From deb395a24f5c01845fee758f782fae8265f5d93d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 21 Apr 2010 09:38:33 +0000
Subject: testing/scst-grsec: new aport

grsec kernel modules for SCST
http://scst.sourceforge.net/
---
 testing/scst-grsec/APKBUILD                 | 62 +++++++++++++++++++++++++++++
 testing/scst-grsec/scst-kernel-2.6.32.patch | 17 ++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 testing/scst-grsec/APKBUILD
 create mode 100644 testing/scst-grsec/scst-kernel-2.6.32.patch

diff --git a/testing/scst-grsec/APKBUILD b/testing/scst-grsec/APKBUILD
new file mode 100644
index 00000000..144cfc07
--- /dev/null
+++ b/testing/scst-grsec/APKBUILD
@@ -0,0 +1,62 @@
+# Contributor: Carlo Landmeter
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+_flavor=${FLAVOR:-grsec}
+_realname=scst
+# source the kernel version
+if [ -f ../../main/linux-$_flavor/APKBUILD ]; then
+	. ../../main/linux-$_flavor/APKBUILD
+fi
+_kver=$pkgver
+_kernelver=$pkgver-r$pkgrel
+_abi_release=$pkgver-${_flavor}
+_kpkgrel=$pkgrel
+
+_realver=1.0.1.1
+pkgname=${_realname}-${_flavor}
+pkgver=$_kver
+_mypkgrel=0
+pkgrel=$(($_kpkgrel + $_mypkgrel))
+pkgdesc="$_flavor kernel modules for SCST $_realver"
+url="http://scst.sourceforge.net/"
+license="GPL-2"
+depends="linux-${_flavor}=${_kernelver}"
+install=
+makedepends="linux-${_flavor}-dev=${_kernelver}"
+subpackages="$pkgname-dev"
+source="http://downloads.sourceforge.net/$_realname/$_realname-$_realver.tar.gz
+	scst-kernel-2.6.32.patch
+	"
+_ksrc=/usr/src/linux-headers-${_abi_release}
+
+_builddir="$srcdir"/$_realname-$_realver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		[ -f "$i" ] || continue
+		msg "Applying $i"
+		patch -p1 -i $i || return 1
+	done
+}
+
+build() {
+	cd "$_builddir"
+	unset ARCH
+	make KDIR="$_ksrc" || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make KDIR="$_ksrc" \
+		INSTALL_MOD_PATH="$pkgdir" \
+		INSTALL_DIR_H="$pkgdir"/usr/include/scst \
+		install || return 1
+}
+
+# we sourced kernel apkbuild above so we need to override the dev() func
+dev() {
+	default_dev
+}
+
+md5sums="38abb5f10325911ff1374535a30a02ad  scst-1.0.1.1.tar.gz
+a87b844b57f997c15c8e0099a313a98e  scst-kernel-2.6.32.patch"
diff --git a/testing/scst-grsec/scst-kernel-2.6.32.patch b/testing/scst-grsec/scst-kernel-2.6.32.patch
new file mode 100644
index 00000000..80fc8610
--- /dev/null
+++ b/testing/scst-grsec/scst-kernel-2.6.32.patch
@@ -0,0 +1,17 @@
+--- scst-1.0.1.1/src/dev_handlers/scst_vdisk.c.orig
++++ scst-1.0.1.1/src/dev_handlers/scst_vdisk.c
+@@ -2071,9 +2071,13 @@
+ 	inode = file->f_dentry->d_inode;
+ 	mapping = file->f_mapping;
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 32)
+ 	res = sync_page_range(inode, mapping, loff, len);
++#else
++	res = filemap_write_and_wait_range(file->f_mapping, loff, len);
++#endif
+ 	if (unlikely(res != 0)) {
+-		PRINT_ERROR("sync_page_range() failed (%d)", res);
++		PRINT_ERROR("sync range failed (%d)", res);
+ 		if (cmd != NULL) {
+ 			scst_set_cmd_error(cmd,
+ 				SCST_LOAD_SENSE(scst_sense_write_error));
-- 
cgit v1.2.3


From 83f962b250b35e5ad6f5c4949ad53cc5e2b5f2c2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 21 Apr 2010 12:14:18 +0000
Subject: main/busybox: patches from upstream

---
 main/busybox/APKBUILD | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/main/busybox/APKBUILD b/main/busybox/APKBUILD
index bd0f178f..e4d1a01c 100644
--- a/main/busybox/APKBUILD
+++ b/main/busybox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=busybox
 pkgver=1.16.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Size optimized toolbox of many common UNIX utilities"
 url=http://busybox.net
 license="GPL-2"
@@ -11,6 +11,10 @@ triggers="busybox.trigger:/bin /usr/bin /sbin /usr/sbin /lib/modules/*"
 source="http://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
 	$pkgname-1.11.1-bb.patch
 	flock-bb.patch
+	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-dnsd.patch
+	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-hwclock.patch
+	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-indexcgi.patch
+	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-sed.patch
 	busyboxconfig"
 
 _builddir="$srcdir"/$pkgname-$pkgver
@@ -54,4 +58,8 @@ package() {
 md5sums="319486ec65078d07fde26eb620fecde7  busybox-1.16.1.tar.bz2
 4c0f3b486eaa0674961b7ddcd0c60a9b  busybox-1.11.1-bb.patch
 20d9beea7d0c0aaca14553a8f98fee12  flock-bb.patch
+9fd18c9833253119996039429bee1992  busybox-1.16.1-dnsd.patch
+b16ad6491dcb4f053f84ae2c4064918d  busybox-1.16.1-hwclock.patch
+c3bc34309334c456b6f905f0708c914f  busybox-1.16.1-indexcgi.patch
+8e1ef2dc70aaaa6f1af1d5e0541de103  busybox-1.16.1-sed.patch
 4bc85af9dd659cbb83c9a819b3481a47  busyboxconfig"
-- 
cgit v1.2.3


From 28d3a986488900f1d15ec23d02f6f264bc8fe692 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 21 Apr 2010 14:03:07 +0000
Subject: main/iscsi-scst-grsec: new aport

grsec ISCSI for SCST
http://scst.sourceforge.net/
---
 testing/iscsi-scst-grsec/APKBUILD       | 60 +++++++++++++++++++++++++++++++++
 testing/iscsi-scst-grsec/config.c.patch | 12 +++++++
 2 files changed, 72 insertions(+)
 create mode 100644 testing/iscsi-scst-grsec/APKBUILD
 create mode 100644 testing/iscsi-scst-grsec/config.c.patch

diff --git a/testing/iscsi-scst-grsec/APKBUILD b/testing/iscsi-scst-grsec/APKBUILD
new file mode 100644
index 00000000..0fae6a74
--- /dev/null
+++ b/testing/iscsi-scst-grsec/APKBUILD
@@ -0,0 +1,60 @@
+# Contributor: Carlo Landmeter
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+_flavor=${FLAVOR:-grsec}
+_realname=iscsi-scst
+# source the kernel version
+if [ -f ../../main/linux-$_flavor/APKBUILD ]; then
+        . ../../main/linux-$_flavor/APKBUILD
+fi
+_kver=$pkgver
+_kernelver=$pkgver-r$pkgrel
+_abi_release=$pkgver-${_flavor}
+_kpkgrel=$pkgrel
+
+_realver=1.0.1.1
+pkgname=${_realname}-${_flavor}
+pkgver=$_kver
+_mypkgrel=0
+pkgrel=$(($_kpkgrel + $_mypkgrel))
+pkgdesc="$_flavor ISCSI for SCST $_realver"
+url="http://scst.sourceforge.net/"
+license="GPL-2"
+depends="linux-${_flavor}=${_kernelver}"
+install=
+makedepends="linux-${_flavor}-dev=${_kernelver} openssl-dev scst-grsec-dev"
+subpackages=
+source="http://downloads.sourceforge.net/scst/$_realname-$_realver.tar.gz
+        config.c.patch
+        "
+_ksrc=/usr/src/linux-headers-${_abi_release}
+
+_builddir="$srcdir"/$_realname-$_realver
+prepare() {
+        cd "$_builddir"
+        for i in "$srcdir"/*.patch; do
+                [ -f "$i" ] || continue
+                msg "Applying $i"
+                patch -p1 -i $i || return 1
+        done
+	# to build mods we need the headre file. fix dependency in makefile
+	sed -i -e 's/^\(mods: .*\)/\1 include\/iscsi_scst_itf_ver.h/' Makefile
+}
+
+build() {
+        cd "$_builddir"
+        unset ARCH
+        make mods \
+		KDIR="$_ksrc" \
+	        SCST_INC_DIR=/usr/include/scst \
+	        || return 1
+}
+
+package() {
+        cd "$_builddir"
+	install -D -m 644 kernel/iscsi-scst.ko \
+	        "$pkgdir"/lib/modules/$_abi_release/extra/iscsi-scst.ko
+}
+
+md5sums="56109c01e3d4421a36d6f47efa1fb0d5  iscsi-scst-1.0.1.1.tar.gz
+48e21e3466fd819418f29e3b2487f052  config.c.patch"
diff --git a/testing/iscsi-scst-grsec/config.c.patch b/testing/iscsi-scst-grsec/config.c.patch
new file mode 100644
index 00000000..e3b15232
--- /dev/null
+++ b/testing/iscsi-scst-grsec/config.c.patch
@@ -0,0 +1,12 @@
+--- iscsi-scst/kernel/config.c	2009/05/11 17:24:51	841
++++ iscsi-scst/kernel/config.c	2009/07/08 17:27:30	938
+@@ -203,7 +203,9 @@
+ 		goto out;
+ 	}
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 30)
+ 	proc_iscsi_dir->owner = THIS_MODULE;
++#endif
+ 
+ 	err = iscsi_proc_log_entry_build(&iscsi_template);
+ 	if (err < 0)
-- 
cgit v1.2.3


From 78834aed72ecf339da0d48c94c5329af7ea35e6c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 21 Apr 2010 14:32:02 +0000
Subject: testing/iscsi-scst: new aport

ISCSI target for SCST - userspace tools
http://iscsi-scst.sourceforge.net/
---
 testing/iscsi-scst/APKBUILD         | 39 +++++++++++++++++++++++++++++++++++++
 testing/iscsi-scst/iscsi-scst.initd | 23 ++++++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100644 testing/iscsi-scst/APKBUILD
 create mode 100644 testing/iscsi-scst/iscsi-scst.initd

diff --git a/testing/iscsi-scst/APKBUILD b/testing/iscsi-scst/APKBUILD
new file mode 100644
index 00000000..9f373ea5
--- /dev/null
+++ b/testing/iscsi-scst/APKBUILD
@@ -0,0 +1,39 @@
+# Contributor: Carlo Landmeter
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+pkgname=iscsi-scst
+pkgver=1.0.1.1
+pkgrel=0
+pkgdesc="ISCSI target for SCST - userspace tools"
+url="http://iscsi-scst.sourceforge.net/"
+license="GPL-2"
+depends=
+install=
+makedepends="openssl-dev"
+subpackages=
+source="http://downloads.sourceforge.net/scst/$pkgname-$pkgver.tar.gz
+	iscsi-scst.initd
+        "
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+        cd "$_builddir"
+	# we need the headre file. fix dependency in makefile
+	sed -i -e 's/^\(progs:.*\)/\1 include\/iscsi_scst_itf_ver.h/' Makefile
+}
+
+build() {
+        cd "$_builddir"
+        make progs
+}
+
+package() {
+        cd "$_builddir"
+	# make install is broken
+	install -D usr/iscsi-scstd "$pkgdir"/usr/sbin/iscsi-scstd
+	install -D usr/iscsi-scst-adm "$pkgdir"/iscsi-scst-adm
+	install -D -m 755 "$srcdir"/iscsi-scst.initd "$pkgdir"/etc/init.d/iscsi-scst
+}
+
+md5sums="56109c01e3d4421a36d6f47efa1fb0d5  iscsi-scst-1.0.1.1.tar.gz
+3132fae1ec2f9bcc72476d9e9f36d326  iscsi-scst.initd"
diff --git a/testing/iscsi-scst/iscsi-scst.initd b/testing/iscsi-scst/iscsi-scst.initd
new file mode 100644
index 00000000..4d4cd76b
--- /dev/null
+++ b/testing/iscsi-scst/iscsi-scst.initd
@@ -0,0 +1,23 @@
+#!/sbin/runscript
+#
+# Start the iSCSI-SCST Target.
+#
+
+depend() {
+	need net
+	afer firewall
+}
+
+start() {
+	modprobe -q crc32c
+	modprobe -q iscsi-scst
+	ebegin "Starting iscsi-scstd"
+	start-stop-daemon --start --exec /usr/sbin/iscsi-scstd
+	eend 0
+}
+
+stop() {
+	ebegin "Stopping iscsi-scstd"
+	start-stop-daemon --stop --exec /usr/sbin/iscsi-scstd
+	eend 0
+}
-- 
cgit v1.2.3


From c748ef25ff1d236ac2f9410df0a77124c3f59b67 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 21 Apr 2010 15:05:20 +0000
Subject: testing/freeswitch: enable debugging

---
 testing/freeswitch/APKBUILD | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/testing/freeswitch/APKBUILD b/testing/freeswitch/APKBUILD
index 7b1a4ea9..fd024b64 100644
--- a/testing/freeswitch/APKBUILD
+++ b/testing/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.4
-pkgrel=2
+pkgrel=3
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
@@ -18,6 +18,7 @@ source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
 	freeswitch.pre-install
 	freeswitch.post-deinstall
 	"
+options="!strip"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
@@ -26,6 +27,7 @@ build() {
 	# i think our max cmd len is 32768
 	# by specifying it here we save our selves from some CPU cycles
 	export lt_cv_sys_max_cmd_len=8192
+	export CFLAGS="-g"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/freeswitch \
-- 
cgit v1.2.3


From 32abc98b7b0f30667f37574d180e01649cd2cb2d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 22 Apr 2010 06:29:23 +0000
Subject: main/djbdns: fix dnscache update hints

---
 main/djbdns/APKBUILD         | 6 +++---
 main/djbdns/dnscache.monthly | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/djbdns/APKBUILD b/main/djbdns/APKBUILD
index a9895c23..2d825352 100644
--- a/main/djbdns/APKBUILD
+++ b/main/djbdns/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=djbdns
 pkgver=1.05
-pkgrel=33
+pkgrel=34
 pkgdesc="Excellent high-performance DNS services"
 url="http://cr.yp.to/djbdns.html"
 license="public-domain"
@@ -50,7 +50,7 @@ common() {
 	replaces="djbdns"
 
 	mkdir -p "$subpkgdir"/usr/bin
-	mv "$pkgdir"/usr/bin/dnsq "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/dnsqr "$subpkgdir"/usr/bin
 	mv "$pkgdir"/usr/bin/dnsip "$subpkgdir"/usr/bin
 }
 
@@ -101,4 +101,4 @@ fe48165a920cf843ceb9a4ee50bf74c0  tinydns.initd
 e09c3a6ba6917e16f4736ab5c070dbe9  dnscache.pre-install
 e5cada3b032da84c4a0e41ef8b3108cb  dnscache.initd
 2b3d02e88f70603c760bf368ab3ed636  dnscache.confd
-6253f44f042fc5aa31fd182780d9853c  dnscache.monthly"
+7d02c68b683749f5ed5bb67dd8e8ebc6  dnscache.monthly"
diff --git a/main/djbdns/dnscache.monthly b/main/djbdns/dnscache.monthly
index 0bd5a853..664b3768 100755
--- a/main/djbdns/dnscache.monthly
+++ b/main/djbdns/dnscache.monthly
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-if [ -f ./etc/conf.d/dnscache ]; then
+if [ -f /etc/conf.d/dnscache ]; then
 	. /etc/conf.d/dnscache
 fi
 
-- 
cgit v1.2.3


From 6645fef357b5df23c46a7397861e357c975708bd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 22 Apr 2010 08:28:32 +0000
Subject: main/djbdns: dnscache: restart service quietly from cronjob

---
 main/djbdns/APKBUILD         | 4 ++--
 main/djbdns/dnscache.monthly | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/djbdns/APKBUILD b/main/djbdns/APKBUILD
index 2d825352..976afa3f 100644
--- a/main/djbdns/APKBUILD
+++ b/main/djbdns/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=djbdns
 pkgver=1.05
-pkgrel=34
+pkgrel=35
 pkgdesc="Excellent high-performance DNS services"
 url="http://cr.yp.to/djbdns.html"
 license="public-domain"
@@ -101,4 +101,4 @@ fe48165a920cf843ceb9a4ee50bf74c0  tinydns.initd
 e09c3a6ba6917e16f4736ab5c070dbe9  dnscache.pre-install
 e5cada3b032da84c4a0e41ef8b3108cb  dnscache.initd
 2b3d02e88f70603c760bf368ab3ed636  dnscache.confd
-7d02c68b683749f5ed5bb67dd8e8ebc6  dnscache.monthly"
+805b6989f945d727788f1908fe3fce81  dnscache.monthly"
diff --git a/main/djbdns/dnscache.monthly b/main/djbdns/dnscache.monthly
index 664b3768..4e53fd6f 100755
--- a/main/djbdns/dnscache.monthly
+++ b/main/djbdns/dnscache.monthly
@@ -42,7 +42,7 @@ for ZONEFILE in $ZONES; do
 done
 
 if [ "$NEEDRESTART" ] && /etc/init.d/dnscache --quiet status; then
-	/etc/init.d/dnscache restart
+	/etc/init.d/dnscache --quiet restart
 fi
 
 exit 0
-- 
cgit v1.2.3


From 3276e925833aa78a9dcce9819b63fd6876ec3751 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 22 Apr 2010 09:43:27 +0000
Subject: main/busybox-initscripts: minor mdev fixes

got hints from solar
---
 main/busybox-initscripts/APKBUILD  | 6 +++---
 main/busybox-initscripts/mdev.conf | 5 ++++-
 main/busybox-initscripts/usbdev    | 8 ++++----
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/main/busybox-initscripts/APKBUILD b/main/busybox-initscripts/APKBUILD
index c0d01f1e..4b9402af 100644
--- a/main/busybox-initscripts/APKBUILD
+++ b/main/busybox-initscripts/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=busybox-initscripts
 pkgver=2.0
-pkgrel=11
+pkgrel=12
 pkgdesc="Init scripts for busybox daemons"
 url="http://git.alpinelinux.org/cgit/aports/tree/core/busybox-initscripts"
 license="GPL-2"
@@ -55,9 +55,9 @@ b5b23dd06cea120bd8d850b54bca0b59  syslog.initd
 22adbf155ffc4595206ded6daad07812  rdate.confd
 77fb31a75511247bf4e3430565a276bc  syslog.confd
 0bb55dde32f5e119111fa4938daaef3d  watchdog.confd
-c3eb08c577384154fdf748f1db06f8db  mdev.conf
+c514213ed7e56c64c44be3285d34a297  mdev.conf
 ad1556961294e4aa2abca6be52138b7c  dvbdev
 5c8725b4cbdeda23b00f08124a0d20bf  ide_links
-1acfd58dfd1cf324c90ca3a3be519510  usbdev
+c422992ca5bfdfabdbba1f1532bc1358  usbdev
 30b0c85956b6701caf55309a17e537f6  usbdisk_link
 826d85313ca7a4a0205d63bd58b7d01f  xvd_links"
diff --git a/main/busybox-initscripts/mdev.conf b/main/busybox-initscripts/mdev.conf
index 5a86a9cd..ce6aa4e9 100644
--- a/main/busybox-initscripts/mdev.conf
+++ b/main/busybox-initscripts/mdev.conf
@@ -17,7 +17,10 @@ urandom	root:root 0444
 hwrandom root:root 0660
 
 # console does already exist; therefore ownership has to be changed with command
-console	root:tty 0600	@chmod 600 $MDEV && mkdir -p vc && ln -sf ../$MDEV vc/0
+#console	root:tty 0600	@chmod 600 $MDEV && mkdir -p vc && ln -sf ../$MDEV vc/0
+console root:tty 0600 @mkdir -pm 755 fd && cd fd && for x in 0 1 2 3 ; do ln -sf /proc/self/fd/$x $x; done
+
+
 fd0	root:floppy 0660
 kmem	root:root 0640
 mem	root:root 0640
diff --git a/main/busybox-initscripts/usbdev b/main/busybox-initscripts/usbdev
index b1aff296..ea5b9155 100644
--- a/main/busybox-initscripts/usbdev
+++ b/main/busybox-initscripts/usbdev
@@ -15,13 +15,13 @@ add_zeros () {
 
 
 # bus and device dirs in /sys
-local USB_PATH=$(echo $MDEV | sed -e 's/usbdev\([0-9]\).[0-9]/usb\1/')
+USB_PATH=$(echo $MDEV | sed -e 's/usbdev\([0-9]\).[0-9]/usb\1/')
 USB_PATH=$(find /sys/devices -type d -name "$USB_PATH")
-local USB_DEV_DIR=$(echo $MDEV | sed -e 's/usbdev\([0-9]\).\([0-9]\)/\1-\2/')
+USB_DEV_DIR=$(echo $MDEV | sed -e 's/usbdev\([0-9]\).\([0-9]\)/\1-\2/')
 
 # dir names in /dev
-local BUS=$(add_zeros $(echo $MDEV | sed -e 's/^usbdev\([0-9]\).[0-9]/\1/'))
-local USB_DEV=$(add_zeros $(echo $MDEV | sed -e 's/^usbdev[0-9].\([0-9]\)/\1/'))
+BUS=$(add_zeros $(echo $MDEV | sed -e 's/^usbdev\([0-9]\).[0-9]/\1/'))
+USB_DEV=$(add_zeros $(echo $MDEV | sed -e 's/^usbdev[0-9].\([0-9]\)/\1/'))
 
 
 # try to load the proper driver for usb devices
-- 
cgit v1.2.3


From 94935276452af6872606af02e5cdcec82ba6761d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 22 Apr 2010 12:49:45 +0000
Subject: testing/freeswitch: upgrade to 1.0.6

---
 testing/freeswitch/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testing/freeswitch/APKBUILD b/testing/freeswitch/APKBUILD
index fd024b64..b9fd3558 100644
--- a/testing/freeswitch/APKBUILD
+++ b/testing/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
-pkgver=1.0.4
-pkgrel=3
+pkgver=1.0.6
+pkgrel=0
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
@@ -57,7 +57,7 @@ package(){
 	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
 }
 
-md5sums="86e34bdd8cc027d71772cb0dc51388da  freeswitch-1.0.4.tar.gz
+md5sums="388effee587887a81fe7f411b7350590  freeswitch-1.0.6.tar.gz
 c05f2356be159e99b3845f5260a33599  modules.conf
 c608cca8ad773acebf201f581438c7e7  freeswitch.confd
 dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
-- 
cgit v1.2.3


From 1577216ae207699aa26a1aebd349da99764bf6f1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 23 Apr 2010 11:04:31 +0000
Subject: main/busybox: provide subpackage with static binary

---
 main/busybox/APKBUILD | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/main/busybox/APKBUILD b/main/busybox/APKBUILD
index e4d1a01c..51813602 100644
--- a/main/busybox/APKBUILD
+++ b/main/busybox/APKBUILD
@@ -1,12 +1,13 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=busybox
 pkgver=1.16.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Size optimized toolbox of many common UNIX utilities"
 url=http://busybox.net
 license="GPL-2"
 depends=
 install="$pkgname.post-install $pkgname.post-upgrade"
+subpackages="$pkgname-static"
 triggers="busybox.trigger:/bin /usr/bin /sbin /usr/sbin /lib/modules/*"
 source="http://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
 	$pkgname-1.11.1-bb.patch
@@ -18,6 +19,7 @@ source="http://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
 	busyboxconfig"
 
 _builddir="$srcdir"/$pkgname-$pkgver
+_config="$srcdir"/busyboxconfig
 prepare() {
 	cd "$_builddir"
 	#patches
@@ -32,29 +34,43 @@ prepare() {
 	sed -i	-e 's/(ip, _BB_DIR_BIN/(ip, _BB_DIR_SBIN/' \
 		-e 's/(vi, _BB_DIR_BIN/(vi, _BB_DIR_USR_BIN/' \
 		include/applets.h || return 1
-
-	# we set the install prefix with sed since it might differ depending
-	# on abuild version
-	sed -e "s:^CONFIG_PREFIX=.*:CONFIG_PREFIX=\"$pkgdir\":" \
-		../busyboxconfig > .config
 }
 
 build() {
 	cd "$_builddir"
+	msg "Building static busybox"
+	sed -e "s/.*CONFIG_PIE.*/\# CONFIG_PIE is not set/" \
+		-e "s/.*CONFIG_STATIC.*/CONFIG_STATIC=y/" \
+		"$_config" > .config
+	make silentoldconfig || return 1
+	make || return 1
+	mv busybox busybox.static
+
+	# build dynamic
+	msg "Building dynamic busybox"
+	cp "$_config" .config
 	make silentoldconfig || return 1
 	make || return 1
 }
 
 package() {
 	cd "$_builddir"
-	make install DESTDIR="$pkgdir"
 	mkdir -p "$pkgdir"/usr/sbin "$pkgdir"/usr/bin "$pkgdir"/tmp \
-		"$pkgdir"/var/cache/misc
+		"$pkgdir"/var/cache/misc "$pkgdir"/bin "$pkgdir"/sbin
 	chmod 1777 "$pkgdir"/tmp
+	install -m755 busybox "$pkgdir"/bin/busybox
 	# we need /bin/sh to be able to execute post-install
 	ln -s /bin/busybox "$pkgdir"/bin/sh
 }
 
+static() {
+	triggers=	
+	mkdir -p "$subpkgdir"/bin
+	install -m755 "$_builddir"/busybox.static \
+		"$subpkgdir"/bin/busybox.static
+	
+}
+
 md5sums="319486ec65078d07fde26eb620fecde7  busybox-1.16.1.tar.bz2
 4c0f3b486eaa0674961b7ddcd0c60a9b  busybox-1.11.1-bb.patch
 20d9beea7d0c0aaca14553a8f98fee12  flock-bb.patch
-- 
cgit v1.2.3


From aa790e1c40c36c106884182c9fe15dabad77177d Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Fri, 23 Apr 2010 13:04:25 +0000
Subject: testing/open-iscsi: init script busybox compatibility fix

---
 testing/open-iscsi/iscsid-2.0.871-r1.init.d | 127 ----------------------------
 testing/open-iscsi/iscsid.initd             | 124 +++++++++++++++++++++++++++
 2 files changed, 124 insertions(+), 127 deletions(-)
 delete mode 100644 testing/open-iscsi/iscsid-2.0.871-r1.init.d
 create mode 100644 testing/open-iscsi/iscsid.initd

diff --git a/testing/open-iscsi/iscsid-2.0.871-r1.init.d b/testing/open-iscsi/iscsid-2.0.871-r1.init.d
deleted file mode 100644
index 060eb9b5..00000000
--- a/testing/open-iscsi/iscsid-2.0.871-r1.init.d
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/sbin/runscript
-# Copyright 1999-2008 Gentoo Technologies, Inc.
-# Distributed under the terms of the GNU General Public License, v2 or later
-# $Header: /var/www/viewcvs.gentoo.org/raw_cvs/gentoo-x86/sys-block/open-iscsi/files/iscsid-2.0.871-r1.init.d,v 1.1 2009/11/12 09:29:48 robbat2 Exp $
-
-opts="${opts} starttargets stoptargets restarttargets"
-
-depend() {
-	after modules
-	use net
-}
-
-checkconfig() {
-	if [ ! -e /etc/conf.d/${SVCNAME} ]; then
-		eerror "Config file /etc/conf.d/${SVCNAME} does not exist!"
-		return 1
-	fi
-	if [ ! -e "${CONFIG_FILE}" ]; then
-		eerror "Config file ${CONFIG_FILE} does not exist!"
-		return 1
-	fi
-	if [ ! -e ${INITIATORNAME_FILE} ] || [ ! "$(grep "^InitiatorName=iqn\." ${INITIATORNAME_FILE})" ]; then
-		ewarn "${INITIATORNAME_FILE} should contain a string with your initiatior name."
-		IQN=iqn.$(date +%Y-%m).$(hostname -f | awk 'BEGIN { FS=".";}{x=NF; while (x>0) {printf $x ;x--; if (x>0) printf ".";} print ""}'):openiscsi
-		IQN=${IQN}-$(echo ${RANDOM}${RANDOM}${RANDOM}${RANDOM}${RANDOM} | md5sum | sed -e "s/\(.*\) -/\1/g" -e 's/ //g')
-		ebegin "Creating InitiatorName ${IQN} in ${INITIATORNAME_FILE}"
-		echo "InitiatorName=${IQN}" >> "${INITIATORNAME_FILE}"
-		eend $?
-	fi
-}
-
-do_modules() {
-	msg="$1"
-	shift
-	modules="${1}"
-	shift
-	modopts="$@"
-	for m in ${modules}
-	do
-		if [ -n "$(modprobe -l | grep ${m})" ]
-		then
-			ebegin "${msg} ${m}"
-			modprobe ${modopts} ${m}
-			ret=$?
-			eend ${ret}
-			if [ ${ret} -ne 0 ]; then
-				return ${ret}
-			fi
-		else
-			ebegin "${msg} ${m}: not found"
-			return 1
-		fi
-	done
-	return 0
-}
-
-start() {
-	ebegin "Checking open-iSCSI configuration"
-	checkconfig
-	ret=$?
-	if [ $ret -ne 0 ]; then
-		eend 1
-		return 1
-	fi
-	ebegin "Loading iSCSI modules"
-	do_modules 'Loading' 'libiscsi scsi_transport_iscsi iscsi_tcp'
-	ret=$?
-	if [ $ret -ne 0 ]; then
-		eend 1
-		return 1
-	fi
-
-	ebegin "Starting ${SVCNAME}"
-	start-stop-daemon --start --quiet --exec /usr/sbin/iscsid -- ${OPTS}
-	ret=$?
-	if [ $ret -ne 0 ]; then
-		eend $?
-		return $?
-	fi
-
-	# Start automatic targets when iscsid is started
-	if [ "${AUTOSTARTTARGETS}" = "yes" ]; then
-		starttargets
-		return $?
-	fi
-	return 0
-}
-	
-stop() {
-	stoptargets
-	ebegin "Stopping ${SVCNAME}"
-	start-stop-daemon --signal HUP --stop --quiet --exec /usr/sbin/iscsid #--pidfile $PID_FILE
-	eend $?
-
-	# ugly, but pid file is not removed by iscsid
-	rm -f $PID_FILE
-	
-	do_modules 'Removing iSCSI modules' 'iscsi_tcp scsi_transport_iscsi libiscsi' '-r'
-	eend $?
-}
-
-starttargets() {
-        ebegin "Setting up iSCSI targets"
-        /usr/bin/iscsiadm -m node --loginall=automatic
-		ret=$?
-        eend $ret
-		return $ret
-}
-
-stoptargets() {
-        ebegin "Disconnecting iSCSI targets"
-        sync
-        /usr/bin/iscsiadm -m node --logoutall=all
-		ret=$?
-        eend $ret
-		return $ret
-}
-
-restarttargets() {
-        stoptargets
-        starttargets
-}
-
-status() {
-	ebegin "Showing current active iSCSI sessions"
-	/usr/bin/iscsiadm -m session
-}
diff --git a/testing/open-iscsi/iscsid.initd b/testing/open-iscsi/iscsid.initd
new file mode 100644
index 00000000..572b0a6a
--- /dev/null
+++ b/testing/open-iscsi/iscsid.initd
@@ -0,0 +1,124 @@
+#!/sbin/runscript
+
+opts="${opts} starttargets stoptargets restarttargets"
+
+depend() {
+	after modules
+	use net
+}
+
+checkconfig() {
+	if [ ! -e /etc/conf.d/${SVCNAME} ]; then
+		eerror "Config file /etc/conf.d/${SVCNAME} does not exist!"
+		return 1
+	fi
+	if [ ! -e "${CONFIG_FILE}" ]; then
+		eerror "Config file ${CONFIG_FILE} does not exist!"
+		return 1
+	fi
+	if [ ! -e ${INITIATORNAME_FILE} ] || [ ! "$(grep "^InitiatorName=iqn\." ${INITIATORNAME_FILE})" ]; then
+		ewarn "${INITIATORNAME_FILE} should contain a string with your initiatior name."
+		IQN=iqn.$(date +%Y-%m).$(hostname -f | awk 'BEGIN { FS=".";}{x=NF; while (x>0) {printf $x ;x--; if (x>0) printf ".";} print ""}'):openiscsi
+		IQN=${IQN}-$(echo ${RANDOM}${RANDOM}${RANDOM}${RANDOM}${RANDOM} | md5sum | sed -e "s/\(.*\) -/\1/g" -e 's/ //g')
+		ebegin "Creating InitiatorName ${IQN} in ${INITIATORNAME_FILE}"
+		echo "InitiatorName=${IQN}" >> "${INITIATORNAME_FILE}"
+		eend $?
+	fi
+}
+
+do_modules() {
+	msg="$1"
+	shift
+	modules="${1}"
+	shift
+	modopts="$@"
+	for m in ${modules}
+	do
+		if [ -n "$(find /lib/modules/`uname -r` | grep ${m})" ]
+		then
+			ebegin "${msg} ${m}"
+			modprobe ${modopts} ${m}
+			ret=$?
+			eend ${ret}
+			if [ ${ret} -ne 0 ]; then
+				return ${ret}
+			fi
+		else
+			ebegin "${msg} ${m}: not found"
+			return 1
+		fi
+	done
+	return 0
+}
+
+start() {
+	ebegin "Checking open-iSCSI configuration"
+	checkconfig
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eend 1
+		return 1
+	fi
+	ebegin "Loading iSCSI modules"
+	do_modules 'Loading' 'libiscsi scsi_transport_iscsi iscsi_tcp'
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eend 1
+		return 1
+	fi
+
+	ebegin "Starting ${SVCNAME}"
+	start-stop-daemon --start --quiet --exec /usr/sbin/iscsid -- ${OPTS}
+	ret=$?
+	if [ $ret -ne 0 ]; then
+		eend $?
+		return $?
+	fi
+
+	# Start automatic targets when iscsid is started
+	if [ "${AUTOSTARTTARGETS}" = "yes" ]; then
+		starttargets
+		return $?
+	fi
+	return 0
+}
+	
+stop() {
+	stoptargets
+	ebegin "Stopping ${SVCNAME}"
+	start-stop-daemon --signal HUP --stop --quiet --exec /usr/sbin/iscsid #--pidfile $PID_FILE
+	eend $?
+
+	# ugly, but pid file is not removed by iscsid
+	rm -f $PID_FILE
+	
+	do_modules 'Removing iSCSI modules' 'iscsi_tcp scsi_transport_iscsi libiscsi' '-r'
+	eend $?
+}
+
+starttargets() {
+        ebegin "Setting up iSCSI targets"
+        /usr/bin/iscsiadm -m node --loginall=automatic
+		ret=$?
+        eend $ret
+		return $ret
+}
+
+stoptargets() {
+        ebegin "Disconnecting iSCSI targets"
+        sync
+        /usr/bin/iscsiadm -m node --logoutall=all
+		ret=$?
+        eend $ret
+		return $ret
+}
+
+restarttargets() {
+        stoptargets
+        starttargets
+}
+
+status() {
+	ebegin "Showing current active iSCSI sessions"
+	/usr/bin/iscsiadm -m session
+}
-- 
cgit v1.2.3


From dfb08231f9794fa46cc8b7053e31d0ef08132c8b Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Fri, 23 Apr 2010 13:30:02 +0000
Subject: testing/open-iscsi: pkgrel +1

---
 testing/open-iscsi/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/open-iscsi/APKBUILD b/testing/open-iscsi/APKBUILD
index c74cf269..508235b5 100644
--- a/testing/open-iscsi/APKBUILD
+++ b/testing/open-iscsi/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=open-iscsi
 pkgver=2.0.871
 _realver=2.0-871
-pkgrel=0
+pkgrel=1
 pkgdesc="High performance, transport independent, multi-platform iSCSI initiator"
 url="http://www.open-iscsi.org"
 license="GPL-2"
-- 
cgit v1.2.3


From 30a54def351fec6d44d413828182cf4e9c203149 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 23 Apr 2010 13:32:52 +0000
Subject: testing/freeswitch: rebuild without debugging

the 1.0.6 seems to fix the issues
---
 testing/freeswitch/APKBUILD | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/testing/freeswitch/APKBUILD b/testing/freeswitch/APKBUILD
index b9fd3558..4659f4f5 100644
--- a/testing/freeswitch/APKBUILD
+++ b/testing/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
@@ -18,7 +18,6 @@ source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
 	freeswitch.pre-install
 	freeswitch.post-deinstall
 	"
-options="!strip"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
@@ -27,7 +26,6 @@ build() {
 	# i think our max cmd len is 32768
 	# by specifying it here we save our selves from some CPU cycles
 	export lt_cv_sys_max_cmd_len=8192
-	export CFLAGS="-g"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/freeswitch \
-- 
cgit v1.2.3


From a8865bca760dc6b1ac64b8bb8dacbf75e6d69847 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Fri, 23 Apr 2010 13:44:13 +0000
Subject: testing/open-iscsi: install init and checksum update

---
 testing/open-iscsi/APKBUILD | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/testing/open-iscsi/APKBUILD b/testing/open-iscsi/APKBUILD
index 508235b5..ca7bbda1 100644
--- a/testing/open-iscsi/APKBUILD
+++ b/testing/open-iscsi/APKBUILD
@@ -12,7 +12,8 @@ install=""
 subpackages="$pkgname-doc"
 source="http://www.open-iscsi.org/bits/$pkgname-$_realver.tar.gz
 	CVE-2009-1297.patch
-	open-iscsi-2.0.871-makefile-cleanup.patch"
+	open-iscsi-2.0.871-makefile-cleanup.patch
+	iscsid.initd"
 
 _builddir="$srcdir"/$pkgname-$_realver
 
@@ -36,9 +37,10 @@ package() {
 	mv $pkgdir/sbin/iscsi_discovery $pkgdir/usr/bin
 	mv $pkgdir/sbin/iscsiadm $pkgdir/usr/bin
 	mv $pkgdir/sbin/iscsid $pkgdir/usr/sbin
-	install -Dm755 ../../iscsid-2.0.871-r1.init.d "$pkgdir"/etc/init.d/iscsid
+	install -Dm755 ../../iscsid.initd "$pkgdir"/etc/init.d/iscsid
 }
 
 md5sums="0c403e8c9ad41607571ba0e6e8ff196e  open-iscsi-2.0-871.tar.gz
 d1584790b4e12f087e60089880b53d2b  CVE-2009-1297.patch
-734300d7b7590dc9ae9b2fb7f5b51bf0  open-iscsi-2.0.871-makefile-cleanup.patch"
+734300d7b7590dc9ae9b2fb7f5b51bf0  open-iscsi-2.0.871-makefile-cleanup.patch
+3e89cb86395756dafebc4f1490f0de10  iscsid.initd"
-- 
cgit v1.2.3


From 15d5070c984e5d206de86a34831ae25e396f7a3b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 23 Apr 2010 14:35:55 +0000
Subject: main/freeswitch: moved from testing

---
 main/freeswitch/APKBUILD                     | 64 ++++++++++++++++++++++++
 main/freeswitch/freeswitch.confd             | 25 ++++++++++
 main/freeswitch/freeswitch.initd             | 33 ++++++++++++
 main/freeswitch/freeswitch.post-deinstall    |  4 ++
 main/freeswitch/freeswitch.post-install      |  5 ++
 main/freeswitch/freeswitch.pre-install       |  4 ++
 main/freeswitch/modules.conf                 | 75 ++++++++++++++++++++++++++++
 testing/freeswitch/APKBUILD                  | 64 ------------------------
 testing/freeswitch/freeswitch.confd          | 25 ----------
 testing/freeswitch/freeswitch.initd          | 33 ------------
 testing/freeswitch/freeswitch.post-deinstall |  4 --
 testing/freeswitch/freeswitch.post-install   |  5 --
 testing/freeswitch/freeswitch.pre-install    |  4 --
 testing/freeswitch/modules.conf              | 75 ----------------------------
 14 files changed, 210 insertions(+), 210 deletions(-)
 create mode 100644 main/freeswitch/APKBUILD
 create mode 100644 main/freeswitch/freeswitch.confd
 create mode 100755 main/freeswitch/freeswitch.initd
 create mode 100755 main/freeswitch/freeswitch.post-deinstall
 create mode 100755 main/freeswitch/freeswitch.post-install
 create mode 100755 main/freeswitch/freeswitch.pre-install
 create mode 100644 main/freeswitch/modules.conf
 delete mode 100644 testing/freeswitch/APKBUILD
 delete mode 100644 testing/freeswitch/freeswitch.confd
 delete mode 100755 testing/freeswitch/freeswitch.initd
 delete mode 100755 testing/freeswitch/freeswitch.post-deinstall
 delete mode 100755 testing/freeswitch/freeswitch.post-install
 delete mode 100755 testing/freeswitch/freeswitch.pre-install
 delete mode 100644 testing/freeswitch/modules.conf

diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
new file mode 100644
index 00000000..4659f4f5
--- /dev/null
+++ b/main/freeswitch/APKBUILD
@@ -0,0 +1,64 @@
+# Contributor: Michael Mason <ms13sp@gmail.com>
+pkgname=freeswitch
+pkgver=1.0.6
+pkgrel=1
+pkgdesc="A communications platform written in C from the ground up"
+url="http://www.freeswitch.org"
+license="GPL"
+depends=""
+makedepends="curl-dev unixodbc-dev zlib-dev openssl-dev
+	autoconf automake libtool"
+install=
+subpackages="$pkgname-dev"
+source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
+	modules.conf
+	freeswitch.confd
+	freeswitch.initd
+	freeswitch.post-install
+	freeswitch.pre-install
+	freeswitch.post-deinstall
+	"
+
+build() {
+	cd "$srcdir/$pkgname-$pkgver"
+	cp -f "$srcdir/modules.conf" modules.conf || return 1
+
+	# i think our max cmd len is 32768
+	# by specifying it here we save our selves from some CPU cycles
+	export lt_cv_sys_max_cmd_len=8192
+
+	./configure --prefix=/usr \
+		--sysconfdir=/etc/freeswitch \
+		--with-modinstdir=/usr/lib/freeswitch \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+
+	# check how/when parallel builds are fixed here:
+	# http://jira.freeswitch.org/browse/FSBUILD-6
+
+	# build the libs and prerequisites in parallel first
+	make libs/apr/libapr-1.la \
+		libs/apr-util/libaprutil-1.la \
+		libs/speex/libspeex/libspeexdsp.la \
+		libs/sqlite/libsqlite3.la \
+		libs/pcre/libpcre.la \
+		libs/srtp/libsrtp.la \
+		src/include/switch_version.h
+
+	# then the rest should build in parallel too
+	make || return 1
+}
+package(){
+	cd "$srcdir/$pkgname-$pkgver"
+	make -j1 DESTDIR="$pkgdir" install
+	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+}
+
+md5sums="388effee587887a81fe7f411b7350590  freeswitch-1.0.6.tar.gz
+c05f2356be159e99b3845f5260a33599  modules.conf
+c608cca8ad773acebf201f581438c7e7  freeswitch.confd
+dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
+c0d7ad55063b1f62c9a2fcfa37b2fc0a  freeswitch.post-install
+a34305ba1f8a8e7e6dbb9c678cc442b9  freeswitch.pre-install
+a7188703019a74fd7f128d165b3ecf42  freeswitch.post-deinstall"
diff --git a/main/freeswitch/freeswitch.confd b/main/freeswitch/freeswitch.confd
new file mode 100644
index 00000000..378e4b41
--- /dev/null
+++ b/main/freeswitch/freeswitch.confd
@@ -0,0 +1,25 @@
+#
+# FreeSWITCH startup configuration
+#
+
+# freeswitch will be running with this userid
+FREESWITCH_USER="freeswitch"
+
+
+# optional: group the freeswitch process should be running with
+#
+# (note: without this option freeswitch will be using all groups
+#  the user in FREESWITCH_USER is a member of)
+#
+#FREESWITCH_GROUP="freeswitch"
+
+
+
+# optional: other options, e.g.
+#
+# -hp	Use realtime priority and protect freeswitch
+#       process from being swapped to disk
+#       (warning: dangerous on machines with little ram!)
+#
+#FREESWITCH_OPTS=""
+
diff --git a/main/freeswitch/freeswitch.initd b/main/freeswitch/freeswitch.initd
new file mode 100755
index 00000000..84381d77
--- /dev/null
+++ b/main/freeswitch/freeswitch.initd
@@ -0,0 +1,33 @@
+#!/sbin/runscript
+# Copyright 2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License, v2 or later
+# $Header: $
+
+depend() {
+    need net
+}
+
+start() {
+    local OPTS
+
+    [ -n "${FREESWITCH_USER}" ] && \
+        OPTS="${OPTS} -u ${FREESWITCH_USER}" 
+
+    [ -n "${FREESWITCH_GROUP}" ] && \
+        OPTS="${OPTS} -g ${FREESWITCH_GROUP}" 
+
+    [ -n "${FREESWITCH_OPTS}" ] && \
+        OPTS="${OPTS} ${FREESWITCH_OPTS}" 
+
+    ebegin "Starting Freeswitch" 
+    start-stop-daemon --start --quiet --exec /usr/bin/freeswitch \
+        --pidfile /var/run/freeswitch.pid -- -nc ${OPTS}
+    eend $?
+}
+
+stop() {
+    ebegin "Stopping Freeswitch" 
+    start-stop-daemon --stop --quiet --pidfile /var/run/freeswitch.pid
+    eend $?
+}
+
diff --git a/main/freeswitch/freeswitch.post-deinstall b/main/freeswitch/freeswitch.post-deinstall
new file mode 100755
index 00000000..5ec871cb
--- /dev/null
+++ b/main/freeswitch/freeswitch.post-deinstall
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+deluser freeswitch
+delgroup freeswitch
diff --git a/main/freeswitch/freeswitch.post-install b/main/freeswitch/freeswitch.post-install
new file mode 100755
index 00000000..3b1c414c
--- /dev/null
+++ b/main/freeswitch/freeswitch.post-install
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+chown -R freeswitch:freeswitch /etc/freeswitch/
+chown -R freeswitch:freeswitch /var/run/freeswitch/
+
diff --git a/main/freeswitch/freeswitch.pre-install b/main/freeswitch/freeswitch.pre-install
new file mode 100755
index 00000000..b8065b52
--- /dev/null
+++ b/main/freeswitch/freeswitch.pre-install
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+adduser -h /dev/null -s /bin/false -D freeswitch 2>/dev/null
+mkdir /var/run/freeswitch
diff --git a/main/freeswitch/modules.conf b/main/freeswitch/modules.conf
new file mode 100644
index 00000000..c6f5a05d
--- /dev/null
+++ b/main/freeswitch/modules.conf
@@ -0,0 +1,75 @@
+loggers/mod_console
+loggers/mod_logfile
+loggers/mod_syslog
+applications/mod_commands
+applications/mod_conference
+applications/mod_dptools
+applications/mod_enum
+applications/mod_fifo
+#applications/mod_fax
+applications/mod_voicemail
+#applications/mod_lcr
+applications/mod_limit
+applications/mod_expr
+applications/mod_esf
+#applications/mod_easyroute
+applications/mod_fsv
+#applications/mod_soundtouch
+#applications/mod_rss
+#applications/mod_snom
+#applications/mod_vmd
+#asr_tts/mod_flite
+#asr_tts/mod_pocketsphinx
+#asr_tts/mod_cepstral
+codecs/mod_g723_1
+codecs/mod_amr
+#codecs/mod_amrwb
+codecs/mod_g729
+codecs/mod_h26x
+codecs/mod_voipcodecs
+codecs/mod_ilbc
+codecs/mod_speex
+#codecs/mod_siren
+#codecs/mod_celt
+#codecs/mod_dahdi_codec
+#dialplans/mod_dialplan_directory
+dialplans/mod_dialplan_xml
+dialplans/mod_dialplan_asterisk
+#directories/mod_ldap
+#endpoints/mod_dingaling
+endpoints/mod_iax
+#endpoints/mod_portaudio
+endpoints/mod_sofia
+endpoints/mod_loopback
+#endpoints/mod_alsa
+#endpoints/mod_opal
+#../../libs/openzap/mod_openzap
+#event_handlers/mod_event_multicast
+event_handlers/mod_event_socket
+event_handlers/mod_cdr_csv
+#event_handlers/mod_radius_cdr
+formats/mod_native_file
+formats/mod_sndfile
+#formats/mod_shout
+formats/mod_local_stream
+formats/mod_tone_stream
+#languages/mod_python
+#languages/mod_spidermonkey
+#languages/mod_spidermonkey_teletone
+#languages/mod_spidermonkey_core_db
+#languages/mod_spidermonkey_socket
+#languages/mod_spidermonkey_odbc
+languages/mod_lua
+#languages/mod_perl
+#languages/mod_yaml
+#xml_int/mod_xml_rpc
+#xml_int/mod_xml_curl
+#xml_int/mod_xml_cdr
+#xml_int/mod_xml_ldap
+say/mod_say_en
+#say/mod_say_de
+#say/mod_say_es
+#say/mod_say_fr
+#say/mod_say_it
+#say/mod_say_nl
+#say/mod_say_zh
diff --git a/testing/freeswitch/APKBUILD b/testing/freeswitch/APKBUILD
deleted file mode 100644
index 4659f4f5..00000000
--- a/testing/freeswitch/APKBUILD
+++ /dev/null
@@ -1,64 +0,0 @@
-# Contributor: Michael Mason <ms13sp@gmail.com>
-pkgname=freeswitch
-pkgver=1.0.6
-pkgrel=1
-pkgdesc="A communications platform written in C from the ground up"
-url="http://www.freeswitch.org"
-license="GPL"
-depends=""
-makedepends="curl-dev unixodbc-dev zlib-dev openssl-dev
-	autoconf automake libtool"
-install=
-subpackages="$pkgname-dev"
-source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
-	modules.conf
-	freeswitch.confd
-	freeswitch.initd
-	freeswitch.post-install
-	freeswitch.pre-install
-	freeswitch.post-deinstall
-	"
-
-build() {
-	cd "$srcdir/$pkgname-$pkgver"
-	cp -f "$srcdir/modules.conf" modules.conf || return 1
-
-	# i think our max cmd len is 32768
-	# by specifying it here we save our selves from some CPU cycles
-	export lt_cv_sys_max_cmd_len=8192
-
-	./configure --prefix=/usr \
-		--sysconfdir=/etc/freeswitch \
-		--with-modinstdir=/usr/lib/freeswitch \
-		--mandir=/usr/share/man \
-		--infodir=/usr/share/info
-
-	# check how/when parallel builds are fixed here:
-	# http://jira.freeswitch.org/browse/FSBUILD-6
-
-	# build the libs and prerequisites in parallel first
-	make libs/apr/libapr-1.la \
-		libs/apr-util/libaprutil-1.la \
-		libs/speex/libspeex/libspeexdsp.la \
-		libs/sqlite/libsqlite3.la \
-		libs/pcre/libpcre.la \
-		libs/srtp/libsrtp.la \
-		src/include/switch_version.h
-
-	# then the rest should build in parallel too
-	make || return 1
-}
-package(){
-	cd "$srcdir/$pkgname-$pkgver"
-	make -j1 DESTDIR="$pkgdir" install
-	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
-	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
-}
-
-md5sums="388effee587887a81fe7f411b7350590  freeswitch-1.0.6.tar.gz
-c05f2356be159e99b3845f5260a33599  modules.conf
-c608cca8ad773acebf201f581438c7e7  freeswitch.confd
-dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
-c0d7ad55063b1f62c9a2fcfa37b2fc0a  freeswitch.post-install
-a34305ba1f8a8e7e6dbb9c678cc442b9  freeswitch.pre-install
-a7188703019a74fd7f128d165b3ecf42  freeswitch.post-deinstall"
diff --git a/testing/freeswitch/freeswitch.confd b/testing/freeswitch/freeswitch.confd
deleted file mode 100644
index 378e4b41..00000000
--- a/testing/freeswitch/freeswitch.confd
+++ /dev/null
@@ -1,25 +0,0 @@
-#
-# FreeSWITCH startup configuration
-#
-
-# freeswitch will be running with this userid
-FREESWITCH_USER="freeswitch"
-
-
-# optional: group the freeswitch process should be running with
-#
-# (note: without this option freeswitch will be using all groups
-#  the user in FREESWITCH_USER is a member of)
-#
-#FREESWITCH_GROUP="freeswitch"
-
-
-
-# optional: other options, e.g.
-#
-# -hp	Use realtime priority and protect freeswitch
-#       process from being swapped to disk
-#       (warning: dangerous on machines with little ram!)
-#
-#FREESWITCH_OPTS=""
-
diff --git a/testing/freeswitch/freeswitch.initd b/testing/freeswitch/freeswitch.initd
deleted file mode 100755
index 84381d77..00000000
--- a/testing/freeswitch/freeswitch.initd
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/sbin/runscript
-# Copyright 2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License, v2 or later
-# $Header: $
-
-depend() {
-    need net
-}
-
-start() {
-    local OPTS
-
-    [ -n "${FREESWITCH_USER}" ] && \
-        OPTS="${OPTS} -u ${FREESWITCH_USER}" 
-
-    [ -n "${FREESWITCH_GROUP}" ] && \
-        OPTS="${OPTS} -g ${FREESWITCH_GROUP}" 
-
-    [ -n "${FREESWITCH_OPTS}" ] && \
-        OPTS="${OPTS} ${FREESWITCH_OPTS}" 
-
-    ebegin "Starting Freeswitch" 
-    start-stop-daemon --start --quiet --exec /usr/bin/freeswitch \
-        --pidfile /var/run/freeswitch.pid -- -nc ${OPTS}
-    eend $?
-}
-
-stop() {
-    ebegin "Stopping Freeswitch" 
-    start-stop-daemon --stop --quiet --pidfile /var/run/freeswitch.pid
-    eend $?
-}
-
diff --git a/testing/freeswitch/freeswitch.post-deinstall b/testing/freeswitch/freeswitch.post-deinstall
deleted file mode 100755
index 5ec871cb..00000000
--- a/testing/freeswitch/freeswitch.post-deinstall
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-deluser freeswitch
-delgroup freeswitch
diff --git a/testing/freeswitch/freeswitch.post-install b/testing/freeswitch/freeswitch.post-install
deleted file mode 100755
index 3b1c414c..00000000
--- a/testing/freeswitch/freeswitch.post-install
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/sh
-
-chown -R freeswitch:freeswitch /etc/freeswitch/
-chown -R freeswitch:freeswitch /var/run/freeswitch/
-
diff --git a/testing/freeswitch/freeswitch.pre-install b/testing/freeswitch/freeswitch.pre-install
deleted file mode 100755
index b8065b52..00000000
--- a/testing/freeswitch/freeswitch.pre-install
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-adduser -h /dev/null -s /bin/false -D freeswitch 2>/dev/null
-mkdir /var/run/freeswitch
diff --git a/testing/freeswitch/modules.conf b/testing/freeswitch/modules.conf
deleted file mode 100644
index c6f5a05d..00000000
--- a/testing/freeswitch/modules.conf
+++ /dev/null
@@ -1,75 +0,0 @@
-loggers/mod_console
-loggers/mod_logfile
-loggers/mod_syslog
-applications/mod_commands
-applications/mod_conference
-applications/mod_dptools
-applications/mod_enum
-applications/mod_fifo
-#applications/mod_fax
-applications/mod_voicemail
-#applications/mod_lcr
-applications/mod_limit
-applications/mod_expr
-applications/mod_esf
-#applications/mod_easyroute
-applications/mod_fsv
-#applications/mod_soundtouch
-#applications/mod_rss
-#applications/mod_snom
-#applications/mod_vmd
-#asr_tts/mod_flite
-#asr_tts/mod_pocketsphinx
-#asr_tts/mod_cepstral
-codecs/mod_g723_1
-codecs/mod_amr
-#codecs/mod_amrwb
-codecs/mod_g729
-codecs/mod_h26x
-codecs/mod_voipcodecs
-codecs/mod_ilbc
-codecs/mod_speex
-#codecs/mod_siren
-#codecs/mod_celt
-#codecs/mod_dahdi_codec
-#dialplans/mod_dialplan_directory
-dialplans/mod_dialplan_xml
-dialplans/mod_dialplan_asterisk
-#directories/mod_ldap
-#endpoints/mod_dingaling
-endpoints/mod_iax
-#endpoints/mod_portaudio
-endpoints/mod_sofia
-endpoints/mod_loopback
-#endpoints/mod_alsa
-#endpoints/mod_opal
-#../../libs/openzap/mod_openzap
-#event_handlers/mod_event_multicast
-event_handlers/mod_event_socket
-event_handlers/mod_cdr_csv
-#event_handlers/mod_radius_cdr
-formats/mod_native_file
-formats/mod_sndfile
-#formats/mod_shout
-formats/mod_local_stream
-formats/mod_tone_stream
-#languages/mod_python
-#languages/mod_spidermonkey
-#languages/mod_spidermonkey_teletone
-#languages/mod_spidermonkey_core_db
-#languages/mod_spidermonkey_socket
-#languages/mod_spidermonkey_odbc
-languages/mod_lua
-#languages/mod_perl
-#languages/mod_yaml
-#xml_int/mod_xml_rpc
-#xml_int/mod_xml_curl
-#xml_int/mod_xml_cdr
-#xml_int/mod_xml_ldap
-say/mod_say_en
-#say/mod_say_de
-#say/mod_say_es
-#say/mod_say_fr
-#say/mod_say_it
-#say/mod_say_nl
-#say/mod_say_zh
-- 
cgit v1.2.3


From 80443ec9989ec738c5de3489e3ea00f2f7c402c0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 27 Apr 2010 14:22:02 +0000
Subject: main/kamailio: upgrade to 1.5.4

---
 main/kamailio/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/kamailio/APKBUILD b/main/kamailio/APKBUILD
index 2b64a76e..e085fdad 100644
--- a/main/kamailio/APKBUILD
+++ b/main/kamailio/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=kamailio
-pkgver=1.5.3
-pkgrel=8
+pkgver=1.5.4
+pkgrel=0
 pkgdesc="Open Source SIP Server"
 url="http://www.kamailio.org/"
 pkgusers="kamailio"
@@ -126,7 +126,7 @@ unixodbc() {
 	_mv_mod db_unixodbc
 }
 
-md5sums="17eeea5cdc2fdd28b2f9a1bad6598de2  kamailio-1.5.3-notls_src.tar.gz
+md5sums="127233aff2f20566b54f84555602132d  kamailio-1.5.4-notls_src.tar.gz
 eb665248ee39cf755a247286affc5cbb  kamailio.cfg
 8ac6c260f090aea0ca344f18f9a2a904  kamailio.initd
 3259980a45d9ad3fc6fca83414021d07  kamailio-backslash.patch"
-- 
cgit v1.2.3


From 7fdc5f7dad7c1c775d73074b56276a62bf15c19a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 29 Apr 2010 12:12:25 +0000
Subject: main/syslinux: upgrade to 3.86

---
 main/syslinux/APKBUILD                  | 19 ++++++++++++-------
 main/syslinux/syslinux-3.72-nopie.patch | 12 ------------
 main/syslinux/syslinux-3.86-nopie.patch | 11 +++++++++++
 3 files changed, 23 insertions(+), 19 deletions(-)
 delete mode 100644 main/syslinux/syslinux-3.72-nopie.patch
 create mode 100644 main/syslinux/syslinux-3.86-nopie.patch

diff --git a/main/syslinux/APKBUILD b/main/syslinux/APKBUILD
index e543f31f..5fd6f2f5 100644
--- a/main/syslinux/APKBUILD
+++ b/main/syslinux/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=syslinux
-pkgver=3.85
+pkgver=3.86
 pkgrel=0
 pkgdesc="a boot loader for the Linux operating system which operates off an MS-DOS/Windows FAT filesystem."
 url="http://syslinux.org"
@@ -8,21 +8,26 @@ license="GPL"
 makedepends="nasm perl"
 depends="mtools"
 source="http://www.kernel.org/pub/linux/utils/boot/$pkgname/$pkgname-$pkgver.tar.bz2
-	$pkgname-3.72-nopie.patch
+	$pkgname-3.86-nopie.patch
 	"
 subpackages="$pkgname-doc"
 
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	patch -p1 < ../$pkgname-3.86-nopie.patch || return 1
+}
+
 build() {
-	cd "$srcdir/$pkgname-$pkgver"
-	patch -p1 < ../$pkgname-3.72-nopie.patch || return 1
+	cd "$_builddir"
 	unset LDFLAGS
 	make installer || return 1
 }
 
 package() {
-	cd "$srcdir/$pkgname-$pkgver"
+	cd "$_builddir"
 	make INSTALLROOT="$pkgdir" MANDIR=/usr/share/man local-install
 }
 
-md5sums="416e64e3e9b1f838e393c809ff83e792  syslinux-3.85.tar.bz2
-c08398d165d29e48711e55058e2897de  syslinux-3.72-nopie.patch"
+md5sums="d6fb0231e82190b4932b2aa20274911a  syslinux-3.86.tar.bz2
+5852d62ba0772cf967156a75451e6066  syslinux-3.86-nopie.patch"
diff --git a/main/syslinux/syslinux-3.72-nopie.patch b/main/syslinux/syslinux-3.72-nopie.patch
deleted file mode 100644
index 2662d17b..00000000
--- a/main/syslinux/syslinux-3.72-nopie.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur a/com32/MCONFIG b/com32/MCONFIG
---- a/com32/MCONFIG	2008-09-26 01:46:02.000000000 +0200
-+++ b/com32/MCONFIG	2008-10-28 16:10:16.107964907 +0100
-@@ -19,6 +19,8 @@
- GCCOPT := $(call gcc_ok,-std=gnu99,) \
- 	  $(call gcc_ok,-m32,) \
- 	  $(call gcc_ok,-fno-stack-protector,) \
-+	  $(call gcc_ok,-nopie,) \
-+	  $(call gcc_ok,-fno-pie,) \
- 	  -mregparm=3 -DREGPARM=3 -march=i386 -Os
- 
- com32 = $(topdir)/com32
diff --git a/main/syslinux/syslinux-3.86-nopie.patch b/main/syslinux/syslinux-3.86-nopie.patch
new file mode 100644
index 00000000..262a4c15
--- /dev/null
+++ b/main/syslinux/syslinux-3.86-nopie.patch
@@ -0,0 +1,11 @@
+--- ./com32/MCONFIG.orig
++++ ./com32/MCONFIG
+@@ -25,6 +25,8 @@
+ 	     $(call gcc_ok,-falign-loops=0,-malign-loops=0)		\
+ 	     $(call gcc_ok,-mpreferred-stack-boundary=2,)		\
+ 	     $(call gcc_ok,-mincoming-stack-boundary=2,)		\
++	     $(call gcc_ok,-nopie,)					\
++	     $(call gcc_ok,-fno-pie,)					\
+ 	     -march=i386 -Os -fomit-frame-pointer -mregparm=3 -DREGPARM=3
+ 
+ com32 = $(topdir)/com32
-- 
cgit v1.2.3


From 69fbc34c4de71a14c464b61d89b72ca7e95a515e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 29 Apr 2010 12:18:31 +0000
Subject: main/sudo: upgrade to 1.7.2_p6

---
 main/sudo/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/sudo/APKBUILD b/main/sudo/APKBUILD
index 628d7589..1bbb53cc 100644
--- a/main/sudo/APKBUILD
+++ b/main/sudo/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sudo
-pkgver=1.7.2_p5
+pkgver=1.7.2_p6
 _realver=${pkgver%_*}${pkgver#*_}
 pkgrel=0
 pkgdesc="Give certain users the ability to run some commands as root"
@@ -27,4 +27,4 @@ package() {
 	make -j1 DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="398f584e831bd75b3c0179e28368c2a3  sudo-1.7.2p5.tar.gz"
+md5sums="c4f1a43e8ba94f6bf06d2211442148c4  sudo-1.7.2p6.tar.gz"
-- 
cgit v1.2.3


From f26af8bcd27eadc735bbdd7ccf437899d730267a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 29 Apr 2010 13:00:41 +0000
Subject: main/linux-vserver: upgrade to 2.6.32.12-vs2.3.0.36.29.4

---
 main/linux-vserver/APKBUILD | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/main/linux-vserver/APKBUILD b/main/linux-vserver/APKBUILD
index 05a31146..9f761de7 100644
--- a/main/linux-vserver/APKBUILD
+++ b/main/linux-vserver/APKBUILD
@@ -2,7 +2,8 @@
 
 _flavor=vserver
 pkgname=linux-${_flavor}
-pkgver=2.6.32.10
+pkgver=2.6.32.12
+
 _kernver=2.6.32
 pkgrel=0
 pkgdesc="Linux kernel with vserver"
@@ -14,7 +15,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	http://vserver.13thfloor.at/Experimental/patch-2.6.32.10-vs2.3.0.36.29.2.diff
+	http://vserver.13thfloor.at/Experimental/patch-2.6.32.12-vs2.3.0.36.29.4.diff
 	kernelconfig.x86
 	"
 subpackages="$pkgname-dev"
@@ -49,7 +50,7 @@ menuconfig() {
 
 build() {
 	cd "$srcdir"/build
-	make CC="$CC" || return 1
+	make CC="${CC:-gcc}" || return 1
 }
 
 package() {
@@ -114,6 +115,6 @@ dev() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-0f1863836bf96fd0aab128d61eaa5693  patch-2.6.32.10.bz2
-393978a0b5c75b598f9fa711556dd2e1  patch-2.6.32.10-vs2.3.0.36.29.2.diff
+9d097d34648a1734b1a7f97c5d000f03  patch-2.6.32.12.bz2
+cbf358edd0f416b035d13114fdc34ccb  patch-2.6.32.12-vs2.3.0.36.29.4.diff
 42ce36a36e7c71ee54761e56d59d17ed  kernelconfig.x86"
-- 
cgit v1.2.3


From 56350924f1206ad8e2d6c603c8b437395841a8e0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 30 Apr 2010 06:50:55 +0000
Subject: main/linux-grsec: upgrade to 2.1.14-2.6.32.12-201004292005

the 0006 and 0008 patch was applied upstream
---
 ...al-fix-for-CVE-2009-4537-overlength-frame.patch |   120 -
 .../0008-r8169-clean-up-my-printk-uglyness.patch   |    36 -
 main/linux-grsec/APKBUILD                          |    12 +-
 .../grsecurity-2.1.14-2.6.32.11-201004071936.patch | 55251 ------------------
 .../grsecurity-2.1.14-2.6.32.12-201004292005.patch | 55920 +++++++++++++++++++
 5 files changed, 55924 insertions(+), 55415 deletions(-)
 delete mode 100644 main/linux-grsec/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
 delete mode 100644 main/linux-grsec/0008-r8169-clean-up-my-printk-uglyness.patch
 delete mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.11-201004071936.patch
 create mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch

diff --git a/main/linux-grsec/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch b/main/linux-grsec/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
deleted file mode 100644
index 03ea13fa..00000000
--- a/main/linux-grsec/0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From a60cfaf3df9cd0cddbc24695434ed5bfa917d505 Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@redhat.com>
-Date: Mon, 29 Mar 2010 13:16:02 -0700
-Subject: [PATCH 06/18] r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)
-
-Official patch to fix the r8169 frame length check error.
-
-Based on this initial thread:
-http://marc.info/?l=linux-netdev&m=126202972828626&w=1
-This is the official patch to fix the frame length problems in the r8169
-driver.  As noted in the previous thread, while this patch incurs a performance
-hit on the driver, its possible to improve performance dynamically by updating
-the mtu and rx_copybreak values at runtime to return performance to what it was
-for those NICS which are unaffected by the ideosyncracy (if there are any).
-
-Summary:
-
-    A while back Eric submitted a patch for r8169 in which the proper
-allocated frame size was written to RXMaxSize to prevent the NIC from dmaing too
-much data.  This was done in commit fdd7b4c3302c93f6833e338903ea77245eb510b4.  A
-long time prior to that however, Francois posted
-126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c, which expiclitly disabled the MaxSize
-setting due to the fact that the hardware behaved in odd ways when overlong
-frames were received on NIC's supported by this driver.  This was mentioned in a
-security conference recently:
-http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html
-
-It seems that if we can't enable frame size filtering, then, as Eric correctly
-noticed, we can find ourselves DMA-ing too much data to a buffer, causing
-corruption.  As a result is seems that we are forced to allocate a frame which
-is ready to handle a maximally sized receive.
-
-This obviously has performance issues with it, so to mitigate that issue, this
-patch does two things:
-
-1) Raises the copybreak value to the frame allocation size, which should force
-appropriately sized packets to get allocated on rx, rather than a full new 16k
-buffer.
-
-2) This patch only disables frame filtering initially (i.e., during the NIC
-open), changing the MTU results in ring buffer allocation of a size in relation
-to the new mtu (along with a warning indicating that this is dangerous).
-
-Because of item (2), individuals who can't cope with the performance hit (or can
-otherwise filter frames to prevent the bug), or who have hardware they are sure
-is unaffected by this issue, can manually lower the copybreak and reset the mtu
-such that performance is restored easily.
-
-Signed-off-by: Neil Horman <nhorman@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit c0cd884af045338476b8e69a61fceb3f34ff22f1)
----
- drivers/net/r8169.c |   29 ++++++++++++++++++++++++-----
- 1 files changed, 24 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 24599b5..1484528 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -186,7 +186,12 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
- 
- MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
- 
--static int rx_copybreak = 200;
-+/*
-+ * we set our copybreak very high so that we don't have
-+ * to allocate 16k frames all the time (see note in
-+ * rtl8169_open()
-+ */
-+static int rx_copybreak = 16383;
- static int use_dac;
- static struct {
- 	u32 msg_enable;
-@@ -3245,9 +3250,13 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
- }
- 
- static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
--				  struct net_device *dev)
-+				  unsigned int mtu)
- {
--	unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+	unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-+
-+	if (max_frame != 16383)
-+		printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
-+			"May lead to frame reception errors!\n");
- 
- 	tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
-@@ -3259,7 +3268,17 @@ static int rtl8169_open(struct net_device *dev)
- 	int retval = -ENOMEM;
- 
- 
--	rtl8169_set_rxbufsize(tp, dev);
-+	/*
-+	 * Note that we use a magic value here, its wierd I know
-+	 * its done because, some subset of rtl8169 hardware suffers from
-+	 * a problem in which frames received that are longer than
-+	 * the size set in RxMaxSize register return garbage sizes
-+	 * when received.  To avoid this we need to turn off filtering,
-+	 * which is done by setting a value of 16383 in the RxMaxSize register
-+	 * and allocating 16k frames to handle the largest possible rx value
-+	 * thats what the magic math below does.
-+	 */
-+	rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
- 
- 	/*
- 	 * Rx and Tx desscriptors needs 256 bytes alignment.
-@@ -3912,7 +3931,7 @@ static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
- 
- 	rtl8169_down(dev);
- 
--	rtl8169_set_rxbufsize(tp, dev);
-+	rtl8169_set_rxbufsize(tp, dev->mtu);
- 
- 	ret = rtl8169_init_ring(dev);
- 	if (ret < 0)
--- 
-1.7.0.2
-
diff --git a/main/linux-grsec/0008-r8169-clean-up-my-printk-uglyness.patch b/main/linux-grsec/0008-r8169-clean-up-my-printk-uglyness.patch
deleted file mode 100644
index dff3fd21..00000000
--- a/main/linux-grsec/0008-r8169-clean-up-my-printk-uglyness.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From d1c9ac562923fa0b1738fceb4c7bafac3ab936ba Mon Sep 17 00:00:00 2001
-From: Neil Horman <nhorman@tuxdriver.com>
-Date: Thu, 1 Apr 2010 07:30:07 +0000
-Subject: [PATCH 08/18] r8169: clean up my printk uglyness
-
-Fix formatting on r8169 printk
-
-Brandon Philips noted that I had a spacing issue in my printk for the
-last r8169 patch that made it quite ugly.  Fix that up and add the PFX
-macro to it as well so it looks like the other r8169 printks
-
-Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-(cherry picked from commit 93f4d91d879acfcb0ba9c2725e3133fcff2dfd1e)
----
- drivers/net/r8169.c |    4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index bed1d47..790555e 100644
---- a/drivers/net/r8169.c
-+++ b/drivers/net/r8169.c
-@@ -3255,8 +3255,8 @@ static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
- 	unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- 
- 	if (max_frame != 16383)
--		printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
--			"May lead to frame reception errors!\n");
-+		printk(KERN_WARNING PFX "WARNING! Changing of MTU on this "
-+			"NIC may lead to frame reception errors!\n");
- 
- 	tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
- }
--- 
-1.7.0.2
-
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 759d6716..f5983aa3 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=2.6.32.11
+pkgver=2.6.32.12
 _kernver=2.6.32
 pkgrel=2
 pkgdesc="Linux kernel with grsecurity"
@@ -14,15 +14,13 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	grsecurity-2.1.14-2.6.32.11-201004071936.patch
+	grsecurity-2.1.14-2.6.32.12-201004292005.patch
 	0001-grsec-revert-conflicting-flow-cache-changes.patch
 	0002-gre-fix-hard-header-destination-address-checking.patch
 	0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 	0004-arp-flush-arp-cache-on-device-change.patch
 	0005-r8169-fix-broken-register-writes.patch
-	0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
 	0007-r8169-Fix-rtl8169_rx_interrupt.patch
-	0008-r8169-clean-up-my-printk-uglyness.patch
 	0009-ipsec-Fix-bogus-bundle-flowi.patch
 	0010-xfrm-Remove-xfrm_state_genid.patch
 	0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
@@ -138,16 +136,14 @@ firmware() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-855c248334a71ef5ca3d8cb89d51334f  patch-2.6.32.11.bz2
-6eabb0c08a988a97a823b5462d1c5018  grsecurity-2.1.14-2.6.32.11-201004071936.patch
+9d097d34648a1734b1a7f97c5d000f03  patch-2.6.32.12.bz2
+6c360e4ba40b91137f6ab8b5996e9b1f  grsecurity-2.1.14-2.6.32.12-201004292005.patch
 1d247140abec49b96250aec9aa59b324  0001-grsec-revert-conflicting-flow-cache-changes.patch
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 afa06334c81f21c20571286a83d3d928  0005-r8169-fix-broken-register-writes.patch
-c538c0f735d79fd71b47dde02bf1f790  0006-r8169-offical-fix-for-CVE-2009-4537-overlength-frame.patch
 5f8b9a76d95319c5b1aa26b54a42e6b5  0007-r8169-Fix-rtl8169_rx_interrupt.patch
-f878c802700e3babd03be3505119c5c2  0008-r8169-clean-up-my-printk-uglyness.patch
 cf168620efa63479a6e03da78906e32f  0009-ipsec-Fix-bogus-bundle-flowi.patch
 3af4b5ae1afae3278b0070f585b874e3  0010-xfrm-Remove-xfrm_state_genid.patch
 9f284c3fd5ab38cef4544efc1f50c6ba  0011-xfrm_user-verify-policy-direction-at-XFRM_MSG_POLEXP.patch
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.11-201004071936.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.11-201004071936.patch
deleted file mode 100644
index 62c446bc..00000000
--- a/main/linux-grsec/grsecurity-2.1.14-2.6.32.11-201004071936.patch
+++ /dev/null
@@ -1,55251 +0,0 @@
-diff -urNp linux-2.6.32.11/arch/alpha/include/asm/elf.h linux-2.6.32.11/arch/alpha/include/asm/elf.h
---- linux-2.6.32.11/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/alpha/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- 
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be 
-    registered using atexit.  This provides a mean for the dynamic
-    linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.32.11/arch/alpha/include/asm/pgtable.h linux-2.6.32.11/arch/alpha/include/asm/pgtable.h
---- linux-2.6.32.11/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/alpha/include/asm/pgtable.h	2010-04-04 20:46:41.472784147 -0400
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
- 
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.32.11/arch/alpha/kernel/module.c linux-2.6.32.11/arch/alpha/kernel/module.c
---- linux-2.6.32.11/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/alpha/kernel/module.c	2010-04-04 20:46:41.472784147 -0400
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
- 
- 	/* The small sections were sorted to the end of the segment.
- 	   The following should definitely cover them.  */
--	gp = (u64)me->module_core + me->core_size - 0x8000;
-+	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- 	got = sechdrs[me->arch.gotsecindex].sh_addr;
- 
- 	for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.32.11/arch/alpha/kernel/osf_sys.c linux-2.6.32.11/arch/alpha/kernel/osf_sys.c
---- linux-2.6.32.11/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/alpha/kernel/osf_sys.c	2010-04-04 20:46:41.472784147 -0400
-@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
- 	   merely specific addresses, but regions of memory -- perhaps
- 	   this feature should be incorporated into all ports?  */
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
- 		if (addr != (unsigned long) -ENOMEM)
-@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
- 	}
- 
- 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
--	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
--					 len, limit);
-+	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
-+
- 	if (addr != (unsigned long) -ENOMEM)
- 		return addr;
- 
-diff -urNp linux-2.6.32.11/arch/alpha/mm/fault.c linux-2.6.32.11/arch/alpha/mm/fault.c
---- linux-2.6.32.11/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/alpha/mm/fault.c	2010-04-04 20:46:41.472784147 -0400
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
- 	__reload_thread(pcb);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int ldah, ldq, jmp;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+		    jmp == 0x6BFB0000U)
-+		{
-+			unsigned long r27, addr;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			err = get_user(r27, (unsigned long *)addr);
-+			if (err)
-+				break;
-+
-+			regs->r27 = r27;
-+			regs->pc = r27;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #2 */
-+		unsigned int ldah, lda, br;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+		err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+		    (br & 0xFFE00000U) == 0xC3E00000U)
-+		{
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int br;
-+
-+		err = get_user(br, (unsigned int *)regs->pc);
-+
-+		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+			unsigned int br2, ldq, nop, jmp;
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			err = get_user(br2, (unsigned int *)addr);
-+			err |= get_user(ldq, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			err |= get_user(jmp, (unsigned int *)(addr+12));
-+			err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+			if (err)
-+				break;
-+
-+			if (br2 == 0xC3600000U &&
-+			    ldq == 0xA77B000CU &&
-+			    nop == 0x47FF041FU &&
-+			    jmp == 0x6B7B0000U)
-+			{
-+				regs->r28 = regs->pc+4;
-+				regs->r27 = addr+16;
-+				regs->pc = resolver;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
- 
- /*
-  * This routine handles page faults.  It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
-  good_area:
- 	si_code = SEGV_ACCERR;
- 	if (cause < 0) {
--		if (!(vma->vm_flags & VM_EXEC))
-+		if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+			do_group_exit(SIGKILL);
-+#else
- 			goto bad_area;
-+#endif
-+
-+		}
- 	} else if (!cause) {
- 		/* Allow reads even for write-only mappings */
- 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.32.11/arch/arm/include/asm/elf.h linux-2.6.32.11/arch/arm/include/asm/elf.h
---- linux-2.6.32.11/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
- 
- /* When the program starts, a1 contains a pointer to a function to be 
-    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
-diff -urNp linux-2.6.32.11/arch/arm/include/asm/kmap_types.h linux-2.6.32.11/arch/arm/include/asm/kmap_types.h
---- linux-2.6.32.11/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/include/asm/kmap_types.h	2010-04-04 20:46:41.472784147 -0400
-@@ -19,6 +19,7 @@ enum km_type {
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
- 	KM_L2_CACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.11/arch/arm/include/asm/uaccess.h linux-2.6.32.11/arch/arm/include/asm/uaccess.h
---- linux-2.6.32.11/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/include/asm/uaccess.h	2010-04-04 20:46:41.472784147 -0400
-@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
- 
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else /* security hole - plug it */
-@@ -412,6 +415,9 @@ static inline unsigned long __must_check
- 
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-diff -urNp linux-2.6.32.11/arch/arm/kernel/kgdb.c linux-2.6.32.11/arch/arm/kernel/kgdb.c
---- linux-2.6.32.11/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/kernel/kgdb.c	2010-04-04 20:46:41.472784147 -0400
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
-  * and we handle the normal undef case within the do_undefinstr
-  * handler.
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff -urNp linux-2.6.32.11/arch/arm/mach-at91/pm.c linux-2.6.32.11/arch/arm/mach-at91/pm.c
---- linux-2.6.32.11/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-at91/pm.c	2010-04-04 20:46:41.472784147 -0400
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
- 
- 
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- 	.valid	= at91_pm_valid_state,
- 	.begin	= at91_pm_begin,
- 	.enter	= at91_pm_enter,
-diff -urNp linux-2.6.32.11/arch/arm/mach-omap1/pm.c linux-2.6.32.11/arch/arm/mach-omap1/pm.c
---- linux-2.6.32.11/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-omap1/pm.c	2010-04-04 20:46:41.472784147 -0400
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
- 
- 
- 
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- 	.prepare	= omap_pm_prepare,
- 	.enter		= omap_pm_enter,
- 	.finish		= omap_pm_finish,
-diff -urNp linux-2.6.32.11/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.11/arch/arm/mach-omap2/pm24xx.c
---- linux-2.6.32.11/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-omap2/pm24xx.c	2010-04-04 20:46:41.472784147 -0400
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- 	enable_hlt();
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.prepare	= omap2_pm_prepare,
- 	.enter		= omap2_pm_enter,
- 	.finish		= omap2_pm_finish,
-diff -urNp linux-2.6.32.11/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.11/arch/arm/mach-omap2/pm34xx.c
---- linux-2.6.32.11/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-omap2/pm34xx.c	2010-04-04 20:46:41.472784147 -0400
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- 	return;
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.begin		= omap3_pm_begin,
- 	.end		= omap3_pm_end,
- 	.prepare	= omap3_pm_prepare,
-diff -urNp linux-2.6.32.11/arch/arm/mach-pnx4008/pm.c linux-2.6.32.11/arch/arm/mach-pnx4008/pm.c
---- linux-2.6.32.11/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-pnx4008/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
- 	       (state == PM_SUSPEND_MEM);
- }
- 
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- 	.enter = pnx4008_pm_enter,
- 	.valid = pnx4008_pm_valid,
- };
-diff -urNp linux-2.6.32.11/arch/arm/mach-pxa/pm.c linux-2.6.32.11/arch/arm/mach-pxa/pm.c
---- linux-2.6.32.11/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-pxa/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- 		pxa_cpu_pm_fns->finish();
- }
- 
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- 	.valid		= pxa_pm_valid,
- 	.enter		= pxa_pm_enter,
- 	.prepare	= pxa_pm_prepare,
-diff -urNp linux-2.6.32.11/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.11/arch/arm/mach-pxa/sharpsl_pm.c
---- linux-2.6.32.11/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-pxa/sharpsl_pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
- }
- 
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- 	.prepare	= pxa_pm_prepare,
- 	.finish		= pxa_pm_finish,
- 	.enter		= corgi_pxa_pm_enter,
-diff -urNp linux-2.6.32.11/arch/arm/mach-sa1100/pm.c linux-2.6.32.11/arch/arm/mach-sa1100/pm.c
---- linux-2.6.32.11/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mach-sa1100/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- 	return virt_to_phys(sp);
- }
- 
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- 	.enter		= sa11x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.11/arch/arm/mm/fault.c linux-2.6.32.11/arch/arm/mm/fault.c
---- linux-2.6.32.11/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
-@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
- 	}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (fsr & FSR_LNX_PF) {
-+		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	tsk->thread.address = addr;
- 	tsk->thread.error_code = fsr;
- 	tsk->thread.trap_no = 14;
-@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
- }
- #endif					/* CONFIG_MMU */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-4: ");
-+	for (i = -1; i < 20; i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08lx ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * First Level Translation Fault Handler
-  *
-diff -urNp linux-2.6.32.11/arch/arm/mm/mmap.c linux-2.6.32.11/arch/arm/mm/mmap.c
---- linux-2.6.32.11/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/mm/mmap.c	2010-04-04 20:46:41.476773136 -0400
-@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (len > TASK_SIZE)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -94,8 +98,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-diff -urNp linux-2.6.32.11/arch/arm/plat-s3c/pm.c linux-2.6.32.11/arch/arm/plat-s3c/pm.c
---- linux-2.6.32.11/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/arm/plat-s3c/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- 	s3c_pm_check_cleanup();
- }
- 
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- 	.enter		= s3c_pm_enter,
- 	.prepare	= s3c_pm_prepare,
- 	.finish		= s3c_pm_finish,
-diff -urNp linux-2.6.32.11/arch/avr32/include/asm/elf.h linux-2.6.32.11/arch/avr32/include/asm/elf.h
---- linux-2.6.32.11/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/avr32/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-diff -urNp linux-2.6.32.11/arch/avr32/include/asm/kmap_types.h linux-2.6.32.11/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.32.11/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/avr32/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
-@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
- D(11)	KM_IRQ1,
- D(12)	KM_SOFTIRQ0,
- D(13)	KM_SOFTIRQ1,
--D(14)	KM_TYPE_NR
-+D(14)	KM_CLEARPAGE,
-+D(15)	KM_TYPE_NR
- };
- 
- #undef D
-diff -urNp linux-2.6.32.11/arch/avr32/mach-at32ap/pm.c linux-2.6.32.11/arch/avr32/mach-at32ap/pm.c
---- linux-2.6.32.11/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/avr32/mach-at32ap/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -176,7 +176,7 @@ out:
- 	return 0;
- }
- 
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- 	.valid	= avr32_pm_valid_state,
- 	.enter	= avr32_pm_enter,
- };
-diff -urNp linux-2.6.32.11/arch/avr32/mm/fault.c linux-2.6.32.11/arch/avr32/mm/fault.c
---- linux-2.6.32.11/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/avr32/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
- 
- int exception_trace = 1;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (unsigned char *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults. It determines the address and the
-  * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- 	up_read(&mm->mmap_sem);
- 
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		if (exception_trace && printk_ratelimit())
- 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
- 			       "sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.32.11/arch/blackfin/kernel/kgdb.c linux-2.6.32.11/arch/blackfin/kernel/kgdb.c
---- linux-2.6.32.11/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/blackfin/kernel/kgdb.c	2010-04-04 20:46:41.476773136 -0400
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;		/* this means that we do not want to exit from the handler */
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.32.11/arch/blackfin/mach-common/pm.c linux-2.6.32.11/arch/blackfin/mach-common/pm.c
---- linux-2.6.32.11/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/blackfin/mach-common/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
- 	return 0;
- }
- 
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- 	.enter = bfin_pm_enter,
- 	.valid	= bfin_pm_valid,
- };
-diff -urNp linux-2.6.32.11/arch/frv/include/asm/kmap_types.h linux-2.6.32.11/arch/frv/include/asm/kmap_types.h
---- linux-2.6.32.11/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/frv/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.11/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.11/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.32.11/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/hp/common/hwsw_iommu.c	2010-04-04 20:46:41.476773136 -0400
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
- 
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
- 
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
- 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
- 
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- 	if (use_swiotlb(dev))
- 		return &swiotlb_dma_ops;
-diff -urNp linux-2.6.32.11/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.11/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.32.11/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/hp/common/sba_iommu.c	2010-04-04 20:46:41.476773136 -0400
-@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
- 	},
- };
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static int __init
- sba_init(void)
-@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
- 
- __setup("sbapagesize=",sba_page_override);
- 
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- 	.alloc_coherent		= sba_alloc_coherent,
- 	.free_coherent		= sba_free_coherent,
- 	.map_page		= sba_map_page,
-diff -urNp linux-2.6.32.11/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.11/arch/ia64/ia32/binfmt_elf32.c
---- linux-2.6.32.11/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/ia32/binfmt_elf32.c	2010-04-04 20:46:41.476773136 -0400
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
- 
- #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
- 
-diff -urNp linux-2.6.32.11/arch/ia64/ia32/ia32priv.h linux-2.6.32.11/arch/ia64/ia32/ia32priv.h
---- linux-2.6.32.11/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/ia32/ia32priv.h	2010-04-04 20:46:41.476773136 -0400
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA	ELFDATA2LSB
- #define ELF_ARCH	EM_386
- 
--#define IA32_STACK_TOP		IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK	(current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK	0UL
-+#endif
-+
-+#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
- #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
- 
-diff -urNp linux-2.6.32.11/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.11/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.32.11/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/include/asm/dma-mapping.h	2010-04-04 20:46:41.476773136 -0400
-@@ -12,7 +12,7 @@
- 
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
- 
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *daddr, gfp_t gfp)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	void *caddr;
- 
- 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *caddr, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	debug_dma_free_coherent(dev, size, caddr, daddr);
- 	ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->mapping_error(dev, daddr);
- }
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->dma_supported(dev, mask);
- }
- 
-diff -urNp linux-2.6.32.11/arch/ia64/include/asm/elf.h linux-2.6.32.11/arch/ia64/include/asm/elf.h
---- linux-2.6.32.11/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
-@@ -43,6 +43,13 @@
-  */
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND		0x70000001
- 
- /* IA-64 relocations: */
-diff -urNp linux-2.6.32.11/arch/ia64/include/asm/machvec.h linux-2.6.32.11/arch/ia64/include/asm/machvec.h
---- linux-2.6.32.11/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/include/asm/machvec.h	2010-04-04 20:46:41.476773136 -0400
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
- 
- /*
-  * WARNING: The legacy I/O space is _architected_.  Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
- # endif /* CONFIG_IA64_GENERIC */
- 
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
- 
- /*
-  * Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.32.11/arch/ia64/include/asm/pgtable.h linux-2.6.32.11/arch/ia64/include/asm/pgtable.h
---- linux-2.6.32.11/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+#endif
-+
- #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.32.11/arch/ia64/include/asm/uaccess.h linux-2.6.32.11/arch/ia64/include/asm/uaccess.h
---- linux-2.6.32.11/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/include/asm/uaccess.h	2010-04-04 20:46:41.480470677 -0400
-@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
- 	const void *__cu_from = (from);							\
- 	long __cu_len = (n);								\
- 											\
--	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
-+	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
- 	long __cu_len = (n);								\
- 											\
- 	__chk_user_ptr(__cu_from);							\
--	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
-+	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/dma-mapping.c linux-2.6.32.11/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.32.11/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/dma-mapping.c	2010-04-04 20:46:41.480470677 -0400
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
- 
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- 	return dma_ops;
- }
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/module.c linux-2.6.32.11/arch/ia64/kernel/module.c
---- linux-2.6.32.11/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
--	if (mod && mod->arch.init_unw_table &&
--	    module_region == mod->module_init) {
-+	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- 		unw_remove_unwind_table(mod->arch.init_unw_table);
- 		mod->arch.init_unw_table = NULL;
- 	}
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
- }
- 
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_init < mod->init_size;
-+	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
- 
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_core < mod->core_size;
-+	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
- 
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
- 		break;
- 
- 	      case RV_BDREL:
--		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+		if (in_init_rx(mod, val))
-+			val -= (uint64_t) mod->module_init_rx;
-+		else if (in_init_rw(mod, val))
-+			val -= (uint64_t) mod->module_init_rw;
-+		else if (in_core_rx(mod, val))
-+			val -= (uint64_t) mod->module_core_rx;
-+		else if (in_core_rw(mod, val))
-+			val -= (uint64_t) mod->module_core_rw;
- 		break;
- 
- 	      case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
- 		 *     addresses have been selected...
- 		 */
- 		uint64_t gp;
--		if (mod->core_size > MAX_LTOFF)
-+		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- 			/*
- 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- 			 * at the end of the module.
- 			 */
--			gp = mod->core_size - MAX_LTOFF / 2;
-+			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- 		else
--			gp = mod->core_size / 2;
--		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- 		mod->arch.gp = gp;
- 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- 	}
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/pci-dma.c linux-2.6.32.11/arch/ia64/kernel/pci-dma.c
---- linux-2.6.32.11/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/pci-dma.c	2010-04-04 20:46:41.480470677 -0400
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- 	.dma_mask = &fallback_dev.coherent_dma_mask,
- };
- 
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
- 
- static int __init pci_iommu_init(void)
- {
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.11/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.32.11/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/pci-swiotlb.c	2010-04-04 20:46:41.480470677 -0400
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
- 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
- 
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
- 	.map_page = swiotlb_map_page,
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/sys_ia64.c linux-2.6.32.11/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.32.11/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/sys_ia64.c	2010-04-04 20:46:41.480470677 -0400
-@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
- 	if (REGION_NUMBER(addr) == RGN_HPAGE)
- 		addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		addr = mm->free_area_cache;
-+	else
-+#endif
-+
- 	if (!addr)
- 		addr = mm->free_area_cache;
- 
-@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
- 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
-+			if (start_addr != mm->mmap_base) {
- 				/* Start a new search --- just in case we missed some holes.  */
--				addr = TASK_UNMAPPED_BASE;
-+				addr = mm->mmap_base;
- 				goto full_search;
- 			}
- 			return -ENOMEM;
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/topology.c linux-2.6.32.11/arch/ia64/kernel/topology.c
---- linux-2.6.32.11/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/topology.c	2010-04-04 20:46:41.480470677 -0400
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
- 	return ret;
- }
- 
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- 	.show   = cache_show
- };
- 
-diff -urNp linux-2.6.32.11/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.11/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.32.11/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/kernel/vmlinux.lds.S	2010-04-04 20:46:41.480470677 -0400
-@@ -190,7 +190,7 @@ SECTIONS
-   /* Per-cpu data: */
-   . = ALIGN(PERCPU_PAGE_SIZE);
-   PERCPU_VADDR(PERCPU_ADDR, :percpu)
--  __phys_per_cpu_start = __per_cpu_load;
-+  __phys_per_cpu_start = per_cpu_load;
-   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
-   						 * into percpu page size
- 						 */
-diff -urNp linux-2.6.32.11/arch/ia64/mm/fault.c linux-2.6.32.11/arch/ia64/mm/fault.c
---- linux-2.6.32.11/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
- 	return pte_present(pte);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
- 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
- 
--	if ((vma->vm_flags & mask) != mask)
-+	if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
- 
-+	}
-+
-   survive:
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.11/arch/ia64/mm/init.c linux-2.6.32.11/arch/ia64/mm/init.c
---- linux-2.6.32.11/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/mm/init.c	2010-04-04 20:46:41.480470677 -0400
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- 		vma->vm_end = vma->vm_start + PAGE_SIZE;
- 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+			if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+				vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+		}
-+#endif
-+
- 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 		down_write(&current->mm->mmap_sem);
- 		if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.32.11/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.11/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.32.11/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/ia64/sn/pci/pci_dma.c	2010-04-04 20:46:41.480470677 -0400
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
- 	return ret;
- }
- 
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- 	.alloc_coherent		= sn_dma_alloc_coherent,
- 	.free_coherent		= sn_dma_free_coherent,
- 	.map_page		= sn_dma_map_page,
-diff -urNp linux-2.6.32.11/arch/m32r/lib/usercopy.c linux-2.6.32.11/arch/m32r/lib/usercopy.c
---- linux-2.6.32.11/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/m32r/lib/usercopy.c	2010-04-04 20:46:41.480470677 -0400
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetch(from);
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		__copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetchw(to);
- 	if (access_ok(VERIFY_READ, from, n))
- 		__copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.32.11/arch/mips/alchemy/devboards/pm.c linux-2.6.32.11/arch/mips/alchemy/devboards/pm.c
---- linux-2.6.32.11/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/alchemy/devboards/pm.c	2010-04-04 20:46:41.480470677 -0400
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
- 
- }
- 
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- 	.valid		= suspend_valid_only_mem,
- 	.begin		= db1x_pm_begin,
- 	.enter		= db1x_pm_enter,
-diff -urNp linux-2.6.32.11/arch/mips/include/asm/elf.h linux-2.6.32.11/arch/mips/include/asm/elf.h
---- linux-2.6.32.11/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
- #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
- #endif
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.32.11/arch/mips/include/asm/page.h linux-2.6.32.11/arch/mips/include/asm/page.h
---- linux-2.6.32.11/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/include/asm/page.h	2010-04-04 20:46:41.480470677 -0400
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
-   #ifdef CONFIG_CPU_MIPS32
-     typedef struct { unsigned long pte_low, pte_high; } pte_t;
-     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
--    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
-   #else
-      typedef struct { unsigned long long pte; } pte_t;
-      #define pte_val(x)	((x).pte)
-diff -urNp linux-2.6.32.11/arch/mips/include/asm/system.h linux-2.6.32.11/arch/mips/include/asm/system.h
---- linux-2.6.32.11/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/include/asm/system.h	2010-04-04 20:46:41.480470677 -0400
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
-  */
- #define __ARCH_WANT_UNLOCKED_CTXSW
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ALMASK)
- 
- #endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.32.11/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.11/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.32.11/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/kernel/binfmt_elfn32.c	2010-04-04 20:46:41.480470677 -0400
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff -urNp linux-2.6.32.11/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.11/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.32.11/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/kernel/binfmt_elfo32.c	2010-04-04 20:46:41.480470677 -0400
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- 
- /*
-diff -urNp linux-2.6.32.11/arch/mips/kernel/kgdb.c linux-2.6.32.11/arch/mips/kernel/kgdb.c
---- linux-2.6.32.11/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/kernel/kgdb.c	2010-04-04 20:46:41.480470677 -0400
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;
- }
- 
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
- 
- /*
-diff -urNp linux-2.6.32.11/arch/mips/kernel/process.c linux-2.6.32.11/arch/mips/kernel/process.c
---- linux-2.6.32.11/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/kernel/process.c	2010-04-04 20:46:41.480470677 -0400
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
- out:
- 	return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() & ~PAGE_MASK;
--
--	return sp & ALMASK;
--}
-diff -urNp linux-2.6.32.11/arch/mips/kernel/syscall.c linux-2.6.32.11/arch/mips/kernel/syscall.c
---- linux-2.6.32.11/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/kernel/syscall.c	2010-04-04 20:46:41.480470677 -0400
-@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
- 	do_color_align = 0;
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
- 		    (!vmm || addr + len <= vmm->vm_start))
- 			return addr;
- 	}
--	addr = TASK_UNMAPPED_BASE;
-+	addr = current->mm->mmap_base;
- 	if (do_color_align)
- 		addr = COLOUR_ALIGN(addr, pgoff);
- 	else
-diff -urNp linux-2.6.32.11/arch/mips/mm/fault.c linux-2.6.32.11/arch/mips/mm/fault.c
---- linux-2.6.32.11/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/mips/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h>		/* For VMALLOC_END */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults.  It determines the address,
-  * and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.32.11/arch/parisc/include/asm/elf.h linux-2.6.32.11/arch/parisc/include/asm/elf.h
---- linux-2.6.32.11/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
-@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-    but it's not easy, and we've already done it here.  */
-diff -urNp linux-2.6.32.11/arch/parisc/include/asm/pgtable.h linux-2.6.32.11/arch/parisc/include/asm/pgtable.h
---- linux-2.6.32.11/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY       PAGE_EXECREAD
- #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.32.11/arch/parisc/kernel/module.c linux-2.6.32.11/arch/parisc/kernel/module.c
---- linux-2.6.32.11/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
-@@ -95,16 +95,38 @@
- 
- /* three functions to determine where in the module core
-  * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rx &&
-+		loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rw &&
-+		loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
--	return (loc >= me->module_init &&
--		loc <= (me->module_init + me->init_size));
-+	return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rx &&
-+		loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rw &&
-+		loc < (me->module_core_rw + me->core_size_rw));
- }
- 
- static inline int in_core(struct module *me, void *loc)
- {
--	return (loc >= me->module_core &&
--		loc <= (me->module_core + me->core_size));
-+	return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
- 
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
- 	}
- 
- 	/* align things a bit */
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.got_offset = me->core_size;
--	me->core_size += gots * sizeof(struct got_entry);
--
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.fdesc_offset = me->core_size;
--	me->core_size += fdescs * sizeof(Elf_Fdesc);
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += gots * sizeof(struct got_entry);
-+
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.fdesc_offset = me->core_size_rw;
-+	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
- 
- 	me->arch.got_max = gots;
- 	me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
- 
- 	BUG_ON(value == 0);
- 
--	got = me->module_core + me->arch.got_offset;
-+	got = me->module_core_rw + me->arch.got_offset;
- 	for (i = 0; got[i].addr; i++)
- 		if (got[i].addr == value)
- 			goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
--	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
- 
- 	if (!value) {
- 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
- 
- 	/* Create new one */
- 	fdesc->addr = value;
--	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 	return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
- 
- 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- 	end = table + sechdrs[me->arch.unwind_section].sh_size;
--	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 
- 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- 	       me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.32.11/arch/parisc/kernel/sys_parisc.c linux-2.6.32.11/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.32.11/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/kernel/sys_parisc.c	2010-04-04 20:46:41.480470677 -0400
-@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (flags & MAP_FIXED)
- 		return addr;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (filp) {
- 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.32.11/arch/parisc/kernel/traps.c linux-2.6.32.11/arch/parisc/kernel/traps.c
---- linux-2.6.32.11/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/kernel/traps.c	2010-04-04 20:46:41.480470677 -0400
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
- 
- 			down_read(&current->mm->mmap_sem);
- 			vma = find_vma(current->mm,regs->iaoq[0]);
--			if (vma && (regs->iaoq[0] >= vma->vm_start)
--				&& (vma->vm_flags & VM_EXEC)) {
--
-+			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- 				fault_address = regs->iaoq[0];
- 				fault_space = regs->iasq[0];
- 
-diff -urNp linux-2.6.32.11/arch/parisc/mm/fault.c linux-2.6.32.11/arch/parisc/mm/fault.c
---- linux-2.6.32.11/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/parisc/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
- 
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
--	if (code == 6 || code == 16)
-+	if (code == 6 || code == 7 || code == 16)
- 	    return VM_EXEC;
- 
- 	switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
- 			}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when rt_sigreturn trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int bl, depwi;
-+
-+		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+		if (err)
-+			break;
-+
-+		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+			err = get_user(ldw, (unsigned int *)addr);
-+			err |= get_user(bv, (unsigned int *)(addr+4));
-+			err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+			if (err)
-+				break;
-+
-+			if (ldw == 0x0E801096U &&
-+			    bv == 0xEAC0C000U &&
-+			    ldw2 == 0x0E881095U)
-+			{
-+				unsigned int resolver, map;
-+
-+				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+				if (err)
-+					break;
-+
-+				regs->gr[20] = instruction_pointer(regs)+8;
-+				regs->gr[21] = map;
-+				regs->gr[22] = resolver;
-+				regs->iaoq[0] = resolver | 3UL;
-+				regs->iaoq[1] = regs->iaoq[0] + 4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+#endif
-+
-+	do { /* PaX: rt_sigreturn emulation */
-+		unsigned int ldi1, ldi2, bel, nop;
-+
-+		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+		    ldi2 == 0x3414015AU &&
-+		    bel == 0xE4008200U &&
-+		    nop == 0x08000240U)
-+		{
-+			regs->gr[25] = (ldi1 & 2) >> 1;
-+			regs->gr[20] = __NR_rt_sigreturn;
-+			regs->gr[31] = regs->iaoq[1] + 16;
-+			regs->sr[0] = regs->iasq[1];
-+			regs->iaoq[0] = 0x100UL;
-+			regs->iaoq[1] = regs->iaoq[0] + 4;
-+			regs->iasq[0] = regs->sr[2];
-+			regs->iasq[1] = regs->sr[2];
-+			return 2;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
- 
- 	acc_type = parisc_acctyp(code,regs->iir);
- 
--	if ((vma->vm_flags & acc_type) != acc_type)
-+	if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+		    (address & ~3UL) == instruction_pointer(regs))
-+		{
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 3:
-+				return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			case 2:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
-+	}
- 
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/device.h linux-2.6.32.11/arch/powerpc/include/asm/device.h
---- linux-2.6.32.11/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/device.h	2010-04-04 20:46:41.485273950 -0400
-@@ -14,7 +14,7 @@ struct dev_archdata {
- 	struct device_node	*of_node;
- 
- 	/* DMA operations on that device */
--	struct dma_map_ops	*dma_ops;
-+	const struct dma_map_ops	*dma_ops;
- 
- 	/*
- 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.11/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.32.11/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/dma-mapping.h	2010-04-04 20:46:41.485273950 -0400
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- 	/* We don't handle the NULL dev case for ISA for now. We could
- 	 * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
- 	return dev->archdata.dma_ops;
- }
- 
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- 	dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
- 
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	BUG_ON(!dma_ops);
- 
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (dma_ops->mapping_error)
- 		return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/elf.h linux-2.6.32.11/arch/powerpc/include/asm/elf.h
---- linux-2.6.32.11/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/elf.h	2010-04-04 20:46:41.485273950 -0400
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE		(0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
-+#endif
- 
- /*
-  * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
- 	(0x7ff >> (PAGE_SHIFT - 12)) : \
- 	(0x3ffff >> (PAGE_SHIFT - 12)))
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
- 
- /*
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/iommu.h linux-2.6.32.11/arch/powerpc/include/asm/iommu.h
---- linux-2.6.32.11/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/iommu.h	2010-04-04 20:46:41.485273950 -0400
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
- 
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.11/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.32.11/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/kmap_types.h	2010-04-04 20:46:41.485273950 -0400
-@@ -26,6 +26,7 @@ enum km_type {
- 	KM_SOFTIRQ1,
- 	KM_PPC_SYNC_PAGE,
- 	KM_PPC_SYNC_ICACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/page_64.h linux-2.6.32.11/arch/powerpc/include/asm/page_64.h
---- linux-2.6.32.11/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/page_64.h	2010-04-04 20:46:41.485273950 -0400
-@@ -180,15 +180,18 @@ do {						\
-  * stack by default, so in the absense of a PT_GNU_STACK program header
-  * we turn execute permission off.
-  */
--#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- 	(test_thread_flag(TIF_32BIT) ? \
- 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
- 
- #include <asm-generic/getorder.h>
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/page.h linux-2.6.32.11/arch/powerpc/include/asm/page.h
---- linux-2.6.32.11/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/page.h	2010-04-04 20:46:41.485273950 -0400
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
-  * and needs to be executable.  This means the whole heap ends
-  * up being executable.
-  */
--#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
- #endif
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- #ifndef __ASSEMBLY__
- 
- #undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/pci.h linux-2.6.32.11/arch/powerpc/include/asm/pci.h
---- linux-2.6.32.11/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/pci.h	2010-04-04 20:46:41.485273950 -0400
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
- }
- 
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else	/* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops()	NULL
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.11/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.32.11/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/pte-hash32.h	2010-04-04 20:46:41.485273950 -0400
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
- #define _PAGE_USER	0x004	/* usermode access allowed */
- #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
-+#define _PAGE_EXEC	_PAGE_GUARDED
- #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
- #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/reg.h linux-2.6.32.11/arch/powerpc/include/asm/reg.h
---- linux-2.6.32.11/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/reg.h	2010-04-04 20:46:41.485273950 -0400
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
- #define   DSISR_NOHPTE		0x40000000	/* no translation found */
-+#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
- #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
- #define   DSISR_ISSTORE		0x02000000	/* access was a store */
- #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.11/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.32.11/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/swiotlb.h	2010-04-04 20:46:41.485273950 -0400
-@@ -13,7 +13,7 @@
- 
- #include <linux/swiotlb.h>
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static inline void dma_mark_clean(void *addr, size_t size) {}
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/include/asm/uaccess.h linux-2.6.32.11/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.32.11/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/include/asm/uaccess.h	2010-04-04 20:46:41.485273950 -0400
-@@ -327,52 +327,6 @@ do {								\
- extern unsigned long __copy_tofrom_user(void __user *to,
- 		const void __user *from, unsigned long size);
- 
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
--		const void __user *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_READ, from, n))
--		return __copy_tofrom_user((__force void __user *)to, from, n);
--	if ((unsigned long)from < TASK_SIZE) {
--		over = (unsigned long)from + n - TASK_SIZE;
--		return __copy_tofrom_user((__force void __user *)to, from,
--				n - over) + over;
--	}
--	return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
--		const void *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_WRITE, to, n))
--		return __copy_tofrom_user(to, (__force void __user *)from, n);
--	if ((unsigned long)to < TASK_SIZE) {
--		over = (unsigned long)to + n - TASK_SIZE;
--		return __copy_tofrom_user(to, (__force void __user *)from,
--				n - over) + over;
--	}
--	return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
--	__copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
--				    unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
--				  unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
--				  unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- 		const void __user *from, unsigned long n)
- {
-@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
- 	return __copy_tofrom_user((__force void __user *)to, from, n);
- }
- 
-@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
- 
-@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
- 	return __copy_to_user_inatomic(to, from, size);
- }
- 
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+		const void __user *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_READ, from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		return __copy_tofrom_user((__force void __user *)to, from, n);
-+	}
-+	if ((unsigned long)from < TASK_SIZE) {
-+		over = (unsigned long)from + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n - over))
-+			check_object_size(to, n - over, false);
-+		return __copy_tofrom_user((__force void __user *)to, from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+		const void *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_WRITE, to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from, n);
-+	}
-+	if ((unsigned long)to < TASK_SIZE) {
-+		over = (unsigned long)to + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n - over, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+	__copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
-+	if (likely(access_ok(VERIFY_READ, from, n)))
-+		n = __copy_from_user(to, from, n);
-+	else
-+		memset(to, 0, n);
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		n = __copy_to_user(to, from, n);
-+	}
-+	return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+				  unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
- 
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.11/arch/powerpc/kernel/cacheinfo.c
---- linux-2.6.32.11/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/cacheinfo.c	2010-04-04 20:46:41.485273950 -0400
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
- 	&cache_assoc_attr,
- };
- 
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- 	.show = cache_index_show,
- };
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/dma.c linux-2.6.32.11/arch/powerpc/kernel/dma.c
---- linux-2.6.32.11/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/dma.c	2010-04-04 20:46:41.485273950 -0400
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
- }
- #endif
- 
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- 	.alloc_coherent	= dma_direct_alloc_coherent,
- 	.free_coherent	= dma_direct_free_coherent,
- 	.map_sg		= dma_direct_map_sg,
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.11/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.32.11/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/dma-iommu.c	2010-04-04 20:46:41.485273950 -0400
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
- }
- 
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- 	struct iommu_table *tbl = get_iommu_table_base(dev);
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.11/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.32.11/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/dma-swiotlb.c	2010-04-04 20:46:41.485273950 -0400
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
-  * map_page, and unmap_page on highmem, use normal dma_ops
-  * for everything else.
-  */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = dma_direct_alloc_coherent,
- 	.free_coherent = dma_direct_free_coherent,
- 	.map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.11/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.32.11/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/exceptions-64e.S	2010-04-04 20:46:41.485273950 -0400
-@@ -455,6 +455,7 @@ storage_fault_common:
- 	std	r14,_DAR(r1)
- 	std	r15,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	mr	r4,r14
- 	mr	r5,r15
- 	ld	r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- 	cmpdi	r3,0
- 	bne-	1f
- 	b	.ret_from_except_lite
--1:	bl	.save_nvgprs
--	mr	r5,r3
-+1:	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	ld	r4,_DAR(r1)
- 	bl	.bad_page_fault
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.11/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.32.11/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/exceptions-64s.S	2010-04-04 20:46:41.485273950 -0400
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11:	ld	r4,_DAR(r1)
- 	ld	r5,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	bl	.do_page_fault
- 	cmpdi	r3,0
- 	beq+	13f
--	bl	.save_nvgprs
- 	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	lwz	r4,_DAR(r1)
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/ibmebus.c linux-2.6.32.11/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.32.11/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/ibmebus.c	2010-04-04 20:46:41.485273950 -0400
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
- 	return 1;
- }
- 
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- 	.alloc_coherent = ibmebus_alloc_coherent,
- 	.free_coherent  = ibmebus_free_coherent,
- 	.map_sg         = ibmebus_map_sg,
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/kgdb.c linux-2.6.32.11/arch/powerpc/kernel/kgdb.c
---- linux-2.6.32.11/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/kgdb.c	2010-04-04 20:46:41.485273950 -0400
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
- 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- 		return 0;
- 
--	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- 		regs->nip += 4;
- 
- 	return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
- /*
-  * Global data
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/module_32.c linux-2.6.32.11/arch/powerpc/kernel/module_32.c
---- linux-2.6.32.11/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/module_32.c	2010-04-04 20:46:41.485273950 -0400
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
- 			me->arch.core_plt_section = i;
- 	}
- 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
--		printk("Module doesn't contain .plt or .init.plt sections.\n");
-+		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- 		return -ENOEXEC;
- 	}
- 
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
- 
- 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- 	/* Init, or core PLT? */
--	if (location >= mod->module_core
--	    && location < mod->module_core + mod->core_size)
-+	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
--	else
-+	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+	else {
-+		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+		return ~0UL;
-+	}
- 
- 	/* Find this entry, or if that fails, the next avail. entry */
- 	while (entry->jump[0]) {
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/module.c linux-2.6.32.11/arch/powerpc/kernel/module.c
---- linux-2.6.32.11/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/module.c	2010-04-04 20:46:41.485273950 -0400
-@@ -31,11 +31,24 @@
- 
- LIST_HEAD(module_bug_list);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- 	if (size == 0)
- 		return NULL;
- 
-+	return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+	if (size == 0)
-+		return NULL;
-+
- 	return vmalloc_exec(size);
- }
- 
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- 				    const Elf_Shdr *sechdrs,
- 				    const char *name)
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/pci-common.c linux-2.6.32.11/arch/powerpc/kernel/pci-common.c
---- linux-2.6.32.11/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/pci-common.c	2010-04-04 20:46:41.485273950 -0400
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
- 
- 
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
- 
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- 	pci_dma_ops = dma_ops;
- }
- 
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- 	return pci_dma_ops;
- }
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/process.c linux-2.6.32.11/arch/powerpc/kernel/process.c
---- linux-2.6.32.11/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/process.c	2010-04-04 20:46:41.485273950 -0400
-@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
- 		sp -= get_random_int() & ~PAGE_MASK;
- 	return sp & ~0xf;
- }
--
--static inline unsigned long brk_rnd(void)
--{
--        unsigned long rnd = 0;
--
--	/* 8MB for 32bit, 1GB for 64bit */
--	if (is_32bit_task())
--		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
--	else
--		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
--	return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long base = mm->brk;
--	unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
--	/*
--	 * If we are using 1TB segments and we are allowed to randomise
--	 * the heap, we can put it above 1TB so it is backed by a 1TB
--	 * segment. Otherwise the heap will be in the bottom 1TB
--	 * which always uses 256MB segments and this may result in a
--	 * performance penalty.
--	 */
--	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
--		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
--	ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < mm->brk)
--		return mm->brk;
--
--	return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
--	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < base)
--		return base;
--
--	return ret;
--}
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/signal_32.c linux-2.6.32.11/arch/powerpc/kernel/signal_32.c
---- linux-2.6.32.11/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/signal_32.c	2010-04-04 20:46:41.489273754 -0400
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
- 	/* Save user registers on the stack */
- 	frame = &rt_sf->uc.uc_mcontext;
- 	addr = frame;
--	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		if (save_user_regs(regs, frame, 0, 1))
- 			goto badframe;
- 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/signal_64.c linux-2.6.32.11/arch/powerpc/kernel/signal_64.c
---- linux-2.6.32.11/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/signal_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
- 	current->thread.fpscr.val = 0;
- 
- 	/* Set up to return from userspace. */
--	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- 	} else {
- 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.11/arch/powerpc/kernel/sys_ppc32.c
---- linux-2.6.32.11/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/sys_ppc32.c	2010-04-04 20:46:41.489273754 -0400
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
- 	if (oldlenp) {
- 		if (!error) {
- 			if (get_user(oldlen, oldlenp) ||
--			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- 				error = -EFAULT;
- 		}
--		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- 	}
- 	return error;
- }
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/vdso.c linux-2.6.32.11/arch/powerpc/kernel/vdso.c
---- linux-2.6.32.11/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/vdso.c	2010-04-04 20:46:41.489273754 -0400
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
- 
- #include "setup.h"
- 
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = VDSO32_MBASE;
- #endif
- 
--	current->mm->context.vdso_base = 0;
-+	current->mm->context.vdso_base = ~0UL;
- 
- 	/* vDSO has a problem and was disabled, just don't "enable" it for the
- 	 * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = get_unmapped_area(NULL, vdso_base,
- 				      (vdso_pages << PAGE_SHIFT) +
- 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
--				      0, 0);
-+				      0, MAP_PRIVATE | MAP_EXECUTABLE);
- 	if (IS_ERR_VALUE(vdso_base)) {
- 		rc = vdso_base;
- 		goto fail_mmapsem;
-diff -urNp linux-2.6.32.11/arch/powerpc/kernel/vio.c linux-2.6.32.11/arch/powerpc/kernel/vio.c
---- linux-2.6.32.11/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/kernel/vio.c	2010-04-04 20:46:41.489273754 -0400
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
- 	vio_cmo_dealloc(viodev, alloc_size);
- }
- 
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
- 	.free_coherent  = vio_dma_iommu_free_coherent,
- 	.map_sg         = vio_dma_iommu_map_sg,
- 	.unmap_sg       = vio_dma_iommu_unmap_sg,
-+	.dma_supported  = dma_iommu_dma_supported,
- 	.map_page       = vio_dma_iommu_map_page,
- 	.unmap_page     = vio_dma_iommu_unmap_page,
- 
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
- 
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
--	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/lib/usercopy_64.c linux-2.6.32.11/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.32.11/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/lib/usercopy_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
- 
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_READ, from, n)))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_WRITE, to, n)))
--		n = __copy_to_user(to, from, n);
--	return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- 			   unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
- 	return n;
- }
- 
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.11/arch/powerpc/mm/fault.c linux-2.6.32.11/arch/powerpc/mm/fault.c
---- linux-2.6.32.11/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/mm/fault.c	2010-04-04 20:46:41.489273754 -0400
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
- 
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
- 
- 
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
- }
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int __user *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * Check whether the instruction at regs->nip is a store using
-  * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
- 	 * indicate errors in DSISR but can validly be set in SRR1.
- 	 */
- 	if (trap == 0x400)
--		error_code &= 0x48200000;
-+		error_code &= 0x58200000;
- 	else
- 		is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
-          * "undefined".  Of those that can be set, this is the only
-          * one which seems bad.
-          */
--	if (error_code & 0x10000000)
-+	if (error_code & DSISR_GUARDED)
-                 /* Guarded storage error. */
- 		goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- 		 * processors use the same I/D cache coherency mechanism
- 		 * as embedded.
- 		 */
--		if (error_code & DSISR_PROTFAULT)
-+		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- 			goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
- 
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- 	/* User mode accesses cause a SIGSEGV */
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+			if (is_exec && regs->nip == address) {
-+#endif
-+				switch (pax_handle_fetch_fault(regs)) {
-+				}
-+
-+				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		_exception(SIGSEGV, regs, code, address);
- 		return 0;
- 	}
-diff -urNp linux-2.6.32.11/arch/powerpc/mm/mmap_64.c linux-2.6.32.11/arch/powerpc/mm/mmap_64.c
---- linux-2.6.32.11/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/mm/mmap_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.11/arch/powerpc/mm/slice.c linux-2.6.32.11/arch/powerpc/mm/slice.c
---- linux-2.6.32.11/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/mm/slice.c	2010-04-04 20:46:41.489273754 -0400
-@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
- 	if (fixed && addr > (mm->task_size - len))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+		addr = 0;
-+#endif
-+
- 	/* If hint, make sure it matches our alignment restrictions */
- 	if (!fixed && addr) {
- 		addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.11/arch/powerpc/platforms/52xx/lite5200_pm.c
---- linux-2.6.32.11/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-04-04 20:46:41.489273754 -0400
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- 	lite5200_pm_target_state = PM_SUSPEND_ON;
- }
- 
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- 	.valid		= lite5200_pm_valid,
- 	.begin		= lite5200_pm_begin,
- 	.prepare	= lite5200_pm_prepare,
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.11/arch/powerpc/platforms/52xx/mpc52xx_pm.c
---- linux-2.6.32.11/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-04-04 20:46:41.489273754 -0400
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- 	iounmap(mbar);
- }
- 
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- 	.valid		= mpc52xx_pm_valid,
- 	.prepare	= mpc52xx_pm_prepare,
- 	.enter		= mpc52xx_pm_enter,
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.11/arch/powerpc/platforms/83xx/suspend.c
---- linux-2.6.32.11/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/83xx/suspend.c	2010-04-04 20:46:41.489273754 -0400
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- 	return ret;
- }
- 
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- 	.valid = mpc83xx_suspend_valid,
- 	.begin = mpc83xx_suspend_begin,
- 	.enter = mpc83xx_suspend_enter,
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.11/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.32.11/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/cell/iommu.c	2010-04-04 20:46:41.489273754 -0400
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
- 
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
- 
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- 	.alloc_coherent = dma_fixed_alloc_coherent,
- 	.free_coherent  = dma_fixed_free_coherent,
- 	.map_sg         = dma_fixed_map_sg,
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.11/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.32.11/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/ps3/system-bus.c	2010-04-04 20:46:41.489273754 -0400
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
- 	return mask >= DMA_BIT_MASK(32);
- }
- 
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
- 	.unmap_page = ps3_unmap_page,
- };
- 
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.32.11/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.11/arch/powerpc/platforms/pseries/Kconfig
---- linux-2.6.32.11/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/powerpc/platforms/pseries/Kconfig	2010-04-04 20:46:41.489273754 -0400
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- 	depends on PPC64 && PPC_BOOK3S
- 	bool "IBM pSeries & new (POWER5-based) iSeries"
- 	select MPIC
-+	select PCI_MSI
-+	select XICS
- 	select PPC_I8259
- 	select PPC_RTAS
- 	select RTAS_ERROR_LOGGING
-diff -urNp linux-2.6.32.11/arch/s390/include/asm/elf.h linux-2.6.32.11/arch/s390/include/asm/elf.h
---- linux-2.6.32.11/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/include/asm/elf.h	2010-04-04 20:46:41.489273754 -0400
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
-    that it will "exec", and that there is sufficient room for the brk.  */
- #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports. */
- 
-diff -urNp linux-2.6.32.11/arch/s390/include/asm/setup.h linux-2.6.32.11/arch/s390/include/asm/setup.h
---- linux-2.6.32.11/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/include/asm/setup.h	2010-04-04 20:46:41.489273754 -0400
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode	(1)
- #else
- #define switch_amode	(0)
- #endif
- 
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec	(1)
- #else
- #define s390_noexec	(0)
- #endif
-diff -urNp linux-2.6.32.11/arch/s390/include/asm/uaccess.h linux-2.6.32.11/arch/s390/include/asm/uaccess.h
---- linux-2.6.32.11/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/include/asm/uaccess.h	2010-04-04 20:46:41.489273754 -0400
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n) && (n <= 256))
- 		return uaccess.copy_from_user_small(n, from, to);
- 	else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else
-diff -urNp linux-2.6.32.11/arch/s390/Kconfig linux-2.6.32.11/arch/s390/Kconfig
---- linux-2.6.32.11/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/Kconfig	2010-04-04 20:46:41.489273754 -0400
-@@ -194,28 +194,26 @@ config AUDIT_ARCH
- 
- config S390_SWITCH_AMODE
- 	bool "Switch kernel/user addressing modes"
-+	default y
- 	help
- 	  This option allows to switch the addressing modes of kernel and user
--	  space. The kernel parameter switch_amode=on will enable this feature,
--	  default is disabled. Enabling this (via kernel parameter) on machines
--	  earlier than IBM System z9-109 EC/BC will reduce system performance.
-+	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
-+	  will reduce system performance.
- 
- 	  Note that this option will also be selected by selecting the execute
--	  protection option below. Enabling the execute protection via the
--	  noexec kernel parameter will also switch the addressing modes,
--	  independent of the switch_amode kernel parameter.
-+	  protection option below. Enabling the execute protection will also
-+	  switch the addressing modes, independent of this option.
- 
- 
- config S390_EXEC_PROTECT
- 	bool "Data execute protection"
-+	default y
- 	select S390_SWITCH_AMODE
- 	help
- 	  This option allows to enable a buffer overflow protection for user
- 	  space programs and it also selects the addressing mode option above.
--	  The kernel parameter noexec=on will enable this feature and also
--	  switch the addressing modes, default is disabled. Enabling this (via
--	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
--	  will reduce system performance.
-+	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+	  reduce system performance.
- 
- comment "Code generation options"
- 
-diff -urNp linux-2.6.32.11/arch/s390/kernel/module.c linux-2.6.32.11/arch/s390/kernel/module.c
---- linux-2.6.32.11/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/kernel/module.c	2010-04-04 20:46:41.492578989 -0400
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
- 
- 	/* Increase core size by size of got & plt and set start
- 	   offsets for got and plt. */
--	me->core_size = ALIGN(me->core_size, 4);
--	me->arch.got_offset = me->core_size;
--	me->core_size += me->arch.got_size;
--	me->arch.plt_offset = me->core_size;
--	me->core_size += me->arch.plt_size;
-+	me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += me->arch.got_size;
-+	me->arch.plt_offset = me->core_size_rx;
-+	me->core_size_rx += me->arch.plt_size;
- 	return 0;
- }
- 
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		if (info->got_initialized == 0) {
- 			Elf_Addr *gotent;
- 
--			gotent = me->module_core + me->arch.got_offset +
-+			gotent = me->module_core_rw + me->arch.got_offset +
- 				info->got_offset;
- 			*gotent = val;
- 			info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		else if (r_type == R_390_GOTENT ||
- 			 r_type == R_390_GOTPLTENT)
- 			*(unsigned int *) loc =
--				(val + (Elf_Addr) me->module_core - loc) >> 1;
-+				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- 		else if (r_type == R_390_GOT64 ||
- 			 r_type == R_390_GOTPLT64)
- 			*(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
- 		if (info->plt_initialized == 0) {
- 			unsigned int *ip;
--			ip = me->module_core + me->arch.plt_offset +
-+			ip = me->module_core_rx + me->arch.plt_offset +
- 				info->plt_offset;
- #ifndef CONFIG_64BIT
- 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
- 			      (r_type == R_390_PLT32DBL &&
- 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
--				val = (Elf_Addr) me->module_core +
-+				val = (Elf_Addr) me->module_core_rx +
- 					me->arch.plt_offset +
- 					info->plt_offset;
- 			val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
- 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
- 		val = val + rela->r_addend -
--			((Elf_Addr) me->module_core + me->arch.got_offset);
-+			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- 		if (r_type == R_390_GOTOFF16)
- 			*(unsigned short *) loc = val;
- 		else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		break;
- 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
- 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
--		val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- 			rela->r_addend - loc;
- 		if (r_type == R_390_GOTPC)
- 			*(unsigned int *) loc = val;
-diff -urNp linux-2.6.32.11/arch/s390/kernel/setup.c linux-2.6.32.11/arch/s390/kernel/setup.c
---- linux-2.6.32.11/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/kernel/setup.c	2010-04-04 20:46:41.492578989 -0400
-@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
- early_param("mem", early_parse_mem);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- 				 unsigned long user32_amode)
- {
-@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
- 		return 0;
- 	}
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
--	switch_amode = 1;
--	return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- 					unsigned long user32_amode)
-@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
- 
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
--	if (!strncmp(p, "off", 3))
--		return 0;
--	switch_amode = 1;
--	s390_noexec = 1;
--	return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- 	if (s390_noexec) {
-diff -urNp linux-2.6.32.11/arch/s390/mm/mmap.c linux-2.6.32.11/arch/s390/mm/mmap.c
---- linux-2.6.32.11/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/s390/mm/mmap.c	2010-04-04 20:46:41.492578989 -0400
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.11/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.11/arch/sh/boards/mach-hp6xx/pm.c
---- linux-2.6.32.11/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sh/boards/mach-hp6xx/pm.c	2010-04-04 20:46:41.492578989 -0400
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
- 	return 0;
- }
- 
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- 	.enter		= hp6x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.11/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.11/arch/sh/kernel/cpu/sh4/sq.c
---- linux-2.6.32.11/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sh/kernel/cpu/sh4/sq.c	2010-04-04 20:46:41.492578989 -0400
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
- 	NULL,
- };
- 
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- 	.show	= sq_sysfs_show,
- 	.store	= sq_sysfs_store,
- };
-diff -urNp linux-2.6.32.11/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.11/arch/sh/kernel/cpu/shmobile/pm.c
---- linux-2.6.32.11/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sh/kernel/cpu/shmobile/pm.c	2010-04-04 20:46:41.492578989 -0400
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
- 	return 0;
- }
- 
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- 	.enter          = sh_pm_enter,
- 	.valid          = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.11/arch/sh/kernel/kgdb.c linux-2.6.32.11/arch/sh/kernel/kgdb.c
---- linux-2.6.32.11/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sh/kernel/kgdb.c	2010-04-04 20:46:41.492578989 -0400
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/atomic_64.h linux-2.6.32.11/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.32.11/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/atomic_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -14,18 +14,38 @@
- #define ATOMIC64_INIT(i)	{ (i) }
- 
- #define atomic_read(v)		((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- #define atomic64_read(v)	((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- 
- #define atomic_set(v, i)	(((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
- #define atomic64_set(v, i)	(((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
- 
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(int, atomic64_t *);
-+extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(int, atomic64_t *);
- 
- extern int atomic_add_ret(int, atomic_t *);
- extern int atomic64_add_ret(int, atomic64_t *);
-+extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern int atomic64_sub_ret(int, atomic64_t *);
- 
-@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
- 
- #define atomic_inc_return(v) atomic_add_ret(1, v)
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
- 
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
- 
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+	atomic64_add_unchecked(1, v);
-+}
- 
- #define atomic_dec(v) atomic_sub(1, v)
- #define atomic64_dec(v) atomic64_sub(1, v)
-@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
- 
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%icc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
- 
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%xcc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic64_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.11/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.32.11/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/dma-mapping.h	2010-04-04 20:46:41.492578989 -0400
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h)	(1)
- 
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- 	if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/elf_32.h linux-2.6.32.11/arch/sparc/include/asm/elf_32.h
---- linux-2.6.32.11/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/elf_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -116,6 +116,13 @@ typedef struct {
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  This can NOT be done in userspace
-    on Sparc.  */
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/elf_64.h linux-2.6.32.11/arch/sparc/include/asm/elf_64.h
---- linux-2.6.32.11/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/elf_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE		0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  */
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.11/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.32.11/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/pgtable_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
- 
- #define PMD_SHIFT		SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
- 
- #ifdef MODULE
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.11/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.32.11/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/pgtsrmmu.h	2010-04-04 20:46:41.492578989 -0400
-@@ -115,6 +115,13 @@
- 				    SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- 				    SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- 				    SRMMU_DIRTY | SRMMU_REF)
- 
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.11/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.32.11/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/spinlock_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
- 	__asm__ __volatile__ (
- "1:	ldsw		[%2], %0\n"
- "	brlz,pn		%0, 2f\n"
--"4:	 add		%0, 1, %1\n"
-+"4:	 addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
- "	.previous"
- 	: "=&r" (tmp1), "=&r" (tmp2)
- 	: "r" (lock)
--	: "memory");
-+	: "memory", "cc");
- }
- 
- static int inline arch_read_trylock(raw_rwlock_t *lock)
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
- "1:	ldsw		[%2], %0\n"
- "	brlz,a,pn	%0, 2f\n"
- "	 mov		0, %0\n"
--"	add		%0, 1, %1\n"
-+"	addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
- 
- 	__asm__ __volatile__(
- "1:	lduw	[%2], %0\n"
--"	sub	%0, 1, %1\n"
-+"	subcc	%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs	%%icc, 6\n"
-+#endif
-+
- "	cas	[%2], %0, %1\n"
- "	cmp	%0, %1\n"
- "	bne,pn	%%xcc, 1b\n"
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.11/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.32.11/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/uaccess_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
- 
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) to, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
- 		return __copy_user(to, (__force void __user *) from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_user(to, (__force void __user *) from, n);
- }
- 
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) from, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
- 		return __copy_user((__force void __user *) to, from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	return __copy_user((__force void __user *) to, from, n);
- }
- 
-diff -urNp linux-2.6.32.11/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.11/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.32.11/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/include/asm/uaccess_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
-        : "=r" (x) : "r" (__m(addr)), "i" (retval))
- 
- extern int __get_user_bad(void);
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- extern unsigned long __must_check ___copy_from_user(void *to,
- 						    const void __user *from,
-@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
--	unsigned long ret = ___copy_from_user(to, from, size);
-+	unsigned long ret;
- 
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(to, size, false);
-+
-+	ret = ___copy_from_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_from_user_fixup(to, from, size);
- 	return ret;
-@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
--	unsigned long ret = ___copy_to_user(to, from, size);
-+	unsigned long ret;
-+
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(from, size, true);
- 
-+	ret = ___copy_to_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_to_user_fixup(to, from, size);
- 	return ret;
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/iommu.c linux-2.6.32.11/arch/sparc/kernel/iommu.c
---- linux-2.6.32.11/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/iommu.c	2010-04-04 20:46:41.492578989 -0400
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- 	.alloc_coherent		= dma_4u_alloc_coherent,
- 	.free_coherent		= dma_4u_free_coherent,
- 	.map_page		= dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
- 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
- };
- 
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/ioport.c linux-2.6.32.11/arch/sparc/kernel/ioport.c
---- linux-2.6.32.11/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/ioport.c	2010-04-04 20:46:41.492578989 -0400
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
- 	BUG();
- }
- 
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- 	.alloc_coherent		= sbus_alloc_coherent,
- 	.free_coherent		= sbus_free_coherent,
- 	.map_page		= sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- 	.sync_sg_for_device	= sbus_sync_sg_for_device,
- };
- 
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
- 	}
- }
- 
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- 	.alloc_coherent		= pci32_alloc_coherent,
- 	.free_coherent		= pci32_free_coherent,
- 	.map_page		= pci32_map_page,
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/kgdb_32.c linux-2.6.32.11/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.32.11/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/kgdb_32.c	2010-04-04 20:46:41.492578989 -0400
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x7d */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/kgdb_64.c linux-2.6.32.11/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.32.11/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/kgdb_64.c	2010-04-04 20:46:41.492578989 -0400
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x72 */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/Makefile linux-2.6.32.11/arch/sparc/kernel/Makefile
---- linux-2.6.32.11/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/Makefile	2010-04-04 20:46:41.492578989 -0400
-@@ -3,7 +3,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- extra-y     := head_$(BITS).o
- extra-y     += init_task.o
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.11/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.32.11/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/pci_sun4v.c	2010-04-04 20:46:41.492578989 -0400
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- 	.alloc_coherent			= dma_4v_alloc_coherent,
- 	.free_coherent			= dma_4v_free_coherent,
- 	.map_page			= dma_4v_map_page,
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.11/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.32.11/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/sys_sparc_32.c	2010-04-04 20:46:41.492578989 -0400
-@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (ARCH_SUN4C && len > 0x20000000)
- 		return -ENOMEM;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (flags & MAP_SHARED)
- 		addr = COLOUR_ALIGN(addr);
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.11/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.32.11/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/sys_sparc_64.c	2010-04-04 20:46:41.492578989 -0400
-@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
- 	}
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
-+		start_addr = addr = mm->mmap_base;
- 	        mm->cached_hole_size = 0;
- 	}
- 
-@@ -175,8 +179,8 @@ full_search:
- 			vma = find_vma(mm, VA_EXCLUDE_END);
- 		}
- 		if (unlikely(task_size < addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
- 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- 	    sysctl_legacy_va_layout) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
-@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
- 			gap = (task_size / 6 * 5);
- 
- 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.11/arch/sparc/kernel/traps_64.c linux-2.6.32.11/arch/sparc/kernel/traps_64.c
---- linux-2.6.32.11/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/kernel/traps_64.c	2010-04-04 20:46:41.496772577 -0400
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
- 
- 	lvl -= 0x100;
- 	if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		if (lvl == 6)
-+			pax_report_refcount_overflow(regs);
-+#endif
-+
- 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- 		die_if_kernel(buffer, regs);
- 	}
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- 	char buffer[32];
--	
-+
- 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
- 		return;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (lvl == 6)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
- 
- 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-diff -urNp linux-2.6.32.11/arch/sparc/lib/atomic_64.S linux-2.6.32.11/arch/sparc/lib/atomic_64.S
---- linux-2.6.32.11/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/lib/atomic_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_add, .-atomic_add
- 
-+	.globl	atomic_add_unchecked
-+	.type	atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	add	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_add_unchecked, .-atomic_add_unchecked
-+
- 	.globl	atomic_sub
- 	.type	atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_sub, .-atomic_sub
- 
-+	.globl	atomic_sub_unchecked
-+	.type	atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	sub	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- 	.globl	atomic_add_ret
- 	.type	atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add, .-atomic64_add
- 
-+	.globl	atomic64_add_unchecked
-+	.type	atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- 	.globl	atomic64_sub
- 	.type	atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add_ret, .-atomic64_add_ret
- 
-+	.globl	atomic64_add_ret_unchecked
-+	.type	atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 add	%g7, %o0, %g7
-+	mov	%g7, %o0
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- 	.globl	atomic64_sub_ret
- 	.type	atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-diff -urNp linux-2.6.32.11/arch/sparc/lib/ksyms.c linux-2.6.32.11/arch/sparc/lib/ksyms.c
---- linux-2.6.32.11/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/lib/ksyms.c	2010-04-04 20:46:41.496772577 -0400
-@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
- 
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
- EXPORT_SYMBOL(atomic64_add_ret);
-diff -urNp linux-2.6.32.11/arch/sparc/lib/rwsem_64.S linux-2.6.32.11/arch/sparc/lib/rwsem_64.S
---- linux-2.6.32.11/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/lib/rwsem_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -11,7 +11,12 @@
- 	.globl		__down_read
- __down_read:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- 	.globl		__down_read_trylock
- __down_read_trylock:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cmp		%g7, 0
- 	bl,pn		%icc, 2f
- 	 mov		0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- 	cmp		%g3, 0
- 	bne,pn		%icc, 2f
- 	 mov		0, %o1
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- 	lduw		[%o0], %g1
--	sub		%g1, 1, %g7
-+	subcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-diff -urNp linux-2.6.32.11/arch/sparc/Makefile linux-2.6.32.11/arch/sparc/Makefile
---- linux-2.6.32.11/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/Makefile	2010-04-04 20:46:41.496772577 -0400
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
- 
-diff -urNp linux-2.6.32.11/arch/sparc/mm/fault_32.c linux-2.6.32.11/arch/sparc/mm/fault_32.c
---- linux-2.6.32.11/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/mm/fault_32.c	2010-04-04 20:46:41.496772577 -0400
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
- 	return safe_compute_effective_address(regs, insn);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->pc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned int addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->pc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned int addr;
-+
-+			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr, save, call;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			else
-+				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->pc = call_dl_resolve;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+				regs->pc = addr;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->pc-4));
-+		err |= get_user(call, (unsigned int *)regs->pc);
-+		err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+			regs->u_regs[UREG_RETPC] = regs->pc;
-+			regs->pc = dl_resolve;
-+			regs->npc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- 			       unsigned long address)
- {
-@@ -231,6 +495,24 @@ good_area:
- 		if(!(vma->vm_flags & VM_WRITE))
- 			goto bad_area;
- 	} else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		/* Allow reads even for write-only mappings */
- 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- 			goto bad_area;
-diff -urNp linux-2.6.32.11/arch/sparc/mm/fault_64.c linux-2.6.32.11/arch/sparc/mm/fault_64.c
---- linux-2.6.32.11/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/mm/fault_64.c	2010-04-04 20:46:41.496772577 -0400
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
- 	show_regs(regs);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned long addr;
-+
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #4 */
-+		unsigned int sethi, mov1, call, mov2;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    mov1 == 0x8210000FU &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    mov2 == 0x9E100001U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #5 */
-+		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    (or1 & 0xFFFFE000U) == 0x82106000U &&
-+		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+		    sllx == 0x83287020U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #6 */
-+		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    sllx == 0x83287020U &&
-+		    (or & 0xFFFFE000U) == 0x8A116000U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+			unsigned int save, call;
-+			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+			else
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->tpc = call_dl_resolve;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+				if (test_thread_flag(TIF_32BIT))
-+					addr &= 0xFFFFFFFFUL;
-+
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+
-+			/* PaX: 64-bit PLT stub */
-+			err = get_user(sethi1, (unsigned int *)addr);
-+			err |= get_user(sethi2, (unsigned int *)(addr+4));
-+			err |= get_user(or1, (unsigned int *)(addr+8));
-+			err |= get_user(or2, (unsigned int *)(addr+12));
-+			err |= get_user(sllx, (unsigned int *)(addr+16));
-+			err |= get_user(add, (unsigned int *)(addr+20));
-+			err |= get_user(jmpl, (unsigned int *)(addr+24));
-+			err |= get_user(nop, (unsigned int *)(addr+28));
-+			if (err)
-+				break;
-+
-+			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+			    (or1 & 0xFFFFE000U) == 0x88112000U &&
-+			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+			    sllx == 0x89293020U &&
-+			    add == 0x8A010005U &&
-+			    jmpl == 0x89C14000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+				regs->u_regs[UREG_G4] <<= 32;
-+				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+				regs->u_regs[UREG_G4] = addr + 24;
-+				addr = regs->u_regs[UREG_G5];
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->tpc-4));
-+		err |= get_user(call, (unsigned int *)regs->tpc);
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				dl_resolve &= 0xFFFFFFFFUL;
-+
-+			regs->u_regs[UREG_RETPC] = regs->tpc;
-+			regs->tpc = dl_resolve;
-+			regs->tnpc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (ba & 0xFFF00000U) == 0x30600000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- 	struct mm_struct *mm = current->mm;
-@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
- 	if (!vma)
- 		goto bad_area;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	/* PaX: detect ITLB misses on non-exec pages */
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+	{
-+		if (address != regs->tpc)
-+			goto good_area;
-+
-+		up_read(&mm->mmap_sem);
-+		switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+		case 2:
-+		case 3:
-+			return;
-+#endif
-+
-+		}
-+		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	/* Pure DTLB misses do not tell us whether the fault causing
- 	 * load/store/atomic was a write or not, it only says that there
- 	 * was no match.  So in such a case we (carefully) read the
-diff -urNp linux-2.6.32.11/arch/sparc/mm/init_32.c linux-2.6.32.11/arch/sparc/mm/init_32.c
---- linux-2.6.32.11/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/mm/init_32.c	2010-04-04 20:46:41.496772577 -0400
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
- 
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- 	switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
- 
- 	/* Initialize the protection map with non-constant, MMU dependent values. */
- 	protection_map[0] = PAGE_NONE;
--	protection_map[1] = PAGE_READONLY;
--	protection_map[2] = PAGE_COPY;
--	protection_map[3] = PAGE_COPY;
-+	protection_map[1] = PAGE_READONLY_NOEXEC;
-+	protection_map[2] = PAGE_COPY_NOEXEC;
-+	protection_map[3] = PAGE_COPY_NOEXEC;
- 	protection_map[4] = PAGE_READONLY;
- 	protection_map[5] = PAGE_READONLY;
- 	protection_map[6] = PAGE_COPY;
- 	protection_map[7] = PAGE_COPY;
- 	protection_map[8] = PAGE_NONE;
--	protection_map[9] = PAGE_READONLY;
--	protection_map[10] = PAGE_SHARED;
--	protection_map[11] = PAGE_SHARED;
-+	protection_map[9] = PAGE_READONLY_NOEXEC;
-+	protection_map[10] = PAGE_SHARED_NOEXEC;
-+	protection_map[11] = PAGE_SHARED_NOEXEC;
- 	protection_map[12] = PAGE_READONLY;
- 	protection_map[13] = PAGE_READONLY;
- 	protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.32.11/arch/sparc/mm/Makefile linux-2.6.32.11/arch/sparc/mm/Makefile
---- linux-2.6.32.11/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/mm/Makefile	2010-04-04 20:46:41.496772577 -0400
-@@ -2,7 +2,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
- obj-y                   += fault_$(BITS).o
-diff -urNp linux-2.6.32.11/arch/sparc/mm/srmmu.c linux-2.6.32.11/arch/sparc/mm/srmmu.c
---- linux-2.6.32.11/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/sparc/mm/srmmu.c	2010-04-04 20:46:41.496772577 -0400
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
- 
-diff -urNp linux-2.6.32.11/arch/um/include/asm/kmap_types.h linux-2.6.32.11/arch/um/include/asm/kmap_types.h
---- linux-2.6.32.11/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/um/include/asm/kmap_types.h	2010-04-04 20:46:41.496772577 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.11/arch/um/include/asm/page.h linux-2.6.32.11/arch/um/include/asm/page.h
---- linux-2.6.32.11/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/um/include/asm/page.h	2010-04-04 20:46:41.496772577 -0400
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK	(~(PAGE_SIZE-1))
- 
-+#define ktla_ktva(addr)			(addr)
-+#define ktva_ktla(addr)			(addr)
-+
- #ifndef __ASSEMBLY__
- 
- struct page;
-diff -urNp linux-2.6.32.11/arch/um/sys-i386/syscalls.c linux-2.6.32.11/arch/um/sys-i386/syscalls.c
---- linux-2.6.32.11/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/um/sys-i386/syscalls.c	2010-04-04 20:46:41.496772577 -0400
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-diff -urNp linux-2.6.32.11/arch/x86/boot/bitops.h linux-2.6.32.11/arch/x86/boot/bitops.h
---- linux-2.6.32.11/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/bitops.h	2010-04-04 20:46:41.496772577 -0400
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
- 	u8 v;
- 	const u32 *p = (const u32 *)addr;
- 
--	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- 	return v;
- }
- 
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
- 
- static inline void set_bit(int nr, void *addr)
- {
--	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
- 
- #endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.32.11/arch/x86/boot/boot.h linux-2.6.32.11/arch/x86/boot/boot.h
---- linux-2.6.32.11/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/boot.h	2010-04-04 20:46:41.496772577 -0400
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- 	u16 seg;
--	asm("movw %%ds,%0" : "=rm" (seg));
-+	asm volatile("movw %%ds,%0" : "=rm" (seg));
- 	return seg;
- }
- 
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- 	u8 diff;
--	asm("repe; cmpsb; setnz %0"
-+	asm volatile("repe; cmpsb; setnz %0"
- 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- 	return diff;
- }
-diff -urNp linux-2.6.32.11/arch/x86/boot/compressed/head_32.S linux-2.6.32.11/arch/x86/boot/compressed/head_32.S
---- linux-2.6.32.11/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/compressed/head_32.S	2010-04-04 20:46:41.496772577 -0400
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl    %eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
-  * and where it was actually loaded.
-  */
- 	movl	%ebp, %ebx
--	subl	$LOAD_PHYSICAL_ADDR, %ebx
-+	subl	$____LOAD_PHYSICAL_ADDR, %ebx
- 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
- /*
-  * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
- 
- 1:	subl	$4, %edi
- 	movl	(%edi), %ecx
--	testl	%ecx, %ecx
--	jz	2f
-+	jecxz	2f
- 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
- 	jmp	1b
- 2:
-diff -urNp linux-2.6.32.11/arch/x86/boot/compressed/head_64.S linux-2.6.32.11/arch/x86/boot/compressed/head_64.S
---- linux-2.6.32.11/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/compressed/head_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl	%eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- 	notq	%rax
- 	andq	%rax, %rbp
- #else
--	movq	$LOAD_PHYSICAL_ADDR, %rbp
-+	movq	$____LOAD_PHYSICAL_ADDR, %rbp
- #endif
- 
- 	/* Target address to relocate to for decompression */
-diff -urNp linux-2.6.32.11/arch/x86/boot/compressed/misc.c linux-2.6.32.11/arch/x86/boot/compressed/misc.c
---- linux-2.6.32.11/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/compressed/misc.c	2010-04-04 20:46:41.496772577 -0400
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- 		case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- 			dest = output;
--			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- 			dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
- 		error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
--	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- 		error("Wrong destination address");
- #endif
- 
-diff -urNp linux-2.6.32.11/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.11/arch/x86/boot/compressed/mkpiggy.c
---- linux-2.6.32.11/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/compressed/mkpiggy.c	2010-04-04 20:46:41.496772577 -0400
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
- 
- 	offs = (olen > ilen) ? olen - ilen : 0;
- 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
--	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
-+	offs += 64*1024;	/* Add 64K bytes slack */
- 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
- 
- 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff -urNp linux-2.6.32.11/arch/x86/boot/compressed/relocs.c linux-2.6.32.11/arch/x86/boot/compressed/relocs.c
---- linux-2.6.32.11/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/compressed/relocs.c	2010-04-04 20:46:41.500459645 -0400
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
- 
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
- 
- static int is_safe_abs_reloc(const char* sym_name)
- {
--	int i;
-+	unsigned int i;
- 
- 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- 		if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
- 			if (sym->st_shndx == SHN_ABS) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
- 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
- 				/*
- 				 * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
-diff -urNp linux-2.6.32.11/arch/x86/boot/cpucheck.c linux-2.6.32.11/arch/x86/boot/cpucheck.c
---- linux-2.6.32.11/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/cpucheck.c	2010-04-04 20:46:41.500459645 -0400
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- 	u16 fcw = -1, fsw = -1;
- 	u32 cr0;
- 
--	asm("movl %%cr0,%0" : "=r" (cr0));
-+	asm volatile("movl %%cr0,%0" : "=r" (cr0));
- 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- 	u32 f0, f1;
- 
--	asm("pushfl ; "
-+	asm volatile("pushfl ; "
- 	    "pushfl ; "
- 	    "popl %0 ; "
- 	    "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- 		set_bit(X86_FEATURE_FPU, cpu.flags);
- 
- 	if (has_eflag(X86_EFLAGS_ID)) {
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_intel_level),
- 		      "=b" (cpu_vendor[0]),
- 		      "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
- 
- 		if (max_intel_level >= 0x00000001 &&
- 		    max_intel_level <= 0x0000ffff) {
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "=a" (tfms),
- 			      "=c" (cpu.flags[4]),
- 			      "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- 				cpu.model += ((tfms >> 16) & 0xf) << 4;
- 		}
- 
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_amd_level)
- 		    : "a" (0x80000000)
- 		    : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- 		if (max_amd_level >= 0x80000001 &&
- 		    max_amd_level <= 0x8000ffff) {
- 			u32 eax = 0x80000001;
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "+a" (eax),
- 			      "=c" (cpu.flags[6]),
- 			      "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_K7_HWCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax &= ~(1 << 15);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		get_flags();	/* Make sure it really did something */
- 		err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_VIA_FCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax |= (1<<1)|(1<<7);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		set_bit(X86_FEATURE_CX8, cpu.flags);
- 		err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 eax, edx;
- 		u32 level = 1;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
--		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
--		asm("cpuid"
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+		asm volatile("cpuid"
- 		    : "+a" (level), "=d" (cpu.flags[0])
- 		    : : "ecx", "ebx");
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		err = check_flags();
- 	}
-diff -urNp linux-2.6.32.11/arch/x86/boot/header.S linux-2.6.32.11/arch/x86/boot/header.S
---- linux-2.6.32.11/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/header.S	2010-04-04 20:46:41.500459645 -0400
-@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
- 						# single linked list of
- 						# struct setup_data
- 
--pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
-+pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
- 
- #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
- #define VO_INIT_SIZE	(VO__end - VO__text)
-diff -urNp linux-2.6.32.11/arch/x86/boot/video-vesa.c linux-2.6.32.11/arch/x86/boot/video-vesa.c
---- linux-2.6.32.11/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/boot/video-vesa.c	2010-04-04 20:46:41.500459645 -0400
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
- 
- 	boot_params.screen_info.vesapm_seg = oreg.es;
- 	boot_params.screen_info.vesapm_off = oreg.di;
-+	boot_params.screen_info.vesapm_size = oreg.cx;
- }
- 
- /*
-diff -urNp linux-2.6.32.11/arch/x86/ia32/ia32entry.S linux-2.6.32.11/arch/x86/ia32/ia32entry.S
---- linux-2.6.32.11/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/ia32/ia32entry.S	2010-04-04 20:58:33.225084964 -0400
-@@ -13,6 +13,7 @@
- #include <asm/thread_info.h>	
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
-@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
- 	SWAPGS_UNSAFE_STACK
- 	movq	PER_CPU_VAR(kernel_stack), %rsp
- 	addq	$(KERNEL_STACK_OFFSET),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs, here we enable it straight after entry:
-@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
- 	SAVE_ARGS 0,0,1
-  	/* no need to do an access_ok check here because rbp has been
-  	   32bit zero extended */ 
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%rbp
-+#endif
-+
- 1:	movl	(%rbp),%ebp
-  	.section __ex_table,"a"
-  	.quad 1b,ia32_badarg
-@@ -166,6 +178,11 @@ sysenter_dispatch:
- 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz	sysexit_audit
- sysexit_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl    $~TS_COMPAT,TI_status(%r10)
- 	/* clear IF, that popfq doesn't enable interrupts early */
- 	andl  $~0x200,EFLAGS-R11(%rsp) 
-@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
- 	movl	%esp,%r8d
- 	CFI_REGISTER	rsp,r8
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
- 	/* no need to do an access_ok check here because r8 has been
- 	   32bit zero extended */ 
- 	/* hardware stack frame is complete now */	
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%r8
-+#endif
-+
- 1:	movl	(%r8),%r9d
- 	.section __ex_table,"a"
- 	.quad 1b,ia32_badarg
-@@ -327,6 +355,11 @@ cstar_dispatch:
- 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz sysretl_audit
- sysretl_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl $~TS_COMPAT,TI_status(%r10)
- 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- 	movl RIP-ARGOFFSET(%rsp),%ecx
-@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
- 	CFI_REL_OFFSET	rip,RIP-RIP
- 	PARAVIRT_ADJUST_EXCEPTION_FRAME
- 	SWAPGS
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-diff -urNp linux-2.6.32.11/arch/x86/ia32/ia32_signal.c linux-2.6.32.11/arch/x86/ia32/ia32_signal.c
---- linux-2.6.32.11/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/ia32/ia32_signal.c	2010-04-04 20:46:41.500459645 -0400
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
- 	sp -= frame_size;
- 	/* Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- 	return (void __user *) sp;
- }
- 
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
- 		0xb8,
- 		__NR_ia32_rt_sigreturn,
- 		0x80cd,
--		0,
-+		0
- 	};
- 
- 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/alternative.h linux-2.6.32.11/arch/x86/include/asm/alternative.h
---- linux-2.6.32.11/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/alternative.h	2010-04-04 20:46:41.500459645 -0400
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
-       "	 .byte 662b-661b\n"			/* sourcelen       */	\
-       "	 .byte 664f-663f\n"			/* replacementlen  */	\
-       ".previous\n"							\
--      ".section .altinstr_replacement, \"ax\"\n"			\
-+      ".section .altinstr_replacement, \"a\"\n"			\
-       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
-       ".previous"
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/apm.h linux-2.6.32.11/arch/x86/include/asm/apm.h
---- linux-2.6.32.11/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/apm.h	2010-04-04 20:46:41.500459645 -0400
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%al\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%bl\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/atomic_32.h linux-2.6.32.11/arch/x86/include/asm/atomic_32.h
---- linux-2.6.32.11/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/atomic_32.h	2010-04-04 20:46:41.500459645 -0400
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "+m" (v->counter));
- }
- 
-@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (v->counter));
- }
- 
-@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+	local_irq_save(flags);
-+	__i = atomic_read(v);
-+	atomic_set(v, i + __i);
-+	local_irq_restore(flags);
-+	return i + __i;
-+#endif
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	int __i;
-+#ifdef CONFIG_M386
-+	unsigned long flags;
-+	if (unlikely(boot_cpu_data.x86 <= 3))
-+		goto no_xadd;
-+#endif
-+	/* Modern 486+ processor */
-+	__i = i;
- 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
-@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "into\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
- 
- #define atomic_inc_return(v)  (atomic_add_return(1, v))
-+#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
- #define atomic_dec_return(v)  (atomic_sub_return(1, v))
- 
- /* These are x86-specific, used by some header files */
-@@ -266,6 +461,14 @@ typedef struct {
- 	u64 __aligned(8) counter;
- } atomic64_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val)	{ (val) }
- 
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/atomic_64.h linux-2.6.32.11/arch/x86/include/asm/atomic_64.h
---- linux-2.6.32.11/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/atomic_64.h	2010-04-04 20:46:41.500459645 -0400
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- 	int __i = i;
--	asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
- }
- 
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic64_set - set atomic64 variable
-  * @v: pointer to type atomic64_t
-  * @i: required value
-@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
- }
- 
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic64_add - add integer to atomic64 variable
-  * @i: integer value to add
-  * @v: pointer to type atomic64_t
-@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
-  */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "addq %1,%0"
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
-@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
-  */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "subq %1,%0"
-+	asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
-  */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "incq %0"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
-@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
-  */
- static inline void atomic64_dec(atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "decq %0"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- 	long __i = i;
--	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movq %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+	long __i = i;
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
- }
- 
- #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
-+#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
- #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
- 
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
-  */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "er" (a));
-+
-+		old = atomic64_cmpxchg((v), c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- /**
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/boot.h linux-2.6.32.11/arch/x86/include/asm/boot.h
---- linux-2.6.32.11/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/boot.h	2010-04-04 20:46:41.500459645 -0400
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
- 
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
- 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
- 
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/cache.h linux-2.6.32.11/arch/x86/include/asm/cache.h
---- linux-2.6.32.11/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/cache.h	2010-04-04 20:46:41.500459645 -0400
-@@ -8,6 +8,7 @@
- #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
- 
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
- 
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/checksum_32.h linux-2.6.32.11/arch/x86/include/asm/checksum_32.h
---- linux-2.6.32.11/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/checksum_32.h	2010-04-04 20:46:41.500459645 -0400
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
- 					    int len, __wsum sum,
- 					    int *src_err_ptr, int *dst_err_ptr);
- 
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
- /*
-  *	Note: when you get a NULL pointer exception here this means someone
-  *	passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
- 						 int *err_ptr)
- {
- 	might_sleep();
--	return csum_partial_copy_generic((__force void *)src, dst,
-+	return csum_partial_copy_generic_from_user((__force void *)src, dst,
- 					 len, sum, err_ptr, NULL);
- }
- 
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
- {
- 	might_sleep();
- 	if (access_ok(VERIFY_WRITE, dst, len))
--		return csum_partial_copy_generic(src, (__force void *)dst,
-+		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- 						 len, sum, NULL, err_ptr);
- 
- 	if (len)
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/desc.h linux-2.6.32.11/arch/x86/include/asm/desc.h
---- linux-2.6.32.11/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/desc.h	2010-04-04 20:46:41.500459645 -0400
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
- 
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
- 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- 	desc->type = (info->read_exec_only ^ 1) << 1;
- 	desc->type |= info->contents << 2;
-+	desc->type |= info->seg_not_present ^ 1;
- 	desc->s = 1;
- 	desc->dpl = 0x3;
- 	desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
- }
- 
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
--	struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
- 
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
--	return per_cpu(gdt_page, cpu).gdt;
-+	return cpu_gdt_table[cpu];
- }
- 
- #ifdef CONFIG_X86_64
-@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- 					  const gate_desc *gate)
- {
-+	pax_open_kernel();
- 	memcpy(&idt[entry], gate, sizeof(*gate));
-+	pax_close_kernel();
- }
- 
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- 					  const void *desc)
- {
-+	pax_open_kernel();
- 	memcpy(&ldt[entry], desc, 8);
-+	pax_close_kernel();
- }
- 
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- 					  const void *desc, int type)
- {
- 	unsigned int size;
-+
- 	switch (type) {
- 	case DESC_TSS:
- 		size = sizeof(tss_desc);
-@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
- 		size = sizeof(struct desc_struct);
- 		break;
- 	}
-+
-+	pax_open_kernel();
- 	memcpy(&gdt[entry], desc, size);
-+	pax_close_kernel();
- }
- 
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
- 
- static inline void native_load_tr_desc(void)
- {
-+	pax_open_kernel();
- 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+	pax_close_kernel();
- }
- 
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
- 	unsigned int i;
- 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
- 
-+	pax_open_kernel();
- 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+	pax_close_kernel();
- }
- 
- #define _LDT_empty(info)				\
-@@ -392,4 +402,16 @@ static inline void set_system_intr_gate_
- 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
- 
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+	struct desc_struct d;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/device.h linux-2.6.32.11/arch/x86/include/asm/device.h
---- linux-2.6.32.11/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/device.h	2010-04-04 20:46:41.500459645 -0400
-@@ -6,7 +6,7 @@ struct dev_archdata {
- 	void	*acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+	const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- 	void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/dma-mapping.h linux-2.6.32.11/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.32.11/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/dma-mapping.h	2010-04-04 20:46:41.500459645 -0400
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- 	return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	if (ops->mapping_error)
- 		return ops->mapping_error(dev, dma_addr);
- 
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- 		gfp_t gfp)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *memory;
- 
- 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *vaddr, dma_addr_t bus)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	WARN_ON(irqs_disabled());       /* for portability */
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/e820.h linux-2.6.32.11/arch/x86/include/asm/e820.h
---- linux-2.6.32.11/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/e820.h	2010-04-04 20:46:41.500459645 -0400
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
- #define ISA_END_ADDRESS		0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
- 
--#define BIOS_BEGIN		0x000a0000
-+#define BIOS_BEGIN		0x000c0000
- #define BIOS_END		0x00100000
- 
- #ifdef __KERNEL__
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/elf.h linux-2.6.32.11/arch/x86/include/asm/elf.h
---- linux-2.6.32.11/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/elf.h	2010-04-04 20:58:33.220592413 -0400
-@@ -257,7 +257,25 @@ extern int force_personality32;
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE	0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE	0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-@@ -311,8 +329,7 @@ do {									\
- #define ARCH_DLINFO							\
- do {									\
- 	if (vdso_enabled)						\
--		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
--			    (unsigned long)current->mm->context.vdso);	\
-+		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
- } while (0)
- 
- #define AT_SYSINFO		32
-@@ -323,7 +340,7 @@ do {									\
- 
- #endif /* !CONFIG_X86_32 */
- 
--#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
- 
- #define VDSO_ENTRY							\
- 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages	syscall32_setup_pages
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/futex.h linux-2.6.32.11/arch/x86/include/asm/futex.h
---- linux-2.6.32.11/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/futex.h	2010-04-04 20:58:33.220592413 -0400
-@@ -11,17 +11,54 @@
- #include <asm/processor.h>
- #include <asm/system.h>
- 
-+#ifdef CONFIG_X86_32
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile(						\
-+		     "movw\t%w6, %%ds\n"			\
-+		     "1:\t" insn "\n"				\
-+		     "2:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%ds\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "3:\tmov\t%3, %1\n"			\
-+		     "\tjmp\t2b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 3b)			\
-+		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
-+
-+#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile("movw\t%w7, %%es\n"			\
-+		     "1:\tmovl\t%%es:%2, %0\n"			\
-+		     "\tmovl\t%0, %3\n"				\
-+		     "\t" insn "\n"				\
-+		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
-+		     "\tjnz\t1b\n"				\
-+		     "3:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%es\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "4:\tmov\t%5, %1\n"			\
-+		     "\tjmp\t3b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 4b)			\
-+		     _ASM_EXTABLE(2b, 4b)			\
-+		     : "=&a" (oldval), "=&r" (ret),		\
-+		       "+m" (*uaddr), "=&r" (tem)		\
-+		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
-+#else
-+#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\t" insn "\n"				\
- 		     "2:\t.section .fixup,\"ax\"\n"		\
- 		     "3:\tmov\t%3, %1\n"			\
- 		     "\tjmp\t2b\n"				\
- 		     "\t.previous\n"				\
- 		     _ASM_EXTABLE(1b, 3b)			\
--		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "=r" (oldval), "=r" (ret),		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
- 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
- 
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\tmovl	%2, %0\n"			\
- 		     "\tmovl\t%0, %3\n"				\
- 		     "\t" insn "\n"				\
-@@ -34,10 +71,12 @@
- 		     _ASM_EXTABLE(1b, 4b)			\
- 		     _ASM_EXTABLE(2b, 4b)			\
- 		     : "=&a" (oldval), "=&r" (ret),		\
--		       "+m" (*uaddr), "=&r" (tem)		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
-+		       "=&r" (tem)				\
- 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
-+#endif
- 
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
- 
- 	switch (op) {
- 	case FUTEX_OP_SET:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
-+#else
- 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_ADD:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
-+				   uaddr, oparg);
-+#else
- 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
- 				   uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_OR:
- 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
-@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
- 	return ret;
- }
- 
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- 						int newval)
- {
- 
-@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
- 		return -ENOSYS;
- #endif
- 
--	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- 		return -EFAULT;
- 
--	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
--		     "2:\t.section .fixup, \"ax\"\n"
-+	asm volatile(
-+#ifdef CONFIG_X86_32
-+		     "\tmovw %w5, %%ds\n"
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
-+		     "2:\tpushl   %%ss\n"
-+		     "\tpopl    %%ds\n"
-+#else
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+		     "2:\n"
-+#endif
-+		     "\t.section .fixup, \"ax\"\n"
- 		     "3:\tmov     %2, %0\n"
- 		     "\tjmp     2b\n"
- 		     "\t.previous\n"
- 		     _ASM_EXTABLE(1b, 3b)
-+#ifdef CONFIG_X86_32
- 		     : "=a" (oldval), "+m" (*uaddr)
-+		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
-+#else
-+		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
- 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
-+#endif
- 		     : "memory"
- 	);
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/i387.h linux-2.6.32.11/arch/x86/include/asm/i387.h
---- linux-2.6.32.11/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/i387.h	2010-04-04 20:58:33.220592413 -0400
-@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
- }
- 
- /* We need a safe address that is cheap to find and that is already
--   in L1 during context switch. The best choices are unfortunately
--   different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+   in L1 during context switch. */
-+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
- 
- /*
-  * These must be called with preempt disabled
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/io_64.h linux-2.6.32.11/arch/x86/include/asm/io_64.h
---- linux-2.6.32.11/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/io_64.h	2010-04-04 20:46:41.500459645 -0400
-@@ -140,6 +140,17 @@ __OUTS(l)
- 
- #include <linux/vmalloc.h>
- 
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
- 
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/iommu.h linux-2.6.32.11/arch/x86/include/asm/iommu.h
---- linux-2.6.32.11/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/iommu.h	2010-04-04 20:46:41.500459645 -0400
-@@ -3,7 +3,7 @@
- 
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/irqflags.h linux-2.6.32.11/arch/x86/include/asm/irqflags.h
---- linux-2.6.32.11/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/irqflags.h	2010-04-07 19:33:06.601891934 -0400
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
- 	sti;					\
- 	sysexit
- 
-+#define GET_CR0_INTO_RDI		mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0		mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI		mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3		mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN		iret
- #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/kvm_host.h linux-2.6.32.11/arch/x86/include/asm/kvm_host.h
---- linux-2.6.32.11/arch/x86/include/asm/kvm_host.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/kvm_host.h	2010-04-04 20:46:41.500459645 -0400
-@@ -531,7 +531,7 @@ struct kvm_x86_ops {
- 	const struct trace_print_flags *exit_reasons_str;
- };
- 
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
- 
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/local.h linux-2.6.32.11/arch/x86/include/asm/local.h
---- linux-2.6.32.11/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/local.h	2010-04-04 20:46:41.500459645 -0400
-@@ -18,26 +18,90 @@ typedef struct {
- 
- static inline void local_inc(local_t *l)
- {
--	asm volatile(_ASM_INC "%0"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_dec(local_t *l)
- {
--	asm volatile(_ASM_DEC "%0"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_add(long i, local_t *l)
- {
--	asm volatile(_ASM_ADD "%1,%0"
-+	asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
- 
- static inline void local_sub(long i, local_t *l)
- {
--	asm volatile(_ASM_SUB "%1,%0"
-+	asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
-@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_SUB "%2,%0; sete %1"
-+	asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_DEC "%0; sete %1"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_INC "%0; sete %1"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_ADD "%2,%0; sets %1"
-+	asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -133,7 +265,23 @@ static inline long local_add_return(long
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
--	asm volatile(_ASM_XADD "%0, %1;"
-+	asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_MOV "%0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (i), "+m" (l->a.counter)
- 		     : : "memory");
- 	return i + __i;
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/microcode.h linux-2.6.32.11/arch/x86/include/asm/microcode.h
---- linux-2.6.32.11/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/microcode.h	2010-04-04 20:46:41.500459645 -0400
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
- 
- struct microcode_ops {
--	enum ucode_state (*request_microcode_user) (int cpu,
-+	enum ucode_state (* const request_microcode_user) (int cpu,
- 				const void __user *buf, size_t size);
- 
--	enum ucode_state (*request_microcode_fw) (int cpu,
-+	enum ucode_state (* const request_microcode_fw) (int cpu,
- 				struct device *device);
- 
--	void (*microcode_fini_cpu) (int cpu);
-+	void (* const microcode_fini_cpu) (int cpu);
- 
- 	/*
- 	 * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
- 
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
- 
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return NULL;
- }
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/mman.h linux-2.6.32.11/arch/x86/include/asm/mman.h
---- linux-2.6.32.11/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/mman.h	2010-04-04 20:46:41.500459645 -0400
-@@ -5,4 +5,14 @@
- 
- #include <asm-generic/mman.h>
- 
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check	i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+		unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/mmu_context.h linux-2.6.32.11/arch/x86/include/asm/mmu_context.h
---- linux-2.6.32.11/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/mmu_context.h	2010-04-06 22:21:53.692294722 -0400
-@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
- 
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	unsigned int i;
-+	pgd_t *pgd;
-+
-+	pax_open_kernel();
-+	pgd = get_cpu_pgd(smp_processor_id());
-+	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+		if (paravirt_enabled())
-+			set_pgd(pgd+i, native_make_pgd(0));
-+		else
-+			pgd[i] = native_make_pgd(0);
-+	pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,37 +49,96 @@ static inline void switch_mm(struct mm_s
- 			     struct task_struct *tsk)
- {
- 	unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
-+	int tlbstate = TLBSTATE_OK;
-+#endif
- 
- 	if (likely(prev != next)) {
- 		/* stop flush ipis for the previous mm */
- 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
- #ifdef CONFIG_SMP
-+#ifdef CONFIG_X86_32
-+		tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- 		cpumask_set_cpu(cpu, mm_cpumask(next));
- 
- 		/* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#else
- 		load_cr3(next->pgd);
-+#endif
- 
- 		/*
- 		 * load the LDT, if the LDT is different:
- 		 */
- 		if (unlikely(prev->context.ldt != next->context.ldt))
- 			load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		if (!nx_enabled) {
-+			smp_mb__before_clear_bit();
-+			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+			smp_mb__after_clear_bit();
-+			cpu_set(cpu, next->context.cpu_user_cs_mask);
-+		}
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+			     prev->context.user_cs_limit != next->context.user_cs_limit))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#ifdef CONFIG_SMP
-+		else if (unlikely(tlbstate != TLBSTATE_OK))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
- 	}
- #ifdef CONFIG_SMP
- 	else {
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
- 		if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next))) {
- 			/* We were in lazy tlb mode and leave_mm disabled
- 			 * tlb flush IPI delivery. We must reload CR3
- 			 * to make sure to use no freed page tables.
- 			 */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 			load_cr3(next->pgd);
-+#endif
-+
- 			load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+			if (!nx_enabled)
-+				cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- 		}
- 	}
- #endif
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/mmu.h linux-2.6.32.11/arch/x86/include/asm/mmu.h
---- linux-2.6.32.11/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/mmu.h	2010-04-04 20:46:41.500459645 -0400
-@@ -9,10 +9,23 @@
-  * we put the segment information here.
-  */
- typedef struct {
--	void *ldt;
-+	struct desc_struct *ldt;
- 	int size;
- 	struct mutex lock;
--	void *vdso;
-+	unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	unsigned long user_cs_base;
-+	unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+	cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/module.h linux-2.6.32.11/arch/x86/include/asm/module.h
---- linux-2.6.32.11/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/module.h	2010-04-04 21:01:05.305858196 -0400
-@@ -59,13 +59,31 @@
- #error unknown processor family
- #endif
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
- #ifdef CONFIG_X86_32
- # ifdef CONFIG_4KSTACKS
- #  define MODULE_STACKSIZE "4KSTACKS "
- # else
- #  define MODULE_STACKSIZE ""
- # endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+# ifdef CONFIG_PAX_KERNEXEC
-+#  define MODULE_PAX_KERNEXEC "KERNEXEC "
-+# else
-+#  define MODULE_PAX_KERNEXEC ""
-+# endif
-+# ifdef CONFIG_GRKERNSEC
-+#  define MODULE_GRSEC "GRSECURITY "
-+# else
-+#  define MODULE_GRSEC ""
-+# endif
-+# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
-+#else
-+# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
- #endif
- 
- #endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/page_32_types.h linux-2.6.32.11/arch/x86/include/asm/page_32_types.h
---- linux-2.6.32.11/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/page_32_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -15,6 +15,10 @@
-  */
- #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
-+#endif
-+
- #ifdef CONFIG_4KSTACKS
- #define THREAD_ORDER	0
- #else
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/page_64_types.h linux-2.6.32.11/arch/x86/include/asm/page_64_types.h
---- linux-2.6.32.11/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/page_64_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -39,6 +39,9 @@
- #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
- #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
- #define __PHYSICAL_MASK_SHIFT	46
- #define __VIRTUAL_MASK_SHIFT	47
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/paravirt.h linux-2.6.32.11/arch/x86/include/asm/paravirt.h
---- linux-2.6.32.11/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/paravirt.h	2010-04-07 16:58:23.343008831 -0400
-@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
- 	pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+	return pv_mmu_ops.pax_open_kernel();
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+	return pv_mmu_ops.pax_close_kernel();
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
- 
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +960,7 @@ extern void default_banner(void);
- 
- #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr)	*%cs:addr
-+#define PARA_INDIRECT(addr)	*%ss:addr
- #endif
- 
- #define INTERRUPT_RETURN						\
-@@ -1022,6 +1037,21 @@ extern void default_banner(void);
- 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
- 		  CLBR_NONE,						\
- 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif	/* CONFIG_X86_32 */
- 
- #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/paravirt_types.h linux-2.6.32.11/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.32.11/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/paravirt_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -316,6 +316,12 @@ struct pv_mmu_ops {
- 	   an mfn.  We can tell which is which from the index. */
- 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- 			   phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	unsigned long (*pax_open_kernel)(void);
-+	unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
- 
- struct raw_spinlock;
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pci_x86.h linux-2.6.32.11/arch/x86/include/asm/pci_x86.h
---- linux-2.6.32.11/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pci_x86.h	2010-04-04 20:46:41.505526780 -0400
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
- 
- struct pci_raw_ops {
--	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val);
--	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 val);
- };
- 
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
- 
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
- 
- /* arch_initcall level */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgalloc.h linux-2.6.32.11/arch/x86/include/asm/pgalloc.h
---- linux-2.6.32.11/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgalloc.h	2010-04-04 20:46:41.505526780 -0400
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
- 				       pmd_t *pmd, pte_t *pte)
- {
- 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+				       pmd_t *pmd, pte_t *pte)
-+{
-+	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.11/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable-2level.h	2010-04-04 20:46:41.505526780 -0400
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable_32.h linux-2.6.32.11/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable_32.h	2010-04-04 20:46:41.505526780 -0400
-@@ -26,8 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
- 
--extern pgd_t swapper_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
- # include <asm/pgtable-2level.h>
- #endif
- 
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE			\
- 	(in_nmi() ? KM_NMI_PTE : 	\
-@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr)		\
- do {						\
-+	pax_open_kernel();			\
- 	pte_clear(&init_mm, (vaddr), (ptep));	\
-+	pax_close_kernel();			\
- 	__flush_tlb_one((vaddr));		\
- } while (0)
- 
-@@ -84,6 +89,9 @@ do {						\
- 
- #endif /* !__ASSEMBLY__ */
- 
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
-  * kern_addr_valid() is (1) for FLATMEM and (0) for
-  * SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.11/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable_32_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -8,7 +8,7 @@
-  */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE	(1UL << PMD_SHIFT)
-+# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK	(~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
- # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+#endif
-+
- #define MODULES_VADDR	VMALLOC_START
- #define MODULES_END	VMALLOC_END
- #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.11/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable-3level.h	2010-04-04 20:46:41.505526780 -0400
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+	pax_close_kernel();
- }
- 
- /*
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable_64.h linux-2.6.32.11/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable_64.h	2010-04-04 20:58:33.220592413 -0400
-@@ -16,10 +16,13 @@
- 
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
- 
- #define swapper_pg_dir init_level4_pgt
- 
-@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
- 
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+	pax_open_kernel();
- 	*pgdp = pgd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pgd_clear(pgd_t *pgd)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	native_set_pgd(pgd, native_make_pgd(0));
-+#endif
-+
- }
- 
- /*
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable.h linux-2.6.32.11/arch/x86/include/asm/pgtable.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable.h	2010-04-04 20:58:33.220592413 -0400
-@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
- 
- #define arch_end_context_switch(prev)	do {} while(0)
- 
-+#define pax_open_kernel()	native_pax_open_kernel()
-+#define pax_close_kernel()	native_pax_close_kernel()
- #endif	/* CONFIG_PARAVIRT */
- 
-+#define  __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	preempt_disable();
-+	barrier();
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(cr0 & X86_CR0_WP));
-+	write_cr0(cr0);
-+	return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
-+	write_cr0(cr0);
-+	barrier();
-+	preempt_enable_no_resched();
-+	return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
-  * The following only work if pte_present() is true.
-  * Undefined behaviour if not..
-  */
-+static inline int pte_user(pte_t pte)
-+{
-+	return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- 	return pte_flags(pte) & _PAGE_DIRTY;
-@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
- 	return pte_clear_flags(pte, _PAGE_RW);
- }
- 
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+	return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
--	return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_clear_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_set_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_clear_flags(pte, _PAGE_USER);
- }
- 
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
- #endif
- 
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+	return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
- 
- static inline int pte_none(pte_t pte)
-@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
- 
- static inline int pgd_bad(pgd_t pgd)
- {
--	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
- 
- static inline int pgd_none(pgd_t pgd)
-@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
-  * pgd_offset() returns a (pgd_t *)
-  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
-  */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
-  * a shortcut which implies the use of the kernel's pgd, instead
-  * of a process's
-@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
- 
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
- 
- extern int direct_gbpages;
-@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
-  * dst and src can be on the same page, but the range must not overlap,
-  * and must not cross a page boundary.
-  */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
--       memcpy(dst, src, count * sizeof(pgd_t));
-+	pax_open_kernel();
-+	while (count--)
-+		*dst++ = *src++;
-+	pax_close_kernel();
- }
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+#endif
- 
- #include <asm-generic/pgtable.h>
- #endif	/* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/pgtable_types.h linux-2.6.32.11/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.32.11/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/pgtable_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT		7	/* on 4KB pages */
- #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
-+#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
- 
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
- 
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX	(_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
- 
- #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
- 					 _PAGE_ACCESSED)
- 
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC						\
- 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
-  * bits are combined, this will alow user to access the high address mapped
-  * VDSO in the presence of CONFIG_COMPAT_VDSO
-  */
--#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
--#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
- #endif
- 
-@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
- 
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
- 
- #define pgprot_writecombine	pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/processor.h linux-2.6.32.11/arch/x86/include/asm/processor.h
---- linux-2.6.32.11/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/processor.h	2010-04-04 20:58:33.220592413 -0400
-@@ -272,7 +272,7 @@ struct tss_struct {
- 
- } ____cacheline_aligned;
- 
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
- 
- /*
-  * Save the original ist values for checking stack pointers during debugging
-@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
-  */
- #define TASK_SIZE		PAGE_OFFSET
- #define TASK_SIZE_MAX		TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
-+#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP		TASK_SIZE
--#define STACK_TOP_MAX		STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX		TASK_SIZE
- 
- #define INIT_THREAD  {							  \
- 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
-@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
-  */
- #define INIT_TSS  {							  \
- 	.x86_tss = {							  \
--		.sp0		= sizeof(init_stack) + (long)&init_stack, \
-+		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
- 		.ss0		= __KERNEL_DS,				  \
- 		.ss1		= __KERNEL_CS,				  \
- 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
-@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
- 
- #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info)                                                 \
--({                                                                     \
--       unsigned long *__ptr = (unsigned long *)(info);                 \
--       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
--})
-+#define KSTK_TOP(info)         ((info)->task.thread.sp0)
- 
- /*
-  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
- #define task_pt_regs(task)                                             \
- ({                                                                     \
-        struct pt_regs *__regs__;                                       \
--       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
-        __regs__ - 1;                                                   \
- })
- 
-@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
- /*
-  * User space process size. 47bits minus one guard page.
-  */
--#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
- 
- /* This decides where the kernel will search for a free chunk of vm
-  * space during mmap's.
-  */
- #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
--					0xc0000000 : 0xFFFFe000)
-+					0xc0000000 : 0xFFFFf000)
- 
- #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
- 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
-  */
- #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
- 
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/ptrace.h linux-2.6.32.11/arch/x86/include/asm/ptrace.h
---- linux-2.6.32.11/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/ptrace.h	2010-04-04 20:46:41.505526780 -0400
-@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
- }
- 
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
-  * This is true if V8086 mode was enabled OR if the register set was from
-  * protected mode with RPL-3 CS value.  This tricky test checks that with
-  * one comparison.  Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
-  */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
--	return !!(regs->cs & 3);
-+	return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
- 
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- 		USER_RPL;
- #else
--	return user_mode(regs);
-+	return user_mode_novm(regs);
- #endif
- }
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/reboot.h linux-2.6.32.11/arch/x86/include/asm/reboot.h
---- linux-2.6.32.11/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/reboot.h	2010-04-04 20:46:41.505526780 -0400
-@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
- 
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void machine_real_restart(const unsigned char *code, unsigned int length);
- 
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/rwsem.h linux-2.6.32.11/arch/x86/include/asm/rwsem.h
---- linux-2.6.32.11/arch/x86/include/asm/rwsem.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/rwsem.h	2010-04-04 20:46:41.505526780 -0400
-@@ -106,10 +106,26 @@ static inline void __down_read(struct rw
- {
- 	asm volatile("# beginning down_read\n\t"
- 		     LOCK_PREFIX "  incl      (%%eax)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl (%%eax)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* adds 0x00000001, returns the old value */
--		     "  jns        1f\n"
-+		     "  jns        2f\n"
- 		     "  call call_rwsem_down_read_failed\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending down_read\n\t"
- 		     : "+m" (sem->count)
- 		     : "a" (sem)
-@@ -124,13 +140,29 @@ static inline int __down_read_trylock(st
- 	__s32 result, tmp;
- 	asm volatile("# beginning __down_read_trylock\n\t"
- 		     "  movl      %0,%1\n\t"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "  movl	     %1,%2\n\t"
- 		     "  addl      %3,%2\n\t"
--		     "  jle	     2f\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "subl %3,%2\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "  jle	     3f\n\t"
- 		     LOCK_PREFIX "  cmpxchgl  %2,%0\n\t"
--		     "  jnz	     1b\n\t"
--		     "2:\n\t"
-+		     "  jnz	     2b\n\t"
-+		     "3:\n\t"
- 		     "# ending __down_read_trylock\n\t"
- 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
- 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
-@@ -148,12 +180,28 @@ static inline void __down_write_nested(s
- 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
- 	asm volatile("# beginning down_write\n\t"
- 		     LOCK_PREFIX "  xadd      %%edx,(%%eax)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "movl %%edx,(%%eax)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtract 0x0000ffff, returns the old value */
- 		     "  testl     %%edx,%%edx\n\t"
- 		     /* was the count 0 before? */
--		     "  jz        1f\n"
-+		     "  jz        2f\n"
- 		     "  call call_rwsem_down_write_failed\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending down_write"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -186,10 +234,26 @@ static inline void __up_read(struct rw_s
- 	__s32 tmp = -RWSEM_ACTIVE_READ_BIAS;
- 	asm volatile("# beginning __up_read\n\t"
- 		     LOCK_PREFIX "  xadd      %%edx,(%%eax)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "movl %%edx,(%%eax)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtracts 1, returns the old value */
--		     "  jns        1f\n\t"
-+		     "  jns        2f\n\t"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending __up_read\n"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -204,11 +268,27 @@ static inline void __up_write(struct rw_
- 	asm volatile("# beginning __up_write\n\t"
- 		     "  movl      %2,%%edx\n\t"
- 		     LOCK_PREFIX "  xaddl     %%edx,(%%eax)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "movl %%edx,(%%eax)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* tries to transition
- 			0xffff0001 -> 0x00000000 */
--		     "  jz       1f\n"
-+		     "  jz       2f\n"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __up_write\n"
- 		     : "+m" (sem->count)
- 		     : "a" (sem), "i" (-RWSEM_ACTIVE_WRITE_BIAS)
-@@ -222,10 +302,26 @@ static inline void __downgrade_write(str
- {
- 	asm volatile("# beginning __downgrade_write\n\t"
- 		     LOCK_PREFIX "  addl      %2,(%%eax)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "subl %2,(%%eax)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* transitions 0xZZZZ0001 -> 0xYYYY0001 */
--		     "  jns       1f\n\t"
-+		     "  jns       2f\n\t"
- 		     "  call call_rwsem_downgrade_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __downgrade_write\n"
- 		     : "+m" (sem->count)
- 		     : "a" (sem), "i" (-RWSEM_WAITING_BIAS)
-@@ -237,7 +333,23 @@ static inline void __downgrade_write(str
-  */
- static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (sem->count)
- 		     : "ir" (delta));
- }
-@@ -249,7 +361,23 @@ static inline int rwsem_atomic_update(in
- {
- 	int tmp = delta;
- 
--	asm volatile(LOCK_PREFIX "xadd %0,%1"
-+	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "movl %0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (tmp), "+m" (sem->count)
- 		     : : "memory");
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/segment.h linux-2.6.32.11/arch/x86/include/asm/segment.h
---- linux-2.6.32.11/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/segment.h	2010-04-04 20:46:41.505526780 -0400
-@@ -62,8 +62,8 @@
-  *  26 - ESPFIX small SS
-  *  27 - per-cpu			[ offset to per-cpu data area ]
-  *  28 - stack_canary-20		[ for stack protector ]
-- *  29 - unused
-- *  30 - unused
-+ *  29 - PCI BIOS CS
-+ *  30 - PCI BIOS DS
-  *  31 - TSS for double fault handler
-  */
- #define GDT_ENTRY_TLS_MIN	6
-@@ -77,6 +77,8 @@
- 
- #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
-+
- #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
- 
- #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +90,7 @@
- #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
- 
--#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +104,12 @@
- #define __KERNEL_STACK_CANARY		0
- #endif
- 
-+#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS	31
- 
- /*
-@@ -139,7 +147,7 @@
-  */
- 
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
- 
- 
- #else
-@@ -163,6 +171,8 @@
- #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS	__USER_DS
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8	/* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +193,7 @@
- #endif
- 
- #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/spinlock.h linux-2.6.32.11/arch/x86/include/asm/spinlock.h
---- linux-2.6.32.11/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/spinlock.h	2010-04-04 20:46:41.505526780 -0400
-@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
--		     "jns 1f\n"
--		     "call __read_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl $1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jns 2f\n"
-+		     "call __read_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw) : "memory");
- }
- 
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
--		     "jz 1f\n"
--		     "call __write_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl %1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jz 2f\n"
-+		     "call __write_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
- 
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     :"+m" (rw->lock) : : "memory");
- }
- 
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "addl %1, %0"
-+	asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/system.h linux-2.6.32.11/arch/x86/include/asm/system.h
---- linux-2.6.32.11/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/system.h	2010-04-04 20:46:41.505526780 -0400
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
- {
- 	unsigned long __limit;
- 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
--	return __limit + 1;
-+	return __limit;
- }
- 
- static inline void native_clts(void)
-@@ -340,7 +340,7 @@ void enable_hlt(void);
- 
- void cpu_idle_wait(void);
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
- 
- void default_idle(void);
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/uaccess_32.h linux-2.6.32.11/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.32.11/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/uaccess_32.h	2010-04-04 20:46:41.505526780 -0400
-@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
- 	return __copy_to_user_ll(to, from, n);
- }
- 
-@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	/* Avoid zeroing the tail if the copy fails..
- 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- 	 * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +146,10 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
- 	return __copy_from_user_ll(to, from, n);
- }
- 
-@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
- 				const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -182,14 +200,62 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- 				  unsigned long n)
- {
--       return __copy_from_user_ll_nocache_nozero(to, from, n);
-+	if ((long)n < 0)
-+		return n;
-+
-+	return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to:   Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_WRITE, to, n))
-+		n = __copy_to_user(to, from, n);
-+	return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to:   Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_READ, from, n))
-+		n = __copy_from_user(to, from, n);
-+	else if ((long)n > 0) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		memset(to, 0, n);
-+	}
-+	return n;
- }
- 
--unsigned long __must_check copy_to_user(void __user *to,
--					const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
--					  const void __user *from,
--					  unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- 				    long count);
- long __must_check __strncpy_from_user(char *dst,
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/uaccess_64.h linux-2.6.32.11/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.32.11/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/uaccess_64.h	2010-04-04 20:58:33.220592413 -0400
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x)	(current_thread_info()->addr_limit = (x))
- 
- /*
-  * Copy To/From Userspace
-@@ -19,20 +22,24 @@ __must_check unsigned long
- copy_user_generic(void *to, const void *from, unsigned len);
- 
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
- copy_in_user(void __user *to, const void __user *from, unsigned len);
- 
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(dst, size, false);
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
- 			      ret, "b", "b", "=q", 1);
-@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
- 			       ret, "q", "", "=r", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(src, size, true);
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
-+	}
- 	switch (size) {
- 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
- 			      ret, "b", "b", "iq", 1);
-@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
- 			       ret, "q", "", "er", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
-+{
-+	if (access_ok(VERIFY_WRITE, to, len))
-+		len = __copy_to_user(to, from, len);
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
-+{
-+	if ((int)len < 0)
-+		return len;
-+
-+	if (access_ok(VERIFY_READ, from, len))
-+		len = __copy_from_user(to, from, len);
-+	else if ((int)len > 0) {
-+		if (!__builtin_constant_p(len))
-+			check_object_size(to, len, false);
-+		memset(to, 0, len);
-+	}
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1: {
- 		u8 tmp;
-@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
- 		return ret;
- 	}
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
- 	}
-@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
- __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
- 					    unsigned size);
- 
--static __must_check __always_inline int
-+static __must_check __always_inline unsigned long
- __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return copy_user_generic((__force void *)dst, src, size);
- }
- 
--extern long __copy_user_nocache(void *dst, const void __user *src,
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
- 				unsigned size, int zerorest);
- 
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
- {
- 	might_sleep();
-+
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 1);
- }
- 
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
- 				  unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 0);
- }
- 
--unsigned long
-+extern unsigned long
- copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
- 
- #endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/uaccess.h linux-2.6.32.11/arch/x86/include/asm/uaccess.h
---- linux-2.6.32.11/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/uaccess.h	2010-04-04 20:58:33.220592413 -0400
-@@ -8,8 +8,11 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
-+#include <linux/slab.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-+#include <asm/segment.h>
- 
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-@@ -29,7 +32,12 @@
- 
- #define get_ds()	(KERNEL_DS)
- #define get_fs()	(current_thread_info()->addr_limit)
-+#ifdef CONFIG_X86_32
-+void __set_fs(mm_segment_t x, int cpu);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x)	(current_thread_info()->addr_limit = (x))
-+#endif
- 
- #define segment_eq(a, b)	((a).seg == (b).seg)
- 
-@@ -77,7 +85,33 @@
-  * checks that the pointer is in the user space range - after calling
-  * this function, memory access functions may still return -EFAULT.
-  */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size)					\
-+({									\
-+	long __size = size;						\
-+	unsigned long __addr = (unsigned long)addr;			\
-+	unsigned long __addr_ao = __addr & PAGE_MASK;			\
-+	unsigned long __end_ao = __addr + __size - 1;			\
-+	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
-+	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
-+		while(__addr_ao <= __end_ao) {				\
-+			char __c_ao;					\
-+			__addr_ao += PAGE_SIZE;				\
-+			if (__size > PAGE_SIZE)				\
-+				cond_resched();				\
-+			if (__get_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			if (type != VERIFY_WRITE) {			\
-+				__addr = __addr_ao;			\
-+				continue;				\
-+			}						\
-+			if (__put_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			__addr = __addr_ao;				\
-+		}							\
-+	}								\
-+	__ret_ao;							\
-+})
- 
- /*
-  * The exception table consists of pairs of addresses: the first is the
-@@ -183,13 +217,21 @@ extern int __get_user_bad(void);
- 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
- 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
- 
--
-+#ifdef CONFIG_X86_32
-+#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
-+#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
-+#else
-+#define _ASM_LOAD_USER_DS(ds)
-+#define _ASM_LOAD_KERNEL_DS
-+#endif
- 
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret)			\
--	asm volatile("1:	movl %%eax,0(%2)\n"			\
--		     "2:	movl %%edx,4(%2)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	movl %%eax,%%ds:0(%2)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%2)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "4:	movl %3,%0\n"				\
- 		     "	jmp 3b\n"					\
-@@ -197,15 +239,18 @@ extern int __get_user_bad(void);
- 		     _ASM_EXTABLE(1b, 4b)				\
- 		     _ASM_EXTABLE(2b, 4b)				\
- 		     : "=r" (err)					\
--		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
-+		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex_u64(x, addr)					\
--	asm volatile("1:	movl %%eax,0(%1)\n"			\
--		     "2:	movl %%edx,4(%1)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	movl %%eax,%%ds:0(%1)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%1)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
- 		     _ASM_EXTABLE(2b, 3b - 2b)				\
--		     : : "A" (x), "r" (addr))
-+		     : : "A" (x), "r" (addr), "r"(__USER_DS))
- 
- #define __put_user_x8(x, ptr, __ret_pu)				\
- 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
-@@ -374,16 +419,18 @@ do {									\
- } while (0)
- 
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
--		     : "=r" (err), ltype(x)				\
--		     : "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : "=r" (err), ltype (x)				\
-+		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
- 
- #define __get_user_size_ex(x, ptr, size)				\
- do {									\
-@@ -407,10 +454,12 @@ do {									\
- } while (0)
- 
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : ltype(x) : "m" (__m(addr)))
-+		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
- 
- #define __put_user_nocheck(x, ptr, size)			\
- ({								\
-@@ -424,13 +473,24 @@ do {									\
- 	int __gu_err;							\
- 	unsigned long __gu_val;						\
- 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
--	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
-+	(x) = (__typeof__(*(ptr)))__gu_val;				\
- 	__gu_err;							\
- })
- 
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x)					\
-+({							\
-+	unsigned long ____x = (unsigned long)(x);	\
-+	if (____x < PAX_USER_SHADOW_BASE)		\
-+		____x += PAX_USER_SHADOW_BASE;		\
-+	(void __user *)____x;				\
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
- 
- /*
-  * Tell gcc we read from memory instead of writing: this is because
-@@ -438,21 +498,26 @@ struct __large_struct { unsigned long bu
-  * aliasing issues.
-  */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
- 		     : "=r"(err)					\
--		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : : ltype(x), "m" (__m(addr)))
-+		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
- 
- /*
-  * uaccess_try and catch
-@@ -530,7 +595,7 @@ struct __large_struct { unsigned long bu
- #define get_user_ex(x, ptr)	do {					\
- 	unsigned long __gue_val;					\
- 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
--	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
-+	(x) = (__typeof__(*(ptr)))__gue_val;				\
- } while (0)
- 
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +632,7 @@ extern struct movsl_mask {
- 
- #define ARCH_HAS_NOCACHE_UACCESS 1
- 
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/vgtod.h linux-2.6.32.11/arch/x86/include/asm/vgtod.h
---- linux-2.6.32.11/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/vgtod.h	2010-04-04 20:46:41.509696869 -0400
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- 	int		sysctl_enabled;
- 	struct timezone sys_tz;
- 	struct { /* extract of a clocksource struct */
-+		char	name[8];
- 		cycle_t (*vread)(void);
- 		cycle_t	cycle_last;
- 		cycle_t	mask;
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/vmi.h linux-2.6.32.11/arch/x86/include/asm/vmi.h
---- linux-2.6.32.11/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/vmi.h	2010-04-04 20:46:41.509696869 -0400
-@@ -191,6 +191,7 @@ struct vrom_header {
- 	u8      reserved[96];   /* Reserved for headers */
- 	char    vmi_init[8];    /* VMI_Init jump point */
- 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
-+	char    rom_data[8048];	/* rest of the option ROM */
- } __attribute__((packed));
- 
- struct pnp_header {
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/vsyscall.h linux-2.6.32.11/arch/x86/include/asm/vsyscall.h
---- linux-2.6.32.11/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/vsyscall.h	2010-04-04 20:46:41.509696869 -0400
-@@ -15,9 +15,10 @@ enum vsyscall_num {
- 
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
- 
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
- 
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL	2
- 
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
- 
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
- 
- extern void map_vsyscall(void);
- 
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
- 
- #endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.32.11/arch/x86/include/asm/xsave.h linux-2.6.32.11/arch/x86/include/asm/xsave.h
---- linux-2.6.32.11/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/include/asm/xsave.h	2010-04-04 20:58:33.225084964 -0400
-@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- 	int err;
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
-+		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
- 	u32 lmask = mask;
- 	u32 hmask = mask >> 32;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
-+		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.32.11/arch/x86/Kconfig linux-2.6.32.11/arch/x86/Kconfig
---- linux-2.6.32.11/arch/x86/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/Kconfig	2010-04-04 20:46:41.509696869 -0400
-@@ -1083,7 +1083,7 @@ config PAGE_OFFSET
- 	hex
- 	default 0xB0000000 if VMSPLIT_3G_OPT
- 	default 0x80000000 if VMSPLIT_2G
--	default 0x78000000 if VMSPLIT_2G_OPT
-+	default 0x70000000 if VMSPLIT_2G_OPT
- 	default 0x40000000 if VMSPLIT_1G
- 	default 0xC0000000
- 	depends on X86_32
-@@ -1409,7 +1409,7 @@ config ARCH_USES_PG_UNCACHED
- 
- config EFI
- 	bool "EFI runtime service support"
--	depends on ACPI
-+	depends on ACPI && !PAX_KERNEXEC
- 	---help---
- 	  This enables the kernel to use EFI runtime services that are
- 	  available (such as the EFI variable services).
-@@ -1496,6 +1496,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- 	default "0x1000000"
-+	range 0x400000 0x40000000
- 	---help---
- 	  This gives the physical address where the kernel is loaded.
- 
-@@ -1560,6 +1561,7 @@ config PHYSICAL_ALIGN
- 	hex
- 	prompt "Alignment value to which kernel should be aligned" if X86_32
- 	default "0x1000000"
-+	range 0x400000 0x1000000 if PAX_KERNEXEC
- 	range 0x2000 0x1000000
- 	---help---
- 	  This value puts the alignment restrictions on physical address
-@@ -1591,9 +1593,10 @@ config HOTPLUG_CPU
- 	  Say N if you want to disable CPU hotplug.
- 
- config COMPAT_VDSO
--	def_bool y
-+	def_bool n
- 	prompt "Compat VDSO support"
- 	depends on X86_32 || IA32_EMULATION
-+	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
- 	---help---
- 	  Map the 32-bit VDSO to the predictable old-style address too.
- 	---help---
-diff -urNp linux-2.6.32.11/arch/x86/Kconfig.cpu linux-2.6.32.11/arch/x86/Kconfig.cpu
---- linux-2.6.32.11/arch/x86/Kconfig.cpu	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/Kconfig.cpu	2010-04-04 20:46:41.509696869 -0400
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
- 
- config X86_F00F_BUG
- 	def_bool y
--	depends on M586MMX || M586TSC || M586 || M486 || M386
-+	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
- 
- config X86_WP_WORKS_OK
- 	def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
- 
- config X86_ALIGNMENT_16
- 	def_bool y
--	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
- 
- config X86_INTEL_USERCOPY
- 	def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- 	def_bool y
--	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
- 
- config X86_MINIMUM_CPU_FAMILY
- 	int
-diff -urNp linux-2.6.32.11/arch/x86/Kconfig.debug linux-2.6.32.11/arch/x86/Kconfig.debug
---- linux-2.6.32.11/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/Kconfig.debug	2010-04-04 20:46:41.509696869 -0400
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- 	bool "Write protect kernel read-only data structures"
- 	default y
--	depends on DEBUG_KERNEL
-+	depends on DEBUG_KERNEL && BROKEN
- 	---help---
- 	  Mark the kernel read-only data as write-protected in the pagetables,
- 	  in order to catch accidental (and incorrect) writes to such const
-diff -urNp linux-2.6.32.11/arch/x86/kernel/acpi/boot.c linux-2.6.32.11/arch/x86/kernel/acpi/boot.c
---- linux-2.6.32.11/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/acpi/boot.c	2010-04-04 20:46:41.509696869 -0400
-@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
- 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
- 		     },
- 	 },
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- /*
-diff -urNp linux-2.6.32.11/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.11/arch/x86/kernel/acpi/realmode/wakeup.S
---- linux-2.6.32.11/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/acpi/realmode/wakeup.S	2010-04-04 20:46:41.509696869 -0400
-@@ -104,7 +104,7 @@ _start:
- 	movl	%eax, %ecx
- 	orl	%edx, %ecx
- 	jz	1f
--	movl	$0xc0000080, %ecx
-+	mov	$MSR_EFER, %ecx
- 	wrmsr
- 1:
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/acpi/sleep.c linux-2.6.32.11/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.32.11/arch/x86/kernel/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/acpi/sleep.c	2010-04-04 20:46:41.509696869 -0400
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
- 
- #include "realmode/wakeup.h"
- #include "sleep.h"
- 
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
- 
- /* address in low memory of the wakeup routine. */
-@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
- 	header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
- 	stack_start.sp = temp_stack + sizeof(temp_stack);
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address =
- 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
-+	pax_close_kernel();
-+
- 	initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- 	initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- 		return;
- 	}
- 
--	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
--	if (!acpi_realmode) {
--		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
--		return;
--	}
--
--	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
- 
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.11/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.32.11/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/acpi/wakeup_32.S	2010-04-04 20:46:41.509696869 -0400
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- 	# and restore the stack ... but you need gdt for this to work
- 	movl	saved_context_esp, %esp
- 
--	movl	%cs:saved_magic, %eax
--	cmpl	$0x12345678, %eax
-+	cmpl	$0x12345678, saved_magic
- 	jne	bogus_magic
- 
- 	# jump to place where we left off
--	movl	saved_eip, %eax
--	jmp	*%eax
-+	jmp	*(saved_eip)
- 
- bogus_magic:
- 	jmp	bogus_magic
-diff -urNp linux-2.6.32.11/arch/x86/kernel/alternative.c linux-2.6.32.11/arch/x86/kernel/alternative.c
---- linux-2.6.32.11/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/alternative.c	2010-04-04 20:46:41.509696869 -0400
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
- 
- 		BUG_ON(p->len > MAX_PATCH_LEN);
- 		/* prep the buffer with the original instructions */
--		memcpy(insnbuf, p->instr, p->len);
-+		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- 					 (unsigned long)p->instr, p->len);
- 
-@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
-  * instructions. And on the local CPU you need to be protected again NMI or MCE
-  * handlers seeing an inconsistent instruction while you patch.
-  */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- 					      size_t len)
- {
- 	unsigned long flags;
- 	local_irq_save(flags);
--	memcpy(addr, opcode, len);
-+
-+	pax_open_kernel();
-+	memcpy(ktla_ktva(addr), opcode, len);
-+	pax_close_kernel();
-+
- 	sync_core();
- 	local_irq_restore(flags);
- 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
-  */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
--	unsigned long flags;
--	char *vaddr;
-+	unsigned char *vaddr = ktla_ktva(addr);
- 	struct page *pages[2];
--	int i;
-+	size_t i;
- 
- 	if (!core_kernel_text((unsigned long)addr)) {
--		pages[0] = vmalloc_to_page(addr);
--		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+		pages[0] = vmalloc_to_page(vaddr);
-+		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- 	} else {
--		pages[0] = virt_to_page(addr);
-+		pages[0] = virt_to_page(vaddr);
- 		WARN_ON(!PageReserved(pages[0]));
--		pages[1] = virt_to_page(addr + PAGE_SIZE);
-+		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- 	}
- 	BUG_ON(!pages[0]);
--	local_irq_save(flags);
--	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
--	if (pages[1])
--		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
--	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
--	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
--	clear_fixmap(FIX_TEXT_POKE0);
--	if (pages[1])
--		clear_fixmap(FIX_TEXT_POKE1);
--	local_flush_tlb();
--	sync_core();
--	/* Could also do a CLFLUSH here to speed up CPU recovery; but
--	   that causes hangs on some VIA CPUs. */
-+	text_poke_early(addr, opcode, len);
- 	for (i = 0; i < len; i++)
--		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
--	local_irq_restore(flags);
-+		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
- 	return addr;
- }
-diff -urNp linux-2.6.32.11/arch/x86/kernel/amd_iommu.c linux-2.6.32.11/arch/x86/kernel/amd_iommu.c
---- linux-2.6.32.11/arch/x86/kernel/amd_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/amd_iommu.c	2010-04-04 20:46:41.509696869 -0400
-@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
- 	}
- }
- 
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- 	.alloc_coherent = alloc_coherent,
- 	.free_coherent = free_coherent,
- 	.map_page = map_page,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/apic/io_apic.c linux-2.6.32.11/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.32.11/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/apic/io_apic.c	2010-04-04 20:46:41.509696869 -0400
-@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
- 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- 				GFP_ATOMIC);
- 	if (!ioapic_entries)
--		return 0;
-+		return NULL;
- 
- 	for (apic = 0; apic < nr_ioapics; apic++) {
- 		ioapic_entries[apic] =
-@@ -728,7 +728,7 @@ nomem:
- 		kfree(ioapic_entries[apic]);
- 	kfree(ioapic_entries);
- 
--	return 0;
-+	return NULL;
- }
- 
- /*
-@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
- 
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- 	/* Used to the online set of cpus does not change
- 	 * during assign_irq_vector.
-@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
- 	spin_lock(&vector_lock);
- }
- 
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- 	spin_unlock(&vector_lock);
- }
-diff -urNp linux-2.6.32.11/arch/x86/kernel/apm_32.c linux-2.6.32.11/arch/x86/kernel/apm_32.c
---- linux-2.6.32.11/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/apm_32.c	2010-04-04 20:46:41.513555986 -0400
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
-  * This is for buggy BIOS's that refer to (real mode) segment 0x40
-  * even though they are called in protected mode.
-  */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- static const char driver_version[] = "1.16ac";	/* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- 			  &call->esi);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
- 					 &call->eax);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 	return error;
- }
-@@ -975,7 +989,7 @@ recalc:
- 
- static void apm_power_off(void)
- {
--	unsigned char po_bios_call[] = {
-+	const unsigned char po_bios_call[] = {
- 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
- 		0x8e, 0xd0,		/* movw  ax,ss       */
- 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
-@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
- static struct miscdevice apm_device = {
- 	APM_MINOR_DEV,
- 	"apm_bios",
--	&apm_bios_fops
-+	&apm_bios_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- 
-@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
- 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
- 
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- /*
-@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
- 	 * code to that CPU.
- 	 */
- 	gdt = get_cpu_gdt_table(0);
-+
-+	pax_open_kernel();
- 	set_desc_base(&gdt[APM_CS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- 	set_desc_base(&gdt[APM_CS_16 >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- 	set_desc_base(&gdt[APM_DS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+	pax_close_kernel();
- 
- 	proc_create("apm", 0, NULL, &apm_file_ops);
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.11/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.32.11/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/asm-offsets_32.c	2010-04-04 20:46:41.513555986 -0400
-@@ -115,6 +115,11 @@ void foo(void)
- 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
- 
- #ifdef CONFIG_XEN
-diff -urNp linux-2.6.32.11/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.11/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.32.11/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/asm-offsets_64.c	2010-04-04 20:58:33.220592413 -0400
-@@ -63,6 +63,18 @@ int main(void)
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
-+#endif
-+
- #endif
- 
- 
-@@ -115,6 +127,7 @@ int main(void)
- 	ENTRY(cr8);
- 	BLANK();
- #undef ENTRY
-+	DEFINE(TSS_size, sizeof(struct tss_struct));
- 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- 	BLANK();
- 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/common.c linux-2.6.32.11/arch/x86/kernel/cpu/common.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/common.c	2010-04-04 20:47:28.952733264 -0400
-@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
- 
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
- 
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
--	/*
--	 * We need valid kernel segments for data and code in long mode too
--	 * IRET will check the segment types  kkeil 2000/10/28
--	 * Also sysret mandates a special GDT layout
--	 *
--	 * TLS descriptors are currently at a different place compared to i386.
--	 * Hopefully nobody expects them at a fixed place (Wine?)
--	 */
--	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
--	/*
--	 * Segments used for calling PnP BIOS have byte granularity.
--	 * They code segments and data segments have fixed 64k limits,
--	 * the transfer segment sizes are set at run time.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/*
--	 * The APM segments have byte granularity and their bases
--	 * are set at run time.  All have 64k limits.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* data */
--	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
--	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
- {
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 	/* Reload the per-cpu base */
-@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
- 	/* Filter out anything that depends on CPUID levels we don't have */
- 	filter_cpuid_features(c, true);
- 
-+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
-+	setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- 	/* If the model name is still unset, do table lookup. */
- 	if (!c->x86_model_id[0]) {
- 		const char *p;
-@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
- 	int i;
- 
- 	cpu = stack_smp_processor_id();
--	t = &per_cpu(init_tss, cpu);
-+	t = init_tss + cpu;
- 	orig_ist = &per_cpu(orig_ist, cpu);
- 
- #ifdef CONFIG_NUMA
-@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
- 	switch_to_new_gdt(cpu);
- 	loadsegment(fs, 0);
- 
--	load_idt((const struct desc_ptr *)&idt_descr);
-+	load_idt(&idt_descr);
- 
- 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- 	syscall_init();
-@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
- {
- 	int cpu = smp_processor_id();
- 	struct task_struct *curr = current;
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 	struct thread_struct *thread = &curr->thread;
- 
- 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-04-04 20:46:41.513555986 -0400
-@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
- 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-04-04 20:46:41.513555986 -0400
-@@ -225,7 +225,7 @@ static struct cpu_model models[] =
- 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
- 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
- 
--	{ NULL, }
-+	{ NULL, NULL, 0, NULL}
- };
- #undef _BANIAS
- #undef BANIAS
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/intel.c linux-2.6.32.11/arch/x86/kernel/cpu/intel.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/intel.c	2010-04-04 20:41:49.916475305 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/intel.c	2010-04-04 20:46:41.513555986 -0400
-@@ -140,7 +140,7 @@ static void __cpuinit trap_init_f00f_bug
- 	 * Update the IDT descriptor and reload the IDT so that
- 	 * it uses the read-only mapped virtual address.
- 	 */
--	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- 	load_idt(&idt_descr);
- }
- #endif
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.11/arch/x86/kernel/cpu/intel_cacheinfo.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-04-04 20:46:41.513555986 -0400
-@@ -863,7 +863,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show   = show,
- 	.store  = store,
- };
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/Makefile linux-2.6.32.11/arch/x86/kernel/cpu/Makefile
---- linux-2.6.32.11/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/Makefile	2010-04-04 20:46:41.513555986 -0400
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
- 
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o		:= $(nostackp)
--
- obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
- obj-y			+= proc.o capflags.o powerflags.o common.o
- obj-y			+= vmware.o hypervisor.o sched.o
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce_amd.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-04-04 20:46:41.513555986 -0400
-@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- 	.show			= show,
- 	.store			= store,
- };
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mcheck/mce.c	2010-04-04 20:46:41.513555986 -0400
-@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
- 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- 				m->cs, m->ip);
- 
--		if (m->cs == __KERNEL_CS)
-+		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- 			print_symbol("{%s}", m->ip);
- 		pr_cont("\n");
- 	}
-@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
-  */
- 
- static DEFINE_SPINLOCK(mce_state_lock);
--static int		open_count;		/* #times opened */
-+static atomic_t		open_count;		/* #times opened */
- static int		open_exclu;		/* already open exclusive? */
- 
- static int mce_open(struct inode *inode, struct file *file)
- {
- 	spin_lock(&mce_state_lock);
- 
--	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
- 		spin_unlock(&mce_state_lock);
- 
- 		return -EBUSY;
-@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
- 
- 	if (file->f_flags & O_EXCL)
- 		open_exclu = 1;
--	open_count++;
-+	atomic_inc(&open_count);
- 
- 	spin_unlock(&mce_state_lock);
- 
-@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
- {
- 	spin_lock(&mce_state_lock);
- 
--	open_count--;
-+	atomic_dec(&open_count);
- 	open_exclu = 0;
- 
- 	spin_unlock(&mce_state_lock);
-@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
- 	MISC_MCELOG_MINOR,
- 	"mcelog",
- 	&mce_chrdev_ops,
-+	{NULL, NULL}, NULL, NULL
- };
- 
- /*
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/amd.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/amd.c	2010-04-04 20:46:41.513555986 -0400
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
- 	return 0;
- }
- 
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- 	.vendor            = X86_VENDOR_AMD,
- 	.set               = amd_set_mtrr,
- 	.get               = amd_get_mtrr,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/centaur.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/centaur.c	2010-04-04 20:46:41.513555986 -0400
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
- 	return 0;
- }
- 
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CENTAUR,
- 	.set               = centaur_set_mcr,
- 	.get               = centaur_get_mcr,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/cyrix.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-04-04 20:46:41.513555986 -0400
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- 	post_set();
- }
- 
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CYRIX,
- 	.set_all	   = cyrix_set_all,
- 	.set               = cyrix_set_arr,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/generic.c	2010-04-04 20:46:41.513555986 -0400
-@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
- 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
- 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
- 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
--	{}
-+	{ 0, 0 }
- };
- 
- static unsigned long smp_changes_mask;
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
-  * Generic structure...
-  */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- 	.use_intel_if		= 1,
- 	.set_all		= generic_set_all,
- 	.get			= generic_get_mtrr,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/main.c	2010-04-04 20:46:41.513555986 -0400
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
- 
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
- 
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
- 
- static void set_mtrr(unsigned int reg, unsigned long base,
- 		     unsigned long size, mtrr_type type);
- 
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- 		mtrr_ops[ops->vendor] = ops;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-04-04 20:46:41.517551870 -0400
-@@ -12,19 +12,19 @@
- extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
- 
- struct mtrr_ops {
--	u32	vendor;
--	u32	use_intel_if;
--	void	(*set)(unsigned int reg, unsigned long base,
-+	const u32	vendor;
-+	const u32	use_intel_if;
-+	void	(* const set)(unsigned int reg, unsigned long base,
- 		       unsigned long size, mtrr_type type);
--	void	(*set_all)(void);
-+	void	(* const set_all)(void);
- 
--	void	(*get)(unsigned int reg, unsigned long *base,
-+	void	(* const get)(unsigned int reg, unsigned long *base,
- 		       unsigned long *size, mtrr_type *type);
--	int	(*get_free_region)(unsigned long base, unsigned long size,
-+	int	(* const get_free_region)(unsigned long base, unsigned long size,
- 				   int replace_reg);
--	int	(*validate_add_page)(unsigned long base, unsigned long size,
-+	int	(* const validate_add_page)(unsigned long base, unsigned long size,
- 				     unsigned int type);
--	int	(*have_wrcomb)(void);
-+	int	(* const have_wrcomb)(void);
- };
- 
- extern int generic_get_free_region(unsigned long base, unsigned long size,
-@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- 				     unsigned int type);
- 
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
- 
- extern int positive_have_wrcomb(void);
- 
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
- 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
- 
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
- 
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
- 
- #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.11/arch/x86/kernel/cpu/perfctr-watchdog.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-04-04 20:46:41.517551870 -0400
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
- 
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
--	int (*reserve)(void);
--	void (*unreserve)(void);
--	int (*setup)(unsigned nmi_hz);
--	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
--	void (*stop)(void);
-+	int (* const reserve)(void);
-+	void (* const unreserve)(void);
-+	int (* const setup)(unsigned nmi_hz);
-+	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+	void (* const stop)(void);
- 	unsigned perfctr;
- 	unsigned evntsel;
- 	u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
- 
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
- 	return 1;
- }
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- 	.reserve	= single_msr_reserve,
- 	.unreserve	= single_msr_unreserve,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.11/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.32.11/arch/x86/kernel/cpu/perf_event.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/cpu/perf_event.c	2010-04-04 20:46:41.517551870 -0400
-@@ -2252,7 +2252,7 @@ perf_callchain_user(struct pt_regs *regs
- 			break;
- 
- 		callchain_store(entry, frame.return_address);
--		fp = frame.next_frame;
-+		fp = (__force const void __user *)frame.next_frame;
- 	}
- }
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/crash.c linux-2.6.32.11/arch/x86/kernel/crash.c
---- linux-2.6.32.11/arch/x86/kernel/crash.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/crash.c	2010-04-04 20:46:41.517551870 -0400
-@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, 
- 	regs = args->regs;
- 
- #ifdef CONFIG_X86_32
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		crash_fixup_ss_esp(&fixed_regs, regs);
- 		regs = &fixed_regs;
- 	}
-diff -urNp linux-2.6.32.11/arch/x86/kernel/doublefault_32.c linux-2.6.32.11/arch/x86/kernel/doublefault_32.c
---- linux-2.6.32.11/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/doublefault_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -11,7 +11,7 @@
- 
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
- 
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
- 
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- 	unsigned long gdt, tss;
- 
- 	store_gdt(&gdt_desc);
--	gdt = gdt_desc.address;
-+	gdt = (unsigned long)gdt_desc.address;
- 
- 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
- 
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
- 		/* 0x2 bit is always set */
- 		.flags		= X86_EFLAGS_SF | 0x2,
- 		.sp		= STACK_START,
--		.es		= __USER_DS,
-+		.es		= __KERNEL_DS,
- 		.cs		= __KERNEL_CS,
- 		.ss		= __KERNEL_DS,
--		.ds		= __USER_DS,
-+		.ds		= __KERNEL_DS,
- 		.fs		= __KERNEL_PERCPU,
- 
- 		.__cr3		= __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.32.11/arch/x86/kernel/dumpstack_32.c linux-2.6.32.11/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.32.11/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/dumpstack_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
- 	 * When in-kernel, we also print out the stack and code at the
- 	 * time of the fault..
- 	 */
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned int code_prologue = code_bytes * 43 / 64;
- 		unsigned int code_len = code_bytes;
- 		unsigned char c;
- 		u8 *ip;
-+		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
- 
- 		printk(KERN_EMERG "Stack:\n");
- 		show_stack_log_lvl(NULL, regs, &regs->sp,
-@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
- 
- 		printk(KERN_EMERG "Code: ");
- 
--		ip = (u8 *)regs->ip - code_prologue;
-+		ip = (u8 *)regs->ip - code_prologue + cs_base;
- 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- 			/* try starting at IP */
--			ip = (u8 *)regs->ip;
-+			ip = (u8 *)regs->ip + cs_base;
- 			code_len = code_len - code_prologue + 1;
- 		}
- 		for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
- 				printk(" Bad EIP value.");
- 				break;
- 			}
--			if (ip == (u8 *)regs->ip)
-+			if (ip == (u8 *)regs->ip + cs_base)
- 				printk("<%02x> ", c);
- 			else
- 				printk("%02x ", c);
-@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
- {
- 	unsigned short ud2;
- 
-+	ip = ktla_ktva(ip);
- 	if (ip < PAGE_OFFSET)
- 		return 0;
- 	if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.32.11/arch/x86/kernel/dumpstack.c linux-2.6.32.11/arch/x86/kernel/dumpstack.c
---- linux-2.6.32.11/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/dumpstack.c	2010-04-04 20:46:41.517551870 -0400
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
- 
- 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version);
-@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
- 		panic("Fatal exception in interrupt");
- 	if (panic_on_oops)
- 		panic("Fatal exception");
--	do_exit(signr);
-+	do_group_exit(signr);
- }
- 
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
- 	unsigned long flags = oops_begin();
- 	int sig = SIGSEGV;
- 
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		report_bug(regs->ip, regs);
- 
- 	if (__die(str, regs, err))
-diff -urNp linux-2.6.32.11/arch/x86/kernel/e820.c linux-2.6.32.11/arch/x86/kernel/e820.c
---- linux-2.6.32.11/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/e820.c	2010-04-04 20:46:41.517551870 -0400
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
--	{}
-+	{ 0, 0, {0}, 0 }
- };
- 
- static int __init find_overlapped_early(u64 start, u64 end)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/efi_32.c linux-2.6.32.11/arch/x86/kernel/efi_32.c
---- linux-2.6.32.11/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/efi_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -38,70 +38,38 @@
-  */
- 
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
- 
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
--	unsigned long cr4;
--	unsigned long temp;
- 	struct desc_ptr gdt_descr;
- 
- 	local_irq_save(efi_rt_eflags);
- 
--	/*
--	 * If I don't have PAE, I should just duplicate two entries in page
--	 * directory. If I have PAE, I just need to duplicate one entry in
--	 * page directory.
--	 */
--	cr4 = read_cr4_safe();
- 
--	if (cr4 & X86_CR4_PAE) {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		swapper_pg_dir[0].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--	} else {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		efi_bak_pg_dir_pointer[1].pgd =
--		    swapper_pg_dir[pgd_index(0x400000)].pgd;
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--		temp = PAGE_OFFSET + 0x400000;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    swapper_pg_dir[pgd_index(temp)].pgd;
--	}
-+	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
- 	 */
- 	__flush_tlb_all();
- 
--	gdt_descr.address = __pa(get_cpu_gdt_table(0));
-+	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- }
- 
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
--	unsigned long cr4;
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
-+	gdt_descr.address = get_cpu_gdt_table(0);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 
--	cr4 = read_cr4_safe();
--
--	if (cr4 & X86_CR4_PAE) {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--	} else {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    efi_bak_pg_dir_pointer[1].pgd;
--	}
-+	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.32.11/arch/x86/kernel/efi_stub_32.S linux-2.6.32.11/arch/x86/kernel/efi_stub_32.S
---- linux-2.6.32.11/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/efi_stub_32.S	2010-04-04 20:46:41.517551870 -0400
-@@ -6,6 +6,7 @@
-  */
- 
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
- 
- /*
-@@ -20,7 +21,7 @@
-  * service functions will comply with gcc calling convention, too.
-  */
- 
--.text
-+__INIT
- ENTRY(efi_call_phys)
- 	/*
- 	 * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
- 	 * The mapping of lower virtual memory has been created in prelog and
- 	 * epilog.
- 	 */
--	movl	$1f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	jmp	*%edx
-+	jmp	1f-__PAGE_OFFSET
- 1:
- 
- 	/*
-@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
- 	 * parameter 2, ..., param n. To make things easy, we save the return
- 	 * address of efi_call_phys in a global variable.
- 	 */
--	popl	%edx
--	movl	%edx, saved_return_addr
--	/* get the function pointer into ECX*/
--	popl	%ecx
--	movl	%ecx, efi_rt_function_ptr
--	movl	$2f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	pushl	%edx
-+	popl	(saved_return_addr)
-+	popl	(efi_rt_function_ptr)
- 
- 	/*
- 	 * 3. Clear PG bit in %CR0.
-@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
- 	/*
- 	 * 5. Call the physical function.
- 	 */
--	jmp	*%ecx
-+	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
- 
--2:
- 	/*
- 	 * 6. After EFI runtime service returns, control will return to
- 	 * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
- 	movl	%cr0, %edx
- 	orl	$0x80000000, %edx
- 	movl	%edx, %cr0
--	jmp	1f
--1:
-+
- 	/*
- 	 * 8. Now restore the virtual mode from flat mode by
- 	 * adding EIP with PAGE_OFFSET.
- 	 */
--	movl	$1f, %edx
--	jmp	*%edx
-+	jmp	1f+__PAGE_OFFSET
- 1:
- 
- 	/*
- 	 * 9. Balance the stack. And because EAX contain the return value,
- 	 * we'd better not clobber it.
- 	 */
--	leal	efi_rt_function_ptr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
-+	pushl	(efi_rt_function_ptr)
- 
- 	/*
--	 * 10. Push the saved return address onto the stack and return.
-+	 * 10. Return to the saved return address.
- 	 */
--	leal	saved_return_addr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
--	ret
-+	jmpl	*(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
- 
--.data
-+__INITDATA
- saved_return_addr:
- 	.long 0
- efi_rt_function_ptr:
-diff -urNp linux-2.6.32.11/arch/x86/kernel/entry_32.S linux-2.6.32.11/arch/x86/kernel/entry_32.S
---- linux-2.6.32.11/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/entry_32.S	2010-04-04 20:47:28.952733264 -0400
-@@ -191,7 +191,67 @@
- 
- #endif	/* CONFIG_X86_32_LAZY_GS */
- 
--.macro SAVE_ALL
-+.macro PAX_EXIT_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+#endif
-+	mov %cs, %esi
-+	cmp $__KERNEXEC_KERNEL_CS, %esi
-+	jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	btr $16, %esi
-+	ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+	mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro PAX_ENTER_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	bts $16, %esi
-+	jnc 1f
-+	mov %cs, %esi
-+	cmp $__KERNEL_CS, %esi
-+	jz 3f
-+	ljmp $__KERNEL_CS, $3f
-+1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+	mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro __SAVE_ALL _DS
- 	cld
- 	PUSH_GS
- 	pushl %fs
-@@ -224,7 +284,7 @@
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
--	movl $(__USER_DS), %edx
-+	movl $\_DS, %edx
- 	movl %edx, %ds
- 	movl %edx, %es
- 	movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +292,15 @@
- 	SET_KERNEL_GS %edx
- .endm
- 
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+	__SAVE_ALL __KERNEL_DS
-+	PAX_ENTER_KERNEL
-+#else
-+	__SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
-@@ -352,7 +421,15 @@ check_userspace:
- 	movb PT_CS(%esp), %al
- 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
- 	cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jae resume_userspace
-+
-+	PAX_EXIT_KERNEL
-+	jmp resume_kernel
-+#else
- 	jb resume_kernel		# not returning to v8086 or userspace
-+#endif
- 
- ENTRY(resume_userspace)
- 	LOCKDEP_SYS_EXIT
-@@ -414,10 +491,9 @@ sysenter_past_esp:
- 	/*CFI_REL_OFFSET cs, 0*/
- 	/*
- 	 * Push current_thread_info()->sysenter_return to the stack.
--	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
--	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
- 	 */
--	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+	GET_THREAD_INFO(%ebp)
-+	pushl TI_sysenter_return(%ebp)
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET eip, 0
- 
-@@ -430,9 +506,19 @@ sysenter_past_esp:
-  * Load the potential sixth argument from user stack.
-  * Careful about security.
-  */
-+	movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov PT_OLDSS(%esp),%ds
-+1:	movl %ds:(%ebp),%ebp
-+	push %ss
-+	pop %ds
-+#else
- 	cmpl $__PAGE_OFFSET-3,%ebp
- 	jae syscall_fault
- 1:	movl (%ebp),%ebp
-+#endif
-+
- 	movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- 	.align 4
-@@ -455,12 +541,23 @@ sysenter_do_call:
- 	testl $_TIF_ALLWORK_MASK, %ecx
- 	jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	pushl %eax
-+	CFI_ADJUST_CFA_OFFSET 4
-+	call pax_randomize_kstack
-+	popl %eax
-+	CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- /* if something modifies registers it must also disable sysexit */
- 	movl PT_EIP(%esp), %edx
- 	movl PT_OLDESP(%esp), %ecx
- 	xorl %ebp,%ebp
- 	TRACE_IRQS_ON
- 1:	mov  PT_FS(%esp), %fs
-+2:	mov  PT_DS(%esp), %ds
-+3:	mov  PT_ES(%esp), %es
- 	PTGS_TO_GS
- 	ENABLE_INTERRUPTS_SYSEXIT
- 
-@@ -504,11 +601,17 @@ sysexit_audit:
- 
- 	CFI_ENDPROC
- .pushsection .fixup,"ax"
--2:	movl $0,PT_FS(%esp)
-+4:	movl $0,PT_FS(%esp)
-+	jmp 1b
-+5:	movl $0,PT_DS(%esp)
-+	jmp 1b
-+6:	movl $0,PT_ES(%esp)
- 	jmp 1b
- .section __ex_table,"a"
- 	.align 4
--	.long 1b,2b
-+	.long 1b,4b
-+	.long 2b,5b
-+	.long 3b,6b
- .popsection
- 	PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -538,6 +641,10 @@ syscall_exit:
- 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
- 	jne syscall_exit_work
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	call pax_randomize_kstack
-+#endif
-+
- restore_all:
- 	TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,7 +709,13 @@ ldt_ss:
- 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
- 	mov %dx, %ax			/* eax: new kernel esp */
- 	sub %eax, %edx			/* offset (low word is 0) */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	shr $16, %edx
- 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-@@ -642,25 +755,19 @@ work_resched:
- 
- work_notifysig:				# deal with pending signals and
- 					# notify-resume requests
-+	movl %esp, %eax
- #ifdef CONFIG_VM86
- 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
--	movl %esp, %eax
--	jne work_notifysig_v86		# returning to kernel-space or
-+	jz 1f				# returning to kernel-space or
- 					# vm86-space
--	xorl %edx, %edx
--	call do_notify_resume
--	jmp resume_userspace_sig
- 
--	ALIGN
--work_notifysig_v86:
- 	pushl %ecx			# save ti_flags for do_notify_resume
- 	CFI_ADJUST_CFA_OFFSET 4
- 	call save_v86_state		# %eax contains pt_regs pointer
- 	popl %ecx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	movl %eax, %esp
--#else
--	movl %esp, %eax
-+1:
- #endif
- 	xorl %edx, %edx
- 	call do_notify_resume
-@@ -695,6 +802,10 @@ END(syscall_exit_work)
- 
- 	RING0_INT_FRAME			# can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %ss
-+	pop %ds
-+#endif
- 	GET_THREAD_INFO(%ebp)
- 	movl $-EFAULT,PT_EAX(%esp)
- 	jmp resume_userspace
-@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
-  * normal stack and adjusts ESP with the matching offset.
-  */
- 	/* fixup the stack */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- 	shl $16, %eax
-@@ -1198,7 +1315,6 @@ return_to_handler:
- 	ret
- #endif
- 
--.section .rodata,"a"
- #include "syscall_table_32.S"
- 
- syscall_table_size=(.-sys_call_table)
-@@ -1250,12 +1366,15 @@ error_code:
- 	movl %ecx, %fs
- 	UNWIND_ESPFIX_STACK
- 	GS_TO_REG %ecx
-+
-+	PAX_ENTER_KERNEL
-+
- 	movl PT_GS(%esp), %edi		# get the function address
- 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
- 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
- 	REG_TO_PTGS %ecx
- 	SET_KERNEL_GS %ecx
--	movl $(__USER_DS), %ecx
-+	movl $(__KERNEL_DS), %ecx
- 	movl %ecx, %ds
- 	movl %ecx, %es
- 	TRACE_IRQS_OFF
-@@ -1351,6 +1470,9 @@ nmi_stack_correct:
- 	xorl %edx,%edx		# zero error code
- 	movl %esp,%eax		# pt_regs pointer
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	jmp restore_all_notrace
- 	CFI_ENDPROC
- 
-@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
- 	FIXUP_ESPFIX_STACK		# %eax == %esp
- 	xorl %edx,%edx			# zero error code
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	RESTORE_REGS
- 	lss 12+4(%esp), %esp		# back to espfix stack
- 	CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.32.11/arch/x86/kernel/entry_64.S linux-2.6.32.11/arch/x86/kernel/entry_64.S
---- linux-2.6.32.11/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/entry_64.S	2010-04-07 16:58:23.343008831 -0400
-@@ -53,6 +53,7 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
- #include <linux/elf-em.h>
-@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
- 
-+	.macro ljmpq sel, off
-+#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+	.byte 0x48; ljmp *1234f(%rip)
-+	.pushsection .rodata
-+	.align 16
-+	1234: .quad \off; .word \sel
-+	.popsection
-+#else
-+	push $\sel
-+	push $\off
-+	lretq
-+#endif
-+	.endm
-+
-+ENTRY(pax_enter_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	jnc 1f
-+	mov %cs,%edi
-+	cmp $__KERNEL_CS,%edi
-+	jz 3f
-+	ljmpq __KERNEL_CS,3f
-+1:	ljmpq __KERNEXEC_KERNEL_CS,2f
-+2:	SET_RDI_INTO_CR0
-+3:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	mov %cs,%rdi
-+	cmp $__KERNEXEC_KERNEL_CS,%edi
-+	jnz 2f
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	ljmpq __KERNEL_CS,1f
-+1:	SET_RDI_INTO_CR0
-+2:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel)
-+
-+ENTRY(pax_enter_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+	push %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	mov %rdi,%rbx
-+	add $__START_KERNEL_map,%rbx
-+	sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rdi
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0,i*8(%rbx)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	pop %rdi
-+#endif
-+	SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rbx
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rbx
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	add $__START_KERNEL_map,%rdi
-+	sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	mov %rdi,%rbx
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0x67,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0x67,i*8(%rdi)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	PV_RESTORE_REGS(CLBR_RDI)
-+	pop %rbx
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel_user)
- 
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
- 
- 	movq	%rsp,PER_CPU_VAR(old_rsp)
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs off/on section - it's straight
- 	 * and short:
-@@ -502,6 +691,11 @@ sysret_check:
- 	andl %edi,%edx
- 	jnz  sysret_careful
- 	CFI_REMEMBER_STATE
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	/*
- 	 * sysretq will re-enable interrupts:
- 	 */
-@@ -800,7 +994,16 @@ END(interrupt)
- 	CFI_ADJUST_CFA_OFFSET 10*8
- 	call save_args
- 	PARTIAL_FRAME 0
--	call \func
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rdi)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	call \func
- 	.endm
- 
- 	/*
-@@ -844,12 +1047,18 @@ retint_swapgs:		/* return to user-space 
- 	 * The iretq could re-enable interrupts:
- 	 */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	TRACE_IRQS_IRETQ
- 	SWAPGS
- 	jmp restore_args
- 
- retint_restore_args:	/* return to kernel space */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+	call pax_exit_kernel
- 	/*
- 	 * The iretq could re-enable interrupts:
- 	 */
-@@ -1032,7 +1241,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
- 	jmp error_exit		/* %ebx: no swapgs flag */
-@@ -1049,7 +1267,16 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
- 	jmp paranoid_exit	/* %ebx: no swapgs flag */
-@@ -1066,9 +1293,23 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
--	PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+	lea init_tss(%rbp), %rbp
-+#else
-+	lea init_tss(%rip), %rbp
-+#endif
- 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- 	call \do_sym
- 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
-@@ -1085,7 +1326,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
--	movq %rsp,%rdi			/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
- 	call \do_sym
-@@ -1104,7 +1354,16 @@ ENTRY(\sym)
- 	call save_paranoid
- 	DEFAULT_FRAME 0
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi			/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
- 	call \do_sym
-@@ -1408,11 +1667,13 @@ ENTRY(paranoid_exit)
- 	testl $3,CS(%rsp)
- 	jnz   paranoid_userspace
- paranoid_swapgs:
-+	call pax_exit_kernel
- 	TRACE_IRQS_IRETQ 0
- 	SWAPGS_UNSAFE_STACK
- 	RESTORE_ALL 8
- 	jmp irq_return
- paranoid_restore:
-+	call pax_exit_kernel
- 	TRACE_IRQS_IRETQ 0
- 	RESTORE_ALL 8
- 	jmp irq_return
-@@ -1529,6 +1790,16 @@ ENTRY(nmi)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call save_paranoid
- 	DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:
- 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- 	movq %rsp,%rdi
- 	movq $-1,%rsi
-@@ -1544,6 +1815,7 @@ ENTRY(nmi)
- nmi_swapgs:
- 	SWAPGS_UNSAFE_STACK
- nmi_restore:
-+	call pax_exit_kernel
- 	RESTORE_ALL 8
- 	jmp irq_return
- nmi_userspace:
-diff -urNp linux-2.6.32.11/arch/x86/kernel/ftrace.c linux-2.6.32.11/arch/x86/kernel/ftrace.c
---- linux-2.6.32.11/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/ftrace.c	2010-04-04 20:46:41.517551870 -0400
-@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
- {
- 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- 		smp_rmb();
-+		pax_open_kernel();
- 		ftrace_mod_code();
-+		pax_close_kernel();
- 		atomic_inc(&nmi_update_count);
- 	}
- 	/* Must have previous changes seen before executions */
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
- 
- 
- 
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
- 
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
- {
- 	unsigned char replaced[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	/*
- 	 * Note: Due to modules and __init, code can
- 	 *  disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
- 	unsigned char old[MCOUNT_INSN_SIZE], *new;
- 	int ret;
- 
--	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
- 	new = ftrace_call_replace(ip, (unsigned long)func);
- 	ret = ftrace_modify_code(ip, old, new);
- 
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
- 	switch (faulted) {
- 	case 0:
- 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
--		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- 		break;
- 	case 1:
- 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
--		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- 		break;
- 	case 2:
- 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
--		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- 		break;
- 	}
- 
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
- {
- 	unsigned char code[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- 		return -EFAULT;
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/head32.c linux-2.6.32.11/arch/x86/kernel/head32.c
---- linux-2.6.32.11/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/head32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -16,6 +16,7 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
- 
- static void __init i386_default_early_setup(void)
- {
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- 	reserve_trampoline_memory();
- 
--	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
- 
- #ifdef CONFIG_BLK_DEV_INITRD
- 	/* Reserve INITRD */
-diff -urNp linux-2.6.32.11/arch/x86/kernel/head_32.S linux-2.6.32.11/arch/x86/kernel/head_32.S
---- linux-2.6.32.11/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/head_32.S	2010-04-04 20:58:33.220592413 -0400
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
- 
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
-  * References to members of the new_cpu_data structure.
-  */
-@@ -52,11 +59,7 @@
-  * and small than max_low_pfn, otherwise will waste some page table entries
-  */
- 
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
- 
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- 
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
-  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
-  * %esi points to the real-mode code as a 32-bit pointer.
-  * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-  * can.
-  */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
- 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
- 		us to not reload segments */
-@@ -97,6 +113,55 @@ ENTRY(startup_32)
- 	movl %eax,%gs
- 2:
- 
-+#ifdef CONFIG_SMP
-+	movl $pa(cpu_gdt_table),%edi
-+	movl $__per_cpu_load,%eax
-+	movw %ax,__KERNEL_PERCPU + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_PERCPU + 4(%edi)
-+	movb %ah,__KERNEL_PERCPU + 7(%edi)
-+	movl $__per_cpu_end - 1,%eax
-+	subl $__per_cpu_start,%eax
-+	movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+1:
-+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	movl $pa(boot_gdt),%edi
-+	movl $__LOAD_PHYSICAL_ADDR,%eax
-+	movw %ax,__BOOT_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__BOOT_CS + 4(%edi)
-+	movb %ah,__BOOT_CS + 7(%edi)
-+	rorl $16,%eax
-+
-+	ljmp $(__BOOT_CS),$1f
-+1:
-+
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+	addl $__PAGE_OFFSET,%eax
-+1:
-+	movw %ax,__KERNEL_CS + 2(%edi)
-+	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_CS + 4(%edi)
-+	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
-+	movb %ah,__KERNEL_CS + 7(%edi)
-+	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
-+	rorl $16,%eax
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
- /*
-  * Clear BSS first so that there are no surprises...
-  */
-@@ -140,9 +205,7 @@ ENTRY(startup_32)
- 	cmpl $num_subarch_entries, %eax
- 	jae bad_subarch
- 
--	movl pa(subarch_entries)(,%eax,4), %eax
--	subl $__PAGE_OFFSET, %eax
--	jmp *%eax
-+	jmp *pa(subarch_entries)(,%eax,4)
- 
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +217,10 @@ WEAK(xen_entry)
- 	__INITDATA
- 
- subarch_entries:
--	.long default_entry		/* normal x86/PC */
--	.long lguest_entry		/* lguest hypervisor */
--	.long xen_entry			/* Xen hypervisor */
--	.long default_entry		/* Moorestown MID */
-+	.long ta(default_entry)		/* normal x86/PC */
-+	.long ta(lguest_entry)		/* lguest hypervisor */
-+	.long ta(xen_entry)		/* Xen hypervisor */
-+	.long ta(default_entry)		/* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +281,11 @@ default_entry:
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else	/* Not PAE */
- 
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- 	jmp 3f
- /*
-@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
- 	orl %edx,%eax
- 	movl %eax,%cr4
- 
-+#ifdef CONFIG_X86_PAE
- 	btl $5, %eax		# check if PAE is enabled
- 	jnc 6f
- 
-@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
- 	jnc 6f
- 
- 	/* Setup EFER (Extended Feature Enable Register) */
--	movl $0xc0000080, %ecx
-+	movl $MSR_EFER, %ecx
- 	rdmsr
- 
- 	btsl $11, %eax
- 	/* Make changes effective */
- 	wrmsr
- 
-+	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+	movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
- 
- /*
-@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
- 
- #ifdef CONFIG_SMP
- 	cmpb $0, ready
--	jz  1f				/* Initial CPU cleans BSS */
--	jmp checkCPUtype
--1:
-+	jnz checkCPUtype		/* Initial CPU cleans BSS */
- #endif /* CONFIG_SMP */
- 
- /*
-@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
- 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
- 	movl %eax,%ss			# after changing gdt.
- 
--	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
-+#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
- 	movl %eax,%ds
- 	movl %eax,%es
- 
-@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
- 	 */
- 	cmpb $0,ready
- 	jne 1f
--	movl $per_cpu__gdt_page,%eax
-+	movl $cpu_gdt_table,%eax
- 	movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+	addl $__per_cpu_load,%ecx
-+#endif
- 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- 	shrl $16, %ecx
- 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
- #ifdef CONFIG_SMP
- 	movb ready, %cl
- 	movb $1, ready
--	cmpb $0,%cl		# the first CPU calls start_kernel
--	je   1f
--	movl (stack_start), %esp
--1:
- #endif /* CONFIG_SMP */
- 	jmp *(initial_code)
- 
-@@ -546,22 +617,22 @@ early_page_fault:
- 	jmp early_fault
- 
- early_fault:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $1,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pusha
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	movl %cr2,%eax
- 	pushl %eax
- 	pushl %edx		/* trapno */
- 	pushl $fault_msg
- 	call printk
-+;	call dump_stack
- #endif
--	call dump_stack
- hlt_loop:
- 	hlt
- 	jmp hlt_loop
-@@ -569,8 +640,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- 	ALIGN
- ignore_int:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $2,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pushl %eax
- 	pushl %ecx
- 	pushl %edx
-@@ -579,9 +653,6 @@ ignore_int:
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	pushl 16(%esp)
- 	pushl 24(%esp)
- 	pushl 32(%esp)
-@@ -608,27 +679,45 @@ ENTRY(initial_code)
- /*
-  * BSS section
-  */
--__PAGE_ALIGNED_BSS
--	.align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- 	.fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- 	.fill 1024,4,0
- #endif
-+
- swapper_pg_fixmap:
- 	.fill 1024,4,0
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- 	.fill 4096,1,0
- 
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+	.fill 256,8,0
-+
-+/*
-  * This starts the data section.
-  */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
--	/* Page-aligned for the benefit of paravirt? */
--	.align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- ENTRY(swapper_pg_dir)
- 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
- # if KPMDS == 3
-@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
- 
- .data
- ENTRY(stack_start)
--	.long init_thread_union+THREAD_SIZE
-+	.long init_thread_union+THREAD_SIZE-8
- 	.long __BOOT_DS
- 
- ready:	.byte 0
- 
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- 	.long 0
- 
-@@ -691,7 +781,7 @@ fault_msg:
- 	.word 0				# 32 bit align gdt_desc.address
- boot_gdt_descr:
- 	.word __BOOT_DS+7
--	.long boot_gdt - __PAGE_OFFSET
-+	.long pa(boot_gdt)
- 
- 	.word 0				# 32-bit align idt_desc.address
- idt_descr:
-@@ -702,7 +792,7 @@ idt_descr:
- 	.word 0				# 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- 	.word GDT_ENTRIES*8-1
--	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
-+	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
- 
- /*
-  * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
- 	.align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- 	.fill GDT_ENTRY_BOOT_CS,8,0
--	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
--	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
-+	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
-+
-+	.align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad 0x0000000000000000	/* NULL descriptor */
-+	.quad 0x0000000000000000	/* 0x0b reserved */
-+	.quad 0x0000000000000000	/* 0x13 reserved */
-+	.quad 0x0000000000000000	/* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+	.quad 0x0000000000000000	/* 0x20 unused */
-+#endif
-+
-+	.quad 0x0000000000000000	/* 0x28 unused */
-+	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
-+	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
-+	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
-+	.quad 0x0000000000000000	/* 0x4b reserved */
-+	.quad 0x0000000000000000	/* 0x53 reserved */
-+	.quad 0x0000000000000000	/* 0x5b reserved */
-+
-+	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
-+	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
-+	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
-+
-+	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
-+	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
-+
-+	/*
-+	 * Segments used for calling PnP BIOS have byte granularity.
-+	 * The code segments and data segments have fixed 64k limits,
-+	 * the transfer segment sizes are set at run time.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
-+	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
-+	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
-+	.quad 0x0000930000000000	/* 0xa8 16-bit data */
-+	.quad 0x0000930000000000	/* 0xb0 16-bit data */
-+
-+	/*
-+	 * The APM segments have byte granularity and their bases
-+	 * are set at run time.  All have 64k limits.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
-+	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
-+	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
-+
-+	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
-+	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
-+	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
-+	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
-+	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
-+	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+	/* Be sure this is zeroed to avoid false validations in Xen */
-+	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+	.endr
-diff -urNp linux-2.6.32.11/arch/x86/kernel/head64.c linux-2.6.32.11/arch/x86/kernel/head64.c
---- linux-2.6.32.11/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/head64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -29,7 +29,13 @@
- static void __init zap_identity_mappings(void)
- {
- 	pgd_t *pgd = pgd_offset_k(0UL);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	set_pgd(pgd, native_make_pgd(0));
-+#else
- 	pgd_clear(pgd);
-+#endif
-+
- 	__flush_tlb_all();
- }
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/head_64.S linux-2.6.32.11/arch/x86/kernel/head_64.S
---- linux-2.6.32.11/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/head_64.S	2010-04-04 20:58:33.220592413 -0400
-@@ -19,6 +19,7 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
- 
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
- 
- 	.text
- 	__HEAD
-@@ -85,35 +90,22 @@ startup_64:
- 	 */
- 	addq	%rbp, init_level4_pgt + 0(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
- 
- 	addq	%rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+	addq	%rbp, level3_ident_pgt + 8(%rip)
-+#endif
- 
--	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
--	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
-+	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
- 
--	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
- 
--	/* Add an Identity mapping if I am above 1G */
--	leaq	_text(%rip), %rdi
--	andq	$PMD_PAGE_MASK, %rdi
--
--	movq	%rdi, %rax
--	shrq	$PUD_SHIFT, %rax
--	andq	$(PTRS_PER_PUD - 1), %rax
--	jz	ident_complete
--
--	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
--	leaq	level3_ident_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--
--	movq	%rdi, %rax
--	shrq	$PMD_SHIFT, %rax
--	andq	$(PTRS_PER_PMD - 1), %rax
--	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
--	leaq	level2_spare_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
- 
- 	/*
- 	 * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
- 	 * after the boot processor executes this code.
- 	 */
- 
--	/* Enable PAE mode and PGE */
--	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
-+	/* Enable PAE mode and PSE/PGE */
-+	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- 	movq	%rax, %cr4
- 
- 	/* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
- 	movl	$MSR_EFER, %ecx
- 	rdmsr
- 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
--	btl	$20,%edi		/* No Execute supported? */
-+	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
- 	jnc     1f
- 	btsl	$_EFER_NX, %eax
-+	leaq	init_level4_pgt(%rip), %rdi
-+	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1:	wrmsr				/* Make changes effective */
- 
- 	/* Setup cr0 */
-@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
- 	.quad	x86_64_start_kernel
- 	ENTRY(initial_gs)
- 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
--	__FINITDATA
- 
- 	ENTRY(stack_start)
- 	.quad  init_thread_union+THREAD_SIZE-8
- 	.word  0
-+	__FINITDATA
- 
- bad_address:
- 	jmp bad_address
- 
--	.section ".init.text","ax"
-+	__INIT
- #ifdef CONFIG_EARLY_PRINTK
- 	.globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1:	hlt
- 	jmp 1b
-+	.previous
- 
- #ifdef CONFIG_EARLY_PRINTK
-+	__INITDATA
- early_recursion_flag:
- 	.long 0
-+	.previous
- 
-+	.section .rodata,"a",@progbits
- early_idt_msg:
- 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- 	.asciz "RIP %s\n"
--#endif /* CONFIG_EARLY_PRINTK */
- 	.previous
-+#endif /* CONFIG_EARLY_PRINTK */
- 
-+	.section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- 	.balign	PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
-+	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
-+	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
- 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- 	.fill	511,8,0
-+#else
-+	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+	.fill	510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_pgt)
-+	.fill	512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+	.fill	L3_VMEMMAP_START,8,0
-+	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 
- NEXT_PAGE(level3_kernel_pgt)
- 	.fill	L3_START_KERNEL,8,0
-@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
- 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+NEXT_PAGE(level2_vmemmap_pgt)
-+	.fill	512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
--	.fill	506,8,0
--	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
--	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
--	.fill	5,8,0
-+	.fill	507,8,0
-+	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+	.fill	4,8,0
- 
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- 	.fill	512,8,0
- 
--NEXT_PAGE(level2_ident_pgt)
--	/* Since I easily can, map the first 1G.
-+	/* Since I easily can, map the first 2G.
- 	 * Don't set NX because code runs from these pages.
- 	 */
--	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
- 
- NEXT_PAGE(level2_kernel_pgt)
- 	/*
-@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
- 	 *  If you want to increase this then increase MODULES_VADDR
- 	 *  too.)
- 	 */
--	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
--		KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
--	.fill   512, 8, 0
-+	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
- 
- #undef PMDS
- #undef NEXT_PAGE
- 
--	.data
-+	.align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad	0x0000000000000000	/* NULL descriptor */
-+	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
-+	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
-+	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
-+	.quad	0x00cffb000000ffff	/* __USER32_CS */
-+	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
-+	.quad	0x00affb000000ffff	/* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
-+#else
-+	.quad	0x0			/* unused */
-+#endif
-+
-+	.quad	0,0			/* TSS */
-+	.quad	0,0			/* LDT */
-+	.quad	0,0,0			/* three TLS descriptors */
-+	.quad	0x0000f40000000000	/* node/CPU stored in limit */
-+	/* asm/segment.h:GDT_ENTRIES must match this */
-+
-+	/* zero the remaining page */
-+	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+	.endr
-+
- 	.align 16
- 	.globl early_gdt_descr
- early_gdt_descr:
- 	.word	GDT_ENTRIES*8-1
- early_gdt_descr_base:
--	.quad	INIT_PER_CPU_VAR(gdt_page)
-+	.quad	cpu_gdt_table
- 
- ENTRY(phys_base)
- 	/* This must match the first entry in level2_kernel_pgt */
- 	.quad   0x0000000000000000
- 
- #include "../../x86/xen/xen-head.S"
--	
--	.section .bss, "aw", @nobits
-+
-+	.section .rodata,"a",@progbits
- 	.align L1_CACHE_BYTES
- ENTRY(idt_table)
--	.skip IDT_ENTRIES * 16
-+	.fill 512,8,0
- 
- 	__PAGE_ALIGNED_BSS
- 	.align PAGE_SIZE
-diff -urNp linux-2.6.32.11/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.11/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.32.11/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/i386_ksyms_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
- 
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
- 
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
- 
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff -urNp linux-2.6.32.11/arch/x86/kernel/init_task.c linux-2.6.32.11/arch/x86/kernel/init_task.c
---- linux-2.6.32.11/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/init_task.c	2010-04-04 20:46:41.517551870 -0400
-@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
-  * section. Since TSS's are completely CPU-local, we want them
-  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
-  */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/ioport.c linux-2.6.32.11/arch/x86/kernel/ioport.c
---- linux-2.6.32.11/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/ioport.c	2010-04-04 20:46:41.517551870 -0400
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
- 
- 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- 		return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+	if (turn_on) {
-+		gr_handle_ioperm();
-+		return -EPERM;
-+	}
-+#endif
- 	if (turn_on && !capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
- 	 * because the ->io_bitmap_max value must match the bitmap
- 	 * contents:
- 	 */
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 
- 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
- 
-@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
- 		return -EINVAL;
- 	/* Trying to gain more privileges? */
- 	if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+		gr_handle_iopl();
-+		return -EPERM;
-+#else
- 		if (!capable(CAP_SYS_RAWIO))
- 			return -EPERM;
-+#endif
- 	}
- 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/irq_32.c linux-2.6.32.11/arch/x86/kernel/irq_32.c
---- linux-2.6.32.11/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/irq_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
- 		return 0;
- 
- 	/* build the stack frame on the IRQ stack */
--	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 	irqctx->tinfo.task = curctx->tinfo.task;
- 	irqctx->tinfo.previous_esp = current_stack_pointer;
- 
-@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
- 		irqctx->tinfo.previous_esp = current_stack_pointer;
- 
- 		/* build the stack frame on the softirq stack */
--		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 
- 		call_on_stack(__do_softirq, isp);
- 		/*
-diff -urNp linux-2.6.32.11/arch/x86/kernel/kgdb.c linux-2.6.32.11/arch/x86/kernel/kgdb.c
---- linux-2.6.32.11/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/kgdb.c	2010-04-04 20:46:41.521777445 -0400
-@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
- 	return instruction_pointer(regs);
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: */
- 	.gdb_bpt_instr		= { 0xcc },
- 	.flags			= KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/kprobes.c linux-2.6.32.11/arch/x86/kernel/kprobes.c
---- linux-2.6.32.11/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/kprobes.c	2010-04-04 20:46:41.521777445 -0400
-@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
- 		char op;
- 		s32 raddr;
- 	} __attribute__((packed)) * jop;
--	jop = (struct __arch_jmp_op *)from;
-+
-+	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+	pax_open_kernel();
- 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- 	jop->op = RELATIVEJUMP_INSTRUCTION;
-+	pax_close_kernel();
- }
- 
- /*
-@@ -345,16 +349,18 @@ static void __kprobes fix_riprel(struct 
- 
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
--	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_open_kernel();
-+	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_close_kernel();
- 
- 	fix_riprel(p);
- 
--	if (can_boost(p->addr))
-+	if (can_boost(ktla_ktva(p->addr)))
- 		p->ainsn.boostable = 0;
- 	else
- 		p->ainsn.boostable = -1;
- 
--	p->opcode = *p->addr;
-+	p->opcode = *(ktla_ktva(p->addr));
- }
- 
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,7 +438,7 @@ static void __kprobes prepare_singlestep
- 	if (p->opcode == BREAKPOINT_INSTRUCTION)
- 		regs->ip = (unsigned long)p->addr;
- 	else
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
- 
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -453,7 +459,7 @@ static void __kprobes setup_singlestep(s
- 	if (p->ainsn.boostable == 1 && !p->post_handler) {
- 		/* Boost up -- we can execute copied instructions directly */
- 		reset_current_kprobe();
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 		preempt_enable_no_resched();
- 		return;
- 	}
-@@ -523,7 +529,7 @@ static int __kprobes kprobe_handler(stru
- 	struct kprobe_ctlblk *kcb;
- 
- 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
--	if (*addr != BREAKPOINT_INSTRUCTION) {
-+	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- 		/*
- 		 * The breakpoint instruction was removed right
- 		 * after we hit it.  Another cpu has removed
-@@ -775,7 +781,7 @@ static void __kprobes resume_execution(s
- 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- 	unsigned long *tos = stack_addr(regs);
--	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 	unsigned long orig_ip = (unsigned long)p->addr;
- 	kprobe_opcode_t *insn = p->ainsn.insn;
- 
-@@ -958,7 +964,7 @@ int __kprobes kprobe_exceptions_notify(s
- 	struct die_args *args = data;
- 	int ret = NOTIFY_DONE;
- 
--	if (args->regs && user_mode_vm(args->regs))
-+	if (args->regs && user_mode(args->regs))
- 		return ret;
- 
- 	switch (val) {
-diff -urNp linux-2.6.32.11/arch/x86/kernel/ldt.c linux-2.6.32.11/arch/x86/kernel/ldt.c
---- linux-2.6.32.11/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/ldt.c	2010-04-04 20:46:41.521777445 -0400
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
- 	if (reload) {
- #ifdef CONFIG_SMP
- 		preempt_disable();
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- 		if (!cpumask_equal(mm_cpumask(current->mm),
- 				   cpumask_of(smp_processor_id())))
- 			smp_call_function(flush_ldt, current->mm, 1);
- 		preempt_enable();
- #else
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- #endif
- 	}
- 	if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
- 		return err;
- 
- 	for (i = 0; i < old->size; i++)
--		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+		write_ldt_entry(new->ldt, i, old->ldt + i);
- 	return 0;
- }
- 
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
- 		retval = copy_ldt(&mm->context, &old_mm->context);
- 		mutex_unlock(&old_mm->context.lock);
- 	}
-+
-+	if (tsk == current) {
-+		mm->context.vdso = ~0UL;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		mm->context.user_cs_base = 0UL;
-+		mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+	}
-+
- 	return retval;
- }
- 
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+		error = -EINVAL;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	fill_ldt(&ldt, &ldt_info);
- 	if (oldmode)
- 		ldt.avl = 0;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.11/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.32.11/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/machine_kexec_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
- 
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- 	struct desc_ptr curidt;
- 
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
- }
- 
- 
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- 	struct desc_ptr curgdt;
- 
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- 	}
- 
- 	control_page = page_address(image->control_code_page);
--	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
- 
- 	relocate_kernel_ptr = control_page;
- 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.11/arch/x86/kernel/machine_kexec_64.c
---- linux-2.6.32.11/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/machine_kexec_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
- 	}
- 	/* clear the unused entries */
- 	while (addr < end_addr) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		set_pgd(level4p++, native_make_pgd(0));
-+#else
- 		pgd_clear(level4p++);
-+#endif
-+
- 		addr += PGDIR_SIZE;
- 	}
- out:
-diff -urNp linux-2.6.32.11/arch/x86/kernel/microcode_amd.c linux-2.6.32.11/arch/x86/kernel/microcode_amd.c
---- linux-2.6.32.11/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/microcode_amd.c	2010-04-04 20:46:41.521777445 -0400
-@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- 	.request_microcode_user           = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info_amd,
-@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
- 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
- };
- 
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return &microcode_amd_ops;
- }
-diff -urNp linux-2.6.32.11/arch/x86/kernel/microcode_core.c linux-2.6.32.11/arch/x86/kernel/microcode_core.c
---- linux-2.6.32.11/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/microcode_core.c	2010-04-04 20:46:41.521777445 -0400
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
- 
- #define MICROCODE_VERSION	"2.00"
- 
--static struct microcode_ops	*microcode_ops;
-+static const struct microcode_ops	*microcode_ops;
- 
- /*
-  * Synchronization.
-diff -urNp linux-2.6.32.11/arch/x86/kernel/microcode_intel.c linux-2.6.32.11/arch/x86/kernel/microcode_intel.c
---- linux-2.6.32.11/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/microcode_intel.c	2010-04-04 20:46:41.521777445 -0400
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
- 
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
--	return copy_from_user(to, from, n);
-+	return copy_from_user(to, (__force const void __user *)from, n);
- }
- 
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
--	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
- }
- 
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- 	.request_microcode_user		  = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
- 	.microcode_fini_cpu               = microcode_fini_cpu,
- };
- 
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return &microcode_intel_ops;
- }
-diff -urNp linux-2.6.32.11/arch/x86/kernel/module.c linux-2.6.32.11/arch/x86/kernel/module.c
---- linux-2.6.32.11/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/module.c	2010-04-04 20:46:41.521777445 -0400
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
- 
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- 	struct vm_struct *area;
- 
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- 	if (!area)
- 		return NULL;
- 
--	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
--					PAGE_KERNEL_EXEC);
-+	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	return __module_alloc(size, PAGE_KERNEL);
-+#else
-+	return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
- 
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+	struct vm_struct *area;
-+
-+	if (size == 0)
-+		return NULL;
-+
-+	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+	return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+	return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- 			      Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 	unsigned int i;
- 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- 	Elf32_Sym *sym;
--	uint32_t *location;
-+	uint32_t *plocation, location;
- 
- 	DEBUGP("Applying relocate section %u to %u\n", relsec,
- 	       sechdrs[relsec].sh_info);
- 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- 		/* This is where to make the change */
--		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
--			+ rel[i].r_offset;
-+		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+		location = (uint32_t)plocation;
-+		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+			plocation = ktla_ktva((void *)plocation);
- 		/* This is the symbol it is referring to.  Note that all
- 		   undefined symbols have been resolved.  */
- 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 		switch (ELF32_R_TYPE(rel[i].r_info)) {
- 		case R_386_32:
- 			/* We add the value into the location given */
--			*location += sym->st_value;
-+			pax_open_kernel();
-+			*plocation += sym->st_value;
-+			pax_close_kernel();
- 			break;
- 		case R_386_PC32:
- 			/* Add the value, subtract its postition */
--			*location += sym->st_value - (uint32_t)location;
-+			pax_open_kernel();
-+			*plocation += sym->st_value - location;
-+			pax_close_kernel();
- 			break;
- 		default:
- 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
- 		case R_X86_64_NONE:
- 			break;
- 		case R_X86_64_64:
-+			pax_open_kernel();
- 			*(u64 *)loc = val;
-+			pax_close_kernel();
- 			break;
- 		case R_X86_64_32:
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
- 			if (val != *(u32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_32S:
-+			pax_open_kernel();
- 			*(s32 *)loc = val;
-+			pax_close_kernel();
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_PC32:
- 			val -= (u64)loc;
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
-+
- #if 0
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/paravirt.c linux-2.6.32.11/arch/x86/kernel/paravirt.c
---- linux-2.6.32.11/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/paravirt.c	2010-04-04 20:46:41.521777445 -0400
-@@ -120,9 +120,9 @@ unsigned paravirt_patch_jmp(void *insnbu
- 
- /* Neat trick to map patch type back to the call within the
-  * corresponding structure. */
--static void *get_call_destination(u8 type)
-+static const void *get_call_destination(u8 type)
- {
--	struct paravirt_patch_template tmpl = {
-+	const struct paravirt_patch_template tmpl = {
- 		.pv_init_ops = pv_init_ops,
- 		.pv_time_ops = pv_time_ops,
- 		.pv_cpu_ops = pv_cpu_ops,
-@@ -133,13 +133,13 @@ static void *get_call_destination(u8 typ
- 		.pv_lock_ops = pv_lock_ops,
- #endif
- 	};
--	return *((void **)&tmpl + type);
-+	return *((const void **)&tmpl + type);
- }
- 
- unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
- 				unsigned long addr, unsigned len)
- {
--	void *opfunc = get_call_destination(type);
-+	const void *opfunc = get_call_destination(type);
- 	unsigned ret;
- 
- 	if (opfunc == NULL)
-@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
- 	if (insn_len > len || start == NULL)
- 		insn_len = len;
- 	else
--		memcpy(insnbuf, start, insn_len);
-+		memcpy(insnbuf, ktla_ktva(start), insn_len);
- 
- 	return insn_len;
- }
-@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
- 	preempt_enable();
- }
- 
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- 	.name = "bare hardware",
- 	.paravirt_enabled = 0,
- 	.kernel_rpl = 0,
- 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
- };
- 
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- 	.patch = native_patch,
- };
- 
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- 	.sched_clock = native_sched_clock,
- };
- 
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
- 
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- 	.cpuid = native_cpuid,
- 	.get_debugreg = native_get_debugreg,
- 	.set_debugreg = native_set_debugreg,
-@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
- 	.end_context_switch = paravirt_nop,
- };
- 
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- 	.startup_ipi_hook = paravirt_nop,
- #endif
-@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
- #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
- 
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
- 
- 	.read_cr2 = native_read_cr2,
- 	.write_cr2 = native_write_cr2,
-@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- 	},
- 
- 	.set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.pax_open_kernel = native_pax_open_kernel,
-+	.pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
- 
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.11/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.32.11/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/paravirt-spinlocks.c	2010-04-04 20:46:41.521777445 -0400
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
- 	__raw_spin_lock(lock);
- }
- 
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- 	.spin_is_locked = __ticket_spin_is_locked,
- 	.spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.11/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.32.11/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/pci-calgary_64.c	2010-04-04 20:46:41.521777445 -0400
-@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
- 	free_pages((unsigned long)vaddr, get_order(size));
- }
- 
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- 	.alloc_coherent = calgary_alloc_coherent,
- 	.free_coherent = calgary_free_coherent,
- 	.map_sg = calgary_map_sg,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/pci-dma.c linux-2.6.32.11/arch/x86/kernel/pci-dma.c
---- linux-2.6.32.11/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/pci-dma.c	2010-04-04 20:46:41.521777445 -0400
-@@ -14,7 +14,7 @@
- 
- static int forbid_dac __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
- 
- int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- #ifdef CONFIG_PCI
- 	if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.32.11/arch/x86/kernel/pci-gart_64.c linux-2.6.32.11/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.32.11/arch/x86/kernel/pci-gart_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/pci-gart_64.c	2010-04-04 20:46:41.521777445 -0400
-@@ -679,7 +679,7 @@ static __init int init_k8_gatt(struct ag
- 	return -1;
- }
- 
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- 	.map_sg				= gart_map_sg,
- 	.unmap_sg			= gart_unmap_sg,
- 	.map_page			= gart_map_page,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/pci-nommu.c linux-2.6.32.11/arch/x86/kernel/pci-nommu.c
---- linux-2.6.32.11/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/pci-nommu.c	2010-04-04 20:46:41.521777445 -0400
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
- 	flush_write_buffers();
- }
- 
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- 	.alloc_coherent		= dma_generic_alloc_coherent,
- 	.free_coherent		= nommu_free_coherent,
- 	.map_sg			= nommu_map_sg,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.11/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.32.11/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/pci-swiotlb.c	2010-04-04 20:46:41.521777445 -0400
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
- 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
- 
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- 	.mapping_error = swiotlb_dma_mapping_error,
- 	.alloc_coherent = x86_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/process_32.c linux-2.6.32.11/arch/x86/kernel/process_32.c
---- linux-2.6.32.11/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/process_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- 	return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX	return tsk->thread.eip;
- }
- 
- #ifndef CONFIG_SMP
-@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
- 	unsigned short ss, gs;
- 	const char *board;
- 
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		sp = regs->sp;
- 		ss = regs->ss & 0xffff;
- 		gs = get_user_gs(regs);
-@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
- 	regs.bx = (unsigned long) fn;
- 	regs.dx = (unsigned long) arg;
- 
--	regs.ds = __USER_DS;
--	regs.es = __USER_DS;
-+	regs.ds = __KERNEL_DS;
-+	regs.es = __KERNEL_DS;
- 	regs.fs = __KERNEL_PERCPU;
- 	regs.gs = __KERNEL_STACK_CANARY;
- 	regs.orig_ax = -1;
-@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
- 	struct task_struct *tsk;
- 	int err;
- 
--	childregs = task_pt_regs(p);
-+	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- 	*childregs = *regs;
- 	childregs->ax = 0;
- 	childregs->sp = sp;
-@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
- 	 * Set a new TLS for the child thread?
- 	 */
- 	if (clone_flags & CLONE_SETTLS)
-+//XXX needs set_fs()?
- 		err = do_set_thread_area(p, -1,
- 			(struct user_desc __user *)childregs->si, 0);
- 
-@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread,
- 				 *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	bool preload_fpu;
- 
- 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
- 	 */
- 	lazy_save_gs(prev->gs);
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
-+		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
-+#endif
-+
- 	/*
- 	 * Load the per-thread Thread-Local Storage descriptor.
- 	 */
-@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
- 	return 0;
- }
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+asmlinkage void pax_randomize_kstack(void)
-+{
-+	struct thread_struct *thread = &current->thread;
-+	unsigned long time;
-+
-+	if (!randomize_va_space)
-+		return;
-+
-+	rdtscl(time);
-+
-+	/* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+	time &= 0x1EUL;
-+	time <<= 2;
-+#else
-+	time &= 0xFUL;
-+	time <<= 3;
-+#endif
-+
-+	thread->sp0 ^= time;
-+	load_sp0(init_tss + smp_processor_id(), thread);
-+}
-+#endif
-diff -urNp linux-2.6.32.11/arch/x86/kernel/process_64.c linux-2.6.32.11/arch/x86/kernel/process_64.c
---- linux-2.6.32.11/arch/x86/kernel/process_64.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/process_64.c	2010-04-04 20:46:41.521777445 -0400
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- 	/* idle loop has pid 0 */
--	if (current->pid)
-+	if (task_pid_nr(current))
- 		return;
- 	__exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
- 	if (!board)
- 		board = "";
- 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version, board);
-@@ -381,7 +381,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread;
- 	struct thread_struct *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	unsigned fsindex, gsindex;
- 	bool preload_fpu;
- 
-@@ -561,12 +561,11 @@ unsigned long get_wchan(struct task_stru
- 	if (!p || p == current || p->state == TASK_RUNNING)
- 		return 0;
- 	stack = (unsigned long)task_stack_page(p);
--	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
- 		return 0;
- 	fp = *(u64 *)(p->thread.sp);
- 	do {
--		if (fp < (unsigned long)stack ||
--		    fp >= (unsigned long)stack+THREAD_SIZE)
-+		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
- 			return 0;
- 		ip = *(u64 *)(fp+8);
- 		if (!in_sched_functions(ip))
-diff -urNp linux-2.6.32.11/arch/x86/kernel/process.c linux-2.6.32.11/arch/x86/kernel/process.c
---- linux-2.6.32.11/arch/x86/kernel/process.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/process.c	2010-04-04 20:46:41.521777445 -0400
-@@ -73,7 +73,7 @@ void exit_thread(void)
- 	unsigned long *bp = t->io_bitmap_ptr;
- 
- 	if (bp) {
--		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+		struct tss_struct *tss = init_tss + get_cpu();
- 
- 		t->io_bitmap_ptr = NULL;
- 		clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +93,9 @@ void flush_thread(void)
- 
- 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
- 
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
-+	loadsegment(gs, 0);
-+#endif
- 	tsk->thread.debugreg0 = 0;
- 	tsk->thread.debugreg1 = 0;
- 	tsk->thread.debugreg2 = 0;
-@@ -600,17 +603,3 @@ static int __init idle_setup(char *str)
- 	return 0;
- }
- early_param("idle", idle_setup);
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() % 8192;
--	return sp & ~0xf;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long range_end = mm->brk + 0x02000000;
--	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
--}
--
-diff -urNp linux-2.6.32.11/arch/x86/kernel/ptrace.c linux-2.6.32.11/arch/x86/kernel/ptrace.c
---- linux-2.6.32.11/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/ptrace.c	2010-04-04 20:46:41.525738446 -0400
-@@ -925,7 +925,7 @@ static const struct user_regset_view use
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- 	int ret;
--	unsigned long __user *datap = (unsigned long __user *)data;
-+	unsigned long __user *datap = (__force unsigned long __user *)data;
- 
- 	switch (request) {
- 	/* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_get_thread_area(child, addr,
--					 (struct user_desc __user *) data);
-+					 (__force struct user_desc __user *) data);
- 		break;
- 
- 	case PTRACE_SET_THREAD_AREA:
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_set_thread_area(child, addr,
--					 (struct user_desc __user *) data, 0);
-+					 (__force struct user_desc __user *) data, 0);
- 		break;
- #endif
- 
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
- #ifdef CONFIG_X86_PTRACE_BTS
- 	case PTRACE_BTS_CONFIG:
- 		ret = ptrace_bts_config
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_STATUS:
- 		ret = ptrace_bts_status
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_GET:
- 		ret = ptrace_bts_read_record
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- 
- 	case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_DRAIN:
- 		ret = ptrace_bts_drain
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- #endif /* CONFIG_X86_PTRACE_BTS */
- 
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
- 	info.si_code = si_code;
- 
- 	/* User-mode ip? */
--	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
- 
- 	/* Send us the fake SIGTRAP */
- 	force_sig_info(SIGTRAP, &info, tsk);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/reboot.c linux-2.6.32.11/arch/x86/kernel/reboot.c
---- linux-2.6.32.11/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/reboot.c	2010-04-04 20:46:41.525738446 -0400
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
- 
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
- 
-@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
- 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static int __init reboot_init(void)
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
-    controller to pulse the CPU reset line, which is more thorough, but
-    doesn't work with at least one type of 486 motherboard.  It is easy
-    to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
--	0x0000000000000000ULL,	/* Null descriptor */
--	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
--	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
-+	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
-+	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
-+	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
- };
- 
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
-  * specified by the code and length parameters.
-  * We assume that length will aways be less that 100!
-  */
--void machine_real_restart(const unsigned char *code, int length)
-+void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- 	local_irq_disable();
- 
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
- 	/* Remap the kernel at virtual address zero, as well as offset zero
- 	   from the kernel segment.  This assumes the kernel segment starts at
- 	   virtual address PAGE_OFFSET. */
--	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
--		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
- 	   boot)".  This seems like a fairly standard thing that gets set by
- 	   REBOOT.COM programs, and the previous reset routine did this
- 	   too. */
--	*((unsigned short *)0x472) = reboot_mode;
-+	*(unsigned short *)(__va(0x472)) = reboot_mode;
- 
- 	/* For the switch to real mode, copy some code to low memory.  It has
- 	   to be in the first 64k because it is running in 16-bit mode, and it
- 	   has to have the same physical and virtual address, because it turns
- 	   off paging.  Copy it near the end of the first page, out of the way
- 	   of BIOS variables. */
--	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
--		real_mode_switch, sizeof (real_mode_switch));
--	memcpy((void *)(0x1000 - 100), code, length);
-+	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+	memcpy(__va(0x1000 - 100), code, length);
- 
- 	/* Set up the IDT for real mode. */
- 	load_idt(&real_mode_idt);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/setup.c linux-2.6.32.11/arch/x86/kernel/setup.c
---- linux-2.6.32.11/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/setup.c	2010-04-04 20:46:41.525738446 -0400
-@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
- 
- 	if (!boot_params.hdr.root_flags)
- 		root_mountflags &= ~MS_RDONLY;
--	init_mm.start_code = (unsigned long) _text;
--	init_mm.end_code = (unsigned long) _etext;
-+	init_mm.start_code = ktla_ktva((unsigned long) _text);
-+	init_mm.end_code = ktla_ktva((unsigned long) _etext);
- 	init_mm.end_data = (unsigned long) _edata;
- 	init_mm.brk = _brk_end;
- 
--	code_resource.start = virt_to_phys(_text);
--	code_resource.end = virt_to_phys(_etext)-1;
--	data_resource.start = virt_to_phys(_etext);
-+	code_resource.start = virt_to_phys(ktla_ktva(_text));
-+	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+	data_resource.start = virt_to_phys(_sdata);
- 	data_resource.end = virt_to_phys(_edata)-1;
- 	bss_resource.start = virt_to_phys(&__bss_start);
- 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/setup_percpu.c linux-2.6.32.11/arch/x86/kernel/setup_percpu.c
---- linux-2.6.32.11/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/setup_percpu.c	2010-04-04 20:46:41.525738446 -0400
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
- 
-+#ifdef CONFIG_SMP
- DEFINE_PER_CPU(int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
- 
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
- 
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
- 
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
- {
- #ifdef CONFIG_X86_32
- 	struct desc_struct gdt;
-+	unsigned long base = per_cpu_offset(cpu);
- 
--	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
--			0x2 | DESCTYPE_S, 0x8);
--	gdt.s = 1;
-+	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+			0x83 | DESCTYPE_S, 0xC);
- 	write_gdt_entry(get_cpu_gdt_table(cpu),
- 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- 	/* alrighty, percpu areas up and running */
- 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- 	for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		unsigned long canary = per_cpu(stack_canary, cpu);
-+#endif
-+#endif
- 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- 		per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		if (cpu == boot_cpu_id)
-+			per_cpu(stack_canary, cpu) = canary;
-+#endif
-+#endif
- 		/*
- 		 * Up to this point, the boot CPU has been using .data.init
- 		 * area.  Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.32.11/arch/x86/kernel/signal.c linux-2.6.32.11/arch/x86/kernel/signal.c
---- linux-2.6.32.11/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/signal.c	2010-04-04 20:46:41.525738446 -0400
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
- 	 * Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
- 	 */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- 	sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
- 	 * Return an always-bogus address instead so we will die with SIGSEGV.
- 	 */
- 	if (onsigstack && !likely(on_sig_stack(sp)))
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	/* save i387 state */
- 	if (used_math() && save_i387_xstate(*fpstate) < 0)
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
- 	}
- 
- 	if (current->mm->context.vdso)
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- 	else
--		restorer = &frame->retcode;
-+		restorer = (void __user *)&frame->retcode;
- 	if (ka->sa.sa_flags & SA_RESTORER)
- 		restorer = ka->sa.sa_restorer;
- 
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
- 	 * reasons and because gdb uses it as a signature to notice
- 	 * signal handler stack frames.
- 	 */
--	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
- 
- 	if (err)
- 		return -EFAULT;
-@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
- 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
- 
- 		/* Set up to return from userspace.  */
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- 		if (ka->sa.sa_flags & SA_RESTORER)
- 			restorer = ka->sa.sa_restorer;
- 		put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
- 		 * reasons and because gdb uses it as a signature to notice
- 		 * signal handler stack frames.
- 		 */
--		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- 	} put_user_catch(err);
- 
- 	if (err)
-@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
- 	 * X86_32: vm86 regs switched out by assembly code before reaching
- 	 * here, so testing against kernel CS suffices.
- 	 */
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		return;
- 
- 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/smpboot.c linux-2.6.32.11/arch/x86/kernel/smpboot.c
---- linux-2.6.32.11/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/smpboot.c	2010-04-04 20:58:33.225084964 -0400
-@@ -729,7 +729,11 @@ do_rest:
- 		(unsigned long)task_stack_page(c_idle.idle) -
- 		KERNEL_STACK_OFFSET + THREAD_SIZE;
- #endif
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+	pax_close_kernel();
-+
- 	initial_code = (unsigned long)start_secondary;
- 	stack_start.sp = (void *) c_idle.idle->thread.sp;
- 
-@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
- 
- 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_X86_32
- 	/* init low mem mapping */
- 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-diff -urNp linux-2.6.32.11/arch/x86/kernel/step.c linux-2.6.32.11/arch/x86/kernel/step.c
---- linux-2.6.32.11/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/step.c	2010-04-04 20:46:41.525738446 -0400
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
- 		struct desc_struct *desc;
- 		unsigned long base;
- 
--		seg &= ~7UL;
-+		seg >>= 3;
- 
- 		mutex_lock(&child->mm->context.lock);
--		if (unlikely((seg >> 3) >= child->mm->context.size))
-+		if (unlikely(seg >= child->mm->context.size))
- 			addr = -1L; /* bogus selector, access would fault */
- 		else {
- 			desc = child->mm->context.ldt + seg;
-@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
- 	unsigned char opcode[15];
- 	unsigned long addr = convert_ip_to_linear(child, regs);
- 
-+	if (addr == -EINVAL)
-+		return 0;
-+
- 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- 	for (i = 0; i < copied; i++) {
- 		switch (opcode[i]) {
-@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
- 
- #ifdef CONFIG_X86_64
- 		case 0x40 ... 0x4f:
--			if (regs->cs != __USER_CS)
-+			if ((regs->cs & 0xffff) != __USER_CS)
- 				/* 32-bit mode: register increment */
- 				return 0;
- 			/* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.32.11/arch/x86/kernel/syscall_table_32.S linux-2.6.32.11/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.32.11/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/syscall_table_32.S	2010-04-04 20:46:41.525738446 -0400
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
- 	.long sys_exit
-diff -urNp linux-2.6.32.11/arch/x86/kernel/sys_i386_32.c linux-2.6.32.11/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.32.11/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/sys_i386_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -24,6 +24,21 @@
- 
- #include <asm/syscalls.h>
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,205 @@ out:
- 	return err;
- }
- 
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+		unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+	struct mm_struct *mm = current->mm;
-+	struct vm_area_struct *vma;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+		    (!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+	if (len > mm->cached_hole_size) {
-+		start_addr = addr = mm->free_area_cache;
-+	} else {
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
-+	}
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+		start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+			start_addr = addr = mm->mmap_base;
-+		else
-+			addr = start_addr;
-+	}
-+#endif
-+
-+full_search:
-+	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+		/* At this point:  (!vma || addr < vma->vm_end). */
-+		if (pax_task_size - len < addr) {
-+			/*
-+			 * Start a new search - just in case we missed
-+			 * some holes.
-+			 */
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
-+				mm->cached_hole_size = 0;
-+				goto full_search;
-+			}
-+			return -ENOMEM;
-+		}
-+		if (!vma || addr + len <= vma->vm_start) {
-+			/*
-+			 * Remember the place where we stopped the search:
-+			 */
-+			mm->free_area_cache = addr + len;
-+			return addr;
-+		}
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+		addr = vma->vm_end;
-+		if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+			start_addr = addr = mm->mmap_base;
-+			mm->cached_hole_size = 0;
-+			goto full_search;
-+		}
-+	}
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+			  const unsigned long len, const unsigned long pgoff,
-+			  const unsigned long flags)
-+{
-+	struct vm_area_struct *vma;
-+	struct mm_struct *mm = current->mm;
-+	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	/* requested length too big for entire address space */
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+		goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	/* requesting a specific address */
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+				(!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+
-+	/* check if free_area_cache is useful for us */
-+	if (len <= mm->cached_hole_size) {
-+		mm->cached_hole_size = 0;
-+		mm->free_area_cache = mm->mmap_base;
-+	}
-+
-+	/* either no address requested or can't fit in requested address hole */
-+	addr = mm->free_area_cache;
-+
-+	/* make sure it can fit in the remaining address space */
-+	if (addr > len) {
-+		vma = find_vma(mm, addr-len);
-+		if (!vma || addr <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr-len);
-+	}
-+
-+	if (mm->mmap_base < len)
-+		goto bottomup;
-+
-+	addr = mm->mmap_base-len;
-+
-+	do {
-+		/*
-+		 * Lookup failure means no vma is above this address,
-+		 * else if new region fits below vma->vm_start,
-+		 * return with success:
-+		 */
-+		vma = find_vma(mm, addr);
-+		if (!vma || addr+len <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr);
-+
-+		/* remember the largest hole we saw so far */
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+
-+		/* try just below the current vma->vm_start */
-+		addr = vma->vm_start-len;
-+	} while (len < vma->vm_start);
-+
-+bottomup:
-+	/*
-+	 * A failed mmap() very likely causes application failure,
-+	 * so fall back to the bottom-up function here. This scenario
-+	 * can happen with large stack limits and large mmap()
-+	 * allocations.
-+	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
-+	mm->cached_hole_size = ~0UL;
-+	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+	/*
-+	 * Restore the topdown base:
-+	 */
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
-+	mm->cached_hole_size = ~0UL;
-+
-+	return addr;
-+}
- 
- struct sel_arg_struct {
- 	unsigned long n;
-@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- 	case SEMTIMEDOP:
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
--					(const struct timespec __user *)fifth);
-+					(__force const struct timespec __user *)fifth);
- 
- 	case SEMGET:
- 		return sys_semget(first, second, third);
-@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- 			if (ret)
- 				return ret;
--			return put_user(raddr, (ulong __user *) third);
-+			return put_user(raddr, (__force ulong __user *) third);
- 		}
- 		case 1:	/* iBCS2 emulator entry point */
- 			if (!segment_eq(get_fs(), get_ds()))
-diff -urNp linux-2.6.32.11/arch/x86/kernel/sys_x86_64.c linux-2.6.32.11/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.32.11/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/sys_x86_64.c	2010-04-04 20:46:41.525738446 -0400
-@@ -32,8 +32,8 @@ out:
- 	return error;
- }
- 
--static void find_start_end(unsigned long flags, unsigned long *begin,
--			   unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+			   unsigned long *begin, unsigned long *end)
- {
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- 		unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
- 				*begin = new_begin;
- 		}
- 	} else {
--		*begin = TASK_UNMAPPED_BASE;
-+		*begin = mm->mmap_base;
- 		*end = TASK_SIZE;
- 	}
- }
-@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
--	find_start_end(flags, &begin, &end);
-+	find_start_end(mm, flags, &begin, &end);
- 
- 	if (len > end)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- 		goto bottomup;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -198,13 +206,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/time.c linux-2.6.32.11/arch/x86/kernel/time.c
---- linux-2.6.32.11/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/time.c	2010-04-04 20:46:41.525738446 -0400
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
- 
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- 	unsigned long pc = instruction_pointer(regs);
- 
--	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+	if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
--		return *(unsigned long *)(regs->bp + sizeof(long));
-+		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- 		unsigned long *sp =
- 			(unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
- 		 * or above a saved flags. Eflags has bits 22-31 zero,
- 		 * kernel addresses don't.
- 		 */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		return ktla_ktva(sp[0]);
-+#else
- 		if (sp[0] >> 22)
- 			return sp[0];
- 		if (sp[1] >> 22)
- 			return sp[1];
- #endif
-+
-+#endif
- 	}
- 	return pc;
- }
-diff -urNp linux-2.6.32.11/arch/x86/kernel/tls.c linux-2.6.32.11/arch/x86/kernel/tls.c
---- linux-2.6.32.11/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/tls.c	2010-04-04 20:46:41.525738446 -0400
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
- 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+		return -EINVAL;
-+#endif
-+
- 	set_tls_desc(p, idx, &info, 1);
- 
- 	return 0;
-diff -urNp linux-2.6.32.11/arch/x86/kernel/trampoline_32.S linux-2.6.32.11/arch/x86/kernel/trampoline_32.S
---- linux-2.6.32.11/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/trampoline_32.S	2010-04-04 20:46:41.525738446 -0400
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- 	inc	%ax		# protected mode (PE) bit
- 	lmsw	%ax		# into protected mode
- 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
--	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
- 
- 	# These need to be in the same 64K segment as the above;
- 	# hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.32.11/arch/x86/kernel/traps.c linux-2.6.32.11/arch/x86/kernel/traps.c
---- linux-2.6.32.11/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/traps.c	2010-04-04 20:46:41.525738446 -0400
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
- 
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
- 
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		die(str, regs, err);
- }
- #endif
- 
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- 	long error_code, siginfo_t *info)
- {
- 	struct task_struct *tsk = current;
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		/*
- 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- 		 * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
- 	}
- #endif
- 
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto kernel_trap;
- 
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- 	    printk_ratelimit()) {
- 		printk(KERN_INFO
- 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
--		       tsk->comm, tsk->pid, str,
-+		       tsk->comm, task_pid_nr(tsk), str,
- 		       regs->ip, regs->sp, error_code);
- 		print_vma_addr(" in ", regs->ip);
- 		printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- 	if (!fixup_exception(regs)) {
- 		tsk->thread.error_code = error_code;
- 		tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+			str = "PAX: suspicious stack segment fault";
-+#endif
-+
- 		die(str, regs, error_code);
- 	}
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (trapnr == 4)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	return;
- 
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
- 	conditional_sti(regs);
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto gp_in_vm86;
- #endif
- 
- 	tsk = current;
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto gp_in_kernel;
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+		struct mm_struct *mm = tsk->mm;
-+		unsigned long limit;
-+
-+		down_write(&mm->mmap_sem);
-+		limit = mm->context.user_cs_limit;
-+		if (limit < TASK_SIZE) {
-+			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+			up_write(&mm->mmap_sem);
-+			return;
-+		}
-+		up_write(&mm->mmap_sem);
-+	}
-+#endif
-+
- 	tsk->thread.error_code = error_code;
- 	tsk->thread.trap_no = 13;
- 
-@@ -305,6 +327,13 @@ gp_in_kernel:
- 	if (notify_die(DIE_GPF, "general protection fault", regs,
- 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
- 		return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+		die("PAX: suspicious general protection fault", regs, error_code);
-+	else
-+#endif
-+
- 	die("general protection fault", regs, error_code);
- }
- 
-@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
- 	}
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto debug_vm86;
- #endif
- 
-@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
- 	 * kernel space (but re-enable TF when returning to user mode).
- 	 */
- 	if (condition & DR_STEP) {
--		if (!user_mode(regs))
-+		if (!user_mode_novm(regs))
- 			goto clear_TF_reenable;
- 	}
- 
-@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
- 	 * Handle strange cache flush from user space exception
- 	 * in all other cases.  This is undocumented behaviour.
- 	 */
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- 		return;
- 	}
-diff -urNp linux-2.6.32.11/arch/x86/kernel/tsc.c linux-2.6.32.11/arch/x86/kernel/tsc.c
---- linux-2.6.32.11/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/tsc.c	2010-04-04 20:46:41.525738446 -0400
-@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
- 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static void __init check_system_tsc_reliable(void)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/vm86_32.c linux-2.6.32.11/arch/x86/kernel/vm86_32.c
---- linux-2.6.32.11/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/vm86_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
- 
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
- 		do_exit(SIGSEGV);
- 	}
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	current->thread.sp0 = current->thread.saved_sp0;
- 	current->thread.sysenter_cs = __KERNEL_CS;
- 	load_sp0(tss, &current->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- 	struct task_struct *tsk;
- 	int tmp, ret = -EPERM;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	if (tsk->thread.saved_sp0)
- 		goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- 	int tmp, ret;
- 	struct vm86plus_struct __user *v86;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		ret = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	switch (regs->bx) {
- 	case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
- 	tsk->thread.saved_fs = info->regs32->fs;
- 	tsk->thread.saved_gs = get_user_gs(info->regs32);
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- 	if (cpu_has_sep)
- 		tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
- 		goto cannot_handle;
- 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- 		goto cannot_handle;
--	intr_ptr = (unsigned long __user *) (i << 2);
-+	intr_ptr = (__force unsigned long __user *) (i << 2);
- 	if (get_user(segoffs, intr_ptr))
- 		goto cannot_handle;
- 	if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.32.11/arch/x86/kernel/vmi_32.c linux-2.6.32.11/arch/x86/kernel/vmi_32.c
---- linux-2.6.32.11/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/vmi_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
- 
- #define call_vrom_func(rom,func) \
--   (((VROMFUNC *)(rom->func))())
-+   (((VROMFUNC *)(ktva_ktla(rom.func)))())
- 
- #define call_vrom_long_func(rom,func,arg) \
--   (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+	__reloc;\
-+})
- 
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- 	void (*set_initial_ap_state)(int, int);
- 	void (*halt)(void);
-   	void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} vmi_ops __read_only;
- 
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
- 
- /*
-  * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- 				unsigned long ip, unsigned long dest)
- {
--        *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+	*(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
- 
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
- {
- 	u64 reloc;
- 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
- 	switch(rel->type) {
- 		case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
- 
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
- 
- static void vmi_pmd_clear(pmd_t *pmd)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
- 	ap.ss = __KERNEL_DS;
- 	ap.esp = (unsigned long) start_esp;
- 
--	ap.ds = __USER_DS;
--	ap.es = __USER_DS;
-+	ap.ds = __KERNEL_DS;
-+	ap.es = __KERNEL_DS;
- 	ap.fs = __KERNEL_PERCPU;
- 	ap.gs = __KERNEL_STACK_CANARY;
- 
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- 	paravirt_leave_lazy_mmu();
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+	return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+	return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- 	struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
- 		return 0;
- 	if (rom->vrom_signature != VMI_SIGNATURE)
- 		return 0;
-+	if (rom->rom_length * 512 > sizeof(*rom)) {
-+		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+		return 0;
-+	}
- 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
- 		struct vrom_header *romstart;
- 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
- 		if (check_vmi_rom(romstart)) {
--			vmi_rom = romstart;
-+			vmi_rom = *romstart;
- 			return 1;
- 		}
- 	}
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
- 
- 	para_fill(pv_irq_ops.safe_halt, Halt);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- 	/*
- 	 * Alternative instruction rewriting doesn't happen soon enough
- 	 * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
- 
- void __init vmi_init(void)
- {
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		probe_vmi_rom();
- 	else
--		check_vmi_rom(vmi_rom);
-+		check_vmi_rom(&vmi_rom);
- 
- 	/* In case probing for or validating the ROM failed, basil */
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
--	reserve_top_address(-vmi_rom->virtual_top);
-+	reserve_top_address(-vmi_rom.virtual_top);
- 
- #ifdef CONFIG_X86_IO_APIC
- 	/* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- 	unsigned long flags;
- 
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.11/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.32.11/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/vmlinux.lds.S	2010-04-04 20:46:41.529538490 -0400
-@@ -26,6 +26,22 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#undef PMD_SIZE
-+#undef PMD_SHIFT
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+#define PMD_SHIFT 21
-+#else
-+#define PMD_SHIFT 22
-+#endif
-+#define PMD_SIZE (1 << PMD_SHIFT)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET	0
-+#endif
- 
- #undef i386     /* in case the preprocessor is a 32bit one */
- 
-@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
- 
-+jiffies = jiffies_64;
-+
- PHDRS {
- 	text PT_LOAD FLAGS(5);          /* R_E */
--	data PT_LOAD FLAGS(7);          /* RWE */
-+#ifdef CONFIG_XEN
-+	rodata PT_LOAD FLAGS(5);        /* R_E */
-+#else
-+	rodata PT_LOAD FLAGS(4);        /* R__ */
-+#endif
-+#ifdef CONFIG_X86_32
-+	module PT_LOAD FLAGS(5);        /* R_E */
-+#endif
-+	data PT_LOAD FLAGS(6);          /* RW_ */
- #ifdef CONFIG_X86_64
- 	user PT_LOAD FLAGS(5);          /* R_E */
-+#endif
-+	init.begin PT_LOAD FLAGS(6);    /* RW_ */
- #ifdef CONFIG_SMP
- 	percpu PT_LOAD FLAGS(6);        /* RW_ */
- #endif
-+	text.init PT_LOAD FLAGS(5);     /* R_E */
-+	text.exit PT_LOAD FLAGS(5);     /* R_E */
- 	init PT_LOAD FLAGS(7);          /* RWE */
--#endif
- 	note PT_NOTE FLAGS(0);          /* ___ */
- }
- 
- SECTIONS
- {
- #ifdef CONFIG_X86_32
--        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
--        phys_startup_32 = startup_32 - LOAD_OFFSET;
-+	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
--        . = __START_KERNEL;
--        phys_startup_64 = startup_64 - LOAD_OFFSET;
-+	. = __START_KERNEL;
- #endif
- 
- 	/* Text and read-only data */
--	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
--		_text = .;
-+	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- 		/* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+		_text = .;
- 		HEAD_TEXT
- #ifdef CONFIG_X86_32
- 		. = ALIGN(PAGE_SIZE);
-@@ -82,28 +113,64 @@ SECTIONS
- 		IRQENTRY_TEXT
- 		*(.fixup)
- 		*(.gnu.warning)
--		/* End of text section */
--		_etext = .;
- 	} :text = 0x9090
- 
--	NOTES :text :note
-+	. += __KERNEL_TEXT_OFFSET;
-+
-+	. = ALIGN(PAGE_SIZE);
-+	NOTES :rodata :note
- 
--	EXCEPTION_TABLE(16) :text = 0x9090
-+	EXCEPTION_TABLE(16) :rodata
- 
- 	RO_DATA(PAGE_SIZE)
- 
-+#ifdef CONFIG_X86_32
-+	. = ALIGN(PAGE_SIZE);
-+	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+		*(.idt)
-+		. = ALIGN(PAGE_SIZE);
-+		*(.empty_zero_page)
-+		*(.swapper_pg_pmd)
-+		*(.swapper_pg_dir)
-+	}
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+		*(.vmi.rom)
-+	} :module
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+		MODULES_EXEC_VADDR = .;
-+		BYTE(0)
-+		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+		. = ALIGN(PMD_SIZE);
-+		MODULES_EXEC_END = . - 1;
-+#endif
-+
-+	} :module
-+#endif
-+
- 	/* Data */
- 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
-+		/* End of text section */
-+		_etext = . - __KERNEL_TEXT_OFFSET;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	. = ALIGN(PMD_SIZE);
-+#else
-+	. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		/* Start of data section */
- 		_sdata = .;
- 
- 		/* init_task */
- 		INIT_TASK_DATA(THREAD_SIZE)
- 
--#ifdef CONFIG_X86_32
--		/* 32 bit has nosave before _edata */
- 		NOSAVE_DATA
--#endif
- 
- 		PAGE_ALIGNED_DATA(PAGE_SIZE)
- 
-@@ -166,12 +233,6 @@ SECTIONS
- 	}
- 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
- 
--	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
--	.jiffies : AT(VLOAD(.jiffies)) {
--		*(.jiffies)
--	}
--	jiffies = VVIRT(.jiffies);
--
- 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- 		*(.vsyscall_3)
- 	}
-@@ -187,12 +248,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
- 
- 	/* Init code and data - will be freed after init */
--	. = ALIGN(PAGE_SIZE);
- 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+		BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		. = ALIGN(PMD_SIZE);
-+#else
-+		. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		__init_begin = .; /* paired with __init_end */
--	}
-+	} :init.begin
- 
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- 	/*
- 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
- 	 * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +269,27 @@ SECTIONS
- 	PERCPU_VADDR(0, :percpu)
- #endif
- 
--	INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
--	:init
--#endif
-+	. = ALIGN(PAGE_SIZE);
-+	init_begin = .;
-+	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+		VMLINUX_SYMBOL(_sinittext) = .;
-+		INIT_TEXT
-+		VMLINUX_SYMBOL(_einittext) = .;
-+		. = ALIGN(PAGE_SIZE);
-+	} :text.init
-+
-+	/*
-+	 * .exit.text is discard at runtime, not link time, to deal with
-+	 *  references from .altinstructions and .eh_frame
-+	 */
-+	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-+		EXIT_TEXT
-+		. = ALIGN(16);
-+	} :text.exit
-+	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
- 
--	INIT_DATA_SECTION(16)
-+	. = ALIGN(PAGE_SIZE);
-+	INIT_DATA_SECTION(16) :init
- 
- 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- 		__x86_cpu_dev_start = .;
-@@ -232,19 +315,11 @@ SECTIONS
- 		*(.altinstr_replacement)
- 	}
- 
--	/*
--	 * .exit.text is discard at runtime, not link time, to deal with
--	 *  references from .altinstructions and .eh_frame
--	 */
--	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
--		EXIT_TEXT
--	}
--
- 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- 		EXIT_DATA
- 	}
- 
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- 	PERCPU(PAGE_SIZE)
- #endif
- 
-@@ -267,12 +342,6 @@ SECTIONS
- 		. = ALIGN(PAGE_SIZE);
- 	}
- 
--#ifdef CONFIG_X86_64
--	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
--		NOSAVE_DATA
--	}
--#endif
--
- 	/* BSS */
- 	. = ALIGN(PAGE_SIZE);
- 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +357,7 @@ SECTIONS
- 		__brk_base = .;
- 		. += 64 * 1024;		/* 64k alignment slop space */
- 		*(.brk_reservation)	/* areas brk users have reserved */
-+		. = ALIGN(PMD_SIZE);
- 		__brk_limit = .;
- 	}
- 
-@@ -316,13 +386,12 @@ SECTIONS
-  * for the boot processor.
-  */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
- 
- /*
-  * Build-time check on the image size:
-  */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.11/arch/x86/kernel/vsyscall_64.c linux-2.6.32.11/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.32.11/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/vsyscall_64.c	2010-04-04 20:46:41.529538490 -0400
-@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
- 
- 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- 	/* copy vsyscall data */
-+	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- 	vsyscall_gtod_data.clock.vread = clock->vread;
- 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- 	vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
- 	   We do this here because otherwise user space would do it on
- 	   its own in a likely inferior way (no access to jiffies).
- 	   If you don't like it pass NULL. */
--	if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+	if (tcache && tcache->blob[0] == (j = jiffies)) {
- 		p = tcache->blob[1];
- 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- 		/* Load per CPU data from RDTSCP */
-@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
- 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
- 	  .mode = 0644,
- 	  .proc_handler = proc_dointvec },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table kernel_root_table2[] = {
- 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
- 	  .child = kernel_table2 },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.11/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.11/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.32.11/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/x8664_ksyms_64.c	2010-04-04 20:46:41.529538490 -0400
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
- 
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
- 
- EXPORT_SYMBOL(copy_page);
-diff -urNp linux-2.6.32.11/arch/x86/kernel/xsave.c linux-2.6.32.11/arch/x86/kernel/xsave.c
---- linux-2.6.32.11/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kernel/xsave.c	2010-04-04 20:46:41.529538490 -0400
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
- 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
- 		return -1;
- 
--	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- 					    fx_sw_user->extended_size -
- 					    FP_XSTATE_MAGIC2_SIZE));
- 	/*
-@@ -196,7 +196,7 @@ fx_only:
- 	 * the other extended state.
- 	 */
- 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
--	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
- 
- /*
-@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
- 	if (task_thread_info(tsk)->status & TS_XSAVE)
- 		err = restore_user_xstate(buf);
- 	else
--		err = fxrstor_checking((__force struct i387_fxsave_struct *)
-+		err = fxrstor_checking((struct i387_fxsave_struct __user *)
- 				       buf);
- 	if (unlikely(err)) {
- 		/*
-diff -urNp linux-2.6.32.11/arch/x86/kvm/emulate.c linux-2.6.32.11/arch/x86/kvm/emulate.c
---- linux-2.6.32.11/arch/x86/kvm/emulate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kvm/emulate.c	2010-04-04 20:46:41.529538490 -0400
-@@ -404,6 +404,7 @@ static u32 group2_table[] = {
- 
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
- 	do {								\
-+		unsigned long _tmp;					\
- 		__asm__ __volatile__ (					\
- 			_PRE_EFLAGS("0", "4", "2")			\
- 			_op _suffix " %"_x"3,%1; "			\
-@@ -417,8 +418,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								\
--		unsigned long _tmp;					\
--									\
- 		switch ((_dst).bytes) {					\
- 		case 2:							\
- 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -434,7 +433,6 @@ static u32 group2_table[] = {
- 
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								     \
--		unsigned long _tmp;					     \
- 		switch ((_dst).bytes) {				             \
- 		case 1:							     \
- 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
-diff -urNp linux-2.6.32.11/arch/x86/kvm/svm.c linux-2.6.32.11/arch/x86/kvm/svm.c
---- linux-2.6.32.11/arch/x86/kvm/svm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kvm/svm.c	2010-04-04 20:46:41.529538490 -0400
-@@ -2389,9 +2389,12 @@ static int handle_exit(struct kvm_run *k
- static void reload_tss(struct kvm_vcpu *vcpu)
- {
- 	int cpu = raw_smp_processor_id();
--
- 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+	pax_open_kernel();
- 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -2839,7 +2842,7 @@ static bool svm_gb_page_enable(void)
- 	return true;
- }
- 
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- 	.cpu_has_kvm_support = has_svm,
- 	.disabled_by_bios = is_disabled,
- 	.hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.32.11/arch/x86/kvm/vmx.c linux-2.6.32.11/arch/x86/kvm/vmx.c
---- linux-2.6.32.11/arch/x86/kvm/vmx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kvm/vmx.c	2010-04-04 20:46:41.529538490 -0400
-@@ -566,7 +566,11 @@ static void reload_tss(void)
- 
- 	kvm_get_gdt(&gdt);
- 	descs = (void *)gdt.base;
-+
-+	pax_open_kernel();
- 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -1388,8 +1392,11 @@ static __init int hardware_setup(void)
- 	if (!cpu_has_vmx_flexpriority())
- 		flexpriority_enabled = 0;
- 
--	if (!cpu_has_vmx_tpr_shadow())
--		kvm_x86_ops->update_cr8_intercept = NULL;
-+	if (!cpu_has_vmx_tpr_shadow()) {
-+		pax_open_kernel();
-+		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+		pax_close_kernel();
-+	}
- 
- 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
- 		kvm_disable_largepages();
-@@ -2339,7 +2346,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
- 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
- 
- 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
--	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3682,6 +3689,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		"jmp .Lkvm_vmx_return \n\t"
- 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- 		".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+		".Lkvm_vmx_return2: "
-+#endif
-+
- 		/* Save guest registers, load host registers, keep flags */
- 		"xchg %0,     (%%"R"sp) \n\t"
- 		"mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3728,6 +3741,11 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- 	      : "cc", "memory"
- 		, R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
-@@ -3746,7 +3764,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 	if (vmx->rmode.irq.pending)
- 		fixup_rmode_irq(vmx);
- 
--	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
- 	vmx->launched = 1;
- 
- 	vmx_complete_interrupts(vmx);
-@@ -3921,7 +3939,7 @@ static bool vmx_gb_page_enable(void)
- 	return false;
- }
- 
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- 	.cpu_has_kvm_support = cpu_has_kvm_support,
- 	.disabled_by_bios = vmx_disabled_by_bios,
- 	.hardware_setup = hardware_setup,
-diff -urNp linux-2.6.32.11/arch/x86/kvm/x86.c linux-2.6.32.11/arch/x86/kvm/x86.c
---- linux-2.6.32.11/arch/x86/kvm/x86.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/kvm/x86.c	2010-04-04 20:46:41.529538490 -0400
-@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- 				    struct kvm_cpuid_entry2 __user *entries);
- 
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
- 
- int ignore_msrs = 0;
- module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
- 
- struct kvm_stats_debugfs_item debugfs_entries[] = {
--	{ "pf_fixed", VCPU_STAT(pf_fixed) },
--	{ "pf_guest", VCPU_STAT(pf_guest) },
--	{ "tlb_flush", VCPU_STAT(tlb_flush) },
--	{ "invlpg", VCPU_STAT(invlpg) },
--	{ "exits", VCPU_STAT(exits) },
--	{ "io_exits", VCPU_STAT(io_exits) },
--	{ "mmio_exits", VCPU_STAT(mmio_exits) },
--	{ "signal_exits", VCPU_STAT(signal_exits) },
--	{ "irq_window", VCPU_STAT(irq_window_exits) },
--	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
--	{ "halt_exits", VCPU_STAT(halt_exits) },
--	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
--	{ "hypercalls", VCPU_STAT(hypercalls) },
--	{ "request_irq", VCPU_STAT(request_irq_exits) },
--	{ "irq_exits", VCPU_STAT(irq_exits) },
--	{ "host_state_reload", VCPU_STAT(host_state_reload) },
--	{ "efer_reload", VCPU_STAT(efer_reload) },
--	{ "fpu_reload", VCPU_STAT(fpu_reload) },
--	{ "insn_emulation", VCPU_STAT(insn_emulation) },
--	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
--	{ "irq_injections", VCPU_STAT(irq_injections) },
--	{ "nmi_injections", VCPU_STAT(nmi_injections) },
--	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
--	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
--	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
--	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
--	{ "mmu_flooded", VM_STAT(mmu_flooded) },
--	{ "mmu_recycled", VM_STAT(mmu_recycled) },
--	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
--	{ "mmu_unsync", VM_STAT(mmu_unsync) },
--	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
--	{ "largepages", VM_STAT(lpages) },
-+	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
-+	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
-+	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
-+	{ "invlpg", VCPU_STAT(invlpg), NULL },
-+	{ "exits", VCPU_STAT(exits), NULL },
-+	{ "io_exits", VCPU_STAT(io_exits), NULL },
-+	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
-+	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
-+	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
-+	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
-+	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
-+	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
-+	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
-+	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
-+	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
-+	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
-+	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
-+	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
-+	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
-+	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
-+	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
-+	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
-+	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
-+	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
-+	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
-+	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
-+	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
-+	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
-+	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
-+	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
-+	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
-+	{ "largepages", VM_STAT(lpages), NULL },
- 	{ NULL }
- };
- 
-@@ -1658,7 +1658,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- 				    struct kvm_interrupt *irq)
- {
--	if (irq->irq < 0 || irq->irq >= 256)
-+	if (irq->irq >= 256)
- 		return -EINVAL;
- 	if (irqchip_in_kernel(vcpu->kvm))
- 		return -ENXIO;
-@@ -3170,10 +3170,10 @@ static struct notifier_block kvmclock_cp
-         .notifier_call  = kvmclock_cpufreq_notifier
- };
- 
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- 	int r, cpu;
--	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
- 
- 	if (kvm_x86_ops) {
- 		printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.32.11/arch/x86/lib/checksum_32.S linux-2.6.32.11/arch/x86/lib/checksum_32.S
---- linux-2.6.32.11/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/checksum_32.S	2010-04-04 20:46:41.529538490 -0400
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--				
-+#include <asm/segment.h>
-+
- /*
-  * computes a partial checksum, e.g. for TCP/UDP fragments
-  */
-@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
- 
- #define ARGBASE 16		
- #define FP		12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	subl  $4,%esp	
- 	CFI_ADJUST_CFA_OFFSET 4
- 	pushl %edi
-@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
- 	jmp 4f
- SRC(1:	movw (%esi), %bx	)
- 	addl $2, %esi
--DST(	movw %bx, (%edi)	)
-+DST(	movw %bx, %es:(%edi)	)
- 	addl $2, %edi
- 	addw %bx, %ax	
- 	adcl $0, %eax
-@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
- SRC(1:	movl (%esi), %ebx	)
- SRC(	movl 4(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 4(%edi)	)
-+DST(	movl %edx, %es:4(%edi)	)
- 
- SRC(	movl 8(%esi), %ebx	)
- SRC(	movl 12(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 8(%edi)	)
-+DST(	movl %ebx, %es:8(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 12(%edi)	)
-+DST(	movl %edx, %es:12(%edi)	)
- 
- SRC(	movl 16(%esi), %ebx 	)
- SRC(	movl 20(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 16(%edi)	)
-+DST(	movl %ebx, %es:16(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 20(%edi)	)
-+DST(	movl %edx, %es:20(%edi)	)
- 
- SRC(	movl 24(%esi), %ebx	)
- SRC(	movl 28(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 24(%edi)	)
-+DST(	movl %ebx, %es:24(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 28(%edi)	)
-+DST(	movl %edx, %es:28(%edi)	)
- 
- 	lea 32(%esi), %esi
- 	lea 32(%edi), %edi
-@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
- 	shrl $2, %edx			# This clears CF
- SRC(3:	movl (%esi), %ebx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	lea 4(%esi), %esi
- 	lea 4(%edi), %edi
- 	dec %edx
-@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
- 	jb 5f
- SRC(	movw (%esi), %cx	)
- 	leal 2(%esi), %esi
--DST(	movw %cx, (%edi)	)
-+DST(	movw %cx, %es:(%edi)	)
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%ecx
- SRC(5:	movb (%esi), %cl	)
--DST(	movb %cl, (%edi)	)
-+DST(	movb %cl, %es:(%edi)	)
- 6:	addl %ecx, %eax
- 	adcl $0, %eax
- 7:
-@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
- 
- 6001:
- 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 
- 	# zero the complete destination - computing the rest
- 	# is too much work 
-@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
- 
- 6002:
- 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT,(%ebx)
-+	movl $-EFAULT,%ss:(%ebx)
- 	jmp 5000b
- 
- .previous
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE ebx
-@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
- 	CFI_ADJUST_CFA_OFFSET -4
- 	ret	
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 
- #else
- 
- /* Version for PentiumII/PPro */
- 
- #define ROUND1(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	addl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	; 
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ROUND(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	adcl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	;
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ARGBASE 12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
-@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
- 	subl %ebx, %edi  
- 	lea  -1(%esi),%edx
- 	andl $-32,%edx
--	lea 3f(%ebx,%ebx), %ebx
-+	lea 3f(%ebx,%ebx,2), %ebx
- 	testl %esi, %esi 
- 	jmp *%ebx
- 1:	addl $64,%esi
-@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
- 	jb 5f
- SRC(	movw (%esi), %dx         )
- 	leal 2(%esi), %esi
--DST(	movw %dx, (%edi)         )
-+DST(	movw %dx, %es:(%edi)     )
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%edx
- 5:
- SRC(	movb (%esi), %dl         )
--DST(	movb %dl, (%edi)         )
-+DST(	movb %dl, %es:(%edi)     )
- 6:	addl %edx, %eax
- 	adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	# zero the complete destination (computing the rest is too much work)
- 	movl ARGBASE+8(%esp),%edi	# dst
- 	movl ARGBASE+12(%esp),%ecx	# len
-@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
- 	rep; stosb
- 	jmp 7b
- 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	jmp  7b			
- .previous				
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %esi
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE esi
-@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
- 	CFI_RESTORE ebx
- 	ret
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 				
- #undef ROUND
- #undef ROUND1		
-diff -urNp linux-2.6.32.11/arch/x86/lib/clear_page_64.S linux-2.6.32.11/arch/x86/lib/clear_page_64.S
---- linux-2.6.32.11/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/clear_page_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -43,7 +43,7 @@ ENDPROC(clear_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.11/arch/x86/lib/copy_page_64.S linux-2.6.32.11/arch/x86/lib/copy_page_64.S
---- linux-2.6.32.11/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/copy_page_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -104,7 +104,7 @@ ENDPROC(copy_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.11/arch/x86/lib/copy_user_64.S linux-2.6.32.11/arch/x86/lib/copy_user_64.S
---- linux-2.6.32.11/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/copy_user_64.S	2010-04-04 20:58:33.225084964 -0400
-@@ -15,13 +15,14 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- 	.byte 0xe9	/* 32bit jump */
- 	.long \orig-1f	/* by default jump to orig */
- 1:
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 2:	.byte 0xe9			/* near jump with 32bit immediate */
- 	.long \alt-1b /* offset */   /* or alternatively to alt */
- 	.previous
-@@ -64,32 +65,6 @@
- #endif
- 	.endm
- 
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rdi,%rcx
--	addq %rdx,%rcx
--	jc bad_to_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_to_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rsi,%rcx
--	addq %rdx,%rcx
--	jc bad_from_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_from_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- 	CFI_STARTPROC
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
- 
- ENTRY(__copy_from_user_inatomic)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- 	CFI_ENDPROC
- ENDPROC(__copy_from_user_inatomic)
-@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
- ENTRY(bad_from_user)
- bad_from_user:
- 	CFI_STARTPROC
-+	testl %edx,%edx
-+	js bad_to_user
- 	movl %edx,%ecx
- 	xorl %eax,%eax
- 	rep
-diff -urNp linux-2.6.32.11/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.11/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.32.11/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/copy_user_nocache_64.S	2010-04-04 20:58:33.225084964 -0400
-@@ -14,6 +14,7 @@
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +51,15 @@
-  */
- ENTRY(__copy_user_nocache)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	cmpl $8,%edx
- 	jb 20f		/* less then 8 bytes, go to byte copy loop */
- 	ALIGN_DESTINATION
-diff -urNp linux-2.6.32.11/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.11/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.32.11/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/csum-wrappers_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
- 			len -= 2;
- 		}
- 	}
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	isum = csum_partial_copy_generic((__force const void *)src,
- 				dst, len, isum, errp, NULL);
- 	if (unlikely(*errp))
-@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
- 	}
- 
- 	*errp = 0;
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return csum_partial_copy_generic(src, (void __force *)dst,
- 					 len, isum, NULL, errp);
- }
-diff -urNp linux-2.6.32.11/arch/x86/lib/getuser.S linux-2.6.32.11/arch/x86/lib/getuser.S
---- linux-2.6.32.11/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/getuser.S	2010-04-04 20:58:33.225084964 -0400
-@@ -33,14 +33,38 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- 	.text
- ENTRY(__get_user_1)
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- 	CFI_STARTPROC
- 	add $1,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- 	CFI_STARTPROC
- 	add $3,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae	bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4:	movq -7(%_ASM_AX),%_ASM_DX
- 	xor %eax,%eax
- 	ret
-@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
- 
- bad_get_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %edx,%edx
- 	mov $(-EFAULT),%_ASM_AX
- 	ret
-diff -urNp linux-2.6.32.11/arch/x86/lib/memcpy_64.S linux-2.6.32.11/arch/x86/lib/memcpy_64.S
---- linux-2.6.32.11/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/memcpy_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
- 	 * It is also a lot simpler. Use this when possible:
- 	 */
- 
--	.section .altinstr_replacement, "ax"
-+	.section .altinstr_replacement, "a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.11/arch/x86/lib/memset_64.S linux-2.6.32.11/arch/x86/lib/memset_64.S
---- linux-2.6.32.11/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/memset_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -118,7 +118,7 @@ ENDPROC(__memset)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.11/arch/x86/lib/mmx_32.c linux-2.6.32.11/arch/x86/lib/mmx_32.c
---- linux-2.6.32.11/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/mmx_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
- {
- 	void *p;
- 	int i;
-+	unsigned long cr0;
- 
- 	if (unlikely(in_interrupt()))
- 		return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"		/* This set is 28 bytes */
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"		/* This set is 28 bytes */
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from));
-+			: "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for ( ; i > 5; i--) {
- 		__asm__ __volatile__ (
--		"1:  prefetch 320(%0)\n"
--		"2:  movq (%0), %%mm0\n"
--		"  movq 8(%0), %%mm1\n"
--		"  movq 16(%0), %%mm2\n"
--		"  movq 24(%0), %%mm3\n"
--		"  movq %%mm0, (%1)\n"
--		"  movq %%mm1, 8(%1)\n"
--		"  movq %%mm2, 16(%1)\n"
--		"  movq %%mm3, 24(%1)\n"
--		"  movq 32(%0), %%mm0\n"
--		"  movq 40(%0), %%mm1\n"
--		"  movq 48(%0), %%mm2\n"
--		"  movq 56(%0), %%mm3\n"
--		"  movq %%mm0, 32(%1)\n"
--		"  movq %%mm1, 40(%1)\n"
--		"  movq %%mm2, 48(%1)\n"
--		"  movq %%mm3, 56(%1)\n"
-+		"1:  prefetch 320(%1)\n"
-+		"2:  movq (%1), %%mm0\n"
-+		"  movq 8(%1), %%mm1\n"
-+		"  movq 16(%1), %%mm2\n"
-+		"  movq 24(%1), %%mm3\n"
-+		"  movq %%mm0, (%2)\n"
-+		"  movq %%mm1, 8(%2)\n"
-+		"  movq %%mm2, 16(%2)\n"
-+		"  movq %%mm3, 24(%2)\n"
-+		"  movq 32(%1), %%mm0\n"
-+		"  movq 40(%1), %%mm1\n"
-+		"  movq 48(%1), %%mm2\n"
-+		"  movq 56(%1), %%mm3\n"
-+		"  movq %%mm0, 32(%2)\n"
-+		"  movq %%mm1, 40(%2)\n"
-+		"  movq %%mm2, 48(%2)\n"
-+		"  movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
- 	 * but that is for later. -AV
- 	 */
- 	__asm__ __volatile__(
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < (4096-320)/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movntq %%mm0, (%1)\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movntq %%mm1, 8(%1)\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movntq %%mm2, 16(%1)\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movntq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm4\n"
--		"   movntq %%mm4, 32(%1)\n"
--		"   movq 40(%0), %%mm5\n"
--		"   movntq %%mm5, 40(%1)\n"
--		"   movq 48(%0), %%mm6\n"
--		"   movntq %%mm6, 48(%1)\n"
--		"   movq 56(%0), %%mm7\n"
--		"   movntq %%mm7, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movntq %%mm0, (%2)\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movntq %%mm1, 8(%2)\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movntq %%mm2, 16(%2)\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movntq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm4\n"
-+		"   movntq %%mm4, 32(%2)\n"
-+		"   movq 40(%1), %%mm5\n"
-+		"   movntq %%mm5, 40(%2)\n"
-+		"   movq 48(%1), %%mm6\n"
-+		"   movntq %%mm6, 48(%2)\n"
-+		"   movq 56(%1), %%mm7\n"
-+		"   movntq %%mm7, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < 4096/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movq %%mm0, (%1)\n"
--		"   movq %%mm1, 8(%1)\n"
--		"   movq %%mm2, 16(%1)\n"
--		"   movq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm0\n"
--		"   movq 40(%0), %%mm1\n"
--		"   movq 48(%0), %%mm2\n"
--		"   movq 56(%0), %%mm3\n"
--		"   movq %%mm0, 32(%1)\n"
--		"   movq %%mm1, 40(%1)\n"
--		"   movq %%mm2, 48(%1)\n"
--		"   movq %%mm3, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movq %%mm0, (%2)\n"
-+		"   movq %%mm1, 8(%2)\n"
-+		"   movq %%mm2, 16(%2)\n"
-+		"   movq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm0\n"
-+		"   movq 40(%1), %%mm1\n"
-+		"   movq 48(%1), %%mm2\n"
-+		"   movq 56(%1), %%mm3\n"
-+		"   movq %%mm0, 32(%2)\n"
-+		"   movq %%mm1, 40(%2)\n"
-+		"   movq %%mm2, 48(%2)\n"
-+		"   movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-diff -urNp linux-2.6.32.11/arch/x86/lib/putuser.S linux-2.6.32.11/arch/x86/lib/putuser.S
---- linux-2.6.32.11/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/putuser.S	2010-04-04 20:58:33.225084964 -0400
-@@ -15,7 +15,8 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- /*
-  * __put_user_X
-@@ -29,59 +30,156 @@
-  * as they get called from within inline assembly.
-  */
- 
--#define ENTER	CFI_STARTPROC ; \
--		GET_THREAD_INFO(%_ASM_BX)
-+#define ENTER	CFI_STARTPROC
- #define EXIT	ret ; \
- 		CFI_ENDPROC
- 
- .text
- ENTRY(__put_user_1)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_1)
- 
- ENTRY(__put_user_2)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $1,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_2)
- 
- ENTRY(__put_user_4)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $3,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_4)
- 
- ENTRY(__put_user_8)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $7,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 4:	mov %_ASM_AX,(%_ASM_CX)
- #ifdef CONFIG_X86_32
- 5:	movl %edx,4(%_ASM_CX)
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_8)
- 
- bad_put_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	movl $-EFAULT,%eax
- 	EXIT
- END(bad_put_user)
-diff -urNp linux-2.6.32.11/arch/x86/lib/usercopy_32.c linux-2.6.32.11/arch/x86/lib/usercopy_32.c
---- linux-2.6.32.11/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/usercopy_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
-  * Copy a null terminated string from userspace.
-  */
- 
--#define __do_strncpy_from_user(dst, src, count, res)			   \
--do {									   \
--	int __d0, __d1, __d2;						   \
--	might_fault();							   \
--	__asm__ __volatile__(						   \
--		"	testl %1,%1\n"					   \
--		"	jz 2f\n"					   \
--		"0:	lodsb\n"					   \
--		"	stosb\n"					   \
--		"	testb %%al,%%al\n"				   \
--		"	jz 1f\n"					   \
--		"	decl %1\n"					   \
--		"	jnz 0b\n"					   \
--		"1:	subl %1,%0\n"					   \
--		"2:\n"							   \
--		".section .fixup,\"ax\"\n"				   \
--		"3:	movl %5,%0\n"					   \
--		"	jmp 2b\n"					   \
--		".previous\n"						   \
--		_ASM_EXTABLE(0b,3b)					   \
--		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
--		  "=&D" (__d2)						   \
--		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
--		: "memory");						   \
--} while (0)
-+static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
-+{
-+	int __d0, __d1, __d2;
-+	long res = -EFAULT;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w10,%%ds\n"
-+		"	testl %1,%1\n"
-+		"	jz 2f\n"
-+		"0:	lodsb\n"
-+		"	stosb\n"
-+		"	testb %%al,%%al\n"
-+		"	jz 1f\n"
-+		"	decl %1\n"
-+		"	jnz 0b\n"
-+		"1:	subl %1,%0\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	movl %5,%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
-+		  "=&D" (__d2)
-+		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
-+		  "r"(__USER_DS)
-+		: "memory");
-+	return res;
-+}
- 
- /**
-  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
-@@ -85,9 +92,7 @@ do {									   \
- long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
--	long res;
--	__do_strncpy_from_user(dst, src, count, res);
--	return res;
-+	return __do_strncpy_from_user(dst, src, count);
- }
- EXPORT_SYMBOL(__strncpy_from_user);
- 
-@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
--		__do_strncpy_from_user(dst, src, count, res);
-+		res = __do_strncpy_from_user(dst, src, count);
- 	return res;
- }
- EXPORT_SYMBOL(strncpy_from_user);
-@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
-  * Zero Userspace
-  */
- 
--#define __do_clear_user(addr,size)					\
--do {									\
--	int __d0;							\
--	might_fault();							\
--	__asm__ __volatile__(						\
--		"0:	rep; stosl\n"					\
--		"	movl %2,%0\n"					\
--		"1:	rep; stosb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"3:	lea 0(%2,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		_ASM_EXTABLE(0b,3b)					\
--		_ASM_EXTABLE(1b,2b)					\
--		: "=&c"(size), "=&D" (__d0)				\
--		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
--} while (0)
-+static unsigned long __do_clear_user(void __user *addr, unsigned long size)
-+{
-+	int __d0;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w6,%%es\n"
-+		"0:	rep; stosl\n"
-+		"	movl %2,%0\n"
-+		"1:	rep; stosb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	lea 0(%2,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		_ASM_EXTABLE(1b,2b)
-+		: "=&c"(size), "=&D" (__d0)
-+		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
-+		  "r"(__USER_DS));
-+	return size;
-+}
- 
- /**
-  * clear_user: - Zero a block of memory in user space.
-@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
- {
- 	might_fault();
- 	if (access_ok(VERIFY_WRITE, to, n))
--		__do_clear_user(to, n);
-+		n = __do_clear_user(to, n);
- 	return n;
- }
- EXPORT_SYMBOL(clear_user);
-@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
- unsigned long
- __clear_user(void __user *to, unsigned long n)
- {
--	__do_clear_user(to, n);
--	return n;
-+	return __do_clear_user(to, n);
- }
- EXPORT_SYMBOL(__clear_user);
- 
-@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
- 	might_fault();
- 
- 	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
- 		"	testl %0, %0\n"
- 		"	jz 3f\n"
--		"	andl %0,%%ecx\n"
-+		"	movl %0,%%ecx\n"
- 		"0:	repne; scasb\n"
- 		"	setne %%al\n"
- 		"	subl %%ecx,%0\n"
- 		"	addl %0,%%eax\n"
- 		"1:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
- 		".section .fixup,\"ax\"\n"
- 		"2:	xorl %%eax,%%eax\n"
- 		"	jmp 1b\n"
-@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
- 		"	.long 0b,2b\n"
- 		".previous"
- 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
--		:"0" (n), "1" (s), "2" (0), "3" (mask)
-+		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
- 		:"cc");
- 	return res & mask;
- }
-@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
- 
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "       movw %w6, %%es\n"
- 		       "       .align 2,0x90\n"
- 		       "1:     movl 32(%4), %%eax\n"
- 		       "       cmpl $67, %0\n"
-@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
- 		       "       .align 2,0x90\n"
- 		       "3:     movl 0(%4), %%eax\n"
- 		       "4:     movl 4(%4), %%edx\n"
--		       "5:     movl %%eax, 0(%3)\n"
--		       "6:     movl %%edx, 4(%3)\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
- 		       "7:     movl 8(%4), %%eax\n"
- 		       "8:     movl 12(%4),%%edx\n"
--		       "9:     movl %%eax, 8(%3)\n"
--		       "10:    movl %%edx, 12(%3)\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
- 		       "11:    movl 16(%4), %%eax\n"
- 		       "12:    movl 20(%4), %%edx\n"
--		       "13:    movl %%eax, 16(%3)\n"
--		       "14:    movl %%edx, 20(%3)\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
- 		       "15:    movl 24(%4), %%eax\n"
- 		       "16:    movl 28(%4), %%edx\n"
--		       "17:    movl %%eax, 24(%3)\n"
--		       "18:    movl %%edx, 28(%3)\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
- 		       "19:    movl 32(%4), %%eax\n"
- 		       "20:    movl 36(%4), %%edx\n"
--		       "21:    movl %%eax, 32(%3)\n"
--		       "22:    movl %%edx, 36(%3)\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
- 		       "23:    movl 40(%4), %%eax\n"
- 		       "24:    movl 44(%4), %%edx\n"
--		       "25:    movl %%eax, 40(%3)\n"
--		       "26:    movl %%edx, 44(%3)\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
- 		       "27:    movl 48(%4), %%eax\n"
- 		       "28:    movl 52(%4), %%edx\n"
--		       "29:    movl %%eax, 48(%3)\n"
--		       "30:    movl %%edx, 52(%3)\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
- 		       "31:    movl 56(%4), %%eax\n"
- 		       "32:    movl 60(%4), %%edx\n"
--		       "33:    movl %%eax, 56(%3)\n"
--		       "34:    movl %%edx, 60(%3)\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
- 		       "       addl $-64, %0\n"
- 		       "       addl $64, %4\n"
- 		       "       addl $64, %3\n"
-@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
- 		       "36:    movl %%eax, %0\n"
- 		       "37:    rep; movsb\n"
- 		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%es\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "101:   lea 0(%%eax,%0,4),%0\n"
- 		       "       jmp 100b\n"
-@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
- 		       "       .long 99b,101b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
-+		       : "eax", "edx", "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+	int d0, d1;
-+	__asm__ __volatile__(
-+		       "       movw %w6, %%ds\n"
-+		       "       .align 2,0x90\n"
-+		       "1:     movl 32(%4), %%eax\n"
-+		       "       cmpl $67, %0\n"
-+		       "       jbe 3f\n"
-+		       "2:     movl 64(%4), %%eax\n"
-+		       "       .align 2,0x90\n"
-+		       "3:     movl 0(%4), %%eax\n"
-+		       "4:     movl 4(%4), %%edx\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
-+		       "7:     movl 8(%4), %%eax\n"
-+		       "8:     movl 12(%4),%%edx\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
-+		       "11:    movl 16(%4), %%eax\n"
-+		       "12:    movl 20(%4), %%edx\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
-+		       "15:    movl 24(%4), %%eax\n"
-+		       "16:    movl 28(%4), %%edx\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
-+		       "19:    movl 32(%4), %%eax\n"
-+		       "20:    movl 36(%4), %%edx\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
-+		       "23:    movl 40(%4), %%eax\n"
-+		       "24:    movl 44(%4), %%edx\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
-+		       "27:    movl 48(%4), %%eax\n"
-+		       "28:    movl 52(%4), %%edx\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
-+		       "31:    movl 56(%4), %%eax\n"
-+		       "32:    movl 60(%4), %%edx\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
-+		       "       addl $-64, %0\n"
-+		       "       addl $64, %4\n"
-+		       "       addl $64, %3\n"
-+		       "       cmpl $63, %0\n"
-+		       "       ja  1b\n"
-+		       "35:    movl  %0, %%eax\n"
-+		       "       shrl  $2, %0\n"
-+		       "       andl  $3, %%eax\n"
-+		       "       cld\n"
-+		       "99:    rep; movsl\n"
-+		       "36:    movl %%eax, %0\n"
-+		       "37:    rep; movsb\n"
-+		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%ds\n"
-+		       ".section .fixup,\"ax\"\n"
-+		       "101:   lea 0(%%eax,%0,4),%0\n"
-+		       "       jmp 100b\n"
-+		       ".previous\n"
-+		       ".section __ex_table,\"a\"\n"
-+		       "       .align 4\n"
-+		       "       .long 1b,100b\n"
-+		       "       .long 2b,100b\n"
-+		       "       .long 3b,100b\n"
-+		       "       .long 4b,100b\n"
-+		       "       .long 5b,100b\n"
-+		       "       .long 6b,100b\n"
-+		       "       .long 7b,100b\n"
-+		       "       .long 8b,100b\n"
-+		       "       .long 9b,100b\n"
-+		       "       .long 10b,100b\n"
-+		       "       .long 11b,100b\n"
-+		       "       .long 12b,100b\n"
-+		       "       .long 13b,100b\n"
-+		       "       .long 14b,100b\n"
-+		       "       .long 15b,100b\n"
-+		       "       .long 16b,100b\n"
-+		       "       .long 17b,100b\n"
-+		       "       .long 18b,100b\n"
-+		       "       .long 19b,100b\n"
-+		       "       .long 20b,100b\n"
-+		       "       .long 21b,100b\n"
-+		       "       .long 22b,100b\n"
-+		       "       .long 23b,100b\n"
-+		       "       .long 24b,100b\n"
-+		       "       .long 25b,100b\n"
-+		       "       .long 26b,100b\n"
-+		       "       .long 27b,100b\n"
-+		       "       .long 28b,100b\n"
-+		       "       .long 29b,100b\n"
-+		       "       .long 30b,100b\n"
-+		       "       .long 31b,100b\n"
-+		       "       .long 32b,100b\n"
-+		       "       .long 33b,100b\n"
-+		       "       .long 34b,100b\n"
-+		       "       .long 35b,100b\n"
-+		       "       .long 36b,100b\n"
-+		       "       .long 37b,100b\n"
-+		       "       .long 99b,101b\n"
-+		       ".previous"
-+		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "        movw %w6, %%ds\n"
- 		       "        .align 2,0x90\n"
- 		       "0:      movl 32(%4), %%eax\n"
- 		       "        cmpl $67, %0\n"
-@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .align 2,0x90\n"
- 		       "2:      movl 0(%4), %%eax\n"
- 		       "21:     movl 4(%4), %%edx\n"
--		       "        movl %%eax, 0(%3)\n"
--		       "        movl %%edx, 4(%3)\n"
-+		       "        movl %%eax, %%es:0(%3)\n"
-+		       "        movl %%edx, %%es:4(%3)\n"
- 		       "3:      movl 8(%4), %%eax\n"
- 		       "31:     movl 12(%4),%%edx\n"
--		       "        movl %%eax, 8(%3)\n"
--		       "        movl %%edx, 12(%3)\n"
-+		       "        movl %%eax, %%es:8(%3)\n"
-+		       "        movl %%edx, %%es:12(%3)\n"
- 		       "4:      movl 16(%4), %%eax\n"
- 		       "41:     movl 20(%4), %%edx\n"
--		       "        movl %%eax, 16(%3)\n"
--		       "        movl %%edx, 20(%3)\n"
-+		       "        movl %%eax, %%es:16(%3)\n"
-+		       "        movl %%edx, %%es:20(%3)\n"
- 		       "10:     movl 24(%4), %%eax\n"
- 		       "51:     movl 28(%4), %%edx\n"
--		       "        movl %%eax, 24(%3)\n"
--		       "        movl %%edx, 28(%3)\n"
-+		       "        movl %%eax, %%es:24(%3)\n"
-+		       "        movl %%edx, %%es:28(%3)\n"
- 		       "11:     movl 32(%4), %%eax\n"
- 		       "61:     movl 36(%4), %%edx\n"
--		       "        movl %%eax, 32(%3)\n"
--		       "        movl %%edx, 36(%3)\n"
-+		       "        movl %%eax, %%es:32(%3)\n"
-+		       "        movl %%edx, %%es:36(%3)\n"
- 		       "12:     movl 40(%4), %%eax\n"
- 		       "71:     movl 44(%4), %%edx\n"
--		       "        movl %%eax, 40(%3)\n"
--		       "        movl %%edx, 44(%3)\n"
-+		       "        movl %%eax, %%es:40(%3)\n"
-+		       "        movl %%edx, %%es:44(%3)\n"
- 		       "13:     movl 48(%4), %%eax\n"
- 		       "81:     movl 52(%4), %%edx\n"
--		       "        movl %%eax, 48(%3)\n"
--		       "        movl %%edx, 52(%3)\n"
-+		       "        movl %%eax, %%es:48(%3)\n"
-+		       "        movl %%edx, %%es:52(%3)\n"
- 		       "14:     movl 56(%4), %%eax\n"
- 		       "91:     movl 60(%4), %%edx\n"
--		       "        movl %%eax, 56(%3)\n"
--		       "        movl %%edx, 60(%3)\n"
-+		       "        movl %%eax, %%es:56(%3)\n"
-+		       "        movl %%edx, %%es:60(%3)\n"
- 		       "        addl $-64, %0\n"
- 		       "        addl $64, %4\n"
- 		       "        addl $64, %3\n"
-@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        movl %%eax,%0\n"
- 		       "7:      rep; movsb\n"
- 		       "8:\n"
-+		       "        pushl %%ss\n"
-+		       "        popl %%ds\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "9:      lea 0(%%eax,%0,4),%0\n"
- 		       "16:     pushl %0\n"
-@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .long 7b,16b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     pushl %0\n"
-@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     jmp 8b\n"
-@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
-  */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- 					unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+					unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- 					unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- 				const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
- 
- /* Generic arbitrary sized copy.  */
--#define __copy_user(to, from, size)					\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 2b\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,2b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
--
--#define __copy_user_zeroing(to, from, size)				\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 6f\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"6:	pushl %0\n"					\
--		"	pushl %%eax\n"					\
--		"	xorl %%eax,%%eax\n"				\
--		"	rep; stosb\n"					\
--		"	popl %%eax\n"					\
--		"	popl %0\n"					\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,6b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
-+static unsigned long
-+__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 6f\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"6:	pushl %0\n"
-+		"	pushl %%eax\n"
-+		"	xorl %%eax,%%eax\n"
-+		"	rep; stosb\n"
-+		"	popl %%eax\n"
-+		"	popl %0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,6b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
- 
- unsigned long __copy_to_user_ll(void __user *to, const void *from,
- 				unsigned long n)
-@@ -775,9 +966,9 @@ survive:
- 	}
- #endif
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_to_user(to, from, n);
- 	else
--		n = __copy_user_intel(to, from, n);
-+		n = __generic_copy_to_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
- 					unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- 	else
- 		n = __copy_user_zeroing_intel(to, from, n);
- 	return n;
-@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
- 					 unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- 	else
--		n = __copy_user_intel((void __user *)to,
--				      (const void *)from, n);
-+		n = __generic_copy_from_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_zeroing_intel_nocache(to, from, n);
- 	else
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- #else
--	__copy_user_zeroing(to, from, n);
-+	n = __copy_user_zeroing(to, from, n);
- #endif
- 	return n;
- }
-@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_intel_nocache(to, from, n);
- 	else
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- #else
--	__copy_user(to, from, n);
-+	n = __generic_copy_from_user(to, from, n);
- #endif
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
- 
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to:   Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x, int cpu)
- {
--	if (access_ok(VERIFY_WRITE, to, n))
--		n = __copy_to_user(to, from, n);
--	return n;
-+	unsigned long limit = x.seg;
-+	struct desc_struct d;
-+
-+	current_thread_info()->addr_limit = x;
-+	if (unlikely(paravirt_enabled()))
-+		return;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
- }
--EXPORT_SYMBOL(copy_to_user);
- 
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to:   Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void set_fs(mm_segment_t x)
- {
--	if (access_ok(VERIFY_READ, from, n))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
-+	__set_fs(x, get_cpu());
-+	put_cpu();
- }
--EXPORT_SYMBOL(copy_from_user);
-+#else
-+void set_fs(mm_segment_t x)
-+{
-+	current_thread_info()->addr_limit = x;
-+}
-+#endif
-+
-+EXPORT_SYMBOL(set_fs);
-diff -urNp linux-2.6.32.11/arch/x86/lib/usercopy_64.c linux-2.6.32.11/arch/x86/lib/usercopy_64.c
---- linux-2.6.32.11/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/lib/usercopy_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -42,6 +42,8 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- 	long res;
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	__do_strncpy_from_user(dst, src, count, res);
- 	return res;
- }
-@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
- {
- 	long __d0;
- 	might_fault();
-+	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
-+		addr += PAX_USER_SHADOW_BASE;
- 	/* no memory constraint because it doesn't change any memory gcc knows
- 	   about */
- 	asm volatile(
-@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
- 
- unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
- {
--	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
-+	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-+		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
-+			to += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
-+			from += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)to, (__force void *)from, len);
--	} 
--	return len;		
-+	}
-+	return len;
- }
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.11/arch/x86/Makefile linux-2.6.32.11/arch/x86/Makefile
---- linux-2.6.32.11/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/Makefile	2010-04-04 20:46:41.533557286 -0400
-@@ -189,3 +189,12 @@ define archhelp
-   echo  '                  FDARGS="..."  arguments for the booted kernel'
-   echo  '                  FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.32.11/arch/x86/mm/extable.c linux-2.6.32.11/arch/x86/mm/extable.c
---- linux-2.6.32.11/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/extable.c	2010-04-04 20:46:41.533557286 -0400
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
- 
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+	const struct exception_table_entry *x = a, *y = b;
-+
-+	/* avoid overflow */
-+	if (x->insn > y->insn)
-+		return 1;
-+	if (x->insn < y->insn)
-+		return -1;
-+	return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+	struct exception_table_entry t, *x = a, *y = b;
-+
-+	t = *x;
-+
-+	pax_open_kernel();
-+	*x = *y;
-+	*y = t;
-+	pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+		  struct exception_table_entry *finish)
-+{
-+	sort(start, finish - start, sizeof(struct exception_table_entry),
-+	     cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+	/*trim the beginning*/
-+	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+		m->extable++;
-+		m->num_exentries--;
-+	}
-+	/*trim the end*/
-+	while (m->num_exentries &&
-+		within_module_init(m->extable[m->num_exentries-1].insn, m))
-+		m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
- 
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fixup;
- 
- #ifdef CONFIG_PNPBIOS
--	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- 		extern u32 pnp_bios_is_utter_crap;
- 		pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.32.11/arch/x86/mm/fault.c linux-2.6.32.11/arch/x86/mm/fault.c
---- linux-2.6.32.11/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/fault.c	2010-04-04 20:58:33.225084964 -0400
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h>		/* __kprobes, ...		*/
- #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
- #include <linux/perf_event.h>		/* perf_sw_event		*/
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
- 
- #include <asm/traps.h>			/* dotraplinkage, ...		*/
- #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
- #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
- 
- /*
-  * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
- 	int ret = 0;
- 
- 	/* kprobe_running() needs smp_processor_id() */
--	if (kprobes_built_in() && !user_mode_vm(regs)) {
-+	if (kprobes_built_in() && !user_mode(regs)) {
- 		preempt_disable();
- 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
- 			ret = 1;
-@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
- 	force_sig_info(si_signo, &info, tsk);
- }
- 
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+	pgd = pgd_offset(mm, address);
-+	if (!pgd_present(*pgd))
-+		return NULL;
-+	pud = pud_offset(pgd, address);
-+	if (!pud_present(*pud))
-+		return NULL;
-+	pmd = pmd_offset(pud, address);
-+	if (!pmd_present(*pmd))
-+		return NULL;
-+	return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
- 
-@@ -332,15 +365,27 @@ void vmalloc_sync_all(void)
- 
- 		const pgd_t *pgd_ref = pgd_offset_k(address);
- 		unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		unsigned long cpu;
-+#else
- 		struct page *page;
-+#endif
- 
- 		if (pgd_none(*pgd_ref))
- 			continue;
- 
- 		spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+			pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- 		list_for_each_entry(page, &pgd_list, lru) {
- 			pgd_t *pgd;
- 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- 			if (pgd_none(*pgd))
- 				set_pgd(pgd, *pgd_ref);
- 			else
-@@ -373,7 +418,14 @@ static noinline int vmalloc_fault(unsign
- 	 * happen within a race in page table update. In the later
- 	 * case just flush:
- 	 */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+	pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- 	pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- 	pgd_ref = pgd_offset_k(address);
- 	if (pgd_none(*pgd_ref))
- 		return -1;
-@@ -535,7 +587,7 @@ static int is_errata93(struct pt_regs *r
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
--	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- 		return 1;
- #endif
- 	return 0;
-@@ -562,7 +614,7 @@ static int is_f00f_bug(struct pt_regs *r
- }
- 
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
- 
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +623,26 @@ show_fault_oops(struct pt_regs *regs, un
- 	if (!oops_may_print())
- 		return;
- 
--	if (error_code & PF_INSTR) {
-+	if (nx_enabled && (error_code & PF_INSTR)) {
- 		unsigned int level;
- 
- 		pte_t *pte = lookup_address(address, &level);
- 
- 		if (pte && pte_present(*pte) && !pte_exec(*pte))
--			printk(nx_warning, current_uid());
-+			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- 	}
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (init_mm.start_code <= address && address < init_mm.end_code) {
-+		if (current->signal->curr_ip)
-+			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+		else
-+			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	}
-+#endif
-+
- 	printk(KERN_ALERT "BUG: unable to handle kernel ");
- 	if (address < PAGE_SIZE)
- 		printk(KERN_CONT "NULL pointer dereference");
-@@ -704,6 +767,68 @@ __bad_area_nosemaphore(struct pt_regs *r
- 		       unsigned long address, int si_code)
- {
- 	struct task_struct *tsk = current;
-+	struct mm_struct *mm = tsk->mm;
-+
-+#ifdef CONFIG_X86_64
-+	if (mm && (error_code & PF_INSTR)) {
-+		if (regs->ip == (unsigned long)vgettimeofday) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+			return;
-+		} else if (regs->ip == (unsigned long)vtime) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+			return;
-+		} else if (regs->ip == (unsigned long)vgetcpu) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+			return;
-+		}
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm && (error_code & PF_USER)) {
-+		unsigned long ip = regs->ip;
-+
-+		if (v8086_mode(regs))
-+			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
-+
-+		/*
-+		 * It's possible to have interrupts off here:
-+		 */
-+		local_irq_enable();
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
-+		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+	}
-+#endif
- 
- 	/* User mode accesses just cause a SIGSEGV */
- 	if (error_code & PF_USER) {
-@@ -848,6 +973,106 @@ static int spurious_fault_check(unsigned
- 	return 1;
- }
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+	pte_t *pte;
-+	pmd_t *pmd;
-+	spinlock_t *ptl;
-+	unsigned char pte_mask;
-+
-+	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+		return 0;
-+
-+	/* PaX: it's our fault, let's handle it if we can */
-+
-+	/* PaX: take a look at read faults before acquiring any locks */
-+	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+		/* instruction fetch attempt from a protected page in user mode */
-+		up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		switch (pax_handle_fetch_fault(regs)) {
-+		case 2:
-+			return 1;
-+		}
-+#endif
-+
-+		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+		do_group_exit(SIGKILL);
-+	}
-+
-+	pmd = pax_get_pmd(mm, address);
-+	if (unlikely(!pmd))
-+		return 0;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+		/* write attempt to a protected page in user mode */
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+#ifdef CONFIG_SMP
-+	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+	if (likely(address > get_limit(regs->cs)))
-+#endif
-+	{
-+		set_pte(pte, pte_mkread(*pte));
-+		__flush_tlb_one(address);
-+		pte_unmap_unlock(pte, ptl);
-+		up_read(&mm->mmap_sem);
-+		return 1;
-+	}
-+
-+	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+	/*
-+	 * PaX: fill DTLB with user rights and retry
-+	 */
-+	__asm__ __volatile__ (
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"movw %w4,%%es\n"
-+#endif
-+		"orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+		"invlpg (%0)\n"
-+#endif
-+		"testb $0,%%es:(%0)\n"
-+		"xorb %3,(%1)\n"
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"pushl %%ss\n"
-+		"popl %%es\n"
-+#endif
-+		:
-+		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
-+		: "memory", "cc");
-+	pte_unmap_unlock(pte, ptl);
-+	up_read(&mm->mmap_sem);
-+	return 1;
-+}
-+#endif
-+
- /*
-  * Handle a spurious fault caused by a stale TLB entry.
-  *
-@@ -914,6 +1139,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+		return 1;
-+
- 	if (write) {
- 		/* write, present and write, not present: */
- 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -947,17 +1175,29 @@ do_page_fault(struct pt_regs *regs, unsi
- {
- 	struct vm_area_struct *vma;
- 	struct task_struct *tsk;
--	unsigned long address;
- 	struct mm_struct *mm;
- 	int write;
- 	int fault;
- 
-+	/* Get the faulting address: */
-+	unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (!user_mode(regs)) {
-+		if (address < PAX_USER_SHADOW_BASE) {
-+			if (search_exception_tables(regs->ip)) {
-+				printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+				printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
-+				show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+			}
-+		} else if (address < 2 * PAX_USER_SHADOW_BASE)
-+			address -= PAX_USER_SHADOW_BASE;
-+	}
-+#endif
-+
- 	tsk = current;
- 	mm = tsk->mm;
- 
--	/* Get the faulting address: */
--	address = read_cr2();
--
- 	/*
- 	 * Detect and handle instructions that would cause a page fault for
- 	 * both a tracked kernel page and a userspace page.
-@@ -1017,7 +1257,7 @@ do_page_fault(struct pt_regs *regs, unsi
- 	 * User-mode registers count as a user access even for any
- 	 * potential system fault or CPU buglet:
- 	 */
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		local_irq_enable();
- 		error_code |= PF_USER;
- 	} else {
-@@ -1071,6 +1311,11 @@ do_page_fault(struct pt_regs *regs, unsi
- 		might_sleep();
- 	}
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+		return;
-+#endif
-+
- 	vma = find_vma(mm, address);
- 	if (unlikely(!vma)) {
- 		bad_area(regs, error_code, address);
-@@ -1082,18 +1327,24 @@ do_page_fault(struct pt_regs *regs, unsi
- 		bad_area(regs, error_code, address);
- 		return;
- 	}
--	if (error_code & PF_USER) {
--		/*
--		 * Accessing the stack below %sp is always a bug.
--		 * The large cushion allows instructions like enter
--		 * and pusha to work. ("enter $65535, $31" pushes
--		 * 32 pointers and then decrements %sp by 65535.)
--		 */
--		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
--			bad_area(regs, error_code, address);
--			return;
--		}
-+	/*
-+	 * Accessing the stack below %sp is always a bug.
-+	 * The large cushion allows instructions like enter
-+	 * and pusha to work. ("enter $65535, $31" pushes
-+	 * 32 pointers and then decrements %sp by 65535.)
-+	 */
-+	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+		bad_area(regs, error_code, address);
-+		return;
-+	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+		bad_area(regs, error_code, address);
-+		return;
- 	}
-+#endif
-+
- 	if (unlikely(expand_stack(vma, address))) {
- 		bad_area(regs, error_code, address);
- 		return;
-@@ -1137,3 +1388,199 @@ good_area:
- 
- 	up_read(&mm->mmap_sem);
- }
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned char mov1, mov2;
-+		unsigned short jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 11) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov1, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+			regs->cx = addr1;
-+			regs->ax = addr2;
-+			regs->ip = addr2;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned char mov, jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 9) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+		if (err)
-+			break;
-+
-+		if (mov == 0xB9 && jmp == 0xE9) {
-+			regs->cx = addr1;
-+			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned int addr1;
-+		unsigned long addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned long addr1, addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	if (v8086_mode(regs))
-+		return 1;
-+
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+
-+#ifdef CONFIG_X86_32
-+	return pax_handle_fetch_fault_32(regs);
-+#else
-+	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+		return pax_handle_fetch_fault_32(regs);
-+	else
-+		return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+	for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+#ifdef CONFIG_X86_32
-+			printk(KERN_CONT "???????? ");
-+#else
-+			printk(KERN_CONT "???????????????? ");
-+#endif
-+		else
-+			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+	long ret;
-+	mm_segment_t old_fs = get_fs();
-+
-+	set_fs(KERNEL_DS);
-+	pagefault_disable();
-+	pax_open_kernel();
-+	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+	pax_close_kernel();
-+	pagefault_enable();
-+	set_fs(old_fs);
-+
-+	return ret ? -EFAULT : 0;
-+}
-diff -urNp linux-2.6.32.11/arch/x86/mm/gup.c linux-2.6.32.11/arch/x86/mm/gup.c
---- linux-2.6.32.11/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/gup.c	2010-04-04 20:46:41.533557286 -0400
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
- 	addr = start;
- 	len = (unsigned long) nr_pages << PAGE_SHIFT;
- 	end = start + len;
--	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- 					(void __user *)start, len)))
- 		return 0;
- 
-diff -urNp linux-2.6.32.11/arch/x86/mm/highmem_32.c linux-2.6.32.11/arch/x86/mm/highmem_32.c
---- linux-2.6.32.11/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/highmem_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
- 	idx = type + KM_TYPE_NR*smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- 	BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte-idx, mk_pte(page, prot));
-+	pax_close_kernel();
- 
- 	return (void *)vaddr;
- }
-diff -urNp linux-2.6.32.11/arch/x86/mm/hugetlbpage.c linux-2.6.32.11/arch/x86/mm/hugetlbpage.c
---- linux-2.6.32.11/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/hugetlbpage.c	2010-04-04 20:46:41.533557286 -0400
-@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
--	unsigned long start_addr;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = mm->free_area_cache;
-+		start_addr = mm->free_area_cache;
- 	} else {
--	        start_addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -281,13 +286,13 @@ full_search:
- 
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
--		if (TASK_SIZE - len < addr) {
-+		if (pax_task_size - len < addr) {
- 			/*
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma, *prev_vma;
--	unsigned long base = mm->mmap_base, addr = addr0;
-+	unsigned long base = mm->mmap_base, addr;
- 	unsigned long largest_hole = mm->cached_hole_size;
--	int first_time = 1;
- 
- 	/* don't allow allocations above current base */
- 	if (mm->free_area_cache > base)
-@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
- 	        largest_hole = 0;
- 		mm->free_area_cache  = base;
- 	}
--try_again:
-+
- 	/* make sure it can fit in the remaining address space */
- 	if (mm->free_area_cache < len)
- 		goto fail;
-@@ -364,22 +368,26 @@ try_again:
- 
- fail:
- 	/*
--	 * if hint left us with no space for the requested
--	 * mapping then try again:
--	 */
--	if (first_time) {
--		mm->free_area_cache = base;
--		largest_hole = 0;
--		first_time = 0;
--		goto try_again;
--	}
--	/*
- 	 * A failed mmap() very likely causes application failure,
- 	 * so fall back to the bottom-up function here. This scenario
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
- 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- 			len, pgoff, flags);
-@@ -387,6 +395,7 @@ fail:
- 	/*
- 	 * Restore the topdown base:
- 	 */
-+	mm->mmap_base = base;
- 	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
-@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (len & ~huge_page_mask(h))
- 		return -EINVAL;
--	if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
- 		return -ENOMEM;
- 
- 	if (flags & MAP_FIXED) {
-@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
- 	if (addr) {
- 		addr = ALIGN(addr, huge_page_size(h));
- 		vma = find_vma(mm, addr);
--		if (TASK_SIZE - len >= addr &&
-+		if (pax_task_size - len >= addr &&
- 		    (!vma || addr + len <= vma->vm_start))
- 			return addr;
- 	}
-diff -urNp linux-2.6.32.11/arch/x86/mm/init_32.c linux-2.6.32.11/arch/x86/mm/init_32.c
---- linux-2.6.32.11/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/init_32.c	2010-04-04 20:58:33.225084964 -0400
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
- 
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
--	pud_t *pud;
--	pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
--	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
--		if (after_bootmem)
--			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
--		else
--			pmd_table = (pmd_t *)alloc_low_page();
--		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
--		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
--		pud = pud_offset(pgd, 0);
--		BUG_ON(pmd_table != pmd_offset(pud, 0));
--
--		return pmd_table;
--	}
--#endif
--	pud = pud_offset(pgd, 0);
--	pmd_table = pmd_offset(pud, 0);
--
--	return pmd_table;
--}
--
--/*
-  * Create a page table and place a pointer to it in a middle page
-  * directory entry:
-  */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
- 			page_table = (pte_t *)alloc_low_page();
- 
- 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- 	}
- 
- 	return pte_offset_kernel(pmd, 0);
- }
- 
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+	pud_t *pud;
-+	pmd_t *pmd_table;
-+
-+	pud = pud_offset(pgd, 0);
-+	pmd_table = pmd_offset(pud, 0);
-+
-+	return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- 	int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
- 	int pgd_idx, pmd_idx;
- 	unsigned long vaddr;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte = NULL;
- 
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
- 	pgd = pgd_base + pgd_idx;
- 
- 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
--		pmd = pmd + pmd_index(vaddr);
-+		pud = pud_offset(pgd, vaddr);
-+		pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- 							pmd++, pmd_idx++) {
- 			pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
- 	}
- }
- 
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
--	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
--		return 1;
--	return 0;
-+	if ((start > ktla_ktva((unsigned long)_etext) ||
-+	     end <= ktla_ktva((unsigned long)_stext)) &&
-+	    (start > ktla_ktva((unsigned long)_einittext) ||
-+	     end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+		return 0;
-+	return 1;
- }
- 
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
- 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- 	unsigned long start_pfn, end_pfn;
- 	pgd_t *pgd_base = swapper_pg_dir;
--	int pgd_idx, pmd_idx, pte_ofs;
-+	unsigned int pgd_idx, pmd_idx, pte_ofs;
- 	unsigned long pfn;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte;
- 	unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- 	pfn = start_pfn;
- 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 	pgd = pgd_base + pgd_idx;
--	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
-+	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+		pud = pud_offset(pgd, 0);
-+		pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
- 
- 		if (pfn >= end_pfn)
- 			continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- 		     pmd++, pmd_idx++) {
--			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
- 
- 			/*
- 			 * Map with big pages if possible, otherwise
- 			 * create normal page tables:
- 			 */
- 			if (use_pse) {
--				unsigned int addr2;
- 				pgprot_t prot = PAGE_KERNEL_LARGE;
- 				/*
- 				 * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- 					__pgprot(PTE_IDENT_ATTR |
- 						 _PAGE_PSE);
- 
--				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
--					PAGE_OFFSET + PAGE_SIZE-1;
--
--				if (is_kernel_text(addr) ||
--				    is_kernel_text(addr2))
-+				if (is_kernel_text(address, address + PMD_SIZE))
- 					prot = PAGE_KERNEL_LARGE_EXEC;
- 
- 				pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 			pte += pte_ofs;
- 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
--			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- 				pgprot_t prot = PAGE_KERNEL;
- 				/*
- 				 * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- 				 */
- 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
- 
--				if (is_kernel_text(addr))
-+				if (is_kernel_text(address, address + PAGE_SIZE))
- 					prot = PAGE_KERNEL_EXEC;
- 
- 				pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
- 
- 		pud = pud_offset(pgd, va);
- 		pmd = pmd_offset(pud, va);
--		if (!pmd_present(*pmd))
-+		if (!pmd_present(*pmd) || pmd_huge(*pmd))
- 			break;
- 
- 		pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
- 
- static void __init pagetable_init(void)
- {
--	pgd_t *pgd_base = swapper_pg_dir;
--
--	permanent_kmaps_init(pgd_base);
-+	permanent_kmaps_init(swapper_pg_dir);
- }
- 
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
-  * ACPI suspend needs this for resume, because things like the intel-agp
-  * driver might have split up a kernel 4MB mapping.
-  */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- 	__attribute__ ((aligned(PAGE_SIZE)));
- 
- static inline void save_pg_dir(void)
- {
--	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- 		flush_tlb_all();
- }
- 
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
- 
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
- 	 * Initialize the boot-time allocator (with low memory only):
- 	 */
- 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
--	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- 				 PAGE_SIZE);
- 	if (bootmap == -1L)
- 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -864,6 +863,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- 	BUG_ON(!mem_map);
- #endif
-@@ -881,7 +886,7 @@ void __init mem_init(void)
- 	set_highmem_pages_init();
- 
- 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
--	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
-+	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
- 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
- 
- 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +928,10 @@ void __init mem_init(void)
- 		((unsigned long)&__init_end -
- 		 (unsigned long)&__init_begin) >> 10,
- 
--		(unsigned long)&_etext, (unsigned long)&_edata,
--		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+		(unsigned long)&_sdata, (unsigned long)&_edata,
-+		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
- 
--		(unsigned long)&_text, (unsigned long)&_etext,
-+		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
- 
- 	/*
-@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read write\n",
- 		 start, start+size);
- 
-@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read only\n",
- 		 start, start+size);
- 
-@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
- 	unsigned long start = PFN_ALIGN(_text);
- 	unsigned long size = PFN_ALIGN(_etext) - start;
- 
-+	start = ktla_ktva(start);
- 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- 		size >> 10);
-diff -urNp linux-2.6.32.11/arch/x86/mm/init_64.c linux-2.6.32.11/arch/x86/mm/init_64.c
---- linux-2.6.32.11/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/init_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
- 	pmd = fill_pmd(pud, vaddr);
- 	pte = fill_pte(pmd, vaddr);
- 
-+	pax_open_kernel();
- 	set_pte(pte, new_pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
- 		pgd = pgd_offset_k((unsigned long)__va(phys));
- 		if (pgd_none(*pgd)) {
- 			pud = (pud_t *) spp_getpage();
--			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- 		}
- 		pud = pud_offset(pgd, (unsigned long)__va(phys));
- 		if (pud_none(*pud)) {
- 			pmd = (pmd_t *) spp_getpage();
--			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- 		}
- 		pmd = pmd_offset(pud, phys);
- 		BUG_ON(!pmd_none(*pmd));
-@@ -656,6 +656,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- 	/* clear_bss() already clear the empty_zero_page */
- 
- 	reservedpages = 0;
-@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- 	.vm_start	= VSYSCALL_START,
- 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
--	.vm_page_prot	= PAGE_READONLY_EXEC,
--	.vm_flags	= VM_READ | VM_EXEC
-+	.vm_page_prot	= PAGE_READONLY,
-+	.vm_flags	= VM_READ
- };
- 
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
- 	if (vma == &gate_vma)
- 		return "[vsyscall]";
-diff -urNp linux-2.6.32.11/arch/x86/mm/init.c linux-2.6.32.11/arch/x86/mm/init.c
---- linux-2.6.32.11/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/init.c	2010-04-04 20:46:41.533557286 -0400
-@@ -69,11 +69,7 @@ static void __init find_early_table_spac
- 	 * cause a hotspot and fill up ZONE_DMA. The page tables
- 	 * need roughly 0.5KB per GB.
- 	 */
--#ifdef CONFIG_X86_32
--	start = 0x7000;
--#else
--	start = 0x8000;
--#endif
-+	start = 0x100000;
- 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- 					tables, PAGE_SIZE);
- 	if (e820_table_start == -1UL)
-@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
-  */
- int devmem_is_allowed(unsigned long pagenr)
- {
--	if (pagenr <= 256)
-+	if (!pagenr)
-+		return 1;
-+#ifdef CONFIG_VM86
-+	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
-+		return 1;
-+#endif
-+	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 1;
- 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- 		return 0;
-@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
- 
- void free_initmem(void)
- {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+#ifdef CONFIG_X86_32
-+	/* PaX: limit KERNEL_CS to actual size */
-+	unsigned long addr, limit;
-+	struct desc_struct d;
-+	int cpu;
-+
-+	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+	limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+	}
-+
-+	/* PaX: make KERNEL_CS read-only */
-+	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+	if (!paravirt_enabled())
-+		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+			pgd = pgd_offset_k(addr);
-+			pud = pud_offset(pgd, addr);
-+			pmd = pmd_offset(pud, addr);
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		}
-+*/
-+#ifdef CONFIG_X86_PAE
-+	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+	unsigned long addr, end;
-+
-+	/* PaX: make kernel code/rodata read-only, rest non-executable */
-+	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+
-+	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+	end = addr + KERNEL_IMAGE_SIZE;
-+	for (; addr < end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+	flush_tlb_all();
-+#endif
-+
- 	free_init_pages("unused kernel memory",
- 			(unsigned long)(&__init_begin),
- 			(unsigned long)(&__init_end));
-diff -urNp linux-2.6.32.11/arch/x86/mm/iomap_32.c linux-2.6.32.11/arch/x86/mm/iomap_32.c
---- linux-2.6.32.11/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/iomap_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
- 	debug_kmap_atomic(type);
- 	idx = type + KM_TYPE_NR * smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+	pax_close_kernel();
-+
- 	arch_flush_lazy_mmu_mode();
- 
- 	return (void *)vaddr;
-diff -urNp linux-2.6.32.11/arch/x86/mm/ioremap.c linux-2.6.32.11/arch/x86/mm/ioremap.c
---- linux-2.6.32.11/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/ioremap.c	2010-04-04 20:46:41.533557286 -0400
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- 	 * Second special case: Some BIOSen report the PC BIOS
- 	 * area (640->1Mb) as ram even though it is not.
- 	 */
--	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
--		    pagenr < (BIOS_END >> PAGE_SHIFT))
-+	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 0;
- 
- 	for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
- 	/*
- 	 * Don't allow anybody to remap normal RAM that we're using..
- 	 */
--	for (pfn = phys_addr >> PAGE_SHIFT;
--				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
--				pfn++) {
--
-+	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- 		int is_ram = page_is_ram(pfn);
- 
--		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- 			return NULL;
- 		WARN_ON_ONCE(is_ram);
- 	}
-@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
- 
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
- 
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
- 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
- 
- 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
--	memset(bm_pte, 0, sizeof(bm_pte));
--	pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+	pmd_populate_user(&init_mm, pmd, bm_pte);
- 
- 	/*
- 	 * The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.32.11/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.11/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.32.11/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/kmemcheck/kmemcheck.c	2010-04-04 20:46:41.533557286 -0400
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
- 	 * memory (e.g. tracked pages)? For now, we need this to avoid
- 	 * invoking kmemcheck for PnP BIOS calls.
- 	 */
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		return false;
--	if (regs->cs != __KERNEL_CS)
-+	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- 		return false;
- 
- 	pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.32.11/arch/x86/mm/mmap.c linux-2.6.32.11/arch/x86/mm/mmap.c
---- linux-2.6.32.11/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/mmap.c	2010-04-04 20:46:41.537568318 -0400
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
-  * Leave an at least ~128 MB hole with possible stack randomization.
-  */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
- 
- /*
-  * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- 	return rnd << PAGE_SHIFT;
- }
- 
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (gap < MIN_GAP)
- 		gap = MIN_GAP;
- 	else if (gap > MAX_GAP)
- 		gap = MAX_GAP;
- 
--	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
- 
- /*
-  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
-  * does, but not when emulating X86_32
-  */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
--	if (mmap_is_ia32())
-+	if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+			return SEGMEXEC_TASK_UNMAPPED_BASE;
-+		else
-+#endif
-+
- 		return TASK_UNMAPPED_BASE;
--	else
-+	} else
- 		return TASK_UNMAPPED_BASE + mmap_rnd();
- }
- 
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	if (mmap_is_legacy()) {
--		mm->mmap_base = mmap_legacy_base();
-+		mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
--		mm->mmap_base = mmap_base();
-+		mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.11/arch/x86/mm/numa_32.c linux-2.6.32.11/arch/x86/mm/numa_32.c
---- linux-2.6.32.11/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/numa_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
- }
- #endif
- 
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
- 
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.32.11/arch/x86/mm/pageattr.c linux-2.6.32.11/arch/x86/mm/pageattr.c
---- linux-2.6.32.11/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/pageattr.c	2010-04-04 20:46:41.537568318 -0400
-@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
- 	 * Does not cover __inittext since that is gone later on. On
- 	 * 64bit we do not enforce !NX on the low mapping
- 	 */
--	if (within(address, (unsigned long)_text, (unsigned long)_etext))
-+	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
- 		pgprot_val(forbidden) |= _PAGE_NX;
- 
-+#ifdef CONFIG_DEBUG_RODATA
- 	/*
- 	 * The .rodata section needs to be read-only. Using the pfn
- 	 * catches all aliases.
-@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
- 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- 		pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
- 
- 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
- 
-@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- 	/* change init_mm */
-+	pax_open_kernel();
- 	set_pte_atomic(kpte, pte);
-+	pax_close_kernel();
-+
- #ifdef CONFIG_X86_32
- 	if (!SHARED_KERNEL_PMD) {
- 		struct page *page;
-diff -urNp linux-2.6.32.11/arch/x86/mm/pageattr-test.c linux-2.6.32.11/arch/x86/mm/pageattr-test.c
---- linux-2.6.32.11/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/pageattr-test.c	2010-04-04 20:46:41.537568318 -0400
-@@ -36,7 +36,7 @@ enum {
- 
- static int pte_testbit(pte_t pte)
- {
--	return pte_flags(pte) & _PAGE_UNUSED1;
-+	return pte_flags(pte) & _PAGE_CPA_TEST;
- }
- 
- struct split_state {
-diff -urNp linux-2.6.32.11/arch/x86/mm/pat.c linux-2.6.32.11/arch/x86/mm/pat.c
---- linux-2.6.32.11/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/pat.c	2010-04-04 20:46:41.537568318 -0400
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
- 
-  conflict:
- 	printk(KERN_INFO "%s:%d conflicting memory types "
--	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- 	       new->end, cattr_name(new->type), cattr_name(entry->type));
- 	return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
- 
- 	if (err) {
- 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
--			current->comm, current->pid, start, end);
-+			current->comm, task_pid_nr(current), start, end);
- 	}
- 
- 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
- 		printk(KERN_INFO
- 			"%s:%d ioremap_change_attr failed %s "
- 			"for %Lx-%Lx\n",
--			current->comm, current->pid,
-+			current->comm, task_pid_nr(current),
- 			cattr_name(flags),
- 			base, (unsigned long long)(base + size));
- 		return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
- 			free_memtype(paddr, paddr + size);
- 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- 				" for %Lx-%Lx, got %s\n",
--				current->comm, current->pid,
-+				current->comm, task_pid_nr(current),
- 				cattr_name(want_flags),
- 				(unsigned long long)paddr,
- 				(unsigned long long)(paddr + size),
-diff -urNp linux-2.6.32.11/arch/x86/mm/pgtable_32.c linux-2.6.32.11/arch/x86/mm/pgtable_32.c
---- linux-2.6.32.11/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/pgtable_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
- 		return;
- 	}
- 	pte = pte_offset_kernel(pmd, vaddr);
-+
-+	pax_open_kernel();
- 	if (pte_val(pteval))
- 		set_pte_at(&init_mm, vaddr, pte, pteval);
- 	else
- 		pte_clear(&init_mm, vaddr, pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-diff -urNp linux-2.6.32.11/arch/x86/mm/pgtable.c linux-2.6.32.11/arch/x86/mm/pgtable.c
---- linux-2.6.32.11/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/pgtable.c	2010-04-04 20:58:33.225084964 -0400
-@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
- #if PAGETABLE_LEVELS > 3
- void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
- 	tlb_remove_page(tlb, virt_to_page(pud));
-+#endif
-+
- }
- #endif	/* PAGETABLE_LEVELS > 3 */
- #endif	/* PAGETABLE_LEVELS > 2 */
-@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
- 	list_del(&page->lru);
- }
- 
--#define UNSHARED_PTRS_PER_PGD				\
--	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+	while (count--)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
-+#else
-+		*dst++ = *src++;
-+#endif
-+
-+}
-+
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	while (count--)
-+		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
-+#endif
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#ifdef CONFIG_X86_64
-+#define pxd_t				pud_t
-+#define pyd_t				pgd_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud)		pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
-+#define PYD_SIZE			PGDIR_SIZE
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud)		pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
-+#endif
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
-+#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
- 
- static void pgd_ctor(pgd_t *pgd)
- {
-@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
- 	pgd_list_del(pgd);
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- }
-+#endif
- 
- /*
-  * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * -- wli
-  */
- 
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
-  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
-  * updating the top-level pagetable entries to guarantee the
-@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
-  * and initialize the kernel pmds here.
-  */
--#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
- 
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
- 	if (mm == current->active_mm)
- 		write_cr3(read_cr3());
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS	USER_PGD_PTRS
- #else  /* !CONFIG_X86_PAE */
- 
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS	0
-+#define PREALLOCATED_PXDS	0
- 
- #endif	/* CONFIG_X86_PAE */
- 
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++)
--		if (pmds[i])
--			free_page((unsigned long)pmds[i]);
-+	for(i = 0; i < PREALLOCATED_PXDS; i++)
-+		if (pxds[i])
-+			free_page((unsigned long)pxds[i]);
- }
- 
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- 	int i;
- 	bool failed = false;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
--		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
--		if (pmd == NULL)
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+		if (pxd == NULL)
- 			failed = true;
--		pmds[i] = pmd;
-+		pxds[i] = pxd;
- 	}
- 
- 	if (failed) {
--		free_pmds(pmds);
-+		free_pxds(pxds);
- 		return -ENOMEM;
- 	}
- 
-@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
-  * preallocate which never got a corresponding vma will need to be
-  * freed manually.
-  */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
- 		pgd_t pgd = pgdp[i];
- 
- 		if (pgd_val(pgd) != 0) {
--			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
- 
--			pgdp[i] = native_make_pgd(0);
-+			set_pgd(pgdp + i, native_make_pgd(0));
- 
--			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
--			pmd_free(mm, pmd);
-+			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+			pxd_free(mm, pxd);
- 		}
- 	}
- }
- 
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
--	pud_t *pud;
-+	pyd_t *pyd;
- 	unsigned long addr;
- 	int i;
- 
--	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- 		return;
- 
--	pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+	pyd = pyd_offset(mm, 0L);
-+#else
-+	pyd = pyd_offset(pgd, 0L);
-+#endif
- 
-- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
--	     i++, pud++, addr += PUD_SIZE) {
--		pmd_t *pmd = pmds[i];
-+ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
-+	     i++, pyd++, addr += PYD_SIZE) {
-+		pxd_t *pxd = pxds[i];
- 
- 		if (i >= KERNEL_PGD_BOUNDARY)
--			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
--			       sizeof(pmd_t) * PTRS_PER_PMD);
-+			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+			       sizeof(pxd_t) * PTRS_PER_PMD);
- 
--		pud_populate(mm, pud, pmd);
-+		pyd_populate(mm, pyd, pxd);
- 	}
- }
- 
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- 	pgd_t *pgd;
--	pmd_t *pmds[PREALLOCATED_PMDS];
-+	pxd_t *pxds[PREALLOCATED_PXDS];
-+
- 	unsigned long flags;
- 
- 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 
- 	mm->pgd = pgd;
- 
--	if (preallocate_pmds(pmds) != 0)
-+	if (preallocate_pxds(pxds) != 0)
- 		goto out_free_pgd;
- 
- 	if (paravirt_pgd_alloc(mm) != 0)
--		goto out_free_pmds;
-+		goto out_free_pxds;
- 
- 	/*
- 	 * Make sure that pre-populating the pmds is atomic with
-@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 	spin_lock_irqsave(&pgd_lock, flags);
- 
- 	pgd_ctor(pgd);
--	pgd_prepopulate_pmd(mm, pgd, pmds);
-+	pgd_prepopulate_pxd(mm, pgd, pxds);
- 
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- 
- 	return pgd;
- 
--out_free_pmds:
--	free_pmds(pmds);
-+out_free_pxds:
-+	free_pxds(pxds);
- out_free_pgd:
- 	free_page((unsigned long)pgd);
- out:
-@@ -288,7 +354,7 @@ out:
- 
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
--	pgd_mop_up_pmds(mm, pgd);
-+	pgd_mop_up_pxds(mm, pgd);
- 	pgd_dtor(pgd);
- 	paravirt_pgd_free(mm, pgd);
- 	free_page((unsigned long)pgd);
-diff -urNp linux-2.6.32.11/arch/x86/mm/setup_nx.c linux-2.6.32.11/arch/x86/mm/setup_nx.c
---- linux-2.6.32.11/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/setup_nx.c	2010-04-04 20:46:41.537568318 -0400
-@@ -4,11 +4,10 @@
- 
- #include <asm/pgtable.h>
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
- 
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
-  * noexec = on|off
-  *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
- 	if (!str)
- 		return -EINVAL;
- 	if (!strncmp(str, "on", 2)) {
--		__supported_pte_mask |= _PAGE_NX;
--		disable_nx = 0;
-+		nx_enabled = 1;
- 	} else if (!strncmp(str, "off", 3)) {
--		disable_nx = 1;
--		__supported_pte_mask &= ~_PAGE_NX;
-+		nx_enabled = 0;
- 	}
- 	return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
- 
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
--	unsigned int v[4], l, h;
-+	if (!nx_enabled && cpu_has_nx) {
-+		unsigned l, h;
- 
--	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
--		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
--		if ((v[3] & (1 << 20)) && !disable_nx) {
--			rdmsr(MSR_EFER, l, h);
--			l |= EFER_NX;
--			wrmsr(MSR_EFER, l, h);
--			nx_enabled = 1;
--			__supported_pte_mask |= _PAGE_NX;
--		}
-+		__supported_pte_mask &= ~_PAGE_NX;
-+		rdmsr(MSR_EFER, l, h);
-+		l &= ~EFER_NX;
-+		wrmsr(MSR_EFER, l, h);
- 	}
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- 	unsigned long efer;
- 
- 	rdmsrl(MSR_EFER, efer);
--	if (!(efer & EFER_NX) || disable_nx)
-+	if (!(efer & EFER_NX) || !nx_enabled)
- 		__supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff -urNp linux-2.6.32.11/arch/x86/mm/tlb.c linux-2.6.32.11/arch/x86/mm/tlb.c
---- linux-2.6.32.11/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/mm/tlb.c	2010-04-04 20:58:33.225084964 -0400
-@@ -12,7 +12,7 @@
- #include <asm/uv/uv.h>
- 
- DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
--			= { &init_mm, 0, };
-+			= { &init_mm, 0 };
- 
- /*
-  *	Smarter SMP flushing macros.
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- 		BUG();
- 	cpumask_clear_cpu(cpu,
- 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
- 
-diff -urNp linux-2.6.32.11/arch/x86/oprofile/backtrace.c linux-2.6.32.11/arch/x86/oprofile/backtrace.c
---- linux-2.6.32.11/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/oprofile/backtrace.c	2010-04-04 20:46:41.537568318 -0400
-@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
- 	struct frame_head bufhead[2];
- 
- 	/* Also check accessibility of one struct frame_head beyond */
--	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
-+	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
- 		return NULL;
- 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
- 		return NULL;
-@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
- {
- 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
- 
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned long stack = kernel_stack_pointer(regs);
- 		if (depth)
- 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff -urNp linux-2.6.32.11/arch/x86/oprofile/op_model_p4.c linux-2.6.32.11/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.32.11/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/oprofile/op_model_p4.c	2010-04-04 20:46:41.537568318 -0400
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
- #endif
- }
- 
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- 	return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.32.11/arch/x86/pci/common.c linux-2.6.32.11/arch/x86/pci/common.c
---- linux-2.6.32.11/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/common.c	2010-04-04 20:46:41.537568318 -0400
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
- 
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val)
-@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- void __init dmi_check_pciprobe(void)
-diff -urNp linux-2.6.32.11/arch/x86/pci/direct.c linux-2.6.32.11/arch/x86/pci/direct.c
---- linux-2.6.32.11/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/direct.c	2010-04-04 20:46:41.537568318 -0400
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
- 
- #undef PCI_CONF1_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- 	.read =		pci_conf1_read,
- 	.write =	pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
- 
- #undef PCI_CONF2_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- 	.read =		pci_conf2_read,
- 	.write =	pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
-  * This should be close to trivial, but it isn't, because there are buggy
-  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
-  */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- 	u32 x = 0;
- 	int year, devfn;
-diff -urNp linux-2.6.32.11/arch/x86/pci/fixup.c linux-2.6.32.11/arch/x86/pci/fixup.c
---- linux-2.6.32.11/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/fixup.c	2010-04-04 20:46:41.537568318 -0400
-@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
-diff -urNp linux-2.6.32.11/arch/x86/pci/irq.c linux-2.6.32.11/arch/x86/pci/irq.c
---- linux-2.6.32.11/arch/x86/pci/irq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/irq.c	2010-04-04 20:46:41.537568318 -0400
-@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
- 	static struct pci_device_id __initdata pirq_440gx[] = {
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
--		{ },
-+		{ PCI_DEVICE(0, 0) }
- 	};
- 
- 	/* 440GX has a proprietary PIRQ router -- don't use it */
-@@ -1107,7 +1107,7 @@ static struct dmi_system_id __initdata p
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- int __init pcibios_irq_init(void)
-diff -urNp linux-2.6.32.11/arch/x86/pci/mmconfig_32.c linux-2.6.32.11/arch/x86/pci/mmconfig_32.c
---- linux-2.6.32.11/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/mmconfig_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.11/arch/x86/pci/mmconfig_64.c linux-2.6.32.11/arch/x86/pci/mmconfig_64.c
---- linux-2.6.32.11/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/mmconfig_64.c	2010-04-04 20:46:41.537568318 -0400
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.11/arch/x86/pci/numaq_32.c linux-2.6.32.11/arch/x86/pci/numaq_32.c
---- linux-2.6.32.11/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/numaq_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
- 
- #undef PCI_CONF1_MQ_ADDRESS
- 
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- 	.read	= pci_conf1_mq_read,
- 	.write	= pci_conf1_mq_write
- };
-diff -urNp linux-2.6.32.11/arch/x86/pci/olpc.c linux-2.6.32.11/arch/x86/pci/olpc.c
---- linux-2.6.32.11/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/olpc.c	2010-04-04 20:46:41.537568318 -0400
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- 	.read =	pci_olpc_read,
- 	.write = pci_olpc_write,
- };
-diff -urNp linux-2.6.32.11/arch/x86/pci/pcbios.c linux-2.6.32.11/arch/x86/pci/pcbios.c
---- linux-2.6.32.11/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/pci/pcbios.c	2010-04-04 20:46:41.537568318 -0400
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
- 
- /*
-  * Returns the entry point for the given service, NULL on error
-  */
- 
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- 	unsigned char return_code;	/* %al */
- 	unsigned long address;		/* %ebx */
- 	unsigned long length;		/* %ecx */
- 	unsigned long entry;		/* %edx */
- 	unsigned long flags;
-+	struct desc_struct d, *gdt;
- 
- 	local_irq_save(flags);
--	__asm__("lcall *(%%edi); cld"
-+
-+	gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- 		: "=a" (return_code),
- 		  "=b" (address),
- 		  "=c" (length),
- 		  "=d" (entry)
- 		: "0" (service),
- 		  "1" (0),
--		  "D" (&bios32_indirect));
-+		  "D" (&bios32_indirect),
-+		  "r"(__PCIBIOS_DS)
-+		: "memory");
-+
-+	pax_open_kernel();
-+	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+	pax_close_kernel();
-+
- 	local_irq_restore(flags);
- 
- 	switch (return_code) {
--		case 0:
--			return address + entry;
--		case 0x80:	/* Not present */
--			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
--			return 0;
--		default: /* Shouldn't happen */
--			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
--				service, return_code);
-+	case 0: {
-+		int cpu;
-+		unsigned char flags;
-+
-+		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+			printk(KERN_WARNING "bios32_service: not valid\n");
- 			return 0;
-+		}
-+		address = address + PAGE_OFFSET;
-+		length += 16UL; /* some BIOSs underreport this... */
-+		flags = 4;
-+		if (length >= 64*1024*1024) {
-+			length >>= PAGE_SHIFT;
-+			flags |= 8;
-+		}
-+
-+		for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+			gdt = get_cpu_gdt_table(cpu);
-+			pack_descriptor(&d, address, length, 0x9b, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+			pack_descriptor(&d, address, length, 0x93, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+		}
-+		return entry;
-+	}
-+	case 0x80:	/* Not present */
-+		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+		return 0;
-+	default: /* Shouldn't happen */
-+		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+			service, return_code);
-+		return 0;
- 	}
- }
- 
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
- 
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
- 
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- 	unsigned long flags, pcibios_entry;
- 
- 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
--		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+		pci_indirect.address = pcibios_entry;
- 
- 		local_irq_save(flags);
--		__asm__(
--			"lcall *(%%edi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%edi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- 			  "=b" (ebx),
- 			  "=c" (ecx)
- 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
--			  "D" (&pci_indirect)
-+			  "D" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS)
- 			: "memory");
- 		local_irq_restore(flags);
- 
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 8 bits, do not trust the
- 		 * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xff;
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_WORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 16 bits, do not trust the
- 		 * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xffff;
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
-  * Function table for BIOS32 access
-  */
- 
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- 	.read =		pci_bios_read,
- 	.write =	pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
-  * Try to find PCI BIOS.
-  */
- 
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- 	union bios32 *check;
- 	unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
- 
- 	DBG("PCI: Fetching IRQ routing table... ");
- 	__asm__("push %%es\n\t"
-+		"movw %w8, %%ds\n\t"
- 		"push %%ds\n\t"
- 		"pop  %%es\n\t"
--		"lcall *(%%esi); cld\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
- 		"pop %%es\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
- 		  "1" (0),
- 		  "D" ((long) &opt),
- 		  "S" (&pci_indirect),
--		  "m" (opt)
-+		  "m" (opt),
-+		  "r" (__PCIBIOS_DS)
- 		: "memory");
- 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- 	if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
- {
- 	int ret;
- 
--	__asm__("lcall *(%%esi); cld\n\t"
-+	__asm__("movw %w5, %%ds\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
- 		: "0" (PCIBIOS_SET_PCI_HW_INT),
- 		  "b" ((dev->bus->number << 8) | dev->devfn),
- 		  "c" ((irq << 8) | (pin + 10)),
--		  "S" (&pci_indirect));
-+		  "S" (&pci_indirect),
-+		  "r" (__PCIBIOS_DS));
- 	return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.32.11/arch/x86/power/cpu.c linux-2.6.32.11/arch/x86/power/cpu.c
---- linux-2.6.32.11/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/power/cpu.c	2010-04-04 20:46:41.537568318 -0400
-@@ -126,7 +126,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- 	int cpu = smp_processor_id();
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 
- 	set_tss_desc(cpu, t);	/*
- 				 * This just modifies memory; should not be
-@@ -136,7 +136,9 @@ static void fix_processor_context(void)
- 				 */
- 
- #ifdef CONFIG_X86_64
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
-+	pax_close_kernel();
- 
- 	syscall_init();				/* This sets MSR_*STAR and related */
- #endif
-diff -urNp linux-2.6.32.11/arch/x86/vdso/Makefile linux-2.6.32.11/arch/x86/vdso/Makefile
---- linux-2.6.32.11/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/Makefile	2010-04-04 20:46:41.537568318 -0400
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
- 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
- 
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
- 
- #
-diff -urNp linux-2.6.32.11/arch/x86/vdso/vclock_gettime.c linux-2.6.32.11/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.32.11/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/vclock_gettime.c	2010-04-04 20:46:41.541133870 -0400
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
- 
- #define gtod vdso_vsyscall_gtod_data
- 
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+	long secs;
-+	asm volatile("syscall"
-+		: "=a" (secs)
-+		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+	return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- 	long ret;
- 	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- 	return ret;
- }
- 
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+	cycle_t ret = (cycle_t)vget_cycles();
-+
-+	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- 	long v;
--	cycles_t (*vread)(void);
--	vread = gtod->clock.vread;
--	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+		v = __vdso_vread_tsc();
-+	else
-+		v = __vdso_vread_hpet();
-+	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- 	return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
- 
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
- 
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
--	if (likely(gtod->sysctl_enabled))
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- 		switch (clock) {
- 		case CLOCK_REALTIME:
- 			if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
- int clock_gettime(clockid_t, struct timespec *)
- 	__attribute__((weak, alias("__vdso_clock_gettime")));
- 
--notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
- 	long ret;
--	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+	asm("syscall" : "=a" (ret) :
-+	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+	return ret;
-+}
-+
-+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+	{
- 		if (likely(tv != NULL)) {
- 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- 				     offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
- 		}
- 		return 0;
- 	}
--	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
--	return ret;
-+	return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- 	__attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.32.11/arch/x86/vdso/vdso32-setup.c linux-2.6.32.11/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.32.11/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/vdso32-setup.c	2010-04-04 20:46:41.541133870 -0400
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
- 
- enum {
- 	VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
- void enable_sep_cpu(void)
- {
- 	int cpu = get_cpu();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 
- 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
- 		put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
- 	if (compat)
- 		addr = VDSO_HIGH_BASE;
- 	else {
--		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- 		if (IS_ERR_VALUE(addr)) {
- 			ret = addr;
- 			goto up_fail;
- 		}
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	if (compat_uses_vma || !compat) {
- 		/*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
- 	}
- 
- 	current_thread_info()->sysenter_return =
--		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
- 
-   up_fail:
- 	if (ret)
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 
- 	up_write(&mm->mmap_sem);
- 
-@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table abi_root_table2[] = {
-@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
- 		.mode = 0555,
- 		.child = abi_table2
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static __init int ia32_binfmt_init(void)
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+		return "[vdso]";
-+#endif
-+
- 	return NULL;
- }
- 
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
- 	struct mm_struct *mm = tsk->mm;
- 
- 	/* Check to see if this task was created in compat vdso mode */
--	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- 		return &gate_vma;
- 	return NULL;
- }
-diff -urNp linux-2.6.32.11/arch/x86/vdso/vdso.lds.S linux-2.6.32.11/arch/x86/vdso/vdso.lds.S
---- linux-2.6.32.11/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/vdso.lds.S	2010-04-04 20:46:41.541133870 -0400
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef	VEXTERN
-+
-+#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef	VEXTERN
-diff -urNp linux-2.6.32.11/arch/x86/vdso/vextern.h linux-2.6.32.11/arch/x86/vdso/vextern.h
---- linux-2.6.32.11/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/vextern.h	2010-04-04 20:46:41.541133870 -0400
-@@ -11,6 +11,5 @@
-    put into vextern.h and be referenced as a pointer with vdso prefix.
-    The main kernel later fills in the values.   */
- 
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.32.11/arch/x86/vdso/vma.c linux-2.6.32.11/arch/x86/vdso/vma.c
---- linux-2.6.32.11/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/vdso/vma.c	2010-04-04 20:46:41.541133870 -0400
-@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
- 	if (!vbase)
- 		goto oom;
- 
--	if (memcmp(vbase, "\177ELF", 4)) {
-+	if (memcmp(vbase, ELFMAG, SELFMAG)) {
- 		printk("VDSO: I'm broken; not ELF\n");
- 		vdso_enabled = 0;
- 	}
-@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
- 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+	vunmap(vbase);
- 	return 0;
- 
-  oom:
-@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
- 		goto up_fail;
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	ret = install_special_mapping(mm, addr, vdso_size,
- 				      VM_READ|VM_EXEC|
-@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
- 				      VM_ALWAYSDUMP,
- 				      vdso_pages);
- 	if (ret) {
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 		goto up_fail;
- 	}
- 
-@@ -132,10 +133,3 @@ up_fail:
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
--	vdso_enabled = simple_strtoul(s, NULL, 0);
--	return 0;
--}
--__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.32.11/arch/x86/xen/enlighten.c linux-2.6.32.11/arch/x86/xen/enlighten.c
---- linux-2.6.32.11/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/xen/enlighten.c	2010-04-04 20:46:41.541133870 -0400
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
- 
- struct shared_info xen_dummy_shared_info;
- 
--void *xen_initial_gdt;
--
- /*
-  * Point at some empty memory to start with. We map the real shared_info
-  * page as soon as fixmap is up and running.
-@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
- 
- 	preempt_disable();
- 
--	start = __get_cpu_var(idt_desc).address;
-+	start = (unsigned long)__get_cpu_var(idt_desc).address;
- 	end = start + __get_cpu_var(idt_desc).size + 1;
- 
- 	xen_mc_flush();
-@@ -1133,13 +1131,6 @@ asmlinkage void __init xen_start_kernel(
- 
- 	machine_ops = xen_machine_ops;
- 
--	/*
--	 * The only reliable way to retain the initial address of the
--	 * percpu gdt_page is to remember it here, so we can go and
--	 * mark it RW later, when the initial percpu area is freed.
--	 */
--	xen_initial_gdt = &per_cpu(gdt_page, 0);
--
- 	xen_smp_init();
- 
- 	pgd = (pgd_t *)xen_start_info->pt_base;
-diff -urNp linux-2.6.32.11/arch/x86/xen/mmu.c linux-2.6.32.11/arch/x86/xen/mmu.c
---- linux-2.6.32.11/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/xen/mmu.c	2010-04-04 20:46:41.541133870 -0400
-@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	convert_pfn_mfn(init_level4_pgt);
- 	convert_pfn_mfn(level3_ident_pgt);
- 	convert_pfn_mfn(level3_kernel_pgt);
-+	convert_pfn_mfn(level3_vmalloc_pgt);
-+	convert_pfn_mfn(level3_vmemmap_pgt);
- 
- 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
- 
-diff -urNp linux-2.6.32.11/arch/x86/xen/smp.c linux-2.6.32.11/arch/x86/xen/smp.c
---- linux-2.6.32.11/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/xen/smp.c	2010-04-04 20:46:41.541133870 -0400
-@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
- {
- 	BUG_ON(smp_processor_id() != 0);
- 	native_smp_prepare_boot_cpu();
--
--	/* We've switched to the "real" per-cpu gdt, so make sure the
--	   old memory can be recycled */
--	make_lowmem_page_readwrite(xen_initial_gdt);
--
- 	xen_setup_vcpu_info_placement();
- }
- 
-@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
- 	gdt = get_cpu_gdt_table(cpu);
- 
- 	ctxt->flags = VGCF_IN_KERNEL;
--	ctxt->user_regs.ds = __USER_DS;
--	ctxt->user_regs.es = __USER_DS;
-+	ctxt->user_regs.ds = __KERNEL_DS;
-+	ctxt->user_regs.es = __KERNEL_DS;
- 	ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- 	ctxt->user_regs.fs = __KERNEL_PERCPU;
-diff -urNp linux-2.6.32.11/arch/x86/xen/xen-ops.h linux-2.6.32.11/arch/x86/xen/xen-ops.h
---- linux-2.6.32.11/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/arch/x86/xen/xen-ops.h	2010-04-04 20:46:41.541133870 -0400
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
- 
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
- 
-diff -urNp linux-2.6.32.11/block/blk-integrity.c linux-2.6.32.11/block/blk-integrity.c
---- linux-2.6.32.11/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/blk-integrity.c	2010-04-04 20:46:41.541133870 -0400
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
- 	NULL,
- };
- 
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- 	.show	= &integrity_attr_show,
- 	.store	= &integrity_attr_store,
- };
-diff -urNp linux-2.6.32.11/block/blk-iopoll.c linux-2.6.32.11/block/blk-iopoll.c
---- linux-2.6.32.11/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/blk-iopoll.c	2010-04-04 20:46:41.541133870 -0400
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
- 
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- 	int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.32.11/block/blk-map.c linux-2.6.32.11/block/blk-map.c
---- linux-2.6.32.11/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/blk-map.c	2010-04-04 20:46:41.541133870 -0400
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
- 	 * direct dma. else, set up kernel bounce buffers
- 	 */
- 	uaddr = (unsigned long) ubuf;
--	if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- 	else
- 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
- 	if (!len || !kbuf)
- 		return -EINVAL;
- 
--	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- 	if (do_copy)
- 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- 	else
-diff -urNp linux-2.6.32.11/block/blk-softirq.c linux-2.6.32.11/block/blk-softirq.c
---- linux-2.6.32.11/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/blk-softirq.c	2010-04-04 20:46:41.541133870 -0400
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
-  * Softirq action handler - move entries to local list and loop over them
-  * while passing them to the queue registered handler.
-  */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- 	struct list_head *cpu_list, local_list;
- 
-diff -urNp linux-2.6.32.11/block/blk-sysfs.c linux-2.6.32.11/block/blk-sysfs.c
---- linux-2.6.32.11/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/blk-sysfs.c	2010-04-04 20:46:41.541133870 -0400
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
- 	kmem_cache_free(blk_requestq_cachep, q);
- }
- 
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- 	.show	= queue_attr_show,
- 	.store	= queue_attr_store,
- };
-diff -urNp linux-2.6.32.11/block/elevator.c linux-2.6.32.11/block/elevator.c
---- linux-2.6.32.11/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/block/elevator.c	2010-04-04 20:46:41.541133870 -0400
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
- 	return error;
- }
- 
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- 	.show	= elv_attr_show,
- 	.store	= elv_attr_store,
- };
-diff -urNp linux-2.6.32.11/crypto/lrw.c linux-2.6.32.11/crypto/lrw.c
---- linux-2.6.32.11/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/crypto/lrw.c	2010-04-04 20:46:41.541133870 -0400
-@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
- 	struct priv *ctx = crypto_tfm_ctx(parent);
- 	struct crypto_cipher *child = ctx->child;
- 	int err, i;
--	be128 tmp = { 0 };
-+	be128 tmp = { 0, 0 };
- 	int bsize = crypto_cipher_blocksize(child);
- 
- 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
-diff -urNp linux-2.6.32.11/Documentation/dontdiff linux-2.6.32.11/Documentation/dontdiff
---- linux-2.6.32.11/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/Documentation/dontdiff	2010-04-04 20:47:28.952733264 -0400
-@@ -3,6 +3,7 @@
- *.bin
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
-@@ -40,6 +41,7 @@
- *.ver
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
-@@ -49,11 +51,16 @@
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -76,7 +83,10 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -103,13 +113,14 @@ gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
- keywords.c
- ksym.c*
- ksym.h*
-@@ -133,7 +144,9 @@ mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +162,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -163,6 +177,7 @@ setup
- setup.bin
- setup.elf
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -186,14 +201,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff -urNp linux-2.6.32.11/Documentation/kernel-parameters.txt linux-2.6.32.11/Documentation/kernel-parameters.txt
---- linux-2.6.32.11/Documentation/kernel-parameters.txt	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/Documentation/kernel-parameters.txt	2010-04-04 20:46:41.541133870 -0400
-@@ -1833,6 +1833,12 @@ and is between 256 and 4096 characters. 
- 			the specified number of seconds.  This is to be used if
- 			your oopses keep scrolling off the screen.
- 
-+	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
-+			virtualization environments that don't cope well with the
-+			expand down segment used by UDEREF on X86-32.
-+
-+	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
-+
- 	pcbit=		[HW,ISDN]
- 
- 	pcd.		[PARIDE]
-diff -urNp linux-2.6.32.11/drivers/acpi/battery.c linux-2.6.32.11/drivers/acpi/battery.c
---- linux-2.6.32.11/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/battery.c	2010-04-04 20:46:41.541133870 -0400
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- 	}
- 
- static struct battery_file {
--	struct file_operations ops;
-+	const struct file_operations ops;
- 	mode_t mode;
- 	const char *name;
- } acpi_battery_file[] = {
-diff -urNp linux-2.6.32.11/drivers/acpi/blacklist.c linux-2.6.32.11/drivers/acpi/blacklist.c
---- linux-2.6.32.11/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/blacklist.c	2010-04-04 20:46:41.541133870 -0400
-@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
- 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
- 	 "Incorrect _ADR", 1},
- 
--	{""}
-+	{"", "", 0, NULL, all_versions, NULL, 0}
- };
- 
- #if	CONFIG_ACPI_BLACKLIST_YEAR
-diff -urNp linux-2.6.32.11/drivers/acpi/dock.c linux-2.6.32.11/drivers/acpi/dock.c
---- linux-2.6.32.11/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/dock.c	2010-04-04 20:46:41.544756868 -0400
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- 	struct list_head list;
- 	struct list_head hotplug_list;
- 	acpi_handle handle;
--	struct acpi_dock_ops *ops;
-+	const struct acpi_dock_ops *ops;
- 	void *context;
- };
- 
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
-  * the dock driver after _DCK is executed.
-  */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- 			     void *context)
- {
- 	struct dock_dependent_device *dd;
-diff -urNp linux-2.6.32.11/drivers/acpi/osl.c linux-2.6.32.11/drivers/acpi/osl.c
---- linux-2.6.32.11/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/osl.c	2010-04-04 20:46:41.544756868 -0400
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 	if (!value)
- 		value = &dummy;
- 
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 
- 	switch (width) {
- 	case 8:
-diff -urNp linux-2.6.32.11/drivers/acpi/processor_core.c linux-2.6.32.11/drivers/acpi/processor_core.c
---- linux-2.6.32.11/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/processor_core.c	2010-04-04 20:46:41.544756868 -0400
-@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
- 		return 0;
- 	}
- 
--	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+	BUG_ON(pr->id >= nr_cpu_ids);
- 
- 	/*
- 	 * Buggy BIOS check
-diff -urNp linux-2.6.32.11/drivers/acpi/processor_idle.c linux-2.6.32.11/drivers/acpi/processor_idle.c
---- linux-2.6.32.11/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/processor_idle.c	2010-04-04 20:46:41.544756868 -0400
-@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
- 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
- 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
- 	 (void *)1},
--	{},
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
- };
- 
- 
-diff -urNp linux-2.6.32.11/drivers/acpi/sleep.c linux-2.6.32.11/drivers/acpi/sleep.c
---- linux-2.6.32.11/drivers/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/sleep.c	2010-04-04 20:46:41.544756868 -0400
-@@ -297,7 +297,7 @@ static int acpi_suspend_state_valid(susp
- 	}
- }
- 
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin,
- 	.prepare_late = acpi_pm_prepare,
-@@ -325,7 +325,7 @@ static int acpi_suspend_begin_old(suspen
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin_old,
- 	.prepare_late = acpi_pm_disable_gpes,
-@@ -552,7 +552,7 @@ static void acpi_pm_enable_gpes(void)
- 	acpi_enable_all_runtime_gpes();
- }
- 
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- 	.begin = acpi_hibernation_begin,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -605,7 +605,7 @@ static int acpi_hibernation_pre_snapshot
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- 	.begin = acpi_hibernation_begin_old,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff -urNp linux-2.6.32.11/drivers/acpi/video.c linux-2.6.32.11/drivers/acpi/video.c
---- linux-2.6.32.11/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/acpi/video.c	2010-04-04 20:46:41.544756868 -0400
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
- 				vd->brightness->levels[request_level]);
- }
- 
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- 	.get_brightness = acpi_video_get_brightness,
- 	.update_status  = acpi_video_set_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/ahci.c linux-2.6.32.11/drivers/ata/ahci.c
---- linux-2.6.32.11/drivers/ata/ahci.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.11/drivers/ata/ahci.c	2010-04-04 20:46:41.544756868 -0400
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
- 	.sdev_attrs		= ahci_sdev_attrs,
- };
- 
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
- 	.port_stop		= ahci_port_stop,
- };
- 
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_vt8251_hardreset,
- };
- 
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_p5wdh_hardreset,
- };
- 
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- 	.inherits		= &ahci_ops,
- 	.softreset		= ahci_sb600_softreset,
- 	.pmp_softreset		= ahci_sb600_softreset,
-@@ -681,7 +681,7 @@ static const struct pci_device_id ahci_p
- 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
- 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
- 
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- 
-diff -urNp linux-2.6.32.11/drivers/ata/ata_generic.c linux-2.6.32.11/drivers/ata/ata_generic.c
---- linux-2.6.32.11/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/ata_generic.c	2010-04-04 20:46:41.544756868 -0400
-@@ -95,7 +95,7 @@ static struct scsi_host_template generic
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_mode	= generic_set_mode,
-diff -urNp linux-2.6.32.11/drivers/ata/ata_piix.c linux-2.6.32.11/drivers/ata/ata_piix.c
---- linux-2.6.32.11/drivers/ata/ata_piix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/ata_piix.c	2010-04-04 20:46:41.544756868 -0400
-@@ -291,7 +291,7 @@ static const struct pci_device_id piix_p
- 	{ 0x8086, 0x3b2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
- 	/* SATA Controller IDE (PCH) */
- 	{ 0x8086, 0x3b2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- static struct pci_driver piix_pci_driver = {
-@@ -309,7 +309,7 @@ static struct scsi_host_template piix_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= piix_set_piomode,
-@@ -317,22 +317,22 @@ static struct ata_port_operations piix_p
- 	.prereset		= piix_pata_prereset,
- };
- 
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.bmdma_status		= piix_vmw_bmdma_status,
- };
- 
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.cable_detect		= ich_pata_cable_detect,
- 	.set_dmamode		= ich_set_dmamode,
- };
- 
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- };
- 
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- 	.inherits		= &piix_sata_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= piix_sidpr_scr_read,
-@@ -608,7 +608,7 @@ static const struct ich_laptop ich_lapto
- 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
- 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
- 	/* end marker */
--	{ 0, }
-+	{ 0, 0, 0 }
- };
- 
- /**
-@@ -1086,7 +1086,7 @@ static int piix_broken_suspend(void)
- 			},
- 		},
- 
--		{ }	/* terminate list */
-+		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
- 	};
- 	static const char *oemstrs[] = {
- 		"Tecra M3,",
-diff -urNp linux-2.6.32.11/drivers/ata/libata-acpi.c linux-2.6.32.11/drivers/ata/libata-acpi.c
---- linux-2.6.32.11/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/libata-acpi.c	2010-04-04 20:46:41.544756868 -0400
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
- 	ata_acpi_uevent(dev->link->ap, dev, event);
- }
- 
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- 	.handler = ata_acpi_dev_notify_dock,
- 	.uevent = ata_acpi_dev_uevent,
- };
- 
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- 	.handler = ata_acpi_ap_notify_dock,
- 	.uevent = ata_acpi_ap_uevent,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/libata-core.c linux-2.6.32.11/drivers/ata/libata-core.c
---- linux-2.6.32.11/drivers/ata/libata-core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/libata-core.c	2010-04-04 20:46:41.544756868 -0400
-@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
- 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
- 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
- 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
--	{ -1, },
-+	{ -1, 0, 0 }
- };
- 
- /**
-@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
- 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
- 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
- 
--	{ 0xFF }
-+	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
-@@ -4385,7 +4385,7 @@ static const struct ata_blacklist_entry 
- 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
- 
- 	/* End Marker */
--	{ }
-+	{ NULL, NULL, 0 }
- };
- 
- static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
-@@ -5961,7 +5961,7 @@ static void ata_host_stop(struct device 
-  *	LOCKING:
-  *	None.
-  */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- 	static DEFINE_SPINLOCK(lock);
- 	const struct ata_port_operations *cur;
-@@ -5973,6 +5973,7 @@ static void ata_finalize_port_ops(struct
- 		return;
- 
- 	spin_lock(&lock);
-+	pax_open_kernel();
- 
- 	for (cur = ops->inherits; cur; cur = cur->inherits) {
- 		void **inherit = (void **)cur;
-@@ -5986,8 +5987,9 @@ static void ata_finalize_port_ops(struct
- 		if (IS_ERR(*pp))
- 			*pp = NULL;
- 
--	ops->inherits = NULL;
-+	((struct ata_port_operations *)ops)->inherits = NULL;
- 
-+	pax_close_kernel();
- 	spin_unlock(&lock);
- }
- 
-@@ -6084,7 +6086,7 @@ int ata_host_start(struct ata_host *host
-  */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
--		   unsigned long flags, struct ata_port_operations *ops)
-+		   unsigned long flags, const struct ata_port_operations *ops)
- {
- 	spin_lock_init(&host->lock);
- 	host->dev = dev;
-@@ -6747,7 +6749,7 @@ static void ata_dummy_error_handler(stru
- 	/* truly dummy */
- }
- 
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- 	.qc_prep		= ata_noop_qc_prep,
- 	.qc_issue		= ata_dummy_qc_issue,
- 	.error_handler		= ata_dummy_error_handler,
-diff -urNp linux-2.6.32.11/drivers/ata/libata-eh.c linux-2.6.32.11/drivers/ata/libata-eh.c
---- linux-2.6.32.11/drivers/ata/libata-eh.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/libata-eh.c	2010-04-04 20:46:41.544756868 -0400
-@@ -3581,7 +3581,7 @@ void ata_do_eh(struct ata_port *ap, ata_
-  */
- void ata_std_error_handler(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	ata_reset_fn_t hardreset = ops->hardreset;
- 
- 	/* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.32.11/drivers/ata/libata-pmp.c linux-2.6.32.11/drivers/ata/libata-pmp.c
---- linux-2.6.32.11/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/libata-pmp.c	2010-04-04 20:46:41.544756868 -0400
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
-  */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- 	struct ata_link *pmp_link = &ap->link;
- 	struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.32.11/drivers/ata/pata_acpi.c linux-2.6.32.11/drivers/ata/pata_acpi.c
---- linux-2.6.32.11/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_acpi.c	2010-04-04 20:46:41.549452547 -0400
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= pacpi_qc_issue,
- 	.cable_detect		= pacpi_cable_detect,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_ali.c linux-2.6.32.11/drivers/ata/pata_ali.c
---- linux-2.6.32.11/drivers/ata/pata_ali.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_ali.c	2010-04-04 20:46:41.549452547 -0400
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
-  *	Port operations for PIO only ALi
-  */
- 
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations 
-  *	Port operations for DMA capable ALi without cable
-  *	detect
-  */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.mode_filter	= ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
- /*
-  *	Port operations for DMA capable ALi with cable detect and LBA48
-  */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.dev_config	= ali_warn_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_amd.c linux-2.6.32.11/drivers/ata/pata_amd.c
---- linux-2.6.32.11/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_amd.c	2010-04-04 20:46:41.549452547 -0400
-@@ -397,28 +397,28 @@ static const struct ata_port_operations 
- 	.prereset	= amd_pre_reset,
- };
- 
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= amd33_set_piomode,
- 	.set_dmamode	= amd33_set_dmamode,
- };
- 
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd66_set_piomode,
- 	.set_dmamode	= amd66_set_dmamode,
- };
- 
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd100_set_piomode,
- 	.set_dmamode	= amd100_set_dmamode,
- };
- 
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= amd_cable_detect,
- 	.set_piomode	= amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations 
- 	.host_stop	= nv_host_stop,
- };
- 
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv100_set_piomode,
- 	.set_dmamode	= nv100_set_dmamode,
- };
- 
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv133_set_piomode,
- 	.set_dmamode	= nv133_set_dmamode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_artop.c linux-2.6.32.11/drivers/ata/pata_artop.c
---- linux-2.6.32.11/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_artop.c	2010-04-04 20:46:41.549452547 -0400
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
- 	.qc_defer		= artop6210_qc_defer,
- };
- 
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= artop6260_cable_detect,
- 	.set_piomode		= artop6260_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_at32.c linux-2.6.32.11/drivers/ata/pata_at32.c
---- linux-2.6.32.11/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_at32.c	2010-04-04 20:46:41.549452547 -0400
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= pata_at32_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_at91.c linux-2.6.32.11/drivers/ata/pata_at91.c
---- linux-2.6.32.11/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_at91.c	2010-04-04 20:46:41.549452547 -0400
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 
- 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_atiixp.c linux-2.6.32.11/drivers/ata/pata_atiixp.c
---- linux-2.6.32.11/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_atiixp.c	2010-04-04 20:46:41.549452547 -0400
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_atp867x.c linux-2.6.32.11/drivers/ata/pata_atp867x.c
---- linux-2.6.32.11/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_atp867x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= atp867x_cable_detect,
- 	.set_piomode		= atp867x_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_bf54x.c linux-2.6.32.11/drivers/ata/pata_bf54x.c
---- linux-2.6.32.11/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_bf54x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.set_piomode		= bfin_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cmd640.c linux-2.6.32.11/drivers/ata/pata_cmd640.c
---- linux-2.6.32.11/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cmd640.c	2010-04-04 20:46:41.549452547 -0400
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cmd64x.c linux-2.6.32.11/drivers/ata/pata_cmd64x.c
---- linux-2.6.32.11/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cmd64x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -275,18 +275,18 @@ static const struct ata_port_operations 
- 	.set_dmamode	= cmd64x_set_dmamode,
- };
- 
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd646r1_bmdma_stop,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd648_bmdma_stop,
- 	.cable_detect	= cmd648_cable_detect,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cs5520.c linux-2.6.32.11/drivers/ata/pata_cs5520.c
---- linux-2.6.32.11/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cs5520.c	2010-04-04 20:46:41.549452547 -0400
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_prep		= ata_sff_dumb_qc_prep,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cs5530.c linux-2.6.32.11/drivers/ata/pata_cs5530.c
---- linux-2.6.32.11/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cs5530.c	2010-04-04 20:46:41.549452547 -0400
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cs5535.c linux-2.6.32.11/drivers/ata/pata_cs5535.c
---- linux-2.6.32.11/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cs5535.c	2010-04-04 20:46:41.549452547 -0400
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= cs5535_cable_detect,
- 	.set_piomode	= cs5535_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cs5536.c linux-2.6.32.11/drivers/ata/pata_cs5536.c
---- linux-2.6.32.11/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cs5536.c	2010-04-04 20:46:41.549452547 -0400
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= cs5536_cable_detect,
- 	.set_piomode		= cs5536_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_cypress.c linux-2.6.32.11/drivers/ata/pata_cypress.c
---- linux-2.6.32.11/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_cypress.c	2010-04-04 20:46:41.549452547 -0400
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= cy82c693_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_efar.c linux-2.6.32.11/drivers/ata/pata_efar.c
---- linux-2.6.32.11/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_efar.c	2010-04-04 20:46:41.549452547 -0400
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= efar_cable_detect,
- 	.set_piomode		= efar_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_hpt366.c linux-2.6.32.11/drivers/ata/pata_hpt366.c
---- linux-2.6.32.11/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_hpt366.c	2010-04-04 20:46:41.549452547 -0400
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
-  *	Configuration for HPT366/68
-  */
- 
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= hpt36x_cable_detect,
- 	.mode_filter	= hpt366_filter,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_hpt37x.c linux-2.6.32.11/drivers/ata/pata_hpt37x.c
---- linux-2.6.32.11/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_hpt37x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
-  *	Configuration for HPT370
-  */
- 
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
-  *	Configuration for HPT370A. Close to 370 but less filters
-  */
- 
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- 	.inherits	= &hpt370_port_ops,
- 	.mode_filter	= hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
-  *	and DMA mode setting functionality.
-  */
- 
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
-  *	but we have a different cable detection procedure for function 1.
-  */
- 
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- 	.inherits	= &hpt372_port_ops,
- 	.prereset	= hpt374_fn1_pre_reset,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_hpt3x2n.c linux-2.6.32.11/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.32.11/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_hpt3x2n.c	2010-04-04 20:46:41.552552724 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
-  *	Configuration for HPT3x2n.
-  */
- 
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt3x2n_bmdma_stop,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_hpt3x3.c linux-2.6.32.11/drivers/ata/pata_hpt3x3.c
---- linux-2.6.32.11/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_hpt3x3.c	2010-04-04 20:46:41.552552724 -0400
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= hpt3x3_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_icside.c linux-2.6.32.11/drivers/ata/pata_icside.c
---- linux-2.6.32.11/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_icside.c	2010-04-04 20:46:41.552552724 -0400
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
- 	}
- }
- 
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	/* no need to build any PRD tables for DMA */
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_isapnp.c linux-2.6.32.11/drivers/ata/pata_isapnp.c
---- linux-2.6.32.11/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_isapnp.c	2010-04-04 20:46:41.552552724 -0400
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	/* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.32.11/drivers/ata/pata_it8213.c linux-2.6.32.11/drivers/ata/pata_it8213.c
---- linux-2.6.32.11/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_it8213.c	2010-04-04 20:46:41.552552724 -0400
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
- };
- 
- 
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= it8213_cable_detect,
- 	.set_piomode		= it8213_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_it821x.c linux-2.6.32.11/drivers/ata/pata_it821x.c
---- linux-2.6.32.11/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_it821x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.11/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.32.11/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_ixp4xx_cf.c	2010-04-04 20:46:41.552552724 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_jmicron.c linux-2.6.32.11/drivers/ata/pata_jmicron.c
---- linux-2.6.32.11/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_jmicron.c	2010-04-04 20:46:41.552552724 -0400
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= jmicron_pre_reset,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_legacy.c linux-2.6.32.11/drivers/ata/pata_legacy.c
---- linux-2.6.32.11/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_legacy.c	2010-04-04 20:46:41.552552724 -0400
-@@ -106,7 +106,7 @@ struct legacy_probe {
- 
- struct legacy_controller {
- 	const char *name;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned int pio_mask;
- 	unsigned int flags;
- 	unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations 
-  *	pio_mask as well.
-  */
- 
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
- 
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.set_mode	= legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
- 	return buflen;
- }
- 
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= pdc20230_set_piomode,
- 	.sff_data_xfer	= pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
- }
- 
- 
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
- 	return ata_sff_qc_issue(qc);
- }
- 
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c46x_set_piomode,
- 	.qc_issue	= opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
- 	return 0;
- }
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6500_set_piomode,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580dp_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
- 	return 0;
- }
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= winbond_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
- 	int pio_modes = controller->pio_mask;
- 	unsigned long io = probe->port;
- 	u32 mask = (1 << probe->slot);
--	struct ata_port_operations *ops = controller->ops;
-+	const struct ata_port_operations *ops = controller->ops;
- 	struct legacy_data *ld = &legacy_data[probe->slot];
- 	struct ata_host *host = NULL;
- 	struct ata_port *ap;
-diff -urNp linux-2.6.32.11/drivers/ata/pata_marvell.c linux-2.6.32.11/drivers/ata/pata_marvell.c
---- linux-2.6.32.11/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_marvell.c	2010-04-04 20:46:41.552552724 -0400
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= marvell_cable_detect,
- 	.prereset		= marvell_pre_reset,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_mpc52xx.c linux-2.6.32.11/drivers/ata/pata_mpc52xx.c
---- linux-2.6.32.11/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_mpc52xx.c	2010-04-04 20:46:41.552552724 -0400
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_dev_select		= mpc52xx_ata_dev_select,
- 	.set_piomode		= mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_mpiix.c linux-2.6.32.11/drivers/ata/pata_mpiix.c
---- linux-2.6.32.11/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_mpiix.c	2010-04-04 20:46:41.552552724 -0400
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= mpiix_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_netcell.c linux-2.6.32.11/drivers/ata/pata_netcell.c
---- linux-2.6.32.11/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_netcell.c	2010-04-04 20:46:41.552552724 -0400
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_80wire,
- 	.read_id	= netcell_read_id,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_ninja32.c linux-2.6.32.11/drivers/ata/pata_ninja32.c
---- linux-2.6.32.11/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_ninja32.c	2010-04-04 20:46:41.552552724 -0400
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.sff_dev_select = ninja32_dev_select,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_ns87410.c linux-2.6.32.11/drivers/ata/pata_ns87410.c
---- linux-2.6.32.11/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_ns87410.c	2010-04-04 20:46:41.552552724 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= ns87410_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_ns87415.c linux-2.6.32.11/drivers/ata/pata_ns87415.c
---- linux-2.6.32.11/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_ns87415.c	2010-04-04 20:46:41.552552724 -0400
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
- }
- #endif		/* 87560 SuperIO Support */
- 
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma	= ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
- };
- 
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- 	.inherits		= &ns87415_pata_ops,
- 	.sff_tf_read		= ns87560_tf_read,
- 	.sff_check_status	= ns87560_check_status,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_octeon_cf.c linux-2.6.32.11/drivers/ata/pata_octeon_cf.c
---- linux-2.6.32.11/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_octeon_cf.c	2010-04-04 20:46:41.552552724 -0400
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_oldpiix.c linux-2.6.32.11/drivers/ata/pata_oldpiix.c
---- linux-2.6.32.11/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_oldpiix.c	2010-04-04 20:46:41.552552724 -0400
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= oldpiix_qc_issue,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_opti.c linux-2.6.32.11/drivers/ata/pata_opti.c
---- linux-2.6.32.11/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_opti.c	2010-04-04 20:46:41.552552724 -0400
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= opti_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_optidma.c linux-2.6.32.11/drivers/ata/pata_optidma.c
---- linux-2.6.32.11/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_optidma.c	2010-04-04 20:46:41.552552724 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
- 	.prereset	= optidma_pre_reset,
- };
- 
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- 	.inherits	= &optidma_port_ops,
- 	.set_piomode	= optiplus_set_pio_mode,
- 	.set_dmamode	= optiplus_set_dma_mode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_palmld.c linux-2.6.32.11/drivers/ata/pata_palmld.c
---- linux-2.6.32.11/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_palmld.c	2010-04-04 20:46:41.552552724 -0400
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_pcmcia.c linux-2.6.32.11/drivers/ata/pata_pcmcia.c
---- linux-2.6.32.11/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_pcmcia.c	2010-04-04 20:46:41.552552724 -0400
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= pcmcia_set_mode,
- };
- 
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_data_xfer_8bit,
- 	.cable_detect	= ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
- 	unsigned long io_base, ctl_base;
- 	void __iomem *io_addr, *ctl_addr;
- 	int n_ports = 1;
--	struct ata_port_operations *ops = &pcmcia_port_ops;
-+	const struct ata_port_operations *ops = &pcmcia_port_ops;
- 
- 	info = kzalloc(sizeof(*info), GFP_KERNEL);
- 	if (info == NULL)
-diff -urNp linux-2.6.32.11/drivers/ata/pata_pdc2027x.c linux-2.6.32.11/drivers/ata/pata_pdc2027x.c
---- linux-2.6.32.11/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_pdc2027x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
- 	.cable_detect		= pdc2027x_cable_detect,
- 	.prereset		= pdc2027x_prereset,
- };
- 
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- 	.inherits		= &pdc2027x_pata100_ops,
- 	.mode_filter		= pdc2027x_mode_filter,
- 	.set_piomode		= pdc2027x_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.11/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.32.11/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_pdc202xx_old.c	2010-04-04 20:46:41.552552724 -0400
-@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.cable_detect		= ata_cable_40wire,
-@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
- 	.set_dmamode		= pdc202xx_set_dmamode,
- };
- 
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- 	.inherits		= &pdc2024x_port_ops,
- 
- 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_platform.c linux-2.6.32.11/drivers/ata/pata_platform.c
---- linux-2.6.32.11/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_platform.c	2010-04-04 20:46:41.552552724 -0400
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_qdi.c linux-2.6.32.11/drivers/ata/pata_qdi.c
---- linux-2.6.32.11/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_qdi.c	2010-04-04 20:46:41.552552724 -0400
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
- 	.set_piomode	= qdi6500_set_piomode,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &qdi6500_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_radisys.c linux-2.6.32.11/drivers/ata/pata_radisys.c
---- linux-2.6.32.11/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_radisys.c	2010-04-04 20:46:41.556857392 -0400
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= radisys_qc_issue,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_rb532_cf.c linux-2.6.32.11/drivers/ata/pata_rb532_cf.c
---- linux-2.6.32.11/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_rb532_cf.c	2010-04-04 20:46:41.556857392 -0400
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
- 	return IRQ_HANDLED;
- }
- 
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer32,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_rdc.c linux-2.6.32.11/drivers/ata/pata_rdc.c
---- linux-2.6.32.11/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_rdc.c	2010-04-04 20:46:41.556857392 -0400
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
- 	pci_write_config_byte(dev, 0x48, udma_enable);
- }
- 
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= rdc_pata_cable_detect,
- 	.set_piomode		= rdc_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_rz1000.c linux-2.6.32.11/drivers/ata/pata_rz1000.c
---- linux-2.6.32.11/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_rz1000.c	2010-04-04 20:46:41.556857392 -0400
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= rz1000_set_mode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_sc1200.c linux-2.6.32.11/drivers/ata/pata_sc1200.c
---- linux-2.6.32.11/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_sc1200.c	2010-04-04 20:46:41.556857392 -0400
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
- 	.qc_issue	= sc1200_qc_issue,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_scc.c linux-2.6.32.11/drivers/ata/pata_scc.c
---- linux-2.6.32.11/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_scc.c	2010-04-04 20:46:41.556857392 -0400
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.set_piomode		= scc_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_sch.c linux-2.6.32.11/drivers/ata/pata_sch.c
---- linux-2.6.32.11/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_sch.c	2010-04-04 20:46:41.556857392 -0400
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_unknown,
- 	.set_piomode		= sch_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_serverworks.c linux-2.6.32.11/drivers/ata/pata_serverworks.c
---- linux-2.6.32.11/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_serverworks.c	2010-04-04 20:46:41.556857392 -0400
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= serverworks_cable_detect,
- 	.mode_filter	= serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations server
- 	.set_dmamode	= serverworks_set_dmamode,
- };
- 
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- 	.inherits	= &serverworks_osb4_port_ops,
- 	.mode_filter	= serverworks_csb_filter,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_sil680.c linux-2.6.32.11/drivers/ata/pata_sil680.c
---- linux-2.6.32.11/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_sil680.c	2010-04-04 20:46:41.556857392 -0400
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- 	.inherits	= &ata_bmdma32_port_ops,
- 	.cable_detect	= sil680_cable_detect,
- 	.set_piomode	= sil680_set_piomode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_sis.c linux-2.6.32.11/drivers/ata/pata_sis.c
---- linux-2.6.32.11/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_sis.c	2010-04-04 20:46:41.556857392 -0400
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= sis_pre_reset,
- };
- 
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_133_early_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_100_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_66_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_old_set_dmamode,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_sl82c105.c linux-2.6.32.11/drivers/ata/pata_sl82c105.c
---- linux-2.6.32.11/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_sl82c105.c	2010-04-04 20:46:41.556857392 -0400
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_defer	= sl82c105_qc_defer,
- 	.bmdma_start 	= sl82c105_bmdma_start,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_triflex.c linux-2.6.32.11/drivers/ata/pata_triflex.c
---- linux-2.6.32.11/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_triflex.c	2010-04-04 20:46:41.556857392 -0400
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.bmdma_start 	= triflex_bmdma_start,
- 	.bmdma_stop	= triflex_bmdma_stop,
-diff -urNp linux-2.6.32.11/drivers/ata/pata_via.c linux-2.6.32.11/drivers/ata/pata_via.c
---- linux-2.6.32.11/drivers/ata/pata_via.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_via.c	2010-04-04 20:46:41.556857392 -0400
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= via_cable_detect,
- 	.set_piomode	= via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
- 	.port_start	= via_port_start,
- };
- 
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- 	.inherits	= &via_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
-diff -urNp linux-2.6.32.11/drivers/ata/pata_winbond.c linux-2.6.32.11/drivers/ata/pata_winbond.c
---- linux-2.6.32.11/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pata_winbond.c	2010-04-04 20:46:41.556857392 -0400
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= winbond_data_xfer,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.11/drivers/ata/pdc_adma.c linux-2.6.32.11/drivers/ata/pdc_adma.c
---- linux-2.6.32.11/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/pdc_adma.c	2010-04-04 20:46:41.556857392 -0400
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
- 	.dma_boundary		= ADMA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_fsl.c linux-2.6.32.11/drivers/ata/sata_fsl.c
---- linux-2.6.32.11/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_fsl.c	2010-04-04 20:46:41.556857392 -0400
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
- 	.dma_boundary = ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_inic162x.c linux-2.6.32.11/drivers/ata/sata_inic162x.c
---- linux-2.6.32.11/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_inic162x.c	2010-04-04 20:46:41.556857392 -0400
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
- 	return 0;
- }
- 
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- 	.inherits		= &sata_port_ops,
- 
- 	.check_atapi_dma	= inic_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_mv.c linux-2.6.32.11/drivers/ata/sata_mv.c
---- linux-2.6.32.11/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_mv.c	2010-04-04 20:46:41.556857392 -0400
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
- 	.dma_boundary		= MV_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
- 	.port_stop		= mv_port_stop,
- };
- 
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- 	.inherits		= &mv5_ops,
- 	.dev_config             = mv6_dev_config,
- 	.scr_read		= mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
- 	.bmdma_status		= mv_bmdma_status,
- };
- 
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- 	.inherits		= &mv6_ops,
- 	.dev_config		= ATA_OP_NULL,
- 	.qc_prep		= mv_qc_prep_iie,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_nv.c linux-2.6.32.11/drivers/ata/sata_nv.c
---- linux-2.6.32.11/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_nv.c	2010-04-04 20:46:41.556857392 -0400
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
-  * cases.  Define nv_hardreset() which only kicks in for post-boot
-  * probing and use it for all variants.
-  */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.lost_interrupt		= ATA_OP_NULL,
- 	.scr_read		= nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
- 	.hardreset		= nv_hardreset,
- };
- 
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_nf2_freeze,
- 	.thaw			= nv_nf2_thaw,
- };
- 
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_ck804_freeze,
- 	.thaw			= nv_ck804_thaw,
- 	.host_stop		= nv_ck804_host_stop,
- };
- 
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- 	.inherits		= &nv_ck804_ops,
- 
- 	.check_atapi_dma	= nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
- 	.host_stop		= nv_adma_host_stop,
- };
- 
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- 	.inherits		= &nv_generic_ops,
- 
- 	.qc_defer		= ata_std_qc_defer,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_promise.c linux-2.6.32.11/drivers/ata/sata_promise.c
---- linux-2.6.32.11/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_promise.c	2010-04-04 20:46:41.556857392 -0400
-@@ -195,7 +195,7 @@ static const struct ata_port_operations 
- 	.error_handler		= pdc_error_handler,
- };
- 
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_sata_cable_detect,
- 	.freeze			= pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
- 
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
-    and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- 	.inherits		= &pdc_sata_ops,
- 	.freeze			= pdc_freeze,
- 	.thaw			= pdc_thaw,
- 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
- };
- 
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_pata_cable_detect,
- 	.freeze			= pdc_freeze,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_qstor.c linux-2.6.32.11/drivers/ata/sata_qstor.c
---- linux-2.6.32.11/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_qstor.c	2010-04-04 20:46:41.556857392 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
- 	.dma_boundary		= QS_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= qs_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_sil24.c linux-2.6.32.11/drivers/ata/sata_sil24.c
---- linux-2.6.32.11/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_sil24.c	2010-04-04 20:46:41.556857392 -0400
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sil24_qc_defer,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_sil.c linux-2.6.32.11/drivers/ata/sata_sil.c
---- linux-2.6.32.11/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_sil.c	2010-04-04 20:46:41.556857392 -0400
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
- 	.sg_tablesize		= ATA_MAX_PRD
- };
- 
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.dev_config		= sil_dev_config,
- 	.set_mode		= sil_set_mode,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_sis.c linux-2.6.32.11/drivers/ata/sata_sis.c
---- linux-2.6.32.11/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_sis.c	2010-04-04 20:46:41.561786507 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= sis_scr_read,
- 	.scr_write		= sis_scr_write,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_svw.c linux-2.6.32.11/drivers/ata/sata_svw.c
---- linux-2.6.32.11/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_svw.c	2010-04-04 20:46:41.561786507 -0400
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
- };
- 
- 
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= k2_sata_tf_load,
- 	.sff_tf_read		= k2_sata_tf_read,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_sx4.c linux-2.6.32.11/drivers/ata/sata_sx4.c
---- linux-2.6.32.11/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_sx4.c	2010-04-04 20:46:41.561786507 -0400
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
- };
- 
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= pdc_check_atapi_dma,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_uli.c linux-2.6.32.11/drivers/ata/sata_uli.c
---- linux-2.6.32.11/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_uli.c	2010-04-04 20:46:41.561786507 -0400
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= uli_scr_read,
- 	.scr_write		= uli_scr_write,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_via.c linux-2.6.32.11/drivers/ata/sata_via.c
---- linux-2.6.32.11/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_via.c	2010-04-04 20:46:41.561786507 -0400
-@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= svia_tf_load,
- };
- 
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.freeze			= svia_noop_freeze,
- 	.prereset		= vt6420_prereset,
- };
- 
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.cable_detect		= vt6421_pata_cable_detect,
- 	.set_piomode		= vt6421_set_pio_mode,
- 	.set_dmamode		= vt6421_set_dma_mode,
- };
- 
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.scr_read		= svia_scr_read,
- 	.scr_write		= svia_scr_write,
- };
- 
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- 	.inherits		= &svia_base_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= vt8251_scr_read,
-diff -urNp linux-2.6.32.11/drivers/ata/sata_vsc.c linux-2.6.32.11/drivers/ata/sata_vsc.c
---- linux-2.6.32.11/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ata/sata_vsc.c	2010-04-04 20:46:41.561786507 -0400
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
- };
- 
- 
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	/* The IRQ handling is not quite standard SFF behaviour so we
- 	   cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.32.11/drivers/atm/adummy.c linux-2.6.32.11/drivers/atm/adummy.c
---- linux-2.6.32.11/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/adummy.c	2010-04-04 20:46:41.561786507 -0400
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
- 		vcc->pop(vcc, skb);
- 	else
- 		dev_kfree_skb_any(skb);
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/drivers/atm/ambassador.c linux-2.6.32.11/drivers/atm/ambassador.c
---- linux-2.6.32.11/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/ambassador.c	2010-04-04 20:46:41.561786507 -0400
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
-   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-   
-   // VC layer stats
--  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-   
-   // free the descriptor
-   kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
- 	  dump_skb ("<<<", vc, skb);
- 	  
- 	  // VC layer stats
--	  atomic_inc(&atm_vcc->stats->rx);
-+	  atomic_inc_unchecked(&atm_vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
-       } else {
-       	PRINTK (KERN_INFO, "dropped over-size frame");
- 	// should we count this?
--	atomic_inc(&atm_vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
-       }
-       
-     } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
-   }
-   
-   if (check_area (skb->data, skb->len)) {
--    atomic_inc(&atm_vcc->stats->tx_err);
-+    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
-     return -ENOMEM; // ?
-   }
-   
-diff -urNp linux-2.6.32.11/drivers/atm/atmtcp.c linux-2.6.32.11/drivers/atm/atmtcp.c
---- linux-2.6.32.11/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/atmtcp.c	2010-04-04 20:46:41.561786507 -0400
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
- 		if (dev_data) return 0;
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOLINK;
- 	}
- 	size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (!new_skb) {
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOBUFS;
- 	}
- 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- 	return 0;
- }
- 
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
- 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- 	read_unlock(&vcc_sklist_lock);
- 	if (!out_vcc) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		goto done;
- 	}
- 	skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
- 	__net_timestamp(new_skb);
- 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
-diff -urNp linux-2.6.32.11/drivers/atm/eni.c linux-2.6.32.11/drivers/atm/eni.c
---- linux-2.6.32.11/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/eni.c	2010-04-04 20:46:41.561786507 -0400
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- 		    vcc->dev->number);
- 		length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    size);
- 		}
- 		eff = length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
- 			length = eff = 0;
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 		}
- 	}
- 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- 			vcc->push(vcc,skb);
- 			pushed++;
- 		}
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
- 		    PCI_DMA_TODEVICE);
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb_irq(skb);
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 		wake_up(&eni_dev->tx_wait);
- dma_complete++;
- 	}
-diff -urNp linux-2.6.32.11/drivers/atm/firestream.c linux-2.6.32.11/drivers/atm/firestream.c
---- linux-2.6.32.11/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/firestream.c	2010-04-04 20:46:41.561786507 -0400
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
- 				}
- 			}
- 
--			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 
- 			fs_dprintk (FS_DEBUG_TXMEM, "i");
- 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
- #endif
- 				skb_put (skb, qe->p1 & 0xffff); 
- 				ATM_SKB(skb)->vcc = atm_vcc;
--				atomic_inc(&atm_vcc->stats->rx);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx);
- 				__net_timestamp(skb);
- 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- 				atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
- 				kfree (pe);
- 			}
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		case 0x1f: /*  Reassembly abort: no buffers. */
- 			/* Silently increment error counter. */
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
-diff -urNp linux-2.6.32.11/drivers/atm/fore200e.c linux-2.6.32.11/drivers/atm/fore200e.c
---- linux-2.6.32.11/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/fore200e.c	2010-04-04 20:46:41.561786507 -0400
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
- #endif
- 		/* check error condition */
- 		if (*entry->status & STATUS_ERROR)
--		    atomic_inc(&vcc->stats->tx_err);
-+		    atomic_inc_unchecked(&vcc->stats->tx_err);
- 		else
--		    atomic_inc(&vcc->stats->tx);
-+		    atomic_inc_unchecked(&vcc->stats->tx);
- 	    }
- 	}
- 
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
-     if (skb == NULL) {
- 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     } 
- 
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
- 
- 	dev_kfree_skb_any(skb);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     }
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-     vcc->push(vcc, skb);
--    atomic_inc(&vcc->stats->rx);
-+    atomic_inc_unchecked(&vcc->stats->rx);
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
- 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- 			fore200e->atm_dev->number,
- 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	    }
- 	}
- 
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
- 		goto retry_here;
- 	    }
- 
--	    atomic_inc(&vcc->stats->tx_err);
-+	    atomic_inc_unchecked(&vcc->stats->tx_err);
- 
- 	    fore200e->tx_sat++;
- 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.32.11/drivers/atm/he.c linux-2.6.32.11/drivers/atm/he.c
---- linux-2.6.32.11/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/he.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 
- 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
--				atomic_inc(&vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 				RBRQ_LEN_ERR(he_dev->rbrq_head)
- 							? "LEN_ERR" : "",
- 							vcc->vpi, vcc->vci);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 		vcc->push(vcc, skb);
- 		spin_lock(&he_dev->global_lock);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- return_host_buffers:
- 		++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
- 					tpd->vcc->pop(tpd->vcc, tpd->skb);
- 				else
- 					dev_kfree_skb_any(tpd->skb);
--				atomic_inc(&tpd->vcc->stats->tx_err);
-+				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- 			}
- 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- 			return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- 
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 		return -ENOMEM;
- 	}
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 					vcc->pop(vcc, skb);
- 				else
- 					dev_kfree_skb_any(skb);
--				atomic_inc(&vcc->stats->tx_err);
-+				atomic_inc_unchecked(&vcc->stats->tx_err);
- 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 				return -ENOMEM;
- 			}
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 	__enqueue_tpd(he_dev, tpd, cid);
- 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/drivers/atm/horizon.c linux-2.6.32.11/drivers/atm/horizon.c
---- linux-2.6.32.11/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/horizon.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
- 	{
- 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- 	  // VC layer stats
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
- 	dev->tx_iovec = NULL;
- 	
- 	// VC layer stats
--	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 	
- 	// free the skb
- 	hrz_kfree_skb (skb);
-diff -urNp linux-2.6.32.11/drivers/atm/idt77252.c linux-2.6.32.11/drivers/atm/idt77252.c
---- linux-2.6.32.11/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/idt77252.c	2010-04-04 20:46:41.565779517 -0400
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
- 		else
- 			dev_kfree_skb(skb);
- 
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 	}
- 
- 	atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			if ((sb = dev_alloc_skb(64)) == NULL) {
- 				printk("%s: Can't allocate buffers for aal0.\n",
- 				       card->name);
--				atomic_add(i, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i, &vcc->stats->rx_drop);
- 				break;
- 			}
- 			if (!atm_charge(vcc, sb->truesize)) {
- 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- 					 card->name);
--				atomic_add(i - 1, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- 				dev_kfree_skb(sb);
- 				break;
- 			}
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			ATM_SKB(sb)->vcc = vcc;
- 			__net_timestamp(sb);
- 			vcc->push(vcc, sb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			cell += ATM_CELL_PAYLOAD;
- 		}
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			         "(CDC: %08x)\n",
- 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (stat & SAR_RSQE_CRC) {
- 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 				RXPRINTK("%s: Can't alloc RX skb.\n",
- 					 card->name);
- 				recycle_rx_pool_skb(card, rpp);
--				atomic_inc(&vcc->stats->rx_err);
-+				atomic_inc_unchecked(&vcc->stats->rx_err);
- 				return;
- 			}
- 			if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			__net_timestamp(skb);
- 
- 			vcc->push(vcc, skb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			return;
- 		}
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 		__net_timestamp(skb);
- 
- 		vcc->push(vcc, skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- 		if (skb->truesize > SAR_FB_SIZE_3)
- 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		if (vcc->qos.aal != ATM_AAL0) {
- 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- 				card->name, vpi, vci);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto drop;
- 		}
- 	
- 		if ((sb = dev_alloc_skb(64)) == NULL) {
- 			printk("%s: Can't allocate buffers for AAL0.\n",
- 			       card->name);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto drop;
- 		}
- 
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		ATM_SKB(sb)->vcc = vcc;
- 		__net_timestamp(sb);
- 		vcc->push(vcc, sb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- drop:
- 		skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	if (vc == NULL) {
- 		printk("%s: NULL connection in send().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 	if (!test_bit(VCF_TX, &vc->flags)) {
- 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 		break;
- 	default:
- 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 
- 	if (skb_shinfo(skb)->nr_frags != 0) {
- 		printk("%s: No scatter-gather yet.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	err = queue_skb(card, vc, skb, oam);
- 	if (err) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return err;
- 	}
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
- 	skb = dev_alloc_skb(64);
- 	if (!skb) {
- 		printk("%s: Out of memory in send_oam().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOMEM;
- 	}
- 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.32.11/drivers/atm/iphase.c linux-2.6.32.11/drivers/atm/iphase.c
---- linux-2.6.32.11/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/iphase.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	status = (u_short) (buf_desc_ptr->desc_mode);  
- 	if (status & (RX_CER | RX_PTE | RX_OFL))  
- 	{  
--                atomic_inc(&vcc->stats->rx_err);
-+                atomic_inc_unchecked(&vcc->stats->rx_err);
- 		IF_ERR(printk("IA: bad packet, dropping it");)  
-                 if (status & RX_CER) { 
-                     IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	len = dma_addr - buf_addr;  
-         if (len > iadev->rx_buf_sz) {
-            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
--           atomic_inc(&vcc->stats->rx_err);
-+           atomic_inc_unchecked(&vcc->stats->rx_err);
- 	   goto out_free_desc;
-         }
- 		  
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
-           ia_vcc = INPH_IA_VCC(vcc);
-           if (ia_vcc == NULL)
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              dev_kfree_skb_any(skb);
-              atm_return(vcc, atm_guess_pdu2truesize(len));
-              goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
-           if ((length > iadev->rx_buf_sz) || (length > 
-                               (skb->len - sizeof(struct cpcs_trailer))))
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
-                                                             length, skb->len);)
-              dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
- 
- 	  IF_RX(printk("rx_dle_intr: skb push");)  
- 	  vcc->push(vcc,skb);  
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
-           iadev->rx_pkt_cnt++;
-       }  
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
-          {
-              struct k_sonet_stats *stats;
-              stats = &PRIV(_ia_dev[board])->sonet_stats;
--             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
--             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
--             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
--             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
--             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
--             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
--             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
--             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
--             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
-+             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
-+             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
-+             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
-+             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
-+             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
-          }
-             ia_cmds.status = 0;
-             break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
- 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
- 	{  
- 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
--                atomic_inc(&vcc->stats->tx);
-+                atomic_inc_unchecked(&vcc->stats->tx);
- 		if (vcc->pop)   
- 		    vcc->pop(vcc, skb);   
- 		else  
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
-         ATM_DESC(skb) = vcc->vci;
-         skb_queue_tail(&iadev->tx_dma_q, skb);
- 
--        atomic_inc(&vcc->stats->tx);
-+        atomic_inc_unchecked(&vcc->stats->tx);
-         iadev->tx_pkt_cnt++;
- 	/* Increment transaction counter */  
- 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
-         
- #if 0        
-         /* add flow control logic */ 
--        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
-           if (iavcc->vc_desc_cnt > 10) {
-              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
-             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.32.11/drivers/atm/lanai.c linux-2.6.32.11/drivers/atm/lanai.c
---- linux-2.6.32.11/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/lanai.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
- 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- 	lanai_endtx(lanai, lvcc);
- 	lanai_free_skb(lvcc->tx.atmvcc, skb);
--	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
- 
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
- 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- 	__net_timestamp(skb);
- 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
-     out:
- 	lvcc->rx.buf.ptr = end;
- 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
- 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
- 		lanai->stats.service_rxnotaal5++;
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		return 0;
- 	}
- 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
- 		int bytes;
- 		read_unlock(&vcc_sklist_lock);
- 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_trash++;
- 		bytes = (SERVICE_GET_END(s) * 16) -
- 		    (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
- 	}
- 	if (s & SERVICE_STREAM) {
- 		read_unlock(&vcc_sklist_lock);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_stream++;
- 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- 		    "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
- 		return 0;
- 	}
- 	DPRINTK("got rx crc error on vci %d\n", vci);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 	lvcc->stats.x.aal5.service_rxcrc++;
- 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.32.11/drivers/atm/nicstar.c linux-2.6.32.11/drivers/atm/nicstar.c
---- linux-2.6.32.11/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/nicstar.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if ((vc = (vc_map *) vcc->dev_data) == NULL)
-    {
-       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (!vc->tx)
-    {
-       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
-    {
-       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (skb_shinfo(skb)->nr_frags != 0)
-    {
-       printk("nicstar%d: No scatter-gather yet.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
- 
-    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
-    {
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EIO;
-    }
--   atomic_inc(&vcc->stats->tx);
-+   atomic_inc_unchecked(&vcc->stats->tx);
- 
-    return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
-          {
-             printk("nicstar%d: Can't allocate buffers for aal0.\n",
-                    card->index);
--            atomic_add(i,&vcc->stats->rx_drop);
-+            atomic_add_unchecked(i,&vcc->stats->rx_drop);
-             break;
-          }
-          if (!atm_charge(vcc, sb->truesize))
-          {
-             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
-                      card->index);
--            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-             dev_kfree_skb_any(sb);
-             break;
-          }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          ATM_SKB(sb)->vcc = vcc;
- 	 __net_timestamp(sb);
-          vcc->push(vcc, sb);
--         atomic_inc(&vcc->stats->rx);
-+         atomic_inc_unchecked(&vcc->stats->rx);
-          cell += ATM_CELL_PAYLOAD;
-       }
- 
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
- 	 if (iovb == NULL)
- 	 {
- 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-             recycle_rx_buf(card, skb);
-             return;
- 	 }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
-    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
-    {
-       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
--      atomic_inc(&vcc->stats->rx_err);
-+      atomic_inc_unchecked(&vcc->stats->rx_err);
-       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
-       NS_SKB(iovb)->iovcnt = 0;
-       iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_rx_buf(card, skb);
-          vc->rx_iov = NULL;
-          recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                       NS_SKB(iovb)->iovcnt);
-          vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             printk(" - PDU size mismatch.\n");
-          else
-             printk(".\n");
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	   NS_SKB(iovb)->iovcnt);
- 	 vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          if (!atm_charge(vcc, skb->truesize))
-          {
-             push_rxbufs(card, skb);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             ATM_SKB(skb)->vcc = vcc;
- 	    __net_timestamp(skb);
-             vcc->push(vcc, skb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
-       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, sb->truesize))
-             {
-                push_rxbufs(card, sb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
- 	    {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(sb)->vcc = vcc;
- 	       __net_timestamp(sb);
-                vcc->push(vcc, sb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, skb->truesize))
-             {
-                push_rxbufs(card, skb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
-             {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(skb)->vcc = vcc;
- 	       __net_timestamp(skb);
-                vcc->push(vcc, skb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (hb == NULL)
-             {
-                printk("nicstar%d: Out of huge buffers.\n", card->index);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                             NS_SKB(iovb)->iovcnt);
-                vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             }
- 	    else
- 	       dev_kfree_skb_any(hb);
--	    atomic_inc(&vcc->stats->rx_drop);
-+	    atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
- #endif /* NS_USE_DESTRUCTORS */
- 	    __net_timestamp(hb);
-             vcc->push(vcc, hb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
- 
-diff -urNp linux-2.6.32.11/drivers/atm/solos-pci.c linux-2.6.32.11/drivers/atm/solos-pci.c
---- linux-2.6.32.11/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/solos-pci.c	2010-04-04 20:46:41.565779517 -0400
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- 				}
- 				atm_charge(vcc, skb->truesize);
- 				vcc->push(vcc, skb);
--				atomic_inc(&vcc->stats->rx);
-+				atomic_inc_unchecked(&vcc->stats->rx);
- 				break;
- 
- 			case PKT_STATUS:
-@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
- 			vcc = SKB_CB(oldskb)->vcc;
- 
- 			if (vcc) {
--				atomic_inc(&vcc->stats->tx);
-+				atomic_inc_unchecked(&vcc->stats->tx);
- 				solos_pop(vcc, oldskb);
- 			} else
- 				dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.32.11/drivers/atm/suni.c linux-2.6.32.11/drivers/atm/suni.c
---- linux-2.6.32.11/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/suni.c	2010-04-04 20:46:41.565779517 -0400
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
- 
- 
- #define ADD_LIMITED(s,v) \
--    atomic_add((v),&stats->s); \
--    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+    atomic_add_unchecked((v),&stats->s); \
-+    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
- 
- 
- static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.32.11/drivers/atm/uPD98402.c linux-2.6.32.11/drivers/atm/uPD98402.c
---- linux-2.6.32.11/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/uPD98402.c	2010-04-04 20:46:41.565779517 -0400
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
- 	struct sonet_stats tmp;
-  	int error = 0;
- 
--	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- 	if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
- 
- 
- #define ADD_LIMITED(s,v) \
--    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
--    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
--	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
- 
- 
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
- 		if (reason & uPD98402_INT_PFM) stat_event(dev);
- 		if (reason & uPD98402_INT_PCO) {
- 			(void) GET(PCOCR); /* clear interrupt cause */
--			atomic_add(GET(HECCT),
-+			atomic_add_unchecked(GET(HECCT),
- 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
- 		}
- 		if ((reason & uPD98402_INT_RFO) && 
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
- 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- 	  uPD98402_INT_LOS),PIMR); /* enable them */
- 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
--	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.11/drivers/atm/zatm.c linux-2.6.32.11/drivers/atm/zatm.c
---- linux-2.6.32.11/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/atm/zatm.c	2010-04-04 20:46:41.569782507 -0400
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		}
- 		if (!size) {
- 			dev_kfree_skb_irq(skb);
--			if (vcc) atomic_inc(&vcc->stats->rx_err);
-+			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- 			continue;
- 		}
- 		if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		skb->len = size;
- 		ATM_SKB(skb)->vcc = vcc;
- 		vcc->push(vcc,skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
- 			skb_queue_head(&zatm_vcc->backlog,skb);
- 			break;
- 		}
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 	wake_up(&zatm_vcc->tx_wait);
- }
- 
-diff -urNp linux-2.6.32.11/drivers/base/bus.c linux-2.6.32.11/drivers/base/bus.c
---- linux-2.6.32.11/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/base/bus.c	2010-04-04 20:46:41.569782507 -0400
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- 	.show	= drv_attr_show,
- 	.store	= drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- 	.show	= bus_attr_show,
- 	.store	= bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- 	.filter = bus_uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/base/class.c linux-2.6.32.11/drivers/base/class.c
---- linux-2.6.32.11/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/base/class.c	2010-04-04 20:46:41.569782507 -0400
-@@ -63,7 +63,7 @@ static void class_release(struct kobject
- 	kfree(cp);
- }
- 
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- 	.show	= class_attr_show,
- 	.store	= class_attr_store,
- };
-diff -urNp linux-2.6.32.11/drivers/base/core.c linux-2.6.32.11/drivers/base/core.c
---- linux-2.6.32.11/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/base/core.c	2010-04-04 20:46:41.569782507 -0400
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- 	.show	= dev_attr_show,
- 	.store	= dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
- 	return retval;
- }
- 
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- 	.filter =	dev_uevent_filter,
- 	.name =		dev_uevent_name,
- 	.uevent =	dev_uevent,
-diff -urNp linux-2.6.32.11/drivers/base/memory.c linux-2.6.32.11/drivers/base/memory.c
---- linux-2.6.32.11/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/base/memory.c	2010-04-04 20:46:41.569782507 -0400
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
- 	return retval;
- }
- 
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- 	.name		= memory_uevent_name,
- 	.uevent		= memory_uevent,
- };
-diff -urNp linux-2.6.32.11/drivers/base/sys.c linux-2.6.32.11/drivers/base/sys.c
---- linux-2.6.32.11/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/base/sys.c	2010-04-04 20:46:41.569782507 -0400
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= sysdev_show,
- 	.store	= sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- 	.show	= sysdev_class_show,
- 	.store	= sysdev_class_store,
- };
-diff -urNp linux-2.6.32.11/drivers/block/pktcdvd.c linux-2.6.32.11/drivers/block/pktcdvd.c
---- linux-2.6.32.11/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/block/pktcdvd.c	2010-04-04 20:46:41.569782507 -0400
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
- 	return len;
- }
- 
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- 	.show = kobj_pkt_show,
- 	.store = kobj_pkt_store
- };
-diff -urNp linux-2.6.32.11/drivers/char/agp/frontend.c linux-2.6.32.11/drivers/char/agp/frontend.c
---- linux-2.6.32.11/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/agp/frontend.c	2010-04-04 20:46:41.569782507 -0400
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
- 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- 		return -EFAULT;
- 
--	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- 		return -EFAULT;
- 
- 	client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.32.11/drivers/char/agp/intel-agp.c linux-2.6.32.11/drivers/char/agp/intel-agp.c
---- linux-2.6.32.11/drivers/char/agp/intel-agp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/agp/intel-agp.c	2010-04-04 20:46:41.569782507 -0400
-@@ -2571,7 +2571,7 @@ static struct pci_device_id agp_intel_pc
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
-diff -urNp linux-2.6.32.11/drivers/char/hpet.c linux-2.6.32.11/drivers/char/hpet.c
---- linux-2.6.32.11/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hpet.c	2010-04-04 20:46:41.569782507 -0400
-@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
- 		},
- };
- 
--static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
-+static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
- 
- static int __init hpet_init(void)
- {
-diff -urNp linux-2.6.32.11/drivers/char/hvc_beat.c linux-2.6.32.11/drivers/char/hvc_beat.c
---- linux-2.6.32.11/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_beat.c	2010-04-04 20:46:41.569782507 -0400
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
- 	return cnt;
- }
- 
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- 	.get_chars = hvc_beat_get_chars,
- 	.put_chars = hvc_beat_put_chars,
- };
-diff -urNp linux-2.6.32.11/drivers/char/hvc_console.c linux-2.6.32.11/drivers/char/hvc_console.c
---- linux-2.6.32.11/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_console.c	2010-04-04 20:46:41.569782507 -0400
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
-  * console interfaces but can still be used as a tty device.  This has to be
-  * static because kmalloc will not work during early console init.
-  */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
- 
-@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
-  * vty adapters do NOT get an hvc_instantiate() callback since they
-  * appear after early console init.
-  */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- 	struct hvc_struct *hp;
- 
-@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
- };
- 
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
--					struct hv_ops *ops, int outbuf_size)
-+					const struct hv_ops *ops, int outbuf_size)
- {
- 	struct hvc_struct *hp;
- 	int i;
-diff -urNp linux-2.6.32.11/drivers/char/hvc_console.h linux-2.6.32.11/drivers/char/hvc_console.h
---- linux-2.6.32.11/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_console.h	2010-04-04 20:46:41.569782507 -0400
-@@ -55,7 +55,7 @@ struct hvc_struct {
- 	int outbuf_size;
- 	int n_outbuf;
- 	uint32_t vtermno;
--	struct hv_ops *ops;
-+	const struct hv_ops *ops;
- 	int irq_requested;
- 	int data;
- 	struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
- 
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
- 
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
--				struct hv_ops *ops, int outbuf_size);
-+				const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
- 
-diff -urNp linux-2.6.32.11/drivers/char/hvc_iseries.c linux-2.6.32.11/drivers/char/hvc_iseries.c
---- linux-2.6.32.11/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_iseries.c	2010-04-04 20:46:41.569782507 -0400
-@@ -197,7 +197,7 @@ done:
- 	return sent;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = get_chars,
- 	.put_chars = put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.11/drivers/char/hvc_iucv.c linux-2.6.32.11/drivers/char/hvc_iucv.c
---- linux-2.6.32.11/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_iucv.c	2010-04-04 20:46:41.569782507 -0400
-@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
- 
- 
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- 	.get_chars = hvc_iucv_get_chars,
- 	.put_chars = hvc_iucv_put_chars,
- 	.notifier_add = hvc_iucv_notifier_add,
-diff -urNp linux-2.6.32.11/drivers/char/hvc_rtas.c linux-2.6.32.11/drivers/char/hvc_rtas.c
---- linux-2.6.32.11/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_rtas.c	2010-04-04 20:46:41.569782507 -0400
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
- 	return i;
- }
- 
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- 	.get_chars = hvc_rtas_read_console,
- 	.put_chars = hvc_rtas_write_console,
- };
-diff -urNp linux-2.6.32.11/drivers/char/hvcs.c linux-2.6.32.11/drivers/char/hvcs.c
---- linux-2.6.32.11/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvcs.c	2010-04-04 20:46:41.573523483 -0400
-@@ -269,7 +269,7 @@ struct hvcs_struct {
- 	unsigned int index;
- 
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 
- 	/*
- 	 * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 
--	if (hvcsd->open_count > 0) {
-+	if (atomic_read(&hvcsd->open_count) > 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
- 				"The hvcs device node is still in use.\n");
-@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
- 		if ((retval = hvcs_partner_connect(hvcsd)))
- 			goto error_release;
- 
--	hvcsd->open_count = 1;
-+	atomic_set(&hvcsd->open_count, 1);
- 	hvcsd->tty = tty;
- 	tty->driver_data = hvcsd;
- 
-@@ -1169,7 +1169,7 @@ fast_open:
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	kref_get(&hvcsd->kref);
--	hvcsd->open_count++;
-+	atomic_inc(&hvcsd->open_count);
- 	hvcsd->todo_mask |= HVCS_SCHED_READ;
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
- 
-@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
- 	hvcsd = tty->driver_data;
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
--	if (--hvcsd->open_count == 0) {
-+	if (atomic_dec_and_test(&hvcsd->open_count)) {
- 
- 		vio_disable_interrupts(hvcsd->vdev);
- 
-@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
- 		free_irq(irq, hvcsd);
- 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
- 		return;
--	} else if (hvcsd->open_count < 0) {
-+	} else if (atomic_read(&hvcsd->open_count) < 0) {
- 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- 				" is missmanaged.\n",
--		hvcsd->vdev->unit_address, hvcsd->open_count);
-+		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
- 	}
- 
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	/* Preserve this so that we know how many kref refs to put */
--	temp_open_count = hvcsd->open_count;
-+	temp_open_count = atomic_read(&hvcsd->open_count);
- 
- 	/*
- 	 * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
- 	hvcsd->tty->driver_data = NULL;
- 	hvcsd->tty = NULL;
- 
--	hvcsd->open_count = 0;
-+	atomic_set(&hvcsd->open_count, 0);
- 
- 	/* This will drop any buffered data on the floor which is OK in a hangup
- 	 * scenario. */
-@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
- 	 * the middle of a write operation?  This is a crummy place to do this
- 	 * but we want to keep it all in the spinlock.
- 	 */
--	if (hvcsd->open_count <= 0) {
-+	if (atomic_read(&hvcsd->open_count) <= 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		return -ENODEV;
- 	}
-@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
- {
- 	struct hvcs_struct *hvcsd = tty->driver_data;
- 
--	if (!hvcsd || hvcsd->open_count <= 0)
-+	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
- 		return 0;
- 
- 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.32.11/drivers/char/hvc_udbg.c linux-2.6.32.11/drivers/char/hvc_udbg.c
---- linux-2.6.32.11/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_udbg.c	2010-04-04 20:46:41.573523483 -0400
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
- 	return i;
- }
- 
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- 	.get_chars = hvc_udbg_get,
- 	.put_chars = hvc_udbg_put,
- };
-diff -urNp linux-2.6.32.11/drivers/char/hvc_vio.c linux-2.6.32.11/drivers/char/hvc_vio.c
---- linux-2.6.32.11/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_vio.c	2010-04-04 20:46:41.573523483 -0400
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
- 	return got;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = filtered_get_chars,
- 	.put_chars = hvc_put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.11/drivers/char/hvc_xen.c linux-2.6.32.11/drivers/char/hvc_xen.c
---- linux-2.6.32.11/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/hvc_xen.c	2010-04-04 20:46:41.573523483 -0400
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
- 	return recv;
- }
- 
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- 	.get_chars = read_console,
- 	.put_chars = write_console,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.11/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.11/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.32.11/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/ipmi/ipmi_msghandler.c	2010-04-04 20:46:41.573523483 -0400
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- 	struct proc_dir_entry *proc_dir;
- 	char                  proc_dir_name[10];
- 
--	atomic_t stats[IPMI_NUM_STATS];
-+	atomic_unchecked_t stats[IPMI_NUM_STATS];
- 
- 	/*
- 	 * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
- 
- 
- #define ipmi_inc_stat(intf, stat) \
--	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
--	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
- 
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
- 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
- 	init_waitqueue_head(&intf->waitq);
- 	for (i = 0; i < IPMI_NUM_STATS; i++)
--		atomic_set(&intf->stats[i], 0);
-+		atomic_set_unchecked(&intf->stats[i], 0);
- 
- 	intf->proc_dir = NULL;
- 
-diff -urNp linux-2.6.32.11/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.11/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.32.11/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/ipmi/ipmi_si_intf.c	2010-04-04 20:46:41.573523483 -0400
-@@ -277,7 +277,7 @@ struct smi_info {
- 	unsigned char slave_addr;
- 
- 	/* Counters and things for the proc filesystem. */
--	atomic_t stats[SI_NUM_STATS];
-+	atomic_unchecked_t stats[SI_NUM_STATS];
- 
- 	struct task_struct *thread;
- 
-@@ -285,9 +285,9 @@ struct smi_info {
- };
- 
- #define smi_inc_stat(smi, stat) \
--	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
--	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
- 
- #define SI_MAX_PARMS 4
- 
-@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
- 	atomic_set(&new_smi->req_events, 0);
- 	new_smi->run_to_completion = 0;
- 	for (i = 0; i < SI_NUM_STATS; i++)
--		atomic_set(&new_smi->stats[i], 0);
-+		atomic_set_unchecked(&new_smi->stats[i], 0);
- 
- 	new_smi->interrupt_disabled = 0;
- 	atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.32.11/drivers/char/keyboard.c linux-2.6.32.11/drivers/char/keyboard.c
---- linux-2.6.32.11/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/keyboard.c	2010-04-04 20:46:41.573523483 -0400
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
- 	     kbd->kbdmode == VC_MEDIUMRAW) &&
- 	     value != KVAL(K_SAK))
- 		return;		/* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+	{
-+		void *func = fn_handler[value];
-+		if (func == fn_show_state || func == fn_show_ptregs ||
-+		    func == fn_show_mem)
-+			return;
-+	}
-+#endif
-+
- 	fn_handler[value](vc);
- }
- 
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
-                 .evbit = { BIT_MASK(EV_SND) },
-         },
- 
--	{ },    /* Terminating entry */
-+	{ 0 },    /* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.32.11/drivers/char/mem.c linux-2.6.32.11/drivers/char/mem.c
---- linux-2.6.32.11/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/mem.c	2010-04-04 20:46:41.573523483 -0400
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
- 
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- 					     unsigned long size)
- {
-@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
- 	if (!valid_phys_addr_range(p, count))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_mem_write();
-+	return -EPERM;
-+#endif
-+
- 	written = 0;
- 
- #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
-@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
- 						&vma->vm_page_prot))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
-+		return -EPERM;
-+#endif
-+
- 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
- 						 size,
- 						 vma->vm_page_prot);
-@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
- 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
- 	int err = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_kmem_write();
-+	return -EPERM;
-+#endif
-+
- 	if (p < (unsigned long) high_memory) {
- 
- 		wrote = count;
-@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
- 
- static int open_port(struct inode * inode, struct file * filp)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_open_port();
-+	return -EPERM;
-+#endif
-+
-+	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
-+}
-+
-+static int open_mem(struct inode * inode, struct file * filp)
-+{
- 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
- }
- 
-@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
- #define full_lseek      null_lseek
- #define write_zero	write_null
- #define read_full       read_zero
--#define open_mem	open_port
- #define open_kmem	open_mem
- #define open_oldmem	open_mem
- 
-@@ -888,6 +917,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
- 
- static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.32.11/drivers/char/nvram.c linux-2.6.32.11/drivers/char/nvram.c
---- linux-2.6.32.11/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/nvram.c	2010-04-04 20:46:41.573523483 -0400
-@@ -429,7 +429,10 @@ static const struct file_operations nvra
- static struct miscdevice nvram_dev = {
- 	NVRAM_MINOR,
- 	"nvram",
--	&nvram_fops
-+	&nvram_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static int __init nvram_init(void)
-diff -urNp linux-2.6.32.11/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.11/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.32.11/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/pcmcia/ipwireless/tty.c	2010-04-04 20:46:41.573523483 -0400
-@@ -51,7 +51,7 @@ struct ipw_tty {
- 	int tty_type;
- 	struct ipw_network *network;
- 	struct tty_struct *linux_tty;
--	int open_count;
-+	atomic_t open_count;
- 	unsigned int control_lines;
- 	struct mutex ipw_tty_mutex;
- 	int tx_bytes_queued;
-@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -ENODEV;
- 	}
--	if (tty->open_count == 0)
-+	if (atomic_read(&tty->open_count) == 0)
- 		tty->tx_bytes_queued = 0;
- 
--	tty->open_count++;
-+	atomic_inc(&tty->open_count);
- 
- 	tty->linux_tty = linux_tty;
- 	linux_tty->driver_data = tty;
-@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
- 
- static void do_ipw_close(struct ipw_tty *tty)
- {
--	tty->open_count--;
--
--	if (tty->open_count == 0) {
-+	if (atomic_dec_return(&tty->open_count) == 0) {
- 		struct tty_struct *linux_tty = tty->linux_tty;
- 
- 		if (linux_tty != NULL) {
-@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
- 		return;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (tty->open_count == 0) {
-+	if (atomic_read(&tty->open_count) == 0) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
- 		return;
- 	}
- 
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
- 		return -ENODEV;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -EINVAL;
- 	}
-@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
- 	if (!tty)
- 		return 0;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return 0;
- 
- 	return tty->tx_bytes_queued;
-@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return get_control_lines(tty);
-@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return set_control_lines(tty, set, clear);
-@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	/* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
- 				   against a parallel ioctl etc */
- 				mutex_lock(&ttyj->ipw_tty_mutex);
- 			}
--			while (ttyj->open_count)
-+			while (atomic_read(&ttyj->open_count))
- 				do_ipw_close(ttyj);
- 			ipwireless_disassociate_network_ttys(network,
- 							     ttyj->channel_idx);
-diff -urNp linux-2.6.32.11/drivers/char/pty.c linux-2.6.32.11/drivers/char/pty.c
---- linux-2.6.32.11/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/pty.c	2010-04-04 20:46:41.573523483 -0400
-@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
- 	return ret;
- }
- 
--static struct file_operations ptmx_fops;
-+static const struct file_operations ptmx_fops = {
-+	.llseek		= no_llseek,
-+	.read		= tty_read,
-+	.write		= tty_write,
-+	.poll		= tty_poll,
-+	.unlocked_ioctl	= tty_ioctl,
-+	.compat_ioctl	= tty_compat_ioctl,
-+	.open		= ptmx_open,
-+	.release	= tty_release,
-+	.fasync		= tty_fasync,
-+};
-+
- 
- static void __init unix98_pty_init(void)
- {
-@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
- 	register_sysctl_table(pty_root_table);
- 
- 	/* Now create the /dev/ptmx special device */
--	tty_default_fops(&ptmx_fops);
--	ptmx_fops.open = ptmx_open;
--
- 	cdev_init(&ptmx_cdev, &ptmx_fops);
- 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
- 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
-diff -urNp linux-2.6.32.11/drivers/char/random.c linux-2.6.32.11/drivers/char/random.c
---- linux-2.6.32.11/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/random.c	2010-04-04 20:46:41.573523483 -0400
-@@ -254,8 +254,13 @@
- /*
-  * Configuration information
-  */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
- 
- /*
-@@ -292,10 +297,17 @@ static struct poolinfo {
- 	int poolwords;
- 	int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+	{ 512,	411,	308,	208,	104,	1 },
-+	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+	{ 128,	103,	76,	51,	25,	1 },
-+#else
- 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- 	{ 128,	103,	76,	51,	25,	1 },
- 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- 	{ 32,	26,	20,	14,	7,	1 },
-+#endif
- #if 0
- 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
- 	{ 2048,	1638,	1231,	819,	411,	1 },
-@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
- 
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
- 
-diff -urNp linux-2.6.32.11/drivers/char/sonypi.c linux-2.6.32.11/drivers/char/sonypi.c
---- linux-2.6.32.11/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/sonypi.c	2010-04-04 20:46:41.573523483 -0400
-@@ -491,7 +491,7 @@ static struct sonypi_device {
- 	spinlock_t fifo_lock;
- 	wait_queue_head_t fifo_proc_list;
- 	struct fasync_struct *fifo_async;
--	int open_count;
-+	atomic_t open_count;
- 	int model;
- 	struct input_dev *input_jog_dev;
- 	struct input_dev *input_key_dev;
-@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- 	mutex_lock(&sonypi_device.lock);
--	sonypi_device.open_count--;
-+	atomic_dec(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	return 0;
- }
-@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
- 	lock_kernel();
- 	mutex_lock(&sonypi_device.lock);
- 	/* Flush input queue on first open */
--	if (!sonypi_device.open_count)
-+	if (!atomic_read(&sonypi_device.open_count))
- 		kfifo_reset(sonypi_device.fifo);
--	sonypi_device.open_count++;
-+	atomic_inc(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	unlock_kernel();
- 	return 0;
-diff -urNp linux-2.6.32.11/drivers/char/tpm/tpm_bios.c linux-2.6.32.11/drivers/char/tpm/tpm_bios.c
---- linux-2.6.32.11/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/tpm/tpm_bios.c	2010-04-04 20:46:41.573523483 -0400
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
- 	event = addr;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
- 		return NULL;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	(*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
- 	int i;
- 
- 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
--		seq_putc(m, data[i]);
-+		if (!seq_putc(m, data[i]))
-+			return -EFAULT;
- 
- 	return 0;
- }
-@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
- 	log->bios_event_log_end = log->bios_event_log + len;
- 
- 	virt = acpi_os_map_memory(start, len);
-+	if (!virt) {
-+		kfree(log->bios_event_log);
-+		log->bios_event_log = NULL;
-+		return -EFAULT;
-+	}
- 
- 	memcpy(log->bios_event_log, virt, len);
- 
-diff -urNp linux-2.6.32.11/drivers/char/tty_io.c linux-2.6.32.11/drivers/char/tty_io.c
---- linux-2.6.32.11/drivers/char/tty_io.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/tty_io.c	2010-04-04 20:46:41.577798214 -0400
-@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
- DEFINE_MUTEX(tty_mutex);
- EXPORT_SYMBOL(tty_mutex);
- 
--static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
--static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
- ssize_t redirected_tty_write(struct file *, const char __user *,
- 							size_t, loff_t *);
--static unsigned int tty_poll(struct file *, poll_table *);
- static int tty_open(struct inode *, struct file *);
--static int tty_release(struct inode *, struct file *);
- long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
--#ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
--				unsigned long arg);
--#else
--#define tty_compat_ioctl NULL
--#endif
--static int tty_fasync(int fd, struct file *filp, int on);
- static void release_tty(struct tty_struct *tty, int idx);
- static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
- static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
-@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
-  *	read calls may be outstanding in parallel.
-  */
- 
--static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
-+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
- 			loff_t *ppos)
- {
- 	int i;
-@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
- 	return i;
- }
- 
-+EXPORT_SYMBOL(tty_read);
-+
- void tty_write_unlock(struct tty_struct *tty)
- {
- 	mutex_unlock(&tty->atomic_write_lock);
-@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
-  *	write method will not be invoked in parallel for each device.
-  */
- 
--static ssize_t tty_write(struct file *file, const char __user *buf,
-+ssize_t tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
- 	struct tty_struct *tty;
-@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
- 	return ret;
- }
- 
-+EXPORT_SYMBOL(tty_write);
-+
- ssize_t redirected_tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
-@@ -1865,7 +1858,7 @@ static int tty_open(struct inode *inode,
-  *		Takes bkl. See tty_release_dev
-  */
- 
--static int tty_release(struct inode *inode, struct file *filp)
-+int tty_release(struct inode *inode, struct file *filp)
- {
- 	lock_kernel();
- 	tty_release_dev(filp);
-@@ -1873,6 +1866,8 @@ static int tty_release(struct inode *ino
- 	return 0;
- }
- 
-+EXPORT_SYMBOL(tty_release);
-+
- /**
-  *	tty_poll	-	check tty status
-  *	@filp: file being polled
-@@ -1885,7 +1880,7 @@ static int tty_release(struct inode *ino
-  *	may be re-entered freely by other callers.
-  */
- 
--static unsigned int tty_poll(struct file *filp, poll_table *wait)
-+unsigned int tty_poll(struct file *filp, poll_table *wait)
- {
- 	struct tty_struct *tty;
- 	struct tty_ldisc *ld;
-@@ -1902,7 +1897,9 @@ static unsigned int tty_poll(struct file
- 	return ret;
- }
- 
--static int tty_fasync(int fd, struct file *filp, int on)
-+EXPORT_SYMBOL(tty_poll);
-+
-+int tty_fasync(int fd, struct file *filp, int on)
- {
- 	struct tty_struct *tty;
- 	unsigned long flags;
-@@ -1946,6 +1943,8 @@ out:
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_fasync);
-+
- /**
-  *	tiocsti			-	fake input character
-  *	@tty: tty to fake input into
-@@ -2580,8 +2579,10 @@ long tty_ioctl(struct file *file, unsign
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- 				unsigned long arg)
- {
- 	struct inode *inode = file->f_dentry->d_inode;
-@@ -2605,6 +2606,8 @@ static long tty_compat_ioctl(struct file
- 
- 	return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
- 
- /*
-@@ -3048,11 +3051,6 @@ struct tty_struct *get_current_tty(void)
- }
- EXPORT_SYMBOL_GPL(get_current_tty);
- 
--void tty_default_fops(struct file_operations *fops)
--{
--	*fops = tty_fops;
--}
--
- /*
-  * Initialize the console device. This is called *early*, so
-  * we can't necessarily depend on lots of kernel help here.
-diff -urNp linux-2.6.32.11/drivers/char/tty_ldisc.c linux-2.6.32.11/drivers/char/tty_ldisc.c
---- linux-2.6.32.11/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/tty_ldisc.c	2010-04-04 20:46:41.577798214 -0400
-@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
- 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- 		struct tty_ldisc_ops *ldo = ld->ops;
- 
--		ldo->refcount--;
-+		atomic_dec(&ldo->refcount);
- 		module_put(ldo->owner);
- 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
-@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
- 	tty_ldiscs[disc] = new_ldisc;
- 	new_ldisc->num = disc;
--	new_ldisc->refcount = 0;
-+	atomic_set(&new_ldisc->refcount, 0);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
- 	return ret;
-@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
- 		return -EINVAL;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	if (tty_ldiscs[disc]->refcount)
-+	if (atomic_read(&tty_ldiscs[disc]->refcount))
- 		ret = -EBUSY;
- 	else
- 		tty_ldiscs[disc] = NULL;
-@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
- 	if (ldops) {
- 		ret = ERR_PTR(-EAGAIN);
- 		if (try_module_get(ldops->owner)) {
--			ldops->refcount++;
-+			atomic_inc(&ldops->refcount);
- 			ret = ldops;
- 		}
- 	}
-@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	ldops->refcount--;
-+	atomic_dec(&ldops->refcount);
- 	module_put(ldops->owner);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff -urNp linux-2.6.32.11/drivers/char/virtio_console.c linux-2.6.32.11/drivers/char/virtio_console.c
---- linux-2.6.32.11/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/virtio_console.c	2010-04-04 20:46:41.577798214 -0400
-@@ -44,6 +44,7 @@ static unsigned int in_len;
- static char *in, *inbuf;
- 
- /* The operations for our console. */
-+/* cannot be const */
- static struct hv_ops virtio_cons;
- 
- /* The hvc device */
-diff -urNp linux-2.6.32.11/drivers/char/vt_ioctl.c linux-2.6.32.11/drivers/char/vt_ioctl.c
---- linux-2.6.32.11/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/char/vt_ioctl.c	2010-04-04 20:46:41.577798214 -0400
-@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
- 	case KDSKBENT:
- 		if (!perm)
- 			return -EPERM;
-+
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG))
-+			return -EPERM;
-+#endif
-+
- 		if (!i && v == K_NOSUCHMAP) {
- 			/* deallocate map */
- 			key_map = key_maps[s];
-@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
- 			goto reterr;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG)) {
-+			ret = -EPERM;
-+			goto reterr;
-+		}
-+#endif
-+
- 		q = func_table[i];
- 		first_free = funcbufptr + (funcbufsize - funcbufleft);
- 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
-diff -urNp linux-2.6.32.11/drivers/cpufreq/cpufreq.c linux-2.6.32.11/drivers/cpufreq/cpufreq.c
---- linux-2.6.32.11/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/cpufreq/cpufreq.c	2010-04-04 20:46:41.577798214 -0400
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
- 	complete(&policy->kobj_unregister);
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= show,
- 	.store	= store,
- };
-diff -urNp linux-2.6.32.11/drivers/cpuidle/sysfs.c linux-2.6.32.11/drivers/cpuidle/sysfs.c
---- linux-2.6.32.11/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/cpuidle/sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- 	.show = cpuidle_show,
- 	.store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- 	.show = cpuidle_state_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/dma/ioat/dma.c linux-2.6.32.11/drivers/dma/ioat/dma.c
---- linux-2.6.32.11/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/dma/ioat/dma.c	2010-04-04 20:46:41.577798214 -0400
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
- 	return entry->show(&chan->common, page);
- }
- 
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- 	.show	= ioat_attr_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/dma/ioat/dma.h linux-2.6.32.11/drivers/dma/ioat/dma.h
---- linux-2.6.32.11/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/dma/ioat/dma.h	2010-04-04 20:46:41.577798214 -0400
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
- 			   unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff -urNp linux-2.6.32.11/drivers/edac/edac_core.h linux-2.6.32.11/drivers/edac/edac_core.h
---- linux-2.6.32.11/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/edac/edac_core.h	2010-04-04 20:46:41.577798214 -0400
-@@ -99,11 +99,11 @@ extern int edac_debug_level;
- 
- #else				/* !CONFIG_EDAC_DEBUG */
- 
--#define debugf0( ... )
--#define debugf1( ... )
--#define debugf2( ... )
--#define debugf3( ... )
--#define debugf4( ... )
-+#define debugf0( ... ) do {} while (0)
-+#define debugf1( ... ) do {} while (0)
-+#define debugf2( ... ) do {} while (0)
-+#define debugf3( ... ) do {} while (0)
-+#define debugf4( ... ) do {} while (0)
- 
- #endif				/* !CONFIG_EDAC_DEBUG */
- 
-diff -urNp linux-2.6.32.11/drivers/edac/edac_device_sysfs.c linux-2.6.32.11/drivers/edac/edac_device_sysfs.c
---- linux-2.6.32.11/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/edac/edac_device_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
- }
- 
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- 	.show = edac_dev_ctl_info_show,
- 	.store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
- }
- 
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- 	.show = edac_dev_instance_show,
- 	.store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
- }
- 
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- 	.show = edac_dev_block_show,
- 	.store = edac_dev_block_store
- };
-diff -urNp linux-2.6.32.11/drivers/edac/edac_mc_sysfs.c linux-2.6.32.11/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.32.11/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/edac/edac_mc_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
- 	return -EIO;
- }
- 
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- 	.show = csrowdev_show,
- 	.store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
- }
- 
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- 	.show = mcidev_show,
- 	.store = mcidev_store
- };
-diff -urNp linux-2.6.32.11/drivers/edac/edac_pci_sysfs.c linux-2.6.32.11/drivers/edac/edac_pci_sysfs.c
---- linux-2.6.32.11/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/edac/edac_pci_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
- }
- 
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- 	.show = edac_pci_instance_show,
- 	.store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- 	.show = edac_pci_dev_show,
- 	.store = edac_pci_dev_store
- };
-diff -urNp linux-2.6.32.11/drivers/firmware/dmi_scan.c linux-2.6.32.11/drivers/firmware/dmi_scan.c
---- linux-2.6.32.11/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/firmware/dmi_scan.c	2010-04-04 20:46:41.577798214 -0400
-@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
- 		}
- 	}
- 	else {
--		/*
--		 * no iounmap() for that ioremap(); it would be a no-op, but
--		 * it's so early in setup that sucker gets confused into doing
--		 * what it shouldn't if we actually call it.
--		 */
- 		p = dmi_ioremap(0xF0000, 0x10000);
- 		if (p == NULL)
- 			goto error;
-diff -urNp linux-2.6.32.11/drivers/firmware/edd.c linux-2.6.32.11/drivers/firmware/edd.c
---- linux-2.6.32.11/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/firmware/edd.c	2010-04-04 20:46:41.577798214 -0400
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
- 	return ret;
- }
- 
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- 	.show = edd_attr_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/firmware/efivars.c linux-2.6.32.11/drivers/firmware/efivars.c
---- linux-2.6.32.11/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/firmware/efivars.c	2010-04-04 20:46:41.577798214 -0400
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- 	.show = efivar_attr_show,
- 	.store = efivar_attr_store,
- };
-diff -urNp linux-2.6.32.11/drivers/firmware/iscsi_ibft.c linux-2.6.32.11/drivers/firmware/iscsi_ibft.c
---- linux-2.6.32.11/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/firmware/iscsi_ibft.c	2010-04-04 20:46:41.581454607 -0400
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
- 	return ret;
- }
- 
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- 	.show = ibft_show_attribute,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/firmware/memmap.c linux-2.6.32.11/drivers/firmware/memmap.c
---- linux-2.6.32.11/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/firmware/memmap.c	2010-04-04 20:46:41.581454607 -0400
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- 	NULL
- };
- 
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- 	.show = memmap_attr_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/drm_drv.c linux-2.6.32.11/drivers/gpu/drm/drm_drv.c
---- linux-2.6.32.11/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/drm_drv.c	2010-04-04 20:46:41.581454607 -0400
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
- 	char *kdata = NULL;
- 
- 	atomic_inc(&dev->ioctl_count);
--	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- 	++file_priv->ioctl_count;
- 
- 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/drm_fops.c linux-2.6.32.11/drivers/gpu/drm/drm_fops.c
---- linux-2.6.32.11/drivers/gpu/drm/drm_fops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/drm_fops.c	2010-04-04 20:46:41.581454607 -0400
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
- 	}
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
--		atomic_set(&dev->counts[i], 0);
-+		atomic_set_unchecked(&dev->counts[i], 0);
- 
- 	dev->sigdata.lock = NULL;
- 
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
- 
- 	retcode = drm_open_helper(inode, filp, dev);
- 	if (!retcode) {
--		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- 		spin_lock(&dev->count_lock);
--		if (!dev->open_count++) {
-+		if (atomic_inc_return(&dev->open_count) == 1) {
- 			spin_unlock(&dev->count_lock);
- 			retcode = drm_setup(dev);
- 			goto out;
-@@ -433,7 +433,7 @@ int drm_release(struct inode *inode, str
- 
- 	lock_kernel();
- 
--	DRM_DEBUG("open_count = %d\n", dev->open_count);
-+	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
- 
- 	if (dev->driver->preclose)
- 		dev->driver->preclose(dev, file_priv);
-@@ -445,7 +445,7 @@ int drm_release(struct inode *inode, str
- 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- 		  task_pid_nr(current),
- 		  (long)old_encode_dev(file_priv->minor->device),
--		  dev->open_count);
-+		  atomic_read(&dev->open_count));
- 
- 	/* if the master has gone away we can't do anything with the lock */
- 	if (file_priv->minor->master)
-@@ -522,9 +522,9 @@ int drm_release(struct inode *inode, str
- 	 * End inline drm_release
- 	 */
- 
--	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- 	spin_lock(&dev->count_lock);
--	if (!--dev->open_count) {
-+	if (atomic_dec_and_test(&dev->open_count)) {
- 		if (atomic_read(&dev->ioctl_count)) {
- 			DRM_ERROR("Device busy: %d\n",
- 				  atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.11/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.32.11/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/drm_ioctl.c	2010-04-04 20:46:41.581454607 -0400
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
- 			stats->data[i].value =
- 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- 		else
--			stats->data[i].value = atomic_read(&dev->counts[i]);
-+			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- 		stats->data[i].type = dev->types[i];
- 	}
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/drm_lock.c linux-2.6.32.11/drivers/gpu/drm/drm_lock.c
---- linux-2.6.32.11/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/drm_lock.c	2010-04-04 20:46:41.581454607 -0400
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
- 		if (drm_lock_take(&master->lock, lock->context)) {
- 			master->lock.file_priv = file_priv;
- 			master->lock.lock_time = jiffies;
--			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- 			break;	/* Got lock */
- 		}
- 
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
- 		return -EINVAL;
- 	}
- 
--	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
- 
- 	/* kernel_context_switch isn't used by any of the x86 drm
- 	 * modules but is required by the Sparc driver.
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.11/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.32.11/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i810/i810_dma.c	2010-04-04 20:46:41.581454607 -0400
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
- 				 dma->buflist[vertex->idx],
- 				 vertex->discard, vertex->used);
- 
--	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
- 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- 			     mc->last_render);
- 
--	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7017.c	2010-04-04 20:46:41.581454607 -0400
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- 	.init = ch7017_init,
- 	.detect = ch7017_detect,
- 	.mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-04-04 20:46:41.581454607 -0400
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- 	.init = ch7xxx_init,
- 	.detect = ch7xxx_detect,
- 	.mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo.h linux-2.6.32.11/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo.h	2010-04-04 20:46:41.581454607 -0400
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- 	 *
- 	 * \return singly-linked list of modes or NULL if no modes found.
- 	 */
--	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Clean up driver-specific bits of the output
- 	 */
--	void (*destroy) (struct intel_dvo_device *dvo);
-+	void (* const destroy) (struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Debugging hook to dump device registers to log file
- 	 */
--	void (*dump_regs)(struct intel_dvo_device *dvo);
-+	void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
- 
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
- 
- #endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo_ivch.c	2010-04-04 20:46:41.581454607 -0400
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
- 	}
- }
- 
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- 	.init = ivch_init,
- 	.dpms = ivch_dpms,
- 	.save = ivch_save,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.11/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo_sil164.c	2010-04-04 20:46:41.581454607 -0400
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- 	.init = sil164_init,
- 	.detect = sil164_detect,
- 	.mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.11/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/dvo_tfp410.c	2010-04-04 20:46:41.581454607 -0400
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- 	.init = tfp410_init,
- 	.detect = tfp410_detect,
- 	.mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.11/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.32.11/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/i915/i915_drv.c	2010-04-04 20:46:41.581454607 -0400
-@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
- 	return i915_resume(dev);
- }
- 
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- 	.fault = i915_gem_fault,
- 	.open = drm_gem_vm_open,
- 	.close = drm_gem_vm_close,
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.11/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.32.11/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/radeon/mkregtable.c	2010-04-04 20:46:41.581454607 -0400
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
- 	regex_t mask_rex;
- 	regmatch_t match[4];
- 	char buf[1024];
--	size_t end;
-+	long end;
- 	int len;
- 	int done = 0;
- 	int r;
- 	unsigned o;
- 	struct offset *offset;
- 	char last_reg_s[10];
--	int last_reg;
-+	unsigned long last_reg;
- 
- 	if (regcomp
- 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_atombios.c
---- linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_atombios.c	2010-04-04 20:46:41.581454607 -0400
-@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
- 	}
- }
- 
--struct bios_connector {
-+static struct bios_connector {
- 	bool valid;
- 	uint16_t line_mux;
- 	uint16_t devices;
- 	int connector_type;
- 	struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- 								 drm_device
-@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
- 	uint8_t dac;
- 	union atom_supported_devices *supported_devices;
- 	int i, j;
--	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_state.c	2010-04-04 20:46:41.581454607 -0400
-@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
- {
- 	drm_radeon_private_t *dev_priv = dev->dev_private;
- 	drm_radeon_getparam_t *param = data;
--	int value;
-+	int value = 0;
- 
- 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/radeon/radeon_ttm.c	2010-04-04 20:46:41.581454607 -0400
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
- 	DRM_INFO("radeon: ttm finalized\n");
- }
- 
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
--	struct ttm_buffer_object *bo;
--	int r;
--
--	bo = (struct ttm_buffer_object *)vma->vm_private_data;
--	if (bo == NULL) {
--		return VM_FAULT_NOPAGE;
--	}
--	r = ttm_vm_ops->fault(vma, vmf);
--	return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- 	struct drm_file *file_priv;
- 	struct radeon_device *rdev;
--	int r;
- 
- 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- 		return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
- 
- 	file_priv = (struct drm_file *)filp->private_data;
- 	rdev = file_priv->minor->dev->dev_private;
--	if (rdev == NULL) {
-+	if (!rdev)
- 		return -EINVAL;
--	}
--	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
--	if (unlikely(r != 0)) {
--		return r;
--	}
--	if (unlikely(ttm_vm_ops == NULL)) {
--		ttm_vm_ops = vma->vm_ops;
--		radeon_ttm_vm_ops = *ttm_vm_ops;
--		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
--	}
--	vma->vm_ops = &radeon_ttm_vm_ops;
--	return 0;
-+	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
- 
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo.c	2010-04-04 20:46:41.581454607 -0400
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
- 	NULL
- };
- 
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- 	.show = &ttm_bo_global_show
- };
- 
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-04-04 20:46:41.585591308 -0400
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
- {
- 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- 	    vma->vm_private_data;
--	struct ttm_bo_device *bdev = bo->bdev;
-+	struct ttm_bo_device *bdev;
- 	unsigned long bus_base;
- 	unsigned long bus_offset;
- 	unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
- 	unsigned long address = (unsigned long)vmf->virtual_address;
- 	int retval = VM_FAULT_NOPAGE;
- 
-+	if (!bo)
-+		return VM_FAULT_NOPAGE;
-+	bdev = bo->bdev;
-+
- 	/*
- 	 * Work around locking order reversal in fault / nopfn
- 	 * between mmap_sem and bo_reserve: Perform a trylock operation
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_global.c
---- linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_global.c	2010-04-04 20:46:41.585591308 -0400
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- 	struct mutex mutex;
- 	void *object;
--	int refcount;
-+	atomic_t refcount;
- };
- 
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- 		struct ttm_global_item *item = &glob[i];
- 		mutex_init(&item->mutex);
- 		item->object = NULL;
--		item->refcount = 0;
-+		atomic_set(&item->refcount, 0);
- 	}
- }
- 
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- 		struct ttm_global_item *item = &glob[i];
- 		BUG_ON(item->object != NULL);
--		BUG_ON(item->refcount != 0);
-+		BUG_ON(atomic_read(&item->refcount) != 0);
- 	}
- }
- 
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
- 	void *object;
- 
- 	mutex_lock(&item->mutex);
--	if (item->refcount == 0) {
-+	if (atomic_read(&item->refcount) == 0) {
- 		item->object = kzalloc(ref->size, GFP_KERNEL);
- 		if (unlikely(item->object == NULL)) {
- 			ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
- 			goto out_err;
- 
- 	}
--	++item->refcount;
-+	atomic_inc(&item->refcount);
- 	ref->object = item->object;
- 	object = item->object;
- 	mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
- 	struct ttm_global_item *item = &glob[ref->global_type];
- 
- 	mutex_lock(&item->mutex);
--	BUG_ON(item->refcount == 0);
-+	BUG_ON(atomic_read(&item->refcount) == 0);
- 	BUG_ON(ref->object != item->object);
--	if (--item->refcount == 0) {
-+	if (atomic_dec_and_test(&item->refcount)) {
- 		ref->release(ref);
- 		item->object = NULL;
- 	}
-diff -urNp linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_memory.c
---- linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/drm/ttm/ttm_memory.c	2010-04-04 20:46:41.585591308 -0400
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
- 	NULL
- };
- 
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- 	.show = &ttm_mem_zone_show,
- 	.store = &ttm_mem_zone_store
- };
-diff -urNp linux-2.6.32.11/drivers/gpu/vga/vgaarb.c linux-2.6.32.11/drivers/gpu/vga/vgaarb.c
---- linux-2.6.32.11/drivers/gpu/vga/vgaarb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/gpu/vga/vgaarb.c	2010-04-04 20:46:41.585591308 -0400
-@@ -961,7 +961,7 @@ static ssize_t vga_arb_write(struct file
- 		remaining -= 7;
- 		pr_devel("client 0x%p called 'target'\n", priv);
- 		/* if target is default */
--		if (!strncmp(buf, "default", 7))
-+		if (!strncmp(curr_pos, "default", 7))
- 			pdev = pci_dev_get(vga_default_device());
- 		else {
- 			if (!vga_pci_str_to_vars(curr_pos, remaining,
-diff -urNp linux-2.6.32.11/drivers/hwmon/k8temp.c linux-2.6.32.11/drivers/hwmon/k8temp.c
---- linux-2.6.32.11/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/hwmon/k8temp.c	2010-04-04 20:46:41.585591308 -0400
-@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
- 
- static struct pci_device_id k8temp_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, k8temp_ids);
-diff -urNp linux-2.6.32.11/drivers/hwmon/sis5595.c linux-2.6.32.11/drivers/hwmon/sis5595.c
---- linux-2.6.32.11/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/hwmon/sis5595.c	2010-04-04 20:46:41.585591308 -0400
-@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
- 
- static struct pci_device_id sis5595_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
-diff -urNp linux-2.6.32.11/drivers/hwmon/via686a.c linux-2.6.32.11/drivers/hwmon/via686a.c
---- linux-2.6.32.11/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/hwmon/via686a.c	2010-04-04 20:46:41.585591308 -0400
-@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
- 
- static struct pci_device_id via686a_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
-diff -urNp linux-2.6.32.11/drivers/hwmon/vt8231.c linux-2.6.32.11/drivers/hwmon/vt8231.c
---- linux-2.6.32.11/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/hwmon/vt8231.c	2010-04-04 20:46:41.585591308 -0400
-@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
- 
- static struct pci_device_id vt8231_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
-diff -urNp linux-2.6.32.11/drivers/hwmon/w83791d.c linux-2.6.32.11/drivers/hwmon/w83791d.c
---- linux-2.6.32.11/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/hwmon/w83791d.c	2010-04-04 20:46:41.585591308 -0400
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
- 			  struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
- 
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
- 
- #ifdef DEBUG
-diff -urNp linux-2.6.32.11/drivers/i2c/busses/i2c-i801.c linux-2.6.32.11/drivers/i2c/busses/i2c-i801.c
---- linux-2.6.32.11/drivers/i2c/busses/i2c-i801.c	2010-04-04 20:41:49.952923765 -0400
-+++ linux-2.6.32.11/drivers/i2c/busses/i2c-i801.c	2010-04-04 20:46:41.585591308 -0400
-@@ -580,7 +580,7 @@ static struct pci_device_id i801_ids[] =
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_4) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, i801_ids);
-diff -urNp linux-2.6.32.11/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.11/drivers/i2c/busses/i2c-piix4.c
---- linux-2.6.32.11/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/i2c/busses/i2c-piix4.c	2010-04-04 20:46:41.585591308 -0400
-@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
- 		.ident = "IBM",
- 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
--	{ },
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
-@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, piix4_ids);
-diff -urNp linux-2.6.32.11/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.11/drivers/i2c/busses/i2c-sis630.c
---- linux-2.6.32.11/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/i2c/busses/i2c-sis630.c	2010-04-04 20:46:41.585591308 -0400
-@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
- static struct pci_device_id sis630_ids[] __devinitdata = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis630_ids);
-diff -urNp linux-2.6.32.11/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.11/drivers/i2c/busses/i2c-sis96x.c
---- linux-2.6.32.11/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/i2c/busses/i2c-sis96x.c	2010-04-04 20:46:41.585591308 -0400
-@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
- 
- static struct pci_device_id sis96x_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis96x_ids);
-diff -urNp linux-2.6.32.11/drivers/ide/ide-cd.c linux-2.6.32.11/drivers/ide/ide-cd.c
---- linux-2.6.32.11/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ide/ide-cd.c	2010-04-04 20:46:41.585591308 -0400
-@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
- 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- 		if ((unsigned long)buf & alignment
- 		    || blk_rq_bytes(rq) & q->dma_pad_mask
--		    || object_is_on_stack(buf))
-+		    || object_starts_on_stack(buf))
- 			drive->dma = 0;
- 	}
- }
-diff -urNp linux-2.6.32.11/drivers/ieee1394/dv1394.c linux-2.6.32.11/drivers/ieee1394/dv1394.c
---- linux-2.6.32.11/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/dv1394.c	2010-04-04 20:46:41.585591308 -0400
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
- 	based upon DIF section and sequence
- */
- 
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
-@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
- 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
- 	},
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
-diff -urNp linux-2.6.32.11/drivers/ieee1394/eth1394.c linux-2.6.32.11/drivers/ieee1394/eth1394.c
---- linux-2.6.32.11/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/eth1394.c	2010-04-04 20:46:41.585591308 -0400
-@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
- 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
- 		.version = ETHER1394_GASP_VERSION,
- 	},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
-diff -urNp linux-2.6.32.11/drivers/ieee1394/hosts.c linux-2.6.32.11/drivers/ieee1394/hosts.c
---- linux-2.6.32.11/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/hosts.c	2010-04-04 20:46:41.589782410 -0400
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
- }
- 
- static struct hpsb_host_driver dummy_driver = {
-+	.name =		   "dummy",
- 	.transmit_packet = dummy_transmit_packet,
- 	.devctl =	   dummy_devctl,
- 	.isoctl =	   dummy_isoctl
-diff -urNp linux-2.6.32.11/drivers/ieee1394/ohci1394.c linux-2.6.32.11/drivers/ieee1394/ohci1394.c
---- linux-2.6.32.11/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/ohci1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
- 
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
- 
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
- 		.subvendor =	PCI_ANY_ID,
- 		.subdevice =	PCI_ANY_ID,
- 	},
--	{ 0, },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
-diff -urNp linux-2.6.32.11/drivers/ieee1394/raw1394.c linux-2.6.32.11/drivers/ieee1394/raw1394.c
---- linux-2.6.32.11/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/raw1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
- 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
-diff -urNp linux-2.6.32.11/drivers/ieee1394/sbp2.c linux-2.6.32.11/drivers/ieee1394/sbp2.c
---- linux-2.6.32.11/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/sbp2.c	2010-04-04 20:46:41.589782410 -0400
-@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
- 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
- 
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
- 
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- 	int ret;
- 
-diff -urNp linux-2.6.32.11/drivers/ieee1394/video1394.c linux-2.6.32.11/drivers/ieee1394/video1394.c
---- linux-2.6.32.11/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/ieee1394/video1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
-                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
-                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
-         },
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
-diff -urNp linux-2.6.32.11/drivers/infiniband/core/cm.c linux-2.6.32.11/drivers/infiniband/core/cm.c
---- linux-2.6.32.11/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/infiniband/core/cm.c	2010-04-04 20:46:41.589782410 -0400
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM
- 
- struct cm_counter_group {
- 	struct kobject obj;
--	atomic_long_t counter[CM_ATTR_COUNT];
-+	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
- 
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
- 	struct ib_mad_send_buf *msg = NULL;
- 	int ret;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REQ_COUNTER]);
- 
- 	/* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
- 	if (!cm_id_priv)
- 		return;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REP_COUNTER]);
- 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- 	if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
- 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- 		spin_unlock_irq(&cm_id_priv->lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_RTU_COUNTER]);
- 		goto out;
- 	}
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
- 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- 				   dreq_msg->local_comm_id);
- 	if (!cm_id_priv) {
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		cm_issue_drep(work->port, work->mad_recv_wc);
- 		return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
- 	case IB_CM_MRA_REP_RCVD:
- 		break;
- 	case IB_CM_TIMEWAIT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_DREQ_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
- 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
- 				  cm_id_priv->msg, timeout)) {
- 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
--				atomic_long_inc(&work->port->
-+				atomic_long_inc_unchecked(&work->port->
- 						counter_group[CM_RECV_DUPLICATES].
- 						counter[CM_MRA_COUNTER]);
- 			goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
- 		break;
- 	case IB_CM_MRA_REQ_RCVD:
- 	case IB_CM_MRA_REP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_MRA_COUNTER]);
- 		/* fall through */
- 	default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
- 	case IB_CM_LAP_IDLE:
- 		break;
- 	case IB_CM_MRA_LAP_SENT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_LAP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
- 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- 	if (cur_cm_id_priv) {
- 		spin_unlock_irq(&cm.lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_SIDR_REQ_COUNTER]);
- 		goto out; /* Duplicate message. */
- 	}
-@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
- 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- 		msg->retries = 1;
- 
--	atomic_long_add(1 + msg->retries,
-+	atomic_long_add_unchecked(1 + msg->retries,
- 			&port->counter_group[CM_XMIT].counter[attr_index]);
- 	if (msg->retries)
--		atomic_long_add(msg->retries,
-+		atomic_long_add_unchecked(msg->retries,
- 				&port->counter_group[CM_XMIT_RETRIES].
- 				counter[attr_index]);
- 
-@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
- 	}
- 
- 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
--	atomic_long_inc(&port->counter_group[CM_RECV].
-+	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- 			counter[attr_id - CM_ATTR_ID_OFFSET]);
- 
- 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
- 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
- 
- 	return sprintf(buf, "%ld\n",
--		       atomic_long_read(&group->counter[cm_attr->index]));
-+		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
- 
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- 	.show = cm_show_counter
- };
- 
-diff -urNp linux-2.6.32.11/drivers/infiniband/core/sysfs.c linux-2.6.32.11/drivers/infiniband/core/sysfs.c
---- linux-2.6.32.11/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/infiniband/core/sysfs.c	2010-04-04 20:46:41.589782410 -0400
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
- 	return port_attr->show(p, port_attr, buf);
- }
- 
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- 	.show = port_attr_show
- };
- 
-diff -urNp linux-2.6.32.11/drivers/input/keyboard/atkbd.c linux-2.6.32.11/drivers/input/keyboard/atkbd.c
---- linux-2.6.32.11/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/keyboard/atkbd.c	2010-04-04 20:46:41.589782410 -0400
-@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
-diff -urNp linux-2.6.32.11/drivers/input/mouse/lifebook.c linux-2.6.32.11/drivers/input/mouse/lifebook.c
---- linux-2.6.32.11/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/mouse/lifebook.c	2010-04-04 20:46:41.589782410 -0400
-@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
- 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
-diff -urNp linux-2.6.32.11/drivers/input/mouse/psmouse-base.c linux-2.6.32.11/drivers/input/mouse/psmouse-base.c
---- linux-2.6.32.11/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/mouse/psmouse-base.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
-diff -urNp linux-2.6.32.11/drivers/input/mouse/synaptics.c linux-2.6.32.11/drivers/input/mouse/synaptics.c
---- linux-2.6.32.11/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/mouse/synaptics.c	2010-04-04 20:46:41.593451026 -0400
-@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
- 				break;
- 			case 2:
- 				if (SYN_MODEL_PEN(priv->model_id))
--					;   /* Nothing, treat a pen as a single finger */
-+					break;   /* Nothing, treat a pen as a single finger */
- 				break;
- 			case 4 ... 15:
- 				if (SYN_CAP_PALMDETECT(priv->capabilities))
-@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
- 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
- 		},
--
- 	},
- 	{
- 		.ident = "Toshiba Portege M300",
-@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
- 		},
--
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.11/drivers/input/mousedev.c linux-2.6.32.11/drivers/input/mousedev.c
---- linux-2.6.32.11/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/mousedev.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
- 
- #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
- static struct miscdevice psaux_mouse = {
--	PSMOUSE_MINOR, "psaux", &mousedev_fops
-+	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
- };
- static int psaux_registered;
- #endif
-diff -urNp linux-2.6.32.11/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.11/drivers/input/serio/i8042-x86ia64io.h
---- linux-2.6.32.11/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.11/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:46:41.593451026 -0400
-@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
-@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #ifdef CONFIG_PNP
-@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
-@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #endif /* CONFIG_X86 */
-diff -urNp linux-2.6.32.11/drivers/input/serio/serio_raw.c linux-2.6.32.11/drivers/input/serio/serio_raw.c
---- linux-2.6.32.11/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/input/serio/serio_raw.c	2010-04-04 20:46:41.593451026 -0400
-@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
-diff -urNp linux-2.6.32.11/drivers/isdn/gigaset/common.c linux-2.6.32.11/drivers/isdn/gigaset/common.c
---- linux-2.6.32.11/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/isdn/gigaset/common.c	2010-04-04 20:46:41.593451026 -0400
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
- 	cs->commands_pending = 0;
- 	cs->cur_at_seq = 0;
- 	cs->gotfwver = -1;
--	cs->open_count = 0;
-+	atomic_set(&cs->open_count, 0);
- 	cs->dev = NULL;
- 	cs->tty = NULL;
- 	cs->tty_dev = NULL;
-diff -urNp linux-2.6.32.11/drivers/isdn/gigaset/gigaset.h linux-2.6.32.11/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.32.11/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/isdn/gigaset/gigaset.h	2010-04-04 20:46:41.593451026 -0400
-@@ -446,7 +446,7 @@ struct cardstate {
- 	spinlock_t cmdlock;
- 	unsigned curlen, cmdbytes;
- 
--	unsigned open_count;
-+	atomic_t open_count;
- 	struct tty_struct *tty;
- 	struct tasklet_struct if_wake_tasklet;
- 	unsigned control_state;
-diff -urNp linux-2.6.32.11/drivers/isdn/gigaset/interface.c linux-2.6.32.11/drivers/isdn/gigaset/interface.c
---- linux-2.6.32.11/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.11/drivers/isdn/gigaset/interface.c	2010-04-04 20:46:41.593451026 -0400
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
- 		return -ERESTARTSYS; // FIXME -EINTR?
- 	tty->driver_data = cs;
- 
--	++cs->open_count;
--
--	if (cs->open_count == 1) {
-+	if (atomic_inc_return(&cs->open_count) == 1) {
- 		spin_lock_irqsave(&cs->lock, flags);
- 		cs->tty = tty;
- 		spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
--		if (!--cs->open_count) {
-+		if (!atomic_dec_return(&cs->open_count)) {
- 			spin_lock_irqsave(&cs->lock, flags);
- 			cs->tty = NULL;
- 			spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED)
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
- 		goto out;
- 	}
- 
--	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 		goto out;
- 	}
-diff -urNp linux-2.6.32.11/drivers/isdn/hardware/avm/b1.c linux-2.6.32.11/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.32.11/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/isdn/hardware/avm/b1.c	2010-04-04 20:46:41.593451026 -0400
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (t4file->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (config->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-diff -urNp linux-2.6.32.11/drivers/isdn/icn/icn.c linux-2.6.32.11/drivers/isdn/icn/icn.c
---- linux-2.6.32.11/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/isdn/icn/icn.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
- 		if (count > len)
- 			count = len;
- 		if (user) {
--			if (copy_from_user(msg, buf, count))
-+			if (count > sizeof msg || copy_from_user(msg, buf, count))
- 				return -EFAULT;
- 		} else
- 			memcpy(msg, buf, count);
-diff -urNp linux-2.6.32.11/drivers/lguest/core.c linux-2.6.32.11/drivers/lguest/core.c
---- linux-2.6.32.11/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/lguest/core.c	2010-04-04 20:46:41.593451026 -0400
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- 	 * it's worked so far.  The end address needs +1 because __get_vm_area
- 	 * allocates an extra guard page, so we need space for that.
- 	 */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- 	if (!switcher_vma) {
- 		err = -ENOMEM;
- 		printk("lguest: could not map switcher pages high\n");
-diff -urNp linux-2.6.32.11/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.11/drivers/macintosh/via-pmu-backlight.c
---- linux-2.6.32.11/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/macintosh/via-pmu-backlight.c	2010-04-04 20:46:41.593451026 -0400
-@@ -15,7 +15,7 @@
- 
- #define MAX_PMU_LEVEL 0xFF
- 
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- 	.get_brightness	= pmu_backlight_get_brightness,
- 	.update_status	= pmu_backlight_update_status,
- 
-diff -urNp linux-2.6.32.11/drivers/macintosh/via-pmu.c linux-2.6.32.11/drivers/macintosh/via-pmu.c
---- linux-2.6.32.11/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/macintosh/via-pmu.c	2010-04-04 20:46:41.593451026 -0400
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
- 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
- 
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- 	.enter = powerbook_sleep,
- 	.valid = pmu_sleep_valid,
- };
-diff -urNp linux-2.6.32.11/drivers/md/bitmap.c linux-2.6.32.11/drivers/md/bitmap.c
---- linux-2.6.32.11/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/md/bitmap.c	2010-04-04 20:46:41.593451026 -0400
-@@ -58,7 +58,7 @@
- #  if DEBUG > 0
- #    define PRINTK(x...) printk(KERN_DEBUG x)
- #  else
--#    define PRINTK(x...)
-+#    define PRINTK(x...) do {} while (0)
- #  endif
- #endif
- 
-diff -urNp linux-2.6.32.11/drivers/md/dm-sysfs.c linux-2.6.32.11/drivers/md/dm-sysfs.c
---- linux-2.6.32.11/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/md/dm-sysfs.c	2010-04-04 20:46:41.593451026 -0400
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- 	NULL,
- };
- 
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- 	.show	= dm_attr_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/md/dm-table.c linux-2.6.32.11/drivers/md/dm-table.c
---- linux-2.6.32.11/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/md/dm-table.c	2010-04-04 20:46:41.593451026 -0400
-@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
- 	if (!dev_size)
- 		return 0;
- 
--	if ((start >= dev_size) || (start + len > dev_size)) {
-+	if ((start >= dev_size) || (len > dev_size - start)) {
- 		DMWARN("%s: %s too small for target: "
- 		       "start=%llu, len=%llu, dev_size=%llu",
- 		       dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.32.11/drivers/md/md.c linux-2.6.32.11/drivers/md/md.c
---- linux-2.6.32.11/drivers/md/md.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/md/md.c	2010-04-04 20:46:41.597784214 -0400
-@@ -2508,7 +2508,7 @@ static void rdev_free(struct kobject *ko
- 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- 	kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- 	.show		= rdev_attr_show,
- 	.store		= rdev_attr_store,
- };
-@@ -3878,7 +3878,7 @@ static void md_free(struct kobject *ko)
- 	kfree(mddev);
- }
- 
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- 	.show	= md_attr_show,
- 	.store	= md_attr_store,
- };
-@@ -6004,7 +6004,7 @@ static int md_seq_show(struct seq_file *
- 				chunk_kb ? "KB" : "B");
- 			if (bitmap->file) {
- 				seq_printf(seq, ", file: ");
--				seq_path(seq, &bitmap->file->f_path, " \t\n");
-+				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- 			}
- 
- 			seq_printf(seq, "\n");
-@@ -6098,7 +6098,7 @@ static int is_mddev_idle(mddev_t *mddev,
- 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- 			      (int)part_stat_read(&disk->part0, sectors[1]) -
--			      atomic_read(&disk->sync_io);
-+			      atomic_read_unchecked(&disk->sync_io);
- 		/* sync IO will cause sync_io to increase before the disk_stats
- 		 * as sync_io is counted when a request starts, and
- 		 * disk_stats is counted when it completes.
-diff -urNp linux-2.6.32.11/drivers/md/md.h linux-2.6.32.11/drivers/md/md.h
---- linux-2.6.32.11/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/md/md.h	2010-04-04 20:46:41.597784214 -0400
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
- 
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
--        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
- 
- struct mdk_personality
-diff -urNp linux-2.6.32.11/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.11/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.32.11/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/media/dvb/dvb-core/dvbdev.c	2010-04-04 20:46:41.597784214 -0400
-@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
- 			const struct dvb_device *template, void *priv, int type)
- {
- 	struct dvb_device *dvbdev;
-+	/* cannot be const */
- 	struct file_operations *dvbdevfops;
- 	struct device *clsdev;
- 	int minor;
-diff -urNp linux-2.6.32.11/drivers/media/radio/radio-cadet.c linux-2.6.32.11/drivers/media/radio/radio-cadet.c
---- linux-2.6.32.11/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/media/radio/radio-cadet.c	2010-04-04 20:46:41.597784214 -0400
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
- 	while (i < count && dev->rdsin != dev->rdsout)
- 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
- 
--	if (copy_to_user(data, readbuf, i))
-+	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- 		return -EFAULT;
- 	return i;
- }
-diff -urNp linux-2.6.32.11/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.11/drivers/media/video/usbvideo/konicawc.c
---- linux-2.6.32.11/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/media/video/usbvideo/konicawc.c	2010-04-04 20:46:41.597784214 -0400
-@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.11/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.11/drivers/media/video/usbvideo/quickcam_messenger.c
---- linux-2.6.32.11/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/media/video/usbvideo/quickcam_messenger.c	2010-04-04 20:46:41.597784214 -0400
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.11/drivers/message/i2o/i2o_proc.c linux-2.6.32.11/drivers/message/i2o/i2o_proc.c
---- linux-2.6.32.11/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/message/i2o/i2o_proc.c	2010-04-04 20:46:41.597784214 -0400
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- 	"Array Controller Device"
- };
- 
--static char *chtostr(u8 * chars, int n)
--{
--	char tmp[256];
--	tmp[0] = 0;
--	return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- 				   char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
- 
- 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", ddm_table.module_id);
--		seq_printf(seq, "%-29s",
--			   chtostr(ddm_table.module_name_version, 28));
-+		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- 		seq_printf(seq, "%9d  ", ddm_table.data_size);
- 		seq_printf(seq, "%8d", ddm_table.code_size);
- 
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
- 
- 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", dst->module_id);
--		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
--		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+		seq_printf(seq, "%-.28s", dst->module_name_version);
-+		seq_printf(seq, "%-.8s", dst->date);
- 		seq_printf(seq, "%8d ", dst->module_size);
- 		seq_printf(seq, "%8d ", dst->mpb_size);
- 		seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
- 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
- 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
- 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
--	seq_printf(seq, "Vendor info   : %s\n",
--		   chtostr((u8 *) (work32 + 2), 16));
--	seq_printf(seq, "Product info  : %s\n",
--		   chtostr((u8 *) (work32 + 6), 16));
--	seq_printf(seq, "Description   : %s\n",
--		   chtostr((u8 *) (work32 + 10), 16));
--	seq_printf(seq, "Product rev.  : %s\n",
--		   chtostr((u8 *) (work32 + 14), 8));
-+	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
-+	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
-+	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
-+	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
- 
- 	seq_printf(seq, "Serial number : ");
- 	print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
- 	}
- 
- 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
--	seq_printf(seq, "Module name         : %s\n",
--		   chtostr(result.module_name, 24));
--	seq_printf(seq, "Module revision     : %s\n",
--		   chtostr(result.module_rev, 8));
-+	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
-+	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
- 
- 	seq_printf(seq, "Serial number       : ");
- 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
- 		return 0;
- 	}
- 
--	seq_printf(seq, "Device name     : %s\n",
--		   chtostr(result.device_name, 64));
--	seq_printf(seq, "Service name    : %s\n",
--		   chtostr(result.service_name, 64));
--	seq_printf(seq, "Physical name   : %s\n",
--		   chtostr(result.physical_location, 64));
--	seq_printf(seq, "Instance number : %s\n",
--		   chtostr(result.instance_number, 4));
-+	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
-+	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
-+	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
-+	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/drivers/misc/kgdbts.c linux-2.6.32.11/drivers/misc/kgdbts.c
---- linux-2.6.32.11/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/misc/kgdbts.c	2010-04-04 20:46:41.597784214 -0400
-@@ -118,7 +118,7 @@
- 	} while (0)
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- 	.name			= "kgdbts",
- 	.read_char		= kgdbts_get_char,
- 	.write_char		= kgdbts_put_char,
-diff -urNp linux-2.6.32.11/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.11/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.32.11/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/misc/sgi-gru/gruhandles.c	2010-04-04 20:46:41.597784214 -0400
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
- 
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
--	atomic_long_inc(&mcs_op_statistics[op].count);
--	atomic_long_add(clks, &mcs_op_statistics[op].total);
-+	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- 	if (mcs_op_statistics[op].max < clks)
- 		mcs_op_statistics[op].max = clks;
- }
-diff -urNp linux-2.6.32.11/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.11/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.32.11/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/misc/sgi-gru/gruprocfs.c	2010-04-04 20:46:41.597784214 -0400
-@@ -32,9 +32,9 @@
- 
- #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
- 
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
--	unsigned long val = atomic_long_read(v);
-+	unsigned long val = atomic_long_read_unchecked(v);
- 
- 	if (val)
- 		seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
- 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
- 
- 	for (op = 0; op < mcsop_last; op++) {
--		count = atomic_long_read(&mcs_op_statistics[op].count);
--		total = atomic_long_read(&mcs_op_statistics[op].total);
-+		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- 		max = mcs_op_statistics[op].max;
- 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- 			   count ? total / count : 0, max);
-diff -urNp linux-2.6.32.11/drivers/misc/sgi-gru/grutables.h linux-2.6.32.11/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.32.11/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/misc/sgi-gru/grutables.h	2010-04-04 20:46:41.597784214 -0400
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
-  * GRU statistics.
-  */
- struct gru_stats_s {
--	atomic_long_t vdata_alloc;
--	atomic_long_t vdata_free;
--	atomic_long_t gts_alloc;
--	atomic_long_t gts_free;
--	atomic_long_t vdata_double_alloc;
--	atomic_long_t gts_double_allocate;
--	atomic_long_t assign_context;
--	atomic_long_t assign_context_failed;
--	atomic_long_t free_context;
--	atomic_long_t load_user_context;
--	atomic_long_t load_kernel_context;
--	atomic_long_t lock_kernel_context;
--	atomic_long_t unlock_kernel_context;
--	atomic_long_t steal_user_context;
--	atomic_long_t steal_kernel_context;
--	atomic_long_t steal_context_failed;
--	atomic_long_t nopfn;
--	atomic_long_t break_cow;
--	atomic_long_t asid_new;
--	atomic_long_t asid_next;
--	atomic_long_t asid_wrap;
--	atomic_long_t asid_reuse;
--	atomic_long_t intr;
--	atomic_long_t intr_mm_lock_failed;
--	atomic_long_t call_os;
--	atomic_long_t call_os_offnode_reference;
--	atomic_long_t call_os_check_for_bug;
--	atomic_long_t call_os_wait_queue;
--	atomic_long_t user_flush_tlb;
--	atomic_long_t user_unload_context;
--	atomic_long_t user_exception;
--	atomic_long_t set_context_option;
--	atomic_long_t migrate_check;
--	atomic_long_t migrated_retarget;
--	atomic_long_t migrated_unload;
--	atomic_long_t migrated_unload_delay;
--	atomic_long_t migrated_nopfn_retarget;
--	atomic_long_t migrated_nopfn_unload;
--	atomic_long_t tlb_dropin;
--	atomic_long_t tlb_dropin_fail_no_asid;
--	atomic_long_t tlb_dropin_fail_upm;
--	atomic_long_t tlb_dropin_fail_invalid;
--	atomic_long_t tlb_dropin_fail_range_active;
--	atomic_long_t tlb_dropin_fail_idle;
--	atomic_long_t tlb_dropin_fail_fmm;
--	atomic_long_t tlb_dropin_fail_no_exception;
--	atomic_long_t tlb_dropin_fail_no_exception_war;
--	atomic_long_t tfh_stale_on_fault;
--	atomic_long_t mmu_invalidate_range;
--	atomic_long_t mmu_invalidate_page;
--	atomic_long_t mmu_clear_flush_young;
--	atomic_long_t flush_tlb;
--	atomic_long_t flush_tlb_gru;
--	atomic_long_t flush_tlb_gru_tgh;
--	atomic_long_t flush_tlb_gru_zero_asid;
--
--	atomic_long_t copy_gpa;
--
--	atomic_long_t mesq_receive;
--	atomic_long_t mesq_receive_none;
--	atomic_long_t mesq_send;
--	atomic_long_t mesq_send_failed;
--	atomic_long_t mesq_noop;
--	atomic_long_t mesq_send_unexpected_error;
--	atomic_long_t mesq_send_lb_overflow;
--	atomic_long_t mesq_send_qlimit_reached;
--	atomic_long_t mesq_send_amo_nacked;
--	atomic_long_t mesq_send_put_nacked;
--	atomic_long_t mesq_qf_not_full;
--	atomic_long_t mesq_qf_locked;
--	atomic_long_t mesq_qf_noop_not_full;
--	atomic_long_t mesq_qf_switch_head_failed;
--	atomic_long_t mesq_qf_unexpected_error;
--	atomic_long_t mesq_noop_unexpected_error;
--	atomic_long_t mesq_noop_lb_overflow;
--	atomic_long_t mesq_noop_qlimit_reached;
--	atomic_long_t mesq_noop_amo_nacked;
--	atomic_long_t mesq_noop_put_nacked;
-+	atomic_long_unchecked_t vdata_alloc;
-+	atomic_long_unchecked_t vdata_free;
-+	atomic_long_unchecked_t gts_alloc;
-+	atomic_long_unchecked_t gts_free;
-+	atomic_long_unchecked_t vdata_double_alloc;
-+	atomic_long_unchecked_t gts_double_allocate;
-+	atomic_long_unchecked_t assign_context;
-+	atomic_long_unchecked_t assign_context_failed;
-+	atomic_long_unchecked_t free_context;
-+	atomic_long_unchecked_t load_user_context;
-+	atomic_long_unchecked_t load_kernel_context;
-+	atomic_long_unchecked_t lock_kernel_context;
-+	atomic_long_unchecked_t unlock_kernel_context;
-+	atomic_long_unchecked_t steal_user_context;
-+	atomic_long_unchecked_t steal_kernel_context;
-+	atomic_long_unchecked_t steal_context_failed;
-+	atomic_long_unchecked_t nopfn;
-+	atomic_long_unchecked_t break_cow;
-+	atomic_long_unchecked_t asid_new;
-+	atomic_long_unchecked_t asid_next;
-+	atomic_long_unchecked_t asid_wrap;
-+	atomic_long_unchecked_t asid_reuse;
-+	atomic_long_unchecked_t intr;
-+	atomic_long_unchecked_t intr_mm_lock_failed;
-+	atomic_long_unchecked_t call_os;
-+	atomic_long_unchecked_t call_os_offnode_reference;
-+	atomic_long_unchecked_t call_os_check_for_bug;
-+	atomic_long_unchecked_t call_os_wait_queue;
-+	atomic_long_unchecked_t user_flush_tlb;
-+	atomic_long_unchecked_t user_unload_context;
-+	atomic_long_unchecked_t user_exception;
-+	atomic_long_unchecked_t set_context_option;
-+	atomic_long_unchecked_t migrate_check;
-+	atomic_long_unchecked_t migrated_retarget;
-+	atomic_long_unchecked_t migrated_unload;
-+	atomic_long_unchecked_t migrated_unload_delay;
-+	atomic_long_unchecked_t migrated_nopfn_retarget;
-+	atomic_long_unchecked_t migrated_nopfn_unload;
-+	atomic_long_unchecked_t tlb_dropin;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+	atomic_long_unchecked_t tlb_dropin_fail_upm;
-+	atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+	atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+	atomic_long_unchecked_t tlb_dropin_fail_idle;
-+	atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+	atomic_long_unchecked_t tfh_stale_on_fault;
-+	atomic_long_unchecked_t mmu_invalidate_range;
-+	atomic_long_unchecked_t mmu_invalidate_page;
-+	atomic_long_unchecked_t mmu_clear_flush_young;
-+	atomic_long_unchecked_t flush_tlb;
-+	atomic_long_unchecked_t flush_tlb_gru;
-+	atomic_long_unchecked_t flush_tlb_gru_tgh;
-+	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-+
-+	atomic_long_unchecked_t copy_gpa;
-+
-+	atomic_long_unchecked_t mesq_receive;
-+	atomic_long_unchecked_t mesq_receive_none;
-+	atomic_long_unchecked_t mesq_send;
-+	atomic_long_unchecked_t mesq_send_failed;
-+	atomic_long_unchecked_t mesq_noop;
-+	atomic_long_unchecked_t mesq_send_unexpected_error;
-+	atomic_long_unchecked_t mesq_send_lb_overflow;
-+	atomic_long_unchecked_t mesq_send_qlimit_reached;
-+	atomic_long_unchecked_t mesq_send_amo_nacked;
-+	atomic_long_unchecked_t mesq_send_put_nacked;
-+	atomic_long_unchecked_t mesq_qf_not_full;
-+	atomic_long_unchecked_t mesq_qf_locked;
-+	atomic_long_unchecked_t mesq_qf_noop_not_full;
-+	atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+	atomic_long_unchecked_t mesq_qf_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_lb_overflow;
-+	atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+	atomic_long_unchecked_t mesq_noop_amo_nacked;
-+	atomic_long_unchecked_t mesq_noop_put_nacked;
- 
- };
- 
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
- 	cchop_deallocate, tghop_invalidate, mcsop_last};
- 
- struct mcs_op_statistic {
--	atomic_long_t	count;
--	atomic_long_t	total;
-+	atomic_long_unchecked_t	count;
-+	atomic_long_unchecked_t	total;
- 	unsigned long	max;
- };
- 
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
- 
- #define STAT(id)	do {						\
- 				if (gru_options & OPT_STATS)		\
--					atomic_long_inc(&gru_stats.id);	\
-+					atomic_long_inc_unchecked(&gru_stats.id);	\
- 			} while (0)
- 
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.32.11/drivers/mtd/devices/doc2000.c linux-2.6.32.11/drivers/mtd/devices/doc2000.c
---- linux-2.6.32.11/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/mtd/devices/doc2000.c	2010-04-04 20:46:41.597784214 -0400
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
- 
- 		/* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
--		if (len != 0x200 && eccbuf)
-+		if (len != 0x200)
- 			printk(KERN_WARNING
- 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
- 			       (long) to, (long) len);
-diff -urNp linux-2.6.32.11/drivers/mtd/devices/doc2001.c linux-2.6.32.11/drivers/mtd/devices/doc2001.c
---- linux-2.6.32.11/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/mtd/devices/doc2001.c	2010-04-04 20:46:41.597784214 -0400
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
- 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
- 
- 	/* Don't allow read past end of device */
--	if (from >= this->totlen)
-+	if (from >= this->totlen || !len)
- 		return -EINVAL;
- 
- 	/* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.32.11/drivers/mtd/ubi/build.c linux-2.6.32.11/drivers/mtd/ubi/build.c
---- linux-2.6.32.11/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/mtd/ubi/build.c	2010-04-04 20:46:41.597784214 -0400
-@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
- static int __init bytes_str_to_int(const char *str)
- {
- 	char *endp;
--	unsigned long result;
-+	unsigned long result, scale = 1;
- 
- 	result = simple_strtoul(str, &endp, 0);
- 	if (str == endp || result >= INT_MAX) {
-@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
- 
- 	switch (*endp) {
- 	case 'G':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'M':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'K':
--		result *= 1024;
-+		scale *= 1024;
- 		if (endp[1] == 'i' && endp[2] == 'B')
- 			endp += 2;
- 	case '\0':
-@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
- 		return -EINVAL;
- 	}
- 
--	return result;
-+	if ((intoverflow_t)result*scale >= INT_MAX) {
-+		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
-+		       str);
-+		return -EINVAL;
-+	}
-+
-+	return result*scale;
- }
- 
- /**
-diff -urNp linux-2.6.32.11/drivers/net/e1000e/82571.c linux-2.6.32.11/drivers/net/e1000e/82571.c
---- linux-2.6.32.11/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/e1000e/82571.c	2010-04-04 20:46:41.597784214 -0400
-@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 	u32 swsm = 0;
- 	u32 swsm2 = 0;
-@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- 	/* .check_mng_mode: mac type dependent */
- 	/* .check_for_link: media type dependent */
- 	.id_led_init		= e1000e_id_led_init,
-@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= NULL,
-@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_82571,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_82571,
-diff -urNp linux-2.6.32.11/drivers/net/e1000e/e1000.h linux-2.6.32.11/drivers/net/e1000e/e1000.h
---- linux-2.6.32.11/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/e1000e/e1000.h	2010-04-04 20:46:41.597784214 -0400
-@@ -375,9 +375,9 @@ struct e1000_info {
- 	u32			pba;
- 	u32			max_hw_frame_size;
- 	s32			(*get_variants)(struct e1000_adapter *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- /* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.32.11/drivers/net/e1000e/es2lan.c linux-2.6.32.11/drivers/net/e1000e/es2lan.c
---- linux-2.6.32.11/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/e1000e/es2lan.c	2010-04-04 20:46:41.597784214 -0400
-@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 
- 	/* Set media type */
-@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000e_check_mng_mode_generic,
- 	/* check_for_link dependent on media type */
-@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy	 	= e1000e_phy_sw_reset,
-@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
- 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
- };
- 
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.32.11/drivers/net/e1000e/hw.h linux-2.6.32.11/drivers/net/e1000e/hw.h
---- linux-2.6.32.11/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.11/drivers/net/e1000e/hw.h	2010-04-04 20:46:41.601781347 -0400
-@@ -756,34 +756,34 @@ struct e1000_mac_operations {
- 
- /* Function pointers for the PHY. */
- struct e1000_phy_operations {
--	s32  (*acquire_phy)(struct e1000_hw *);
--	s32  (*check_polarity)(struct e1000_hw *);
--	s32  (*check_reset_block)(struct e1000_hw *);
--	s32  (*commit_phy)(struct e1000_hw *);
--	s32  (*force_speed_duplex)(struct e1000_hw *);
--	s32  (*get_cfg_done)(struct e1000_hw *hw);
--	s32  (*get_cable_length)(struct e1000_hw *);
--	s32  (*get_phy_info)(struct e1000_hw *);
--	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
--	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
--	void (*release_phy)(struct e1000_hw *);
--	s32  (*reset_phy)(struct e1000_hw *);
--	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
--	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
--	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
--	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
--	s32  (*cfg_on_link_up)(struct e1000_hw *);
-+	s32  (* acquire_phy)(struct e1000_hw *);
-+	s32  (* check_polarity)(struct e1000_hw *);
-+	s32  (* check_reset_block)(struct e1000_hw *);
-+	s32  (* commit_phy)(struct e1000_hw *);
-+	s32  (* force_speed_duplex)(struct e1000_hw *);
-+	s32  (* get_cfg_done)(struct e1000_hw *hw);
-+	s32  (* get_cable_length)(struct e1000_hw *);
-+	s32  (* get_phy_info)(struct e1000_hw *);
-+	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
-+	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-+	void (* release_phy)(struct e1000_hw *);
-+	s32  (* reset_phy)(struct e1000_hw *);
-+	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
-+	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-+	s32  (* cfg_on_link_up)(struct e1000_hw *);
- };
- 
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
--	s32  (*acquire_nvm)(struct e1000_hw *);
--	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release_nvm)(struct e1000_hw *);
--	s32  (*update_nvm)(struct e1000_hw *);
--	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
--	s32  (*validate_nvm)(struct e1000_hw *);
--	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire_nvm)(struct e1000_hw *);
-+	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release_nvm)(struct e1000_hw *);
-+	s32  (* const update_nvm)(struct e1000_hw *);
-+	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
-+	s32  (* const validate_nvm)(struct e1000_hw *);
-+	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_mac_info {
-diff -urNp linux-2.6.32.11/drivers/net/e1000e/ich8lan.c linux-2.6.32.11/drivers/net/e1000e/ich8lan.c
---- linux-2.6.32.11/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
-+++ linux-2.6.32.11/drivers/net/e1000e/ich8lan.c	2010-04-04 20:46:41.601781347 -0400
-@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
- 	}
- }
- 
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
- 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
-@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
- 	/* id_led_init dependent on mac type */
- };
- 
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
- 	.check_reset_block	= e1000_check_reset_block_ich8lan,
- 	.commit_phy		= NULL,
-@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
- 	.write_phy_reg		= e1000e_write_phy_reg_igp,
- };
- 
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
- 	.read_nvm	 	= e1000_read_nvm_ich8lan,
- 	.release_nvm		= e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.32.11/drivers/net/ibmveth.c linux-2.6.32.11/drivers/net/ibmveth.c
---- linux-2.6.32.11/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/ibmveth.c	2010-04-04 20:46:41.601781347 -0400
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
- 	NULL,
- };
- 
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- 	.show   = veth_pool_show,
- 	.store  = veth_pool_store,
- };
-diff -urNp linux-2.6.32.11/drivers/net/igb/e1000_82575.c linux-2.6.32.11/drivers/net/igb/e1000_82575.c
---- linux-2.6.32.11/drivers/net/igb/e1000_82575.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/igb/e1000_82575.c	2010-04-04 20:46:41.601781347 -0400
-@@ -1400,7 +1400,7 @@ void igb_vmdq_set_replication_pf(struct 
- 	wr32(E1000_VT_CTL, vt_ctl);
- }
- 
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- 	.reset_hw             = igb_reset_hw_82575,
- 	.init_hw              = igb_init_hw_82575,
- 	.check_for_link       = igb_check_for_link_82575,
-@@ -1409,13 +1409,13 @@ static struct e1000_mac_operations e1000
- 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
- 
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- 	.acquire              = igb_acquire_phy_82575,
- 	.get_cfg_done         = igb_get_cfg_done_82575,
- 	.release              = igb_release_phy_82575,
- };
- 
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- 	.acquire              = igb_acquire_nvm_82575,
- 	.read                 = igb_read_nvm_eerd,
- 	.release              = igb_release_nvm_82575,
-diff -urNp linux-2.6.32.11/drivers/net/igb/e1000_hw.h linux-2.6.32.11/drivers/net/igb/e1000_hw.h
---- linux-2.6.32.11/drivers/net/igb/e1000_hw.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/igb/e1000_hw.h	2010-04-04 20:46:41.601781347 -0400
-@@ -302,17 +302,17 @@ struct e1000_phy_operations {
- };
- 
- struct e1000_nvm_operations {
--	s32  (*acquire)(struct e1000_hw *);
--	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release)(struct e1000_hw *);
--	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire)(struct e1000_hw *);
-+	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release)(struct e1000_hw *);
-+	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_info {
- 	s32 (*get_invariants)(struct e1000_hw *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- extern const struct e1000_info e1000_82575_info;
-diff -urNp linux-2.6.32.11/drivers/net/irda/vlsi_ir.c linux-2.6.32.11/drivers/net/irda/vlsi_ir.c
---- linux-2.6.32.11/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/irda/vlsi_ir.c	2010-04-04 20:46:41.601781347 -0400
-@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
- 			/* no race - tx-ring already empty */
- 			vlsi_set_baud(idev, iobase);
- 			netif_wake_queue(ndev);
--		}
--		else
--			;
-+		} else {
- 			/* keep the speed change pending like it would
- 			 * for any len>0 packet. tx completion interrupt
- 			 * will apply it when the tx ring becomes empty.
- 			 */
-+		}
- 		spin_unlock_irqrestore(&idev->lock, flags);
- 		dev_kfree_skb_any(skb);
- 		return NETDEV_TX_OK;
-diff -urNp linux-2.6.32.11/drivers/net/iseries_veth.c linux-2.6.32.11/drivers/net/iseries_veth.c
---- linux-2.6.32.11/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/iseries_veth.c	2010-04-04 20:46:41.601781347 -0400
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
- 	NULL
- };
- 
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- 		.show = veth_cnx_attribute_show
- };
- 
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
- 	NULL
- };
- 
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- 	.show = veth_port_attribute_show
- };
- 
-diff -urNp linux-2.6.32.11/drivers/net/pcnet32.c linux-2.6.32.11/drivers/net/pcnet32.c
---- linux-2.6.32.11/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/pcnet32.c	2010-04-04 20:46:41.601781347 -0400
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
-  * VLB I/O addresses
-  */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
-     { 0x300, 0x320, 0x340, 0x360, 0 };
- 
- static int pcnet32_debug = 0;
-diff -urNp linux-2.6.32.11/drivers/net/tg3.h linux-2.6.32.11/drivers/net/tg3.h
---- linux-2.6.32.11/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
-+++ linux-2.6.32.11/drivers/net/tg3.h	2010-04-04 20:46:41.601781347 -0400
-@@ -95,6 +95,7 @@
- #define  CHIPREV_ID_5750_A0		 0x4000
- #define  CHIPREV_ID_5750_A1		 0x4001
- #define  CHIPREV_ID_5750_A3		 0x4003
-+#define  CHIPREV_ID_5750_C1		 0x4201
- #define  CHIPREV_ID_5750_C2		 0x4202
- #define  CHIPREV_ID_5752_A0_HW		 0x5000
- #define  CHIPREV_ID_5752_A0		 0x6000
-diff -urNp linux-2.6.32.11/drivers/net/tulip/de4x5.c linux-2.6.32.11/drivers/net/tulip/de4x5.c
---- linux-2.6.32.11/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/tulip/de4x5.c	2010-04-04 20:46:41.601781347 -0400
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	for (i=0; i<ETH_ALEN; i++) {
- 	    tmp.addr[i] = dev->dev_addr[i];
- 	}
--	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- 	break;
- 
-     case DE4X5_SET_HWADDR:           /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	spin_lock_irqsave(&lp->lock, flags);
- 	memcpy(&statbuf, &lp->pktStats, ioc->len);
- 	spin_unlock_irqrestore(&lp->lock, flags);
--	if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- 		return -EFAULT;
- 	break;
-     }
-diff -urNp linux-2.6.32.11/drivers/net/usb/hso.c linux-2.6.32.11/drivers/net/usb/hso.c
---- linux-2.6.32.11/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/usb/hso.c	2010-04-04 20:46:41.605567348 -0400
-@@ -258,7 +258,7 @@ struct hso_serial {
- 
- 	/* from usb_serial_port */
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 	spinlock_t serial_lock;
- 
- 	int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
- 	struct urb *urb;
- 
- 	urb = serial->rx_urb[0];
--	if (serial->open_count > 0) {
-+	if (atomic_read(&serial->open_count) > 0) {
- 		count = put_rxbuf_data(urb, serial);
- 		if (count == -1)
- 			return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
- 	DUMP1(urb->transfer_buffer, urb->actual_length);
- 
- 	/* Anyone listening? */
--	if (serial->open_count == 0)
-+	if (atomic_read(&serial->open_count) == 0)
- 		return;
- 
- 	if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
- 	spin_unlock_irq(&serial->serial_lock);
- 
- 	/* check for port already opened, if not set the termios */
--	serial->open_count++;
--	if (serial->open_count == 1) {
-+	if (atomic_inc_return(&serial->open_count) == 1) {
- 		tty->low_latency = 1;
- 		serial->rx_state = RX_IDLE;
- 		/* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
- 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- 		if (result) {
- 			hso_stop_serial_device(serial->parent);
--			serial->open_count--;
-+			atomic_dec(&serial->open_count);
- 			kref_put(&serial->parent->ref, hso_serial_ref_free);
- 		}
- 	} else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
- 
- 	/* reset the rts and dtr */
- 	/* do the actual close */
--	serial->open_count--;
-+	atomic_dec(&serial->open_count);
- 
--	if (serial->open_count <= 0) {
--		serial->open_count = 0;
-+	if (atomic_read(&serial->open_count) <= 0) {
-+		atomic_set(&serial->open_count,  0);
- 		spin_lock_irq(&serial->serial_lock);
- 		if (serial->tty == tty) {
- 			serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
- 
- 	/* the actual setup */
- 	spin_lock_irqsave(&serial->serial_lock, flags);
--	if (serial->open_count)
-+	if (atomic_read(&serial->open_count))
- 		_hso_serial_set_termios(tty, old);
- 	else
- 		tty->termios = old;
-@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
- 	/* Start all serial ports */
- 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
--			if (dev2ser(serial_table[i])->open_count) {
-+			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
- 				result =
- 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
- 				hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.32.11/drivers/net/wireless/b43/debugfs.c linux-2.6.32.11/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.32.11/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/b43/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
- 	size_t file_struct_offset;
- };
-diff -urNp linux-2.6.32.11/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.11/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.32.11/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/b43legacy/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- 	size_t file_struct_offset;
- 	/* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-1000.c
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-04-04 20:46:41.605567348 -0400
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
- 	 },
- };
- 
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl1000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-3945.c
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:46:41.605567348 -0400
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
- 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
- 
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- 	.ucode = &iwl3945_ucode,
- 	.lib = &iwl3945_lib,
- 	.hcmd = &iwl3945_hcmd,
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-4965.c
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-04 20:46:41.605567348 -0400
-@@ -2335,7 +2335,7 @@ static struct iwl_lib_ops iwl4965_lib = 
- 	},
- };
- 
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- 	.ucode = &iwl4965_ucode,
- 	.lib = &iwl4965_lib,
- 	.hcmd = &iwl4965_hcmd,
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-5000.c
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-04 20:46:41.605567348 -0400
-@@ -1626,14 +1626,14 @@ static struct iwl_lib_ops iwl5150_lib = 
- 	 },
- };
- 
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5000_lib,
- 	.hcmd = &iwl5000_hcmd,
- 	.utils = &iwl5000_hcmd_utils,
- };
- 
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5150_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-6000.c
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-04-04 20:46:41.605567348 -0400
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
- 	.calc_rssi = iwl5000_calc_rssi,
- };
- 
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl6000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-dev.h
---- linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-04-04 20:46:41.605567348 -0400
-@@ -67,7 +67,7 @@ struct iwl_tx_queue;
- 
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff -urNp linux-2.6.32.11/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.11/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.32.11/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/net/wireless/libertas/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- 	const char *name;
- 	int perm;
--	struct file_operations fops;
-+	const struct file_operations fops;
- };
- 
- static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.32.11/drivers/oprofile/buffer_sync.c linux-2.6.32.11/drivers/oprofile/buffer_sync.c
---- linux-2.6.32.11/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/buffer_sync.c	2010-04-04 20:46:41.605567348 -0400
-@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
- 		if (cookie == NO_COOKIE)
- 			offset = pc;
- 		if (cookie == INVALID_COOKIE) {
--			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 			offset = pc;
- 		}
- 		if (cookie != last_cookie) {
-@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
- 	/* add userspace sample */
- 
- 	if (!mm) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- 		return 0;
- 	}
- 
- 	cookie = lookup_dcookie(mm, s->eip, &offset);
- 
- 	if (cookie == INVALID_COOKIE) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 		return 0;
- 	}
- 
-@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
- 		/* ignore backtraces if failed to add a sample */
- 		if (state == sb_bt_start) {
- 			state = sb_bt_ignore;
--			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- 		}
- 	}
- 	release_mm(mm);
-diff -urNp linux-2.6.32.11/drivers/oprofile/event_buffer.c linux-2.6.32.11/drivers/oprofile/event_buffer.c
---- linux-2.6.32.11/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/event_buffer.c	2010-04-04 20:46:41.605567348 -0400
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
- 	}
- 
- 	if (buffer_pos == buffer_size) {
--		atomic_inc(&oprofile_stats.event_lost_overflow);
-+		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- 		return;
- 	}
- 
-diff -urNp linux-2.6.32.11/drivers/oprofile/oprof.c linux-2.6.32.11/drivers/oprofile/oprof.c
---- linux-2.6.32.11/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/oprof.c	2010-04-04 20:46:41.605567348 -0400
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
- 	if (oprofile_ops.switch_events())
- 		return;
- 
--	atomic_inc(&oprofile_stats.multiplex_counter);
-+	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- 	start_switch_worker();
- }
- 
-diff -urNp linux-2.6.32.11/drivers/oprofile/oprofilefs.c linux-2.6.32.11/drivers/oprofile/oprofilefs.c
---- linux-2.6.32.11/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/oprofilefs.c	2010-04-04 20:46:41.609229988 -0400
-@@ -187,7 +187,7 @@ static const struct file_operations atom
- 
- 
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
--	char const *name, atomic_t *val)
-+	char const *name, atomic_unchecked_t *val)
- {
- 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
- 						     &atomic_ro_fops, 0444);
-diff -urNp linux-2.6.32.11/drivers/oprofile/oprofile_stats.c linux-2.6.32.11/drivers/oprofile/oprofile_stats.c
---- linux-2.6.32.11/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/oprofile_stats.c	2010-04-04 20:46:41.609229988 -0400
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- 		cpu_buf->sample_invalid_eip = 0;
- 	}
- 
--	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
--	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.event_lost_overflow, 0);
--	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.multiplex_counter, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
- 
- 
-diff -urNp linux-2.6.32.11/drivers/oprofile/oprofile_stats.h linux-2.6.32.11/drivers/oprofile/oprofile_stats.h
---- linux-2.6.32.11/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/oprofile/oprofile_stats.h	2010-04-04 20:46:41.609229988 -0400
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
- 
- struct oprofile_stat_struct {
--	atomic_t sample_lost_no_mm;
--	atomic_t sample_lost_no_mapping;
--	atomic_t bt_lost_no_mapping;
--	atomic_t event_lost_overflow;
--	atomic_t multiplex_counter;
-+	atomic_unchecked_t sample_lost_no_mm;
-+	atomic_unchecked_t sample_lost_no_mapping;
-+	atomic_unchecked_t bt_lost_no_mapping;
-+	atomic_unchecked_t event_lost_overflow;
-+	atomic_unchecked_t multiplex_counter;
- };
- 
- extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.32.11/drivers/parisc/pdc_stable.c linux-2.6.32.11/drivers/parisc/pdc_stable.c
---- linux-2.6.32.11/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/parisc/pdc_stable.c	2010-04-04 20:46:41.609229988 -0400
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
- 	return ret;
- }
- 
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- 	.show = pdcspath_attr_show,
- 	.store = pdcspath_attr_store,
- };
-diff -urNp linux-2.6.32.11/drivers/parport/procfs.c linux-2.6.32.11/drivers/parport/procfs.c
---- linux-2.6.32.11/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/parport/procfs.c	2010-04-04 20:46:41.609229988 -0400
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
- 
- 	*ppos += len;
- 
--	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
- 
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
- 
- 	*ppos += len;
- 
--	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
- 
-diff -urNp linux-2.6.32.11/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.11/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.32.11/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/hotplug/acpiphp_glue.c	2010-04-04 20:46:41.609229988 -0400
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
- }
- 
- 
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- 	.handler = handle_hotplug_event_func,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.11/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.32.11/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/hotplug/cpqphp_nvram.c	2010-04-04 20:46:41.609229988 -0400
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
- 
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- 	if (rom_start) {
- 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- 	}
-+#endif
-+
- 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
- 
- 	/* initialize our int15 lock */
-diff -urNp linux-2.6.32.11/drivers/pci/hotplug/fakephp.c linux-2.6.32.11/drivers/pci/hotplug/fakephp.c
---- linux-2.6.32.11/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/hotplug/fakephp.c	2010-04-04 20:46:41.609229988 -0400
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
- }
- 
- static struct kobj_type legacy_ktype = {
--	.sysfs_ops = &(struct sysfs_ops){
-+	.sysfs_ops = &(const struct sysfs_ops){
- 		.store = legacy_store, .show = legacy_show
- 	},
- 	.release = &legacy_release,
-diff -urNp linux-2.6.32.11/drivers/pci/intel-iommu.c linux-2.6.32.11/drivers/pci/intel-iommu.c
---- linux-2.6.32.11/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/intel-iommu.c	2010-04-04 20:46:41.609229988 -0400
-@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
- 	return !dma_addr;
- }
- 
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- 	.alloc_coherent = intel_alloc_coherent,
- 	.free_coherent = intel_free_coherent,
- 	.map_sg = intel_map_sg,
-diff -urNp linux-2.6.32.11/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.11/drivers/pci/pcie/portdrv_pci.c
---- linux-2.6.32.11/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/pcie/portdrv_pci.c	2010-04-04 20:46:41.609229988 -0400
-@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
- static const struct pci_device_id port_pci_ids[] = { {
- 	/* handle any PCI-Express port */
- 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, port_pci_ids);
- 
-diff -urNp linux-2.6.32.11/drivers/pci/proc.c linux-2.6.32.11/drivers/pci/proc.c
---- linux-2.6.32.11/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/proc.c	2010-04-04 20:46:41.609229988 -0400
-@@ -480,7 +480,16 @@ static const struct file_operations proc
- static int __init pci_proc_init(void)
- {
- 	struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- 	proc_create("devices", 0, proc_bus_pci_dir,
- 		    &proc_bus_pci_dev_operations);
- 	proc_initialized = 1;
-diff -urNp linux-2.6.32.11/drivers/pci/slot.c linux-2.6.32.11/drivers/pci/slot.c
---- linux-2.6.32.11/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pci/slot.c	2010-04-04 20:46:41.609229988 -0400
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
- 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
- 
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- 	.show = pci_slot_attr_show,
- 	.store = pci_slot_attr_store,
- };
-diff -urNp linux-2.6.32.11/drivers/pcmcia/ti113x.h linux-2.6.32.11/drivers/pcmcia/ti113x.h
---- linux-2.6.32.11/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pcmcia/ti113x.h	2010-04-04 20:46:41.609229988 -0400
-@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
- 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
- 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
- 
--	{}
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
-diff -urNp linux-2.6.32.11/drivers/pcmcia/yenta_socket.c linux-2.6.32.11/drivers/pcmcia/yenta_socket.c
---- linux-2.6.32.11/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pcmcia/yenta_socket.c	2010-04-04 20:46:41.609229988 -0400
-@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
- 
- 	/* match any cardbus bridge */
- 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
--	{ /* all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, yenta_table);
- 
-diff -urNp linux-2.6.32.11/drivers/platform/x86/acer-wmi.c linux-2.6.32.11/drivers/platform/x86/acer-wmi.c
---- linux-2.6.32.11/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/acer-wmi.c	2010-04-04 20:46:41.609229988 -0400
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
- 	return 0;
- }
- 
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/asus_acpi.c linux-2.6.32.11/drivers/platform/x86/asus_acpi.c
---- linux-2.6.32.11/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/asus_acpi.c	2010-04-04 20:46:41.609229988 -0400
-@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
- 	return 0;
- }
- 
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- 	.get_brightness = read_brightness,
- 	.update_status  = set_brightness_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/asus-laptop.c linux-2.6.32.11/drivers/platform/x86/asus-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/asus-laptop.c	2010-04-04 20:46:41.609229988 -0400
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/compal-laptop.c linux-2.6.32.11/drivers/platform/x86/compal-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/compal-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status	= bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/dell-laptop.c linux-2.6.32.11/drivers/platform/x86/dell-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/dell-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
- 	return buffer.output[1];
- }
- 
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- 	.get_brightness = dell_get_intensity,
- 	.update_status  = dell_send_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.11/drivers/platform/x86/eeepc-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/eeepc-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/eeepc-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -242,7 +242,7 @@ static struct device *eeepc_hwmon_device
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.11/drivers/platform/x86/fujitsu-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/fujitsu-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
- 	return ret;
- }
- 
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/msi-laptop.c linux-2.6.32.11/drivers/platform/x86/msi-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/msi-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status  = bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.11/drivers/platform/x86/panasonic-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/panasonic-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
- 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
- 
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- 	.get_brightness	= bl_get,
- 	.update_status	= bl_set_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/sony-laptop.c linux-2.6.32.11/drivers/platform/x86/sony-laptop.c
---- linux-2.6.32.11/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/sony-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
- }
- 
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- 	.update_status = sony_backlight_update_status,
- 	.get_brightness = sony_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.11/drivers/platform/x86/thinkpad_acpi.c
---- linux-2.6.32.11/drivers/platform/x86/thinkpad_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/thinkpad_acpi.c	2010-04-04 20:46:41.612789562 -0400
-@@ -6083,7 +6083,7 @@ static int brightness_get(struct backlig
- 	return status & TP_EC_BACKLIGHT_LVLMSK;
- }
- 
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- 	.get_brightness = brightness_get,
- 	.update_status  = brightness_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.11/drivers/platform/x86/toshiba_acpi.c
---- linux-2.6.32.11/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/platform/x86/toshiba_acpi.c	2010-04-04 20:46:41.612789562 -0400
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- 	return AE_OK;
- }
- 
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
-         .get_brightness = get_lcd,
-         .update_status  = set_lcd_status,
- };
-diff -urNp linux-2.6.32.11/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.11/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.32.11/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pnp/pnpbios/bioscalls.c	2010-04-04 20:46:41.612789562 -0400
-@@ -60,7 +60,7 @@ do { \
- 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
- 
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
- 
- 	cpu = get_cpu();
- 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
- 	spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
- 			     :"memory");
- 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
- 
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	/* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
- 	return status;
- }
- 
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- 	int i;
- 
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
- 	pnp_bios_callpoint.offset = header->fields.pm16offset;
- 	pnp_bios_callpoint.segment = PNP_CS16;
- 
-+	pax_open_kernel();
-+
- 	for_each_possible_cpu(i) {
- 		struct desc_struct *gdt = get_cpu_gdt_table(i);
- 		if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
- 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- 			 (unsigned long)__va(header->fields.pm16dseg));
- 	}
-+
-+	pax_close_kernel();
- }
-diff -urNp linux-2.6.32.11/drivers/pnp/quirks.c linux-2.6.32.11/drivers/pnp/quirks.c
---- linux-2.6.32.11/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pnp/quirks.c	2010-04-04 20:46:41.612789562 -0400
-@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
- 	/* PnP resources that might overlap PCI BARs */
- 	{"PNP0c01", quirk_system_pci_resources},
- 	{"PNP0c02", quirk_system_pci_resources},
--	{""}
-+	{"", NULL}
- };
- 
- void pnp_fixup_device(struct pnp_dev *dev)
-diff -urNp linux-2.6.32.11/drivers/pnp/resource.c linux-2.6.32.11/drivers/pnp/resource.c
---- linux-2.6.32.11/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/pnp/resource.c	2010-04-04 20:46:41.612789562 -0400
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*irq < 0 || *irq > 15)
-+	if (*irq > 15)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*dma < 0 || *dma == 4 || *dma > 7)
-+	if (*dma == 4 || *dma > 7)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-diff -urNp linux-2.6.32.11/drivers/s390/cio/qdio_perf.c linux-2.6.32.11/drivers/s390/cio/qdio_perf.c
---- linux-2.6.32.11/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/s390/cio/qdio_perf.c	2010-04-04 20:46:41.612789562 -0400
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.qdio_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.pci_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thin_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound),
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_in));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_out));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_sync));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.inbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.fast_requeue));
-+		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_target_full));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- 	seq_printf(m, "\n");
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/drivers/s390/cio/qdio_perf.h linux-2.6.32.11/drivers/s390/cio/qdio_perf.h
---- linux-2.6.32.11/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/s390/cio/qdio_perf.h	2010-04-04 20:46:41.612789562 -0400
-@@ -13,46 +13,46 @@
- 
- struct qdio_perf_stats {
- 	/* interrupt handler calls */
--	atomic_long_t qdio_int;
--	atomic_long_t pci_int;
--	atomic_long_t thin_int;
-+	atomic_long_unchecked_t qdio_int;
-+	atomic_long_unchecked_t pci_int;
-+	atomic_long_unchecked_t thin_int;
- 
- 	/* tasklet runs */
--	atomic_long_t tasklet_inbound;
--	atomic_long_t tasklet_outbound;
--	atomic_long_t tasklet_thinint;
--	atomic_long_t tasklet_thinint_loop;
--	atomic_long_t thinint_inbound;
--	atomic_long_t thinint_inbound_loop;
--	atomic_long_t thinint_inbound_loop2;
-+	atomic_long_unchecked_t tasklet_inbound;
-+	atomic_long_unchecked_t tasklet_outbound;
-+	atomic_long_unchecked_t tasklet_thinint;
-+	atomic_long_unchecked_t tasklet_thinint_loop;
-+	atomic_long_unchecked_t thinint_inbound;
-+	atomic_long_unchecked_t thinint_inbound_loop;
-+	atomic_long_unchecked_t thinint_inbound_loop2;
- 
- 	/* signal adapter calls */
--	atomic_long_t siga_out;
--	atomic_long_t siga_in;
--	atomic_long_t siga_sync;
-+	atomic_long_unchecked_t siga_out;
-+	atomic_long_unchecked_t siga_in;
-+	atomic_long_unchecked_t siga_sync;
- 
- 	/* misc */
--	atomic_long_t inbound_handler;
--	atomic_long_t outbound_handler;
--	atomic_long_t fast_requeue;
--	atomic_long_t outbound_target_full;
-+	atomic_long_unchecked_t inbound_handler;
-+	atomic_long_unchecked_t outbound_handler;
-+	atomic_long_unchecked_t fast_requeue;
-+	atomic_long_unchecked_t outbound_target_full;
- 
- 	/* for debugging */
--	atomic_long_t debug_tl_out_timer;
--	atomic_long_t debug_stop_polling;
--	atomic_long_t debug_eqbs_all;
--	atomic_long_t debug_eqbs_incomplete;
--	atomic_long_t debug_sqbs_all;
--	atomic_long_t debug_sqbs_incomplete;
-+	atomic_long_unchecked_t debug_tl_out_timer;
-+	atomic_long_unchecked_t debug_stop_polling;
-+	atomic_long_unchecked_t debug_eqbs_all;
-+	atomic_long_unchecked_t debug_eqbs_incomplete;
-+	atomic_long_unchecked_t debug_sqbs_all;
-+	atomic_long_unchecked_t debug_sqbs_incomplete;
- };
- 
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
- 
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- 	if (qdio_performance_stats)
--		atomic_long_inc(count);
-+		atomic_long_inc_unchecked(count);
- }
- 
- int qdio_setup_perf_stats(void);
-diff -urNp linux-2.6.32.11/drivers/scsi/ipr.c linux-2.6.32.11/drivers/scsi/ipr.c
---- linux-2.6.32.11/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/scsi/ipr.c	2010-04-04 20:46:41.616874360 -0400
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
- 	return true;
- }
- 
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- 	.phy_reset = ipr_ata_phy_reset,
- 	.hardreset = ipr_sata_reset,
- 	.post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.32.11/drivers/scsi/libfc/fc_exch.c linux-2.6.32.11/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.32.11/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/scsi/libfc/fc_exch.c	2010-04-04 20:46:41.616874360 -0400
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- 	 * all together if not used XXX
- 	 */
- 	struct {
--		atomic_t no_free_exch;
--		atomic_t no_free_exch_xid;
--		atomic_t xid_not_found;
--		atomic_t xid_busy;
--		atomic_t seq_not_found;
--		atomic_t non_bls_resp;
-+		atomic_unchecked_t no_free_exch;
-+		atomic_unchecked_t no_free_exch_xid;
-+		atomic_unchecked_t xid_not_found;
-+		atomic_unchecked_t xid_busy;
-+		atomic_unchecked_t seq_not_found;
-+		atomic_unchecked_t non_bls_resp;
- 	} stats;
- };
- #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
- 	/* allocate memory for exchange */
- 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- 	if (!ep) {
--		atomic_inc(&mp->stats.no_free_exch);
-+		atomic_inc_unchecked(&mp->stats.no_free_exch);
- 		goto out;
- 	}
- 	memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- 	return ep;
- err:
- 	spin_unlock_bh(&pool->lock);
--	atomic_inc(&mp->stats.no_free_exch_xid);
-+	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- 	mempool_free(ep, mp->ep_pool);
- 	return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
- 		ep = fc_exch_find(mp, xid);
- 		if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_OX_ID;
- 			goto out;
- 		}
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		ep = fc_exch_find(mp, xid);
- 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- 			if (ep) {
--				atomic_inc(&mp->stats.xid_busy);
-+				atomic_inc_unchecked(&mp->stats.xid_busy);
- 				reject = FC_RJT_RX_ID;
- 				goto rel;
- 			}
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 			}
- 			xid = ep->xid;	/* get our XID */
- 		} else if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_RX_ID;	/* XID not found */
- 			goto out;
- 		}
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
- 			goto rel;
- 		}
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
- 
- 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- 	if (!ep) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->esb_stat & ESB_ST_COMPLETE) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->rxid == FC_XID_UNKNOWN)
- 		ep->rxid = ntohs(fh->fh_rx_id);
- 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	if (ep->did != ntoh24(fh->fh_s_id) &&
- 	    ep->did != FC_FID_FLOGI) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			goto rel;
- 		}
- 	}
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
- 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
- 
- 	if (!sp)
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 	else
--		atomic_inc(&mp->stats.non_bls_resp);
-+		atomic_inc_unchecked(&mp->stats.non_bls_resp);
- 
- 	fc_frame_free(fp);
- }
-diff -urNp linux-2.6.32.11/drivers/scsi/libsas/sas_ata.c linux-2.6.32.11/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.32.11/drivers/scsi/libsas/sas_ata.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/scsi/libsas/sas_ata.c	2010-04-04 20:46:41.616874360 -0400
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
- 	}
- }
- 
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- 	.phy_reset		= sas_ata_phy_reset,
- 	.post_internal_cmd	= sas_ata_post_internal,
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.11/drivers/scsi/scsi_logging.h linux-2.6.32.11/drivers/scsi/scsi_logging.h
---- linux-2.6.32.11/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/scsi/scsi_logging.h	2010-04-04 20:46:41.616874360 -0400
-@@ -51,7 +51,7 @@ do {								\
- 		} while (0);					\
- } while (0)
- #else
--#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
-+#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
- #endif /* CONFIG_SCSI_LOGGING */
- 
- /*
-diff -urNp linux-2.6.32.11/drivers/scsi/sg.c linux-2.6.32.11/drivers/scsi/sg.c
---- linux-2.6.32.11/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/scsi/sg.c	2010-04-04 20:46:41.616874360 -0400
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- 	const struct file_operations * fops;
- };
- 
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- 	{"allow_dio", &adio_fops},
- 	{"debug", &debug_fops},
- 	{"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- 	int k, mask;
- 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
--	struct sg_proc_leaf * leaf;
-+	const struct sg_proc_leaf * leaf;
- 
- 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- 	if (!sg_proc_sgp)
-diff -urNp linux-2.6.32.11/drivers/serial/8250_pci.c linux-2.6.32.11/drivers/serial/8250_pci.c
---- linux-2.6.32.11/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/serial/8250_pci.c	2010-04-04 20:46:41.616874360 -0400
-@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
- 		PCI_ANY_ID, PCI_ANY_ID,
- 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
- 		0xffff00, pbn_default },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static struct pci_driver serial_pci_driver = {
-diff -urNp linux-2.6.32.11/drivers/serial/kgdboc.c linux-2.6.32.11/drivers/serial/kgdboc.c
---- linux-2.6.32.11/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/serial/kgdboc.c	2010-04-04 20:46:41.616874360 -0400
-@@ -18,7 +18,7 @@
- 
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io		kgdboc_io_ops;
-+static const struct kgdb_io	kgdboc_io_ops;
- 
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured		= -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- 	.name			= "kgdboc",
- 	.read_char		= kgdboc_get_char,
- 	.write_char		= kgdboc_put_char,
-diff -urNp linux-2.6.32.11/drivers/staging/android/binder.c linux-2.6.32.11/drivers/staging/android/binder.c
---- linux-2.6.32.11/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/android/binder.c	2010-04-04 20:46:41.616874360 -0400
-@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
- 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
- 
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- 	.open = binder_vma_open,
- 	.close = binder_vma_close,
- };
-diff -urNp linux-2.6.32.11/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.11/drivers/staging/b3dfg/b3dfg.c
---- linux-2.6.32.11/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/b3dfg/b3dfg.c	2010-04-04 20:46:41.616874360 -0400
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
- 	return VM_FAULT_NOPAGE;
- }
- 
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- 	.fault = b3dfg_vma_fault,
- };
- 
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
- 	return r;
- }
- 
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- 	.owner = THIS_MODULE,
- 	.open = b3dfg_open,
- 	.release = b3dfg_release,
-diff -urNp linux-2.6.32.11/drivers/staging/comedi/comedi_fops.c linux-2.6.32.11/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.32.11/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/comedi/comedi_fops.c	2010-04-04 20:46:41.616874360 -0400
-@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
- 	mutex_unlock(&dev->mutex);
- }
- 
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- 	.close = comedi_unmap,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.11/drivers/staging/dream/qdsp5/adsp_driver.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/adsp_driver.c	2010-04-04 20:46:41.616874360 -0400
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
- static dev_t adsp_devno;
- static struct class *adsp_class;
- 
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = adsp_open,
- 	.unlocked_ioctl = adsp_ioctl,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_aac.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_aac.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1022,7 +1022,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audio_open,
- 	.release = audio_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_amrnb.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-04-04 20:46:41.621505029 -0400
-@@ -833,7 +833,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audamrnb_open,
- 	.release = audamrnb_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_evrc.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_evrc.c	2010-04-04 20:46:41.621505029 -0400
-@@ -805,7 +805,7 @@ dma_fail:
- 	return rc;
- }
- 
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audevrc_open,
- 	.release = audevrc_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_in.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_in.c	2010-04-04 20:46:41.621505029 -0400
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_in_open,
- 	.release	= audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_in_ioctl,
- };
- 
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- 	.owner          = THIS_MODULE,
- 	.open           = audpre_open,
- 	.unlocked_ioctl = audpre_ioctl,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_mp3.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_mp3.c	2010-04-04 20:46:41.621505029 -0400
-@@ -941,7 +941,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_out.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_out.c	2010-04-04 20:46:41.621505029 -0400
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_ioctl,
- };
- 
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audpp_open,
- 	.unlocked_ioctl	= audpp_ioctl,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_qcelp.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-04-04 20:46:41.621505029 -0400
-@@ -816,7 +816,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audqcelp_open,
- 	.release = audqcelp_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.11/drivers/staging/dream/qdsp5/snd.c
---- linux-2.6.32.11/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/qdsp5/snd.c	2010-04-04 20:46:41.621505029 -0400
-@@ -242,7 +242,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= snd_open,
- 	.release	= snd_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.11/drivers/staging/dream/smd/smd_qmi.c
---- linux-2.6.32.11/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/smd/smd_qmi.c	2010-04-04 20:46:41.621505029 -0400
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
- 	return 0;
- }
- 
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- 	.owner = THIS_MODULE,
- 	.read = qmi_read,
- 	.write = qmi_write,
-diff -urNp linux-2.6.32.11/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.11/drivers/staging/dream/smd/smd_rpcrouter_device.c
---- linux-2.6.32.11/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-04-04 20:46:41.621505029 -0400
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
- 	return rc;
- }
- 
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
- 	.unlocked_ioctl	 = rpcrouter_ioctl,
- };
- 
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-diff -urNp linux-2.6.32.11/drivers/staging/dst/dcore.c linux-2.6.32.11/drivers/staging/dst/dcore.c
---- linux-2.6.32.11/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dst/dcore.c	2010-04-04 20:46:41.621505029 -0400
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
- 	return 0;
- }
- 
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- 	.open		= dst_bdev_open,
- 	.release	= dst_bdev_release,
- 	.owner		= THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
- 	n->size = ctl->size;
- 
- 	atomic_set(&n->refcnt, 1);
--	atomic_long_set(&n->gen, 0);
-+	atomic_long_set_unchecked(&n->gen, 0);
- 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
- 
- 	err = dst_node_sysfs_init(n);
-diff -urNp linux-2.6.32.11/drivers/staging/dst/trans.c linux-2.6.32.11/drivers/staging/dst/trans.c
---- linux-2.6.32.11/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/dst/trans.c	2010-04-04 20:46:41.621505029 -0400
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
- 	t->error = 0;
- 	t->retries = 0;
- 	atomic_set(&t->refcnt, 1);
--	t->gen = atomic_long_inc_return(&n->gen);
-+	t->gen = atomic_long_inc_return_unchecked(&n->gen);
- 
- 	t->enc = bio_data_dir(bio);
- 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff -urNp linux-2.6.32.11/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.11/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.32.11/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/go7007/go7007-v4l2.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
- 	return 0;
- }
- 
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- 	.open	= go7007_vm_open,
- 	.close	= go7007_vm_close,
- 	.fault	= go7007_vm_fault,
-diff -urNp linux-2.6.32.11/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.11/drivers/staging/hv/blkvsc_drv.c
---- linux-2.6.32.11/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/hv/blkvsc_drv.c	2010-04-04 20:46:41.621505029 -0400
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
- 
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- 	.owner = THIS_MODULE,
- 	.open = blkvsc_open,
- 	.release = blkvsc_release,
-diff -urNp linux-2.6.32.11/drivers/staging/panel/panel.c linux-2.6.32.11/drivers/staging/panel/panel.c
---- linux-2.6.32.11/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/panel/panel.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- 	.write   = lcd_write,
- 	.open    = lcd_open,
- 	.release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
- 	return 0;
- }
- 
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- 	.read    = keypad_read,		/* read */
- 	.open    = keypad_open,		/* open */
- 	.release = keypad_release,	/* close */
-diff -urNp linux-2.6.32.11/drivers/staging/phison/phison.c linux-2.6.32.11/drivers/staging/phison/phison.c
---- linux-2.6.32.11/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/phison/phison.c	2010-04-04 20:46:41.621505029 -0400
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= phison_pre_reset,
- };
-diff -urNp linux-2.6.32.11/drivers/staging/poch/poch.c linux-2.6.32.11/drivers/staging/poch/poch.c
---- linux-2.6.32.11/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/poch/poch.c	2010-04-04 20:46:41.625742858 -0400
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- 	.owner = THIS_MODULE,
- 	.open = poch_open,
- 	.release = poch_release,
-diff -urNp linux-2.6.32.11/drivers/staging/pohmelfs/inode.c linux-2.6.32.11/drivers/staging/pohmelfs/inode.c
---- linux-2.6.32.11/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/pohmelfs/inode.c	2010-04-04 20:46:41.625742858 -0400
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
- 	mutex_init(&psb->mcache_lock);
- 	psb->mcache_root = RB_ROOT;
- 	psb->mcache_timeout = msecs_to_jiffies(5000);
--	atomic_long_set(&psb->mcache_gen, 0);
-+	atomic_long_set_unchecked(&psb->mcache_gen, 0);
- 
- 	psb->trans_max_pages = 100;
- 
-diff -urNp linux-2.6.32.11/drivers/staging/pohmelfs/mcache.c linux-2.6.32.11/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.32.11/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/pohmelfs/mcache.c	2010-04-04 20:46:41.625742858 -0400
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
- 	m->data = data;
- 	m->start = start;
- 	m->size = size;
--	m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
- 
- 	mutex_lock(&psb->mcache_lock);
- 	err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.32.11/drivers/staging/pohmelfs/netfs.h linux-2.6.32.11/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.32.11/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/pohmelfs/netfs.h	2010-04-04 20:46:41.625742858 -0400
-@@ -570,7 +570,7 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- 	struct rb_root		mcache_root;
- 	struct mutex		mcache_lock;
--	atomic_long_t		mcache_gen;
-+	atomic_long_unchecked_t	mcache_gen;
- 	unsigned long		mcache_timeout;
- 
- 	unsigned int		idx;
-diff -urNp linux-2.6.32.11/drivers/staging/sep/sep_driver.c linux-2.6.32.11/drivers/staging/sep/sep_driver.c
---- linux-2.6.32.11/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/sep/sep_driver.c	2010-04-04 20:46:41.625742858 -0400
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
- static dev_t sep_devno;
- 
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- 	.owner = THIS_MODULE,
- 	.ioctl = sep_ioctl,
- 	.poll = sep_poll,
-diff -urNp linux-2.6.32.11/drivers/staging/vme/devices/vme_user.c linux-2.6.32.11/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.32.11/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/staging/vme/devices/vme_user.c	2010-04-04 20:46:41.625742858 -0400
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
- 
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
-         .open = vme_user_open,
-         .release = vme_user_release,
-         .read = vme_user_read,
-diff -urNp linux-2.6.32.11/drivers/uio/uio.c linux-2.6.32.11/drivers/uio/uio.c
---- linux-2.6.32.11/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/uio/uio.c	2010-04-04 20:46:41.625742858 -0400
-@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
- 	return entry->show(mem, buf);
- }
- 
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- 	.show = map_type_show,
- };
- 
-@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
- 	return entry->show(port, buf);
- }
- 
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- 	.show = portio_type_show,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/usb/atm/usbatm.c linux-2.6.32.11/drivers/usb/atm/usbatm.c
---- linux-2.6.32.11/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/atm/usbatm.c	2010-04-04 20:46:41.625742858 -0400
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
- 		if (printk_ratelimit())
- 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- 				__func__, vpi, vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 		return;
- 	}
- 
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
- 		if (length > ATM_MAX_AAL5_PDU) {
- 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- 				  __func__, length, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
- 		if (sarb->len < pdu_length) {
- 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- 				  __func__, pdu_length, sarb->len, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
- 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- 				  __func__, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
- 			if (printk_ratelimit())
- 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- 					__func__, length);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto out;
- 		}
- 
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
- 
- 		vcc->push(vcc, skb);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	out:
- 		skb_trim(sarb, 0);
- 	}
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
- 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
- 
- 			usbatm_pop(vcc, skb);
--			atomic_inc(&vcc->stats->tx);
-+			atomic_inc_unchecked(&vcc->stats->tx);
- 
- 			skb = skb_dequeue(&instance->sndqueue);
- 		}
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
- 	if (!left--)
- 		return sprintf(page,
- 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
--			       atomic_read(&atm_dev->stats.aal5.tx),
--			       atomic_read(&atm_dev->stats.aal5.tx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx),
--			       atomic_read(&atm_dev->stats.aal5.rx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx_drop));
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
- 
- 	if (!left--) {
- 		if (instance->disconnected)
-diff -urNp linux-2.6.32.11/drivers/usb/class/cdc-acm.c linux-2.6.32.11/drivers/usb/class/cdc-acm.c
---- linux-2.6.32.11/drivers/usb/class/cdc-acm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/class/cdc-acm.c	2010-04-04 20:46:41.625742858 -0400
-@@ -1534,7 +1534,7 @@ static struct usb_device_id acm_ids[] = 
- 		USB_CDC_ACM_PROTO_AT_CDMA) },
- 
- 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(usb, acm_ids);
-diff -urNp linux-2.6.32.11/drivers/usb/class/usblp.c linux-2.6.32.11/drivers/usb/class/usblp.c
---- linux-2.6.32.11/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/class/usblp.c	2010-04-04 20:46:41.625742858 -0400
-@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
- 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
- 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
- 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
--	{ 0, 0 }
-+	{ 0, 0, 0 }
- };
- 
- static int usblp_wwait(struct usblp *usblp, int nonblock);
-@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
- 	{ USB_INTERFACE_INFO(7, 1, 2) },
- 	{ USB_INTERFACE_INFO(7, 1, 3) },
- 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
--	{ }						/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, usblp_ids);
-diff -urNp linux-2.6.32.11/drivers/usb/core/hcd.c linux-2.6.32.11/drivers/usb/core/hcd.c
---- linux-2.6.32.11/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/core/hcd.c	2010-04-04 20:46:41.625742858 -0400
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
- 
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
- 
- /*
-  * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
-  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
-  */
-  
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
- 
- 	if (mon_ops)
-diff -urNp linux-2.6.32.11/drivers/usb/core/hcd.h linux-2.6.32.11/drivers/usb/core/hcd.h
---- linux-2.6.32.11/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/core/hcd.h	2010-04-04 20:46:41.625742858 -0400
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
- struct usb_mon_operations {
--	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
--	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
--	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
- 
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
- 
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
- 		(*mon_ops->urb_complete)(bus, urb, status);
- }
- 
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
- 
- #else
-diff -urNp linux-2.6.32.11/drivers/usb/core/hub.c linux-2.6.32.11/drivers/usb/core/hub.c
---- linux-2.6.32.11/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/core/hub.c	2010-04-04 20:46:41.625742858 -0400
-@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
-       .bDeviceClass = USB_CLASS_HUB},
-     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
-       .bInterfaceClass = USB_CLASS_HUB},
--    { }						/* Terminating entry */
-+    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, hub_id_table);
-diff -urNp linux-2.6.32.11/drivers/usb/core/message.c linux-2.6.32.11/drivers/usb/core/message.c
---- linux-2.6.32.11/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/core/message.c	2010-04-04 20:46:41.629706570 -0400
-@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
- 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
- 	if (buf) {
- 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
--		if (len > 0) {
--			smallbuf = kmalloc(++len, GFP_NOIO);
-+		if (len++ > 0) {
-+			smallbuf = kmalloc(len, GFP_NOIO);
- 			if (!smallbuf)
- 				return buf;
- 			memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.32.11/drivers/usb/host/ehci-pci.c linux-2.6.32.11/drivers/usb/host/ehci-pci.c
---- linux-2.6.32.11/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/host/ehci-pci.c	2010-04-04 20:46:41.629706570 -0400
-@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
- 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
- 	},
--	{ /* end: all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, pci_ids);
- 
-diff -urNp linux-2.6.32.11/drivers/usb/host/uhci-hcd.c linux-2.6.32.11/drivers/usb/host/uhci-hcd.c
---- linux-2.6.32.11/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/host/uhci-hcd.c	2010-04-04 20:46:41.629706570 -0400
-@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
- 	/* handle any USB UHCI controller */
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
- 	.driver_data =	(unsigned long) &uhci_driver,
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
-diff -urNp linux-2.6.32.11/drivers/usb/misc/appledisplay.c linux-2.6.32.11/drivers/usb/misc/appledisplay.c
---- linux-2.6.32.11/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/misc/appledisplay.c	2010-04-04 20:46:41.629706570 -0400
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
- 		return pdata->msgdata[1];
- }
- 
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- 	.get_brightness	= appledisplay_bl_get_brightness,
- 	.update_status	= appledisplay_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/usb/mon/mon_main.c linux-2.6.32.11/drivers/usb/mon/mon_main.c
---- linux-2.6.32.11/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/mon/mon_main.c	2010-04-04 20:46:41.629706570 -0400
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
-  * Ops
-  */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- 	.urb_submit =	mon_submit,
- 	.urb_submit_error = mon_submit_error,
- 	.urb_complete =	mon_complete,
-diff -urNp linux-2.6.32.11/drivers/usb/storage/debug.h linux-2.6.32.11/drivers/usb/storage/debug.h
---- linux-2.6.32.11/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/storage/debug.h	2010-04-04 20:46:41.629706570 -0400
-@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
- #define US_DEBUGPX(x...) printk( x )
- #define US_DEBUG(x) x 
- #else
--#define US_DEBUGP(x...)
--#define US_DEBUGPX(x...)
--#define US_DEBUG(x)
-+#define US_DEBUGP(x...) do {} while (0)
-+#define US_DEBUGPX(x...) do {} while (0)
-+#define US_DEBUG(x) do {} while (0)
- #endif
- 
- #endif
-diff -urNp linux-2.6.32.11/drivers/usb/storage/usb.c linux-2.6.32.11/drivers/usb/storage/usb.c
---- linux-2.6.32.11/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/storage/usb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
- 
- static struct us_unusual_dev us_unusual_dev_list[] = {
- #	include "unusual_devs.h" 
--	{ }		/* Terminating entry */
-+	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
- };
- 
- #undef UNUSUAL_DEV
-diff -urNp linux-2.6.32.11/drivers/usb/storage/usual-tables.c linux-2.6.32.11/drivers/usb/storage/usual-tables.c
---- linux-2.6.32.11/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/usb/storage/usual-tables.c	2010-04-04 20:46:41.629706570 -0400
-@@ -48,7 +48,7 @@
- 
- struct usb_device_id usb_storage_usb_ids[] = {
- #	include "unusual_devs.h"
--	{ }		/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
- 
-diff -urNp linux-2.6.32.11/drivers/uwb/wlp/messages.c linux-2.6.32.11/drivers/uwb/wlp/messages.c
---- linux-2.6.32.11/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/uwb/wlp/messages.c	2010-04-04 20:46:41.629706570 -0400
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
- 	size_t len = skb->len;
- 	size_t used;
- 	ssize_t result;
--	struct wlp_nonce enonce, rnonce;
-+	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- 	enum wlp_assc_error assc_err;
- 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff -urNp linux-2.6.32.11/drivers/uwb/wlp/sysfs.c linux-2.6.32.11/drivers/uwb/wlp/sysfs.c
---- linux-2.6.32.11/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/uwb/wlp/sysfs.c	2010-04-04 20:46:41.629706570 -0400
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
- 	return ret;
- }
- 
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- 	.show	= wlp_wss_attr_show,
- 	.store	= wlp_wss_attr_store,
- };
-diff -urNp linux-2.6.32.11/drivers/video/atmel_lcdfb.c linux-2.6.32.11/drivers/video/atmel_lcdfb.c
---- linux-2.6.32.11/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/atmel_lcdfb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
- 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
- 
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- 	.update_status = atmel_bl_update_status,
- 	.get_brightness = atmel_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/video/aty/aty128fb.c linux-2.6.32.11/drivers/video/aty/aty128fb.c
---- linux-2.6.32.11/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/aty/aty128fb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- 	.get_brightness	= aty128_bl_get_brightness,
- 	.update_status	= aty128_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/aty/atyfb_base.c linux-2.6.32.11/drivers/video/aty/atyfb_base.c
---- linux-2.6.32.11/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/aty/atyfb_base.c	2010-04-04 20:46:41.629706570 -0400
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- 	.get_brightness = aty_bl_get_brightness,
- 	.update_status	= aty_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/aty/radeon_backlight.c linux-2.6.32.11/drivers/video/aty/radeon_backlight.c
---- linux-2.6.32.11/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/aty/radeon_backlight.c	2010-04-04 20:46:41.629706570 -0400
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- 	.get_brightness = radeon_bl_get_brightness,
- 	.update_status	= radeon_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/adp5520_bl.c linux-2.6.32.11/drivers/video/backlight/adp5520_bl.c
---- linux-2.6.32.11/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/adp5520_bl.c	2010-04-04 20:46:41.629706570 -0400
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
- 	return error ? data->current_brightness : reg_val;
- }
- 
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- 	.update_status	= adp5520_bl_update_status,
- 	.get_brightness	= adp5520_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/adx_bl.c linux-2.6.32.11/drivers/video/backlight/adx_bl.c
---- linux-2.6.32.11/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/adx_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
- 	return 1;
- }
- 
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- 	.options = 0,
- 	.update_status = adx_backlight_update_status,
- 	.get_brightness = adx_backlight_get_brightness,
-diff -urNp linux-2.6.32.11/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.11/drivers/video/backlight/atmel-pwm-bl.c
---- linux-2.6.32.11/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/atmel-pwm-bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
- 	return pwm_channel_enable(&pwmbl->pwmc);
- }
- 
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- 	.get_brightness = atmel_pwm_bl_get_intensity,
- 	.update_status  = atmel_pwm_bl_set_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/backlight.c linux-2.6.32.11/drivers/video/backlight/backlight.c
---- linux-2.6.32.11/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/backlight.c	2010-04-04 20:46:41.633638271 -0400
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
-  * ERR_PTR() or a pointer to the newly allocated device.
-  */
- struct backlight_device *backlight_device_register(const char *name,
--		struct device *parent, void *devdata, struct backlight_ops *ops)
-+		struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- 	struct backlight_device *new_bd;
- 	int rc;
-diff -urNp linux-2.6.32.11/drivers/video/backlight/corgi_lcd.c linux-2.6.32.11/drivers/video/backlight/corgi_lcd.c
---- linux-2.6.32.11/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/corgi_lcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
- 
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- 	.get_brightness	= corgi_bl_get_intensity,
- 	.update_status  = corgi_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/cr_bllcd.c linux-2.6.32.11/drivers/video/backlight/cr_bllcd.c
---- linux-2.6.32.11/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/cr_bllcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
- 	return intensity;
- }
- 
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- 	.get_brightness = cr_backlight_get_intensity,
- 	.update_status = cr_backlight_set_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/da903x_bl.c linux-2.6.32.11/drivers/video/backlight/da903x_bl.c
---- linux-2.6.32.11/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/da903x_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- 	.update_status	= da903x_backlight_update_status,
- 	.get_brightness	= da903x_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/generic_bl.c linux-2.6.32.11/drivers/video/backlight/generic_bl.c
---- linux-2.6.32.11/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/generic_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
- 
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.get_brightness = genericbl_get_intensity,
- 	.update_status  = genericbl_send_intensity,
-diff -urNp linux-2.6.32.11/drivers/video/backlight/hp680_bl.c linux-2.6.32.11/drivers/video/backlight/hp680_bl.c
---- linux-2.6.32.11/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/hp680_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
- 	return current_intensity;
- }
- 
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- 	.get_brightness = hp680bl_get_intensity,
- 	.update_status  = hp680bl_set_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/jornada720_bl.c linux-2.6.32.11/drivers/video/backlight/jornada720_bl.c
---- linux-2.6.32.11/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/jornada720_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -93,7 +93,7 @@ out:
- 	return ret;
- }
- 
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- 	.get_brightness = jornada_bl_get_brightness,
- 	.update_status = jornada_bl_update_status,
- 	.options = BL_CORE_SUSPENDRESUME,
-diff -urNp linux-2.6.32.11/drivers/video/backlight/kb3886_bl.c linux-2.6.32.11/drivers/video/backlight/kb3886_bl.c
---- linux-2.6.32.11/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/kb3886_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
- 	return kb3886bl_intensity;
- }
- 
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- 	.get_brightness = kb3886bl_get_intensity,
- 	.update_status  = kb3886bl_send_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/locomolcd.c linux-2.6.32.11/drivers/video/backlight/locomolcd.c
---- linux-2.6.32.11/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/locomolcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
- 	return current_intensity;
- }
- 
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- 	.get_brightness = locomolcd_get_intensity,
- 	.update_status  = locomolcd_set_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.11/drivers/video/backlight/mbp_nvidia_bl.c
---- linux-2.6.32.11/drivers/video/backlight/mbp_nvidia_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- 	unsigned long iostart;
- 	unsigned long iolen;
- 	/* Backlight operations structure. */
--	struct backlight_ops backlight_ops;
-+	const struct backlight_ops backlight_ops;
- };
- 
- /* Module parameters. */
-diff -urNp linux-2.6.32.11/drivers/video/backlight/omap1_bl.c linux-2.6.32.11/drivers/video/backlight/omap1_bl.c
---- linux-2.6.32.11/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/omap1_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
- 	return bl->current_intensity;
- }
- 
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- 	.get_brightness = omapbl_get_intensity,
- 	.update_status  = omapbl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/progear_bl.c linux-2.6.32.11/drivers/video/backlight/progear_bl.c
---- linux-2.6.32.11/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/progear_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
- 	return intensity - HW_LEVEL_MIN;
- }
- 
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- 	.get_brightness = progearbl_get_intensity,
- 	.update_status = progearbl_set_intensity,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/pwm_bl.c linux-2.6.32.11/drivers/video/backlight/pwm_bl.c
---- linux-2.6.32.11/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/pwm_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
- 	return bl->props.brightness;
- }
- 
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- 	.update_status	= pwm_backlight_update_status,
- 	.get_brightness	= pwm_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/tosa_bl.c linux-2.6.32.11/drivers/video/backlight/tosa_bl.c
---- linux-2.6.32.11/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/tosa_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
- 	return props->brightness;
- }
- 
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- 	.get_brightness		= tosa_bl_get_brightness,
- 	.update_status		= tosa_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/backlight/wm831x_bl.c linux-2.6.32.11/drivers/video/backlight/wm831x_bl.c
---- linux-2.6.32.11/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/backlight/wm831x_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.update_status	= wm831x_backlight_update_status,
- 	.get_brightness	= wm831x_backlight_get_brightness,
-diff -urNp linux-2.6.32.11/drivers/video/bf54x-lq043fb.c linux-2.6.32.11/drivers/video/bf54x-lq043fb.c
---- linux-2.6.32.11/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/bf54x-lq043fb.c	2010-04-04 20:46:41.633638271 -0400
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.11/drivers/video/bfin-t350mcqb-fb.c
---- linux-2.6.32.11/drivers/video/bfin-t350mcqb-fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/bfin-t350mcqb-fb.c	2010-04-04 20:46:41.633638271 -0400
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.11/drivers/video/fbmem.c linux-2.6.32.11/drivers/video/fbmem.c
---- linux-2.6.32.11/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/fbmem.c	2010-04-04 20:46:41.633638271 -0400
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dx += image->width + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_UD) {
--		for (x = 0; x < num && image->dx >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dx -= image->width + 8;
- 		}
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dy += image->height + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_CCW) {
--		for (x = 0; x < num && image->dy >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dy -= image->height + 8;
- 		}
-@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
- 			return -EFAULT;
- 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- 			return -EINVAL;
--		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+		if (con2fb.framebuffer >= FB_MAX)
- 			return -EINVAL;
- 		if (!registered_fb[con2fb.framebuffer])
- 			request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.32.11/drivers/video/fbmon.c linux-2.6.32.11/drivers/video/fbmon.c
---- linux-2.6.32.11/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/fbmon.c	2010-04-04 20:46:41.633638271 -0400
-@@ -45,7 +45,7 @@
- #ifdef DEBUG
- #define DPRINTK(fmt, args...) printk(fmt,## args)
- #else
--#define DPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
- #endif
- 
- #define FBMON_FIX_HEADER  1
-diff -urNp linux-2.6.32.11/drivers/video/i810/i810_accel.c linux-2.6.32.11/drivers/video/i810/i810_accel.c
---- linux-2.6.32.11/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/i810/i810_accel.c	2010-04-04 20:46:41.633638271 -0400
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
- 		}
- 	}
- 	printk("ringbuffer lockup!!!\n");
-+	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- 	i810_report_error(mmio); 
- 	par->dev_flags |= LOCKUP;
- 	info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.32.11/drivers/video/i810/i810_main.c linux-2.6.32.11/drivers/video/i810/i810_main.c
---- linux-2.6.32.11/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/i810/i810_main.c	2010-04-04 20:46:41.633638271 -0400
-@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
- 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- static struct pci_driver i810fb_driver = {
-diff -urNp linux-2.6.32.11/drivers/video/modedb.c linux-2.6.32.11/drivers/video/modedb.c
---- linux-2.6.32.11/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/modedb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
-     {
- 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
- 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
- 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
- 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
- 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
- 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
--	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
- 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
- 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
- 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
- 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
- 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
- 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
- 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
- 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
- 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
- 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
- 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
- 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
- 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
- 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
--	0, FB_VMODE_NONINTERLACED   	
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
- 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
-         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
- 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
- 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
- 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
- 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
- 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
- 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
- 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
- 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
- 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
- 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
- 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
- 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
- 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
- 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
- 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
- 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
- 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
- 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
- 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
- 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
- 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
- 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
- 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
- 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
- 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
- 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--	FB_VMODE_NONINTERLACED
-+	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
- 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
- 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-    }, {
- 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
- 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     },
- };
- 
-diff -urNp linux-2.6.32.11/drivers/video/nvidia/nv_backlight.c linux-2.6.32.11/drivers/video/nvidia/nv_backlight.c
---- linux-2.6.32.11/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/nvidia/nv_backlight.c	2010-04-04 20:46:41.637780128 -0400
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- 	.get_brightness = nvidia_bl_get_brightness,
- 	.update_status	= nvidia_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/riva/fbdev.c linux-2.6.32.11/drivers/video/riva/fbdev.c
---- linux-2.6.32.11/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/riva/fbdev.c	2010-04-04 20:46:41.637780128 -0400
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- 	.get_brightness = riva_bl_get_brightness,
- 	.update_status	= riva_bl_update_status,
- };
-diff -urNp linux-2.6.32.11/drivers/video/uvesafb.c linux-2.6.32.11/drivers/video/uvesafb.c
---- linux-2.6.32.11/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/uvesafb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- 		NULL,
- 	};
- 
--	return call_usermodehelper(v86d_path, argv, envp, 1);
-+	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
- 
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
- 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- 		par->pmi_setpal = par->ypan = 0;
- 	} else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+		if (!par->pmi_code) {
-+			par->pmi_setpal = par->ypan = 0;
-+			return 0;
-+		}
-+#endif
-+
- 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- 						+ task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+		pax_close_kernel();
-+
-+		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- 		printk(KERN_INFO "uvesafb: protected mode interface info at "
- 				 "%04x:%04x\n",
- 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1799,6 +1822,11 @@ out:
- 	if (par->vbe_modes)
- 		kfree(par->vbe_modes);
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	if (par->pmi_code)
-+		module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 	framebuffer_release(info);
- 	return err;
- }
-@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
- 				kfree(par->vbe_state_orig);
- 			if (par->vbe_state_saved)
- 				kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+			if (par->pmi_code)
-+				module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 		}
- 
- 		framebuffer_release(info);
-diff -urNp linux-2.6.32.11/drivers/video/vesafb.c linux-2.6.32.11/drivers/video/vesafb.c
---- linux-2.6.32.11/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/video/vesafb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -9,6 +9,7 @@
-  */
- 
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
- static int   vram_total __initdata;		/* Set total amount of memory */
- static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
- static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
--static void  (*pmi_start)(void) __read_mostly;
--static void  (*pmi_pal)  (void) __read_mostly;
-+static void  (*pmi_start)(void) __read_only;
-+static void  (*pmi_pal)  (void) __read_only;
- static int   depth      __read_mostly;
- static int   vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
- 	unsigned int size_vmode;
- 	unsigned int size_remap;
- 	unsigned int size_total;
-+	void *pmi_code = NULL;
- 
- 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- 		return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
- 		size_remap = size_total;
- 	vesafb_fix.smem_len = size_remap;
- 
--#ifndef __i386__
--	screen_info.vesapm_seg = 0;
--#endif
--
- 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- 		printk(KERN_WARNING
- 		       "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
- 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
- 
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+	if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+	if (0)
-+#endif
-+
-+#endif
-+	screen_info.vesapm_seg = 0;
-+
- 	if (screen_info.vesapm_seg) {
--		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
--		       screen_info.vesapm_seg,screen_info.vesapm_off);
-+		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- 	}
- 
- 	if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
- 
- 	if (ypan || pmi_setpal) {
- 		unsigned short *pmi_base;
--		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
--		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
--		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+		pmi_code = pmi_base;
-+#endif
-+
-+		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pmi_start = ktva_ktla(pmi_start);
-+		pmi_pal = ktva_ktla(pmi_pal);
-+		pax_close_kernel();
-+#endif
-+
- 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- 		if (pmi_base[3]) {
- 			printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
- 	       info->node, info->fix.id);
- 	return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	module_free_exec(NULL, pmi_code);
-+#endif
-+
- 	if (info->screen_base)
- 		iounmap(info->screen_base);
- 	framebuffer_release(info);
-diff -urNp linux-2.6.32.11/drivers/xen/sys-hypervisor.c linux-2.6.32.11/drivers/xen/sys-hypervisor.c
---- linux-2.6.32.11/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/drivers/xen/sys-hypervisor.c	2010-04-04 20:46:41.637780128 -0400
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
- 	return 0;
- }
- 
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- 	.show = hyp_sysfs_show,
- 	.store = hyp_sysfs_store,
- };
-diff -urNp linux-2.6.32.11/fs/9p/vfs_inode.c linux-2.6.32.11/fs/9p/vfs_inode.c
---- linux-2.6.32.11/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/9p/vfs_inode.c	2010-04-04 20:46:41.637780128 -0400
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 
- 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- 		IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.32.11/fs/aio.c linux-2.6.32.11/fs/aio.c
---- linux-2.6.32.11/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/aio.c	2010-04-04 20:46:41.637780128 -0400
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
- 	size += sizeof(struct io_event) * nr_events;
- 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
- 
--	if (nr_pages < 0)
-+	if (nr_pages <= 0)
- 		return -EINVAL;
- 
- 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-diff -urNp linux-2.6.32.11/fs/attr.c linux-2.6.32.11/fs/attr.c
---- linux-2.6.32.11/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/attr.c	2010-04-04 20:46:41.637780128 -0400
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
- 		unsigned long limit;
- 
- 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- 		if (limit != RLIM_INFINITY && offset > limit)
- 			goto out_sig;
- 		if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.32.11/fs/autofs/root.c linux-2.6.32.11/fs/autofs/root.c
---- linux-2.6.32.11/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/autofs/root.c	2010-04-04 20:46:41.637780128 -0400
-@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
- 	set_bit(n,sbi->symlink_bitmap);
- 	sl = &sbi->symlink[n];
- 	sl->len = strlen(symname);
--	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
-+	slsize = sl->len+1;
-+	sl->data = kmalloc(slsize, GFP_KERNEL);
- 	if (!sl->data) {
- 		clear_bit(n,sbi->symlink_bitmap);
- 		unlock_kernel();
-diff -urNp linux-2.6.32.11/fs/autofs4/symlink.c linux-2.6.32.11/fs/autofs4/symlink.c
---- linux-2.6.32.11/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/autofs4/symlink.c	2010-04-04 20:46:41.637780128 -0400
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
--	nd_set_link(nd, (char *)ino->u.symlink);
-+	nd_set_link(nd, ino->u.symlink);
- 	return NULL;
- }
- 
-diff -urNp linux-2.6.32.11/fs/befs/linuxvfs.c linux-2.6.32.11/fs/befs/linuxvfs.c
---- linux-2.6.32.11/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/befs/linuxvfs.c	2010-04-04 20:46:41.637780128 -0400
-@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
- {
- 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
--		char *link = nd_get_link(nd);
-+		const char *link = nd_get_link(nd);
- 		if (!IS_ERR(link))
- 			kfree(link);
- 	}
-diff -urNp linux-2.6.32.11/fs/binfmt_aout.c linux-2.6.32.11/fs/binfmt_aout.c
---- linux-2.6.32.11/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/binfmt_aout.c	2010-04-04 20:46:41.637780128 -0400
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
- 
- /* If the size of the dump file exceeds the rlimit, then see what would happen
-    if we wrote the stack, but not the data area.  */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- 		dump.u_dsize = 0;
- 
- /* Make sure we have enough room to write the stack and data areas. */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- 		dump.u_ssize = 0;
- 
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- 	if (rlim >= RLIM_INFINITY)
- 		rlim = ~0;
-+
-+	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- 	if (ex.a_data + ex.a_bss > rlim)
- 		return -ENOMEM;
- 
-@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
- 	install_exec_creds(bprm);
-  	current->flags &= ~PF_FORKNOEXEC;
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+			current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+	}
-+#endif
-+
- 	if (N_MAGIC(ex) == OMAGIC) {
- 		unsigned long text_addr, map_size;
- 		loff_t pos;
-@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
- 
- 		down_write(&current->mm->mmap_sem);
-  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
--				PROT_READ | PROT_WRITE | PROT_EXEC,
-+				PROT_READ | PROT_WRITE,
- 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- 				fd_offset + ex.a_text);
- 		up_write(&current->mm->mmap_sem);
-diff -urNp linux-2.6.32.11/fs/binfmt_elf.c linux-2.6.32.11/fs/binfmt_elf.c
---- linux-2.6.32.11/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/binfmt_elf.c	2010-04-04 20:47:28.956670452 -0400
-@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
- #define elf_core_dump	NULL
- #endif
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
- 		.load_binary	= load_elf_binary,
- 		.load_shlib	= load_elf_library,
- 		.core_dump	= elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		.handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- 		.min_coredump	= ELF_EXEC_PAGESIZE,
- 		.hasvdso	= 1
- };
-@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
- 
- static int set_brk(unsigned long start, unsigned long end)
- {
-+	unsigned long e = end;
-+
- 	start = ELF_PAGEALIGN(start);
- 	end = ELF_PAGEALIGN(end);
- 	if (end > start) {
-@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
- 		if (BAD_ADDR(addr))
- 			return addr;
- 	}
--	current->mm->start_brk = current->mm->brk = end;
-+	current->mm->start_brk = current->mm->brk = e;
- 	return 0;
- }
- 
-@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
- 	elf_addr_t __user *u_rand_bytes;
- 	const char *k_platform = ELF_PLATFORM;
- 	const char *k_base_platform = ELF_BASE_PLATFORM;
--	unsigned char k_rand_bytes[16];
-+	u32 k_rand_bytes[4];
- 	int items;
- 	elf_addr_t *elf_info;
- 	int ei_index = 0;
-@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
- 	 * Generate 16 random bytes for userspace PRNG seeding.
- 	 */
- 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
--	u_rand_bytes = (elf_addr_t __user *)
--		       STACK_ALLOC(p, sizeof(k_rand_bytes));
-+	srandom32(k_rand_bytes[0] ^ random32());
-+	srandom32(k_rand_bytes[1] ^ random32());
-+	srandom32(k_rand_bytes[2] ^ random32());
-+	srandom32(k_rand_bytes[3] ^ random32());
-+	p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+	u_rand_bytes = (elf_addr_t __user *) p;
- 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- 		return -EFAULT;
- 
-@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
- {
- 	struct elf_phdr *elf_phdata;
- 	struct elf_phdr *eppnt;
--	unsigned long load_addr = 0;
-+	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- 	int load_addr_set = 0;
- 	unsigned long last_bss = 0, elf_bss = 0;
--	unsigned long error = ~0UL;
-+	unsigned long error = -EINVAL;
- 	unsigned long total_size;
- 	int retval, i, size;
- 
-@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
- 		goto out_close;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	eppnt = elf_phdata;
- 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- 		if (eppnt->p_type == PT_LOAD) {
-@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
- 			k = load_addr + eppnt->p_vaddr;
- 			if (BAD_ADDR(k) ||
- 			    eppnt->p_filesz > eppnt->p_memsz ||
--			    eppnt->p_memsz > TASK_SIZE ||
--			    TASK_SIZE - eppnt->p_memsz < k) {
-+			    eppnt->p_memsz > pax_task_size ||
-+			    pax_task_size - eppnt->p_memsz < k) {
- 				error = -ENOMEM;
- 				goto out_close;
- 			}
-@@ -532,6 +552,177 @@ out:
- 	return error;
- }
- 
-+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
-+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (elf_phdata->p_flags & PF_PAGEEXEC)
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (elf_phdata->p_flags & PF_SEGMEXEC)
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (elf_phdata->p_flags & PF_EMUTRAMP)
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (elf_phdata->p_flags & PF_MPROTECT)
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	unsigned long i;
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+	pax_flags = pax_parse_ei_pax(elf_ex);
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	for (i = 0UL; i < elf_ex->e_phnum; i++)
-+		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+				return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+			if (pax_softmode)
-+				pax_flags = pax_parse_softmode(&elf_phdata[i]);
-+			else
-+#endif
-+
-+				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
-+			break;
-+		}
-+#endif
-+
-+	if (0 > pax_check_flags(&pax_flags))
-+		return -EINVAL;
-+
-+	current->mm->pax_flags = pax_flags;
-+	return 0;
-+}
-+#endif
-+
- /*
-  * These are the functions used to load ELF style executables and shared
-  * libraries.  There is no binary dependent code anywhere else.
-@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
- {
- 	unsigned int random_variable = 0;
- 
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		return stack_top - current->mm->delta_stack;
-+#endif
-+
- 	if ((current->flags & PF_RANDOMIZE) &&
- 		!(current->personality & ADDR_NO_RANDOMIZE)) {
- 		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
-  	unsigned long load_addr = 0, load_bias = 0;
- 	int load_addr_set = 0;
- 	char * elf_interpreter = NULL;
--	unsigned long error;
-+	unsigned long error = 0;
- 	struct elf_phdr *elf_ppnt, *elf_phdata;
- 	unsigned long elf_bss, elf_brk;
- 	int retval, i;
-@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
- 	unsigned long start_code, end_code, start_data, end_data;
- 	unsigned long reloc_func_desc = 0;
- 	int executable_stack = EXSTACK_DEFAULT;
--	unsigned long def_flags = 0;
- 	struct {
- 		struct elfhdr elf_ex;
- 		struct elfhdr interp_elf_ex;
- 	} *loc;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- 	if (!loc) {
-@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
- 
- 	/* OK, This is the point of no return */
- 	current->flags &= ~PF_FORKNOEXEC;
--	current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	current->mm->delta_mmap = 0UL;
-+	current->mm->delta_stack = 0UL;
-+#endif
-+
-+	current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
-+		send_sig(SIGKILL, current, 0);
-+		goto out_free_dentry;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+	pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+	if (pax_set_initial_flags_func)
-+		(pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+		current->mm->context.user_cs_limit = PAGE_SIZE;
-+		current->mm->def_flags |= VM_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+	}
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+		put_cpu();
-+	}
-+#endif
- 
- 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
- 	   may depend on the personality.  */
- 	SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		executable_stack = EXSTACK_DISABLE_X;
-+		current->personality &= ~READ_IMPLIES_EXEC;
-+	} else
-+#endif
-+
- 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- 		current->personality |= READ_IMPLIES_EXEC;
- 
-@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
- #else
- 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+			/* PaX: randomize base address at the default exe base if requested */
-+			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+				elf_flags |= MAP_FIXED;
-+			}
-+#endif
-+
- 		}
- 
- 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
- 		 * allowed task size. Note that p_filesz must always be
- 		 * <= p_memsz so it is only necessary to check p_memsz.
- 		 */
--		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
--		    elf_ppnt->p_memsz > TASK_SIZE ||
--		    TASK_SIZE - elf_ppnt->p_memsz < k) {
-+		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+		    elf_ppnt->p_memsz > pax_task_size ||
-+		    pax_task_size - elf_ppnt->p_memsz < k) {
- 			/* set_brk can never work. Avoid overflows. */
- 			send_sig(SIGKILL, current, 0);
- 			retval = -EINVAL;
-@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
- 	start_data += load_bias;
- 	end_data += load_bias;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
-+#endif
-+
- 	/* Calling set_brk effectively mmaps the pages that we need
- 	 * for the bss and break sections.  We must do this before
- 	 * mapping in the interpreter, to make sure it doesn't wind
-@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
- 		goto out_free_dentry;
- 	}
- 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
--		send_sig(SIGSEGV, current, 0);
--		retval = -EFAULT; /* Nobody gets to see this, but.. */
--		goto out_free_dentry;
-+		/*
-+		 * This bss-zeroing can fail if the ELF
-+		 * file specifies odd protections. So
-+		 * we don't check the return value
-+		 */
- 	}
- 
- 	if (elf_interpreter) {
-@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
- 			unsigned long n = off;
- 			if (n > PAGE_SIZE)
- 				n = PAGE_SIZE;
--			if (!dump_write(file, buf, n))
-+			if (!dump_write(file, buf, n)) {
-+				free_page((unsigned long)buf);
- 				return 0;
-+			}
- 			off -= n;
- 		}
- 		free_page((unsigned long)buf);
-@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
-  * Decide what to dump of a segment, part, all or none.
-  */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
--				   unsigned long mm_flags)
-+				   unsigned long mm_flags, long signr)
- {
- #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
- 
-@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
- 	if (vma->vm_file == NULL)
- 		return 0;
- 
--	if (FILTER(MAPPED_PRIVATE))
-+	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- 		goto whole;
- 
- 	/*
-@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
- #undef DUMP_WRITE
- 
- #define DUMP_WRITE(addr, nr)	\
-+	do { \
-+	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
--		goto end_coredump;
-+		goto end_coredump; \
-+	} while (0);
- 
- static void fill_elf_header(struct elfhdr *elf, int segs,
- 			    u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
- {
- 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- 	int i = 0;
--	do
-+	do {
- 		i += 2;
--	while (auxv[i - 2] != AT_NULL);
-+	} while (auxv[i - 2] != AT_NULL);
- 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
- 
-@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
- 		phdr.p_offset = offset;
- 		phdr.p_vaddr = vma->vm_start;
- 		phdr.p_paddr = 0;
--		phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- 		phdr.p_memsz = vma->vm_end - vma->vm_start;
- 		offset += phdr.p_filesz;
- 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
- 		unsigned long addr;
- 		unsigned long end;
- 
--		end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
- 
- 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- 			struct page *page;
-@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
- 			page = get_dump_page(addr);
- 			if (page) {
- 				void *kaddr = kmap(page);
-+				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- 				stop = ((size += PAGE_SIZE) > limit) ||
- 					!dump_write(file, kaddr, PAGE_SIZE);
- 				kunmap(page);
-@@ -2042,6 +2334,97 @@ out:
- 
- #endif		/* USE_ELF_CORE_DUMP */
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+	struct elfhdr elf_h;
-+	struct elf_phdr elf_p;
-+	unsigned long i;
-+	unsigned long oldflags;
-+	bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+		return;
-+
-+	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_NOELFRELOCS
-+	is_textrel_rw = false;
-+	is_textrel_rx = false;
-+#else
-+	/* possible TEXTREL */
-+	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#endif
-+
-+	/* possible RELRO */
-+	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+		return;
-+
-+	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+	    !elf_check_arch(&elf_h) ||
-+	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+		return;
-+
-+	for (i = 0UL; i < elf_h.e_phnum; i++) {
-+		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+			return;
-+		switch (elf_p.p_type) {
-+		case PT_DYNAMIC:
-+			if (!is_textrel_rw && !is_textrel_rx)
-+				continue;
-+			i = 0UL;
-+			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+				elf_dyn dyn;
-+
-+				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+					return;
-+				if (dyn.d_tag == DT_NULL)
-+					return;
-+				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+					gr_log_textrel(vma);
-+					if (is_textrel_rw)
-+						vma->vm_flags |= VM_MAYWRITE;
-+					else
-+						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+						vma->vm_flags &= ~VM_MAYWRITE;
-+					return;
-+				}
-+				i++;
-+			}
-+			return;
-+
-+		case PT_GNU_RELRO:
-+			if (!is_relro)
-+				continue;
-+			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+				vma->vm_flags &= ~VM_MAYWRITE;
-+			return;
-+		}
-+	}
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- 	return register_binfmt(&elf_format);
-diff -urNp linux-2.6.32.11/fs/binfmt_flat.c linux-2.6.32.11/fs/binfmt_flat.c
---- linux-2.6.32.11/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/binfmt_flat.c	2010-04-04 20:46:41.641560293 -0400
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
- 				realdatastart = (unsigned long) -ENOMEM;
- 			printk("Unable to allocate RAM for process data, errno %d\n",
- 					(int)-realdatastart);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
-+			up_write(&current->mm->mmap_sem);
- 			ret = realdatastart;
- 			goto err;
- 		}
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read data+bss, errno %d\n", (int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
- 			do_munmap(current->mm, realdatastart, data_len + extra);
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len + data_len + extra +
- 				MAX_SHARED_LIBS * sizeof(unsigned long));
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-diff -urNp linux-2.6.32.11/fs/binfmt_misc.c linux-2.6.32.11/fs/binfmt_misc.c
---- linux-2.6.32.11/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/binfmt_misc.c	2010-04-04 20:46:41.641560293 -0400
-@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
- 	static struct tree_descr bm_files[] = {
- 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
- 		[3] = {"register", &bm_register_operations, S_IWUSR},
--		/* last one */ {""}
-+		/* last one */ {"", NULL, 0}
- 	};
- 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
- 	if (!err)
-diff -urNp linux-2.6.32.11/fs/bio.c linux-2.6.32.11/fs/bio.c
---- linux-2.6.32.11/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/bio.c	2010-04-04 20:46:41.641560293 -0400
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
- 
- 	i = 0;
- 	while (i < bio_slab_nr) {
--		struct bio_slab *bslab = &bio_slabs[i];
-+		bslab = &bio_slabs[i];
- 
- 		if (!bslab->slab && entry == -1)
- 			entry = i;
-@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
- 	const int read = bio_data_dir(bio) == READ;
- 	struct bio_map_data *bmd = bio->bi_private;
- 	int i;
--	char *p = bmd->sgvecs[0].iov_base;
-+	char *p = (__force char *)bmd->sgvecs[0].iov_base;
- 
- 	__bio_for_each_segment(bvec, bio, i, 0) {
- 		char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.32.11/fs/btrfs/ctree.c linux-2.6.32.11/fs/btrfs/ctree.c
---- linux-2.6.32.11/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/ctree.c	2010-04-04 20:46:41.641560293 -0400
-@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
- 
- 	ret = 0;
- 	if (slot == 0) {
--		struct btrfs_disk_key disk_key;
- 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- 	}
-diff -urNp linux-2.6.32.11/fs/btrfs/disk-io.c linux-2.6.32.11/fs/btrfs/disk-io.c
---- linux-2.6.32.11/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/disk-io.c	2010-04-04 20:46:41.641560293 -0400
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
- 
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
- 
-@@ -2585,7 +2585,7 @@ out:
- 	return 0;
- }
- 
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- 	.write_cache_pages_lock_hook = btree_lock_page_hook,
- 	.readpage_end_io_hook = btree_readpage_end_io_hook,
- 	.submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.32.11/fs/btrfs/extent_io.h linux-2.6.32.11/fs/btrfs/extent_io.h
---- linux-2.6.32.11/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/extent_io.h	2010-04-04 20:46:41.641560293 -0400
-@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
- 				       struct bio *bio, int mirror_num,
- 				       unsigned long bio_flags);
- struct extent_io_ops {
--	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- 			     u64 start, u64 end, int *page_started,
- 			     unsigned long *nr_written);
--	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
--	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- 	extent_submit_bio_hook_t *submit_bio_hook;
--	int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- 			      size_t size, struct bio *bio,
- 			      unsigned long bio_flags);
--	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
--	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- 				       u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- 					u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				    struct extent_state *state);
--	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				      struct extent_state *state, int uptodate);
--	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- 			    unsigned long old, unsigned long bits);
--	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- 			      unsigned long bits);
--	int (*merge_extent_hook)(struct inode *inode,
-+	int (* const merge_extent_hook)(struct inode *inode,
- 				 struct extent_state *new,
- 				 struct extent_state *other);
--	int (*split_extent_hook)(struct inode *inode,
-+	int (* const split_extent_hook)(struct inode *inode,
- 				 struct extent_state *orig, u64 split);
--	int (*write_cache_pages_lock_hook)(struct page *page);
-+	int (* const write_cache_pages_lock_hook)(struct page *page);
- };
- 
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- 	u64 dirty_bytes;
- 	spinlock_t lock;
- 	spinlock_t buffer_lock;
--	struct extent_io_ops *ops;
-+	const struct extent_io_ops *ops;
- };
- 
- struct extent_state {
-diff -urNp linux-2.6.32.11/fs/btrfs/free-space-cache.c linux-2.6.32.11/fs/btrfs/free-space-cache.c
---- linux-2.6.32.11/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/free-space-cache.c	2010-04-04 20:46:41.641560293 -0400
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
- 
- 	while(1) {
- 		if (entry->bytes < bytes || entry->offset < min_start) {
--			struct rb_node *node;
--
- 			node = rb_next(&entry->offset_index);
- 			if (!node)
- 				break;
-@@ -1226,7 +1224,7 @@ again:
- 	 */
- 	while (entry->bitmap || found_bitmap ||
- 	       (!entry->bitmap && entry->bytes < min_bytes)) {
--		struct rb_node *node = rb_next(&entry->offset_index);
-+		node = rb_next(&entry->offset_index);
- 
- 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
- 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.32.11/fs/btrfs/inode.c linux-2.6.32.11/fs/btrfs/inode.c
---- linux-2.6.32.11/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/inode.c	2010-04-04 20:46:41.641560293 -0400
-@@ -63,7 +63,7 @@ static const struct inode_operations btr
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
- 
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
- 	.fsync		= btrfs_sync_file,
- };
- 
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- 	.fill_delalloc = run_delalloc_range,
- 	.submit_bio_hook = btrfs_submit_bio_hook,
- 	.merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.32.11/fs/btrfs/sysfs.c linux-2.6.32.11/fs/btrfs/sysfs.c
---- linux-2.6.32.11/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/btrfs/sysfs.c	2010-04-04 20:46:41.641560293 -0400
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
- 	complete(&root->kobj_unregister);
- }
- 
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- 	.show	= btrfs_super_attr_show,
- 	.store	= btrfs_super_attr_store,
- };
- 
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- 	.show	= btrfs_root_attr_show,
- 	.store	= btrfs_root_attr_store,
- };
-diff -urNp linux-2.6.32.11/fs/buffer.c linux-2.6.32.11/fs/buffer.c
---- linux-2.6.32.11/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/buffer.c	2010-04-04 20:46:41.641560293 -0400
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-diff -urNp linux-2.6.32.11/fs/cachefiles/rdwr.c linux-2.6.32.11/fs/cachefiles/rdwr.c
---- linux-2.6.32.11/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/cachefiles/rdwr.c	2010-04-04 20:46:41.641560293 -0400
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
- 			old_fs = get_fs();
- 			set_fs(KERNEL_DS);
- 			ret = file->f_op->write(
--				file, (const void __user *) data, len, &pos);
-+				file, (__force const void __user *) data, len, &pos);
- 			set_fs(old_fs);
- 			kunmap(page);
- 			if (ret != len)
-diff -urNp linux-2.6.32.11/fs/cifs/cifs_uniupr.h linux-2.6.32.11/fs/cifs/cifs_uniupr.h
---- linux-2.6.32.11/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/cifs/cifs_uniupr.h	2010-04-04 20:46:41.645781188 -0400
-@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
- 	{0x0490, 0x04cc, UniCaseRangeU0490},
- 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
- 	{0xff40, 0xff5a, UniCaseRangeUff40},
--	{0}
-+	{0, 0, NULL}
- };
- #endif
- 
-diff -urNp linux-2.6.32.11/fs/cifs/link.c linux-2.6.32.11/fs/cifs/link.c
---- linux-2.6.32.11/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/cifs/link.c	2010-04-04 20:46:41.645781188 -0400
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
- 
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
--	char *p = nd_get_link(nd);
-+	const char *p = nd_get_link(nd);
- 	if (!IS_ERR(p))
- 		kfree(p);
- }
-diff -urNp linux-2.6.32.11/fs/compat_binfmt_elf.c linux-2.6.32.11/fs/compat_binfmt_elf.c
---- linux-2.6.32.11/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/compat_binfmt_elf.c	2010-04-04 20:46:41.645781188 -0400
-@@ -29,10 +29,12 @@
- #undef	elfhdr
- #undef	elf_phdr
- #undef	elf_note
-+#undef	elf_dyn
- #undef	elf_addr_t
- #define elfhdr		elf32_hdr
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
-+#define elf_dyn		Elf32_Dyn
- #define elf_addr_t	Elf32_Addr
- 
- /*
-diff -urNp linux-2.6.32.11/fs/compat.c linux-2.6.32.11/fs/compat.c
---- linux-2.6.32.11/fs/compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/compat.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
- 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
- 				struct page *page;
- 
--#ifdef CONFIG_STACK_GROWSUP
- 				ret = expand_stack_downwards(bprm->vma, pos);
- 				if (ret < 0) {
- 					/* We've exceed the stack rlimit. */
- 					ret = -E2BIG;
- 					goto out;
- 				}
--#endif
- 				ret = get_user_pages(current, bprm->mm, pos,
- 						     1, 1, 1, &page, NULL);
- 				if (ret <= 0) {
-@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
- 	compat_uptr_t __user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+	retval = -EAGAIN;
-+	if (gr_handle_nproc())
-+		goto out_file;
-+	retval = -EACCES;
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+		goto out_file;
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, (char __user * __user *)argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	retval = search_binary_handler(bprm, regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1543,6 +1585,14 @@ int compat_do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput(bprm->mm);
-diff -urNp linux-2.6.32.11/fs/compat_ioctl.c linux-2.6.32.11/fs/compat_ioctl.c
---- linux-2.6.32.11/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/compat_ioctl.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1827,15 +1827,15 @@ struct ioctl_trans {
- };
- 
- #define HANDLE_IOCTL(cmd,handler) \
--	{ (cmd), (ioctl_trans_handler_t)(handler) },
-+	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
- 
- /* pointer to compatible structure or no argument */
- #define COMPATIBLE_IOCTL(cmd) \
--	{ (cmd), do_ioctl32_pointer },
-+	{ (cmd), do_ioctl32_pointer, NULL },
- 
- /* argument is an unsigned long integer, not a pointer */
- #define ULONG_IOCTL(cmd) \
--	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
-+	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
- 
- /* ioctl should not be warned about even if it's not implemented.
-    Valid reasons to use this:
-diff -urNp linux-2.6.32.11/fs/debugfs/inode.c linux-2.6.32.11/fs/debugfs/inode.c
---- linux-2.6.32.11/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/debugfs/inode.c	2010-04-04 20:46:41.645781188 -0400
-@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
- 
- static int debug_fill_super(struct super_block *sb, void *data, int silent)
- {
--	static struct tree_descr debug_files[] = {{""}};
-+	static struct tree_descr debug_files[] = {{"", NULL, 0}};
- 
- 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
- }
-diff -urNp linux-2.6.32.11/fs/dlm/lockspace.c linux-2.6.32.11/fs/dlm/lockspace.c
---- linux-2.6.32.11/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/dlm/lockspace.c	2010-04-04 20:46:41.645781188 -0400
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
- 	kfree(ls);
- }
- 
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- 	.show  = dlm_attr_show,
- 	.store = dlm_attr_store,
- };
-diff -urNp linux-2.6.32.11/fs/ecryptfs/inode.c linux-2.6.32.11/fs/ecryptfs/inode.c
---- linux-2.6.32.11/fs/ecryptfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ecryptfs/inode.c	2010-04-04 20:46:41.645781188 -0400
-@@ -676,7 +676,7 @@ ecryptfs_readlink(struct dentry *dentry,
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
--						   (char __user *)lower_buf,
-+						   (__force char __user *)lower_buf,
- 						   lower_bufsiz);
- 	set_fs(old_fs);
- 	if (rc >= 0) {
-@@ -720,7 +720,7 @@ static void *ecryptfs_follow_link(struct
- 	}
- 	old_fs = get_fs();
- 	set_fs(get_ds());
--	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- 	set_fs(old_fs);
- 	if (rc < 0)
- 		goto out_free;
-diff -urNp linux-2.6.32.11/fs/exec.c linux-2.6.32.11/fs/exec.c
---- linux-2.6.32.11/fs/exec.c	2010-04-04 20:41:50.037938751 -0400
-+++ linux-2.6.32.11/fs/exec.c	2010-04-04 20:46:41.645781188 -0400
-@@ -56,12 +56,24 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
- 
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
- 
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
- 		goto out;
- 
- 	file = do_filp_open(AT_FDCWD, tmp,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_READ | MAY_EXEC | MAY_OPEN);
- 	putname(tmp);
- 	error = PTR_ERR(file);
-@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
- 		int write)
- {
- 	struct page *page;
--	int ret;
- 
--#ifdef CONFIG_STACK_GROWSUP
--	if (write) {
--		ret = expand_stack_downwards(bprm->vma, pos);
--		if (ret < 0)
--			return NULL;
--	}
--#endif
--	ret = get_user_pages(current, bprm->mm, pos,
--			1, write, 1, &page, NULL);
--	if (ret <= 0)
-+	if (0 > expand_stack_downwards(bprm->vma, pos))
-+		return NULL;
-+	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- 		return NULL;
- 
- 	if (write) {
-@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
- 	vma->vm_end = STACK_TOP_MAX;
- 	vma->vm_start = vma->vm_end - PAGE_SIZE;
- 	vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 	err = insert_vm_struct(mm, vma);
- 	if (err)
-@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
- 	mm->stack_vm = mm->total_vm = 1;
- 	up_write(&mm->mmap_sem);
- 	bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
-+#endif
-+
- 	return 0;
- err:
- 	up_write(&mm->mmap_sem);
-@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
- 	int r;
- 	mm_segment_t oldfs = get_fs();
- 	set_fs(KERNEL_DS);
--	r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- 	set_fs(oldfs);
- 	return r;
- }
-@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
- 	unsigned long new_end = old_end - shift;
- 	struct mmu_gather *tlb;
- 
--	BUG_ON(new_start > new_end);
-+	if (new_start >= new_end || new_start < mmap_min_addr)
-+		return -EFAULT;
- 
- 	/*
- 	 * ensure there are no vmas between where we want to go
-@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
- 	if (vma != find_vma(mm, new_start))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- 	/*
- 	 * cover the whole range: [new_start, old_end)
- 	 */
-@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
- 	bprm->exec -= stack_shift;
- 
- 	down_write(&mm->mmap_sem);
-+
-+	/* Move stack pages down in memory. */
-+	if (stack_shift) {
-+		ret = shift_arg_pages(vma, stack_shift);
-+		if (ret)
-+			goto out_unlock;
-+	}
-+
- 	vm_flags = VM_STACK_FLAGS;
- 
- 	/*
-@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
- 		vm_flags &= ~VM_EXEC;
- 	vm_flags |= mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- 			vm_flags);
- 	if (ret)
- 		goto out_unlock;
- 	BUG_ON(prev != vma);
- 
--	/* Move stack pages down in memory. */
--	if (stack_shift) {
--		ret = shift_arg_pages(vma, stack_shift);
--		if (ret)
--			goto out_unlock;
--	}
--
- 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- 	stack_size = vma->vm_end - vma->vm_start;
- 	/*
-@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
- 	int err;
- 
- 	file = do_filp_open(AT_FDCWD, name,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_EXEC | MAY_OPEN);
- 	if (IS_ERR(file))
- 		goto out;
-@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	result = vfs_read(file, (void __user *)addr, count, &pos);
-+	result = vfs_read(file, (__force void __user *)addr, count, &pos);
- 	set_fs(old_fs);
- 	return result;
- }
-@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
- 	}
- 	rcu_read_unlock();
- 
--	if (p->fs->users > n_fs) {
-+	if (atomic_read(&p->fs->users) > n_fs) {
- 		bprm->unsafe |= LSM_UNSAFE_SHARE;
- 	} else {
- 		res = -EAGAIN;
-@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
- 	char __user *__user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+
-+	if (gr_handle_nproc()) {
-+		retval = -EAGAIN;
-+		goto out_file;
-+	}
-+
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+		retval = -EACCES;
-+		goto out_file;
-+	}
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	current->flags &= ~PF_KTHREAD;
- 	retval = search_binary_handler(bprm,regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1390,6 +1471,14 @@ int do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput (bprm->mm);
-@@ -1553,6 +1642,169 @@ out:
- 	return ispipe;
- }
- 
-+int pax_check_flags(unsigned long *flags)
-+{
-+	int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+	if (*flags & MF_PAX_SEGMEXEC)
-+	{
-+		*flags &= ~MF_PAX_SEGMEXEC;
-+		retval = -EINVAL;
-+	}
-+#endif
-+
-+	if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	    &&  (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_PAGEEXEC;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_MPROTECT;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_EMUTRAMP;
-+		retval = -EINVAL;
-+	}
-+
-+	return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+	struct task_struct *tsk = current;
-+	struct mm_struct *mm = current->mm;
-+	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+	char *path_exec = NULL;
-+	char *path_fault = NULL;
-+	unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+	if (buffer_exec && buffer_fault) {
-+		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+		down_read(&mm->mmap_sem);
-+		vma = mm->mmap;
-+		while (vma && (!vma_exec || !vma_fault)) {
-+			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+				vma_exec = vma;
-+			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+				vma_fault = vma;
-+			vma = vma->vm_next;
-+		}
-+		if (vma_exec) {
-+			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+			if (IS_ERR(path_exec))
-+				path_exec = "<path too long>";
-+			else {
-+				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+				if (path_exec) {
-+					*path_exec = 0;
-+					path_exec = buffer_exec;
-+				} else
-+					path_exec = "<path too long>";
-+			}
-+		}
-+		if (vma_fault) {
-+			start = vma_fault->vm_start;
-+			end = vma_fault->vm_end;
-+			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+			if (vma_fault->vm_file) {
-+				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+				if (IS_ERR(path_fault))
-+					path_fault = "<path too long>";
-+				else {
-+					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+					if (path_fault) {
-+						*path_fault = 0;
-+						path_fault = buffer_fault;
-+					} else
-+						path_fault = "<path too long>";
-+				}
-+			} else
-+				path_fault = "<anonymous mapping>";
-+		}
-+		up_read(&mm->mmap_sem);
-+	}
-+	if (tsk->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+	else
-+		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+			task_uid(tsk), task_euid(tsk), pc, sp);
-+	free_page((unsigned long)buffer_exec);
-+	free_page((unsigned long)buffer_fault);
-+	pax_report_insns(pc, sp);
-+	do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	else
-+		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+	show_regs(regs);
-+	force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+void pax_report_leak_to_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- 	struct task_struct *t;
-@@ -1755,17 +2007,17 @@ static void wait_for_dump_helpers(struct
- 	pipe = file->f_path.dentry->d_inode->i_pipe;
- 
- 	pipe_lock(pipe);
--	pipe->readers++;
--	pipe->writers--;
-+	atomic_inc(&pipe->readers);
-+	atomic_dec(&pipe->writers);
- 
--	while ((pipe->readers > 1) && (!signal_pending(current))) {
-+	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- 		wake_up_interruptible_sync(&pipe->wait);
- 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 		pipe_wait(pipe);
- 	}
- 
--	pipe->readers--;
--	pipe->writers++;
-+	atomic_dec(&pipe->readers);
-+	atomic_inc(&pipe->writers);
- 	pipe_unlock(pipe);
- 
- }
-@@ -1836,6 +2088,10 @@ void do_coredump(long signr, int exit_co
- 	 */
- 	clear_thread_flag(TIF_SIGPENDING);
- 
-+	if (signr == SIGKILL || signr == SIGILL)
-+		gr_handle_brute_attach(current);
-+	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- 	/*
- 	 * lock_kernel() because format_corename() is controlled by sysctl, which
- 	 * uses lock_kernel()
-diff -urNp linux-2.6.32.11/fs/ext2/balloc.c linux-2.6.32.11/fs/ext2/balloc.c
---- linux-2.6.32.11/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext2/balloc.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.11/fs/ext3/balloc.c linux-2.6.32.11/fs/ext3/balloc.c
---- linux-2.6.32.11/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext3/balloc.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.11/fs/ext3/namei.c linux-2.6.32.11/fs/ext3/namei.c
---- linux-2.6.32.11/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext3/namei.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext3_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext3_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.11/fs/ext3/xattr.c linux-2.6.32.11/fs/ext3/xattr.c
---- linux-2.6.32.11/fs/ext3/xattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext3/xattr.c	2010-04-04 20:46:41.649500937 -0400
-@@ -89,8 +89,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(f...) do {} while (0)
-+# define ea_bdebug(f...) do {} while (0)
- #endif
- 
- static void ext3_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.32.11/fs/ext4/balloc.c linux-2.6.32.11/fs/ext4/balloc.c
---- linux-2.6.32.11/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext4/balloc.c	2010-04-04 20:46:41.649500937 -0400
-@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
- 	/* Hm, nope.  Are (enough) root reserved blocks available? */
- 	if (sbi->s_resuid == current_fsuid() ||
- 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
--	    capable(CAP_SYS_RESOURCE)) {
-+	    capable_nolog(CAP_SYS_RESOURCE)) {
- 		if (free_blocks >= (nblocks + dirty_blocks))
- 			return 1;
- 	}
-diff -urNp linux-2.6.32.11/fs/ext4/ioctl.c linux-2.6.32.11/fs/ext4/ioctl.c
---- linux-2.6.32.11/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext4/ioctl.c	2010-04-04 20:46:41.649500937 -0400
-@@ -221,6 +221,9 @@ setversion_out:
- 		struct file *donor_filp;
- 		int err;
- 
-+		/* temporary workaround for bugs in here */
-+		return -EOPNOTSUPP;
-+
- 		if (!(filp->f_mode & FMODE_READ) ||
- 		    !(filp->f_mode & FMODE_WRITE))
- 			return -EBADF;
-diff -urNp linux-2.6.32.11/fs/ext4/namei.c linux-2.6.32.11/fs/ext4/namei.c
---- linux-2.6.32.11/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext4/namei.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext4_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext4_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.11/fs/ext4/super.c linux-2.6.32.11/fs/ext4/super.c
---- linux-2.6.32.11/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ext4/super.c	2010-04-04 20:46:41.649500937 -0400
-@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
- }
- 
- 
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- 	.show	= ext4_attr_show,
- 	.store	= ext4_attr_store,
- };
-diff -urNp linux-2.6.32.11/fs/fcntl.c linux-2.6.32.11/fs/fcntl.c
---- linux-2.6.32.11/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fcntl.c	2010-04-04 20:46:41.649500937 -0400
-@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
- 	switch (cmd) {
- 	case F_DUPFD:
- 	case F_DUPFD_CLOEXEC:
-+		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 			break;
- 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
- 	ret = ((fown->euid == 0 ||
- 		fown->euid == cred->suid || fown->euid == cred->uid ||
- 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
--	       !security_file_send_sigiotask(p, fown, sig));
-+	       !security_file_send_sigiotask(p, fown, sig) &&
-+	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
- 	rcu_read_unlock();
- 	return ret;
- }
-diff -urNp linux-2.6.32.11/fs/fifo.c linux-2.6.32.11/fs/fifo.c
---- linux-2.6.32.11/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fifo.c	2010-04-04 20:46:41.649500937 -0400
-@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &read_pipefifo_fops;
- 		pipe->r_counter++;
--		if (pipe->readers++ == 0)
-+		if (atomic_inc_return(&pipe->readers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->writers) {
-+		if (!atomic_read(&pipe->writers)) {
- 			if ((filp->f_flags & O_NONBLOCK)) {
- 				/* suppress POLLHUP until we have
- 				 * seen a writer */
-@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
- 	 *  errno=ENXIO when there is no process reading the FIFO.
- 	 */
- 		ret = -ENXIO;
--		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- 			goto err;
- 
- 		filp->f_op = &write_pipefifo_fops;
- 		pipe->w_counter++;
--		if (!pipe->writers++)
-+		if (atomic_inc_return(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			wait_for_partner(inode, &pipe->r_counter);
- 			if (signal_pending(current))
- 				goto err_wr;
-@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &rdwr_pipefifo_fops;
- 
--		pipe->readers++;
--		pipe->writers++;
-+		atomic_inc(&pipe->readers);
-+		atomic_inc(&pipe->writers);
- 		pipe->r_counter++;
- 		pipe->w_counter++;
--		if (pipe->readers == 1 || pipe->writers == 1)
-+		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 		break;
- 
-@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
- 	return 0;
- 
- err_rd:
--	if (!--pipe->readers)
-+	if (atomic_dec_and_test(&pipe->readers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err_wr:
--	if (!--pipe->writers)
-+	if (atomic_dec_and_test(&pipe->writers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err:
--	if (!pipe->readers && !pipe->writers)
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- 		free_pipe_info(inode);
- 
- err_nocleanup:
-diff -urNp linux-2.6.32.11/fs/file.c linux-2.6.32.11/fs/file.c
---- linux-2.6.32.11/fs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/file.c	2010-04-04 20:46:41.649500937 -0400
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
- 	 * N.B. For clone tasks sharing a files structure, this test
- 	 * will limit the total number of files that can be opened.
- 	 */
-+
-+	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EMFILE;
- 
-diff -urNp linux-2.6.32.11/fs/fs_struct.c linux-2.6.32.11/fs/fs_struct.c
---- linux-2.6.32.11/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fs_struct.c	2010-04-04 20:46:41.649500937 -0400
-@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
- 	struct task_struct *g, *p;
- 	struct fs_struct *fs;
- 	int count = 0;
-+	unsigned long flags;
- 
- 	read_lock(&tasklist_lock);
- 	do_each_thread(g, p) {
- 		task_lock(p);
-+		gr_fs_write_lock_irqsave(p, flags);
- 		fs = p->fs;
- 		if (fs) {
- 			write_lock(&fs->lock);
-@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
- 			}
- 			write_unlock(&fs->lock);
- 		}
-+		gr_fs_write_unlock_irqrestore(p, flags);
- 		task_unlock(p);
- 	} while_each_thread(g, p);
- 	read_unlock(&tasklist_lock);
-@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
- void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
- 		task_lock(tsk);
-+		gr_fs_write_lock_irqsave(tsk, flags);
- 		write_lock(&fs->lock);
- 		tsk->fs = NULL;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(tsk, flags);
- 		task_unlock(tsk);
- 		if (kill)
- 			free_fs_struct(fs);
-@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
- 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- 	/* We don't need to lock fs - think why ;-) */
- 	if (fs) {
--		fs->users = 1;
-+		atomic_set(&fs->users, 1);
- 		fs->in_exec = 0;
- 		rwlock_init(&fs->lock);
- 		fs->umask = old->umask;
-@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
- 	struct fs_struct *fs = current->fs;
- 	struct fs_struct *new_fs = copy_fs_struct(fs);
- 	int kill;
-+	unsigned long flags;
- 
- 	if (!new_fs)
- 		return -ENOMEM;
- 
- 	task_lock(current);
-+	gr_fs_write_lock_irqsave(current, flags);
- 	write_lock(&fs->lock);
--	kill = !--fs->users;
-+	kill = !atomic_dec_return(&fs->users);
- 	current->fs = new_fs;
- 	write_unlock(&fs->lock);
-+	gr_fs_write_unlock_irqrestore(current, flags);
- 	task_unlock(current);
- 
- 	if (kill)
-@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
- 
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
--	.users		= 1,
-+	.users		= ATOMIC_INIT(1),
- 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
- 	.umask		= 0022,
- };
-@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
- void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
-@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
- 		task_lock(current);
- 
- 		write_lock(&init_fs.lock);
--		init_fs.users++;
-+		atomic_inc(&init_fs.users);
- 		write_unlock(&init_fs.lock);
- 
-+		gr_fs_write_lock_irqsave(current, flags);
- 		write_lock(&fs->lock);
- 		current->fs = &init_fs;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(current, flags);
- 
- 		task_unlock(current);
- 		if (kill)
-diff -urNp linux-2.6.32.11/fs/fuse/control.c linux-2.6.32.11/fs/fuse/control.c
---- linux-2.6.32.11/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fuse/control.c	2010-04-04 20:46:41.649500937 -0400
-@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
- 
- static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
- {
--	struct tree_descr empty_descr = {""};
-+	struct tree_descr empty_descr = {"", NULL, 0};
- 	struct fuse_conn *fc;
- 	int err;
- 
-diff -urNp linux-2.6.32.11/fs/fuse/cuse.c linux-2.6.32.11/fs/fuse/cuse.c
---- linux-2.6.32.11/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fuse/cuse.c	2010-04-04 20:46:41.649500937 -0400
-@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
- 	return rc;
- }
- 
--static struct file_operations cuse_channel_fops; /* initialized during init */
--
-+static const struct file_operations cuse_channel_fops = { /* initialized during init */
-+	.owner		= THIS_MODULE,
-+	.llseek		= no_llseek,
-+	.read		= do_sync_read,
-+	.aio_read	= fuse_dev_read,
-+	.write		= do_sync_write,
-+	.aio_write	= fuse_dev_write,
-+	.poll		= fuse_dev_poll,
-+	.open		= cuse_channel_open,
-+	.release	= cuse_channel_release,
-+	.fasync		= fuse_dev_fasync,
-+};
- 
- /**************************************************************************
-  * Misc stuff and module initializatiion
-@@ -575,12 +585,6 @@ static int __init cuse_init(void)
- 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
- 		INIT_LIST_HEAD(&cuse_conntbl[i]);
- 
--	/* inherit and extend fuse_dev_operations */
--	cuse_channel_fops		= fuse_dev_operations;
--	cuse_channel_fops.owner		= THIS_MODULE;
--	cuse_channel_fops.open		= cuse_channel_open;
--	cuse_channel_fops.release	= cuse_channel_release;
--
- 	cuse_class = class_create(THIS_MODULE, "cuse");
- 	if (IS_ERR(cuse_class))
- 		return PTR_ERR(cuse_class);
-diff -urNp linux-2.6.32.11/fs/fuse/dev.c linux-2.6.32.11/fs/fuse/dev.c
---- linux-2.6.32.11/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fuse/dev.c	2010-04-04 20:46:41.649500937 -0400
-@@ -745,7 +745,7 @@ __releases(&fc->lock)
-  * request_end().  Otherwise add it to the processing list, and set
-  * the 'sent' flag.
-  */
--static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
- 			      unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
- 	spin_unlock(&fc->lock);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_read);
- 
- static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
- 			    struct fuse_copy_state *cs)
-@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
- {
- 	struct fuse_notify_inval_entry_out outarg;
- 	int err = -EINVAL;
--	char buf[FUSE_NAME_MAX+1];
-+	char *buf = NULL;
- 	struct qstr name;
- 
- 	if (size < sizeof(outarg))
-@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
- 	if (outarg.namelen > FUSE_NAME_MAX)
- 		goto err;
- 
-+	err = -ENOMEM;
-+	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+	if (!buf)
-+		goto err;
-+
- 	name.name = buf;
- 	name.len = outarg.namelen;
- 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
-@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
- 
- 	down_read(&fc->killsb);
- 	err = -ENOENT;
--	if (!fc->sb)
--		goto err_unlock;
--
--	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+	if (fc->sb)
-+		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- 	up_read(&fc->killsb);
-+	kfree(buf);
- 	return err;
- 
- err:
- 	fuse_copy_finish(cs);
-+	kfree(buf);
- 	return err;
- }
- 
-@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
-  * it from the list and copy the rest of the buffer to the request.
-  * The request is finished by calling request_end()
-  */
--static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
- 			       unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
- 	fuse_copy_finish(&cs);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_write);
- 
--static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
-+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
- {
- 	unsigned mask = POLLOUT | POLLWRNORM;
- 	struct fuse_conn *fc = fuse_get_conn(file);
-@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
- 
- 	return mask;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_poll);
- 
- /*
-  * Abort all requests on the given list (pending or processing)
-@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
- }
- EXPORT_SYMBOL_GPL(fuse_dev_release);
- 
--static int fuse_dev_fasync(int fd, struct file *file, int on)
-+int fuse_dev_fasync(int fd, struct file *file, int on)
- {
- 	struct fuse_conn *fc = fuse_get_conn(file);
- 	if (!fc)
-@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
- 	/* No locking - fasync_helper does its own locking */
- 	return fasync_helper(fd, file, on, &fc->fasync);
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
- 
- const struct file_operations fuse_dev_operations = {
- 	.owner		= THIS_MODULE,
-diff -urNp linux-2.6.32.11/fs/fuse/dir.c linux-2.6.32.11/fs/fuse/dir.c
---- linux-2.6.32.11/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fuse/dir.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
- 	return link;
- }
- 
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- 	if (!IS_ERR(link))
- 		free_page((unsigned long) link);
-diff -urNp linux-2.6.32.11/fs/fuse/fuse_i.h linux-2.6.32.11/fs/fuse/fuse_i.h
---- linux-2.6.32.11/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/fuse/fuse_i.h	2010-04-04 20:46:41.649500937 -0400
-@@ -521,6 +521,16 @@ extern const struct file_operations fuse
- 
- extern const struct dentry_operations fuse_dentry_operations;
- 
-+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+			      unsigned long nr_segs, loff_t pos);
-+
-+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+			       unsigned long nr_segs, loff_t pos);
-+
-+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
-+
-+extern int fuse_dev_fasync(int fd, struct file *file, int on);
-+
- /**
-  * Inode to nodeid comparison.
-  */
-diff -urNp linux-2.6.32.11/fs/gfs2/sys.c linux-2.6.32.11/fs/gfs2/sys.c
---- linux-2.6.32.11/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/gfs2/sys.c	2010-04-04 20:46:41.649500937 -0400
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
- 	return a->store ? a->store(sdp, buf, len) : len;
- }
- 
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- 	.show  = gfs2_attr_show,
- 	.store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- 	.uevent = gfs2_uevent,
- };
- 
-diff -urNp linux-2.6.32.11/fs/hfs/inode.c linux-2.6.32.11/fs/hfs/inode.c
---- linux-2.6.32.11/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/hfs/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
- 
- 	if (S_ISDIR(main_inode->i_mode)) {
- 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_dir));
- 		if (rec.type != HFS_CDR_DIR ||
-@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
- 				sizeof(struct hfs_cat_file));
- 	} else {
- 		if (fd.entrylength < sizeof(struct hfs_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_file));
- 		if (rec.type != HFS_CDR_FIL ||
-diff -urNp linux-2.6.32.11/fs/hfsplus/inode.c linux-2.6.32.11/fs/hfsplus/inode.c
---- linux-2.6.32.11/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/hfsplus/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		hfsplus_get_perms(inode, &folder->permissions, 1);
-@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 
-@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		/* simple node checks? */
-@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 		hfsplus_inode_write_fork(inode, &file->data_fork);
-diff -urNp linux-2.6.32.11/fs/hugetlbfs/inode.c linux-2.6.32.11/fs/hugetlbfs/inode.c
---- linux-2.6.32.11/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/hugetlbfs/inode.c	2010-04-06 22:13:08.677504702 -0400
-@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
- 	.kill_sb	= kill_litter_super,
- };
- 
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
- 
- static int can_do_hugetlb_shm(void)
- {
-diff -urNp linux-2.6.32.11/fs/ioctl.c linux-2.6.32.11/fs/ioctl.c
---- linux-2.6.32.11/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ioctl.c	2010-04-04 20:46:41.653544810 -0400
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
- 			    u64 phys, u64 len, u32 flags)
- {
- 	struct fiemap_extent extent;
--	struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
- 
- 	/* only count the extents */
- 	if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
- 
- 	fieinfo.fi_flags = fiemap.fm_flags;
- 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
--	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
- 
- 	if (fiemap.fm_extent_count != 0 &&
- 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
- 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- 	fiemap.fm_flags = fieinfo.fi_flags;
- 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
--	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- 		error = -EFAULT;
- 
- 	return error;
-diff -urNp linux-2.6.32.11/fs/jffs2/debug.h linux-2.6.32.11/fs/jffs2/debug.h
---- linux-2.6.32.11/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/jffs2/debug.h	2010-04-04 20:46:41.653544810 -0400
-@@ -52,13 +52,13 @@
- #if CONFIG_JFFS2_FS_DEBUG > 0
- #define D1(x) x
- #else
--#define D1(x)
-+#define D1(x) do {} while (0);
- #endif
- 
- #if CONFIG_JFFS2_FS_DEBUG > 1
- #define D2(x) x
- #else
--#define D2(x)
-+#define D2(x) do {} while (0);
- #endif
- 
- /* The prefixes of JFFS2 messages */
-@@ -114,73 +114,73 @@
- #ifdef JFFS2_DBG_READINODE_MESSAGES
- #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode(fmt, ...)
-+#define dbg_readinode(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_READINODE2_MESSAGES
- #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode2(fmt, ...)
-+#define dbg_readinode2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Fragtree build debugging messages */
- #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
- #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree(fmt, ...)
-+#define dbg_fragtree(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
- #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree2(fmt, ...)
-+#define dbg_fragtree2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Directory entry list manilulation debugging messages */
- #ifdef JFFS2_DBG_DENTLIST_MESSAGES
- #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_dentlist(fmt, ...)
-+#define dbg_dentlist(fmt, ...)	do {} while (0)
- #endif
- 
- /* Print the messages about manipulating node_refs */
- #ifdef JFFS2_DBG_NODEREF_MESSAGES
- #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_noderef(fmt, ...)
-+#define dbg_noderef(fmt, ...)	do {} while (0)
- #endif
- 
- /* Manipulations with the list of inodes (JFFS2 inocache) */
- #ifdef JFFS2_DBG_INOCACHE_MESSAGES
- #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_inocache(fmt, ...)
-+#define dbg_inocache(fmt, ...)	do {} while (0)
- #endif
- 
- /* Summary debugging messages */
- #ifdef JFFS2_DBG_SUMMARY_MESSAGES
- #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_summary(fmt, ...)
-+#define dbg_summary(fmt, ...)	do {} while (0)
- #endif
- 
- /* File system build messages */
- #ifdef JFFS2_DBG_FSBUILD_MESSAGES
- #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fsbuild(fmt, ...)
-+#define dbg_fsbuild(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the object allocations */
- #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
- #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_memalloc(fmt, ...)
-+#define dbg_memalloc(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the XATTR subsystem */
- #ifdef JFFS2_DBG_XATTR_MESSAGES
- #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_xattr(fmt, ...)
-+#define dbg_xattr(fmt, ...)	do {} while (0)
- #endif 
- 
- /* "Sanity" checks */
-diff -urNp linux-2.6.32.11/fs/jffs2/erase.c linux-2.6.32.11/fs/jffs2/erase.c
---- linux-2.6.32.11/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/jffs2/erase.c	2010-04-04 20:46:41.653544810 -0400
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
- 		struct jffs2_unknown_node marker = {
- 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--			.totlen =	cpu_to_je32(c->cleanmarker_size)
-+			.totlen =	cpu_to_je32(c->cleanmarker_size),
-+			.hdr_crc =	cpu_to_je32(0)
- 		};
- 
- 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.32.11/fs/jffs2/summary.h linux-2.6.32.11/fs/jffs2/summary.h
---- linux-2.6.32.11/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/jffs2/summary.h	2010-04-04 20:46:41.653544810 -0400
-@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
- 
- #define jffs2_sum_active() (0)
- #define jffs2_sum_init(a) (0)
--#define jffs2_sum_exit(a)
--#define jffs2_sum_disable_collecting(a)
-+#define jffs2_sum_exit(a) do {} while (0)
-+#define jffs2_sum_disable_collecting(a) do {} while (0)
- #define jffs2_sum_is_disabled(a) (0)
--#define jffs2_sum_reset_collected(a)
-+#define jffs2_sum_reset_collected(a) do {} while (0)
- #define jffs2_sum_add_kvec(a,b,c,d) (0)
--#define jffs2_sum_move_collected(a,b)
-+#define jffs2_sum_move_collected(a,b) do {} while (0)
- #define jffs2_sum_write_sumnode(a) (0)
--#define jffs2_sum_add_padding_mem(a,b)
--#define jffs2_sum_add_inode_mem(a,b,c)
--#define jffs2_sum_add_dirent_mem(a,b,c)
--#define jffs2_sum_add_xattr_mem(a,b,c)
--#define jffs2_sum_add_xref_mem(a,b,c)
-+#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
-+#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
- #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
- 
- #endif /* CONFIG_JFFS2_SUMMARY */
-diff -urNp linux-2.6.32.11/fs/jffs2/wbuf.c linux-2.6.32.11/fs/jffs2/wbuf.c
---- linux-2.6.32.11/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/jffs2/wbuf.c	2010-04-04 20:46:41.653544810 -0400
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
- {
- 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--	.totlen = constant_cpu_to_je32(8)
-+	.totlen = constant_cpu_to_je32(8),
-+	.hdr_crc = constant_cpu_to_je32(0)
- };
- 
- /*
-diff -urNp linux-2.6.32.11/fs/lockd/svc.c linux-2.6.32.11/fs/lockd/svc.c
---- linux-2.6.32.11/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/lockd/svc.c	2010-04-04 20:46:41.653544810 -0400
-@@ -43,7 +43,7 @@
- 
- static struct svc_program	nlmsvc_program;
- 
--struct nlmsvc_binding *		nlmsvc_ops;
-+const struct nlmsvc_binding *	nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
- 
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.32.11/fs/locks.c linux-2.6.32.11/fs/locks.c
---- linux-2.6.32.11/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/locks.c	2010-04-04 20:46:41.653544810 -0400
-@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
- 		return;
- 
- 	if (filp->f_op && filp->f_op->flock) {
--		struct file_lock fl = {
-+		struct file_lock flock = {
- 			.fl_pid = current->tgid,
- 			.fl_file = filp,
- 			.fl_flags = FL_FLOCK,
- 			.fl_type = F_UNLCK,
- 			.fl_end = OFFSET_MAX,
- 		};
--		filp->f_op->flock(filp, F_SETLKW, &fl);
--		if (fl.fl_ops && fl.fl_ops->fl_release_private)
--			fl.fl_ops->fl_release_private(&fl);
-+		filp->f_op->flock(filp, F_SETLKW, &flock);
-+		if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+			flock.fl_ops->fl_release_private(&flock);
- 	}
- 
- 	lock_kernel();
-diff -urNp linux-2.6.32.11/fs/namei.c linux-2.6.32.11/fs/namei.c
---- linux-2.6.32.11/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/namei.c	2010-04-04 20:46:41.653544810 -0400
-@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
- 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- 	error = PTR_ERR(cookie);
- 	if (!IS_ERR(cookie)) {
--		char *s = nd_get_link(nd);
-+		const char *s = nd_get_link(nd);
- 		error = 0;
- 		if (s)
- 			error = __vfs_follow_link(nd, s);
-@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
- 	err = security_inode_follow_link(path->dentry, nd);
- 	if (err)
- 		goto loop;
-+
-+	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+		err = -EACCES;
-+		goto loop;
-+	}
-+
- 	current->link_count++;
- 	current->total_link_count++;
- 	nd->depth++;
-@@ -1016,11 +1023,18 @@ return_reval:
- 				break;
- 		}
- return_base:
-+		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+			path_put(&nd->path);
-+			return -ENOENT;
-+		}
- 		return 0;
- out_dput:
- 		path_put_conditional(&next, nd);
- 		break;
- 	}
-+	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+		err = -ENOENT;
-+
- 	path_put(&nd->path);
- return_err:
- 	return err;
-@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
- 	int error;
- 	struct dentry *dir = nd->path.dentry;
- 
-+	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
-+		error = -EACCES;
-+		goto out_unlock;
-+	}
-+
- 	if (!IS_POSIXACL(dir->d_inode))
- 		mode &= ~current_umask();
- 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
- 	if (error)
- 		goto out_unlock;
- 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+	if (!error)
-+		gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	dput(nd->path.dentry);
-@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
- 					 &nd, flag);
- 		if (error)
- 			return ERR_PTR(error);
-+
-+		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
-+			error = -EACCES;
-+			goto exit;
-+		}
-+
- 		goto ok;
- 	}
- 
-@@ -1795,6 +1832,24 @@ do_last:
- 	/*
- 	 * It already exists.
- 	 */
-+
-+	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_rawio(path.dentry->d_inode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	audit_inode(pathname, path.dentry);
- 
-@@ -1887,6 +1942,13 @@ do_link:
- 	error = security_inode_follow_link(path.dentry, &nd);
- 	if (error)
- 		goto exit_dput;
-+
-+	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+				  path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto exit_dput;
-+	}
-+
- 	error = __do_follow_link(&path, &nd);
- 	if (error) {
- 		/* Does someone understand code flow here? Or it is only
-@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	error = may_mknod(mode);
- 	if (error)
- 		goto out_dput;
-+
-+	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+		error = -EPERM;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	}
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
- 		mode &= ~current_umask();
- 	error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
- 	char * name;
- 	struct dentry *dentry;
- 	struct nameidata nd;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
- 	error = PTR_ERR(dentry);
- 	if (IS_ERR(dentry))
- 		goto exit2;
-+
-+	if (dentry->d_inode != NULL) {
-+		if (dentry->d_inode->i_nlink <= 1) {
-+			saved_ino = dentry->d_inode->i_ino;
-+			saved_dev = dentry->d_inode->i_sb->s_dev;
-+		}
-+
-+		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+			error = -EACCES;
-+			goto exit3;
-+		}
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto exit3;
-@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
- 	if (error)
- 		goto exit4;
- 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+	if (!error && (saved_dev || saved_ino))
-+		gr_handle_delete(saved_ino, saved_dev);
- exit4:
- 	mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
- 	struct dentry *dentry;
- 	struct nameidata nd;
- 	struct inode *inode = NULL;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
- 		if (nd.last.name[nd.last.len])
- 			goto slashes;
- 		inode = dentry->d_inode;
--		if (inode)
-+		if (inode) {
-+			if (inode->i_nlink <= 1) {
-+				saved_ino = inode->i_ino;
-+				saved_dev = inode->i_sb->s_dev;
-+			}
-+
- 			atomic_inc(&inode->i_count);
-+
-+			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+				error = -EACCES;
-+				goto exit2;
-+			}
-+		}
- 		error = mnt_want_write(nd.path.mnt);
- 		if (error)
- 			goto exit2;
-@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
- 		if (error)
- 			goto exit3;
- 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+		if (!error && (saved_ino || saved_dev))
-+			gr_handle_delete(saved_ino, saved_dev);
- exit3:
- 		mnt_drop_write(nd.path.mnt);
- 	exit2:
-@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	error = PTR_ERR(new_dentry);
- 	if (IS_ERR(new_dentry))
- 		goto out_unlock;
-+
-+	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+			       old_path.dentry->d_inode,
-+			       old_path.dentry->d_inode->i_mode, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+				old_path.dentry, old_path.mnt, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 	if (new_dentry == trap)
- 		goto exit5;
- 
-+	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+				     to);
-+	if (error)
-+		goto exit5;
-+
- 	error = mnt_want_write(oldnd.path.mnt);
- 	if (error)
- 		goto exit5;
-@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 		goto exit6;
- 	error = vfs_rename(old_dir->d_inode, old_dentry,
- 				   new_dir->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- 	mnt_drop_write(oldnd.path.mnt);
- exit5:
-diff -urNp linux-2.6.32.11/fs/namespace.c linux-2.6.32.11/fs/namespace.c
---- linux-2.6.32.11/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/namespace.c	2010-04-04 20:46:41.653544810 -0400
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
- 		if (!(sb->s_flags & MS_RDONLY))
- 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- 		up_write(&sb->s_umount);
-+
-+		gr_log_remount(mnt->mnt_devname, retval);
-+
- 		return retval;
- 	}
- 
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
- 		security_sb_umount_busy(mnt);
- 	up_write(&namespace_sem);
- 	release_mounts(&umount_list);
-+
-+	gr_log_unmount(mnt->mnt_devname, retval);
-+
- 	return retval;
- }
- 
-@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
- 	if (retval)
- 		goto dput_out;
- 
-+	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
-+	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
- 	if (flags & MS_REMOUNT)
- 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- 				    data_page);
-@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
- 				      dev_name, data_page);
- dput_out:
- 	path_put(&path);
-+
-+	gr_log_mount(dev_name, dir_name, retval);
-+
- 	return retval;
- }
- 
-@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
- 		goto out1;
- 	}
- 
-+	if (gr_handle_chroot_pivot()) {
-+		error = -EPERM;
-+		path_put(&old);
-+		goto out1;
-+	}
-+
- 	read_lock(&current->fs->lock);
- 	root = current->fs->root;
- 	path_get(&current->fs->root);
-diff -urNp linux-2.6.32.11/fs/nfs/inode.c linux-2.6.32.11/fs/nfs/inode.c
---- linux-2.6.32.11/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
-+++ linux-2.6.32.11/fs/nfs/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
- 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
- 
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
- 
- static unsigned long nfs_read_attr_generation_counter(void)
- {
--	return atomic_long_read(&nfs_attr_generation_counter);
-+	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
- 
- unsigned long nfs_inc_attr_generation_counter(void)
- {
--	return atomic_long_inc_return(&nfs_attr_generation_counter);
-+	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
- 
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.32.11/fs/nfs/nfs4proc.c linux-2.6.32.11/fs/nfs/nfs4proc.c
---- linux-2.6.32.11/fs/nfs/nfs4proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/nfs/nfs4proc.c	2010-04-04 20:46:41.653544810 -0400
-@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
- static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_do_open_reclaim(ctx, state);
-@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
- 
- int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs_server *server = NFS_SERVER(state->inode);
- 	int err;
- 	do {
-@@ -1491,7 +1491,7 @@ static int _nfs4_open_expired(struct nfs
- static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -1591,7 +1591,7 @@ out_err:
- 
- static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs4_state *res;
- 	int status;
- 
-@@ -1682,7 +1682,7 @@ static int nfs4_do_setattr(struct inode 
- 			   struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2048,7 +2048,7 @@ static int _nfs4_server_capabilities(str
- 
- int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2082,7 +2082,7 @@ static int _nfs4_lookup_root(struct nfs_
- static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_fsinfo *info)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2171,7 +2171,7 @@ static int _nfs4_proc_getattr(struct nfs
- 
- static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2259,7 +2259,7 @@ static int nfs4_proc_lookupfh(struct nfs
- 			      struct qstr *name, struct nfs_fh *fhandle,
- 			      struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
-@@ -2288,7 +2288,7 @@ static int _nfs4_proc_lookup(struct inod
- 
- static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2352,7 +2352,7 @@ static int _nfs4_proc_access(struct inod
- 
- static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2408,7 +2408,7 @@ static int _nfs4_proc_readlink(struct in
- static int nfs4_proc_readlink(struct inode *inode, struct page *page,
- 		unsigned int pgbase, unsigned int pglen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2506,7 +2506,7 @@ static int _nfs4_proc_remove(struct inod
- 
- static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2580,7 +2580,7 @@ static int _nfs4_proc_rename(struct inod
- static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
- 		struct inode *new_dir, struct qstr *new_name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
-@@ -2627,7 +2627,7 @@ static int _nfs4_proc_link(struct inode 
- 
- static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2719,7 +2719,7 @@ out:
- static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
- 		struct page *page, unsigned int len, struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2750,7 +2750,7 @@ out:
- static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2799,7 +2799,7 @@ static int _nfs4_proc_readdir(struct den
- static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
-                   u64 cookie, struct page *page, unsigned int count, int plus)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
-@@ -2847,7 +2847,7 @@ out:
- static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr, dev_t rdev)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2879,7 +2879,7 @@ static int _nfs4_proc_statfs(struct nfs_
- 
- static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2910,7 +2910,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
- 
- static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -2956,7 +2956,7 @@ static int _nfs4_proc_pathconf(struct nf
- static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_pathconf *pathconf)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -3255,7 +3255,7 @@ out_free:
- 
- static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	ssize_t ret;
- 	do {
- 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
-@@ -3311,7 +3311,7 @@ static int __nfs4_proc_set_acl(struct in
- 
- static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -3576,7 +3576,7 @@ out:
- int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
-@@ -3649,7 +3649,7 @@ out:
- 
- static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4042,7 +4042,7 @@ static int _nfs4_do_setlk(struct nfs4_st
- static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4060,7 +4060,7 @@ static int nfs4_lock_reclaim(struct nfs4
- static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, request);
-@@ -4118,7 +4118,7 @@ out:
- 
- static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4178,7 +4178,7 @@ nfs4_proc_lock(struct file *filp, int cm
- int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, fl);
-diff -urNp linux-2.6.32.11/fs/nfsd/lockd.c linux-2.6.32.11/fs/nfsd/lockd.c
---- linux-2.6.32.11/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/nfsd/lockd.c	2010-04-04 20:46:41.653544810 -0400
-@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
- 	fput(filp);
- }
- 
--static struct nlmsvc_binding	nfsd_nlm_ops = {
-+static const struct nlmsvc_binding	nfsd_nlm_ops = {
- 	.fopen		= nlm_fopen,		/* open file for locking */
- 	.fclose		= nlm_fclose,		/* close file */
- };
-diff -urNp linux-2.6.32.11/fs/nfsd/vfs.c linux-2.6.32.11/fs/nfsd/vfs.c
---- linux-2.6.32.11/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/nfsd/vfs.c	2010-04-04 20:46:41.657782339 -0400
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
- 	} else {
- 		oldfs = get_fs();
- 		set_fs(KERNEL_DS);
--		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
- 		set_fs(oldfs);
- 	}
- 
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
- 
- 	/* Write the data. */
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
- 	set_fs(oldfs);
- 	if (host_err < 0)
- 		goto out_nfserr;
-@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
- 	 */
- 
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
- 	set_fs(oldfs);
- 
- 	if (host_err < 0)
-diff -urNp linux-2.6.32.11/fs/nls/nls_base.c linux-2.6.32.11/fs/nls/nls_base.c
---- linux-2.6.32.11/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/nls/nls_base.c	2010-04-04 20:46:41.657782339 -0400
-@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
-     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
-     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
-     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
--    {0,						       /* end of table    */}
-+    {0, 0, 0, 0, 0,				       /* end of table    */}
- };
- 
- #define UNICODE_MAX	0x0010ffff
-diff -urNp linux-2.6.32.11/fs/ntfs/file.c linux-2.6.32.11/fs/ntfs/file.c
---- linux-2.6.32.11/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ntfs/file.c	2010-04-04 20:46:41.657782339 -0400
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
- #endif /* NTFS_RW */
- };
- 
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
- 
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.32.11/fs/ocfs2/cluster/masklog.c linux-2.6.32.11/fs/ocfs2/cluster/masklog.c
---- linux-2.6.32.11/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ocfs2/cluster/masklog.c	2010-04-04 20:46:41.657782339 -0400
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
- 	return mlog_mask_store(mlog_attr->mask, buf, count);
- }
- 
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- 	.show  = mlog_show,
- 	.store = mlog_store,
- };
-diff -urNp linux-2.6.32.11/fs/ocfs2/localalloc.c linux-2.6.32.11/fs/ocfs2/localalloc.c
---- linux-2.6.32.11/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ocfs2/localalloc.c	2010-04-04 20:46:41.657782339 -0400
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
- 		goto bail;
- 	}
- 
--	atomic_inc(&osb->alloc_stats.moves);
-+	atomic_inc_unchecked(&osb->alloc_stats.moves);
- 
- 	status = 0;
- bail:
-diff -urNp linux-2.6.32.11/fs/ocfs2/ocfs2.h linux-2.6.32.11/fs/ocfs2/ocfs2.h
---- linux-2.6.32.11/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ocfs2/ocfs2.h	2010-04-04 20:46:41.657782339 -0400
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
- 
- struct ocfs2_alloc_stats
- {
--	atomic_t moves;
--	atomic_t local_data;
--	atomic_t bitmap_data;
--	atomic_t bg_allocs;
--	atomic_t bg_extends;
-+	atomic_unchecked_t moves;
-+	atomic_unchecked_t local_data;
-+	atomic_unchecked_t bitmap_data;
-+	atomic_unchecked_t bg_allocs;
-+	atomic_unchecked_t bg_extends;
- };
- 
- enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.32.11/fs/ocfs2/suballoc.c linux-2.6.32.11/fs/ocfs2/suballoc.c
---- linux-2.6.32.11/fs/ocfs2/suballoc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ocfs2/suballoc.c	2010-04-04 20:46:41.657782339 -0400
-@@ -620,7 +620,7 @@ static int ocfs2_reserve_suballoc_bits(s
- 				mlog_errno(status);
- 			goto bail;
- 		}
--		atomic_inc(&osb->alloc_stats.bg_extends);
-+		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
- 
- 		/* You should never ask for this much metadata */
- 		BUG_ON(bits_wanted >
-@@ -1651,7 +1651,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- 	ac->ac_bits_given += (*num_bits);
-@@ -1725,7 +1725,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	BUG_ON(num_bits != 1);
- 
-@@ -1827,7 +1827,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 						      cluster_start,
- 						      num_clusters);
- 		if (!status)
--			atomic_inc(&osb->alloc_stats.local_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.local_data);
- 	} else {
- 		if (min_clusters > (osb->bitmap_cpg - 1)) {
- 			/* The only paths asking for contiguousness
-@@ -1855,7 +1855,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- 								 bg_blkno,
- 								 bg_bit_off);
--			atomic_inc(&osb->alloc_stats.bitmap_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- 		}
- 	}
- 	if (status < 0) {
-diff -urNp linux-2.6.32.11/fs/ocfs2/super.c linux-2.6.32.11/fs/ocfs2/super.c
---- linux-2.6.32.11/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/ocfs2/super.c	2010-04-04 20:46:41.657782339 -0400
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
- 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
- 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
- 			"Stats",
--			atomic_read(&osb->alloc_stats.bitmap_data),
--			atomic_read(&osb->alloc_stats.local_data),
--			atomic_read(&osb->alloc_stats.bg_allocs),
--			atomic_read(&osb->alloc_stats.moves),
--			atomic_read(&osb->alloc_stats.bg_extends));
-+			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+			atomic_read_unchecked(&osb->alloc_stats.local_data),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+			atomic_read_unchecked(&osb->alloc_stats.moves),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
- 
- 	out += snprintf(buf + out, len - out,
- 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
-@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
- 	spin_lock_init(&osb->osb_xattr_lock);
- 	ocfs2_init_inode_steal_slot(osb);
- 
--	atomic_set(&osb->alloc_stats.moves, 0);
--	atomic_set(&osb->alloc_stats.local_data, 0);
--	atomic_set(&osb->alloc_stats.bitmap_data, 0);
--	atomic_set(&osb->alloc_stats.bg_allocs, 0);
--	atomic_set(&osb->alloc_stats.bg_extends, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
- 
- 	/* Copy the blockcheck stats from the superblock probe */
- 	osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.32.11/fs/open.c linux-2.6.32.11/fs/open.c
---- linux-2.6.32.11/fs/open.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/open.c	2010-04-04 20:46:41.657782339 -0400
-@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
- 	if (length < 0)
- 		return -EINVAL;
- 
-+	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_size = length;
- 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
- 	if (filp) {
-@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
- 	if (__mnt_is_readonly(path.mnt))
- 		res = -EROFS;
- 
-+	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+		res = -EACCES;
-+
- out_path_release:
- 	path_put(&path);
- out:
-@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
- 	if (error)
- 		goto dput_and_out;
- 
-+	gr_log_chdir(path.dentry, path.mnt);
-+
- 	set_fs_pwd(current->fs, &path);
- 
- dput_and_out:
-@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
- 		goto out_putf;
- 
- 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+		error = -EPERM;
-+
-+	if (!error)
-+		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- 	if (!error)
- 		set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
- 	if (!capable(CAP_SYS_CHROOT))
- 		goto dput_and_out;
- 
-+	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+		goto dput_and_out;
-+
-+	if (gr_handle_chroot_caps(&path)) {
-+		error = -ENOMEM;
-+		goto dput_and_out;
-+	}
-+
- 	set_fs_root(current->fs, &path);
-+
-+	gr_handle_chroot_chdir(&path);
-+
- 	error = 0;
- dput_and_out:
- 	path_put(&path);
-@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
- 	err = mnt_want_write_file(file);
- 	if (err)
- 		goto out_putf;
-+
-+	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EPERM;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	err = notify_change(dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(file->f_path.mnt);
- out_putf:
- 	fput(file);
-@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto dput_and_out;
-+
-+	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	error = notify_change(path.dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(path.mnt);
- dput_and_out:
- 	path_put(&path);
-@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
- 	return sys_fchmodat(AT_FDCWD, filename, mode);
- }
- 
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- 	struct inode *inode = dentry->d_inode;
- 	int error;
- 	struct iattr newattrs;
- 
-+	if (!gr_acl_handle_chown(dentry, mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_valid =  ATTR_CTIME;
- 	if (user != (uid_t) -1) {
- 		newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
- 		goto out_fput;
- 	dentry = file->f_path.dentry;
- 	audit_inode(NULL, dentry);
--	error = chown_common(dentry, user, group);
-+	error = chown_common(dentry, user, group, file->f_path.mnt);
- 	mnt_drop_write(file->f_path.mnt);
- out_fput:
- 	fput(file);
-diff -urNp linux-2.6.32.11/fs/pipe.c linux-2.6.32.11/fs/pipe.c
---- linux-2.6.32.11/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/pipe.c	2010-04-04 20:46:41.657782339 -0400
-@@ -401,9 +401,9 @@ redo:
- 		}
- 		if (bufs)	/* More to do? */
- 			continue;
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			/* syscall merging: Usually we must not sleep
- 			 * if O_NONBLOCK is set, or if we got some data.
- 			 * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
- 
--	if (!pipe->readers) {
-+	if (!atomic_read(&pipe->readers)) {
- 		send_sig(SIGPIPE, current, 0);
- 		ret = -EPIPE;
- 		goto out;
-@@ -511,7 +511,7 @@ redo1:
- 	for (;;) {
- 		int bufs;
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 			do_wakeup = 0;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- out:
- 	mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
- 	mask = 0;
- 	if (filp->f_mode & FMODE_READ) {
- 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
--		if (!pipe->writers && filp->f_version != pipe->w_counter)
-+		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- 			mask |= POLLHUP;
- 	}
- 
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
- 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
- 		 * behave exactly like pipes for poll().
- 		 */
--		if (!pipe->readers)
-+		if (!atomic_read(&pipe->readers))
- 			mask |= POLLERR;
- 	}
- 
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
- 
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
--	pipe->readers -= decr;
--	pipe->writers -= decw;
-+	atomic_sub(decr, &pipe->readers);
-+	atomic_sub(decw, &pipe->writers);
- 
--	if (!pipe->readers && !pipe->writers) {
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- 		free_pipe_info(inode);
- 	} else {
- 		wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->readers++;
-+		atomic_inc(&inode->i_pipe->readers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->writers++;
-+		atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
- 	if (inode->i_pipe) {
- 		ret = 0;
- 		if (filp->f_mode & FMODE_READ)
--			inode->i_pipe->readers++;
-+			atomic_inc(&inode->i_pipe->readers);
- 		if (filp->f_mode & FMODE_WRITE)
--			inode->i_pipe->writers++;
-+			atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
- 	inode->i_pipe = NULL;
- }
- 
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- 	/*
-@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
- 		goto fail_iput;
- 	inode->i_pipe = pipe;
- 
--	pipe->readers = pipe->writers = 1;
-+	atomic_set(&pipe->readers, 1);
-+	atomic_set(&pipe->writers, 1);
- 	inode->i_fop = &rdwr_pipefifo_fops;
- 
- 	/*
-diff -urNp linux-2.6.32.11/fs/proc/array.c linux-2.6.32.11/fs/proc/array.c
---- linux-2.6.32.11/fs/proc/array.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/array.c	2010-04-04 20:46:41.657782339 -0400
-@@ -410,6 +410,21 @@ static void task_show_stack_usage(struct
- }
- #endif		/* CONFIG_MMU */
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+	if (p->mm)
-+		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+	else
-+		seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task)
- {
-@@ -430,9 +445,20 @@ int proc_pid_status(struct seq_file *m, 
- #endif
- 	task_context_switch_counts(m, task);
- 	task_show_stack_usage(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	task_pax(m, task);
-+#endif
-+
- 	return 0;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -529,6 +555,19 @@ static int do_task_stat(struct seq_file 
- 		gtime = task_gtime(task);
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (PAX_RAND_FLAGS(mm)) {
-+		eip = 0;
-+		esp = 0;
-+		wchan = 0;
-+	}
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	wchan = 0;
-+	eip =0;
-+	esp =0;
-+#endif
-+
- 	/* scale priority and nice values from timeslices to -20..20 */
- 	/* to make it look like a "normal" Unix priority/nice value  */
- 	priority = task_prio(task);
-@@ -569,9 +608,15 @@ static int do_task_stat(struct seq_file 
- 		vsize,
- 		mm ? get_mm_rss(mm) : 0,
- 		rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
-+#else
- 		mm ? mm->start_code : 0,
- 		mm ? mm->end_code : 0,
- 		(permitted && mm) ? task->stack_start : 0,
-+#endif
- 		esp,
- 		eip,
- 		/* The signal information here is obsolete.
-@@ -624,3 +669,10 @@ int proc_pid_statm(struct seq_file *m, s
- 
- 	return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
-+}
-+#endif
-diff -urNp linux-2.6.32.11/fs/proc/base.c linux-2.6.32.11/fs/proc/base.c
---- linux-2.6.32.11/fs/proc/base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/base.c	2010-04-04 20:46:41.661529739 -0400
-@@ -102,6 +102,22 @@ struct pid_entry {
- 	union proc_op op;
- };
- 
-+struct getdents_callback {
-+	struct linux_dirent __user * current_dir;
-+	struct linux_dirent __user * previous;
-+	struct file * file;
-+	int count;
-+	int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
-+			   loff_t offset, u64 ino, unsigned int d_type)
-+{
-+	struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+	buf->error = -EINVAL;
-+	return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) {			\
- 	.name = (NAME),					\
- 	.len  = sizeof(NAME) - 1,			\
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
- 	if (task == current)
- 		return 0;
- 
-+	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+		return -EPERM;
-+
- 	/*
- 	 * If current is actively ptrace'ing, and would also be
- 	 * permitted to freshly attach with ptrace now, permit it.
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
- 	if (!mm->arg_end)
- 		goto out_mm;	/* Shh! No looking before we're done */
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out_mm;
-+
-  	len = mm->arg_end - mm->arg_start;
-  
- 	if (len > PAGE_SIZE)
-@@ -287,12 +309,26 @@ out:
- 	return res;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- 	int res = 0;
- 	struct mm_struct *mm = get_task_mm(task);
- 	if (mm) {
- 		unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (PAX_RAND_FLAGS(mm)) {
-+			mmput(mm);
-+			return res;
-+		}
-+#endif
-+
- 		do {
- 			nwords += 2;
- 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
- }
- #endif /* CONFIG_KALLSYMS */
- 
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 
- #define MAX_STACK_TRACE_DEPTH	64
- 
-@@ -521,7 +557,7 @@ static int proc_pid_limits(struct task_s
- 	return count;
- }
- 
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- 	long nr;
-@@ -935,6 +971,9 @@ static ssize_t environ_read(struct file 
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out;
-+
- 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
- 		goto out;
- 
-@@ -1455,7 +1494,11 @@ static struct inode *proc_pid_make_inode
- 		rcu_read_lock();
- 		cred = __task_cred(task);
- 		inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 		inode->i_gid = cred->egid;
-+#endif
- 		rcu_read_unlock();
- 	}
- 	security_task_to_inode(task, inode);
-@@ -1473,6 +1516,9 @@ static int pid_getattr(struct vfsmount *
- 	struct inode *inode = dentry->d_inode;
- 	struct task_struct *task;
- 	const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+#endif
- 
- 	generic_fillattr(inode, stat);
- 
-@@ -1480,12 +1526,34 @@ static int pid_getattr(struct vfsmount *
- 	stat->uid = 0;
- 	stat->gid = 0;
- 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+		rcu_read_unlock();
-+		return -ENOENT;
-+	}
-+
- 	if (task) {
-+		cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+		)
-+#endif
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
--			cred = __task_cred(task);
- 			stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			stat->gid = cred->egid;
-+#endif
- 		}
- 	}
- 	rcu_read_unlock();
-@@ -1517,11 +1585,20 @@ static int pid_revalidate(struct dentry 
- 
- 	if (task) {
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
- 			rcu_read_lock();
- 			cred = __task_cred(task);
- 			inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = cred->egid;
-+#endif
- 			rcu_read_unlock();
- 		} else {
- 			inode->i_uid = 0;
-@@ -1642,7 +1719,8 @@ static int proc_fd_info(struct inode *in
- 	int fd = proc_fd(inode);
- 
- 	if (task) {
--		files = get_files_struct(task);
-+		if (!gr_acl_handle_procpidmem(task))
-+			files = get_files_struct(task);
- 		put_task_struct(task);
- 	}
- 	if (files) {
-@@ -1894,12 +1972,22 @@ static const struct file_operations proc
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- 	int rv;
-+	struct task_struct *task;
- 
- 	rv = generic_permission(inode, mask, NULL);
--	if (rv == 0)
--		return 0;
-+
- 	if (task_pid(current) == proc_pid(inode))
- 		rv = 0;
-+
-+	task = get_proc_task(inode);
-+	if (task == NULL)
-+		return rv;
-+
-+	if (gr_acl_handle_procpidmem(task))
-+		rv = -EACCES;
-+
-+	put_task_struct(task);
-+
- 	return rv;
- }
- 
-@@ -2008,6 +2096,9 @@ static struct dentry *proc_pident_lookup
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	/*
- 	 * Yes, it does not scale. And it should not. Don't add
- 	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2052,6 +2143,9 @@ static int proc_pident_readdir(struct fi
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	ret = 0;
- 	i = filp->f_pos;
- 	switch (i) {
-@@ -2319,7 +2413,7 @@ static void *proc_self_follow_link(struc
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- 				void *cookie)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-@@ -2432,6 +2526,9 @@ static struct dentry *proc_base_lookup(s
- 	if (p > last)
- 		goto out;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	error = proc_base_instantiate(dir, dentry, task, p);
- 
- out:
-@@ -2518,7 +2615,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",    S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2546,7 +2643,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",      S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2576,6 +2673,9 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
- 
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2700,7 +2800,14 @@ static struct dentry *proc_pid_instantia
- 	if (!inode)
- 		goto out;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- 	inode->i_op = &proc_tgid_base_inode_operations;
- 	inode->i_fop = &proc_tgid_base_operations;
- 	inode->i_flags|=S_IMMUTABLE;
-@@ -2742,7 +2849,11 @@ struct dentry *proc_pid_lookup(struct in
- 	if (!task)
- 		goto out;
- 
-+	if (gr_check_hidden_task(task))
-+		goto out_put_task;
-+
- 	result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- 	put_task_struct(task);
- out:
- 	return result;
-@@ -2807,6 +2918,11 @@ int proc_pid_readdir(struct file * filp,
- {
- 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+	const struct cred *itercred;
-+#endif
-+	filldir_t __filldir = filldir;
- 	struct tgid_iter iter;
- 	struct pid_namespace *ns;
- 
-@@ -2825,8 +2941,27 @@ int proc_pid_readdir(struct file * filp,
- 	for (iter = next_tgid(ns, iter);
- 	     iter.task;
- 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		rcu_read_lock();
-+		itercred = __task_cred(iter.task);
-+#endif
-+		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+			)
-+#endif
-+		)
-+			__filldir = &gr_fake_filldir;
-+		else
-+			__filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	rcu_read_unlock();
-+#endif
- 		filp->f_pos = iter.tgid + TGID_OFFSET;
--		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- 			put_task_struct(iter.task);
- 			goto out;
- 		}
-@@ -2852,7 +2987,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",   S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -2879,7 +3014,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",     S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.32.11/fs/proc/cmdline.c linux-2.6.32.11/fs/proc/cmdline.c
---- linux-2.6.32.11/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/cmdline.c	2010-04-04 20:46:41.661529739 -0400
-@@ -23,7 +23,11 @@ static const struct file_operations cmdl
- 
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- 	return 0;
- }
- module_init(proc_cmdline_init);
-diff -urNp linux-2.6.32.11/fs/proc/devices.c linux-2.6.32.11/fs/proc/devices.c
---- linux-2.6.32.11/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/devices.c	2010-04-04 20:46:41.661529739 -0400
-@@ -64,7 +64,11 @@ static const struct file_operations proc
- 
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_devices_init);
-diff -urNp linux-2.6.32.11/fs/proc/inode.c linux-2.6.32.11/fs/proc/inode.c
---- linux-2.6.32.11/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/inode.c	2010-04-04 20:46:41.661529739 -0400
-@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
- 		if (de->mode) {
- 			inode->i_mode = de->mode;
- 			inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = de->gid;
-+#endif
- 		}
- 		if (de->size)
- 			inode->i_size = de->size;
-diff -urNp linux-2.6.32.11/fs/proc/internal.h linux-2.6.32.11/fs/proc/internal.h
---- linux-2.6.32.11/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/internal.h	2010-04-04 20:46:41.661529739 -0400
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
- 				struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- 				struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
- 
- extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.32.11/fs/proc/Kconfig linux-2.6.32.11/fs/proc/Kconfig
---- linux-2.6.32.11/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/Kconfig	2010-04-04 20:46:41.661529739 -0400
-@@ -30,12 +30,12 @@ config PROC_FS
- 
- config PROC_KCORE
- 	bool "/proc/kcore support" if !ARM
--	depends on PROC_FS && MMU
-+	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
- 
- config PROC_VMCORE
-         bool "/proc/vmcore support (EXPERIMENTAL)"
--        depends on PROC_FS && CRASH_DUMP
--	default y
-+        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+	default n
-         help
-         Exports the dump image of crashed kernel in ELF format.
- 
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- 	  limited in memory.
- 
- config PROC_PAGE_MONITOR
-- 	default y
--	depends on PROC_FS && MMU
-+ 	default n
-+	depends on PROC_FS && MMU && !GRKERNSEC
- 	bool "Enable /proc page monitoring" if EMBEDDED
-  	help
- 	  Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.32.11/fs/proc/kcore.c linux-2.6.32.11/fs/proc/kcore.c
---- linux-2.6.32.11/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/kcore.c	2010-04-04 20:46:41.661529739 -0400
-@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
- 
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	return -EPERM;
-+#endif
- 	if (!capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 	if (kcore_need_update)
-diff -urNp linux-2.6.32.11/fs/proc/meminfo.c linux-2.6.32.11/fs/proc/meminfo.c
---- linux-2.6.32.11/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/meminfo.c	2010-04-04 20:46:41.661529739 -0400
-@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
- 		vmi.used >> 10,
- 		vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
--		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- 		);
- 
-diff -urNp linux-2.6.32.11/fs/proc/nommu.c linux-2.6.32.11/fs/proc/nommu.c
---- linux-2.6.32.11/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/nommu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.11/fs/proc/proc_net.c linux-2.6.32.11/fs/proc/proc_net.c
---- linux-2.6.32.11/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/proc_net.c	2010-04-04 20:46:41.661529739 -0400
-@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
- 	struct task_struct *task;
- 	struct nsproxy *ns;
- 	struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	if (cred->fsuid)
-+		return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
-+		return net;
-+#endif
- 
- 	rcu_read_lock();
- 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.32.11/fs/proc/proc_sysctl.c linux-2.6.32.11/fs/proc/proc_sysctl.c
---- linux-2.6.32.11/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/proc_sysctl.c	2010-04-04 20:46:41.661529739 -0400
-@@ -7,6 +7,8 @@
- #include <linux/security.h>
- #include "internal.h"
- 
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
- static const struct inode_operations proc_sys_inode_operations;
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
- 	if (!p)
- 		goto out;
- 
-+	if (gr_handle_sysctl(p, MAY_EXEC))
-+		goto out;
-+
- 	err = ERR_PTR(-ENOMEM);
- 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- 	if (h)
-@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
- 		if (*pos < file->f_pos)
- 			continue;
- 
-+		if (gr_handle_sysctl(table, 0))
-+			continue;
-+
- 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- 		if (res)
- 			return res;
-@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
- 	if (IS_ERR(head))
- 		return PTR_ERR(head);
- 
-+	if (table && gr_handle_sysctl(table, MAY_EXEC))
-+		return -ENOENT;
-+
- 	generic_fillattr(inode, stat);
- 	if (table)
- 		stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.32.11/fs/proc/root.c linux-2.6.32.11/fs/proc/root.c
---- linux-2.6.32.11/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/root.c	2010-04-04 20:46:41.661529739 -0400
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- 	proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_mkdir("bus", NULL);
-+#endif
- 	proc_sys_init();
- }
- 
-diff -urNp linux-2.6.32.11/fs/proc/task_mmu.c linux-2.6.32.11/fs/proc/task_mmu.c
---- linux-2.6.32.11/fs/proc/task_mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/task_mmu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
- 		"VmStk:\t%8lu kB\n"
- 		"VmExe:\t%8lu kB\n"
- 		"VmLib:\t%8lu kB\n"
--		"VmPTE:\t%8lu kB\n",
--		hiwater_vm << (PAGE_SHIFT-10),
-+		"VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+		,hiwater_vm << (PAGE_SHIFT-10),
- 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- 		mm->locked_vm << (PAGE_SHIFT-10),
- 		hiwater_rss << (PAGE_SHIFT-10),
- 		total_rss << (PAGE_SHIFT-10),
- 		data << (PAGE_SHIFT-10),
- 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
--		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		, mm->context.user_cs_base, mm->context.user_cs_limit
-+#endif
-+
-+	);
- }
- 
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
- 	return ret;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- {
- 	struct mm_struct *mm = vma->vm_mm;
-@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
- 	}
- 
- 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
- 			vma->vm_start,
- 			vma->vm_end,
-+#endif
- 			flags & VM_READ ? 'r' : '-',
- 			flags & VM_WRITE ? 'w' : '-',
- 			flags & VM_EXEC ? 'x' : '-',
- 			flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- 			pgoff,
-+#endif
- 			MAJOR(dev), MINOR(dev), ino, &len);
- 
- 	/*
-@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
- 	 */
- 	if (file) {
- 		pad_len_spaces(m, len);
--		seq_path(m, &file->f_path, "\n");
-+		seq_path(m, &file->f_path, "\n\\");
- 	} else {
- 		const char *name = arch_vma_name(vma);
- 		if (!name) {
- 			if (mm) {
--				if (vma->vm_start <= mm->start_brk &&
--						vma->vm_end >= mm->brk) {
-+				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 					name = "[heap]";
--				} else if (vma->vm_start <= mm->start_stack &&
--					   vma->vm_end >= mm->start_stack) {
-+				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+					   (vma->vm_start <= mm->start_stack &&
-+					    vma->vm_end >= mm->start_stack)) {
- 					name = "[stack]";
- 				} else {
- 					unsigned long stack_start;
-@@ -403,9 +429,16 @@ static int show_smap(struct seq_file *m,
- 	};
- 
- 	memset(&mss, 0, sizeof mss);
--	mss.vma = vma;
--	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
--		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+		mss.vma = vma;
-+		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	}
-+#endif
- 
- 	show_map_vma(m, vma);
- 
-@@ -421,7 +454,11 @@ static int show_smap(struct seq_file *m,
- 		   "Swap:           %8lu kB\n"
- 		   "KernelPageSize: %8lu kB\n"
- 		   "MMUPageSize:    %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- 		   (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- 		   mss.resident >> 10,
- 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- 		   mss.shared_clean  >> 10,
-diff -urNp linux-2.6.32.11/fs/proc/task_nommu.c linux-2.6.32.11/fs/proc/task_nommu.c
---- linux-2.6.32.11/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/proc/task_nommu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
- 	else
- 		bytes += kobjsize(mm);
- 	
--	if (current->fs && current->fs->users > 1)
-+	if (current->fs && atomic_read(&current->fs->users) > 1)
- 		sbytes += kobjsize(current->fs);
- 	else
- 		bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.11/fs/readdir.c linux-2.6.32.11/fs/readdir.c
---- linux-2.6.32.11/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/readdir.c	2010-04-04 20:46:41.661529739 -0400
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
- 
- struct readdir_callback {
- 	struct old_linux_dirent __user * dirent;
-+	struct file * file;
- 	int result;
- };
- 
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
- 		buf->result = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	buf->result++;
- 	dirent = buf->dirent;
- 	if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
- 
- 	buf.result = 0;
- 	buf.dirent = dirent;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, fillonedir, &buf);
- 	if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- 	struct linux_dirent __user * current_dir;
- 	struct linux_dirent __user * previous;
-+	struct file * file;
- 	int count;
- 	int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
- 		buf->error = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
- 	buf.previous = NULL;
- 	buf.count = count;
- 	buf.error = 0;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, filldir, &buf);
- 	if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- 	struct linux_dirent64 __user * current_dir;
- 	struct linux_dirent64 __user * previous;
-+	struct file *file;
- 	int count;
- 	int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
- 	buf->error = -EINVAL;	/* only used if we fail.. */
- 	if (reclen > buf->count)
- 		return -EINVAL;
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
- 
- 	buf.current_dir = dirent;
- 	buf.previous = NULL;
-+	buf.file = file;
- 	buf.count = count;
- 	buf.error = 0;
- 
-diff -urNp linux-2.6.32.11/fs/reiserfs/do_balan.c linux-2.6.32.11/fs/reiserfs/do_balan.c
---- linux-2.6.32.11/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/reiserfs/do_balan.c	2010-04-04 20:46:41.661529739 -0400
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
- 		return;
- 	}
- 
--	atomic_inc(&(fs_generation(tb->tb_sb)));
-+	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- 	do_balance_starts(tb);
- 
- 	/* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.32.11/fs/reiserfs/item_ops.c linux-2.6.32.11/fs/reiserfs/item_ops.c
---- linux-2.6.32.11/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/reiserfs/item_ops.c	2010-04-04 20:46:41.661529739 -0400
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- 	.bytes_number = sd_bytes_number,
- 	.decrement_key = sd_decrement_key,
- 	.is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- 	.bytes_number = direct_bytes_number,
- 	.decrement_key = direct_decrement_key,
- 	.is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- 	.bytes_number = indirect_bytes_number,
- 	.decrement_key = indirect_decrement_key,
- 	.is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
- 	printk("\n");
- }
- 
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- 	.bytes_number = direntry_bytes_number,
- 	.decrement_key = direntry_decrement_key,
- 	.is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
- 			 "Invalid item type observed, run fsck ASAP");
- }
- 
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- 	errcatch_bytes_number,
- 	errcatch_decrement_key,
- 	errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
- #error Item types must use disk-format assigned values.
- #endif
- 
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- 	&stat_data_ops,
- 	&indirect_ops,
- 	&direct_ops,
-diff -urNp linux-2.6.32.11/fs/reiserfs/procfs.c linux-2.6.32.11/fs/reiserfs/procfs.c
---- linux-2.6.32.11/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/reiserfs/procfs.c	2010-04-04 20:46:41.661529739 -0400
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
- 		   "SMALL_TAILS " : "NO_TAILS ",
- 		   replay_only(sb) ? "REPLAY_ONLY " : "",
- 		   convert_reiserfs(sb) ? "CONV " : "",
--		   atomic_read(&r->s_generation_counter),
-+		   atomic_read_unchecked(&r->s_generation_counter),
- 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
- 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
-diff -urNp linux-2.6.32.11/fs/select.c linux-2.6.32.11/fs/select.c
---- linux-2.6.32.11/fs/select.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/select.c	2010-04-04 20:46:41.661529739 -0400
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
-  	struct poll_list *walk = head;
-  	unsigned long todo = nfds;
- 
-+	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EINVAL;
- 
-diff -urNp linux-2.6.32.11/fs/seq_file.c linux-2.6.32.11/fs/seq_file.c
---- linux-2.6.32.11/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/seq_file.c	2010-04-04 20:46:41.661529739 -0400
-@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
- 		return 0;
- 	}
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			return -ENOMEM;
- 	}
-@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
- Eoverflow:
- 	m->op->stop(m, p);
- 	kfree(m->buf);
--	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+	m->size <<= 1;
-+	m->buf = kmalloc(m->size, GFP_KERNEL);
- 	return !m->buf ? -ENOMEM : -EAGAIN;
- }
- 
-@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
- 	m->version = file->f_version;
- 	/* grab buffer if we didn't have one */
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 	}
-@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
- 			goto Fill;
- 		m->op->stop(m, p);
- 		kfree(m->buf);
--		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+		m->size <<= 1;
-+		m->buf = kmalloc(m->size, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 		m->count = 0;
-diff -urNp linux-2.6.32.11/fs/smbfs/symlink.c linux-2.6.32.11/fs/smbfs/symlink.c
---- linux-2.6.32.11/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/smbfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
- 
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-diff -urNp linux-2.6.32.11/fs/splice.c linux-2.6.32.11/fs/splice.c
---- linux-2.6.32.11/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/splice.c	2010-04-04 20:46:41.661529739 -0400
-@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
- 	pipe_lock(pipe);
- 
- 	for (;;) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
- 			do_wakeup = 0;
- 		}
- 
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_write(file, (const char __user *)buf, count, &pos);
-+	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
- 			goto err;
- 
- 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
--		vec[i].iov_base = (void __user *) page_address(page);
-+		vec[i].iov_base = (__force void __user *) page_address(page);
- 		vec[i].iov_len = this_len;
- 		pages[i] = page;
- 		spd.nr_pages++;
-@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- 	while (!pipe->nrbufs) {
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			return 0;
- 
--		if (!pipe->waiting_writers && sd->num_spliced)
-+		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- 			return 0;
- 
- 		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
- 		 * out of the pipe right after the splice_to_pipe(). So set
- 		 * PIPE_READERS appropriately.
- 		 */
--		pipe->readers = 1;
-+		atomic_set(&pipe->readers, 1);
- 
- 		current->splice_pipe = pipe;
- 	}
-@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			if (flags & SPLICE_F_NONBLOCK) {
- 				ret = -EAGAIN;
- 				break;
-@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
- 	pipe_lock(pipe);
- 
- 	while (pipe->nrbufs >= PIPE_BUFFERS) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			ret = -EPIPE;
- 			break;
-@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -1789,14 +1789,14 @@ retry:
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
- 			break;
- 		}
- 
--		if (!ipipe->nrbufs && !ipipe->writers)
-+		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- 			break;
- 
- 		/*
-@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
- 	 * return EAGAIN if we have the potential of some data in the
- 	 * future, otherwise just return 0
- 	 */
--	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- 		ret = -EAGAIN;
- 
- 	pipe_unlock(ipipe);
-diff -urNp linux-2.6.32.11/fs/sysfs/file.c linux-2.6.32.11/fs/sysfs/file.c
---- linux-2.6.32.11/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/sysfs/file.c	2010-04-04 20:46:41.661529739 -0400
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- 	size_t			count;
- 	loff_t			pos;
- 	char			* page;
--	struct sysfs_ops	* ops;
-+	const struct sysfs_ops	* ops;
- 	struct mutex		mutex;
- 	int			needs_read_fill;
- 	int			event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int ret = 0;
- 	ssize_t count;
- 
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int rc;
- 
- 	/* need attr_sd for attr and ops, its parent for kobj */
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
- 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- 	struct sysfs_buffer *buffer;
--	struct sysfs_ops *ops;
-+	const struct sysfs_ops *ops;
- 	int error = -EACCES;
- 	char *p;
- 
-diff -urNp linux-2.6.32.11/fs/sysfs/symlink.c linux-2.6.32.11/fs/sysfs/symlink.c
---- linux-2.6.32.11/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/sysfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
- 
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
--	char *page = nd_get_link(nd);
-+	const char *page = nd_get_link(nd);
- 	if (!IS_ERR(page))
- 		free_page((unsigned long)page);
- }
-diff -urNp linux-2.6.32.11/fs/udf/balloc.c linux-2.6.32.11/fs/udf/balloc.c
---- linux-2.6.32.11/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/udf/balloc.c	2010-04-04 20:46:41.665784997 -0400
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- 			  count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- 			  partmap->s_partition_len);
-diff -urNp linux-2.6.32.11/fs/utimes.c linux-2.6.32.11/fs/utimes.c
---- linux-2.6.32.11/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/utimes.c	2010-04-04 20:46:41.665784997 -0400
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
- 				goto mnt_drop_write_and_out;
- 		}
- 	}
-+
-+	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+		error = -EACCES;
-+		goto mnt_drop_write_and_out;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	error = notify_change(path->dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.32.11/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.11/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.32.11/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/xfs/linux-2.6/xfs_ioctl.c	2010-04-04 20:46:41.665784997 -0400
-@@ -134,7 +134,7 @@ xfs_find_handle(
- 	}
- 
- 	error = -EFAULT;
--	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- 		goto out_put;
- 
-diff -urNp linux-2.6.32.11/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.11/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.32.11/fs/xfs/linux-2.6/xfs_iops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/xfs/linux-2.6/xfs_iops.c	2010-04-04 20:46:41.665784997 -0400
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- 	struct nameidata *nd,
- 	void		*p)
- {
--	char		*s = nd_get_link(nd);
-+	const char	*s = nd_get_link(nd);
- 
- 	if (!IS_ERR(s))
- 		kfree(s);
-diff -urNp linux-2.6.32.11/fs/xfs/xfs_bmap.c linux-2.6.32.11/fs/xfs/xfs_bmap.c
---- linux-2.6.32.11/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/fs/xfs/xfs_bmap.c	2010-04-04 20:46:41.665784997 -0400
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- 	int			nmap,
- 	int			ret_nmap);
- #else
--#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
- 
- #if defined(XFS_RW_TRACE)
-diff -urNp linux-2.6.32.11/grsecurity/gracl_alloc.c linux-2.6.32.11/grsecurity/gracl_alloc.c
---- linux-2.6.32.11/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_alloc.c	2010-04-04 20:46:41.665784997 -0400
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+	if (alloc_stack_next == 1)
-+		return 0;
-+
-+	kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+	alloc_stack_next--;
-+
-+	return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+	if (alloc_stack_next >= alloc_stack_size)
-+		return 1;
-+
-+	alloc_stack[alloc_stack_next - 1] = buf;
-+
-+	alloc_stack_next++;
-+
-+	return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+	void *ret = NULL;
-+
-+	if (!len || len > PAGE_SIZE)
-+		goto out;
-+
-+	ret = kmalloc(len, GFP_KERNEL);
-+
-+	if (ret) {
-+		if (alloc_push(ret)) {
-+			kfree(ret);
-+			ret = NULL;
-+		}
-+	}
-+
-+out:
-+	return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+	if (!len || (num > (PAGE_SIZE / len)))
-+		return NULL;
-+
-+	return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+	if (gr_acl_is_enabled() || !alloc_stack)
-+		return;
-+
-+	while (alloc_pop()) ;
-+
-+	if (alloc_stack) {
-+		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+			kfree(alloc_stack);
-+		else
-+			vfree(alloc_stack);
-+	}
-+
-+	alloc_stack = NULL;
-+	alloc_stack_size = 1;
-+	alloc_stack_next = 1;
-+
-+	return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+	if ((size * sizeof (void *)) <= PAGE_SIZE)
-+		alloc_stack =
-+		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+	else
-+		alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+	alloc_stack_size = size;
-+
-+	if (!alloc_stack)
-+		return 0;
-+	else
-+		return 1;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/gracl.c linux-2.6.32.11/grsecurity/gracl.c
---- linux-2.6.32.11/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl.c	2010-04-06 22:16:21.600343588 -0400
-@@ -0,0 +1,3924 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+   can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DECLARE_MUTEX(gr_dev_sem);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+			    const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+extern struct vfsmount *sock_mnt;
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+	return (gr_status & GR_READY);
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+	switch (current->role->roletype &
-+		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+		 GR_ROLE_SPECIAL)) {
-+	case GR_ROLE_DEFAULT:
-+		return 'D';
-+	case GR_ROLE_USER:
-+		return 'U';
-+	case GR_ROLE_GROUP:
-+		return 'G';
-+	case GR_ROLE_SPECIAL:
-+		return 'S';
-+	}
-+
-+	return 'X';
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+	if (current->role->roletype & GR_ROLE_TPE)
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (inode && S_ISBLK(inode->i_mode) &&
-+	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+	    !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+	int i;
-+	unsigned long *l1;
-+	unsigned long *l2;
-+	unsigned char *c1;
-+	unsigned char *c2;
-+	int num_longs;
-+
-+	if (likely(lena != lenb))
-+		return 0;
-+
-+	l1 = (unsigned long *)a;
-+	l2 = (unsigned long *)b;
-+
-+	num_longs = lena / sizeof(unsigned long);
-+
-+	for (i = num_longs; i--; l1++, l2++) {
-+		if (unlikely(*l1 != *l2))
-+			return 0;
-+	}
-+
-+	c1 = (unsigned char *) l1;
-+	c2 = (unsigned char *) l2;
-+
-+	i = lena - (num_longs * sizeof(unsigned long));	
-+
-+	for (; i--; c1++, c2++) {
-+		if (unlikely(*c1 != *c2))
-+			return 0;
-+	}
-+
-+	return 1;
-+}
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+	                   struct dentry *root, struct vfsmount *rootmnt,
-+			   char *buffer, int buflen)
-+{
-+	char * end = buffer+buflen;
-+	char * retval;
-+	int namelen;
-+
-+	*--end = '\0';
-+	buflen--;
-+
-+	if (buflen < 1)
-+		goto Elong;
-+	/* Get '/' right */
-+	retval = end-1;
-+	*retval = '/';
-+
-+	for (;;) {
-+		struct dentry * parent;
-+
-+		if (dentry == root && vfsmnt == rootmnt)
-+			break;
-+		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+			/* Global root? */
-+			spin_lock(&vfsmount_lock);
-+			if (vfsmnt->mnt_parent == vfsmnt) {
-+				spin_unlock(&vfsmount_lock);
-+				goto global_root;
-+			}
-+			dentry = vfsmnt->mnt_mountpoint;
-+			vfsmnt = vfsmnt->mnt_parent;
-+			spin_unlock(&vfsmount_lock);
-+			continue;
-+		}
-+		parent = dentry->d_parent;
-+		prefetch(parent);
-+		namelen = dentry->d_name.len;
-+		buflen -= namelen + 1;
-+		if (buflen < 0)
-+			goto Elong;
-+		end -= namelen;
-+		memcpy(end, dentry->d_name.name, namelen);
-+		*--end = '/';
-+		retval = end;
-+		dentry = parent;
-+	}
-+
-+	return retval;
-+
-+global_root:
-+	namelen = dentry->d_name.len;
-+	buflen -= namelen;
-+	if (buflen < 0)
-+		goto Elong;
-+	retval -= namelen-1;	/* hit the slash */
-+	memcpy(retval, dentry->d_name.name, namelen);
-+	return retval;
-+Elong:
-+	return ERR_PTR(-ENAMETOOLONG);
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+	char *retval;
-+
-+	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+	if (unlikely(IS_ERR(retval)))
-+		retval = strcpy(buf, "<path too long>");
-+	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+		retval[1] = '\0';
-+
-+	return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+		char *buf, int buflen)
-+{
-+	char *res;
-+
-+	/* we can use real_root, real_root_mnt, because this is only called
-+	   by the RBAC system */
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+	return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+	    char *buf, int buflen)
-+{
-+	char *res;
-+	struct dentry *root;
-+	struct vfsmount *rootmnt;
-+	struct task_struct *reaper = &init_task;
-+
-+	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+	read_lock(&reaper->fs->lock);
-+	root = dget(reaper->fs->root.dentry);
-+	rootmnt = mntget(reaper->fs->root.mnt);
-+	read_unlock(&reaper->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+	spin_unlock(&dcache_lock);
-+
-+	dput(root);
-+	mntput(rootmnt);
-+	return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	char *ret;
-+	spin_lock(&dcache_lock);
-+	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+	spin_unlock(&dcache_lock);
-+	return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+	/* masks off auditable permission flags, then shifts them to create
-+	   auditing flags, and adds the special case of append auditing if
-+	   we're requesting write */
-+	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+	unsigned int index = shash(userp, subj_map_set.s_size);
-+	struct subject_map *match;
-+
-+	match = subj_map_set.s_hash[index];
-+
-+	while (match && match->user != userp)
-+		match = match->next;
-+
-+	if (match != NULL)
-+		return match->kernel;
-+	else
-+		return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
-+	struct subject_map **curr;
-+
-+	subjmap->prev = NULL;
-+
-+	curr = &subj_map_set.s_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = subjmap;
-+
-+	subjmap->next = *curr;
-+	*curr = subjmap;
-+
-+	return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+		      const gid_t gid)
-+{
-+	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+	struct acl_role_label *match;
-+	struct role_allowed_ip *ipp;
-+	unsigned int x;
-+
-+	match = acl_role_set.r_hash[index];
-+
-+	while (match) {
-+		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+			for (x = 0; x < match->domain_child_num; x++) {
-+				if (match->domain_children[x] == uid)
-+					goto found;
-+			}
-+		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+			break;
-+		match = match->next;
-+	}
-+found:
-+	if (match == NULL) {
-+	      try_group:
-+		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+		match = acl_role_set.r_hash[index];
-+
-+		while (match) {
-+			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+				for (x = 0; x < match->domain_child_num; x++) {
-+					if (match->domain_children[x] == gid)
-+						goto found2;
-+				}
-+			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+				break;
-+			match = match->next;
-+		}
-+found2:
-+		if (match == NULL)
-+			match = default_role;
-+		if (match->allowed_ips == NULL)
-+			return match;
-+		else {
-+			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+				if (likely
-+				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+				     (ntohl(ipp->addr) & ipp->netmask)))
-+					return match;
-+			}
-+			match = default_role;
-+		}
-+	} else if (match->allowed_ips == NULL) {
-+		return match;
-+	} else {
-+		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+			if (likely
-+			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+			     (ntohl(ipp->addr) & ipp->netmask)))
-+				return match;
-+		}
-+		goto try_group;
-+	}
-+
-+	return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+		      const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+			  const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 !match->deleted))
-+		match = match->next;
-+
-+	if (match && match->deleted)
-+		return match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 match->deleted))
-+		match = match->next;
-+
-+	if (match && !match->deleted)
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+	unsigned int index = fhash(ino, dev, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
-+				    inodev_set.i_size);
-+	struct inodev_entry **curr;
-+
-+	entry->prev = NULL;
-+
-+	curr = &inodev_set.i_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = entry;
-+	
-+	entry->next = *curr;
-+	*curr = entry;
-+
-+	return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+	unsigned int index =
-+	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+	struct acl_role_label **curr;
-+	struct acl_role_label *tmp;
-+
-+	curr = &acl_role_set.r_hash[index];
-+
-+	/* if role was already inserted due to domains and already has
-+	   a role in the same bucket as it attached, then we need to
-+	   combine these two buckets
-+	*/
-+	if (role->next) {
-+		tmp = role->next;
-+		while (tmp->next)
-+			tmp = tmp->next;
-+		tmp->next = *curr;
-+	} else
-+		role->next = *curr;
-+	*curr = role;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+	int i;
-+
-+	if (role_list == NULL) {
-+		role_list = role;
-+		role->prev = NULL;
-+	} else {
-+		role->prev = role_list;
-+		role_list = role;
-+	}
-+	
-+	/* used for hash chains */
-+	role->next = NULL;
-+
-+	if (role->roletype & GR_ROLE_DOMAIN) {
-+		for (i = 0; i < role->domain_child_num; i++)
-+			__insert_acl_role_label(role, role->domain_children[i]);
-+	} else
-+		__insert_acl_role_label(role, role->uidgid);
-+}
-+					
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+	struct name_entry **curr, *nentry;
-+	struct inodev_entry *ientry;
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+
-+	curr = &name_set.n_hash[index];
-+
-+	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+		curr = &((*curr)->next);
-+
-+	if (*curr != NULL)
-+		return 1;
-+
-+	nentry = acl_alloc(sizeof (struct name_entry));
-+	if (nentry == NULL)
-+		return 0;
-+	ientry = acl_alloc(sizeof (struct inodev_entry));
-+	if (ientry == NULL)
-+		return 0;
-+	ientry->nentry = nentry;
-+
-+	nentry->key = key;
-+	nentry->name = name;
-+	nentry->inode = inode;
-+	nentry->device = device;
-+	nentry->len = len;
-+	nentry->deleted = deleted;
-+
-+	nentry->prev = NULL;
-+	curr = &name_set.n_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = nentry;
-+	nentry->next = *curr;
-+	*curr = nentry;
-+
-+	/* insert us into the table searchable by inode/dev */
-+	insert_inodev_entry(ientry);
-+
-+	return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index =
-+	    fhash(obj->inode, obj->device, subj->obj_hash_size);
-+	struct acl_object_label **curr;
-+
-+	
-+	obj->prev = NULL;
-+
-+	curr = &subj->obj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
-+	struct acl_subject_label **curr;
-+
-+	obj->prev = NULL;
-+
-+	curr = &role->subj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+	unsigned int table_sizes[] = {
-+		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+		4194301, 8388593, 16777213, 33554393, 67108859
-+	};
-+	void *newtable = NULL;
-+	unsigned int pwr = 0;
-+
-+	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+	       table_sizes[pwr] <= *len)
-+		pwr++;
-+
-+	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+		return newtable;
-+
-+	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+		newtable =
-+		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+	else
-+		newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+	*len = table_sizes[pwr];
-+
-+	return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+	struct task_struct *reaper = &init_task;
-+	unsigned int stacksize;
-+
-+	subj_map_set.s_size = arg->role_db.num_subjects;
-+	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+	name_set.n_size = arg->role_db.num_objects;
-+	inodev_set.i_size = arg->role_db.num_objects;
-+
-+	if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+	    !name_set.n_size || !inodev_set.i_size)
-+		return 1;
-+
-+	if (!gr_init_uidset())
-+		return 1;
-+
-+	/* set up the stack that holds allocation info */
-+
-+	stacksize = arg->role_db.num_pointers + 5;
-+
-+	if (!acl_alloc_stack_init(stacksize))
-+		return 1;
-+
-+	/* grab reference for the real root dentry and vfsmount */
-+	read_lock(&reaper->fs->lock);
-+	real_root_mnt = mntget(reaper->fs->root.mnt);
-+	real_root = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+	
-+	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
-+	if (fakefs_obj == NULL)
-+		return 1;
-+	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+	subj_map_set.s_hash =
-+	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+	acl_role_set.r_hash =
-+	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+	inodev_set.i_hash =
-+	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+	    !name_set.n_hash || !inodev_set.i_hash)
-+		return 1;
-+
-+	memset(subj_map_set.s_hash, 0,
-+	       sizeof(struct subject_map *) * subj_map_set.s_size);
-+	memset(acl_role_set.r_hash, 0,
-+	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+	memset(name_set.n_hash, 0,
-+	       sizeof (struct name_entry *) * name_set.n_size);
-+	memset(inodev_set.i_hash, 0,
-+	       sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+	return 0;
-+}
-+
-+/* free information not needed after startup
-+   currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+	__u32 i;
-+
-+	if (subj_map_set.s_hash) {
-+		for (i = 0; i < subj_map_set.s_size; i++) {
-+			if (subj_map_set.s_hash[i]) {
-+				kfree(subj_map_set.s_hash[i]);
-+				subj_map_set.s_hash[i] = NULL;
-+			}
-+		}
-+
-+		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+		    PAGE_SIZE)
-+			kfree(subj_map_set.s_hash);
-+		else
-+			vfree(subj_map_set.s_hash);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+	struct acl_subject_label *s;
-+	struct acl_role_label *r;
-+	struct task_struct *task, *task2;
-+	unsigned int x;
-+
-+	gr_clear_learn_entries();
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(task2, task) {
-+		task->acl_sp_role = 0;
-+		task->acl_role_id = 0;
-+		task->acl = NULL;
-+		task->role = NULL;
-+	} while_each_thread(task2, task);
-+	read_unlock(&tasklist_lock);
-+
-+	/* release the reference to the real root dentry and vfsmount */
-+	if (real_root)
-+		dput(real_root);
-+	real_root = NULL;
-+	if (real_root_mnt)
-+		mntput(real_root_mnt);
-+	real_root_mnt = NULL;
-+
-+	/* free all object hash tables */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (r->subj_hash == NULL)
-+			goto next_role;
-+		FOR_EACH_SUBJECT_START(r, s, x)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_SUBJECT_END(s, x)
-+		FOR_EACH_NESTED_SUBJECT_START(r, s)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_NESTED_SUBJECT_END(s)
-+		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+			kfree(r->subj_hash);
-+		else
-+			vfree(r->subj_hash);
-+		r->subj_hash = NULL;
-+next_role:
-+	FOR_EACH_ROLE_END(r)
-+
-+	acl_free_all();
-+
-+	if (acl_role_set.r_hash) {
-+		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+		    PAGE_SIZE)
-+			kfree(acl_role_set.r_hash);
-+		else
-+			vfree(acl_role_set.r_hash);
-+	}
-+	if (name_set.n_hash) {
-+		if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(name_set.n_hash);
-+		else
-+			vfree(name_set.n_hash);
-+	}
-+
-+	if (inodev_set.i_hash) {
-+		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(inodev_set.i_hash);
-+		else
-+			vfree(inodev_set.i_hash);
-+	}
-+
-+	gr_free_uidset();
-+
-+	memset(&name_set, 0, sizeof (struct name_db));
-+	memset(&inodev_set, 0, sizeof (struct inodev_db));
-+	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+	default_role = NULL;
-+	role_list = NULL;
-+
-+	return;
-+}
-+
-+static __u32
-+count_user_objs(struct acl_object_label *userp)
-+{
-+	struct acl_object_label o_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			break;
-+
-+		userp = o_tmp.prev;
-+		num++;
-+	}
-+
-+	return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+	struct acl_object_label *g_tmp, **guser;
-+	unsigned int len;
-+	char *tmp;
-+
-+	if (obj->globbed == NULL)
-+		return 0;
-+
-+	guser = &obj->globbed;
-+	while (*guser) {
-+		g_tmp = (struct acl_object_label *)
-+			acl_alloc(sizeof (struct acl_object_label));
-+		if (g_tmp == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(g_tmp, *guser,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		len = strnlen_user(g_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, g_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		g_tmp->filename = tmp;
-+
-+		*guser = g_tmp;
-+		guser = &(g_tmp->next);
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+	       struct acl_role_label *role)
-+{
-+	struct acl_object_label *o_tmp;
-+	unsigned int len;
-+	int ret;
-+	char *tmp;
-+
-+	while (userp) {
-+		if ((o_tmp = (struct acl_object_label *)
-+		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		userp = o_tmp->prev;
-+
-+		len = strnlen_user(o_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, o_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		o_tmp->filename = tmp;
-+
-+		insert_acl_obj_label(o_tmp, subj);
-+		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+			return -ENOMEM;
-+
-+		ret = copy_user_glob(o_tmp);
-+		if (ret)
-+			return ret;
-+
-+		if (o_tmp->nested) {
-+			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
-+			if (IS_ERR(o_tmp->nested))
-+				return PTR_ERR(o_tmp->nested);
-+
-+			/* insert into nested subject list */
-+			o_tmp->nested->next = role->hash->first;
-+			role->hash->first = o_tmp->nested;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+	struct acl_subject_label s_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_tmp, userp,
-+				   sizeof (struct acl_subject_label)))
-+			break;
-+
-+		userp = s_tmp.prev;
-+		/* do not count nested subjects against this count, since
-+		   they are not included in the hash table, but are
-+		   attached to objects.  We have already counted
-+		   the subjects in userspace for the allocation 
-+		   stack
-+		*/
-+		if (!(s_tmp.mode & GR_NESTED))
-+			num++;
-+	}
-+
-+	return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+	ruserip = rolep->allowed_ips;
-+
-+	while (ruserip) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_allowed_ip *)
-+		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, ruserip,
-+				   sizeof (struct role_allowed_ip)))
-+			return -EFAULT;
-+
-+		ruserip = rtmp->prev;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->allowed_ips = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!ruserip)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+	struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+	
-+	unsigned int len;
-+	char *tmp;
-+
-+	rusertp = rolep->transitions;
-+
-+	while (rusertp) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_transition *)
-+		     acl_alloc(sizeof (struct role_transition))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, rusertp,
-+				   sizeof (struct role_transition)))
-+			return -EFAULT;
-+
-+		rusertp = rtmp->prev;
-+
-+		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, rtmp->rolename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		rtmp->rolename = tmp;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->transitions = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!rusertp)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+	unsigned int len;
-+	char *tmp;
-+	__u32 num_objs;
-+	struct acl_ip_label **i_tmp, *i_utmp2;
-+	struct gr_hash_struct ghash;
-+	struct subject_map *subjmap;
-+	unsigned int i_num;
-+	int err;
-+
-+	s_tmp = lookup_subject_map(userp);
-+
-+	/* we've already copied this subject into the kernel, just return
-+	   the reference to it, and don't copy it over again
-+	*/
-+	if (s_tmp)
-+		return(s_tmp);
-+
-+	if ((s_tmp = (struct acl_subject_label *)
-+	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+	if (subjmap == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap->user = userp;
-+	subjmap->kernel = s_tmp;
-+	insert_subj_map_entry(subjmap);
-+
-+	if (copy_from_user(s_tmp, userp,
-+			   sizeof (struct acl_subject_label)))
-+		return ERR_PTR(-EFAULT);
-+
-+	len = strnlen_user(s_tmp->filename, PATH_MAX);
-+
-+	if (!len || len >= PATH_MAX)
-+		return ERR_PTR(-EINVAL);
-+
-+	if ((tmp = (char *) acl_alloc(len)) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	if (copy_from_user(tmp, s_tmp->filename, len))
-+		return ERR_PTR(-EFAULT);
-+	tmp[len-1] = '\0';
-+	s_tmp->filename = tmp;
-+
-+	if (!strcmp(s_tmp->filename, "/"))
-+		role->root_label = s_tmp;
-+
-+	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
-+		return ERR_PTR(-EFAULT);
-+
-+	/* copy user and group transition tables */
-+
-+	if (s_tmp->user_trans_num) {
-+		uid_t *uidlist;
-+
-+		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+		if (uidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->user_transitions = uidlist;
-+	}
-+
-+	if (s_tmp->group_trans_num) {
-+		gid_t *gidlist;
-+
-+		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+		if (gidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->group_transitions = gidlist;
-+	}
-+
-+	/* set up object hash table */
-+	num_objs = count_user_objs(ghash.first);
-+
-+	s_tmp->obj_hash_size = num_objs;
-+	s_tmp->obj_hash =
-+	    (struct acl_object_label **)
-+	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+	if (!s_tmp->obj_hash)
-+		return ERR_PTR(-ENOMEM);
-+
-+	memset(s_tmp->obj_hash, 0,
-+	       s_tmp->obj_hash_size *
-+	       sizeof (struct acl_object_label *));
-+
-+	/* add in objects */
-+	err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+	if (err)
-+		return ERR_PTR(err);
-+
-+	/* set pointer for parent subject */
-+	if (s_tmp->parent_subject) {
-+		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
-+
-+		if (IS_ERR(s_tmp2))
-+			return s_tmp2;
-+
-+		s_tmp->parent_subject = s_tmp2;
-+	}
-+
-+	/* add in ip acls */
-+
-+	if (!s_tmp->ip_num) {
-+		s_tmp->ips = NULL;
-+		goto insert;
-+	}
-+
-+	i_tmp =
-+	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+					       sizeof (struct acl_ip_label *));
-+
-+	if (!i_tmp)
-+		return ERR_PTR(-ENOMEM);
-+
-+	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+		*(i_tmp + i_num) =
-+		    (struct acl_ip_label *)
-+		    acl_alloc(sizeof (struct acl_ip_label));
-+		if (!*(i_tmp + i_num))
-+			return ERR_PTR(-ENOMEM);
-+
-+		if (copy_from_user
-+		    (&i_utmp2, s_tmp->ips + i_num,
-+		     sizeof (struct acl_ip_label *)))
-+			return ERR_PTR(-EFAULT);
-+
-+		if (copy_from_user
-+		    (*(i_tmp + i_num), i_utmp2,
-+		     sizeof (struct acl_ip_label)))
-+			return ERR_PTR(-EFAULT);
-+		
-+		if ((*(i_tmp + i_num))->iface == NULL)
-+			continue;
-+
-+		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
-+		if (!len || len >= IFNAMSIZ)
-+			return ERR_PTR(-EINVAL);
-+		tmp = acl_alloc(len);
-+		if (tmp == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
-+			return ERR_PTR(-EFAULT);
-+		(*(i_tmp + i_num))->iface = tmp;
-+	}
-+
-+	s_tmp->ips = i_tmp;
-+
-+insert:
-+	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+		return ERR_PTR(-ENOMEM);
-+
-+	return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label s_pre;
-+	struct acl_subject_label * ret;
-+	int err;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_pre, userp,
-+				   sizeof (struct acl_subject_label)))
-+			return -EFAULT;
-+		
-+		/* do not add nested subjects here, add
-+		   while parsing objects
-+		*/
-+
-+		if (s_pre.mode & GR_NESTED) {
-+			userp = s_pre.prev;
-+			continue;
-+		}
-+
-+		ret = do_copy_user_subj(userp, role);
-+
-+		err = PTR_ERR(ret);
-+		if (IS_ERR(ret))
-+			return err;
-+
-+		insert_acl_subj_label(ret, role);
-+
-+		userp = s_pre.prev;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+	struct sprole_pw *sptmp;
-+	struct gr_hash_struct *ghash;
-+	uid_t *domainlist;
-+	unsigned int r_num;
-+	unsigned int len;
-+	char *tmp;
-+	int err = 0;
-+	__u16 i;
-+	__u32 num_subjs;
-+
-+	/* we need a default and kernel role */
-+	if (arg->role_db.num_roles < 2)
-+		return -EINVAL;
-+
-+	/* copy special role authentication info from userspace */
-+
-+	num_sprole_pws = arg->num_sprole_pws;
-+	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+	if (!acl_special_roles) {
-+		err = -ENOMEM;
-+		goto cleanup;
-+	}
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+		if (!sptmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(sptmp, arg->sprole_pws + i,
-+				   sizeof (struct sprole_pw))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len =
-+		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(tmp, sptmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+		printk(KERN_ALERT "Copying special role %s\n", tmp);
-+#endif
-+		sptmp->rolename = tmp;
-+		acl_special_roles[i] = sptmp;
-+	}
-+
-+	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+		r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+		if (!r_tmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(&r_utmp2, r_utmp + r_num,
-+				   sizeof (struct acl_role_label *))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(r_tmp, r_utmp2,
-+				   sizeof (struct acl_role_label))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= PATH_MAX) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(tmp, r_tmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+		r_tmp->rolename = tmp;
-+
-+		if (!strcmp(r_tmp->rolename, "default")
-+		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+			default_role = r_tmp;
-+		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+			kernel_role = r_tmp;
-+		}
-+
-+		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		r_tmp->hash = ghash;
-+
-+		num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+		r_tmp->subj_hash_size = num_subjs;
-+		r_tmp->subj_hash =
-+		    (struct acl_subject_label **)
-+		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+		if (!r_tmp->subj_hash) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		err = copy_user_allowedips(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		/* copy domain info */
-+		if (r_tmp->domain_children != NULL) {
-+			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+			if (domainlist == NULL) {
-+				err = -ENOMEM;
-+				goto cleanup;
-+			}
-+			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
-+				err = -EFAULT;
-+				goto cleanup;
-+			}
-+			r_tmp->domain_children = domainlist;
-+		}
-+
-+		err = copy_user_transitions(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		memset(r_tmp->subj_hash, 0,
-+		       r_tmp->subj_hash_size *
-+		       sizeof (struct acl_subject_label *));
-+
-+		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
-+
-+		if (err)
-+			goto cleanup;
-+
-+		/* set nested subject list to null */
-+		r_tmp->hash->first = NULL;
-+
-+		insert_acl_role_label(r_tmp);
-+	}
-+
-+	goto return_err;
-+      cleanup:
-+	free_variables();
-+      return_err:
-+	return err;
-+
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+	int error = 0;
-+
-+	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+	if (init_variables(args)) {
-+		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+		error = -ENOMEM;
-+		free_variables();
-+		goto out;
-+	}
-+
-+	error = copy_user_acl(args);
-+	free_init_variables();
-+	if (error) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	if ((error = gr_set_acls(0))) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	pax_open_kernel();
-+	gr_status |= GR_READY;
-+	pax_close_kernel();
-+
-+      out:
-+	return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+	char c;
-+
-+	while ((c = *p++) != '\0') {
-+	switch (c) {
-+		case '?':
-+			if (*n == '\0')
-+				return 1;
-+			else if (*n == '/')
-+				return 1;
-+			break;
-+		case '\\':
-+			if (*n != c)
-+				return 1;
-+			break;
-+		case '*':
-+			for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+				if (*n == '/')
-+					return 1;
-+				else if (c == '?') {
-+					if (*n == '\0')
-+						return 1;
-+					else
-+						++n;
-+				}
-+			}
-+			if (c == '\0') {
-+				return 0;
-+			} else {
-+				const char *endp;
-+
-+				if ((endp = strchr(n, '/')) == NULL)
-+					endp = n + strlen(n);
-+
-+				if (c == '[') {
-+					for (--p; n < endp; ++n)
-+						if (!glob_match(p, n))
-+							return 0;
-+				} else if (c == '/') {
-+					while (*n != '\0' && *n != '/')
-+						++n;
-+					if (*n == '/' && !glob_match(p, n + 1))
-+						return 0;
-+				} else {
-+					for (--p; n < endp; ++n)
-+						if (*n == c && !glob_match(p, n))
-+							return 0;
-+				}
-+
-+				return 1;
-+			}
-+		case '[':
-+			{
-+			int not;
-+			char cold;
-+
-+			if (*n == '\0' || *n == '/')
-+				return 1;
-+
-+			not = (*p == '!' || *p == '^');
-+			if (not)
-+				++p;
-+
-+			c = *p++;
-+			for (;;) {
-+				unsigned char fn = (unsigned char)*n;
-+
-+				if (c == '\0')
-+					return 1;
-+				else {
-+					if (c == fn)
-+						goto matched;
-+					cold = c;
-+					c = *p++;
-+
-+					if (c == '-' && *p != ']') {
-+						unsigned char cend = *p++;
-+
-+						if (cend == '\0')
-+							return 1;
-+
-+						if (cold <= fn && fn <= cend)
-+							goto matched;
-+
-+						c = *p++;
-+					}
-+				}
-+
-+				if (c == ']')
-+					break;
-+			}
-+			if (!not)
-+				return 1;
-+			break;
-+		matched:
-+			while (c != ']') {
-+				if (c == '\0')
-+					return 1;
-+
-+				c = *p++;
-+			}
-+			if (not)
-+				return 1;
-+		}
-+		break;
-+	default:
-+		if (c != *n)
-+			return 1;
-+	}
-+
-+	++n;
-+	}
-+
-+	if (*n == '\0')
-+		return 0;
-+
-+	if (*n == '/')
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+	struct dentry *dentry, struct vfsmount *mnt, char **path)
-+{
-+	struct acl_object_label *tmp;
-+
-+	if (*path == NULL)
-+		*path = gr_to_filename_nolock(dentry, mnt);
-+
-+	tmp = globbed;
-+
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, *path))
-+			return tmp;
-+		tmp = tmp->next;
-+	}
-+
-+	return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const ino_t curr_ino, const dev_t curr_dev,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	struct acl_subject_label *tmpsubj;
-+	struct acl_object_label *retval;
-+	struct acl_object_label *retval2;
-+
-+	tmpsubj = (struct acl_subject_label *) subj;
-+	read_lock(&gr_inode_lock);
-+	do {
-+		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+		if (retval) {
-+			if (checkglob && retval->globbed) {
-+				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
-+						(struct vfsmount *)orig_mnt, path);
-+				if (retval2)
-+					retval = retval2;
-+			}
-+			break;
-+		}
-+	} while ((tmpsubj = tmpsubj->parent_subject));
-+	read_unlock(&gr_inode_lock);
-+
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const struct dentry *curr_dentry,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	return __full_lookup(orig_dentry, orig_mnt,
-+			     curr_dentry->d_inode->i_ino, 
-+			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_object_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
-+#ifdef CONFIG_HUGETLBFS
-+	    mnt == hugetlbfs_vfsmount ||
-+#endif
-+		/* ignore Eric Biederman */
-+	    IS_PRIVATE(l_dentry->d_inode))) {
-+		retval = fakefs_obj;
-+		goto out;
-+	}
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+	if (retval == NULL)
-+		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+	spin_unlock(&dcache_lock);
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+		     const struct acl_subject_label *subj, char *path)
-+{
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	       const struct acl_role_label *role)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_subject_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			read_lock(&gr_inode_lock);
-+			retval =
-+				lookup_acl_subj_label(dentry->d_inode->i_ino,
-+						dentry->d_inode->i_sb->s_dev, role);
-+			read_unlock(&gr_inode_lock);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+					  dentry->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	read_lock(&gr_inode_lock);
-+	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+				  dentry->d_inode->i_sb->s_dev, role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (unlikely(retval == NULL)) {
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+					  real_root->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+	}
-+out:
-+	spin_unlock(&dcache_lock);
-+
-+	return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real, 
-+		       const unsigned int effective, const unsigned int fs)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       type, real, effective, fs, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+	      const struct dentry * parent_dentry,
-+	      const struct vfsmount * parent_mnt,
-+	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+	struct acl_object_label *obj;
-+	__u32 oldmode, newmode;
-+	__u32 needmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (GR_CREATE | GR_LINK);
-+
-+	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+	oldmode = obj->mode;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		oldmode |= (GR_CREATE | GR_LINK);
-+
-+	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID | GR_AUDIT_SETID;
-+
-+	newmode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    oldmode | needmode);
-+
-+	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
-+			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
-+			      GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
-+		goto bad;
-+
-+	if ((oldmode & needmode) != needmode)
-+		goto bad;
-+
-+	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+	if ((newmode & needmode) != needmode)
-+		goto bad;
-+
-+	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+		return newmode;
-+bad:
-+	needmode = oldmode;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID;
-+	
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		gr_log_learn(old_dentry, old_mnt, needmode);
-+		return (GR_CREATE | GR_LINK);
-+	} else if (newmode & GR_SUPPRESS)
-+		return GR_SUPPRESS;
-+	else
-+		return 0;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+	       const struct vfsmount * mnt)
-+{
-+	__u32 retval = mode;
-+	struct acl_subject_label *curracl;
-+	struct acl_object_label *currobj;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	curracl = current->acl;
-+
-+	currobj = chk_obj_label(dentry, mnt, curracl);
-+	retval = currobj->mode & mode;
-+
-+	if (unlikely
-+	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		retval = new_mode;
-+
-+		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+			new_mode |= GR_INHERIT;
-+
-+		if (!(mode & GR_NOLEARN))
-+			gr_log_learn(dentry, mnt, new_mode);
-+	}
-+
-+	return retval;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+		const struct vfsmount * mnt, const __u32 mode)
-+{
-+	struct name_entry *match;
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *curracl;
-+	char *path;
-+	__u32 retval;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	preempt_disable();
-+	path = gr_to_filename_rbac(new_dentry, mnt);
-+	match = lookup_name_entry_create(path);
-+
-+	if (!match)
-+		goto check_parent;
-+
-+	curracl = current->acl;
-+
-+	read_lock(&gr_inode_lock);
-+	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (matchpo) {
-+		if ((matchpo->mode & mode) !=
-+		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
-+		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+			__u32 new_mode = mode;
-+
-+			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+			gr_log_learn(new_dentry, mnt, new_mode);
-+
-+			preempt_enable();
-+			return new_mode;
-+		}
-+		preempt_enable();
-+		return (matchpo->mode & mode);
-+	}
-+
-+      check_parent:
-+	curracl = current->acl;
-+
-+	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+	retval = matchpo->mode & mode;
-+
-+	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		gr_log_learn(new_dentry, mnt, new_mode);
-+		preempt_enable();
-+		return new_mode;
-+	}
-+
-+	preempt_enable();
-+	return retval;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY) || !task))
-+		return 0;
-+
-+	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+	    task->acl != current->acl)
-+		return 1;
-+
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	tsk->signal->used_accept = 0;
-+	tsk->acl_sp_role = 0;
-+	tsk->acl_role_id = current->acl_role_id;
-+	tsk->acl = current->acl;
-+	tsk->role = current->role;
-+	tsk->signal->curr_ip = current->signal->curr_ip;
-+	if (current->exec_file)
-+		get_file(current->exec_file);
-+	tsk->exec_file = current->exec_file;
-+	tsk->is_writable = current->is_writable;
-+	if (unlikely(current->signal->used_accept))
-+		current->signal->curr_ip = 0;
-+
-+	return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+	struct acl_subject_label *proc;
-+	unsigned short i;
-+
-+	proc = task->acl;
-+
-+	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return;
-+
-+	for (i = 0; i < RLIM_NLIMITS; i++) {
-+		if (!(proc->resmask & (1 << i)))
-+			continue;
-+
-+		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	uid_t *uidlist;
-+	int curuid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('u', real, effective, fs);
-+
-+	num = current->acl->user_trans_num;
-+	uidlist = current->acl->user_transitions;
-+
-+	if (uidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				realok = 1;
-+			if (effective == curuid)
-+				effectiveok = 1;
-+			if (fs == curuid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->user_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				break;
-+			if (effective == curuid)
-+				break;
-+			if (fs == curuid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	gid_t *gidlist;
-+	int curgid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('g', real, effective, fs);
-+
-+	num = current->acl->group_trans_num;
-+	gidlist = current->acl->group_transitions;
-+
-+	if (gidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				realok = 1;
-+			if (effective == curgid)
-+				effectiveok = 1;
-+			if (fs == curgid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->group_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				break;
-+			if (effective == curgid)
-+				break;
-+			if (fs == curgid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+	struct acl_role_label *role = task->role;
-+	struct acl_subject_label *subj = NULL;
-+	struct acl_object_label *obj;
-+	struct file *filp;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	filp = task->exec_file;
-+
-+	/* kernel process, we'll give them the kernel role */
-+	if (unlikely(!filp)) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+		return;
-+	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+		role = lookup_acl_role_label(task, uid, gid);
-+
-+	/* perform subject lookup in possibly new role
-+	   we can use this result below in the case where role == task->role
-+	*/
-+	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+	/* if we changed uid/gid, but result in the same role
-+	   and are using inheritance, don't lose the inherited subject
-+	   if current subject is other than what normal lookup
-+	   would result in, we arrived via inheritance, don't
-+	   lose subject
-+	*/
-+	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+				   (subj == task->acl)))
-+		task->acl = subj;
-+
-+	task->role = role;
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+	gr_set_proc_res(task);
-+
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	struct task_struct *task = current;
-+	struct acl_subject_label *newacl;
-+	struct acl_object_label *obj;
-+	__u32 retmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+	task_lock(task);
-+	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
-+	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+	     !(task->role->roletype & GR_ROLE_GOD) &&
-+	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
-+                task_unlock(task);
-+		if (unsafe_share)
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+		else
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+		return -EACCES;
-+	}
-+	task_unlock(task);
-+
-+	obj = chk_obj_label(dentry, mnt, task->acl);
-+	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (!(task->acl->mode & GR_INHERITLEARN) &&
-+	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+		if (obj->nested)
-+			task->acl = obj->nested;
-+		else
-+			task->acl = newacl;
-+	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+	gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+	return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *matchps;
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+
-+	FOR_EACH_ROLE_START(role)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+				matchpo->mode |= GR_DELETED;
-+		FOR_EACH_SUBJECT_END(subj,x)
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if (subj->inode == ino && subj->device == dev)
-+				subj->mode |= GR_DELETED;
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+			matchps->mode |= GR_DELETED;
-+	FOR_EACH_ROLE_END(role)
-+
-+	inodev->nentry->deleted = 1;
-+
-+	return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	struct inodev_entry *inodev;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	write_lock(&gr_inode_lock);
-+	inodev = lookup_inodev_entry(ino, dev);
-+	if (inodev != NULL)
-+		do_handle_delete(inodev, ino, dev);
-+	write_unlock(&gr_inode_lock);
-+
-+	return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+		     const ino_t newinode, const dev_t newdevice,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			subj->obj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_obj_label(match, subj);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+		      const ino_t newinode, const dev_t newdevice,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			role->subj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_subj_label(match, role);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+		    const ino_t newinode, const dev_t newdevice)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != oldinode ||
-+	       match->nentry->device != olddevice || !match->nentry->deleted))
-+		match = match->next;
-+
-+	if (match && (match->nentry->inode == oldinode)
-+	    && (match->nentry->device == olddevice) &&
-+	    match->nentry->deleted) {
-+		if (match->prev == NULL) {
-+			inodev_set.i_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->nentry->inode = newinode;
-+		match->nentry->device = newdevice;
-+		match->nentry->deleted = 0;
-+
-+		insert_inodev_entry(match);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+		 const struct vfsmount *mnt)
-+{
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+	
-+	FOR_EACH_ROLE_START(role)
-+		update_acl_subj_label(matchn->inode, matchn->device,
-+				      dentry->d_inode->i_ino,
-+				      dentry->d_inode->i_sb->s_dev, role);
-+
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if ((subj->inode == dentry->d_inode->i_ino) &&
-+			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
-+				subj->inode = dentry->d_inode->i_ino;
-+				subj->device = dentry->d_inode->i_sb->s_dev;
-+			}
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			update_acl_obj_label(matchn->inode, matchn->device,
-+					     dentry->d_inode->i_ino,
-+					     dentry->d_inode->i_sb->s_dev, subj);
-+		FOR_EACH_SUBJECT_END(subj,x)
-+	FOR_EACH_ROLE_END(role)
-+
-+	update_inodev_entry(matchn->inode, matchn->device,
-+			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
-+
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	struct name_entry *matchn;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+	if (unlikely((unsigned long)matchn)) {
-+		write_lock(&gr_inode_lock);
-+		do_handle_create(matchn, dentry, mnt);
-+		write_unlock(&gr_inode_lock);
-+	}
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	struct name_entry *matchn;
-+	struct inodev_entry *inodev;
-+
-+	/* vfs_rename swaps the name and parent link for old_dentry and
-+	   new_dentry
-+	   at this point, old_dentry has the new name, parent link, and inode
-+	   for the renamed file
-+	   if a file is being replaced by a rename, new_dentry has the inode
-+	   and name for the replaced file
-+	*/
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+	/* we wouldn't have to check d_inode if it weren't for
-+	   NFS silly-renaming
-+	 */
-+
-+	write_lock(&gr_inode_lock);
-+	if (unlikely(replace && new_dentry->d_inode)) {
-+		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
-+					     new_dentry->d_inode->i_sb->s_dev);
-+		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
-+			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
-+					 new_dentry->d_inode->i_sb->s_dev);
-+	}
-+
-+	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
-+				     old_dentry->d_inode->i_sb->s_dev);
-+	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
-+		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
-+				 old_dentry->d_inode->i_sb->s_dev);
-+
-+	if (unlikely((unsigned long)matchn))
-+		do_handle_create(matchn, old_dentry, mnt);
-+
-+	write_unlock(&gr_inode_lock);
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+			 unsigned char **sum)
-+{
-+	struct acl_role_label *r;
-+	struct role_allowed_ip *ipp;
-+	struct role_transition *trans;
-+	unsigned int i;
-+	int found = 0;
-+
-+	/* check transition table */
-+
-+	for (trans = current->role->transitions; trans; trans = trans->next) {
-+		if (!strcmp(rolename, trans->rolename)) {
-+			found = 1;
-+			break;
-+		}
-+	}
-+
-+	if (!found)
-+		return 0;
-+
-+	/* handle special roles that do not require authentication
-+	   and check ip */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			found = 0;
-+			if (r->allowed_ips != NULL) {
-+				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
-+					     (ntohl(ipp->addr) & ipp->netmask))
-+						found = 1;
-+				}
-+			} else
-+				found = 2;
-+			if (!found)
-+				return 0;
-+
-+			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+				*salt = NULL;
-+				*sum = NULL;
-+				return 1;
-+			}
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+			*salt = acl_special_roles[i]->salt;
-+			*sum = acl_special_roles[i]->sum;
-+			return 1;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+	struct acl_object_label *obj;
-+	struct acl_role_label *r;
-+	struct acl_role_label *assigned = NULL;
-+	struct task_struct *tsk;
-+	struct file *filp;
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			assigned = r;
-+			break;
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	if (!assigned)
-+		return;
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+
-+	tsk = current->parent;
-+	if (tsk == NULL)
-+		goto out_unlock;
-+
-+	filp = tsk->exec_file;
-+	if (filp == NULL)
-+		goto out_unlock;
-+
-+	tsk->is_writable = 0;
-+
-+	tsk->acl_sp_role = 1;
-+	tsk->acl_role_id = ++acl_sp_role_value;
-+	tsk->role = assigned;
-+	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+	struct task_struct *p, *p2, *p3;
-+	struct files_struct *files;
-+	struct fdtable *fdt;
-+	struct file *our_file = NULL, *file;
-+	int i;
-+
-+	if (task->signal->tty == NULL)
-+		return 1;
-+
-+	files = get_files_struct(task);
-+	if (files != NULL) {
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+				get_file(file);
-+				our_file = file;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	}
-+
-+	if (our_file == NULL)
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(p2, p) {
-+		files = get_files_struct(p);
-+		if (files == NULL ||
-+		    (p->signal && p->signal->tty == task->signal->tty)) {
-+			if (files != NULL)
-+				put_files_struct(files);
-+			continue;
-+		}
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+				p3 = task;
-+				while (p3->pid > 0) {
-+					if (p3 == p)
-+						break;
-+					p3 = p3->parent;
-+				}
-+				if (p3 == p)
-+					break;
-+				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+				gr_handle_alertkill(p);
-+				rcu_read_unlock();
-+				put_files_struct(files);
-+				read_unlock(&tasklist_lock);
-+				fput(our_file);
-+				return 0;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	} while_each_thread(p2, p);
-+	read_unlock(&tasklist_lock);
-+
-+	fput(our_file);
-+	return 1;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
-+{
-+	struct gr_arg_wrapper uwrap;
-+	unsigned char *sprole_salt = NULL;
-+	unsigned char *sprole_sum = NULL;
-+	int error = sizeof (struct gr_arg_wrapper);
-+	int error2 = 0;
-+
-+	down(&gr_dev_sem);
-+
-+	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	if (count != sizeof (struct gr_arg_wrapper)) {
-+		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	
-+	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+		gr_auth_expires = 0;
-+		gr_auth_attempts = 0;
-+	}
-+
-+	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+	    time_after(gr_auth_expires, get_seconds())) {
-+		error = -EBUSY;
-+		goto out;
-+	}
-+
-+	/* if non-root trying to do anything other than use a special role,
-+	   do not attempt authentication, do not count towards authentication
-+	   locking
-+	 */
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    current_uid()) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	/* ensure pw and special role name are null terminated */
-+
-+	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+	/* Okay. 
-+	 * We have our enough of the argument structure..(we have yet
-+	 * to copy_from_user the tables themselves) . Copy the tables
-+	 * only if we need them, i.e. for loading operations. */
-+
-+	switch (gr_usermode->mode) {
-+	case GR_STATUS:
-+			if (gr_status & GR_READY) {
-+				error = 1;
-+				if (!gr_check_secure_terminal(current))
-+					error = 3;
-+			} else
-+				error = 2;
-+			goto out;
-+	case GR_SHUTDOWN:
-+		if ((gr_status & GR_READY)
-+		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+			free_variables();
-+			memset(gr_usermode, 0, sizeof (struct gr_arg));
-+			memset(gr_system_salt, 0, GR_SALT_LEN);
-+			memset(gr_system_sum, 0, GR_SHA_LEN);
-+		} else if (gr_status & GR_READY) {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+			error = -EPERM;
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+			error = -EAGAIN;
-+		}
-+		break;
-+	case GR_ENABLE:
-+		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+		else {
-+			if (gr_status & GR_READY)
-+				error = -EAGAIN;
-+			else
-+				error = error2;
-+			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+		}
-+		break;
-+	case GR_RELOAD:
-+		if (!(gr_status & GR_READY)) {
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+			error = -EAGAIN;
-+		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			lock_kernel();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				unlock_kernel();
-+				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				unlock_kernel();
-+				error = error2;
-+				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			}
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SEGVMOD:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+				struct acl_subject_label *segvacl;
-+				segvacl =
-+				    lookup_acl_subj_label(gr_usermode->segv_inode,
-+							  gr_usermode->segv_device,
-+							  current->role);
-+				if (segvacl) {
-+					segvacl->crashes = 0;
-+					segvacl->expires = 0;
-+				}
-+			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+				gr_remove_uid(gr_usermode->segv_uid);
-+			}
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SPROLE:
-+	case GR_SPROLEPAM:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+			current->role->expires = 0;
-+			current->role->auth_attempts = 0;
-+		}
-+
-+		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+		    time_after(current->role->expires, get_seconds())) {
-+			error = -EBUSY;
-+			goto out;
-+		}
-+
-+		if (lookup_special_role_auth
-+		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+		    && ((!sprole_salt && !sprole_sum)
-+			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+			char *p = "";
-+			assign_special_role(gr_usermode->sp_role);
-+			read_lock(&tasklist_lock);
-+			if (current->parent)
-+				p = current->parent->role->rolename;
-+			read_unlock(&tasklist_lock);
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+					p, acl_sp_role_value);
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+			error = -EPERM;
-+			if(!(current->role->auth_attempts++))
-+				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+			goto out;
-+		}
-+		break;
-+	case GR_UNSPROLE:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->roletype & GR_ROLE_SPECIAL) {
-+			char *p = "";
-+			int i = 0;
-+
-+			read_lock(&tasklist_lock);
-+			if (current->parent) {
-+				p = current->parent->role->rolename;
-+				i = current->parent->acl_role_id;
-+			}
-+			read_unlock(&tasklist_lock);
-+
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+			gr_set_acls(1);
-+		} else {
-+			error = -EPERM;
-+			goto out;
-+		}
-+		break;
-+	default:
-+		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+		error = -EINVAL;
-+		break;
-+	}
-+
-+	if (error != -EPERM)
-+		goto out;
-+
-+	if(!(gr_auth_attempts++))
-+		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+      out:
-+	up(&gr_dev_sem);
-+	return error;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	struct acl_object_label *obj;
-+	struct task_struct *task, *task2;
-+	struct file *filp;
-+	struct acl_role_label *role = current->role;
-+	__u16 acl_role_id = current->acl_role_id;
-+	const struct cred *cred;
-+	char *tmpname;
-+	struct name_entry *nmatch;
-+	struct acl_subject_label *tmpsubj;
-+
-+	rcu_read_lock();
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	do_each_thread(task2, task) {
-+		/* check to see if we're called from the exit handler,
-+		   if so, only replace ACLs that have inherited the admin
-+		   ACL */
-+
-+		if (type && (task->role != role ||
-+			     task->acl_role_id != acl_role_id))
-+			continue;
-+
-+		task->acl_role_id = 0;
-+		task->acl_sp_role = 0;
-+
-+		if ((filp = task->exec_file)) {
-+			cred = __task_cred(task);
-+			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+			/* the following is to apply the correct subject 
-+			   on binaries running when the RBAC system 
-+			   is enabled, when the binaries have been 
-+			   replaced or deleted since their execution
-+			   -----
-+			   when the RBAC system starts, the inode/dev
-+			   from exec_file will be one the RBAC system
-+			   is unaware of.  It only knows the inode/dev
-+			   of the present file on disk, or the absence
-+			   of it.
-+			*/
-+			preempt_disable();
-+			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+			
-+			nmatch = lookup_name_entry(tmpname);
-+			preempt_enable();
-+			tmpsubj = NULL;
-+			if (nmatch) {
-+				if (nmatch->deleted)
-+					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+				else
-+					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+				if (tmpsubj != NULL)
-+					task->acl = tmpsubj;
-+			}
-+			if (tmpsubj == NULL)
-+				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+							   task->role);
-+			if (task->acl) {
-+				struct acl_subject_label *curr;
-+				curr = task->acl;
-+
-+				task->is_writable = 0;
-+				/* ignore additional mmap checks for processes that are writable 
-+				   by the default ACL */
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+
-+				gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+			} else {
-+				read_unlock(&grsec_exec_file_lock);
-+				read_unlock(&tasklist_lock);
-+				rcu_read_unlock();
-+				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+				return 1;
-+			}
-+		} else {
-+			// it's a kernel process
-+			task->role = kernel_role;
-+			task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+			task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+		}
-+	} while_each_thread(task2, task);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	rcu_read_unlock();
-+
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	struct acl_subject_label *acl;
-+	const struct cred *cred;
-+
-+	if (unlikely((gr_status & GR_READY) &&
-+		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+		goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	gr_log_resource(task, res, wanted, gt);
-+#endif
-+      skip_reslog:
-+
-+	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+		return;
-+
-+	acl = task->acl;
-+
-+	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+		   !(acl->resmask & (1 << (unsigned short) res))))
-+		return;
-+
-+	if (wanted >= acl->res[res].rlim_cur) {
-+		unsigned long res_add;
-+
-+		res_add = wanted;
-+		switch (res) {
-+		case RLIMIT_CPU:
-+			res_add += GR_RLIM_CPU_BUMP;
-+			break;
-+		case RLIMIT_FSIZE:
-+			res_add += GR_RLIM_FSIZE_BUMP;
-+			break;
-+		case RLIMIT_DATA:
-+			res_add += GR_RLIM_DATA_BUMP;
-+			break;
-+		case RLIMIT_STACK:
-+			res_add += GR_RLIM_STACK_BUMP;
-+			break;
-+		case RLIMIT_CORE:
-+			res_add += GR_RLIM_CORE_BUMP;
-+			break;
-+		case RLIMIT_RSS:
-+			res_add += GR_RLIM_RSS_BUMP;
-+			break;
-+		case RLIMIT_NPROC:
-+			res_add += GR_RLIM_NPROC_BUMP;
-+			break;
-+		case RLIMIT_NOFILE:
-+			res_add += GR_RLIM_NOFILE_BUMP;
-+			break;
-+		case RLIMIT_MEMLOCK:
-+			res_add += GR_RLIM_MEMLOCK_BUMP;
-+			break;
-+		case RLIMIT_AS:
-+			res_add += GR_RLIM_AS_BUMP;
-+			break;
-+		case RLIMIT_LOCKS:
-+			res_add += GR_RLIM_LOCKS_BUMP;
-+			break;
-+		case RLIMIT_SIGPENDING:
-+			res_add += GR_RLIM_SIGPENDING_BUMP;
-+			break;
-+		case RLIMIT_MSGQUEUE:
-+			res_add += GR_RLIM_MSGQUEUE_BUMP;
-+			break;
-+		case RLIMIT_NICE:
-+			res_add += GR_RLIM_NICE_BUMP;
-+			break;
-+		case RLIMIT_RTPRIO:
-+			res_add += GR_RLIM_RTPRIO_BUMP;
-+			break;
-+		case RLIMIT_RTTIME:
-+			res_add += GR_RLIM_RTTIME_BUMP;
-+			break;
-+		}
-+
-+		acl->res[res].rlim_cur = res_add;
-+
-+		if (wanted > acl->res[res].rlim_max)
-+			acl->res[res].rlim_max = res_add;
-+
-+		/* only log the subject filename, since resource logging is supported for
-+		   single-subject learning only */
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid, cred->gid, acl->filename,
-+			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+			       "", (unsigned long) res, &task->signal->curr_ip);
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	struct task_struct *task = current;
-+        struct acl_subject_label *proc;
-+	unsigned long flags;
-+
-+        if (unlikely(!(gr_status & GR_READY)))
-+                return;
-+
-+	flags = pax_get_flags(task);
-+
-+        proc = task->acl;
-+
-+	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+		flags &= ~MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+		flags &= ~MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+		flags &= ~MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+		flags &= ~MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+		flags &= ~MF_PAX_MPROTECT;
-+
-+	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+		flags |= MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+		flags |= MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+		flags |= MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+		flags |= MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+		flags |= MF_PAX_MPROTECT;
-+
-+	pax_set_flags(task, flags);
-+
-+        return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+   system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+	struct name_entry *nmatch;
-+	char *p, *lastp = NULL;
-+	struct acl_object_label *obj = NULL, *tmp;
-+	struct acl_subject_label *tmpsubj;
-+	char c = '\0';
-+
-+	read_lock(&gr_inode_lock);
-+
-+	p = name + len - 1;
-+	do {
-+		nmatch = lookup_name_entry(name);
-+		if (lastp != NULL)
-+			*lastp = c;
-+
-+		if (nmatch == NULL)
-+			goto next_component;
-+		tmpsubj = current->acl;
-+		do {
-+			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+			if (obj != NULL) {
-+				tmp = obj->globbed;
-+				while (tmp) {
-+					if (!glob_match(tmp->filename, name)) {
-+						obj = tmp;
-+						goto found_obj;
-+					}
-+					tmp = tmp->next;
-+				}
-+				goto found_obj;
-+			}
-+		} while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+		/* end case */
-+		if (p == name)
-+			break;
-+
-+		while (*p != '/')
-+			p--;
-+		if (p == name)
-+			lastp = p + 1;
-+		else {
-+			lastp = p;
-+			p--;
-+		}
-+		c = *lastp;
-+		*lastp = '\0';
-+	} while (1);
-+found_obj:
-+	read_unlock(&gr_inode_lock);
-+	/* obj returned will always be non-null */
-+	return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+   op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+	ctl_table *tmp;
-+	const char *proc_sys = "/proc/sys";
-+	char *path;
-+	struct acl_object_label *obj;
-+	unsigned short len = 0, pos = 0, depth = 0, i;
-+	__u32 err = 0;
-+	__u32 mode = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	/* for now, ignore operations on non-sysctl entries if it's not a
-+	   readdir*/
-+	if (table->child != NULL && op != 0)
-+		return 0;
-+
-+	mode |= GR_FIND;
-+	/* it's only a read if it's an entry, read on dirs is for readdir */
-+	if (op & MAY_READ)
-+		mode |= GR_READ;
-+	if (op & MAY_WRITE)
-+		mode |= GR_WRITE;
-+
-+	preempt_disable();
-+
-+	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+	/* it's only a read/write if it's an actual entry, not a dir
-+	   (which are opened for readdir)
-+	*/
-+
-+	/* convert the requested sysctl entry into a pathname */
-+
-+	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+		len += strlen(tmp->procname);
-+		len++;
-+		depth++;
-+	}
-+
-+	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+		/* deny */
-+		goto out;
-+	}
-+
-+	memset(path, 0, PAGE_SIZE);
-+
-+	memcpy(path, proc_sys, strlen(proc_sys));
-+
-+	pos += strlen(proc_sys);
-+
-+	for (; depth > 0; depth--) {
-+		path[pos] = '/';
-+		pos++;
-+		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+			if (depth == i) {
-+				memcpy(path + pos, tmp->procname,
-+				       strlen(tmp->procname));
-+				pos += strlen(tmp->procname);
-+			}
-+			i++;
-+		}
-+	}
-+
-+	obj = gr_lookup_by_name(path, pos);
-+	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+		     ((err & mode) != mode))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		err = 0;
-+		gr_log_learn_sysctl(path, new_mode);
-+	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+		err = -ENOENT;
-+	} else if (!(err & GR_FIND)) {
-+		err = -ENOENT;
-+	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = -EACCES;
-+	} else if ((err & mode) != mode) {
-+		err = -EACCES;
-+	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = 0;
-+	} else
-+		err = 0;
-+
-+      out:
-+	preempt_enable();
-+
-+	return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	struct file *filp;
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	filp = task->exec_file;
-+
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 1;
-+	}
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 0;
-+	}
-+#endif
-+
-+	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+
-+	if (retmode & GR_NOPTRACE)
-+		return 1;
-+
-+	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+	    && (current->acl != task->acl || (current->acl != current->role->root_label
-+	    && current->pid != task->pid)))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY))
-+		return 0;
-+#endif
-+
-+	read_lock(&grsec_exec_file_lock);
-+	if (unlikely(!task->exec_file)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		return 0;
-+	}
-+
-+	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+
-+	if (retmode & GR_NOPTRACE) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+		
-+	if (retmode & GR_PTRACERD) {
-+		switch (request) {
-+		case PTRACE_POKETEXT:
-+		case PTRACE_POKEDATA:
-+		case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+		case PTRACE_SETREGS:
-+		case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+		case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+		case PTRACE_SETVRREGS:
-+#endif
-+			return 1;
-+		default:
-+			return 0;
-+		}
-+	} else if (!(current->acl->mode & GR_POVERRIDE) &&
-+		   !(current->role->roletype & GR_ROLE_GOD) &&
-+		   (current->acl != task->acl)) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+	struct task_struct *task = current;
-+	struct acl_object_label *obj, *obj2;
-+
-+	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
-+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+				     task->role->root_label);
-+		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+			return 1;
-+		}
-+	}
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	unsigned long runtime;
-+	unsigned long cputime;
-+	unsigned int wday, cday;
-+	__u8 whr, chr;
-+	__u8 wmin, cmin;
-+	__u8 wsec, csec;
-+	struct timespec timeval;
-+
-+	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+		     !(task->acl->mode & GR_PROCACCT)))
-+		return;
-+
-+	do_posix_clock_monotonic_gettime(&timeval);
-+	runtime = timeval.tv_sec - task->start_time.tv_sec;
-+	wday = runtime / (3600 * 24);
-+	runtime -= wday * (3600 * 24);
-+	whr = runtime / 3600;
-+	runtime -= whr * 3600;
-+	wmin = runtime / 60;
-+	runtime -= wmin * 60;
-+	wsec = runtime;
-+
-+	cputime = (task->utime + task->stime) / HZ;
-+	cday = cputime / (3600 * 24);
-+	cputime -= cday * (3600 * 24);
-+	chr = cputime / 3600;
-+	cputime -= chr * 3600;
-+	cmin = cputime / 60;
-+	cputime -= cmin * 60;
-+	csec = cputime;
-+
-+	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+	return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+	if (gr_status & GR_READY) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+	}
-+	return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred;
-+#endif
-+	int ret = 0;
-+
-+	/* restrict taskstats viewing to un-chrooted root users
-+	   who have the 'view' subject flag if the RBAC system is enabled
-+	*/
-+
-+	read_lock(&tasklist_lock);
-+	task = find_task_by_vpid(pid);
-+	if (task) {
-+		gr_fs_read_lock(task);
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+		if (proc_is_chrooted(task))
-+			ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		if (cred->uid != 0)
-+			ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
-+			ret = -EACCES;
-+#endif
-+#endif
-+		if (gr_status & GR_READY) {
-+			if (!(task->acl->mode & GR_VIEW))
-+				ret = -EACCES;
-+		}
-+		
-+		gr_fs_read_unlock(task);
-+	} else
-+		ret = -ENOENT;
-+
-+	read_unlock(&tasklist_lock);
-+
-+	return ret;
-+}
-+#endif
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+	struct task_struct *task = current;
-+	struct dentry *dentry = file->f_path.dentry;
-+	struct vfsmount *mnt = file->f_path.mnt;
-+	struct acl_object_label *obj, *tmp;
-+	struct acl_subject_label *subj;
-+	unsigned int bufsize;
-+	int is_not_root;
-+	char *path;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 1;
-+
-+	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return 1;
-+
-+	/* ignore Eric Biederman */
-+	if (IS_PRIVATE(dentry->d_inode))
-+		return 1;
-+
-+	subj = task->acl;
-+	do {
-+		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
-+		if (obj != NULL)
-+			return (obj->mode & GR_FIND) ? 1 : 0;
-+	} while ((subj = subj->parent_subject));
-+	
-+	/* this is purely an optimization since we're looking for an object
-+	   for the directory we're doing a readdir on
-+	   if it's possible for any globbed object to match the entry we're
-+	   filling into the directory, then the object we find here will be
-+	   an anchor point with attached globbed objects
-+	*/
-+	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+	if (obj->globbed == NULL)
-+		return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+	is_not_root = ((obj->filename[0] == '/') &&
-+		   (obj->filename[1] == '\0')) ? 0 : 1;
-+	bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+	/* check bufsize > PAGE_SIZE || bufsize == 0 */
-+	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+		return 1;
-+
-+	preempt_disable();
-+	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   bufsize);
-+
-+	bufsize = strlen(path);
-+
-+	/* if base is "/", don't append an additional slash */
-+	if (is_not_root)
-+		*(path + bufsize) = '/';
-+	memcpy(path + bufsize + is_not_root, name, namelen);
-+	*(path + bufsize + namelen + is_not_root) = '\0';
-+
-+	tmp = obj->globbed;
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, path)) {
-+			preempt_enable();
-+			return (tmp->mode & GR_FIND) ? 1 : 0;
-+		}
-+		tmp = tmp->next;
-+	}
-+	preempt_enable();
-+	return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff -urNp linux-2.6.32.11/grsecurity/gracl_cap.c linux-2.6.32.11/grsecurity/gracl_cap.c
---- linux-2.6.32.11/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_cap.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,131 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static const char *captab_log[] = {
-+	"CAP_CHOWN",
-+	"CAP_DAC_OVERRIDE",
-+	"CAP_DAC_READ_SEARCH",
-+	"CAP_FOWNER",
-+	"CAP_FSETID",
-+	"CAP_KILL",
-+	"CAP_SETGID",
-+	"CAP_SETUID",
-+	"CAP_SETPCAP",
-+	"CAP_LINUX_IMMUTABLE",
-+	"CAP_NET_BIND_SERVICE",
-+	"CAP_NET_BROADCAST",
-+	"CAP_NET_ADMIN",
-+	"CAP_NET_RAW",
-+	"CAP_IPC_LOCK",
-+	"CAP_IPC_OWNER",
-+	"CAP_SYS_MODULE",
-+	"CAP_SYS_RAWIO",
-+	"CAP_SYS_CHROOT",
-+	"CAP_SYS_PTRACE",
-+	"CAP_SYS_PACCT",
-+	"CAP_SYS_ADMIN",
-+	"CAP_SYS_BOOT",
-+	"CAP_SYS_NICE",
-+	"CAP_SYS_RESOURCE",
-+	"CAP_SYS_TIME",
-+	"CAP_SYS_TTY_CONFIG",
-+	"CAP_MKNOD",
-+	"CAP_LEASE",
-+	"CAP_AUDIT_WRITE",
-+	"CAP_AUDIT_CONTROL",
-+	"CAP_SETFCAP",
-+	"CAP_MAC_OVERRIDE",
-+	"CAP_MAC_ADMIN"
-+};
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+	    && cap_raised(cred->cap_effective, cap)) {
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid,
-+			       cred->gid, task->exec_file ?
-+			       gr_to_filename(task->exec_file->f_path.dentry,
-+			       task->exec_file->f_path.mnt) : curracl->filename,
-+			       curracl->filename, 0UL,
-+			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
-+		return 1;
-+	}
-+
-+	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
-+		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+	return 0;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = current->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	return 0;
-+}
-+
-diff -urNp linux-2.6.32.11/grsecurity/gracl_fs.c linux-2.6.32.11/grsecurity/gracl_fs.c
---- linux-2.6.32.11/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_fs.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,424 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return GR_FIND;
-+
-+	mode =
-+	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return mode;
-+	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_FIND)))
-+		return 0;
-+
-+	return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	__u32 reqmode = GR_FIND;
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return reqmode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	else if (unlikely(fmode & FMODE_WRITE))
-+		reqmode |= GR_WRITE;
-+	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
-+		reqmode &= ~GR_READ;
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
-+		reqmode |= GR_SETID;
-+
-+	mode =
-+	    gr_check_create(dentry, p_dentry, p_mnt,
-+			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     const int fmode)
-+{
-+	__u32 mode, reqmode = GR_FIND;
-+
-+	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+		reqmode |= GR_EXEC;
-+	if (fmode & S_IWOTH)
-+		reqmode |= GR_WRITE;
-+	if (fmode & S_IROTH)
-+		reqmode |= GR_READ;
-+
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		     mode_t mode)
-+{
-+	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+		return 1;
-+
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_FCHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		    mode_t mode)
-+{
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_CHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+			   GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create permission,
-+   any additional privilege required is based on the
-+   privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	__u32 mode;
-+	__u32 needmode = GR_CREATE | GR_LINK;
-+	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+	mode =
-+	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+			  old_mnt);
-+
-+	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	__u32 needmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	mode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    GR_CREATE | GR_AUDIT_CREATE |
-+			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	if (unlikely(mode & (S_ISUID | S_ISGID)))
-+		reqmode |= GR_SETID;
-+
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+		    const struct dentry *parent_dentry,
-+		    const struct vfsmount *parent_mnt)
-+{
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+		     struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     struct dentry *old_dentry,
-+		     struct inode *old_parent_inode,
-+		     struct vfsmount *old_mnt, const char *newname)
-+{
-+	__u32 comp1, comp2;
-+	int error = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (!new_dentry->d_inode) {
-+		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+				       GR_DELETE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, old_mnt);
-+	} else {
-+		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+				       GR_CREATE | GR_DELETE |
-+				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, parent_mnt);
-+		comp2 =
-+		    gr_search_file(old_dentry,
-+				   GR_READ | GR_WRITE | GR_AUDIT_READ |
-+				   GR_DELETE | GR_AUDIT_DELETE |
-+				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+	}
-+
-+	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+		 && !(comp2 & GR_SUPPRESS)) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+		error = -EACCES;
-+	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+		error = -EACCES;
-+
-+	return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	u16 id;
-+	char *rolename;
-+	struct file *exec_file;
-+
-+	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
-+		id = current->acl_role_id;
-+		rolename = current->role->rolename;
-+		gr_set_acls(1);
-+		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+	}
-+
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (task != current && task->acl->mode & GR_PROTPROCFD)
-+		return -EACCES;
-+
-+	return 0;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/gracl_ip.c linux-2.6.32.11/grsecurity/gracl_ip.c
---- linux-2.6.32.11/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_ip.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,339 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND			0x01
-+#define GR_CONNECT		0x02
-+#define GR_INVERT		0x04
-+#define GR_BINDOVERRIDE		0x08
-+#define GR_CONNECTOVERRIDE	0x10
-+
-+static const char * gr_protocols[256] = {
-+	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
-+	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
-+	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+	};
-+
-+static const char * gr_socktypes[11] = {
-+	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
-+	"unknown:7", "unknown:8", "unknown:9", "packet"
-+	};
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+	return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+	return gr_socktypes[type];
-+}
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+	struct acl_subject_label *curr;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		goto exit;
-+
-+	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
-+	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
-+		goto exit;	// let the kernel handle it
-+
-+	curr = current->acl;
-+
-+	if (!curr->ips)
-+		goto exit;
-+
-+	if ((curr->ip_type & (1 << type)) &&
-+	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
-+		goto exit;
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		/* we don't place acls on raw sockets , and sometimes
-+		   dgram/ip sockets are opened for ioctl and not
-+		   bind/connect, so we'll fake a bind learn log */
-+		if (type == SOCK_RAW || type == SOCK_PACKET) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_CONNECT, &current->signal->curr_ip);
-+		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_BIND, &current->signal->curr_ip);
-+		}
-+		/* we'll log when they use connect or bind */
-+		goto exit;
-+	}
-+
-+	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
-+		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+
-+	return 0;
-+      exit:
-+	return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+	if ((ip->mode & mode) &&
-+	    (ip_port >= ip->low) &&
-+	    (ip_port <= ip->high) &&
-+	    ((ntohl(ip_addr) & our_netmask) ==
-+	     (ntohl(our_addr) & our_netmask))
-+	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+	    && (ip->type & (1 << type))) {
-+		if (ip->mode & GR_INVERT)
-+			return 2; // specifically denied
-+		else
-+			return 1; // allowed
-+	}
-+
-+	return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+		      struct sockaddr_in *addr, const int type)
-+{
-+	char iface[IFNAMSIZ] = {0};
-+	struct acl_subject_label *curr;
-+	struct acl_ip_label *ip;
-+	struct inet_sock *isk;
-+	struct net_device *dev;
-+	struct in_device *idev;
-+	unsigned long i;
-+	int ret;
-+	int mode = full_mode & (GR_BIND | GR_CONNECT);
-+	__u32 ip_addr = 0;
-+	__u32 our_addr;
-+	__u32 our_netmask;
-+	char *p;
-+	__u16 ip_port = 0;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+		return 0;
-+
-+	curr = current->acl;
-+	isk = inet_sk(sk);
-+
-+	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+		addr->sin_addr.s_addr = curr->inaddr_any_override;
-+	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+		struct sockaddr_in saddr;
-+		int err;
-+
-+		saddr.sin_family = AF_INET;
-+		saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+		saddr.sin_port = isk->sport;
-+
-+		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+
-+		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+	}
-+
-+	if (!curr->ips)
-+		return 0;
-+
-+	ip_addr = addr->sin_addr.s_addr;
-+	ip_port = ntohs(addr->sin_port);
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+			       current->role->roletype, cred->uid,
-+			       cred->gid, current->exec_file ?
-+			       gr_to_filename(current->exec_file->f_path.dentry,
-+			       current->exec_file->f_path.mnt) :
-+			       curr->filename, curr->filename,
-+			       &ip_addr, ip_port, type,
-+			       sk->sk_protocol, mode, &current->signal->curr_ip);
-+		return 0;
-+	}
-+
-+	for (i = 0; i < curr->ip_num; i++) {
-+		ip = *(curr->ips + i);
-+		if (ip->iface != NULL) {
-+			strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+			p = strchr(iface, ':');
-+			if (p != NULL)
-+				*p = '\0';
-+			dev = dev_get_by_name(sock_net(sk), iface);
-+			if (dev == NULL)
-+				continue;
-+			idev = in_dev_get(dev);
-+			if (idev == NULL) {
-+				dev_put(dev);
-+				continue;
-+			}
-+			rcu_read_lock();
-+			for_ifa(idev) {
-+				if (!strcmp(ip->iface, ifa->ifa_label)) {
-+					our_addr = ifa->ifa_address;
-+					our_netmask = 0xffffffff;
-+					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+					if (ret == 1) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						return 0;
-+					} else if (ret == 2) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						goto denied;
-+					}
-+				}
-+			} endfor_ifa(idev);
-+			rcu_read_unlock();
-+			in_dev_put(idev);
-+			dev_put(dev);
-+		} else {
-+			our_addr = ip->addr;
-+			our_netmask = ip->netmask;
-+			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+			if (ret == 1)
-+				return 0;
-+			else if (ret == 2)
-+				goto denied;
-+		}
-+	}
-+
-+denied:
-+	if (mode == GR_BIND)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+	else if (mode == GR_CONNECT)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+	return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+	if (addr)
-+		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+	else {
-+		struct sockaddr_in sin;
-+		const struct inet_sock *inet = inet_sk(sk);
-+
-+		sin.sin_addr.s_addr = inet->daddr;
-+		sin.sin_port = inet->dport;
-+
-+		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+	}
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+	struct sockaddr_in sin;
-+
-+	if (unlikely(skb->len < sizeof (struct udphdr)))
-+		return 0;	// skip this packet
-+
-+	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+	sin.sin_port = udp_hdr(skb)->source;
-+
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff -urNp linux-2.6.32.11/grsecurity/gracl_learn.c linux-2.6.32.11/grsecurity/gracl_learn.c
---- linux-2.6.32.11/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_learn.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,211 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+				   size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DECLARE_MUTEX(gr_learn_user_sem);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+   uses a semaphore around the userspace copying, and the other kernel contexts
-+   use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+	DECLARE_WAITQUEUE(wait, current);
-+	ssize_t retval = 0;
-+
-+	add_wait_queue(&learn_wait, &wait);
-+	set_current_state(TASK_INTERRUPTIBLE);
-+	do {
-+		down(&gr_learn_user_sem);
-+		spin_lock(&gr_learn_lock);
-+		if (learn_buffer_len)
-+			break;
-+		spin_unlock(&gr_learn_lock);
-+		up(&gr_learn_user_sem);
-+		if (file->f_flags & O_NONBLOCK) {
-+			retval = -EAGAIN;
-+			goto out;
-+		}
-+		if (signal_pending(current)) {
-+			retval = -ERESTARTSYS;
-+			goto out;
-+		}
-+
-+		schedule();
-+	} while (1);
-+
-+	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+	learn_buffer_user_len = learn_buffer_len;
-+	retval = learn_buffer_len;
-+	learn_buffer_len = 0;
-+
-+	spin_unlock(&gr_learn_lock);
-+
-+	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+		retval = -EFAULT;
-+
-+	up(&gr_learn_user_sem);
-+out:
-+	set_current_state(TASK_RUNNING);
-+	remove_wait_queue(&learn_wait, &wait);
-+	return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+	poll_wait(file, &learn_wait, wait);
-+
-+	if (learn_buffer_len)
-+		return (POLLIN | POLLRDNORM);
-+
-+	return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+	char *tmp;
-+
-+	down(&gr_learn_user_sem);
-+	if (learn_buffer != NULL) {
-+		spin_lock(&gr_learn_lock);
-+		tmp = learn_buffer;
-+		learn_buffer = NULL;
-+		spin_unlock(&gr_learn_lock);
-+		vfree(learn_buffer);
-+	}
-+	if (learn_buffer_user != NULL) {
-+		vfree(learn_buffer_user);
-+		learn_buffer_user = NULL;
-+	}
-+	learn_buffer_len = 0;
-+	up(&gr_learn_user_sem);
-+
-+	return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+	va_list args;
-+	unsigned int len;
-+
-+	if (!gr_learn_attached)
-+		return;
-+
-+	spin_lock(&gr_learn_lock);
-+
-+	/* leave a gap at the end so we know when it's "full" but don't have to
-+	   compute the exact length of the string we're trying to append
-+	*/
-+	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+		spin_unlock(&gr_learn_lock);
-+		wake_up_interruptible(&learn_wait);
-+		return;
-+	}
-+	if (learn_buffer == NULL) {
-+		spin_unlock(&gr_learn_lock);
-+		return;
-+	}
-+
-+	va_start(args, fmt);
-+	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+	va_end(args);
-+
-+	learn_buffer_len += len + 1;
-+
-+	spin_unlock(&gr_learn_lock);
-+	wake_up_interruptible(&learn_wait);
-+
-+	return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+	if (file->f_mode & FMODE_READ && gr_learn_attached)
-+		return -EBUSY;
-+	if (file->f_mode & FMODE_READ) {
-+		int retval = 0;
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer == NULL)
-+			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer_user == NULL)
-+			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		if (learn_buffer_user == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 1;
-+out_error:
-+		up(&gr_learn_user_sem);
-+		return retval;
-+	}
-+	return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+	char *tmp;
-+
-+	if (file->f_mode & FMODE_READ) {
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer != NULL) {
-+			spin_lock(&gr_learn_lock);
-+			tmp = learn_buffer;
-+			learn_buffer = NULL;
-+			spin_unlock(&gr_learn_lock);
-+			vfree(tmp);
-+		}
-+		if (learn_buffer_user != NULL) {
-+			vfree(learn_buffer_user);
-+			learn_buffer_user = NULL;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 0;
-+		up(&gr_learn_user_sem);
-+	}
-+
-+	return 0;
-+}
-+		
-+const struct file_operations grsec_fops = {
-+	.read		= read_learn,
-+	.write		= write_grsec_handler,
-+	.open		= open_learn,
-+	.release	= close_learn,
-+	.poll		= poll_learn,
-+};
-diff -urNp linux-2.6.32.11/grsecurity/gracl_res.c linux-2.6.32.11/grsecurity/gracl_res.c
---- linux-2.6.32.11/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_res.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+	[RLIMIT_CPU] = "RLIMIT_CPU",
-+	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+	[RLIMIT_DATA] = "RLIMIT_DATA",
-+	[RLIMIT_STACK] = "RLIMIT_STACK",
-+	[RLIMIT_CORE] = "RLIMIT_CORE",
-+	[RLIMIT_RSS] = "RLIMIT_RSS",
-+	[RLIMIT_NPROC] = "RLIMIT_NPROC",
-+	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+	[RLIMIT_AS] = "RLIMIT_AS",
-+	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+	[RLIMIT_NICE] = "RLIMIT_NICE",
-+	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+	[GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+		const int res, const unsigned long wanted, const int gt)
-+{
-+	const struct cred *cred;
-+
-+	if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+		return;
-+
-+	// not yet supported resource
-+	if (!restab_log[res])
-+		return;
-+
-+	rcu_read_lock();
-+	cred = __task_cred(task);
-+
-+	if (res == RLIMIT_NPROC && 
-+	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
-+	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_MEMLOCK &&
-+		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+		goto out_rcu_unlock;
-+	rcu_read_unlock();
-+
-+	preempt_disable();
-+
-+	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
-+		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
-+		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
-+		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
-+	preempt_enable_no_resched();
-+
-+	return;
-+out_rcu_unlock:
-+	rcu_read_unlock();
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/gracl_segv.c linux-2.6.32.11/grsecurity/gracl_segv.c
---- linux-2.6.32.11/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_segv.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,310 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+			      struct acl_role_label *role);
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int
-+gr_init_uidset(void)
-+{
-+	uid_set =
-+	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+	uid_used = 0;
-+
-+	return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+	if (uid_set)
-+		kfree(uid_set);
-+
-+	return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+	struct crash_uid *tmp = uid_set;
-+	uid_t buid;
-+	int low = 0, high = uid_used - 1, mid;
-+
-+	while (high >= low) {
-+		mid = (low + high) >> 1;
-+		buid = tmp[mid].uid;
-+		if (buid == uid)
-+			return mid;
-+		if (buid > uid)
-+			high = mid - 1;
-+		if (buid < uid)
-+			low = mid + 1;
-+	}
-+
-+	return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+	unsigned short i, j;
-+	struct crash_uid index;
-+
-+	for (i = 1; i < uid_used; i++) {
-+		index = uid_set[i];
-+		j = i;
-+		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+			uid_set[j] = uid_set[j - 1];
-+			j--;
-+		}
-+		uid_set[j] = index;
-+	}
-+
-+	return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+	int loc;
-+
-+	if (uid_used == GR_UIDTABLE_MAX)
-+		return;
-+
-+	loc = gr_find_uid(uid);
-+
-+	if (loc >= 0) {
-+		uid_set[loc].expires = expires;
-+		return;
-+	}
-+
-+	uid_set[uid_used].uid = uid;
-+	uid_set[uid_used].expires = expires;
-+	uid_used++;
-+
-+	gr_insertsort();
-+
-+	return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+	unsigned short i;
-+
-+	for (i = loc + 1; i < uid_used; i++)
-+		uid_set[i - 1] = uid_set[i];
-+
-+	uid_used--;
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	int loc;
-+	int ret = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	spin_lock(&gr_uid_lock);
-+	loc = gr_find_uid(uid);
-+
-+	if (loc < 0)
-+		goto out_unlock;
-+
-+	if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+		gr_remove_uid(loc);
-+	else
-+		ret = 1;
-+
-+out_unlock:
-+	spin_unlock(&gr_uid_lock);
-+	return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+	if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+	    cred->uid != cred->fsuid)
-+		return 1;
-+	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+	    cred->gid != cred->fsgid)
-+		return 1;
-+
-+	return 0;
-+}
-+static __inline__ int
-+gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+	unsigned long int flags;
-+	int ret, blocked, ignored;
-+	struct k_sigaction *action;
-+
-+	spin_lock_irqsave(&t->sighand->siglock, flags);
-+	action = &t->sighand->action[sig-1];
-+	ignored = action->sa.sa_handler == SIG_IGN;
-+	blocked = sigismember(&t->blocked, sig);
-+	if (blocked || ignored) {
-+		action->sa.sa_handler = SIG_DFL;
-+		if (blocked) {
-+			sigdelset(&t->blocked, sig);
-+			recalc_sigpending_and_wake(t);
-+		}
-+	}
-+	if (action->sa.sa_handler == SIG_DFL)
-+		t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+	spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+	return ret;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	struct acl_subject_label *curr;
-+	struct acl_subject_label *curr2;
-+	struct task_struct *tsk, *tsk2;
-+	const struct cred *cred;
-+	const struct cred *cred2;
-+
-+	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+		return;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curr = task->acl;
-+
-+	if (!(curr->resmask & (1 << GR_CRASH_RES)))
-+		return;
-+
-+	if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->expires = 0;
-+		curr->crashes = 0;
-+	}
-+
-+	curr->crashes++;
-+
-+	if (!curr->expires)
-+		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds())) {
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		if (cred->uid && proc_is_setxid(cred)) {
-+			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			spin_lock(&gr_uid_lock);
-+			gr_insert_uid(cred->uid, curr->expires);
-+			spin_unlock(&gr_uid_lock);
-+			curr->expires = 0;
-+			curr->crashes = 0;
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				cred2 = __task_cred(tsk);
-+				if (tsk != task && cred2->uid == cred->uid)
-+					gr_fake_force_sig(SIGKILL, tsk);
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		} else {
-+			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				if (likely(tsk != task)) {
-+					curr2 = tsk->acl;
-+
-+					if (curr2->device == curr->device &&
-+					    curr2->inode == curr->inode)
-+						gr_fake_force_sig(SIGKILL, tsk);
-+				}
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		}
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	struct acl_subject_label *curr;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	read_lock(&gr_inode_lock);
-+	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+				     filp->f_path.dentry->d_inode->i_sb->s_dev,
-+				     current->role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
-+	    (!curr->crashes && !curr->expires))
-+		return 0;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds()))
-+		return 1;
-+	else if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->crashes = 0;
-+		curr->expires = 0;
-+	}
-+
-+	return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	struct acl_subject_label *curracl;
-+	__u32 curr_ip;
-+	struct task_struct *p, *p2;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curracl = task->acl;
-+	curr_ip = task->signal->curr_ip;
-+
-+	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+		read_lock(&tasklist_lock);
-+		do_each_thread(p2, p) {
-+			if (p->signal->curr_ip == curr_ip)
-+				gr_fake_force_sig(SIGKILL, p);
-+		} while_each_thread(p2, p);
-+		read_unlock(&tasklist_lock);
-+	} else if (curracl->mode & GR_KILLPROC)
-+		gr_fake_force_sig(SIGKILL, task);
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/gracl_shm.c linux-2.6.32.11/grsecurity/gracl_shm.c
---- linux-2.6.32.11/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/gracl_shm.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,37 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	struct task_struct *task;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	task = find_task_by_vpid(shm_cprid);
-+
-+	if (unlikely(!task))
-+		task = find_task_by_vpid(shm_lapid);
-+
-+	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+			      (task->pid == shm_lapid)) &&
-+		     (task->acl->mode & GR_PROTSHM) &&
-+		     (task->acl != current->acl))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+		return 0;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+	return 1;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_chdir.c linux-2.6.32.11/grsecurity/grsec_chdir.c
---- linux-2.6.32.11/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_chdir.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	if ((grsec_enable_chdir && grsec_enable_group &&
-+	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+					      !grsec_enable_group)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+	}
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_chroot.c linux-2.6.32.11/grsecurity/grsec_chroot.c
---- linux-2.6.32.11/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_chroot.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,348 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	struct pid *spid = NULL;
-+
-+	if (unlikely(!grsec_enable_chroot_unix))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	spid = find_vpid(pid);
-+	if (spid) {
-+		struct task_struct *p;
-+		p = pid_task(spid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		if (unlikely(!have_same_root(current, p))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	}
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+			&& proc_is_chrooted(current)) {
-+		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
-+	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+		return 0;
-+
-+	gr_fs_read_lock(p);
-+	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+	    !have_same_root(current, p)) {
-+		gr_fs_read_unlock(p);
-+		return 1;
-+	}
-+	gr_fs_read_unlock(p);
-+#endif
-+	return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+	struct dentry *dentry = (struct dentry *)u_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+	struct dentry *realroot;
-+	struct vfsmount *realrootmnt;
-+	struct dentry *currentroot;
-+	struct vfsmount *currentmnt;
-+	struct task_struct *reaper = &init_task;
-+	int ret = 1;
-+
-+	read_lock(&reaper->fs->lock);
-+	realrootmnt = mntget(reaper->fs->root.mnt);
-+	realroot = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+
-+	read_lock(&current->fs->lock);
-+	currentmnt = mntget(current->fs->root.mnt);
-+	currentroot = dget(current->fs->root.dentry);
-+	read_unlock(&current->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	for (;;) {
-+		if (unlikely((dentry == realroot && mnt == realrootmnt)
-+		     || (dentry == currentroot && mnt == currentmnt)))
-+			break;
-+		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+		dentry = dentry->d_parent;
-+	}
-+	spin_unlock(&dcache_lock);
-+
-+	dput(currentroot);
-+	mntput(currentmnt);
-+
-+	/* access is outside of chroot */
-+	if (dentry == realroot && mnt == realrootmnt)
-+		ret = 0;
-+
-+	dput(realroot);
-+	mntput(realrootmnt);
-+	return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	if (!grsec_enable_chroot_fchdir)
-+		return 1;
-+
-+	if (!proc_is_chrooted(current))
-+		return 1;
-+	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+		return 0;
-+	}
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	struct pid *pid = NULL;
-+	time_t starttime;
-+
-+	if (unlikely(!grsec_enable_chroot_shmat))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	pid = find_vpid(shm_cprid);
-+	if (pid) {
-+		struct task_struct *p;
-+		p = pid_task(pid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		starttime = p->start_time.tv_sec;
-+		if (unlikely(!have_same_root(current, p) &&
-+			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	} else {
-+		pid = find_vpid(shm_lapid);
-+		if (pid) {
-+			struct task_struct *p;
-+			p = pid_task(pid, PIDTYPE_PID);
-+			gr_fs_read_lock(p);
-+			if (unlikely(!have_same_root(current, p))) {
-+				gr_fs_read_unlock(p);
-+				read_unlock(&tasklist_lock);
-+				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+				return 0;
-+			}
-+			gr_fs_read_unlock(p);
-+		}
-+	}
-+
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+	    !gr_is_outside_chroot(dentry, mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_caps(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
-+		(init_task.fs->root.dentry != path->dentry) &&
-+		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
-+
-+		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+		const struct cred *old = current_cred();
-+		struct cred *new = prepare_creds();
-+		if (new == NULL)
-+			return 1;
-+
-+		new->cap_permitted = cap_drop(old->cap_permitted, 
-+					      chroot_caps);
-+		new->cap_inheritable = cap_drop(old->cap_inheritable, 
-+						chroot_caps);
-+		new->cap_effective = cap_drop(old->cap_effective,
-+					      chroot_caps);
-+
-+		commit_creds(new);
-+
-+		return 0;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+	    && (op & MAY_WRITE))
-+		return -EACCES;
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	if (grsec_enable_chroot_chdir)
-+		set_fs_pwd(current->fs, path);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	if (grsec_enable_chroot_chmod &&
-+	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_handle_chroot_caps);
-+#endif
-diff -urNp linux-2.6.32.11/grsecurity/grsec_disabled.c linux-2.6.32.11/grsecurity/grsec_disabled.c
---- linux-2.6.32.11/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_disabled.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,426 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+	return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+		      const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+		   unsigned int *vm_flags)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+		       const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+		     const struct vfsmount * mnt, const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		    mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+		     const struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     const struct dentry *old_dentry,
-+		     const struct inode *old_parent_inode,
-+		     const struct vfsmount *old_mnt, const char *newname)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+		      const int namelen, const ino_t ino)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff -urNp linux-2.6.32.11/grsecurity/grsec_exec.c linux-2.6.32.11/grsecurity/grsec_exec.c
---- linux-2.6.32.11/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_exec.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,89 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DECLARE_MUTEX(gr_exec_arg_sem);
-+#endif
-+
-+int
-+gr_handle_nproc(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	const struct cred *cred = current_cred();
-+	if (grsec_enable_execve && cred->user &&
-+	    (atomic_read(&cred->user->processes) >
-+	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
-+	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
-+		return -EAGAIN;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	char *grarg = gr_exec_arg_buf;
-+	unsigned int i, x, execlen = 0;
-+	char c;
-+
-+	if (!((grsec_enable_execlog && grsec_enable_group &&
-+	       in_group_p(grsec_audit_gid))
-+	      || (grsec_enable_execlog && !grsec_enable_group)))
-+		return;
-+
-+	down(&gr_exec_arg_sem);
-+	memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+	if (unlikely(argv == NULL))
-+		goto log;
-+
-+	for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+		const char __user *p;
-+		unsigned int len;
-+
-+		if (copy_from_user(&p, argv + i, sizeof(p)))
-+			goto log;
-+		if (!p)
-+			goto log;
-+		len = strnlen_user(p, 128 - execlen);
-+		if (len > 128 - execlen)
-+			len = 128 - execlen;
-+		else if (len > 0)
-+			len--;
-+		if (copy_from_user(grarg + execlen, p, len))
-+			goto log;
-+
-+		/* rewrite unprintable characters */
-+		for (x = 0; x < len; x++) {
-+			c = *(grarg + execlen + x);
-+			if (c < 32 || c > 126)
-+				*(grarg + execlen + x) = ' ';
-+		}
-+
-+		execlen += len;
-+		*(grarg + execlen) = ' ';
-+		*(grarg + execlen + 1) = '\0';
-+		execlen++;
-+	}
-+
-+      log:
-+	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+			bprm->file->f_path.mnt, grarg);
-+	up(&gr_exec_arg_sem);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_fifo.c linux-2.6.32.11/grsecurity/grsec_fifo.c
---- linux-2.6.32.11/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_fifo.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+	       const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+	    (cred->fsuid != dentry->d_inode->i_uid)) {
-+		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
-+			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_fork.c linux-2.6.32.11/grsecurity/grsec_fork.c
---- linux-2.6.32.11/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_fork.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,15 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
-+		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_init.c linux-2.6.32.11/grsecurity/grsec_init.c
---- linux-2.6.32.11/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_init.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,241 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execve;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+	int j;
-+	/* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+	for (j = 0; j < 4; j++) {
-+		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+		if (gr_shared_page[j] == NULL) {
-+			panic("Unable to allocate grsecurity shared page");
-+			return;
-+		}
-+	}
-+
-+	/* allocate log buffers */
-+	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_alert_log_fmt) {
-+		panic("Unable to allocate grsecurity alert log format buffer");
-+		return;
-+	}
-+	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_audit_log_fmt) {
-+		panic("Unable to allocate grsecurity audit log format buffer");
-+		return;
-+	}
-+	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_alert_log_buf) {
-+		panic("Unable to allocate grsecurity alert log buffer");
-+		return;
-+	}
-+	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_audit_log_buf) {
-+		panic("Unable to allocate grsecurity audit log buffer");
-+		return;
-+	}
-+
-+	/* allocate memory for authentication structure */
-+	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+		panic("Unable to allocate grsecurity authentication structure");
-+		return;
-+	}
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+	grsec_lock = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	grsec_enable_group = 1;
-+	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	grsec_enable_blackhole = 1;
-+	grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	grsec_enable_execve = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	grsec_enable_tpe = 1;
-+	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	grsec_enable_socket_all = 1;
-+	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	grsec_enable_socket_client = 1;
-+	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	grsec_enable_socket_server = 1;
-+	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_link.c linux-2.6.32.11/grsecurity/grsec_link.c
---- linux-2.6.32.11/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_link.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,43 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+		      const struct inode *inode,
-+		      const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+		   const struct vfsmount *mnt,
-+		   struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+	    (!S_ISREG(mode) || (mode & S_ISUID) ||
-+	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
-+	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
-+	    !capable(CAP_FOWNER) && cred->uid) {
-+		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_log.c linux-2.6.32.11/grsecurity/grsec_log.c
---- linux-2.6.32.11/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_log.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,296 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#define BEGIN_LOCKS(x) \
-+	rcu_read_lock(); \
-+	read_lock(&tasklist_lock); \
-+	read_lock(&grsec_exec_file_lock); \
-+	if (x != GR_DO_AUDIT) \
-+		spin_lock(&grsec_alert_lock); \
-+	else \
-+		spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+	if (x != GR_DO_AUDIT) \
-+		spin_unlock(&grsec_alert_lock); \
-+	else \
-+		spin_unlock(&grsec_audit_lock); \
-+	read_unlock(&grsec_exec_file_lock); \
-+	read_unlock(&tasklist_lock); \
-+	rcu_read_unlock(); \
-+	if (x == GR_DONT_AUDIT) \
-+		gr_handle_alertkill(current)
-+
-+enum {
-+	FLOODING,
-+	NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+	if (audit == GR_DO_AUDIT)
-+		goto set_fmt;
-+
-+	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet = 0;
-+	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+		grsec_alert_fyet++;
-+	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet++;
-+		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+		return FLOODING;
-+	} else return FLOODING;
-+
-+set_fmt:
-+	memset(buf, 0, PAGE_SIZE);
-+	if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else if (current->signal->curr_ip) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
-+	} else if (gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+		strcpy(buf, fmt);
-+	}
-+
-+	return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+	__attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+	return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+	__attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+	va_list ap;
-+
-+	va_start(ap, msg);
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+	va_end(ap);
-+
-+	return;
-+}
-+
-+static void gr_log_end(int audit)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
-+	printk("%s\n", buf);
-+
-+	return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+	int logtype;
-+	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+	char *str1, *str2, *str3;
-+	void *voidptr;
-+	int num1, num2;
-+	unsigned long ulong1, ulong2;
-+	struct dentry *dentry;
-+	struct vfsmount *mnt;
-+	struct file *file;
-+	struct task_struct *task;
-+	const struct cred *cred, *pcred;
-+	va_list ap;
-+
-+	BEGIN_LOCKS(audit);
-+	logtype = gr_log_start(audit);
-+	if (logtype == FLOODING) {
-+		END_LOCKS(audit);
-+		return;
-+	}
-+	va_start(ap, argtypes);
-+	switch (argtypes) {
-+	case GR_TTYSNIFF:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
-+		break;
-+	case GR_SYSCTL_HIDDEN:
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, str1);
-+		break;
-+	case GR_RBAC:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_STR_RBAC:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_MODE2:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+		break;
-+	case GR_RBAC_MODE3:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		str3 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+		break;
-+	case GR_FILENAME:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_STR_FILENAME:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_FILENAME_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_FILENAME_TWO_INT:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+		break;
-+	case GR_FILENAME_TWO_INT_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+		break;
-+	case GR_TEXTREL:
-+		file = va_arg(ap, struct file *);
-+		ulong1 = va_arg(ap, unsigned long);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+		break;
-+	case GR_PTRACE:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+		break;
-+	case GR_RESOURCE:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		str1 = va_arg(ap, char *);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CAP:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_SIG:
-+		str1 = va_arg(ap, char *);
-+		voidptr = va_arg(ap, void *);
-+		gr_log_middle_varargs(audit, msg, str1, voidptr);
-+		break;
-+	case GR_SIG2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		num1 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CRASH1:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+		break;
-+	case GR_CRASH2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+		break;
-+	case GR_PSACCT:
-+		{
-+			unsigned int wday, cday;
-+			__u8 whr, chr;
-+			__u8 wmin, cmin;
-+			__u8 wsec, csec;
-+			char cur_tty[64] = { 0 };
-+			char parent_tty[64] = { 0 };
-+
-+			task = va_arg(ap, struct task_struct *);
-+			wday = va_arg(ap, unsigned int);
-+			cday = va_arg(ap, unsigned int);
-+			whr = va_arg(ap, int);
-+			chr = va_arg(ap, int);
-+			wmin = va_arg(ap, int);
-+			cmin = va_arg(ap, int);
-+			wsec = va_arg(ap, int);
-+			csec = va_arg(ap, int);
-+			ulong1 = va_arg(ap, unsigned long);
-+			cred = __task_cred(task);
-+			pcred = __task_cred(task->parent);
-+
-+			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		}
-+		break;
-+	default:
-+		gr_log_middle(audit, msg, ap);
-+	}
-+	va_end(ap);
-+	gr_log_end(audit);
-+	END_LOCKS(audit);
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_mem.c linux-2.6.32.11/grsecurity/grsec_mem.c
---- linux-2.6.32.11/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_mem.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,85 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_mem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_kmem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_open_port(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
-+	return;
-+}
-+
-+int
-+gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
-+{
-+	unsigned long start, end;
-+
-+	start = offset;
-+	end = start + vma->vm_end - vma->vm_start;
-+
-+	if (start > end) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	}
-+
-+	/* allowed ranges : ISA I/O BIOS */
-+	if ((start >= __pa(high_memory))
-+#if defined(CONFIG_X86) || defined(CONFIG_PPC)
-+	    || (start >= 0x000a0000 && end <= 0x00100000)
-+	    || (start >= 0x00000000 && end <= 0x00001000)
-+#endif
-+	)
-+		return 0;
-+
-+	if (vma->vm_flags & VM_WRITE) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	} else
-+		vma->vm_flags &= ~VM_MAYWRITE;
-+
-+	return 0;
-+}
-+
-+void
-+gr_log_nonroot_mod_load(const char *modname)
-+{
-+        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
-+        return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_mount.c linux-2.6.32.11/grsecurity/grsec_mount.c
---- linux-2.6.32.11/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_mount.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,62 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_ptrace.c linux-2.6.32.11/grsecurity/grsec_ptrace.c
---- linux-2.6.32.11/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_ptrace.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,14 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	if (grsec_enable_audit_ptrace)
-+		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_sig.c linux-2.6.32.11/grsecurity/grsec_sig.c
---- linux-2.6.32.11/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_sig.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+char *signames[] = {
-+	[SIGSEGV] = "Segmentation fault",
-+	[SIGILL] = "Illegal instruction",
-+	[SIGABRT] = "Abort",
-+	[SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+				    (sig == SIGABRT) || (sig == SIGBUS))) {
-+		if (t->pid == current->pid) {
-+			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+		} else {
-+			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+		}
-+	}
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (current->pid > 1 && gr_check_protected_task(p)) {
-+		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+		return -EPERM;
-+	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void gr_handle_brute_attach(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	if (p->parent && p->parent->exec_file == p->exec_file)
-+		p->parent->brute = 1;
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	if (current->brute)
-+		msleep(30 * 1000);
-+#endif
-+	return;
-+}
-+
-diff -urNp linux-2.6.32.11/grsecurity/grsec_sock.c linux-2.6.32.11/grsecurity/grsec_sock.c
---- linux-2.6.32.11/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_sock.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,271 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+	struct conn_table_entry *next;
-+	struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+
-+static __inline__ int 
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
-+	   __u16 sport, __u16 dport)
-+{
-+	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+		     sig->gr_sport == sport && sig->gr_dport == dport))
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+	struct conn_table_entry **match;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	newent->sig = sig;
-+	
-+	match = &gr_conn_table[index];
-+	newent->next = *match;
-+	*match = newent;
-+
-+	return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+	struct conn_table_entry *match, *last = NULL;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, 
-+		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
-+		sig->gr_dport)) {
-+		last = match;
-+		match = match->next;
-+	}
-+
-+	if (match) {
-+		if (last)
-+			last->next = match->next;
-+		else
-+			gr_conn_table[index] = NULL;
-+		kfree(match);
-+	}
-+
-+	return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+					     __u16 sport, __u16 dport)
-+{
-+	struct conn_table_entry *match;
-+	unsigned int index;
-+
-+	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+		match = match->next;
-+
-+	if (match)
-+		return match->sig;
-+	else
-+		return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *sig = task->signal;
-+	struct conn_table_entry *newent;
-+
-+	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+	if (newent == NULL)
-+		return;
-+	/* no bh lock needed since we are called with bh disabled */
-+	spin_lock(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(sig);
-+	sig->gr_saddr = inet->rcv_saddr;
-+	sig->gr_daddr = inet->daddr;
-+	sig->gr_sport = inet->sport;
-+	sig->gr_dport = inet->dport;
-+	gr_add_to_task_ip_table_nolock(sig, newent);
-+	spin_unlock(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	spin_lock_bh(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(task->signal);
-+	spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *p, *set;
-+	const struct inet_sock *inet = inet_sk(sk);	
-+
-+	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+		return;
-+
-+	set = current->signal;
-+
-+	spin_lock_bh(&gr_conn_table_lock);
-+	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+				    inet->dport, inet->sport);
-+	if (unlikely(p != NULL)) {
-+		set->curr_ip = p->curr_ip;
-+		set->used_accept = 1;
-+		gr_del_task_from_ip_table_nolock(p);
-+		spin_unlock_bh(&gr_conn_table_lock);
-+		return;
-+	}
-+	spin_unlock_bh(&gr_conn_table_lock);
-+
-+	set->curr_ip = inet->daddr;
-+	set->used_accept = 1;
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+	    (family != AF_UNIX) && (family != AF_LOCAL)) {
-+		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sk_family != AF_UNIX) &&
-+	    (sck->sk_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_acl_is_enabled())
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_ISCSI &&
-+		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+		 gr_is_capable(CAP_SYS_ADMIN))
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_AUDIT &&
-+		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+		 gr_is_capable(CAP_AUDIT_WRITE) &&
-+		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+		 gr_is_capable(CAP_AUDIT_CONTROL))
-+		return current_cap();
-+	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
-+		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
-+		  gr_is_capable(CAP_NET_ADMIN)))
-+		return current_cap();
-+	else
-+		return __cap_empty_set;
-+#else
-+	return current_cap();
-+#endif
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_sysctl.c linux-2.6.32.11/grsecurity/grsec_sysctl.c
---- linux-2.6.32.11/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_sysctl.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,447 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+static int __maybe_unused one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "linking_restrictions",
-+		.data		= &grsec_enable_link,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "fifo_restrictions",
-+		.data		= &grsec_enable_fifo,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "execve_limiting",
-+		.data		= &grsec_enable_execve,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "ip_blackhole",
-+		.data		= &grsec_enable_blackhole,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "lastack_retries",
-+		.data		= &grsec_lastack_retries,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "exec_logging",
-+		.data		= &grsec_enable_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "signal_logging",
-+		.data		= &grsec_enable_signal,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "forkfail_logging",
-+		.data		= &grsec_enable_forkfail,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "timechange_logging",
-+		.data		= &grsec_enable_time,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_shmat",
-+		.data		= &grsec_enable_chroot_shmat,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_unix",
-+		.data		= &grsec_enable_chroot_unix,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mount",
-+		.data		= &grsec_enable_chroot_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_fchdir",
-+		.data		= &grsec_enable_chroot_fchdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chroot",
-+		.data		= &grsec_enable_chroot_double,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_pivot",
-+		.data		= &grsec_enable_chroot_pivot,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_enforce_chdir",
-+		.data		= &grsec_enable_chroot_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chmod",
-+		.data		= &grsec_enable_chroot_chmod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mknod",
-+		.data		= &grsec_enable_chroot_mknod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_restrict_nice",
-+		.data		= &grsec_enable_chroot_nice,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_execlog",
-+		.data		= &grsec_enable_chroot_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_caps",
-+		.data		= &grsec_enable_chroot_caps,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_sysctl",
-+		.data		= &grsec_enable_chroot_sysctl,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe",
-+		.data		= &grsec_enable_tpe,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_gid",
-+		.data		= &grsec_tpe_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_restrict_all",
-+		.data		= &grsec_enable_tpe_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all",
-+		.data		= &grsec_enable_socket_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all_gid",
-+		.data		= &grsec_socket_all_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client",
-+		.data		= &grsec_enable_socket_client,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client_gid",
-+		.data		= &grsec_socket_client_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server",
-+		.data		= &grsec_enable_socket_server,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server_gid",
-+		.data		= &grsec_socket_server_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_group",
-+		.data		= &grsec_enable_group,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_gid",
-+		.data		= &grsec_audit_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_chdir",
-+		.data		= &grsec_enable_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_mount",
-+		.data		= &grsec_enable_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_textrel",
-+		.data		= &grsec_enable_audit_textrel,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "dmesg",
-+		.data		= &grsec_enable_dmesg,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_findtask",
-+		.data		= &grsec_enable_chroot_findtask,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "resource_logging",
-+		.data		= &grsec_resource_logging,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_ptrace",
-+		.data		= &grsec_enable_audit_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "harden_ptrace",
-+		.data		= &grsec_enable_harden_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsec_lock",
-+		.data		= &grsec_lock,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "romount_protect",
-+		.data		= &grsec_enable_rofs,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec_minmax,
-+		.extra1		= &one,
-+		.extra2		= &one,
-+	},
-+#endif
-+	{ .ctl_name = 0 }
-+};
-+#endif
-diff -urNp linux-2.6.32.11/grsecurity/grsec_textrel.c linux-2.6.32.11/grsecurity/grsec_textrel.c
---- linux-2.6.32.11/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_textrel.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	if (grsec_enable_audit_textrel)
-+		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_time.c linux-2.6.32.11/grsecurity/grsec_time.c
---- linux-2.6.32.11/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_time.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,13 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	if (grsec_enable_time)
-+		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsec_tpe.c linux-2.6.32.11/grsecurity/grsec_tpe.c
---- linux-2.6.32.11/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsec_tpe.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,38 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+	const struct cred *cred = current_cred();
-+
-+	if (cred->uid && ((grsec_enable_tpe &&
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+	    !in_group_p(grsec_tpe_gid)
-+#else
-+	    in_group_p(grsec_tpe_gid)
-+#endif
-+	    ) || gr_acl_tpe_check()) &&
-+	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
-+						(inode->i_mode & S_IWOTH))))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
-+	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
-+	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#endif
-+#endif
-+	return 1;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/grsum.c linux-2.6.32.11/grsecurity/grsum.c
---- linux-2.6.32.11/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/grsum.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,59 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+	char *p;
-+	struct crypto_hash *tfm;
-+	struct hash_desc desc;
-+	struct scatterlist sg;
-+	unsigned char temp_sum[GR_SHA_LEN];
-+	volatile int retval = 0;
-+	volatile int dummy = 0;
-+	unsigned int i;
-+
-+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+	if (IS_ERR(tfm)) {
-+		/* should never happen, since sha256 should be built in */
-+		return 1;
-+	}
-+
-+	desc.tfm = tfm;
-+	desc.flags = 0;
-+
-+	crypto_hash_init(&desc);
-+
-+	p = salt;
-+	sg_set_buf(&sg, p, GR_SALT_LEN);
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	p = entry->pw;
-+	sg_set_buf(&sg, p, strlen(p));
-+	
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	crypto_hash_final(&desc, temp_sum);
-+
-+	memset(entry->pw, 0, GR_PW_LEN);
-+
-+	for (i = 0; i < GR_SHA_LEN; i++)
-+		if (sum[i] != temp_sum[i])
-+			retval = 1;
-+		else
-+			dummy = 1;	// waste a cycle
-+
-+	crypto_free_hash(tfm);
-+
-+	return retval;
-+}
-diff -urNp linux-2.6.32.11/grsecurity/Kconfig linux-2.6.32.11/grsecurity/Kconfig
---- linux-2.6.32.11/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/Kconfig	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,965 @@
-+#
-+# grecurity configuration
-+#
-+
-+menu "Grsecurity"
-+
-+config GRKERNSEC
-+	bool "Grsecurity"
-+	select CRYPTO
-+	select CRYPTO_SHA256
-+	help
-+	  If you say Y here, you will be able to configure many features
-+	  that will enhance the security of your system.  It is highly
-+	  recommended that you say Y here and read through the help
-+	  for each option so that you fully understand the features and
-+	  can evaluate their usefulness for your machine.
-+
-+choice
-+	prompt "Security Level"
-+	depends on GRKERNSEC
-+	default GRKERNSEC_CUSTOM
-+
-+config GRKERNSEC_LOW
-+	bool "Low"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_CHDIR
-+
-+	help
-+	  If you choose this option, several of the grsecurity options will
-+	  be enabled that will give you greater protection against a number
-+	  of attacks, while assuring that none of your software will have any
-+	  conflicts with the additional security measures.  If you run a lot
-+	  of unusual software, or you are having problems with the higher
-+	  security levels, you should say Y here.  With this option, the
-+	  following features are enabled:
-+
-+	  - Linking restrictions
-+	  - FIFO restrictions
-+	  - Enforcing RLIMIT_NPROC on execve
-+	  - Restricted dmesg
-+	  - Enforced chdir("/") on chroot
-+	  - Runtime module disabling
-+
-+config GRKERNSEC_MEDIUM
-+	bool "Medium"
-+	select PAX
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_USERGROUP
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
-+
-+	help
-+	  If you say Y here, several features in addition to those included
-+	  in the low additional security level will be enabled.  These
-+	  features provide even more security to your system, though in rare
-+	  cases they may be incompatible with very old or poorly written
-+	  software.  If you enable this option, make sure that your auth
-+	  service (identd) is running as gid 1001.  With this option, 
-+	  the following features (in addition to those provided in the 
-+	  low additional security level) will be enabled:
-+
-+	  - Failed fork logging
-+	  - Time change logging
-+	  - Signal logging
-+	  - Deny mounts in chroot
-+	  - Deny double chrooting
-+	  - Deny sysctl writes in chroot
-+	  - Deny mknod in chroot
-+	  - Deny access to abstract AF_UNIX sockets out of chroot
-+	  - Deny pivot_root in chroot
-+	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
-+	  - /proc restrictions with special GID set to 10 (usually wheel)
-+	  - Address Space Layout Randomization (ASLR)
-+	  - Prevent exploitation of most refcount overflows
-+	  - Bounds checking of copying between the kernel and userland
-+
-+config GRKERNSEC_HIGH
-+	bool "High"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SHMAT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_FCHDIR
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_CHROOT_CAPS
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_CHROOT_FINDTASK
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_HIDESYM
-+	select GRKERNSEC_BRUTE
-+	select GRKERNSEC_PROC_USERGROUP
-+	select GRKERNSEC_KMEM
-+	select GRKERNSEC_RESLOG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_PROC_ADD
-+	select GRKERNSEC_CHROOT_CHMOD
-+	select GRKERNSEC_CHROOT_NICE
-+	select GRKERNSEC_AUDIT_MOUNT
-+	select GRKERNSEC_MODHARDEN if (MODULES)
-+	select GRKERNSEC_HARDEN_PTRACE
-+	select GRKERNSEC_VM86 if (X86_32)
-+	select PAX
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_NOEXEC
-+	select PAX_MPROTECT
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
-+	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
-+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
-+	select PAX_SEGMEXEC if (X86_32)
-+	select PAX_PAGEEXEC
-+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
-+	select PAX_EMUTRAMP if (PARISC)
-+	select PAX_EMUSIGRT if (PARISC)
-+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
-+	help
-+	  If you say Y here, many of the features of grsecurity will be
-+	  enabled, which will protect you against many kinds of attacks
-+	  against your system.  The heightened security comes at a cost
-+	  of an increased chance of incompatibilities with rare software
-+	  on your machine.  Since this security level enables PaX, you should
-+	  view <http://pax.grsecurity.net> and read about the PaX
-+	  project.  While you are there, download chpax and run it on
-+	  binaries that cause problems with PaX.  Also remember that
-+	  since the /proc restrictions are enabled, you must run your
-+	  identd as gid 1001.  This security level enables the following 
-+	  features in addition to those listed in the low and medium 
-+	  security levels:
-+
-+	  - Additional /proc restrictions
-+	  - Chmod restrictions in chroot
-+	  - No signals, ptrace, or viewing of processes outside of chroot
-+	  - Capability restrictions in chroot
-+	  - Deny fchdir out of chroot
-+	  - Priority restrictions in chroot
-+	  - Segmentation-based implementation of PaX
-+	  - Mprotect restrictions
-+	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
-+	  - Kernel stack randomization
-+	  - Mount/unmount/remount logging
-+	  - Kernel symbol hiding
-+	  - Prevention of memory exhaustion-based exploits
-+	  - Hardening of module auto-loading
-+	  - Ptrace restrictions
-+	  - Restricted vm86 mode
-+
-+config GRKERNSEC_CUSTOM
-+	bool "Custom"
-+	help
-+	  If you say Y here, you will be able to configure every grsecurity
-+	  option, which allows you to enable many more features that aren't
-+	  covered in the basic security levels.  These additional features
-+	  include TPE, socket restrictions, and the sysctl system for
-+	  grsecurity.  It is advised that you read through the help for
-+	  each option to determine its usefulness in your situation.
-+
-+endchoice
-+
-+menu "Address Space Protection"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
-+	help
-+	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+	  be written to via mmap or otherwise to modify the running kernel.
-+	  /dev/port will also not be allowed to be opened. If you have module
-+	  support disabled, enabling this will close up four ways that are
-+	  currently used  to insert malicious code into the running kernel.
-+	  Even with all these features enabled, we still highly recommend that
-+	  you use the RBAC system, as it is still possible for an attacker to
-+	  modify the running kernel through privileged I/O granted by ioperm/iopl.
-+	  If you are not using XFree86, you may be able to stop this additional
-+	  case by enabling the 'Disable privileged I/O' option. Though nothing
-+	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+	  but only to video memory, which is the only writing we allow in this
-+	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+	  not be allowed to mprotect it with PROT_WRITE later.
-+	  It is highly recommended that you say Y here if you meet all the
-+	  conditions above.
-+
-+config GRKERNSEC_VM86
-+	bool "Restrict VM86 mode"
-+	depends on X86_32
-+
-+	help
-+	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+	  make use of a special execution mode on 32bit x86 processors called
-+	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
-+	  video cards and will still work with this option enabled.  The purpose
-+	  of the option is to prevent exploitation of emulation errors in
-+	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+	  Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+	bool "Disable privileged I/O"
-+	depends on X86
-+	select RTC_CLASS
-+	select RTC_INTF_DEV
-+	select RTC_DRV_CMOS
-+
-+	help
-+	  If you say Y here, all ioperm and iopl calls will return an error.
-+	  Ioperm and iopl can be used to modify the running kernel.
-+	  Unfortunately, some programs need this access to operate properly,
-+	  the most notable of which are XFree86 and hwclock.  hwclock can be
-+	  remedied by having RTC support in the kernel, so real-time 
-+	  clock support is enabled if this option is enabled, to ensure 
-+	  that hwclock operates correctly.  XFree86 still will not 
-+	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
-+	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
-+	  protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
-+	default y if (PAX_NOEXEC || PAX_ASLR)
-+	depends on PAX_NOEXEC || PAX_ASLR
-+	help
-+	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+	  give no information about the addresses of its mappings if
-+	  PaX features that rely on random addresses are enabled on the task.
-+	  If you use PaX it is greatly recommended that you say Y here as it
-+	  closes up a hole that makes the full ASLR useless for suid
-+	  binaries.
-+
-+config GRKERNSEC_BRUTE
-+	bool "Deter exploit bruteforcing"
-+	help
-+	  If you say Y here, attempts to bruteforce exploits against forking
-+	  daemons such as apache or sshd will be deterred.  When a child of a
-+	  forking daemon is killed by PaX or crashes due to an illegal
-+	  instruction, the parent process will be delayed 30 seconds upon every
-+	  subsequent fork until the administrator is able to assess the
-+	  situation and restart the daemon.  It is recommended that you also
-+	  enable signal logging in the auditing section so that logs are
-+	  generated when a process performs an illegal instruction.
-+
-+config GRKERNSEC_MODHARDEN
-+	bool "Harden module auto-loading"
-+	depends on MODULES
-+	help
-+	  If you say Y here, module auto-loading in response to use of some
-+	  feature implemented by an unloaded module will be restricted to
-+	  root users.  Enabling this option helps defend against attacks 
-+	  by unprivileged users who abuse the auto-loading behavior to 
-+	  cause a vulnerable module to load that is then exploited.
-+
-+	  If this option prevents a legitimate use of auto-loading for a 
-+	  non-root user, the administrator can execute modprobe manually 
-+	  with the exact name of the module mentioned in the alert log.
-+	  Alternatively, the administrator can add the module to the list
-+	  of modules loaded at boot by modifying init scripts.
-+
-+	  Modification of init scripts will most likely be needed on 
-+	  Ubuntu servers with encrypted home directory support enabled,
-+	  as the first non-root user logging in will cause the ecb(aes),
-+	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+	bool "Hide kernel symbols"
-+	help
-+	  If you say Y here, getting information on loaded modules, and
-+	  displaying all kernel symbols through a syscall will be restricted
-+	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
-+	  /proc/kallsyms will be restricted to the root user.  The RBAC
-+	  system can hide that entry even from root.  Note that this option
-+	  is only effective provided the following conditions are met:
-+	  1) The kernel using grsecurity is not precompiled by some distribution
-+	  2) You are using the RBAC system and hiding other files such as your
-+	     kernel image and System.map.  Alternatively, enabling this option
-+	     causes the permissions on /boot, /lib/modules, and the kernel
-+	     source directory to change at compile time to prevent 
-+	     reading by non-root users.
-+	  If the above conditions are met, this option will aid in providing a
-+	  useful protection against local kernel exploitation of overflows
-+	  and arbitrary read/write vulnerabilities.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_NO_RBAC
-+	bool "Disable RBAC system"
-+	help
-+	  If you say Y here, the /dev/grsec device will be removed from the kernel,
-+	  preventing the RBAC system from being enabled.  You should only say Y
-+	  here if you have no intention of using the RBAC system, so as to prevent
-+	  an attacker with root access from misusing the RBAC system to hide files
-+	  and processes when loadable module support and /dev/[k]mem have been
-+	  locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+	bool "Hide kernel processes"
-+	help
-+	  If you say Y here, all kernel threads will be hidden to all
-+	  processes but those whose subject has the "view hidden processes"
-+	  flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+	int "Maximum tries before password lockout"
-+	default 3
-+	help
-+	  This option enforces the maximum number of times a user can attempt
-+	  to authorize themselves with the grsecurity RBAC system before being
-+	  denied the ability to attempt authorization again for a specified time.
-+	  The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+	int "Time to wait after max password tries, in seconds"
-+	default 30
-+	help
-+	  This option specifies the time the user must wait after attempting to
-+	  authorize to the RBAC system with the maximum number of invalid
-+	  passwords.  The higher the number, the harder it will be to brute-force
-+	  a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+	bool "Proc restrictions"
-+	help
-+	  If you say Y here, the permissions of the /proc filesystem
-+	  will be altered to enhance system security and privacy.  You MUST
-+  	  choose either a user only restriction or a user and group restriction.
-+	  Depending upon the option you choose, you can either restrict users to
-+	  see only the processes they themselves run, or choose a group that can
-+	  view all processes and files normally restricted to root if you choose
-+	  the "restrict to user only" option.  NOTE: If you're running identd as
-+	  a non-root user, you will have to run it as the group you specify here.
-+
-+config GRKERNSEC_PROC_USER
-+	bool "Restrict /proc to user only"
-+	depends on GRKERNSEC_PROC
-+	help
-+	  If you say Y here, non-root users will only be able to view their own
-+	  processes, and restricts them from viewing network-related information,
-+	  and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+	bool "Allow special group"
-+	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+	help
-+	  If you say Y here, you will be able to select a group that will be
-+	  able to view all processes, network-related information, and
-+	  kernel and symbol information.  This option is useful if you want
-+	  to run identd as a non-root user.
-+
-+config GRKERNSEC_PROC_GID
-+	int "GID for special group"
-+	depends on GRKERNSEC_PROC_USERGROUP
-+	default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+	bool "Additional restrictions"
-+	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+	help
-+	  If you say Y here, additional restrictions will be placed on
-+	  /proc that keep normal users from viewing device information and 
-+	  slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+	bool "Linking restrictions"
-+	help
-+	  If you say Y here, /tmp race exploits will be prevented, since users
-+	  will no longer be able to follow symlinks owned by other users in
-+	  world-writable +t directories (i.e. /tmp), unless the owner of the
-+	  symlink is the owner of the directory. users will also not be
-+	  able to hardlink to files they do not own.  If the sysctl option is
-+	  enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_FIFO
-+	bool "FIFO restrictions"
-+	help
-+	  If you say Y here, users will not be able to write to FIFOs they don't
-+	  own in world-writable +t directories (i.e. /tmp), unless the owner of
-+	  the FIFO is the same owner of the directory it's held in.  If the sysctl
-+	  option is enabled, a sysctl option with name "fifo_restrictions" is
-+	  created.
-+
-+config GRKERNSEC_ROFS
-+	bool "Runtime read-only mount protection"
-+	help
-+	  If you say Y here, a sysctl option with name "romount_protect" will
-+	  be created.  By setting this option to 1 at runtime, filesystems
-+	  will be protected in the following ways:
-+	  * No new writable mounts will be allowed
-+	  * Existing read-only mounts won't be able to be remounted read/write
-+	  * Write operations will be denied on all block devices
-+	  This option acts independently of grsec_lock: once it is set to 1,
-+	  it cannot be turned off.  Therefore, please be mindful of the resulting
-+	  behavior if this option is enabled in an init script on a read-only
-+	  filesystem.  This feature is mainly intended for secure embedded systems.
-+
-+config GRKERNSEC_CHROOT
-+	bool "Chroot jail restrictions"
-+	help
-+	  If you say Y here, you will be able to choose several options that will
-+	  make breaking out of a chrooted jail much more difficult.  If you
-+	  encounter no software incompatibilities with the following options, it
-+	  is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+	bool "Deny mounts"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  mount or remount filesystems.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+	bool "Deny double-chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chroot
-+	  again outside the chroot.  This is a widely used method of breaking
-+	  out of a chroot jail and should not be allowed.  If the sysctl 
-+	  option is enabled, a sysctl option with name 
-+	  "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+	bool "Deny pivot_root in chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to use
-+	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
-+	  works similar to chroot in that it changes the root filesystem.  This
-+	  function could be misused in a chrooted process to attempt to break out
-+	  of the chroot, and therefore should not be allowed.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+	bool "Enforce chdir(\"/\") on all chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the current working directory of all newly-chrooted
-+	  applications will be set to the the root directory of the chroot.
-+	  The man page on chroot(2) states:
-+	  Note that this call does not change  the  current  working
-+	  directory,  so  that `.' can be outside the tree rooted at
-+	  `/'.  In particular, the  super-user  can  escape  from  a
-+	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+	  It is recommended that you say Y here, since it's not known to break
-+	  any software.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+	bool "Deny (f)chmod +s"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chmod
-+	  or fchmod files to make them have suid or sgid bits.  This protects
-+	  against another published method of breaking a chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+	bool "Deny fchdir out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+	  to a file descriptor of the chrooting process that points to a directory
-+	  outside the filesystem will be stopped.  If the sysctl option
-+	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+	bool "Deny mknod"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be allowed to
-+	  mknod.  The problem with using mknod inside a chroot is that it
-+	  would allow an attacker to create a device entry that is the same
-+	  as one on the physical root of your system, which could range from
-+	  anything from the console device to a device for your harddrive (which
-+	  they could then use to wipe the drive or steal data).  It is recommended
-+	  that you say Y here, unless you run into software incompatibilities.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+	bool "Deny shmat() out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to attach
-+	  to shared memory segments that were created outside of the chroot jail.
-+	  It is recommended that you say Y here.  If the sysctl option is enabled,
-+	  a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+	bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  connect to abstract (meaning not belonging to a filesystem) Unix
-+	  domain sockets that were bound outside of a chroot.  It is recommended
-+	  that you say Y here.  If the sysctl option is enabled, a sysctl option
-+	  with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+	bool "Protect outside processes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
-+	  getsid, or view any process outside of the chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_findtask" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+	bool "Restrict priority changes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to raise
-+	  the priority of processes in the chroot, or alter the priority of
-+	  processes outside the chroot.  This provides more security than simply
-+	  removing CAP_SYS_NICE from the process' capability set.  If the
-+	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+	  is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+	bool "Deny sysctl writes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, an attacker in a chroot will not be able to
-+	  write to sysctl entries, either by sysctl(2) or through a /proc
-+	  interface.  It is strongly recommended that you say Y here. If the
-+	  sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+	bool "Capability restrictions"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the capabilities on all root processes within a
-+	  chroot jail will be lowered to stop module insertion, raw i/o,
-+	  system and net admin tasks, rebooting the system, modifying immutable
-+	  files, modifying IPC owned by another, and changing the system time.
-+	  This is left an option because it can break some apps.  Disable this
-+	  if your chrooted apps are having problems performing those kinds of
-+	  tasks.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_caps" is created.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+	bool "Single group for auditing"
-+	help
-+	  If you say Y here, the exec, chdir, and (un)mount logging features
-+	  will only operate on a group you specify.  This option is recommended
-+	  if you only want to watch certain users instead of having a large
-+	  amount of logs from the entire system.  If the sysctl option is enabled,
-+	  a sysctl option with name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+	int "GID for auditing"
-+	depends on GRKERNSEC_AUDIT_GROUP
-+	default 1007
-+
-+config GRKERNSEC_EXECLOG
-+	bool "Exec logging"
-+	help
-+	  If you say Y here, all execve() calls will be logged (since the
-+	  other exec*() calls are frontends to execve(), all execution
-+	  will be logged).  Useful for shell-servers that like to keep track
-+	  of their users.  If the sysctl option is enabled, a sysctl option with
-+	  name "exec_logging" is created.
-+	  WARNING: This option when enabled will produce a LOT of logs, especially
-+	  on an active system.
-+
-+config GRKERNSEC_RESLOG
-+	bool "Resource logging"
-+	help
-+	  If you say Y here, all attempts to overstep resource limits will
-+	  be logged with the resource name, the requested size, and the current
-+	  limit.  It is highly recommended that you say Y here.  If the sysctl
-+	  option is enabled, a sysctl option with name "resource_logging" is
-+	  created.  If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+	bool "Log execs within chroot"
-+	help
-+	  If you say Y here, all executions inside a chroot jail will be logged
-+	  to syslog.  This can cause a large amount of logs if certain
-+	  applications (eg. djb's daemontools) are installed on the system, and
-+	  is therefore left as an option.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+	bool "Ptrace logging"
-+	help
-+	  If you say Y here, all attempts to attach to a process via ptrace
-+	  will be logged.  If the sysctl option is enabled, a sysctl option
-+	  with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+	bool "Chdir logging"
-+	help
-+	  If you say Y here, all chdir() calls will be logged.  If the sysctl
-+ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+	bool "(Un)Mount logging"
-+	help
-+	  If you say Y here, all mounts and unmounts will be logged.  If the
-+	  sysctl option is enabled, a sysctl option with name "audit_mount" is
-+	  created.
-+
-+config GRKERNSEC_SIGNAL
-+	bool "Signal logging"
-+	help
-+	  If you say Y here, certain important signals will be logged, such as
-+	  SIGSEGV, which will as a result inform you of when a error in a program
-+	  occurred, which in some cases could mean a possible exploit attempt.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+	bool "Fork failure logging"
-+	help
-+	  If you say Y here, all failed fork() attempts will be logged.
-+	  This could suggest a fork bomb, or someone attempting to overstep
-+	  their process limit.  If the sysctl option is enabled, a sysctl option
-+	  with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+	bool "Time change logging"
-+	help
-+	  If you say Y here, any changes of the system clock will be logged.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+	bool "/proc/<pid>/ipaddr support"
-+	help
-+	  If you say Y here, a new entry will be added to each /proc/<pid>
-+	  directory that contains the IP address of the person using the task.
-+	  The IP is carried across local TCP and AF_UNIX stream sockets.
-+	  This information can be useful for IDS/IPSes to perform remote response
-+	  to a local attack.  The entry is readable by only the owner of the
-+	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+	  the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+	bool 'ELF text relocations logging (READ HELP)'
-+	depends on PAX_MPROTECT
-+	help
-+	  If you say Y here, text relocations will be logged with the filename
-+	  of the offending library or binary.  The purpose of the feature is
-+	  to help Linux distribution developers get rid of libraries and
-+	  binaries that need text relocations which hinder the future progress
-+	  of PaX.  Only Linux distribution developers should say Y here, and
-+	  never on a production machine, as this option creates an information
-+	  leak that could aid an attacker in defeating the randomization of
-+	  a single memory region.  If the sysctl option is enabled, a sysctl
-+	  option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_EXECVE
-+	bool "Enforce RLIMIT_NPROC on execs"
-+	help
-+	  If you say Y here, users with a resource limit on processes will
-+	  have the value checked during execve() calls.  The current system
-+	  only checks the system limit during fork() calls.  If the sysctl option
-+	  is enabled, a sysctl option with name "execve_limiting" is created.
-+
-+config GRKERNSEC_DMESG
-+	bool "Dmesg(8) restriction"
-+	help
-+	  If you say Y here, non-root users will not be able to use dmesg(8)
-+	  to view up to the last 4kb of messages in the kernel's log buffer.
-+	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+	  created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+	bool "Deter ptrace-based process snooping"
-+	help
-+	  If you say Y here, TTY sniffers and other malicious monitoring
-+	  programs implemented through ptrace will be defeated.  If you
-+	  have been using the RBAC system, this option has already been
-+	  enabled for several years for all users, with the ability to make
-+	  fine-grained exceptions.
-+
-+	  This option only affects the ability of non-root users to ptrace
-+	  processes that are not a descendent of the ptracing process.
-+	  This means that strace ./binary and gdb ./binary will still work,
-+	  but attaching to arbitrary processes will not.  If the sysctl
-+	  option is enabled, a sysctl option with name "harden_ptrace" is
-+	  created.
-+
-+config GRKERNSEC_TPE
-+	bool "Trusted Path Execution (TPE)"
-+	help
-+	  If you say Y here, you will be able to choose a gid to add to the
-+	  supplementary groups of users you want to mark as "untrusted."
-+	  These users will not be able to execute any files that are not in
-+	  root-owned directories writable only by root.  If the sysctl option
-+	  is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+	bool "Partially restrict non-root users"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, All non-root users other than the ones in the
-+	  group specified in the main TPE option will only be allowed to
-+	  execute files in directories they own that are not group or
-+	  world-writable, or in directories owned by root and writable only by
-+	  root.  If the sysctl option is enabled, a sysctl option with name
-+	  "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+	bool "Invert GID option"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, the group you specify in the TPE configuration will
-+	  decide what group TPE restrictions will be *disabled* for.  This
-+	  option is useful if you want TPE restrictions to be applied to most
-+	  users on the system.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for untrusted users"
-+	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for trusted users"
-+	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+	bool "Larger entropy pools"
-+	help
-+	  If you say Y here, the entropy pools used for many features of Linux
-+	  and grsecurity will be doubled in size.  Since several grsecurity
-+	  features use additional randomness, it is recommended that you say Y
-+	  here.  Saying Y here has a similar effect as modifying
-+	  /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+	help
-+	  If you say Y here, neither TCP resets nor ICMP
-+	  destination-unreachable packets will be sent in response to packets
-+	  send to ports for which no associated listening process exists.
-+	  This feature supports both IPV4 and IPV6 and exempts the 
-+	  loopback interface from blackholing.  Enabling this feature 
-+	  makes a host more resilient to DoS attacks and reduces network
-+	  visibility against scanners.
-+
-+	  The blackhole feature as-implemented is equivalent to the FreeBSD
-+	  blackhole feature, as prevents RST responses to all packets, not
-+	  just SYNs.  Under most application behavior this causes no
-+	  problems, but applications (like haproxy) may not close certain
-+	  connections in a way that cleanly terminates them on the remote
-+	  end, leaving the remote host in LAST_ACK state.  Because of this
-+	  side-effect and to prevent intentional LAST_ACK DoSes, this
-+	  feature also adds automatic mitigation against such attacks.
-+	  The mitigation drastically reduces the amount of time a socket
-+	  can spend in LAST_ACK state.  If you're using haproxy and not
-+	  all servers it connects to have this option enabled, consider
-+	  disabling this feature on the haproxy host.
-+
-+	  If this option is enabled, two sysctl options with names
-+	  "ip_blackhole" and "lastack_retries" will be created.
-+	  While "ip_blackhole" takes the standard zero/non-zero on/off
-+	  toggle, "lastack_retries" uses the same kinds of values as
-+	  "tcp_retries1" and "tcp_retries2".  The default value of 4
-+	  prevents a socket from lasting more than 45 seconds in LAST_ACK
-+	  state.
-+
-+config GRKERNSEC_SOCKET
-+	bool "Socket restrictions"
-+	help
-+	  If you say Y here, you will be able to choose from several options.
-+	  If you assign a GID on your system and add it to the supplementary
-+	  groups of users you want to restrict socket access to, this patch
-+	  will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+	bool "Deny any sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine or run server
-+	  applications from your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+	int "GID to deny all sockets for"
-+	depends on GRKERNSEC_SOCKET_ALL
-+	default 1004
-+	help
-+	  Here you can choose the GID to disable socket access for. Remember to
-+	  add the users you want socket access disabled for to the GID
-+	  specified here.  If the sysctl option is enabled, a sysctl option
-+	  with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+	bool "Deny client sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine, but will be
-+	  able to run servers.  If this option is enabled, all users in the group
-+	  you specify will have to use passive mode when initiating ftp transfers
-+	  from the shell on your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+	int "GID to deny client sockets for"
-+	depends on GRKERNSEC_SOCKET_CLIENT
-+	default 1003
-+	help
-+	  Here you can choose the GID to disable client socket access for.
-+	  Remember to add the users you want client socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+	bool "Deny server sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to run server applications from your machine.  If the sysctl
-+	  option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+	int "GID to deny server sockets for"
-+	depends on GRKERNSEC_SOCKET_SERVER
-+	default 1002
-+	help
-+	  Here you can choose the GID to disable server socket access for.
-+	  Remember to add the users you want server socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_server_gid" is created.
-+
-+endmenu
-+menu "Sysctl support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+	bool "Sysctl support"
-+	help
-+	  If you say Y here, you will be able to change the options that
-+	  grsecurity runs with at bootup, without having to recompile your
-+	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
-+	  to enable (1) or disable (0) various features.  All the sysctl entries
-+	  are mutable until the "grsec_lock" entry is set to a non-zero value.
-+	  All features enabled in the kernel configuration are disabled at boot
-+	  if you do not say Y to the "Turn on features by default" option.
-+	  All options should be set at startup, and the grsec_lock entry should
-+	  be set to a non-zero value after all the options are set.
-+	  *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_ON
-+	bool "Turn on features by default"
-+	depends on GRKERNSEC_SYSCTL
-+	help
-+	  If you say Y here, instead of having all features enabled in the
-+	  kernel configuration disabled at boot time, the features will be
-+	  enabled at boot time.  It is recommended you say Y here unless
-+	  there is some reason you would want all sysctl-tunable features to
-+	  be disabled by default.  As mentioned elsewhere, it is important
-+	  to enable the grsec_lock entry once you have finished modifying
-+	  the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+	int "Seconds in between log messages (minimum)"
-+	default 10
-+	help
-+	  This option allows you to enforce the number of seconds between
-+	  grsecurity log messages.  The default should be suitable for most
-+	  people, however, if you choose to change it, choose a value small enough
-+	  to allow informative logs to be produced, but large enough to
-+	  prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+	int "Number of messages in a burst (maximum)"
-+	default 4
-+	help
-+	  This option allows you to choose the maximum number of messages allowed
-+	  within the flood time interval you chose in a separate option.  The
-+	  default should be suitable for most people, however if you find that
-+	  many of your logs are being interpreted as flooding, you may want to
-+	  raise this value.
-+
-+endmenu
-+
-+endmenu
-diff -urNp linux-2.6.32.11/grsecurity/Makefile linux-2.6.32.11/grsecurity/Makefile
---- linux-2.6.32.11/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/grsecurity/Makefile	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,29 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released 
-+# under the GPL v2 or higher
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
-+	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
-+	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+	gracl_learn.o grsec_log.o
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+	@-chmod -f 500 /boot
-+	@-chmod -f 500 /lib/modules
-+	@-chmod -f 700 .
-+	@echo '  grsec: protected kernel image paths'
-+endif
-diff -urNp linux-2.6.32.11/include/acpi/acpi_drivers.h linux-2.6.32.11/include/acpi/acpi_drivers.h
---- linux-2.6.32.11/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/acpi/acpi_drivers.h	2010-04-04 20:46:41.668784531 -0400
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
-                                   Dock Station
-   -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
--	acpi_notify_handler handler;
--	acpi_notify_handler uevent;
-+	const acpi_notify_handler handler;
-+	const acpi_notify_handler uevent;
- };
- 
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
--					struct acpi_dock_ops *ops,
-+					const struct acpi_dock_ops *ops,
- 					void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
--					       struct acpi_dock_ops *ops,
-+					       const struct acpi_dock_ops *ops,
- 					       void *context)
- {
- 	return -ENODEV;
-diff -urNp linux-2.6.32.11/include/asm-generic/atomic-long.h linux-2.6.32.11/include/asm-generic/atomic-long.h
---- linux-2.6.32.11/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/atomic-long.h	2010-04-04 20:46:41.668784531 -0400
-@@ -22,6 +22,12 @@
- 
- typedef atomic64_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
- 
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic64_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
- 	atomic64_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
- 	atomic64_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
- 	atomic64_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic64_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
- 
- typedef atomic_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
- 	atomic_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
- 	atomic_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
- 	atomic_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
- 
- #endif  /*  BITS_PER_LONG == 64  */
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+	atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+
-+	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#endif
-+
- #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
-diff -urNp linux-2.6.32.11/include/asm-generic/dma-mapping-common.h linux-2.6.32.11/include/asm-generic/dma-mapping-common.h
---- linux-2.6.32.11/include/asm-generic/dma-mapping-common.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/dma-mapping-common.h	2010-04-04 20:46:41.673688119 -0400
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
- 					      enum dma_data_direction dir,
- 					      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
- 					  enum dma_data_direction dir,
- 					  struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
- 				   int nents, enum dma_data_direction dir,
- 				   struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	int i, ents;
- 	struct scatterlist *s;
- 
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
- 				      int nents, enum dma_data_direction dir,
- 				      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
- 				      size_t offset, size_t size,
- 				      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- 				  size_t size, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
- 					   size_t size,
- 					   enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
- 					      dma_addr_t addr, size_t size,
- 					      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
- 						 size_t size,
- 						 enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
- 						    size_t size,
- 						    enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- 		    int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- 		       int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.32.11/include/asm-generic/futex.h linux-2.6.32.11/include/asm-generic/futex.h
---- linux-2.6.32.11/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/futex.h	2010-04-04 20:46:41.673688119 -0400
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
- 
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
- }
- 
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- 	return -ENOSYS;
- }
-diff -urNp linux-2.6.32.11/include/asm-generic/int-l64.h linux-2.6.32.11/include/asm-generic/int-l64.h
---- linux-2.6.32.11/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/int-l64.h	2010-04-04 20:46:41.673688119 -0400
-@@ -46,6 +46,8 @@ typedef unsigned int u32;
- typedef signed long s64;
- typedef unsigned long u64;
- 
-+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.11/include/asm-generic/int-ll64.h linux-2.6.32.11/include/asm-generic/int-ll64.h
---- linux-2.6.32.11/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/int-ll64.h	2010-04-04 20:46:41.673688119 -0400
-@@ -51,6 +51,8 @@ typedef unsigned int u32;
- typedef signed long long s64;
- typedef unsigned long long u64;
- 
-+typedef unsigned long long intoverflow_t;
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.11/include/asm-generic/kmap_types.h linux-2.6.32.11/include/asm-generic/kmap_types.h
---- linux-2.6.32.11/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/kmap_types.h	2010-04-04 20:46:41.673688119 -0400
-@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
- KMAP_D(16)	KM_IRQ_PTE,
- KMAP_D(17)	KM_NMI,
- KMAP_D(18)	KM_NMI_PTE,
--KMAP_D(19)	KM_TYPE_NR
-+KMAP_D(19)	KM_CLEARPAGE,
-+KMAP_D(20)	KM_TYPE_NR
- };
- 
- #undef KMAP_D
-diff -urNp linux-2.6.32.11/include/asm-generic/pgtable.h linux-2.6.32.11/include/asm-generic/pgtable.h
---- linux-2.6.32.11/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/pgtable.h	2010-04-04 20:46:41.673688119 -0400
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
- 				unsigned long size);
- #endif
- 
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
- 
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.32.11/include/asm-generic/vmlinux.lds.h linux-2.6.32.11/include/asm-generic/vmlinux.lds.h
---- linux-2.6.32.11/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/asm-generic/vmlinux.lds.h	2010-04-04 20:46:41.673688119 -0400
-@@ -199,6 +199,7 @@
- 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
- 		VMLINUX_SYMBOL(__start_rodata) = .;			\
- 		*(.rodata) *(.rodata.*)					\
-+		*(.data.read_only)					\
- 		*(__vermagic)		/* Kernel version magic */	\
- 		*(__markers_strings)	/* Markers: strings */		\
- 		*(__tracepoints_strings)/* Tracepoints: strings */	\
-@@ -656,22 +657,24 @@
-  * section in the linker script will go there too.  @phdr should have
-  * a leading colon.
-  *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
-  * If there is no need to put the percpu section at a predetermined
-  * address, use PERCPU().
-  */
- #define PERCPU_VADDR(vaddr, phdr)					\
--	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
--	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
-+	per_cpu_load = .;						\
-+	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
- 				- LOAD_OFFSET) {			\
-+		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
- 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
- 		*(.data.percpu.first)					\
--		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu)						\
-+		. = ALIGN(PAGE_SIZE);					\
-+		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu.shared_aligned)				\
- 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
- 	} phdr								\
--	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
- 
- /**
-  * PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.32.11/include/drm/drm_pciids.h linux-2.6.32.11/include/drm/drm_pciids.h
---- linux-2.6.32.11/include/drm/drm_pciids.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/drm/drm_pciids.h	2010-04-04 20:46:41.673688119 -0400
-@@ -375,7 +375,7 @@
- 	{0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define r128_PCI_IDS \
- 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -415,14 +415,14 @@
- 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mga_PCI_IDS \
- 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
- 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mach64_PCI_IDS \
- 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -445,7 +445,7 @@
- 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define sisdrv_PCI_IDS \
- 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -456,7 +456,7 @@
- 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
- 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define tdfx_PCI_IDS \
- 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -465,7 +465,7 @@
- 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define viadrv_PCI_IDS \
- 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -477,14 +477,14 @@
- 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
- 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i810_PCI_IDS \
- 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i830_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -492,11 +492,11 @@
- 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define gamma_PCI_IDS \
- 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define savage_PCI_IDS \
- 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-@@ -522,10 +522,10 @@
- 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
- 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
- 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define ffb_PCI_IDS \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i915_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
-@@ -558,4 +558,4 @@
- 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
-diff -urNp linux-2.6.32.11/include/drm/drmP.h linux-2.6.32.11/include/drm/drmP.h
---- linux-2.6.32.11/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/drm/drmP.h	2010-04-04 20:46:41.673688119 -0400
-@@ -814,7 +814,7 @@ struct drm_driver {
- 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
- 
- 	/* Driver private ops for this object */
--	struct vm_operations_struct *gem_vm_ops;
-+	const struct vm_operations_struct *gem_vm_ops;
- 
- 	int major;
- 	int minor;
-@@ -917,7 +917,7 @@ struct drm_device {
- 
- 	/** \name Usage Counters */
- 	/*@{ */
--	int open_count;			/**< Outstanding files open */
-+	atomic_t open_count;		/**< Outstanding files open */
- 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
- 	atomic_t vma_count;		/**< Outstanding vma areas open */
- 	int buf_use;			/**< Buffers in use -- cannot alloc */
-@@ -928,7 +928,7 @@ struct drm_device {
- 	/*@{ */
- 	unsigned long counters;
- 	enum drm_stat_type types[15];
--	atomic_t counts[15];
-+	atomic_unchecked_t counts[15];
- 	/*@} */
- 
- 	struct list_head filelist;
-diff -urNp linux-2.6.32.11/include/linux/a.out.h linux-2.6.32.11/include/linux/a.out.h
---- linux-2.6.32.11/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/a.out.h	2010-04-04 20:46:41.673688119 -0400
-@@ -39,6 +39,14 @@ enum machine_type {
-   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
- };
- 
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
-+#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
-+#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff -urNp linux-2.6.32.11/include/linux/atmdev.h linux-2.6.32.11/include/linux/atmdev.h
---- linux-2.6.32.11/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/atmdev.h	2010-04-04 20:46:41.673688119 -0400
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
- 
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.11/include/linux/backlight.h linux-2.6.32.11/include/linux/backlight.h
---- linux-2.6.32.11/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/backlight.h	2010-04-04 20:46:41.673688119 -0400
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
- 
- struct backlight_ops {
--	unsigned int options;
-+	const unsigned int options;
- 
- #define BL_CORE_SUSPENDRESUME	(1 << 0)
- 
- 	/* Notify the backlight driver some property has changed */
--	int (*update_status)(struct backlight_device *);
-+	int (* const update_status)(struct backlight_device *);
- 	/* Return the current backlight brightness (accounting for power,
- 	   fb_blank etc.) */
--	int (*get_brightness)(struct backlight_device *);
-+	int (* const get_brightness)(struct backlight_device *);
- 	/* Check if given framebuffer device is the one bound to this backlight;
- 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
--	int (*check_fb)(struct fb_info *);
-+	int (* const check_fb)(struct fb_info *);
- };
- 
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- 	   registered this device has been unloaded, and if class_get_devdata()
- 	   points to something in the body of that driver, it is also invalid. */
- 	struct mutex ops_lock;
--	struct backlight_ops *ops;
-+	const struct backlight_ops *ops;
- 
- 	/* The framebuffer notifier block */
- 	struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_stat
- }
- 
- extern struct backlight_device *backlight_device_register(const char *name,
--	struct device *dev, void *devdata, struct backlight_ops *ops);
-+	struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- 				   enum backlight_update_reason reason);
-diff -urNp linux-2.6.32.11/include/linux/binfmts.h linux-2.6.32.11/include/linux/binfmts.h
---- linux-2.6.32.11/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/binfmts.h	2010-04-04 20:46:41.673688119 -0400
-@@ -78,6 +78,7 @@ struct linux_binfmt {
- 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
- 	int (*load_shlib)(struct file *);
- 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- 	unsigned long min_coredump;	/* minimal dump size */
- 	int hasvdso;
- };
-diff -urNp linux-2.6.32.11/include/linux/blkdev.h linux-2.6.32.11/include/linux/blkdev.h
---- linux-2.6.32.11/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/blkdev.h	2010-04-04 20:46:41.673688119 -0400
-@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
- #endif /* CONFIG_BLK_DEV_INTEGRITY */
- 
- struct block_device_operations {
--	int (*open) (struct block_device *, fmode_t);
--	int (*release) (struct gendisk *, fmode_t);
--	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*direct_access) (struct block_device *, sector_t,
-+	int (* const open) (struct block_device *, fmode_t);
-+	int (* const release) (struct gendisk *, fmode_t);
-+	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const direct_access) (struct block_device *, sector_t,
- 						void **, unsigned long *);
--	int (*media_changed) (struct gendisk *);
--	unsigned long long (*set_capacity) (struct gendisk *,
-+	int (* const media_changed) (struct gendisk *);
-+	unsigned long long (* const set_capacity) (struct gendisk *,
- 						unsigned long long);
--	int (*revalidate_disk) (struct gendisk *);
--	int (*getgeo)(struct block_device *, struct hd_geometry *);
--	struct module *owner;
-+	int (* const revalidate_disk) (struct gendisk *);
-+	int (*const getgeo)(struct block_device *, struct hd_geometry *);
-+	struct module * const owner;
- };
- 
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.32.11/include/linux/cache.h linux-2.6.32.11/include/linux/cache.h
---- linux-2.6.32.11/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/cache.h	2010-04-04 20:46:41.673688119 -0400
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
- 
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff -urNp linux-2.6.32.11/include/linux/capability.h linux-2.6.32.11/include/linux/capability.h
---- linux-2.6.32.11/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/capability.h	2010-04-04 20:46:41.673688119 -0400
-@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
- 	(security_real_capable_noaudit((t), (cap)) == 0)
- 
- extern int capable(int cap);
-+int capable_nolog(int cap);
- 
- /* audit system wants to get cap info from files as well */
- struct dentry;
-diff -urNp linux-2.6.32.11/include/linux/compiler-gcc4.h linux-2.6.32.11/include/linux/compiler-gcc4.h
---- linux-2.6.32.11/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/compiler-gcc4.h	2010-04-04 20:46:41.673688119 -0400
-@@ -36,4 +36,8 @@
-    the kernel context */
- #define __cold			__attribute__((__cold__))
- 
-+#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
-+#define __bos0(ptr)		__bos((ptr), 0)
-+#define __bos1(ptr)		__bos((ptr), 1)
- #endif
-diff -urNp linux-2.6.32.11/include/linux/compiler.h linux-2.6.32.11/include/linux/compiler.h
---- linux-2.6.32.11/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/compiler.h	2010-04-04 20:46:41.673688119 -0400
-@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
- #define __cold
- #endif
- 
-+#ifndef __alloc_size
-+#define __alloc_size
-+#endif
-+
-+#ifndef __bos
-+#define __bos
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-diff -urNp linux-2.6.32.11/include/linux/decompress/mm.h linux-2.6.32.11/include/linux/decompress/mm.h
---- linux-2.6.32.11/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
-+++ linux-2.6.32.11/include/linux/decompress/mm.h	2010-04-04 20:46:41.673688119 -0400
-@@ -78,7 +78,7 @@ static void free(void *where)
-  * warnings when not needed (indeed large_malloc / large_free are not
-  * needed by inflate */
- 
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- 
- #define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.32.11/include/linux/dma-mapping.h linux-2.6.32.11/include/linux/dma-mapping.h
---- linux-2.6.32.11/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/dma-mapping.h	2010-04-04 20:46:41.673688119 -0400
-@@ -16,50 +16,50 @@ enum dma_data_direction {
- };
- 
- struct dma_map_ops {
--	void* (*alloc_coherent)(struct device *dev, size_t size,
-+	void* (* const alloc_coherent)(struct device *dev, size_t size,
- 				dma_addr_t *dma_handle, gfp_t gfp);
--	void (*free_coherent)(struct device *dev, size_t size,
-+	void (* const free_coherent)(struct device *dev, size_t size,
- 			      void *vaddr, dma_addr_t dma_handle);
--	dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- 			       unsigned long offset, size_t size,
- 			       enum dma_data_direction dir,
- 			       struct dma_attrs *attrs);
--	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- 			   size_t size, enum dma_data_direction dir,
- 			   struct dma_attrs *attrs);
--	int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- 		      int nents, enum dma_data_direction dir,
- 		      struct dma_attrs *attrs);
--	void (*unmap_sg)(struct device *dev,
-+	void (* const unmap_sg)(struct device *dev,
- 			 struct scatterlist *sg, int nents,
- 			 enum dma_data_direction dir,
- 			 struct dma_attrs *attrs);
--	void (*sync_single_for_cpu)(struct device *dev,
-+	void (* const sync_single_for_cpu)(struct device *dev,
- 				    dma_addr_t dma_handle, size_t size,
- 				    enum dma_data_direction dir);
--	void (*sync_single_for_device)(struct device *dev,
-+	void (* const sync_single_for_device)(struct device *dev,
- 				       dma_addr_t dma_handle, size_t size,
- 				       enum dma_data_direction dir);
--	void (*sync_single_range_for_cpu)(struct device *dev,
-+	void (* const sync_single_range_for_cpu)(struct device *dev,
- 					  dma_addr_t dma_handle,
- 					  unsigned long offset,
- 					  size_t size,
- 					  enum dma_data_direction dir);
--	void (*sync_single_range_for_device)(struct device *dev,
-+	void (* const sync_single_range_for_device)(struct device *dev,
- 					     dma_addr_t dma_handle,
- 					     unsigned long offset,
- 					     size_t size,
- 					     enum dma_data_direction dir);
--	void (*sync_sg_for_cpu)(struct device *dev,
-+	void (* const sync_sg_for_cpu)(struct device *dev,
- 				struct scatterlist *sg, int nents,
- 				enum dma_data_direction dir);
--	void (*sync_sg_for_device)(struct device *dev,
-+	void (* const sync_sg_for_device)(struct device *dev,
- 				   struct scatterlist *sg, int nents,
- 				   enum dma_data_direction dir);
--	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
--	int (*dma_supported)(struct device *dev, u64 mask);
-+	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+	int (* const dma_supported)(struct device *dev, u64 mask);
- 	int (*set_dma_mask)(struct device *dev, u64 mask);
--	int is_phys;
-+	const int is_phys;
- };
- 
- #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.32.11/include/linux/dst.h linux-2.6.32.11/include/linux/dst.h
---- linux-2.6.32.11/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/dst.h	2010-04-04 20:46:41.673688119 -0400
-@@ -380,7 +380,7 @@ struct dst_node
- 	struct thread_pool	*pool;
- 
- 	/* Transaction IDs live here */
--	atomic_long_t		gen;
-+	atomic_long_unchecked_t	gen;
- 
- 	/*
- 	 * How frequently and how many times transaction
-diff -urNp linux-2.6.32.11/include/linux/elf.h linux-2.6.32.11/include/linux/elf.h
---- linux-2.6.32.11/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/elf.h	2010-04-04 20:46:41.673688119 -0400
-@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
- #define PT_GNU_EH_FRAME		0x6474e550
- 
- #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
-+#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
- 
- /* These constants define the different elf file types */
- #define ET_NONE   0
-@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
- #define DT_DEBUG	21
- #define DT_TEXTREL	22
- #define DT_JMPREL	23
-+#define DT_FLAGS	30
-+  #define DF_TEXTREL  0x00000004
- #define DT_ENCODING	32
- #define OLD_DT_LOOS	0x60000000
- #define DT_LOOS		0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W		0x2
- #define PF_X		0x1
- 
-+#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
-+#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
-+#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
-+#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
-+#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
-+#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
-+/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
-+/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
-+#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
-+#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
-+#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
-+#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
-   Elf32_Word	p_type;
-   Elf32_Off	p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define	EI_OSABI	7
- #define	EI_PAD		8
- 
-+#define	EI_PAX		14
-+
- #define	ELFMAG0		0x7f		/* EI_MAG */
- #define	ELFMAG1		'E'
- #define	ELFMAG2		'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
- #define elf_addr_t	Elf32_Off
-+#define elf_dyn		Elf32_Dyn
- 
- #else
- 
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr	elf64_phdr
- #define elf_note	elf64_note
- #define elf_addr_t	Elf64_Off
-+#define elf_dyn		Elf64_Dyn
- 
- #endif
- 
-diff -urNp linux-2.6.32.11/include/linux/fs.h linux-2.6.32.11/include/linux/fs.h
---- linux-2.6.32.11/include/linux/fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/fs.h	2010-04-04 20:46:41.677383221 -0400
-@@ -90,6 +90,11 @@ struct inodes_stat_t {
- /* Expect random access pattern */
- #define FMODE_RANDOM		((__force fmode_t)4096)
- 
-+/* Hack for grsec so as not to require read permission simply to execute
-+ * a binary
-+ */
-+#define FMODE_GREXEC		((__force fmode_t)8192)
-+
- /*
-  * The below are the various read and write types that we support. Some of
-  * them include behavioral modifiers that send information down to the
-@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
- 		unsigned long, unsigned long);
- 
- struct address_space_operations {
--	int (*writepage)(struct page *page, struct writeback_control *wbc);
--	int (*readpage)(struct file *, struct page *);
--	void (*sync_page)(struct page *);
-+	int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+	int (* const readpage)(struct file *, struct page *);
-+	void (* const sync_page)(struct page *);
- 
- 	/* Write back some dirty pages from this mapping. */
--	int (*writepages)(struct address_space *, struct writeback_control *);
-+	int (* const writepages)(struct address_space *, struct writeback_control *);
- 
- 	/* Set a page dirty.  Return true if this dirtied it */
--	int (*set_page_dirty)(struct page *page);
-+	int (* const set_page_dirty)(struct page *page);
- 
--	int (*readpages)(struct file *filp, struct address_space *mapping,
-+	int (* const readpages)(struct file *filp, struct address_space *mapping,
- 			struct list_head *pages, unsigned nr_pages);
- 
--	int (*write_begin)(struct file *, struct address_space *mapping,
-+	int (* const write_begin)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned flags,
- 				struct page **pagep, void **fsdata);
--	int (*write_end)(struct file *, struct address_space *mapping,
-+	int (* const write_end)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned copied,
- 				struct page *page, void *fsdata);
- 
- 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
--	sector_t (*bmap)(struct address_space *, sector_t);
--	void (*invalidatepage) (struct page *, unsigned long);
--	int (*releasepage) (struct page *, gfp_t);
--	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+	sector_t (* const bmap)(struct address_space *, sector_t);
-+	void (* const invalidatepage) (struct page *, unsigned long);
-+	int (* const releasepage) (struct page *, gfp_t);
-+	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- 			loff_t offset, unsigned long nr_segs);
--	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- 						void **, unsigned long *);
- 	/* migrate the contents of a page to the specified target */
--	int (*migratepage) (struct address_space *,
-+	int (* const migratepage) (struct address_space *,
- 			struct page *, struct page *);
--	int (*launder_page) (struct page *);
--	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+	int (* const launder_page) (struct page *);
-+	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- 					unsigned long);
--	int (*error_remove_page)(struct address_space *, struct page *);
-+	int (* const error_remove_page)(struct address_space *, struct page *);
- };
- 
- /*
-@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
- typedef struct files_struct *fl_owner_t;
- 
- struct file_lock_operations {
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
- };
- 
- struct lock_manager_operations {
--	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
--	void (*fl_notify)(struct file_lock *);	/* unblock callback */
--	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
--	void (*fl_break)(struct file_lock *);
--	int (*fl_mylease)(struct file_lock *, struct file_lock *);
--	int (*fl_change)(struct file_lock **, int);
-+	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
-+	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
-+	void (* const fl_break)(struct file_lock *);
-+	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+	int (* const fl_change)(struct file_lock **, int);
- };
- 
- struct lock_manager {
-@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
- 	unsigned int fi_flags;		/* Flags as passed from user */
- 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
- 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
--	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- 						 * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
- 		unsigned long, loff_t *);
- 
- struct super_operations {
--   	struct inode *(*alloc_inode)(struct super_block *sb);
--	void (*destroy_inode)(struct inode *);
-+   	struct inode *(* const alloc_inode)(struct super_block *sb);
-+	void (* const destroy_inode)(struct inode *);
- 
--   	void (*dirty_inode) (struct inode *);
--	int (*write_inode) (struct inode *, int);
--	void (*drop_inode) (struct inode *);
--	void (*delete_inode) (struct inode *);
--	void (*put_super) (struct super_block *);
--	void (*write_super) (struct super_block *);
--	int (*sync_fs)(struct super_block *sb, int wait);
--	int (*freeze_fs) (struct super_block *);
--	int (*unfreeze_fs) (struct super_block *);
--	int (*statfs) (struct dentry *, struct kstatfs *);
--	int (*remount_fs) (struct super_block *, int *, char *);
--	void (*clear_inode) (struct inode *);
--	void (*umount_begin) (struct super_block *);
-+   	void (* const dirty_inode) (struct inode *);
-+	int (* const write_inode) (struct inode *, int);
-+	void (* const drop_inode) (struct inode *);
-+	void (* const delete_inode) (struct inode *);
-+	void (* const put_super) (struct super_block *);
-+	void (* const write_super) (struct super_block *);
-+	int (* const sync_fs)(struct super_block *sb, int wait);
-+	int (* const freeze_fs) (struct super_block *);
-+	int (* const unfreeze_fs) (struct super_block *);
-+	int (* const statfs) (struct dentry *, struct kstatfs *);
-+	int (* const remount_fs) (struct super_block *, int *, char *);
-+	void (* const clear_inode) (struct inode *);
-+	void (* const umount_begin) (struct super_block *);
- 
--	int (*show_options)(struct seq_file *, struct vfsmount *);
--	int (*show_stats)(struct seq_file *, struct vfsmount *);
-+	int (* const show_options)(struct seq_file *, struct vfsmount *);
-+	int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
--	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
--	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
--	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
- 
- /*
-diff -urNp linux-2.6.32.11/include/linux/fs_struct.h linux-2.6.32.11/include/linux/fs_struct.h
---- linux-2.6.32.11/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/fs_struct.h	2010-04-04 20:46:41.677383221 -0400
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
- 
- struct fs_struct {
--	int users;
-+	atomic_t users;
- 	rwlock_t lock;
- 	int umask;
- 	int in_exec;
-diff -urNp linux-2.6.32.11/include/linux/genhd.h linux-2.6.32.11/include/linux/genhd.h
---- linux-2.6.32.11/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/genhd.h	2010-04-04 20:46:41.677383221 -0400
-@@ -161,7 +161,7 @@ struct gendisk {
- 
- 	struct timer_rand_state *random;
- 
--	atomic_t sync_io;		/* RAID */
-+	atomic_unchecked_t sync_io;	/* RAID */
- 	struct work_struct async_notify;
- #ifdef  CONFIG_BLK_DEV_INTEGRITY
- 	struct blk_integrity *integrity;
-diff -urNp linux-2.6.32.11/include/linux/gracl.h linux-2.6.32.11/include/linux/gracl.h
---- linux-2.6.32.11/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/gracl.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,309 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION  "grsecurity 2.1.14"
-+#define GRSECURITY_VERSION 0x2114
-+
-+enum {
-+	GR_SHUTDOWN = 0,
-+	GR_ENABLE = 1,
-+	GR_SPROLE = 2,
-+	GR_RELOAD = 3,
-+	GR_SEGVMOD = 4,
-+	GR_STATUS = 5,
-+	GR_UNSPROLE = 6,
-+	GR_PASSSET = 7,
-+	GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+	GR_PW_LEN = 128,
-+	GR_SALT_LEN = 16,
-+	GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+	GR_SPROLE_LEN = 64,
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+	unsigned char *rolename;
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+	__u32 key;
-+	ino_t inode;
-+	dev_t device;
-+	char *name;
-+	__u16 len;
-+	__u8 deleted;
-+	struct name_entry *prev;
-+	struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+	struct name_entry *nentry;
-+	struct inodev_entry *prev;
-+	struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+	struct acl_role_label **r_hash;
-+	__u32 r_size;
-+};
-+
-+struct inodev_db {
-+	struct inodev_entry **i_hash;
-+	__u32 i_size;
-+};
-+
-+struct name_db {
-+	struct name_entry **n_hash;
-+	__u32 n_size;
-+};
-+
-+struct crash_uid {
-+	uid_t uid;
-+	unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+	void **table;
-+	void **nametable;
-+	void *first;
-+	__u32 table_size;
-+	__u32 used_size;
-+	int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+	kernel_cap_t cap_mask;
-+	kernel_cap_t cap_lower;
-+
-+	struct rlimit res[GR_NLIMITS];
-+	__u32 resmask;
-+
-+	__u8 user_trans_type;
-+	__u8 group_trans_type;
-+	uid_t *user_transitions;
-+	gid_t *group_transitions;
-+	__u16 user_trans_num;
-+	__u16 group_trans_num;
-+
-+	__u32 ip_proto[8];
-+	__u32 ip_type;
-+	struct acl_ip_label **ips;
-+	__u32 ip_num;
-+	__u32 inaddr_any_override;
-+
-+	__u32 crashes;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *parent_subject;
-+	struct gr_hash_struct *hash;
-+	struct acl_subject_label *prev;
-+	struct acl_subject_label *next;
-+
-+	struct acl_object_label **obj_hash;
-+	__u32 obj_hash_size;
-+	__u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+	__u32 addr;
-+	__u32 netmask;
-+
-+	struct role_allowed_ip *prev;
-+	struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+	char *rolename;
-+
-+	struct role_transition *prev;
-+	struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+	char *rolename;
-+	uid_t uidgid;
-+	__u16 roletype;
-+
-+	__u16 auth_attempts;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *root_label;
-+	struct gr_hash_struct *hash;
-+
-+	struct acl_role_label *prev;
-+	struct acl_role_label *next;
-+
-+	struct role_transition *transitions;
-+	struct role_allowed_ip *allowed_ips;
-+	uid_t *domain_children;
-+	__u16 domain_child_num;
-+
-+	struct acl_subject_label **subj_hash;
-+	__u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+	struct acl_role_label **r_table;
-+	__u32 num_pointers;		/* Number of allocations to track */
-+	__u32 num_roles;		/* Number of roles */
-+	__u32 num_domain_children;	/* Number of domain children */
-+	__u32 num_subjects;		/* Number of subjects */
-+	__u32 num_objects;		/* Number of objects */
-+};
-+
-+struct acl_object_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+
-+	struct acl_subject_label *nested;
-+	struct acl_object_label *globbed;
-+
-+	/* next two structures not used */
-+
-+	struct acl_object_label *prev;
-+	struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+	char *iface;
-+	__u32 addr;
-+	__u32 netmask;
-+	__u16 low, high;
-+	__u8 mode;
-+	__u32 type;
-+	__u32 proto[8];
-+
-+	/* next two structures not used */
-+
-+	struct acl_ip_label *prev;
-+	struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+	struct user_acl_role_db role_db;
-+	unsigned char pw[GR_PW_LEN];
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];
-+	unsigned char sp_role[GR_SPROLE_LEN];
-+	struct sprole_pw *sprole_pws;
-+	dev_t segv_device;
-+	ino_t segv_inode;
-+	uid_t segv_uid;
-+	__u16 num_sprole_pws;
-+	__u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+	struct gr_arg *arg;
-+	__u32 version;
-+	__u32 size;
-+};
-+
-+struct subject_map {
-+	struct acl_subject_label *user;
-+	struct acl_subject_label *kernel;
-+	struct subject_map *prev;
-+	struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+	struct subject_map **s_hash;
-+	__u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+   Makes good use of the low bits of the inode.  Generally 0-1 times
-+   in loop for successful match.  0-3 for unsuccessful match.
-+   Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+	return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+	return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+	return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+	role = role_list; \
-+	while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+		role = role->prev; \
-+	}
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+	subj = NULL; \
-+	iter = 0; \
-+	while (iter < role->subj_hash_size) { \
-+		if (subj == NULL) \
-+			subj = role->subj_hash[iter]; \
-+		if (subj == NULL) { \
-+			iter++; \
-+			continue; \
-+		}
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+		subj = subj->next; \
-+		if (subj == NULL) \
-+			iter++; \
-+	}
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+	subj = role->hash->first; \
-+	while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+		subj = subj->next; \
-+	}
-+
-+#endif
-+
-diff -urNp linux-2.6.32.11/include/linux/gralloc.h linux-2.6.32.11/include/linux/gralloc.h
---- linux-2.6.32.11/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/gralloc.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff -urNp linux-2.6.32.11/include/linux/grdefs.h linux-2.6.32.11/include/linux/grdefs.h
---- linux-2.6.32.11/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/grdefs.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,136 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+	GR_READY = 0x01,
-+	GR_STATUS_INIT = 0x00	// disabled state
-+};
-+
-+/* Begin  ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+	GR_ROLE_USER = 0x0001,
-+	GR_ROLE_GROUP = 0x0002,
-+	GR_ROLE_DEFAULT = 0x0004,
-+	GR_ROLE_SPECIAL = 0x0008,
-+	GR_ROLE_AUTH = 0x0010,
-+	GR_ROLE_NOPW = 0x0020,
-+	GR_ROLE_GOD = 0x0040,
-+	GR_ROLE_LEARN = 0x0080,
-+	GR_ROLE_TPE = 0x0100,
-+	GR_ROLE_DOMAIN = 0x0200,
-+	GR_ROLE_PAM = 0x0400
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+	GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+	GR_READ 	= 0x00000001,
-+	GR_APPEND 	= 0x00000002,
-+	GR_WRITE 	= 0x00000004,
-+	GR_EXEC 	= 0x00000008,
-+	GR_FIND 	= 0x00000010,
-+	GR_INHERIT 	= 0x00000020,
-+	GR_SETID 	= 0x00000040,
-+	GR_CREATE 	= 0x00000080,
-+	GR_DELETE 	= 0x00000100,
-+	GR_LINK		= 0x00000200,
-+	GR_AUDIT_READ 	= 0x00000400,
-+	GR_AUDIT_APPEND = 0x00000800,
-+	GR_AUDIT_WRITE 	= 0x00001000,
-+	GR_AUDIT_EXEC 	= 0x00002000,
-+	GR_AUDIT_FIND 	= 0x00004000,
-+	GR_AUDIT_INHERIT= 0x00008000,
-+	GR_AUDIT_SETID 	= 0x00010000,
-+	GR_AUDIT_CREATE = 0x00020000,
-+	GR_AUDIT_DELETE = 0x00040000,
-+	GR_AUDIT_LINK	= 0x00080000,
-+	GR_PTRACERD 	= 0x00100000,
-+	GR_NOPTRACE	= 0x00200000,
-+	GR_SUPPRESS 	= 0x00400000,
-+	GR_NOLEARN 	= 0x00800000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+	GR_KILL 	= 0x00000001,
-+	GR_VIEW 	= 0x00000002,
-+	GR_PROTECTED 	= 0x00000004,
-+	GR_LEARN 	= 0x00000008,
-+	GR_OVERRIDE 	= 0x00000010,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_DUMMY 	= 0x00000020,
-+	GR_PROTSHM	= 0x00000040,
-+	GR_KILLPROC	= 0x00000080,
-+	GR_KILLIPPROC	= 0x00000100,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_NOTROJAN	= 0x00000200,
-+	GR_PROTPROCFD	= 0x00000400,
-+	GR_PROCACCT	= 0x00000800,
-+	GR_RELAXPTRACE	= 0x00001000,
-+	GR_NESTED	= 0x00002000,
-+	GR_INHERITLEARN	= 0x00004000,
-+	GR_PROCFIND	= 0x00008000,
-+	GR_POVERRIDE	= 0x00010000,
-+	GR_KERNELAUTH	= 0x00020000,
-+};
-+
-+enum {
-+	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
-+	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
-+	GR_PAX_ENABLE_MPROTECT	= 0x0004,
-+	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
-+	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
-+	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
-+	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
-+	GR_PAX_DISABLE_MPROTECT	= 0x0400,
-+	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
-+	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
-+};
-+
-+enum {
-+	GR_ID_USER	= 0x01,
-+	GR_ID_GROUP	= 0x02,
-+};
-+
-+enum {
-+	GR_ID_ALLOW	= 0x01,
-+	GR_ID_DENY	= 0x02,
-+};
-+
-+#define GR_CRASH_RES	31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+	GR_RLIM_CPU_BUMP = 60,
-+	GR_RLIM_FSIZE_BUMP = 50000,
-+	GR_RLIM_DATA_BUMP = 10000,
-+	GR_RLIM_STACK_BUMP = 1000,
-+	GR_RLIM_CORE_BUMP = 10000,
-+	GR_RLIM_RSS_BUMP = 500000,
-+	GR_RLIM_NPROC_BUMP = 1,
-+	GR_RLIM_NOFILE_BUMP = 5,
-+	GR_RLIM_MEMLOCK_BUMP = 50000,
-+	GR_RLIM_AS_BUMP = 500000,
-+	GR_RLIM_LOCKS_BUMP = 2,
-+	GR_RLIM_SIGPENDING_BUMP = 5,
-+	GR_RLIM_MSGQUEUE_BUMP = 10000,
-+	GR_RLIM_NICE_BUMP = 1,
-+	GR_RLIM_RTPRIO_BUMP = 1,
-+	GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff -urNp linux-2.6.32.11/include/linux/grinternal.h linux-2.6.32.11/include/linux/grinternal.h
---- linux-2.6.32.11/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/grinternal.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,215 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+	__attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+			    const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+			     const struct dentry *parent,
-+			     const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_execve;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_findtask;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_sidcaps;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) (tsk->exec_file ? \
-+			gr_to_filename2(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
-+			gr_to_filename(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
-+			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
-+			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
-+			    tsk_a->fs->root.dentry)))
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
-+			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
-+		       task->pid, cred->uid, \
-+		       cred->euid, cred->gid, cred->egid, \
-+		       gr_parent_task_fullpath(task), \
-+		       task->parent->comm, task->parent->pid, \
-+		       pcred->uid, pcred->euid, \
-+		       pcred->gid, pcred->egid
-+
-+#define GR_CHROOT_CAPS {{ \
-+	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+	read_lock(&grsec_exec_file_lock); \
-+	gr_add_learn_entry(normal_msg "\n", ## args); \
-+	read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+	GR_DO_AUDIT,
-+	GR_DONT_AUDIT,
-+	GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+	GR_TTYSNIFF,
-+	GR_RBAC,
-+	GR_RBAC_STR,
-+	GR_STR_RBAC,
-+	GR_RBAC_MODE2,
-+	GR_RBAC_MODE3,
-+	GR_FILENAME,
-+	GR_SYSCTL_HIDDEN,
-+	GR_NOARGS,
-+	GR_ONE_INT,
-+	GR_ONE_INT_TWO_STR,
-+	GR_ONE_STR,
-+	GR_STR_INT,
-+	GR_TWO_INT,
-+	GR_THREE_INT,
-+	GR_FIVE_INT_TWO_STR,
-+	GR_TWO_STR,
-+	GR_THREE_STR,
-+	GR_FOUR_STR,
-+	GR_STR_FILENAME,
-+	GR_FILENAME_STR,
-+	GR_FILENAME_TWO_INT,
-+	GR_FILENAME_TWO_INT_STR,
-+	GR_TEXTREL,
-+	GR_PTRACE,
-+	GR_RESOURCE,
-+	GR_CAP,
-+	GR_SIG,
-+	GR_SIG2,
-+	GR_CRASH1,
-+	GR_CRASH2,
-+	GR_PSACCT
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.11/include/linux/grmsg.h linux-2.6.32.11/include/linux/grmsg.h
---- linux-2.6.32.11/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/grmsg.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,107 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_KMEM_MSG "denied write of /dev/kmem by "
-+#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
-+#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
-+#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_NPROC_MSG "denied overstep of process limit by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %d by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-diff -urNp linux-2.6.32.11/include/linux/grsecurity.h linux-2.6.32.11/include/linux/grsecurity.h
---- linux-2.6.32.11/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/include/linux/grsecurity.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,199 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+void gr_handle_brute_attach(struct task_struct *p);
-+void gr_handle_brute_check(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+					const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+				   const struct vfsmount *mnt);
-+int gr_handle_chroot_caps(struct path *path);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+				  const struct vfsmount *mnt,
-+				  const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+int gr_handle_nproc(void);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+int gr_random_pid(void);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+			 const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+			       const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+				 const struct inode *inode,
-+				 const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+			  const struct vfsmount *mnt,
-+			  const struct dentry *dir, const int flag,
-+			  const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+			      const struct vfsmount *mnt,
-+			      struct inode *inode,
-+			      const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+			      const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_acl_handle_mmap(const struct file *file,
-+			      const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+				  const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+				    const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+				 const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+			      const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+			const struct vfsmount *mnt,
-+			const int unsafe_share);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+				const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+				 const struct dentry *p_dentry,
-+				 const struct vfsmount *p_mnt, const int fmode,
-+				 const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+			     const struct vfsmount *mnt);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt,
-+				 const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+				   const struct dentry *parent_dentry,
-+				   const struct vfsmount *parent_mnt,
-+				   const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+				const struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				const struct dentry *old_dentry,
-+				const struct vfsmount *old_mnt, const char *to);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+				struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				struct dentry *old_dentry,
-+				struct inode *old_parent_inode,
-+				struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+				struct dentry *old_dentry,
-+				struct dentry *new_dentry,
-+				struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+			   const struct dentry *parent_dentry,
-+			   const struct vfsmount *parent_mnt,
-+			   const struct dentry *old_dentry,
-+			   const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+				 const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void gr_log_nonroot_mod_load(const char *modname);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_write(void);
-+void gr_handle_kmem_write(void);
-+void gr_handle_open_port(void);
-+int gr_handle_mem_mmap(const unsigned long offset,
-+			      struct vm_area_struct *vma);
-+
-+extern int grsec_enable_dmesg;
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.11/include/linux/hdpu_features.h linux-2.6.32.11/include/linux/hdpu_features.h
---- linux-2.6.32.11/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/hdpu_features.h	2010-04-04 20:46:41.677383221 -0400
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- 	spinlock_t lock;
- 	int excl;
--        int open_count;
-+	atomic_t open_count;
- 	unsigned char cached_val;
- 	int inited;
- 	unsigned long *set_addr;
-diff -urNp linux-2.6.32.11/include/linux/highmem.h linux-2.6.32.11/include/linux/highmem.h
---- linux-2.6.32.11/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/highmem.h	2010-04-04 20:46:41.677383221 -0400
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
- 	kunmap_atomic(kaddr, KM_USER0);
- }
- 
-+static inline void sanitize_highpage(struct page *page)
-+{
-+	void *kaddr;
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
-+	kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+	clear_page(kaddr);
-+	kunmap_atomic(kaddr, KM_CLEARPAGE);
-+	local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- 	unsigned start1, unsigned end1,
- 	unsigned start2, unsigned end2)
-diff -urNp linux-2.6.32.11/include/linux/init_task.h linux-2.6.32.11/include/linux/init_task.h
---- linux-2.6.32.11/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/init_task.h	2010-04-04 20:46:41.677383221 -0400
-@@ -115,6 +115,13 @@ extern struct cred init_cred;
- # define INIT_PERF_EVENTS(tsk)
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+# define INIT_GR_FS_LOCK					\
-+	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
-+#else
-+# define INIT_GR_FS_LOCK
-+#endif
-+
- /*
-  *  INIT_TASK is used to set up the first task table, touch at
-  * your own risk!. Base=0, limit=0x1fffff (=2MB)
-@@ -184,6 +191,7 @@ extern struct cred init_cred;
- 	INIT_FTRACE_GRAPH						\
- 	INIT_TRACE_RECURSION						\
- 	INIT_TASK_RCU_PREEMPT(tsk)					\
-+	INIT_GR_FS_LOCK							\
- }
- 
- 
-diff -urNp linux-2.6.32.11/include/linux/interrupt.h linux-2.6.32.11/include/linux/interrupt.h
---- linux-2.6.32.11/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/interrupt.h	2010-04-04 20:46:41.677383221 -0400
-@@ -357,7 +357,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
-  * kernel/softirq.c when adding a new softirq.
-  */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
- 
- /* softirq mask and active fields moved to irq_cpustat_t in
-  * asm/hardirq.h to get better cache usage.  KAO
-@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
- 
- struct softirq_action
- {
--	void	(*action)(struct softirq_action *);
-+	void	(*action)(void);
- };
- 
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff -urNp linux-2.6.32.11/include/linux/jbd2.h linux-2.6.32.11/include/linux/jbd2.h
---- linux-2.6.32.11/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/jbd2.h	2010-04-04 20:46:41.677383221 -0400
-@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd2_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.11/include/linux/jbd.h linux-2.6.32.11/include/linux/jbd.h
---- linux-2.6.32.11/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/jbd.h	2010-04-04 20:46:41.677383221 -0400
-@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.11/include/linux/kallsyms.h linux-2.6.32.11/include/linux/kallsyms.h
---- linux-2.6.32.11/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/kallsyms.h	2010-04-04 20:46:41.677383221 -0400
-@@ -15,7 +15,8 @@
- 
- struct module;
- 
--#ifdef CONFIG_KALLSYMS
-+#ifndef __INCLUDED_BY_HIDESYM
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
- 
-@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, with HIDESYM enabled */
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+#endif
- 
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.32.11/include/linux/kgdb.h linux-2.6.32.11/include/linux/kgdb.h
---- linux-2.6.32.11/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/kgdb.h	2010-04-04 20:46:41.677383221 -0400
-@@ -251,20 +251,20 @@ struct kgdb_arch {
-  */
- struct kgdb_io {
- 	const char		*name;
--	int			(*read_char) (void);
--	void			(*write_char) (u8);
--	void			(*flush) (void);
--	int			(*init) (void);
--	void			(*pre_exception) (void);
--	void			(*post_exception) (void);
-+	int			(* const read_char) (void);
-+	void			(* const write_char) (u8);
-+	void			(* const flush) (void);
-+	int			(* const init) (void);
-+	void			(* const pre_exception) (void);
-+	void			(* const post_exception) (void);
- };
- 
--extern struct kgdb_arch		arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
- 
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
- 
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
- 
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.32.11/include/linux/kobject.h linux-2.6.32.11/include/linux/kobject.h
---- linux-2.6.32.11/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/kobject.h	2010-04-04 20:46:41.677383221 -0400
-@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
- 
- struct kobj_type {
- 	void (*release)(struct kobject *kobj);
--	struct sysfs_ops *sysfs_ops;
-+	const struct sysfs_ops *sysfs_ops;
- 	struct attribute **default_attrs;
- };
- 
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
- 
- struct kset_uevent_ops {
--	int (*filter)(struct kset *kset, struct kobject *kobj);
--	const char *(*name)(struct kset *kset, struct kobject *kobj);
--	int (*uevent)(struct kset *kset, struct kobject *kobj,
-+	int (* const filter)(struct kset *kset, struct kobject *kobj);
-+	const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+	int (* const uevent)(struct kset *kset, struct kobject *kobj,
- 		      struct kobj_uevent_env *env);
- };
- 
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- 			 const char *buf, size_t count);
- };
- 
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
- 
- /**
-  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- 	struct list_head list;
- 	spinlock_t list_lock;
- 	struct kobject kobj;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- };
- 
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
--						struct kset_uevent_ops *u,
-+						const struct kset_uevent_ops *u,
- 						struct kobject *parent_kobj);
- 
- static inline struct kset *to_kset(struct kobject *kobj)
-diff -urNp linux-2.6.32.11/include/linux/kvm_host.h linux-2.6.32.11/include/linux/kvm_host.h
---- linux-2.6.32.11/include/linux/kvm_host.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/kvm_host.h	2010-04-04 20:46:41.677383221 -0400
-@@ -205,7 +205,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module);
- void kvm_exit(void);
- 
-@@ -311,7 +311,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
- 					struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
- 
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
- 
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.32.11/include/linux/libata.h linux-2.6.32.11/include/linux/libata.h
---- linux-2.6.32.11/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/libata.h	2010-04-04 20:46:41.677383221 -0400
-@@ -64,11 +64,11 @@
- #ifdef ATA_VERBOSE_DEBUG
- #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
- #else
--#define VPRINTK(fmt, args...)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_VERBOSE_DEBUG */
- #else
--#define DPRINTK(fmt, args...)
--#define VPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_DEBUG */
- 
- #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
-@@ -524,11 +524,11 @@ struct ata_ioports {
- 
- struct ata_host {
- 	spinlock_t		lock;
--	struct device 		*dev;
-+	struct device		*dev;
- 	void __iomem * const	*iomap;
- 	unsigned int		n_ports;
- 	void			*private_data;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned long		flags;
- #ifdef CONFIG_ATA_ACPI
- 	acpi_handle		acpi_handle;
-@@ -709,7 +709,7 @@ struct ata_link {
- 
- struct ata_port {
- 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	spinlock_t		*lock;
- 	/* Flags owned by the EH context. Only EH should touch these once the
- 	   port is active */
-@@ -891,7 +891,7 @@ struct ata_port_info {
- 	unsigned long		pio_mask;
- 	unsigned long		mwdma_mask;
- 	unsigned long		udma_mask;
--	struct ata_port_operations *port_ops;
-+	const struct ata_port_operations *port_ops;
- 	void 			*private_data;
- };
- 
-@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
- 
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
- 
- static inline const unsigned long *
-@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
- 			     struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
--			  unsigned long, struct ata_port_operations *);
-+			  unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff -urNp linux-2.6.32.11/include/linux/lockd/bind.h linux-2.6.32.11/include/linux/lockd/bind.h
---- linux-2.6.32.11/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/lockd/bind.h	2010-04-04 20:46:41.681061354 -0400
-@@ -23,13 +23,13 @@ struct svc_rqst;
-  * This is the set of functions for lockd->nfsd communication
-  */
- struct nlmsvc_binding {
--	__be32			(*fopen)(struct svc_rqst *,
-+	__be32			(* const fopen)(struct svc_rqst *,
- 						struct nfs_fh *,
- 						struct file **);
--	void			(*fclose)(struct file *);
-+	void			(* const fclose)(struct file *);
- };
- 
--extern struct nlmsvc_binding *	nlmsvc_ops;
-+extern const struct nlmsvc_binding *	nlmsvc_ops;
- 
- /*
-  * Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.32.11/include/linux/mm.h linux-2.6.32.11/include/linux/mm.h
---- linux-2.6.32.11/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/mm.h	2010-04-04 20:46:41.681061354 -0400
-@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
- #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
-+#endif
-+
- #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
- #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
- #endif
-@@ -880,6 +884,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
- 
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
- 
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -1152,6 +1158,7 @@ out:
- }
- 
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
- 
- extern unsigned long do_brk(unsigned long, unsigned long);
- 
-@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- 					     struct vm_area_struct **pprev);
- 
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
-    NULL if none.  Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
- 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
- 
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- 			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
- 
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.32.11/include/linux/mm_types.h linux-2.6.32.11/include/linux/mm_types.h
---- linux-2.6.32.11/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/mm_types.h	2010-04-04 20:46:41.681061354 -0400
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
- #endif
-+
-+	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
- 
- struct core_thread {
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- 	struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	unsigned long delta_mmap;		/* randomized offset */
-+	unsigned long delta_stack;		/* randomized offset */
-+#endif
-+
- };
- 
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.32.11/include/linux/mmu_notifier.h linux-2.6.32.11/include/linux/mmu_notifier.h
---- linux-2.6.32.11/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/mmu_notifier.h	2010-04-04 20:46:41.681061354 -0400
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
-  */
- #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
- ({									\
--	pte_t __pte;							\
-+	pte_t ___pte;							\
- 	struct vm_area_struct *___vma = __vma;				\
- 	unsigned long ___address = __address;				\
--	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
-+	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
- 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
--	__pte;								\
-+	___pte;								\
- })
- 
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
-diff -urNp linux-2.6.32.11/include/linux/mod_devicetable.h linux-2.6.32.11/include/linux/mod_devicetable.h
---- linux-2.6.32.11/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/mod_devicetable.h	2010-04-04 20:46:41.681061354 -0400
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
- 
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
- 
- struct pci_device_id {
- 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
- 
--#define HID_ANY_ID				(~0)
-+#define HID_ANY_ID				(~0U)
- 
- struct hid_device_id {
- 	__u16 bus;
-diff -urNp linux-2.6.32.11/include/linux/module.h linux-2.6.32.11/include/linux/module.h
---- linux-2.6.32.11/include/linux/module.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/module.h	2010-04-04 20:46:41.681061354 -0400
-@@ -287,16 +287,16 @@ struct module
- 	int (*init)(void);
- 
- 	/* If this is non-NULL, vfree after init() returns */
--	void *module_init;
-+	void *module_init_rx, *module_init_rw;
- 
- 	/* Here is the actual code + data, vfree'd on unload. */
--	void *module_core;
-+	void *module_core_rx, *module_core_rw;
- 
- 	/* Here are the sizes of the init and core sections */
--	unsigned int init_size, core_size;
-+	unsigned int init_size_rw, core_size_rw;
- 
- 	/* The size of the executable code in each section.  */
--	unsigned int init_text_size, core_text_size;
-+	unsigned int init_size_rx, core_size_rx;
- 
- 	/* Arch-specific module values */
- 	struct mod_arch_specific arch;
-@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
- 
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (ktla_ktva(addr) >= (unsigned long)start &&
-+	    ktla_ktva(addr) < (unsigned long)start + size)
-+		return 1;
-+#endif
-+
-+	return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_core <= addr &&
--	       addr < (unsigned long)mod->module_core + mod->core_size;
-+	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
- 
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_init <= addr &&
--	       addr < (unsigned long)mod->module_init + mod->init_size;
-+	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
- 
- /* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.32.11/include/linux/moduleloader.h linux-2.6.32.11/include/linux/moduleloader.h
---- linux-2.6.32.11/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/moduleloader.h	2010-04-04 20:46:41.681061354 -0400
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
-    sections.  Returns NULL on failure. */
- void *module_alloc(unsigned long size);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF.  Return -error
-    or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.32.11/include/linux/namei.h linux-2.6.32.11/include/linux/namei.h
---- linux-2.6.32.11/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/namei.h	2010-04-04 20:46:41.681061354 -0400
-@@ -22,7 +22,7 @@ struct nameidata {
- 	unsigned int	flags;
- 	int		last_type;
- 	unsigned	depth;
--	char *saved_names[MAX_NESTED_LINKS + 1];
-+	const char *saved_names[MAX_NESTED_LINKS + 1];
- 
- 	/* Intent data */
- 	union {
-@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
- 
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- 	nd->saved_names[nd->depth] = path;
- }
- 
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- 	return nd->saved_names[nd->depth];
- }
-diff -urNp linux-2.6.32.11/include/linux/nodemask.h linux-2.6.32.11/include/linux/nodemask.h
---- linux-2.6.32.11/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/nodemask.h	2010-04-04 20:46:41.681061354 -0400
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
- 
- #define any_online_node(mask)			\
- ({						\
--	int node;				\
--	for_each_node_mask(node, (mask))	\
--		if (node_online(node))		\
-+	int __node;				\
-+	for_each_node_mask(__node, (mask))	\
-+		if (node_online(__node))	\
- 			break;			\
--	node;					\
-+	__node;					\
- })
- 
- #define num_online_nodes()	num_node_state(N_ONLINE)
-diff -urNp linux-2.6.32.11/include/linux/oprofile.h linux-2.6.32.11/include/linux/oprofile.h
---- linux-2.6.32.11/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/oprofile.h	2010-04-04 20:46:41.681061354 -0400
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- 	char const * name, ulong * val);
-  
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
--	char const * name, atomic_t * val);
-+	char const * name, atomic_unchecked_t * val);
-  
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.32.11/include/linux/pipe_fs_i.h linux-2.6.32.11/include/linux/pipe_fs_i.h
---- linux-2.6.32.11/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/pipe_fs_i.h	2010-04-04 20:46:41.681061354 -0400
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- 	wait_queue_head_t wait;
- 	unsigned int nrbufs, curbuf;
- 	struct page *tmp_page;
--	unsigned int readers;
--	unsigned int writers;
--	unsigned int waiting_writers;
-+	atomic_t readers;
-+	atomic_t writers;
-+	atomic_t waiting_writers;
- 	unsigned int r_counter;
- 	unsigned int w_counter;
- 	struct fasync_struct *fasync_readers;
-diff -urNp linux-2.6.32.11/include/linux/poison.h linux-2.6.32.11/include/linux/poison.h
---- linux-2.6.32.11/include/linux/poison.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/poison.h	2010-04-04 20:46:41.681061354 -0400
-@@ -7,8 +7,8 @@
-  * under normal circumstances, used to verify that nobody uses
-  * non-initialized list entries.
-  */
--#define LIST_POISON1  ((void *) 0x00100100)
--#define LIST_POISON2  ((void *) 0x00200200)
-+#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
- 
- /********** include/linux/timer.h **********/
- /*
-diff -urNp linux-2.6.32.11/include/linux/proc_fs.h linux-2.6.32.11/include/linux/proc_fs.h
---- linux-2.6.32.11/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/proc_fs.h	2010-04-04 20:46:41.681061354 -0400
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
- 	return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
- 
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+	return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+	
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- 	mode_t mode, struct proc_dir_entry *base, 
- 	read_proc_t *read_proc, void * data)
-diff -urNp linux-2.6.32.11/include/linux/random.h linux-2.6.32.11/include/linux/random.h
---- linux-2.6.32.11/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/random.h	2010-04-04 20:46:41.681061354 -0400
-@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
- 
-+static inline unsigned long pax_get_random_long(void)
-+{
-+	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
- 
- #endif /* _LINUX_RANDOM_H */
-diff -urNp linux-2.6.32.11/include/linux/reiserfs_fs.h linux-2.6.32.11/include/linux/reiserfs_fs.h
---- linux-2.6.32.11/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/reiserfs_fs.h	2010-04-04 20:46:41.681061354 -0400
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
- #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
- 
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
- */
- 
- struct item_operations {
--	int (*bytes_number) (struct item_head * ih, int block_size);
--	void (*decrement_key) (struct cpu_key *);
--	int (*is_left_mergeable) (struct reiserfs_key * ih,
-+	int (* const bytes_number) (struct item_head * ih, int block_size);
-+	void (* const decrement_key) (struct cpu_key *);
-+	int (* const is_left_mergeable) (struct reiserfs_key * ih,
- 				  unsigned long bsize);
--	void (*print_item) (struct item_head *, char *item);
--	void (*check_item) (struct item_head *, char *item);
-+	void (* const print_item) (struct item_head *, char *item);
-+	void (* const check_item) (struct item_head *, char *item);
- 
--	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- 			  int is_affected, int insert_size);
--	int (*check_left) (struct virtual_item * vi, int free,
-+	int (* const check_left) (struct virtual_item * vi, int free,
- 			   int start_skip, int end_skip);
--	int (*check_right) (struct virtual_item * vi, int free);
--	int (*part_size) (struct virtual_item * vi, int from, int to);
--	int (*unit_num) (struct virtual_item * vi);
--	void (*print_vi) (struct virtual_item * vi);
-+	int (* const check_right) (struct virtual_item * vi, int free);
-+	int (* const part_size) (struct virtual_item * vi, int from, int to);
-+	int (* const unit_num) (struct virtual_item * vi);
-+	void (* const print_vi) (struct virtual_item * vi);
- };
- 
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
- 
- #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.32.11/include/linux/reiserfs_fs_sb.h linux-2.6.32.11/include/linux/reiserfs_fs_sb.h
---- linux-2.6.32.11/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/reiserfs_fs_sb.h	2010-04-04 20:46:41.681061354 -0400
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- 	/* Comment? -Hans */
- 	wait_queue_head_t s_wait;
- 	/* To be obsoleted soon by per buffer seals.. -Hans */
--	atomic_t s_generation_counter;	// increased by one every time the
-+	atomic_unchecked_t s_generation_counter;	// increased by one every time the
- 	// tree gets re-balanced
- 	unsigned long s_properties;	/* File system properties. Currently holds
- 					   on-disk FS format */
-diff -urNp linux-2.6.32.11/include/linux/sched.h linux-2.6.32.11/include/linux/sched.h
---- linux-2.6.32.11/include/linux/sched.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/sched.h	2010-04-04 20:46:41.681061354 -0400
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
- 
- /*
-  * List of flags we want to share for kernel threads,
-@@ -664,6 +665,15 @@ struct signal_struct {
- 	struct tty_audit_buf *tty_audit_buf;
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+	u32 curr_ip;
-+	u32 gr_saddr;
-+	u32 gr_daddr;
-+	u16 gr_sport;
-+	u16 gr_dport;
-+	u8 used_accept:1;
-+#endif
-+
- 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
- };
- 
-@@ -1217,7 +1227,7 @@ struct rcu_node;
- 
- struct task_struct {
- 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
--	void *stack;
-+	struct thread_info *stack;
- 	atomic_t usage;
- 	unsigned int flags;	/* per process flags, defined below */
- 	unsigned int ptrace;
-@@ -1329,8 +1339,8 @@ struct task_struct {
- 	struct list_head thread_group;
- 
- 	struct completion *vfork_done;		/* for vfork() */
--	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
--	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
-+	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
-+	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
- 
- 	cputime_t utime, stime, utimescaled, stimescaled;
- 	cputime_t gtime;
-@@ -1344,16 +1354,6 @@ struct task_struct {
- 	struct task_cputime cputime_expires;
- 	struct list_head cpu_timers[3];
- 
--/* process credentials */
--	const struct cred *real_cred;	/* objective and real subjective task
--					 * credentials (COW) */
--	const struct cred *cred;	/* effective (overridable) subjective task
--					 * credentials (COW) */
--	struct mutex cred_guard_mutex;	/* guard against foreign influences on
--					 * credential calculations
--					 * (notably. ptrace) */
--	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- 	char comm[TASK_COMM_LEN]; /* executable name excluding path
- 				     - access with [gs]et_task_comm (which lock
- 				       it with task_lock())
-@@ -1437,6 +1437,15 @@ struct task_struct {
- 	int hardirq_context;
- 	int softirq_context;
- #endif
-+
-+/* process credentials */
-+	const struct cred *real_cred;	/* objective and real subjective task
-+					 * credentials (COW) */
-+	struct mutex cred_guard_mutex;	/* guard against foreign influences on
-+					 * credential calculations
-+					 * (notably. ptrace) */
-+	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- 	u64 curr_chain_key;
-@@ -1457,6 +1466,9 @@ struct task_struct {
- 
- 	struct backing_dev_info *backing_dev_info;
- 
-+	const struct cred *cred;	/* effective (overridable) subjective task
-+					 * credentials (COW) */
-+
- 	struct io_context *io_context;
- 
- 	unsigned long ptrace_message;
-@@ -1520,6 +1532,19 @@ struct task_struct {
- 	unsigned long default_timer_slack_ns;
- 
- 	struct list_head	*scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+	/* grsecurity */
-+	rwlock_t gr_fs_lock;
-+	struct acl_subject_label *acl;
-+	struct acl_role_label *role;
-+	struct file *exec_file;
-+	u16 acl_role_id;
-+	u8 acl_sp_role;
-+	u8 is_writable;
-+	u8 brute;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- 	/* Index of current stored adress in ret_stack */
- 	int curr_ret_stack;
-@@ -1544,6 +1569,52 @@ struct task_struct {
- 	unsigned long stack_start;
- };
- 
-+#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
-+#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern unsigned int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+	if (likely(tsk->mm))
-+		return tsk->mm->pax_flags;
-+	else
-+		return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+	if (likely(tsk->mm)) {
-+		tsk->mm->pax_flags = flags;
-+		return 0;
-+	}
-+	return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+void pax_report_insns(void *pc, void *sp);
-+void pax_report_refcount_overflow(struct pt_regs *regs);
-+void pax_report_leak_to_user(const void *ptr, unsigned long len);
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len);
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
- 
-@@ -2143,7 +2214,7 @@ extern void __cleanup_sighand(struct sig
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
- 
--extern NORET_TYPE void do_group_exit(int);
-+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
- 
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2245,6 +2316,33 @@ static inline void task_unlock(struct ta
- 	spin_unlock(&p->alloc_lock);
- }
- 
-+/* grsec: protects only ->fs as task_lock is overkill and we can't
-+   be using a spin_lock in interrupt context
-+*/
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_fs_write_lock_irqsave(x, y)				\
-+	write_lock_irqsave(&x->gr_fs_lock, y)
-+#define gr_fs_write_unlock_irqrestore(x, y) 			\
-+	write_unlock_irqrestore(&x->gr_fs_lock, y)
-+#else
-+#define gr_fs_write_lock_irqsave(x, y)
-+#define gr_fs_write_unlock_irqrestore(x, y)
-+#endif
-+
-+static inline void gr_fs_read_lock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_lock(&p->gr_fs_lock);
-+#endif
-+}
-+
-+static inline void gr_fs_read_unlock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_unlock(&p->gr_fs_lock);
-+#endif
-+}
-+
- extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
- 							unsigned long *flags);
- 
-@@ -2256,8 +2354,8 @@ static inline void unlock_task_sighand(s
- 
- #ifndef __HAVE_THREAD_FUNCTIONS
- 
--#define task_thread_info(task)	((struct thread_info *)(task)->stack)
--#define task_stack_page(task)	((task)->stack)
-+#define task_thread_info(task)	((task)->stack)
-+#define task_stack_page(task)	((void *)(task)->stack)
- 
- static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
- {
-@@ -2272,13 +2370,31 @@ static inline unsigned long *end_of_stac
- 
- #endif
- 
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
--	void *stack = task_stack_page(current);
-+	const void *stack = task_stack_page(current);
- 
- 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
- 
-+/* 0: not at all, 1: fully, -1: partially (implies an error) */
-+static inline int object_is_on_stack(const void *obj, unsigned long len)
-+{
-+	const void *stack = task_stack_page(current);
-+	const void *stackend = stack + THREAD_SIZE;
-+
-+	if (obj + len < obj)
-+		return -1;
-+
-+	if (stack <= obj && obj + len <= stackend)
-+		return 1;
-+
-+	if (obj + len <= stack || stackend <=  obj)
-+		return 0;
-+
-+	return -1;
-+}
-+
- extern void thread_info_cache_init(void);
- 
- #ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.32.11/include/linux/screen_info.h linux-2.6.32.11/include/linux/screen_info.h
---- linux-2.6.32.11/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/screen_info.h	2010-04-04 20:46:41.681061354 -0400
-@@ -42,7 +42,8 @@ struct screen_info {
- 	__u16 pages;		/* 0x32 */
- 	__u16 vesa_attributes;	/* 0x34 */
- 	__u32 capabilities;     /* 0x36 */
--	__u8  _reserved[6];	/* 0x3a */
-+	__u16 vesapm_size;	/* 0x3a */
-+	__u8  _reserved[4];	/* 0x3c */
- } __attribute__((packed));
- 
- #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
-diff -urNp linux-2.6.32.11/include/linux/security.h linux-2.6.32.11/include/linux/security.h
---- linux-2.6.32.11/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/security.h	2010-04-04 20:46:41.681061354 -0400
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
- 
- /* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.32.11/include/linux/shm.h linux-2.6.32.11/include/linux/shm.h
---- linux-2.6.32.11/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/shm.h	2010-04-04 20:46:41.681061354 -0400
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
- 	pid_t			shm_cprid;
- 	pid_t			shm_lprid;
- 	struct user_struct	*mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+	time_t			shm_createtime;
-+	pid_t			shm_lapid;
-+#endif
- };
- 
- /* shm_mode upper byte flags */
-diff -urNp linux-2.6.32.11/include/linux/slab.h linux-2.6.32.11/include/linux/slab.h
---- linux-2.6.32.11/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/slab.h	2010-04-04 20:47:28.956670452 -0400
-@@ -11,6 +11,7 @@
- 
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
- 
- /*
-  * Flags to pass to kmem_cache_create().
-@@ -82,10 +83,13 @@
-  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
-  * Both make kfree a no-op.
-  */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR				\
-+({						\
-+	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+	(void *)(-MAX_ERRNO-1L);		\
-+})
- 
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
--				(unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
- 
- /*
-  * struct kmem_cache related prototypes
-@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- /*
-  * Allocator specific definitions. These are mainly used to establish optimized
-@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
- 
- void __init kmem_cache_init_late(void);
- 
-+#define kmalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kmalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
-+#define kmalloc_node(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = kmalloc_node((size_t)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define kzalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kzalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
- #endif	/* _LINUX_SLAB_H */
-diff -urNp linux-2.6.32.11/include/linux/slub_def.h linux-2.6.32.11/include/linux/slub_def.h
---- linux-2.6.32.11/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/slub_def.h	2010-04-04 20:46:41.685762250 -0400
-@@ -86,7 +86,7 @@ struct kmem_cache {
- 	struct kmem_cache_order_objects max;
- 	struct kmem_cache_order_objects min;
- 	gfp_t allocflags;	/* gfp flags to use on each alloc */
--	int refcount;		/* Refcount for slab cache destroy */
-+	atomic_t refcount;	/* Refcount for slab cache destroy */
- 	void (*ctor)(void *);
- 	int inuse;		/* Offset to metadata */
- 	int align;		/* Alignment */
-diff -urNp linux-2.6.32.11/include/linux/sonet.h linux-2.6.32.11/include/linux/sonet.h
---- linux-2.6.32.11/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/sonet.h	2010-04-04 20:46:41.685762250 -0400
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
- 
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.11/include/linux/suspend.h linux-2.6.32.11/include/linux/suspend.h
---- linux-2.6.32.11/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/suspend.h	2010-04-04 20:46:41.685762250 -0400
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
-  *	which require special recovery actions in that situation.
-  */
- struct platform_suspend_ops {
--	int (*valid)(suspend_state_t state);
--	int (*begin)(suspend_state_t state);
--	int (*prepare)(void);
--	int (*prepare_late)(void);
--	int (*enter)(suspend_state_t state);
--	void (*wake)(void);
--	void (*finish)(void);
--	void (*end)(void);
--	void (*recover)(void);
-+	int (* const valid)(suspend_state_t state);
-+	int (* const begin)(suspend_state_t state);
-+	int (* const prepare)(void);
-+	int (* const prepare_late)(void);
-+	int (* const enter)(suspend_state_t state);
-+	void (* const wake)(void);
-+	void (* const finish)(void);
-+	void (* const end)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
-  * suspend_set_ops - set platform dependent suspend operations
-  * @ops: The new suspend operations to set.
-  */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
- 
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem	NULL
- 
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
- 
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
-  *	platforms which require special recovery actions in that situation.
-  */
- struct platform_hibernation_ops {
--	int (*begin)(void);
--	void (*end)(void);
--	int (*pre_snapshot)(void);
--	void (*finish)(void);
--	int (*prepare)(void);
--	int (*enter)(void);
--	void (*leave)(void);
--	int (*pre_restore)(void);
--	void (*restore_cleanup)(void);
--	void (*recover)(void);
-+	int (* const begin)(void);
-+	void (* const end)(void);
-+	int (* const pre_snapshot)(void);
-+	void (* const finish)(void);
-+	int (* const prepare)(void);
-+	int (* const enter)(void);
-+	void (* const leave)(void);
-+	int (* const pre_restore)(void);
-+	void (* const restore_cleanup)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
- 
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
- 
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff -urNp linux-2.6.32.11/include/linux/sysctl.h linux-2.6.32.11/include/linux/sysctl.h
---- linux-2.6.32.11/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/sysctl.h	2010-04-04 20:46:41.685762250 -0400
-@@ -164,7 +164,11 @@ enum
- 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
- 
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
-+};
-+#endif
- 
- /* CTL_VM names: */
- enum
-diff -urNp linux-2.6.32.11/include/linux/sysfs.h linux-2.6.32.11/include/linux/sysfs.h
---- linux-2.6.32.11/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/sysfs.h	2010-04-04 20:46:41.685762250 -0400
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
- 
- struct sysfs_ops {
--	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
--	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
-+	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
-+	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
- 
- struct sysfs_dirent;
-diff -urNp linux-2.6.32.11/include/linux/thread_info.h linux-2.6.32.11/include/linux/thread_info.h
---- linux-2.6.32.11/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/thread_info.h	2010-04-04 20:46:41.685762250 -0400
-@@ -23,7 +23,7 @@ struct restart_block {
- 		};
- 		/* For futex_wait and futex_wait_requeue_pi */
- 		struct {
--			u32 *uaddr;
-+			u32 __user *uaddr;
- 			u32 val;
- 			u32 flags;
- 			u32 bitset;
-diff -urNp linux-2.6.32.11/include/linux/tty.h linux-2.6.32.11/include/linux/tty.h
---- linux-2.6.32.11/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.11/include/linux/tty.h	2010-04-04 20:46:41.685762250 -0400
-@@ -13,6 +13,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_ldisc.h>
- #include <linux/mutex.h>
-+#include <linux/poll.h>
- 
- #include <asm/system.h>
- 
-@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
- extern dev_t tty_devnum(struct tty_struct *tty);
- extern void proc_clear_tty(struct task_struct *p);
- extern struct tty_struct *get_current_tty(void);
--extern void tty_default_fops(struct file_operations *fops);
- extern struct tty_struct *alloc_tty_struct(void);
- extern void free_tty_struct(struct tty_struct *tty);
- extern void initialize_tty_struct(struct tty_struct *tty,
-@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
- 
-+/* tty_io.c */
-+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
-+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
-+extern unsigned int tty_poll(struct file *, poll_table *);
-+#ifdef CONFIG_COMPAT
-+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+				unsigned long arg);
-+#else
-+#define tty_compat_ioctl NULL
-+#endif
-+extern int tty_release(struct inode *, struct file *);
-+extern int tty_fasync(int fd, struct file *filp, int on);
- 
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-diff -urNp linux-2.6.32.11/include/linux/tty_ldisc.h linux-2.6.32.11/include/linux/tty_ldisc.h
---- linux-2.6.32.11/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/tty_ldisc.h	2010-04-04 20:46:41.685762250 -0400
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
- 
- 	struct  module *owner;
- 	
--	int refcount;
-+	atomic_t refcount;
- };
- 
- struct tty_ldisc {
-diff -urNp linux-2.6.32.11/include/linux/types.h linux-2.6.32.11/include/linux/types.h
---- linux-2.6.32.11/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/types.h	2010-04-04 20:46:41.685762250 -0400
-@@ -191,10 +191,26 @@ typedef struct {
- 	volatile int counter;
- } atomic_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- 	volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
- 
- struct ustat {
-diff -urNp linux-2.6.32.11/include/linux/uaccess.h linux-2.6.32.11/include/linux/uaccess.h
---- linux-2.6.32.11/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/uaccess.h	2010-04-04 20:46:41.685762250 -0400
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
- 		long ret;				\
- 		mm_segment_t old_fs = get_fs();		\
- 							\
--		set_fs(KERNEL_DS);			\
- 		pagefault_disable();			\
-+		set_fs(KERNEL_DS);			\
- 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
--		pagefault_enable();			\
- 		set_fs(old_fs);				\
-+		pagefault_enable();			\
- 		ret;					\
- 	})
- 
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
- 
- /*
-  * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size);
- 
- #endif		/* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.32.11/include/linux/vmalloc.h linux-2.6.32.11/include/linux/vmalloc.h
---- linux-2.6.32.11/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/linux/vmalloc.h	2010-04-04 20:46:41.685762250 -0400
-@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
- #define VM_MAP		0x00000004	/* vmap()ed pages */
- #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
- #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
- 
- /*
-@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
- 
- void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
- 
-+#define vmalloc(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define __vmalloc(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = __vmalloc((unsigned long)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_user(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_user((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_exec(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_exec((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_node(x, y)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_node((unsigned long)___x, (y));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32_user(x)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32_user((unsigned long)___x);\
-+	___retval;						\
-+})
-+
- #endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.32.11/include/net/irda/ircomm_tty.h linux-2.6.32.11/include/net/irda/ircomm_tty.h
---- linux-2.6.32.11/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/net/irda/ircomm_tty.h	2010-04-04 20:46:41.685762250 -0400
-@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
-         unsigned short    close_delay;
-         unsigned short    closing_wait; /* time to wait before closing */
- 
--	int  open_count;
--	int  blocked_open;	/* # of blocked opens */
-+	atomic_t open_count;
-+	atomic_t blocked_open;	/* # of blocked opens */
- 
- 	/* Protect concurent access to :
- 	 *	o self->open_count
-diff -urNp linux-2.6.32.11/include/net/neighbour.h linux-2.6.32.11/include/net/neighbour.h
---- linux-2.6.32.11/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/net/neighbour.h	2010-04-04 20:46:41.685762250 -0400
-@@ -125,12 +125,12 @@ struct neighbour
- struct neigh_ops
- {
- 	int			family;
--	void			(*solicit)(struct neighbour *, struct sk_buff*);
--	void			(*error_report)(struct neighbour *, struct sk_buff*);
--	int			(*output)(struct sk_buff*);
--	int			(*connected_output)(struct sk_buff*);
--	int			(*hh_output)(struct sk_buff*);
--	int			(*queue_xmit)(struct sk_buff*);
-+	void			(* const solicit)(struct neighbour *, struct sk_buff*);
-+	void			(* const error_report)(struct neighbour *, struct sk_buff*);
-+	int			(* const output)(struct sk_buff*);
-+	int			(* const connected_output)(struct sk_buff*);
-+	int			(* const hh_output)(struct sk_buff*);
-+	int			(* const queue_xmit)(struct sk_buff*);
- };
- 
- struct pneigh_entry
-diff -urNp linux-2.6.32.11/include/net/sctp/sctp.h linux-2.6.32.11/include/net/sctp/sctp.h
---- linux-2.6.32.11/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/net/sctp/sctp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
- 
- #else	/* SCTP_DEBUG */
- 
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.32.11/include/net/tcp.h linux-2.6.32.11/include/net/tcp.h
---- linux-2.6.32.11/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/net/tcp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
- struct tcp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.11/include/net/udp.h linux-2.6.32.11/include/net/udp.h
---- linux-2.6.32.11/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/net/udp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
- 	struct udp_table	*udp_table;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.11/include/sound/ac97_codec.h linux-2.6.32.11/include/sound/ac97_codec.h
---- linux-2.6.32.11/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/sound/ac97_codec.h	2010-04-04 20:46:41.685762250 -0400
-@@ -419,15 +419,15 @@
- struct snd_ac97;
- 
- struct snd_ac97_build_ops {
--	int (*build_3d) (struct snd_ac97 *ac97);
--	int (*build_specific) (struct snd_ac97 *ac97);
--	int (*build_spdif) (struct snd_ac97 *ac97);
--	int (*build_post_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_3d) (struct snd_ac97 *ac97);
-+	int (* const build_specific) (struct snd_ac97 *ac97);
-+	int (* const build_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
--	void (*suspend) (struct snd_ac97 *ac97);
--	void (*resume) (struct snd_ac97 *ac97);
-+	void (* const suspend) (struct snd_ac97 *ac97);
-+	void (* const resume) (struct snd_ac97 *ac97);
- #endif
--	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
-+	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
- };
- 
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
- 
- struct snd_ac97 {
- 	/* -- lowlevel (hardware) driver specific -- */
--	struct snd_ac97_build_ops * build_ops;
-+	const struct snd_ac97_build_ops * build_ops;
- 	void *private_data;
- 	void (*private_free) (struct snd_ac97 *ac97);
- 	/* --- */
-diff -urNp linux-2.6.32.11/include/trace/events/irq.h linux-2.6.32.11/include/trace/events/irq.h
---- linux-2.6.32.11/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/trace/events/irq.h	2010-04-04 20:46:41.685762250 -0400
-@@ -34,7 +34,7 @@
-  */
- TRACE_EVENT(irq_handler_entry,
- 
--	TP_PROTO(int irq, struct irqaction *action),
-+	TP_PROTO(int irq, const struct irqaction *action),
- 
- 	TP_ARGS(irq, action),
- 
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
-  */
- TRACE_EVENT(irq_handler_exit,
- 
--	TP_PROTO(int irq, struct irqaction *action, int ret),
-+	TP_PROTO(int irq, const struct irqaction *action, int ret),
- 
- 	TP_ARGS(irq, action, ret),
- 
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
-  */
- TRACE_EVENT(softirq_entry,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
-  */
- TRACE_EVENT(softirq_exit,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-diff -urNp linux-2.6.32.11/include/video/uvesafb.h linux-2.6.32.11/include/video/uvesafb.h
---- linux-2.6.32.11/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/include/video/uvesafb.h	2010-04-04 20:46:41.685762250 -0400
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
- 	u8 pmi_setpal;			/* PMI for palette changes */
- 	u16 *pmi_base;			/* protected mode interface location */
-+	u8 *pmi_code;			/* protected mode code location */
- 	void *pmi_start;
- 	void *pmi_pal;
- 	u8 *vbe_state_orig;		/*
-diff -urNp linux-2.6.32.11/init/do_mounts.c linux-2.6.32.11/init/do_mounts.c
---- linux-2.6.32.11/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/do_mounts.c	2010-04-04 20:46:41.685762250 -0400
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
- 
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
--	int err = sys_mount(name, "/root", fs, flags, data);
-+	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- 	if (err)
- 		return err;
- 
--	sys_chdir("/root");
-+	sys_chdir((__force char __user *)"/root");
- 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
- 	va_start(args, fmt);
- 	vsprintf(buf, fmt, args);
- 	va_end(args);
--	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, FDEJECT, 0);
- 		sys_close(fd);
- 	}
- 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
--	fd = sys_open("/dev/console", O_RDWR, 0);
-+	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, TCGETS, (long)&termios);
- 		termios.c_lflag &= ~ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
--		sys_read(fd, &c, 1);
-+		sys_read(fd, (char __user *)&c, 1);
- 		termios.c_lflag |= ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
- 		sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- 	mount_root();
- out:
- 	devtmpfs_mount("dev");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force char __user *)".");
- }
-diff -urNp linux-2.6.32.11/init/do_mounts.h linux-2.6.32.11/init/do_mounts.h
---- linux-2.6.32.11/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/do_mounts.h	2010-04-04 20:46:41.685762250 -0400
-@@ -15,15 +15,15 @@ extern int root_mountflags;
- 
- static inline int create_dev(char *name, dev_t dev)
- {
--	sys_unlink(name);
--	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+	sys_unlink((__force char __user *)name);
-+	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
- 
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- 	struct stat64 stat;
--	if (sys_stat64(name, &stat) != 0)
-+	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
- 		return 0;
- 	if (!S_ISBLK(stat.st_mode))
- 		return 0;
-diff -urNp linux-2.6.32.11/init/do_mounts_initrd.c linux-2.6.32.11/init/do_mounts_initrd.c
---- linux-2.6.32.11/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/do_mounts_initrd.c	2010-04-04 20:46:41.685762250 -0400
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
- 	sys_close(old_fd);sys_close(root_fd);
- 	sys_close(0);sys_close(1);sys_close(2);
- 	sys_setsid();
--	(void) sys_open("/dev/console",O_RDWR,0);
-+	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- 	(void) sys_dup(0);
- 	(void) sys_dup(0);
- 	return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- 	create_dev("/dev/root.old", Root_RAM0);
- 	/* mount initrd on rootfs' /root */
- 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
--	sys_mkdir("/old", 0700);
--	root_fd = sys_open("/", 0, 0);
--	old_fd = sys_open("/old", 0, 0);
-+	sys_mkdir((__force const char __user *)"/old", 0700);
-+	root_fd = sys_open((__force const char __user *)"/", 0, 0);
-+	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
- 	/* move initrd over / and chdir/chroot in initrd root */
--	sys_chdir("/root");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_chdir((__force const char __user *)"/root");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force const char __user *)".");
- 
- 	/*
- 	 * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
- 
- 	/* move initrd to rootfs' /old */
- 	sys_fchdir(old_fd);
--	sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
- 	/* switch root and cwd back to / of rootfs */
- 	sys_fchdir(root_fd);
--	sys_chroot(".");
-+	sys_chroot((__force const char __user *)".");
- 	sys_close(old_fd);
- 	sys_close(root_fd);
- 
- 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
--		sys_chdir("/old");
-+		sys_chdir((__force const char __user *)"/old");
- 		return;
- 	}
- 
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- 	mount_root();
- 
- 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
--	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
- 	if (!error)
- 		printk("okay\n");
- 	else {
--		int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
- 		if (error == -ENOENT)
- 			printk("/initrd does not exist. Ignored.\n");
- 		else
- 			printk("failed\n");
- 		printk(KERN_NOTICE "Unmounting old root\n");
--		sys_umount("/old", MNT_DETACH);
-+		sys_umount((__force char __user *)"/old", MNT_DETACH);
- 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- 		if (fd < 0) {
- 			error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- 		 * mounted in the normal path.
- 		 */
- 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
--			sys_unlink("/initrd.image");
-+			sys_unlink((__force const char __user *)"/initrd.image");
- 			handle_initrd();
- 			return 1;
- 		}
- 	}
--	sys_unlink("/initrd.image");
-+	sys_unlink((__force const char __user *)"/initrd.image");
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/init/do_mounts_md.c linux-2.6.32.11/init/do_mounts_md.c
---- linux-2.6.32.11/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/do_mounts_md.c	2010-04-04 20:46:41.689696132 -0400
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- 			partitioned ? "_d" : "", minor,
- 			md_setup_args[ent].device_names);
- 
--		fd = sys_open(name, 0, 0);
-+		fd = sys_open((__force char __user *)name, 0, 0);
- 		if (fd < 0) {
- 			printk(KERN_ERR "md: open failed - cannot start "
- 					"array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- 			 * array without it
- 			 */
- 			sys_close(fd);
--			fd = sys_open(name, 0, 0);
-+			fd = sys_open((__force char __user *)name, 0, 0);
- 			sys_ioctl(fd, BLKRRPART, 0);
- 		}
- 		sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
- 
- 	wait_for_device_probe();
- 
--	fd = sys_open("/dev/md0", 0, 0);
-+	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- 		sys_close(fd);
-diff -urNp linux-2.6.32.11/init/initramfs.c linux-2.6.32.11/init/initramfs.c
---- linux-2.6.32.11/init/initramfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/initramfs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- 	}
- }
- 
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- 	struct timespec t[2];
- 
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- 	struct dir_entry *de, *tmp;
- 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
- 		list_del(&de->list);
--		do_utime(de->name, de->mtime);
-+		do_utime((__force char __user *)de->name, de->mtime);
- 		kfree(de->name);
- 		kfree(de);
- 	}
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- 	if (nlink >= 2) {
- 		char *old = find_link(major, minor, ino, mode, collected);
- 		if (old)
--			return (sys_link(old, collected) < 0) ? -1 : 1;
-+			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
- 	}
- 	return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path
- {
- 	struct stat st;
- 
--	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
- 		if (S_ISDIR(st.st_mode))
--			sys_rmdir(path);
-+			sys_rmdir((__force char __user *)path);
- 		else
--			sys_unlink(path);
-+			sys_unlink((__force char __user *)path);
- 	}
- }
- 
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- 			int openflags = O_WRONLY|O_CREAT;
- 			if (ml != 1)
- 				openflags |= O_TRUNC;
--			wfd = sys_open(collected, openflags, mode);
-+			wfd = sys_open((__force char __user *)collected, openflags, mode);
- 
- 			if (wfd >= 0) {
- 				sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- 			}
- 		}
- 	} else if (S_ISDIR(mode)) {
--		sys_mkdir(collected, mode);
--		sys_chown(collected, uid, gid);
--		sys_chmod(collected, mode);
-+		sys_mkdir((__force char __user *)collected, mode);
-+		sys_chown((__force char __user *)collected, uid, gid);
-+		sys_chmod((__force char __user *)collected, mode);
- 		dir_add(collected, mtime);
- 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
- 		if (maybe_link() == 0) {
--			sys_mknod(collected, mode, rdev);
--			sys_chown(collected, uid, gid);
--			sys_chmod(collected, mode);
--			do_utime(collected, mtime);
-+			sys_mknod((__force char __user *)collected, mode, rdev);
-+			sys_chown((__force char __user *)collected, uid, gid);
-+			sys_chmod((__force char __user *)collected, mode);
-+			do_utime((__force char __user *)collected, mtime);
- 		}
- 	}
- 	return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- 	if (count >= body_len) {
--		sys_write(wfd, victim, body_len);
-+		sys_write(wfd, (__force char __user *)victim, body_len);
- 		sys_close(wfd);
--		do_utime(vcollected, mtime);
-+		do_utime((__force char __user *)vcollected, mtime);
- 		kfree(vcollected);
- 		eat(body_len);
- 		state = SkipIt;
- 		return 0;
- 	} else {
--		sys_write(wfd, victim, count);
-+		sys_write(wfd, (__force char __user *)victim, count);
- 		body_len -= count;
- 		eat(count);
- 		return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- 	collected[N_ALIGN(name_len) + body_len] = '\0';
- 	clean_path(collected, 0);
--	sys_symlink(collected + N_ALIGN(name_len), collected);
--	sys_lchown(collected, uid, gid);
--	do_utime(collected, mtime);
-+	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
-+	sys_lchown((__force char __user *)collected, uid, gid);
-+	do_utime((__force char __user *)collected, mtime);
- 	state = SkipIt;
- 	next_state = Reset;
- 	return 0;
-diff -urNp linux-2.6.32.11/init/Kconfig linux-2.6.32.11/init/Kconfig
---- linux-2.6.32.11/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/Kconfig	2010-04-04 20:46:41.689696132 -0400
-@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
- 
- config COMPAT_BRK
- 	bool "Disable heap randomization"
--	default y
-+	default n
- 	help
- 	  Randomizing heap placement makes heap exploits harder, but it
- 	  also breaks ancient binaries (including anything libc5 based).
-@@ -1116,9 +1116,9 @@ config HAVE_GENERIC_DMA_COHERENT
- 
- config SLABINFO
- 	bool
--	depends on PROC_FS
-+	depends on PROC_FS && !GRKERNSEC_PROC_ADD
- 	depends on SLAB || SLUB_DEBUG
--	default y
-+	default n
- 
- config RT_MUTEXES
- 	boolean
-diff -urNp linux-2.6.32.11/init/main.c linux-2.6.32.11/init/main.c
---- linux-2.6.32.11/init/main.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.11/init/main.c	2010-04-04 20:58:33.225084964 -0400
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
- 
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
- 
- __setup("reset_devices", set_reset_devices);
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void pax_enter_kernel_user(void);
-+extern void pax_exit_kernel_user(void);
-+extern pteval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+	unsigned int cpu;
-+
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+	}
-+	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
-+#else
-+	char *p;
-+	p = (char *)pax_enter_kernel_user;
-+	*p = 0xc3;
-+	p = (char *)pax_exit_kernel_user;
-+	*p = 0xc3;
-+	clone_pgd_mask = ~(pteval_t)0UL;
-+#endif
-+
-+	return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+unsigned int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+	get_option(&str, &pax_softmode);
-+	return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -697,52 +742,53 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
- 
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
- 
- int do_one_initcall(initcall_t fn)
- {
- 	int count = preempt_count();
- 	ktime_t calltime, delta, rettime;
-+	const char *msg1 = "", *msg2 = "";
- 
- 	if (initcall_debug) {
--		call.caller = task_pid_nr(current);
--		printk("calling  %pF @ %i\n", fn, call.caller);
-+		trace_call.caller = task_pid_nr(current);
-+		printk("calling  %pF @ %i\n", fn, trace_call.caller);
- 		calltime = ktime_get();
--		trace_boot_call(&call, fn);
-+		trace_boot_call(&trace_call, fn);
- 		enable_boot_trace();
- 	}
- 
--	ret.result = fn();
-+	trace_ret.result = fn();
- 
- 	if (initcall_debug) {
- 		disable_boot_trace();
- 		rettime = ktime_get();
- 		delta = ktime_sub(rettime, calltime);
--		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
--		trace_boot_ret(&ret, fn);
-+		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+		trace_boot_ret(&trace_ret, fn);
- 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
--			ret.result, ret.duration);
-+			trace_ret.result, trace_ret.duration);
- 	}
- 
- 	msgbuf[0] = 0;
- 
--	if (ret.result && ret.result != -ENODEV && initcall_debug)
--		sprintf(msgbuf, "error code %d ", ret.result);
-+	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+		sprintf(msgbuf, "error code %d ", trace_ret.result);
- 
- 	if (preempt_count() != count) {
--		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+		msg1 = " preemption imbalance";
- 		preempt_count() = count;
- 	}
- 	if (irqs_disabled()) {
--		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+		msg2 = " disabled interrupts";
- 		local_irq_enable();
- 	}
--	if (msgbuf[0]) {
--		printk("initcall %pF returned with %s\n", fn, msgbuf);
-+	if (msgbuf[0] || *msg1 || *msg2) {
-+		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- 	}
- 
--	return ret.result;
-+	return trace_ret.result;
- }
- 
- 
-@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
- 	if (!ramdisk_execute_command)
- 		ramdisk_execute_command = "/init";
- 
--	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
- 		ramdisk_execute_command = NULL;
- 		prepare_namespace();
- 	}
- 
-+	grsecurity_init();
-+
- 	/*
- 	 * Ok, we have completed the initial bootup, and
- 	 * we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.32.11/init/noinitramfs.c linux-2.6.32.11/init/noinitramfs.c
---- linux-2.6.32.11/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/init/noinitramfs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- 	int err;
- 
--	err = sys_mkdir("/dev", 0755);
-+	err = sys_mkdir((const char __user *)"/dev", 0755);
- 	if (err < 0)
- 		goto out;
- 
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- 	if (err < 0)
- 		goto out;
- 
--	err = sys_mkdir("/root", 0700);
-+	err = sys_mkdir((const char __user *)"/root", 0700);
- 	if (err < 0)
- 		goto out;
- 
-diff -urNp linux-2.6.32.11/ipc/ipc_sysctl.c linux-2.6.32.11/ipc/ipc_sysctl.c
---- linux-2.6.32.11/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/ipc/ipc_sysctl.c	2010-04-04 20:46:41.689696132 -0400
-@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
- 		.extra1		= &zero,
- 		.extra2		= &one,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table ipc_root_table[] = {
-@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
- 		.mode		= 0555,
- 		.child		= ipc_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init ipc_sysctl_init(void)
-diff -urNp linux-2.6.32.11/ipc/mqueue.c linux-2.6.32.11/ipc/mqueue.c
---- linux-2.6.32.11/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.11/ipc/mqueue.c	2010-04-04 20:46:41.689696132 -0400
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
- 			mq_bytes = (mq_msg_tblsz +
- 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
- 
-+			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- 			spin_lock(&mq_lock);
- 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- 		 	    u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.32.11/ipc/shm.c linux-2.6.32.11/ipc/shm.c
---- linux-2.6.32.11/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/ipc/shm.c	2010-04-04 20:46:41.689696132 -0400
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime, const uid_t cuid,
-+			   const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- 	ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
- 	shp->shm_lprid = 0;
- 	shp->shm_atim = shp->shm_dtim = 0;
- 	shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+	{
-+		struct timespec timeval;
-+		do_posix_clock_monotonic_gettime(&timeval);
-+
-+		shp->shm_createtime = timeval.tv_sec;
-+	}
-+#endif
- 	shp->shm_segsz = size;
- 	shp->shm_nattch = 0;
- 	shp->shm_file = file;
-@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
- 	if (err)
- 		goto out_unlock;
- 
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+			     shp->shm_perm.cuid, shmid) ||
-+	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+		err = -EACCES;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	path.dentry = dget(shp->shm_file->f_path.dentry);
- 	path.mnt    = shp->shm_file->f_path.mnt;
- 	shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+	shp->shm_lapid = current->pid;
-+#endif
- 	size = i_size_read(path.dentry->d_inode);
- 	shm_unlock(shp);
- 
-diff -urNp linux-2.6.32.11/kernel/acct.c linux-2.6.32.11/kernel/acct.c
---- linux-2.6.32.11/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/acct.c	2010-04-04 20:46:41.689696132 -0400
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
- 	 */
- 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
--	file->f_op->write(file, (char *)&ac,
-+	file->f_op->write(file, (__force char __user *)&ac,
- 			       sizeof(acct_t), &file->f_pos);
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- 	set_fs(fs);
-diff -urNp linux-2.6.32.11/kernel/capability.c linux-2.6.32.11/kernel/capability.c
---- linux-2.6.32.11/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/capability.c	2010-04-04 20:46:41.689696132 -0400
-@@ -306,10 +306,21 @@ int capable(int cap)
- 		BUG();
- 	}
- 
--	if (security_capable(cap) == 0) {
-+	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- 		current->flags |= PF_SUPERPRIV;
- 		return 1;
- 	}
- 	return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
-+		current->flags |= PF_SUPERPRIV;
-+		return 1;
-+	}
-+	return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.32.11/kernel/configs.c linux-2.6.32.11/kernel/configs.c
---- linux-2.6.32.11/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/configs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- 	struct proc_dir_entry *entry;
- 
- 	/* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+			    &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+			    &ikconfig_file_ops);
-+#endif
-+#else
- 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- 			    &ikconfig_file_ops);
-+#endif
-+
- 	if (!entry)
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.11/kernel/cpu.c linux-2.6.32.11/kernel/cpu.c
---- linux-2.6.32.11/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/cpu.c	2010-04-04 20:46:41.689696132 -0400
-@@ -19,7 +19,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
- 
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
- 
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
-  * Should always be manipulated under cpu_add_remove_lock
-diff -urNp linux-2.6.32.11/kernel/cred.c linux-2.6.32.11/kernel/cred.c
---- linux-2.6.32.11/kernel/cred.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/cred.c	2010-04-04 20:46:41.689696132 -0400
-@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
- 
- 	get_cred(new); /* we will require a ref for the subj creds too */
- 
-+	gr_set_role_label(task, new->uid, new->gid);
-+
- 	/* dumpability changes */
- 	if (old->euid != new->euid ||
- 	    old->egid != new->egid ||
-diff -urNp linux-2.6.32.11/kernel/exit.c linux-2.6.32.11/kernel/exit.c
---- linux-2.6.32.11/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/exit.c	2010-04-04 20:46:41.689696132 -0400
-@@ -56,6 +56,10 @@
- #include <asm/mmu_context.h>
- #include "cred-internals.h"
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern rwlock_t grsec_exec_file_lock;
-+#endif
-+
- static void exit_mm(struct task_struct * tsk);
- 
- static void __unhash_process(struct task_struct *p)
-@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
- 	struct task_struct *leader;
- 	int zap_leader;
- repeat:
-+	gr_del_task_from_ip_table(p);
-+
- 	tracehook_prepare_release_task(p);
- 	/* don't need to get the RCU readlock here - the process is dead and
- 	 * can't be modifying its own credentials */
-@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
- {
- 	write_lock_irq(&tasklist_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
- 	ptrace_unlink(current);
- 	/* Reparent to init */
- 	current->real_parent = current->parent = kthreadd_task;
- 	list_move_tail(&current->sibling, &current->real_parent->children);
- 
-+	gr_set_kernel_label(current);
-+
- 	/* Set the exit signal to SIGCHLD so we signal init on exit */
- 	current->exit_signal = SIGCHLD;
- 
-@@ -390,7 +407,7 @@ int allow_signal(int sig)
- 	 * know it'll be handled, so that they don't get converted to
- 	 * SIGKILL or just silently dropped.
- 	 */
--	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- 	recalc_sigpending();
- 	spin_unlock_irq(&current->sighand->siglock);
- 	return 0;
-@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
- 	vsnprintf(current->comm, sizeof(current->comm), name, args);
- 	va_end(args);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
-+	gr_set_kernel_label(current);
-+
- 	/*
- 	 * If we were started as result of loading a module, close all of the
- 	 * user space pages.  We don't need them, and if we didn't close them
-@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
- 	tsk->exit_code = code;
- 	taskstats_exit(tsk, group_dead);
- 
-+	gr_acl_handle_psacct(tsk, code);
-+	gr_acl_handle_exit();
-+
- 	exit_mm(tsk);
- 
- 	if (group_dead)
-@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
- 
- 	if (unlikely(wo->wo_flags & WNOWAIT)) {
- 		int exit_code = p->exit_code;
--		int why, status;
-+		int why;
- 
- 		get_task_struct(p);
- 		read_unlock(&tasklist_lock);
-diff -urNp linux-2.6.32.11/kernel/fork.c linux-2.6.32.11/kernel/fork.c
---- linux-2.6.32.11/kernel/fork.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/fork.c	2010-04-04 20:46:41.689696132 -0400
-@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
- 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
- 
- #ifdef CONFIG_CC_STACKPROTECTOR
--	tsk->stack_canary = get_random_int();
-+	tsk->stack_canary = pax_get_random_long();
- #endif
- 
- 	/* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
- 	mm->locked_vm = 0;
- 	mm->mmap = NULL;
- 	mm->mmap_cache = NULL;
--	mm->free_area_cache = oldmm->mmap_base;
--	mm->cached_hole_size = ~0UL;
-+	mm->free_area_cache = oldmm->free_area_cache;
-+	mm->cached_hole_size = oldmm->cached_hole_size;
- 	mm->map_count = 0;
- 	cpumask_clear(mm_cpumask(mm));
- 	mm->mm_rb = RB_ROOT;
-@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
- 		tmp->vm_flags &= ~VM_LOCKED;
- 		tmp->vm_mm = mm;
- 		tmp->vm_next = NULL;
-+		tmp->vm_mirror = NULL;
- 		anon_vma_link(tmp);
- 		file = tmp->vm_file;
- 		if (file) {
-@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
- 		if (retval)
- 			goto out;
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+		struct vm_area_struct *mpnt_m;
-+
-+		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+			if (!mpnt->vm_mirror)
-+				continue;
-+
-+			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+				mpnt->vm_mirror = mpnt_m;
-+			} else {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+				mpnt->vm_mirror->vm_mirror = mpnt;
-+			}
-+		}
-+		BUG_ON(mpnt_m);
-+	}
-+#endif
-+
- 	/* a new mm has just been created */
- 	arch_dup_mmap(oldmm, mm);
- 	retval = 0;
-@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
- 			write_unlock(&fs->lock);
- 			return -EAGAIN;
- 		}
--		fs->users++;
-+		atomic_inc(&fs->users);
- 		write_unlock(&fs->lock);
- 		return 0;
- 	}
-@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
- 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- 	retval = -EAGAIN;
-+
-+	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- 	if (atomic_read(&p->real_cred->user->processes) >=
- 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
--		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
--		    p->real_cred->user != INIT_USER)
-+		if (p->real_cred->user != INIT_USER &&
-+		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- 			goto bad_fork_free;
- 	}
- 
-@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
- 	p->vfork_done = NULL;
- 	spin_lock_init(&p->alloc_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	rwlock_init(&p->gr_fs_lock);
-+#endif
-+
- 	init_sigpending(&p->pending);
- 
- 	p->utime = cputime_zero;
-@@ -1179,6 +1212,8 @@ static struct task_struct *copy_process(
- 			goto bad_fork_free_pid;
- 	}
- 
-+	gr_copy_label(p);
-+
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1344,6 +1379,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- 	free_task(p);
- fork_out:
-+	gr_log_forkfail(retval);
-+
- 	return ERR_PTR(retval);
- }
- 
-@@ -1437,6 +1474,8 @@ long do_fork(unsigned long clone_flags,
- 		if (clone_flags & CLONE_PARENT_SETTID)
- 			put_user(nr, parent_tidptr);
- 
-+		gr_handle_brute_check();
-+
- 		if (clone_flags & CLONE_VFORK) {
- 			p->vfork_done = &vfork;
- 			init_completion(&vfork);
-@@ -1569,7 +1608,7 @@ static int unshare_fs(unsigned long unsh
- 		return 0;
- 
- 	/* don't need lock here; in the worst case we'll do useless copy */
--	if (fs->users == 1)
-+	if (atomic_read(&fs->users) == 1)
- 		return 0;
- 
- 	*new_fsp = copy_fs_struct(fs);
-@@ -1689,14 +1728,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
- 		task_lock(current);
- 
- 		if (new_fs) {
-+			unsigned long flags;
-+
-+			gr_fs_write_lock_irqsave(current, flags);
- 			fs = current->fs;
- 			write_lock(&fs->lock);
- 			current->fs = new_fs;
--			if (--fs->users)
-+			if (atomic_dec_return(&fs->users))
- 				new_fs = NULL;
- 			else
- 				new_fs = fs;
- 			write_unlock(&fs->lock);
-+			gr_fs_write_unlock_irqrestore(current, flags);
- 		}
- 
- 		if (new_mm) {
-diff -urNp linux-2.6.32.11/kernel/futex.c linux-2.6.32.11/kernel/futex.c
---- linux-2.6.32.11/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/futex.c	2010-04-04 20:46:41.689696132 -0400
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
- 	struct page *page;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+		return -EFAULT;
-+#endif
-+
- 	/*
- 	 * The futex address must be "naturally" aligned.
- 	 */
-@@ -1852,7 +1858,7 @@ retry:
- 
- 	restart = &current_thread_info()->restart_block;
- 	restart->fn = futex_wait_restart;
--	restart->futex.uaddr = (u32 *)uaddr;
-+	restart->futex.uaddr = uaddr;
- 	restart->futex.val = val;
- 	restart->futex.time = abs_time->tv64;
- 	restart->futex.bitset = bitset;
-@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- {
- 	struct robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *cred = current_cred();
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->robust_list;
- 		rcu_read_unlock();
- 	}
-@@ -2467,7 +2481,7 @@ retry:
-  */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- 				     struct robust_list __user * __user *head,
--				     int *pi)
-+				     unsigned int *pi)
- {
- 	unsigned long uentry;
- 
-diff -urNp linux-2.6.32.11/kernel/futex_compat.c linux-2.6.32.11/kernel/futex_compat.c
---- linux-2.6.32.11/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/futex_compat.c	2010-04-04 20:46:41.693491350 -0400
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
- {
- 	struct compat_robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+	const struct cred *cred = current_cred();
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->compat_robust_list;
- 		read_unlock(&tasklist_lock);
- 	}
-diff -urNp linux-2.6.32.11/kernel/gcov/base.c linux-2.6.32.11/kernel/gcov/base.c
---- linux-2.6.32.11/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/gcov/base.c	2010-04-04 20:46:41.693491350 -0400
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
- 
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
--	return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- 				void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
- 	prev = NULL;
- 	/* Remove entries located in module from linked list. */
- 	for (info = gcov_info_head; info; info = info->next) {
--		if (within(info, mod->module_core, mod->core_size)) {
-+		if (within_module_core_rw((unsigned long)info, mod)) {
- 			if (prev)
- 				prev->next = info->next;
- 			else
-diff -urNp linux-2.6.32.11/kernel/hrtimer.c linux-2.6.32.11/kernel/hrtimer.c
---- linux-2.6.32.11/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
-+++ linux-2.6.32.11/kernel/hrtimer.c	2010-04-04 20:46:41.693491350 -0400
-@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
- 	local_irq_restore(flags);
- }
- 
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- 	hrtimer_peek_ahead_timers();
- }
-diff -urNp linux-2.6.32.11/kernel/kallsyms.c linux-2.6.32.11/kernel/kallsyms.c
---- linux-2.6.32.11/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/kallsyms.c	2010-04-06 22:21:53.692294722 -0400
-@@ -11,6 +11,9 @@
-  *      Changed the compression method from stem compression to "table lookup"
-  *      compression (see scripts/kallsyms.c for a more complete description)
-  */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
- 
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+	if (system_state != SYSTEM_BOOTING)
-+		return 0;
-+
- 	if (addr >= (unsigned long)_sinittext
- 	    && addr <= (unsigned long)_einittext)
- 		return 1;
-@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
- 
- static inline int is_kernel(unsigned long addr)
- {
-+	if (is_kernel_inittext(addr))
-+		return 1;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
-+		return 0;
-+#endif
-+
-+	if (is_kernel_text(addr))
-+		return 1;
-+
-+	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
-+		return 1;
-+
-+	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
-+		return 1;
-+	return in_gate_area_no_task(addr);
-+#endif
-+
- 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
- 		return 1;
- 	return in_gate_area_no_task(addr);
-@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
- 
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
--	iter->name[0] = '\0';
- 	iter->nameoff = get_symbol_offset(new_pos);
- 	iter->pos = new_pos;
- }
-@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
- {
- 	struct kallsym_iter *iter = m->private;
- 
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	if (current_uid())
-+		return 0;
-+#endif
-+
- 	/* Some debugging symbols have no name.  Ignore them. */
- 	if (!iter->name[0])
- 		return 0;
-@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
- 	struct kallsym_iter *iter;
- 	int ret;
- 
--	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- 	if (!iter)
- 		return -ENOMEM;
- 	reset_iter(iter, 0);
-diff -urNp linux-2.6.32.11/kernel/kgdb.c linux-2.6.32.11/kernel/kgdb.c
---- linux-2.6.32.11/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/kgdb.c	2010-04-04 20:46:41.693491350 -0400
-@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int			exception_level;
- 
--static struct kgdb_io		*kgdb_io_ops;
-+static const struct kgdb_io	*kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
- 
- /* kgdb console driver is loaded */
-@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
-  *
-  *	Register it with the KGDB core.
-  */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- 	int err;
- 
-@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
-  *
-  *	Unregister it with the KGDB core.
-  */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- 	BUG_ON(kgdb_connected);
- 
-diff -urNp linux-2.6.32.11/kernel/kmod.c linux-2.6.32.11/kernel/kmod.c
---- linux-2.6.32.11/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/kmod.c	2010-04-04 20:46:41.693491350 -0400
-@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
- 	if (ret >= MODULE_NAME_LEN)
- 		return -ENAMETOOLONG;
- 
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+	/* we could do a tighter check here, but some distros
-+	   are taking it upon themselves to remove CAP_SYS_MODULE
-+	   from even root-running apps which cause modules to be 
-+	   auto-loaded
-+	*/
-+	if (current_uid()) {
-+		gr_log_nonroot_mod_load(module_name);
-+		return -EPERM;
-+	}
-+#endif
-+
- 	/* If modprobe needs a service that is in a module, we get a recursive
- 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
- 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
-diff -urNp linux-2.6.32.11/kernel/kprobes.c linux-2.6.32.11/kernel/kprobes.c
---- linux-2.6.32.11/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/kprobes.c	2010-04-04 20:46:41.693491350 -0400
-@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
- 	 * kernel image and loaded module images reside. This is required
- 	 * so x86_64 can correctly handle the %rip-relative fixups.
- 	 */
--	kip->insns = module_alloc(PAGE_SIZE);
-+	kip->insns = module_alloc_exec(PAGE_SIZE);
- 	if (!kip->insns) {
- 		kfree(kip);
- 		return NULL;
-@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
- 		 */
- 		if (!list_is_singular(&kprobe_insn_pages)) {
- 			list_del(&kip->list);
--			module_free(NULL, kip->insns);
-+			module_free_exec(NULL, kip->insns);
- 			kfree(kip);
- 		}
- 		return 1;
-diff -urNp linux-2.6.32.11/kernel/lockdep.c linux-2.6.32.11/kernel/lockdep.c
---- linux-2.6.32.11/kernel/lockdep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/lockdep.c	2010-04-04 20:46:41.693491350 -0400
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- 	int i;
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	start = ktla_ktva(start);
-+#endif
-+
- 	/*
- 	 * static variable?
- 	 */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- 	 */
- 	for_each_possible_cpu(i) {
- 		start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
--		end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
--					+ per_cpu_offset(i);
-+		end   = start + PERCPU_ENOUGH_ROOM;
- 
- 		if ((addr >= start) && (addr < end))
- 			return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
- 	if (!static_obj(lock->key)) {
- 		debug_locks_off();
- 		printk("INFO: trying to register non-static key.\n");
-+		printk("lock:%pS key:%pS.\n", lock, lock->key);
- 		printk("the code is fine but needs lockdep annotation.\n");
- 		printk("turning off the locking correctness validator.\n");
- 		dump_stack();
-diff -urNp linux-2.6.32.11/kernel/module.c linux-2.6.32.11/kernel/module.c
---- linux-2.6.32.11/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/module.c	2010-04-04 20:46:41.693491350 -0400
-@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
- 
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
- 
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
- 		return true;
- 
- 	list_for_each_entry_rcu(mod, &modules, list) {
--		struct symsearch arr[] = {
-+		struct symsearch modarr[] = {
- 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
- 			  NOT_GPL_ONLY, false },
- 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
- #endif
- 		};
- 
--		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- 			return true;
- 	}
- 	return false;
-@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
- 	void *ptr;
- 	int cpu;
- 
--	if (align > PAGE_SIZE) {
-+	if (align-1 >= PAGE_SIZE) {
- 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- 		       name, align, PAGE_SIZE);
- 		align = PAGE_SIZE;
-@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
- 	destroy_params(mod->kp, mod->num_kp);
- 
- 	/* This may be NULL, but that's OK */
--	module_free(mod, mod->module_init);
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
- 	kfree(mod->args);
- 	if (mod->percpu)
- 		percpu_modfree(mod->percpu);
-@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
- 		percpu_modfree(mod->refptr);
- #endif
- 	/* Free lock-classes: */
--	lockdep_free_key_range(mod->module_core, mod->core_size);
-+	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
- 
- 	/* Finally, free the core (containing the module structure) */
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_core_rx);
-+	module_free(mod, mod->module_core_rw);
- 
- #ifdef CONFIG_MPU
- 	update_protections(current->mm);
-@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
- 					      strtab + sym[i].st_name, mod);
- 			/* Ok if resolved.  */
- 			if (ksym) {
-+				pax_open_kernel();
- 				sym[i].st_value = ksym->value;
-+				pax_close_kernel();
- 				break;
- 			}
- 
-@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
- 				secbase = (unsigned long)mod->percpu;
- 			else
- 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+			pax_open_kernel();
- 			sym[i].st_value += secbase;
-+			pax_close_kernel();
- 			break;
- 		}
- 	}
-@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->core_text_size = mod->core_size;
- 	}
- 
- 	DEBUGP("Init section allocation order:\n");
-@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || !strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
--					 | INIT_OFFSET_MASK);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+			s->sh_entsize |= INIT_OFFSET_MASK;
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->init_text_size = mod->init_size;
- 	}
- }
- 
-@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
- 
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
--		     Elf_Shdr *sechdrs,
--		     const char *secstrings,
--		     struct module *mod)
-+		     const Elf_Shdr *sechdrs,
-+		     const char *secstrings)
- {
- 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
- 
- 	/* Put symbol section at end of init part of module. */
- 	symsect->sh_flags |= SHF_ALLOC;
--	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- 					 symindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
- 
-@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
- 		}
- 
- 	/* Append room for core symbols at end of core part. */
--	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
--	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
- 
- 	/* Put string table section at end of init part of module. */
- 	strsect->sh_flags |= SHF_ALLOC;
--	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- 					 strindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
- 
- 	/* Append room for core symbols' strings at end of core part. */
--	*pstroffs = mod->core_size;
-+	*pstroffs = mod->core_size_rx;
- 	__set_bit(0, strmap);
--	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
- 
- 	return symoffs;
- }
-@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
- 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
- 
-+	pax_open_kernel();
-+
- 	/* Set types up while we still have access to sections. */
- 	for (i = 0; i < mod->num_symtab; i++)
- 		mod->symtab[i].st_info
--			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+			= elf_type(&mod->symtab[i], sechdrs, secstrings);
- 
--	mod->core_symtab = dst = mod->module_core + symoffs;
-+	mod->core_symtab = dst = mod->module_core_rx + symoffs;
- 	src = mod->symtab;
- 	*dst = *src;
- 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
- 	}
- 	mod->core_num_syms = ndst;
- 
--	mod->core_strtab = s = mod->module_core + stroffs;
-+	mod->core_strtab = s = mod->module_core_rx + stroffs;
- 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- 		if (test_bit(i, strmap))
- 			*++s = mod->strtab[i];
-+
-+	pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
- #endif
- }
- 
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- 	void *ret = module_alloc(size);
- 
- 	if (ret) {
- 		/* Update module bounds. */
--		if ((unsigned long)ret < module_addr_min)
--			module_addr_min = (unsigned long)ret;
--		if ((unsigned long)ret + size > module_addr_max)
--			module_addr_max = (unsigned long)ret + size;
-+		if ((unsigned long)ret < module_addr_min_rw)
-+			module_addr_min_rw = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rw)
-+			module_addr_max_rw = (unsigned long)ret + size;
-+	}
-+	return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+	void *ret = module_alloc_exec(size);
-+
-+	if (ret) {
-+		/* Update module bounds. */
-+		if ((unsigned long)ret < module_addr_min_rx)
-+			module_addr_min_rx = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rx)
-+			module_addr_max_rx = (unsigned long)ret + size;
- 	}
- 	return ret;
- }
-@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
- 	unsigned int i;
- 
- 	/* only scan the sections containing data */
--	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
--			   (unsigned long)mod->module_core,
-+	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+			   (unsigned long)mod->module_core_rw,
- 			   sizeof(struct module), GFP_KERNEL);
- 
- 	for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
- 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- 			continue;
- 
--		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
--				   (unsigned long)mod->module_core,
-+		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+				   (unsigned long)mod->module_core_rw,
- 				   sechdrs[i].sh_size, GFP_KERNEL);
- 	}
- }
-@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
- 				secstrings, &stroffs, strmap);
- 
- 	/* Do the allocs. */
--	ptr = module_alloc_update_bounds(mod->core_size);
-+	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. Just mark it as not being a
-@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
- 		err = -ENOMEM;
- 		goto free_percpu;
- 	}
--	memset(ptr, 0, mod->core_size);
--	mod->module_core = ptr;
-+	memset(ptr, 0, mod->core_size_rw);
-+	mod->module_core_rw = ptr;
- 
--	ptr = module_alloc_update_bounds(mod->init_size);
-+	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. This block doesn't need to be
- 	 * scanned as it contains data and code that will be freed
- 	 * after the module is initialized.
- 	 */
--	kmemleak_ignore(ptr);
--	if (!ptr && mod->init_size) {
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rw) {
-+		err = -ENOMEM;
-+		goto free_core_rw;
-+	}
-+	memset(ptr, 0, mod->init_size_rw);
-+	mod->module_init_rw = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr) {
- 		err = -ENOMEM;
--		goto free_core;
-+		goto free_init_rw;
- 	}
--	memset(ptr, 0, mod->init_size);
--	mod->module_init = ptr;
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->core_size_rx);
-+	pax_close_kernel();
-+	mod->module_core_rx = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rx) {
-+		err = -ENOMEM;
-+		goto free_core_rx;
-+	}
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->init_size_rx);
-+	pax_close_kernel();
-+	mod->module_init_rx = ptr;
- 
- 	/* Transfer each section which specifies SHF_ALLOC */
- 	DEBUGP("final section addresses:\n");
-@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
- 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- 			continue;
- 
--		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
--			dest = mod->module_init
--				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
--		else
--			dest = mod->module_core + sechdrs[i].sh_entsize;
-+		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_init_rw
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+			else
-+				dest = mod->module_init_rx
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+		} else {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+			else
-+				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+		}
-+
-+		if (sechdrs[i].sh_type != SHT_NOBITS) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+				pax_open_kernel();
-+				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+				pax_close_kernel();
-+			} else
-+#endif
- 
--		if (sechdrs[i].sh_type != SHT_NOBITS)
--			memcpy(dest, (void *)sechdrs[i].sh_addr,
--			       sechdrs[i].sh_size);
-+			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+		}
- 		/* Update sh_addr to point to copy in image. */
--		sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+		else
-+#endif
-+
-+			sechdrs[i].sh_addr = (unsigned long)dest;
- 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- 	}
- 	/* Module has been moved. */
-@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
- 				      mod->name);
- 	if (!mod->refptr) {
- 		err = -ENOMEM;
--		goto free_init;
-+		goto free_init_rx;
- 	}
- #endif
- 	/* Now we've moved module, initialize linked lists, etc. */
-@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
- 
- 	/* Now do relocations. */
- 	for (i = 1; i < hdr->e_shnum; i++) {
--		const char *strtab = (char *)sechdrs[strindex].sh_addr;
- 		unsigned int info = sechdrs[i].sh_info;
-+		strtab = (char *)sechdrs[strindex].sh_addr;
- 
- 		/* Not a valid relocation section? */
- 		if (info >= hdr->e_shnum)
-@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
- 	 * Do it before processing of module parameters, so the module
- 	 * can provide parameter accessor functions of its own.
- 	 */
--	if (mod->module_init)
--		flush_icache_range((unsigned long)mod->module_init,
--				   (unsigned long)mod->module_init
--				   + mod->init_size);
--	flush_icache_range((unsigned long)mod->module_core,
--			   (unsigned long)mod->module_core + mod->core_size);
-+	if (mod->module_init_rx)
-+		flush_icache_range((unsigned long)mod->module_init_rx,
-+				   (unsigned long)mod->module_init_rx
-+				   + mod->init_size_rx);
-+	flush_icache_range((unsigned long)mod->module_core_rx,
-+			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
- 
- 	set_fs(old_fs);
- 
-@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
-  free_unload:
- 	module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- 	percpu_modfree(mod->refptr);
-- free_init:
- #endif
--	module_free(mod, mod->module_init);
-- free_core:
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+	module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+	module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+	module_free(mod, mod->module_core_rw);
- 	/* mod will be freed with core. Don't access it beyond this line! */
-  free_percpu:
- 	if (percpu)
-@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
- 	mod->symtab = mod->core_symtab;
- 	mod->strtab = mod->core_strtab;
- #endif
--	module_free(mod, mod->module_init);
--	mod->module_init = NULL;
--	mod->init_size = 0;
--	mod->init_text_size = 0;
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
-+	mod->module_init_rw = NULL;
-+	mod->module_init_rx = NULL;
-+	mod->init_size_rw = 0;
-+	mod->init_size_rx = 0;
- 	mutex_unlock(&module_mutex);
- 
- 	return 0;
-@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
- 	unsigned long nextval;
- 
- 	/* At worse, next value is at end of module */
--	if (within_module_init(addr, mod))
--		nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+	if (within_module_init_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+	else if (within_module_init_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+	else if (within_module_core_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+	else if (within_module_core_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- 	else
--		nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+		return NULL;
- 
- 	/* Scan for closest preceeding symbol, and next symbol. (ELF
- 	   starts real symbols at 1). */
-@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
- 	char buf[8];
- 
- 	seq_printf(m, "%s %u",
--		   mod->name, mod->init_size + mod->core_size);
-+		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- 	print_unload_info(m, mod);
- 
- 	/* Informative for users. */
-@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
- 		   mod->state == MODULE_STATE_COMING ? "Loading":
- 		   "Live");
- 	/* Used by oprofile and other similar tools. */
--	seq_printf(m, " 0x%p", mod->module_core);
-+	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
- 
- 	/* Taints info */
- 	if (mod->taints)
-@@ -2979,7 +3066,17 @@ static const struct file_operations proc
- 
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- 	proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_modules_init);
-@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
- {
- 	struct module *mod;
- 
--	if (addr < module_addr_min || addr > module_addr_max)
-+	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
- 		return NULL;
- 
- 	list_for_each_entry_rcu(mod, &modules, list)
--		if (within_module_core(addr, mod)
--		    || within_module_init(addr, mod))
-+		if (within_module_init(addr, mod) || within_module_core(addr, mod))
- 			return mod;
- 	return NULL;
- }
-@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
-  */
- struct module *__module_text_address(unsigned long addr)
- {
--	struct module *mod = __module_address(addr);
-+	struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+	addr = ktla_ktva(addr);
-+#endif
-+
-+	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+		return NULL;
-+
-+	mod = __module_address(addr);
-+
- 	if (mod) {
- 		/* Make sure it's within the text section. */
--		if (!within(addr, mod->module_init, mod->init_text_size)
--		    && !within(addr, mod->module_core, mod->core_text_size))
-+		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- 			mod = NULL;
- 	}
- 	return mod;
-diff -urNp linux-2.6.32.11/kernel/panic.c linux-2.6.32.11/kernel/panic.c
---- linux-2.6.32.11/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/panic.c	2010-04-04 20:46:41.693491350 -0400
-@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
-  */
- void __stack_chk_fail(void)
- {
--	panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+	dump_stack();
-+	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
- 		__builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.32.11/kernel/params.c linux-2.6.32.11/kernel/params.c
---- linux-2.6.32.11/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/params.c	2010-04-04 20:46:41.693491350 -0400
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- 	.show = module_attr_show,
- 	.store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.11/kernel/pid.c linux-2.6.32.11/kernel/pid.c
---- linux-2.6.32.11/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/pid.c	2010-04-04 20:46:41.693491350 -0400
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
- 
- int pid_max = PID_MAX_DEFAULT;
- 
--#define RESERVED_PIDS		300
-+#define RESERVED_PIDS		500
- 
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
-  */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
--	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+	struct task_struct *task;
-+	
-+	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+	if (gr_pid_is_chrooted(task))
-+		return NULL;
-+
-+	return task;
- }
- 
- struct task_struct *find_task_by_vpid(pid_t vnr)
-diff -urNp linux-2.6.32.11/kernel/posix-cpu-timers.c linux-2.6.32.11/kernel/posix-cpu-timers.c
---- linux-2.6.32.11/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/posix-cpu-timers.c	2010-04-04 20:46:41.697788265 -0400
-@@ -6,6 +6,7 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
- 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
- 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-diff -urNp linux-2.6.32.11/kernel/power/hibernate.c linux-2.6.32.11/kernel/power/hibernate.c
---- linux-2.6.32.11/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/power/hibernate.c	2010-04-04 20:46:41.697788265 -0400
-@@ -48,14 +48,14 @@ enum {
- 
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
- 
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
- 
- /**
-  * hibernation_set_ops - set the global hibernate operations
-  * @ops: the hibernation operations to use in subsequent hibernation transitions
-  */
- 
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
- 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff -urNp linux-2.6.32.11/kernel/power/poweroff.c linux-2.6.32.11/kernel/power/poweroff.c
---- linux-2.6.32.11/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/power/poweroff.c	2010-04-04 20:46:41.697788265 -0400
-@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
- 	.enable_mask	= SYSRQ_ENABLE_BOOT,
- };
- 
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- 	register_sysrq_key('o', &sysrq_poweroff_op);
- 	return 0;
-diff -urNp linux-2.6.32.11/kernel/power/process.c linux-2.6.32.11/kernel/power/process.c
---- linux-2.6.32.11/kernel/power/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/power/process.c	2010-04-04 20:46:41.697788265 -0400
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
- 	struct timeval start, end;
- 	u64 elapsed_csecs64;
- 	unsigned int elapsed_csecs;
-+	bool timedout = false;
- 
- 	do_gettimeofday(&start);
- 
- 	end_time = jiffies + TIMEOUT;
- 	do {
- 		todo = 0;
-+		if (time_after(jiffies, end_time))
-+			timedout = true;
- 		read_lock(&tasklist_lock);
- 		do_each_thread(g, p) {
- 			if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
- 			 * It is "frozen enough".  If the task does wake
- 			 * up, it will immediately call try_to_freeze.
- 			 */
--			if (!task_is_stopped_or_traced(p) &&
--			    !freezer_should_skip(p))
-+			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- 				todo++;
-+				if (timedout) {
-+					printk(KERN_ERR "Task refusing to freeze:\n");
-+					sched_show_task(p);
-+				}
-+			}
- 		} while_each_thread(g, p);
- 		read_unlock(&tasklist_lock);
- 		yield();			/* Yield is okay here */
--		if (time_after(jiffies, end_time))
--			break;
--	} while (todo);
-+	} while (todo && !timedout);
- 
- 	do_gettimeofday(&end);
- 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff -urNp linux-2.6.32.11/kernel/power/suspend.c linux-2.6.32.11/kernel/power/suspend.c
---- linux-2.6.32.11/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/power/suspend.c	2010-04-04 20:46:41.697788265 -0400
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
- 	[PM_SUSPEND_MEM]	= "mem",
- };
- 
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
- 
- /**
-  *	suspend_set_ops - Set the global suspend method table.
-  *	@ops:	Pointer to ops structure.
-  */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- 	mutex_lock(&pm_mutex);
- 	suspend_ops = ops;
-diff -urNp linux-2.6.32.11/kernel/printk.c linux-2.6.32.11/kernel/printk.c
---- linux-2.6.32.11/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/printk.c	2010-04-04 20:46:41.697788265 -0400
-@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
- 	char c;
- 	int error = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
-+		return -EPERM;
-+#endif
-+
- 	error = security_syslog(type);
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.11/kernel/ptrace.c linux-2.6.32.11/kernel/ptrace.c
---- linux-2.6.32.11/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/ptrace.c	2010-04-04 20:46:41.697788265 -0400
-@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
- 	     cred->gid != tcred->egid ||
- 	     cred->gid != tcred->sgid ||
- 	     cred->gid != tcred->gid) &&
--	    !capable(CAP_SYS_PTRACE)) {
-+	    !capable_nolog(CAP_SYS_PTRACE)) {
- 		rcu_read_unlock();
- 		return -EPERM;
- 	}
-@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
- 	smp_rmb();
- 	if (task->mm)
- 		dumpable = get_dumpable(task->mm);
--	if (!dumpable && !capable(CAP_SYS_PTRACE))
-+	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
- 		return -EPERM;
- 
- 	return security_ptrace_access_check(task, mode);
-@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
- 		goto unlock_tasklist;
- 
- 	task->ptrace = PT_PTRACED;
--	if (capable(CAP_SYS_PTRACE))
-+	if (capable_nolog(CAP_SYS_PTRACE))
- 		task->ptrace |= PT_PTRACE_CAP;
- 
- 	__ptrace_link(task, current);
-@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
- 		ret = ptrace_setoptions(child, data);
- 		break;
- 	case PTRACE_GETEVENTMSG:
--		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- 		break;
- 
- 	case PTRACE_GETSIGINFO:
- 		ret = ptrace_getsiginfo(child, &siginfo);
- 		if (!ret)
--			ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- 						   &siginfo);
- 		break;
- 
- 	case PTRACE_SETSIGINFO:
--		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- 				   sizeof siginfo))
- 			ret = -EFAULT;
- 		else
-@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
- 		goto out;
- 	}
- 
-+	if (gr_handle_ptrace(child, request)) {
-+		ret = -EPERM;
-+		goto out_put_task_struct;
-+	}
-+
- 	if (request == PTRACE_ATTACH) {
- 		ret = ptrace_attach(child);
- 		/*
- 		 * Some architectures need to do book-keeping after
- 		 * a ptrace attach.
- 		 */
--		if (!ret)
-+		if (!ret) {
- 			arch_ptrace_attach(child);
-+			gr_audit_ptrace(child);
-+		}
- 		goto out_put_task_struct;
- 	}
- 
-@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
- 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- 	if (copied != sizeof(tmp))
- 		return -EIO;
--	return put_user(tmp, (unsigned long __user *)data);
-+	return put_user(tmp, (__force unsigned long __user *)data);
- }
- 
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-diff -urNp linux-2.6.32.11/kernel/rcutree.c linux-2.6.32.11/kernel/rcutree.c
---- linux-2.6.32.11/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/rcutree.c	2010-04-04 20:46:41.697788265 -0400
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
- /*
-  * Do softirq processing for the current CPU.
-  */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- 	/*
- 	 * Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.32.11/kernel/relay.c linux-2.6.32.11/kernel/relay.c
---- linux-2.6.32.11/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/relay.c	2010-04-04 20:46:41.697788265 -0400
-@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
- 		return 0;
- 
- 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
--	if (ret < 0 || ret < total_len)
-+	if ((int)ret < 0 || ret < total_len)
- 		return ret;
- 
-         if (read_start + ret == nonpad_end)
-diff -urNp linux-2.6.32.11/kernel/resource.c linux-2.6.32.11/kernel/resource.c
---- linux-2.6.32.11/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/resource.c	2010-04-04 20:46:41.697788265 -0400
-@@ -132,8 +132,18 @@ static const struct file_operations proc
- 
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
- 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- 	return 0;
- }
- __initcall(ioresources_init);
-diff -urNp linux-2.6.32.11/kernel/sched.c linux-2.6.32.11/kernel/sched.c
---- linux-2.6.32.11/kernel/sched.c	2010-04-04 20:41:50.068477203 -0400
-+++ linux-2.6.32.11/kernel/sched.c	2010-04-04 20:46:41.697788265 -0400
-@@ -4843,7 +4843,7 @@ out:
-  * In CONFIG_NO_HZ case, the idle load balance owner will do the
-  * rebalancing for all the cpus for whom scheduler ticks are stopped.
-  */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- 	int this_cpu = smp_processor_id();
- 	struct rq *this_rq = cpu_rq(this_cpu);
-@@ -6112,6 +6112,8 @@ int can_nice(const struct task_struct *p
- 	/* convert nice value [19,-20] to rlimit style value [1,40] */
- 	int nice_rlim = 20 - nice;
- 
-+	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- 		capable(CAP_SYS_NICE));
- }
-@@ -6145,7 +6147,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- 	if (nice > 19)
- 		nice = 19;
- 
--	if (increment < 0 && !can_nice(current, nice))
-+	if (increment < 0 && (!can_nice(current, nice) ||
-+			      gr_handle_chroot_nice()))
- 		return -EPERM;
- 
- 	retval = security_task_setnice(current, nice);
-@@ -6295,6 +6298,8 @@ recheck:
- 		if (rt_policy(policy)) {
- 			unsigned long rlim_rtprio;
- 
-+			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
-+
- 			if (!lock_task_sighand(p, &flags))
- 				return -ESRCH;
- 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
-@@ -7447,7 +7452,7 @@ static struct ctl_table sd_ctl_dir[] = {
- 		.procname	= "sched_domain",
- 		.mode		= 0555,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table sd_ctl_root[] = {
-@@ -7457,7 +7462,7 @@ static struct ctl_table sd_ctl_root[] = 
- 		.mode		= 0555,
- 		.child		= sd_ctl_dir,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table *sd_alloc_ctl_entry(int n)
-diff -urNp linux-2.6.32.11/kernel/signal.c linux-2.6.32.11/kernel/signal.c
---- linux-2.6.32.11/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/signal.c	2010-04-04 20:46:41.701624986 -0400
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
- 	 */
- 	user = get_uid(__task_cred(t)->user);
- 	atomic_inc(&user->sigpending);
-+
-+	if (!override_rlimit)
-+		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- 	if (override_rlimit ||
- 	    atomic_read(&user->sigpending) <=
- 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
- 		}
- 	}
- 
-+	if (gr_handle_signal(t, sig))
-+		return -EPERM;
-+
- 	return security_task_kill(t, info, sig, 0);
- }
- 
-@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
- 	return send_signal(sig, info, p, 1);
- }
- 
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- 	return send_signal(sig, info, t, 0);
-@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
- 	ret = specific_send_sig_info(sig, info, t);
- 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
- 
-+	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+	gr_handle_crash(t, sig);
-+
- 	return ret;
- }
- 
-@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
- {
- 	int ret = check_kill_permission(sig, info, p);
- 
--	if (!ret && sig)
-+	if (!ret && sig) {
- 		ret = do_send_sig_info(sig, info, p, true);
-+		if (!ret)
-+			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+	}
- 
- 	return ret;
- }
-diff -urNp linux-2.6.32.11/kernel/smp.c linux-2.6.32.11/kernel/smp.c
---- linux-2.6.32.11/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/smp.c	2010-04-04 20:46:41.701624986 -0400
-@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
- }
- EXPORT_SYMBOL(smp_call_function);
- 
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- 	spin_lock(&call_function.lock);
- }
- 
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- 	spin_unlock(&call_function.lock);
- }
- 
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- 	spin_lock_irq(&call_function.lock);
- }
- 
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- 	spin_unlock_irq(&call_function.lock);
- }
-diff -urNp linux-2.6.32.11/kernel/softirq.c linux-2.6.32.11/kernel/softirq.c
---- linux-2.6.32.11/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/softirq.c	2010-04-04 20:46:41.701624986 -0400
-@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
- 
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
- 
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
- };
-@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
- 
- asmlinkage void __do_softirq(void)
- {
--	struct softirq_action *h;
-+	const struct softirq_action *h;
- 	__u32 pending;
- 	int max_restart = MAX_SOFTIRQ_RESTART;
- 	int cpu;
-@@ -216,7 +216,7 @@ restart:
- 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
- 
- 			trace_softirq_entry(h, softirq_vec);
--			h->action(h);
-+			h->action();
- 			trace_softirq_exit(h, softirq_vec);
- 			if (unlikely(prev_count != preempt_count())) {
- 				printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
- 	local_irq_restore(flags);
- }
- 
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
- 	softirq_vec[nr].action = action;
- }
-@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
- 
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
- 
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- 	struct tasklet_struct *list;
- 
-@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
- 	}
- }
- 
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- 	struct tasklet_struct *list;
- 
-diff -urNp linux-2.6.32.11/kernel/sys.c linux-2.6.32.11/kernel/sys.c
---- linux-2.6.32.11/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/sys.c	2010-04-04 20:46:41.701624986 -0400
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
- 		error = -EACCES;
- 		goto out;
- 	}
-+
-+	if (gr_handle_chroot_setpriority(p, niceval)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
- 	no_nice = security_task_setnice(p, niceval);
- 	if (no_nice) {
- 		error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who)
- 					error = set_one_prio(p, niceval, error);
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* For find_user() */
- 			break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who) {
- 					niceval = 20 - task_nice(p);
- 					if (niceval > retval)
- 						retval = niceval;
- 				}
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* for find_user() */
- 			break;
-@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(new->gid, new->egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1 ||
- 	    (egid != (gid_t) -1 && egid != old->gid))
- 		new->sgid = new->egid;
-@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_group_change(gid, gid, gid))
-+		goto error;
-+
- 	if (capable(CAP_SETGID))
- 		new->gid = new->egid = new->sgid = new->fsgid = gid;
- 	else if (gid == old->gid || gid == old->sgid)
-@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(new->uid, new->euid, -1))
-+		goto error;
-+
- 	if (new->uid != old->uid) {
- 		retval = set_user(new);
- 		if (retval < 0)
-@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_crash_uid(uid))
-+		goto error;
-+	if (gr_check_user_change(uid, uid, uid))
-+		goto error;
-+
- 	if (capable(CAP_SETUID)) {
- 		new->suid = new->uid = uid;
- 		if (uid != old->uid) {
-@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(ruid, euid, -1))
-+		goto error;
-+
- 	if (ruid != (uid_t) -1) {
- 		new->uid = ruid;
- 		if (ruid != old->uid) {
-@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(rgid, egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1)
- 		new->gid = rgid;
- 	if (egid != (gid_t) -1)
-@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
- 		goto error;
- 
-+	if (gr_check_user_change(-1, -1, uid))
-+		goto error;
-+
- 	if (uid == old->uid  || uid == old->euid  ||
- 	    uid == old->suid || uid == old->fsuid ||
- 	    capable(CAP_SETUID)) {
-@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- 	if (gid == old->gid  || gid == old->egid  ||
- 	    gid == old->sgid || gid == old->fsgid ||
- 	    capable(CAP_SETGID)) {
-+		if (gr_check_group_change(-1, -1, gid))
-+			goto error;
-+
- 		if (gid != old_fsgid) {
- 			new->fsgid = gid;
- 			goto change_okay;
-@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
- 			error = get_dumpable(me->mm);
- 			break;
- 		case PR_SET_DUMPABLE:
--			if (arg2 < 0 || arg2 > 1) {
-+			if (arg2 > 1) {
- 				error = -EINVAL;
- 				break;
- 			}
-diff -urNp linux-2.6.32.11/kernel/sysctl.c linux-2.6.32.11/kernel/sysctl.c
---- linux-2.6.32.11/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/sysctl.c	2010-04-04 20:46:41.701624986 -0400
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
- 
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+				const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
- 
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
- static int proc_taint(struct ctl_table *table, int write,
- 			       void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
- 
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
- 
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "softmode",
-+		.data		= &pax_softmode,
-+		.maxlen		= sizeof(unsigned int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+
-+	{ .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
- 
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
- #endif
- 
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsecurity",
-+		.mode		= 0500,
-+		.child		= grsecurity_table,
-+	},
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "pax",
-+		.mode		= 0500,
-+		.child		= pax_table,
-+	},
-+#endif
-+
- 	{
- 		.ctl_name	= CTL_UNNUMBERED,
- 		.procname	= "sched_child_runs_first",
-@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
- 	return 0;
- }
- 
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- 		       void __user *oldval, size_t __user *oldlenp,
- 		       void __user *newval, size_t newlen,
-@@ -1821,7 +1864,7 @@ repeat:
- 		if (n == table->ctl_name) {
- 			int error;
- 			if (table->child) {
--				if (sysctl_perm(root, table, MAY_EXEC))
-+				if (sysctl_perm_nochk(root, table, MAY_EXEC))
- 					return -EPERM;
- 				name++;
- 				nlen--;
-@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
- 	int error;
- 	int mode;
- 
-+	if (table->parent != NULL && table->parent->procname != NULL &&
-+	   table->procname != NULL &&
-+	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+		return -EACCES;
-+	if (gr_handle_chroot_sysctl(op))
-+		return -EACCES;
-+	error = gr_handle_sysctl(table, op);
-+	if (error)
-+		return error;
-+
-+	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+	if (error)
-+		return error;
-+
-+	if (root->permissions)
-+		mode = root->permissions(root, current->nsproxy, table);
-+	else
-+		mode = table->mode;
-+
-+	return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+	int error;
-+	int mode;
-+
- 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.11/kernel/taskstats.c linux-2.6.32.11/kernel/taskstats.c
---- linux-2.6.32.11/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/taskstats.c	2010-04-04 20:46:41.701624986 -0400
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
- 
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
-  * Maximum length of a cpumask that can be specified in
-  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
- 	size_t size;
- 	cpumask_var_t mask;
- 
-+	if (gr_is_taskstats_denied(current->pid))
-+		return -EACCES;
-+
- 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.11/kernel/time/tick-broadcast.c linux-2.6.32.11/kernel/time/tick-broadcast.c
---- linux-2.6.32.11/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/time/tick-broadcast.c	2010-04-04 20:46:41.701624986 -0400
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
- 		 * then clear the broadcast bit.
- 		 */
- 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
--			int cpu = smp_processor_id();
-+			cpu = smp_processor_id();
- 
- 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- 			tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.32.11/kernel/time.c linux-2.6.32.11/kernel/time.c
---- linux-2.6.32.11/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/time.c	2010-04-04 20:46:41.701624986 -0400
-@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
- 		return err;
- 
- 	do_settimeofday(&tv);
-+
-+	gr_log_timechange();
-+
- 	return 0;
- }
- 
-@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
- 			return -EFAULT;
- 	}
- 
-+	gr_log_timechange();
-+
- 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
- }
- 
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
-  * Avoid unnecessary multiplications/divisions in the
-  * two most common HZ cases:
-  */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- 	return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
- 
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- 	return (USEC_PER_SEC / HZ) * j;
-diff -urNp linux-2.6.32.11/kernel/timer.c linux-2.6.32.11/kernel/timer.c
---- linux-2.6.32.11/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/timer.c	2010-04-04 20:46:41.701624986 -0400
-@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
- /*
-  * This function runs timers and the timer-tq in bottom half context.
-  */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- 	struct tvec_base *base = __get_cpu_var(tvec_bases);
- 
-diff -urNp linux-2.6.32.11/kernel/trace/ftrace.c linux-2.6.32.11/kernel/trace/ftrace.c
---- linux-2.6.32.11/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
-+++ linux-2.6.32.11/kernel/trace/ftrace.c	2010-04-04 20:46:41.701624986 -0400
-@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
- 
- 	ip = rec->ip;
- 
-+	ret = ftrace_arch_code_modify_prepare();
-+	FTRACE_WARN_ON(ret);
-+	if (ret)
-+		return 0;
-+
- 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- 	if (ret) {
- 		ftrace_bug(ret, ip);
- 		rec->flags |= FTRACE_FL_FAILED;
--		return 0;
- 	}
--	return 1;
-+	return ret ? 0 : 1;
- }
- 
- /*
-diff -urNp linux-2.6.32.11/kernel/trace/Kconfig linux-2.6.32.11/kernel/trace/Kconfig
---- linux-2.6.32.11/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/trace/Kconfig	2010-04-04 20:46:41.701624986 -0400
-@@ -126,6 +126,7 @@ if FTRACE
- config FUNCTION_TRACER
- 	bool "Kernel Function Tracer"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FRAME_POINTER
- 	select KALLSYMS
- 	select GENERIC_TRACER
-@@ -343,6 +344,7 @@ config POWER_TRACER
- config STACK_TRACER
- 	bool "Trace max stack"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FUNCTION_TRACER
- 	select STACKTRACE
- 	select KALLSYMS
-diff -urNp linux-2.6.32.11/kernel/trace/trace.c linux-2.6.32.11/kernel/trace/trace.c
---- linux-2.6.32.11/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.11/kernel/trace/trace.c	2010-04-04 20:46:41.705142860 -0400
-@@ -3808,10 +3808,9 @@ static const struct file_operations trac
- };
- #endif
- 
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+	static struct dentry *d_tracer;
- 	static int once;
- 
- 	if (d_tracer)
-@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
- 	return d_tracer;
- }
- 
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+	static struct dentry *d_percpu;
- 	static int once;
- 	struct dentry *d_tracer;
- 
-diff -urNp linux-2.6.32.11/kernel/trace/trace_events.c linux-2.6.32.11/kernel/trace/trace_events.c
---- linux-2.6.32.11/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/trace/trace_events.c	2010-04-04 20:46:41.705142860 -0400
-@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
-  * Modules must own their file_operations to keep up with
-  * reference counting.
-  */
-+
-+/* cannot be const */
- struct ftrace_module_file_ops {
- 	struct list_head		list;
- 	struct module			*mod;
-diff -urNp linux-2.6.32.11/kernel/trace/trace_output.c linux-2.6.32.11/kernel/trace/trace_output.c
---- linux-2.6.32.11/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/trace/trace_output.c	2010-04-04 20:46:41.705142860 -0400
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
- 		return 0;
- 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- 	if (!IS_ERR(p)) {
--		p = mangle_path(s->buffer + s->len, p, "\n");
-+		p = mangle_path(s->buffer + s->len, p, "\n\\");
- 		if (p) {
- 			s->len = p - s->buffer;
- 			return 1;
-diff -urNp linux-2.6.32.11/kernel/trace/trace_stack.c linux-2.6.32.11/kernel/trace/trace_stack.c
---- linux-2.6.32.11/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/trace/trace_stack.c	2010-04-04 20:46:41.705142860 -0400
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- 		return;
- 
- 	/* we do not handle interrupt stacks yet */
--	if (!object_is_on_stack(&this_size))
-+	if (!object_starts_on_stack(&this_size))
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.11/kernel/utsname_sysctl.c linux-2.6.32.11/kernel/utsname_sysctl.c
---- linux-2.6.32.11/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/kernel/utsname_sysctl.c	2010-04-04 20:46:41.705142860 -0400
-@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
- 		.proc_handler	= proc_do_uts_string,
- 		.strategy	= sysctl_uts_string,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table uts_root_table[] = {
-@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
- 		.mode		= 0555,
- 		.child		= uts_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init utsname_sysctl_init(void)
-diff -urNp linux-2.6.32.11/lib/bug.c linux-2.6.32.11/lib/bug.c
---- linux-2.6.32.11/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/bug.c	2010-04-04 20:46:41.705142860 -0400
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
- 		return BUG_TRAP_TYPE_NONE;
- 
- 	bug = find_bug(bugaddr);
-+	if (!bug)
-+		return BUG_TRAP_TYPE_NONE;
- 
- 	printk(KERN_EMERG "------------[ cut here ]------------\n");
- 
-diff -urNp linux-2.6.32.11/lib/debugobjects.c linux-2.6.32.11/lib/debugobjects.c
---- linux-2.6.32.11/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/debugobjects.c	2010-04-04 20:46:41.705142860 -0400
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
- 	if (limit > 4)
- 		return;
- 
--	is_on_stack = object_is_on_stack(addr);
-+	is_on_stack = object_starts_on_stack(addr);
- 	if (is_on_stack == onstack)
- 		return;
- 
-diff -urNp linux-2.6.32.11/lib/dma-debug.c linux-2.6.32.11/lib/dma-debug.c
---- linux-2.6.32.11/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/dma-debug.c	2010-04-04 20:46:41.705142860 -0400
-@@ -861,7 +861,7 @@ out:
- 
- static void check_for_stack(struct device *dev, void *addr)
- {
--	if (object_is_on_stack(addr))
-+	if (object_starts_on_stack(addr))
- 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- 				"stack [addr=%p]\n", addr);
- }
-diff -urNp linux-2.6.32.11/lib/idr.c linux-2.6.32.11/lib/idr.c
---- linux-2.6.32.11/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/idr.c	2010-04-04 20:46:41.705142860 -0400
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
- 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
- 
- 			/* if already at the top layer, we need to grow */
--			if (id >= 1 << (idp->layers * IDR_BITS)) {
-+			if (id >= (1 << (idp->layers * IDR_BITS))) {
- 				*starting_id = id;
- 				return IDR_NEED_TO_GROW;
- 			}
-diff -urNp linux-2.6.32.11/lib/inflate.c linux-2.6.32.11/lib/inflate.c
---- linux-2.6.32.11/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/inflate.c	2010-04-04 20:46:41.705142860 -0400
-@@ -266,7 +266,7 @@ static void free(void *where)
- 		malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
- 
-diff -urNp linux-2.6.32.11/lib/Kconfig.debug linux-2.6.32.11/lib/Kconfig.debug
---- linux-2.6.32.11/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/Kconfig.debug	2010-04-04 20:46:41.705142860 -0400
-@@ -905,7 +905,7 @@ config LATENCYTOP
- 	select STACKTRACE
- 	select SCHEDSTATS
- 	select SCHED_DEBUG
--	depends on HAVE_LATENCYTOP_SUPPORT
-+	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- 	help
- 	  Enable this option if you want to use the LatencyTOP tool
- 	  to find out which userspace is blocking on what kernel operations.
-diff -urNp linux-2.6.32.11/lib/kobject.c linux-2.6.32.11/lib/kobject.c
---- linux-2.6.32.11/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/kobject.c	2010-04-04 20:46:41.705142860 -0400
-@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
- 	return ret;
- }
- 
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- 	.show	= kobj_attr_show,
- 	.store	= kobj_attr_store,
- };
-@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
-  * If the kset was not able to be created, NULL will be returned.
-  */
- static struct kset *kset_create(const char *name,
--				struct kset_uevent_ops *uevent_ops,
-+				const struct kset_uevent_ops *uevent_ops,
- 				struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
-  * If the kset was not able to be created, NULL will be returned.
-  */
- struct kset *kset_create_and_add(const char *name,
--				 struct kset_uevent_ops *uevent_ops,
-+				 const struct kset_uevent_ops *uevent_ops,
- 				 struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-diff -urNp linux-2.6.32.11/lib/kobject_uevent.c linux-2.6.32.11/lib/kobject_uevent.c
---- linux-2.6.32.11/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/kobject_uevent.c	2010-04-04 20:46:41.705142860 -0400
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
- 	const char *subsystem;
- 	struct kobject *top_kobj;
- 	struct kset *kset;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- 	u64 seq;
- 	int i = 0;
- 	int retval = 0;
-diff -urNp linux-2.6.32.11/lib/parser.c linux-2.6.32.11/lib/parser.c
---- linux-2.6.32.11/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/parser.c	2010-04-04 20:46:41.705142860 -0400
-@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
- 	char *buf;
- 	int ret;
- 
--	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
-+	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
- 	if (!buf)
- 		return -ENOMEM;
- 	memcpy(buf, s->from, s->to - s->from);
-diff -urNp linux-2.6.32.11/lib/radix-tree.c linux-2.6.32.11/lib/radix-tree.c
---- linux-2.6.32.11/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/radix-tree.c	2010-04-04 20:46:41.705142860 -0400
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- 	int nr;
- 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
- 
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff -urNp linux-2.6.32.11/lib/random32.c linux-2.6.32.11/lib/random32.c
---- linux-2.6.32.11/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/lib/random32.c	2010-04-04 20:46:41.705142860 -0400
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
-  */
- static inline u32 __seed(u32 x, u32 m)
- {
--	return (x < m) ? x + m : x;
-+	return (x <= m) ? x + m + 1 : x;
- }
- 
- /**
-diff -urNp linux-2.6.32.11/localversion-grsec linux-2.6.32.11/localversion-grsec
---- linux-2.6.32.11/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.11/localversion-grsec	2010-04-04 20:46:41.705142860 -0400
-@@ -0,0 +1 @@
-+-grsec
-diff -urNp linux-2.6.32.11/Makefile linux-2.6.32.11/Makefile
---- linux-2.6.32.11/Makefile	2010-04-04 20:41:49.914404054 -0400
-+++ linux-2.6.32.11/Makefile	2010-04-04 20:46:41.705142860 -0400
-@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
- 
- HOSTCC       = gcc
- HOSTCXX      = g++
--HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
- 
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -644,7 +644,7 @@ export mod_strip_cmd
- 
- 
- ifeq ($(KBUILD_EXTMOD),)
--core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- 
- vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-diff -urNp linux-2.6.32.11/mm/filemap.c linux-2.6.32.11/mm/filemap.c
---- linux-2.6.32.11/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/filemap.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
- 	struct address_space *mapping = file->f_mapping;
- 
- 	if (!mapping->a_ops->readpage)
--		return -ENOEXEC;
-+		return -ENODEV;
- 	file_accessed(file);
- 	vma->vm_ops = &generic_file_vm_ops;
- 	vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
-                         *pos = i_size_read(inode);
- 
- 		if (limit != RLIM_INFINITY) {
-+			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- 			if (*pos >= limit) {
- 				send_sig(SIGXFSZ, current, 0);
- 				return -EFBIG;
-diff -urNp linux-2.6.32.11/mm/fremap.c linux-2.6.32.11/mm/fremap.c
---- linux-2.6.32.11/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/fremap.c	2010-04-04 20:46:41.708732353 -0400
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
-  retry:
- 	vma = find_vma(mm, start);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+		goto out;
-+#endif
-+
- 	/*
- 	 * Make sure the vma is shared, that it supports prefaulting,
- 	 * and that the remapped range is valid and fully within
-diff -urNp linux-2.6.32.11/mm/highmem.c linux-2.6.32.11/mm/highmem.c
---- linux-2.6.32.11/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/highmem.c	2010-04-04 20:46:41.708732353 -0400
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- 		 * So no dangers, even with speculative execution.
- 		 */
- 		page = pte_page(pkmap_page_table[i]);
-+		pax_open_kernel();
- 		pte_clear(&init_mm, (unsigned long)page_address(page),
- 			  &pkmap_page_table[i]);
--
-+		pax_close_kernel();
- 		set_page_address(page, NULL);
- 		need_flush = 1;
- 	}
-@@ -177,9 +178,11 @@ start:
- 		}
- 	}
- 	vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+	pax_open_kernel();
- 	set_pte_at(&init_mm, vaddr,
- 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+	pax_close_kernel();
- 	pkmap_count[last_pkmap_nr] = 1;
- 	set_page_address(page, (void *)vaddr);
- 
-diff -urNp linux-2.6.32.11/mm/hugetlb.c linux-2.6.32.11/mm/hugetlb.c
---- linux-2.6.32.11/mm/hugetlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/hugetlb.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1924,6 +1924,26 @@ static int unmap_ref_private(struct mm_s
- 	return 1;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	struct vm_area_struct *vma_m;
-+	unsigned long address_m;
-+	pte_t *ptep_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+	get_page(page_m);
-+	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- 			unsigned long address, pte_t *ptep, pte_t pte,
- 			struct page *pagecache_page)
-@@ -1995,6 +2015,11 @@ retry_avoidcopy:
- 		huge_ptep_clear_flush(vma, address, ptep);
- 		set_huge_pte_at(mm, address, ptep,
- 				make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- 		/* Make the old page be freed below */
- 		new_page = old_page;
- 	}
-@@ -2124,6 +2149,10 @@ retry:
- 				&& (vma->vm_flags & VM_SHARED)));
- 	set_huge_pte_at(mm, address, ptep, new_pte);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- 		/* Optimization, do the COW without a second fault */
- 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2152,6 +2181,28 @@ int hugetlb_fault(struct mm_struct *mm, 
- 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- 	struct hstate *h = hstate_vma(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+			h = hstate_vma(vma);
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+			return VM_FAULT_OOM;
-+		address_m &= HPAGE_MASK;
-+		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+	}
-+#endif
-+
- 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- 	if (!ptep)
- 		return VM_FAULT_OOM;
-diff -urNp linux-2.6.32.11/mm/Kconfig linux-2.6.32.11/mm/Kconfig
---- linux-2.6.32.11/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/Kconfig	2010-04-04 20:46:41.708732353 -0400
-@@ -228,7 +228,7 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
-         int "Low address space to protect from user allocation"
- 	depends on MMU
--        default 4096
-+        default 65536
-         help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.11/mm/maccess.c linux-2.6.32.11/mm/maccess.c
---- linux-2.6.32.11/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/maccess.c	2010-04-04 20:46:41.708732353 -0400
-@@ -14,7 +14,7 @@
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.32.11/mm/madvise.c linux-2.6.32.11/mm/madvise.c
---- linux-2.6.32.11/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/madvise.c	2010-04-04 20:46:41.708732353 -0400
-@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
- 	pgoff_t pgoff;
- 	unsigned long new_flags = vma->vm_flags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	switch (behavior) {
- 	case MADV_NORMAL:
- 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -103,6 +107,13 @@ success:
- 	/*
- 	 * vm_flags is protected by the mmap_sem held in write mode.
- 	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m)
-+		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- 	vma->vm_flags = new_flags;
- 
- out:
-@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
- 			     struct vm_area_struct ** prev,
- 			     unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	*prev = vma;
- 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- 		return -EINVAL;
-@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
- 		zap_page_range(vma, start, end - start, &details);
- 	} else
- 		zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+			struct zap_details details = {
-+				.nonlinear_vma = vma_m,
-+				.last_index = ULONG_MAX,
-+			};
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+		} else
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
- 	if (end < start)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			goto out;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		goto out;
-+
- 	error = 0;
- 	if (end == start)
- 		goto out;
-diff -urNp linux-2.6.32.11/mm/memory.c linux-2.6.32.11/mm/memory.c
---- linux-2.6.32.11/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/memory.c	2010-04-04 20:46:41.708732353 -0400
-@@ -48,6 +48,7 @@
- #include <linux/ksm.h>
- #include <linux/rmap.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/delayacct.h>
- #include <linux/init.h>
- #include <linux/writeback.h>
-@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
- 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- 	i = 0;
- 
--	do {
-+	while (nr_pages) {
- 		struct vm_area_struct *vma;
- 
--		vma = find_extend_vma(mm, start);
-+		vma = find_vma(mm, start);
- 		if (!vma && in_gate_area(tsk, start)) {
- 			unsigned long pg = start & PAGE_MASK;
- 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
- 			continue;
- 		}
- 
--		if (!vma ||
-+		if (!vma || start < vma->vm_start ||
- 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- 		    !(vm_flags & vma->vm_flags))
- 			return i ? : -EFAULT;
-@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
- 			start += PAGE_SIZE;
- 			nr_pages--;
- 		} while (nr_pages && start < vma->vm_end);
--	} while (nr_pages);
-+	}
- 	return i;
- }
- 
-@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
- 		copy_user_highpage(dst, src, va, vma);
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	spinlock_t *ptl;
-+	pte_t *pte, entry;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	entry = *pte;
-+	if (!pte_present(entry)) {
-+		if (!pte_none(entry)) {
-+			BUG_ON(pte_file(entry));
-+			free_swap_and_cache(pte_to_swp_entry(entry));
-+			pte_clear_not_present_full(mm, address, pte, 0);
-+		}
-+	} else {
-+		struct page *page;
-+
-+		flush_cache_page(vma, address, pte_pfn(entry));
-+		entry = ptep_clear_flush(vma, address, pte);
-+		BUG_ON(pte_dirty(entry));
-+		page = vm_normal_page(vma, address, entry);
-+		if (page) {
-+			update_hiwater_rss(mm);
-+			if (PageAnon(page))
-+				dec_mm_counter(mm, anon_rss);
-+			else
-+				dec_mm_counter(mm, file_rss);
-+			page_remove_rmap(page);
-+			page_cache_release(page);
-+		}
-+	}
-+	pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || !PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(!PageLocked(page_m));
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_anon_rmap(page_m, vma_m, address_m);
-+	inc_mm_counter(mm, anon_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+	unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_file_rmap(page_m);
-+	inc_mm_counter(mm, file_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+	struct page *page_m;
-+	pte_t entry;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+		goto out;
-+
-+	entry = *pte;
-+	page_m  = vm_normal_page(vma, address, entry);
-+	if (!page_m)
-+		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+	else if (PageAnon(page_m)) {
-+		if (pax_find_mirror_vma(vma)) {
-+			pte_unmap_unlock(pte, ptl);
-+			lock_page(page_m);
-+			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+			if (pte_same(entry, *pte))
-+				pax_mirror_anon_pte(vma, address, page_m, ptl);
-+			else
-+				unlock_page(page_m);
-+		}
-+	} else
-+		pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+	pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
-  * This routine handles present pages, when users try to write
-  * to a shared page. It is done by copying the page to a new address
-@@ -2146,6 +2327,12 @@ gotten:
- 	 */
- 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(new_page));
-+#endif
-+
- 		if (old_page) {
- 			if (!PageAnon(old_page)) {
- 				dec_mm_counter(mm, file_rss);
-@@ -2197,6 +2384,10 @@ gotten:
- 			page_remove_rmap(old_page);
- 		}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- 		/* Free the old page.. */
- 		new_page = old_page;
- 		ret |= VM_FAULT_WRITE;
-@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
- 	swap_free(entry);
- 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- 		try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- 	unlock_page(page);
- 
- 	if (flags & FAULT_FLAG_WRITE) {
-@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
- 		unsigned long address, pte_t *page_table, pmd_t *pmd,
- 		unsigned int flags)
- {
--	struct page *page;
-+	struct page *page = NULL;
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
-@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
- 	if (!pte_none(*page_table))
- 		goto release;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		BUG_ON(!trylock_page(page));
-+#endif
-+
- 	inc_mm_counter(mm, anon_rss);
- 	page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2670,6 +2876,12 @@ setpte:
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (page)
-+		pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- 	return 0;
-@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
- 	 */
- 	/* Only go through if we didn't race with anybody else... */
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon && pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(page));
-+#endif
-+
- 		flush_icache_page(vma, page);
- 		entry = mk_pte(page, vma->vm_page_prot);
- 		if (flags & FAULT_FLAG_WRITE)
-@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
- 
- 		/* no need to invalidate: a not-present page won't be cached */
- 		update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon)
-+			pax_mirror_anon_pte(vma, address, page, ptl);
-+		else
-+			pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- 	} else {
- 		if (charged)
- 			mem_cgroup_uncharge_page(page);
-@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
- 		if (flags & FAULT_FLAG_WRITE)
- 			flush_tlb_page(vma, address);
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_pte(vma, address, pte, pmd, ptl);
-+	return 0;
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(pte, ptl);
- 	return 0;
-@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
- 	pmd_t *pmd;
- 	pte_t *pte;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	__set_current_state(TASK_RUNNING);
- 
- 	count_vm_event(PGFAULT);
-@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
- 	if (unlikely(is_vm_hugetlb_page(vma)))
- 		return hugetlb_fault(mm, vma, address, flags);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+		pgd_t *pgd_m;
-+		pud_t *pud_m;
-+		pmd_t *pmd_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		pgd_m = pgd_offset(mm, address_m);
-+		pud_m = pud_alloc(mm, pgd_m, address_m);
-+		if (!pud_m)
-+			return VM_FAULT_OOM;
-+		pmd_m = pmd_alloc(mm, pud_m, address_m);
-+		if (!pmd_m)
-+			return VM_FAULT_OOM;
-+		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+			return VM_FAULT_OOM;
-+		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+	}
-+#endif
-+
- 	pgd = pgd_offset(mm, address);
- 	pud = pud_alloc(mm, pgd, address);
- 	if (!pud)
-@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.32.11/mm/memory-failure.c linux-2.6.32.11/mm/memory-failure.c
---- linux-2.6.32.11/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/memory-failure.c	2010-04-04 20:46:41.708732353 -0400
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
- 
- int sysctl_memory_failure_recovery __read_mostly = 1;
- 
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
- 
- /*
-  * Send all the processes who have the page mapped an ``action optional''
-@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
- 		return 0;
- 	}
- 
--	atomic_long_add(1, &mce_bad_pages);
-+	atomic_long_add_unchecked(1, &mce_bad_pages);
- 
- 	/*
- 	 * We need/can do nothing about count=0 pages.
-diff -urNp linux-2.6.32.11/mm/mempolicy.c linux-2.6.32.11/mm/mempolicy.c
---- linux-2.6.32.11/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.11/mm/mempolicy.c	2010-04-04 20:46:41.708732353 -0400
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
- 	struct vm_area_struct *next;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	err = 0;
- 	for (; vma && vma->vm_start < end; vma = next) {
- 		next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
- 			err = policy_vma(vma, new);
- 		if (err)
- 			break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		vma_m = pax_find_mirror_vma(vma);
-+		if (vma_m) {
-+			err = policy_vma(vma_m, new);
-+			if (err)
-+				break;
-+		}
-+#endif
-+
- 	}
- 	return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
- 
- 	if (end < start)
- 		return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (end == start)
- 		return 0;
- 
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
- 
- 	if (file) {
- 		seq_printf(m, " file=");
--		seq_path(m, &file->f_path, "\n\t= ");
-+		seq_path(m, &file->f_path, "\n\t\\= ");
- 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 		seq_printf(m, " heap");
- 	} else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.32.11/mm/migrate.c linux-2.6.32.11/mm/migrate.c
---- linux-2.6.32.11/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/migrate.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-diff -urNp linux-2.6.32.11/mm/mlock.c linux-2.6.32.11/mm/mlock.c
---- linux-2.6.32.11/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/mlock.c	2010-04-04 20:46:41.708732353 -0400
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
- 		return -EINVAL;
- 	if (end == start)
- 		return 0;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	vma = find_vma_prev(current->mm, start, &prev);
- 	if (!vma || vma->vm_start > start)
- 		return -ENOMEM;
-@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	/* check against resource limits */
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- 		error = do_mlock(start, len, 1);
- 	up_write(&current->mm->mmap_sem);
-@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
- static int do_mlockall(int flags)
- {
- 	struct vm_area_struct * vma, * prev = NULL;
--	unsigned int def_flags = 0;
-+	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
- 
- 	if (flags & MCL_FUTURE)
--		def_flags = VM_LOCKED;
-+		def_flags |= VM_LOCKED;
- 	current->mm->def_flags = def_flags;
- 	if (flags == MCL_FUTURE)
- 		goto out;
-@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
- 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
- 		unsigned int newflags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+			break;
-+#endif
-+
-+		BUG_ON(vma->vm_end > TASK_SIZE);
- 		newflags = vma->vm_flags | VM_LOCKED;
- 		if (!(flags & MCL_CURRENT))
- 			newflags &= ~VM_LOCKED;
-@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	ret = -ENOMEM;
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
- 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- 	    capable(CAP_IPC_LOCK))
- 		ret = do_mlockall(flags);
-diff -urNp linux-2.6.32.11/mm/mmap.c linux-2.6.32.11/mm/mmap.c
---- linux-2.6.32.11/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/mmap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -45,6 +45,16 @@
- #define arch_rebalance_pgtables(addr, len)		(addr)
- #endif
- 
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+		up_read(&mm->mmap_sem);
-+		BUG();
-+	}
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- 		struct vm_area_struct *vma, struct vm_area_struct *prev,
- 		unsigned long start, unsigned long end);
-@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
-  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
-  *
-  */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
- 
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
--	return __pgprot(pgprot_val(protection_map[vm_flags &
-+	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if (!nx_enabled &&
-+	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+	    (vm_flags & (VM_READ | VM_WRITE)))
-+		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+	return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
- 
-@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
- 	struct vm_area_struct *next = vma->vm_next;
- 
- 	might_sleep();
-+	BUG_ON(vma->vm_mirror);
- 	if (vma->vm_ops && vma->vm_ops->close)
- 		vma->vm_ops->close(vma);
- 	if (vma->vm_file) {
-@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- 	 * not page aligned -Ram Gupta
- 	 */
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- 			(mm->end_data - mm->start_data) > rlim)
- 		goto out;
-@@ -694,6 +715,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		if (vma->vm_pgoff == vm_pgoff)
-@@ -713,6 +740,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		pgoff_t vm_pglen;
-@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- 			struct vm_area_struct *prev, unsigned long addr,
- 			unsigned long end, unsigned long vm_flags,
--		     	struct anon_vma *anon_vma, struct file *file,
-+			struct anon_vma *anon_vma, struct file *file,
- 			pgoff_t pgoff, struct mempolicy *policy)
- {
- 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- 	struct vm_area_struct *area, *next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- 	/*
- 	 * We later require that vma->vm_flags == vm_flags,
- 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
- 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
- 		next = next->vm_next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (prev)
-+		prev_m = pax_find_mirror_vma(prev);
-+	if (area)
-+		area_m = pax_find_mirror_vma(area);
-+	if (next)
-+		next_m = pax_find_mirror_vma(next);
-+#endif
-+
- 	/*
- 	 * Can it merge with the predecessor?
- 	 */
-@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
- 							/* cases 1, 6 */
- 			vma_adjust(prev, prev->vm_start,
- 				next->vm_end, prev->vm_pgoff, NULL);
--		} else					/* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 2, 5, 7 */
- 			vma_adjust(prev, prev->vm_start,
- 				end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		}
- 		return prev;
- 	}
- 
-@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
-  			mpol_equal(policy, vma_policy(next)) &&
- 			can_vma_merge_before(next, vm_flags,
- 					anon_vma, file, pgoff+pglen)) {
--		if (prev && addr < prev->vm_end)	/* case 4 */
-+		if (prev && addr < prev->vm_end) {	/* case 4 */
- 			vma_adjust(prev, prev->vm_start,
- 				addr, prev->vm_pgoff, NULL);
--		else					/* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 3, 8 */
- 			vma_adjust(area, addr, next->vm_end,
- 				next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (area_m)
-+				vma_adjust(area_m, addr_m, next_m->vm_end,
-+					next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+		}
- 		return area;
- 	}
- 
-@@ -888,14 +967,11 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- 						struct file *file, long pages)
- {
--	const unsigned long stack_flags
--		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
--
- 	if (file) {
- 		mm->shared_vm += pages;
- 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- 			mm->exec_vm += pages;
--	} else if (flags & stack_flags)
-+	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- 		mm->stack_vm += pages;
- 	if (flags & (VM_RESERVED|VM_IO))
- 		mm->reserved_vm += pages;
-@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	 * (the exception is when the underlying filesystem is noexec
- 	 *  mounted, in which case we dont add PROT_EXEC.)
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- 			prot |= PROT_EXEC;
- 
-@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	/* Obtain the address to map to. we verify (or select) it and ensure
- 	 * that it represents a valid section of the address space.
- 	 */
--	addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- 	if (addr & ~PAGE_MASK)
- 		return addr;
- 
-@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
- 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT) {
-+			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
-+				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+			else
-+				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+		}
-+#endif
-+
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+		vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- 	if (flags & MAP_LOCKED)
- 		if (!can_do_mlock())
- 			return -EPERM;
-@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- 			return -EAGAIN;
- 	}
-@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
- 	if (error)
- 		return error;
- 
-+	if (!gr_acl_handle_mmap(file, prot))
-+		return -EACCES;
-+
- 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
-  */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
--	unsigned int vm_flags = vma->vm_flags;
-+	unsigned long vm_flags = vma->vm_flags;
- 
- 	/* If it was private or non-writable, the write bit is already clear */
--	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- 		return 0;
- 
- 	/* The backer wishes to know when pages are first written to? */
-@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
- 	unsigned long charged = 0;
- 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	/* Clear old maps */
- 	error = -ENOMEM;
--munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limit. */
-@@ -1163,6 +1273,16 @@ munmap_back:
- 		goto unacct_error;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			error = -ENOMEM;
-+			goto free_vma;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -1185,6 +1305,19 @@ munmap_back:
- 		error = file->f_op->mmap(file, vma);
- 		if (error)
- 			goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma_m && (vm_flags & VM_EXECUTABLE))
-+			added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+			vma->vm_flags |= VM_PAGEEXEC;
-+			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+		}
-+#endif
-+
- 		if (vm_flags & VM_EXECUTABLE)
- 			added_exe_file_vma(mm);
- 
-@@ -1208,6 +1341,11 @@ munmap_back:
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- 	file = vma->vm_file;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	/* Once vma denies write, undo our temporary denial count */
- 	if (correct_wcount)
- 		atomic_inc(&inode->i_writecount);
-@@ -1216,6 +1354,7 @@ out:
- 
- 	mm->total_vm += len >> PAGE_SHIFT;
- 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+	track_exec_limit(mm, addr, addr + len, vm_flags);
- 	if (vm_flags & VM_LOCKED) {
- 		/*
- 		 * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
- 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- 	charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- 	kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- 	if (charged)
-@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -1293,9 +1442,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				addr = TASK_UNMAPPED_BASE;
--			        start_addr = addr;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -1317,10 +1465,16 @@ full_search:
- 
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the lowest possible address?
- 	 */
--	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- 		mm->free_area_cache = addr;
- 		mm->cached_hole_size = ~0UL;
- 	}
-@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -1404,13 +1562,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--  	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-@@ -1419,6 +1585,12 @@ bottomup:
- 
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the highest possible address?
- 	 */
-@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
- 		mm->free_area_cache = addr;
- 
- 	/* dont allow allocations above current base */
--	if (mm->free_area_cache > mm->mmap_base)
-+	if (mm->free_area_cache > mm->mmap_base) {
- 		mm->free_area_cache = mm->mmap_base;
-+		mm->cached_hole_size = ~0UL;
-+	}
- }
- 
- unsigned long
-@@ -1535,6 +1709,27 @@ out:
- 	return prev ? prev->vm_next : vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *vma_m;
-+
-+	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+		BUG_ON(vma->vm_mirror);
-+		return NULL;
-+	}
-+	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+	vma_m = vma->vm_mirror;
-+	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+	BUG_ON(vma->vm_file != vma_m->vm_file);
-+	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
-+	return vma_m;
-+}
-+#endif
-+
- /*
-  * Verify that the stack growth is acceptable and
-  * update accounting. This is shared with both the
-@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
- 		return -ENOMEM;
- 
- 	/* Stack limit test */
-+	gr_learn_resource(current, RLIMIT_STACK, size, 1);
- 	if (size > rlim[RLIMIT_STACK].rlim_cur)
- 		return -ENOMEM;
- 
-@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
- 		unsigned long limit;
- 		locked = mm->locked_vm + grow;
- 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > limit && !capable(CAP_IPC_LOCK))
- 			return -ENOMEM;
- 	}
-@@ -1595,35 +1792,40 @@ static
- #endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
--	int error;
-+	int error, locknext;
- 
- 	if (!(vma->vm_flags & VM_GROWSUP))
- 		return -EFAULT;
- 
-+	/* Also guard against wrapping around to address 0. */
-+	if (address < PAGE_ALIGN(address+1))
-+		address = PAGE_ALIGN(address+1);
-+	else
-+		return -ENOMEM;
-+
- 	/*
- 	 * We must make sure the anon_vma is allocated
- 	 * so that the anon_vma locking is not a noop.
- 	 */
- 	if (unlikely(anon_vma_prepare(vma)))
- 		return -ENOMEM;
-+	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
-+		return -ENOMEM;
- 	anon_vma_lock(vma);
-+	if (locknext)
-+		anon_vma_lock(vma->vm_next);
- 
- 	/*
- 	 * vma->vm_start/vm_end cannot change under us because the caller
- 	 * is required to hold the mmap_sem in read mode.  We need the
--	 * anon_vma lock to serialize against concurrent expand_stacks.
--	 * Also guard against wrapping around to address 0.
-+	 * anon_vma locks to serialize against concurrent expand_stacks
-+	 * and expand_upwards.
- 	 */
--	if (address < PAGE_ALIGN(address+4))
--		address = PAGE_ALIGN(address+4);
--	else {
--		anon_vma_unlock(vma);
--		return -ENOMEM;
--	}
- 	error = 0;
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address > vma->vm_end) {
-+	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- 		unsigned long size, grow;
- 
- 		size = address - vma->vm_start;
-@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
- 		if (!error)
- 			vma->vm_end = address;
- 	}
-+	if (locknext)
-+		anon_vma_unlock(vma->vm_next);
- 	anon_vma_unlock(vma);
- 	return error;
- }
-@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
- static int expand_downwards(struct vm_area_struct *vma,
- 				   unsigned long address)
- {
--	int error;
-+	int error, lockprev = 0;
-+	struct vm_area_struct *prev = NULL;
- 
- 	/*
- 	 * We must make sure the anon_vma is allocated
-@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
- 	if (error)
- 		return error;
- 
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+	find_vma_prev(vma->vm_mm, address, &prev);
-+	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+	if (lockprev && unlikely(anon_vma_prepare(prev)))
-+		return -ENOMEM;
-+	if (lockprev)
-+		anon_vma_lock(prev);
-+
- 	anon_vma_lock(vma);
- 
- 	/*
-@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
- 	 */
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address < vma->vm_start) {
-+	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- 		unsigned long size, grow;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+
-+		vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- 		size = vma->vm_end - address;
- 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
- 
-@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
- 		if (!error) {
- 			vma->vm_start = address;
- 			vma->vm_pgoff -= grow;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (vma_m) {
-+				vma_m->vm_start -= grow << PAGE_SHIFT;
-+				vma_m->vm_pgoff -= grow;
-+			}
-+#endif
-+
- 		}
- 	}
- 	anon_vma_unlock(vma);
-+	if (lockprev)
-+		anon_vma_unlock(prev);
- 	return error;
- }
- 
-@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
- 	do {
- 		long nrpages = vma_pages(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+			vma = remove_vma(vma);
-+			continue;
-+		}
-+#endif
-+
- 		mm->total_vm -= nrpages;
- 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- 		vma = remove_vma(vma);
-@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
- 
- 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- 	do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma->vm_mirror) {
-+			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+			vma->vm_mirror->vm_mirror = NULL;
-+			vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+			vma->vm_mirror = NULL;
-+		}
-+#endif
-+
- 		rb_erase(&vma->vm_rb, &mm->mm_rb);
- 		mm->map_count--;
- 		tail_vma = vma;
-@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
- 	struct mempolicy *pol;
- 	struct vm_area_struct *new;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m, *new_m = NULL;
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (is_vm_hugetlb_page(vma) && (addr &
- 					~(huge_page_mask(hstate_vma(vma)))))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+		if (mm->map_count >= sysctl_max_map_count-1)
-+			return -ENOMEM;
-+	} else
-+#endif
-+
- 	if (mm->map_count >= sysctl_max_map_count)
- 		return -ENOMEM;
- 
-@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
- 	if (!new)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+		if (!new_m) {
-+			kmem_cache_free(vm_area_cachep, new);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	/* most fields are the same, copy all, and then fixup */
- 	*new = *vma;
- 
-@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
- 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		*new_m = *vma_m;
-+		new_m->vm_mirror = new;
-+		new->vm_mirror = new_m;
-+
-+		if (new_below)
-+			new_m->vm_end = addr_m;
-+		else {
-+			new_m->vm_start = addr_m;
-+			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+		}
-+	}
-+#endif
-+
- 	pol = mpol_dup(vma_policy(vma));
- 	if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (new_m)
-+			kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- 		kmem_cache_free(vm_area_cachep, new);
- 		return PTR_ERR(pol);
- 	}
-@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
- 	else
- 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		mpol_get(pol);
-+		vma_set_policy(new_m, pol);
-+
-+		if (new_m->vm_file) {
-+			get_file(new_m->vm_file);
-+			if (vma_m->vm_flags & VM_EXECUTABLE)
-+				added_exe_file_vma(mm);
-+		}
-+
-+		if (new_m->vm_ops && new_m->vm_ops->open)
-+			new_m->vm_ops->open(new_m);
-+
-+		if (new_below)
-+			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+		else
-+			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
-  * work.  This now handles partial unmappings.
-  * Jeremy Fitzhardinge <jeremy@goop.org>
-  */
-+#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
-+	int ret = __do_munmap(mm, start, len);
-+	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+		return ret;
-+
-+	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
-+{
- 	unsigned long end;
- 	struct vm_area_struct *vma, *prev, *last;
- 
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- 		return -EINVAL;
- 
-@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
- 	/* Fix up all other VM information */
- 	remove_vma_list(mm, vma);
- 
-+	track_exec_limit(mm, start, end, 0UL);
-+
- 	return 0;
- }
- 
-@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
- 
- 	profile_munmap(addr);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+		return -EINVAL;
-+#endif
-+
- 	down_write(&mm->mmap_sem);
- 	ret = do_munmap(mm, addr, len);
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
- 
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
--	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
--		WARN_ON(1);
--		up_read(&mm->mmap_sem);
--	}
--#endif
--}
--
- /*
-  *  this is really a simplified "do_mmap".  it only handles
-  *  anonymous maps.  eventually we may be able to do some
-@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
- 	struct rb_node ** rb_link, * rb_parent;
- 	pgoff_t pgoff = addr >> PAGE_SHIFT;
- 	int error;
-+	unsigned long charged;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
- 
- 	len = PAGE_ALIGN(len);
- 	if (!len)
-@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
- 
- 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- 	if (error & ~PAGE_MASK)
- 		return error;
- 
-+	charged = len >> PAGE_SHIFT;
-+
- 	/*
- 	 * mlock MCL_FUTURE?
- 	 */
- 	if (mm->def_flags & VM_LOCKED) {
- 		unsigned long locked, lock_limit;
--		locked = len >> PAGE_SHIFT;
-+		locked = charged;
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
- 	/*
- 	 * Clear old maps.  this also does some error checking for us
- 	 */
-- munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limits *after* clearing old maps... */
--	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+	if (!may_expand_vm(mm, charged))
- 		return -ENOMEM;
- 
- 	if (mm->map_count > sysctl_max_map_count)
- 		return -ENOMEM;
- 
--	if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+	if (security_vm_enough_memory(charged))
- 		return -ENOMEM;
- 
- 	/* Can we just expand an old private anonymous mapping? */
-@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
- 	 */
- 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- 	if (!vma) {
--		vm_unacct_memory(len >> PAGE_SHIFT);
-+		vm_unacct_memory(charged);
- 		return -ENOMEM;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			kmem_cache_free(vm_area_cachep, vma);
-+			vm_unacct_memory(charged);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
- 	vma->vm_page_prot = vm_get_page_prot(flags);
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
--	mm->total_vm += len >> PAGE_SHIFT;
-+	mm->total_vm += charged;
- 	if (flags & VM_LOCKED) {
- 		if (!mlock_vma_pages_range(vma, addr, addr + len))
--			mm->locked_vm += (len >> PAGE_SHIFT);
-+			mm->locked_vm += charged;
- 	}
-+	track_exec_limit(mm, addr, addr + len, flags);
- 	return addr;
- }
- 
-@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
- 	 * Walk the list again, actually closing and freeing it,
- 	 * with preemption enabled, without holding any MM locks.
- 	 */
--	while (vma)
-+	while (vma) {
-+		vma->vm_mirror = NULL;
- 		vma = remove_vma(vma);
-+	}
- 
- 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
- 	struct vm_area_struct * __vma, * prev;
- 	struct rb_node ** rb_link, * rb_parent;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- 	/*
- 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
- 	 * until its first write fault, when page's anon_vma and index
-@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
- 	if ((vma->vm_flags & VM_ACCOUNT) &&
- 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m)
-+			return -ENOMEM;
-+	}
-+#endif
-+
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	return 0;
- }
- 
-@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
- 	struct rb_node **rb_link, *rb_parent;
- 	struct mempolicy *pol;
- 
-+	BUG_ON(vma->vm_mirror);
-+
- 	/*
- 	 * If anonymous vma has not yet been faulted, update new pgoff
- 	 * to match new location, to increase its chance of merging.
-@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
- 	return new_vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *prev_m;
-+	struct rb_node **rb_link_m, *rb_parent_m;
-+	struct mempolicy *pol_m;
-+
-+	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+	*vma_m = *vma;
-+	pol_m = vma_policy(vma_m);
-+	mpol_get(pol_m);
-+	vma_set_policy(vma_m, pol_m);
-+	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+	if (vma_m->vm_file)
-+		get_file(vma_m->vm_file);
-+	if (vma_m->vm_ops && vma_m->vm_ops->open)
-+		vma_m->vm_ops->open(vma_m);
-+	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+	vma_m->vm_mirror = vma;
-+	vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
-  * Return true if the calling process may expand its vm space by the passed
-  * number of pages
-@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
- 	unsigned long lim;
- 
- 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
--
-+	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- 	if (cur + npages > lim)
- 		return 0;
- 	return 1;
-@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->pax_flags & MF_PAX_MPROTECT) {
-+		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+		else
-+			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+	}
-+#endif
-+
- 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 
-diff -urNp linux-2.6.32.11/mm/mprotect.c linux-2.6.32.11/mm/mprotect.c
---- linux-2.6.32.11/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/mprotect.c	2010-04-04 20:46:41.713805609 -0400
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
- 
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_
- 	flush_tlb_range(vma, start, end);
- }
- 
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+	unsigned long oldlimit, newlimit = 0UL;
-+
-+	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+		return;
-+
-+	spin_lock(&mm->page_table_lock);
-+	oldlimit = mm->context.user_cs_limit;
-+	if ((prot & VM_EXEC) && oldlimit < end)
-+		/* USER_CS limit moved up */
-+		newlimit = end;
-+	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+		/* USER_CS limit moved down */
-+		newlimit = start;
-+
-+	if (newlimit) {
-+		mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+		wmb();
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+	}
-+	spin_unlock(&mm->page_table_lock);
-+	if (newlimit == end) {
-+		struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+		for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+			if (is_vm_hugetlb_page(vma))
-+				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+			else
-+				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+	}
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- 	unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
- 	int error;
- 	int dirty_accountable = 0;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+	unsigned long start_m, end_m;
-+
-+	start_m = start + SEGMEXEC_TASK_SIZE;
-+	end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (newflags == oldflags) {
- 		*pprev = vma;
- 		return 0;
-@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+		if (start != vma->vm_start) {
-+			error = split_vma(mm, vma, start, 1);
-+			if (error)
-+				goto fail;
-+			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+			*pprev = (*pprev)->vm_next;
-+		}
-+
-+		if (end != vma->vm_end) {
-+			error = split_vma(mm, vma, end, 0);
-+			if (error)
-+				goto fail;
-+		}
-+
-+		if (pax_find_mirror_vma(vma)) {
-+			error = __do_munmap(mm, start_m, end_m - start_m);
-+			if (error)
-+				goto fail;
-+		} else {
-+			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+			if (!vma_m) {
-+				error = -ENOMEM;
-+				goto fail;
-+			}
-+			vma->vm_flags = newflags;
-+			pax_mirror_vma(vma_m, vma);
-+		}
-+	}
-+#endif
-+
- 	/*
- 	 * First try to merge with previous and/or next vma.
- 	 */
-@@ -196,8 +284,14 @@ success:
- 	 * held in write mode.
- 	 */
- 	vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->binfmt && mm->binfmt->handle_mprotect)
-+		mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
--					  vm_get_page_prot(newflags));
-+					  vm_get_page_prot(vma->vm_flags));
- 
- 	if (vma_wants_writenotify(vma)) {
- 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	end = start + len;
- 	if (end <= start)
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (!arch_validate_prot(prot))
- 		return -EINVAL;
- 
-@@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	/*
- 	 * Does the application expect PROT_READ to imply PROT_EXEC:
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		prot |= PROT_EXEC;
- 
- 	vm_flags = calc_vm_prot_bits(prot);
-@@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	if (start > vma->vm_start)
- 		prev = vma;
- 
-+	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+		current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- 	for (nstart = start ; ; ) {
- 		unsigned long newflags;
- 
-@@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 		if (error)
- 			goto out;
- 		perf_event_mmap(vma);
-+
-+		track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- 		nstart = tmp;
- 
- 		if (nstart < prev->vm_end)
-diff -urNp linux-2.6.32.11/mm/mremap.c linux-2.6.32.11/mm/mremap.c
---- linux-2.6.32.11/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/mremap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
- 			continue;
- 		pte = ptep_clear_flush(vma, old_addr, old_pte);
- 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+			pte = pte_exprotect(pte);
-+#endif
-+
- 		set_pte_at(mm, new_addr, new_pte, pte);
- 	}
- 
-@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
- 	if (is_vm_hugetlb_page(vma))
- 		goto Einval;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		goto Einval;
-+#endif
-+
- 	/* We can't remap across vm area boundaries */
- 	if (old_len > vma->vm_end - addr)
- 		goto Efault;
-@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
- 	unsigned long map_flags;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (new_addr & ~PAGE_MASK)
- 		goto out;
- 
--	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- 		goto out;
- 
- 	/* Check if the location we're moving into overlaps the
- 	 * old location at all, and fail if it does.
- 	 */
--	if ((new_addr <= addr) && (new_addr+new_len) > addr)
--		goto out;
--
--	if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+	if (addr + old_len > new_addr && new_addr + new_len > addr)
- 		goto out;
- 
- 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
- 	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- 		goto out;
-@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
- 	if (!new_len)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+	    old_len > pax_task_size || addr > pax_task_size-old_len)
-+		goto out;
-+
- 	if (flags & MREMAP_FIXED) {
- 		if (flags & MREMAP_MAYMOVE)
- 			ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
- 						   addr + new_len);
- 			}
- 			ret = addr;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- 			goto out;
- 		}
- 	}
-@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
- 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- 		if (ret)
- 			goto out;
-+
-+		map_flags = vma->vm_flags;
- 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+		if (!(ret & ~PAGE_MASK)) {
-+			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+		}
- 	}
- out:
- 	if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.32.11/mm/nommu.c linux-2.6.32.11/mm/nommu.c
---- linux-2.6.32.11/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/nommu.c	2010-04-04 20:46:41.713805609 -0400
-@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
- EXPORT_SYMBOL(find_vma);
- 
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
--	return find_vma(mm, addr);
--}
--
--/*
-  * expand a stack to a given address
-  * - not supported under NOMMU conditions
-  */
-diff -urNp linux-2.6.32.11/mm/page_alloc.c linux-2.6.32.11/mm/page_alloc.c
---- linux-2.6.32.11/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/page_alloc.c	2010-04-04 20:46:41.713805609 -0400
-@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
- 	int bad = 0;
- 	int wasMlocked = __TestClearPageMlocked(page);
- 
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	unsigned long index = 1UL << order;
-+#endif
-+
- 	kmemcheck_free_shadow(page, order);
- 
- 	for (i = 0 ; i < (1 << order) ; ++i)
-@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
- 		debug_check_no_obj_freed(page_address(page),
- 					   PAGE_SIZE << order);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	for (; index; --index)
-+		sanitize_highpage(page + index - 1);
-+#endif
-+
- 	arch_free_page(page, order);
- 	kernel_map_pages(page, 1 << order, 0);
- 
-@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
- 	arch_alloc_page(page, order);
- 	kernel_map_pages(page, 1 << order, 1);
- 
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- 	if (gfp_flags & __GFP_ZERO)
- 		prep_zero_page(page, order, gfp_flags);
-+#endif
- 
- 	if (order && (gfp_flags & __GFP_COMP))
- 		prep_compound_page(page, order);
-@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
- 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	sanitize_highpage(page);
-+#endif
-+
- 	arch_free_page(page, 0);
- 	kernel_map_pages(page, 1, 0);
- 
-diff -urNp linux-2.6.32.11/mm/percpu.c linux-2.6.32.11/mm/percpu.c
---- linux-2.6.32.11/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/percpu.c	2010-04-04 20:46:41.713805609 -0400
-@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
- static unsigned int pcpu_last_unit_cpu __read_mostly;
- 
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
- 
- static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
-diff -urNp linux-2.6.32.11/mm/rmap.c linux-2.6.32.11/mm/rmap.c
---- linux-2.6.32.11/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/rmap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
- 		struct mm_struct *mm = vma->vm_mm;
- 		struct anon_vma *allocated;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+#endif
-+
- 		anon_vma = find_mergeable_anon_vma(vma);
- 		allocated = NULL;
- 		if (!anon_vma) {
-@@ -121,6 +125,15 @@ int anon_vma_prepare(struct vm_area_stru
- 		/* page_table_lock to protect against threads */
- 		spin_lock(&mm->page_table_lock);
- 		if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			vma_m = pax_find_mirror_vma(vma);
-+			if (vma_m) {
-+				vma_m->anon_vma = anon_vma;
-+				__anon_vma_link(vma_m);
-+			}
-+#endif
-+
- 			vma->anon_vma = anon_vma;
- 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- 			allocated = NULL;
-diff -urNp linux-2.6.32.11/mm/shmem.c linux-2.6.32.11/mm/shmem.c
---- linux-2.6.32.11/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/shmem.c	2010-04-04 20:46:41.716811517 -0400
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
- 
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
- 
- #ifdef CONFIG_SHMEM
- /*
-diff -urNp linux-2.6.32.11/mm/slab.c linux-2.6.32.11/mm/slab.c
---- linux-2.6.32.11/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/slab.c	2010-04-04 20:46:41.716811517 -0400
-@@ -308,7 +308,7 @@ struct kmem_list3 {
-  * Need this for bootstrapping a per node allocator.
-  */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define	CACHE_CACHE 0
- #define	SIZE_AC MAX_NUMNODES
- #define	SIZE_L3 (2 * MAX_NUMNODES)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
-  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
-  */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
--					const struct slab *slab, void *obj)
-+					const struct slab *slab, const void *obj)
- {
- 	u32 offset = (obj - slab->s_mem);
- 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -584,14 +584,14 @@ struct cache_names {
- static struct cache_names __initdata cache_names[] = {
- #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
- #include <linux/kmalloc_sizes.h>
--	{NULL,}
-+	{NULL, NULL}
- #undef CACHE
- };
- 
- static struct arraycache_init initarray_cache __initdata =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- static struct arraycache_init initarray_generic =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- 
- /* internal cache of cache description objs */
- static struct kmem_cache cache_cache = {
-@@ -4082,7 +4082,7 @@ out:
- 	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
- }
- 
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- 
- static void print_slabinfo_header(struct seq_file *m)
- {
-@@ -4480,6 +4480,51 @@ static int __init slab_proc_init(void)
- module_init(slab_proc_init);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct kmem_cache *cachep;
-+	struct slab *slabp;
-+	struct page *page;
-+	unsigned int objnr;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = virt_to_head_page(ptr);
-+
-+	if (!PageSlab(page)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	cachep = page_get_cache(page);
-+	slabp = page_get_slab(page);
-+	objnr = obj_to_index(cachep, slabp, ptr);
-+	BUG_ON(objnr >= cachep->num);
-+	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /**
-  * ksize - get the actual amount of memory allocated for a given object
-  * @objp: Pointer to the object
-diff -urNp linux-2.6.32.11/mm/slob.c linux-2.6.32.11/mm/slob.c
---- linux-2.6.32.11/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/slob.c	2010-04-04 20:46:41.716811517 -0400
-@@ -29,7 +29,7 @@
-  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
-  * alloc_pages() directly, allocating compound pages so the page order
-  * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
-  * provide ksize(). These objects are detected in kfree() because slob_page()
-  * is false for them.
-  *
-@@ -58,6 +58,7 @@
-  */
- 
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- 			unsigned long flags;	/* mandatory */
- 			atomic_t _count;	/* mandatory */
- 			slobidx_t units;	/* free units left in page */
--			unsigned long pad[2];
-+			unsigned long pad[1];
-+			unsigned long size;	/* size when >=PAGE_SIZE */
- 			slob_t *free;		/* first free slob_t in page */
- 			struct list_head list;	/* linked list of free pages */
- 		};
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
-  */
- static inline int is_slob_page(struct slob_page *sp)
- {
--	return PageSlab((struct page *)sp);
-+	return PageSlab((struct page *)sp) && !sp->size;
- }
- 
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
- 
- static inline struct slob_page *slob_page(const void *addr)
- {
--	return (struct slob_page *)virt_to_page(addr);
-+	return (struct slob_page *)virt_to_head_page(addr);
- }
- 
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
- /*
-  * Return the size of a slob block.
-  */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- 	if (s->units > 0)
- 		return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
-  * Return the next free slob block pointer after this one.
-  */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- 	slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
-  * Returns true if s is the last free block in its page.
-  */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
- 	if (!page)
- 		return NULL;
- 
-+	set_slob_page(page);
- 	return page_address(page);
- }
- 
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
- 		if (!b)
- 			return NULL;
- 		sp = slob_page(b);
--		set_slob_page(sp);
- 
- 		spin_lock_irqsave(&slob_lock, flags);
- 		sp->units = SLOB_UNITS(PAGE_SIZE);
- 		sp->free = b;
-+		sp->size = 0;
- 		INIT_LIST_HEAD(&sp->list);
- 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- 		set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
- 
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
--	unsigned int *m;
--	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+	slob_t *m;
- 	void *ret;
- 
- 	lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		if (!m)
- 			return NULL;
--		*m = size;
-+		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+		m[0].units = size;
-+		m[1].units = align;
- 		ret = (void *)m + align;
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- 		if (ret) {
--			struct page *page;
--			page = virt_to_page(ret);
--			page->private = size;
-+			struct slob_page *sp;
-+			sp = slob_page(ret);
-+			sp->size = size;
- 		}
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
- 	kmemleak_alloc(ret, size, 1, gfp);
- 	return ret;
- }
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+
-+	return __kmalloc_node_align(size, gfp, node, align);
-+}
- EXPORT_SYMBOL(__kmalloc_node);
- 
- void kfree(const void *block)
-@@ -528,13 +540,84 @@ void kfree(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		slob_free(m, *m + align);
--	} else
-+		slob_t *m = (slob_t *)(block - align);
-+		slob_free(m, m[0].units + align);
-+	} else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		put_page(&sp->page);
-+	}
- }
- EXPORT_SYMBOL(kfree);
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct slob_page *sp;
-+	const slob_t *free;
-+	const void *base;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	sp = slob_page(ptr);
-+	if (!PageSlab((struct page*)sp)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	if (sp->size) {
-+		base = page_address(&sp->page);
-+		if (base <= ptr && n <= sp->size - (ptr - base))
-+			return;
-+		goto report;
-+	}
-+
-+	/* some tricky double walking to find the chunk */
-+	base = (void *)((unsigned long)ptr & PAGE_MASK);
-+	free = sp->free;
-+
-+	while (!slob_last(free) && (void *)free <= ptr) {
-+		base = free + slob_units(free);
-+		free = slob_next(free);
-+	}
-+
-+	while (base < (void *)free) {
-+		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+		int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+		int offset;
-+
-+		if (ptr < base + align)
-+			goto report;
-+
-+		offset = ptr - base - align;
-+		if (offset < m) {
-+			if (n <= m - offset)
-+				return;
-+			goto report;
-+		}
-+		base += size;
-+	}
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +630,10 @@ size_t ksize(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		return SLOB_UNITS(*m) * SLOB_UNIT;
-+		slob_t *m = (slob_t *)(block - align);
-+		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- 	} else
--		return sp->page.private;
-+		return sp->size;
- }
- EXPORT_SYMBOL(ksize);
- 
-@@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
- {
- 	void *b;
- 
-+#ifdef CONFIG_PAX_USERCOPY
-+	b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- 	if (c->size < PAGE_SIZE) {
- 		b = slob_alloc(c->size, flags, c->align, node);
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    SLOB_UNITS(c->size) * SLOB_UNIT,
- 					    flags, node);
- 	} else {
-+		struct slob_page *sp;
-+
- 		b = slob_new_pages(flags, get_order(c->size), node);
-+		sp = slob_page(b);
-+		sp->size = c->size;
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    PAGE_SIZE << get_order(c->size),
- 					    flags, node);
- 	}
-+#endif
- 
- 	if (c->ctor)
- 		c->ctor(b);
-@@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
- 
- static void __kmem_cache_free(void *b, int size)
- {
--	if (size < PAGE_SIZE)
-+	struct slob_page *sp = slob_page(b);
-+
-+	if (is_slob_page(sp))
- 		slob_free(b, size);
--	else
-+	else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		slob_free_pages(b, get_order(size));
-+	}
- }
- 
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
- 
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+	int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	if (size + c->align < PAGE_SIZE) {
-+		size += c->align;
-+		b -= c->align;
-+	}
-+#endif
-+
- 	kmemleak_free_recursive(b, c->flags);
- 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- 		struct slob_rcu *slob_rcu;
--		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+		slob_rcu = b + (size - sizeof(struct slob_rcu));
- 		INIT_RCU_HEAD(&slob_rcu->head);
--		slob_rcu->size = c->size;
-+		slob_rcu->size = size;
- 		call_rcu(&slob_rcu->head, kmem_rcu_free);
- 	} else {
--		__kmem_cache_free(b, c->size);
-+		__kmem_cache_free(b, size);
- 	}
- 
- 	trace_kmem_cache_free(_RET_IP_, b);
-diff -urNp linux-2.6.32.11/mm/slub.c linux-2.6.32.11/mm/slub.c
---- linux-2.6.32.11/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/slub.c	2010-04-04 20:46:41.716811517 -0400
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
- 
- 	page = virt_to_head_page(x);
- 
-+	BUG_ON(!PageSlab(page));
-+
- 	slab_free(s, page, x, _RET_IP_);
- 
- 	trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
-  * Merge control. If this is set then no merging of slab caches will occur.
-  * (Could be removed. This was introduced to pacify the merge skeptics.)
-  */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
- 
- /*
-  * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
- 	 * list to avoid pounding the page allocator excessively.
- 	 */
- 	set_min_partial(s, ilog2(s->size));
--	s->refcount = 1;
-+	atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- 	s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- 	down_write(&slub_lock);
--	s->refcount--;
--	if (!s->refcount) {
-+	if (atomic_dec_and_test(&s->refcount)) {
- 		list_del(&s->list);
- 		up_write(&slub_lock);
- 		if (kmem_cache_close(s)) {
-@@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t 
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct page *page;
-+	struct kmem_cache *s;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = get_object_page(ptr);
-+
-+	if (!page) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	s = page->slab;
-+	offset = (ptr - page_address(page)) % s->size;
-+	if (offset <= s->objsize && n <= s->objsize - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- size_t ksize(const void *object)
- {
- 	struct page *page;
-@@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
- 	 */
- 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
- 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
--	kmalloc_caches[0].refcount = -1;
-+	atomic_set(&kmalloc_caches[0].refcount, -1);
- 	caches++;
- 
- 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
- 	/*
- 	 * We may have set a slab to be unmergeable during bootstrap.
- 	 */
--	if (s->refcount < 0)
-+	if (atomic_read(&s->refcount) < 0)
- 		return 1;
- 
- 	return 0;
-@@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
- 	if (s) {
- 		int cpu;
- 
--		s->refcount++;
-+		atomic_inc(&s->refcount);
- 		/*
- 		 * Adjust the object sizes so that we clear
- 		 * the complete object on kzalloc.
-@@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
- 
- 		if (sysfs_slab_alias(s, name)) {
- 			down_write(&slub_lock);
--			s->refcount--;
-+			atomic_dec(&s->refcount);
- 			up_write(&slub_lock);
- 			goto err;
- 		}
-@@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
- 
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
--	return sprintf(buf, "%d\n", s->refcount - 1);
-+	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
- 
-@@ -4503,7 +4544,7 @@ static void kmem_cache_release(struct ko
- 	kfree(s);
- }
- 
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- 	.show = slab_attr_show,
- 	.store = slab_attr_store,
- };
-@@ -4522,7 +4563,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-@@ -4696,7 +4737,7 @@ __initcall(slab_sysfs_init);
- /*
-  * The /proc/slabinfo ABI
-  */
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static void print_slabinfo_header(struct seq_file *m)
- {
- 	seq_puts(m, "slabinfo - version: 2.1\n");
-diff -urNp linux-2.6.32.11/mm/util.c linux-2.6.32.11/mm/util.c
---- linux-2.6.32.11/mm/util.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/util.c	2010-04-04 20:46:41.716811517 -0400
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 	mm->get_unmapped_area = arch_get_unmapped_area;
- 	mm->unmap_area = arch_unmap_area;
- }
-diff -urNp linux-2.6.32.11/mm/vmalloc.c linux-2.6.32.11/mm/vmalloc.c
---- linux-2.6.32.11/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/mm/vmalloc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
- 
- 	pte = pte_offset_kernel(pmd, addr);
- 	do {
--		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
--		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+			BUG_ON(!pte_exec(*pte));
-+			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+			continue;
-+		}
-+#endif
-+
-+		{
-+			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+		}
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
- }
- 
-@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
- 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
- {
- 	pte_t *pte;
-+	int ret = -ENOMEM;
- 
- 	/*
- 	 * nr is a running index into the array which helps higher level
-@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
- 	pte = pte_alloc_kernel(pmd, addr);
- 	if (!pte)
- 		return -ENOMEM;
-+
-+	pax_open_kernel();
- 	do {
- 		struct page *page = pages[*nr];
- 
--		if (WARN_ON(!pte_none(*pte)))
--			return -EBUSY;
--		if (WARN_ON(!page))
--			return -ENOMEM;
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (pgprot_val(prot) & _PAGE_NX)
-+#endif
-+
-+		if (WARN_ON(!pte_none(*pte))) {
-+			ret = -EBUSY;
-+			goto out;
-+		}
-+		if (WARN_ON(!page)) {
-+			ret = -ENOMEM;
-+			goto out;
-+		}
- 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- 		(*nr)++;
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
--	return 0;
-+	ret = 0;
-+out:
-+	pax_close_kernel();
-+	return ret;
- }
- 
- static int vmap_pmd_range(pud_t *pud, unsigned long addr,
-@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
- 	 * and fall back on vmalloc() if that fails. Others
- 	 * just put it in the vmalloc space.
- 	 */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- 	unsigned long addr = (unsigned long)x;
- 	if (addr >= MODULES_VADDR && addr < MODULES_END)
- 		return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+		return 1;
-+#endif
-+
-+#endif
-+
- 	return is_vmalloc_addr(x);
- }
- 
-@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
- 	struct rb_node *tmp;
- 
- 	while (*p) {
--		struct vmap_area *tmp;
-+		struct vmap_area *varea;
- 
- 		parent = *p;
--		tmp = rb_entry(parent, struct vmap_area, rb_node);
--		if (va->va_start < tmp->va_end)
-+		varea = rb_entry(parent, struct vmap_area, rb_node);
-+		if (va->va_start < varea->va_end)
- 			p = &(*p)->rb_left;
--		else if (va->va_end > tmp->va_start)
-+		else if (va->va_end > varea->va_start)
- 			p = &(*p)->rb_right;
- 		else
- 			BUG();
-@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
- 	struct vm_struct *area;
- 
- 	BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (flags & VM_KERNEXEC) {
-+		if (start != VMALLOC_START || end != VMALLOC_END)
-+			return NULL;
-+		start = (unsigned long)&MODULES_EXEC_VADDR;
-+		end = (unsigned long)&MODULES_EXEC_END;
-+	}
-+#endif
-+
- 	if (flags & VM_IOREMAP) {
- 		int bit = fls(size);
- 
-@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
- 	if (count > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		flags |= VM_KERNEXEC;
-+#endif
-+
- 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- 					__builtin_return_address(0));
- 	if (!area)
-@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
- 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
-+						node, gfp_mask, caller);
-+	else
-+#endif
-+
- 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
- 				  VMALLOC_END, node, gfp_mask, caller);
- 
-@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
- 	return addr;
- }
- 
-+#undef __vmalloc
- void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
- {
- 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
-@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc
- void *vmalloc(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
-  * The resulting memory area is zeroed so it can be mapped to userspace
-  * without leaking data.
-  */
-+#undef vmalloc_user
- void *vmalloc_user(unsigned long size)
- {
- 	struct vm_struct *area;
-@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc_node
- void *vmalloc_node(unsigned long size, int node)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
--
-+#undef vmalloc_exec
- void *vmalloc_exec(unsigned long size)
- {
--	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- 			      -1, __builtin_return_address(0));
- }
- 
-@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
-  *	Allocate enough 32bit PA addressable pages to cover @size from the
-  *	page level allocator and map them into contiguous kernel virtual space.
-  */
-+#undef vmalloc_32
- void *vmalloc_32(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
-@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
-  * The resulting memory area is 32bit addressable and zeroed so it can be
-  * mapped to userspace without leaking data.
-  */
-+#undef vmalloc_32_user
- void *vmalloc_32_user(unsigned long size)
- {
- 	struct vm_struct *area;
-diff -urNp linux-2.6.32.11/net/atm/atm_misc.c linux-2.6.32.11/net/atm/atm_misc.c
---- linux-2.6.32.11/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/atm/atm_misc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
- 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- 		return 1;
- 	atm_return(vcc,truesize);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return 0;
- }
- 
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
- 		}
- 	}
- 	atm_return(vcc,guess);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return NULL;
- }
- 
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
- 
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
- 
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.11/net/atm/proc.c linux-2.6.32.11/net/atm/proc.c
---- linux-2.6.32.11/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/atm/proc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
-   const struct k_atm_aal_stats *stats)
- {
- 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
--	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
--	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
--	    atomic_read(&stats->rx_drop));
-+	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+	    atomic_read_unchecked(&stats->rx_drop));
- }
- 
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-diff -urNp linux-2.6.32.11/net/atm/resources.c linux-2.6.32.11/net/atm/resources.c
---- linux-2.6.32.11/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/atm/resources.c	2010-04-04 20:46:41.716811517 -0400
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
- static void copy_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.11/net/bridge/br_private.h linux-2.6.32.11/net/bridge/br_private.h
---- linux-2.6.32.11/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/bridge/br_private.h	2010-04-04 20:46:41.716811517 -0400
-@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
- 
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
- 
- /* br_sysfs_br.c */
-diff -urNp linux-2.6.32.11/net/bridge/br_stp_if.c linux-2.6.32.11/net/bridge/br_stp_if.c
---- linux-2.6.32.11/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/bridge/br_stp_if.c	2010-04-04 20:46:41.716811517 -0400
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
- 	char *envp[] = { NULL };
- 
- 	if (br->stp_enabled == BR_USER_STP) {
--		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- 			br->dev->name, r);
- 
-diff -urNp linux-2.6.32.11/net/bridge/br_sysfs_if.c linux-2.6.32.11/net/bridge/br_sysfs_if.c
---- linux-2.6.32.11/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/bridge/br_sysfs_if.c	2010-04-04 20:46:41.716811517 -0400
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
- 	return ret;
- }
- 
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- 	.show = brport_show,
- 	.store = brport_store,
- };
-diff -urNp linux-2.6.32.11/net/core/dev.c linux-2.6.32.11/net/core/dev.c
---- linux-2.6.32.11/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/core/dev.c	2010-04-04 20:46:41.721901011 -0400
-@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
- 
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
- 
-@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
- EXPORT_SYMBOL(netif_napi_del);
- 
- 
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- 	unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.32.11/net/core/flow.c linux-2.6.32.11/net/core/flow.c
---- linux-2.6.32.11/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/core/flow.c	2010-04-04 20:46:41.721901011 -0400
-@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
- 
- static u32 flow_hash_shift;
- #define flow_hash_size	(1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
- 
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
- 
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- 	u32 hash_rnd;
- 	int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
- 
- #define flow_hash_rnd_recalc(cpu) \
- 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- 	atomic_t cpuleft;
- 	struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
- 
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
- 
-diff -urNp linux-2.6.32.11/net/dccp/ccids/ccid3.c linux-2.6.32.11/net/dccp/ccids/ccid3.c
---- linux-2.6.32.11/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/dccp/ccids/ccid3.c	2010-04-04 20:46:41.721901011 -0400
-@@ -41,7 +41,7 @@
- static int ccid3_debug;
- #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
- #else
--#define ccid3_pr_debug(format, a...)
-+#define ccid3_pr_debug(format, a...) do {} while (0)
- #endif
- 
- /*
-diff -urNp linux-2.6.32.11/net/dccp/dccp.h linux-2.6.32.11/net/dccp/dccp.h
---- linux-2.6.32.11/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/dccp/dccp.h	2010-04-04 20:46:41.721901011 -0400
-@@ -44,9 +44,9 @@ extern int dccp_debug;
- #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
- #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
- #else
--#define dccp_pr_debug(format, a...)
--#define dccp_pr_debug_cat(format, a...)
--#define dccp_debug(format, a...)
-+#define dccp_pr_debug(format, a...) do {} while (0)
-+#define dccp_pr_debug_cat(format, a...) do {} while (0)
-+#define dccp_debug(format, a...) do {} while (0)
- #endif
- 
- extern struct inet_hashinfo dccp_hashinfo;
-diff -urNp linux-2.6.32.11/net/decnet/sysctl_net_decnet.c linux-2.6.32.11/net/decnet/sysctl_net_decnet.c
---- linux-2.6.32.11/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/decnet/sysctl_net_decnet.c	2010-04-04 20:46:41.721901011 -0400
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, addr, len))
-+	if (len > sizeof addr || copy_to_user(buffer, addr, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, devname, len))
-+	if (len > sizeof devname || copy_to_user(buffer, devname, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-diff -urNp linux-2.6.32.11/net/ipv4/inet_hashtables.c linux-2.6.32.11/net/ipv4/inet_hashtables.c
---- linux-2.6.32.11/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/inet_hashtables.c	2010-04-04 20:46:41.721901011 -0400
-@@ -18,11 +18,14 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
- 
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/ip.h>
- 
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
-  * Allocate and initialize a new local port bind bucket.
-  * The bindhash mutex for snum's hash chain must be held here.
-@@ -490,6 +493,8 @@ ok:
- 		}
- 		spin_unlock(&head->lock);
- 
-+		gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- 		if (tw) {
- 			inet_twsk_deschedule(tw, death_row);
- 			inet_twsk_put(tw);
-diff -urNp linux-2.6.32.11/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.11/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.32.11/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-04-04 20:46:41.721901011 -0400
-@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
- 
- 	*len = 0;
- 
--	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
-+	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
- 	if (*octets == NULL) {
- 		if (net_ratelimit())
- 			printk("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.32.11/net/ipv4/tcp_ipv4.c linux-2.6.32.11/net/ipv4/tcp_ipv4.c
---- linux-2.6.32.11/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/tcp_ipv4.c	2010-04-04 20:46:41.721901011 -0400
-@@ -84,6 +84,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
- 
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- 	TCP_SKB_CB(skb)->sacked	 = 0;
- 
- 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
--	if (!sk)
-+	if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 1;
-+#endif
- 		goto no_tcp_socket;
-+	}
- 
- process:
--	if (sk->sk_state == TCP_TIME_WAIT)
-+	if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 2;
-+#endif
- 		goto do_time_wait;
-+	}
- 
- 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- 		goto discard_and_relse;
-@@ -1650,6 +1661,10 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (!grsec_enable_blackhole || (ret == 1 &&
-+		    (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- 		tcp_v4_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.11/net/ipv4/tcp_minisocks.c linux-2.6.32.11/net/ipv4/tcp_minisocks.c
---- linux-2.6.32.11/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/tcp_minisocks.c	2010-04-04 20:46:41.721901011 -0400
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
- 
- embryonic_reset:
- 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole)
-+#endif
- 	if (!(flg & TCP_FLAG_RST))
- 		req->rsk_ops->send_reset(sk, skb);
- 
-diff -urNp linux-2.6.32.11/net/ipv4/tcp_probe.c linux-2.6.32.11/net/ipv4/tcp_probe.c
---- linux-2.6.32.11/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/tcp_probe.c	2010-04-04 20:46:41.721901011 -0400
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
- 		if (cnt + width >= len)
- 			break;
- 
--		if (copy_to_user(buf + cnt, tbuf, width))
-+		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- 			return -EFAULT;
- 		cnt += width;
- 	}
-diff -urNp linux-2.6.32.11/net/ipv4/tcp_timer.c linux-2.6.32.11/net/ipv4/tcp_timer.c
---- linux-2.6.32.11/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/tcp_timer.c	2010-04-04 20:46:41.721901011 -0400
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
- 		}
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if ((sk->sk_state == TCP_LAST_ACK) &&
-+	    (grsec_lastack_retries > 0) &&
-+	    (grsec_lastack_retries < retry_until))
-+		retry_until = grsec_lastack_retries;
-+#endif
-+
- 	if (retransmits_timed_out(sk, retry_until)) {
- 		/* Has it gone just too far? */
- 		tcp_write_err(sk);
-diff -urNp linux-2.6.32.11/net/ipv4/udp.c linux-2.6.32.11/net/ipv4/udp.c
---- linux-2.6.32.11/net/ipv4/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv4/udp.c	2010-04-04 20:46:41.724917264 -0400
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
- 
-@@ -371,6 +376,9 @@ found:
- 	return s;
- }
- 
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
-  * This routine is called by the ICMP module when it gets some
-  * sort of error condition.  If err < 0 then the socket should
-@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
- 		dport = usin->sin_port;
- 		if (dport == 0)
- 			return -EINVAL;
-+
-+		err = gr_search_udp_sendmsg(sk, usin);
-+		if (err)
-+			return err;
- 	} else {
- 		if (sk->sk_state != TCP_ESTABLISHED)
- 			return -EDESTADDRREQ;
-+
-+		err = gr_search_udp_sendmsg(sk, NULL);
-+		if (err)
-+			return err;
-+
- 		daddr = inet->daddr;
- 		dport = inet->dport;
- 		/* Open fast path for connected socket.
-@@ -945,6 +962,10 @@ try_again:
- 	if (!skb)
- 		goto out;
- 
-+	err = gr_search_udp_recvmsg(sk, skb);
-+	if (err)
-+		goto out_free;
-+
- 	ulen = skb->len - sizeof(struct udphdr);
- 	copied = len;
- 	if (copied > ulen)
-@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
- 		goto csum_error;
- 
- 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
- 
- 	/*
-diff -urNp linux-2.6.32.11/net/ipv6/exthdrs.c linux-2.6.32.11/net/ipv6/exthdrs.c
---- linux-2.6.32.11/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv6/exthdrs.c	2010-04-04 20:46:41.724917264 -0400
-@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
- 		.type	= IPV6_TLV_JUMBO,
- 		.func	= ipv6_hop_jumbo,
- 	},
--	{ -1, }
-+	{ -1, NULL }
- };
- 
- int ipv6_parse_hopopts(struct sk_buff *skb)
-diff -urNp linux-2.6.32.11/net/ipv6/raw.c linux-2.6.32.11/net/ipv6/raw.c
---- linux-2.6.32.11/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv6/raw.c	2010-04-04 20:46:41.724917264 -0400
-@@ -600,7 +600,7 @@ out:
- 	return err;
- }
- 
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- 			struct flowi *fl, struct rt6_info *rt,
- 			unsigned int flags)
- {
-diff -urNp linux-2.6.32.11/net/ipv6/tcp_ipv6.c linux-2.6.32.11/net/ipv6/tcp_ipv6.c
---- linux-2.6.32.11/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv6/tcp_ipv6.c	2010-04-04 20:46:41.724917264 -0400
-@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
- 	return 0;
- 
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	tcp_v6_send_reset(sk, skb);
- discard:
- 	if (opt_skb)
-@@ -1700,6 +1703,9 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		tcp_v6_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.11/net/ipv6/udp.c linux-2.6.32.11/net/ipv6/udp.c
---- linux-2.6.32.11/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/ipv6/udp.c	2010-04-04 20:46:41.724917264 -0400
-@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
- 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- 				proto == IPPROTO_UDPLITE);
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
- 
- 		kfree_skb(skb);
-diff -urNp linux-2.6.32.11/net/irda/ircomm/ircomm_tty.c linux-2.6.32.11/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.32.11/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/irda/ircomm/ircomm_tty.c	2010-04-04 20:46:41.724917264 -0400
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
- 	add_wait_queue(&self->open_wait, &wait);
- 
- 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 	/* As far as I can see, we protect open_count - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	if (!tty_hung_up_p(filp)) {
- 		extra_count = 1;
--		self->open_count--;
-+		atomic_dec(&self->open_count);
- 	}
- 	spin_unlock_irqrestore(&self->spinlock, flags);
--	self->blocked_open++;
-+	atomic_inc(&self->blocked_open);
- 
- 	while (1) {
- 		if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
- 		}
- 
- 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
--		      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 		schedule();
- 	}
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
- 	if (extra_count) {
- 		/* ++ is not atomic, so this should be protected - Jean II */
- 		spin_lock_irqsave(&self->spinlock, flags);
--		self->open_count++;
-+		atomic_inc(&self->open_count);
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 	}
--	self->blocked_open--;
-+	atomic_dec(&self->blocked_open);
- 
- 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count);
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
- 
- 	if (!retval)
- 		self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
- 	}
- 	/* ++ is not atomic, so this should be protected - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
--	self->open_count++;
-+	atomic_inc(&self->open_count);
- 
- 	tty->driver_data = self;
- 	self->tty = tty;
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
--		   self->line, self->open_count);
-+		   self->line, atomic_read(&self->open_count));
- 
- 	/* Not really used by us, but lets do it anyway */
- 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
- 		return;
- 	}
- 
--	if ((tty->count == 1) && (self->open_count != 1)) {
-+	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
- 		/*
- 		 * Uh, oh.  tty->count is 1, which means that the tty
- 		 * structure will be freed.  state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
- 		 */
- 		IRDA_DEBUG(0, "%s(), bad serial port count; "
- 			   "tty->count is 1, state->count is %d\n", __func__ ,
--			   self->open_count);
--		self->open_count = 1;
-+			   atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 1);
- 	}
- 
--	if (--self->open_count < 0) {
-+	if (atomic_dec_return(&self->open_count) < 0) {
- 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
--			   __func__, self->line, self->open_count);
--		self->open_count = 0;
-+			   __func__, self->line, atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 0);
- 	}
--	if (self->open_count) {
-+	if (atomic_read(&self->open_count)) {
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
- 	tty->closing = 0;
- 	self->tty = NULL;
- 
--	if (self->blocked_open) {
-+	if (atomic_read(&self->blocked_open)) {
- 		if (self->close_delay)
- 			schedule_timeout_interruptible(self->close_delay);
- 		wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
- 	self->tty = NULL;
--	self->open_count = 0;
-+	atomic_set(&self->open_count, 0);
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
- 	seq_putc(m, '\n');
- 
- 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
--	seq_printf(m, "Open count: %d\n", self->open_count);
-+	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
- 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
- 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
- 
-diff -urNp linux-2.6.32.11/net/mac80211/ieee80211_i.h linux-2.6.32.11/net/mac80211/ieee80211_i.h
---- linux-2.6.32.11/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.11/net/mac80211/ieee80211_i.h	2010-04-04 20:46:41.724917264 -0400
-@@ -635,7 +635,7 @@ struct ieee80211_local {
- 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- 	spinlock_t queue_stop_reason_lock;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int monitors, cooked_mntrs;
- 	/* number of interfaces with corresponding FIF_ flags */
- 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff -urNp linux-2.6.32.11/net/mac80211/iface.c linux-2.6.32.11/net/mac80211/iface.c
---- linux-2.6.32.11/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/mac80211/iface.c	2010-04-04 20:46:41.724917264 -0400
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
- 		break;
- 	}
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		res = drv_start(local);
- 		if (res)
- 			goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
- 	 * Validate the MAC address for this device.
- 	 */
- 	if (!is_valid_ether_addr(dev->dev_addr)) {
--		if (!local->open_count)
-+		if (!atomic_read(&local->open_count))
- 			drv_stop(local);
- 		return -EADDRNOTAVAIL;
- 	}
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
- 
- 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
- 
--	local->open_count++;
-+	atomic_inc(&local->open_count);
- 	if (hw_reconf_flags) {
- 		ieee80211_hw_config(local, hw_reconf_flags);
- 		/*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
-  err_del_interface:
- 	drv_remove_interface(local, &conf);
-  err_stop:
--	if (!local->open_count)
-+	if (!atomic_read(&local->open_count))
- 		drv_stop(local);
-  err_del_bss:
- 	sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
- 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
- 	}
- 
--	local->open_count--;
-+	atomic_dec(&local->open_count);
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
- 
- 	ieee80211_recalc_ps(local, -1);
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		ieee80211_clear_tx_pending(local);
- 		ieee80211_stop_device(local);
- 
-diff -urNp linux-2.6.32.11/net/mac80211/main.c linux-2.6.32.11/net/mac80211/main.c
---- linux-2.6.32.11/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.11/net/mac80211/main.c	2010-04-04 20:46:41.724917264 -0400
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
- 		local->hw.conf.power_level = power;
- 	}
- 
--	if (changed && local->open_count) {
-+	if (changed && atomic_read(&local->open_count)) {
- 		ret = drv_config(local, changed);
- 		/*
- 		 * Goal:
-diff -urNp linux-2.6.32.11/net/mac80211/pm.c linux-2.6.32.11/net/mac80211/pm.c
---- linux-2.6.32.11/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/mac80211/pm.c	2010-04-04 20:46:41.724917264 -0400
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
- 	}
- 
- 	/* stop hardware - this must stop RX */
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		ieee80211_stop_device(local);
- 
- 	local->suspended = true;
-diff -urNp linux-2.6.32.11/net/mac80211/rate.c linux-2.6.32.11/net/mac80211/rate.c
---- linux-2.6.32.11/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/mac80211/rate.c	2010-04-04 20:46:41.724917264 -0400
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
- 	struct rate_control_ref *ref, *old;
- 
- 	ASSERT_RTNL();
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		return -EBUSY;
- 
- 	ref = rate_control_alloc(name, local);
-diff -urNp linux-2.6.32.11/net/mac80211/util.c linux-2.6.32.11/net/mac80211/util.c
---- linux-2.6.32.11/net/mac80211/util.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/mac80211/util.c	2010-04-04 20:46:41.724917264 -0400
-@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
- 		local->resuming = true;
- 
- 	/* restart hardware */
--	if (local->open_count) {
-+	if (atomic_read(&local->open_count)) {
- 		/*
- 		 * Upon resume hardware can sometimes be goofy due to
- 		 * various platform / driver / bus issues, so restarting
- 		 * the device may at times not work immediately. Propagate
- 		 * the error.
- 		 */
--		res = drv_start(local);
-+                res = drv_start(local);
- 		if (res) {
- 			WARN(local->suspended, "Harware became unavailable "
- 			     "upon resume. This is could be a software issue"
-diff -urNp linux-2.6.32.11/net/sctp/socket.c linux-2.6.32.11/net/sctp/socket.c
---- linux-2.6.32.11/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/sctp/socket.c	2010-04-04 20:46:41.728797784 -0400
-@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
- 	struct sctp_sndrcvinfo *sinfo;
- 	struct sctp_initmsg *sinit;
- 	sctp_assoc_t associd = 0;
--	sctp_cmsgs_t cmsgs = { NULL };
-+	sctp_cmsgs_t cmsgs = { NULL, NULL };
- 	int err;
- 	sctp_scope_t scope;
- 	long timeo;
-@@ -5802,7 +5802,6 @@ pp_found:
- 		 */
- 		int reuse = sk->sk_reuse;
- 		struct sock *sk2;
--		struct hlist_node *node;
- 
- 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- 		if (pp->fastreuse && sk->sk_reuse &&
-diff -urNp linux-2.6.32.11/net/socket.c linux-2.6.32.11/net/socket.c
---- linux-2.6.32.11/net/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/socket.c	2010-04-04 20:46:41.728797784 -0400
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
- 
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
- 
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+			      const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct socket *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+			     struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+			  struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+			    const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- 			 unsigned long nr_segs, loff_t pos);
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
- 			     mnt);
- }
- 
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
- 
- static struct file_system_type sock_fs_type = {
- 	.name =		"sockfs",
-@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
- 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
- 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
- 
-+	if(!gr_search_socket(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_handle_sock_all(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
- 	retval = sock_create(family, type, protocol, &sock);
- 	if (retval < 0)
- 		goto out;
-@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 	if (sock) {
- 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- 		if (err >= 0) {
-+			if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+				err = -EACCES;
-+				goto error;
-+			}
-+			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+			if (err)
-+				goto error;
-+
- 			err = security_socket_bind(sock,
- 						   (struct sockaddr *)&address,
- 						   addrlen);
-@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 						      (struct sockaddr *)
- 						      &address, addrlen);
- 		}
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
- 		if ((unsigned)backlog > somaxconn)
- 			backlog = somaxconn;
- 
-+		if (gr_handle_sock_server_other(sock)) {
-+			err = -EPERM;
-+			goto error;
-+		}
-+
-+		err = gr_search_listen(sock);
-+		if (err)
-+			goto error;
-+
- 		err = security_socket_listen(sock, backlog);
- 		if (!err)
- 			err = sock->ops->listen(sock, backlog);
- 
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	newsock->type = sock->type;
- 	newsock->ops = sock->ops;
- 
-+	if (gr_handle_sock_server_other(sock)) {
-+		err = -EPERM;
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
-+	err = gr_search_accept(sock);
-+	if (err) {
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
- 	/*
- 	 * We don't need try_module_get here, as the listening socket (sock)
- 	 * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	fd_install(newfd, newfile);
- 	err = newfd;
- 
-+	gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- 	fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 		int, addrlen)
- {
- 	struct socket *sock;
-+	struct sockaddr *sck;
- 	struct sockaddr_storage address;
- 	int err, fput_needed;
- 
-@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 	if (err < 0)
- 		goto out_put;
- 
-+	sck = (struct sockaddr *)&address;
-+
-+	if (gr_handle_sock_client(sck)) {
-+		err = -EACCES;
-+		goto out_put;
-+	}
-+
-+	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+	if (err)
-+		goto out_put;
-+
- 	err =
- 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- 	if (err)
-diff -urNp linux-2.6.32.11/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.11/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.32.11/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/sunrpc/xprtrdma/svc_rdma.c	2010-04-04 20:46:41.728797784 -0400
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
- 		len -= *ppos;
- 		if (len > *lenp)
- 			len = *lenp;
--		if (len && copy_to_user(buffer, str_buf, len))
-+		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- 			return -EFAULT;
- 		*lenp = len;
- 		*ppos += len;
-diff -urNp linux-2.6.32.11/net/sysctl_net.c linux-2.6.32.11/net/sysctl_net.c
---- linux-2.6.32.11/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/sysctl_net.c	2010-04-04 20:46:41.728797784 -0400
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
- 			       struct ctl_table *table)
- {
- 	/* Allow network administrator to have same access as root. */
--	if (capable(CAP_NET_ADMIN)) {
-+	if (capable_nolog(CAP_NET_ADMIN)) {
- 		int mode = (table->mode >> 6) & 7;
- 		return (mode << 6) | (mode << 3) | mode;
- 	}
-diff -urNp linux-2.6.32.11/net/unix/af_unix.c linux-2.6.32.11/net/unix/af_unix.c
---- linux-2.6.32.11/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/net/unix/af_unix.c	2010-04-04 20:46:41.728797784 -0400
-@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
- 		err = -ECONNREFUSED;
- 		if (!S_ISSOCK(inode->i_mode))
- 			goto put_fail;
-+
-+		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+			err = -EACCES;
-+			goto put_fail;
-+		}
-+
- 		u = unix_find_socket_byinode(net, inode);
- 		if (!u)
- 			goto put_fail;
-@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
- 		if (u) {
- 			struct dentry *dentry;
- 			dentry = unix_sk(u)->dentry;
-+
-+			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+				err = -EPERM;
-+				sock_put(u);
-+				goto fail;
-+			}
-+
- 			if (dentry)
- 				touch_atime(unix_sk(u)->mnt, dentry);
- 		} else
-@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
- 		err = security_path_mknod(&nd.path, dentry, mode, 0);
- 		if (err)
- 			goto out_mknod_drop_write;
-+		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+			err = -EACCES;
-+			goto out_mknod_drop_write;
-+		}
- 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- 		mnt_drop_write(nd.path.mnt);
- 		if (err)
- 			goto out_mknod_dput;
-+
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- 		dput(nd.path.dentry);
- 		nd.path.dentry = dentry;
-@@ -861,6 +881,10 @@ out_mknod_drop_write:
- 			goto out_unlock;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+		sk->sk_peercred.pid = current->pid;
-+#endif
-+
- 		list = &unix_socket_table[addr->hash];
- 	} else {
- 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
-diff -urNp linux-2.6.32.11/samples/kobject/kset-example.c linux-2.6.32.11/samples/kobject/kset-example.c
---- linux-2.6.32.11/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/samples/kobject/kset-example.c	2010-04-04 20:46:41.728797784 -0400
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
- }
- 
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- 	.show = foo_attr_show,
- 	.store = foo_attr_store,
- };
-diff -urNp linux-2.6.32.11/scripts/basic/fixdep.c linux-2.6.32.11/scripts/basic/fixdep.c
---- linux-2.6.32.11/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/basic/fixdep.c	2010-04-04 20:46:41.728797784 -0400
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
- 
- static void parse_config_file(char *map, size_t len)
- {
--	int *end = (int *) (map + len);
-+	unsigned int *end = (unsigned int *) (map + len);
- 	/* start at +1, so that p can never be < map */
--	int *m   = (int *) map + 1;
-+	unsigned int *m   = (unsigned int *) map + 1;
- 	char *p, *q;
- 
- 	for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
--	int *p = (int *)test;
-+	unsigned int *p = (unsigned int *)test;
- 
- 	if (*p != INT_CONF) {
- 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.32.11/scripts/kallsyms.c linux-2.6.32.11/scripts/kallsyms.c
---- linux-2.6.32.11/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/kallsyms.c	2010-04-04 20:46:41.728797784 -0400
-@@ -43,10 +43,10 @@ struct text_range {
- 
- static unsigned long long _text;
- static struct text_range text_ranges[] = {
--	{ "_stext",     "_etext"     },
--	{ "_sinittext", "_einittext" },
--	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
--	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
-+	{ "_stext",     "_etext",     0, 0 },
-+	{ "_sinittext", "_einittext", 0, 0 },
-+	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
-+	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
- };
- #define text_range_text     (&text_ranges[0])
- #define text_range_inittext (&text_ranges[1])
-diff -urNp linux-2.6.32.11/scripts/mod/file2alias.c linux-2.6.32.11/scripts/mod/file2alias.c
---- linux-2.6.32.11/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/mod/file2alias.c	2010-04-04 20:46:41.728797784 -0400
-@@ -72,7 +72,7 @@ static void device_id_check(const char *
- 			    unsigned long size, unsigned long id_size,
- 			    void *symval)
- {
--	int i;
-+	unsigned int i;
- 
- 	if (size % id_size || size < id_size) {
- 		if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
--			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- 			 unsigned char range_lo, unsigned char range_hi,
- 			 struct module *mod)
- {
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
- 	for (i = 0; i < count; i++) {
- 		const char *id = (char *)devs[i].id;
- 		char acpi_id[sizeof(devs[0].id)];
--		int j;
-+		unsigned int j;
- 
- 		buf_printf(&mod->dev_table_buf,
- 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
- 
- 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
- 			const char *id = (char *)card->devs[j].id;
--			int i2, j2;
-+			unsigned int i2, j2;
- 			int dup = 0;
- 
- 			if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
- 			/* add an individual alias for every device entry */
- 			if (!dup) {
- 				char acpi_id[sizeof(card->devs[0].id)];
--				int k;
-+				unsigned int k;
- 
- 				buf_printf(&mod->dev_table_buf,
- 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- 			char *alias)
- {
--	int i, j;
-+	unsigned int i, j;
- 
- 	sprintf(alias, "dmi*");
- 
-diff -urNp linux-2.6.32.11/scripts/mod/modpost.c linux-2.6.32.11/scripts/mod/modpost.c
---- linux-2.6.32.11/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/mod/modpost.c	2010-04-04 20:46:41.728797784 -0400
-@@ -835,6 +835,7 @@ enum mismatch {
- 	INIT_TO_EXIT,
- 	EXIT_TO_INIT,
- 	EXPORT_TO_INIT_EXIT,
-+	DATA_TO_TEXT
- };
- 
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
- 	.fromsec = { "__ksymtab*", NULL },
- 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- 	.mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+	.fromsec = { DATA_SECTIONS, NULL },
-+	.tosec   = { TEXT_SECTIONS, NULL },
-+	.mismatch = DATA_TO_TEXT
- }
- };
- 
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
- 			continue;
- 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- 			continue;
--		if (sym->st_value == addr)
--			return sym;
- 		/* Find a symbol nearby - addr are maybe negative */
- 		d = sym->st_value - addr;
-+		if (d == 0)
-+			return sym;
- 		if (d < 0)
- 			d = addr - sym->st_value;
- 		if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
- 		"Fix this by removing the %sannotation of %s "
- 		"or drop the export.\n",
- 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+	case DATA_TO_TEXT:
-+/*
-+		fprintf(stderr,
-+		"The variable %s references\n"
-+		"the %s %s%s%s\n",
-+		fromsym, to, sec2annotation(tosec), tosym, to_p);
-+*/
-+		break;
- 	case NO_MISMATCH:
- 		/* To get warnings on missing members */
- 		break;
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
- 	va_end(ap);
- }
- 
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- 	if (buf->size - buf->pos < len) {
- 		buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
- 	if (fstat(fileno(file), &st) < 0)
- 		goto close_write;
- 
--	if (st.st_size != b->pos)
-+	if (st.st_size != (off_t)b->pos)
- 		goto close_write;
- 
- 	tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.32.11/scripts/mod/modpost.h linux-2.6.32.11/scripts/mod/modpost.h
---- linux-2.6.32.11/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/mod/modpost.h	2010-04-04 20:46:41.728797784 -0400
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
- 
- struct buffer {
- 	char *p;
--	int pos;
--	int size;
-+	unsigned int pos;
-+	unsigned int size;
- };
- 
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
- 
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
- 
- struct module {
- 	struct module *next;
-diff -urNp linux-2.6.32.11/scripts/mod/sumversion.c linux-2.6.32.11/scripts/mod/sumversion.c
---- linux-2.6.32.11/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/mod/sumversion.c	2010-04-04 20:46:41.728797784 -0400
-@@ -455,7 +455,7 @@ static void write_version(const char *fi
- 		goto out;
- 	}
- 
--	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- 		warn("writing sum in %s failed: %s\n",
- 			filename, strerror(errno));
- 		goto out;
-diff -urNp linux-2.6.32.11/scripts/pnmtologo.c linux-2.6.32.11/scripts/pnmtologo.c
---- linux-2.6.32.11/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/scripts/pnmtologo.c	2010-04-04 20:46:41.728797784 -0400
-@@ -237,14 +237,14 @@ static void write_header(void)
-     fprintf(out, " *  Linux logo %s\n", logoname);
-     fputs(" */\n\n", out);
-     fputs("#include <linux/linux_logo.h>\n\n", out);
--    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_data[] = {\n",
- 	    logoname);
- }
- 
- static void write_footer(void)
- {
-     fputs("\n};\n\n", out);
--    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+    fprintf(out, "const struct linux_logo %s = {\n", logoname);
-     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
-     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
-     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
-     fputs("\n};\n\n", out);
- 
-     /* write logo clut */
--    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_clut[] = {\n",
- 	    logoname);
-     write_hex_cnt = 0;
-     for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.32.11/security/commoncap.c linux-2.6.32.11/security/commoncap.c
---- linux-2.6.32.11/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/commoncap.c	2010-04-04 20:46:41.728797784 -0400
-@@ -27,7 +27,7 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
--
-+#include <net/sock.h>
- /*
-  * If a non-root user executes a setuid-root binary in
-  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
-@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
- 	}
- }
- 
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
--	NETLINK_CB(skb).eff_cap = current_cap();
-+	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.11/security/integrity/ima/ima_api.c linux-2.6.32.11/security/integrity/ima/ima_api.c
---- linux-2.6.32.11/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/integrity/ima/ima_api.c	2010-04-04 20:46:41.728797784 -0400
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
- 	int result;
- 
- 	/* can overflow, only indicator */
--	atomic_long_inc(&ima_htable.violations);
-+	atomic_long_inc_unchecked(&ima_htable.violations);
- 
- 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- 	if (!entry) {
-diff -urNp linux-2.6.32.11/security/integrity/ima/ima_fs.c linux-2.6.32.11/security/integrity/ima/ima_fs.c
---- linux-2.6.32.11/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/integrity/ima/ima_fs.c	2010-04-04 20:46:41.728797784 -0400
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
--				     loff_t *ppos, atomic_long_t *val)
-+				     loff_t *ppos, atomic_long_unchecked_t *val)
- {
- 	char tmpbuf[TMPBUFLEN];
- 	ssize_t len;
- 
--	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
- 
-diff -urNp linux-2.6.32.11/security/integrity/ima/ima.h linux-2.6.32.11/security/integrity/ima/ima.h
---- linux-2.6.32.11/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/integrity/ima/ima.h	2010-04-04 20:46:41.728797784 -0400
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
- extern spinlock_t ima_queue_lock;
- 
- struct ima_h_table {
--	atomic_long_t len;	/* number of stored measurements in the list */
--	atomic_long_t violations;
-+	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
-+	atomic_long_unchecked_t violations;
- 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.32.11/security/integrity/ima/ima_queue.c linux-2.6.32.11/security/integrity/ima/ima_queue.c
---- linux-2.6.32.11/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/integrity/ima/ima_queue.c	2010-04-04 20:46:41.728797784 -0400
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
- 	INIT_LIST_HEAD(&qe->later);
- 	list_add_tail_rcu(&qe->later, &ima_measurements);
- 
--	atomic_long_inc(&ima_htable.len);
-+	atomic_long_inc_unchecked(&ima_htable.len);
- 	key = ima_hash_key(entry->digest);
- 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- 	return 0;
-diff -urNp linux-2.6.32.11/security/Kconfig linux-2.6.32.11/security/Kconfig
---- linux-2.6.32.11/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/security/Kconfig	2010-04-04 21:03:05.108480196 -0400
-@@ -4,6 +4,499 @@
- 
- menu "Security options"
- 
-+source grsecurity/Kconfig
-+
-+menu "PaX"
-+
-+config PAX
-+	bool "Enable various PaX features"
-+	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
-+	help
-+	  This allows you to enable various PaX features.  PaX adds
-+	  intrusion prevention mechanisms to the kernel that reduce
-+	  the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+	depends on PAX
-+
-+config PAX_SOFTMODE
-+	bool 'Support soft mode'
-+	select PAX_PT_PAX_FLAGS
-+	help
-+	  Enabling this option will allow you to run PaX in soft mode, that
-+	  is, PaX features will not be enforced by default, only on executables
-+	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
-+	  is the only way to mark executables for soft mode use.
-+
-+	  Soft mode can be activated by using the "pax_softmode=1" kernel command
-+	  line option on boot.  Furthermore you can control various PaX features
-+	  at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+	bool 'Use legacy ELF header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'chpax' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  an otherwise reserved part of the ELF header.  This marking has
-+	  numerous drawbacks (no support for soft-mode, toolchain does not
-+	  know about the non-standard use of the ELF header) therefore it
-+	  has been deprecated in favour of PT_PAX_FLAGS support.
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable this option otherwise they
-+	  will not get any protection.
-+
-+	  Note that if you enable PT_PAX_FLAGS marking support as well,
-+	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
-+
-+config PAX_PT_PAX_FLAGS
-+	bool 'Use ELF program header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'paxctl' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
-+	  has the benefits of supporting both soft mode and being fully
-+	  integrated into the toolchain (the binutils patch is available
-+	  from http://pax.grsecurity.net).
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable the EI_PAX marking support
-+	  otherwise they will not get any protection.
-+
-+	  Note that if you enable the legacy EI_PAX marking support as well,
-+	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+choice
-+	prompt 'MAC system integration'
-+	default PAX_HAVE_ACL_FLAGS
-+	help
-+	  Mandatory Access Control systems have the option of controlling
-+	  PaX flags on a per executable basis, choose the method supported
-+	  by your particular system.
-+
-+	  - "none": if your MAC system does not interact with PaX,
-+	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+	  NOTE: this option is for developers/integrators only.
-+
-+	config PAX_NO_ACL_FLAGS
-+		bool 'none'
-+
-+	config PAX_HAVE_ACL_FLAGS
-+		bool 'direct'
-+
-+	config PAX_HOOK_ACL_FLAGS
-+		bool 'hook'
-+endchoice
-+
-+	config PAX_PER_CPU_PGD
-+	bool
-+
-+	config TASK_SIZE_MAX_SHIFT
-+	int
-+	depends on X86_64
-+	default 47 if !PAX_PER_CPU_PGD
-+	default 42 if PAX_PER_CPU_PGD
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+	depends on PAX
-+
-+config PAX_NOEXEC
-+	bool "Enforce non-executable pages"
-+	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
-+	help
-+	  By design some architectures do not allow for protecting memory
-+	  pages against execution or even if they do, Linux does not make
-+	  use of this feature.  In practice this means that if a page is
-+	  readable (such as the stack or heap) it is also executable.
-+
-+	  There is a well known exploit technique that makes use of this
-+	  fact and a common programming mistake where an attacker can
-+	  introduce code of his choice somewhere in the attacked program's
-+	  memory (typically the stack or the heap) and then execute it.
-+
-+	  If the attacked program was running with different (typically
-+	  higher) privileges than that of the attacker, then he can elevate
-+	  his own privilege level (e.g. get a root shell, write to files for
-+	  which he does not have write access to, etc).
-+
-+	  Enabling this option will let you choose from various features
-+	  that prevent the injection and execution of 'foreign' code in
-+	  a program.
-+
-+	  This will also break programs that rely on the old behaviour and
-+	  expect that dynamically allocated memory via the malloc() family
-+	  of functions is executable (which it is not).  Notable examples
-+	  are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+	bool "Paging based non-executable pages"
-+	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+	select S390_SWITCH_AMODE if S390
-+	select S390_EXEC_PROTECT if S390
-+	help
-+	  This implementation is based on the paging feature of the CPU.
-+	  On i386 without hardware non-executable bit support there is a
-+	  variable but usually low performance impact, however on Intel's
-+	  P4 core based CPUs it is very high so you should not enable this
-+	  for kernels meant to be used on such CPUs.
-+
-+	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+	  with hardware non-executable bit support there is no performance
-+	  impact, on ppc the impact is negligible.
-+
-+	  Note that several architectures require various emulations due to
-+	  badly designed userland ABIs, this will cause a performance impact
-+	  but will disappear as soon as userland is fixed. For example, ppc
-+	  userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+	bool "Segmentation based non-executable pages"
-+	depends on PAX_NOEXEC && X86_32
-+	help
-+	  This implementation is based on the segmentation feature of the
-+	  CPU and has a very small performance impact, however applications
-+	  will be limited to a 1.5 GB address space instead of the normal
-+	  3 GB.
-+
-+config PAX_EMUTRAMP
-+	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+	default y if PARISC
-+	help
-+	  There are some programs and libraries that for one reason or
-+	  another attempt to execute special small code snippets from
-+	  non-executable memory pages.  Most notable examples are the
-+	  signal handler return code generated by the kernel itself and
-+	  the GCC trampolines.
-+
-+	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+	  such programs will no longer work under your kernel.
-+
-+	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+	  utilities to enable trampoline emulation for the affected programs
-+	  yet still have the protection provided by the non-executable pages.
-+
-+	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+	  your system will not even boot.
-+
-+	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+	  for the affected files.
-+
-+	  NOTE: enabling this feature *may* open up a loophole in the
-+	  protection provided by non-executable pages that an attacker
-+	  could abuse.  Therefore the best solution is to not have any
-+	  files on your system that would require this option.  This can
-+	  be achieved by not using libc5 (which relies on the kernel
-+	  signal handler return code) and not using or rewriting programs
-+	  that make use of the nested function implementation of GCC.
-+	  Skilled users can just fix GCC itself so that it implements
-+	  nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+	bool "Automatically emulate sigreturn trampolines"
-+	depends on PAX_EMUTRAMP && PARISC
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate signal return trampolines executing on the stack
-+	  that would otherwise lead to task termination.
-+
-+	  This solution is intended as a temporary one for users with
-+	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+	  Modula-3 runtime, etc) or executables linked to such, basically
-+	  everything that does not specify its own SA_RESTORER function in
-+	  normal executable memory like glibc 2.1+ does.
-+
-+	  On parisc you MUST enable this option, otherwise your system will
-+	  not even boot.
-+
-+	  NOTE: this feature cannot be disabled on a per executable basis
-+	  and since it *does* open up a loophole in the protection provided
-+	  by non-executable pages, the best solution is to not have any
-+	  files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+	bool "Restrict mprotect()"
-+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+	help
-+	  Enabling this option will prevent programs from
-+	   - changing the executable status of memory pages that were
-+	     not originally created as executable,
-+	   - making read-only executable pages writable again,
-+	   - creating executable pages from anonymous memory.
-+
-+	  You should say Y here to complete the protection provided by
-+	  the enforcement of non-executable pages.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_NOELFRELOCS
-+	bool "Disallow ELF text relocations"
-+	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
-+	help
-+	  Non-executable pages and mprotect() restrictions are effective
-+	  in preventing the introduction of new executable code into an
-+	  attacked task's address space.  There remain only two venues
-+	  for this kind of attack: if the attacker can execute already
-+	  existing code in the attacked task then he can either have it
-+	  create and mmap() a file containing his code or have it mmap()
-+	  an already existing ELF library that does not have position
-+	  independent code in it and use mprotect() on it to make it
-+	  writable and copy his code there.  While protecting against
-+	  the former approach is beyond PaX, the latter can be prevented
-+	  by having only PIC ELF libraries on one's system (which do not
-+	  need to relocate their code).  If you are sure this is your case,
-+	  then enable this option otherwise be careful as you may not even
-+	  be able to boot or log on your system (for example, some PAM
-+	  modules are erroneously compiled as non-PIC by default).
-+
-+	  NOTE: if you are using dynamic ELF executables (as suggested
-+	  when using ASLR) then you must have made sure that you linked
-+	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
-+	  referenced there has already been updated to support this).
-+
-+config PAX_ETEXECRELOCS
-+	bool "Allow ELF ET_EXEC text relocations"
-+	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+	default y
-+	help
-+	  On some architectures there are incorrectly created applications
-+	  that require text relocations and would not work without enabling
-+	  this option.  If you are an alpha, ia64 or parisc user, you should
-+	  enable this option and disable it once you have made sure that
-+	  none of your applications need it.
-+
-+config PAX_EMUPLT
-+	bool "Automatically emulate ELF PLT"
-+	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate the Procedure Linkage Table entries in ELF files.
-+	  On some architectures such entries are in writable memory, and
-+	  become non-executable leading to task termination.  Therefore
-+	  it is mandatory that you enable this option on alpha, parisc,
-+	  sparc and sparc64, otherwise your system would not even boot.
-+
-+	  NOTE: this feature *does* open up a loophole in the protection
-+	  provided by the non-executable pages, therefore the proper
-+	  solution is to modify the toolchain to produce a PLT that does
-+	  not need to be writable.
-+
-+config PAX_DLRESOLVE
-+	bool 'Emulate old glibc resolver stub'
-+	depends on PAX_EMUPLT && SPARC
-+	default n
-+	help
-+	  This option is needed if userland has an old glibc (before 2.4)
-+	  that puts a 'save' instruction into the runtime generated resolver
-+	  stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+	bool "Enforce non-executable kernel pages"
-+	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
-+	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+	help
-+	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+	  that is, enabling this option will make it harder to inject
-+	  and execute 'foreign' code in kernel memory itself.
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+	int "Minimum amount of memory reserved for module code"
-+	default "4"
-+	depends on PAX_KERNEXEC && X86_32 && MODULES
-+	help
-+	  Due to implementation details the kernel must reserve a fixed
-+	  amount of memory for module code at compile time that cannot be
-+	  changed at runtime.  Here you can specify the minimum amount
-+	  in MB that will be reserved.  Due to the same implementation
-+	  details this size will always be rounded up to the next 2/4 MB
-+	  boundary (depends on PAE) so the actually available memory for
-+	  module code will usually be more than this minimum.
-+
-+	  The default 4 MB should be enough for most users but if you have
-+	  an excessive number of modules (e.g., most distribution configs
-+	  compile many drivers as modules) or use huge modules such as
-+	  nvidia's kernel driver, you will need to adjust this amount.
-+	  A good rule of thumb is to look at your currently loaded kernel
-+	  modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+	depends on PAX
-+
-+config PAX_ASLR
-+	bool "Address Space Layout Randomization"
-+	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
-+	help
-+	  Many if not most exploit techniques rely on the knowledge of
-+	  certain addresses in the attacked program.  The following options
-+	  will allow the kernel to apply a certain amount of randomization
-+	  to specific parts of the program thereby forcing an attacker to
-+	  guess them in most cases.  Any failed guess will most likely crash
-+	  the attacked program which allows the kernel to detect such attempts
-+	  and react on them.  PaX itself provides no reaction mechanisms,
-+	  instead it is strongly encouraged that you make use of Nergal's
-+	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+	  (http://www.grsecurity.net/) built-in crash detection features or
-+	  develop one yourself.
-+
-+	  By saying Y here you can choose to randomize the following areas:
-+	   - top of the task's kernel stack
-+	   - top of the task's userland stack
-+	   - base address for mmap() requests that do not specify one
-+	     (this includes all libraries)
-+	   - base address of the main executable
-+
-+	  It is strongly recommended to say Y here as address space layout
-+	  randomization has negligible impact on performance yet it provides
-+	  a very effective protection.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+	bool "Randomize kernel stack base"
-+	depends on PAX_ASLR && X86_TSC && X86_32
-+	help
-+	  By saying Y here the kernel will randomize every task's kernel
-+	  stack on every system call.  This will not only force an attacker
-+	  to guess it but also prevent him from making use of possible
-+	  leaked information about it.
-+
-+	  Since the kernel stack is a rather scarce resource, randomization
-+	  may cause unexpected stack overflows, therefore you should very
-+	  carefully test your system.  Note that once enabled in the kernel
-+	  configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+	bool "Randomize user stack base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will randomize every task's userland
-+	  stack.  The randomization is done in two steps where the second
-+	  one may apply a big amount of shift to the top of the stack and
-+	  cause problems for programs that want to use lots of memory (more
-+	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+	  For this reason the second step can be controlled by 'chpax' or
-+	  'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+	bool "Randomize mmap() base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will use a randomized base address for
-+	  mmap() requests that do not specify one themselves.  As a result
-+	  all dynamically loaded libraries will appear at random addresses
-+	  and therefore be harder to exploit by a technique where an attacker
-+	  attempts to execute library code for his purposes (e.g. spawn a
-+	  shell from an exploited program that is running at an elevated
-+	  privilege level).
-+
-+	  Furthermore, if a program is relinked as a dynamic ELF file, its
-+	  base address will be randomized as well, completing the full
-+	  randomization of the address space layout.  Attacking such programs
-+	  becomes a guess game.  You can find an example of doing this at
-+	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+	  feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+	bool "Sanitize all freed memory"
-+	help
-+	  By saying Y here the kernel will erase memory pages as soon as they
-+	  are freed.  This in turn reduces the lifetime of data stored in the
-+	  pages, making it less likely that sensitive information such as
-+	  passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+	  This is especially useful for programs whose runtime is short, long
-+	  lived processes and the kernel itself benefit from this as long as
-+	  they operate on whole memory pages and ensure timely freeing of pages
-+	  that may hold sensitive information.
-+
-+	  The tradeoff is performance impact, on a single CPU system kernel
-+	  compilation sees a 3% slowdown, other systems and workloads may vary
-+	  and you are advised to test this feature on your expected workload
-+	  before deploying it.
-+
-+	  Note that this feature does not protect data stored in live pages,
-+	  e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_UDEREF
-+	bool "Prevent invalid userland pointer dereference"
-+	depends on X86 && !UML_X86 && !XEN
-+	select PAX_PER_CPU_PGD if X86_64
-+	help
-+	  By saying Y here the kernel will be prevented from dereferencing
-+	  userland pointers in contexts where the kernel expects only kernel
-+	  pointers.  This is both a useful runtime debugging feature and a
-+	  security measure that prevents exploiting a class of kernel bugs.
-+
-+	  The tradeoff is that some virtualization solutions may experience
-+	  a huge slowdown and therefore you should not enable this feature
-+	  for kernels meant to run in such environments.  Whether a given VM
-+	  solution is affected or not is best determined by simply trying it
-+	  out, the performance impact will be obvious right on boot as this
-+	  mechanism engages from very early on.  A good rule of thumb is that
-+	  VMs running on CPUs without hardware virtualization support (i.e.,
-+	  the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+	bool "Prevent various kernel object reference counter overflows"
-+	depends on GRKERNSEC && (X86 || SPARC64)
-+	help
-+	  By saying Y here the kernel will detect and prevent overflowing
-+	  various (but not all) kinds of object reference counters.  Such
-+	  overflows can normally occur due to bugs only and are often, if
-+	  not always, exploitable.
-+
-+	  The tradeoff is that data structures protected by an overflowed
-+	  refcount will never be freed and therefore will leak memory.  Note
-+	  that this leak also happens even without this protection but in
-+	  that case the overflow can eventually trigger the freeing of the
-+	  data structure while it is still being used elsewhere, resulting
-+	  in the exploitable situation that this feature prevents.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+
-+config PAX_USERCOPY
-+	bool "Bounds check heap object copies between kernel and userland"
-+	depends on X86 || PPC || SPARC
-+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+	help
-+	  By saying Y here the kernel will enforce the size of heap objects
-+	  when they are copied in either direction between the kernel and
-+	  userland, even if only a part of the heap object is copied.
-+
-+	  Specifically, this checking prevents information leaking from the
-+	  kernel heap during kernel to userland copies (if the kernel heap
-+	  object is otherwise fully initialized) and prevents kernel heap
-+	  overflows during userland to kernel copies.
-+
-+	  Note that the current implementation provides the strictest checks
-+	  for the SLUB allocator.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+endmenu
-+
-+endmenu
-+
- config KEYS
- 	bool "Enable access key retention support"
- 	help
-@@ -146,7 +639,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- 	int "Low address space for LSM to protect from user allocation"
- 	depends on SECURITY && SECURITY_SELINUX
--	default 65536
-+	default 32768
- 	help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.11/security/min_addr.c linux-2.6.32.11/security/min_addr.c
---- linux-2.6.32.11/security/min_addr.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.11/security/min_addr.c	2010-04-04 20:46:41.732880788 -0400
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
-  */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- 		mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- 	mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
- 
- /*
-diff -urNp linux-2.6.32.11/sound/aoa/codecs/onyx.c linux-2.6.32.11/sound/aoa/codecs/onyx.c
---- linux-2.6.32.11/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/aoa/codecs/onyx.c	2010-04-04 20:46:41.732880788 -0400
-@@ -53,7 +53,7 @@ struct onyx {
- 				spdif_locked:1,
- 				analog_locked:1,
- 				original_mute:2;
--	int			open_count;
-+	atomic_t		open_count;
- 	struct codec_info	*codec_info;
- 
- 	/* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count++;
-+	atomic_inc(&onyx->open_count);
- 	mutex_unlock(&onyx->mutex);
- 
- 	return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count--;
--	if (!onyx->open_count)
-+	if (atomic_dec_and_test(&onyx->open_count))
- 		onyx->spdif_locked = onyx->analog_locked = 0;
- 	mutex_unlock(&onyx->mutex);
- 
-diff -urNp linux-2.6.32.11/sound/core/oss/pcm_oss.c linux-2.6.32.11/sound/core/oss/pcm_oss.c
---- linux-2.6.32.11/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/core/oss/pcm_oss.c	2010-04-04 20:46:41.732880788 -0400
-@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
- 	}
- }
- #else /* !CONFIG_SND_VERBOSE_PROCFS */
--#define snd_pcm_oss_proc_init(pcm)
--#define snd_pcm_oss_proc_done(pcm)
-+#define snd_pcm_oss_proc_init(pcm) do {} while (0)
-+#define snd_pcm_oss_proc_done(pcm) do {} while (0)
- #endif /* CONFIG_SND_VERBOSE_PROCFS */
- 
- /*
-diff -urNp linux-2.6.32.11/sound/core/seq/seq_lock.h linux-2.6.32.11/sound/core/seq/seq_lock.h
---- linux-2.6.32.11/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/core/seq/seq_lock.h	2010-04-04 20:46:41.732880788 -0400
-@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
- #else /* SMP || CONFIG_SND_DEBUG */
- 
- typedef spinlock_t snd_use_lock_t;	/* dummy */
--#define snd_use_lock_init(lockp) /**/
--#define snd_use_lock_use(lockp) /**/
--#define snd_use_lock_free(lockp) /**/
--#define snd_use_lock_sync(lockp) /**/
-+#define snd_use_lock_init(lockp) do {} while (0)
-+#define snd_use_lock_use(lockp) do {} while (0)
-+#define snd_use_lock_free(lockp) do {} while (0)
-+#define snd_use_lock_sync(lockp) do {} while (0)
- 
- #endif /* SMP || CONFIG_SND_DEBUG */
- 
-diff -urNp linux-2.6.32.11/sound/drivers/mts64.c linux-2.6.32.11/sound/drivers/mts64.c
---- linux-2.6.32.11/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/drivers/mts64.c	2010-04-04 20:46:41.732880788 -0400
-@@ -65,7 +65,7 @@ struct mts64 {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int current_midi_output_port;
- 	int current_midi_input_port;
- 	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
- {
- 	struct mts64 *mts = substream->rmidi->private_data;
- 
--	if (mts->open_count == 0) {
-+	if (atomic_read(&mts->open_count) == 0) {
- 		/* We don't need a spinlock here, because this is just called 
- 		   if the device has not been opened before. 
- 		   So there aren't any IRQs from the device */
-@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
- 
- 		msleep(50);
- 	}
--	++(mts->open_count);
-+	atomic_inc(&mts->open_count);
- 
- 	return 0;
- }
-@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
- 	struct mts64 *mts = substream->rmidi->private_data;
- 	unsigned long flags;
- 
--	--(mts->open_count);
--	if (mts->open_count == 0) {
-+	if (atomic_dec_return(&mts->open_count) == 0) {
- 		/* We need the spinlock_irqsave here because we can still
- 		   have IRQs at this point */
- 		spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
- 
- 		msleep(500);
- 
--	} else if (mts->open_count < 0)
--		mts->open_count = 0;
-+	} else if (atomic_read(&mts->open_count) < 0)
-+		atomic_set(&mts->open_count, 0);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.11/sound/drivers/portman2x4.c linux-2.6.32.11/sound/drivers/portman2x4.c
---- linux-2.6.32.11/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/drivers/portman2x4.c	2010-04-04 20:46:41.732880788 -0400
-@@ -83,7 +83,7 @@ struct portman {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int mode[PORTMAN_NUM_INPUT_PORTS];
- 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff -urNp linux-2.6.32.11/sound/oss/sb_audio.c linux-2.6.32.11/sound/oss/sb_audio.c
---- linux-2.6.32.11/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/oss/sb_audio.c	2010-04-04 20:46:41.732880788 -0400
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- 		buf16 = (signed short *)(localbuf + localoffs);
- 		while (c)
- 		{
--			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- 			if (copy_from_user(lbuf8,
- 					   userbuf+useroffs + p,
- 					   locallen))
-diff -urNp linux-2.6.32.11/sound/pci/ac97/ac97_codec.c linux-2.6.32.11/sound/pci/ac97/ac97_codec.c
---- linux-2.6.32.11/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/pci/ac97/ac97_codec.c	2010-04-04 20:46:41.732880788 -0400
-@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
- }
- 
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
- 
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff -urNp linux-2.6.32.11/sound/pci/ac97/ac97_patch.c linux-2.6.32.11/sound/pci/ac97/ac97_patch.c
---- linux-2.6.32.11/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.11/sound/pci/ac97/ac97_patch.c	2010-04-04 20:46:41.732880788 -0400
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- 	.build_specific = patch_wolfson_wm9703_specific,
- };
- 
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- 	.build_specific = patch_wolfson_wm9704_specific,
- };
- 
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- 	.build_specific = patch_wolfson_wm9705_specific,
- };
- 
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- 	.build_specific = patch_wolfson_wm9711_specific,
- };
- 
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
- }
- #endif
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- 	.build_specific = patch_wolfson_wm9713_specific,
- 	.build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM	
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
- 	return patch_sigmatel_stac97xx_specific(ac97);
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- 	.build_3d	= patch_sigmatel_stac9708_3d,
- 	.build_specific	= patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- 	.build_spdif = patch_cirrus_build_spdif
- };
- 
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- 	.build_spdif = patch_conexant_build_spdif
- };
- 
-@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
- 	{ AC97_VIDEO, 0x9f1f },
- 	{ AC97_AUX, 0x9f1f },
- 	{ AC97_PCM, 0x9f1f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_ad1819(struct snd_ac97 * ac97)
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
- 	}
- }
- 
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- 	.build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- 	.build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
- 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
- 
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- 	.build_specific	= patch_alc650_specific,
- 	.update_jacks = alc650_update_jacks
- };
-@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- 	.build_specific	= patch_alc655_specific,
- 	.update_jacks = alc655_update_jacks
- };
-@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- 	.build_specific	= patch_alc850_specific,
- 	.update_jacks = alc850_update_jacks
- };
-@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- 	.build_specific	= patch_cm9738_specific,
- 	.update_jacks = cm9738_update_jacks
- };
-@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
- 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
- 
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- 	.build_specific	= patch_cm9739_specific,
- 	.build_post_spdif = patch_cm9739_post_spdif,
- 	.update_jacks = cm9739_update_jacks
-@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- 	.build_specific	= patch_cm9761_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif,
- 	.update_jacks = cm9761_update_jacks
-@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
- 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- 	.build_specific	= patch_cm9780_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
- };
-@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- 	.build_specific	= patch_vt1616_specific
- };
- 
-@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- 	.build_specific	= patch_it2646_specific,
- 	.update_jacks = it2646_update_jacks
- };
-@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- 	.build_specific	= patch_si3036_specific,
- };
- 
-@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
- 	{ AC97_AUX, 0x1f1f },
- 	{ AC97_PCM, 0x1f1f },
- 	{ AC97_REC_GAIN, 0x0f0f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_lm4550(struct snd_ac97 *ac97)
-@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- 	.build_specific	= patch_ucb1400_specific,
- };
- 
-diff -urNp linux-2.6.32.11/sound/pci/ens1370.c linux-2.6.32.11/sound/pci/ens1370.c
---- linux-2.6.32.11/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/pci/ens1370.c	2010-04-04 20:46:41.732880788 -0400
-@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
- 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
- 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
-diff -urNp linux-2.6.32.11/sound/pci/intel8x0.c linux-2.6.32.11/sound/pci/intel8x0.c
---- linux-2.6.32.11/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/pci/intel8x0.c	2010-04-04 20:46:41.732880788 -0400
-@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
-@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
- 		.type = AC97_TUNE_HP_ONLY
- 	},
- #endif
--	{ } /* terminator */
-+	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
- };
- 
- static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
-diff -urNp linux-2.6.32.11/sound/pci/intel8x0m.c linux-2.6.32.11/sound/pci/intel8x0m.c
---- linux-2.6.32.11/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/sound/pci/intel8x0m.c	2010-04-04 20:46:41.737788480 -0400
-@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- 	{ 0x5455, "ALi M5455" },
- 	{ 0x746d, "AMD AMD8111" },
- #endif
--	{ 0 },
-+	{ 0, NULL },
- };
- 
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.32.11/usr/gen_init_cpio.c linux-2.6.32.11/usr/gen_init_cpio.c
---- linux-2.6.32.11/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/usr/gen_init_cpio.c	2010-04-04 20:46:41.737788480 -0400
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
- 	int retval;
- 	int rc = -1;
- 	int namesize;
--	int i;
-+	unsigned int i;
- 
- 	mode |= S_IFREG;
- 
-@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
-                        *env_var = *expanded = '\0';
-                        strncat(env_var, start + 2, end - start - 2);
-                        strncat(expanded, new_location, start - new_location);
--                       strncat(expanded, getenv(env_var), PATH_MAX);
--                       strncat(expanded, end + 1, PATH_MAX);
-+                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
-                        strncpy(new_location, expanded, PATH_MAX);
-+                       new_location[PATH_MAX] = 0;
-                } else
-                        break;
-        }
-diff -urNp linux-2.6.32.11/virt/kvm/kvm_main.c linux-2.6.32.11/virt/kvm/kvm_main.c
---- linux-2.6.32.11/virt/kvm/kvm_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.11/virt/kvm/kvm_main.c	2010-04-04 20:46:41.737788480 -0400
-@@ -1745,6 +1745,7 @@ static int kvm_vcpu_release(struct inode
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vcpu_fops = {
- 	.release        = kvm_vcpu_release,
- 	.unlocked_ioctl = kvm_vcpu_ioctl,
-@@ -2341,6 +2342,7 @@ static int kvm_vm_mmap(struct file *file
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vm_fops = {
- 	.release        = kvm_vm_release,
- 	.unlocked_ioctl = kvm_vm_ioctl,
-@@ -2428,6 +2430,7 @@ out:
- 	return r;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_chardev_ops = {
- 	.unlocked_ioctl = kvm_dev_ioctl,
- 	.compat_ioctl   = kvm_dev_ioctl,
-@@ -2437,6 +2440,9 @@ static struct miscdevice kvm_dev = {
- 	KVM_MINOR,
- 	"kvm",
- 	&kvm_chardev_ops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static void hardware_enable(void *junk)
-@@ -2711,7 +2717,7 @@ static void kvm_sched_out(struct preempt
- 	kvm_arch_vcpu_put(vcpu);
- }
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module)
- {
- 	int r;
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch
new file mode 100644
index 00000000..e491c258
--- /dev/null
+++ b/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch
@@ -0,0 +1,55920 @@
+diff -urNp linux-2.6.32.12/arch/alpha/include/asm/elf.h linux-2.6.32.12/arch/alpha/include/asm/elf.h
+--- linux-2.6.32.12/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/alpha/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
+@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ 
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
++#endif
++
+ /* $0 is set by ld.so to a pointer to a function which might be 
+    registered using atexit.  This provides a mean for the dynamic
+    linker to call DT_FINI functions for shared libraries that have
+diff -urNp linux-2.6.32.12/arch/alpha/include/asm/pgtable.h linux-2.6.32.12/arch/alpha/include/asm/pgtable.h
+--- linux-2.6.32.12/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/alpha/include/asm/pgtable.h	2010-04-04 20:46:41.472784147 -0400
+@@ -101,6 +101,17 @@ struct vm_area_struct;
+ #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
+ #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
+ #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
+ 
+ #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
+diff -urNp linux-2.6.32.12/arch/alpha/kernel/module.c linux-2.6.32.12/arch/alpha/kernel/module.c
+--- linux-2.6.32.12/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/alpha/kernel/module.c	2010-04-04 20:46:41.472784147 -0400
+@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
+ 
+ 	/* The small sections were sorted to the end of the segment.
+ 	   The following should definitely cover them.  */
+-	gp = (u64)me->module_core + me->core_size - 0x8000;
++	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
+ 	got = sechdrs[me->arch.gotsecindex].sh_addr;
+ 
+ 	for (i = 0; i < n; i++) {
+diff -urNp linux-2.6.32.12/arch/alpha/kernel/osf_sys.c linux-2.6.32.12/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.32.12/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/alpha/kernel/osf_sys.c	2010-04-04 20:46:41.472784147 -0400
+@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
+ 	   merely specific addresses, but regions of memory -- perhaps
+ 	   this feature should be incorporated into all ports?  */
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
+ 		if (addr != (unsigned long) -ENOMEM)
+@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
+ 	}
+ 
+ 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
+-	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
+-					 len, limit);
++	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
++
+ 	if (addr != (unsigned long) -ENOMEM)
+ 		return addr;
+ 
+diff -urNp linux-2.6.32.12/arch/alpha/mm/fault.c linux-2.6.32.12/arch/alpha/mm/fault.c
+--- linux-2.6.32.12/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/alpha/mm/fault.c	2010-04-04 20:46:41.472784147 -0400
+@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
+ 	__reload_thread(pcb);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int ldah, ldq, jmp;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
++		    jmp == 0x6BFB0000U)
++		{
++			unsigned long r27, addr;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
++
++			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			err = get_user(r27, (unsigned long *)addr);
++			if (err)
++				break;
++
++			regs->r27 = r27;
++			regs->pc = r27;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #2 */
++		unsigned int ldah, lda, br;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(lda, (unsigned int *)(regs->pc+4));
++		err |= get_user(br, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
++		    (br & 0xFFE00000U) == 0xC3E00000U)
++		{
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
++
++			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int br;
++
++		err = get_user(br, (unsigned int *)regs->pc);
++
++		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
++			unsigned int br2, ldq, nop, jmp;
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
++
++			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			err = get_user(br2, (unsigned int *)addr);
++			err |= get_user(ldq, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			err |= get_user(jmp, (unsigned int *)(addr+12));
++			err |= get_user(resolver, (unsigned long *)(addr+16));
++
++			if (err)
++				break;
++
++			if (br2 == 0xC3600000U &&
++			    ldq == 0xA77B000CU &&
++			    nop == 0x47FF041FU &&
++			    jmp == 0x6B7B0000U)
++			{
++				regs->r28 = regs->pc+4;
++				regs->r27 = addr+16;
++				regs->pc = resolver;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
+ 
+ /*
+  * This routine handles page faults.  It determines the address,
+@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
+  good_area:
+ 	si_code = SEGV_ACCERR;
+ 	if (cause < 0) {
+-		if (!(vma->vm_flags & VM_EXEC))
++		if (!(vma->vm_flags & VM_EXEC)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
++			do_group_exit(SIGKILL);
++#else
+ 			goto bad_area;
++#endif
++
++		}
+ 	} else if (!cause) {
+ 		/* Allow reads even for write-only mappings */
+ 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
+diff -urNp linux-2.6.32.12/arch/arm/include/asm/elf.h linux-2.6.32.12/arch/arm/include/asm/elf.h
+--- linux-2.6.32.12/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
+@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00008000UL
++
++#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#endif
+ 
+ /* When the program starts, a1 contains a pointer to a function to be 
+    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
+diff -urNp linux-2.6.32.12/arch/arm/include/asm/kmap_types.h linux-2.6.32.12/arch/arm/include/asm/kmap_types.h
+--- linux-2.6.32.12/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/include/asm/kmap_types.h	2010-04-04 20:46:41.472784147 -0400
+@@ -19,6 +19,7 @@ enum km_type {
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
+ 	KM_L2_CACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/arm/include/asm/uaccess.h linux-2.6.32.12/arch/arm/include/asm/uaccess.h
+--- linux-2.6.32.12/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/include/asm/uaccess.h	2010-04-04 20:46:41.472784147 -0400
+@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
+ 
+ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else /* security hole - plug it */
+@@ -412,6 +415,9 @@ static inline unsigned long __must_check
+ 
+ static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+diff -urNp linux-2.6.32.12/arch/arm/kernel/kgdb.c linux-2.6.32.12/arch/arm/kernel/kgdb.c
+--- linux-2.6.32.12/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/kernel/kgdb.c	2010-04-04 20:46:41.472784147 -0400
+@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
+  * and we handle the normal undef case within the do_undefinstr
+  * handler.
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ #ifndef __ARMEB__
+ 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
+ #else /* ! __ARMEB__ */
+diff -urNp linux-2.6.32.12/arch/arm/mach-at91/pm.c linux-2.6.32.12/arch/arm/mach-at91/pm.c
+--- linux-2.6.32.12/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-at91/pm.c	2010-04-04 20:46:41.472784147 -0400
+@@ -348,7 +348,7 @@ static void at91_pm_end(void)
+ }
+ 
+ 
+-static struct platform_suspend_ops at91_pm_ops ={
++static const struct platform_suspend_ops at91_pm_ops ={
+ 	.valid	= at91_pm_valid_state,
+ 	.begin	= at91_pm_begin,
+ 	.enter	= at91_pm_enter,
+diff -urNp linux-2.6.32.12/arch/arm/mach-omap1/pm.c linux-2.6.32.12/arch/arm/mach-omap1/pm.c
+--- linux-2.6.32.12/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-omap1/pm.c	2010-04-04 20:46:41.472784147 -0400
+@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
+ 
+ 
+ 
+-static struct platform_suspend_ops omap_pm_ops ={
++static const struct platform_suspend_ops omap_pm_ops ={
+ 	.prepare	= omap_pm_prepare,
+ 	.enter		= omap_pm_enter,
+ 	.finish		= omap_pm_finish,
+diff -urNp linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c
+--- linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c	2010-04-04 20:46:41.472784147 -0400
+@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
+ 	enable_hlt();
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.prepare	= omap2_pm_prepare,
+ 	.enter		= omap2_pm_enter,
+ 	.finish		= omap2_pm_finish,
+diff -urNp linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c
+--- linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c	2010-04-04 20:46:41.472784147 -0400
+@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
+ 	return;
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.begin		= omap3_pm_begin,
+ 	.end		= omap3_pm_end,
+ 	.prepare	= omap3_pm_prepare,
+diff -urNp linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c
+--- linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
+ 	       (state == PM_SUSPEND_MEM);
+ }
+ 
+-static struct platform_suspend_ops pnx4008_pm_ops = {
++static const struct platform_suspend_ops pnx4008_pm_ops = {
+ 	.enter = pnx4008_pm_enter,
+ 	.valid = pnx4008_pm_valid,
+ };
+diff -urNp linux-2.6.32.12/arch/arm/mach-pxa/pm.c linux-2.6.32.12/arch/arm/mach-pxa/pm.c
+--- linux-2.6.32.12/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-pxa/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
+ 		pxa_cpu_pm_fns->finish();
+ }
+ 
+-static struct platform_suspend_ops pxa_pm_ops = {
++static const struct platform_suspend_ops pxa_pm_ops = {
+ 	.valid		= pxa_pm_valid,
+ 	.enter		= pxa_pm_enter,
+ 	.prepare	= pxa_pm_prepare,
+diff -urNp linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c
+--- linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
+ }
+ 
+ #ifdef CONFIG_PM
+-static struct platform_suspend_ops sharpsl_pm_ops = {
++static const struct platform_suspend_ops sharpsl_pm_ops = {
+ 	.prepare	= pxa_pm_prepare,
+ 	.finish		= pxa_pm_finish,
+ 	.enter		= corgi_pxa_pm_enter,
+diff -urNp linux-2.6.32.12/arch/arm/mach-sa1100/pm.c linux-2.6.32.12/arch/arm/mach-sa1100/pm.c
+--- linux-2.6.32.12/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mach-sa1100/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
+ 	return virt_to_phys(sp);
+ }
+ 
+-static struct platform_suspend_ops sa11x0_pm_ops = {
++static const struct platform_suspend_ops sa11x0_pm_ops = {
+ 	.enter		= sa11x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.12/arch/arm/mm/fault.c linux-2.6.32.12/arch/arm/mm/fault.c
+--- linux-2.6.32.12/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
+@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
+ 	}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (fsr & FSR_LNX_PF) {
++		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	tsk->thread.address = addr;
+ 	tsk->thread.error_code = fsr;
+ 	tsk->thread.trap_no = 14;
+@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
+ }
+ #endif					/* CONFIG_MMU */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-4: ");
++	for (i = -1; i < 20; i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08lx ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * First Level Translation Fault Handler
+  *
+diff -urNp linux-2.6.32.12/arch/arm/mm/mmap.c linux-2.6.32.12/arch/arm/mm/mmap.c
+--- linux-2.6.32.12/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/mm/mmap.c	2010-04-04 20:46:41.476773136 -0400
+@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (len > TASK_SIZE)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -94,8 +98,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+diff -urNp linux-2.6.32.12/arch/arm/plat-s3c/pm.c linux-2.6.32.12/arch/arm/plat-s3c/pm.c
+--- linux-2.6.32.12/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/arm/plat-s3c/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
+ 	s3c_pm_check_cleanup();
+ }
+ 
+-static struct platform_suspend_ops s3c_pm_ops = {
++static const struct platform_suspend_ops s3c_pm_ops = {
+ 	.enter		= s3c_pm_enter,
+ 	.prepare	= s3c_pm_prepare,
+ 	.finish		= s3c_pm_finish,
+diff -urNp linux-2.6.32.12/arch/avr32/include/asm/elf.h linux-2.6.32.12/arch/avr32/include/asm/elf.h
+--- linux-2.6.32.12/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/avr32/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
+@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00001000UL
++
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+diff -urNp linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h
+--- linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
+@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
+ D(11)	KM_IRQ1,
+ D(12)	KM_SOFTIRQ0,
+ D(13)	KM_SOFTIRQ1,
+-D(14)	KM_TYPE_NR
++D(14)	KM_CLEARPAGE,
++D(15)	KM_TYPE_NR
+ };
+ 
+ #undef D
+diff -urNp linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c
+--- linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -176,7 +176,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops avr32_pm_ops = {
++static const struct platform_suspend_ops avr32_pm_ops = {
+ 	.valid	= avr32_pm_valid_state,
+ 	.enter	= avr32_pm_enter,
+ };
+diff -urNp linux-2.6.32.12/arch/avr32/mm/fault.c linux-2.6.32.12/arch/avr32/mm/fault.c
+--- linux-2.6.32.12/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/avr32/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
+@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
+ 
+ int exception_trace = 1;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (unsigned char *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults. It determines the address and the
+  * problem, and then passes it off to one of the appropriate routines.
+@@ -157,6 +174,16 @@ bad_area:
+ 	up_read(&mm->mmap_sem);
+ 
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
++				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		if (exception_trace && printk_ratelimit())
+ 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
+ 			       "sp %08lx ecr %lu\n",
+diff -urNp linux-2.6.32.12/arch/blackfin/kernel/kgdb.c linux-2.6.32.12/arch/blackfin/kernel/kgdb.c
+--- linux-2.6.32.12/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/blackfin/kernel/kgdb.c	2010-04-04 20:46:41.476773136 -0400
+@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;		/* this means that we do not want to exit from the handler */
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0xa1},
+ #ifdef CONFIG_SMP
+ 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
+diff -urNp linux-2.6.32.12/arch/blackfin/mach-common/pm.c linux-2.6.32.12/arch/blackfin/mach-common/pm.c
+--- linux-2.6.32.12/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/blackfin/mach-common/pm.c	2010-04-04 20:46:41.476773136 -0400
+@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
+ 	return 0;
+ }
+ 
+-struct platform_suspend_ops bfin_pm_ops = {
++const struct platform_suspend_ops bfin_pm_ops = {
+ 	.enter = bfin_pm_enter,
+ 	.valid	= bfin_pm_valid,
+ };
+diff -urNp linux-2.6.32.12/arch/frv/include/asm/kmap_types.h linux-2.6.32.12/arch/frv/include/asm/kmap_types.h
+--- linux-2.6.32.12/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/frv/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c
+--- linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c	2010-04-04 20:46:41.476773136 -0400
+@@ -17,7 +17,7 @@
+ #include <linux/swiotlb.h>
+ #include <asm/machvec.h>
+ 
+-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
++extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
+ 
+ /* swiotlb declarations & definitions: */
+ extern int swiotlb_late_init_with_default_size (size_t size);
+@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
+ 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
+ }
+ 
+-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
++const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
+ {
+ 	if (use_swiotlb(dev))
+ 		return &swiotlb_dma_ops;
+diff -urNp linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c
+--- linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c	2010-04-04 20:46:41.476773136 -0400
+@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
+ 	},
+ };
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static int __init
+ sba_init(void)
+@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
+ 
+ __setup("sbapagesize=",sba_page_override);
+ 
+-struct dma_map_ops sba_dma_ops = {
++const struct dma_map_ops sba_dma_ops = {
+ 	.alloc_coherent		= sba_alloc_coherent,
+ 	.free_coherent		= sba_free_coherent,
+ 	.map_page		= sba_map_page,
+diff -urNp linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c
+--- linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c	2010-04-04 20:46:41.476773136 -0400
+@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
+ 
+ #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ /* Ugly but avoids duplication */
+ #include "../../../fs/binfmt_elf.c"
+ 
+diff -urNp linux-2.6.32.12/arch/ia64/ia32/ia32priv.h linux-2.6.32.12/arch/ia64/ia32/ia32priv.h
+--- linux-2.6.32.12/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/ia32/ia32priv.h	2010-04-04 20:46:41.476773136 -0400
+@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
+ #define ELF_DATA	ELFDATA2LSB
+ #define ELF_ARCH	EM_386
+ 
+-#define IA32_STACK_TOP		IA32_PAGE_OFFSET
++#ifdef CONFIG_PAX_RANDUSTACK
++#define __IA32_DELTA_STACK	(current->mm->delta_stack)
++#else
++#define __IA32_DELTA_STACK	0UL
++#endif
++
++#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
++
+ #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
+ #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
+ 
+diff -urNp linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h
+--- linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h	2010-04-04 20:46:41.476773136 -0400
+@@ -12,7 +12,7 @@
+ 
+ #define ARCH_HAS_DMA_GET_REQUIRED_MASK
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ extern struct ia64_machine_vector ia64_mv;
+ extern void set_iommu_machvec(void);
+ 
+@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *daddr, gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	void *caddr;
+ 
+ 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
+@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *caddr, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	debug_dma_free_coherent(dev, size, caddr, daddr);
+ 	ops->free_coherent(dev, size, caddr, daddr);
+ }
+@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->mapping_error(dev, daddr);
+ }
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->dma_supported(dev, mask);
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/ia64/include/asm/elf.h linux-2.6.32.12/arch/ia64/include/asm/elf.h
+--- linux-2.6.32.12/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
+@@ -43,6 +43,13 @@
+  */
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ #define PT_IA_64_UNWIND		0x70000001
+ 
+ /* IA-64 relocations: */
+diff -urNp linux-2.6.32.12/arch/ia64/include/asm/machvec.h linux-2.6.32.12/arch/ia64/include/asm/machvec.h
+--- linux-2.6.32.12/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/include/asm/machvec.h	2010-04-04 20:46:41.476773136 -0400
+@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
+ /* DMA-mapping interface: */
+ typedef void ia64_mv_dma_init (void);
+ typedef u64 ia64_mv_dma_get_required_mask (struct device *);
+-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
++typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
+ 
+ /*
+  * WARNING: The legacy I/O space is _architected_.  Platforms are
+@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
+ # endif /* CONFIG_IA64_GENERIC */
+ 
+ extern void swiotlb_dma_init(void);
+-extern struct dma_map_ops *dma_get_ops(struct device *);
++extern const struct dma_map_ops *dma_get_ops(struct device *);
+ 
+ /*
+  * Define default versions so we can extend machvec for new platforms without having
+diff -urNp linux-2.6.32.12/arch/ia64/include/asm/pgtable.h linux-2.6.32.12/arch/ia64/include/asm/pgtable.h
+--- linux-2.6.32.12/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
+@@ -143,6 +143,17 @@
+ #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
++# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++#endif
++
+ #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
+ #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
+ #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
+diff -urNp linux-2.6.32.12/arch/ia64/include/asm/uaccess.h linux-2.6.32.12/arch/ia64/include/asm/uaccess.h
+--- linux-2.6.32.12/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/include/asm/uaccess.h	2010-04-04 20:46:41.480470677 -0400
+@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
+ 	const void *__cu_from = (from);							\
+ 	long __cu_len = (n);								\
+ 											\
+-	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
++	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
+ 	long __cu_len = (n);								\
+ 											\
+ 	__chk_user_ptr(__cu_from);							\
+-	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
++	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c
+--- linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c	2010-04-04 20:46:41.480470677 -0400
+@@ -3,7 +3,7 @@
+ /* Set this to 1 if there is a HW IOMMU in the system */
+ int iommu_detected __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
+@@ -16,7 +16,7 @@ static int __init dma_init(void)
+ }
+ fs_initcall(dma_init);
+ 
+-struct dma_map_ops *dma_get_ops(struct device *dev)
++const struct dma_map_ops *dma_get_ops(struct device *dev)
+ {
+ 	return dma_ops;
+ }
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/module.c linux-2.6.32.12/arch/ia64/kernel/module.c
+--- linux-2.6.32.12/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
+@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
+ void
+ module_free (struct module *mod, void *module_region)
+ {
+-	if (mod && mod->arch.init_unw_table &&
+-	    module_region == mod->module_init) {
++	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
+ 		unw_remove_unwind_table(mod->arch.init_unw_table);
+ 		mod->arch.init_unw_table = NULL;
+ 	}
+@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
+ }
+ 
+ static inline int
++in_init_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
++}
++
++static inline int
++in_init_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
++}
++
++static inline int
+ in_init (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_init < mod->init_size;
++	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
++}
++
++static inline int
++in_core_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
++}
++
++static inline int
++in_core_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
+ }
+ 
+ static inline int
+ in_core (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_core < mod->core_size;
++	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
+ }
+ 
+ static inline int
+@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
+ 		break;
+ 
+ 	      case RV_BDREL:
+-		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
++		if (in_init_rx(mod, val))
++			val -= (uint64_t) mod->module_init_rx;
++		else if (in_init_rw(mod, val))
++			val -= (uint64_t) mod->module_init_rw;
++		else if (in_core_rx(mod, val))
++			val -= (uint64_t) mod->module_core_rx;
++		else if (in_core_rw(mod, val))
++			val -= (uint64_t) mod->module_core_rw;
+ 		break;
+ 
+ 	      case RV_LTV:
+@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
+ 		 *     addresses have been selected...
+ 		 */
+ 		uint64_t gp;
+-		if (mod->core_size > MAX_LTOFF)
++		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
+ 			/*
+ 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
+ 			 * at the end of the module.
+ 			 */
+-			gp = mod->core_size - MAX_LTOFF / 2;
++			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
+ 		else
+-			gp = mod->core_size / 2;
+-		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
++			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
++		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
+ 		mod->arch.gp = gp;
+ 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
+ 	}
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/pci-dma.c linux-2.6.32.12/arch/ia64/kernel/pci-dma.c
+--- linux-2.6.32.12/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/pci-dma.c	2010-04-04 20:46:41.480470677 -0400
+@@ -43,7 +43,7 @@ struct device fallback_dev = {
+ 	.dma_mask = &fallback_dev.coherent_dma_mask,
+ };
+ 
+-extern struct dma_map_ops intel_dma_ops;
++extern const struct dma_map_ops intel_dma_ops;
+ 
+ static int __init pci_iommu_init(void)
+ {
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c
+--- linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c	2010-04-04 20:46:41.480470677 -0400
+@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
+ 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
+ }
+ 
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+ 	.map_page = swiotlb_map_page,
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c
+--- linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c	2010-04-04 20:46:41.480470677 -0400
+@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
+ 	if (REGION_NUMBER(addr) == RGN_HPAGE)
+ 		addr = 0;
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		addr = mm->free_area_cache;
++	else
++#endif
++
+ 	if (!addr)
+ 		addr = mm->free_area_cache;
+ 
+@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+ 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
++			if (start_addr != mm->mmap_base) {
+ 				/* Start a new search --- just in case we missed some holes.  */
+-				addr = TASK_UNMAPPED_BASE;
++				addr = mm->mmap_base;
+ 				goto full_search;
+ 			}
+ 			return -ENOMEM;
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/topology.c linux-2.6.32.12/arch/ia64/kernel/topology.c
+--- linux-2.6.32.12/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/topology.c	2010-04-04 20:46:41.480470677 -0400
+@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cache_sysfs_ops = {
++static const struct sysfs_ops cache_sysfs_ops = {
+ 	.show   = cache_show
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S
+--- linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S	2010-04-04 20:46:41.480470677 -0400
+@@ -190,7 +190,7 @@ SECTIONS
+   /* Per-cpu data: */
+   . = ALIGN(PERCPU_PAGE_SIZE);
+   PERCPU_VADDR(PERCPU_ADDR, :percpu)
+-  __phys_per_cpu_start = __per_cpu_load;
++  __phys_per_cpu_start = per_cpu_load;
+   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
+   						 * into percpu page size
+ 						 */
+diff -urNp linux-2.6.32.12/arch/ia64/mm/fault.c linux-2.6.32.12/arch/ia64/mm/fault.c
+--- linux-2.6.32.12/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
+@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
+ 	return pte_present(pte);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ void __kprobes
+ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
+ {
+@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
+ 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
+ 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
+ 
+-	if ((vma->vm_flags & mask) != mask)
++	if ((vma->vm_flags & mask) != mask) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
+ 
++	}
++
+   survive:
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.12/arch/ia64/mm/init.c linux-2.6.32.12/arch/ia64/mm/init.c
+--- linux-2.6.32.12/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/mm/init.c	2010-04-04 20:46:41.480470677 -0400
+@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
+ 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
+ 		vma->vm_end = vma->vm_start + PAGE_SIZE;
+ 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
++			vma->vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++			if (current->mm->pax_flags & MF_PAX_MPROTECT)
++				vma->vm_flags &= ~VM_MAYEXEC;
++#endif
++
++		}
++#endif
++
+ 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 		down_write(&current->mm->mmap_sem);
+ 		if (insert_vm_struct(current->mm, vma)) {
+diff -urNp linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c
+--- linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c	2010-04-04 20:46:41.480470677 -0400
+@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
+ 	return ret;
+ }
+ 
+-static struct dma_map_ops sn_dma_ops = {
++static const struct dma_map_ops sn_dma_ops = {
+ 	.alloc_coherent		= sn_dma_alloc_coherent,
+ 	.free_coherent		= sn_dma_free_coherent,
+ 	.map_page		= sn_dma_map_page,
+diff -urNp linux-2.6.32.12/arch/m32r/lib/usercopy.c linux-2.6.32.12/arch/m32r/lib/usercopy.c
+--- linux-2.6.32.12/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/m32r/lib/usercopy.c	2010-04-04 20:46:41.480470677 -0400
+@@ -14,6 +14,9 @@
+ unsigned long
+ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetch(from);
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		__copy_user(to,from,n);
+@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
+ unsigned long
+ __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetchw(to);
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		__copy_user_zeroing(to,from,n);
+diff -urNp linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c
+--- linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c	2010-04-04 20:46:41.480470677 -0400
+@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
+ 
+ }
+ 
+-static struct platform_suspend_ops db1x_pm_ops = {
++static const struct platform_suspend_ops db1x_pm_ops = {
+ 	.valid		= suspend_valid_only_mem,
+ 	.begin		= db1x_pm_begin,
+ 	.enter		= db1x_pm_enter,
+diff -urNp linux-2.6.32.12/arch/mips/include/asm/elf.h linux-2.6.32.12/arch/mips/include/asm/elf.h
+--- linux-2.6.32.12/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
+@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
+ #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
+ #endif
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #endif /* _ASM_ELF_H */
+diff -urNp linux-2.6.32.12/arch/mips/include/asm/page.h linux-2.6.32.12/arch/mips/include/asm/page.h
+--- linux-2.6.32.12/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/include/asm/page.h	2010-04-04 20:46:41.480470677 -0400
+@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
+   #ifdef CONFIG_CPU_MIPS32
+     typedef struct { unsigned long pte_low, pte_high; } pte_t;
+     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
+-    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
++    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
+   #else
+      typedef struct { unsigned long long pte; } pte_t;
+      #define pte_val(x)	((x).pte)
+diff -urNp linux-2.6.32.12/arch/mips/include/asm/system.h linux-2.6.32.12/arch/mips/include/asm/system.h
+--- linux-2.6.32.12/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/include/asm/system.h	2010-04-04 20:46:41.480470677 -0400
+@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
+  */
+ #define __ARCH_WANT_UNLOCKED_CTXSW
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ALMASK)
+ 
+ #endif /* _ASM_SYSTEM_H */
+diff -urNp linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c
+--- linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c	2010-04-04 20:46:41.480470677 -0400
+@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ #include <linux/module.h>
+ #include <linux/elfcore.h>
+diff -urNp linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c
+--- linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c	2010-04-04 20:46:41.480470677 -0400
+@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/mips/kernel/kgdb.c linux-2.6.32.12/arch/mips/kernel/kgdb.c
+--- linux-2.6.32.12/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/kernel/kgdb.c	2010-04-04 20:46:41.480470677 -0400
+@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;
+ }
+ 
++/* cannot be const */
+ struct kgdb_arch arch_kgdb_ops;
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/mips/kernel/process.c linux-2.6.32.12/arch/mips/kernel/process.c
+--- linux-2.6.32.12/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/kernel/process.c	2010-04-04 20:46:41.480470677 -0400
+@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
+ out:
+ 	return pc;
+ }
+-
+-/*
+- * Don't forget that the stack pointer must be aligned on a 8 bytes
+- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
+- */
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() & ~PAGE_MASK;
+-
+-	return sp & ALMASK;
+-}
+diff -urNp linux-2.6.32.12/arch/mips/kernel/syscall.c linux-2.6.32.12/arch/mips/kernel/syscall.c
+--- linux-2.6.32.12/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/kernel/syscall.c	2010-04-04 20:46:41.480470677 -0400
+@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
+ 	do_color_align = 0;
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
+ 		    (!vmm || addr + len <= vmm->vm_start))
+ 			return addr;
+ 	}
+-	addr = TASK_UNMAPPED_BASE;
++	addr = current->mm->mmap_base;
+ 	if (do_color_align)
+ 		addr = COLOUR_ALIGN(addr, pgoff);
+ 	else
+diff -urNp linux-2.6.32.12/arch/mips/mm/fault.c linux-2.6.32.12/arch/mips/mm/fault.c
+--- linux-2.6.32.12/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/mips/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
+@@ -26,6 +26,23 @@
+ #include <asm/ptrace.h>
+ #include <asm/highmem.h>		/* For VMALLOC_END */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults.  It determines the address,
+  * and the problem, and then passes it off to one of the appropriate
+diff -urNp linux-2.6.32.12/arch/parisc/include/asm/elf.h linux-2.6.32.12/arch/parisc/include/asm/elf.h
+--- linux-2.6.32.12/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
+@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+    but it's not easy, and we've already done it here.  */
+diff -urNp linux-2.6.32.12/arch/parisc/include/asm/pgtable.h linux-2.6.32.12/arch/parisc/include/asm/pgtable.h
+--- linux-2.6.32.12/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
+@@ -207,6 +207,17 @@
+ #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
+ #define PAGE_COPY       PAGE_EXECREAD
+ #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
+ #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
+ #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
+diff -urNp linux-2.6.32.12/arch/parisc/kernel/module.c linux-2.6.32.12/arch/parisc/kernel/module.c
+--- linux-2.6.32.12/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
+@@ -95,16 +95,38 @@
+ 
+ /* three functions to determine where in the module core
+  * or init pieces the location is */
++static inline int in_init_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rx &&
++		loc < (me->module_init_rx + me->init_size_rx));
++}
++
++static inline int in_init_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rw &&
++		loc < (me->module_init_rw + me->init_size_rw));
++}
++
+ static inline int in_init(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_init &&
+-		loc <= (me->module_init + me->init_size));
++	return in_init_rx(me, loc) || in_init_rw(me, loc);
++}
++
++static inline int in_core_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rx &&
++		loc < (me->module_core_rx + me->core_size_rx));
++}
++
++static inline int in_core_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rw &&
++		loc < (me->module_core_rw + me->core_size_rw));
+ }
+ 
+ static inline int in_core(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_core &&
+-		loc <= (me->module_core + me->core_size));
++	return in_core_rx(me, loc) || in_core_rw(me, loc);
+ }
+ 
+ static inline int in_local(struct module *me, void *loc)
+@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
+ 	}
+ 
+ 	/* align things a bit */
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += gots * sizeof(struct got_entry);
+-
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.fdesc_offset = me->core_size;
+-	me->core_size += fdescs * sizeof(Elf_Fdesc);
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += gots * sizeof(struct got_entry);
++
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.fdesc_offset = me->core_size_rw;
++	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
+ 
+ 	me->arch.got_max = gots;
+ 	me->arch.fdesc_max = fdescs;
+@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
+ 
+ 	BUG_ON(value == 0);
+ 
+-	got = me->module_core + me->arch.got_offset;
++	got = me->module_core_rw + me->arch.got_offset;
+ 	for (i = 0; got[i].addr; i++)
+ 		if (got[i].addr == value)
+ 			goto out;
+@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
+ #ifdef CONFIG_64BIT
+ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
+ {
+-	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
++	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
+ 
+ 	if (!value) {
+ 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
+@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
+ 
+ 	/* Create new one */
+ 	fdesc->addr = value;
+-	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 	return (Elf_Addr)fdesc;
+ }
+ #endif /* CONFIG_64BIT */
+@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
+ 
+ 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
+ 	end = table + sechdrs[me->arch.unwind_section].sh_size;
+-	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 
+ 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
+ 	       me->arch.unwind_section, table, end, gp);
+diff -urNp linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c
+--- linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c	2010-04-04 20:46:41.480470677 -0400
+@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (filp) {
+ 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
+diff -urNp linux-2.6.32.12/arch/parisc/kernel/traps.c linux-2.6.32.12/arch/parisc/kernel/traps.c
+--- linux-2.6.32.12/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/kernel/traps.c	2010-04-04 20:46:41.480470677 -0400
+@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
+ 
+ 			down_read(&current->mm->mmap_sem);
+ 			vma = find_vma(current->mm,regs->iaoq[0]);
+-			if (vma && (regs->iaoq[0] >= vma->vm_start)
+-				&& (vma->vm_flags & VM_EXEC)) {
+-
++			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
+ 				fault_address = regs->iaoq[0];
+ 				fault_space = regs->iasq[0];
+ 
+diff -urNp linux-2.6.32.12/arch/parisc/mm/fault.c linux-2.6.32.12/arch/parisc/mm/fault.c
+--- linux-2.6.32.12/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/parisc/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
+@@ -15,6 +15,7 @@
+ #include <linux/sched.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
+ static unsigned long
+ parisc_acctyp(unsigned long code, unsigned int inst)
+ {
+-	if (code == 6 || code == 16)
++	if (code == 6 || code == 7 || code == 16)
+ 	    return VM_EXEC;
+ 
+ 	switch (inst & 0xf0000000) {
+@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
+ 			}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when rt_sigreturn trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int bl, depwi;
++
++		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
++
++		if (err)
++			break;
++
++		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
++			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
++
++			err = get_user(ldw, (unsigned int *)addr);
++			err |= get_user(bv, (unsigned int *)(addr+4));
++			err |= get_user(ldw2, (unsigned int *)(addr+8));
++
++			if (err)
++				break;
++
++			if (ldw == 0x0E801096U &&
++			    bv == 0xEAC0C000U &&
++			    ldw2 == 0x0E881095U)
++			{
++				unsigned int resolver, map;
++
++				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
++				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
++				if (err)
++					break;
++
++				regs->gr[20] = instruction_pointer(regs)+8;
++				regs->gr[21] = map;
++				regs->gr[22] = resolver;
++				regs->iaoq[0] = resolver | 3UL;
++				regs->iaoq[1] = regs->iaoq[0] + 4;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++
++#ifndef CONFIG_PAX_EMUSIGRT
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++#endif
++
++	do { /* PaX: rt_sigreturn emulation */
++		unsigned int ldi1, ldi2, bel, nop;
++
++		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
++		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
++		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
++
++		if (err)
++			break;
++
++		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
++		    ldi2 == 0x3414015AU &&
++		    bel == 0xE4008200U &&
++		    nop == 0x08000240U)
++		{
++			regs->gr[25] = (ldi1 & 2) >> 1;
++			regs->gr[20] = __NR_rt_sigreturn;
++			regs->gr[31] = regs->iaoq[1] + 16;
++			regs->sr[0] = regs->iasq[1];
++			regs->iaoq[0] = 0x100UL;
++			regs->iaoq[1] = regs->iaoq[0] + 4;
++			regs->iasq[0] = regs->sr[2];
++			regs->iasq[1] = regs->sr[2];
++			return 2;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fix;
+@@ -192,8 +303,33 @@ good_area:
+ 
+ 	acc_type = parisc_acctyp(code,regs->iir);
+ 
+-	if ((vma->vm_flags & acc_type) != acc_type)
++	if ((vma->vm_flags & acc_type) != acc_type) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
++		    (address & ~3UL) == instruction_pointer(regs))
++		{
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 3:
++				return;
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			case 2:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
++	}
+ 
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/device.h linux-2.6.32.12/arch/powerpc/include/asm/device.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/device.h	2010-04-04 20:46:41.485273950 -0400
+@@ -14,7 +14,7 @@ struct dev_archdata {
+ 	struct device_node	*of_node;
+ 
+ 	/* DMA operations on that device */
+-	struct dma_map_ops	*dma_ops;
++	const struct dma_map_ops	*dma_ops;
+ 
+ 	/*
+ 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h	2010-04-04 20:46:41.485273950 -0400
+@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
+ #ifdef CONFIG_PPC64
+ extern struct dma_map_ops dma_iommu_ops;
+ #endif
+-extern struct dma_map_ops dma_direct_ops;
++extern const struct dma_map_ops dma_direct_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ 	/* We don't handle the NULL dev case for ISA for now. We could
+ 	 * do it via an out of line call but it is not needed for now. The
+@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
+ 	return dev->archdata.dma_ops;
+ }
+ 
+-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
++static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
+ {
+ 	dev->archdata.dma_ops = ops;
+ }
+@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return 0;
+@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
+ 
+ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return -EIO;
+@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	BUG_ON(!dma_ops);
+@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!dma_ops);
+ 
+@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (dma_ops->mapping_error)
+ 		return dma_ops->mapping_error(dev, dma_addr);
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/elf.h linux-2.6.32.12/arch/powerpc/include/asm/elf.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/elf.h	2010-04-04 20:46:41.485273950 -0400
+@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-extern unsigned long randomize_et_dyn(unsigned long base);
+-#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
++#define ELF_ET_DYN_BASE		(0x20000000)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
++
++#ifdef __powerpc64__
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#else
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
++#endif
+ 
+ /*
+  * Our registers are always unsigned longs, whether we're a 32 bit
+@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
+ 	(0x7ff >> (PAGE_SHIFT - 12)) : \
+ 	(0x3ffff >> (PAGE_SHIFT - 12)))
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* __KERNEL__ */
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/iommu.h linux-2.6.32.12/arch/powerpc/include/asm/iommu.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/iommu.h	2010-04-04 20:46:41.485273950 -0400
+@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
+ extern void iommu_init_early_dart(void);
+ extern void iommu_init_early_pasemi(void);
+ 
++/* dma-iommu.c */
++extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
++
+ #ifdef CONFIG_PCI
+ extern void pci_iommu_init(void);
+ extern void pci_direct_iommu_init(void);
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h	2010-04-04 20:46:41.485273950 -0400
+@@ -26,6 +26,7 @@ enum km_type {
+ 	KM_SOFTIRQ1,
+ 	KM_PPC_SYNC_PAGE,
+ 	KM_PPC_SYNC_ICACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/page_64.h linux-2.6.32.12/arch/powerpc/include/asm/page_64.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/page_64.h	2010-04-04 20:46:41.485273950 -0400
+@@ -180,15 +180,18 @@ do {						\
+  * stack by default, so in the absense of a PT_GNU_STACK program header
+  * we turn execute permission off.
+  */
+-#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_STACK_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
++#ifndef CONFIG_PAX_PAGEEXEC
+ #define VM_STACK_DEFAULT_FLAGS \
+ 	(test_thread_flag(TIF_32BIT) ? \
+ 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
++#endif
+ 
+ #include <asm-generic/getorder.h>
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/page.h linux-2.6.32.12/arch/powerpc/include/asm/page.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/page.h	2010-04-04 20:46:41.485273950 -0400
+@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
+  * and needs to be executable.  This means the whole heap ends
+  * up being executable.
+  */
+-#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_DATA_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
+ #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
+ #endif
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ #undef STRICT_MM_TYPECHECKS
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/pci.h linux-2.6.32.12/arch/powerpc/include/asm/pci.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/pci.h	2010-04-04 20:46:41.485273950 -0400
+@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
+ }
+ 
+ #ifdef CONFIG_PCI
+-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
+-extern struct dma_map_ops *get_pci_dma_ops(void);
++extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
++extern const struct dma_map_ops *get_pci_dma_ops(void);
+ #else	/* CONFIG_PCI */
+ #define set_pci_dma_ops(d)
+ #define get_pci_dma_ops()	NULL
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h	2010-04-04 20:46:41.485273950 -0400
+@@ -21,6 +21,7 @@
+ #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
+ #define _PAGE_USER	0x004	/* usermode access allowed */
+ #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
++#define _PAGE_EXEC	_PAGE_GUARDED
+ #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
+ #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
+ #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/reg.h linux-2.6.32.12/arch/powerpc/include/asm/reg.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/reg.h	2010-04-04 20:46:41.485273950 -0400
+@@ -191,6 +191,7 @@
+ #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
+ #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
+ #define   DSISR_NOHPTE		0x40000000	/* no translation found */
++#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
+ #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
+ #define   DSISR_ISSTORE		0x02000000	/* access was a store */
+ #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h	2010-04-04 20:46:41.485273950 -0400
+@@ -13,7 +13,7 @@
+ 
+ #include <linux/swiotlb.h>
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static inline void dma_mark_clean(void *addr, size_t size) {}
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h
+--- linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h	2010-04-04 20:46:41.485273950 -0400
+@@ -327,52 +327,6 @@ do {								\
+ extern unsigned long __copy_tofrom_user(void __user *to,
+ 		const void __user *from, unsigned long size);
+ 
+-#ifndef __powerpc64__
+-
+-static inline unsigned long copy_from_user(void *to,
+-		const void __user *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_tofrom_user((__force void __user *)to, from, n);
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + n - TASK_SIZE;
+-		return __copy_tofrom_user((__force void __user *)to, from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-static inline unsigned long copy_to_user(void __user *to,
+-		const void *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __copy_tofrom_user(to, (__force void __user *)from, n);
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, (__force void __user *)from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-#else /* __powerpc64__ */
+-
+-#define __copy_in_user(to, from, size) \
+-	__copy_tofrom_user((to), (from), (size))
+-
+-extern unsigned long copy_from_user(void *to, const void __user *from,
+-				    unsigned long n);
+-extern unsigned long copy_to_user(void __user *to, const void *from,
+-				  unsigned long n);
+-extern unsigned long copy_in_user(void __user *to, const void __user *from,
+-				  unsigned long n);
+-
+-#endif /* __powerpc64__ */
+-
+ static inline unsigned long __copy_from_user_inatomic(void *to,
+ 		const void __user *from, unsigned long n)
+ {
+@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
+ 	return __copy_tofrom_user((__force void __user *)to, from, n);
+ }
+ 
+@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
+ }
+ 
+@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
+ 	return __copy_to_user_inatomic(to, from, size);
+ }
+ 
++#ifndef __powerpc64__
++
++static inline unsigned long __must_check copy_from_user(void *to,
++		const void __user *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_READ, from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		return __copy_tofrom_user((__force void __user *)to, from, n);
++	}
++	if ((unsigned long)from < TASK_SIZE) {
++		over = (unsigned long)from + n - TASK_SIZE;
++		if (!__builtin_constant_p(n - over))
++			check_object_size(to, n - over, false);
++		return __copy_tofrom_user((__force void __user *)to, from,
++				n - over) + over;
++	}
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to,
++		const void *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_WRITE, to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		return __copy_tofrom_user(to, (__force void __user *)from, n);
++	}
++	if ((unsigned long)to < TASK_SIZE) {
++		over = (unsigned long)to + n - TASK_SIZE;
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n - over, true);
++		return __copy_tofrom_user(to, (__force void __user *)from,
++				n - over) + over;
++	}
++	return n;
++}
++
++#else /* __powerpc64__ */
++
++#define __copy_in_user(to, from, size) \
++	__copy_tofrom_user((to), (from), (size))
++
++static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		n = __copy_from_user(to, from, n);
++	else
++		memset(to, 0, n);
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (likely(access_ok(VERIFY_WRITE, to, n))) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		n = __copy_to_user(to, from, n);
++	}
++	return n;
++}
++
++extern unsigned long copy_in_user(void __user *to, const void __user *from,
++				  unsigned long n);
++
++#endif /* __powerpc64__ */
++
+ extern unsigned long __clear_user(void __user *addr, unsigned long size);
+ 
+ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c
+--- linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c	2010-04-04 20:46:41.485273950 -0400
+@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
+ 	&cache_assoc_attr,
+ };
+ 
+-static struct sysfs_ops cache_index_ops = {
++static const struct sysfs_ops cache_index_ops = {
+ 	.show = cache_index_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma.c linux-2.6.32.12/arch/powerpc/kernel/dma.c
+--- linux-2.6.32.12/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/dma.c	2010-04-04 20:46:41.485273950 -0400
+@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
+ }
+ #endif
+ 
+-struct dma_map_ops dma_direct_ops = {
++const struct dma_map_ops dma_direct_ops = {
+ 	.alloc_coherent	= dma_direct_alloc_coherent,
+ 	.free_coherent	= dma_direct_free_coherent,
+ 	.map_sg		= dma_direct_map_sg,
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c
+--- linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c	2010-04-04 20:46:41.485273950 -0400
+@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
+ }
+ 
+ /* We support DMA to/from any memory page via the iommu */
+-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
++int dma_iommu_dma_supported(struct device *dev, u64 mask)
+ {
+ 	struct iommu_table *tbl = get_iommu_table_base(dev);
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c
+--- linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c	2010-04-04 20:46:41.485273950 -0400
+@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
+  * map_page, and unmap_page on highmem, use normal dma_ops
+  * for everything else.
+  */
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = dma_direct_alloc_coherent,
+ 	.free_coherent = dma_direct_free_coherent,
+ 	.map_sg = swiotlb_map_sg_attrs,
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S
+--- linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S	2010-04-04 20:46:41.485273950 -0400
+@@ -455,6 +455,7 @@ storage_fault_common:
+ 	std	r14,_DAR(r1)
+ 	std	r15,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	mr	r4,r14
+ 	mr	r5,r15
+ 	ld	r14,PACA_EXGEN+EX_R14(r13)
+@@ -464,8 +465,7 @@ storage_fault_common:
+ 	cmpdi	r3,0
+ 	bne-	1f
+ 	b	.ret_from_except_lite
+-1:	bl	.save_nvgprs
+-	mr	r5,r3
++1:	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	ld	r4,_DAR(r1)
+ 	bl	.bad_page_fault
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S
+--- linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S	2010-04-04 20:46:41.485273950 -0400
+@@ -818,10 +818,10 @@ handle_page_fault:
+ 11:	ld	r4,_DAR(r1)
+ 	ld	r5,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	bl	.do_page_fault
+ 	cmpdi	r3,0
+ 	beq+	13f
+-	bl	.save_nvgprs
+ 	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	lwz	r4,_DAR(r1)
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c
+--- linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c	2010-04-04 20:46:41.485273950 -0400
+@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
+ 	return 1;
+ }
+ 
+-static struct dma_map_ops ibmebus_dma_ops = {
++static const struct dma_map_ops ibmebus_dma_ops = {
+ 	.alloc_coherent = ibmebus_alloc_coherent,
+ 	.free_coherent  = ibmebus_free_coherent,
+ 	.map_sg         = ibmebus_map_sg,
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/kgdb.c linux-2.6.32.12/arch/powerpc/kernel/kgdb.c
+--- linux-2.6.32.12/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/kgdb.c	2010-04-04 20:46:41.485273950 -0400
+@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
+ 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
+ 		return 0;
+ 
+-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+ 		regs->nip += 4;
+ 
+ 	return 1;
+@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
+ /*
+  * Global data
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/module_32.c linux-2.6.32.12/arch/powerpc/kernel/module_32.c
+--- linux-2.6.32.12/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/module_32.c	2010-04-04 20:46:41.485273950 -0400
+@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
+ 			me->arch.core_plt_section = i;
+ 	}
+ 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
+-		printk("Module doesn't contain .plt or .init.plt sections.\n");
++		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
+ 		return -ENOEXEC;
+ 	}
+ 
+@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
+ 
+ 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
+ 	/* Init, or core PLT? */
+-	if (location >= mod->module_core
+-	    && location < mod->module_core + mod->core_size)
++	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
++	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
+-	else
++	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
++		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
++	else {
++		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
++		return ~0UL;
++	}
+ 
+ 	/* Find this entry, or if that fails, the next avail. entry */
+ 	while (entry->jump[0]) {
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/module.c linux-2.6.32.12/arch/powerpc/kernel/module.c
+--- linux-2.6.32.12/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/module.c	2010-04-04 20:46:41.485273950 -0400
+@@ -31,11 +31,24 @@
+ 
+ LIST_HEAD(module_bug_list);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
+ void *module_alloc(unsigned long size)
+ {
+ 	if (size == 0)
+ 		return NULL;
+ 
++	return vmalloc(size);
++}
++
++void *module_alloc_exec(unsigned long size)
++#else
++void *module_alloc(unsigned long size)
++#endif
++
++{
++	if (size == 0)
++		return NULL;
++
+ 	return vmalloc_exec(size);
+ }
+ 
+@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++#endif
++
+ static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
+ 				    const Elf_Shdr *sechdrs,
+ 				    const char *name)
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/pci-common.c linux-2.6.32.12/arch/powerpc/kernel/pci-common.c
+--- linux-2.6.32.12/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/pci-common.c	2010-04-04 20:46:41.485273950 -0400
+@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
+ unsigned int ppc_pci_flags = 0;
+ 
+ 
+-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
++static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
+ 
+-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
++void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
+ {
+ 	pci_dma_ops = dma_ops;
+ }
+ 
+-struct dma_map_ops *get_pci_dma_ops(void)
++const struct dma_map_ops *get_pci_dma_ops(void)
+ {
+ 	return pci_dma_ops;
+ }
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/process.c linux-2.6.32.12/arch/powerpc/kernel/process.c
+--- linux-2.6.32.12/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/process.c	2010-04-04 20:46:41.485273950 -0400
+@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
+ 		sp -= get_random_int() & ~PAGE_MASK;
+ 	return sp & ~0xf;
+ }
+-
+-static inline unsigned long brk_rnd(void)
+-{
+-        unsigned long rnd = 0;
+-
+-	/* 8MB for 32bit, 1GB for 64bit */
+-	if (is_32bit_task())
+-		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+-	else
+-		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+-
+-	return rnd << PAGE_SHIFT;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long base = mm->brk;
+-	unsigned long ret;
+-
+-#ifdef CONFIG_PPC_STD_MMU_64
+-	/*
+-	 * If we are using 1TB segments and we are allowed to randomise
+-	 * the heap, we can put it above 1TB so it is backed by a 1TB
+-	 * segment. Otherwise the heap will be in the bottom 1TB
+-	 * which always uses 256MB segments and this may result in a
+-	 * performance penalty.
+-	 */
+-	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
+-		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
+-#endif
+-
+-	ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < mm->brk)
+-		return mm->brk;
+-
+-	return ret;
+-}
+-
+-unsigned long randomize_et_dyn(unsigned long base)
+-{
+-	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < base)
+-		return base;
+-
+-	return ret;
+-}
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/signal_32.c linux-2.6.32.12/arch/powerpc/kernel/signal_32.c
+--- linux-2.6.32.12/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/signal_32.c	2010-04-04 20:46:41.489273754 -0400
+@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
+ 	/* Save user registers on the stack */
+ 	frame = &rt_sf->uc.uc_mcontext;
+ 	addr = frame;
+-	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		if (save_user_regs(regs, frame, 0, 1))
+ 			goto badframe;
+ 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/signal_64.c linux-2.6.32.12/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.32.12/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/signal_64.c	2010-04-04 20:46:41.489273754 -0400
+@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
+ 	current->thread.fpscr.val = 0;
+ 
+ 	/* Set up to return from userspace. */
+-	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
+ 	} else {
+ 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c
+--- linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c	2010-04-04 20:46:41.489273754 -0400
+@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
+ 	if (oldlenp) {
+ 		if (!error) {
+ 			if (get_user(oldlen, oldlenp) ||
+-			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
++			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
++			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
+ 				error = -EFAULT;
+ 		}
+-		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
+ 	}
+ 	return error;
+ }
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/vdso.c linux-2.6.32.12/arch/powerpc/kernel/vdso.c
+--- linux-2.6.32.12/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/vdso.c	2010-04-04 20:46:41.489273754 -0400
+@@ -36,6 +36,7 @@
+ #include <asm/firmware.h>
+ #include <asm/vdso.h>
+ #include <asm/vdso_datapage.h>
++#include <asm/mman.h>
+ 
+ #include "setup.h"
+ 
+@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = VDSO32_MBASE;
+ #endif
+ 
+-	current->mm->context.vdso_base = 0;
++	current->mm->context.vdso_base = ~0UL;
+ 
+ 	/* vDSO has a problem and was disabled, just don't "enable" it for the
+ 	 * process
+@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = get_unmapped_area(NULL, vdso_base,
+ 				      (vdso_pages << PAGE_SHIFT) +
+ 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
+-				      0, 0);
++				      0, MAP_PRIVATE | MAP_EXECUTABLE);
+ 	if (IS_ERR_VALUE(vdso_base)) {
+ 		rc = vdso_base;
+ 		goto fail_mmapsem;
+diff -urNp linux-2.6.32.12/arch/powerpc/kernel/vio.c linux-2.6.32.12/arch/powerpc/kernel/vio.c
+--- linux-2.6.32.12/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/kernel/vio.c	2010-04-04 20:46:41.489273754 -0400
+@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
+ 	vio_cmo_dealloc(viodev, alloc_size);
+ }
+ 
+-struct dma_map_ops vio_dma_mapping_ops = {
++static const struct dma_map_ops vio_dma_mapping_ops = {
+ 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
+ 	.free_coherent  = vio_dma_iommu_free_coherent,
+ 	.map_sg         = vio_dma_iommu_map_sg,
+ 	.unmap_sg       = vio_dma_iommu_unmap_sg,
++	.dma_supported  = dma_iommu_dma_supported,
+ 	.map_page       = vio_dma_iommu_map_page,
+ 	.unmap_page     = vio_dma_iommu_unmap_page,
+ 
+@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
+ 
+ static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
+ {
+-	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
+ 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c
+--- linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c	2010-04-04 20:46:41.489273754 -0400
+@@ -9,22 +9,6 @@
+ #include <linux/module.h>
+ #include <asm/uaccess.h>
+ 
+-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_READ, from, n)))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
+-}
+-
+-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_WRITE, to, n)))
+-		n = __copy_to_user(to, from, n);
+-	return n;
+-}
+-
+ unsigned long copy_in_user(void __user *to, const void __user *from,
+ 			   unsigned long n)
+ {
+@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
+ 	return n;
+ }
+ 
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.12/arch/powerpc/mm/fault.c linux-2.6.32.12/arch/powerpc/mm/fault.c
+--- linux-2.6.32.12/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/mm/fault.c	2010-04-04 20:46:41.489273754 -0400
+@@ -30,6 +30,10 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/perf_event.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/firmware.h>
+ #include <asm/page.h>
+@@ -40,6 +44,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/tlbflush.h>
+ #include <asm/siginfo.h>
++#include <asm/ptrace.h>
+ 
+ 
+ #ifdef CONFIG_KPROBES
+@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
+ }
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->nip = fault address)
++ *
++ * returns 1 when task should be killed
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int __user *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * Check whether the instruction at regs->nip is a store using
+  * an update addressing form which will update r1.
+@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
+ 	 * indicate errors in DSISR but can validly be set in SRR1.
+ 	 */
+ 	if (trap == 0x400)
+-		error_code &= 0x48200000;
++		error_code &= 0x58200000;
+ 	else
+ 		is_write = error_code & DSISR_ISSTORE;
+ #else
+@@ -250,7 +282,7 @@ good_area:
+          * "undefined".  Of those that can be set, this is the only
+          * one which seems bad.
+          */
+-	if (error_code & 0x10000000)
++	if (error_code & DSISR_GUARDED)
+                 /* Guarded storage error. */
+ 		goto bad_area;
+ #endif /* CONFIG_8xx */
+@@ -265,7 +297,7 @@ good_area:
+ 		 * processors use the same I/D cache coherency mechanism
+ 		 * as embedded.
+ 		 */
+-		if (error_code & DSISR_PROTFAULT)
++		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
+ 			goto bad_area;
+ #endif /* CONFIG_PPC_STD_MMU */
+ 
+@@ -335,6 +367,23 @@ bad_area:
+ bad_area_nosemaphore:
+ 	/* User mode accesses cause a SIGSEGV */
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++#ifdef CONFIG_PPC_STD_MMU
++			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
++#else
++			if (is_exec && regs->nip == address) {
++#endif
++				switch (pax_handle_fetch_fault(regs)) {
++				}
++
++				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		_exception(SIGSEGV, regs, code, address);
+ 		return 0;
+ 	}
+diff -urNp linux-2.6.32.12/arch/powerpc/mm/mmap_64.c linux-2.6.32.12/arch/powerpc/mm/mmap_64.c
+--- linux-2.6.32.12/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/mm/mmap_64.c	2010-04-04 20:46:41.489273754 -0400
+@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.12/arch/powerpc/mm/slice.c linux-2.6.32.12/arch/powerpc/mm/slice.c
+--- linux-2.6.32.12/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/mm/slice.c	2010-04-04 20:46:41.489273754 -0400
+@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
+ 	if (fixed && addr > (mm->task_size - len))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
++		addr = 0;
++#endif
++
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+ 		addr = _ALIGN_UP(addr, 1ul << pshift);
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c
+--- linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-04-04 20:46:41.489273754 -0400
+@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
+ 	lite5200_pm_target_state = PM_SUSPEND_ON;
+ }
+ 
+-static struct platform_suspend_ops lite5200_pm_ops = {
++static const struct platform_suspend_ops lite5200_pm_ops = {
+ 	.valid		= lite5200_pm_valid,
+ 	.begin		= lite5200_pm_begin,
+ 	.prepare	= lite5200_pm_prepare,
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c
+--- linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-04-04 20:46:41.489273754 -0400
+@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
+ 	iounmap(mbar);
+ }
+ 
+-static struct platform_suspend_ops mpc52xx_pm_ops = {
++static const struct platform_suspend_ops mpc52xx_pm_ops = {
+ 	.valid		= mpc52xx_pm_valid,
+ 	.prepare	= mpc52xx_pm_prepare,
+ 	.enter		= mpc52xx_pm_enter,
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c
+--- linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c	2010-04-04 20:46:41.489273754 -0400
+@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
+ 	return ret;
+ }
+ 
+-static struct platform_suspend_ops mpc83xx_suspend_ops = {
++static const struct platform_suspend_ops mpc83xx_suspend_ops = {
+ 	.valid = mpc83xx_suspend_valid,
+ 	.begin = mpc83xx_suspend_begin,
+ 	.enter = mpc83xx_suspend_enter,
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c
+--- linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c	2010-04-04 20:46:41.489273754 -0400
+@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
+ 
+ static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
+ 
+-struct dma_map_ops dma_iommu_fixed_ops = {
++const struct dma_map_ops dma_iommu_fixed_ops = {
+ 	.alloc_coherent = dma_fixed_alloc_coherent,
+ 	.free_coherent  = dma_fixed_free_coherent,
+ 	.map_sg         = dma_fixed_map_sg,
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c
+--- linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c	2010-04-04 20:46:41.489273754 -0400
+@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
+ 	return mask >= DMA_BIT_MASK(32);
+ }
+ 
+-static struct dma_map_ops ps3_sb_dma_ops = {
++static const struct dma_map_ops ps3_sb_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_sb_map_sg,
+@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
+ 	.unmap_page = ps3_unmap_page,
+ };
+ 
+-static struct dma_map_ops ps3_ioc0_dma_ops = {
++static const struct dma_map_ops ps3_ioc0_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_ioc0_map_sg,
+diff -urNp linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig
+--- linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig	2010-04-04 20:46:41.489273754 -0400
+@@ -2,6 +2,8 @@ config PPC_PSERIES
+ 	depends on PPC64 && PPC_BOOK3S
+ 	bool "IBM pSeries & new (POWER5-based) iSeries"
+ 	select MPIC
++	select PCI_MSI
++	select XICS
+ 	select PPC_I8259
+ 	select PPC_RTAS
+ 	select RTAS_ERROR_LOGGING
+diff -urNp linux-2.6.32.12/arch/s390/include/asm/elf.h linux-2.6.32.12/arch/s390/include/asm/elf.h
+--- linux-2.6.32.12/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/include/asm/elf.h	2010-04-04 20:46:41.489273754 -0400
+@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
+    that it will "exec", and that there is sufficient room for the brk.  */
+ #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports. */
+ 
+diff -urNp linux-2.6.32.12/arch/s390/include/asm/setup.h linux-2.6.32.12/arch/s390/include/asm/setup.h
+--- linux-2.6.32.12/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/include/asm/setup.h	2010-04-04 20:46:41.489273754 -0400
+@@ -50,13 +50,13 @@ extern unsigned long memory_end;
+ void detect_memory_layout(struct mem_chunk chunk[]);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-extern unsigned int switch_amode;
++#define switch_amode	(1)
+ #else
+ #define switch_amode	(0)
+ #endif
+ 
+ #ifdef CONFIG_S390_EXEC_PROTECT
+-extern unsigned int s390_noexec;
++#define s390_noexec	(1)
+ #else
+ #define s390_noexec	(0)
+ #endif
+diff -urNp linux-2.6.32.12/arch/s390/include/asm/uaccess.h linux-2.6.32.12/arch/s390/include/asm/uaccess.h
+--- linux-2.6.32.12/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/include/asm/uaccess.h	2010-04-04 20:46:41.489273754 -0400
+@@ -232,6 +232,10 @@ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
+ static inline unsigned long __must_check
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n) && (n <= 256))
+ 		return uaccess.copy_from_user_small(n, from, to);
+ 	else
+@@ -283,6 +290,10 @@ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else
+diff -urNp linux-2.6.32.12/arch/s390/Kconfig linux-2.6.32.12/arch/s390/Kconfig
+--- linux-2.6.32.12/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/Kconfig	2010-04-04 20:46:41.489273754 -0400
+@@ -194,28 +194,26 @@ config AUDIT_ARCH
+ 
+ config S390_SWITCH_AMODE
+ 	bool "Switch kernel/user addressing modes"
++	default y
+ 	help
+ 	  This option allows to switch the addressing modes of kernel and user
+-	  space. The kernel parameter switch_amode=on will enable this feature,
+-	  default is disabled. Enabling this (via kernel parameter) on machines
+-	  earlier than IBM System z9-109 EC/BC will reduce system performance.
++	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
++	  will reduce system performance.
+ 
+ 	  Note that this option will also be selected by selecting the execute
+-	  protection option below. Enabling the execute protection via the
+-	  noexec kernel parameter will also switch the addressing modes,
+-	  independent of the switch_amode kernel parameter.
++	  protection option below. Enabling the execute protection will also
++	  switch the addressing modes, independent of this option.
+ 
+ 
+ config S390_EXEC_PROTECT
+ 	bool "Data execute protection"
++	default y
+ 	select S390_SWITCH_AMODE
+ 	help
+ 	  This option allows to enable a buffer overflow protection for user
+ 	  space programs and it also selects the addressing mode option above.
+-	  The kernel parameter noexec=on will enable this feature and also
+-	  switch the addressing modes, default is disabled. Enabling this (via
+-	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
+-	  will reduce system performance.
++	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
++	  reduce system performance.
+ 
+ comment "Code generation options"
+ 
+diff -urNp linux-2.6.32.12/arch/s390/kernel/module.c linux-2.6.32.12/arch/s390/kernel/module.c
+--- linux-2.6.32.12/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/kernel/module.c	2010-04-04 20:46:41.492578989 -0400
+@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
+ 
+ 	/* Increase core size by size of got & plt and set start
+ 	   offsets for got and plt. */
+-	me->core_size = ALIGN(me->core_size, 4);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += me->arch.got_size;
+-	me->arch.plt_offset = me->core_size;
+-	me->core_size += me->arch.plt_size;
++	me->core_size_rw = ALIGN(me->core_size_rw, 4);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += me->arch.got_size;
++	me->arch.plt_offset = me->core_size_rx;
++	me->core_size_rx += me->arch.plt_size;
+ 	return 0;
+ }
+ 
+@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		if (info->got_initialized == 0) {
+ 			Elf_Addr *gotent;
+ 
+-			gotent = me->module_core + me->arch.got_offset +
++			gotent = me->module_core_rw + me->arch.got_offset +
+ 				info->got_offset;
+ 			*gotent = val;
+ 			info->got_initialized = 1;
+@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		else if (r_type == R_390_GOTENT ||
+ 			 r_type == R_390_GOTPLTENT)
+ 			*(unsigned int *) loc =
+-				(val + (Elf_Addr) me->module_core - loc) >> 1;
++				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
+ 		else if (r_type == R_390_GOT64 ||
+ 			 r_type == R_390_GOTPLT64)
+ 			*(unsigned long *) loc = val;
+@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
+ 		if (info->plt_initialized == 0) {
+ 			unsigned int *ip;
+-			ip = me->module_core + me->arch.plt_offset +
++			ip = me->module_core_rx + me->arch.plt_offset +
+ 				info->plt_offset;
+ #ifndef CONFIG_64BIT
+ 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
+@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
+ 			      (r_type == R_390_PLT32DBL &&
+ 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
+-				val = (Elf_Addr) me->module_core +
++				val = (Elf_Addr) me->module_core_rx +
+ 					me->arch.plt_offset +
+ 					info->plt_offset;
+ 			val += rela->r_addend - loc;
+@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
+ 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
+ 		val = val + rela->r_addend -
+-			((Elf_Addr) me->module_core + me->arch.got_offset);
++			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
+ 		if (r_type == R_390_GOTOFF16)
+ 			*(unsigned short *) loc = val;
+ 		else if (r_type == R_390_GOTOFF32)
+@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		break;
+ 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
+ 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
+-		val = (Elf_Addr) me->module_core + me->arch.got_offset +
++		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
+ 			rela->r_addend - loc;
+ 		if (r_type == R_390_GOTPC)
+ 			*(unsigned int *) loc = val;
+diff -urNp linux-2.6.32.12/arch/s390/kernel/setup.c linux-2.6.32.12/arch/s390/kernel/setup.c
+--- linux-2.6.32.12/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/kernel/setup.c	2010-04-04 20:46:41.492578989 -0400
+@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
+ early_param("mem", early_parse_mem);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-unsigned int switch_amode = 0;
+-EXPORT_SYMBOL_GPL(switch_amode);
+-
+ static int set_amode_and_uaccess(unsigned long user_amode,
+ 				 unsigned long user32_amode)
+ {
+@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
+ 		return 0;
+ 	}
+ }
+-
+-/*
+- * Switch kernel/user addressing modes?
+- */
+-static int __init early_parse_switch_amode(char *p)
+-{
+-	switch_amode = 1;
+-	return 0;
+-}
+-early_param("switch_amode", early_parse_switch_amode);
+-
+ #else /* CONFIG_S390_SWITCH_AMODE */
+ static inline int set_amode_and_uaccess(unsigned long user_amode,
+ 					unsigned long user32_amode)
+@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
+ }
+ #endif /* CONFIG_S390_SWITCH_AMODE */
+ 
+-#ifdef CONFIG_S390_EXEC_PROTECT
+-unsigned int s390_noexec = 0;
+-EXPORT_SYMBOL_GPL(s390_noexec);
+-
+-/*
+- * Enable execute protection?
+- */
+-static int __init early_parse_noexec(char *p)
+-{
+-	if (!strncmp(p, "off", 3))
+-		return 0;
+-	switch_amode = 1;
+-	s390_noexec = 1;
+-	return 0;
+-}
+-early_param("noexec", early_parse_noexec);
+-#endif /* CONFIG_S390_EXEC_PROTECT */
+-
+ static void setup_addressing_mode(void)
+ {
+ 	if (s390_noexec) {
+diff -urNp linux-2.6.32.12/arch/s390/mm/mmap.c linux-2.6.32.12/arch/s390/mm/mmap.c
+--- linux-2.6.32.12/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/s390/mm/mmap.c	2010-04-04 20:46:41.492578989 -0400
+@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c
+--- linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c	2010-04-04 20:46:41.492578989 -0400
+@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops hp6x0_pm_ops = {
++static const struct platform_suspend_ops hp6x0_pm_ops = {
+ 	.enter		= hp6x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c
+--- linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c	2010-04-04 20:46:41.492578989 -0400
+@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops sq_sysfs_ops = {
++static const struct sysfs_ops sq_sysfs_ops = {
+ 	.show	= sq_sysfs_show,
+ 	.store	= sq_sysfs_store,
+ };
+diff -urNp linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c
+--- linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c	2010-04-04 20:46:41.492578989 -0400
+@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops sh_pm_ops = {
++static const struct platform_suspend_ops sh_pm_ops = {
+ 	.enter          = sh_pm_enter,
+ 	.valid          = suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.12/arch/sh/kernel/kgdb.c linux-2.6.32.12/arch/sh/kernel/kgdb.c
+--- linux-2.6.32.12/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sh/kernel/kgdb.c	2010-04-04 20:46:41.492578989 -0400
+@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: trapa #0x3c */
+ #ifdef CONFIG_CPU_LITTLE_ENDIAN
+ 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h
+--- linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h	2010-04-04 20:46:41.492578989 -0400
+@@ -14,18 +14,38 @@
+ #define ATOMIC64_INIT(i)	{ (i) }
+ 
+ #define atomic_read(v)		((v)->counter)
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
+ #define atomic64_read(v)	((v)->counter)
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
+ 
+ #define atomic_set(v, i)	(((v)->counter) = i)
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
+ #define atomic64_set(v, i)	(((v)->counter) = i)
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
+ 
+ extern void atomic_add(int, atomic_t *);
++extern void atomic_add_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_add(int, atomic64_t *);
++extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
+ extern void atomic_sub(int, atomic_t *);
++extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_sub(int, atomic64_t *);
+ 
+ extern int atomic_add_ret(int, atomic_t *);
+ extern int atomic64_add_ret(int, atomic64_t *);
++extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
+ extern int atomic_sub_ret(int, atomic_t *);
+ extern int atomic64_sub_ret(int, atomic64_t *);
+ 
+@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ #define atomic_inc_return(v) atomic_add_ret(1, v)
+ #define atomic64_inc_return(v) atomic64_add_ret(1, v)
++#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
+ 
+ #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
+ #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
+@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
+ #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
+ 
+ #define atomic_inc(v) atomic_add(1, v)
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	atomic_add_unchecked(1, v);
++}
+ #define atomic64_inc(v) atomic64_add(1, v)
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
++	atomic64_add_unchecked(1, v);
++}
+ 
+ #define atomic_dec(v) atomic_sub(1, v)
+ #define atomic64_dec(v) atomic64_sub(1, v)
+@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%icc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
+ 
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%xcc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic64_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h
+--- linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h	2010-04-04 20:46:41.492578989 -0400
+@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
+ #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+ #define dma_is_consistent(d, h)	(1)
+ 
+-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
++extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
+ extern struct bus_type pci_bus_type;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
+ 	if (dev->bus == &pci_bus_type)
+@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
+@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
+ 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/elf_32.h linux-2.6.32.12/arch/sparc/include/asm/elf_32.h
+--- linux-2.6.32.12/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/elf_32.h	2010-04-04 20:46:41.492578989 -0400
+@@ -116,6 +116,13 @@ typedef struct {
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  This can NOT be done in userspace
+    on Sparc.  */
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/elf_64.h linux-2.6.32.12/arch/sparc/include/asm/elf_64.h
+--- linux-2.6.32.12/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/elf_64.h	2010-04-04 20:46:41.492578989 -0400
+@@ -163,6 +163,12 @@ typedef struct {
+ #define ELF_ET_DYN_BASE		0x0000010000000000UL
+ #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  */
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h
+--- linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h	2010-04-04 20:46:41.492578989 -0400
+@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
+ BTFIXUPDEF_INT(page_none)
+ BTFIXUPDEF_INT(page_copy)
+ BTFIXUPDEF_INT(page_readonly)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++BTFIXUPDEF_INT(page_shared_noexec)
++BTFIXUPDEF_INT(page_copy_noexec)
++BTFIXUPDEF_INT(page_readonly_noexec)
++#endif
++
+ BTFIXUPDEF_INT(page_kernel)
+ 
+ #define PMD_SHIFT		SUN4C_PMD_SHIFT
+@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
+ #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
+ #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++extern pgprot_t PAGE_SHARED_NOEXEC;
++# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
++# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ extern unsigned long page_kernel;
+ 
+ #ifdef MODULE
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h
+--- linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h	2010-04-04 20:46:41.492578989 -0400
+@@ -115,6 +115,13 @@
+ 				    SRMMU_EXEC | SRMMU_REF)
+ #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
+ 				    SRMMU_EXEC | SRMMU_REF)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
++#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#endif
++
+ #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
+ 				    SRMMU_DIRTY | SRMMU_REF)
+ 
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h
+--- linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h	2010-04-04 20:46:41.492578989 -0400
+@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
+ 	__asm__ __volatile__ (
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,pn		%0, 2f\n"
+-"4:	 add		%0, 1, %1\n"
++"4:	 addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
+ "	.previous"
+ 	: "=&r" (tmp1), "=&r" (tmp2)
+ 	: "r" (lock)
+-	: "memory");
++	: "memory", "cc");
+ }
+ 
+ static int inline arch_read_trylock(raw_rwlock_t *lock)
+@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,a,pn	%0, 2f\n"
+ "	 mov		0, %0\n"
+-"	add		%0, 1, %1\n"
++"	addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
+ 
+ 	__asm__ __volatile__(
+ "1:	lduw	[%2], %0\n"
+-"	sub	%0, 1, %1\n"
++"	subcc	%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs	%%icc, 6\n"
++#endif
++
+ "	cas	[%2], %0, %1\n"
+ "	cmp	%0, %1\n"
+ "	bne,pn	%%xcc, 1b\n"
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h
+--- linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h	2010-04-04 20:46:41.492578989 -0400
+@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
+ 
+ static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) to, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
+ 		return __copy_user(to, (__force void __user *) from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_user(to, (__force void __user *) from, n);
+ }
+ 
+ static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) from, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
+ 		return __copy_user((__force void __user *) to, from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	return __copy_user((__force void __user *) to, from, n);
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h
+--- linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h	2010-04-04 20:46:41.492578989 -0400
+@@ -9,6 +9,7 @@
+ #include <linux/compiler.h>
+ #include <linux/string.h>
+ #include <linux/thread_info.h>
++#include <linux/kernel.h>
+ #include <asm/asi.h>
+ #include <asm/system.h>
+ #include <asm/spitfire.h>
+@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
+        : "=r" (x) : "r" (__m(addr)), "i" (retval))
+ 
+ extern int __get_user_bad(void);
++extern void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ extern unsigned long __must_check ___copy_from_user(void *to,
+ 						    const void __user *from,
+@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
+ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_from_user(to, from, size);
++	unsigned long ret;
+ 
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(to, size, false);
++
++	ret = ___copy_from_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_from_user_fixup(to, from, size);
+ 	return ret;
+@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
+ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_to_user(to, from, size);
++	unsigned long ret;
++
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(from, size, true);
+ 
++	ret = ___copy_to_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_to_user_fixup(to, from, size);
+ 	return ret;
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/iommu.c linux-2.6.32.12/arch/sparc/kernel/iommu.c
+--- linux-2.6.32.12/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/iommu.c	2010-04-04 20:46:41.492578989 -0400
+@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4u_dma_ops = {
++static const struct dma_map_ops sun4u_dma_ops = {
+ 	.alloc_coherent		= dma_4u_alloc_coherent,
+ 	.free_coherent		= dma_4u_free_coherent,
+ 	.map_page		= dma_4u_map_page,
+@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
+ 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
++const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/ioport.c linux-2.6.32.12/arch/sparc/kernel/ioport.c
+--- linux-2.6.32.12/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/ioport.c	2010-04-04 20:46:41.492578989 -0400
+@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
+ 	BUG();
+ }
+ 
+-struct dma_map_ops sbus_dma_ops = {
++const struct dma_map_ops sbus_dma_ops = {
+ 	.alloc_coherent		= sbus_alloc_coherent,
+ 	.free_coherent		= sbus_free_coherent,
+ 	.map_page		= sbus_map_page,
+@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
+ 	.sync_sg_for_device	= sbus_sync_sg_for_device,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sbus_dma_ops;
++const struct dma_map_ops *dma_ops = &sbus_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int __init sparc_register_ioport(void)
+@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
+ 	}
+ }
+ 
+-struct dma_map_ops pci32_dma_ops = {
++const struct dma_map_ops pci32_dma_ops = {
+ 	.alloc_coherent		= pci32_alloc_coherent,
+ 	.free_coherent		= pci32_free_coherent,
+ 	.map_page		= pci32_map_page,
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c
+--- linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c	2010-04-04 20:46:41.492578989 -0400
+@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x7d */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
+ };
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c
+--- linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c	2010-04-04 20:46:41.492578989 -0400
+@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x72 */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
+ };
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/Makefile linux-2.6.32.12/arch/sparc/kernel/Makefile
+--- linux-2.6.32.12/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/Makefile	2010-04-04 20:46:41.492578989 -0400
+@@ -3,7 +3,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ extra-y     := head_$(BITS).o
+ extra-y     += init_task.o
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c
+--- linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c	2010-04-04 20:46:41.492578989 -0400
+@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4v_dma_ops = {
++static const struct dma_map_ops sun4v_dma_ops = {
+ 	.alloc_coherent			= dma_4v_alloc_coherent,
+ 	.free_coherent			= dma_4v_free_coherent,
+ 	.map_page			= dma_4v_map_page,
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c
+--- linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c	2010-04-04 20:46:41.492578989 -0400
+@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (ARCH_SUN4C && len > 0x20000000)
+ 		return -ENOMEM;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (flags & MAP_SHARED)
+ 		addr = COLOUR_ALIGN(addr);
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c
+--- linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c	2010-04-04 20:46:41.492578989 -0400
+@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
+ 	}
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
++		start_addr = addr = mm->mmap_base;
+ 	        mm->cached_hole_size = 0;
+ 	}
+ 
+@@ -175,8 +179,8 @@ full_search:
+ 			vma = find_vma(mm, VA_EXCLUDE_END);
+ 		}
+ 		if (unlikely(task_size < addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
+ 	    sysctl_legacy_va_layout) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 			gap = (task_size / 6 * 5);
+ 
+ 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.12/arch/sparc/kernel/traps_64.c linux-2.6.32.12/arch/sparc/kernel/traps_64.c
+--- linux-2.6.32.12/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/kernel/traps_64.c	2010-04-04 20:46:41.496772577 -0400
+@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
+ 
+ 	lvl -= 0x100;
+ 	if (regs->tstate & TSTATE_PRIV) {
++
++#ifdef CONFIG_PAX_REFCOUNT
++		if (lvl == 6)
++			pax_report_refcount_overflow(regs);
++#endif
++
+ 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
+ 		die_if_kernel(buffer, regs);
+ 	}
+@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
+ void bad_trap_tl1(struct pt_regs *regs, long lvl)
+ {
+ 	char buffer[32];
+-	
++
+ 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
+ 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
+ 		return;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++	if (lvl == 6)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
+ 
+ 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
+diff -urNp linux-2.6.32.12/arch/sparc/lib/atomic_64.S linux-2.6.32.12/arch/sparc/lib/atomic_64.S
+--- linux-2.6.32.12/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/lib/atomic_64.S	2010-04-04 20:46:41.496772577 -0400
+@@ -18,7 +18,12 @@
+ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_add, .-atomic_add
+ 
++	.globl	atomic_add_unchecked
++	.type	atomic_add_unchecked,#function
++atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	add	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_add_unchecked, .-atomic_add_unchecked
++
+ 	.globl	atomic_sub
+ 	.type	atomic_sub,#function
+ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_sub, .-atomic_sub
+ 
++	.globl	atomic_sub_unchecked
++	.type	atomic_sub_unchecked,#function
++atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	sub	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
++
+ 	.globl	atomic_add_ret
+ 	.type	atomic_add_ret,#function
+ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
+ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
+ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add, .-atomic64_add
+ 
++	.globl	atomic64_add_unchecked
++	.type	atomic64_add_unchecked,#function
++atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
++
+ 	.globl	atomic64_sub
+ 	.type	atomic64_sub,#function
+ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
+ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add_ret, .-atomic64_add_ret
+ 
++	.globl	atomic64_add_ret_unchecked
++	.type	atomic64_add_ret_unchecked,#function
++atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 add	%g7, %o0, %g7
++	mov	%g7, %o0
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
++
+ 	.globl	atomic64_sub_ret
+ 	.type	atomic64_sub_ret,#function
+ atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+diff -urNp linux-2.6.32.12/arch/sparc/lib/ksyms.c linux-2.6.32.12/arch/sparc/lib/ksyms.c
+--- linux-2.6.32.12/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/lib/ksyms.c	2010-04-04 20:46:41.496772577 -0400
+@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
+ 
+ /* Atomic counter implementation. */
+ EXPORT_SYMBOL(atomic_add);
++EXPORT_SYMBOL(atomic_add_unchecked);
+ EXPORT_SYMBOL(atomic_add_ret);
+ EXPORT_SYMBOL(atomic_sub);
++EXPORT_SYMBOL(atomic_sub_unchecked);
+ EXPORT_SYMBOL(atomic_sub_ret);
+ EXPORT_SYMBOL(atomic64_add);
+ EXPORT_SYMBOL(atomic64_add_ret);
+diff -urNp linux-2.6.32.12/arch/sparc/lib/rwsem_64.S linux-2.6.32.12/arch/sparc/lib/rwsem_64.S
+--- linux-2.6.32.12/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/lib/rwsem_64.S	2010-04-04 20:46:41.496772577 -0400
+@@ -11,7 +11,12 @@
+ 	.globl		__down_read
+ __down_read:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -33,7 +38,12 @@ __down_read:
+ 	.globl		__down_read_trylock
+ __down_read_trylock:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cmp		%g7, 0
+ 	bl,pn		%icc, 2f
+ 	 mov		0, %o1
+@@ -51,7 +61,12 @@ __down_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -77,7 +92,12 @@ __down_write_trylock:
+ 	cmp		%g3, 0
+ 	bne,pn		%icc, 2f
+ 	 mov		0, %o1
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -90,7 +110,12 @@ __down_write_trylock:
+ __up_read:
+ 1:
+ 	lduw		[%o0], %g1
+-	sub		%g1, 1, %g7
++	subcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -118,7 +143,12 @@ __up_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -143,7 +173,12 @@ __downgrade_write:
+ 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+diff -urNp linux-2.6.32.12/arch/sparc/Makefile linux-2.6.32.12/arch/sparc/Makefile
+--- linux-2.6.32.12/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/Makefile	2010-04-04 20:46:41.496772577 -0400
+@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
+ # Export what is needed by arch/sparc/boot/Makefile
+ export VMLINUX_INIT VMLINUX_MAIN
+ VMLINUX_INIT := $(head-y) $(init-y)
+-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
+ VMLINUX_MAIN += $(drivers-y) $(net-y)
+ 
+diff -urNp linux-2.6.32.12/arch/sparc/mm/fault_32.c linux-2.6.32.12/arch/sparc/mm/fault_32.c
+--- linux-2.6.32.12/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/mm/fault_32.c	2010-04-04 20:46:41.496772577 -0400
+@@ -21,6 +21,9 @@
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+ #include <linux/kdebug.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/system.h>
+ #include <asm/page.h>
+@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
+ 	return safe_compute_effective_address(regs, insn);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->pc);
++		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned int addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->pc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned int addr;
++
++			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(ba, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr, save, call;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			else
++				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->pc = call_dl_resolve;
++				regs->npc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++				regs->pc = addr;
++				regs->npc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->pc-4));
++		err |= get_user(call, (unsigned int *)regs->pc);
++		err |= get_user(nop, (unsigned int *)(regs->pc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
++
++			regs->u_regs[UREG_RETPC] = regs->pc;
++			regs->pc = dl_resolve;
++			regs->npc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
+ 			       unsigned long address)
+ {
+@@ -231,6 +495,24 @@ good_area:
+ 		if(!(vma->vm_flags & VM_WRITE))
+ 			goto bad_area;
+ 	} else {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		/* Allow reads even for write-only mappings */
+ 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
+ 			goto bad_area;
+diff -urNp linux-2.6.32.12/arch/sparc/mm/fault_64.c linux-2.6.32.12/arch/sparc/mm/fault_64.c
+--- linux-2.6.32.12/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/mm/fault_64.c	2010-04-04 20:46:41.496772577 -0400
+@@ -20,6 +20,9 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/percpu.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
+ 	show_regs(regs);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->tpc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->tpc);
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->tpc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned long addr;
++
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #4 */
++		unsigned int sethi, mov1, call, mov2;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(call, (unsigned int *)(regs->tpc+8));
++		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    mov1 == 0x8210000FU &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    mov2 == 0x9E100001U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
++			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #5 */
++		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    (or1 & 0xFFFFE000U) == 0x82106000U &&
++		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++		    sllx == 0x83287020U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #6 */
++		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or, (unsigned int *)(regs->tpc+16));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    sllx == 0x83287020U &&
++		    (or & 0xFFFFE000U) == 0x8A116000U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++			unsigned int save, call;
++			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++			else
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->tpc = call_dl_resolve;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++				if (test_thread_flag(TIF_32BIT))
++					addr &= 0xFFFFFFFFUL;
++
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++
++			/* PaX: 64-bit PLT stub */
++			err = get_user(sethi1, (unsigned int *)addr);
++			err |= get_user(sethi2, (unsigned int *)(addr+4));
++			err |= get_user(or1, (unsigned int *)(addr+8));
++			err |= get_user(or2, (unsigned int *)(addr+12));
++			err |= get_user(sllx, (unsigned int *)(addr+16));
++			err |= get_user(add, (unsigned int *)(addr+20));
++			err |= get_user(jmpl, (unsigned int *)(addr+24));
++			err |= get_user(nop, (unsigned int *)(addr+28));
++			if (err)
++				break;
++
++			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
++			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++			    (or1 & 0xFFFFE000U) == 0x88112000U &&
++			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++			    sllx == 0x89293020U &&
++			    add == 0x8A010005U &&
++			    jmpl == 0x89C14000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++				regs->u_regs[UREG_G4] <<= 32;
++				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
++				regs->u_regs[UREG_G4] = addr + 24;
++				addr = regs->u_regs[UREG_G5];
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->tpc-4));
++		err |= get_user(call, (unsigned int *)regs->tpc);
++		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				dl_resolve &= 0xFFFFFFFFUL;
++
++			regs->u_regs[UREG_RETPC] = regs->tpc;
++			regs->tpc = dl_resolve;
++			regs->tnpc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (ba & 0xFFF00000U) == 0x30600000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ 	struct mm_struct *mm = current->mm;
+@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
+ 	if (!vma)
+ 		goto bad_area;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	/* PaX: detect ITLB misses on non-exec pages */
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
++	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
++	{
++		if (address != regs->tpc)
++			goto good_area;
++
++		up_read(&mm->mmap_sem);
++		switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++		case 2:
++		case 3:
++			return;
++#endif
++
++		}
++		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	/* Pure DTLB misses do not tell us whether the fault causing
+ 	 * load/store/atomic was a write or not, it only says that there
+ 	 * was no match.  So in such a case we (carefully) read the
+diff -urNp linux-2.6.32.12/arch/sparc/mm/init_32.c linux-2.6.32.12/arch/sparc/mm/init_32.c
+--- linux-2.6.32.12/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/mm/init_32.c	2010-04-04 20:46:41.496772577 -0400
+@@ -317,6 +317,9 @@ extern void device_scan(void);
+ pgprot_t PAGE_SHARED __read_mostly;
+ EXPORT_SYMBOL(PAGE_SHARED);
+ 
++pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
++EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
++
+ void __init paging_init(void)
+ {
+ 	switch(sparc_cpu_model) {
+@@ -345,17 +348,17 @@ void __init paging_init(void)
+ 
+ 	/* Initialize the protection map with non-constant, MMU dependent values. */
+ 	protection_map[0] = PAGE_NONE;
+-	protection_map[1] = PAGE_READONLY;
+-	protection_map[2] = PAGE_COPY;
+-	protection_map[3] = PAGE_COPY;
++	protection_map[1] = PAGE_READONLY_NOEXEC;
++	protection_map[2] = PAGE_COPY_NOEXEC;
++	protection_map[3] = PAGE_COPY_NOEXEC;
+ 	protection_map[4] = PAGE_READONLY;
+ 	protection_map[5] = PAGE_READONLY;
+ 	protection_map[6] = PAGE_COPY;
+ 	protection_map[7] = PAGE_COPY;
+ 	protection_map[8] = PAGE_NONE;
+-	protection_map[9] = PAGE_READONLY;
+-	protection_map[10] = PAGE_SHARED;
+-	protection_map[11] = PAGE_SHARED;
++	protection_map[9] = PAGE_READONLY_NOEXEC;
++	protection_map[10] = PAGE_SHARED_NOEXEC;
++	protection_map[11] = PAGE_SHARED_NOEXEC;
+ 	protection_map[12] = PAGE_READONLY;
+ 	protection_map[13] = PAGE_READONLY;
+ 	protection_map[14] = PAGE_SHARED;
+diff -urNp linux-2.6.32.12/arch/sparc/mm/Makefile linux-2.6.32.12/arch/sparc/mm/Makefile
+--- linux-2.6.32.12/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/mm/Makefile	2010-04-04 20:46:41.496772577 -0400
+@@ -2,7 +2,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
+ obj-y                   += fault_$(BITS).o
+diff -urNp linux-2.6.32.12/arch/sparc/mm/srmmu.c linux-2.6.32.12/arch/sparc/mm/srmmu.c
+--- linux-2.6.32.12/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/sparc/mm/srmmu.c	2010-04-04 20:46:41.496772577 -0400
+@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
+ 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
+ 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
+ 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
++	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
++	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
++#endif
++
+ 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
+ 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
+ 
+diff -urNp linux-2.6.32.12/arch/um/include/asm/kmap_types.h linux-2.6.32.12/arch/um/include/asm/kmap_types.h
+--- linux-2.6.32.12/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/um/include/asm/kmap_types.h	2010-04-04 20:46:41.496772577 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.12/arch/um/include/asm/page.h linux-2.6.32.12/arch/um/include/asm/page.h
+--- linux-2.6.32.12/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/um/include/asm/page.h	2010-04-04 20:46:41.496772577 -0400
+@@ -14,6 +14,9 @@
+ #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
+ #define PAGE_MASK	(~(PAGE_SIZE-1))
+ 
++#define ktla_ktva(addr)			(addr)
++#define ktva_ktla(addr)			(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ struct page;
+diff -urNp linux-2.6.32.12/arch/um/sys-i386/syscalls.c linux-2.6.32.12/arch/um/sys-i386/syscalls.c
+--- linux-2.6.32.12/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/um/sys-i386/syscalls.c	2010-04-04 20:46:41.496772577 -0400
+@@ -11,6 +11,21 @@
+ #include "asm/uaccess.h"
+ #include "asm/unistd.h"
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+diff -urNp linux-2.6.32.12/arch/x86/boot/bitops.h linux-2.6.32.12/arch/x86/boot/bitops.h
+--- linux-2.6.32.12/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/bitops.h	2010-04-04 20:46:41.496772577 -0400
+@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
+ 	u8 v;
+ 	const u32 *p = (const u32 *)addr;
+ 
+-	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
++	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+ 	return v;
+ }
+ 
+@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
+ 
+ static inline void set_bit(int nr, void *addr)
+ {
+-	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
++	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
+ }
+ 
+ #endif /* BOOT_BITOPS_H */
+diff -urNp linux-2.6.32.12/arch/x86/boot/boot.h linux-2.6.32.12/arch/x86/boot/boot.h
+--- linux-2.6.32.12/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/boot.h	2010-04-04 20:46:41.496772577 -0400
+@@ -82,7 +82,7 @@ static inline void io_delay(void)
+ static inline u16 ds(void)
+ {
+ 	u16 seg;
+-	asm("movw %%ds,%0" : "=rm" (seg));
++	asm volatile("movw %%ds,%0" : "=rm" (seg));
+ 	return seg;
+ }
+ 
+@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
+ static inline int memcmp(const void *s1, const void *s2, size_t len)
+ {
+ 	u8 diff;
+-	asm("repe; cmpsb; setnz %0"
++	asm volatile("repe; cmpsb; setnz %0"
+ 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
+ 	return diff;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/head_32.S linux-2.6.32.12/arch/x86/boot/compressed/head_32.S
+--- linux-2.6.32.12/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/compressed/head_32.S	2010-04-04 20:46:41.496772577 -0400
+@@ -76,7 +76,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl    %eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -149,7 +149,7 @@ relocated:
+  * and where it was actually loaded.
+  */
+ 	movl	%ebp, %ebx
+-	subl	$LOAD_PHYSICAL_ADDR, %ebx
++	subl	$____LOAD_PHYSICAL_ADDR, %ebx
+ 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
+ /*
+  * Process relocations.
+@@ -157,8 +157,7 @@ relocated:
+ 
+ 1:	subl	$4, %edi
+ 	movl	(%edi), %ecx
+-	testl	%ecx, %ecx
+-	jz	2f
++	jecxz	2f
+ 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
+ 	jmp	1b
+ 2:
+diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/head_64.S linux-2.6.32.12/arch/x86/boot/compressed/head_64.S
+--- linux-2.6.32.12/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/compressed/head_64.S	2010-04-04 20:46:41.496772577 -0400
+@@ -91,7 +91,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl	%eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -234,7 +234,7 @@ ENTRY(startup_64)
+ 	notq	%rax
+ 	andq	%rax, %rbp
+ #else
+-	movq	$LOAD_PHYSICAL_ADDR, %rbp
++	movq	$____LOAD_PHYSICAL_ADDR, %rbp
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/misc.c linux-2.6.32.12/arch/x86/boot/compressed/misc.c
+--- linux-2.6.32.12/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/compressed/misc.c	2010-04-04 20:46:41.496772577 -0400
+@@ -288,7 +288,7 @@ static void parse_elf(void *output)
+ 		case PT_LOAD:
+ #ifdef CONFIG_RELOCATABLE
+ 			dest = output;
+-			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
++			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
+ #else
+ 			dest = (void *)(phdr->p_paddr);
+ #endif
+@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
+ 		error("Destination address too large");
+ #endif
+ #ifndef CONFIG_RELOCATABLE
+-	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
++	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
+ 		error("Wrong destination address");
+ #endif
+ 
+diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c
+--- linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c	2010-04-04 20:46:41.496772577 -0400
+@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
+ 
+ 	offs = (olen > ilen) ? olen - ilen : 0;
+ 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
+-	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
++	offs += 64*1024;	/* Add 64K bytes slack */
+ 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
+ 
+ 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
+diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/relocs.c linux-2.6.32.12/arch/x86/boot/compressed/relocs.c
+--- linux-2.6.32.12/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/compressed/relocs.c	2010-04-04 20:46:41.500459645 -0400
+@@ -10,8 +10,11 @@
+ #define USE_BSD
+ #include <endian.h>
+ 
++#include "../../../../include/linux/autoconf.h"
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ 
+@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
+ 
+ static int is_safe_abs_reloc(const char* sym_name)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
+ 		if (!strcmp(sym_name, safe_abs_relocs[i]))
+@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
+ 
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
+ 			if (sym->st_shndx == SHN_ABS) {
+ 				continue;
+ 			}
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
+ 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
+ 				/*
+ 				 * NONE can be ignored and and PC relative
+@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
+ 
+ static void emit_relocs(int as_text)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc);
+@@ -634,6 +693,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
+diff -urNp linux-2.6.32.12/arch/x86/boot/cpucheck.c linux-2.6.32.12/arch/x86/boot/cpucheck.c
+--- linux-2.6.32.12/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/cpucheck.c	2010-04-04 20:46:41.500459645 -0400
+@@ -74,7 +74,7 @@ static int has_fpu(void)
+ 	u16 fcw = -1, fsw = -1;
+ 	u32 cr0;
+ 
+-	asm("movl %%cr0,%0" : "=r" (cr0));
++	asm volatile("movl %%cr0,%0" : "=r" (cr0));
+ 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
+ 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
+ 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
+@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
+ {
+ 	u32 f0, f1;
+ 
+-	asm("pushfl ; "
++	asm volatile("pushfl ; "
+ 	    "pushfl ; "
+ 	    "popl %0 ; "
+ 	    "movl %0,%1 ; "
+@@ -115,7 +115,7 @@ static void get_flags(void)
+ 		set_bit(X86_FEATURE_FPU, cpu.flags);
+ 
+ 	if (has_eflag(X86_EFLAGS_ID)) {
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_intel_level),
+ 		      "=b" (cpu_vendor[0]),
+ 		      "=d" (cpu_vendor[1]),
+@@ -124,7 +124,7 @@ static void get_flags(void)
+ 
+ 		if (max_intel_level >= 0x00000001 &&
+ 		    max_intel_level <= 0x0000ffff) {
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "=a" (tfms),
+ 			      "=c" (cpu.flags[4]),
+ 			      "=d" (cpu.flags[0])
+@@ -136,7 +136,7 @@ static void get_flags(void)
+ 				cpu.model += ((tfms >> 16) & 0xf) << 4;
+ 		}
+ 
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_amd_level)
+ 		    : "a" (0x80000000)
+ 		    : "ebx", "ecx", "edx");
+@@ -144,7 +144,7 @@ static void get_flags(void)
+ 		if (max_amd_level >= 0x80000001 &&
+ 		    max_amd_level <= 0x8000ffff) {
+ 			u32 eax = 0x80000001;
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "+a" (eax),
+ 			      "=c" (cpu.flags[6]),
+ 			      "=d" (cpu.flags[1])
+@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_K7_HWCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax &= ~(1 << 15);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		get_flags();	/* Make sure it really did something */
+ 		err = check_flags();
+@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_VIA_FCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax |= (1<<1)|(1<<7);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		set_bit(X86_FEATURE_CX8, cpu.flags);
+ 		err = check_flags();
+@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 eax, edx;
+ 		u32 level = 1;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+-		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
+-		asm("cpuid"
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
++		asm volatile("cpuid"
+ 		    : "+a" (level), "=d" (cpu.flags[0])
+ 		    : : "ecx", "ebx");
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		err = check_flags();
+ 	}
+diff -urNp linux-2.6.32.12/arch/x86/boot/header.S linux-2.6.32.12/arch/x86/boot/header.S
+--- linux-2.6.32.12/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/header.S	2010-04-04 20:46:41.500459645 -0400
+@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
+ 						# single linked list of
+ 						# struct setup_data
+ 
+-pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
++pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
+ 
+ #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
+ #define VO_INIT_SIZE	(VO__end - VO__text)
+diff -urNp linux-2.6.32.12/arch/x86/boot/memory.c linux-2.6.32.12/arch/x86/boot/memory.c
+--- linux-2.6.32.12/arch/x86/boot/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/memory.c	2010-04-29 17:46:37.065247062 -0400
+@@ -19,7 +19,7 @@
+ 
+ static int detect_memory_e820(void)
+ {
+-	int count = 0;
++	unsigned int count = 0;
+ 	struct biosregs ireg, oreg;
+ 	struct e820entry *desc = boot_params.e820_map;
+ 	static struct e820entry buf; /* static so it is zeroed */
+diff -urNp linux-2.6.32.12/arch/x86/boot/video.c linux-2.6.32.12/arch/x86/boot/video.c
+--- linux-2.6.32.12/arch/x86/boot/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/video.c	2010-04-29 17:46:37.069058404 -0400
+@@ -90,7 +90,7 @@ static void store_mode_params(void)
+ static unsigned int get_entry(void)
+ {
+ 	char entry_buf[4];
+-	int i, len = 0;
++	unsigned int i, len = 0;
+ 	int key;
+ 	unsigned int v;
+ 
+diff -urNp linux-2.6.32.12/arch/x86/boot/video-vesa.c linux-2.6.32.12/arch/x86/boot/video-vesa.c
+--- linux-2.6.32.12/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/boot/video-vesa.c	2010-04-04 20:46:41.500459645 -0400
+@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
+ 
+ 	boot_params.screen_info.vesapm_seg = oreg.es;
+ 	boot_params.screen_info.vesapm_off = oreg.di;
++	boot_params.screen_info.vesapm_size = oreg.cx;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/x86/ia32/ia32entry.S linux-2.6.32.12/arch/x86/ia32/ia32entry.S
+--- linux-2.6.32.12/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/ia32/ia32entry.S	2010-04-04 20:58:33.225084964 -0400
+@@ -13,6 +13,7 @@
+ #include <asm/thread_info.h>	
+ #include <asm/segment.h>
+ #include <asm/irqflags.h>
++#include <asm/pgtable.h>
+ #include <linux/linkage.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
+ 	SWAPGS_UNSAFE_STACK
+ 	movq	PER_CPU_VAR(kernel_stack), %rsp
+ 	addq	$(KERNEL_STACK_OFFSET),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs, here we enable it straight after entry:
+@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
+ 	SAVE_ARGS 0,0,1
+  	/* no need to do an access_ok check here because rbp has been
+  	   32bit zero extended */ 
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%rbp
++#endif
++
+ 1:	movl	(%rbp),%ebp
+  	.section __ex_table,"a"
+  	.quad 1b,ia32_badarg
+@@ -166,6 +178,11 @@ sysenter_dispatch:
+ 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz	sysexit_audit
+ sysexit_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl    $~TS_COMPAT,TI_status(%r10)
+ 	/* clear IF, that popfq doesn't enable interrupts early */
+ 	andl  $~0x200,EFLAGS-R11(%rsp) 
+@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
+ 	movl	%esp,%r8d
+ 	CFI_REGISTER	rsp,r8
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
+ 	/* no need to do an access_ok check here because r8 has been
+ 	   32bit zero extended */ 
+ 	/* hardware stack frame is complete now */	
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%r8
++#endif
++
+ 1:	movl	(%r8),%r9d
+ 	.section __ex_table,"a"
+ 	.quad 1b,ia32_badarg
+@@ -327,6 +355,11 @@ cstar_dispatch:
+ 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz sysretl_audit
+ sysretl_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl $~TS_COMPAT,TI_status(%r10)
+ 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
+ 	movl RIP-ARGOFFSET(%rsp),%ecx
+@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
+ 	CFI_REL_OFFSET	rip,RIP-RIP
+ 	PARAVIRT_ADJUST_EXCEPTION_FRAME
+ 	SWAPGS
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+diff -urNp linux-2.6.32.12/arch/x86/ia32/ia32_signal.c linux-2.6.32.12/arch/x86/ia32/ia32_signal.c
+--- linux-2.6.32.12/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/ia32/ia32_signal.c	2010-04-04 20:46:41.500459645 -0400
+@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
+ 	sp -= frame_size;
+ 	/* Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ 	return (void __user *) sp;
+ }
+ 
+@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
+ 		0xb8,
+ 		__NR_ia32_rt_sigreturn,
+ 		0x80cd,
+-		0,
++		0
+ 	};
+ 
+ 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/alternative.h linux-2.6.32.12/arch/x86/include/asm/alternative.h
+--- linux-2.6.32.12/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/alternative.h	2010-04-04 20:46:41.500459645 -0400
+@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
+       "	 .byte 662b-661b\n"			/* sourcelen       */	\
+       "	 .byte 664f-663f\n"			/* replacementlen  */	\
+       ".previous\n"							\
+-      ".section .altinstr_replacement, \"ax\"\n"			\
++      ".section .altinstr_replacement, \"a\"\n"			\
+       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
+       ".previous"
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/apm.h linux-2.6.32.12/arch/x86/include/asm/apm.h
+--- linux-2.6.32.12/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/apm.h	2010-04-04 20:46:41.500459645 -0400
+@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%al\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%bl\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/atomic_32.h linux-2.6.32.12/arch/x86/include/asm/atomic_32.h
+--- linux-2.6.32.12/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/atomic_32.h	2010-04-04 20:46:41.500459645 -0400
+@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_sub_unchecked - subtract integer from atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "+m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++
++#ifdef CONFIG_M386
++no_xadd: /* Legacy 386 processor */
++	local_irq_save(flags);
++	__i = atomic_read(v);
++	atomic_set(v, i + __i);
++	local_irq_restore(flags);
++	return i + __i;
++#endif
++}
++
++/**
++ * atomic_add_return_unchecked - add integer and return
++ * @v: pointer of type atomic_unchecked_t
++ * @i: integer value to add
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
++{
++	int __i;
++#ifdef CONFIG_M386
++	unsigned long flags;
++	if (unlikely(boot_cpu_data.x86 <= 3))
++		goto no_xadd;
++#endif
++	/* Modern 486+ processor */
++	__i = i;
+ 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "into\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+ 
+ #define atomic_inc_return(v)  (atomic_add_return(1, v))
++#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
+ #define atomic_dec_return(v)  (atomic_sub_return(1, v))
+ 
+ /* These are x86-specific, used by some header files */
+@@ -266,6 +461,14 @@ typedef struct {
+ 	u64 __aligned(8) counter;
+ } atomic64_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	u64 __aligned(8) counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
++
+ #define ATOMIC64_INIT(val)	{ (val) }
+ 
+ extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/atomic_64.h linux-2.6.32.12/arch/x86/include/asm/atomic_64.h
+--- linux-2.6.32.12/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/atomic_64.h	2010-04-04 20:46:41.500459645 -0400
+@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_sub_unchecked - subtract the atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
+ static inline int atomic_add_return(int i, atomic_t *v)
+ {
+ 	int __i = i;
+-	asm volatile(LOCK_PREFIX "xaddl %0, %1"
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
+ }
+ 
+ /**
++ * atomic64_read_unchecked - read atomic64 variable
++ * @v: pointer of type atomic64_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ * Doesn't imply a read memory barrier.
++ */
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic64_set - set atomic64 variable
+  * @v: pointer to type atomic64_t
+  * @i: required value
+@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
+ }
+ 
+ /**
++ * atomic64_set_unchecked - set atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic64_add - add integer to atomic64 variable
+  * @i: integer value to add
+  * @v: pointer to type atomic64_t
+@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
+  */
+ static inline void atomic64_add(long i, atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "addq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "er" (i), "m" (v->counter));
++}
++
++/**
++ * atomic64_add_unchecked - add integer to atomic64 variable
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "addq %1,%0"
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
+  */
+ static inline void atomic64_sub(long i, atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subq %1,%0"
++	asm volatile(LOCK_PREFIX "subq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+ }
+@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
+  */
+ static inline void atomic64_inc(atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic64_inc_unchecked - increment atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "incq %0"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
+  */
+ static inline void atomic64_dec(atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decq %0"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decq %0; sete %1"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incq %0; sete %1"
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
+ static inline long atomic64_add_return(long i, atomic64_t *v)
+ {
+ 	long __i = i;
+-	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
++	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movq %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++}
++
++/**
++ * atomic64_add_return_unchecked - add and return
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
++{
++	long __i = i;
++	asm volatile(LOCK_PREFIX "xaddq %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
+ }
+ 
+ #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
++#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
+ #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
+ 
+ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
+@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
+  */
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "er" (a));
++
++		old = atomic64_cmpxchg((v), c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/boot.h linux-2.6.32.12/arch/x86/include/asm/boot.h
+--- linux-2.6.32.12/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/boot.h	2010-04-04 20:46:41.500459645 -0400
+@@ -11,10 +11,15 @@
+ #include <asm/pgtable_types.h>
+ 
+ /* Physical address where kernel should be loaded. */
+-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
++#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
+ 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
+ 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
+ 
++#ifndef __ASSEMBLY__
++extern unsigned char __LOAD_PHYSICAL_ADDR[];
++#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
++#endif
++
+ /* Minimum kernel alignment, as a power of two */
+ #ifdef CONFIG_X86_64
+ #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/cacheflush.h linux-2.6.32.12/arch/x86/include/asm/cacheflush.h
+--- linux-2.6.32.12/arch/x86/include/asm/cacheflush.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/cacheflush.h	2010-04-29 17:46:37.069058404 -0400
+@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
+ static inline unsigned long get_page_memtype(struct page *pg)
+ {
+ 	if (!PageUncached(pg) && !PageWC(pg))
+-		return -1;
++		return ~0UL;
+ 	else if (!PageUncached(pg) && PageWC(pg))
+ 		return _PAGE_CACHE_WC;
+ 	else if (PageUncached(pg) && !PageWC(pg))
+@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
+ 		SetPageWC(pg);
+ 		break;
+ 	default:
+-	case -1:
++	case ~0UL:
+ 		ClearPageUncached(pg);
+ 		ClearPageWC(pg);
+ 		break;
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/cache.h linux-2.6.32.12/arch/x86/include/asm/cache.h
+--- linux-2.6.32.12/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/cache.h	2010-04-04 20:46:41.500459645 -0400
+@@ -8,6 +8,7 @@
+ #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+ 
+ #define __read_mostly __attribute__((__section__(".data.read_mostly")))
++#define __read_only __attribute__((__section__(".data.read_only")))
+ 
+ #ifdef CONFIG_X86_VSMP
+ /* vSMP Internode cacheline shift */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/checksum_32.h linux-2.6.32.12/arch/x86/include/asm/checksum_32.h
+--- linux-2.6.32.12/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/checksum_32.h	2010-04-04 20:46:41.500459645 -0400
+@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
+ 					    int len, __wsum sum,
+ 					    int *src_err_ptr, int *dst_err_ptr);
+ 
++asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
++asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
+ /*
+  *	Note: when you get a NULL pointer exception here this means someone
+  *	passed in an incorrect kernel address to one of these functions.
+@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
+ 						 int *err_ptr)
+ {
+ 	might_sleep();
+-	return csum_partial_copy_generic((__force void *)src, dst,
++	return csum_partial_copy_generic_from_user((__force void *)src, dst,
+ 					 len, sum, err_ptr, NULL);
+ }
+ 
+@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
+ {
+ 	might_sleep();
+ 	if (access_ok(VERIFY_WRITE, dst, len))
+-		return csum_partial_copy_generic(src, (__force void *)dst,
++		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
+ 						 len, sum, NULL, err_ptr);
+ 
+ 	if (len)
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/desc.h linux-2.6.32.12/arch/x86/include/asm/desc.h
+--- linux-2.6.32.12/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/desc.h	2010-04-29 17:46:36.819981711 -0400
+@@ -4,6 +4,7 @@
+ #include <asm/desc_defs.h>
+ #include <asm/ldt.h>
+ #include <asm/mmu.h>
++#include <asm/pgtable.h>
+ #include <linux/smp.h>
+ 
+ static inline void fill_ldt(struct desc_struct *desc,
+@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
+ 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
+ 	desc->type = (info->read_exec_only ^ 1) << 1;
+ 	desc->type |= info->contents << 2;
++	desc->type |= info->seg_not_present ^ 1;
+ 	desc->s = 1;
+ 	desc->dpl = 0x3;
+ 	desc->p = info->seg_not_present ^ 1;
+@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
+ }
+ 
+ extern struct desc_ptr idt_descr;
+-extern gate_desc idt_table[];
+-
+-struct gdt_page {
+-	struct desc_struct gdt[GDT_ENTRIES];
+-} __attribute__((aligned(PAGE_SIZE)));
+-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
++extern gate_desc idt_table[256];
+ 
++extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
+ static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
+ {
+-	return per_cpu(gdt_page, cpu).gdt;
++	return cpu_gdt_table[cpu];
+ }
+ 
+ #ifdef CONFIG_X86_64
+@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
+ static inline void native_write_idt_entry(gate_desc *idt, int entry,
+ 					  const gate_desc *gate)
+ {
++	pax_open_kernel();
+ 	memcpy(&idt[entry], gate, sizeof(*gate));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
+ 					  const void *desc)
+ {
++	pax_open_kernel();
+ 	memcpy(&ldt[entry], desc, 8);
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
+ 					  const void *desc, int type)
+ {
+ 	unsigned int size;
++
+ 	switch (type) {
+ 	case DESC_TSS:
+ 		size = sizeof(tss_desc);
+@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
+ 		size = sizeof(struct desc_struct);
+ 		break;
+ 	}
++
++	pax_open_kernel();
+ 	memcpy(&gdt[entry], desc, size);
++	pax_close_kernel();
+ }
+ 
+ static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
+@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
+ 
+ static inline void native_load_tr_desc(void)
+ {
++	pax_open_kernel();
+ 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_load_gdt(const struct desc_ptr *dtr)
+@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
+ 	unsigned int i;
+ 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+ 
++	pax_open_kernel();
+ 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
+ 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
++	pax_close_kernel();
+ }
+ 
+ #define _LDT_empty(info)				\
+@@ -309,7 +319,7 @@ static inline void set_desc_limit(struct
+ 	desc->limit = (limit >> 16) & 0xf;
+ }
+ 
+-static inline void _set_gate(int gate, unsigned type, void *addr,
++static inline void _set_gate(int gate, unsigned type, const void *addr,
+ 			     unsigned dpl, unsigned ist, unsigned seg)
+ {
+ 	gate_desc s;
+@@ -327,7 +337,7 @@ static inline void _set_gate(int gate, u
+  * Pentium F0 0F bugfix can have resulted in the mapped
+  * IDT being write-protected.
+  */
+-static inline void set_intr_gate(unsigned int n, void *addr)
++static inline void set_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
+@@ -356,19 +366,19 @@ static inline void alloc_intr_gate(unsig
+ /*
+  * This routine sets up an interrupt gate at directory privilege level 3.
+  */
+-static inline void set_system_intr_gate(unsigned int n, void *addr)
++static inline void set_system_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_trap_gate(unsigned int n, void *addr)
++static inline void set_system_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_trap_gate(unsigned int n, void *addr)
++static inline void set_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
+@@ -377,19 +387,31 @@ static inline void set_trap_gate(unsigne
+ static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+-	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
++	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
+ }
+ 
+-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
+ }
+ 
++#ifdef CONFIG_X86_32
++static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
++{
++	struct desc_struct d;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, base, limit, 0xFB, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
++}
++#endif
++
+ #endif /* _ASM_X86_DESC_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/device.h linux-2.6.32.12/arch/x86/include/asm/device.h
+--- linux-2.6.32.12/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/device.h	2010-04-04 20:46:41.500459645 -0400
+@@ -6,7 +6,7 @@ struct dev_archdata {
+ 	void	*acpi_handle;
+ #endif
+ #ifdef CONFIG_X86_64
+-struct dma_map_ops *dma_ops;
++	const struct dma_map_ops *dma_ops;
+ #endif
+ #ifdef CONFIG_DMAR
+ 	void *iommu; /* hook for IOMMU specific extension */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h
+--- linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h	2010-04-04 20:46:41.500459645 -0400
+@@ -25,9 +25,9 @@ extern int iommu_merge;
+ extern struct device x86_dma_fallback_dev;
+ extern int panic_on_overflow;
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #ifdef CONFIG_X86_32
+ 	return dma_ops;
+@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
+ /* Make sure we keep the same behaviour */
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	if (ops->mapping_error)
+ 		return ops->mapping_error(dev, dma_addr);
+ 
+@@ -122,7 +122,7 @@ static inline void *
+ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
+ 		gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *memory;
+ 
+ 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *vaddr, dma_addr_t bus)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	WARN_ON(irqs_disabled());       /* for portability */
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/e820.h linux-2.6.32.12/arch/x86/include/asm/e820.h
+--- linux-2.6.32.12/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/e820.h	2010-04-04 20:46:41.500459645 -0400
+@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
+ #define ISA_END_ADDRESS		0x100000
+ #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
+ 
+-#define BIOS_BEGIN		0x000a0000
++#define BIOS_BEGIN		0x000c0000
+ #define BIOS_END		0x00100000
+ 
+ #ifdef __KERNEL__
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/elf.h linux-2.6.32.12/arch/x86/include/asm/elf.h
+--- linux-2.6.32.12/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/elf.h	2010-04-04 20:58:33.220592413 -0400
+@@ -257,7 +257,25 @@ extern int force_personality32;
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
++#else
+ #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++#ifdef CONFIG_X86_32
++#define PAX_ELF_ET_DYN_BASE	0x10000000UL
++
++#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#else
++#define PAX_ELF_ET_DYN_BASE	0x400000UL
++
++#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#endif
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+@@ -311,8 +329,7 @@ do {									\
+ #define ARCH_DLINFO							\
+ do {									\
+ 	if (vdso_enabled)						\
+-		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
+-			    (unsigned long)current->mm->context.vdso);	\
++		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
+ } while (0)
+ 
+ #define AT_SYSINFO		32
+@@ -323,7 +340,7 @@ do {									\
+ 
+ #endif /* !CONFIG_X86_32 */
+ 
+-#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
++#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
+ 
+ #define VDSO_ENTRY							\
+ 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
+@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
+ extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
+ #define compat_arch_setup_additional_pages	syscall32_setup_pages
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* _ASM_X86_ELF_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/futex.h linux-2.6.32.12/arch/x86/include/asm/futex.h
+--- linux-2.6.32.12/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/futex.h	2010-04-04 20:58:33.220592413 -0400
+@@ -11,17 +11,54 @@
+ #include <asm/processor.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_X86_32
+ #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile(						\
++		     "movw\t%w6, %%ds\n"			\
++		     "1:\t" insn "\n"				\
++		     "2:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%ds\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "3:\tmov\t%3, %1\n"			\
++		     "\tjmp\t2b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 3b)			\
++		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
++
++#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile("movw\t%w7, %%es\n"			\
++		     "1:\tmovl\t%%es:%2, %0\n"			\
++		     "\tmovl\t%0, %3\n"				\
++		     "\t" insn "\n"				\
++		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
++		     "\tjnz\t1b\n"				\
++		     "3:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%es\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "4:\tmov\t%5, %1\n"			\
++		     "\tjmp\t3b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 4b)			\
++		     _ASM_EXTABLE(2b, 4b)			\
++		     : "=&a" (oldval), "=&r" (ret),		\
++		       "+m" (*uaddr), "=&r" (tem)		\
++		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
++#else
++#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\t" insn "\n"				\
+ 		     "2:\t.section .fixup,\"ax\"\n"		\
+ 		     "3:\tmov\t%3, %1\n"			\
+ 		     "\tjmp\t2b\n"				\
+ 		     "\t.previous\n"				\
+ 		     _ASM_EXTABLE(1b, 3b)			\
+-		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "=r" (oldval), "=r" (ret),		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
+ 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
+ 
+ #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\tmovl	%2, %0\n"			\
+ 		     "\tmovl\t%0, %3\n"				\
+ 		     "\t" insn "\n"				\
+@@ -34,10 +71,12 @@
+ 		     _ASM_EXTABLE(1b, 4b)			\
+ 		     _ASM_EXTABLE(2b, 4b)			\
+ 		     : "=&a" (oldval), "=&r" (ret),		\
+-		       "+m" (*uaddr), "=&r" (tem)		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
++		       "=&r" (tem)				\
+ 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
++#endif
+ 
+-static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
++static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
+ 
+ 	switch (op) {
+ 	case FUTEX_OP_SET:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
++#else
+ 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_ADD:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
++				   uaddr, oparg);
++#else
+ 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
+ 				   uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_OR:
+ 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
+@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
+ 	return ret;
+ }
+ 
+-static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
++static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
+ 						int newval)
+ {
+ 
+@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
+ 		return -ENOSYS;
+ #endif
+ 
+-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
++	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ 		return -EFAULT;
+ 
+-	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
+-		     "2:\t.section .fixup, \"ax\"\n"
++	asm volatile(
++#ifdef CONFIG_X86_32
++		     "\tmovw %w5, %%ds\n"
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
++		     "2:\tpushl   %%ss\n"
++		     "\tpopl    %%ds\n"
++#else
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
++		     "2:\n"
++#endif
++		     "\t.section .fixup, \"ax\"\n"
+ 		     "3:\tmov     %2, %0\n"
+ 		     "\tjmp     2b\n"
+ 		     "\t.previous\n"
+ 		     _ASM_EXTABLE(1b, 3b)
++#ifdef CONFIG_X86_32
+ 		     : "=a" (oldval), "+m" (*uaddr)
++		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
++#else
++		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
+ 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
++#endif
+ 		     : "memory"
+ 	);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/i387.h linux-2.6.32.12/arch/x86/include/asm/i387.h
+--- linux-2.6.32.12/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/i387.h	2010-04-04 20:58:33.220592413 -0400
+@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
+ }
+ 
+ /* We need a safe address that is cheap to find and that is already
+-   in L1 during context switch. The best choices are unfortunately
+-   different for UP and SMP */
+-#ifdef CONFIG_SMP
+-#define safe_address (__per_cpu_offset[0])
+-#else
+-#define safe_address (kstat_cpu(0).cpustat.user)
+-#endif
++   in L1 during context switch. */
++#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
+ 
+ /*
+  * These must be called with preempt disabled
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/io_64.h linux-2.6.32.12/arch/x86/include/asm/io_64.h
+--- linux-2.6.32.12/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/io_64.h	2010-04-04 20:46:41.500459645 -0400
+@@ -140,6 +140,17 @@ __OUTS(l)
+ 
+ #include <linux/vmalloc.h>
+ 
++#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
++static inline int valid_phys_addr_range(unsigned long addr, size_t count)
++{
++	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
++static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
++{
++	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
+ #include <asm-generic/iomap.h>
+ 
+ void __memcpy_fromio(void *, unsigned long, unsigned);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/iommu.h linux-2.6.32.12/arch/x86/include/asm/iommu.h
+--- linux-2.6.32.12/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/iommu.h	2010-04-04 20:46:41.500459645 -0400
+@@ -3,7 +3,7 @@
+ 
+ extern void pci_iommu_shutdown(void);
+ extern void no_iommu_init(void);
+-extern struct dma_map_ops nommu_dma_ops;
++extern const struct dma_map_ops nommu_dma_ops;
+ extern int force_iommu, no_iommu;
+ extern int iommu_detected;
+ extern int iommu_pass_through;
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/irqflags.h linux-2.6.32.12/arch/x86/include/asm/irqflags.h
+--- linux-2.6.32.12/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/irqflags.h	2010-04-07 19:33:06.601891934 -0400
+@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
+ 	sti;					\
+ 	sysexit
+ 
++#define GET_CR0_INTO_RDI		mov %cr0, %rdi
++#define SET_RDI_INTO_CR0		mov %rdi, %cr0
++#define GET_CR3_INTO_RDI		mov %cr3, %rdi
++#define SET_RDI_INTO_CR3		mov %rdi, %cr3
++
+ #else
+ #define INTERRUPT_RETURN		iret
+ #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/kvm_host.h linux-2.6.32.12/arch/x86/include/asm/kvm_host.h
+--- linux-2.6.32.12/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:37.497949072 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:57.941485514 -0400
+@@ -532,7 +532,7 @@ struct kvm_x86_ops {
+ 	const struct trace_print_flags *exit_reasons_str;
+ };
+ 
+-extern struct kvm_x86_ops *kvm_x86_ops;
++extern const struct kvm_x86_ops *kvm_x86_ops;
+ 
+ int kvm_mmu_module_init(void);
+ void kvm_mmu_module_exit(void);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/local.h linux-2.6.32.12/arch/x86/include/asm/local.h
+--- linux-2.6.32.12/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/local.h	2010-04-04 20:46:41.500459645 -0400
+@@ -18,26 +18,90 @@ typedef struct {
+ 
+ static inline void local_inc(local_t *l)
+ {
+-	asm volatile(_ASM_INC "%0"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_dec(local_t *l)
+ {
+-	asm volatile(_ASM_DEC "%0"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_add(long i, local_t *l)
+ {
+-	asm volatile(_ASM_ADD "%1,%0"
++	asm volatile(_ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+ 
+ static inline void local_sub(long i, local_t *l)
+ {
+-	asm volatile(_ASM_SUB "%1,%0"
++	asm volatile(_ASM_SUB "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_SUB "%2,%0; sete %1"
++	asm volatile(_ASM_SUB "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_DEC "%0; sete %1"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_INC "%0; sete %1"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_ADD "%2,%0; sets %1"
++	asm volatile(_ASM_ADD "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -133,7 +265,23 @@ static inline long local_add_return(long
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
+-	asm volatile(_ASM_XADD "%0, %1;"
++	asm volatile(_ASM_XADD "%0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_MOV "%0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (i), "+m" (l->a.counter)
+ 		     : : "memory");
+ 	return i + __i;
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h
+--- linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h	2010-04-29 17:46:37.069058404 -0400
+@@ -81,8 +81,8 @@ static inline unsigned char current_lock
+ #else
+ #define lock_cmos_prefix(reg) do {} while (0)
+ #define lock_cmos_suffix(reg) do {} while (0)
+-#define lock_cmos(reg)
+-#define unlock_cmos()
++#define lock_cmos(reg) do {} while (0)
++#define unlock_cmos() do {} while (0)
+ #define do_i_have_lock_cmos() 0
+ #define current_lock_cmos_reg() 0
+ #endif
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/microcode.h linux-2.6.32.12/arch/x86/include/asm/microcode.h
+--- linux-2.6.32.12/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/microcode.h	2010-04-04 20:46:41.500459645 -0400
+@@ -12,13 +12,13 @@ struct device;
+ enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
+ 
+ struct microcode_ops {
+-	enum ucode_state (*request_microcode_user) (int cpu,
++	enum ucode_state (* const request_microcode_user) (int cpu,
+ 				const void __user *buf, size_t size);
+ 
+-	enum ucode_state (*request_microcode_fw) (int cpu,
++	enum ucode_state (* const request_microcode_fw) (int cpu,
+ 				struct device *device);
+ 
+-	void (*microcode_fini_cpu) (int cpu);
++	void (* const microcode_fini_cpu) (int cpu);
+ 
+ 	/*
+ 	 * The generic 'microcode_core' part guarantees that
+@@ -38,18 +38,18 @@ struct ucode_cpu_info {
+ extern struct ucode_cpu_info ucode_cpu_info[];
+ 
+ #ifdef CONFIG_MICROCODE_INTEL
+-extern struct microcode_ops * __init init_intel_microcode(void);
++extern const struct microcode_ops * __init init_intel_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_intel_microcode(void)
++static inline const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return NULL;
+ }
+ #endif /* CONFIG_MICROCODE_INTEL */
+ 
+ #ifdef CONFIG_MICROCODE_AMD
+-extern struct microcode_ops * __init init_amd_microcode(void);
++extern const struct microcode_ops * __init init_amd_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_amd_microcode(void)
++static inline const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/mman.h linux-2.6.32.12/arch/x86/include/asm/mman.h
+--- linux-2.6.32.12/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/mman.h	2010-04-04 20:46:41.500459645 -0400
+@@ -5,4 +5,14 @@
+ 
+ #include <asm-generic/mman.h>
+ 
++#ifdef __KERNEL__
++#ifndef __ASSEMBLY__
++#ifdef CONFIG_X86_32
++#define arch_mmap_check	i386_mmap_check
++int i386_mmap_check(unsigned long addr, unsigned long len,
++		unsigned long flags);
++#endif
++#endif
++#endif
++
+ #endif /* _ASM_X86_MMAN_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/mmu_context.h linux-2.6.32.12/arch/x86/include/asm/mmu_context.h
+--- linux-2.6.32.12/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/mmu_context.h	2010-04-29 17:46:36.829235058 -0400
+@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
+ 
+ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+ {
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	unsigned int i;
++	pgd_t *pgd;
++
++	pax_open_kernel();
++	pgd = get_cpu_pgd(smp_processor_id());
++	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
++		if (paravirt_enabled())
++			set_pgd(pgd+i, native_make_pgd(0));
++		else
++			pgd[i] = native_make_pgd(0);
++	pax_close_kernel();
++#endif
++
+ #ifdef CONFIG_SMP
+ 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
+@@ -34,27 +49,70 @@ static inline void switch_mm(struct mm_s
+ 			     struct task_struct *tsk)
+ {
+ 	unsigned cpu = smp_processor_id();
++#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
++	int tlbstate = TLBSTATE_OK;
++#endif
+ 
+ 	if (likely(prev != next)) {
+ 		/* stop flush ipis for the previous mm */
+ 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ #ifdef CONFIG_SMP
++#ifdef CONFIG_X86_32
++		tlbstate = percpu_read(cpu_tlbstate.state);
++#endif
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		percpu_write(cpu_tlbstate.active_mm, next);
+ #endif
+ 		cpumask_set_cpu(cpu, mm_cpumask(next));
+ 
+ 		/* Re-load page tables */
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#else
+ 		load_cr3(next->pgd);
++#endif
+ 
+ 		/*
+ 		 * load the LDT, if the LDT is different:
+ 		 */
+ 		if (unlikely(prev->context.ldt != next->context.ldt))
+ 			load_LDT_nolock(&next->context);
+-	}
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		if (!nx_enabled) {
++			smp_mb__before_clear_bit();
++			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
++			smp_mb__after_clear_bit();
++			cpu_set(cpu, next->context.cpu_user_cs_mask);
++		}
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
++			     prev->context.user_cs_limit != next->context.user_cs_limit))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
+ #ifdef CONFIG_SMP
++		else if (unlikely(tlbstate != TLBSTATE_OK))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++#endif
++
++	}
+ 	else {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#endif
++
++#ifdef CONFIG_SMP
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
+ 
+@@ -63,11 +121,28 @@ static inline void switch_mm(struct mm_s
+ 			 * tlb flush IPI delivery. We must reload CR3
+ 			 * to make sure to use no freed page tables.
+ 			 */
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 			load_cr3(next->pgd);
++#endif
++
+ 			load_LDT_nolock(&next->context);
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++			if (!nx_enabled)
++				cpu_set(cpu, next->context.cpu_user_cs_mask);
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
++#endif
++				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++
+ 		}
+-	}
+ #endif
++	}
+ }
+ 
+ #define activate_mm(prev, next)			\
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/mmu.h linux-2.6.32.12/arch/x86/include/asm/mmu.h
+--- linux-2.6.32.12/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/mmu.h	2010-04-04 20:46:41.500459645 -0400
+@@ -9,10 +9,23 @@
+  * we put the segment information here.
+  */
+ typedef struct {
+-	void *ldt;
++	struct desc_struct *ldt;
+ 	int size;
+ 	struct mutex lock;
+-	void *vdso;
++	unsigned long vdso;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	unsigned long user_cs_base;
++	unsigned long user_cs_limit;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++	cpumask_t cpu_user_cs_mask;
++#endif
++
++#endif
++#endif
++
+ } mm_context_t;
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/module.h linux-2.6.32.12/arch/x86/include/asm/module.h
+--- linux-2.6.32.12/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/module.h	2010-04-04 21:01:05.305858196 -0400
+@@ -59,13 +59,31 @@
+ #error unknown processor family
+ #endif
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define MODULE_PAX_UDEREF "UDEREF "
++#else
++#define MODULE_PAX_UDEREF ""
++#endif
++
+ #ifdef CONFIG_X86_32
+ # ifdef CONFIG_4KSTACKS
+ #  define MODULE_STACKSIZE "4KSTACKS "
+ # else
+ #  define MODULE_STACKSIZE ""
+ # endif
+-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
++# ifdef CONFIG_PAX_KERNEXEC
++#  define MODULE_PAX_KERNEXEC "KERNEXEC "
++# else
++#  define MODULE_PAX_KERNEXEC ""
++# endif
++# ifdef CONFIG_GRKERNSEC
++#  define MODULE_GRSEC "GRSECURITY "
++# else
++#  define MODULE_GRSEC ""
++# endif
++# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
++#else
++# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
+ #endif
+ 
+ #endif /* _ASM_X86_MODULE_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/page_32_types.h linux-2.6.32.12/arch/x86/include/asm/page_32_types.h
+--- linux-2.6.32.12/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/page_32_types.h	2010-04-04 20:46:41.505526780 -0400
+@@ -15,6 +15,10 @@
+  */
+ #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
++#endif
++
+ #ifdef CONFIG_4KSTACKS
+ #define THREAD_ORDER	0
+ #else
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/page_64_types.h linux-2.6.32.12/arch/x86/include/asm/page_64_types.h
+--- linux-2.6.32.12/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/page_64_types.h	2010-04-04 20:46:41.505526780 -0400
+@@ -39,6 +39,9 @@
+ #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
+ #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
+ #define __PHYSICAL_MASK_SHIFT	46
+ #define __VIRTUAL_MASK_SHIFT	47
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/paravirt.h linux-2.6.32.12/arch/x86/include/asm/paravirt.h
+--- linux-2.6.32.12/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/paravirt.h	2010-04-07 16:58:23.343008831 -0400
+@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
+ 	pv_mmu_ops.set_fixmap(idx, phys, flags);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long pax_open_kernel(void)
++{
++	return pv_mmu_ops.pax_open_kernel();
++}
++
++static inline unsigned long pax_close_kernel(void)
++{
++	return pv_mmu_ops.pax_close_kernel();
++}
++#else
++static inline unsigned long pax_open_kernel(void) { return 0; }
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
+ 
+ static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
+@@ -945,7 +960,7 @@ extern void default_banner(void);
+ 
+ #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
+ #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
+-#define PARA_INDIRECT(addr)	*%cs:addr
++#define PARA_INDIRECT(addr)	*%ss:addr
+ #endif
+ 
+ #define INTERRUPT_RETURN						\
+@@ -1022,6 +1037,21 @@ extern void default_banner(void);
+ 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
+ 		  CLBR_NONE,						\
+ 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
++
++#define GET_CR0_INTO_RDI				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR0				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++
++#define GET_CR3_INTO_RDI				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR3				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
++
+ #endif	/* CONFIG_X86_32 */
+ 
+ #endif /* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h
+--- linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h	2010-04-04 20:46:41.505526780 -0400
+@@ -316,6 +316,12 @@ struct pv_mmu_ops {
+ 	   an mfn.  We can tell which is which from the index. */
+ 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
+ 			   phys_addr_t phys, pgprot_t flags);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long (*pax_open_kernel)(void);
++	unsigned long (*pax_close_kernel)(void);
++#endif
++
+ };
+ 
+ struct raw_spinlock;
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pci_x86.h linux-2.6.32.12/arch/x86/include/asm/pci_x86.h
+--- linux-2.6.32.12/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pci_x86.h	2010-04-04 20:46:41.505526780 -0400
+@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+ 
+ struct pci_raw_ops {
+-	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val);
+-	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 val);
+ };
+ 
+-extern struct pci_raw_ops *raw_pci_ops;
+-extern struct pci_raw_ops *raw_pci_ext_ops;
++extern const struct pci_raw_ops *raw_pci_ops;
++extern const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+-extern struct pci_raw_ops pci_direct_conf1;
++extern const struct pci_raw_ops pci_direct_conf1;
+ extern bool port_cf9_safe;
+ 
+ /* arch_initcall level */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgalloc.h linux-2.6.32.12/arch/x86/include/asm/pgalloc.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgalloc.h	2010-04-04 20:46:41.505526780 -0400
+@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
+ 				       pmd_t *pmd, pte_t *pte)
+ {
+ 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
++	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
++}
++
++static inline void pmd_populate_user(struct mm_struct *mm,
++				       pmd_t *pmd, pte_t *pte)
++{
++	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
+ 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h	2010-04-04 20:46:41.505526780 -0400
+@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h	2010-04-04 20:46:41.505526780 -0400
+@@ -26,8 +26,6 @@
+ struct mm_struct;
+ struct vm_area_struct;
+ 
+-extern pgd_t swapper_pg_dir[1024];
+-
+ static inline void pgtable_cache_init(void) { }
+ static inline void check_pgt_cache(void) { }
+ void paging_init(void);
+@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
+ # include <asm/pgtable-2level.h>
+ #endif
+ 
++extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
++#ifdef CONFIG_X86_PAE
++extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
++#endif
++
+ #if defined(CONFIG_HIGHPTE)
+ #define __KM_PTE			\
+ 	(in_nmi() ? KM_NMI_PTE : 	\
+@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
+ /* Clear a kernel PTE and flush it from the TLB */
+ #define kpte_clear_flush(ptep, vaddr)		\
+ do {						\
++	pax_open_kernel();			\
+ 	pte_clear(&init_mm, (vaddr), (ptep));	\
++	pax_close_kernel();			\
+ 	__flush_tlb_one((vaddr));		\
+ } while (0)
+ 
+@@ -84,6 +89,9 @@ do {						\
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
++#define HAVE_ARCH_UNMAPPED_AREA
++#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
++
+ /*
+  * kern_addr_valid() is (1) for FLATMEM and (0) for
+  * SPARSEMEM and DISCONTIGMEM
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h	2010-04-04 20:46:41.505526780 -0400
+@@ -8,7 +8,7 @@
+  */
+ #ifdef CONFIG_X86_PAE
+ # include <asm/pgtable-3level_types.h>
+-# define PMD_SIZE	(1UL << PMD_SHIFT)
++# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
+ # define PMD_MASK	(~(PMD_SIZE - 1))
+ #else
+ # include <asm/pgtable-2level_types.h>
+@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
+ # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifndef __ASSEMBLY__
++extern unsigned char MODULES_EXEC_VADDR[];
++extern unsigned char MODULES_EXEC_END[];
++#endif
++#include <asm/boot.h>
++#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
++#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
++#else
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++#endif
++
+ #define MODULES_VADDR	VMALLOC_START
+ #define MODULES_END	VMALLOC_END
+ #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h	2010-04-04 20:46:41.505526780 -0400
+@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pud(pud_t *pudp, pud_t pud)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
++	pax_close_kernel();
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h	2010-04-04 20:58:33.220592413 -0400
+@@ -16,10 +16,13 @@
+ 
+ extern pud_t level3_kernel_pgt[512];
+ extern pud_t level3_ident_pgt[512];
++extern pud_t level3_vmalloc_pgt[512];
++extern pud_t level3_vmemmap_pgt[512];
++extern pud_t level2_vmemmap_pgt[512];
+ extern pmd_t level2_kernel_pgt[512];
+ extern pmd_t level2_fixmap_pgt[512];
+-extern pmd_t level2_ident_pgt[512];
+-extern pgd_t init_level4_pgt[];
++extern pmd_t level2_ident_pgt[512*2];
++extern pgd_t init_level4_pgt[512];
+ 
+ #define swapper_pg_dir init_level4_pgt
+ 
+@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pmd_clear(pmd_t *pmd)
+@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
+ 
+ static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
++	pax_open_kernel();
+ 	*pgdp = pgd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pgd_clear(pgd_t *pgd)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	native_set_pgd(pgd, native_make_pgd(0));
++#endif
++
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable.h linux-2.6.32.12/arch/x86/include/asm/pgtable.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable.h	2010-04-04 20:58:33.220592413 -0400
+@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
+ 
+ #define arch_end_context_switch(prev)	do {} while(0)
+ 
++#define pax_open_kernel()	native_pax_open_kernel()
++#define pax_close_kernel()	native_pax_close_kernel()
+ #endif	/* CONFIG_PARAVIRT */
+ 
++#define  __HAVE_ARCH_PAX_OPEN_KERNEL
++#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
++
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long native_pax_open_kernel(void)
++{
++	unsigned long cr0;
++
++	preempt_disable();
++	barrier();
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(cr0 & X86_CR0_WP));
++	write_cr0(cr0);
++	return cr0 ^ X86_CR0_WP;
++}
++
++static inline unsigned long native_pax_close_kernel(void)
++{
++	unsigned long cr0;
++
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
++	write_cr0(cr0);
++	barrier();
++	preempt_enable_no_resched();
++	return cr0 ^ X86_CR0_WP;
++}
++#else
++static inline unsigned long native_pax_open_kernel(void) { return 0; }
++static inline unsigned long native_pax_close_kernel(void) { return 0; }
++#endif
++
+ /*
+  * The following only work if pte_present() is true.
+  * Undefined behaviour if not..
+  */
++static inline int pte_user(pte_t pte)
++{
++	return pte_val(pte) & _PAGE_USER;
++}
++
+ static inline int pte_dirty(pte_t pte)
+ {
+ 	return pte_flags(pte) & _PAGE_DIRTY;
+@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
+ 	return pte_clear_flags(pte, _PAGE_RW);
+ }
+ 
++static inline pte_t pte_mkread(pte_t pte)
++{
++	return __pte(pte_val(pte) | _PAGE_USER);
++}
++
+ static inline pte_t pte_mkexec(pte_t pte)
+ {
+-	return pte_clear_flags(pte, _PAGE_NX);
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_clear_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_set_flags(pte, _PAGE_USER);
++}
++
++static inline pte_t pte_exprotect(pte_t pte)
++{
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_set_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_clear_flags(pte, _PAGE_USER);
+ }
+ 
+ static inline pte_t pte_mkdirty(pte_t pte)
+@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
+ #endif
+ 
+ #ifndef __ASSEMBLY__
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
++static inline pgd_t *get_cpu_pgd(unsigned int cpu)
++{
++	return cpu_pgd[cpu];
++}
++#endif
++
+ #include <linux/mm_types.h>
+ 
+ static inline int pte_none(pte_t pte)
+@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
+ 
+ static inline int pgd_bad(pgd_t pgd)
+ {
+-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
++	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
+ }
+ 
+ static inline int pgd_none(pgd_t pgd)
+@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
+  * pgd_offset() returns a (pgd_t *)
+  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
+  */
+-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
++#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
++#endif
++
+ /*
+  * a shortcut which implies the use of the kernel's pgd, instead
+  * of a process's
+@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
+ #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
+ #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
+ 
++#ifdef CONFIG_X86_32
++#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
++#else
++#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
++#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
++#else
++#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
++#endif
++
++#endif
++
+ #ifndef __ASSEMBLY__
+ 
+ extern int direct_gbpages;
+@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
+  * dst and src can be on the same page, but the range must not overlap,
+  * and must not cross a page boundary.
+  */
+-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
++static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
+ {
+-       memcpy(dst, src, count * sizeof(pgd_t));
++	pax_open_kernel();
++	while (count--)
++		*dst++ = *src++;
++	pax_close_kernel();
+ }
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++#endif
+ 
+ #include <asm-generic/pgtable.h>
+ #endif	/* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h
+--- linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h	2010-04-04 20:46:41.505526780 -0400
+@@ -16,12 +16,11 @@
+ #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
+ #define _PAGE_BIT_PAT		7	/* on 4KB pages */
+ #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
+-#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
++#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
+ #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
+ #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
+ #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
+-#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
+-#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
++#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
+ #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
+ 
+ /* If _PAGE_BIT_PRESENT is clear, we use these: */
+@@ -39,7 +38,6 @@
+ #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
+ #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
+ #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
+-#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
+ #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
+ #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
+ #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
+@@ -55,8 +53,10 @@
+ 
+ #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
+-#else
++#elif defined(CONFIG_KMEMCHECK)
+ #define _PAGE_NX	(_AT(pteval_t, 0))
++#else
++#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
+ #endif
+ 
+ #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
+@@ -93,6 +93,9 @@
+ #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
+ 					 _PAGE_ACCESSED)
+ 
++#define PAGE_READONLY_NOEXEC PAGE_READONLY
++#define PAGE_SHARED_NOEXEC PAGE_SHARED
++
+ #define __PAGE_KERNEL_EXEC						\
+ 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
+ #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
+@@ -103,8 +106,8 @@
+ #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
+ #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
+ #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
+-#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
+-#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
++#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
++#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
+ #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
+@@ -163,8 +166,8 @@
+  * bits are combined, this will alow user to access the high address mapped
+  * VDSO in the presence of CONFIG_COMPAT_VDSO
+  */
+-#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
+-#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
++#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
++#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
+ #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
+ #endif
+ 
+@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
+ 
+ extern pteval_t __supported_pte_mask;
+ extern void set_nx(void);
++
++#ifdef CONFIG_X86_32
++#ifdef CONFIG_X86_PAE
+ extern int nx_enabled;
++#else
++#define nx_enabled (0)
++#endif
++#else
++#define nx_enabled (1)
++#endif
+ 
+ #define pgprot_writecombine	pgprot_writecombine
+ extern pgprot_t pgprot_writecombine(pgprot_t prot);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/processor.h linux-2.6.32.12/arch/x86/include/asm/processor.h
+--- linux-2.6.32.12/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/processor.h	2010-04-04 20:58:33.220592413 -0400
+@@ -272,7 +272,7 @@ struct tss_struct {
+ 
+ } ____cacheline_aligned;
+ 
+-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
++extern struct tss_struct init_tss[NR_CPUS];
+ 
+ /*
+  * Save the original ist values for checking stack pointers during debugging
+@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
+  */
+ #define TASK_SIZE		PAGE_OFFSET
+ #define TASK_SIZE_MAX		TASK_SIZE
++
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
++#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
++#else
+ #define STACK_TOP		TASK_SIZE
+-#define STACK_TOP_MAX		STACK_TOP
++#endif
++
++#define STACK_TOP_MAX		TASK_SIZE
+ 
+ #define INIT_THREAD  {							  \
+ 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
+@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
+  */
+ #define INIT_TSS  {							  \
+ 	.x86_tss = {							  \
+-		.sp0		= sizeof(init_stack) + (long)&init_stack, \
++		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
+ 		.ss0		= __KERNEL_DS,				  \
+ 		.ss1		= __KERNEL_CS,				  \
+ 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
+@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
+ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+ 
+ #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
+-#define KSTK_TOP(info)                                                 \
+-({                                                                     \
+-       unsigned long *__ptr = (unsigned long *)(info);                 \
+-       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
+-})
++#define KSTK_TOP(info)         ((info)->task.thread.sp0)
+ 
+ /*
+  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
+@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
+ #define task_pt_regs(task)                                             \
+ ({                                                                     \
+        struct pt_regs *__regs__;                                       \
+-       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
++       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
+        __regs__ - 1;                                                   \
+ })
+ 
+@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
+ /*
+  * User space process size. 47bits minus one guard page.
+  */
+-#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
++#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
+ 
+ /* This decides where the kernel will search for a free chunk of vm
+  * space during mmap's.
+  */
+ #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
+-					0xc0000000 : 0xFFFFe000)
++					0xc0000000 : 0xFFFFf000)
+ 
+ #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
+ 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
+@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
+  */
+ #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
++#endif
++
+ #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
+ 
+ /* Get/set a process' ability to use the timestamp counter instruction */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/ptrace.h linux-2.6.32.12/arch/x86/include/asm/ptrace.h
+--- linux-2.6.32.12/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/ptrace.h	2010-04-04 20:46:41.505526780 -0400
+@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
+ }
+ 
+ /*
+- * user_mode_vm(regs) determines whether a register set came from user mode.
++ * user_mode(regs) determines whether a register set came from user mode.
+  * This is true if V8086 mode was enabled OR if the register set was from
+  * protected mode with RPL-3 CS value.  This tricky test checks that with
+  * one comparison.  Many places in the kernel can bypass this full check
+- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
++ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
++ * be used.
+  */
+-static inline int user_mode(struct pt_regs *regs)
++static inline int user_mode_novm(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
+ #else
+-	return !!(regs->cs & 3);
++	return !!(regs->cs & SEGMENT_RPL_MASK);
+ #endif
+ }
+ 
+-static inline int user_mode_vm(struct pt_regs *regs)
++static inline int user_mode(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
+ 		USER_RPL;
+ #else
+-	return user_mode(regs);
++	return user_mode_novm(regs);
+ #endif
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/reboot.h linux-2.6.32.12/arch/x86/include/asm/reboot.h
+--- linux-2.6.32.12/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/reboot.h	2010-04-04 20:46:41.505526780 -0400
+@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
+ 
+ void native_machine_crash_shutdown(struct pt_regs *regs);
+ void native_machine_shutdown(void);
+-void machine_real_restart(const unsigned char *code, int length);
++void machine_real_restart(const unsigned char *code, unsigned int length);
+ 
+ typedef void (*nmi_shootdown_cb)(int, struct die_args*);
+ void nmi_shootdown_cpus(nmi_shootdown_cb callback);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/rwsem.h linux-2.6.32.12/arch/x86/include/asm/rwsem.h
+--- linux-2.6.32.12/arch/x86/include/asm/rwsem.h	2010-04-29 17:49:37.501451369 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/rwsem.h	2010-04-29 20:01:51.893191958 -0400
+@@ -118,10 +118,26 @@ static inline void __down_read(struct rw
+ {
+ 	asm volatile("# beginning down_read\n\t"
+ 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* adds 0x00000001, returns the old value */
+-		     "  jns        1f\n"
++		     "  jns        2f\n"
+ 		     "  call call_rwsem_down_read_failed\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending down_read\n\t"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem)
+@@ -136,13 +152,29 @@ static inline int __down_read_trylock(st
+ 	rwsem_count_t result, tmp;
+ 	asm volatile("# beginning __down_read_trylock\n\t"
+ 		     "  mov          %0,%1\n\t"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "  mov          %1,%2\n\t"
+ 		     "  add          %3,%2\n\t"
+-		     "  jle	     2f\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "sub %3,%2\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "  jle	     3f\n\t"
+ 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
+-		     "  jnz	     1b\n\t"
+-		     "2:\n\t"
++		     "  jnz	     2b\n\t"
++		     "3:\n\t"
+ 		     "# ending __down_read_trylock\n\t"
+ 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
+ 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
+@@ -160,12 +192,28 @@ static inline void __down_write_nested(s
+ 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
+ 	asm volatile("# beginning down_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtract 0x0000ffff, returns the old value */
+ 		     "  test      %1,%1\n\t"
+ 		     /* was the count 0 before? */
+-		     "  jz        1f\n"
++		     "  jz        2f\n"
+ 		     "  call call_rwsem_down_write_failed\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending down_write"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -198,10 +246,26 @@ static inline void __up_read(struct rw_s
+ 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
+ 	asm volatile("# beginning __up_read\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtracts 1, returns the old value */
+-		     "  jns        1f\n\t"
++		     "  jns        2f\n\t"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending __up_read\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -216,11 +280,27 @@ static inline void __up_write(struct rw_
+ 	rwsem_count_t tmp;
+ 	asm volatile("# beginning __up_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* tries to transition
+ 			0xffff0001 -> 0x00000000 */
+-		     "  jz       1f\n"
++		     "  jz       2f\n"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __up_write\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (-RWSEM_ACTIVE_WRITE_BIAS)
+@@ -234,13 +314,29 @@ static inline void __downgrade_write(str
+ {
+ 	asm volatile("# beginning __downgrade_write\n\t"
+ 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /*
+ 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
+ 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
+ 		      */
+-		     "  jns       1f\n\t"
++		     "  jns       2f\n\t"
+ 		     "  call call_rwsem_downgrade_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __downgrade_write\n"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem), "er" (-RWSEM_WAITING_BIAS)
+@@ -253,7 +349,23 @@ static inline void __downgrade_write(str
+ static inline void rwsem_atomic_add(rwsem_count_t delta,
+ 				    struct rw_semaphore *sem)
+ {
+-	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
++	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (sem->count)
+ 		     : "er" (delta));
+ }
+@@ -266,7 +378,23 @@ static inline rwsem_count_t rwsem_atomic
+ {
+ 	rwsem_count_t tmp = delta;
+ 
+-	asm volatile(LOCK_PREFIX "xadd %0,%1"
++	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (tmp), "+m" (sem->count)
+ 		     : : "memory");
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/segment.h linux-2.6.32.12/arch/x86/include/asm/segment.h
+--- linux-2.6.32.12/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/segment.h	2010-04-04 20:46:41.505526780 -0400
+@@ -62,8 +62,8 @@
+  *  26 - ESPFIX small SS
+  *  27 - per-cpu			[ offset to per-cpu data area ]
+  *  28 - stack_canary-20		[ for stack protector ]
+- *  29 - unused
+- *  30 - unused
++ *  29 - PCI BIOS CS
++ *  30 - PCI BIOS DS
+  *  31 - TSS for double fault handler
+  */
+ #define GDT_ENTRY_TLS_MIN	6
+@@ -77,6 +77,8 @@
+ 
+ #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
++
+ #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
+ 
+ #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
+@@ -88,7 +90,7 @@
+ #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
+ #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
+ 
+-#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
++#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
+ #ifdef CONFIG_SMP
+ #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
+ #else
+@@ -102,6 +104,12 @@
+ #define __KERNEL_STACK_CANARY		0
+ #endif
+ 
++#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
++#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
++
++#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
++#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
++
+ #define GDT_ENTRY_DOUBLEFAULT_TSS	31
+ 
+ /*
+@@ -139,7 +147,7 @@
+  */
+ 
+ /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
+-#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
++#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
+ 
+ 
+ #else
+@@ -163,6 +171,8 @@
+ #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
+ #define __USER32_DS	__USER_DS
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
++
+ #define GDT_ENTRY_TSS 8	/* needs two entries */
+ #define GDT_ENTRY_LDT 10 /* needs two entries */
+ #define GDT_ENTRY_TLS_MIN 12
+@@ -183,6 +193,7 @@
+ #endif
+ 
+ #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
++#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
+ #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
+ #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
+ #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/spinlock.h linux-2.6.32.12/arch/x86/include/asm/spinlock.h
+--- linux-2.6.32.12/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/spinlock.h	2010-04-04 20:46:41.505526780 -0400
+@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
+ static inline void __raw_read_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
+-		     "jns 1f\n"
+-		     "call __read_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl $1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jns 2f\n"
++		     "call __read_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw) : "memory");
+ }
+ 
+ static inline void __raw_write_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
+-		     "jz 1f\n"
+-		     "call __write_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl %1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jz 2f\n"
++		     "call __write_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
+ 
+ static inline void __raw_read_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     :"+m" (rw->lock) : : "memory");
+ }
+ 
+ static inline void __raw_write_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1, %0"
++	asm volatile(LOCK_PREFIX "addl %1, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/system.h linux-2.6.32.12/arch/x86/include/asm/system.h
+--- linux-2.6.32.12/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/system.h	2010-04-04 20:46:41.505526780 -0400
+@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
+ {
+ 	unsigned long __limit;
+ 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
+-	return __limit + 1;
++	return __limit;
+ }
+ 
+ static inline void native_clts(void)
+@@ -340,7 +340,7 @@ void enable_hlt(void);
+ 
+ void cpu_idle_wait(void);
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ~0xfUL)
+ extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
+ 
+ void default_idle(void);
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h
+--- linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h	2010-04-04 20:46:41.505526780 -0400
+@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
+ static __always_inline unsigned long __must_check
+ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
+ 	return __copy_to_user_ll(to, from, n);
+ }
+ 
+@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
+ static __always_inline unsigned long
+ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	/* Avoid zeroing the tail if the copy fails..
+ 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
+ 	 * but as the zeroing behaviour is only significant when n is not
+@@ -138,6 +146,10 @@ static __always_inline unsigned long
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
+ 	return __copy_from_user_ll(to, from, n);
+ }
+ 
+@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
+ 				const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -182,14 +200,62 @@ static __always_inline unsigned long
+ __copy_from_user_inatomic_nocache(void *to, const void __user *from,
+ 				  unsigned long n)
+ {
+-       return __copy_from_user_ll_nocache_nozero(to, from, n);
++	if ((long)n < 0)
++		return n;
++
++	return __copy_from_user_ll_nocache_nozero(to, from, n);
++}
++
++/**
++ * copy_to_user: - Copy a block of data into user space.
++ * @to:   Destination address, in user space.
++ * @from: Source address, in kernel space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from kernel space to user space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ */
++static __always_inline unsigned long __must_check
++copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if (access_ok(VERIFY_WRITE, to, n))
++		n = __copy_to_user(to, from, n);
++	return n;
++}
++
++/**
++ * copy_from_user: - Copy a block of data from user space.
++ * @to:   Destination address, in kernel space.
++ * @from: Source address, in user space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from user space to kernel space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ *
++ * If some data could not be copied, this function will pad the copied
++ * data to the requested size using zero bytes.
++ */
++static __always_inline unsigned long __must_check
++copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if (access_ok(VERIFY_READ, from, n))
++		n = __copy_from_user(to, from, n);
++	else if ((long)n > 0) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		memset(to, 0, n);
++	}
++	return n;
+ }
+ 
+-unsigned long __must_check copy_to_user(void __user *to,
+-					const void *from, unsigned long n);
+-unsigned long __must_check copy_from_user(void *to,
+-					  const void __user *from,
+-					  unsigned long n);
+ long __must_check strncpy_from_user(char *dst, const char __user *src,
+ 				    long count);
+ long __must_check __strncpy_from_user(char *dst,
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h
+--- linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h	2010-04-04 20:58:33.220592413 -0400
+@@ -9,6 +9,9 @@
+ #include <linux/prefetch.h>
+ #include <linux/lockdep.h>
+ #include <asm/page.h>
++#include <asm/pgtable.h>
++
++#define set_fs(x)	(current_thread_info()->addr_limit = (x))
+ 
+ /*
+  * Copy To/From Userspace
+@@ -19,20 +22,24 @@ __must_check unsigned long
+ copy_user_generic(void *to, const void *from, unsigned len);
+ 
+ __must_check unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned len);
+-__must_check unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned len);
+-__must_check unsigned long
+ copy_in_user(void __user *to, const void __user *from, unsigned len);
+ 
+ static __always_inline __must_check
+-int __copy_from_user(void *dst, const void __user *src, unsigned size)
++unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(dst, size, false);
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
+ 			      ret, "b", "b", "=q", 1);
+@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
+ 			       ret, "q", "", "=r", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_to_user(void __user *dst, const void *src, unsigned size)
++unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(src, size, true);
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
++	}
+ 	switch (size) {
+ 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
+ 			      ret, "b", "b", "iq", 1);
+@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
+ 			       ret, "q", "", "er", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
++unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
++{
++	if (access_ok(VERIFY_WRITE, to, len))
++		len = __copy_to_user(to, from, len);
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
++{
++	if ((int)len < 0)
++		return len;
++
++	if (access_ok(VERIFY_READ, from, len))
++		len = __copy_from_user(to, from, len);
++	else if ((int)len > 0) {
++		if (!__builtin_constant_p(len))
++			check_object_size(to, len, false);
++		memset(to, 0, len);
++	}
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1: {
+ 		u8 tmp;
+@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
+ 		return ret;
+ 	}
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
+ 	}
+@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
+ __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
+ 					    unsigned size);
+ 
+-static __must_check __always_inline int
++static __must_check __always_inline unsigned long
+ __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return copy_user_generic((__force void *)dst, src, size);
+ }
+ 
+-extern long __copy_user_nocache(void *dst, const void __user *src,
++extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
+ 				unsigned size, int zerorest);
+ 
+-static inline int
+-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
++static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
+ {
+ 	might_sleep();
++
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 1);
+ }
+ 
+-static inline int
+-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
++static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
+ 				  unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 0);
+ }
+ 
+-unsigned long
++extern unsigned long
+ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
+ 
+ #endif /* _ASM_X86_UACCESS_64_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess.h linux-2.6.32.12/arch/x86/include/asm/uaccess.h
+--- linux-2.6.32.12/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/uaccess.h	2010-04-04 20:58:33.220592413 -0400
+@@ -8,8 +8,11 @@
+ #include <linux/thread_info.h>
+ #include <linux/prefetch.h>
+ #include <linux/string.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
+ #include <asm/asm.h>
+ #include <asm/page.h>
++#include <asm/segment.h>
+ 
+ #define VERIFY_READ 0
+ #define VERIFY_WRITE 1
+@@ -29,7 +32,12 @@
+ 
+ #define get_ds()	(KERNEL_DS)
+ #define get_fs()	(current_thread_info()->addr_limit)
++#ifdef CONFIG_X86_32
++void __set_fs(mm_segment_t x, int cpu);
++void set_fs(mm_segment_t x);
++#else
+ #define set_fs(x)	(current_thread_info()->addr_limit = (x))
++#endif
+ 
+ #define segment_eq(a, b)	((a).seg == (b).seg)
+ 
+@@ -77,7 +85,33 @@
+  * checks that the pointer is in the user space range - after calling
+  * this function, memory access functions may still return -EFAULT.
+  */
+-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define access_ok(type, addr, size)					\
++({									\
++	long __size = size;						\
++	unsigned long __addr = (unsigned long)addr;			\
++	unsigned long __addr_ao = __addr & PAGE_MASK;			\
++	unsigned long __end_ao = __addr + __size - 1;			\
++	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
++	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
++		while(__addr_ao <= __end_ao) {				\
++			char __c_ao;					\
++			__addr_ao += PAGE_SIZE;				\
++			if (__size > PAGE_SIZE)				\
++				cond_resched();				\
++			if (__get_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			if (type != VERIFY_WRITE) {			\
++				__addr = __addr_ao;			\
++				continue;				\
++			}						\
++			if (__put_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			__addr = __addr_ao;				\
++		}							\
++	}								\
++	__ret_ao;							\
++})
+ 
+ /*
+  * The exception table consists of pairs of addresses: the first is the
+@@ -183,13 +217,21 @@ extern int __get_user_bad(void);
+ 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
+ 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
+ 
+-
++#ifdef CONFIG_X86_32
++#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
++#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
++#else
++#define _ASM_LOAD_USER_DS(ds)
++#define _ASM_LOAD_KERNEL_DS
++#endif
+ 
+ #ifdef CONFIG_X86_32
+ #define __put_user_asm_u64(x, addr, err, errret)			\
+-	asm volatile("1:	movl %%eax,0(%2)\n"			\
+-		     "2:	movl %%edx,4(%2)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	movl %%eax,%%ds:0(%2)\n"		\
++		     "2:	movl %%edx,%%ds:4(%2)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "4:	movl %3,%0\n"				\
+ 		     "	jmp 3b\n"					\
+@@ -197,15 +239,18 @@ extern int __get_user_bad(void);
+ 		     _ASM_EXTABLE(1b, 4b)				\
+ 		     _ASM_EXTABLE(2b, 4b)				\
+ 		     : "=r" (err)					\
+-		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
++		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex_u64(x, addr)					\
+-	asm volatile("1:	movl %%eax,0(%1)\n"			\
+-		     "2:	movl %%edx,4(%1)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	movl %%eax,%%ds:0(%1)\n"		\
++		     "2:	movl %%edx,%%ds:4(%1)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+ 		     _ASM_EXTABLE(2b, 3b - 2b)				\
+-		     : : "A" (x), "r" (addr))
++		     : : "A" (x), "r" (addr), "r"(__USER_DS))
+ 
+ #define __put_user_x8(x, ptr, __ret_pu)				\
+ 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
+@@ -374,16 +419,18 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+-		     : "=r" (err), ltype(x)				\
+-		     : "m" (__m(addr)), "i" (errret), "0" (err))
++		     : "=r" (err), ltype (x)				\
++		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
+ 
+ #define __get_user_size_ex(x, ptr, size)				\
+ do {									\
+@@ -407,10 +454,12 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : ltype(x) : "m" (__m(addr)))
++		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
+ 
+ #define __put_user_nocheck(x, ptr, size)			\
+ ({								\
+@@ -424,13 +473,24 @@ do {									\
+ 	int __gu_err;							\
+ 	unsigned long __gu_val;						\
+ 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
+-	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
++	(x) = (__typeof__(*(ptr)))__gu_val;				\
+ 	__gu_err;							\
+ })
+ 
+ /* FIXME: this hack is definitely wrong -AK */
+ struct __large_struct { unsigned long buf[100]; };
+-#define __m(x) (*(struct __large_struct __user *)(x))
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#define ____m(x)					\
++({							\
++	unsigned long ____x = (unsigned long)(x);	\
++	if (____x < PAX_USER_SHADOW_BASE)		\
++		____x += PAX_USER_SHADOW_BASE;		\
++	(void __user *)____x;				\
++})
++#else
++#define ____m(x) (x)
++#endif
++#define __m(x) (*(struct __large_struct __user *)____m(x))
+ 
+ /*
+  * Tell gcc we read from memory instead of writing: this is because
+@@ -438,21 +498,26 @@ struct __large_struct { unsigned long bu
+  * aliasing issues.
+  */
+ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+ 		     : "=r"(err)					\
+-		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
++		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : : ltype(x), "m" (__m(addr)))
++		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
+ 
+ /*
+  * uaccess_try and catch
+@@ -530,7 +595,7 @@ struct __large_struct { unsigned long bu
+ #define get_user_ex(x, ptr)	do {					\
+ 	unsigned long __gue_val;					\
+ 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
+-	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
++	(x) = (__typeof__(*(ptr)))__gue_val;				\
+ } while (0)
+ 
+ #ifdef CONFIG_X86_WP_WORKS_OK
+@@ -567,6 +632,7 @@ extern struct movsl_mask {
+ 
+ #define ARCH_HAS_NOCACHE_UACCESS 1
+ 
++#define ARCH_HAS_SORT_EXTABLE
+ #ifdef CONFIG_X86_32
+ # include "uaccess_32.h"
+ #else
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/vgtod.h linux-2.6.32.12/arch/x86/include/asm/vgtod.h
+--- linux-2.6.32.12/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/vgtod.h	2010-04-04 20:46:41.509696869 -0400
+@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
+ 	int		sysctl_enabled;
+ 	struct timezone sys_tz;
+ 	struct { /* extract of a clocksource struct */
++		char	name[8];
+ 		cycle_t (*vread)(void);
+ 		cycle_t	cycle_last;
+ 		cycle_t	mask;
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/vmi.h linux-2.6.32.12/arch/x86/include/asm/vmi.h
+--- linux-2.6.32.12/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/vmi.h	2010-04-04 20:46:41.509696869 -0400
+@@ -191,6 +191,7 @@ struct vrom_header {
+ 	u8      reserved[96];   /* Reserved for headers */
+ 	char    vmi_init[8];    /* VMI_Init jump point */
+ 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
++	char    rom_data[8048];	/* rest of the option ROM */
+ } __attribute__((packed));
+ 
+ struct pnp_header {
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/vsyscall.h linux-2.6.32.12/arch/x86/include/asm/vsyscall.h
+--- linux-2.6.32.12/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/vsyscall.h	2010-04-04 20:46:41.509696869 -0400
+@@ -15,9 +15,10 @@ enum vsyscall_num {
+ 
+ #ifdef __KERNEL__
+ #include <linux/seqlock.h>
++#include <linux/getcpu.h>
++#include <linux/time.h>
+ 
+ #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
+-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
+ 
+ /* Definitions for CONFIG_GENERIC_TIME definitions */
+ #define __section_vsyscall_gtod_data __attribute__ \
+@@ -31,7 +32,6 @@ enum vsyscall_num {
+ #define VGETCPU_LSL	2
+ 
+ extern int __vgetcpu_mode;
+-extern volatile unsigned long __jiffies;
+ 
+ /* kernel space (writeable) */
+ extern int vgetcpu_mode;
+@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
+ 
+ extern void map_vsyscall(void);
+ 
++extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
++extern time_t vtime(time_t *t);
++extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
+ #endif /* __KERNEL__ */
+ 
+ #endif /* _ASM_X86_VSYSCALL_H */
+diff -urNp linux-2.6.32.12/arch/x86/include/asm/xsave.h linux-2.6.32.12/arch/x86/include/asm/xsave.h
+--- linux-2.6.32.12/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/include/asm/xsave.h	2010-04-04 20:58:33.225084964 -0400
+@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
+ static inline int xsave_user(struct xsave_struct __user *buf)
+ {
+ 	int err;
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
++		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
+ 	u32 lmask = mask;
+ 	u32 hmask = mask >> 32;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
++		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+diff -urNp linux-2.6.32.12/arch/x86/Kconfig linux-2.6.32.12/arch/x86/Kconfig
+--- linux-2.6.32.12/arch/x86/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/Kconfig	2010-04-04 20:46:41.509696869 -0400
+@@ -1083,7 +1083,7 @@ config PAGE_OFFSET
+ 	hex
+ 	default 0xB0000000 if VMSPLIT_3G_OPT
+ 	default 0x80000000 if VMSPLIT_2G
+-	default 0x78000000 if VMSPLIT_2G_OPT
++	default 0x70000000 if VMSPLIT_2G_OPT
+ 	default 0x40000000 if VMSPLIT_1G
+ 	default 0xC0000000
+ 	depends on X86_32
+@@ -1409,7 +1409,7 @@ config ARCH_USES_PG_UNCACHED
+ 
+ config EFI
+ 	bool "EFI runtime service support"
+-	depends on ACPI
++	depends on ACPI && !PAX_KERNEXEC
+ 	---help---
+ 	  This enables the kernel to use EFI runtime services that are
+ 	  available (such as the EFI variable services).
+@@ -1496,6 +1496,7 @@ config KEXEC_JUMP
+ config PHYSICAL_START
+ 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
+ 	default "0x1000000"
++	range 0x400000 0x40000000
+ 	---help---
+ 	  This gives the physical address where the kernel is loaded.
+ 
+@@ -1560,6 +1561,7 @@ config PHYSICAL_ALIGN
+ 	hex
+ 	prompt "Alignment value to which kernel should be aligned" if X86_32
+ 	default "0x1000000"
++	range 0x400000 0x1000000 if PAX_KERNEXEC
+ 	range 0x2000 0x1000000
+ 	---help---
+ 	  This value puts the alignment restrictions on physical address
+@@ -1591,9 +1593,10 @@ config HOTPLUG_CPU
+ 	  Say N if you want to disable CPU hotplug.
+ 
+ config COMPAT_VDSO
+-	def_bool y
++	def_bool n
+ 	prompt "Compat VDSO support"
+ 	depends on X86_32 || IA32_EMULATION
++	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
+ 	---help---
+ 	  Map the 32-bit VDSO to the predictable old-style address too.
+ 	---help---
+diff -urNp linux-2.6.32.12/arch/x86/Kconfig.cpu linux-2.6.32.12/arch/x86/Kconfig.cpu
+--- linux-2.6.32.12/arch/x86/Kconfig.cpu	2010-04-29 17:49:37.481119841 -0400
++++ linux-2.6.32.12/arch/x86/Kconfig.cpu	2010-04-29 17:49:57.921493895 -0400
+@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
+ 
+ config X86_F00F_BUG
+ 	def_bool y
+-	depends on M586MMX || M586TSC || M586 || M486 || M386
++	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
+ 
+ config X86_WP_WORKS_OK
+ 	def_bool y
+@@ -360,7 +360,7 @@ config X86_POPAD_OK
+ 
+ config X86_ALIGNMENT_16
+ 	def_bool y
+-	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
++	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+ 
+ config X86_INTEL_USERCOPY
+ 	def_bool y
+@@ -406,7 +406,7 @@ config X86_CMPXCHG64
+ # generates cmov.
+ config X86_CMOV
+ 	def_bool y
+-	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
++	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
+ 
+ config X86_MINIMUM_CPU_FAMILY
+ 	int
+diff -urNp linux-2.6.32.12/arch/x86/Kconfig.debug linux-2.6.32.12/arch/x86/Kconfig.debug
+--- linux-2.6.32.12/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/Kconfig.debug	2010-04-04 20:46:41.509696869 -0400
+@@ -99,7 +99,7 @@ config X86_PTDUMP
+ config DEBUG_RODATA
+ 	bool "Write protect kernel read-only data structures"
+ 	default y
+-	depends on DEBUG_KERNEL
++	depends on DEBUG_KERNEL && BROKEN
+ 	---help---
+ 	  Mark the kernel read-only data as write-protected in the pagetables,
+ 	  in order to catch accidental (and incorrect) writes to such const
+diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/boot.c linux-2.6.32.12/arch/x86/kernel/acpi/boot.c
+--- linux-2.6.32.12/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
++++ linux-2.6.32.12/arch/x86/kernel/acpi/boot.c	2010-04-04 20:46:41.509696869 -0400
+@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
+ 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
+ 		     },
+ 	 },
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S
+--- linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S	2010-04-04 20:46:41.509696869 -0400
+@@ -104,7 +104,7 @@ _start:
+ 	movl	%eax, %ecx
+ 	orl	%edx, %ecx
+ 	jz	1f
+-	movl	$0xc0000080, %ecx
++	mov	$MSR_EFER, %ecx
+ 	wrmsr
+ 1:
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c
+--- linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c	2010-04-04 20:46:41.509696869 -0400
+@@ -11,11 +11,12 @@
+ #include <linux/cpumask.h>
+ #include <asm/segment.h>
+ #include <asm/desc.h>
++#include <asm/e820.h>
+ 
+ #include "realmode/wakeup.h"
+ #include "sleep.h"
+ 
+-unsigned long acpi_wakeup_address;
++unsigned long acpi_wakeup_address = 0x2000;
+ unsigned long acpi_realmode_flags;
+ 
+ /* address in low memory of the wakeup routine. */
+@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
+ 	header->trampoline_segment = setup_trampoline() >> 4;
+ #ifdef CONFIG_SMP
+ 	stack_start.sp = temp_stack + sizeof(temp_stack);
++
++	pax_open_kernel();
+ 	early_gdt_descr.address =
+ 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
++	pax_close_kernel();
++
+ 	initial_gs = per_cpu_offset(smp_processor_id());
+ #endif
+ 	initial_code = (unsigned long)wakeup_long64;
+@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
+ 		return;
+ 	}
+ 
+-	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
+-
+-	if (!acpi_realmode) {
+-		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
+-		return;
+-	}
+-
+-	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
++	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
++	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
+ }
+ 
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S
+--- linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S	2010-04-04 20:46:41.509696869 -0400
+@@ -30,13 +30,11 @@ wakeup_pmode_return:
+ 	# and restore the stack ... but you need gdt for this to work
+ 	movl	saved_context_esp, %esp
+ 
+-	movl	%cs:saved_magic, %eax
+-	cmpl	$0x12345678, %eax
++	cmpl	$0x12345678, saved_magic
+ 	jne	bogus_magic
+ 
+ 	# jump to place where we left off
+-	movl	saved_eip, %eax
+-	jmp	*%eax
++	jmp	*(saved_eip)
+ 
+ bogus_magic:
+ 	jmp	bogus_magic
+diff -urNp linux-2.6.32.12/arch/x86/kernel/alternative.c linux-2.6.32.12/arch/x86/kernel/alternative.c
+--- linux-2.6.32.12/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/alternative.c	2010-04-04 20:46:41.509696869 -0400
+@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
+ 
+ 		BUG_ON(p->len > MAX_PATCH_LEN);
+ 		/* prep the buffer with the original instructions */
+-		memcpy(insnbuf, p->instr, p->len);
++		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
+ 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
+ 					 (unsigned long)p->instr, p->len);
+ 
+@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
+  * instructions. And on the local CPU you need to be protected again NMI or MCE
+  * handlers seeing an inconsistent instruction while you patch.
+  */
+-static void *__init_or_module text_poke_early(void *addr, const void *opcode,
++static void *__kprobes text_poke_early(void *addr, const void *opcode,
+ 					      size_t len)
+ {
+ 	unsigned long flags;
+ 	local_irq_save(flags);
+-	memcpy(addr, opcode, len);
++
++	pax_open_kernel();
++	memcpy(ktla_ktva(addr), opcode, len);
++	pax_close_kernel();
++
+ 	sync_core();
+ 	local_irq_restore(flags);
+ 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
+  */
+ void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
+ {
+-	unsigned long flags;
+-	char *vaddr;
++	unsigned char *vaddr = ktla_ktva(addr);
+ 	struct page *pages[2];
+-	int i;
++	size_t i;
+ 
+ 	if (!core_kernel_text((unsigned long)addr)) {
+-		pages[0] = vmalloc_to_page(addr);
+-		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
++		pages[0] = vmalloc_to_page(vaddr);
++		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
+ 	} else {
+-		pages[0] = virt_to_page(addr);
++		pages[0] = virt_to_page(vaddr);
+ 		WARN_ON(!PageReserved(pages[0]));
+-		pages[1] = virt_to_page(addr + PAGE_SIZE);
++		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
+ 	}
+ 	BUG_ON(!pages[0]);
+-	local_irq_save(flags);
+-	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
+-	if (pages[1])
+-		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
+-	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
+-	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
+-	clear_fixmap(FIX_TEXT_POKE0);
+-	if (pages[1])
+-		clear_fixmap(FIX_TEXT_POKE1);
+-	local_flush_tlb();
+-	sync_core();
+-	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+-	   that causes hangs on some VIA CPUs. */
++	text_poke_early(addr, opcode, len);
+ 	for (i = 0; i < len; i++)
+-		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
+-	local_irq_restore(flags);
++		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
+ 	return addr;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/kernel/amd_iommu.c linux-2.6.32.12/arch/x86/kernel/amd_iommu.c
+--- linux-2.6.32.12/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:37.521943068 -0400
++++ linux-2.6.32.12/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:57.953503497 -0400
+@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
+ 	}
+ }
+ 
+-static struct dma_map_ops amd_iommu_dma_ops = {
++static const struct dma_map_ops amd_iommu_dma_ops = {
+ 	.alloc_coherent = alloc_coherent,
+ 	.free_coherent = free_coherent,
+ 	.map_page = map_page,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c
+--- linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c	2010-04-04 20:46:41.509696869 -0400
+@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
+ 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
+ 				GFP_ATOMIC);
+ 	if (!ioapic_entries)
+-		return 0;
++		return NULL;
+ 
+ 	for (apic = 0; apic < nr_ioapics; apic++) {
+ 		ioapic_entries[apic] =
+@@ -728,7 +728,7 @@ nomem:
+ 		kfree(ioapic_entries[apic]);
+ 	kfree(ioapic_entries);
+ 
+-	return 0;
++	return NULL;
+ }
+ 
+ /*
+@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
+ }
+ EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
+ 
+-void lock_vector_lock(void)
++void lock_vector_lock(void) __acquires(vector_lock)
+ {
+ 	/* Used to the online set of cpus does not change
+ 	 * during assign_irq_vector.
+@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
+ 	spin_lock(&vector_lock);
+ }
+ 
+-void unlock_vector_lock(void)
++void unlock_vector_lock(void) __releases(vector_lock)
+ {
+ 	spin_unlock(&vector_lock);
+ }
+diff -urNp linux-2.6.32.12/arch/x86/kernel/apm_32.c linux-2.6.32.12/arch/x86/kernel/apm_32.c
+--- linux-2.6.32.12/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/apm_32.c	2010-04-04 20:46:41.513555986 -0400
+@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
+  * This is for buggy BIOS's that refer to (real mode) segment 0x40
+  * even though they are called in protected mode.
+  */
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ static const char driver_version[] = "1.16ac";	/* no spaces */
+@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
+ 			  &call->esi);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	return call->eax & 0xff;
+@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
+ 					 &call->eax);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 	return error;
+ }
+@@ -975,7 +989,7 @@ recalc:
+ 
+ static void apm_power_off(void)
+ {
+-	unsigned char po_bios_call[] = {
++	const unsigned char po_bios_call[] = {
+ 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
+ 		0x8e, 0xd0,		/* movw  ax,ss       */
+ 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
+@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
+ static struct miscdevice apm_device = {
+ 	APM_MINOR_DEV,
+ 	"apm_bios",
+-	&apm_bios_fops
++	&apm_bios_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ 
+@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+ 
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ /*
+@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
+ 	 * code to that CPU.
+ 	 */
+ 	gdt = get_cpu_gdt_table(0);
++
++	pax_open_kernel();
+ 	set_desc_base(&gdt[APM_CS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
+ 	set_desc_base(&gdt[APM_CS_16 >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
+ 	set_desc_base(&gdt[APM_DS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
++	pax_close_kernel();
+ 
+ 	proc_create("apm", 0, NULL, &apm_file_ops);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c
+--- linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c	2010-04-04 20:46:41.513555986 -0400
+@@ -115,6 +115,11 @@ void foo(void)
+ 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
+ #endif
+ 
+ #ifdef CONFIG_XEN
+diff -urNp linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c
+--- linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c	2010-04-04 20:58:33.220592413 -0400
+@@ -63,6 +63,18 @@ int main(void)
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
+ 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
++	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
++	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
++#endif
++
+ #endif
+ 
+ 
+@@ -115,6 +127,7 @@ int main(void)
+ 	ENTRY(cr8);
+ 	BLANK();
+ #undef ENTRY
++	DEFINE(TSS_size, sizeof(struct tss_struct));
+ 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
+ 	BLANK();
+ 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/common.c linux-2.6.32.12/arch/x86/kernel/cpu/common.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/common.c	2010-04-04 20:47:28.952733264 -0400
+@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
+ 
+ static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
+ 
+-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
+-#ifdef CONFIG_X86_64
+-	/*
+-	 * We need valid kernel segments for data and code in long mode too
+-	 * IRET will check the segment types  kkeil 2000/10/28
+-	 * Also sysret mandates a special GDT layout
+-	 *
+-	 * TLS descriptors are currently at a different place compared to i386.
+-	 * Hopefully nobody expects them at a fixed place (Wine?)
+-	 */
+-	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
+-#else
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
+-	/*
+-	 * Segments used for calling PnP BIOS have byte granularity.
+-	 * They code segments and data segments have fixed 64k limits,
+-	 * the transfer segment sizes are set at run time.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/*
+-	 * The APM segments have byte granularity and their bases
+-	 * are set at run time.  All have 64k limits.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* data */
+-	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
+-
+-	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	GDT_STACK_CANARY_INIT
+-#endif
+-} };
+-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+-
+ static int __init x86_xsave_setup(char *s)
+ {
+ 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
+@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
+ {
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
++	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 	/* Reload the per-cpu base */
+@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
+ 	/* Filter out anything that depends on CPUID levels we don't have */
+ 	filter_cpuid_features(c, true);
+ 
++#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
++	setup_clear_cpu_cap(X86_FEATURE_SEP);
++#endif
++
+ 	/* If the model name is still unset, do table lookup. */
+ 	if (!c->x86_model_id[0]) {
+ 		const char *p;
+@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
+ 	int i;
+ 
+ 	cpu = stack_smp_processor_id();
+-	t = &per_cpu(init_tss, cpu);
++	t = init_tss + cpu;
+ 	orig_ist = &per_cpu(orig_ist, cpu);
+ 
+ #ifdef CONFIG_NUMA
+@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
+ 	switch_to_new_gdt(cpu);
+ 	loadsegment(fs, 0);
+ 
+-	load_idt((const struct desc_ptr *)&idt_descr);
++	load_idt(&idt_descr);
+ 
+ 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
+ 	syscall_init();
+@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
+ {
+ 	int cpu = smp_processor_id();
+ 	struct task_struct *curr = current;
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 	struct thread_struct *thread = &curr->thread;
+ 
+ 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-04-04 20:46:41.513555986 -0400
+@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-04-04 20:46:41.513555986 -0400
+@@ -225,7 +225,7 @@ static struct cpu_model models[] =
+ 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
+ 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
+ 
+-	{ NULL, }
++	{ NULL, NULL, 0, NULL}
+ };
+ #undef _BANIAS
+ #undef BANIAS
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/intel.c linux-2.6.32.12/arch/x86/kernel/cpu/intel.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/intel.c	2010-04-04 20:41:49.916475305 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/intel.c	2010-04-04 20:46:41.513555986 -0400
+@@ -140,7 +140,7 @@ static void __cpuinit trap_init_f00f_bug
+ 	 * Update the IDT descriptor and reload the IDT so that
+ 	 * it uses the read-only mapped virtual address.
+ 	 */
+-	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
++	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
+ 	load_idt(&idt_descr);
+ }
+ #endif
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-04-29 17:49:57.985196208 -0400
+@@ -916,7 +916,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show   = show,
+ 	.store  = store,
+ };
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/Makefile linux-2.6.32.12/arch/x86/kernel/cpu/Makefile
+--- linux-2.6.32.12/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/Makefile	2010-04-04 20:46:41.513555986 -0400
+@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
+ CFLAGS_REMOVE_common.o = -pg
+ endif
+ 
+-# Make sure load_percpu_segment has no stackprotector
+-nostackp := $(call cc-option, -fno-stack-protector)
+-CFLAGS_common.o		:= $(nostackp)
+-
+ obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
+ obj-y			+= proc.o capflags.o powerflags.o common.o
+ obj-y			+= vmware.o hypervisor.o sched.o
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-04-04 20:46:41.513555986 -0400
+@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops threshold_ops = {
++static const struct sysfs_ops threshold_ops = {
+ 	.show			= show,
+ 	.store			= store,
+ };
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c	2010-04-04 20:46:41.513555986 -0400
+@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
+ 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
+ 				m->cs, m->ip);
+ 
+-		if (m->cs == __KERNEL_CS)
++		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
+ 			print_symbol("{%s}", m->ip);
+ 		pr_cont("\n");
+ 	}
+@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
+  */
+ 
+ static DEFINE_SPINLOCK(mce_state_lock);
+-static int		open_count;		/* #times opened */
++static atomic_t		open_count;		/* #times opened */
+ static int		open_exclu;		/* already open exclusive? */
+ 
+ static int mce_open(struct inode *inode, struct file *file)
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
++	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
+ 		spin_unlock(&mce_state_lock);
+ 
+ 		return -EBUSY;
+@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
+ 
+ 	if (file->f_flags & O_EXCL)
+ 		open_exclu = 1;
+-	open_count++;
++	atomic_inc(&open_count);
+ 
+ 	spin_unlock(&mce_state_lock);
+ 
+@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	open_count--;
++	atomic_dec(&open_count);
+ 	open_exclu = 0;
+ 
+ 	spin_unlock(&mce_state_lock);
+@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
+ 	MISC_MCELOG_MINOR,
+ 	"mcelog",
+ 	&mce_chrdev_ops,
++	{NULL, NULL}, NULL, NULL
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c	2010-04-04 20:46:41.513555986 -0400
+@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops amd_mtrr_ops = {
++static const struct mtrr_ops amd_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_AMD,
+ 	.set               = amd_set_mtrr,
+ 	.get               = amd_get_mtrr,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c	2010-04-04 20:46:41.513555986 -0400
+@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops centaur_mtrr_ops = {
++static const struct mtrr_ops centaur_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CENTAUR,
+ 	.set               = centaur_set_mcr,
+ 	.get               = centaur_get_mcr,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-04-04 20:46:41.513555986 -0400
+@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
+ 	post_set();
+ }
+ 
+-static struct mtrr_ops cyrix_mtrr_ops = {
++static const struct mtrr_ops cyrix_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CYRIX,
+ 	.set_all	   = cyrix_set_all,
+ 	.set               = cyrix_set_arr,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c	2010-04-04 20:46:41.513555986 -0400
+@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
+ 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
+ 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
+ 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
+-	{}
++	{ 0, 0 }
+ };
+ 
+ static unsigned long smp_changes_mask;
+@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
+ /*
+  * Generic structure...
+  */
+-struct mtrr_ops generic_mtrr_ops = {
++const struct mtrr_ops generic_mtrr_ops = {
+ 	.use_intel_if		= 1,
+ 	.set_all		= generic_set_all,
+ 	.get			= generic_get_mtrr,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c	2010-04-04 20:46:41.513555986 -0400
+@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
+ u64 size_or_mask, size_and_mask;
+ static bool mtrr_aps_delayed_init;
+ 
+-static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
++static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
+ 
+-struct mtrr_ops *mtrr_if;
++const struct mtrr_ops *mtrr_if;
+ 
+ static void set_mtrr(unsigned int reg, unsigned long base,
+ 		     unsigned long size, mtrr_type type);
+ 
+-void set_mtrr_ops(struct mtrr_ops *ops)
++void set_mtrr_ops(const struct mtrr_ops *ops)
+ {
+ 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
+ 		mtrr_ops[ops->vendor] = ops;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h
+--- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-04-04 20:46:41.517551870 -0400
+@@ -12,19 +12,19 @@
+ extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
+ 
+ struct mtrr_ops {
+-	u32	vendor;
+-	u32	use_intel_if;
+-	void	(*set)(unsigned int reg, unsigned long base,
++	const u32	vendor;
++	const u32	use_intel_if;
++	void	(* const set)(unsigned int reg, unsigned long base,
+ 		       unsigned long size, mtrr_type type);
+-	void	(*set_all)(void);
++	void	(* const set_all)(void);
+ 
+-	void	(*get)(unsigned int reg, unsigned long *base,
++	void	(* const get)(unsigned int reg, unsigned long *base,
+ 		       unsigned long *size, mtrr_type *type);
+-	int	(*get_free_region)(unsigned long base, unsigned long size,
++	int	(* const get_free_region)(unsigned long base, unsigned long size,
+ 				   int replace_reg);
+-	int	(*validate_add_page)(unsigned long base, unsigned long size,
++	int	(* const validate_add_page)(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+-	int	(*have_wrcomb)(void);
++	int	(* const have_wrcomb)(void);
+ };
+ 
+ extern int generic_get_free_region(unsigned long base, unsigned long size,
+@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
+ extern int generic_validate_add_page(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+ 
+-extern struct mtrr_ops generic_mtrr_ops;
++extern const struct mtrr_ops generic_mtrr_ops;
+ 
+ extern int positive_have_wrcomb(void);
+ 
+@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
+ 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
+ void get_mtrr_state(void);
+ 
+-extern void set_mtrr_ops(struct mtrr_ops *ops);
++extern void set_mtrr_ops(const struct mtrr_ops *ops);
+ 
+ extern u64 size_or_mask, size_and_mask;
+-extern struct mtrr_ops *mtrr_if;
++extern const struct mtrr_ops *mtrr_if;
+ 
+ #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
+ #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-04-04 20:46:41.517551870 -0400
+@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
+ 
+ /* Interface defining a CPU specific perfctr watchdog */
+ struct wd_ops {
+-	int (*reserve)(void);
+-	void (*unreserve)(void);
+-	int (*setup)(unsigned nmi_hz);
+-	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
+-	void (*stop)(void);
++	int (* const reserve)(void);
++	void (* const unreserve)(void);
++	int (* const setup)(unsigned nmi_hz);
++	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
++	void (* const stop)(void);
+ 	unsigned perfctr;
+ 	unsigned evntsel;
+ 	u64 checkbit;
+@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
+ #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
+ #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops;
+ 
+ static int setup_intel_arch_watchdog(unsigned nmi_hz)
+@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
+ 	return 1;
+ }
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops __read_mostly = {
+ 	.reserve	= single_msr_reserve,
+ 	.unreserve	= single_msr_unreserve,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c
+--- linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:57.989487280 -0400
+@@ -2354,7 +2354,7 @@ perf_callchain_user(struct pt_regs *regs
+ 			break;
+ 
+ 		callchain_store(entry, frame.return_address);
+-		fp = frame.next_frame;
++		fp = (__force const void __user *)frame.next_frame;
+ 	}
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/crash.c linux-2.6.32.12/arch/x86/kernel/crash.c
+--- linux-2.6.32.12/arch/x86/kernel/crash.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.12/arch/x86/kernel/crash.c	2010-04-29 17:49:57.989487280 -0400
+@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, 
+ 	regs = args->regs;
+ 
+ #ifdef CONFIG_X86_32
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		crash_fixup_ss_esp(&fixed_regs, regs);
+ 		regs = &fixed_regs;
+ 	}
+diff -urNp linux-2.6.32.12/arch/x86/kernel/doublefault_32.c linux-2.6.32.12/arch/x86/kernel/doublefault_32.c
+--- linux-2.6.32.12/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/doublefault_32.c	2010-04-04 20:46:41.517551870 -0400
+@@ -11,7 +11,7 @@
+ 
+ #define DOUBLEFAULT_STACKSIZE (1024)
+ static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
+-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
++#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
+ 
+ #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
+ 
+@@ -21,7 +21,7 @@ static void doublefault_fn(void)
+ 	unsigned long gdt, tss;
+ 
+ 	store_gdt(&gdt_desc);
+-	gdt = gdt_desc.address;
++	gdt = (unsigned long)gdt_desc.address;
+ 
+ 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+ 
+@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
+ 		/* 0x2 bit is always set */
+ 		.flags		= X86_EFLAGS_SF | 0x2,
+ 		.sp		= STACK_START,
+-		.es		= __USER_DS,
++		.es		= __KERNEL_DS,
+ 		.cs		= __KERNEL_CS,
+ 		.ss		= __KERNEL_DS,
+-		.ds		= __USER_DS,
++		.ds		= __KERNEL_DS,
+ 		.fs		= __KERNEL_PERCPU,
+ 
+ 		.__cr3		= __pa_nodebug(swapper_pg_dir),
+diff -urNp linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c
+--- linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c	2010-04-04 20:46:41.517551870 -0400
+@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
+ 	 * When in-kernel, we also print out the stack and code at the
+ 	 * time of the fault..
+ 	 */
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned int code_prologue = code_bytes * 43 / 64;
+ 		unsigned int code_len = code_bytes;
+ 		unsigned char c;
+ 		u8 *ip;
++		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
+ 
+ 		printk(KERN_EMERG "Stack:\n");
+ 		show_stack_log_lvl(NULL, regs, &regs->sp,
+@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
+ 
+ 		printk(KERN_EMERG "Code: ");
+ 
+-		ip = (u8 *)regs->ip - code_prologue;
++		ip = (u8 *)regs->ip - code_prologue + cs_base;
+ 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
+ 			/* try starting at IP */
+-			ip = (u8 *)regs->ip;
++			ip = (u8 *)regs->ip + cs_base;
+ 			code_len = code_len - code_prologue + 1;
+ 		}
+ 		for (i = 0; i < code_len; i++, ip++) {
+@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
+ 				printk(" Bad EIP value.");
+ 				break;
+ 			}
+-			if (ip == (u8 *)regs->ip)
++			if (ip == (u8 *)regs->ip + cs_base)
+ 				printk("<%02x> ", c);
+ 			else
+ 				printk("%02x ", c);
+@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
+ {
+ 	unsigned short ud2;
+ 
++	ip = ktla_ktva(ip);
+ 	if (ip < PAGE_OFFSET)
+ 		return 0;
+ 	if (probe_kernel_address((unsigned short *)ip, ud2))
+diff -urNp linux-2.6.32.12/arch/x86/kernel/dumpstack.c linux-2.6.32.12/arch/x86/kernel/dumpstack.c
+--- linux-2.6.32.12/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/dumpstack.c	2010-04-04 20:46:41.517551870 -0400
+@@ -180,7 +180,7 @@ void dump_stack(void)
+ #endif
+ 
+ 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version);
+@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
+ 		panic("Fatal exception in interrupt");
+ 	if (panic_on_oops)
+ 		panic("Fatal exception");
+-	do_exit(signr);
++	do_group_exit(signr);
+ }
+ 
+ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
+ 	unsigned long flags = oops_begin();
+ 	int sig = SIGSEGV;
+ 
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		report_bug(regs->ip, regs);
+ 
+ 	if (__die(str, regs, err))
+diff -urNp linux-2.6.32.12/arch/x86/kernel/e820.c linux-2.6.32.12/arch/x86/kernel/e820.c
+--- linux-2.6.32.12/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/e820.c	2010-04-04 20:46:41.517551870 -0400
+@@ -733,7 +733,7 @@ struct early_res {
+ };
+ static struct early_res early_res[MAX_EARLY_RES] __initdata = {
+ 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
+-	{}
++	{ 0, 0, {0}, 0 }
+ };
+ 
+ static int __init find_overlapped_early(u64 start, u64 end)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/efi_32.c linux-2.6.32.12/arch/x86/kernel/efi_32.c
+--- linux-2.6.32.12/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/efi_32.c	2010-04-04 20:46:41.517551870 -0400
+@@ -38,70 +38,38 @@
+  */
+ 
+ static unsigned long efi_rt_eflags;
+-static pgd_t efi_bak_pg_dir_pointer[2];
++static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
+ 
+-void efi_call_phys_prelog(void)
++void __init efi_call_phys_prelog(void)
+ {
+-	unsigned long cr4;
+-	unsigned long temp;
+ 	struct desc_ptr gdt_descr;
+ 
+ 	local_irq_save(efi_rt_eflags);
+ 
+-	/*
+-	 * If I don't have PAE, I should just duplicate two entries in page
+-	 * directory. If I have PAE, I just need to duplicate one entry in
+-	 * page directory.
+-	 */
+-	cr4 = read_cr4_safe();
+ 
+-	if (cr4 & X86_CR4_PAE) {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		swapper_pg_dir[0].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-	} else {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		efi_bak_pg_dir_pointer[1].pgd =
+-		    swapper_pg_dir[pgd_index(0x400000)].pgd;
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-		temp = PAGE_OFFSET + 0x400000;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    swapper_pg_dir[pgd_index(temp)].pgd;
+-	}
++	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+ 	 */
+ 	__flush_tlb_all();
+ 
+-	gdt_descr.address = __pa(get_cpu_gdt_table(0));
++	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ }
+ 
+-void efi_call_phys_epilog(void)
++void __init efi_call_phys_epilog(void)
+ {
+-	unsigned long cr4;
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
++	gdt_descr.address = get_cpu_gdt_table(0);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 
+-	cr4 = read_cr4_safe();
+-
+-	if (cr4 & X86_CR4_PAE) {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-	} else {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    efi_bak_pg_dir_pointer[1].pgd;
+-	}
++	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+diff -urNp linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S
+--- linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S	2010-04-04 20:46:41.517551870 -0400
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <linux/linkage.h>
++#include <linux/init.h>
+ #include <asm/page_types.h>
+ 
+ /*
+@@ -20,7 +21,7 @@
+  * service functions will comply with gcc calling convention, too.
+  */
+ 
+-.text
++__INIT
+ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 0. The function can only be called in Linux kernel. So CS has been
+@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
+ 	 * The mapping of lower virtual memory has been created in prelog and
+ 	 * epilog.
+ 	 */
+-	movl	$1f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	jmp	*%edx
++	jmp	1f-__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
+ 	 * parameter 2, ..., param n. To make things easy, we save the return
+ 	 * address of efi_call_phys in a global variable.
+ 	 */
+-	popl	%edx
+-	movl	%edx, saved_return_addr
+-	/* get the function pointer into ECX*/
+-	popl	%ecx
+-	movl	%ecx, efi_rt_function_ptr
+-	movl	$2f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	pushl	%edx
++	popl	(saved_return_addr)
++	popl	(efi_rt_function_ptr)
+ 
+ 	/*
+ 	 * 3. Clear PG bit in %CR0.
+@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 5. Call the physical function.
+ 	 */
+-	jmp	*%ecx
++	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
+ 
+-2:
+ 	/*
+ 	 * 6. After EFI runtime service returns, control will return to
+ 	 * following instruction. We'd better readjust stack pointer first.
+@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
+ 	movl	%cr0, %edx
+ 	orl	$0x80000000, %edx
+ 	movl	%edx, %cr0
+-	jmp	1f
+-1:
++
+ 	/*
+ 	 * 8. Now restore the virtual mode from flat mode by
+ 	 * adding EIP with PAGE_OFFSET.
+ 	 */
+-	movl	$1f, %edx
+-	jmp	*%edx
++	jmp	1f+__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+ 	 * 9. Balance the stack. And because EAX contain the return value,
+ 	 * we'd better not clobber it.
+ 	 */
+-	leal	efi_rt_function_ptr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
++	pushl	(efi_rt_function_ptr)
+ 
+ 	/*
+-	 * 10. Push the saved return address onto the stack and return.
++	 * 10. Return to the saved return address.
+ 	 */
+-	leal	saved_return_addr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
+-	ret
++	jmpl	*(saved_return_addr)
+ ENDPROC(efi_call_phys)
+ .previous
+ 
+-.data
++__INITDATA
+ saved_return_addr:
+ 	.long 0
+ efi_rt_function_ptr:
+diff -urNp linux-2.6.32.12/arch/x86/kernel/entry_32.S linux-2.6.32.12/arch/x86/kernel/entry_32.S
+--- linux-2.6.32.12/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/entry_32.S	2010-04-04 20:47:28.952733264 -0400
+@@ -191,7 +191,67 @@
+ 
+ #endif	/* CONFIG_X86_32_LAZY_GS */
+ 
+-.macro SAVE_ALL
++.macro PAX_EXIT_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++#endif
++	mov %cs, %esi
++	cmp $__KERNEXEC_KERNEL_CS, %esi
++	jnz 2f
++#ifdef CONFIG_PARAVIRT
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	btr $16, %esi
++	ljmp $__KERNEL_CS, $1f
++1:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
++#else
++	mov %esi, %cr0
++#endif
++2:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro PAX_ENTER_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	bts $16, %esi
++	jnc 1f
++	mov %cs, %esi
++	cmp $__KERNEL_CS, %esi
++	jz 3f
++	ljmp $__KERNEL_CS, $3f
++1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
++2:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++#else
++	mov %esi, %cr0
++#endif
++3:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro __SAVE_ALL _DS
+ 	cld
+ 	PUSH_GS
+ 	pushl %fs
+@@ -224,7 +284,7 @@
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+-	movl $(__USER_DS), %edx
++	movl $\_DS, %edx
+ 	movl %edx, %ds
+ 	movl %edx, %es
+ 	movl $(__KERNEL_PERCPU), %edx
+@@ -232,6 +292,15 @@
+ 	SET_KERNEL_GS %edx
+ .endm
+ 
++.macro SAVE_ALL
++#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
++	__SAVE_ALL __KERNEL_DS
++	PAX_ENTER_KERNEL
++#else
++	__SAVE_ALL __USER_DS
++#endif
++.endm
++
+ .macro RESTORE_INT_REGS
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+@@ -352,7 +421,15 @@ check_userspace:
+ 	movb PT_CS(%esp), %al
+ 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
+ 	cmpl $USER_RPL, %eax
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jae resume_userspace
++
++	PAX_EXIT_KERNEL
++	jmp resume_kernel
++#else
+ 	jb resume_kernel		# not returning to v8086 or userspace
++#endif
+ 
+ ENTRY(resume_userspace)
+ 	LOCKDEP_SYS_EXIT
+@@ -414,10 +491,9 @@ sysenter_past_esp:
+ 	/*CFI_REL_OFFSET cs, 0*/
+ 	/*
+ 	 * Push current_thread_info()->sysenter_return to the stack.
+-	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
+-	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
+ 	 */
+-	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
++	GET_THREAD_INFO(%ebp)
++	pushl TI_sysenter_return(%ebp)
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET eip, 0
+ 
+@@ -430,9 +506,19 @@ sysenter_past_esp:
+  * Load the potential sixth argument from user stack.
+  * Careful about security.
+  */
++	movl PT_OLDESP(%esp),%ebp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov PT_OLDSS(%esp),%ds
++1:	movl %ds:(%ebp),%ebp
++	push %ss
++	pop %ds
++#else
+ 	cmpl $__PAGE_OFFSET-3,%ebp
+ 	jae syscall_fault
+ 1:	movl (%ebp),%ebp
++#endif
++
+ 	movl %ebp,PT_EBP(%esp)
+ .section __ex_table,"a"
+ 	.align 4
+@@ -455,12 +541,23 @@ sysenter_do_call:
+ 	testl $_TIF_ALLWORK_MASK, %ecx
+ 	jne sysexit_audit
+ sysenter_exit:
++
++#ifdef CONFIG_PAX_RANDKSTACK
++	pushl %eax
++	CFI_ADJUST_CFA_OFFSET 4
++	call pax_randomize_kstack
++	popl %eax
++	CFI_ADJUST_CFA_OFFSET -4
++#endif
++
+ /* if something modifies registers it must also disable sysexit */
+ 	movl PT_EIP(%esp), %edx
+ 	movl PT_OLDESP(%esp), %ecx
+ 	xorl %ebp,%ebp
+ 	TRACE_IRQS_ON
+ 1:	mov  PT_FS(%esp), %fs
++2:	mov  PT_DS(%esp), %ds
++3:	mov  PT_ES(%esp), %es
+ 	PTGS_TO_GS
+ 	ENABLE_INTERRUPTS_SYSEXIT
+ 
+@@ -504,11 +601,17 @@ sysexit_audit:
+ 
+ 	CFI_ENDPROC
+ .pushsection .fixup,"ax"
+-2:	movl $0,PT_FS(%esp)
++4:	movl $0,PT_FS(%esp)
++	jmp 1b
++5:	movl $0,PT_DS(%esp)
++	jmp 1b
++6:	movl $0,PT_ES(%esp)
+ 	jmp 1b
+ .section __ex_table,"a"
+ 	.align 4
+-	.long 1b,2b
++	.long 1b,4b
++	.long 2b,5b
++	.long 3b,6b
+ .popsection
+ 	PTGS_TO_GS_EX
+ ENDPROC(ia32_sysenter_target)
+@@ -538,6 +641,10 @@ syscall_exit:
+ 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
+ 	jne syscall_exit_work
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++	call pax_randomize_kstack
++#endif
++
+ restore_all:
+ 	TRACE_IRQS_IRET
+ restore_all_notrace:
+@@ -602,7 +709,13 @@ ldt_ss:
+ 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
+ 	mov %dx, %ax			/* eax: new kernel esp */
+ 	sub %eax, %edx			/* offset (low word is 0) */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	shr $16, %edx
+ 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
+ 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
+@@ -642,25 +755,19 @@ work_resched:
+ 
+ work_notifysig:				# deal with pending signals and
+ 					# notify-resume requests
++	movl %esp, %eax
+ #ifdef CONFIG_VM86
+ 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
+-	movl %esp, %eax
+-	jne work_notifysig_v86		# returning to kernel-space or
++	jz 1f				# returning to kernel-space or
+ 					# vm86-space
+-	xorl %edx, %edx
+-	call do_notify_resume
+-	jmp resume_userspace_sig
+ 
+-	ALIGN
+-work_notifysig_v86:
+ 	pushl %ecx			# save ti_flags for do_notify_resume
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	call save_v86_state		# %eax contains pt_regs pointer
+ 	popl %ecx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	movl %eax, %esp
+-#else
+-	movl %esp, %eax
++1:
+ #endif
+ 	xorl %edx, %edx
+ 	call do_notify_resume
+@@ -695,6 +802,10 @@ END(syscall_exit_work)
+ 
+ 	RING0_INT_FRAME			# can't unwind into user space anyway
+ syscall_fault:
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %ss
++	pop %ds
++#endif
+ 	GET_THREAD_INFO(%ebp)
+ 	movl $-EFAULT,PT_EAX(%esp)
+ 	jmp resume_userspace
+@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
+  * normal stack and adjusts ESP with the matching offset.
+  */
+ 	/* fixup the stack */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
+ 	shl $16, %eax
+@@ -1198,7 +1315,6 @@ return_to_handler:
+ 	ret
+ #endif
+ 
+-.section .rodata,"a"
+ #include "syscall_table_32.S"
+ 
+ syscall_table_size=(.-sys_call_table)
+@@ -1250,12 +1366,15 @@ error_code:
+ 	movl %ecx, %fs
+ 	UNWIND_ESPFIX_STACK
+ 	GS_TO_REG %ecx
++
++	PAX_ENTER_KERNEL
++
+ 	movl PT_GS(%esp), %edi		# get the function address
+ 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
+ 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
+ 	REG_TO_PTGS %ecx
+ 	SET_KERNEL_GS %ecx
+-	movl $(__USER_DS), %ecx
++	movl $(__KERNEL_DS), %ecx
+ 	movl %ecx, %ds
+ 	movl %ecx, %es
+ 	TRACE_IRQS_OFF
+@@ -1351,6 +1470,9 @@ nmi_stack_correct:
+ 	xorl %edx,%edx		# zero error code
+ 	movl %esp,%eax		# pt_regs pointer
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	jmp restore_all_notrace
+ 	CFI_ENDPROC
+ 
+@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
+ 	FIXUP_ESPFIX_STACK		# %eax == %esp
+ 	xorl %edx,%edx			# zero error code
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	RESTORE_REGS
+ 	lss 12+4(%esp), %esp		# back to espfix stack
+ 	CFI_ADJUST_CFA_OFFSET -24
+diff -urNp linux-2.6.32.12/arch/x86/kernel/entry_64.S linux-2.6.32.12/arch/x86/kernel/entry_64.S
+--- linux-2.6.32.12/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/entry_64.S	2010-04-07 16:58:23.343008831 -0400
+@@ -53,6 +53,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+ #include <linux/elf-em.h>
+@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
+ ENDPROC(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
++	.macro ljmpq sel, off
++#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
++	.byte 0x48; ljmp *1234f(%rip)
++	.pushsection .rodata
++	.align 16
++	1234: .quad \off; .word \sel
++	.popsection
++#else
++	push $\sel
++	push $\off
++	lretq
++#endif
++	.endm
++
++ENTRY(pax_enter_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	jnc 1f
++	mov %cs,%edi
++	cmp $__KERNEL_CS,%edi
++	jz 3f
++	ljmpq __KERNEL_CS,3f
++1:	ljmpq __KERNEXEC_KERNEL_CS,2f
++2:	SET_RDI_INTO_CR0
++3:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel)
++
++ENTRY(pax_exit_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	mov %cs,%rdi
++	cmp $__KERNEXEC_KERNEL_CS,%edi
++	jnz 2f
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	ljmpq __KERNEL_CS,1f
++1:	SET_RDI_INTO_CR0
++2:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI);
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel)
++
++ENTRY(pax_enter_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++	push %rbx
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR3_INTO_RDI
++	mov %rdi,%rbx
++	add $__START_KERNEL_map,%rbx
++	sub phys_base(%rip),%rbx
++
++#ifdef CONFIG_PARAVIRT
++	push %rdi
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0,i*8(%rbx)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	pop %rdi
++#endif
++	SET_RDI_INTO_CR3
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rbx
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel_user)
++
++ENTRY(pax_exit_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	push %rbx
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++	GET_CR3_INTO_RDI
++	add $__START_KERNEL_map,%rdi
++	sub phys_base(%rip),%rdi
++
++#ifdef CONFIG_PARAVIRT
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	mov %rdi,%rbx
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0x67,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0x67,i*8(%rdi)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	PV_RESTORE_REGS(CLBR_RDI)
++	pop %rbx
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel_user)
+ 
+ .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
+ #ifdef CONFIG_TRACE_IRQFLAGS
+@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
+ 
+ 	movq	%rsp,PER_CPU_VAR(old_rsp)
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs off/on section - it's straight
+ 	 * and short:
+@@ -502,6 +691,11 @@ sysret_check:
+ 	andl %edi,%edx
+ 	jnz  sysret_careful
+ 	CFI_REMEMBER_STATE
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	/*
+ 	 * sysretq will re-enable interrupts:
+ 	 */
+@@ -800,7 +994,16 @@ END(interrupt)
+ 	CFI_ADJUST_CFA_OFFSET 10*8
+ 	call save_args
+ 	PARTIAL_FRAME 0
+-	call \func
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rdi)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	call \func
+ 	.endm
+ 
+ 	/*
+@@ -844,12 +1047,18 @@ retint_swapgs:		/* return to user-space 
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	TRACE_IRQS_IRETQ
+ 	SWAPGS
+ 	jmp restore_args
+ 
+ retint_restore_args:	/* return to kernel space */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++	call pax_exit_kernel
+ 	/*
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+@@ -1032,7 +1241,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
+-	movq %rsp,%rdi		/* pt_regs pointer */
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+ 	jmp error_exit		/* %ebx: no swapgs flag */
+@@ -1049,7 +1267,16 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
+-	movq %rsp,%rdi		/* pt_regs pointer */
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+ 	jmp paranoid_exit	/* %ebx: no swapgs flag */
+@@ -1066,9 +1293,23 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
+-	movq %rsp,%rdi		/* pt_regs pointer */
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+-	PER_CPU(init_tss, %rbp)
++#ifdef CONFIG_SMP
++	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
++	lea init_tss(%rbp), %rbp
++#else
++	lea init_tss(%rip), %rbp
++#endif
+ 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+ 	call \do_sym
+ 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+@@ -1085,7 +1326,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
+-	movq %rsp,%rdi			/* pt_regs pointer */
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+ 	call \do_sym
+@@ -1104,7 +1354,16 @@ ENTRY(\sym)
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
+ 	TRACE_IRQS_OFF
+-	movq %rsp,%rdi			/* pt_regs pointer */
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+ 	call \do_sym
+@@ -1408,11 +1667,13 @@ ENTRY(paranoid_exit)
+ 	testl $3,CS(%rsp)
+ 	jnz   paranoid_userspace
+ paranoid_swapgs:
++	call pax_exit_kernel
+ 	TRACE_IRQS_IRETQ 0
+ 	SWAPGS_UNSAFE_STACK
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ paranoid_restore:
++	call pax_exit_kernel
+ 	TRACE_IRQS_IRETQ 0
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+@@ -1529,6 +1790,16 @@ ENTRY(nmi)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testl $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++#else
++	call pax_enter_kernel
++#endif
++2:
+ 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
+ 	movq %rsp,%rdi
+ 	movq $-1,%rsi
+@@ -1544,6 +1815,7 @@ ENTRY(nmi)
+ nmi_swapgs:
+ 	SWAPGS_UNSAFE_STACK
+ nmi_restore:
++	call pax_exit_kernel
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ nmi_userspace:
+diff -urNp linux-2.6.32.12/arch/x86/kernel/ftrace.c linux-2.6.32.12/arch/x86/kernel/ftrace.c
+--- linux-2.6.32.12/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/ftrace.c	2010-04-04 20:46:41.517551870 -0400
+@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
+ {
+ 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
+ 		smp_rmb();
++		pax_open_kernel();
+ 		ftrace_mod_code();
++		pax_close_kernel();
+ 		atomic_inc(&nmi_update_count);
+ 	}
+ 	/* Must have previous changes seen before executions */
+@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
+ 
+ 
+ 
+-static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
++static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
+ 
+ static unsigned char *ftrace_nop_replace(void)
+ {
+@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
+ {
+ 	unsigned char replaced[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	/*
+ 	 * Note: Due to modules and __init, code can
+ 	 *  disappear and change, we need to protect against faulting
+@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
+ 	unsigned char old[MCOUNT_INSN_SIZE], *new;
+ 	int ret;
+ 
+-	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
++	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
+ 	new = ftrace_call_replace(ip, (unsigned long)func);
+ 	ret = ftrace_modify_code(ip, old, new);
+ 
+@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
+ 	switch (faulted) {
+ 	case 0:
+ 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
+-		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 1:
+ 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
+-		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 2:
+ 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
+-		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
+ 		break;
+ 	}
+ 
+@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
+ {
+ 	unsigned char code[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/head32.c linux-2.6.32.12/arch/x86/kernel/head32.c
+--- linux-2.6.32.12/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/head32.c	2010-04-04 20:46:41.517551870 -0400
+@@ -16,6 +16,7 @@
+ #include <asm/apic.h>
+ #include <asm/io_apic.h>
+ #include <asm/bios_ebda.h>
++#include <asm/boot.h>
+ 
+ static void __init i386_default_early_setup(void)
+ {
+@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
+ {
+ 	reserve_trampoline_memory();
+ 
+-	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
++	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
+ 
+ #ifdef CONFIG_BLK_DEV_INITRD
+ 	/* Reserve INITRD */
+diff -urNp linux-2.6.32.12/arch/x86/kernel/head_32.S linux-2.6.32.12/arch/x86/kernel/head_32.S
+--- linux-2.6.32.12/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/head_32.S	2010-04-04 20:58:33.220592413 -0400
+@@ -19,10 +19,17 @@
+ #include <asm/setup.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/msr-index.h>
+ 
+ /* Physical address */
+ #define pa(X) ((X) - __PAGE_OFFSET)
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /*
+  * References to members of the new_cpu_data structure.
+  */
+@@ -52,11 +59,7 @@
+  * and small than max_low_pfn, otherwise will waste some page table entries
+  */
+ 
+-#if PTRS_PER_PMD > 1
+-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
+-#else
+-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
+-#endif
++#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
+ 
+ /* Enough space to fit pagetables for the low memory linear map */
+ MAPPING_BEYOND_END = \
+@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
+ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+ 
+ /*
++ * Real beginning of normal "text" segment
++ */
++ENTRY(stext)
++ENTRY(_stext)
++
++/*
+  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
+  * %esi points to the real-mode code as a 32-bit pointer.
+  * CS and DS must be 4 GB flat segments, but we don't depend on
+@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+  * can.
+  */
+ __HEAD
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jmp startup_32
++/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
++.fill PAGE_SIZE-5,1,0xcc
++#endif
++
+ ENTRY(startup_32)
+ 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
+ 		us to not reload segments */
+@@ -97,6 +113,55 @@ ENTRY(startup_32)
+ 	movl %eax,%gs
+ 2:
+ 
++#ifdef CONFIG_SMP
++	movl $pa(cpu_gdt_table),%edi
++	movl $__per_cpu_load,%eax
++	movw %ax,__KERNEL_PERCPU + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_PERCPU + 4(%edi)
++	movb %ah,__KERNEL_PERCPU + 7(%edi)
++	movl $__per_cpu_end - 1,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,__KERNEL_PERCPU + 0(%edi)
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++1:
++	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	movl $pa(boot_gdt),%edi
++	movl $__LOAD_PHYSICAL_ADDR,%eax
++	movw %ax,__BOOT_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__BOOT_CS + 4(%edi)
++	movb %ah,__BOOT_CS + 7(%edi)
++	rorl $16,%eax
++
++	ljmp $(__BOOT_CS),$1f
++1:
++
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++	addl $__PAGE_OFFSET,%eax
++1:
++	movw %ax,__KERNEL_CS + 2(%edi)
++	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_CS + 4(%edi)
++	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
++	movb %ah,__KERNEL_CS + 7(%edi)
++	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
++	rorl $16,%eax
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
+ /*
+  * Clear BSS first so that there are no surprises...
+  */
+@@ -140,9 +205,7 @@ ENTRY(startup_32)
+ 	cmpl $num_subarch_entries, %eax
+ 	jae bad_subarch
+ 
+-	movl pa(subarch_entries)(,%eax,4), %eax
+-	subl $__PAGE_OFFSET, %eax
+-	jmp *%eax
++	jmp *pa(subarch_entries)(,%eax,4)
+ 
+ bad_subarch:
+ WEAK(lguest_entry)
+@@ -154,10 +217,10 @@ WEAK(xen_entry)
+ 	__INITDATA
+ 
+ subarch_entries:
+-	.long default_entry		/* normal x86/PC */
+-	.long lguest_entry		/* lguest hypervisor */
+-	.long xen_entry			/* Xen hypervisor */
+-	.long default_entry		/* Moorestown MID */
++	.long ta(default_entry)		/* normal x86/PC */
++	.long ta(lguest_entry)		/* lguest hypervisor */
++	.long ta(xen_entry)		/* Xen hypervisor */
++	.long ta(default_entry)		/* Moorestown MID */
+ num_subarch_entries = (. - subarch_entries) / 4
+ .previous
+ #endif /* CONFIG_PARAVIRT */
+@@ -218,8 +281,11 @@ default_entry:
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#endif
+ #else	/* Not PAE */
+ 
+ page_pde_offset = (__PAGE_OFFSET >> 20);
+@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_dir+0xffc)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
++#endif
+ #endif
+ 	jmp 3f
+ /*
+@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
+ 	orl %edx,%eax
+ 	movl %eax,%cr4
+ 
++#ifdef CONFIG_X86_PAE
+ 	btl $5, %eax		# check if PAE is enabled
+ 	jnc 6f
+ 
+@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
+ 	jnc 6f
+ 
+ 	/* Setup EFER (Extended Feature Enable Register) */
+-	movl $0xc0000080, %ecx
++	movl $MSR_EFER, %ecx
+ 	rdmsr
+ 
+ 	btsl $11, %eax
+ 	/* Make changes effective */
+ 	wrmsr
+ 
++	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
++	movl $1,pa(nx_enabled)
++#endif
++
+ 6:
+ 
+ /*
+@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
+ 
+ #ifdef CONFIG_SMP
+ 	cmpb $0, ready
+-	jz  1f				/* Initial CPU cleans BSS */
+-	jmp checkCPUtype
+-1:
++	jnz checkCPUtype		/* Initial CPU cleans BSS */
+ #endif /* CONFIG_SMP */
+ 
+ /*
+@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
+ 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
+ 	movl %eax,%ss			# after changing gdt.
+ 
+-	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
++#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
+ 	movl %eax,%ds
+ 	movl %eax,%es
+ 
+@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
+ 	 */
+ 	cmpb $0,ready
+ 	jne 1f
+-	movl $per_cpu__gdt_page,%eax
++	movl $cpu_gdt_table,%eax
+ 	movl $per_cpu__stack_canary,%ecx
++#ifdef CONFIG_SMP
++	addl $__per_cpu_load,%ecx
++#endif
+ 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+ 	shrl $16, %ecx
+ 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
+ #ifdef CONFIG_SMP
+ 	movb ready, %cl
+ 	movb $1, ready
+-	cmpb $0,%cl		# the first CPU calls start_kernel
+-	je   1f
+-	movl (stack_start), %esp
+-1:
+ #endif /* CONFIG_SMP */
+ 	jmp *(initial_code)
+ 
+@@ -546,22 +617,22 @@ early_page_fault:
+ 	jmp early_fault
+ 
+ early_fault:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $1,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pusha
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	movl %cr2,%eax
+ 	pushl %eax
+ 	pushl %edx		/* trapno */
+ 	pushl $fault_msg
+ 	call printk
++;	call dump_stack
+ #endif
+-	call dump_stack
+ hlt_loop:
+ 	hlt
+ 	jmp hlt_loop
+@@ -569,8 +640,11 @@ hlt_loop:
+ /* This is the default interrupt "handler" :-) */
+ 	ALIGN
+ ignore_int:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $2,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pushl %eax
+ 	pushl %ecx
+ 	pushl %edx
+@@ -579,9 +653,6 @@ ignore_int:
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	pushl 16(%esp)
+ 	pushl 24(%esp)
+ 	pushl 32(%esp)
+@@ -608,27 +679,45 @@ ENTRY(initial_code)
+ /*
+  * BSS section
+  */
+-__PAGE_ALIGNED_BSS
+-	.align PAGE_SIZE_asm
+ #ifdef CONFIG_X86_PAE
++.section .swapper_pg_pmd,"a",@progbits
+ swapper_pg_pmd:
+ 	.fill 1024*KPMDS,4,0
+ #else
++.section .swapper_pg_dir,"a",@progbits
+ ENTRY(swapper_pg_dir)
+ 	.fill 1024,4,0
+ #endif
++
+ swapper_pg_fixmap:
+ 	.fill 1024,4,0
++
++.section .empty_zero_page,"a",@progbits
+ ENTRY(empty_zero_page)
+ 	.fill 4096,1,0
+ 
+ /*
++ * The IDT has to be page-aligned to simplify the Pentium
++ * F0 0F bug workaround.. We have a special link segment
++ * for this.
++ */
++.section .idt,"a",@progbits
++ENTRY(idt_table)
++	.fill 256,8,0
++
++/*
+  * This starts the data section.
+  */
+ #ifdef CONFIG_X86_PAE
+-__PAGE_ALIGNED_DATA
+-	/* Page-aligned for the benefit of paravirt? */
+-	.align PAGE_SIZE_asm
++.section .swapper_pg_dir,"a",@progbits
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ENTRY(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ ENTRY(swapper_pg_dir)
+ 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
+ # if KPMDS == 3
+@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
+ 
+ .data
+ ENTRY(stack_start)
+-	.long init_thread_union+THREAD_SIZE
++	.long init_thread_union+THREAD_SIZE-8
+ 	.long __BOOT_DS
+ 
+ ready:	.byte 0
+ 
++.section .rodata,"a",@progbits
+ early_recursion_flag:
+ 	.long 0
+ 
+@@ -691,7 +781,7 @@ fault_msg:
+ 	.word 0				# 32 bit align gdt_desc.address
+ boot_gdt_descr:
+ 	.word __BOOT_DS+7
+-	.long boot_gdt - __PAGE_OFFSET
++	.long pa(boot_gdt)
+ 
+ 	.word 0				# 32-bit align idt_desc.address
+ idt_descr:
+@@ -702,7 +792,7 @@ idt_descr:
+ 	.word 0				# 32 bit align gdt_desc.address
+ ENTRY(early_gdt_descr)
+ 	.word GDT_ENTRIES*8-1
+-	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
++	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
+ 
+ /*
+  * The boot_gdt must mirror the equivalent in setup.S and is
+@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
+ 	.align L1_CACHE_BYTES
+ ENTRY(boot_gdt)
+ 	.fill GDT_ENTRY_BOOT_CS,8,0
+-	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
+-	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
++	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
++
++	.align PAGE_SIZE_asm
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad 0x0000000000000000	/* NULL descriptor */
++	.quad 0x0000000000000000	/* 0x0b reserved */
++	.quad 0x0000000000000000	/* 0x13 reserved */
++	.quad 0x0000000000000000	/* 0x1b reserved */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
++#else
++	.quad 0x0000000000000000	/* 0x20 unused */
++#endif
++
++	.quad 0x0000000000000000	/* 0x28 unused */
++	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
++	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
++	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
++	.quad 0x0000000000000000	/* 0x4b reserved */
++	.quad 0x0000000000000000	/* 0x53 reserved */
++	.quad 0x0000000000000000	/* 0x5b reserved */
++
++	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
++	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
++	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
++
++	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
++	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
++
++	/*
++	 * Segments used for calling PnP BIOS have byte granularity.
++	 * The code segments and data segments have fixed 64k limits,
++	 * the transfer segment sizes are set at run time.
++	 */
++	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
++	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
++	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
++	.quad 0x0000930000000000	/* 0xa8 16-bit data */
++	.quad 0x0000930000000000	/* 0xb0 16-bit data */
++
++	/*
++	 * The APM segments have byte granularity and their bases
++	 * are set at run time.  All have 64k limits.
++	 */
++	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
++	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
++	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
++
++	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
++	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
++	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
++	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
++	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
++	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
++
++	/* Be sure this is zeroed to avoid false validations in Xen */
++	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
++	.endr
+diff -urNp linux-2.6.32.12/arch/x86/kernel/head64.c linux-2.6.32.12/arch/x86/kernel/head64.c
+--- linux-2.6.32.12/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/head64.c	2010-04-04 20:58:33.225084964 -0400
+@@ -29,7 +29,13 @@
+ static void __init zap_identity_mappings(void)
+ {
+ 	pgd_t *pgd = pgd_offset_k(0UL);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	set_pgd(pgd, native_make_pgd(0));
++#else
+ 	pgd_clear(pgd);
++#endif
++
+ 	__flush_tlb_all();
+ }
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/head_64.S linux-2.6.32.12/arch/x86/kernel/head_64.S
+--- linux-2.6.32.12/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/head_64.S	2010-04-04 20:58:33.220592413 -0400
+@@ -19,6 +19,7 @@
+ #include <asm/cache.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/cpufeature.h>
+ 
+ #ifdef CONFIG_PARAVIRT
+ #include <asm/asm-offsets.h>
+@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
+ L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
+ L4_START_KERNEL = pgd_index(__START_KERNEL_map)
+ L3_START_KERNEL = pud_index(__START_KERNEL_map)
++L4_VMALLOC_START = pgd_index(VMALLOC_START)
++L3_VMALLOC_START = pud_index(VMALLOC_START)
++L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
++L3_VMEMMAP_START = pud_index(VMEMMAP_START)
+ 
+ 	.text
+ 	__HEAD
+@@ -85,35 +90,22 @@ startup_64:
+ 	 */
+ 	addq	%rbp, init_level4_pgt + 0(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
+ 
+ 	addq	%rbp, level3_ident_pgt + 0(%rip)
++#ifndef CONFIG_XEN
++	addq	%rbp, level3_ident_pgt + 8(%rip)
++#endif
+ 
+-	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
+-	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
++	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
+ 
+-	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
+ 
+-	/* Add an Identity mapping if I am above 1G */
+-	leaq	_text(%rip), %rdi
+-	andq	$PMD_PAGE_MASK, %rdi
+-
+-	movq	%rdi, %rax
+-	shrq	$PUD_SHIFT, %rax
+-	andq	$(PTRS_PER_PUD - 1), %rax
+-	jz	ident_complete
+-
+-	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
+-	leaq	level3_ident_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-
+-	movq	%rdi, %rax
+-	shrq	$PMD_SHIFT, %rax
+-	andq	$(PTRS_PER_PMD - 1), %rax
+-	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
+-	leaq	level2_spare_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-ident_complete:
++	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
+ 
+ 	/*
+ 	 * Fixup the kernel text+data virtual addresses. Note that
+@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
+ 	 * after the boot processor executes this code.
+ 	 */
+ 
+-	/* Enable PAE mode and PGE */
+-	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
++	/* Enable PAE mode and PSE/PGE */
++	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
+ 	movq	%rax, %cr4
+ 
+ 	/* Setup early boot stage 4 level pagetables. */
+@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
+ 	movl	$MSR_EFER, %ecx
+ 	rdmsr
+ 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
+-	btl	$20,%edi		/* No Execute supported? */
++	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
+ 	jnc     1f
+ 	btsl	$_EFER_NX, %eax
++	leaq	init_level4_pgt(%rip), %rdi
++	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
+ 1:	wrmsr				/* Make changes effective */
+ 
+ 	/* Setup cr0 */
+@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
+ 	.quad	x86_64_start_kernel
+ 	ENTRY(initial_gs)
+ 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
+-	__FINITDATA
+ 
+ 	ENTRY(stack_start)
+ 	.quad  init_thread_union+THREAD_SIZE-8
+ 	.word  0
++	__FINITDATA
+ 
+ bad_address:
+ 	jmp bad_address
+ 
+-	.section ".init.text","ax"
++	__INIT
+ #ifdef CONFIG_EARLY_PRINTK
+ 	.globl early_idt_handlers
+ early_idt_handlers:
+@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
+ #endif /* EARLY_PRINTK */
+ 1:	hlt
+ 	jmp 1b
++	.previous
+ 
+ #ifdef CONFIG_EARLY_PRINTK
++	__INITDATA
+ early_recursion_flag:
+ 	.long 0
++	.previous
+ 
++	.section .rodata,"a",@progbits
+ early_idt_msg:
+ 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
+ early_idt_ripmsg:
+ 	.asciz "RIP %s\n"
+-#endif /* CONFIG_EARLY_PRINTK */
+ 	.previous
++#endif /* CONFIG_EARLY_PRINTK */
+ 
++	.section .rodata,"a",@progbits
+ #define NEXT_PAGE(name) \
+ 	.balign	PAGE_SIZE; \
+ ENTRY(name)
+@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
++	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
++	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
+ 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
+ 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++NEXT_PAGE(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ NEXT_PAGE(level3_ident_pgt)
+ 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++#ifdef CONFIG_XEN
+ 	.fill	511,8,0
++#else
++	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
++	.fill	510,8,0
++#endif
++
++NEXT_PAGE(level3_vmalloc_pgt)
++	.fill	512,8,0
++
++NEXT_PAGE(level3_vmemmap_pgt)
++	.fill	L3_VMEMMAP_START,8,0
++	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 
+ NEXT_PAGE(level3_kernel_pgt)
+ 	.fill	L3_START_KERNEL,8,0
+@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
+ 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++NEXT_PAGE(level2_vmemmap_pgt)
++	.fill	512,8,0
++
+ NEXT_PAGE(level2_fixmap_pgt)
+-	.fill	506,8,0
+-	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+-	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
+-	.fill	5,8,0
++	.fill	507,8,0
++	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
++	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
++	.fill	4,8,0
+ 
+-NEXT_PAGE(level1_fixmap_pgt)
++NEXT_PAGE(level1_vsyscall_pgt)
+ 	.fill	512,8,0
+ 
+-NEXT_PAGE(level2_ident_pgt)
+-	/* Since I easily can, map the first 1G.
++	/* Since I easily can, map the first 2G.
+ 	 * Don't set NX because code runs from these pages.
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
++NEXT_PAGE(level2_ident_pgt)
++	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
+ 
+ NEXT_PAGE(level2_kernel_pgt)
+ 	/*
+@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
+ 	 *  If you want to increase this then increase MODULES_VADDR
+ 	 *  too.)
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
+-		KERNEL_IMAGE_SIZE/PMD_SIZE)
+-
+-NEXT_PAGE(level2_spare_pgt)
+-	.fill   512, 8, 0
++	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
+ 
+ #undef PMDS
+ #undef NEXT_PAGE
+ 
+-	.data
++	.align PAGE_SIZE
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad	0x0000000000000000	/* NULL descriptor */
++	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
++	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
++	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
++	.quad	0x00cffb000000ffff	/* __USER32_CS */
++	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
++	.quad	0x00affb000000ffff	/* __USER_CS */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
++#else
++	.quad	0x0			/* unused */
++#endif
++
++	.quad	0,0			/* TSS */
++	.quad	0,0			/* LDT */
++	.quad	0,0,0			/* three TLS descriptors */
++	.quad	0x0000f40000000000	/* node/CPU stored in limit */
++	/* asm/segment.h:GDT_ENTRIES must match this */
++
++	/* zero the remaining page */
++	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
++	.endr
++
+ 	.align 16
+ 	.globl early_gdt_descr
+ early_gdt_descr:
+ 	.word	GDT_ENTRIES*8-1
+ early_gdt_descr_base:
+-	.quad	INIT_PER_CPU_VAR(gdt_page)
++	.quad	cpu_gdt_table
+ 
+ ENTRY(phys_base)
+ 	/* This must match the first entry in level2_kernel_pgt */
+ 	.quad   0x0000000000000000
+ 
+ #include "../../x86/xen/xen-head.S"
+-	
+-	.section .bss, "aw", @nobits
++
++	.section .rodata,"a",@progbits
+ 	.align L1_CACHE_BYTES
+ ENTRY(idt_table)
+-	.skip IDT_ENTRIES * 16
++	.fill 512,8,0
+ 
+ 	__PAGE_ALIGNED_BSS
+ 	.align PAGE_SIZE
+diff -urNp linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c
+--- linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c	2010-04-04 20:46:41.517551870 -0400
+@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
+ EXPORT_SYMBOL(cmpxchg8b_emu);
+ #endif
+ 
++EXPORT_SYMBOL_GPL(cpu_gdt_table);
++
+ /* Networking helper routines. */
+ EXPORT_SYMBOL(csum_partial_copy_generic);
++EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
++EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
+ 
+ EXPORT_SYMBOL(__get_user_1);
+ EXPORT_SYMBOL(__get_user_2);
+@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
+ 
+ EXPORT_SYMBOL(csum_partial);
+ EXPORT_SYMBOL(empty_zero_page);
++
++#ifdef CONFIG_PAX_KERNEXEC
++EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
++#endif
+diff -urNp linux-2.6.32.12/arch/x86/kernel/init_task.c linux-2.6.32.12/arch/x86/kernel/init_task.c
+--- linux-2.6.32.12/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/init_task.c	2010-04-04 20:46:41.517551870 -0400
+@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
+  * section. Since TSS's are completely CPU-local, we want them
+  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
+  */
+-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
+-
++struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
++EXPORT_SYMBOL(init_tss);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/ioport.c linux-2.6.32.12/arch/x86/kernel/ioport.c
+--- linux-2.6.32.12/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/ioport.c	2010-04-04 20:46:41.517551870 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/sched.h>
+ #include <linux/kernel.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/ioport.h>
+@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
+ 
+ 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
+ 		return -EINVAL;
++#ifdef CONFIG_GRKERNSEC_IO
++	if (turn_on) {
++		gr_handle_ioperm();
++		return -EPERM;
++	}
++#endif
+ 	if (turn_on && !capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 
+@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
+ 	 * because the ->io_bitmap_max value must match the bitmap
+ 	 * contents:
+ 	 */
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 
+ 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
+ 
+@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
+ 		return -EINVAL;
+ 	/* Trying to gain more privileges? */
+ 	if (level > old) {
++#ifdef CONFIG_GRKERNSEC_IO
++		gr_handle_iopl();
++		return -EPERM;
++#else
+ 		if (!capable(CAP_SYS_RAWIO))
+ 			return -EPERM;
++#endif
+ 	}
+ 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/irq_32.c linux-2.6.32.12/arch/x86/kernel/irq_32.c
+--- linux-2.6.32.12/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/irq_32.c	2010-04-04 20:46:41.521777445 -0400
+@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
+ 		return 0;
+ 
+ 	/* build the stack frame on the IRQ stack */
+-	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 	irqctx->tinfo.task = curctx->tinfo.task;
+ 	irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
+ 		irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+ 		/* build the stack frame on the softirq stack */
+-		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 
+ 		call_on_stack(__do_softirq, isp);
+ 		/*
+diff -urNp linux-2.6.32.12/arch/x86/kernel/kgdb.c linux-2.6.32.12/arch/x86/kernel/kgdb.c
+--- linux-2.6.32.12/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/kgdb.c	2010-04-04 20:46:41.521777445 -0400
+@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
+ 	return instruction_pointer(regs);
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: */
+ 	.gdb_bpt_instr		= { 0xcc },
+ 	.flags			= KGDB_HW_BREAKPOINT,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/kprobes.c linux-2.6.32.12/arch/x86/kernel/kprobes.c
+--- linux-2.6.32.12/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/kprobes.c	2010-04-04 20:46:41.521777445 -0400
+@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
+ 		char op;
+ 		s32 raddr;
+ 	} __attribute__((packed)) * jop;
+-	jop = (struct __arch_jmp_op *)from;
++
++	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
++
++	pax_open_kernel();
+ 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
+ 	jop->op = RELATIVEJUMP_INSTRUCTION;
++	pax_close_kernel();
+ }
+ 
+ /*
+@@ -345,16 +349,18 @@ static void __kprobes fix_riprel(struct 
+ 
+ static void __kprobes arch_copy_kprobe(struct kprobe *p)
+ {
+-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_open_kernel();
++	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_close_kernel();
+ 
+ 	fix_riprel(p);
+ 
+-	if (can_boost(p->addr))
++	if (can_boost(ktla_ktva(p->addr)))
+ 		p->ainsn.boostable = 0;
+ 	else
+ 		p->ainsn.boostable = -1;
+ 
+-	p->opcode = *p->addr;
++	p->opcode = *(ktla_ktva(p->addr));
+ }
+ 
+ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+@@ -432,7 +438,7 @@ static void __kprobes prepare_singlestep
+ 	if (p->opcode == BREAKPOINT_INSTRUCTION)
+ 		regs->ip = (unsigned long)p->addr;
+ 	else
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ }
+ 
+ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+@@ -453,7 +459,7 @@ static void __kprobes setup_singlestep(s
+ 	if (p->ainsn.boostable == 1 && !p->post_handler) {
+ 		/* Boost up -- we can execute copied instructions directly */
+ 		reset_current_kprobe();
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 		preempt_enable_no_resched();
+ 		return;
+ 	}
+@@ -523,7 +529,7 @@ static int __kprobes kprobe_handler(stru
+ 	struct kprobe_ctlblk *kcb;
+ 
+ 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
+-	if (*addr != BREAKPOINT_INSTRUCTION) {
++	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
+ 		/*
+ 		 * The breakpoint instruction was removed right
+ 		 * after we hit it.  Another cpu has removed
+@@ -775,7 +781,7 @@ static void __kprobes resume_execution(s
+ 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
+ {
+ 	unsigned long *tos = stack_addr(regs);
+-	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
++	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 	unsigned long orig_ip = (unsigned long)p->addr;
+ 	kprobe_opcode_t *insn = p->ainsn.insn;
+ 
+@@ -958,7 +964,7 @@ int __kprobes kprobe_exceptions_notify(s
+ 	struct die_args *args = data;
+ 	int ret = NOTIFY_DONE;
+ 
+-	if (args->regs && user_mode_vm(args->regs))
++	if (args->regs && user_mode(args->regs))
+ 		return ret;
+ 
+ 	switch (val) {
+diff -urNp linux-2.6.32.12/arch/x86/kernel/ldt.c linux-2.6.32.12/arch/x86/kernel/ldt.c
+--- linux-2.6.32.12/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/ldt.c	2010-04-04 20:46:41.521777445 -0400
+@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
+ 	if (reload) {
+ #ifdef CONFIG_SMP
+ 		preempt_disable();
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ 		if (!cpumask_equal(mm_cpumask(current->mm),
+ 				   cpumask_of(smp_processor_id())))
+ 			smp_call_function(flush_ldt, current->mm, 1);
+ 		preempt_enable();
+ #else
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ #endif
+ 	}
+ 	if (oldsize) {
+@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
+ 		return err;
+ 
+ 	for (i = 0; i < old->size; i++)
+-		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
++		write_ldt_entry(new->ldt, i, old->ldt + i);
+ 	return 0;
+ }
+ 
+@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
+ 		retval = copy_ldt(&mm->context, &old_mm->context);
+ 		mutex_unlock(&old_mm->context.lock);
+ 	}
++
++	if (tsk == current) {
++		mm->context.vdso = ~0UL;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		mm->context.user_cs_base = 0UL;
++		mm->context.user_cs_limit = ~0UL;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		cpus_clear(mm->context.cpu_user_cs_mask);
++#endif
++
++#endif
++#endif
++
++	}
++
+ 	return retval;
+ }
+ 
+@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
++		error = -EINVAL;
++		goto out_unlock;
++	}
++#endif
++
+ 	fill_ldt(&ldt, &ldt_info);
+ 	if (oldmode)
+ 		ldt.avl = 0;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c
+--- linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c	2010-04-04 20:46:41.521777445 -0400
+@@ -26,7 +26,7 @@
+ #include <asm/system.h>
+ #include <asm/cacheflush.h>
+ 
+-static void set_idt(void *newidt, __u16 limit)
++static void set_idt(struct desc_struct *newidt, __u16 limit)
+ {
+ 	struct desc_ptr curidt;
+ 
+@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
+ }
+ 
+ 
+-static void set_gdt(void *newgdt, __u16 limit)
++static void set_gdt(struct desc_struct *newgdt, __u16 limit)
+ {
+ 	struct desc_ptr curgdt;
+ 
+@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
+ 	}
+ 
+ 	control_page = page_address(image->control_code_page);
+-	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
++	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
+ 
+ 	relocate_kernel_ptr = control_page;
+ 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c
+--- linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c	2010-04-04 20:58:33.225084964 -0400
+@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
+ 	}
+ 	/* clear the unused entries */
+ 	while (addr < end_addr) {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		set_pgd(level4p++, native_make_pgd(0));
++#else
+ 		pgd_clear(level4p++);
++#endif
++
+ 		addr += PGDIR_SIZE;
+ 	}
+ out:
+diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_amd.c linux-2.6.32.12/arch/x86/kernel/microcode_amd.c
+--- linux-2.6.32.12/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/microcode_amd.c	2010-04-04 20:46:41.521777445 -0400
+@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_amd_ops = {
++static const struct microcode_ops microcode_amd_ops = {
+ 	.request_microcode_user           = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info_amd,
+@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
+ 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
+ };
+ 
+-struct microcode_ops * __init init_amd_microcode(void)
++const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return &microcode_amd_ops;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_core.c linux-2.6.32.12/arch/x86/kernel/microcode_core.c
+--- linux-2.6.32.12/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/microcode_core.c	2010-04-04 20:46:41.521777445 -0400
+@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
+ 
+ #define MICROCODE_VERSION	"2.00"
+ 
+-static struct microcode_ops	*microcode_ops;
++static const struct microcode_ops	*microcode_ops;
+ 
+ /*
+  * Synchronization.
+diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_intel.c linux-2.6.32.12/arch/x86/kernel/microcode_intel.c
+--- linux-2.6.32.12/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/microcode_intel.c	2010-04-04 20:46:41.521777445 -0400
+@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
+ 
+ static int get_ucode_user(void *to, const void *from, size_t n)
+ {
+-	return copy_from_user(to, from, n);
++	return copy_from_user(to, (__force const void __user *)from, n);
+ }
+ 
+ static enum ucode_state
+ request_microcode_user(int cpu, const void __user *buf, size_t size)
+ {
+-	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
++	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
+ }
+ 
+ static void microcode_fini_cpu(int cpu)
+@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_intel_ops = {
++static const struct microcode_ops microcode_intel_ops = {
+ 	.request_microcode_user		  = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info,
+@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
+ 	.microcode_fini_cpu               = microcode_fini_cpu,
+ };
+ 
+-struct microcode_ops * __init init_intel_microcode(void)
++const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return &microcode_intel_ops;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/kernel/module.c linux-2.6.32.12/arch/x86/kernel/module.c
+--- linux-2.6.32.12/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/module.c	2010-04-04 20:46:41.521777445 -0400
+@@ -34,7 +34,7 @@
+ #define DEBUGP(fmt...)
+ #endif
+ 
+-void *module_alloc(unsigned long size)
++static void *__module_alloc(unsigned long size, pgprot_t prot)
+ {
+ 	struct vm_struct *area;
+ 
+@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
+ 	if (!area)
+ 		return NULL;
+ 
+-	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
+-					PAGE_KERNEL_EXEC);
++	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
++}
++
++void *module_alloc(unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	return __module_alloc(size, PAGE_KERNEL);
++#else
++	return __module_alloc(size, PAGE_KERNEL_EXEC);
++#endif
++
+ }
+ 
+ /* Free memory returned from module_alloc */
+@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_X86_32
++void *module_alloc_exec(unsigned long size)
++{
++	struct vm_struct *area;
++
++	if (size == 0)
++		return NULL;
++
++	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
++	return area ? area->addr : NULL;
++}
++EXPORT_SYMBOL(module_alloc_exec);
++
++void module_free_exec(struct module *mod, void *module_region)
++{
++	vunmap(module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++#else
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++
++void *module_alloc_exec(unsigned long size)
++{
++	return __module_alloc(size, PAGE_KERNEL_RX);
++}
++EXPORT_SYMBOL(module_alloc_exec);
++#endif
++#endif
++
+ /* We don't need anything special. */
+ int module_frob_arch_sections(Elf_Ehdr *hdr,
+ 			      Elf_Shdr *sechdrs,
+@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 	unsigned int i;
+ 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
+ 	Elf32_Sym *sym;
+-	uint32_t *location;
++	uint32_t *plocation, location;
+ 
+ 	DEBUGP("Applying relocate section %u to %u\n", relsec,
+ 	       sechdrs[relsec].sh_info);
+ 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+ 		/* This is where to make the change */
+-		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
+-			+ rel[i].r_offset;
++		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
++		location = (uint32_t)plocation;
++		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
++			plocation = ktla_ktva((void *)plocation);
+ 		/* This is the symbol it is referring to.  Note that all
+ 		   undefined symbols have been resolved.  */
+ 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
+@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 		switch (ELF32_R_TYPE(rel[i].r_info)) {
+ 		case R_386_32:
+ 			/* We add the value into the location given */
+-			*location += sym->st_value;
++			pax_open_kernel();
++			*plocation += sym->st_value;
++			pax_close_kernel();
+ 			break;
+ 		case R_386_PC32:
+ 			/* Add the value, subtract its postition */
+-			*location += sym->st_value - (uint32_t)location;
++			pax_open_kernel();
++			*plocation += sym->st_value - location;
++			pax_close_kernel();
+ 			break;
+ 		default:
+ 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
+@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
+ 		case R_X86_64_NONE:
+ 			break;
+ 		case R_X86_64_64:
++			pax_open_kernel();
+ 			*(u64 *)loc = val;
++			pax_close_kernel();
+ 			break;
+ 		case R_X86_64_32:
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
+ 			if (val != *(u32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_32S:
++			pax_open_kernel();
+ 			*(s32 *)loc = val;
++			pax_close_kernel();
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_PC32:
+ 			val -= (u64)loc;
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
++
+ #if 0
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/paravirt.c linux-2.6.32.12/arch/x86/kernel/paravirt.c
+--- linux-2.6.32.12/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/paravirt.c	2010-04-29 17:46:36.865234674 -0400
+@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
+  * corresponding structure. */
+ static void *get_call_destination(u8 type)
+ {
+-	struct paravirt_patch_template tmpl = {
++	const struct paravirt_patch_template tmpl = {
+ 		.pv_init_ops = pv_init_ops,
+ 		.pv_time_ops = pv_time_ops,
+ 		.pv_cpu_ops = pv_cpu_ops,
+@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
+ 	if (opfunc == NULL)
+ 		/* If there's no function, patch it with a ud2a (BUG) */
+ 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
+-	else if (opfunc == _paravirt_nop)
++	else if (opfunc == (void *)_paravirt_nop)
+ 		/* If the operation is a nop, then nop the callsite */
+ 		ret = paravirt_patch_nop();
+ 
+ 	/* identity functions just return their single argument */
+-	else if (opfunc == _paravirt_ident_32)
++	else if (opfunc == (void *)_paravirt_ident_32)
+ 		ret = paravirt_patch_ident_32(insnbuf, len);
+-	else if (opfunc == _paravirt_ident_64)
++	else if (opfunc == (void *)_paravirt_ident_64)
+ 		ret = paravirt_patch_ident_64(insnbuf, len);
+ 
+ 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
+@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
+ 	if (insn_len > len || start == NULL)
+ 		insn_len = len;
+ 	else
+-		memcpy(insnbuf, start, insn_len);
++		memcpy(insnbuf, ktla_ktva(start), insn_len);
+ 
+ 	return insn_len;
+ }
+@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
+ 	preempt_enable();
+ }
+ 
+-struct pv_info pv_info = {
++struct pv_info pv_info __read_only = {
+ 	.name = "bare hardware",
+ 	.paravirt_enabled = 0,
+ 	.kernel_rpl = 0,
+ 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
+ };
+ 
+-struct pv_init_ops pv_init_ops = {
++struct pv_init_ops pv_init_ops __read_only = {
+ 	.patch = native_patch,
+ };
+ 
+-struct pv_time_ops pv_time_ops = {
++struct pv_time_ops pv_time_ops __read_only = {
+ 	.sched_clock = native_sched_clock,
+ };
+ 
+-struct pv_irq_ops pv_irq_ops = {
++struct pv_irq_ops pv_irq_ops __read_only = {
+ 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
+ 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
+ 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
+@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
+ #endif
+ };
+ 
+-struct pv_cpu_ops pv_cpu_ops = {
++struct pv_cpu_ops pv_cpu_ops __read_only = {
+ 	.cpuid = native_cpuid,
+ 	.get_debugreg = native_get_debugreg,
+ 	.set_debugreg = native_set_debugreg,
+@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
+ 	.end_context_switch = paravirt_nop,
+ };
+ 
+-struct pv_apic_ops pv_apic_ops = {
++struct pv_apic_ops pv_apic_ops __read_only = {
+ #ifdef CONFIG_X86_LOCAL_APIC
+ 	.startup_ipi_hook = paravirt_nop,
+ #endif
+@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
+ #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
+ #endif
+ 
+-struct pv_mmu_ops pv_mmu_ops = {
++struct pv_mmu_ops pv_mmu_ops __read_only = {
+ 
+ 	.read_cr2 = native_read_cr2,
+ 	.write_cr2 = native_write_cr2,
+@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+ 	},
+ 
+ 	.set_fixmap = native_set_fixmap,
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.pax_open_kernel = native_pax_open_kernel,
++	.pax_close_kernel = native_pax_close_kernel,
++#endif
++
+ };
+ 
+ EXPORT_SYMBOL_GPL(pv_time_ops);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c
+--- linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c	2010-04-04 20:46:41.521777445 -0400
+@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
+ 	__raw_spin_lock(lock);
+ }
+ 
+-struct pv_lock_ops pv_lock_ops = {
++struct pv_lock_ops pv_lock_ops __read_only = {
+ #ifdef CONFIG_SMP
+ 	.spin_is_locked = __ticket_spin_is_locked,
+ 	.spin_is_contended = __ticket_spin_is_contended,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c
+--- linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c	2010-04-04 20:46:41.521777445 -0400
+@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
+ 	free_pages((unsigned long)vaddr, get_order(size));
+ }
+ 
+-static struct dma_map_ops calgary_dma_ops = {
++static const struct dma_map_ops calgary_dma_ops = {
+ 	.alloc_coherent = calgary_alloc_coherent,
+ 	.free_coherent = calgary_free_coherent,
+ 	.map_sg = calgary_map_sg,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-dma.c linux-2.6.32.12/arch/x86/kernel/pci-dma.c
+--- linux-2.6.32.12/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/pci-dma.c	2010-04-04 20:46:41.521777445 -0400
+@@ -14,7 +14,7 @@
+ 
+ static int forbid_dac __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int iommu_sac_force __read_mostly;
+@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
+ 
+ int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ #ifdef CONFIG_PCI
+ 	if (mask > 0xffffffff && forbid_dac > 0) {
+diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c
+--- linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c	2010-04-29 17:49:57.989487280 -0400
+@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
+ 	return -1;
+ }
+ 
+-static struct dma_map_ops gart_dma_ops = {
++static const struct dma_map_ops gart_dma_ops = {
+ 	.map_sg				= gart_map_sg,
+ 	.unmap_sg			= gart_unmap_sg,
+ 	.map_page			= gart_map_page,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-nommu.c linux-2.6.32.12/arch/x86/kernel/pci-nommu.c
+--- linux-2.6.32.12/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/pci-nommu.c	2010-04-04 20:46:41.521777445 -0400
+@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
+ 	flush_write_buffers();
+ }
+ 
+-struct dma_map_ops nommu_dma_ops = {
++const struct dma_map_ops nommu_dma_ops = {
+ 	.alloc_coherent		= dma_generic_alloc_coherent,
+ 	.free_coherent		= nommu_free_coherent,
+ 	.map_sg			= nommu_map_sg,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c
+--- linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c	2010-04-04 20:46:41.521777445 -0400
+@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
+ 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
+ }
+ 
+-static struct dma_map_ops swiotlb_dma_ops = {
++static const struct dma_map_ops swiotlb_dma_ops = {
+ 	.mapping_error = swiotlb_dma_mapping_error,
+ 	.alloc_coherent = x86_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/process_32.c linux-2.6.32.12/arch/x86/kernel/process_32.c
+--- linux-2.6.32.12/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/process_32.c	2010-04-04 20:46:41.521777445 -0400
+@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
+ unsigned long thread_saved_pc(struct task_struct *tsk)
+ {
+ 	return ((unsigned long *)tsk->thread.sp)[3];
++//XXX	return tsk->thread.eip;
+ }
+ 
+ #ifndef CONFIG_SMP
+@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	unsigned short ss, gs;
+ 	const char *board;
+ 
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		sp = regs->sp;
+ 		ss = regs->ss & 0xffff;
+ 		gs = get_user_gs(regs);
+@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
+ 	regs.bx = (unsigned long) fn;
+ 	regs.dx = (unsigned long) arg;
+ 
+-	regs.ds = __USER_DS;
+-	regs.es = __USER_DS;
++	regs.ds = __KERNEL_DS;
++	regs.es = __KERNEL_DS;
+ 	regs.fs = __KERNEL_PERCPU;
+ 	regs.gs = __KERNEL_STACK_CANARY;
+ 	regs.orig_ax = -1;
+@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
+ 	struct task_struct *tsk;
+ 	int err;
+ 
+-	childregs = task_pt_regs(p);
++	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
+ 	*childregs = *regs;
+ 	childregs->ax = 0;
+ 	childregs->sp = sp;
+@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
+ 	 * Set a new TLS for the child thread?
+ 	 */
+ 	if (clone_flags & CLONE_SETTLS)
++//XXX needs set_fs()?
+ 		err = do_set_thread_area(p, -1,
+ 			(struct user_desc __user *)childregs->si, 0);
+ 
+@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread,
+ 				 *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	bool preload_fpu;
+ 
+ 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
+@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
+ 	 */
+ 	lazy_save_gs(prev->gs);
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
++		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
++#endif
++
+ 	/*
+ 	 * Load the per-thread Thread-Local Storage descriptor.
+ 	 */
+@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++asmlinkage void pax_randomize_kstack(void)
++{
++	struct thread_struct *thread = &current->thread;
++	unsigned long time;
++
++	if (!randomize_va_space)
++		return;
++
++	rdtscl(time);
++
++	/* P4 seems to return a 0 LSB, ignore it */
++#ifdef CONFIG_MPENTIUM4
++	time &= 0x1EUL;
++	time <<= 2;
++#else
++	time &= 0xFUL;
++	time <<= 3;
++#endif
++
++	thread->sp0 ^= time;
++	load_sp0(init_tss + smp_processor_id(), thread);
++}
++#endif
+diff -urNp linux-2.6.32.12/arch/x86/kernel/process_64.c linux-2.6.32.12/arch/x86/kernel/process_64.c
+--- linux-2.6.32.12/arch/x86/kernel/process_64.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.12/arch/x86/kernel/process_64.c	2010-04-04 20:46:41.521777445 -0400
+@@ -91,7 +91,7 @@ static void __exit_idle(void)
+ void exit_idle(void)
+ {
+ 	/* idle loop has pid 0 */
+-	if (current->pid)
++	if (task_pid_nr(current))
+ 		return;
+ 	__exit_idle();
+ }
+@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	if (!board)
+ 		board = "";
+ 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version, board);
+@@ -381,7 +381,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread;
+ 	struct thread_struct *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	unsigned fsindex, gsindex;
+ 	bool preload_fpu;
+ 
+@@ -561,12 +561,11 @@ unsigned long get_wchan(struct task_stru
+ 	if (!p || p == current || p->state == TASK_RUNNING)
+ 		return 0;
+ 	stack = (unsigned long)task_stack_page(p);
+-	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
++	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
+ 		return 0;
+ 	fp = *(u64 *)(p->thread.sp);
+ 	do {
+-		if (fp < (unsigned long)stack ||
+-		    fp >= (unsigned long)stack+THREAD_SIZE)
++		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
+ 			return 0;
+ 		ip = *(u64 *)(fp+8);
+ 		if (!in_sched_functions(ip))
+diff -urNp linux-2.6.32.12/arch/x86/kernel/process.c linux-2.6.32.12/arch/x86/kernel/process.c
+--- linux-2.6.32.12/arch/x86/kernel/process.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.12/arch/x86/kernel/process.c	2010-04-04 20:46:41.521777445 -0400
+@@ -73,7 +73,7 @@ void exit_thread(void)
+ 	unsigned long *bp = t->io_bitmap_ptr;
+ 
+ 	if (bp) {
+-		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
++		struct tss_struct *tss = init_tss + get_cpu();
+ 
+ 		t->io_bitmap_ptr = NULL;
+ 		clear_thread_flag(TIF_IO_BITMAP);
+@@ -93,6 +93,9 @@ void flush_thread(void)
+ 
+ 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
+ 
++#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
++	loadsegment(gs, 0);
++#endif
+ 	tsk->thread.debugreg0 = 0;
+ 	tsk->thread.debugreg1 = 0;
+ 	tsk->thread.debugreg2 = 0;
+@@ -600,17 +603,3 @@ static int __init idle_setup(char *str)
+ 	return 0;
+ }
+ early_param("idle", idle_setup);
+-
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() % 8192;
+-	return sp & ~0xf;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long range_end = mm->brk + 0x02000000;
+-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+-}
+-
+diff -urNp linux-2.6.32.12/arch/x86/kernel/ptrace.c linux-2.6.32.12/arch/x86/kernel/ptrace.c
+--- linux-2.6.32.12/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/ptrace.c	2010-04-04 20:46:41.525738446 -0400
+@@ -925,7 +925,7 @@ static const struct user_regset_view use
+ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
+ {
+ 	int ret;
+-	unsigned long __user *datap = (unsigned long __user *)data;
++	unsigned long __user *datap = (__force unsigned long __user *)data;
+ 
+ 	switch (request) {
+ 	/* read the word at location addr in the USER area. */
+@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_get_thread_area(child, addr,
+-					 (struct user_desc __user *) data);
++					 (__force struct user_desc __user *) data);
+ 		break;
+ 
+ 	case PTRACE_SET_THREAD_AREA:
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_set_thread_area(child, addr,
+-					 (struct user_desc __user *) data, 0);
++					 (__force struct user_desc __user *) data, 0);
+ 		break;
+ #endif
+ 
+@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
+ #ifdef CONFIG_X86_PTRACE_BTS
+ 	case PTRACE_BTS_CONFIG:
+ 		ret = ptrace_bts_config
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_STATUS:
+ 		ret = ptrace_bts_status
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_SIZE:
+@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_GET:
+ 		ret = ptrace_bts_read_record
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_CLEAR:
+@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_DRAIN:
+ 		ret = ptrace_bts_drain
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ #endif /* CONFIG_X86_PTRACE_BTS */
+ 
+@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
+ 	info.si_code = si_code;
+ 
+ 	/* User-mode ip? */
+-	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
++	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
+ 
+ 	/* Send us the fake SIGTRAP */
+ 	force_sig_info(SIGTRAP, &info, tsk);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/reboot.c linux-2.6.32.12/arch/x86/kernel/reboot.c
+--- linux-2.6.32.12/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/reboot.c	2010-04-04 20:46:41.525738446 -0400
+@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
+ EXPORT_SYMBOL(pm_power_off);
+ 
+ static const struct desc_ptr no_idt = {};
+-static int reboot_mode;
++static unsigned short reboot_mode;
+ enum reboot_type reboot_type = BOOT_KBD;
+ int reboot_force;
+ 
+@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
+ 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static int __init reboot_init(void)
+@@ -292,12 +292,12 @@ core_initcall(reboot_init);
+    controller to pulse the CPU reset line, which is more thorough, but
+    doesn't work with at least one type of 486 motherboard.  It is easy
+    to stop this code working; hence the copious comments. */
+-static const unsigned long long
+-real_mode_gdt_entries [3] =
++static struct desc_struct
++real_mode_gdt_entries [3] __read_only =
+ {
+-	0x0000000000000000ULL,	/* Null descriptor */
+-	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
+-	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
++	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
++	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
++	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
+ };
+ 
+ static const struct desc_ptr
+@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
+  * specified by the code and length parameters.
+  * We assume that length will aways be less that 100!
+  */
+-void machine_real_restart(const unsigned char *code, int length)
++void machine_real_restart(const unsigned char *code, unsigned int length)
+ {
+ 	local_irq_disable();
+ 
+@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
+ 	/* Remap the kernel at virtual address zero, as well as offset zero
+ 	   from the kernel segment.  This assumes the kernel segment starts at
+ 	   virtual address PAGE_OFFSET. */
+-	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+-		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * Use `swapper_pg_dir' as our page directory.
+@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
+ 	   boot)".  This seems like a fairly standard thing that gets set by
+ 	   REBOOT.COM programs, and the previous reset routine did this
+ 	   too. */
+-	*((unsigned short *)0x472) = reboot_mode;
++	*(unsigned short *)(__va(0x472)) = reboot_mode;
+ 
+ 	/* For the switch to real mode, copy some code to low memory.  It has
+ 	   to be in the first 64k because it is running in 16-bit mode, and it
+ 	   has to have the same physical and virtual address, because it turns
+ 	   off paging.  Copy it near the end of the first page, out of the way
+ 	   of BIOS variables. */
+-	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
+-		real_mode_switch, sizeof (real_mode_switch));
+-	memcpy((void *)(0x1000 - 100), code, length);
++	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
++	memcpy(__va(0x1000 - 100), code, length);
+ 
+ 	/* Set up the IDT for real mode. */
+ 	load_idt(&real_mode_idt);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/setup.c linux-2.6.32.12/arch/x86/kernel/setup.c
+--- linux-2.6.32.12/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/setup.c	2010-04-04 20:46:41.525738446 -0400
+@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	if (!boot_params.hdr.root_flags)
+ 		root_mountflags &= ~MS_RDONLY;
+-	init_mm.start_code = (unsigned long) _text;
+-	init_mm.end_code = (unsigned long) _etext;
++	init_mm.start_code = ktla_ktva((unsigned long) _text);
++	init_mm.end_code = ktla_ktva((unsigned long) _etext);
+ 	init_mm.end_data = (unsigned long) _edata;
+ 	init_mm.brk = _brk_end;
+ 
+-	code_resource.start = virt_to_phys(_text);
+-	code_resource.end = virt_to_phys(_etext)-1;
+-	data_resource.start = virt_to_phys(_etext);
++	code_resource.start = virt_to_phys(ktla_ktva(_text));
++	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
++	data_resource.start = virt_to_phys(_sdata);
+ 	data_resource.end = virt_to_phys(_edata)-1;
+ 	bss_resource.start = virt_to_phys(&__bss_start);
+ 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/setup_percpu.c linux-2.6.32.12/arch/x86/kernel/setup_percpu.c
+--- linux-2.6.32.12/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/setup_percpu.c	2010-04-04 20:46:41.525738446 -0400
+@@ -25,19 +25,17 @@
+ # define DBG(x...)
+ #endif
+ 
++#ifdef CONFIG_SMP
+ DEFINE_PER_CPU(int, cpu_number);
+ EXPORT_PER_CPU_SYMBOL(cpu_number);
++#endif
+ 
+-#ifdef CONFIG_X86_64
+ #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
+-#else
+-#define BOOT_PERCPU_OFFSET 0
+-#endif
+ 
+ DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
+ EXPORT_PER_CPU_SYMBOL(this_cpu_off);
+ 
+-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
++unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
+ 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
+ };
+ EXPORT_SYMBOL(__per_cpu_offset);
+@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
+ {
+ #ifdef CONFIG_X86_32
+ 	struct desc_struct gdt;
++	unsigned long base = per_cpu_offset(cpu);
+ 
+-	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
+-			0x2 | DESCTYPE_S, 0x8);
+-	gdt.s = 1;
++	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
++			0x83 | DESCTYPE_S, 0xC);
+ 	write_gdt_entry(get_cpu_gdt_table(cpu),
+ 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
+ #endif
+@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
+ 	/* alrighty, percpu areas up and running */
+ 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
+ 	for_each_possible_cpu(cpu) {
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		unsigned long canary = per_cpu(stack_canary, cpu);
++#endif
++#endif
+ 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
+ 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
+ 		per_cpu(cpu_number, cpu) = cpu;
+@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
+ 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
+ #endif
+ #endif
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		if (cpu == boot_cpu_id)
++			per_cpu(stack_canary, cpu) = canary;
++#endif
++#endif
+ 		/*
+ 		 * Up to this point, the boot CPU has been using .data.init
+ 		 * area.  Reload any changed state for the boot CPU.
+diff -urNp linux-2.6.32.12/arch/x86/kernel/signal.c linux-2.6.32.12/arch/x86/kernel/signal.c
+--- linux-2.6.32.12/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/signal.c	2010-04-04 20:46:41.525738446 -0400
+@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
+ 	 * Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
+ 	 */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ #else /* !CONFIG_X86_32 */
+ 	sp = round_down(sp, 16) - 8;
+ #endif
+@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
+ 	 * Return an always-bogus address instead so we will die with SIGSEGV.
+ 	 */
+ 	if (onsigstack && !likely(on_sig_stack(sp)))
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	/* save i387 state */
+ 	if (used_math() && save_i387_xstate(*fpstate) < 0)
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	return (void __user *)sp;
+ }
+@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
+ 	}
+ 
+ 	if (current->mm->context.vdso)
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
+ 	else
+-		restorer = &frame->retcode;
++		restorer = (void __user *)&frame->retcode;
+ 	if (ka->sa.sa_flags & SA_RESTORER)
+ 		restorer = ka->sa.sa_restorer;
+ 
+@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
+ 	 * reasons and because gdb uses it as a signature to notice
+ 	 * signal handler stack frames.
+ 	 */
+-	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
++	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
+ 
+ 	if (err)
+ 		return -EFAULT;
+@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
+ 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+ 
+ 		/* Set up to return from userspace.  */
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+ 		if (ka->sa.sa_flags & SA_RESTORER)
+ 			restorer = ka->sa.sa_restorer;
+ 		put_user_ex(restorer, &frame->pretcode);
+@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
+ 		 * reasons and because gdb uses it as a signature to notice
+ 		 * signal handler stack frames.
+ 		 */
+-		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
++		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
+ 	} put_user_catch(err);
+ 
+ 	if (err)
+@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
+ 	 * X86_32: vm86 regs switched out by assembly code before reaching
+ 	 * here, so testing against kernel CS suffices.
+ 	 */
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		return;
+ 
+ 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/smpboot.c linux-2.6.32.12/arch/x86/kernel/smpboot.c
+--- linux-2.6.32.12/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.12/arch/x86/kernel/smpboot.c	2010-04-04 20:58:33.225084964 -0400
+@@ -729,7 +729,11 @@ do_rest:
+ 		(unsigned long)task_stack_page(c_idle.idle) -
+ 		KERNEL_STACK_OFFSET + THREAD_SIZE;
+ #endif
++
++	pax_open_kernel();
+ 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
++	pax_close_kernel();
++
+ 	initial_code = (unsigned long)start_secondary;
+ 	stack_start.sp = (void *) c_idle.idle->thread.sp;
+ 
+@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
+ 
+ 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_X86_32
+ 	/* init low mem mapping */
+ 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+diff -urNp linux-2.6.32.12/arch/x86/kernel/step.c linux-2.6.32.12/arch/x86/kernel/step.c
+--- linux-2.6.32.12/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/step.c	2010-04-04 20:46:41.525738446 -0400
+@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
+ 		struct desc_struct *desc;
+ 		unsigned long base;
+ 
+-		seg &= ~7UL;
++		seg >>= 3;
+ 
+ 		mutex_lock(&child->mm->context.lock);
+-		if (unlikely((seg >> 3) >= child->mm->context.size))
++		if (unlikely(seg >= child->mm->context.size))
+ 			addr = -1L; /* bogus selector, access would fault */
+ 		else {
+ 			desc = child->mm->context.ldt + seg;
+@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
+ 	unsigned char opcode[15];
+ 	unsigned long addr = convert_ip_to_linear(child, regs);
+ 
++	if (addr == -EINVAL)
++		return 0;
++
+ 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
+ 	for (i = 0; i < copied; i++) {
+ 		switch (opcode[i]) {
+@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
+ 
+ #ifdef CONFIG_X86_64
+ 		case 0x40 ... 0x4f:
+-			if (regs->cs != __USER_CS)
++			if ((regs->cs & 0xffff) != __USER_CS)
+ 				/* 32-bit mode: register increment */
+ 				return 0;
+ 			/* 64-bit mode: REX prefix */
+diff -urNp linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S
+--- linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S	2010-04-04 20:46:41.525738446 -0400
+@@ -1,3 +1,4 @@
++.section .rodata,"a",@progbits
+ ENTRY(sys_call_table)
+ 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
+ 	.long sys_exit
+diff -urNp linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c
+--- linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c	2010-04-04 20:46:41.525738446 -0400
+@@ -24,6 +24,21 @@
+ 
+ #include <asm/syscalls.h>
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+@@ -58,6 +73,205 @@ out:
+ 	return err;
+ }
+ 
++unsigned long
++arch_get_unmapped_area(struct file *filp, unsigned long addr,
++		unsigned long len, unsigned long pgoff, unsigned long flags)
++{
++	struct mm_struct *mm = current->mm;
++	struct vm_area_struct *vma;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++		    (!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++	if (len > mm->cached_hole_size) {
++		start_addr = addr = mm->free_area_cache;
++	} else {
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
++	}
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
++		start_addr = 0x00110000UL;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			start_addr += mm->delta_mmap & 0x03FFF000UL;
++#endif
++
++		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
++			start_addr = addr = mm->mmap_base;
++		else
++			addr = start_addr;
++	}
++#endif
++
++full_search:
++	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
++		/* At this point:  (!vma || addr < vma->vm_end). */
++		if (pax_task_size - len < addr) {
++			/*
++			 * Start a new search - just in case we missed
++			 * some holes.
++			 */
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
++				mm->cached_hole_size = 0;
++				goto full_search;
++			}
++			return -ENOMEM;
++		}
++		if (!vma || addr + len <= vma->vm_start) {
++			/*
++			 * Remember the place where we stopped the search:
++			 */
++			mm->free_area_cache = addr + len;
++			return addr;
++		}
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++		addr = vma->vm_end;
++		if (mm->start_brk <= addr && addr < mm->mmap_base) {
++			start_addr = addr = mm->mmap_base;
++			mm->cached_hole_size = 0;
++			goto full_search;
++		}
++	}
++}
++
++unsigned long
++arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
++			  const unsigned long len, const unsigned long pgoff,
++			  const unsigned long flags)
++{
++	struct vm_area_struct *vma;
++	struct mm_struct *mm = current->mm;
++	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	/* requested length too big for entire address space */
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
++		goto bottomup;
++#endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	/* requesting a specific address */
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++				(!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++
++	/* check if free_area_cache is useful for us */
++	if (len <= mm->cached_hole_size) {
++		mm->cached_hole_size = 0;
++		mm->free_area_cache = mm->mmap_base;
++	}
++
++	/* either no address requested or can't fit in requested address hole */
++	addr = mm->free_area_cache;
++
++	/* make sure it can fit in the remaining address space */
++	if (addr > len) {
++		vma = find_vma(mm, addr-len);
++		if (!vma || addr <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr-len);
++	}
++
++	if (mm->mmap_base < len)
++		goto bottomup;
++
++	addr = mm->mmap_base-len;
++
++	do {
++		/*
++		 * Lookup failure means no vma is above this address,
++		 * else if new region fits below vma->vm_start,
++		 * return with success:
++		 */
++		vma = find_vma(mm, addr);
++		if (!vma || addr+len <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr);
++
++		/* remember the largest hole we saw so far */
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++
++		/* try just below the current vma->vm_start */
++		addr = vma->vm_start-len;
++	} while (len < vma->vm_start);
++
++bottomup:
++	/*
++	 * A failed mmap() very likely causes application failure,
++	 * so fall back to the bottom-up function here. This scenario
++	 * can happen with large stack limits and large mmap()
++	 * allocations.
++	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
++	mm->cached_hole_size = ~0UL;
++	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
++	/*
++	 * Restore the topdown base:
++	 */
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
++	mm->cached_hole_size = ~0UL;
++
++	return addr;
++}
+ 
+ struct sel_arg_struct {
+ 	unsigned long n;
+@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
+ 	case SEMTIMEDOP:
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
+-					(const struct timespec __user *)fifth);
++					(__force const struct timespec __user *)fifth);
+ 
+ 	case SEMGET:
+ 		return sys_semget(first, second, third);
+@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
+ 			if (ret)
+ 				return ret;
+-			return put_user(raddr, (ulong __user *) third);
++			return put_user(raddr, (__force ulong __user *) third);
+ 		}
+ 		case 1:	/* iBCS2 emulator entry point */
+ 			if (!segment_eq(get_fs(), get_ds()))
+diff -urNp linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c
+--- linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c	2010-04-04 20:46:41.525738446 -0400
+@@ -32,8 +32,8 @@ out:
+ 	return error;
+ }
+ 
+-static void find_start_end(unsigned long flags, unsigned long *begin,
+-			   unsigned long *end)
++static void find_start_end(struct mm_struct *mm, unsigned long flags,
++			   unsigned long *begin, unsigned long *end)
+ {
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
+ 		unsigned long new_begin;
+@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
+ 				*begin = new_begin;
+ 		}
+ 	} else {
+-		*begin = TASK_UNMAPPED_BASE;
++		*begin = mm->mmap_base;
+ 		*end = TASK_SIZE;
+ 	}
+ }
+@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
+-	find_start_end(flags, &begin, &end);
++	find_start_end(mm, flags, &begin, &end);
+ 
+ 	if (len > end)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
+ 		goto bottomup;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -198,13 +206,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/time.c linux-2.6.32.12/arch/x86/kernel/time.c
+--- linux-2.6.32.12/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/time.c	2010-04-04 20:46:41.525738446 -0400
+@@ -26,17 +26,13 @@
+ int timer_ack;
+ #endif
+ 
+-#ifdef CONFIG_X86_64
+-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
+-#endif
+-
+ unsigned long profile_pc(struct pt_regs *regs)
+ {
+ 	unsigned long pc = instruction_pointer(regs);
+ 
+-	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
++	if (!user_mode(regs) && in_lock_functions(pc)) {
+ #ifdef CONFIG_FRAME_POINTER
+-		return *(unsigned long *)(regs->bp + sizeof(long));
++		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
+ #else
+ 		unsigned long *sp =
+ 			(unsigned long *)kernel_stack_pointer(regs);
+@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
+ 		 * or above a saved flags. Eflags has bits 22-31 zero,
+ 		 * kernel addresses don't.
+ 		 */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		return ktla_ktva(sp[0]);
++#else
+ 		if (sp[0] >> 22)
+ 			return sp[0];
+ 		if (sp[1] >> 22)
+ 			return sp[1];
+ #endif
++
++#endif
+ 	}
+ 	return pc;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/kernel/tls.c linux-2.6.32.12/arch/x86/kernel/tls.c
+--- linux-2.6.32.12/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/tls.c	2010-04-04 20:46:41.525738446 -0400
+@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
+ 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
++		return -EINVAL;
++#endif
++
+ 	set_tls_desc(p, idx, &info, 1);
+ 
+ 	return 0;
+diff -urNp linux-2.6.32.12/arch/x86/kernel/trampoline_32.S linux-2.6.32.12/arch/x86/kernel/trampoline_32.S
+--- linux-2.6.32.12/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/trampoline_32.S	2010-04-04 20:46:41.525738446 -0400
+@@ -32,6 +32,12 @@
+ #include <asm/segment.h>
+ #include <asm/page_types.h>
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /* We can free up trampoline after bootup if cpu hotplug is not supported. */
+ __CPUINITRODATA
+ .code16
+@@ -60,7 +66,7 @@ r_base = .
+ 	inc	%ax		# protected mode (PE) bit
+ 	lmsw	%ax		# into protected mode
+ 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
+-	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
++	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
+ 
+ 	# These need to be in the same 64K segment as the above;
+ 	# hence we don't use the boot_gdt_descr defined in head.S
+diff -urNp linux-2.6.32.12/arch/x86/kernel/traps.c linux-2.6.32.12/arch/x86/kernel/traps.c
+--- linux-2.6.32.12/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/traps.c	2010-04-04 20:46:41.525738446 -0400
+@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
+ 
+ /* Do we ignore FPU interrupts ? */
+ char ignore_fpu_irq;
+-
+-/*
+- * The IDT has to be page-aligned to simplify the Pentium
+- * F0 0F bug workaround.
+- */
+-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
+ #endif
+ 
+ DECLARE_BITMAP(used_vectors, NR_VECTORS);
+@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
+ static inline void
+ die_if_kernel(const char *str, struct pt_regs *regs, long err)
+ {
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		die(str, regs, err);
+ }
+ #endif
+ 
+ static void __kprobes
+-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
++do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
+ 	long error_code, siginfo_t *info)
+ {
+ 	struct task_struct *tsk = current;
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		/*
+ 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
+ 		 * On nmi (interrupt 2), do_trap should not be called.
+@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
+ 	}
+ #endif
+ 
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto kernel_trap;
+ 
+ #ifdef CONFIG_X86_32
+@@ -158,7 +152,7 @@ trap_signal:
+ 	    printk_ratelimit()) {
+ 		printk(KERN_INFO
+ 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
+-		       tsk->comm, tsk->pid, str,
++		       tsk->comm, task_pid_nr(tsk), str,
+ 		       regs->ip, regs->sp, error_code);
+ 		print_vma_addr(" in ", regs->ip);
+ 		printk("\n");
+@@ -175,8 +169,20 @@ kernel_trap:
+ 	if (!fixup_exception(regs)) {
+ 		tsk->thread.error_code = error_code;
+ 		tsk->thread.trap_no = trapnr;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
++			str = "PAX: suspicious stack segment fault";
++#endif
++
+ 		die(str, regs, error_code);
+ 	}
++
++#ifdef CONFIG_PAX_REFCOUNT
++	if (trapnr == 4)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	return;
+ 
+ #ifdef CONFIG_X86_32
+@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
+ 	conditional_sti(regs);
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto gp_in_vm86;
+ #endif
+ 
+ 	tsk = current;
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto gp_in_kernel;
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
++		struct mm_struct *mm = tsk->mm;
++		unsigned long limit;
++
++		down_write(&mm->mmap_sem);
++		limit = mm->context.user_cs_limit;
++		if (limit < TASK_SIZE) {
++			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
++			up_write(&mm->mmap_sem);
++			return;
++		}
++		up_write(&mm->mmap_sem);
++	}
++#endif
++
+ 	tsk->thread.error_code = error_code;
+ 	tsk->thread.trap_no = 13;
+ 
+@@ -305,6 +327,13 @@ gp_in_kernel:
+ 	if (notify_die(DIE_GPF, "general protection fault", regs,
+ 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
+ 		return;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
++		die("PAX: suspicious general protection fault", regs, error_code);
++	else
++#endif
++
+ 	die("general protection fault", regs, error_code);
+ }
+ 
+@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	}
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto debug_vm86;
+ #endif
+ 
+@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	 * kernel space (but re-enable TF when returning to user mode).
+ 	 */
+ 	if (condition & DR_STEP) {
+-		if (!user_mode(regs))
++		if (!user_mode_novm(regs))
+ 			goto clear_TF_reenable;
+ 	}
+ 
+@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
+ 	 * Handle strange cache flush from user space exception
+ 	 * in all other cases.  This is undocumented behaviour.
+ 	 */
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
+ 		return;
+ 	}
+diff -urNp linux-2.6.32.12/arch/x86/kernel/tsc.c linux-2.6.32.12/arch/x86/kernel/tsc.c
+--- linux-2.6.32.12/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/tsc.c	2010-04-04 20:46:41.525738446 -0400
+@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
+ 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static void __init check_system_tsc_reliable(void)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/vm86_32.c linux-2.6.32.12/arch/x86/kernel/vm86_32.c
+--- linux-2.6.32.12/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/vm86_32.c	2010-04-04 20:46:41.525738446 -0400
+@@ -41,6 +41,7 @@
+ #include <linux/ptrace.h>
+ #include <linux/audit.h>
+ #include <linux/stddef.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
+ 		do_exit(SIGSEGV);
+ 	}
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	current->thread.sp0 = current->thread.saved_sp0;
+ 	current->thread.sysenter_cs = __KERNEL_CS;
+ 	load_sp0(tss, &current->thread);
+@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
+ 	struct task_struct *tsk;
+ 	int tmp, ret = -EPERM;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	if (tsk->thread.saved_sp0)
+ 		goto out;
+@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
+ 	int tmp, ret;
+ 	struct vm86plus_struct __user *v86;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		ret = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	switch (regs->bx) {
+ 	case VM86_REQUEST_IRQ:
+@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
+ 	tsk->thread.saved_fs = info->regs32->fs;
+ 	tsk->thread.saved_gs = get_user_gs(info->regs32);
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
+ 	if (cpu_has_sep)
+ 		tsk->thread.sysenter_cs = 0;
+@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
+ 		goto cannot_handle;
+ 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
+ 		goto cannot_handle;
+-	intr_ptr = (unsigned long __user *) (i << 2);
++	intr_ptr = (__force unsigned long __user *) (i << 2);
+ 	if (get_user(segoffs, intr_ptr))
+ 		goto cannot_handle;
+ 	if ((segoffs >> 16) == BIOSSEG)
+diff -urNp linux-2.6.32.12/arch/x86/kernel/vmi_32.c linux-2.6.32.12/arch/x86/kernel/vmi_32.c
+--- linux-2.6.32.12/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/vmi_32.c	2010-04-04 20:46:41.525738446 -0400
+@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
+ typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
+ 
+ #define call_vrom_func(rom,func) \
+-   (((VROMFUNC *)(rom->func))())
++   (((VROMFUNC *)(ktva_ktla(rom.func)))())
+ 
+ #define call_vrom_long_func(rom,func,arg) \
+-   (((VROMLONGFUNC *)(rom->func)) (arg))
++({\
++	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
++	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
++	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
++	__reloc;\
++})
+ 
+-static struct vrom_header *vmi_rom;
++static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
+ static int disable_pge;
+ static int disable_pse;
+ static int disable_sep;
+@@ -76,10 +81,10 @@ static struct {
+ 	void (*set_initial_ap_state)(int, int);
+ 	void (*halt)(void);
+   	void (*set_lazy_mode)(int mode);
+-} vmi_ops;
++} vmi_ops __read_only;
+ 
+ /* Cached VMI operations */
+-struct vmi_timer_ops vmi_timer_ops;
++struct vmi_timer_ops vmi_timer_ops __read_only;
+ 
+ /*
+  * VMI patching routines.
+@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
+ static inline void patch_offset(void *insnbuf,
+ 				unsigned long ip, unsigned long dest)
+ {
+-        *(unsigned long *)(insnbuf+1) = dest-ip-5;
++	*(unsigned long *)(insnbuf+1) = dest-ip-5;
+ }
+ 
+ static unsigned patch_internal(int call, unsigned len, void *insnbuf,
+@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
+ {
+ 	u64 reloc;
+ 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
++
+ 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
+ 	switch(rel->type) {
+ 		case VMI_RELOCATION_CALL_REL:
+@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
+ 
+ static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
+ }
+ 
+ static void vmi_pmd_clear(pmd_t *pmd)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
+ }
+ #endif
+@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
+ 	ap.ss = __KERNEL_DS;
+ 	ap.esp = (unsigned long) start_esp;
+ 
+-	ap.ds = __USER_DS;
+-	ap.es = __USER_DS;
++	ap.ds = __KERNEL_DS;
++	ap.es = __KERNEL_DS;
+ 	ap.fs = __KERNEL_PERCPU;
+ 	ap.gs = __KERNEL_STACK_CANARY;
+ 
+@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
+ 	paravirt_leave_lazy_mmu();
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static unsigned long vmi_pax_open_kernel(void)
++{
++	return 0;
++}
++
++static unsigned long vmi_pax_close_kernel(void)
++{
++	return 0;
++}
++#endif
++
+ static inline int __init check_vmi_rom(struct vrom_header *rom)
+ {
+ 	struct pci_header *pci;
+@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
+ 		return 0;
+ 	if (rom->vrom_signature != VMI_SIGNATURE)
+ 		return 0;
++	if (rom->rom_length * 512 > sizeof(*rom)) {
++		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
++		return 0;
++	}
+ 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
+ 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
+ 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
+@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
+ 		struct vrom_header *romstart;
+ 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
+ 		if (check_vmi_rom(romstart)) {
+-			vmi_rom = romstart;
++			vmi_rom = *romstart;
+ 			return 1;
+ 		}
+ 	}
+@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
+ 
+ 	para_fill(pv_irq_ops.safe_halt, Halt);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
++	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
++#endif
++
+ 	/*
+ 	 * Alternative instruction rewriting doesn't happen soon enough
+ 	 * to convert VMI_IRET to a call instead of a jump; so we have
+@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
+ 
+ void __init vmi_init(void)
+ {
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		probe_vmi_rom();
+ 	else
+-		check_vmi_rom(vmi_rom);
++		check_vmi_rom(&vmi_rom);
+ 
+ 	/* In case probing for or validating the ROM failed, basil */
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+-	reserve_top_address(-vmi_rom->virtual_top);
++	reserve_top_address(-vmi_rom.virtual_top);
+ 
+ #ifdef CONFIG_X86_IO_APIC
+ 	/* This is virtual hardware; timer routing is wired correctly */
+@@ -874,7 +901,7 @@ void __init vmi_activate(void)
+ {
+ 	unsigned long flags;
+ 
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S
+--- linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S	2010-04-04 20:46:41.529538490 -0400
+@@ -26,6 +26,22 @@
+ #include <asm/page_types.h>
+ #include <asm/cache.h>
+ #include <asm/boot.h>
++#include <asm/segment.h>
++
++#undef PMD_SIZE
++#undef PMD_SHIFT
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
++#define PMD_SHIFT 21
++#else
++#define PMD_SHIFT 22
++#endif
++#define PMD_SIZE (1 << PMD_SHIFT)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
++#else
++#define __KERNEL_TEXT_OFFSET	0
++#endif
+ 
+ #undef i386     /* in case the preprocessor is a 32bit one */
+ 
+@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
+ #ifdef CONFIG_X86_32
+ OUTPUT_ARCH(i386)
+ ENTRY(phys_startup_32)
+-jiffies = jiffies_64;
+ #else
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(phys_startup_64)
+-jiffies_64 = jiffies;
+ #endif
+ 
++jiffies = jiffies_64;
++
+ PHDRS {
+ 	text PT_LOAD FLAGS(5);          /* R_E */
+-	data PT_LOAD FLAGS(7);          /* RWE */
++#ifdef CONFIG_XEN
++	rodata PT_LOAD FLAGS(5);        /* R_E */
++#else
++	rodata PT_LOAD FLAGS(4);        /* R__ */
++#endif
++#ifdef CONFIG_X86_32
++	module PT_LOAD FLAGS(5);        /* R_E */
++#endif
++	data PT_LOAD FLAGS(6);          /* RW_ */
+ #ifdef CONFIG_X86_64
+ 	user PT_LOAD FLAGS(5);          /* R_E */
++#endif
++	init.begin PT_LOAD FLAGS(6);    /* RW_ */
+ #ifdef CONFIG_SMP
+ 	percpu PT_LOAD FLAGS(6);        /* RW_ */
+ #endif
++	text.init PT_LOAD FLAGS(5);     /* R_E */
++	text.exit PT_LOAD FLAGS(5);     /* R_E */
+ 	init PT_LOAD FLAGS(7);          /* RWE */
+-#endif
+ 	note PT_NOTE FLAGS(0);          /* ___ */
+ }
+ 
+ SECTIONS
+ {
+ #ifdef CONFIG_X86_32
+-        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
+-        phys_startup_32 = startup_32 - LOAD_OFFSET;
++	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
+ #else
+-        . = __START_KERNEL;
+-        phys_startup_64 = startup_64 - LOAD_OFFSET;
++	. = __START_KERNEL;
+ #endif
+ 
+ 	/* Text and read-only data */
+-	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
+-		_text = .;
++	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
+ 		/* bootstrapping code */
++#ifdef CONFIG_X86_32
++		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#else
++		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#endif
++		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++		_text = .;
+ 		HEAD_TEXT
+ #ifdef CONFIG_X86_32
+ 		. = ALIGN(PAGE_SIZE);
+@@ -82,28 +113,64 @@ SECTIONS
+ 		IRQENTRY_TEXT
+ 		*(.fixup)
+ 		*(.gnu.warning)
+-		/* End of text section */
+-		_etext = .;
+ 	} :text = 0x9090
+ 
+-	NOTES :text :note
++	. += __KERNEL_TEXT_OFFSET;
++
++	. = ALIGN(PAGE_SIZE);
++	NOTES :rodata :note
+ 
+-	EXCEPTION_TABLE(16) :text = 0x9090
++	EXCEPTION_TABLE(16) :rodata
+ 
+ 	RO_DATA(PAGE_SIZE)
+ 
++#ifdef CONFIG_X86_32
++	. = ALIGN(PAGE_SIZE);
++	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
++		*(.idt)
++		. = ALIGN(PAGE_SIZE);
++		*(.empty_zero_page)
++		*(.swapper_pg_pmd)
++		*(.swapper_pg_dir)
++	}
++
++	. = ALIGN(PAGE_SIZE);
++	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
++		*(.vmi.rom)
++	} :module
++
++	. = ALIGN(PAGE_SIZE);
++	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
++		MODULES_EXEC_VADDR = .;
++		BYTE(0)
++		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
++		. = ALIGN(PMD_SIZE);
++		MODULES_EXEC_END = . - 1;
++#endif
++
++	} :module
++#endif
++
+ 	/* Data */
+ 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
++		/* End of text section */
++		_etext = . - __KERNEL_TEXT_OFFSET;
++
++#ifdef CONFIG_PAX_KERNEXEC
++	. = ALIGN(PMD_SIZE);
++#else
++	. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		/* Start of data section */
+ 		_sdata = .;
+ 
+ 		/* init_task */
+ 		INIT_TASK_DATA(THREAD_SIZE)
+ 
+-#ifdef CONFIG_X86_32
+-		/* 32 bit has nosave before _edata */
+ 		NOSAVE_DATA
+-#endif
+ 
+ 		PAGE_ALIGNED_DATA(PAGE_SIZE)
+ 
+@@ -166,12 +233,6 @@ SECTIONS
+ 	}
+ 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
+ 
+-	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
+-	.jiffies : AT(VLOAD(.jiffies)) {
+-		*(.jiffies)
+-	}
+-	jiffies = VVIRT(.jiffies);
+-
+ 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
+ 		*(.vsyscall_3)
+ 	}
+@@ -187,12 +248,19 @@ SECTIONS
+ #endif /* CONFIG_X86_64 */
+ 
+ 	/* Init code and data - will be freed after init */
+-	. = ALIGN(PAGE_SIZE);
+ 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
++		BYTE(0)
++
++#ifdef CONFIG_PAX_KERNEXEC
++		. = ALIGN(PMD_SIZE);
++#else
++		. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		__init_begin = .; /* paired with __init_end */
+-	}
++	} :init.begin
+ 
+-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
++#ifdef CONFIG_SMP
+ 	/*
+ 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
+ 	 * output PHDR, so the next output section - .init.text - should
+@@ -201,12 +269,27 @@ SECTIONS
+ 	PERCPU_VADDR(0, :percpu)
+ #endif
+ 
+-	INIT_TEXT_SECTION(PAGE_SIZE)
+-#ifdef CONFIG_X86_64
+-	:init
+-#endif
++	. = ALIGN(PAGE_SIZE);
++	init_begin = .;
++	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
++		VMLINUX_SYMBOL(_sinittext) = .;
++		INIT_TEXT
++		VMLINUX_SYMBOL(_einittext) = .;
++		. = ALIGN(PAGE_SIZE);
++	} :text.init
++
++	/*
++	 * .exit.text is discard at runtime, not link time, to deal with
++	 *  references from .altinstructions and .eh_frame
++	 */
++	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
++		EXIT_TEXT
++		. = ALIGN(16);
++	} :text.exit
++	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
+ 
+-	INIT_DATA_SECTION(16)
++	. = ALIGN(PAGE_SIZE);
++	INIT_DATA_SECTION(16) :init
+ 
+ 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
+ 		__x86_cpu_dev_start = .;
+@@ -232,19 +315,11 @@ SECTIONS
+ 		*(.altinstr_replacement)
+ 	}
+ 
+-	/*
+-	 * .exit.text is discard at runtime, not link time, to deal with
+-	 *  references from .altinstructions and .eh_frame
+-	 */
+-	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
+-		EXIT_TEXT
+-	}
+-
+ 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
+ 		EXIT_DATA
+ 	}
+ 
+-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
++#ifndef CONFIG_SMP
+ 	PERCPU(PAGE_SIZE)
+ #endif
+ 
+@@ -267,12 +342,6 @@ SECTIONS
+ 		. = ALIGN(PAGE_SIZE);
+ 	}
+ 
+-#ifdef CONFIG_X86_64
+-	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
+-		NOSAVE_DATA
+-	}
+-#endif
+-
+ 	/* BSS */
+ 	. = ALIGN(PAGE_SIZE);
+ 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+@@ -288,6 +357,7 @@ SECTIONS
+ 		__brk_base = .;
+ 		. += 64 * 1024;		/* 64k alignment slop space */
+ 		*(.brk_reservation)	/* areas brk users have reserved */
++		. = ALIGN(PMD_SIZE);
+ 		__brk_limit = .;
+ 	}
+ 
+@@ -316,13 +386,12 @@ SECTIONS
+  * for the boot processor.
+  */
+ #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
+-INIT_PER_CPU(gdt_page);
+ INIT_PER_CPU(irq_stack_union);
+ 
+ /*
+  * Build-time check on the image size:
+  */
+-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
++. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
+ 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c
+--- linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c	2010-04-04 20:46:41.529538490 -0400
+@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
+ 
+ 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
+ 	/* copy vsyscall data */
++	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
+ 	vsyscall_gtod_data.clock.vread = clock->vread;
+ 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
+ 	vsyscall_gtod_data.clock.mask = clock->mask;
+@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
+ 	   We do this here because otherwise user space would do it on
+ 	   its own in a likely inferior way (no access to jiffies).
+ 	   If you don't like it pass NULL. */
+-	if (tcache && tcache->blob[0] == (j = __jiffies)) {
++	if (tcache && tcache->blob[0] == (j = jiffies)) {
+ 		p = tcache->blob[1];
+ 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
+ 		/* Load per CPU data from RDTSCP */
+@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
+ 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
+ 	  .mode = 0644,
+ 	  .proc_handler = proc_dointvec },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table kernel_root_table2[] = {
+ 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
+ 	  .child = kernel_table2 },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c
+--- linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c	2010-04-04 20:46:41.529538490 -0400
+@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
+ 
+ EXPORT_SYMBOL(copy_user_generic);
+ EXPORT_SYMBOL(__copy_user_nocache);
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(__copy_from_user_inatomic);
+ 
+ EXPORT_SYMBOL(copy_page);
+diff -urNp linux-2.6.32.12/arch/x86/kernel/xsave.c linux-2.6.32.12/arch/x86/kernel/xsave.c
+--- linux-2.6.32.12/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kernel/xsave.c	2010-04-04 20:46:41.529538490 -0400
+@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
+ 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
+ 		return -1;
+ 
+-	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
++	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
+ 					    fx_sw_user->extended_size -
+ 					    FP_XSTATE_MAGIC2_SIZE));
+ 	/*
+@@ -196,7 +196,7 @@ fx_only:
+ 	 * the other extended state.
+ 	 */
+ 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
+-	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
++	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
+ }
+ 
+ /*
+@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
+ 	if (task_thread_info(tsk)->status & TS_XSAVE)
+ 		err = restore_user_xstate(buf);
+ 	else
+-		err = fxrstor_checking((__force struct i387_fxsave_struct *)
++		err = fxrstor_checking((struct i387_fxsave_struct __user *)
+ 				       buf);
+ 	if (unlikely(err)) {
+ 		/*
+diff -urNp linux-2.6.32.12/arch/x86/kvm/emulate.c linux-2.6.32.12/arch/x86/kvm/emulate.c
+--- linux-2.6.32.12/arch/x86/kvm/emulate.c	2010-04-29 17:49:37.541027029 -0400
++++ linux-2.6.32.12/arch/x86/kvm/emulate.c	2010-04-29 17:49:57.993228946 -0400
+@@ -81,8 +81,8 @@
+ #define Src2CL      (1<<29)
+ #define Src2ImmByte (2<<29)
+ #define Src2One     (3<<29)
+-#define Src2Imm16   (4<<29)
+-#define Src2Mask    (7<<29)
++#define Src2Imm16   (4U<<29)
++#define Src2Mask    (7U<<29)
+ 
+ enum {
+ 	Group1_80, Group1_81, Group1_82, Group1_83,
+@@ -411,6 +411,7 @@ static u32 group2_table[] = {
+ 
+ #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
+ 	do {								\
++		unsigned long _tmp;					\
+ 		__asm__ __volatile__ (					\
+ 			_PRE_EFLAGS("0", "4", "2")			\
+ 			_op _suffix " %"_x"3,%1; "			\
+@@ -424,8 +425,6 @@ static u32 group2_table[] = {
+ /* Raw emulation: instruction has two explicit operands. */
+ #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								\
+-		unsigned long _tmp;					\
+-									\
+ 		switch ((_dst).bytes) {					\
+ 		case 2:							\
+ 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
+@@ -441,7 +440,6 @@ static u32 group2_table[] = {
+ 
+ #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								     \
+-		unsigned long _tmp;					     \
+ 		switch ((_dst).bytes) {				             \
+ 		case 1:							     \
+ 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
+diff -urNp linux-2.6.32.12/arch/x86/kvm/lapic.c linux-2.6.32.12/arch/x86/kvm/lapic.c
+--- linux-2.6.32.12/arch/x86/kvm/lapic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/kvm/lapic.c	2010-04-29 17:46:37.073091406 -0400
+@@ -52,7 +52,7 @@
+ #define APIC_BUS_CYCLE_NS 1
+ 
+ /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+-#define apic_debug(fmt, arg...)
++#define apic_debug(fmt, arg...) do {} while (0)
+ 
+ #define APIC_LVT_NUM			6
+ /* 14 is the version for Xeon and Pentium 8.4.8*/
+diff -urNp linux-2.6.32.12/arch/x86/kvm/svm.c linux-2.6.32.12/arch/x86/kvm/svm.c
+--- linux-2.6.32.12/arch/x86/kvm/svm.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.12/arch/x86/kvm/svm.c	2010-04-29 17:49:58.005400983 -0400
+@@ -2395,9 +2395,12 @@ static int handle_exit(struct kvm_run *k
+ static void reload_tss(struct kvm_vcpu *vcpu)
+ {
+ 	int cpu = raw_smp_processor_id();
+-
+ 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
++
++	pax_open_kernel();
+ 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -2845,7 +2848,7 @@ static bool svm_gb_page_enable(void)
+ 	return true;
+ }
+ 
+-static struct kvm_x86_ops svm_x86_ops = {
++static const struct kvm_x86_ops svm_x86_ops = {
+ 	.cpu_has_kvm_support = has_svm,
+ 	.disabled_by_bios = is_disabled,
+ 	.hardware_setup = svm_hardware_setup,
+diff -urNp linux-2.6.32.12/arch/x86/kvm/vmx.c linux-2.6.32.12/arch/x86/kvm/vmx.c
+--- linux-2.6.32.12/arch/x86/kvm/vmx.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.12/arch/x86/kvm/vmx.c	2010-04-29 17:49:58.025065700 -0400
+@@ -568,7 +568,11 @@ static void reload_tss(void)
+ 
+ 	kvm_get_gdt(&gdt);
+ 	descs = (void *)gdt.base;
++
++	pax_open_kernel();
+ 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -1395,8 +1399,11 @@ static __init int hardware_setup(void)
+ 	if (!cpu_has_vmx_flexpriority())
+ 		flexpriority_enabled = 0;
+ 
+-	if (!cpu_has_vmx_tpr_shadow())
+-		kvm_x86_ops->update_cr8_intercept = NULL;
++	if (!cpu_has_vmx_tpr_shadow()) {
++		pax_open_kernel();
++		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
++		pax_close_kernel();
++	}
+ 
+ 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
+ 		kvm_disable_largepages();
+@@ -2347,7 +2354,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
+ 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
+ 
+ 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
+-	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
++	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
+ 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+ 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
+ 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
+@@ -3703,6 +3710,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		"jmp .Lkvm_vmx_return \n\t"
+ 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
+ 		".Lkvm_vmx_return: "
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
++		".Lkvm_vmx_return2: "
++#endif
++
+ 		/* Save guest registers, load host registers, keep flags */
+ 		"xchg %0,     (%%"R"sp) \n\t"
+ 		"mov %%"R"ax, %c[rax](%0) \n\t"
+@@ -3749,6 +3762,11 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
+ #endif
+ 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		,[cs]"i"(__KERNEL_CS)
++#endif
++
+ 	      : "cc", "memory"
+ 		, R"bx", R"di", R"si"
+ #ifdef CONFIG_X86_64
+@@ -3767,7 +3785,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 	if (vmx->rmode.irq.pending)
+ 		fixup_rmode_irq(vmx);
+ 
+-	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
++	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
+ 	vmx->launched = 1;
+ 
+ 	vmx_complete_interrupts(vmx);
+@@ -3942,7 +3960,7 @@ static bool vmx_gb_page_enable(void)
+ 	return false;
+ }
+ 
+-static struct kvm_x86_ops vmx_x86_ops = {
++static const struct kvm_x86_ops vmx_x86_ops = {
+ 	.cpu_has_kvm_support = cpu_has_kvm_support,
+ 	.disabled_by_bios = vmx_disabled_by_bios,
+ 	.hardware_setup = hardware_setup,
+diff -urNp linux-2.6.32.12/arch/x86/kvm/x86.c linux-2.6.32.12/arch/x86/kvm/x86.c
+--- linux-2.6.32.12/arch/x86/kvm/x86.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.12/arch/x86/kvm/x86.c	2010-04-29 17:49:58.041485405 -0400
+@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
+ static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
+ 				    struct kvm_cpuid_entry2 __user *entries);
+ 
+-struct kvm_x86_ops *kvm_x86_ops;
++const struct kvm_x86_ops *kvm_x86_ops;
+ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ 
+ int ignore_msrs = 0;
+ module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
+ struct kvm_stats_debugfs_item debugfs_entries[] = {
+-	{ "pf_fixed", VCPU_STAT(pf_fixed) },
+-	{ "pf_guest", VCPU_STAT(pf_guest) },
+-	{ "tlb_flush", VCPU_STAT(tlb_flush) },
+-	{ "invlpg", VCPU_STAT(invlpg) },
+-	{ "exits", VCPU_STAT(exits) },
+-	{ "io_exits", VCPU_STAT(io_exits) },
+-	{ "mmio_exits", VCPU_STAT(mmio_exits) },
+-	{ "signal_exits", VCPU_STAT(signal_exits) },
+-	{ "irq_window", VCPU_STAT(irq_window_exits) },
+-	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
+-	{ "halt_exits", VCPU_STAT(halt_exits) },
+-	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
+-	{ "hypercalls", VCPU_STAT(hypercalls) },
+-	{ "request_irq", VCPU_STAT(request_irq_exits) },
+-	{ "irq_exits", VCPU_STAT(irq_exits) },
+-	{ "host_state_reload", VCPU_STAT(host_state_reload) },
+-	{ "efer_reload", VCPU_STAT(efer_reload) },
+-	{ "fpu_reload", VCPU_STAT(fpu_reload) },
+-	{ "insn_emulation", VCPU_STAT(insn_emulation) },
+-	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
+-	{ "irq_injections", VCPU_STAT(irq_injections) },
+-	{ "nmi_injections", VCPU_STAT(nmi_injections) },
+-	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
+-	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
+-	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
+-	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
+-	{ "mmu_flooded", VM_STAT(mmu_flooded) },
+-	{ "mmu_recycled", VM_STAT(mmu_recycled) },
+-	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
+-	{ "mmu_unsync", VM_STAT(mmu_unsync) },
+-	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
+-	{ "largepages", VM_STAT(lpages) },
++	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
++	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
++	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
++	{ "invlpg", VCPU_STAT(invlpg), NULL },
++	{ "exits", VCPU_STAT(exits), NULL },
++	{ "io_exits", VCPU_STAT(io_exits), NULL },
++	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
++	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
++	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
++	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
++	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
++	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
++	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
++	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
++	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
++	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
++	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
++	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
++	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
++	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
++	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
++	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
++	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
++	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
++	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
++	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
++	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
++	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
++	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
++	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
++	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
++	{ "largepages", VM_STAT(lpages), NULL },
+ 	{ NULL }
+ };
+ 
+@@ -1635,7 +1635,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
+ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
+ 				    struct kvm_interrupt *irq)
+ {
+-	if (irq->irq < 0 || irq->irq >= 256)
++	if (irq->irq >= 256)
+ 		return -EINVAL;
+ 	if (irqchip_in_kernel(vcpu->kvm))
+ 		return -ENXIO;
+@@ -3205,10 +3205,10 @@ static struct notifier_block kvmclock_cp
+         .notifier_call  = kvmclock_cpufreq_notifier
+ };
+ 
+-int kvm_arch_init(void *opaque)
++int kvm_arch_init(const void *opaque)
+ {
+ 	int r, cpu;
+-	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
++	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
+ 
+ 	if (kvm_x86_ops) {
+ 		printk(KERN_ERR "kvm: already loaded the other module\n");
+diff -urNp linux-2.6.32.12/arch/x86/lib/checksum_32.S linux-2.6.32.12/arch/x86/lib/checksum_32.S
+--- linux-2.6.32.12/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/checksum_32.S	2010-04-04 20:46:41.529538490 -0400
+@@ -28,7 +28,8 @@
+ #include <linux/linkage.h>
+ #include <asm/dwarf2.h>
+ #include <asm/errno.h>
+-				
++#include <asm/segment.h>
++
+ /*
+  * computes a partial checksum, e.g. for TCP/UDP fragments
+  */
+@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
+ 
+ #define ARGBASE 16		
+ #define FP		12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	subl  $4,%esp	
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	pushl %edi
+@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
+ 	jmp 4f
+ SRC(1:	movw (%esi), %bx	)
+ 	addl $2, %esi
+-DST(	movw %bx, (%edi)	)
++DST(	movw %bx, %es:(%edi)	)
+ 	addl $2, %edi
+ 	addw %bx, %ax	
+ 	adcl $0, %eax
+@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
+ SRC(1:	movl (%esi), %ebx	)
+ SRC(	movl 4(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 4(%edi)	)
++DST(	movl %edx, %es:4(%edi)	)
+ 
+ SRC(	movl 8(%esi), %ebx	)
+ SRC(	movl 12(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 8(%edi)	)
++DST(	movl %ebx, %es:8(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 12(%edi)	)
++DST(	movl %edx, %es:12(%edi)	)
+ 
+ SRC(	movl 16(%esi), %ebx 	)
+ SRC(	movl 20(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 16(%edi)	)
++DST(	movl %ebx, %es:16(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 20(%edi)	)
++DST(	movl %edx, %es:20(%edi)	)
+ 
+ SRC(	movl 24(%esi), %ebx	)
+ SRC(	movl 28(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 24(%edi)	)
++DST(	movl %ebx, %es:24(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 28(%edi)	)
++DST(	movl %edx, %es:28(%edi)	)
+ 
+ 	lea 32(%esi), %esi
+ 	lea 32(%edi), %edi
+@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
+ 	shrl $2, %edx			# This clears CF
+ SRC(3:	movl (%esi), %ebx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	lea 4(%esi), %esi
+ 	lea 4(%edi), %edi
+ 	dec %edx
+@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
+ 	jb 5f
+ SRC(	movw (%esi), %cx	)
+ 	leal 2(%esi), %esi
+-DST(	movw %cx, (%edi)	)
++DST(	movw %cx, %es:(%edi)	)
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%ecx
+ SRC(5:	movb (%esi), %cl	)
+-DST(	movb %cl, (%edi)	)
++DST(	movb %cl, %es:(%edi)	)
+ 6:	addl %ecx, %eax
+ 	adcl $0, %eax
+ 7:
+@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6001:
+ 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 
+ 	# zero the complete destination - computing the rest
+ 	# is too much work 
+@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6002:
+ 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT,(%ebx)
++	movl $-EFAULT,%ss:(%ebx)
+ 	jmp 5000b
+ 
+ .previous
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE ebx
+@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	ret	
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 
+ #else
+ 
+ /* Version for PentiumII/PPro */
+ 
+ #define ROUND1(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	addl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	; 
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ROUND(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	adcl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	;
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ARGBASE 12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
+ 	subl %ebx, %edi  
+ 	lea  -1(%esi),%edx
+ 	andl $-32,%edx
+-	lea 3f(%ebx,%ebx), %ebx
++	lea 3f(%ebx,%ebx,2), %ebx
+ 	testl %esi, %esi 
+ 	jmp *%ebx
+ 1:	addl $64,%esi
+@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
+ 	jb 5f
+ SRC(	movw (%esi), %dx         )
+ 	leal 2(%esi), %esi
+-DST(	movw %dx, (%edi)         )
++DST(	movw %dx, %es:(%edi)     )
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%edx
+ 5:
+ SRC(	movb (%esi), %dl         )
+-DST(	movb %dl, (%edi)         )
++DST(	movb %dl, %es:(%edi)     )
+ 6:	addl %edx, %eax
+ 	adcl $0, %eax
+ 7:
+ .section .fixup, "ax"
+ 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	# zero the complete destination (computing the rest is too much work)
+ 	movl ARGBASE+8(%esp),%edi	# dst
+ 	movl ARGBASE+12(%esp),%ecx	# len
+@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
+ 	rep; stosb
+ 	jmp 7b
+ 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	jmp  7b			
+ .previous				
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %esi
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE esi
+@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
+ 	CFI_RESTORE ebx
+ 	ret
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 				
+ #undef ROUND
+ #undef ROUND1		
+diff -urNp linux-2.6.32.12/arch/x86/lib/clear_page_64.S linux-2.6.32.12/arch/x86/lib/clear_page_64.S
+--- linux-2.6.32.12/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/clear_page_64.S	2010-04-04 20:46:41.529538490 -0400
+@@ -43,7 +43,7 @@ ENDPROC(clear_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.12/arch/x86/lib/copy_page_64.S linux-2.6.32.12/arch/x86/lib/copy_page_64.S
+--- linux-2.6.32.12/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/copy_page_64.S	2010-04-04 20:46:41.529538490 -0400
+@@ -104,7 +104,7 @@ ENDPROC(copy_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.12/arch/x86/lib/copy_user_64.S linux-2.6.32.12/arch/x86/lib/copy_user_64.S
+--- linux-2.6.32.12/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/copy_user_64.S	2010-04-04 20:58:33.225084964 -0400
+@@ -15,13 +15,14 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/cpufeature.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALTERNATIVE_JUMP feature,orig,alt
+ 0:
+ 	.byte 0xe9	/* 32bit jump */
+ 	.long \orig-1f	/* by default jump to orig */
+ 1:
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 2:	.byte 0xe9			/* near jump with 32bit immediate */
+ 	.long \alt-1b /* offset */   /* or alternatively to alt */
+ 	.previous
+@@ -64,32 +65,6 @@
+ #endif
+ 	.endm
+ 
+-/* Standard copy_to_user with segment limit checking */
+-ENTRY(copy_to_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rdi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_to_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_to_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_to_user)
+-
+-/* Standard copy_from_user with segment limit checking */
+-ENTRY(copy_from_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rsi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_from_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_from_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_from_user)
+-
+ ENTRY(copy_user_generic)
+ 	CFI_STARTPROC
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
+ 
+ ENTRY(__copy_from_user_inatomic)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+ 	CFI_ENDPROC
+ ENDPROC(__copy_from_user_inatomic)
+@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
+ ENTRY(bad_from_user)
+ bad_from_user:
+ 	CFI_STARTPROC
++	testl %edx,%edx
++	js bad_to_user
+ 	movl %edx,%ecx
+ 	xorl %eax,%eax
+ 	rep
+diff -urNp linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S
+--- linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S	2010-04-04 20:58:33.225084964 -0400
+@@ -14,6 +14,7 @@
+ #include <asm/current.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALIGN_DESTINATION
+ #ifdef FIX_ALIGNMENT
+@@ -50,6 +51,15 @@
+  */
+ ENTRY(__copy_user_nocache)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	cmpl $8,%edx
+ 	jb 20f		/* less then 8 bytes, go to byte copy loop */
+ 	ALIGN_DESTINATION
+diff -urNp linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c
+--- linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c	2010-04-04 20:58:33.225084964 -0400
+@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
+ 			len -= 2;
+ 		}
+ 	}
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	isum = csum_partial_copy_generic((__force const void *)src,
+ 				dst, len, isum, errp, NULL);
+ 	if (unlikely(*errp))
+@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
+ 	}
+ 
+ 	*errp = 0;
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return csum_partial_copy_generic(src, (void __force *)dst,
+ 					 len, isum, NULL, errp);
+ }
+diff -urNp linux-2.6.32.12/arch/x86/lib/getuser.S linux-2.6.32.12/arch/x86/lib/getuser.S
+--- linux-2.6.32.12/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/getuser.S	2010-04-04 20:58:33.225084964 -0400
+@@ -33,14 +33,38 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/asm.h>
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ 	.text
+ ENTRY(__get_user_1)
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 1:	movzb (%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
+ ENTRY(__get_user_2)
+ 	CFI_STARTPROC
+ 	add $1,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 2:	movzwl -1(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
+ ENTRY(__get_user_4)
+ 	CFI_STARTPROC
+ 	add $3,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 3:	mov -3(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae	bad_get_user
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
+ 4:	movq -7(%_ASM_AX),%_ASM_DX
+ 	xor %eax,%eax
+ 	ret
+@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
+ 
+ bad_get_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %edx,%edx
+ 	mov $(-EFAULT),%_ASM_AX
+ 	ret
+diff -urNp linux-2.6.32.12/arch/x86/lib/memcpy_64.S linux-2.6.32.12/arch/x86/lib/memcpy_64.S
+--- linux-2.6.32.12/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/memcpy_64.S	2010-04-04 20:46:41.529538490 -0400
+@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
+ 	 * It is also a lot simpler. Use this when possible:
+ 	 */
+ 
+-	.section .altinstr_replacement, "ax"
++	.section .altinstr_replacement, "a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.12/arch/x86/lib/memset_64.S linux-2.6.32.12/arch/x86/lib/memset_64.S
+--- linux-2.6.32.12/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/memset_64.S	2010-04-04 20:46:41.529538490 -0400
+@@ -118,7 +118,7 @@ ENDPROC(__memset)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.12/arch/x86/lib/mmx_32.c linux-2.6.32.12/arch/x86/lib/mmx_32.c
+--- linux-2.6.32.12/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/mmx_32.c	2010-04-04 20:46:41.533557286 -0400
+@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
+ {
+ 	void *p;
+ 	int i;
++	unsigned long cr0;
+ 
+ 	if (unlikely(in_interrupt()))
+ 		return __memcpy(to, from, len);
+@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"		/* This set is 28 bytes */
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"		/* This set is 28 bytes */
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from));
++			: "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for ( ; i > 5; i--) {
+ 		__asm__ __volatile__ (
+-		"1:  prefetch 320(%0)\n"
+-		"2:  movq (%0), %%mm0\n"
+-		"  movq 8(%0), %%mm1\n"
+-		"  movq 16(%0), %%mm2\n"
+-		"  movq 24(%0), %%mm3\n"
+-		"  movq %%mm0, (%1)\n"
+-		"  movq %%mm1, 8(%1)\n"
+-		"  movq %%mm2, 16(%1)\n"
+-		"  movq %%mm3, 24(%1)\n"
+-		"  movq 32(%0), %%mm0\n"
+-		"  movq 40(%0), %%mm1\n"
+-		"  movq 48(%0), %%mm2\n"
+-		"  movq 56(%0), %%mm3\n"
+-		"  movq %%mm0, 32(%1)\n"
+-		"  movq %%mm1, 40(%1)\n"
+-		"  movq %%mm2, 48(%1)\n"
+-		"  movq %%mm3, 56(%1)\n"
++		"1:  prefetch 320(%1)\n"
++		"2:  movq (%1), %%mm0\n"
++		"  movq 8(%1), %%mm1\n"
++		"  movq 16(%1), %%mm2\n"
++		"  movq 24(%1), %%mm3\n"
++		"  movq %%mm0, (%2)\n"
++		"  movq %%mm1, 8(%2)\n"
++		"  movq %%mm2, 16(%2)\n"
++		"  movq %%mm3, 24(%2)\n"
++		"  movq 32(%1), %%mm0\n"
++		"  movq 40(%1), %%mm1\n"
++		"  movq 48(%1), %%mm2\n"
++		"  movq 56(%1), %%mm3\n"
++		"  movq %%mm0, 32(%2)\n"
++		"  movq %%mm1, 40(%2)\n"
++		"  movq %%mm2, 48(%2)\n"
++		"  movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
+ 	 * but that is for later. -AV
+ 	 */
+ 	__asm__ __volatile__(
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < (4096-320)/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movntq %%mm0, (%1)\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movntq %%mm1, 8(%1)\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movntq %%mm2, 16(%1)\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movntq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm4\n"
+-		"   movntq %%mm4, 32(%1)\n"
+-		"   movq 40(%0), %%mm5\n"
+-		"   movntq %%mm5, 40(%1)\n"
+-		"   movq 48(%0), %%mm6\n"
+-		"   movntq %%mm6, 48(%1)\n"
+-		"   movq 56(%0), %%mm7\n"
+-		"   movntq %%mm7, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movntq %%mm0, (%2)\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movntq %%mm1, 8(%2)\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movntq %%mm2, 16(%2)\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movntq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm4\n"
++		"   movntq %%mm4, 32(%2)\n"
++		"   movq 40(%1), %%mm5\n"
++		"   movntq %%mm5, 40(%2)\n"
++		"   movq 48(%1), %%mm6\n"
++		"   movntq %%mm6, 48(%2)\n"
++		"   movq 56(%1), %%mm7\n"
++		"   movntq %%mm7, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
++		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < 4096/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movq %%mm0, (%1)\n"
+-		"   movq %%mm1, 8(%1)\n"
+-		"   movq %%mm2, 16(%1)\n"
+-		"   movq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm0\n"
+-		"   movq 40(%0), %%mm1\n"
+-		"   movq 48(%0), %%mm2\n"
+-		"   movq 56(%0), %%mm3\n"
+-		"   movq %%mm0, 32(%1)\n"
+-		"   movq %%mm1, 40(%1)\n"
+-		"   movq %%mm2, 48(%1)\n"
+-		"   movq %%mm3, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movq %%mm0, (%2)\n"
++		"   movq %%mm1, 8(%2)\n"
++		"   movq %%mm2, 16(%2)\n"
++		"   movq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm0\n"
++		"   movq 40(%1), %%mm1\n"
++		"   movq 48(%1), %%mm2\n"
++		"   movq 56(%1), %%mm3\n"
++		"   movq %%mm0, 32(%2)\n"
++		"   movq %%mm1, 40(%2)\n"
++		"   movq %%mm2, 48(%2)\n"
++		"   movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+diff -urNp linux-2.6.32.12/arch/x86/lib/putuser.S linux-2.6.32.12/arch/x86/lib/putuser.S
+--- linux-2.6.32.12/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/putuser.S	2010-04-04 20:58:33.225084964 -0400
+@@ -15,7 +15,8 @@
+ #include <asm/thread_info.h>
+ #include <asm/errno.h>
+ #include <asm/asm.h>
+-
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ /*
+  * __put_user_X
+@@ -29,59 +30,156 @@
+  * as they get called from within inline assembly.
+  */
+ 
+-#define ENTER	CFI_STARTPROC ; \
+-		GET_THREAD_INFO(%_ASM_BX)
++#define ENTER	CFI_STARTPROC
+ #define EXIT	ret ; \
+ 		CFI_ENDPROC
+ 
+ .text
+ ENTRY(__put_user_1)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 1:	movb %al,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_1)
+ 
+ ENTRY(__put_user_2)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $1,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 2:	movw %ax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_2)
+ 
+ ENTRY(__put_user_4)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $3,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 3:	movl %eax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_4)
+ 
+ ENTRY(__put_user_8)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $7,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 4:	mov %_ASM_AX,(%_ASM_CX)
+ #ifdef CONFIG_X86_32
+ 5:	movl %edx,4(%_ASM_CX)
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_8)
+ 
+ bad_put_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	movl $-EFAULT,%eax
+ 	EXIT
+ END(bad_put_user)
+diff -urNp linux-2.6.32.12/arch/x86/lib/usercopy_32.c linux-2.6.32.12/arch/x86/lib/usercopy_32.c
+--- linux-2.6.32.12/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/usercopy_32.c	2010-04-04 20:46:41.533557286 -0400
+@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
+  * Copy a null terminated string from userspace.
+  */
+ 
+-#define __do_strncpy_from_user(dst, src, count, res)			   \
+-do {									   \
+-	int __d0, __d1, __d2;						   \
+-	might_fault();							   \
+-	__asm__ __volatile__(						   \
+-		"	testl %1,%1\n"					   \
+-		"	jz 2f\n"					   \
+-		"0:	lodsb\n"					   \
+-		"	stosb\n"					   \
+-		"	testb %%al,%%al\n"				   \
+-		"	jz 1f\n"					   \
+-		"	decl %1\n"					   \
+-		"	jnz 0b\n"					   \
+-		"1:	subl %1,%0\n"					   \
+-		"2:\n"							   \
+-		".section .fixup,\"ax\"\n"				   \
+-		"3:	movl %5,%0\n"					   \
+-		"	jmp 2b\n"					   \
+-		".previous\n"						   \
+-		_ASM_EXTABLE(0b,3b)					   \
+-		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
+-		  "=&D" (__d2)						   \
+-		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
+-		: "memory");						   \
+-} while (0)
++static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
++{
++	int __d0, __d1, __d2;
++	long res = -EFAULT;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w10,%%ds\n"
++		"	testl %1,%1\n"
++		"	jz 2f\n"
++		"0:	lodsb\n"
++		"	stosb\n"
++		"	testb %%al,%%al\n"
++		"	jz 1f\n"
++		"	decl %1\n"
++		"	jnz 0b\n"
++		"1:	subl %1,%0\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"3:	movl %5,%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
++		  "=&D" (__d2)
++		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
++		  "r"(__USER_DS)
++		: "memory");
++	return res;
++}
+ 
+ /**
+  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
+@@ -85,9 +92,7 @@ do {									   \
+ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+-	long res;
+-	__do_strncpy_from_user(dst, src, count, res);
+-	return res;
++	return __do_strncpy_from_user(dst, src, count);
+ }
+ EXPORT_SYMBOL(__strncpy_from_user);
+ 
+@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
+ {
+ 	long res = -EFAULT;
+ 	if (access_ok(VERIFY_READ, src, 1))
+-		__do_strncpy_from_user(dst, src, count, res);
++		res = __do_strncpy_from_user(dst, src, count);
+ 	return res;
+ }
+ EXPORT_SYMBOL(strncpy_from_user);
+@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
+  * Zero Userspace
+  */
+ 
+-#define __do_clear_user(addr,size)					\
+-do {									\
+-	int __d0;							\
+-	might_fault();							\
+-	__asm__ __volatile__(						\
+-		"0:	rep; stosl\n"					\
+-		"	movl %2,%0\n"					\
+-		"1:	rep; stosb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"3:	lea 0(%2,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		_ASM_EXTABLE(0b,3b)					\
+-		_ASM_EXTABLE(1b,2b)					\
+-		: "=&c"(size), "=&D" (__d0)				\
+-		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
+-} while (0)
++static unsigned long __do_clear_user(void __user *addr, unsigned long size)
++{
++	int __d0;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w6,%%es\n"
++		"0:	rep; stosl\n"
++		"	movl %2,%0\n"
++		"1:	rep; stosb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"3:	lea 0(%2,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		_ASM_EXTABLE(1b,2b)
++		: "=&c"(size), "=&D" (__d0)
++		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
++		  "r"(__USER_DS));
++	return size;
++}
+ 
+ /**
+  * clear_user: - Zero a block of memory in user space.
+@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
+ {
+ 	might_fault();
+ 	if (access_ok(VERIFY_WRITE, to, n))
+-		__do_clear_user(to, n);
++		n = __do_clear_user(to, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(clear_user);
+@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
+ unsigned long
+ __clear_user(void __user *to, unsigned long n)
+ {
+-	__do_clear_user(to, n);
+-	return n;
++	return __do_clear_user(to, n);
+ }
+ EXPORT_SYMBOL(__clear_user);
+ 
+@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
+ 	might_fault();
+ 
+ 	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
+ 		"	testl %0, %0\n"
+ 		"	jz 3f\n"
+-		"	andl %0,%%ecx\n"
++		"	movl %0,%%ecx\n"
+ 		"0:	repne; scasb\n"
+ 		"	setne %%al\n"
+ 		"	subl %%ecx,%0\n"
+ 		"	addl %0,%%eax\n"
+ 		"1:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
+ 		".section .fixup,\"ax\"\n"
+ 		"2:	xorl %%eax,%%eax\n"
+ 		"	jmp 1b\n"
+@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
+ 		"	.long 0b,2b\n"
+ 		".previous"
+ 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
+-		:"0" (n), "1" (s), "2" (0), "3" (mask)
++		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
+ 		:"cc");
+ 	return res & mask;
+ }
+@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
+ 
+ #ifdef CONFIG_X86_INTEL_USERCOPY
+ static unsigned long
+-__copy_user_intel(void __user *to, const void *from, unsigned long size)
++__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "       movw %w6, %%es\n"
+ 		       "       .align 2,0x90\n"
+ 		       "1:     movl 32(%4), %%eax\n"
+ 		       "       cmpl $67, %0\n"
+@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
+ 		       "       .align 2,0x90\n"
+ 		       "3:     movl 0(%4), %%eax\n"
+ 		       "4:     movl 4(%4), %%edx\n"
+-		       "5:     movl %%eax, 0(%3)\n"
+-		       "6:     movl %%edx, 4(%3)\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
+ 		       "7:     movl 8(%4), %%eax\n"
+ 		       "8:     movl 12(%4),%%edx\n"
+-		       "9:     movl %%eax, 8(%3)\n"
+-		       "10:    movl %%edx, 12(%3)\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
+ 		       "11:    movl 16(%4), %%eax\n"
+ 		       "12:    movl 20(%4), %%edx\n"
+-		       "13:    movl %%eax, 16(%3)\n"
+-		       "14:    movl %%edx, 20(%3)\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
+ 		       "15:    movl 24(%4), %%eax\n"
+ 		       "16:    movl 28(%4), %%edx\n"
+-		       "17:    movl %%eax, 24(%3)\n"
+-		       "18:    movl %%edx, 28(%3)\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
+ 		       "19:    movl 32(%4), %%eax\n"
+ 		       "20:    movl 36(%4), %%edx\n"
+-		       "21:    movl %%eax, 32(%3)\n"
+-		       "22:    movl %%edx, 36(%3)\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
+ 		       "23:    movl 40(%4), %%eax\n"
+ 		       "24:    movl 44(%4), %%edx\n"
+-		       "25:    movl %%eax, 40(%3)\n"
+-		       "26:    movl %%edx, 44(%3)\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
+ 		       "27:    movl 48(%4), %%eax\n"
+ 		       "28:    movl 52(%4), %%edx\n"
+-		       "29:    movl %%eax, 48(%3)\n"
+-		       "30:    movl %%edx, 52(%3)\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
+ 		       "31:    movl 56(%4), %%eax\n"
+ 		       "32:    movl 60(%4), %%edx\n"
+-		       "33:    movl %%eax, 56(%3)\n"
+-		       "34:    movl %%edx, 60(%3)\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
+ 		       "       addl $-64, %0\n"
+ 		       "       addl $64, %4\n"
+ 		       "       addl $64, %3\n"
+@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
+ 		       "36:    movl %%eax, %0\n"
+ 		       "37:    rep; movsb\n"
+ 		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%es\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "101:   lea 0(%%eax,%0,4),%0\n"
+ 		       "       jmp 100b\n"
+@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
+ 		       "       .long 99b,101b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
++		       : "eax", "edx", "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
++{
++	int d0, d1;
++	__asm__ __volatile__(
++		       "       movw %w6, %%ds\n"
++		       "       .align 2,0x90\n"
++		       "1:     movl 32(%4), %%eax\n"
++		       "       cmpl $67, %0\n"
++		       "       jbe 3f\n"
++		       "2:     movl 64(%4), %%eax\n"
++		       "       .align 2,0x90\n"
++		       "3:     movl 0(%4), %%eax\n"
++		       "4:     movl 4(%4), %%edx\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
++		       "7:     movl 8(%4), %%eax\n"
++		       "8:     movl 12(%4),%%edx\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
++		       "11:    movl 16(%4), %%eax\n"
++		       "12:    movl 20(%4), %%edx\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
++		       "15:    movl 24(%4), %%eax\n"
++		       "16:    movl 28(%4), %%edx\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
++		       "19:    movl 32(%4), %%eax\n"
++		       "20:    movl 36(%4), %%edx\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
++		       "23:    movl 40(%4), %%eax\n"
++		       "24:    movl 44(%4), %%edx\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
++		       "27:    movl 48(%4), %%eax\n"
++		       "28:    movl 52(%4), %%edx\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
++		       "31:    movl 56(%4), %%eax\n"
++		       "32:    movl 60(%4), %%edx\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
++		       "       addl $-64, %0\n"
++		       "       addl $64, %4\n"
++		       "       addl $64, %3\n"
++		       "       cmpl $63, %0\n"
++		       "       ja  1b\n"
++		       "35:    movl  %0, %%eax\n"
++		       "       shrl  $2, %0\n"
++		       "       andl  $3, %%eax\n"
++		       "       cld\n"
++		       "99:    rep; movsl\n"
++		       "36:    movl %%eax, %0\n"
++		       "37:    rep; movsb\n"
++		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%ds\n"
++		       ".section .fixup,\"ax\"\n"
++		       "101:   lea 0(%%eax,%0,4),%0\n"
++		       "       jmp 100b\n"
++		       ".previous\n"
++		       ".section __ex_table,\"a\"\n"
++		       "       .align 4\n"
++		       "       .long 1b,100b\n"
++		       "       .long 2b,100b\n"
++		       "       .long 3b,100b\n"
++		       "       .long 4b,100b\n"
++		       "       .long 5b,100b\n"
++		       "       .long 6b,100b\n"
++		       "       .long 7b,100b\n"
++		       "       .long 8b,100b\n"
++		       "       .long 9b,100b\n"
++		       "       .long 10b,100b\n"
++		       "       .long 11b,100b\n"
++		       "       .long 12b,100b\n"
++		       "       .long 13b,100b\n"
++		       "       .long 14b,100b\n"
++		       "       .long 15b,100b\n"
++		       "       .long 16b,100b\n"
++		       "       .long 17b,100b\n"
++		       "       .long 18b,100b\n"
++		       "       .long 19b,100b\n"
++		       "       .long 20b,100b\n"
++		       "       .long 21b,100b\n"
++		       "       .long 22b,100b\n"
++		       "       .long 23b,100b\n"
++		       "       .long 24b,100b\n"
++		       "       .long 25b,100b\n"
++		       "       .long 26b,100b\n"
++		       "       .long 27b,100b\n"
++		       "       .long 28b,100b\n"
++		       "       .long 29b,100b\n"
++		       "       .long 30b,100b\n"
++		       "       .long 31b,100b\n"
++		       "       .long 32b,100b\n"
++		       "       .long 33b,100b\n"
++		       "       .long 34b,100b\n"
++		       "       .long 35b,100b\n"
++		       "       .long 36b,100b\n"
++		       "       .long 37b,100b\n"
++		       "       .long 99b,101b\n"
++		       ".previous"
++		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "        movw %w6, %%ds\n"
+ 		       "        .align 2,0x90\n"
+ 		       "0:      movl 32(%4), %%eax\n"
+ 		       "        cmpl $67, %0\n"
+@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .align 2,0x90\n"
+ 		       "2:      movl 0(%4), %%eax\n"
+ 		       "21:     movl 4(%4), %%edx\n"
+-		       "        movl %%eax, 0(%3)\n"
+-		       "        movl %%edx, 4(%3)\n"
++		       "        movl %%eax, %%es:0(%3)\n"
++		       "        movl %%edx, %%es:4(%3)\n"
+ 		       "3:      movl 8(%4), %%eax\n"
+ 		       "31:     movl 12(%4),%%edx\n"
+-		       "        movl %%eax, 8(%3)\n"
+-		       "        movl %%edx, 12(%3)\n"
++		       "        movl %%eax, %%es:8(%3)\n"
++		       "        movl %%edx, %%es:12(%3)\n"
+ 		       "4:      movl 16(%4), %%eax\n"
+ 		       "41:     movl 20(%4), %%edx\n"
+-		       "        movl %%eax, 16(%3)\n"
+-		       "        movl %%edx, 20(%3)\n"
++		       "        movl %%eax, %%es:16(%3)\n"
++		       "        movl %%edx, %%es:20(%3)\n"
+ 		       "10:     movl 24(%4), %%eax\n"
+ 		       "51:     movl 28(%4), %%edx\n"
+-		       "        movl %%eax, 24(%3)\n"
+-		       "        movl %%edx, 28(%3)\n"
++		       "        movl %%eax, %%es:24(%3)\n"
++		       "        movl %%edx, %%es:28(%3)\n"
+ 		       "11:     movl 32(%4), %%eax\n"
+ 		       "61:     movl 36(%4), %%edx\n"
+-		       "        movl %%eax, 32(%3)\n"
+-		       "        movl %%edx, 36(%3)\n"
++		       "        movl %%eax, %%es:32(%3)\n"
++		       "        movl %%edx, %%es:36(%3)\n"
+ 		       "12:     movl 40(%4), %%eax\n"
+ 		       "71:     movl 44(%4), %%edx\n"
+-		       "        movl %%eax, 40(%3)\n"
+-		       "        movl %%edx, 44(%3)\n"
++		       "        movl %%eax, %%es:40(%3)\n"
++		       "        movl %%edx, %%es:44(%3)\n"
+ 		       "13:     movl 48(%4), %%eax\n"
+ 		       "81:     movl 52(%4), %%edx\n"
+-		       "        movl %%eax, 48(%3)\n"
+-		       "        movl %%edx, 52(%3)\n"
++		       "        movl %%eax, %%es:48(%3)\n"
++		       "        movl %%edx, %%es:52(%3)\n"
+ 		       "14:     movl 56(%4), %%eax\n"
+ 		       "91:     movl 60(%4), %%edx\n"
+-		       "        movl %%eax, 56(%3)\n"
+-		       "        movl %%edx, 60(%3)\n"
++		       "        movl %%eax, %%es:56(%3)\n"
++		       "        movl %%edx, %%es:60(%3)\n"
+ 		       "        addl $-64, %0\n"
+ 		       "        addl $64, %4\n"
+ 		       "        addl $64, %3\n"
+@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        movl %%eax,%0\n"
+ 		       "7:      rep; movsb\n"
+ 		       "8:\n"
++		       "        pushl %%ss\n"
++		       "        popl %%ds\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "9:      lea 0(%%eax,%0,4),%0\n"
+ 		       "16:     pushl %0\n"
+@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .long 7b,16b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     pushl %0\n"
+@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     jmp 8b\n"
+@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
+  */
+ unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
+ 					unsigned long size);
+-unsigned long __copy_user_intel(void __user *to, const void *from,
++unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
++					unsigned long size);
++unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
+ 					unsigned long size);
+ unsigned long __copy_user_zeroing_intel_nocache(void *to,
+ 				const void __user *from, unsigned long size);
+ #endif /* CONFIG_X86_INTEL_USERCOPY */
+ 
+ /* Generic arbitrary sized copy.  */
+-#define __copy_user(to, from, size)					\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 2b\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,2b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
+-
+-#define __copy_user_zeroing(to, from, size)				\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 6f\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"6:	pushl %0\n"					\
+-		"	pushl %%eax\n"					\
+-		"	xorl %%eax,%%eax\n"				\
+-		"	rep; stosb\n"					\
+-		"	popl %%eax\n"					\
+-		"	popl %0\n"					\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,6b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
++static unsigned long
++__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 6f\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"6:	pushl %0\n"
++		"	pushl %%eax\n"
++		"	xorl %%eax,%%eax\n"
++		"	rep; stosb\n"
++		"	popl %%eax\n"
++		"	popl %0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,6b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
+ 
+ unsigned long __copy_to_user_ll(void __user *to, const void *from,
+ 				unsigned long n)
+@@ -775,9 +966,9 @@ survive:
+ 	}
+ #endif
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_to_user(to, from, n);
+ 	else
+-		n = __copy_user_intel(to, from, n);
++		n = __generic_copy_to_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_to_user_ll);
+@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
+ 					unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ 	else
+ 		n = __copy_user_zeroing_intel(to, from, n);
+ 	return n;
+@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
+ 					 unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ 	else
+-		n = __copy_user_intel((void __user *)to,
+-				      (const void *)from, n);
++		n = __generic_copy_from_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nozero);
+@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_zeroing_intel_nocache(to, from, n);
+ 	else
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ #else
+-	__copy_user_zeroing(to, from, n);
++	n = __copy_user_zeroing(to, from, n);
+ #endif
+ 	return n;
+ }
+@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_intel_nocache(to, from, n);
+ 	else
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ #else
+-	__copy_user(to, from, n);
++	n = __generic_copy_from_user(to, from, n);
+ #endif
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
+ 
+-/**
+- * copy_to_user: - Copy a block of data into user space.
+- * @to:   Destination address, in user space.
+- * @from: Source address, in kernel space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from kernel space to user space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- */
+-unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned long n)
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++void __set_fs(mm_segment_t x, int cpu)
+ {
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		n = __copy_to_user(to, from, n);
+-	return n;
++	unsigned long limit = x.seg;
++	struct desc_struct d;
++
++	current_thread_info()->addr_limit = x;
++	if (unlikely(paravirt_enabled()))
++		return;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
+ }
+-EXPORT_SYMBOL(copy_to_user);
+ 
+-/**
+- * copy_from_user: - Copy a block of data from user space.
+- * @to:   Destination address, in kernel space.
+- * @from: Source address, in user space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from user space to kernel space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- *
+- * If some data could not be copied, this function will pad the copied
+- * data to the requested size using zero bytes.
+- */
+-unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned long n)
++void set_fs(mm_segment_t x)
+ {
+-	if (access_ok(VERIFY_READ, from, n))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
++	__set_fs(x, get_cpu());
++	put_cpu();
+ }
+-EXPORT_SYMBOL(copy_from_user);
++#else
++void set_fs(mm_segment_t x)
++{
++	current_thread_info()->addr_limit = x;
++}
++#endif
++
++EXPORT_SYMBOL(set_fs);
+diff -urNp linux-2.6.32.12/arch/x86/lib/usercopy_64.c linux-2.6.32.12/arch/x86/lib/usercopy_64.c
+--- linux-2.6.32.12/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/lib/usercopy_64.c	2010-04-04 20:58:33.225084964 -0400
+@@ -42,6 +42,8 @@ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+ 	long res;
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	__do_strncpy_from_user(dst, src, count, res);
+ 	return res;
+ }
+@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
+ {
+ 	long __d0;
+ 	might_fault();
++	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
++		addr += PAX_USER_SHADOW_BASE;
+ 	/* no memory constraint because it doesn't change any memory gcc knows
+ 	   about */
+ 	asm volatile(
+@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
+ 
+ unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
+ {
+-	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
++	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
++		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
++			to += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
++			from += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)to, (__force void *)from, len);
+-	} 
+-	return len;		
++	}
++	return len;
+ }
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/Makefile linux-2.6.32.12/arch/x86/Makefile
+--- linux-2.6.32.12/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/Makefile	2010-04-04 20:46:41.533557286 -0400
+@@ -189,3 +189,12 @@ define archhelp
+   echo  '                  FDARGS="..."  arguments for the booted kernel'
+   echo  '                  FDINITRD=file initrd for the booted kernel'
+ endef
++
++define OLD_LD
++
++*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
++*** Please upgrade your binutils to 2.18 or newer
++endef
++
++archprepare:
++	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
+diff -urNp linux-2.6.32.12/arch/x86/mm/extable.c linux-2.6.32.12/arch/x86/mm/extable.c
+--- linux-2.6.32.12/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/extable.c	2010-04-04 20:46:41.533557286 -0400
+@@ -1,14 +1,71 @@
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
++#include <linux/sort.h>
+ #include <asm/uaccess.h>
++#include <asm/pgtable.h>
+ 
++/*
++ * The exception table needs to be sorted so that the binary
++ * search that we use to find entries in it works properly.
++ * This is used both for the kernel exception table and for
++ * the exception tables of modules that get loaded.
++ */
++static int cmp_ex(const void *a, const void *b)
++{
++	const struct exception_table_entry *x = a, *y = b;
++
++	/* avoid overflow */
++	if (x->insn > y->insn)
++		return 1;
++	if (x->insn < y->insn)
++		return -1;
++	return 0;
++}
++
++static void swap_ex(void *a, void *b, int size)
++{
++	struct exception_table_entry t, *x = a, *y = b;
++
++	t = *x;
++
++	pax_open_kernel();
++	*x = *y;
++	*y = t;
++	pax_close_kernel();
++}
++
++void sort_extable(struct exception_table_entry *start,
++		  struct exception_table_entry *finish)
++{
++	sort(start, finish - start, sizeof(struct exception_table_entry),
++	     cmp_ex, swap_ex);
++}
++
++#ifdef CONFIG_MODULES
++/*
++ * If the exception table is sorted, any referring to the module init
++ * will be at the beginning or the end.
++ */
++void trim_init_extable(struct module *m)
++{
++	/*trim the beginning*/
++	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
++		m->extable++;
++		m->num_exentries--;
++	}
++	/*trim the end*/
++	while (m->num_exentries &&
++		within_module_init(m->extable[m->num_exentries-1].insn, m))
++		m->num_exentries--;
++}
++#endif /* CONFIG_MODULES */
+ 
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fixup;
+ 
+ #ifdef CONFIG_PNPBIOS
+-	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
++	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
+ 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
+ 		extern u32 pnp_bios_is_utter_crap;
+ 		pnp_bios_is_utter_crap = 1;
+diff -urNp linux-2.6.32.12/arch/x86/mm/fault.c linux-2.6.32.12/arch/x86/mm/fault.c
+--- linux-2.6.32.12/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/fault.c	2010-04-29 17:46:36.897235141 -0400
+@@ -11,10 +11,19 @@
+ #include <linux/kprobes.h>		/* __kprobes, ...		*/
+ #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
+ #include <linux/perf_event.h>		/* perf_sw_event		*/
++#include <linux/unistd.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/traps.h>			/* dotraplinkage, ...		*/
+ #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
+ #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
++#include <asm/vsyscall.h>
++#include <asm/tlbflush.h>
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#include <asm/stacktrace.h>
++#include "../kernel/dumpstack.h"
++#endif
+ 
+ /*
+  * Page fault error code bits:
+@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
+ 	int ret = 0;
+ 
+ 	/* kprobe_running() needs smp_processor_id() */
+-	if (kprobes_built_in() && !user_mode_vm(regs)) {
++	if (kprobes_built_in() && !user_mode(regs)) {
+ 		preempt_disable();
+ 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
+ 			ret = 1;
+@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
+ 	force_sig_info(si_signo, &info, tsk);
+ }
+ 
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault(struct pt_regs *regs);
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
++{
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++	pgd = pgd_offset(mm, address);
++	if (!pgd_present(*pgd))
++		return NULL;
++	pud = pud_offset(pgd, address);
++	if (!pud_present(*pud))
++		return NULL;
++	pmd = pmd_offset(pud, address);
++	if (!pmd_present(*pmd))
++		return NULL;
++	return pmd;
++}
++#endif
++
+ DEFINE_SPINLOCK(pgd_lock);
+ LIST_HEAD(pgd_list);
+ 
+@@ -332,15 +365,27 @@ void vmalloc_sync_all(void)
+ 
+ 		const pgd_t *pgd_ref = pgd_offset_k(address);
+ 		unsigned long flags;
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		unsigned long cpu;
++#else
+ 		struct page *page;
++#endif
+ 
+ 		if (pgd_none(*pgd_ref))
+ 			continue;
+ 
+ 		spin_lock_irqsave(&pgd_lock, flags);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++			pgd_t *pgd = pgd_offset_cpu(cpu, address);
++#else
+ 		list_for_each_entry(page, &pgd_list, lru) {
+ 			pgd_t *pgd;
+ 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
++#endif
++
+ 			if (pgd_none(*pgd))
+ 				set_pgd(pgd, *pgd_ref);
+ 			else
+@@ -373,7 +418,14 @@ static noinline int vmalloc_fault(unsign
+ 	 * happen within a race in page table update. In the later
+ 	 * case just flush:
+ 	 */
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
++	pgd = pgd_offset_cpu(smp_processor_id(), address);
++#else
+ 	pgd = pgd_offset(current->active_mm, address);
++#endif
++
+ 	pgd_ref = pgd_offset_k(address);
+ 	if (pgd_none(*pgd_ref))
+ 		return -1;
+@@ -535,7 +587,7 @@ static int is_errata93(struct pt_regs *r
+ static int is_errata100(struct pt_regs *regs, unsigned long address)
+ {
+ #ifdef CONFIG_X86_64
+-	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
++	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
+ 		return 1;
+ #endif
+ 	return 0;
+@@ -562,7 +614,7 @@ static int is_f00f_bug(struct pt_regs *r
+ }
+ 
+ static const char nx_warning[] = KERN_CRIT
+-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
++"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
+ 
+ static void
+ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -571,15 +623,26 @@ show_fault_oops(struct pt_regs *regs, un
+ 	if (!oops_may_print())
+ 		return;
+ 
+-	if (error_code & PF_INSTR) {
++	if (nx_enabled && (error_code & PF_INSTR)) {
+ 		unsigned int level;
+ 
+ 		pte_t *pte = lookup_address(address, &level);
+ 
+ 		if (pte && pte_present(*pte) && !pte_exec(*pte))
+-			printk(nx_warning, current_uid());
++			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
+ 	}
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	if (init_mm.start_code <= address && address < init_mm.end_code) {
++		if (current->signal->curr_ip)
++			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++		else
++			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	}
++#endif
++
+ 	printk(KERN_ALERT "BUG: unable to handle kernel ");
+ 	if (address < PAGE_SIZE)
+ 		printk(KERN_CONT "NULL pointer dereference");
+@@ -704,6 +767,68 @@ __bad_area_nosemaphore(struct pt_regs *r
+ 		       unsigned long address, int si_code)
+ {
+ 	struct task_struct *tsk = current;
++	struct mm_struct *mm = tsk->mm;
++
++#ifdef CONFIG_X86_64
++	if (mm && (error_code & PF_INSTR)) {
++		if (regs->ip == (unsigned long)vgettimeofday) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
++			return;
++		} else if (regs->ip == (unsigned long)vtime) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
++			return;
++		} else if (regs->ip == (unsigned long)vgetcpu) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
++			return;
++		}
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm && (error_code & PF_USER)) {
++		unsigned long ip = regs->ip;
++
++		if (v8086_mode(regs))
++			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
++
++		/*
++		 * It's possible to have interrupts off here:
++		 */
++		local_irq_enable();
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
++		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++	}
++#endif
+ 
+ 	/* User mode accesses just cause a SIGSEGV */
+ 	if (error_code & PF_USER) {
+@@ -848,6 +973,106 @@ static int spurious_fault_check(unsigned
+ 	return 1;
+ }
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
++{
++	pte_t *pte;
++	pmd_t *pmd;
++	spinlock_t *ptl;
++	unsigned char pte_mask;
++
++	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
++	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
++		return 0;
++
++	/* PaX: it's our fault, let's handle it if we can */
++
++	/* PaX: take a look at read faults before acquiring any locks */
++	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
++		/* instruction fetch attempt from a protected page in user mode */
++		up_read(&mm->mmap_sem);
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		switch (pax_handle_fetch_fault(regs)) {
++		case 2:
++			return 1;
++		}
++#endif
++
++		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++		do_group_exit(SIGKILL);
++	}
++
++	pmd = pax_get_pmd(mm, address);
++	if (unlikely(!pmd))
++		return 0;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
++		/* write attempt to a protected page in user mode */
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++#ifdef CONFIG_SMP
++	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
++#else
++	if (likely(address > get_limit(regs->cs)))
++#endif
++	{
++		set_pte(pte, pte_mkread(*pte));
++		__flush_tlb_one(address);
++		pte_unmap_unlock(pte, ptl);
++		up_read(&mm->mmap_sem);
++		return 1;
++	}
++
++	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
++
++	/*
++	 * PaX: fill DTLB with user rights and retry
++	 */
++	__asm__ __volatile__ (
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"movw %w4,%%es\n"
++#endif
++		"orb %2,(%1)\n"
++#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
++/*
++ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
++ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
++ * page fault when examined during a TLB load attempt. this is true not only
++ * for PTEs holding a non-present entry but also present entries that will
++ * raise a page fault (such as those set up by PaX, or the copy-on-write
++ * mechanism). in effect it means that we do *not* need to flush the TLBs
++ * for our target pages since their PTEs are simply not in the TLBs at all.
++
++ * the best thing in omitting it is that we gain around 15-20% speed in the
++ * fast path of the page fault handler and can get rid of tracing since we
++ * can no longer flush unintended entries.
++ */
++		"invlpg (%0)\n"
++#endif
++		"testb $0,%%es:(%0)\n"
++		"xorb %3,(%1)\n"
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"pushl %%ss\n"
++		"popl %%es\n"
++#endif
++		:
++		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
++		: "memory", "cc");
++	pte_unmap_unlock(pte, ptl);
++	up_read(&mm->mmap_sem);
++	return 1;
++}
++#endif
++
+ /*
+  * Handle a spurious fault caused by a stale TLB entry.
+  *
+@@ -914,6 +1139,9 @@ int show_unhandled_signals = 1;
+ static inline int
+ access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
+ {
++	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
++		return 1;
++
+ 	if (write) {
+ 		/* write, present and write, not present: */
+ 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
+@@ -947,17 +1175,31 @@ do_page_fault(struct pt_regs *regs, unsi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct task_struct *tsk;
+-	unsigned long address;
+ 	struct mm_struct *mm;
+ 	int write;
+ 	int fault;
+ 
++	/* Get the faulting address: */
++	unsigned long address = read_cr2();
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
++		if (!search_exception_tables(regs->ip)) {
++			bad_area_nosemaphore(regs, error_code, address);
++			return;
++		}
++		if (address < PAX_USER_SHADOW_BASE) {
++			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
++			printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
++			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
++		} else
++			address -= PAX_USER_SHADOW_BASE;
++	}
++#endif
++
+ 	tsk = current;
+ 	mm = tsk->mm;
+ 
+-	/* Get the faulting address: */
+-	address = read_cr2();
+-
+ 	/*
+ 	 * Detect and handle instructions that would cause a page fault for
+ 	 * both a tracked kernel page and a userspace page.
+@@ -1017,7 +1259,7 @@ do_page_fault(struct pt_regs *regs, unsi
+ 	 * User-mode registers count as a user access even for any
+ 	 * potential system fault or CPU buglet:
+ 	 */
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		local_irq_enable();
+ 		error_code |= PF_USER;
+ 	} else {
+@@ -1071,6 +1313,11 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		might_sleep();
+ 	}
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
++		return;
++#endif
++
+ 	vma = find_vma(mm, address);
+ 	if (unlikely(!vma)) {
+ 		bad_area(regs, error_code, address);
+@@ -1082,18 +1329,24 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		bad_area(regs, error_code, address);
+ 		return;
+ 	}
+-	if (error_code & PF_USER) {
+-		/*
+-		 * Accessing the stack below %sp is always a bug.
+-		 * The large cushion allows instructions like enter
+-		 * and pusha to work. ("enter $65535, $31" pushes
+-		 * 32 pointers and then decrements %sp by 65535.)
+-		 */
+-		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
+-			bad_area(regs, error_code, address);
+-			return;
+-		}
++	/*
++	 * Accessing the stack below %sp is always a bug.
++	 * The large cushion allows instructions like enter
++	 * and pusha to work. ("enter $65535, $31" pushes
++	 * 32 pointers and then decrements %sp by 65535.)
++	 */
++	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
++		bad_area(regs, error_code, address);
++		return;
++	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
++		bad_area(regs, error_code, address);
++		return;
+ 	}
++#endif
++
+ 	if (unlikely(expand_stack(vma, address))) {
+ 		bad_area(regs, error_code, address);
+ 		return;
+@@ -1137,3 +1390,199 @@ good_area:
+ 
+ 	up_read(&mm->mmap_sem);
+ }
++
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault_32(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned char mov1, mov2;
++		unsigned short jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 11) >> 32)
++			break;
++#endif
++
++		err = get_user(mov1, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
++			regs->cx = addr1;
++			regs->ax = addr2;
++			regs->ip = addr2;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned char mov, jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 9) >> 32)
++			break;
++#endif
++
++		err = get_user(mov, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++
++		if (err)
++			break;
++
++		if (mov == 0xB9 && jmp == 0xE9) {
++			regs->cx = addr1;
++			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++
++#ifdef CONFIG_X86_64
++static int pax_handle_fetch_fault_64(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned int addr1;
++		unsigned long addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned long addr1, addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->ip = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when gcc trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	if (v8086_mode(regs))
++		return 1;
++
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++
++#ifdef CONFIG_X86_32
++	return pax_handle_fetch_fault_32(regs);
++#else
++	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
++		return pax_handle_fetch_fault_32(regs);
++	else
++		return pax_handle_fetch_fault_64(regs);
++#endif
++}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
++	for (i = -1; i < 80 / (long)sizeof(long); i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++#ifdef CONFIG_X86_32
++			printk(KERN_CONT "???????? ");
++#else
++			printk(KERN_CONT "???????????????? ");
++#endif
++		else
++			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
++	}
++	printk("\n");
++}
++#endif
++
++/**
++ * probe_kernel_write(): safely attempt to write to a location
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++long notrace probe_kernel_write(void *dst, const void *src, size_t size)
++{
++	long ret;
++	mm_segment_t old_fs = get_fs();
++
++	set_fs(KERNEL_DS);
++	pagefault_disable();
++	pax_open_kernel();
++	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
++	pax_close_kernel();
++	pagefault_enable();
++	set_fs(old_fs);
++
++	return ret ? -EFAULT : 0;
++}
+diff -urNp linux-2.6.32.12/arch/x86/mm/gup.c linux-2.6.32.12/arch/x86/mm/gup.c
+--- linux-2.6.32.12/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/gup.c	2010-04-04 20:46:41.533557286 -0400
+@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
+ 	addr = start;
+ 	len = (unsigned long) nr_pages << PAGE_SHIFT;
+ 	end = start + len;
+-	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
++	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+ 					(void __user *)start, len)))
+ 		return 0;
+ 
+diff -urNp linux-2.6.32.12/arch/x86/mm/highmem_32.c linux-2.6.32.12/arch/x86/mm/highmem_32.c
+--- linux-2.6.32.12/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/highmem_32.c	2010-04-04 20:46:41.533557286 -0400
+@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
+ 	idx = type + KM_TYPE_NR*smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+ 	BUG_ON(!pte_none(*(kmap_pte-idx)));
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte-idx, mk_pte(page, prot));
++	pax_close_kernel();
+ 
+ 	return (void *)vaddr;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/mm/hugetlbpage.c linux-2.6.32.12/arch/x86/mm/hugetlbpage.c
+--- linux-2.6.32.12/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/hugetlbpage.c	2010-04-04 20:46:41.533557286 -0400
+@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+-	unsigned long start_addr;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = mm->free_area_cache;
++		start_addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -281,13 +286,13 @@ full_search:
+ 
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+-		if (TASK_SIZE - len < addr) {
++		if (pax_task_size - len < addr) {
+ 			/*
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma, *prev_vma;
+-	unsigned long base = mm->mmap_base, addr = addr0;
++	unsigned long base = mm->mmap_base, addr;
+ 	unsigned long largest_hole = mm->cached_hole_size;
+-	int first_time = 1;
+ 
+ 	/* don't allow allocations above current base */
+ 	if (mm->free_area_cache > base)
+@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
+ 	        largest_hole = 0;
+ 		mm->free_area_cache  = base;
+ 	}
+-try_again:
++
+ 	/* make sure it can fit in the remaining address space */
+ 	if (mm->free_area_cache < len)
+ 		goto fail;
+@@ -364,22 +368,26 @@ try_again:
+ 
+ fail:
+ 	/*
+-	 * if hint left us with no space for the requested
+-	 * mapping then try again:
+-	 */
+-	if (first_time) {
+-		mm->free_area_cache = base;
+-		largest_hole = 0;
+-		first_time = 0;
+-		goto try_again;
+-	}
+-	/*
+ 	 * A failed mmap() very likely causes application failure,
+ 	 * so fall back to the bottom-up function here. This scenario
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+ 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
+ 			len, pgoff, flags);
+@@ -387,6 +395,7 @@ fail:
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
++	mm->mmap_base = base;
+ 	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > TASK_SIZE)
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED) {
+@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (pax_task_size - len >= addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+diff -urNp linux-2.6.32.12/arch/x86/mm/init_32.c linux-2.6.32.12/arch/x86/mm/init_32.c
+--- linux-2.6.32.12/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/init_32.c	2010-04-04 20:58:33.225084964 -0400
+@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
+ }
+ 
+ /*
+- * Creates a middle page table and puts a pointer to it in the
+- * given global directory entry. This only returns the gd entry
+- * in non-PAE compilation mode, since the middle layer is folded.
+- */
+-static pmd_t * __init one_md_table_init(pgd_t *pgd)
+-{
+-	pud_t *pud;
+-	pmd_t *pmd_table;
+-
+-#ifdef CONFIG_X86_PAE
+-	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
+-		if (after_bootmem)
+-			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
+-		else
+-			pmd_table = (pmd_t *)alloc_low_page();
+-		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
+-		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
+-		pud = pud_offset(pgd, 0);
+-		BUG_ON(pmd_table != pmd_offset(pud, 0));
+-
+-		return pmd_table;
+-	}
+-#endif
+-	pud = pud_offset(pgd, 0);
+-	pmd_table = pmd_offset(pud, 0);
+-
+-	return pmd_table;
+-}
+-
+-/*
+  * Create a page table and place a pointer to it in a middle page
+  * directory entry:
+  */
+@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
+ 			page_table = (pte_t *)alloc_low_page();
+ 
+ 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
++#else
+ 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
++#endif
+ 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
+ 	}
+ 
+ 	return pte_offset_kernel(pmd, 0);
+ }
+ 
++static pmd_t * __init one_md_table_init(pgd_t *pgd)
++{
++	pud_t *pud;
++	pmd_t *pmd_table;
++
++	pud = pud_offset(pgd, 0);
++	pmd_table = pmd_offset(pud, 0);
++
++	return pmd_table;
++}
++
+ pmd_t * __init populate_extra_pmd(unsigned long vaddr)
+ {
+ 	int pgd_idx = pgd_index(vaddr);
+@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
+ 	int pgd_idx, pmd_idx;
+ 	unsigned long vaddr;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte = NULL;
+ 
+@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
+ 	pgd = pgd_base + pgd_idx;
+ 
+ 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
+-		pmd = pmd + pmd_index(vaddr);
++		pud = pud_offset(pgd, vaddr);
++		pmd = pmd_offset(pud, vaddr);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
++
+ 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
+ 							pmd++, pmd_idx++) {
+ 			pte = page_table_kmap_check(one_page_table_init(pmd),
+@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
+ 	}
+ }
+ 
+-static inline int is_kernel_text(unsigned long addr)
++static inline int is_kernel_text(unsigned long start, unsigned long end)
+ {
+-	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
+-		return 1;
+-	return 0;
++	if ((start > ktla_ktva((unsigned long)_etext) ||
++	     end <= ktla_ktva((unsigned long)_stext)) &&
++	    (start > ktla_ktva((unsigned long)_einittext) ||
++	     end <= ktla_ktva((unsigned long)_sinittext)) &&
++
++#ifdef CONFIG_ACPI_SLEEP
++	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
++#endif
++
++	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
++		return 0;
++	return 1;
+ }
+ 
+ /*
+@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
+ 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
+ 	unsigned long start_pfn, end_pfn;
+ 	pgd_t *pgd_base = swapper_pg_dir;
+-	int pgd_idx, pmd_idx, pte_ofs;
++	unsigned int pgd_idx, pmd_idx, pte_ofs;
+ 	unsigned long pfn;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 	unsigned pages_2m, pages_4k;
+@@ -278,8 +279,13 @@ repeat:
+ 	pfn = start_pfn;
+ 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 	pgd = pgd_base + pgd_idx;
+-	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
++	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
++		pud = pud_offset(pgd, 0);
++		pmd = pmd_offset(pud, 0);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
+ 
+ 		if (pfn >= end_pfn)
+ 			continue;
+@@ -291,14 +297,13 @@ repeat:
+ #endif
+ 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
+ 		     pmd++, pmd_idx++) {
+-			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
++			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
+ 
+ 			/*
+ 			 * Map with big pages if possible, otherwise
+ 			 * create normal page tables:
+ 			 */
+ 			if (use_pse) {
+-				unsigned int addr2;
+ 				pgprot_t prot = PAGE_KERNEL_LARGE;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -308,11 +313,7 @@ repeat:
+ 					__pgprot(PTE_IDENT_ATTR |
+ 						 _PAGE_PSE);
+ 
+-				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
+-					PAGE_OFFSET + PAGE_SIZE-1;
+-
+-				if (is_kernel_text(addr) ||
+-				    is_kernel_text(addr2))
++				if (is_kernel_text(address, address + PMD_SIZE))
+ 					prot = PAGE_KERNEL_LARGE_EXEC;
+ 
+ 				pages_2m++;
+@@ -329,7 +330,7 @@ repeat:
+ 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 			pte += pte_ofs;
+ 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
+-			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
++			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
+ 				pgprot_t prot = PAGE_KERNEL;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -337,7 +338,7 @@ repeat:
+ 				 */
+ 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
+ 
+-				if (is_kernel_text(addr))
++				if (is_kernel_text(address, address + PAGE_SIZE))
+ 					prot = PAGE_KERNEL_EXEC;
+ 
+ 				pages_4k++;
+@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
+ 
+ 		pud = pud_offset(pgd, va);
+ 		pmd = pmd_offset(pud, va);
+-		if (!pmd_present(*pmd))
++		if (!pmd_present(*pmd) || pmd_huge(*pmd))
+ 			break;
+ 
+ 		pte = pte_offset_kernel(pmd, va);
+@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
+ 
+ static void __init pagetable_init(void)
+ {
+-	pgd_t *pgd_base = swapper_pg_dir;
+-
+-	permanent_kmaps_init(pgd_base);
++	permanent_kmaps_init(swapper_pg_dir);
+ }
+ 
+ #ifdef CONFIG_ACPI_SLEEP
+@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
+  * ACPI suspend needs this for resume, because things like the intel-agp
+  * driver might have split up a kernel 4MB mapping.
+  */
+-char swsusp_pg_dir[PAGE_SIZE]
++pgd_t swsusp_pg_dir[PTRS_PER_PGD]
+ 	__attribute__ ((aligned(PAGE_SIZE)));
+ 
+ static inline void save_pg_dir(void)
+ {
+-	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
++	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
+ }
+ #else /* !CONFIG_ACPI_SLEEP */
+ static inline void save_pg_dir(void)
+@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
+ 		flush_tlb_all();
+ }
+ 
+-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
++pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+ 
+ /* user-defined highmem size */
+@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
+ 	 * Initialize the boot-time allocator (with low memory only):
+ 	 */
+ 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
+-	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
++	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
+ 				 PAGE_SIZE);
+ 	if (bootmap == -1L)
+ 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
+@@ -864,6 +863,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_FLATMEM
+ 	BUG_ON(!mem_map);
+ #endif
+@@ -881,7 +886,7 @@ void __init mem_init(void)
+ 	set_highmem_pages_init();
+ 
+ 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
+-	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
++	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
+ 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
+ 
+ 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
+@@ -923,10 +928,10 @@ void __init mem_init(void)
+ 		((unsigned long)&__init_end -
+ 		 (unsigned long)&__init_begin) >> 10,
+ 
+-		(unsigned long)&_etext, (unsigned long)&_edata,
+-		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
++		(unsigned long)&_sdata, (unsigned long)&_edata,
++		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
+ 
+-		(unsigned long)&_text, (unsigned long)&_etext,
++		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
+ 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
+ 
+ 	/*
+@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read write\n",
+ 		 start, start+size);
+ 
+@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read only\n",
+ 		 start, start+size);
+ 
+@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
+ 	unsigned long start = PFN_ALIGN(_text);
+ 	unsigned long size = PFN_ALIGN(_etext) - start;
+ 
++	start = ktla_ktva(start);
+ 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+ 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
+ 		size >> 10);
+diff -urNp linux-2.6.32.12/arch/x86/mm/init_64.c linux-2.6.32.12/arch/x86/mm/init_64.c
+--- linux-2.6.32.12/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/init_64.c	2010-04-04 20:58:33.225084964 -0400
+@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
+ 	pmd = fill_pmd(pud, vaddr);
+ 	pte = fill_pte(pmd, vaddr);
+ 
++	pax_open_kernel();
+ 	set_pte(pte, new_pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
+ 		pgd = pgd_offset_k((unsigned long)__va(phys));
+ 		if (pgd_none(*pgd)) {
+ 			pud = (pud_t *) spp_getpage();
+-			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
+ 		}
+ 		pud = pud_offset(pgd, (unsigned long)__va(phys));
+ 		if (pud_none(*pud)) {
+ 			pmd = (pmd_t *) spp_getpage();
+-			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
+ 		}
+ 		pmd = pmd_offset(pud, phys);
+ 		BUG_ON(!pmd_none(*pmd));
+@@ -656,6 +656,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ 	/* clear_bss() already clear the empty_zero_page */
+ 
+ 	reservedpages = 0;
+@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
+ static struct vm_area_struct gate_vma = {
+ 	.vm_start	= VSYSCALL_START,
+ 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
+-	.vm_page_prot	= PAGE_READONLY_EXEC,
+-	.vm_flags	= VM_READ | VM_EXEC
++	.vm_page_prot	= PAGE_READONLY,
++	.vm_flags	= VM_READ
+ };
+ 
+ struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
+@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
+ 	if (vma == &gate_vma)
+ 		return "[vsyscall]";
+diff -urNp linux-2.6.32.12/arch/x86/mm/init.c linux-2.6.32.12/arch/x86/mm/init.c
+--- linux-2.6.32.12/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/init.c	2010-04-04 20:46:41.533557286 -0400
+@@ -69,11 +69,7 @@ static void __init find_early_table_spac
+ 	 * cause a hotspot and fill up ZONE_DMA. The page tables
+ 	 * need roughly 0.5KB per GB.
+ 	 */
+-#ifdef CONFIG_X86_32
+-	start = 0x7000;
+-#else
+-	start = 0x8000;
+-#endif
++	start = 0x100000;
+ 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
+ 					tables, PAGE_SIZE);
+ 	if (e820_table_start == -1UL)
+@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
+  */
+ int devmem_is_allowed(unsigned long pagenr)
+ {
+-	if (pagenr <= 256)
++	if (!pagenr)
++		return 1;
++#ifdef CONFIG_VM86
++	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
++		return 1;
++#endif
++	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 1;
+ 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+ 		return 0;
+@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
+ 
+ void free_initmem(void)
+ {
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++#ifdef CONFIG_X86_32
++	/* PaX: limit KERNEL_CS to actual size */
++	unsigned long addr, limit;
++	struct desc_struct d;
++	int cpu;
++
++	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
++	limit = (limit - 1UL) >> PAGE_SHIFT;
++
++	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
++		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
++	}
++
++	/* PaX: make KERNEL_CS read-only */
++	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
++	if (!paravirt_enabled())
++		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
++/*
++		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
++			pgd = pgd_offset_k(addr);
++			pud = pud_offset(pgd, addr);
++			pmd = pmd_offset(pud, addr);
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		}
++*/
++#ifdef CONFIG_X86_PAE
++	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
++	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++#ifdef CONFIG_MODULES
++	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
++#endif
++
++#else
++	unsigned long addr, end;
++
++	/* PaX: make kernel code/rodata read-only, rest non-executable */
++	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++
++	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
++	end = addr + KERNEL_IMAGE_SIZE;
++	for (; addr < end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++	flush_tlb_all();
++#endif
++
+ 	free_init_pages("unused kernel memory",
+ 			(unsigned long)(&__init_begin),
+ 			(unsigned long)(&__init_end));
+diff -urNp linux-2.6.32.12/arch/x86/mm/iomap_32.c linux-2.6.32.12/arch/x86/mm/iomap_32.c
+--- linux-2.6.32.12/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/iomap_32.c	2010-04-04 20:46:41.533557286 -0400
+@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
+ 	debug_kmap_atomic(type);
+ 	idx = type + KM_TYPE_NR * smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
++	pax_close_kernel();
++
+ 	arch_flush_lazy_mmu_mode();
+ 
+ 	return (void *)vaddr;
+diff -urNp linux-2.6.32.12/arch/x86/mm/ioremap.c linux-2.6.32.12/arch/x86/mm/ioremap.c
+--- linux-2.6.32.12/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/ioremap.c	2010-04-04 20:46:41.533557286 -0400
+@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
+ 	 * Second special case: Some BIOSen report the PC BIOS
+ 	 * area (640->1Mb) as ram even though it is not.
+ 	 */
+-	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
+-		    pagenr < (BIOS_END >> PAGE_SHIFT))
++	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
++		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 0;
+ 
+ 	for (i = 0; i < e820.nr_map; i++) {
+@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
+ 	/*
+ 	 * Don't allow anybody to remap normal RAM that we're using..
+ 	 */
+-	for (pfn = phys_addr >> PAGE_SHIFT;
+-				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
+-				pfn++) {
+-
++	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
+ 		int is_ram = page_is_ram(pfn);
+ 
+-		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
++		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
+ 			return NULL;
+ 		WARN_ON_ONCE(is_ram);
+ 	}
+@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
+ early_param("early_ioremap_debug", early_ioremap_debug_setup);
+ 
+ static __initdata int after_paging_init;
+-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
++static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
+ 
+ static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
+ {
+@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
+ 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
+ 
+ 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
+-	memset(bm_pte, 0, sizeof(bm_pte));
+-	pmd_populate_kernel(&init_mm, pmd, bm_pte);
++	pmd_populate_user(&init_mm, pmd, bm_pte);
+ 
+ 	/*
+ 	 * The boot-ioremap range spans multiple pmds, for which
+diff -urNp linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c
+--- linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c	2010-04-04 20:46:41.533557286 -0400
+@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
+ 	 * memory (e.g. tracked pages)? For now, we need this to avoid
+ 	 * invoking kmemcheck for PnP BIOS calls.
+ 	 */
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		return false;
+-	if (regs->cs != __KERNEL_CS)
++	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
+ 		return false;
+ 
+ 	pte = kmemcheck_pte_lookup(address);
+diff -urNp linux-2.6.32.12/arch/x86/mm/mmap.c linux-2.6.32.12/arch/x86/mm/mmap.c
+--- linux-2.6.32.12/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/mmap.c	2010-04-04 20:46:41.537568318 -0400
+@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
+  * Leave an at least ~128 MB hole with possible stack randomization.
+  */
+ #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
+-#define MAX_GAP (TASK_SIZE/6*5)
++#define MAX_GAP (pax_task_size/6*5)
+ 
+ /*
+  * True on X86_32 or when emulating IA32 on X86_64
+@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
+ 	return rnd << PAGE_SHIFT;
+ }
+ 
+-static unsigned long mmap_base(void)
++static unsigned long mmap_base(struct mm_struct *mm)
+ {
+ 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (gap < MIN_GAP)
+ 		gap = MIN_GAP;
+ 	else if (gap > MAX_GAP)
+ 		gap = MAX_GAP;
+ 
+-	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
++	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
+ }
+ 
+ /*
+  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
+  * does, but not when emulating X86_32
+  */
+-static unsigned long mmap_legacy_base(void)
++static unsigned long mmap_legacy_base(struct mm_struct *mm)
+ {
+-	if (mmap_is_ia32())
++	if (mmap_is_ia32()) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (mm->pax_flags & MF_PAX_SEGMEXEC)
++			return SEGMEXEC_TASK_UNMAPPED_BASE;
++		else
++#endif
++
+ 		return TASK_UNMAPPED_BASE;
+-	else
++	} else
+ 		return TASK_UNMAPPED_BASE + mmap_rnd();
+ }
+ 
+@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	if (mmap_is_legacy()) {
+-		mm->mmap_base = mmap_legacy_base();
++		mm->mmap_base = mmap_legacy_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+-		mm->mmap_base = mmap_base();
++		mm->mmap_base = mmap_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.12/arch/x86/mm/numa_32.c linux-2.6.32.12/arch/x86/mm/numa_32.c
+--- linux-2.6.32.12/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/numa_32.c	2010-04-04 20:46:41.537568318 -0400
+@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
+ }
+ #endif
+ 
+-extern unsigned long find_max_low_pfn(void);
+ extern unsigned long highend_pfn, highstart_pfn;
+ 
+ #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
+diff -urNp linux-2.6.32.12/arch/x86/mm/pageattr.c linux-2.6.32.12/arch/x86/mm/pageattr.c
+--- linux-2.6.32.12/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/pageattr.c	2010-04-04 20:46:41.537568318 -0400
+@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
+ 	 * Does not cover __inittext since that is gone later on. On
+ 	 * 64bit we do not enforce !NX on the low mapping
+ 	 */
+-	if (within(address, (unsigned long)_text, (unsigned long)_etext))
++	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
+ 		pgprot_val(forbidden) |= _PAGE_NX;
+ 
++#ifdef CONFIG_DEBUG_RODATA
+ 	/*
+ 	 * The .rodata section needs to be read-only. Using the pfn
+ 	 * catches all aliases.
+@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
+ 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
+ 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
+ 		pgprot_val(forbidden) |= _PAGE_RW;
++#endif
+ 
+ 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
+ 
+@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
+ static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
+ {
+ 	/* change init_mm */
++	pax_open_kernel();
+ 	set_pte_atomic(kpte, pte);
++	pax_close_kernel();
++
+ #ifdef CONFIG_X86_32
+ 	if (!SHARED_KERNEL_PMD) {
+ 		struct page *page;
+diff -urNp linux-2.6.32.12/arch/x86/mm/pageattr-test.c linux-2.6.32.12/arch/x86/mm/pageattr-test.c
+--- linux-2.6.32.12/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/pageattr-test.c	2010-04-04 20:46:41.537568318 -0400
+@@ -36,7 +36,7 @@ enum {
+ 
+ static int pte_testbit(pte_t pte)
+ {
+-	return pte_flags(pte) & _PAGE_UNUSED1;
++	return pte_flags(pte) & _PAGE_CPA_TEST;
+ }
+ 
+ struct split_state {
+diff -urNp linux-2.6.32.12/arch/x86/mm/pat.c linux-2.6.32.12/arch/x86/mm/pat.c
+--- linux-2.6.32.12/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/pat.c	2010-04-04 20:46:41.537568318 -0400
+@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
+ 
+  conflict:
+ 	printk(KERN_INFO "%s:%d conflicting memory types "
+-	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
++	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
+ 	       new->end, cattr_name(new->type), cattr_name(entry->type));
+ 	return -EBUSY;
+ }
+@@ -559,7 +559,7 @@ unlock_ret:
+ 
+ 	if (err) {
+ 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
+-			current->comm, current->pid, start, end);
++			current->comm, task_pid_nr(current), start, end);
+ 	}
+ 
+ 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
+@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
+ 		printk(KERN_INFO
+ 			"%s:%d ioremap_change_attr failed %s "
+ 			"for %Lx-%Lx\n",
+-			current->comm, current->pid,
++			current->comm, task_pid_nr(current),
+ 			cattr_name(flags),
+ 			base, (unsigned long long)(base + size));
+ 		return -EINVAL;
+@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
+ 			free_memtype(paddr, paddr + size);
+ 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
+ 				" for %Lx-%Lx, got %s\n",
+-				current->comm, current->pid,
++				current->comm, task_pid_nr(current),
+ 				cattr_name(want_flags),
+ 				(unsigned long long)paddr,
+ 				(unsigned long long)(paddr + size),
+diff -urNp linux-2.6.32.12/arch/x86/mm/pgtable_32.c linux-2.6.32.12/arch/x86/mm/pgtable_32.c
+--- linux-2.6.32.12/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/pgtable_32.c	2010-04-04 20:46:41.537568318 -0400
+@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
+ 		return;
+ 	}
+ 	pte = pte_offset_kernel(pmd, vaddr);
++
++	pax_open_kernel();
+ 	if (pte_val(pteval))
+ 		set_pte_at(&init_mm, vaddr, pte, pteval);
+ 	else
+ 		pte_clear(&init_mm, vaddr, pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+diff -urNp linux-2.6.32.12/arch/x86/mm/pgtable.c linux-2.6.32.12/arch/x86/mm/pgtable.c
+--- linux-2.6.32.12/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/pgtable.c	2010-04-04 20:58:33.225084964 -0400
+@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
+ #if PAGETABLE_LEVELS > 3
+ void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
+ 	tlb_remove_page(tlb, virt_to_page(pud));
++#endif
++
+ }
+ #endif	/* PAGETABLE_LEVELS > 3 */
+ #endif	/* PAGETABLE_LEVELS > 2 */
+@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
+ 	list_del(&page->lru);
+ }
+ 
+-#define UNSHARED_PTRS_PER_PGD				\
+-	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++	while (count--)
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
++#else
++		*dst++ = *src++;
++#endif
++
++}
++
++void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	while (count--)
++		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
++#endif
++
++}
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++static inline void pgd_ctor(pgd_t *pgd) {}
++static inline void pgd_dtor(pgd_t *pgd) {}
++#ifdef CONFIG_X86_64
++#define pxd_t				pud_t
++#define pyd_t				pgd_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
++#define pxd_free(mm, pud)		pud_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
++#define PYD_SIZE			PGDIR_SIZE
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pud)		pmd_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
++#endif
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
++#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
+ 
+ static void pgd_ctor(pgd_t *pgd)
+ {
+@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
+ 	pgd_list_del(pgd);
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ }
++#endif
+ 
+ /*
+  * List of all pgd's needed for non-PAE so it can invalidate entries
+@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * -- wli
+  */
+ 
+-#ifdef CONFIG_X86_PAE
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ /*
+  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
+  * updating the top-level pagetable entries to guarantee the
+@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
+  * and initialize the kernel pmds here.
+  */
+-#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
++#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+ 
+ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
+ {
+@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
+ 	if (mm == current->active_mm)
+ 		write_cr3(read_cr3());
+ }
++#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
++#define PREALLOCATED_PXDS	USER_PGD_PTRS
+ #else  /* !CONFIG_X86_PAE */
+ 
+ /* No need to prepopulate any pagetable entries in non-PAE modes. */
+-#define PREALLOCATED_PMDS	0
++#define PREALLOCATED_PXDS	0
+ 
+ #endif	/* CONFIG_X86_PAE */
+ 
+-static void free_pmds(pmd_t *pmds[])
++static void free_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++)
+-		if (pmds[i])
+-			free_page((unsigned long)pmds[i]);
++	for(i = 0; i < PREALLOCATED_PXDS; i++)
++		if (pxds[i])
++			free_page((unsigned long)pxds[i]);
+ }
+ 
+-static int preallocate_pmds(pmd_t *pmds[])
++static int preallocate_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 	bool failed = false;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
+-		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
+-		if (pmd == NULL)
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
++		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
++		if (pxd == NULL)
+ 			failed = true;
+-		pmds[i] = pmd;
++		pxds[i] = pxd;
+ 	}
+ 
+ 	if (failed) {
+-		free_pmds(pmds);
++		free_pxds(pxds);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
+  * preallocate which never got a corresponding vma will need to be
+  * freed manually.
+  */
+-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
++static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
+ 		pgd_t pgd = pgdp[i];
+ 
+ 		if (pgd_val(pgd) != 0) {
+-			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
++			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
+ 
+-			pgdp[i] = native_make_pgd(0);
++			set_pgd(pgdp + i, native_make_pgd(0));
+ 
+-			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
+-			pmd_free(mm, pmd);
++			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
++			pxd_free(mm, pxd);
+ 		}
+ 	}
+ }
+ 
+-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
++static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
+ {
+-	pud_t *pud;
++	pyd_t *pyd;
+ 	unsigned long addr;
+ 	int i;
+ 
+-	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
++	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
+ 		return;
+ 
+-	pud = pud_offset(pgd, 0);
++#ifdef CONFIG_X86_64
++	pyd = pyd_offset(mm, 0L);
++#else
++	pyd = pyd_offset(pgd, 0L);
++#endif
+ 
+- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
+-	     i++, pud++, addr += PUD_SIZE) {
+-		pmd_t *pmd = pmds[i];
++ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
++	     i++, pyd++, addr += PYD_SIZE) {
++		pxd_t *pxd = pxds[i];
+ 
+ 		if (i >= KERNEL_PGD_BOUNDARY)
+-			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
+-			       sizeof(pmd_t) * PTRS_PER_PMD);
++			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
++			       sizeof(pxd_t) * PTRS_PER_PMD);
+ 
+-		pud_populate(mm, pud, pmd);
++		pyd_populate(mm, pyd, pxd);
+ 	}
+ }
+ 
+ pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+ 	pgd_t *pgd;
+-	pmd_t *pmds[PREALLOCATED_PMDS];
++	pxd_t *pxds[PREALLOCATED_PXDS];
++
+ 	unsigned long flags;
+ 
+ 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
+@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 
+ 	mm->pgd = pgd;
+ 
+-	if (preallocate_pmds(pmds) != 0)
++	if (preallocate_pxds(pxds) != 0)
+ 		goto out_free_pgd;
+ 
+ 	if (paravirt_pgd_alloc(mm) != 0)
+-		goto out_free_pmds;
++		goto out_free_pxds;
+ 
+ 	/*
+ 	 * Make sure that pre-populating the pmds is atomic with
+@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 	spin_lock_irqsave(&pgd_lock, flags);
+ 
+ 	pgd_ctor(pgd);
+-	pgd_prepopulate_pmd(mm, pgd, pmds);
++	pgd_prepopulate_pxd(mm, pgd, pxds);
+ 
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ 
+ 	return pgd;
+ 
+-out_free_pmds:
+-	free_pmds(pmds);
++out_free_pxds:
++	free_pxds(pxds);
+ out_free_pgd:
+ 	free_page((unsigned long)pgd);
+ out:
+@@ -288,7 +354,7 @@ out:
+ 
+ void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ {
+-	pgd_mop_up_pmds(mm, pgd);
++	pgd_mop_up_pxds(mm, pgd);
+ 	pgd_dtor(pgd);
+ 	paravirt_pgd_free(mm, pgd);
+ 	free_page((unsigned long)pgd);
+diff -urNp linux-2.6.32.12/arch/x86/mm/setup_nx.c linux-2.6.32.12/arch/x86/mm/setup_nx.c
+--- linux-2.6.32.12/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/setup_nx.c	2010-04-04 20:46:41.537568318 -0400
+@@ -4,11 +4,10 @@
+ 
+ #include <asm/pgtable.h>
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ int nx_enabled;
+ 
+-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+-static int disable_nx __cpuinitdata;
+-
++#ifndef CONFIG_PAX_PAGEEXEC
+ /*
+  * noexec = on|off
+  *
+@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
+ 	if (!str)
+ 		return -EINVAL;
+ 	if (!strncmp(str, "on", 2)) {
+-		__supported_pte_mask |= _PAGE_NX;
+-		disable_nx = 0;
++		nx_enabled = 1;
+ 	} else if (!strncmp(str, "off", 3)) {
+-		disable_nx = 1;
+-		__supported_pte_mask &= ~_PAGE_NX;
++		nx_enabled = 0;
+ 	}
+ 	return 0;
+ }
+ early_param("noexec", noexec_setup);
+ #endif
++#endif
+ 
+ #ifdef CONFIG_X86_PAE
+ void __init set_nx(void)
+ {
+-	unsigned int v[4], l, h;
++	if (!nx_enabled && cpu_has_nx) {
++		unsigned l, h;
+ 
+-	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
+-		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
+-
+-		if ((v[3] & (1 << 20)) && !disable_nx) {
+-			rdmsr(MSR_EFER, l, h);
+-			l |= EFER_NX;
+-			wrmsr(MSR_EFER, l, h);
+-			nx_enabled = 1;
+-			__supported_pte_mask |= _PAGE_NX;
+-		}
++		__supported_pte_mask &= ~_PAGE_NX;
++		rdmsr(MSR_EFER, l, h);
++		l &= ~EFER_NX;
++		wrmsr(MSR_EFER, l, h);
+ 	}
+ }
+ #else
+@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
+ 	unsigned long efer;
+ 
+ 	rdmsrl(MSR_EFER, efer);
+-	if (!(efer & EFER_NX) || disable_nx)
++	if (!(efer & EFER_NX) || !nx_enabled)
+ 		__supported_pte_mask &= ~_PAGE_NX;
+ }
+ #endif
+diff -urNp linux-2.6.32.12/arch/x86/mm/tlb.c linux-2.6.32.12/arch/x86/mm/tlb.c
+--- linux-2.6.32.12/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/mm/tlb.c	2010-04-04 20:58:33.225084964 -0400
+@@ -12,7 +12,7 @@
+ #include <asm/uv/uv.h>
+ 
+ DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
+-			= { &init_mm, 0, };
++			= { &init_mm, 0 };
+ 
+ /*
+  *	Smarter SMP flushing macros.
+@@ -61,7 +61,11 @@ void leave_mm(int cpu)
+ 		BUG();
+ 	cpumask_clear_cpu(cpu,
+ 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	load_cr3(swapper_pg_dir);
++#endif
++
+ }
+ EXPORT_SYMBOL_GPL(leave_mm);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/oprofile/backtrace.c linux-2.6.32.12/arch/x86/oprofile/backtrace.c
+--- linux-2.6.32.12/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/oprofile/backtrace.c	2010-04-04 20:46:41.537568318 -0400
+@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
+ 	struct frame_head bufhead[2];
+ 
+ 	/* Also check accessibility of one struct frame_head beyond */
+-	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
++	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
+ 		return NULL;
+ 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
+ 		return NULL;
+@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
+ {
+ 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
+ 
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned long stack = kernel_stack_pointer(regs);
+ 		if (depth)
+ 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff -urNp linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c
+--- linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c	2010-04-04 20:46:41.537568318 -0400
+@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
+ #endif
+ }
+ 
+-static int inline addr_increment(void)
++static inline int addr_increment(void)
+ {
+ #ifdef CONFIG_SMP
+ 	return smp_num_siblings == 2 ? 2 : 1;
+diff -urNp linux-2.6.32.12/arch/x86/pci/common.c linux-2.6.32.12/arch/x86/pci/common.c
+--- linux-2.6.32.12/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/common.c	2010-04-04 20:46:41.537568318 -0400
+@@ -31,8 +31,8 @@ int noioapicreroute = 1;
+ int pcibios_last_bus = -1;
+ unsigned long pirq_table_addr;
+ struct pci_bus *pci_root_bus;
+-struct pci_raw_ops *raw_pci_ops;
+-struct pci_raw_ops *raw_pci_ext_ops;
++const struct pci_raw_ops *raw_pci_ops;
++const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+ int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val)
+@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ void __init dmi_check_pciprobe(void)
+diff -urNp linux-2.6.32.12/arch/x86/pci/direct.c linux-2.6.32.12/arch/x86/pci/direct.c
+--- linux-2.6.32.12/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/direct.c	2010-04-04 20:46:41.537568318 -0400
+@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
+ 
+ #undef PCI_CONF1_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf1 = {
++const struct pci_raw_ops pci_direct_conf1 = {
+ 	.read =		pci_conf1_read,
+ 	.write =	pci_conf1_write,
+ };
+@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
+ 
+ #undef PCI_CONF2_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf2 = {
++const struct pci_raw_ops pci_direct_conf2 = {
+ 	.read =		pci_conf2_read,
+ 	.write =	pci_conf2_write,
+ };
+@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
+  * This should be close to trivial, but it isn't, because there are buggy
+  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
+  */
+-static int __init pci_sanity_check(struct pci_raw_ops *o)
++static int __init pci_sanity_check(const struct pci_raw_ops *o)
+ {
+ 	u32 x = 0;
+ 	int year, devfn;
+diff -urNp linux-2.6.32.12/arch/x86/pci/fixup.c linux-2.6.32.12/arch/x86/pci/fixup.c
+--- linux-2.6.32.12/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/fixup.c	2010-04-04 20:46:41.537568318 -0400
+@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
+diff -urNp linux-2.6.32.12/arch/x86/pci/irq.c linux-2.6.32.12/arch/x86/pci/irq.c
+--- linux-2.6.32.12/arch/x86/pci/irq.c	2010-04-29 17:49:37.625451376 -0400
++++ linux-2.6.32.12/arch/x86/pci/irq.c	2010-04-29 17:49:58.053442872 -0400
+@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
+ 	static struct pci_device_id __initdata pirq_440gx[] = {
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
+-		{ },
++		{ PCI_DEVICE(0, 0) }
+ 	};
+ 
+ 	/* 440GX has a proprietary PIRQ router -- don't use it */
+@@ -1109,7 +1109,7 @@ static struct dmi_system_id __initdata p
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ int __init pcibios_irq_init(void)
+diff -urNp linux-2.6.32.12/arch/x86/pci/mmconfig_32.c linux-2.6.32.12/arch/x86/pci/mmconfig_32.c
+--- linux-2.6.32.12/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/mmconfig_32.c	2010-04-04 20:46:41.537568318 -0400
+@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.12/arch/x86/pci/mmconfig_64.c linux-2.6.32.12/arch/x86/pci/mmconfig_64.c
+--- linux-2.6.32.12/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/mmconfig_64.c	2010-04-04 20:46:41.537568318 -0400
+@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.12/arch/x86/pci/numaq_32.c linux-2.6.32.12/arch/x86/pci/numaq_32.c
+--- linux-2.6.32.12/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/numaq_32.c	2010-04-04 20:46:41.537568318 -0400
+@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
+ 
+ #undef PCI_CONF1_MQ_ADDRESS
+ 
+-static struct pci_raw_ops pci_direct_conf1_mq = {
++static const struct pci_raw_ops pci_direct_conf1_mq = {
+ 	.read	= pci_conf1_mq_read,
+ 	.write	= pci_conf1_mq_write
+ };
+diff -urNp linux-2.6.32.12/arch/x86/pci/olpc.c linux-2.6.32.12/arch/x86/pci/olpc.c
+--- linux-2.6.32.12/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/olpc.c	2010-04-04 20:46:41.537568318 -0400
+@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_olpc_conf = {
++static const struct pci_raw_ops pci_olpc_conf = {
+ 	.read =	pci_olpc_read,
+ 	.write = pci_olpc_write,
+ };
+diff -urNp linux-2.6.32.12/arch/x86/pci/pcbios.c linux-2.6.32.12/arch/x86/pci/pcbios.c
+--- linux-2.6.32.12/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/pci/pcbios.c	2010-04-04 20:46:41.537568318 -0400
+@@ -56,50 +56,93 @@ union bios32 {
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} bios32_indirect = { 0, __KERNEL_CS };
++} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+ /*
+  * Returns the entry point for the given service, NULL on error
+  */
+ 
+-static unsigned long bios32_service(unsigned long service)
++static unsigned long __devinit bios32_service(unsigned long service)
+ {
+ 	unsigned char return_code;	/* %al */
+ 	unsigned long address;		/* %ebx */
+ 	unsigned long length;		/* %ecx */
+ 	unsigned long entry;		/* %edx */
+ 	unsigned long flags;
++	struct desc_struct d, *gdt;
+ 
+ 	local_irq_save(flags);
+-	__asm__("lcall *(%%edi); cld"
++
++	gdt = get_cpu_gdt_table(smp_processor_id());
++
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++
++	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
+ 		: "=a" (return_code),
+ 		  "=b" (address),
+ 		  "=c" (length),
+ 		  "=d" (entry)
+ 		: "0" (service),
+ 		  "1" (0),
+-		  "D" (&bios32_indirect));
++		  "D" (&bios32_indirect),
++		  "r"(__PCIBIOS_DS)
++		: "memory");
++
++	pax_open_kernel();
++	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
++	pax_close_kernel();
++
+ 	local_irq_restore(flags);
+ 
+ 	switch (return_code) {
+-		case 0:
+-			return address + entry;
+-		case 0x80:	/* Not present */
+-			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
+-			return 0;
+-		default: /* Shouldn't happen */
+-			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
+-				service, return_code);
++	case 0: {
++		int cpu;
++		unsigned char flags;
++
++		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
++		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
++			printk(KERN_WARNING "bios32_service: not valid\n");
+ 			return 0;
++		}
++		address = address + PAGE_OFFSET;
++		length += 16UL; /* some BIOSs underreport this... */
++		flags = 4;
++		if (length >= 64*1024*1024) {
++			length >>= PAGE_SHIFT;
++			flags |= 8;
++		}
++
++		for (cpu = 0; cpu < NR_CPUS; cpu++) {
++			gdt = get_cpu_gdt_table(cpu);
++			pack_descriptor(&d, address, length, 0x9b, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++			pack_descriptor(&d, address, length, 0x93, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++		}
++		return entry;
++	}
++	case 0x80:	/* Not present */
++		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
++		return 0;
++	default: /* Shouldn't happen */
++		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
++			service, return_code);
++		return 0;
+ 	}
+ }
+ 
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} pci_indirect = { 0, __KERNEL_CS };
++} pci_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+-static int pci_bios_present;
++static int pci_bios_present __read_only;
+ 
+ static int __devinit check_pcibios(void)
+ {
+@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
+ 	unsigned long flags, pcibios_entry;
+ 
+ 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
+-		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
++		pci_indirect.address = pcibios_entry;
+ 
+ 		local_irq_save(flags);
+-		__asm__(
+-			"lcall *(%%edi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%edi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
+ 			  "=b" (ebx),
+ 			  "=c" (ecx)
+ 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
+-			  "D" (&pci_indirect)
++			  "D" (&pci_indirect),
++			  "r" (__PCIBIOS_DS)
+ 			: "memory");
+ 		local_irq_restore(flags);
+ 
+@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 8 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xff;
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_WORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 16 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xffff;
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
+  * Function table for BIOS32 access
+  */
+ 
+-static struct pci_raw_ops pci_bios_access = {
++static const struct pci_raw_ops pci_bios_access = {
+ 	.read =		pci_bios_read,
+ 	.write =	pci_bios_write
+ };
+@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
+  * Try to find PCI BIOS.
+  */
+ 
+-static struct pci_raw_ops * __devinit pci_find_bios(void)
++static const struct pci_raw_ops * __devinit pci_find_bios(void)
+ {
+ 	union bios32 *check;
+ 	unsigned char sum;
+@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
+ 
+ 	DBG("PCI: Fetching IRQ routing table... ");
+ 	__asm__("push %%es\n\t"
++		"movw %w8, %%ds\n\t"
+ 		"push %%ds\n\t"
+ 		"pop  %%es\n\t"
+-		"lcall *(%%esi); cld\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
+ 		"pop %%es\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
+ 		  "1" (0),
+ 		  "D" ((long) &opt),
+ 		  "S" (&pci_indirect),
+-		  "m" (opt)
++		  "m" (opt),
++		  "r" (__PCIBIOS_DS)
+ 		: "memory");
+ 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
+ 	if (ret & 0xff00)
+@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
+ {
+ 	int ret;
+ 
+-	__asm__("lcall *(%%esi); cld\n\t"
++	__asm__("movw %w5, %%ds\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
+ 		: "0" (PCIBIOS_SET_PCI_HW_INT),
+ 		  "b" ((dev->bus->number << 8) | dev->devfn),
+ 		  "c" ((irq << 8) | (pin + 10)),
+-		  "S" (&pci_indirect));
++		  "S" (&pci_indirect),
++		  "r" (__PCIBIOS_DS));
+ 	return !(ret & 0xff00);
+ }
+ EXPORT_SYMBOL(pcibios_set_irq_routing);
+diff -urNp linux-2.6.32.12/arch/x86/power/cpu.c linux-2.6.32.12/arch/x86/power/cpu.c
+--- linux-2.6.32.12/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/power/cpu.c	2010-04-04 20:46:41.537568318 -0400
+@@ -126,7 +126,7 @@ static void do_fpu_end(void)
+ static void fix_processor_context(void)
+ {
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 
+ 	set_tss_desc(cpu, t);	/*
+ 				 * This just modifies memory; should not be
+@@ -136,7 +136,9 @@ static void fix_processor_context(void)
+ 				 */
+ 
+ #ifdef CONFIG_X86_64
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
++	pax_close_kernel();
+ 
+ 	syscall_init();				/* This sets MSR_*STAR and related */
+ #endif
+diff -urNp linux-2.6.32.12/arch/x86/vdso/Makefile linux-2.6.32.12/arch/x86/vdso/Makefile
+--- linux-2.6.32.12/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/Makefile	2010-04-04 20:46:41.537568318 -0400
+@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
+ 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
+ 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
+ 
+-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+ GCOV_PROFILE := n
+ 
+ #
+diff -urNp linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c
+--- linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c	2010-04-04 20:46:41.541133870 -0400
+@@ -22,24 +22,48 @@
+ #include <asm/hpet.h>
+ #include <asm/unistd.h>
+ #include <asm/io.h>
++#include <asm/fixmap.h>
+ #include "vextern.h"
+ 
+ #define gtod vdso_vsyscall_gtod_data
+ 
++notrace noinline long __vdso_fallback_time(long *t)
++{
++	long secs;
++	asm volatile("syscall"
++		: "=a" (secs)
++		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
++	return secs;
++}
++
+ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+ {
+ 	long ret;
+ 	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
++	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
+ 	return ret;
+ }
+ 
++notrace static inline cycle_t __vdso_vread_hpet(void)
++{
++	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
++}
++
++notrace static inline cycle_t __vdso_vread_tsc(void)
++{
++	cycle_t ret = (cycle_t)vget_cycles();
++
++	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
++}
++
+ notrace static inline long vgetns(void)
+ {
+ 	long v;
+-	cycles_t (*vread)(void);
+-	vread = gtod->clock.vread;
+-	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
++	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
++		v = __vdso_vread_tsc();
++	else
++		v = __vdso_vread_hpet();
++	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
+ 	return (v * gtod->clock.mult) >> gtod->clock.shift;
+ }
+ 
+@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
+ 
+ notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
+ {
+-	if (likely(gtod->sysctl_enabled))
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
+ 		switch (clock) {
+ 		case CLOCK_REALTIME:
+ 			if (likely(gtod->clock.vread))
+@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
+ int clock_gettime(clockid_t, struct timespec *)
+ 	__attribute__((weak, alias("__vdso_clock_gettime")));
+ 
+-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
+ {
+ 	long ret;
+-	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
++	asm("syscall" : "=a" (ret) :
++	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
++	return ret;
++}
++
++notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++{
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
++	{
+ 		if (likely(tv != NULL)) {
+ 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
+ 				     offsetof(struct timespec, tv_nsec) ||
+@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
+ 		}
+ 		return 0;
+ 	}
+-	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+-	return ret;
++	return __vdso_fallback_gettimeofday(tv, tz);
+ }
+ int gettimeofday(struct timeval *, struct timezone *)
+ 	__attribute__((weak, alias("__vdso_gettimeofday")));
+diff -urNp linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c
+--- linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c	2010-04-04 20:46:41.541133870 -0400
+@@ -25,6 +25,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/vdso.h>
+ #include <asm/proto.h>
++#include <asm/mman.h>
+ 
+ enum {
+ 	VDSO_DISABLED = 0,
+@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
+ void enable_sep_cpu(void)
+ {
+ 	int cpu = get_cpu();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 
+ 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
+ 		put_cpu();
+@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
+ 	if (compat)
+ 		addr = VDSO_HIGH_BASE;
+ 	else {
+-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
+ 		if (IS_ERR_VALUE(addr)) {
+ 			ret = addr;
+ 			goto up_fail;
+ 		}
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	if (compat_uses_vma || !compat) {
+ 		/*
+@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
+ 	}
+ 
+ 	current_thread_info()->sysenter_return =
+-		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
++		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
+ 
+   up_fail:
+ 	if (ret)
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 
+ 	up_write(&mm->mmap_sem);
+ 
+@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table abi_root_table2[] = {
+@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
+ 		.mode = 0555,
+ 		.child = abi_table2
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static __init int ia32_binfmt_init(void)
+@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
++		return "[vdso]";
++#endif
++
+ 	return NULL;
+ }
+ 
+@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
+ 	struct mm_struct *mm = tsk->mm;
+ 
+ 	/* Check to see if this task was created in compat vdso mode */
+-	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
++	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
+ 		return &gate_vma;
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.12/arch/x86/vdso/vdso.lds.S linux-2.6.32.12/arch/x86/vdso/vdso.lds.S
+--- linux-2.6.32.12/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/vdso.lds.S	2010-04-04 20:46:41.541133870 -0400
+@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
+ #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
+ #include "vextern.h"
+ #undef	VEXTERN
++
++#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
++VEXTERN(fallback_gettimeofday)
++VEXTERN(fallback_time)
++VEXTERN(getcpu)
++#undef	VEXTERN
+diff -urNp linux-2.6.32.12/arch/x86/vdso/vextern.h linux-2.6.32.12/arch/x86/vdso/vextern.h
+--- linux-2.6.32.12/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/vextern.h	2010-04-04 20:46:41.541133870 -0400
+@@ -11,6 +11,5 @@
+    put into vextern.h and be referenced as a pointer with vdso prefix.
+    The main kernel later fills in the values.   */
+ 
+-VEXTERN(jiffies)
+ VEXTERN(vgetcpu_mode)
+ VEXTERN(vsyscall_gtod_data)
+diff -urNp linux-2.6.32.12/arch/x86/vdso/vma.c linux-2.6.32.12/arch/x86/vdso/vma.c
+--- linux-2.6.32.12/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/vdso/vma.c	2010-04-04 20:46:41.541133870 -0400
+@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
+ 	if (!vbase)
+ 		goto oom;
+ 
+-	if (memcmp(vbase, "\177ELF", 4)) {
++	if (memcmp(vbase, ELFMAG, SELFMAG)) {
+ 		printk("VDSO: I'm broken; not ELF\n");
+ 		vdso_enabled = 0;
+ 	}
+@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
+ 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
+ #include "vextern.h"
+ #undef VEXTERN
++	vunmap(vbase);
+ 	return 0;
+ 
+  oom:
+@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
+ 		goto up_fail;
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	ret = install_special_mapping(mm, addr, vdso_size,
+ 				      VM_READ|VM_EXEC|
+@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
+ 				      VM_ALWAYSDUMP,
+ 				      vdso_pages);
+ 	if (ret) {
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 		goto up_fail;
+ 	}
+ 
+@@ -132,10 +133,3 @@ up_fail:
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+-
+-static __init int vdso_setup(char *s)
+-{
+-	vdso_enabled = simple_strtoul(s, NULL, 0);
+-	return 0;
+-}
+-__setup("vdso=", vdso_setup);
+diff -urNp linux-2.6.32.12/arch/x86/xen/enlighten.c linux-2.6.32.12/arch/x86/xen/enlighten.c
+--- linux-2.6.32.12/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/xen/enlighten.c	2010-04-04 20:46:41.541133870 -0400
+@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
+ 
+ struct shared_info xen_dummy_shared_info;
+ 
+-void *xen_initial_gdt;
+-
+ /*
+  * Point at some empty memory to start with. We map the real shared_info
+  * page as soon as fixmap is up and running.
+@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
+ 
+ 	preempt_disable();
+ 
+-	start = __get_cpu_var(idt_desc).address;
++	start = (unsigned long)__get_cpu_var(idt_desc).address;
+ 	end = start + __get_cpu_var(idt_desc).size + 1;
+ 
+ 	xen_mc_flush();
+@@ -1133,13 +1131,6 @@ asmlinkage void __init xen_start_kernel(
+ 
+ 	machine_ops = xen_machine_ops;
+ 
+-	/*
+-	 * The only reliable way to retain the initial address of the
+-	 * percpu gdt_page is to remember it here, so we can go and
+-	 * mark it RW later, when the initial percpu area is freed.
+-	 */
+-	xen_initial_gdt = &per_cpu(gdt_page, 0);
+-
+ 	xen_smp_init();
+ 
+ 	pgd = (pgd_t *)xen_start_info->pt_base;
+diff -urNp linux-2.6.32.12/arch/x86/xen/mmu.c linux-2.6.32.12/arch/x86/xen/mmu.c
+--- linux-2.6.32.12/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/xen/mmu.c	2010-04-04 20:46:41.541133870 -0400
+@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	convert_pfn_mfn(init_level4_pgt);
+ 	convert_pfn_mfn(level3_ident_pgt);
+ 	convert_pfn_mfn(level3_kernel_pgt);
++	convert_pfn_mfn(level3_vmalloc_pgt);
++	convert_pfn_mfn(level3_vmemmap_pgt);
+ 
+ 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+ 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
++	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+ 
+diff -urNp linux-2.6.32.12/arch/x86/xen/smp.c linux-2.6.32.12/arch/x86/xen/smp.c
+--- linux-2.6.32.12/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/xen/smp.c	2010-04-04 20:46:41.541133870 -0400
+@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
+ {
+ 	BUG_ON(smp_processor_id() != 0);
+ 	native_smp_prepare_boot_cpu();
+-
+-	/* We've switched to the "real" per-cpu gdt, so make sure the
+-	   old memory can be recycled */
+-	make_lowmem_page_readwrite(xen_initial_gdt);
+-
+ 	xen_setup_vcpu_info_placement();
+ }
+ 
+@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
+ 	gdt = get_cpu_gdt_table(cpu);
+ 
+ 	ctxt->flags = VGCF_IN_KERNEL;
+-	ctxt->user_regs.ds = __USER_DS;
+-	ctxt->user_regs.es = __USER_DS;
++	ctxt->user_regs.ds = __KERNEL_DS;
++	ctxt->user_regs.es = __KERNEL_DS;
+ 	ctxt->user_regs.ss = __KERNEL_DS;
+ #ifdef CONFIG_X86_32
+ 	ctxt->user_regs.fs = __KERNEL_PERCPU;
+diff -urNp linux-2.6.32.12/arch/x86/xen/xen-ops.h linux-2.6.32.12/arch/x86/xen/xen-ops.h
+--- linux-2.6.32.12/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/arch/x86/xen/xen-ops.h	2010-04-04 20:46:41.541133870 -0400
+@@ -10,8 +10,6 @@
+ extern const char xen_hypervisor_callback[];
+ extern const char xen_failsafe_callback[];
+ 
+-extern void *xen_initial_gdt;
+-
+ struct trap_info;
+ void xen_copy_trap_info(struct trap_info *traps);
+ 
+diff -urNp linux-2.6.32.12/block/blk-integrity.c linux-2.6.32.12/block/blk-integrity.c
+--- linux-2.6.32.12/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/blk-integrity.c	2010-04-04 20:46:41.541133870 -0400
+@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops integrity_ops = {
++static const struct sysfs_ops integrity_ops = {
+ 	.show	= &integrity_attr_show,
+ 	.store	= &integrity_attr_store,
+ };
+diff -urNp linux-2.6.32.12/block/blk-iopoll.c linux-2.6.32.12/block/blk-iopoll.c
+--- linux-2.6.32.12/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/blk-iopoll.c	2010-04-04 20:46:41.541133870 -0400
+@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
+ }
+ EXPORT_SYMBOL(blk_iopoll_complete);
+ 
+-static void blk_iopoll_softirq(struct softirq_action *h)
++static void blk_iopoll_softirq(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
+ 	int rearm = 0, budget = blk_iopoll_budget;
+diff -urNp linux-2.6.32.12/block/blk-map.c linux-2.6.32.12/block/blk-map.c
+--- linux-2.6.32.12/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/blk-map.c	2010-04-04 20:46:41.541133870 -0400
+@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
+ 	 * direct dma. else, set up kernel bounce buffers
+ 	 */
+ 	uaddr = (unsigned long) ubuf;
+-	if (blk_rq_aligned(q, ubuf, len) && !map_data)
++	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
+ 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
+ 	else
+ 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
+@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
+ 	if (!len || !kbuf)
+ 		return -EINVAL;
+ 
+-	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
++	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
+ 	if (do_copy)
+ 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
+ 	else
+diff -urNp linux-2.6.32.12/block/blk-softirq.c linux-2.6.32.12/block/blk-softirq.c
+--- linux-2.6.32.12/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/blk-softirq.c	2010-04-04 20:46:41.541133870 -0400
+@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
+  * Softirq action handler - move entries to local list and loop over them
+  * while passing them to the queue registered handler.
+  */
+-static void blk_done_softirq(struct softirq_action *h)
++static void blk_done_softirq(void)
+ {
+ 	struct list_head *cpu_list, local_list;
+ 
+diff -urNp linux-2.6.32.12/block/blk-sysfs.c linux-2.6.32.12/block/blk-sysfs.c
+--- linux-2.6.32.12/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/blk-sysfs.c	2010-04-04 20:46:41.541133870 -0400
+@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
+ 	kmem_cache_free(blk_requestq_cachep, q);
+ }
+ 
+-static struct sysfs_ops queue_sysfs_ops = {
++static const struct sysfs_ops queue_sysfs_ops = {
+ 	.show	= queue_attr_show,
+ 	.store	= queue_attr_store,
+ };
+diff -urNp linux-2.6.32.12/block/elevator.c linux-2.6.32.12/block/elevator.c
+--- linux-2.6.32.12/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/block/elevator.c	2010-04-04 20:46:41.541133870 -0400
+@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
+ 	return error;
+ }
+ 
+-static struct sysfs_ops elv_sysfs_ops = {
++static const struct sysfs_ops elv_sysfs_ops = {
+ 	.show	= elv_attr_show,
+ 	.store	= elv_attr_store,
+ };
+diff -urNp linux-2.6.32.12/crypto/lrw.c linux-2.6.32.12/crypto/lrw.c
+--- linux-2.6.32.12/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/crypto/lrw.c	2010-04-04 20:46:41.541133870 -0400
+@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
+ 	struct priv *ctx = crypto_tfm_ctx(parent);
+ 	struct crypto_cipher *child = ctx->child;
+ 	int err, i;
+-	be128 tmp = { 0 };
++	be128 tmp = { 0, 0 };
+ 	int bsize = crypto_cipher_blocksize(child);
+ 
+ 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
+diff -urNp linux-2.6.32.12/Documentation/dontdiff linux-2.6.32.12/Documentation/dontdiff
+--- linux-2.6.32.12/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/Documentation/dontdiff	2010-04-04 20:47:28.952733264 -0400
+@@ -3,6 +3,7 @@
+ *.bin
+ *.cpio
+ *.csp
++*.dbg
+ *.dsp
+ *.dvi
+ *.elf
+@@ -40,6 +41,7 @@
+ *.ver
+ *.xml
+ *_MODULES
++*_reg_safe.h
+ *_vga16.c
+ *~
+ *.9
+@@ -49,11 +51,16 @@
+ 53c700_d.h
+ CVS
+ ChangeSet
++GPATH
++GRTAGS
++GSYMS
++GTAGS
+ Image
+ Kerntypes
+ Module.markers
+ Module.symvers
+ PENDING
++PERF*
+ SCCS
+ System.map*
+ TAGS
+@@ -76,7 +83,10 @@ btfixupprep
+ build
+ bvmlinux
+ bzImage*
++capflags.c
+ classlist.h*
++clut_vga16.c
++common-cmds.h
+ comp*.log
+ compile.h*
+ conf
+@@ -103,13 +113,14 @@ gen_crc32table
+ gen_init_cpio
+ genksyms
+ *_gray256.c
++hash
+ ihex2fw
+ ikconfig.h*
+ initramfs_data.cpio
++initramfs_data.cpio.bz2
+ initramfs_data.cpio.gz
+ initramfs_list
+ kallsyms
+-kconfig
+ keywords.c
+ ksym.c*
+ ksym.h*
+@@ -133,7 +144,9 @@ mkboot
+ mkbugboot
+ mkcpustr
+ mkdep
++mkpiggy
+ mkprep
++mkregtable
+ mktables
+ mktree
+ modpost
+@@ -149,6 +162,7 @@ patches*
+ pca200e.bin
+ pca200e_ecd.bin2
+ piggy.gz
++piggy.S
+ piggyback
+ pnmtologo
+ ppc_defs.h*
+@@ -163,6 +177,7 @@ setup
+ setup.bin
+ setup.elf
+ sImage
++slabinfo
+ sm_tbl*
+ split-include
+ syscalltab.h
+@@ -186,14 +201,20 @@ version.h*
+ vmlinux
+ vmlinux-*
+ vmlinux.aout
++vmlinux.bin.all
++vmlinux.bin.bz2
+ vmlinux.lds
++vmlinux.relocs
++voffset.h
+ vsyscall.lds
+ vsyscall_32.lds
+ wanxlfw.inc
+ uImage
+ unifdef
++utsrelease.h
+ wakeup.bin
+ wakeup.elf
+ wakeup.lds
+ zImage*
+ zconf.hash.c
++zoffset.h
+diff -urNp linux-2.6.32.12/Documentation/kernel-parameters.txt linux-2.6.32.12/Documentation/kernel-parameters.txt
+--- linux-2.6.32.12/Documentation/kernel-parameters.txt	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/Documentation/kernel-parameters.txt	2010-04-04 20:46:41.541133870 -0400
+@@ -1833,6 +1833,12 @@ and is between 256 and 4096 characters. 
+ 			the specified number of seconds.  This is to be used if
+ 			your oopses keep scrolling off the screen.
+ 
++	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
++			virtualization environments that don't cope well with the
++			expand down segment used by UDEREF on X86-32.
++
++	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
++
+ 	pcbit=		[HW,ISDN]
+ 
+ 	pcd.		[PARIDE]
+diff -urNp linux-2.6.32.12/drivers/acpi/battery.c linux-2.6.32.12/drivers/acpi/battery.c
+--- linux-2.6.32.12/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/battery.c	2010-04-04 20:46:41.541133870 -0400
+@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
+ 	}
+ 
+ static struct battery_file {
+-	struct file_operations ops;
++	const struct file_operations ops;
+ 	mode_t mode;
+ 	const char *name;
+ } acpi_battery_file[] = {
+diff -urNp linux-2.6.32.12/drivers/acpi/blacklist.c linux-2.6.32.12/drivers/acpi/blacklist.c
+--- linux-2.6.32.12/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/blacklist.c	2010-04-04 20:46:41.541133870 -0400
+@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
+ 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
+ 	 "Incorrect _ADR", 1},
+ 
+-	{""}
++	{"", "", 0, NULL, all_versions, NULL, 0}
+ };
+ 
+ #if	CONFIG_ACPI_BLACKLIST_YEAR
+diff -urNp linux-2.6.32.12/drivers/acpi/dock.c linux-2.6.32.12/drivers/acpi/dock.c
+--- linux-2.6.32.12/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/dock.c	2010-04-04 20:46:41.544756868 -0400
+@@ -77,7 +77,7 @@ struct dock_dependent_device {
+ 	struct list_head list;
+ 	struct list_head hotplug_list;
+ 	acpi_handle handle;
+-	struct acpi_dock_ops *ops;
++	const struct acpi_dock_ops *ops;
+ 	void *context;
+ };
+ 
+@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
+  * the dock driver after _DCK is executed.
+  */
+ int
+-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
++register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
+ 			     void *context)
+ {
+ 	struct dock_dependent_device *dd;
+diff -urNp linux-2.6.32.12/drivers/acpi/osl.c linux-2.6.32.12/drivers/acpi/osl.c
+--- linux-2.6.32.12/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/osl.c	2010-04-04 20:46:41.544756868 -0400
+@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 	if (!value)
+ 		value = &dummy;
+ 
+@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 
+ 	switch (width) {
+ 	case 8:
+diff -urNp linux-2.6.32.12/drivers/acpi/power_meter.c linux-2.6.32.12/drivers/acpi/power_meter.c
+--- linux-2.6.32.12/drivers/acpi/power_meter.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/power_meter.c	2010-04-29 17:46:37.081234462 -0400
+@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
+ 		return res;
+ 
+ 	temp /= 1000;
+-	if (temp < 0)
+-		return -EINVAL;
+ 
+ 	mutex_lock(&resource->lock);
+ 	resource->trip[attr->index - 7] = temp;
+diff -urNp linux-2.6.32.12/drivers/acpi/proc.c linux-2.6.32.12/drivers/acpi/proc.c
+--- linux-2.6.32.12/drivers/acpi/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/proc.c	2010-04-29 17:46:37.081234462 -0400
+@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
+ 				size_t count, loff_t * ppos)
+ {
+ 	struct list_head *node, *next;
+-	char strbuf[5];
+-	char str[5] = "";
+-	unsigned int len = count;
++	char strbuf[5] = {0};
+ 	struct acpi_device *found_dev = NULL;
+ 
+-	if (len > 4)
+-		len = 4;
+-	if (len < 0)
+-		return -EFAULT;
++	if (count > 4)
++		count = 4;
+ 
+-	if (copy_from_user(strbuf, buffer, len))
++	if (copy_from_user(strbuf, buffer, count))
+ 		return -EFAULT;
+-	strbuf[len] = '\0';
+-	sscanf(strbuf, "%s", str);
++	strbuf[count] = '\0';
+ 
+ 	mutex_lock(&acpi_device_lock);
+ 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
+@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
+ 		if (!dev->wakeup.flags.valid)
+ 			continue;
+ 
+-		if (!strncmp(dev->pnp.bus_id, str, 4)) {
++		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
+ 			dev->wakeup.state.enabled =
+ 			    dev->wakeup.state.enabled ? 0 : 1;
+ 			found_dev = dev;
+diff -urNp linux-2.6.32.12/drivers/acpi/processor_core.c linux-2.6.32.12/drivers/acpi/processor_core.c
+--- linux-2.6.32.12/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/processor_core.c	2010-04-04 20:46:41.544756868 -0400
+@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
+ 		return 0;
+ 	}
+ 
+-	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
++	BUG_ON(pr->id >= nr_cpu_ids);
+ 
+ 	/*
+ 	 * Buggy BIOS check
+diff -urNp linux-2.6.32.12/drivers/acpi/processor_idle.c linux-2.6.32.12/drivers/acpi/processor_idle.c
+--- linux-2.6.32.12/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/processor_idle.c	2010-04-04 20:46:41.544756868 -0400
+@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
+ 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+ 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
+ 	 (void *)1},
+-	{},
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
+ };
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/acpi/sleep.c linux-2.6.32.12/drivers/acpi/sleep.c
+--- linux-2.6.32.12/drivers/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/sleep.c	2010-04-04 20:46:41.544756868 -0400
+@@ -297,7 +297,7 @@ static int acpi_suspend_state_valid(susp
+ 	}
+ }
+ 
+-static struct platform_suspend_ops acpi_suspend_ops = {
++static const struct platform_suspend_ops acpi_suspend_ops = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin,
+ 	.prepare_late = acpi_pm_prepare,
+@@ -325,7 +325,7 @@ static int acpi_suspend_begin_old(suspen
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_suspend_ops acpi_suspend_ops_old = {
++static const struct platform_suspend_ops acpi_suspend_ops_old = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin_old,
+ 	.prepare_late = acpi_pm_disable_gpes,
+@@ -552,7 +552,7 @@ static void acpi_pm_enable_gpes(void)
+ 	acpi_enable_all_runtime_gpes();
+ }
+ 
+-static struct platform_hibernation_ops acpi_hibernation_ops = {
++static const struct platform_hibernation_ops acpi_hibernation_ops = {
+ 	.begin = acpi_hibernation_begin,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot,
+@@ -605,7 +605,7 @@ static int acpi_hibernation_pre_snapshot
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_hibernation_ops acpi_hibernation_ops_old = {
++static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
+ 	.begin = acpi_hibernation_begin_old,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
+diff -urNp linux-2.6.32.12/drivers/acpi/video.c linux-2.6.32.12/drivers/acpi/video.c
+--- linux-2.6.32.12/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/acpi/video.c	2010-04-04 20:46:41.544756868 -0400
+@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
+ 				vd->brightness->levels[request_level]);
+ }
+ 
+-static struct backlight_ops acpi_backlight_ops = {
++static const struct backlight_ops acpi_backlight_ops = {
+ 	.get_brightness = acpi_video_get_brightness,
+ 	.update_status  = acpi_video_set_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/ahci.c linux-2.6.32.12/drivers/ata/ahci.c
+--- linux-2.6.32.12/drivers/ata/ahci.c	2010-04-29 17:49:37.661448235 -0400
++++ linux-2.6.32.12/drivers/ata/ahci.c	2010-04-29 17:49:58.057498948 -0400
+@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
+ 	.sdev_attrs		= ahci_sdev_attrs,
+ };
+ 
+-static struct ata_port_operations ahci_ops = {
++static const struct ata_port_operations ahci_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
+@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
+ 	.port_stop		= ahci_port_stop,
+ };
+ 
+-static struct ata_port_operations ahci_vt8251_ops = {
++static const struct ata_port_operations ahci_vt8251_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_vt8251_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_p5wdh_ops = {
++static const struct ata_port_operations ahci_p5wdh_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_p5wdh_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_sb600_ops = {
++static const struct ata_port_operations ahci_sb600_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.softreset		= ahci_sb600_softreset,
+ 	.pmp_softreset		= ahci_sb600_softreset,
+@@ -687,7 +687,7 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
+ 
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/ata/ata_generic.c linux-2.6.32.12/drivers/ata/ata_generic.c
+--- linux-2.6.32.12/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/ata_generic.c	2010-04-04 20:46:41.544756868 -0400
+@@ -95,7 +95,7 @@ static struct scsi_host_template generic
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations generic_port_ops = {
++static const struct ata_port_operations generic_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_mode	= generic_set_mode,
+diff -urNp linux-2.6.32.12/drivers/ata/ata_piix.c linux-2.6.32.12/drivers/ata/ata_piix.c
+--- linux-2.6.32.12/drivers/ata/ata_piix.c	2010-04-29 17:49:37.669446700 -0400
++++ linux-2.6.32.12/drivers/ata/ata_piix.c	2010-04-29 18:01:47.141162449 -0400
+@@ -299,7 +299,7 @@ static const struct pci_device_id piix_p
+ 	{ 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (CPT) */
+ 	{ 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ static struct pci_driver piix_pci_driver = {
+@@ -317,7 +317,7 @@ static struct scsi_host_template piix_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations piix_pata_ops = {
++static const struct ata_port_operations piix_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= piix_set_piomode,
+@@ -325,22 +325,22 @@ static struct ata_port_operations piix_p
+ 	.prereset		= piix_pata_prereset,
+ };
+ 
+-static struct ata_port_operations piix_vmw_ops = {
++static const struct ata_port_operations piix_vmw_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.bmdma_status		= piix_vmw_bmdma_status,
+ };
+ 
+-static struct ata_port_operations ich_pata_ops = {
++static const struct ata_port_operations ich_pata_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.cable_detect		= ich_pata_cable_detect,
+ 	.set_dmamode		= ich_set_dmamode,
+ };
+ 
+-static struct ata_port_operations piix_sata_ops = {
++static const struct ata_port_operations piix_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ };
+ 
+-static struct ata_port_operations piix_sidpr_sata_ops = {
++static const struct ata_port_operations piix_sidpr_sata_ops = {
+ 	.inherits		= &piix_sata_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= piix_sidpr_scr_read,
+@@ -616,7 +616,7 @@ static const struct ich_laptop ich_lapto
+ 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
+ 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
+ 	/* end marker */
+-	{ 0, }
++	{ 0, 0, 0 }
+ };
+ 
+ /**
+@@ -1094,7 +1094,7 @@ static int piix_broken_suspend(void)
+ 			},
+ 		},
+ 
+-		{ }	/* terminate list */
++		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
+ 	};
+ 	static const char *oemstrs[] = {
+ 		"Tecra M3,",
+diff -urNp linux-2.6.32.12/drivers/ata/libata-acpi.c linux-2.6.32.12/drivers/ata/libata-acpi.c
+--- linux-2.6.32.12/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/libata-acpi.c	2010-04-04 20:46:41.544756868 -0400
+@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
+ 	ata_acpi_uevent(dev->link->ap, dev, event);
+ }
+ 
+-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
+ 	.handler = ata_acpi_dev_notify_dock,
+ 	.uevent = ata_acpi_dev_uevent,
+ };
+ 
+-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
+ 	.handler = ata_acpi_ap_notify_dock,
+ 	.uevent = ata_acpi_ap_uevent,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/libata-core.c linux-2.6.32.12/drivers/ata/libata-core.c
+--- linux-2.6.32.12/drivers/ata/libata-core.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.12/drivers/ata/libata-core.c	2010-04-29 17:49:58.081481928 -0400
+@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
+ 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
+ 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
+ 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
+-	{ -1, },
++	{ -1, 0, 0 }
+ };
+ 
+ /**
+@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
+ 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
+ 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
+ 
+-	{ 0xFF }
++	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
+@@ -4388,7 +4388,7 @@ static const struct ata_blacklist_entry 
+ 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
+ 
+ 	/* End Marker */
+-	{ }
++	{ NULL, NULL, 0 }
+ };
+ 
+ static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
+@@ -5964,7 +5964,7 @@ static void ata_host_stop(struct device 
+  *	LOCKING:
+  *	None.
+  */
+-static void ata_finalize_port_ops(struct ata_port_operations *ops)
++static void ata_finalize_port_ops(const struct ata_port_operations *ops)
+ {
+ 	static DEFINE_SPINLOCK(lock);
+ 	const struct ata_port_operations *cur;
+@@ -5976,6 +5976,7 @@ static void ata_finalize_port_ops(struct
+ 		return;
+ 
+ 	spin_lock(&lock);
++	pax_open_kernel();
+ 
+ 	for (cur = ops->inherits; cur; cur = cur->inherits) {
+ 		void **inherit = (void **)cur;
+@@ -5989,8 +5990,9 @@ static void ata_finalize_port_ops(struct
+ 		if (IS_ERR(*pp))
+ 			*pp = NULL;
+ 
+-	ops->inherits = NULL;
++	((struct ata_port_operations *)ops)->inherits = NULL;
+ 
++	pax_close_kernel();
+ 	spin_unlock(&lock);
+ }
+ 
+@@ -6087,7 +6089,7 @@ int ata_host_start(struct ata_host *host
+  */
+ /* KILLME - the only user left is ipr */
+ void ata_host_init(struct ata_host *host, struct device *dev,
+-		   unsigned long flags, struct ata_port_operations *ops)
++		   unsigned long flags, const struct ata_port_operations *ops)
+ {
+ 	spin_lock_init(&host->lock);
+ 	host->dev = dev;
+@@ -6750,7 +6752,7 @@ static void ata_dummy_error_handler(stru
+ 	/* truly dummy */
+ }
+ 
+-struct ata_port_operations ata_dummy_port_ops = {
++const struct ata_port_operations ata_dummy_port_ops = {
+ 	.qc_prep		= ata_noop_qc_prep,
+ 	.qc_issue		= ata_dummy_qc_issue,
+ 	.error_handler		= ata_dummy_error_handler,
+diff -urNp linux-2.6.32.12/drivers/ata/libata-eh.c linux-2.6.32.12/drivers/ata/libata-eh.c
+--- linux-2.6.32.12/drivers/ata/libata-eh.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/libata-eh.c	2010-04-04 20:46:41.544756868 -0400
+@@ -3581,7 +3581,7 @@ void ata_do_eh(struct ata_port *ap, ata_
+  */
+ void ata_std_error_handler(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	ata_reset_fn_t hardreset = ops->hardreset;
+ 
+ 	/* ignore built-in hardreset if SCR access is not available */
+diff -urNp linux-2.6.32.12/drivers/ata/libata-pmp.c linux-2.6.32.12/drivers/ata/libata-pmp.c
+--- linux-2.6.32.12/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/libata-pmp.c	2010-04-04 20:46:41.544756868 -0400
+@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
+  */
+ static int sata_pmp_eh_recover(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
+ 	struct ata_link *pmp_link = &ap->link;
+ 	struct ata_device *pmp_dev = pmp_link->device;
+diff -urNp linux-2.6.32.12/drivers/ata/pata_acpi.c linux-2.6.32.12/drivers/ata/pata_acpi.c
+--- linux-2.6.32.12/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_acpi.c	2010-04-04 20:46:41.549452547 -0400
+@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pacpi_ops = {
++static const struct ata_port_operations pacpi_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= pacpi_qc_issue,
+ 	.cable_detect		= pacpi_cable_detect,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_ali.c linux-2.6.32.12/drivers/ata/pata_ali.c
+--- linux-2.6.32.12/drivers/ata/pata_ali.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.12/drivers/ata/pata_ali.c	2010-04-29 17:49:58.081481928 -0400
+@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
+  *	Port operations for PIO only ALi
+  */
+ 
+-static struct ata_port_operations ali_early_port_ops = {
++static const struct ata_port_operations ali_early_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= ali_set_piomode,
+@@ -382,7 +382,7 @@ static const struct ata_port_operations 
+  *	Port operations for DMA capable ALi without cable
+  *	detect
+  */
+-static struct ata_port_operations ali_20_port_ops = {
++static const struct ata_port_operations ali_20_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.mode_filter	= ali_20_filter,
+@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c2_port_ops = {
++static const struct ata_port_operations ali_c2_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c4_port_ops = {
++static const struct ata_port_operations ali_c4_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
+ /*
+  *	Port operations for DMA capable ALi with cable detect and LBA48
+  */
+-static struct ata_port_operations ali_c5_port_ops = {
++static const struct ata_port_operations ali_c5_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.dev_config	= ali_warn_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_amd.c linux-2.6.32.12/drivers/ata/pata_amd.c
+--- linux-2.6.32.12/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_amd.c	2010-04-04 20:46:41.549452547 -0400
+@@ -397,28 +397,28 @@ static const struct ata_port_operations 
+ 	.prereset	= amd_pre_reset,
+ };
+ 
+-static struct ata_port_operations amd33_port_ops = {
++static const struct ata_port_operations amd33_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= amd33_set_piomode,
+ 	.set_dmamode	= amd33_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd66_port_ops = {
++static const struct ata_port_operations amd66_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd66_set_piomode,
+ 	.set_dmamode	= amd66_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd100_port_ops = {
++static const struct ata_port_operations amd100_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd100_set_piomode,
+ 	.set_dmamode	= amd100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd133_port_ops = {
++static const struct ata_port_operations amd133_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= amd_cable_detect,
+ 	.set_piomode	= amd133_set_piomode,
+@@ -433,13 +433,13 @@ static const struct ata_port_operations 
+ 	.host_stop	= nv_host_stop,
+ };
+ 
+-static struct ata_port_operations nv100_port_ops = {
++static const struct ata_port_operations nv100_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv100_set_piomode,
+ 	.set_dmamode	= nv100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations nv133_port_ops = {
++static const struct ata_port_operations nv133_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv133_set_piomode,
+ 	.set_dmamode	= nv133_set_dmamode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_artop.c linux-2.6.32.12/drivers/ata/pata_artop.c
+--- linux-2.6.32.12/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_artop.c	2010-04-04 20:46:41.549452547 -0400
+@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations artop6210_ops = {
++static const struct ata_port_operations artop6210_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= artop6210_set_piomode,
+@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
+ 	.qc_defer		= artop6210_qc_defer,
+ };
+ 
+-static struct ata_port_operations artop6260_ops = {
++static const struct ata_port_operations artop6260_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= artop6260_cable_detect,
+ 	.set_piomode		= artop6260_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_at32.c linux-2.6.32.12/drivers/ata/pata_at32.c
+--- linux-2.6.32.12/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_at32.c	2010-04-04 20:46:41.549452547 -0400
+@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations at32_port_ops = {
++static const struct ata_port_operations at32_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= pata_at32_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_at91.c linux-2.6.32.12/drivers/ata/pata_at91.c
+--- linux-2.6.32.12/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_at91.c	2010-04-04 20:46:41.549452547 -0400
+@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_at91_port_ops = {
++static const struct ata_port_operations pata_at91_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 
+ 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_atiixp.c linux-2.6.32.12/drivers/ata/pata_atiixp.c
+--- linux-2.6.32.12/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_atiixp.c	2010-04-04 20:46:41.549452547 -0400
+@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations atiixp_port_ops = {
++static const struct ata_port_operations atiixp_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_atp867x.c linux-2.6.32.12/drivers/ata/pata_atp867x.c
+--- linux-2.6.32.12/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_atp867x.c	2010-04-04 20:46:41.549452547 -0400
+@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations atp867x_ops = {
++static const struct ata_port_operations atp867x_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= atp867x_cable_detect,
+ 	.set_piomode		= atp867x_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_bf54x.c linux-2.6.32.12/drivers/ata/pata_bf54x.c
+--- linux-2.6.32.12/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_bf54x.c	2010-04-04 20:46:41.549452547 -0400
+@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations bfin_pata_ops = {
++static const struct ata_port_operations bfin_pata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.set_piomode		= bfin_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cmd640.c linux-2.6.32.12/drivers/ata/pata_cmd640.c
+--- linux-2.6.32.12/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cmd640.c	2010-04-04 20:46:41.549452547 -0400
+@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cmd640_port_ops = {
++static const struct ata_port_operations cmd640_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cmd64x.c linux-2.6.32.12/drivers/ata/pata_cmd64x.c
+--- linux-2.6.32.12/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cmd64x.c	2010-04-04 20:46:41.549452547 -0400
+@@ -275,18 +275,18 @@ static const struct ata_port_operations 
+ 	.set_dmamode	= cmd64x_set_dmamode,
+ };
+ 
+-static struct ata_port_operations cmd64x_port_ops = {
++static const struct ata_port_operations cmd64x_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd646r1_port_ops = {
++static const struct ata_port_operations cmd646r1_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd646r1_bmdma_stop,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd648_port_ops = {
++static const struct ata_port_operations cmd648_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd648_bmdma_stop,
+ 	.cable_detect	= cmd648_cable_detect,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5520.c linux-2.6.32.12/drivers/ata/pata_cs5520.c
+--- linux-2.6.32.12/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cs5520.c	2010-04-04 20:46:41.549452547 -0400
+@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5520_port_ops = {
++static const struct ata_port_operations cs5520_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_prep		= ata_sff_dumb_qc_prep,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5530.c linux-2.6.32.12/drivers/ata/pata_cs5530.c
+--- linux-2.6.32.12/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cs5530.c	2010-04-04 20:46:41.549452547 -0400
+@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5530_port_ops = {
++static const struct ata_port_operations cs5530_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5535.c linux-2.6.32.12/drivers/ata/pata_cs5535.c
+--- linux-2.6.32.12/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cs5535.c	2010-04-04 20:46:41.549452547 -0400
+@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5535_port_ops = {
++static const struct ata_port_operations cs5535_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= cs5535_cable_detect,
+ 	.set_piomode	= cs5535_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5536.c linux-2.6.32.12/drivers/ata/pata_cs5536.c
+--- linux-2.6.32.12/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cs5536.c	2010-04-04 20:46:41.549452547 -0400
+@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5536_port_ops = {
++static const struct ata_port_operations cs5536_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= cs5536_cable_detect,
+ 	.set_piomode		= cs5536_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_cypress.c linux-2.6.32.12/drivers/ata/pata_cypress.c
+--- linux-2.6.32.12/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_cypress.c	2010-04-04 20:46:41.549452547 -0400
+@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cy82c693_port_ops = {
++static const struct ata_port_operations cy82c693_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= cy82c693_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_efar.c linux-2.6.32.12/drivers/ata/pata_efar.c
+--- linux-2.6.32.12/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_efar.c	2010-04-04 20:46:41.549452547 -0400
+@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations efar_ops = {
++static const struct ata_port_operations efar_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= efar_cable_detect,
+ 	.set_piomode		= efar_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt366.c linux-2.6.32.12/drivers/ata/pata_hpt366.c
+--- linux-2.6.32.12/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_hpt366.c	2010-04-04 20:46:41.549452547 -0400
+@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
+  *	Configuration for HPT366/68
+  */
+ 
+-static struct ata_port_operations hpt366_port_ops = {
++static const struct ata_port_operations hpt366_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= hpt36x_cable_detect,
+ 	.mode_filter	= hpt366_filter,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt37x.c linux-2.6.32.12/drivers/ata/pata_hpt37x.c
+--- linux-2.6.32.12/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_hpt37x.c	2010-04-04 20:46:41.552552724 -0400
+@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
+  *	Configuration for HPT370
+  */
+ 
+-static struct ata_port_operations hpt370_port_ops = {
++static const struct ata_port_operations hpt370_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt370_bmdma_stop,
+@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
+  *	Configuration for HPT370A. Close to 370 but less filters
+  */
+ 
+-static struct ata_port_operations hpt370a_port_ops = {
++static const struct ata_port_operations hpt370a_port_ops = {
+ 	.inherits	= &hpt370_port_ops,
+ 	.mode_filter	= hpt370a_filter,
+ };
+@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
+  *	and DMA mode setting functionality.
+  */
+ 
+-static struct ata_port_operations hpt372_port_ops = {
++static const struct ata_port_operations hpt372_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt37x_bmdma_stop,
+@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
+  *	but we have a different cable detection procedure for function 1.
+  */
+ 
+-static struct ata_port_operations hpt374_fn1_port_ops = {
++static const struct ata_port_operations hpt374_fn1_port_ops = {
+ 	.inherits	= &hpt372_port_ops,
+ 	.prereset	= hpt374_fn1_pre_reset,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c
+--- linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c	2010-04-04 20:46:41.552552724 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
+  *	Configuration for HPT3x2n.
+  */
+ 
+-static struct ata_port_operations hpt3x2n_port_ops = {
++static const struct ata_port_operations hpt3x2n_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt3x2n_bmdma_stop,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt3x3.c linux-2.6.32.12/drivers/ata/pata_hpt3x3.c
+--- linux-2.6.32.12/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_hpt3x3.c	2010-04-04 20:46:41.552552724 -0400
+@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations hpt3x3_port_ops = {
++static const struct ata_port_operations hpt3x3_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= hpt3x3_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_icside.c linux-2.6.32.12/drivers/ata/pata_icside.c
+--- linux-2.6.32.12/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_icside.c	2010-04-04 20:46:41.552552724 -0400
+@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
+ 	}
+ }
+ 
+-static struct ata_port_operations pata_icside_port_ops = {
++static const struct ata_port_operations pata_icside_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	/* no need to build any PRD tables for DMA */
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_isapnp.c linux-2.6.32.12/drivers/ata/pata_isapnp.c
+--- linux-2.6.32.12/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_isapnp.c	2010-04-04 20:46:41.552552724 -0400
+@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations isapnp_port_ops = {
++static const struct ata_port_operations isapnp_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations isapnp_noalt_port_ops = {
++static const struct ata_port_operations isapnp_noalt_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	/* No altstatus so we don't want to use the lost interrupt poll */
+diff -urNp linux-2.6.32.12/drivers/ata/pata_it8213.c linux-2.6.32.12/drivers/ata/pata_it8213.c
+--- linux-2.6.32.12/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_it8213.c	2010-04-04 20:46:41.552552724 -0400
+@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
+ };
+ 
+ 
+-static struct ata_port_operations it8213_ops = {
++static const struct ata_port_operations it8213_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= it8213_cable_detect,
+ 	.set_piomode		= it8213_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_it821x.c linux-2.6.32.12/drivers/ata/pata_it821x.c
+--- linux-2.6.32.12/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_it821x.c	2010-04-04 20:46:41.552552724 -0400
+@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations it821x_smart_port_ops = {
++static const struct ata_port_operations it821x_smart_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_passthru_port_ops = {
++static const struct ata_port_operations it821x_passthru_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_rdc_port_ops = {
++static const struct ata_port_operations it821x_rdc_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c
+--- linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c	2010-04-04 20:46:41.552552724 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ixp4xx_port_ops = {
++static const struct ata_port_operations ixp4xx_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_jmicron.c linux-2.6.32.12/drivers/ata/pata_jmicron.c
+--- linux-2.6.32.12/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_jmicron.c	2010-04-04 20:46:41.552552724 -0400
+@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations jmicron_ops = {
++static const struct ata_port_operations jmicron_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= jmicron_pre_reset,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_legacy.c linux-2.6.32.12/drivers/ata/pata_legacy.c
+--- linux-2.6.32.12/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_legacy.c	2010-04-04 20:46:41.552552724 -0400
+@@ -106,7 +106,7 @@ struct legacy_probe {
+ 
+ struct legacy_controller {
+ 	const char *name;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned int pio_mask;
+ 	unsigned int flags;
+ 	unsigned int pflags;
+@@ -223,12 +223,12 @@ static const struct ata_port_operations 
+  *	pio_mask as well.
+  */
+ 
+-static struct ata_port_operations simple_port_ops = {
++static const struct ata_port_operations simple_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+ 
+-static struct ata_port_operations legacy_port_ops = {
++static const struct ata_port_operations legacy_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.set_mode	= legacy_set_mode,
+@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
+ 	return buflen;
+ }
+ 
+-static struct ata_port_operations pdc20230_port_ops = {
++static const struct ata_port_operations pdc20230_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= pdc20230_set_piomode,
+ 	.sff_data_xfer	= pdc_data_xfer_vlb,
+@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560a_port_ops = {
++static const struct ata_port_operations ht6560a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560a_set_piomode,
+ };
+@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560b_port_ops = {
++static const struct ata_port_operations ht6560b_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560b_set_piomode,
+ };
+@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
+ }
+ 
+ 
+-static struct ata_port_operations opti82c611a_port_ops = {
++static const struct ata_port_operations opti82c611a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c611a_set_piomode,
+ };
+@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
+ 	return ata_sff_qc_issue(qc);
+ }
+ 
+-static struct ata_port_operations opti82c46x_port_ops = {
++static const struct ata_port_operations opti82c46x_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c46x_set_piomode,
+ 	.qc_issue	= opti82c46x_qc_issue,
+@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6500_set_piomode,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580dp_port_ops = {
++static const struct ata_port_operations qdi6580dp_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580dp_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= winbond_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
+ 	int pio_modes = controller->pio_mask;
+ 	unsigned long io = probe->port;
+ 	u32 mask = (1 << probe->slot);
+-	struct ata_port_operations *ops = controller->ops;
++	const struct ata_port_operations *ops = controller->ops;
+ 	struct legacy_data *ld = &legacy_data[probe->slot];
+ 	struct ata_host *host = NULL;
+ 	struct ata_port *ap;
+diff -urNp linux-2.6.32.12/drivers/ata/pata_marvell.c linux-2.6.32.12/drivers/ata/pata_marvell.c
+--- linux-2.6.32.12/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_marvell.c	2010-04-04 20:46:41.552552724 -0400
+@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations marvell_ops = {
++static const struct ata_port_operations marvell_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= marvell_cable_detect,
+ 	.prereset		= marvell_pre_reset,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_mpc52xx.c linux-2.6.32.12/drivers/ata/pata_mpc52xx.c
+--- linux-2.6.32.12/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_mpc52xx.c	2010-04-04 20:46:41.552552724 -0400
+@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpc52xx_ata_port_ops = {
++static const struct ata_port_operations mpc52xx_ata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_dev_select		= mpc52xx_ata_dev_select,
+ 	.set_piomode		= mpc52xx_ata_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_mpiix.c linux-2.6.32.12/drivers/ata/pata_mpiix.c
+--- linux-2.6.32.12/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_mpiix.c	2010-04-04 20:46:41.552552724 -0400
+@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpiix_port_ops = {
++static const struct ata_port_operations mpiix_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= mpiix_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_netcell.c linux-2.6.32.12/drivers/ata/pata_netcell.c
+--- linux-2.6.32.12/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_netcell.c	2010-04-04 20:46:41.552552724 -0400
+@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations netcell_ops = {
++static const struct ata_port_operations netcell_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_80wire,
+ 	.read_id	= netcell_read_id,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_ninja32.c linux-2.6.32.12/drivers/ata/pata_ninja32.c
+--- linux-2.6.32.12/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_ninja32.c	2010-04-04 20:46:41.552552724 -0400
+@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ninja32_port_ops = {
++static const struct ata_port_operations ninja32_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.sff_dev_select = ninja32_dev_select,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_ns87410.c linux-2.6.32.12/drivers/ata/pata_ns87410.c
+--- linux-2.6.32.12/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_ns87410.c	2010-04-04 20:46:41.552552724 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ns87410_port_ops = {
++static const struct ata_port_operations ns87410_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= ns87410_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_ns87415.c linux-2.6.32.12/drivers/ata/pata_ns87415.c
+--- linux-2.6.32.12/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_ns87415.c	2010-04-04 20:46:41.552552724 -0400
+@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
+ }
+ #endif		/* 87560 SuperIO Support */
+ 
+-static struct ata_port_operations ns87415_pata_ops = {
++static const struct ata_port_operations ns87415_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma	= ns87415_check_atapi_dma,
+@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
+ };
+ 
+ #if defined(CONFIG_SUPERIO)
+-static struct ata_port_operations ns87560_pata_ops = {
++static const struct ata_port_operations ns87560_pata_ops = {
+ 	.inherits		= &ns87415_pata_ops,
+ 	.sff_tf_read		= ns87560_tf_read,
+ 	.sff_check_status	= ns87560_check_status,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_octeon_cf.c linux-2.6.32.12/drivers/ata/pata_octeon_cf.c
+--- linux-2.6.32.12/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_octeon_cf.c	2010-04-04 20:46:41.552552724 -0400
+@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct ata_port_operations octeon_cf_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_oldpiix.c linux-2.6.32.12/drivers/ata/pata_oldpiix.c
+--- linux-2.6.32.12/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_oldpiix.c	2010-04-04 20:46:41.552552724 -0400
+@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations oldpiix_pata_ops = {
++static const struct ata_port_operations oldpiix_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= oldpiix_qc_issue,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_opti.c linux-2.6.32.12/drivers/ata/pata_opti.c
+--- linux-2.6.32.12/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_opti.c	2010-04-04 20:46:41.552552724 -0400
+@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations opti_port_ops = {
++static const struct ata_port_operations opti_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= opti_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_optidma.c linux-2.6.32.12/drivers/ata/pata_optidma.c
+--- linux-2.6.32.12/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_optidma.c	2010-04-04 20:46:41.552552724 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations optidma_port_ops = {
++static const struct ata_port_operations optidma_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= optidma_set_pio_mode,
+@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
+ 	.prereset	= optidma_pre_reset,
+ };
+ 
+-static struct ata_port_operations optiplus_port_ops = {
++static const struct ata_port_operations optiplus_port_ops = {
+ 	.inherits	= &optidma_port_ops,
+ 	.set_piomode	= optiplus_set_pio_mode,
+ 	.set_dmamode	= optiplus_set_dma_mode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_palmld.c linux-2.6.32.12/drivers/ata/pata_palmld.c
+--- linux-2.6.32.12/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_palmld.c	2010-04-04 20:46:41.552552724 -0400
+@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations palmld_port_ops = {
++static const struct ata_port_operations palmld_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_pcmcia.c linux-2.6.32.12/drivers/ata/pata_pcmcia.c
+--- linux-2.6.32.12/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_pcmcia.c	2010-04-04 20:46:41.552552724 -0400
+@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pcmcia_port_ops = {
++static const struct ata_port_operations pcmcia_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= pcmcia_set_mode,
+ };
+ 
+-static struct ata_port_operations pcmcia_8bit_port_ops = {
++static const struct ata_port_operations pcmcia_8bit_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_data_xfer_8bit,
+ 	.cable_detect	= ata_cable_40wire,
+@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
+ 	unsigned long io_base, ctl_base;
+ 	void __iomem *io_addr, *ctl_addr;
+ 	int n_ports = 1;
+-	struct ata_port_operations *ops = &pcmcia_port_ops;
++	const struct ata_port_operations *ops = &pcmcia_port_ops;
+ 
+ 	info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 	if (info == NULL)
+diff -urNp linux-2.6.32.12/drivers/ata/pata_pdc2027x.c linux-2.6.32.12/drivers/ata/pata_pdc2027x.c
+--- linux-2.6.32.12/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_pdc2027x.c	2010-04-04 20:46:41.552552724 -0400
+@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata100_ops = {
++static const struct ata_port_operations pdc2027x_pata100_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
+ 	.cable_detect		= pdc2027x_cable_detect,
+ 	.prereset		= pdc2027x_prereset,
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata133_ops = {
++static const struct ata_port_operations pdc2027x_pata133_ops = {
+ 	.inherits		= &pdc2027x_pata100_ops,
+ 	.mode_filter		= pdc2027x_mode_filter,
+ 	.set_piomode		= pdc2027x_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c
+--- linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c	2010-04-04 20:46:41.552552724 -0400
+@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2024x_port_ops = {
++static const struct ata_port_operations pdc2024x_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.cable_detect		= ata_cable_40wire,
+@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
+ 	.set_dmamode		= pdc202xx_set_dmamode,
+ };
+ 
+-static struct ata_port_operations pdc2026x_port_ops = {
++static const struct ata_port_operations pdc2026x_port_ops = {
+ 	.inherits		= &pdc2024x_port_ops,
+ 
+ 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_platform.c linux-2.6.32.12/drivers/ata/pata_platform.c
+--- linux-2.6.32.12/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_platform.c	2010-04-04 20:46:41.552552724 -0400
+@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_platform_port_ops = {
++static const struct ata_port_operations pata_platform_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_qdi.c linux-2.6.32.12/drivers/ata/pata_qdi.c
+--- linux-2.6.32.12/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_qdi.c	2010-04-04 20:46:41.552552724 -0400
+@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= qdi_data_xfer,
+@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
+ 	.set_piomode	= qdi6500_set_piomode,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &qdi6500_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_radisys.c linux-2.6.32.12/drivers/ata/pata_radisys.c
+--- linux-2.6.32.12/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_radisys.c	2010-04-04 20:46:41.556857392 -0400
+@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations radisys_pata_ops = {
++static const struct ata_port_operations radisys_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= radisys_qc_issue,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_rb532_cf.c linux-2.6.32.12/drivers/ata/pata_rb532_cf.c
+--- linux-2.6.32.12/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_rb532_cf.c	2010-04-04 20:46:41.556857392 -0400
+@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
+ 	return IRQ_HANDLED;
+ }
+ 
+-static struct ata_port_operations rb532_pata_port_ops = {
++static const struct ata_port_operations rb532_pata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer32,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_rdc.c linux-2.6.32.12/drivers/ata/pata_rdc.c
+--- linux-2.6.32.12/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_rdc.c	2010-04-04 20:46:41.556857392 -0400
+@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
+ 	pci_write_config_byte(dev, 0x48, udma_enable);
+ }
+ 
+-static struct ata_port_operations rdc_pata_ops = {
++static const struct ata_port_operations rdc_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= rdc_pata_cable_detect,
+ 	.set_piomode		= rdc_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_rz1000.c linux-2.6.32.12/drivers/ata/pata_rz1000.c
+--- linux-2.6.32.12/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_rz1000.c	2010-04-04 20:46:41.556857392 -0400
+@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations rz1000_port_ops = {
++static const struct ata_port_operations rz1000_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= rz1000_set_mode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_sc1200.c linux-2.6.32.12/drivers/ata/pata_sc1200.c
+--- linux-2.6.32.12/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_sc1200.c	2010-04-04 20:46:41.556857392 -0400
+@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations sc1200_port_ops = {
++static const struct ata_port_operations sc1200_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+ 	.qc_issue	= sc1200_qc_issue,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_scc.c linux-2.6.32.12/drivers/ata/pata_scc.c
+--- linux-2.6.32.12/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_scc.c	2010-04-04 20:46:41.556857392 -0400
+@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations scc_pata_ops = {
++static const struct ata_port_operations scc_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.set_piomode		= scc_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_sch.c linux-2.6.32.12/drivers/ata/pata_sch.c
+--- linux-2.6.32.12/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_sch.c	2010-04-04 20:46:41.556857392 -0400
+@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sch_pata_ops = {
++static const struct ata_port_operations sch_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_unknown,
+ 	.set_piomode		= sch_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_serverworks.c linux-2.6.32.12/drivers/ata/pata_serverworks.c
+--- linux-2.6.32.12/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_serverworks.c	2010-04-04 20:46:41.556857392 -0400
+@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations serverworks_osb4_port_ops = {
++static const struct ata_port_operations serverworks_osb4_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= serverworks_cable_detect,
+ 	.mode_filter	= serverworks_osb4_filter,
+@@ -307,7 +307,7 @@ static struct ata_port_operations server
+ 	.set_dmamode	= serverworks_set_dmamode,
+ };
+ 
+-static struct ata_port_operations serverworks_csb_port_ops = {
++static const struct ata_port_operations serverworks_csb_port_ops = {
+ 	.inherits	= &serverworks_osb4_port_ops,
+ 	.mode_filter	= serverworks_csb_filter,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_sil680.c linux-2.6.32.12/drivers/ata/pata_sil680.c
+--- linux-2.6.32.12/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_sil680.c	2010-04-04 20:46:41.556857392 -0400
+@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sil680_port_ops = {
++static const struct ata_port_operations sil680_port_ops = {
+ 	.inherits	= &ata_bmdma32_port_ops,
+ 	.cable_detect	= sil680_cable_detect,
+ 	.set_piomode	= sil680_set_piomode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_sis.c linux-2.6.32.12/drivers/ata/pata_sis.c
+--- linux-2.6.32.12/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_sis.c	2010-04-04 20:46:41.556857392 -0400
+@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_133_for_sata_ops = {
++static const struct ata_port_operations sis_133_for_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_base_ops = {
++static const struct ata_port_operations sis_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= sis_pre_reset,
+ };
+ 
+-static struct ata_port_operations sis_133_ops = {
++static const struct ata_port_operations sis_133_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_133_early_ops = {
++static const struct ata_port_operations sis_133_early_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_133_early_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_100_ops = {
++static const struct ata_port_operations sis_100_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_100_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_66_ops = {
++static const struct ata_port_operations sis_66_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_66_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_old_ops = {
++static const struct ata_port_operations sis_old_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_old_set_dmamode,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_sl82c105.c linux-2.6.32.12/drivers/ata/pata_sl82c105.c
+--- linux-2.6.32.12/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_sl82c105.c	2010-04-04 20:46:41.556857392 -0400
+@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sl82c105_port_ops = {
++static const struct ata_port_operations sl82c105_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_defer	= sl82c105_qc_defer,
+ 	.bmdma_start 	= sl82c105_bmdma_start,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_triflex.c linux-2.6.32.12/drivers/ata/pata_triflex.c
+--- linux-2.6.32.12/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_triflex.c	2010-04-04 20:46:41.556857392 -0400
+@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations triflex_port_ops = {
++static const struct ata_port_operations triflex_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.bmdma_start 	= triflex_bmdma_start,
+ 	.bmdma_stop	= triflex_bmdma_stop,
+diff -urNp linux-2.6.32.12/drivers/ata/pata_via.c linux-2.6.32.12/drivers/ata/pata_via.c
+--- linux-2.6.32.12/drivers/ata/pata_via.c	2010-04-29 17:49:37.709698369 -0400
++++ linux-2.6.32.12/drivers/ata/pata_via.c	2010-04-29 17:49:58.093238510 -0400
+@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations via_port_ops = {
++static const struct ata_port_operations via_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= via_cable_detect,
+ 	.set_piomode	= via_set_piomode,
+@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
+ 	.port_start	= via_port_start,
+ };
+ 
+-static struct ata_port_operations via_port_ops_noirq = {
++static const struct ata_port_operations via_port_ops_noirq = {
+ 	.inherits	= &via_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+diff -urNp linux-2.6.32.12/drivers/ata/pata_winbond.c linux-2.6.32.12/drivers/ata/pata_winbond.c
+--- linux-2.6.32.12/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pata_winbond.c	2010-04-04 20:46:41.556857392 -0400
+@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= winbond_data_xfer,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.12/drivers/ata/pdc_adma.c linux-2.6.32.12/drivers/ata/pdc_adma.c
+--- linux-2.6.32.12/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/pdc_adma.c	2010-04-04 20:46:41.556857392 -0400
+@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
+ 	.dma_boundary		= ADMA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations adma_ata_ops = {
++static const struct ata_port_operations adma_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_fsl.c linux-2.6.32.12/drivers/ata/sata_fsl.c
+--- linux-2.6.32.12/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_fsl.c	2010-04-04 20:46:41.556857392 -0400
+@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
+ 	.dma_boundary = ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sata_fsl_ops = {
++static const struct ata_port_operations sata_fsl_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer = ata_std_qc_defer,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_inic162x.c linux-2.6.32.12/drivers/ata/sata_inic162x.c
+--- linux-2.6.32.12/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_inic162x.c	2010-04-04 20:46:41.556857392 -0400
+@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations inic_port_ops = {
++static const struct ata_port_operations inic_port_ops = {
+ 	.inherits		= &sata_port_ops,
+ 
+ 	.check_atapi_dma	= inic_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_mv.c linux-2.6.32.12/drivers/ata/sata_mv.c
+--- linux-2.6.32.12/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_mv.c	2010-04-04 20:46:41.556857392 -0400
+@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
+ 	.dma_boundary		= MV_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations mv5_ops = {
++static const struct ata_port_operations mv5_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
+ 	.port_stop		= mv_port_stop,
+ };
+ 
+-static struct ata_port_operations mv6_ops = {
++static const struct ata_port_operations mv6_ops = {
+ 	.inherits		= &mv5_ops,
+ 	.dev_config             = mv6_dev_config,
+ 	.scr_read		= mv_scr_read,
+@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
+ 	.bmdma_status		= mv_bmdma_status,
+ };
+ 
+-static struct ata_port_operations mv_iie_ops = {
++static const struct ata_port_operations mv_iie_ops = {
+ 	.inherits		= &mv6_ops,
+ 	.dev_config		= ATA_OP_NULL,
+ 	.qc_prep		= mv_qc_prep_iie,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_nv.c linux-2.6.32.12/drivers/ata/sata_nv.c
+--- linux-2.6.32.12/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_nv.c	2010-04-04 20:46:41.556857392 -0400
+@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
+  * cases.  Define nv_hardreset() which only kicks in for post-boot
+  * probing and use it for all variants.
+  */
+-static struct ata_port_operations nv_generic_ops = {
++static const struct ata_port_operations nv_generic_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.lost_interrupt		= ATA_OP_NULL,
+ 	.scr_read		= nv_scr_read,
+@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
+ 	.hardreset		= nv_hardreset,
+ };
+ 
+-static struct ata_port_operations nv_nf2_ops = {
++static const struct ata_port_operations nv_nf2_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_nf2_freeze,
+ 	.thaw			= nv_nf2_thaw,
+ };
+ 
+-static struct ata_port_operations nv_ck804_ops = {
++static const struct ata_port_operations nv_ck804_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_ck804_freeze,
+ 	.thaw			= nv_ck804_thaw,
+ 	.host_stop		= nv_ck804_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_adma_ops = {
++static const struct ata_port_operations nv_adma_ops = {
+ 	.inherits		= &nv_ck804_ops,
+ 
+ 	.check_atapi_dma	= nv_adma_check_atapi_dma,
+@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
+ 	.host_stop		= nv_adma_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_swncq_ops = {
++static const struct ata_port_operations nv_swncq_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 
+ 	.qc_defer		= ata_std_qc_defer,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_promise.c linux-2.6.32.12/drivers/ata/sata_promise.c
+--- linux-2.6.32.12/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_promise.c	2010-04-04 20:46:41.556857392 -0400
+@@ -195,7 +195,7 @@ static const struct ata_port_operations 
+ 	.error_handler		= pdc_error_handler,
+ };
+ 
+-static struct ata_port_operations pdc_sata_ops = {
++static const struct ata_port_operations pdc_sata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_sata_cable_detect,
+ 	.freeze			= pdc_sata_freeze,
+@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
+ 
+ /* First-generation chips need a more restrictive ->check_atapi_dma op,
+    and ->freeze/thaw that ignore the hotplug controls. */
+-static struct ata_port_operations pdc_old_sata_ops = {
++static const struct ata_port_operations pdc_old_sata_ops = {
+ 	.inherits		= &pdc_sata_ops,
+ 	.freeze			= pdc_freeze,
+ 	.thaw			= pdc_thaw,
+ 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
+ };
+ 
+-static struct ata_port_operations pdc_pata_ops = {
++static const struct ata_port_operations pdc_pata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_pata_cable_detect,
+ 	.freeze			= pdc_freeze,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_qstor.c linux-2.6.32.12/drivers/ata/sata_qstor.c
+--- linux-2.6.32.12/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_qstor.c	2010-04-04 20:46:41.556857392 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
+ 	.dma_boundary		= QS_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations qs_ata_ops = {
++static const struct ata_port_operations qs_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= qs_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_sil24.c linux-2.6.32.12/drivers/ata/sata_sil24.c
+--- linux-2.6.32.12/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_sil24.c	2010-04-04 20:46:41.556857392 -0400
+@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sil24_ops = {
++static const struct ata_port_operations sil24_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sil24_qc_defer,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_sil.c linux-2.6.32.12/drivers/ata/sata_sil.c
+--- linux-2.6.32.12/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_sil.c	2010-04-04 20:46:41.556857392 -0400
+@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
+ 	.sg_tablesize		= ATA_MAX_PRD
+ };
+ 
+-static struct ata_port_operations sil_ops = {
++static const struct ata_port_operations sil_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.dev_config		= sil_dev_config,
+ 	.set_mode		= sil_set_mode,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_sis.c linux-2.6.32.12/drivers/ata/sata_sis.c
+--- linux-2.6.32.12/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_sis.c	2010-04-04 20:46:41.561786507 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_ops = {
++static const struct ata_port_operations sis_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= sis_scr_read,
+ 	.scr_write		= sis_scr_write,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_svw.c linux-2.6.32.12/drivers/ata/sata_svw.c
+--- linux-2.6.32.12/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_svw.c	2010-04-04 20:46:41.561786507 -0400
+@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
+ };
+ 
+ 
+-static struct ata_port_operations k2_sata_ops = {
++static const struct ata_port_operations k2_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= k2_sata_tf_load,
+ 	.sff_tf_read		= k2_sata_tf_read,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_sx4.c linux-2.6.32.12/drivers/ata/sata_sx4.c
+--- linux-2.6.32.12/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_sx4.c	2010-04-04 20:46:41.561786507 -0400
+@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
+ };
+ 
+ /* TODO: inherit from base port_ops after converting to new EH */
+-static struct ata_port_operations pdc_20621_ops = {
++static const struct ata_port_operations pdc_20621_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= pdc_check_atapi_dma,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_uli.c linux-2.6.32.12/drivers/ata/sata_uli.c
+--- linux-2.6.32.12/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_uli.c	2010-04-04 20:46:41.561786507 -0400
+@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations uli_ops = {
++static const struct ata_port_operations uli_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= uli_scr_read,
+ 	.scr_write		= uli_scr_write,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_via.c linux-2.6.32.12/drivers/ata/sata_via.c
+--- linux-2.6.32.12/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_via.c	2010-04-04 20:46:41.561786507 -0400
+@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations svia_base_ops = {
++static const struct ata_port_operations svia_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= svia_tf_load,
+ };
+ 
+-static struct ata_port_operations vt6420_sata_ops = {
++static const struct ata_port_operations vt6420_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.freeze			= svia_noop_freeze,
+ 	.prereset		= vt6420_prereset,
+ };
+ 
+-static struct ata_port_operations vt6421_pata_ops = {
++static const struct ata_port_operations vt6421_pata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.cable_detect		= vt6421_pata_cable_detect,
+ 	.set_piomode		= vt6421_set_pio_mode,
+ 	.set_dmamode		= vt6421_set_dma_mode,
+ };
+ 
+-static struct ata_port_operations vt6421_sata_ops = {
++static const struct ata_port_operations vt6421_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.scr_read		= svia_scr_read,
+ 	.scr_write		= svia_scr_write,
+ };
+ 
+-static struct ata_port_operations vt8251_ops = {
++static const struct ata_port_operations vt8251_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= vt8251_scr_read,
+diff -urNp linux-2.6.32.12/drivers/ata/sata_vsc.c linux-2.6.32.12/drivers/ata/sata_vsc.c
+--- linux-2.6.32.12/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ata/sata_vsc.c	2010-04-04 20:46:41.561786507 -0400
+@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
+ };
+ 
+ 
+-static struct ata_port_operations vsc_sata_ops = {
++static const struct ata_port_operations vsc_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	/* The IRQ handling is not quite standard SFF behaviour so we
+ 	   cannot use the default lost interrupt handler */
+diff -urNp linux-2.6.32.12/drivers/atm/adummy.c linux-2.6.32.12/drivers/atm/adummy.c
+--- linux-2.6.32.12/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/adummy.c	2010-04-04 20:46:41.561786507 -0400
+@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
+ 		vcc->pop(vcc, skb);
+ 	else
+ 		dev_kfree_skb_any(skb);
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/drivers/atm/ambassador.c linux-2.6.32.12/drivers/atm/ambassador.c
+--- linux-2.6.32.12/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/ambassador.c	2010-04-04 20:46:41.561786507 -0400
+@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
+   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
+   
+   // VC layer stats
+-  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+   
+   // free the descriptor
+   kfree (tx_descr);
+@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
+ 	  dump_skb ("<<<", vc, skb);
+ 	  
+ 	  // VC layer stats
+-	  atomic_inc(&atm_vcc->stats->rx);
++	  atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  atm_vcc->push (atm_vcc, skb);
+@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
+       } else {
+       	PRINTK (KERN_INFO, "dropped over-size frame");
+ 	// should we count this?
+-	atomic_inc(&atm_vcc->stats->rx_drop);
++	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+       }
+       
+     } else {
+@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
+   }
+   
+   if (check_area (skb->data, skb->len)) {
+-    atomic_inc(&atm_vcc->stats->tx_err);
++    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
+     return -ENOMEM; // ?
+   }
+   
+diff -urNp linux-2.6.32.12/drivers/atm/atmtcp.c linux-2.6.32.12/drivers/atm/atmtcp.c
+--- linux-2.6.32.12/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/atmtcp.c	2010-04-04 20:46:41.561786507 -0400
+@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+ 		if (dev_data) return 0;
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOLINK;
+ 	}
+ 	size = skb->len+sizeof(struct atmtcp_hdr);
+@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (!new_skb) {
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOBUFS;
+ 	}
+ 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
+@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ 	return 0;
+ }
+ 
+@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
+ 	read_unlock(&vcc_sklist_lock);
+ 	if (!out_vcc) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		goto done;
+ 	}
+ 	skb_pull(skb,sizeof(struct atmtcp_hdr));
+@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	__net_timestamp(new_skb);
+ 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ done:
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+diff -urNp linux-2.6.32.12/drivers/atm/eni.c linux-2.6.32.12/drivers/atm/eni.c
+--- linux-2.6.32.12/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/eni.c	2010-04-04 20:46:41.561786507 -0400
+@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
+ 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
+ 		    vcc->dev->number);
+ 		length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		length = ATM_CELL_SIZE-1; /* no HEC */
+@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    size);
+ 		}
+ 		eff = length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
+@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
+ 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
+ 			length = eff = 0;
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		}
+ 	}
+ 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
+@@ -770,7 +770,7 @@ rx_dequeued++;
+ 			vcc->push(vcc,skb);
+ 			pushed++;
+ 		}
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	wake_up(&eni_dev->rx_wait);
+ }
+@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
+ 		    PCI_DMA_TODEVICE);
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb_irq(skb);
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 		wake_up(&eni_dev->tx_wait);
+ dma_complete++;
+ 	}
+diff -urNp linux-2.6.32.12/drivers/atm/firestream.c linux-2.6.32.12/drivers/atm/firestream.c
+--- linux-2.6.32.12/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/firestream.c	2010-04-04 20:46:41.561786507 -0400
+@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
+ 				}
+ 			}
+ 
+-			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 
+ 			fs_dprintk (FS_DEBUG_TXMEM, "i");
+ 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
+@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
+ #endif
+ 				skb_put (skb, qe->p1 & 0xffff); 
+ 				ATM_SKB(skb)->vcc = atm_vcc;
+-				atomic_inc(&atm_vcc->stats->rx);
++				atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 				__net_timestamp(skb);
+ 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
+ 				atm_vcc->push (atm_vcc, skb);
+@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
+ 				kfree (pe);
+ 			}
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		case 0x1f: /*  Reassembly abort: no buffers. */
+ 			/* Silently increment error counter. */
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
+ 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
+diff -urNp linux-2.6.32.12/drivers/atm/fore200e.c linux-2.6.32.12/drivers/atm/fore200e.c
+--- linux-2.6.32.12/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/fore200e.c	2010-04-04 20:46:41.561786507 -0400
+@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
+ #endif
+ 		/* check error condition */
+ 		if (*entry->status & STATUS_ERROR)
+-		    atomic_inc(&vcc->stats->tx_err);
++		    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		else
+-		    atomic_inc(&vcc->stats->tx);
++		    atomic_inc_unchecked(&vcc->stats->tx);
+ 	    }
+ 	}
+ 
+@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
+     if (skb == NULL) {
+ 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     } 
+ 
+@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
+ 
+ 	dev_kfree_skb_any(skb);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     }
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+     vcc->push(vcc, skb);
+-    atomic_inc(&vcc->stats->rx);
++    atomic_inc_unchecked(&vcc->stats->rx);
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
+ 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
+ 			fore200e->atm_dev->number,
+ 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	    }
+ 	}
+ 
+@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
+ 		goto retry_here;
+ 	    }
+ 
+-	    atomic_inc(&vcc->stats->tx_err);
++	    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 
+ 	    fore200e->tx_sat++;
+ 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
+diff -urNp linux-2.6.32.12/drivers/atm/he.c linux-2.6.32.12/drivers/atm/he.c
+--- linux-2.6.32.12/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/he.c	2010-04-04 20:46:41.565779517 -0400
+@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 
+ 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
+ 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
+-				atomic_inc(&vcc->stats->rx_drop);
++				atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 				RBRQ_LEN_ERR(he_dev->rbrq_head)
+ 							? "LEN_ERR" : "",
+ 							vcc->vpi, vcc->vci);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 		vcc->push(vcc, skb);
+ 		spin_lock(&he_dev->global_lock);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ return_host_buffers:
+ 		++pdus_assembled;
+@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
+ 					tpd->vcc->pop(tpd->vcc, tpd->skb);
+ 				else
+ 					dev_kfree_skb_any(tpd->skb);
+-				atomic_inc(&tpd->vcc->stats->tx_err);
++				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
+ 			}
+ 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
+ 			return;
+@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ #endif
+@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 		return -ENOMEM;
+ 	}
+@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 					vcc->pop(vcc, skb);
+ 				else
+ 					dev_kfree_skb_any(skb);
+-				atomic_inc(&vcc->stats->tx_err);
++				atomic_inc_unchecked(&vcc->stats->tx_err);
+ 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 				return -ENOMEM;
+ 			}
+@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 	__enqueue_tpd(he_dev, tpd, cid);
+ 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/drivers/atm/horizon.c linux-2.6.32.12/drivers/atm/horizon.c
+--- linux-2.6.32.12/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/horizon.c	2010-04-04 20:46:41.565779517 -0400
+@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
+ 	{
+ 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
+ 	  // VC layer stats
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  vcc->push (vcc, skb);
+@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
+ 	dev->tx_iovec = NULL;
+ 	
+ 	// VC layer stats
+-	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 	
+ 	// free the skb
+ 	hrz_kfree_skb (skb);
+diff -urNp linux-2.6.32.12/drivers/atm/idt77252.c linux-2.6.32.12/drivers/atm/idt77252.c
+--- linux-2.6.32.12/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/idt77252.c	2010-04-04 20:46:41.565779517 -0400
+@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
+ 		else
+ 			dev_kfree_skb(skb);
+ 
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 	}
+ 
+ 	atomic_dec(&scq->used);
+@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			if ((sb = dev_alloc_skb(64)) == NULL) {
+ 				printk("%s: Can't allocate buffers for aal0.\n",
+ 				       card->name);
+-				atomic_add(i, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i, &vcc->stats->rx_drop);
+ 				break;
+ 			}
+ 			if (!atm_charge(vcc, sb->truesize)) {
+ 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
+ 					 card->name);
+-				atomic_add(i - 1, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
+ 				dev_kfree_skb(sb);
+ 				break;
+ 			}
+@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			ATM_SKB(sb)->vcc = vcc;
+ 			__net_timestamp(sb);
+ 			vcc->push(vcc, sb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			cell += ATM_CELL_PAYLOAD;
+ 		}
+@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			         "(CDC: %08x)\n",
+ 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (stat & SAR_RSQE_CRC) {
+ 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (skb_queue_len(&rpp->queue) > 1) {
+@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 				RXPRINTK("%s: Can't alloc RX skb.\n",
+ 					 card->name);
+ 				recycle_rx_pool_skb(card, rpp);
+-				atomic_inc(&vcc->stats->rx_err);
++				atomic_inc_unchecked(&vcc->stats->rx_err);
+ 				return;
+ 			}
+ 			if (!atm_charge(vcc, skb->truesize)) {
+@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			__net_timestamp(skb);
+ 
+ 			vcc->push(vcc, skb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			return;
+ 		}
+@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 		__net_timestamp(skb);
+ 
+ 		vcc->push(vcc, skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 		if (skb->truesize > SAR_FB_SIZE_3)
+ 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
+@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		if (vcc->qos.aal != ATM_AAL0) {
+ 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
+ 				card->name, vpi, vci);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto drop;
+ 		}
+ 	
+ 		if ((sb = dev_alloc_skb(64)) == NULL) {
+ 			printk("%s: Can't allocate buffers for AAL0.\n",
+ 			       card->name);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto drop;
+ 		}
+ 
+@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		ATM_SKB(sb)->vcc = vcc;
+ 		__net_timestamp(sb);
+ 		vcc->push(vcc, sb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ drop:
+ 		skb_pull(queue, 64);
+@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	if (vc == NULL) {
+ 		printk("%s: NULL connection in send().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 	if (!test_bit(VCF_TX, &vc->flags)) {
+ 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 		break;
+ 	default:
+ 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (skb_shinfo(skb)->nr_frags != 0) {
+ 		printk("%s: No scatter-gather yet.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	err = queue_skb(card, vc, skb, oam);
+ 	if (err) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return err;
+ 	}
+@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
+ 	skb = dev_alloc_skb(64);
+ 	if (!skb) {
+ 		printk("%s: Out of memory in send_oam().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOMEM;
+ 	}
+ 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+diff -urNp linux-2.6.32.12/drivers/atm/iphase.c linux-2.6.32.12/drivers/atm/iphase.c
+--- linux-2.6.32.12/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/iphase.c	2010-04-04 20:46:41.565779517 -0400
+@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	status = (u_short) (buf_desc_ptr->desc_mode);  
+ 	if (status & (RX_CER | RX_PTE | RX_OFL))  
+ 	{  
+-                atomic_inc(&vcc->stats->rx_err);
++                atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		IF_ERR(printk("IA: bad packet, dropping it");)  
+                 if (status & RX_CER) { 
+                     IF_ERR(printk(" cause: packet CRC error\n");)
+@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	len = dma_addr - buf_addr;  
+         if (len > iadev->rx_buf_sz) {
+            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
+-           atomic_inc(&vcc->stats->rx_err);
++           atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	   goto out_free_desc;
+         }
+ 		  
+@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
+           ia_vcc = INPH_IA_VCC(vcc);
+           if (ia_vcc == NULL)
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              dev_kfree_skb_any(skb);
+              atm_return(vcc, atm_guess_pdu2truesize(len));
+              goto INCR_DLE;
+@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
+           if ((length > iadev->rx_buf_sz) || (length > 
+                               (skb->len - sizeof(struct cpcs_trailer))))
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
+                                                             length, skb->len);)
+              dev_kfree_skb_any(skb);
+@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
+ 
+ 	  IF_RX(printk("rx_dle_intr: skb push");)  
+ 	  vcc->push(vcc,skb);  
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+           iadev->rx_pkt_cnt++;
+       }  
+ INCR_DLE:
+@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
+          {
+              struct k_sonet_stats *stats;
+              stats = &PRIV(_ia_dev[board])->sonet_stats;
+-             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
+-             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
+-             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
+-             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
+-             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
+-             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
+-             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
+-             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
+-             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
++             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
++             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
++             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
++             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
++             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
++             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
++             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
++             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
++             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
+          }
+             ia_cmds.status = 0;
+             break;
+@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
+ 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
+ 	{  
+ 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
+-                atomic_inc(&vcc->stats->tx);
++                atomic_inc_unchecked(&vcc->stats->tx);
+ 		if (vcc->pop)   
+ 		    vcc->pop(vcc, skb);   
+ 		else  
+@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
+         ATM_DESC(skb) = vcc->vci;
+         skb_queue_tail(&iadev->tx_dma_q, skb);
+ 
+-        atomic_inc(&vcc->stats->tx);
++        atomic_inc_unchecked(&vcc->stats->tx);
+         iadev->tx_pkt_cnt++;
+ 	/* Increment transaction counter */  
+ 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
+         
+ #if 0        
+         /* add flow control logic */ 
+-        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
++        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
+           if (iavcc->vc_desc_cnt > 10) {
+              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
+             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
+diff -urNp linux-2.6.32.12/drivers/atm/lanai.c linux-2.6.32.12/drivers/atm/lanai.c
+--- linux-2.6.32.12/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/lanai.c	2010-04-04 20:46:41.565779517 -0400
+@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
+ 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
+ 	lanai_endtx(lanai, lvcc);
+ 	lanai_free_skb(lvcc->tx.atmvcc, skb);
+-	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
++	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
+ }
+ 
+ /* Try to fill the buffer - don't call unless there is backlog */
+@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
+ 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
+ 	__net_timestamp(skb);
+ 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
+     out:
+ 	lvcc->rx.buf.ptr = end;
+ 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
+@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
+ 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
+ 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
+ 		lanai->stats.service_rxnotaal5++;
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		return 0;
+ 	}
+ 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
+@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
+ 		int bytes;
+ 		read_unlock(&vcc_sklist_lock);
+ 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_trash++;
+ 		bytes = (SERVICE_GET_END(s) * 16) -
+ 		    (((unsigned long) lvcc->rx.buf.ptr) -
+@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
+ 	}
+ 	if (s & SERVICE_STREAM) {
+ 		read_unlock(&vcc_sklist_lock);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_stream++;
+ 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
+ 		    "PDU on VCI %d!\n", lanai->number, vci);
+@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
+ 		return 0;
+ 	}
+ 	DPRINTK("got rx crc error on vci %d\n", vci);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 	lvcc->stats.x.aal5.service_rxcrc++;
+ 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
+ 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
+diff -urNp linux-2.6.32.12/drivers/atm/nicstar.c linux-2.6.32.12/drivers/atm/nicstar.c
+--- linux-2.6.32.12/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/nicstar.c	2010-04-04 20:46:41.565779517 -0400
+@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if ((vc = (vc_map *) vcc->dev_data) == NULL)
+    {
+       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (!vc->tx)
+    {
+       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
+    {
+       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (skb_shinfo(skb)->nr_frags != 0)
+    {
+       printk("nicstar%d: No scatter-gather yet.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
+ 
+    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
+    {
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EIO;
+    }
+-   atomic_inc(&vcc->stats->tx);
++   atomic_inc_unchecked(&vcc->stats->tx);
+ 
+    return 0;
+ }
+@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
+          {
+             printk("nicstar%d: Can't allocate buffers for aal0.\n",
+                    card->index);
+-            atomic_add(i,&vcc->stats->rx_drop);
++            atomic_add_unchecked(i,&vcc->stats->rx_drop);
+             break;
+          }
+          if (!atm_charge(vcc, sb->truesize))
+          {
+             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
+                      card->index);
+-            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
++            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
+             dev_kfree_skb_any(sb);
+             break;
+          }
+@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          ATM_SKB(sb)->vcc = vcc;
+ 	 __net_timestamp(sb);
+          vcc->push(vcc, sb);
+-         atomic_inc(&vcc->stats->rx);
++         atomic_inc_unchecked(&vcc->stats->rx);
+          cell += ATM_CELL_PAYLOAD;
+       }
+ 
+@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ 	 if (iovb == NULL)
+ 	 {
+ 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+             recycle_rx_buf(card, skb);
+             return;
+ 	 }
+@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
+    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
+    {
+       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
+-      atomic_inc(&vcc->stats->rx_err);
++      atomic_inc_unchecked(&vcc->stats->rx_err);
+       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
+       NS_SKB(iovb)->iovcnt = 0;
+       iovb->len = 0;
+@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_rx_buf(card, skb);
+          vc->rx_iov = NULL;
+          recycle_iov_buf(card, iovb);
+@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                       NS_SKB(iovb)->iovcnt);
+          vc->rx_iov = NULL;
+@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             printk(" - PDU size mismatch.\n");
+          else
+             printk(".\n");
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	   NS_SKB(iovb)->iovcnt);
+ 	 vc->rx_iov = NULL;
+@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          if (!atm_charge(vcc, skb->truesize))
+          {
+             push_rxbufs(card, skb);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             ATM_SKB(skb)->vcc = vcc;
+ 	    __net_timestamp(skb);
+             vcc->push(vcc, skb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
+@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, sb->truesize))
+             {
+                push_rxbufs(card, sb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+ 	    {
+@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(sb)->vcc = vcc;
+ 	       __net_timestamp(sb);
+                vcc->push(vcc, sb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, skb);
+@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, skb->truesize))
+             {
+                push_rxbufs(card, skb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+             {
+@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(skb)->vcc = vcc;
+ 	       __net_timestamp(skb);
+                vcc->push(vcc, skb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, sb);
+@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (hb == NULL)
+             {
+                printk("nicstar%d: Out of huge buffers.\n", card->index);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                             NS_SKB(iovb)->iovcnt);
+                vc->rx_iov = NULL;
+@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             }
+ 	    else
+ 	       dev_kfree_skb_any(hb);
+-	    atomic_inc(&vcc->stats->rx_drop);
++	    atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ #endif /* NS_USE_DESTRUCTORS */
+ 	    __net_timestamp(hb);
+             vcc->push(vcc, hb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+ 
+diff -urNp linux-2.6.32.12/drivers/atm/solos-pci.c linux-2.6.32.12/drivers/atm/solos-pci.c
+--- linux-2.6.32.12/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/solos-pci.c	2010-04-04 20:46:41.565779517 -0400
+@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
+ 				}
+ 				atm_charge(vcc, skb->truesize);
+ 				vcc->push(vcc, skb);
+-				atomic_inc(&vcc->stats->rx);
++				atomic_inc_unchecked(&vcc->stats->rx);
+ 				break;
+ 
+ 			case PKT_STATUS:
+@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
+ 			vcc = SKB_CB(oldskb)->vcc;
+ 
+ 			if (vcc) {
+-				atomic_inc(&vcc->stats->tx);
++				atomic_inc_unchecked(&vcc->stats->tx);
+ 				solos_pop(vcc, oldskb);
+ 			} else
+ 				dev_kfree_skb_irq(oldskb);
+diff -urNp linux-2.6.32.12/drivers/atm/suni.c linux-2.6.32.12/drivers/atm/suni.c
+--- linux-2.6.32.12/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/suni.c	2010-04-04 20:46:41.565779517 -0400
+@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    atomic_add((v),&stats->s); \
+-    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
++    atomic_add_unchecked((v),&stats->s); \
++    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
+ 
+ 
+ static void suni_hz(unsigned long from_timer)
+diff -urNp linux-2.6.32.12/drivers/atm/uPD98402.c linux-2.6.32.12/drivers/atm/uPD98402.c
+--- linux-2.6.32.12/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/uPD98402.c	2010-04-04 20:46:41.565779517 -0400
+@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
+ 	struct sonet_stats tmp;
+  	int error = 0;
+ 
+-	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
++	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
+ 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
+ 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
+ 	if (zero && !error) {
+@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
+-    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
+-	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
++    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
++    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
+ 
+ 
+ static void stat_event(struct atm_dev *dev)
+@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
+ 		if (reason & uPD98402_INT_PFM) stat_event(dev);
+ 		if (reason & uPD98402_INT_PCO) {
+ 			(void) GET(PCOCR); /* clear interrupt cause */
+-			atomic_add(GET(HECCT),
++			atomic_add_unchecked(GET(HECCT),
+ 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
+ 		}
+ 		if ((reason & uPD98402_INT_RFO) && 
+@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
+ 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
+ 	  uPD98402_INT_LOS),PIMR); /* enable them */
+ 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
+-	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.12/drivers/atm/zatm.c linux-2.6.32.12/drivers/atm/zatm.c
+--- linux-2.6.32.12/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/atm/zatm.c	2010-04-04 20:46:41.569782507 -0400
+@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		}
+ 		if (!size) {
+ 			dev_kfree_skb_irq(skb);
+-			if (vcc) atomic_inc(&vcc->stats->rx_err);
++			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			continue;
+ 		}
+ 		if (!atm_charge(vcc,skb->truesize)) {
+@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		skb->len = size;
+ 		ATM_SKB(skb)->vcc = vcc;
+ 		vcc->push(vcc,skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	zout(pos & 0xffff,MTA(mbx));
+ #if 0 /* probably a stupid idea */
+@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
+ 			skb_queue_head(&zatm_vcc->backlog,skb);
+ 			break;
+ 		}
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 	wake_up(&zatm_vcc->tx_wait);
+ }
+ 
+diff -urNp linux-2.6.32.12/drivers/base/bus.c linux-2.6.32.12/drivers/base/bus.c
+--- linux-2.6.32.12/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/base/bus.c	2010-04-04 20:46:41.569782507 -0400
+@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops driver_sysfs_ops = {
++static const struct sysfs_ops driver_sysfs_ops = {
+ 	.show	= drv_attr_show,
+ 	.store	= drv_attr_store,
+ };
+@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops bus_sysfs_ops = {
++static const struct sysfs_ops bus_sysfs_ops = {
+ 	.show	= bus_attr_show,
+ 	.store	= bus_attr_store,
+ };
+@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops bus_uevent_ops = {
++static const struct kset_uevent_ops bus_uevent_ops = {
+ 	.filter = bus_uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/base/class.c linux-2.6.32.12/drivers/base/class.c
+--- linux-2.6.32.12/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/base/class.c	2010-04-04 20:46:41.569782507 -0400
+@@ -63,7 +63,7 @@ static void class_release(struct kobject
+ 	kfree(cp);
+ }
+ 
+-static struct sysfs_ops class_sysfs_ops = {
++static const struct sysfs_ops class_sysfs_ops = {
+ 	.show	= class_attr_show,
+ 	.store	= class_attr_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/base/core.c linux-2.6.32.12/drivers/base/core.c
+--- linux-2.6.32.12/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/base/core.c	2010-04-04 20:46:41.569782507 -0400
+@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops dev_sysfs_ops = {
++static const struct sysfs_ops dev_sysfs_ops = {
+ 	.show	= dev_attr_show,
+ 	.store	= dev_attr_store,
+ };
+@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops device_uevent_ops = {
++static const struct kset_uevent_ops device_uevent_ops = {
+ 	.filter =	dev_uevent_filter,
+ 	.name =		dev_uevent_name,
+ 	.uevent =	dev_uevent,
+diff -urNp linux-2.6.32.12/drivers/base/memory.c linux-2.6.32.12/drivers/base/memory.c
+--- linux-2.6.32.12/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/base/memory.c	2010-04-04 20:46:41.569782507 -0400
+@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops memory_uevent_ops = {
++static const struct kset_uevent_ops memory_uevent_ops = {
+ 	.name		= memory_uevent_name,
+ 	.uevent		= memory_uevent,
+ };
+diff -urNp linux-2.6.32.12/drivers/base/sys.c linux-2.6.32.12/drivers/base/sys.c
+--- linux-2.6.32.12/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/base/sys.c	2010-04-04 20:46:41.569782507 -0400
+@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= sysdev_show,
+ 	.store	= sysdev_store,
+ };
+@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_class_ops = {
++static const struct sysfs_ops sysfs_class_ops = {
+ 	.show	= sysdev_class_show,
+ 	.store	= sysdev_class_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/block/pktcdvd.c linux-2.6.32.12/drivers/block/pktcdvd.c
+--- linux-2.6.32.12/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/block/pktcdvd.c	2010-04-04 20:46:41.569782507 -0400
+@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
+ 	return len;
+ }
+ 
+-static struct sysfs_ops kobj_pkt_ops = {
++static const struct sysfs_ops kobj_pkt_ops = {
+ 	.show = kobj_pkt_show,
+ 	.store = kobj_pkt_store
+ };
+diff -urNp linux-2.6.32.12/drivers/char/agp/frontend.c linux-2.6.32.12/drivers/char/agp/frontend.c
+--- linux-2.6.32.12/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/agp/frontend.c	2010-04-04 20:46:41.569782507 -0400
+@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
+ 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
+ 		return -EFAULT;
+ 
+-	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
++	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
+ 		return -EFAULT;
+ 
+ 	client = agp_find_client_by_pid(reserve.pid);
+diff -urNp linux-2.6.32.12/drivers/char/agp/intel-agp.c linux-2.6.32.12/drivers/char/agp/intel-agp.c
+--- linux-2.6.32.12/drivers/char/agp/intel-agp.c	2010-04-29 17:49:37.777981896 -0400
++++ linux-2.6.32.12/drivers/char/agp/intel-agp.c	2010-04-29 17:49:58.121109354 -0400
+@@ -2564,7 +2564,7 @@ static struct pci_device_id agp_intel_pc
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
+diff -urNp linux-2.6.32.12/drivers/char/hpet.c linux-2.6.32.12/drivers/char/hpet.c
+--- linux-2.6.32.12/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hpet.c	2010-04-29 17:46:36.909235393 -0400
+@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
+ 	return 0;
+ }
+ 
+-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
++static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
+ 
+ static int
+ hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+@@ -550,7 +550,7 @@ static inline unsigned long hpet_time_di
+ }
+ 
+ static int
+-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
++hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
+ {
+ 	struct hpet_timer __iomem *timer;
+ 	struct hpet __iomem *hpet;
+@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
+ 		},
+ };
+ 
+-static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
++static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
+ 
+ static int __init hpet_init(void)
+ {
+diff -urNp linux-2.6.32.12/drivers/char/hvc_beat.c linux-2.6.32.12/drivers/char/hvc_beat.c
+--- linux-2.6.32.12/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_beat.c	2010-04-04 20:46:41.569782507 -0400
+@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
+ 	return cnt;
+ }
+ 
+-static struct hv_ops hvc_beat_get_put_ops = {
++static const struct hv_ops hvc_beat_get_put_ops = {
+ 	.get_chars = hvc_beat_get_chars,
+ 	.put_chars = hvc_beat_put_chars,
+ };
+diff -urNp linux-2.6.32.12/drivers/char/hvc_console.c linux-2.6.32.12/drivers/char/hvc_console.c
+--- linux-2.6.32.12/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_console.c	2010-04-04 20:46:41.569782507 -0400
+@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
+  * console interfaces but can still be used as a tty device.  This has to be
+  * static because kmalloc will not work during early console init.
+  */
+-static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
++static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
+ static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
+ 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
+ 
+@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
+  * vty adapters do NOT get an hvc_instantiate() callback since they
+  * appear after early console init.
+  */
+-int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
++int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
+ {
+ 	struct hvc_struct *hp;
+ 
+@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
+ };
+ 
+ struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
+-					struct hv_ops *ops, int outbuf_size)
++					const struct hv_ops *ops, int outbuf_size)
+ {
+ 	struct hvc_struct *hp;
+ 	int i;
+diff -urNp linux-2.6.32.12/drivers/char/hvc_console.h linux-2.6.32.12/drivers/char/hvc_console.h
+--- linux-2.6.32.12/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_console.h	2010-04-04 20:46:41.569782507 -0400
+@@ -55,7 +55,7 @@ struct hvc_struct {
+ 	int outbuf_size;
+ 	int n_outbuf;
+ 	uint32_t vtermno;
+-	struct hv_ops *ops;
++	const struct hv_ops *ops;
+ 	int irq_requested;
+ 	int data;
+ 	struct winsize ws;
+@@ -76,11 +76,11 @@ struct hv_ops {
+ };
+ 
+ /* Register a vterm and a slot index for use as a console (console_init) */
+-extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
++extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
+ 
+ /* register a vterm for hvc tty operation (module_init or hotplug add) */
+ extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
+-				struct hv_ops *ops, int outbuf_size);
++				const struct hv_ops *ops, int outbuf_size);
+ /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
+ extern int hvc_remove(struct hvc_struct *hp);
+ 
+diff -urNp linux-2.6.32.12/drivers/char/hvc_iseries.c linux-2.6.32.12/drivers/char/hvc_iseries.c
+--- linux-2.6.32.12/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_iseries.c	2010-04-04 20:46:41.569782507 -0400
+@@ -197,7 +197,7 @@ done:
+ 	return sent;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = get_chars,
+ 	.put_chars = put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.12/drivers/char/hvc_iucv.c linux-2.6.32.12/drivers/char/hvc_iucv.c
+--- linux-2.6.32.12/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_iucv.c	2010-04-04 20:46:41.569782507 -0400
+@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
+ 
+ 
+ /* HVC operations */
+-static struct hv_ops hvc_iucv_ops = {
++static const struct hv_ops hvc_iucv_ops = {
+ 	.get_chars = hvc_iucv_get_chars,
+ 	.put_chars = hvc_iucv_put_chars,
+ 	.notifier_add = hvc_iucv_notifier_add,
+diff -urNp linux-2.6.32.12/drivers/char/hvc_rtas.c linux-2.6.32.12/drivers/char/hvc_rtas.c
+--- linux-2.6.32.12/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_rtas.c	2010-04-04 20:46:41.569782507 -0400
+@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_rtas_get_put_ops = {
++static const struct hv_ops hvc_rtas_get_put_ops = {
+ 	.get_chars = hvc_rtas_read_console,
+ 	.put_chars = hvc_rtas_write_console,
+ };
+diff -urNp linux-2.6.32.12/drivers/char/hvcs.c linux-2.6.32.12/drivers/char/hvcs.c
+--- linux-2.6.32.12/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvcs.c	2010-04-04 20:46:41.573523483 -0400
+@@ -269,7 +269,7 @@ struct hvcs_struct {
+ 	unsigned int index;
+ 
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 
+ 	/*
+ 	 * Used to tell the driver kernel_thread what operations need to take
+@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 
+-	if (hvcsd->open_count > 0) {
++	if (atomic_read(&hvcsd->open_count) > 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
+ 				"The hvcs device node is still in use.\n");
+@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
+ 		if ((retval = hvcs_partner_connect(hvcsd)))
+ 			goto error_release;
+ 
+-	hvcsd->open_count = 1;
++	atomic_set(&hvcsd->open_count, 1);
+ 	hvcsd->tty = tty;
+ 	tty->driver_data = hvcsd;
+ 
+@@ -1169,7 +1169,7 @@ fast_open:
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	kref_get(&hvcsd->kref);
+-	hvcsd->open_count++;
++	atomic_inc(&hvcsd->open_count);
+ 	hvcsd->todo_mask |= HVCS_SCHED_READ;
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 
+@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
+ 	hvcsd = tty->driver_data;
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+-	if (--hvcsd->open_count == 0) {
++	if (atomic_dec_and_test(&hvcsd->open_count)) {
+ 
+ 		vio_disable_interrupts(hvcsd->vdev);
+ 
+@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
+ 		free_irq(irq, hvcsd);
+ 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
+ 		return;
+-	} else if (hvcsd->open_count < 0) {
++	} else if (atomic_read(&hvcsd->open_count) < 0) {
+ 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
+ 				" is missmanaged.\n",
+-		hvcsd->vdev->unit_address, hvcsd->open_count);
++		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
+ 	}
+ 
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	/* Preserve this so that we know how many kref refs to put */
+-	temp_open_count = hvcsd->open_count;
++	temp_open_count = atomic_read(&hvcsd->open_count);
+ 
+ 	/*
+ 	 * Don't kref put inside the spinlock because the destruction
+@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
+ 	hvcsd->tty->driver_data = NULL;
+ 	hvcsd->tty = NULL;
+ 
+-	hvcsd->open_count = 0;
++	atomic_set(&hvcsd->open_count, 0);
+ 
+ 	/* This will drop any buffered data on the floor which is OK in a hangup
+ 	 * scenario. */
+@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
+ 	 * the middle of a write operation?  This is a crummy place to do this
+ 	 * but we want to keep it all in the spinlock.
+ 	 */
+-	if (hvcsd->open_count <= 0) {
++	if (atomic_read(&hvcsd->open_count) <= 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		return -ENODEV;
+ 	}
+@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
+ {
+ 	struct hvcs_struct *hvcsd = tty->driver_data;
+ 
+-	if (!hvcsd || hvcsd->open_count <= 0)
++	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
+ 		return 0;
+ 
+ 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
+diff -urNp linux-2.6.32.12/drivers/char/hvc_udbg.c linux-2.6.32.12/drivers/char/hvc_udbg.c
+--- linux-2.6.32.12/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_udbg.c	2010-04-04 20:46:41.573523483 -0400
+@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_udbg_ops = {
++static const struct hv_ops hvc_udbg_ops = {
+ 	.get_chars = hvc_udbg_get,
+ 	.put_chars = hvc_udbg_put,
+ };
+diff -urNp linux-2.6.32.12/drivers/char/hvc_vio.c linux-2.6.32.12/drivers/char/hvc_vio.c
+--- linux-2.6.32.12/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_vio.c	2010-04-04 20:46:41.573523483 -0400
+@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
+ 	return got;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = filtered_get_chars,
+ 	.put_chars = hvc_put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.12/drivers/char/hvc_xen.c linux-2.6.32.12/drivers/char/hvc_xen.c
+--- linux-2.6.32.12/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/hvc_xen.c	2010-04-04 20:46:41.573523483 -0400
+@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
+ 	return recv;
+ }
+ 
+-static struct hv_ops hvc_ops = {
++static const struct hv_ops hvc_ops = {
+ 	.get_chars = read_console,
+ 	.put_chars = write_console,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c
+--- linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c	2010-04-04 20:46:41.573523483 -0400
+@@ -414,7 +414,7 @@ struct ipmi_smi {
+ 	struct proc_dir_entry *proc_dir;
+ 	char                  proc_dir_name[10];
+ 
+-	atomic_t stats[IPMI_NUM_STATS];
++	atomic_unchecked_t stats[IPMI_NUM_STATS];
+ 
+ 	/*
+ 	 * run_to_completion duplicate of smb_info, smi_info
+@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
+ 
+ 
+ #define ipmi_inc_stat(intf, stat) \
+-	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
++	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
+ #define ipmi_get_stat(intf, stat) \
+-	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
+ 
+ static int is_lan_addr(struct ipmi_addr *addr)
+ {
+@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
+ 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
+ 	init_waitqueue_head(&intf->waitq);
+ 	for (i = 0; i < IPMI_NUM_STATS; i++)
+-		atomic_set(&intf->stats[i], 0);
++		atomic_set_unchecked(&intf->stats[i], 0);
+ 
+ 	intf->proc_dir = NULL;
+ 
+diff -urNp linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c
+--- linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c	2010-04-04 20:46:41.573523483 -0400
+@@ -277,7 +277,7 @@ struct smi_info {
+ 	unsigned char slave_addr;
+ 
+ 	/* Counters and things for the proc filesystem. */
+-	atomic_t stats[SI_NUM_STATS];
++	atomic_unchecked_t stats[SI_NUM_STATS];
+ 
+ 	struct task_struct *thread;
+ 
+@@ -285,9 +285,9 @@ struct smi_info {
+ };
+ 
+ #define smi_inc_stat(smi, stat) \
+-	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
++	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
+ #define smi_get_stat(smi, stat) \
+-	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
+ 
+ #define SI_MAX_PARMS 4
+ 
+@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
+ 	atomic_set(&new_smi->req_events, 0);
+ 	new_smi->run_to_completion = 0;
+ 	for (i = 0; i < SI_NUM_STATS; i++)
+-		atomic_set(&new_smi->stats[i], 0);
++		atomic_set_unchecked(&new_smi->stats[i], 0);
+ 
+ 	new_smi->interrupt_disabled = 0;
+ 	atomic_set(&new_smi->stop_operation, 0);
+diff -urNp linux-2.6.32.12/drivers/char/keyboard.c linux-2.6.32.12/drivers/char/keyboard.c
+--- linux-2.6.32.12/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/keyboard.c	2010-04-04 20:46:41.573523483 -0400
+@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
+ 	     kbd->kbdmode == VC_MEDIUMRAW) &&
+ 	     value != KVAL(K_SAK))
+ 		return;		/* SAK is allowed even in raw mode */
++
++#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
++	{
++		void *func = fn_handler[value];
++		if (func == fn_show_state || func == fn_show_ptregs ||
++		    func == fn_show_mem)
++			return;
++	}
++#endif
++
+ 	fn_handler[value](vc);
+ }
+ 
+@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
+                 .evbit = { BIT_MASK(EV_SND) },
+         },
+ 
+-	{ },    /* Terminating entry */
++	{ 0 },    /* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE(input, kbd_ids);
+diff -urNp linux-2.6.32.12/drivers/char/mem.c linux-2.6.32.12/drivers/char/mem.c
+--- linux-2.6.32.12/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/mem.c	2010-04-04 20:46:41.573523483 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/raw.h>
+ #include <linux/tty.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/ptrace.h>
+ #include <linux/device.h>
+ #include <linux/highmem.h>
+@@ -35,6 +36,10 @@
+ # include <linux/efi.h>
+ #endif
+ 
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++extern struct file_operations grsec_fops;
++#endif
++
+ static inline unsigned long size_inside_page(unsigned long start,
+ 					     unsigned long size)
+ {
+@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
+ 	if (!valid_phys_addr_range(p, count))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_mem_write();
++	return -EPERM;
++#endif
++
+ 	written = 0;
+ 
+ #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
+@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
+ 						&vma->vm_page_prot))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
++		return -EPERM;
++#endif
++
+ 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
+ 						 size,
+ 						 vma->vm_page_prot);
+@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
+ 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+ 	int err = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_kmem_write();
++	return -EPERM;
++#endif
++
+ 	if (p < (unsigned long) high_memory) {
+ 
+ 		wrote = count;
+@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
+ 
+ static int open_port(struct inode * inode, struct file * filp)
+ {
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_open_port();
++	return -EPERM;
++#endif
++
++	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
++}
++
++static int open_mem(struct inode * inode, struct file * filp)
++{
+ 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
+ }
+ 
+@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
+ #define full_lseek      null_lseek
+ #define write_zero	write_null
+ #define read_full       read_zero
+-#define open_mem	open_port
+ #define open_kmem	open_mem
+ #define open_oldmem	open_mem
+ 
+@@ -888,6 +917,9 @@ static const struct memdev {
+ #ifdef CONFIG_CRASH_DUMP
+ 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
+ #endif
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
++#endif
+ };
+ 
+ static int memory_open(struct inode *inode, struct file *filp)
+diff -urNp linux-2.6.32.12/drivers/char/nvram.c linux-2.6.32.12/drivers/char/nvram.c
+--- linux-2.6.32.12/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/nvram.c	2010-04-04 20:46:41.573523483 -0400
+@@ -429,7 +429,10 @@ static const struct file_operations nvra
+ static struct miscdevice nvram_dev = {
+ 	NVRAM_MINOR,
+ 	"nvram",
+-	&nvram_fops
++	&nvram_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static int __init nvram_init(void)
+diff -urNp linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c
+--- linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c	2010-04-04 20:46:41.573523483 -0400
+@@ -51,7 +51,7 @@ struct ipw_tty {
+ 	int tty_type;
+ 	struct ipw_network *network;
+ 	struct tty_struct *linux_tty;
+-	int open_count;
++	atomic_t open_count;
+ 	unsigned int control_lines;
+ 	struct mutex ipw_tty_mutex;
+ 	int tx_bytes_queued;
+@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -ENODEV;
+ 	}
+-	if (tty->open_count == 0)
++	if (atomic_read(&tty->open_count) == 0)
+ 		tty->tx_bytes_queued = 0;
+ 
+-	tty->open_count++;
++	atomic_inc(&tty->open_count);
+ 
+ 	tty->linux_tty = linux_tty;
+ 	linux_tty->driver_data = tty;
+@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
+ 
+ static void do_ipw_close(struct ipw_tty *tty)
+ {
+-	tty->open_count--;
+-
+-	if (tty->open_count == 0) {
++	if (atomic_dec_return(&tty->open_count) == 0) {
+ 		struct tty_struct *linux_tty = tty->linux_tty;
+ 
+ 		if (linux_tty != NULL) {
+@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
+ 		return;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (tty->open_count == 0) {
++	if (atomic_read(&tty->open_count) == 0) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
+ 		return;
+ 	}
+ 
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
+ 		return -ENODEV;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -EINVAL;
+ 	}
+@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
+@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
+ 	if (!tty)
+ 		return 0;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return 0;
+ 
+ 	return tty->tx_bytes_queued;
+@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return get_control_lines(tty);
+@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return set_control_lines(tty, set, clear);
+@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	/* FIXME: Exactly how is the tty object locked here .. */
+@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
+ 				   against a parallel ioctl etc */
+ 				mutex_lock(&ttyj->ipw_tty_mutex);
+ 			}
+-			while (ttyj->open_count)
++			while (atomic_read(&ttyj->open_count))
+ 				do_ipw_close(ttyj);
+ 			ipwireless_disassociate_network_ttys(network,
+ 							     ttyj->channel_idx);
+diff -urNp linux-2.6.32.12/drivers/char/pty.c linux-2.6.32.12/drivers/char/pty.c
+--- linux-2.6.32.12/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/pty.c	2010-04-04 20:46:41.573523483 -0400
+@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
+ 	return ret;
+ }
+ 
+-static struct file_operations ptmx_fops;
++static const struct file_operations ptmx_fops = {
++	.llseek		= no_llseek,
++	.read		= tty_read,
++	.write		= tty_write,
++	.poll		= tty_poll,
++	.unlocked_ioctl	= tty_ioctl,
++	.compat_ioctl	= tty_compat_ioctl,
++	.open		= ptmx_open,
++	.release	= tty_release,
++	.fasync		= tty_fasync,
++};
++
+ 
+ static void __init unix98_pty_init(void)
+ {
+@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
+ 	register_sysctl_table(pty_root_table);
+ 
+ 	/* Now create the /dev/ptmx special device */
+-	tty_default_fops(&ptmx_fops);
+-	ptmx_fops.open = ptmx_open;
+-
+ 	cdev_init(&ptmx_cdev, &ptmx_fops);
+ 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
+ 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
+diff -urNp linux-2.6.32.12/drivers/char/random.c linux-2.6.32.12/drivers/char/random.c
+--- linux-2.6.32.12/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/random.c	2010-04-04 20:46:41.573523483 -0400
+@@ -254,8 +254,13 @@
+ /*
+  * Configuration information
+  */
++#ifdef CONFIG_GRKERNSEC_RANDNET
++#define INPUT_POOL_WORDS 512
++#define OUTPUT_POOL_WORDS 128
++#else
+ #define INPUT_POOL_WORDS 128
+ #define OUTPUT_POOL_WORDS 32
++#endif
+ #define SEC_XFER_SIZE 512
+ 
+ /*
+@@ -292,10 +297,17 @@ static struct poolinfo {
+ 	int poolwords;
+ 	int tap1, tap2, tap3, tap4, tap5;
+ } poolinfo_table[] = {
++#ifdef CONFIG_GRKERNSEC_RANDNET
++	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
++	{ 512,	411,	308,	208,	104,	1 },
++	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
++	{ 128,	103,	76,	51,	25,	1 },
++#else
+ 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
+ 	{ 128,	103,	76,	51,	25,	1 },
+ 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
+ 	{ 32,	26,	20,	14,	7,	1 },
++#endif
+ #if 0
+ 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
+ 	{ 2048,	1638,	1231,	819,	411,	1 },
+@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+ #include <linux/sysctl.h>
+ 
+ static int min_read_thresh = 8, min_write_thresh;
+-static int max_read_thresh = INPUT_POOL_WORDS * 32;
++static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
+ static int max_write_thresh = INPUT_POOL_WORDS * 32;
+ static char sysctl_bootid[16];
+ 
+diff -urNp linux-2.6.32.12/drivers/char/sonypi.c linux-2.6.32.12/drivers/char/sonypi.c
+--- linux-2.6.32.12/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/sonypi.c	2010-04-04 20:46:41.573523483 -0400
+@@ -491,7 +491,7 @@ static struct sonypi_device {
+ 	spinlock_t fifo_lock;
+ 	wait_queue_head_t fifo_proc_list;
+ 	struct fasync_struct *fifo_async;
+-	int open_count;
++	atomic_t open_count;
+ 	int model;
+ 	struct input_dev *input_jog_dev;
+ 	struct input_dev *input_key_dev;
+@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
+ static int sonypi_misc_release(struct inode *inode, struct file *file)
+ {
+ 	mutex_lock(&sonypi_device.lock);
+-	sonypi_device.open_count--;
++	atomic_dec(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	return 0;
+ }
+@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
+ 	lock_kernel();
+ 	mutex_lock(&sonypi_device.lock);
+ 	/* Flush input queue on first open */
+-	if (!sonypi_device.open_count)
++	if (!atomic_read(&sonypi_device.open_count))
+ 		kfifo_reset(sonypi_device.fifo);
+-	sonypi_device.open_count++;
++	atomic_inc(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	unlock_kernel();
+ 	return 0;
+diff -urNp linux-2.6.32.12/drivers/char/tpm/tpm_bios.c linux-2.6.32.12/drivers/char/tpm/tpm_bios.c
+--- linux-2.6.32.12/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/tpm/tpm_bios.c	2010-04-04 20:46:41.573523483 -0400
+@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
+ 	event = addr;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	return addr;
+@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
+ 		return NULL;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	(*pos)++;
+@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
+ 	int i;
+ 
+ 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
+-		seq_putc(m, data[i]);
++		if (!seq_putc(m, data[i]))
++			return -EFAULT;
+ 
+ 	return 0;
+ }
+@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
+ 	log->bios_event_log_end = log->bios_event_log + len;
+ 
+ 	virt = acpi_os_map_memory(start, len);
++	if (!virt) {
++		kfree(log->bios_event_log);
++		log->bios_event_log = NULL;
++		return -EFAULT;
++	}
+ 
+ 	memcpy(log->bios_event_log, virt, len);
+ 
+diff -urNp linux-2.6.32.12/drivers/char/tty_io.c linux-2.6.32.12/drivers/char/tty_io.c
+--- linux-2.6.32.12/drivers/char/tty_io.c	2010-04-29 17:49:37.826084348 -0400
++++ linux-2.6.32.12/drivers/char/tty_io.c	2010-04-29 17:49:58.141506968 -0400
+@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
+ DEFINE_MUTEX(tty_mutex);
+ EXPORT_SYMBOL(tty_mutex);
+ 
+-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
+-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
+ ssize_t redirected_tty_write(struct file *, const char __user *,
+ 							size_t, loff_t *);
+-static unsigned int tty_poll(struct file *, poll_table *);
+ static int tty_open(struct inode *, struct file *);
+-static int tty_release(struct inode *, struct file *);
+ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+-#ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+-				unsigned long arg);
+-#else
+-#define tty_compat_ioctl NULL
+-#endif
+-static int tty_fasync(int fd, struct file *filp, int on);
+ static void release_tty(struct tty_struct *tty, int idx);
+ static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+ static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
+  *	read calls may be outstanding in parallel.
+  */
+ 
+-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
++ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 			loff_t *ppos)
+ {
+ 	int i;
+@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
+ 	return i;
+ }
+ 
++EXPORT_SYMBOL(tty_read);
++
+ void tty_write_unlock(struct tty_struct *tty)
+ {
+ 	mutex_unlock(&tty->atomic_write_lock);
+@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
+  *	write method will not be invoked in parallel for each device.
+  */
+ 
+-static ssize_t tty_write(struct file *file, const char __user *buf,
++ssize_t tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+ 	struct tty_struct *tty;
+@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
+ 	return ret;
+ }
+ 
++EXPORT_SYMBOL(tty_write);
++
+ ssize_t redirected_tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+@@ -1867,7 +1860,7 @@ static int tty_open(struct inode *inode,
+  *		Takes bkl. See tty_release_dev
+  */
+ 
+-static int tty_release(struct inode *inode, struct file *filp)
++int tty_release(struct inode *inode, struct file *filp)
+ {
+ 	lock_kernel();
+ 	tty_release_dev(filp);
+@@ -1875,6 +1868,8 @@ static int tty_release(struct inode *ino
+ 	return 0;
+ }
+ 
++EXPORT_SYMBOL(tty_release);
++
+ /**
+  *	tty_poll	-	check tty status
+  *	@filp: file being polled
+@@ -1887,7 +1882,7 @@ static int tty_release(struct inode *ino
+  *	may be re-entered freely by other callers.
+  */
+ 
+-static unsigned int tty_poll(struct file *filp, poll_table *wait)
++unsigned int tty_poll(struct file *filp, poll_table *wait)
+ {
+ 	struct tty_struct *tty;
+ 	struct tty_ldisc *ld;
+@@ -1904,7 +1899,9 @@ static unsigned int tty_poll(struct file
+ 	return ret;
+ }
+ 
+-static int tty_fasync(int fd, struct file *filp, int on)
++EXPORT_SYMBOL(tty_poll);
++
++int tty_fasync(int fd, struct file *filp, int on)
+ {
+ 	struct tty_struct *tty;
+ 	unsigned long flags;
+@@ -1948,6 +1945,8 @@ out:
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_fasync);
++
+ /**
+  *	tiocsti			-	fake input character
+  *	@tty: tty to fake input into
+@@ -2582,8 +2581,10 @@ long tty_ioctl(struct file *file, unsign
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_ioctl);
++
+ #ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
++long tty_compat_ioctl(struct file *file, unsigned int cmd,
+ 				unsigned long arg)
+ {
+ 	struct inode *inode = file->f_dentry->d_inode;
+@@ -2607,6 +2608,8 @@ static long tty_compat_ioctl(struct file
+ 
+ 	return retval;
+ }
++
++EXPORT_SYMBOL(tty_compat_ioctl);
+ #endif
+ 
+ /*
+@@ -3050,11 +3053,6 @@ struct tty_struct *get_current_tty(void)
+ }
+ EXPORT_SYMBOL_GPL(get_current_tty);
+ 
+-void tty_default_fops(struct file_operations *fops)
+-{
+-	*fops = tty_fops;
+-}
+-
+ /*
+  * Initialize the console device. This is called *early*, so
+  * we can't necessarily depend on lots of kernel help here.
+diff -urNp linux-2.6.32.12/drivers/char/tty_ldisc.c linux-2.6.32.12/drivers/char/tty_ldisc.c
+--- linux-2.6.32.12/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/tty_ldisc.c	2010-04-04 20:46:41.577798214 -0400
+@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
+ 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+ 		struct tty_ldisc_ops *ldo = ld->ops;
+ 
+-		ldo->refcount--;
++		atomic_dec(&ldo->refcount);
+ 		module_put(ldo->owner);
+ 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+ 	tty_ldiscs[disc] = new_ldisc;
+ 	new_ldisc->num = disc;
+-	new_ldisc->refcount = 0;
++	atomic_set(&new_ldisc->refcount, 0);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+ 	return ret;
+@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	if (tty_ldiscs[disc]->refcount)
++	if (atomic_read(&tty_ldiscs[disc]->refcount))
+ 		ret = -EBUSY;
+ 	else
+ 		tty_ldiscs[disc] = NULL;
+@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
+ 	if (ldops) {
+ 		ret = ERR_PTR(-EAGAIN);
+ 		if (try_module_get(ldops->owner)) {
+-			ldops->refcount++;
++			atomic_inc(&ldops->refcount);
+ 			ret = ldops;
+ 		}
+ 	}
+@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	ldops->refcount--;
++	atomic_dec(&ldops->refcount);
+ 	module_put(ldops->owner);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ }
+diff -urNp linux-2.6.32.12/drivers/char/virtio_console.c linux-2.6.32.12/drivers/char/virtio_console.c
+--- linux-2.6.32.12/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/virtio_console.c	2010-04-04 20:46:41.577798214 -0400
+@@ -44,6 +44,7 @@ static unsigned int in_len;
+ static char *in, *inbuf;
+ 
+ /* The operations for our console. */
++/* cannot be const */
+ static struct hv_ops virtio_cons;
+ 
+ /* The hvc device */
+diff -urNp linux-2.6.32.12/drivers/char/vt_ioctl.c linux-2.6.32.12/drivers/char/vt_ioctl.c
+--- linux-2.6.32.12/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/char/vt_ioctl.c	2010-04-04 20:46:41.577798214 -0400
+@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
+ 	case KDSKBENT:
+ 		if (!perm)
+ 			return -EPERM;
++
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG))
++			return -EPERM;
++#endif
++
+ 		if (!i && v == K_NOSUCHMAP) {
+ 			/* deallocate map */
+ 			key_map = key_maps[s];
+@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
+ 			goto reterr;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG)) {
++			ret = -EPERM;
++			goto reterr;
++		}
++#endif
++
+ 		q = func_table[i];
+ 		first_free = funcbufptr + (funcbufsize - funcbufleft);
+ 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
+diff -urNp linux-2.6.32.12/drivers/cpufreq/cpufreq.c linux-2.6.32.12/drivers/cpufreq/cpufreq.c
+--- linux-2.6.32.12/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/cpufreq/cpufreq.c	2010-04-04 20:46:41.577798214 -0400
+@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
+ 	complete(&policy->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= show,
+ 	.store	= store,
+ };
+diff -urNp linux-2.6.32.12/drivers/cpuidle/sysfs.c linux-2.6.32.12/drivers/cpuidle/sysfs.c
+--- linux-2.6.32.12/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/cpuidle/sysfs.c	2010-04-29 17:46:36.917238919 -0400
+@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_sysfs_ops = {
++static const struct sysfs_ops cpuidle_sysfs_ops = {
+ 	.show = cpuidle_show,
+ 	.store = cpuidle_store,
+ };
+@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_state_sysfs_ops = {
++static const struct sysfs_ops cpuidle_state_sysfs_ops = {
+ 	.show = cpuidle_state_show,
+ };
+ 
+@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
+ 	.release = cpuidle_state_sysfs_release,
+ };
+ 
+-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
++static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
+ {
+ 	kobject_put(&device->kobjs[i]->kobj);
+ 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
+diff -urNp linux-2.6.32.12/drivers/dma/ioat/dma.c linux-2.6.32.12/drivers/dma/ioat/dma.c
+--- linux-2.6.32.12/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/dma/ioat/dma.c	2010-04-04 20:46:41.577798214 -0400
+@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
+ 	return entry->show(&chan->common, page);
+ }
+ 
+-struct sysfs_ops ioat_sysfs_ops = {
++const struct sysfs_ops ioat_sysfs_ops = {
+ 	.show	= ioat_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/dma/ioat/dma.h linux-2.6.32.12/drivers/dma/ioat/dma.h
+--- linux-2.6.32.12/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/dma/ioat/dma.h	2010-04-04 20:46:41.577798214 -0400
+@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
+ 			   unsigned long *phys_complete);
+ void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
+ void ioat_kobject_del(struct ioatdma_device *device);
+-extern struct sysfs_ops ioat_sysfs_ops;
++extern const struct sysfs_ops ioat_sysfs_ops;
+ extern struct ioat_sysfs_entry ioat_version_attr;
+ extern struct ioat_sysfs_entry ioat_cap_attr;
+ #endif /* IOATDMA_H */
+diff -urNp linux-2.6.32.12/drivers/edac/edac_core.h linux-2.6.32.12/drivers/edac/edac_core.h
+--- linux-2.6.32.12/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/edac/edac_core.h	2010-04-04 20:46:41.577798214 -0400
+@@ -99,11 +99,11 @@ extern int edac_debug_level;
+ 
+ #else				/* !CONFIG_EDAC_DEBUG */
+ 
+-#define debugf0( ... )
+-#define debugf1( ... )
+-#define debugf2( ... )
+-#define debugf3( ... )
+-#define debugf4( ... )
++#define debugf0( ... ) do {} while (0)
++#define debugf1( ... ) do {} while (0)
++#define debugf2( ... ) do {} while (0)
++#define debugf3( ... ) do {} while (0)
++#define debugf4( ... ) do {} while (0)
+ 
+ #endif				/* !CONFIG_EDAC_DEBUG */
+ 
+diff -urNp linux-2.6.32.12/drivers/edac/edac_device_sysfs.c linux-2.6.32.12/drivers/edac/edac_device_sysfs.c
+--- linux-2.6.32.12/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/edac/edac_device_sysfs.c	2010-04-04 20:46:41.577798214 -0400
+@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
+ }
+ 
+ /* edac_dev file operations for an 'ctl_info' */
+-static struct sysfs_ops device_ctl_info_ops = {
++static const struct sysfs_ops device_ctl_info_ops = {
+ 	.show = edac_dev_ctl_info_show,
+ 	.store = edac_dev_ctl_info_store
+ };
+@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
+ }
+ 
+ /* edac_dev file operations for an 'instance' */
+-static struct sysfs_ops device_instance_ops = {
++static const struct sysfs_ops device_instance_ops = {
+ 	.show = edac_dev_instance_show,
+ 	.store = edac_dev_instance_store
+ };
+@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
+ }
+ 
+ /* edac_dev file operations for a 'block' */
+-static struct sysfs_ops device_block_ops = {
++static const struct sysfs_ops device_block_ops = {
+ 	.show = edac_dev_block_show,
+ 	.store = edac_dev_block_store
+ };
+diff -urNp linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c
+--- linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c	2010-04-04 20:46:41.577798214 -0400
+@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops csrowfs_ops = {
++static const struct sysfs_ops csrowfs_ops = {
+ 	.show = csrowdev_show,
+ 	.store = csrowdev_store
+ };
+@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
+ }
+ 
+ /* Intermediate show/store table */
+-static struct sysfs_ops mci_ops = {
++static const struct sysfs_ops mci_ops = {
+ 	.show = mcidev_show,
+ 	.store = mcidev_store
+ };
+diff -urNp linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c
+--- linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c	2010-04-04 20:46:41.577798214 -0400
+@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
+ }
+ 
+ /* fs_ops table */
+-static struct sysfs_ops pci_instance_ops = {
++static const struct sysfs_ops pci_instance_ops = {
+ 	.show = edac_pci_instance_show,
+ 	.store = edac_pci_instance_store
+ };
+@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops edac_pci_sysfs_ops = {
++static const struct sysfs_ops edac_pci_sysfs_ops = {
+ 	.show = edac_pci_dev_show,
+ 	.store = edac_pci_dev_store
+ };
+diff -urNp linux-2.6.32.12/drivers/firewire/core-cdev.c linux-2.6.32.12/drivers/firewire/core-cdev.c
+--- linux-2.6.32.12/drivers/firewire/core-cdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firewire/core-cdev.c	2010-04-29 17:46:37.101039010 -0400
+@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
+ 	int ret;
+ 
+ 	if ((request->channels == 0 && request->bandwidth == 0) ||
+-	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
+-	    request->bandwidth < 0)
++	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
+ 		return -EINVAL;
+ 
+ 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
+diff -urNp linux-2.6.32.12/drivers/firmware/dmi_scan.c linux-2.6.32.12/drivers/firmware/dmi_scan.c
+--- linux-2.6.32.12/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firmware/dmi_scan.c	2010-04-04 20:46:41.577798214 -0400
+@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
+ 		}
+ 	}
+ 	else {
+-		/*
+-		 * no iounmap() for that ioremap(); it would be a no-op, but
+-		 * it's so early in setup that sucker gets confused into doing
+-		 * what it shouldn't if we actually call it.
+-		 */
+ 		p = dmi_ioremap(0xF0000, 0x10000);
+ 		if (p == NULL)
+ 			goto error;
+diff -urNp linux-2.6.32.12/drivers/firmware/edd.c linux-2.6.32.12/drivers/firmware/edd.c
+--- linux-2.6.32.12/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firmware/edd.c	2010-04-04 20:46:41.577798214 -0400
+@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops edd_attr_ops = {
++static const struct sysfs_ops edd_attr_ops = {
+ 	.show = edd_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/firmware/efivars.c linux-2.6.32.12/drivers/firmware/efivars.c
+--- linux-2.6.32.12/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firmware/efivars.c	2010-04-04 20:46:41.577798214 -0400
+@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops efivar_attr_ops = {
++static const struct sysfs_ops efivar_attr_ops = {
+ 	.show = efivar_attr_show,
+ 	.store = efivar_attr_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/firmware/iscsi_ibft.c linux-2.6.32.12/drivers/firmware/iscsi_ibft.c
+--- linux-2.6.32.12/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firmware/iscsi_ibft.c	2010-04-04 20:46:41.581454607 -0400
+@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops ibft_attr_ops = {
++static const struct sysfs_ops ibft_attr_ops = {
+ 	.show = ibft_show_attribute,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/firmware/memmap.c linux-2.6.32.12/drivers/firmware/memmap.c
+--- linux-2.6.32.12/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/firmware/memmap.c	2010-04-04 20:46:41.581454607 -0400
+@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
+ 	NULL
+ };
+ 
+-static struct sysfs_ops memmap_attr_ops = {
++static const struct sysfs_ops memmap_attr_ops = {
+ 	.show = memmap_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_drv.c linux-2.6.32.12/drivers/gpu/drm/drm_drv.c
+--- linux-2.6.32.12/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/drm_drv.c	2010-04-04 20:46:41.581454607 -0400
+@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
+ 	char *kdata = NULL;
+ 
+ 	atomic_inc(&dev->ioctl_count);
+-	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
+ 	++file_priv->ioctl_count;
+ 
+ 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_fops.c linux-2.6.32.12/drivers/gpu/drm/drm_fops.c
+--- linux-2.6.32.12/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:37.845185844 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:58.154995647 -0400
+@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
+-		atomic_set(&dev->counts[i], 0);
++		atomic_set_unchecked(&dev->counts[i], 0);
+ 
+ 	dev->sigdata.lock = NULL;
+ 
+@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
+ 
+ 	retcode = drm_open_helper(inode, filp, dev);
+ 	if (!retcode) {
+-		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
++		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
+ 		spin_lock(&dev->count_lock);
+-		if (!dev->open_count++) {
++		if (atomic_inc_return(&dev->open_count) == 1) {
+ 			spin_unlock(&dev->count_lock);
+ 			retcode = drm_setup(dev);
+ 			goto out;
+@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
+ 
+ 	lock_kernel();
+ 
+-	DRM_DEBUG("open_count = %d\n", dev->open_count);
++	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
+ 
+ 	if (dev->driver->preclose)
+ 		dev->driver->preclose(dev, file_priv);
+@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
+ 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
+ 		  task_pid_nr(current),
+ 		  (long)old_encode_dev(file_priv->minor->device),
+-		  dev->open_count);
++		  atomic_read(&dev->open_count));
+ 
+ 	/* if the master has gone away we can't do anything with the lock */
+ 	if (file_priv->minor->master)
+@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
+ 	 * End inline drm_release
+ 	 */
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
+ 	spin_lock(&dev->count_lock);
+-	if (!--dev->open_count) {
++	if (atomic_dec_and_test(&dev->open_count)) {
+ 		if (atomic_read(&dev->ioctl_count)) {
+ 			DRM_ERROR("Device busy: %d\n",
+ 				  atomic_read(&dev->ioctl_count));
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c
+--- linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c	2010-04-04 20:46:41.581454607 -0400
+@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
+ 			stats->data[i].value =
+ 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
+ 		else
+-			stats->data[i].value = atomic_read(&dev->counts[i]);
++			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
+ 		stats->data[i].type = dev->types[i];
+ 	}
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_lock.c linux-2.6.32.12/drivers/gpu/drm/drm_lock.c
+--- linux-2.6.32.12/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/drm_lock.c	2010-04-04 20:46:41.581454607 -0400
+@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
+ 		if (drm_lock_take(&master->lock, lock->context)) {
+ 			master->lock.file_priv = file_priv;
+ 			master->lock.lock_time = jiffies;
+-			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
++			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
+ 			break;	/* Got lock */
+ 		}
+ 
+@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
+ 		return -EINVAL;
+ 	}
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
+ 
+ 	/* kernel_context_switch isn't used by any of the x86 drm
+ 	 * modules but is required by the Sparc driver.
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c
+--- linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c	2010-04-04 20:46:41.581454607 -0400
+@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
+ 				 dma->buflist[vertex->idx],
+ 				 vertex->discard, vertex->used);
+ 
+-	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
+ 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
+ 			     mc->last_render);
+ 
+-	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c	2010-04-04 20:46:41.581454607 -0400
+@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7017_ops = {
++const struct intel_dvo_dev_ops ch7017_ops = {
+ 	.init = ch7017_init,
+ 	.detect = ch7017_detect,
+ 	.mode_valid = ch7017_mode_valid,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-04-04 20:46:41.581454607 -0400
+@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7xxx_ops = {
++const struct intel_dvo_dev_ops ch7xxx_ops = {
+ 	.init = ch7xxx_init,
+ 	.detect = ch7xxx_detect,
+ 	.mode_valid = ch7xxx_mode_valid,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h	2010-04-04 20:46:41.581454607 -0400
+@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
+ 	 *
+ 	 * \return singly-linked list of modes or NULL if no modes found.
+ 	 */
+-	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
++	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Clean up driver-specific bits of the output
+ 	 */
+-	void (*destroy) (struct intel_dvo_device *dvo);
++	void (* const destroy) (struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Debugging hook to dump device registers to log file
+ 	 */
+-	void (*dump_regs)(struct intel_dvo_device *dvo);
++	void (* const dump_regs)(struct intel_dvo_device *dvo);
+ };
+ 
+-extern struct intel_dvo_dev_ops sil164_ops;
+-extern struct intel_dvo_dev_ops ch7xxx_ops;
+-extern struct intel_dvo_dev_ops ivch_ops;
+-extern struct intel_dvo_dev_ops tfp410_ops;
+-extern struct intel_dvo_dev_ops ch7017_ops;
++extern const struct intel_dvo_dev_ops sil164_ops;
++extern const struct intel_dvo_dev_ops ch7xxx_ops;
++extern const struct intel_dvo_dev_ops ivch_ops;
++extern const struct intel_dvo_dev_ops tfp410_ops;
++extern const struct intel_dvo_dev_ops ch7017_ops;
+ 
+ #endif /* _INTEL_DVO_H */
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c	2010-04-04 20:46:41.581454607 -0400
+@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ivch_ops= {
++const struct intel_dvo_dev_ops ivch_ops= {
+ 	.init = ivch_init,
+ 	.dpms = ivch_dpms,
+ 	.save = ivch_save,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c	2010-04-04 20:46:41.581454607 -0400
+@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops sil164_ops = {
++const struct intel_dvo_dev_ops sil164_ops = {
+ 	.init = sil164_init,
+ 	.detect = sil164_detect,
+ 	.mode_valid = sil164_mode_valid,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c	2010-04-04 20:46:41.581454607 -0400
+@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops tfp410_ops = {
++const struct intel_dvo_dev_ops tfp410_ops = {
+ 	.init = tfp410_init,
+ 	.detect = tfp410_detect,
+ 	.mode_valid = tfp410_mode_valid,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c
+--- linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c	2010-04-04 20:46:41.581454607 -0400
+@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
+ 	return i915_resume(dev);
+ }
+ 
+-static struct vm_operations_struct i915_gem_vm_ops = {
++static const struct vm_operations_struct i915_gem_vm_ops = {
+ 	.fault = i915_gem_fault,
+ 	.open = drm_gem_vm_open,
+ 	.close = drm_gem_vm_close,
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c
+--- linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c	2010-04-04 20:46:41.581454607 -0400
+@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
+ 	regex_t mask_rex;
+ 	regmatch_t match[4];
+ 	char buf[1024];
+-	size_t end;
++	long end;
+ 	int len;
+ 	int done = 0;
+ 	int r;
+ 	unsigned o;
+ 	struct offset *offset;
+ 	char last_reg_s[10];
+-	int last_reg;
++	unsigned long last_reg;
+ 
+ 	if (regcomp
+ 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c	2010-04-04 20:46:41.581454607 -0400
+@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
+ 	}
+ }
+ 
+-struct bios_connector {
++static struct bios_connector {
+ 	bool valid;
+ 	uint16_t line_mux;
+ 	uint16_t devices;
+ 	int connector_type;
+ 	struct radeon_i2c_bus_rec ddc_bus;
+-};
++} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ 								 drm_device
+@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
+ 	uint8_t dac;
+ 	union atom_supported_devices *supported_devices;
+ 	int i, j;
+-	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c
+--- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c	2010-04-29 17:46:37.101039010 -0400
+@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
+ 
+ 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
+ 						error = freq - current_freq;
+-						error = error < 0 ? 0xffffffff : error;
++						error = (int32_t)error < 0 ? 0xffffffff : error;
+ 					} else
+ 						error = abs(current_freq - freq);
+ 					vco_diff = abs(vco - best_vco);
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c
+--- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c	2010-04-04 20:46:41.581454607 -0400
+@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
+ {
+ 	drm_radeon_private_t *dev_priv = dev->dev_private;
+ 	drm_radeon_getparam_t *param = data;
+-	int value;
++	int value = 0;
+ 
+ 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c
+--- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c	2010-04-04 20:46:41.581454607 -0400
+@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
+ 	DRM_INFO("radeon: ttm finalized\n");
+ }
+ 
+-static struct vm_operations_struct radeon_ttm_vm_ops;
+-static const struct vm_operations_struct *ttm_vm_ops = NULL;
+-
+-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+-{
+-	struct ttm_buffer_object *bo;
+-	int r;
+-
+-	bo = (struct ttm_buffer_object *)vma->vm_private_data;
+-	if (bo == NULL) {
+-		return VM_FAULT_NOPAGE;
+-	}
+-	r = ttm_vm_ops->fault(vma, vmf);
+-	return r;
+-}
+-
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ 	struct drm_file *file_priv;
+ 	struct radeon_device *rdev;
+-	int r;
+ 
+ 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
+ 		return drm_mmap(filp, vma);
+@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
+ 
+ 	file_priv = (struct drm_file *)filp->private_data;
+ 	rdev = file_priv->minor->dev->dev_private;
+-	if (rdev == NULL) {
++	if (!rdev)
+ 		return -EINVAL;
+-	}
+-	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+-	if (unlikely(r != 0)) {
+-		return r;
+-	}
+-	if (unlikely(ttm_vm_ops == NULL)) {
+-		ttm_vm_ops = vma->vm_ops;
+-		radeon_ttm_vm_ops = *ttm_vm_ops;
+-		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
+-	}
+-	vma->vm_ops = &radeon_ttm_vm_ops;
+-	return 0;
++	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c
+--- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c	2010-04-29 17:46:36.939238869 -0400
+@@ -39,7 +39,7 @@
+ #include <linux/module.h>
+ 
+ #define TTM_ASSERT_LOCKED(param)
+-#define TTM_DEBUG(fmt, arg...)
++#define TTM_DEBUG(fmt, arg...) do {} while (0)
+ #define TTM_BO_HASH_ORDER 13
+ 
+ static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
+@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_bo_global_ops = {
++static const struct sysfs_ops ttm_bo_global_ops = {
+ 	.show = &ttm_bo_global_show
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c
+--- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-04-04 20:46:41.585591308 -0400
+@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
+ {
+ 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
+ 	    vma->vm_private_data;
+-	struct ttm_bo_device *bdev = bo->bdev;
++	struct ttm_bo_device *bdev;
+ 	unsigned long bus_base;
+ 	unsigned long bus_offset;
+ 	unsigned long bus_size;
+@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
+ 	unsigned long address = (unsigned long)vmf->virtual_address;
+ 	int retval = VM_FAULT_NOPAGE;
+ 
++	if (!bo)
++		return VM_FAULT_NOPAGE;
++	bdev = bo->bdev;
++
+ 	/*
+ 	 * Work around locking order reversal in fault / nopfn
+ 	 * between mmap_sem and bo_reserve: Perform a trylock operation
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c
+--- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c	2010-04-04 20:46:41.585591308 -0400
+@@ -36,7 +36,7 @@
+ struct ttm_global_item {
+ 	struct mutex mutex;
+ 	void *object;
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ static struct ttm_global_item glob[TTM_GLOBAL_NUM];
+@@ -49,7 +49,7 @@ void ttm_global_init(void)
+ 		struct ttm_global_item *item = &glob[i];
+ 		mutex_init(&item->mutex);
+ 		item->object = NULL;
+-		item->refcount = 0;
++		atomic_set(&item->refcount, 0);
+ 	}
+ }
+ 
+@@ -59,7 +59,7 @@ void ttm_global_release(void)
+ 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
+ 		struct ttm_global_item *item = &glob[i];
+ 		BUG_ON(item->object != NULL);
+-		BUG_ON(item->refcount != 0);
++		BUG_ON(atomic_read(&item->refcount) != 0);
+ 	}
+ }
+ 
+@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 	void *object;
+ 
+ 	mutex_lock(&item->mutex);
+-	if (item->refcount == 0) {
++	if (atomic_read(&item->refcount) == 0) {
+ 		item->object = kzalloc(ref->size, GFP_KERNEL);
+ 		if (unlikely(item->object == NULL)) {
+ 			ret = -ENOMEM;
+@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 			goto out_err;
+ 
+ 	}
+-	++item->refcount;
++	atomic_inc(&item->refcount);
+ 	ref->object = item->object;
+ 	object = item->object;
+ 	mutex_unlock(&item->mutex);
+@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
+ 	struct ttm_global_item *item = &glob[ref->global_type];
+ 
+ 	mutex_lock(&item->mutex);
+-	BUG_ON(item->refcount == 0);
++	BUG_ON(atomic_read(&item->refcount) == 0);
+ 	BUG_ON(ref->object != item->object);
+-	if (--item->refcount == 0) {
++	if (atomic_dec_and_test(&item->refcount)) {
+ 		ref->release(ref);
+ 		item->object = NULL;
+ 	}
+diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c
+--- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c	2010-04-04 20:46:41.585591308 -0400
+@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_mem_zone_ops = {
++static const struct sysfs_ops ttm_mem_zone_ops = {
+ 	.show = &ttm_mem_zone_show,
+ 	.store = &ttm_mem_zone_store
+ };
+diff -urNp linux-2.6.32.12/drivers/hid/usbhid/hiddev.c linux-2.6.32.12/drivers/hid/usbhid/hiddev.c
+--- linux-2.6.32.12/drivers/hid/usbhid/hiddev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hid/usbhid/hiddev.c	2010-04-29 17:46:37.113104605 -0400
+@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
+ 		return put_user(HID_VERSION, (int __user *)arg);
+ 
+ 	case HIDIOCAPPLICATION:
+-		if (arg < 0 || arg >= hid->maxapplication)
++		if (arg >= hid->maxapplication)
+ 			return -EINVAL;
+ 
+ 		for (i = 0; i < hid->maxcollection; i++)
+diff -urNp linux-2.6.32.12/drivers/hwmon/k8temp.c linux-2.6.32.12/drivers/hwmon/k8temp.c
+--- linux-2.6.32.12/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hwmon/k8temp.c	2010-04-04 20:46:41.585591308 -0400
+@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
+ 
+ static struct pci_device_id k8temp_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, k8temp_ids);
+diff -urNp linux-2.6.32.12/drivers/hwmon/sis5595.c linux-2.6.32.12/drivers/hwmon/sis5595.c
+--- linux-2.6.32.12/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hwmon/sis5595.c	2010-04-04 20:46:41.585591308 -0400
+@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
+ 
+ static struct pci_device_id sis5595_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
+diff -urNp linux-2.6.32.12/drivers/hwmon/via686a.c linux-2.6.32.12/drivers/hwmon/via686a.c
+--- linux-2.6.32.12/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hwmon/via686a.c	2010-04-04 20:46:41.585591308 -0400
+@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
+ 
+ static struct pci_device_id via686a_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
+diff -urNp linux-2.6.32.12/drivers/hwmon/vt8231.c linux-2.6.32.12/drivers/hwmon/vt8231.c
+--- linux-2.6.32.12/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hwmon/vt8231.c	2010-04-04 20:46:41.585591308 -0400
+@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
+ 
+ static struct pci_device_id vt8231_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
+diff -urNp linux-2.6.32.12/drivers/hwmon/w83791d.c linux-2.6.32.12/drivers/hwmon/w83791d.c
+--- linux-2.6.32.12/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/hwmon/w83791d.c	2010-04-04 20:46:41.585591308 -0400
+@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
+ 			  struct i2c_board_info *info);
+ static int w83791d_remove(struct i2c_client *client);
+ 
+-static int w83791d_read(struct i2c_client *client, u8 register);
+-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
++static int w83791d_read(struct i2c_client *client, u8 reg);
++static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
+ static struct w83791d_data *w83791d_update_device(struct device *dev);
+ 
+ #ifdef DEBUG
+diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c
+--- linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c	2010-04-29 17:49:37.945518391 -0400
++++ linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c	2010-04-29 18:00:43.521920899 -0400
+@@ -582,7 +582,7 @@ static struct pci_device_id i801_ids[] =
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CPT_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, i801_ids);
+diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c
+--- linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c	2010-04-04 20:46:41.585591308 -0400
+@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
+ 		.ident = "IBM",
+ 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+-	{ },
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
+@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, piix4_ids);
+diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c
+--- linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c	2010-04-04 20:46:41.585591308 -0400
+@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
+ static struct pci_device_id sis630_ids[] __devinitdata = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis630_ids);
+diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c
+--- linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c	2010-04-04 20:46:41.585591308 -0400
+@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
+ 
+ static struct pci_device_id sis96x_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis96x_ids);
+diff -urNp linux-2.6.32.12/drivers/ide/ide-cd.c linux-2.6.32.12/drivers/ide/ide-cd.c
+--- linux-2.6.32.12/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ide/ide-cd.c	2010-04-04 20:46:41.585591308 -0400
+@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
+ 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
+ 		if ((unsigned long)buf & alignment
+ 		    || blk_rq_bytes(rq) & q->dma_pad_mask
+-		    || object_is_on_stack(buf))
++		    || object_starts_on_stack(buf))
+ 			drive->dma = 0;
+ 	}
+ }
+diff -urNp linux-2.6.32.12/drivers/ieee1394/dv1394.c linux-2.6.32.12/drivers/ieee1394/dv1394.c
+--- linux-2.6.32.12/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/dv1394.c	2010-04-04 20:46:41.585591308 -0400
+@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
+ 	based upon DIF section and sequence
+ */
+ 
+-static void inline
++static inline void
+ frame_put_packet (struct frame *f, struct packet *p)
+ {
+ 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
+@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
+ 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
+ 	},
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
+diff -urNp linux-2.6.32.12/drivers/ieee1394/eth1394.c linux-2.6.32.12/drivers/ieee1394/eth1394.c
+--- linux-2.6.32.12/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/eth1394.c	2010-04-04 20:46:41.585591308 -0400
+@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
+ 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
+ 		.version = ETHER1394_GASP_VERSION,
+ 	},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
+diff -urNp linux-2.6.32.12/drivers/ieee1394/hosts.c linux-2.6.32.12/drivers/ieee1394/hosts.c
+--- linux-2.6.32.12/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/hosts.c	2010-04-04 20:46:41.589782410 -0400
+@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
+ }
+ 
+ static struct hpsb_host_driver dummy_driver = {
++	.name =		   "dummy",
+ 	.transmit_packet = dummy_transmit_packet,
+ 	.devctl =	   dummy_devctl,
+ 	.isoctl =	   dummy_isoctl
+diff -urNp linux-2.6.32.12/drivers/ieee1394/ohci1394.c linux-2.6.32.12/drivers/ieee1394/ohci1394.c
+--- linux-2.6.32.12/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/ohci1394.c	2010-04-04 20:46:41.589782410 -0400
+@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
+ printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
+ 
+ /* Module Parameters */
+-static int phys_dma = 1;
++static int phys_dma;
+ module_param(phys_dma, int, 0444);
+-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
++MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
+ 
+ static void dma_trm_tasklet(unsigned long data);
+ static void dma_trm_reset(struct dma_trm_ctx *d);
+@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
+ 		.subvendor =	PCI_ANY_ID,
+ 		.subdevice =	PCI_ANY_ID,
+ 	},
+-	{ 0, },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
+diff -urNp linux-2.6.32.12/drivers/ieee1394/raw1394.c linux-2.6.32.12/drivers/ieee1394/raw1394.c
+--- linux-2.6.32.12/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/raw1394.c	2010-04-04 20:46:41.589782410 -0400
+@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
+ 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
+diff -urNp linux-2.6.32.12/drivers/ieee1394/sbp2.c linux-2.6.32.12/drivers/ieee1394/sbp2.c
+--- linux-2.6.32.12/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/sbp2.c	2010-04-04 20:46:41.589782410 -0400
+@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
+ 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
+ 
+@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
+ MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
+ MODULE_LICENSE("GPL");
+ 
+-static int sbp2_module_init(void)
++static int __init sbp2_module_init(void)
+ {
+ 	int ret;
+ 
+diff -urNp linux-2.6.32.12/drivers/ieee1394/video1394.c linux-2.6.32.12/drivers/ieee1394/video1394.c
+--- linux-2.6.32.12/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/ieee1394/video1394.c	2010-04-04 20:46:41.589782410 -0400
+@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
+                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
+         },
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
+diff -urNp linux-2.6.32.12/drivers/infiniband/core/cm.c linux-2.6.32.12/drivers/infiniband/core/cm.c
+--- linux-2.6.32.12/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/infiniband/core/cm.c	2010-04-04 20:46:41.589782410 -0400
+@@ -112,7 +112,7 @@ static char const counter_group_names[CM
+ 
+ struct cm_counter_group {
+ 	struct kobject obj;
+-	atomic_long_t counter[CM_ATTR_COUNT];
++	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
+ };
+ 
+ struct cm_counter_attribute {
+@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
+ 	struct ib_mad_send_buf *msg = NULL;
+ 	int ret;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REQ_COUNTER]);
+ 
+ 	/* Quick state check to discard duplicate REQs. */
+@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
+ 	if (!cm_id_priv)
+ 		return;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REP_COUNTER]);
+ 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+ 	if (ret)
+@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
+ 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
+ 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
+ 		spin_unlock_irq(&cm_id_priv->lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_RTU_COUNTER]);
+ 		goto out;
+ 	}
+@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
+ 				   dreq_msg->local_comm_id);
+ 	if (!cm_id_priv) {
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		cm_issue_drep(work->port, work->mad_recv_wc);
+ 		return -EINVAL;
+@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	case IB_CM_MRA_REP_RCVD:
+ 		break;
+ 	case IB_CM_TIMEWAIT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_DREQ_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
+ 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+ 				  cm_id_priv->msg, timeout)) {
+ 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
+-				atomic_long_inc(&work->port->
++				atomic_long_inc_unchecked(&work->port->
+ 						counter_group[CM_RECV_DUPLICATES].
+ 						counter[CM_MRA_COUNTER]);
+ 			goto out;
+@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
+ 		break;
+ 	case IB_CM_MRA_REQ_RCVD:
+ 	case IB_CM_MRA_REP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_MRA_COUNTER]);
+ 		/* fall through */
+ 	default:
+@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
+ 	case IB_CM_LAP_IDLE:
+ 		break;
+ 	case IB_CM_MRA_LAP_SENT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_LAP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
+ 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
+ 	if (cur_cm_id_priv) {
+ 		spin_unlock_irq(&cm.lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_SIDR_REQ_COUNTER]);
+ 		goto out; /* Duplicate message. */
+ 	}
+@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
+ 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
+ 		msg->retries = 1;
+ 
+-	atomic_long_add(1 + msg->retries,
++	atomic_long_add_unchecked(1 + msg->retries,
+ 			&port->counter_group[CM_XMIT].counter[attr_index]);
+ 	if (msg->retries)
+-		atomic_long_add(msg->retries,
++		atomic_long_add_unchecked(msg->retries,
+ 				&port->counter_group[CM_XMIT_RETRIES].
+ 				counter[attr_index]);
+ 
+@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
+ 	}
+ 
+ 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
+-	atomic_long_inc(&port->counter_group[CM_RECV].
++	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
+ 			counter[attr_id - CM_ATTR_ID_OFFSET]);
+ 
+ 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
+@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
+ 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
+ 
+ 	return sprintf(buf, "%ld\n",
+-		       atomic_long_read(&group->counter[cm_attr->index]));
++		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
+ }
+ 
+-static struct sysfs_ops cm_counter_ops = {
++static const struct sysfs_ops cm_counter_ops = {
+ 	.show = cm_show_counter
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/infiniband/core/sysfs.c linux-2.6.32.12/drivers/infiniband/core/sysfs.c
+--- linux-2.6.32.12/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/infiniband/core/sysfs.c	2010-04-04 20:46:41.589782410 -0400
+@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
+ 	return port_attr->show(p, port_attr, buf);
+ }
+ 
+-static struct sysfs_ops port_sysfs_ops = {
++static const struct sysfs_ops port_sysfs_ops = {
+ 	.show = port_attr_show
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/input/keyboard/atkbd.c linux-2.6.32.12/drivers/input/keyboard/atkbd.c
+--- linux-2.6.32.12/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/keyboard/atkbd.c	2010-04-04 20:46:41.589782410 -0400
+@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
+diff -urNp linux-2.6.32.12/drivers/input/mouse/lifebook.c linux-2.6.32.12/drivers/input/mouse/lifebook.c
+--- linux-2.6.32.12/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/mouse/lifebook.c	2010-04-04 20:46:41.589782410 -0400
+@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
+diff -urNp linux-2.6.32.12/drivers/input/mouse/psmouse-base.c linux-2.6.32.12/drivers/input/mouse/psmouse-base.c
+--- linux-2.6.32.12/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/mouse/psmouse-base.c	2010-04-04 20:46:41.593451026 -0400
+@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
+diff -urNp linux-2.6.32.12/drivers/input/mouse/synaptics.c linux-2.6.32.12/drivers/input/mouse/synaptics.c
+--- linux-2.6.32.12/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/mouse/synaptics.c	2010-04-04 20:46:41.593451026 -0400
+@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
+ 				break;
+ 			case 2:
+ 				if (SYN_MODEL_PEN(priv->model_id))
+-					;   /* Nothing, treat a pen as a single finger */
++					break;   /* Nothing, treat a pen as a single finger */
+ 				break;
+ 			case 4 ... 15:
+ 				if (SYN_CAP_PALMDETECT(priv->capabilities))
+@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
+ 		},
+-
+ 	},
+ 	{
+ 		.ident = "Toshiba Portege M300",
+@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
+ 		},
+-
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.12/drivers/input/mousedev.c linux-2.6.32.12/drivers/input/mousedev.c
+--- linux-2.6.32.12/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/mousedev.c	2010-04-04 20:46:41.593451026 -0400
+@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
+ 
+ #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
+ static struct miscdevice psaux_mouse = {
+-	PSMOUSE_MINOR, "psaux", &mousedev_fops
++	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
+ };
+ static int psaux_registered;
+ #endif
+diff -urNp linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h
+--- linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:46:41.593451026 -0400
+@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #ifdef CONFIG_PNP
+@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
+@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #endif /* CONFIG_X86 */
+diff -urNp linux-2.6.32.12/drivers/input/serio/serio_raw.c linux-2.6.32.12/drivers/input/serio/serio_raw.c
+--- linux-2.6.32.12/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/input/serio/serio_raw.c	2010-04-04 20:46:41.593451026 -0400
+@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
+diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/common.c linux-2.6.32.12/drivers/isdn/gigaset/common.c
+--- linux-2.6.32.12/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/isdn/gigaset/common.c	2010-04-04 20:46:41.593451026 -0400
+@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
+ 	cs->commands_pending = 0;
+ 	cs->cur_at_seq = 0;
+ 	cs->gotfwver = -1;
+-	cs->open_count = 0;
++	atomic_set(&cs->open_count, 0);
+ 	cs->dev = NULL;
+ 	cs->tty = NULL;
+ 	cs->tty_dev = NULL;
+diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h
+--- linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h	2010-04-04 20:46:41.593451026 -0400
+@@ -446,7 +446,7 @@ struct cardstate {
+ 	spinlock_t cmdlock;
+ 	unsigned curlen, cmdbytes;
+ 
+-	unsigned open_count;
++	atomic_t open_count;
+ 	struct tty_struct *tty;
+ 	struct tasklet_struct if_wake_tasklet;
+ 	unsigned control_state;
+diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/interface.c linux-2.6.32.12/drivers/isdn/gigaset/interface.c
+--- linux-2.6.32.12/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.12/drivers/isdn/gigaset/interface.c	2010-04-04 20:46:41.593451026 -0400
+@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
+ 		return -ERESTARTSYS; // FIXME -EINTR?
+ 	tty->driver_data = cs;
+ 
+-	++cs->open_count;
+-
+-	if (cs->open_count == 1) {
++	if (atomic_inc_return(&cs->open_count) == 1) {
+ 		spin_lock_irqsave(&cs->lock, flags);
+ 		cs->tty = tty;
+ 		spin_unlock_irqrestore(&cs->lock, flags);
+@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+-		if (!--cs->open_count) {
++		if (!atomic_dec_return(&cs->open_count)) {
+ 			spin_lock_irqsave(&cs->lock, flags);
+ 			cs->tty = NULL;
+ 			spin_unlock_irqrestore(&cs->lock, flags);
+@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		retval = 0;
+@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED)
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
+ 		goto out;
+ 	}
+ 
+-	if (!cs->open_count) {
++	if (!atomic_read(&cs->open_count)) {
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 		goto out;
+ 	}
+diff -urNp linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c
+--- linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c	2010-04-04 20:46:41.593451026 -0400
+@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (t4file->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (config->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+diff -urNp linux-2.6.32.12/drivers/isdn/icn/icn.c linux-2.6.32.12/drivers/isdn/icn/icn.c
+--- linux-2.6.32.12/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/isdn/icn/icn.c	2010-04-04 20:46:41.593451026 -0400
+@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
+ 		if (count > len)
+ 			count = len;
+ 		if (user) {
+-			if (copy_from_user(msg, buf, count))
++			if (count > sizeof msg || copy_from_user(msg, buf, count))
+ 				return -EFAULT;
+ 		} else
+ 			memcpy(msg, buf, count);
+diff -urNp linux-2.6.32.12/drivers/lguest/core.c linux-2.6.32.12/drivers/lguest/core.c
+--- linux-2.6.32.12/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/lguest/core.c	2010-04-04 20:46:41.593451026 -0400
+@@ -91,9 +91,17 @@ static __init int map_switcher(void)
+ 	 * it's worked so far.  The end address needs +1 because __get_vm_area
+ 	 * allocates an extra guard page, so we need space for that.
+ 	 */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
++				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
++				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#else
+ 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+ 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+ 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#endif
++
+ 	if (!switcher_vma) {
+ 		err = -ENOMEM;
+ 		printk("lguest: could not map switcher pages high\n");
+diff -urNp linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c
+--- linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c	2010-04-04 20:46:41.593451026 -0400
+@@ -15,7 +15,7 @@
+ 
+ #define MAX_PMU_LEVEL 0xFF
+ 
+-static struct backlight_ops pmu_backlight_data;
++static const struct backlight_ops pmu_backlight_data;
+ static DEFINE_SPINLOCK(pmu_backlight_lock);
+ static int sleeping, uses_pmu_bl;
+ static u8 bl_curve[FB_BACKLIGHT_LEVELS];
+@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops pmu_backlight_data = {
++static const struct backlight_ops pmu_backlight_data = {
+ 	.get_brightness	= pmu_backlight_get_brightness,
+ 	.update_status	= pmu_backlight_update_status,
+ 
+diff -urNp linux-2.6.32.12/drivers/macintosh/via-pmu.c linux-2.6.32.12/drivers/macintosh/via-pmu.c
+--- linux-2.6.32.12/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/macintosh/via-pmu.c	2010-04-04 20:46:41.593451026 -0400
+@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
+ 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
+ }
+ 
+-static struct platform_suspend_ops pmu_pm_ops = {
++static const struct platform_suspend_ops pmu_pm_ops = {
+ 	.enter = powerbook_sleep,
+ 	.valid = pmu_sleep_valid,
+ };
+diff -urNp linux-2.6.32.12/drivers/md/bitmap.c linux-2.6.32.12/drivers/md/bitmap.c
+--- linux-2.6.32.12/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/md/bitmap.c	2010-04-04 20:46:41.593451026 -0400
+@@ -58,7 +58,7 @@
+ #  if DEBUG > 0
+ #    define PRINTK(x...) printk(KERN_DEBUG x)
+ #  else
+-#    define PRINTK(x...)
++#    define PRINTK(x...) do {} while (0)
+ #  endif
+ #endif
+ 
+diff -urNp linux-2.6.32.12/drivers/md/dm-sysfs.c linux-2.6.32.12/drivers/md/dm-sysfs.c
+--- linux-2.6.32.12/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/md/dm-sysfs.c	2010-04-04 20:46:41.593451026 -0400
+@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops dm_sysfs_ops = {
++static const struct sysfs_ops dm_sysfs_ops = {
+ 	.show	= dm_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/md/dm-table.c linux-2.6.32.12/drivers/md/dm-table.c
+--- linux-2.6.32.12/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/md/dm-table.c	2010-04-04 20:46:41.593451026 -0400
+@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
+ 	if (!dev_size)
+ 		return 0;
+ 
+-	if ((start >= dev_size) || (start + len > dev_size)) {
++	if ((start >= dev_size) || (len > dev_size - start)) {
+ 		DMWARN("%s: %s too small for target: "
+ 		       "start=%llu, len=%llu, dev_size=%llu",
+ 		       dm_device_name(ti->table->md), bdevname(bdev, b),
+diff -urNp linux-2.6.32.12/drivers/md/md.c linux-2.6.32.12/drivers/md/md.c
+--- linux-2.6.32.12/drivers/md/md.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/md/md.c	2010-04-04 20:46:41.597784214 -0400
+@@ -2508,7 +2508,7 @@ static void rdev_free(struct kobject *ko
+ 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
+ 	kfree(rdev);
+ }
+-static struct sysfs_ops rdev_sysfs_ops = {
++static const struct sysfs_ops rdev_sysfs_ops = {
+ 	.show		= rdev_attr_show,
+ 	.store		= rdev_attr_store,
+ };
+@@ -3878,7 +3878,7 @@ static void md_free(struct kobject *ko)
+ 	kfree(mddev);
+ }
+ 
+-static struct sysfs_ops md_sysfs_ops = {
++static const struct sysfs_ops md_sysfs_ops = {
+ 	.show	= md_attr_show,
+ 	.store	= md_attr_store,
+ };
+@@ -6004,7 +6004,7 @@ static int md_seq_show(struct seq_file *
+ 				chunk_kb ? "KB" : "B");
+ 			if (bitmap->file) {
+ 				seq_printf(seq, ", file: ");
+-				seq_path(seq, &bitmap->file->f_path, " \t\n");
++				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
+ 			}
+ 
+ 			seq_printf(seq, "\n");
+@@ -6098,7 +6098,7 @@ static int is_mddev_idle(mddev_t *mddev,
+ 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
+ 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
+ 			      (int)part_stat_read(&disk->part0, sectors[1]) -
+-			      atomic_read(&disk->sync_io);
++			      atomic_read_unchecked(&disk->sync_io);
+ 		/* sync IO will cause sync_io to increase before the disk_stats
+ 		 * as sync_io is counted when a request starts, and
+ 		 * disk_stats is counted when it completes.
+diff -urNp linux-2.6.32.12/drivers/md/md.h linux-2.6.32.12/drivers/md/md.h
+--- linux-2.6.32.12/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/md/md.h	2010-04-04 20:46:41.597784214 -0400
+@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
+ 
+ static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
+ {
+-        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
++	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
+ }
+ 
+ struct mdk_personality
+diff -urNp linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c
+--- linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c	2010-04-04 20:46:41.597784214 -0400
+@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
+ 			const struct dvb_device *template, void *priv, int type)
+ {
+ 	struct dvb_device *dvbdev;
++	/* cannot be const */
+ 	struct file_operations *dvbdevfops;
+ 	struct device *clsdev;
+ 	int minor;
+diff -urNp linux-2.6.32.12/drivers/media/radio/radio-cadet.c linux-2.6.32.12/drivers/media/radio/radio-cadet.c
+--- linux-2.6.32.12/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/media/radio/radio-cadet.c	2010-04-04 20:46:41.597784214 -0400
+@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
+ 	while (i < count && dev->rdsin != dev->rdsout)
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
+diff -urNp linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c
+--- linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c	2010-04-04 20:46:41.597784214 -0400
+@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c
+--- linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c	2010-04-04 20:46:41.597784214 -0400
+@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.12/drivers/message/fusion/mptdebug.h linux-2.6.32.12/drivers/message/fusion/mptdebug.h
+--- linux-2.6.32.12/drivers/message/fusion/mptdebug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/message/fusion/mptdebug.h	2010-04-29 17:46:37.113104605 -0400
+@@ -71,7 +71,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/message/fusion/mptsas.c linux-2.6.32.12/drivers/message/fusion/mptsas.c
+--- linux-2.6.32.12/drivers/message/fusion/mptsas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/message/fusion/mptsas.c	2010-04-29 17:46:37.113104605 -0400
+@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
+ 		return 0;
+ }
+ 
++static inline void
++mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
++{
++	if (phy_info->port_details) {
++		phy_info->port_details->rphy = rphy;
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
++		    ioc->name, rphy));
++	}
++
++	if (rphy) {
++		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
++		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
++		    ioc->name, rphy, rphy->dev.release));
++	}
++}
++
+ /* no mutex */
+ static void
+ mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
+@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
+ 		return NULL;
+ }
+ 
+-static inline void
+-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+-{
+-	if (phy_info->port_details) {
+-		phy_info->port_details->rphy = rphy;
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
+-		    ioc->name, rphy));
+-	}
+-
+-	if (rphy) {
+-		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
+-		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
+-		    ioc->name, rphy, rphy->dev.release));
+-	}
+-}
+-
+ static inline struct sas_port *
+ mptsas_get_port(struct mptsas_phyinfo *phy_info)
+ {
+diff -urNp linux-2.6.32.12/drivers/message/i2o/i2o_proc.c linux-2.6.32.12/drivers/message/i2o/i2o_proc.c
+--- linux-2.6.32.12/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/message/i2o/i2o_proc.c	2010-04-04 20:46:41.597784214 -0400
+@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
+ 	"Array Controller Device"
+ };
+ 
+-static char *chtostr(u8 * chars, int n)
+-{
+-	char tmp[256];
+-	tmp[0] = 0;
+-	return strncat(tmp, (char *)chars, n);
+-}
+-
+ static int i2o_report_query_status(struct seq_file *seq, int block_status,
+ 				   char *group)
+ {
+@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
+ 
+ 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", ddm_table.module_id);
+-		seq_printf(seq, "%-29s",
+-			   chtostr(ddm_table.module_name_version, 28));
++		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
+ 		seq_printf(seq, "%9d  ", ddm_table.data_size);
+ 		seq_printf(seq, "%8d", ddm_table.code_size);
+ 
+@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
+ 
+ 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", dst->module_id);
+-		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
+-		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
++		seq_printf(seq, "%-.28s", dst->module_name_version);
++		seq_printf(seq, "%-.8s", dst->date);
+ 		seq_printf(seq, "%8d ", dst->module_size);
+ 		seq_printf(seq, "%8d ", dst->mpb_size);
+ 		seq_printf(seq, "0x%04x", dst->module_flags);
+@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
+ 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
+ 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
+ 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
+-	seq_printf(seq, "Vendor info   : %s\n",
+-		   chtostr((u8 *) (work32 + 2), 16));
+-	seq_printf(seq, "Product info  : %s\n",
+-		   chtostr((u8 *) (work32 + 6), 16));
+-	seq_printf(seq, "Description   : %s\n",
+-		   chtostr((u8 *) (work32 + 10), 16));
+-	seq_printf(seq, "Product rev.  : %s\n",
+-		   chtostr((u8 *) (work32 + 14), 8));
++	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
++	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
++	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
++	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
+ 
+ 	seq_printf(seq, "Serial number : ");
+ 	print_serial_number(seq, (u8 *) (work32 + 16),
+@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
+ 	}
+ 
+ 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
+-	seq_printf(seq, "Module name         : %s\n",
+-		   chtostr(result.module_name, 24));
+-	seq_printf(seq, "Module revision     : %s\n",
+-		   chtostr(result.module_rev, 8));
++	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
++	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
+ 
+ 	seq_printf(seq, "Serial number       : ");
+ 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
+@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
+ 		return 0;
+ 	}
+ 
+-	seq_printf(seq, "Device name     : %s\n",
+-		   chtostr(result.device_name, 64));
+-	seq_printf(seq, "Service name    : %s\n",
+-		   chtostr(result.service_name, 64));
+-	seq_printf(seq, "Physical name   : %s\n",
+-		   chtostr(result.physical_location, 64));
+-	seq_printf(seq, "Instance number : %s\n",
+-		   chtostr(result.instance_number, 4));
++	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
++	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
++	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
++	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/drivers/misc/kgdbts.c linux-2.6.32.12/drivers/misc/kgdbts.c
+--- linux-2.6.32.12/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/misc/kgdbts.c	2010-04-04 20:46:41.597784214 -0400
+@@ -118,7 +118,7 @@
+ 	} while (0)
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io kgdbts_io_ops;
++static const struct kgdb_io kgdbts_io_ops;
+ static char get_buf[BUFMAX];
+ static int get_buf_cnt;
+ static char put_buf[BUFMAX];
+@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdbts_io_ops = {
++static const struct kgdb_io kgdbts_io_ops = {
+ 	.name			= "kgdbts",
+ 	.read_char		= kgdbts_get_char,
+ 	.write_char		= kgdbts_put_char,
+diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c
+--- linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c	2010-04-04 20:46:41.597784214 -0400
+@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
+ 
+ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
+ {
+-	atomic_long_inc(&mcs_op_statistics[op].count);
+-	atomic_long_add(clks, &mcs_op_statistics[op].total);
++	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
++	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
+ 	if (mcs_op_statistics[op].max < clks)
+ 		mcs_op_statistics[op].max = clks;
+ }
+diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c
+--- linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c	2010-04-04 20:46:41.597784214 -0400
+@@ -32,9 +32,9 @@
+ 
+ #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
+ 
+-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
++static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
+ {
+-	unsigned long val = atomic_long_read(v);
++	unsigned long val = atomic_long_read_unchecked(v);
+ 
+ 	if (val)
+ 		seq_printf(s, "%16lu %s\n", val, id);
+@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
+ 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+ 
+ 	for (op = 0; op < mcsop_last; op++) {
+-		count = atomic_long_read(&mcs_op_statistics[op].count);
+-		total = atomic_long_read(&mcs_op_statistics[op].total);
++		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
++		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
+ 		max = mcs_op_statistics[op].max;
+ 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
+ 			   count ? total / count : 0, max);
+diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h
+--- linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h	2010-04-04 20:46:41.597784214 -0400
+@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
+  * GRU statistics.
+  */
+ struct gru_stats_s {
+-	atomic_long_t vdata_alloc;
+-	atomic_long_t vdata_free;
+-	atomic_long_t gts_alloc;
+-	atomic_long_t gts_free;
+-	atomic_long_t vdata_double_alloc;
+-	atomic_long_t gts_double_allocate;
+-	atomic_long_t assign_context;
+-	atomic_long_t assign_context_failed;
+-	atomic_long_t free_context;
+-	atomic_long_t load_user_context;
+-	atomic_long_t load_kernel_context;
+-	atomic_long_t lock_kernel_context;
+-	atomic_long_t unlock_kernel_context;
+-	atomic_long_t steal_user_context;
+-	atomic_long_t steal_kernel_context;
+-	atomic_long_t steal_context_failed;
+-	atomic_long_t nopfn;
+-	atomic_long_t break_cow;
+-	atomic_long_t asid_new;
+-	atomic_long_t asid_next;
+-	atomic_long_t asid_wrap;
+-	atomic_long_t asid_reuse;
+-	atomic_long_t intr;
+-	atomic_long_t intr_mm_lock_failed;
+-	atomic_long_t call_os;
+-	atomic_long_t call_os_offnode_reference;
+-	atomic_long_t call_os_check_for_bug;
+-	atomic_long_t call_os_wait_queue;
+-	atomic_long_t user_flush_tlb;
+-	atomic_long_t user_unload_context;
+-	atomic_long_t user_exception;
+-	atomic_long_t set_context_option;
+-	atomic_long_t migrate_check;
+-	atomic_long_t migrated_retarget;
+-	atomic_long_t migrated_unload;
+-	atomic_long_t migrated_unload_delay;
+-	atomic_long_t migrated_nopfn_retarget;
+-	atomic_long_t migrated_nopfn_unload;
+-	atomic_long_t tlb_dropin;
+-	atomic_long_t tlb_dropin_fail_no_asid;
+-	atomic_long_t tlb_dropin_fail_upm;
+-	atomic_long_t tlb_dropin_fail_invalid;
+-	atomic_long_t tlb_dropin_fail_range_active;
+-	atomic_long_t tlb_dropin_fail_idle;
+-	atomic_long_t tlb_dropin_fail_fmm;
+-	atomic_long_t tlb_dropin_fail_no_exception;
+-	atomic_long_t tlb_dropin_fail_no_exception_war;
+-	atomic_long_t tfh_stale_on_fault;
+-	atomic_long_t mmu_invalidate_range;
+-	atomic_long_t mmu_invalidate_page;
+-	atomic_long_t mmu_clear_flush_young;
+-	atomic_long_t flush_tlb;
+-	atomic_long_t flush_tlb_gru;
+-	atomic_long_t flush_tlb_gru_tgh;
+-	atomic_long_t flush_tlb_gru_zero_asid;
+-
+-	atomic_long_t copy_gpa;
+-
+-	atomic_long_t mesq_receive;
+-	atomic_long_t mesq_receive_none;
+-	atomic_long_t mesq_send;
+-	atomic_long_t mesq_send_failed;
+-	atomic_long_t mesq_noop;
+-	atomic_long_t mesq_send_unexpected_error;
+-	atomic_long_t mesq_send_lb_overflow;
+-	atomic_long_t mesq_send_qlimit_reached;
+-	atomic_long_t mesq_send_amo_nacked;
+-	atomic_long_t mesq_send_put_nacked;
+-	atomic_long_t mesq_qf_not_full;
+-	atomic_long_t mesq_qf_locked;
+-	atomic_long_t mesq_qf_noop_not_full;
+-	atomic_long_t mesq_qf_switch_head_failed;
+-	atomic_long_t mesq_qf_unexpected_error;
+-	atomic_long_t mesq_noop_unexpected_error;
+-	atomic_long_t mesq_noop_lb_overflow;
+-	atomic_long_t mesq_noop_qlimit_reached;
+-	atomic_long_t mesq_noop_amo_nacked;
+-	atomic_long_t mesq_noop_put_nacked;
++	atomic_long_unchecked_t vdata_alloc;
++	atomic_long_unchecked_t vdata_free;
++	atomic_long_unchecked_t gts_alloc;
++	atomic_long_unchecked_t gts_free;
++	atomic_long_unchecked_t vdata_double_alloc;
++	atomic_long_unchecked_t gts_double_allocate;
++	atomic_long_unchecked_t assign_context;
++	atomic_long_unchecked_t assign_context_failed;
++	atomic_long_unchecked_t free_context;
++	atomic_long_unchecked_t load_user_context;
++	atomic_long_unchecked_t load_kernel_context;
++	atomic_long_unchecked_t lock_kernel_context;
++	atomic_long_unchecked_t unlock_kernel_context;
++	atomic_long_unchecked_t steal_user_context;
++	atomic_long_unchecked_t steal_kernel_context;
++	atomic_long_unchecked_t steal_context_failed;
++	atomic_long_unchecked_t nopfn;
++	atomic_long_unchecked_t break_cow;
++	atomic_long_unchecked_t asid_new;
++	atomic_long_unchecked_t asid_next;
++	atomic_long_unchecked_t asid_wrap;
++	atomic_long_unchecked_t asid_reuse;
++	atomic_long_unchecked_t intr;
++	atomic_long_unchecked_t intr_mm_lock_failed;
++	atomic_long_unchecked_t call_os;
++	atomic_long_unchecked_t call_os_offnode_reference;
++	atomic_long_unchecked_t call_os_check_for_bug;
++	atomic_long_unchecked_t call_os_wait_queue;
++	atomic_long_unchecked_t user_flush_tlb;
++	atomic_long_unchecked_t user_unload_context;
++	atomic_long_unchecked_t user_exception;
++	atomic_long_unchecked_t set_context_option;
++	atomic_long_unchecked_t migrate_check;
++	atomic_long_unchecked_t migrated_retarget;
++	atomic_long_unchecked_t migrated_unload;
++	atomic_long_unchecked_t migrated_unload_delay;
++	atomic_long_unchecked_t migrated_nopfn_retarget;
++	atomic_long_unchecked_t migrated_nopfn_unload;
++	atomic_long_unchecked_t tlb_dropin;
++	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
++	atomic_long_unchecked_t tlb_dropin_fail_upm;
++	atomic_long_unchecked_t tlb_dropin_fail_invalid;
++	atomic_long_unchecked_t tlb_dropin_fail_range_active;
++	atomic_long_unchecked_t tlb_dropin_fail_idle;
++	atomic_long_unchecked_t tlb_dropin_fail_fmm;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
++	atomic_long_unchecked_t tfh_stale_on_fault;
++	atomic_long_unchecked_t mmu_invalidate_range;
++	atomic_long_unchecked_t mmu_invalidate_page;
++	atomic_long_unchecked_t mmu_clear_flush_young;
++	atomic_long_unchecked_t flush_tlb;
++	atomic_long_unchecked_t flush_tlb_gru;
++	atomic_long_unchecked_t flush_tlb_gru_tgh;
++	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
++
++	atomic_long_unchecked_t copy_gpa;
++
++	atomic_long_unchecked_t mesq_receive;
++	atomic_long_unchecked_t mesq_receive_none;
++	atomic_long_unchecked_t mesq_send;
++	atomic_long_unchecked_t mesq_send_failed;
++	atomic_long_unchecked_t mesq_noop;
++	atomic_long_unchecked_t mesq_send_unexpected_error;
++	atomic_long_unchecked_t mesq_send_lb_overflow;
++	atomic_long_unchecked_t mesq_send_qlimit_reached;
++	atomic_long_unchecked_t mesq_send_amo_nacked;
++	atomic_long_unchecked_t mesq_send_put_nacked;
++	atomic_long_unchecked_t mesq_qf_not_full;
++	atomic_long_unchecked_t mesq_qf_locked;
++	atomic_long_unchecked_t mesq_qf_noop_not_full;
++	atomic_long_unchecked_t mesq_qf_switch_head_failed;
++	atomic_long_unchecked_t mesq_qf_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_lb_overflow;
++	atomic_long_unchecked_t mesq_noop_qlimit_reached;
++	atomic_long_unchecked_t mesq_noop_amo_nacked;
++	atomic_long_unchecked_t mesq_noop_put_nacked;
+ 
+ };
+ 
+@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
+ 	cchop_deallocate, tghop_invalidate, mcsop_last};
+ 
+ struct mcs_op_statistic {
+-	atomic_long_t	count;
+-	atomic_long_t	total;
++	atomic_long_unchecked_t	count;
++	atomic_long_unchecked_t	total;
+ 	unsigned long	max;
+ };
+ 
+@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
+ 
+ #define STAT(id)	do {						\
+ 				if (gru_options & OPT_STATS)		\
+-					atomic_long_inc(&gru_stats.id);	\
++					atomic_long_inc_unchecked(&gru_stats.id);	\
+ 			} while (0)
+ 
+ #ifdef CONFIG_SGI_GRU_DEBUG
+diff -urNp linux-2.6.32.12/drivers/mtd/devices/doc2000.c linux-2.6.32.12/drivers/mtd/devices/doc2000.c
+--- linux-2.6.32.12/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/mtd/devices/doc2000.c	2010-04-04 20:46:41.597784214 -0400
+@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
+ 
+ 		/* The ECC will not be calculated correctly if less than 512 is written */
+ /* DBB-
+-		if (len != 0x200 && eccbuf)
++		if (len != 0x200)
+ 			printk(KERN_WARNING
+ 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
+ 			       (long) to, (long) len);
+diff -urNp linux-2.6.32.12/drivers/mtd/devices/doc2001.c linux-2.6.32.12/drivers/mtd/devices/doc2001.c
+--- linux-2.6.32.12/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/mtd/devices/doc2001.c	2010-04-04 20:46:41.597784214 -0400
+@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
+ 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
+ 
+ 	/* Don't allow read past end of device */
+-	if (from >= this->totlen)
++	if (from >= this->totlen || !len)
+ 		return -EINVAL;
+ 
+ 	/* Don't allow a single read to cross a 512-byte block boundary */
+diff -urNp linux-2.6.32.12/drivers/mtd/ubi/build.c linux-2.6.32.12/drivers/mtd/ubi/build.c
+--- linux-2.6.32.12/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/mtd/ubi/build.c	2010-04-04 20:46:41.597784214 -0400
+@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
+ static int __init bytes_str_to_int(const char *str)
+ {
+ 	char *endp;
+-	unsigned long result;
++	unsigned long result, scale = 1;
+ 
+ 	result = simple_strtoul(str, &endp, 0);
+ 	if (str == endp || result >= INT_MAX) {
+@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
+ 
+ 	switch (*endp) {
+ 	case 'G':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'M':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'K':
+-		result *= 1024;
++		scale *= 1024;
+ 		if (endp[1] == 'i' && endp[2] == 'B')
+ 			endp += 2;
+ 	case '\0':
+@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
+ 		return -EINVAL;
+ 	}
+ 
+-	return result;
++	if ((intoverflow_t)result*scale >= INT_MAX) {
++		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
++		       str);
++		return -EINVAL;
++	}
++
++	return result*scale;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.12/drivers/net/e1000e/82571.c linux-2.6.32.12/drivers/net/e1000e/82571.c
+--- linux-2.6.32.12/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/e1000e/82571.c	2010-04-04 20:46:41.597784214 -0400
+@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 	u32 swsm = 0;
+ 	u32 swsm2 = 0;
+@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations e82571_mac_ops = {
++static const struct e1000_mac_operations e82571_mac_ops = {
+ 	/* .check_mng_mode: mac type dependent */
+ 	/* .check_for_link: media type dependent */
+ 	.id_led_init		= e1000e_id_led_init,
+@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_igp = {
++static const struct e1000_phy_operations e82_phy_ops_igp = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= NULL,
+@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_m88 = {
++static const struct e1000_phy_operations e82_phy_ops_m88 = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_bm = {
++static const struct e1000_phy_operations e82_phy_ops_bm = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_nvm_operations e82571_nvm_ops = {
++static const struct e1000_nvm_operations e82571_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_82571,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_82571,
+diff -urNp linux-2.6.32.12/drivers/net/e1000e/e1000.h linux-2.6.32.12/drivers/net/e1000e/e1000.h
+--- linux-2.6.32.12/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/e1000e/e1000.h	2010-04-04 20:46:41.597784214 -0400
+@@ -375,9 +375,9 @@ struct e1000_info {
+ 	u32			pba;
+ 	u32			max_hw_frame_size;
+ 	s32			(*get_variants)(struct e1000_adapter *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ /* hardware capability, feature, and workaround flags */
+diff -urNp linux-2.6.32.12/drivers/net/e1000e/es2lan.c linux-2.6.32.12/drivers/net/e1000e/es2lan.c
+--- linux-2.6.32.12/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/e1000e/es2lan.c	2010-04-04 20:46:41.597784214 -0400
+@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 
+ 	/* Set media type */
+@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations es2_mac_ops = {
++static const struct e1000_mac_operations es2_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000e_check_mng_mode_generic,
+ 	/* check_for_link dependent on media type */
+@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations es2_phy_ops = {
++static const struct e1000_phy_operations es2_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy	 	= e1000e_phy_sw_reset,
+@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
+ 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
+ };
+ 
+-static struct e1000_nvm_operations es2_nvm_ops = {
++static const struct e1000_nvm_operations es2_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_80003es2lan,
+diff -urNp linux-2.6.32.12/drivers/net/e1000e/hw.h linux-2.6.32.12/drivers/net/e1000e/hw.h
+--- linux-2.6.32.12/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.12/drivers/net/e1000e/hw.h	2010-04-04 20:46:41.601781347 -0400
+@@ -756,34 +756,34 @@ struct e1000_mac_operations {
+ 
+ /* Function pointers for the PHY. */
+ struct e1000_phy_operations {
+-	s32  (*acquire_phy)(struct e1000_hw *);
+-	s32  (*check_polarity)(struct e1000_hw *);
+-	s32  (*check_reset_block)(struct e1000_hw *);
+-	s32  (*commit_phy)(struct e1000_hw *);
+-	s32  (*force_speed_duplex)(struct e1000_hw *);
+-	s32  (*get_cfg_done)(struct e1000_hw *hw);
+-	s32  (*get_cable_length)(struct e1000_hw *);
+-	s32  (*get_phy_info)(struct e1000_hw *);
+-	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
+-	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
+-	void (*release_phy)(struct e1000_hw *);
+-	s32  (*reset_phy)(struct e1000_hw *);
+-	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
+-	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
+-	s32  (*cfg_on_link_up)(struct e1000_hw *);
++	s32  (* acquire_phy)(struct e1000_hw *);
++	s32  (* check_polarity)(struct e1000_hw *);
++	s32  (* check_reset_block)(struct e1000_hw *);
++	s32  (* commit_phy)(struct e1000_hw *);
++	s32  (* force_speed_duplex)(struct e1000_hw *);
++	s32  (* get_cfg_done)(struct e1000_hw *hw);
++	s32  (* get_cable_length)(struct e1000_hw *);
++	s32  (* get_phy_info)(struct e1000_hw *);
++	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
++	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
++	void (* release_phy)(struct e1000_hw *);
++	s32  (* reset_phy)(struct e1000_hw *);
++	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
++	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
++	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
++	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
++	s32  (* cfg_on_link_up)(struct e1000_hw *);
+ };
+ 
+ /* Function pointers for the NVM. */
+ struct e1000_nvm_operations {
+-	s32  (*acquire_nvm)(struct e1000_hw *);
+-	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release_nvm)(struct e1000_hw *);
+-	s32  (*update_nvm)(struct e1000_hw *);
+-	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
+-	s32  (*validate_nvm)(struct e1000_hw *);
+-	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire_nvm)(struct e1000_hw *);
++	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release_nvm)(struct e1000_hw *);
++	s32  (* const update_nvm)(struct e1000_hw *);
++	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
++	s32  (* const validate_nvm)(struct e1000_hw *);
++	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_mac_info {
+diff -urNp linux-2.6.32.12/drivers/net/e1000e/ich8lan.c linux-2.6.32.12/drivers/net/e1000e/ich8lan.c
+--- linux-2.6.32.12/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
++++ linux-2.6.32.12/drivers/net/e1000e/ich8lan.c	2010-04-04 20:46:41.601781347 -0400
+@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
+ 	}
+ }
+ 
+-static struct e1000_mac_operations ich8_mac_ops = {
++static const struct e1000_mac_operations ich8_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
+ 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
+@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
+ 	/* id_led_init dependent on mac type */
+ };
+ 
+-static struct e1000_phy_operations ich8_phy_ops = {
++static const struct e1000_phy_operations ich8_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
+ 	.check_reset_block	= e1000_check_reset_block_ich8lan,
+ 	.commit_phy		= NULL,
+@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
+ 	.write_phy_reg		= e1000e_write_phy_reg_igp,
+ };
+ 
+-static struct e1000_nvm_operations ich8_nvm_ops = {
++static const struct e1000_nvm_operations ich8_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
+ 	.read_nvm	 	= e1000_read_nvm_ich8lan,
+ 	.release_nvm		= e1000_release_nvm_ich8lan,
+diff -urNp linux-2.6.32.12/drivers/net/ibmveth.c linux-2.6.32.12/drivers/net/ibmveth.c
+--- linux-2.6.32.12/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/ibmveth.c	2010-04-04 20:46:41.601781347 -0400
+@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops veth_pool_ops = {
++static const struct sysfs_ops veth_pool_ops = {
+ 	.show   = veth_pool_show,
+ 	.store  = veth_pool_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/net/igb/e1000_82575.c linux-2.6.32.12/drivers/net/igb/e1000_82575.c
+--- linux-2.6.32.12/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.12/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:58.193505226 -0400
+@@ -1401,7 +1401,7 @@ void igb_vmdq_set_replication_pf(struct 
+ 	wr32(E1000_VT_CTL, vt_ctl);
+ }
+ 
+-static struct e1000_mac_operations e1000_mac_ops_82575 = {
++static const struct e1000_mac_operations e1000_mac_ops_82575 = {
+ 	.reset_hw             = igb_reset_hw_82575,
+ 	.init_hw              = igb_init_hw_82575,
+ 	.check_for_link       = igb_check_for_link_82575,
+@@ -1410,13 +1410,13 @@ static struct e1000_mac_operations e1000
+ 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
+ };
+ 
+-static struct e1000_phy_operations e1000_phy_ops_82575 = {
++static const struct e1000_phy_operations e1000_phy_ops_82575 = {
+ 	.acquire              = igb_acquire_phy_82575,
+ 	.get_cfg_done         = igb_get_cfg_done_82575,
+ 	.release              = igb_release_phy_82575,
+ };
+ 
+-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
++static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
+ 	.acquire              = igb_acquire_nvm_82575,
+ 	.read                 = igb_read_nvm_eerd,
+ 	.release              = igb_release_nvm_82575,
+diff -urNp linux-2.6.32.12/drivers/net/igb/e1000_hw.h linux-2.6.32.12/drivers/net/igb/e1000_hw.h
+--- linux-2.6.32.12/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.12/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:58.197572571 -0400
+@@ -303,17 +303,17 @@ struct e1000_phy_operations {
+ };
+ 
+ struct e1000_nvm_operations {
+-	s32  (*acquire)(struct e1000_hw *);
+-	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release)(struct e1000_hw *);
+-	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire)(struct e1000_hw *);
++	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release)(struct e1000_hw *);
++	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_info {
+ 	s32 (*get_invariants)(struct e1000_hw *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ extern const struct e1000_info e1000_82575_info;
+diff -urNp linux-2.6.32.12/drivers/net/irda/vlsi_ir.c linux-2.6.32.12/drivers/net/irda/vlsi_ir.c
+--- linux-2.6.32.12/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/irda/vlsi_ir.c	2010-04-04 20:46:41.601781347 -0400
+@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
+ 			/* no race - tx-ring already empty */
+ 			vlsi_set_baud(idev, iobase);
+ 			netif_wake_queue(ndev);
+-		}
+-		else
+-			;
++		} else {
+ 			/* keep the speed change pending like it would
+ 			 * for any len>0 packet. tx completion interrupt
+ 			 * will apply it when the tx ring becomes empty.
+ 			 */
++		}
+ 		spin_unlock_irqrestore(&idev->lock, flags);
+ 		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+diff -urNp linux-2.6.32.12/drivers/net/iseries_veth.c linux-2.6.32.12/drivers/net/iseries_veth.c
+--- linux-2.6.32.12/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/iseries_veth.c	2010-04-04 20:46:41.601781347 -0400
+@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_cnx_sysfs_ops = {
++static const struct sysfs_ops veth_cnx_sysfs_ops = {
+ 		.show = veth_cnx_attribute_show
+ };
+ 
+@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_port_sysfs_ops = {
++static const struct sysfs_ops veth_port_sysfs_ops = {
+ 	.show = veth_port_attribute_show
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/net/pcnet32.c linux-2.6.32.12/drivers/net/pcnet32.c
+--- linux-2.6.32.12/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/pcnet32.c	2010-04-04 20:46:41.601781347 -0400
+@@ -79,7 +79,7 @@ static int cards_found;
+ /*
+  * VLB I/O addresses
+  */
+-static unsigned int pcnet32_portlist[] __initdata =
++static unsigned int pcnet32_portlist[] __devinitdata =
+     { 0x300, 0x320, 0x340, 0x360, 0 };
+ 
+ static int pcnet32_debug = 0;
+diff -urNp linux-2.6.32.12/drivers/net/tg3.h linux-2.6.32.12/drivers/net/tg3.h
+--- linux-2.6.32.12/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
++++ linux-2.6.32.12/drivers/net/tg3.h	2010-04-04 20:46:41.601781347 -0400
+@@ -95,6 +95,7 @@
+ #define  CHIPREV_ID_5750_A0		 0x4000
+ #define  CHIPREV_ID_5750_A1		 0x4001
+ #define  CHIPREV_ID_5750_A3		 0x4003
++#define  CHIPREV_ID_5750_C1		 0x4201
+ #define  CHIPREV_ID_5750_C2		 0x4202
+ #define  CHIPREV_ID_5752_A0_HW		 0x5000
+ #define  CHIPREV_ID_5752_A0		 0x6000
+diff -urNp linux-2.6.32.12/drivers/net/tulip/de4x5.c linux-2.6.32.12/drivers/net/tulip/de4x5.c
+--- linux-2.6.32.12/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/tulip/de4x5.c	2010-04-04 20:46:41.601781347 -0400
+@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	for (i=0; i<ETH_ALEN; i++) {
+ 	    tmp.addr[i] = dev->dev_addr[i];
+ 	}
+-	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
++	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+ 	break;
+ 
+     case DE4X5_SET_HWADDR:           /* Set the hardware address */
+@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 	memcpy(&statbuf, &lp->pktStats, ioc->len);
+ 	spin_unlock_irqrestore(&lp->lock, flags);
+-	if (copy_to_user(ioc->data, &statbuf, ioc->len))
++	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
+ 		return -EFAULT;
+ 	break;
+     }
+diff -urNp linux-2.6.32.12/drivers/net/usb/hso.c linux-2.6.32.12/drivers/net/usb/hso.c
+--- linux-2.6.32.12/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/usb/hso.c	2010-04-04 20:46:41.605567348 -0400
+@@ -258,7 +258,7 @@ struct hso_serial {
+ 
+ 	/* from usb_serial_port */
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 	spinlock_t serial_lock;
+ 
+ 	int (*write_data) (struct hso_serial *serial);
+@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
+ 	struct urb *urb;
+ 
+ 	urb = serial->rx_urb[0];
+-	if (serial->open_count > 0) {
++	if (atomic_read(&serial->open_count) > 0) {
+ 		count = put_rxbuf_data(urb, serial);
+ 		if (count == -1)
+ 			return;
+@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
+ 	DUMP1(urb->transfer_buffer, urb->actual_length);
+ 
+ 	/* Anyone listening? */
+-	if (serial->open_count == 0)
++	if (atomic_read(&serial->open_count) == 0)
+ 		return;
+ 
+ 	if (status == 0) {
+@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
+ 	spin_unlock_irq(&serial->serial_lock);
+ 
+ 	/* check for port already opened, if not set the termios */
+-	serial->open_count++;
+-	if (serial->open_count == 1) {
++	if (atomic_inc_return(&serial->open_count) == 1) {
+ 		tty->low_latency = 1;
+ 		serial->rx_state = RX_IDLE;
+ 		/* Force default termio settings */
+@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
+ 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
+ 		if (result) {
+ 			hso_stop_serial_device(serial->parent);
+-			serial->open_count--;
++			atomic_dec(&serial->open_count);
+ 			kref_put(&serial->parent->ref, hso_serial_ref_free);
+ 		}
+ 	} else {
+@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
+ 
+ 	/* reset the rts and dtr */
+ 	/* do the actual close */
+-	serial->open_count--;
++	atomic_dec(&serial->open_count);
+ 
+-	if (serial->open_count <= 0) {
+-		serial->open_count = 0;
++	if (atomic_read(&serial->open_count) <= 0) {
++		atomic_set(&serial->open_count,  0);
+ 		spin_lock_irq(&serial->serial_lock);
+ 		if (serial->tty == tty) {
+ 			serial->tty->driver_data = NULL;
+@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
+ 
+ 	/* the actual setup */
+ 	spin_lock_irqsave(&serial->serial_lock, flags);
+-	if (serial->open_count)
++	if (atomic_read(&serial->open_count))
+ 		_hso_serial_set_termios(tty, old);
+ 	else
+ 		tty->termios = old;
+@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
+ 	/* Start all serial ports */
+ 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
+ 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
+-			if (dev2ser(serial_table[i])->open_count) {
++			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
+ 				result =
+ 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
+ 				hso_kick_transmit(dev2ser(serial_table[i]));
+diff -urNp linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c
+--- linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c	2010-04-04 20:46:41.605567348 -0400
+@@ -43,7 +43,7 @@ static struct dentry *rootdir;
+ struct b43_debugfs_fops {
+ 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
+ 	size_t file_struct_offset;
+ };
+diff -urNp linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c
+--- linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c	2010-04-04 20:46:41.605567348 -0400
+@@ -44,7 +44,7 @@ static struct dentry *rootdir;
+ struct b43legacy_debugfs_fops {
+ 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
+ 	size_t file_struct_offset;
+ 	/* Take wl->irq_lock before calling read/write? */
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-04-04 20:46:41.605567348 -0400
+@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 	 },
+ };
+ 
+-static struct iwl_ops iwl1000_ops = {
++static const struct iwl_ops iwl1000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl1000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:46:41.605567348 -0400
+@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
+ 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+ };
+ 
+-static struct iwl_ops iwl3945_ops = {
++static const struct iwl_ops iwl3945_ops = {
+ 	.ucode = &iwl3945_ucode,
+ 	.lib = &iwl3945_lib,
+ 	.hcmd = &iwl3945_hcmd,
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:38.221487644 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:58.277496729 -0400
+@@ -2340,7 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
+ 	},
+ };
+ 
+-static struct iwl_ops iwl4965_ops = {
++static const struct iwl_ops iwl4965_ops = {
+ 	.ucode = &iwl4965_ucode,
+ 	.lib = &iwl4965_lib,
+ 	.hcmd = &iwl4965_hcmd,
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:38.221487644 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:58.285504530 -0400
+@@ -1628,14 +1628,14 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 	 },
+ };
+ 
+-struct iwl_ops iwl5000_ops = {
++const struct iwl_ops iwl5000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+ 	.utils = &iwl5000_hcmd_utils,
+ };
+ 
+-static struct iwl_ops iwl5150_ops = {
++static const struct iwl_ops iwl5150_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5150_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-04-04 20:46:41.605567348 -0400
+@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
+ 	.calc_rssi = iwl5000_calc_rssi,
+ };
+ 
+-static struct iwl_ops iwl6000_ops = {
++static const struct iwl_ops iwl6000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl6000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-04-29 17:46:37.170092362 -0400
+@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
+ #endif
+ 
+ #else
+-#define IWL_DEBUG(__priv, level, fmt, args...)
+-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
++#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
++#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
+ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
+ 				      void *p, u32 len)
+ {}
+diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-04-04 20:46:41.605567348 -0400
+@@ -67,7 +67,7 @@ struct iwl_tx_queue;
+ 
+ /* shared structures from iwl-5000.c */
+ extern struct iwl_mod_params iwl50_mod_params;
+-extern struct iwl_ops iwl5000_ops;
++extern const struct iwl_ops iwl5000_ops;
+ extern struct iwl_ucode_ops iwl5000_ucode;
+ extern struct iwl_lib_ops iwl5000_lib;
+ extern struct iwl_hcmd_ops iwl5000_hcmd;
+diff -urNp linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c
+--- linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c	2010-04-04 20:46:41.605567348 -0400
+@@ -708,7 +708,7 @@ out_unlock:
+ struct lbs_debugfs_files {
+ 	const char *name;
+ 	int perm;
+-	struct file_operations fops;
++	const struct file_operations fops;
+ };
+ 
+ static const struct lbs_debugfs_files debugfs_files[] = {
+diff -urNp linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c	2010-04-29 17:46:37.185749089 -0400
+@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
+ 
+ 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
+ 
+-	if (rts_threshold < 0 || rts_threshold > 2347)
++	if (rts_threshold > 2347)
+ 		rts_threshold = 2347;
+ 
+ 	tmp = cpu_to_le32(rts_threshold);
+diff -urNp linux-2.6.32.12/drivers/oprofile/buffer_sync.c linux-2.6.32.12/drivers/oprofile/buffer_sync.c
+--- linux-2.6.32.12/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/buffer_sync.c	2010-04-04 20:46:41.605567348 -0400
+@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
+ 		if (cookie == NO_COOKIE)
+ 			offset = pc;
+ 		if (cookie == INVALID_COOKIE) {
+-			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 			offset = pc;
+ 		}
+ 		if (cookie != last_cookie) {
+@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
+ 	/* add userspace sample */
+ 
+ 	if (!mm) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mm);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
+ 		return 0;
+ 	}
+ 
+ 	cookie = lookup_dcookie(mm, s->eip, &offset);
+ 
+ 	if (cookie == INVALID_COOKIE) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 		return 0;
+ 	}
+ 
+@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
+ 		/* ignore backtraces if failed to add a sample */
+ 		if (state == sb_bt_start) {
+ 			state = sb_bt_ignore;
+-			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
+ 		}
+ 	}
+ 	release_mm(mm);
+diff -urNp linux-2.6.32.12/drivers/oprofile/event_buffer.c linux-2.6.32.12/drivers/oprofile/event_buffer.c
+--- linux-2.6.32.12/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/event_buffer.c	2010-04-04 20:46:41.605567348 -0400
+@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
+ 	}
+ 
+ 	if (buffer_pos == buffer_size) {
+-		atomic_inc(&oprofile_stats.event_lost_overflow);
++		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
+ 		return;
+ 	}
+ 
+diff -urNp linux-2.6.32.12/drivers/oprofile/oprof.c linux-2.6.32.12/drivers/oprofile/oprof.c
+--- linux-2.6.32.12/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/oprof.c	2010-04-04 20:46:41.605567348 -0400
+@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
+ 	if (oprofile_ops.switch_events())
+ 		return;
+ 
+-	atomic_inc(&oprofile_stats.multiplex_counter);
++	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
+ 	start_switch_worker();
+ }
+ 
+diff -urNp linux-2.6.32.12/drivers/oprofile/oprofilefs.c linux-2.6.32.12/drivers/oprofile/oprofilefs.c
+--- linux-2.6.32.12/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/oprofilefs.c	2010-04-04 20:46:41.609229988 -0400
+@@ -187,7 +187,7 @@ static const struct file_operations atom
+ 
+ 
+ int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
+-	char const *name, atomic_t *val)
++	char const *name, atomic_unchecked_t *val)
+ {
+ 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
+ 						     &atomic_ro_fops, 0444);
+diff -urNp linux-2.6.32.12/drivers/oprofile/oprofile_stats.c linux-2.6.32.12/drivers/oprofile/oprofile_stats.c
+--- linux-2.6.32.12/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/oprofile_stats.c	2010-04-04 20:46:41.609229988 -0400
+@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
+ 		cpu_buf->sample_invalid_eip = 0;
+ 	}
+ 
+-	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
+-	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.event_lost_overflow, 0);
+-	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.multiplex_counter, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
++	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/oprofile/oprofile_stats.h linux-2.6.32.12/drivers/oprofile/oprofile_stats.h
+--- linux-2.6.32.12/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/oprofile/oprofile_stats.h	2010-04-04 20:46:41.609229988 -0400
+@@ -13,11 +13,11 @@
+ #include <asm/atomic.h>
+ 
+ struct oprofile_stat_struct {
+-	atomic_t sample_lost_no_mm;
+-	atomic_t sample_lost_no_mapping;
+-	atomic_t bt_lost_no_mapping;
+-	atomic_t event_lost_overflow;
+-	atomic_t multiplex_counter;
++	atomic_unchecked_t sample_lost_no_mm;
++	atomic_unchecked_t sample_lost_no_mapping;
++	atomic_unchecked_t bt_lost_no_mapping;
++	atomic_unchecked_t event_lost_overflow;
++	atomic_unchecked_t multiplex_counter;
+ };
+ 
+ extern struct oprofile_stat_struct oprofile_stats;
+diff -urNp linux-2.6.32.12/drivers/parisc/pdc_stable.c linux-2.6.32.12/drivers/parisc/pdc_stable.c
+--- linux-2.6.32.12/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/parisc/pdc_stable.c	2010-04-04 20:46:41.609229988 -0400
+@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops pdcspath_attr_ops = {
++static const struct sysfs_ops pdcspath_attr_ops = {
+ 	.show = pdcspath_attr_show,
+ 	.store = pdcspath_attr_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/parport/procfs.c linux-2.6.32.12/drivers/parport/procfs.c
+--- linux-2.6.32.12/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/parport/procfs.c	2010-04-04 20:46:41.609229988 -0400
+@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
+ }
+ 
+ #ifdef CONFIG_PARPORT_1284
+@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
+ }
+ #endif /* IEEE1284.3 support. */
+ 
+diff -urNp linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c
+--- linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c	2010-04-04 20:46:41.609229988 -0400
+@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
+ }
+ 
+ 
+-static struct acpi_dock_ops acpiphp_dock_ops = {
++static const struct acpi_dock_ops acpiphp_dock_ops = {
+ 	.handler = handle_hotplug_event_func,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c
+--- linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c	2010-04-04 20:46:41.609229988 -0400
+@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
+ 
+ void compaq_nvram_init (void __iomem *rom_start)
+ {
++
++#ifndef CONFIG_PAX_KERNEXEC
+ 	if (rom_start) {
+ 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
+ 	}
++#endif
++
+ 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
+ 
+ 	/* initialize our int15 lock */
+diff -urNp linux-2.6.32.12/drivers/pci/hotplug/fakephp.c linux-2.6.32.12/drivers/pci/hotplug/fakephp.c
+--- linux-2.6.32.12/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/hotplug/fakephp.c	2010-04-04 20:46:41.609229988 -0400
+@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
+ }
+ 
+ static struct kobj_type legacy_ktype = {
+-	.sysfs_ops = &(struct sysfs_ops){
++	.sysfs_ops = &(const struct sysfs_ops){
+ 		.store = legacy_store, .show = legacy_show
+ 	},
+ 	.release = &legacy_release,
+diff -urNp linux-2.6.32.12/drivers/pci/intel-iommu.c linux-2.6.32.12/drivers/pci/intel-iommu.c
+--- linux-2.6.32.12/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/intel-iommu.c	2010-04-04 20:46:41.609229988 -0400
+@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
+ 	return !dma_addr;
+ }
+ 
+-struct dma_map_ops intel_dma_ops = {
++const struct dma_map_ops intel_dma_ops = {
+ 	.alloc_coherent = intel_alloc_coherent,
+ 	.free_coherent = intel_free_coherent,
+ 	.map_sg = intel_map_sg,
+diff -urNp linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c
+--- linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c	2010-04-04 20:46:41.609229988 -0400
+@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
+ static const struct pci_device_id port_pci_ids[] = { {
+ 	/* handle any PCI-Express port */
+ 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, port_pci_ids);
+ 
+diff -urNp linux-2.6.32.12/drivers/pci/probe.c linux-2.6.32.12/drivers/pci/probe.c
+--- linux-2.6.32.12/drivers/pci/probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/probe.c	2010-04-29 17:46:37.193749810 -0400
+@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
+ 	return ret;
+ }
+ 
+-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+ 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
+ }
+ 
+-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+diff -urNp linux-2.6.32.12/drivers/pci/proc.c linux-2.6.32.12/drivers/pci/proc.c
+--- linux-2.6.32.12/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/proc.c	2010-04-04 20:46:41.609229988 -0400
+@@ -480,7 +480,16 @@ static const struct file_operations proc
+ static int __init pci_proc_init(void)
+ {
+ 	struct pci_dev *dev = NULL;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
++#endif
+ 	proc_create("devices", 0, proc_bus_pci_dir,
+ 		    &proc_bus_pci_dev_operations);
+ 	proc_initialized = 1;
+diff -urNp linux-2.6.32.12/drivers/pci/slot.c linux-2.6.32.12/drivers/pci/slot.c
+--- linux-2.6.32.12/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pci/slot.c	2010-04-04 20:46:41.609229988 -0400
+@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
+ 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
+ }
+ 
+-static struct sysfs_ops pci_slot_sysfs_ops = {
++static const struct sysfs_ops pci_slot_sysfs_ops = {
+ 	.show = pci_slot_attr_show,
+ 	.store = pci_slot_attr_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/pcmcia/ti113x.h linux-2.6.32.12/drivers/pcmcia/ti113x.h
+--- linux-2.6.32.12/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pcmcia/ti113x.h	2010-04-04 20:46:41.609229988 -0400
+@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
+ 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
+ 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
+ 
+-	{}
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
+diff -urNp linux-2.6.32.12/drivers/pcmcia/yenta_socket.c linux-2.6.32.12/drivers/pcmcia/yenta_socket.c
+--- linux-2.6.32.12/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pcmcia/yenta_socket.c	2010-04-04 20:46:41.609229988 -0400
+@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
+ 
+ 	/* match any cardbus bridge */
+ 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
+-	{ /* all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, yenta_table);
+ 
+diff -urNp linux-2.6.32.12/drivers/platform/x86/acer-wmi.c linux-2.6.32.12/drivers/platform/x86/acer-wmi.c
+--- linux-2.6.32.12/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/acer-wmi.c	2010-04-04 20:46:41.609229988 -0400
+@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
+ 	return 0;
+ }
+ 
+-static struct backlight_ops acer_bl_ops = {
++static const struct backlight_ops acer_bl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/asus_acpi.c linux-2.6.32.12/drivers/platform/x86/asus_acpi.c
+--- linux-2.6.32.12/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/asus_acpi.c	2010-04-04 20:46:41.609229988 -0400
+@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
+ 	return 0;
+ }
+ 
+-static struct backlight_ops asus_backlight_data = {
++static const struct backlight_ops asus_backlight_data = {
+ 	.get_brightness = read_brightness,
+ 	.update_status  = set_brightness_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/asus-laptop.c linux-2.6.32.12/drivers/platform/x86/asus-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/asus-laptop.c	2010-04-04 20:46:41.609229988 -0400
+@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops asusbl_ops = {
++static const struct backlight_ops asusbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/compal-laptop.c linux-2.6.32.12/drivers/platform/x86/compal-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/compal-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops compalbl_ops = {
++static const struct backlight_ops compalbl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status	= bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/dell-laptop.c linux-2.6.32.12/drivers/platform/x86/dell-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/dell-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
+ 	return buffer.output[1];
+ }
+ 
+-static struct backlight_ops dell_ops = {
++static const struct backlight_ops dell_ops = {
+ 	.get_brightness = dell_get_intensity,
+ 	.update_status  = dell_send_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:38.317493070 -0400
++++ linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:58.337509449 -0400
+@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops eeepcbl_ops = {
++static const struct backlight_ops eeepcbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
+ 	return ret;
+ }
+ 
+-static struct backlight_ops fujitsubl_ops = {
++static const struct backlight_ops fujitsubl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status = bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/msi-laptop.c linux-2.6.32.12/drivers/platform/x86/msi-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/msi-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops msibl_ops = {
++static const struct backlight_ops msibl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status  = bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
+ 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
+ }
+ 
+-static struct backlight_ops pcc_backlight_ops = {
++static const struct backlight_ops pcc_backlight_ops = {
+ 	.get_brightness	= bl_get,
+ 	.update_status	= bl_set_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/sony-laptop.c linux-2.6.32.12/drivers/platform/x86/sony-laptop.c
+--- linux-2.6.32.12/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/sony-laptop.c	2010-04-04 20:46:41.612789562 -0400
+@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
+ }
+ 
+ static struct backlight_device *sony_backlight_device;
+-static struct backlight_ops sony_backlight_ops = {
++static const struct backlight_ops sony_backlight_ops = {
+ 	.update_status = sony_backlight_update_status,
+ 	.get_brightness = sony_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c
+--- linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 17:49:38.333363657 -0400
++++ linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 18:04:08.901389713 -0400
+@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
+ 			       BACKLIGHT_UPDATE_HOTKEY);
+ }
+ 
+-static struct backlight_ops ibm_backlight_data = {
++static const struct backlight_ops ibm_backlight_data = {
+ 	.get_brightness = brightness_get,
+ 	.update_status  = brightness_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c
+--- linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c	2010-04-04 20:46:41.612789562 -0400
+@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
+ 	return AE_OK;
+ }
+ 
+-static struct backlight_ops toshiba_backlight_data = {
++static const struct backlight_ops toshiba_backlight_data = {
+         .get_brightness = get_lcd,
+         .update_status  = set_lcd_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c
+--- linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c	2010-04-04 20:46:41.612789562 -0400
+@@ -60,7 +60,7 @@ do { \
+ 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
+ } while(0)
+ 
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ /*
+@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
+ 
+ 	cpu = get_cpu();
+ 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
++
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
+ 	spin_lock_irqsave(&pnp_bios_lock, flags);
+@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
+ 			     :"memory");
+ 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
+ 
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	/* If we get here and this is set then the PnP BIOS faulted on us. */
+@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
+ 	return status;
+ }
+ 
+-void pnpbios_calls_init(union pnp_bios_install_struct *header)
++void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
+ {
+ 	int i;
+ 
+@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
+ 	pnp_bios_callpoint.offset = header->fields.pm16offset;
+ 	pnp_bios_callpoint.segment = PNP_CS16;
+ 
++	pax_open_kernel();
++
+ 	for_each_possible_cpu(i) {
+ 		struct desc_struct *gdt = get_cpu_gdt_table(i);
+ 		if (!gdt)
+@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
+ 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
+ 			 (unsigned long)__va(header->fields.pm16dseg));
+ 	}
++
++	pax_close_kernel();
+ }
+diff -urNp linux-2.6.32.12/drivers/pnp/quirks.c linux-2.6.32.12/drivers/pnp/quirks.c
+--- linux-2.6.32.12/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pnp/quirks.c	2010-04-04 20:46:41.612789562 -0400
+@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
+ 	/* PnP resources that might overlap PCI BARs */
+ 	{"PNP0c01", quirk_system_pci_resources},
+ 	{"PNP0c02", quirk_system_pci_resources},
+-	{""}
++	{"", NULL}
+ };
+ 
+ void pnp_fixup_device(struct pnp_dev *dev)
+diff -urNp linux-2.6.32.12/drivers/pnp/resource.c linux-2.6.32.12/drivers/pnp/resource.c
+--- linux-2.6.32.12/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/pnp/resource.c	2010-04-04 20:46:41.612789562 -0400
+@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*irq < 0 || *irq > 15)
++	if (*irq > 15)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*dma < 0 || *dma == 4 || *dma > 7)
++	if (*dma == 4 || *dma > 7)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+diff -urNp linux-2.6.32.12/drivers/s390/cio/qdio_perf.c linux-2.6.32.12/drivers/s390/cio/qdio_perf.c
+--- linux-2.6.32.12/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/s390/cio/qdio_perf.c	2010-04-04 20:46:41.612789562 -0400
+@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
+ static int qdio_perf_proc_show(struct seq_file *m, void *v)
+ {
+ 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.qdio_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
+ 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.pci_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
+ 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thin_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
+ 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
+ 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
+ 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound),
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_in));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
+ 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_out));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
+ 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_sync));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.inbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
+ 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.fast_requeue));
++		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
+ 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_target_full));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
+ 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
+ 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
+ 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
+ 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
+ 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
+ 	seq_printf(m, "\n");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/drivers/s390/cio/qdio_perf.h linux-2.6.32.12/drivers/s390/cio/qdio_perf.h
+--- linux-2.6.32.12/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/s390/cio/qdio_perf.h	2010-04-04 20:46:41.612789562 -0400
+@@ -13,46 +13,46 @@
+ 
+ struct qdio_perf_stats {
+ 	/* interrupt handler calls */
+-	atomic_long_t qdio_int;
+-	atomic_long_t pci_int;
+-	atomic_long_t thin_int;
++	atomic_long_unchecked_t qdio_int;
++	atomic_long_unchecked_t pci_int;
++	atomic_long_unchecked_t thin_int;
+ 
+ 	/* tasklet runs */
+-	atomic_long_t tasklet_inbound;
+-	atomic_long_t tasklet_outbound;
+-	atomic_long_t tasklet_thinint;
+-	atomic_long_t tasklet_thinint_loop;
+-	atomic_long_t thinint_inbound;
+-	atomic_long_t thinint_inbound_loop;
+-	atomic_long_t thinint_inbound_loop2;
++	atomic_long_unchecked_t tasklet_inbound;
++	atomic_long_unchecked_t tasklet_outbound;
++	atomic_long_unchecked_t tasklet_thinint;
++	atomic_long_unchecked_t tasklet_thinint_loop;
++	atomic_long_unchecked_t thinint_inbound;
++	atomic_long_unchecked_t thinint_inbound_loop;
++	atomic_long_unchecked_t thinint_inbound_loop2;
+ 
+ 	/* signal adapter calls */
+-	atomic_long_t siga_out;
+-	atomic_long_t siga_in;
+-	atomic_long_t siga_sync;
++	atomic_long_unchecked_t siga_out;
++	atomic_long_unchecked_t siga_in;
++	atomic_long_unchecked_t siga_sync;
+ 
+ 	/* misc */
+-	atomic_long_t inbound_handler;
+-	atomic_long_t outbound_handler;
+-	atomic_long_t fast_requeue;
+-	atomic_long_t outbound_target_full;
++	atomic_long_unchecked_t inbound_handler;
++	atomic_long_unchecked_t outbound_handler;
++	atomic_long_unchecked_t fast_requeue;
++	atomic_long_unchecked_t outbound_target_full;
+ 
+ 	/* for debugging */
+-	atomic_long_t debug_tl_out_timer;
+-	atomic_long_t debug_stop_polling;
+-	atomic_long_t debug_eqbs_all;
+-	atomic_long_t debug_eqbs_incomplete;
+-	atomic_long_t debug_sqbs_all;
+-	atomic_long_t debug_sqbs_incomplete;
++	atomic_long_unchecked_t debug_tl_out_timer;
++	atomic_long_unchecked_t debug_stop_polling;
++	atomic_long_unchecked_t debug_eqbs_all;
++	atomic_long_unchecked_t debug_eqbs_incomplete;
++	atomic_long_unchecked_t debug_sqbs_all;
++	atomic_long_unchecked_t debug_sqbs_incomplete;
+ };
+ 
+ extern struct qdio_perf_stats perf_stats;
+ extern int qdio_performance_stats;
+ 
+-static inline void qdio_perf_stat_inc(atomic_long_t *count)
++static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
+ {
+ 	if (qdio_performance_stats)
+-		atomic_long_inc(count);
++		atomic_long_inc_unchecked(count);
+ }
+ 
+ int qdio_setup_perf_stats(void);
+diff -urNp linux-2.6.32.12/drivers/scsi/ipr.c linux-2.6.32.12/drivers/scsi/ipr.c
+--- linux-2.6.32.12/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/ipr.c	2010-04-04 20:46:41.616874360 -0400
+@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
+ 	return true;
+ }
+ 
+-static struct ata_port_operations ipr_sata_ops = {
++static const struct ata_port_operations ipr_sata_ops = {
+ 	.phy_reset = ipr_ata_phy_reset,
+ 	.hardreset = ipr_sata_reset,
+ 	.post_internal_cmd = ipr_ata_post_internal,
+diff -urNp linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c
+--- linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c	2010-04-04 20:46:41.616874360 -0400
+@@ -86,12 +86,12 @@ struct fc_exch_mgr {
+ 	 * all together if not used XXX
+ 	 */
+ 	struct {
+-		atomic_t no_free_exch;
+-		atomic_t no_free_exch_xid;
+-		atomic_t xid_not_found;
+-		atomic_t xid_busy;
+-		atomic_t seq_not_found;
+-		atomic_t non_bls_resp;
++		atomic_unchecked_t no_free_exch;
++		atomic_unchecked_t no_free_exch_xid;
++		atomic_unchecked_t xid_not_found;
++		atomic_unchecked_t xid_busy;
++		atomic_unchecked_t seq_not_found;
++		atomic_unchecked_t non_bls_resp;
+ 	} stats;
+ };
+ #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
+@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
+ 	/* allocate memory for exchange */
+ 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.no_free_exch);
++		atomic_inc_unchecked(&mp->stats.no_free_exch);
+ 		goto out;
+ 	}
+ 	memset(ep, 0, sizeof(*ep));
+@@ -557,7 +557,7 @@ out:
+ 	return ep;
+ err:
+ 	spin_unlock_bh(&pool->lock);
+-	atomic_inc(&mp->stats.no_free_exch_xid);
++	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
+ 	mempool_free(ep, mp->ep_pool);
+ 	return NULL;
+ }
+@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
+ 		ep = fc_exch_find(mp, xid);
+ 		if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_OX_ID;
+ 			goto out;
+ 		}
+@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		ep = fc_exch_find(mp, xid);
+ 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
+ 			if (ep) {
+-				atomic_inc(&mp->stats.xid_busy);
++				atomic_inc_unchecked(&mp->stats.xid_busy);
+ 				reject = FC_RJT_RX_ID;
+ 				goto rel;
+ 			}
+@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 			}
+ 			xid = ep->xid;	/* get our XID */
+ 		} else if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_RX_ID;	/* XID not found */
+ 			goto out;
+ 		}
+@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
+ 			goto rel;
+ 		}
+@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
+ 
+ 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->esb_stat & ESB_ST_COMPLETE) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->rxid == FC_XID_UNKNOWN)
+ 		ep->rxid = ntohs(fh->fh_rx_id);
+ 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	if (ep->did != ntoh24(fh->fh_s_id) &&
+ 	    ep->did != FC_FID_FLOGI) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	sof = fr_sof(fp);
+@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			goto rel;
+ 		}
+ 	}
+@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
+ 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
+ 
+ 	if (!sp)
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 	else
+-		atomic_inc(&mp->stats.non_bls_resp);
++		atomic_inc_unchecked(&mp->stats.non_bls_resp);
+ 
+ 	fc_frame_free(fp);
+ }
+diff -urNp linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c
+--- linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c	2010-04-04 20:46:41.616874360 -0400
+@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
+ 	}
+ }
+ 
+-static struct ata_port_operations sas_sata_ops = {
++static const struct ata_port_operations sas_sata_ops = {
+ 	.phy_reset		= sas_ata_phy_reset,
+ 	.post_internal_cmd	= sas_ata_post_internal,
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h
+--- linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-04-29 17:46:37.209772088 -0400
+@@ -79,7 +79,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
+ 
+ 
+diff -urNp linux-2.6.32.12/drivers/scsi/scsi_logging.h linux-2.6.32.12/drivers/scsi/scsi_logging.h
+--- linux-2.6.32.12/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/scsi_logging.h	2010-04-04 20:46:41.616874360 -0400
+@@ -51,7 +51,7 @@ do {								\
+ 		} while (0);					\
+ } while (0)
+ #else
+-#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
++#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
+ #endif /* CONFIG_SCSI_LOGGING */
+ 
+ /*
+diff -urNp linux-2.6.32.12/drivers/scsi/sg.c linux-2.6.32.12/drivers/scsi/sg.c
+--- linux-2.6.32.12/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/scsi/sg.c	2010-04-04 20:46:41.616874360 -0400
+@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
+ 	const struct file_operations * fops;
+ };
+ 
+-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
++static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
+ 	{"allow_dio", &adio_fops},
+ 	{"debug", &debug_fops},
+ 	{"def_reserved_size", &dressz_fops},
+@@ -2307,7 +2307,7 @@ sg_proc_init(void)
+ {
+ 	int k, mask;
+ 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
+-	struct sg_proc_leaf * leaf;
++	const struct sg_proc_leaf * leaf;
+ 
+ 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
+ 	if (!sg_proc_sgp)
+diff -urNp linux-2.6.32.12/drivers/serial/8250_pci.c linux-2.6.32.12/drivers/serial/8250_pci.c
+--- linux-2.6.32.12/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/serial/8250_pci.c	2010-04-04 20:46:41.616874360 -0400
+@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
+ 		PCI_ANY_ID, PCI_ANY_ID,
+ 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
+ 		0xffff00, pbn_default },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static struct pci_driver serial_pci_driver = {
+diff -urNp linux-2.6.32.12/drivers/serial/kgdboc.c linux-2.6.32.12/drivers/serial/kgdboc.c
+--- linux-2.6.32.12/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/serial/kgdboc.c	2010-04-04 20:46:41.616874360 -0400
+@@ -18,7 +18,7 @@
+ 
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io		kgdboc_io_ops;
++static const struct kgdb_io	kgdboc_io_ops;
+ 
+ /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
+ static int configured		= -1;
+@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdboc_io_ops = {
++static const struct kgdb_io kgdboc_io_ops = {
+ 	.name			= "kgdboc",
+ 	.read_char		= kgdboc_get_char,
+ 	.write_char		= kgdboc_put_char,
+diff -urNp linux-2.6.32.12/drivers/staging/android/binder.c linux-2.6.32.12/drivers/staging/android/binder.c
+--- linux-2.6.32.12/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/android/binder.c	2010-04-04 20:46:41.616874360 -0400
+@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
+ 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
+ }
+ 
+-static struct vm_operations_struct binder_vm_ops = {
++static const struct vm_operations_struct binder_vm_ops = {
+ 	.open = binder_vma_open,
+ 	.close = binder_vma_close,
+ };
+diff -urNp linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c
+--- linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c	2010-04-04 20:46:41.616874360 -0400
+@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
+ 	return VM_FAULT_NOPAGE;
+ }
+ 
+-static struct vm_operations_struct b3dfg_vm_ops = {
++static const struct vm_operations_struct b3dfg_vm_ops = {
+ 	.fault = b3dfg_vma_fault,
+ };
+ 
+@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
+ 	return r;
+ }
+ 
+-static struct file_operations b3dfg_fops = {
++static const struct file_operations b3dfg_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = b3dfg_open,
+ 	.release = b3dfg_release,
+diff -urNp linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c
+--- linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c	2010-04-04 20:46:41.616874360 -0400
+@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
+ 	mutex_unlock(&dev->mutex);
+ }
+ 
+-static struct vm_operations_struct comedi_vm_ops = {
++static const struct vm_operations_struct comedi_vm_ops = {
+ 	.close = comedi_unmap,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c	2010-04-04 20:46:41.616874360 -0400
+@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
+ static dev_t adsp_devno;
+ static struct class *adsp_class;
+ 
+-static struct file_operations adsp_fops = {
++static const struct file_operations adsp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = adsp_open,
+ 	.unlocked_ioctl = adsp_ioctl,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c	2010-04-04 20:46:41.621505029 -0400
+@@ -1022,7 +1022,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_aac_fops = {
++static const struct file_operations audio_aac_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audio_open,
+ 	.release = audio_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-04-04 20:46:41.621505029 -0400
+@@ -833,7 +833,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_amrnb_fops = {
++static const struct file_operations audio_amrnb_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audamrnb_open,
+ 	.release = audamrnb_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c	2010-04-04 20:46:41.621505029 -0400
+@@ -805,7 +805,7 @@ dma_fail:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_evrc_fops = {
++static const struct file_operations audio_evrc_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audevrc_open,
+ 	.release = audevrc_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c	2010-04-04 20:46:41.621505029 -0400
+@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_in_open,
+ 	.release	= audio_in_release,
+@@ -922,7 +922,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_in_ioctl,
+ };
+ 
+-static struct file_operations audpre_fops = {
++static const struct file_operations audpre_fops = {
+ 	.owner          = THIS_MODULE,
+ 	.open           = audpre_open,
+ 	.unlocked_ioctl = audpre_ioctl,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c	2010-04-04 20:46:41.621505029 -0400
+@@ -941,7 +941,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_mp3_fops = {
++static const struct file_operations audio_mp3_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c	2010-04-04 20:46:41.621505029 -0400
+@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+@@ -819,7 +819,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_ioctl,
+ };
+ 
+-static struct file_operations audpp_fops = {
++static const struct file_operations audpp_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audpp_open,
+ 	.unlocked_ioctl	= audpp_ioctl,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-04-04 20:46:41.621505029 -0400
+@@ -816,7 +816,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_qcelp_fops = {
++static const struct file_operations audio_qcelp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audqcelp_open,
+ 	.release = audqcelp_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c
+--- linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c	2010-04-04 20:46:41.621505029 -0400
+@@ -242,7 +242,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations snd_fops = {
++static const struct file_operations snd_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= snd_open,
+ 	.release	= snd_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c
+--- linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c	2010-04-04 20:46:41.621505029 -0400
+@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
+ 	return 0;
+ }
+ 
+-static struct file_operations qmi_fops = {
++static const struct file_operations qmi_fops = {
+ 	.owner = THIS_MODULE,
+ 	.read = qmi_read,
+ 	.write = qmi_write,
+diff -urNp linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c
+--- linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-04-04 20:46:41.621505029 -0400
+@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
+ 	return rc;
+ }
+ 
+-static struct file_operations rpcrouter_server_fops = {
++static const struct file_operations rpcrouter_server_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
+ 	.unlocked_ioctl	 = rpcrouter_ioctl,
+ };
+ 
+-static struct file_operations rpcrouter_router_fops = {
++static const struct file_operations rpcrouter_router_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+diff -urNp linux-2.6.32.12/drivers/staging/dst/dcore.c linux-2.6.32.12/drivers/staging/dst/dcore.c
+--- linux-2.6.32.12/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dst/dcore.c	2010-04-04 20:46:41.621505029 -0400
+@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
+ 	return 0;
+ }
+ 
+-static struct block_device_operations dst_blk_ops = {
++static const struct block_device_operations dst_blk_ops = {
+ 	.open		= dst_bdev_open,
+ 	.release	= dst_bdev_release,
+ 	.owner		= THIS_MODULE,
+@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
+ 	n->size = ctl->size;
+ 
+ 	atomic_set(&n->refcnt, 1);
+-	atomic_long_set(&n->gen, 0);
++	atomic_long_set_unchecked(&n->gen, 0);
+ 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
+ 
+ 	err = dst_node_sysfs_init(n);
+diff -urNp linux-2.6.32.12/drivers/staging/dst/trans.c linux-2.6.32.12/drivers/staging/dst/trans.c
+--- linux-2.6.32.12/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/dst/trans.c	2010-04-04 20:46:41.621505029 -0400
+@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
+ 	t->error = 0;
+ 	t->retries = 0;
+ 	atomic_set(&t->refcnt, 1);
+-	t->gen = atomic_long_inc_return(&n->gen);
++	t->gen = atomic_long_inc_return_unchecked(&n->gen);
+ 
+ 	t->enc = bio_data_dir(bio);
+ 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
+diff -urNp linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c
+--- linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c	2010-04-04 20:46:41.621505029 -0400
+@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
+ 	return 0;
+ }
+ 
+-static struct vm_operations_struct go7007_vm_ops = {
++static const struct vm_operations_struct go7007_vm_ops = {
+ 	.open	= go7007_vm_open,
+ 	.close	= go7007_vm_close,
+ 	.fault	= go7007_vm_fault,
+diff -urNp linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c
+--- linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c	2010-04-04 20:46:41.621505029 -0400
+@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
+ /* The one and only one */
+ static struct blkvsc_driver_context g_blkvsc_drv;
+ 
+-static struct block_device_operations block_ops = {
++static const struct block_device_operations block_ops = {
+ 	.owner = THIS_MODULE,
+ 	.open = blkvsc_open,
+ 	.release = blkvsc_release,
+diff -urNp linux-2.6.32.12/drivers/staging/panel/panel.c linux-2.6.32.12/drivers/staging/panel/panel.c
+--- linux-2.6.32.12/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/panel/panel.c	2010-04-04 20:46:41.621505029 -0400
+@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations lcd_fops = {
++static const struct file_operations lcd_fops = {
+ 	.write   = lcd_write,
+ 	.open    = lcd_open,
+ 	.release = lcd_release,
+@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
+ 	return 0;
+ }
+ 
+-static struct file_operations keypad_fops = {
++static const struct file_operations keypad_fops = {
+ 	.read    = keypad_read,		/* read */
+ 	.open    = keypad_open,		/* open */
+ 	.release = keypad_release,	/* close */
+diff -urNp linux-2.6.32.12/drivers/staging/phison/phison.c linux-2.6.32.12/drivers/staging/phison/phison.c
+--- linux-2.6.32.12/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/phison/phison.c	2010-04-04 20:46:41.621505029 -0400
+@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations phison_ops = {
++static const struct ata_port_operations phison_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= phison_pre_reset,
+ };
+diff -urNp linux-2.6.32.12/drivers/staging/poch/poch.c linux-2.6.32.12/drivers/staging/poch/poch.c
+--- linux-2.6.32.12/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/poch/poch.c	2010-04-04 20:46:41.625742858 -0400
+@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations poch_fops = {
++static const struct file_operations poch_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = poch_open,
+ 	.release = poch_release,
+diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/inode.c linux-2.6.32.12/drivers/staging/pohmelfs/inode.c
+--- linux-2.6.32.12/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/pohmelfs/inode.c	2010-04-04 20:46:41.625742858 -0400
+@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
+ 	mutex_init(&psb->mcache_lock);
+ 	psb->mcache_root = RB_ROOT;
+ 	psb->mcache_timeout = msecs_to_jiffies(5000);
+-	atomic_long_set(&psb->mcache_gen, 0);
++	atomic_long_set_unchecked(&psb->mcache_gen, 0);
+ 
+ 	psb->trans_max_pages = 100;
+ 
+diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c
+--- linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c	2010-04-04 20:46:41.625742858 -0400
+@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
+ 	m->data = data;
+ 	m->start = start;
+ 	m->size = size;
+-	m->gen = atomic_long_inc_return(&psb->mcache_gen);
++	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
+ 
+ 	mutex_lock(&psb->mcache_lock);
+ 	err = pohmelfs_mcache_insert(psb, m);
+diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h
+--- linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h	2010-04-04 20:46:41.625742858 -0400
+@@ -570,7 +570,7 @@ struct pohmelfs_config;
+ struct pohmelfs_sb {
+ 	struct rb_root		mcache_root;
+ 	struct mutex		mcache_lock;
+-	atomic_long_t		mcache_gen;
++	atomic_long_unchecked_t	mcache_gen;
+ 	unsigned long		mcache_timeout;
+ 
+ 	unsigned int		idx;
+diff -urNp linux-2.6.32.12/drivers/staging/sep/sep_driver.c linux-2.6.32.12/drivers/staging/sep/sep_driver.c
+--- linux-2.6.32.12/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/sep/sep_driver.c	2010-04-04 20:46:41.625742858 -0400
+@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
+ static dev_t sep_devno;
+ 
+ /* the files operations structure of the driver */
+-static struct file_operations sep_file_operations = {
++static const struct file_operations sep_file_operations = {
+ 	.owner = THIS_MODULE,
+ 	.ioctl = sep_ioctl,
+ 	.poll = sep_poll,
+diff -urNp linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c
+--- linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c	2010-04-04 20:46:41.625742858 -0400
+@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
+ static int __init vme_user_probe(struct device *, int, int);
+ static int __exit vme_user_remove(struct device *, int, int);
+ 
+-static struct file_operations vme_user_fops = {
++static const struct file_operations vme_user_fops = {
+         .open = vme_user_open,
+         .release = vme_user_release,
+         .read = vme_user_read,
+diff -urNp linux-2.6.32.12/drivers/uio/uio.c linux-2.6.32.12/drivers/uio/uio.c
+--- linux-2.6.32.12/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/uio/uio.c	2010-04-04 20:46:41.625742858 -0400
+@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
+ 	return entry->show(mem, buf);
+ }
+ 
+-static struct sysfs_ops map_sysfs_ops = {
++static const struct sysfs_ops map_sysfs_ops = {
+ 	.show = map_type_show,
+ };
+ 
+@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
+ 	return entry->show(port, buf);
+ }
+ 
+-static struct sysfs_ops portio_sysfs_ops = {
++static const struct sysfs_ops portio_sysfs_ops = {
+ 	.show = portio_type_show,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/usb/atm/usbatm.c linux-2.6.32.12/drivers/usb/atm/usbatm.c
+--- linux-2.6.32.12/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/atm/usbatm.c	2010-04-04 20:46:41.625742858 -0400
+@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (printk_ratelimit())
+ 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
+ 				__func__, vpi, vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		return;
+ 	}
+ 
+@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (length > ATM_MAX_AAL5_PDU) {
+ 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
+ 				  __func__, length, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
+ 		if (sarb->len < pdu_length) {
+ 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
+ 				  __func__, pdu_length, sarb->len, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+ 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
+ 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
+ 				  __func__, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
+ 			if (printk_ratelimit())
+ 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
+ 					__func__, length);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto out;
+ 		}
+ 
+@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
+ 
+ 		vcc->push(vcc, skb);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	out:
+ 		skb_trim(sarb, 0);
+ 	}
+@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
+ 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
+ 
+ 			usbatm_pop(vcc, skb);
+-			atomic_inc(&vcc->stats->tx);
++			atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 			skb = skb_dequeue(&instance->sndqueue);
+ 		}
+@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
+ 	if (!left--)
+ 		return sprintf(page,
+ 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
+-			       atomic_read(&atm_dev->stats.aal5.tx),
+-			       atomic_read(&atm_dev->stats.aal5.tx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx),
+-			       atomic_read(&atm_dev->stats.aal5.rx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx_drop));
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
+ 
+ 	if (!left--) {
+ 		if (instance->disconnected)
+diff -urNp linux-2.6.32.12/drivers/usb/class/cdc-acm.c linux-2.6.32.12/drivers/usb/class/cdc-acm.c
+--- linux-2.6.32.12/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:38.389083173 -0400
++++ linux-2.6.32.12/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:58.429105010 -0400
+@@ -1535,7 +1535,7 @@ static struct usb_device_id acm_ids[] = 
+ 		USB_CDC_ACM_PROTO_AT_CDMA) },
+ 
+ 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(usb, acm_ids);
+diff -urNp linux-2.6.32.12/drivers/usb/class/usblp.c linux-2.6.32.12/drivers/usb/class/usblp.c
+--- linux-2.6.32.12/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/class/usblp.c	2010-04-04 20:46:41.625742858 -0400
+@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
+ 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
+ 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
+ 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
+-	{ 0, 0 }
++	{ 0, 0, 0 }
+ };
+ 
+ static int usblp_wwait(struct usblp *usblp, int nonblock);
+@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
+ 	{ USB_INTERFACE_INFO(7, 1, 2) },
+ 	{ USB_INTERFACE_INFO(7, 1, 3) },
+ 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
+-	{ }						/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, usblp_ids);
+diff -urNp linux-2.6.32.12/drivers/usb/core/hcd.c linux-2.6.32.12/drivers/usb/core/hcd.c
+--- linux-2.6.32.12/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/core/hcd.c	2010-04-04 20:46:41.625742858 -0400
+@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
+ 
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+-struct usb_mon_operations *mon_ops;
++const struct usb_mon_operations *mon_ops;
+ 
+ /*
+  * The registration is unlocked.
+@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
+  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
+  */
+  
+-int usb_mon_register (struct usb_mon_operations *ops)
++int usb_mon_register (const struct usb_mon_operations *ops)
+ {
+ 
+ 	if (mon_ops)
+diff -urNp linux-2.6.32.12/drivers/usb/core/hcd.h linux-2.6.32.12/drivers/usb/core/hcd.h
+--- linux-2.6.32.12/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/core/hcd.h	2010-04-04 20:46:41.625742858 -0400
+@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+ struct usb_mon_operations {
+-	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
+-	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
+-	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
++	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
++	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
++	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
+ 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
+ };
+ 
+-extern struct usb_mon_operations *mon_ops;
++extern const struct usb_mon_operations *mon_ops;
+ 
+ static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
+ {
+@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
+ 		(*mon_ops->urb_complete)(bus, urb, status);
+ }
+ 
+-int usb_mon_register(struct usb_mon_operations *ops);
++int usb_mon_register(const struct usb_mon_operations *ops);
+ void usb_mon_deregister(void);
+ 
+ #else
+diff -urNp linux-2.6.32.12/drivers/usb/core/hub.c linux-2.6.32.12/drivers/usb/core/hub.c
+--- linux-2.6.32.12/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/core/hub.c	2010-04-04 20:46:41.625742858 -0400
+@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
+       .bDeviceClass = USB_CLASS_HUB},
+     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
+       .bInterfaceClass = USB_CLASS_HUB},
+-    { }						/* Terminating entry */
++    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, hub_id_table);
+diff -urNp linux-2.6.32.12/drivers/usb/core/message.c linux-2.6.32.12/drivers/usb/core/message.c
+--- linux-2.6.32.12/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/core/message.c	2010-04-04 20:46:41.629706570 -0400
+@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
+ 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
+ 	if (buf) {
+ 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
+-		if (len > 0) {
+-			smallbuf = kmalloc(++len, GFP_NOIO);
++		if (len++ > 0) {
++			smallbuf = kmalloc(len, GFP_NOIO);
+ 			if (!smallbuf)
+ 				return buf;
+ 			memcpy(smallbuf, buf, len);
+diff -urNp linux-2.6.32.12/drivers/usb/host/ehci-pci.c linux-2.6.32.12/drivers/usb/host/ehci-pci.c
+--- linux-2.6.32.12/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/host/ehci-pci.c	2010-04-04 20:46:41.629706570 -0400
+@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
+ 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
+ 	},
+-	{ /* end: all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, pci_ids);
+ 
+diff -urNp linux-2.6.32.12/drivers/usb/host/uhci-hcd.c linux-2.6.32.12/drivers/usb/host/uhci-hcd.c
+--- linux-2.6.32.12/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/host/uhci-hcd.c	2010-04-04 20:46:41.629706570 -0400
+@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
+ 	/* handle any USB UHCI controller */
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
+ 	.driver_data =	(unsigned long) &uhci_driver,
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
+diff -urNp linux-2.6.32.12/drivers/usb/misc/appledisplay.c linux-2.6.32.12/drivers/usb/misc/appledisplay.c
+--- linux-2.6.32.12/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/misc/appledisplay.c	2010-04-04 20:46:41.629706570 -0400
+@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
+ 		return pdata->msgdata[1];
+ }
+ 
+-static struct backlight_ops appledisplay_bl_data = {
++static const struct backlight_ops appledisplay_bl_data = {
+ 	.get_brightness	= appledisplay_bl_get_brightness,
+ 	.update_status	= appledisplay_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/usb/mon/mon_main.c linux-2.6.32.12/drivers/usb/mon/mon_main.c
+--- linux-2.6.32.12/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/mon/mon_main.c	2010-04-04 20:46:41.629706570 -0400
+@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
+ /*
+  * Ops
+  */
+-static struct usb_mon_operations mon_ops_0 = {
++static const struct usb_mon_operations mon_ops_0 = {
+ 	.urb_submit =	mon_submit,
+ 	.urb_submit_error = mon_submit_error,
+ 	.urb_complete =	mon_complete,
+diff -urNp linux-2.6.32.12/drivers/usb/storage/debug.h linux-2.6.32.12/drivers/usb/storage/debug.h
+--- linux-2.6.32.12/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/storage/debug.h	2010-04-04 20:46:41.629706570 -0400
+@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
+ #define US_DEBUGPX(x...) printk( x )
+ #define US_DEBUG(x) x 
+ #else
+-#define US_DEBUGP(x...)
+-#define US_DEBUGPX(x...)
+-#define US_DEBUG(x)
++#define US_DEBUGP(x...) do {} while (0)
++#define US_DEBUGPX(x...) do {} while (0)
++#define US_DEBUG(x) do {} while (0)
+ #endif
+ 
+ #endif
+diff -urNp linux-2.6.32.12/drivers/usb/storage/usb.c linux-2.6.32.12/drivers/usb/storage/usb.c
+--- linux-2.6.32.12/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/storage/usb.c	2010-04-04 20:46:41.629706570 -0400
+@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
+ 
+ static struct us_unusual_dev us_unusual_dev_list[] = {
+ #	include "unusual_devs.h" 
+-	{ }		/* Terminating entry */
++	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
+ };
+ 
+ #undef UNUSUAL_DEV
+diff -urNp linux-2.6.32.12/drivers/usb/storage/usual-tables.c linux-2.6.32.12/drivers/usb/storage/usual-tables.c
+--- linux-2.6.32.12/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/usb/storage/usual-tables.c	2010-04-04 20:46:41.629706570 -0400
+@@ -48,7 +48,7 @@
+ 
+ struct usb_device_id usb_storage_usb_ids[] = {
+ #	include "unusual_devs.h"
+-	{ }		/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
+ 
+diff -urNp linux-2.6.32.12/drivers/uwb/wlp/messages.c linux-2.6.32.12/drivers/uwb/wlp/messages.c
+--- linux-2.6.32.12/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/uwb/wlp/messages.c	2010-04-04 20:46:41.629706570 -0400
+@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
+ 	size_t len = skb->len;
+ 	size_t used;
+ 	ssize_t result;
+-	struct wlp_nonce enonce, rnonce;
++	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
+ 	enum wlp_assc_error assc_err;
+ 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
+ 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
+diff -urNp linux-2.6.32.12/drivers/uwb/wlp/sysfs.c linux-2.6.32.12/drivers/uwb/wlp/sysfs.c
+--- linux-2.6.32.12/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/uwb/wlp/sysfs.c	2010-04-04 20:46:41.629706570 -0400
+@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
+ 	return ret;
+ }
+ 
+-static
+-struct sysfs_ops wss_sysfs_ops = {
++static const struct sysfs_ops wss_sysfs_ops = {
+ 	.show	= wlp_wss_attr_show,
+ 	.store	= wlp_wss_attr_store,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/atmel_lcdfb.c linux-2.6.32.12/drivers/video/atmel_lcdfb.c
+--- linux-2.6.32.12/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/atmel_lcdfb.c	2010-04-04 20:46:41.629706570 -0400
+@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
+ 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
+ }
+ 
+-static struct backlight_ops atmel_lcdc_bl_ops = {
++static const struct backlight_ops atmel_lcdc_bl_ops = {
+ 	.update_status = atmel_bl_update_status,
+ 	.get_brightness = atmel_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/aty/aty128fb.c linux-2.6.32.12/drivers/video/aty/aty128fb.c
+--- linux-2.6.32.12/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/aty/aty128fb.c	2010-04-04 20:46:41.629706570 -0400
+@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty128_bl_data = {
++static const struct backlight_ops aty128_bl_data = {
+ 	.get_brightness	= aty128_bl_get_brightness,
+ 	.update_status	= aty128_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/aty/atyfb_base.c linux-2.6.32.12/drivers/video/aty/atyfb_base.c
+--- linux-2.6.32.12/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/aty/atyfb_base.c	2010-04-04 20:46:41.629706570 -0400
+@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty_bl_data = {
++static const struct backlight_ops aty_bl_data = {
+ 	.get_brightness = aty_bl_get_brightness,
+ 	.update_status	= aty_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/aty/radeon_backlight.c linux-2.6.32.12/drivers/video/aty/radeon_backlight.c
+--- linux-2.6.32.12/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/aty/radeon_backlight.c	2010-04-04 20:46:41.629706570 -0400
+@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops radeon_bl_data = {
++static const struct backlight_ops radeon_bl_data = {
+ 	.get_brightness = radeon_bl_get_brightness,
+ 	.update_status	= radeon_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c	2010-04-04 20:46:41.629706570 -0400
+@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
+ 	return error ? data->current_brightness : reg_val;
+ }
+ 
+-static struct backlight_ops adp5520_bl_ops = {
++static const struct backlight_ops adp5520_bl_ops = {
+ 	.update_status	= adp5520_bl_update_status,
+ 	.get_brightness	= adp5520_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/adx_bl.c linux-2.6.32.12/drivers/video/backlight/adx_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/adx_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
+ 	return 1;
+ }
+ 
+-static struct backlight_ops adx_backlight_ops = {
++static const struct backlight_ops adx_backlight_ops = {
+ 	.options = 0,
+ 	.update_status = adx_backlight_update_status,
+ 	.get_brightness = adx_backlight_get_brightness,
+diff -urNp linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c
+--- linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
+ 	return pwm_channel_enable(&pwmbl->pwmc);
+ }
+ 
+-static struct backlight_ops atmel_pwm_bl_ops = {
++static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.get_brightness = atmel_pwm_bl_get_intensity,
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/backlight.c linux-2.6.32.12/drivers/video/backlight/backlight.c
+--- linux-2.6.32.12/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/backlight.c	2010-04-04 20:46:41.633638271 -0400
+@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
+  * ERR_PTR() or a pointer to the newly allocated device.
+  */
+ struct backlight_device *backlight_device_register(const char *name,
+-		struct device *parent, void *devdata, struct backlight_ops *ops)
++		struct device *parent, void *devdata, const struct backlight_ops *ops)
+ {
+ 	struct backlight_device *new_bd;
+ 	int rc;
+diff -urNp linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c
+--- linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c	2010-04-04 20:46:41.633638271 -0400
+@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
+ }
+ EXPORT_SYMBOL(corgi_lcd_limit_intensity);
+ 
+-static struct backlight_ops corgi_bl_ops = {
++static const struct backlight_ops corgi_bl_ops = {
+ 	.get_brightness	= corgi_bl_get_intensity,
+ 	.update_status  = corgi_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c
+--- linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c	2010-04-04 20:46:41.633638271 -0400
+@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
+ 	return intensity;
+ }
+ 
+-static struct backlight_ops cr_backlight_ops = {
++static const struct backlight_ops cr_backlight_ops = {
+ 	.get_brightness = cr_backlight_get_intensity,
+ 	.update_status = cr_backlight_set_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/da903x_bl.c linux-2.6.32.12/drivers/video/backlight/da903x_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/da903x_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops da903x_backlight_ops = {
++static const struct backlight_ops da903x_backlight_ops = {
+ 	.update_status	= da903x_backlight_update_status,
+ 	.get_brightness	= da903x_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/generic_bl.c linux-2.6.32.12/drivers/video/backlight/generic_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/generic_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
+ }
+ EXPORT_SYMBOL(corgibl_limit_intensity);
+ 
+-static struct backlight_ops genericbl_ops = {
++static const struct backlight_ops genericbl_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.get_brightness = genericbl_get_intensity,
+ 	.update_status  = genericbl_send_intensity,
+diff -urNp linux-2.6.32.12/drivers/video/backlight/hp680_bl.c linux-2.6.32.12/drivers/video/backlight/hp680_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/hp680_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops hp680bl_ops = {
++static const struct backlight_ops hp680bl_ops = {
+ 	.get_brightness = hp680bl_get_intensity,
+ 	.update_status  = hp680bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -93,7 +93,7 @@ out:
+ 	return ret;
+ }
+ 
+-static struct backlight_ops jornada_bl_ops = {
++static const struct backlight_ops jornada_bl_ops = {
+ 	.get_brightness = jornada_bl_get_brightness,
+ 	.update_status = jornada_bl_update_status,
+ 	.options = BL_CORE_SUSPENDRESUME,
+diff -urNp linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
+ 	return kb3886bl_intensity;
+ }
+ 
+-static struct backlight_ops kb3886bl_ops = {
++static const struct backlight_ops kb3886bl_ops = {
+ 	.get_brightness = kb3886bl_get_intensity,
+ 	.update_status  = kb3886bl_send_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/locomolcd.c linux-2.6.32.12/drivers/video/backlight/locomolcd.c
+--- linux-2.6.32.12/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/locomolcd.c	2010-04-04 20:46:41.633638271 -0400
+@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops locomobl_data = {
++static const struct backlight_ops locomobl_data = {
+ 	.get_brightness = locomolcd_get_intensity,
+ 	.update_status  = locomolcd_set_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:38.397382140 -0400
++++ linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:58.433026851 -0400
+@@ -33,7 +33,7 @@ struct dmi_match_data {
+ 	unsigned long iostart;
+ 	unsigned long iolen;
+ 	/* Backlight operations structure. */
+-	struct backlight_ops backlight_ops;
++	const struct backlight_ops backlight_ops;
+ };
+ 
+ /* Module parameters. */
+diff -urNp linux-2.6.32.12/drivers/video/backlight/omap1_bl.c linux-2.6.32.12/drivers/video/backlight/omap1_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/omap1_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
+ 	return bl->current_intensity;
+ }
+ 
+-static struct backlight_ops omapbl_ops = {
++static const struct backlight_ops omapbl_ops = {
+ 	.get_brightness = omapbl_get_intensity,
+ 	.update_status  = omapbl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/progear_bl.c linux-2.6.32.12/drivers/video/backlight/progear_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/progear_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
+ 	return intensity - HW_LEVEL_MIN;
+ }
+ 
+-static struct backlight_ops progearbl_ops = {
++static const struct backlight_ops progearbl_ops = {
+ 	.get_brightness = progearbl_get_intensity,
+ 	.update_status = progearbl_set_intensity,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/pwm_bl.c linux-2.6.32.12/drivers/video/backlight/pwm_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/pwm_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
+ 	return bl->props.brightness;
+ }
+ 
+-static struct backlight_ops pwm_backlight_ops = {
++static const struct backlight_ops pwm_backlight_ops = {
+ 	.update_status	= pwm_backlight_update_status,
+ 	.get_brightness	= pwm_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/tosa_bl.c linux-2.6.32.12/drivers/video/backlight/tosa_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/tosa_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
+ 	return props->brightness;
+ }
+ 
+-static struct backlight_ops bl_ops = {
++static const struct backlight_ops bl_ops = {
+ 	.get_brightness		= tosa_bl_get_brightness,
+ 	.update_status		= tosa_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c
+--- linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c	2010-04-04 20:46:41.633638271 -0400
+@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops wm831x_backlight_ops = {
++static const struct backlight_ops wm831x_backlight_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.update_status	= wm831x_backlight_update_status,
+ 	.get_brightness	= wm831x_backlight_get_brightness,
+diff -urNp linux-2.6.32.12/drivers/video/bf54x-lq043fb.c linux-2.6.32.12/drivers/video/bf54x-lq043fb.c
+--- linux-2.6.32.12/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/bf54x-lq043fb.c	2010-04-04 20:46:41.633638271 -0400
+@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c
+--- linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c	2010-04-04 20:46:41.633638271 -0400
+@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/video/fbcmap.c linux-2.6.32.12/drivers/video/fbcmap.c
+--- linux-2.6.32.12/drivers/video/fbcmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/fbcmap.c	2010-04-29 17:46:37.213234717 -0400
+@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
+ 		rc = -ENODEV;
+ 		goto out;
+ 	}
+-	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+-				!info->fbops->fb_setcmap)) {
++	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
+ 		rc = -EINVAL;
+ 		goto out1;
+ 	}
+diff -urNp linux-2.6.32.12/drivers/video/fbmem.c linux-2.6.32.12/drivers/video/fbmem.c
+--- linux-2.6.32.12/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/fbmem.c	2010-04-04 20:46:41.633638271 -0400
+@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dx += image->width + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_UD) {
+-		for (x = 0; x < num && image->dx >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dx -= image->width + 8;
+ 		}
+@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dy += image->height + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_CCW) {
+-		for (x = 0; x < num && image->dy >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dy -= image->height + 8;
+ 		}
+@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
+ 			return -EFAULT;
+ 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+ 			return -EINVAL;
+-		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
++		if (con2fb.framebuffer >= FB_MAX)
+ 			return -EINVAL;
+ 		if (!registered_fb[con2fb.framebuffer])
+ 			request_module("fb%d", con2fb.framebuffer);
+diff -urNp linux-2.6.32.12/drivers/video/fbmon.c linux-2.6.32.12/drivers/video/fbmon.c
+--- linux-2.6.32.12/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/fbmon.c	2010-04-04 20:46:41.633638271 -0400
+@@ -45,7 +45,7 @@
+ #ifdef DEBUG
+ #define DPRINTK(fmt, args...) printk(fmt,## args)
+ #else
+-#define DPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
+ #endif
+ 
+ #define FBMON_FIX_HEADER  1
+diff -urNp linux-2.6.32.12/drivers/video/i810/i810_accel.c linux-2.6.32.12/drivers/video/i810/i810_accel.c
+--- linux-2.6.32.12/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/i810/i810_accel.c	2010-04-04 20:46:41.633638271 -0400
+@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
+ 		}
+ 	}
+ 	printk("ringbuffer lockup!!!\n");
++	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
+ 	i810_report_error(mmio); 
+ 	par->dev_flags |= LOCKUP;
+ 	info->pixmap.scan_align = 1;
+diff -urNp linux-2.6.32.12/drivers/video/i810/i810_main.c linux-2.6.32.12/drivers/video/i810/i810_main.c
+--- linux-2.6.32.12/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/i810/i810_main.c	2010-04-04 20:46:41.633638271 -0400
+@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
+ 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ static struct pci_driver i810fb_driver = {
+diff -urNp linux-2.6.32.12/drivers/video/modedb.c linux-2.6.32.12/drivers/video/modedb.c
+--- linux-2.6.32.12/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/modedb.c	2010-04-04 20:46:41.637780128 -0400
+@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
+     {
+ 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
+ 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
+ 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
+ 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
+ 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
+ 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
+-	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
+ 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
+ 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
+ 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
+ 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
+ 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
+ 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
+ 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
+ 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
+ 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
+ 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
+ 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
+ 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
+ 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
+ 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
+-	0, FB_VMODE_NONINTERLACED   	
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
+ 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
+         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
+ 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
+ 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
+ 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
+ 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
+ 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
+ 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
+ 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
+ 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
+ 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
+ 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
+ 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
+ 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
+ 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
+ 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
+ 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
+ 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
+ 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
+ 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
+ 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
+ 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+ 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+ 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+-	FB_VMODE_NONINTERLACED
++	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
+ 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
+ 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+    }, {
+ 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
+ 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     },
+ };
+ 
+diff -urNp linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c
+--- linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c	2010-04-04 20:46:41.637780128 -0400
+@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops nvidia_bl_ops = {
++static const struct backlight_ops nvidia_bl_ops = {
+ 	.get_brightness = nvidia_bl_get_brightness,
+ 	.update_status	= nvidia_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/riva/fbdev.c linux-2.6.32.12/drivers/video/riva/fbdev.c
+--- linux-2.6.32.12/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/riva/fbdev.c	2010-04-04 20:46:41.637780128 -0400
+@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops riva_bl_ops = {
++static const struct backlight_ops riva_bl_ops = {
+ 	.get_brightness = riva_bl_get_brightness,
+ 	.update_status	= riva_bl_update_status,
+ };
+diff -urNp linux-2.6.32.12/drivers/video/uvesafb.c linux-2.6.32.12/drivers/video/uvesafb.c
+--- linux-2.6.32.12/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/uvesafb.c	2010-04-04 20:46:41.637780128 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/fb.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
++#include <linux/moduleloader.h>
+ #include <video/edid.h>
+ #include <video/uvesafb.h>
+ #ifdef CONFIG_X86
+@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
+ 		NULL,
+ 	};
+ 
+-	return call_usermodehelper(v86d_path, argv, envp, 1);
++	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
+ }
+ 
+ /*
+@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
+ 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
+ 		par->pmi_setpal = par->ypan = 0;
+ 	} else {
++
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_MODULES
++		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
++#endif
++		if (!par->pmi_code) {
++			par->pmi_setpal = par->ypan = 0;
++			return 0;
++		}
++#endif
++
+ 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
+ 						+ task->t.regs.edi);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
++		pax_close_kernel();
++
++		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
++		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
++#else
+ 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
+ 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
++#endif
++
+ 		printk(KERN_INFO "uvesafb: protected mode interface info at "
+ 				 "%04x:%04x\n",
+ 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
+@@ -1799,6 +1822,11 @@ out:
+ 	if (par->vbe_modes)
+ 		kfree(par->vbe_modes);
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	if (par->pmi_code)
++		module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 	framebuffer_release(info);
+ 	return err;
+ }
+@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
+ 				kfree(par->vbe_state_orig);
+ 			if (par->vbe_state_saved)
+ 				kfree(par->vbe_state_saved);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++			if (par->pmi_code)
++				module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 		}
+ 
+ 		framebuffer_release(info);
+diff -urNp linux-2.6.32.12/drivers/video/vesafb.c linux-2.6.32.12/drivers/video/vesafb.c
+--- linux-2.6.32.12/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/video/vesafb.c	2010-04-04 20:46:41.637780128 -0400
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/module.h>
++#include <linux/moduleloader.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/string.h>
+@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
+ static int   vram_total __initdata;		/* Set total amount of memory */
+ static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
+ static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
+-static void  (*pmi_start)(void) __read_mostly;
+-static void  (*pmi_pal)  (void) __read_mostly;
++static void  (*pmi_start)(void) __read_only;
++static void  (*pmi_pal)  (void) __read_only;
+ static int   depth      __read_mostly;
+ static int   vga_compat __read_mostly;
+ /* --------------------------------------------------------------------- */
+@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
+ 	unsigned int size_vmode;
+ 	unsigned int size_remap;
+ 	unsigned int size_total;
++	void *pmi_code = NULL;
+ 
+ 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
+ 		return -ENODEV;
+@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
+ 		size_remap = size_total;
+ 	vesafb_fix.smem_len = size_remap;
+ 
+-#ifndef __i386__
+-	screen_info.vesapm_seg = 0;
+-#endif
+-
+ 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
+ 		printk(KERN_WARNING
+ 		       "vesafb: cannot reserve video memory at 0x%lx\n",
+@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
+ 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
+ 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
+ 
++#ifdef __i386__
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	pmi_code = module_alloc_exec(screen_info.vesapm_size);
++	if (!pmi_code)
++#elif !defined(CONFIG_PAX_KERNEXEC)
++	if (0)
++#endif
++
++#endif
++	screen_info.vesapm_seg = 0;
++
+ 	if (screen_info.vesapm_seg) {
+-		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
+-		       screen_info.vesapm_seg,screen_info.vesapm_off);
++		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
++		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
+ 	}
+ 
+ 	if (screen_info.vesapm_seg < 0xc000)
+@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
+ 
+ 	if (ypan || pmi_setpal) {
+ 		unsigned short *pmi_base;
+-		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+-		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
+-		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
++
++		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
++#else
++		pmi_code = pmi_base;
++#endif
++
++		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
++		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pmi_start = ktva_ktla(pmi_start);
++		pmi_pal = ktva_ktla(pmi_pal);
++		pax_close_kernel();
++#endif
++
+ 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
+ 		if (pmi_base[3]) {
+ 			printk(KERN_INFO "vesafb: pmi: ports = ");
+@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
+ 	       info->node, info->fix.id);
+ 	return 0;
+ err:
++
++#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	module_free_exec(NULL, pmi_code);
++#endif
++
+ 	if (info->screen_base)
+ 		iounmap(info->screen_base);
+ 	framebuffer_release(info);
+diff -urNp linux-2.6.32.12/drivers/xen/sys-hypervisor.c linux-2.6.32.12/drivers/xen/sys-hypervisor.c
+--- linux-2.6.32.12/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/drivers/xen/sys-hypervisor.c	2010-04-04 20:46:41.637780128 -0400
+@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
+ 	return 0;
+ }
+ 
+-static struct sysfs_ops hyp_sysfs_ops = {
++static const struct sysfs_ops hyp_sysfs_ops = {
+ 	.show = hyp_sysfs_show,
+ 	.store = hyp_sysfs_store,
+ };
+diff -urNp linux-2.6.32.12/fs/9p/vfs_inode.c linux-2.6.32.12/fs/9p/vfs_inode.c
+--- linux-2.6.32.12/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/9p/vfs_inode.c	2010-04-04 20:46:41.637780128 -0400
+@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
+ static void
+ v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 
+ 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
+ 		IS_ERR(s) ? "<error>" : s);
+diff -urNp linux-2.6.32.12/fs/aio.c linux-2.6.32.12/fs/aio.c
+--- linux-2.6.32.12/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/aio.c	2010-04-04 20:46:41.637780128 -0400
+@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
+ 	size += sizeof(struct io_event) * nr_events;
+ 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
+ 
+-	if (nr_pages < 0)
++	if (nr_pages <= 0)
+ 		return -EINVAL;
+ 
+ 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+diff -urNp linux-2.6.32.12/fs/attr.c linux-2.6.32.12/fs/attr.c
+--- linux-2.6.32.12/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/attr.c	2010-04-04 20:46:41.637780128 -0400
+@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
+ 		unsigned long limit;
+ 
+ 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
++		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
+ 		if (limit != RLIM_INFINITY && offset > limit)
+ 			goto out_sig;
+ 		if (offset > inode->i_sb->s_maxbytes)
+diff -urNp linux-2.6.32.12/fs/autofs/root.c linux-2.6.32.12/fs/autofs/root.c
+--- linux-2.6.32.12/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/autofs/root.c	2010-04-04 20:46:41.637780128 -0400
+@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
+ 	set_bit(n,sbi->symlink_bitmap);
+ 	sl = &sbi->symlink[n];
+ 	sl->len = strlen(symname);
+-	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
++	slsize = sl->len+1;
++	sl->data = kmalloc(slsize, GFP_KERNEL);
+ 	if (!sl->data) {
+ 		clear_bit(n,sbi->symlink_bitmap);
+ 		unlock_kernel();
+diff -urNp linux-2.6.32.12/fs/autofs4/symlink.c linux-2.6.32.12/fs/autofs4/symlink.c
+--- linux-2.6.32.12/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/autofs4/symlink.c	2010-04-04 20:46:41.637780128 -0400
+@@ -15,7 +15,7 @@
+ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
+ {
+ 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
+-	nd_set_link(nd, (char *)ino->u.symlink);
++	nd_set_link(nd, ino->u.symlink);
+ 	return NULL;
+ }
+ 
+diff -urNp linux-2.6.32.12/fs/befs/linuxvfs.c linux-2.6.32.12/fs/befs/linuxvfs.c
+--- linux-2.6.32.12/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/befs/linuxvfs.c	2010-04-04 20:46:41.637780128 -0400
+@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
+ {
+ 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
+ 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
+-		char *link = nd_get_link(nd);
++		const char *link = nd_get_link(nd);
+ 		if (!IS_ERR(link))
+ 			kfree(link);
+ 	}
+diff -urNp linux-2.6.32.12/fs/binfmt_aout.c linux-2.6.32.12/fs/binfmt_aout.c
+--- linux-2.6.32.12/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/binfmt_aout.c	2010-04-04 20:46:41.637780128 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/string.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #include <linux/ptrace.h>
+@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
+ 
+ /* If the size of the dump file exceeds the rlimit, then see what would happen
+    if we wrote the stack, but not the data area.  */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
+ 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
+ 		dump.u_dsize = 0;
+ 
+ /* Make sure we have enough room to write the stack and data areas. */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
+ 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
+ 		dump.u_ssize = 0;
+ 
+@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+ 	if (rlim >= RLIM_INFINITY)
+ 		rlim = ~0;
++
++	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
+ 	if (ex.a_data + ex.a_bss > rlim)
+ 		return -ENOMEM;
+ 
+@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
+ 	install_exec_creds(bprm);
+  	current->flags &= ~PF_FORKNOEXEC;
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
++		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
++			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
++			current->mm->pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++	}
++#endif
++
+ 	if (N_MAGIC(ex) == OMAGIC) {
+ 		unsigned long text_addr, map_size;
+ 		loff_t pos;
+@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
+ 
+ 		down_write(&current->mm->mmap_sem);
+  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+-				PROT_READ | PROT_WRITE | PROT_EXEC,
++				PROT_READ | PROT_WRITE,
+ 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
+ 				fd_offset + ex.a_text);
+ 		up_write(&current->mm->mmap_sem);
+diff -urNp linux-2.6.32.12/fs/binfmt_elf.c linux-2.6.32.12/fs/binfmt_elf.c
+--- linux-2.6.32.12/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/binfmt_elf.c	2010-04-04 20:47:28.956670452 -0400
+@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
+ #define elf_core_dump	NULL
+ #endif
+ 
++#ifdef CONFIG_PAX_MPROTECT
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
++#endif
++
+ #if ELF_EXEC_PAGESIZE > PAGE_SIZE
+ #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
+ #else
+@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
+ 		.load_binary	= load_elf_binary,
+ 		.load_shlib	= load_elf_library,
+ 		.core_dump	= elf_core_dump,
++
++#ifdef CONFIG_PAX_MPROTECT
++		.handle_mprotect= elf_handle_mprotect,
++#endif
++
+ 		.min_coredump	= ELF_EXEC_PAGESIZE,
+ 		.hasvdso	= 1
+ };
+@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
+ 
+ static int set_brk(unsigned long start, unsigned long end)
+ {
++	unsigned long e = end;
++
+ 	start = ELF_PAGEALIGN(start);
+ 	end = ELF_PAGEALIGN(end);
+ 	if (end > start) {
+@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+-	current->mm->start_brk = current->mm->brk = end;
++	current->mm->start_brk = current->mm->brk = e;
+ 	return 0;
+ }
+ 
+@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
+ 	elf_addr_t __user *u_rand_bytes;
+ 	const char *k_platform = ELF_PLATFORM;
+ 	const char *k_base_platform = ELF_BASE_PLATFORM;
+-	unsigned char k_rand_bytes[16];
++	u32 k_rand_bytes[4];
+ 	int items;
+ 	elf_addr_t *elf_info;
+ 	int ei_index = 0;
+@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
+ 	 * Generate 16 random bytes for userspace PRNG seeding.
+ 	 */
+ 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
+-	u_rand_bytes = (elf_addr_t __user *)
+-		       STACK_ALLOC(p, sizeof(k_rand_bytes));
++	srandom32(k_rand_bytes[0] ^ random32());
++	srandom32(k_rand_bytes[1] ^ random32());
++	srandom32(k_rand_bytes[2] ^ random32());
++	srandom32(k_rand_bytes[3] ^ random32());
++	p = STACK_ROUND(p, sizeof(k_rand_bytes));
++	u_rand_bytes = (elf_addr_t __user *) p;
+ 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
+ 		return -EFAULT;
+ 
+@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
+ {
+ 	struct elf_phdr *elf_phdata;
+ 	struct elf_phdr *eppnt;
+-	unsigned long load_addr = 0;
++	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
+ 	int load_addr_set = 0;
+ 	unsigned long last_bss = 0, elf_bss = 0;
+-	unsigned long error = ~0UL;
++	unsigned long error = -EINVAL;
+ 	unsigned long total_size;
+ 	int retval, i, size;
+ 
+@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
+ 		goto out_close;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	eppnt = elf_phdata;
+ 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
+ 		if (eppnt->p_type == PT_LOAD) {
+@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
+ 			k = load_addr + eppnt->p_vaddr;
+ 			if (BAD_ADDR(k) ||
+ 			    eppnt->p_filesz > eppnt->p_memsz ||
+-			    eppnt->p_memsz > TASK_SIZE ||
+-			    TASK_SIZE - eppnt->p_memsz < k) {
++			    eppnt->p_memsz > pax_task_size ||
++			    pax_task_size - eppnt->p_memsz < k) {
+ 				error = -ENOMEM;
+ 				goto out_close;
+ 			}
+@@ -532,6 +552,177 @@ out:
+ 	return error;
+ }
+ 
++#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
++static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (elf_phdata->p_flags & PF_PAGEEXEC)
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (elf_phdata->p_flags & PF_SEGMEXEC)
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (elf_phdata->p_flags & PF_EMUTRAMP)
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (elf_phdata->p_flags & PF_MPROTECT)
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	unsigned long i;
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++	pax_flags = pax_parse_ei_pax(elf_ex);
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	for (i = 0UL; i < elf_ex->e_phnum; i++)
++		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
++			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
++			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
++			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
++				return -EINVAL;
++
++#ifdef CONFIG_PAX_SOFTMODE
++			if (pax_softmode)
++				pax_flags = pax_parse_softmode(&elf_phdata[i]);
++			else
++#endif
++
++				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
++			break;
++		}
++#endif
++
++	if (0 > pax_check_flags(&pax_flags))
++		return -EINVAL;
++
++	current->mm->pax_flags = pax_flags;
++	return 0;
++}
++#endif
++
+ /*
+  * These are the functions used to load ELF style executables and shared
+  * libraries.  There is no binary dependent code anywhere else.
+@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
+ {
+ 	unsigned int random_variable = 0;
+ 
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		return stack_top - current->mm->delta_stack;
++#endif
++
+ 	if ((current->flags & PF_RANDOMIZE) &&
+ 		!(current->personality & ADDR_NO_RANDOMIZE)) {
+ 		random_variable = get_random_int() & STACK_RND_MASK;
+@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
+  	unsigned long load_addr = 0, load_bias = 0;
+ 	int load_addr_set = 0;
+ 	char * elf_interpreter = NULL;
+-	unsigned long error;
++	unsigned long error = 0;
+ 	struct elf_phdr *elf_ppnt, *elf_phdata;
+ 	unsigned long elf_bss, elf_brk;
+ 	int retval, i;
+@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
+ 	unsigned long start_code, end_code, start_data, end_data;
+ 	unsigned long reloc_func_desc = 0;
+ 	int executable_stack = EXSTACK_DEFAULT;
+-	unsigned long def_flags = 0;
+ 	struct {
+ 		struct elfhdr elf_ex;
+ 		struct elfhdr interp_elf_ex;
+ 	} *loc;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
+ 	if (!loc) {
+@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
+ 
+ 	/* OK, This is the point of no return */
+ 	current->flags &= ~PF_FORKNOEXEC;
+-	current->mm->def_flags = def_flags;
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	current->mm->call_dl_resolve = 0UL;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	current->mm->call_syscall = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	current->mm->delta_mmap = 0UL;
++	current->mm->delta_stack = 0UL;
++#endif
++
++	current->mm->def_flags = 0;
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
++		send_sig(SIGKILL, current, 0);
++		goto out_free_dentry;
++	}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++	pax_set_initial_flags(bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++	if (pax_set_initial_flags_func)
++		(pax_set_initial_flags_func)(bprm);
++#endif
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
++		current->mm->context.user_cs_limit = PAGE_SIZE;
++		current->mm->def_flags |= VM_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
++		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++	}
++#endif
++
++#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
++		put_cpu();
++	}
++#endif
+ 
+ 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
+ 	   may depend on the personality.  */
+ 	SET_PERSONALITY(loc->elf_ex);
++
++#ifdef CONFIG_PAX_ASLR
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
++		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
++		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		executable_stack = EXSTACK_DISABLE_X;
++		current->personality &= ~READ_IMPLIES_EXEC;
++	} else
++#endif
++
+ 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
+ 		current->personality |= READ_IMPLIES_EXEC;
+ 
+@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++			/* PaX: randomize base address at the default exe base if requested */
++			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
++#ifdef CONFIG_SPARC64
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
++#else
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
++#endif
++				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
++				elf_flags |= MAP_FIXED;
++			}
++#endif
++
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
+ 		 * allowed task size. Note that p_filesz must always be
+ 		 * <= p_memsz so it is only necessary to check p_memsz.
+ 		 */
+-		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
+-		    elf_ppnt->p_memsz > TASK_SIZE ||
+-		    TASK_SIZE - elf_ppnt->p_memsz < k) {
++		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
++		    elf_ppnt->p_memsz > pax_task_size ||
++		    pax_task_size - elf_ppnt->p_memsz < k) {
+ 			/* set_brk can never work. Avoid overflows. */
+ 			send_sig(SIGKILL, current, 0);
+ 			retval = -EINVAL;
+@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
+ 	start_data += load_bias;
+ 	end_data += load_bias;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
++		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
++#endif
++
+ 	/* Calling set_brk effectively mmaps the pages that we need
+ 	 * for the bss and break sections.  We must do this before
+ 	 * mapping in the interpreter, to make sure it doesn't wind
+@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
+ 		goto out_free_dentry;
+ 	}
+ 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
+-		send_sig(SIGSEGV, current, 0);
+-		retval = -EFAULT; /* Nobody gets to see this, but.. */
+-		goto out_free_dentry;
++		/*
++		 * This bss-zeroing can fail if the ELF
++		 * file specifies odd protections. So
++		 * we don't check the return value
++		 */
+ 	}
+ 
+ 	if (elf_interpreter) {
+@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
+ 			unsigned long n = off;
+ 			if (n > PAGE_SIZE)
+ 				n = PAGE_SIZE;
+-			if (!dump_write(file, buf, n))
++			if (!dump_write(file, buf, n)) {
++				free_page((unsigned long)buf);
+ 				return 0;
++			}
+ 			off -= n;
+ 		}
+ 		free_page((unsigned long)buf);
+@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
+  * Decide what to dump of a segment, part, all or none.
+  */
+ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+-				   unsigned long mm_flags)
++				   unsigned long mm_flags, long signr)
+ {
+ #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
+ 
+@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
+ 	if (vma->vm_file == NULL)
+ 		return 0;
+ 
+-	if (FILTER(MAPPED_PRIVATE))
++	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
+ 		goto whole;
+ 
+ 	/*
+@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
+ #undef DUMP_WRITE
+ 
+ #define DUMP_WRITE(addr, nr)	\
++	do { \
++	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
+ 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
+-		goto end_coredump;
++		goto end_coredump; \
++	} while (0);
+ 
+ static void fill_elf_header(struct elfhdr *elf, int segs,
+ 			    u16 machine, u32 flags, u8 osabi)
+@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
+ {
+ 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
+ 	int i = 0;
+-	do
++	do {
+ 		i += 2;
+-	while (auxv[i - 2] != AT_NULL);
++	} while (auxv[i - 2] != AT_NULL);
+ 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
+ }
+ 
+@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
+ 		phdr.p_offset = offset;
+ 		phdr.p_vaddr = vma->vm_start;
+ 		phdr.p_paddr = 0;
+-		phdr.p_filesz = vma_dump_size(vma, mm_flags);
++		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
+ 		phdr.p_memsz = vma->vm_end - vma->vm_start;
+ 		offset += phdr.p_filesz;
+ 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
+@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
+ 		unsigned long addr;
+ 		unsigned long end;
+ 
+-		end = vma->vm_start + vma_dump_size(vma, mm_flags);
++		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
+ 
+ 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
+ 			struct page *page;
+@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
+ 			page = get_dump_page(addr);
+ 			if (page) {
+ 				void *kaddr = kmap(page);
++				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
+ 				stop = ((size += PAGE_SIZE) > limit) ||
+ 					!dump_write(file, kaddr, PAGE_SIZE);
+ 				kunmap(page);
+@@ -2042,6 +2334,97 @@ out:
+ 
+ #endif		/* USE_ELF_CORE_DUMP */
+ 
++#ifdef CONFIG_PAX_MPROTECT
++/* PaX: non-PIC ELF libraries need relocations on their executable segments
++ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
++ * we'll remove VM_MAYWRITE for good on RELRO segments.
++ *
++ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
++ * basis because we want to allow the common case and not the special ones.
++ */
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
++{
++	struct elfhdr elf_h;
++	struct elf_phdr elf_p;
++	unsigned long i;
++	unsigned long oldflags;
++	bool is_textrel_rw, is_textrel_rx, is_relro;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
++		return;
++
++	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
++	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
++
++#ifdef CONFIG_PAX_NOELFRELOCS
++	is_textrel_rw = false;
++	is_textrel_rx = false;
++#else
++	/* possible TEXTREL */
++	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
++	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
++#endif
++
++	/* possible RELRO */
++	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
++
++	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
++		return;
++
++	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
++	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
++
++#ifdef CONFIG_PAX_ETEXECRELOCS
++	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++#else
++	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
++#endif
++
++	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++	    !elf_check_arch(&elf_h) ||
++	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
++	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
++		return;
++
++	for (i = 0UL; i < elf_h.e_phnum; i++) {
++		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
++			return;
++		switch (elf_p.p_type) {
++		case PT_DYNAMIC:
++			if (!is_textrel_rw && !is_textrel_rx)
++				continue;
++			i = 0UL;
++			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
++				elf_dyn dyn;
++
++				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
++					return;
++				if (dyn.d_tag == DT_NULL)
++					return;
++				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
++					gr_log_textrel(vma);
++					if (is_textrel_rw)
++						vma->vm_flags |= VM_MAYWRITE;
++					else
++						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
++						vma->vm_flags &= ~VM_MAYWRITE;
++					return;
++				}
++				i++;
++			}
++			return;
++
++		case PT_GNU_RELRO:
++			if (!is_relro)
++				continue;
++			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
++				vma->vm_flags &= ~VM_MAYWRITE;
++			return;
++		}
++	}
++}
++#endif
++
+ static int __init init_elf_binfmt(void)
+ {
+ 	return register_binfmt(&elf_format);
+diff -urNp linux-2.6.32.12/fs/binfmt_flat.c linux-2.6.32.12/fs/binfmt_flat.c
+--- linux-2.6.32.12/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/binfmt_flat.c	2010-04-04 20:46:41.641560293 -0400
+@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
+ 				realdatastart = (unsigned long) -ENOMEM;
+ 			printk("Unable to allocate RAM for process data, errno %d\n",
+ 					(int)-realdatastart);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
++			up_write(&current->mm->mmap_sem);
+ 			ret = realdatastart;
+ 			goto err;
+ 		}
+@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read data+bss, errno %d\n", (int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
+ 			do_munmap(current->mm, realdatastart, data_len + extra);
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len + data_len + extra +
+ 				MAX_SHARED_LIBS * sizeof(unsigned long));
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+diff -urNp linux-2.6.32.12/fs/binfmt_misc.c linux-2.6.32.12/fs/binfmt_misc.c
+--- linux-2.6.32.12/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/binfmt_misc.c	2010-04-04 20:46:41.641560293 -0400
+@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
+ 	static struct tree_descr bm_files[] = {
+ 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
+ 		[3] = {"register", &bm_register_operations, S_IWUSR},
+-		/* last one */ {""}
++		/* last one */ {"", NULL, 0}
+ 	};
+ 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
+ 	if (!err)
+diff -urNp linux-2.6.32.12/fs/bio.c linux-2.6.32.12/fs/bio.c
+--- linux-2.6.32.12/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/bio.c	2010-04-04 20:46:41.641560293 -0400
+@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
+ 
+ 	i = 0;
+ 	while (i < bio_slab_nr) {
+-		struct bio_slab *bslab = &bio_slabs[i];
++		bslab = &bio_slabs[i];
+ 
+ 		if (!bslab->slab && entry == -1)
+ 			entry = i;
+@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
+ 	const int read = bio_data_dir(bio) == READ;
+ 	struct bio_map_data *bmd = bio->bi_private;
+ 	int i;
+-	char *p = bmd->sgvecs[0].iov_base;
++	char *p = (__force char *)bmd->sgvecs[0].iov_base;
+ 
+ 	__bio_for_each_segment(bvec, bio, i, 0) {
+ 		char *addr = page_address(bvec->bv_page);
+diff -urNp linux-2.6.32.12/fs/block_dev.c linux-2.6.32.12/fs/block_dev.c
+--- linux-2.6.32.12/fs/block_dev.c	2010-04-29 17:49:38.421500081 -0400
++++ linux-2.6.32.12/fs/block_dev.c	2010-04-29 17:49:58.449523678 -0400
+@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, 
+ 	else if (bdev->bd_contains == bdev)
+ 		res = 0;  	 /* is a whole device which isn't held */
+ 
+-	else if (bdev->bd_contains->bd_holder == bd_claim)
++	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
+ 		res = 0; 	 /* is a partition of a device that is being partitioned */
+ 	else if (bdev->bd_contains->bd_holder != NULL)
+ 		res = -EBUSY;	 /* is a partition of a held device */
+diff -urNp linux-2.6.32.12/fs/btrfs/ctree.c linux-2.6.32.12/fs/btrfs/ctree.c
+--- linux-2.6.32.12/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/ctree.c	2010-04-04 20:46:41.641560293 -0400
+@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
+ 
+ 	ret = 0;
+ 	if (slot == 0) {
+-		struct btrfs_disk_key disk_key;
+ 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
+ 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
+ 	}
+diff -urNp linux-2.6.32.12/fs/btrfs/disk-io.c linux-2.6.32.12/fs/btrfs/disk-io.c
+--- linux-2.6.32.12/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/disk-io.c	2010-04-04 20:46:41.641560293 -0400
+@@ -39,7 +39,7 @@
+ #include "tree-log.h"
+ #include "free-space-cache.h"
+ 
+-static struct extent_io_ops btree_extent_io_ops;
++static const struct extent_io_ops btree_extent_io_ops;
+ static void end_workqueue_fn(struct btrfs_work *work);
+ static void free_fs_root(struct btrfs_root *root);
+ 
+@@ -2585,7 +2585,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct extent_io_ops btree_extent_io_ops = {
++static const struct extent_io_ops btree_extent_io_ops = {
+ 	.write_cache_pages_lock_hook = btree_lock_page_hook,
+ 	.readpage_end_io_hook = btree_readpage_end_io_hook,
+ 	.submit_bio_hook = btree_submit_bio_hook,
+diff -urNp linux-2.6.32.12/fs/btrfs/extent_io.h linux-2.6.32.12/fs/btrfs/extent_io.h
+--- linux-2.6.32.12/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/extent_io.h	2010-04-04 20:46:41.641560293 -0400
+@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
+ 				       struct bio *bio, int mirror_num,
+ 				       unsigned long bio_flags);
+ struct extent_io_ops {
+-	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
++	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
+ 			     u64 start, u64 end, int *page_started,
+ 			     unsigned long *nr_written);
+-	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+-	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
+ 	extent_submit_bio_hook_t *submit_bio_hook;
+-	int (*merge_bio_hook)(struct page *page, unsigned long offset,
++	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
+ 			      size_t size, struct bio *bio,
+ 			      unsigned long bio_flags);
+-	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
+-	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
+ 				       u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
+ 					u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				    struct extent_state *state);
+-	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				      struct extent_state *state, int uptodate);
+-	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
++	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
+ 			    unsigned long old, unsigned long bits);
+-	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
++	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
+ 			      unsigned long bits);
+-	int (*merge_extent_hook)(struct inode *inode,
++	int (* const merge_extent_hook)(struct inode *inode,
+ 				 struct extent_state *new,
+ 				 struct extent_state *other);
+-	int (*split_extent_hook)(struct inode *inode,
++	int (* const split_extent_hook)(struct inode *inode,
+ 				 struct extent_state *orig, u64 split);
+-	int (*write_cache_pages_lock_hook)(struct page *page);
++	int (* const write_cache_pages_lock_hook)(struct page *page);
+ };
+ 
+ struct extent_io_tree {
+@@ -88,7 +88,7 @@ struct extent_io_tree {
+ 	u64 dirty_bytes;
+ 	spinlock_t lock;
+ 	spinlock_t buffer_lock;
+-	struct extent_io_ops *ops;
++	const struct extent_io_ops *ops;
+ };
+ 
+ struct extent_state {
+diff -urNp linux-2.6.32.12/fs/btrfs/free-space-cache.c linux-2.6.32.12/fs/btrfs/free-space-cache.c
+--- linux-2.6.32.12/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/free-space-cache.c	2010-04-04 20:46:41.641560293 -0400
+@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
+ 
+ 	while(1) {
+ 		if (entry->bytes < bytes || entry->offset < min_start) {
+-			struct rb_node *node;
+-
+ 			node = rb_next(&entry->offset_index);
+ 			if (!node)
+ 				break;
+@@ -1226,7 +1224,7 @@ again:
+ 	 */
+ 	while (entry->bitmap || found_bitmap ||
+ 	       (!entry->bitmap && entry->bytes < min_bytes)) {
+-		struct rb_node *node = rb_next(&entry->offset_index);
++		node = rb_next(&entry->offset_index);
+ 
+ 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
+ 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+diff -urNp linux-2.6.32.12/fs/btrfs/inode.c linux-2.6.32.12/fs/btrfs/inode.c
+--- linux-2.6.32.12/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/inode.c	2010-04-04 20:46:41.641560293 -0400
+@@ -63,7 +63,7 @@ static const struct inode_operations btr
+ static const struct address_space_operations btrfs_aops;
+ static const struct address_space_operations btrfs_symlink_aops;
+ static const struct file_operations btrfs_dir_file_operations;
+-static struct extent_io_ops btrfs_extent_io_ops;
++static const struct extent_io_ops btrfs_extent_io_ops;
+ 
+ static struct kmem_cache *btrfs_inode_cachep;
+ struct kmem_cache *btrfs_trans_handle_cachep;
+@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
+ 	.fsync		= btrfs_sync_file,
+ };
+ 
+-static struct extent_io_ops btrfs_extent_io_ops = {
++static const struct extent_io_ops btrfs_extent_io_ops = {
+ 	.fill_delalloc = run_delalloc_range,
+ 	.submit_bio_hook = btrfs_submit_bio_hook,
+ 	.merge_bio_hook = btrfs_merge_bio_hook,
+diff -urNp linux-2.6.32.12/fs/btrfs/sysfs.c linux-2.6.32.12/fs/btrfs/sysfs.c
+--- linux-2.6.32.12/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/btrfs/sysfs.c	2010-04-04 20:46:41.641560293 -0400
+@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
+ 	complete(&root->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops btrfs_super_attr_ops = {
++static const struct sysfs_ops btrfs_super_attr_ops = {
+ 	.show	= btrfs_super_attr_show,
+ 	.store	= btrfs_super_attr_store,
+ };
+ 
+-static struct sysfs_ops btrfs_root_attr_ops = {
++static const struct sysfs_ops btrfs_root_attr_ops = {
+ 	.show	= btrfs_root_attr_show,
+ 	.store	= btrfs_root_attr_store,
+ };
+diff -urNp linux-2.6.32.12/fs/buffer.c linux-2.6.32.12/fs/buffer.c
+--- linux-2.6.32.12/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/buffer.c	2010-04-04 20:46:41.641560293 -0400
+@@ -25,6 +25,7 @@
+ #include <linux/percpu.h>
+ #include <linux/slab.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/blkdev.h>
+ #include <linux/file.h>
+ #include <linux/quotaops.h>
+diff -urNp linux-2.6.32.12/fs/cachefiles/bind.c linux-2.6.32.12/fs/cachefiles/bind.c
+--- linux-2.6.32.12/fs/cachefiles/bind.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/cachefiles/bind.c	2010-04-29 17:46:37.245246835 -0400
+@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
+ 	       args);
+ 
+ 	/* start by checking things over */
+-	ASSERT(cache->fstop_percent >= 0 &&
+-	       cache->fstop_percent < cache->fcull_percent &&
++	ASSERT(cache->fstop_percent < cache->fcull_percent &&
+ 	       cache->fcull_percent < cache->frun_percent &&
+ 	       cache->frun_percent  < 100);
+ 
+-	ASSERT(cache->bstop_percent >= 0 &&
+-	       cache->bstop_percent < cache->bcull_percent &&
++	ASSERT(cache->bstop_percent < cache->bcull_percent &&
+ 	       cache->bcull_percent < cache->brun_percent &&
+ 	       cache->brun_percent  < 100);
+ 
+diff -urNp linux-2.6.32.12/fs/cachefiles/daemon.c linux-2.6.32.12/fs/cachefiles/daemon.c
+--- linux-2.6.32.12/fs/cachefiles/daemon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/cachefiles/daemon.c	2010-04-29 17:46:37.253252101 -0400
+@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
+ 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
+ 		return -EIO;
+ 
+-	if (datalen < 0 || datalen > PAGE_SIZE - 1)
++	if (datalen > PAGE_SIZE - 1)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* drag the command string into the kernel so we can parse it */
+@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (fstop < 0 || fstop >= cache->fcull_percent)
++	if (fstop >= cache->fcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->fstop_percent = fstop;
+@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (bstop < 0 || bstop >= cache->bcull_percent)
++	if (bstop >= cache->bcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->bstop_percent = bstop;
+diff -urNp linux-2.6.32.12/fs/cachefiles/rdwr.c linux-2.6.32.12/fs/cachefiles/rdwr.c
+--- linux-2.6.32.12/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/cachefiles/rdwr.c	2010-04-04 20:46:41.641560293 -0400
+@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
+ 			old_fs = get_fs();
+ 			set_fs(KERNEL_DS);
+ 			ret = file->f_op->write(
+-				file, (const void __user *) data, len, &pos);
++				file, (__force const void __user *) data, len, &pos);
+ 			set_fs(old_fs);
+ 			kunmap(page);
+ 			if (ret != len)
+diff -urNp linux-2.6.32.12/fs/cifs/cifs_uniupr.h linux-2.6.32.12/fs/cifs/cifs_uniupr.h
+--- linux-2.6.32.12/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/cifs/cifs_uniupr.h	2010-04-04 20:46:41.645781188 -0400
+@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
+ 	{0x0490, 0x04cc, UniCaseRangeU0490},
+ 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
+ 	{0xff40, 0xff5a, UniCaseRangeUff40},
+-	{0}
++	{0, 0, NULL}
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.12/fs/cifs/link.c linux-2.6.32.12/fs/cifs/link.c
+--- linux-2.6.32.12/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/cifs/link.c	2010-04-04 20:46:41.645781188 -0400
+@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
+ 
+ void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
+ {
+-	char *p = nd_get_link(nd);
++	const char *p = nd_get_link(nd);
+ 	if (!IS_ERR(p))
+ 		kfree(p);
+ }
+diff -urNp linux-2.6.32.12/fs/compat_binfmt_elf.c linux-2.6.32.12/fs/compat_binfmt_elf.c
+--- linux-2.6.32.12/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/compat_binfmt_elf.c	2010-04-04 20:46:41.645781188 -0400
+@@ -29,10 +29,12 @@
+ #undef	elfhdr
+ #undef	elf_phdr
+ #undef	elf_note
++#undef	elf_dyn
+ #undef	elf_addr_t
+ #define elfhdr		elf32_hdr
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
++#define elf_dyn		Elf32_Dyn
+ #define elf_addr_t	Elf32_Addr
+ 
+ /*
+diff -urNp linux-2.6.32.12/fs/compat.c linux-2.6.32.12/fs/compat.c
+--- linux-2.6.32.12/fs/compat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/compat.c	2010-04-04 20:46:41.645781188 -0400
+@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
+ 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
+ 				struct page *page;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+ 				ret = expand_stack_downwards(bprm->vma, pos);
+ 				if (ret < 0) {
+ 					/* We've exceed the stack rlimit. */
+ 					ret = -E2BIG;
+ 					goto out;
+ 				}
+-#endif
+ 				ret = get_user_pages(current, bprm->mm, pos,
+ 						     1, 1, 1, &page, NULL);
+ 				if (ret <= 0) {
+@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
+ 	compat_uptr_t __user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++	retval = -EAGAIN;
++	if (gr_handle_nproc())
++		goto out_file;
++	retval = -EACCES;
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
++		goto out_file;
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, (char __user * __user *)argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	retval = search_binary_handler(bprm, regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	current->stack_start = current->mm->start_stack;
+ 
+@@ -1543,6 +1585,14 @@ int compat_do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput(bprm->mm);
+diff -urNp linux-2.6.32.12/fs/compat_ioctl.c linux-2.6.32.12/fs/compat_ioctl.c
+--- linux-2.6.32.12/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/compat_ioctl.c	2010-04-04 20:46:41.645781188 -0400
+@@ -1827,15 +1827,15 @@ struct ioctl_trans {
+ };
+ 
+ #define HANDLE_IOCTL(cmd,handler) \
+-	{ (cmd), (ioctl_trans_handler_t)(handler) },
++	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
+ 
+ /* pointer to compatible structure or no argument */
+ #define COMPATIBLE_IOCTL(cmd) \
+-	{ (cmd), do_ioctl32_pointer },
++	{ (cmd), do_ioctl32_pointer, NULL },
+ 
+ /* argument is an unsigned long integer, not a pointer */
+ #define ULONG_IOCTL(cmd) \
+-	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
++	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
+ 
+ /* ioctl should not be warned about even if it's not implemented.
+    Valid reasons to use this:
+diff -urNp linux-2.6.32.12/fs/debugfs/inode.c linux-2.6.32.12/fs/debugfs/inode.c
+--- linux-2.6.32.12/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/debugfs/inode.c	2010-04-04 20:46:41.645781188 -0400
+@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	static struct tree_descr debug_files[] = {{""}};
++	static struct tree_descr debug_files[] = {{"", NULL, 0}};
+ 
+ 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
+ }
+diff -urNp linux-2.6.32.12/fs/dlm/lockspace.c linux-2.6.32.12/fs/dlm/lockspace.c
+--- linux-2.6.32.12/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/dlm/lockspace.c	2010-04-04 20:46:41.645781188 -0400
+@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
+ 	kfree(ls);
+ }
+ 
+-static struct sysfs_ops dlm_attr_ops = {
++static const struct sysfs_ops dlm_attr_ops = {
+ 	.show  = dlm_attr_show,
+ 	.store = dlm_attr_store,
+ };
+diff -urNp linux-2.6.32.12/fs/ecryptfs/inode.c linux-2.6.32.12/fs/ecryptfs/inode.c
+--- linux-2.6.32.12/fs/ecryptfs/inode.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.12/fs/ecryptfs/inode.c	2010-04-29 17:49:58.465067636 -0400
+@@ -655,7 +655,7 @@ static int ecryptfs_readlink_lower(struc
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
+-						   (char __user *)lower_buf,
++						   (__force char __user *)lower_buf,
+ 						   lower_bufsiz);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+@@ -701,7 +701,7 @@ static void *ecryptfs_follow_link(struct
+ 	}
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+-	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
++	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+ 		goto out_free;
+diff -urNp linux-2.6.32.12/fs/exec.c linux-2.6.32.12/fs/exec.c
+--- linux-2.6.32.12/fs/exec.c	2010-04-04 20:41:50.037938751 -0400
++++ linux-2.6.32.12/fs/exec.c	2010-04-04 20:46:41.645781188 -0400
+@@ -56,12 +56,24 @@
+ #include <linux/fsnotify.h>
+ #include <linux/fs_struct.h>
+ #include <linux/pipe_fs_i.h>
++#include <linux/random.h>
++#include <linux/seq_file.h>
++
++#ifdef CONFIG_PAX_REFCOUNT
++#include <linux/kallsyms.h>
++#include <linux/kdebug.h>
++#endif
+ 
+ #include <asm/uaccess.h>
+ #include <asm/mmu_context.h>
+ #include <asm/tlb.h>
+ #include "internal.h"
+ 
++#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
++void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++EXPORT_SYMBOL(pax_set_initial_flags_func);
++#endif
++
+ int core_uses_pid;
+ char core_pattern[CORENAME_MAX_SIZE] = "core";
+ unsigned int core_pipe_limit;
+@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
+ 		goto out;
+ 
+ 	file = do_filp_open(AT_FDCWD, tmp,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_READ | MAY_EXEC | MAY_OPEN);
+ 	putname(tmp);
+ 	error = PTR_ERR(file);
+@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
+ 		int write)
+ {
+ 	struct page *page;
+-	int ret;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+-	if (write) {
+-		ret = expand_stack_downwards(bprm->vma, pos);
+-		if (ret < 0)
+-			return NULL;
+-	}
+-#endif
+-	ret = get_user_pages(current, bprm->mm, pos,
+-			1, write, 1, &page, NULL);
+-	if (ret <= 0)
++	if (0 > expand_stack_downwards(bprm->vma, pos))
++		return NULL;
++	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
+ 		return NULL;
+ 
+ 	if (write) {
+@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
+ 	vma->vm_end = STACK_TOP_MAX;
+ 	vma->vm_start = vma->vm_end - PAGE_SIZE;
+ 	vma->vm_flags = VM_STACK_FLAGS;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 	err = insert_vm_struct(mm, vma);
+ 	if (err)
+@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
+ 	mm->stack_vm = mm->total_vm = 1;
+ 	up_write(&mm->mmap_sem);
+ 	bprm->p = vma->vm_end - sizeof(void *);
++
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
++#endif
++
+ 	return 0;
+ err:
+ 	up_write(&mm->mmap_sem);
+@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
+ 	int r;
+ 	mm_segment_t oldfs = get_fs();
+ 	set_fs(KERNEL_DS);
+-	r = copy_strings(argc, (char __user * __user *)argv, bprm);
++	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
+ 	set_fs(oldfs);
+ 	return r;
+ }
+@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
+ 	unsigned long new_end = old_end - shift;
+ 	struct mmu_gather *tlb;
+ 
+-	BUG_ON(new_start > new_end);
++	if (new_start >= new_end || new_start < mmap_min_addr)
++		return -EFAULT;
+ 
+ 	/*
+ 	 * ensure there are no vmas between where we want to go
+@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
+ 	if (vma != find_vma(mm, new_start))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	BUG_ON(pax_find_mirror_vma(vma));
++#endif
++
+ 	/*
+ 	 * cover the whole range: [new_start, old_end)
+ 	 */
+@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
+ 	bprm->exec -= stack_shift;
+ 
+ 	down_write(&mm->mmap_sem);
++
++	/* Move stack pages down in memory. */
++	if (stack_shift) {
++		ret = shift_arg_pages(vma, stack_shift);
++		if (ret)
++			goto out_unlock;
++	}
++
+ 	vm_flags = VM_STACK_FLAGS;
+ 
+ 	/*
+@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
+ 		vm_flags &= ~VM_EXEC;
+ 	vm_flags |= mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			vm_flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
+ 			vm_flags);
+ 	if (ret)
+ 		goto out_unlock;
+ 	BUG_ON(prev != vma);
+ 
+-	/* Move stack pages down in memory. */
+-	if (stack_shift) {
+-		ret = shift_arg_pages(vma, stack_shift);
+-		if (ret)
+-			goto out_unlock;
+-	}
+-
+ 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+ 	stack_size = vma->vm_end - vma->vm_start;
+ 	/*
+@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
+ 	int err;
+ 
+ 	file = do_filp_open(AT_FDCWD, name,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_EXEC | MAY_OPEN);
+ 	if (IS_ERR(file))
+ 		goto out;
+@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	result = vfs_read(file, (void __user *)addr, count, &pos);
++	result = vfs_read(file, (__force void __user *)addr, count, &pos);
+ 	set_fs(old_fs);
+ 	return result;
+ }
+@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
+ 	}
+ 	rcu_read_unlock();
+ 
+-	if (p->fs->users > n_fs) {
++	if (atomic_read(&p->fs->users) > n_fs) {
+ 		bprm->unsafe |= LSM_UNSAFE_SHARE;
+ 	} else {
+ 		res = -EAGAIN;
+@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
+ 	char __user *__user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++
++	if (gr_handle_nproc()) {
++		retval = -EAGAIN;
++		goto out_file;
++	}
++
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
++		retval = -EACCES;
++		goto out_file;
++	}
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	current->flags &= ~PF_KTHREAD;
+ 	retval = search_binary_handler(bprm,regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	current->stack_start = current->mm->start_stack;
+ 
+@@ -1390,6 +1471,14 @@ int do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput (bprm->mm);
+@@ -1553,6 +1642,169 @@ out:
+ 	return ispipe;
+ }
+ 
++int pax_check_flags(unsigned long *flags)
++{
++	int retval = 0;
++
++#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
++	if (*flags & MF_PAX_SEGMEXEC)
++	{
++		*flags &= ~MF_PAX_SEGMEXEC;
++		retval = -EINVAL;
++	}
++#endif
++
++	if ((*flags & MF_PAX_PAGEEXEC)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	    &&  (*flags & MF_PAX_SEGMEXEC)
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_PAGEEXEC;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_MPROTECT)
++
++#ifdef CONFIG_PAX_MPROTECT
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_MPROTECT;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_EMUTRAMP)
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_EMUTRAMP;
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++EXPORT_SYMBOL(pax_check_flags);
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
++{
++	struct task_struct *tsk = current;
++	struct mm_struct *mm = current->mm;
++	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
++	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
++	char *path_exec = NULL;
++	char *path_fault = NULL;
++	unsigned long start = 0UL, end = 0UL, offset = 0UL;
++
++	if (buffer_exec && buffer_fault) {
++		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
++
++		down_read(&mm->mmap_sem);
++		vma = mm->mmap;
++		while (vma && (!vma_exec || !vma_fault)) {
++			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
++				vma_exec = vma;
++			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
++				vma_fault = vma;
++			vma = vma->vm_next;
++		}
++		if (vma_exec) {
++			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
++			if (IS_ERR(path_exec))
++				path_exec = "<path too long>";
++			else {
++				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
++				if (path_exec) {
++					*path_exec = 0;
++					path_exec = buffer_exec;
++				} else
++					path_exec = "<path too long>";
++			}
++		}
++		if (vma_fault) {
++			start = vma_fault->vm_start;
++			end = vma_fault->vm_end;
++			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
++			if (vma_fault->vm_file) {
++				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
++				if (IS_ERR(path_fault))
++					path_fault = "<path too long>";
++				else {
++					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
++					if (path_fault) {
++						*path_fault = 0;
++						path_fault = buffer_fault;
++					} else
++						path_fault = "<path too long>";
++				}
++			} else
++				path_fault = "<anonymous mapping>";
++		}
++		up_read(&mm->mmap_sem);
++	}
++	if (tsk->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
++	else
++		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
++	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
++			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
++			task_uid(tsk), task_euid(tsk), pc, sp);
++	free_page((unsigned long)buffer_exec);
++	free_page((unsigned long)buffer_fault);
++	pax_report_insns(pc, sp);
++	do_coredump(SIGKILL, SIGKILL, regs);
++}
++#endif
++
++#ifdef CONFIG_PAX_REFCOUNT
++void pax_report_refcount_overflow(struct pt_regs *regs)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++	else
++		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
++	show_regs(regs);
++	force_sig_specific(SIGKILL, current);
++}
++#endif
++
++#ifdef CONFIG_PAX_USERCOPY
++void pax_report_leak_to_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++
++void pax_report_overflow_from_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++#endif
++
+ static int zap_process(struct task_struct *start)
+ {
+ 	struct task_struct *t;
+@@ -1755,17 +2007,17 @@ static void wait_for_dump_helpers(struct
+ 	pipe = file->f_path.dentry->d_inode->i_pipe;
+ 
+ 	pipe_lock(pipe);
+-	pipe->readers++;
+-	pipe->writers--;
++	atomic_inc(&pipe->readers);
++	atomic_dec(&pipe->writers);
+ 
+-	while ((pipe->readers > 1) && (!signal_pending(current))) {
++	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
+ 		wake_up_interruptible_sync(&pipe->wait);
+ 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 		pipe_wait(pipe);
+ 	}
+ 
+-	pipe->readers--;
+-	pipe->writers++;
++	atomic_dec(&pipe->readers);
++	atomic_inc(&pipe->writers);
+ 	pipe_unlock(pipe);
+ 
+ }
+@@ -1836,6 +2088,10 @@ void do_coredump(long signr, int exit_co
+ 	 */
+ 	clear_thread_flag(TIF_SIGPENDING);
+ 
++	if (signr == SIGKILL || signr == SIGILL)
++		gr_handle_brute_attach(current);
++	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
++
+ 	/*
+ 	 * lock_kernel() because format_corename() is controlled by sysctl, which
+ 	 * uses lock_kernel()
+diff -urNp linux-2.6.32.12/fs/ext2/balloc.c linux-2.6.32.12/fs/ext2/balloc.c
+--- linux-2.6.32.12/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext2/balloc.c	2010-04-04 20:46:41.645781188 -0400
+@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.12/fs/ext2/xattr.c linux-2.6.32.12/fs/ext2/xattr.c
+--- linux-2.6.32.12/fs/ext2/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext2/xattr.c	2010-04-29 17:46:37.253252101 -0400
+@@ -85,8 +85,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static int ext2_xattr_set2(struct inode *, struct buffer_head *,
+diff -urNp linux-2.6.32.12/fs/ext3/balloc.c linux-2.6.32.12/fs/ext3/balloc.c
+--- linux-2.6.32.12/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext3/balloc.c	2010-04-04 20:46:41.645781188 -0400
+@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.12/fs/ext3/namei.c linux-2.6.32.12/fs/ext3/namei.c
+--- linux-2.6.32.12/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext3/namei.c	2010-04-04 20:46:41.649500937 -0400
+@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext3_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext3_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.12/fs/ext3/xattr.c linux-2.6.32.12/fs/ext3/xattr.c
+--- linux-2.6.32.12/fs/ext3/xattr.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.12/fs/ext3/xattr.c	2010-04-29 17:49:58.485032679 -0400
+@@ -89,8 +89,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(f...) do {} while (0)
++# define ea_bdebug(f...) do {} while (0)
+ #endif
+ 
+ static void ext3_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.12/fs/ext4/balloc.c linux-2.6.32.12/fs/ext4/balloc.c
+--- linux-2.6.32.12/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext4/balloc.c	2010-04-04 20:46:41.649500937 -0400
+@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
+ 	/* Hm, nope.  Are (enough) root reserved blocks available? */
+ 	if (sbi->s_resuid == current_fsuid() ||
+ 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
+-	    capable(CAP_SYS_RESOURCE)) {
++	    capable_nolog(CAP_SYS_RESOURCE)) {
+ 		if (free_blocks >= (nblocks + dirty_blocks))
+ 			return 1;
+ 	}
+diff -urNp linux-2.6.32.12/fs/ext4/ioctl.c linux-2.6.32.12/fs/ext4/ioctl.c
+--- linux-2.6.32.12/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext4/ioctl.c	2010-04-04 20:46:41.649500937 -0400
+@@ -221,6 +221,9 @@ setversion_out:
+ 		struct file *donor_filp;
+ 		int err;
+ 
++		/* temporary workaround for bugs in here */
++		return -EOPNOTSUPP;
++
+ 		if (!(filp->f_mode & FMODE_READ) ||
+ 		    !(filp->f_mode & FMODE_WRITE))
+ 			return -EBADF;
+diff -urNp linux-2.6.32.12/fs/ext4/namei.c linux-2.6.32.12/fs/ext4/namei.c
+--- linux-2.6.32.12/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext4/namei.c	2010-04-04 20:46:41.649500937 -0400
+@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext4_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext4_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.12/fs/ext4/super.c linux-2.6.32.12/fs/ext4/super.c
+--- linux-2.6.32.12/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext4/super.c	2010-04-04 20:46:41.649500937 -0400
+@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
+ }
+ 
+ 
+-static struct sysfs_ops ext4_attr_ops = {
++static const struct sysfs_ops ext4_attr_ops = {
+ 	.show	= ext4_attr_show,
+ 	.store	= ext4_attr_store,
+ };
+diff -urNp linux-2.6.32.12/fs/ext4/xattr.c linux-2.6.32.12/fs/ext4/xattr.c
+--- linux-2.6.32.12/fs/ext4/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ext4/xattr.c	2010-04-29 17:46:37.279760502 -0400
+@@ -82,8 +82,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static void ext4_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.12/fs/fcntl.c linux-2.6.32.12/fs/fcntl.c
+--- linux-2.6.32.12/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fcntl.c	2010-04-04 20:46:41.649500937 -0400
+@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
+ 	switch (cmd) {
+ 	case F_DUPFD:
+ 	case F_DUPFD_CLOEXEC:
++		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
+ 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 			break;
+ 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
+@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
+ 	ret = ((fown->euid == 0 ||
+ 		fown->euid == cred->suid || fown->euid == cred->uid ||
+ 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
+-	       !security_file_send_sigiotask(p, fown, sig));
++	       !security_file_send_sigiotask(p, fown, sig) &&
++	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
+ 	rcu_read_unlock();
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.12/fs/fifo.c linux-2.6.32.12/fs/fifo.c
+--- linux-2.6.32.12/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fifo.c	2010-04-04 20:46:41.649500937 -0400
+@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &read_pipefifo_fops;
+ 		pipe->r_counter++;
+-		if (pipe->readers++ == 0)
++		if (atomic_inc_return(&pipe->readers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->writers) {
++		if (!atomic_read(&pipe->writers)) {
+ 			if ((filp->f_flags & O_NONBLOCK)) {
+ 				/* suppress POLLHUP until we have
+ 				 * seen a writer */
+@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
+ 	 *  errno=ENXIO when there is no process reading the FIFO.
+ 	 */
+ 		ret = -ENXIO;
+-		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
++		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
+ 			goto err;
+ 
+ 		filp->f_op = &write_pipefifo_fops;
+ 		pipe->w_counter++;
+-		if (!pipe->writers++)
++		if (atomic_inc_return(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			wait_for_partner(inode, &pipe->r_counter);
+ 			if (signal_pending(current))
+ 				goto err_wr;
+@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &rdwr_pipefifo_fops;
+ 
+-		pipe->readers++;
+-		pipe->writers++;
++		atomic_inc(&pipe->readers);
++		atomic_inc(&pipe->writers);
+ 		pipe->r_counter++;
+ 		pipe->w_counter++;
+-		if (pipe->readers == 1 || pipe->writers == 1)
++		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 		break;
+ 
+@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
+ 	return 0;
+ 
+ err_rd:
+-	if (!--pipe->readers)
++	if (atomic_dec_and_test(&pipe->readers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err_wr:
+-	if (!--pipe->writers)
++	if (atomic_dec_and_test(&pipe->writers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err:
+-	if (!pipe->readers && !pipe->writers)
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
+ 		free_pipe_info(inode);
+ 
+ err_nocleanup:
+diff -urNp linux-2.6.32.12/fs/file.c linux-2.6.32.12/fs/file.c
+--- linux-2.6.32.12/fs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/file.c	2010-04-04 20:46:41.649500937 -0400
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/fdtable.h>
+ #include <linux/bitops.h>
+ #include <linux/interrupt.h>
+@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
+ 	 * N.B. For clone tasks sharing a files structure, this test
+ 	 * will limit the total number of files that can be opened.
+ 	 */
++
++	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
+ 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EMFILE;
+ 
+diff -urNp linux-2.6.32.12/fs/fs_struct.c linux-2.6.32.12/fs/fs_struct.c
+--- linux-2.6.32.12/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fs_struct.c	2010-04-04 20:46:41.649500937 -0400
+@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
+ 	struct task_struct *g, *p;
+ 	struct fs_struct *fs;
+ 	int count = 0;
++	unsigned long flags;
+ 
+ 	read_lock(&tasklist_lock);
+ 	do_each_thread(g, p) {
+ 		task_lock(p);
++		gr_fs_write_lock_irqsave(p, flags);
+ 		fs = p->fs;
+ 		if (fs) {
+ 			write_lock(&fs->lock);
+@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
+ 			}
+ 			write_unlock(&fs->lock);
+ 		}
++		gr_fs_write_unlock_irqrestore(p, flags);
+ 		task_unlock(p);
+ 	} while_each_thread(g, p);
+ 	read_unlock(&tasklist_lock);
+@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
+ void exit_fs(struct task_struct *tsk)
+ {
+ 	struct fs_struct *fs = tsk->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+ 		task_lock(tsk);
++		gr_fs_write_lock_irqsave(tsk, flags);
+ 		write_lock(&fs->lock);
+ 		tsk->fs = NULL;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(tsk, flags);
+ 		task_unlock(tsk);
+ 		if (kill)
+ 			free_fs_struct(fs);
+@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
+ 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
+ 	/* We don't need to lock fs - think why ;-) */
+ 	if (fs) {
+-		fs->users = 1;
++		atomic_set(&fs->users, 1);
+ 		fs->in_exec = 0;
+ 		rwlock_init(&fs->lock);
+ 		fs->umask = old->umask;
+@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
+ 	struct fs_struct *fs = current->fs;
+ 	struct fs_struct *new_fs = copy_fs_struct(fs);
+ 	int kill;
++	unsigned long flags;
+ 
+ 	if (!new_fs)
+ 		return -ENOMEM;
+ 
+ 	task_lock(current);
++	gr_fs_write_lock_irqsave(current, flags);
+ 	write_lock(&fs->lock);
+-	kill = !--fs->users;
++	kill = !atomic_dec_return(&fs->users);
+ 	current->fs = new_fs;
+ 	write_unlock(&fs->lock);
++	gr_fs_write_unlock_irqrestore(current, flags);
+ 	task_unlock(current);
+ 
+ 	if (kill)
+@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
+ 
+ /* to be mentioned only in INIT_TASK */
+ struct fs_struct init_fs = {
+-	.users		= 1,
++	.users		= ATOMIC_INIT(1),
+ 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
+ 	.umask		= 0022,
+ };
+@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
+ void daemonize_fs_struct(void)
+ {
+ 	struct fs_struct *fs = current->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
+ 		task_lock(current);
+ 
+ 		write_lock(&init_fs.lock);
+-		init_fs.users++;
++		atomic_inc(&init_fs.users);
+ 		write_unlock(&init_fs.lock);
+ 
++		gr_fs_write_lock_irqsave(current, flags);
+ 		write_lock(&fs->lock);
+ 		current->fs = &init_fs;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(current, flags);
+ 
+ 		task_unlock(current);
+ 		if (kill)
+diff -urNp linux-2.6.32.12/fs/fuse/control.c linux-2.6.32.12/fs/fuse/control.c
+--- linux-2.6.32.12/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fuse/control.c	2010-04-04 20:46:41.649500937 -0400
+@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
+ 
+ static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	struct tree_descr empty_descr = {""};
++	struct tree_descr empty_descr = {"", NULL, 0};
+ 	struct fuse_conn *fc;
+ 	int err;
+ 
+diff -urNp linux-2.6.32.12/fs/fuse/cuse.c linux-2.6.32.12/fs/fuse/cuse.c
+--- linux-2.6.32.12/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fuse/cuse.c	2010-04-04 20:46:41.649500937 -0400
+@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
+ 	return rc;
+ }
+ 
+-static struct file_operations cuse_channel_fops; /* initialized during init */
+-
++static const struct file_operations cuse_channel_fops = { /* initialized during init */
++	.owner		= THIS_MODULE,
++	.llseek		= no_llseek,
++	.read		= do_sync_read,
++	.aio_read	= fuse_dev_read,
++	.write		= do_sync_write,
++	.aio_write	= fuse_dev_write,
++	.poll		= fuse_dev_poll,
++	.open		= cuse_channel_open,
++	.release	= cuse_channel_release,
++	.fasync		= fuse_dev_fasync,
++};
+ 
+ /**************************************************************************
+  * Misc stuff and module initializatiion
+@@ -575,12 +585,6 @@ static int __init cuse_init(void)
+ 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
+ 		INIT_LIST_HEAD(&cuse_conntbl[i]);
+ 
+-	/* inherit and extend fuse_dev_operations */
+-	cuse_channel_fops		= fuse_dev_operations;
+-	cuse_channel_fops.owner		= THIS_MODULE;
+-	cuse_channel_fops.open		= cuse_channel_open;
+-	cuse_channel_fops.release	= cuse_channel_release;
+-
+ 	cuse_class = class_create(THIS_MODULE, "cuse");
+ 	if (IS_ERR(cuse_class))
+ 		return PTR_ERR(cuse_class);
+diff -urNp linux-2.6.32.12/fs/fuse/dev.c linux-2.6.32.12/fs/fuse/dev.c
+--- linux-2.6.32.12/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fuse/dev.c	2010-04-04 20:46:41.649500937 -0400
+@@ -745,7 +745,7 @@ __releases(&fc->lock)
+  * request_end().  Otherwise add it to the processing list, and set
+  * the 'sent' flag.
+  */
+-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+ 			      unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
+ 	spin_unlock(&fc->lock);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_read);
+ 
+ static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
+ 			    struct fuse_copy_state *cs)
+@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
+ {
+ 	struct fuse_notify_inval_entry_out outarg;
+ 	int err = -EINVAL;
+-	char buf[FUSE_NAME_MAX+1];
++	char *buf = NULL;
+ 	struct qstr name;
+ 
+ 	if (size < sizeof(outarg))
+@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
+ 	if (outarg.namelen > FUSE_NAME_MAX)
+ 		goto err;
+ 
++	err = -ENOMEM;
++	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
++	if (!buf)
++		goto err;
++
+ 	name.name = buf;
+ 	name.len = outarg.namelen;
+ 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
+@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
+ 
+ 	down_read(&fc->killsb);
+ 	err = -ENOENT;
+-	if (!fc->sb)
+-		goto err_unlock;
+-
+-	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+-
+-err_unlock:
++	if (fc->sb)
++		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+ 	up_read(&fc->killsb);
++	kfree(buf);
+ 	return err;
+ 
+ err:
+ 	fuse_copy_finish(cs);
++	kfree(buf);
+ 	return err;
+ }
+ 
+@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
+  * it from the list and copy the rest of the buffer to the request.
+  * The request is finished by calling request_end()
+  */
+-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
+ 			       unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
+ 	fuse_copy_finish(&cs);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_write);
+ 
+-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
++unsigned fuse_dev_poll(struct file *file, poll_table *wait)
+ {
+ 	unsigned mask = POLLOUT | POLLWRNORM;
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
+ 
+ 	return mask;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_poll);
+ 
+ /*
+  * Abort all requests on the given list (pending or processing)
+@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
+ }
+ EXPORT_SYMBOL_GPL(fuse_dev_release);
+ 
+-static int fuse_dev_fasync(int fd, struct file *file, int on)
++int fuse_dev_fasync(int fd, struct file *file, int on)
+ {
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+ 	if (!fc)
+@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
+ 	/* No locking - fasync_helper does its own locking */
+ 	return fasync_helper(fd, file, on, &fc->fasync);
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_fasync);
+ 
+ const struct file_operations fuse_dev_operations = {
+ 	.owner		= THIS_MODULE,
+diff -urNp linux-2.6.32.12/fs/fuse/dir.c linux-2.6.32.12/fs/fuse/dir.c
+--- linux-2.6.32.12/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fuse/dir.c	2010-04-04 20:46:41.649500937 -0400
+@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
+ 	return link;
+ }
+ 
+-static void free_link(char *link)
++static void free_link(const char *link)
+ {
+ 	if (!IS_ERR(link))
+ 		free_page((unsigned long) link);
+diff -urNp linux-2.6.32.12/fs/fuse/fuse_i.h linux-2.6.32.12/fs/fuse/fuse_i.h
+--- linux-2.6.32.12/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/fuse/fuse_i.h	2010-04-04 20:46:41.649500937 -0400
+@@ -521,6 +521,16 @@ extern const struct file_operations fuse
+ 
+ extern const struct dentry_operations fuse_dentry_operations;
+ 
++extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++			      unsigned long nr_segs, loff_t pos);
++
++extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++			       unsigned long nr_segs, loff_t pos);
++
++extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
++
++extern int fuse_dev_fasync(int fd, struct file *file, int on);
++
+ /**
+  * Inode to nodeid comparison.
+  */
+diff -urNp linux-2.6.32.12/fs/gfs2/sys.c linux-2.6.32.12/fs/gfs2/sys.c
+--- linux-2.6.32.12/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/gfs2/sys.c	2010-04-04 20:46:41.649500937 -0400
+@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
+ 	return a->store ? a->store(sdp, buf, len) : len;
+ }
+ 
+-static struct sysfs_ops gfs2_attr_ops = {
++static const struct sysfs_ops gfs2_attr_ops = {
+ 	.show  = gfs2_attr_show,
+ 	.store = gfs2_attr_store,
+ };
+@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops gfs2_uevent_ops = {
++static const struct kset_uevent_ops gfs2_uevent_ops = {
+ 	.uevent = gfs2_uevent,
+ };
+ 
+diff -urNp linux-2.6.32.12/fs/hfs/inode.c linux-2.6.32.12/fs/hfs/inode.c
+--- linux-2.6.32.12/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/hfs/inode.c	2010-04-04 20:46:41.653544810 -0400
+@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
+ 
+ 	if (S_ISDIR(main_inode->i_mode)) {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_dir));
+ 		if (rec.type != HFS_CDR_DIR ||
+@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
+ 				sizeof(struct hfs_cat_file));
+ 	} else {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_file));
+ 		if (rec.type != HFS_CDR_FIL ||
+diff -urNp linux-2.6.32.12/fs/hfsplus/inode.c linux-2.6.32.12/fs/hfsplus/inode.c
+--- linux-2.6.32.12/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/hfsplus/inode.c	2010-04-04 20:46:41.653544810 -0400
+@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		hfsplus_get_perms(inode, &folder->permissions, 1);
+@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 
+@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		/* simple node checks? */
+@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 		hfsplus_inode_write_fork(inode, &file->data_fork);
+diff -urNp linux-2.6.32.12/fs/hugetlbfs/inode.c linux-2.6.32.12/fs/hugetlbfs/inode.c
+--- linux-2.6.32.12/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/hugetlbfs/inode.c	2010-04-06 22:13:08.677504702 -0400
+@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
+ 	.kill_sb	= kill_litter_super,
+ };
+ 
+-static struct vfsmount *hugetlbfs_vfsmount;
++struct vfsmount *hugetlbfs_vfsmount;
+ 
+ static int can_do_hugetlb_shm(void)
+ {
+diff -urNp linux-2.6.32.12/fs/ioctl.c linux-2.6.32.12/fs/ioctl.c
+--- linux-2.6.32.12/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ioctl.c	2010-04-04 20:46:41.653544810 -0400
+@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
+ 			    u64 phys, u64 len, u32 flags)
+ {
+ 	struct fiemap_extent extent;
+-	struct fiemap_extent *dest = fieinfo->fi_extents_start;
++	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+ 
+ 	/* only count the extents */
+ 	if (fieinfo->fi_extents_max == 0) {
+@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
+ 
+ 	fieinfo.fi_flags = fiemap.fm_flags;
+ 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
+-	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
++	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
+ 
+ 	if (fiemap.fm_extent_count != 0 &&
+ 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
+@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
+ 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
+ 	fiemap.fm_flags = fieinfo.fi_flags;
+ 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
+-	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
++	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
+ 		error = -EFAULT;
+ 
+ 	return error;
+diff -urNp linux-2.6.32.12/fs/jffs2/debug.h linux-2.6.32.12/fs/jffs2/debug.h
+--- linux-2.6.32.12/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/jffs2/debug.h	2010-04-04 20:46:41.653544810 -0400
+@@ -52,13 +52,13 @@
+ #if CONFIG_JFFS2_FS_DEBUG > 0
+ #define D1(x) x
+ #else
+-#define D1(x)
++#define D1(x) do {} while (0);
+ #endif
+ 
+ #if CONFIG_JFFS2_FS_DEBUG > 1
+ #define D2(x) x
+ #else
+-#define D2(x)
++#define D2(x) do {} while (0);
+ #endif
+ 
+ /* The prefixes of JFFS2 messages */
+@@ -114,73 +114,73 @@
+ #ifdef JFFS2_DBG_READINODE_MESSAGES
+ #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode(fmt, ...)
++#define dbg_readinode(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_READINODE2_MESSAGES
+ #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode2(fmt, ...)
++#define dbg_readinode2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Fragtree build debugging messages */
+ #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
+ #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree(fmt, ...)
++#define dbg_fragtree(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
+ #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree2(fmt, ...)
++#define dbg_fragtree2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Directory entry list manilulation debugging messages */
+ #ifdef JFFS2_DBG_DENTLIST_MESSAGES
+ #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_dentlist(fmt, ...)
++#define dbg_dentlist(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Print the messages about manipulating node_refs */
+ #ifdef JFFS2_DBG_NODEREF_MESSAGES
+ #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_noderef(fmt, ...)
++#define dbg_noderef(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Manipulations with the list of inodes (JFFS2 inocache) */
+ #ifdef JFFS2_DBG_INOCACHE_MESSAGES
+ #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_inocache(fmt, ...)
++#define dbg_inocache(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Summary debugging messages */
+ #ifdef JFFS2_DBG_SUMMARY_MESSAGES
+ #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_summary(fmt, ...)
++#define dbg_summary(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* File system build messages */
+ #ifdef JFFS2_DBG_FSBUILD_MESSAGES
+ #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fsbuild(fmt, ...)
++#define dbg_fsbuild(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the object allocations */
+ #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
+ #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_memalloc(fmt, ...)
++#define dbg_memalloc(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the XATTR subsystem */
+ #ifdef JFFS2_DBG_XATTR_MESSAGES
+ #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_xattr(fmt, ...)
++#define dbg_xattr(fmt, ...)	do {} while (0)
+ #endif 
+ 
+ /* "Sanity" checks */
+diff -urNp linux-2.6.32.12/fs/jffs2/erase.c linux-2.6.32.12/fs/jffs2/erase.c
+--- linux-2.6.32.12/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/jffs2/erase.c	2010-04-04 20:46:41.653544810 -0400
+@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
+ 		struct jffs2_unknown_node marker = {
+ 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-			.totlen =	cpu_to_je32(c->cleanmarker_size)
++			.totlen =	cpu_to_je32(c->cleanmarker_size),
++			.hdr_crc =	cpu_to_je32(0)
+ 		};
+ 
+ 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
+diff -urNp linux-2.6.32.12/fs/jffs2/summary.h linux-2.6.32.12/fs/jffs2/summary.h
+--- linux-2.6.32.12/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/jffs2/summary.h	2010-04-04 20:46:41.653544810 -0400
+@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
+ 
+ #define jffs2_sum_active() (0)
+ #define jffs2_sum_init(a) (0)
+-#define jffs2_sum_exit(a)
+-#define jffs2_sum_disable_collecting(a)
++#define jffs2_sum_exit(a) do {} while (0)
++#define jffs2_sum_disable_collecting(a) do {} while (0)
+ #define jffs2_sum_is_disabled(a) (0)
+-#define jffs2_sum_reset_collected(a)
++#define jffs2_sum_reset_collected(a) do {} while (0)
+ #define jffs2_sum_add_kvec(a,b,c,d) (0)
+-#define jffs2_sum_move_collected(a,b)
++#define jffs2_sum_move_collected(a,b) do {} while (0)
+ #define jffs2_sum_write_sumnode(a) (0)
+-#define jffs2_sum_add_padding_mem(a,b)
+-#define jffs2_sum_add_inode_mem(a,b,c)
+-#define jffs2_sum_add_dirent_mem(a,b,c)
+-#define jffs2_sum_add_xattr_mem(a,b,c)
+-#define jffs2_sum_add_xref_mem(a,b,c)
++#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
++#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
+ #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
+ 
+ #endif /* CONFIG_JFFS2_SUMMARY */
+diff -urNp linux-2.6.32.12/fs/jffs2/wbuf.c linux-2.6.32.12/fs/jffs2/wbuf.c
+--- linux-2.6.32.12/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/jffs2/wbuf.c	2010-04-04 20:46:41.653544810 -0400
+@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
+ {
+ 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-	.totlen = constant_cpu_to_je32(8)
++	.totlen = constant_cpu_to_je32(8),
++	.hdr_crc = constant_cpu_to_je32(0)
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.12/fs/lockd/svc.c linux-2.6.32.12/fs/lockd/svc.c
+--- linux-2.6.32.12/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/lockd/svc.c	2010-04-04 20:46:41.653544810 -0400
+@@ -43,7 +43,7 @@
+ 
+ static struct svc_program	nlmsvc_program;
+ 
+-struct nlmsvc_binding *		nlmsvc_ops;
++const struct nlmsvc_binding *	nlmsvc_ops;
+ EXPORT_SYMBOL_GPL(nlmsvc_ops);
+ 
+ static DEFINE_MUTEX(nlmsvc_mutex);
+diff -urNp linux-2.6.32.12/fs/locks.c linux-2.6.32.12/fs/locks.c
+--- linux-2.6.32.12/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/locks.c	2010-04-04 20:46:41.653544810 -0400
+@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
+ 		return;
+ 
+ 	if (filp->f_op && filp->f_op->flock) {
+-		struct file_lock fl = {
++		struct file_lock flock = {
+ 			.fl_pid = current->tgid,
+ 			.fl_file = filp,
+ 			.fl_flags = FL_FLOCK,
+ 			.fl_type = F_UNLCK,
+ 			.fl_end = OFFSET_MAX,
+ 		};
+-		filp->f_op->flock(filp, F_SETLKW, &fl);
+-		if (fl.fl_ops && fl.fl_ops->fl_release_private)
+-			fl.fl_ops->fl_release_private(&fl);
++		filp->f_op->flock(filp, F_SETLKW, &flock);
++		if (flock.fl_ops && flock.fl_ops->fl_release_private)
++			flock.fl_ops->fl_release_private(&flock);
+ 	}
+ 
+ 	lock_kernel();
+diff -urNp linux-2.6.32.12/fs/namei.c linux-2.6.32.12/fs/namei.c
+--- linux-2.6.32.12/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/namei.c	2010-04-04 20:46:41.653544810 -0400
+@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
+ 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+ 	error = PTR_ERR(cookie);
+ 	if (!IS_ERR(cookie)) {
+-		char *s = nd_get_link(nd);
++		const char *s = nd_get_link(nd);
+ 		error = 0;
+ 		if (s)
+ 			error = __vfs_follow_link(nd, s);
+@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
+ 	err = security_inode_follow_link(path->dentry, nd);
+ 	if (err)
+ 		goto loop;
++
++	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
++				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
++		err = -EACCES;
++		goto loop;
++	}
++
+ 	current->link_count++;
+ 	current->total_link_count++;
+ 	nd->depth++;
+@@ -1016,11 +1023,18 @@ return_reval:
+ 				break;
+ 		}
+ return_base:
++		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
++			path_put(&nd->path);
++			return -ENOENT;
++		}
+ 		return 0;
+ out_dput:
+ 		path_put_conditional(&next, nd);
+ 		break;
+ 	}
++	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
++		err = -ENOENT;
++
+ 	path_put(&nd->path);
+ return_err:
+ 	return err;
+@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
+ 	int error;
+ 	struct dentry *dir = nd->path.dentry;
+ 
++	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
++		error = -EACCES;
++		goto out_unlock;
++	}
++
+ 	if (!IS_POSIXACL(dir->d_inode))
+ 		mode &= ~current_umask();
+ 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
+ 	if (error)
+ 		goto out_unlock;
+ 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
++	if (!error)
++		gr_handle_create(path->dentry, nd->path.mnt);
+ out_unlock:
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	dput(nd->path.dentry);
+@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
+ 					 &nd, flag);
+ 		if (error)
+ 			return ERR_PTR(error);
++
++		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
++			error = -EACCES;
++			goto exit;
++		}
++
+ 		goto ok;
+ 	}
+ 
+@@ -1795,6 +1832,24 @@ do_last:
+ 	/*
+ 	 * It already exists.
+ 	 */
++
++	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_rawio(path.dentry->d_inode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	audit_inode(pathname, path.dentry);
+ 
+@@ -1887,6 +1942,13 @@ do_link:
+ 	error = security_inode_follow_link(path.dentry, &nd);
+ 	if (error)
+ 		goto exit_dput;
++
++	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
++				  path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto exit_dput;
++	}
++
+ 	error = __do_follow_link(&path, &nd);
+ 	if (error) {
+ 		/* Does someone understand code flow here? Or it is only
+@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	error = may_mknod(mode);
+ 	if (error)
+ 		goto out_dput;
++
++	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
++		error = -EPERM;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	}
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
+ 		mode &= ~current_umask();
+ 	error = mnt_want_write(nd.path.mnt);
+@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
++
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
+ 	char * name;
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
+ 	error = PTR_ERR(dentry);
+ 	if (IS_ERR(dentry))
+ 		goto exit2;
++
++	if (dentry->d_inode != NULL) {
++		if (dentry->d_inode->i_nlink <= 1) {
++			saved_ino = dentry->d_inode->i_ino;
++			saved_dev = dentry->d_inode->i_sb->s_dev;
++		}
++
++		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
++			error = -EACCES;
++			goto exit3;
++		}
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto exit3;
+@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
+ 	if (error)
+ 		goto exit4;
+ 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
++	if (!error && (saved_dev || saved_ino))
++		gr_handle_delete(saved_ino, saved_dev);
+ exit4:
+ 	mnt_drop_write(nd.path.mnt);
+ exit3:
+@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
+ 	struct inode *inode = NULL;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
+ 		if (nd.last.name[nd.last.len])
+ 			goto slashes;
+ 		inode = dentry->d_inode;
+-		if (inode)
++		if (inode) {
++			if (inode->i_nlink <= 1) {
++				saved_ino = inode->i_ino;
++				saved_dev = inode->i_sb->s_dev;
++			}
++
+ 			atomic_inc(&inode->i_count);
++
++			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
++				error = -EACCES;
++				goto exit2;
++			}
++		}
+ 		error = mnt_want_write(nd.path.mnt);
+ 		if (error)
+ 			goto exit2;
+@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
+ 		if (error)
+ 			goto exit3;
+ 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
++		if (!error && (saved_ino || saved_dev))
++			gr_handle_delete(saved_ino, saved_dev);
+ exit3:
+ 		mnt_drop_write(nd.path.mnt);
+ 	exit2:
+@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	error = PTR_ERR(new_dentry);
+ 	if (IS_ERR(new_dentry))
+ 		goto out_unlock;
++
++	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
++			       old_path.dentry->d_inode,
++			       old_path.dentry->d_inode->i_mode, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
++				old_path.dentry, old_path.mnt, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
++	if (!error)
++		gr_handle_create(new_dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 	if (new_dentry == trap)
+ 		goto exit5;
+ 
++	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
++				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
++				     to);
++	if (error)
++		goto exit5;
++
+ 	error = mnt_want_write(oldnd.path.mnt);
+ 	if (error)
+ 		goto exit5;
+@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 		goto exit6;
+ 	error = vfs_rename(old_dir->d_inode, old_dentry,
+ 				   new_dir->d_inode, new_dentry);
++	if (!error)
++		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
++				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
+ exit6:
+ 	mnt_drop_write(oldnd.path.mnt);
+ exit5:
+diff -urNp linux-2.6.32.12/fs/namespace.c linux-2.6.32.12/fs/namespace.c
+--- linux-2.6.32.12/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/namespace.c	2010-04-04 20:46:41.653544810 -0400
+@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
+ 		if (!(sb->s_flags & MS_RDONLY))
+ 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
+ 		up_write(&sb->s_umount);
++
++		gr_log_remount(mnt->mnt_devname, retval);
++
+ 		return retval;
+ 	}
+ 
+@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
+ 		security_sb_umount_busy(mnt);
+ 	up_write(&namespace_sem);
+ 	release_mounts(&umount_list);
++
++	gr_log_unmount(mnt->mnt_devname, retval);
++
+ 	return retval;
+ }
+ 
+@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
+ 	if (retval)
+ 		goto dput_out;
+ 
++	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
++	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
+ 	if (flags & MS_REMOUNT)
+ 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
+ 				    data_page);
+@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
+ 				      dev_name, data_page);
+ dput_out:
+ 	path_put(&path);
++
++	gr_log_mount(dev_name, dir_name, retval);
++
+ 	return retval;
+ }
+ 
+@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
+ 		goto out1;
+ 	}
+ 
++	if (gr_handle_chroot_pivot()) {
++		error = -EPERM;
++		path_put(&old);
++		goto out1;
++	}
++
+ 	read_lock(&current->fs->lock);
+ 	root = current->fs->root;
+ 	path_get(&current->fs->root);
+diff -urNp linux-2.6.32.12/fs/nfs/inode.c linux-2.6.32.12/fs/nfs/inode.c
+--- linux-2.6.32.12/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
++++ linux-2.6.32.12/fs/nfs/inode.c	2010-04-04 20:46:41.653544810 -0400
+@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
+ 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
+ }
+ 
+-static atomic_long_t nfs_attr_generation_counter;
++static atomic_long_unchecked_t nfs_attr_generation_counter;
+ 
+ static unsigned long nfs_read_attr_generation_counter(void)
+ {
+-	return atomic_long_read(&nfs_attr_generation_counter);
++	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ unsigned long nfs_inc_attr_generation_counter(void)
+ {
+-	return atomic_long_inc_return(&nfs_attr_generation_counter);
++	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ void nfs_fattr_init(struct nfs_fattr *fattr)
+diff -urNp linux-2.6.32.12/fs/nfs/nfs4proc.c linux-2.6.32.12/fs/nfs/nfs4proc.c
+--- linux-2.6.32.12/fs/nfs/nfs4proc.c	2010-04-29 17:49:38.445067399 -0400
++++ linux-2.6.32.12/fs/nfs/nfs4proc.c	2010-04-29 17:49:58.597031543 -0400
+@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
+ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_do_open_reclaim(ctx, state);
+@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
+ 
+ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+ 	int err;
+ 	do {
+@@ -1493,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs
+ static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -1593,7 +1593,7 @@ out_err:
+ 
+ static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs4_state *res;
+ 	int status;
+ 
+@@ -1684,7 +1684,7 @@ static int nfs4_do_setattr(struct inode 
+ 			   struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2050,7 +2050,7 @@ static int _nfs4_server_capabilities(str
+ 
+ int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2084,7 +2084,7 @@ static int _nfs4_lookup_root(struct nfs_
+ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_fsinfo *info)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2173,7 +2173,7 @@ static int _nfs4_proc_getattr(struct nfs
+ 
+ static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2261,7 +2261,7 @@ static int nfs4_proc_lookupfh(struct nfs
+ 			      struct qstr *name, struct nfs_fh *fhandle,
+ 			      struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
+@@ -2290,7 +2290,7 @@ static int _nfs4_proc_lookup(struct inod
+ 
+ static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2354,7 +2354,7 @@ static int _nfs4_proc_access(struct inod
+ 
+ static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2410,7 +2410,7 @@ static int _nfs4_proc_readlink(struct in
+ static int nfs4_proc_readlink(struct inode *inode, struct page *page,
+ 		unsigned int pgbase, unsigned int pglen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2508,7 +2508,7 @@ static int _nfs4_proc_remove(struct inod
+ 
+ static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2582,7 +2582,7 @@ static int _nfs4_proc_rename(struct inod
+ static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
+ 		struct inode *new_dir, struct qstr *new_name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
+@@ -2629,7 +2629,7 @@ static int _nfs4_proc_link(struct inode 
+ 
+ static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2721,7 +2721,7 @@ out:
+ static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
+ 		struct page *page, unsigned int len, struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2752,7 +2752,7 @@ out:
+ static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2801,7 +2801,7 @@ static int _nfs4_proc_readdir(struct den
+ static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+                   u64 cookie, struct page *page, unsigned int count, int plus)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
+@@ -2849,7 +2849,7 @@ out:
+ static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr, dev_t rdev)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2881,7 +2881,7 @@ static int _nfs4_proc_statfs(struct nfs_
+ 
+ static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2912,7 +2912,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
+ 
+ static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -2958,7 +2958,7 @@ static int _nfs4_proc_pathconf(struct nf
+ static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_pathconf *pathconf)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -3257,7 +3257,7 @@ out_free:
+ 
+ static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	ssize_t ret;
+ 	do {
+ 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
+@@ -3313,7 +3313,7 @@ static int __nfs4_proc_set_acl(struct in
+ 
+ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -3578,7 +3578,7 @@ out:
+ int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
+@@ -3651,7 +3651,7 @@ out:
+ 
+ static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4044,7 +4044,7 @@ static int _nfs4_do_setlk(struct nfs4_st
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4062,7 +4062,7 @@ static int nfs4_lock_reclaim(struct nfs4
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, request);
+@@ -4120,7 +4120,7 @@ out:
+ 
+ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4180,7 +4180,7 @@ nfs4_proc_lock(struct file *filp, int cm
+ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, fl);
+diff -urNp linux-2.6.32.12/fs/nfsd/lockd.c linux-2.6.32.12/fs/nfsd/lockd.c
+--- linux-2.6.32.12/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/nfsd/lockd.c	2010-04-04 20:46:41.653544810 -0400
+@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
+ 	fput(filp);
+ }
+ 
+-static struct nlmsvc_binding	nfsd_nlm_ops = {
++static const struct nlmsvc_binding	nfsd_nlm_ops = {
+ 	.fopen		= nlm_fopen,		/* open file for locking */
+ 	.fclose		= nlm_fclose,		/* close file */
+ };
+diff -urNp linux-2.6.32.12/fs/nfsd/vfs.c linux-2.6.32.12/fs/nfsd/vfs.c
+--- linux-2.6.32.12/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/nfsd/vfs.c	2010-04-04 20:46:41.657782339 -0400
+@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
+ 	} else {
+ 		oldfs = get_fs();
+ 		set_fs(KERNEL_DS);
+-		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
++		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 		set_fs(oldfs);
+ 	}
+ 
+@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ 
+ 	/* Write the data. */
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
++	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 	set_fs(oldfs);
+ 	if (host_err < 0)
+ 		goto out_nfserr;
+@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
+ 	 */
+ 
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = inode->i_op->readlink(dentry, buf, *lenp);
++	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
+ 	set_fs(oldfs);
+ 
+ 	if (host_err < 0)
+diff -urNp linux-2.6.32.12/fs/nls/nls_base.c linux-2.6.32.12/fs/nls/nls_base.c
+--- linux-2.6.32.12/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/nls/nls_base.c	2010-04-04 20:46:41.657782339 -0400
+@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
+     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
+     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
+     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
+-    {0,						       /* end of table    */}
++    {0, 0, 0, 0, 0,				       /* end of table    */}
+ };
+ 
+ #define UNICODE_MAX	0x0010ffff
+diff -urNp linux-2.6.32.12/fs/ntfs/file.c linux-2.6.32.12/fs/ntfs/file.c
+--- linux-2.6.32.12/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ntfs/file.c	2010-04-04 20:46:41.657782339 -0400
+@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
+ #endif /* NTFS_RW */
+ };
+ 
+-const struct file_operations ntfs_empty_file_ops = {};
++const struct file_operations ntfs_empty_file_ops __read_only;
+ 
+-const struct inode_operations ntfs_empty_inode_ops = {};
++const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff -urNp linux-2.6.32.12/fs/ocfs2/cluster/masklog.c linux-2.6.32.12/fs/ocfs2/cluster/masklog.c
+--- linux-2.6.32.12/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ocfs2/cluster/masklog.c	2010-04-04 20:46:41.657782339 -0400
+@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
+ 	return mlog_mask_store(mlog_attr->mask, buf, count);
+ }
+ 
+-static struct sysfs_ops mlog_attr_ops = {
++static const struct sysfs_ops mlog_attr_ops = {
+ 	.show  = mlog_show,
+ 	.store = mlog_store,
+ };
+diff -urNp linux-2.6.32.12/fs/ocfs2/localalloc.c linux-2.6.32.12/fs/ocfs2/localalloc.c
+--- linux-2.6.32.12/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ocfs2/localalloc.c	2010-04-04 20:46:41.657782339 -0400
+@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
+ 		goto bail;
+ 	}
+ 
+-	atomic_inc(&osb->alloc_stats.moves);
++	atomic_inc_unchecked(&osb->alloc_stats.moves);
+ 
+ 	status = 0;
+ bail:
+diff -urNp linux-2.6.32.12/fs/ocfs2/ocfs2.h linux-2.6.32.12/fs/ocfs2/ocfs2.h
+--- linux-2.6.32.12/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ocfs2/ocfs2.h	2010-04-04 20:46:41.657782339 -0400
+@@ -217,11 +217,11 @@ enum ocfs2_vol_state
+ 
+ struct ocfs2_alloc_stats
+ {
+-	atomic_t moves;
+-	atomic_t local_data;
+-	atomic_t bitmap_data;
+-	atomic_t bg_allocs;
+-	atomic_t bg_extends;
++	atomic_unchecked_t moves;
++	atomic_unchecked_t local_data;
++	atomic_unchecked_t bitmap_data;
++	atomic_unchecked_t bg_allocs;
++	atomic_unchecked_t bg_extends;
+ };
+ 
+ enum ocfs2_local_alloc_state
+diff -urNp linux-2.6.32.12/fs/ocfs2/suballoc.c linux-2.6.32.12/fs/ocfs2/suballoc.c
+--- linux-2.6.32.12/fs/ocfs2/suballoc.c	2010-04-29 17:49:38.449086403 -0400
++++ linux-2.6.32.12/fs/ocfs2/suballoc.c	2010-04-29 17:49:58.609026943 -0400
+@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
+ 				mlog_errno(status);
+ 			goto bail;
+ 		}
+-		atomic_inc(&osb->alloc_stats.bg_extends);
++		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
+ 
+ 		/* You should never ask for this much metadata */
+ 		BUG_ON(bits_wanted >
+@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
+ 	ac->ac_bits_given += (*num_bits);
+@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	BUG_ON(num_bits != 1);
+ 
+@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 						      cluster_start,
+ 						      num_clusters);
+ 		if (!status)
+-			atomic_inc(&osb->alloc_stats.local_data);
++			atomic_inc_unchecked(&osb->alloc_stats.local_data);
+ 	} else {
+ 		if (min_clusters > (osb->bitmap_cpg - 1)) {
+ 			/* The only paths asking for contiguousness
+@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
+ 								 bg_blkno,
+ 								 bg_bit_off);
+-			atomic_inc(&osb->alloc_stats.bitmap_data);
++			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
+ 		}
+ 	}
+ 	if (status < 0) {
+diff -urNp linux-2.6.32.12/fs/ocfs2/super.c linux-2.6.32.12/fs/ocfs2/super.c
+--- linux-2.6.32.12/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/ocfs2/super.c	2010-04-04 20:46:41.657782339 -0400
+@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
+ 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
+ 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
+ 			"Stats",
+-			atomic_read(&osb->alloc_stats.bitmap_data),
+-			atomic_read(&osb->alloc_stats.local_data),
+-			atomic_read(&osb->alloc_stats.bg_allocs),
+-			atomic_read(&osb->alloc_stats.moves),
+-			atomic_read(&osb->alloc_stats.bg_extends));
++			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
++			atomic_read_unchecked(&osb->alloc_stats.local_data),
++			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
++			atomic_read_unchecked(&osb->alloc_stats.moves),
++			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
+ 
+ 	out += snprintf(buf + out, len - out,
+ 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
+@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
+ 	spin_lock_init(&osb->osb_xattr_lock);
+ 	ocfs2_init_inode_steal_slot(osb);
+ 
+-	atomic_set(&osb->alloc_stats.moves, 0);
+-	atomic_set(&osb->alloc_stats.local_data, 0);
+-	atomic_set(&osb->alloc_stats.bitmap_data, 0);
+-	atomic_set(&osb->alloc_stats.bg_allocs, 0);
+-	atomic_set(&osb->alloc_stats.bg_extends, 0);
++	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
++	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
+ 
+ 	/* Copy the blockcheck stats from the superblock probe */
+ 	osb->osb_ecc_stats = *stats;
+diff -urNp linux-2.6.32.12/fs/open.c linux-2.6.32.12/fs/open.c
+--- linux-2.6.32.12/fs/open.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/open.c	2010-04-04 20:46:41.657782339 -0400
+@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
+ 	if (length < 0)
+ 		return -EINVAL;
+ 
++	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
++		return -EACCES;
++
+ 	newattrs.ia_size = length;
+ 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
+ 	if (filp) {
+@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
+ 	if (__mnt_is_readonly(path.mnt))
+ 		res = -EROFS;
+ 
++	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
++		res = -EACCES;
++
+ out_path_release:
+ 	path_put(&path);
+ out:
+@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
+ 	if (error)
+ 		goto dput_and_out;
+ 
++	gr_log_chdir(path.dentry, path.mnt);
++
+ 	set_fs_pwd(current->fs, &path);
+ 
+ dput_and_out:
+@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
+ 		goto out_putf;
+ 
+ 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
++
++	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
++		error = -EPERM;
++
++	if (!error)
++		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
++
+ 	if (!error)
+ 		set_fs_pwd(current->fs, &file->f_path);
+ out_putf:
+@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
+ 	if (!capable(CAP_SYS_CHROOT))
+ 		goto dput_and_out;
+ 
++	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
++		goto dput_and_out;
++
++	if (gr_handle_chroot_caps(&path)) {
++		error = -ENOMEM;
++		goto dput_and_out;
++	}
++
+ 	set_fs_root(current->fs, &path);
++
++	gr_handle_chroot_chdir(&path);
++
+ 	error = 0;
+ dput_and_out:
+ 	path_put(&path);
+@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
+ 	err = mnt_want_write_file(file);
+ 	if (err)
+ 		goto out_putf;
++
++	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
++		err = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
++		err = -EPERM;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	err = notify_change(dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(file->f_path.mnt);
+ out_putf:
+ 	fput(file);
+@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto dput_and_out;
++
++	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	error = notify_change(path.dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(path.mnt);
+ dput_and_out:
+ 	path_put(&path);
+@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
+ 	return sys_fchmodat(AT_FDCWD, filename, mode);
+ }
+ 
+-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
++static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int error;
+ 	struct iattr newattrs;
+ 
++	if (!gr_acl_handle_chown(dentry, mnt))
++		return -EACCES;
++
+ 	newattrs.ia_valid =  ATTR_CTIME;
+ 	if (user != (uid_t) -1) {
+ 		newattrs.ia_valid |= ATTR_UID;
+@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
+ 		goto out_fput;
+ 	dentry = file->f_path.dentry;
+ 	audit_inode(NULL, dentry);
+-	error = chown_common(dentry, user, group);
++	error = chown_common(dentry, user, group, file->f_path.mnt);
+ 	mnt_drop_write(file->f_path.mnt);
+ out_fput:
+ 	fput(file);
+diff -urNp linux-2.6.32.12/fs/pipe.c linux-2.6.32.12/fs/pipe.c
+--- linux-2.6.32.12/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/pipe.c	2010-04-04 20:46:41.657782339 -0400
+@@ -401,9 +401,9 @@ redo:
+ 		}
+ 		if (bufs)	/* More to do? */
+ 			continue;
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			/* syscall merging: Usually we must not sleep
+ 			 * if O_NONBLOCK is set, or if we got some data.
+ 			 * But if a writer sleeps in kernel space, then
+@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+ 
+-	if (!pipe->readers) {
++	if (!atomic_read(&pipe->readers)) {
+ 		send_sig(SIGPIPE, current, 0);
+ 		ret = -EPIPE;
+ 		goto out;
+@@ -511,7 +511,7 @@ redo1:
+ 	for (;;) {
+ 		int bufs;
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -597,9 +597,9 @@ redo2:
+ 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 			do_wakeup = 0;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ out:
+ 	mutex_unlock(&inode->i_mutex);
+@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
+ 	mask = 0;
+ 	if (filp->f_mode & FMODE_READ) {
+ 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
+-		if (!pipe->writers && filp->f_version != pipe->w_counter)
++		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
+ 			mask |= POLLHUP;
+ 	}
+ 
+@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
+ 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
+ 		 * behave exactly like pipes for poll().
+ 		 */
+-		if (!pipe->readers)
++		if (!atomic_read(&pipe->readers))
+ 			mask |= POLLERR;
+ 	}
+ 
+@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
+ 
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+-	pipe->readers -= decr;
+-	pipe->writers -= decw;
++	atomic_sub(decr, &pipe->readers);
++	atomic_sub(decw, &pipe->writers);
+ 
+-	if (!pipe->readers && !pipe->writers) {
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
+ 		free_pipe_info(inode);
+ 	} else {
+ 		wake_up_interruptible_sync(&pipe->wait);
+@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->readers++;
++		atomic_inc(&inode->i_pipe->readers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->writers++;
++		atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+ 		if (filp->f_mode & FMODE_READ)
+-			inode->i_pipe->readers++;
++			atomic_inc(&inode->i_pipe->readers);
+ 		if (filp->f_mode & FMODE_WRITE)
+-			inode->i_pipe->writers++;
++			atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
+ 	inode->i_pipe = NULL;
+ }
+ 
+-static struct vfsmount *pipe_mnt __read_mostly;
++struct vfsmount *pipe_mnt __read_mostly;
+ static int pipefs_delete_dentry(struct dentry *dentry)
+ {
+ 	/*
+@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
+ 		goto fail_iput;
+ 	inode->i_pipe = pipe;
+ 
+-	pipe->readers = pipe->writers = 1;
++	atomic_set(&pipe->readers, 1);
++	atomic_set(&pipe->writers, 1);
+ 	inode->i_fop = &rdwr_pipefifo_fops;
+ 
+ 	/*
+diff -urNp linux-2.6.32.12/fs/proc/array.c linux-2.6.32.12/fs/proc/array.c
+--- linux-2.6.32.12/fs/proc/array.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/array.c	2010-04-04 20:46:41.657782339 -0400
+@@ -410,6 +410,21 @@ static void task_show_stack_usage(struct
+ }
+ #endif		/* CONFIG_MMU */
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline void task_pax(struct seq_file *m, struct task_struct *p)
++{
++	if (p->mm)
++		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
++			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
++			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
++			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
++			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
++			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
++	else
++		seq_printf(m, "PaX:\t-----\n");
++}
++#endif
++
+ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task)
+ {
+@@ -430,9 +445,20 @@ int proc_pid_status(struct seq_file *m, 
+ #endif
+ 	task_context_switch_counts(m, task);
+ 	task_show_stack_usage(m, task);
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	task_pax(m, task);
++#endif
++
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task, int whole)
+ {
+@@ -529,6 +555,19 @@ static int do_task_stat(struct seq_file 
+ 		gtime = task_gtime(task);
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (PAX_RAND_FLAGS(mm)) {
++		eip = 0;
++		esp = 0;
++		wchan = 0;
++	}
++#endif
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	wchan = 0;
++	eip =0;
++	esp =0;
++#endif
++
+ 	/* scale priority and nice values from timeslices to -20..20 */
+ 	/* to make it look like a "normal" Unix priority/nice value  */
+ 	priority = task_prio(task);
+@@ -569,9 +608,15 @@ static int do_task_stat(struct seq_file 
+ 		vsize,
+ 		mm ? get_mm_rss(mm) : 0,
+ 		rsslim,
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
++		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
++#else
+ 		mm ? mm->start_code : 0,
+ 		mm ? mm->end_code : 0,
+ 		(permitted && mm) ? task->stack_start : 0,
++#endif
+ 		esp,
+ 		eip,
+ 		/* The signal information here is obsolete.
+@@ -624,3 +669,10 @@ int proc_pid_statm(struct seq_file *m, s
+ 
+ 	return 0;
+ }
++
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++int proc_pid_ipaddr(struct task_struct *task, char *buffer)
++{
++	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
++}
++#endif
+diff -urNp linux-2.6.32.12/fs/proc/base.c linux-2.6.32.12/fs/proc/base.c
+--- linux-2.6.32.12/fs/proc/base.c	2010-04-29 17:49:38.453075413 -0400
++++ linux-2.6.32.12/fs/proc/base.c	2010-04-29 17:49:58.609026943 -0400
+@@ -102,6 +102,22 @@ struct pid_entry {
+ 	union proc_op op;
+ };
+ 
++struct getdents_callback {
++	struct linux_dirent __user * current_dir;
++	struct linux_dirent __user * previous;
++	struct file * file;
++	int count;
++	int error;
++};
++
++static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
++			   loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct getdents_callback * buf = (struct getdents_callback *) __buf;
++	buf->error = -EINVAL;
++	return 0;
++}
++
+ #define NOD(NAME, MODE, IOP, FOP, OP) {			\
+ 	.name = (NAME),					\
+ 	.len  = sizeof(NAME) - 1,			\
+@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
+ 	if (task == current)
+ 		return 0;
+ 
++	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
++		return -EPERM;
++
+ 	/*
+ 	 * If current is actively ptrace'ing, and would also be
+ 	 * permitted to freshly attach with ptrace now, permit it.
+@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
+ 	if (!mm->arg_end)
+ 		goto out_mm;	/* Shh! No looking before we're done */
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out_mm;
++
+  	len = mm->arg_end - mm->arg_start;
+  
+ 	if (len > PAGE_SIZE)
+@@ -287,12 +309,26 @@ out:
+ 	return res;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+ {
+ 	int res = 0;
+ 	struct mm_struct *mm = get_task_mm(task);
+ 	if (mm) {
+ 		unsigned int nwords = 0;
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (PAX_RAND_FLAGS(mm)) {
++			mmput(mm);
++			return res;
++		}
++#endif
++
+ 		do {
+ 			nwords += 2;
+ 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
+ }
+ #endif /* CONFIG_KALLSYMS */
+ 
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 
+ #define MAX_STACK_TRACE_DEPTH	64
+ 
+@@ -522,7 +558,7 @@ static int proc_pid_limits(struct task_s
+ 	return count;
+ }
+ 
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+ {
+ 	long nr;
+@@ -936,6 +972,9 @@ static ssize_t environ_read(struct file 
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out;
++
+ 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ 		goto out;
+ 
+@@ -1456,7 +1495,11 @@ static struct inode *proc_pid_make_inode
+ 		rcu_read_lock();
+ 		cred = __task_cred(task);
+ 		inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 		inode->i_gid = cred->egid;
++#endif
+ 		rcu_read_unlock();
+ 	}
+ 	security_task_to_inode(task, inode);
+@@ -1474,6 +1517,9 @@ static int pid_getattr(struct vfsmount *
+ 	struct inode *inode = dentry->d_inode;
+ 	struct task_struct *task;
+ 	const struct cred *cred;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++#endif
+ 
+ 	generic_fillattr(inode, stat);
+ 
+@@ -1481,12 +1527,34 @@ static int pid_getattr(struct vfsmount *
+ 	stat->uid = 0;
+ 	stat->gid = 0;
+ 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
++
++	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
+ 	if (task) {
++		cred = __task_cred(task);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++		)
++#endif
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+-			cred = __task_cred(task);
+ 			stat->uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			stat->gid = cred->egid;
++#endif
+ 		}
+ 	}
+ 	rcu_read_unlock();
+@@ -1518,11 +1586,20 @@ static int pid_revalidate(struct dentry 
+ 
+ 	if (task) {
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+ 			rcu_read_lock();
+ 			cred = __task_cred(task);
+ 			inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = cred->egid;
++#endif
+ 			rcu_read_unlock();
+ 		} else {
+ 			inode->i_uid = 0;
+@@ -1643,7 +1720,8 @@ static int proc_fd_info(struct inode *in
+ 	int fd = proc_fd(inode);
+ 
+ 	if (task) {
+-		files = get_files_struct(task);
++		if (!gr_acl_handle_procpidmem(task))
++			files = get_files_struct(task);
+ 		put_task_struct(task);
+ 	}
+ 	if (files) {
+@@ -1895,12 +1973,22 @@ static const struct file_operations proc
+ static int proc_fd_permission(struct inode *inode, int mask)
+ {
+ 	int rv;
++	struct task_struct *task;
+ 
+ 	rv = generic_permission(inode, mask, NULL);
+-	if (rv == 0)
+-		return 0;
++
+ 	if (task_pid(current) == proc_pid(inode))
+ 		rv = 0;
++
++	task = get_proc_task(inode);
++	if (task == NULL)
++		return rv;
++
++	if (gr_acl_handle_procpidmem(task))
++		rv = -EACCES;
++
++	put_task_struct(task);
++
+ 	return rv;
+ }
+ 
+@@ -2009,6 +2097,9 @@ static struct dentry *proc_pident_lookup
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	/*
+ 	 * Yes, it does not scale. And it should not. Don't add
+ 	 * new entries into /proc/<tgid>/ without very good reasons.
+@@ -2053,6 +2144,9 @@ static int proc_pident_readdir(struct fi
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	ret = 0;
+ 	i = filp->f_pos;
+ 	switch (i) {
+@@ -2320,7 +2414,7 @@ static void *proc_self_follow_link(struc
+ static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+ 				void *cookie)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+@@ -2433,6 +2527,9 @@ static struct dentry *proc_base_lookup(s
+ 	if (p > last)
+ 		goto out;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	error = proc_base_instantiate(dir, dentry, task, p);
+ 
+ out:
+@@ -2519,7 +2616,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",    S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
+@@ -2547,7 +2644,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",      S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+@@ -2577,6 +2674,9 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+ 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
++#endif
+ };
+ 
+ static int proc_tgid_base_readdir(struct file * filp,
+@@ -2701,7 +2801,14 @@ static struct dentry *proc_pid_instantia
+ 	if (!inode)
+ 		goto out;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
++#else
+ 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
++#endif
+ 	inode->i_op = &proc_tgid_base_inode_operations;
+ 	inode->i_fop = &proc_tgid_base_operations;
+ 	inode->i_flags|=S_IMMUTABLE;
+@@ -2743,7 +2850,11 @@ struct dentry *proc_pid_lookup(struct in
+ 	if (!task)
+ 		goto out;
+ 
++	if (gr_check_hidden_task(task))
++		goto out_put_task;
++
+ 	result = proc_pid_instantiate(dir, dentry, task, NULL);
++out_put_task:
+ 	put_task_struct(task);
+ out:
+ 	return result;
+@@ -2808,6 +2919,11 @@ int proc_pid_readdir(struct file * filp,
+ {
+ 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+ 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++	const struct cred *itercred;
++#endif
++	filldir_t __filldir = filldir;
+ 	struct tgid_iter iter;
+ 	struct pid_namespace *ns;
+ 
+@@ -2826,8 +2942,27 @@ int proc_pid_readdir(struct file * filp,
+ 	for (iter = next_tgid(ns, iter);
+ 	     iter.task;
+ 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		rcu_read_lock();
++		itercred = __task_cred(iter.task);
++#endif
++		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++			)
++#endif
++		)
++			__filldir = &gr_fake_filldir;
++		else
++			__filldir = filldir;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	rcu_read_unlock();
++#endif
+ 		filp->f_pos = iter.tgid + TGID_OFFSET;
+-		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
++		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
+ 			put_task_struct(iter.task);
+ 			goto out;
+ 		}
+@@ -2853,7 +2988,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",   S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
+@@ -2880,7 +3015,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",     S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+diff -urNp linux-2.6.32.12/fs/proc/cmdline.c linux-2.6.32.12/fs/proc/cmdline.c
+--- linux-2.6.32.12/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/cmdline.c	2010-04-04 20:46:41.661529739 -0400
+@@ -23,7 +23,11 @@ static const struct file_operations cmdl
+ 
+ static int __init proc_cmdline_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
++#else
+ 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
++#endif
+ 	return 0;
+ }
+ module_init(proc_cmdline_init);
+diff -urNp linux-2.6.32.12/fs/proc/devices.c linux-2.6.32.12/fs/proc/devices.c
+--- linux-2.6.32.12/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/devices.c	2010-04-04 20:46:41.661529739 -0400
+@@ -64,7 +64,11 @@ static const struct file_operations proc
+ 
+ static int __init proc_devices_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
++#else
+ 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_devices_init);
+diff -urNp linux-2.6.32.12/fs/proc/inode.c linux-2.6.32.12/fs/proc/inode.c
+--- linux-2.6.32.12/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/inode.c	2010-04-04 20:46:41.661529739 -0400
+@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
+ 		if (de->mode) {
+ 			inode->i_mode = de->mode;
+ 			inode->i_uid = de->uid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = de->gid;
++#endif
+ 		}
+ 		if (de->size)
+ 			inode->i_size = de->size;
+diff -urNp linux-2.6.32.12/fs/proc/internal.h linux-2.6.32.12/fs/proc/internal.h
+--- linux-2.6.32.12/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/internal.h	2010-04-04 20:46:41.661529739 -0400
+@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
+ 				struct pid *pid, struct task_struct *task);
+ extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+ 				struct pid *pid, struct task_struct *task);
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
++#endif
+ extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
+ 
+ extern const struct file_operations proc_maps_operations;
+diff -urNp linux-2.6.32.12/fs/proc/Kconfig linux-2.6.32.12/fs/proc/Kconfig
+--- linux-2.6.32.12/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/Kconfig	2010-04-04 20:46:41.661529739 -0400
+@@ -30,12 +30,12 @@ config PROC_FS
+ 
+ config PROC_KCORE
+ 	bool "/proc/kcore support" if !ARM
+-	depends on PROC_FS && MMU
++	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
+ 
+ config PROC_VMCORE
+         bool "/proc/vmcore support (EXPERIMENTAL)"
+-        depends on PROC_FS && CRASH_DUMP
+-	default y
++        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
++	default n
+         help
+         Exports the dump image of crashed kernel in ELF format.
+ 
+@@ -59,8 +59,8 @@ config PROC_SYSCTL
+ 	  limited in memory.
+ 
+ config PROC_PAGE_MONITOR
+- 	default y
+-	depends on PROC_FS && MMU
++ 	default n
++	depends on PROC_FS && MMU && !GRKERNSEC
+ 	bool "Enable /proc page monitoring" if EMBEDDED
+  	help
+ 	  Various /proc files exist to monitor process memory utilization:
+diff -urNp linux-2.6.32.12/fs/proc/kcore.c linux-2.6.32.12/fs/proc/kcore.c
+--- linux-2.6.32.12/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/kcore.c	2010-04-04 20:46:41.661529739 -0400
+@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
+ 
+ static int open_kcore(struct inode *inode, struct file *filp)
+ {
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	return -EPERM;
++#endif
+ 	if (!capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 	if (kcore_need_update)
+diff -urNp linux-2.6.32.12/fs/proc/meminfo.c linux-2.6.32.12/fs/proc/meminfo.c
+--- linux-2.6.32.12/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/meminfo.c	2010-04-04 20:46:41.661529739 -0400
+@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
+ 		vmi.used >> 10,
+ 		vmi.largest_chunk >> 10
+ #ifdef CONFIG_MEMORY_FAILURE
+-		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
++		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
+ #endif
+ 		);
+ 
+diff -urNp linux-2.6.32.12/fs/proc/nommu.c linux-2.6.32.12/fs/proc/nommu.c
+--- linux-2.6.32.12/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/nommu.c	2010-04-04 20:46:41.661529739 -0400
+@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.12/fs/proc/proc_net.c linux-2.6.32.12/fs/proc/proc_net.c
+--- linux-2.6.32.12/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/proc_net.c	2010-04-04 20:46:41.661529739 -0400
+@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
+ 	struct task_struct *task;
+ 	struct nsproxy *ns;
+ 	struct net *net = NULL;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred = current_cred();
++#endif
++
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	if (cred->fsuid)
++		return net;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
++		return net;
++#endif
+ 
+ 	rcu_read_lock();
+ 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
+diff -urNp linux-2.6.32.12/fs/proc/proc_sysctl.c linux-2.6.32.12/fs/proc/proc_sysctl.c
+--- linux-2.6.32.12/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/proc_sysctl.c	2010-04-04 20:46:41.661529739 -0400
+@@ -7,6 +7,8 @@
+ #include <linux/security.h>
+ #include "internal.h"
+ 
++extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
++
+ static const struct dentry_operations proc_sys_dentry_operations;
+ static const struct file_operations proc_sys_file_operations;
+ static const struct inode_operations proc_sys_inode_operations;
+@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
+ 	if (!p)
+ 		goto out;
+ 
++	if (gr_handle_sysctl(p, MAY_EXEC))
++		goto out;
++
+ 	err = ERR_PTR(-ENOMEM);
+ 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+ 	if (h)
+@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
+ 		if (*pos < file->f_pos)
+ 			continue;
+ 
++		if (gr_handle_sysctl(table, 0))
++			continue;
++
+ 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
+ 		if (res)
+ 			return res;
+@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
+ 	if (IS_ERR(head))
+ 		return PTR_ERR(head);
+ 
++	if (table && gr_handle_sysctl(table, MAY_EXEC))
++		return -ENOENT;
++
+ 	generic_fillattr(inode, stat);
+ 	if (table)
+ 		stat->mode = (stat->mode & S_IFMT) | table->mode;
+diff -urNp linux-2.6.32.12/fs/proc/root.c linux-2.6.32.12/fs/proc/root.c
+--- linux-2.6.32.12/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/root.c	2010-04-04 20:46:41.661529739 -0400
+@@ -134,7 +134,15 @@ void __init proc_root_init(void)
+ #ifdef CONFIG_PROC_DEVICETREE
+ 	proc_device_tree_init();
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_mkdir("bus", NULL);
++#endif
+ 	proc_sys_init();
+ }
+ 
+diff -urNp linux-2.6.32.12/fs/proc/task_mmu.c linux-2.6.32.12/fs/proc/task_mmu.c
+--- linux-2.6.32.12/fs/proc/task_mmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/task_mmu.c	2010-04-04 20:46:41.661529739 -0400
+@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
+ 		"VmStk:\t%8lu kB\n"
+ 		"VmExe:\t%8lu kB\n"
+ 		"VmLib:\t%8lu kB\n"
+-		"VmPTE:\t%8lu kB\n",
+-		hiwater_vm << (PAGE_SHIFT-10),
++		"VmPTE:\t%8lu kB\n"
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
++#endif
++
++		,hiwater_vm << (PAGE_SHIFT-10),
+ 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
+ 		mm->locked_vm << (PAGE_SHIFT-10),
+ 		hiwater_rss << (PAGE_SHIFT-10),
+ 		total_rss << (PAGE_SHIFT-10),
+ 		data << (PAGE_SHIFT-10),
+ 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
+-		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
++		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		, mm->context.user_cs_base, mm->context.user_cs_limit
++#endif
++
++	);
+ }
+ 
+ unsigned long task_vsize(struct mm_struct *mm)
+@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ {
+ 	struct mm_struct *mm = vma->vm_mm;
+@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
+ 	}
+ 
+ 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
++#else
+ 			vma->vm_start,
+ 			vma->vm_end,
++#endif
+ 			flags & VM_READ ? 'r' : '-',
+ 			flags & VM_WRITE ? 'w' : '-',
+ 			flags & VM_EXEC ? 'x' : '-',
+ 			flags & VM_MAYSHARE ? 's' : 'p',
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
++#else
+ 			pgoff,
++#endif
+ 			MAJOR(dev), MINOR(dev), ino, &len);
+ 
+ 	/*
+@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
+ 	 */
+ 	if (file) {
+ 		pad_len_spaces(m, len);
+-		seq_path(m, &file->f_path, "\n");
++		seq_path(m, &file->f_path, "\n\\");
+ 	} else {
+ 		const char *name = arch_vma_name(vma);
+ 		if (!name) {
+ 			if (mm) {
+-				if (vma->vm_start <= mm->start_brk &&
+-						vma->vm_end >= mm->brk) {
++				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 					name = "[heap]";
+-				} else if (vma->vm_start <= mm->start_stack &&
+-					   vma->vm_end >= mm->start_stack) {
++				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
++					   (vma->vm_start <= mm->start_stack &&
++					    vma->vm_end >= mm->start_stack)) {
+ 					name = "[stack]";
+ 				} else {
+ 					unsigned long stack_start;
+@@ -403,9 +429,16 @@ static int show_smap(struct seq_file *m,
+ 	};
+ 
+ 	memset(&mss, 0, sizeof mss);
+-	mss.vma = vma;
+-	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
+-		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
++#endif
++		mss.vma = vma;
++		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
++			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	}
++#endif
+ 
+ 	show_map_vma(m, vma);
+ 
+@@ -421,7 +454,11 @@ static int show_smap(struct seq_file *m,
+ 		   "Swap:           %8lu kB\n"
+ 		   "KernelPageSize: %8lu kB\n"
+ 		   "MMUPageSize:    %8lu kB\n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
++#else
+ 		   (vma->vm_end - vma->vm_start) >> 10,
++#endif
+ 		   mss.resident >> 10,
+ 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
+ 		   mss.shared_clean  >> 10,
+diff -urNp linux-2.6.32.12/fs/proc/task_nommu.c linux-2.6.32.12/fs/proc/task_nommu.c
+--- linux-2.6.32.12/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/proc/task_nommu.c	2010-04-04 20:46:41.661529739 -0400
+@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
+ 	else
+ 		bytes += kobjsize(mm);
+ 	
+-	if (current->fs && current->fs->users > 1)
++	if (current->fs && atomic_read(&current->fs->users) > 1)
+ 		sbytes += kobjsize(current->fs);
+ 	else
+ 		bytes += kobjsize(current->fs);
+@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.12/fs/readdir.c linux-2.6.32.12/fs/readdir.c
+--- linux-2.6.32.12/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/readdir.c	2010-04-04 20:46:41.661529739 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/security.h>
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
++#include <linux/namei.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -67,6 +68,7 @@ struct old_linux_dirent {
+ 
+ struct readdir_callback {
+ 	struct old_linux_dirent __user * dirent;
++	struct file * file;
+ 	int result;
+ };
+ 
+@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
+ 		buf->result = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	buf->result++;
+ 	dirent = buf->dirent;
+ 	if (!access_ok(VERIFY_WRITE, dirent,
+@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
+ 
+ 	buf.result = 0;
+ 	buf.dirent = dirent;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, fillonedir, &buf);
+ 	if (buf.result)
+@@ -142,6 +149,7 @@ struct linux_dirent {
+ struct getdents_callback {
+ 	struct linux_dirent __user * current_dir;
+ 	struct linux_dirent __user * previous;
++	struct file * file;
+ 	int count;
+ 	int error;
+ };
+@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
+ 		buf->error = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
+ 	buf.previous = NULL;
+ 	buf.count = count;
+ 	buf.error = 0;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, filldir, &buf);
+ 	if (error >= 0)
+@@ -228,6 +241,7 @@ out:
+ struct getdents_callback64 {
+ 	struct linux_dirent64 __user * current_dir;
+ 	struct linux_dirent64 __user * previous;
++	struct file *file;
+ 	int count;
+ 	int error;
+ };
+@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
+ 	buf->error = -EINVAL;	/* only used if we fail.. */
+ 	if (reclen > buf->count)
+ 		return -EINVAL;
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
+ 
+ 	buf.current_dir = dirent;
+ 	buf.previous = NULL;
++	buf.file = file;
+ 	buf.count = count;
+ 	buf.error = 0;
+ 
+diff -urNp linux-2.6.32.12/fs/reiserfs/do_balan.c linux-2.6.32.12/fs/reiserfs/do_balan.c
+--- linux-2.6.32.12/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/reiserfs/do_balan.c	2010-04-04 20:46:41.661529739 -0400
+@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
+ 		return;
+ 	}
+ 
+-	atomic_inc(&(fs_generation(tb->tb_sb)));
++	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
+ 	do_balance_starts(tb);
+ 
+ 	/* balance leaf returns 0 except if combining L R and S into
+diff -urNp linux-2.6.32.12/fs/reiserfs/item_ops.c linux-2.6.32.12/fs/reiserfs/item_ops.c
+--- linux-2.6.32.12/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/reiserfs/item_ops.c	2010-04-04 20:46:41.661529739 -0400
+@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations stat_data_ops = {
++static const struct item_operations stat_data_ops = {
+ 	.bytes_number = sd_bytes_number,
+ 	.decrement_key = sd_decrement_key,
+ 	.is_left_mergeable = sd_is_left_mergeable,
+@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations direct_ops = {
++static const struct item_operations direct_ops = {
+ 	.bytes_number = direct_bytes_number,
+ 	.decrement_key = direct_decrement_key,
+ 	.is_left_mergeable = direct_is_left_mergeable,
+@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations indirect_ops = {
++static const struct item_operations indirect_ops = {
+ 	.bytes_number = indirect_bytes_number,
+ 	.decrement_key = indirect_decrement_key,
+ 	.is_left_mergeable = indirect_is_left_mergeable,
+@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
+ 	printk("\n");
+ }
+ 
+-static struct item_operations direntry_ops = {
++static const struct item_operations direntry_ops = {
+ 	.bytes_number = direntry_bytes_number,
+ 	.decrement_key = direntry_decrement_key,
+ 	.is_left_mergeable = direntry_is_left_mergeable,
+@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
+ 			 "Invalid item type observed, run fsck ASAP");
+ }
+ 
+-static struct item_operations errcatch_ops = {
++static const struct item_operations errcatch_ops = {
+ 	errcatch_bytes_number,
+ 	errcatch_decrement_key,
+ 	errcatch_is_left_mergeable,
+@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
+ #error Item types must use disk-format assigned values.
+ #endif
+ 
+-struct item_operations *item_ops[TYPE_ANY + 1] = {
++const struct item_operations * const item_ops[TYPE_ANY + 1] = {
+ 	&stat_data_ops,
+ 	&indirect_ops,
+ 	&direct_ops,
+diff -urNp linux-2.6.32.12/fs/reiserfs/procfs.c linux-2.6.32.12/fs/reiserfs/procfs.c
+--- linux-2.6.32.12/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/reiserfs/procfs.c	2010-04-04 20:46:41.661529739 -0400
+@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
+ 		   "SMALL_TAILS " : "NO_TAILS ",
+ 		   replay_only(sb) ? "REPLAY_ONLY " : "",
+ 		   convert_reiserfs(sb) ? "CONV " : "",
+-		   atomic_read(&r->s_generation_counter),
++		   atomic_read_unchecked(&r->s_generation_counter),
+ 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
+ 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
+ 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
+diff -urNp linux-2.6.32.12/fs/select.c linux-2.6.32.12/fs/select.c
+--- linux-2.6.32.12/fs/select.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/select.c	2010-04-04 20:46:41.661529739 -0400
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/poll.h>
++#include <linux/security.h>
+ #include <linux/personality.h> /* for STICKY_TIMEOUTS */
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
+@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
+  	struct poll_list *walk = head;
+  	unsigned long todo = nfds;
+ 
++	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
+ 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EINVAL;
+ 
+diff -urNp linux-2.6.32.12/fs/seq_file.c linux-2.6.32.12/fs/seq_file.c
+--- linux-2.6.32.12/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/seq_file.c	2010-04-04 20:46:41.661529739 -0400
+@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
+ 		return 0;
+ 	}
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			return -ENOMEM;
+ 	}
+@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
+ Eoverflow:
+ 	m->op->stop(m, p);
+ 	kfree(m->buf);
+-	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++	m->size <<= 1;
++	m->buf = kmalloc(m->size, GFP_KERNEL);
+ 	return !m->buf ? -ENOMEM : -EAGAIN;
+ }
+ 
+@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
+ 	m->version = file->f_version;
+ 	/* grab buffer if we didn't have one */
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 	}
+@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
+ 			goto Fill;
+ 		m->op->stop(m, p);
+ 		kfree(m->buf);
+-		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++		m->size <<= 1;
++		m->buf = kmalloc(m->size, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 		m->count = 0;
+diff -urNp linux-2.6.32.12/fs/smbfs/symlink.c linux-2.6.32.12/fs/smbfs/symlink.c
+--- linux-2.6.32.12/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/smbfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
+@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
+ 
+ static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+diff -urNp linux-2.6.32.12/fs/splice.c linux-2.6.32.12/fs/splice.c
+--- linux-2.6.32.12/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/splice.c	2010-04-04 20:46:41.661529739 -0400
+@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 	pipe_lock(pipe);
+ 
+ 	for (;;) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 			do_wakeup = 0;
+ 		}
+ 
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
++	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_write(file, (const char __user *)buf, count, &pos);
++	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
+ 			goto err;
+ 
+ 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
+-		vec[i].iov_base = (void __user *) page_address(page);
++		vec[i].iov_base = (__force void __user *) page_address(page);
+ 		vec[i].iov_len = this_len;
+ 		pages[i] = page;
+ 		spd.nr_pages++;
+@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+ int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
+ 	while (!pipe->nrbufs) {
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			return 0;
+ 
+-		if (!pipe->waiting_writers && sd->num_spliced)
++		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
+ 			return 0;
+ 
+ 		if (sd->flags & SPLICE_F_NONBLOCK)
+@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
+ 		 * out of the pipe right after the splice_to_pipe(). So set
+ 		 * PIPE_READERS appropriately.
+ 		 */
+-		pipe->readers = 1;
++		atomic_set(&pipe->readers, 1);
+ 
+ 		current->splice_pipe = pipe;
+ 	}
+@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			if (flags & SPLICE_F_NONBLOCK) {
+ 				ret = -EAGAIN;
+ 				break;
+@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
+ 	pipe_lock(pipe);
+ 
+ 	while (pipe->nrbufs >= PIPE_BUFFERS) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			ret = -EPIPE;
+ 			break;
+@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -1789,14 +1789,14 @@ retry:
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+ 			break;
+ 		}
+ 
+-		if (!ipipe->nrbufs && !ipipe->writers)
++		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
+ 			break;
+ 
+ 		/*
+@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
+ 	 * return EAGAIN if we have the potential of some data in the
+ 	 * future, otherwise just return 0
+ 	 */
+-	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
++	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
+ 		ret = -EAGAIN;
+ 
+ 	pipe_unlock(ipipe);
+diff -urNp linux-2.6.32.12/fs/sysfs/file.c linux-2.6.32.12/fs/sysfs/file.c
+--- linux-2.6.32.12/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/sysfs/file.c	2010-04-04 20:46:41.661529739 -0400
+@@ -53,7 +53,7 @@ struct sysfs_buffer {
+ 	size_t			count;
+ 	loff_t			pos;
+ 	char			* page;
+-	struct sysfs_ops	* ops;
++	const struct sysfs_ops	* ops;
+ 	struct mutex		mutex;
+ 	int			needs_read_fill;
+ 	int			event;
+@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int ret = 0;
+ 	ssize_t count;
+ 
+@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int rc;
+ 
+ 	/* need attr_sd for attr and ops, its parent for kobj */
+@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
+ 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+ 	struct sysfs_buffer *buffer;
+-	struct sysfs_ops *ops;
++	const struct sysfs_ops *ops;
+ 	int error = -EACCES;
+ 	char *p;
+ 
+diff -urNp linux-2.6.32.12/fs/sysfs/symlink.c linux-2.6.32.12/fs/sysfs/symlink.c
+--- linux-2.6.32.12/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/sysfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
+@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
+ 
+ static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
+ {
+-	char *page = nd_get_link(nd);
++	const char *page = nd_get_link(nd);
+ 	if (!IS_ERR(page))
+ 		free_page((unsigned long)page);
+ }
+diff -urNp linux-2.6.32.12/fs/udf/balloc.c linux-2.6.32.12/fs/udf/balloc.c
+--- linux-2.6.32.12/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/udf/balloc.c	2010-04-04 20:46:41.665784997 -0400
+@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
+ 			  count, partmap->s_partition_len);
+@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
+ 			  partmap->s_partition_len);
+diff -urNp linux-2.6.32.12/fs/udf/misc.c linux-2.6.32.12/fs/udf/misc.c
+--- linux-2.6.32.12/fs/udf/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/udf/misc.c	2010-04-29 17:46:37.289044536 -0400
+@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
+ 		iinfo->i_lenEAttr += size;
+ 		return (struct genericFormat *)&ea[offset];
+ 	}
+-	if (loc & 0x02)
+-		;
++	if (loc & 0x02) {
++	}
+ 
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.12/fs/udf/udfdecl.h linux-2.6.32.12/fs/udf/udfdecl.h
+--- linux-2.6.32.12/fs/udf/udfdecl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/udf/udfdecl.h	2010-04-29 17:46:37.289044536 -0400
+@@ -26,7 +26,7 @@ do { \
+ 	printk(f, ##a); \
+ } while (0)
+ #else
+-#define udf_debug(f, a...) /**/
++#define udf_debug(f, a...) do {} while (0)
+ #endif
+ 
+ #define udf_info(f, a...) \
+diff -urNp linux-2.6.32.12/fs/utimes.c linux-2.6.32.12/fs/utimes.c
+--- linux-2.6.32.12/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/utimes.c	2010-04-04 20:46:41.665784997 -0400
+@@ -1,6 +1,7 @@
+ #include <linux/compiler.h>
+ #include <linux/file.h>
+ #include <linux/fs.h>
++#include <linux/security.h>
+ #include <linux/linkage.h>
+ #include <linux/mount.h>
+ #include <linux/namei.h>
+@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
+ 				goto mnt_drop_write_and_out;
+ 		}
+ 	}
++
++	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
++		error = -EACCES;
++		goto mnt_drop_write_and_out;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	error = notify_change(path->dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
+diff -urNp linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c
+--- linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c	2010-04-04 20:46:41.665784997 -0400
+@@ -134,7 +134,7 @@ xfs_find_handle(
+ 	}
+ 
+ 	error = -EFAULT;
+-	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
++	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
+ 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
+ 		goto out_put;
+ 
+diff -urNp linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:38.453075413 -0400
++++ linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:58.609026943 -0400
+@@ -468,7 +468,7 @@ xfs_vn_put_link(
+ 	struct nameidata *nd,
+ 	void		*p)
+ {
+-	char		*s = nd_get_link(nd);
++	const char	*s = nd_get_link(nd);
+ 
+ 	if (!IS_ERR(s))
+ 		kfree(s);
+diff -urNp linux-2.6.32.12/fs/xfs/xfs_bmap.c linux-2.6.32.12/fs/xfs/xfs_bmap.c
+--- linux-2.6.32.12/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/fs/xfs/xfs_bmap.c	2010-04-04 20:46:41.665784997 -0400
+@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
+ 	int			nmap,
+ 	int			ret_nmap);
+ #else
+-#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
++#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
+ #endif /* DEBUG */
+ 
+ #if defined(XFS_RW_TRACE)
+diff -urNp linux-2.6.32.12/grsecurity/gracl_alloc.c linux-2.6.32.12/grsecurity/gracl_alloc.c
+--- linux-2.6.32.12/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_alloc.c	2010-04-04 20:46:41.665784997 -0400
+@@ -0,0 +1,105 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++
++static unsigned long alloc_stack_next = 1;
++static unsigned long alloc_stack_size = 1;
++static void **alloc_stack;
++
++static __inline__ int
++alloc_pop(void)
++{
++	if (alloc_stack_next == 1)
++		return 0;
++
++	kfree(alloc_stack[alloc_stack_next - 2]);
++
++	alloc_stack_next--;
++
++	return 1;
++}
++
++static __inline__ int
++alloc_push(void *buf)
++{
++	if (alloc_stack_next >= alloc_stack_size)
++		return 1;
++
++	alloc_stack[alloc_stack_next - 1] = buf;
++
++	alloc_stack_next++;
++
++	return 0;
++}
++
++void *
++acl_alloc(unsigned long len)
++{
++	void *ret = NULL;
++
++	if (!len || len > PAGE_SIZE)
++		goto out;
++
++	ret = kmalloc(len, GFP_KERNEL);
++
++	if (ret) {
++		if (alloc_push(ret)) {
++			kfree(ret);
++			ret = NULL;
++		}
++	}
++
++out:
++	return ret;
++}
++
++void *
++acl_alloc_num(unsigned long num, unsigned long len)
++{
++	if (!len || (num > (PAGE_SIZE / len)))
++		return NULL;
++
++	return acl_alloc(num * len);
++}
++
++void
++acl_free_all(void)
++{
++	if (gr_acl_is_enabled() || !alloc_stack)
++		return;
++
++	while (alloc_pop()) ;
++
++	if (alloc_stack) {
++		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
++			kfree(alloc_stack);
++		else
++			vfree(alloc_stack);
++	}
++
++	alloc_stack = NULL;
++	alloc_stack_size = 1;
++	alloc_stack_next = 1;
++
++	return;
++}
++
++int
++acl_alloc_stack_init(unsigned long size)
++{
++	if ((size * sizeof (void *)) <= PAGE_SIZE)
++		alloc_stack =
++		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
++	else
++		alloc_stack = (void **) vmalloc(size * sizeof (void *));
++
++	alloc_stack_size = size;
++
++	if (!alloc_stack)
++		return 0;
++	else
++		return 1;
++}
+diff -urNp linux-2.6.32.12/grsecurity/gracl.c linux-2.6.32.12/grsecurity/gracl.c
+--- linux-2.6.32.12/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl.c	2010-04-29 17:48:04.497204424 -0400
+@@ -0,0 +1,3897 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/mount.h>
++#include <linux/tty.h>
++#include <linux/proc_fs.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/types.h>
++#include <linux/sysctl.h>
++#include <linux/netdevice.h>
++#include <linux/ptrace.h>
++#include <linux/gracl.h>
++#include <linux/gralloc.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/pid_namespace.h>
++#include <linux/fdtable.h>
++#include <linux/percpu.h>
++
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++
++static struct acl_role_db acl_role_set;
++static struct name_db name_set;
++static struct inodev_db inodev_set;
++
++/* for keeping track of userspace pointers used for subjects, so we
++   can share references in the kernel as well
++*/
++
++static struct dentry *real_root;
++static struct vfsmount *real_root_mnt;
++
++static struct acl_subj_map_db subj_map_set;
++
++static struct acl_role_label *default_role;
++
++static struct acl_role_label *role_list;
++
++static u16 acl_sp_role_value;
++
++extern char *gr_shared_page[4];
++static DECLARE_MUTEX(gr_dev_sem);
++DEFINE_RWLOCK(gr_inode_lock);
++
++struct gr_arg *gr_usermode;
++
++static unsigned int gr_status __read_only = GR_STATUS_INIT;
++
++extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
++extern void gr_clear_learn_entries(void);
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++extern void gr_log_resource(const struct task_struct *task,
++			    const int res, const unsigned long wanted, const int gt);
++#endif
++
++unsigned char *gr_system_salt;
++unsigned char *gr_system_sum;
++
++static struct sprole_pw **acl_special_roles = NULL;
++static __u16 num_sprole_pws = 0;
++
++static struct acl_role_label *kernel_role = NULL;
++
++static unsigned int gr_auth_attempts = 0;
++static unsigned long gr_auth_expires = 0UL;
++
++extern struct vfsmount *sock_mnt;
++extern struct vfsmount *pipe_mnt;
++extern struct vfsmount *shm_mnt;
++#ifdef CONFIG_HUGETLBFS
++extern struct vfsmount *hugetlbfs_vfsmount;
++#endif
++
++static struct acl_object_label *fakefs_obj;
++
++extern int gr_init_uidset(void);
++extern void gr_free_uidset(void);
++extern void gr_remove_uid(uid_t uid);
++extern int gr_find_uid(uid_t uid);
++
++__inline__ int
++gr_acl_is_enabled(void)
++{
++	return (gr_status & GR_READY);
++}
++
++char gr_roletype_to_char(void)
++{
++	switch (current->role->roletype &
++		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
++		 GR_ROLE_SPECIAL)) {
++	case GR_ROLE_DEFAULT:
++		return 'D';
++	case GR_ROLE_USER:
++		return 'U';
++	case GR_ROLE_GROUP:
++		return 'G';
++	case GR_ROLE_SPECIAL:
++		return 'S';
++	}
++
++	return 'X';
++}
++
++__inline__ int
++gr_acl_tpe_check(void)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++	if (current->role->roletype & GR_ROLE_TPE)
++		return 1;
++	else
++		return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (inode && S_ISBLK(inode->i_mode) &&
++	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
++	    !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++static int
++gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
++{
++	if (likely(lena != lenb))
++		return 0;
++
++	return !memcmp(a, b, lena);
++}
++
++static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++	                   struct dentry *root, struct vfsmount *rootmnt,
++			   char *buffer, int buflen)
++{
++	char * end = buffer+buflen;
++	char * retval;
++	int namelen;
++
++	*--end = '\0';
++	buflen--;
++
++	if (buflen < 1)
++		goto Elong;
++	/* Get '/' right */
++	retval = end-1;
++	*retval = '/';
++
++	for (;;) {
++		struct dentry * parent;
++
++		if (dentry == root && vfsmnt == rootmnt)
++			break;
++		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
++			/* Global root? */
++			spin_lock(&vfsmount_lock);
++			if (vfsmnt->mnt_parent == vfsmnt) {
++				spin_unlock(&vfsmount_lock);
++				goto global_root;
++			}
++			dentry = vfsmnt->mnt_mountpoint;
++			vfsmnt = vfsmnt->mnt_parent;
++			spin_unlock(&vfsmount_lock);
++			continue;
++		}
++		parent = dentry->d_parent;
++		prefetch(parent);
++		namelen = dentry->d_name.len;
++		buflen -= namelen + 1;
++		if (buflen < 0)
++			goto Elong;
++		end -= namelen;
++		memcpy(end, dentry->d_name.name, namelen);
++		*--end = '/';
++		retval = end;
++		dentry = parent;
++	}
++
++	return retval;
++
++global_root:
++	namelen = dentry->d_name.len;
++	buflen -= namelen;
++	if (buflen < 0)
++		goto Elong;
++	retval -= namelen-1;	/* hit the slash */
++	memcpy(retval, dentry->d_name.name, namelen);
++	return retval;
++Elong:
++	return ERR_PTR(-ENAMETOOLONG);
++}
++
++static char *
++gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
++{
++	char *retval;
++
++	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
++	if (unlikely(IS_ERR(retval)))
++		retval = strcpy(buf, "<path too long>");
++	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
++		retval[1] = '\0';
++
++	return retval;
++}
++
++static char *
++__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++		char *buf, int buflen)
++{
++	char *res;
++
++	/* we can use real_root, real_root_mnt, because this is only called
++	   by the RBAC system */
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
++
++	return res;
++}
++
++static char *
++d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++	    char *buf, int buflen)
++{
++	char *res;
++	struct dentry *root;
++	struct vfsmount *rootmnt;
++	struct task_struct *reaper = &init_task;
++
++	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
++	read_lock(&reaper->fs->lock);
++	root = dget(reaper->fs->root.dentry);
++	rootmnt = mntget(reaper->fs->root.mnt);
++	read_unlock(&reaper->fs->lock);
++
++	spin_lock(&dcache_lock);
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
++	spin_unlock(&dcache_lock);
++
++	dput(root);
++	mntput(rootmnt);
++	return res;
++}
++
++static char *
++gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	char *ret;
++	spin_lock(&dcache_lock);
++	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++	spin_unlock(&dcache_lock);
++	return ret;
++}
++
++char *
++gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++}
++
++char *
++gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++__inline__ __u32
++to_gr_audit(const __u32 reqmode)
++{
++	/* masks off auditable permission flags, then shifts them to create
++	   auditing flags, and adds the special case of append auditing if
++	   we're requesting write */
++	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
++}
++
++struct acl_subject_label *
++lookup_subject_map(const struct acl_subject_label *userp)
++{
++	unsigned int index = shash(userp, subj_map_set.s_size);
++	struct subject_map *match;
++
++	match = subj_map_set.s_hash[index];
++
++	while (match && match->user != userp)
++		match = match->next;
++
++	if (match != NULL)
++		return match->kernel;
++	else
++		return NULL;
++}
++
++static void
++insert_subj_map_entry(struct subject_map *subjmap)
++{
++	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
++	struct subject_map **curr;
++
++	subjmap->prev = NULL;
++
++	curr = &subj_map_set.s_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = subjmap;
++
++	subjmap->next = *curr;
++	*curr = subjmap;
++
++	return;
++}
++
++static struct acl_role_label *
++lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
++		      const gid_t gid)
++{
++	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
++	struct acl_role_label *match;
++	struct role_allowed_ip *ipp;
++	unsigned int x;
++
++	match = acl_role_set.r_hash[index];
++
++	while (match) {
++		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
++			for (x = 0; x < match->domain_child_num; x++) {
++				if (match->domain_children[x] == uid)
++					goto found;
++			}
++		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
++			break;
++		match = match->next;
++	}
++found:
++	if (match == NULL) {
++	      try_group:
++		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
++		match = acl_role_set.r_hash[index];
++
++		while (match) {
++			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
++				for (x = 0; x < match->domain_child_num; x++) {
++					if (match->domain_children[x] == gid)
++						goto found2;
++				}
++			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
++				break;
++			match = match->next;
++		}
++found2:
++		if (match == NULL)
++			match = default_role;
++		if (match->allowed_ips == NULL)
++			return match;
++		else {
++			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++				if (likely
++				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++				     (ntohl(ipp->addr) & ipp->netmask)))
++					return match;
++			}
++			match = default_role;
++		}
++	} else if (match->allowed_ips == NULL) {
++		return match;
++	} else {
++		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++			if (likely
++			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++			     (ntohl(ipp->addr) & ipp->netmask)))
++				return match;
++		}
++		goto try_group;
++	}
++
++	return match;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label(const ino_t ino, const dev_t dev,
++		      const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
++			  const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct name_entry *
++lookup_name_entry(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
++		match = match->next;
++
++	return match;
++}
++
++static struct name_entry *
++lookup_name_entry_create(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 !match->deleted))
++		match = match->next;
++
++	if (match && match->deleted)
++		return match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 match->deleted))
++		match = match->next;
++
++	if (match && !match->deleted)
++		return match;
++	else
++		return NULL;
++}
++
++static struct inodev_entry *
++lookup_inodev_entry(const ino_t ino, const dev_t dev)
++{
++	unsigned int index = fhash(ino, dev, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
++		match = match->next;
++
++	return match;
++}
++
++static void
++insert_inodev_entry(struct inodev_entry *entry)
++{
++	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
++				    inodev_set.i_size);
++	struct inodev_entry **curr;
++
++	entry->prev = NULL;
++
++	curr = &inodev_set.i_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = entry;
++	
++	entry->next = *curr;
++	*curr = entry;
++
++	return;
++}
++
++static void
++__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
++{
++	unsigned int index =
++	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
++	struct acl_role_label **curr;
++	struct acl_role_label *tmp;
++
++	curr = &acl_role_set.r_hash[index];
++
++	/* if role was already inserted due to domains and already has
++	   a role in the same bucket as it attached, then we need to
++	   combine these two buckets
++	*/
++	if (role->next) {
++		tmp = role->next;
++		while (tmp->next)
++			tmp = tmp->next;
++		tmp->next = *curr;
++	} else
++		role->next = *curr;
++	*curr = role;
++
++	return;
++}
++
++static void
++insert_acl_role_label(struct acl_role_label *role)
++{
++	int i;
++
++	if (role_list == NULL) {
++		role_list = role;
++		role->prev = NULL;
++	} else {
++		role->prev = role_list;
++		role_list = role;
++	}
++	
++	/* used for hash chains */
++	role->next = NULL;
++
++	if (role->roletype & GR_ROLE_DOMAIN) {
++		for (i = 0; i < role->domain_child_num; i++)
++			__insert_acl_role_label(role, role->domain_children[i]);
++	} else
++		__insert_acl_role_label(role, role->uidgid);
++}
++					
++static int
++insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
++{
++	struct name_entry **curr, *nentry;
++	struct inodev_entry *ientry;
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++
++	curr = &name_set.n_hash[index];
++
++	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
++		curr = &((*curr)->next);
++
++	if (*curr != NULL)
++		return 1;
++
++	nentry = acl_alloc(sizeof (struct name_entry));
++	if (nentry == NULL)
++		return 0;
++	ientry = acl_alloc(sizeof (struct inodev_entry));
++	if (ientry == NULL)
++		return 0;
++	ientry->nentry = nentry;
++
++	nentry->key = key;
++	nentry->name = name;
++	nentry->inode = inode;
++	nentry->device = device;
++	nentry->len = len;
++	nentry->deleted = deleted;
++
++	nentry->prev = NULL;
++	curr = &name_set.n_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = nentry;
++	nentry->next = *curr;
++	*curr = nentry;
++
++	/* insert us into the table searchable by inode/dev */
++	insert_inodev_entry(ientry);
++
++	return 1;
++}
++
++static void
++insert_acl_obj_label(struct acl_object_label *obj,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index =
++	    fhash(obj->inode, obj->device, subj->obj_hash_size);
++	struct acl_object_label **curr;
++
++	
++	obj->prev = NULL;
++
++	curr = &subj->obj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++static void
++insert_acl_subj_label(struct acl_subject_label *obj,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
++	struct acl_subject_label **curr;
++
++	obj->prev = NULL;
++
++	curr = &role->subj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
++
++static void *
++create_table(__u32 * len, int elementsize)
++{
++	unsigned int table_sizes[] = {
++		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
++		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
++		4194301, 8388593, 16777213, 33554393, 67108859
++	};
++	void *newtable = NULL;
++	unsigned int pwr = 0;
++
++	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
++	       table_sizes[pwr] <= *len)
++		pwr++;
++
++	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
++		return newtable;
++
++	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
++		newtable =
++		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
++	else
++		newtable = vmalloc(table_sizes[pwr] * elementsize);
++
++	*len = table_sizes[pwr];
++
++	return newtable;
++}
++
++static int
++init_variables(const struct gr_arg *arg)
++{
++	struct task_struct *reaper = &init_task;
++	unsigned int stacksize;
++
++	subj_map_set.s_size = arg->role_db.num_subjects;
++	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
++	name_set.n_size = arg->role_db.num_objects;
++	inodev_set.i_size = arg->role_db.num_objects;
++
++	if (!subj_map_set.s_size || !acl_role_set.r_size ||
++	    !name_set.n_size || !inodev_set.i_size)
++		return 1;
++
++	if (!gr_init_uidset())
++		return 1;
++
++	/* set up the stack that holds allocation info */
++
++	stacksize = arg->role_db.num_pointers + 5;
++
++	if (!acl_alloc_stack_init(stacksize))
++		return 1;
++
++	/* grab reference for the real root dentry and vfsmount */
++	read_lock(&reaper->fs->lock);
++	real_root_mnt = mntget(reaper->fs->root.mnt);
++	real_root = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++	
++	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
++	if (fakefs_obj == NULL)
++		return 1;
++	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
++
++	subj_map_set.s_hash =
++	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
++	acl_role_set.r_hash =
++	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
++	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
++	inodev_set.i_hash =
++	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
++
++	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
++	    !name_set.n_hash || !inodev_set.i_hash)
++		return 1;
++
++	memset(subj_map_set.s_hash, 0,
++	       sizeof(struct subject_map *) * subj_map_set.s_size);
++	memset(acl_role_set.r_hash, 0,
++	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
++	memset(name_set.n_hash, 0,
++	       sizeof (struct name_entry *) * name_set.n_size);
++	memset(inodev_set.i_hash, 0,
++	       sizeof (struct inodev_entry *) * inodev_set.i_size);
++
++	return 0;
++}
++
++/* free information not needed after startup
++   currently contains user->kernel pointer mappings for subjects
++*/
++
++static void
++free_init_variables(void)
++{
++	__u32 i;
++
++	if (subj_map_set.s_hash) {
++		for (i = 0; i < subj_map_set.s_size; i++) {
++			if (subj_map_set.s_hash[i]) {
++				kfree(subj_map_set.s_hash[i]);
++				subj_map_set.s_hash[i] = NULL;
++			}
++		}
++
++		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
++		    PAGE_SIZE)
++			kfree(subj_map_set.s_hash);
++		else
++			vfree(subj_map_set.s_hash);
++	}
++
++	return;
++}
++
++static void
++free_variables(void)
++{
++	struct acl_subject_label *s;
++	struct acl_role_label *r;
++	struct task_struct *task, *task2;
++	unsigned int x;
++
++	gr_clear_learn_entries();
++
++	read_lock(&tasklist_lock);
++	do_each_thread(task2, task) {
++		task->acl_sp_role = 0;
++		task->acl_role_id = 0;
++		task->acl = NULL;
++		task->role = NULL;
++	} while_each_thread(task2, task);
++	read_unlock(&tasklist_lock);
++
++	/* release the reference to the real root dentry and vfsmount */
++	if (real_root)
++		dput(real_root);
++	real_root = NULL;
++	if (real_root_mnt)
++		mntput(real_root_mnt);
++	real_root_mnt = NULL;
++
++	/* free all object hash tables */
++
++	FOR_EACH_ROLE_START(r)
++		if (r->subj_hash == NULL)
++			goto next_role;
++		FOR_EACH_SUBJECT_START(r, s, x)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_SUBJECT_END(s, x)
++		FOR_EACH_NESTED_SUBJECT_START(r, s)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_NESTED_SUBJECT_END(s)
++		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
++			kfree(r->subj_hash);
++		else
++			vfree(r->subj_hash);
++		r->subj_hash = NULL;
++next_role:
++	FOR_EACH_ROLE_END(r)
++
++	acl_free_all();
++
++	if (acl_role_set.r_hash) {
++		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
++		    PAGE_SIZE)
++			kfree(acl_role_set.r_hash);
++		else
++			vfree(acl_role_set.r_hash);
++	}
++	if (name_set.n_hash) {
++		if ((name_set.n_size * sizeof (struct name_entry *)) <=
++		    PAGE_SIZE)
++			kfree(name_set.n_hash);
++		else
++			vfree(name_set.n_hash);
++	}
++
++	if (inodev_set.i_hash) {
++		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
++		    PAGE_SIZE)
++			kfree(inodev_set.i_hash);
++		else
++			vfree(inodev_set.i_hash);
++	}
++
++	gr_free_uidset();
++
++	memset(&name_set, 0, sizeof (struct name_db));
++	memset(&inodev_set, 0, sizeof (struct inodev_db));
++	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
++	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
++
++	default_role = NULL;
++	role_list = NULL;
++
++	return;
++}
++
++static __u32
++count_user_objs(struct acl_object_label *userp)
++{
++	struct acl_object_label o_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			break;
++
++		userp = o_tmp.prev;
++		num++;
++	}
++
++	return num;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
++
++static int
++copy_user_glob(struct acl_object_label *obj)
++{
++	struct acl_object_label *g_tmp, **guser;
++	unsigned int len;
++	char *tmp;
++
++	if (obj->globbed == NULL)
++		return 0;
++
++	guser = &obj->globbed;
++	while (*guser) {
++		g_tmp = (struct acl_object_label *)
++			acl_alloc(sizeof (struct acl_object_label));
++		if (g_tmp == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(g_tmp, *guser,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		len = strnlen_user(g_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, g_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		g_tmp->filename = tmp;
++
++		*guser = g_tmp;
++		guser = &(g_tmp->next);
++	}
++
++	return 0;
++}
++
++static int
++copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
++	       struct acl_role_label *role)
++{
++	struct acl_object_label *o_tmp;
++	unsigned int len;
++	int ret;
++	char *tmp;
++
++	while (userp) {
++		if ((o_tmp = (struct acl_object_label *)
++		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		userp = o_tmp->prev;
++
++		len = strnlen_user(o_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, o_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		o_tmp->filename = tmp;
++
++		insert_acl_obj_label(o_tmp, subj);
++		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
++				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
++			return -ENOMEM;
++
++		ret = copy_user_glob(o_tmp);
++		if (ret)
++			return ret;
++
++		if (o_tmp->nested) {
++			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
++			if (IS_ERR(o_tmp->nested))
++				return PTR_ERR(o_tmp->nested);
++
++			/* insert into nested subject list */
++			o_tmp->nested->next = role->hash->first;
++			role->hash->first = o_tmp->nested;
++		}
++	}
++
++	return 0;
++}
++
++static __u32
++count_user_subjs(struct acl_subject_label *userp)
++{
++	struct acl_subject_label s_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&s_tmp, userp,
++				   sizeof (struct acl_subject_label)))
++			break;
++
++		userp = s_tmp.prev;
++		/* do not count nested subjects against this count, since
++		   they are not included in the hash table, but are
++		   attached to objects.  We have already counted
++		   the subjects in userspace for the allocation 
++		   stack
++		*/
++		if (!(s_tmp.mode & GR_NESTED))
++			num++;
++	}
++
++	return num;
++}
++
++static int
++copy_user_allowedips(struct acl_role_label *rolep)
++{
++	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
++
++	ruserip = rolep->allowed_ips;
++
++	while (ruserip) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_allowed_ip *)
++		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, ruserip,
++				   sizeof (struct role_allowed_ip)))
++			return -EFAULT;
++
++		ruserip = rtmp->prev;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->allowed_ips = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!ruserip)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_transitions(struct acl_role_label *rolep)
++{
++	struct role_transition *rusertp, *rtmp = NULL, *rlast;
++	
++	unsigned int len;
++	char *tmp;
++
++	rusertp = rolep->transitions;
++
++	while (rusertp) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_transition *)
++		     acl_alloc(sizeof (struct role_transition))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, rusertp,
++				   sizeof (struct role_transition)))
++			return -EFAULT;
++
++		rusertp = rtmp->prev;
++
++		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, rtmp->rolename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		rtmp->rolename = tmp;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->transitions = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!rusertp)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
++	unsigned int len;
++	char *tmp;
++	__u32 num_objs;
++	struct acl_ip_label **i_tmp, *i_utmp2;
++	struct gr_hash_struct ghash;
++	struct subject_map *subjmap;
++	unsigned int i_num;
++	int err;
++
++	s_tmp = lookup_subject_map(userp);
++
++	/* we've already copied this subject into the kernel, just return
++	   the reference to it, and don't copy it over again
++	*/
++	if (s_tmp)
++		return(s_tmp);
++
++	if ((s_tmp = (struct acl_subject_label *)
++	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
++	if (subjmap == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap->user = userp;
++	subjmap->kernel = s_tmp;
++	insert_subj_map_entry(subjmap);
++
++	if (copy_from_user(s_tmp, userp,
++			   sizeof (struct acl_subject_label)))
++		return ERR_PTR(-EFAULT);
++
++	len = strnlen_user(s_tmp->filename, PATH_MAX);
++
++	if (!len || len >= PATH_MAX)
++		return ERR_PTR(-EINVAL);
++
++	if ((tmp = (char *) acl_alloc(len)) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	if (copy_from_user(tmp, s_tmp->filename, len))
++		return ERR_PTR(-EFAULT);
++	tmp[len-1] = '\0';
++	s_tmp->filename = tmp;
++
++	if (!strcmp(s_tmp->filename, "/"))
++		role->root_label = s_tmp;
++
++	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
++		return ERR_PTR(-EFAULT);
++
++	/* copy user and group transition tables */
++
++	if (s_tmp->user_trans_num) {
++		uid_t *uidlist;
++
++		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
++		if (uidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->user_transitions = uidlist;
++	}
++
++	if (s_tmp->group_trans_num) {
++		gid_t *gidlist;
++
++		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
++		if (gidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->group_transitions = gidlist;
++	}
++
++	/* set up object hash table */
++	num_objs = count_user_objs(ghash.first);
++
++	s_tmp->obj_hash_size = num_objs;
++	s_tmp->obj_hash =
++	    (struct acl_object_label **)
++	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
++
++	if (!s_tmp->obj_hash)
++		return ERR_PTR(-ENOMEM);
++
++	memset(s_tmp->obj_hash, 0,
++	       s_tmp->obj_hash_size *
++	       sizeof (struct acl_object_label *));
++
++	/* add in objects */
++	err = copy_user_objs(ghash.first, s_tmp, role);
++
++	if (err)
++		return ERR_PTR(err);
++
++	/* set pointer for parent subject */
++	if (s_tmp->parent_subject) {
++		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
++
++		if (IS_ERR(s_tmp2))
++			return s_tmp2;
++
++		s_tmp->parent_subject = s_tmp2;
++	}
++
++	/* add in ip acls */
++
++	if (!s_tmp->ip_num) {
++		s_tmp->ips = NULL;
++		goto insert;
++	}
++
++	i_tmp =
++	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
++					       sizeof (struct acl_ip_label *));
++
++	if (!i_tmp)
++		return ERR_PTR(-ENOMEM);
++
++	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
++		*(i_tmp + i_num) =
++		    (struct acl_ip_label *)
++		    acl_alloc(sizeof (struct acl_ip_label));
++		if (!*(i_tmp + i_num))
++			return ERR_PTR(-ENOMEM);
++
++		if (copy_from_user
++		    (&i_utmp2, s_tmp->ips + i_num,
++		     sizeof (struct acl_ip_label *)))
++			return ERR_PTR(-EFAULT);
++
++		if (copy_from_user
++		    (*(i_tmp + i_num), i_utmp2,
++		     sizeof (struct acl_ip_label)))
++			return ERR_PTR(-EFAULT);
++		
++		if ((*(i_tmp + i_num))->iface == NULL)
++			continue;
++
++		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
++		if (!len || len >= IFNAMSIZ)
++			return ERR_PTR(-EINVAL);
++		tmp = acl_alloc(len);
++		if (tmp == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
++			return ERR_PTR(-EFAULT);
++		(*(i_tmp + i_num))->iface = tmp;
++	}
++
++	s_tmp->ips = i_tmp;
++
++insert:
++	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
++			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
++		return ERR_PTR(-ENOMEM);
++
++	return s_tmp;
++}
++
++static int
++copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label s_pre;
++	struct acl_subject_label * ret;
++	int err;
++
++	while (userp) {
++		if (copy_from_user(&s_pre, userp,
++				   sizeof (struct acl_subject_label)))
++			return -EFAULT;
++		
++		/* do not add nested subjects here, add
++		   while parsing objects
++		*/
++
++		if (s_pre.mode & GR_NESTED) {
++			userp = s_pre.prev;
++			continue;
++		}
++
++		ret = do_copy_user_subj(userp, role);
++
++		err = PTR_ERR(ret);
++		if (IS_ERR(ret))
++			return err;
++
++		insert_acl_subj_label(ret, role);
++
++		userp = s_pre.prev;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_acl(struct gr_arg *arg)
++{
++	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
++	struct sprole_pw *sptmp;
++	struct gr_hash_struct *ghash;
++	uid_t *domainlist;
++	unsigned int r_num;
++	unsigned int len;
++	char *tmp;
++	int err = 0;
++	__u16 i;
++	__u32 num_subjs;
++
++	/* we need a default and kernel role */
++	if (arg->role_db.num_roles < 2)
++		return -EINVAL;
++
++	/* copy special role authentication info from userspace */
++
++	num_sprole_pws = arg->num_sprole_pws;
++	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
++
++	if (!acl_special_roles) {
++		err = -ENOMEM;
++		goto cleanup;
++	}
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
++		if (!sptmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(sptmp, arg->sprole_pws + i,
++				   sizeof (struct sprole_pw))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len =
++		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(tmp, sptmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++		printk(KERN_ALERT "Copying special role %s\n", tmp);
++#endif
++		sptmp->rolename = tmp;
++		acl_special_roles[i] = sptmp;
++	}
++
++	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
++
++	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
++		r_tmp = acl_alloc(sizeof (struct acl_role_label));
++
++		if (!r_tmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(&r_utmp2, r_utmp + r_num,
++				   sizeof (struct acl_role_label *))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		if (copy_from_user(r_tmp, r_utmp2,
++				   sizeof (struct acl_role_label))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= PATH_MAX) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(tmp, r_tmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++		r_tmp->rolename = tmp;
++
++		if (!strcmp(r_tmp->rolename, "default")
++		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
++			default_role = r_tmp;
++		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
++			kernel_role = r_tmp;
++		}
++
++		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		r_tmp->hash = ghash;
++
++		num_subjs = count_user_subjs(r_tmp->hash->first);
++
++		r_tmp->subj_hash_size = num_subjs;
++		r_tmp->subj_hash =
++		    (struct acl_subject_label **)
++		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
++
++		if (!r_tmp->subj_hash) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		err = copy_user_allowedips(r_tmp);
++		if (err)
++			goto cleanup;
++
++		/* copy domain info */
++		if (r_tmp->domain_children != NULL) {
++			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
++			if (domainlist == NULL) {
++				err = -ENOMEM;
++				goto cleanup;
++			}
++			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
++				err = -EFAULT;
++				goto cleanup;
++			}
++			r_tmp->domain_children = domainlist;
++		}
++
++		err = copy_user_transitions(r_tmp);
++		if (err)
++			goto cleanup;
++
++		memset(r_tmp->subj_hash, 0,
++		       r_tmp->subj_hash_size *
++		       sizeof (struct acl_subject_label *));
++
++		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
++
++		if (err)
++			goto cleanup;
++
++		/* set nested subject list to null */
++		r_tmp->hash->first = NULL;
++
++		insert_acl_role_label(r_tmp);
++	}
++
++	goto return_err;
++      cleanup:
++	free_variables();
++      return_err:
++	return err;
++
++}
++
++static int
++gracl_init(struct gr_arg *args)
++{
++	int error = 0;
++
++	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
++	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
++
++	if (init_variables(args)) {
++		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
++		error = -ENOMEM;
++		free_variables();
++		goto out;
++	}
++
++	error = copy_user_acl(args);
++	free_init_variables();
++	if (error) {
++		free_variables();
++		goto out;
++	}
++
++	if ((error = gr_set_acls(0))) {
++		free_variables();
++		goto out;
++	}
++
++	pax_open_kernel();
++	gr_status |= GR_READY;
++	pax_close_kernel();
++
++      out:
++	return error;
++}
++
++/* derived from glibc fnmatch() 0: match, 1: no match*/
++
++static int
++glob_match(const char *p, const char *n)
++{
++	char c;
++
++	while ((c = *p++) != '\0') {
++	switch (c) {
++		case '?':
++			if (*n == '\0')
++				return 1;
++			else if (*n == '/')
++				return 1;
++			break;
++		case '\\':
++			if (*n != c)
++				return 1;
++			break;
++		case '*':
++			for (c = *p++; c == '?' || c == '*'; c = *p++) {
++				if (*n == '/')
++					return 1;
++				else if (c == '?') {
++					if (*n == '\0')
++						return 1;
++					else
++						++n;
++				}
++			}
++			if (c == '\0') {
++				return 0;
++			} else {
++				const char *endp;
++
++				if ((endp = strchr(n, '/')) == NULL)
++					endp = n + strlen(n);
++
++				if (c == '[') {
++					for (--p; n < endp; ++n)
++						if (!glob_match(p, n))
++							return 0;
++				} else if (c == '/') {
++					while (*n != '\0' && *n != '/')
++						++n;
++					if (*n == '/' && !glob_match(p, n + 1))
++						return 0;
++				} else {
++					for (--p; n < endp; ++n)
++						if (*n == c && !glob_match(p, n))
++							return 0;
++				}
++
++				return 1;
++			}
++		case '[':
++			{
++			int not;
++			char cold;
++
++			if (*n == '\0' || *n == '/')
++				return 1;
++
++			not = (*p == '!' || *p == '^');
++			if (not)
++				++p;
++
++			c = *p++;
++			for (;;) {
++				unsigned char fn = (unsigned char)*n;
++
++				if (c == '\0')
++					return 1;
++				else {
++					if (c == fn)
++						goto matched;
++					cold = c;
++					c = *p++;
++
++					if (c == '-' && *p != ']') {
++						unsigned char cend = *p++;
++
++						if (cend == '\0')
++							return 1;
++
++						if (cold <= fn && fn <= cend)
++							goto matched;
++
++						c = *p++;
++					}
++				}
++
++				if (c == ']')
++					break;
++			}
++			if (!not)
++				return 1;
++			break;
++		matched:
++			while (c != ']') {
++				if (c == '\0')
++					return 1;
++
++				c = *p++;
++			}
++			if (not)
++				return 1;
++		}
++		break;
++	default:
++		if (c != *n)
++			return 1;
++	}
++
++	++n;
++	}
++
++	if (*n == '\0')
++		return 0;
++
++	if (*n == '/')
++		return 0;
++
++	return 1;
++}
++
++static struct acl_object_label *
++chk_glob_label(struct acl_object_label *globbed,
++	struct dentry *dentry, struct vfsmount *mnt, char **path)
++{
++	struct acl_object_label *tmp;
++
++	if (*path == NULL)
++		*path = gr_to_filename_nolock(dentry, mnt);
++
++	tmp = globbed;
++
++	while (tmp) {
++		if (!glob_match(tmp->filename, *path))
++			return tmp;
++		tmp = tmp->next;
++	}
++
++	return NULL;
++}
++
++static struct acl_object_label *
++__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const ino_t curr_ino, const dev_t curr_dev,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	struct acl_subject_label *tmpsubj;
++	struct acl_object_label *retval;
++	struct acl_object_label *retval2;
++
++	tmpsubj = (struct acl_subject_label *) subj;
++	read_lock(&gr_inode_lock);
++	do {
++		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
++		if (retval) {
++			if (checkglob && retval->globbed) {
++				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
++						(struct vfsmount *)orig_mnt, path);
++				if (retval2)
++					retval = retval2;
++			}
++			break;
++		}
++	} while ((tmpsubj = tmpsubj->parent_subject));
++	read_unlock(&gr_inode_lock);
++
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const struct dentry *curr_dentry,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	return __full_lookup(orig_dentry, orig_mnt,
++			     curr_dentry->d_inode->i_ino, 
++			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
++}
++
++static struct acl_object_label *
++__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj, char *path, const int checkglob)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_object_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
++#ifdef CONFIG_HUGETLBFS
++	    mnt == hugetlbfs_vfsmount ||
++#endif
++		/* ignore Eric Biederman */
++	    IS_PRIVATE(l_dentry->d_inode))) {
++		retval = fakefs_obj;
++		goto out;
++	}
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++
++	if (retval == NULL)
++		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
++out:
++	spin_unlock(&dcache_lock);
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++		     const struct acl_subject_label *subj, char *path)
++{
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static struct acl_subject_label *
++chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	       const struct acl_role_label *role)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_subject_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			read_lock(&gr_inode_lock);
++			retval =
++				lookup_acl_subj_label(dentry->d_inode->i_ino,
++						dentry->d_inode->i_sb->s_dev, role);
++			read_unlock(&gr_inode_lock);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++					  dentry->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	read_lock(&gr_inode_lock);
++	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++				  dentry->d_inode->i_sb->s_dev, role);
++	read_unlock(&gr_inode_lock);
++
++	if (unlikely(retval == NULL)) {
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
++					  real_root->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++	}
++out:
++	spin_unlock(&dcache_lock);
++
++	return retval;
++}
++
++static void
++gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_sysctl(const char *path, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_id_change(const char type, const unsigned int real, 
++		       const unsigned int effective, const unsigned int fs)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       type, real, effective, fs, &task->signal->curr_ip);
++
++	return;
++}
++
++__u32
++gr_check_link(const struct dentry * new_dentry,
++	      const struct dentry * parent_dentry,
++	      const struct vfsmount * parent_mnt,
++	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
++{
++	struct acl_object_label *obj;
++	__u32 oldmode, newmode;
++	__u32 needmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (GR_CREATE | GR_LINK);
++
++	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
++	oldmode = obj->mode;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		oldmode |= (GR_CREATE | GR_LINK);
++
++	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID | GR_AUDIT_SETID;
++
++	newmode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    oldmode | needmode);
++
++	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
++			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
++			      GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
++		goto bad;
++
++	if ((oldmode & needmode) != needmode)
++		goto bad;
++
++	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
++	if ((newmode & needmode) != needmode)
++		goto bad;
++
++	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
++		return newmode;
++bad:
++	needmode = oldmode;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID;
++	
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		gr_log_learn(old_dentry, old_mnt, needmode);
++		return (GR_CREATE | GR_LINK);
++	} else if (newmode & GR_SUPPRESS)
++		return GR_SUPPRESS;
++	else
++		return 0;
++}
++
++__u32
++gr_search_file(const struct dentry * dentry, const __u32 mode,
++	       const struct vfsmount * mnt)
++{
++	__u32 retval = mode;
++	struct acl_subject_label *curracl;
++	struct acl_object_label *currobj;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	curracl = current->acl;
++
++	currobj = chk_obj_label(dentry, mnt, curracl);
++	retval = currobj->mode & mode;
++
++	if (unlikely
++	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
++	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		retval = new_mode;
++
++		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
++			new_mode |= GR_INHERIT;
++
++		if (!(mode & GR_NOLEARN))
++			gr_log_learn(dentry, mnt, new_mode);
++	}
++
++	return retval;
++}
++
++__u32
++gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
++		const struct vfsmount * mnt, const __u32 mode)
++{
++	struct name_entry *match;
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *curracl;
++	char *path;
++	__u32 retval;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	preempt_disable();
++	path = gr_to_filename_rbac(new_dentry, mnt);
++	match = lookup_name_entry_create(path);
++
++	if (!match)
++		goto check_parent;
++
++	curracl = current->acl;
++
++	read_lock(&gr_inode_lock);
++	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
++	read_unlock(&gr_inode_lock);
++
++	if (matchpo) {
++		if ((matchpo->mode & mode) !=
++		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
++		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++			__u32 new_mode = mode;
++
++			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++			gr_log_learn(new_dentry, mnt, new_mode);
++
++			preempt_enable();
++			return new_mode;
++		}
++		preempt_enable();
++		return (matchpo->mode & mode);
++	}
++
++      check_parent:
++	curracl = current->acl;
++
++	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
++	retval = matchpo->mode & mode;
++
++	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
++	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		gr_log_learn(new_dentry, mnt, new_mode);
++		preempt_enable();
++		return new_mode;
++	}
++
++	preempt_enable();
++	return retval;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY) || !task))
++		return 0;
++
++	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
++	    task->acl != current->acl)
++		return 1;
++
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	tsk->signal->used_accept = 0;
++	tsk->acl_sp_role = 0;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
++	tsk->signal->curr_ip = current->signal->curr_ip;
++	if (current->exec_file)
++		get_file(current->exec_file);
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
++	if (unlikely(current->signal->used_accept))
++		current->signal->curr_ip = 0;
++
++	return;
++}
++
++static void
++gr_set_proc_res(struct task_struct *task)
++{
++	struct acl_subject_label *proc;
++	unsigned short i;
++
++	proc = task->acl;
++
++	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
++		return;
++
++	for (i = 0; i < RLIM_NLIMITS; i++) {
++		if (!(proc->resmask & (1 << i)))
++			continue;
++
++		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
++		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
++	}
++
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	uid_t *uidlist;
++	int curuid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('u', real, effective, fs);
++
++	num = current->acl->user_trans_num;
++	uidlist = current->acl->user_transitions;
++
++	if (uidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->user_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				realok = 1;
++			if (effective == curuid)
++				effectiveok = 1;
++			if (fs == curuid)
++				fsok = 1;
++		}
++	} else if (current->acl->user_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				break;
++			if (effective == curuid)
++				break;
++			if (fs == curuid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	gid_t *gidlist;
++	int curgid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('g', real, effective, fs);
++
++	num = current->acl->group_trans_num;
++	gidlist = current->acl->group_transitions;
++
++	if (gidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->group_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				realok = 1;
++			if (effective == curgid)
++				effectiveok = 1;
++			if (fs == curgid)
++				fsok = 1;
++		}
++	} else if (current->acl->group_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				break;
++			if (effective == curgid)
++				break;
++			if (fs == curgid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++void
++gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
++{
++	struct acl_role_label *role = task->role;
++	struct acl_subject_label *subj = NULL;
++	struct acl_object_label *obj;
++	struct file *filp;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	filp = task->exec_file;
++
++	/* kernel process, we'll give them the kernel role */
++	if (unlikely(!filp)) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++		return;
++	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
++		role = lookup_acl_role_label(task, uid, gid);
++
++	/* perform subject lookup in possibly new role
++	   we can use this result below in the case where role == task->role
++	*/
++	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
++
++	/* if we changed uid/gid, but result in the same role
++	   and are using inheritance, don't lose the inherited subject
++	   if current subject is other than what normal lookup
++	   would result in, we arrived via inheritance, don't
++	   lose subject
++	*/
++	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
++				   (subj == task->acl)))
++		task->acl = subj;
++
++	task->role = role;
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++
++	gr_set_proc_res(task);
++
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	struct task_struct *task = current;
++	struct acl_subject_label *newacl;
++	struct acl_object_label *obj;
++	__u32 retmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	newacl = chk_subj_label(dentry, mnt, task->role);
++
++	task_lock(task);
++	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
++	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
++	     !(task->role->roletype & GR_ROLE_GOD) &&
++	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
++	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
++                task_unlock(task);
++		if (unsafe_share)
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
++		else
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
++		return -EACCES;
++	}
++	task_unlock(task);
++
++	obj = chk_obj_label(dentry, mnt, task->acl);
++	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (!(task->acl->mode & GR_INHERITLEARN) &&
++	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
++		if (obj->nested)
++			task->acl = obj->nested;
++		else
++			task->acl = newacl;
++	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
++		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(dentry, mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(dentry, mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++	gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++	return 0;
++}
++
++/* always called with valid inodev ptr */
++static void
++do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
++{
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *matchps;
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++
++	FOR_EACH_ROLE_START(role)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
++				matchpo->mode |= GR_DELETED;
++		FOR_EACH_SUBJECT_END(subj,x)
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if (subj->inode == ino && subj->device == dev)
++				subj->mode |= GR_DELETED;
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
++			matchps->mode |= GR_DELETED;
++	FOR_EACH_ROLE_END(role)
++
++	inodev->nentry->deleted = 1;
++
++	return;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	struct inodev_entry *inodev;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	write_lock(&gr_inode_lock);
++	inodev = lookup_inodev_entry(ino, dev);
++	if (inodev != NULL)
++		do_handle_delete(inodev, ino, dev);
++	write_unlock(&gr_inode_lock);
++
++	return;
++}
++
++static void
++update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
++		     const ino_t newinode, const dev_t newdevice,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			subj->obj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_obj_label(match, subj);
++	}
++
++	return;
++}
++
++static void
++update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
++		      const ino_t newinode, const dev_t newdevice,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			role->subj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_subj_label(match, role);
++	}
++
++	return;
++}
++
++static void
++update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
++		    const ino_t newinode, const dev_t newdevice)
++{
++	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != oldinode ||
++	       match->nentry->device != olddevice || !match->nentry->deleted))
++		match = match->next;
++
++	if (match && (match->nentry->inode == oldinode)
++	    && (match->nentry->device == olddevice) &&
++	    match->nentry->deleted) {
++		if (match->prev == NULL) {
++			inodev_set.i_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->nentry->inode = newinode;
++		match->nentry->device = newdevice;
++		match->nentry->deleted = 0;
++
++		insert_inodev_entry(match);
++	}
++
++	return;
++}
++
++static void
++do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
++		 const struct vfsmount *mnt)
++{
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++	
++	FOR_EACH_ROLE_START(role)
++		update_acl_subj_label(matchn->inode, matchn->device,
++				      dentry->d_inode->i_ino,
++				      dentry->d_inode->i_sb->s_dev, role);
++
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if ((subj->inode == dentry->d_inode->i_ino) &&
++			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
++				subj->inode = dentry->d_inode->i_ino;
++				subj->device = dentry->d_inode->i_sb->s_dev;
++			}
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			update_acl_obj_label(matchn->inode, matchn->device,
++					     dentry->d_inode->i_ino,
++					     dentry->d_inode->i_sb->s_dev, subj);
++		FOR_EACH_SUBJECT_END(subj,x)
++	FOR_EACH_ROLE_END(role)
++
++	update_inodev_entry(matchn->inode, matchn->device,
++			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
++
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	struct name_entry *matchn;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
++
++	if (unlikely((unsigned long)matchn)) {
++		write_lock(&gr_inode_lock);
++		do_handle_create(matchn, dentry, mnt);
++		write_unlock(&gr_inode_lock);
++	}
++	preempt_enable();
++
++	return;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	struct name_entry *matchn;
++	struct inodev_entry *inodev;
++
++	/* vfs_rename swaps the name and parent link for old_dentry and
++	   new_dentry
++	   at this point, old_dentry has the new name, parent link, and inode
++	   for the renamed file
++	   if a file is being replaced by a rename, new_dentry has the inode
++	   and name for the replaced file
++	*/
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
++
++	/* we wouldn't have to check d_inode if it weren't for
++	   NFS silly-renaming
++	 */
++
++	write_lock(&gr_inode_lock);
++	if (unlikely(replace && new_dentry->d_inode)) {
++		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
++					     new_dentry->d_inode->i_sb->s_dev);
++		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
++			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
++					 new_dentry->d_inode->i_sb->s_dev);
++	}
++
++	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
++				     old_dentry->d_inode->i_sb->s_dev);
++	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
++		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
++				 old_dentry->d_inode->i_sb->s_dev);
++
++	if (unlikely((unsigned long)matchn))
++		do_handle_create(matchn, old_dentry, mnt);
++
++	write_unlock(&gr_inode_lock);
++	preempt_enable();
++
++	return;
++}
++
++static int
++lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
++			 unsigned char **sum)
++{
++	struct acl_role_label *r;
++	struct role_allowed_ip *ipp;
++	struct role_transition *trans;
++	unsigned int i;
++	int found = 0;
++
++	/* check transition table */
++
++	for (trans = current->role->transitions; trans; trans = trans->next) {
++		if (!strcmp(rolename, trans->rolename)) {
++			found = 1;
++			break;
++		}
++	}
++
++	if (!found)
++		return 0;
++
++	/* handle special roles that do not require authentication
++	   and check ip */
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			found = 0;
++			if (r->allowed_ips != NULL) {
++				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
++					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
++					     (ntohl(ipp->addr) & ipp->netmask))
++						found = 1;
++				}
++			} else
++				found = 2;
++			if (!found)
++				return 0;
++
++			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
++			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
++				*salt = NULL;
++				*sum = NULL;
++				return 1;
++			}
++		}
++	FOR_EACH_ROLE_END(r)
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
++			*salt = acl_special_roles[i]->salt;
++			*sum = acl_special_roles[i]->sum;
++			return 1;
++		}
++	}
++
++	return 0;
++}
++
++static void
++assign_special_role(char *rolename)
++{
++	struct acl_object_label *obj;
++	struct acl_role_label *r;
++	struct acl_role_label *assigned = NULL;
++	struct task_struct *tsk;
++	struct file *filp;
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			assigned = r;
++			break;
++		}
++	FOR_EACH_ROLE_END(r)
++
++	if (!assigned)
++		return;
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++
++	tsk = current->parent;
++	if (tsk == NULL)
++		goto out_unlock;
++
++	filp = tsk->exec_file;
++	if (filp == NULL)
++		goto out_unlock;
++
++	tsk->is_writable = 0;
++
++	tsk->acl_sp_role = 1;
++	tsk->acl_role_id = ++acl_sp_role_value;
++	tsk->role = assigned;
++	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
++#endif
++
++out_unlock:
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	return;
++}
++
++int gr_check_secure_terminal(struct task_struct *task)
++{
++	struct task_struct *p, *p2, *p3;
++	struct files_struct *files;
++	struct fdtable *fdt;
++	struct file *our_file = NULL, *file;
++	int i;
++
++	if (task->signal->tty == NULL)
++		return 1;
++
++	files = get_files_struct(task);
++	if (files != NULL) {
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
++				get_file(file);
++				our_file = file;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	}
++
++	if (our_file == NULL)
++		return 1;
++
++	read_lock(&tasklist_lock);
++	do_each_thread(p2, p) {
++		files = get_files_struct(p);
++		if (files == NULL ||
++		    (p->signal && p->signal->tty == task->signal->tty)) {
++			if (files != NULL)
++				put_files_struct(files);
++			continue;
++		}
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
++			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
++				p3 = task;
++				while (p3->pid > 0) {
++					if (p3 == p)
++						break;
++					p3 = p3->parent;
++				}
++				if (p3 == p)
++					break;
++				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
++				gr_handle_alertkill(p);
++				rcu_read_unlock();
++				put_files_struct(files);
++				read_unlock(&tasklist_lock);
++				fput(our_file);
++				return 0;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	} while_each_thread(p2, p);
++	read_unlock(&tasklist_lock);
++
++	fput(our_file);
++	return 1;
++}
++
++ssize_t
++write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
++{
++	struct gr_arg_wrapper uwrap;
++	unsigned char *sprole_salt = NULL;
++	unsigned char *sprole_sum = NULL;
++	int error = sizeof (struct gr_arg_wrapper);
++	int error2 = 0;
++
++	down(&gr_dev_sem);
++
++	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
++		error = -EPERM;
++		goto out;
++	}
++
++	if (count != sizeof (struct gr_arg_wrapper)) {
++		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
++		error = -EINVAL;
++		goto out;
++	}
++
++	
++	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
++		gr_auth_expires = 0;
++		gr_auth_attempts = 0;
++	}
++
++	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
++		error = -EINVAL;
++		goto out;
++	}
++
++	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++	    time_after(gr_auth_expires, get_seconds())) {
++		error = -EBUSY;
++		goto out;
++	}
++
++	/* if non-root trying to do anything other than use a special role,
++	   do not attempt authentication, do not count towards authentication
++	   locking
++	 */
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
++	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    current_uid()) {
++		error = -EPERM;
++		goto out;
++	}
++
++	/* ensure pw and special role name are null terminated */
++
++	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
++	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
++
++	/* Okay. 
++	 * We have our enough of the argument structure..(we have yet
++	 * to copy_from_user the tables themselves) . Copy the tables
++	 * only if we need them, i.e. for loading operations. */
++
++	switch (gr_usermode->mode) {
++	case GR_STATUS:
++			if (gr_status & GR_READY) {
++				error = 1;
++				if (!gr_check_secure_terminal(current))
++					error = 3;
++			} else
++				error = 2;
++			goto out;
++	case GR_SHUTDOWN:
++		if ((gr_status & GR_READY)
++		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			free_variables();
++			memset(gr_usermode, 0, sizeof (struct gr_arg));
++			memset(gr_system_salt, 0, GR_SALT_LEN);
++			memset(gr_system_sum, 0, GR_SHA_LEN);
++		} else if (gr_status & GR_READY) {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
++			error = -EPERM;
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
++			error = -EAGAIN;
++		}
++		break;
++	case GR_ENABLE:
++		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
++		else {
++			if (gr_status & GR_READY)
++				error = -EAGAIN;
++			else
++				error = error2;
++			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
++		}
++		break;
++	case GR_RELOAD:
++		if (!(gr_status & GR_READY)) {
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
++			error = -EAGAIN;
++		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			lock_kernel();
++
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			free_variables();
++			if (!(error2 = gracl_init(gr_usermode))) {
++				unlock_kernel();
++				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
++			} else {
++				unlock_kernel();
++				error = error2;
++				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			}
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			error = -EPERM;
++		}
++		break;
++	case GR_SEGVMOD:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
++			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
++				struct acl_subject_label *segvacl;
++				segvacl =
++				    lookup_acl_subj_label(gr_usermode->segv_inode,
++							  gr_usermode->segv_device,
++							  current->role);
++				if (segvacl) {
++					segvacl->crashes = 0;
++					segvacl->expires = 0;
++				}
++			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
++				gr_remove_uid(gr_usermode->segv_uid);
++			}
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
++			error = -EPERM;
++		}
++		break;
++	case GR_SPROLE:
++	case GR_SPROLEPAM:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
++			current->role->expires = 0;
++			current->role->auth_attempts = 0;
++		}
++
++		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++		    time_after(current->role->expires, get_seconds())) {
++			error = -EBUSY;
++			goto out;
++		}
++
++		if (lookup_special_role_auth
++		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
++		    && ((!sprole_salt && !sprole_sum)
++			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
++			char *p = "";
++			assign_special_role(gr_usermode->sp_role);
++			read_lock(&tasklist_lock);
++			if (current->parent)
++				p = current->parent->role->rolename;
++			read_unlock(&tasklist_lock);
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
++					p, acl_sp_role_value);
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
++			error = -EPERM;
++			if(!(current->role->auth_attempts++))
++				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++			goto out;
++		}
++		break;
++	case GR_UNSPROLE:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->roletype & GR_ROLE_SPECIAL) {
++			char *p = "";
++			int i = 0;
++
++			read_lock(&tasklist_lock);
++			if (current->parent) {
++				p = current->parent->role->rolename;
++				i = current->parent->acl_role_id;
++			}
++			read_unlock(&tasklist_lock);
++
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
++			gr_set_acls(1);
++		} else {
++			error = -EPERM;
++			goto out;
++		}
++		break;
++	default:
++		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
++		error = -EINVAL;
++		break;
++	}
++
++	if (error != -EPERM)
++		goto out;
++
++	if(!(gr_auth_attempts++))
++		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++      out:
++	up(&gr_dev_sem);
++	return error;
++}
++
++int
++gr_set_acls(const int type)
++{
++	struct acl_object_label *obj;
++	struct task_struct *task, *task2;
++	struct file *filp;
++	struct acl_role_label *role = current->role;
++	__u16 acl_role_id = current->acl_role_id;
++	const struct cred *cred;
++	char *tmpname;
++	struct name_entry *nmatch;
++	struct acl_subject_label *tmpsubj;
++
++	rcu_read_lock();
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	do_each_thread(task2, task) {
++		/* check to see if we're called from the exit handler,
++		   if so, only replace ACLs that have inherited the admin
++		   ACL */
++
++		if (type && (task->role != role ||
++			     task->acl_role_id != acl_role_id))
++			continue;
++
++		task->acl_role_id = 0;
++		task->acl_sp_role = 0;
++
++		if ((filp = task->exec_file)) {
++			cred = __task_cred(task);
++			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
++
++			/* the following is to apply the correct subject 
++			   on binaries running when the RBAC system 
++			   is enabled, when the binaries have been 
++			   replaced or deleted since their execution
++			   -----
++			   when the RBAC system starts, the inode/dev
++			   from exec_file will be one the RBAC system
++			   is unaware of.  It only knows the inode/dev
++			   of the present file on disk, or the absence
++			   of it.
++			*/
++			preempt_disable();
++			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
++			
++			nmatch = lookup_name_entry(tmpname);
++			preempt_enable();
++			tmpsubj = NULL;
++			if (nmatch) {
++				if (nmatch->deleted)
++					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
++				else
++					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
++				if (tmpsubj != NULL)
++					task->acl = tmpsubj;
++			}
++			if (tmpsubj == NULL)
++				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
++							   task->role);
++			if (task->acl) {
++				struct acl_subject_label *curr;
++				curr = task->acl;
++
++				task->is_writable = 0;
++				/* ignore additional mmap checks for processes that are writable 
++				   by the default ACL */
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++
++				gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++			} else {
++				read_unlock(&grsec_exec_file_lock);
++				read_unlock(&tasklist_lock);
++				rcu_read_unlock();
++				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
++				return 1;
++			}
++		} else {
++			// it's a kernel process
++			task->role = kernel_role;
++			task->acl = kernel_role->root_label;
++#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
++			task->acl->mode &= ~GR_PROCFIND;
++#endif
++		}
++	} while_each_thread(task2, task);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
++
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	struct acl_subject_label *acl;
++	const struct cred *cred;
++
++	if (unlikely((gr_status & GR_READY) &&
++		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
++		goto skip_reslog;
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	gr_log_resource(task, res, wanted, gt);
++#endif
++      skip_reslog:
++
++	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
++		return;
++
++	acl = task->acl;
++
++	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
++		   !(acl->resmask & (1 << (unsigned short) res))))
++		return;
++
++	if (wanted >= acl->res[res].rlim_cur) {
++		unsigned long res_add;
++
++		res_add = wanted;
++		switch (res) {
++		case RLIMIT_CPU:
++			res_add += GR_RLIM_CPU_BUMP;
++			break;
++		case RLIMIT_FSIZE:
++			res_add += GR_RLIM_FSIZE_BUMP;
++			break;
++		case RLIMIT_DATA:
++			res_add += GR_RLIM_DATA_BUMP;
++			break;
++		case RLIMIT_STACK:
++			res_add += GR_RLIM_STACK_BUMP;
++			break;
++		case RLIMIT_CORE:
++			res_add += GR_RLIM_CORE_BUMP;
++			break;
++		case RLIMIT_RSS:
++			res_add += GR_RLIM_RSS_BUMP;
++			break;
++		case RLIMIT_NPROC:
++			res_add += GR_RLIM_NPROC_BUMP;
++			break;
++		case RLIMIT_NOFILE:
++			res_add += GR_RLIM_NOFILE_BUMP;
++			break;
++		case RLIMIT_MEMLOCK:
++			res_add += GR_RLIM_MEMLOCK_BUMP;
++			break;
++		case RLIMIT_AS:
++			res_add += GR_RLIM_AS_BUMP;
++			break;
++		case RLIMIT_LOCKS:
++			res_add += GR_RLIM_LOCKS_BUMP;
++			break;
++		case RLIMIT_SIGPENDING:
++			res_add += GR_RLIM_SIGPENDING_BUMP;
++			break;
++		case RLIMIT_MSGQUEUE:
++			res_add += GR_RLIM_MSGQUEUE_BUMP;
++			break;
++		case RLIMIT_NICE:
++			res_add += GR_RLIM_NICE_BUMP;
++			break;
++		case RLIMIT_RTPRIO:
++			res_add += GR_RLIM_RTPRIO_BUMP;
++			break;
++		case RLIMIT_RTTIME:
++			res_add += GR_RLIM_RTTIME_BUMP;
++			break;
++		}
++
++		acl->res[res].rlim_cur = res_add;
++
++		if (wanted > acl->res[res].rlim_max)
++			acl->res[res].rlim_max = res_add;
++
++		/* only log the subject filename, since resource logging is supported for
++		   single-subject learning only */
++		rcu_read_lock();
++		cred = __task_cred(task);
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid, cred->gid, acl->filename,
++			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
++			       "", (unsigned long) res, &task->signal->curr_ip);
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	struct task_struct *task = current;
++        struct acl_subject_label *proc;
++	unsigned long flags;
++
++        if (unlikely(!(gr_status & GR_READY)))
++                return;
++
++	flags = pax_get_flags(task);
++
++        proc = task->acl;
++
++	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
++		flags &= ~MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
++		flags &= ~MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
++		flags &= ~MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
++		flags &= ~MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
++		flags &= ~MF_PAX_MPROTECT;
++
++	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
++		flags |= MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
++		flags |= MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
++		flags |= MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
++		flags |= MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
++		flags |= MF_PAX_MPROTECT;
++
++	pax_set_flags(task, flags);
++
++        return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++/* Eric Biederman likes breaking userland ABI and every inode-based security
++   system to save 35kb of memory */
++
++/* we modify the passed in filename, but adjust it back before returning */
++static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
++{
++	struct name_entry *nmatch;
++	char *p, *lastp = NULL;
++	struct acl_object_label *obj = NULL, *tmp;
++	struct acl_subject_label *tmpsubj;
++	char c = '\0';
++
++	read_lock(&gr_inode_lock);
++
++	p = name + len - 1;
++	do {
++		nmatch = lookup_name_entry(name);
++		if (lastp != NULL)
++			*lastp = c;
++
++		if (nmatch == NULL)
++			goto next_component;
++		tmpsubj = current->acl;
++		do {
++			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
++			if (obj != NULL) {
++				tmp = obj->globbed;
++				while (tmp) {
++					if (!glob_match(tmp->filename, name)) {
++						obj = tmp;
++						goto found_obj;
++					}
++					tmp = tmp->next;
++				}
++				goto found_obj;
++			}
++		} while ((tmpsubj = tmpsubj->parent_subject));
++next_component:
++		/* end case */
++		if (p == name)
++			break;
++
++		while (*p != '/')
++			p--;
++		if (p == name)
++			lastp = p + 1;
++		else {
++			lastp = p;
++			p--;
++		}
++		c = *lastp;
++		*lastp = '\0';
++	} while (1);
++found_obj:
++	read_unlock(&gr_inode_lock);
++	/* obj returned will always be non-null */
++	return obj;
++}
++
++/* returns 0 when allowing, non-zero on error
++   op of 0 is used for readdir, so we don't log the names of hidden files
++*/
++__u32
++gr_handle_sysctl(const struct ctl_table *table, const int op)
++{
++	ctl_table *tmp;
++	const char *proc_sys = "/proc/sys";
++	char *path;
++	struct acl_object_label *obj;
++	unsigned short len = 0, pos = 0, depth = 0, i;
++	__u32 err = 0;
++	__u32 mode = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	/* for now, ignore operations on non-sysctl entries if it's not a
++	   readdir*/
++	if (table->child != NULL && op != 0)
++		return 0;
++
++	mode |= GR_FIND;
++	/* it's only a read if it's an entry, read on dirs is for readdir */
++	if (op & MAY_READ)
++		mode |= GR_READ;
++	if (op & MAY_WRITE)
++		mode |= GR_WRITE;
++
++	preempt_disable();
++
++	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
++
++	/* it's only a read/write if it's an actual entry, not a dir
++	   (which are opened for readdir)
++	*/
++
++	/* convert the requested sysctl entry into a pathname */
++
++	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++		len += strlen(tmp->procname);
++		len++;
++		depth++;
++	}
++
++	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
++		/* deny */
++		goto out;
++	}
++
++	memset(path, 0, PAGE_SIZE);
++
++	memcpy(path, proc_sys, strlen(proc_sys));
++
++	pos += strlen(proc_sys);
++
++	for (; depth > 0; depth--) {
++		path[pos] = '/';
++		pos++;
++		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++			if (depth == i) {
++				memcpy(path + pos, tmp->procname,
++				       strlen(tmp->procname));
++				pos += strlen(tmp->procname);
++			}
++			i++;
++		}
++	}
++
++	obj = gr_lookup_by_name(path, pos);
++	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
++
++	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
++		     ((err & mode) != mode))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		err = 0;
++		gr_log_learn_sysctl(path, new_mode);
++	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
++		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
++		err = -ENOENT;
++	} else if (!(err & GR_FIND)) {
++		err = -ENOENT;
++	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
++		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = -EACCES;
++	} else if ((err & mode) != mode) {
++		err = -EACCES;
++	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
++		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = 0;
++	} else
++		err = 0;
++
++      out:
++	preempt_enable();
++
++	return err;
++}
++#endif
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	struct file *filp;
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	filp = task->exec_file;
++
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 1;
++	}
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY)) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 0;
++	}
++#endif
++
++	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++
++	if (retmode & GR_NOPTRACE)
++		return 1;
++
++	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
++	    && (current->acl != task->acl || (current->acl != current->role->root_label
++	    && current->pid != task->pid)))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
++		read_unlock(&tasklist_lock);
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++	read_unlock(&tasklist_lock);
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY))
++		return 0;
++#endif
++
++	read_lock(&grsec_exec_file_lock);
++	if (unlikely(!task->exec_file)) {
++		read_unlock(&grsec_exec_file_lock);
++		return 0;
++	}
++
++	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++
++	if (retmode & GR_NOPTRACE) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++		
++	if (retmode & GR_PTRACERD) {
++		switch (request) {
++		case PTRACE_POKETEXT:
++		case PTRACE_POKEDATA:
++		case PTRACE_POKEUSR:
++#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
++		case PTRACE_SETREGS:
++		case PTRACE_SETFPREGS:
++#endif
++#ifdef CONFIG_X86
++		case PTRACE_SETFPXREGS:
++#endif
++#ifdef CONFIG_ALTIVEC
++		case PTRACE_SETVRREGS:
++#endif
++			return 1;
++		default:
++			return 0;
++		}
++	} else if (!(current->acl->mode & GR_POVERRIDE) &&
++		   !(current->role->roletype & GR_ROLE_GOD) &&
++		   (current->acl != task->acl)) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++
++	return 0;
++}
++
++static int is_writable_mmap(const struct file *filp)
++{
++	struct task_struct *task = current;
++	struct acl_object_label *obj, *obj2;
++
++	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
++	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
++		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
++				     task->role->root_label);
++		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
++			return 1;
++		}
++	}
++	return 0;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	unsigned long runtime;
++	unsigned long cputime;
++	unsigned int wday, cday;
++	__u8 whr, chr;
++	__u8 wmin, cmin;
++	__u8 wsec, csec;
++	struct timespec timeval;
++
++	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
++		     !(task->acl->mode & GR_PROCACCT)))
++		return;
++
++	do_posix_clock_monotonic_gettime(&timeval);
++	runtime = timeval.tv_sec - task->start_time.tv_sec;
++	wday = runtime / (3600 * 24);
++	runtime -= wday * (3600 * 24);
++	whr = runtime / 3600;
++	runtime -= whr * 3600;
++	wmin = runtime / 60;
++	runtime -= wmin * 60;
++	wsec = runtime;
++
++	cputime = (task->utime + task->stime) / HZ;
++	cday = cputime / (3600 * 24);
++	cputime -= cday * (3600 * 24);
++	chr = cputime / 3600;
++	cputime -= chr * 3600;
++	cmin = cputime / 60;
++	cputime -= cmin * 60;
++	csec = cputime;
++
++	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
++
++	return;
++}
++
++void gr_set_kernel_label(struct task_struct *task)
++{
++	if (gr_status & GR_READY) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++	}
++	return;
++}
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	struct task_struct *task;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred;
++#endif
++	int ret = 0;
++
++	/* restrict taskstats viewing to un-chrooted root users
++	   who have the 'view' subject flag if the RBAC system is enabled
++	*/
++
++	read_lock(&tasklist_lock);
++	task = find_task_by_vpid(pid);
++	if (task) {
++		gr_fs_read_lock(task);
++#ifdef CONFIG_GRKERNSEC_CHROOT
++		if (proc_is_chrooted(task))
++			ret = -EACCES;
++#endif
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		cred = __task_cred(task);
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		if (cred->uid != 0)
++			ret = -EACCES;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
++			ret = -EACCES;
++#endif
++#endif
++		if (gr_status & GR_READY) {
++			if (!(task->acl->mode & GR_VIEW))
++				ret = -EACCES;
++		}
++		
++		gr_fs_read_unlock(task);
++	} else
++		ret = -ENOENT;
++
++	read_unlock(&tasklist_lock);
++
++	return ret;
++}
++#endif
++
++int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
++{
++	struct task_struct *task = current;
++	struct dentry *dentry = file->f_path.dentry;
++	struct vfsmount *mnt = file->f_path.mnt;
++	struct acl_object_label *obj, *tmp;
++	struct acl_subject_label *subj;
++	unsigned int bufsize;
++	int is_not_root;
++	char *path;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 1;
++
++	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		return 1;
++
++	/* ignore Eric Biederman */
++	if (IS_PRIVATE(dentry->d_inode))
++		return 1;
++
++	subj = task->acl;
++	do {
++		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
++		if (obj != NULL)
++			return (obj->mode & GR_FIND) ? 1 : 0;
++	} while ((subj = subj->parent_subject));
++	
++	/* this is purely an optimization since we're looking for an object
++	   for the directory we're doing a readdir on
++	   if it's possible for any globbed object to match the entry we're
++	   filling into the directory, then the object we find here will be
++	   an anchor point with attached globbed objects
++	*/
++	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
++	if (obj->globbed == NULL)
++		return (obj->mode & GR_FIND) ? 1 : 0;
++
++	is_not_root = ((obj->filename[0] == '/') &&
++		   (obj->filename[1] == '\0')) ? 0 : 1;
++	bufsize = PAGE_SIZE - namelen - is_not_root;
++
++	/* check bufsize > PAGE_SIZE || bufsize == 0 */
++	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
++		return 1;
++
++	preempt_disable();
++	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   bufsize);
++
++	bufsize = strlen(path);
++
++	/* if base is "/", don't append an additional slash */
++	if (is_not_root)
++		*(path + bufsize) = '/';
++	memcpy(path + bufsize + is_not_root, name, namelen);
++	*(path + bufsize + namelen + is_not_root) = '\0';
++
++	tmp = obj->globbed;
++	while (tmp) {
++		if (!glob_match(tmp->filename, path)) {
++			preempt_enable();
++			return (tmp->mode & GR_FIND) ? 1 : 0;
++		}
++		tmp = tmp->next;
++	}
++	preempt_enable();
++	return (obj->mode & GR_FIND) ? 1 : 0;
++}
++
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
++
+diff -urNp linux-2.6.32.12/grsecurity/gracl_cap.c linux-2.6.32.12/grsecurity/gracl_cap.c
+--- linux-2.6.32.12/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_cap.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,131 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static const char *captab_log[] = {
++	"CAP_CHOWN",
++	"CAP_DAC_OVERRIDE",
++	"CAP_DAC_READ_SEARCH",
++	"CAP_FOWNER",
++	"CAP_FSETID",
++	"CAP_KILL",
++	"CAP_SETGID",
++	"CAP_SETUID",
++	"CAP_SETPCAP",
++	"CAP_LINUX_IMMUTABLE",
++	"CAP_NET_BIND_SERVICE",
++	"CAP_NET_BROADCAST",
++	"CAP_NET_ADMIN",
++	"CAP_NET_RAW",
++	"CAP_IPC_LOCK",
++	"CAP_IPC_OWNER",
++	"CAP_SYS_MODULE",
++	"CAP_SYS_RAWIO",
++	"CAP_SYS_CHROOT",
++	"CAP_SYS_PTRACE",
++	"CAP_SYS_PACCT",
++	"CAP_SYS_ADMIN",
++	"CAP_SYS_BOOT",
++	"CAP_SYS_NICE",
++	"CAP_SYS_RESOURCE",
++	"CAP_SYS_TIME",
++	"CAP_SYS_TTY_CONFIG",
++	"CAP_MKNOD",
++	"CAP_LEASE",
++	"CAP_AUDIT_WRITE",
++	"CAP_AUDIT_CONTROL",
++	"CAP_SETFCAP",
++	"CAP_MAC_OVERRIDE",
++	"CAP_MAC_ADMIN"
++};
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++
++int
++gr_is_capable(const int cap)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = task->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	curracl = task->acl;
++
++	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
++	    && cap_raised(cred->cap_effective, cap)) {
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid,
++			       cred->gid, task->exec_file ?
++			       gr_to_filename(task->exec_file->f_path.dentry,
++			       task->exec_file->f_path.mnt) : curracl->filename,
++			       curracl->filename, 0UL,
++			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
++		return 1;
++	}
++
++	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
++		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
++	return 0;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = current->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	return 0;
++}
++
+diff -urNp linux-2.6.32.12/grsecurity/gracl_fs.c linux-2.6.32.12/grsecurity/gracl_fs.c
+--- linux-2.6.32.12/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_fs.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,424 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/stat.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return GR_FIND;
++
++	mode =
++	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
++
++	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return mode;
++	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_FIND)))
++		return 0;
++
++	return GR_FIND;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	__u32 reqmode = GR_FIND;
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return reqmode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	else if (unlikely(fmode & FMODE_WRITE))
++		reqmode |= GR_WRITE;
++	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
++		reqmode &= ~GR_READ;
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
++		reqmode |= GR_SETID;
++
++	mode =
++	    gr_check_create(dentry, p_dentry, p_mnt,
++			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
++		     const int fmode)
++{
++	__u32 mode, reqmode = GR_FIND;
++
++	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
++		reqmode |= GR_EXEC;
++	if (fmode & S_IWOTH)
++		reqmode |= GR_WRITE;
++	if (fmode & S_IROTH)
++		reqmode |= GR_READ;
++
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		     mode_t mode)
++{
++	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
++		return 1;
++
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_FCHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		    mode_t mode)
++{
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_CHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
++			   GR_UNIXCONNECT_ACL_MSG);
++}
++
++/* hardlinks require at minimum create permission,
++   any additional privilege required is based on the
++   privilege of the file being linked to
++*/
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	__u32 mode;
++	__u32 needmode = GR_CREATE | GR_LINK;
++	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
++
++	mode =
++	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
++			  old_mnt);
++
++	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	__u32 needmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	mode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    GR_CREATE | GR_AUDIT_CREATE |
++			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
++
++	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
++		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return (GR_WRITE | GR_CREATE);
++}
++
++static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	if (unlikely(mode & (S_ISUID | S_ISGID)))
++		reqmode |= GR_SETID;
++
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  reqmode, GR_MKNOD_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry *new_dentry,
++		    const struct dentry *parent_dentry,
++		    const struct vfsmount *parent_mnt)
++{
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
++}
++
++#define RENAME_CHECK_SUCCESS(old, new) \
++	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
++	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
++
++int
++gr_acl_handle_rename(struct dentry *new_dentry,
++		     struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     struct dentry *old_dentry,
++		     struct inode *old_parent_inode,
++		     struct vfsmount *old_mnt, const char *newname)
++{
++	__u32 comp1, comp2;
++	int error = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (!new_dentry->d_inode) {
++		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
++					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
++					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
++		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
++				       GR_DELETE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, old_mnt);
++	} else {
++		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
++				       GR_CREATE | GR_DELETE |
++				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, parent_mnt);
++		comp2 =
++		    gr_search_file(old_dentry,
++				   GR_READ | GR_WRITE | GR_AUDIT_READ |
++				   GR_DELETE | GR_AUDIT_DELETE |
++				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
++	}
++
++	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
++	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
++		 && !(comp2 & GR_SUPPRESS)) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++		error = -EACCES;
++	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
++		error = -EACCES;
++
++	return error;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	u16 id;
++	char *rolename;
++	struct file *exec_file;
++
++	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
++		id = current->acl_role_id;
++		rolename = current->role->rolename;
++		gr_set_acls(1);
++		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
++	}
++
++	write_lock(&grsec_exec_file_lock);
++	exec_file = current->exec_file;
++	current->exec_file = NULL;
++	write_unlock(&grsec_exec_file_lock);
++
++	if (exec_file)
++		fput(exec_file);
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (task != current && task->acl->mode & GR_PROTPROCFD)
++		return -EACCES;
++
++	return 0;
++}
+diff -urNp linux-2.6.32.12/grsecurity/gracl_ip.c linux-2.6.32.12/grsecurity/gracl_ip.c
+--- linux-2.6.32.12/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_ip.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,339 @@
++#include <linux/kernel.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/skbuff.h>
++#include <linux/ip.h>
++#include <linux/udp.h>
++#include <linux/smp_lock.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/netdevice.h>
++#include <linux/inetdevice.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++#define GR_BIND			0x01
++#define GR_CONNECT		0x02
++#define GR_INVERT		0x04
++#define GR_BINDOVERRIDE		0x08
++#define GR_CONNECTOVERRIDE	0x10
++
++static const char * gr_protocols[256] = {
++	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
++	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
++	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
++	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
++	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
++	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
++	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
++	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
++	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
++	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
++	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
++	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
++	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
++	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
++	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
++	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
++	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
++	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
++	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
++	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
++	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
++	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
++	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
++	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
++	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
++	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
++	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
++	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
++	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
++	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
++	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
++	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
++	};
++
++static const char * gr_socktypes[11] = {
++	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
++	"unknown:7", "unknown:8", "unknown:9", "packet"
++	};
++
++const char *
++gr_proto_to_name(unsigned char proto)
++{
++	return gr_protocols[proto];
++}
++
++const char *
++gr_socktype_to_name(unsigned char type)
++{
++	return gr_socktypes[type];
++}
++
++int
++gr_search_socket(const int domain, const int type, const int protocol)
++{
++	struct acl_subject_label *curr;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled()))
++		goto exit;
++
++	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
++	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
++		goto exit;	// let the kernel handle it
++
++	curr = current->acl;
++
++	if (!curr->ips)
++		goto exit;
++
++	if ((curr->ip_type & (1 << type)) &&
++	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++		goto exit;
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		/* we don't place acls on raw sockets , and sometimes
++		   dgram/ip sockets are opened for ioctl and not
++		   bind/connect, so we'll fake a bind learn log */
++		if (type == SOCK_RAW || type == SOCK_PACKET) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_CONNECT, &current->signal->curr_ip);
++		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_BIND, &current->signal->curr_ip);
++		}
++		/* we'll log when they use connect or bind */
++		goto exit;
++	}
++
++	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
++		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
++
++	return 0;
++      exit:
++	return 1;
++}
++
++int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
++{
++	if ((ip->mode & mode) &&
++	    (ip_port >= ip->low) &&
++	    (ip_port <= ip->high) &&
++	    ((ntohl(ip_addr) & our_netmask) ==
++	     (ntohl(our_addr) & our_netmask))
++	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
++	    && (ip->type & (1 << type))) {
++		if (ip->mode & GR_INVERT)
++			return 2; // specifically denied
++		else
++			return 1; // allowed
++	}
++
++	return 0; // not specifically allowed, may continue parsing
++}
++
++static int
++gr_search_connectbind(const int full_mode, struct sock *sk,
++		      struct sockaddr_in *addr, const int type)
++{
++	char iface[IFNAMSIZ] = {0};
++	struct acl_subject_label *curr;
++	struct acl_ip_label *ip;
++	struct inet_sock *isk;
++	struct net_device *dev;
++	struct in_device *idev;
++	unsigned long i;
++	int ret;
++	int mode = full_mode & (GR_BIND | GR_CONNECT);
++	__u32 ip_addr = 0;
++	__u32 our_addr;
++	__u32 our_netmask;
++	char *p;
++	__u16 ip_port = 0;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
++		return 0;
++
++	curr = current->acl;
++	isk = inet_sk(sk);
++
++	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
++	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
++		addr->sin_addr.s_addr = curr->inaddr_any_override;
++	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
++		struct sockaddr_in saddr;
++		int err;
++
++		saddr.sin_family = AF_INET;
++		saddr.sin_addr.s_addr = curr->inaddr_any_override;
++		saddr.sin_port = isk->sport;
++
++		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++
++		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++	}
++
++	if (!curr->ips)
++		return 0;
++
++	ip_addr = addr->sin_addr.s_addr;
++	ip_port = ntohs(addr->sin_port);
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++			       current->role->roletype, cred->uid,
++			       cred->gid, current->exec_file ?
++			       gr_to_filename(current->exec_file->f_path.dentry,
++			       current->exec_file->f_path.mnt) :
++			       curr->filename, curr->filename,
++			       &ip_addr, ip_port, type,
++			       sk->sk_protocol, mode, &current->signal->curr_ip);
++		return 0;
++	}
++
++	for (i = 0; i < curr->ip_num; i++) {
++		ip = *(curr->ips + i);
++		if (ip->iface != NULL) {
++			strncpy(iface, ip->iface, IFNAMSIZ - 1);
++			p = strchr(iface, ':');
++			if (p != NULL)
++				*p = '\0';
++			dev = dev_get_by_name(sock_net(sk), iface);
++			if (dev == NULL)
++				continue;
++			idev = in_dev_get(dev);
++			if (idev == NULL) {
++				dev_put(dev);
++				continue;
++			}
++			rcu_read_lock();
++			for_ifa(idev) {
++				if (!strcmp(ip->iface, ifa->ifa_label)) {
++					our_addr = ifa->ifa_address;
++					our_netmask = 0xffffffff;
++					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++					if (ret == 1) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						return 0;
++					} else if (ret == 2) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						goto denied;
++					}
++				}
++			} endfor_ifa(idev);
++			rcu_read_unlock();
++			in_dev_put(idev);
++			dev_put(dev);
++		} else {
++			our_addr = ip->addr;
++			our_netmask = ip->netmask;
++			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++			if (ret == 1)
++				return 0;
++			else if (ret == 2)
++				goto denied;
++		}
++	}
++
++denied:
++	if (mode == GR_BIND)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++	else if (mode == GR_CONNECT)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++
++	return -EACCES;
++}
++
++int
++gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int
++gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int gr_search_listen(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int gr_search_accept(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int
++gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
++{
++	if (addr)
++		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
++	else {
++		struct sockaddr_in sin;
++		const struct inet_sock *inet = inet_sk(sk);
++
++		sin.sin_addr.s_addr = inet->daddr;
++		sin.sin_port = inet->dport;
++
++		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++	}
++}
++
++int
++gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
++{
++	struct sockaddr_in sin;
++
++	if (unlikely(skb->len < sizeof (struct udphdr)))
++		return 0;	// skip this packet
++
++	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
++	sin.sin_port = udp_hdr(skb)->source;
++
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++}
+diff -urNp linux-2.6.32.12/grsecurity/gracl_learn.c linux-2.6.32.12/grsecurity/gracl_learn.c
+--- linux-2.6.32.12/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_learn.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,211 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/poll.h>
++#include <linux/smp_lock.h>
++#include <linux/string.h>
++#include <linux/file.h>
++#include <linux/types.h>
++#include <linux/vmalloc.h>
++#include <linux/grinternal.h>
++
++extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
++				   size_t count, loff_t *ppos);
++extern int gr_acl_is_enabled(void);
++
++static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
++static int gr_learn_attached;
++
++/* use a 512k buffer */
++#define LEARN_BUFFER_SIZE (512 * 1024)
++
++static DEFINE_SPINLOCK(gr_learn_lock);
++static DECLARE_MUTEX(gr_learn_user_sem);
++
++/* we need to maintain two buffers, so that the kernel context of grlearn
++   uses a semaphore around the userspace copying, and the other kernel contexts
++   use a spinlock when copying into the buffer, since they cannot sleep
++*/
++static char *learn_buffer;
++static char *learn_buffer_user;
++static int learn_buffer_len;
++static int learn_buffer_user_len;
++
++static ssize_t
++read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
++{
++	DECLARE_WAITQUEUE(wait, current);
++	ssize_t retval = 0;
++
++	add_wait_queue(&learn_wait, &wait);
++	set_current_state(TASK_INTERRUPTIBLE);
++	do {
++		down(&gr_learn_user_sem);
++		spin_lock(&gr_learn_lock);
++		if (learn_buffer_len)
++			break;
++		spin_unlock(&gr_learn_lock);
++		up(&gr_learn_user_sem);
++		if (file->f_flags & O_NONBLOCK) {
++			retval = -EAGAIN;
++			goto out;
++		}
++		if (signal_pending(current)) {
++			retval = -ERESTARTSYS;
++			goto out;
++		}
++
++		schedule();
++	} while (1);
++
++	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
++	learn_buffer_user_len = learn_buffer_len;
++	retval = learn_buffer_len;
++	learn_buffer_len = 0;
++
++	spin_unlock(&gr_learn_lock);
++
++	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
++		retval = -EFAULT;
++
++	up(&gr_learn_user_sem);
++out:
++	set_current_state(TASK_RUNNING);
++	remove_wait_queue(&learn_wait, &wait);
++	return retval;
++}
++
++static unsigned int
++poll_learn(struct file * file, poll_table * wait)
++{
++	poll_wait(file, &learn_wait, wait);
++
++	if (learn_buffer_len)
++		return (POLLIN | POLLRDNORM);
++
++	return 0;
++}
++
++void
++gr_clear_learn_entries(void)
++{
++	char *tmp;
++
++	down(&gr_learn_user_sem);
++	if (learn_buffer != NULL) {
++		spin_lock(&gr_learn_lock);
++		tmp = learn_buffer;
++		learn_buffer = NULL;
++		spin_unlock(&gr_learn_lock);
++		vfree(learn_buffer);
++	}
++	if (learn_buffer_user != NULL) {
++		vfree(learn_buffer_user);
++		learn_buffer_user = NULL;
++	}
++	learn_buffer_len = 0;
++	up(&gr_learn_user_sem);
++
++	return;
++}
++
++void
++gr_add_learn_entry(const char *fmt, ...)
++{
++	va_list args;
++	unsigned int len;
++
++	if (!gr_learn_attached)
++		return;
++
++	spin_lock(&gr_learn_lock);
++
++	/* leave a gap at the end so we know when it's "full" but don't have to
++	   compute the exact length of the string we're trying to append
++	*/
++	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
++		spin_unlock(&gr_learn_lock);
++		wake_up_interruptible(&learn_wait);
++		return;
++	}
++	if (learn_buffer == NULL) {
++		spin_unlock(&gr_learn_lock);
++		return;
++	}
++
++	va_start(args, fmt);
++	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
++	va_end(args);
++
++	learn_buffer_len += len + 1;
++
++	spin_unlock(&gr_learn_lock);
++	wake_up_interruptible(&learn_wait);
++
++	return;
++}
++
++static int
++open_learn(struct inode *inode, struct file *file)
++{
++	if (file->f_mode & FMODE_READ && gr_learn_attached)
++		return -EBUSY;
++	if (file->f_mode & FMODE_READ) {
++		int retval = 0;
++		down(&gr_learn_user_sem);
++		if (learn_buffer == NULL)
++			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer_user == NULL)
++			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		if (learn_buffer_user == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 1;
++out_error:
++		up(&gr_learn_user_sem);
++		return retval;
++	}
++	return 0;
++}
++
++static int
++close_learn(struct inode *inode, struct file *file)
++{
++	char *tmp;
++
++	if (file->f_mode & FMODE_READ) {
++		down(&gr_learn_user_sem);
++		if (learn_buffer != NULL) {
++			spin_lock(&gr_learn_lock);
++			tmp = learn_buffer;
++			learn_buffer = NULL;
++			spin_unlock(&gr_learn_lock);
++			vfree(tmp);
++		}
++		if (learn_buffer_user != NULL) {
++			vfree(learn_buffer_user);
++			learn_buffer_user = NULL;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 0;
++		up(&gr_learn_user_sem);
++	}
++
++	return 0;
++}
++		
++const struct file_operations grsec_fops = {
++	.read		= read_learn,
++	.write		= write_grsec_handler,
++	.open		= open_learn,
++	.release	= close_learn,
++	.poll		= poll_learn,
++};
+diff -urNp linux-2.6.32.12/grsecurity/gracl_res.c linux-2.6.32.12/grsecurity/gracl_res.c
+--- linux-2.6.32.12/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_res.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grinternal.h>
++
++static const char *restab_log[] = {
++	[RLIMIT_CPU] = "RLIMIT_CPU",
++	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
++	[RLIMIT_DATA] = "RLIMIT_DATA",
++	[RLIMIT_STACK] = "RLIMIT_STACK",
++	[RLIMIT_CORE] = "RLIMIT_CORE",
++	[RLIMIT_RSS] = "RLIMIT_RSS",
++	[RLIMIT_NPROC] = "RLIMIT_NPROC",
++	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
++	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
++	[RLIMIT_AS] = "RLIMIT_AS",
++	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
++	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
++	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
++	[RLIMIT_NICE] = "RLIMIT_NICE",
++	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
++	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
++	[GR_CRASH_RES] = "RLIMIT_CRASH"
++};
++
++void
++gr_log_resource(const struct task_struct *task,
++		const int res, const unsigned long wanted, const int gt)
++{
++	const struct cred *cred;
++
++	if (!gr_acl_is_enabled() && !grsec_resource_logging)
++		return;
++
++	// not yet supported resource
++	if (!restab_log[res])
++		return;
++
++	rcu_read_lock();
++	cred = __task_cred(task);
++
++	if (res == RLIMIT_NPROC && 
++	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
++	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_MEMLOCK &&
++		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
++		goto out_rcu_unlock;
++	rcu_read_unlock();
++
++	preempt_disable();
++
++	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
++		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
++		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
++		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
++	preempt_enable_no_resched();
++
++	return;
++out_rcu_unlock:
++	rcu_read_unlock();
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/gracl_segv.c linux-2.6.32.12/grsecurity/gracl_segv.c
+--- linux-2.6.32.12/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_segv.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,310 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/timer.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static struct crash_uid *uid_set;
++static unsigned short uid_used;
++static DEFINE_SPINLOCK(gr_uid_lock);
++extern rwlock_t gr_inode_lock;
++extern struct acl_subject_label *
++	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
++			      struct acl_role_label *role);
++extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
++
++int
++gr_init_uidset(void)
++{
++	uid_set =
++	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
++	uid_used = 0;
++
++	return uid_set ? 1 : 0;
++}
++
++void
++gr_free_uidset(void)
++{
++	if (uid_set)
++		kfree(uid_set);
++
++	return;
++}
++
++int
++gr_find_uid(const uid_t uid)
++{
++	struct crash_uid *tmp = uid_set;
++	uid_t buid;
++	int low = 0, high = uid_used - 1, mid;
++
++	while (high >= low) {
++		mid = (low + high) >> 1;
++		buid = tmp[mid].uid;
++		if (buid == uid)
++			return mid;
++		if (buid > uid)
++			high = mid - 1;
++		if (buid < uid)
++			low = mid + 1;
++	}
++
++	return -1;
++}
++
++static __inline__ void
++gr_insertsort(void)
++{
++	unsigned short i, j;
++	struct crash_uid index;
++
++	for (i = 1; i < uid_used; i++) {
++		index = uid_set[i];
++		j = i;
++		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
++			uid_set[j] = uid_set[j - 1];
++			j--;
++		}
++		uid_set[j] = index;
++	}
++
++	return;
++}
++
++static __inline__ void
++gr_insert_uid(const uid_t uid, const unsigned long expires)
++{
++	int loc;
++
++	if (uid_used == GR_UIDTABLE_MAX)
++		return;
++
++	loc = gr_find_uid(uid);
++
++	if (loc >= 0) {
++		uid_set[loc].expires = expires;
++		return;
++	}
++
++	uid_set[uid_used].uid = uid;
++	uid_set[uid_used].expires = expires;
++	uid_used++;
++
++	gr_insertsort();
++
++	return;
++}
++
++void
++gr_remove_uid(const unsigned short loc)
++{
++	unsigned short i;
++
++	for (i = loc + 1; i < uid_used; i++)
++		uid_set[i - 1] = uid_set[i];
++
++	uid_used--;
++
++	return;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	int loc;
++	int ret = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	spin_lock(&gr_uid_lock);
++	loc = gr_find_uid(uid);
++
++	if (loc < 0)
++		goto out_unlock;
++
++	if (time_before_eq(uid_set[loc].expires, get_seconds()))
++		gr_remove_uid(loc);
++	else
++		ret = 1;
++
++out_unlock:
++	spin_unlock(&gr_uid_lock);
++	return ret;
++}
++
++static __inline__ int
++proc_is_setxid(const struct cred *cred)
++{
++	if (cred->uid != cred->euid || cred->uid != cred->suid ||
++	    cred->uid != cred->fsuid)
++		return 1;
++	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
++	    cred->gid != cred->fsgid)
++		return 1;
++
++	return 0;
++}
++static __inline__ int
++gr_fake_force_sig(int sig, struct task_struct *t)
++{
++	unsigned long int flags;
++	int ret, blocked, ignored;
++	struct k_sigaction *action;
++
++	spin_lock_irqsave(&t->sighand->siglock, flags);
++	action = &t->sighand->action[sig-1];
++	ignored = action->sa.sa_handler == SIG_IGN;
++	blocked = sigismember(&t->blocked, sig);
++	if (blocked || ignored) {
++		action->sa.sa_handler = SIG_DFL;
++		if (blocked) {
++			sigdelset(&t->blocked, sig);
++			recalc_sigpending_and_wake(t);
++		}
++	}
++	if (action->sa.sa_handler == SIG_DFL)
++		t->signal->flags &= ~SIGNAL_UNKILLABLE;
++	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
++
++	spin_unlock_irqrestore(&t->sighand->siglock, flags);
++
++	return ret;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	struct acl_subject_label *curr;
++	struct acl_subject_label *curr2;
++	struct task_struct *tsk, *tsk2;
++	const struct cred *cred;
++	const struct cred *cred2;
++
++	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
++		return;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curr = task->acl;
++
++	if (!(curr->resmask & (1 << GR_CRASH_RES)))
++		return;
++
++	if (time_before_eq(curr->expires, get_seconds())) {
++		curr->expires = 0;
++		curr->crashes = 0;
++	}
++
++	curr->crashes++;
++
++	if (!curr->expires)
++		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds())) {
++		rcu_read_lock();
++		cred = __task_cred(task);
++		if (cred->uid && proc_is_setxid(cred)) {
++			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			spin_lock(&gr_uid_lock);
++			gr_insert_uid(cred->uid, curr->expires);
++			spin_unlock(&gr_uid_lock);
++			curr->expires = 0;
++			curr->crashes = 0;
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				cred2 = __task_cred(tsk);
++				if (tsk != task && cred2->uid == cred->uid)
++					gr_fake_force_sig(SIGKILL, tsk);
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		} else {
++			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				if (likely(tsk != task)) {
++					curr2 = tsk->acl;
++
++					if (curr2->device == curr->device &&
++					    curr2->inode == curr->inode)
++						gr_fake_force_sig(SIGKILL, tsk);
++				}
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	struct acl_subject_label *curr;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	read_lock(&gr_inode_lock);
++	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
++				     filp->f_path.dentry->d_inode->i_sb->s_dev,
++				     current->role);
++	read_unlock(&gr_inode_lock);
++
++	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++	    (!curr->crashes && !curr->expires))
++		return 0;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds()))
++		return 1;
++	else if (time_before_eq(curr->expires, get_seconds())) {
++		curr->crashes = 0;
++		curr->expires = 0;
++	}
++
++	return 0;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	struct acl_subject_label *curracl;
++	__u32 curr_ip;
++	struct task_struct *p, *p2;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curracl = task->acl;
++	curr_ip = task->signal->curr_ip;
++
++	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
++		read_lock(&tasklist_lock);
++		do_each_thread(p2, p) {
++			if (p->signal->curr_ip == curr_ip)
++				gr_fake_force_sig(SIGKILL, p);
++		} while_each_thread(p2, p);
++		read_unlock(&tasklist_lock);
++	} else if (curracl->mode & GR_KILLPROC)
++		gr_fake_force_sig(SIGKILL, task);
++
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/gracl_shm.c linux-2.6.32.12/grsecurity/gracl_shm.c
+--- linux-2.6.32.12/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/gracl_shm.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,37 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/ipc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	struct task_struct *task;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	task = find_task_by_vpid(shm_cprid);
++
++	if (unlikely(!task))
++		task = find_task_by_vpid(shm_lapid);
++
++	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
++			      (task->pid == shm_lapid)) &&
++		     (task->acl->mode & GR_PROTSHM) &&
++		     (task->acl != current->acl))) {
++		read_unlock(&tasklist_lock);
++		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
++		return 0;
++	}
++	read_unlock(&tasklist_lock);
++
++	return 1;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_chdir.c linux-2.6.32.12/grsecurity/grsec_chdir.c
+--- linux-2.6.32.12/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_chdir.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,19 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	if ((grsec_enable_chdir && grsec_enable_group &&
++	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
++					      !grsec_enable_group)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
++	}
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_chroot.c linux-2.6.32.12/grsecurity/grsec_chroot.c
+--- linux-2.6.32.12/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_chroot.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,348 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/mount.h>
++#include <linux/types.h>
++#include <linux/pid_namespace.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_chroot_unix(const pid_t pid)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	struct pid *spid = NULL;
++
++	if (unlikely(!grsec_enable_chroot_unix))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	spid = find_vpid(pid);
++	if (spid) {
++		struct task_struct *p;
++		p = pid_task(spid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		if (unlikely(!have_same_root(current, p))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	}
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++int
++gr_handle_chroot_nice(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
++			&& proc_is_chrooted(current)) {
++		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
++	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++int
++gr_pid_is_chrooted(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
++		return 0;
++
++	gr_fs_read_lock(p);
++	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
++	    !have_same_root(current, p)) {
++		gr_fs_read_unlock(p);
++		return 1;
++	}
++	gr_fs_read_unlock(p);
++#endif
++	return 0;
++}
++
++EXPORT_SYMBOL(gr_pid_is_chrooted);
++
++#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
++int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
++{
++	struct dentry *dentry = (struct dentry *)u_dentry;
++	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
++	struct dentry *realroot;
++	struct vfsmount *realrootmnt;
++	struct dentry *currentroot;
++	struct vfsmount *currentmnt;
++	struct task_struct *reaper = &init_task;
++	int ret = 1;
++
++	read_lock(&reaper->fs->lock);
++	realrootmnt = mntget(reaper->fs->root.mnt);
++	realroot = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++
++	read_lock(&current->fs->lock);
++	currentmnt = mntget(current->fs->root.mnt);
++	currentroot = dget(current->fs->root.dentry);
++	read_unlock(&current->fs->lock);
++
++	spin_lock(&dcache_lock);
++	for (;;) {
++		if (unlikely((dentry == realroot && mnt == realrootmnt)
++		     || (dentry == currentroot && mnt == currentmnt)))
++			break;
++		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
++			if (mnt->mnt_parent == mnt)
++				break;
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++		dentry = dentry->d_parent;
++	}
++	spin_unlock(&dcache_lock);
++
++	dput(currentroot);
++	mntput(currentmnt);
++
++	/* access is outside of chroot */
++	if (dentry == realroot && mnt == realrootmnt)
++		ret = 0;
++
++	dput(realroot);
++	mntput(realrootmnt);
++	return ret;
++}
++#endif
++
++int
++gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	if (!grsec_enable_chroot_fchdir)
++		return 1;
++
++	if (!proc_is_chrooted(current))
++		return 1;
++	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
++		return 0;
++	}
++#endif
++	return 1;
++}
++
++int
++gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	struct pid *pid = NULL;
++	time_t starttime;
++
++	if (unlikely(!grsec_enable_chroot_shmat))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	pid = find_vpid(shm_cprid);
++	if (pid) {
++		struct task_struct *p;
++		p = pid_task(pid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		starttime = p->start_time.tv_sec;
++		if (unlikely(!have_same_root(current, p) &&
++			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	} else {
++		pid = find_vpid(shm_lapid);
++		if (pid) {
++			struct task_struct *p;
++			p = pid_task(pid, PIDTYPE_PID);
++			gr_fs_read_lock(p);
++			if (unlikely(!have_same_root(current, p))) {
++				gr_fs_read_unlock(p);
++				read_unlock(&tasklist_lock);
++				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++				return 0;
++			}
++			gr_fs_read_unlock(p);
++		}
++	}
++
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++void
++gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
++		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_mknod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_mount(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const char *dev_name)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
++		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_pivot(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
++	    !gr_is_outside_chroot(dentry, mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_caps(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
++		(init_task.fs->root.dentry != path->dentry) &&
++		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
++
++		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
++		const struct cred *old = current_cred();
++		struct cred *new = prepare_creds();
++		if (new == NULL)
++			return 1;
++
++		new->cap_permitted = cap_drop(old->cap_permitted, 
++					      chroot_caps);
++		new->cap_inheritable = cap_drop(old->cap_inheritable, 
++						chroot_caps);
++		new->cap_effective = cap_drop(old->cap_effective,
++					      chroot_caps);
++
++		commit_creds(new);
++
++		return 0;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_sysctl(const int op)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
++	    && (op & MAY_WRITE))
++		return -EACCES;
++#endif
++	return 0;
++}
++
++void
++gr_handle_chroot_chdir(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	if (grsec_enable_chroot_chdir)
++		set_fs_pwd(current->fs, path);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_chmod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	if (grsec_enable_chroot_chmod &&
++	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_handle_chroot_caps);
++#endif
+diff -urNp linux-2.6.32.12/grsecurity/grsec_disabled.c linux-2.6.32.12/grsecurity/grsec_disabled.c
+--- linux-2.6.32.12/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_disabled.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,426 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kdev_t.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <linux/skbuff.h>
++#include <linux/sysctl.h>
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++__u32
++gr_handle_sysctl(const struct ctl_table * table, const int op)
++{
++	return 0;
++}
++#endif
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	return 0;
++}
++#endif
++
++int
++gr_acl_is_enabled(void)
++{
++	return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++	return 0;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	return;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	return 0;
++}
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	return;
++}
++
++int
++gr_set_acls(const int type)
++{
++	return 0;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *tsk)
++{
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	return;
++}
++
++void
++gr_set_pax_flags(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	return 0;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	return 0;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	return 0;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	return;
++}
++
++int
++gr_search_socket(const int family, const int type, const int protocol)
++{
++	return 1;
++}
++
++int
++gr_search_connectbind(const int mode, const struct socket *sock,
++		      const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_is_capable(const int cap)
++{
++	return 1;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	return 1;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
++		   unsigned int *vm_flags)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry * dentry,
++		       const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry,
++		     const struct vfsmount * mnt, const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		     mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		    mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++void
++grsecurity_init(void)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_rename(const struct dentry *new_dentry,
++		     const struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     const struct dentry *old_dentry,
++		     const struct inode *old_parent_inode,
++		     const struct vfsmount *old_mnt, const char *newname)
++{
++	return 0;
++}
++
++int
++gr_acl_handle_filldir(const struct file *file, const char *name,
++		      const int namelen, const ino_t ino)
++{
++	return 1;
++}
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	return 1;
++}
++
++int
++gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_search_accept(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_listen(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	return 1;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	return;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	return 1;
++}
++
++void
++gr_set_role_label(const uid_t uid, const gid_t gid)
++{
++	return;
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	return 0;
++}
++
++int
++gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
++{
++	return 0;
++}
++
++int
++gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++void
++gr_set_kernel_label(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
+diff -urNp linux-2.6.32.12/grsecurity/grsec_exec.c linux-2.6.32.12/grsecurity/grsec_exec.c
+--- linux-2.6.32.12/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_exec.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,89 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/binfmts.h>
++#include <linux/smp_lock.h>
++#include <linux/fs.h>
++#include <linux/types.h>
++#include <linux/grdefs.h>
++#include <linux/grinternal.h>
++#include <linux/capability.h>
++
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++static char gr_exec_arg_buf[132];
++static DECLARE_MUTEX(gr_exec_arg_sem);
++#endif
++
++int
++gr_handle_nproc(void)
++{
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	const struct cred *cred = current_cred();
++	if (grsec_enable_execve && cred->user &&
++	    (atomic_read(&cred->user->processes) >
++	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
++	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
++		return -EAGAIN;
++	}
++#endif
++	return 0;
++}
++
++void
++gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
++{
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	char *grarg = gr_exec_arg_buf;
++	unsigned int i, x, execlen = 0;
++	char c;
++
++	if (!((grsec_enable_execlog && grsec_enable_group &&
++	       in_group_p(grsec_audit_gid))
++	      || (grsec_enable_execlog && !grsec_enable_group)))
++		return;
++
++	down(&gr_exec_arg_sem);
++	memset(grarg, 0, sizeof(gr_exec_arg_buf));
++
++	if (unlikely(argv == NULL))
++		goto log;
++
++	for (i = 0; i < bprm->argc && execlen < 128; i++) {
++		const char __user *p;
++		unsigned int len;
++
++		if (copy_from_user(&p, argv + i, sizeof(p)))
++			goto log;
++		if (!p)
++			goto log;
++		len = strnlen_user(p, 128 - execlen);
++		if (len > 128 - execlen)
++			len = 128 - execlen;
++		else if (len > 0)
++			len--;
++		if (copy_from_user(grarg + execlen, p, len))
++			goto log;
++
++		/* rewrite unprintable characters */
++		for (x = 0; x < len; x++) {
++			c = *(grarg + execlen + x);
++			if (c < 32 || c > 126)
++				*(grarg + execlen + x) = ' ';
++		}
++
++		execlen += len;
++		*(grarg + execlen) = ' ';
++		*(grarg + execlen + 1) = '\0';
++		execlen++;
++	}
++
++      log:
++	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
++			bprm->file->f_path.mnt, grarg);
++	up(&gr_exec_arg_sem);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_fifo.c linux-2.6.32.12/grsecurity/grsec_fifo.c
+--- linux-2.6.32.12/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_fifo.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,24 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
++	       const struct dentry *dir, const int flag, const int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_FIFO
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
++	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
++	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
++	    (cred->fsuid != dentry->d_inode->i_uid)) {
++		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
++			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_fork.c linux-2.6.32.12/grsecurity/grsec_fork.c
+--- linux-2.6.32.12/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_fork.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,15 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/errno.h>
++
++void
++gr_log_forkfail(const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
++		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_init.c linux-2.6.32.12/grsecurity/grsec_init.c
+--- linux-2.6.32.12/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_init.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,241 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/smp_lock.h>
++#include <linux/gracl.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/percpu.h>
++
++int grsec_enable_link;
++int grsec_enable_dmesg;
++int grsec_enable_harden_ptrace;
++int grsec_enable_fifo;
++int grsec_enable_execve;
++int grsec_enable_execlog;
++int grsec_enable_signal;
++int grsec_enable_forkfail;
++int grsec_enable_audit_ptrace;
++int grsec_enable_time;
++int grsec_enable_audit_textrel;
++int grsec_enable_group;
++int grsec_audit_gid;
++int grsec_enable_chdir;
++int grsec_enable_mount;
++int grsec_enable_rofs;
++int grsec_enable_chroot_findtask;
++int grsec_enable_chroot_mount;
++int grsec_enable_chroot_shmat;
++int grsec_enable_chroot_fchdir;
++int grsec_enable_chroot_double;
++int grsec_enable_chroot_pivot;
++int grsec_enable_chroot_chdir;
++int grsec_enable_chroot_chmod;
++int grsec_enable_chroot_mknod;
++int grsec_enable_chroot_nice;
++int grsec_enable_chroot_execlog;
++int grsec_enable_chroot_caps;
++int grsec_enable_chroot_sysctl;
++int grsec_enable_chroot_unix;
++int grsec_enable_tpe;
++int grsec_tpe_gid;
++int grsec_enable_blackhole;
++int grsec_lastack_retries;
++int grsec_enable_tpe_all;
++int grsec_enable_socket_all;
++int grsec_socket_all_gid;
++int grsec_enable_socket_client;
++int grsec_socket_client_gid;
++int grsec_enable_socket_server;
++int grsec_socket_server_gid;
++int grsec_resource_logging;
++int grsec_lock;
++
++DEFINE_SPINLOCK(grsec_alert_lock);
++unsigned long grsec_alert_wtime = 0;
++unsigned long grsec_alert_fyet = 0;
++
++DEFINE_SPINLOCK(grsec_audit_lock);
++
++DEFINE_RWLOCK(grsec_exec_file_lock);
++
++char *gr_shared_page[4];
++
++char *gr_alert_log_fmt;
++char *gr_audit_log_fmt;
++char *gr_alert_log_buf;
++char *gr_audit_log_buf;
++
++extern struct gr_arg *gr_usermode;
++extern unsigned char *gr_system_salt;
++extern unsigned char *gr_system_sum;
++
++void __init
++grsecurity_init(void)
++{
++	int j;
++	/* create the per-cpu shared pages */
++
++#ifdef CONFIG_X86
++	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
++#endif
++
++	for (j = 0; j < 4; j++) {
++		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
++		if (gr_shared_page[j] == NULL) {
++			panic("Unable to allocate grsecurity shared page");
++			return;
++		}
++	}
++
++	/* allocate log buffers */
++	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_alert_log_fmt) {
++		panic("Unable to allocate grsecurity alert log format buffer");
++		return;
++	}
++	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_audit_log_fmt) {
++		panic("Unable to allocate grsecurity audit log format buffer");
++		return;
++	}
++	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_alert_log_buf) {
++		panic("Unable to allocate grsecurity alert log buffer");
++		return;
++	}
++	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_audit_log_buf) {
++		panic("Unable to allocate grsecurity audit log buffer");
++		return;
++	}
++
++	/* allocate memory for authentication structure */
++	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
++	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
++	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
++
++	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
++		panic("Unable to allocate grsecurity authentication structure");
++		return;
++	}
++
++#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
++#ifndef CONFIG_GRKERNSEC_SYSCTL
++	grsec_lock = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	grsec_enable_audit_textrel = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	grsec_enable_group = 1;
++	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	grsec_enable_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	grsec_enable_harden_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	grsec_enable_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_LINK
++	grsec_enable_link = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	grsec_enable_dmesg = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	grsec_enable_blackhole = 1;
++	grsec_lastack_retries = 4;
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	grsec_enable_fifo = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	grsec_enable_execve = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	grsec_enable_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	grsec_enable_signal = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	grsec_enable_forkfail = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	grsec_enable_time = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	grsec_resource_logging = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	grsec_enable_chroot_findtask = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	grsec_enable_chroot_unix = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	grsec_enable_chroot_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	grsec_enable_chroot_fchdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	grsec_enable_chroot_shmat = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	grsec_enable_audit_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	grsec_enable_chroot_double = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	grsec_enable_chroot_pivot = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	grsec_enable_chroot_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	grsec_enable_chroot_chmod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	grsec_enable_chroot_mknod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	grsec_enable_chroot_nice = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	grsec_enable_chroot_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	grsec_enable_chroot_caps = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	grsec_enable_chroot_sysctl = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	grsec_enable_tpe = 1;
++	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	grsec_enable_tpe_all = 1;
++#endif
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	grsec_enable_socket_all = 1;
++	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	grsec_enable_socket_client = 1;
++	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	grsec_enable_socket_server = 1;
++	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
++#endif
++#endif
++
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_link.c linux-2.6.32.12/grsecurity/grsec_link.c
+--- linux-2.6.32.12/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_link.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,43 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_follow_link(const struct inode *parent,
++		      const struct inode *inode,
++		      const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
++	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
++	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
++		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_hardlink(const struct dentry *dentry,
++		   const struct vfsmount *mnt,
++		   struct inode *inode, const int mode, const char *to)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
++	    (!S_ISREG(mode) || (mode & S_ISUID) ||
++	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
++	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
++	    !capable(CAP_FOWNER) && cred->uid) {
++		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_log.c linux-2.6.32.12/grsecurity/grsec_log.c
+--- linux-2.6.32.12/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_log.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,296 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/tty.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++#define BEGIN_LOCKS(x) \
++	rcu_read_lock(); \
++	read_lock(&tasklist_lock); \
++	read_lock(&grsec_exec_file_lock); \
++	if (x != GR_DO_AUDIT) \
++		spin_lock(&grsec_alert_lock); \
++	else \
++		spin_lock(&grsec_audit_lock)
++
++#define END_LOCKS(x) \
++	if (x != GR_DO_AUDIT) \
++		spin_unlock(&grsec_alert_lock); \
++	else \
++		spin_unlock(&grsec_audit_lock); \
++	read_unlock(&grsec_exec_file_lock); \
++	read_unlock(&tasklist_lock); \
++	rcu_read_unlock(); \
++	if (x == GR_DONT_AUDIT) \
++		gr_handle_alertkill(current)
++
++enum {
++	FLOODING,
++	NO_FLOODING
++};
++
++extern char *gr_alert_log_fmt;
++extern char *gr_audit_log_fmt;
++extern char *gr_alert_log_buf;
++extern char *gr_audit_log_buf;
++
++static int gr_log_start(int audit)
++{
++	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
++	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++
++	if (audit == GR_DO_AUDIT)
++		goto set_fmt;
++
++	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet = 0;
++	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
++		grsec_alert_fyet++;
++	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet++;
++		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
++		return FLOODING;
++	} else return FLOODING;
++
++set_fmt:
++	memset(buf, 0, PAGE_SIZE);
++	if (current->signal->curr_ip && gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else if (current->signal->curr_ip) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
++	} else if (gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else {
++		sprintf(fmt, "%s%s", loglevel, "grsec: ");
++		strcpy(buf, fmt);
++	}
++
++	return NO_FLOODING;
++}
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++	__attribute__ ((format (printf, 2, 0)));
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++
++	return;
++}
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++	__attribute__ ((format (printf, 2, 3)));
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++	va_list ap;
++
++	va_start(ap, msg);
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++	va_end(ap);
++
++	return;
++}
++
++static void gr_log_end(int audit)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
++	printk("%s\n", buf);
++
++	return;
++}
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
++{
++	int logtype;
++	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
++	char *str1, *str2, *str3;
++	void *voidptr;
++	int num1, num2;
++	unsigned long ulong1, ulong2;
++	struct dentry *dentry;
++	struct vfsmount *mnt;
++	struct file *file;
++	struct task_struct *task;
++	const struct cred *cred, *pcred;
++	va_list ap;
++
++	BEGIN_LOCKS(audit);
++	logtype = gr_log_start(audit);
++	if (logtype == FLOODING) {
++		END_LOCKS(audit);
++		return;
++	}
++	va_start(ap, argtypes);
++	switch (argtypes) {
++	case GR_TTYSNIFF:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
++		break;
++	case GR_SYSCTL_HIDDEN:
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, str1);
++		break;
++	case GR_RBAC:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_STR_RBAC:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_MODE2:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
++		break;
++	case GR_RBAC_MODE3:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		str3 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
++		break;
++	case GR_FILENAME:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
++		break;
++	case GR_STR_FILENAME:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_FILENAME_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_FILENAME_TWO_INT:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
++		break;
++	case GR_FILENAME_TWO_INT_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
++		break;
++	case GR_TEXTREL:
++		file = va_arg(ap, struct file *);
++		ulong1 = va_arg(ap, unsigned long);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
++		break;
++	case GR_PTRACE:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
++		break;
++	case GR_RESOURCE:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		str1 = va_arg(ap, char *);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CAP:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_SIG:
++		str1 = va_arg(ap, char *);
++		voidptr = va_arg(ap, void *);
++		gr_log_middle_varargs(audit, msg, str1, voidptr);
++		break;
++	case GR_SIG2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		num1 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CRASH1:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
++		break;
++	case GR_CRASH2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
++		break;
++	case GR_PSACCT:
++		{
++			unsigned int wday, cday;
++			__u8 whr, chr;
++			__u8 wmin, cmin;
++			__u8 wsec, csec;
++			char cur_tty[64] = { 0 };
++			char parent_tty[64] = { 0 };
++
++			task = va_arg(ap, struct task_struct *);
++			wday = va_arg(ap, unsigned int);
++			cday = va_arg(ap, unsigned int);
++			whr = va_arg(ap, int);
++			chr = va_arg(ap, int);
++			wmin = va_arg(ap, int);
++			cmin = va_arg(ap, int);
++			wsec = va_arg(ap, int);
++			csec = va_arg(ap, int);
++			ulong1 = va_arg(ap, unsigned long);
++			cred = __task_cred(task);
++			pcred = __task_cred(task->parent);
++
++			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		}
++		break;
++	default:
++		gr_log_middle(audit, msg, ap);
++	}
++	va_end(ap);
++	gr_log_end(audit);
++	END_LOCKS(audit);
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_mem.c linux-2.6.32.12/grsecurity/grsec_mem.c
+--- linux-2.6.32.12/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_mem.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,85 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/mman.h>
++#include <linux/grinternal.h>
++
++void
++gr_handle_ioperm(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
++	return;
++}
++
++void
++gr_handle_iopl(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
++	return;
++}
++
++void
++gr_handle_mem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
++	return;
++}
++
++void
++gr_handle_kmem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
++	return;
++}
++
++void
++gr_handle_open_port(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
++	return;
++}
++
++int
++gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
++{
++	unsigned long start, end;
++
++	start = offset;
++	end = start + vma->vm_end - vma->vm_start;
++
++	if (start > end) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	}
++
++	/* allowed ranges : ISA I/O BIOS */
++	if ((start >= __pa(high_memory))
++#if defined(CONFIG_X86) || defined(CONFIG_PPC)
++	    || (start >= 0x000a0000 && end <= 0x00100000)
++	    || (start >= 0x00000000 && end <= 0x00001000)
++#endif
++	)
++		return 0;
++
++	if (vma->vm_flags & VM_WRITE) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	} else
++		vma->vm_flags &= ~VM_MAYWRITE;
++
++	return 0;
++}
++
++void
++gr_log_nonroot_mod_load(const char *modname)
++{
++        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
++        return;
++}
++
++void
++gr_handle_vm86(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_mount.c linux-2.6.32.12/grsecurity/grsec_mount.c
+--- linux-2.6.32.12/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_mount.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,62 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mount.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_remount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_unmount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_mount(const char *from, const char *to, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
++#endif
++	return;
++}
++
++int
++gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
++
++int
++gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
++	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_ptrace.c linux-2.6.32.12/grsecurity/grsec_ptrace.c
+--- linux-2.6.32.12/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_ptrace.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,14 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_audit_ptrace(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	if (grsec_enable_audit_ptrace)
++		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_sig.c linux-2.6.32.12/grsecurity/grsec_sig.c
+--- linux-2.6.32.12/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_sig.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++char *signames[] = {
++	[SIGSEGV] = "Segmentation fault",
++	[SIGILL] = "Illegal instruction",
++	[SIGABRT] = "Abort",
++	[SIGBUS] = "Invalid alignment/Bus error"
++};
++
++void
++gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
++{
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
++				    (sig == SIGABRT) || (sig == SIGBUS))) {
++		if (t->pid == current->pid) {
++			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
++		} else {
++			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
++		}
++	}
++#endif
++	return;
++}
++
++int
++gr_handle_signal(const struct task_struct *p, const int sig)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (current->pid > 1 && gr_check_protected_task(p)) {
++		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
++		return -EPERM;
++	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++void gr_handle_brute_attach(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	if (p->parent && p->parent->exec_file == p->exec_file)
++		p->parent->brute = 1;
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++#endif
++	return;
++}
++
++void gr_handle_brute_check(void)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	if (current->brute)
++		msleep(30 * 1000);
++#endif
++	return;
++}
++
+diff -urNp linux-2.6.32.12/grsecurity/grsec_sock.c linux-2.6.32.12/grsecurity/grsec_sock.c
+--- linux-2.6.32.12/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_sock.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,271 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <net/sock.h>
++#include <net/inet_sock.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
++EXPORT_SYMBOL(gr_cap_rtnetlink);
++
++extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
++
++EXPORT_SYMBOL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL(gr_search_udp_sendmsg);
++
++#ifdef CONFIG_UNIX_MODULE
++EXPORT_SYMBOL(gr_acl_handle_unix);
++EXPORT_SYMBOL(gr_acl_handle_mknod);
++EXPORT_SYMBOL(gr_handle_chroot_unix);
++EXPORT_SYMBOL(gr_handle_create);
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define gr_conn_table_size 32749
++struct conn_table_entry {
++	struct conn_table_entry *next;
++	struct signal_struct *sig;
++};
++
++struct conn_table_entry *gr_conn_table[gr_conn_table_size];
++DEFINE_SPINLOCK(gr_conn_table_lock);
++
++extern const char * gr_socktype_to_name(unsigned char type);
++extern const char * gr_proto_to_name(unsigned char proto);
++
++static __inline__ int 
++conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
++{
++	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
++}
++
++static __inline__ int
++conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
++	   __u16 sport, __u16 dport)
++{
++	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
++		     sig->gr_sport == sport && sig->gr_dport == dport))
++		return 1;
++	else
++		return 0;
++}
++
++static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
++{
++	struct conn_table_entry **match;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	newent->sig = sig;
++	
++	match = &gr_conn_table[index];
++	newent->next = *match;
++	*match = newent;
++
++	return;
++}
++
++static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
++{
++	struct conn_table_entry *match, *last = NULL;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, 
++		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
++		sig->gr_dport)) {
++		last = match;
++		match = match->next;
++	}
++
++	if (match) {
++		if (last)
++			last->next = match->next;
++		else
++			gr_conn_table[index] = NULL;
++		kfree(match);
++	}
++
++	return;
++}
++
++static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
++					     __u16 sport, __u16 dport)
++{
++	struct conn_table_entry *match;
++	unsigned int index;
++
++	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
++		match = match->next;
++
++	if (match)
++		return match->sig;
++	else
++		return NULL;
++}
++
++#endif
++
++void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *sig = task->signal;
++	struct conn_table_entry *newent;
++
++	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
++	if (newent == NULL)
++		return;
++	/* no bh lock needed since we are called with bh disabled */
++	spin_lock(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(sig);
++	sig->gr_saddr = inet->rcv_saddr;
++	sig->gr_daddr = inet->daddr;
++	sig->gr_sport = inet->sport;
++	sig->gr_dport = inet->dport;
++	gr_add_to_task_ip_table_nolock(sig, newent);
++	spin_unlock(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void gr_del_task_from_ip_table(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC
++	spin_lock_bh(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(task->signal);
++	spin_unlock_bh(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void
++gr_attach_curr_ip(const struct sock *sk)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *p, *set;
++	const struct inet_sock *inet = inet_sk(sk);	
++
++	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
++		return;
++
++	set = current->signal;
++
++	spin_lock_bh(&gr_conn_table_lock);
++	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
++				    inet->dport, inet->sport);
++	if (unlikely(p != NULL)) {
++		set->curr_ip = p->curr_ip;
++		set->used_accept = 1;
++		gr_del_task_from_ip_table_nolock(p);
++		spin_unlock_bh(&gr_conn_table_lock);
++		return;
++	}
++	spin_unlock_bh(&gr_conn_table_lock);
++
++	set->curr_ip = inet->daddr;
++	set->used_accept = 1;
++#endif
++	return;
++}
++
++int
++gr_handle_sock_all(const int family, const int type, const int protocol)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
++	    (family != AF_UNIX) && (family != AF_LOCAL)) {
++		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server_other(const struct sock *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sk_family != AF_UNIX) &&
++	    (sck->sk_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_client(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++kernel_cap_t
++gr_cap_rtnetlink(struct sock *sock)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_acl_is_enabled())
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_ISCSI &&
++		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
++		 gr_is_capable(CAP_SYS_ADMIN))
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_AUDIT &&
++		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
++		 gr_is_capable(CAP_AUDIT_WRITE) &&
++		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
++		 gr_is_capable(CAP_AUDIT_CONTROL))
++		return current_cap();
++	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
++		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
++		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
++		  gr_is_capable(CAP_NET_ADMIN)))
++		return current_cap();
++	else
++		return __cap_empty_set;
++#else
++	return current_cap();
++#endif
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_sysctl.c linux-2.6.32.12/grsecurity/grsec_sysctl.c
+--- linux-2.6.32.12/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_sysctl.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,447 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/sysctl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
++{
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
++		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_GRKERNSEC_ROFS
++static int __maybe_unused one = 1;
++#endif
++
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++ctl_table grsecurity_table[] = {
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++#ifdef CONFIG_GRKERNSEC_LINK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "linking_restrictions",
++		.data		= &grsec_enable_link,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "fifo_restrictions",
++		.data		= &grsec_enable_fifo,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "execve_limiting",
++		.data		= &grsec_enable_execve,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "ip_blackhole",
++		.data		= &grsec_enable_blackhole,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "lastack_retries",
++		.data		= &grsec_lastack_retries,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "exec_logging",
++		.data		= &grsec_enable_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "signal_logging",
++		.data		= &grsec_enable_signal,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "forkfail_logging",
++		.data		= &grsec_enable_forkfail,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "timechange_logging",
++		.data		= &grsec_enable_time,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_shmat",
++		.data		= &grsec_enable_chroot_shmat,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_unix",
++		.data		= &grsec_enable_chroot_unix,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mount",
++		.data		= &grsec_enable_chroot_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_fchdir",
++		.data		= &grsec_enable_chroot_fchdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chroot",
++		.data		= &grsec_enable_chroot_double,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_pivot",
++		.data		= &grsec_enable_chroot_pivot,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_enforce_chdir",
++		.data		= &grsec_enable_chroot_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chmod",
++		.data		= &grsec_enable_chroot_chmod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mknod",
++		.data		= &grsec_enable_chroot_mknod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_restrict_nice",
++		.data		= &grsec_enable_chroot_nice,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_execlog",
++		.data		= &grsec_enable_chroot_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_caps",
++		.data		= &grsec_enable_chroot_caps,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_sysctl",
++		.data		= &grsec_enable_chroot_sysctl,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe",
++		.data		= &grsec_enable_tpe,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_gid",
++		.data		= &grsec_tpe_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_restrict_all",
++		.data		= &grsec_enable_tpe_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all",
++		.data		= &grsec_enable_socket_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all_gid",
++		.data		= &grsec_socket_all_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client",
++		.data		= &grsec_enable_socket_client,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client_gid",
++		.data		= &grsec_socket_client_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server",
++		.data		= &grsec_enable_socket_server,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server_gid",
++		.data		= &grsec_socket_server_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_group",
++		.data		= &grsec_enable_group,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_gid",
++		.data		= &grsec_audit_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_chdir",
++		.data		= &grsec_enable_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_mount",
++		.data		= &grsec_enable_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_textrel",
++		.data		= &grsec_enable_audit_textrel,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "dmesg",
++		.data		= &grsec_enable_dmesg,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_findtask",
++		.data		= &grsec_enable_chroot_findtask,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "resource_logging",
++		.data		= &grsec_resource_logging,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_ptrace",
++		.data		= &grsec_enable_audit_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "harden_ptrace",
++		.data		= &grsec_enable_harden_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsec_lock",
++		.data		= &grsec_lock,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_ROFS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "romount_protect",
++		.data		= &grsec_enable_rofs,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec_minmax,
++		.extra1		= &one,
++		.extra2		= &one,
++	},
++#endif
++	{ .ctl_name = 0 }
++};
++#endif
+diff -urNp linux-2.6.32.12/grsecurity/grsec_textrel.c linux-2.6.32.12/grsecurity/grsec_textrel.c
+--- linux-2.6.32.12/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_textrel.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,16 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_log_textrel(struct vm_area_struct * vma)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	if (grsec_enable_audit_textrel)
++		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_time.c linux-2.6.32.12/grsecurity/grsec_time.c
+--- linux-2.6.32.12/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_time.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,13 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_timechange(void)
++{
++#ifdef CONFIG_GRKERNSEC_TIME
++	if (grsec_enable_time)
++		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsec_tpe.c linux-2.6.32.12/grsecurity/grsec_tpe.c
+--- linux-2.6.32.12/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsec_tpe.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,38 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++extern int gr_acl_tpe_check(void);
++
++int
++gr_tpe_allow(const struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
++	const struct cred *cred = current_cred();
++
++	if (cred->uid && ((grsec_enable_tpe &&
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++	    !in_group_p(grsec_tpe_gid)
++#else
++	    in_group_p(grsec_tpe_gid)
++#endif
++	    ) || gr_acl_tpe_check()) &&
++	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
++						(inode->i_mode & S_IWOTH))))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
++	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
++	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#endif
++#endif
++	return 1;
++}
+diff -urNp linux-2.6.32.12/grsecurity/grsum.c linux-2.6.32.12/grsecurity/grsum.c
+--- linux-2.6.32.12/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/grsum.c	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,59 @@
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/scatterlist.h>
++#include <linux/crypto.h>
++#include <linux/gracl.h>
++
++
++#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
++#error "crypto and sha256 must be built into the kernel"
++#endif
++
++int
++chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
++{
++	char *p;
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++	unsigned char temp_sum[GR_SHA_LEN];
++	volatile int retval = 0;
++	volatile int dummy = 0;
++	unsigned int i;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		/* should never happen, since sha256 should be built in */
++		return 1;
++	}
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	crypto_hash_init(&desc);
++
++	p = salt;
++	sg_set_buf(&sg, p, GR_SALT_LEN);
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	p = entry->pw;
++	sg_set_buf(&sg, p, strlen(p));
++	
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	crypto_hash_final(&desc, temp_sum);
++
++	memset(entry->pw, 0, GR_PW_LEN);
++
++	for (i = 0; i < GR_SHA_LEN; i++)
++		if (sum[i] != temp_sum[i])
++			retval = 1;
++		else
++			dummy = 1;	// waste a cycle
++
++	crypto_free_hash(tfm);
++
++	return retval;
++}
+diff -urNp linux-2.6.32.12/grsecurity/Kconfig linux-2.6.32.12/grsecurity/Kconfig
+--- linux-2.6.32.12/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/Kconfig	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,965 @@
++#
++# grecurity configuration
++#
++
++menu "Grsecurity"
++
++config GRKERNSEC
++	bool "Grsecurity"
++	select CRYPTO
++	select CRYPTO_SHA256
++	help
++	  If you say Y here, you will be able to configure many features
++	  that will enhance the security of your system.  It is highly
++	  recommended that you say Y here and read through the help
++	  for each option so that you fully understand the features and
++	  can evaluate their usefulness for your machine.
++
++choice
++	prompt "Security Level"
++	depends on GRKERNSEC
++	default GRKERNSEC_CUSTOM
++
++config GRKERNSEC_LOW
++	bool "Low"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_CHDIR
++
++	help
++	  If you choose this option, several of the grsecurity options will
++	  be enabled that will give you greater protection against a number
++	  of attacks, while assuring that none of your software will have any
++	  conflicts with the additional security measures.  If you run a lot
++	  of unusual software, or you are having problems with the higher
++	  security levels, you should say Y here.  With this option, the
++	  following features are enabled:
++
++	  - Linking restrictions
++	  - FIFO restrictions
++	  - Enforcing RLIMIT_NPROC on execve
++	  - Restricted dmesg
++	  - Enforced chdir("/") on chroot
++	  - Runtime module disabling
++
++config GRKERNSEC_MEDIUM
++	bool "Medium"
++	select PAX
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_USERGROUP
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
++
++	help
++	  If you say Y here, several features in addition to those included
++	  in the low additional security level will be enabled.  These
++	  features provide even more security to your system, though in rare
++	  cases they may be incompatible with very old or poorly written
++	  software.  If you enable this option, make sure that your auth
++	  service (identd) is running as gid 1001.  With this option, 
++	  the following features (in addition to those provided in the 
++	  low additional security level) will be enabled:
++
++	  - Failed fork logging
++	  - Time change logging
++	  - Signal logging
++	  - Deny mounts in chroot
++	  - Deny double chrooting
++	  - Deny sysctl writes in chroot
++	  - Deny mknod in chroot
++	  - Deny access to abstract AF_UNIX sockets out of chroot
++	  - Deny pivot_root in chroot
++	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
++	  - /proc restrictions with special GID set to 10 (usually wheel)
++	  - Address Space Layout Randomization (ASLR)
++	  - Prevent exploitation of most refcount overflows
++	  - Bounds checking of copying between the kernel and userland
++
++config GRKERNSEC_HIGH
++	bool "High"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SHMAT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_FCHDIR
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_CHROOT_CAPS
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_CHROOT_FINDTASK
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_HIDESYM
++	select GRKERNSEC_BRUTE
++	select GRKERNSEC_PROC_USERGROUP
++	select GRKERNSEC_KMEM
++	select GRKERNSEC_RESLOG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_PROC_ADD
++	select GRKERNSEC_CHROOT_CHMOD
++	select GRKERNSEC_CHROOT_NICE
++	select GRKERNSEC_AUDIT_MOUNT
++	select GRKERNSEC_MODHARDEN if (MODULES)
++	select GRKERNSEC_HARDEN_PTRACE
++	select GRKERNSEC_VM86 if (X86_32)
++	select PAX
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_NOEXEC
++	select PAX_MPROTECT
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
++	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
++	select PAX_SEGMEXEC if (X86_32)
++	select PAX_PAGEEXEC
++	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
++	select PAX_EMUTRAMP if (PARISC)
++	select PAX_EMUSIGRT if (PARISC)
++	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
++	help
++	  If you say Y here, many of the features of grsecurity will be
++	  enabled, which will protect you against many kinds of attacks
++	  against your system.  The heightened security comes at a cost
++	  of an increased chance of incompatibilities with rare software
++	  on your machine.  Since this security level enables PaX, you should
++	  view <http://pax.grsecurity.net> and read about the PaX
++	  project.  While you are there, download chpax and run it on
++	  binaries that cause problems with PaX.  Also remember that
++	  since the /proc restrictions are enabled, you must run your
++	  identd as gid 1001.  This security level enables the following 
++	  features in addition to those listed in the low and medium 
++	  security levels:
++
++	  - Additional /proc restrictions
++	  - Chmod restrictions in chroot
++	  - No signals, ptrace, or viewing of processes outside of chroot
++	  - Capability restrictions in chroot
++	  - Deny fchdir out of chroot
++	  - Priority restrictions in chroot
++	  - Segmentation-based implementation of PaX
++	  - Mprotect restrictions
++	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
++	  - Kernel stack randomization
++	  - Mount/unmount/remount logging
++	  - Kernel symbol hiding
++	  - Prevention of memory exhaustion-based exploits
++	  - Hardening of module auto-loading
++	  - Ptrace restrictions
++	  - Restricted vm86 mode
++
++config GRKERNSEC_CUSTOM
++	bool "Custom"
++	help
++	  If you say Y here, you will be able to configure every grsecurity
++	  option, which allows you to enable many more features that aren't
++	  covered in the basic security levels.  These additional features
++	  include TPE, socket restrictions, and the sysctl system for
++	  grsecurity.  It is advised that you read through the help for
++	  each option to determine its usefulness in your situation.
++
++endchoice
++
++menu "Address Space Protection"
++depends on GRKERNSEC
++
++config GRKERNSEC_KMEM
++	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
++	help
++	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
++	  be written to via mmap or otherwise to modify the running kernel.
++	  /dev/port will also not be allowed to be opened. If you have module
++	  support disabled, enabling this will close up four ways that are
++	  currently used  to insert malicious code into the running kernel.
++	  Even with all these features enabled, we still highly recommend that
++	  you use the RBAC system, as it is still possible for an attacker to
++	  modify the running kernel through privileged I/O granted by ioperm/iopl.
++	  If you are not using XFree86, you may be able to stop this additional
++	  case by enabling the 'Disable privileged I/O' option. Though nothing
++	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
++	  but only to video memory, which is the only writing we allow in this
++	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
++	  not be allowed to mprotect it with PROT_WRITE later.
++	  It is highly recommended that you say Y here if you meet all the
++	  conditions above.
++
++config GRKERNSEC_VM86
++	bool "Restrict VM86 mode"
++	depends on X86_32
++
++	help
++	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
++	  make use of a special execution mode on 32bit x86 processors called
++	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
++	  video cards and will still work with this option enabled.  The purpose
++	  of the option is to prevent exploitation of emulation errors in
++	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
++	  Nearly all users should be able to enable this option.
++
++config GRKERNSEC_IO
++	bool "Disable privileged I/O"
++	depends on X86
++	select RTC_CLASS
++	select RTC_INTF_DEV
++	select RTC_DRV_CMOS
++
++	help
++	  If you say Y here, all ioperm and iopl calls will return an error.
++	  Ioperm and iopl can be used to modify the running kernel.
++	  Unfortunately, some programs need this access to operate properly,
++	  the most notable of which are XFree86 and hwclock.  hwclock can be
++	  remedied by having RTC support in the kernel, so real-time 
++	  clock support is enabled if this option is enabled, to ensure 
++	  that hwclock operates correctly.  XFree86 still will not 
++	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
++	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
++	  protect your kernel against modification, use the RBAC system.
++
++config GRKERNSEC_PROC_MEMMAP
++	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
++	default y if (PAX_NOEXEC || PAX_ASLR)
++	depends on PAX_NOEXEC || PAX_ASLR
++	help
++	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
++	  give no information about the addresses of its mappings if
++	  PaX features that rely on random addresses are enabled on the task.
++	  If you use PaX it is greatly recommended that you say Y here as it
++	  closes up a hole that makes the full ASLR useless for suid
++	  binaries.
++
++config GRKERNSEC_BRUTE
++	bool "Deter exploit bruteforcing"
++	help
++	  If you say Y here, attempts to bruteforce exploits against forking
++	  daemons such as apache or sshd will be deterred.  When a child of a
++	  forking daemon is killed by PaX or crashes due to an illegal
++	  instruction, the parent process will be delayed 30 seconds upon every
++	  subsequent fork until the administrator is able to assess the
++	  situation and restart the daemon.  It is recommended that you also
++	  enable signal logging in the auditing section so that logs are
++	  generated when a process performs an illegal instruction.
++
++config GRKERNSEC_MODHARDEN
++	bool "Harden module auto-loading"
++	depends on MODULES
++	help
++	  If you say Y here, module auto-loading in response to use of some
++	  feature implemented by an unloaded module will be restricted to
++	  root users.  Enabling this option helps defend against attacks 
++	  by unprivileged users who abuse the auto-loading behavior to 
++	  cause a vulnerable module to load that is then exploited.
++
++	  If this option prevents a legitimate use of auto-loading for a 
++	  non-root user, the administrator can execute modprobe manually 
++	  with the exact name of the module mentioned in the alert log.
++	  Alternatively, the administrator can add the module to the list
++	  of modules loaded at boot by modifying init scripts.
++
++	  Modification of init scripts will most likely be needed on 
++	  Ubuntu servers with encrypted home directory support enabled,
++	  as the first non-root user logging in will cause the ecb(aes),
++	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
++
++config GRKERNSEC_HIDESYM
++	bool "Hide kernel symbols"
++	help
++	  If you say Y here, getting information on loaded modules, and
++	  displaying all kernel symbols through a syscall will be restricted
++	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
++	  /proc/kallsyms will be restricted to the root user.  The RBAC
++	  system can hide that entry even from root.  Note that this option
++	  is only effective provided the following conditions are met:
++	  1) The kernel using grsecurity is not precompiled by some distribution
++	  2) You are using the RBAC system and hiding other files such as your
++	     kernel image and System.map.  Alternatively, enabling this option
++	     causes the permissions on /boot, /lib/modules, and the kernel
++	     source directory to change at compile time to prevent 
++	     reading by non-root users.
++	  If the above conditions are met, this option will aid in providing a
++	  useful protection against local kernel exploitation of overflows
++	  and arbitrary read/write vulnerabilities.
++
++endmenu
++menu "Role Based Access Control Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_NO_RBAC
++	bool "Disable RBAC system"
++	help
++	  If you say Y here, the /dev/grsec device will be removed from the kernel,
++	  preventing the RBAC system from being enabled.  You should only say Y
++	  here if you have no intention of using the RBAC system, so as to prevent
++	  an attacker with root access from misusing the RBAC system to hide files
++	  and processes when loadable module support and /dev/[k]mem have been
++	  locked down.
++
++config GRKERNSEC_ACL_HIDEKERN
++	bool "Hide kernel processes"
++	help
++	  If you say Y here, all kernel threads will be hidden to all
++	  processes but those whose subject has the "view hidden processes"
++	  flag.
++
++config GRKERNSEC_ACL_MAXTRIES
++	int "Maximum tries before password lockout"
++	default 3
++	help
++	  This option enforces the maximum number of times a user can attempt
++	  to authorize themselves with the grsecurity RBAC system before being
++	  denied the ability to attempt authorization again for a specified time.
++	  The lower the number, the harder it will be to brute-force a password.
++
++config GRKERNSEC_ACL_TIMEOUT
++	int "Time to wait after max password tries, in seconds"
++	default 30
++	help
++	  This option specifies the time the user must wait after attempting to
++	  authorize to the RBAC system with the maximum number of invalid
++	  passwords.  The higher the number, the harder it will be to brute-force
++	  a password.
++
++endmenu
++menu "Filesystem Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_PROC
++	bool "Proc restrictions"
++	help
++	  If you say Y here, the permissions of the /proc filesystem
++	  will be altered to enhance system security and privacy.  You MUST
++  	  choose either a user only restriction or a user and group restriction.
++	  Depending upon the option you choose, you can either restrict users to
++	  see only the processes they themselves run, or choose a group that can
++	  view all processes and files normally restricted to root if you choose
++	  the "restrict to user only" option.  NOTE: If you're running identd as
++	  a non-root user, you will have to run it as the group you specify here.
++
++config GRKERNSEC_PROC_USER
++	bool "Restrict /proc to user only"
++	depends on GRKERNSEC_PROC
++	help
++	  If you say Y here, non-root users will only be able to view their own
++	  processes, and restricts them from viewing network-related information,
++	  and viewing kernel symbol and module information.
++
++config GRKERNSEC_PROC_USERGROUP
++	bool "Allow special group"
++	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
++	help
++	  If you say Y here, you will be able to select a group that will be
++	  able to view all processes, network-related information, and
++	  kernel and symbol information.  This option is useful if you want
++	  to run identd as a non-root user.
++
++config GRKERNSEC_PROC_GID
++	int "GID for special group"
++	depends on GRKERNSEC_PROC_USERGROUP
++	default 1001
++
++config GRKERNSEC_PROC_ADD
++	bool "Additional restrictions"
++	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
++	help
++	  If you say Y here, additional restrictions will be placed on
++	  /proc that keep normal users from viewing device information and 
++	  slabinfo information that could be useful for exploits.
++
++config GRKERNSEC_LINK
++	bool "Linking restrictions"
++	help
++	  If you say Y here, /tmp race exploits will be prevented, since users
++	  will no longer be able to follow symlinks owned by other users in
++	  world-writable +t directories (i.e. /tmp), unless the owner of the
++	  symlink is the owner of the directory. users will also not be
++	  able to hardlink to files they do not own.  If the sysctl option is
++	  enabled, a sysctl option with name "linking_restrictions" is created.
++
++config GRKERNSEC_FIFO
++	bool "FIFO restrictions"
++	help
++	  If you say Y here, users will not be able to write to FIFOs they don't
++	  own in world-writable +t directories (i.e. /tmp), unless the owner of
++	  the FIFO is the same owner of the directory it's held in.  If the sysctl
++	  option is enabled, a sysctl option with name "fifo_restrictions" is
++	  created.
++
++config GRKERNSEC_ROFS
++	bool "Runtime read-only mount protection"
++	help
++	  If you say Y here, a sysctl option with name "romount_protect" will
++	  be created.  By setting this option to 1 at runtime, filesystems
++	  will be protected in the following ways:
++	  * No new writable mounts will be allowed
++	  * Existing read-only mounts won't be able to be remounted read/write
++	  * Write operations will be denied on all block devices
++	  This option acts independently of grsec_lock: once it is set to 1,
++	  it cannot be turned off.  Therefore, please be mindful of the resulting
++	  behavior if this option is enabled in an init script on a read-only
++	  filesystem.  This feature is mainly intended for secure embedded systems.
++
++config GRKERNSEC_CHROOT
++	bool "Chroot jail restrictions"
++	help
++	  If you say Y here, you will be able to choose several options that will
++	  make breaking out of a chrooted jail much more difficult.  If you
++	  encounter no software incompatibilities with the following options, it
++	  is recommended that you enable each one.
++
++config GRKERNSEC_CHROOT_MOUNT
++	bool "Deny mounts"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  mount or remount filesystems.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_deny_mount" is created.
++
++config GRKERNSEC_CHROOT_DOUBLE
++	bool "Deny double-chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chroot
++	  again outside the chroot.  This is a widely used method of breaking
++	  out of a chroot jail and should not be allowed.  If the sysctl 
++	  option is enabled, a sysctl option with name 
++	  "chroot_deny_chroot" is created.
++
++config GRKERNSEC_CHROOT_PIVOT
++	bool "Deny pivot_root in chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to use
++	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
++	  works similar to chroot in that it changes the root filesystem.  This
++	  function could be misused in a chrooted process to attempt to break out
++	  of the chroot, and therefore should not be allowed.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
++	  created.
++
++config GRKERNSEC_CHROOT_CHDIR
++	bool "Enforce chdir(\"/\") on all chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the current working directory of all newly-chrooted
++	  applications will be set to the the root directory of the chroot.
++	  The man page on chroot(2) states:
++	  Note that this call does not change  the  current  working
++	  directory,  so  that `.' can be outside the tree rooted at
++	  `/'.  In particular, the  super-user  can  escape  from  a
++	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
++
++	  It is recommended that you say Y here, since it's not known to break
++	  any software.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_enforce_chdir" is created.
++
++config GRKERNSEC_CHROOT_CHMOD
++	bool "Deny (f)chmod +s"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chmod
++	  or fchmod files to make them have suid or sgid bits.  This protects
++	  against another published method of breaking a chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
++	  created.
++
++config GRKERNSEC_CHROOT_FCHDIR
++	bool "Deny fchdir out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
++	  to a file descriptor of the chrooting process that points to a directory
++	  outside the filesystem will be stopped.  If the sysctl option
++	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
++
++config GRKERNSEC_CHROOT_MKNOD
++	bool "Deny mknod"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be allowed to
++	  mknod.  The problem with using mknod inside a chroot is that it
++	  would allow an attacker to create a device entry that is the same
++	  as one on the physical root of your system, which could range from
++	  anything from the console device to a device for your harddrive (which
++	  they could then use to wipe the drive or steal data).  It is recommended
++	  that you say Y here, unless you run into software incompatibilities.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_mknod" is created.
++
++config GRKERNSEC_CHROOT_SHMAT
++	bool "Deny shmat() out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to attach
++	  to shared memory segments that were created outside of the chroot jail.
++	  It is recommended that you say Y here.  If the sysctl option is enabled,
++	  a sysctl option with name "chroot_deny_shmat" is created.
++
++config GRKERNSEC_CHROOT_UNIX
++	bool "Deny access to abstract AF_UNIX sockets out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  connect to abstract (meaning not belonging to a filesystem) Unix
++	  domain sockets that were bound outside of a chroot.  It is recommended
++	  that you say Y here.  If the sysctl option is enabled, a sysctl option
++	  with name "chroot_deny_unix" is created.
++
++config GRKERNSEC_CHROOT_FINDTASK
++	bool "Protect outside processes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
++	  getsid, or view any process outside of the chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_findtask" is
++	  created.
++
++config GRKERNSEC_CHROOT_NICE
++	bool "Restrict priority changes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to raise
++	  the priority of processes in the chroot, or alter the priority of
++	  processes outside the chroot.  This provides more security than simply
++	  removing CAP_SYS_NICE from the process' capability set.  If the
++	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
++	  is created.
++
++config GRKERNSEC_CHROOT_SYSCTL
++	bool "Deny sysctl writes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, an attacker in a chroot will not be able to
++	  write to sysctl entries, either by sysctl(2) or through a /proc
++	  interface.  It is strongly recommended that you say Y here. If the
++	  sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_sysctl" is created.
++
++config GRKERNSEC_CHROOT_CAPS
++	bool "Capability restrictions"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the capabilities on all root processes within a
++	  chroot jail will be lowered to stop module insertion, raw i/o,
++	  system and net admin tasks, rebooting the system, modifying immutable
++	  files, modifying IPC owned by another, and changing the system time.
++	  This is left an option because it can break some apps.  Disable this
++	  if your chrooted apps are having problems performing those kinds of
++	  tasks.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_caps" is created.
++
++endmenu
++menu "Kernel Auditing"
++depends on GRKERNSEC
++
++config GRKERNSEC_AUDIT_GROUP
++	bool "Single group for auditing"
++	help
++	  If you say Y here, the exec, chdir, and (un)mount logging features
++	  will only operate on a group you specify.  This option is recommended
++	  if you only want to watch certain users instead of having a large
++	  amount of logs from the entire system.  If the sysctl option is enabled,
++	  a sysctl option with name "audit_group" is created.
++
++config GRKERNSEC_AUDIT_GID
++	int "GID for auditing"
++	depends on GRKERNSEC_AUDIT_GROUP
++	default 1007
++
++config GRKERNSEC_EXECLOG
++	bool "Exec logging"
++	help
++	  If you say Y here, all execve() calls will be logged (since the
++	  other exec*() calls are frontends to execve(), all execution
++	  will be logged).  Useful for shell-servers that like to keep track
++	  of their users.  If the sysctl option is enabled, a sysctl option with
++	  name "exec_logging" is created.
++	  WARNING: This option when enabled will produce a LOT of logs, especially
++	  on an active system.
++
++config GRKERNSEC_RESLOG
++	bool "Resource logging"
++	help
++	  If you say Y here, all attempts to overstep resource limits will
++	  be logged with the resource name, the requested size, and the current
++	  limit.  It is highly recommended that you say Y here.  If the sysctl
++	  option is enabled, a sysctl option with name "resource_logging" is
++	  created.  If the RBAC system is enabled, the sysctl value is ignored.
++
++config GRKERNSEC_CHROOT_EXECLOG
++	bool "Log execs within chroot"
++	help
++	  If you say Y here, all executions inside a chroot jail will be logged
++	  to syslog.  This can cause a large amount of logs if certain
++	  applications (eg. djb's daemontools) are installed on the system, and
++	  is therefore left as an option.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_execlog" is created.
++
++config GRKERNSEC_AUDIT_PTRACE
++	bool "Ptrace logging"
++	help
++	  If you say Y here, all attempts to attach to a process via ptrace
++	  will be logged.  If the sysctl option is enabled, a sysctl option
++	  with name "audit_ptrace" is created.
++
++config GRKERNSEC_AUDIT_CHDIR
++	bool "Chdir logging"
++	help
++	  If you say Y here, all chdir() calls will be logged.  If the sysctl
++ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
++
++config GRKERNSEC_AUDIT_MOUNT
++	bool "(Un)Mount logging"
++	help
++	  If you say Y here, all mounts and unmounts will be logged.  If the
++	  sysctl option is enabled, a sysctl option with name "audit_mount" is
++	  created.
++
++config GRKERNSEC_SIGNAL
++	bool "Signal logging"
++	help
++	  If you say Y here, certain important signals will be logged, such as
++	  SIGSEGV, which will as a result inform you of when a error in a program
++	  occurred, which in some cases could mean a possible exploit attempt.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "signal_logging" is created.
++
++config GRKERNSEC_FORKFAIL
++	bool "Fork failure logging"
++	help
++	  If you say Y here, all failed fork() attempts will be logged.
++	  This could suggest a fork bomb, or someone attempting to overstep
++	  their process limit.  If the sysctl option is enabled, a sysctl option
++	  with name "forkfail_logging" is created.
++
++config GRKERNSEC_TIME
++	bool "Time change logging"
++	help
++	  If you say Y here, any changes of the system clock will be logged.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "timechange_logging" is created.
++
++config GRKERNSEC_PROC_IPADDR
++	bool "/proc/<pid>/ipaddr support"
++	help
++	  If you say Y here, a new entry will be added to each /proc/<pid>
++	  directory that contains the IP address of the person using the task.
++	  The IP is carried across local TCP and AF_UNIX stream sockets.
++	  This information can be useful for IDS/IPSes to perform remote response
++	  to a local attack.  The entry is readable by only the owner of the
++	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
++	  the RBAC system), and thus does not create privacy concerns.
++
++config GRKERNSEC_AUDIT_TEXTREL
++	bool 'ELF text relocations logging (READ HELP)'
++	depends on PAX_MPROTECT
++	help
++	  If you say Y here, text relocations will be logged with the filename
++	  of the offending library or binary.  The purpose of the feature is
++	  to help Linux distribution developers get rid of libraries and
++	  binaries that need text relocations which hinder the future progress
++	  of PaX.  Only Linux distribution developers should say Y here, and
++	  never on a production machine, as this option creates an information
++	  leak that could aid an attacker in defeating the randomization of
++	  a single memory region.  If the sysctl option is enabled, a sysctl
++	  option with name "audit_textrel" is created.
++
++endmenu
++
++menu "Executable Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_EXECVE
++	bool "Enforce RLIMIT_NPROC on execs"
++	help
++	  If you say Y here, users with a resource limit on processes will
++	  have the value checked during execve() calls.  The current system
++	  only checks the system limit during fork() calls.  If the sysctl option
++	  is enabled, a sysctl option with name "execve_limiting" is created.
++
++config GRKERNSEC_DMESG
++	bool "Dmesg(8) restriction"
++	help
++	  If you say Y here, non-root users will not be able to use dmesg(8)
++	  to view up to the last 4kb of messages in the kernel's log buffer.
++	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
++	  created.
++
++config GRKERNSEC_HARDEN_PTRACE
++	bool "Deter ptrace-based process snooping"
++	help
++	  If you say Y here, TTY sniffers and other malicious monitoring
++	  programs implemented through ptrace will be defeated.  If you
++	  have been using the RBAC system, this option has already been
++	  enabled for several years for all users, with the ability to make
++	  fine-grained exceptions.
++
++	  This option only affects the ability of non-root users to ptrace
++	  processes that are not a descendent of the ptracing process.
++	  This means that strace ./binary and gdb ./binary will still work,
++	  but attaching to arbitrary processes will not.  If the sysctl
++	  option is enabled, a sysctl option with name "harden_ptrace" is
++	  created.
++
++config GRKERNSEC_TPE
++	bool "Trusted Path Execution (TPE)"
++	help
++	  If you say Y here, you will be able to choose a gid to add to the
++	  supplementary groups of users you want to mark as "untrusted."
++	  These users will not be able to execute any files that are not in
++	  root-owned directories writable only by root.  If the sysctl option
++	  is enabled, a sysctl option with name "tpe" is created.
++
++config GRKERNSEC_TPE_ALL
++	bool "Partially restrict non-root users"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, All non-root users other than the ones in the
++	  group specified in the main TPE option will only be allowed to
++	  execute files in directories they own that are not group or
++	  world-writable, or in directories owned by root and writable only by
++	  root.  If the sysctl option is enabled, a sysctl option with name
++	  "tpe_restrict_all" is created.
++
++config GRKERNSEC_TPE_INVERT
++	bool "Invert GID option"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, the group you specify in the TPE configuration will
++	  decide what group TPE restrictions will be *disabled* for.  This
++	  option is useful if you want TPE restrictions to be applied to most
++	  users on the system.
++
++config GRKERNSEC_TPE_GID
++	int "GID for untrusted users"
++	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++config GRKERNSEC_TPE_GID
++	int "GID for trusted users"
++	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++endmenu
++menu "Network Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_RANDNET
++	bool "Larger entropy pools"
++	help
++	  If you say Y here, the entropy pools used for many features of Linux
++	  and grsecurity will be doubled in size.  Since several grsecurity
++	  features use additional randomness, it is recommended that you say Y
++	  here.  Saying Y here has a similar effect as modifying
++	  /proc/sys/kernel/random/poolsize.
++
++config GRKERNSEC_BLACKHOLE
++	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
++	help
++	  If you say Y here, neither TCP resets nor ICMP
++	  destination-unreachable packets will be sent in response to packets
++	  send to ports for which no associated listening process exists.
++	  This feature supports both IPV4 and IPV6 and exempts the 
++	  loopback interface from blackholing.  Enabling this feature 
++	  makes a host more resilient to DoS attacks and reduces network
++	  visibility against scanners.
++
++	  The blackhole feature as-implemented is equivalent to the FreeBSD
++	  blackhole feature, as prevents RST responses to all packets, not
++	  just SYNs.  Under most application behavior this causes no
++	  problems, but applications (like haproxy) may not close certain
++	  connections in a way that cleanly terminates them on the remote
++	  end, leaving the remote host in LAST_ACK state.  Because of this
++	  side-effect and to prevent intentional LAST_ACK DoSes, this
++	  feature also adds automatic mitigation against such attacks.
++	  The mitigation drastically reduces the amount of time a socket
++	  can spend in LAST_ACK state.  If you're using haproxy and not
++	  all servers it connects to have this option enabled, consider
++	  disabling this feature on the haproxy host.
++
++	  If this option is enabled, two sysctl options with names
++	  "ip_blackhole" and "lastack_retries" will be created.
++	  While "ip_blackhole" takes the standard zero/non-zero on/off
++	  toggle, "lastack_retries" uses the same kinds of values as
++	  "tcp_retries1" and "tcp_retries2".  The default value of 4
++	  prevents a socket from lasting more than 45 seconds in LAST_ACK
++	  state.
++
++config GRKERNSEC_SOCKET
++	bool "Socket restrictions"
++	help
++	  If you say Y here, you will be able to choose from several options.
++	  If you assign a GID on your system and add it to the supplementary
++	  groups of users you want to restrict socket access to, this patch
++	  will perform up to three things, based on the option(s) you choose.
++
++config GRKERNSEC_SOCKET_ALL
++	bool "Deny any sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine or run server
++	  applications from your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_all" is created.
++
++config GRKERNSEC_SOCKET_ALL_GID
++	int "GID to deny all sockets for"
++	depends on GRKERNSEC_SOCKET_ALL
++	default 1004
++	help
++	  Here you can choose the GID to disable socket access for. Remember to
++	  add the users you want socket access disabled for to the GID
++	  specified here.  If the sysctl option is enabled, a sysctl option
++	  with name "socket_all_gid" is created.
++
++config GRKERNSEC_SOCKET_CLIENT
++	bool "Deny client sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine, but will be
++	  able to run servers.  If this option is enabled, all users in the group
++	  you specify will have to use passive mode when initiating ftp transfers
++	  from the shell on your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_client" is created.
++
++config GRKERNSEC_SOCKET_CLIENT_GID
++	int "GID to deny client sockets for"
++	depends on GRKERNSEC_SOCKET_CLIENT
++	default 1003
++	help
++	  Here you can choose the GID to disable client socket access for.
++	  Remember to add the users you want client socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_client_gid" is created.
++
++config GRKERNSEC_SOCKET_SERVER
++	bool "Deny server sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to run server applications from your machine.  If the sysctl
++	  option is enabled, a sysctl option with name "socket_server" is created.
++
++config GRKERNSEC_SOCKET_SERVER_GID
++	int "GID to deny server sockets for"
++	depends on GRKERNSEC_SOCKET_SERVER
++	default 1002
++	help
++	  Here you can choose the GID to disable server socket access for.
++	  Remember to add the users you want server socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_server_gid" is created.
++
++endmenu
++menu "Sysctl support"
++depends on GRKERNSEC && SYSCTL
++
++config GRKERNSEC_SYSCTL
++	bool "Sysctl support"
++	help
++	  If you say Y here, you will be able to change the options that
++	  grsecurity runs with at bootup, without having to recompile your
++	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
++	  to enable (1) or disable (0) various features.  All the sysctl entries
++	  are mutable until the "grsec_lock" entry is set to a non-zero value.
++	  All features enabled in the kernel configuration are disabled at boot
++	  if you do not say Y to the "Turn on features by default" option.
++	  All options should be set at startup, and the grsec_lock entry should
++	  be set to a non-zero value after all the options are set.
++	  *THIS IS EXTREMELY IMPORTANT*
++
++config GRKERNSEC_SYSCTL_ON
++	bool "Turn on features by default"
++	depends on GRKERNSEC_SYSCTL
++	help
++	  If you say Y here, instead of having all features enabled in the
++	  kernel configuration disabled at boot time, the features will be
++	  enabled at boot time.  It is recommended you say Y here unless
++	  there is some reason you would want all sysctl-tunable features to
++	  be disabled by default.  As mentioned elsewhere, it is important
++	  to enable the grsec_lock entry once you have finished modifying
++	  the sysctl entries.
++
++endmenu
++menu "Logging Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_FLOODTIME
++	int "Seconds in between log messages (minimum)"
++	default 10
++	help
++	  This option allows you to enforce the number of seconds between
++	  grsecurity log messages.  The default should be suitable for most
++	  people, however, if you choose to change it, choose a value small enough
++	  to allow informative logs to be produced, but large enough to
++	  prevent flooding.
++
++config GRKERNSEC_FLOODBURST
++	int "Number of messages in a burst (maximum)"
++	default 4
++	help
++	  This option allows you to choose the maximum number of messages allowed
++	  within the flood time interval you chose in a separate option.  The
++	  default should be suitable for most people, however if you find that
++	  many of your logs are being interpreted as flooding, you may want to
++	  raise this value.
++
++endmenu
++
++endmenu
+diff -urNp linux-2.6.32.12/grsecurity/Makefile linux-2.6.32.12/grsecurity/Makefile
+--- linux-2.6.32.12/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/grsecurity/Makefile	2010-04-04 20:46:41.668784531 -0400
+@@ -0,0 +1,29 @@
++# grsecurity's ACL system was originally written in 2001 by Michael Dalton
++# during 2001-2009 it has been completely redesigned by Brad Spengler
++# into an RBAC system
++#
++# All code in this directory and various hooks inserted throughout the kernel
++# are copyright Brad Spengler - Open Source Security, Inc., and released 
++# under the GPL v2 or higher
++
++obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
++	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
++	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
++
++obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
++	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
++	gracl_learn.o grsec_log.o
++obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
++
++ifndef CONFIG_GRKERNSEC
++obj-y += grsec_disabled.o
++endif
++
++ifdef CONFIG_GRKERNSEC_HIDESYM
++extra-y := grsec_hidesym.o
++$(obj)/grsec_hidesym.o:
++	@-chmod -f 500 /boot
++	@-chmod -f 500 /lib/modules
++	@-chmod -f 700 .
++	@echo '  grsec: protected kernel image paths'
++endif
+diff -urNp linux-2.6.32.12/include/acpi/acoutput.h linux-2.6.32.12/include/acpi/acoutput.h
+--- linux-2.6.32.12/include/acpi/acoutput.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/acpi/acoutput.h	2010-04-29 17:46:37.297250222 -0400
+@@ -264,8 +264,8 @@
+  * leaving no executable debug code!
+  */
+ #define ACPI_FUNCTION_NAME(a)
+-#define ACPI_DEBUG_PRINT(pl)
+-#define ACPI_DEBUG_PRINT_RAW(pl)
++#define ACPI_DEBUG_PRINT(pl) do {} while (0)
++#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
+ 
+ #endif				/* ACPI_DEBUG_OUTPUT */
+ 
+diff -urNp linux-2.6.32.12/include/acpi/acpi_drivers.h linux-2.6.32.12/include/acpi/acpi_drivers.h
+--- linux-2.6.32.12/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/acpi/acpi_drivers.h	2010-04-04 20:46:41.668784531 -0400
+@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
+                                   Dock Station
+   -------------------------------------------------------------------------- */
+ struct acpi_dock_ops {
+-	acpi_notify_handler handler;
+-	acpi_notify_handler uevent;
++	const acpi_notify_handler handler;
++	const acpi_notify_handler uevent;
+ };
+ 
+ #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
+@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
+ extern int register_dock_notifier(struct notifier_block *nb);
+ extern void unregister_dock_notifier(struct notifier_block *nb);
+ extern int register_hotplug_dock_device(acpi_handle handle,
+-					struct acpi_dock_ops *ops,
++					const struct acpi_dock_ops *ops,
+ 					void *context);
+ extern void unregister_hotplug_dock_device(acpi_handle handle);
+ #else
+@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
+ {
+ }
+ static inline int register_hotplug_dock_device(acpi_handle handle,
+-					       struct acpi_dock_ops *ops,
++					       const struct acpi_dock_ops *ops,
+ 					       void *context)
+ {
+ 	return -ENODEV;
+diff -urNp linux-2.6.32.12/include/asm-generic/atomic-long.h linux-2.6.32.12/include/asm-generic/atomic-long.h
+--- linux-2.6.32.12/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/atomic-long.h	2010-04-04 20:46:41.668784531 -0400
+@@ -22,6 +22,12 @@
+ 
+ typedef atomic64_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic64_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic64_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
+ 
+ static inline long atomic_long_read(atomic_long_t *l)
+@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic64_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
+ 	atomic64_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic64_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
+ 	atomic64_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic64_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
+ 
+ typedef atomic_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
+ static inline long atomic_long_read(atomic_long_t *l)
+ {
+@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
+ 	atomic_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
+ 	atomic_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
+ 
+ #endif  /*  BITS_PER_LONG == 64  */
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void pax_refcount_needs_these_functions(void)
++{
++	atomic_read_unchecked((atomic_unchecked_t *)NULL);
++	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
++	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
++
++	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
++	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
++}
++#else
++#define atomic_read_unchecked(v) atomic_read(v)
++#define atomic_set_unchecked(v, i) atomic_set((v), (i))
++#define atomic_add_unchecked(i, v) atomic_add((i), (v))
++#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
++#define atomic_inc_unchecked(v) atomic_inc(v)
++
++#define atomic_long_read_unchecked(v) atomic_long_read(v)
++#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
++#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
++#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
++#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
++#endif
++
+ #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
+diff -urNp linux-2.6.32.12/include/asm-generic/dma-mapping-common.h linux-2.6.32.12/include/asm-generic/dma-mapping-common.h
+--- linux-2.6.32.12/include/asm-generic/dma-mapping-common.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/dma-mapping-common.h	2010-04-04 20:46:41.673688119 -0400
+@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
+ 					      enum dma_data_direction dir,
+ 					      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(ptr, size);
+@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
+ 					  enum dma_data_direction dir,
+ 					  struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
+ 				   int nents, enum dma_data_direction dir,
+ 				   struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	int i, ents;
+ 	struct scatterlist *s;
+ 
+@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
+ 				      int nents, enum dma_data_direction dir,
+ 				      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	debug_dma_unmap_sg(dev, sg, nents, dir);
+@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
+ 				      size_t offset, size_t size,
+ 				      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(page_address(page) + offset, size);
+@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
+ static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+ 				  size_t size, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
+ 					   size_t size,
+ 					   enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_cpu)
+@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
+ 					      dma_addr_t addr, size_t size,
+ 					      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_device)
+@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
+ 						 size_t size,
+ 						 enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_cpu) {
+@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
+ 						    size_t size,
+ 						    enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_device) {
+@@ -155,7 +155,7 @@ static inline void
+ dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
+ 		    int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_cpu)
+@@ -167,7 +167,7 @@ static inline void
+ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
+ 		       int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_device)
+diff -urNp linux-2.6.32.12/include/asm-generic/futex.h linux-2.6.32.12/include/asm-generic/futex.h
+--- linux-2.6.32.12/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/futex.h	2010-04-04 20:46:41.673688119 -0400
+@@ -6,7 +6,7 @@
+ #include <asm/errno.h>
+ 
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
++futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
+ }
+ 
+ static inline int
+-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
++futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
+ {
+ 	return -ENOSYS;
+ }
+diff -urNp linux-2.6.32.12/include/asm-generic/int-l64.h linux-2.6.32.12/include/asm-generic/int-l64.h
+--- linux-2.6.32.12/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/int-l64.h	2010-04-04 20:46:41.673688119 -0400
+@@ -46,6 +46,8 @@ typedef unsigned int u32;
+ typedef signed long s64;
+ typedef unsigned long u64;
+ 
++typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.12/include/asm-generic/int-ll64.h linux-2.6.32.12/include/asm-generic/int-ll64.h
+--- linux-2.6.32.12/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/int-ll64.h	2010-04-04 20:46:41.673688119 -0400
+@@ -51,6 +51,8 @@ typedef unsigned int u32;
+ typedef signed long long s64;
+ typedef unsigned long long u64;
+ 
++typedef unsigned long long intoverflow_t;
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.12/include/asm-generic/kmap_types.h linux-2.6.32.12/include/asm-generic/kmap_types.h
+--- linux-2.6.32.12/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/kmap_types.h	2010-04-04 20:46:41.673688119 -0400
+@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
+ KMAP_D(16)	KM_IRQ_PTE,
+ KMAP_D(17)	KM_NMI,
+ KMAP_D(18)	KM_NMI_PTE,
+-KMAP_D(19)	KM_TYPE_NR
++KMAP_D(19)	KM_CLEARPAGE,
++KMAP_D(20)	KM_TYPE_NR
+ };
+ 
+ #undef KMAP_D
+diff -urNp linux-2.6.32.12/include/asm-generic/pgtable.h linux-2.6.32.12/include/asm-generic/pgtable.h
+--- linux-2.6.32.12/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/pgtable.h	2010-04-04 20:46:41.673688119 -0400
+@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
+ 				unsigned long size);
+ #endif
+ 
++#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
++static inline unsigned long pax_open_kernel(void) { return 0; }
++#endif
++
++#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #endif /* !__ASSEMBLY__ */
+ 
+ #endif /* _ASM_GENERIC_PGTABLE_H */
+diff -urNp linux-2.6.32.12/include/asm-generic/vmlinux.lds.h linux-2.6.32.12/include/asm-generic/vmlinux.lds.h
+--- linux-2.6.32.12/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/asm-generic/vmlinux.lds.h	2010-04-04 20:46:41.673688119 -0400
+@@ -199,6 +199,7 @@
+ 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
+ 		VMLINUX_SYMBOL(__start_rodata) = .;			\
+ 		*(.rodata) *(.rodata.*)					\
++		*(.data.read_only)					\
+ 		*(__vermagic)		/* Kernel version magic */	\
+ 		*(__markers_strings)	/* Markers: strings */		\
+ 		*(__tracepoints_strings)/* Tracepoints: strings */	\
+@@ -656,22 +657,24 @@
+  * section in the linker script will go there too.  @phdr should have
+  * a leading colon.
+  *
+- * Note that this macros defines __per_cpu_load as an absolute symbol.
++ * Note that this macros defines per_cpu_load as an absolute symbol.
+  * If there is no need to put the percpu section at a predetermined
+  * address, use PERCPU().
+  */
+ #define PERCPU_VADDR(vaddr, phdr)					\
+-	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
+-	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
++	per_cpu_load = .;						\
++	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
+ 				- LOAD_OFFSET) {			\
++		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
+ 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
+ 		*(.data.percpu.first)					\
+-		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu)						\
++		. = ALIGN(PAGE_SIZE);					\
++		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu.shared_aligned)				\
+ 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
+ 	} phdr								\
+-	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
++	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
+ 
+ /**
+  * PERCPU - define output section for percpu area, simple version
+diff -urNp linux-2.6.32.12/include/drm/drm_pciids.h linux-2.6.32.12/include/drm/drm_pciids.h
+--- linux-2.6.32.12/include/drm/drm_pciids.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.12/include/drm/drm_pciids.h	2010-04-29 18:05:16.209337414 -0400
+@@ -377,7 +377,7 @@
+ 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define r128_PCI_IDS \
+ 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -417,14 +417,14 @@
+ 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mga_PCI_IDS \
+ 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
+ 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mach64_PCI_IDS \
+ 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -447,7 +447,7 @@
+ 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define sisdrv_PCI_IDS \
+ 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -458,7 +458,7 @@
+ 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+ 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define tdfx_PCI_IDS \
+ 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -467,7 +467,7 @@
+ 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define viadrv_PCI_IDS \
+ 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -479,14 +479,14 @@
+ 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
+ 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i810_PCI_IDS \
+ 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i830_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -494,11 +494,11 @@
+ 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define gamma_PCI_IDS \
+ 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define savage_PCI_IDS \
+ 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
+@@ -524,10 +524,10 @@
+ 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
+ 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+ 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define ffb_PCI_IDS \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i915_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+@@ -560,4 +560,4 @@
+ 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+diff -urNp linux-2.6.32.12/include/drm/drmP.h linux-2.6.32.12/include/drm/drmP.h
+--- linux-2.6.32.12/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/drm/drmP.h	2010-04-04 20:46:41.673688119 -0400
+@@ -814,7 +814,7 @@ struct drm_driver {
+ 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
+ 
+ 	/* Driver private ops for this object */
+-	struct vm_operations_struct *gem_vm_ops;
++	const struct vm_operations_struct *gem_vm_ops;
+ 
+ 	int major;
+ 	int minor;
+@@ -917,7 +917,7 @@ struct drm_device {
+ 
+ 	/** \name Usage Counters */
+ 	/*@{ */
+-	int open_count;			/**< Outstanding files open */
++	atomic_t open_count;		/**< Outstanding files open */
+ 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
+ 	atomic_t vma_count;		/**< Outstanding vma areas open */
+ 	int buf_use;			/**< Buffers in use -- cannot alloc */
+@@ -928,7 +928,7 @@ struct drm_device {
+ 	/*@{ */
+ 	unsigned long counters;
+ 	enum drm_stat_type types[15];
+-	atomic_t counts[15];
++	atomic_unchecked_t counts[15];
+ 	/*@} */
+ 
+ 	struct list_head filelist;
+diff -urNp linux-2.6.32.12/include/linux/a.out.h linux-2.6.32.12/include/linux/a.out.h
+--- linux-2.6.32.12/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/a.out.h	2010-04-04 20:46:41.673688119 -0400
+@@ -39,6 +39,14 @@ enum machine_type {
+   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
+ };
+ 
++/* Constants for the N_FLAGS field */
++#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
++#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
++#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
++#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
++/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
++#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
++
+ #if !defined (N_MAGIC)
+ #define N_MAGIC(exec) ((exec).a_info & 0xffff)
+ #endif
+diff -urNp linux-2.6.32.12/include/linux/atmdev.h linux-2.6.32.12/include/linux/atmdev.h
+--- linux-2.6.32.12/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/atmdev.h	2010-04-04 20:46:41.673688119 -0400
+@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
+ #endif
+ 
+ struct k_atm_aal_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.12/include/linux/backlight.h linux-2.6.32.12/include/linux/backlight.h
+--- linux-2.6.32.12/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/backlight.h	2010-04-04 20:46:41.673688119 -0400
+@@ -36,18 +36,18 @@ struct backlight_device;
+ struct fb_info;
+ 
+ struct backlight_ops {
+-	unsigned int options;
++	const unsigned int options;
+ 
+ #define BL_CORE_SUSPENDRESUME	(1 << 0)
+ 
+ 	/* Notify the backlight driver some property has changed */
+-	int (*update_status)(struct backlight_device *);
++	int (* const update_status)(struct backlight_device *);
+ 	/* Return the current backlight brightness (accounting for power,
+ 	   fb_blank etc.) */
+-	int (*get_brightness)(struct backlight_device *);
++	int (* const get_brightness)(struct backlight_device *);
+ 	/* Check if given framebuffer device is the one bound to this backlight;
+ 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
+-	int (*check_fb)(struct fb_info *);
++	int (* const check_fb)(struct fb_info *);
+ };
+ 
+ /* This structure defines all the properties of a backlight */
+@@ -86,7 +86,7 @@ struct backlight_device {
+ 	   registered this device has been unloaded, and if class_get_devdata()
+ 	   points to something in the body of that driver, it is also invalid. */
+ 	struct mutex ops_lock;
+-	struct backlight_ops *ops;
++	const struct backlight_ops *ops;
+ 
+ 	/* The framebuffer notifier block */
+ 	struct notifier_block fb_notif;
+@@ -103,7 +103,7 @@ static inline void backlight_update_stat
+ }
+ 
+ extern struct backlight_device *backlight_device_register(const char *name,
+-	struct device *dev, void *devdata, struct backlight_ops *ops);
++	struct device *dev, void *devdata, const struct backlight_ops *ops);
+ extern void backlight_device_unregister(struct backlight_device *bd);
+ extern void backlight_force_update(struct backlight_device *bd,
+ 				   enum backlight_update_reason reason);
+diff -urNp linux-2.6.32.12/include/linux/binfmts.h linux-2.6.32.12/include/linux/binfmts.h
+--- linux-2.6.32.12/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/binfmts.h	2010-04-04 20:46:41.673688119 -0400
+@@ -78,6 +78,7 @@ struct linux_binfmt {
+ 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
+ 	int (*load_shlib)(struct file *);
+ 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
+ 	unsigned long min_coredump;	/* minimal dump size */
+ 	int hasvdso;
+ };
+diff -urNp linux-2.6.32.12/include/linux/blkdev.h linux-2.6.32.12/include/linux/blkdev.h
+--- linux-2.6.32.12/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/blkdev.h	2010-04-04 20:46:41.673688119 -0400
+@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
+ #endif /* CONFIG_BLK_DEV_INTEGRITY */
+ 
+ struct block_device_operations {
+-	int (*open) (struct block_device *, fmode_t);
+-	int (*release) (struct gendisk *, fmode_t);
+-	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*direct_access) (struct block_device *, sector_t,
++	int (* const open) (struct block_device *, fmode_t);
++	int (* const release) (struct gendisk *, fmode_t);
++	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const direct_access) (struct block_device *, sector_t,
+ 						void **, unsigned long *);
+-	int (*media_changed) (struct gendisk *);
+-	unsigned long long (*set_capacity) (struct gendisk *,
++	int (* const media_changed) (struct gendisk *);
++	unsigned long long (* const set_capacity) (struct gendisk *,
+ 						unsigned long long);
+-	int (*revalidate_disk) (struct gendisk *);
+-	int (*getgeo)(struct block_device *, struct hd_geometry *);
+-	struct module *owner;
++	int (* const revalidate_disk) (struct gendisk *);
++	int (*const getgeo)(struct block_device *, struct hd_geometry *);
++	struct module * const owner;
+ };
+ 
+ extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
+diff -urNp linux-2.6.32.12/include/linux/cache.h linux-2.6.32.12/include/linux/cache.h
+--- linux-2.6.32.12/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/cache.h	2010-04-04 20:46:41.673688119 -0400
+@@ -16,6 +16,10 @@
+ #define __read_mostly
+ #endif
+ 
++#ifndef __read_only
++#define __read_only __read_mostly
++#endif
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+diff -urNp linux-2.6.32.12/include/linux/capability.h linux-2.6.32.12/include/linux/capability.h
+--- linux-2.6.32.12/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/capability.h	2010-04-04 20:46:41.673688119 -0400
+@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
+ 	(security_real_capable_noaudit((t), (cap)) == 0)
+ 
+ extern int capable(int cap);
++int capable_nolog(int cap);
+ 
+ /* audit system wants to get cap info from files as well */
+ struct dentry;
+diff -urNp linux-2.6.32.12/include/linux/compiler-gcc4.h linux-2.6.32.12/include/linux/compiler-gcc4.h
+--- linux-2.6.32.12/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/compiler-gcc4.h	2010-04-04 20:46:41.673688119 -0400
+@@ -36,4 +36,8 @@
+    the kernel context */
+ #define __cold			__attribute__((__cold__))
+ 
++#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
++#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
++#define __bos0(ptr)		__bos((ptr), 0)
++#define __bos1(ptr)		__bos((ptr), 1)
+ #endif
+diff -urNp linux-2.6.32.12/include/linux/compiler.h linux-2.6.32.12/include/linux/compiler.h
+--- linux-2.6.32.12/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/compiler.h	2010-04-04 20:46:41.673688119 -0400
+@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
+ #define __cold
+ #endif
+ 
++#ifndef __alloc_size
++#define __alloc_size
++#endif
++
++#ifndef __bos
++#define __bos
++#endif
++
++#ifndef __bos0
++#define __bos0
++#endif
++
++#ifndef __bos1
++#define __bos1
++#endif
++
+ /* Simple shorthand for a section definition */
+ #ifndef __section
+ # define __section(S) __attribute__ ((__section__(#S)))
+diff -urNp linux-2.6.32.12/include/linux/decompress/mm.h linux-2.6.32.12/include/linux/decompress/mm.h
+--- linux-2.6.32.12/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
++++ linux-2.6.32.12/include/linux/decompress/mm.h	2010-04-04 20:46:41.673688119 -0400
+@@ -78,7 +78,7 @@ static void free(void *where)
+  * warnings when not needed (indeed large_malloc / large_free are not
+  * needed by inflate */
+ 
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ 
+ #define large_malloc(a) vmalloc(a)
+diff -urNp linux-2.6.32.12/include/linux/dma-mapping.h linux-2.6.32.12/include/linux/dma-mapping.h
+--- linux-2.6.32.12/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/dma-mapping.h	2010-04-04 20:46:41.673688119 -0400
+@@ -16,50 +16,50 @@ enum dma_data_direction {
+ };
+ 
+ struct dma_map_ops {
+-	void* (*alloc_coherent)(struct device *dev, size_t size,
++	void* (* const alloc_coherent)(struct device *dev, size_t size,
+ 				dma_addr_t *dma_handle, gfp_t gfp);
+-	void (*free_coherent)(struct device *dev, size_t size,
++	void (* const free_coherent)(struct device *dev, size_t size,
+ 			      void *vaddr, dma_addr_t dma_handle);
+-	dma_addr_t (*map_page)(struct device *dev, struct page *page,
++	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
+ 			       unsigned long offset, size_t size,
+ 			       enum dma_data_direction dir,
+ 			       struct dma_attrs *attrs);
+-	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
++	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
+ 			   size_t size, enum dma_data_direction dir,
+ 			   struct dma_attrs *attrs);
+-	int (*map_sg)(struct device *dev, struct scatterlist *sg,
++	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
+ 		      int nents, enum dma_data_direction dir,
+ 		      struct dma_attrs *attrs);
+-	void (*unmap_sg)(struct device *dev,
++	void (* const unmap_sg)(struct device *dev,
+ 			 struct scatterlist *sg, int nents,
+ 			 enum dma_data_direction dir,
+ 			 struct dma_attrs *attrs);
+-	void (*sync_single_for_cpu)(struct device *dev,
++	void (* const sync_single_for_cpu)(struct device *dev,
+ 				    dma_addr_t dma_handle, size_t size,
+ 				    enum dma_data_direction dir);
+-	void (*sync_single_for_device)(struct device *dev,
++	void (* const sync_single_for_device)(struct device *dev,
+ 				       dma_addr_t dma_handle, size_t size,
+ 				       enum dma_data_direction dir);
+-	void (*sync_single_range_for_cpu)(struct device *dev,
++	void (* const sync_single_range_for_cpu)(struct device *dev,
+ 					  dma_addr_t dma_handle,
+ 					  unsigned long offset,
+ 					  size_t size,
+ 					  enum dma_data_direction dir);
+-	void (*sync_single_range_for_device)(struct device *dev,
++	void (* const sync_single_range_for_device)(struct device *dev,
+ 					     dma_addr_t dma_handle,
+ 					     unsigned long offset,
+ 					     size_t size,
+ 					     enum dma_data_direction dir);
+-	void (*sync_sg_for_cpu)(struct device *dev,
++	void (* const sync_sg_for_cpu)(struct device *dev,
+ 				struct scatterlist *sg, int nents,
+ 				enum dma_data_direction dir);
+-	void (*sync_sg_for_device)(struct device *dev,
++	void (* const sync_sg_for_device)(struct device *dev,
+ 				   struct scatterlist *sg, int nents,
+ 				   enum dma_data_direction dir);
+-	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
+-	int (*dma_supported)(struct device *dev, u64 mask);
++	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
++	int (* const dma_supported)(struct device *dev, u64 mask);
+ 	int (*set_dma_mask)(struct device *dev, u64 mask);
+-	int is_phys;
++	const int is_phys;
+ };
+ 
+ #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+diff -urNp linux-2.6.32.12/include/linux/dst.h linux-2.6.32.12/include/linux/dst.h
+--- linux-2.6.32.12/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/dst.h	2010-04-04 20:46:41.673688119 -0400
+@@ -380,7 +380,7 @@ struct dst_node
+ 	struct thread_pool	*pool;
+ 
+ 	/* Transaction IDs live here */
+-	atomic_long_t		gen;
++	atomic_long_unchecked_t	gen;
+ 
+ 	/*
+ 	 * How frequently and how many times transaction
+diff -urNp linux-2.6.32.12/include/linux/elf.h linux-2.6.32.12/include/linux/elf.h
+--- linux-2.6.32.12/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/elf.h	2010-04-04 20:46:41.673688119 -0400
+@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
+ #define PT_GNU_EH_FRAME		0x6474e550
+ 
+ #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
++#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
++
++#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
++
++/* Constants for the e_flags field */
++#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
++#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
++#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
++#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
++/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
++#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
+ 
+ /* These constants define the different elf file types */
+ #define ET_NONE   0
+@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
+ #define DT_DEBUG	21
+ #define DT_TEXTREL	22
+ #define DT_JMPREL	23
++#define DT_FLAGS	30
++  #define DF_TEXTREL  0x00000004
+ #define DT_ENCODING	32
+ #define OLD_DT_LOOS	0x60000000
+ #define DT_LOOS		0x6000000d
+@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
+ #define PF_W		0x2
+ #define PF_X		0x1
+ 
++#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
++#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
++#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
++#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
++#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
++#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
++/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
++/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
++#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
++#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
++#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
++#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
++
+ typedef struct elf32_phdr{
+   Elf32_Word	p_type;
+   Elf32_Off	p_offset;
+@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
+ #define	EI_OSABI	7
+ #define	EI_PAD		8
+ 
++#define	EI_PAX		14
++
+ #define	ELFMAG0		0x7f		/* EI_MAG */
+ #define	ELFMAG1		'E'
+ #define	ELFMAG2		'L'
+@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
+ #define elf_addr_t	Elf32_Off
++#define elf_dyn		Elf32_Dyn
+ 
+ #else
+ 
+@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
+ #define elf_phdr	elf64_phdr
+ #define elf_note	elf64_note
+ #define elf_addr_t	Elf64_Off
++#define elf_dyn		Elf64_Dyn
+ 
+ #endif
+ 
+diff -urNp linux-2.6.32.12/include/linux/fs.h linux-2.6.32.12/include/linux/fs.h
+--- linux-2.6.32.12/include/linux/fs.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.12/include/linux/fs.h	2010-04-29 17:49:58.621028174 -0400
+@@ -90,6 +90,11 @@ struct inodes_stat_t {
+ /* Expect random access pattern */
+ #define FMODE_RANDOM		((__force fmode_t)4096)
+ 
++/* Hack for grsec so as not to require read permission simply to execute
++ * a binary
++ */
++#define FMODE_GREXEC		((__force fmode_t)8192)
++
+ /*
+  * The below are the various read and write types that we support. Some of
+  * them include behavioral modifiers that send information down to the
+@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
+ 		unsigned long, unsigned long);
+ 
+ struct address_space_operations {
+-	int (*writepage)(struct page *page, struct writeback_control *wbc);
+-	int (*readpage)(struct file *, struct page *);
+-	void (*sync_page)(struct page *);
++	int (* const writepage)(struct page *page, struct writeback_control *wbc);
++	int (* const readpage)(struct file *, struct page *);
++	void (* const sync_page)(struct page *);
+ 
+ 	/* Write back some dirty pages from this mapping. */
+-	int (*writepages)(struct address_space *, struct writeback_control *);
++	int (* const writepages)(struct address_space *, struct writeback_control *);
+ 
+ 	/* Set a page dirty.  Return true if this dirtied it */
+-	int (*set_page_dirty)(struct page *page);
++	int (* const set_page_dirty)(struct page *page);
+ 
+-	int (*readpages)(struct file *filp, struct address_space *mapping,
++	int (* const readpages)(struct file *filp, struct address_space *mapping,
+ 			struct list_head *pages, unsigned nr_pages);
+ 
+-	int (*write_begin)(struct file *, struct address_space *mapping,
++	int (* const write_begin)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned flags,
+ 				struct page **pagep, void **fsdata);
+-	int (*write_end)(struct file *, struct address_space *mapping,
++	int (* const write_end)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned copied,
+ 				struct page *page, void *fsdata);
+ 
+ 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
+-	sector_t (*bmap)(struct address_space *, sector_t);
+-	void (*invalidatepage) (struct page *, unsigned long);
+-	int (*releasepage) (struct page *, gfp_t);
+-	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
++	sector_t (* const bmap)(struct address_space *, sector_t);
++	void (* const invalidatepage) (struct page *, unsigned long);
++	int (* const releasepage) (struct page *, gfp_t);
++	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
+ 			loff_t offset, unsigned long nr_segs);
+-	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
++	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
+ 						void **, unsigned long *);
+ 	/* migrate the contents of a page to the specified target */
+-	int (*migratepage) (struct address_space *,
++	int (* const migratepage) (struct address_space *,
+ 			struct page *, struct page *);
+-	int (*launder_page) (struct page *);
+-	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
++	int (* const launder_page) (struct page *);
++	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
+ 					unsigned long);
+-	int (*error_remove_page)(struct address_space *, struct page *);
++	int (* const error_remove_page)(struct address_space *, struct page *);
+ };
+ 
+ /*
+@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
+ typedef struct files_struct *fl_owner_t;
+ 
+ struct file_lock_operations {
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
+ };
+ 
+ struct lock_manager_operations {
+-	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
+-	void (*fl_notify)(struct file_lock *);	/* unblock callback */
+-	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
+-	void (*fl_break)(struct file_lock *);
+-	int (*fl_mylease)(struct file_lock *, struct file_lock *);
+-	int (*fl_change)(struct file_lock **, int);
++	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
++	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
++	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
++	void (* const fl_break)(struct file_lock *);
++	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
++	int (* const fl_change)(struct file_lock **, int);
+ };
+ 
+ struct lock_manager {
+@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
+ 	unsigned int fi_flags;		/* Flags as passed from user */
+ 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
+ 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
+-	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
++	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
+ 						 * array */
+ };
+ int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
+@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
+ 		unsigned long, loff_t *);
+ 
+ struct super_operations {
+-   	struct inode *(*alloc_inode)(struct super_block *sb);
+-	void (*destroy_inode)(struct inode *);
++   	struct inode *(* const alloc_inode)(struct super_block *sb);
++	void (* const destroy_inode)(struct inode *);
+ 
+-   	void (*dirty_inode) (struct inode *);
+-	int (*write_inode) (struct inode *, int);
+-	void (*drop_inode) (struct inode *);
+-	void (*delete_inode) (struct inode *);
+-	void (*put_super) (struct super_block *);
+-	void (*write_super) (struct super_block *);
+-	int (*sync_fs)(struct super_block *sb, int wait);
+-	int (*freeze_fs) (struct super_block *);
+-	int (*unfreeze_fs) (struct super_block *);
+-	int (*statfs) (struct dentry *, struct kstatfs *);
+-	int (*remount_fs) (struct super_block *, int *, char *);
+-	void (*clear_inode) (struct inode *);
+-	void (*umount_begin) (struct super_block *);
++   	void (* const dirty_inode) (struct inode *);
++	int (* const write_inode) (struct inode *, int);
++	void (* const drop_inode) (struct inode *);
++	void (* const delete_inode) (struct inode *);
++	void (* const put_super) (struct super_block *);
++	void (* const write_super) (struct super_block *);
++	int (* const sync_fs)(struct super_block *sb, int wait);
++	int (* const freeze_fs) (struct super_block *);
++	int (* const unfreeze_fs) (struct super_block *);
++	int (* const statfs) (struct dentry *, struct kstatfs *);
++	int (* const remount_fs) (struct super_block *, int *, char *);
++	void (* const clear_inode) (struct inode *);
++	void (* const umount_begin) (struct super_block *);
+ 
+-	int (*show_options)(struct seq_file *, struct vfsmount *);
+-	int (*show_stats)(struct seq_file *, struct vfsmount *);
++	int (* const show_options)(struct seq_file *, struct vfsmount *);
++	int (* const show_stats)(struct seq_file *, struct vfsmount *);
+ #ifdef CONFIG_QUOTA
+-	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
+-	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
++	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
++	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+ #endif
+-	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
++	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.12/include/linux/fs_struct.h linux-2.6.32.12/include/linux/fs_struct.h
+--- linux-2.6.32.12/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/fs_struct.h	2010-04-04 20:46:41.677383221 -0400
+@@ -4,7 +4,7 @@
+ #include <linux/path.h>
+ 
+ struct fs_struct {
+-	int users;
++	atomic_t users;
+ 	rwlock_t lock;
+ 	int umask;
+ 	int in_exec;
+diff -urNp linux-2.6.32.12/include/linux/genhd.h linux-2.6.32.12/include/linux/genhd.h
+--- linux-2.6.32.12/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/genhd.h	2010-04-04 20:46:41.677383221 -0400
+@@ -161,7 +161,7 @@ struct gendisk {
+ 
+ 	struct timer_rand_state *random;
+ 
+-	atomic_t sync_io;		/* RAID */
++	atomic_unchecked_t sync_io;	/* RAID */
+ 	struct work_struct async_notify;
+ #ifdef  CONFIG_BLK_DEV_INTEGRITY
+ 	struct blk_integrity *integrity;
+diff -urNp linux-2.6.32.12/include/linux/gracl.h linux-2.6.32.12/include/linux/gracl.h
+--- linux-2.6.32.12/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/gracl.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,309 @@
++#ifndef GR_ACL_H
++#define GR_ACL_H
++
++#include <linux/grdefs.h>
++#include <linux/resource.h>
++#include <linux/capability.h>
++#include <linux/dcache.h>
++#include <asm/resource.h>
++
++/* Major status information */
++
++#define GR_VERSION  "grsecurity 2.1.14"
++#define GRSECURITY_VERSION 0x2114
++
++enum {
++	GR_SHUTDOWN = 0,
++	GR_ENABLE = 1,
++	GR_SPROLE = 2,
++	GR_RELOAD = 3,
++	GR_SEGVMOD = 4,
++	GR_STATUS = 5,
++	GR_UNSPROLE = 6,
++	GR_PASSSET = 7,
++	GR_SPROLEPAM = 8,
++};
++
++/* Password setup definitions
++ * kernel/grhash.c */
++enum {
++	GR_PW_LEN = 128,
++	GR_SALT_LEN = 16,
++	GR_SHA_LEN = 32,
++};
++
++enum {
++	GR_SPROLE_LEN = 64,
++};
++
++#define GR_NLIMITS 32
++
++/* Begin Data Structures */
++
++struct sprole_pw {
++	unsigned char *rolename;
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
++};
++
++struct name_entry {
++	__u32 key;
++	ino_t inode;
++	dev_t device;
++	char *name;
++	__u16 len;
++	__u8 deleted;
++	struct name_entry *prev;
++	struct name_entry *next;
++};
++
++struct inodev_entry {
++	struct name_entry *nentry;
++	struct inodev_entry *prev;
++	struct inodev_entry *next;
++};
++
++struct acl_role_db {
++	struct acl_role_label **r_hash;
++	__u32 r_size;
++};
++
++struct inodev_db {
++	struct inodev_entry **i_hash;
++	__u32 i_size;
++};
++
++struct name_db {
++	struct name_entry **n_hash;
++	__u32 n_size;
++};
++
++struct crash_uid {
++	uid_t uid;
++	unsigned long expires;
++};
++
++struct gr_hash_struct {
++	void **table;
++	void **nametable;
++	void *first;
++	__u32 table_size;
++	__u32 used_size;
++	int type;
++};
++
++/* Userspace Grsecurity ACL data structures */
++
++struct acl_subject_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++	kernel_cap_t cap_mask;
++	kernel_cap_t cap_lower;
++
++	struct rlimit res[GR_NLIMITS];
++	__u32 resmask;
++
++	__u8 user_trans_type;
++	__u8 group_trans_type;
++	uid_t *user_transitions;
++	gid_t *group_transitions;
++	__u16 user_trans_num;
++	__u16 group_trans_num;
++
++	__u32 ip_proto[8];
++	__u32 ip_type;
++	struct acl_ip_label **ips;
++	__u32 ip_num;
++	__u32 inaddr_any_override;
++
++	__u32 crashes;
++	unsigned long expires;
++
++	struct acl_subject_label *parent_subject;
++	struct gr_hash_struct *hash;
++	struct acl_subject_label *prev;
++	struct acl_subject_label *next;
++
++	struct acl_object_label **obj_hash;
++	__u32 obj_hash_size;
++	__u16 pax_flags;
++};
++
++struct role_allowed_ip {
++	__u32 addr;
++	__u32 netmask;
++
++	struct role_allowed_ip *prev;
++	struct role_allowed_ip *next;
++};
++
++struct role_transition {
++	char *rolename;
++
++	struct role_transition *prev;
++	struct role_transition *next;
++};
++
++struct acl_role_label {
++	char *rolename;
++	uid_t uidgid;
++	__u16 roletype;
++
++	__u16 auth_attempts;
++	unsigned long expires;
++
++	struct acl_subject_label *root_label;
++	struct gr_hash_struct *hash;
++
++	struct acl_role_label *prev;
++	struct acl_role_label *next;
++
++	struct role_transition *transitions;
++	struct role_allowed_ip *allowed_ips;
++	uid_t *domain_children;
++	__u16 domain_child_num;
++
++	struct acl_subject_label **subj_hash;
++	__u32 subj_hash_size;
++};
++
++struct user_acl_role_db {
++	struct acl_role_label **r_table;
++	__u32 num_pointers;		/* Number of allocations to track */
++	__u32 num_roles;		/* Number of roles */
++	__u32 num_domain_children;	/* Number of domain children */
++	__u32 num_subjects;		/* Number of subjects */
++	__u32 num_objects;		/* Number of objects */
++};
++
++struct acl_object_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++
++	struct acl_subject_label *nested;
++	struct acl_object_label *globbed;
++
++	/* next two structures not used */
++
++	struct acl_object_label *prev;
++	struct acl_object_label *next;
++};
++
++struct acl_ip_label {
++	char *iface;
++	__u32 addr;
++	__u32 netmask;
++	__u16 low, high;
++	__u8 mode;
++	__u32 type;
++	__u32 proto[8];
++
++	/* next two structures not used */
++
++	struct acl_ip_label *prev;
++	struct acl_ip_label *next;
++};
++
++struct gr_arg {
++	struct user_acl_role_db role_db;
++	unsigned char pw[GR_PW_LEN];
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];
++	unsigned char sp_role[GR_SPROLE_LEN];
++	struct sprole_pw *sprole_pws;
++	dev_t segv_device;
++	ino_t segv_inode;
++	uid_t segv_uid;
++	__u16 num_sprole_pws;
++	__u16 mode;
++};
++
++struct gr_arg_wrapper {
++	struct gr_arg *arg;
++	__u32 version;
++	__u32 size;
++};
++
++struct subject_map {
++	struct acl_subject_label *user;
++	struct acl_subject_label *kernel;
++	struct subject_map *prev;
++	struct subject_map *next;
++};
++
++struct acl_subj_map_db {
++	struct subject_map **s_hash;
++	__u32 s_size;
++};
++
++/* End Data Structures Section */
++
++/* Hash functions generated by empirical testing by Brad Spengler
++   Makes good use of the low bits of the inode.  Generally 0-1 times
++   in loop for successful match.  0-3 for unsuccessful match.
++   Shift/add algorithm with modulus of table size and an XOR*/
++
++static __inline__ unsigned int
++rhash(const uid_t uid, const __u16 type, const unsigned int sz)
++{
++	return ((((uid + type) << (16 + type)) ^ uid) % sz);
++}
++
++ static __inline__ unsigned int
++shash(const struct acl_subject_label *userp, const unsigned int sz)
++{
++	return ((const unsigned long)userp % sz);
++}
++
++static __inline__ unsigned int
++fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
++{
++	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
++}
++
++static __inline__ unsigned int
++nhash(const char *name, const __u16 len, const unsigned int sz)
++{
++	return full_name_hash((const unsigned char *)name, len) % sz;
++}
++
++#define FOR_EACH_ROLE_START(role) \
++	role = role_list; \
++	while (role) {
++
++#define FOR_EACH_ROLE_END(role) \
++		role = role->prev; \
++	}
++
++#define FOR_EACH_SUBJECT_START(role,subj,iter) \
++	subj = NULL; \
++	iter = 0; \
++	while (iter < role->subj_hash_size) { \
++		if (subj == NULL) \
++			subj = role->subj_hash[iter]; \
++		if (subj == NULL) { \
++			iter++; \
++			continue; \
++		}
++
++#define FOR_EACH_SUBJECT_END(subj,iter) \
++		subj = subj->next; \
++		if (subj == NULL) \
++			iter++; \
++	}
++
++
++#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
++	subj = role->hash->first; \
++	while (subj != NULL) {
++
++#define FOR_EACH_NESTED_SUBJECT_END(subj) \
++		subj = subj->next; \
++	}
++
++#endif
++
+diff -urNp linux-2.6.32.12/include/linux/gralloc.h linux-2.6.32.12/include/linux/gralloc.h
+--- linux-2.6.32.12/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/gralloc.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,9 @@
++#ifndef __GRALLOC_H
++#define __GRALLOC_H
++
++void acl_free_all(void);
++int acl_alloc_stack_init(unsigned long size);
++void *acl_alloc(unsigned long len);
++void *acl_alloc_num(unsigned long num, unsigned long len);
++
++#endif
+diff -urNp linux-2.6.32.12/include/linux/grdefs.h linux-2.6.32.12/include/linux/grdefs.h
+--- linux-2.6.32.12/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/grdefs.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,136 @@
++#ifndef GRDEFS_H
++#define GRDEFS_H
++
++/* Begin grsecurity status declarations */
++
++enum {
++	GR_READY = 0x01,
++	GR_STATUS_INIT = 0x00	// disabled state
++};
++
++/* Begin  ACL declarations */
++
++/* Role flags */
++
++enum {
++	GR_ROLE_USER = 0x0001,
++	GR_ROLE_GROUP = 0x0002,
++	GR_ROLE_DEFAULT = 0x0004,
++	GR_ROLE_SPECIAL = 0x0008,
++	GR_ROLE_AUTH = 0x0010,
++	GR_ROLE_NOPW = 0x0020,
++	GR_ROLE_GOD = 0x0040,
++	GR_ROLE_LEARN = 0x0080,
++	GR_ROLE_TPE = 0x0100,
++	GR_ROLE_DOMAIN = 0x0200,
++	GR_ROLE_PAM = 0x0400
++};
++
++/* ACL Subject and Object mode flags */
++enum {
++	GR_DELETED = 0x80000000
++};
++
++/* ACL Object-only mode flags */
++enum {
++	GR_READ 	= 0x00000001,
++	GR_APPEND 	= 0x00000002,
++	GR_WRITE 	= 0x00000004,
++	GR_EXEC 	= 0x00000008,
++	GR_FIND 	= 0x00000010,
++	GR_INHERIT 	= 0x00000020,
++	GR_SETID 	= 0x00000040,
++	GR_CREATE 	= 0x00000080,
++	GR_DELETE 	= 0x00000100,
++	GR_LINK		= 0x00000200,
++	GR_AUDIT_READ 	= 0x00000400,
++	GR_AUDIT_APPEND = 0x00000800,
++	GR_AUDIT_WRITE 	= 0x00001000,
++	GR_AUDIT_EXEC 	= 0x00002000,
++	GR_AUDIT_FIND 	= 0x00004000,
++	GR_AUDIT_INHERIT= 0x00008000,
++	GR_AUDIT_SETID 	= 0x00010000,
++	GR_AUDIT_CREATE = 0x00020000,
++	GR_AUDIT_DELETE = 0x00040000,
++	GR_AUDIT_LINK	= 0x00080000,
++	GR_PTRACERD 	= 0x00100000,
++	GR_NOPTRACE	= 0x00200000,
++	GR_SUPPRESS 	= 0x00400000,
++	GR_NOLEARN 	= 0x00800000
++};
++
++#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
++		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
++		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
++
++/* ACL subject-only mode flags */
++enum {
++	GR_KILL 	= 0x00000001,
++	GR_VIEW 	= 0x00000002,
++	GR_PROTECTED 	= 0x00000004,
++	GR_LEARN 	= 0x00000008,
++	GR_OVERRIDE 	= 0x00000010,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_DUMMY 	= 0x00000020,
++	GR_PROTSHM	= 0x00000040,
++	GR_KILLPROC	= 0x00000080,
++	GR_KILLIPPROC	= 0x00000100,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_NOTROJAN	= 0x00000200,
++	GR_PROTPROCFD	= 0x00000400,
++	GR_PROCACCT	= 0x00000800,
++	GR_RELAXPTRACE	= 0x00001000,
++	GR_NESTED	= 0x00002000,
++	GR_INHERITLEARN	= 0x00004000,
++	GR_PROCFIND	= 0x00008000,
++	GR_POVERRIDE	= 0x00010000,
++	GR_KERNELAUTH	= 0x00020000,
++};
++
++enum {
++	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
++	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
++	GR_PAX_ENABLE_MPROTECT	= 0x0004,
++	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
++	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
++	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
++	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
++	GR_PAX_DISABLE_MPROTECT	= 0x0400,
++	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
++	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
++};
++
++enum {
++	GR_ID_USER	= 0x01,
++	GR_ID_GROUP	= 0x02,
++};
++
++enum {
++	GR_ID_ALLOW	= 0x01,
++	GR_ID_DENY	= 0x02,
++};
++
++#define GR_CRASH_RES	31
++#define GR_UIDTABLE_MAX 500
++
++/* begin resource learning section */
++enum {
++	GR_RLIM_CPU_BUMP = 60,
++	GR_RLIM_FSIZE_BUMP = 50000,
++	GR_RLIM_DATA_BUMP = 10000,
++	GR_RLIM_STACK_BUMP = 1000,
++	GR_RLIM_CORE_BUMP = 10000,
++	GR_RLIM_RSS_BUMP = 500000,
++	GR_RLIM_NPROC_BUMP = 1,
++	GR_RLIM_NOFILE_BUMP = 5,
++	GR_RLIM_MEMLOCK_BUMP = 50000,
++	GR_RLIM_AS_BUMP = 500000,
++	GR_RLIM_LOCKS_BUMP = 2,
++	GR_RLIM_SIGPENDING_BUMP = 5,
++	GR_RLIM_MSGQUEUE_BUMP = 10000,
++	GR_RLIM_NICE_BUMP = 1,
++	GR_RLIM_RTPRIO_BUMP = 1,
++	GR_RLIM_RTTIME_BUMP = 1000000
++};
++
++#endif
+diff -urNp linux-2.6.32.12/include/linux/grinternal.h linux-2.6.32.12/include/linux/grinternal.h
+--- linux-2.6.32.12/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/grinternal.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,215 @@
++#ifndef __GRINTERNAL_H
++#define __GRINTERNAL_H
++
++#ifdef CONFIG_GRKERNSEC
++
++#include <linux/fs.h>
++#include <linux/mnt_namespace.h>
++#include <linux/nsproxy.h>
++#include <linux/gracl.h>
++#include <linux/grdefs.h>
++#include <linux/grmsg.h>
++
++void gr_add_learn_entry(const char *fmt, ...)
++	__attribute__ ((format (printf, 1, 2)));
++__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
++			    const struct vfsmount *mnt);
++__u32 gr_check_create(const struct dentry *new_dentry,
++			     const struct dentry *parent,
++			     const struct vfsmount *mnt, const __u32 mode);
++int gr_check_protected_task(const struct task_struct *task);
++__u32 to_gr_audit(const __u32 reqmode);
++int gr_set_acls(const int type);
++
++int gr_acl_is_enabled(void);
++char gr_roletype_to_char(void);
++
++void gr_handle_alertkill(struct task_struct *task);
++char *gr_to_filename(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename1(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename2(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename3(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++
++extern int grsec_enable_harden_ptrace;
++extern int grsec_enable_link;
++extern int grsec_enable_fifo;
++extern int grsec_enable_execve;
++extern int grsec_enable_shm;
++extern int grsec_enable_execlog;
++extern int grsec_enable_signal;
++extern int grsec_enable_audit_ptrace;
++extern int grsec_enable_forkfail;
++extern int grsec_enable_time;
++extern int grsec_enable_rofs;
++extern int grsec_enable_chroot_shmat;
++extern int grsec_enable_chroot_findtask;
++extern int grsec_enable_chroot_mount;
++extern int grsec_enable_chroot_double;
++extern int grsec_enable_chroot_pivot;
++extern int grsec_enable_chroot_chdir;
++extern int grsec_enable_chroot_chmod;
++extern int grsec_enable_chroot_mknod;
++extern int grsec_enable_chroot_fchdir;
++extern int grsec_enable_chroot_nice;
++extern int grsec_enable_chroot_execlog;
++extern int grsec_enable_chroot_caps;
++extern int grsec_enable_chroot_sysctl;
++extern int grsec_enable_chroot_unix;
++extern int grsec_enable_tpe;
++extern int grsec_tpe_gid;
++extern int grsec_enable_tpe_all;
++extern int grsec_enable_sidcaps;
++extern int grsec_enable_socket_all;
++extern int grsec_socket_all_gid;
++extern int grsec_enable_socket_client;
++extern int grsec_socket_client_gid;
++extern int grsec_enable_socket_server;
++extern int grsec_socket_server_gid;
++extern int grsec_audit_gid;
++extern int grsec_enable_group;
++extern int grsec_enable_audit_textrel;
++extern int grsec_enable_mount;
++extern int grsec_enable_chdir;
++extern int grsec_resource_logging;
++extern int grsec_enable_blackhole;
++extern int grsec_lastack_retries;
++extern int grsec_lock;
++
++extern spinlock_t grsec_alert_lock;
++extern unsigned long grsec_alert_wtime;
++extern unsigned long grsec_alert_fyet;
++
++extern spinlock_t grsec_audit_lock;
++
++extern rwlock_t grsec_exec_file_lock;
++
++#define gr_task_fullpath(tsk) (tsk->exec_file ? \
++			gr_to_filename2(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
++			gr_to_filename(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
++			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
++			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
++			    tsk_a->fs->root.dentry)))
++
++#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
++			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
++
++#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
++		       task->pid, cred->uid, \
++		       cred->euid, cred->gid, cred->egid, \
++		       gr_parent_task_fullpath(task), \
++		       task->parent->comm, task->parent->pid, \
++		       pcred->uid, pcred->euid, \
++		       pcred->gid, pcred->egid
++
++#define GR_CHROOT_CAPS {{ \
++	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
++	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
++	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
++	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
++
++#define security_learn(normal_msg,args...) \
++({ \
++	read_lock(&grsec_exec_file_lock); \
++	gr_add_learn_entry(normal_msg "\n", ## args); \
++	read_unlock(&grsec_exec_file_lock); \
++})
++
++enum {
++	GR_DO_AUDIT,
++	GR_DONT_AUDIT,
++	GR_DONT_AUDIT_GOOD
++};
++
++enum {
++	GR_TTYSNIFF,
++	GR_RBAC,
++	GR_RBAC_STR,
++	GR_STR_RBAC,
++	GR_RBAC_MODE2,
++	GR_RBAC_MODE3,
++	GR_FILENAME,
++	GR_SYSCTL_HIDDEN,
++	GR_NOARGS,
++	GR_ONE_INT,
++	GR_ONE_INT_TWO_STR,
++	GR_ONE_STR,
++	GR_STR_INT,
++	GR_TWO_INT,
++	GR_THREE_INT,
++	GR_FIVE_INT_TWO_STR,
++	GR_TWO_STR,
++	GR_THREE_STR,
++	GR_FOUR_STR,
++	GR_STR_FILENAME,
++	GR_FILENAME_STR,
++	GR_FILENAME_TWO_INT,
++	GR_FILENAME_TWO_INT_STR,
++	GR_TEXTREL,
++	GR_PTRACE,
++	GR_RESOURCE,
++	GR_CAP,
++	GR_SIG,
++	GR_SIG2,
++	GR_CRASH1,
++	GR_CRASH2,
++	GR_PSACCT
++};
++
++#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
++#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
++#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
++#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
++#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
++#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
++#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
++#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
++#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
++#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
++#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
++#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
++#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
++#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
++#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
++#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
++#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
++#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
++#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
++#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
++#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
++#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
++#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
++#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
++#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
++#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
++#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
++#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
++#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
++#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
++#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
++#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
++
++#endif
++
++#endif
+diff -urNp linux-2.6.32.12/include/linux/grmsg.h linux-2.6.32.12/include/linux/grmsg.h
+--- linux-2.6.32.12/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/grmsg.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,107 @@
++#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
++#define GR_STOPMOD_MSG "denied modification of module state by "
++#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
++#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
++#define GR_IOPERM_MSG "denied use of ioperm() by "
++#define GR_IOPL_MSG "denied use of iopl() by "
++#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
++#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
++#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
++#define GR_KMEM_MSG "denied write of /dev/kmem by "
++#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
++#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
++#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
++#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
++#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
++#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
++#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
++#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
++#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
++#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
++#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
++#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
++#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
++#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
++#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
++#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
++#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
++#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
++#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
++#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
++#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
++#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
++#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
++#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
++#define GR_NPROC_MSG "denied overstep of process limit by "
++#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
++#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
++#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
++#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
++#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
++#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
++#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
++#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
++#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
++#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
++#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
++#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
++#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
++#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
++#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
++#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
++#define GR_INITF_ACL_MSG "init_variables() failed %s by "
++#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
++#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
++#define GR_SHUTS_ACL_MSG "shutdown auth success for "
++#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
++#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
++#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
++#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
++#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
++#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
++#define GR_ENABLEF_ACL_MSG "unable to load %s for "
++#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
++#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
++#define GR_RELOADF_ACL_MSG "failed reload of %s for "
++#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
++#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
++#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
++#define GR_SPROLEF_ACL_MSG "special role %s failure for "
++#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
++#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
++#define GR_INVMODE_ACL_MSG "invalid mode %d by "
++#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
++#define GR_FAILFORK_MSG "failed fork with errno %d by "
++#define GR_NICE_CHROOT_MSG "denied priority change by "
++#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
++#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
++#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
++#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
++#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
++#define GR_TIME_MSG "time set by "
++#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
++#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
++#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
++#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
++#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
++#define GR_BIND_MSG "denied bind() by "
++#define GR_CONNECT_MSG "denied connect() by "
++#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
++#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
++#define GR_CAP_ACL_MSG "use of %s denied for "
++#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
++#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
++#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
++#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
++#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
++#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
++#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
++#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
++#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
++#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
++#define GR_VM86_MSG "denied use of vm86 by "
++#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
+diff -urNp linux-2.6.32.12/include/linux/grsecurity.h linux-2.6.32.12/include/linux/grsecurity.h
+--- linux-2.6.32.12/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/include/linux/grsecurity.h	2010-04-04 20:46:41.677383221 -0400
+@@ -0,0 +1,199 @@
++#ifndef GR_SECURITY_H
++#define GR_SECURITY_H
++#include <linux/fs.h>
++#include <linux/fs_struct.h>
++#include <linux/binfmts.h>
++#include <linux/gracl.h>
++
++/* notify of brain-dead configs */
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
++#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
++#endif
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
++#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
++#endif
++#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
++#error "CONFIG_PAX enabled, but no PaX options are enabled."
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p);
++void gr_handle_brute_check(void);
++
++char gr_roletype_to_char(void);
++
++int gr_check_user_change(int real, int effective, int fs);
++int gr_check_group_change(int real, int effective, int fs);
++
++void gr_del_task_from_ip_table(struct task_struct *p);
++
++int gr_pid_is_chrooted(struct task_struct *p);
++int gr_handle_chroot_nice(void);
++int gr_handle_chroot_sysctl(const int op);
++int gr_handle_chroot_setpriority(struct task_struct *p,
++					const int niceval);
++int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
++int gr_handle_chroot_chroot(const struct dentry *dentry,
++				   const struct vfsmount *mnt);
++int gr_handle_chroot_caps(struct path *path);
++void gr_handle_chroot_chdir(struct path *path);
++int gr_handle_chroot_chmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mknod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mount(const struct dentry *dentry,
++				  const struct vfsmount *mnt,
++				  const char *dev_name);
++int gr_handle_chroot_pivot(void);
++int gr_handle_chroot_unix(const pid_t pid);
++
++int gr_handle_rawio(const struct inode *inode);
++int gr_handle_nproc(void);
++
++void gr_handle_ioperm(void);
++void gr_handle_iopl(void);
++
++int gr_tpe_allow(const struct file *file);
++
++int gr_random_pid(void);
++
++void gr_log_forkfail(const int retval);
++void gr_log_timechange(void);
++void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
++void gr_log_chdir(const struct dentry *dentry,
++			 const struct vfsmount *mnt);
++void gr_log_chroot_exec(const struct dentry *dentry,
++			       const struct vfsmount *mnt);
++void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
++void gr_log_remount(const char *devname, const int retval);
++void gr_log_unmount(const char *devname, const int retval);
++void gr_log_mount(const char *from, const char *to, const int retval);
++void gr_log_textrel(struct vm_area_struct *vma);
++
++int gr_handle_follow_link(const struct inode *parent,
++				 const struct inode *inode,
++				 const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_fifo(const struct dentry *dentry,
++			  const struct vfsmount *mnt,
++			  const struct dentry *dir, const int flag,
++			  const int acc_mode);
++int gr_handle_hardlink(const struct dentry *dentry,
++			      const struct vfsmount *mnt,
++			      struct inode *inode,
++			      const int mode, const char *to);
++
++int gr_is_capable(const int cap);
++int gr_is_capable_nolog(const int cap);
++void gr_learn_resource(const struct task_struct *task, const int limit,
++			      const unsigned long wanted, const int gt);
++void gr_copy_label(struct task_struct *tsk);
++void gr_handle_crash(struct task_struct *task, const int sig);
++int gr_handle_signal(const struct task_struct *p, const int sig);
++int gr_check_crash_uid(const uid_t uid);
++int gr_check_protected_task(const struct task_struct *task);
++int gr_acl_handle_mmap(const struct file *file,
++			      const unsigned long prot);
++int gr_acl_handle_mprotect(const struct file *file,
++				  const unsigned long prot);
++int gr_check_hidden_task(const struct task_struct *tsk);
++__u32 gr_acl_handle_truncate(const struct dentry *dentry,
++				    const struct vfsmount *mnt);
++__u32 gr_acl_handle_utime(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++__u32 gr_acl_handle_access(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chmod(const struct dentry *dentry,
++				 const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chown(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_ptrace(struct task_struct *task, const long request);
++int gr_handle_proc_ptrace(struct task_struct *task);
++__u32 gr_acl_handle_execve(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++int gr_check_crash_exec(const struct file *filp);
++int gr_acl_is_enabled(void);
++void gr_set_kernel_label(struct task_struct *task);
++void gr_set_role_label(struct task_struct *task, const uid_t uid,
++			      const gid_t gid);
++int gr_set_proc_label(const struct dentry *dentry,
++			const struct vfsmount *mnt,
++			const int unsafe_share);
++__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++__u32 gr_acl_handle_open(const struct dentry *dentry,
++				const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_creat(const struct dentry *dentry,
++				 const struct dentry *p_dentry,
++				 const struct vfsmount *p_mnt, const int fmode,
++				 const int imode);
++void gr_handle_create(const struct dentry *dentry,
++			     const struct vfsmount *mnt);
++__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt,
++				 const int mode);
++__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt);
++__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++void gr_handle_delete(const ino_t ino, const dev_t dev);
++__u32 gr_acl_handle_unlink(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
++				   const struct dentry *parent_dentry,
++				   const struct vfsmount *parent_mnt,
++				   const char *from);
++__u32 gr_acl_handle_link(const struct dentry *new_dentry,
++				const struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				const struct dentry *old_dentry,
++				const struct vfsmount *old_mnt, const char *to);
++int gr_acl_handle_rename(struct dentry *new_dentry,
++				struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				struct dentry *old_dentry,
++				struct inode *old_parent_inode,
++				struct vfsmount *old_mnt, const char *newname);
++void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++				struct dentry *old_dentry,
++				struct dentry *new_dentry,
++				struct vfsmount *mnt, const __u8 replace);
++__u32 gr_check_link(const struct dentry *new_dentry,
++			   const struct dentry *parent_dentry,
++			   const struct vfsmount *parent_mnt,
++			   const struct dentry *old_dentry,
++			   const struct vfsmount *old_mnt);
++int gr_acl_handle_filldir(const struct file *file, const char *name,
++				 const unsigned int namelen, const ino_t ino);
++
++__u32 gr_acl_handle_unix(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++void gr_acl_handle_exit(void);
++void gr_acl_handle_psacct(struct task_struct *task, const long code);
++int gr_acl_handle_procpidmem(const struct task_struct *task);
++int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
++int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
++void gr_audit_ptrace(struct task_struct *task);
++
++#ifdef CONFIG_GRKERNSEC
++void gr_log_nonroot_mod_load(const char *modname);
++void gr_handle_vm86(void);
++void gr_handle_mem_write(void);
++void gr_handle_kmem_write(void);
++void gr_handle_open_port(void);
++int gr_handle_mem_mmap(const unsigned long offset,
++			      struct vm_area_struct *vma);
++
++extern int grsec_enable_dmesg;
++#endif
++
++#endif
+diff -urNp linux-2.6.32.12/include/linux/hdpu_features.h linux-2.6.32.12/include/linux/hdpu_features.h
+--- linux-2.6.32.12/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/hdpu_features.h	2010-04-04 20:46:41.677383221 -0400
+@@ -3,7 +3,7 @@
+ struct cpustate_t {
+ 	spinlock_t lock;
+ 	int excl;
+-        int open_count;
++	atomic_t open_count;
+ 	unsigned char cached_val;
+ 	int inited;
+ 	unsigned long *set_addr;
+diff -urNp linux-2.6.32.12/include/linux/highmem.h linux-2.6.32.12/include/linux/highmem.h
+--- linux-2.6.32.12/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/highmem.h	2010-04-04 20:46:41.677383221 -0400
+@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
+ 	kunmap_atomic(kaddr, KM_USER0);
+ }
+ 
++static inline void sanitize_highpage(struct page *page)
++{
++	void *kaddr;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	kaddr = kmap_atomic(page, KM_CLEARPAGE);
++	clear_page(kaddr);
++	kunmap_atomic(kaddr, KM_CLEARPAGE);
++	local_irq_restore(flags);
++}
++
+ static inline void zero_user_segments(struct page *page,
+ 	unsigned start1, unsigned end1,
+ 	unsigned start2, unsigned end2)
+diff -urNp linux-2.6.32.12/include/linux/init_task.h linux-2.6.32.12/include/linux/init_task.h
+--- linux-2.6.32.12/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/init_task.h	2010-04-04 20:46:41.677383221 -0400
+@@ -115,6 +115,13 @@ extern struct cred init_cred;
+ # define INIT_PERF_EVENTS(tsk)
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++# define INIT_GR_FS_LOCK					\
++	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
++#else
++# define INIT_GR_FS_LOCK
++#endif
++
+ /*
+  *  INIT_TASK is used to set up the first task table, touch at
+  * your own risk!. Base=0, limit=0x1fffff (=2MB)
+@@ -184,6 +191,7 @@ extern struct cred init_cred;
+ 	INIT_FTRACE_GRAPH						\
+ 	INIT_TRACE_RECURSION						\
+ 	INIT_TASK_RCU_PREEMPT(tsk)					\
++	INIT_GR_FS_LOCK							\
+ }
+ 
+ 
+diff -urNp linux-2.6.32.12/include/linux/interrupt.h linux-2.6.32.12/include/linux/interrupt.h
+--- linux-2.6.32.12/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/interrupt.h	2010-04-04 20:46:41.677383221 -0400
+@@ -357,7 +357,7 @@ enum
+ /* map softirq index to softirq name. update 'softirq_to_name' in
+  * kernel/softirq.c when adding a new softirq.
+  */
+-extern char *softirq_to_name[NR_SOFTIRQS];
++extern const char * const softirq_to_name[NR_SOFTIRQS];
+ 
+ /* softirq mask and active fields moved to irq_cpustat_t in
+  * asm/hardirq.h to get better cache usage.  KAO
+@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
+ 
+ struct softirq_action
+ {
+-	void	(*action)(struct softirq_action *);
++	void	(*action)(void);
+ };
+ 
+ asmlinkage void do_softirq(void);
+ asmlinkage void __do_softirq(void);
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
+ extern void raise_softirq_irqoff(unsigned int nr);
+diff -urNp linux-2.6.32.12/include/linux/jbd2.h linux-2.6.32.12/include/linux/jbd2.h
+--- linux-2.6.32.12/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/jbd2.h	2010-04-04 20:46:41.677383221 -0400
+@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd2_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.12/include/linux/jbd.h linux-2.6.32.12/include/linux/jbd.h
+--- linux-2.6.32.12/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/jbd.h	2010-04-04 20:46:41.677383221 -0400
+@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.12/include/linux/kallsyms.h linux-2.6.32.12/include/linux/kallsyms.h
+--- linux-2.6.32.12/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/kallsyms.h	2010-04-04 20:46:41.677383221 -0400
+@@ -15,7 +15,8 @@
+ 
+ struct module;
+ 
+-#ifdef CONFIG_KALLSYMS
++#ifndef __INCLUDED_BY_HIDESYM
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ /* Lookup the address for a symbol. Returns 0 if not found. */
+ unsigned long kallsyms_lookup_name(const char *name);
+ 
+@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
+ /* Stupid that this does nothing, but I didn't create this mess. */
+ #define __print_symbol(fmt, addr)
+ #endif /*CONFIG_KALLSYMS*/
++#else /* when included by kallsyms.c, with HIDESYM enabled */
++extern void __print_symbol(const char *fmt, unsigned long address);
++#endif
+ 
+ /* This macro allows us to keep printk typechecking */
+ static void __check_printsym_format(const char *fmt, ...)
+diff -urNp linux-2.6.32.12/include/linux/kgdb.h linux-2.6.32.12/include/linux/kgdb.h
+--- linux-2.6.32.12/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/kgdb.h	2010-04-04 20:46:41.677383221 -0400
+@@ -251,20 +251,20 @@ struct kgdb_arch {
+  */
+ struct kgdb_io {
+ 	const char		*name;
+-	int			(*read_char) (void);
+-	void			(*write_char) (u8);
+-	void			(*flush) (void);
+-	int			(*init) (void);
+-	void			(*pre_exception) (void);
+-	void			(*post_exception) (void);
++	int			(* const read_char) (void);
++	void			(* const write_char) (u8);
++	void			(* const flush) (void);
++	int			(* const init) (void);
++	void			(* const pre_exception) (void);
++	void			(* const post_exception) (void);
+ };
+ 
+-extern struct kgdb_arch		arch_kgdb_ops;
++extern const struct kgdb_arch arch_kgdb_ops;
+ 
+ extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
+ 
+-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
+-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
++extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
++extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
+ 
+ extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
+ extern int kgdb_mem2hex(char *mem, char *buf, int count);
+diff -urNp linux-2.6.32.12/include/linux/kobject.h linux-2.6.32.12/include/linux/kobject.h
+--- linux-2.6.32.12/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/kobject.h	2010-04-04 20:46:41.677383221 -0400
+@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
+ 
+ struct kobj_type {
+ 	void (*release)(struct kobject *kobj);
+-	struct sysfs_ops *sysfs_ops;
++	const struct sysfs_ops *sysfs_ops;
+ 	struct attribute **default_attrs;
+ };
+ 
+@@ -118,9 +118,9 @@ struct kobj_uevent_env {
+ };
+ 
+ struct kset_uevent_ops {
+-	int (*filter)(struct kset *kset, struct kobject *kobj);
+-	const char *(*name)(struct kset *kset, struct kobject *kobj);
+-	int (*uevent)(struct kset *kset, struct kobject *kobj,
++	int (* const filter)(struct kset *kset, struct kobject *kobj);
++	const char *(* const name)(struct kset *kset, struct kobject *kobj);
++	int (* const uevent)(struct kset *kset, struct kobject *kobj,
+ 		      struct kobj_uevent_env *env);
+ };
+ 
+@@ -132,7 +132,7 @@ struct kobj_attribute {
+ 			 const char *buf, size_t count);
+ };
+ 
+-extern struct sysfs_ops kobj_sysfs_ops;
++extern const struct sysfs_ops kobj_sysfs_ops;
+ 
+ /**
+  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
+@@ -155,14 +155,14 @@ struct kset {
+ 	struct list_head list;
+ 	spinlock_t list_lock;
+ 	struct kobject kobj;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ };
+ 
+ extern void kset_init(struct kset *kset);
+ extern int __must_check kset_register(struct kset *kset);
+ extern void kset_unregister(struct kset *kset);
+ extern struct kset * __must_check kset_create_and_add(const char *name,
+-						struct kset_uevent_ops *u,
++						const struct kset_uevent_ops *u,
+ 						struct kobject *parent_kobj);
+ 
+ static inline struct kset *to_kset(struct kobject *kobj)
+diff -urNp linux-2.6.32.12/include/linux/kvm_host.h linux-2.6.32.12/include/linux/kvm_host.h
+--- linux-2.6.32.12/include/linux/kvm_host.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.12/include/linux/kvm_host.h	2010-04-29 17:49:58.621028174 -0400
+@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
+ void vcpu_load(struct kvm_vcpu *vcpu);
+ void vcpu_put(struct kvm_vcpu *vcpu);
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module);
+ void kvm_exit(void);
+ 
+@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
+ 					struct kvm_guest_debug *dbg);
+ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
+ 
+-int kvm_arch_init(void *opaque);
++int kvm_arch_init(const void *opaque);
+ void kvm_arch_exit(void);
+ 
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
+diff -urNp linux-2.6.32.12/include/linux/libata.h linux-2.6.32.12/include/linux/libata.h
+--- linux-2.6.32.12/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/libata.h	2010-04-04 20:46:41.677383221 -0400
+@@ -64,11 +64,11 @@
+ #ifdef ATA_VERBOSE_DEBUG
+ #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+ #else
+-#define VPRINTK(fmt, args...)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_VERBOSE_DEBUG */
+ #else
+-#define DPRINTK(fmt, args...)
+-#define VPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_DEBUG */
+ 
+ #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+@@ -524,11 +524,11 @@ struct ata_ioports {
+ 
+ struct ata_host {
+ 	spinlock_t		lock;
+-	struct device 		*dev;
++	struct device		*dev;
+ 	void __iomem * const	*iomap;
+ 	unsigned int		n_ports;
+ 	void			*private_data;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned long		flags;
+ #ifdef CONFIG_ATA_ACPI
+ 	acpi_handle		acpi_handle;
+@@ -709,7 +709,7 @@ struct ata_link {
+ 
+ struct ata_port {
+ 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	spinlock_t		*lock;
+ 	/* Flags owned by the EH context. Only EH should touch these once the
+ 	   port is active */
+@@ -891,7 +891,7 @@ struct ata_port_info {
+ 	unsigned long		pio_mask;
+ 	unsigned long		mwdma_mask;
+ 	unsigned long		udma_mask;
+-	struct ata_port_operations *port_ops;
++	const struct ata_port_operations *port_ops;
+ 	void 			*private_data;
+ };
+ 
+@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
+ extern const unsigned long sata_deb_timing_hotplug[];
+ extern const unsigned long sata_deb_timing_long[];
+ 
+-extern struct ata_port_operations ata_dummy_port_ops;
++extern const struct ata_port_operations ata_dummy_port_ops;
+ extern const struct ata_port_info ata_dummy_port_info;
+ 
+ static inline const unsigned long *
+@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
+ 			     struct scsi_host_template *sht);
+ extern void ata_host_detach(struct ata_host *host);
+ extern void ata_host_init(struct ata_host *, struct device *,
+-			  unsigned long, struct ata_port_operations *);
++			  unsigned long, const struct ata_port_operations *);
+ extern int ata_scsi_detect(struct scsi_host_template *sht);
+ extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
+ extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
+diff -urNp linux-2.6.32.12/include/linux/lockd/bind.h linux-2.6.32.12/include/linux/lockd/bind.h
+--- linux-2.6.32.12/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/lockd/bind.h	2010-04-04 20:46:41.681061354 -0400
+@@ -23,13 +23,13 @@ struct svc_rqst;
+  * This is the set of functions for lockd->nfsd communication
+  */
+ struct nlmsvc_binding {
+-	__be32			(*fopen)(struct svc_rqst *,
++	__be32			(* const fopen)(struct svc_rqst *,
+ 						struct nfs_fh *,
+ 						struct file **);
+-	void			(*fclose)(struct file *);
++	void			(* const fclose)(struct file *);
+ };
+ 
+-extern struct nlmsvc_binding *	nlmsvc_ops;
++extern const struct nlmsvc_binding *	nlmsvc_ops;
+ 
+ /*
+  * Similar to nfs_client_initdata, but without the NFS-specific
+diff -urNp linux-2.6.32.12/include/linux/mm.h linux-2.6.32.12/include/linux/mm.h
+--- linux-2.6.32.12/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/mm.h	2010-04-04 20:46:41.681061354 -0400
+@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
+ #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
+ #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
++#endif
++
+ #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
+ #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
+ #endif
+@@ -880,6 +884,8 @@ struct shrinker {
+ extern void register_shrinker(struct shrinker *);
+ extern void unregister_shrinker(struct shrinker *);
+ 
++pgprot_t vm_get_page_prot(unsigned long vm_flags);
++
+ int vma_wants_writenotify(struct vm_area_struct *vma);
+ 
+ extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
+@@ -1152,6 +1158,7 @@ out:
+ }
+ 
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
++extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
+ 
+@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
+ extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
+ 					     struct vm_area_struct **pprev);
+ 
++extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
++extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
++extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
++
+ /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
+    NULL if none.  Assume start_addr < end_addr. */
+ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
+@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
+ 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ }
+ 
+-pgprot_t vm_get_page_prot(unsigned long vm_flags);
+ struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
+ int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
+ 			unsigned long pfn, unsigned long size, pgprot_t);
+@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
+ extern int __memory_failure(unsigned long pfn, int trapno, int ref);
+ extern int sysctl_memory_failure_early_kill;
+ extern int sysctl_memory_failure_recovery;
+-extern atomic_long_t mce_bad_pages;
++extern atomic_long_unchecked_t mce_bad_pages;
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
++#else
++static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
++#endif
+ 
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_MM_H */
+diff -urNp linux-2.6.32.12/include/linux/mm_types.h linux-2.6.32.12/include/linux/mm_types.h
+--- linux-2.6.32.12/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/mm_types.h	2010-04-04 20:46:41.681061354 -0400
+@@ -186,6 +186,8 @@ struct vm_area_struct {
+ #ifdef CONFIG_NUMA
+ 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
+ #endif
++
++	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
+ };
+ 
+ struct core_thread {
+@@ -287,6 +289,24 @@ struct mm_struct {
+ #ifdef CONFIG_MMU_NOTIFIER
+ 	struct mmu_notifier_mm *mmu_notifier_mm;
+ #endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	unsigned long pax_flags;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	unsigned long call_dl_resolve;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	unsigned long call_syscall;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	unsigned long delta_mmap;		/* randomized offset */
++	unsigned long delta_stack;		/* randomized offset */
++#endif
++
+ };
+ 
+ /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
+diff -urNp linux-2.6.32.12/include/linux/mmu_notifier.h linux-2.6.32.12/include/linux/mmu_notifier.h
+--- linux-2.6.32.12/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/mmu_notifier.h	2010-04-04 20:46:41.681061354 -0400
+@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
+  */
+ #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
+ ({									\
+-	pte_t __pte;							\
++	pte_t ___pte;							\
+ 	struct vm_area_struct *___vma = __vma;				\
+ 	unsigned long ___address = __address;				\
+-	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
++	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
+ 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
+-	__pte;								\
++	___pte;								\
+ })
+ 
+ #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
+diff -urNp linux-2.6.32.12/include/linux/mod_devicetable.h linux-2.6.32.12/include/linux/mod_devicetable.h
+--- linux-2.6.32.12/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/mod_devicetable.h	2010-04-04 20:46:41.681061354 -0400
+@@ -12,7 +12,7 @@
+ typedef unsigned long kernel_ulong_t;
+ #endif
+ 
+-#define PCI_ANY_ID (~0)
++#define PCI_ANY_ID ((__u16)~0)
+ 
+ struct pci_device_id {
+ 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
+@@ -131,7 +131,7 @@ struct usb_device_id {
+ #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
+ #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
+ 
+-#define HID_ANY_ID				(~0)
++#define HID_ANY_ID				(~0U)
+ 
+ struct hid_device_id {
+ 	__u16 bus;
+diff -urNp linux-2.6.32.12/include/linux/module.h linux-2.6.32.12/include/linux/module.h
+--- linux-2.6.32.12/include/linux/module.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.12/include/linux/module.h	2010-04-29 17:49:58.621028174 -0400
+@@ -287,16 +287,16 @@ struct module
+ 	int (*init)(void);
+ 
+ 	/* If this is non-NULL, vfree after init() returns */
+-	void *module_init;
++	void *module_init_rx, *module_init_rw;
+ 
+ 	/* Here is the actual code + data, vfree'd on unload. */
+-	void *module_core;
++	void *module_core_rx, *module_core_rw;
+ 
+ 	/* Here are the sizes of the init and core sections */
+-	unsigned int init_size, core_size;
++	unsigned int init_size_rw, core_size_rw;
+ 
+ 	/* The size of the executable code in each section.  */
+-	unsigned int init_text_size, core_text_size;
++	unsigned int init_size_rx, core_size_rx;
+ 
+ 	/* Arch-specific module values */
+ 	struct mod_arch_specific arch;
+@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
+ bool is_module_address(unsigned long addr);
+ bool is_module_text_address(unsigned long addr);
+ 
++static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	if (ktla_ktva(addr) >= (unsigned long)start &&
++	    ktla_ktva(addr) < (unsigned long)start + size)
++		return 1;
++#endif
++
++	return ((void *)addr >= start && (void *)addr < start + size);
++}
++
++static inline int within_module_core_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
++}
++
++static inline int within_module_core_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
++}
++
++static inline int within_module_init_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
++}
++
++static inline int within_module_init_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
++}
++
+ static inline int within_module_core(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_core <= addr &&
+-	       addr < (unsigned long)mod->module_core + mod->core_size;
++	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
+ }
+ 
+ static inline int within_module_init(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_init <= addr &&
+-	       addr < (unsigned long)mod->module_init + mod->init_size;
++	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
+ }
+ 
+ /* Search for module by name: must hold module_mutex. */
+diff -urNp linux-2.6.32.12/include/linux/moduleloader.h linux-2.6.32.12/include/linux/moduleloader.h
+--- linux-2.6.32.12/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/moduleloader.h	2010-04-04 20:46:41.681061354 -0400
+@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
+    sections.  Returns NULL on failure. */
+ void *module_alloc(unsigned long size);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void *module_alloc_exec(unsigned long size);
++#else
++#define module_alloc_exec(x) module_alloc(x)
++#endif
++
+ /* Free memory returned from module_alloc. */
+ void module_free(struct module *mod, void *module_region);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region);
++#else
++#define module_free_exec(x, y) module_free((x), (y))
++#endif
++
+ /* Apply the given relocation to the (simplified) ELF.  Return -error
+    or 0. */
+ int apply_relocate(Elf_Shdr *sechdrs,
+diff -urNp linux-2.6.32.12/include/linux/namei.h linux-2.6.32.12/include/linux/namei.h
+--- linux-2.6.32.12/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/namei.h	2010-04-04 20:46:41.681061354 -0400
+@@ -22,7 +22,7 @@ struct nameidata {
+ 	unsigned int	flags;
+ 	int		last_type;
+ 	unsigned	depth;
+-	char *saved_names[MAX_NESTED_LINKS + 1];
++	const char *saved_names[MAX_NESTED_LINKS + 1];
+ 
+ 	/* Intent data */
+ 	union {
+@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
+ extern struct dentry *lock_rename(struct dentry *, struct dentry *);
+ extern void unlock_rename(struct dentry *, struct dentry *);
+ 
+-static inline void nd_set_link(struct nameidata *nd, char *path)
++static inline void nd_set_link(struct nameidata *nd, const char *path)
+ {
+ 	nd->saved_names[nd->depth] = path;
+ }
+ 
+-static inline char *nd_get_link(struct nameidata *nd)
++static inline const char *nd_get_link(const struct nameidata *nd)
+ {
+ 	return nd->saved_names[nd->depth];
+ }
+diff -urNp linux-2.6.32.12/include/linux/nodemask.h linux-2.6.32.12/include/linux/nodemask.h
+--- linux-2.6.32.12/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/nodemask.h	2010-04-04 20:46:41.681061354 -0400
+@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
+ 
+ #define any_online_node(mask)			\
+ ({						\
+-	int node;				\
+-	for_each_node_mask(node, (mask))	\
+-		if (node_online(node))		\
++	int __node;				\
++	for_each_node_mask(__node, (mask))	\
++		if (node_online(__node))	\
+ 			break;			\
+-	node;					\
++	__node;					\
+ })
+ 
+ #define num_online_nodes()	num_node_state(N_ONLINE)
+diff -urNp linux-2.6.32.12/include/linux/oprofile.h linux-2.6.32.12/include/linux/oprofile.h
+--- linux-2.6.32.12/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/oprofile.h	2010-04-04 20:46:41.681061354 -0400
+@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
+ int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
+ 	char const * name, ulong * val);
+  
+-/** Create a file for read-only access to an atomic_t. */
++/** Create a file for read-only access to an atomic_unchecked_t. */
+ int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
+-	char const * name, atomic_t * val);
++	char const * name, atomic_unchecked_t * val);
+  
+ /** create a directory */
+ struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
+diff -urNp linux-2.6.32.12/include/linux/pipe_fs_i.h linux-2.6.32.12/include/linux/pipe_fs_i.h
+--- linux-2.6.32.12/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/pipe_fs_i.h	2010-04-04 20:46:41.681061354 -0400
+@@ -46,9 +46,9 @@ struct pipe_inode_info {
+ 	wait_queue_head_t wait;
+ 	unsigned int nrbufs, curbuf;
+ 	struct page *tmp_page;
+-	unsigned int readers;
+-	unsigned int writers;
+-	unsigned int waiting_writers;
++	atomic_t readers;
++	atomic_t writers;
++	atomic_t waiting_writers;
+ 	unsigned int r_counter;
+ 	unsigned int w_counter;
+ 	struct fasync_struct *fasync_readers;
+diff -urNp linux-2.6.32.12/include/linux/poison.h linux-2.6.32.12/include/linux/poison.h
+--- linux-2.6.32.12/include/linux/poison.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/poison.h	2010-04-04 20:46:41.681061354 -0400
+@@ -7,8 +7,8 @@
+  * under normal circumstances, used to verify that nobody uses
+  * non-initialized list entries.
+  */
+-#define LIST_POISON1  ((void *) 0x00100100)
+-#define LIST_POISON2  ((void *) 0x00200200)
++#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
++#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
+ 
+ /********** include/linux/timer.h **********/
+ /*
+diff -urNp linux-2.6.32.12/include/linux/proc_fs.h linux-2.6.32.12/include/linux/proc_fs.h
+--- linux-2.6.32.12/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/proc_fs.h	2010-04-04 20:46:41.681061354 -0400
+@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
+ 	return proc_create_data(name, mode, parent, proc_fops, NULL);
+ }
+ 
++static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
++	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
++{
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
++#else
++	return proc_create_data(name, mode, parent, proc_fops, NULL);
++#endif
++}
++	
++
+ static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
+ 	mode_t mode, struct proc_dir_entry *base, 
+ 	read_proc_t *read_proc, void * data)
+diff -urNp linux-2.6.32.12/include/linux/random.h linux-2.6.32.12/include/linux/random.h
+--- linux-2.6.32.12/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/random.h	2010-04-04 20:46:41.681061354 -0400
+@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
+ u32 random32(void);
+ void srandom32(u32 seed);
+ 
++static inline unsigned long pax_get_random_long(void)
++{
++	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
++}
++
+ #endif /* __KERNEL___ */
+ 
+ #endif /* _LINUX_RANDOM_H */
+diff -urNp linux-2.6.32.12/include/linux/reiserfs_fs.h linux-2.6.32.12/include/linux/reiserfs_fs.h
+--- linux-2.6.32.12/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/reiserfs_fs.h	2010-04-04 20:46:41.681061354 -0400
+@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
+ #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
+ 
+ #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
+-#define get_generation(s) atomic_read (&fs_generation(s))
++#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
+ #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
+ #define __fs_changed(gen,s) (gen != get_generation (s))
+ #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
+@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
+ */
+ 
+ struct item_operations {
+-	int (*bytes_number) (struct item_head * ih, int block_size);
+-	void (*decrement_key) (struct cpu_key *);
+-	int (*is_left_mergeable) (struct reiserfs_key * ih,
++	int (* const bytes_number) (struct item_head * ih, int block_size);
++	void (* const decrement_key) (struct cpu_key *);
++	int (* const is_left_mergeable) (struct reiserfs_key * ih,
+ 				  unsigned long bsize);
+-	void (*print_item) (struct item_head *, char *item);
+-	void (*check_item) (struct item_head *, char *item);
++	void (* const print_item) (struct item_head *, char *item);
++	void (* const check_item) (struct item_head *, char *item);
+ 
+-	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
++	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
+ 			  int is_affected, int insert_size);
+-	int (*check_left) (struct virtual_item * vi, int free,
++	int (* const check_left) (struct virtual_item * vi, int free,
+ 			   int start_skip, int end_skip);
+-	int (*check_right) (struct virtual_item * vi, int free);
+-	int (*part_size) (struct virtual_item * vi, int from, int to);
+-	int (*unit_num) (struct virtual_item * vi);
+-	void (*print_vi) (struct virtual_item * vi);
++	int (* const check_right) (struct virtual_item * vi, int free);
++	int (* const part_size) (struct virtual_item * vi, int from, int to);
++	int (* const unit_num) (struct virtual_item * vi);
++	void (* const print_vi) (struct virtual_item * vi);
+ };
+ 
+-extern struct item_operations *item_ops[TYPE_ANY + 1];
++extern const struct item_operations * const item_ops[TYPE_ANY + 1];
+ 
+ #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
+ #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
+diff -urNp linux-2.6.32.12/include/linux/reiserfs_fs_sb.h linux-2.6.32.12/include/linux/reiserfs_fs_sb.h
+--- linux-2.6.32.12/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/reiserfs_fs_sb.h	2010-04-04 20:46:41.681061354 -0400
+@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
+ 	/* Comment? -Hans */
+ 	wait_queue_head_t s_wait;
+ 	/* To be obsoleted soon by per buffer seals.. -Hans */
+-	atomic_t s_generation_counter;	// increased by one every time the
++	atomic_unchecked_t s_generation_counter;	// increased by one every time the
+ 	// tree gets re-balanced
+ 	unsigned long s_properties;	/* File system properties. Currently holds
+ 					   on-disk FS format */
+diff -urNp linux-2.6.32.12/include/linux/sched.h linux-2.6.32.12/include/linux/sched.h
+--- linux-2.6.32.12/include/linux/sched.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/sched.h	2010-04-04 20:46:41.681061354 -0400
+@@ -101,6 +101,7 @@ struct bio;
+ struct fs_struct;
+ struct bts_context;
+ struct perf_event_context;
++struct linux_binprm;
+ 
+ /*
+  * List of flags we want to share for kernel threads,
+@@ -664,6 +665,15 @@ struct signal_struct {
+ 	struct tty_audit_buf *tty_audit_buf;
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++	u32 curr_ip;
++	u32 gr_saddr;
++	u32 gr_daddr;
++	u16 gr_sport;
++	u16 gr_dport;
++	u8 used_accept:1;
++#endif
++
+ 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
+ };
+ 
+@@ -1217,7 +1227,7 @@ struct rcu_node;
+ 
+ struct task_struct {
+ 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
+-	void *stack;
++	struct thread_info *stack;
+ 	atomic_t usage;
+ 	unsigned int flags;	/* per process flags, defined below */
+ 	unsigned int ptrace;
+@@ -1329,8 +1339,8 @@ struct task_struct {
+ 	struct list_head thread_group;
+ 
+ 	struct completion *vfork_done;		/* for vfork() */
+-	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
+-	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
++	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
++	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
+ 
+ 	cputime_t utime, stime, utimescaled, stimescaled;
+ 	cputime_t gtime;
+@@ -1344,16 +1354,6 @@ struct task_struct {
+ 	struct task_cputime cputime_expires;
+ 	struct list_head cpu_timers[3];
+ 
+-/* process credentials */
+-	const struct cred *real_cred;	/* objective and real subjective task
+-					 * credentials (COW) */
+-	const struct cred *cred;	/* effective (overridable) subjective task
+-					 * credentials (COW) */
+-	struct mutex cred_guard_mutex;	/* guard against foreign influences on
+-					 * credential calculations
+-					 * (notably. ptrace) */
+-	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
+-
+ 	char comm[TASK_COMM_LEN]; /* executable name excluding path
+ 				     - access with [gs]et_task_comm (which lock
+ 				       it with task_lock())
+@@ -1437,6 +1437,15 @@ struct task_struct {
+ 	int hardirq_context;
+ 	int softirq_context;
+ #endif
++
++/* process credentials */
++	const struct cred *real_cred;	/* objective and real subjective task
++					 * credentials (COW) */
++	struct mutex cred_guard_mutex;	/* guard against foreign influences on
++					 * credential calculations
++					 * (notably. ptrace) */
++	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
++
+ #ifdef CONFIG_LOCKDEP
+ # define MAX_LOCK_DEPTH 48UL
+ 	u64 curr_chain_key;
+@@ -1457,6 +1466,9 @@ struct task_struct {
+ 
+ 	struct backing_dev_info *backing_dev_info;
+ 
++	const struct cred *cred;	/* effective (overridable) subjective task
++					 * credentials (COW) */
++
+ 	struct io_context *io_context;
+ 
+ 	unsigned long ptrace_message;
+@@ -1520,6 +1532,19 @@ struct task_struct {
+ 	unsigned long default_timer_slack_ns;
+ 
+ 	struct list_head	*scm_work_list;
++
++#ifdef CONFIG_GRKERNSEC
++	/* grsecurity */
++	rwlock_t gr_fs_lock;
++	struct acl_subject_label *acl;
++	struct acl_role_label *role;
++	struct file *exec_file;
++	u16 acl_role_id;
++	u8 acl_sp_role;
++	u8 is_writable;
++	u8 brute;
++#endif
++
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ 	/* Index of current stored adress in ret_stack */
+ 	int curr_ret_stack;
+@@ -1544,6 +1569,52 @@ struct task_struct {
+ 	unsigned long stack_start;
+ };
+ 
++#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
++#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
++#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
++#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
++/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
++#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
++
++#ifdef CONFIG_PAX_SOFTMODE
++extern unsigned int pax_softmode;
++#endif
++
++extern int pax_check_flags(unsigned long *);
++
++/* if tsk != current then task_lock must be held on it */
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline unsigned long pax_get_flags(struct task_struct *tsk)
++{
++	if (likely(tsk->mm))
++		return tsk->mm->pax_flags;
++	else
++		return 0UL;
++}
++
++/* if tsk != current then task_lock must be held on it */
++static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
++{
++	if (likely(tsk->mm)) {
++		tsk->mm->pax_flags = flags;
++		return 0;
++	}
++	return -EINVAL;
++}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++extern void pax_set_initial_flags(struct linux_binprm *bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++#endif
++
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
++void pax_report_insns(void *pc, void *sp);
++void pax_report_refcount_overflow(struct pt_regs *regs);
++void pax_report_leak_to_user(const void *ptr, unsigned long len);
++void pax_report_overflow_from_user(const void *ptr, unsigned long len);
++
+ /* Future-safe accessor for struct task_struct's cpus_allowed. */
+ #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+ 
+@@ -2143,7 +2214,7 @@ extern void __cleanup_sighand(struct sig
+ extern void exit_itimers(struct signal_struct *);
+ extern void flush_itimer_signals(void);
+ 
+-extern NORET_TYPE void do_group_exit(int);
++extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
+ 
+ extern void daemonize(const char *, ...);
+ extern int allow_signal(int);
+@@ -2245,6 +2316,33 @@ static inline void task_unlock(struct ta
+ 	spin_unlock(&p->alloc_lock);
+ }
+ 
++/* grsec: protects only ->fs as task_lock is overkill and we can't
++   be using a spin_lock in interrupt context
++*/
++#ifdef CONFIG_GRKERNSEC
++#define gr_fs_write_lock_irqsave(x, y)				\
++	write_lock_irqsave(&x->gr_fs_lock, y)
++#define gr_fs_write_unlock_irqrestore(x, y) 			\
++	write_unlock_irqrestore(&x->gr_fs_lock, y)
++#else
++#define gr_fs_write_lock_irqsave(x, y)
++#define gr_fs_write_unlock_irqrestore(x, y)
++#endif
++
++static inline void gr_fs_read_lock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_lock(&p->gr_fs_lock);
++#endif
++}
++
++static inline void gr_fs_read_unlock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_unlock(&p->gr_fs_lock);
++#endif
++}
++
+ extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
+ 							unsigned long *flags);
+ 
+@@ -2256,8 +2354,8 @@ static inline void unlock_task_sighand(s
+ 
+ #ifndef __HAVE_THREAD_FUNCTIONS
+ 
+-#define task_thread_info(task)	((struct thread_info *)(task)->stack)
+-#define task_stack_page(task)	((task)->stack)
++#define task_thread_info(task)	((task)->stack)
++#define task_stack_page(task)	((void *)(task)->stack)
+ 
+ static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
+ {
+@@ -2272,13 +2370,31 @@ static inline unsigned long *end_of_stac
+ 
+ #endif
+ 
+-static inline int object_is_on_stack(void *obj)
++static inline int object_starts_on_stack(void *obj)
+ {
+-	void *stack = task_stack_page(current);
++	const void *stack = task_stack_page(current);
+ 
+ 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
+ }
+ 
++/* 0: not at all, 1: fully, -1: partially (implies an error) */
++static inline int object_is_on_stack(const void *obj, unsigned long len)
++{
++	const void *stack = task_stack_page(current);
++	const void *stackend = stack + THREAD_SIZE;
++
++	if (obj + len < obj)
++		return -1;
++
++	if (stack <= obj && obj + len <= stackend)
++		return 1;
++
++	if (obj + len <= stack || stackend <=  obj)
++		return 0;
++
++	return -1;
++}
++
+ extern void thread_info_cache_init(void);
+ 
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+diff -urNp linux-2.6.32.12/include/linux/screen_info.h linux-2.6.32.12/include/linux/screen_info.h
+--- linux-2.6.32.12/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/screen_info.h	2010-04-04 20:46:41.681061354 -0400
+@@ -42,7 +42,8 @@ struct screen_info {
+ 	__u16 pages;		/* 0x32 */
+ 	__u16 vesa_attributes;	/* 0x34 */
+ 	__u32 capabilities;     /* 0x36 */
+-	__u8  _reserved[6];	/* 0x3a */
++	__u16 vesapm_size;	/* 0x3a */
++	__u8  _reserved[4];	/* 0x3c */
+ } __attribute__((packed));
+ 
+ #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
+diff -urNp linux-2.6.32.12/include/linux/security.h linux-2.6.32.12/include/linux/security.h
+--- linux-2.6.32.12/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/security.h	2010-04-04 20:46:41.681061354 -0400
+@@ -34,6 +34,7 @@
+ #include <linux/key.h>
+ #include <linux/xfrm.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ #include <net/flow.h>
+ 
+ /* Maximum number of letters for an LSM name string */
+diff -urNp linux-2.6.32.12/include/linux/shm.h linux-2.6.32.12/include/linux/shm.h
+--- linux-2.6.32.12/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/shm.h	2010-04-04 20:46:41.681061354 -0400
+@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
+ 	pid_t			shm_cprid;
+ 	pid_t			shm_lprid;
+ 	struct user_struct	*mlock_user;
++#ifdef CONFIG_GRKERNSEC
++	time_t			shm_createtime;
++	pid_t			shm_lapid;
++#endif
+ };
+ 
+ /* shm_mode upper byte flags */
+diff -urNp linux-2.6.32.12/include/linux/slab.h linux-2.6.32.12/include/linux/slab.h
+--- linux-2.6.32.12/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/slab.h	2010-04-04 20:47:28.956670452 -0400
+@@ -11,6 +11,7 @@
+ 
+ #include <linux/gfp.h>
+ #include <linux/types.h>
++#include <linux/err.h>
+ 
+ /*
+  * Flags to pass to kmem_cache_create().
+@@ -82,10 +83,13 @@
+  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
+  * Both make kfree a no-op.
+  */
+-#define ZERO_SIZE_PTR ((void *)16)
++#define ZERO_SIZE_PTR				\
++({						\
++	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
++	(void *)(-MAX_ERRNO-1L);		\
++})
+ 
+-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
+-				(unsigned long)ZERO_SIZE_PTR)
++#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
+ 
+ /*
+  * struct kmem_cache related prototypes
+@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
+ void kfree(const void *);
+ void kzfree(const void *);
+ size_t ksize(const void *);
++void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ /*
+  * Allocator specific definitions. These are mainly used to establish optimized
+@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
+ 
+ void __init kmem_cache_init_late(void);
+ 
++#define kmalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kmalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
++#define kmalloc_node(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = kmalloc_node((size_t)___x, (y), (z));\
++	___retval;						\
++})
++
++#define kzalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kzalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
+ #endif	/* _LINUX_SLAB_H */
+diff -urNp linux-2.6.32.12/include/linux/slub_def.h linux-2.6.32.12/include/linux/slub_def.h
+--- linux-2.6.32.12/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/slub_def.h	2010-04-04 20:46:41.685762250 -0400
+@@ -86,7 +86,7 @@ struct kmem_cache {
+ 	struct kmem_cache_order_objects max;
+ 	struct kmem_cache_order_objects min;
+ 	gfp_t allocflags;	/* gfp flags to use on each alloc */
+-	int refcount;		/* Refcount for slab cache destroy */
++	atomic_t refcount;	/* Refcount for slab cache destroy */
+ 	void (*ctor)(void *);
+ 	int inuse;		/* Offset to metadata */
+ 	int align;		/* Alignment */
+diff -urNp linux-2.6.32.12/include/linux/sonet.h linux-2.6.32.12/include/linux/sonet.h
+--- linux-2.6.32.12/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/sonet.h	2010-04-04 20:46:41.685762250 -0400
+@@ -61,7 +61,7 @@ struct sonet_stats {
+ #include <asm/atomic.h>
+ 
+ struct k_sonet_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.12/include/linux/suspend.h linux-2.6.32.12/include/linux/suspend.h
+--- linux-2.6.32.12/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/suspend.h	2010-04-04 20:46:41.685762250 -0400
+@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
+  *	which require special recovery actions in that situation.
+  */
+ struct platform_suspend_ops {
+-	int (*valid)(suspend_state_t state);
+-	int (*begin)(suspend_state_t state);
+-	int (*prepare)(void);
+-	int (*prepare_late)(void);
+-	int (*enter)(suspend_state_t state);
+-	void (*wake)(void);
+-	void (*finish)(void);
+-	void (*end)(void);
+-	void (*recover)(void);
++	int (* const valid)(suspend_state_t state);
++	int (* const begin)(suspend_state_t state);
++	int (* const prepare)(void);
++	int (* const prepare_late)(void);
++	int (* const enter)(suspend_state_t state);
++	void (* const wake)(void);
++	void (* const finish)(void);
++	void (* const end)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_SUSPEND
+@@ -120,7 +120,7 @@ struct platform_suspend_ops {
+  * suspend_set_ops - set platform dependent suspend operations
+  * @ops: The new suspend operations to set.
+  */
+-extern void suspend_set_ops(struct platform_suspend_ops *ops);
++extern void suspend_set_ops(const struct platform_suspend_ops *ops);
+ extern int suspend_valid_only_mem(suspend_state_t state);
+ 
+ /**
+@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
+ #else /* !CONFIG_SUSPEND */
+ #define suspend_valid_only_mem	NULL
+ 
+-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
++static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
+ static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
+ #endif /* !CONFIG_SUSPEND */
+ 
+@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
+  *	platforms which require special recovery actions in that situation.
+  */
+ struct platform_hibernation_ops {
+-	int (*begin)(void);
+-	void (*end)(void);
+-	int (*pre_snapshot)(void);
+-	void (*finish)(void);
+-	int (*prepare)(void);
+-	int (*enter)(void);
+-	void (*leave)(void);
+-	int (*pre_restore)(void);
+-	void (*restore_cleanup)(void);
+-	void (*recover)(void);
++	int (* const begin)(void);
++	void (* const end)(void);
++	int (* const pre_snapshot)(void);
++	void (* const finish)(void);
++	int (* const prepare)(void);
++	int (* const enter)(void);
++	void (* const leave)(void);
++	int (* const pre_restore)(void);
++	void (* const restore_cleanup)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_HIBERNATION
+@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
+ extern void swsusp_unset_page_free(struct page *);
+ extern unsigned long get_safe_page(gfp_t gfp_mask);
+ 
+-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
++extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
+ extern int hibernate(void);
+ extern bool system_entering_hibernation(void);
+ #else /* CONFIG_HIBERNATION */
+@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
+ static inline void swsusp_set_page_free(struct page *p) {}
+ static inline void swsusp_unset_page_free(struct page *p) {}
+ 
+-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
++static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
+ static inline int hibernate(void) { return -ENOSYS; }
+ static inline bool system_entering_hibernation(void) { return false; }
+ #endif /* CONFIG_HIBERNATION */
+diff -urNp linux-2.6.32.12/include/linux/sysctl.h linux-2.6.32.12/include/linux/sysctl.h
+--- linux-2.6.32.12/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/sysctl.h	2010-04-04 20:46:41.685762250 -0400
+@@ -164,7 +164,11 @@ enum
+ 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
+ };
+ 
+-
++#ifdef CONFIG_PAX_SOFTMODE
++enum {
++	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
++};
++#endif
+ 
+ /* CTL_VM names: */
+ enum
+diff -urNp linux-2.6.32.12/include/linux/sysfs.h linux-2.6.32.12/include/linux/sysfs.h
+--- linux-2.6.32.12/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/sysfs.h	2010-04-04 20:46:41.685762250 -0400
+@@ -75,8 +75,8 @@ struct bin_attribute {
+ };
+ 
+ struct sysfs_ops {
+-	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
+-	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
++	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
++	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
+ };
+ 
+ struct sysfs_dirent;
+diff -urNp linux-2.6.32.12/include/linux/thread_info.h linux-2.6.32.12/include/linux/thread_info.h
+--- linux-2.6.32.12/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/thread_info.h	2010-04-04 20:46:41.685762250 -0400
+@@ -23,7 +23,7 @@ struct restart_block {
+ 		};
+ 		/* For futex_wait and futex_wait_requeue_pi */
+ 		struct {
+-			u32 *uaddr;
++			u32 __user *uaddr;
+ 			u32 val;
+ 			u32 flags;
+ 			u32 bitset;
+diff -urNp linux-2.6.32.12/include/linux/tty.h linux-2.6.32.12/include/linux/tty.h
+--- linux-2.6.32.12/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.12/include/linux/tty.h	2010-04-04 20:46:41.685762250 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/tty_ldisc.h>
+ #include <linux/mutex.h>
++#include <linux/poll.h>
+ 
+ #include <asm/system.h>
+ 
+@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
+ extern dev_t tty_devnum(struct tty_struct *tty);
+ extern void proc_clear_tty(struct task_struct *p);
+ extern struct tty_struct *get_current_tty(void);
+-extern void tty_default_fops(struct file_operations *fops);
+ extern struct tty_struct *alloc_tty_struct(void);
+ extern void free_tty_struct(struct tty_struct *tty);
+ extern void initialize_tty_struct(struct tty_struct *tty,
+@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
+ /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
+ extern void tty_ldisc_enable(struct tty_struct *tty);
+ 
++/* tty_io.c */
++extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
++extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
++extern unsigned int tty_poll(struct file *, poll_table *);
++#ifdef CONFIG_COMPAT
++extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
++				unsigned long arg);
++#else
++#define tty_compat_ioctl NULL
++#endif
++extern int tty_release(struct inode *, struct file *);
++extern int tty_fasync(int fd, struct file *filp, int on);
+ 
+ /* n_tty.c */
+ extern struct tty_ldisc_ops tty_ldisc_N_TTY;
+diff -urNp linux-2.6.32.12/include/linux/tty_ldisc.h linux-2.6.32.12/include/linux/tty_ldisc.h
+--- linux-2.6.32.12/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/tty_ldisc.h	2010-04-04 20:46:41.685762250 -0400
+@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
+ 
+ 	struct  module *owner;
+ 	
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ struct tty_ldisc {
+diff -urNp linux-2.6.32.12/include/linux/types.h linux-2.6.32.12/include/linux/types.h
+--- linux-2.6.32.12/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/types.h	2010-04-04 20:46:41.685762250 -0400
+@@ -191,10 +191,26 @@ typedef struct {
+ 	volatile int counter;
+ } atomic_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile int counter;
++} atomic_unchecked_t;
++#else
++typedef atomic_t atomic_unchecked_t;
++#endif
++
+ #ifdef CONFIG_64BIT
+ typedef struct {
+ 	volatile long counter;
+ } atomic64_t;
++
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile long counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
+ #endif
+ 
+ struct ustat {
+diff -urNp linux-2.6.32.12/include/linux/uaccess.h linux-2.6.32.12/include/linux/uaccess.h
+--- linux-2.6.32.12/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/uaccess.h	2010-04-04 20:46:41.685762250 -0400
+@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
+ 		long ret;				\
+ 		mm_segment_t old_fs = get_fs();		\
+ 							\
+-		set_fs(KERNEL_DS);			\
+ 		pagefault_disable();			\
++		set_fs(KERNEL_DS);			\
+ 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
+-		pagefault_enable();			\
+ 		set_fs(old_fs);				\
++		pagefault_enable();			\
+ 		ret;					\
+ 	})
+ 
+@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_read(void *dst, void *src, size_t size);
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
+ 
+ /*
+  * probe_kernel_write(): safely attempt to write to a location
+@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_write(void *dst, void *src, size_t size);
++extern long probe_kernel_write(void *dst, const void *src, size_t size);
+ 
+ #endif		/* __LINUX_UACCESS_H__ */
+diff -urNp linux-2.6.32.12/include/linux/vmalloc.h linux-2.6.32.12/include/linux/vmalloc.h
+--- linux-2.6.32.12/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/linux/vmalloc.h	2010-04-04 20:46:41.685762250 -0400
+@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
+ #define VM_MAP		0x00000004	/* vmap()ed pages */
+ #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
+ #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
++#endif
++
+ /* bits [20..32] reserved for arch specific ioremap internals */
+ 
+ /*
+@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
+ 
+ void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
+ 
++#define vmalloc(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define __vmalloc(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = __vmalloc((unsigned long)___x, (y), (z));\
++	___retval;						\
++})
++
++#define vmalloc_user(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_user((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_exec(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_exec((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_node(x, y)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_node((unsigned long)___x, (y));\
++	___retval;						\
++})
++
++#define vmalloc_32(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_32_user(x)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32_user((unsigned long)___x);\
++	___retval;						\
++})
++
+ #endif /* _LINUX_VMALLOC_H */
+diff -urNp linux-2.6.32.12/include/net/irda/ircomm_tty.h linux-2.6.32.12/include/net/irda/ircomm_tty.h
+--- linux-2.6.32.12/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/net/irda/ircomm_tty.h	2010-04-04 20:46:41.685762250 -0400
+@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
+         unsigned short    close_delay;
+         unsigned short    closing_wait; /* time to wait before closing */
+ 
+-	int  open_count;
+-	int  blocked_open;	/* # of blocked opens */
++	atomic_t open_count;
++	atomic_t blocked_open;	/* # of blocked opens */
+ 
+ 	/* Protect concurent access to :
+ 	 *	o self->open_count
+diff -urNp linux-2.6.32.12/include/net/neighbour.h linux-2.6.32.12/include/net/neighbour.h
+--- linux-2.6.32.12/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/net/neighbour.h	2010-04-04 20:46:41.685762250 -0400
+@@ -125,12 +125,12 @@ struct neighbour
+ struct neigh_ops
+ {
+ 	int			family;
+-	void			(*solicit)(struct neighbour *, struct sk_buff*);
+-	void			(*error_report)(struct neighbour *, struct sk_buff*);
+-	int			(*output)(struct sk_buff*);
+-	int			(*connected_output)(struct sk_buff*);
+-	int			(*hh_output)(struct sk_buff*);
+-	int			(*queue_xmit)(struct sk_buff*);
++	void			(* const solicit)(struct neighbour *, struct sk_buff*);
++	void			(* const error_report)(struct neighbour *, struct sk_buff*);
++	int			(* const output)(struct sk_buff*);
++	int			(* const connected_output)(struct sk_buff*);
++	int			(* const hh_output)(struct sk_buff*);
++	int			(* const queue_xmit)(struct sk_buff*);
+ };
+ 
+ struct pneigh_entry
+diff -urNp linux-2.6.32.12/include/net/sctp/sctp.h linux-2.6.32.12/include/net/sctp/sctp.h
+--- linux-2.6.32.12/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/net/sctp/sctp.h	2010-04-04 20:46:41.685762250 -0400
+@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
+ 
+ #else	/* SCTP_DEBUG */
+ 
+-#define SCTP_DEBUG_PRINTK(whatever...)
+-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
++#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
++#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
+ #define SCTP_ENABLE_DEBUG
+ #define SCTP_DISABLE_DEBUG
+ #define SCTP_ASSERT(expr, str, func)
+diff -urNp linux-2.6.32.12/include/net/tcp.h linux-2.6.32.12/include/net/tcp.h
+--- linux-2.6.32.12/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/net/tcp.h	2010-04-04 20:46:41.685762250 -0400
+@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
+ struct tcp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.12/include/net/udp.h linux-2.6.32.12/include/net/udp.h
+--- linux-2.6.32.12/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/net/udp.h	2010-04-04 20:46:41.685762250 -0400
+@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
+ 	struct udp_table	*udp_table;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.12/include/sound/ac97_codec.h linux-2.6.32.12/include/sound/ac97_codec.h
+--- linux-2.6.32.12/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/sound/ac97_codec.h	2010-04-04 20:46:41.685762250 -0400
+@@ -419,15 +419,15 @@
+ struct snd_ac97;
+ 
+ struct snd_ac97_build_ops {
+-	int (*build_3d) (struct snd_ac97 *ac97);
+-	int (*build_specific) (struct snd_ac97 *ac97);
+-	int (*build_spdif) (struct snd_ac97 *ac97);
+-	int (*build_post_spdif) (struct snd_ac97 *ac97);
++	int (* const build_3d) (struct snd_ac97 *ac97);
++	int (* const build_specific) (struct snd_ac97 *ac97);
++	int (* const build_spdif) (struct snd_ac97 *ac97);
++	int (* const build_post_spdif) (struct snd_ac97 *ac97);
+ #ifdef CONFIG_PM
+-	void (*suspend) (struct snd_ac97 *ac97);
+-	void (*resume) (struct snd_ac97 *ac97);
++	void (* const suspend) (struct snd_ac97 *ac97);
++	void (* const resume) (struct snd_ac97 *ac97);
+ #endif
+-	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
++	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
+ };
+ 
+ struct snd_ac97_bus_ops {
+@@ -477,7 +477,7 @@ struct snd_ac97_template {
+ 
+ struct snd_ac97 {
+ 	/* -- lowlevel (hardware) driver specific -- */
+-	struct snd_ac97_build_ops * build_ops;
++	const struct snd_ac97_build_ops * build_ops;
+ 	void *private_data;
+ 	void (*private_free) (struct snd_ac97 *ac97);
+ 	/* --- */
+diff -urNp linux-2.6.32.12/include/trace/events/irq.h linux-2.6.32.12/include/trace/events/irq.h
+--- linux-2.6.32.12/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/trace/events/irq.h	2010-04-04 20:46:41.685762250 -0400
+@@ -34,7 +34,7 @@
+  */
+ TRACE_EVENT(irq_handler_entry,
+ 
+-	TP_PROTO(int irq, struct irqaction *action),
++	TP_PROTO(int irq, const struct irqaction *action),
+ 
+ 	TP_ARGS(irq, action),
+ 
+@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
+  */
+ TRACE_EVENT(irq_handler_exit,
+ 
+-	TP_PROTO(int irq, struct irqaction *action, int ret),
++	TP_PROTO(int irq, const struct irqaction *action, int ret),
+ 
+ 	TP_ARGS(irq, action, ret),
+ 
+@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
+  */
+ TRACE_EVENT(softirq_entry,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
+  */
+ TRACE_EVENT(softirq_exit,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+diff -urNp linux-2.6.32.12/include/video/uvesafb.h linux-2.6.32.12/include/video/uvesafb.h
+--- linux-2.6.32.12/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/include/video/uvesafb.h	2010-04-04 20:46:41.685762250 -0400
+@@ -177,6 +177,7 @@ struct uvesafb_par {
+ 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
+ 	u8 pmi_setpal;			/* PMI for palette changes */
+ 	u16 *pmi_base;			/* protected mode interface location */
++	u8 *pmi_code;			/* protected mode code location */
+ 	void *pmi_start;
+ 	void *pmi_pal;
+ 	u8 *vbe_state_orig;		/*
+diff -urNp linux-2.6.32.12/init/do_mounts.c linux-2.6.32.12/init/do_mounts.c
+--- linux-2.6.32.12/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/do_mounts.c	2010-04-04 20:46:41.685762250 -0400
+@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
+ 
+ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
+ {
+-	int err = sys_mount(name, "/root", fs, flags, data);
++	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
+ 	if (err)
+ 		return err;
+ 
+-	sys_chdir("/root");
++	sys_chdir((__force char __user *)"/root");
+ 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
+ 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
+ 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
+@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
+ 	va_start(args, fmt);
+ 	vsprintf(buf, fmt, args);
+ 	va_end(args);
+-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, FDEJECT, 0);
+ 		sys_close(fd);
+ 	}
+ 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
+-	fd = sys_open("/dev/console", O_RDWR, 0);
++	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, TCGETS, (long)&termios);
+ 		termios.c_lflag &= ~ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+-		sys_read(fd, &c, 1);
++		sys_read(fd, (char __user *)&c, 1);
+ 		termios.c_lflag |= ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+ 		sys_close(fd);
+@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
+ 	mount_root();
+ out:
+ 	devtmpfs_mount("dev");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force char __user *)".");
+ }
+diff -urNp linux-2.6.32.12/init/do_mounts.h linux-2.6.32.12/init/do_mounts.h
+--- linux-2.6.32.12/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/do_mounts.h	2010-04-04 20:46:41.685762250 -0400
+@@ -15,15 +15,15 @@ extern int root_mountflags;
+ 
+ static inline int create_dev(char *name, dev_t dev)
+ {
+-	sys_unlink(name);
+-	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
++	sys_unlink((__force char __user *)name);
++	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
+ }
+ 
+ #if BITS_PER_LONG == 32
+ static inline u32 bstat(char *name)
+ {
+ 	struct stat64 stat;
+-	if (sys_stat64(name, &stat) != 0)
++	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
+ 		return 0;
+ 	if (!S_ISBLK(stat.st_mode))
+ 		return 0;
+diff -urNp linux-2.6.32.12/init/do_mounts_initrd.c linux-2.6.32.12/init/do_mounts_initrd.c
+--- linux-2.6.32.12/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/do_mounts_initrd.c	2010-04-04 20:46:41.685762250 -0400
+@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
+ 	sys_close(old_fd);sys_close(root_fd);
+ 	sys_close(0);sys_close(1);sys_close(2);
+ 	sys_setsid();
+-	(void) sys_open("/dev/console",O_RDWR,0);
++	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
+ 	(void) sys_dup(0);
+ 	(void) sys_dup(0);
+ 	return kernel_execve(shell, argv, envp_init);
+@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
+ 	create_dev("/dev/root.old", Root_RAM0);
+ 	/* mount initrd on rootfs' /root */
+ 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
+-	sys_mkdir("/old", 0700);
+-	root_fd = sys_open("/", 0, 0);
+-	old_fd = sys_open("/old", 0, 0);
++	sys_mkdir((__force const char __user *)"/old", 0700);
++	root_fd = sys_open((__force const char __user *)"/", 0, 0);
++	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
+ 	/* move initrd over / and chdir/chroot in initrd root */
+-	sys_chdir("/root");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_chdir((__force const char __user *)"/root");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force const char __user *)".");
+ 
+ 	/*
+ 	 * In case that a resume from disk is carried out by linuxrc or one of
+@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
+ 
+ 	/* move initrd to rootfs' /old */
+ 	sys_fchdir(old_fd);
+-	sys_mount("/", ".", NULL, MS_MOVE, NULL);
++	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
+ 	/* switch root and cwd back to / of rootfs */
+ 	sys_fchdir(root_fd);
+-	sys_chroot(".");
++	sys_chroot((__force const char __user *)".");
+ 	sys_close(old_fd);
+ 	sys_close(root_fd);
+ 
+ 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
+-		sys_chdir("/old");
++		sys_chdir((__force const char __user *)"/old");
+ 		return;
+ 	}
+ 
+@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
+ 	mount_root();
+ 
+ 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
+-	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
++	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
+ 	if (!error)
+ 		printk("okay\n");
+ 	else {
+-		int fd = sys_open("/dev/root.old", O_RDWR, 0);
++		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
+ 		if (error == -ENOENT)
+ 			printk("/initrd does not exist. Ignored.\n");
+ 		else
+ 			printk("failed\n");
+ 		printk(KERN_NOTICE "Unmounting old root\n");
+-		sys_umount("/old", MNT_DETACH);
++		sys_umount((__force char __user *)"/old", MNT_DETACH);
+ 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
+ 		if (fd < 0) {
+ 			error = fd;
+@@ -119,11 +119,11 @@ int __init initrd_load(void)
+ 		 * mounted in the normal path.
+ 		 */
+ 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
+-			sys_unlink("/initrd.image");
++			sys_unlink((__force const char __user *)"/initrd.image");
+ 			handle_initrd();
+ 			return 1;
+ 		}
+ 	}
+-	sys_unlink("/initrd.image");
++	sys_unlink((__force const char __user *)"/initrd.image");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/init/do_mounts_md.c linux-2.6.32.12/init/do_mounts_md.c
+--- linux-2.6.32.12/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/do_mounts_md.c	2010-04-04 20:46:41.689696132 -0400
+@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
+ 			partitioned ? "_d" : "", minor,
+ 			md_setup_args[ent].device_names);
+ 
+-		fd = sys_open(name, 0, 0);
++		fd = sys_open((__force char __user *)name, 0, 0);
+ 		if (fd < 0) {
+ 			printk(KERN_ERR "md: open failed - cannot start "
+ 					"array %s\n", name);
+@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
+ 			 * array without it
+ 			 */
+ 			sys_close(fd);
+-			fd = sys_open(name, 0, 0);
++			fd = sys_open((__force char __user *)name, 0, 0);
+ 			sys_ioctl(fd, BLKRRPART, 0);
+ 		}
+ 		sys_close(fd);
+@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
+ 
+ 	wait_for_device_probe();
+ 
+-	fd = sys_open("/dev/md0", 0, 0);
++	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
+ 		sys_close(fd);
+diff -urNp linux-2.6.32.12/init/initramfs.c linux-2.6.32.12/init/initramfs.c
+--- linux-2.6.32.12/init/initramfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/initramfs.c	2010-04-04 20:46:41.689696132 -0400
+@@ -74,7 +74,7 @@ static void __init free_hash(void)
+ 	}
+ }
+ 
+-static long __init do_utime(char __user *filename, time_t mtime)
++static long __init do_utime(__force char __user *filename, time_t mtime)
+ {
+ 	struct timespec t[2];
+ 
+@@ -109,7 +109,7 @@ static void __init dir_utime(void)
+ 	struct dir_entry *de, *tmp;
+ 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
+ 		list_del(&de->list);
+-		do_utime(de->name, de->mtime);
++		do_utime((__force char __user *)de->name, de->mtime);
+ 		kfree(de->name);
+ 		kfree(de);
+ 	}
+@@ -271,7 +271,7 @@ static int __init maybe_link(void)
+ 	if (nlink >= 2) {
+ 		char *old = find_link(major, minor, ino, mode, collected);
+ 		if (old)
+-			return (sys_link(old, collected) < 0) ? -1 : 1;
++			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
+ 	}
+ 	return 0;
+ }
+@@ -280,11 +280,11 @@ static void __init clean_path(char *path
+ {
+ 	struct stat st;
+ 
+-	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
++	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
+ 		if (S_ISDIR(st.st_mode))
+-			sys_rmdir(path);
++			sys_rmdir((__force char __user *)path);
+ 		else
+-			sys_unlink(path);
++			sys_unlink((__force char __user *)path);
+ 	}
+ }
+ 
+@@ -305,7 +305,7 @@ static int __init do_name(void)
+ 			int openflags = O_WRONLY|O_CREAT;
+ 			if (ml != 1)
+ 				openflags |= O_TRUNC;
+-			wfd = sys_open(collected, openflags, mode);
++			wfd = sys_open((__force char __user *)collected, openflags, mode);
+ 
+ 			if (wfd >= 0) {
+ 				sys_fchown(wfd, uid, gid);
+@@ -317,17 +317,17 @@ static int __init do_name(void)
+ 			}
+ 		}
+ 	} else if (S_ISDIR(mode)) {
+-		sys_mkdir(collected, mode);
+-		sys_chown(collected, uid, gid);
+-		sys_chmod(collected, mode);
++		sys_mkdir((__force char __user *)collected, mode);
++		sys_chown((__force char __user *)collected, uid, gid);
++		sys_chmod((__force char __user *)collected, mode);
+ 		dir_add(collected, mtime);
+ 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
+ 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
+ 		if (maybe_link() == 0) {
+-			sys_mknod(collected, mode, rdev);
+-			sys_chown(collected, uid, gid);
+-			sys_chmod(collected, mode);
+-			do_utime(collected, mtime);
++			sys_mknod((__force char __user *)collected, mode, rdev);
++			sys_chown((__force char __user *)collected, uid, gid);
++			sys_chmod((__force char __user *)collected, mode);
++			do_utime((__force char __user *)collected, mtime);
+ 		}
+ 	}
+ 	return 0;
+@@ -336,15 +336,15 @@ static int __init do_name(void)
+ static int __init do_copy(void)
+ {
+ 	if (count >= body_len) {
+-		sys_write(wfd, victim, body_len);
++		sys_write(wfd, (__force char __user *)victim, body_len);
+ 		sys_close(wfd);
+-		do_utime(vcollected, mtime);
++		do_utime((__force char __user *)vcollected, mtime);
+ 		kfree(vcollected);
+ 		eat(body_len);
+ 		state = SkipIt;
+ 		return 0;
+ 	} else {
+-		sys_write(wfd, victim, count);
++		sys_write(wfd, (__force char __user *)victim, count);
+ 		body_len -= count;
+ 		eat(count);
+ 		return 1;
+@@ -355,9 +355,9 @@ static int __init do_symlink(void)
+ {
+ 	collected[N_ALIGN(name_len) + body_len] = '\0';
+ 	clean_path(collected, 0);
+-	sys_symlink(collected + N_ALIGN(name_len), collected);
+-	sys_lchown(collected, uid, gid);
+-	do_utime(collected, mtime);
++	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
++	sys_lchown((__force char __user *)collected, uid, gid);
++	do_utime((__force char __user *)collected, mtime);
+ 	state = SkipIt;
+ 	next_state = Reset;
+ 	return 0;
+diff -urNp linux-2.6.32.12/init/Kconfig linux-2.6.32.12/init/Kconfig
+--- linux-2.6.32.12/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/Kconfig	2010-04-04 20:46:41.689696132 -0400
+@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
+ 
+ config COMPAT_BRK
+ 	bool "Disable heap randomization"
+-	default y
++	default n
+ 	help
+ 	  Randomizing heap placement makes heap exploits harder, but it
+ 	  also breaks ancient binaries (including anything libc5 based).
+@@ -1116,9 +1116,9 @@ config HAVE_GENERIC_DMA_COHERENT
+ 
+ config SLABINFO
+ 	bool
+-	depends on PROC_FS
++	depends on PROC_FS && !GRKERNSEC_PROC_ADD
+ 	depends on SLAB || SLUB_DEBUG
+-	default y
++	default n
+ 
+ config RT_MUTEXES
+ 	boolean
+diff -urNp linux-2.6.32.12/init/main.c linux-2.6.32.12/init/main.c
+--- linux-2.6.32.12/init/main.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.12/init/main.c	2010-04-04 20:58:33.225084964 -0400
+@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
+ #ifdef CONFIG_TC
+ extern void tc_init(void);
+ #endif
++extern void grsecurity_init(void);
+ 
+ enum system_states system_state __read_mostly;
+ EXPORT_SYMBOL(system_state);
+@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
+ 
+ __setup("reset_devices", set_reset_devices);
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++extern void pax_enter_kernel_user(void);
++extern void pax_exit_kernel_user(void);
++extern pteval_t clone_pgd_mask;
++#endif
++
++#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++	unsigned int cpu;
++
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++	}
++	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++#else
++	char *p;
++	p = (char *)pax_enter_kernel_user;
++	*p = 0xc3;
++	p = (char *)pax_exit_kernel_user;
++	*p = 0xc3;
++	clone_pgd_mask = ~(pteval_t)0UL;
++#endif
++
++	return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++unsigned int pax_softmode;
++
++static int __init setup_pax_softmode(char *str)
++{
++	get_option(&str, &pax_softmode);
++	return 1;
++}
++__setup("pax_softmode=", setup_pax_softmode);
++#endif
++
+ static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
+ char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
+ static const char *panic_later, *panic_param;
+@@ -697,52 +742,53 @@ int initcall_debug;
+ core_param(initcall_debug, initcall_debug, bool, 0644);
+ 
+ static char msgbuf[64];
+-static struct boot_trace_call call;
+-static struct boot_trace_ret ret;
++static struct boot_trace_call trace_call;
++static struct boot_trace_ret trace_ret;
+ 
+ int do_one_initcall(initcall_t fn)
+ {
+ 	int count = preempt_count();
+ 	ktime_t calltime, delta, rettime;
++	const char *msg1 = "", *msg2 = "";
+ 
+ 	if (initcall_debug) {
+-		call.caller = task_pid_nr(current);
+-		printk("calling  %pF @ %i\n", fn, call.caller);
++		trace_call.caller = task_pid_nr(current);
++		printk("calling  %pF @ %i\n", fn, trace_call.caller);
+ 		calltime = ktime_get();
+-		trace_boot_call(&call, fn);
++		trace_boot_call(&trace_call, fn);
+ 		enable_boot_trace();
+ 	}
+ 
+-	ret.result = fn();
++	trace_ret.result = fn();
+ 
+ 	if (initcall_debug) {
+ 		disable_boot_trace();
+ 		rettime = ktime_get();
+ 		delta = ktime_sub(rettime, calltime);
+-		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
+-		trace_boot_ret(&ret, fn);
++		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
++		trace_boot_ret(&trace_ret, fn);
+ 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
+-			ret.result, ret.duration);
++			trace_ret.result, trace_ret.duration);
+ 	}
+ 
+ 	msgbuf[0] = 0;
+ 
+-	if (ret.result && ret.result != -ENODEV && initcall_debug)
+-		sprintf(msgbuf, "error code %d ", ret.result);
++	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
++		sprintf(msgbuf, "error code %d ", trace_ret.result);
+ 
+ 	if (preempt_count() != count) {
+-		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
++		msg1 = " preemption imbalance";
+ 		preempt_count() = count;
+ 	}
+ 	if (irqs_disabled()) {
+-		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
++		msg2 = " disabled interrupts";
+ 		local_irq_enable();
+ 	}
+-	if (msgbuf[0]) {
+-		printk("initcall %pF returned with %s\n", fn, msgbuf);
++	if (msgbuf[0] || *msg1 || *msg2) {
++		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
+ 	}
+ 
+-	return ret.result;
++	return trace_ret.result;
+ }
+ 
+ 
+@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
+ 	if (!ramdisk_execute_command)
+ 		ramdisk_execute_command = "/init";
+ 
+-	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
++	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
+ 		ramdisk_execute_command = NULL;
+ 		prepare_namespace();
+ 	}
+ 
++	grsecurity_init();
++
+ 	/*
+ 	 * Ok, we have completed the initial bootup, and
+ 	 * we're essentially up and running. Get rid of the
+diff -urNp linux-2.6.32.12/init/noinitramfs.c linux-2.6.32.12/init/noinitramfs.c
+--- linux-2.6.32.12/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/init/noinitramfs.c	2010-04-04 20:46:41.689696132 -0400
+@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
+ {
+ 	int err;
+ 
+-	err = sys_mkdir("/dev", 0755);
++	err = sys_mkdir((const char __user *)"/dev", 0755);
+ 	if (err < 0)
+ 		goto out;
+ 
+@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
+ 	if (err < 0)
+ 		goto out;
+ 
+-	err = sys_mkdir("/root", 0700);
++	err = sys_mkdir((const char __user *)"/root", 0700);
+ 	if (err < 0)
+ 		goto out;
+ 
+diff -urNp linux-2.6.32.12/ipc/ipc_sysctl.c linux-2.6.32.12/ipc/ipc_sysctl.c
+--- linux-2.6.32.12/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/ipc/ipc_sysctl.c	2010-04-04 20:46:41.689696132 -0400
+@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
+ 		.extra1		= &zero,
+ 		.extra2		= &one,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table ipc_root_table[] = {
+@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
+ 		.mode		= 0555,
+ 		.child		= ipc_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init ipc_sysctl_init(void)
+diff -urNp linux-2.6.32.12/ipc/mqueue.c linux-2.6.32.12/ipc/mqueue.c
+--- linux-2.6.32.12/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.12/ipc/mqueue.c	2010-04-04 20:46:41.689696132 -0400
+@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
+ 			mq_bytes = (mq_msg_tblsz +
+ 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
+ 
++			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
+ 			spin_lock(&mq_lock);
+ 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
+ 		 	    u->mq_bytes + mq_bytes >
+diff -urNp linux-2.6.32.12/ipc/shm.c linux-2.6.32.12/ipc/shm.c
+--- linux-2.6.32.12/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/ipc/shm.c	2010-04-04 20:46:41.689696132 -0400
+@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
+ static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime, const uid_t cuid,
++			   const int shmid);
++extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime);
++#endif
++
+ void shm_init_ns(struct ipc_namespace *ns)
+ {
+ 	ns->shm_ctlmax = SHMMAX;
+@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
+ 	shp->shm_lprid = 0;
+ 	shp->shm_atim = shp->shm_dtim = 0;
+ 	shp->shm_ctim = get_seconds();
++#ifdef CONFIG_GRKERNSEC
++	{
++		struct timespec timeval;
++		do_posix_clock_monotonic_gettime(&timeval);
++
++		shp->shm_createtime = timeval.tv_sec;
++	}
++#endif
+ 	shp->shm_segsz = size;
+ 	shp->shm_nattch = 0;
+ 	shp->shm_file = file;
+@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
+ 	if (err)
+ 		goto out_unlock;
+ 
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
++			     shp->shm_perm.cuid, shmid) ||
++	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
++		err = -EACCES;
++		goto out_unlock;
++	}
++#endif
++
+ 	path.dentry = dget(shp->shm_file->f_path.dentry);
+ 	path.mnt    = shp->shm_file->f_path.mnt;
+ 	shp->shm_nattch++;
++#ifdef CONFIG_GRKERNSEC
++	shp->shm_lapid = current->pid;
++#endif
+ 	size = i_size_read(path.dentry->d_inode);
+ 	shm_unlock(shp);
+ 
+diff -urNp linux-2.6.32.12/kernel/acct.c linux-2.6.32.12/kernel/acct.c
+--- linux-2.6.32.12/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/acct.c	2010-04-04 20:46:41.689696132 -0400
+@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
+ 	 */
+ 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
+-	file->f_op->write(file, (char *)&ac,
++	file->f_op->write(file, (__force char __user *)&ac,
+ 			       sizeof(acct_t), &file->f_pos);
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
+ 	set_fs(fs);
+diff -urNp linux-2.6.32.12/kernel/capability.c linux-2.6.32.12/kernel/capability.c
+--- linux-2.6.32.12/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/capability.c	2010-04-04 20:46:41.689696132 -0400
+@@ -306,10 +306,21 @@ int capable(int cap)
+ 		BUG();
+ 	}
+ 
+-	if (security_capable(cap) == 0) {
++	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
+ 		current->flags |= PF_SUPERPRIV;
+ 		return 1;
+ 	}
+ 	return 0;
+ }
++
++int capable_nolog(int cap)
++{
++	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
++		current->flags |= PF_SUPERPRIV;
++		return 1;
++	}
++	return 0;
++}
++
+ EXPORT_SYMBOL(capable);
++EXPORT_SYMBOL(capable_nolog);
+diff -urNp linux-2.6.32.12/kernel/configs.c linux-2.6.32.12/kernel/configs.c
+--- linux-2.6.32.12/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/configs.c	2010-04-04 20:46:41.689696132 -0400
+@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
+ 	struct proc_dir_entry *entry;
+ 
+ 	/* create the current config file */
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
++			    &ikconfig_file_ops);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
++			    &ikconfig_file_ops);
++#endif
++#else
+ 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+ 			    &ikconfig_file_ops);
++#endif
++
+ 	if (!entry)
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.12/kernel/cpu.c linux-2.6.32.12/kernel/cpu.c
+--- linux-2.6.32.12/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/cpu.c	2010-04-04 20:46:41.689696132 -0400
+@@ -19,7 +19,7 @@
+ /* Serializes the updates to cpu_online_mask, cpu_present_mask */
+ static DEFINE_MUTEX(cpu_add_remove_lock);
+ 
+-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
++static RAW_NOTIFIER_HEAD(cpu_chain);
+ 
+ /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
+  * Should always be manipulated under cpu_add_remove_lock
+diff -urNp linux-2.6.32.12/kernel/cred.c linux-2.6.32.12/kernel/cred.c
+--- linux-2.6.32.12/kernel/cred.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/cred.c	2010-04-04 20:46:41.689696132 -0400
+@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
+ 
+ 	get_cred(new); /* we will require a ref for the subj creds too */
+ 
++	gr_set_role_label(task, new->uid, new->gid);
++
+ 	/* dumpability changes */
+ 	if (old->euid != new->euid ||
+ 	    old->egid != new->egid ||
+diff -urNp linux-2.6.32.12/kernel/exit.c linux-2.6.32.12/kernel/exit.c
+--- linux-2.6.32.12/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/exit.c	2010-04-04 20:46:41.689696132 -0400
+@@ -56,6 +56,10 @@
+ #include <asm/mmu_context.h>
+ #include "cred-internals.h"
+ 
++#ifdef CONFIG_GRKERNSEC
++extern rwlock_t grsec_exec_file_lock;
++#endif
++
+ static void exit_mm(struct task_struct * tsk);
+ 
+ static void __unhash_process(struct task_struct *p)
+@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
+ 	struct task_struct *leader;
+ 	int zap_leader;
+ repeat:
++	gr_del_task_from_ip_table(p);
++
+ 	tracehook_prepare_release_task(p);
+ 	/* don't need to get the RCU readlock here - the process is dead and
+ 	 * can't be modifying its own credentials */
+@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
+ {
+ 	write_lock_irq(&tasklist_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
+ 	ptrace_unlink(current);
+ 	/* Reparent to init */
+ 	current->real_parent = current->parent = kthreadd_task;
+ 	list_move_tail(&current->sibling, &current->real_parent->children);
+ 
++	gr_set_kernel_label(current);
++
+ 	/* Set the exit signal to SIGCHLD so we signal init on exit */
+ 	current->exit_signal = SIGCHLD;
+ 
+@@ -390,7 +407,7 @@ int allow_signal(int sig)
+ 	 * know it'll be handled, so that they don't get converted to
+ 	 * SIGKILL or just silently dropped.
+ 	 */
+-	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
++	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
+ 	recalc_sigpending();
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 	return 0;
+@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
+ 	vsnprintf(current->comm, sizeof(current->comm), name, args);
+ 	va_end(args);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
++	gr_set_kernel_label(current);
++
+ 	/*
+ 	 * If we were started as result of loading a module, close all of the
+ 	 * user space pages.  We don't need them, and if we didn't close them
+@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
+ 	tsk->exit_code = code;
+ 	taskstats_exit(tsk, group_dead);
+ 
++	gr_acl_handle_psacct(tsk, code);
++	gr_acl_handle_exit();
++
+ 	exit_mm(tsk);
+ 
+ 	if (group_dead)
+@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
+ 
+ 	if (unlikely(wo->wo_flags & WNOWAIT)) {
+ 		int exit_code = p->exit_code;
+-		int why, status;
++		int why;
+ 
+ 		get_task_struct(p);
+ 		read_unlock(&tasklist_lock);
+diff -urNp linux-2.6.32.12/kernel/fork.c linux-2.6.32.12/kernel/fork.c
+--- linux-2.6.32.12/kernel/fork.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/fork.c	2010-04-04 20:46:41.689696132 -0400
+@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
+ 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
+ 
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-	tsk->stack_canary = get_random_int();
++	tsk->stack_canary = pax_get_random_long();
+ #endif
+ 
+ 	/* One for us, one for whoever does the "release_task()" (usually parent) */
+@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
+ 	mm->locked_vm = 0;
+ 	mm->mmap = NULL;
+ 	mm->mmap_cache = NULL;
+-	mm->free_area_cache = oldmm->mmap_base;
+-	mm->cached_hole_size = ~0UL;
++	mm->free_area_cache = oldmm->free_area_cache;
++	mm->cached_hole_size = oldmm->cached_hole_size;
+ 	mm->map_count = 0;
+ 	cpumask_clear(mm_cpumask(mm));
+ 	mm->mm_rb = RB_ROOT;
+@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
+ 		tmp->vm_flags &= ~VM_LOCKED;
+ 		tmp->vm_mm = mm;
+ 		tmp->vm_next = NULL;
++		tmp->vm_mirror = NULL;
+ 		anon_vma_link(tmp);
+ 		file = tmp->vm_file;
+ 		if (file) {
+@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
+ 		if (retval)
+ 			goto out;
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
++		struct vm_area_struct *mpnt_m;
++
++		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
++			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
++
++			if (!mpnt->vm_mirror)
++				continue;
++
++			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
++				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
++				mpnt->vm_mirror = mpnt_m;
++			} else {
++				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
++				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
++				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
++				mpnt->vm_mirror->vm_mirror = mpnt;
++			}
++		}
++		BUG_ON(mpnt_m);
++	}
++#endif
++
+ 	/* a new mm has just been created */
+ 	arch_dup_mmap(oldmm, mm);
+ 	retval = 0;
+@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
+ 			write_unlock(&fs->lock);
+ 			return -EAGAIN;
+ 		}
+-		fs->users++;
++		atomic_inc(&fs->users);
+ 		write_unlock(&fs->lock);
+ 		return 0;
+ 	}
+@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
+ 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
+ #endif
+ 	retval = -EAGAIN;
++
++	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
++
+ 	if (atomic_read(&p->real_cred->user->processes) >=
+ 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+-		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
+-		    p->real_cred->user != INIT_USER)
++		if (p->real_cred->user != INIT_USER &&
++		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
+ 			goto bad_fork_free;
+ 	}
+ 
+@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
+ 	p->vfork_done = NULL;
+ 	spin_lock_init(&p->alloc_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	rwlock_init(&p->gr_fs_lock);
++#endif
++
+ 	init_sigpending(&p->pending);
+ 
+ 	p->utime = cputime_zero;
+@@ -1179,6 +1212,8 @@ static struct task_struct *copy_process(
+ 			goto bad_fork_free_pid;
+ 	}
+ 
++	gr_copy_label(p);
++
+ 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+ 	/*
+ 	 * Clear TID on mm_release()?
+@@ -1344,6 +1379,8 @@ bad_fork_cleanup_count:
+ bad_fork_free:
+ 	free_task(p);
+ fork_out:
++	gr_log_forkfail(retval);
++
+ 	return ERR_PTR(retval);
+ }
+ 
+@@ -1437,6 +1474,8 @@ long do_fork(unsigned long clone_flags,
+ 		if (clone_flags & CLONE_PARENT_SETTID)
+ 			put_user(nr, parent_tidptr);
+ 
++		gr_handle_brute_check();
++
+ 		if (clone_flags & CLONE_VFORK) {
+ 			p->vfork_done = &vfork;
+ 			init_completion(&vfork);
+@@ -1569,7 +1608,7 @@ static int unshare_fs(unsigned long unsh
+ 		return 0;
+ 
+ 	/* don't need lock here; in the worst case we'll do useless copy */
+-	if (fs->users == 1)
++	if (atomic_read(&fs->users) == 1)
+ 		return 0;
+ 
+ 	*new_fsp = copy_fs_struct(fs);
+@@ -1689,14 +1728,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
+ 		task_lock(current);
+ 
+ 		if (new_fs) {
++			unsigned long flags;
++
++			gr_fs_write_lock_irqsave(current, flags);
+ 			fs = current->fs;
+ 			write_lock(&fs->lock);
+ 			current->fs = new_fs;
+-			if (--fs->users)
++			if (atomic_dec_return(&fs->users))
+ 				new_fs = NULL;
+ 			else
+ 				new_fs = fs;
+ 			write_unlock(&fs->lock);
++			gr_fs_write_unlock_irqrestore(current, flags);
+ 		}
+ 
+ 		if (new_mm) {
+diff -urNp linux-2.6.32.12/kernel/futex.c linux-2.6.32.12/kernel/futex.c
+--- linux-2.6.32.12/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/futex.c	2010-04-04 20:46:41.689696132 -0400
+@@ -54,6 +54,7 @@
+ #include <linux/mount.h>
+ #include <linux/pagemap.h>
+ #include <linux/syscalls.h>
++#include <linux/ptrace.h>
+ #include <linux/signal.h>
+ #include <linux/module.h>
+ #include <linux/magic.h>
+@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
+ 	struct page *page;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
++		return -EFAULT;
++#endif
++
+ 	/*
+ 	 * The futex address must be "naturally" aligned.
+ 	 */
+@@ -1852,7 +1858,7 @@ retry:
+ 
+ 	restart = &current_thread_info()->restart_block;
+ 	restart->fn = futex_wait_restart;
+-	restart->futex.uaddr = (u32 *)uaddr;
++	restart->futex.uaddr = uaddr;
+ 	restart->futex.val = val;
+ 	restart->futex.time = abs_time->tv64;
+ 	restart->futex.bitset = bitset;
+@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ {
+ 	struct robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *cred = current_cred();
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->robust_list;
+ 		rcu_read_unlock();
+ 	}
+@@ -2467,7 +2481,7 @@ retry:
+  */
+ static inline int fetch_robust_entry(struct robust_list __user **entry,
+ 				     struct robust_list __user * __user *head,
+-				     int *pi)
++				     unsigned int *pi)
+ {
+ 	unsigned long uentry;
+ 
+diff -urNp linux-2.6.32.12/kernel/futex_compat.c linux-2.6.32.12/kernel/futex_compat.c
+--- linux-2.6.32.12/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/futex_compat.c	2010-04-04 20:46:41.693491350 -0400
+@@ -10,6 +10,7 @@
+ #include <linux/compat.h>
+ #include <linux/nsproxy.h>
+ #include <linux/futex.h>
++#include <linux/ptrace.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
+ {
+ 	struct compat_robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++	const struct cred *cred = current_cred();
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->compat_robust_list;
+ 		read_unlock(&tasklist_lock);
+ 	}
+diff -urNp linux-2.6.32.12/kernel/gcov/base.c linux-2.6.32.12/kernel/gcov/base.c
+--- linux-2.6.32.12/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/gcov/base.c	2010-04-04 20:46:41.693491350 -0400
+@@ -102,11 +102,6 @@ void gcov_enable_events(void)
+ }
+ 
+ #ifdef CONFIG_MODULES
+-static inline int within(void *addr, void *start, unsigned long size)
+-{
+-	return ((addr >= start) && (addr < start + size));
+-}
+-
+ /* Update list and generate events when modules are unloaded. */
+ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
+ 				void *data)
+@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
+ 	prev = NULL;
+ 	/* Remove entries located in module from linked list. */
+ 	for (info = gcov_info_head; info; info = info->next) {
+-		if (within(info, mod->module_core, mod->core_size)) {
++		if (within_module_core_rw((unsigned long)info, mod)) {
+ 			if (prev)
+ 				prev->next = info->next;
+ 			else
+diff -urNp linux-2.6.32.12/kernel/hrtimer.c linux-2.6.32.12/kernel/hrtimer.c
+--- linux-2.6.32.12/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
++++ linux-2.6.32.12/kernel/hrtimer.c	2010-04-04 20:46:41.693491350 -0400
+@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
+ 	local_irq_restore(flags);
+ }
+ 
+-static void run_hrtimer_softirq(struct softirq_action *h)
++static void run_hrtimer_softirq(void)
+ {
+ 	hrtimer_peek_ahead_timers();
+ }
+diff -urNp linux-2.6.32.12/kernel/kallsyms.c linux-2.6.32.12/kernel/kallsyms.c
+--- linux-2.6.32.12/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/kallsyms.c	2010-04-06 22:21:53.692294722 -0400
+@@ -11,6 +11,9 @@
+  *      Changed the compression method from stem compression to "table lookup"
+  *      compression (see scripts/kallsyms.c for a more complete description)
+  */
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++#define __INCLUDED_BY_HIDESYM 1
++#endif
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
+ 
+ static inline int is_kernel_inittext(unsigned long addr)
+ {
++	if (system_state != SYSTEM_BOOTING)
++		return 0;
++
+ 	if (addr >= (unsigned long)_sinittext
+ 	    && addr <= (unsigned long)_einittext)
+ 		return 1;
+@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
+ 
+ static inline int is_kernel(unsigned long addr)
+ {
++	if (is_kernel_inittext(addr))
++		return 1;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#ifdef CONFIG_MODULES
++	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
++		return 0;
++#endif
++
++	if (is_kernel_text(addr))
++		return 1;
++
++	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
++		return 1;
++
++	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
++		return 1;
++	return in_gate_area_no_task(addr);
++#endif
++
+ 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+ 		return 1;
+ 	return in_gate_area_no_task(addr);
+@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
+ 
+ static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
+ {
+-	iter->name[0] = '\0';
+ 	iter->nameoff = get_symbol_offset(new_pos);
+ 	iter->pos = new_pos;
+ }
+@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
+ {
+ 	struct kallsym_iter *iter = m->private;
+ 
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	if (current_uid())
++		return 0;
++#endif
++
+ 	/* Some debugging symbols have no name.  Ignore them. */
+ 	if (!iter->name[0])
+ 		return 0;
+@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
+ 	struct kallsym_iter *iter;
+ 	int ret;
+ 
+-	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
++	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 	if (!iter)
+ 		return -ENOMEM;
+ 	reset_iter(iter, 0);
+diff -urNp linux-2.6.32.12/kernel/kgdb.c linux-2.6.32.12/kernel/kgdb.c
+--- linux-2.6.32.12/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/kgdb.c	2010-04-04 20:46:41.693491350 -0400
+@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
+ /* Guard for recursive entry */
+ static int			exception_level;
+ 
+-static struct kgdb_io		*kgdb_io_ops;
++static const struct kgdb_io	*kgdb_io_ops;
+ static DEFINE_SPINLOCK(kgdb_registration_lock);
+ 
+ /* kgdb console driver is loaded */
+@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
+  *
+  *	Register it with the KGDB core.
+  */
+-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
++int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
+ {
+ 	int err;
+ 
+@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
+  *
+  *	Unregister it with the KGDB core.
+  */
+-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
++void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
+ {
+ 	BUG_ON(kgdb_connected);
+ 
+diff -urNp linux-2.6.32.12/kernel/kmod.c linux-2.6.32.12/kernel/kmod.c
+--- linux-2.6.32.12/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/kmod.c	2010-04-04 20:46:41.693491350 -0400
+@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
+ 	if (ret >= MODULE_NAME_LEN)
+ 		return -ENAMETOOLONG;
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	/* we could do a tighter check here, but some distros
++	   are taking it upon themselves to remove CAP_SYS_MODULE
++	   from even root-running apps which cause modules to be 
++	   auto-loaded
++	*/
++	if (current_uid()) {
++		gr_log_nonroot_mod_load(module_name);
++		return -EPERM;
++	}
++#endif
++
+ 	/* If modprobe needs a service that is in a module, we get a recursive
+ 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
+ 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
+diff -urNp linux-2.6.32.12/kernel/kprobes.c linux-2.6.32.12/kernel/kprobes.c
+--- linux-2.6.32.12/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/kprobes.c	2010-04-29 17:46:36.959467563 -0400
+@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
+ 	 * kernel image and loaded module images reside. This is required
+ 	 * so x86_64 can correctly handle the %rip-relative fixups.
+ 	 */
+-	kip->insns = module_alloc(PAGE_SIZE);
++	kip->insns = module_alloc_exec(PAGE_SIZE);
+ 	if (!kip->insns) {
+ 		kfree(kip);
+ 		return NULL;
+@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
+ 		 */
+ 		if (!list_is_singular(&kprobe_insn_pages)) {
+ 			list_del(&kip->list);
+-			module_free(NULL, kip->insns);
++			module_free_exec(NULL, kip->insns);
+ 			kfree(kip);
+ 		}
+ 		return 1;
+@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
+ {
+ 	int i, err = 0;
+ 	unsigned long offset = 0, size = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 	const char *symbol_name;
+ 	void *addr;
+ 	struct kprobe_blackpoint *kb;
+@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
+ 	const char *sym = NULL;
+ 	unsigned int i = *(loff_t *) v;
+ 	unsigned long offset = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 
+ 	head = &kprobe_table[i];
+ 	preempt_disable();
+diff -urNp linux-2.6.32.12/kernel/lockdep.c linux-2.6.32.12/kernel/lockdep.c
+--- linux-2.6.32.12/kernel/lockdep.c	2010-04-29 17:49:38.578001941 -0400
++++ linux-2.6.32.12/kernel/lockdep.c	2010-04-29 18:02:39.221319476 -0400
+@@ -577,6 +577,10 @@ static int static_obj(void *obj)
+ 	int i;
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	start = ktla_ktva(start);
++#endif
++
+ 	/*
+ 	 * static variable?
+ 	 */
+@@ -592,8 +596,7 @@ static int static_obj(void *obj)
+ 	 */
+ 	for_each_possible_cpu(i) {
+ 		start = (unsigned long) per_cpu_ptr(&__per_cpu_start, i);
+-		end   = (unsigned long) per_cpu_ptr(&__per_cpu_start, i)
+-					+ PERCPU_ENOUGH_ROOM;
++		end   = start + PERCPU_ENOUGH_ROOM;
+ 
+ 		if ((addr >= start) && (addr < end))
+ 			return 1;
+@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
+ 	if (!static_obj(lock->key)) {
+ 		debug_locks_off();
+ 		printk("INFO: trying to register non-static key.\n");
++		printk("lock:%pS key:%pS.\n", lock, lock->key);
+ 		printk("the code is fine but needs lockdep annotation.\n");
+ 		printk("turning off the locking correctness validator.\n");
+ 		dump_stack();
+diff -urNp linux-2.6.32.12/kernel/lockdep_proc.c linux-2.6.32.12/kernel/lockdep_proc.c
+--- linux-2.6.32.12/kernel/lockdep_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/lockdep_proc.c	2010-04-29 17:46:37.305259446 -0400
+@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
+ 
+ static void print_name(struct seq_file *m, struct lock_class *class)
+ {
+-	char str[128];
++	char str[KSYM_NAME_LEN];
+ 	const char *name = class->name;
+ 
+ 	if (!name) {
+diff -urNp linux-2.6.32.12/kernel/module.c linux-2.6.32.12/kernel/module.c
+--- linux-2.6.32.12/kernel/module.c	2010-04-29 17:49:38.586002480 -0400
++++ linux-2.6.32.12/kernel/module.c	2010-04-29 17:49:58.693515313 -0400
+@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
+ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
+ 
+ /* Bounds of module allocation, for speeding __module_address */
+-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
++static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
++static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
+ 
+ int register_module_notifier(struct notifier_block * nb)
+ {
+@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
+ 		return true;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list) {
+-		struct symsearch arr[] = {
++		struct symsearch modarr[] = {
+ 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ 			  NOT_GPL_ONLY, false },
+ 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
+@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
+ #endif
+ 		};
+ 
+-		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
++		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
+ 			return true;
+ 	}
+ 	return false;
+@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
+ 	void *ptr;
+ 	int cpu;
+ 
+-	if (align > PAGE_SIZE) {
++	if (align-1 >= PAGE_SIZE) {
+ 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
+ 		       name, align, PAGE_SIZE);
+ 		align = PAGE_SIZE;
+@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
+ 	destroy_params(mod->kp, mod->num_kp);
+ 
+ 	/* This may be NULL, but that's OK */
+-	module_free(mod, mod->module_init);
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
+ 	kfree(mod->args);
+ 	if (mod->percpu)
+ 		percpu_modfree(mod->percpu);
+@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
+ 		percpu_modfree(mod->refptr);
+ #endif
+ 	/* Free lock-classes: */
+-	lockdep_free_key_range(mod->module_core, mod->core_size);
++	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
++	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
+ 
+ 	/* Finally, free the core (containing the module structure) */
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_core_rx);
++	module_free(mod, mod->module_core_rw);
+ 
+ #ifdef CONFIG_MPU
+ 	update_protections(current->mm);
+@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 					      strtab + sym[i].st_name, mod);
+ 			/* Ok if resolved.  */
+ 			if (ksym) {
++				pax_open_kernel();
+ 				sym[i].st_value = ksym->value;
++				pax_close_kernel();
+ 				break;
+ 			}
+ 
+@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 				secbase = (unsigned long)mod->percpu;
+ 			else
+ 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
++			pax_open_kernel();
+ 			sym[i].st_value += secbase;
++			pax_close_kernel();
+ 			break;
+ 		}
+ 	}
+@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->core_text_size = mod->core_size;
+ 	}
+ 
+ 	DEBUGP("Init section allocation order:\n");
+@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || !strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
+-					 | INIT_OFFSET_MASK);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
++			s->sh_entsize |= INIT_OFFSET_MASK;
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->init_text_size = mod->init_size;
+ 	}
+ }
+ 
+@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
+ 
+ /* As per nm */
+ static char elf_type(const Elf_Sym *sym,
+-		     Elf_Shdr *sechdrs,
+-		     const char *secstrings,
+-		     struct module *mod)
++		     const Elf_Shdr *sechdrs,
++		     const char *secstrings)
+ {
+ 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
+@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
+ 
+ 	/* Put symbol section at end of init part of module. */
+ 	symsect->sh_flags |= SHF_ALLOC;
+-	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
++	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
+ 					 symindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
+ 
+@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
+ 		}
+ 
+ 	/* Append room for core symbols at end of core part. */
+-	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
+-	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
++	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
++	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
+ 
+ 	/* Put string table section at end of init part of module. */
+ 	strsect->sh_flags |= SHF_ALLOC;
+-	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
++	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
+ 					 strindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
+ 
+ 	/* Append room for core symbols' strings at end of core part. */
+-	*pstroffs = mod->core_size;
++	*pstroffs = mod->core_size_rx;
+ 	__set_bit(0, strmap);
+-	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
++	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
+ 
+ 	return symoffs;
+ }
+@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
+ 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+ 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
+ 
++	pax_open_kernel();
++
+ 	/* Set types up while we still have access to sections. */
+ 	for (i = 0; i < mod->num_symtab; i++)
+ 		mod->symtab[i].st_info
+-			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
++			= elf_type(&mod->symtab[i], sechdrs, secstrings);
+ 
+-	mod->core_symtab = dst = mod->module_core + symoffs;
++	mod->core_symtab = dst = mod->module_core_rx + symoffs;
+ 	src = mod->symtab;
+ 	*dst = *src;
+ 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
+ 	}
+ 	mod->core_num_syms = ndst;
+ 
+-	mod->core_strtab = s = mod->module_core + stroffs;
++	mod->core_strtab = s = mod->module_core_rx + stroffs;
+ 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
+ 		if (test_bit(i, strmap))
+ 			*++s = mod->strtab[i];
++
++	pax_close_kernel();
+ }
+ #else
+ static inline unsigned long layout_symtab(struct module *mod,
+@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
+ #endif
+ }
+ 
+-static void *module_alloc_update_bounds(unsigned long size)
++static void *module_alloc_update_bounds_rw(unsigned long size)
+ {
+ 	void *ret = module_alloc(size);
+ 
+ 	if (ret) {
+ 		/* Update module bounds. */
+-		if ((unsigned long)ret < module_addr_min)
+-			module_addr_min = (unsigned long)ret;
+-		if ((unsigned long)ret + size > module_addr_max)
+-			module_addr_max = (unsigned long)ret + size;
++		if ((unsigned long)ret < module_addr_min_rw)
++			module_addr_min_rw = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rw)
++			module_addr_max_rw = (unsigned long)ret + size;
++	}
++	return ret;
++}
++
++static void *module_alloc_update_bounds_rx(unsigned long size)
++{
++	void *ret = module_alloc_exec(size);
++
++	if (ret) {
++		/* Update module bounds. */
++		if ((unsigned long)ret < module_addr_min_rx)
++			module_addr_min_rx = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rx)
++			module_addr_max_rx = (unsigned long)ret + size;
+ 	}
+ 	return ret;
+ }
+@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
+ 	unsigned int i;
+ 
+ 	/* only scan the sections containing data */
+-	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
+-			   (unsigned long)mod->module_core,
++	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
++			   (unsigned long)mod->module_core_rw,
+ 			   sizeof(struct module), GFP_KERNEL);
+ 
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
+ 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
+ 			continue;
+ 
+-		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
+-				   (unsigned long)mod->module_core,
++		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
++				   (unsigned long)mod->module_core_rw,
+ 				   sechdrs[i].sh_size, GFP_KERNEL);
+ 	}
+ }
+@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
+ 				secstrings, &stroffs, strmap);
+ 
+ 	/* Do the allocs. */
+-	ptr = module_alloc_update_bounds(mod->core_size);
++	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. Just mark it as not being a
+@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
+ 		err = -ENOMEM;
+ 		goto free_percpu;
+ 	}
+-	memset(ptr, 0, mod->core_size);
+-	mod->module_core = ptr;
++	memset(ptr, 0, mod->core_size_rw);
++	mod->module_core_rw = ptr;
+ 
+-	ptr = module_alloc_update_bounds(mod->init_size);
++	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. This block doesn't need to be
+ 	 * scanned as it contains data and code that will be freed
+ 	 * after the module is initialized.
+ 	 */
+-	kmemleak_ignore(ptr);
+-	if (!ptr && mod->init_size) {
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rw) {
++		err = -ENOMEM;
++		goto free_core_rw;
++	}
++	memset(ptr, 0, mod->init_size_rw);
++	mod->module_init_rw = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr) {
+ 		err = -ENOMEM;
+-		goto free_core;
++		goto free_init_rw;
+ 	}
+-	memset(ptr, 0, mod->init_size);
+-	mod->module_init = ptr;
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->core_size_rx);
++	pax_close_kernel();
++	mod->module_core_rx = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rx) {
++		err = -ENOMEM;
++		goto free_core_rx;
++	}
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->init_size_rx);
++	pax_close_kernel();
++	mod->module_init_rx = ptr;
+ 
+ 	/* Transfer each section which specifies SHF_ALLOC */
+ 	DEBUGP("final section addresses:\n");
+@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
+ 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+ 			continue;
+ 
+-		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
+-			dest = mod->module_init
+-				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+-		else
+-			dest = mod->module_core + sechdrs[i].sh_entsize;
++		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_init_rw
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++			else
++				dest = mod->module_init_rx
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++		} else {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
++			else
++				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
++		}
++
++		if (sechdrs[i].sh_type != SHT_NOBITS) {
++
++#ifdef CONFIG_PAX_KERNEXEC
++			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
++				pax_open_kernel();
++				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++				pax_close_kernel();
++			} else
++#endif
+ 
+-		if (sechdrs[i].sh_type != SHT_NOBITS)
+-			memcpy(dest, (void *)sechdrs[i].sh_addr,
+-			       sechdrs[i].sh_size);
++			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++		}
+ 		/* Update sh_addr to point to copy in image. */
+-		sechdrs[i].sh_addr = (unsigned long)dest;
++
++#ifdef CONFIG_PAX_KERNEXEC
++		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
++			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
++		else
++#endif
++
++			sechdrs[i].sh_addr = (unsigned long)dest;
+ 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
+ 	}
+ 	/* Module has been moved. */
+@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
+ 				      mod->name);
+ 	if (!mod->refptr) {
+ 		err = -ENOMEM;
+-		goto free_init;
++		goto free_init_rx;
+ 	}
+ #endif
+ 	/* Now we've moved module, initialize linked lists, etc. */
+@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
+ 
+ 	/* Now do relocations. */
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+-		const char *strtab = (char *)sechdrs[strindex].sh_addr;
+ 		unsigned int info = sechdrs[i].sh_info;
++		strtab = (char *)sechdrs[strindex].sh_addr;
+ 
+ 		/* Not a valid relocation section? */
+ 		if (info >= hdr->e_shnum)
+@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
+ 	 * Do it before processing of module parameters, so the module
+ 	 * can provide parameter accessor functions of its own.
+ 	 */
+-	if (mod->module_init)
+-		flush_icache_range((unsigned long)mod->module_init,
+-				   (unsigned long)mod->module_init
+-				   + mod->init_size);
+-	flush_icache_range((unsigned long)mod->module_core,
+-			   (unsigned long)mod->module_core + mod->core_size);
++	if (mod->module_init_rx)
++		flush_icache_range((unsigned long)mod->module_init_rx,
++				   (unsigned long)mod->module_init_rx
++				   + mod->init_size_rx);
++	flush_icache_range((unsigned long)mod->module_core_rx,
++			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
+ 
+ 	set_fs(old_fs);
+ 
+@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
+  free_unload:
+ 	module_unload_free(mod);
+ #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
++ free_init_rx:
+ 	percpu_modfree(mod->refptr);
+- free_init:
+ #endif
+-	module_free(mod, mod->module_init);
+- free_core:
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_init_rx);
++ free_core_rx:
++	module_free_exec(mod, mod->module_core_rx);
++ free_init_rw:
++	module_free(mod, mod->module_init_rw);
++ free_core_rw:
++	module_free(mod, mod->module_core_rw);
+ 	/* mod will be freed with core. Don't access it beyond this line! */
+  free_percpu:
+ 	if (percpu)
+@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
+ 	mod->symtab = mod->core_symtab;
+ 	mod->strtab = mod->core_strtab;
+ #endif
+-	module_free(mod, mod->module_init);
+-	mod->module_init = NULL;
+-	mod->init_size = 0;
+-	mod->init_text_size = 0;
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
++	mod->module_init_rw = NULL;
++	mod->module_init_rx = NULL;
++	mod->init_size_rw = 0;
++	mod->init_size_rx = 0;
+ 	mutex_unlock(&module_mutex);
+ 
+ 	return 0;
+@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
+ 	unsigned long nextval;
+ 
+ 	/* At worse, next value is at end of module */
+-	if (within_module_init(addr, mod))
+-		nextval = (unsigned long)mod->module_init+mod->init_text_size;
++	if (within_module_init_rx(addr, mod))
++		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
++	else if (within_module_init_rw(addr, mod))
++		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
++	else if (within_module_core_rx(addr, mod))
++		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
++	else if (within_module_core_rw(addr, mod))
++		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
+ 	else
+-		nextval = (unsigned long)mod->module_core+mod->core_text_size;
++		return NULL;
+ 
+ 	/* Scan for closest preceeding symbol, and next symbol. (ELF
+ 	   starts real symbols at 1). */
+@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
+ 	char buf[8];
+ 
+ 	seq_printf(m, "%s %u",
+-		   mod->name, mod->init_size + mod->core_size);
++		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
+ 	print_unload_info(m, mod);
+ 
+ 	/* Informative for users. */
+@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
+ 		   mod->state == MODULE_STATE_COMING ? "Loading":
+ 		   "Live");
+ 	/* Used by oprofile and other similar tools. */
+-	seq_printf(m, " 0x%p", mod->module_core);
++	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
+ 
+ 	/* Taints info */
+ 	if (mod->taints)
+@@ -2979,7 +3066,17 @@ static const struct file_operations proc
+ 
+ static int __init proc_modules_init(void)
+ {
++#ifndef CONFIG_GRKERNSEC_HIDESYM
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
++#else
+ 	proc_create("modules", 0, NULL, &proc_modules_operations);
++#endif
++#else
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_modules_init);
+@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
+ {
+ 	struct module *mod;
+ 
+-	if (addr < module_addr_min || addr > module_addr_max)
++	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
++	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
+ 		return NULL;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list)
+-		if (within_module_core(addr, mod)
+-		    || within_module_init(addr, mod))
++		if (within_module_init(addr, mod) || within_module_core(addr, mod))
+ 			return mod;
+ 	return NULL;
+ }
+@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
+  */
+ struct module *__module_text_address(unsigned long addr)
+ {
+-	struct module *mod = __module_address(addr);
++	struct module *mod;
++
++#ifdef CONFIG_X86_32
++	addr = ktla_ktva(addr);
++#endif
++
++	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
++		return NULL;
++
++	mod = __module_address(addr);
++
+ 	if (mod) {
+ 		/* Make sure it's within the text section. */
+-		if (!within(addr, mod->module_init, mod->init_text_size)
+-		    && !within(addr, mod->module_core, mod->core_text_size))
++		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
+ 			mod = NULL;
+ 	}
+ 	return mod;
+diff -urNp linux-2.6.32.12/kernel/panic.c linux-2.6.32.12/kernel/panic.c
+--- linux-2.6.32.12/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/panic.c	2010-04-04 20:46:41.693491350 -0400
+@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
+  */
+ void __stack_chk_fail(void)
+ {
+-	panic("stack-protector: Kernel stack is corrupted in: %p\n",
++	dump_stack();
++	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
+ 		__builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+diff -urNp linux-2.6.32.12/kernel/params.c linux-2.6.32.12/kernel/params.c
+--- linux-2.6.32.12/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/params.c	2010-04-04 20:46:41.693491350 -0400
+@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops module_sysfs_ops = {
++static const struct sysfs_ops module_sysfs_ops = {
+ 	.show = module_attr_show,
+ 	.store = module_attr_store,
+ };
+@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops module_uevent_ops = {
++static const struct kset_uevent_ops module_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.12/kernel/pid.c linux-2.6.32.12/kernel/pid.c
+--- linux-2.6.32.12/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/pid.c	2010-04-04 20:46:41.693491350 -0400
+@@ -33,6 +33,7 @@
+ #include <linux/rculist.h>
+ #include <linux/bootmem.h>
+ #include <linux/hash.h>
++#include <linux/security.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/init_task.h>
+ #include <linux/syscalls.h>
+@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
+ 
+ int pid_max = PID_MAX_DEFAULT;
+ 
+-#define RESERVED_PIDS		300
++#define RESERVED_PIDS		500
+ 
+ int pid_max_min = RESERVED_PIDS + 1;
+ int pid_max_max = PID_MAX_LIMIT;
+@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
+  */
+ struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
+ {
+-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++	struct task_struct *task;
++	
++	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++
++	if (gr_pid_is_chrooted(task))
++		return NULL;
++
++	return task;
+ }
+ 
+ struct task_struct *find_task_by_vpid(pid_t vnr)
+diff -urNp linux-2.6.32.12/kernel/posix-cpu-timers.c linux-2.6.32.12/kernel/posix-cpu-timers.c
+--- linux-2.6.32.12/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/posix-cpu-timers.c	2010-04-04 20:46:41.697788265 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/posix-timers.h>
+ #include <linux/errno.h>
+ #include <linux/math64.h>
++#include <linux/security.h>
+ #include <asm/uaccess.h>
+ #include <linux/kernel_stat.h>
+ #include <trace/events/timer.h>
+@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
+ 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
+ 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+diff -urNp linux-2.6.32.12/kernel/power/hibernate.c linux-2.6.32.12/kernel/power/hibernate.c
+--- linux-2.6.32.12/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/power/hibernate.c	2010-04-04 20:46:41.697788265 -0400
+@@ -48,14 +48,14 @@ enum {
+ 
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+ 
+-static struct platform_hibernation_ops *hibernation_ops;
++static const struct platform_hibernation_ops *hibernation_ops;
+ 
+ /**
+  * hibernation_set_ops - set the global hibernate operations
+  * @ops: the hibernation operations to use in subsequent hibernation transitions
+  */
+ 
+-void hibernation_set_ops(struct platform_hibernation_ops *ops)
++void hibernation_set_ops(const struct platform_hibernation_ops *ops)
+ {
+ 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
+ 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
+diff -urNp linux-2.6.32.12/kernel/power/poweroff.c linux-2.6.32.12/kernel/power/poweroff.c
+--- linux-2.6.32.12/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/power/poweroff.c	2010-04-04 20:46:41.697788265 -0400
+@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
+ 	.enable_mask	= SYSRQ_ENABLE_BOOT,
+ };
+ 
+-static int pm_sysrq_init(void)
++static int __init pm_sysrq_init(void)
+ {
+ 	register_sysrq_key('o', &sysrq_poweroff_op);
+ 	return 0;
+diff -urNp linux-2.6.32.12/kernel/power/process.c linux-2.6.32.12/kernel/power/process.c
+--- linux-2.6.32.12/kernel/power/process.c	2010-04-29 17:49:38.590000225 -0400
++++ linux-2.6.32.12/kernel/power/process.c	2010-04-29 17:49:58.697130575 -0400
+@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
+ 	struct timeval start, end;
+ 	u64 elapsed_csecs64;
+ 	unsigned int elapsed_csecs;
++	bool timedout = false;
+ 
+ 	do_gettimeofday(&start);
+ 
+ 	end_time = jiffies + TIMEOUT;
+ 	do {
+ 		todo = 0;
++		if (time_after(jiffies, end_time))
++			timedout = true;
+ 		read_lock(&tasklist_lock);
+ 		do_each_thread(g, p) {
+ 			if (frozen(p) || !freezeable(p))
+@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
+ 			 * It is "frozen enough".  If the task does wake
+ 			 * up, it will immediately call try_to_freeze.
+ 			 */
+-			if (!task_is_stopped_or_traced(p) &&
+-			    !freezer_should_skip(p))
++			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
+ 				todo++;
++				if (timedout) {
++					printk(KERN_ERR "Task refusing to freeze:\n");
++					sched_show_task(p);
++				}
++			}
+ 		} while_each_thread(g, p);
+ 		read_unlock(&tasklist_lock);
+ 		yield();			/* Yield is okay here */
+-		if (time_after(jiffies, end_time))
+-			break;
+-	} while (todo);
++	} while (todo && !timedout);
+ 
+ 	do_gettimeofday(&end);
+ 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
+diff -urNp linux-2.6.32.12/kernel/power/suspend.c linux-2.6.32.12/kernel/power/suspend.c
+--- linux-2.6.32.12/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/power/suspend.c	2010-04-04 20:46:41.697788265 -0400
+@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
+ 	[PM_SUSPEND_MEM]	= "mem",
+ };
+ 
+-static struct platform_suspend_ops *suspend_ops;
++static const struct platform_suspend_ops *suspend_ops;
+ 
+ /**
+  *	suspend_set_ops - Set the global suspend method table.
+  *	@ops:	Pointer to ops structure.
+  */
+-void suspend_set_ops(struct platform_suspend_ops *ops)
++void suspend_set_ops(const struct platform_suspend_ops *ops)
+ {
+ 	mutex_lock(&pm_mutex);
+ 	suspend_ops = ops;
+diff -urNp linux-2.6.32.12/kernel/printk.c linux-2.6.32.12/kernel/printk.c
+--- linux-2.6.32.12/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/printk.c	2010-04-04 20:46:41.697788265 -0400
+@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
+ 	char c;
+ 	int error = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_DMESG
++	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
++		return -EPERM;
++#endif
++
+ 	error = security_syslog(type);
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.12/kernel/ptrace.c linux-2.6.32.12/kernel/ptrace.c
+--- linux-2.6.32.12/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/ptrace.c	2010-04-04 20:46:41.697788265 -0400
+@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
+ 	     cred->gid != tcred->egid ||
+ 	     cred->gid != tcred->sgid ||
+ 	     cred->gid != tcred->gid) &&
+-	    !capable(CAP_SYS_PTRACE)) {
++	    !capable_nolog(CAP_SYS_PTRACE)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
+ 	smp_rmb();
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+-	if (!dumpable && !capable(CAP_SYS_PTRACE))
++	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
+ 		return -EPERM;
+ 
+ 	return security_ptrace_access_check(task, mode);
+@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
+ 		goto unlock_tasklist;
+ 
+ 	task->ptrace = PT_PTRACED;
+-	if (capable(CAP_SYS_PTRACE))
++	if (capable_nolog(CAP_SYS_PTRACE))
+ 		task->ptrace |= PT_PTRACE_CAP;
+ 
+ 	__ptrace_link(task, current);
+@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
+ 		ret = ptrace_setoptions(child, data);
+ 		break;
+ 	case PTRACE_GETEVENTMSG:
+-		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
++		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
+ 		break;
+ 
+ 	case PTRACE_GETSIGINFO:
+ 		ret = ptrace_getsiginfo(child, &siginfo);
+ 		if (!ret)
+-			ret = copy_siginfo_to_user((siginfo_t __user *) data,
++			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
+ 						   &siginfo);
+ 		break;
+ 
+ 	case PTRACE_SETSIGINFO:
+-		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
++		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
+ 				   sizeof siginfo))
+ 			ret = -EFAULT;
+ 		else
+@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
+ 		goto out;
+ 	}
+ 
++	if (gr_handle_ptrace(child, request)) {
++		ret = -EPERM;
++		goto out_put_task_struct;
++	}
++
+ 	if (request == PTRACE_ATTACH) {
+ 		ret = ptrace_attach(child);
+ 		/*
+ 		 * Some architectures need to do book-keeping after
+ 		 * a ptrace attach.
+ 		 */
+-		if (!ret)
++		if (!ret) {
+ 			arch_ptrace_attach(child);
++			gr_audit_ptrace(child);
++		}
+ 		goto out_put_task_struct;
+ 	}
+ 
+@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
+ 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
+ 	if (copied != sizeof(tmp))
+ 		return -EIO;
+-	return put_user(tmp, (unsigned long __user *)data);
++	return put_user(tmp, (__force unsigned long __user *)data);
+ }
+ 
+ int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+diff -urNp linux-2.6.32.12/kernel/rcutree.c linux-2.6.32.12/kernel/rcutree.c
+--- linux-2.6.32.12/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/rcutree.c	2010-04-04 20:46:41.697788265 -0400
+@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
+ /*
+  * Do softirq processing for the current CPU.
+  */
+-static void rcu_process_callbacks(struct softirq_action *unused)
++static void rcu_process_callbacks(void)
+ {
+ 	/*
+ 	 * Memory references from any prior RCU read-side critical sections
+diff -urNp linux-2.6.32.12/kernel/relay.c linux-2.6.32.12/kernel/relay.c
+--- linux-2.6.32.12/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/relay.c	2010-04-04 20:46:41.697788265 -0400
+@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
+ 		return 0;
+ 
+ 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
+-	if (ret < 0 || ret < total_len)
++	if ((int)ret < 0 || ret < total_len)
+ 		return ret;
+ 
+         if (read_start + ret == nonpad_end)
+diff -urNp linux-2.6.32.12/kernel/resource.c linux-2.6.32.12/kernel/resource.c
+--- linux-2.6.32.12/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/resource.c	2010-04-04 20:46:41.697788265 -0400
+@@ -132,8 +132,18 @@ static const struct file_operations proc
+ 
+ static int __init ioresources_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
++#endif
++#else
+ 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
+ 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
++#endif
+ 	return 0;
+ }
+ __initcall(ioresources_init);
+diff -urNp linux-2.6.32.12/kernel/sched.c linux-2.6.32.12/kernel/sched.c
+--- linux-2.6.32.12/kernel/sched.c	2010-04-29 17:49:38.609495328 -0400
++++ linux-2.6.32.12/kernel/sched.c	2010-04-29 17:49:58.717524885 -0400
+@@ -4841,7 +4841,7 @@ out:
+  * In CONFIG_NO_HZ case, the idle load balance owner will do the
+  * rebalancing for all the cpus for whom scheduler ticks are stopped.
+  */
+-static void run_rebalance_domains(struct softirq_action *h)
++static void run_rebalance_domains(void)
+ {
+ 	int this_cpu = smp_processor_id();
+ 	struct rq *this_rq = cpu_rq(this_cpu);
+@@ -6110,6 +6110,8 @@ int can_nice(const struct task_struct *p
+ 	/* convert nice value [19,-20] to rlimit style value [1,40] */
+ 	int nice_rlim = 20 - nice;
+ 
++	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
++
+ 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+ 		capable(CAP_SYS_NICE));
+ }
+@@ -6143,7 +6145,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+ 	if (nice > 19)
+ 		nice = 19;
+ 
+-	if (increment < 0 && !can_nice(current, nice))
++	if (increment < 0 && (!can_nice(current, nice) ||
++			      gr_handle_chroot_nice()))
+ 		return -EPERM;
+ 
+ 	retval = security_task_setnice(current, nice);
+@@ -6293,6 +6296,8 @@ recheck:
+ 		if (rt_policy(policy)) {
+ 			unsigned long rlim_rtprio;
+ 
++			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
++
+ 			if (!lock_task_sighand(p, &flags))
+ 				return -ESRCH;
+ 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
+@@ -7452,7 +7457,7 @@ static struct ctl_table sd_ctl_dir[] = {
+ 		.procname	= "sched_domain",
+ 		.mode		= 0555,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table sd_ctl_root[] = {
+@@ -7462,7 +7467,7 @@ static struct ctl_table sd_ctl_root[] = 
+ 		.mode		= 0555,
+ 		.child		= sd_ctl_dir,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table *sd_alloc_ctl_entry(int n)
+diff -urNp linux-2.6.32.12/kernel/signal.c linux-2.6.32.12/kernel/signal.c
+--- linux-2.6.32.12/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/signal.c	2010-04-29 17:46:37.333938325 -0400
+@@ -41,12 +41,12 @@
+ 
+ static struct kmem_cache *sigqueue_cachep;
+ 
+-static void __user *sig_handler(struct task_struct *t, int sig)
++static __sighandler_t sig_handler(struct task_struct *t, int sig)
+ {
+ 	return t->sighand->action[sig - 1].sa.sa_handler;
+ }
+ 
+-static int sig_handler_ignored(void __user *handler, int sig)
++static int sig_handler_ignored(__sighandler_t handler, int sig)
+ {
+ 	/* Is it explicitly or implicitly ignored? */
+ 	return handler == SIG_IGN ||
+@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
+ static int sig_task_ignored(struct task_struct *t, int sig,
+ 		int from_ancestor_ns)
+ {
+-	void __user *handler;
++	__sighandler_t handler;
+ 
+ 	handler = sig_handler(t, sig);
+ 
+@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
+ 	 */
+ 	user = get_uid(__task_cred(t)->user);
+ 	atomic_inc(&user->sigpending);
++
++	if (!override_rlimit)
++		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
+ 	if (override_rlimit ||
+ 	    atomic_read(&user->sigpending) <=
+ 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
+ 
+ int unhandled_signal(struct task_struct *tsk, int sig)
+ {
+-	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
++	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
+ 	if (is_global_init(tsk))
+ 		return 1;
+ 	if (handler != SIG_IGN && handler != SIG_DFL)
+@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
+ 		}
+ 	}
+ 
++	if (gr_handle_signal(t, sig))
++		return -EPERM;
++
+ 	return security_task_kill(t, info, sig, 0);
+ }
+ 
+@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
+ 	return send_signal(sig, info, p, 1);
+ }
+ 
+-static int
++int
+ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ {
+ 	return send_signal(sig, info, t, 0);
+@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
+ 	ret = specific_send_sig_info(sig, info, t);
+ 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
+ 
++	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
++	gr_handle_crash(t, sig);
++
+ 	return ret;
+ }
+ 
+@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
+ {
+ 	int ret = check_kill_permission(sig, info, p);
+ 
+-	if (!ret && sig)
++	if (!ret && sig) {
+ 		ret = do_send_sig_info(sig, info, p, true);
++		if (!ret)
++			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
++	}
+ 
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.12/kernel/smp.c linux-2.6.32.12/kernel/smp.c
+--- linux-2.6.32.12/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/smp.c	2010-04-04 20:46:41.701624986 -0400
+@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
+ }
+ EXPORT_SYMBOL(smp_call_function);
+ 
+-void ipi_call_lock(void)
++void ipi_call_lock(void) __acquires(call_function.lock)
+ {
+ 	spin_lock(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock(void)
++void ipi_call_unlock(void) __releases(call_function.lock)
+ {
+ 	spin_unlock(&call_function.lock);
+ }
+ 
+-void ipi_call_lock_irq(void)
++void ipi_call_lock_irq(void) __acquires(call_function.lock)
+ {
+ 	spin_lock_irq(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock_irq(void)
++void ipi_call_unlock_irq(void) __releases(call_function.lock)
+ {
+ 	spin_unlock_irq(&call_function.lock);
+ }
+diff -urNp linux-2.6.32.12/kernel/softirq.c linux-2.6.32.12/kernel/softirq.c
+--- linux-2.6.32.12/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/softirq.c	2010-04-04 20:46:41.701624986 -0400
+@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
+ 
+ static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+ 
+-char *softirq_to_name[NR_SOFTIRQS] = {
++const char * const softirq_to_name[NR_SOFTIRQS] = {
+ 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
+ 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
+ };
+@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
+ asmlinkage void __do_softirq(void)
+ {
+-	struct softirq_action *h;
++	const struct softirq_action *h;
+ 	__u32 pending;
+ 	int max_restart = MAX_SOFTIRQ_RESTART;
+ 	int cpu;
+@@ -216,7 +216,7 @@ restart:
+ 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
+ 
+ 			trace_softirq_entry(h, softirq_vec);
+-			h->action(h);
++			h->action();
+ 			trace_softirq_exit(h, softirq_vec);
+ 			if (unlikely(prev_count != preempt_count())) {
+ 				printk(KERN_ERR "huh, entered softirq %td %s %p"
+@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
+ 	local_irq_restore(flags);
+ }
+ 
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void open_softirq(int nr, void (*action)(void))
+ {
+ 	softirq_vec[nr].action = action;
+ }
+@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
+ 
+ EXPORT_SYMBOL(__tasklet_hi_schedule_first);
+ 
+-static void tasklet_action(struct softirq_action *a)
++static void tasklet_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
+ 	}
+ }
+ 
+-static void tasklet_hi_action(struct softirq_action *a)
++static void tasklet_hi_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+diff -urNp linux-2.6.32.12/kernel/sys.c linux-2.6.32.12/kernel/sys.c
+--- linux-2.6.32.12/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/sys.c	2010-04-04 20:46:41.701624986 -0400
+@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
+ 		error = -EACCES;
+ 		goto out;
+ 	}
++
++	if (gr_handle_chroot_setpriority(p, niceval)) {
++		error = -EACCES;
++		goto out;
++	}
++
+ 	no_nice = security_task_setnice(p, niceval);
+ 	if (no_nice) {
+ 		error = no_nice;
+@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who)
+ 					error = set_one_prio(p, niceval, error);
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* For find_user() */
+ 			break;
+@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who) {
+ 					niceval = 20 - task_nice(p);
+ 					if (niceval > retval)
+ 						retval = niceval;
+ 				}
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* for find_user() */
+ 			break;
+@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(new->gid, new->egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1 ||
+ 	    (egid != (gid_t) -1 && egid != old->gid))
+ 		new->sgid = new->egid;
+@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_group_change(gid, gid, gid))
++		goto error;
++
+ 	if (capable(CAP_SETGID))
+ 		new->gid = new->egid = new->sgid = new->fsgid = gid;
+ 	else if (gid == old->gid || gid == old->sgid)
+@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(new->uid, new->euid, -1))
++		goto error;
++
+ 	if (new->uid != old->uid) {
+ 		retval = set_user(new);
+ 		if (retval < 0)
+@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_crash_uid(uid))
++		goto error;
++	if (gr_check_user_change(uid, uid, uid))
++		goto error;
++
+ 	if (capable(CAP_SETUID)) {
+ 		new->suid = new->uid = uid;
+ 		if (uid != old->uid) {
+@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(ruid, euid, -1))
++		goto error;
++
+ 	if (ruid != (uid_t) -1) {
+ 		new->uid = ruid;
+ 		if (ruid != old->uid) {
+@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(rgid, egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1)
+ 		new->gid = rgid;
+ 	if (egid != (gid_t) -1)
+@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+ 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
+ 		goto error;
+ 
++	if (gr_check_user_change(-1, -1, uid))
++		goto error;
++
+ 	if (uid == old->uid  || uid == old->euid  ||
+ 	    uid == old->suid || uid == old->fsuid ||
+ 	    capable(CAP_SETUID)) {
+@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+ 	if (gid == old->gid  || gid == old->egid  ||
+ 	    gid == old->sgid || gid == old->fsgid ||
+ 	    capable(CAP_SETGID)) {
++		if (gr_check_group_change(-1, -1, gid))
++			goto error;
++
+ 		if (gid != old_fsgid) {
+ 			new->fsgid = gid;
+ 			goto change_okay;
+@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
+ 			error = get_dumpable(me->mm);
+ 			break;
+ 		case PR_SET_DUMPABLE:
+-			if (arg2 < 0 || arg2 > 1) {
++			if (arg2 > 1) {
+ 				error = -EINVAL;
+ 				break;
+ 			}
+diff -urNp linux-2.6.32.12/kernel/sysctl.c linux-2.6.32.12/kernel/sysctl.c
+--- linux-2.6.32.12/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/sysctl.c	2010-04-04 20:46:41.701624986 -0400
+@@ -63,6 +63,13 @@
+ static int deprecated_sysctl_warning(struct __sysctl_args *args);
+ 
+ #if defined(CONFIG_SYSCTL)
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
++extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
++				const int op);
++extern int gr_handle_chroot_sysctl(const int op);
+ 
+ /* External variables not in a header file. */
+ extern int C_A_D;
+@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
+ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
++extern ctl_table grsecurity_table[];
+ 
+ static struct ctl_table root_table[];
+ static struct ctl_table_root sysctl_table_root;
+@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
+ int sysctl_legacy_va_layout;
+ #endif
+ 
++#ifdef CONFIG_PAX_SOFTMODE
++static ctl_table pax_table[] = {
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "softmode",
++		.data		= &pax_softmode,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++
++	{ .ctl_name = 0 }
++};
++#endif
++
+ extern int prove_locking;
+ extern int lock_stat;
+ 
+@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
+ #endif
+ 
+ static struct ctl_table kern_table[] = {
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsecurity",
++		.mode		= 0500,
++		.child		= grsecurity_table,
++	},
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "pax",
++		.mode		= 0500,
++		.child		= pax_table,
++	},
++#endif
++
+ 	{
+ 		.ctl_name	= CTL_UNNUMBERED,
+ 		.procname	= "sched_child_runs_first",
+@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
+ 	return 0;
+ }
+ 
++static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
++
+ static int parse_table(int __user *name, int nlen,
+ 		       void __user *oldval, size_t __user *oldlenp,
+ 		       void __user *newval, size_t newlen,
+@@ -1821,7 +1864,7 @@ repeat:
+ 		if (n == table->ctl_name) {
+ 			int error;
+ 			if (table->child) {
+-				if (sysctl_perm(root, table, MAY_EXEC))
++				if (sysctl_perm_nochk(root, table, MAY_EXEC))
+ 					return -EPERM;
+ 				name++;
+ 				nlen--;
+@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
+ 	int error;
+ 	int mode;
+ 
++	if (table->parent != NULL && table->parent->procname != NULL &&
++	   table->procname != NULL &&
++	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
++		return -EACCES;
++	if (gr_handle_chroot_sysctl(op))
++		return -EACCES;
++	error = gr_handle_sysctl(table, op);
++	if (error)
++		return error;
++
++	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
++	if (error)
++		return error;
++
++	if (root->permissions)
++		mode = root->permissions(root, current->nsproxy, table);
++	else
++		mode = table->mode;
++
++	return test_perm(mode, op);
++}
++
++int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
++{
++	int error;
++	int mode;
++
+ 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.12/kernel/taskstats.c linux-2.6.32.12/kernel/taskstats.c
+--- linux-2.6.32.12/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/taskstats.c	2010-04-04 20:46:41.701624986 -0400
+@@ -26,9 +26,12 @@
+ #include <linux/cgroup.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/grsecurity.h>
+ #include <net/genetlink.h>
+ #include <asm/atomic.h>
+ 
++extern int gr_is_taskstats_denied(int pid);
++
+ /*
+  * Maximum length of a cpumask that can be specified in
+  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
+@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
+ 	size_t size;
+ 	cpumask_var_t mask;
+ 
++	if (gr_is_taskstats_denied(current->pid))
++		return -EACCES;
++
+ 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.12/kernel/time/tick-broadcast.c linux-2.6.32.12/kernel/time/tick-broadcast.c
+--- linux-2.6.32.12/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/time/tick-broadcast.c	2010-04-04 20:46:41.701624986 -0400
+@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
+ 		 * then clear the broadcast bit.
+ 		 */
+ 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+-			int cpu = smp_processor_id();
++			cpu = smp_processor_id();
+ 
+ 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
+ 			tick_broadcast_clear_oneshot(cpu);
+diff -urNp linux-2.6.32.12/kernel/time.c linux-2.6.32.12/kernel/time.c
+--- linux-2.6.32.12/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/time.c	2010-04-04 20:46:41.701624986 -0400
+@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
+ 		return err;
+ 
+ 	do_settimeofday(&tv);
++
++	gr_log_timechange();
++
+ 	return 0;
+ }
+ 
+@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
+ 			return -EFAULT;
+ 	}
+ 
++	gr_log_timechange();
++
+ 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
+ }
+ 
+@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
+  * Avoid unnecessary multiplications/divisions in the
+  * two most common HZ cases:
+  */
+-unsigned int inline jiffies_to_msecs(const unsigned long j)
++inline unsigned int jiffies_to_msecs(const unsigned long j)
+ {
+ #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
+ 	return (MSEC_PER_SEC / HZ) * j;
+@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
+ }
+ EXPORT_SYMBOL(jiffies_to_msecs);
+ 
+-unsigned int inline jiffies_to_usecs(const unsigned long j)
++inline unsigned int jiffies_to_usecs(const unsigned long j)
+ {
+ #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
+ 	return (USEC_PER_SEC / HZ) * j;
+diff -urNp linux-2.6.32.12/kernel/timer.c linux-2.6.32.12/kernel/timer.c
+--- linux-2.6.32.12/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/timer.c	2010-04-04 20:46:41.701624986 -0400
+@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
+ /*
+  * This function runs timers and the timer-tq in bottom half context.
+  */
+-static void run_timer_softirq(struct softirq_action *h)
++static void run_timer_softirq(void)
+ {
+ 	struct tvec_base *base = __get_cpu_var(tvec_bases);
+ 
+diff -urNp linux-2.6.32.12/kernel/trace/ftrace.c linux-2.6.32.12/kernel/trace/ftrace.c
+--- linux-2.6.32.12/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
++++ linux-2.6.32.12/kernel/trace/ftrace.c	2010-04-04 20:46:41.701624986 -0400
+@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
+ 
+ 	ip = rec->ip;
+ 
++	ret = ftrace_arch_code_modify_prepare();
++	FTRACE_WARN_ON(ret);
++	if (ret)
++		return 0;
++
+ 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
++	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
+ 	if (ret) {
+ 		ftrace_bug(ret, ip);
+ 		rec->flags |= FTRACE_FL_FAILED;
+-		return 0;
+ 	}
+-	return 1;
++	return ret ? 0 : 1;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.12/kernel/trace/Kconfig linux-2.6.32.12/kernel/trace/Kconfig
+--- linux-2.6.32.12/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/trace/Kconfig	2010-04-04 20:46:41.701624986 -0400
+@@ -126,6 +126,7 @@ if FTRACE
+ config FUNCTION_TRACER
+ 	bool "Kernel Function Tracer"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FRAME_POINTER
+ 	select KALLSYMS
+ 	select GENERIC_TRACER
+@@ -343,6 +344,7 @@ config POWER_TRACER
+ config STACK_TRACER
+ 	bool "Trace max stack"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FUNCTION_TRACER
+ 	select STACKTRACE
+ 	select KALLSYMS
+diff -urNp linux-2.6.32.12/kernel/trace/ring_buffer.c linux-2.6.32.12/kernel/trace/ring_buffer.c
+--- linux-2.6.32.12/kernel/trace/ring_buffer.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.12/kernel/trace/ring_buffer.c	2010-04-29 17:46:37.362529614 -0400
+@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
+  * the reader page). But if the next page is a header page,
+  * its flags will be non zero.
+  */
+-static int inline
++static inline int
+ rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
+ 		struct buffer_page *page, struct list_head *list)
+ {
+diff -urNp linux-2.6.32.12/kernel/trace/trace.c linux-2.6.32.12/kernel/trace/trace.c
+--- linux-2.6.32.12/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.12/kernel/trace/trace.c	2010-04-04 20:46:41.705142860 -0400
+@@ -3808,10 +3808,9 @@ static const struct file_operations trac
+ };
+ #endif
+ 
+-static struct dentry *d_tracer;
+-
+ struct dentry *tracing_init_dentry(void)
+ {
++	static struct dentry *d_tracer;
+ 	static int once;
+ 
+ 	if (d_tracer)
+@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
+ 	return d_tracer;
+ }
+ 
+-static struct dentry *d_percpu;
+-
+ struct dentry *tracing_dentry_percpu(void)
+ {
++	static struct dentry *d_percpu;
+ 	static int once;
+ 	struct dentry *d_tracer;
+ 
+diff -urNp linux-2.6.32.12/kernel/trace/trace_events.c linux-2.6.32.12/kernel/trace/trace_events.c
+--- linux-2.6.32.12/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/trace/trace_events.c	2010-04-04 20:46:41.705142860 -0400
+@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
+  * Modules must own their file_operations to keep up with
+  * reference counting.
+  */
++
++/* cannot be const */
+ struct ftrace_module_file_ops {
+ 	struct list_head		list;
+ 	struct module			*mod;
+diff -urNp linux-2.6.32.12/kernel/trace/trace_output.c linux-2.6.32.12/kernel/trace/trace_output.c
+--- linux-2.6.32.12/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/trace/trace_output.c	2010-04-04 20:46:41.705142860 -0400
+@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
+ 		return 0;
+ 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
+ 	if (!IS_ERR(p)) {
+-		p = mangle_path(s->buffer + s->len, p, "\n");
++		p = mangle_path(s->buffer + s->len, p, "\n\\");
+ 		if (p) {
+ 			s->len = p - s->buffer;
+ 			return 1;
+diff -urNp linux-2.6.32.12/kernel/trace/trace_stack.c linux-2.6.32.12/kernel/trace/trace_stack.c
+--- linux-2.6.32.12/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/trace/trace_stack.c	2010-04-04 20:46:41.705142860 -0400
+@@ -50,7 +50,7 @@ static inline void check_stack(void)
+ 		return;
+ 
+ 	/* we do not handle interrupt stacks yet */
+-	if (!object_is_on_stack(&this_size))
++	if (!object_starts_on_stack(&this_size))
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.12/kernel/utsname_sysctl.c linux-2.6.32.12/kernel/utsname_sysctl.c
+--- linux-2.6.32.12/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/kernel/utsname_sysctl.c	2010-04-04 20:46:41.705142860 -0400
+@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
+ 		.proc_handler	= proc_do_uts_string,
+ 		.strategy	= sysctl_uts_string,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table uts_root_table[] = {
+@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
+ 		.mode		= 0555,
+ 		.child		= uts_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init utsname_sysctl_init(void)
+diff -urNp linux-2.6.32.12/lib/bug.c linux-2.6.32.12/lib/bug.c
+--- linux-2.6.32.12/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/bug.c	2010-04-04 20:46:41.705142860 -0400
+@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
+ 		return BUG_TRAP_TYPE_NONE;
+ 
+ 	bug = find_bug(bugaddr);
++	if (!bug)
++		return BUG_TRAP_TYPE_NONE;
+ 
+ 	printk(KERN_EMERG "------------[ cut here ]------------\n");
+ 
+diff -urNp linux-2.6.32.12/lib/debugobjects.c linux-2.6.32.12/lib/debugobjects.c
+--- linux-2.6.32.12/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/debugobjects.c	2010-04-04 20:46:41.705142860 -0400
+@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
+ 	if (limit > 4)
+ 		return;
+ 
+-	is_on_stack = object_is_on_stack(addr);
++	is_on_stack = object_starts_on_stack(addr);
+ 	if (is_on_stack == onstack)
+ 		return;
+ 
+diff -urNp linux-2.6.32.12/lib/dma-debug.c linux-2.6.32.12/lib/dma-debug.c
+--- linux-2.6.32.12/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/dma-debug.c	2010-04-04 20:46:41.705142860 -0400
+@@ -861,7 +861,7 @@ out:
+ 
+ static void check_for_stack(struct device *dev, void *addr)
+ {
+-	if (object_is_on_stack(addr))
++	if (object_starts_on_stack(addr))
+ 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
+ 				"stack [addr=%p]\n", addr);
+ }
+diff -urNp linux-2.6.32.12/lib/idr.c linux-2.6.32.12/lib/idr.c
+--- linux-2.6.32.12/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/idr.c	2010-04-04 20:46:41.705142860 -0400
+@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
+ 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
+ 
+ 			/* if already at the top layer, we need to grow */
+-			if (id >= 1 << (idp->layers * IDR_BITS)) {
++			if (id >= (1 << (idp->layers * IDR_BITS))) {
+ 				*starting_id = id;
+ 				return IDR_NEED_TO_GROW;
+ 			}
+diff -urNp linux-2.6.32.12/lib/inflate.c linux-2.6.32.12/lib/inflate.c
+--- linux-2.6.32.12/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/inflate.c	2010-04-04 20:46:41.705142860 -0400
+@@ -266,7 +266,7 @@ static void free(void *where)
+ 		malloc_ptr = free_mem_ptr;
+ }
+ #else
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ #endif
+ 
+diff -urNp linux-2.6.32.12/lib/Kconfig.debug linux-2.6.32.12/lib/Kconfig.debug
+--- linux-2.6.32.12/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/Kconfig.debug	2010-04-04 20:46:41.705142860 -0400
+@@ -905,7 +905,7 @@ config LATENCYTOP
+ 	select STACKTRACE
+ 	select SCHEDSTATS
+ 	select SCHED_DEBUG
+-	depends on HAVE_LATENCYTOP_SUPPORT
++	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
+ 	help
+ 	  Enable this option if you want to use the LatencyTOP tool
+ 	  to find out which userspace is blocking on what kernel operations.
+diff -urNp linux-2.6.32.12/lib/kobject.c linux-2.6.32.12/lib/kobject.c
+--- linux-2.6.32.12/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/kobject.c	2010-04-04 20:46:41.705142860 -0400
+@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
+ 	return ret;
+ }
+ 
+-struct sysfs_ops kobj_sysfs_ops = {
++const struct sysfs_ops kobj_sysfs_ops = {
+ 	.show	= kobj_attr_show,
+ 	.store	= kobj_attr_store,
+ };
+@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ static struct kset *kset_create(const char *name,
+-				struct kset_uevent_ops *uevent_ops,
++				const struct kset_uevent_ops *uevent_ops,
+ 				struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ struct kset *kset_create_and_add(const char *name,
+-				 struct kset_uevent_ops *uevent_ops,
++				 const struct kset_uevent_ops *uevent_ops,
+ 				 struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+diff -urNp linux-2.6.32.12/lib/kobject_uevent.c linux-2.6.32.12/lib/kobject_uevent.c
+--- linux-2.6.32.12/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/kobject_uevent.c	2010-04-04 20:46:41.705142860 -0400
+@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
+ 	const char *subsystem;
+ 	struct kobject *top_kobj;
+ 	struct kset *kset;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ 	u64 seq;
+ 	int i = 0;
+ 	int retval = 0;
+diff -urNp linux-2.6.32.12/lib/parser.c linux-2.6.32.12/lib/parser.c
+--- linux-2.6.32.12/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/parser.c	2010-04-04 20:46:41.705142860 -0400
+@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
+ 	char *buf;
+ 	int ret;
+ 
+-	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
++	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
+ 	if (!buf)
+ 		return -ENOMEM;
+ 	memcpy(buf, s->from, s->to - s->from);
+diff -urNp linux-2.6.32.12/lib/radix-tree.c linux-2.6.32.12/lib/radix-tree.c
+--- linux-2.6.32.12/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/radix-tree.c	2010-04-04 20:46:41.705142860 -0400
+@@ -81,7 +81,7 @@ struct radix_tree_preload {
+ 	int nr;
+ 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
+ };
+-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
++static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
+ 
+ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
+ {
+diff -urNp linux-2.6.32.12/lib/random32.c linux-2.6.32.12/lib/random32.c
+--- linux-2.6.32.12/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/lib/random32.c	2010-04-04 20:46:41.705142860 -0400
+@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
+  */
+ static inline u32 __seed(u32 x, u32 m)
+ {
+-	return (x < m) ? x + m : x;
++	return (x <= m) ? x + m + 1 : x;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.12/localversion-grsec linux-2.6.32.12/localversion-grsec
+--- linux-2.6.32.12/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.12/localversion-grsec	2010-04-04 20:46:41.705142860 -0400
+@@ -0,0 +1 @@
++-grsec
+diff -urNp linux-2.6.32.12/Makefile linux-2.6.32.12/Makefile
+--- linux-2.6.32.12/Makefile	2010-04-29 17:49:37.365428457 -0400
++++ linux-2.6.32.12/Makefile	2010-04-29 17:49:57.861101311 -0400
+@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
+ 
+ HOSTCC       = gcc
+ HOSTCXX      = g++
+-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
+-HOSTCXXFLAGS = -O2
++HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
++HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
+ 
+ # Decide whether to build built-in, modular, or both.
+ # Normally, just do built-in.
+@@ -644,7 +644,7 @@ export mod_strip_cmd
+ 
+ 
+ ifeq ($(KBUILD_EXTMOD),)
+-core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ 
+ vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
+ 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
+diff -urNp linux-2.6.32.12/mm/filemap.c linux-2.6.32.12/mm/filemap.c
+--- linux-2.6.32.12/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/filemap.c	2010-04-04 20:46:41.708732353 -0400
+@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
+ 	struct address_space *mapping = file->f_mapping;
+ 
+ 	if (!mapping->a_ops->readpage)
+-		return -ENOEXEC;
++		return -ENODEV;
+ 	file_accessed(file);
+ 	vma->vm_ops = &generic_file_vm_ops;
+ 	vma->vm_flags |= VM_CAN_NONLINEAR;
+@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
+                         *pos = i_size_read(inode);
+ 
+ 		if (limit != RLIM_INFINITY) {
++			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
+ 			if (*pos >= limit) {
+ 				send_sig(SIGXFSZ, current, 0);
+ 				return -EFBIG;
+diff -urNp linux-2.6.32.12/mm/fremap.c linux-2.6.32.12/mm/fremap.c
+--- linux-2.6.32.12/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/fremap.c	2010-04-04 20:46:41.708732353 -0400
+@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
+  retry:
+ 	vma = find_vma(mm, start);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
++		goto out;
++#endif
++
+ 	/*
+ 	 * Make sure the vma is shared, that it supports prefaulting,
+ 	 * and that the remapped range is valid and fully within
+diff -urNp linux-2.6.32.12/mm/highmem.c linux-2.6.32.12/mm/highmem.c
+--- linux-2.6.32.12/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/highmem.c	2010-04-04 20:46:41.708732353 -0400
+@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
+ 		 * So no dangers, even with speculative execution.
+ 		 */
+ 		page = pte_page(pkmap_page_table[i]);
++		pax_open_kernel();
+ 		pte_clear(&init_mm, (unsigned long)page_address(page),
+ 			  &pkmap_page_table[i]);
+-
++		pax_close_kernel();
+ 		set_page_address(page, NULL);
+ 		need_flush = 1;
+ 	}
+@@ -177,9 +178,11 @@ start:
+ 		}
+ 	}
+ 	vaddr = PKMAP_ADDR(last_pkmap_nr);
++
++	pax_open_kernel();
+ 	set_pte_at(&init_mm, vaddr,
+ 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
+-
++	pax_close_kernel();
+ 	pkmap_count[last_pkmap_nr] = 1;
+ 	set_page_address(page, (void *)vaddr);
+ 
+diff -urNp linux-2.6.32.12/mm/hugetlb.c linux-2.6.32.12/mm/hugetlb.c
+--- linux-2.6.32.12/mm/hugetlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/hugetlb.c	2010-04-04 20:46:41.708732353 -0400
+@@ -1924,6 +1924,26 @@ static int unmap_ref_private(struct mm_s
+ 	return 1;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	struct vm_area_struct *vma_m;
++	unsigned long address_m;
++	pte_t *ptep_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
++	get_page(page_m);
++	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
++}
++#endif
++
+ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			unsigned long address, pte_t *ptep, pte_t pte,
+ 			struct page *pagecache_page)
+@@ -1995,6 +2015,11 @@ retry_avoidcopy:
+ 		huge_ptep_clear_flush(vma, address, ptep);
+ 		set_huge_pte_at(mm, address, ptep,
+ 				make_huge_pte(vma, new_page, 1));
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_huge_pte(vma, address, new_page);
++#endif
++
+ 		/* Make the old page be freed below */
+ 		new_page = old_page;
+ 	}
+@@ -2124,6 +2149,10 @@ retry:
+ 				&& (vma->vm_flags & VM_SHARED)));
+ 	set_huge_pte_at(mm, address, ptep, new_pte);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_huge_pte(vma, address, page);
++#endif
++
+ 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
+ 		/* Optimization, do the COW without a second fault */
+ 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
+@@ -2152,6 +2181,28 @@ int hugetlb_fault(struct mm_struct *mm, 
+ 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
+ 	struct hstate *h = hstate_vma(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++			h = hstate_vma(vma);
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
++			return VM_FAULT_OOM;
++		address_m &= HPAGE_MASK;
++		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
++	}
++#endif
++
+ 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+ 	if (!ptep)
+ 		return VM_FAULT_OOM;
+diff -urNp linux-2.6.32.12/mm/Kconfig linux-2.6.32.12/mm/Kconfig
+--- linux-2.6.32.12/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/Kconfig	2010-04-04 20:46:41.708732353 -0400
+@@ -228,7 +228,7 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+         int "Low address space to protect from user allocation"
+ 	depends on MMU
+-        default 4096
++        default 65536
+         help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.12/mm/maccess.c linux-2.6.32.12/mm/maccess.c
+--- linux-2.6.32.12/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/maccess.c	2010-04-04 20:46:41.708732353 -0400
+@@ -14,7 +14,7 @@
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long probe_kernel_read(void *dst, void *src, size_t size)
++long probe_kernel_read(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
++long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+diff -urNp linux-2.6.32.12/mm/madvise.c linux-2.6.32.12/mm/madvise.c
+--- linux-2.6.32.12/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/madvise.c	2010-04-04 20:46:41.708732353 -0400
+@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
+ 	pgoff_t pgoff;
+ 	unsigned long new_flags = vma->vm_flags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	switch (behavior) {
+ 	case MADV_NORMAL:
+ 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
+@@ -103,6 +107,13 @@ success:
+ 	/*
+ 	 * vm_flags is protected by the mmap_sem held in write mode.
+ 	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m)
++		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
++#endif
++
+ 	vma->vm_flags = new_flags;
+ 
+ out:
+@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
+ 			     struct vm_area_struct ** prev,
+ 			     unsigned long start, unsigned long end)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	*prev = vma;
+ 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
+ 		return -EINVAL;
+@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
+ 		zap_page_range(vma, start, end - start, &details);
+ 	} else
+ 		zap_page_range(vma, start, end - start, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
++			struct zap_details details = {
++				.nonlinear_vma = vma_m,
++				.last_index = ULONG_MAX,
++			};
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++		} else
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
+ 	if (end < start)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			goto out;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		goto out;
++
+ 	error = 0;
+ 	if (end == start)
+ 		goto out;
+diff -urNp linux-2.6.32.12/mm/memory.c linux-2.6.32.12/mm/memory.c
+--- linux-2.6.32.12/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/memory.c	2010-04-04 20:46:41.708732353 -0400
+@@ -48,6 +48,7 @@
+ #include <linux/ksm.h>
+ #include <linux/rmap.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/delayacct.h>
+ #include <linux/init.h>
+ #include <linux/writeback.h>
+@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
+ 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
+ 	i = 0;
+ 
+-	do {
++	while (nr_pages) {
+ 		struct vm_area_struct *vma;
+ 
+-		vma = find_extend_vma(mm, start);
++		vma = find_vma(mm, start);
+ 		if (!vma && in_gate_area(tsk, start)) {
+ 			unsigned long pg = start & PAGE_MASK;
+ 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
+ 			continue;
+ 		}
+ 
+-		if (!vma ||
++		if (!vma || start < vma->vm_start ||
+ 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
+ 		    !(vm_flags & vma->vm_flags))
+ 			return i ? : -EFAULT;
+@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
+ 			start += PAGE_SIZE;
+ 			nr_pages--;
+ 		} while (nr_pages && start < vma->vm_end);
+-	} while (nr_pages);
++	}
+ 	return i;
+ }
+ 
+@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
+ 		copy_user_highpage(dst, src, va, vma);
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	spinlock_t *ptl;
++	pte_t *pte, entry;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	entry = *pte;
++	if (!pte_present(entry)) {
++		if (!pte_none(entry)) {
++			BUG_ON(pte_file(entry));
++			free_swap_and_cache(pte_to_swp_entry(entry));
++			pte_clear_not_present_full(mm, address, pte, 0);
++		}
++	} else {
++		struct page *page;
++
++		flush_cache_page(vma, address, pte_pfn(entry));
++		entry = ptep_clear_flush(vma, address, pte);
++		BUG_ON(pte_dirty(entry));
++		page = vm_normal_page(vma, address, entry);
++		if (page) {
++			update_hiwater_rss(mm);
++			if (PageAnon(page))
++				dec_mm_counter(mm, anon_rss);
++			else
++				dec_mm_counter(mm, file_rss);
++			page_remove_rmap(page);
++			page_cache_release(page);
++		}
++	}
++	pte_unmap_unlock(pte, ptl);
++}
++
++/* PaX: if vma is mirrored, synchronize the mirror's PTE
++ *
++ * the ptl of the lower mapped page is held on entry and is not released on exit
++ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
++ */
++static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || !PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(!PageLocked(page_m));
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_anon_rmap(page_m, vma_m, address_m);
++	inc_mm_counter(mm, anon_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++	unlock_page(page_m);
++}
++
++void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_file_rmap(page_m);
++	inc_mm_counter(mm, file_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
++{
++	struct page *page_m;
++	pte_t entry;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
++		goto out;
++
++	entry = *pte;
++	page_m  = vm_normal_page(vma, address, entry);
++	if (!page_m)
++		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
++	else if (PageAnon(page_m)) {
++		if (pax_find_mirror_vma(vma)) {
++			pte_unmap_unlock(pte, ptl);
++			lock_page(page_m);
++			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
++			if (pte_same(entry, *pte))
++				pax_mirror_anon_pte(vma, address, page_m, ptl);
++			else
++				unlock_page(page_m);
++		}
++	} else
++		pax_mirror_file_pte(vma, address, page_m, ptl);
++
++out:
++	pte_unmap_unlock(pte, ptl);
++}
++#endif
++
+ /*
+  * This routine handles present pages, when users try to write
+  * to a shared page. It is done by copying the page to a new address
+@@ -2146,6 +2327,12 @@ gotten:
+ 	 */
+ 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(new_page));
++#endif
++
+ 		if (old_page) {
+ 			if (!PageAnon(old_page)) {
+ 				dec_mm_counter(mm, file_rss);
+@@ -2197,6 +2384,10 @@ gotten:
+ 			page_remove_rmap(old_page);
+ 		}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_anon_pte(vma, address, new_page, ptl);
++#endif
++
+ 		/* Free the old page.. */
+ 		new_page = old_page;
+ 		ret |= VM_FAULT_WRITE;
+@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
+ 	swap_free(entry);
+ 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
+ 		try_to_free_swap(page);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
++#endif
++
+ 	unlock_page(page);
+ 
+ 	if (flags & FAULT_FLAG_WRITE) {
+@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, pte);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ out:
+@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
+ 		unsigned long address, pte_t *page_table, pmd_t *pmd,
+ 		unsigned int flags)
+ {
+-	struct page *page;
++	struct page *page = NULL;
+ 	spinlock_t *ptl;
+ 	pte_t entry;
+ 
+@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
+ 	if (!pte_none(*page_table))
+ 		goto release;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		BUG_ON(!trylock_page(page));
++#endif
++
+ 	inc_mm_counter(mm, anon_rss);
+ 	page_add_new_anon_rmap(page, vma, address);
+ setpte:
+@@ -2670,6 +2876,12 @@ setpte:
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (page)
++		pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ 	return 0;
+@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
+ 	 */
+ 	/* Only go through if we didn't race with anybody else... */
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon && pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(page));
++#endif
++
+ 		flush_icache_page(vma, page);
+ 		entry = mk_pte(page, vma->vm_page_prot);
+ 		if (flags & FAULT_FLAG_WRITE)
+@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
+ 
+ 		/* no need to invalidate: a not-present page won't be cached */
+ 		update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon)
++			pax_mirror_anon_pte(vma, address, page, ptl);
++		else
++			pax_mirror_file_pte(vma, address, page, ptl);
++#endif
++
+ 	} else {
+ 		if (charged)
+ 			mem_cgroup_uncharge_page(page);
+@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
+ 		if (flags & FAULT_FLAG_WRITE)
+ 			flush_tlb_page(vma, address);
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_pte(vma, address, pte, pmd, ptl);
++	return 0;
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(pte, ptl);
+ 	return 0;
+@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	__set_current_state(TASK_RUNNING);
+ 
+ 	count_vm_event(PGFAULT);
+@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
+ 	if (unlikely(is_vm_hugetlb_page(vma)))
+ 		return hugetlb_fault(mm, vma, address, flags);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++		pgd_t *pgd_m;
++		pud_t *pud_m;
++		pmd_t *pmd_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		pgd_m = pgd_offset(mm, address_m);
++		pud_m = pud_alloc(mm, pgd_m, address_m);
++		if (!pud_m)
++			return VM_FAULT_OOM;
++		pmd_m = pmd_alloc(mm, pud_m, address_m);
++		if (!pmd_m)
++			return VM_FAULT_OOM;
++		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
++			return VM_FAULT_OOM;
++		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
++	}
++#endif
++
+ 	pgd = pgd_offset(mm, address);
+ 	pud = pud_alloc(mm, pgd, address);
+ 	if (!pud)
+@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+diff -urNp linux-2.6.32.12/mm/memory-failure.c linux-2.6.32.12/mm/memory-failure.c
+--- linux-2.6.32.12/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/memory-failure.c	2010-04-04 20:46:41.708732353 -0400
+@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
+ 
+ int sysctl_memory_failure_recovery __read_mostly = 1;
+ 
+-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
++atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
+ 
+ /*
+  * Send all the processes who have the page mapped an ``action optional''
+@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
+ 		return 0;
+ 	}
+ 
+-	atomic_long_add(1, &mce_bad_pages);
++	atomic_long_add_unchecked(1, &mce_bad_pages);
+ 
+ 	/*
+ 	 * We need/can do nothing about count=0 pages.
+diff -urNp linux-2.6.32.12/mm/mempolicy.c linux-2.6.32.12/mm/mempolicy.c
+--- linux-2.6.32.12/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.12/mm/mempolicy.c	2010-04-04 20:46:41.708732353 -0400
+@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
+ 	struct vm_area_struct *next;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	err = 0;
+ 	for (; vma && vma->vm_start < end; vma = next) {
+ 		next = vma->vm_next;
+@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
+ 			err = policy_vma(vma, new);
+ 		if (err)
+ 			break;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		vma_m = pax_find_mirror_vma(vma);
++		if (vma_m) {
++			err = policy_vma(vma_m, new);
++			if (err)
++				break;
++		}
++#endif
++
+ 	}
+ 	return err;
+ }
+@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
+ 
+ 	if (end < start)
+ 		return -EINVAL;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (end == start)
+ 		return 0;
+ 
+@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
+ 
+ 	if (file) {
+ 		seq_printf(m, " file=");
+-		seq_path(m, &file->f_path, "\n\t= ");
++		seq_path(m, &file->f_path, "\n\t\\= ");
+ 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 		seq_printf(m, " heap");
+ 	} else if (vma->vm_start <= mm->start_stack &&
+diff -urNp linux-2.6.32.12/mm/migrate.c linux-2.6.32.12/mm/migrate.c
+--- linux-2.6.32.12/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/migrate.c	2010-04-04 20:46:41.708732353 -0400
+@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+diff -urNp linux-2.6.32.12/mm/mlock.c linux-2.6.32.12/mm/mlock.c
+--- linux-2.6.32.12/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/mlock.c	2010-04-04 20:46:41.708732353 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/pagemap.h>
+ #include <linux/mempolicy.h>
+ #include <linux/syscalls.h>
++#include <linux/security.h>
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ #include <linux/rmap.h>
+@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
+ 		return -EINVAL;
+ 	if (end == start)
+ 		return 0;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	vma = find_vma_prev(current->mm, start, &prev);
+ 	if (!vma || vma->vm_start > start)
+ 		return -ENOMEM;
+@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	/* check against resource limits */
++	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
+ 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
+ 		error = do_mlock(start, len, 1);
+ 	up_write(&current->mm->mmap_sem);
+@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
+ static int do_mlockall(int flags)
+ {
+ 	struct vm_area_struct * vma, * prev = NULL;
+-	unsigned int def_flags = 0;
++	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
+ 
+ 	if (flags & MCL_FUTURE)
+-		def_flags = VM_LOCKED;
++		def_flags |= VM_LOCKED;
+ 	current->mm->def_flags = def_flags;
+ 	if (flags == MCL_FUTURE)
+ 		goto out;
+@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
+ 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
+ 		unsigned int newflags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
++			break;
++#endif
++
++		BUG_ON(vma->vm_end > TASK_SIZE);
+ 		newflags = vma->vm_flags | VM_LOCKED;
+ 		if (!(flags & MCL_CURRENT))
+ 			newflags &= ~VM_LOCKED;
+@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	ret = -ENOMEM;
++	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
+ 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
+ 	    capable(CAP_IPC_LOCK))
+ 		ret = do_mlockall(flags);
+diff -urNp linux-2.6.32.12/mm/mmap.c linux-2.6.32.12/mm/mmap.c
+--- linux-2.6.32.12/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/mmap.c	2010-04-04 20:46:41.713805609 -0400
+@@ -45,6 +45,16 @@
+ #define arch_rebalance_pgtables(addr, len)		(addr)
+ #endif
+ 
++static inline void verify_mm_writelocked(struct mm_struct *mm)
++{
++#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
++	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++		up_read(&mm->mmap_sem);
++		BUG();
++	}
++#endif
++}
++
+ static void unmap_region(struct mm_struct *mm,
+ 		struct vm_area_struct *vma, struct vm_area_struct *prev,
+ 		unsigned long start, unsigned long end);
+@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
+  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
+  *
+  */
+-pgprot_t protection_map[16] = {
++pgprot_t protection_map[16] __read_only = {
+ 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+ 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
+ };
+ 
+ pgprot_t vm_get_page_prot(unsigned long vm_flags)
+ {
+-	return __pgprot(pgprot_val(protection_map[vm_flags &
++	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
+ 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
+ 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if (!nx_enabled &&
++	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
++	    (vm_flags & (VM_READ | VM_WRITE)))
++		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
++#endif
++
++	return prot;
+ }
+ EXPORT_SYMBOL(vm_get_page_prot);
+ 
+@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
+ 	struct vm_area_struct *next = vma->vm_next;
+ 
+ 	might_sleep();
++	BUG_ON(vma->vm_mirror);
+ 	if (vma->vm_ops && vma->vm_ops->close)
+ 		vma->vm_ops->close(vma);
+ 	if (vma->vm_file) {
+@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+ 	 * not page aligned -Ram Gupta
+ 	 */
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
++	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
+ 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
+ 			(mm->end_data - mm->start_data) > rlim)
+ 		goto out;
+@@ -694,6 +715,12 @@ static int
+ can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		if (vma->vm_pgoff == vm_pgoff)
+@@ -713,6 +740,12 @@ static int
+ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		pgoff_t vm_pglen;
+@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
+ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 			struct vm_area_struct *prev, unsigned long addr,
+ 			unsigned long end, unsigned long vm_flags,
+-		     	struct anon_vma *anon_vma, struct file *file,
++			struct anon_vma *anon_vma, struct file *file,
+ 			pgoff_t pgoff, struct mempolicy *policy)
+ {
+ 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
+ 	struct vm_area_struct *area, *next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
++	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
++
++	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
++#endif
++
+ 	/*
+ 	 * We later require that vma->vm_flags == vm_flags,
+ 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
+@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
+ 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
+ 		next = next->vm_next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (prev)
++		prev_m = pax_find_mirror_vma(prev);
++	if (area)
++		area_m = pax_find_mirror_vma(area);
++	if (next)
++		next_m = pax_find_mirror_vma(next);
++#endif
++
+ 	/*
+ 	 * Can it merge with the predecessor?
+ 	 */
+@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
+ 							/* cases 1, 6 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				next->vm_end, prev->vm_pgoff, NULL);
+-		} else					/* cases 2, 5, 7 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					next_m->vm_end, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 2, 5, 7 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				end, prev->vm_pgoff, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					end_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		}
+ 		return prev;
+ 	}
+ 
+@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
+  			mpol_equal(policy, vma_policy(next)) &&
+ 			can_vma_merge_before(next, vm_flags,
+ 					anon_vma, file, pgoff+pglen)) {
+-		if (prev && addr < prev->vm_end)	/* case 4 */
++		if (prev && addr < prev->vm_end) {	/* case 4 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				addr, prev->vm_pgoff, NULL);
+-		else					/* cases 3, 8 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					addr_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 3, 8 */
+ 			vma_adjust(area, addr, next->vm_end,
+ 				next->vm_pgoff - pglen, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (area_m)
++				vma_adjust(area_m, addr_m, next_m->vm_end,
++					next_m->vm_pgoff - pglen, NULL);
++#endif
++
++		}
+ 		return area;
+ 	}
+ 
+@@ -888,14 +967,11 @@ none:
+ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+ 						struct file *file, long pages)
+ {
+-	const unsigned long stack_flags
+-		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
+-
+ 	if (file) {
+ 		mm->shared_vm += pages;
+ 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
+ 			mm->exec_vm += pages;
+-	} else if (flags & stack_flags)
++	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
+ 		mm->stack_vm += pages;
+ 	if (flags & (VM_RESERVED|VM_IO))
+ 		mm->reserved_vm += pages;
+@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	 * (the exception is when the underlying filesystem is noexec
+ 	 *  mounted, in which case we dont add PROT_EXEC.)
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
+ 			prot |= PROT_EXEC;
+ 
+@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	/* Obtain the address to map to. we verify (or select) it and ensure
+ 	 * that it represents a valid section of the address space.
+ 	 */
+-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
++	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
+ 	if (addr & ~PAGE_MASK)
+ 		return addr;
+ 
+@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
+ 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
+ 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT) {
++			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
++				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++			else
++				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++		}
++#endif
++
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
++		vm_flags &= ~VM_PAGEEXEC;
++#endif
++
+ 	if (flags & MAP_LOCKED)
+ 		if (!can_do_mlock())
+ 			return -EPERM;
+@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
+ 			return -EAGAIN;
+ 	}
+@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
+ 	if (error)
+ 		return error;
+ 
++	if (!gr_acl_handle_mmap(file, prot))
++		return -EACCES;
++
+ 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
+ }
+ EXPORT_SYMBOL(do_mmap_pgoff);
+@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
+  */
+ int vma_wants_writenotify(struct vm_area_struct *vma)
+ {
+-	unsigned int vm_flags = vma->vm_flags;
++	unsigned long vm_flags = vma->vm_flags;
+ 
+ 	/* If it was private or non-writable, the write bit is already clear */
+-	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
++	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
+ 		return 0;
+ 
+ 	/* The backer wishes to know when pages are first written to? */
+@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
+ 	unsigned long charged = 0;
+ 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	/* Clear old maps */
+ 	error = -ENOMEM;
+-munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limit. */
+@@ -1163,6 +1273,16 @@ munmap_back:
+ 		goto unacct_error;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			error = -ENOMEM;
++			goto free_vma;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -1185,6 +1305,19 @@ munmap_back:
+ 		error = file->f_op->mmap(file, vma);
+ 		if (error)
+ 			goto unmap_and_free_vma;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma_m && (vm_flags & VM_EXECUTABLE))
++			added_exe_file_vma(mm);
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
++			vma->vm_flags |= VM_PAGEEXEC;
++			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++		}
++#endif
++
+ 		if (vm_flags & VM_EXECUTABLE)
+ 			added_exe_file_vma(mm);
+ 
+@@ -1208,6 +1341,11 @@ munmap_back:
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ 	file = vma->vm_file;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	/* Once vma denies write, undo our temporary denial count */
+ 	if (correct_wcount)
+ 		atomic_inc(&inode->i_writecount);
+@@ -1216,6 +1354,7 @@ out:
+ 
+ 	mm->total_vm += len >> PAGE_SHIFT;
+ 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
++	track_exec_limit(mm, addr, addr + len, vm_flags);
+ 	if (vm_flags & VM_LOCKED) {
+ 		/*
+ 		 * makes pages present; downgrades, drops, reacquires mmap_sem
+@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
+ 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
+ 	charged = 0;
+ free_vma:
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		kmem_cache_free(vm_area_cachep, vma_m);
++#endif
++
+ 	kmem_cache_free(vm_area_cachep, vma);
+ unacct_error:
+ 	if (charged)
+@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -1293,9 +1442,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				addr = TASK_UNMAPPED_BASE;
+-			        start_addr = addr;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -1317,10 +1465,16 @@ full_search:
+ 
+ void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the lowest possible address?
+ 	 */
+-	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
++	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
+ 		mm->free_area_cache = addr;
+ 		mm->cached_hole_size = ~0UL;
+ 	}
+@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -1404,13 +1562,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-  	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+@@ -1419,6 +1585,12 @@ bottomup:
+ 
+ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the highest possible address?
+ 	 */
+@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
+ 		mm->free_area_cache = addr;
+ 
+ 	/* dont allow allocations above current base */
+-	if (mm->free_area_cache > mm->mmap_base)
++	if (mm->free_area_cache > mm->mmap_base) {
+ 		mm->free_area_cache = mm->mmap_base;
++		mm->cached_hole_size = ~0UL;
++	}
+ }
+ 
+ unsigned long
+@@ -1535,6 +1709,27 @@ out:
+ 	return prev ? prev->vm_next : vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
++{
++	struct vm_area_struct *vma_m;
++
++	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
++		BUG_ON(vma->vm_mirror);
++		return NULL;
++	}
++	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
++	vma_m = vma->vm_mirror;
++	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
++	BUG_ON(vma->vm_file != vma_m->vm_file);
++	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
++	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
++	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
++	return vma_m;
++}
++#endif
++
+ /*
+  * Verify that the stack growth is acceptable and
+  * update accounting. This is shared with both the
+@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
+ 		return -ENOMEM;
+ 
+ 	/* Stack limit test */
++	gr_learn_resource(current, RLIMIT_STACK, size, 1);
+ 	if (size > rlim[RLIMIT_STACK].rlim_cur)
+ 		return -ENOMEM;
+ 
+@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
+ 		unsigned long limit;
+ 		locked = mm->locked_vm + grow;
+ 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > limit && !capable(CAP_IPC_LOCK))
+ 			return -ENOMEM;
+ 	}
+@@ -1595,35 +1792,40 @@ static
+ #endif
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+-	int error;
++	int error, locknext;
+ 
+ 	if (!(vma->vm_flags & VM_GROWSUP))
+ 		return -EFAULT;
+ 
++	/* Also guard against wrapping around to address 0. */
++	if (address < PAGE_ALIGN(address+1))
++		address = PAGE_ALIGN(address+1);
++	else
++		return -ENOMEM;
++
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+ 	 * so that the anon_vma locking is not a noop.
+ 	 */
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		return -ENOMEM;
++	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
++	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
++		return -ENOMEM;
+ 	anon_vma_lock(vma);
++	if (locknext)
++		anon_vma_lock(vma->vm_next);
+ 
+ 	/*
+ 	 * vma->vm_start/vm_end cannot change under us because the caller
+ 	 * is required to hold the mmap_sem in read mode.  We need the
+-	 * anon_vma lock to serialize against concurrent expand_stacks.
+-	 * Also guard against wrapping around to address 0.
++	 * anon_vma locks to serialize against concurrent expand_stacks
++	 * and expand_upwards.
+ 	 */
+-	if (address < PAGE_ALIGN(address+4))
+-		address = PAGE_ALIGN(address+4);
+-	else {
+-		anon_vma_unlock(vma);
+-		return -ENOMEM;
+-	}
+ 	error = 0;
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address > vma->vm_end) {
++	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
+ 		unsigned long size, grow;
+ 
+ 		size = address - vma->vm_start;
+@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
+ 		if (!error)
+ 			vma->vm_end = address;
+ 	}
++	if (locknext)
++		anon_vma_unlock(vma->vm_next);
+ 	anon_vma_unlock(vma);
+ 	return error;
+ }
+@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
+ static int expand_downwards(struct vm_area_struct *vma,
+ 				   unsigned long address)
+ {
+-	int error;
++	int error, lockprev = 0;
++	struct vm_area_struct *prev = NULL;
+ 
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
+ 	if (error)
+ 		return error;
+ 
++#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
++	find_vma_prev(vma->vm_mm, address, &prev);
++	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
++#endif
++	if (lockprev && unlikely(anon_vma_prepare(prev)))
++		return -ENOMEM;
++	if (lockprev)
++		anon_vma_lock(prev);
++
+ 	anon_vma_lock(vma);
+ 
+ 	/*
+@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
+ 	 */
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address < vma->vm_start) {
++	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
+ 		unsigned long size, grow;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++
++		vma_m = pax_find_mirror_vma(vma);
++#endif
++
+ 		size = vma->vm_end - address;
+ 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 
+@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
+ 		if (!error) {
+ 			vma->vm_start = address;
+ 			vma->vm_pgoff -= grow;
++			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (vma_m) {
++				vma_m->vm_start -= grow << PAGE_SHIFT;
++				vma_m->vm_pgoff -= grow;
++			}
++#endif
++
+ 		}
+ 	}
+ 	anon_vma_unlock(vma);
++	if (lockprev)
++		anon_vma_unlock(prev);
+ 	return error;
+ }
+ 
+@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
+ 	do {
+ 		long nrpages = vma_pages(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
++			vma = remove_vma(vma);
++			continue;
++		}
++#endif
++
+ 		mm->total_vm -= nrpages;
+ 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
+ 		vma = remove_vma(vma);
+@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
+ 
+ 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
+ 	do {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma->vm_mirror) {
++			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
++			vma->vm_mirror->vm_mirror = NULL;
++			vma->vm_mirror->vm_flags &= ~VM_EXEC;
++			vma->vm_mirror = NULL;
++		}
++#endif
++
+ 		rb_erase(&vma->vm_rb, &mm->mm_rb);
+ 		mm->map_count--;
+ 		tail_vma = vma;
+@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
+ 	struct mempolicy *pol;
+ 	struct vm_area_struct *new;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m, *new_m = NULL;
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (is_vm_hugetlb_page(vma) && (addr &
+ 					~(huge_page_mask(hstate_vma(vma)))))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
++		if (mm->map_count >= sysctl_max_map_count-1)
++			return -ENOMEM;
++	} else
++#endif
++
+ 	if (mm->map_count >= sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
+ 	if (!new)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++		if (!new_m) {
++			kmem_cache_free(vm_area_cachep, new);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	/* most fields are the same, copy all, and then fixup */
+ 	*new = *vma;
+ 
+@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
+ 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		*new_m = *vma_m;
++		new_m->vm_mirror = new;
++		new->vm_mirror = new_m;
++
++		if (new_below)
++			new_m->vm_end = addr_m;
++		else {
++			new_m->vm_start = addr_m;
++			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
++		}
++	}
++#endif
++
+ 	pol = mpol_dup(vma_policy(vma));
+ 	if (IS_ERR(pol)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (new_m)
++			kmem_cache_free(vm_area_cachep, new_m);
++#endif
++
+ 		kmem_cache_free(vm_area_cachep, new);
+ 		return PTR_ERR(pol);
+ 	}
+@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
+ 	else
+ 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		mpol_get(pol);
++		vma_set_policy(new_m, pol);
++
++		if (new_m->vm_file) {
++			get_file(new_m->vm_file);
++			if (vma_m->vm_flags & VM_EXECUTABLE)
++				added_exe_file_vma(mm);
++		}
++
++		if (new_m->vm_ops && new_m->vm_ops->open)
++			new_m->vm_ops->open(new_m);
++
++		if (new_below)
++			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
++				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
++		else
++			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
+  * work.  This now handles partial unmappings.
+  * Jeremy Fitzhardinge <jeremy@goop.org>
+  */
++#ifdef CONFIG_PAX_SEGMEXEC
+ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ {
++	int ret = __do_munmap(mm, start, len);
++	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
++		return ret;
++
++	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
++}
++
++int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#else
++int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#endif
++{
+ 	unsigned long end;
+ 	struct vm_area_struct *vma, *prev, *last;
+ 
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
+ 		return -EINVAL;
+ 
+@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
+ 	/* Fix up all other VM information */
+ 	remove_vma_list(mm, vma);
+ 
++	track_exec_limit(mm, start, end, 0UL);
++
+ 	return 0;
+ }
+ 
+@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
+ 
+ 	profile_munmap(addr);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
++	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
++		return -EINVAL;
++#endif
++
+ 	down_write(&mm->mmap_sem);
+ 	ret = do_munmap(mm, addr, len);
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+ 
+-static inline void verify_mm_writelocked(struct mm_struct *mm)
+-{
+-#ifdef CONFIG_DEBUG_VM
+-	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
+-		WARN_ON(1);
+-		up_read(&mm->mmap_sem);
+-	}
+-#endif
+-}
+-
+ /*
+  *  this is really a simplified "do_mmap".  it only handles
+  *  anonymous maps.  eventually we may be able to do some
+@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
+ 	struct rb_node ** rb_link, * rb_parent;
+ 	pgoff_t pgoff = addr >> PAGE_SHIFT;
+ 	int error;
++	unsigned long charged;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
+ 
+ 	len = PAGE_ALIGN(len);
+ 	if (!len)
+@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
+ 
+ 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
+ 	if (error & ~PAGE_MASK)
+ 		return error;
+ 
++	charged = len >> PAGE_SHIFT;
++
+ 	/*
+ 	 * mlock MCL_FUTURE?
+ 	 */
+ 	if (mm->def_flags & VM_LOCKED) {
+ 		unsigned long locked, lock_limit;
+-		locked = len >> PAGE_SHIFT;
++		locked = charged;
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
+@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
+ 	/*
+ 	 * Clear old maps.  this also does some error checking for us
+ 	 */
+- munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limits *after* clearing old maps... */
+-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
++	if (!may_expand_vm(mm, charged))
+ 		return -ENOMEM;
+ 
+ 	if (mm->map_count > sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+-	if (security_vm_enough_memory(len >> PAGE_SHIFT))
++	if (security_vm_enough_memory(charged))
+ 		return -ENOMEM;
+ 
+ 	/* Can we just expand an old private anonymous mapping? */
+@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
+ 	 */
+ 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+ 	if (!vma) {
+-		vm_unacct_memory(len >> PAGE_SHIFT);
++		vm_unacct_memory(charged);
+ 		return -ENOMEM;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			kmem_cache_free(vm_area_cachep, vma);
++			vm_unacct_memory(charged);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
+ 	vma->vm_page_prot = vm_get_page_prot(flags);
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ out:
+-	mm->total_vm += len >> PAGE_SHIFT;
++	mm->total_vm += charged;
+ 	if (flags & VM_LOCKED) {
+ 		if (!mlock_vma_pages_range(vma, addr, addr + len))
+-			mm->locked_vm += (len >> PAGE_SHIFT);
++			mm->locked_vm += charged;
+ 	}
++	track_exec_limit(mm, addr, addr + len, flags);
+ 	return addr;
+ }
+ 
+@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
+ 	 * Walk the list again, actually closing and freeing it,
+ 	 * with preemption enabled, without holding any MM locks.
+ 	 */
+-	while (vma)
++	while (vma) {
++		vma->vm_mirror = NULL;
+ 		vma = remove_vma(vma);
++	}
+ 
+ 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
+ }
+@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
+ 	struct vm_area_struct * __vma, * prev;
+ 	struct rb_node ** rb_link, * rb_parent;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
+ 	/*
+ 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
+ 	 * until its first write fault, when page's anon_vma and index
+@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
+ 	if ((vma->vm_flags & VM_ACCOUNT) &&
+ 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m)
++			return -ENOMEM;
++	}
++#endif
++
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
+ 	struct rb_node **rb_link, *rb_parent;
+ 	struct mempolicy *pol;
+ 
++	BUG_ON(vma->vm_mirror);
++
+ 	/*
+ 	 * If anonymous vma has not yet been faulted, update new pgoff
+ 	 * to match new location, to increase its chance of merging.
+@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
+ 	return new_vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
++{
++	struct vm_area_struct *prev_m;
++	struct rb_node **rb_link_m, *rb_parent_m;
++	struct mempolicy *pol_m;
++
++	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
++	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
++	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
++	*vma_m = *vma;
++	pol_m = vma_policy(vma_m);
++	mpol_get(pol_m);
++	vma_set_policy(vma_m, pol_m);
++	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
++	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
++	if (vma_m->vm_file)
++		get_file(vma_m->vm_file);
++	if (vma_m->vm_ops && vma_m->vm_ops->open)
++		vma_m->vm_ops->open(vma_m);
++	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
++	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
++	vma_m->vm_mirror = vma;
++	vma->vm_mirror = vma_m;
++}
++#endif
++
+ /*
+  * Return true if the calling process may expand its vm space by the passed
+  * number of pages
+@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
+ 	unsigned long lim;
+ 
+ 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+-
++	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
+ 	if (cur + npages > lim)
+ 		return 0;
+ 	return 1;
+@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->pax_flags & MF_PAX_MPROTECT) {
++		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
++			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++		else
++			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++	}
++#endif
++
+ 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 
+diff -urNp linux-2.6.32.12/mm/mprotect.c linux-2.6.32.12/mm/mprotect.c
+--- linux-2.6.32.12/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/mprotect.c	2010-04-04 20:46:41.713805609 -0400
+@@ -24,10 +24,16 @@
+ #include <linux/mmu_notifier.h>
+ #include <linux/migrate.h>
+ #include <linux/perf_event.h>
++
++#ifdef CONFIG_PAX_MPROTECT
++#include <linux/elf.h>
++#endif
++
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
++#include <asm/mmu_context.h>
+ 
+ #ifndef pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+@@ -132,6 +138,48 @@ static void change_protection(struct vm_
+ 	flush_tlb_range(vma, start, end);
+ }
+ 
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++/* called while holding the mmap semaphor for writing except stack expansion */
++void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
++{
++	unsigned long oldlimit, newlimit = 0UL;
++
++	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
++		return;
++
++	spin_lock(&mm->page_table_lock);
++	oldlimit = mm->context.user_cs_limit;
++	if ((prot & VM_EXEC) && oldlimit < end)
++		/* USER_CS limit moved up */
++		newlimit = end;
++	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
++		/* USER_CS limit moved down */
++		newlimit = start;
++
++	if (newlimit) {
++		mm->context.user_cs_limit = newlimit;
++
++#ifdef CONFIG_SMP
++		wmb();
++		cpus_clear(mm->context.cpu_user_cs_mask);
++		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
++#endif
++
++		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
++	}
++	spin_unlock(&mm->page_table_lock);
++	if (newlimit == end) {
++		struct vm_area_struct *vma = find_vma(mm, oldlimit);
++
++		for (; vma && vma->vm_start < end; vma = vma->vm_next)
++			if (is_vm_hugetlb_page(vma))
++				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
++			else
++				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
++	}
++}
++#endif
++
+ int
+ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ 	unsigned long start, unsigned long end, unsigned long newflags)
+@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
+ 	int error;
+ 	int dirty_accountable = 0;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++	unsigned long start_m, end_m;
++
++	start_m = start + SEGMEXEC_TASK_SIZE;
++	end_m = end + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (newflags == oldflags) {
+ 		*pprev = vma;
+ 		return 0;
+@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
++		if (start != vma->vm_start) {
++			error = split_vma(mm, vma, start, 1);
++			if (error)
++				goto fail;
++			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
++			*pprev = (*pprev)->vm_next;
++		}
++
++		if (end != vma->vm_end) {
++			error = split_vma(mm, vma, end, 0);
++			if (error)
++				goto fail;
++		}
++
++		if (pax_find_mirror_vma(vma)) {
++			error = __do_munmap(mm, start_m, end_m - start_m);
++			if (error)
++				goto fail;
++		} else {
++			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++			if (!vma_m) {
++				error = -ENOMEM;
++				goto fail;
++			}
++			vma->vm_flags = newflags;
++			pax_mirror_vma(vma_m, vma);
++		}
++	}
++#endif
++
+ 	/*
+ 	 * First try to merge with previous and/or next vma.
+ 	 */
+@@ -196,8 +284,14 @@ success:
+ 	 * held in write mode.
+ 	 */
+ 	vma->vm_flags = newflags;
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->binfmt && mm->binfmt->handle_mprotect)
++		mm->binfmt->handle_mprotect(vma, newflags);
++#endif
++
+ 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
+-					  vm_get_page_prot(newflags));
++					  vm_get_page_prot(vma->vm_flags));
+ 
+ 	if (vma_wants_writenotify(vma)) {
+ 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
+@@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	end = start + len;
+ 	if (end <= start)
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (!arch_validate_prot(prot))
+ 		return -EINVAL;
+ 
+@@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	/*
+ 	 * Does the application expect PROT_READ to imply PROT_EXEC:
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		prot |= PROT_EXEC;
+ 
+ 	vm_flags = calc_vm_prot_bits(prot);
+@@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	if (start > vma->vm_start)
+ 		prev = vma;
+ 
++	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
++		error = -EACCES;
++		goto out;
++	}
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
++		current->mm->binfmt->handle_mprotect(vma, vm_flags);
++#endif
++
+ 	for (nstart = start ; ; ) {
+ 		unsigned long newflags;
+ 
+@@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 		if (error)
+ 			goto out;
+ 		perf_event_mmap(vma);
++
++		track_exec_limit(current->mm, nstart, tmp, vm_flags);
++
+ 		nstart = tmp;
+ 
+ 		if (nstart < prev->vm_end)
+diff -urNp linux-2.6.32.12/mm/mremap.c linux-2.6.32.12/mm/mremap.c
+--- linux-2.6.32.12/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/mremap.c	2010-04-04 20:46:41.713805609 -0400
+@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
+ 			continue;
+ 		pte = ptep_clear_flush(vma, old_addr, old_pte);
+ 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
++			pte = pte_exprotect(pte);
++#endif
++
+ 		set_pte_at(mm, new_addr, new_pte, pte);
+ 	}
+ 
+@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
+ 	if (is_vm_hugetlb_page(vma))
+ 		goto Einval;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		goto Einval;
++#endif
++
+ 	/* We can't remap across vm area boundaries */
+ 	if (old_len > vma->vm_end - addr)
+ 		goto Efault;
+@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
+ 	unsigned long map_flags;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (new_addr & ~PAGE_MASK)
+ 		goto out;
+ 
+-	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
+ 		goto out;
+ 
+ 	/* Check if the location we're moving into overlaps the
+ 	 * old location at all, and fail if it does.
+ 	 */
+-	if ((new_addr <= addr) && (new_addr+new_len) > addr)
+-		goto out;
+-
+-	if ((addr <= new_addr) && (addr+old_len) > new_addr)
++	if (addr + old_len > new_addr && new_addr + new_len > addr)
+ 		goto out;
+ 
+ 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
+ 	struct vm_area_struct *vma;
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+ 		goto out;
+@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
+ 	if (!new_len)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
++	    old_len > pax_task_size || addr > pax_task_size-old_len)
++		goto out;
++
+ 	if (flags & MREMAP_FIXED) {
+ 		if (flags & MREMAP_MAYMOVE)
+ 			ret = mremap_to(addr, old_len, new_addr, new_len);
+@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
+ 						   addr + new_len);
+ 			}
+ 			ret = addr;
++			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
+ 			goto out;
+ 		}
+ 	}
+@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
+ 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+ 		if (ret)
+ 			goto out;
++
++		map_flags = vma->vm_flags;
+ 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
++		if (!(ret & ~PAGE_MASK)) {
++			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
++			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
++		}
+ 	}
+ out:
+ 	if (ret & ~PAGE_MASK)
+diff -urNp linux-2.6.32.12/mm/nommu.c linux-2.6.32.12/mm/nommu.c
+--- linux-2.6.32.12/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/nommu.c	2010-04-04 20:46:41.713805609 -0400
+@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
+ EXPORT_SYMBOL(find_vma);
+ 
+ /*
+- * find a VMA
+- * - we don't extend stack VMAs under NOMMU conditions
+- */
+-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
+-{
+-	return find_vma(mm, addr);
+-}
+-
+-/*
+  * expand a stack to a given address
+  * - not supported under NOMMU conditions
+  */
+diff -urNp linux-2.6.32.12/mm/page_alloc.c linux-2.6.32.12/mm/page_alloc.c
+--- linux-2.6.32.12/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/page_alloc.c	2010-04-29 17:46:37.045244082 -0400
+@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
+ 	int bad = 0;
+ 	int wasMlocked = __TestClearPageMlocked(page);
+ 
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	unsigned long index = 1UL << order;
++#endif
++
+ 	kmemcheck_free_shadow(page, order);
+ 
+ 	for (i = 0 ; i < (1 << order) ; ++i)
+@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
+ 		debug_check_no_obj_freed(page_address(page),
+ 					   PAGE_SIZE << order);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	for (; index; --index)
++		sanitize_highpage(page + index - 1);
++#endif
++
+ 	arch_free_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 0);
+ 
+@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
+ 	arch_alloc_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 1);
+ 
++#ifndef CONFIG_PAX_MEMORY_SANITIZE
+ 	if (gfp_flags & __GFP_ZERO)
+ 		prep_zero_page(page, order, gfp_flags);
++#endif
+ 
+ 	if (order && (gfp_flags & __GFP_COMP))
+ 		prep_compound_page(page, order);
+@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
+ 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
+ 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	sanitize_highpage(page);
++#endif
++
+ 	arch_free_page(page, 0);
+ 	kernel_map_pages(page, 1, 0);
+ 
+@@ -3723,7 +3740,7 @@ static void __init setup_usemap(struct p
+ 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
+ }
+ #else
+-static void inline setup_usemap(struct pglist_data *pgdat,
++static inline void setup_usemap(struct pglist_data *pgdat,
+ 				struct zone *zone, unsigned long zonesize) {}
+ #endif /* CONFIG_SPARSEMEM */
+ 
+diff -urNp linux-2.6.32.12/mm/percpu.c linux-2.6.32.12/mm/percpu.c
+--- linux-2.6.32.12/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/percpu.c	2010-04-04 20:46:41.713805609 -0400
+@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
+ static unsigned int pcpu_last_unit_cpu __read_mostly;
+ 
+ /* the address of the first chunk which starts with the kernel static area */
+-void *pcpu_base_addr __read_mostly;
++void *pcpu_base_addr __read_only;
+ EXPORT_SYMBOL_GPL(pcpu_base_addr);
+ 
+ static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
+diff -urNp linux-2.6.32.12/mm/rmap.c linux-2.6.32.12/mm/rmap.c
+--- linux-2.6.32.12/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/rmap.c	2010-04-04 20:46:41.713805609 -0400
+@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
+ 		struct mm_struct *mm = vma->vm_mm;
+ 		struct anon_vma *allocated;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++#endif
++
+ 		anon_vma = find_mergeable_anon_vma(vma);
+ 		allocated = NULL;
+ 		if (!anon_vma) {
+@@ -121,6 +125,15 @@ int anon_vma_prepare(struct vm_area_stru
+ 		/* page_table_lock to protect against threads */
+ 		spin_lock(&mm->page_table_lock);
+ 		if (likely(!vma->anon_vma)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			vma_m = pax_find_mirror_vma(vma);
++			if (vma_m) {
++				vma_m->anon_vma = anon_vma;
++				__anon_vma_link(vma_m);
++			}
++#endif
++
+ 			vma->anon_vma = anon_vma;
+ 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
+ 			allocated = NULL;
+diff -urNp linux-2.6.32.12/mm/shmem.c linux-2.6.32.12/mm/shmem.c
+--- linux-2.6.32.12/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/shmem.c	2010-04-04 20:46:41.716811517 -0400
+@@ -31,7 +31,7 @@
+ #include <linux/swap.h>
+ #include <linux/ima.h>
+ 
+-static struct vfsmount *shm_mnt;
++struct vfsmount *shm_mnt;
+ 
+ #ifdef CONFIG_SHMEM
+ /*
+diff -urNp linux-2.6.32.12/mm/slab.c linux-2.6.32.12/mm/slab.c
+--- linux-2.6.32.12/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/slab.c	2010-04-04 20:46:41.716811517 -0400
+@@ -308,7 +308,7 @@ struct kmem_list3 {
+  * Need this for bootstrapping a per node allocator.
+  */
+ #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
+-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
++struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
+ #define	CACHE_CACHE 0
+ #define	SIZE_AC MAX_NUMNODES
+ #define	SIZE_L3 (2 * MAX_NUMNODES)
+@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
+  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
+  */
+ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
+-					const struct slab *slab, void *obj)
++					const struct slab *slab, const void *obj)
+ {
+ 	u32 offset = (obj - slab->s_mem);
+ 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
+@@ -584,14 +584,14 @@ struct cache_names {
+ static struct cache_names __initdata cache_names[] = {
+ #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
+ #include <linux/kmalloc_sizes.h>
+-	{NULL,}
++	{NULL, NULL}
+ #undef CACHE
+ };
+ 
+ static struct arraycache_init initarray_cache __initdata =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ static struct arraycache_init initarray_generic =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ 
+ /* internal cache of cache description objs */
+ static struct kmem_cache cache_cache = {
+@@ -4082,7 +4082,7 @@ out:
+ 	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
+ }
+ 
+-#ifdef CONFIG_SLABINFO
++#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ 
+ static void print_slabinfo_header(struct seq_file *m)
+ {
+@@ -4480,6 +4480,51 @@ static int __init slab_proc_init(void)
+ module_init(slab_proc_init);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct kmem_cache *cachep;
++	struct slab *slabp;
++	struct page *page;
++	unsigned int objnr;
++	unsigned long offset;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = virt_to_head_page(ptr);
++
++	if (!PageSlab(page)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	cachep = page_get_cache(page);
++	slabp = page_get_slab(page);
++	objnr = obj_to_index(cachep, slabp, ptr);
++	BUG_ON(objnr >= cachep->num);
++	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
++	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /**
+  * ksize - get the actual amount of memory allocated for a given object
+  * @objp: Pointer to the object
+diff -urNp linux-2.6.32.12/mm/slob.c linux-2.6.32.12/mm/slob.c
+--- linux-2.6.32.12/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/slob.c	2010-04-04 20:46:41.716811517 -0400
+@@ -29,7 +29,7 @@
+  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
+  * alloc_pages() directly, allocating compound pages so the page order
+  * does not have to be separately tracked, and also stores the exact
+- * allocation size in page->private so that it can be used to accurately
++ * allocation size in slob_page->size so that it can be used to accurately
+  * provide ksize(). These objects are detected in kfree() because slob_page()
+  * is false for them.
+  *
+@@ -58,6 +58,7 @@
+  */
+ 
+ #include <linux/kernel.h>
++#include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+ #include <linux/swap.h> /* struct reclaim_state */
+@@ -100,7 +101,8 @@ struct slob_page {
+ 			unsigned long flags;	/* mandatory */
+ 			atomic_t _count;	/* mandatory */
+ 			slobidx_t units;	/* free units left in page */
+-			unsigned long pad[2];
++			unsigned long pad[1];
++			unsigned long size;	/* size when >=PAGE_SIZE */
+ 			slob_t *free;		/* first free slob_t in page */
+ 			struct list_head list;	/* linked list of free pages */
+ 		};
+@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
+  */
+ static inline int is_slob_page(struct slob_page *sp)
+ {
+-	return PageSlab((struct page *)sp);
++	return PageSlab((struct page *)sp) && !sp->size;
+ }
+ 
+ static inline void set_slob_page(struct slob_page *sp)
+@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
+ 
+ static inline struct slob_page *slob_page(const void *addr)
+ {
+-	return (struct slob_page *)virt_to_page(addr);
++	return (struct slob_page *)virt_to_head_page(addr);
+ }
+ 
+ /*
+@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
+ /*
+  * Return the size of a slob block.
+  */
+-static slobidx_t slob_units(slob_t *s)
++static slobidx_t slob_units(const slob_t *s)
+ {
+ 	if (s->units > 0)
+ 		return s->units;
+@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
+ /*
+  * Return the next free slob block pointer after this one.
+  */
+-static slob_t *slob_next(slob_t *s)
++static slob_t *slob_next(const slob_t *s)
+ {
+ 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
+ 	slobidx_t next;
+@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
+ /*
+  * Returns true if s is the last free block in its page.
+  */
+-static int slob_last(slob_t *s)
++static int slob_last(const slob_t *s)
+ {
+ 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
+ }
+@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
+ 	if (!page)
+ 		return NULL;
+ 
++	set_slob_page(page);
+ 	return page_address(page);
+ }
+ 
+@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
+ 		if (!b)
+ 			return NULL;
+ 		sp = slob_page(b);
+-		set_slob_page(sp);
+ 
+ 		spin_lock_irqsave(&slob_lock, flags);
+ 		sp->units = SLOB_UNITS(PAGE_SIZE);
+ 		sp->free = b;
++		sp->size = 0;
+ 		INIT_LIST_HEAD(&sp->list);
+ 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
+ 		set_slob_page_free(sp, slob_list);
+@@ -475,10 +478,9 @@ out:
+ #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
+ #endif
+ 
+-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
+ {
+-	unsigned int *m;
+-	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++	slob_t *m;
+ 	void *ret;
+ 
+ 	lockdep_trace_alloc(gfp);
+@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		if (!m)
+ 			return NULL;
+-		*m = size;
++		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
++		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
++		m[0].units = size;
++		m[1].units = align;
+ 		ret = (void *)m + align;
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
+ 		if (ret) {
+-			struct page *page;
+-			page = virt_to_page(ret);
+-			page->private = size;
++			struct slob_page *sp;
++			sp = slob_page(ret);
++			sp->size = size;
+ 		}
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 	kmemleak_alloc(ret, size, 1, gfp);
+ 	return ret;
+ }
++
++void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++{
++	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++
++	return __kmalloc_node_align(size, gfp, node, align);
++}
+ EXPORT_SYMBOL(__kmalloc_node);
+ 
+ void kfree(const void *block)
+@@ -528,13 +540,84 @@ void kfree(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		slob_free(m, *m + align);
+-	} else
++		slob_t *m = (slob_t *)(block - align);
++		slob_free(m, m[0].units + align);
++	} else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		put_page(&sp->page);
++	}
+ }
+ EXPORT_SYMBOL(kfree);
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct slob_page *sp;
++	const slob_t *free;
++	const void *base;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	sp = slob_page(ptr);
++	if (!PageSlab((struct page*)sp)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	if (sp->size) {
++		base = page_address(&sp->page);
++		if (base <= ptr && n <= sp->size - (ptr - base))
++			return;
++		goto report;
++	}
++
++	/* some tricky double walking to find the chunk */
++	base = (void *)((unsigned long)ptr & PAGE_MASK);
++	free = sp->free;
++
++	while (!slob_last(free) && (void *)free <= ptr) {
++		base = free + slob_units(free);
++		free = slob_next(free);
++	}
++
++	while (base < (void *)free) {
++		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
++		int size = SLOB_UNIT * SLOB_UNITS(m + align);
++		int offset;
++
++		if (ptr < base + align)
++			goto report;
++
++		offset = ptr - base - align;
++		if (offset < m) {
++			if (n <= m - offset)
++				return;
++			goto report;
++		}
++		base += size;
++	}
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
+ size_t ksize(const void *block)
+ {
+@@ -547,10 +630,10 @@ size_t ksize(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		return SLOB_UNITS(*m) * SLOB_UNIT;
++		slob_t *m = (slob_t *)(block - align);
++		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
+ 	} else
+-		return sp->page.private;
++		return sp->size;
+ }
+ EXPORT_SYMBOL(ksize);
+ 
+@@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
+ {
+ 	void *b;
+ 
++#ifdef CONFIG_PAX_USERCOPY
++	b = __kmalloc_node_align(c->size, flags, node, c->align);
++#else
+ 	if (c->size < PAGE_SIZE) {
+ 		b = slob_alloc(c->size, flags, c->align, node);
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    SLOB_UNITS(c->size) * SLOB_UNIT,
+ 					    flags, node);
+ 	} else {
++		struct slob_page *sp;
++
+ 		b = slob_new_pages(flags, get_order(c->size), node);
++		sp = slob_page(b);
++		sp->size = c->size;
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    PAGE_SIZE << get_order(c->size),
+ 					    flags, node);
+ 	}
++#endif
+ 
+ 	if (c->ctor)
+ 		c->ctor(b);
+@@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+ 
+ static void __kmem_cache_free(void *b, int size)
+ {
+-	if (size < PAGE_SIZE)
++	struct slob_page *sp = slob_page(b);
++
++	if (is_slob_page(sp))
+ 		slob_free(b, size);
+-	else
++	else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		slob_free_pages(b, get_order(size));
++	}
+ }
+ 
+ static void kmem_rcu_free(struct rcu_head *head)
+@@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
+ 
+ void kmem_cache_free(struct kmem_cache *c, void *b)
+ {
++	int size = c->size;
++
++#ifdef CONFIG_PAX_USERCOPY
++	if (size + c->align < PAGE_SIZE) {
++		size += c->align;
++		b -= c->align;
++	}
++#endif
++
+ 	kmemleak_free_recursive(b, c->flags);
+ 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
+ 		struct slob_rcu *slob_rcu;
+-		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
++		slob_rcu = b + (size - sizeof(struct slob_rcu));
+ 		INIT_RCU_HEAD(&slob_rcu->head);
+-		slob_rcu->size = c->size;
++		slob_rcu->size = size;
+ 		call_rcu(&slob_rcu->head, kmem_rcu_free);
+ 	} else {
+-		__kmem_cache_free(b, c->size);
++		__kmem_cache_free(b, size);
+ 	}
+ 
+ 	trace_kmem_cache_free(_RET_IP_, b);
+diff -urNp linux-2.6.32.12/mm/slub.c linux-2.6.32.12/mm/slub.c
+--- linux-2.6.32.12/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/slub.c	2010-04-04 20:46:41.716811517 -0400
+@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
+ 
+ 	page = virt_to_head_page(x);
+ 
++	BUG_ON(!PageSlab(page));
++
+ 	slab_free(s, page, x, _RET_IP_);
+ 
+ 	trace_kmem_cache_free(_RET_IP_, x);
+@@ -1937,7 +1939,7 @@ static int slub_min_objects;
+  * Merge control. If this is set then no merging of slab caches will occur.
+  * (Could be removed. This was introduced to pacify the merge skeptics.)
+  */
+-static int slub_nomerge;
++static int slub_nomerge = 1;
+ 
+ /*
+  * Calculate the order of allocation given an slab object size.
+@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
+ 	 * list to avoid pounding the page allocator excessively.
+ 	 */
+ 	set_min_partial(s, ilog2(s->size));
+-	s->refcount = 1;
++	atomic_set(&s->refcount, 1);
+ #ifdef CONFIG_NUMA
+ 	s->remote_node_defrag_ratio = 1000;
+ #endif
+@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
+ 	down_write(&slub_lock);
+-	s->refcount--;
+-	if (!s->refcount) {
++	if (atomic_dec_and_test(&s->refcount)) {
+ 		list_del(&s->list);
+ 		up_write(&slub_lock);
+ 		if (kmem_cache_close(s)) {
+@@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t 
+ EXPORT_SYMBOL(__kmalloc_node);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct page *page;
++	struct kmem_cache *s;
++	unsigned long offset;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = get_object_page(ptr);
++
++	if (!page) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	s = page->slab;
++	offset = (ptr - page_address(page)) % s->size;
++	if (offset <= s->objsize && n <= s->objsize - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ size_t ksize(const void *object)
+ {
+ 	struct page *page;
+@@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
+ 	 */
+ 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
+ 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
+-	kmalloc_caches[0].refcount = -1;
++	atomic_set(&kmalloc_caches[0].refcount, -1);
+ 	caches++;
+ 
+ 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
+@@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
+ 	/*
+ 	 * We may have set a slab to be unmergeable during bootstrap.
+ 	 */
+-	if (s->refcount < 0)
++	if (atomic_read(&s->refcount) < 0)
+ 		return 1;
+ 
+ 	return 0;
+@@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
+ 	if (s) {
+ 		int cpu;
+ 
+-		s->refcount++;
++		atomic_inc(&s->refcount);
+ 		/*
+ 		 * Adjust the object sizes so that we clear
+ 		 * the complete object on kzalloc.
+@@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
+ 
+ 		if (sysfs_slab_alias(s, name)) {
+ 			down_write(&slub_lock);
+-			s->refcount--;
++			atomic_dec(&s->refcount);
+ 			up_write(&slub_lock);
+ 			goto err;
+ 		}
+@@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
+ 
+ static ssize_t aliases_show(struct kmem_cache *s, char *buf)
+ {
+-	return sprintf(buf, "%d\n", s->refcount - 1);
++	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
+ }
+ SLAB_ATTR_RO(aliases);
+ 
+@@ -4503,7 +4544,7 @@ static void kmem_cache_release(struct ko
+ 	kfree(s);
+ }
+ 
+-static struct sysfs_ops slab_sysfs_ops = {
++static const struct sysfs_ops slab_sysfs_ops = {
+ 	.show = slab_attr_show,
+ 	.store = slab_attr_store,
+ };
+@@ -4522,7 +4563,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops slab_uevent_ops = {
++static const struct kset_uevent_ops slab_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+@@ -4696,7 +4737,7 @@ __initcall(slab_sysfs_init);
+ /*
+  * The /proc/slabinfo ABI
+  */
+-#ifdef CONFIG_SLABINFO
++#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static void print_slabinfo_header(struct seq_file *m)
+ {
+ 	seq_puts(m, "slabinfo - version: 2.1\n");
+diff -urNp linux-2.6.32.12/mm/util.c linux-2.6.32.12/mm/util.c
+--- linux-2.6.32.12/mm/util.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/util.c	2010-04-04 20:46:41.716811517 -0400
+@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 	mm->get_unmapped_area = arch_get_unmapped_area;
+ 	mm->unmap_area = arch_unmap_area;
+ }
+diff -urNp linux-2.6.32.12/mm/vmalloc.c linux-2.6.32.12/mm/vmalloc.c
+--- linux-2.6.32.12/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/mm/vmalloc.c	2010-04-04 20:46:41.716811517 -0400
+@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
+ 
+ 	pte = pte_offset_kernel(pmd, addr);
+ 	do {
+-		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
+-		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
++			BUG_ON(!pte_exec(*pte));
++			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
++			continue;
++		}
++#endif
++
++		{
++			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
++			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++		}
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+ }
+ 
+@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+ {
+ 	pte_t *pte;
++	int ret = -ENOMEM;
+ 
+ 	/*
+ 	 * nr is a running index into the array which helps higher level
+@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 	pte = pte_alloc_kernel(pmd, addr);
+ 	if (!pte)
+ 		return -ENOMEM;
++
++	pax_open_kernel();
+ 	do {
+ 		struct page *page = pages[*nr];
+ 
+-		if (WARN_ON(!pte_none(*pte)))
+-			return -EBUSY;
+-		if (WARN_ON(!page))
+-			return -ENOMEM;
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (pgprot_val(prot) & _PAGE_NX)
++#endif
++
++		if (WARN_ON(!pte_none(*pte))) {
++			ret = -EBUSY;
++			goto out;
++		}
++		if (WARN_ON(!page)) {
++			ret = -ENOMEM;
++			goto out;
++		}
+ 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
+ 		(*nr)++;
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+-	return 0;
++	ret = 0;
++out:
++	pax_close_kernel();
++	return ret;
+ }
+ 
+ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
+ 	 * and fall back on vmalloc() if that fails. Others
+ 	 * just put it in the vmalloc space.
+ 	 */
+-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
++#ifdef CONFIG_MODULES
++#ifdef MODULES_VADDR
+ 	unsigned long addr = (unsigned long)x;
+ 	if (addr >= MODULES_VADDR && addr < MODULES_END)
+ 		return 1;
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
++		return 1;
++#endif
++
++#endif
++
+ 	return is_vmalloc_addr(x);
+ }
+ 
+@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
+ 	struct rb_node *tmp;
+ 
+ 	while (*p) {
+-		struct vmap_area *tmp;
++		struct vmap_area *varea;
+ 
+ 		parent = *p;
+-		tmp = rb_entry(parent, struct vmap_area, rb_node);
+-		if (va->va_start < tmp->va_end)
++		varea = rb_entry(parent, struct vmap_area, rb_node);
++		if (va->va_start < varea->va_end)
+ 			p = &(*p)->rb_left;
+-		else if (va->va_end > tmp->va_start)
++		else if (va->va_end > varea->va_start)
+ 			p = &(*p)->rb_right;
+ 		else
+ 			BUG();
+@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
+ 	struct vm_struct *area;
+ 
+ 	BUG_ON(in_interrupt());
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (flags & VM_KERNEXEC) {
++		if (start != VMALLOC_START || end != VMALLOC_END)
++			return NULL;
++		start = (unsigned long)&MODULES_EXEC_VADDR;
++		end = (unsigned long)&MODULES_EXEC_END;
++	}
++#endif
++
+ 	if (flags & VM_IOREMAP) {
+ 		int bit = fls(size);
+ 
+@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
+ 	if (count > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		flags |= VM_KERNEXEC;
++#endif
++
+ 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
+ 					__builtin_return_address(0));
+ 	if (!area)
+@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
+ 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
++						node, gfp_mask, caller);
++	else
++#endif
++
+ 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
+ 				  VMALLOC_END, node, gfp_mask, caller);
+ 
+@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
+ 	return addr;
+ }
+ 
++#undef __vmalloc
+ void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
+ {
+ 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
+@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc
+ void *vmalloc(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
+  * The resulting memory area is zeroed so it can be mapped to userspace
+  * without leaking data.
+  */
++#undef vmalloc_user
+ void *vmalloc_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc_node
+ void *vmalloc_node(unsigned long size, int node)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
+-
++#undef vmalloc_exec
+ void *vmalloc_exec(unsigned long size)
+ {
+-	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
++	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
+ 			      -1, __builtin_return_address(0));
+ }
+ 
+@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
+  *	Allocate enough 32bit PA addressable pages to cover @size from the
+  *	page level allocator and map them into contiguous kernel virtual space.
+  */
++#undef vmalloc_32
+ void *vmalloc_32(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
+@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
+  * The resulting memory area is 32bit addressable and zeroed so it can be
+  * mapped to userspace without leaking data.
+  */
++#undef vmalloc_32_user
+ void *vmalloc_32_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+diff -urNp linux-2.6.32.12/net/8021q/vlan.c linux-2.6.32.12/net/8021q/vlan.c
+--- linux-2.6.32.12/net/8021q/vlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/8021q/vlan.c	2010-04-29 17:46:37.373258882 -0400
+@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
+ 		err = -EPERM;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			break;
+-		if ((args.u.name_type >= 0) &&
+-		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
++		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
+ 			struct vlan_net *vn;
+ 
+ 			vn = net_generic(net, vlan_net_id);
+diff -urNp linux-2.6.32.12/net/atm/atm_misc.c linux-2.6.32.12/net/atm/atm_misc.c
+--- linux-2.6.32.12/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/atm/atm_misc.c	2010-04-04 20:46:41.716811517 -0400
+@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
+ 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
+ 		return 1;
+ 	atm_return(vcc,truesize);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return 0;
+ }
+ 
+@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
+ 		}
+ 	}
+ 	atm_return(vcc,guess);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return NULL;
+ }
+ 
+@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
+ 
+ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
+ 
+ void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.12/net/atm/proc.c linux-2.6.32.12/net/atm/proc.c
+--- linux-2.6.32.12/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/atm/proc.c	2010-04-04 20:46:41.716811517 -0400
+@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
+   const struct k_atm_aal_stats *stats)
+ {
+ 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
+-	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
+-	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
+-	    atomic_read(&stats->rx_drop));
++	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
++	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
++	    atomic_read_unchecked(&stats->rx_drop));
+ }
+ 
+ static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
+diff -urNp linux-2.6.32.12/net/atm/resources.c linux-2.6.32.12/net/atm/resources.c
+--- linux-2.6.32.12/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/atm/resources.c	2010-04-04 20:46:41.716811517 -0400
+@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
+ static void copy_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
+ static void subtract_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.12/net/bridge/br_private.h linux-2.6.32.12/net/bridge/br_private.h
+--- linux-2.6.32.12/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/bridge/br_private.h	2010-04-04 20:46:41.716811517 -0400
+@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
+ 
+ #ifdef CONFIG_SYSFS
+ /* br_sysfs_if.c */
+-extern struct sysfs_ops brport_sysfs_ops;
++extern const struct sysfs_ops brport_sysfs_ops;
+ extern int br_sysfs_addif(struct net_bridge_port *p);
+ 
+ /* br_sysfs_br.c */
+diff -urNp linux-2.6.32.12/net/bridge/br_stp_if.c linux-2.6.32.12/net/bridge/br_stp_if.c
+--- linux-2.6.32.12/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/bridge/br_stp_if.c	2010-04-04 20:46:41.716811517 -0400
+@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
+ 	char *envp[] = { NULL };
+ 
+ 	if (br->stp_enabled == BR_USER_STP) {
+-		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
++		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+ 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
+ 			br->dev->name, r);
+ 
+diff -urNp linux-2.6.32.12/net/bridge/br_sysfs_if.c linux-2.6.32.12/net/bridge/br_sysfs_if.c
+--- linux-2.6.32.12/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/bridge/br_sysfs_if.c	2010-04-04 20:46:41.716811517 -0400
+@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
+ 	return ret;
+ }
+ 
+-struct sysfs_ops brport_sysfs_ops = {
++const struct sysfs_ops brport_sysfs_ops = {
+ 	.show = brport_show,
+ 	.store = brport_store,
+ };
+diff -urNp linux-2.6.32.12/net/core/dev.c linux-2.6.32.12/net/core/dev.c
+--- linux-2.6.32.12/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/core/dev.c	2010-04-04 20:46:41.721901011 -0400
+@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_ni);
+ 
+-static void net_tx_action(struct softirq_action *h)
++static void net_tx_action(void)
+ {
+ 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
+ 
+@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
+ EXPORT_SYMBOL(netif_napi_del);
+ 
+ 
+-static void net_rx_action(struct softirq_action *h)
++static void net_rx_action(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
+ 	unsigned long time_limit = jiffies + 2;
+diff -urNp linux-2.6.32.12/net/core/flow.c linux-2.6.32.12/net/core/flow.c
+--- linux-2.6.32.12/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/core/flow.c	2010-04-04 20:46:41.721901011 -0400
+@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
+ 
+ static u32 flow_hash_shift;
+ #define flow_hash_size	(1 << flow_hash_shift)
+-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
++static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
+ 
+ #define flow_table(cpu) (per_cpu(flow_tables, cpu))
+ 
+@@ -52,7 +52,7 @@ struct flow_percpu_info {
+ 	u32 hash_rnd;
+ 	int count;
+ };
+-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
++static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
+ 
+ #define flow_hash_rnd_recalc(cpu) \
+ 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
+@@ -69,7 +69,7 @@ struct flow_flush_info {
+ 	atomic_t cpuleft;
+ 	struct completion completion;
+ };
+-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
++static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
+ 
+ #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
+ 
+diff -urNp linux-2.6.32.12/net/dccp/ccids/ccid3.c linux-2.6.32.12/net/dccp/ccids/ccid3.c
+--- linux-2.6.32.12/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/dccp/ccids/ccid3.c	2010-04-04 20:46:41.721901011 -0400
+@@ -41,7 +41,7 @@
+ static int ccid3_debug;
+ #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
+ #else
+-#define ccid3_pr_debug(format, a...)
++#define ccid3_pr_debug(format, a...) do {} while (0)
+ #endif
+ 
+ /*
+diff -urNp linux-2.6.32.12/net/dccp/dccp.h linux-2.6.32.12/net/dccp/dccp.h
+--- linux-2.6.32.12/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/dccp/dccp.h	2010-04-04 20:46:41.721901011 -0400
+@@ -44,9 +44,9 @@ extern int dccp_debug;
+ #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+ 
+ extern struct inet_hashinfo dccp_hashinfo;
+diff -urNp linux-2.6.32.12/net/decnet/sysctl_net_decnet.c linux-2.6.32.12/net/decnet/sysctl_net_decnet.c
+--- linux-2.6.32.12/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/decnet/sysctl_net_decnet.c	2010-04-04 20:46:41.721901011 -0400
+@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, addr, len))
++	if (len > sizeof addr || copy_to_user(buffer, addr, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, devname, len))
++	if (len > sizeof devname || copy_to_user(buffer, devname, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+diff -urNp linux-2.6.32.12/net/ipv4/inet_hashtables.c linux-2.6.32.12/net/ipv4/inet_hashtables.c
+--- linux-2.6.32.12/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/inet_hashtables.c	2010-04-04 20:46:41.721901011 -0400
+@@ -18,11 +18,14 @@
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
++#include <linux/security.h>
+ 
+ #include <net/inet_connection_sock.h>
+ #include <net/inet_hashtables.h>
+ #include <net/ip.h>
+ 
++extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
++
+ /*
+  * Allocate and initialize a new local port bind bucket.
+  * The bindhash mutex for snum's hash chain must be held here.
+@@ -490,6 +493,8 @@ ok:
+ 		}
+ 		spin_unlock(&head->lock);
+ 
++		gr_update_task_in_ip_table(current, inet_sk(sk));
++
+ 		if (tw) {
+ 			inet_twsk_deschedule(tw, death_row);
+ 			inet_twsk_put(tw);
+diff -urNp linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-04-04 20:46:41.721901011 -0400
+@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
+ 
+ 	*len = 0;
+ 
+-	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
++	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
+ 	if (*octets == NULL) {
+ 		if (net_ratelimit())
+ 			printk("OOM in bsalg (%d)\n", __LINE__);
+diff -urNp linux-2.6.32.12/net/ipv4/tcp_ipv4.c linux-2.6.32.12/net/ipv4/tcp_ipv4.c
+--- linux-2.6.32.12/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/tcp_ipv4.c	2010-04-04 20:46:41.721901011 -0400
+@@ -84,6 +84,9 @@
+ int sysctl_tcp_tw_reuse __read_mostly;
+ int sysctl_tcp_low_latency __read_mostly;
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+ static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
+@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
+ 	TCP_SKB_CB(skb)->sacked	 = 0;
+ 
+ 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+-	if (!sk)
++	if (!sk) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 1;
++#endif
+ 		goto no_tcp_socket;
++	}
+ 
+ process:
+-	if (sk->sk_state == TCP_TIME_WAIT)
++	if (sk->sk_state == TCP_TIME_WAIT) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 2;
++#endif
+ 		goto do_time_wait;
++	}
+ 
+ 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+ 		goto discard_and_relse;
+@@ -1650,6 +1661,10 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (!grsec_enable_blackhole || (ret == 1 &&
++		    (skb->dev->flags & IFF_LOOPBACK)))
++#endif
+ 		tcp_v4_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.12/net/ipv4/tcp_minisocks.c linux-2.6.32.12/net/ipv4/tcp_minisocks.c
+--- linux-2.6.32.12/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/tcp_minisocks.c	2010-04-04 20:46:41.721901011 -0400
+@@ -26,6 +26,10 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ #ifdef CONFIG_SYSCTL
+ #define SYNC_INIT 0 /* let the user enable it */
+ #else
+@@ -672,6 +676,10 @@ listen_overflow:
+ 
+ embryonic_reset:
+ 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole)
++#endif
+ 	if (!(flg & TCP_FLAG_RST))
+ 		req->rsk_ops->send_reset(sk, skb);
+ 
+diff -urNp linux-2.6.32.12/net/ipv4/tcp_probe.c linux-2.6.32.12/net/ipv4/tcp_probe.c
+--- linux-2.6.32.12/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/tcp_probe.c	2010-04-04 20:46:41.721901011 -0400
+@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
+ 		if (cnt + width >= len)
+ 			break;
+ 
+-		if (copy_to_user(buf + cnt, tbuf, width))
++		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
+ 			return -EFAULT;
+ 		cnt += width;
+ 	}
+diff -urNp linux-2.6.32.12/net/ipv4/tcp_timer.c linux-2.6.32.12/net/ipv4/tcp_timer.c
+--- linux-2.6.32.12/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/tcp_timer.c	2010-04-04 20:46:41.721901011 -0400
+@@ -21,6 +21,10 @@
+ #include <linux/module.h>
+ #include <net/tcp.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_lastack_retries;
++#endif
++
+ int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
+ int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
+ int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
+@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
+ 		}
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if ((sk->sk_state == TCP_LAST_ACK) &&
++	    (grsec_lastack_retries > 0) &&
++	    (grsec_lastack_retries < retry_until))
++		retry_until = grsec_lastack_retries;
++#endif
++
+ 	if (retransmits_timed_out(sk, retry_until)) {
+ 		/* Has it gone just too far? */
+ 		tcp_write_err(sk);
+diff -urNp linux-2.6.32.12/net/ipv4/udp.c linux-2.6.32.12/net/ipv4/udp.c
+--- linux-2.6.32.12/net/ipv4/udp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv4/udp.c	2010-04-04 20:46:41.724917264 -0400
+@@ -86,6 +86,7 @@
+ #include <linux/types.h>
+ #include <linux/fcntl.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+ #include <linux/igmp.h>
+@@ -106,6 +107,10 @@
+ #include <net/xfrm.h>
+ #include "udp_impl.h"
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ struct udp_table udp_table;
+ EXPORT_SYMBOL(udp_table);
+ 
+@@ -371,6 +376,9 @@ found:
+ 	return s;
+ }
+ 
++extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
++
+ /*
+  * This routine is called by the ICMP module when it gets some
+  * sort of error condition.  If err < 0 then the socket should
+@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
+ 		dport = usin->sin_port;
+ 		if (dport == 0)
+ 			return -EINVAL;
++
++		err = gr_search_udp_sendmsg(sk, usin);
++		if (err)
++			return err;
+ 	} else {
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+ 			return -EDESTADDRREQ;
++
++		err = gr_search_udp_sendmsg(sk, NULL);
++		if (err)
++			return err;
++
+ 		daddr = inet->daddr;
+ 		dport = inet->dport;
+ 		/* Open fast path for connected socket.
+@@ -945,6 +962,10 @@ try_again:
+ 	if (!skb)
+ 		goto out;
+ 
++	err = gr_search_udp_recvmsg(sk, skb);
++	if (err)
++		goto out_free;
++
+ 	ulen = skb->len - sizeof(struct udphdr);
+ 	copied = len;
+ 	if (copied > ulen)
+@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
+ 		goto csum_error;
+ 
+ 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+ 
+ 	/*
+diff -urNp linux-2.6.32.12/net/ipv6/exthdrs.c linux-2.6.32.12/net/ipv6/exthdrs.c
+--- linux-2.6.32.12/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv6/exthdrs.c	2010-04-04 20:46:41.724917264 -0400
+@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
+ 		.type	= IPV6_TLV_JUMBO,
+ 		.func	= ipv6_hop_jumbo,
+ 	},
+-	{ -1, }
++	{ -1, NULL }
+ };
+ 
+ int ipv6_parse_hopopts(struct sk_buff *skb)
+diff -urNp linux-2.6.32.12/net/ipv6/raw.c linux-2.6.32.12/net/ipv6/raw.c
+--- linux-2.6.32.12/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv6/raw.c	2010-04-04 20:46:41.724917264 -0400
+@@ -600,7 +600,7 @@ out:
+ 	return err;
+ }
+ 
+-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
++static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
+ 			struct flowi *fl, struct rt6_info *rt,
+ 			unsigned int flags)
+ {
+diff -urNp linux-2.6.32.12/net/ipv6/tcp_ipv6.c linux-2.6.32.12/net/ipv6/tcp_ipv6.c
+--- linux-2.6.32.12/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv6/tcp_ipv6.c	2010-04-04 20:46:41.724917264 -0400
+@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
+ 	return 0;
+ 
+ reset:
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	tcp_v6_send_reset(sk, skb);
+ discard:
+ 	if (opt_skb)
+@@ -1700,6 +1703,9 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		tcp_v6_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.12/net/ipv6/udp.c linux-2.6.32.12/net/ipv6/udp.c
+--- linux-2.6.32.12/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/ipv6/udp.c	2010-04-04 20:46:41.724917264 -0400
+@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
+ 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+ 				proto == IPPROTO_UDPLITE);
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+ 
+ 		kfree_skb(skb);
+diff -urNp linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c
+--- linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c	2010-04-04 20:46:41.724917264 -0400
+@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
+ 	add_wait_queue(&self->open_wait, &wait);
+ 
+ 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count );
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 	/* As far as I can see, we protect open_count - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	if (!tty_hung_up_p(filp)) {
+ 		extra_count = 1;
+-		self->open_count--;
++		atomic_dec(&self->open_count);
+ 	}
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+-	self->blocked_open++;
++	atomic_inc(&self->blocked_open);
+ 
+ 	while (1) {
+ 		if (tty->termios->c_cflag & CBAUD) {
+@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
+ 		}
+ 
+ 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
+-		      __FILE__,__LINE__, tty->driver->name, self->open_count );
++		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 		schedule();
+ 	}
+@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
+ 	if (extra_count) {
+ 		/* ++ is not atomic, so this should be protected - Jean II */
+ 		spin_lock_irqsave(&self->spinlock, flags);
+-		self->open_count++;
++		atomic_inc(&self->open_count);
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 	}
+-	self->blocked_open--;
++	atomic_dec(&self->blocked_open);
+ 
+ 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count);
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
+ 
+ 	if (!retval)
+ 		self->flags |= ASYNC_NORMAL_ACTIVE;
+@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
+ 	}
+ 	/* ++ is not atomic, so this should be protected - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+-	self->open_count++;
++	atomic_inc(&self->open_count);
+ 
+ 	tty->driver_data = self;
+ 	self->tty = tty;
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
+-		   self->line, self->open_count);
++		   self->line, atomic_read(&self->open_count));
+ 
+ 	/* Not really used by us, but lets do it anyway */
+ 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
+ 		return;
+ 	}
+ 
+-	if ((tty->count == 1) && (self->open_count != 1)) {
++	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
+ 		/*
+ 		 * Uh, oh.  tty->count is 1, which means that the tty
+ 		 * structure will be freed.  state->count should always
+@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
+ 		 */
+ 		IRDA_DEBUG(0, "%s(), bad serial port count; "
+ 			   "tty->count is 1, state->count is %d\n", __func__ ,
+-			   self->open_count);
+-		self->open_count = 1;
++			   atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 1);
+ 	}
+ 
+-	if (--self->open_count < 0) {
++	if (atomic_dec_return(&self->open_count) < 0) {
+ 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
+-			   __func__, self->line, self->open_count);
+-		self->open_count = 0;
++			   __func__, self->line, atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 0);
+ 	}
+-	if (self->open_count) {
++	if (atomic_read(&self->open_count)) {
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
+@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
+ 	tty->closing = 0;
+ 	self->tty = NULL;
+ 
+-	if (self->blocked_open) {
++	if (atomic_read(&self->blocked_open)) {
+ 		if (self->close_delay)
+ 			schedule_timeout_interruptible(self->close_delay);
+ 		wake_up_interruptible(&self->open_wait);
+@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
+ 	self->tty = NULL;
+-	self->open_count = 0;
++	atomic_set(&self->open_count, 0);
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	wake_up_interruptible(&self->open_wait);
+@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
+ 	seq_putc(m, '\n');
+ 
+ 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
+-	seq_printf(m, "Open count: %d\n", self->open_count);
++	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
+ 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
+ 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
+ 
+diff -urNp linux-2.6.32.12/net/mac80211/ieee80211_i.h linux-2.6.32.12/net/mac80211/ieee80211_i.h
+--- linux-2.6.32.12/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.12/net/mac80211/ieee80211_i.h	2010-04-04 20:46:41.724917264 -0400
+@@ -635,7 +635,7 @@ struct ieee80211_local {
+ 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
+ 	spinlock_t queue_stop_reason_lock;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int monitors, cooked_mntrs;
+ 	/* number of interfaces with corresponding FIF_ flags */
+ 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
+diff -urNp linux-2.6.32.12/net/mac80211/iface.c linux-2.6.32.12/net/mac80211/iface.c
+--- linux-2.6.32.12/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/mac80211/iface.c	2010-04-04 20:46:41.724917264 -0400
+@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
+ 		break;
+ 	}
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		res = drv_start(local);
+ 		if (res)
+ 			goto err_del_bss;
+@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
+ 	 * Validate the MAC address for this device.
+ 	 */
+ 	if (!is_valid_ether_addr(dev->dev_addr)) {
+-		if (!local->open_count)
++		if (!atomic_read(&local->open_count))
+ 			drv_stop(local);
+ 		return -EADDRNOTAVAIL;
+ 	}
+@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
+ 
+ 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
+ 
+-	local->open_count++;
++	atomic_inc(&local->open_count);
+ 	if (hw_reconf_flags) {
+ 		ieee80211_hw_config(local, hw_reconf_flags);
+ 		/*
+@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
+  err_del_interface:
+ 	drv_remove_interface(local, &conf);
+  err_stop:
+-	if (!local->open_count)
++	if (!atomic_read(&local->open_count))
+ 		drv_stop(local);
+  err_del_bss:
+ 	sdata->bss = NULL;
+@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
+ 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
+ 	}
+ 
+-	local->open_count--;
++	atomic_dec(&local->open_count);
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
+ 
+ 	ieee80211_recalc_ps(local, -1);
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		ieee80211_clear_tx_pending(local);
+ 		ieee80211_stop_device(local);
+ 
+diff -urNp linux-2.6.32.12/net/mac80211/main.c linux-2.6.32.12/net/mac80211/main.c
+--- linux-2.6.32.12/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.12/net/mac80211/main.c	2010-04-04 20:46:41.724917264 -0400
+@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
+ 		local->hw.conf.power_level = power;
+ 	}
+ 
+-	if (changed && local->open_count) {
++	if (changed && atomic_read(&local->open_count)) {
+ 		ret = drv_config(local, changed);
+ 		/*
+ 		 * Goal:
+diff -urNp linux-2.6.32.12/net/mac80211/pm.c linux-2.6.32.12/net/mac80211/pm.c
+--- linux-2.6.32.12/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/mac80211/pm.c	2010-04-04 20:46:41.724917264 -0400
+@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
+ 	}
+ 
+ 	/* stop hardware - this must stop RX */
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		ieee80211_stop_device(local);
+ 
+ 	local->suspended = true;
+diff -urNp linux-2.6.32.12/net/mac80211/rate.c linux-2.6.32.12/net/mac80211/rate.c
+--- linux-2.6.32.12/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/mac80211/rate.c	2010-04-04 20:46:41.724917264 -0400
+@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
+ 	struct rate_control_ref *ref, *old;
+ 
+ 	ASSERT_RTNL();
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		return -EBUSY;
+ 
+ 	ref = rate_control_alloc(name, local);
+diff -urNp linux-2.6.32.12/net/mac80211/tx.c linux-2.6.32.12/net/mac80211/tx.c
+--- linux-2.6.32.12/net/mac80211/tx.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.12/net/mac80211/tx.c	2010-04-29 17:49:58.741536660 -0400
+@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
+ 	return cpu_to_le16(dur);
+ }
+ 
+-static int inline is_ieee80211_device(struct ieee80211_local *local,
++static inline int is_ieee80211_device(struct ieee80211_local *local,
+ 				      struct net_device *dev)
+ {
+ 	return local == wdev_priv(dev->ieee80211_ptr);
+diff -urNp linux-2.6.32.12/net/mac80211/util.c linux-2.6.32.12/net/mac80211/util.c
+--- linux-2.6.32.12/net/mac80211/util.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.12/net/mac80211/util.c	2010-04-29 17:49:58.749029456 -0400
+@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
+ 		local->resuming = true;
+ 
+ 	/* restart hardware */
+-	if (local->open_count) {
++	if (atomic_read(&local->open_count)) {
+ 		/*
+ 		 * Upon resume hardware can sometimes be goofy due to
+ 		 * various platform / driver / bus issues, so restarting
+ 		 * the device may at times not work immediately. Propagate
+ 		 * the error.
+ 		 */
+-		res = drv_start(local);
++                res = drv_start(local);
+ 		if (res) {
+ 			WARN(local->suspended, "Harware became unavailable "
+ 			     "upon resume. This is could be a software issue"
+diff -urNp linux-2.6.32.12/net/sctp/socket.c linux-2.6.32.12/net/sctp/socket.c
+--- linux-2.6.32.12/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/sctp/socket.c	2010-04-04 20:46:41.728797784 -0400
+@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
+ 	struct sctp_sndrcvinfo *sinfo;
+ 	struct sctp_initmsg *sinit;
+ 	sctp_assoc_t associd = 0;
+-	sctp_cmsgs_t cmsgs = { NULL };
++	sctp_cmsgs_t cmsgs = { NULL, NULL };
+ 	int err;
+ 	sctp_scope_t scope;
+ 	long timeo;
+@@ -5802,7 +5802,6 @@ pp_found:
+ 		 */
+ 		int reuse = sk->sk_reuse;
+ 		struct sock *sk2;
+-		struct hlist_node *node;
+ 
+ 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
+ 		if (pp->fastreuse && sk->sk_reuse &&
+diff -urNp linux-2.6.32.12/net/socket.c linux-2.6.32.12/net/socket.c
+--- linux-2.6.32.12/net/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/socket.c	2010-04-04 20:46:41.728797784 -0400
+@@ -87,6 +87,7 @@
+ #include <linux/wireless.h>
+ #include <linux/nsproxy.h>
+ #include <linux/magic.h>
++#include <linux/in.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/unistd.h>
+@@ -97,6 +98,21 @@
+ #include <net/sock.h>
+ #include <linux/netfilter.h>
+ 
++extern void gr_attach_curr_ip(const struct sock *sk);
++extern int gr_handle_sock_all(const int family, const int type,
++			      const int protocol);
++extern int gr_handle_sock_server(const struct sockaddr *sck);
++extern int gr_handle_sock_server_other(const struct socket *sck);
++extern int gr_handle_sock_client(const struct sockaddr *sck);
++extern int gr_search_connect(struct socket * sock,
++			     struct sockaddr_in * addr);
++extern int gr_search_bind(struct socket * sock,
++			  struct sockaddr_in * addr);
++extern int gr_search_listen(struct socket * sock);
++extern int gr_search_accept(struct socket * sock);
++extern int gr_search_socket(const int domain, const int type,
++			    const int protocol);
++
+ static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
+ static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ 			 unsigned long nr_segs, loff_t pos);
+@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
+ 			     mnt);
+ }
+ 
+-static struct vfsmount *sock_mnt __read_mostly;
++struct vfsmount *sock_mnt __read_mostly;
+ 
+ static struct file_system_type sock_fs_type = {
+ 	.name =		"sockfs",
+@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
+ 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+ 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
+ 
++	if(!gr_search_socket(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_handle_sock_all(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
+ 	retval = sock_create(family, type, protocol, &sock);
+ 	if (retval < 0)
+ 		goto out;
+@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 	if (sock) {
+ 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
+ 		if (err >= 0) {
++			if (gr_handle_sock_server((struct sockaddr *)&address)) {
++				err = -EACCES;
++				goto error;
++			}
++			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
++			if (err)
++				goto error;
++
+ 			err = security_socket_bind(sock,
+ 						   (struct sockaddr *)&address,
+ 						   addrlen);
+@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 						      (struct sockaddr *)
+ 						      &address, addrlen);
+ 		}
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
+ 		if ((unsigned)backlog > somaxconn)
+ 			backlog = somaxconn;
+ 
++		if (gr_handle_sock_server_other(sock)) {
++			err = -EPERM;
++			goto error;
++		}
++
++		err = gr_search_listen(sock);
++		if (err)
++			goto error;
++
+ 		err = security_socket_listen(sock, backlog);
+ 		if (!err)
+ 			err = sock->ops->listen(sock, backlog);
+ 
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	newsock->type = sock->type;
+ 	newsock->ops = sock->ops;
+ 
++	if (gr_handle_sock_server_other(sock)) {
++		err = -EPERM;
++		sock_release(newsock);
++		goto out_put;
++	}
++
++	err = gr_search_accept(sock);
++	if (err) {
++		sock_release(newsock);
++		goto out_put;
++	}
++
+ 	/*
+ 	 * We don't need try_module_get here, as the listening socket (sock)
+ 	 * has the protocol module (sock->ops->owner) held.
+@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	fd_install(newfd, newfile);
+ 	err = newfd;
+ 
++	gr_attach_curr_ip(newsock->sk);
++
+ out_put:
+ 	fput_light(sock->file, fput_needed);
+ out:
+@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 		int, addrlen)
+ {
+ 	struct socket *sock;
++	struct sockaddr *sck;
+ 	struct sockaddr_storage address;
+ 	int err, fput_needed;
+ 
+@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 	if (err < 0)
+ 		goto out_put;
+ 
++	sck = (struct sockaddr *)&address;
++
++	if (gr_handle_sock_client(sck)) {
++		err = -EACCES;
++		goto out_put;
++	}
++
++	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
++	if (err)
++		goto out_put;
++
+ 	err =
+ 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
+ 	if (err)
+diff -urNp linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c
+--- linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c	2010-04-04 20:46:41.728797784 -0400
+@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
+ 		len -= *ppos;
+ 		if (len > *lenp)
+ 			len = *lenp;
+-		if (len && copy_to_user(buffer, str_buf, len))
++		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
+ 			return -EFAULT;
+ 		*lenp = len;
+ 		*ppos += len;
+diff -urNp linux-2.6.32.12/net/sysctl_net.c linux-2.6.32.12/net/sysctl_net.c
+--- linux-2.6.32.12/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/sysctl_net.c	2010-04-04 20:46:41.728797784 -0400
+@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
+ 			       struct ctl_table *table)
+ {
+ 	/* Allow network administrator to have same access as root. */
+-	if (capable(CAP_NET_ADMIN)) {
++	if (capable_nolog(CAP_NET_ADMIN)) {
+ 		int mode = (table->mode >> 6) & 7;
+ 		return (mode << 6) | (mode << 3) | mode;
+ 	}
+diff -urNp linux-2.6.32.12/net/tipc/socket.c linux-2.6.32.12/net/tipc/socket.c
+--- linux-2.6.32.12/net/tipc/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/tipc/socket.c	2010-04-29 17:46:37.401277007 -0400
+@@ -1449,8 +1449,9 @@ static int connect(struct socket *sock, 
+ 	} else {
+ 		if (res == 0)
+ 			res = -ETIMEDOUT;
+-		else
+-			; /* leave "res" unchanged */
++		else {
++			/* leave "res" unchanged */
++		}
+ 		sock->state = SS_DISCONNECTING;
+ 	}
+ 
+diff -urNp linux-2.6.32.12/net/unix/af_unix.c linux-2.6.32.12/net/unix/af_unix.c
+--- linux-2.6.32.12/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/unix/af_unix.c	2010-04-04 20:46:41.728797784 -0400
+@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
+ 		err = -ECONNREFUSED;
+ 		if (!S_ISSOCK(inode->i_mode))
+ 			goto put_fail;
++
++		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
++			err = -EACCES;
++			goto put_fail;
++		}
++
+ 		u = unix_find_socket_byinode(net, inode);
+ 		if (!u)
+ 			goto put_fail;
+@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
+ 		if (u) {
+ 			struct dentry *dentry;
+ 			dentry = unix_sk(u)->dentry;
++
++			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
++				err = -EPERM;
++				sock_put(u);
++				goto fail;
++			}
++
+ 			if (dentry)
+ 				touch_atime(unix_sk(u)->mnt, dentry);
+ 		} else
+@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
+ 		err = security_path_mknod(&nd.path, dentry, mode, 0);
+ 		if (err)
+ 			goto out_mknod_drop_write;
++		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++			err = -EACCES;
++			goto out_mknod_drop_write;
++		}
+ 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
+ out_mknod_drop_write:
+ 		mnt_drop_write(nd.path.mnt);
+ 		if (err)
+ 			goto out_mknod_dput;
++
++		gr_handle_create(dentry, nd.path.mnt);
++
+ 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+ 		dput(nd.path.dentry);
+ 		nd.path.dentry = dentry;
+@@ -861,6 +881,10 @@ out_mknod_drop_write:
+ 			goto out_unlock;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++		sk->sk_peercred.pid = current->pid;
++#endif
++
+ 		list = &unix_socket_table[addr->hash];
+ 	} else {
+ 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
+diff -urNp linux-2.6.32.12/net/xfrm/xfrm_policy.c linux-2.6.32.12/net/xfrm/xfrm_policy.c
+--- linux-2.6.32.12/net/xfrm/xfrm_policy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/net/xfrm/xfrm_policy.c	2010-04-29 17:46:37.421275445 -0400
+@@ -1477,7 +1477,7 @@ free_dst:
+ 	goto out;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_alloc_copy(void **target, void *src, int size)
+ {
+ 	if (!*target) {
+@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void 
+ 	return 0;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry 
+ #endif
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+diff -urNp linux-2.6.32.12/samples/kobject/kset-example.c linux-2.6.32.12/samples/kobject/kset-example.c
+--- linux-2.6.32.12/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/samples/kobject/kset-example.c	2010-04-04 20:46:41.728797784 -0400
+@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
+ }
+ 
+ /* Our custom sysfs_ops that we will associate with our ktype later on */
+-static struct sysfs_ops foo_sysfs_ops = {
++static const struct sysfs_ops foo_sysfs_ops = {
+ 	.show = foo_attr_show,
+ 	.store = foo_attr_store,
+ };
+diff -urNp linux-2.6.32.12/scripts/basic/fixdep.c linux-2.6.32.12/scripts/basic/fixdep.c
+--- linux-2.6.32.12/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/basic/fixdep.c	2010-04-04 20:46:41.728797784 -0400
+@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
+ 
+ static void parse_config_file(char *map, size_t len)
+ {
+-	int *end = (int *) (map + len);
++	unsigned int *end = (unsigned int *) (map + len);
+ 	/* start at +1, so that p can never be < map */
+-	int *m   = (int *) map + 1;
++	unsigned int *m   = (unsigned int *) map + 1;
+ 	char *p, *q;
+ 
+ 	for (; m < end; m++) {
+@@ -371,7 +371,7 @@ static void print_deps(void)
+ static void traps(void)
+ {
+ 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
+-	int *p = (int *)test;
++	unsigned int *p = (unsigned int *)test;
+ 
+ 	if (*p != INT_CONF) {
+ 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
+diff -urNp linux-2.6.32.12/scripts/kallsyms.c linux-2.6.32.12/scripts/kallsyms.c
+--- linux-2.6.32.12/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/kallsyms.c	2010-04-04 20:46:41.728797784 -0400
+@@ -43,10 +43,10 @@ struct text_range {
+ 
+ static unsigned long long _text;
+ static struct text_range text_ranges[] = {
+-	{ "_stext",     "_etext"     },
+-	{ "_sinittext", "_einittext" },
+-	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
+-	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
++	{ "_stext",     "_etext",     0, 0 },
++	{ "_sinittext", "_einittext", 0, 0 },
++	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
++	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
+ };
+ #define text_range_text     (&text_ranges[0])
+ #define text_range_inittext (&text_ranges[1])
+diff -urNp linux-2.6.32.12/scripts/mod/file2alias.c linux-2.6.32.12/scripts/mod/file2alias.c
+--- linux-2.6.32.12/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/mod/file2alias.c	2010-04-04 20:46:41.728797784 -0400
+@@ -72,7 +72,7 @@ static void device_id_check(const char *
+ 			    unsigned long size, unsigned long id_size,
+ 			    void *symval)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	if (size % id_size || size < id_size) {
+ 		if (cross_build != 0)
+@@ -102,7 +102,7 @@ static void device_id_check(const char *
+ /* USB is special because the bcdDevice can be matched against a numeric range */
+ /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
+ static void do_usb_entry(struct usb_device_id *id,
+-			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
++			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
+ 			 unsigned char range_lo, unsigned char range_hi,
+ 			 struct module *mod)
+ {
+@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
+ 	for (i = 0; i < count; i++) {
+ 		const char *id = (char *)devs[i].id;
+ 		char acpi_id[sizeof(devs[0].id)];
+-		int j;
++		unsigned int j;
+ 
+ 		buf_printf(&mod->dev_table_buf,
+ 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
+ 
+ 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
+ 			const char *id = (char *)card->devs[j].id;
+-			int i2, j2;
++			unsigned int i2, j2;
+ 			int dup = 0;
+ 
+ 			if (!id[0])
+@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
+ 			/* add an individual alias for every device entry */
+ 			if (!dup) {
+ 				char acpi_id[sizeof(card->devs[0].id)];
+-				int k;
++				unsigned int k;
+ 
+ 				buf_printf(&mod->dev_table_buf,
+ 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
+ static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
+ 			char *alias)
+ {
+-	int i, j;
++	unsigned int i, j;
+ 
+ 	sprintf(alias, "dmi*");
+ 
+diff -urNp linux-2.6.32.12/scripts/mod/modpost.c linux-2.6.32.12/scripts/mod/modpost.c
+--- linux-2.6.32.12/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/mod/modpost.c	2010-04-04 20:46:41.728797784 -0400
+@@ -835,6 +835,7 @@ enum mismatch {
+ 	INIT_TO_EXIT,
+ 	EXIT_TO_INIT,
+ 	EXPORT_TO_INIT_EXIT,
++	DATA_TO_TEXT
+ };
+ 
+ struct sectioncheck {
+@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
+ 	.fromsec = { "__ksymtab*", NULL },
+ 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
+ 	.mismatch = EXPORT_TO_INIT_EXIT
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.tosec   = { TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+ 
+@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
+ 			continue;
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ 			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+ 		/* Find a symbol nearby - addr are maybe negative */
+ 		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+ 		if (d < 0)
+ 			d = addr - sym->st_value;
+ 		if (d < distance) {
+@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
+ 		"Fix this by removing the %sannotation of %s "
+ 		"or drop the export.\n",
+ 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
++	case DATA_TO_TEXT:
++/*
++		fprintf(stderr,
++		"The variable %s references\n"
++		"the %s %s%s%s\n",
++		fromsym, to, sec2annotation(tosec), tosym, to_p);
++*/
++		break;
+ 	case NO_MISMATCH:
+ 		/* To get warnings on missing members */
+ 		break;
+@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
+ 	va_end(ap);
+ }
+ 
+-void buf_write(struct buffer *buf, const char *s, int len)
++void buf_write(struct buffer *buf, const char *s, unsigned int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
+ 	if (fstat(fileno(file), &st) < 0)
+ 		goto close_write;
+ 
+-	if (st.st_size != b->pos)
++	if (st.st_size != (off_t)b->pos)
+ 		goto close_write;
+ 
+ 	tmp = NOFAIL(malloc(b->pos));
+diff -urNp linux-2.6.32.12/scripts/mod/modpost.h linux-2.6.32.12/scripts/mod/modpost.h
+--- linux-2.6.32.12/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/mod/modpost.h	2010-04-04 20:46:41.728797784 -0400
+@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
+ 
+ struct buffer {
+ 	char *p;
+-	int pos;
+-	int size;
++	unsigned int pos;
++	unsigned int size;
+ };
+ 
+ void __attribute__((format(printf, 2, 3)))
+ buf_printf(struct buffer *buf, const char *fmt, ...);
+ 
+ void
+-buf_write(struct buffer *buf, const char *s, int len);
++buf_write(struct buffer *buf, const char *s, unsigned int len);
+ 
+ struct module {
+ 	struct module *next;
+diff -urNp linux-2.6.32.12/scripts/mod/sumversion.c linux-2.6.32.12/scripts/mod/sumversion.c
+--- linux-2.6.32.12/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/mod/sumversion.c	2010-04-04 20:46:41.728797784 -0400
+@@ -455,7 +455,7 @@ static void write_version(const char *fi
+ 		goto out;
+ 	}
+ 
+-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
++	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
+ 		warn("writing sum in %s failed: %s\n",
+ 			filename, strerror(errno));
+ 		goto out;
+diff -urNp linux-2.6.32.12/scripts/pnmtologo.c linux-2.6.32.12/scripts/pnmtologo.c
+--- linux-2.6.32.12/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/scripts/pnmtologo.c	2010-04-04 20:46:41.728797784 -0400
+@@ -237,14 +237,14 @@ static void write_header(void)
+     fprintf(out, " *  Linux logo %s\n", logoname);
+     fputs(" */\n\n", out);
+     fputs("#include <linux/linux_logo.h>\n\n", out);
+-    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_data[] = {\n",
+ 	    logoname);
+ }
+ 
+ static void write_footer(void)
+ {
+     fputs("\n};\n\n", out);
+-    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
++    fprintf(out, "const struct linux_logo %s = {\n", logoname);
+     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
+     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
+     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
+@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
+     fputs("\n};\n\n", out);
+ 
+     /* write logo clut */
+-    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_clut[] = {\n",
+ 	    logoname);
+     write_hex_cnt = 0;
+     for (i = 0; i < logo_clutsize; i++) {
+diff -urNp linux-2.6.32.12/security/commoncap.c linux-2.6.32.12/security/commoncap.c
+--- linux-2.6.32.12/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/commoncap.c	2010-04-04 20:46:41.728797784 -0400
+@@ -27,7 +27,7 @@
+ #include <linux/sched.h>
+ #include <linux/prctl.h>
+ #include <linux/securebits.h>
+-
++#include <net/sock.h>
+ /*
+  * If a non-root user executes a setuid-root binary in
+  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
+@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
+ 	}
+ }
+ 
++extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
++
+ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
+ {
+-	NETLINK_CB(skb).eff_cap = current_cap();
++	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.12/security/integrity/ima/ima_api.c linux-2.6.32.12/security/integrity/ima/ima_api.c
+--- linux-2.6.32.12/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/integrity/ima/ima_api.c	2010-04-04 20:46:41.728797784 -0400
+@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
+ 	int result;
+ 
+ 	/* can overflow, only indicator */
+-	atomic_long_inc(&ima_htable.violations);
++	atomic_long_inc_unchecked(&ima_htable.violations);
+ 
+ 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ 	if (!entry) {
+diff -urNp linux-2.6.32.12/security/integrity/ima/ima_fs.c linux-2.6.32.12/security/integrity/ima/ima_fs.c
+--- linux-2.6.32.12/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/integrity/ima/ima_fs.c	2010-04-04 20:46:41.728797784 -0400
+@@ -27,12 +27,12 @@
+ static int valid_policy = 1;
+ #define TMPBUFLEN 12
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+-				     loff_t *ppos, atomic_long_t *val)
++				     loff_t *ppos, atomic_long_unchecked_t *val)
+ {
+ 	char tmpbuf[TMPBUFLEN];
+ 	ssize_t len;
+ 
+-	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
+ 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+ 
+diff -urNp linux-2.6.32.12/security/integrity/ima/ima.h linux-2.6.32.12/security/integrity/ima/ima.h
+--- linux-2.6.32.12/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/integrity/ima/ima.h	2010-04-04 20:46:41.728797784 -0400
+@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
+ extern spinlock_t ima_queue_lock;
+ 
+ struct ima_h_table {
+-	atomic_long_t len;	/* number of stored measurements in the list */
+-	atomic_long_t violations;
++	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
++	atomic_long_unchecked_t violations;
+ 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
+ };
+ extern struct ima_h_table ima_htable;
+diff -urNp linux-2.6.32.12/security/integrity/ima/ima_queue.c linux-2.6.32.12/security/integrity/ima/ima_queue.c
+--- linux-2.6.32.12/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/integrity/ima/ima_queue.c	2010-04-04 20:46:41.728797784 -0400
+@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
+ 	INIT_LIST_HEAD(&qe->later);
+ 	list_add_tail_rcu(&qe->later, &ima_measurements);
+ 
+-	atomic_long_inc(&ima_htable.len);
++	atomic_long_inc_unchecked(&ima_htable.len);
+ 	key = ima_hash_key(entry->digest);
+ 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+ 	return 0;
+diff -urNp linux-2.6.32.12/security/Kconfig linux-2.6.32.12/security/Kconfig
+--- linux-2.6.32.12/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/security/Kconfig	2010-04-29 17:46:37.065247062 -0400
+@@ -4,6 +4,499 @@
+ 
+ menu "Security options"
+ 
++source grsecurity/Kconfig
++
++menu "PaX"
++
++	config PAX_PER_CPU_PGD
++	bool
++
++	config TASK_SIZE_MAX_SHIFT
++	int
++	depends on X86_64
++	default 47 if !PAX_PER_CPU_PGD
++	default 42 if PAX_PER_CPU_PGD
++
++config PAX
++	bool "Enable various PaX features"
++	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
++	help
++	  This allows you to enable various PaX features.  PaX adds
++	  intrusion prevention mechanisms to the kernel that reduce
++	  the risks posed by exploitable memory corruption bugs.
++
++menu "PaX Control"
++	depends on PAX
++
++config PAX_SOFTMODE
++	bool 'Support soft mode'
++	select PAX_PT_PAX_FLAGS
++	help
++	  Enabling this option will allow you to run PaX in soft mode, that
++	  is, PaX features will not be enforced by default, only on executables
++	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
++	  is the only way to mark executables for soft mode use.
++
++	  Soft mode can be activated by using the "pax_softmode=1" kernel command
++	  line option on boot.  Furthermore you can control various PaX features
++	  at runtime via the entries in /proc/sys/kernel/pax.
++
++config PAX_EI_PAX
++	bool 'Use legacy ELF header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'chpax' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  an otherwise reserved part of the ELF header.  This marking has
++	  numerous drawbacks (no support for soft-mode, toolchain does not
++	  know about the non-standard use of the ELF header) therefore it
++	  has been deprecated in favour of PT_PAX_FLAGS support.
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable this option otherwise they
++	  will not get any protection.
++
++	  Note that if you enable PT_PAX_FLAGS marking support as well,
++	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
++
++config PAX_PT_PAX_FLAGS
++	bool 'Use ELF program header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'paxctl' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
++	  has the benefits of supporting both soft mode and being fully
++	  integrated into the toolchain (the binutils patch is available
++	  from http://pax.grsecurity.net).
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable the EI_PAX marking support
++	  otherwise they will not get any protection.
++
++	  Note that if you enable the legacy EI_PAX marking support as well,
++	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
++
++choice
++	prompt 'MAC system integration'
++	default PAX_HAVE_ACL_FLAGS
++	help
++	  Mandatory Access Control systems have the option of controlling
++	  PaX flags on a per executable basis, choose the method supported
++	  by your particular system.
++
++	  - "none": if your MAC system does not interact with PaX,
++	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
++	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
++
++	  NOTE: this option is for developers/integrators only.
++
++	config PAX_NO_ACL_FLAGS
++		bool 'none'
++
++	config PAX_HAVE_ACL_FLAGS
++		bool 'direct'
++
++	config PAX_HOOK_ACL_FLAGS
++		bool 'hook'
++endchoice
++
++endmenu
++
++menu "Non-executable pages"
++	depends on PAX
++
++config PAX_NOEXEC
++	bool "Enforce non-executable pages"
++	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
++	help
++	  By design some architectures do not allow for protecting memory
++	  pages against execution or even if they do, Linux does not make
++	  use of this feature.  In practice this means that if a page is
++	  readable (such as the stack or heap) it is also executable.
++
++	  There is a well known exploit technique that makes use of this
++	  fact and a common programming mistake where an attacker can
++	  introduce code of his choice somewhere in the attacked program's
++	  memory (typically the stack or the heap) and then execute it.
++
++	  If the attacked program was running with different (typically
++	  higher) privileges than that of the attacker, then he can elevate
++	  his own privilege level (e.g. get a root shell, write to files for
++	  which he does not have write access to, etc).
++
++	  Enabling this option will let you choose from various features
++	  that prevent the injection and execution of 'foreign' code in
++	  a program.
++
++	  This will also break programs that rely on the old behaviour and
++	  expect that dynamically allocated memory via the malloc() family
++	  of functions is executable (which it is not).  Notable examples
++	  are the XFree86 4.x server, the java runtime and wine.
++
++config PAX_PAGEEXEC
++	bool "Paging based non-executable pages"
++	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
++	select S390_SWITCH_AMODE if S390
++	select S390_EXEC_PROTECT if S390
++	help
++	  This implementation is based on the paging feature of the CPU.
++	  On i386 without hardware non-executable bit support there is a
++	  variable but usually low performance impact, however on Intel's
++	  P4 core based CPUs it is very high so you should not enable this
++	  for kernels meant to be used on such CPUs.
++
++	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
++	  with hardware non-executable bit support there is no performance
++	  impact, on ppc the impact is negligible.
++
++	  Note that several architectures require various emulations due to
++	  badly designed userland ABIs, this will cause a performance impact
++	  but will disappear as soon as userland is fixed. For example, ppc
++	  userland MUST have been built with secure-plt by a recent toolchain.
++
++config PAX_SEGMEXEC
++	bool "Segmentation based non-executable pages"
++	depends on PAX_NOEXEC && X86_32
++	help
++	  This implementation is based on the segmentation feature of the
++	  CPU and has a very small performance impact, however applications
++	  will be limited to a 1.5 GB address space instead of the normal
++	  3 GB.
++
++config PAX_EMUTRAMP
++	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
++	default y if PARISC
++	help
++	  There are some programs and libraries that for one reason or
++	  another attempt to execute special small code snippets from
++	  non-executable memory pages.  Most notable examples are the
++	  signal handler return code generated by the kernel itself and
++	  the GCC trampolines.
++
++	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
++	  such programs will no longer work under your kernel.
++
++	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
++	  utilities to enable trampoline emulation for the affected programs
++	  yet still have the protection provided by the non-executable pages.
++
++	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
++	  your system will not even boot.
++
++	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
++	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
++	  for the affected files.
++
++	  NOTE: enabling this feature *may* open up a loophole in the
++	  protection provided by non-executable pages that an attacker
++	  could abuse.  Therefore the best solution is to not have any
++	  files on your system that would require this option.  This can
++	  be achieved by not using libc5 (which relies on the kernel
++	  signal handler return code) and not using or rewriting programs
++	  that make use of the nested function implementation of GCC.
++	  Skilled users can just fix GCC itself so that it implements
++	  nested function calls in a way that does not interfere with PaX.
++
++config PAX_EMUSIGRT
++	bool "Automatically emulate sigreturn trampolines"
++	depends on PAX_EMUTRAMP && PARISC
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate signal return trampolines executing on the stack
++	  that would otherwise lead to task termination.
++
++	  This solution is intended as a temporary one for users with
++	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
++	  Modula-3 runtime, etc) or executables linked to such, basically
++	  everything that does not specify its own SA_RESTORER function in
++	  normal executable memory like glibc 2.1+ does.
++
++	  On parisc you MUST enable this option, otherwise your system will
++	  not even boot.
++
++	  NOTE: this feature cannot be disabled on a per executable basis
++	  and since it *does* open up a loophole in the protection provided
++	  by non-executable pages, the best solution is to not have any
++	  files on your system that would require this option.
++
++config PAX_MPROTECT
++	bool "Restrict mprotect()"
++	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
++	help
++	  Enabling this option will prevent programs from
++	   - changing the executable status of memory pages that were
++	     not originally created as executable,
++	   - making read-only executable pages writable again,
++	   - creating executable pages from anonymous memory.
++
++	  You should say Y here to complete the protection provided by
++	  the enforcement of non-executable pages.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_NOELFRELOCS
++	bool "Disallow ELF text relocations"
++	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
++	help
++	  Non-executable pages and mprotect() restrictions are effective
++	  in preventing the introduction of new executable code into an
++	  attacked task's address space.  There remain only two venues
++	  for this kind of attack: if the attacker can execute already
++	  existing code in the attacked task then he can either have it
++	  create and mmap() a file containing his code or have it mmap()
++	  an already existing ELF library that does not have position
++	  independent code in it and use mprotect() on it to make it
++	  writable and copy his code there.  While protecting against
++	  the former approach is beyond PaX, the latter can be prevented
++	  by having only PIC ELF libraries on one's system (which do not
++	  need to relocate their code).  If you are sure this is your case,
++	  then enable this option otherwise be careful as you may not even
++	  be able to boot or log on your system (for example, some PAM
++	  modules are erroneously compiled as non-PIC by default).
++
++	  NOTE: if you are using dynamic ELF executables (as suggested
++	  when using ASLR) then you must have made sure that you linked
++	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
++	  referenced there has already been updated to support this).
++
++config PAX_ETEXECRELOCS
++	bool "Allow ELF ET_EXEC text relocations"
++	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
++	default y
++	help
++	  On some architectures there are incorrectly created applications
++	  that require text relocations and would not work without enabling
++	  this option.  If you are an alpha, ia64 or parisc user, you should
++	  enable this option and disable it once you have made sure that
++	  none of your applications need it.
++
++config PAX_EMUPLT
++	bool "Automatically emulate ELF PLT"
++	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate the Procedure Linkage Table entries in ELF files.
++	  On some architectures such entries are in writable memory, and
++	  become non-executable leading to task termination.  Therefore
++	  it is mandatory that you enable this option on alpha, parisc,
++	  sparc and sparc64, otherwise your system would not even boot.
++
++	  NOTE: this feature *does* open up a loophole in the protection
++	  provided by the non-executable pages, therefore the proper
++	  solution is to modify the toolchain to produce a PLT that does
++	  not need to be writable.
++
++config PAX_DLRESOLVE
++	bool 'Emulate old glibc resolver stub'
++	depends on PAX_EMUPLT && SPARC
++	default n
++	help
++	  This option is needed if userland has an old glibc (before 2.4)
++	  that puts a 'save' instruction into the runtime generated resolver
++	  stub that needs special emulation.
++
++config PAX_KERNEXEC
++	bool "Enforce non-executable kernel pages"
++	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
++	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
++	help
++	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
++	  that is, enabling this option will make it harder to inject
++	  and execute 'foreign' code in kernel memory itself.
++
++config PAX_KERNEXEC_MODULE_TEXT
++	int "Minimum amount of memory reserved for module code"
++	default "4"
++	depends on PAX_KERNEXEC && X86_32 && MODULES
++	help
++	  Due to implementation details the kernel must reserve a fixed
++	  amount of memory for module code at compile time that cannot be
++	  changed at runtime.  Here you can specify the minimum amount
++	  in MB that will be reserved.  Due to the same implementation
++	  details this size will always be rounded up to the next 2/4 MB
++	  boundary (depends on PAE) so the actually available memory for
++	  module code will usually be more than this minimum.
++
++	  The default 4 MB should be enough for most users but if you have
++	  an excessive number of modules (e.g., most distribution configs
++	  compile many drivers as modules) or use huge modules such as
++	  nvidia's kernel driver, you will need to adjust this amount.
++	  A good rule of thumb is to look at your currently loaded kernel
++	  modules and add up their sizes.
++
++endmenu
++
++menu "Address Space Layout Randomization"
++	depends on PAX
++
++config PAX_ASLR
++	bool "Address Space Layout Randomization"
++	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
++	help
++	  Many if not most exploit techniques rely on the knowledge of
++	  certain addresses in the attacked program.  The following options
++	  will allow the kernel to apply a certain amount of randomization
++	  to specific parts of the program thereby forcing an attacker to
++	  guess them in most cases.  Any failed guess will most likely crash
++	  the attacked program which allows the kernel to detect such attempts
++	  and react on them.  PaX itself provides no reaction mechanisms,
++	  instead it is strongly encouraged that you make use of Nergal's
++	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
++	  (http://www.grsecurity.net/) built-in crash detection features or
++	  develop one yourself.
++
++	  By saying Y here you can choose to randomize the following areas:
++	   - top of the task's kernel stack
++	   - top of the task's userland stack
++	   - base address for mmap() requests that do not specify one
++	     (this includes all libraries)
++	   - base address of the main executable
++
++	  It is strongly recommended to say Y here as address space layout
++	  randomization has negligible impact on performance yet it provides
++	  a very effective protection.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_RANDKSTACK
++	bool "Randomize kernel stack base"
++	depends on PAX_ASLR && X86_TSC && X86_32
++	help
++	  By saying Y here the kernel will randomize every task's kernel
++	  stack on every system call.  This will not only force an attacker
++	  to guess it but also prevent him from making use of possible
++	  leaked information about it.
++
++	  Since the kernel stack is a rather scarce resource, randomization
++	  may cause unexpected stack overflows, therefore you should very
++	  carefully test your system.  Note that once enabled in the kernel
++	  configuration, this feature cannot be disabled on a per file basis.
++
++config PAX_RANDUSTACK
++	bool "Randomize user stack base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will randomize every task's userland
++	  stack.  The randomization is done in two steps where the second
++	  one may apply a big amount of shift to the top of the stack and
++	  cause problems for programs that want to use lots of memory (more
++	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
++	  For this reason the second step can be controlled by 'chpax' or
++	  'paxctl' on a per file basis.
++
++config PAX_RANDMMAP
++	bool "Randomize mmap() base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will use a randomized base address for
++	  mmap() requests that do not specify one themselves.  As a result
++	  all dynamically loaded libraries will appear at random addresses
++	  and therefore be harder to exploit by a technique where an attacker
++	  attempts to execute library code for his purposes (e.g. spawn a
++	  shell from an exploited program that is running at an elevated
++	  privilege level).
++
++	  Furthermore, if a program is relinked as a dynamic ELF file, its
++	  base address will be randomized as well, completing the full
++	  randomization of the address space layout.  Attacking such programs
++	  becomes a guess game.  You can find an example of doing this at
++	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
++	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
++	  feature on a per file basis.
++
++endmenu
++
++menu "Miscellaneous hardening features"
++
++config PAX_MEMORY_SANITIZE
++	bool "Sanitize all freed memory"
++	help
++	  By saying Y here the kernel will erase memory pages as soon as they
++	  are freed.  This in turn reduces the lifetime of data stored in the
++	  pages, making it less likely that sensitive information such as
++	  passwords, cryptographic secrets, etc stay in memory for too long.
++
++	  This is especially useful for programs whose runtime is short, long
++	  lived processes and the kernel itself benefit from this as long as
++	  they operate on whole memory pages and ensure timely freeing of pages
++	  that may hold sensitive information.
++
++	  The tradeoff is performance impact, on a single CPU system kernel
++	  compilation sees a 3% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
++
++	  Note that this feature does not protect data stored in live pages,
++	  e.g., process memory swapped to disk may stay there for a long time.
++
++config PAX_MEMORY_UDEREF
++	bool "Prevent invalid userland pointer dereference"
++	depends on X86 && !UML_X86 && !XEN
++	select PAX_PER_CPU_PGD if X86_64
++	help
++	  By saying Y here the kernel will be prevented from dereferencing
++	  userland pointers in contexts where the kernel expects only kernel
++	  pointers.  This is both a useful runtime debugging feature and a
++	  security measure that prevents exploiting a class of kernel bugs.
++
++	  The tradeoff is that some virtualization solutions may experience
++	  a huge slowdown and therefore you should not enable this feature
++	  for kernels meant to run in such environments.  Whether a given VM
++	  solution is affected or not is best determined by simply trying it
++	  out, the performance impact will be obvious right on boot as this
++	  mechanism engages from very early on.  A good rule of thumb is that
++	  VMs running on CPUs without hardware virtualization support (i.e.,
++	  the majority of IA-32 CPUs) will likely experience the slowdown.
++
++config PAX_REFCOUNT
++	bool "Prevent various kernel object reference counter overflows"
++	depends on GRKERNSEC && (X86 || SPARC64)
++	help
++	  By saying Y here the kernel will detect and prevent overflowing
++	  various (but not all) kinds of object reference counters.  Such
++	  overflows can normally occur due to bugs only and are often, if
++	  not always, exploitable.
++
++	  The tradeoff is that data structures protected by an overflowed
++	  refcount will never be freed and therefore will leak memory.  Note
++	  that this leak also happens even without this protection but in
++	  that case the overflow can eventually trigger the freeing of the
++	  data structure while it is still being used elsewhere, resulting
++	  in the exploitable situation that this feature prevents.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++
++config PAX_USERCOPY
++	bool "Bounds check heap object copies between kernel and userland"
++	depends on X86 || PPC || SPARC
++	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++	help
++	  By saying Y here the kernel will enforce the size of heap objects
++	  when they are copied in either direction between the kernel and
++	  userland, even if only a part of the heap object is copied.
++
++	  Specifically, this checking prevents information leaking from the
++	  kernel heap during kernel to userland copies (if the kernel heap
++	  object is otherwise fully initialized) and prevents kernel heap
++	  overflows during userland to kernel copies.
++
++	  Note that the current implementation provides the strictest checks
++	  for the SLUB allocator.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++endmenu
++
++endmenu
++
+ config KEYS
+ 	bool "Enable access key retention support"
+ 	help
+@@ -146,7 +639,7 @@ config INTEL_TXT
+ config LSM_MMAP_MIN_ADDR
+ 	int "Low address space for LSM to protect from user allocation"
+ 	depends on SECURITY && SECURITY_SELINUX
+-	default 65536
++	default 32768
+ 	help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.12/security/min_addr.c linux-2.6.32.12/security/min_addr.c
+--- linux-2.6.32.12/security/min_addr.c	2010-04-04 20:41:50.084493253 -0400
++++ linux-2.6.32.12/security/min_addr.c	2010-04-04 20:46:41.732880788 -0400
+@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
+  */
+ static void update_mmap_min_addr(void)
+ {
++#ifndef SPARC
+ #ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ 		mmap_min_addr = dac_mmap_min_addr;
+@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
+ #else
+ 	mmap_min_addr = dac_mmap_min_addr;
+ #endif
++#endif
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.12/sound/aoa/codecs/onyx.c linux-2.6.32.12/sound/aoa/codecs/onyx.c
+--- linux-2.6.32.12/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/aoa/codecs/onyx.c	2010-04-04 20:46:41.732880788 -0400
+@@ -53,7 +53,7 @@ struct onyx {
+ 				spdif_locked:1,
+ 				analog_locked:1,
+ 				original_mute:2;
+-	int			open_count;
++	atomic_t		open_count;
+ 	struct codec_info	*codec_info;
+ 
+ 	/* mutex serializes concurrent access to the device
+@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count++;
++	atomic_inc(&onyx->open_count);
+ 	mutex_unlock(&onyx->mutex);
+ 
+ 	return 0;
+@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count--;
+-	if (!onyx->open_count)
++	if (atomic_dec_and_test(&onyx->open_count))
+ 		onyx->spdif_locked = onyx->analog_locked = 0;
+ 	mutex_unlock(&onyx->mutex);
+ 
+diff -urNp linux-2.6.32.12/sound/core/oss/pcm_oss.c linux-2.6.32.12/sound/core/oss/pcm_oss.c
+--- linux-2.6.32.12/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/core/oss/pcm_oss.c	2010-04-04 20:46:41.732880788 -0400
+@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
+ 	}
+ }
+ #else /* !CONFIG_SND_VERBOSE_PROCFS */
+-#define snd_pcm_oss_proc_init(pcm)
+-#define snd_pcm_oss_proc_done(pcm)
++#define snd_pcm_oss_proc_init(pcm) do {} while (0)
++#define snd_pcm_oss_proc_done(pcm) do {} while (0)
+ #endif /* CONFIG_SND_VERBOSE_PROCFS */
+ 
+ /*
+diff -urNp linux-2.6.32.12/sound/core/seq/seq_lock.h linux-2.6.32.12/sound/core/seq/seq_lock.h
+--- linux-2.6.32.12/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/core/seq/seq_lock.h	2010-04-04 20:46:41.732880788 -0400
+@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
+ #else /* SMP || CONFIG_SND_DEBUG */
+ 
+ typedef spinlock_t snd_use_lock_t;	/* dummy */
+-#define snd_use_lock_init(lockp) /**/
+-#define snd_use_lock_use(lockp) /**/
+-#define snd_use_lock_free(lockp) /**/
+-#define snd_use_lock_sync(lockp) /**/
++#define snd_use_lock_init(lockp) do {} while (0)
++#define snd_use_lock_use(lockp) do {} while (0)
++#define snd_use_lock_free(lockp) do {} while (0)
++#define snd_use_lock_sync(lockp) do {} while (0)
+ 
+ #endif /* SMP || CONFIG_SND_DEBUG */
+ 
+diff -urNp linux-2.6.32.12/sound/drivers/mts64.c linux-2.6.32.12/sound/drivers/mts64.c
+--- linux-2.6.32.12/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/drivers/mts64.c	2010-04-04 20:46:41.732880788 -0400
+@@ -65,7 +65,7 @@ struct mts64 {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int current_midi_output_port;
+ 	int current_midi_input_port;
+ 	u8 mode[MTS64_NUM_INPUT_PORTS];
+@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
+ {
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 
+-	if (mts->open_count == 0) {
++	if (atomic_read(&mts->open_count) == 0) {
+ 		/* We don't need a spinlock here, because this is just called 
+ 		   if the device has not been opened before. 
+ 		   So there aren't any IRQs from the device */
+@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
+ 
+ 		msleep(50);
+ 	}
+-	++(mts->open_count);
++	atomic_inc(&mts->open_count);
+ 
+ 	return 0;
+ }
+@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 	unsigned long flags;
+ 
+-	--(mts->open_count);
+-	if (mts->open_count == 0) {
++	if (atomic_dec_return(&mts->open_count) == 0) {
+ 		/* We need the spinlock_irqsave here because we can still
+ 		   have IRQs at this point */
+ 		spin_lock_irqsave(&mts->lock, flags);
+@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
+ 
+ 		msleep(500);
+ 
+-	} else if (mts->open_count < 0)
+-		mts->open_count = 0;
++	} else if (atomic_read(&mts->open_count) < 0)
++		atomic_set(&mts->open_count, 0);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.12/sound/drivers/portman2x4.c linux-2.6.32.12/sound/drivers/portman2x4.c
+--- linux-2.6.32.12/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/drivers/portman2x4.c	2010-04-04 20:46:41.732880788 -0400
+@@ -83,7 +83,7 @@ struct portman {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int mode[PORTMAN_NUM_INPUT_PORTS];
+ 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
+ };
+diff -urNp linux-2.6.32.12/sound/oss/sb_audio.c linux-2.6.32.12/sound/oss/sb_audio.c
+--- linux-2.6.32.12/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/oss/sb_audio.c	2010-04-04 20:46:41.732880788 -0400
+@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
+ 		buf16 = (signed short *)(localbuf + localoffs);
+ 		while (c)
+ 		{
+-			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
++			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+ 			if (copy_from_user(lbuf8,
+ 					   userbuf+useroffs + p,
+ 					   locallen))
+diff -urNp linux-2.6.32.12/sound/pci/ac97/ac97_codec.c linux-2.6.32.12/sound/pci/ac97/ac97_codec.c
+--- linux-2.6.32.12/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/pci/ac97/ac97_codec.c	2010-04-04 20:46:41.732880788 -0400
+@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
+ }
+ 
+ /* build_ops to do nothing */
+-static struct snd_ac97_build_ops null_build_ops;
++static const struct snd_ac97_build_ops null_build_ops;
+ 
+ #ifdef CONFIG_SND_AC97_POWER_SAVE
+ static void do_update_power(struct work_struct *work)
+diff -urNp linux-2.6.32.12/sound/pci/ac97/ac97_patch.c linux-2.6.32.12/sound/pci/ac97/ac97_patch.c
+--- linux-2.6.32.12/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
++++ linux-2.6.32.12/sound/pci/ac97/ac97_patch.c	2010-04-04 20:46:41.732880788 -0400
+@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
+ 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ };
+@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
+ };
+@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
+ 	.build_specific = patch_wolfson_wm9703_specific,
+ };
+ 
+@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
+ 	.build_specific = patch_wolfson_wm9704_specific,
+ };
+ 
+@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
+ 	.build_specific = patch_wolfson_wm9705_specific,
+ };
+ 
+@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
+ 	.build_specific = patch_wolfson_wm9711_specific,
+ };
+ 
+@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
+ }
+ #endif
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
+ 	.build_specific = patch_wolfson_wm9713_specific,
+ 	.build_3d = patch_wolfson_wm9713_3d,
+ #ifdef CONFIG_PM	
+@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac97xx_specific
+ };
+@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
+ 	return patch_sigmatel_stac97xx_specific(ac97);
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
+ 	.build_3d	= patch_sigmatel_stac9708_3d,
+ 	.build_specific	= patch_sigmatel_stac9708_specific
+ };
+@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac9758_specific
+ };
+@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_cirrus_ops = {
++static const struct snd_ac97_build_ops patch_cirrus_ops = {
+ 	.build_spdif = patch_cirrus_build_spdif
+ };
+ 
+@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_conexant_ops = {
++static const struct snd_ac97_build_ops patch_conexant_ops = {
+ 	.build_spdif = patch_conexant_build_spdif
+ };
+ 
+@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
+ 	{ AC97_VIDEO, 0x9f1f },
+ 	{ AC97_AUX, 0x9f1f },
+ 	{ AC97_PCM, 0x9f1f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_ad1819(struct snd_ac97 * ac97)
+@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
+ 	}
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1881_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+ #endif
+@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1885_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
+ 	.build_specific = &patch_ad1885_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1886_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
+ 	.build_specific = &patch_ad1886_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981a_specific,
+ #ifdef CONFIG_PM
+@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981b_specific,
+ #ifdef CONFIG_PM
+@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1888_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1888_specific,
+ #ifdef CONFIG_PM
+@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
+ 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1980_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1980_specific,
+ #ifdef CONFIG_PM
+@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1985_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1985_specific,
+ #ifdef CONFIG_PM
+@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1986_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1986_specific,
+ #ifdef CONFIG_PM
+@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc650_ops = {
++static const struct snd_ac97_build_ops patch_alc650_ops = {
+ 	.build_specific	= patch_alc650_specific,
+ 	.update_jacks = alc650_update_jacks
+ };
+@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc655_ops = {
++static const struct snd_ac97_build_ops patch_alc655_ops = {
+ 	.build_specific	= patch_alc655_specific,
+ 	.update_jacks = alc655_update_jacks
+ };
+@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc850_ops = {
++static const struct snd_ac97_build_ops patch_alc850_ops = {
+ 	.build_specific	= patch_alc850_specific,
+ 	.update_jacks = alc850_update_jacks
+ };
+@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9738_ops = {
++static const struct snd_ac97_build_ops patch_cm9738_ops = {
+ 	.build_specific	= patch_cm9738_specific,
+ 	.update_jacks = cm9738_update_jacks
+ };
+@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
+ 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9739_ops = {
++static const struct snd_ac97_build_ops patch_cm9739_ops = {
+ 	.build_specific	= patch_cm9739_specific,
+ 	.build_post_spdif = patch_cm9739_post_spdif,
+ 	.update_jacks = cm9739_update_jacks
+@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9761_ops = {
++static const struct snd_ac97_build_ops patch_cm9761_ops = {
+ 	.build_specific	= patch_cm9761_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif,
+ 	.update_jacks = cm9761_update_jacks
+@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
+ 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9780_ops = {
++static const struct snd_ac97_build_ops patch_cm9780_ops = {
+ 	.build_specific	= patch_cm9780_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
+ };
+@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_vt1616_ops = {
++static const struct snd_ac97_build_ops patch_vt1616_ops = {
+ 	.build_specific	= patch_vt1616_specific
+ };
+ 
+@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_it2646_ops = {
++static const struct snd_ac97_build_ops patch_it2646_ops = {
+ 	.build_specific	= patch_it2646_specific,
+ 	.update_jacks = it2646_update_jacks
+ };
+@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_si3036_ops = {
++static const struct snd_ac97_build_ops patch_si3036_ops = {
+ 	.build_specific	= patch_si3036_specific,
+ };
+ 
+@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
+ 	{ AC97_AUX, 0x1f1f },
+ 	{ AC97_PCM, 0x1f1f },
+ 	{ AC97_REC_GAIN, 0x0f0f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_lm4550(struct snd_ac97 *ac97)
+@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ucb1400_ops = {
++static const struct snd_ac97_build_ops patch_ucb1400_ops = {
+ 	.build_specific	= patch_ucb1400_specific,
+ };
+ 
+diff -urNp linux-2.6.32.12/sound/pci/ens1370.c linux-2.6.32.12/sound/pci/ens1370.c
+--- linux-2.6.32.12/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/pci/ens1370.c	2010-04-04 20:46:41.732880788 -0400
+@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
+ 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
+ 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
+diff -urNp linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c
+--- linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c	2010-04-29 17:46:37.441762570 -0400
+@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
+ 		cp_ready);
+ 
+ 	/* TODO */
+-	if (cp_state)
+-		;
+-	if (cp_ready)
+-		;
++	if (cp_state) {
++	}
++	if (cp_ready) {
++	}
+ }
+ 
+ 
+diff -urNp linux-2.6.32.12/sound/pci/intel8x0.c linux-2.6.32.12/sound/pci/intel8x0.c
+--- linux-2.6.32.12/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/pci/intel8x0.c	2010-04-04 20:46:41.732880788 -0400
+@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
+@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
+ 		.type = AC97_TUNE_HP_ONLY
+ 	},
+ #endif
+-	{ } /* terminator */
++	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
+ };
+ 
+ static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
+diff -urNp linux-2.6.32.12/sound/pci/intel8x0m.c linux-2.6.32.12/sound/pci/intel8x0m.c
+--- linux-2.6.32.12/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/sound/pci/intel8x0m.c	2010-04-04 20:46:41.737788480 -0400
+@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
+@@ -1264,7 +1264,7 @@ static struct shortname_table {
+ 	{ 0x5455, "ALi M5455" },
+ 	{ 0x746d, "AMD AMD8111" },
+ #endif
+-	{ 0 },
++	{ 0, NULL },
+ };
+ 
+ static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
+diff -urNp linux-2.6.32.12/usr/gen_init_cpio.c linux-2.6.32.12/usr/gen_init_cpio.c
+--- linux-2.6.32.12/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.12/usr/gen_init_cpio.c	2010-04-04 20:46:41.737788480 -0400
+@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
+ 	int retval;
+ 	int rc = -1;
+ 	int namesize;
+-	int i;
++	unsigned int i;
+ 
+ 	mode |= S_IFREG;
+ 
+@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
+                        *env_var = *expanded = '\0';
+                        strncat(env_var, start + 2, end - start - 2);
+                        strncat(expanded, new_location, start - new_location);
+-                       strncat(expanded, getenv(env_var), PATH_MAX);
+-                       strncat(expanded, end + 1, PATH_MAX);
++                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
++                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
+                        strncpy(new_location, expanded, PATH_MAX);
++                       new_location[PATH_MAX] = 0;
+                } else
+                        break;
+        }
+diff -urNp linux-2.6.32.12/virt/kvm/kvm_main.c linux-2.6.32.12/virt/kvm/kvm_main.c
+--- linux-2.6.32.12/virt/kvm/kvm_main.c	2010-04-29 17:49:38.869035092 -0400
++++ linux-2.6.32.12/virt/kvm/kvm_main.c	2010-04-29 17:49:58.805045845 -0400
+@@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vcpu_fops = {
+ 	.release        = kvm_vcpu_release,
+ 	.unlocked_ioctl = kvm_vcpu_ioctl,
+@@ -2344,6 +2345,7 @@ static int kvm_vm_mmap(struct file *file
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vm_fops = {
+ 	.release        = kvm_vm_release,
+ 	.unlocked_ioctl = kvm_vm_ioctl,
+@@ -2431,6 +2433,7 @@ out:
+ 	return r;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_chardev_ops = {
+ 	.unlocked_ioctl = kvm_dev_ioctl,
+ 	.compat_ioctl   = kvm_dev_ioctl,
+@@ -2440,6 +2443,9 @@ static struct miscdevice kvm_dev = {
+ 	KVM_MINOR,
+ 	"kvm",
+ 	&kvm_chardev_ops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static void hardware_enable(void *junk)
+@@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
+ 	kvm_arch_vcpu_put(vcpu);
+ }
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module)
+ {
+ 	int r;
-- 
cgit v1.2.3


From 9a9ef911b2ae45967c5a8d674e49074e0035c4af Mon Sep 17 00:00:00 2001
From: Ted Trask <ttrask01@yahoo.com>
Date: Mon, 3 May 2010 13:13:33 +0000
Subject: main/acf-weblog: upgrade to 0.5.5

---
 main/acf-weblog/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/acf-weblog/APKBUILD b/main/acf-weblog/APKBUILD
index ec2f111c..b0b3da27 100644
--- a/main/acf-weblog/APKBUILD
+++ b/main/acf-weblog/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Ted Trask <ttrask01@yahoo.com>
 # Maintainer: Ted Trask <ttrask01@yahoo.com>
 pkgname=acf-weblog
-pkgver=0.5.4
+pkgver=0.5.5
 pkgrel=0
 pkgdesc="ACF for web proxy (squid and dansguardian) logfiles"
 url="http://git.alpinelinux.org/cgit/acf-weblog"
@@ -17,4 +17,4 @@ build() {
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="8926a8178bf646363678bc9feacbc310  acf-weblog-0.5.4.tar.bz2"
+md5sums="c48ef4d8d9136f16de68129404ffb3ee  acf-weblog-0.5.5.tar.bz2"
-- 
cgit v1.2.3


From 3263802a847e849daad45ed0f15e7ed3f7cc166f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:48:00 +0000
Subject: main/libc0.9.32: new aport: uclibc with NPTL

---
 main/libc0.9.32/APKBUILD                 |  91 +++++++++++
 main/libc0.9.32/compat-stack-guard.patch |  51 ++++++
 main/libc0.9.32/uclibcconfig.i486        |   1 +
 main/libc0.9.32/uclibcconfig.x86         | 260 +++++++++++++++++++++++++++++++
 4 files changed, 403 insertions(+)
 create mode 100644 main/libc0.9.32/APKBUILD
 create mode 100644 main/libc0.9.32/compat-stack-guard.patch
 create mode 120000 main/libc0.9.32/uclibcconfig.i486
 create mode 100644 main/libc0.9.32/uclibcconfig.x86

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
new file mode 100644
index 00000000..4ec21af2
--- /dev/null
+++ b/main/libc0.9.32/APKBUILD
@@ -0,0 +1,91 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+_abiver=0.9.32
+pkgname=libc$_abiver
+_gitver=100427
+pkgver=${_abiver}_alpha0_git$_gitver
+pkgrel=0
+pkgdesc="C library for developing embedded Linux systems"
+url=http://uclibc.org
+license="LGPL-2"
+
+subpackages="uclibc-dev:dev uclibc-utils:utils"
+depends_dev="linux-headers=>2.6.32"
+#options="!strip"
+replaces=uclibc
+
+source="
+	http://git.uclibc.org/uClibc/snapshot/master.tar.bz2
+	compat-stack-guard.patch
+	uclibcconfig.x86
+	uclibcconfig.i486
+	"
+
+_config="$srcdir"/uclibcconfig.${ARCH:-x86}
+_builddir="$srcdir"/master
+
+snapshot() {
+	local _date=$(date +%y%m%d%H%M)
+	rm -f "$SRCDEST"/master.tar.bz2
+	pkgrel=0
+	sed -i -e "s/^_gitver=.*/_gitver=$(date +%y%m%d)/" \
+		-e "s/^pkgrel=.*/pkgrel=$pkgrel/" \
+		APKBUILD
+	checksum
+}
+
+prepare() {
+	local i
+	cd "$_builddir"
+	# patches goes here
+	for i in ../*.patch ../*.diff; do
+		[ -r "$i" ] || continue
+		msg "Applying $i..."
+		patch -p1 < $i || return 1
+	done
+	# set abi version and remove unsupported warnings c flag
+	sed -i -e "s/^ABI_VERSION.*/ABI_VERSION := $_abiver/" \
+		-e "s/-Wold-style-declaration//g" \
+		Rules.mak
+}
+
+build() {
+	local _kh=
+	cd "$_builddir"
+	if [ -n "$SYSROOT" ]; then
+		_kh=KERNEL_HEADERS="$SYSROOT/include"
+	fi
+	cp "$_config" .config
+	sleep 1
+	make silentoldconfig
+	make all KERNEL_HEADERS="$SYSROOT/usr/include"  CROSS="$CROSS" || return 1
+	make utils CROSS="$CROSS" || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" KERNEL_HEADERS="$SYSROOT/usr/include" \
+		CROSS="$CROSS" install install_utils
+	install -Dm755 extra/scripts/getent "$_p"/usr/bin/getent
+	# provided by linux-headers
+	rm -f "$_p"/usr/include/scsi/scsi.h
+}
+
+dev() {
+	default_dev
+	replaces=uclibc
+	mkdir "$subpkgdir"/usr/lib 
+	mv "$pkgdir"/usr/lib/*.so "$subpkgdir"/usr/lib/
+}
+
+utils() {
+	pkgdesc="uClibc utility programs"
+	replaces=uclibc
+	mkdir -p "$subpkgdir"/usr/bin "$subpkgdir"/sbin
+	mv "$pkgdir"/sbin/* "$subpkgdir"/sbin/
+	mv "$pkgdir"/usr/bin/* "$subpkgdir"/usr/bin/
+}
+
+md5sums="1189f8f739b1977a86b7afa8637e6827  master.tar.bz2
+4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
+791e2fc050cab523ce1c907ca39a2486  uclibcconfig.x86
+791e2fc050cab523ce1c907ca39a2486  uclibcconfig.i486"
diff --git a/main/libc0.9.32/compat-stack-guard.patch b/main/libc0.9.32/compat-stack-guard.patch
new file mode 100644
index 00000000..71d78bac
--- /dev/null
+++ b/main/libc0.9.32/compat-stack-guard.patch
@@ -0,0 +1,51 @@
+diff --git a/ldso/ldso/ldso.c b/ldso/ldso/ldso.c
+index 125cf96..bb47952 100644
+--- a/ldso/ldso/ldso.c
++++ b/ldso/ldso/ldso.c
+@@ -101,10 +101,10 @@ extern void _start(void);
+ #ifdef __UCLIBC_HAS_SSP__
+ # include <dl-osinfo.h>
+ uintptr_t stack_chk_guard;
++uintptr_t __stack_chk_guard attribute_relro;
+ # ifndef THREAD_SET_STACK_GUARD
+ /* Only exported for architectures that don't store the stack guard canary
+  * in local thread area.  */
+-uintptr_t __stack_chk_guard attribute_relro;
+ #  ifdef __UCLIBC_HAS_SSP_COMPAT__
+ strong_alias(__stack_chk_guard,__guard)
+ #  endif
+@@ -935,13 +935,12 @@ void _dl_get_ready_to_run(struct elf_resolve *tpnt, DL_LOADADDR_TYPE load_addr,
+ #ifdef __UCLIBC_HAS_SSP__
+ 	/* Set up the stack checker's canary.  */
+ 	stack_chk_guard = _dl_setup_stack_chk_guard ();
++	__stack_chk_guard = stack_chk_guard;
+ # ifdef THREAD_SET_STACK_GUARD
+ 	THREAD_SET_STACK_GUARD (stack_chk_guard);
+ #  ifdef __UCLIBC_HAS_SSP_COMPAT__
+ 	__guard = stack_chk_guard;
+ #  endif
+-# else
+-	__stack_chk_guard = stack_chk_guard;
+ # endif
+ #endif
+ 
+diff --git a/libc/misc/internals/__uClibc_main.c b/libc/misc/internals/__uClibc_main.c
+index f7e45c6..b527068 100644
+--- a/libc/misc/internals/__uClibc_main.c
++++ b/libc/misc/internals/__uClibc_main.c
+@@ -43,13 +43,13 @@ void *__libc_stack_end = NULL;
+ 
+ # ifdef __UCLIBC_HAS_SSP__
+ #  include <dl-osinfo.h>
++/* for gcc-4.1 non-TLS */
++uintptr_t __stack_chk_guard attribute_relro;
+ #  ifndef THREAD_SET_STACK_GUARD
+ /* Only exported for architectures that don't store the stack guard canary
+  * in thread local area. */
+ #   include <stdint.h>
+ uintptr_t stack_chk_guard;
+-/* for gcc-4.1 non-TLS */
+-uintptr_t __stack_chk_guard attribute_relro;
+ /* for gcc-3.x + Etoh ssp */
+ #   ifdef __UCLIBC_HAS_SSP_COMPAT__
+ #    ifdef __HAVE_SHARED__
diff --git a/main/libc0.9.32/uclibcconfig.i486 b/main/libc0.9.32/uclibcconfig.i486
new file mode 120000
index 00000000..6ab0f7e5
--- /dev/null
+++ b/main/libc0.9.32/uclibcconfig.i486
@@ -0,0 +1 @@
+uclibcconfig.x86
\ No newline at end of file
diff --git a/main/libc0.9.32/uclibcconfig.x86 b/main/libc0.9.32/uclibcconfig.x86
new file mode 100644
index 00000000..be5cfbb5
--- /dev/null
+++ b/main/libc0.9.32/uclibcconfig.x86
@@ -0,0 +1,260 @@
+#
+# Automatically generated make config: don't edit
+# Version: 0.9.32-git
+# Tue May  4 07:38:19 2010
+#
+# TARGET_alpha is not set
+# TARGET_arm is not set
+# TARGET_avr32 is not set
+# TARGET_bfin is not set
+# TARGET_cris is not set
+# TARGET_e1 is not set
+# TARGET_frv is not set
+# TARGET_h8300 is not set
+# TARGET_hppa is not set
+TARGET_i386=y
+# TARGET_i960 is not set
+# TARGET_ia64 is not set
+# TARGET_m68k is not set
+# TARGET_microblaze is not set
+# TARGET_mips is not set
+# TARGET_nios is not set
+# TARGET_nios2 is not set
+# TARGET_powerpc is not set
+# TARGET_sh is not set
+# TARGET_sh64 is not set
+# TARGET_sparc is not set
+# TARGET_v850 is not set
+# TARGET_vax is not set
+# TARGET_x86_64 is not set
+# TARGET_xtensa is not set
+
+#
+# Target Architecture Features and Options
+#
+TARGET_ARCH="i386"
+FORCE_OPTIONS_FOR_ARCH=y
+# CONFIG_GENERIC_386 is not set
+# CONFIG_386 is not set
+CONFIG_486=y
+# CONFIG_586 is not set
+# CONFIG_586MMX is not set
+# CONFIG_686 is not set
+# CONFIG_PENTIUMII is not set
+# CONFIG_PENTIUMIII is not set
+# CONFIG_PENTIUM4 is not set
+# CONFIG_K6 is not set
+# CONFIG_K7 is not set
+# CONFIG_ELAN is not set
+# CONFIG_CRUSOE is not set
+# CONFIG_WINCHIPC6 is not set
+# CONFIG_WINCHIP2 is not set
+# CONFIG_CYRIXIII is not set
+# CONFIG_NEHEMIAH is not set
+TARGET_SUBARCH=""
+
+#
+# Using ELF file format
+#
+ARCH_LITTLE_ENDIAN=y
+
+#
+# Using Little Endian
+#
+ARCH_HAS_MMU=y
+ARCH_USE_MMU=y
+UCLIBC_HAS_FLOATS=y
+UCLIBC_HAS_FPU=y
+DO_C99_MATH=y
+DO_XSI_MATH=y
+UCLIBC_HAS_FENV=y
+UCLIBC_HAS_LONG_DOUBLE_MATH=y
+KERNEL_HEADERS="/usr/include"
+HAVE_DOT_CONFIG=y
+
+#
+# General Library Settings
+#
+# HAVE_NO_PIC is not set
+DOPIC=y
+# ARCH_HAS_NO_SHARED is not set
+# ARCH_HAS_NO_LDSO is not set
+HAVE_SHARED=y
+FORCE_SHAREABLE_TEXT_SEGMENTS=y
+LDSO_LDD_SUPPORT=y
+LDSO_CACHE_SUPPORT=y
+LDSO_PRELOAD_ENV_SUPPORT=y
+# LDSO_PRELOAD_FILE_SUPPORT is not set
+LDSO_BASE_FILENAME="ld.so"
+UCLIBC_STATIC_LDCONFIG=y
+LDSO_RUNPATH=y
+LDSO_SEARCH_INTERP_PATH=y
+UCLIBC_CTOR_DTOR=y
+# LDSO_GNU_HASH_SUPPORT is not set
+# HAS_NO_THREADS is not set
+# LINUXTHREADS_OLD is not set
+# LINUXTHREADS_NEW is not set
+UCLIBC_HAS_THREADS_NATIVE=y
+UCLIBC_HAS_THREADS=y
+UCLIBC_HAS_TLS=y
+# PTHREADS_DEBUG_SUPPORT is not set
+UCLIBC_HAS_SYSLOG=y
+UCLIBC_HAS_LFS=y
+# MALLOC is not set
+# MALLOC_SIMPLE is not set
+MALLOC_STANDARD=y
+MALLOC_GLIBC_COMPAT=y
+UCLIBC_DYNAMIC_ATEXIT=y
+COMPAT_ATEXIT=y
+UCLIBC_SUSV3_LEGACY=y
+UCLIBC_SUSV3_LEGACY_MACROS=y
+UCLIBC_SUSV4_LEGACY=y
+# UCLIBC_HAS_STUBS is not set
+UCLIBC_HAS_SHADOW=y
+UCLIBC_HAS_PROGRAM_INVOCATION_NAME=y
+UCLIBC_HAS___PROGNAME=y
+UCLIBC_HAS_PTY=y
+ASSUME_DEVPTS=y
+UNIX98PTY_ONLY=y
+# UCLIBC_HAS_GETPT is not set
+UCLIBC_HAS_LIBUTIL=y
+UCLIBC_HAS_TM_EXTENSIONS=y
+UCLIBC_HAS_TZ_CACHING=y
+UCLIBC_HAS_TZ_FILE=y
+UCLIBC_HAS_TZ_FILE_READ_MANY=y
+UCLIBC_TZ_FILE_PATH="/etc/TZ"
+
+#
+# Advanced Library Settings
+#
+UCLIBC_PWD_BUFFER_SIZE=256
+UCLIBC_GRP_BUFFER_SIZE=256
+
+#
+# Support various families of functions
+#
+UCLIBC_LINUX_MODULE_24=y
+UCLIBC_LINUX_SPECIFIC=y
+UCLIBC_HAS_GNU_ERROR=y
+UCLIBC_BSD_SPECIFIC=y
+UCLIBC_HAS_BSD_ERR=y
+UCLIBC_HAS_OBSOLETE_BSD_SIGNAL=y
+UCLIBC_HAS_OBSOLETE_SYSV_SIGNAL=y
+# UCLIBC_NTP_LEGACY is not set
+UCLIBC_SV4_DEPRECATED=y
+UCLIBC_HAS_REALTIME=y
+UCLIBC_HAS_ADVANCED_REALTIME=y
+UCLIBC_HAS_EPOLL=y
+UCLIBC_HAS_XATTR=y
+UCLIBC_HAS_PROFILING=y
+UCLIBC_HAS_CRYPT_IMPL=y
+UCLIBC_HAS_CRYPT=y
+UCLIBC_HAS_NETWORK_SUPPORT=y
+UCLIBC_HAS_SOCKET=y
+UCLIBC_HAS_IPV4=y
+UCLIBC_HAS_IPV6=y
+UCLIBC_HAS_RPC=y
+UCLIBC_HAS_FULL_RPC=y
+UCLIBC_HAS_REENTRANT_RPC=y
+UCLIBC_USE_NETLINK=y
+UCLIBC_SUPPORT_AI_ADDRCONFIG=y
+UCLIBC_HAS_BSD_RES_CLOSE=y
+UCLIBC_HAS_COMPAT_RES_STATE=y
+# UCLIBC_HAS_EXTRA_COMPAT_RES_STATE is not set
+UCLIBC_HAS_LIBRESOLV_STUB=y
+# UCLIBC_HAS_LIBNSL_STUB is not set
+
+#
+# String and Stdio Support
+#
+UCLIBC_HAS_STRING_GENERIC_OPT=y
+UCLIBC_HAS_STRING_ARCH_OPT=y
+UCLIBC_HAS_CTYPE_TABLES=y
+UCLIBC_HAS_CTYPE_SIGNED=y
+# UCLIBC_HAS_CTYPE_UNSAFE is not set
+UCLIBC_HAS_CTYPE_CHECKED=y
+# UCLIBC_HAS_CTYPE_ENFORCED is not set
+UCLIBC_HAS_WCHAR=y
+# UCLIBC_HAS_LOCALE is not set
+UCLIBC_HAS_HEXADECIMAL_FLOATS=y
+UCLIBC_HAS_GLIBC_CUSTOM_PRINTF=y
+UCLIBC_PRINTF_SCANF_POSITIONAL_ARGS=9
+# UCLIBC_HAS_SCANF_GLIBC_A_FLAG is not set
+# UCLIBC_HAS_STDIO_BUFSIZ_NONE is not set
+# UCLIBC_HAS_STDIO_BUFSIZ_256 is not set
+# UCLIBC_HAS_STDIO_BUFSIZ_512 is not set
+# UCLIBC_HAS_STDIO_BUFSIZ_1024 is not set
+# UCLIBC_HAS_STDIO_BUFSIZ_2048 is not set
+UCLIBC_HAS_STDIO_BUFSIZ_4096=y
+# UCLIBC_HAS_STDIO_BUFSIZ_8192 is not set
+UCLIBC_HAS_STDIO_BUILTIN_BUFFER_NONE=y
+# UCLIBC_HAS_STDIO_BUILTIN_BUFFER_4 is not set
+# UCLIBC_HAS_STDIO_BUILTIN_BUFFER_8 is not set
+# UCLIBC_HAS_STDIO_SHUTDOWN_ON_ABORT is not set
+UCLIBC_HAS_STDIO_GETC_MACRO=y
+UCLIBC_HAS_STDIO_PUTC_MACRO=y
+UCLIBC_HAS_STDIO_AUTO_RW_TRANSITION=y
+# UCLIBC_HAS_FOPEN_LARGEFILE_MODE is not set
+UCLIBC_HAS_FOPEN_EXCLUSIVE_MODE=y
+UCLIBC_HAS_GLIBC_CUSTOM_STREAMS=y
+UCLIBC_HAS_PRINTF_M_SPEC=y
+UCLIBC_HAS_ERRNO_MESSAGES=y
+# UCLIBC_HAS_SYS_ERRLIST is not set
+UCLIBC_HAS_SIGNUM_MESSAGES=y
+# UCLIBC_HAS_SYS_SIGLIST is not set
+UCLIBC_HAS_GNU_GETOPT=y
+UCLIBC_HAS_STDIO_FUTEXES=y
+UCLIBC_HAS_GNU_GETSUBOPT=y
+
+#
+# Big and Tall
+#
+UCLIBC_HAS_REGEX=y
+UCLIBC_HAS_REGEX_OLD=y
+UCLIBC_HAS_FNMATCH=y
+# UCLIBC_HAS_FNMATCH_OLD is not set
+UCLIBC_HAS_WORDEXP=y
+UCLIBC_HAS_NFTW=y
+UCLIBC_HAS_FTW=y
+UCLIBC_HAS_GLOB=y
+UCLIBC_HAS_GNU_GLOB=y
+
+#
+# Library Installation Options
+#
+RUNTIME_PREFIX="/"
+DEVEL_PREFIX="/usr"
+MULTILIB_DIR="lib"
+# HARDWIRED_ABSPATH is not set
+
+#
+# Security options
+#
+UCLIBC_BUILD_PIE=y
+UCLIBC_HAS_ARC4RANDOM=y
+# HAVE_NO_SSP is not set
+UCLIBC_HAS_SSP=y
+UCLIBC_HAS_SSP_COMPAT=y
+# SSP_QUICK_CANARY is not set
+# PROPOLICE_BLOCK_ABRT is not set
+PROPOLICE_BLOCK_SEGV=y
+# UCLIBC_BUILD_SSP is not set
+UCLIBC_BUILD_RELRO=y
+UCLIBC_BUILD_NOW=y
+UCLIBC_BUILD_NOEXECSTACK=y
+
+#
+# uClibc development/debugging options
+#
+CROSS_COMPILER_PREFIX=""
+UCLIBC_EXTRA_CFLAGS=""
+# DODEBUG is not set
+DOSTRIP=y
+# DOASSERTS is not set
+# SUPPORT_LD_DEBUG is not set
+# SUPPORT_LD_DEBUG_EARLY is not set
+# UCLIBC_MALLOC_DEBUGGING is not set
+WARNINGS="-Wall"
+EXTRA_WARNINGS=y
+# DOMULTI is not set
+# UCLIBC_MJN3_ONLY is not set
-- 
cgit v1.2.3


From bc01c2255ceaa46b89fcd16b4a249995fe082a9b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:49:11 +0000
Subject: main/uclibc: removed. replaced with libc0.9.32

---
 .../uclibc/0001-Add-dn_skipname-from-OpenBSD.patch | 115 ----------
 ...r32-add-varargs-handling-of-prctl-syscall.patch |  74 -------
 main/uclibc/0001-ldd-segfault-fix.patch            |  49 ----
 ...ke-use-of-macros-from-sys-asm.h-in-crt1.S.patch |  87 --------
 ...0003-rpc-fix-typo-in-version-mismatch-msg.patch |  26 ---
 .../uclibc/0004-fix-make-install_-host-utils.patch | 158 -------------
 .../uclibc/0005-host-utils-depend-on-headers.patch |  35 ---
 ...statat-fix-up-behavior-on-32-64-bit-hosts.patch | 113 ----------
 ...-Unbreak-build-for-sparc-on-some-config-s.patch |  42 ----
 ...race-condition-and-other-bugs-in-the-no-m.patch |  89 --------
 main/uclibc/0009-libm-enable-log2f-and-exp2f.patch |  70 ------
 main/uclibc/APKBUILD                               |  88 --------
 main/uclibc/pthread-new-aliasing-fix.diff          | 147 ------------
 .../uclibc-0.9.30.1-pthread_getattr_np.patch       | 137 ------------
 main/uclibc/uclibc-0.9.30.1-resolv.patch           |  13 --
 main/uclibc/uclibc-fork-hidden.diff                | 115 ----------
 main/uclibc/uclibc-fork-hook.diff                  |  36 ---
 main/uclibc/uclibc-i386-floating-stacks.diff       |  23 --
 main/uclibc/uclibc-linuxthreads-init-stdio.patch   |  21 --
 main/uclibc/uclibc-resolv-cname-fix.diff           |  16 --
 main/uclibc/uclibcconfig.x86                       | 246 ---------------------
 21 files changed, 1700 deletions(-)
 delete mode 100644 main/uclibc/0001-Add-dn_skipname-from-OpenBSD.patch
 delete mode 100644 main/uclibc/0001-avr32-add-varargs-handling-of-prctl-syscall.patch
 delete mode 100644 main/uclibc/0001-ldd-segfault-fix.patch
 delete mode 100644 main/uclibc/0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch
 delete mode 100644 main/uclibc/0003-rpc-fix-typo-in-version-mismatch-msg.patch
 delete mode 100644 main/uclibc/0004-fix-make-install_-host-utils.patch
 delete mode 100644 main/uclibc/0005-host-utils-depend-on-headers.patch
 delete mode 100644 main/uclibc/0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch
 delete mode 100644 main/uclibc/0007-Unbreak-build-for-sparc-on-some-config-s.patch
 delete mode 100644 main/uclibc/0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch
 delete mode 100644 main/uclibc/0009-libm-enable-log2f-and-exp2f.patch
 delete mode 100644 main/uclibc/APKBUILD
 delete mode 100644 main/uclibc/pthread-new-aliasing-fix.diff
 delete mode 100644 main/uclibc/uclibc-0.9.30.1-pthread_getattr_np.patch
 delete mode 100644 main/uclibc/uclibc-0.9.30.1-resolv.patch
 delete mode 100644 main/uclibc/uclibc-fork-hidden.diff
 delete mode 100644 main/uclibc/uclibc-fork-hook.diff
 delete mode 100644 main/uclibc/uclibc-i386-floating-stacks.diff
 delete mode 100644 main/uclibc/uclibc-linuxthreads-init-stdio.patch
 delete mode 100644 main/uclibc/uclibc-resolv-cname-fix.diff
 delete mode 100644 main/uclibc/uclibcconfig.x86

diff --git a/main/uclibc/0001-Add-dn_skipname-from-OpenBSD.patch b/main/uclibc/0001-Add-dn_skipname-from-OpenBSD.patch
deleted file mode 100644
index 6dd7b17c..00000000
--- a/main/uclibc/0001-Add-dn_skipname-from-OpenBSD.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From ab443685d9f923afcdfb9fbb071a293b53aa3c40 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <natanael.copa@gmail.com>
-Date: Sun, 13 Sep 2009 09:53:09 +0000
-Subject: [PATCH] Add dn_skipname() from OpenBSD
-
-dn_skipname() is needed by a few applications like yate, wine, kde and
-probably more.
----
- libresolv/resolv.c |   85 ++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 files changed, 85 insertions(+), 0 deletions(-)
-
-diff --git a/libresolv/resolv.c b/libresolv/resolv.c
-index 38b10ff..c55046d 100644
---- a/libresolv/resolv.c
-+++ b/libresolv/resolv.c
-@@ -7,7 +7,9 @@
-  * Licensed under the LGPL v2.1, see the file COPYING.LIB in this tarball.
-  */
- 
-+#include <sys/types.h>
- #include <features.h>
-+#include <resolv.h>
- 
- void __stub1(void);
- void __stub1(void)
-@@ -16,3 +18,86 @@ void __stub1(void)
- }
- link_warning (__stub1, "the `libresolv' library is a stub.  Do you really need it?")
- 
-+/* taken from OpenBSD source */
-+/*
-+ * ++Copyright++ 1985, 1993
-+ * -
-+ * Copyright (c) 1985, 1993
-+ *    The Regents of the University of California.  All rights reserved.
-+ * 
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. Neither the name of the University nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ * 
-+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ * -
-+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
-+ * 
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies, and that
-+ * the name of Digital Equipment Corporation not be used in advertising or
-+ * publicity pertaining to distribution of the document or software without
-+ * specific, written prior permission.
-+ * 
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
-+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
-+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
-+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
-+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
-+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
-+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
-+ * SOFTWARE.
-+ * -
-+ * --Copyright--
-+ */
-+
-+/*
-+ * Skip over a compressed domain name. Return the size or -1.
-+ */
-+int
-+__dn_skipname(const u_char *comp_dn, const u_char *eom)
-+{
-+	const u_char *cp;
-+	int n;
-+
-+	cp = comp_dn;
-+	while (cp < eom && (n = *cp++)) {
-+		/*
-+		 * check for indirection
-+		 */
-+		switch (n & INDIR_MASK) {
-+		case 0:			/* normal case, n == len */
-+			cp += n;
-+			continue;
-+		case INDIR_MASK:	/* indirection */
-+			cp++;
-+			break;
-+		default:		/* illegal type */
-+			return (-1);
-+		}
-+		break;
-+	}
-+	if (cp > eom)
-+		return (-1);
-+	return (cp - comp_dn);
-+}
-+
--- 
-1.6.4.2
-
diff --git a/main/uclibc/0001-avr32-add-varargs-handling-of-prctl-syscall.patch b/main/uclibc/0001-avr32-add-varargs-handling-of-prctl-syscall.patch
deleted file mode 100644
index 79676958..00000000
--- a/main/uclibc/0001-avr32-add-varargs-handling-of-prctl-syscall.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 85bc04d5436ca6c8a30a1ad28862260a04b8b3d5 Mon Sep 17 00:00:00 2001
-From: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
-Date: Wed, 16 Dec 2009 13:16:08 +0100
-Subject: [PATCH 1/9] avr32: add varargs handling of prctl syscall
-
-prctl is defined to use varargs in the header file, hence it needs varargs
-specific handling in the source. This patch properly handles the variodic
-argument before the syscall is passed to the kernel for the AVR32 architecture.
-
-Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
----
- libc/sysdeps/linux/avr32/Makefile.arch |    2 +-
- libc/sysdeps/linux/avr32/prctl.c       |   36 ++++++++++++++++++++++++++++++++
- 2 files changed, 37 insertions(+), 1 deletions(-)
- create mode 100644 libc/sysdeps/linux/avr32/prctl.c
-
-diff --git a/libc/sysdeps/linux/avr32/Makefile.arch b/libc/sysdeps/linux/avr32/Makefile.arch
-index bc5f625..98b85a7 100644
---- a/libc/sysdeps/linux/avr32/Makefile.arch
-+++ b/libc/sysdeps/linux/avr32/Makefile.arch
-@@ -5,7 +5,7 @@
- # Licensed under the LGPL v2.1, see the file COPYING.LIB in this tarball.
- #
- 
--CSRC	:= brk.c clone.c mmap.c sigaction.c
-+CSRC	:= brk.c clone.c mmap.c prctl.c sigaction.c
- 
- SSRC	:= __longjmp.S setjmp.S bsd-setjmp.S bsd-_setjmp.S	\
- 		sigrestorer.S syscall.S vfork.S
-diff --git a/libc/sysdeps/linux/avr32/prctl.c b/libc/sysdeps/linux/avr32/prctl.c
-new file mode 100644
-index 0000000..4e146e3
---- /dev/null
-+++ b/libc/sysdeps/linux/avr32/prctl.c
-@@ -0,0 +1,36 @@
-+/*
-+ * prctl syscall for AVR32 Linux.
-+ *
-+ * Copyright (C) 2010 Atmel Corporation
-+ *
-+ * This file is subject to the terms and conditions of the GNU Lesser General
-+ * Public License. See the file "COPYING.LIB" in the main directory of this
-+ * archive for more details.
-+ */
-+#include <sys/syscall.h>
-+#include <sys/prctl.h>
-+#include <stdarg.h>
-+
-+#ifdef __NR_prctl
-+#define __NR___syscall_prctl	__NR_prctl
-+static inline _syscall5(int, __syscall_prctl, int, option, long, arg2,
-+		long, arg3, long, arg4, long, arg5);
-+
-+int prctl(int __option, ...)
-+{
-+	long arg2;
-+	long arg3;
-+	long arg4;
-+	long arg5;
-+	va_list ap;
-+
-+	va_start(ap, __option);
-+	arg2 = va_arg(ap, long);
-+	arg3 = va_arg(ap, long);
-+	arg4 = va_arg(ap, long);
-+	arg5 = va_arg(ap, long);
-+	va_end(ap);
-+
-+	return INLINE_SYSCALL(prctl, 5, __option, arg2, arg3, arg4, arg5);
-+}
-+#endif
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0001-ldd-segfault-fix.patch b/main/uclibc/0001-ldd-segfault-fix.patch
deleted file mode 100644
index 4384fa54..00000000
--- a/main/uclibc/0001-ldd-segfault-fix.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From f29b6882327573ec4e694c1c852307c957d544b9 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Tue, 5 May 2009 14:10:42 +0000
-Subject: [PATCH] ldd segfault fix
-
-Fixes ldd segfault on this testcase:
-
-extern void _dl_getenv(void);
-void foo(void)
-{
-	printf("foo: %x\n", &_dl_getenv);
-}
-
-linked as -shared
----
- utils/ldd.c |    8 +++++---
- 1 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/utils/ldd.c b/utils/ldd.c
-index 1f1dc25..2cd173c 100644
---- a/utils/ldd.c
-+++ b/utils/ldd.c
-@@ -576,18 +576,20 @@ static struct library *find_elf_interpreter(ElfW(Ehdr) *ehdr)
- 				}
- 				newlib->name = NULL;
- 				newlib->path = NULL;
--				return NULL;
-+				break;
- 			}
- 		}
--		if (newlib == NULL)
-+		if (newlib == NULL) {
- 			newlib = malloc(sizeof(struct library));
-+			if (newlib)
-+				newlib->next = NULL;
-+		}
- 		if (!newlib)
- 			return NULL;
- 		newlib->name = malloc(strlen(s) + 1);
- 		strcpy(newlib->name, s);
- 		newlib->path = strdup(newlib->name);
- 		newlib->resolved = 1;
--		newlib->next = NULL;
- 
- #if 0
- 		/*printf("find_elf_interpreter is adding '%s' to '%s'\n", newlib->name, newlib->path); */
--- 
-1.6.2.3
-
diff --git a/main/uclibc/0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch b/main/uclibc/0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch
deleted file mode 100644
index 9f04a3ae..00000000
--- a/main/uclibc/0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 2911103dd4a03bbd3aad11eddfce524a5c9ba9b3 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Fri, 22 Jan 2010 13:00:20 +0100
-Subject: [PATCH 2/9] Make use of macros from sys/asm.h in crt1.S
-
-Needed for mips nptl to boot once again.
-(cherry picked from commit 9c343fd4030dcd7a52616f365893177dded50346)
-
-Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
----
- libc/sysdeps/linux/mips/crt1.S |   46 +++++++++++----------------------------
- 1 files changed, 13 insertions(+), 33 deletions(-)
-
-diff --git a/libc/sysdeps/linux/mips/crt1.S b/libc/sysdeps/linux/mips/crt1.S
-index e851d52..6a80412 100644
---- a/libc/sysdeps/linux/mips/crt1.S
-+++ b/libc/sysdeps/linux/mips/crt1.S
-@@ -85,29 +85,10 @@
- 
- __start:
- #ifdef __PIC__
--#if _MIPS_SIM == _MIPS_SIM_ABI32
--	.frame	sp, 24, sp
--        .set noreorder
--	move $0, $31		/* Save old ra.  */
--	bal 10f			/* Find addr of cpload.  */
--        nop
--10:
--	.cpload $31
--	move $31, $0
--	.set reorder
--	.cprestore 16
--#else
--	move $0, $31; /* Save old ra.  */
--	.set noreorder
--	bal 10f /* Find addr of .cpsetup.  */
--	nop
--10:
--	.set reorder
--	.cpsetup $31, $25, 10b
--	move $31, $0
--#endif
-+	SETUP_GPX($0)
-+	SETUP_GPX64($25,$0)
- #else
--	la $28, _gp             /* Setup GP correctly if we're non-PIC.  */
-+	PTR_LA $28, _gp             /* Setup GP correctly if we're non-PIC.  */
- 	move $31, $0
- #endif
- 
-@@ -118,18 +99,18 @@ __start:
- 	/* Allocate space on the stack for seven arguments and
- 	 * make sure the stack is aligned to double words (8 bytes) */
- 
-+	and $29, -2 * SZREG
-+
- #if _MIPS_SIM == _MIPS_SIM_ABI32
--	and $29, -2 * 4
--	subu $29, 32
--	la $7, _init		/* init */
--	la $8, _fini
--	sw $8, 16($29)		/* fini */
--	sw $2, 20($29)		/* rtld_fini */
--	sw $29, 24($29)		/* stack_end */
--#else
--	and $29, -2 * PTRSIZE
-+	PTR_SUBIU $29, 32
-+#endif
- 	PTR_LA $7, _init		/* init */
--	PTR_LA $8, _fini		/* fini */
-+	PTR_LA $8, _fini
-+#if _MIPS_SIM == _MIPS_SIM_ABI32
-+	PTR_S $8, 16($29)		/* fini */
-+	PTR_S $2, 20($29)		/* rtld_fini */
-+	PTR_S $29, 24($29)		/* stack_end */
-+#else
- 	move $9, $2		/* rtld_fini */
- 	move $10, $29		/* stack_end */
- #endif
-@@ -148,4 +129,3 @@ __data_start:
- 	.weak data_start
- 	data_start = __data_start
- 
--
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0003-rpc-fix-typo-in-version-mismatch-msg.patch b/main/uclibc/0003-rpc-fix-typo-in-version-mismatch-msg.patch
deleted file mode 100644
index cb0826c6..00000000
--- a/main/uclibc/0003-rpc-fix-typo-in-version-mismatch-msg.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 83a09cd5c9ed9afd87a7d1d17319c2fd2203ad0f Mon Sep 17 00:00:00 2001
-From: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
-Date: Thu, 21 Jan 2010 10:36:13 +0100
-Subject: [PATCH 3/9] rpc: fix typo in version mismatch msg
-
-Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
----
- libc/inet/rpc/rpc_prot.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/libc/inet/rpc/rpc_prot.c b/libc/inet/rpc/rpc_prot.c
-index 74658e6..229f988 100644
---- a/libc/inet/rpc/rpc_prot.c
-+++ b/libc/inet/rpc/rpc_prot.c
-@@ -229,7 +229,7 @@ rejected (enum reject_stat rjct_stat,
- {
-   switch (rjct_stat)
-     {
--    case RPC_VERSMISMATCH:
-+    case RPC_MISMATCH:
-       error->re_status = RPC_VERSMISMATCH;
-       return;
-     case AUTH_ERROR:
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0004-fix-make-install_-host-utils.patch b/main/uclibc/0004-fix-make-install_-host-utils.patch
deleted file mode 100644
index f5a5a958..00000000
--- a/main/uclibc/0004-fix-make-install_-host-utils.patch
+++ /dev/null
@@ -1,158 +0,0 @@
-From d75ad2e129b3f22296cead3db53c784527deab60 Mon Sep 17 00:00:00 2001
-From: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
-Date: Fri, 18 Sep 2009 16:07:31 +0200
-Subject: [PATCH 4/9] fix make {,install_}{,host}utils
-
-Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
----
- extra/locale/programs/locale.c |    3 +-
- libc/misc/wchar/wchar.c        |   88 +++++++++++++++++++++-------------------
- 2 files changed, 47 insertions(+), 44 deletions(-)
-
-diff --git a/extra/locale/programs/locale.c b/extra/locale/programs/locale.c
-index 462a579..dfd2029 100644
---- a/extra/locale/programs/locale.c
-+++ b/extra/locale/programs/locale.c
-@@ -10,10 +10,9 @@
-  *
-  */
- 
--
-+#include <string.h>
- #include <stdio.h>
- #include <stdlib.h>
--#include <string.h>
- #include <langinfo.h>
- #include <unistd.h>
- #ifdef __UCLIBC_HAS_GETOPT_LONG__
-diff --git a/libc/misc/wchar/wchar.c b/libc/misc/wchar/wchar.c
-index 290e680..3ce884d 100644
---- a/libc/misc/wchar/wchar.c
-+++ b/libc/misc/wchar/wchar.c
-@@ -171,7 +171,6 @@ extern size_t _wchar_utf8sntowcs(wchar_t *__restrict pwc, size_t wn,
- 
- extern size_t _wchar_wcsntoutf8s(char *__restrict s, size_t n,
- 					const wchar_t **__restrict src, size_t wn) attribute_hidden;
--
- #endif /* _LIBC */
- /**********************************************************************/
- #ifdef L_btowc
-@@ -1201,45 +1200,6 @@ typedef struct {
- 	int skip_invalid_input;		/* To support iconv -c option. */
- } _UC_iconv_t;
- 
--
--
--#ifdef L_iconv
--
--#include <iconv.h>
--#include <string.h>
--#include <endian.h>
--#include <byteswap.h>
--
--#if (__BYTE_ORDER != __BIG_ENDIAN) && (__BYTE_ORDER != __LITTLE_ENDIAN)
--#error unsupported endianness for iconv
--#endif
--
--#ifndef __CTYPE_HAS_8_BIT_LOCALES
--#error currently iconv requires 8 bit locales
--#endif
--#ifndef __CTYPE_HAS_UTF_8_LOCALES
--#error currently iconv requires UTF-8 locales
--#endif
--
--
--enum {
--	IC_WCHAR_T = 0xe0,
--	IC_MULTIBYTE = 0xe0,
--#if __BYTE_ORDER == __BIG_ENDIAN
--	IC_UCS_4 =	0xec,
--	IC_UTF_32 = 0xe4,
--	IC_UCS_2 =	0xe2,
--	IC_UTF_16 = 0xea,
--#else
--	IC_UCS_4 =	0xed,
--	IC_UTF_32 = 0xe5,
--	IC_UCS_2 =	0xe3,
--	IC_UTF_16 = 0xeb,
--#endif
--	IC_UTF_8 = 2,
--	IC_ASCII = 1
--};
--
- /* For the multibyte
-  * bit 0 means swap endian
-  * bit 1 means 2 byte
-@@ -1247,8 +1207,13 @@ enum {
-  *
-  */
- 
-+#if defined L_iconv && defined _LIBC
-+/* Used externally only by iconv utility */
- extern const unsigned char __iconv_codesets[];
- libc_hidden_proto(__iconv_codesets)
-+#endif
-+
-+#if defined L_iconv || defined L_iconv_main
- const unsigned char __iconv_codesets[] =
- 	"\x0a\xe0""WCHAR_T\x00"		/* superset of UCS-4 but platform-endian */
- #if __BYTE_ORDER == __BIG_ENDIAN
-@@ -1281,7 +1246,48 @@ const unsigned char __iconv_codesets[] =
- 	"\x08\x02""UTF-8\x00"
- 	"\x0b\x01""US-ASCII\x00"
- 	"\x07\x01""ASCII";			/* Must be last! (special case to save a nul) */
-+#endif
-+#if defined L_iconv && defined _LIBC
- libc_hidden_data_def(__iconv_codesets)
-+#endif
-+
-+
-+#ifdef L_iconv
-+
-+#include <iconv.h>
-+#include <string.h>
-+#include <endian.h>
-+#include <byteswap.h>
-+
-+#if (__BYTE_ORDER != __BIG_ENDIAN) && (__BYTE_ORDER != __LITTLE_ENDIAN)
-+#error unsupported endianness for iconv
-+#endif
-+
-+#ifndef __CTYPE_HAS_8_BIT_LOCALES
-+#error currently iconv requires 8 bit locales
-+#endif
-+#ifndef __CTYPE_HAS_UTF_8_LOCALES
-+#error currently iconv requires UTF-8 locales
-+#endif
-+
-+
-+enum {
-+	IC_WCHAR_T = 0xe0,
-+	IC_MULTIBYTE = 0xe0,
-+#if __BYTE_ORDER == __BIG_ENDIAN
-+	IC_UCS_4 =	0xec,
-+	IC_UTF_32 = 0xe4,
-+	IC_UCS_2 =	0xe2,
-+	IC_UTF_16 = 0xea,
-+#else
-+	IC_UCS_4 =	0xed,
-+	IC_UTF_32 = 0xe5,
-+	IC_UCS_2 =	0xe3,
-+	IC_UTF_16 = 0xeb,
-+#endif
-+	IC_UTF_8 = 2,
-+	IC_ASCII = 1
-+};
- 
- /* Experimentally off - libc_hidden_proto(strcasecmp) */
- 
-@@ -1575,6 +1581,4 @@ size_t weak_function iconv(iconv_t cd, char **__restrict inbuf,
- 	}
- 	return nrcount;
- }
--
- #endif
--
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0005-host-utils-depend-on-headers.patch b/main/uclibc/0005-host-utils-depend-on-headers.patch
deleted file mode 100644
index 3a368926..00000000
--- a/main/uclibc/0005-host-utils-depend-on-headers.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 47e88c04e01299f975ff23f33035d0f34a8f6787 Mon Sep 17 00:00:00 2001
-From: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
-Date: Fri, 22 Jan 2010 13:32:44 +0100
-Subject: [PATCH 5/9] {,host}utils depend on headers
-
-Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
----
- Makefile.in |    4 ++--
- 1 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile.in b/Makefile.in
-index 4c5aecb..ec4c28e 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -436,7 +436,7 @@ ifeq ($(HAVE_SHARED),y)
- 	fi
- endif
- 
--utils:
-+utils: headers
- 	$(Q)$(MAKE) CROSS="$(CROSS)" CC="$(CC)" -C utils $@
- 
- # Installs helper applications, such as 'ldd' and 'ldconfig'
-@@ -445,7 +445,7 @@ install_utils: utils
- 
- endif # ifeq ($(HAVE_DOT_CONFIG),y)
- 
--hostutils:
-+hostutils: headers
- 	$(Q)$(MAKE) CROSS="$(CROSS)" CC="$(CC)" HOSTCC="$(HOSTCC)" DOTHOST=.host -C utils $@
- 
- install_hostutils: hostutils
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch b/main/uclibc/0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch
deleted file mode 100644
index 51564405..00000000
--- a/main/uclibc/0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From d43f068e84513ed88392df4ca27d49ad01145fd2 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sun, 6 Sep 2009 12:12:12 -0400
-Subject: [PATCH 6/9] fstatat: fix up behavior on 32/64 bit hosts
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The fstatat() syscall is a little funky in that it sometimes changes name
-between 32 and 64 bit hosts, but it should always operate on a 64bit stat
-structure.  So for the fstatat() function, make sure we convert it from a
-64bit kstat to a 32bit stat.
-
-Along these lines, we need to restore the __xstat32_conv() function.
-
-Reported-by: Timo Teräs <timo.teras@iki.fi>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
-Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
----
- libc/sysdeps/linux/common/fstatat.c   |    9 +++++++--
- libc/sysdeps/linux/common/fstatat64.c |    5 +++++
- libc/sysdeps/linux/common/xstatconv.c |   19 +++++++++++++++++++
- libc/sysdeps/linux/common/xstatconv.h |    1 +
- 4 files changed, 32 insertions(+), 2 deletions(-)
-
-diff --git a/libc/sysdeps/linux/common/fstatat.c b/libc/sysdeps/linux/common/fstatat.c
-index 149c189..33daa7c 100644
---- a/libc/sysdeps/linux/common/fstatat.c
-+++ b/libc/sysdeps/linux/common/fstatat.c
-@@ -10,15 +10,20 @@
- #include <sys/stat.h>
- #include "xstatconv.h"
- 
-+/* 64bit ports tend to favor newfstatat() */
-+#ifdef __NR_newfstatat
-+# define __NR_fstatat64 __NR_newfstatat
-+#endif
-+
- #ifdef __NR_fstatat64
- int fstatat(int fd, const char *file, struct stat *buf, int flag)
- {
- 	int ret;
--	struct kernel_stat kbuf;
-+	struct kernel_stat64 kbuf;
- 
- 	ret = INLINE_SYSCALL(fstatat64, 4, fd, file, &kbuf, flag);
- 	if (ret == 0)
--		__xstat_conv(&kbuf, buf);
-+		__xstat32_conv(&kbuf, buf);
- 
- 	return ret;
- }
-diff --git a/libc/sysdeps/linux/common/fstatat64.c b/libc/sysdeps/linux/common/fstatat64.c
-index 5ae1fad..95627af 100644
---- a/libc/sysdeps/linux/common/fstatat64.c
-+++ b/libc/sysdeps/linux/common/fstatat64.c
-@@ -12,6 +12,11 @@
- 
- #ifdef __UCLIBC_HAS_LFS__
- 
-+/* 64bit ports tend to favor newfstatat() */
-+#ifdef __NR_newfstatat
-+# define __NR_fstatat64 __NR_newfstatat
-+#endif
-+
- #ifdef __NR_fstatat64
- int fstatat64(int fd, const char *file, struct stat64 *buf, int flag)
- {
-diff --git a/libc/sysdeps/linux/common/xstatconv.c b/libc/sysdeps/linux/common/xstatconv.c
-index e575b26..50455c6 100644
---- a/libc/sysdeps/linux/common/xstatconv.c
-+++ b/libc/sysdeps/linux/common/xstatconv.c
-@@ -46,6 +46,25 @@ void attribute_hidden __xstat_conv(struct kernel_stat *kbuf, struct stat *buf)
- 	buf->st_ctim = kbuf->st_ctim;
- }
- 
-+void __xstat32_conv(struct kernel_stat64 *kbuf, struct stat *buf)
-+{
-+	/* Convert to current kernel version of `struct stat64'. */
-+	memset(buf, 0x00, sizeof(*buf));
-+	buf->st_dev = kbuf->st_dev;
-+	buf->st_ino = kbuf->st_ino;
-+	buf->st_mode = kbuf->st_mode;
-+	buf->st_nlink = kbuf->st_nlink;
-+	buf->st_uid = kbuf->st_uid;
-+	buf->st_gid = kbuf->st_gid;
-+	buf->st_rdev = kbuf->st_rdev;
-+	buf->st_size = kbuf->st_size;
-+	buf->st_blksize = kbuf->st_blksize;
-+	buf->st_blocks = kbuf->st_blocks;
-+	buf->st_atim = kbuf->st_atim;
-+	buf->st_mtim = kbuf->st_mtim;
-+	buf->st_ctim = kbuf->st_ctim;
-+}
-+
- #ifdef __UCLIBC_HAS_LFS__
- 
- void attribute_hidden __xstat64_conv(struct kernel_stat64 *kbuf, struct stat64 *buf)
-diff --git a/libc/sysdeps/linux/common/xstatconv.h b/libc/sysdeps/linux/common/xstatconv.h
-index 57c8bcb..7568da8 100644
---- a/libc/sysdeps/linux/common/xstatconv.h
-+++ b/libc/sysdeps/linux/common/xstatconv.h
-@@ -26,6 +26,7 @@
- #include <bits/kernel_stat.h>
- 
- extern void __xstat_conv(struct kernel_stat *kbuf, struct stat *buf) attribute_hidden;
-+extern void __xstat32_conv(struct kernel_stat64 *kbuf, struct stat *buf) attribute_hidden;
- #if defined __UCLIBC_HAS_LFS__
- extern void __xstat64_conv(struct kernel_stat64 *kbuf, struct stat64 *buf) attribute_hidden;
- #endif
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0007-Unbreak-build-for-sparc-on-some-config-s.patch b/main/uclibc/0007-Unbreak-build-for-sparc-on-some-config-s.patch
deleted file mode 100644
index 1d86d585..00000000
--- a/main/uclibc/0007-Unbreak-build-for-sparc-on-some-config-s.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 7b964170536951a260f7d552db99b428d1ea5026 Mon Sep 17 00:00:00 2001
-From: Austin Foxley <austinf@cetoncorp.com>
-Date: Wed, 3 Feb 2010 12:12:10 -0800
-Subject: [PATCH 7/9] Unbreak build for sparc on some config's
-
-Thanks to rob@landley.net
-
-Signed-off-by: Austin Foxley <austinf@cetoncorp.com>
----
- libc/sysdeps/linux/sparc/sigaction.c |    9 ++++-----
- 1 files changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/libc/sysdeps/linux/sparc/sigaction.c b/libc/sysdeps/linux/sparc/sigaction.c
-index a22ac40..7140fd3 100644
---- a/libc/sysdeps/linux/sparc/sigaction.c
-+++ b/libc/sysdeps/linux/sparc/sigaction.c
-@@ -34,7 +34,8 @@ _syscall5(int, rt_sigaction, int, a, int, b, int, c, int, d, int, e);
- static void __rt_sigreturn_stub(void);
- static void __sigreturn_stub(void);
- 
--int __libc_sigaction(int sig, const struct sigaction *act, struct sigaction *oact)
-+libc_hidden_proto(sigaction)
-+int sigaction(int sig, const struct sigaction *act, struct sigaction *oact)
- {
- 	int ret;
- 	struct sigaction kact, koact;
-@@ -65,10 +66,8 @@ int __libc_sigaction(int sig, const struct sigaction *act, struct sigaction *oac
- 	return ret;
- }
- 
--#ifndef LIBC_SIGACTION
--weak_alias(__libc_sigaction,sigaction)
--libc_hidden_weak(sigaction)
--#endif
-+libc_hidden_def(sigaction)
-+weak_alias(sigaction,__libc_sigaction)
- 
- static void
- __rt_sigreturn_stub(void)
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch b/main/uclibc/0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch
deleted file mode 100644
index 48e8427d..00000000
--- a/main/uclibc/0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From fa476d01f1c1990a92ee49d1f1c557b83805d0e9 Mon Sep 17 00:00:00 2001
-From: Freeman Wang <xwang@ubicom.com>
-Date: Sat, 19 Dec 2009 13:43:00 -0800
-Subject: [PATCH 8/9] malloc: fix race condition and other bugs in the no-mmu malloc
-
-Fixes multiple race conditions on mmb list. This was done by
-making the mmb_heap_lock into a recursive lock and making the
-regular heap_lock extend to cover the mmb heap handling.
-
-Also move the new_mmb allocation up to before the mmb list is
-iterated through to find the insertion point. When the mmb_heap
-also runs out and needs to be extended when the regular heap is
-just extended, the mmb list could be messed up.
-
-Signed-off-by: Freeman Wang <xwang@ubicom.com>
-Signed-off-by: Austin Foxley <austinf@cetoncorp.com>
----
- libc/stdlib/malloc/free.c   |    6 +++---
- libc/stdlib/malloc/malloc.c |    7 ++++---
- 2 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/libc/stdlib/malloc/free.c b/libc/stdlib/malloc/free.c
-index 90e18f4..741248a 100644
---- a/libc/stdlib/malloc/free.c
-+++ b/libc/stdlib/malloc/free.c
-@@ -179,14 +179,14 @@ __free_to_heap (void *mem, struct heap_free_area **heap
- 	      /* Start searching again from the end of this block.  */
- 	      start = mmb_end;
- 
-+	      /* Release the descriptor block we used.  */
-+	      free_to_heap (mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock);
-+
- 	      /* We have to unlock the heap before we recurse to free the mmb
- 		 descriptor, because we might be unmapping from the mmb
- 		 heap.  */
-               __heap_unlock (heap_lock);
- 
--	      /* Release the descriptor block we used.  */
--	      free_to_heap (mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock);
--
- 	      /* Do the actual munmap.  */
- 	      munmap ((void *)mmb_start, mmb_end - mmb_start);
- 
-diff --git a/libc/stdlib/malloc/malloc.c b/libc/stdlib/malloc/malloc.c
-index 71f9e58..84a6acd 100644
---- a/libc/stdlib/malloc/malloc.c
-+++ b/libc/stdlib/malloc/malloc.c
-@@ -48,7 +48,7 @@ struct malloc_mmb *__malloc_mmapped_blocks = 0;
- HEAP_DECLARE_STATIC_FREE_AREA (initial_mmb_fa, 48); /* enough for 3 mmbs */
- struct heap_free_area *__malloc_mmb_heap = HEAP_INIT_WITH_FA (initial_mmb_fa);
- #ifdef HEAP_USE_LOCKING
--pthread_mutex_t __malloc_mmb_heap_lock = PTHREAD_MUTEX_INITIALIZER;
-+pthread_mutex_t __malloc_mmb_heap_lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
- #endif
- #endif /* __UCLIBC_UCLINUX_BROKEN_MUNMAP__ */
- 
-@@ -151,19 +151,19 @@ __malloc_from_heap (size_t size, struct heap_free_area **heap
- 	  /* Try again to allocate.  */
- 	  mem = __heap_alloc (heap, &size);
- 
--	  __heap_unlock (heap_lock);
- 
- #if !defined(MALLOC_USE_SBRK) && defined(__UCLIBC_UCLINUX_BROKEN_MUNMAP__)
- 	  /* Insert a record of BLOCK in sorted order into the
- 	     __malloc_mmapped_blocks list.  */
- 
-+	  new_mmb = malloc_from_heap (sizeof *new_mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock);
-+
- 	  for (prev_mmb = 0, mmb = __malloc_mmapped_blocks;
- 	       mmb;
- 	       prev_mmb = mmb, mmb = mmb->next)
- 	    if (block < mmb->mem)
- 	      break;
- 
--	  new_mmb = malloc_from_heap (sizeof *new_mmb, &__malloc_mmb_heap, &__malloc_mmb_heap_lock);
- 	  new_mmb->next = mmb;
- 	  new_mmb->mem = block;
- 	  new_mmb->size = block_size;
-@@ -177,6 +177,7 @@ __malloc_from_heap (size_t size, struct heap_free_area **heap
- 			    (unsigned)new_mmb,
- 			    (unsigned)new_mmb->mem, block_size);
- #endif /* !MALLOC_USE_SBRK && __UCLIBC_UCLINUX_BROKEN_MUNMAP__ */
-+	  __heap_unlock (heap_lock);
- 	}
-     }
- 
--- 
-1.6.6.1
-
diff --git a/main/uclibc/0009-libm-enable-log2f-and-exp2f.patch b/main/uclibc/0009-libm-enable-log2f-and-exp2f.patch
deleted file mode 100644
index 88e13e32..00000000
--- a/main/uclibc/0009-libm-enable-log2f-and-exp2f.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 956a0087e282e53ba9c085dbbc469391f7234944 Mon Sep 17 00:00:00 2001
-From: Aurelien Jacobs <aurel@gnuage.org>
-Date: Thu, 4 Feb 2010 09:31:40 -0800
-Subject: [PATCH 9/9] libm: enable log2f and exp2f
-
-Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
-Signed-off-by: Austin Foxley <austinf@cetoncorp.com>
----
- libm/float_wrappers.c    |    4 ++--
- test/math/compile_test.c |    4 ++--
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/libm/float_wrappers.c b/libm/float_wrappers.c
-index dc315e7..b7317a1 100644
---- a/libm/float_wrappers.c
-+++ b/libm/float_wrappers.c
-@@ -15,12 +15,10 @@
- 
- /* For the time being, do _NOT_ implement these functions
-  * that are defined by SuSv3 */
--#undef L_exp2f         /*float       exp2f(float);*/
- #undef L_fdimf         /*float       fdimf(float, float);*/
- #undef L_fmaf          /*float       fmaf(float, float, float);*/
- #undef L_fmaxf         /*float       fmaxf(float, float);*/
- #undef L_fminf         /*float       fminf(float, float);*/
--#undef L_log2f         /*float       log2f(float);*/
- #undef L_nearbyintf    /*float       nearbyintf(float);*/
- #undef L_nexttowardf   /*float       nexttowardf(float, long double);*/
- #undef L_remquof       /*float       remquof(float, float, int *);*/
-@@ -43,6 +41,7 @@ float       cosf(float);
- float       coshf(float);
- float       erfcf(float);
- float       erff(float);
-+float       exp2f(float);
- float       expf(float);
- float       expm1f(float);
- float       fabsf(float);
-@@ -56,6 +55,7 @@ float       lgammaf(float);
- long long   llroundf(float);
- float       log10f(float);
- float       log1pf(float);
-+float       log2f(float);
- float       logbf(float);
- float       logf(float);
- long        lroundf(float);
-diff --git a/test/math/compile_test.c b/test/math/compile_test.c
-index 9990520..ee5e2e3 100644
---- a/test/math/compile_test.c
-+++ b/test/math/compile_test.c
-@@ -18,7 +18,7 @@ r += cosf(float_x);
- r += coshf(float_x);
- r += erfcf(float_x);
- r += erff(float_x);
--/*r += exp2f(float_x); - uclibc does not have it (yet?) */
-+r += exp2f(float_x);
- r += expf(float_x);
- r += expm1f(float_x);
- r += fabsf(float_x);
-@@ -38,7 +38,7 @@ r += llrintf(float_x);
- r += llroundf(float_x);
- r += log10f(float_x);
- r += log1pf(float_x);
--/*r += log2f(float_x); - uclibc does not have it (yet?) */
-+r += log2f(float_x);
- r += logbf(float_x);
- r += logf(float_x);
- r += lrintf(float_x);
--- 
-1.6.6.1
-
diff --git a/main/uclibc/APKBUILD b/main/uclibc/APKBUILD
deleted file mode 100644
index 72b5648b..00000000
--- a/main/uclibc/APKBUILD
+++ /dev/null
@@ -1,88 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=uclibc
-pkgver=0.9.30.2
-pkgrel=2
-pkgdesc="C library for developing embedded Linux systems"
-url=http://uclibc.org
-license="LGPL-2"
-_mynamever=uClibc-$pkgver
-
-subpackages="$pkgname-dev"
-depends_dev="linux-headers=>2.6.32"
-
-source="http://uclibc.org/downloads/$_mynamever.tar.bz2
-	$pkgname-0.9.30.1-resolv.patch
-	uclibc-0.9.30.1-pthread_getattr_np.patch
-	0001-Add-dn_skipname-from-OpenBSD.patch
-	0001-ldd-segfault-fix.patch
-
-	0001-avr32-add-varargs-handling-of-prctl-syscall.patch
-	0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch
-	0003-rpc-fix-typo-in-version-mismatch-msg.patch
-	0004-fix-make-install_-host-utils.patch
-	0005-host-utils-depend-on-headers.patch
-	0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch
-	0007-Unbreak-build-for-sparc-on-some-config-s.patch
-	0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch
-	0009-libm-enable-log2f-and-exp2f.patch
-
-	uclibc-linuxthreads-init-stdio.patch
-	pthread-new-aliasing-fix.diff
-	uclibc-resolv-cname-fix.diff
-	uclibc-i386-floating-stacks.diff
-	uclibc-fork-hidden.diff
-	uclibc-fork-hook.diff
-	uclibcconfig.x86
-	"
-
-_config="$srcdir"/uclibcconfig.${ARCH:-x86}
-
-
-prepare() {
-	local i gcc_major
-	cd "$srcdir/$_mynamever/"
-	# patches goes here
-	for i in ../*.patch ../*.diff; do
-		msg "Applying $i..."
-		patch -p1 < $i || return 1
-	done
-}
-
-build() {
-	cd "$srcdir/$_mynamever/"
-	cp "$_config" .config
-	make silentoldconfig
-	# this is a hack to get uclibc-i386-floating-stacks.diff working
-	touch libc/sysdeps/linux/i386/sysdep.h
-	make || return 1
-}
-
-package() {
-	cd "$srcdir/$_mynamever/"
-	make install DESTDIR="$pkgdir" install_utils
-	install -Dm755 extra/scripts/getent "$pkgdir"/usr/bin/getent
-	# provided by linux-headers
-	rm -f "$pkgdir"/usr/include/scsi/scsi.h
-}
-
-md5sums="e759ec855500082ac3e671dd6cacfdb0  uClibc-0.9.30.2.tar.bz2
-ea91460617601b6e084ead66bc3948f5  uclibc-0.9.30.1-resolv.patch
-cf80c0d44a41e02f389be427ee615d61  uclibc-0.9.30.1-pthread_getattr_np.patch
-c9e3df01e854db4b1118266acd9bcfbd  0001-Add-dn_skipname-from-OpenBSD.patch
-4079b20c763727863bc53408e4988434  0001-ldd-segfault-fix.patch
-fe69ee3a487605b40cd7e6edadedbc45  0001-avr32-add-varargs-handling-of-prctl-syscall.patch
-045d4e110e512493fbc2040fd6a6d5c4  0002-Make-use-of-macros-from-sys-asm.h-in-crt1.S.patch
-e23edaf402ae29650205b3337b2f9ec2  0003-rpc-fix-typo-in-version-mismatch-msg.patch
-afbeb89d1fd086cec5cfbc10cc011b7a  0004-fix-make-install_-host-utils.patch
-41796dd355bc56526991410647d854f4  0005-host-utils-depend-on-headers.patch
-c78e19855a8a83f07855fe82ceaf9d21  0006-fstatat-fix-up-behavior-on-32-64-bit-hosts.patch
-d20abc16e2ce8579f77e42271008ff07  0007-Unbreak-build-for-sparc-on-some-config-s.patch
-2438e999b21cfaf823139df05d06dd33  0008-malloc-fix-race-condition-and-other-bugs-in-the-no-m.patch
-0b2ed68cbd2e4bb2941155bdb1f0f9b0  0009-libm-enable-log2f-and-exp2f.patch
-152bd508303e110e660fa7935411b6df  uclibc-linuxthreads-init-stdio.patch
-969187e1da84d0a0a5957b392a3d5a2b  pthread-new-aliasing-fix.diff
-bbb8475963e791f596c34c81ef5583d7  uclibc-resolv-cname-fix.diff
-ccf15714e089306c09d74a1a5c3cc670  uclibc-i386-floating-stacks.diff
-220260c979eca4558827d0e7ec8aa8b6  uclibc-fork-hidden.diff
-55bb709f5efd937df323f0d39a202cfd  uclibc-fork-hook.diff
-36b28777f4c49af39268920fbade41b1  uclibcconfig.x86"
diff --git a/main/uclibc/pthread-new-aliasing-fix.diff b/main/uclibc/pthread-new-aliasing-fix.diff
deleted file mode 100644
index 2b2b3772..00000000
--- a/main/uclibc/pthread-new-aliasing-fix.diff
+++ /dev/null
@@ -1,147 +0,0 @@
-diff --git a/libpthread/linuxthreads/cancel.c b/libpthread/linuxthreads/cancel.c
-index 3435680..1412b57 100644
---- a/libpthread/linuxthreads/cancel.c
-+++ b/libpthread/linuxthreads/cancel.c
-@@ -152,8 +152,8 @@ void pthread_testcancel(void)
-     __pthread_do_exit(PTHREAD_CANCELED, CURRENT_STACK_FRAME);
- }
- 
--void _pthread_cleanup_push(struct _pthread_cleanup_buffer * buffer,
--			   void (*routine)(void *), void * arg)
-+void __pthread_cleanup_push(struct _pthread_cleanup_buffer * buffer,
-+			    void (*routine)(void *), void * arg)
- {
-   pthread_descr self = thread_self();
-   buffer->__routine = routine;
-@@ -163,17 +163,19 @@ void _pthread_cleanup_push(struct _pthread_cleanup_buffer * buffer,
-     buffer->__prev = NULL;
-   THREAD_SETMEM(self, p_cleanup, buffer);
- }
-+strong_alias(__pthread_cleanup_push, _pthread_cleanup_push);
- 
--void _pthread_cleanup_pop(struct _pthread_cleanup_buffer * buffer,
--			  int execute)
-+void __pthread_cleanup_pop(struct _pthread_cleanup_buffer * buffer,
-+			   int execute)
- {
-   pthread_descr self = thread_self();
-   if (execute) buffer->__routine(buffer->__arg);
-   THREAD_SETMEM(self, p_cleanup, buffer->__prev);
- }
-+strong_alias(__pthread_cleanup_pop, _pthread_cleanup_pop);
- 
--void _pthread_cleanup_push_defer(struct _pthread_cleanup_buffer * buffer,
--				 void (*routine)(void *), void * arg)
-+void __pthread_cleanup_push_defer(struct _pthread_cleanup_buffer * buffer,
-+				  void (*routine)(void *), void * arg)
- {
-   pthread_descr self = thread_self();
-   buffer->__routine = routine;
-@@ -185,9 +187,10 @@ void _pthread_cleanup_push_defer(struct _pthread_cleanup_buffer * buffer,
-   THREAD_SETMEM(self, p_canceltype, PTHREAD_CANCEL_DEFERRED);
-   THREAD_SETMEM(self, p_cleanup, buffer);
- }
-+strong_alias(__pthread_cleanup_push_defer, _pthread_cleanup_push_defer);
- 
--void _pthread_cleanup_pop_restore(struct _pthread_cleanup_buffer * buffer,
--				  int execute)
-+void __pthread_cleanup_pop_restore(struct _pthread_cleanup_buffer * buffer,
-+				   int execute)
- {
-   pthread_descr self = thread_self();
-   if (execute) buffer->__routine(buffer->__arg);
-@@ -198,6 +201,7 @@ void _pthread_cleanup_pop_restore(struct _pthread_cleanup_buffer * buffer,
-       THREAD_GETMEM(self, p_canceltype) == PTHREAD_CANCEL_ASYNCHRONOUS)
-     __pthread_do_exit(PTHREAD_CANCELED, CURRENT_STACK_FRAME);
- }
-+strong_alias(__pthread_cleanup_pop_restore, _pthread_cleanup_pop_restore);
- 
- extern void __rpc_thread_destroy(void);
- void __pthread_perform_cleanup(char *currentframe)
-diff --git a/libpthread/linuxthreads/forward.c b/libpthread/linuxthreads/forward.c
-index f9f8ea1..385e79f 100644
---- a/libpthread/linuxthreads/forward.c
-+++ b/libpthread/linuxthreads/forward.c
-@@ -24,6 +24,10 @@
- /* psm: keep this before internals.h */
- /* libc_hidden_proto(exit) */
- 
-+#define hidden_strong_alias(name, aliasname) \
-+  extern __typeof (name) aliasname __attribute__ ((alias (#name), \
-+                                                   visibility ("hidden")));
-+
- #include "internals.h"
- 
- /* Pointers to the libc functions.  */
-@@ -104,8 +108,7 @@ FORWARD (pthread_equal, (pthread_t thread1, pthread_t thread2),
- 
- /* Use an alias to avoid warning, as pthread_exit is declared noreturn.  */
- FORWARD2 (__pthread_exit, void, (void *retval), (retval), exit (EXIT_SUCCESS))
--strong_alias (__pthread_exit, pthread_exit)
--
-+hidden_strong_alias (__pthread_exit, pthread_exit)
- 
- FORWARD (pthread_getschedparam,
- 	 (pthread_t target_thread, int *policy, struct sched_param *param),
-@@ -120,16 +123,16 @@ FORWARD (pthread_mutex_destroy, (pthread_mutex_t *mutex), (mutex), 0)
- FORWARD (pthread_mutex_init,
- 	 (pthread_mutex_t *mutex, const pthread_mutexattr_t *mutexattr),
- 	 (mutex, mutexattr), 0)
--strong_alias(pthread_mutex_init, __pthread_mutex_init)
-+hidden_strong_alias(pthread_mutex_init, __pthread_mutex_init)
- 
- FORWARD (pthread_mutex_lock, (pthread_mutex_t *mutex), (mutex), 0)
--strong_alias(pthread_mutex_lock, __pthread_mutex_lock)
-+hidden_strong_alias(pthread_mutex_lock, __pthread_mutex_lock)
- 
- FORWARD (pthread_mutex_trylock, (pthread_mutex_t *mutex), (mutex), 0)
--strong_alias(pthread_mutex_trylock, __pthread_mutex_trylock)
-+hidden_strong_alias(pthread_mutex_trylock, __pthread_mutex_trylock)
- 
- FORWARD (pthread_mutex_unlock, (pthread_mutex_t *mutex), (mutex), 0)
--strong_alias(pthread_mutex_unlock, __pthread_mutex_unlock)
-+hidden_strong_alias(pthread_mutex_unlock, __pthread_mutex_unlock)
- 
- FORWARD2 (pthread_self, pthread_t, (void), (), return 0)
- 
-diff --git a/libpthread/linuxthreads/internals.h b/libpthread/linuxthreads/internals.h
-index eb0a519..4ad6a0d 100644
---- a/libpthread/linuxthreads/internals.h
-+++ b/libpthread/linuxthreads/internals.h
-@@ -380,6 +380,17 @@ extern int __pthread_setschedparam (pthread_t thread, int policy,
- extern int __pthread_setcancelstate (int state, int * oldstate);
- extern int __pthread_setcanceltype (int type, int * oldtype);
- 
-+extern void __pthread_cleanup_push (struct _pthread_cleanup_buffer *__buffer,
-+                                    void (*__routine) (void *),
-+                                    void *__arg) __THROW;
-+extern void __pthread_cleanup_pop (struct _pthread_cleanup_buffer *__buffer,
-+                                   int __execute) __THROW;
-+extern void __pthread_cleanup_push_defer (struct _pthread_cleanup_buffer *__buffer,
-+                                          void (*__routine) (void *),
-+                                          void *__arg) __THROW;
-+extern void __pthread_cleanup_pop_restore (struct _pthread_cleanup_buffer *__buffer,
-+                                           int __execute) __THROW;
-+
- extern void __pthread_restart_old(pthread_descr th);
- extern void __pthread_suspend_old(pthread_descr self);
- extern int __pthread_timedsuspend_old(pthread_descr self, const struct timespec *abstime);
-diff --git a/libpthread/linuxthreads/pthread.c b/libpthread/linuxthreads/pthread.c
-index 4d1d906..012b74b 100644
---- a/libpthread/linuxthreads/pthread.c
-+++ b/libpthread/linuxthreads/pthread.c
-@@ -280,10 +280,10 @@ struct pthread_functions __pthread_functions =
-     .ptr_pthread_sigaction = __pthread_sigaction,
-     .ptr_pthread_sigwait = __pthread_sigwait,
-     .ptr_pthread_raise = __pthread_raise,
--    .ptr__pthread_cleanup_push = _pthread_cleanup_push,
--    .ptr__pthread_cleanup_push_defer = _pthread_cleanup_push_defer,
--    .ptr__pthread_cleanup_pop = _pthread_cleanup_pop,
--    .ptr__pthread_cleanup_pop_restore = _pthread_cleanup_pop_restore,
-+    .ptr__pthread_cleanup_push = __pthread_cleanup_push,
-+    .ptr__pthread_cleanup_push_defer = __pthread_cleanup_push_defer,
-+    .ptr__pthread_cleanup_pop = __pthread_cleanup_pop,
-+    .ptr__pthread_cleanup_pop_restore = __pthread_cleanup_pop_restore,
-   };
- #ifdef SHARED
- # define ptr_pthread_functions &__pthread_functions
diff --git a/main/uclibc/uclibc-0.9.30.1-pthread_getattr_np.patch b/main/uclibc/uclibc-0.9.30.1-pthread_getattr_np.patch
deleted file mode 100644
index 28469be2..00000000
--- a/main/uclibc/uclibc-0.9.30.1-pthread_getattr_np.patch
+++ /dev/null
@@ -1,137 +0,0 @@
---- uClibc-0.9.30.1.orig/libpthread/linuxthreads.old/sysdeps/pthread/pthread.h	2009-03-30 15:01:48.000000000 +0000
-+++ uClibc-0.9.30.1/libpthread/linuxthreads.old/sysdeps/pthread/pthread.h	2009-03-30 15:48:16.000000000 +0000
-@@ -288,16 +288,12 @@
- 				      __attr, size_t *__restrict __stacksize)
-      __THROW;
- 
--#if 0
--/* Not yet implemented in uClibc! */
--
- #ifdef __USE_GNU
- /* Initialize thread attribute *ATTR with attributes corresponding to the
-    already running thread TH.  It shall be called on uninitialized ATTR
-    and destroyed with pthread_attr_destroy when no longer needed.  */
- extern int pthread_getattr_np (pthread_t __th, pthread_attr_t *__attr) __THROW;
- #endif
--#endif
- 
- /* Functions for scheduling control.  */
- 
-@@ -599,6 +595,11 @@
-    cancelled.  */
- extern void pthread_testcancel (void);
- 
-+/* Return the previously set address for the stack.  */
-+extern int pthread_attr_getstack (__const pthread_attr_t *__restrict __attr,
-+				  void **__restrict __stackaddr,
-+				  size_t *__restrict __stacksize) __THROW;
-+
- 
- /* Install a cleanup handler: ROUTINE will be called with arguments ARG
-    when the thread is cancelled or calls pthread_exit.  ROUTINE will also
---- a/libpthread/linuxthreads.old/attr.c.orig	2007-11-22 16:55:08.000000000 +0000
-+++ b/libpthread/linuxthreads.old/attr.c	2009-03-30 19:15:51.000000000 +0000
-@@ -38,6 +38,14 @@
- libpthread_hidden_proto(pthread_attr_getscope)
- libpthread_hidden_proto(pthread_attr_setscope)
- 
-+#include <sys/resource.h>
-+#include <inttypes.h>
-+#include <stdio.h>
-+#include <stdio_ext.h>
-+#include <stdlib.h>
-+#include <sys/resource.h>
-+
-+
- /* NOTE: With uClibc I don't think we need this versioning stuff.
-  * Therefore, define the function pthread_attr_init() here using
-  * a strong symbol. */
-@@ -235,4 +243,88 @@
-   *stacksize = attr->__stacksize;
-   return 0;
- }
-+
-+
-+extern int *__libc_stack_end;
-+
- weak_alias (__pthread_attr_getstacksize, pthread_attr_getstacksize)
-+int pthread_getattr_np(pthread_t thread, pthread_attr_t *attr)
-+{
-+    static void *stackBase = 0;
-+    static size_t stackSize = 0;
-+    int ret = 0;
-+    /* Stack size limit.  */
-+    struct rlimit rl;
-+
-+    /* The safest way to get the top of the stack is to read
-+    /proc/self/maps and locate the line into which
-+    __libc_stack_end falls.  */
-+    FILE *fp = fopen("/proc/self/maps", "rc");
-+    if (fp == NULL)
-+        ret = errno;
-+    /* We need the limit of the stack in any case.  */
-+    else if (getrlimit (RLIMIT_STACK, &rl) != 0)
-+        ret = errno;
-+    else {
-+        /* We need no locking.  */
-+        __fsetlocking (fp, FSETLOCKING_BYCALLER);
-+
-+        /* Until we found an entry (which should always be the case)
-+        mark the result as a failure.  */
-+        ret = ENOENT;
-+
-+        char *line = NULL;
-+        size_t linelen = 0;
-+        uintptr_t last_to = 0;
-+
-+        while (! feof_unlocked (fp)) {
-+            if (getdelim (&line, &linelen, '\n', fp) <= 0)
-+                break;
-+
-+            uintptr_t from;
-+            uintptr_t to;
-+            if (sscanf (line, "%x-%x", &from, &to) != 2)
-+                continue;
-+            if (from <= (uintptr_t) __libc_stack_end
-+            && (uintptr_t) __libc_stack_end < to) {
-+                /* Found the entry.  Now we have the info we need.  */
-+                attr->__stacksize = rl.rlim_cur;
-+#ifdef _STACK_GROWS_UP
-+                /* Don't check to enforce a limit on the __stacksize */
-+                attr->__stackaddr = (void *) from;
-+#else
-+                attr->__stackaddr = (void *) to;
-+
-+                /* The limit might be too high.  */
-+                if ((size_t) attr->__stacksize > (size_t) attr->__stackaddr - last_to)
-+                    attr->__stacksize = (size_t) attr->__stackaddr - last_to;
-+#endif
-+
-+                /* We succeed and no need to look further.  */
-+                ret = 0;
-+                break;
-+            }
-+            last_to = to;
-+        }
-+
-+        fclose (fp);
-+        free (line);
-+    }
-+    return ret;
-+}
-+
-+int __pthread_attr_getstack (const pthread_attr_t *attr, void **stackaddr,
-+			     size_t *stacksize)
-+{
-+  /* XXX This function has a stupid definition.  The standard specifies
-+     no error value but what is if no stack address was set?  We simply
-+     return the value we have in the member.  */
-+#ifndef _STACK_GROWS_UP
-+  *stackaddr = (char *) attr->__stackaddr - attr->__stacksize;
-+#else
-+  *stackaddr = attr->__stackaddr;
-+#endif
-+  *stacksize = attr->__stacksize;
-+  return 0;
-+}
-+weak_alias (__pthread_attr_getstack, pthread_attr_getstack)
diff --git a/main/uclibc/uclibc-0.9.30.1-resolv.patch b/main/uclibc/uclibc-0.9.30.1-resolv.patch
deleted file mode 100644
index 55b7d991..00000000
--- a/main/uclibc/uclibc-0.9.30.1-resolv.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -ru uClibc-0.9.30.1.orig/libc/inet/resolv.c uClibc-0.9.30.1/libc/inet/resolv.c
---- uClibc-0.9.30.1.orig/libc/inet/resolv.c	2009-03-10 15:32:14.000000000 +0000
-+++ uClibc-0.9.30.1/libc/inet/resolv.c	2009-03-10 15:39:20.000000000 +0000
-@@ -1331,7 +1331,8 @@
- 	i = __dns_lookup(dname, type, __nameserversXX, __nameserverXX, &packet, &a);
- 
- 	if (i < 0) {
--		h_errno = TRY_AGAIN;
-+		if (!h_errno) /* TODO: can this ever happen? */
-+			h_errno = TRY_AGAIN;
- 		return -1;
- 	}
- 
diff --git a/main/uclibc/uclibc-fork-hidden.diff b/main/uclibc/uclibc-fork-hidden.diff
deleted file mode 100644
index 2a054338..00000000
--- a/main/uclibc/uclibc-fork-hidden.diff
+++ /dev/null
@@ -1,115 +0,0 @@
-Index: uClibc-0.9.30.1/libc/misc/wordexp/wordexp.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/misc/wordexp/wordexp.c	2009-08-03 16:13:20.000000000 +0300
-+++ uClibc-0.9.30.1/libc/misc/wordexp/wordexp.c	2009-08-03 16:14:23.000000000 +0300
-@@ -56,7 +56,7 @@
- libc_hidden_proto(atoi)
- libc_hidden_proto(fnmatch)
- libc_hidden_proto(pipe)
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- libc_hidden_proto(open)
- libc_hidden_proto(close)
- libc_hidden_proto(read)
-Index: uClibc-0.9.30.1/libc/stdio/popen.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/stdio/popen.c	2009-08-03 16:13:20.000000000 +0300
-+++ uClibc-0.9.30.1/libc/stdio/popen.c	2009-08-03 16:14:23.000000000 +0300
-@@ -42,7 +42,7 @@
- # define vfork fork
- # define VFORK_LOCK		((void) 0)
- # define VFORK_UNLOCK		((void) 0)
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- #endif
- 
- #ifndef VFORK_LOCK
-Index: uClibc-0.9.30.1/libc/stdlib/system.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/stdlib/system.c	2009-08-03 16:13:20.000000000 +0300
-+++ uClibc-0.9.30.1/libc/stdlib/system.c	2009-08-03 16:14:23.000000000 +0300
-@@ -21,7 +21,7 @@
- #include <sys/syscall.h>
- #ifndef __NR_vfork
- # define vfork fork
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- #endif
- 
- extern __typeof(system) __libc_system;
-Index: uClibc-0.9.30.1/libc/stdlib/unix_grantpt.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/stdlib/unix_grantpt.c	2009-08-03 16:13:21.000000000 +0300
-+++ uClibc-0.9.30.1/libc/stdlib/unix_grantpt.c	2009-08-03 16:14:23.000000000 +0300
-@@ -39,7 +39,7 @@
- libc_hidden_proto(chmod)
- libc_hidden_proto(chown)
- libc_hidden_proto(vfork)
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- libc_hidden_proto(stat)
- libc_hidden_proto(ptsname_r)
- libc_hidden_proto(execle)
-Index: uClibc-0.9.30.1/libc/sysdeps/linux/common/fork.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/sysdeps/linux/common/fork.c	2009-08-03 16:10:51.000000000 +0300
-+++ uClibc-0.9.30.1/libc/sysdeps/linux/common/fork.c	2009-08-03 16:14:23.000000000 +0300
-@@ -16,9 +16,9 @@
- extern __typeof(fork) __libc_fork;
- #define __NR___libc_fork __NR_fork
- _syscall0(pid_t, __libc_fork)
--libc_hidden_proto(fork)
-+////libc_hidden_proto(fork)
- weak_alias(__libc_fork,fork)
--libc_hidden_weak(fork)
-+//libc_hidden_weak(fork)
- #endif
- 
- #elif defined __UCLIBC_HAS_STUBS__
-@@ -28,7 +28,7 @@
- 	__set_errno(ENOSYS);
- 	return -1;
- }
--libc_hidden_proto(fork)
-+////libc_hidden_proto(fork)
- weak_alias(__libc_fork,fork)
- libc_hidden_weak(fork)
- link_warning(fork, "fork: this function is not implemented on no-mmu systems")
-Index: uClibc-0.9.30.1/libc/sysdeps/linux/common/vfork.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/sysdeps/linux/common/vfork.c	2009-08-03 16:13:20.000000000 +0300
-+++ uClibc-0.9.30.1/libc/sysdeps/linux/common/vfork.c	2009-08-03 16:14:23.000000000 +0300
-@@ -12,7 +12,7 @@
- #ifdef __ARCH_USE_MMU__
- 
- #ifdef __NR_fork
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- 
- extern __typeof(vfork) __vfork attribute_hidden;
- pid_t __vfork(void)
-Index: uClibc-0.9.30.1/libc/sysdeps/linux/cris/fork.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/sysdeps/linux/cris/fork.c	2009-08-03 16:13:20.000000000 +0300
-+++ uClibc-0.9.30.1/libc/sysdeps/linux/cris/fork.c	2009-08-03 16:14:23.000000000 +0300
-@@ -14,6 +14,6 @@
- 	   R0&-1==R0, and the child gets R0&0==0.  */
-      /* i dunno what the blurb above is useful for. we just return. */
- __asm__("ret\n\tnop");
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- weak_alias(__libc_fork,fork)
- libc_hidden_weak(fork)
-Index: uClibc-0.9.30.1/libc/unistd/daemon.c
-===================================================================
---- uClibc-0.9.30.1.orig/libc/unistd/daemon.c	2009-08-03 16:13:21.000000000 +0300
-+++ uClibc-0.9.30.1/libc/unistd/daemon.c	2009-08-03 16:14:23.000000000 +0300
-@@ -54,7 +54,7 @@
- libc_hidden_proto(dup2)
- libc_hidden_proto(setsid)
- libc_hidden_proto(chdir)
--libc_hidden_proto(fork)
-+//libc_hidden_proto(fork)
- 
- int daemon( int nochdir, int noclose )
- {
diff --git a/main/uclibc/uclibc-fork-hook.diff b/main/uclibc/uclibc-fork-hook.diff
deleted file mode 100644
index 01269188..00000000
--- a/main/uclibc/uclibc-fork-hook.diff
+++ /dev/null
@@ -1,36 +0,0 @@
-diff --git a/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.c b/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.c
-index e15b99b..70c750d 100644
---- a/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.c
-+++ b/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.c
-@@ -20,6 +20,7 @@
- #include <errno.h>
- #include <fork.h>
- #include <bits/libc-lock.h>
-+#include <internals.h>
- 
- struct fork_block __fork_block =
- {
-@@ -28,3 +29,12 @@ struct fork_block __fork_block =
-   .parent_list = { &__fork_block.parent_list, &__fork_block.parent_list },
-   .child_list = { &__fork_block.child_list, &__fork_block.child_list }
- };
-+
-+pid_t
-+__libc_fork (void)
-+{
-+  return __libc_maybe_call2 (pthread_fork, (&__fork_block), ARCH_FORK ());
-+}
-+weak_alias (__libc_fork, __fork)
-+libc_hidden_def (__fork)
-+weak_alias (__libc_fork, fork)
-diff --git a/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.h b/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.h
-index 85477eb..1e7379e 100644
---- a/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.h
-+++ b/libpthread/linuxthreads/sysdeps/unix/sysv/linux/fork.h
-@@ -54,5 +54,5 @@ extern int __register_atfork (void (*__prepare) (void),
- 			      void *dso_handle);
- 
- #ifndef ARCH_FORK
--# define ARCH_FORK() __libc_fork()
-+# define ARCH_FORK() INLINE_SYSCALL (fork, 0)
- #endif
diff --git a/main/uclibc/uclibc-i386-floating-stacks.diff b/main/uclibc/uclibc-i386-floating-stacks.diff
deleted file mode 100644
index 0ec05799..00000000
--- a/main/uclibc/uclibc-i386-floating-stacks.diff
+++ /dev/null
@@ -1,23 +0,0 @@
---- uClibc-0.9.30.1/libpthread/linuxthreads/sysdeps/i386/pt-machine.h	Thu Sep 25 13:55:14 2008
-+++ /root/uClibc-0.9.30.1-patched/libpthread/linuxthreads/sysdeps/i386/pt-machine.h	Wed Jun 24 13:13:31 2009
-@@ -113,6 +113,8 @@
- }
- #endif /* __ASSEMBLER__ */
- 
-+#include "./useldt.h"
-+
- #endif /* pt-machine.h */
- 
- #endif
---- uClibc-0.9.30.1/libpthread/linuxthreads/sysdeps/i386/useldt.h	Tue May 15 00:35:00 2007
-+++ /root/uClibc-0.9.30.1-patched/libpthread/linuxthreads/sysdeps/i386/useldt.h	Wed Jun 24 13:22:38 2009
-@@ -23,7 +23,8 @@
- #include <stddef.h>	/* For offsetof.  */
- #include <stdlib.h>	/* For abort().	 */
- #include <sysdep.h>
--
-+#include <sys/syscall.h>
-+#include <bits/kernel-features.h>
- 
- /* We don't want to include the kernel header.	So duplicate the
-    information.	 */
diff --git a/main/uclibc/uclibc-linuxthreads-init-stdio.patch b/main/uclibc/uclibc-linuxthreads-init-stdio.patch
deleted file mode 100644
index aa5ef646..00000000
--- a/main/uclibc/uclibc-linuxthreads-init-stdio.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/libpthread/linuxthreads/pthread.c b/libpthread/linuxthreads/pthread.c
-index 6ae9a10..151e039 100644
---- a/libpthread/linuxthreads/pthread.c
-+++ b/libpthread/linuxthreads/pthread.c
-@@ -409,6 +409,16 @@ cannot allocate TLS data structures for initial thread\n";
- #endif
- 
-   __libc_multiple_threads_ptr = __libc_pthread_init (ptr_pthread_functions);
-+  /* uClibc-specific stdio initialization for threads. */
-+  {
-+    FILE *fp;
-+    _stdio_user_locking = 0;       /* 2 if threading not initialized */
-+    for (fp = _stdio_openlist; fp != NULL; fp = fp->__nextopen) {
-+      if (fp->__user_locking != 1) {
-+        fp->__user_locking = 0;
-+      }
-+    }
-+  }
- }
- 
- 
diff --git a/main/uclibc/uclibc-resolv-cname-fix.diff b/main/uclibc/uclibc-resolv-cname-fix.diff
deleted file mode 100644
index 041e150f..00000000
--- a/main/uclibc/uclibc-resolv-cname-fix.diff
+++ /dev/null
@@ -1,16 +0,0 @@
---- a/libc/inet/resolv.c.orig	2009-06-18 09:38:26.000000000 +0300
-+++ b/libc/inet/resolv.c	2009-06-18 09:38:32.000000000 +0300
-@@ -1337,10 +1337,9 @@ int res_query(const char *dname, int cla
- 
- 	free(a.dotted);
- 
--	if (a.atype == type) { /* CNAME */
--		i = MIN(anslen, i);
--		memcpy(answer, packet, i);
--	}
-+	i = MIN(anslen, i);
-+	memcpy(answer, packet, i);
-+
- 	free(packet);
- 	return i;
- }
diff --git a/main/uclibc/uclibcconfig.x86 b/main/uclibc/uclibcconfig.x86
deleted file mode 100644
index 78835525..00000000
--- a/main/uclibc/uclibcconfig.x86
+++ /dev/null
@@ -1,246 +0,0 @@
-#
-# Automatically generated make config: don't edit
-# Version: 0.9.30.1
-# Mon Jun 15 09:42:10 2009
-#
-# TARGET_alpha is not set
-# TARGET_arm is not set
-# TARGET_avr32 is not set
-# TARGET_bfin is not set
-# TARGET_cris is not set
-# TARGET_e1 is not set
-# TARGET_frv is not set
-# TARGET_h8300 is not set
-# TARGET_hppa is not set
-TARGET_i386=y
-# TARGET_i960 is not set
-# TARGET_ia64 is not set
-# TARGET_m68k is not set
-# TARGET_microblaze is not set
-# TARGET_mips is not set
-# TARGET_nios is not set
-# TARGET_nios2 is not set
-# TARGET_powerpc is not set
-# TARGET_sh is not set
-# TARGET_sh64 is not set
-# TARGET_sparc is not set
-# TARGET_v850 is not set
-# TARGET_vax is not set
-# TARGET_x86_64 is not set
-# TARGET_xtensa is not set
-
-#
-# Target Architecture Features and Options
-#
-TARGET_ARCH="i386"
-FORCE_OPTIONS_FOR_ARCH=y
-# CONFIG_GENERIC_386 is not set
-# CONFIG_386 is not set
-CONFIG_486=y
-# CONFIG_586 is not set
-# CONFIG_586MMX is not set
-# CONFIG_686 is not set
-# CONFIG_PENTIUMII is not set
-# CONFIG_PENTIUMIII is not set
-# CONFIG_PENTIUM4 is not set
-# CONFIG_K6 is not set
-# CONFIG_K7 is not set
-# CONFIG_ELAN is not set
-# CONFIG_CRUSOE is not set
-# CONFIG_WINCHIPC6 is not set
-# CONFIG_WINCHIP2 is not set
-# CONFIG_CYRIXIII is not set
-# CONFIG_NEHEMIAH is not set
-TARGET_SUBARCH=""
-
-#
-# Using ELF file format
-#
-ARCH_LITTLE_ENDIAN=y
-
-#
-# Using Little Endian
-#
-ARCH_HAS_MMU=y
-ARCH_USE_MMU=y
-UCLIBC_HAS_FLOATS=y
-UCLIBC_HAS_FPU=y
-DO_C99_MATH=y
-UCLIBC_HAS_FENV=y
-UCLIBC_HAS_LONG_DOUBLE_MATH=y
-KERNEL_HEADERS="/usr/include"
-HAVE_DOT_CONFIG=y
-
-#
-# General Library Settings
-#
-# HAVE_NO_PIC is not set
-DOPIC=y
-# ARCH_HAS_NO_SHARED is not set
-# ARCH_HAS_NO_LDSO is not set
-HAVE_SHARED=y
-FORCE_SHAREABLE_TEXT_SEGMENTS=y
-LDSO_LDD_SUPPORT=y
-LDSO_CACHE_SUPPORT=y
-# LDSO_PRELOAD_FILE_SUPPORT is not set
-LDSO_BASE_FILENAME="ld.so"
-UCLIBC_STATIC_LDCONFIG=y
-LDSO_RUNPATH=y
-UCLIBC_CTOR_DTOR=y
-# LDSO_GNU_HASH_SUPPORT is not set
-# HAS_NO_THREADS is not set
-UCLIBC_HAS_THREADS=y
-# PTHREADS_DEBUG_SUPPORT is not set
-# LINUXTHREADS_OLD is not set
-LINUXTHREADS_NEW=y
-UCLIBC_HAS_SYSLOG=y
-UCLIBC_HAS_LFS=y
-# MALLOC is not set
-# MALLOC_SIMPLE is not set
-MALLOC_STANDARD=y
-MALLOC_GLIBC_COMPAT=y
-UCLIBC_DYNAMIC_ATEXIT=y
-COMPAT_ATEXIT=y
-UCLIBC_SUSV3_LEGACY=y
-UCLIBC_SUSV3_LEGACY_MACROS=y
-# UCLIBC_HAS_STUBS is not set
-UCLIBC_HAS_SHADOW=y
-UCLIBC_HAS_PROGRAM_INVOCATION_NAME=y
-UCLIBC_HAS___PROGNAME=y
-UCLIBC_HAS_PTY=y
-ASSUME_DEVPTS=y
-UNIX98PTY_ONLY=y
-# UCLIBC_HAS_GETPT is not set
-UCLIBC_HAS_TM_EXTENSIONS=y
-UCLIBC_HAS_TZ_CACHING=y
-UCLIBC_HAS_TZ_FILE=y
-UCLIBC_HAS_TZ_FILE_READ_MANY=y
-UCLIBC_TZ_FILE_PATH="/etc/TZ"
-
-#
-# Advanced Library Settings
-#
-UCLIBC_PWD_BUFFER_SIZE=256
-UCLIBC_GRP_BUFFER_SIZE=256
-
-#
-# Support various families of functions
-#
-UCLIBC_LINUX_MODULE_24=y
-UCLIBC_LINUX_SPECIFIC=y
-UCLIBC_HAS_GNU_ERROR=y
-UCLIBC_BSD_SPECIFIC=y
-UCLIBC_HAS_BSD_ERR=y
-UCLIBC_HAS_OBSOLETE_BSD_SIGNAL=y
-UCLIBC_HAS_OBSOLETE_SYSV_SIGNAL=y
-# UCLIBC_NTP_LEGACY is not set
-UCLIBC_SV4_DEPRECATED=y
-UCLIBC_HAS_REALTIME=y
-UCLIBC_HAS_ADVANCED_REALTIME=y
-UCLIBC_HAS_EPOLL=y
-UCLIBC_HAS_XATTR=y
-UCLIBC_HAS_PROFILING=y
-UCLIBC_HAS_CRYPT_IMPL=y
-UCLIBC_HAS_CRYPT=y
-UCLIBC_HAS_NETWORK_SUPPORT=y
-UCLIBC_HAS_SOCKET=y
-UCLIBC_HAS_IPV4=y
-UCLIBC_HAS_IPV6=y
-UCLIBC_HAS_RPC=y
-UCLIBC_HAS_FULL_RPC=y
-UCLIBC_HAS_REENTRANT_RPC=y
-UCLIBC_USE_NETLINK=y
-UCLIBC_SUPPORT_AI_ADDRCONFIG=y
-UCLIBC_HAS_BSD_RES_CLOSE=y
-
-#
-# String and Stdio Support
-#
-UCLIBC_HAS_STRING_GENERIC_OPT=y
-UCLIBC_HAS_STRING_ARCH_OPT=y
-UCLIBC_HAS_CTYPE_TABLES=y
-UCLIBC_HAS_CTYPE_SIGNED=y
-# UCLIBC_HAS_CTYPE_UNSAFE is not set
-UCLIBC_HAS_CTYPE_CHECKED=y
-# UCLIBC_HAS_CTYPE_ENFORCED is not set
-UCLIBC_HAS_WCHAR=y
-# UCLIBC_HAS_LOCALE is not set
-UCLIBC_HAS_HEXADECIMAL_FLOATS=y
-UCLIBC_HAS_GLIBC_CUSTOM_PRINTF=y
-UCLIBC_PRINTF_SCANF_POSITIONAL_ARGS=9
-# UCLIBC_HAS_SCANF_GLIBC_A_FLAG is not set
-# UCLIBC_HAS_STDIO_BUFSIZ_NONE is not set
-# UCLIBC_HAS_STDIO_BUFSIZ_256 is not set
-# UCLIBC_HAS_STDIO_BUFSIZ_512 is not set
-# UCLIBC_HAS_STDIO_BUFSIZ_1024 is not set
-# UCLIBC_HAS_STDIO_BUFSIZ_2048 is not set
-UCLIBC_HAS_STDIO_BUFSIZ_4096=y
-# UCLIBC_HAS_STDIO_BUFSIZ_8192 is not set
-UCLIBC_HAS_STDIO_BUILTIN_BUFFER_NONE=y
-# UCLIBC_HAS_STDIO_BUILTIN_BUFFER_4 is not set
-# UCLIBC_HAS_STDIO_BUILTIN_BUFFER_8 is not set
-# UCLIBC_HAS_STDIO_SHUTDOWN_ON_ABORT is not set
-UCLIBC_HAS_STDIO_GETC_MACRO=y
-UCLIBC_HAS_STDIO_PUTC_MACRO=y
-UCLIBC_HAS_STDIO_AUTO_RW_TRANSITION=y
-# UCLIBC_HAS_FOPEN_LARGEFILE_MODE is not set
-UCLIBC_HAS_FOPEN_EXCLUSIVE_MODE=y
-UCLIBC_HAS_GLIBC_CUSTOM_STREAMS=y
-UCLIBC_HAS_PRINTF_M_SPEC=y
-UCLIBC_HAS_ERRNO_MESSAGES=y
-# UCLIBC_HAS_SYS_ERRLIST is not set
-UCLIBC_HAS_SIGNUM_MESSAGES=y
-# UCLIBC_HAS_SYS_SIGLIST is not set
-UCLIBC_HAS_GNU_GETOPT=y
-UCLIBC_HAS_GNU_GETSUBOPT=y
-
-#
-# Big and Tall
-#
-UCLIBC_HAS_REGEX=y
-UCLIBC_HAS_REGEX_OLD=y
-UCLIBC_HAS_FNMATCH=y
-# UCLIBC_HAS_FNMATCH_OLD is not set
-UCLIBC_HAS_WORDEXP=y
-UCLIBC_HAS_FTW=y
-UCLIBC_HAS_GLOB=y
-UCLIBC_HAS_GNU_GLOB=y
-
-#
-# Library Installation Options
-#
-SHARED_LIB_LOADER_PREFIX="/lib"
-RUNTIME_PREFIX="/"
-DEVEL_PREFIX="/usr"
-
-#
-# Security options
-#
-UCLIBC_BUILD_PIE=y
-UCLIBC_HAS_ARC4RANDOM=y
-# HAVE_NO_SSP is not set
-UCLIBC_HAS_SSP=y
-UCLIBC_HAS_SSP_COMPAT=y
-# SSP_QUICK_CANARY is not set
-# PROPOLICE_BLOCK_ABRT is not set
-PROPOLICE_BLOCK_SEGV=y
-UCLIBC_BUILD_SSP=y
-UCLIBC_BUILD_RELRO=y
-UCLIBC_BUILD_NOW=y
-UCLIBC_BUILD_NOEXECSTACK=y
-
-#
-# uClibc development/debugging options
-#
-CROSS_COMPILER_PREFIX=""
-UCLIBC_EXTRA_CFLAGS=""
-# DODEBUG is not set
-# DOSTRIP is not set
-# DOASSERTS is not set
-# SUPPORT_LD_DEBUG is not set
-# SUPPORT_LD_DEBUG_EARLY is not set
-# UCLIBC_MALLOC_DEBUGGING is not set
-WARNINGS="-Wall"
-# EXTRA_WARNINGS is not set
-# DOMULTI is not set
-# UCLIBC_MJN3_ONLY is not set
-- 
cgit v1.2.3


From 4f91f2a10a5afed55f3ab60b8502b57a769ed252 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:49:55 +0000
Subject: main/alpine-baselayout: force rebuild of mkmntdirs

bug in tarball. binary was shipped there
---
 main/alpine-baselayout/APKBUILD | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/main/alpine-baselayout/APKBUILD b/main/alpine-baselayout/APKBUILD
index 46a325b9..f0e3c00b 100644
--- a/main/alpine-baselayout/APKBUILD
+++ b/main/alpine-baselayout/APKBUILD
@@ -11,7 +11,12 @@ license=GPL-2
 
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
+	rm -f src/mkmntdirs
 	make
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make install PREFIX= DESTDIR="$pkgdir" || return 1
 }
 md5sums="76d61057c9e21d8e3ef85933a20b814d  alpine-baselayout-2.0_rc1.tar.bz2"
-- 
cgit v1.2.3


From c86b56728a4f4b77ef4e09b04c30f94fd82eb23d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:53:28 +0000
Subject: main/libetpan: upgrade to 1.0

---
 main/libetpan/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/libetpan/APKBUILD b/main/libetpan/APKBUILD
index bf490ed2..8356039e 100644
--- a/main/libetpan/APKBUILD
+++ b/main/libetpan/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libetpan
-pkgver=0.58
-pkgrel=2
+pkgver=1.0
+pkgrel=0
 _dbver=4.8
 pkgdesc="a portable middleware for email access"
 url="http://www.etpan.org/"
@@ -15,7 +15,7 @@ source="http://downloads.sourceforge.net/sourceforge/$pkgname/$pkgname-$pkgver.t
 build ()
 {
 	cd "$srcdir"/$pkgname-$pkgver
-	sed -e "s/db-4.4/db-${_dbver}/g" -i configure || return 1
+#	sed -e "s/db-4.4/db-${_dbver}/g" -i configure || return 1
 	./configure --prefix=/usr \
 		--disable-static
 
@@ -27,4 +27,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 	install -Dm644 COPYRIGHT "$pkgdir"/usr/share/licenses/$pkgname/license.txt
 }
-md5sums="bf20b5c0548f06b94bc588afdf5b3436  libetpan-0.58.tar.gz"
+md5sums="5addc766141a0b1d29ee1ca4ba1b6808  libetpan-1.0.tar.gz"
-- 
cgit v1.2.3


From 9306e57a5d5d9539c241a84437365c2a5b9dc0ad Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:53:55 +0000
Subject: main/claws-mail: upgrade to 3.7.6

---
 main/claws-mail/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/claws-mail/APKBUILD b/main/claws-mail/APKBUILD
index 74644f3c..586db2e4 100644
--- a/main/claws-mail/APKBUILD
+++ b/main/claws-mail/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=claws-mail
-pkgver=3.7.5
+pkgver=3.7.6
 pkgrel=0
 pkgdesc="A GTK+ based e-mail client."
 url="http://www.claws-mail.org"
@@ -46,5 +46,5 @@ package() {
 		install -D -m755 ${i} "$pkgdir"/usr/lib/claws-mail/tools/${i}
 	done
 }
-md5sums="05a97ef3bf41ae5e6e2a3ddeb600ab44  claws-mail-3.7.5.tar.bz2
+md5sums="09c150cf13c04201c92089fc285cecd9  claws-mail-3.7.6.tar.bz2
 f3416743b5d8ff97b5a3cc2f7efc2dc1  libc-version.patch"
-- 
cgit v1.2.3


From 80f826f2729b549aba219c6947164b2e96956a03 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 07:56:13 +0000
Subject: main/gcc: build with NPTL support

we need set dynamic-linker to point on other ld-uClibc
---
 main/gcc/APKBUILD                 |  10 +-
 main/gcc/gcc-dynamic-linker.patch | 425 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 433 insertions(+), 2 deletions(-)
 create mode 100644 main/gcc/gcc-dynamic-linker.patch

diff --git a/main/gcc/APKBUILD b/main/gcc/APKBUILD
index 7ab9918c..43663674 100644
--- a/main/gcc/APKBUILD
+++ b/main/gcc/APKBUILD
@@ -4,6 +4,8 @@ pkgver=4.4.3
 _pv=4.4.2
 _specsver=0.1.7
 _espfver=0.3.6
+_uclibc_abiver=0.9.32
+
 pkgrel=0
 pkgdesc="The GNU Compiler Collection"
 url="http://gcc.gnu.org"
@@ -18,6 +20,7 @@ source="ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-core-$pkgver.tar.bz2
 	gcc-spec-env.patch
 	pt_gnu_eh_frame.patch
 	uclibc-getipinfo.patch
+	gcc-dynamic-linker.patch
 	"
 #	ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-objc-$pkgver.tar.bz2
 build ()
@@ -52,7 +55,6 @@ build ()
 		--disable-libstdcxx-pch \
 		--disable-multilib \
 		--disable-nls \
-		--disable-threads \
 		--disable-werror \
 		--enable-__cxa_atexit \
 		--enable-cld \
@@ -61,7 +63,10 @@ build ()
 		--enable-shared \
 		--enable-target-optspace \
 		--enable-tls \
+		--enable-threads \
 		--with-arch=i486 \
+		--with-dynamic-linker=ld-uClibc.so.$_uclibc_abiver \
+		--with-dynamic-linker-prefix=/lib \
 		--with-system-zlib \
 		--without-system-libunwind
 
@@ -127,4 +132,5 @@ cd179ec4f05ee17ce76464da25a2674c  gcc-g++-4.4.3.tar.bz2
 528926b586b2591474b6c2a7ef8ee6d7  gcc-4.4.2-specs-0.1.7.tar.bz2
 c4045bfa85d8be780affd465be9d8ca8  gcc-spec-env.patch
 2db1e3482c5dd59dab70f701afa2ca80  pt_gnu_eh_frame.patch
-6cc2385c5bbd6d0da6eaedd53c8bf547  uclibc-getipinfo.patch"
+6cc2385c5bbd6d0da6eaedd53c8bf547  uclibc-getipinfo.patch
+6db5c87887beee75cde3cce86625b9ed  gcc-dynamic-linker.patch"
diff --git a/main/gcc/gcc-dynamic-linker.patch b/main/gcc/gcc-dynamic-linker.patch
new file mode 100644
index 00000000..9b346645
--- /dev/null
+++ b/main/gcc/gcc-dynamic-linker.patch
@@ -0,0 +1,425 @@
+Submitted By:            Kevin Day <thekevinday AT gmail DOT com>
+Date:                    2008-12-19
+Initial Package Version: 4.3.2
+Upstream Status:         Not submitted
+Description:             Why not just be able to define the prefix of the dynamic linker instead of hardcoding it..
+This includes the --nostdinc patch as well, so think of this as a specs-3 patch
+This also allows for specifying the dynamic-linker as well
+
+diff -r -u gcc-4.4.0.orig/gcc/Makefile.in gcc-4.4.0/gcc/Makefile.in
+--- gcc-4.4.0.orig/gcc/Makefile.in	2009-06-06 09:15:56 -0500
++++ gcc-4.4.0/gcc/Makefile.in	2009-06-06 09:40:07 -0500
+@@ -893,7 +893,7 @@
+ # This is the variable actually used when we compile. If you change this,
+ # you probably want to update BUILD_CFLAGS in configure.ac
+ ALL_CFLAGS = $(T_CFLAGS) \
+-  $(CFLAGS) $(INTERNAL_CFLAGS) $(COVERAGE_FLAGS) $(WARN_CFLAGS) @DEFS@
++  $(CFLAGS) $(INTERNAL_CFLAGS) $(COVERAGE_FLAGS) $(WARN_CFLAGS) @DEFS@ @NOSTDINC@
+ 
+ # Likewise.  Put INCLUDES at the beginning: this way, if some autoconf macro
+ # puts -I options in CPPFLAGS, our include files in the srcdir will always
+@@ -1947,6 +1947,8 @@
+   -DSTANDARD_STARTFILE_PREFIX=\"$(unlibsubdir)/\" \
+   -DSTANDARD_EXEC_PREFIX=\"$(libdir)/gcc/\" \
+   -DSTANDARD_LIBEXEC_PREFIX=\"$(libexecdir)/gcc/\" \
++  -DDYNAMIC_LINKER_PREFIX=\"@DYNAMICLINKERPREFIX@\" \
++  -DDYNAMIC_LINKER=\"@DYNAMICLINKER@\" \
+   -DDEFAULT_TARGET_VERSION=\"$(version)\" \
+   -DDEFAULT_TARGET_MACHINE=\"$(target_noncanonical)\" \
+   -DSTANDARD_BINDIR_PREFIX=\"$(bindir)/\" \
+diff -r -u gcc-4.4.0.orig/gcc/config/alpha/gnu.h gcc-4.4.0/gcc/config/alpha/gnu.h
+--- gcc-4.4.0.orig/gcc/config/alpha/gnu.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/alpha/gnu.h	2009-06-06 09:40:29 -0500
+@@ -11,7 +11,7 @@
+     } while (0)
+ 
+ #undef ELF_DYNAMIC_LINKER
+-#define ELF_DYNAMIC_LINKER	"/lib/ld.so"
++#define ELF_DYNAMIC_LINKER	DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef	STARTFILE_SPEC
+ #define STARTFILE_SPEC \
+diff -r -u gcc-4.4.0.orig/gcc/config/alpha/linux-elf.h gcc-4.4.0/gcc/config/alpha/linux-elf.h
+--- gcc-4.4.0.orig/gcc/config/alpha/linux-elf.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/alpha/linux-elf.h	2009-06-06 09:40:07 -0500
+@@ -27,8 +27,8 @@
+ #define EXTRA_SPECS \
+ { "elf_dynamic_linker", ELF_DYNAMIC_LINKER },
+ 
+-#define GLIBC_DYNAMIC_LINKER	"/lib/ld-linux.so.2"
+-#define UCLIBC_DYNAMIC_LINKER "/lib/ld-uClibc.so.0"
++#define GLIBC_DYNAMIC_LINKER	DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKER   DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #if UCLIBC_DEFAULT
+ #define CHOOSE_DYNAMIC_LINKER(G, U) "%{mglibc:%{muclibc:%e-mglibc and -muclibc used together}" G ";:" U "}"
+ #else
+diff -r -u gcc-4.4.0.orig/gcc/config/arm/linux-eabi.h gcc-4.4.0/gcc/config/arm/linux-eabi.h
+--- gcc-4.4.0.orig/gcc/config/arm/linux-eabi.h	2009-06-06 09:16:10 -0500
++++ gcc-4.4.0/gcc/config/arm/linux-eabi.h	2009-06-06 09:40:07 -0500
+@@ -61,7 +61,7 @@
+ /* Use ld-linux.so.3 so that it will be possible to run "classic"
+    GNU/Linux binaries on an EABI system.  */
+ #undef  GLIBC_DYNAMIC_LINKER
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.3"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ /* At this point, bpabi.h will have clobbered LINK_SPEC.  We want to
+    use the GNU/Linux version, not the generic BPABI version.  */
+diff -r -u gcc-4.4.0.orig/gcc/config/arm/linux-elf.h gcc-4.4.0/gcc/config/arm/linux-elf.h
+--- gcc-4.4.0.orig/gcc/config/arm/linux-elf.h	2009-06-06 09:16:10 -0500
++++ gcc-4.4.0/gcc/config/arm/linux-elf.h	2009-06-06 09:40:07 -0500
+@@ -62,7 +62,7 @@
+ 
+ #define LIBGCC_SPEC "%{msoft-float:-lfloat} %{mfloat-abi=soft*:-lfloat} -lgcc"
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #define LINUX_TARGET_LINK_SPEC  "%{h*} %{version:-v} \
+    %{b} \
+diff -r -u gcc-4.4.0.orig/gcc/config/bfin/linux.h gcc-4.4.0/gcc/config/bfin/linux.h
+--- gcc-4.4.0.orig/gcc/config/bfin/linux.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/bfin/linux.h	2009-06-06 09:40:07 -0500
+@@ -22,7 +22,7 @@
+   %{shared:-G -Bdynamic} \
+   %{!shared: %{!static: \
+    %{rdynamic:-export-dynamic} \
+-   %{!dynamic-linker:-dynamic-linker /lib/ld-uClibc.so.0}} \
++   %{!dynamic-linker:-dynamic-linker DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER}} \
+    %{static}} -init __init -fini __fini"
+ 
+ #define MD_UNWIND_SUPPORT "config/bfin/linux-unwind.h"
+diff -r -u gcc-4.4.0.orig/gcc/config/cris/linux.h gcc-4.4.0/gcc/config/cris/linux.h
+--- gcc-4.4.0.orig/gcc/config/cris/linux.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/cris/linux.h	2009-06-06 09:40:07 -0500
+@@ -103,7 +103,7 @@
+ #undef CRIS_DEFAULT_CPU_VERSION
+ #define CRIS_DEFAULT_CPU_VERSION CRIS_CPU_NG
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ /* We need an -rpath-link to ld.so.1, and presumably to each directory
+    specified with -B.  */
+diff -r -u gcc-4.4.0.orig/gcc/config/freebsd-spec.h gcc-4.4.0/gcc/config/freebsd-spec.h
+--- gcc-4.4.0.orig/gcc/config/freebsd-spec.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/freebsd-spec.h	2009-06-06 09:41:42 -0500
+@@ -144,7 +144,7 @@
+ #endif
+ 
+ #if FBSD_MAJOR < 6
+-#define FBSD_DYNAMIC_LINKER "/usr/libexec/ld-elf.so.1"
++#define FBSD_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #else
+-#define FBSD_DYNAMIC_LINKER "/libexec/ld-elf.so.1"
++#define FBSD_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #endif
+diff -r -u gcc-4.4.0.orig/gcc/config/frv/linux.h gcc-4.4.0/gcc/config/frv/linux.h
+--- gcc-4.4.0.orig/gcc/config/frv/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/frv/linux.h	2009-06-06 09:40:07 -0500
+@@ -35,7 +35,7 @@
+ #define ENDFILE_SPEC \
+   "%{shared|pie:crtendS.o%s;:crtend.o%s} crtn.o%s"
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef LINK_SPEC
+ #define LINK_SPEC "\
+diff -r -u gcc-4.4.0.orig/gcc/config/i386/linux.h gcc-4.4.0/gcc/config/i386/linux.h
+--- gcc-4.4.0.orig/gcc/config/i386/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/i386/linux.h	2009-06-06 09:40:07 -0500
+@@ -100,7 +100,7 @@
+ 
+ /* These macros may be overridden in k*bsd-gnu.h and i386/k*bsd-gnu.h. */
+ #define LINK_EMULATION "elf_i386"
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef  ASM_SPEC
+ #define ASM_SPEC \
+diff -r -u gcc-4.4.0.orig/gcc/config/i386/linux64.h gcc-4.4.0/gcc/config/i386/linux64.h
+--- gcc-4.4.0.orig/gcc/config/i386/linux64.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/i386/linux64.h	2009-06-06 09:40:07 -0500
+@@ -58,8 +58,8 @@
+    When the -shared link option is used a final link is not being
+    done.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER32 "/lib/ld-linux.so.2"
+-#define GLIBC_DYNAMIC_LINKER64 "/lib64/ld-linux-x86-64.so.2"
++#define GLIBC_DYNAMIC_LINKER32 "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef ASM_SPEC
+ #define ASM_SPEC "%{v:-V} %{Qy:} %{!Qn:-Qy} %{n} %{T} %{Ym,*} %{Yd,*} \
+diff -r -u gcc-4.4.0.orig/gcc/config/ia64/linux.h gcc-4.4.0/gcc/config/ia64/linux.h
+--- gcc-4.4.0.orig/gcc/config/ia64/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/ia64/linux.h	2009-06-06 09:40:07 -0500
+@@ -37,7 +37,7 @@
+ /* Define this for shared library support because it isn't in the main
+    linux.h file.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux-ia64.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef LINK_SPEC
+ #define LINK_SPEC "\
+diff -r -u gcc-4.4.0.orig/gcc/config/knetbsd-gnu.h gcc-4.4.0/gcc/config/knetbsd-gnu.h
+--- gcc-4.4.0.orig/gcc/config/knetbsd-gnu.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/knetbsd-gnu.h	2009-06-06 09:40:59 -0500
+@@ -34,5 +34,5 @@
+ 
+ #ifdef GLIBC_DYNAMIC_LINKER
+ #undef GLIBC_DYNAMIC_LINKER
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER  DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #endif
+diff -r -u gcc-4.4.0.orig/gcc/config/linux.h gcc-4.4.0/gcc/config/linux.h
+--- gcc-4.4.0.orig/gcc/config/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/linux.h	2009-06-06 09:40:07 -0500
+@@ -117,9 +117,9 @@
+    GLIBC_DYNAMIC_LINKER must be defined for each target using them, or
+    GLIBC_DYNAMIC_LINKER32 and GLIBC_DYNAMIC_LINKER64 for targets
+    supporting both 32-bit and 64-bit compilation.  */
+-#define UCLIBC_DYNAMIC_LINKER "/lib/ld-uClibc.so.0"
+-#define UCLIBC_DYNAMIC_LINKER32 "/lib/ld-uClibc.so.0"
+-#define UCLIBC_DYNAMIC_LINKER64 "/lib/ld64-uClibc.so.0"
++#define UCLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #define LINUX_DYNAMIC_LINKER \
+   CHOOSE_DYNAMIC_LINKER (GLIBC_DYNAMIC_LINKER, UCLIBC_DYNAMIC_LINKER)
+ #define LINUX_DYNAMIC_LINKER32 \
+@@ -135,3 +135,8 @@
+ #define TARGET_HAS_SINCOS (OPTION_GLIBC)
+ 
+ #define TARGET_POSIX_IO
++
++#ifdef NOSTDINC
++#undef STANDARD_INCLUDE_DIR
++#define STANDARD_INCLUDE_DIR 0
++#endif
+diff -r -u gcc-4.4.0.orig/gcc/config/m32r/linux.h gcc-4.4.0/gcc/config/m32r/linux.h
+--- gcc-4.4.0.orig/gcc/config/m32r/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/m32r/linux.h	2009-06-06 09:40:07 -0500
+@@ -58,7 +58,7 @@
+ 
+ /* If ELF is the default format, we should not use /lib/elf.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef	LINK_SPEC
+ #if TARGET_LITTLE_ENDIAN
+diff -r -u gcc-4.4.0.orig/gcc/config/m68k/linux.h gcc-4.4.0/gcc/config/m68k/linux.h
+--- gcc-4.4.0.orig/gcc/config/m68k/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/m68k/linux.h	2009-06-06 09:40:07 -0500
+@@ -84,7 +84,7 @@
+ 
+ /* If ELF is the default format, we should not use /lib/elf.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef LINK_SPEC
+ #define LINK_SPEC "-m m68kelf %{shared} \
+diff -r -u gcc-4.4.0.orig/gcc/config/mips/linux.h gcc-4.4.0/gcc/config/mips/linux.h
+--- gcc-4.4.0.orig/gcc/config/mips/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/mips/linux.h	2009-06-06 09:40:07 -0500
+@@ -64,7 +64,7 @@
+ #undef MIPS_DEFAULT_GVALUE
+ #define MIPS_DEFAULT_GVALUE 0
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ /* Borrowed from sparc/linux.h */
+ #undef LINK_SPEC
+diff -r -u gcc-4.4.0.orig/gcc/config/mips/linux64.h gcc-4.4.0/gcc/config/mips/linux64.h
+--- gcc-4.4.0.orig/gcc/config/mips/linux64.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/mips/linux64.h	2009-06-06 09:40:07 -0500
+@@ -35,10 +35,10 @@
+ %{!shared: \
+   %{profile:-lc_p} %{!profile:-lc}}"
+ 
+-#define GLIBC_DYNAMIC_LINKER32 "/lib/ld.so.1"
+-#define GLIBC_DYNAMIC_LINKER64 "/lib64/ld.so.1"
+-#define GLIBC_DYNAMIC_LINKERN32 "/lib32/ld.so.1"
+-#define UCLIBC_DYNAMIC_LINKERN32 "/lib32/ld-uClibc.so.0"
++#define GLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKERN32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKERN32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #define LINUX_DYNAMIC_LINKERN32 \
+   CHOOSE_DYNAMIC_LINKER (GLIBC_DYNAMIC_LINKERN32, UCLIBC_DYNAMIC_LINKERN32)
+ 
+diff -r -u gcc-4.4.0.orig/gcc/config/mn10300/linux.h gcc-4.4.0/gcc/config/mn10300/linux.h
+--- gcc-4.4.0.orig/gcc/config/mn10300/linux.h	2009-06-06 09:16:11 -0500
++++ gcc-4.4.0/gcc/config/mn10300/linux.h	2009-06-06 09:40:07 -0500
+@@ -32,7 +32,7 @@
+ #undef  ASM_SPEC
+ #define ASM_SPEC "%{Wa,*:%*}"
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef  LINK_SPEC
+ #define LINK_SPEC "%{mrelax:--relax} %{shared:-shared} \
+diff -r -u gcc-4.4.0.orig/gcc/config/rs6000/linux64.h gcc-4.4.0/gcc/config/rs6000/linux64.h
+--- gcc-4.4.0.orig/gcc/config/rs6000/linux64.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/rs6000/linux64.h	2009-06-06 09:40:07 -0500
+@@ -342,10 +342,10 @@
+ #undef	LINK_OS_DEFAULT_SPEC
+ #define LINK_OS_DEFAULT_SPEC "%(link_os_linux)"
+ 
+-#define GLIBC_DYNAMIC_LINKER32 "/lib/ld.so.1"
+-#define GLIBC_DYNAMIC_LINKER64 "/lib64/ld64.so.1"
+-#define UCLIBC_DYNAMIC_LINKER32 "/lib/ld-uClibc.so.0"
+-#define UCLIBC_DYNAMIC_LINKER64 "/lib/ld64-uClibc.so.0"
++#define GLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define UCLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ #if UCLIBC_DEFAULT
+ #define CHOOSE_DYNAMIC_LINKER(G, U) "%{mglibc:%{muclibc:%e-mglibc and -muclibc used together}" G ";:" U "}"
+ #else
+diff -r -u gcc-4.4.0.orig/gcc/config/s390/linux.h gcc-4.4.0/gcc/config/s390/linux.h
+--- gcc-4.4.0.orig/gcc/config/s390/linux.h	2009-06-06 09:16:10 -0500
++++ gcc-4.4.0/gcc/config/s390/linux.h	2009-06-06 09:40:07 -0500
+@@ -72,8 +72,8 @@
+ #define MULTILIB_DEFAULTS { "m31" }
+ #endif
+ 
+-#define GLIBC_DYNAMIC_LINKER32 "/lib/ld.so.1"
+-#define GLIBC_DYNAMIC_LINKER64 "/lib/ld64.so.1"
++#define GLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef  LINK_SPEC
+ #define LINK_SPEC \
+diff -r -u gcc-4.4.0.orig/gcc/config/sh/linux.h gcc-4.4.0/gcc/config/sh/linux.h
+--- gcc-4.4.0.orig/gcc/config/sh/linux.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/sh/linux.h	2009-06-06 09:40:07 -0500
+@@ -47,7 +47,7 @@
+ 
+ #define TARGET_ASM_FILE_END file_end_indicate_exec_stack
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef SUBTARGET_LINK_EMUL_SUFFIX
+ #define SUBTARGET_LINK_EMUL_SUFFIX "_linux"
+diff -r -u gcc-4.4.0.orig/gcc/config/sparc/linux.h gcc-4.4.0/gcc/config/sparc/linux.h
+--- gcc-4.4.0.orig/gcc/config/sparc/linux.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/sparc/linux.h	2009-06-06 09:40:07 -0500
+@@ -83,7 +83,7 @@
+ 
+ /* If ELF is the default format, we should not use /lib/elf.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef  LINK_SPEC
+ #define LINK_SPEC "-m elf32_sparc -Y P,/usr/lib %{shared:-shared} \
+diff -r -u gcc-4.4.0.orig/gcc/config/sparc/linux64.h gcc-4.4.0/gcc/config/sparc/linux64.h
+--- gcc-4.4.0.orig/gcc/config/sparc/linux64.h	2009-06-06 09:16:15 -0500
++++ gcc-4.4.0/gcc/config/sparc/linux64.h	2009-06-06 09:40:07 -0500
+@@ -109,8 +109,8 @@
+ 
+ /* If ELF is the default format, we should not use /lib/elf.  */
+ 
+-#define GLIBC_DYNAMIC_LINKER32 "/lib/ld-linux.so.2"
+-#define GLIBC_DYNAMIC_LINKER64 "/lib64/ld-linux.so.2"
++#define GLIBC_DYNAMIC_LINKER32 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
++#define GLIBC_DYNAMIC_LINKER64 DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #ifdef SPARC_BI_ARCH
+ 
+diff -r -u gcc-4.4.0.orig/gcc/config/xtensa/linux.h gcc-4.4.0/gcc/config/xtensa/linux.h
+--- gcc-4.4.0.orig/gcc/config/xtensa/linux.h	2009-06-06 09:16:10 -0500
++++ gcc-4.4.0/gcc/config/xtensa/linux.h	2009-06-06 09:40:07 -0500
+@@ -43,7 +43,7 @@
+   %{mlongcalls:--longcalls} \
+   %{mno-longcalls:--no-longcalls}"
+ 
+-#define GLIBC_DYNAMIC_LINKER "/lib/ld.so.1"
++#define GLIBC_DYNAMIC_LINKER DYNAMIC_LINKER_PREFIX "/" DYNAMIC_LINKER
+ 
+ #undef LINK_SPEC
+ #define LINK_SPEC \
+diff -r -u gcc-4.4.0.orig/gcc/configure gcc-4.4.0/gcc/configure
+--- gcc-4.4.0.orig/gcc/configure	2009-06-06 09:16:16 -0500
++++ gcc-4.4.0/gcc/configure	2009-06-06 09:40:07 -0500
+@@ -1118,6 +1118,14 @@
+   --with-gc={page,zone}   choose the garbage collection mechanism to use
+                           with the compiler
+   --with-system-zlib      use installed libz
++  --with-dynamic-linker=PATH
++                          specifies path to dynamic linker.
++                          example: "/lib/ld-linux.so.2", where this defines "ld-linux.so.2"
++  --with-dynamic-linker-prefix=PATH
++                          specifies path to dynamic linker.
++                          example: "/lib/ld-linux.so.2", where this defines "/lib"
++  --with-nostdinc         build gcc to ignore standard include directories.
++                          You will have to use --with-local-prefix with this option.
+   --with-slibdir=DIR      shared libraries in DIR [LIBDIR]
+   --with-datarootdir=DIR  Use DIR as the data root [PREFIX/share]
+   --with-docdir=DIR       Install documentation in DIR [DATAROOTDIR]
+@@ -5631,6 +5639,47 @@
+ #define SIZEOF_INT $ac_cv_sizeof_int
+ _ACEOF
+ 
++# Check whether --with-dynamic-linker was given.
++
++DYNAMICLINKER="ld-linux.so.2" ;
++if test "${with_dynamic_linker+set}" = set; then
++  withval="$with_dynamic_linker"
++  case "${withval}" in
++yes)    { { echo "$as_me:$LINENO: error: bad value "${withval}". Use something like --with-dynamic-linker=$DYNAMICLINKER" >&5
++echo "$as_me: error: bad value "${withval}". Use something like --with-dynamic-linker=$DYNAMICLINKER" >&2;}
++   { (exit 1); exit 1; }; } ;;
++no)     ;;
++*)     DYNAMICLINKER=$withval ;;
++esac
++fi;
++
++# Check whether --with-dynamic-linker-prefix= was given.
++
++DYNAMICLINKERPREFIX="/lib" ;
++if test "${with_dynamic_linker_prefix+set}" = set; then
++  withval="$with_dynamic_linker_prefix"
++  case "${withval}" in
++yes)    { { echo "$as_me:$LINENO: error: bad value "${withval}". Use --with-dynamic-linker-prefix=/path/to/lib/" >&5
++echo "$as_me: error: bad value "${withval}". Use --with-dynamic-linker-prefix=/path/to/lib/" >&2;}
++   { (exit 1); exit 1; }; } ;;
++no)     ;;
++*)     DYNAMICLINKERPREFIX=$withval ;;
++esac
++
++fi;
++
++# Check whether --with-nostdinc was given.
++
++if test "${with_nostdinc+set}" = set; then
++  withval="$with_nostdinc"
++  case "${withval}" in
++yes)   NOSTDINC="-DNOSTDINC" ;;
++no)    ;;
++*)     NOSTDINC="-DNOSTDINC" ;;
++esac
++fi;
++
++
+ 
+ echo "$as_me:$LINENO: checking for long" >&5
+ echo $ECHO_N "checking for long... $ECHO_C" >&6
+@@ -25488,6 +25537,9 @@
+ s,@TARGET_SYSTEM_ROOT_DEFINE@,$TARGET_SYSTEM_ROOT_DEFINE,;t t
+ s,@CROSS_SYSTEM_HEADER_DIR@,$CROSS_SYSTEM_HEADER_DIR,;t t
+ s,@onestep@,$onestep,;t t
++s,@DYNAMICLINKER@,$DYNAMICLINKER,;t t
++s,@DYNAMICLINKERPREFIX@,$DYNAMICLINKERPREFIX,;t t
++s,@NOSTDINC@,$NOSTDINC,;t t
+ s,@PKGVERSION@,$PKGVERSION,;t t
+ s,@REPORT_BUGS_TO@,$REPORT_BUGS_TO,;t t
+ s,@REPORT_BUGS_TEXI@,$REPORT_BUGS_TEXI,;t t
\ No newline at end of file
-- 
cgit v1.2.3


From 346e0e7044597f7b0370d1b93870b82ed93f7b73 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:01:24 +0000
Subject: main/gettext: no need for uclibc++

---
 main/gettext/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/gettext/APKBUILD b/main/gettext/APKBUILD
index 5bb26daa..f5ca376e 100644
--- a/main/gettext/APKBUILD
+++ b/main/gettext/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="GNU locale utilities"
 url="http://www.gnu.org/software/gettext/gettext.html"
 license='GPL'
 depends=
-makedepends="libiconv-dev expat-dev ncurses-dev bash uclibc++-dev libxml2-dev"
+makedepends="libiconv-dev expat-dev ncurses-dev bash libxml2-dev libgomp"
 source="ftp://ftp.mirror.nl/pub/mirror/gnu/gettext/gettext-0.17.tar.gz
 	gettext-0.15-expat-no-dlopen.patch
 	gettext-0.17-gnuinfo.patch
-- 
cgit v1.2.3


From 381f24fd97270dbba50010002e71efc0d6368b3b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:02:03 +0000
Subject: main/gperf: dont use uclibc++

---
 main/gperf/APKBUILD | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/main/gperf/APKBUILD b/main/gperf/APKBUILD
index cc97c06d..e52d2df2 100644
--- a/main/gperf/APKBUILD
+++ b/main/gperf/APKBUILD
@@ -6,16 +6,19 @@ pkgdesc="Perfect hash function generator."
 url="http://www.gnu.org/software/gperf/"
 license="GPL"
 subpackages="$pkgname-doc"
-depends="uclibc libgcc uclibc++"
-makedepends="uclibc++-dev"
+depends=
+makedepends=
 source="ftp://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.gz"
 
 build () 
 { 
 	cd "$srcdir"/$pkgname-$pkgver
-	export CXX=g++-uc
 	./configure --prefix=/usr
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 md5sums="c1f1db32fb6598d6a93e6e88796a8632  gperf-3.0.4.tar.gz"
-- 
cgit v1.2.3


From 8dc6852037ea95173a19db63204076153cc5c905 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:02:59 +0000
Subject: main/groff: dont use uclibc++

---
 main/groff/APKBUILD | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/main/groff/APKBUILD b/main/groff/APKBUILD
index 6866c2db..8b9098e3 100644
--- a/main/groff/APKBUILD
+++ b/main/groff/APKBUILD
@@ -5,18 +5,19 @@ pkgrel=1
 pkgdesc="GNU troff text-formatting system"
 url="http://www.gnu.org/software/groff/groff.html"
 license="GPL"
-depends="uclibc uclibc++ libgcc"
-makedepends="perl texinfo uclibc++-dev"
+depends=
+makedepends="perl texinfo"
 subpackages="$pkgname-doc"
 source="ftp://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.gz"
 
 build () {
 	cd "$srcdir/$pkgname-$pkgver"
-
-	export CXX=g++-uc
 	./configure --prefix=/usr --without-x
-
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 }
 md5sums="48fa768dd6fdeb7968041dd5ae8e2b02  groff-1.20.1.tar.gz"
-- 
cgit v1.2.3


From bf1b6687fd45bdbf4ae20da6f1725ba2ed913e94 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:04:51 +0000
Subject: main/hunspell: dont use uclibc++

---
 main/hunspell/APKBUILD | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/main/hunspell/APKBUILD b/main/hunspell/APKBUILD
index 6883855a..baf7876c 100644
--- a/main/hunspell/APKBUILD
+++ b/main/hunspell/APKBUILD
@@ -6,17 +6,19 @@ pkgdesc="Spell checker and morphological analyzer library and program"
 url="http://hunspell.sourceforge.net/"
 license="GPL LGPL MPL"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="libgcc uclibc++"
-makedepends="uclibc++-dev"
+depends=
+makedepends=
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
 
 build ()
 {
 	cd "$srcdir/hunspell-$pkgver"
-	export CXX="${CXX_UC:-g++-uc}"
-
 	./configure --prefix=/usr --disable-static || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/hunspell-$pkgver"
 	make DESTDIR="$pkgdir" install || return 1
 	rm -rf "$pkgdir"/usr/share/locale/locale.alias
 }
-- 
cgit v1.2.3


From 1eaeb70f388cfe3d10dc6825f947fdeeecf6ac44 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:10:26 +0000
Subject: main/policyd-spf-fs: build fix for nptl

we dont have libnsl anymore
---
 main/policyd-spf-fs/APKBUILD | 1 +
 1 file changed, 1 insertion(+)

diff --git a/main/policyd-spf-fs/APKBUILD b/main/policyd-spf-fs/APKBUILD
index 34c7e90f..116c4188 100644
--- a/main/policyd-spf-fs/APKBUILD
+++ b/main/policyd-spf-fs/APKBUILD
@@ -24,6 +24,7 @@ build() {
 		msg "Apply $i"
 		patch -p1 < $i || return 1
 	done
+	sed -i -e 's/-lnsl//' Makefile
 						
 	make CFLAGS+=-DHAVE_NS_TYPE || return 1
 
-- 
cgit v1.2.3


From cff79a00ec4dc26a3caa16c174a07a3948da4810 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:19:59 +0000
Subject: main/[various]: let abuild detect shared objects dependencies

---
 main/amavisd-new/APKBUILD   |  2 +-
 main/bbsuid/APKBUILD        |  2 +-
 main/beep/APKBUILD          |  2 +-
 main/bridge-utils/APKBUILD  |  4 ++--
 main/bzip2/APKBUILD         |  2 +-
 main/ccache/APKBUILD        |  2 +-
 main/cpufreqd/APKBUILD      |  6 +++++-
 main/cracklib/APKBUILD      |  2 +-
 main/cramfs/APKBUILD        |  7 +++++--
 main/ctags/APKBUILD         |  2 +-
 main/cutter/APKBUILD        |  2 +-
 main/cvs/APKBUILD           |  2 +-
 main/dialog/APKBUILD        |  7 +++++--
 main/diffutils/APKBUILD     |  2 +-
 main/dtach/APKBUILD         |  2 +-
 main/email/APKBUILD         |  2 +-
 main/ethtool/APKBUILD       |  2 +-
 main/fcgi/APKBUILD          |  2 +-
 main/flac/APKBUILD          |  6 +++++-
 main/fping/APKBUILD         |  2 +-
 main/gdbm/APKBUILD          |  2 +-
 main/gnats/APKBUILD         |  2 +-
 main/haserl/APKBUILD        |  7 +++++--
 main/ksymoops/APKBUILD      |  2 +-
 main/less/APKBUILD          |  7 +++++--
 main/lha/APKBUILD           |  2 +-
 main/libao/APKBUILD         |  6 +++++-
 main/libgpg-error/APKBUILD  |  2 +-
 main/libiconv/APKBUILD      |  2 +-
 main/libmcrypt/APKBUILD     |  2 +-
 main/libnfnetlink/APKBUILD  |  2 +-
 main/libsamplerate/APKBUILD |  2 +-
 main/libusb-compat/APKBUILD |  9 ++++++---
 main/libusb/APKBUILD        |  2 +-
 main/lzo/APKBUILD           |  2 +-
 main/mpfr/APKBUILD          |  1 -
 main/pth/APKBUILD           |  2 +-
 main/razor/APKBUILD         |  2 +-
 main/sfic/APKBUILD          | 17 ++++++++++++-----
 main/sic/APKBUILD           |  2 +-
 main/sysfsutils/APKBUILD    |  2 +-
 main/uiconv/APKBUILD        |  2 +-
 main/unarj/APKBUILD         |  2 +-
 main/unfs3/APKBUILD         |  2 +-
 main/v86d/APKBUILD          |  2 +-
 main/valgrind/APKBUILD      |  2 +-
 main/zip/APKBUILD           |  2 +-
 main/zonenotify/APKBUILD    |  2 +-
 48 files changed, 92 insertions(+), 59 deletions(-)

diff --git a/main/amavisd-new/APKBUILD b/main/amavisd-new/APKBUILD
index 69292171..ad9ef36e 100644
--- a/main/amavisd-new/APKBUILD
+++ b/main/amavisd-new/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=1
 pkgdesc="High-performance interface between mailer (MTA) and content checkers"
 url="http://www.ijs.si/software/amavisd"
 license="GPL-2"
-depends="uclibc sed file perl perl-archive-zip perl-convert-tnef
+depends="sed file perl perl-archive-zip perl-convert-tnef
 perl-convert-uulib perl-mime-tools perl-mail-tools perl-net-server
 perl-io-stringy perl-unix-syslog perl-db perl-mail-dkim"
 makedepends=""
diff --git a/main/bbsuid/APKBUILD b/main/bbsuid/APKBUILD
index 45db1e43..8a157b39 100644
--- a/main/bbsuid/APKBUILD
+++ b/main/bbsuid/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="Busybox SUID root application wrapper"
 url="http://git.alpinelinux.org/cgit/bbsuid"
 license="GPL-2"
-depends="uclibc busybox"
+depends="busybox"
 source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2"
 
 build() {
diff --git a/main/beep/APKBUILD b/main/beep/APKBUILD
index 74299820..3cd12e98 100644
--- a/main/beep/APKBUILD
+++ b/main/beep/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="A terminal bell"
 url="http://johnath.com/beep"
 license="GPL-2"
-depends="uclibc"
+depends=""
 makedepends=""
 #install=
 subpackages="$pkgname-doc"
diff --git a/main/bridge-utils/APKBUILD b/main/bridge-utils/APKBUILD
index d76110b1..e4d111a2 100644
--- a/main/bridge-utils/APKBUILD
+++ b/main/bridge-utils/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Tools for configuring the Linux kernel 802.1d Ethernet Bridge"
 url="http://linux-net.osdl.org/index.php/Bridge"
 license="GPL-2"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="uclibc"
+depends=""
 makedepends="autoconf"
 source="http://downloads.sourceforge.net/project/bridge/bridge/bridge-utils-$pkgver/bridge-utils-$pkgver.tar.gz"
 #"http://download.sourceforge.net/bridge/$pkgname-$pkgver.tar.gz"
@@ -15,7 +15,7 @@ build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	autoconf
 	# src_compile
-	configure --prefix=/ \
+	./configure --prefix=/ \
 		--mandir=/usr/share/man \
 		--libdir=/usr/lib \
 		--includedir=/usr/include \
diff --git a/main/bzip2/APKBUILD b/main/bzip2/APKBUILD
index 09721bb7..6805ac6e 100644
--- a/main/bzip2/APKBUILD
+++ b/main/bzip2/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=1
 pkgdesc="A high-quality data compression program"
 url="http://sources.redhat.com/bzip2"
 license="BZIP2"
-depends="uclibc"
+depends=""
 install="$pkgname.post-deinstall"
 source="http://www.bzip.org/$pkgver/$pkgname-$pkgver.tar.gz
 	$install
diff --git a/main/ccache/APKBUILD b/main/ccache/APKBUILD
index 2143bdb7..c93eb7ad 100644
--- a/main/ccache/APKBUILD
+++ b/main/ccache/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="ccache is a compiler cache"
 url="http://ccache.samba.org/"
 license="GPL"
 subpackages="$pkgname-doc"
-depends="uclibc"
+depends=""
 makedepends=""
 source="http://samba.org/ftp/$pkgname/$pkgname-$pkgver.tar.gz"
 
diff --git a/main/cpufreqd/APKBUILD b/main/cpufreqd/APKBUILD
index 98d7f94c..7cc8929c 100644
--- a/main/cpufreqd/APKBUILD
+++ b/main/cpufreqd/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="A small daemon to adjust cpu speed (and indeed voltage)"
 url="http://sourceforge.net/projects/cpufreqd"
 license="GPL2"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="cpufrequtils sysfsutils uclibc"
+depends=
 makedepends="cpufrequtils-dev sysfsutils-dev g++"
 install=
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.bz2
@@ -18,6 +18,10 @@ build ()
 	./configure --prefix=/usr \
 		--sysconfdir=/etc
 	make LIBS=-lpthread || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 	install -Dm 755 ../cpufreqd.initd "$pkgdir"/etc/init.d/cpufreqd \
 		|| return 1
diff --git a/main/cracklib/APKBUILD b/main/cracklib/APKBUILD
index e03c6a77..edec6318 100644
--- a/main/cracklib/APKBUILD
+++ b/main/cracklib/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="A library used to enforce strong passwords"
 url="http://sourceforge.net/projects/cracklib"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages="$pkgname-dev"
diff --git a/main/cramfs/APKBUILD b/main/cramfs/APKBUILD
index e40e57c2..f4f1f65d 100644
--- a/main/cramfs/APKBUILD
+++ b/main/cramfs/APKBUILD
@@ -6,14 +6,17 @@ pkgdesc="Linux filesystem designed to be simple, small, and to compress things w
 arch=""
 url="http://sourceforge.net/projects/cramfs/"
 license='GPL'
-depends="uclibc zlib"
+depends=
 makedepends="zlib-dev"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-
 	make CFLAGS="$CFLAGS" || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	install -d "$pkgdir"/sbin
 	install mkcramfs cramfsck "$pkgdir"/sbin
 }
diff --git a/main/ctags/APKBUILD b/main/ctags/APKBUILD
index b986f9c9..108355c6 100644
--- a/main/ctags/APKBUILD
+++ b/main/ctags/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="Generator of tags for all types of C/C++ languages"
 url="http://ctags.sourceforge.net/"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages=""
diff --git a/main/cutter/APKBUILD b/main/cutter/APKBUILD
index be27d880..50041ef7 100644
--- a/main/cutter/APKBUILD
+++ b/main/cutter/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=1
 pkgdesc="A program that allows firewall administrators to abort TCP/IP connections."
 url="http://www.lowth.com/cutter"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages=""
diff --git a/main/cvs/APKBUILD b/main/cvs/APKBUILD
index bcfcea6f..478fa884 100644
--- a/main/cvs/APKBUILD
+++ b/main/cvs/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="Concurrent Versions System"
 url="http://www.nongnu.org/cvs/"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages="$pkgname-doc"
diff --git a/main/dialog/APKBUILD b/main/dialog/APKBUILD
index 99619e31..b06fb701 100644
--- a/main/dialog/APKBUILD
+++ b/main/dialog/APKBUILD
@@ -7,7 +7,7 @@ pkgrel=0
 pkgdesc="A script-interpreter which provides a set of curses"
 url="http://invisible-island.net/dialog/dialog.html"
 license="GPL"
-depends="uclibc ncurses"
+depends=
 makedepends="ncurses-dev"
 install=
 subpackages="$pkgname-doc"
@@ -15,12 +15,15 @@ source="ftp://invisible-island.net/dialog/$pkgname.tar.gz"
 
 build() {
 	cd "$srcdir/$pkgname-$_ver"
-
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$_ver"
 	make DESTDIR="$pkgdir" install
 }
 
diff --git a/main/diffutils/APKBUILD b/main/diffutils/APKBUILD
index 004d0e91..defa57ba 100644
--- a/main/diffutils/APKBUILD
+++ b/main/diffutils/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Show differences among files"
 subpackages="$pkgname-doc"
 url="http://www.gnu.org/software/diffutils/"
 license="GPL2"
-depends="uclibc"
+depends=""
 makedepends=""
 install="$pkgname.post-deinstall"
 source="http://ftp.gnu.org/pub/gnu/$pkgname/$pkgname-$pkgver.tar.gz
diff --git a/main/dtach/APKBUILD b/main/dtach/APKBUILD
index 120ef4ee..dd0a3779 100644
--- a/main/dtach/APKBUILD
+++ b/main/dtach/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="A program that emulates the detach feature of screen"
 url="http://dtach.sourceforge.net"
 license='GPL'
-depends="uclibc"
+depends=""
 makedepends=""
 source="http://surfnet.dl.sourceforge.net/sourceforge/dtach/dtach-0.8.tar.gz"
 subpackages="$pkgname-doc"
diff --git a/main/email/APKBUILD b/main/email/APKBUILD
index a1301fe0..eff4f3c5 100644
--- a/main/email/APKBUILD
+++ b/main/email/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="A command line SMTP client that's simple"
 url="http://www.cleancode.org/projects/email"
 license="GPL"
-depends="uclibc openssl"
+depends="openssl"
 makedepends="openssl-dev"
 source="http://www.cleancode.org/downloads/email/email-3.1.2.tar.bz2"
 
diff --git a/main/ethtool/APKBUILD b/main/ethtool/APKBUILD
index 50c92d40..7532afc2 100644
--- a/main/ethtool/APKBUILD
+++ b/main/ethtool/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="gkernel ethtool"
 url="http://sourceforge.net/projects/gkernel/"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 source="http://easynews.dl.sf.net/sourceforge/gkernel/$pkgname-$pkgver.tar.gz"
 subpackages="$pkgname-doc"
diff --git a/main/fcgi/APKBUILD b/main/fcgi/APKBUILD
index fc208006..c3a760b3 100644
--- a/main/fcgi/APKBUILD
+++ b/main/fcgi/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="FAST CGI(fcgi) is a language independent, high performant extension to CGI"
 url="http://www.fastcgi.com"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 subpackages="$pkgname-dev"
 source="http://www.fastcgi.com/dist/${pkgname}-${pkgver}.tar.gz
diff --git a/main/flac/APKBUILD b/main/flac/APKBUILD
index a5626e1c..d38a07e0 100644
--- a/main/flac/APKBUILD
+++ b/main/flac/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Free Lossless Audio Codec"
 url="http://flac.sourceforge.net/"
 license="custom:Xiph LGPL GPL FDL"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="uclibc libogg"
+depends=
 makedepends="libogg-dev"
 source="http://downloads.sf.net/sourceforge/$pkgname/$pkgname-$pkgver.tar.gz
 	"
@@ -23,6 +23,10 @@ build () {
 		--disable-cpplibs \
 		--with-pic || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver || return 1
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm0644 COPYING.Xiph \
 		"$pkgdir"/usr/share/licenses/$pkgname/COPYING.Xiph
diff --git a/main/fping/APKBUILD b/main/fping/APKBUILD
index 11b4f181..ff529711 100644
--- a/main/fping/APKBUILD
+++ b/main/fping/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=1
 pkgdesc="A utility to ping multiple hosts at once"
 url="http://www.fping.com/"
 license="fping"
-depends="uclibc"
+depends=""
 subpackages="$pkgname-doc"
 
 # what happened to upstream download? use gentoo distfiles meanwhile
diff --git a/main/gdbm/APKBUILD b/main/gdbm/APKBUILD
index e20966b3..9ef44e74 100644
--- a/main/gdbm/APKBUILD
+++ b/main/gdbm/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="GNU dbm is a set of database routines that use extensible hashing"
 url="http://www.gnu.org/software/gdbm/"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages="$pkgname-dev $pkgname-dev"
diff --git a/main/gnats/APKBUILD b/main/gnats/APKBUILD
index 535f46ee..87ca01e2 100644
--- a/main/gnats/APKBUILD
+++ b/main/gnats/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=2
 pkgdesc="The GNU Bug Tracking System"
 url="http://www.gnu.org/software/gnats/"
 license="GPL-2"
-depends="uclibc postfix"
+depends="postfix"
 makedepends="texinfo"
 install="gnats.pre-install"
 source="http://ftp.gnu.org/pub/gnu/$pkgname/$pkgname-$pkgver.tar.gz
diff --git a/main/haserl/APKBUILD b/main/haserl/APKBUILD
index 2c4e08e4..4f742cd3 100644
--- a/main/haserl/APKBUILD
+++ b/main/haserl/APKBUILD
@@ -5,16 +5,19 @@ pkgrel=1
 pkgdesc="Html And Shell Embedded Report Language"
 url="http://haserl.sourceforge.net/"
 license="GPL-2"
-depends="lua uclibc"
+depends=
 makedepends="lua-dev"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
 subpackages="$pkgname-doc"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-
 	./configure --prefix=/usr --with-lua || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir/" install
 	chmod 4111 "$pkgdir"/usr/bin/haserl
 }
diff --git a/main/ksymoops/APKBUILD b/main/ksymoops/APKBUILD
index d8cc04fd..44736384 100644
--- a/main/ksymoops/APKBUILD
+++ b/main/ksymoops/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="A Linux kernel Oops file troubleshooting tool"
 url="ftp://ftp.kernel.org/pub/linux/utils/kernel/ksymoops/v2.4"
 license="GPL-2"
-depends="uclibc"
+depends=""
 makedepends="!gettext !libiconv"
 source="ftp://ftp.kernel.org/pub/linux/utils/kernel/$pkgname/v2.4/$pkgname-$pkgver.tar.bz2
 	$pkgname-2.4.11-build.patch
diff --git a/main/less/APKBUILD b/main/less/APKBUILD
index 188a7b91..8fdbb273 100644
--- a/main/less/APKBUILD
+++ b/main/less/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="File pager"
 url="http://www.greenwoodsoftware.com/less/"
 license="GPL"
-depends="uclibc ncurses"
+depends=
 makedepends="ncurses-dev"
 install="$pkgname.post-deinstall"
 subpackages="$pkgname-doc"
@@ -15,12 +15,15 @@ source="http://www.greenwoodsoftware.com/$pkgname/$pkgname-$pkgver.tar.gz
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 }
 
diff --git a/main/lha/APKBUILD b/main/lha/APKBUILD
index 705e51e0..fc075b3c 100644
--- a/main/lha/APKBUILD
+++ b/main/lha/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Compression and archive utility for LH-7 format archives"
 url="http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
 license="custom"
 subpackages="$pkgname-doc"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 source="http://osdn.dl.sourceforge.jp/lha/22231/$pkgname-$pkgver-ac20050924p1.tar.gz"
diff --git a/main/libao/APKBUILD b/main/libao/APKBUILD
index a82ba465..f028bab0 100644
--- a/main/libao/APKBUILD
+++ b/main/libao/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Cross-platform audio output library and plugins"
 url="http://www.xiph.org/ao"
 license="GPL"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="uclibc alsa-lib"
+depends=
 makedepends="alsa-lib-dev"
 source="http://downloads.xiph.org/releases/ao/$pkgname-$pkgver.tar.gz"
 
@@ -17,6 +17,10 @@ build () {
 		--disable-esd \
 		--disable-arts
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 md5sums="b92cba3cbcf1ee9bc221118a85d23dcd  libao-0.8.8.tar.gz"
diff --git a/main/libgpg-error/APKBUILD b/main/libgpg-error/APKBUILD
index 24cac436..75e401e3 100644
--- a/main/libgpg-error/APKBUILD
+++ b/main/libgpg-error/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="Support library for libgcrypt"
 url="http://www.gnupg.org"
 license="LGPL"
-depends="uclibc"
+depends=""
 subpackages="$pkgname-dev $pkgname-lisp"
 source="ftp://ftp.franken.de/pub/crypt/mirror/ftp.gnupg.org/gcrypt/$pkgname/$pkgname-$pkgver.tar.bz2
 	nocxx.patch
diff --git a/main/libiconv/APKBUILD b/main/libiconv/APKBUILD
index 6cd441ca..e8175dd5 100644
--- a/main/libiconv/APKBUILD
+++ b/main/libiconv/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="GNU charset conversion library for libc which doesn't implement it"
 url="http://www.gnu.org/software/libiconv"
 license='LGPL'
-depends="uclibc"
+depends=""
 source="http://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.12.tar.gz"
 subpackages="$pkgname-doc $pkgname-dev"
 
diff --git a/main/libmcrypt/APKBUILD b/main/libmcrypt/APKBUILD
index 905d880f..27d6523b 100644
--- a/main/libmcrypt/APKBUILD
+++ b/main/libmcrypt/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="A library which provides a uniform interface to several symmetric encryption algorithms"
 url="http://mcrypt.sourceforge.net/"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends="libtool uclibc++-dev"
 install=
 subpackages="$pkgname-doc $pkgname-dev"
diff --git a/main/libnfnetlink/APKBUILD b/main/libnfnetlink/APKBUILD
index 69f887b3..448b5557 100644
--- a/main/libnfnetlink/APKBUILD
+++ b/main/libnfnetlink/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="low-level library for netfilter related kernel/userspace communication"
 url="http://www.netfilter.org/projects/libnfnetlink/"
 license="GPL-2"
-depends="uclibc"
+depends=""
 makedepends=""
 subpackages="$pkgname-dev"
 source="http://www.netfilter.org/projects/libnfnetlink/files/libnfnetlink-$pkgver.tar.bz2"
diff --git a/main/libsamplerate/APKBUILD b/main/libsamplerate/APKBUILD
index 786d6c1e..8c3d75c1 100644
--- a/main/libsamplerate/APKBUILD
+++ b/main/libsamplerate/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Secret Rabbit Code - aka Sample Rate Converter for audio"
 url="http://www.mega-nerd.com/SRC/index.html"
 subpackages="$pkgname-dev"
 license="GPL"
-depends="uclibc"
+depends=""
 source="http://www.mega-nerd.com/SRC/$pkgname-$pkgver.tar.gz"
 
 build () {
diff --git a/main/libusb-compat/APKBUILD b/main/libusb-compat/APKBUILD
index 23e16cfa..3ebdb277 100644
--- a/main/libusb-compat/APKBUILD
+++ b/main/libusb-compat/APKBUILD
@@ -6,15 +6,18 @@ pkgdesc="Compatility for older libusb"
 url="http://libusb.sourceforge.net/"
 license="LGPL"
 subpackages="$pkgname-dev"
-depends="uclibc libusb"
+depends=
 makedepends="libusb-dev"
 source="http://downloads.sourceforge.net/libusb/$pkgname-$pkgver.tar.bz2"
 
-build () 
-{ 
+build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr --disable-build-docs
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 md5sums="652e1d9e6c6912fd924a5ad204f6d48b  libusb-compat-0.1.0.tar.bz2"
diff --git a/main/libusb/APKBUILD b/main/libusb/APKBUILD
index 7234ad31..f9547ac6 100644
--- a/main/libusb/APKBUILD
+++ b/main/libusb/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Library to enable user space application programs to communicate with U
 url="http://libusb.sourceforge.net/"
 license="LGPL"
 subpackages="$pkgname-dev"
-depends="uclibc"
+depends=""
 makedepends=""
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.bz2"
 
diff --git a/main/lzo/APKBUILD b/main/lzo/APKBUILD
index a9f2b912..52c53d5d 100644
--- a/main/lzo/APKBUILD
+++ b/main/lzo/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="LZO -- a real-time data compression library"
 url="http://www.oberhumer.com/opensource/lzo"
 license="GPL"
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 subpackages="$pkgname-dev"
diff --git a/main/mpfr/APKBUILD b/main/mpfr/APKBUILD
index 63914e04..9e529fa1 100644
--- a/main/mpfr/APKBUILD
+++ b/main/mpfr/APKBUILD
@@ -16,7 +16,6 @@ build() {
 		--disable-thread-safe \
 		--enable-shared || return 1;
 	make || return 1;
-	make check
 }
 
 package() {
diff --git a/main/pth/APKBUILD b/main/pth/APKBUILD
index ce5cc5e1..23217bfc 100644
--- a/main/pth/APKBUILD
+++ b/main/pth/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="The GNU Portable Threads."
 url="http://www.gnu.org/software/pth"
 license="LGPL-2.1"
-depends="uclibc"
+depends=""
 subpackages="$pkgname-dev $pkgname-doc"
 source="ftp://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.gz
 	pth-2.0.5-parallelfix.patch
diff --git a/main/razor/APKBUILD b/main/razor/APKBUILD
index a5dc72c6..45950c98 100644
--- a/main/razor/APKBUILD
+++ b/main/razor/APKBUILD
@@ -7,7 +7,7 @@ pkgrel=0
 pkgdesc="Vipul's Razor is a distributed, collaborative spam detection and filtering network"
 url="http://razor.sourceforge.net/"
 license="Artistic"
-depends="uclibc perl perl-digest-sha1 perl-getopt-long perl-uri-escape"
+depends="perl perl-digest-sha1 perl-getopt-long perl-uri-escape"
 makedepends="perl-dev"
 install=
 subpackages="$pkgname-doc"
diff --git a/main/sfic/APKBUILD b/main/sfic/APKBUILD
index 3f781b4d..0aebac7a 100644
--- a/main/sfic/APKBUILD
+++ b/main/sfic/APKBUILD
@@ -2,26 +2,33 @@ pkgdesc="Small and Simple File Integrity Checker"
 pkgname=sfic
 pkgver=0.1.7
 pkgrel=1
-depends=uclibc
+depends=
 license=GPL
 makedepends="autoconf automake samba-dev"
-depends="tdb uclibc"
-arch=i486
+depends=
 url=http://sfic.sourceforge.net
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
 	$pkgname-0.1.7-signal.patch"
 
 subpackages="$pkgname-doc"
 
-build() {
-	cd $srcdir/$pkgname-$pkgver
+prepare() {
+	cd "$srcdir"/$pkgname-$pkgver
 	patch -p1 < ../$pkgname-0.1.7-signal.patch || return 1 
 		
 	aclocal
 	autoconf
 	automake --add-missing || return 1
+}
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make install DESTDIR="$pkgdir"
 }
 
diff --git a/main/sic/APKBUILD b/main/sic/APKBUILD
index 72e197ea..0ffc4c44 100644
--- a/main/sic/APKBUILD
+++ b/main/sic/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="an extremely simple IRC client"
 url="http://www.suckless.org/programs/sic.html"
 license="GPL"
-depends="uclibc"
+depends=""
 subpackages="$pkgname-doc"
 source="http://code.suckless.org/dl/tools/sic-$pkgver.tar.gz"
 
diff --git a/main/sysfsutils/APKBUILD b/main/sysfsutils/APKBUILD
index e462aec7..64dfe96d 100644
--- a/main/sysfsutils/APKBUILD
+++ b/main/sysfsutils/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=3
 pkgdesc="System Utilities Based on Sysfs"
 url="http://linux-diag.sourceforge.net/Sysfsutils.html"
 license="GPL LGPL"
-depends="uclibc"
+depends=""
 makedepends=""
 subpackages="$pkgname-dev $pkgname-doc"
 source="http://downloads.sourceforge.net/sourceforge/linux-diag/$pkgname-$pkgver.tar.gz"
diff --git a/main/uiconv/APKBUILD b/main/uiconv/APKBUILD
index 3814bb56..1e4aac3b 100644
--- a/main/uiconv/APKBUILD
+++ b/main/uiconv/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="Micro iconv implementation"
 url="http://git.alpinelinux.org/cgit/uiconv"
 license="GPL"
-depends="uclibc"
+depends=""
 source="http://git.alpinelinux.org/cgit/$pkgname/snapshots/$pkgname-$pkgver.tar.bz2"
 
 build() {
diff --git a/main/unarj/APKBUILD b/main/unarj/APKBUILD
index b2e0c726..7f5b23fc 100644
--- a/main/unarj/APKBUILD
+++ b/main/unarj/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Extracting, testing and  viewing the contents of archives created with
 url="http://www.arjsoftware.com"
 license="custom"
 subpackages=""
-depends="uclibc"
+depends=""
 makedepends=""
 install=
 source="http://ibiblio.org/pub/Linux/utils/compress/$pkgname-$pkgver.tar.gz"
diff --git a/main/unfs3/APKBUILD b/main/unfs3/APKBUILD
index 28de3015..bfadf938 100644
--- a/main/unfs3/APKBUILD
+++ b/main/unfs3/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="a user-space implementation of the NFSv3 server specification"
 url="http://unfs3.sourceforge.net/"
 license='GPL'
-depends="uclibc"
+depends=""
 makedepends="flex"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
 subpackages="$pkgname-doc"
diff --git a/main/v86d/APKBUILD b/main/v86d/APKBUILD
index 8bcdcf61..626fc295 100644
--- a/main/v86d/APKBUILD
+++ b/main/v86d/APKBUILD
@@ -4,7 +4,7 @@ pkgver=0.1.9
 pkgdesc="userspace helper for uvesafb that runs x86 code in an emulated environment"
 url="http://dev.gentoo.org/~spock/projects/uvesafb/"
 license="GPL2"
-depends="uclibc"
+depends=""
 makedepends="bash"
 source="http://dev.gentoo.org/~spock/projects/uvesafb/archive/$pkgname-$pkgver.tar.bz2
 	modprobe.uvesafb"
diff --git a/main/valgrind/APKBUILD b/main/valgrind/APKBUILD
index dcba2983..c2120d31 100644
--- a/main/valgrind/APKBUILD
+++ b/main/valgrind/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=1
 pkgdesc="A tool to help find memory-management problems in programs"
 url="http://valgrind.org/"
 license="GPL"
-depends="uclibc"
+depends=""
 # it seems like busybox sed works but the configure script requires GNU sed
 makedepends="sed paxctl pax-utils"
 # from README_PACKAGERS:
diff --git a/main/zip/APKBUILD b/main/zip/APKBUILD
index 4998c35b..426a6d4c 100644
--- a/main/zip/APKBUILD
+++ b/main/zip/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=0
 pkgdesc="Creates PKZIP-compatible .zip files"
 url="http://www.info-zip.org/pub/infozip/Zip.html"
 license="AS IS"
-depends="uclibc"
+depends=""
 makedepends=""
 source="ftp://ftp.info-${pkgname}.org/pub/info${pkgname}/src/${pkgname}30.zip
 10-zip-3.0-build.patch
diff --git a/main/zonenotify/APKBUILD b/main/zonenotify/APKBUILD
index 9709eba4..b76718e3 100644
--- a/main/zonenotify/APKBUILD
+++ b/main/zonenotify/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="Utility to send NS_NOTIFY packets to slave DNS servers"
 arch=""
 url="http://www.morettoni.net/zonenotify.en.html"
 license='BSD'
-depends="uclibc"
+depends=""
 source="http://www.morettoni.net/bsd/$pkgname-$pkgver.tar.gz"
 
 build() {
-- 
cgit v1.2.3


From b4eecaf058de2e73819dff5e48cdbcf1eb3612ba Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:26:51 +0000
Subject: main/[various]: bump pkgrel to force rebuild against nptl

---
 main/a2ps/APKBUILD                      | 2 +-
 main/a52dec/APKBUILD                    | 2 +-
 main/abiword/APKBUILD                   | 2 +-
 main/abuild/APKBUILD                    | 2 +-
 main/acct/APKBUILD                      | 2 +-
 main/alpine-baselayout/APKBUILD         | 2 +-
 main/alsa-lib/APKBUILD                  | 2 +-
 main/antiword/APKBUILD                  | 2 +-
 main/apcupsd/APKBUILD                   | 2 +-
 main/apg/APKBUILD                       | 2 +-
 main/apk-tools/APKBUILD                 | 2 +-
 main/apr-util/APKBUILD                  | 2 +-
 main/apr/APKBUILD                       | 2 +-
 main/arpon/APKBUILD                     | 2 +-
 main/arpwatch/APKBUILD                  | 2 +-
 main/aspell/APKBUILD                    | 2 +-
 main/asterisk/APKBUILD                  | 2 +-
 main/aterm/APKBUILD                     | 2 +-
 main/atk/APKBUILD                       | 2 +-
 main/atop/APKBUILD                      | 2 +-
 main/attr/APKBUILD                      | 2 +-
 main/aumix/APKBUILD                     | 2 +-
 main/b43-fwcutter/APKBUILD              | 2 +-
 main/bash/APKBUILD                      | 2 +-
 main/bbsuid/APKBUILD                    | 2 +-
 main/bc/APKBUILD                        | 2 +-
 main/bdftopcf/APKBUILD                  | 2 +-
 main/beecrypt/APKBUILD                  | 2 +-
 main/beep/APKBUILD                      | 2 +-
 main/bind/APKBUILD                      | 2 +-
 main/bison/APKBUILD                     | 2 +-
 main/bridge-utils/APKBUILD              | 2 +-
 main/busybox/APKBUILD                   | 2 +-
 main/bwm-ng/APKBUILD                    | 2 +-
 main/bzip2/APKBUILD                     | 2 +-
 main/c-ares/APKBUILD                    | 2 +-
 main/cabextract/APKBUILD                | 2 +-
 main/cairo/APKBUILD                     | 2 +-
 main/ccache/APKBUILD                    | 2 +-
 main/cciss_vol_status/APKBUILD          | 2 +-
 main/cdrkit/APKBUILD                    | 2 +-
 main/cgit/APKBUILD                      | 2 +-
 main/chrony/APKBUILD                    | 2 +-
 main/cksfv/APKBUILD                     | 2 +-
 main/clamav/APKBUILD                    | 2 +-
 main/clamsmtp/APKBUILD                  | 2 +-
 main/cmake/APKBUILD                     | 2 +-
 main/confuse/APKBUILD                   | 2 +-
 main/conntrack-tools/APKBUILD           | 2 +-
 main/coreutils/APKBUILD                 | 2 +-
 main/cpufreqd/APKBUILD                  | 2 +-
 main/cpufrequtils/APKBUILD              | 2 +-
 main/cracklib/APKBUILD                  | 2 +-
 main/cramfs/APKBUILD                    | 2 +-
 main/ctags/APKBUILD                     | 2 +-
 main/cups/APKBUILD                      | 2 +-
 main/curl/APKBUILD                      | 2 +-
 main/cutter/APKBUILD                    | 2 +-
 main/cvs/APKBUILD                       | 2 +-
 main/cyrus-sasl/APKBUILD                | 2 +-
 main/dahdi-tools/APKBUILD               | 2 +-
 main/dansguardian/APKBUILD              | 2 +-
 main/db/APKBUILD                        | 2 +-
 main/dbus-glib/APKBUILD                 | 2 +-
 main/dbus/APKBUILD                      | 2 +-
 main/debootstrap/APKBUILD               | 2 +-
 main/desktop-file-utils/APKBUILD        | 2 +-
 main/dhcp/APKBUILD                      | 2 +-
 main/dhcpcd-dbus/APKBUILD               | 2 +-
 main/dhcpcd-ui/APKBUILD                 | 2 +-
 main/dhcpcd/APKBUILD                    | 2 +-
 main/dialog/APKBUILD                    | 2 +-
 main/diffutils/APKBUILD                 | 2 +-
 main/dircproxy/APKBUILD                 | 2 +-
 main/distcc/APKBUILD                    | 2 +-
 main/djbdns/APKBUILD                    | 2 +-
 main/dnsmasq/APKBUILD                   | 2 +-
 main/dosfstools/APKBUILD                | 2 +-
 main/dovecot/APKBUILD                   | 2 +-
 main/dpkg/APKBUILD                      | 2 +-
 main/dropbear/APKBUILD                  | 2 +-
 main/dtach/APKBUILD                     | 2 +-
 main/e2fsprogs/APKBUILD                 | 2 +-
 main/eggdrop/APKBUILD                   | 2 +-
 main/email/APKBUILD                     | 2 +-
 main/enchant/APKBUILD                   | 2 +-
 main/epdfview/APKBUILD                  | 2 +-
 main/epris/APKBUILD                     | 2 +-
 main/espeak/APKBUILD                    | 2 +-
 main/ethtool/APKBUILD                   | 2 +-
 main/exo/APKBUILD                       | 2 +-
 main/expat/APKBUILD                     | 2 +-
 main/ez-ipupdate/APKBUILD               | 2 +-
 main/faac/APKBUILD                      | 2 +-
 main/faad2/APKBUILD                     | 2 +-
 main/fakeroot/APKBUILD                  | 2 +-
 main/fcgi/APKBUILD                      | 2 +-
 main/feh/APKBUILD                       | 2 +-
 main/fetchmail/APKBUILD                 | 2 +-
 main/ffmpeg/APKBUILD                    | 2 +-
 main/file/APKBUILD                      | 2 +-
 main/findutils/APKBUILD                 | 2 +-
 main/flac/APKBUILD                      | 2 +-
 main/flex/APKBUILD                      | 2 +-
 main/fluxbox/APKBUILD                   | 2 +-
 main/font-util/APKBUILD                 | 2 +-
 main/fontconfig/APKBUILD                | 2 +-
 main/fping/APKBUILD                     | 2 +-
 main/fprobe/APKBUILD                    | 2 +-
 main/freeswitch/APKBUILD                | 2 +-
 main/freetds/APKBUILD                   | 2 +-
 main/freetype/APKBUILD                  | 2 +-
 main/fribidi/APKBUILD                   | 2 +-
 main/galculator/APKBUILD                | 2 +-
 main/gamin/APKBUILD                     | 2 +-
 main/gawk/APKBUILD                      | 2 +-
 main/gcc/APKBUILD                       | 2 +-
 main/gd/APKBUILD                        | 2 +-
 main/gdb/APKBUILD                       | 2 +-
 main/gdbm/APKBUILD                      | 2 +-
 main/geany/APKBUILD                     | 2 +-
 main/gettext/APKBUILD                   | 2 +-
 main/ghostscript/APKBUILD               | 2 +-
 main/giblib/APKBUILD                    | 2 +-
 main/giflib/APKBUILD                    | 2 +-
 main/git/APKBUILD                       | 2 +-
 main/glib/APKBUILD                      | 2 +-
 main/gmp/APKBUILD                       | 2 +-
 main/gnats/APKBUILD                     | 2 +-
 main/gnupg/APKBUILD                     | 2 +-
 main/gnutls/APKBUILD                    | 2 +-
 main/gobject-introspection/APKBUILD     | 2 +-
 main/gperf/APKBUILD                     | 2 +-
 main/gpicview/APKBUILD                  | 2 +-
 main/grep/APKBUILD                      | 2 +-
 main/groff/APKBUILD                     | 2 +-
 main/gross/APKBUILD                     | 2 +-
 main/gst-plugins-bad/APKBUILD           | 2 +-
 main/gst-plugins-base/APKBUILD          | 2 +-
 main/gst-plugins-ffmpeg/APKBUILD        | 2 +-
 main/gst-plugins-good/APKBUILD          | 2 +-
 main/gst-plugins-ugly/APKBUILD          | 2 +-
 main/gstreamer/APKBUILD                 | 2 +-
 main/gtk+/APKBUILD                      | 2 +-
 main/gtk-vnc/APKBUILD                   | 2 +-
 main/gtk-xfce-engine/APKBUILD           | 2 +-
 main/guile/APKBUILD                     | 2 +-
 main/gzip/APKBUILD                      | 2 +-
 main/haserl/APKBUILD                    | 2 +-
 main/heimdal/APKBUILD                   | 2 +-
 main/hostapd/APKBUILD                   | 2 +-
 main/htop/APKBUILD                      | 2 +-
 main/hunspell/APKBUILD                  | 2 +-
 main/hylafax/APKBUILD                   | 2 +-
 main/hypermail/APKBUILD                 | 2 +-
 main/iaxmodem/APKBUILD                  | 2 +-
 main/iceauth/APKBUILD                   | 2 +-
 main/icu/APKBUILD                       | 2 +-
 main/iftop/APKBUILD                     | 2 +-
 main/igmpproxy/APKBUILD                 | 2 +-
 main/imagemagick/APKBUILD               | 2 +-
 main/imap/APKBUILD                      | 2 +-
 main/imlib2/APKBUILD                    | 2 +-
 main/iperf/APKBUILD                     | 2 +-
 main/iproute2/APKBUILD                  | 2 +-
 main/ipsec-tools/APKBUILD               | 2 +-
 main/iptables/APKBUILD                  | 2 +-
 main/iptraf/APKBUILD                    | 2 +-
 main/iputils/APKBUILD                   | 2 +-
 main/ircii/APKBUILD                     | 2 +-
 main/irssi/APKBUILD                     | 2 +-
 main/iscsitarget/APKBUILD               | 2 +-
 main/jasper/APKBUILD                    | 2 +-
 main/jpeg/APKBUILD                      | 2 +-
 main/kamailio/APKBUILD                  | 2 +-
 main/ksymoops/APKBUILD                  | 2 +-
 main/lame/APKBUILD                      | 2 +-
 main/less/APKBUILD                      | 2 +-
 main/lftp/APKBUILD                      | 2 +-
 main/lha/APKBUILD                       | 2 +-
 main/libao/APKBUILD                     | 2 +-
 main/libart-lgpl/APKBUILD               | 2 +-
 main/libc0.9.32/APKBUILD                | 2 +-
 main/libcap/APKBUILD                    | 2 +-
 main/libconfig/APKBUILD                 | 2 +-
 main/libcroco/APKBUILD                  | 2 +-
 main/libdrm/APKBUILD                    | 2 +-
 main/libevent/APKBUILD                  | 2 +-
 main/libexif/APKBUILD                   | 2 +-
 main/libffi/APKBUILD                    | 2 +-
 main/libfontenc/APKBUILD                | 2 +-
 main/libgcrypt/APKBUILD                 | 2 +-
 main/libglade/APKBUILD                  | 2 +-
 main/libgpg-error/APKBUILD              | 2 +-
 main/libgsf/APKBUILD                    | 2 +-
 main/libice/APKBUILD                    | 2 +-
 main/libiconv/APKBUILD                  | 2 +-
 main/libid3tag/APKBUILD                 | 2 +-
 main/libidn/APKBUILD                    | 2 +-
 main/libksba/APKBUILD                   | 2 +-
 main/libmad/APKBUILD                    | 2 +-
 main/libmcrypt/APKBUILD                 | 2 +-
 main/libmpdclient/APKBUILD              | 2 +-
 main/libmpeg2/APKBUILD                  | 2 +-
 main/libnet/APKBUILD                    | 2 +-
 main/libnetfilter_conntrack/APKBUILD    | 2 +-
 main/libnfnetlink/APKBUILD              | 2 +-
 main/libnl/APKBUILD                     | 2 +-
 main/libnotify/APKBUILD                 | 2 +-
 main/libogg/APKBUILD                    | 2 +-
 main/liboil/APKBUILD                    | 2 +-
 main/libpaper/APKBUILD                  | 2 +-
 main/libpcap/APKBUILD                   | 2 +-
 main/libpciaccess/APKBUILD              | 2 +-
 main/libpng/APKBUILD                    | 2 +-
 main/libpri/APKBUILD                    | 2 +-
 main/librsvg/APKBUILD                   | 2 +-
 main/libsamplerate/APKBUILD             | 2 +-
 main/libsexy/APKBUILD                   | 2 +-
 main/libsm/APKBUILD                     | 2 +-
 main/libsndfile/APKBUILD                | 2 +-
 main/libsoup/APKBUILD                   | 2 +-
 main/libspf2/APKBUILD                   | 2 +-
 main/libtasn1/APKBUILD                  | 2 +-
 main/libtheora/APKBUILD                 | 2 +-
 main/libtool/APKBUILD                   | 2 +-
 main/libusb-compat/APKBUILD             | 2 +-
 main/libusb/APKBUILD                    | 2 +-
 main/libvorbis/APKBUILD                 | 2 +-
 main/libwnck/APKBUILD                   | 2 +-
 main/libx11/APKBUILD                    | 2 +-
 main/libxau/APKBUILD                    | 2 +-
 main/libxcb/APKBUILD                    | 2 +-
 main/libxcomposite/APKBUILD             | 2 +-
 main/libxcursor/APKBUILD                | 2 +-
 main/libxdamage/APKBUILD                | 2 +-
 main/libxdmcp/APKBUILD                  | 2 +-
 main/libxext/APKBUILD                   | 2 +-
 main/libxfce4menu/APKBUILD              | 2 +-
 main/libxfce4util/APKBUILD              | 2 +-
 main/libxfcegui4/APKBUILD               | 2 +-
 main/libxfixes/APKBUILD                 | 2 +-
 main/libxfont/APKBUILD                  | 2 +-
 main/libxft/APKBUILD                    | 2 +-
 main/libxi/APKBUILD                     | 2 +-
 main/libxinerama/APKBUILD               | 2 +-
 main/libxkbfile/APKBUILD                | 2 +-
 main/libxkbui/APKBUILD                  | 2 +-
 main/libxklavier/APKBUILD               | 2 +-
 main/libxml2/APKBUILD                   | 2 +-
 main/libxmu/APKBUILD                    | 2 +-
 main/libxpm/APKBUILD                    | 2 +-
 main/libxrandr/APKBUILD                 | 2 +-
 main/libxrender/APKBUILD                | 2 +-
 main/libxres/APKBUILD                   | 2 +-
 main/libxslt/APKBUILD                   | 2 +-
 main/libxt/APKBUILD                     | 2 +-
 main/libxtst/APKBUILD                   | 2 +-
 main/libxv/APKBUILD                     | 2 +-
 main/libxvmc/APKBUILD                   | 2 +-
 main/libxxf86dga/APKBUILD               | 2 +-
 main/libxxf86misc/APKBUILD              | 2 +-
 main/libxxf86vm/APKBUILD                | 2 +-
 main/lighttpd/APKBUILD                  | 2 +-
 main/links/APKBUILD                     | 2 +-
 main/linux-grsec/APKBUILD               | 2 +-
 main/linux-pae/APKBUILD                 | 2 +-
 main/linux-vserver/APKBUILD             | 2 +-
 main/lm_sensors/APKBUILD                | 2 +-
 main/logrotate/APKBUILD                 | 2 +-
 main/lsof/APKBUILD                      | 2 +-
 main/lua-bitlib/APKBUILD                | 2 +-
 main/lua-discount/APKBUILD              | 2 +-
 main/lua-expat/APKBUILD                 | 2 +-
 main/lua-iconv/APKBUILD                 | 2 +-
 main/lua-md5/APKBUILD                   | 2 +-
 main/lua-openrc/APKBUILD                | 2 +-
 main/lua-pc/APKBUILD                    | 2 +-
 main/lua-posix/APKBUILD                 | 2 +-
 main/lua-socket/APKBUILD                | 2 +-
 main/lua-sql-mysql/APKBUILD             | 2 +-
 main/lua-sql-postgres/APKBUILD          | 2 +-
 main/lua-sql-sqlite3/APKBUILD           | 2 +-
 main/lua-uuid/APKBUILD                  | 2 +-
 main/lua-zlib/APKBUILD                  | 2 +-
 main/lua/APKBUILD                       | 2 +-
 main/lvm2/APKBUILD                      | 2 +-
 main/lzo/APKBUILD                       | 2 +-
 main/m4/APKBUILD                        | 2 +-
 main/make/APKBUILD                      | 2 +-
 main/man/APKBUILD                       | 2 +-
 main/mdadm/APKBUILD                     | 2 +-
 main/mercurial/APKBUILD                 | 2 +-
 main/mesa/APKBUILD                      | 2 +-
 main/midori/APKBUILD                    | 2 +-
 main/mini_httpd/APKBUILD                | 2 +-
 main/minicom/APKBUILD                   | 2 +-
 main/mkfontscale/APKBUILD               | 2 +-
 main/mlmmj/APKBUILD                     | 2 +-
 main/module-init-tools/APKBUILD         | 2 +-
 main/mousepad/APKBUILD                  | 2 +-
 main/mpc/APKBUILD                       | 2 +-
 main/mpd/APKBUILD                       | 2 +-
 main/mpfr/APKBUILD                      | 2 +-
 main/mpg123/APKBUILD                    | 2 +-
 main/mrxvt/APKBUILD                     | 2 +-
 main/mtools/APKBUILD                    | 2 +-
 main/mysql/APKBUILD                     | 2 +-
 main/nano/APKBUILD                      | 2 +-
 main/nasm/APKBUILD                      | 2 +-
 main/ncftp/APKBUILD                     | 2 +-
 main/ncurses/APKBUILD                   | 2 +-
 main/neon/APKBUILD                      | 2 +-
 main/net-snmp/APKBUILD                  | 2 +-
 main/newt/APKBUILD                      | 2 +-
 main/nfs-utils/APKBUILD                 | 2 +-
 main/ngircd/APKBUILD                    | 2 +-
 main/nmap/APKBUILD                      | 2 +-
 main/nrpe/APKBUILD                      | 2 +-
 main/ntfs-3g/APKBUILD                   | 2 +-
 main/oidentd/APKBUILD                   | 2 +-
 main/openldap/APKBUILD                  | 2 +-
 main/opennhrp/APKBUILD                  | 2 +-
 main/openntpd/APKBUILD                  | 2 +-
 main/openrc/APKBUILD                    | 2 +-
 main/openssh/APKBUILD                   | 2 +-
 main/openssl/APKBUILD                   | 2 +-
 main/openvpn/APKBUILD                   | 2 +-
 main/oprofile/APKBUILD                  | 2 +-
 main/orage/APKBUILD                     | 2 +-
 main/p7zip/APKBUILD                     | 2 +-
 main/pango/APKBUILD                     | 2 +-
 main/parole/APKBUILD                    | 2 +-
 main/parted/APKBUILD                    | 2 +-
 main/patch/APKBUILD                     | 2 +-
 main/pax-utils/APKBUILD                 | 2 +-
 main/paxctl/APKBUILD                    | 2 +-
 main/pciutils/APKBUILD                  | 2 +-
 main/pcmciautils/APKBUILD               | 2 +-
 main/pcre/APKBUILD                      | 2 +-
 main/perl-compress-raw-bzip2/APKBUILD   | 2 +-
 main/perl-compress-raw-zlib/APKBUILD    | 2 +-
 main/perl-convert-uulib/APKBUILD        | 2 +-
 main/perl-crypt-openssl-random/APKBUILD | 2 +-
 main/perl-crypt-openssl-rsa/APKBUILD    | 2 +-
 main/perl-db/APKBUILD                   | 2 +-
 main/perl-db_file/APKBUILD              | 2 +-
 main/perl-digest-sha1/APKBUILD          | 2 +-
 main/perl-file-rsync/APKBUILD           | 2 +-
 main/perl-html-parser/APKBUILD          | 2 +-
 main/perl-mail-clamav/APKBUILD          | 2 +-
 main/perl-mail-spamassassin/APKBUILD    | 2 +-
 main/perl-net-dns/APKBUILD              | 2 +-
 main/perl-net-ssleay/APKBUILD           | 2 +-
 main/perl-netaddr-ip/APKBUILD           | 2 +-
 main/perl-time-hires/APKBUILD           | 2 +-
 main/perl-unix-syslog/APKBUILD          | 2 +-
 main/perl-xml-parser/APKBUILD           | 2 +-
 main/perl/APKBUILD                      | 2 +-
 main/pgcluster/APKBUILD                 | 2 +-
 main/pgpool/APKBUILD                    | 2 +-
 main/php-apc/APKBUILD                   | 2 +-
 main/php-fileinfo/APKBUILD              | 2 +-
 main/php/APKBUILD                       | 2 +-
 main/pinentry/APKBUILD                  | 2 +-
 main/pingu/APKBUILD                     | 2 +-
 main/pixman/APKBUILD                    | 2 +-
 main/pjproject/APKBUILD                 | 2 +-
 main/pkgconfig/APKBUILD                 | 2 +-
 main/policyd-spf-fs/APKBUILD            | 2 +-
 main/poppler-gtk/APKBUILD               | 2 +-
 main/poppler/APKBUILD                   | 2 +-
 main/popt/APKBUILD                      | 2 +-
 main/portmap/APKBUILD                   | 2 +-
 main/postfix/APKBUILD                   | 2 +-
 main/postgresql/APKBUILD                | 2 +-
 main/pound/APKBUILD                     | 2 +-
 main/ppp/APKBUILD                       | 2 +-
 main/procps/APKBUILD                    | 2 +-
 main/pth/APKBUILD                       | 2 +-
 main/python/APKBUILD                    | 2 +-
 main/quagga/APKBUILD                    | 2 +-
 main/rarian/APKBUILD                    | 2 +-
 main/razor/APKBUILD                     | 2 +-
 main/rdesktop/APKBUILD                  | 2 +-
 main/readline/APKBUILD                  | 2 +-
 main/remmina/APKBUILD                   | 2 +-
 main/rgb/APKBUILD                       | 2 +-
 main/ristretto/APKBUILD                 | 2 +-
 main/rrdtool/APKBUILD                   | 2 +-
 main/rsync/APKBUILD                     | 2 +-
 main/ruby/APKBUILD                      | 2 +-
 main/run-parts/APKBUILD                 | 2 +-
 main/rxmtp/APKBUILD                     | 2 +-
 main/samba/APKBUILD                     | 2 +-
 main/screen/APKBUILD                    | 2 +-
 main/scrot/APKBUILD                     | 2 +-
 main/sdl/APKBUILD                       | 2 +-
 main/sed/APKBUILD                       | 2 +-
 main/sessreg/APKBUILD                   | 2 +-
 main/setxkbmap/APKBUILD                 | 2 +-
 main/sfic/APKBUILD                      | 2 +-
 main/shared-mime-info/APKBUILD          | 2 +-
 main/sic/APKBUILD                       | 2 +-
 main/slang/APKBUILD                     | 2 +-
 main/slim/APKBUILD                      | 2 +-
 main/snort/APKBUILD                     | 2 +-
 main/sntpc/APKBUILD                     | 2 +-
 main/sox/APKBUILD                       | 2 +-
 main/spamassassin/APKBUILD              | 2 +-
 main/spandsp/APKBUILD                   | 2 +-
 main/sqlite/APKBUILD                    | 2 +-
 main/squashfs-tools/APKBUILD            | 2 +-
 main/squid/APKBUILD                     | 2 +-
 main/ssmtp/APKBUILD                     | 2 +-
 main/startup-notification/APKBUILD      | 2 +-
 main/strace/APKBUILD                    | 2 +-
 main/subversion/APKBUILD                | 2 +-
 main/sudo/APKBUILD                      | 2 +-
 main/swfdec-mozilla/APKBUILD            | 2 +-
 main/swfdec/APKBUILD                    | 2 +-
 main/swig/APKBUILD                      | 2 +-
 main/sylpheed/APKBUILD                  | 2 +-
 main/sysfsutils/APKBUILD                | 2 +-
 main/sysklogd/APKBUILD                  | 2 +-
 main/syslinux/APKBUILD                  | 2 +-
 main/sysstat/APKBUILD                   | 2 +-
 main/taglib/APKBUILD                    | 2 +-
 main/tar/APKBUILD                       | 2 +-
 main/tcl/APKBUILD                       | 2 +-
 main/tcpdump/APKBUILD                   | 2 +-
 main/tcpproxy/APKBUILD                  | 2 +-
 main/terminal/APKBUILD                  | 2 +-
 main/texinfo/APKBUILD                   | 2 +-
 main/tftpd-hpa/APKBUILD                 | 2 +-
 main/thunar-archive-plugin/APKBUILD     | 2 +-
 main/thunar/APKBUILD                    | 2 +-
 main/tiff/APKBUILD                      | 2 +-
 main/tinyproxy/APKBUILD                 | 2 +-
 main/tmux/APKBUILD                      | 2 +-
 main/ucarp/APKBUILD                     | 2 +-
 main/uclibc++/APKBUILD                  | 2 +-
 main/unarj/APKBUILD                     | 2 +-
 main/unfs3/APKBUILD                     | 2 +-
 main/unixodbc/APKBUILD                  | 2 +-
 main/unrar/APKBUILD                     | 2 +-
 main/usbutils/APKBUILD                  | 2 +-
 main/util-linux-ng/APKBUILD             | 2 +-
 main/util-vserver/APKBUILD              | 2 +-
 main/uvncrepeater/APKBUILD              | 2 +-
 main/vala/APKBUILD                      | 2 +-
 main/valgrind/APKBUILD                  | 2 +-
 main/vim/APKBUILD                       | 2 +-
 main/vsftpd/APKBUILD                    | 2 +-
 main/vte/APKBUILD                       | 2 +-
 main/webkit/APKBUILD                    | 2 +-
 main/wget/APKBUILD                      | 2 +-
 main/wireless-tools/APKBUILD            | 2 +-
 main/wireshark/APKBUILD                 | 2 +-
 main/wpa_supplicant/APKBUILD            | 2 +-
 main/wv/APKBUILD                        | 2 +-
 main/x264/APKBUILD                      | 2 +-
 main/xarchiver/APKBUILD                 | 2 +-
 main/xauth/APKBUILD                     | 2 +-
 main/xbacklight/APKBUILD                | 2 +-
 main/xcb-util/APKBUILD                  | 2 +-
 main/xchat/APKBUILD                     | 2 +-
 main/xcmsdb/APKBUILD                    | 2 +-
 main/xdelta3/APKBUILD                   | 2 +-
 main/xdpyinfo/APKBUILD                  | 2 +-
 main/xdriinfo/APKBUILD                  | 2 +-
 main/xev/APKBUILD                       | 2 +-
 main/xf86-input-evdev/APKBUILD          | 2 +-
 main/xf86-input-keyboard/APKBUILD       | 2 +-
 main/xf86-input-mouse/APKBUILD          | 2 +-
 main/xf86-input-synaptics/APKBUILD      | 2 +-
 main/xf86-video-apm/APKBUILD            | 2 +-
 main/xf86-video-ark/APKBUILD            | 2 +-
 main/xf86-video-ast/APKBUILD            | 2 +-
 main/xf86-video-ati/APKBUILD            | 2 +-
 main/xf86-video-chips/APKBUILD          | 2 +-
 main/xf86-video-cirrus/APKBUILD         | 2 +-
 main/xf86-video-dummy/APKBUILD          | 2 +-
 main/xf86-video-fbdev/APKBUILD          | 2 +-
 main/xf86-video-geode/APKBUILD          | 2 +-
 main/xf86-video-glint/APKBUILD          | 2 +-
 main/xf86-video-i128/APKBUILD           | 2 +-
 main/xf86-video-i740/APKBUILD           | 2 +-
 main/xf86-video-intel/APKBUILD          | 2 +-
 main/xf86-video-mach64/APKBUILD         | 2 +-
 main/xf86-video-newport/APKBUILD        | 2 +-
 main/xf86-video-nv/APKBUILD             | 2 +-
 main/xf86-video-openchrome/APKBUILD     | 2 +-
 main/xf86-video-r128/APKBUILD           | 2 +-
 main/xf86-video-radeonhd/APKBUILD       | 2 +-
 main/xf86-video-rendition/APKBUILD      | 2 +-
 main/xf86-video-s3/APKBUILD             | 2 +-
 main/xf86-video-s3virge/APKBUILD        | 2 +-
 main/xf86-video-savage/APKBUILD         | 2 +-
 main/xf86-video-siliconmotion/APKBUILD  | 2 +-
 main/xf86-video-sis/APKBUILD            | 2 +-
 main/xf86-video-sunffb/APKBUILD         | 2 +-
 main/xf86-video-sunleo/APKBUILD         | 2 +-
 main/xf86-video-tdfx/APKBUILD           | 2 +-
 main/xf86-video-tseng/APKBUILD          | 2 +-
 main/xf86-video-v4l/APKBUILD            | 2 +-
 main/xf86-video-vesa/APKBUILD           | 2 +-
 main/xf86-video-vmware/APKBUILD         | 2 +-
 main/xfce-utils/APKBUILD                | 2 +-
 main/xfce4-appfinder/APKBUILD           | 2 +-
 main/xfce4-battery-plugin/APKBUILD      | 2 +-
 main/xfce4-cpufreq-plugin/APKBUILD      | 2 +-
 main/xfce4-mixer/APKBUILD               | 2 +-
 main/xfce4-notifyd/APKBUILD             | 2 +-
 main/xfce4-panel/APKBUILD               | 2 +-
 main/xfce4-screenshooter/APKBUILD       | 2 +-
 main/xfce4-session/APKBUILD             | 2 +-
 main/xfce4-settings/APKBUILD            | 2 +-
 main/xfce4-taskmanager/APKBUILD         | 2 +-
 main/xfce4-wavelan-plugin/APKBUILD      | 2 +-
 main/xfce4-xkb-plugin/APKBUILD          | 2 +-
 main/xfconf/APKBUILD                    | 2 +-
 main/xfdesktop/APKBUILD                 | 2 +-
 main/xfprint/APKBUILD                   | 2 +-
 main/xfsprogs/APKBUILD                  | 2 +-
 main/xfwm4/APKBUILD                     | 2 +-
 main/xgamma/APKBUILD                    | 2 +-
 main/xhost/APKBUILD                     | 2 +-
 main/xinit/APKBUILD                     | 2 +-
 main/xkbcomp/APKBUILD                   | 2 +-
 main/xmodmap/APKBUILD                   | 2 +-
 main/xorg-server/APKBUILD               | 2 +-
 main/xrandr/APKBUILD                    | 2 +-
 main/xrdb/APKBUILD                      | 2 +-
 main/xrefresh/APKBUILD                  | 2 +-
 main/xset/APKBUILD                      | 2 +-
 main/xsetmode/APKBUILD                  | 2 +-
 main/xsetroot/APKBUILD                  | 2 +-
 main/xtables-addons/APKBUILD            | 2 +-
 main/xvidcore/APKBUILD                  | 2 +-
 main/xvinfo/APKBUILD                    | 2 +-
 main/yasm/APKBUILD                      | 2 +-
 main/zip/APKBUILD                       | 2 +-
 main/zlib/APKBUILD                      | 2 +-
 main/zonenotify/APKBUILD                | 2 +-
 main/zsnes/APKBUILD                     | 2 +-
 546 files changed, 546 insertions(+), 546 deletions(-)

diff --git a/main/a2ps/APKBUILD b/main/a2ps/APKBUILD
index 18409a28..369a94db 100644
--- a/main/a2ps/APKBUILD
+++ b/main/a2ps/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=a2ps
 pkgver=4.14
-pkgrel=0
+pkgrel=1
 pkgdesc="a2ps is an Any to PostScript filter"
 url="http://www.gnu.org/software/a2ps/"
 license="GPL3"
diff --git a/main/a52dec/APKBUILD b/main/a52dec/APKBUILD
index 8d3b868d..bbb41d5f 100644
--- a/main/a52dec/APKBUILD
+++ b/main/a52dec/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=a52dec
 pkgver=0.7.4
-pkgrel=0
+pkgrel=1
 pkgdesc="liba52 is a free library for decoding ATSC A/52 streams."
 url="http://liba52.sourceforge.net/"
 license="GPL2"
diff --git a/main/abiword/APKBUILD b/main/abiword/APKBUILD
index 8007da2a..9ba0eb5c 100644
--- a/main/abiword/APKBUILD
+++ b/main/abiword/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=abiword
 pkgver=2.8.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A fully-featured word processor"
 url="http://www.abisource.com"
 license="GPL"
diff --git a/main/abuild/APKBUILD b/main/abuild/APKBUILD
index ed4d017c..ec01a0fa 100644
--- a/main/abuild/APKBUILD
+++ b/main/abuild/APKBUILD
@@ -2,7 +2,7 @@
 pkgdesc="Script to build Alpine Packages"
 pkgname=abuild
 pkgver=2.1
-pkgrel=0
+pkgrel=1
 url=http://git.alpinelinux.org/cgit/abuild/
 source="http://git.alpinelinux.org/cgit/abuild/snapshot/abuild-$pkgver.tar.bz2
 	"
diff --git a/main/acct/APKBUILD b/main/acct/APKBUILD
index c4a68c67..02072139 100644
--- a/main/acct/APKBUILD
+++ b/main/acct/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=acct
 pkgver=6.5.3
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNU Accounting Utilities"
 url="http://www.gnu.org/software/acct/"
 license="GPL"
diff --git a/main/alpine-baselayout/APKBUILD b/main/alpine-baselayout/APKBUILD
index f0e3c00b..ba6c321f 100644
--- a/main/alpine-baselayout/APKBUILD
+++ b/main/alpine-baselayout/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alpine-baselayout
 pkgver=2.0_rc1
-pkgrel=0
+pkgrel=1
 pkgdesc="Alpine base dir structure and init scripts"
 url=http://git.alpinelinux.org/cgit/alpine-baselayout
 depends=
diff --git a/main/alsa-lib/APKBUILD b/main/alsa-lib/APKBUILD
index eda8c612..ab2f6c0a 100644
--- a/main/alsa-lib/APKBUILD
+++ b/main/alsa-lib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alsa-lib
 pkgver=1.0.22
-pkgrel=0
+pkgrel=1
 pkgdesc="An alternative implementation of Linux sound support"
 url="http://www.alsa-project.org"
 license="GPL"
diff --git a/main/antiword/APKBUILD b/main/antiword/APKBUILD
index a6134c9f..d7b80c77 100644
--- a/main/antiword/APKBUILD
+++ b/main/antiword/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=antiword
 pkgver=0.37
-pkgrel=0
+pkgrel=1
 pkgdesc="free MS Word reader"
 url="http://www.winfield.demon.nl"
 license="GPL"
diff --git a/main/apcupsd/APKBUILD b/main/apcupsd/APKBUILD
index c9b29fa2..4193348f 100644
--- a/main/apcupsd/APKBUILD
+++ b/main/apcupsd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apcupsd
 pkgver=3.14.8
-pkgrel=1
+pkgrel=2
 pkgdesc="A Daemon to control APC UPSes"
 subpackages="$pkgname-doc"
 url="http://www.apcupsd.org"
diff --git a/main/apg/APKBUILD b/main/apg/APKBUILD
index 98d41665..8912b5f3 100644
--- a/main/apg/APKBUILD
+++ b/main/apg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apg
 pkgver=2.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Automated Password Generator."
 url="http://www.adel.nursat.kz/apg/index.shtml"
 license="custom"
diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index 7b366137..30f7eb5e 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
diff --git a/main/apr-util/APKBUILD b/main/apr-util/APKBUILD
index 4c52e523..45133a2c 100644
--- a/main/apr-util/APKBUILD
+++ b/main/apr-util/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apr-util
 pkgver=1.3.9
-pkgrel=0
+pkgrel=1
 pkgdesc="The Apache Portable Runtime"
 url="http://apr.apache.org/"
 license="APACHE"
diff --git a/main/apr/APKBUILD b/main/apr/APKBUILD
index 98891c9a..efef9c19 100644
--- a/main/apr/APKBUILD
+++ b/main/apr/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apr
 pkgver=1.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="The Apache Portable Runtime"
 url="http://apr.apache.org/"
 license="APACHE"
diff --git a/main/arpon/APKBUILD b/main/arpon/APKBUILD
index a18f88c3..5b47cd0d 100644
--- a/main/arpon/APKBUILD
+++ b/main/arpon/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=arpon
 pkgver=1.90
-pkgrel=1
+pkgrel=2
 pkgdesc="Arp handler inspectiON is a handler daemon with tools to handle all ARP aspects"
 url="http://arpon.sourceforge.net/"
 license="GPL"
diff --git a/main/arpwatch/APKBUILD b/main/arpwatch/APKBUILD
index ff97c65b..4907a65c 100644
--- a/main/arpwatch/APKBUILD
+++ b/main/arpwatch/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=arpwatch
 pkgver=2.1a15
-pkgrel=1
+pkgrel=2
 pkgdesc="Ethernet monitoring program"
 url="http://www-nrg.ee.lbl.gov/"
 license="GPL"
diff --git a/main/aspell/APKBUILD b/main/aspell/APKBUILD
index 3a3cef36..5e1bf889 100644
--- a/main/aspell/APKBUILD
+++ b/main/aspell/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=aspell
 pkgver=0.60.6
 _pkgmajorver=${pkgver%.*}
-pkgrel=0
+pkgrel=1
 pkgdesc="A spell checker designed to eventually replace Ispell"
 url="http://aspell.net/"
 license="LGPL"
diff --git a/main/asterisk/APKBUILD b/main/asterisk/APKBUILD
index 51180cc5..2a955f8b 100644
--- a/main/asterisk/APKBUILD
+++ b/main/asterisk/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=asterisk
 pkgver=1.6.2.6
-pkgrel=1
+pkgrel=2
 pkgdesc="Asterisk: A Module Open Source PBX System"
 url="http://www.asterisk.org/"
 license="GPL"
diff --git a/main/aterm/APKBUILD b/main/aterm/APKBUILD
index e414f4a4..e8f2b3e8 100644
--- a/main/aterm/APKBUILD
+++ b/main/aterm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=aterm
 pkgver=1.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="An xterm replacement with transparency support"
 url="http://aterm.sourceforge.net/"
 license="GPL"
diff --git a/main/atk/APKBUILD b/main/atk/APKBUILD
index 80333883..4dd5afd3 100644
--- a/main/atk/APKBUILD
+++ b/main/atk/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=atk
 pkgver=1.30.0
-pkgrel=1
+pkgrel=2
 pkgdesc="A library providing a set of interfaces for accessibility"
 url="http://www.gtk.org/"
 license="LGPL"
diff --git a/main/atop/APKBUILD b/main/atop/APKBUILD
index ecbfb102..59edf26d 100644
--- a/main/atop/APKBUILD
+++ b/main/atop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=atop
 pkgver=1.24
-pkgrel=1
+pkgrel=2
 pkgdesc="Resource-specific view of processes"
 url="http://www.atcomputing.nl/Tools/atop"
 license="GPL-2"
diff --git a/main/attr/APKBUILD b/main/attr/APKBUILD
index 7046bd56..e244a5aa 100644
--- a/main/attr/APKBUILD
+++ b/main/attr/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=attr
 pkgver=2.4.44
 _ver=2.4.44
-pkgrel=1
+pkgrel=2
 pkgdesc="Extended attribute support library for ACL support"
 url="http://oss.sgi.com/projects/xfs/"
 license="LGPL"
diff --git a/main/aumix/APKBUILD b/main/aumix/APKBUILD
index 1e455850..69456169 100644
--- a/main/aumix/APKBUILD
+++ b/main/aumix/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=aumix
 pkgver=2.8
-pkgrel=2
+pkgrel=3
 pkgdesc="A color text mode sound mixer"
 url="http://www.jpj.net/~trevor/aumix.html"
 license="GPL"
diff --git a/main/b43-fwcutter/APKBUILD b/main/b43-fwcutter/APKBUILD
index 0a7f4cc6..3be0da6f 100644
--- a/main/b43-fwcutter/APKBUILD
+++ b/main/b43-fwcutter/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=b43-fwcutter
 pkgver=012
-pkgrel=0
+pkgrel=1
 pkgdesc="Tool to extract firmware from Broadcom drivers"
 url="http://linuxwireless.org/en/users/Drivers/b43"
 license="GPL"
diff --git a/main/bash/APKBUILD b/main/bash/APKBUILD
index 421c936c..f5b5a929 100644
--- a/main/bash/APKBUILD
+++ b/main/bash/APKBUILD
@@ -5,7 +5,7 @@ pkgver=4.1.005
 _patchlevel=${pkgver##*.}
 _myver=${pkgver%.*}
 _patchbase=${_myver%.*}${_myver#*.}
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNU Bourne Again shell"
 license='GPL'
 url="http://www.gnu.org/software/bash/bash.html"
diff --git a/main/bbsuid/APKBUILD b/main/bbsuid/APKBUILD
index 8a157b39..4389e9a1 100644
--- a/main/bbsuid/APKBUILD
+++ b/main/bbsuid/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bbsuid
 pkgver=0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Busybox SUID root application wrapper"
 url="http://git.alpinelinux.org/cgit/bbsuid"
 license="GPL-2"
diff --git a/main/bc/APKBUILD b/main/bc/APKBUILD
index d5f1851f..5b990def 100644
--- a/main/bc/APKBUILD
+++ b/main/bc/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bc
 pkgver=1.06
-pkgrel=1
+pkgrel=2
 pkgdesc="arbitrary precision numeric processing language (calculator)"
 url="http://www.gnu.org/software/bc/bc.html"
 license="GPL"
diff --git a/main/bdftopcf/APKBUILD b/main/bdftopcf/APKBUILD
index 49abcee7..3a003cb2 100644
--- a/main/bdftopcf/APKBUILD
+++ b/main/bdftopcf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bdftopcf
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org font utility"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/beecrypt/APKBUILD b/main/beecrypt/APKBUILD
index d56b0e82..11221c28 100644
--- a/main/beecrypt/APKBUILD
+++ b/main/beecrypt/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=beecrypt
 pkgver=4.1.2
-pkgrel=3
+pkgrel=4
 pkgdesc="general-purpose cryptography library"
 url="http://sourceforge.net/projects/beecrypt"
 license="LGPL"
diff --git a/main/beep/APKBUILD b/main/beep/APKBUILD
index 3cd12e98..a41389bf 100644
--- a/main/beep/APKBUILD
+++ b/main/beep/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=beep
 pkgver=1.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A terminal bell"
 url="http://johnath.com/beep"
 license="GPL-2"
diff --git a/main/bind/APKBUILD b/main/bind/APKBUILD
index 946af90e..21f570ec 100644
--- a/main/bind/APKBUILD
+++ b/main/bind/APKBUILD
@@ -4,7 +4,7 @@ pkgname=bind
 pkgver=9.7.0_p1
 _ver=${pkgver%_p*}
 _p=${pkgver#*_p}
-pkgrel=0
+pkgrel=1
 pkgdesc="BIND - Berkeley Internet Name Domain - Name Server and tools"
 url="http://www.isc.org"
 license="as-is"
diff --git a/main/bison/APKBUILD b/main/bison/APKBUILD
index f24dd744..c355b0cf 100644
--- a/main/bison/APKBUILD
+++ b/main/bison/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bison
 pkgver=2.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNU general-purpose parser generator"
 license="GPL"
 url="http://www.gnu.org/software/bison/bison.html"
diff --git a/main/bridge-utils/APKBUILD b/main/bridge-utils/APKBUILD
index e4d111a2..1f2b79df 100644
--- a/main/bridge-utils/APKBUILD
+++ b/main/bridge-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bridge-utils
 pkgver=1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Tools for configuring the Linux kernel 802.1d Ethernet Bridge"
 url="http://linux-net.osdl.org/index.php/Bridge"
 license="GPL-2"
diff --git a/main/busybox/APKBUILD b/main/busybox/APKBUILD
index 51813602..e625da83 100644
--- a/main/busybox/APKBUILD
+++ b/main/busybox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=busybox
 pkgver=1.16.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Size optimized toolbox of many common UNIX utilities"
 url=http://busybox.net
 license="GPL-2"
diff --git a/main/bwm-ng/APKBUILD b/main/bwm-ng/APKBUILD
index 34285231..f75a0730 100644
--- a/main/bwm-ng/APKBUILD
+++ b/main/bwm-ng/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bwm-ng
 pkgver=0.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A small and simple console-based live bandwidth monitor"
 url="http://www.gropp.org/"
 license="GPL"
diff --git a/main/bzip2/APKBUILD b/main/bzip2/APKBUILD
index 6805ac6e..1081978b 100644
--- a/main/bzip2/APKBUILD
+++ b/main/bzip2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bzip2
 pkgver=1.0.5
-pkgrel=1
+pkgrel=2
 pkgdesc="A high-quality data compression program"
 url="http://sources.redhat.com/bzip2"
 license="BZIP2"
diff --git a/main/c-ares/APKBUILD b/main/c-ares/APKBUILD
index 817bc3df..d0af1f04 100644
--- a/main/c-ares/APKBUILD
+++ b/main/c-ares/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=c-ares
 pkgver=1.7.0
-pkgrel=0
+pkgrel=1
 pkgdesc="An asynchronously DNS/names resolver library"
 url="http://c-ares.haxx.se/"
 license="GPL"
diff --git a/main/cabextract/APKBUILD b/main/cabextract/APKBUILD
index b4788780..addf021e 100644
--- a/main/cabextract/APKBUILD
+++ b/main/cabextract/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=cabextract
 pkgver=1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Tool for extracting Microsoft cabinet files"
 url="http://www.cabextract.org.uk/"
 license="GPL"
diff --git a/main/cairo/APKBUILD b/main/cairo/APKBUILD
index efa1a4ef..11571203 100644
--- a/main/cairo/APKBUILD
+++ b/main/cairo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cairo
 pkgver=1.8.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Cairo vector graphics library"
 url="http://cairographics.org/"
 license="LGPL MPL"
diff --git a/main/ccache/APKBUILD b/main/ccache/APKBUILD
index c93eb7ad..2848bb64 100644
--- a/main/ccache/APKBUILD
+++ b/main/ccache/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ccache
 pkgver=2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="ccache is a compiler cache"
 url="http://ccache.samba.org/"
 license="GPL"
diff --git a/main/cciss_vol_status/APKBUILD b/main/cciss_vol_status/APKBUILD
index 58918450..8f346b70 100644
--- a/main/cciss_vol_status/APKBUILD
+++ b/main/cciss_vol_status/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa
 pkgname=cciss_vol_status
 pkgver=1.06
-pkgrel=0
+pkgrel=1
 pkgdesc="Drivers for the HP (previously Compaq) Smart Array controllers which provide hardware RAID capability."
 url="http://cciss.sourceforge.net/"
 license="GPL"
diff --git a/main/cdrkit/APKBUILD b/main/cdrkit/APKBUILD
index ce5f9830..1d17896b 100644
--- a/main/cdrkit/APKBUILD
+++ b/main/cdrkit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cdrkit
 pkgver=1.1.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Suite of programs for CD/DVD recording, ISO image creation, and audio CD extraction"
 url="http://cdrkit.org/"
 license="GPL2"
diff --git a/main/cgit/APKBUILD b/main/cgit/APKBUILD
index c33aae4a..af8ea6d1 100644
--- a/main/cgit/APKBUILD
+++ b/main/cgit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cgit
 pkgver=0.8.3.1
-pkgrel=0
+pkgrel=1
 _gitver=1.6.4.3
 pkgdesc="a fast webinterface for git"
 url="http://hjemli.net/git/cgit"
diff --git a/main/chrony/APKBUILD b/main/chrony/APKBUILD
index 54d94e51..b83a0e85 100644
--- a/main/chrony/APKBUILD
+++ b/main/chrony/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=chrony
 pkgver=1.23
-pkgrel=5
+pkgrel=6
 pkgdesc="NTP client and server programs"
 url="http://chrony.sunsite.dk/"
 license="GPL-2"
diff --git a/main/cksfv/APKBUILD b/main/cksfv/APKBUILD
index 4cd06d3f..942c9cb8 100644
--- a/main/cksfv/APKBUILD
+++ b/main/cksfv/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=cksfv
 pkgver=1.3.14
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple File Verification"
 url="http://zakalwe.fi/~shd/foss/cksfv"
 license="GPL"
diff --git a/main/clamav/APKBUILD b/main/clamav/APKBUILD
index 0b12df40..fc5b1941 100644
--- a/main/clamav/APKBUILD
+++ b/main/clamav/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=clamav
 pkgver=0.95.3
-pkgrel=0
+pkgrel=1
 pkgusers=clamav
 pkggroups=clamav
 pkgdesc="An anti-virus toolkit for UNIX"
diff --git a/main/clamsmtp/APKBUILD b/main/clamsmtp/APKBUILD
index 1bad20a0..3b9906e7 100644
--- a/main/clamsmtp/APKBUILD
+++ b/main/clamsmtp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=clamsmtp
 pkgver=1.10
-pkgrel=6
+pkgrel=7
 pkgdesc="An SMTP Virus Filter"
 url="http://memberwebs.com/stef/software/clamsmtp/"
 license="as-is"
diff --git a/main/cmake/APKBUILD b/main/cmake/APKBUILD
index bc6331b5..bbd1b588 100644
--- a/main/cmake/APKBUILD
+++ b/main/cmake/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cmake
 pkgver=2.8.1
-pkgrel=0
+pkgrel=1
 pkgdesc="CMake is a cross-platform open-source make system"
 url="http://www.cmake.org"
 license="CMake"
diff --git a/main/confuse/APKBUILD b/main/confuse/APKBUILD
index ef5d5b07..ec90644f 100644
--- a/main/confuse/APKBUILD
+++ b/main/confuse/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=confuse
 pkgver=2.6
-pkgrel=0
+pkgrel=1
 pkgdesc="C-library for parsing configuration files"
 url="http://www.nongnu.org/confuse"
 license="LGPL"
diff --git a/main/conntrack-tools/APKBUILD b/main/conntrack-tools/APKBUILD
index 5ed2b070..343eb8f1 100644
--- a/main/conntrack-tools/APKBUILD
+++ b/main/conntrack-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=conntrack-tools
 pkgver=0.9.13
-pkgrel=1
+pkgrel=2
 pkgdesc="Connection tracking userspace tools"
 url="http://conntrack-tools.netfilter.org"
 license="GPL-2"
diff --git a/main/coreutils/APKBUILD b/main/coreutils/APKBUILD
index 46c9cc4a..2580776a 100644
--- a/main/coreutils/APKBUILD
+++ b/main/coreutils/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=coreutils
 pkgver=8.4
-pkgrel=1
+pkgrel=2
 pkgdesc="The basic file, shell and text manipulation utilities"
 url="http://www.gnu.org/software/coreutils/"
 license="GPL"
diff --git a/main/cpufreqd/APKBUILD b/main/cpufreqd/APKBUILD
index 7cc8929c..98a8f6e8 100644
--- a/main/cpufreqd/APKBUILD
+++ b/main/cpufreqd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cpufreqd
 pkgver=2.3.4
-pkgrel=1
+pkgrel=2
 pkgdesc="A small daemon to adjust cpu speed (and indeed voltage)"
 url="http://sourceforge.net/projects/cpufreqd"
 license="GPL2"
diff --git a/main/cpufrequtils/APKBUILD b/main/cpufrequtils/APKBUILD
index 377fe021..af8cff9d 100644
--- a/main/cpufrequtils/APKBUILD
+++ b/main/cpufrequtils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cpufrequtils
 pkgver=007
-pkgrel=0
+pkgrel=1
 pkgdesc="Userspace tools for the kernel cpufreq subsystem"
 url="http://www.kernel.org/pub/linux/utils/kernel/cpufreq/cpufrequtils.html"
 license="GPL"
diff --git a/main/cracklib/APKBUILD b/main/cracklib/APKBUILD
index edec6318..f7fda796 100644
--- a/main/cracklib/APKBUILD
+++ b/main/cracklib/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=cracklib
 pkgver=2.8.13
-pkgrel=0
+pkgrel=1
 pkgdesc="A library used to enforce strong passwords"
 url="http://sourceforge.net/projects/cracklib"
 license="GPL"
diff --git a/main/cramfs/APKBUILD b/main/cramfs/APKBUILD
index f4f1f65d..79c53cc3 100644
--- a/main/cramfs/APKBUILD
+++ b/main/cramfs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <natanael.copa@gmail.com>
 pkgname=cramfs
 pkgver=1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux filesystem designed to be simple, small, and to compress things well"
 arch=""
 url="http://sourceforge.net/projects/cramfs/"
diff --git a/main/ctags/APKBUILD b/main/ctags/APKBUILD
index 108355c6..7be38174 100644
--- a/main/ctags/APKBUILD
+++ b/main/ctags/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com> 
 pkgname=ctags
 pkgver=5.8
-pkgrel=0
+pkgrel=1
 pkgdesc="Generator of tags for all types of C/C++ languages"
 url="http://ctags.sourceforge.net/"
 license="GPL"
diff --git a/main/cups/APKBUILD b/main/cups/APKBUILD
index b87c456f..8ece114d 100644
--- a/main/cups/APKBUILD
+++ b/main/cups/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cups
 pkgver=1.4.3
-pkgrel=0
+pkgrel=1
 pkgdesc="The CUPS Printing System"
 url="http://www.cups.org/"
 license="GPL"
diff --git a/main/curl/APKBUILD b/main/curl/APKBUILD
index a7bcbd03..380d934a 100644
--- a/main/curl/APKBUILD
+++ b/main/curl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=curl
 pkgver=7.19.7
-pkgrel=0
+pkgrel=1
 pkgdesc="An URL retrival utility and library"
 url="http://curl.haxx.se"
 license="MIT"
diff --git a/main/cutter/APKBUILD b/main/cutter/APKBUILD
index 50041ef7..0337b29a 100644
--- a/main/cutter/APKBUILD
+++ b/main/cutter/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=cutter
 pkgver=1.03
-pkgrel=1
+pkgrel=2
 pkgdesc="A program that allows firewall administrators to abort TCP/IP connections."
 url="http://www.lowth.com/cutter"
 license="GPL"
diff --git a/main/cvs/APKBUILD b/main/cvs/APKBUILD
index 478fa884..21c4d581 100644
--- a/main/cvs/APKBUILD
+++ b/main/cvs/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer:
 pkgname=cvs
 pkgver=1.11.23
-pkgrel=0
+pkgrel=1
 pkgdesc="Concurrent Versions System"
 url="http://www.nongnu.org/cvs/"
 license="GPL"
diff --git a/main/cyrus-sasl/APKBUILD b/main/cyrus-sasl/APKBUILD
index 6346d9fa..519bd908 100644
--- a/main/cyrus-sasl/APKBUILD
+++ b/main/cyrus-sasl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cyrus-sasl
 pkgver=2.1.23
-pkgrel=2
+pkgrel=3
 pkgdesc="Cyrus Simple Authentication Service Layer (SASL)"
 url="http://cyrusimap.web.cmu.edu/downloads.html#sasl"
 license="custom"
diff --git a/main/dahdi-tools/APKBUILD b/main/dahdi-tools/APKBUILD
index 9a1538fa..dbb82aab 100644
--- a/main/dahdi-tools/APKBUILD
+++ b/main/dahdi-tools/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=dahdi-tools
 pkgver=2.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Digium Asterisk Hardware Device Interface management utilities"
 url="http://www.asterisk.org"
 license="GPL"
diff --git a/main/dansguardian/APKBUILD b/main/dansguardian/APKBUILD
index 607cd533..82aa4aa9 100644
--- a/main/dansguardian/APKBUILD
+++ b/main/dansguardian/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dansguardian
 pkgver=2.10.1.1
-pkgrel=5
+pkgrel=6
 pkgdesc="Web content filter"
 url="http://dansguardian.org"
 license="GPL"
diff --git a/main/db/APKBUILD b/main/db/APKBUILD
index 926b9713..d299132b 100644
--- a/main/db/APKBUILD
+++ b/main/db/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=db
 pkgver=4.8.26
 _ver=${pkgver}
-pkgrel=0
+pkgrel=1
 pkgdesc="The Berkeley DB embedded database system 4.8"
 url="http://www.oracle.com/technology/software/products/berkeley-db/index.html"
 license="custom"
diff --git a/main/dbus-glib/APKBUILD b/main/dbus-glib/APKBUILD
index 46c85f20..b4d93ca6 100644
--- a/main/dbus-glib/APKBUILD
+++ b/main/dbus-glib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dbus-glib
 pkgver=0.82
-pkgrel=0
+pkgrel=1
 pkgdesc="GLib bindings for DBUS"
 url="http://www.freedesktop.org/wiki/Software/DBusBindings"
 license="GPL"
diff --git a/main/dbus/APKBUILD b/main/dbus/APKBUILD
index d8471073..12f946ea 100644
--- a/main/dbus/APKBUILD
+++ b/main/dbus/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dbus
 pkgver=1.2.24
-pkgrel=1
+pkgrel=2
 pkgdesc="Freedesktop.org message bus system"
 url="http://www.freedesktop.org/Software/dbus"
 pkggroups="messagebus"
diff --git a/main/debootstrap/APKBUILD b/main/debootstrap/APKBUILD
index 9bd4502c..db61256b 100644
--- a/main/debootstrap/APKBUILD
+++ b/main/debootstrap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=debootstrap
 pkgver=1.0.22
-pkgrel=0
+pkgrel=1
 pkgdesc="Debian/Ubuntu bootstrap scripts"
 url="http://packages.qa.debian.org/d/debootstrap.html"
 license="GPL-2"
diff --git a/main/desktop-file-utils/APKBUILD b/main/desktop-file-utils/APKBUILD
index dc952e86..bdfd3917 100644
--- a/main/desktop-file-utils/APKBUILD
+++ b/main/desktop-file-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=desktop-file-utils
 pkgver=0.16
-pkgrel=0
+pkgrel=1
 pkgdesc="Command line utilities for working with desktop entries"
 url="http://www.freedesktop.org/wiki/Software/desktop-file-utils"
 license="GPL"
diff --git a/main/dhcp/APKBUILD b/main/dhcp/APKBUILD
index 4ecd8dff..1c334c80 100644
--- a/main/dhcp/APKBUILD
+++ b/main/dhcp/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=dhcp
 pkgver=4.1.0_p1
 _realver=4.1.0p1
-pkgrel=9
+pkgrel=10
 pkgdesc="ISC Dynamic Host Configuration Protocol (DHCP)"
 url="https://www.isc.org/"
 license="GPL"
diff --git a/main/dhcpcd-dbus/APKBUILD b/main/dhcpcd-dbus/APKBUILD
index ed4415af..b7f2ffa2 100644
--- a/main/dhcpcd-dbus/APKBUILD
+++ b/main/dhcpcd-dbus/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dhcpcd-dbus
 pkgver=0.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="DBUS binding to dhcpcd"
 url="http://roy.marples.name/projects/dhcpcd-dbus"
 license="BSD"
diff --git a/main/dhcpcd-ui/APKBUILD b/main/dhcpcd-ui/APKBUILD
index 2732f1c7..eb6d6ebd 100644
--- a/main/dhcpcd-ui/APKBUILD
+++ b/main/dhcpcd-ui/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dhcpcd-ui
 pkgver=0.4.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A GTK+ monitor and configuration GUI for dhcpcd"
 url="http://roy.marples.name/projects/dhcpcd-dbus"
 license="BSD-2"
diff --git a/main/dhcpcd/APKBUILD b/main/dhcpcd/APKBUILD
index cfc7a77c..17f3bd0d 100644
--- a/main/dhcpcd/APKBUILD
+++ b/main/dhcpcd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dhcpcd
 pkgver=5.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="RFC2131 compliant DHCP client"
 url="http://roy.marples.name/projects/dhcpcd/"
 license="BSD-2"
diff --git a/main/dialog/APKBUILD b/main/dialog/APKBUILD
index b06fb701..5c6703dc 100644
--- a/main/dialog/APKBUILD
+++ b/main/dialog/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=dialog
 pkgver=1.1.20080819
 _ver=${pkgver%.*}-${pkgver##*.}
-pkgrel=0
+pkgrel=1
 pkgdesc="A script-interpreter which provides a set of curses"
 url="http://invisible-island.net/dialog/dialog.html"
 license="GPL"
diff --git a/main/diffutils/APKBUILD b/main/diffutils/APKBUILD
index defa57ba..66f74eff 100644
--- a/main/diffutils/APKBUILD
+++ b/main/diffutils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=diffutils
 pkgver=2.9
-pkgrel=0
+pkgrel=1
 pkgdesc="Show differences among files"
 subpackages="$pkgname-doc"
 url="http://www.gnu.org/software/diffutils/"
diff --git a/main/dircproxy/APKBUILD b/main/dircproxy/APKBUILD
index becb8133..88ae453f 100644
--- a/main/dircproxy/APKBUILD
+++ b/main/dircproxy/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dircproxy
 pkgver=1.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="IRC proxy server designed for people who use IRC from lots of different workstations or clients"
 url="http://code.google.com/p/dircproxy/"
 license="GPL"
diff --git a/main/distcc/APKBUILD b/main/distcc/APKBUILD
index 27803991..c022995d 100644
--- a/main/distcc/APKBUILD
+++ b/main/distcc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=distcc
 pkgver=3.1
-pkgrel=2
+pkgrel=3
 pkgdesc="A distributed C, C++, Obj C compiler"
 url="http://distcc.org"
 license="GPL-2"
diff --git a/main/djbdns/APKBUILD b/main/djbdns/APKBUILD
index 976afa3f..c52201a9 100644
--- a/main/djbdns/APKBUILD
+++ b/main/djbdns/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=djbdns
 pkgver=1.05
-pkgrel=35
+pkgrel=36
 pkgdesc="Excellent high-performance DNS services"
 url="http://cr.yp.to/djbdns.html"
 license="public-domain"
diff --git a/main/dnsmasq/APKBUILD b/main/dnsmasq/APKBUILD
index feddb67f..a5700338 100644
--- a/main/dnsmasq/APKBUILD
+++ b/main/dnsmasq/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dnsmasq
 pkgver=2.52
-pkgrel=0
+pkgrel=1
 pkgdesc="Small forwarding DNS server"
 url="http://www.thekelleys.org.uk/dnsmasq/"
 license="GPL-2"
diff --git a/main/dosfstools/APKBUILD b/main/dosfstools/APKBUILD
index 07648fe9..fc11de09 100644
--- a/main/dosfstools/APKBUILD
+++ b/main/dosfstools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dosfstools
 pkgver=3.0.9
-pkgrel=0
+pkgrel=1
 pkgdesc="DOS filesystem utilities"
 url="http://www.daniel-baumann.ch/software/dosfstools/"
 license="GPL-2"
diff --git a/main/dovecot/APKBUILD b/main/dovecot/APKBUILD
index 44901280..500aa84c 100644
--- a/main/dovecot/APKBUILD
+++ b/main/dovecot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dovecot
 pkgver=1.2.11
-pkgrel=1
+pkgrel=2
 pkgdesc="IMAP and POP3 server"
 url="http://www.dovecot.org/"
 license="LGPL-2.1"
diff --git a/main/dpkg/APKBUILD b/main/dpkg/APKBUILD
index 5710f9c5..5672b96e 100644
--- a/main/dpkg/APKBUILD
+++ b/main/dpkg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dpkg
 pkgver=1.15.5.6
-pkgrel=0
+pkgrel=1
 pkgdesc="The Debian Package Manager"
 url="http://packages.debian.org/dpkg"
 license="GPL"
diff --git a/main/dropbear/APKBUILD b/main/dropbear/APKBUILD
index 53bbdc4e..65c698ef 100644
--- a/main/dropbear/APKBUILD
+++ b/main/dropbear/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dropbear
 pkgver=0.52
-pkgrel=2
+pkgrel=3
 pkgdesc="small SSH 2 client/server designed for small memory environments"
 url="http://matt.ucc.asn.au/dropbear/dropbear.html"
 license='MIT'
diff --git a/main/dtach/APKBUILD b/main/dtach/APKBUILD
index dd0a3779..46aaf735 100644
--- a/main/dtach/APKBUILD
+++ b/main/dtach/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=dtach
 pkgver=0.8
-pkgrel=0
+pkgrel=1
 pkgdesc="A program that emulates the detach feature of screen"
 url="http://dtach.sourceforge.net"
 license='GPL'
diff --git a/main/e2fsprogs/APKBUILD b/main/e2fsprogs/APKBUILD
index e0360aac..26b6d43b 100644
--- a/main/e2fsprogs/APKBUILD
+++ b/main/e2fsprogs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=e2fsprogs
 pkgver=1.41.11
-pkgrel=0
+pkgrel=1
 pkgdesc="Standard Ext2/3/4 filesystem utilities"
 url="http://e2fsprogs.sourceforge.net"
 license="GPL LGPL MIT"
diff --git a/main/eggdrop/APKBUILD b/main/eggdrop/APKBUILD
index 59c21f2e..2bf311da 100644
--- a/main/eggdrop/APKBUILD
+++ b/main/eggdrop/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Carlo Landmeter <clandmeter at gmail>
 pkgname=eggdrop
 pkgver=1.6.19
-pkgrel=1
+pkgrel=2
 pkgdesc="World's most popular Open Source IRC bot"
 url="http://www.eggheads.org/"
 license='GPL-2'
diff --git a/main/email/APKBUILD b/main/email/APKBUILD
index eff4f3c5..11478b4f 100644
--- a/main/email/APKBUILD
+++ b/main/email/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=email
 pkgver=3.1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A command line SMTP client that's simple"
 url="http://www.cleancode.org/projects/email"
 license="GPL"
diff --git a/main/enchant/APKBUILD b/main/enchant/APKBUILD
index 8133127b..7eb99567 100644
--- a/main/enchant/APKBUILD
+++ b/main/enchant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=enchant
 pkgver=1.5.0
-pkgrel=1
+pkgrel=2
 pkgdesc="A wrapper library for generic spell checking"
 url="http://www.abisource.com/enchant/"
 license="LGPL"
diff --git a/main/epdfview/APKBUILD b/main/epdfview/APKBUILD
index fdd6e418..c89c1e31 100644
--- a/main/epdfview/APKBUILD
+++ b/main/epdfview/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=epdfview
 pkgver=0.1.7
-pkgrel=1
+pkgrel=2
 pkgdesc="A free lightweight PDF document viewer."
 url="http://www.emma-soft.com/projects/epdfview/"
 license="GPL"
diff --git a/main/epris/APKBUILD b/main/epris/APKBUILD
index eb1aaf0b..a313cf61 100644
--- a/main/epris/APKBUILD
+++ b/main/epris/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=epris
 pkgver=0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Small audio player using GStreamer and DBus"
 url="http://code.google.com/p/epris/"
 license="LGPL"
diff --git a/main/espeak/APKBUILD b/main/espeak/APKBUILD
index 2d55080f..c8a114d1 100644
--- a/main/espeak/APKBUILD
+++ b/main/espeak/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=espeak
 pkgver=1.43.03
-pkgrel=0
+pkgrel=1
 pkgdesc="Speech synthesizer for English and other languages"
 url="http://espeak.sourceforge.net/"
 license="GPL-3"
diff --git a/main/ethtool/APKBUILD b/main/ethtool/APKBUILD
index 7532afc2..4a5cd1bc 100644
--- a/main/ethtool/APKBUILD
+++ b/main/ethtool/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ethtool
 pkgver=6
-pkgrel=0
+pkgrel=1
 pkgdesc="gkernel ethtool"
 url="http://sourceforge.net/projects/gkernel/"
 license="GPL"
diff --git a/main/exo/APKBUILD b/main/exo/APKBUILD
index 62277d23..897f279f 100644
--- a/main/exo/APKBUILD
+++ b/main/exo/APKBUILD
@@ -2,7 +2,7 @@
 # TODO: hal
 pkgname=exo
 pkgver=0.3.106
-pkgrel=1
+pkgrel=2
 pkgdesc="Extensions to Xfce by os-cillation"
 url="http://www.os-cillation.com/article.php?sid=40"
 license="GPL-2 LGPL-2"
diff --git a/main/expat/APKBUILD b/main/expat/APKBUILD
index e49d9907..3fb6c621 100644
--- a/main/expat/APKBUILD
+++ b/main/expat/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=expat
 pkgver=2.0.1
-pkgrel=1
+pkgrel=2
 pkgdesc="An XML Parser library written in C"
 url="http://www.libexpat.org/"
 license='AS IS'
diff --git a/main/ez-ipupdate/APKBUILD b/main/ez-ipupdate/APKBUILD
index 9da97305..2d3d4f26 100644
--- a/main/ez-ipupdate/APKBUILD
+++ b/main/ez-ipupdate/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jeremy Thomerson <jeremy@thomersonfamily.com>
 pkgname=ez-ipupdate
 pkgver=3.0.10
-pkgrel=0
+pkgrel=1
 pkgdesc="utility for updating your host name for many of the dynamic DNS services (ez-ip.net, dyndns.org, etc)"
 url="http://ez-ipupdate.com/"
 license="GPL"
diff --git a/main/faac/APKBUILD b/main/faac/APKBUILD
index 3e523a4d..772192f8 100644
--- a/main/faac/APKBUILD
+++ b/main/faac/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=faac
 pkgver=1.28
-pkgrel=0
+pkgrel=1
 pkgdesc="FAAC is an AAC audio encoder."
 url="http://www.audiocoding.com/"
 license="GPL custom"
diff --git a/main/faad2/APKBUILD b/main/faad2/APKBUILD
index e1453df9..11146165 100644
--- a/main/faad2/APKBUILD
+++ b/main/faad2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=faad2
 pkgver=2.7
-pkgrel=0
+pkgrel=1
 pkgdesc="ISO AAC audio decoder"
 url="http://www.audiocoding.com/"
 license="custom:GPL"
diff --git a/main/fakeroot/APKBUILD b/main/fakeroot/APKBUILD
index 4836aed6..6c844616 100644
--- a/main/fakeroot/APKBUILD
+++ b/main/fakeroot/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fakeroot
 pkgver=1.14.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Gives a fake root environment, useful for building packages as a non-privileged user"
 license='GPL'
 url="http://packages.debian.org/fakeroot"
diff --git a/main/fcgi/APKBUILD b/main/fcgi/APKBUILD
index c3a760b3..d2a8bb03 100644
--- a/main/fcgi/APKBUILD
+++ b/main/fcgi/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=fcgi
 pkgver=2.4.0
-pkgrel=0
+pkgrel=1
 pkgdesc="FAST CGI(fcgi) is a language independent, high performant extension to CGI"
 url="http://www.fastcgi.com"
 license="GPL"
diff --git a/main/feh/APKBUILD b/main/feh/APKBUILD
index aeefeb3d..0631a7f6 100644
--- a/main/feh/APKBUILD
+++ b/main/feh/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=feh
 pkgver=1.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="feh is a fast, lightweight image viewer which uses imlib2"
 url="http://www.linuxbrit.co.uk/feh/"
 license="MIT"
diff --git a/main/fetchmail/APKBUILD b/main/fetchmail/APKBUILD
index 779ab8b9..3c099e78 100644
--- a/main/fetchmail/APKBUILD
+++ b/main/fetchmail/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fetchmail
 pkgver=6.3.16
-pkgrel=0
+pkgrel=1
 pkgdesc="A remote-mail retrieval and forwarding utility"
 url="http://fetchmail.berlios.de/"
 license="GPL"
diff --git a/main/ffmpeg/APKBUILD b/main/ffmpeg/APKBUILD
index eb1e167d..5f3e0d94 100644
--- a/main/ffmpeg/APKBUILD
+++ b/main/ffmpeg/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=ffmpeg
 _svnrev=30526
 pkgver=0.5_svn$_svnrev
-pkgrel=1
+pkgrel=2
 pkgdesc="Complete and free Internet live audio and video broadcasting solution for Linux/Unix"
 url="http://ffmpeg.mplayerhq.hu/"
 license="GPL"
diff --git a/main/file/APKBUILD b/main/file/APKBUILD
index 06bde75b..0602565b 100644
--- a/main/file/APKBUILD
+++ b/main/file/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=file
 pkgver=5.04
-pkgrel=0
+pkgrel=1
 pkgdesc="File type identification utility"
 url="http://www.darwinsys.com/file/"
 license="custom"
diff --git a/main/findutils/APKBUILD b/main/findutils/APKBUILD
index 3fbb0bac..31146e8e 100644
--- a/main/findutils/APKBUILD
+++ b/main/findutils/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=findutils
 pkgver=4.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU utilities for finding files"
 url="http://www.gnu.org/software/findutils/"
 license="GPL"
diff --git a/main/flac/APKBUILD b/main/flac/APKBUILD
index d38a07e0..33f097fb 100644
--- a/main/flac/APKBUILD
+++ b/main/flac/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=flac
 pkgver=1.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Free Lossless Audio Codec"
 url="http://flac.sourceforge.net/"
 license="custom:Xiph LGPL GPL FDL"
diff --git a/main/flex/APKBUILD b/main/flex/APKBUILD
index d44643d7..830191ad 100644
--- a/main/flex/APKBUILD
+++ b/main/flex/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncop@alpinelinux.org>
 pkgname=flex
 pkgver=2.5.35
-pkgrel=2
+pkgrel=3
 pkgdesc="A tool for generating text-scanning programs"
 url="http://flex.sourceforge.net"
 license=custom
diff --git a/main/fluxbox/APKBUILD b/main/fluxbox/APKBUILD
index 4229d1bb..dce038f7 100644
--- a/main/fluxbox/APKBUILD
+++ b/main/fluxbox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fluxbox
 pkgver=1.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A lightweight and highly-configurable window manager"
 url="http://www.fluxbox.org"
 license="MIT"
diff --git a/main/font-util/APKBUILD b/main/font-util/APKBUILD
index d7bbb361..fef19d79 100644
--- a/main/font-util/APKBUILD
+++ b/main/font-util/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=font-util
 pkgver=1.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org font utilities"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/fontconfig/APKBUILD b/main/fontconfig/APKBUILD
index 3ae0ffd4..f45956b9 100644
--- a/main/fontconfig/APKBUILD
+++ b/main/fontconfig/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fontconfig
 pkgver=2.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="The Fontconfig package is a library for configuring and customizing font access."
 url="http://fontconfig.org"
 license="GPL"
diff --git a/main/fping/APKBUILD b/main/fping/APKBUILD
index ff529711..9dea9369 100644
--- a/main/fping/APKBUILD
+++ b/main/fping/APKBUILD
@@ -1,7 +1,7 @@
 pkgname=fping
 pkgver=2.4_beta2
 _myver=2.4b2_to
-pkgrel=1
+pkgrel=2
 pkgdesc="A utility to ping multiple hosts at once"
 url="http://www.fping.com/"
 license="fping"
diff --git a/main/fprobe/APKBUILD b/main/fprobe/APKBUILD
index 824129af..f7311e98 100644
--- a/main/fprobe/APKBUILD
+++ b/main/fprobe/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=fprobe
 pkgver=1.1
-pkgrel=2
+pkgrel=3
 pkgdesc="libpcap-based tool that collect network traffic"
 url="http://fprobe.sourceforge.net/"
 license="GPL"
diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 4659f4f5..241b7064 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=1
+pkgrel=2
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
diff --git a/main/freetds/APKBUILD b/main/freetds/APKBUILD
index 5e58429d..bae42d66 100644
--- a/main/freetds/APKBUILD
+++ b/main/freetds/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=freetds
 pkgver=0.82
-pkgrel=1
+pkgrel=2
 pkgdesc="Tabular Datastream Library"
 url="http://www.freetds.org/"
 license="GPL"
diff --git a/main/freetype/APKBUILD b/main/freetype/APKBUILD
index e7f2a87f..f88da34b 100644
--- a/main/freetype/APKBUILD
+++ b/main/freetype/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=freetype
 pkgver=2.3.8
-pkgrel=0
+pkgrel=1
 pkgdesc="TrueType font rendering library"
 url="http://freetype.sourceforge.net"
 license="GPL"
diff --git a/main/fribidi/APKBUILD b/main/fribidi/APKBUILD
index 3c146ec0..fdf62ff6 100644
--- a/main/fribidi/APKBUILD
+++ b/main/fribidi/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fribidi
 pkgver=0.19.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A Free Implementation of the Unicode Bidirectional Algorithm"
 url="http://fribidi.org"
 license="LGPL"
diff --git a/main/galculator/APKBUILD b/main/galculator/APKBUILD
index 4ef92f88..f8f2d436 100644
--- a/main/galculator/APKBUILD
+++ b/main/galculator/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=galculator
 pkgver=1.3.4
-pkgrel=0
+pkgrel=1
 pkgdesc="GTK+ based scientific calculator"
 url="http://galculator.sourceforge.net/"
 license="GPL"
diff --git a/main/gamin/APKBUILD b/main/gamin/APKBUILD
index 730271af..f7c8936a 100644
--- a/main/gamin/APKBUILD
+++ b/main/gamin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gamin
 pkgver=0.1.10
-pkgrel=1
+pkgrel=2
 pkgdesc="Gamin is a file and directory monitoring system defined to be a subset of the FAM (File Alteration Monitor) system."
 url="http://www.gnome.org/~veillard/gamin"
 license="GPL"
diff --git a/main/gawk/APKBUILD b/main/gawk/APKBUILD
index fbc2daaa..45e11601 100644
--- a/main/gawk/APKBUILD
+++ b/main/gawk/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gawk
 pkgver=3.1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU awk pattern-matching language"
 url="http://www.gnu.org/software/gawk/gawk.html"
 license="GPL"
diff --git a/main/gcc/APKBUILD b/main/gcc/APKBUILD
index 43663674..dfbf2529 100644
--- a/main/gcc/APKBUILD
+++ b/main/gcc/APKBUILD
@@ -6,7 +6,7 @@ _specsver=0.1.7
 _espfver=0.3.6
 _uclibc_abiver=0.9.32
 
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNU Compiler Collection"
 url="http://gcc.gnu.org"
 license="GPL LGPL"
diff --git a/main/gd/APKBUILD b/main/gd/APKBUILD
index bee60645..5ec28766 100644
--- a/main/gd/APKBUILD
+++ b/main/gd/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=gd
 pkgver=2.0.36_rc1
 _myver=2.0.36RC1
-pkgrel=1
+pkgrel=2
 pkgdesc="Library for the dynamic creation of images by programmers"
 url="http://www.libgd.org/"
 license="custom"
diff --git a/main/gdb/APKBUILD b/main/gdb/APKBUILD
index a851da31..67bb5d19 100644
--- a/main/gdb/APKBUILD
+++ b/main/gdb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gdb
 pkgver=6.8
-pkgrel=3
+pkgrel=4
 pkgdesc="The GNU Debugger"
 url="http://sources.redhat.com/gdb/"
 license="GPL3"
diff --git a/main/gdbm/APKBUILD b/main/gdbm/APKBUILD
index 9ef44e74..a24bfb1f 100644
--- a/main/gdbm/APKBUILD
+++ b/main/gdbm/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=gdbm
 pkgver=1.8.3
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU dbm is a set of database routines that use extensible hashing"
 url="http://www.gnu.org/software/gdbm/"
 license="GPL"
diff --git a/main/geany/APKBUILD b/main/geany/APKBUILD
index da959e6b..36e77f42 100644
--- a/main/geany/APKBUILD
+++ b/main/geany/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=geany
 pkgver=0.18.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A fast and lightweight IDE"
 url="http://www.geany.org"
 license="GPL"
diff --git a/main/gettext/APKBUILD b/main/gettext/APKBUILD
index f5ca376e..bd9eec61 100644
--- a/main/gettext/APKBUILD
+++ b/main/gettext/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=gettext
 pkgver=0.17
-pkgrel=3
+pkgrel=4
 pkgdesc="GNU locale utilities"
 url="http://www.gnu.org/software/gettext/gettext.html"
 license='GPL'
diff --git a/main/ghostscript/APKBUILD b/main/ghostscript/APKBUILD
index adc8756a..6373c076 100644
--- a/main/ghostscript/APKBUILD
+++ b/main/ghostscript/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Cameron Banta <cbanta@gmail.com>
 pkgname=ghostscript
 pkgver=8.71
-pkgrel=1
+pkgrel=2
 pkgdesc="An interpreter for the PostScript language and for PDF"
 url="http://ghostscript.com/"
 license="GPL"
diff --git a/main/giblib/APKBUILD b/main/giblib/APKBUILD
index e7242d86..90a61b4d 100644
--- a/main/giblib/APKBUILD
+++ b/main/giblib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=giblib
 pkgver=1.2.4
-pkgrel=1
+pkgrel=2
 pkgdesc="Giblib is a library that feh uses as a wrapper to imlib2"
 url="http://linuxbrit.co.uk/giblib/"
 license="MIT"
diff --git a/main/giflib/APKBUILD b/main/giflib/APKBUILD
index 4ea64b88..01fd9047 100644
--- a/main/giflib/APKBUILD
+++ b/main/giflib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=giflib
 pkgver=4.1.6
-pkgrel=1
+pkgrel=2
 pkgdesc="A library for reading and writing gif images"
 url="http://sourceforge.net/projects/giflib/"
 license="MIT"
diff --git a/main/git/APKBUILD b/main/git/APKBUILD
index ca396675..1b1b4e55 100644
--- a/main/git/APKBUILD
+++ b/main/git/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=git
 pkgver=1.7.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="GIT - the stupid content tracker"
 url="http://git.or.cz/"
 license="GPL2"
diff --git a/main/glib/APKBUILD b/main/glib/APKBUILD
index 4c2405eb..e975ad92 100644
--- a/main/glib/APKBUILD
+++ b/main/glib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=glib
 pkgver=2.24.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Common C routines used by Gtk+ and other libs"
 url="http://www.gtk.org"
 license='GPL'
diff --git a/main/gmp/APKBUILD b/main/gmp/APKBUILD
index 5407514d..36ad708d 100644
--- a/main/gmp/APKBUILD
+++ b/main/gmp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gmp
 pkgver=4.3.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A free library for arbitrary precision arithmetic"
 url="http://gmplib.org/"
 license="LGPL3"
diff --git a/main/gnats/APKBUILD b/main/gnats/APKBUILD
index 87ca01e2..bcf94e1b 100644
--- a/main/gnats/APKBUILD
+++ b/main/gnats/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gnats
 pkgver=4.1.0
-pkgrel=2
+pkgrel=3
 pkgdesc="The GNU Bug Tracking System"
 url="http://www.gnu.org/software/gnats/"
 license="GPL-2"
diff --git a/main/gnupg/APKBUILD b/main/gnupg/APKBUILD
index fa1387b7..4e04d84b 100644
--- a/main/gnupg/APKBUILD
+++ b/main/gnupg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gnupg
 pkgver=2.0.10
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU Privacy Guard 2 - a PGP replacement tool"
 url="http://www.gnupg.org/"
 license="GPL"
diff --git a/main/gnutls/APKBUILD b/main/gnutls/APKBUILD
index 160f0155..ebd171cb 100644
--- a/main/gnutls/APKBUILD
+++ b/main/gnutls/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gnutls
 pkgver=2.8.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A library which provides a secure connection"
 url="http://www.gnu.org/software/gnutls/"
 license="GPL"
diff --git a/main/gobject-introspection/APKBUILD b/main/gobject-introspection/APKBUILD
index 6e936cb0..da6aafb2 100644
--- a/main/gobject-introspection/APKBUILD
+++ b/main/gobject-introspection/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gobject-introspection
 pkgver=0.6.9
-pkgrel=0
+pkgrel=1
 pkgdesc="Introspection system for GObject-based libraries"
 url="http://live.gnome.org/GObjectInstrospection"
 license="LGPL GPL"
diff --git a/main/gperf/APKBUILD b/main/gperf/APKBUILD
index e52d2df2..84d5ab2c 100644
--- a/main/gperf/APKBUILD
+++ b/main/gperf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gperf
 pkgver=3.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Perfect hash function generator."
 url="http://www.gnu.org/software/gperf/"
 license="GPL"
diff --git a/main/gpicview/APKBUILD b/main/gpicview/APKBUILD
index 9db0713c..6c2062c3 100644
--- a/main/gpicview/APKBUILD
+++ b/main/gpicview/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gpicview
 pkgver=0.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Picture viewer of the LXDE Desktop"
 url="http://wiki.lxde.org/en/GPicView"
 license="GPL-2"
diff --git a/main/grep/APKBUILD b/main/grep/APKBUILD
index 7d1106be..df9cd263 100644
--- a/main/grep/APKBUILD
+++ b/main/grep/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer:
 pkgname=grep
 pkgver=2.6.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Searches input files for lines containing a match to a specified pattern"
 url="http://www.gnu.org/software/grep/grep.html"
 license="GPL"
diff --git a/main/groff/APKBUILD b/main/groff/APKBUILD
index 8b9098e3..ffd69601 100644
--- a/main/groff/APKBUILD
+++ b/main/groff/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=groff
 pkgver=1.20.1
-pkgrel=1
+pkgrel=2
 pkgdesc="GNU troff text-formatting system"
 url="http://www.gnu.org/software/groff/groff.html"
 license="GPL"
diff --git a/main/gross/APKBUILD b/main/gross/APKBUILD
index 7e6953d9..efb7ba61 100644
--- a/main/gross/APKBUILD
+++ b/main/gross/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gross
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Greylisting of suspicious sources"
 url="http://code.google.com/p/gross/"
 license="BSD"
diff --git a/main/gst-plugins-bad/APKBUILD b/main/gst-plugins-bad/APKBUILD
index 97eb64f2..b5b522d0 100644
--- a/main/gst-plugins-bad/APKBUILD
+++ b/main/gst-plugins-bad/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-bad
 pkgver=0.10.14
-pkgrel=0
+pkgrel=1
 pkgdesc="GStreamer bad plugins"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL GPL"
diff --git a/main/gst-plugins-base/APKBUILD b/main/gst-plugins-base/APKBUILD
index 253cc5fe..f5b6b13b 100644
--- a/main/gst-plugins-base/APKBUILD
+++ b/main/gst-plugins-base/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-base
 pkgver=0.10.25
-pkgrel=2
+pkgrel=3
 pkgdesc="GStreamer Multimedia Framework Base Plugins"
 url="http://gstreamer.freedesktop.org/"
 license="GPL LGPL"
diff --git a/main/gst-plugins-ffmpeg/APKBUILD b/main/gst-plugins-ffmpeg/APKBUILD
index 1949f16c..c6fc5e04 100644
--- a/main/gst-plugins-ffmpeg/APKBUILD
+++ b/main/gst-plugins-ffmpeg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-ffmpeg
 pkgver=0.10.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Gstreamer FFMpeg Plugin"
 url="http://www.gstreamer.net"
 license="GPL"
diff --git a/main/gst-plugins-good/APKBUILD b/main/gst-plugins-good/APKBUILD
index ed2088ea..eee04aaf 100644
--- a/main/gst-plugins-good/APKBUILD
+++ b/main/gst-plugins-good/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-good
 pkgver=0.10.17
-pkgrel=2
+pkgrel=3
 pkgdesc="GStreamer Multimedia Framework Good Plugins"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
diff --git a/main/gst-plugins-ugly/APKBUILD b/main/gst-plugins-ugly/APKBUILD
index cb49433c..ebfec2d6 100644
--- a/main/gst-plugins-ugly/APKBUILD
+++ b/main/gst-plugins-ugly/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-ugly
 pkgver=0.10.13
-pkgrel=0
+pkgrel=1
 pkgdesc="GStreamer Multimedia Framework Ugly Plugins (gst-plugins-ugly)"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
diff --git a/main/gstreamer/APKBUILD b/main/gstreamer/APKBUILD
index df825c01..2259c6ff 100644
--- a/main/gstreamer/APKBUILD
+++ b/main/gstreamer/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gstreamer
 pkgver=0.10.25
-pkgrel=0
+pkgrel=1
 pkgdesc="GStreamer Multimedia Framework"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
diff --git a/main/gtk+/APKBUILD b/main/gtk+/APKBUILD
index 9ce2d3cc..3300e88a 100644
--- a/main/gtk+/APKBUILD
+++ b/main/gtk+/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk+
 pkgver=2.20.0
-pkgrel=0
+pkgrel=1
 pkgdesc="The GTK+ Toolkit (v2)"
 url="http://www.gtk.org/"
 install="$pkgname.post-install $pkgname.post-upgrade $pkgname.post-deinstall"
diff --git a/main/gtk-vnc/APKBUILD b/main/gtk-vnc/APKBUILD
index 5e03a8c9..a321b867 100644
--- a/main/gtk-vnc/APKBUILD
+++ b/main/gtk-vnc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk-vnc
 pkgver=0.3.10
-pkgrel=1
+pkgrel=2
 pkgdesc="A VNC viewer widget for GTK"
 url="http://live.gnome.org/gtk-vnc"
 license="LGPL"
diff --git a/main/gtk-xfce-engine/APKBUILD b/main/gtk-xfce-engine/APKBUILD
index d83f314e..888c79f3 100644
--- a/main/gtk-xfce-engine/APKBUILD
+++ b/main/gtk-xfce-engine/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk-xfce-engine
 pkgver=2.6.0
-pkgrel=1
+pkgrel=2
 pkgdesc="A port of Xfce engine to GTK+-2.0"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/guile/APKBUILD b/main/guile/APKBUILD
index 2a7609e0..e09000f4 100644
--- a/main/guile/APKBUILD
+++ b/main/guile/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=guile
 pkgver=1.8.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Guile is a portable, embeddable Scheme implementation written in C"
 url="http://www.gnu.org/software/guile/"
 license="GPL"
diff --git a/main/gzip/APKBUILD b/main/gzip/APKBUILD
index e6c6c316..1d3510ac 100644
--- a/main/gzip/APKBUILD
+++ b/main/gzip/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gzip
 pkgver=1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A popular data compression program"
 subpackages="$pkgname-doc"
 url="http://www.gnu.org/software/gzip/"
diff --git a/main/haserl/APKBUILD b/main/haserl/APKBUILD
index 4f742cd3..9e86e354 100644
--- a/main/haserl/APKBUILD
+++ b/main/haserl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=haserl
 pkgver=0.9.25
-pkgrel=1
+pkgrel=2
 pkgdesc="Html And Shell Embedded Report Language"
 url="http://haserl.sourceforge.net/"
 license="GPL-2"
diff --git a/main/heimdal/APKBUILD b/main/heimdal/APKBUILD
index e98d9cf0..cb867c72 100644
--- a/main/heimdal/APKBUILD
+++ b/main/heimdal/APKBUILD
@@ -2,7 +2,7 @@
 # Contributor: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=heimdal
 pkgver=1.3.1
-pkgrel=4
+pkgrel=5
 pkgdesc="An implementation of Kerberos 5"
 url="http://www.h5l.org/"
 license="BSD"
diff --git a/main/hostapd/APKBUILD b/main/hostapd/APKBUILD
index c08847fd..a0acf6a6 100644
--- a/main/hostapd/APKBUILD
+++ b/main/hostapd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hostapd
 pkgver=0.6.10
-pkgrel=0
+pkgrel=1
 pkgdesc="daemon for wireless software access points"
 url="http://hostap.epitest.fi/hostapd/"
 license="custom"
diff --git a/main/htop/APKBUILD b/main/htop/APKBUILD
index cb62c3a5..7d27031c 100644
--- a/main/htop/APKBUILD
+++ b/main/htop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer:Carlo Landmeter
 pkgname=htop
 pkgver=0.8.3
-pkgrel=0
+pkgrel=1
 pkgdesc="An interactive process viewer for Linux"
 url="http://htop.sourceforge.net"
 license='GPL'
diff --git a/main/hunspell/APKBUILD b/main/hunspell/APKBUILD
index baf7876c..029b9032 100644
--- a/main/hunspell/APKBUILD
+++ b/main/hunspell/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hunspell
 pkgver=1.2.8
-pkgrel=0
+pkgrel=1
 pkgdesc="Spell checker and morphological analyzer library and program"
 url="http://hunspell.sourceforge.net/"
 license="GPL LGPL MPL"
diff --git a/main/hylafax/APKBUILD b/main/hylafax/APKBUILD
index 42450d46..06a868b9 100644
--- a/main/hylafax/APKBUILD
+++ b/main/hylafax/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Cameron Banta <cbanta@gmail.com>
 pkgname=hylafax
 pkgver=4.4.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Sends and receives faxes"
 url="http://www.hylafax.org/"
 license="custom"
diff --git a/main/hypermail/APKBUILD b/main/hypermail/APKBUILD
index baf9fa10..d41cb8db 100644
--- a/main/hypermail/APKBUILD
+++ b/main/hypermail/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=hypermail
 pkgver=2.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Mail Archiver"
 url="http://www.hypermail-project.org"
 license="GPL"
diff --git a/main/iaxmodem/APKBUILD b/main/iaxmodem/APKBUILD
index 7393e754..786c0799 100644
--- a/main/iaxmodem/APKBUILD
+++ b/main/iaxmodem/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Cameron Banta <cbanta@gmail.com>
 pkgname=iaxmodem
 pkgver=1.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Softmodem for hylafax that connects to VOIP gateway with IAX"
 url="http://iaxmodem.sourceforge.net/"
 license="GPL"
diff --git a/main/iceauth/APKBUILD b/main/iceauth/APKBUILD
index 30da7ad0..eed42250 100644
--- a/main/iceauth/APKBUILD
+++ b/main/iceauth/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iceauth
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org ICE authority file utility"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/icu/APKBUILD b/main/icu/APKBUILD
index f37e7664..5e2b3d97 100644
--- a/main/icu/APKBUILD
+++ b/main/icu/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=icu
 pkgver=4.4
 _ver=4_2_1
-pkgrel=0
+pkgrel=1
 pkgdesc="International Components for Unicode library"
 url="http://www.icu-project.org/"
 license="custom:icu"
diff --git a/main/iftop/APKBUILD b/main/iftop/APKBUILD
index db210d49..ea750d2c 100644
--- a/main/iftop/APKBUILD
+++ b/main/iftop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iftop
 pkgver=0.17
-pkgrel=0
+pkgrel=1
 pkgdesc="iftop does for network usage what top(1) does for CPU usage"
 url="http://www.ex-parrot.com/~pdw/iftop/"
 license="GPL"
diff --git a/main/igmpproxy/APKBUILD b/main/igmpproxy/APKBUILD
index 2ec2c018..3bb9be97 100644
--- a/main/igmpproxy/APKBUILD
+++ b/main/igmpproxy/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=igmpproxy
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="a simple dynamic Multicast Routing Daemon using only IGMP signalling"
 url="http://sourceforge.net/projects/igmpproxy/"
 license="GPL"
diff --git a/main/imagemagick/APKBUILD b/main/imagemagick/APKBUILD
index 982416a9..eaaad7d8 100644
--- a/main/imagemagick/APKBUILD
+++ b/main/imagemagick/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=imagemagick
 pkgver=6.6.0.10
 _pkgver=${pkgver%.*}-${pkgver##*.}
-pkgrel=0
+pkgrel=1
 pkgdesc="A collection of tools and libraries for many image formats"
 url="http://www.imagemagick.org/"
 license="GPL"
diff --git a/main/imap/APKBUILD b/main/imap/APKBUILD
index f7c788c2..39f0acb7 100644
--- a/main/imap/APKBUILD
+++ b/main/imap/APKBUILD
@@ -5,7 +5,7 @@
 # build it shared
 pkgname=imap
 pkgver=2007e
-pkgrel=3
+pkgrel=4
 pkgdesc="An IMAP/POP server"
 url="http://www.washington.edu/imap"
 license="APACHE"
diff --git a/main/imlib2/APKBUILD b/main/imlib2/APKBUILD
index ff9944a9..5176e2e5 100644
--- a/main/imlib2/APKBUILD
+++ b/main/imlib2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=imlib2
 pkgver=1.4.2
-pkgrel=4
+pkgrel=5
 pkgdesc="Library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support"
 url="http://sourceforge.net/projects/enlightenment/"
 license="BSD"
diff --git a/main/iperf/APKBUILD b/main/iperf/APKBUILD
index c9951eb8..d133c905 100644
--- a/main/iperf/APKBUILD
+++ b/main/iperf/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iperf
 pkgver=2.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="tool to measure IP bandwidth using UDP or TCP"
 url="http://iperf.sourceforge.net/"
 license="GPL"
diff --git a/main/iproute2/APKBUILD b/main/iproute2/APKBUILD
index c031ed9c..fed741b4 100644
--- a/main/iproute2/APKBUILD
+++ b/main/iproute2/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=iproute2
 pkgver=2.6.31
 _realver=2.6.31
-pkgrel=0
+pkgrel=1
 pkgdesc="IP Routing Utilities"
 url="http://www.linux-foundation.org/en/Net:Iproute2"
 license="GPL2"
diff --git a/main/ipsec-tools/APKBUILD b/main/ipsec-tools/APKBUILD
index a3da4fc1..0b612f32 100644
--- a/main/ipsec-tools/APKBUILD
+++ b/main/ipsec-tools/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=ipsec-tools
 pkgver=0.8_alpha20090903
 _myver=0.8-alpha20090903
-pkgrel=6
+pkgrel=7
 pkgdesc="User-space IPsec tools for various IPsec implementations"
 url="http://ipsec-tools.sourceforge.net/"
 license="BSD"
diff --git a/main/iptables/APKBUILD b/main/iptables/APKBUILD
index 09c5ffb3..836131dd 100644
--- a/main/iptables/APKBUILD
+++ b/main/iptables/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=iptables
 pkgver=1.4.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel firewall, NAT and packet mangling tools"
 url="http://www.iptables.org/"
 license=GPL-2
diff --git a/main/iptraf/APKBUILD b/main/iptraf/APKBUILD
index e8f0c496..152bbe45 100644
--- a/main/iptraf/APKBUILD
+++ b/main/iptraf/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=iptraf
 pkgver=3.0.0
-pkgrel=2
+pkgrel=3
 pkgdesc="IP Network Monitoring Software"
 url="http://iptraf.seoul.org"
 license="GPL"
diff --git a/main/iputils/APKBUILD b/main/iputils/APKBUILD
index 75cf4c5b..b5d7e25d 100644
--- a/main/iputils/APKBUILD
+++ b/main/iputils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iputils
 pkgver=20100214
-pkgrel=0
+pkgrel=1
 pkgdesc="IP Configuration Utilities (and Ping)"
 url="http://www.linuxfoundation.org/en/Net:Iputils"
 license="GPL"
diff --git a/main/ircii/APKBUILD b/main/ircii/APKBUILD
index 2ff651e8..bcb44899 100644
--- a/main/ircii/APKBUILD
+++ b/main/ircii/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ircii
 pkgver=20060725
-pkgrel=0
+pkgrel=1
 pkgdesc="ircII is an IRC and ICB client that runs under most UNIX platforms."
 url="http://www.eterna.com.au/ircii/"
 license="GPL-2"
diff --git a/main/irssi/APKBUILD b/main/irssi/APKBUILD
index e5e324c8..e20661c3 100644
--- a/main/irssi/APKBUILD
+++ b/main/irssi/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=irssi
 pkgver=0.8.14
 #_pkgver=0.8.14
-pkgrel=1
+pkgrel=2
 pkgdesc="A modular textUI IRC client with IPv6 support"
 url="http://irssi.org/"
 license='GPL'
diff --git a/main/iscsitarget/APKBUILD b/main/iscsitarget/APKBUILD
index 67394407..6ef57463 100644
--- a/main/iscsitarget/APKBUILD
+++ b/main/iscsitarget/APKBUILD
@@ -2,7 +2,7 @@
 
 pkgname=iscsitarget
 pkgver=1.4.19
-pkgrel=0
+pkgrel=1
 pkgdesc="Open Source iSCSI target with professional features - userspace utils"
 url="http://iscsitarget.sourceforge.net/"
 license="GPL-2"
diff --git a/main/jasper/APKBUILD b/main/jasper/APKBUILD
index 9317a184..d74cbd43 100644
--- a/main/jasper/APKBUILD
+++ b/main/jasper/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=jasper
 pkgver=1.900.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A software-based implementation of the codec specified in the emerging JPEG-2000 Part-1 standard"
 url="http://www.ece.uvic.ca/~mdadams/jasper/"
 license="custom:JasPer2.0"
diff --git a/main/jpeg/APKBUILD b/main/jpeg/APKBUILD
index 9292022a..e3bd30d1 100644
--- a/main/jpeg/APKBUILD
+++ b/main/jpeg/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=jpeg
 pkgver=8
-pkgrel=0
+pkgrel=1
 pkgdesc="JPEG image tools"
 url="http://www.ijg.org/"
 license="AS-IS"
diff --git a/main/kamailio/APKBUILD b/main/kamailio/APKBUILD
index e085fdad..84355bb1 100644
--- a/main/kamailio/APKBUILD
+++ b/main/kamailio/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=kamailio
 pkgver=1.5.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Open Source SIP Server"
 url="http://www.kamailio.org/"
 pkgusers="kamailio"
diff --git a/main/ksymoops/APKBUILD b/main/ksymoops/APKBUILD
index 44736384..9653627d 100644
--- a/main/ksymoops/APKBUILD
+++ b/main/ksymoops/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ksymoops
 pkgver=2.4.11
-pkgrel=0
+pkgrel=1
 pkgdesc="A Linux kernel Oops file troubleshooting tool"
 url="ftp://ftp.kernel.org/pub/linux/utils/kernel/ksymoops/v2.4"
 license="GPL-2"
diff --git a/main/lame/APKBUILD b/main/lame/APKBUILD
index 83fe97d1..85a151c6 100644
--- a/main/lame/APKBUILD
+++ b/main/lame/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lame
 pkgver=3.98.3
 _ver=398-2
-pkgrel=0
+pkgrel=1
 pkgdesc="An MP3 encoder and graphical frame analyzer"
 url="http://lame.sourceforge.net/"
 license="LGPL"
diff --git a/main/less/APKBUILD b/main/less/APKBUILD
index 8fdbb273..7508a25f 100644
--- a/main/less/APKBUILD
+++ b/main/less/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Cameron Banta <cbanta@gmail.com>
 pkgname=less
 pkgver=436
-pkgrel=0
+pkgrel=1
 pkgdesc="File pager"
 url="http://www.greenwoodsoftware.com/less/"
 license="GPL"
diff --git a/main/lftp/APKBUILD b/main/lftp/APKBUILD
index ffd61ae0..cf79f761 100644
--- a/main/lftp/APKBUILD
+++ b/main/lftp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=lftp
 pkgver=4.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="LFTP is sophisticated ftp/http client"
 url="http://lftp.yar.ru/"
 license="GPL"
diff --git a/main/lha/APKBUILD b/main/lha/APKBUILD
index fc075b3c..5fc94b35 100644
--- a/main/lha/APKBUILD
+++ b/main/lha/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=lha
 pkgver=1.14i
-pkgrel=0
+pkgrel=1
 pkgdesc="Compression and archive utility for LH-7 format archives"
 url="http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
 license="custom"
diff --git a/main/libao/APKBUILD b/main/libao/APKBUILD
index f028bab0..d9452338 100644
--- a/main/libao/APKBUILD
+++ b/main/libao/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libao
 pkgver=0.8.8
-pkgrel=1
+pkgrel=2
 pkgdesc="Cross-platform audio output library and plugins"
 url="http://www.xiph.org/ao"
 license="GPL"
diff --git a/main/libart-lgpl/APKBUILD b/main/libart-lgpl/APKBUILD
index a9cf7776..0203cd51 100644
--- a/main/libart-lgpl/APKBUILD
+++ b/main/libart-lgpl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libart-lgpl
 pkgver=2.3.21
-pkgrel=0
+pkgrel=1
 pkgdesc="A library for high-performance 2D graphics"
 url="http://www.levien.com/libart/"
 license="LGPL"
diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 4ec21af2..253a7318 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100427
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=0
+pkgrel=1
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
diff --git a/main/libcap/APKBUILD b/main/libcap/APKBUILD
index 61b526cc..e379bee1 100644
--- a/main/libcap/APKBUILD
+++ b/main/libcap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libcap
 pkgver=2.19
-pkgrel=0
+pkgrel=1
 pkgdesc="POSIX 1003.1e capabilities"
 license="GPL"
 url="http://www.friedhoff.org/posixfilecaps.html"
diff --git a/main/libconfig/APKBUILD b/main/libconfig/APKBUILD
index cd2d6e00..b566400a 100644
--- a/main/libconfig/APKBUILD
+++ b/main/libconfig/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libconfig
 pkgver=1.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="a simple library for manipulating structured configuration files"
 url="http://www.hyperrealm.com/libconfig/"
 license='LGPL'
diff --git a/main/libcroco/APKBUILD b/main/libcroco/APKBUILD
index 47a28966..4c0e8ef4 100644
--- a/main/libcroco/APKBUILD
+++ b/main/libcroco/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libcroco
 pkgver=0.6.2
-pkgrel=0
+pkgrel=1
 pkgdesc="GNOME CSS2 parsing and manipulation toolkit"
 url="http://www.gnome.org"
 license="LGPL"
diff --git a/main/libdrm/APKBUILD b/main/libdrm/APKBUILD
index 3e265a00..9138bbf4 100644
--- a/main/libdrm/APKBUILD
+++ b/main/libdrm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libdrm
 pkgver=2.4.20
-pkgrel=0
+pkgrel=1
 pkgdesc="Userspace interface to kernel DRM services"
 url="http://dri.freedesktop.org/"
 license="custom"
diff --git a/main/libevent/APKBUILD b/main/libevent/APKBUILD
index a90b9678..f7447798 100644
--- a/main/libevent/APKBUILD
+++ b/main/libevent/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libevent
 pkgver=1.4.13
-pkgrel=0
+pkgrel=1
 pkgdesc="An event notification library"
 url="http://www.monkey.org/~provos/libevent/"
 license="GPL-2"
diff --git a/main/libexif/APKBUILD b/main/libexif/APKBUILD
index ba829f8b..83546b1c 100644
--- a/main/libexif/APKBUILD
+++ b/main/libexif/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libexif
 pkgver=0.6.19
-pkgrel=0
+pkgrel=1
 pkgdesc="A library to parse an EXIF file and read the data from those tags"
 url="http://sourceforge.net/projects/libexif"
 license="LGPL"
diff --git a/main/libffi/APKBUILD b/main/libffi/APKBUILD
index 3ef74150..39b3ba3a 100644
--- a/main/libffi/APKBUILD
+++ b/main/libffi/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libffi
 pkgver=3.0.9
-pkgrel=0
+pkgrel=1
 pkgdesc="A portable, high level programming interface to various calling conventions."
 url="http://sourceware.org/libffi"
 license="MIT"
diff --git a/main/libfontenc/APKBUILD b/main/libfontenc/APKBUILD
index 7dac13ea..e7b1e30b 100644
--- a/main/libfontenc/APKBUILD
+++ b/main/libfontenc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libfontenc
 pkgver=1.0.5
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 font encoding library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libgcrypt/APKBUILD b/main/libgcrypt/APKBUILD
index 644c2696..9f8c2044 100644
--- a/main/libgcrypt/APKBUILD
+++ b/main/libgcrypt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgcrypt
 pkgver=1.4.5
-pkgrel=0
+pkgrel=1
 pkgdesc="general purpose crypto library based on the code used in GnuPG"
 url="http://www.gnupg.org"
 license="LGPL"
diff --git a/main/libglade/APKBUILD b/main/libglade/APKBUILD
index 3a4b079e..3b8f67e6 100644
--- a/main/libglade/APKBUILD
+++ b/main/libglade/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libglade
 pkgver=2.6.4
-pkgrel=1
+pkgrel=2
 pkgdesc="Allows you to load glade interface files in a program at runtime"
 url="http://www.gnome.org"
 license="LGPL"
diff --git a/main/libgpg-error/APKBUILD b/main/libgpg-error/APKBUILD
index 75e401e3..2ae2c026 100644
--- a/main/libgpg-error/APKBUILD
+++ b/main/libgpg-error/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgpg-error
 pkgver=1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Support library for libgcrypt"
 url="http://www.gnupg.org"
 license="LGPL"
diff --git a/main/libgsf/APKBUILD b/main/libgsf/APKBUILD
index ae307f67..f8bdaa9a 100644
--- a/main/libgsf/APKBUILD
+++ b/main/libgsf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgsf
 pkgver=1.14.16
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNOME Structured File Library is a utility library for reading and writing structured file formats."
 url="http://www.gnome.org/"
 license="GPL LGPL"
diff --git a/main/libice/APKBUILD b/main/libice/APKBUILD
index 4cf8058d..5da1d877 100644
--- a/main/libice/APKBUILD
+++ b/main/libice/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libice
 pkgver=1.0.6
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Inter-Client Exchange library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libiconv/APKBUILD b/main/libiconv/APKBUILD
index e8175dd5..0ad6f627 100644
--- a/main/libiconv/APKBUILD
+++ b/main/libiconv/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=libiconv
 pkgver=1.12
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU charset conversion library for libc which doesn't implement it"
 url="http://www.gnu.org/software/libiconv"
 license='LGPL'
diff --git a/main/libid3tag/APKBUILD b/main/libid3tag/APKBUILD
index 9410e353..1bd9c956 100644
--- a/main/libid3tag/APKBUILD
+++ b/main/libid3tag/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=libid3tag
 pkgver=0.15.1b
-pkgrel=0
+pkgrel=1
 pkgdesc="id3 tagger for mp3"
 url="http://www.underbit.com/products/mad/"
 license="GPL"
diff --git a/main/libidn/APKBUILD b/main/libidn/APKBUILD
index cc4d7af2..b684e642 100644
--- a/main/libidn/APKBUILD
+++ b/main/libidn/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libidn
 pkgver=1.16
-pkgrel=0
+pkgrel=1
 pkgdesc="An encode and decode library for internationalized domain names"
 url="http://www.gnu.org/software/libidn/"
 license="GPL"
diff --git a/main/libksba/APKBUILD b/main/libksba/APKBUILD
index ae100b62..9169690b 100644
--- a/main/libksba/APKBUILD
+++ b/main/libksba/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libksba
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Libksba is a CMS and X.509 access library"
 url="ftp://ftp.gnupg.org/gcrypt/alpha/libksba"
 license="GPL"
diff --git a/main/libmad/APKBUILD b/main/libmad/APKBUILD
index 72968faa..f48894ae 100644
--- a/main/libmad/APKBUILD
+++ b/main/libmad/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libmad
 pkgver=0.15.1b
-pkgrel=0
+pkgrel=1
 pkgdesc="A high-quality MPEG audio decoder"
 url="http://www.underbit.com/products/mad/"
 license="GPL"
diff --git a/main/libmcrypt/APKBUILD b/main/libmcrypt/APKBUILD
index 27d6523b..76b6948c 100644
--- a/main/libmcrypt/APKBUILD
+++ b/main/libmcrypt/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=libmcrypt
 pkgver=2.5.8
-pkgrel=0
+pkgrel=1
 pkgdesc="A library which provides a uniform interface to several symmetric encryption algorithms"
 url="http://mcrypt.sourceforge.net/"
 license="GPL"
diff --git a/main/libmpdclient/APKBUILD b/main/libmpdclient/APKBUILD
index 4b439586..81f413e2 100644
--- a/main/libmpdclient/APKBUILD
+++ b/main/libmpdclient/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libmpdclient
 pkgver=2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="An asynchronous API library for interfacing MPD in the C, C++ & Objective C languages"
 url="http://mpd.wikia.com/wiki/Client:libmpdclient"
 license="GPL2"
diff --git a/main/libmpeg2/APKBUILD b/main/libmpeg2/APKBUILD
index 15704d0d..e933c835 100644
--- a/main/libmpeg2/APKBUILD
+++ b/main/libmpeg2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libmpeg2
 pkgver=0.5.1
-pkgrel=1
+pkgrel=2
 pkgdesc="libmpeg2 is a library for decoding MPEG-1 and MPEG-2 video streams."
 url="http://libmpeg2.sourceforge.net/"
 license="GPL2"
diff --git a/main/libnet/APKBUILD b/main/libnet/APKBUILD
index 8d341b2e..558f827b 100644
--- a/main/libnet/APKBUILD
+++ b/main/libnet/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Your Name <youremail@domain.com>
 pkgname=libnet
 pkgver=1.1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A generic networking API that provides access to several protocols."
 url="http://sourceforge.net/projects/libnet-dev/"
 license="BSD"
diff --git a/main/libnetfilter_conntrack/APKBUILD b/main/libnetfilter_conntrack/APKBUILD
index 1262fe4b..af9dc280 100644
--- a/main/libnetfilter_conntrack/APKBUILD
+++ b/main/libnetfilter_conntrack/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libnetfilter_conntrack
 pkgver=0.0.101
-pkgrel=0
+pkgrel=1
 pkgdesc="programming interface (API) to the in-kernel connection tracking state table"
 url="http://www.netfilter.org/projects/libnetfilter_conntrack/"
 license="GPL-2"
diff --git a/main/libnfnetlink/APKBUILD b/main/libnfnetlink/APKBUILD
index 448b5557..cebfe70a 100644
--- a/main/libnfnetlink/APKBUILD
+++ b/main/libnfnetlink/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libnfnetlink
 pkgver=1.0.0
-pkgrel=0
+pkgrel=1
 pkgdesc="low-level library for netfilter related kernel/userspace communication"
 url="http://www.netfilter.org/projects/libnfnetlink/"
 license="GPL-2"
diff --git a/main/libnl/APKBUILD b/main/libnl/APKBUILD
index 9db755ae..b63fb044 100644
--- a/main/libnl/APKBUILD
+++ b/main/libnl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libnl
 pkgver=1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Library for applications dealing with netlink sockets"
 url="http://people.suug.ch/~tgr/libnl"
 license="GPL"
diff --git a/main/libnotify/APKBUILD b/main/libnotify/APKBUILD
index 788d3b97..4d366af4 100644
--- a/main/libnotify/APKBUILD
+++ b/main/libnotify/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libnotify
 pkgver=0.4.5
-pkgrel=1
+pkgrel=2
 pkgdesc="Desktop notification library"
 url="http://www.galago-project.org/"
 license="LGPL"
diff --git a/main/libogg/APKBUILD b/main/libogg/APKBUILD
index 13fc7688..072f0216 100644
--- a/main/libogg/APKBUILD
+++ b/main/libogg/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=libogg
 pkgver=1.1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Ogg bitstream and framing library"
 url="http://xiph.org/ogg/"
 license="as-is"
diff --git a/main/liboil/APKBUILD b/main/liboil/APKBUILD
index 57cdaa0e..11a577a4 100644
--- a/main/liboil/APKBUILD
+++ b/main/liboil/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=liboil
 pkgver=0.3.17
-pkgrel=0
+pkgrel=1
 pkgdesc="Library of simple functions that are optimized for various CPUs."
 url="http://liboil.freedesktop.org/"
 license="custom"
diff --git a/main/libpaper/APKBUILD b/main/libpaper/APKBUILD
index 9650361f..5cf53829 100644
--- a/main/libpaper/APKBUILD
+++ b/main/libpaper/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libpaper
 pkgver=1.1.23
-pkgrel=0
+pkgrel=1
 pkgdesc="Library for handling paper characteristics"
 url="http://packages.debian.org/unstable/source/libpaper"
 license="GPL"
diff --git a/main/libpcap/APKBUILD b/main/libpcap/APKBUILD
index a4a9f7de..85a94622 100644
--- a/main/libpcap/APKBUILD
+++ b/main/libpcap/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=libpcap
 pkgver=1.0.0
 _sover=1.0.0
-pkgrel=2
+pkgrel=3
 pkgdesc="A system-independent interface for user-level packet capture"
 url="http://www.tcpdump.org/"
 license="BSD"
diff --git a/main/libpciaccess/APKBUILD b/main/libpciaccess/APKBUILD
index 1f5e6365..3ca31cda 100644
--- a/main/libpciaccess/APKBUILD
+++ b/main/libpciaccess/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libpciaccess
 pkgver=0.11.0
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 PCI access library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libpng/APKBUILD b/main/libpng/APKBUILD
index 0f971679..70f15d01 100644
--- a/main/libpng/APKBUILD
+++ b/main/libpng/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=libpng
 pkgver=1.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Portable Network Graphics library"
 url="http://www.libpng.org/"
 license="GPL"
diff --git a/main/libpri/APKBUILD b/main/libpri/APKBUILD
index 05467c53..4094083a 100644
--- a/main/libpri/APKBUILD
+++ b/main/libpri/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=libpri
 pkgver=1.4.11_alpha1
 _pkgver=1.4.10.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Primary Rate ISDN (PRI) library"
 url="http://www.asterisk.orig"
 license="GPL"
diff --git a/main/librsvg/APKBUILD b/main/librsvg/APKBUILD
index 49b474f2..a0e7acf5 100644
--- a/main/librsvg/APKBUILD
+++ b/main/librsvg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=librsvg
 pkgver=2.26.2
-pkgrel=0
+pkgrel=1
 pkgdesc="SAX-based renderer for SVG files into a GdkPixbuf"
 url="http://librsvg.sourceforge.net/"
 license="LGPL"
diff --git a/main/libsamplerate/APKBUILD b/main/libsamplerate/APKBUILD
index 8c3d75c1..71b38fb3 100644
--- a/main/libsamplerate/APKBUILD
+++ b/main/libsamplerate/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsamplerate
 pkgver=0.1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Secret Rabbit Code - aka Sample Rate Converter for audio"
 url="http://www.mega-nerd.com/SRC/index.html"
 subpackages="$pkgname-dev"
diff --git a/main/libsexy/APKBUILD b/main/libsexy/APKBUILD
index 64488a0a..ad2f441b 100644
--- a/main/libsexy/APKBUILD
+++ b/main/libsexy/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsexy
 pkgver=0.1.11
-pkgrel=0
+pkgrel=1
 pkgdesc="Doing naughty things to good widgets."
 url="http://chipx86.com/wiki/Libsexy"
 license="GPL"
diff --git a/main/libsm/APKBUILD b/main/libsm/APKBUILD
index 9f17e18a..63a7303c 100644
--- a/main/libsm/APKBUILD
+++ b/main/libsm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsm
 pkgver=1.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 Session Management library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libsndfile/APKBUILD b/main/libsndfile/APKBUILD
index edfb9328..b315291d 100644
--- a/main/libsndfile/APKBUILD
+++ b/main/libsndfile/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsndfile
 pkgver=1.0.21
-pkgrel=0
+pkgrel=1
 pkgdesc="A C library for reading and writing files containing sampled sound"
 url="http://www.mega-nerd.com/libsndfile"
 license="LGPL"
diff --git a/main/libsoup/APKBUILD b/main/libsoup/APKBUILD
index ee3f8fd8..f2f0434f 100644
--- a/main/libsoup/APKBUILD
+++ b/main/libsoup/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsoup
 pkgver=2.30.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Gnome HTTP Library"
 url="http://www.gnome.org"
 license="LGPL"
diff --git a/main/libspf2/APKBUILD b/main/libspf2/APKBUILD
index da5ba384..b09ea23d 100644
--- a/main/libspf2/APKBUILD
+++ b/main/libspf2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libspf2
 pkgver=1.2.9
-pkgrel=1
+pkgrel=2
 pkgdesc="Sender Policy Framework library, a part of the SPF/SRS protocol pair."
 url="http://www.libspf2.org"
 license="LGPL-2.1 BSD-2"
diff --git a/main/libtasn1/APKBUILD b/main/libtasn1/APKBUILD
index 88a2964e..f0075713 100644
--- a/main/libtasn1/APKBUILD
+++ b/main/libtasn1/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libtasn1
 pkgver=2.5
-pkgrel=0
+pkgrel=1
 pkgdesc="The ASN.1 library used in GNUTLS"
 url="http://www.gnu.org/software/gnutls/"
 license="GPL3 LGPL"
diff --git a/main/libtheora/APKBUILD b/main/libtheora/APKBUILD
index f17b0e8a..d608d361 100644
--- a/main/libtheora/APKBUILD
+++ b/main/libtheora/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libtheora
 pkgver=1.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="An open video codec developed by the Xiph.org"
 url="http://www.xiph.org"
 license="custom"
diff --git a/main/libtool/APKBUILD b/main/libtool/APKBUILD
index f82cdc7e..6741c58d 100644
--- a/main/libtool/APKBUILD
+++ b/main/libtool/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: judd <jvinet@zeroflux.org>
 pkgname=libtool
 pkgver=2.2.6b
-pkgrel=0
+pkgrel=1
 pkgdesc="A generic library support script"
 license='GPL'
 url="http://www.gnu.org/software/libtool"
diff --git a/main/libusb-compat/APKBUILD b/main/libusb-compat/APKBUILD
index 3ebdb277..d9ac9a0b 100644
--- a/main/libusb-compat/APKBUILD
+++ b/main/libusb-compat/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libusb-compat
 pkgver=0.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Compatility for older libusb"
 url="http://libusb.sourceforge.net/"
 license="LGPL"
diff --git a/main/libusb/APKBUILD b/main/libusb/APKBUILD
index f9547ac6..a9146298 100644
--- a/main/libusb/APKBUILD
+++ b/main/libusb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libusb
 pkgver=1.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Library to enable user space application programs to communicate with USB devices"
 url="http://libusb.sourceforge.net/"
 license="LGPL"
diff --git a/main/libvorbis/APKBUILD b/main/libvorbis/APKBUILD
index 07c2fc4d..7f6a6978 100644
--- a/main/libvorbis/APKBUILD
+++ b/main/libvorbis/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libvorbis
 pkgver=1.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Vorbis codec library"
 url="http://www.xiph.org/ogg/vorbis/"
 license="custom"
diff --git a/main/libwnck/APKBUILD b/main/libwnck/APKBUILD
index 172e1d0e..b6977f82 100644
--- a/main/libwnck/APKBUILD
+++ b/main/libwnck/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libwnck
 pkgver=2.30.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Window Navigator Construction Kit"
 url="http://www.gnome.org/"
 license="LGPL"
diff --git a/main/libx11/APKBUILD b/main/libx11/APKBUILD
index 78db7ccf..93dd4442 100644
--- a/main/libx11/APKBUILD
+++ b/main/libx11/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libx11
 pkgver=1.3.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 client-side library"
 url="http://xorg.freedesktop.org/"
 license="custom:XFREE86"
diff --git a/main/libxau/APKBUILD b/main/libxau/APKBUILD
index c6b79906..888eb7dd 100644
--- a/main/libxau/APKBUILD
+++ b/main/libxau/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxau
 pkgver=1.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 authorisation library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD
index a1b30a35..d8e5ac95 100644
--- a/main/libxcb/APKBUILD
+++ b/main/libxcb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxcb
 pkgver=1.5
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 client-side library"
 url="http://xcb.freedesktop.org/"
 license="custom"
diff --git a/main/libxcomposite/APKBUILD b/main/libxcomposite/APKBUILD
index f2e48a91..cad84273 100644
--- a/main/libxcomposite/APKBUILD
+++ b/main/libxcomposite/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxcomposite
 pkgver=0.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 Composite extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxcursor/APKBUILD b/main/libxcursor/APKBUILD
index bc9e33d4..2a83e866 100644
--- a/main/libxcursor/APKBUILD
+++ b/main/libxcursor/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxcursor
 pkgver=1.1.10
-pkgrel=1
+pkgrel=2
 pkgdesc="X cursor management library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxdamage/APKBUILD b/main/libxdamage/APKBUILD
index bf58651c..338e425c 100644
--- a/main/libxdamage/APKBUILD
+++ b/main/libxdamage/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxdamage
 pkgver=1.1.2
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 damaged region extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxdmcp/APKBUILD b/main/libxdmcp/APKBUILD
index f61c9e48..2c6e7e82 100644
--- a/main/libxdmcp/APKBUILD
+++ b/main/libxdmcp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxdmcp
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 Display Manager Control Protocol library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxext/APKBUILD b/main/libxext/APKBUILD
index dbfb1b26..87d7d248 100644
--- a/main/libxext/APKBUILD
+++ b/main/libxext/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxext
 pkgver=1.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 miscellaneous extensions library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxfce4menu/APKBUILD b/main/libxfce4menu/APKBUILD
index 0023f2d9..c07f8659 100644
--- a/main/libxfce4menu/APKBUILD
+++ b/main/libxfce4menu/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfce4menu
 pkgver=4.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="a freedesktop.org compliant menu implementation for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/libxfce4util/APKBUILD b/main/libxfce4util/APKBUILD
index 7cfbd769..401698b6 100644
--- a/main/libxfce4util/APKBUILD
+++ b/main/libxfce4util/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfce4util
 pkgver=4.6.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Basic utility non-GUI functions for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/libxfcegui4/APKBUILD b/main/libxfcegui4/APKBUILD
index efb4c4d0..620ee6cd 100644
--- a/main/libxfcegui4/APKBUILD
+++ b/main/libxfcegui4/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfcegui4
 pkgver=4.6.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Basic GUI functions for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
diff --git a/main/libxfixes/APKBUILD b/main/libxfixes/APKBUILD
index 87e81e1b..6e15f2c1 100644
--- a/main/libxfixes/APKBUILD
+++ b/main/libxfixes/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfixes
 pkgver=4.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 miscellaneous 'fixes' extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxfont/APKBUILD b/main/libxfont/APKBUILD
index f8a2bb25..3ce3622e 100644
--- a/main/libxfont/APKBUILD
+++ b/main/libxfont/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfont
 pkgver=1.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 font rasterisation library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxft/APKBUILD b/main/libxft/APKBUILD
index 43b5a3c0..c9bcb99b 100644
--- a/main/libxft/APKBUILD
+++ b/main/libxft/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxft
 pkgver=2.1.14
-pkgrel=1
+pkgrel=2
 pkgdesc="FreeType-based font drawing library for X"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxi/APKBUILD b/main/libxi/APKBUILD
index 21fd77ce..4f02be89 100644
--- a/main/libxi/APKBUILD
+++ b/main/libxi/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxi
 pkgver=1.3
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Input extension library"
 url="http://xorg.freedesktop.org"
 license="custom"
diff --git a/main/libxinerama/APKBUILD b/main/libxinerama/APKBUILD
index 589994d1..f0ea405c 100644
--- a/main/libxinerama/APKBUILD
+++ b/main/libxinerama/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxinerama
 pkgver=1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Xinerama extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxkbfile/APKBUILD b/main/libxkbfile/APKBUILD
index 1298aed0..10aed961 100644
--- a/main/libxkbfile/APKBUILD
+++ b/main/libxkbfile/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxkbfile
 pkgver=1.0.6
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 keyboard file manipulation library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxkbui/APKBUILD b/main/libxkbui/APKBUILD
index e585174a..eb53261b 100644
--- a/main/libxkbui/APKBUILD
+++ b/main/libxkbui/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxkbui
 pkgver=1.0.2
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 keyboard UI presentation library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxklavier/APKBUILD b/main/libxklavier/APKBUILD
index adbce6f6..65f66aea 100644
--- a/main/libxklavier/APKBUILD
+++ b/main/libxklavier/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxklavier
 pkgver=5.0
-pkgrel=0
+pkgrel=1
 pkgdesc="High-level API for X Keyboard Extension"
 url="http://gswitchit.sourceforge.net"
 license="LGPL"
diff --git a/main/libxml2/APKBUILD b/main/libxml2/APKBUILD
index 58514b1e..4843af7a 100644
--- a/main/libxml2/APKBUILD
+++ b/main/libxml2/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=libxml2
 pkgver=2.7.6
-pkgrel=2
+pkgrel=3
 pkgdesc="XML parsing library, version 2"
 url="http://www.xmlsoft.org/"
 license="MIT"
diff --git a/main/libxmu/APKBUILD b/main/libxmu/APKBUILD
index 13343d78..fb55cfa9 100644
--- a/main/libxmu/APKBUILD
+++ b/main/libxmu/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxmu
 pkgver=1.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 miscellaneous micro-utility library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxpm/APKBUILD b/main/libxpm/APKBUILD
index d1be1b73..cb970fef 100644
--- a/main/libxpm/APKBUILD
+++ b/main/libxpm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxpm
 pkgver=3.5.8
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 pixmap library"
 url="http://xorg.freedesktop.org/"
 license="custom:BELL"
diff --git a/main/libxrandr/APKBUILD b/main/libxrandr/APKBUILD
index e261af4f..e433acc2 100644
--- a/main/libxrandr/APKBUILD
+++ b/main/libxrandr/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxrandr
 pkgver=1.3.0
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 RandR extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxrender/APKBUILD b/main/libxrender/APKBUILD
index dc117553..293610e2 100644
--- a/main/libxrender/APKBUILD
+++ b/main/libxrender/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxrender
 pkgver=0.9.5
-pkgrel=1
+pkgrel=2
 pkgdesc="X Rendering Extension client library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxres/APKBUILD b/main/libxres/APKBUILD
index f446812f..cc654c8b 100644
--- a/main/libxres/APKBUILD
+++ b/main/libxres/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxres
 pkgver=1.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 Resource extension library"
 url="http://xorg.freedesktop.org"
 license="custom"
diff --git a/main/libxslt/APKBUILD b/main/libxslt/APKBUILD
index 32353ba5..c4c9add3 100644
--- a/main/libxslt/APKBUILD
+++ b/main/libxslt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxslt
 pkgver=1.1.26
-pkgrel=1
+pkgrel=2
 pkgdesc="XML stylesheet transformation library"
 url="http://xmlsoft.org/XSLT/"
 license="custom"
diff --git a/main/libxt/APKBUILD b/main/libxt/APKBUILD
index db0401e5..3bf47fe6 100644
--- a/main/libxt/APKBUILD
+++ b/main/libxt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxt
 pkgver=1.0.8
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 toolkit intrinsics library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxtst/APKBUILD b/main/libxtst/APKBUILD
index c1e9c4b6..37eac754 100644
--- a/main/libxtst/APKBUILD
+++ b/main/libxtst/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxtst
 pkgver=1.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="X11 Testing -- Resource extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxv/APKBUILD b/main/libxv/APKBUILD
index ca40f7fd..c0070031 100644
--- a/main/libxv/APKBUILD
+++ b/main/libxv/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxv
 pkgver=1.0.5
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Video extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxvmc/APKBUILD b/main/libxvmc/APKBUILD
index 3233ba40..871d1892 100644
--- a/main/libxvmc/APKBUILD
+++ b/main/libxvmc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxvmc
 pkgver=1.0.5
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Video Motion Compensation extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxxf86dga/APKBUILD b/main/libxxf86dga/APKBUILD
index 5ac46866..238e7612 100644
--- a/main/libxxf86dga/APKBUILD
+++ b/main/libxxf86dga/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxxf86dga
 pkgver=1.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 Direct Graphics Access extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxxf86misc/APKBUILD b/main/libxxf86misc/APKBUILD
index aa644d18..c6dd2cb0 100644
--- a/main/libxxf86misc/APKBUILD
+++ b/main/libxxf86misc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxxf86misc
 pkgver=1.0.2
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 XFree86 miscellaneous extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/libxxf86vm/APKBUILD b/main/libxxf86vm/APKBUILD
index 1a7ebc4f..87fe594d 100644
--- a/main/libxxf86vm/APKBUILD
+++ b/main/libxxf86vm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxxf86vm
 pkgver=1.1.0
-pkgrel=1
+pkgrel=2
 pkgdesc="X11 XFree86 video mode extension library"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/lighttpd/APKBUILD b/main/lighttpd/APKBUILD
index 44125b0e..345b54ae 100644
--- a/main/lighttpd/APKBUILD
+++ b/main/lighttpd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lighttpd
 pkgver=1.4.26
 _streamver=2.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="a secure, fast, compliant and very flexible web-server"
 url="http://www.lighttpd.net/"
 license="custom"
diff --git a/main/links/APKBUILD b/main/links/APKBUILD
index 2d11cf9d..49fa483a 100644
--- a/main/links/APKBUILD
+++ b/main/links/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=links
 pkgver=2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A text WWW browser, similar to Lynx"
 url="http://atrey.karlin.mff.cuni.cz/~clock/twibright/links/"
 license="GPL"
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index f5983aa3..4cbcb41e 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=2.6.32.12
 _kernver=2.6.32
-pkgrel=2
+pkgrel=3
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
diff --git a/main/linux-pae/APKBUILD b/main/linux-pae/APKBUILD
index cee80073..1f96f01e 100644
--- a/main/linux-pae/APKBUILD
+++ b/main/linux-pae/APKBUILD
@@ -4,7 +4,7 @@ _flavor=pae
 pkgname=linux-${_flavor}
 pkgver=2.6.32.10
 _kernver=2.6.32
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with PAE enabled"
 url=http://www.kernel.org
 depends="mkinitfs linux-firmware"
diff --git a/main/linux-vserver/APKBUILD b/main/linux-vserver/APKBUILD
index 9f761de7..2663a0c0 100644
--- a/main/linux-vserver/APKBUILD
+++ b/main/linux-vserver/APKBUILD
@@ -5,7 +5,7 @@ pkgname=linux-${_flavor}
 pkgver=2.6.32.12
 
 _kernver=2.6.32
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with vserver"
 url="http://linux-vserver.org/"
 depends="mkinitfs linux-firmware"
diff --git a/main/lm_sensors/APKBUILD b/main/lm_sensors/APKBUILD
index 2d94523d..d587b1b3 100644
--- a/main/lm_sensors/APKBUILD
+++ b/main/lm_sensors/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lm_sensors
 pkgver=3.1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Collection of user space tools for general SMBus access and hardware monitoring."
 url="http://www.lm-sensors.org/"
 license="GPL"
diff --git a/main/logrotate/APKBUILD b/main/logrotate/APKBUILD
index 5eee0d55..71818db6 100644
--- a/main/logrotate/APKBUILD
+++ b/main/logrotate/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=logrotate
 pkgver=3.7.8
-pkgrel=2
+pkgrel=3
 pkgdesc="Tool to rotate logfiles"
 url="https://fedorahosted.org/logrotate/"
 license="GPL"
diff --git a/main/lsof/APKBUILD b/main/lsof/APKBUILD
index b5f0018d..d1cbe620 100644
--- a/main/lsof/APKBUILD
+++ b/main/lsof/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lsof
 pkgver=4.83
-pkgrel=0
+pkgrel=1
 pkgdesc="LiSt Open Files"
 url="http://people.freebsd.org/~abe/"
 license="custom"
diff --git a/main/lua-bitlib/APKBUILD b/main/lua-bitlib/APKBUILD
index 2a434d3e..7063b8a8 100644
--- a/main/lua-bitlib/APKBUILD
+++ b/main/lua-bitlib/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-bitlib
 _name=bitlib
 pkgver=26
-pkgrel=0
+pkgrel=1
 pkgdesc="A lua library providing bitwise operations"
 url="http://luaforge.net/projects/bitlib"
 license="MIT/X11"
diff --git a/main/lua-discount/APKBUILD b/main/lua-discount/APKBUILD
index 9fe7cfd3..be0d689a 100644
--- a/main/lua-discount/APKBUILD
+++ b/main/lua-discount/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lua-discount
 pkgver=1.2.10.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua binding to discount, a Markdown implementation in C"
 url="http://asbradbury.org/projects/lua-discount"
 license="BSD"
diff --git a/main/lua-expat/APKBUILD b/main/lua-expat/APKBUILD
index e2c58cad..2063657c 100644
--- a/main/lua-expat/APKBUILD
+++ b/main/lua-expat/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=lua-expat
 _name=luaexpat
 pkgver=1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="LuaExpat is a SAX XML parser based on the Expat library. LuaExpat is free software and uses the same license as Lua 5.0."
 url="http://luaforge.net/projects/luaexpat/"
 license="MIT"
diff --git a/main/lua-iconv/APKBUILD b/main/lua-iconv/APKBUILD
index 7f2f5171..a6d29771 100644
--- a/main/lua-iconv/APKBUILD
+++ b/main/lua-iconv/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-iconv
 pkgver=6
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua binding to the POSIX 'iconv' library"
 url="http://luaforge.net/projects/lua-iconv/"
 license="MIT"
diff --git a/main/lua-md5/APKBUILD b/main/lua-md5/APKBUILD
index 79813e53..5352d278 100644
--- a/main/lua-md5/APKBUILD
+++ b/main/lua-md5/APKBUILD
@@ -2,7 +2,7 @@
 pkgname="lua-md5"
 _name="md5"
 pkgver=1.1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Basic cryptographic facilities for Lua"
 url="http://www.keplerproject.org/md5/"
 license="MIT"
diff --git a/main/lua-openrc/APKBUILD b/main/lua-openrc/APKBUILD
index 56578c40..966e1d3c 100644
--- a/main/lua-openrc/APKBUILD
+++ b/main/lua-openrc/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-openrc
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua module for OpenRC"
 url="http://git.alpinelinux.org/cgit/lua-openrc/"
 license="GPL"
diff --git a/main/lua-pc/APKBUILD b/main/lua-pc/APKBUILD
index 85643205..9b1b3891 100644
--- a/main/lua-pc/APKBUILD
+++ b/main/lua-pc/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-pc
 _name=lpc
 pkgver=1.0.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Lua Process Call"
 url="http://lua.net-core.org/sputnik.lua?p=Telesto:About"
 license="MIT/X11"
diff --git a/main/lua-posix/APKBUILD b/main/lua-posix/APKBUILD
index bb90a0c8..ca9e323f 100644
--- a/main/lua-posix/APKBUILD
+++ b/main/lua-posix/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-posix
 _name=luaposix
 pkgver=5.1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="POSIX library for Lua"
 url="http://luaforge.net/projects/luaposix/"
 license="MIT"
diff --git a/main/lua-socket/APKBUILD b/main/lua-socket/APKBUILD
index df001152..cc897ae7 100644
--- a/main/lua-socket/APKBUILD
+++ b/main/lua-socket/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=lua-socket
 _name=luasocket
 pkgver=2.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Luasocket is the most comprehensive networking support library for the Lua language."
 url="http://luaforge.net/projects/luasocket/"
 license="MIT"
diff --git a/main/lua-sql-mysql/APKBUILD b/main/lua-sql-mysql/APKBUILD
index 669ad205..517d6a62 100644
--- a/main/lua-sql-mysql/APKBUILD
+++ b/main/lua-sql-mysql/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-sql-mysql
 _name=luasql-mysql
 pkgver=2.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="MySQL driver for LuaSQL (luasql-mysql)"
 url="http://www.keplerproject.org/luasql/"
 license="MIT"
diff --git a/main/lua-sql-postgres/APKBUILD b/main/lua-sql-postgres/APKBUILD
index 08eb9d96..d54d3401 100644
--- a/main/lua-sql-postgres/APKBUILD
+++ b/main/lua-sql-postgres/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mika Havela <mika.havela@gmail.com>
 pkgname=lua-sql-postgres
 pkgver=2.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="PostgreSQL driver for LuaSQL"
 url="http://www.keplerproject.org/luasql/"
 license="MIT"
diff --git a/main/lua-sql-sqlite3/APKBUILD b/main/lua-sql-sqlite3/APKBUILD
index e5ace6d6..67799576 100644
--- a/main/lua-sql-sqlite3/APKBUILD
+++ b/main/lua-sql-sqlite3/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <natanael.copa@gmail.com>
 pkgname=lua-sql-sqlite3
 pkgver=2.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="LuaSQL driver for sqlite3"
 url="http://www.keplerproject.org/luasql/"
 license="MIT"
diff --git a/main/lua-uuid/APKBUILD b/main/lua-uuid/APKBUILD
index 0f8f899b..82f00bf3 100644
--- a/main/lua-uuid/APKBUILD
+++ b/main/lua-uuid/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-uuid
 pkgver=5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua library generating universally unique identifiers based on libuuid"
 url="http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/#luuid"
 license="Public Domain"
diff --git a/main/lua-zlib/APKBUILD b/main/lua-zlib/APKBUILD
index 6f319b48..d37adab3 100644
--- a/main/lua-zlib/APKBUILD
+++ b/main/lua-zlib/APKBUILD
@@ -4,7 +4,7 @@ pkgname=lua-zlib
 _name=lzlib
 pkgver=0.4
 _ver=$pkgver-work2
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua bindings to the ZLib compression library"
 url="http://luaforge.net/projects/lzlib/"
 license="MIT"
diff --git a/main/lua/APKBUILD b/main/lua/APKBUILD
index 8a770eda..040ecc75 100644
--- a/main/lua/APKBUILD
+++ b/main/lua/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lua
 pkgver=5.1.4
-pkgrel=3
+pkgrel=4
 pkgdesc="A powerful light-weight programming language designed for extending applications."
 url="http://www.lua.org/"
 license="MIT"
diff --git a/main/lvm2/APKBUILD b/main/lvm2/APKBUILD
index d9511cf7..e7cd64b2 100644
--- a/main/lvm2/APKBUILD
+++ b/main/lvm2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lvm2
 pkgver=2.02.61
-pkgrel=0
+pkgrel=1
 pkgdesc="Logical Volume Manager 2 utilities"
 url="http://sourceware.org/lvm2/"
 license="GPL"
diff --git a/main/lzo/APKBUILD b/main/lzo/APKBUILD
index 52c53d5d..aa73d346 100644
--- a/main/lzo/APKBUILD
+++ b/main/lzo/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=lzo
 pkgver=2.03
-pkgrel=0
+pkgrel=1
 pkgdesc="LZO -- a real-time data compression library"
 url="http://www.oberhumer.com/opensource/lzo"
 license="GPL"
diff --git a/main/m4/APKBUILD b/main/m4/APKBUILD
index b1350037..098af7b7 100644
--- a/main/m4/APKBUILD
+++ b/main/m4/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=m4
 pkgver=1.4.14
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU macro processor"
 url="http://www.gnu.org/software/m4"
 depends=
diff --git a/main/make/APKBUILD b/main/make/APKBUILD
index 5b0137cc..6e51fb94 100644
--- a/main/make/APKBUILD
+++ b/main/make/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=make
 pkgver=3.81
-pkgrel=2
+pkgrel=3
 pkgdesc="GNU make utility to maintain groups of programs"
 url="http://www.gnu.org/software/make"
 license=GPL
diff --git a/main/man/APKBUILD b/main/man/APKBUILD
index c6940dbf..3be9fdbd 100644
--- a/main/man/APKBUILD
+++ b/main/man/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=man
 pkgver=1.6f
-pkgrel=1
+pkgrel=2
 pkgdesc="A utility for reading man pages"
 url="http://primates.ximian.com/~flucifredi/man/"
 license="GPL"
diff --git a/main/mdadm/APKBUILD b/main/mdadm/APKBUILD
index ed49a4c6..c85f9bae 100644
--- a/main/mdadm/APKBUILD
+++ b/main/mdadm/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mdadm
 pkgver=3.1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="a tool for managing Linux Software RAID arrays"
 url="http://neil.brown.name/blog/mdadm"
 license="GPL-2"
diff --git a/main/mercurial/APKBUILD b/main/mercurial/APKBUILD
index 0df48f9d..236b2758 100644
--- a/main/mercurial/APKBUILD
+++ b/main/mercurial/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mercurial
 pkgver=1.5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A scalable distributed SCM tool"
 url="http://www.selenic.com/mercurial"
 license="GPL"
diff --git a/main/mesa/APKBUILD b/main/mesa/APKBUILD
index 54a8f75c..40301761 100644
--- a/main/mesa/APKBUILD
+++ b/main/mesa/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mesa
 pkgver=7.7.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Mesa DRI OpenGL library"
 url="http://www.mesa3d.org"
 license="LGPL"
diff --git a/main/midori/APKBUILD b/main/midori/APKBUILD
index ad076028..69bed3a9 100644
--- a/main/midori/APKBUILD
+++ b/main/midori/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=midori
 pkgver=0.2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A lightweight web browser based on Gtk WebKit"
 url="http://www.twotoasts.de/index.php?/pages/midori_summary.html"
 license="GPL"
diff --git a/main/mini_httpd/APKBUILD b/main/mini_httpd/APKBUILD
index 5b733b22..a27ac976 100644
--- a/main/mini_httpd/APKBUILD
+++ b/main/mini_httpd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mini_httpd
 pkgver=1.19
-pkgrel=3
+pkgrel=4
 pkgdesc="Small forking webserver with ssl and ipv6 support"
 url="http://www.acme.com/software/mini_httpd/"
 license="BSD"
diff --git a/main/minicom/APKBUILD b/main/minicom/APKBUILD
index 8a7a35c6..4c4f041e 100644
--- a/main/minicom/APKBUILD
+++ b/main/minicom/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=minicom
 pkgver=2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="menu driven communications program for terminals"
 url="http://alioth.debian.org/projects/minicom"
 license="GPL"
diff --git a/main/mkfontscale/APKBUILD b/main/mkfontscale/APKBUILD
index 283a9856..126dbf2d 100644
--- a/main/mkfontscale/APKBUILD
+++ b/main/mkfontscale/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mkfontscale
 pkgver=1.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org font scale"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/mlmmj/APKBUILD b/main/mlmmj/APKBUILD
index 6ac4d162..1a8e30b5 100644
--- a/main/mlmmj/APKBUILD
+++ b/main/mlmmj/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mlmmj
 pkgver=1.2.16
-pkgrel=1
+pkgrel=2
 pkgdesc="Mailing list managing made joyful"
 url="http://mlmmj.org/"
 license="MIT"
diff --git a/main/module-init-tools/APKBUILD b/main/module-init-tools/APKBUILD
index aaa9ceeb..189f2f0d 100644
--- a/main/module-init-tools/APKBUILD
+++ b/main/module-init-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanel Copa <ncopa@alpinelinux.org>
 pkgname=module-init-tools
 pkgver=3.11.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Utilities for inserting and removing modules from the Linux kernel"
 url="http://www.kernel.org"
 license='GPL'
diff --git a/main/mousepad/APKBUILD b/main/mousepad/APKBUILD
index ad5524f1..6fa9f256 100644
--- a/main/mousepad/APKBUILD
+++ b/main/mousepad/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mousepad
 pkgver=0.2.16
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple Text Editor for Xfce4 (based on Gedit)"
 url="http://www.xfce.org/~benny/apps.html"
 license="GPL-2"
diff --git a/main/mpc/APKBUILD b/main/mpc/APKBUILD
index e385544a..2d8282c0 100644
--- a/main/mpc/APKBUILD
+++ b/main/mpc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mpc
 pkgver=0.19
-pkgrel=0
+pkgrel=1
 pkgdesc="Minimalist command line interface to MPD"
 url="http://mpd.wikia.com/wiki/Client:Mpc"
 license="GPL2"
diff --git a/main/mpd/APKBUILD b/main/mpd/APKBUILD
index a6629591..5877ab3f 100644
--- a/main/mpd/APKBUILD
+++ b/main/mpd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <natanael.copa@gmail.com>
 pkgname=mpd
 pkgver=0.15.9
-pkgrel=0
+pkgrel=1
 pkgdesc="Music daemon that plays MP3, FLAC, and Ogg Vorbis files"
 url="http://musicpd.org"
 pkgusers="mpd"
diff --git a/main/mpfr/APKBUILD b/main/mpfr/APKBUILD
index 9e529fa1..442a89b6 100644
--- a/main/mpfr/APKBUILD
+++ b/main/mpfr/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mpfr
 pkgver=2.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="multiple-precision floating-point library"
 url="http://www.mpfr.org/"
 license="GPL LGPL"
diff --git a/main/mpg123/APKBUILD b/main/mpg123/APKBUILD
index f10f46b1..a0430247 100644
--- a/main/mpg123/APKBUILD
+++ b/main/mpg123/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mpg123
 pkgver=1.12.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A console based real time MPEG Audio Player for Layer 1, 2 and 3"
 url="http://sourceforge.net/projects/mpg123"
 license="GPL2 LGPL2"
diff --git a/main/mrxvt/APKBUILD b/main/mrxvt/APKBUILD
index 0c9cb702..647a8669 100644
--- a/main/mrxvt/APKBUILD
+++ b/main/mrxvt/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mark Constable <markc@renta.net>
 pkgname=mrxvt
 pkgver=0.5.4
-pkgrel=2
+pkgrel=3
 pkgdesc="A multi-tabbed X terminal emulator based on rxvt code"
 url="http://materm.sourceforge.net/wiki/pmwiki.php"
 license="GPL"
diff --git a/main/mtools/APKBUILD b/main/mtools/APKBUILD
index bc738e00..73a61c15 100644
--- a/main/mtools/APKBUILD
+++ b/main/mtools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mtools
 pkgver=4.0.13
-pkgrel=0
+pkgrel=1
 pkgdesc="A collection of utilities to access MS-DOS disks from Unix without mounting them"
 url="http://www.gnu.org/software/mtools/"
 license="GPL"
diff --git a/main/mysql/APKBUILD b/main/mysql/APKBUILD
index bc4f7428..b512228d 100644
--- a/main/mysql/APKBUILD
+++ b/main/mysql/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mysql
 pkgver=5.1.45
-pkgrel=0
+pkgrel=1
 pkgdesc="A fast SQL database server"
 url="http://www.mysql.com/"
 license='GPL'
diff --git a/main/nano/APKBUILD b/main/nano/APKBUILD
index d929c807..67e6ce8d 100644
--- a/main/nano/APKBUILD
+++ b/main/nano/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=nano
 pkgver=2.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Text Editor. GNU nano is designed to be a free replacement for the Pico text editor."
 url="http://www.nano-editor.org/"
 license="GPL"
diff --git a/main/nasm/APKBUILD b/main/nasm/APKBUILD
index 8185a792..b3adaa15 100644
--- a/main/nasm/APKBUILD
+++ b/main/nasm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=nasm
 pkgver=2.08.01
-pkgrel=0
+pkgrel=1
 pkgdesc="80x86 assembler designed for portability and modularity"
 url="http://nasm.sourceforge.net"
 license="LGPL"
diff --git a/main/ncftp/APKBUILD b/main/ncftp/APKBUILD
index 4495c559..29ae6197 100644
--- a/main/ncftp/APKBUILD
+++ b/main/ncftp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=ncftp
 pkgver=3.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A set of free application programs implementing FTP"
 url="http://www.ncftp.com/"
 license="custom"
diff --git a/main/ncurses/APKBUILD b/main/ncurses/APKBUILD
index 9ae623a5..ef763f44 100644
--- a/main/ncurses/APKBUILD
+++ b/main/ncurses/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ncurses
 pkgver=5.7
-pkgrel=1
+pkgrel=2
 pkgdesc="Console display library"
 url="http://www.gnu.org/software/ncurses/"
 license=MIT
diff --git a/main/neon/APKBUILD b/main/neon/APKBUILD
index ef6fc8fe..720f898b 100644
--- a/main/neon/APKBUILD
+++ b/main/neon/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=neon
 pkgver=0.28.6
-pkgrel=0
+pkgrel=1
 pkgdesc="HTTP and WebDAV client library with a C interface"
 url="http://www.webdav.org/neon/"
 license="GPL LGPL"
diff --git a/main/net-snmp/APKBUILD b/main/net-snmp/APKBUILD
index 19baedc9..7ff3a8ac 100644
--- a/main/net-snmp/APKBUILD
+++ b/main/net-snmp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=net-snmp
 pkgver=5.4.2.1
-pkgrel=3
+pkgrel=4
 pkgdesc="Simple Network Management Protocol"
 url="http://www.net-snmp.org/"
 license="GPL"
diff --git a/main/newt/APKBUILD b/main/newt/APKBUILD
index 6f471b17..c87d36e9 100644
--- a/main/newt/APKBUILD
+++ b/main/newt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=newt
 pkgver=0.52.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Redhat's Newt windowing toolkit development files"
 url="https://fedorahosted.org/newt/"
 license="LGPL-2"
diff --git a/main/nfs-utils/APKBUILD b/main/nfs-utils/APKBUILD
index 99500506..45ee5a70 100644
--- a/main/nfs-utils/APKBUILD
+++ b/main/nfs-utils/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=nfs-utils
 pkgver=1.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="kernel-mode NFS"
 url="http://nfs.sourceforge.net/"
 license="GPL"
diff --git a/main/ngircd/APKBUILD b/main/ngircd/APKBUILD
index 45404557..409de6af 100644
--- a/main/ngircd/APKBUILD
+++ b/main/ngircd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ngircd
 pkgver=15
-pkgrel=0
+pkgrel=1
 pkgdesc="Next Generation IRC Daemon"
 url="http://ngircd.barton.de/"
 license="GPL"
diff --git a/main/nmap/APKBUILD b/main/nmap/APKBUILD
index d97acd7a..e2b9d284 100644
--- a/main/nmap/APKBUILD
+++ b/main/nmap/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=nmap 
 pkgver=5.21
-pkgrel=0
+pkgrel=1
 pkgdesc="A network exploration tool and security/port scanner"
 url="http:/nmap.org"
 license="custom:GPL"
diff --git a/main/nrpe/APKBUILD b/main/nrpe/APKBUILD
index ddc67fb4..b87b6410 100644
--- a/main/nrpe/APKBUILD
+++ b/main/nrpe/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=nrpe
 pkgver=2.12
-pkgrel=2
+pkgrel=3
 pkgusers="nagios"
 pkggroups="nagios"
 pkgdesc="NRPE allows you to remotely execute Nagios plugins on other Linux/Unix machines."
diff --git a/main/ntfs-3g/APKBUILD b/main/ntfs-3g/APKBUILD
index b8b61537..c61d00c1 100644
--- a/main/ntfs-3g/APKBUILD
+++ b/main/ntfs-3g/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ntfs-3g
 pkgver=2010.3.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A userspace ntfs driver with write support"
 url="http://www.tuxera.com/community/ntfs-3g-download/"
 license="GPL"
diff --git a/main/oidentd/APKBUILD b/main/oidentd/APKBUILD
index eda425fb..b2d6fed4 100644
--- a/main/oidentd/APKBUILD
+++ b/main/oidentd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=oidentd
 pkgver=2.0.8
-pkgrel=1
+pkgrel=2
 pkgdesc="Configurable IDENT server that supports NAT/IP masq."
 url="http://dev.ojnk.net/"
 license="GPL"
diff --git a/main/openldap/APKBUILD b/main/openldap/APKBUILD
index 9a98906e..45d751ed 100644
--- a/main/openldap/APKBUILD
+++ b/main/openldap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openldap
 pkgver=2.4.21
-pkgrel=0
+pkgrel=1
 pkgdesc="LDAP Server"
 url="http://www.openldap.org/"
 license="custom"
diff --git a/main/opennhrp/APKBUILD b/main/opennhrp/APKBUILD
index 2f0823f0..4c9d94c9 100644
--- a/main/opennhrp/APKBUILD
+++ b/main/opennhrp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=opennhrp
 pkgver=0.11.5
-pkgrel=0
+pkgrel=1
 pkgdesc="NBMA Next Hop Resolution Protocol daemon"
 url="http://sourceforge.net/projects/opennhrp"
 license="GPL-3"
diff --git a/main/openntpd/APKBUILD b/main/openntpd/APKBUILD
index cb0bba50..fe3b1844 100644
--- a/main/openntpd/APKBUILD
+++ b/main/openntpd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=openntpd
 pkgver=3.9_p1
 _myver=3.9p1
-pkgrel=6
+pkgrel=7
 pkgdesc="Lightweight NTP server ported from OpenBSD"
 url=http://www.openntpd.org/
 install=openntpd.pre-install
diff --git a/main/openrc/APKBUILD b/main/openrc/APKBUILD
index 88cab44d..bfa509bd 100644
--- a/main/openrc/APKBUILD
+++ b/main/openrc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openrc
 pkgver=0.6.0
-pkgrel=0
+pkgrel=1
 pkgdesc="OpenRC manages the services, startup and shutdown of a host"
 url="http://roy.marples.name/openrc"
 license='BSD-2'
diff --git a/main/openssh/APKBUILD b/main/openssh/APKBUILD
index 87d996e9..5059c5f6 100644
--- a/main/openssh/APKBUILD
+++ b/main/openssh/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=openssh
 pkgver=5.4_p1
 _myver=${pkgver%_*}${pkgver#*_}
-pkgrel=0
+pkgrel=1
 pkgdesc="Port of OpenBSD's free SSH release"
 url="http://www.openssh.org/portable.html"
 license="as-is"
diff --git a/main/openssl/APKBUILD b/main/openssl/APKBUILD
index 22dc6339..0aeeca9d 100644
--- a/main/openssl/APKBUILD
+++ b/main/openssl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openssl
 pkgver=0.9.8n
-pkgrel=0
+pkgrel=1
 pkgdesc="Toolkit for SSL v2/v3 and TLS v1"
 url=http://openssl.org
 depends=
diff --git a/main/openvpn/APKBUILD b/main/openvpn/APKBUILD
index bd751f31..8b82bf5c 100644
--- a/main/openvpn/APKBUILD
+++ b/main/openvpn/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openvpn
 pkgver=2.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A robust, and highly configurable VPN (Virtual Private Network)"
 url="http://openvpn.sourceforge.net/"
 license="custom"
diff --git a/main/oprofile/APKBUILD b/main/oprofile/APKBUILD
index 29cb35bf..bc81fff7 100644
--- a/main/oprofile/APKBUILD
+++ b/main/oprofile/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=oprofile
 pkgver=0.9.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A System Profiler for Linux"
 url="http://oprofile.sourceforge.net/"
 license="GPL"
diff --git a/main/orage/APKBUILD b/main/orage/APKBUILD
index b310c80c..6a80beb2 100644
--- a/main/orage/APKBUILD
+++ b/main/orage/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=orage
 pkgver=4.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A simple calendar application with reminders for Xfce"
 url="http://www.xfce.org/projects/orage/"
 license="GPL-2"
diff --git a/main/p7zip/APKBUILD b/main/p7zip/APKBUILD
index b022e17b..7ecd4bb6 100644
--- a/main/p7zip/APKBUILD
+++ b/main/p7zip/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=p7zip
 pkgver=9.04
-pkgrel=0
+pkgrel=1
 pkgdesc="A command-line port of the 7zip compression utility"
 url="http://p7zip.sourceforge.net"
 license="GPL"
diff --git a/main/pango/APKBUILD b/main/pango/APKBUILD
index 967a6432..c941679c 100644
--- a/main/pango/APKBUILD
+++ b/main/pango/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pango
 pkgver=1.28.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A library for layout and rendering of text"
 url="http://www.pango.org/"
 license="LGPL"
diff --git a/main/parole/APKBUILD b/main/parole/APKBUILD
index 07b9b0d7..49c1930a 100644
--- a/main/parole/APKBUILD
+++ b/main/parole/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=parole
 pkgver=0.2.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Media player for the Xfce desktop"
 url="http://goodies.xfce.org/projects/applications/parole/"
 license="GPL"
diff --git a/main/parted/APKBUILD b/main/parted/APKBUILD
index 0ae62c97..2bf6e95f 100644
--- a/main/parted/APKBUILD
+++ b/main/parted/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=parted
 pkgver=2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Utility to create, destroy, resize, check and copy partitions"
 url="http://www.gnu.org/software/parted/parted.html"
 license="GPL3"
diff --git a/main/patch/APKBUILD b/main/patch/APKBUILD
index 7090ee48..2b9aa1d2 100644
--- a/main/patch/APKBUILD
+++ b/main/patch/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=patch
 pkgver=2.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Utility to apply diffs to files"
 url="http://www.gnu.org/software/patch/patch.html"
 license='GPL'
diff --git a/main/pax-utils/APKBUILD b/main/pax-utils/APKBUILD
index 8b31035f..4a7069bc 100644
--- a/main/pax-utils/APKBUILD
+++ b/main/pax-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pax-utils
 pkgver=0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="ELF related utils for ELF 32/64 binaries"
 url="http://hardened.gentoo.org/pax-utils.xml"
 license='GPL-2'
diff --git a/main/paxctl/APKBUILD b/main/paxctl/APKBUILD
index b8ac414d..401cc872 100644
--- a/main/paxctl/APKBUILD
+++ b/main/paxctl/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=paxctl
 pkgver=0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Manage PaX releated program header flags"
 url="http://pax.grsecurity.net"
 license="GPL-2"
diff --git a/main/pciutils/APKBUILD b/main/pciutils/APKBUILD
index 946c24c1..7c775f97 100644
--- a/main/pciutils/APKBUILD
+++ b/main/pciutils/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=pciutils
 pkgver=3.1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="PCI bus configuration space access library and tools"
 url="http://mj.ucw.cz/pciutils.html"
 license="GPL"
diff --git a/main/pcmciautils/APKBUILD b/main/pcmciautils/APKBUILD
index 87a1c305..a5afa81e 100644
--- a/main/pcmciautils/APKBUILD
+++ b/main/pcmciautils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pcmciautils
 pkgver=016
-pkgrel=0
+pkgrel=1
 pkgdesc="Utilities for inserting and removing PCMCIA cards"
 url="http://kernel.org/pub/linux/utils/kernel/pcmcia/pcmcia.html"
 license="GPL"
diff --git a/main/pcre/APKBUILD b/main/pcre/APKBUILD
index f46c3426..c091226e 100644
--- a/main/pcre/APKBUILD
+++ b/main/pcre/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pcre
 pkgver=8.02
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl-compatible regular expression library"
 url="http://pcre.sourceforge.net"
 license="BSD"
diff --git a/main/perl-compress-raw-bzip2/APKBUILD b/main/perl-compress-raw-bzip2/APKBUILD
index 86472297..7d8d0b17 100644
--- a/main/perl-compress-raw-bzip2/APKBUILD
+++ b/main/perl-compress-raw-bzip2/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-compress-raw-bzip2
 _realname=Compress-Raw-Bzip2
 pkgver=2.024
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl low-level interface to bzip2 compression library"
 url="http://search.cpan.org/~pmqs/Compress-Raw-Bzip2-2.024/"
 license="GPL PerlArtistic"
diff --git a/main/perl-compress-raw-zlib/APKBUILD b/main/perl-compress-raw-zlib/APKBUILD
index a5820f84..0529ccbd 100644
--- a/main/perl-compress-raw-zlib/APKBUILD
+++ b/main/perl-compress-raw-zlib/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-compress-raw-zlib
 _realname=Compress-Raw-Zlib
 pkgver=2.024
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl low-level interface to zlib compression library"
 url="http://search.cpan.org/~pmqs/Compress-Raw-Zlib-2.024/"
 license="GPL PerlArtistic"
diff --git a/main/perl-convert-uulib/APKBUILD b/main/perl-convert-uulib/APKBUILD
index e469ed9a..e9ecba53 100644
--- a/main/perl-convert-uulib/APKBUILD
+++ b/main/perl-convert-uulib/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-convert-uulib
 _realname=Convert-UUlib
 pkgver=1.12
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl interface to the uulib library"
 url="http://search.cpan.org/~mlehmann/Convert-UUlib-1.12/UUlib.pm"
 license="Artistic GPL2"
diff --git a/main/perl-crypt-openssl-random/APKBUILD b/main/perl-crypt-openssl-random/APKBUILD
index 78568c61..f8e24cb9 100644
--- a/main/perl-crypt-openssl-random/APKBUILD
+++ b/main/perl-crypt-openssl-random/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-crypt-openssl-random
 _realname=Crypt-OpenSSL-Random
 pkgver=0.04
-pkgrel=0
+pkgrel=1
 pkgdesc="RSA encoding and decoding, using the openSSL libraries"
 url="http://search.cpan.org/~iroberts/Crypt-OpenSSL-Random-0.04/"
 license="Unknown"
diff --git a/main/perl-crypt-openssl-rsa/APKBUILD b/main/perl-crypt-openssl-rsa/APKBUILD
index 1b599165..263a8955 100644
--- a/main/perl-crypt-openssl-rsa/APKBUILD
+++ b/main/perl-crypt-openssl-rsa/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-crypt-openssl-rsa
 _realname=Crypt-OpenSSL-RSA
 pkgver=0.26
-pkgrel=0
+pkgrel=1
 pkgdesc="RSA encoding and decoding, using the openSSL libraries"
 url="http://search.cpan.org/~iroberts/Crypt-OpenSSL-RSA-0.25/"
 license="Unknown"
diff --git a/main/perl-db/APKBUILD b/main/perl-db/APKBUILD
index 2b434ea5..dbc64cfc 100644
--- a/main/perl-db/APKBUILD
+++ b/main/perl-db/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-db
 _realname=BerkeleyDB
 pkgver=0.41
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl extension for Berkeley DB version 2, 3 or 4"
 url="http://search.cpan.org/~pmqs/BerkeleyDB-0.38/"
 license="GPL PerlArtistic"
diff --git a/main/perl-db_file/APKBUILD b/main/perl-db_file/APKBUILD
index 88b155d6..7f3d6875 100644
--- a/main/perl-db_file/APKBUILD
+++ b/main/perl-db_file/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-db_file
 _realname=DB_File
 pkgver=1.820
-pkgrel=1
+pkgrel=2
 pkgdesc="Perl5 access to Berkeley DB"
 url="http://search.cpan.org/~pmqs/DB_File-1.820/"
 license="GPL PerlArtistic"
diff --git a/main/perl-digest-sha1/APKBUILD b/main/perl-digest-sha1/APKBUILD
index 0b40dfb4..044d8442 100644
--- a/main/perl-digest-sha1/APKBUILD
+++ b/main/perl-digest-sha1/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-digest-sha1
 _realname=Digest-SHA1
 pkgver=2.12
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl interface to the SHA-1 algorithm"
 url="http://search.cpan.org/~gaas/Digest-SHA1-2.12/"
 license="GPL PerlArtistic"
diff --git a/main/perl-file-rsync/APKBUILD b/main/perl-file-rsync/APKBUILD
index 700e3eee..2a1e9285 100644
--- a/main/perl-file-rsync/APKBUILD
+++ b/main/perl-file-rsync/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-file-rsync
 _realname=File-RsyncP
 pkgver=0.68
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl rsync client"
 url="http://search.cpan.org/~cbarratt/File-RsyncP-0.68/"
 license="GPL PerlArtistic"
diff --git a/main/perl-html-parser/APKBUILD b/main/perl-html-parser/APKBUILD
index 8fbac7fe..87961b1f 100644
--- a/main/perl-html-parser/APKBUILD
+++ b/main/perl-html-parser/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-html-parser
 _realname=HTML-Parser
 pkgver=3.64
-pkgrel=0
+pkgrel=1
 pkgdesc="Parse section of HTML documents"
 url="http://search.cpan.org/~gaas/HTML-Parser-3.60/"
 license="GPL PerlArtistic"
diff --git a/main/perl-mail-clamav/APKBUILD b/main/perl-mail-clamav/APKBUILD
index c8ef7ea7..5f33f12b 100644
--- a/main/perl-mail-clamav/APKBUILD
+++ b/main/perl-mail-clamav/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-mail-clamav
 _realname=Mail-ClamAV
 pkgver=0.29
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl extension for the clamav virus scanner"
 url="http://search.cpan.org/~converter/Mail-ClamAV-0.29/"
 license="Unknown"
diff --git a/main/perl-mail-spamassassin/APKBUILD b/main/perl-mail-spamassassin/APKBUILD
index a86c014f..9682b7e2 100644
--- a/main/perl-mail-spamassassin/APKBUILD
+++ b/main/perl-mail-spamassassin/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-mail-spamassassin
 _realname=Mail-SpamAssassin
 pkgver=3.2.5
-pkgrel=1
+pkgrel=2
 pkgdesc="Spam detector and markup engine"
 url="http://search.cpan.org/~jmason/Mail-SpamAssassin-3.2.5/"
 license="unknown"
diff --git a/main/perl-net-dns/APKBUILD b/main/perl-net-dns/APKBUILD
index d87821b6..7f3580d0 100644
--- a/main/perl-net-dns/APKBUILD
+++ b/main/perl-net-dns/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-net-dns
 _realname=Net-DNS
 pkgver=0.66
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl interface to the DNS resolver"
 url="http://search.cpan.org/dist/Archive-Zip/"
 license="unknown"
diff --git a/main/perl-net-ssleay/APKBUILD b/main/perl-net-ssleay/APKBUILD
index 966aeb77..77a007cb 100644
--- a/main/perl-net-ssleay/APKBUILD
+++ b/main/perl-net-ssleay/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-net-ssleay
 _realname=Net-SSLeay
 pkgver=1.36
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl extension for using OpenSSL"
 url="http://search.cpan.org/dist/Net-SSLeay/"
 license="GPL"
diff --git a/main/perl-netaddr-ip/APKBUILD b/main/perl-netaddr-ip/APKBUILD
index c1e687de..8643038a 100644
--- a/main/perl-netaddr-ip/APKBUILD
+++ b/main/perl-netaddr-ip/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-netaddr-ip
 _realname=NetAddr-IP
 pkgver=4.027
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl extension for managing IPv4 and IPv6 addresses and subnets"
 url="http://search.cpan.org/~miker/NetAddr-IP-$pkgver/"
 license="Unknown"
diff --git a/main/perl-time-hires/APKBUILD b/main/perl-time-hires/APKBUILD
index 33116743..6c2dc445 100644
--- a/main/perl-time-hires/APKBUILD
+++ b/main/perl-time-hires/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=perl-time-hires
 _realname=Time-HiRes
 pkgver=1.9721
-pkgrel=0
+pkgrel=1
 pkgdesc="High resolution alarm, sleep, gettimeofday, interval timers"
 url="http://search.cpan.org/~jhi/Time-HiRes-${pkgver}/"
 license="unknown"
diff --git a/main/perl-unix-syslog/APKBUILD b/main/perl-unix-syslog/APKBUILD
index 3bc8793d..21c5b2ac 100644
--- a/main/perl-unix-syslog/APKBUILD
+++ b/main/perl-unix-syslog/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-unix-syslog
 _realname=Unix-Syslog
 pkgver=1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Perl interface to the UNIX syslog(3) calls"
 url="http://search.cpan.org/~mharnisch/Unix-Syslog-1.1/"
 license="unknown"
diff --git a/main/perl-xml-parser/APKBUILD b/main/perl-xml-parser/APKBUILD
index e2319ac8..48601fef 100644
--- a/main/perl-xml-parser/APKBUILD
+++ b/main/perl-xml-parser/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=perl-xml-parser
 _name=XML-Parser
 pkgver=2.36
-pkgrel=0
+pkgrel=1
 pkgdesc="XML::Parser - an XML parser module for perl"
 url="http://search.cpan.org/dist/XML-Parser/"
 license="GPL PerlArtistic"
diff --git a/main/perl/APKBUILD b/main/perl/APKBUILD
index abca94bd..42643135 100644
--- a/main/perl/APKBUILD
+++ b/main/perl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=perl
 pkgver=5.10.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Larry Wall's Practical Extraction and Report Language"
 url=http://www.perl.org
 license="Artistic GPL-2"
diff --git a/main/pgcluster/APKBUILD b/main/pgcluster/APKBUILD
index c45aecfc..f1f0c67b 100644
--- a/main/pgcluster/APKBUILD
+++ b/main/pgcluster/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=pgcluster
 pkgver=1.9.0_rc5
 _myver=1.9.0rc5
-pkgrel=2
+pkgrel=3
 pkgdesc="PostgreSQL with multi-master cluster/replication patch"
 url="http://pgfoundry.org/projects/pgcluster/"
 license="BSD"
diff --git a/main/pgpool/APKBUILD b/main/pgpool/APKBUILD
index 5bfb6b32..fbd8ca07 100644
--- a/main/pgpool/APKBUILD
+++ b/main/pgpool/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=pgpool
 _opkgname=pgpool-II
 pkgver=2.2.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Pgpool II is a connection pooling/replication server for PostgreSQL."
 url="http://pgfoundry.org/projects/pgpool/"
 license="BSD"
diff --git a/main/php-apc/APKBUILD b/main/php-apc/APKBUILD
index 8e1fc5b1..260ae8e9 100644
--- a/main/php-apc/APKBUILD
+++ b/main/php-apc/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php-apc
 pkgver=3.1.3_p1
 _realver=3.1.3p1
-pkgrel=0
+pkgrel=1
 pkgdesc="Alternative PHP Cache"
 url="http://pecl.php.net/package/APC"
 license="PHP"
diff --git a/main/php-fileinfo/APKBUILD b/main/php-fileinfo/APKBUILD
index 8e72f404..5bcfc32e 100644
--- a/main/php-fileinfo/APKBUILD
+++ b/main/php-fileinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=php-fileinfo
 pkgver=1.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="This extension allows retrieval of information regarding vast majority of file."
 url="http://pecl.php.net/package/Fileinfo"
 license="PHP"
diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index 1b72cc30..1f62f11f 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php
 pkgver=5.3.2
 _suhosinver=${pkgver}-0.9.9.1
-pkgrel=1
+pkgrel=2
 pkgdesc="The PHP language runtime engine"
 url="http://www.php.net/"
 license="PHP-3"
diff --git a/main/pinentry/APKBUILD b/main/pinentry/APKBUILD
index b211173f..d9fbe9a5 100644
--- a/main/pinentry/APKBUILD
+++ b/main/pinentry/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=pinentry
 pkgver=0.7.6
 _uiconv_ver=0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Collection of simple PIN or passphrase entry dialogs which utilize the Assuan protocol"
 url="http://www.gnupg.org/aegypten2"
 license="GPL-2"
diff --git a/main/pingu/APKBUILD b/main/pingu/APKBUILD
index aabc7f78..b09a41c7 100644
--- a/main/pingu/APKBUILD
+++ b/main/pingu/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pingu
 pkgver=0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Small daemon that pings hosts and executes a script when status change"
 url="http://git.alpinelinux.org/cgit/pingu"
 license="GPL"
diff --git a/main/pixman/APKBUILD b/main/pixman/APKBUILD
index 7ea5259e..2e3e01bd 100644
--- a/main/pixman/APKBUILD
+++ b/main/pixman/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pixman
 pkgver=0.16.6
-pkgrel=0
+pkgrel=1
 pkgdesc="Pixman library"
 url="http://xorg.freedesktop.org"
 license="custom"
diff --git a/main/pjproject/APKBUILD b/main/pjproject/APKBUILD
index 363d7616..e44c9450 100644
--- a/main/pjproject/APKBUILD
+++ b/main/pjproject/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pjproject
 pkgver=1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI Softphone"
 url="http://www.pjsip.org/pjsua.htm"
 license="GPL"
diff --git a/main/pkgconfig/APKBUILD b/main/pkgconfig/APKBUILD
index afdb2728..753e07b9 100644
--- a/main/pkgconfig/APKBUILD
+++ b/main/pkgconfig/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pkgconfig
 pkgver=0.23
-pkgrel=0
+pkgrel=1
 pkgdesc="A system for managing library compile/link flags"
 url="http://pkgconfig.freedesktop.org/wiki/"
 license="GPL"
diff --git a/main/policyd-spf-fs/APKBUILD b/main/policyd-spf-fs/APKBUILD
index 116c4188..30fad5f5 100644
--- a/main/policyd-spf-fs/APKBUILD
+++ b/main/policyd-spf-fs/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=policyd-spf-fs
 pkgver=23
-pkgrel=0
+pkgrel=1
 pkgdesc="Policy daemon for checking SPF records in postfix"
 url="http://www.freestone.net/software/policyd-spf-fs/"
 license="GPL"
diff --git a/main/poppler-gtk/APKBUILD b/main/poppler-gtk/APKBUILD
index a92d7650..81e9c6f9 100644
--- a/main/poppler-gtk/APKBUILD
+++ b/main/poppler-gtk/APKBUILD
@@ -5,7 +5,7 @@
 pkgname=poppler-gtk
 _realname=poppler
 pkgver=0.12.4
-pkgrel=0
+pkgrel=1
 pkgdesc="PDF rendering library based on xpdf 3.0"
 url="http://poppler.freedesktop.org/"
 license="GPL"
diff --git a/main/poppler/APKBUILD b/main/poppler/APKBUILD
index b6b8a31d..56cce5a0 100644
--- a/main/poppler/APKBUILD
+++ b/main/poppler/APKBUILD
@@ -5,7 +5,7 @@
 # So we build gtk support in poppler-gtk
 pkgname=poppler
 pkgver=0.12.4
-pkgrel=0
+pkgrel=1
 pkgdesc="PDF rendering library based on xpdf 3.0"
 url="http://poppler.freedesktop.org/"
 license="GPL"
diff --git a/main/popt/APKBUILD b/main/popt/APKBUILD
index 469b65bd..33a7cea0 100644
--- a/main/popt/APKBUILD
+++ b/main/popt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=popt
 pkgver=1.15
-pkgrel=0
+pkgrel=1
 pkgdesc="A commandline option parser"
 url="http://rpm5.org"
 license="custom"
diff --git a/main/portmap/APKBUILD b/main/portmap/APKBUILD
index afdb114a..a6e76bcf 100644
--- a/main/portmap/APKBUILD
+++ b/main/portmap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=portmap
 pkgver=6.0
-pkgrel=3
+pkgrel=4
 pkgdesc="RPC connection manager"
 url="http://neil.brown.name/portmap/"
 license="GPL"
diff --git a/main/postfix/APKBUILD b/main/postfix/APKBUILD
index e4e43fea..8393e8cc 100644
--- a/main/postfix/APKBUILD
+++ b/main/postfix/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postfix
 pkgver=2.6.5
-pkgrel=2
+pkgrel=3
 pkgdesc="Secure and fast drop-in replacement for Sendmail (MTA)"
 url="http://www.postfix.org/"
 license="IPL-1"
diff --git a/main/postgresql/APKBUILD b/main/postgresql/APKBUILD
index a4d1b55f..a771a979 100644
--- a/main/postgresql/APKBUILD
+++ b/main/postgresql/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postgresql
 pkgver=8.4.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A sophisticated object-relational DBMS"
 url="http://www.postgresql.org/"
 license="BSD"
diff --git a/main/pound/APKBUILD b/main/pound/APKBUILD
index 3ad04941..b48afd58 100644
--- a/main/pound/APKBUILD
+++ b/main/pound/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pound
 pkgver=2.5
-pkgrel=0
+pkgrel=1
 pkgdesc="A reverse proxy, load balancer, and SSL wrapper"
 url="http://www.apsis.ch/pound/index_html"
 license="GPL"
diff --git a/main/ppp/APKBUILD b/main/ppp/APKBUILD
index a7fcb2e7..eb17abf7 100644
--- a/main/ppp/APKBUILD
+++ b/main/ppp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ppp
 pkgver=2.4.5
-pkgrel=0
+pkgrel=1
 pkgdesc="A daemon which implements the PPP protocol for dial-up networking"
 url="http://www.samba.org/ppp/"
 license="custom:GPL/BSD"
diff --git a/main/procps/APKBUILD b/main/procps/APKBUILD
index 368148b2..4df2d721 100644
--- a/main/procps/APKBUILD
+++ b/main/procps/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=procps
 pkgver=3.2.8
-pkgrel=0
+pkgrel=1
 pkgdesc="Utilities for monitoring your system and processes on your system"
 url="http://procps.sourceforge.net/"
 license="GPL LGPL"
diff --git a/main/pth/APKBUILD b/main/pth/APKBUILD
index 23217bfc..ec920d87 100644
--- a/main/pth/APKBUILD
+++ b/main/pth/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pth
 pkgver=2.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNU Portable Threads."
 url="http://www.gnu.org/software/pth"
 license="LGPL-2.1"
diff --git a/main/python/APKBUILD b/main/python/APKBUILD
index 4e67b233..a7df0842 100644
--- a/main/python/APKBUILD
+++ b/main/python/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=python
 pkgver=2.6.5
-pkgrel=0
+pkgrel=1
 pkgdesc="A high-level scripting language"
 url="http://www.python.org"
 license="custom"
diff --git a/main/quagga/APKBUILD b/main/quagga/APKBUILD
index 6ce2b926..86d3656d 100644
--- a/main/quagga/APKBUILD
+++ b/main/quagga/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=quagga
 pkgver=0.99.15
-pkgrel=3
+pkgrel=4
 pkgdesc="A free routing daemon replacing Zebra supporting RIP, OSPF and BGP."
 url="http://quagga.net/"
 license="GPL-2"
diff --git a/main/rarian/APKBUILD b/main/rarian/APKBUILD
index 76495449..4dcb23a7 100644
--- a/main/rarian/APKBUILD
+++ b/main/rarian/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rarian
 pkgver=0.8.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Documentation meta-data library, designed as a replacement for Scrollkeeper."
 url="http://rarian.freedesktop.org/"
 license="GPL"
diff --git a/main/razor/APKBUILD b/main/razor/APKBUILD
index 45950c98..0489fcfd 100644
--- a/main/razor/APKBUILD
+++ b/main/razor/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=razor
 _realname=razor-agents
 pkgver=2.84
-pkgrel=0
+pkgrel=1
 pkgdesc="Vipul's Razor is a distributed, collaborative spam detection and filtering network"
 url="http://razor.sourceforge.net/"
 license="Artistic"
diff --git a/main/rdesktop/APKBUILD b/main/rdesktop/APKBUILD
index b705c0ff..597af311 100644
--- a/main/rdesktop/APKBUILD
+++ b/main/rdesktop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rdesktop
 pkgver=1.6.0
-pkgrel=0
+pkgrel=1
 pkgdesc="rdesktop is used to connect to windows terminal servers"
 url="http://www.rdesktop.org/"
 license="GPL"
diff --git a/main/readline/APKBUILD b/main/readline/APKBUILD
index 0c6caeed..7ebf94de 100644
--- a/main/readline/APKBUILD
+++ b/main/readline/APKBUILD
@@ -4,7 +4,7 @@ pkgver=6.1.002
 _myver=${pkgver%.*}
 _patchver=${pkgver##*.}
 _suff=${_myver%.*}${_myver#*.}
-pkgrel=0
+pkgrel=1
 pkgdesc="GNU readline library"
 url="ftp://ftp.cwru.edu/pub/bash/"
 license="GPL"
diff --git a/main/remmina/APKBUILD b/main/remmina/APKBUILD
index 80db469e..67ff8065 100644
--- a/main/remmina/APKBUILD
+++ b/main/remmina/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=remmina
 pkgver=0.7.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Remmina is a remote desktop client written in GTK+"
 url="http://remmina.sourceforge.net/"
 license="GPL"
diff --git a/main/rgb/APKBUILD b/main/rgb/APKBUILD
index 73bbd823..15c87055 100644
--- a/main/rgb/APKBUILD
+++ b/main/rgb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rgb
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org utility to display an rgb color-name database"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/ristretto/APKBUILD b/main/ristretto/APKBUILD
index 4daa7259..28e77495 100644
--- a/main/ristretto/APKBUILD
+++ b/main/ristretto/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ristretto
 pkgver=0.0.22
-pkgrel=1
+pkgrel=2
 pkgdesc="Ristretto is a image viewer for Xfce"
 url="http://goodies.xfce.org/projects/applications/ristretto"
 license="GPL-2"
diff --git a/main/rrdtool/APKBUILD b/main/rrdtool/APKBUILD
index b35091fa..b5794f36 100644
--- a/main/rrdtool/APKBUILD
+++ b/main/rrdtool/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rrdtool
 pkgver=1.2.30
-pkgrel=1
+pkgrel=2
 pkgdesc="Data logging and graphing application"
 url="http://www.rrdtool.org"
 license="GPL"
diff --git a/main/rsync/APKBUILD b/main/rsync/APKBUILD
index dcef2555..3ab1ce60 100644
--- a/main/rsync/APKBUILD
+++ b/main/rsync/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rsync
 pkgver=3.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="A file transfer program to keep remote files in sync"
 url="http://samba.anu.edu.au/rsync/"
 license="GPL3"
diff --git a/main/ruby/APKBUILD b/main/ruby/APKBUILD
index e49c35a1..a24a4cbc 100644
--- a/main/ruby/APKBUILD
+++ b/main/ruby/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=ruby
 pkgver=1.8.7_p174
 _pkgver=1.8.7-p174
-pkgrel=3
+pkgrel=4
 pkgdesc="An object-oriented language for quick and easy programming"
 url="http://www.ruby-lang.org/en/"
 license="Ruby"
diff --git a/main/run-parts/APKBUILD b/main/run-parts/APKBUILD
index b5017323..5718d634 100644
--- a/main/run-parts/APKBUILD
+++ b/main/run-parts/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=run-parts
 pkgver=3.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="run-parts from the debianutils package"
 url="http://packages.qa.debian.org/d/debianutils.html"
 license="GPL"
diff --git a/main/rxmtp/APKBUILD b/main/rxmtp/APKBUILD
index 49cad696..c12214a4 100644
--- a/main/rxmtp/APKBUILD
+++ b/main/rxmtp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=rxmtp
 pkgver=1.1.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Rewrite and eXchange smtp proxy"
 url="http://dev.alpinelinux.org/alpine/rxmtp"
 license="GPL"
diff --git a/main/samba/APKBUILD b/main/samba/APKBUILD
index f84662f8..5a7a1d52 100644
--- a/main/samba/APKBUILD
+++ b/main/samba/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=samba
 pkgver=3.4.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Tools to access a server's filespace and printers via SMB"
 url="http://www.samba.org"
 license="GPL3"
diff --git a/main/screen/APKBUILD b/main/screen/APKBUILD
index a8a04b16..6b08e5fa 100644
--- a/main/screen/APKBUILD
+++ b/main/screen/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=screen
 pkgver=4.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A window manager that multiplexes a physical terminal"
 url="http://ftp.gnu.org/gnu/screen/"
 license="GPL"
diff --git a/main/scrot/APKBUILD b/main/scrot/APKBUILD
index ee98edd6..ea6ac1b6 100644
--- a/main/scrot/APKBUILD
+++ b/main/scrot/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=scrot
 pkgver=0.8
-pkgrel=3
+pkgrel=4
 pkgdesc="A simple command-line screenshot utility for X"
 url="http://linuxbrit.co.uk/scrot/"
 license="MIT"
diff --git a/main/sdl/APKBUILD b/main/sdl/APKBUILD
index e81c8064..e98589b0 100644
--- a/main/sdl/APKBUILD
+++ b/main/sdl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sdl
 pkgver=1.2.14
-pkgrel=0
+pkgrel=1
 pkgdesc="A library for portable low-level access to a video framebuffer, audio output, mouse, and keyboard"
 url="http://www.libsdl.org"
 license="LGPL"
diff --git a/main/sed/APKBUILD b/main/sed/APKBUILD
index 99ba1e6f..b19f1f5e 100644
--- a/main/sed/APKBUILD
+++ b/main/sed/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sed
 pkgver=4.2.1
-pkgrel=0
+pkgrel=1
 subpackages="$pkgname-doc"
 pkgdesc="GNU stream editor"
 url="http://www.gnu.org/software/sed"
diff --git a/main/sessreg/APKBUILD b/main/sessreg/APKBUILD
index 4e1cba4e..237df93b 100644
--- a/main/sessreg/APKBUILD
+++ b/main/sessreg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sessreg
 pkgver=1.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="manage utmp/wtmp entries for non-init clients"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/setxkbmap/APKBUILD b/main/setxkbmap/APKBUILD
index 2b8eb19b..1a75ef88 100644
--- a/main/setxkbmap/APKBUILD
+++ b/main/setxkbmap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=setxkbmap
 pkgver=1.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="set the keyboard using the X Keyboard Extension"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/sfic/APKBUILD b/main/sfic/APKBUILD
index 0aebac7a..4c038907 100644
--- a/main/sfic/APKBUILD
+++ b/main/sfic/APKBUILD
@@ -1,7 +1,7 @@
 pkgdesc="Small and Simple File Integrity Checker"
 pkgname=sfic
 pkgver=0.1.7
-pkgrel=1
+pkgrel=2
 depends=
 license=GPL
 makedepends="autoconf automake samba-dev"
diff --git a/main/shared-mime-info/APKBUILD b/main/shared-mime-info/APKBUILD
index 81b8c5c6..5d1d200b 100644
--- a/main/shared-mime-info/APKBUILD
+++ b/main/shared-mime-info/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=shared-mime-info
 pkgver=0.71
-pkgrel=0
+pkgrel=1
 pkgdesc="Freedesktop.org Shared MIME Info"
 url="http://freedesktop.org/Software/shared-mime-info"
 license="GPL"
diff --git a/main/sic/APKBUILD b/main/sic/APKBUILD
index 0ffc4c44..e95fd832 100644
--- a/main/sic/APKBUILD
+++ b/main/sic/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sic
 pkgver=1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="an extremely simple IRC client"
 url="http://www.suckless.org/programs/sic.html"
 license="GPL"
diff --git a/main/slang/APKBUILD b/main/slang/APKBUILD
index 09b42e1b..a74ca0e6 100644
--- a/main/slang/APKBUILD
+++ b/main/slang/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=slang
 pkgver=2.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="S-Lang is a powerful interpreted language"
 url="http://www.s-lang.org/"
 license="GPL"
diff --git a/main/slim/APKBUILD b/main/slim/APKBUILD
index cf2e08f9..9f4cebe8 100644
--- a/main/slim/APKBUILD
+++ b/main/slim/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=slim
 pkgver=1.3.1
-pkgrel=5
+pkgrel=6
 pkgdesc="Desktop-independent graphical login manager for X11"
 url="http://slim.berlios.de/"
 license="GPL-2"
diff --git a/main/snort/APKBUILD b/main/snort/APKBUILD
index 15ac9717..f9fc94b4 100644
--- a/main/snort/APKBUILD
+++ b/main/snort/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=snort
 pkgver=2.8.5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="An open source network intrusion prevention and detection system"
 url="http://www.snort.org/"
 license="GPL"
diff --git a/main/sntpc/APKBUILD b/main/sntpc/APKBUILD
index b821d569..81643102 100644
--- a/main/sntpc/APKBUILD
+++ b/main/sntpc/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sntpc
 pkgver=0.9
-pkgrel=1
+pkgrel=2
 pkgdesc="Simple NTP client"
 url="http://git.alpinelinux.org/cgit/sntpc"
 license="GPL-2"
diff --git a/main/sox/APKBUILD b/main/sox/APKBUILD
index 166d08b2..e5a90283 100644
--- a/main/sox/APKBUILD
+++ b/main/sox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sox
 pkgver=14.3.0
-pkgrel=0
+pkgrel=1
 pkgdesc="The Swiss Army knife of sound processing tools"
 url="http://sox.sourceforge.net/"
 license="GPL LGPL"
diff --git a/main/spamassassin/APKBUILD b/main/spamassassin/APKBUILD
index 981994f5..97ec9e8a 100644
--- a/main/spamassassin/APKBUILD
+++ b/main/spamassassin/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=spamassassin
 _realname=Mail-SpamAssassin
 pkgver=3.3.1
-pkgrel=1
+pkgrel=2
 pkgdesc="The Powerful #1 Open-Source Spam Filter"
 url="http://spamassassin.apache.org"
 license="Apache"
diff --git a/main/spandsp/APKBUILD b/main/spandsp/APKBUILD
index 87c855a4..15372f47 100644
--- a/main/spandsp/APKBUILD
+++ b/main/spandsp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=spandsp
 pkgver=0.0.6_pre17
-pkgrel=0
+pkgrel=1
 pkgdesc="SpanDSP is a library of DSP functions for telephony"
 url="http://www.soft-switch.org/installing-spandsp.html"
 license="GPL"
diff --git a/main/sqlite/APKBUILD b/main/sqlite/APKBUILD
index 325e2b4a..21d90fc6 100644
--- a/main/sqlite/APKBUILD
+++ b/main/sqlite/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=sqlite
 pkgver=3.6.22
-pkgrel=0
+pkgrel=1
 pkgdesc="A C library that implements an SQL database engine"
 url="http://www.sqlite.org/"
 license="custom"
diff --git a/main/squashfs-tools/APKBUILD b/main/squashfs-tools/APKBUILD
index 8af44856..f5ac12c8 100644
--- a/main/squashfs-tools/APKBUILD
+++ b/main/squashfs-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=squashfs-tools
 pkgver=4.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Tools for squashfs, a highly compressed read-only filesystem for Linux."
 url="http://squashfs.sourceforge.net"
 license="GPL"
diff --git a/main/squid/APKBUILD b/main/squid/APKBUILD
index e0f6582f..44564778 100644
--- a/main/squid/APKBUILD
+++ b/main/squid/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=squid
 pkgver=2.7.7
 _ver=2.7.STABLE7
-pkgrel=3
+pkgrel=4
 pkgdesc="A full-featured Web proxy cache server."
 url="http://www.squid-cache.org"
 install="squid.pre-install squid.pre-upgrade squid.post-install"
diff --git a/main/ssmtp/APKBUILD b/main/ssmtp/APKBUILD
index 35af54e9..590cee0d 100644
--- a/main/ssmtp/APKBUILD
+++ b/main/ssmtp/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=ssmtp
 pkgver=2.64
-pkgrel=1
+pkgrel=2
 pkgdesc="Extremely simple MTA to get mail off the system to a mail hub"
 subpackages="$pkgname-doc"
 arch=""
diff --git a/main/startup-notification/APKBUILD b/main/startup-notification/APKBUILD
index 34f81011..94bc8f00 100644
--- a/main/startup-notification/APKBUILD
+++ b/main/startup-notification/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=startup-notification
 pkgver=0.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Monitor and display application startup"
 url="http://www.freedesktop.org"
 license="LGPL"
diff --git a/main/strace/APKBUILD b/main/strace/APKBUILD
index d7a10cfd..531058cf 100644
--- a/main/strace/APKBUILD
+++ b/main/strace/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=strace
 pkgver=4.5.19
-pkgrel=1
+pkgrel=2
 pkgdesc="A useful diagnositic, instructional, and debugging tool"
 url="http://sourceforge.net/projects/strace/"
 license="BSD"
diff --git a/main/subversion/APKBUILD b/main/subversion/APKBUILD
index 6005c188..15a57dbc 100644
--- a/main/subversion/APKBUILD
+++ b/main/subversion/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=subversion
 pkgver=1.6.9
-pkgrel=0
+pkgrel=1
 pkgdesc="Replacement for CVS, another versioning system (svn)"
 url="http://subversion.tigris.org/"
 license="apache bsd"
diff --git a/main/sudo/APKBUILD b/main/sudo/APKBUILD
index 1bbb53cc..b5d54fd0 100644
--- a/main/sudo/APKBUILD
+++ b/main/sudo/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=sudo
 pkgver=1.7.2_p6
 _realver=${pkgver%_*}${pkgver#*_}
-pkgrel=0
+pkgrel=1
 pkgdesc="Give certain users the ability to run some commands as root"
 url="http://www.sudo.ws/sudo/"
 license='custom ISC'
diff --git a/main/swfdec-mozilla/APKBUILD b/main/swfdec-mozilla/APKBUILD
index b2409e8d..6e3bd989 100644
--- a/main/swfdec-mozilla/APKBUILD
+++ b/main/swfdec-mozilla/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=swfdec-mozilla
 pkgver=0.8.2
-pkgrel=0
+pkgrel=1
 pkgdesc="free plugin for Mozilla browsers that uses the Swfdec library for playing SWF files"
 url="http://swfdec.freedesktop.org"
 license="LGPL"
diff --git a/main/swfdec/APKBUILD b/main/swfdec/APKBUILD
index 3225d0a4..8ab7488d 100644
--- a/main/swfdec/APKBUILD
+++ b/main/swfdec/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=swfdec
 pkgver=0.8.4
-pkgrel=1
+pkgrel=2
 pkgdesc="free library for decoding and rendering Flash animations"
 url="http://swfdec.freedesktop.org"
 license="LGPL"
diff --git a/main/swig/APKBUILD b/main/swig/APKBUILD
index 3a2d470e..9be176bf 100644
--- a/main/swig/APKBUILD
+++ b/main/swig/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=swig
 pkgver=1.3.40
-pkgrel=0
+pkgrel=1
 pkgdesc="SWIG is a compiler that makes it easy to integrate C and C++ code with scripting languages"
 url="http://www.swig.org/"
 license="custom"
diff --git a/main/sylpheed/APKBUILD b/main/sylpheed/APKBUILD
index 672279f2..2fe2daef 100644
--- a/main/sylpheed/APKBUILD
+++ b/main/sylpheed/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sylpheed
 pkgver=3.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Lightweight and user-friendly e-mail client"
 url="http://sylpheed.sraoss.jp/en/"
 license="GPL"
diff --git a/main/sysfsutils/APKBUILD b/main/sysfsutils/APKBUILD
index 64dfe96d..1f910b14 100644
--- a/main/sysfsutils/APKBUILD
+++ b/main/sysfsutils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sysfsutils
 pkgver=2.1.0
-pkgrel=3
+pkgrel=4
 pkgdesc="System Utilities Based on Sysfs"
 url="http://linux-diag.sourceforge.net/Sysfsutils.html"
 license="GPL LGPL"
diff --git a/main/sysklogd/APKBUILD b/main/sysklogd/APKBUILD
index 33dde41e..681ac7d8 100644
--- a/main/sysklogd/APKBUILD
+++ b/main/sysklogd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sysklogd
 pkgver=1.5
-pkgrel=4
+pkgrel=5
 pkgdesc="System and kernel log daemons"
 url="http://www.infodrom.org/projects/sysklogd/"
 license="GPL BSD"
diff --git a/main/syslinux/APKBUILD b/main/syslinux/APKBUILD
index 5fd6f2f5..739e9955 100644
--- a/main/syslinux/APKBUILD
+++ b/main/syslinux/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=syslinux
 pkgver=3.86
-pkgrel=0
+pkgrel=1
 pkgdesc="a boot loader for the Linux operating system which operates off an MS-DOS/Windows FAT filesystem."
 url="http://syslinux.org"
 license="GPL"
diff --git a/main/sysstat/APKBUILD b/main/sysstat/APKBUILD
index 7ec00676..f78fc6e6 100644
--- a/main/sysstat/APKBUILD
+++ b/main/sysstat/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sysstat
 pkgver=9.0.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Performance monitoring tools for Linux"
 url="http://pagesperso-orange.fr/sebastien.godard/"
 license="GPL"
diff --git a/main/taglib/APKBUILD b/main/taglib/APKBUILD
index 66b82a83..2c2320f3 100644
--- a/main/taglib/APKBUILD
+++ b/main/taglib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=taglib
 pkgver=1.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="library for reading and editing the meta-data of several popular audio formats."
 url="http://ktown.kde.org/~wheeler/taglib.html"
 license="GPL2"
diff --git a/main/tar/APKBUILD b/main/tar/APKBUILD
index fed2453b..994adaef 100644
--- a/main/tar/APKBUILD
+++ b/main/tar/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=tar
 pkgver=1.23
-pkgrel=0
+pkgrel=1
 pkgdesc="Utility used to store, backup, and transport files"
 url="http://www.gnu.org"
 license='GPL'
diff --git a/main/tcl/APKBUILD b/main/tcl/APKBUILD
index d815acdd..6b724f9c 100644
--- a/main/tcl/APKBUILD
+++ b/main/tcl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=tcl
 pkgver=8.5.8
-pkgrel=0
+pkgrel=1
 pkgdesc="The Tcl scripting language"
 url="http://tcl.sourceforge.net/"
 license="custom"
diff --git a/main/tcpdump/APKBUILD b/main/tcpdump/APKBUILD
index ad9f5323..74b8f0ec 100644
--- a/main/tcpdump/APKBUILD
+++ b/main/tcpdump/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=tcpdump
 pkgver=4.0.0
-pkgrel=1
+pkgrel=2
 pkgdesc="A tool for network monitoring and data acquisition"
 url="http://www.tcpdump.org"
 license="BSD"
diff --git a/main/tcpproxy/APKBUILD b/main/tcpproxy/APKBUILD
index a06aacb3..9b2273a3 100644
--- a/main/tcpproxy/APKBUILD
+++ b/main/tcpproxy/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=tcpproxy
 pkgver=2.0.0_beta15
 _realver=2.0.0-beta15
-pkgrel=0
+pkgrel=1
 pkgdesc="Transparent TCP Proxy"
 url="http://www.quietsche-entchen.de/cgi-bin/wiki.cgi/proxies/TcpProxy"
 license="GPL"
diff --git a/main/terminal/APKBUILD b/main/terminal/APKBUILD
index d4db8897..2f159f08 100644
--- a/main/terminal/APKBUILD
+++ b/main/terminal/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=terminal
 pkgver=0.4.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A modern terminal emulator primarly for the Xfce desktop environment"
 url="http://www.xfce.org/projects/terminal/"
 license="GPL-2"
diff --git a/main/texinfo/APKBUILD b/main/texinfo/APKBUILD
index a8484bf4..ad4be84c 100644
--- a/main/texinfo/APKBUILD
+++ b/main/texinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=texinfo
 pkgver=4.13a
-pkgrel=1
+pkgrel=2
 pkgdesc="Utilities to work with and produce manuals, ASCII text, and on-line documentation from a single source file"
 url="http://www.gnu.org/software/texinfo/"
 license='GPL3'
diff --git a/main/tftpd-hpa/APKBUILD b/main/tftpd-hpa/APKBUILD
index c507e2f6..c2a3e349 100644
--- a/main/tftpd-hpa/APKBUILD
+++ b/main/tftpd-hpa/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=tftp-hpa
 pkgver=5.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Official tftp server"
 url="http://www.kernel.org/pub/software/network/tftp/"
 license="BSD"
diff --git a/main/thunar-archive-plugin/APKBUILD b/main/thunar-archive-plugin/APKBUILD
index 87162bbf..6e5f8999 100644
--- a/main/thunar-archive-plugin/APKBUILD
+++ b/main/thunar-archive-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=thunar-archive-plugin
 pkgver=0.2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="create and deflate archives in thunar"
 url="http://xfce-goodies.berlios.de/"
 license="GPL2"
diff --git a/main/thunar/APKBUILD b/main/thunar/APKBUILD
index f99a0410..0c2db0a1 100644
--- a/main/thunar/APKBUILD
+++ b/main/thunar/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=thunar
 pkgver=1.0.1
-pkgrel=6
+pkgrel=7
 pkgdesc="File manager for Xfce"
 url="http://thunar.xfce.org"
 license="GPL2 LGPL2"
diff --git a/main/tiff/APKBUILD b/main/tiff/APKBUILD
index 4b348465..c13e26a4 100644
--- a/main/tiff/APKBUILD
+++ b/main/tiff/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=tiff
 pkgver=3.8.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Provides support for the Tag Image File Format or TIFF"
 url="http://www.libtiff.org/"
 license="GPL"
diff --git a/main/tinyproxy/APKBUILD b/main/tinyproxy/APKBUILD
index 5a60c106..9489bd1a 100644
--- a/main/tinyproxy/APKBUILD
+++ b/main/tinyproxy/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=tinyproxy
 pkgver=1.6.5
-pkgrel=4
+pkgrel=5
 pkgdesc="Lightweight HTTP proxy"
 pkgusers="tinyproxy"
 pkggroups="tinyproxy"
diff --git a/main/tmux/APKBUILD b/main/tmux/APKBUILD
index e2720843..fd3a8883 100644
--- a/main/tmux/APKBUILD
+++ b/main/tmux/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=tmux
 pkgver=1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Tool to control multiple terminals from a single terminal"
 url="http://tmux.sourceforge.net/"
 license="BSD"
diff --git a/main/ucarp/APKBUILD b/main/ucarp/APKBUILD
index a40d99f2..f785f2d7 100644
--- a/main/ucarp/APKBUILD
+++ b/main/ucarp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=ucarp
 pkgver=1.5.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Share common IP and do fail over"
 url="http://www.ucarp.org"
 license="GPL"
diff --git a/main/uclibc++/APKBUILD b/main/uclibc++/APKBUILD
index 6a40ba54..e4e9667f 100644
--- a/main/uclibc++/APKBUILD
+++ b/main/uclibc++/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=uclibc++
 pkgver=0.2.2
-pkgrel=5
+pkgrel=6
 pkgdesc="Embedded C++ library"
 url="http://cxx.uclibc.org/"
 license='GPL-2'
diff --git a/main/unarj/APKBUILD b/main/unarj/APKBUILD
index 7f5b23fc..f40c7577 100644
--- a/main/unarj/APKBUILD
+++ b/main/unarj/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=unarj
 pkgver=2.63a
-pkgrel=0
+pkgrel=1
 pkgdesc="Extracting, testing and  viewing the contents of archives created with the ARJ archiver"
 url="http://www.arjsoftware.com"
 license="custom"
diff --git a/main/unfs3/APKBUILD b/main/unfs3/APKBUILD
index bfadf938..7895d99e 100644
--- a/main/unfs3/APKBUILD
+++ b/main/unfs3/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=unfs3
 pkgver=0.9.22
-pkgrel=0
+pkgrel=1
 pkgdesc="a user-space implementation of the NFSv3 server specification"
 url="http://unfs3.sourceforge.net/"
 license='GPL'
diff --git a/main/unixodbc/APKBUILD b/main/unixodbc/APKBUILD
index e0ed27c9..461f4d41 100644
--- a/main/unixodbc/APKBUILD
+++ b/main/unixodbc/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=unixodbc
 pkgver=2.2.14
-pkgrel=1
+pkgrel=2
 pkgdesc="ODBC is an open specification to access Data Sources"
 url="http://www.unixodbc.org/"
 license="GPL2"
diff --git a/main/unrar/APKBUILD b/main/unrar/APKBUILD
index 1f5989d9..6c48217d 100644
--- a/main/unrar/APKBUILD
+++ b/main/unrar/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=unrar
 pkgver=3.9.10
-pkgrel=0
+pkgrel=1
 pkgdesc="The RAR uncompression program"
 url="http://www.rarlab.com"
 license="GPL"
diff --git a/main/usbutils/APKBUILD b/main/usbutils/APKBUILD
index f3ff638f..a6f579b9 100644
--- a/main/usbutils/APKBUILD
+++ b/main/usbutils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=usbutils
 pkgver=0.87
-pkgrel=0
+pkgrel=1
 pkgdesc="USB Device Utilities"
 url="http://linux-usb.sourceforge.net/"
 license="GPL"
diff --git a/main/util-linux-ng/APKBUILD b/main/util-linux-ng/APKBUILD
index 9fe1aa29..0cc99961 100644
--- a/main/util-linux-ng/APKBUILD
+++ b/main/util-linux-ng/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=util-linux-ng
 pkgver=2.17.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Random collection of Linux utilities"
 arch=""
 url="http://kernel.org/~kzak/util-linux-ng/"
diff --git a/main/util-vserver/APKBUILD b/main/util-vserver/APKBUILD
index 5d77bca7..8e2a5307 100644
--- a/main/util-vserver/APKBUILD
+++ b/main/util-vserver/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=util-vserver
 pkgver=0.30.216_pre2882
 _realver=0.30.216-pre2882
-pkgrel=7
+pkgrel=8
 pkgdesc="Linux-VServer admin utilities"
 url="http://www.nongnu.org/util-vserver/"
 license="GPL"
diff --git a/main/uvncrepeater/APKBUILD b/main/uvncrepeater/APKBUILD
index d4464fe1..c4fa4d05 100644
--- a/main/uvncrepeater/APKBUILD
+++ b/main/uvncrepeater/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=uvncrepeater
 pkgver=014
-pkgrel=1
+pkgrel=2
 pkgdesc="VNC repeater based on ultravnc repeater"
 url="http://koti.mbnet.fi/jtko/"
 license="GPL-2"
diff --git a/main/vala/APKBUILD b/main/vala/APKBUILD
index 4ace140d..9cac0789 100644
--- a/main/vala/APKBUILD
+++ b/main/vala/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vala
 pkgver=0.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Compiler for the GObject type system"
 url="http://live.gnome.org/Vala"
 license="LGPL"
diff --git a/main/valgrind/APKBUILD b/main/valgrind/APKBUILD
index c2120d31..31c813ae 100644
--- a/main/valgrind/APKBUILD
+++ b/main/valgrind/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=valgrind
 pkgver=3.4.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A tool to help find memory-management problems in programs"
 url="http://valgrind.org/"
 license="GPL"
diff --git a/main/vim/APKBUILD b/main/vim/APKBUILD
index e0cc6c1c..2d41bc1e 100644
--- a/main/vim/APKBUILD
+++ b/main/vim/APKBUILD
@@ -3,7 +3,7 @@ pkgname=vim
 _srcver=7.2
 _patchver=394
 pkgver=7.2.394
-pkgrel=0
+pkgrel=1
 pkgdesc="advanced text editor"
 url="http://www.vim.org"
 license='GPL'
diff --git a/main/vsftpd/APKBUILD b/main/vsftpd/APKBUILD
index f53933cd..1be9c18c 100644
--- a/main/vsftpd/APKBUILD
+++ b/main/vsftpd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vsftpd
 pkgver=2.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Very secure ftpd"
 url="http://vsftpd.beasts.org"
 license="GPL"
diff --git a/main/vte/APKBUILD b/main/vte/APKBUILD
index 71620ed7..8d251687 100644
--- a/main/vte/APKBUILD
+++ b/main/vte/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vte
 pkgver=0.24.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Virtual Terminal Emulator library"
 url="http://www.gnome.org"
 license="LGPL"
diff --git a/main/webkit/APKBUILD b/main/webkit/APKBUILD
index e7df9315..f030358b 100644
--- a/main/webkit/APKBUILD
+++ b/main/webkit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=webkit
 pkgver=1.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="portable web rendering engine WebKit for GTK+"
 url="http://webkitgtk.org/"
 license="LGPL BSD"
diff --git a/main/wget/APKBUILD b/main/wget/APKBUILD
index 8f377ecb..c5ea9891 100644
--- a/main/wget/APKBUILD
+++ b/main/wget/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=wget
 pkgver=1.12
-pkgrel=0
+pkgrel=1
 pkgdesc="A network utility to retrieve files from the Web"
 url="http://www.gnu.org/software/wget/wget.html"
 license="GPL3"
diff --git a/main/wireless-tools/APKBUILD b/main/wireless-tools/APKBUILD
index b4c726bd..33c0c927 100644
--- a/main/wireless-tools/APKBUILD
+++ b/main/wireless-tools/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=wireless-tools
 pkgver=29
-pkgrel=1
+pkgrel=2
 pkgdesc="Open Source wireless tools"
 url="http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html"
 license="GPL"
diff --git a/main/wireshark/APKBUILD b/main/wireshark/APKBUILD
index 8cd7aa0f..d262ce92 100644
--- a/main/wireshark/APKBUILD
+++ b/main/wireshark/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jeremy Thomerson <jeremy@thomersonfamily.com>
 pkgname=wireshark
 pkgver=1.2.6
-pkgrel=0
+pkgrel=1
 pkgdesc="network protocol analyzer - GTK version"
 url="http://www.wireshark.org"
 license="GPLv2"
diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index bdcbd9bf..1d3d325b 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wpa_supplicant
 pkgver=0.7.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A utility providing key negotiation for WPA wireless networks"
 url="http://hostap.epitest.fi/wpa_supplicant"
 license="GPL"
diff --git a/main/wv/APKBUILD b/main/wv/APKBUILD
index b3b48ff4..ddaeaf07 100644
--- a/main/wv/APKBUILD
+++ b/main/wv/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wv
 pkgver=1.2.4
-pkgrel=1
+pkgrel=2
 pkgdesc="MSWord library can load and parse Word 2000, 97, 95 and 6 file formats"
 url="http://sourceforge.net/projects/wvware"
 license="GPL"
diff --git a/main/x264/APKBUILD b/main/x264/APKBUILD
index a26175f6..2dbe78d7 100644
--- a/main/x264/APKBUILD
+++ b/main/x264/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=x264
 pkgver=20100312
-pkgrel=0
+pkgrel=1
 pkgdesc="free library for encoding H264/AVC video streams"
 url="http://www.videolan.org/developers/x264.html"
 license="GPL"
diff --git a/main/xarchiver/APKBUILD b/main/xarchiver/APKBUILD
index d114f14c..67081e5d 100644
--- a/main/xarchiver/APKBUILD
+++ b/main/xarchiver/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xarchiver
 pkgver=0.5.2
-pkgrel=1
+pkgrel=2
 pkgdesc="GTK+ frontend to various command line archivers"
 url="http://xarchiver.xfce.org/"
 license="GPL"
diff --git a/main/xauth/APKBUILD b/main/xauth/APKBUILD
index 0c16b870..62366d9e 100644
--- a/main/xauth/APKBUILD
+++ b/main/xauth/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xauth
 pkgver=1.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org authorization settings program"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xbacklight/APKBUILD b/main/xbacklight/APKBUILD
index 6c0caaf0..1149915c 100644
--- a/main/xbacklight/APKBUILD
+++ b/main/xbacklight/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xbacklight
 pkgver=1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Sets backlight level using the RandR 1.2 BACKLIGHT output property"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xcb-util/APKBUILD b/main/xcb-util/APKBUILD
index 820a4e1f..a1812b5e 100644
--- a/main/xcb-util/APKBUILD
+++ b/main/xcb-util/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xcb-util
 pkgver=0.3.6
-pkgrel=0
+pkgrel=1
 pkgdesc="Utility libraries for XC Binding"
 url="http://xcb.freedesktop.org"
 license="GPL"
diff --git a/main/xchat/APKBUILD b/main/xchat/APKBUILD
index cb4bdbef..712ac091 100644
--- a/main/xchat/APKBUILD
+++ b/main/xchat/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xchat
 pkgver=2.8.6
-pkgrel=2
+pkgrel=3
 pkgdesc="A GTK+ based IRC client"
 url="http://www.xchat.org/"
 license="GPL"
diff --git a/main/xcmsdb/APKBUILD b/main/xcmsdb/APKBUILD
index 778413b2..ecab4fb8 100644
--- a/main/xcmsdb/APKBUILD
+++ b/main/xcmsdb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xcmsdb
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Device Color Characterization utility for X Color Management System"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xdelta3/APKBUILD b/main/xdelta3/APKBUILD
index 1ca20cae..b2e2d281 100644
--- a/main/xdelta3/APKBUILD
+++ b/main/xdelta3/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xdelta3
 pkgver=3.0y
-pkgrel=0
+pkgrel=1
 pkgdesc="A diff utility which works with binary files"
 url="http://xdelta.org/"
 license="GPL"
diff --git a/main/xdpyinfo/APKBUILD b/main/xdpyinfo/APKBUILD
index 09f9affc..5342985a 100644
--- a/main/xdpyinfo/APKBUILD
+++ b/main/xdpyinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xdpyinfo
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="display information utility for X"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xdriinfo/APKBUILD b/main/xdriinfo/APKBUILD
index ff9e76aa..c7509065 100644
--- a/main/xdriinfo/APKBUILD
+++ b/main/xdriinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xdriinfo
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="query configuration information of DRI drivers"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xev/APKBUILD b/main/xev/APKBUILD
index c30c899a..ed31bb1c 100644
--- a/main/xev/APKBUILD
+++ b/main/xev/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xev
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="print contents of X events"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-input-evdev/APKBUILD b/main/xf86-input-evdev/APKBUILD
index c7461d3f..657a1e66 100644
--- a/main/xf86-input-evdev/APKBUILD
+++ b/main/xf86-input-evdev/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-input-evdev
 pkgver=2.3.2
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org evdev input driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-input-keyboard/APKBUILD b/main/xf86-input-keyboard/APKBUILD
index 4c5fc14f..5315b173 100644
--- a/main/xf86-input-keyboard/APKBUILD
+++ b/main/xf86-input-keyboard/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-input-keyboard
 pkgver=1.4.0
-pkgrel=1
+pkgrel=2
 pkgdesc="X.org keyboard input driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-input-mouse/APKBUILD b/main/xf86-input-mouse/APKBUILD
index b2aea2bb..78eb5b4c 100644
--- a/main/xf86-input-mouse/APKBUILD
+++ b/main/xf86-input-mouse/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-input-mouse
 pkgver=1.5.0
-pkgrel=2
+pkgrel=3
 pkgdesc="X.org mouse input driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-input-synaptics/APKBUILD b/main/xf86-input-synaptics/APKBUILD
index 05debbba..8ec7ca59 100644
--- a/main/xf86-input-synaptics/APKBUILD
+++ b/main/xf86-input-synaptics/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-input-synaptics
 pkgver=1.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org synaptics input driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-apm/APKBUILD b/main/xf86-video-apm/APKBUILD
index ae0582b5..20eec3e3 100644
--- a/main/xf86-video-apm/APKBUILD
+++ b/main/xf86-video-apm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-apm
 pkgver=1.2.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Alliance ProMotion video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-ark/APKBUILD b/main/xf86-video-ark/APKBUILD
index 79bb65c0..6f4683f9 100644
--- a/main/xf86-video-ark/APKBUILD
+++ b/main/xf86-video-ark/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-ark
 pkgver=0.7.2
-pkgrel=1
+pkgrel=2
 pkgdesc="X.Org driver for ark cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-ast/APKBUILD b/main/xf86-video-ast/APKBUILD
index a07d4933..6bebdeec 100644
--- a/main/xf86-video-ast/APKBUILD
+++ b/main/xf86-video-ast/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-ast
 pkgver=0.89.9
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org driver for ASpeedTech cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-ati/APKBUILD b/main/xf86-video-ati/APKBUILD
index 44b69b13..84abb0cf 100644
--- a/main/xf86-video-ati/APKBUILD
+++ b/main/xf86-video-ati/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-ati
 pkgver=6.12.192
-pkgrel=0
+pkgrel=1
 pkgdesc="ATI video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-chips/APKBUILD b/main/xf86-video-chips/APKBUILD
index 74c98f96..ba6ef00d 100644
--- a/main/xf86-video-chips/APKBUILD
+++ b/main/xf86-video-chips/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-chips
 pkgver=1.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Chips and Technologies video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-cirrus/APKBUILD b/main/xf86-video-cirrus/APKBUILD
index 6b708a28..db531d89 100644
--- a/main/xf86-video-cirrus/APKBUILD
+++ b/main/xf86-video-cirrus/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-cirrus
 pkgver=1.3.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Cirrus Logic video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-dummy/APKBUILD b/main/xf86-video-dummy/APKBUILD
index b8f5570f..f3c27c4a 100644
--- a/main/xf86-video-dummy/APKBUILD
+++ b/main/xf86-video-dummy/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-dummy
 pkgver=0.3.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org driver for dummy cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-fbdev/APKBUILD b/main/xf86-video-fbdev/APKBUILD
index 2d001aa9..ebd7b04d 100644
--- a/main/xf86-video-fbdev/APKBUILD
+++ b/main/xf86-video-fbdev/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-fbdev
 pkgver=0.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="video driver for framebuffer device"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-geode/APKBUILD b/main/xf86-video-geode/APKBUILD
index 2ef39bf4..9e0d240b 100644
--- a/main/xf86-video-geode/APKBUILD
+++ b/main/xf86-video-geode/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-geode
 pkgver=2.11.6
-pkgrel=1
+pkgrel=2
 pkgdesc="AMD Geode GX and LX video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-glint/APKBUILD b/main/xf86-video-glint/APKBUILD
index 983b8201..554fda26 100644
--- a/main/xf86-video-glint/APKBUILD
+++ b/main/xf86-video-glint/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-glint
 pkgver=1.2.4
-pkgrel=1
+pkgrel=2
 pkgdesc="GLINT/Permedia video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-i128/APKBUILD b/main/xf86-video-i128/APKBUILD
index 5374446f..2ec4d300 100644
--- a/main/xf86-video-i128/APKBUILD
+++ b/main/xf86-video-i128/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-i128
 pkgver=1.3.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Number 9 I128 video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-i740/APKBUILD b/main/xf86-video-i740/APKBUILD
index fe8db4e6..43771f60 100644
--- a/main/xf86-video-i740/APKBUILD
+++ b/main/xf86-video-i740/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-i740
 pkgver=1.3.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Intel i740 video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-intel/APKBUILD b/main/xf86-video-intel/APKBUILD
index b90dba74..4b3d7062 100644
--- a/main/xf86-video-intel/APKBUILD
+++ b/main/xf86-video-intel/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-intel
 pkgver=2.11.0
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org driver for Intel cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-mach64/APKBUILD b/main/xf86-video-mach64/APKBUILD
index ab361df5..948c053a 100644
--- a/main/xf86-video-mach64/APKBUILD
+++ b/main/xf86-video-mach64/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-mach64
 pkgver=6.8.2
-pkgrel=1
+pkgrel=2
 pkgdesc="ATI Mach64 video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-newport/APKBUILD b/main/xf86-video-newport/APKBUILD
index bdf2f1e1..4aac5465 100644
--- a/main/xf86-video-newport/APKBUILD
+++ b/main/xf86-video-newport/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-newport
 pkgver=0.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Newport video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-nv/APKBUILD b/main/xf86-video-nv/APKBUILD
index d150de36..49cc7b53 100644
--- a/main/xf86-video-nv/APKBUILD
+++ b/main/xf86-video-nv/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-nv
 pkgver=2.1.17
-pkgrel=0
+pkgrel=1
 pkgdesc="Nvidia video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-openchrome/APKBUILD b/main/xf86-video-openchrome/APKBUILD
index f5b944c1..1268b756 100644
--- a/main/xf86-video-openchrome/APKBUILD
+++ b/main/xf86-video-openchrome/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-openchrome
 pkgver=0.2.904
-pkgrel=1
+pkgrel=2
 pkgdesc="X.Org driver for VIA/S3G cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-r128/APKBUILD b/main/xf86-video-r128/APKBUILD
index ffceb6ff..691331b7 100644
--- a/main/xf86-video-r128/APKBUILD
+++ b/main/xf86-video-r128/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-r128
 pkgver=6.8.1
-pkgrel=2
+pkgrel=3
 pkgdesc="ATI Rage128 video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-radeonhd/APKBUILD b/main/xf86-video-radeonhd/APKBUILD
index ebdba8c5..546512c0 100644
--- a/main/xf86-video-radeonhd/APKBUILD
+++ b/main/xf86-video-radeonhd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-radeonhd
 pkgver=1.3.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Experimental Radeon HD video driver."
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-rendition/APKBUILD b/main/xf86-video-rendition/APKBUILD
index 67228824..19123364 100644
--- a/main/xf86-video-rendition/APKBUILD
+++ b/main/xf86-video-rendition/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-rendition
 pkgver=4.2.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Rendition video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-s3/APKBUILD b/main/xf86-video-s3/APKBUILD
index 03f54d23..bb48034b 100644
--- a/main/xf86-video-s3/APKBUILD
+++ b/main/xf86-video-s3/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-s3
 pkgver=0.6.3
-pkgrel=1
+pkgrel=2
 pkgdesc="X.Org driver for s3 cards"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-s3virge/APKBUILD b/main/xf86-video-s3virge/APKBUILD
index f00b0a41..e2a62b3c 100644
--- a/main/xf86-video-s3virge/APKBUILD
+++ b/main/xf86-video-s3virge/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-s3virge
 pkgver=1.10.4
-pkgrel=0
+pkgrel=1
 pkgdesc="S3 ViRGE video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-savage/APKBUILD b/main/xf86-video-savage/APKBUILD
index e9a6d740..6572053d 100644
--- a/main/xf86-video-savage/APKBUILD
+++ b/main/xf86-video-savage/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-savage
 pkgver=2.3.1
-pkgrel=1
+pkgrel=2
 pkgdesc="S3 Savage video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-siliconmotion/APKBUILD b/main/xf86-video-siliconmotion/APKBUILD
index 52d91be1..280c1c39 100644
--- a/main/xf86-video-siliconmotion/APKBUILD
+++ b/main/xf86-video-siliconmotion/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-siliconmotion
 pkgver=1.7.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Silicon Motion video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-sis/APKBUILD b/main/xf86-video-sis/APKBUILD
index ad3589a3..73489778 100644
--- a/main/xf86-video-sis/APKBUILD
+++ b/main/xf86-video-sis/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-sis
 pkgver=0.10.2
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org SiS video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-sunffb/APKBUILD b/main/xf86-video-sunffb/APKBUILD
index e6a566d1..00341541 100644
--- a/main/xf86-video-sunffb/APKBUILD
+++ b/main/xf86-video-sunffb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-sunffb
 pkgver=1.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="SUNFFB video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-sunleo/APKBUILD b/main/xf86-video-sunleo/APKBUILD
index b6898904..ac930235 100644
--- a/main/xf86-video-sunleo/APKBUILD
+++ b/main/xf86-video-sunleo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-sunleo
 pkgver=1.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Leo video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-tdfx/APKBUILD b/main/xf86-video-tdfx/APKBUILD
index 2da071fd..68049189 100644
--- a/main/xf86-video-tdfx/APKBUILD
+++ b/main/xf86-video-tdfx/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-tdfx
 pkgver=1.4.3
-pkgrel=1
+pkgrel=2
 pkgdesc="3Dfx video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-tseng/APKBUILD b/main/xf86-video-tseng/APKBUILD
index c924a7c3..288636a6 100644
--- a/main/xf86-video-tseng/APKBUILD
+++ b/main/xf86-video-tseng/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-tseng
 pkgver=1.2.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Tseng Labs video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-v4l/APKBUILD b/main/xf86-video-v4l/APKBUILD
index 42c658b3..4be24ebe 100644
--- a/main/xf86-video-v4l/APKBUILD
+++ b/main/xf86-video-v4l/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-v4l
 pkgver=0.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="video4linux driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-vesa/APKBUILD b/main/xf86-video-vesa/APKBUILD
index 8eed0bb1..b73c82ff 100644
--- a/main/xf86-video-vesa/APKBUILD
+++ b/main/xf86-video-vesa/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-vesa
 pkgver=2.3.0
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org vesa video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xf86-video-vmware/APKBUILD b/main/xf86-video-vmware/APKBUILD
index 8bba4f31..e01ed349 100644
--- a/main/xf86-video-vmware/APKBUILD
+++ b/main/xf86-video-vmware/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-vmware
 pkgver=11.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="X.org VMWare video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xfce-utils/APKBUILD b/main/xfce-utils/APKBUILD
index c702096d..600ee7fb 100644
--- a/main/xfce-utils/APKBUILD
+++ b/main/xfce-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce-utils
 pkgver=4.6.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Utilities for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
diff --git a/main/xfce4-appfinder/APKBUILD b/main/xfce4-appfinder/APKBUILD
index 6f9f6a19..64238984 100644
--- a/main/xfce4-appfinder/APKBUILD
+++ b/main/xfce4-appfinder/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-appfinder
 pkgver=4.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Xfce application finder"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xfce4-battery-plugin/APKBUILD b/main/xfce4-battery-plugin/APKBUILD
index c0b271cf..b18f5b3c 100644
--- a/main/xfce4-battery-plugin/APKBUILD
+++ b/main/xfce4-battery-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-battery-plugin
 pkgver=0.5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A battery monitor plugin for the Xfce panel"
 url="http://goodies.xfce.org/projects/panel-plugins/xfce4-battery-plugin"
 license="GPL-2"
diff --git a/main/xfce4-cpufreq-plugin/APKBUILD b/main/xfce4-cpufreq-plugin/APKBUILD
index 4f134440..344fdb2a 100644
--- a/main/xfce4-cpufreq-plugin/APKBUILD
+++ b/main/xfce4-cpufreq-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-cpufreq-plugin
 pkgver=0.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="CPU frequency plugin for the Xfce4 panel"
 url="http://goodies.xfce.org/projects/panel-plugins/xfce4-cpufreq-plugin"
 license="GPL2"
diff --git a/main/xfce4-mixer/APKBUILD b/main/xfce4-mixer/APKBUILD
index 1541cb92..b68c6fa1 100644
--- a/main/xfce4-mixer/APKBUILD
+++ b/main/xfce4-mixer/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-mixer
 pkgver=4.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="The volume control plugin for the Xfce panel"
 url="http://www.xfce.org/"
 license="GPL2"
diff --git a/main/xfce4-notifyd/APKBUILD b/main/xfce4-notifyd/APKBUILD
index 717b6847..e708fc3f 100644
--- a/main/xfce4-notifyd/APKBUILD
+++ b/main/xfce4-notifyd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-notifyd
 pkgver=0.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="notification daemon for the xfce desktop"
 url="http://spuriousinterrupt.org/projects/xfce4-notifyd"
 license="GPL2"
diff --git a/main/xfce4-panel/APKBUILD b/main/xfce4-panel/APKBUILD
index ba867f7f..deac0568 100644
--- a/main/xfce4-panel/APKBUILD
+++ b/main/xfce4-panel/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-panel
 pkgver=4.6.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Panel for the Xfce desktop environment"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xfce4-screenshooter/APKBUILD b/main/xfce4-screenshooter/APKBUILD
index cde73790..bd646537 100644
--- a/main/xfce4-screenshooter/APKBUILD
+++ b/main/xfce4-screenshooter/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-screenshooter
 pkgver=1.6.0
-pkgrel=0
+pkgrel=1
 pkgdesc="screenshot application for Xfce4"
 url="http://goodies.xfce.org/projects/applications/xfce4-screenshooter"
 license="GPL2"
diff --git a/main/xfce4-session/APKBUILD b/main/xfce4-session/APKBUILD
index 21fe3452..8eb92efd 100644
--- a/main/xfce4-session/APKBUILD
+++ b/main/xfce4-session/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-session
 pkgver=4.6.1
-pkgrel=2
+pkgrel=3
 pkgdesc="A session manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
diff --git a/main/xfce4-settings/APKBUILD b/main/xfce4-settings/APKBUILD
index ffc6ec03..b6272802 100644
--- a/main/xfce4-settings/APKBUILD
+++ b/main/xfce4-settings/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-settings
 pkgver=4.6.4
-pkgrel=1
+pkgrel=2
 pkgdesc="Settings manager for xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xfce4-taskmanager/APKBUILD b/main/xfce4-taskmanager/APKBUILD
index 039ca22d..946e59ad 100644
--- a/main/xfce4-taskmanager/APKBUILD
+++ b/main/xfce4-taskmanager/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-taskmanager
 pkgver=0.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="a simple taskmanager for the Xfce Desktop Environment"
 url="http://goodies.xfce.org/projects/applications/xfce4-taskmanager"
 license="GPL-2"
diff --git a/main/xfce4-wavelan-plugin/APKBUILD b/main/xfce4-wavelan-plugin/APKBUILD
index 27176f01..108d7438 100644
--- a/main/xfce4-wavelan-plugin/APKBUILD
+++ b/main/xfce4-wavelan-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-wavelan-plugin
 pkgver=0.5.5
-pkgrel=0
+pkgrel=1
 pkgdesc="plugin to monitor wifi connectivity for the Xfce4 panel"
 url="http://goodies.xfce.org/projects/panel-plugins/xfce4-wavelan-plugin/"
 license="custom"
diff --git a/main/xfce4-xkb-plugin/APKBUILD b/main/xfce4-xkb-plugin/APKBUILD
index 7b590a16..b69cb070 100644
--- a/main/xfce4-xkb-plugin/APKBUILD
+++ b/main/xfce4-xkb-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-xkb-plugin
 pkgver=0.5.3.3
-pkgrel=2
+pkgrel=3
 pkgdesc="plugin to switch keyboard layouts for the Xfce4 panel"
 url="http://goodies.xfce.org/projects/panel-plugins/xfce4-xkb-plugin"
 license="custom"
diff --git a/main/xfconf/APKBUILD b/main/xfconf/APKBUILD
index f84906ba..c267f24d 100644
--- a/main/xfconf/APKBUILD
+++ b/main/xfconf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfconf
 pkgver=4.6.1
-pkgrel=1
+pkgrel=2
 pkgdesc="xfconf.. thingie"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xfdesktop/APKBUILD b/main/xfdesktop/APKBUILD
index 9634c085..f0a66cc0 100644
--- a/main/xfdesktop/APKBUILD
+++ b/main/xfdesktop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfdesktop
 pkgver=4.6.1
-pkgrel=2
+pkgrel=3
 pkgdesc="A desktop manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xfprint/APKBUILD b/main/xfprint/APKBUILD
index f09202ab..80c06f5b 100644
--- a/main/xfprint/APKBUILD
+++ b/main/xfprint/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfprint
 pkgver=4.6.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A print dialog and a printer manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
diff --git a/main/xfsprogs/APKBUILD b/main/xfsprogs/APKBUILD
index 638c4b72..83749d63 100644
--- a/main/xfsprogs/APKBUILD
+++ b/main/xfsprogs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfsprogs
 pkgver=3.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="XFS filesystem utilities"
 url="http://oss.sgi.com/projects/xfs/"
 license="LGPL"
diff --git a/main/xfwm4/APKBUILD b/main/xfwm4/APKBUILD
index 5f90698e..9ca4fa56 100644
--- a/main/xfwm4/APKBUILD
+++ b/main/xfwm4/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfwm4
 pkgver=4.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Xfce window manager, compatible with Gnome, Gnome2, KDE2, and KDE3"
 url="http://www.xfce.org/"
 license="GPL-2"
diff --git a/main/xgamma/APKBUILD b/main/xgamma/APKBUILD
index a980fcf4..920d2c8b 100644
--- a/main/xgamma/APKBUILD
+++ b/main/xgamma/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xgamma
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Alter a monitor's gamma correction through the X server"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xhost/APKBUILD b/main/xhost/APKBUILD
index eb4989ed..e1c2b658 100644
--- a/main/xhost/APKBUILD
+++ b/main/xhost/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xhost
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Controls host and/or user access to a running X server."
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xinit/APKBUILD b/main/xinit/APKBUILD
index be135ed7..86eb500e 100644
--- a/main/xinit/APKBUILD
+++ b/main/xinit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xinit
 pkgver=1.1.1
-pkgrel=3
+pkgrel=4
 pkgdesc="X.Org initialisation program "
 url="http://xorg.freedesktop.org/"
 license="GPL"
diff --git a/main/xkbcomp/APKBUILD b/main/xkbcomp/APKBUILD
index 13a7fd3e..c3eb7b47 100644
--- a/main/xkbcomp/APKBUILD
+++ b/main/xkbcomp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xkbcomp
 pkgver=1.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="compile XKB keyboard description"
 url="http://xorg.freedesktop.org"
 license="custom"
diff --git a/main/xmodmap/APKBUILD b/main/xmodmap/APKBUILD
index 87d0d4ba..35f0b361 100644
--- a/main/xmodmap/APKBUILD
+++ b/main/xmodmap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xmodmap
 pkgver=1.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="utility for modifying keymaps and pointer button mappings in X"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xorg-server/APKBUILD b/main/xorg-server/APKBUILD
index b62bbca1..069f4880 100644
--- a/main/xorg-server/APKBUILD
+++ b/main/xorg-server/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xorg-server
 pkgver=1.7.6
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org X servers"
 url="http://xorg.freedesktop.org"
 license="custom"
diff --git a/main/xrandr/APKBUILD b/main/xrandr/APKBUILD
index fefa3aa8..c52fea1a 100644
--- a/main/xrandr/APKBUILD
+++ b/main/xrandr/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xrandr
 pkgver=1.3.2
-pkgrel=0
+pkgrel=1
 pkgdesc="primitive command line interface to RandR extension"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xrdb/APKBUILD b/main/xrdb/APKBUILD
index 271fdb29..0ea72ca8 100644
--- a/main/xrdb/APKBUILD
+++ b/main/xrdb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xrdb
 pkgver=1.0.6
-pkgrel=0
+pkgrel=1
 pkgdesc="X server resource database utility"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xrefresh/APKBUILD b/main/xrefresh/APKBUILD
index f82d4062..83426fc6 100644
--- a/main/xrefresh/APKBUILD
+++ b/main/xrefresh/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xrefresh
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="refresh all or part of an X screen"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xset/APKBUILD b/main/xset/APKBUILD
index 2a46871d..975c6379 100644
--- a/main/xset/APKBUILD
+++ b/main/xset/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xset
 pkgver=1.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org xset application"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xsetmode/APKBUILD b/main/xsetmode/APKBUILD
index 13e8fd3e..3bac795b 100644
--- a/main/xsetmode/APKBUILD
+++ b/main/xsetmode/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xsetmode
 pkgver=1.0.0
-pkgrel=1
+pkgrel=2
 pkgdesc="set the mode for an X Input device"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xsetroot/APKBUILD b/main/xsetroot/APKBUILD
index cfcdb26b..8bd60aa1 100644
--- a/main/xsetroot/APKBUILD
+++ b/main/xsetroot/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xsetroot
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="X.Org xsetroot application"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/xtables-addons/APKBUILD b/main/xtables-addons/APKBUILD
index d31d7036..46ae1bb2 100644
--- a/main/xtables-addons/APKBUILD
+++ b/main/xtables-addons/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xtables-addons
 pkgver=1.21
-pkgrel=1
+pkgrel=2
 pkgdesc="Netfilter userspace extensions for iptables"
 url="http://xtables-addons.sourceforge.net/"
 license="GPL"
diff --git a/main/xvidcore/APKBUILD b/main/xvidcore/APKBUILD
index 20a071cc..6076bfac 100644
--- a/main/xvidcore/APKBUILD
+++ b/main/xvidcore/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xvidcore
 pkgver=1.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="XviD is an open source MPEG-4 video codec"
 url="http://www.xvid.org/"
 license="GPL"
diff --git a/main/xvinfo/APKBUILD b/main/xvinfo/APKBUILD
index 7edd4d03..71ad0740 100644
--- a/main/xvinfo/APKBUILD
+++ b/main/xvinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xvinfo
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Print out X-Video extension adaptor information"
 url="http://xorg.freedesktop.org/"
 license="custom"
diff --git a/main/yasm/APKBUILD b/main/yasm/APKBUILD
index a0975f41..f024570a 100644
--- a/main/yasm/APKBUILD
+++ b/main/yasm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=yasm
 pkgver=0.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A rewrite of NASM to allow for multiple syntax supported (NASM, TASM, GAS, etc.)"
 url="http://www.tortall.net/projects/yasm/"
 license="custom"
diff --git a/main/zip/APKBUILD b/main/zip/APKBUILD
index 426a6d4c..6733e61e 100644
--- a/main/zip/APKBUILD
+++ b/main/zip/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=zip
 pkgver=3.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Creates PKZIP-compatible .zip files"
 url="http://www.info-zip.org/pub/infozip/Zip.html"
 license="AS IS"
diff --git a/main/zlib/APKBUILD b/main/zlib/APKBUILD
index adf584ea..795fbc6b 100644
--- a/main/zlib/APKBUILD
+++ b/main/zlib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=zlib
 pkgver=1.2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A compression/decompression Library"
 license=custom:zlib
 url="http://zlib.net"
diff --git a/main/zonenotify/APKBUILD b/main/zonenotify/APKBUILD
index b76718e3..b442458d 100644
--- a/main/zonenotify/APKBUILD
+++ b/main/zonenotify/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=zonenotify
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Utility to send NS_NOTIFY packets to slave DNS servers"
 arch=""
 url="http://www.morettoni.net/zonenotify.en.html"
diff --git a/main/zsnes/APKBUILD b/main/zsnes/APKBUILD
index 2dcb1bd6..04a44516 100644
--- a/main/zsnes/APKBUILD
+++ b/main/zsnes/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=zsnes
 pkgver=1.51
-pkgrel=1
+pkgrel=2
 pkgdesc="Super Nintendo emulator"
 url="http://www.zsnes.com/"
 license="GPL"
-- 
cgit v1.2.3


From f7a1c436a63a390aa7865e06cc31eef333d95d45 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 08:39:05 +0000
Subject: main/abuild: upgrade to 2.2

---
 main/abuild/APKBUILD | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/main/abuild/APKBUILD b/main/abuild/APKBUILD
index ec01a0fa..db457836 100644
--- a/main/abuild/APKBUILD
+++ b/main/abuild/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgdesc="Script to build Alpine Packages"
 pkgname=abuild
-pkgver=2.1
-pkgrel=1
+pkgver=2.2
+pkgrel=0
 url=http://git.alpinelinux.org/cgit/abuild/
 source="http://git.alpinelinux.org/cgit/abuild/snapshot/abuild-$pkgver.tar.bz2
 	"
@@ -12,10 +12,13 @@ license=GPL-2
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-
 	make
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make install DESTDIR="$pkgdir"
 	install -m 644 abuild.conf "$pkgdir"/etc/abuild.conf
 }
 
-md5sums="2268fa6147c8088139ef136184cd2ae0  abuild-2.1.tar.bz2"
+md5sums="d5f6d5c9df7c7d00e2a26b245b37227d  abuild-2.2.tar.bz2"
-- 
cgit v1.2.3


From 0c75756a0b3bd05687dc2a6a05a3ce71af758d01 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 09:40:55 +0000
Subject: main/mpfr: dont depend on gcc

It creates circular dependency
---
 main/mpfr/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/mpfr/APKBUILD b/main/mpfr/APKBUILD
index 442a89b6..92367632 100644
--- a/main/mpfr/APKBUILD
+++ b/main/mpfr/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="multiple-precision floating-point library"
 url="http://www.mpfr.org/"
 license="GPL LGPL"
 depends=
-makedepends="gcc>=4.4.2 gmp-dev texinfo"
+makedepends="gmp-dev texinfo"
 source="http://www.mpfr.org/mpfr-current/mpfr-$pkgver.tar.bz2"
 subpackages="$pkgname-doc $pkgname-dev"
 
-- 
cgit v1.2.3


From 6d8633ca413095aeddceb7e4802a6d7724e92f8c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 10:44:59 +0000
Subject: main/libxcb: remove versioned dep

abuild does not handle it yet
---
 main/libxcb/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD
index d8e5ac95..d1275f04 100644
--- a/main/libxcb/APKBUILD
+++ b/main/libxcb/APKBUILD
@@ -5,7 +5,7 @@ pkgrel=1
 pkgdesc="X11 client-side library"
 url="http://xcb.freedesktop.org/"
 license="custom"
-depends="xcb-proto>=1.6"
+depends="xcb-proto"
 subpackages="$pkgname-dev $pkgname-doc"
 makedepends="libxdmcp-dev libxau-dev libxslt libpthread-stubs pkgconfig python"
 source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2
-- 
cgit v1.2.3


From e54eeddbe2b67353779d48f8b05381e9f8eb9d2e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 11:20:29 +0000
Subject: main/libc0.9.32: build fix

need run pregen without parallel first

also cleaned up some leftovers from cross tools testing
---
 main/libc0.9.32/APKBUILD | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 253a7318..7ef67dd2 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -55,8 +55,9 @@ build() {
 		_kh=KERNEL_HEADERS="$SYSROOT/include"
 	fi
 	cp "$_config" .config
-	sleep 1
 	make silentoldconfig
+	make -j1 pregen KERNEL_HEADERS="$SYSROOT"/usr/include \
+		CROSS="$CROSS" || return 1
 	make all KERNEL_HEADERS="$SYSROOT/usr/include"  CROSS="$CROSS" || return 1
 	make utils CROSS="$CROSS" || return 1
 }
@@ -65,9 +66,9 @@ package() {
 	cd "$_builddir"
 	make DESTDIR="$pkgdir" KERNEL_HEADERS="$SYSROOT/usr/include" \
 		CROSS="$CROSS" install install_utils
-	install -Dm755 extra/scripts/getent "$_p"/usr/bin/getent
+	install -Dm755 extra/scripts/getent "$pkgdir"/usr/bin/getent
 	# provided by linux-headers
-	rm -f "$_p"/usr/include/scsi/scsi.h
+	rm -f "$ppkgdir"/usr/include/scsi/scsi.h
 }
 
 dev() {
-- 
cgit v1.2.3


From 3b608127d4e7e8be4c6adc919ab271580deeb300 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 11:24:37 +0000
Subject: main/alpine-sdk,binutils,build-base,libdnet,transmission,v86d: set
 pkgrel

---
 main/alpine-sdk/APKBUILD   | 1 +
 main/binutils/APKBUILD     | 1 +
 main/build-base/APKBUILD   | 1 +
 main/libdnet/APKBUILD      | 5 +++++
 main/transmission/APKBUILD | 6 +++++-
 main/v86d/APKBUILD         | 5 +++++
 6 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/main/alpine-sdk/APKBUILD b/main/alpine-sdk/APKBUILD
index 587f1785..1b6d79cb 100644
--- a/main/alpine-sdk/APKBUILD
+++ b/main/alpine-sdk/APKBUILD
@@ -1,6 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alpine-sdk
 pkgver=0.3
+pkgrel=0
 url=http://dev.alpinelinux.org/cgit
 pkgdesc="Alpine Software Development Kit meta package"
 depends="abuild build-base git cramfs cdrkit acct mkinitfs mtools"
diff --git a/main/binutils/APKBUILD b/main/binutils/APKBUILD
index 1a2fbf5d..a2c95263 100644
--- a/main/binutils/APKBUILD
+++ b/main/binutils/APKBUILD
@@ -1,6 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=binutils
 pkgver=2.20.51.0.4
+pkgrel=1
 pkgdesc="Tools necessary to build programs"
 url=http://sources.redhat.com/binutils
 source="http://ftp.kernel.org/pub/linux/devel/binutils/$pkgname-$pkgver.tar.bz2"
diff --git a/main/build-base/APKBUILD b/main/build-base/APKBUILD
index 32c4e93b..59e1f2ee 100644
--- a/main/build-base/APKBUILD
+++ b/main/build-base/APKBUILD
@@ -1,6 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=build-base
 pkgver=0.2
+pkgrel=0
 url=http://dev.alpinelinux.org/cgit
 pkgdesc="Meta package for build base"
 depends="binutils gcc make patch uclibc-dev g++"
diff --git a/main/libdnet/APKBUILD b/main/libdnet/APKBUILD
index 8544bb90..881accbd 100644
--- a/main/libdnet/APKBUILD
+++ b/main/libdnet/APKBUILD
@@ -1,6 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libdnet
 pkgver=1.12
+pkgrel=1
 pkgdesc="A simplified, portable interface to several low-level networking routines"
 url="http://code.google.com/p/libdnet/"
 license="BSD"
@@ -22,6 +23,10 @@ build ()
 		--without-python
 
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
 md5sums="9253ef6de1b5e28e9c9a62b882e44cc9  libdnet-1.12.tgz"
diff --git a/main/transmission/APKBUILD b/main/transmission/APKBUILD
index 7bd64c5e..9cd4f2dc 100644
--- a/main/transmission/APKBUILD
+++ b/main/transmission/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer:Carlo Landmeter
 pkgname=transmission
 pkgver=1.74
-pkgel=1
+pkgrel=1
 pkgdesc="Lightweight GTK BitTorrent client"
 url="http://www.tansmissionbt.com"
 install="$pkgname.pre-install"
@@ -20,6 +20,10 @@ build() {
         ./configure --prefix=/usr \
 		--mandir=/usr/share/man 
         make || return 1
+}
+
+package() {
+        cd "$srcdir/$pkgname-$pkgver"
         make DESTDIR="$pkgdir" install
 }
 
diff --git a/main/v86d/APKBUILD b/main/v86d/APKBUILD
index 626fc295..95f72699 100644
--- a/main/v86d/APKBUILD
+++ b/main/v86d/APKBUILD
@@ -1,6 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=v86d
 pkgver=0.1.9
+pkgrel=1
 pkgdesc="userspace helper for uvesafb that runs x86 code in an emulated environment"
 url="http://dev.gentoo.org/~spock/projects/uvesafb/"
 license="GPL2"
@@ -14,6 +15,10 @@ build ()
 	cd "$srcdir"/v86d-$pkgver
 	./configure --with-x86emu
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/v86d-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 	install -D -m644 "$srcdir"/modprobe.uvesafb "$pkgdir"/etc/modprobe.d/uvesafb || return 1
 }
-- 
cgit v1.2.3


From 02c160b0d8c83687f266b2502620c8e447e9f2b2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 11:44:28 +0000
Subject: main/libpthread-stubs: bump pkgrel

---
 main/libpthread-stubs/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/libpthread-stubs/APKBUILD b/main/libpthread-stubs/APKBUILD
index 7ca630b4..843e4795 100644
--- a/main/libpthread-stubs/APKBUILD
+++ b/main/libpthread-stubs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libpthread-stubs
 pkgver=0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Pthread functions stubs for platforms missing them"
 url="http://cgit.freedesktop.org/xcb/pthread-stubs"
 license="X11"
-- 
cgit v1.2.3


From 0589c447232eb262d5563a7eb825d227b47d9eba Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:02:29 +0000
Subject: main/alpine-base: we need uclibc-utils in base install

It used to be provided by uclibc package
---
 main/alpine-base/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/alpine-base/APKBUILD b/main/alpine-base/APKBUILD
index b4eeefa3..36e96a1f 100644
--- a/main/alpine-base/APKBUILD
+++ b/main/alpine-base/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alpine-base
 pkgver=2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Meta package for minimal alpine base"
 url="http://alpinelinux.org"
 license="GPL"
 depends="alpine-baselayout alpine-conf apk-tools busybox busybox-initscripts
-	openrc"
+	openrc uclibc-utils"
 makedepends=
 install=
 subpackages=
-- 
cgit v1.2.3


From 67a1163c06785861dd7abdad151c6c1ab55410d5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:21:02 +0000
Subject: main/zlib: upgrade to 1.2.5

---
 main/zlib/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/zlib/APKBUILD b/main/zlib/APKBUILD
index 795fbc6b..1f4465a9 100644
--- a/main/zlib/APKBUILD
+++ b/main/zlib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=zlib
-pkgver=1.2.4
-pkgrel=1
+pkgver=1.2.5
+pkgrel=0
 pkgdesc="A compression/decompression Library"
 license=custom:zlib
 url="http://zlib.net"
@@ -31,4 +31,4 @@ dev() {
 	mv "$pkgdir"/lib/libz.a "$subpkgdir"/lib/libz.a
 }
 
-md5sums="47f6ed51b3c83a8534f9228531effa18  zlib-1.2.4.tar.gz"
+md5sums="c735eab2d659a96e5a594c9e8541ad63  zlib-1.2.5.tar.gz"
-- 
cgit v1.2.3


From 2251be06a14251c0acda58a3c7dd4f00a007b10e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:22:32 +0000
Subject: main/pixman: upgrade to 0.18.0

---
 main/pixman/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/pixman/APKBUILD b/main/pixman/APKBUILD
index 2e3e01bd..629130de 100644
--- a/main/pixman/APKBUILD
+++ b/main/pixman/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pixman
-pkgver=0.16.6
-pkgrel=1
+pkgver=0.18.0
+pkgrel=0
 pkgdesc="Pixman library"
 url="http://xorg.freedesktop.org"
 license="custom"
@@ -21,4 +21,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="fbd6ee9cb09d0b26281557bc7afcb3ab  pixman-0.16.6.tar.bz2"
+md5sums="a1b5a0a145cab653f5c1e8cf2f98f945  pixman-0.18.0.tar.bz2"
-- 
cgit v1.2.3


From c97181c8a5ac8bff5956ab0de13b04b5ceec8284 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:30:09 +0000
Subject: main/alsa-lib: upgrade to 1.0.23

---
 main/alsa-lib/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/alsa-lib/APKBUILD b/main/alsa-lib/APKBUILD
index ab2f6c0a..ded73194 100644
--- a/main/alsa-lib/APKBUILD
+++ b/main/alsa-lib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alsa-lib
-pkgver=1.0.22
-pkgrel=1
+pkgver=1.0.23
+pkgrel=0
 pkgdesc="An alternative implementation of Linux sound support"
 url="http://www.alsa-project.org"
 license="GPL"
@@ -27,4 +27,4 @@ package() {
 	cd "$srcdir/$pkgname-$pkgver"
 	make -j1 DESTDIR="$pkgdir" install
 }
-md5sums="b28a12348905fb6915bc41f0edb2ecce  alsa-lib-1.0.22.tar.bz2"
+md5sums="f48b50421d8a69d2d806d9c47e534f0d  alsa-lib-1.0.23.tar.bz2"
-- 
cgit v1.2.3


From 30c3c47d1a4a6f091c2fdc5bb045ce2e174d59b4 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:30:45 +0000
Subject: main/git: upgrade to 1.7.1

---
 main/git/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/git/APKBUILD b/main/git/APKBUILD
index 1b1b4e55..728fd7b1 100644
--- a/main/git/APKBUILD
+++ b/main/git/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=git
-pkgver=1.7.0.5
-pkgrel=1
+pkgver=1.7.1
+pkgrel=0
 pkgdesc="GIT - the stupid content tracker"
 url="http://git.or.cz/"
 license="GPL2"
@@ -42,5 +42,5 @@ perl() {
 }
 
 
-md5sums="77d50f41ef282752dc69d9a47765f5c7  git-1.7.0.5.tar.bz2
+md5sums="3da231dbe82ad103373cb530ae7475d5  git-1.7.1.tar.bz2
 e63a201556c4f089de790805c09a2e5b  bb-tar.patch"
-- 
cgit v1.2.3


From 0deb86482f2de8cb217ff9dc2362d4c76124732b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 12:31:07 +0000
Subject: main/strace: upgrade to 4.5.20

---
 main/strace/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/strace/APKBUILD b/main/strace/APKBUILD
index 531058cf..aed2236e 100644
--- a/main/strace/APKBUILD
+++ b/main/strace/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=strace
-pkgver=4.5.19
-pkgrel=2
+pkgver=4.5.20
+pkgrel=0
 pkgdesc="A useful diagnositic, instructional, and debugging tool"
 url="http://sourceforge.net/projects/strace/"
 license="BSD"
@@ -25,4 +25,4 @@ package() {
 	cd "$srcdir/$pkgname-$pkgver"
 	make -j1 DESTDIR="$pkgdir" install
 }
-md5sums="2415e435d61e40315a298c80aced0cda  strace-4.5.19.tar.bz2"
+md5sums="64dfe10d9db0c1e34030891695ffca4b  strace-4.5.20.tar.bz2"
-- 
cgit v1.2.3


From 1f083b9704a5711391c1815412242dec48b2d938 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:35:35 +0000
Subject: main/b43-fwcutter: upgrade to 013

---
 main/b43-fwcutter/APKBUILD | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/main/b43-fwcutter/APKBUILD b/main/b43-fwcutter/APKBUILD
index 3be0da6f..6b92c22f 100644
--- a/main/b43-fwcutter/APKBUILD
+++ b/main/b43-fwcutter/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Natanael Copa <ncopa@alpinelinux.org>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=b43-fwcutter
-pkgver=012
-pkgrel=1
+pkgver=013
+pkgrel=0
 pkgdesc="Tool to extract firmware from Broadcom drivers"
 url="http://linuxwireless.org/en/users/Drivers/b43"
 license="GPL"
@@ -10,15 +10,18 @@ depends=""
 makedepends=""
 install=
 subpackages="$pkgname-doc"
-source="http://bu3sch.de/b43/fwcutter/b43-fwcutter-012.tar.bz2"
+source="http://bu3sch.de/b43/fwcutter/b43-fwcutter-$pkgver.tar.bz2"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make PREFIX="$pkgdir"/usr install
 	mkdir -p "$pkgdir"/usr/share/
 	mv "$pkgdir"/usr/man "$pkgdir"/usr/share/
 }
 
-md5sums="69eadf67b459f313a8d6b37aaabef96c  b43-fwcutter-012.tar.bz2"
+md5sums="3547ec6c474ac1bc2c4a5bb765b791a4  b43-fwcutter-013.tar.bz2"
-- 
cgit v1.2.3


From 51297e26377f2367b34ae7e4bdd8f3f94fbf9e05 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:38:11 +0000
Subject: main/coreutils: upgrade to 8.5

---
 main/coreutils/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/coreutils/APKBUILD b/main/coreutils/APKBUILD
index 2580776a..7ffc0666 100644
--- a/main/coreutils/APKBUILD
+++ b/main/coreutils/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Michael Mason <ms13sp@gmail.com> 
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=coreutils
-pkgver=8.4
-pkgrel=2
+pkgver=8.5
+pkgrel=0
 pkgdesc="The basic file, shell and text manipulation utilities"
 url="http://www.gnu.org/software/coreutils/"
 license="GPL"
@@ -28,4 +28,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="56f549854d723d9dcebb77919019df55  coreutils-8.4.tar.gz"
+md5sums="c1ffe586d001e87d66cd80c4536ee823  coreutils-8.5.tar.gz"
-- 
cgit v1.2.3


From 59bc7ecf73115652b423e43eb522d4e546c4c737 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:43:57 +0000
Subject: main/aspell: dont use uclibc++

---
 main/aspell/APKBUILD | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/main/aspell/APKBUILD b/main/aspell/APKBUILD
index 5e1bf889..34cd720d 100644
--- a/main/aspell/APKBUILD
+++ b/main/aspell/APKBUILD
@@ -2,28 +2,29 @@
 pkgname=aspell
 pkgver=0.60.6
 _pkgmajorver=${pkgver%.*}
-pkgrel=1
+pkgrel=2
 pkgdesc="A spell checker designed to eventually replace Ispell"
 url="http://aspell.net/"
 license="LGPL"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="ncurses-dev uclibc++-dev perl"
+makedepends="ncurses-dev perl"
 install=
 source="ftp://ftp.gnu.org/gnu/$pkgname/$pkgname-$pkgver.tar.gz
 	libmath.patch"
 
-build () 
-{ 
+build() { 
 	cd "$srcdir"/$pkgname-$pkgver
-	export CXX=${CXX_UC:-g++-uc}
-
 	./configure --prefix=/usr || return 1
 
 	# we want add -lm to linker flag for libaspell so wil build that
 	# separately. this is just an ugly workaround
 	make libaspell.la LDFLAGS="$LDFLAGS -lm" || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 	ln -s $pkgname-${_pkgmajorver} "$pkgdir"/usr/lib/$pkgname || return 1
 }
-- 
cgit v1.2.3


From a158947b3a90fbb1280cc04347c8db44b6673944 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:47:39 +0000
Subject: main/beecrypt: dont use uclibc++

---
 main/beecrypt/APKBUILD | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/main/beecrypt/APKBUILD b/main/beecrypt/APKBUILD
index 11221c28..3b12e359 100644
--- a/main/beecrypt/APKBUILD
+++ b/main/beecrypt/APKBUILD
@@ -2,36 +2,41 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=beecrypt
 pkgver=4.1.2
-pkgrel=4
+pkgrel=5
 pkgdesc="general-purpose cryptography library"
 url="http://sourceforge.net/projects/beecrypt"
 license="LGPL"
 depends=
-makedepends="uclibc++-dev libtool m4"
+makedepends="libtool m4"
 
 subpackages="$pkgname-dev"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
 	$pkgname-4.1.2-base64.patch
 	"
 
-build() {
-	cd "$srcdir/$pkgname-$pkgver"
-	export CXX=${CXX_UC:-g++-uc}
-
+_builddir="$srcdir/$pkgname-$pkgver"
+prepare() {
+	cd "$_builddir"
 	for i in ../*.patch; do
 		msg "Applying $i..."
 		patch -p1 < $i || return 1
 	done
+}
 
+build() {
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
-		--disable-threads \
+		--enable-threads \
 		--enable-shared \
 		--without-java \
 		--without-python \
 		--with-cplusplus=no
-
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install
 }
 md5sums="820d26437843ab0a6a8a5151a73a657c  beecrypt-4.1.2.tar.gz
-- 
cgit v1.2.3


From 4b3e66f825b4b9771f5acde957e466812fe6948e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:49:57 +0000
Subject: main/faac: dont use uclibc++

---
 main/faac/APKBUILD | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/main/faac/APKBUILD b/main/faac/APKBUILD
index 772192f8..85a73079 100644
--- a/main/faac/APKBUILD
+++ b/main/faac/APKBUILD
@@ -1,22 +1,24 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=faac
 pkgver=1.28
-pkgrel=1
+pkgrel=2
 pkgdesc="FAAC is an AAC audio encoder."
 url="http://www.audiocoding.com/"
 license="GPL custom"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="autoconf automake libtool uclibc++-dev"
+makedepends="autoconf automake libtool"
 source="http://downloads.sourceforge.net/sourceforge/$pkgname/$pkgname-$pkgver.tar.gz"
 
-build () 
-{ 
+build() {
 	cd "$srcdir"/$pkgname-$pkgver
-	export CXX="${UC_CXX:-g++-uc}"
 	./bootstrap
 	./configure --prefix=/usr
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 	install -D -m644 "$srcdir"/$pkgname-$pkgver/libfaac/kiss_fft/COPYING \
 		"$pkgdir"/usr/share/licenses/faac/COPYING.kiss_fft
-- 
cgit v1.2.3


From 471b6e3881d15bb45958c560863f7bc1947e27f8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:52:59 +0000
Subject: main/icu: dont use uclibc++

---
 main/icu/APKBUILD | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/main/icu/APKBUILD b/main/icu/APKBUILD
index 5e2b3d97..2c3a05e9 100644
--- a/main/icu/APKBUILD
+++ b/main/icu/APKBUILD
@@ -2,20 +2,19 @@
 pkgname=icu
 pkgver=4.4
 _ver=4_2_1
-pkgrel=1
+pkgrel=2
 pkgdesc="International Components for Unicode library"
 url="http://www.icu-project.org/"
 license="custom:icu"
 subpackages="$pkgname-dev $pkgname-doc"
-depends=""
-makedepends="uclibc++-dev"
+depends=
+makedepends=
 source="http://download.icu-project.org/files/icu4c/${pkgver}/${pkgname}4c-$_ver-src.tgz"
 
 _builddir="$srcdir"/icu/source
 
 build() { 
 	cd "$_builddir"
-	export CXX=g++-uc
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man
-- 
cgit v1.2.3


From 4bc4206c2575501bf18ee6b9a2423a33c89cf0a0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 13:55:05 +0000
Subject: main/p7zip: dont use uclibc++

---
 main/p7zip/APKBUILD | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/main/p7zip/APKBUILD b/main/p7zip/APKBUILD
index 7ecd4bb6..19ecadb2 100644
--- a/main/p7zip/APKBUILD
+++ b/main/p7zip/APKBUILD
@@ -1,13 +1,13 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=p7zip
 pkgver=9.04
-pkgrel=1
+pkgrel=2
 pkgdesc="A command-line port of the 7zip compression utility"
 url="http://p7zip.sourceforge.net"
 license="GPL"
 subpackages="$pkgname-doc"
 depends=
-makedepends="bash uclibc++-dev"
+makedepends="bash"
 #install=p7zip.install
 source="http://downloads.sourceforge.net/sourceforge/$pkgname/${pkgname}_${pkgver}_src_all.tar.bz2
 	p7zip-cc-cxx.patch"
@@ -16,8 +16,6 @@ build() {
 	cd "$srcdir"/${pkgname}_${pkgver}
 	patch -p1 -i ../p7zip-cc-cxx.patch || return 1
 	sed -i "s|usr/local|usr|g" makefile
-	export CXX=${UC_CXX:-g++-uc}
-
 	make all3 OPTFLAGS="${CXXFLAGS}" || return 1
 }
 
-- 
cgit v1.2.3


From f9d0f6b879c4781e7311d2d355581bbc2c583f07 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:02:49 +0000
Subject: main/pjproject: upgrade to 1.6

---
 main/pjproject/APKBUILD | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/main/pjproject/APKBUILD b/main/pjproject/APKBUILD
index e44c9450..da43af73 100644
--- a/main/pjproject/APKBUILD
+++ b/main/pjproject/APKBUILD
@@ -1,21 +1,19 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pjproject
-pkgver=1.4
-pkgrel=1
+pkgver=1.6
+pkgrel=0
 pkgdesc="CLI Softphone"
 url="http://www.pjsip.org/pjsua.htm"
 license="GPL"
 depends=
-makedepends="uclibc++-dev openssl-dev pth-dev"
+makedepends="openssl-dev pth-dev"
 install=
 subpackages="$pkgname-dev pjsua"
 source="http://www.pjsip.org/release/$pkgver/$pkgname-$pkgver.tar.bz2"
 
 build() {
 	cd "$srcdir/$pkgname-$pkgver"
-	export CXX=${CXX_UC:-g++-uc}
-
 	./configure --build=${CHOST:-i486-alpine-linux-uclibc} \
 		--prefix=/usr \
 		--sysconfdir=/etc \
@@ -23,8 +21,11 @@ build() {
 		--infodir=/usr/share/info
 	make -j1 dep || return 1
 	make -j1 all || return 1
-	make -j1 DESTDIR="$pkgdir" prefix=/usr install
+}
 
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
+	make -j1 DESTDIR="$pkgdir" prefix=/usr install
 }
 
 pjsua() {
@@ -35,4 +36,4 @@ pjsua() {
 }
 		
 	
-md5sums="c5abd0d764d89788d817d449141e45a6  pjproject-1.4.tar.bz2"
+md5sums="8e804c4930a5ee98a7a0ed2619c09b44  pjproject-1.6.tar.bz2"
-- 
cgit v1.2.3


From f3994add52752ab3f0f1ea26aced0959f1f377ca Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:06:30 +0000
Subject: main/vim: upgrade to 7.2.411

---
 main/vim/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/vim/APKBUILD b/main/vim/APKBUILD
index 2d41bc1e..4ab3972f 100644
--- a/main/vim/APKBUILD
+++ b/main/vim/APKBUILD
@@ -2,8 +2,8 @@
 pkgname=vim
 _srcver=7.2
 _patchver=394
-pkgver=7.2.394
-pkgrel=1
+pkgver=7.2.411
+pkgrel=0
 pkgdesc="advanced text editor"
 url="http://www.vim.org"
 license='GPL'
-- 
cgit v1.2.3


From 6224fead063e0e0ebe4ab41b9285b9d0a10253f9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:09:02 +0000
Subject: main/neon: upgrade to 0.29.3

---
 main/neon/APKBUILD | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/main/neon/APKBUILD b/main/neon/APKBUILD
index 720f898b..9aaea2c7 100644
--- a/main/neon/APKBUILD
+++ b/main/neon/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=neon
-pkgver=0.28.6
-pkgrel=1
+pkgver=0.29.3
+pkgrel=0
 pkgdesc="HTTP and WebDAV client library with a C interface"
 url="http://www.webdav.org/neon/"
 license="GPL LGPL"
@@ -23,6 +23,10 @@ build () {
 		--disable-static \
 
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 }
-md5sums="252578ed555552b71d15909641484951  neon-0.28.6.tar.gz"
+md5sums="ba1015b59c112d44d7797b62fe7bee51  neon-0.29.3.tar.gz"
-- 
cgit v1.2.3


From d95f8000b48c83905223acd10fc5823ba95458c3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:19:12 +0000
Subject: main/libpcap: upgrade to 1.1.1

---
 main/libpcap/APKBUILD                    |  30 +++---
 main/libpcap/libpcap-1.0.0-LDFLAGS.patch |  13 ---
 main/libpcap/libpcap-any.patch           | 157 -------------------------------
 3 files changed, 16 insertions(+), 184 deletions(-)
 delete mode 100644 main/libpcap/libpcap-1.0.0-LDFLAGS.patch
 delete mode 100644 main/libpcap/libpcap-any.patch

diff --git a/main/libpcap/APKBUILD b/main/libpcap/APKBUILD
index 85a94622..4fc54bbc 100644
--- a/main/libpcap/APKBUILD
+++ b/main/libpcap/APKBUILD
@@ -1,34 +1,36 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libpcap
-pkgver=1.0.0
+pkgver=1.1.1
 _sover=1.0.0
-pkgrel=3
+pkgrel=0
 pkgdesc="A system-independent interface for user-level packet capture"
 url="http://www.tcpdump.org/"
 license="BSD"
 depends=
 makedepends="bison flex"
 source="http://www.tcpdump.org/release/$pkgname-$pkgver.tar.gz
-	$pkgname-1.0.0-LDFLAGS.patch
-	$pkgname-any.patch"
+	"
 subpackages="$pkgname-doc $pkgname-dev"
 
-build () 
-{ 
-	cd ${startdir}/src/${pkgname}-${pkgver}
-	for i in ../*.patch; do
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		[ -r "$i" ] || continue
 		msg "Applying $i..."
 		patch -p1 -i $i || return 1
 	done
+}
 
+build() {
+	cd "$_builddir"
 	./configure --prefix=/usr --enable-ipv6
-
 	make all shared || return 1
+}
+
+package() {
+	cd "$_builddir"
 	mkdir -p "$pkgdir/usr/bin"
 	make -j1 DESTDIR="$pkgdir" install install-shared
-	ln -s libpcap.so.$_sover "$pkgdir"/usr/lib/libpcap.so.1
-	ln -s libpcap.so.$_sover "$pkgdir"/usr/lib/libpcap.so
 }
-md5sums="9ad1358c5dec48456405eac197a46d3d  libpcap-1.0.0.tar.gz
-2bf7e986980c6e5d99758ba55b48d706  libpcap-1.0.0-LDFLAGS.patch
-1e6b01c4f283b497e81e137c3f35e744  libpcap-any.patch"
+md5sums="1bca27d206970badae248cfa471bbb47  libpcap-1.1.1.tar.gz"
diff --git a/main/libpcap/libpcap-1.0.0-LDFLAGS.patch b/main/libpcap/libpcap-1.0.0-LDFLAGS.patch
deleted file mode 100644
index b2fe8d6f..00000000
--- a/main/libpcap/libpcap-1.0.0-LDFLAGS.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-=== modified file 'Makefile.in'
---- a/Makefile.in	2008-11-04 18:53:20 +0000
-+++ b/Makefile.in	2008-11-04 18:53:49 +0000
-@@ -328,7 +328,7 @@
- #
- libpcap.so: $(OBJ)
- 	@rm -f $@
--	$(CC) -shared -Wl,-soname,$@.1 -o $@.`cat $(srcdir)/VERSION` $(OBJ) $(DAGLIBS)
-+	$(CC) -shared $(LDFLAGS) -Wl,-soname,$@.1 -o $@.`cat $(srcdir)/VERSION` $(OBJ) $(DAGLIBS)
- 
- #
- # The following rule succeeds, but the result is untested.
-
diff --git a/main/libpcap/libpcap-any.patch b/main/libpcap/libpcap-any.patch
deleted file mode 100644
index 7754513b..00000000
--- a/main/libpcap/libpcap-any.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-commit 8fa17a5a554aaeb85d3ec4118b45a31f1efd6808
-Author: guy <guy>
-Date:   Wed Nov 19 08:20:39 2008 +0000
-
-    Fix the handling of the "any" device, including making it reject
-    attempts to open it in monitor mode.
-
-diff --git a/pcap-linux.c b/pcap-linux.c
-index 2a92d30..b18c4d2 100644
---- a/pcap-linux.c
-+++ b/pcap-linux.c
-@@ -297,6 +297,12 @@ pcap_create(const char *device, char *ebuf)
- {
- 	pcap_t *handle;
- 
-+	/*
-+	 * A null device name is equivalent to the "any" device.
-+	 */
-+	if (device == NULL)
-+		device = "any";
-+
- #ifdef HAVE_DAG_API
- 	if (strstr(device, "dag")) {
- 		return dag_create(device, ebuf);
-@@ -338,10 +344,9 @@ pcap_can_set_rfmon_linux(pcap_t *p)
- 	struct iwreq ireq;
- #endif
- 
--	if (p->opt.source == NULL) {
-+	if (strcmp(p->opt.source, "any") == 0) {
- 		/*
--		 * This is equivalent to the "any" device, and we don't
--		 * support monitor mode on it.
-+		 * Monitor mode makes no sense on the "any" device.
- 		 */
- 		return 0;
- 	}
-@@ -518,12 +523,11 @@ pcap_activate_linux(pcap_t *handle)
- 	handle->stats_op = pcap_stats_linux;
- 
- 	/*
--	 * NULL and "any" are special devices which give us the hint to
--	 * monitor all devices.
-+	 * The "any" device is a special device which causes us not
-+	 * to bind to a particular device and thus to look at all
-+	 * devices.
- 	 */
--	if (!device || strcmp(device, "any") == 0) {
--		device			= NULL;
--		handle->md.device	= strdup("any");
-+	if (strcmp(device, "any") == 0) {
- 		if (handle->opt.promisc) {
- 			handle->opt.promisc = 0;
- 			/* Just a warning. */
-@@ -531,10 +535,9 @@ pcap_activate_linux(pcap_t *handle)
- 			    "Promiscuous mode not supported on the \"any\" device");
- 			status = PCAP_WARNING_PROMISC_NOTSUP;
- 		}
-+	}
- 
--	} else
--		handle->md.device	= strdup(device);
--
-+	handle->md.device	= strdup(device);
- 	if (handle->md.device == NULL) {
- 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
- 			 pcap_strerror(errno) );
-@@ -1657,19 +1660,21 @@ static int
- activate_new(pcap_t *handle)
- {
- #ifdef HAVE_PF_PACKET_SOCKETS
-+	const char		*device = handle->opt.source;
-+	int			is_any_device = (strcmp(device, "any") == 0);
- 	int			sock_fd = -1, arptype, val;
- 	int			err = 0;
- 	struct packet_mreq	mr;
--	const char* device = handle->opt.source;
- 
- 	/*
--	 * Open a socket with protocol family packet. If a device is
--	 * given we try to open it in raw mode otherwise we use
--	 * the cooked interface.
-+	 * Open a socket with protocol family packet. If the
-+	 * "any" device was specified, we open a SOCK_DGRAM
-+	 * socket for the cooked interface, otherwise we first
-+	 * try a SOCK_RAW socket for the raw interface.
- 	 */
--	sock_fd = device ?
--		socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))
--	      : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL));
-+	sock_fd = is_any_device ?
-+		socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) :
-+		socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
- 
- 	if (sock_fd == -1) {
- 		snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "socket: %s",
-@@ -1704,7 +1709,7 @@ activate_new(pcap_t *handle)
- 	 * to cooked mode if we have an unknown interface type
- 	 * or a type we know doesn't work well in raw mode.
- 	 */
--	if (device) {
-+	if (!is_any_device) {
- 		/* Assume for now we don't need cooked mode. */
- 		handle->md.cooked = 0;
- 
-@@ -1819,15 +1824,23 @@ activate_new(pcap_t *handle)
- 		}
- 	} else {
- 		/*
--		 * This is cooked mode.
-+		 * The "any" device.
-+		 */
-+		if (handle->opt.rfmon) {
-+			/*
-+			 * It doesn't support monitor mode.
-+			 */
-+			return PCAP_ERROR_RFMON_NOTSUP;
-+		}
-+
-+		/*
-+		 * It uses cooked mode.
- 		 */
- 		handle->md.cooked = 1;
- 		handle->linktype = DLT_LINUX_SLL;
- 
- 		/*
- 		 * We're not bound to a device.
--		 * XXX - true?  Or true only if we're using
--		 * the "any" device?
- 		 * For now, we're using this as an indication
- 		 * that we can't transmit; stop doing that only
- 		 * if we figure out how to transmit in cooked
-@@ -1852,10 +1865,13 @@ activate_new(pcap_t *handle)
- 
- 	/*
- 	 * Hmm, how can we set promiscuous mode on all interfaces?
--	 * I am not sure if that is possible at all.
-+	 * I am not sure if that is possible at all.  For now, we
-+	 * silently ignore attempts to turn promiscuous mode on
-+	 * for the "any" device (so you don't have to explicitly
-+	 * disable it in programs such as tcpdump).
- 	 */
- 
--	if (device && handle->opt.promisc) {
-+	if (!is_any_device && handle->opt.promisc) {
- 		memset(&mr, 0, sizeof(mr));
- 		mr.mr_ifindex = handle->md.ifindex;
- 		mr.mr_type    = PACKET_MR_PROMISC;
-@@ -3118,7 +3134,7 @@ activate_old(pcap_t *handle)
- 
- 	/* Bind to the given device */
- 
--	if (!device) {
-+	if (strcmp(device, "any") == 0) {
- 		strncpy(handle->errbuf, "pcap_activate: The \"any\" device isn't supported on 2.0[.x]-kernel systems",
- 			PCAP_ERRBUF_SIZE);
- 		return PCAP_ERROR;
-- 
cgit v1.2.3


From 814db451499c99120d07cf951b2efce19d4b5232 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:21:07 +0000
Subject: main/hunspell: upgrade to 1.2.10

---
 main/hunspell/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/hunspell/APKBUILD b/main/hunspell/APKBUILD
index 029b9032..aea33aff 100644
--- a/main/hunspell/APKBUILD
+++ b/main/hunspell/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hunspell
-pkgver=1.2.8
-pkgrel=1
+pkgver=1.2.10
+pkgrel=0
 pkgdesc="Spell checker and morphological analyzer library and program"
 url="http://hunspell.sourceforge.net/"
 license="GPL LGPL MPL"
@@ -19,7 +19,7 @@ build ()
 
 package() {
 	cd "$srcdir/hunspell-$pkgver"
-	make DESTDIR="$pkgdir" install || return 1
+	make -j1 DESTDIR="$pkgdir" install || return 1
 	rm -rf "$pkgdir"/usr/share/locale/locale.alias
 }
-md5sums="1177af54a09e320d2c24015f29c3a93e  hunspell-1.2.8.tar.gz"
+md5sums="cc701ae1015e5442e85d592c325ea8aa  hunspell-1.2.10.tar.gz"
-- 
cgit v1.2.3


From 19c0d5ac803df6c86c40a78529f9e366fe47085d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:27:45 +0000
Subject: main/mysql: upgrade to 5.1.46

---
 main/mysql/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/mysql/APKBUILD b/main/mysql/APKBUILD
index b512228d..e45e96ed 100644
--- a/main/mysql/APKBUILD
+++ b/main/mysql/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mysql
-pkgver=5.1.45
-pkgrel=1
+pkgver=5.1.46
+pkgrel=0
 pkgdesc="A fast SQL database server"
 url="http://www.mysql.com/"
 license='GPL'
@@ -77,6 +77,6 @@ client() {
 	done
 }
 
-md5sums="06b5deb3a13c7600c38ba65b9f7e42c4  mysql-5.1.45.tar.gz
+md5sums="04f7c1422199c73a88a3d408b9161b63  mysql-5.1.46.tar.gz
 25d08b02bff6aa379dc45859b7a3f28a  mysql.initd
 15a7e3ddd6a40bf5a1eb3a8c69d9c34c  mysql.mycnf"
-- 
cgit v1.2.3


From d5e744342087289e9fcb24887ff09141317811b3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:33:34 +0000
Subject: main/lvm2: upgrade to 2.02.64

---
 main/lvm2/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/lvm2/APKBUILD b/main/lvm2/APKBUILD
index e7cd64b2..6420b9d4 100644
--- a/main/lvm2/APKBUILD
+++ b/main/lvm2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lvm2
-pkgver=2.02.61
-pkgrel=1
+pkgver=2.02.64
+pkgrel=0
 pkgdesc="Logical Volume Manager 2 utilities"
 url="http://sourceware.org/lvm2/"
 license="GPL"
@@ -45,6 +45,6 @@ dm() {
 	mv "$pkgdir"/sbin/dm* "$subpkgdir"/sbin/
 }
 
-md5sums="0fdac768c78d96525d47b5a3df4c67de  LVM2.2.02.61.tgz
+md5sums="59fc0f7f6703a8c7f12df6b7d2e509fb  LVM2.2.02.64.tgz
 6f65f902cf19f144a42b8d6aceadf395  lvm.initd
 ec36d5fe4561220304e406c5c797e71f  lvm.confd"
-- 
cgit v1.2.3


From 8b205595694d20c69a6fb3dea13778f99f07d6b3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 14:34:35 +0000
Subject: main/icu: upgrade to 4.4.1

---
 main/icu/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/icu/APKBUILD b/main/icu/APKBUILD
index 2c3a05e9..df9de54b 100644
--- a/main/icu/APKBUILD
+++ b/main/icu/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=icu
-pkgver=4.4
+pkgver=4.4.1
 _ver=4_2_1
-pkgrel=2
+pkgrel=0
 pkgdesc="International Components for Unicode library"
 url="http://www.icu-project.org/"
 license="custom:icu"
-- 
cgit v1.2.3


From a944bcf495ef2a2d110e2fc68d5deb74136f90d4 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 15:42:11 +0000
Subject: main/taglib: upgrade to 1.6.3

---
 main/taglib/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/taglib/APKBUILD b/main/taglib/APKBUILD
index 2c2320f3..d4492768 100644
--- a/main/taglib/APKBUILD
+++ b/main/taglib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=taglib
-pkgver=1.6.1
-pkgrel=1
+pkgver=1.6.3
+pkgrel=0
 pkgdesc="library for reading and editing the meta-data of several popular audio formats."
 url="http://ktown.kde.org/~wheeler/taglib.html"
 license="GPL2"
@@ -21,4 +21,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="db0502b3c3448ff1f1f9b090c1daa5f7  taglib-1.6.1.tar.gz"
+md5sums="ddf02f4e1d2dc30f76734df806e613eb  taglib-1.6.3.tar.gz"
-- 
cgit v1.2.3


From 6d627de979e80d1d58f2c97fc8da206324184199 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 15:44:34 +0000
Subject: main/tcpdump: upgrade to 4.1.1

---
 main/tcpdump/APKBUILD | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/main/tcpdump/APKBUILD b/main/tcpdump/APKBUILD
index 74b8f0ec..a38ece54 100644
--- a/main/tcpdump/APKBUILD
+++ b/main/tcpdump/APKBUILD
@@ -1,11 +1,11 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=tcpdump
-pkgver=4.0.0
-pkgrel=2
+pkgver=4.1.1
+pkgrel=0
 pkgdesc="A tool for network monitoring and data acquisition"
 url="http://www.tcpdump.org"
 license="BSD"
-depends="libpcap openssl"
+depends=
 makedepends="libpcap-dev openssl-dev"
 source="http://www.$pkgname.org/release/$pkgname-$pkgver.tar.gz"
 subpackages="$pkgname-doc"
@@ -17,8 +17,12 @@ build ()
 		--mandir=/usr/share/man \
 		--enable-ipv6
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 	rm -f "$pkgdir"/usr/sbin/tcpdump.4*
 }
 
-md5sums="b22ca72890df2301d922c9f2d17867f9  tcpdump-4.0.0.tar.gz"
+md5sums="d0dd58bbd6cd36795e05c6f1f74420b0  tcpdump-4.1.1.tar.gz"
-- 
cgit v1.2.3


From b09b095fb6754c71a10ecb2ae44695dddfcc3c1d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 15:53:23 +0000
Subject: main/util-linux-ng: upgrade to 2.17.2

---
 main/util-linux-ng/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/util-linux-ng/APKBUILD b/main/util-linux-ng/APKBUILD
index 0cc99961..604d9244 100644
--- a/main/util-linux-ng/APKBUILD
+++ b/main/util-linux-ng/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Leonardo Arena <rnalrd@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=util-linux-ng
-pkgver=2.17.1
-pkgrel=1
+pkgver=2.17.2
+pkgrel=0
 pkgdesc="Random collection of Linux utilities"
 arch=""
 url="http://kernel.org/~kzak/util-linux-ng/"
@@ -74,4 +74,4 @@ cfdisk() {
 	mv "$pkgdir"/sbin/cfdisk "$subpkgdir"/sbin/
 }
 
-md5sums="3dbf64e961ec00441677855ae1b2e569  util-linux-ng-2.17.1.tar.gz"
+md5sums="4c810430e86d53b6ea5e7ae279b39186  util-linux-ng-2.17.2.tar.gz"
-- 
cgit v1.2.3


From f7bc655f8e3a903442d92a35f7707099f128daed Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 15:54:35 +0000
Subject: main/vala: upgrade to 0.8.1

---
 main/vala/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/vala/APKBUILD b/main/vala/APKBUILD
index 9cac0789..5501fbb4 100644
--- a/main/vala/APKBUILD
+++ b/main/vala/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vala
-pkgver=0.8.0
-pkgrel=1
+pkgver=0.8.1
+pkgrel=0
 pkgdesc="Compiler for the GObject type system"
 url="http://live.gnome.org/Vala"
 license="LGPL"
@@ -23,4 +23,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="177662b0cf1977dcea6707292685647e  vala-0.8.0.tar.gz"
+md5sums="9e3703950a84d2e57a6aa9354034705b  vala-0.8.1.tar.gz"
-- 
cgit v1.2.3


From db5638d0911a1c0320d1ac01768864a7b73ab2d9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 4 May 2010 15:55:37 +0000
Subject: main/vte: upgrade to 0.24.1

---
 main/vte/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/vte/APKBUILD b/main/vte/APKBUILD
index 8d251687..9de94bbd 100644
--- a/main/vte/APKBUILD
+++ b/main/vte/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vte
-pkgver=0.24.0
-pkgrel=1
+pkgver=0.24.1
+pkgrel=0
 pkgdesc="Virtual Terminal Emulator library"
 url="http://www.gnome.org"
 license="LGPL"
@@ -26,4 +26,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="c381f6019448a6e84470ec0acfd78c63  vte-0.24.0.tar.bz2"
+md5sums="3b66116e930dde00e1ddbf8277066ea7  vte-0.24.1.tar.bz2"
-- 
cgit v1.2.3


From d184dae88f067a87efcd7616ad0d3c1772aeec24 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 06:25:55 +0000
Subject: main/portmap: fix preinstall that changed premissions on /dev/null

---
 main/portmap/APKBUILD            | 13 ++++++++++---
 main/portmap/portmap.pre-install |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/main/portmap/APKBUILD b/main/portmap/APKBUILD
index a6e76bcf..fb86bac3 100644
--- a/main/portmap/APKBUILD
+++ b/main/portmap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=portmap
 pkgver=6.0
-pkgrel=4
+pkgrel=5
 pkgdesc="RPC connection manager"
 url="http://neil.brown.name/portmap/"
 license="GPL"
@@ -14,15 +14,22 @@ source="http://neil.brown.name/$pkgname/$pkgname-$pkgver.tgz
 	$pkgname.confd
 	$pkgname.initd"
 
-build () 
-{ 
+
+prepare() {
 	cd "$srcdir"/portmap_$pkgver
 	for i in ../*.patch; do
 		msg "Applying $i"
 		patch -p1 < $i || return 1
 	done
+}
 
+build() {
+	cd "$srcdir"/portmap_$pkgver
 	make NO_TCP_WRAPPER=NO || return 1
+}
+
+package() {
+	cd "$srcdir"/portmap_$pkgver
 	mkdir -p "$pkgdir"/sbin
 	mkdir -p "$pkgdir"/usr/share/man/man8
 	make BASEDIR="$pkgdir" install
diff --git a/main/portmap/portmap.pre-install b/main/portmap/portmap.pre-install
index b0dcfb9c..ea2baf9e 100644
--- a/main/portmap/portmap.pre-install
+++ b/main/portmap/portmap.pre-install
@@ -1,3 +1,3 @@
 #!/bin/sh
 
-adduser -h /dev/null -s /bin/false -D rpc 2>/dev/null || true
+adduser -h /var/lib/empty -H -s /bin/false -S -D rpc 2>/dev/null || true
-- 
cgit v1.2.3


From db8d806774c0ebe3917540ea2581c61549dc4747 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 06:49:36 +0000
Subject: main/linux-headers: detect if headers_install fails

---
 main/linux-headers/APKBUILD | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/main/linux-headers/APKBUILD b/main/linux-headers/APKBUILD
index 2dce2901..272d63ce 100644
--- a/main/linux-headers/APKBUILD
+++ b/main/linux-headers/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=linux-headers
 pkgver=2.6.32.2
 _kernver=2.6.32
-pkgrel=1
+pkgrel=2
 pkgdesc="Linux system headers"
 url="http://kernel.org"
 license='GPL-2'
@@ -14,15 +14,23 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	scsi.patch
 	"
 
-build() {
-	cd $srcdir/linux-$_kernver
+prepare() {
+	cd "$srcdir"/linux-$_kernver
 	if [ "$_kernver" != "$pkgver" ]; then
 		bunzip2 -c < ../patch-$pkgver.bz2 | patch -p1 || return 1
 	fi
 	patch -p1 -i "$srcdir"/scsi.patch || return 1
+}
+
+build() {
+	return 0
+}
+
 
+package() {
+	cd "$srcdir"/linux-$_kernver
 	mkdir -p "$pkgdir/usr"
-	make headers_install INSTALL_HDR_PATH="$pkgdir/usr" 
+	make headers_install INSTALL_HDR_PATH="$pkgdir/usr" || return 1
 
 	find "$pkgdir/usr" \( -name .install -o -name ..install.cmd \) -exec \
 		rm -f {} \;
-- 
cgit v1.2.3


From 332c2c3214845397d84acea4778c33fc0ecfc7e3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 07:14:03 +0000
Subject: testing/[various]: bump pkgrel so we rebuild against new uclibc

---
 testing/alsa-utils/APKBUILD     |  2 +-
 testing/bacula-client/APKBUILD  |  2 +-
 testing/bacula/APKBUILD         |  2 +-
 testing/cherokee/APKBUILD       |  2 +-
 testing/collectd/APKBUILD       |  2 +-
 testing/cryptsetup/APKBUILD     |  2 +-
 testing/daemontools/APKBUILD    |  2 +-
 testing/dspam/APKBUILD          |  2 +-
 testing/ebtables/APKBUILD       |  2 +-
 testing/fuse/APKBUILD           |  2 +-
 testing/gtksourceview/APKBUILD  |  2 +-
 testing/hardinfo/APKBUILD       |  2 +-
 testing/hdparm/APKBUILD         |  2 +-
 testing/hping3/APKBUILD         |  2 +-
 testing/icecast/APKBUILD        |  2 +-
 testing/iproute2/APKBUILD       |  2 +-
 testing/ircii/APKBUILD          |  2 +-
 testing/ircservices/APKBUILD    |  2 +-
 testing/iscsi-scst/APKBUILD     |  2 +-
 testing/kamailio/APKBUILD       |  2 +-
 testing/libgssglue/APKBUILD     |  2 +-
 testing/libtirpc/APKBUILD       |  2 +-
 testing/libunique/APKBUILD      |  2 +-
 testing/libwmf/APKBUILD         |  2 +-
 testing/live-media/APKBUILD     |  2 +-
 testing/lua-crypto/APKBUILD     |  2 +-
 testing/lua-curl/APKBUILD       |  2 +-
 testing/lua-filesystem/APKBUILD |  2 +-
 testing/lua-nixio/APKBUILD      |  2 +-
 testing/lua-rexlib/APKBUILD     |  2 +-
 testing/madplay/APKBUILD        |  2 +-
 testing/madwimax/APKBUILD       |  2 +-
 testing/mediaproxy/APKBUILD     |  2 +-
 testing/mplayer/APKBUILD        |  2 +-
 testing/mtx/APKBUILD            |  2 +-
 testing/needbump                | 57 +++++++++++++++++++++++++++++++++++++++++
 testing/open-iscsi/APKBUILD     |  2 +-
 testing/osmo/APKBUILD           |  2 +-
 testing/pmacct/APKBUILD         |  2 +-
 testing/pptpclient/APKBUILD     |  2 +-
 testing/prosody/APKBUILD        |  2 +-
 testing/psqlodbc/APKBUILD       |  2 +-
 testing/python-cjson/APKBUILD   |  2 +-
 testing/python-gnutls/APKBUILD  |  2 +-
 testing/qemu/APKBUILD           |  2 +-
 testing/rrdbot/APKBUILD         |  2 +-
 testing/rtapd/APKBUILD          |  2 +-
 testing/rtnppd/APKBUILD         |  2 +-
 testing/sems/APKBUILD           |  2 +-
 testing/sircbot/APKBUILD        |  2 +-
 testing/sisctrl/APKBUILD        |  2 +-
 testing/smartmontools/APKBUILD  |  2 +-
 testing/swish-e/APKBUILD        |  2 +-
 testing/ucspi-tcp/APKBUILD      |  2 +-
 testing/udev/APKBUILD           |  2 +-
 testing/umix/APKBUILD           |  2 +-
 testing/wine/APKBUILD           |  2 +-
 57 files changed, 113 insertions(+), 56 deletions(-)
 create mode 100644 testing/needbump

diff --git a/testing/alsa-utils/APKBUILD b/testing/alsa-utils/APKBUILD
index ffa91217..6b48a210 100644
--- a/testing/alsa-utils/APKBUILD
+++ b/testing/alsa-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alsa-utils
 pkgver=1.0.22
-pkgrel=0
+pkgrel=1
 pkgdesc="Advanced Linux Sound Architecture Utils (alsactl, alsamixer, etc.)"
 url="http://www.alsa-project.org"
 license="GPL"
diff --git a/testing/bacula-client/APKBUILD b/testing/bacula-client/APKBUILD
index 998d5cc3..d9876919 100644
--- a/testing/bacula-client/APKBUILD
+++ b/testing/bacula-client/APKBUILD
@@ -3,7 +3,7 @@
 pkgname="bacula-client"
 _realname="bacula"
 pkgver=5.0.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Client (File Daemon) of Bacula, a network based backup program"
 url="http://www.bacula.org"
 license="GPL2"
diff --git a/testing/bacula/APKBUILD b/testing/bacula/APKBUILD
index ecb9dbe2..c7603387 100644
--- a/testing/bacula/APKBUILD
+++ b/testing/bacula/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname="bacula"
 pkgver=5.0.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Enterprise ready, network based backup program"
 url="http://www.bacula.org"
 license="GPL2"
diff --git a/testing/cherokee/APKBUILD b/testing/cherokee/APKBUILD
index 47a7d43a..e122b570 100644
--- a/testing/cherokee/APKBUILD
+++ b/testing/cherokee/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mika Havela <mika.havela@gmail.com>
 pkgname=cherokee
 pkgver=0.99.41
-pkgrel=0
+pkgrel=1
 pkgdesc="A very fast, flexible and easy to configure Web Server"
 url="http://www.cherokee-project.com/"
 license="GPL2"
diff --git a/testing/collectd/APKBUILD b/testing/collectd/APKBUILD
index e145a79f..39e6a7db 100644
--- a/testing/collectd/APKBUILD
+++ b/testing/collectd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=collectd
 pkgver=4.9.1
-pkgrel=0
+pkgrel=1
 pkgdesc="The system statistics collection daemon"
 url="http://collectd.org"
 license="GPL"
diff --git a/testing/cryptsetup/APKBUILD b/testing/cryptsetup/APKBUILD
index 4d7d4c98..2f6fed11 100644
--- a/testing/cryptsetup/APKBUILD
+++ b/testing/cryptsetup/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cryptsetup
 pkgver=1.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Userspace setup tool for transparent encryption of block devices using the Linux 2.6 cryptoapi"
 url="http://code.google.com/p/cryptsetup/"
 license="GPL"
diff --git a/testing/daemontools/APKBUILD b/testing/daemontools/APKBUILD
index 98bf9952..84ed1ded 100644
--- a/testing/daemontools/APKBUILD
+++ b/testing/daemontools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=daemontools
 pkgver=0.76
-pkgrel=0
+pkgrel=1
 pkgdesc="Collection of tools for managing UNIX services"
 url="http://cr.yp.to/daemontools.html"
 license="public-domain"
diff --git a/testing/dspam/APKBUILD b/testing/dspam/APKBUILD
index 1d049cfb..fb276108 100644
--- a/testing/dspam/APKBUILD
+++ b/testing/dspam/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=dspam
 pkgver=3.9.0_rc2
 _ver=3.9.0-RC2
-pkgrel=0
+pkgrel=1
 pkgdesc="A statistical-algorithmic hybrid anti-spam filter"
 url="http://dspam.nuclearelephant.com/"
 pkgusers="dspam"
diff --git a/testing/ebtables/APKBUILD b/testing/ebtables/APKBUILD
index 4bdc882e..aedc6e8a 100644
--- a/testing/ebtables/APKBUILD
+++ b/testing/ebtables/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=ebtables
 pkgver=2.0.9.1
 _realver=v2.0.9-1
-pkgrel=0
+pkgrel=1
 pkgdesc="Ethernet bridge tables - Linux Ethernet filter for the Linux bridge."
 url="http://ebtables.sourceforge.net/"
 license="GPL"
diff --git a/testing/fuse/APKBUILD b/testing/fuse/APKBUILD
index 52cf280b..5f2d4eb6 100644
--- a/testing/fuse/APKBUILD
+++ b/testing/fuse/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fuse
 pkgver=2.8.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A library that makes it possible to implement a filesystem in a userspace program."
 url="http://fuse.sourceforge.net/"
 license="GPL2"
diff --git a/testing/gtksourceview/APKBUILD b/testing/gtksourceview/APKBUILD
index c4ed809a..78f48202 100644
--- a/testing/gtksourceview/APKBUILD
+++ b/testing/gtksourceview/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtksourceview
 pkgver=2.8.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A text widget adding syntax highlighting and more to GNOME"
 url="http://live.gnome.org/GtkSourceView"
 license="GPL"
diff --git a/testing/hardinfo/APKBUILD b/testing/hardinfo/APKBUILD
index ac60f1dd..4081e84c 100644
--- a/testing/hardinfo/APKBUILD
+++ b/testing/hardinfo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hardinfo
 pkgver=0.5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A system information and benchmark tool."
 url="http://hardinfo.berlios.de/wiki/index.php/Main_Page"
 license="GPL-2"
diff --git a/testing/hdparm/APKBUILD b/testing/hdparm/APKBUILD
index f9fb4bf9..4b69192d 100644
--- a/testing/hdparm/APKBUILD
+++ b/testing/hdparm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hdparm
 pkgver=9.27
-pkgrel=1
+pkgrel=2
 pkgdesc="A shell utility for manipulating Linux IDE drive/driver parameters"
 url="http://sourceforge.net/projects/hdparm/"
 license="BSD"
diff --git a/testing/hping3/APKBUILD b/testing/hping3/APKBUILD
index f55e1168..2479d74b 100644
--- a/testing/hping3/APKBUILD
+++ b/testing/hping3/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=hping3
 pkgver=20051105
-pkgrel=0
+pkgrel=1
 pkgdesc="A ping-like TCP/IP packet assembler/analyzer"
 url="http://www.hping.org"
 license="GPL"
diff --git a/testing/icecast/APKBUILD b/testing/icecast/APKBUILD
index 0e7c70e7..33bffd73 100644
--- a/testing/icecast/APKBUILD
+++ b/testing/icecast/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=icecast
 pkgver=2.3.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Open source media server"
 url="http://www.icecast.org"
 license="GPL"
diff --git a/testing/iproute2/APKBUILD b/testing/iproute2/APKBUILD
index 1ef20dde..71773e53 100644
--- a/testing/iproute2/APKBUILD
+++ b/testing/iproute2/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=iproute2
 pkgver=2.6.31
 _realver=2.6.31
-pkgrel=0
+pkgrel=1
 pkgdesc="IP Routing Utilities"
 url="http://www.linux-foundation.org/en/Net:Iproute2"
 license="GPL2"
diff --git a/testing/ircii/APKBUILD b/testing/ircii/APKBUILD
index 221568ba..1c16d509 100644
--- a/testing/ircii/APKBUILD
+++ b/testing/ircii/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=ircii
 pkgver=20080314
-pkgrel=0
+pkgrel=1
 pkgdesc="Universal IRC for Unix systems"
 url="http://www.eterna.com.au/ircii/"
 license="GPL"
diff --git a/testing/ircservices/APKBUILD b/testing/ircservices/APKBUILD
index 96b9db48..57d36e70 100644
--- a/testing/ircservices/APKBUILD
+++ b/testing/ircservices/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ircservices
 pkgver=5.1.21
-pkgrel=0
+pkgrel=1
 pkgdesc="Services for IRC (NickServ, ChanServ, MemoServ)"
 url="http://www.ircservices.za.net/"
 license="GPL"
diff --git a/testing/iscsi-scst/APKBUILD b/testing/iscsi-scst/APKBUILD
index 9f373ea5..dee7d15e 100644
--- a/testing/iscsi-scst/APKBUILD
+++ b/testing/iscsi-scst/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=iscsi-scst
 pkgver=1.0.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="ISCSI target for SCST - userspace tools"
 url="http://iscsi-scst.sourceforge.net/"
 license="GPL-2"
diff --git a/testing/kamailio/APKBUILD b/testing/kamailio/APKBUILD
index 5e3a0c63..604796d5 100644
--- a/testing/kamailio/APKBUILD
+++ b/testing/kamailio/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=kamailio
 pkgver=3.0.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Open Source SIP Server"
 url="http://www.kamailio.org/"
 pkgusers="kamailio"
diff --git a/testing/libgssglue/APKBUILD b/testing/libgssglue/APKBUILD
index 48e22d00..4701c765 100644
--- a/testing/libgssglue/APKBUILD
+++ b/testing/libgssglue/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgssglue
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="exports a gssapi interface which calls other random gssapi libraries"
 url="http://www.citi.umich.edu/projects/nfsv4/linux/"
 license="BSD"
diff --git a/testing/libtirpc/APKBUILD b/testing/libtirpc/APKBUILD
index cbe2b642..d8ae675a 100644
--- a/testing/libtirpc/APKBUILD
+++ b/testing/libtirpc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libtirpc
 pkgver=0.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Transport Independent RPC library (SunRPC replacement)"
 url="http://libtirpc.sourceforge.net/"
 license="GPL2"
diff --git a/testing/libunique/APKBUILD b/testing/libunique/APKBUILD
index 29ed8abb..59bd4508 100644
--- a/testing/libunique/APKBUILD
+++ b/testing/libunique/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libunique
 pkgver=1.1.6
-pkgrel=0
+pkgrel=1
 pkgdesc="Library for writing single instance applications"
 url="http://live.gnome.org/LibUnique"
 license="LGPL"
diff --git a/testing/libwmf/APKBUILD b/testing/libwmf/APKBUILD
index 3f410879..024795bd 100644
--- a/testing/libwmf/APKBUILD
+++ b/testing/libwmf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libwmf
 pkgver=0.2.8.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A library for reading vector images in Microsoft's native Windows Metafile Format (WMF)."
 url="http://wvware.sourceforge.net/libwmf.html"
 license="LGPL"
diff --git a/testing/live-media/APKBUILD b/testing/live-media/APKBUILD
index 7f06135f..0bd0e167 100644
--- a/testing/live-media/APKBUILD
+++ b/testing/live-media/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=live-media
 pkgver=2010.01.22
-pkgrel=0
+pkgrel=1
 pkgdesc="A set of C++ libraries for multimedia streaming"
 url="http://live555.com/liveMedia"
 license="LGPL"
diff --git a/testing/lua-crypto/APKBUILD b/testing/lua-crypto/APKBUILD
index 0aa67ec5..34bbfb18 100644
--- a/testing/lua-crypto/APKBUILD
+++ b/testing/lua-crypto/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-crypto
 pkgver=0.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="a Lua frontend to the OpenSSL cryptographic library"
 url="http://luacrypto.luaforge.net/"
 license="MIT/X11"
diff --git a/testing/lua-curl/APKBUILD b/testing/lua-curl/APKBUILD
index 4440e836..0db7be95 100644
--- a/testing/lua-curl/APKBUILD
+++ b/testing/lua-curl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lua-curl
 pkgver=0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua bindings to cURL library"
 url="http://lua-curl.luaforge.net/"
 license="MIT/X11"
diff --git a/testing/lua-filesystem/APKBUILD b/testing/lua-filesystem/APKBUILD
index cf07eb5a..4c6d6d7b 100644
--- a/testing/lua-filesystem/APKBUILD
+++ b/testing/lua-filesystem/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-filesystem
 pkgver=1.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua library to complement the set of functions related to file systems"
 url="http://www.keplerproject.org/luafilesystem/"
 license="GPL"
diff --git a/testing/lua-nixio/APKBUILD b/testing/lua-nixio/APKBUILD
index 6e84e8c1..9b7ad2bb 100644
--- a/testing/lua-nixio/APKBUILD
+++ b/testing/lua-nixio/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-nixio
 _name=nixio
 pkgver=0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="General POSIX IO library for Lua"
 url="http://dev.luci.freifunk-halle.net/nixio/doc/"
 license="Apache"
diff --git a/testing/lua-rexlib/APKBUILD b/testing/lua-rexlib/APKBUILD
index aed976bb..4f7bce08 100644
--- a/testing/lua-rexlib/APKBUILD
+++ b/testing/lua-rexlib/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-rex
 pkgver=2.4.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Lua bindings to regular expression library pcre and posix"
 url="http://lrexlib.luaforge.net/"
 license="MIT"
diff --git a/testing/madplay/APKBUILD b/testing/madplay/APKBUILD
index 8d2807b7..daa36727 100644
--- a/testing/madplay/APKBUILD
+++ b/testing/madplay/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=madplay
 pkgver=0.15.2b
-pkgrel=0
+pkgrel=1
 pkgdesc="The MAD audio player"
 url="http://www.underbit.com/products/mad/"
 license="GPL-2"
diff --git a/testing/madwimax/APKBUILD b/testing/madwimax/APKBUILD
index 70367a67..6973265b 100644
--- a/testing/madwimax/APKBUILD
+++ b/testing/madwimax/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=madwimax
 pkgver=0.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="WiMAX driver for the Samsung SWC-U200 and similar USB modems"
 url="http://code.google.com/p/madwimax/"
 license="GPL-2"
diff --git a/testing/mediaproxy/APKBUILD b/testing/mediaproxy/APKBUILD
index b8077fe8..6702781d 100644
--- a/testing/mediaproxy/APKBUILD
+++ b/testing/mediaproxy/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=mediaproxy
 pkgver=2.3.8
-pkgrel=2
+pkgrel=3
 pkgdesc="MediaProxy"
 url="http://www.ag-projects.com/MediaProxy/"
 pkgusers="kamailio"
diff --git a/testing/mplayer/APKBUILD b/testing/mplayer/APKBUILD
index 24136a4a..5662a655 100644
--- a/testing/mplayer/APKBUILD
+++ b/testing/mplayer/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=mplayer
 pkgver=1.0_rc4_p20091124
 _svnver=SVN-r29964
-pkgrel=4
+pkgrel=5
 pkgdesc="A movie player for linux"
 url="http://www.mplayerhq.hu/"
 license="GPL"
diff --git a/testing/mtx/APKBUILD b/testing/mtx/APKBUILD
index 5d706bc4..f0997c6e 100644
--- a/testing/mtx/APKBUILD
+++ b/testing/mtx/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname="mtx"
 pkgver=1.3.12
-pkgrel=0
+pkgrel=1
 pkgdesc="SCSI Media Changer and Backup Device Control"
 url="http://mtx.opensource-sw.net/"
 license="GPL2"
diff --git a/testing/needbump b/testing/needbump
new file mode 100644
index 00000000..66f21c47
--- /dev/null
+++ b/testing/needbump
@@ -0,0 +1,57 @@
+alsa-utils
+bacula
+bacula-client
+cherokee
+collectd
+cryptsetup
+daemontools
+dspam
+ebtables
+fuse
+gtksourceview
+hardinfo
+hdparm
+hping3
+icecast
+iproute2
+ircii
+ircservices
+iscsi-scst
+kamailio
+libgssglue
+libtirpc
+libunique
+libwmf
+live-media
+lua-crypto
+lua-curl
+lua-filesystem
+lua-nixio
+lua-rexlib
+madplay
+madwimax
+mediaproxy
+mplayer
+mtx
+open-iscsi
+osmo
+pmacct
+pptpclient
+prosody
+psqlodbc
+python-cjson
+python-gnutls
+qemu
+rrdbot
+rtapd
+rtnppd
+sems
+sircbot
+sisctrl
+smartmontools
+swish-e
+ucspi-tcp
+udev
+umix
+wine
+
diff --git a/testing/open-iscsi/APKBUILD b/testing/open-iscsi/APKBUILD
index ca7bbda1..0f4076e2 100644
--- a/testing/open-iscsi/APKBUILD
+++ b/testing/open-iscsi/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=open-iscsi
 pkgver=2.0.871
 _realver=2.0-871
-pkgrel=1
+pkgrel=2
 pkgdesc="High performance, transport independent, multi-platform iSCSI initiator"
 url="http://www.open-iscsi.org"
 license="GPL-2"
diff --git a/testing/osmo/APKBUILD b/testing/osmo/APKBUILD
index 75a2f25d..4c3145c0 100644
--- a/testing/osmo/APKBUILD
+++ b/testing/osmo/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=osmo
 pkgver=0.2.8
-pkgrel=0
+pkgrel=1
 pkgdesc="A handy personal organizer"
 url="http://clayo.org/osmo/"
 license="GPL"
diff --git a/testing/pmacct/APKBUILD b/testing/pmacct/APKBUILD
index 9a8a05ea..d536e264 100644
--- a/testing/pmacct/APKBUILD
+++ b/testing/pmacct/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=pmacct
 pkgver=0.12.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Measure, account, classify, aggregate and export IPv4 and IPv6 traffic"
 url="http://www.pmacct.net/"
 license="GPL"
diff --git a/testing/pptpclient/APKBUILD b/testing/pptpclient/APKBUILD
index acdc734a..31adae3c 100644
--- a/testing/pptpclient/APKBUILD
+++ b/testing/pptpclient/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pptpclient
 pkgver=1.7.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Client for the proprietary Microsoft Point-to-Point Tunneling Protocol, PPTP."
 url="http://pptpclient.sourceforge.net/"
 license="GPL"
diff --git a/testing/prosody/APKBUILD b/testing/prosody/APKBUILD
index 4f778f2e..8d7c6912 100644
--- a/testing/prosody/APKBUILD
+++ b/testing/prosody/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mika Havela <mika.havela@gmail.com>
 pkgname=prosody
 pkgver=0.4.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Lua based Jabber/XMPP server"
 url="http://prosody.im/"
 license="MIT"
diff --git a/testing/psqlodbc/APKBUILD b/testing/psqlodbc/APKBUILD
index 6139d96e..69c5122c 100644
--- a/testing/psqlodbc/APKBUILD
+++ b/testing/psqlodbc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=psqlodbc
 pkgver=08.04.0200
-pkgrel=0
+pkgrel=1
 pkgdesc="PostgreSQL ODBC driver"
 url="http://www.postgresql.org"
 license="GPL"
diff --git a/testing/python-cjson/APKBUILD b/testing/python-cjson/APKBUILD
index c6df3c17..f3274d5f 100644
--- a/testing/python-cjson/APKBUILD
+++ b/testing/python-cjson/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=python-cjson
 pkgver=1.0.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Fast JSON encoder/decoder for Python"
 url="http://pypi.python.org/pypi/python-gnutls"
 license="PSF"
diff --git a/testing/python-gnutls/APKBUILD b/testing/python-gnutls/APKBUILD
index 943d06aa..df19c123 100644
--- a/testing/python-gnutls/APKBUILD
+++ b/testing/python-gnutls/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=python-gnutls
 pkgver=1.1.9
-pkgrel=0
+pkgrel=1
 pkgdesc="Python wrapper for the GNUTLS library"
 url="http://pypi.python.org/pypi/python-gnutls"
 license="PSF"
diff --git a/testing/qemu/APKBUILD b/testing/qemu/APKBUILD
index 6361ee46..bfe0c629 100644
--- a/testing/qemu/APKBUILD
+++ b/testing/qemu/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=qemu
 pkgver=0.11.1
-pkgrel=0
+pkgrel=1
 pkgdesc="QEMU is a generic machine emulator and virtualizer"
 url="http://www.nongnu.org/qemu/"
 license="GPL-2 LGPL-2"
diff --git a/testing/rrdbot/APKBUILD b/testing/rrdbot/APKBUILD
index d1f1e17d..e9698a13 100644
--- a/testing/rrdbot/APKBUILD
+++ b/testing/rrdbot/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rrdbot
 pkgver=0.9.6
-pkgrel=0
+pkgrel=1
 pkgdesc="an SNMP polling daemon which writes the polled values to an RRD database"
 url="http://memberwebs.com/stef/software/rrdbot/"
 license="BSD"
diff --git a/testing/rtapd/APKBUILD b/testing/rtapd/APKBUILD
index f568fb76..88db6723 100644
--- a/testing/rtapd/APKBUILD
+++ b/testing/rtapd/APKBUILD
@@ -4,7 +4,7 @@ pkgname=rtapd
 _altpkgname="rtnppd"
 _builddir="$pkgname"
 pkgver=1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="daemon for routing packets to rtnppd"
 url="http://sourceforge.net/projects/rtnppd/"
 license="GPL"
diff --git a/testing/rtnppd/APKBUILD b/testing/rtnppd/APKBUILD
index f608ec7f..b2725b8a 100644
--- a/testing/rtnppd/APKBUILD
+++ b/testing/rtnppd/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=rtnppd
 _builddir="$pkgname"
 pkgver=1.7b
-pkgrel=0
+pkgrel=1
 pkgdesc="A program route TNPP 3.8 (Telocator Network Paging Protocol) packets between serial and other links"
 url="http://sourceforge.net/projects/rtnppd/"
 license="GPL"
diff --git a/testing/sems/APKBUILD b/testing/sems/APKBUILD
index 51c3a044..97af0045 100644
--- a/testing/sems/APKBUILD
+++ b/testing/sems/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Francesco Colista <francesco.colista@gmail.com>
 pkgname=sems
 pkgver=1.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="High performance, extensible media server for SIP (RFC3261) based VoIP  services"
 url="http://iptel.org/sems/"
 license="GPL-2"
diff --git a/testing/sircbot/APKBUILD b/testing/sircbot/APKBUILD
index 136c2b7e..85035fc4 100644
--- a/testing/sircbot/APKBUILD
+++ b/testing/sircbot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=sircbot
 pkgver=0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Minimalistic IRC bot"
 url="http://git.alpinelinux.org/cgit/sircbot/"
 license="GPL-2"
diff --git a/testing/sisctrl/APKBUILD b/testing/sisctrl/APKBUILD
index 59fb485d..926a663e 100644
--- a/testing/sisctrl/APKBUILD
+++ b/testing/sisctrl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sisctrl
 pkgver=0.0.20051202
-pkgrel=2
+pkgrel=3
 pkgdesc="SiSCtrl is Display Control Panel for XFree86/X.org SiS driver"
 url="http://www.winischhofer.net/linuxsisvga.shtml"
 license="GPL"
diff --git a/testing/smartmontools/APKBUILD b/testing/smartmontools/APKBUILD
index 8ba05087..9650683c 100644
--- a/testing/smartmontools/APKBUILD
+++ b/testing/smartmontools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=smartmontools
 pkgver=5.38
-pkgrel=0
+pkgrel=1
 pkgdesc="Control and monitor S.M.A.R.T. enabled ATA and SCSI Hard Drives."
 url="http://smartmontools.sourceforge.net"
 license="GPL"
diff --git a/testing/swish-e/APKBUILD b/testing/swish-e/APKBUILD
index 76ff7bb7..758d7755 100644
--- a/testing/swish-e/APKBUILD
+++ b/testing/swish-e/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=swish-e
 pkgver=2.4.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple Web Indexing System for Humans - Enhanced"
 url="http://www.swish-e.org/"
 license="GPL"
diff --git a/testing/ucspi-tcp/APKBUILD b/testing/ucspi-tcp/APKBUILD
index 9cdca875..9b6f578a 100644
--- a/testing/ucspi-tcp/APKBUILD
+++ b/testing/ucspi-tcp/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=ucspi-tcp
 pkgver=0.88
-pkgrel=0
+pkgrel=1
 pkgdesc="Easy-to-use command-line tools for building TCP client-server applications."
 url="http://cr.yp.to/ucspi-tcp.html"
 license="public-domain"
diff --git a/testing/udev/APKBUILD b/testing/udev/APKBUILD
index d25b5faa..de342d4f 100644
--- a/testing/udev/APKBUILD
+++ b/testing/udev/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=udev
 pkgver=142
-pkgrel=0
+pkgrel=1
 pkgdesc="The userspace dev tools (udev)"
 url="http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html"
 license="GPL"
diff --git a/testing/umix/APKBUILD b/testing/umix/APKBUILD
index 7eb262f7..d057b390 100644
--- a/testing/umix/APKBUILD
+++ b/testing/umix/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com> 
 pkgname=umix
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Program for adjusting soundcard volumes"
 url="http://umix.sf.net"
 license="GPL"
diff --git a/testing/wine/APKBUILD b/testing/wine/APKBUILD
index 35ae3634..30406ef6 100644
--- a/testing/wine/APKBUILD
+++ b/testing/wine/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wine
 pkgver=1.1.38
-pkgrel=0
+pkgrel=1
 pkgdesc="A compatibility layer for running Windows programs"
 url="http://www.winehq.com"
 license="LGPL"
-- 
cgit v1.2.3


From 218e723c710e9fd3ccaf38c7a80fbb3b002f6db3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 07:23:34 +0000
Subject: testing/atomic-ops: upgrade to 7.2_alpha4

---
 testing/atomic-ops/APKBUILD | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/testing/atomic-ops/APKBUILD b/testing/atomic-ops/APKBUILD
index aff442f5..7c9dc2cf 100644
--- a/testing/atomic-ops/APKBUILD
+++ b/testing/atomic-ops/APKBUILD
@@ -1,8 +1,10 @@
 # Contributor: Natanael Copa <ncopa@alpinelinux.org>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=atomic-ops
-pkgver=1.2_p20080819
-_realver=1.2+cvs20080819
+_ver=7.2
+_suff=alpha4
+pkgver=${_ver}_${_suff}
+_realver=${_ver}${_suff}
 pkgrel=0
 pkgdesc="A library for atomic operations"
 url="http://www.hpl.hp.com/research/linux/atomic_ops/download.php4"
@@ -11,17 +13,22 @@ depends=""
 makedepends=""
 install=
 subpackages=
-source="http://ftp.de.debian.org/debian/pool/main/liba/libatomic-ops/libatomic-ops_$_realver.orig.tar.gz"
+source="http://www.hpl.hp.com/research/linux/atomic_ops/download/libatomic_ops-$_realver.tar.gz"
 
+_builddir="$srcdir"/libatomic_ops-${_realver}
 build() {
-	cd "$srcdir"/libatomic_ops-${pkgver%_p*}
-
+	cd "$_builddir"
+	chmod +x install-sh
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="bf26c062f28796e3daaab586a38abec1  libatomic-ops_1.2+cvs20080819.orig.tar.gz"
+md5sums="e82723a24fd846fe37bd6a03728776e1  libatomic_ops-7.2alpha4.tar.gz"
-- 
cgit v1.2.3


From bb4fe9a6a8424f1b3f73e2b58d22894a13601e81 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 07:39:08 +0000
Subject: main/libc0.9.32: bugfix. typo. remove scsi.h propely

---
 main/libc0.9.32/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 7ef67dd2..7dc33f12 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100427
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=1
+pkgrel=2
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -68,7 +68,7 @@ package() {
 		CROSS="$CROSS" install install_utils
 	install -Dm755 extra/scripts/getent "$pkgdir"/usr/bin/getent
 	# provided by linux-headers
-	rm -f "$ppkgdir"/usr/include/scsi/scsi.h
+	rm -f "$pkgdir"/usr/include/scsi/scsi.h
 }
 
 dev() {
-- 
cgit v1.2.3


From c6947a4c96106e02b6ed1a9db1a2cc1d56ad3a7f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 07:59:36 +0000
Subject: testing/hardinfo: we dont need bash for configure script

---
 testing/hardinfo/APKBUILD | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testing/hardinfo/APKBUILD b/testing/hardinfo/APKBUILD
index 4081e84c..30b57949 100644
--- a/testing/hardinfo/APKBUILD
+++ b/testing/hardinfo/APKBUILD
@@ -14,6 +14,8 @@ _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
 	patch -p1 < "$srcdir"/fixsensors.patch || return 1
+	# configure scrip says bash but bb ash works just fine
+	sed -i -e '1,1s/bash/sh/' configure
 }
 
 build() { 
-- 
cgit v1.2.3


From 409916aaa24d63b1f1092a0bc62cb03a579beb4e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 08:22:46 +0000
Subject: testing/libtirpc: we dont use -lnsl with uclibc nowdays

---
 testing/libtirpc/APKBUILD | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testing/libtirpc/APKBUILD b/testing/libtirpc/APKBUILD
index d8ae675a..d77553d5 100644
--- a/testing/libtirpc/APKBUILD
+++ b/testing/libtirpc/APKBUILD
@@ -17,6 +17,8 @@ prepare() {
 	# uclibc does not provide nis.h so provide our own
 	mkdir src/rpcsvc
 	cp "$srcdir"/nis.h src/rpcsvc/
+	# we dont have nsl
+	sed -i -e "/^libtirpc_la_LDFLAGS/s/-lnsl//" src/Makefile.in
 }
 
 build() {
-- 
cgit v1.2.3


From c387a79f51c320e0c8474dc947b9f1f83e2b0121 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 08:58:19 +0000
Subject: testing/mp3info: dont depend on uclibc

---
 testing/mp3info/APKBUILD | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testing/mp3info/APKBUILD b/testing/mp3info/APKBUILD
index 6a52c3b6..92aee723 100644
--- a/testing/mp3info/APKBUILD
+++ b/testing/mp3info/APKBUILD
@@ -6,7 +6,7 @@ pkgrel=0
 pkgdesc="An MP3 technical info viewer and ID3 1.x tag editor"
 url="http://www.ibiblio.org/mp3info/"
 license="GPL"
-depends="uclibc ncurses"
+depends=
 makedepends="ncurses-dev"
 subpackages=""
 source="ftp://ftp.ibiblio.org/pub/linux/apps/sound/mp3-utils/mp3info/mp3info-0.8.5a.tgz
@@ -18,6 +18,10 @@ build() {
 	patch -p1 -i "$srcdir"/escape_chars.patch || return 1
 
 	make mp3info || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	install -Dm755 mp3info "$pkgdir"/usr/bin/mp3info
 	install -Dm644 mp3info.1 "$pkgdir"/usr/share/man/man1/mp3info.1
 
-- 
cgit v1.2.3


From eb9243f1705ae561674d7daeec22b30d54281094 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 09:37:02 +0000
Subject: main/lvm2: fix location for libdevmapper.so

---
 main/lvm2/APKBUILD | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/main/lvm2/APKBUILD b/main/lvm2/APKBUILD
index 6420b9d4..33d949b5 100644
--- a/main/lvm2/APKBUILD
+++ b/main/lvm2/APKBUILD
@@ -31,7 +31,9 @@ build () {
 
 package() {
 	cd "$srcdir"/LVM2.$pkgver
-	make -j1 DESTDIR="$pkgdir" install || return 1
+	make -j1 DESTDIR="$pkgdir" \
+		usrlibdir="$pkgdir"/lib \
+		install || return 1
 
 	install -d "$pkgdir"/etc/lvm/archive "$pkgdir"/etc/lvm/backup
 	install -Dm755 "$srcdir"/lvm.initd "$pkgdir"/etc/init.d/lvm
-- 
cgit v1.2.3


From 9636f4e3d2264cb0ef653e57e044c775c9a08c64 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 09:56:27 +0000
Subject: testin/opensips-cp: upgrade checksum

seems like it changed upstream
---
 testing/opensips-cp/APKBUILD | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testing/opensips-cp/APKBUILD b/testing/opensips-cp/APKBUILD
index 3d7ea8c7..58ad2d9d 100644
--- a/testing/opensips-cp/APKBUILD
+++ b/testing/opensips-cp/APKBUILD
@@ -14,8 +14,12 @@ options="!strip"
 source="http://downloads.sourceforge.net/$pkgname/${pkgname}_$pkgver.tgz"
 
 build() {
+	return 0
+}
+
+package() {
 	mkdir -p "$pkgdir"/usr/share/webapps
 	cp -r "$srcdir"/$pkgname "$pkgdir"/usr/share/webapps/$pkgname
 }
 
-md5sums="c9b4f4476e231e0d64682c2b07c66965  opensips-cp_2.0.tgz"
+md5sums="a9c3b142c7f74eb0201ae2ab0b252c32  opensips-cp_2.0.tgz"
-- 
cgit v1.2.3


From 8321ebf63f81215fe05c1e3a06d5b4640119d098 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 12:24:06 +0000
Subject: testing/osmo: upgrade to 0.2.10

---
 testing/osmo/APKBUILD                   | 29 +++++++++++++++++++++--------
 testing/osmo/osmo-0.2.10-build-mo.patch | 20 ++++++++++++++++++++
 2 files changed, 41 insertions(+), 8 deletions(-)
 create mode 100644 testing/osmo/osmo-0.2.10-build-mo.patch

diff --git a/testing/osmo/APKBUILD b/testing/osmo/APKBUILD
index 4c3145c0..489874e3 100644
--- a/testing/osmo/APKBUILD
+++ b/testing/osmo/APKBUILD
@@ -1,24 +1,37 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=osmo
-pkgver=0.2.8
-pkgrel=1
+pkgver=0.2.10
+pkgrel=0
 pkgdesc="A handy personal organizer"
 url="http://clayo.org/osmo/"
 license="GPL"
-makedepends="gtk+-dev libnotify-dev libxml2-dev"
+makedepends="gtk+-dev libnotify-dev libxml2-dev autoconf automake"
 install=
 subpackages="$pkgname-doc"
-source="http://downloads.sourceforge.net/$pkgname-pim/$pkgname-$pkgver.tar.gz"
+source="http://downloads.sourceforge.net/$pkgname-pim/$pkgname-$pkgver.tar.gz
+	osmo-0.2.10-build-mo.patch
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		msg "Applying ${i##*/}"
+		patch -p1 -i "$i" || return 1
+	done
+	aclocal && autoconf && automake
+}
 
 build() {
-	cd "$srcdir"/$pkgname-$pkgver
+	cd "$_builddir"
 	./configure --prefix=/usr || return 1
 	make || return 1
 }
 
 package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install || return 1
+	cd "$_builddir"
+	make -j1 DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="7fa83efd27cd3ecc54e73f0ec4e91d81  osmo-0.2.8.tar.gz"
+md5sums="a774db748228efee96186158d553ade9  osmo-0.2.10.tar.gz
+6c9939fd4df9d25e1a220585e6875c78  osmo-0.2.10-build-mo.patch"
diff --git a/testing/osmo/osmo-0.2.10-build-mo.patch b/testing/osmo/osmo-0.2.10-build-mo.patch
new file mode 100644
index 00000000..ac1b9aa2
--- /dev/null
+++ b/testing/osmo/osmo-0.2.10-build-mo.patch
@@ -0,0 +1,20 @@
+diff --git a/po/Makefile.am b/po/Makefile.am
+index b3c904a..f0ee467 100644
+--- a/po/Makefile.am
++++ b/po/Makefile.am
+@@ -16,8 +16,8 @@ all: $(MOFILES)
+ 
+ update-po: $(DOMAIN).pot $(POFILES) $(MOFILES)
+ 
+-%.mo: skip
+-	@po=$(@:.mo=.po); if test $$po -nt $@ ; then $(MSGFMT) -c --statistics $$po -o $@; echo "$@ updated."; fi
++%.mo: %.po
++	@$(MSGFMT) -c --statistics $^ -o $@; echo "$@ updated."
+ 
+ %.po: $(DOMAIN).pot
+ 	$(MSGMERGE) $@ $< -o $@.in && mv $@.in $@
+@@ -41,4 +41,3 @@ uninstall-local:
+ clean-local:
+ 	rm -rf *.mo
+ 
+-skip:
-- 
cgit v1.2.3


From 0b20870496b49f18e9811d7e104b5d73829364f4 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 12:39:18 +0000
Subject: testing/rrdtool: dont depend on uclibc

---
 testing/rrdcollect/APKBUILD | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/testing/rrdcollect/APKBUILD b/testing/rrdcollect/APKBUILD
index cf4c623d..c0ffb977 100644
--- a/testing/rrdcollect/APKBUILD
+++ b/testing/rrdcollect/APKBUILD
@@ -2,11 +2,11 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=rrdcollect
 pkgver=0.2.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Read system statistical data and feed it to RRDtool"
 url="http://rrdcollect.sourceforge.net/"
 license="GPL"
-depends="uclibc libpcap rrdtool"
+depends="rrdtool"
 makedepends="libpcap-dev"
 install=
 subpackages="$pkgname-doc" 
@@ -20,6 +20,10 @@ build() {
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 
 }
-- 
cgit v1.2.3


From 904836c378b25be70720eb39eb09df7c7752cfa8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 12:49:24 +0000
Subject: testing/spandsp: upgrade to 0.0.5

---
 testing/spandsp/APKBUILD | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/testing/spandsp/APKBUILD b/testing/spandsp/APKBUILD
index dd1f227a..bcb5818d 100644
--- a/testing/spandsp/APKBUILD
+++ b/testing/spandsp/APKBUILD
@@ -1,28 +1,31 @@
 # Contributor: 
 # Maintainer: 
 pkgname=spandsp
-pkgver=0.0.5_pre4
-_ver=0.0.5pre4
+pkgver=0.0.5
 pkgrel=0
 pkgdesc="library to use DSP functions for telephony"
 url="http://www.soft-switch.org/"
 license="GPL"
-depends="uclibc tiff"
+depends=
 makedepends="tiff-dev"
 install=
 subpackages="$pkgname-dev"
-source="http://www.soft-switch.org/downloads/spandsp/$pkgname-$_ver.tgz"
+source="http://www.soft-switch.org/downloads/spandsp/$pkgname-$pkgver.tgz"
 
+_builddir="$srcdir/$pkgname-$pkgver"
 build() {
-	cd "$srcdir/$pkgname-0.0.5"
-
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make -j1 DESTDIR="$pkgdir" install
 
 }
 
-md5sums="fe83ed37a7831f0dd38e7ef4e7e6fd9e  spandsp-0.0.5pre4.tgz"
+md5sums="fe83ed37a7831f0dd38e7ef4e7e6fd9e  spandsp-0.0.5.tgz"
-- 
cgit v1.2.3


From e1e098de972546f5fb9194b71bde04cfa12f3c97 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 14:15:28 +0000
Subject: unstable/vlc: moved from testing

it does not build
---
 testing/vlc/APKBUILD      | 90 -----------------------------------------------
 testing/vlc/uclibc.patch  | 65 ----------------------------------
 unstable/vlc/APKBUILD     | 90 +++++++++++++++++++++++++++++++++++++++++++++++
 unstable/vlc/uclibc.patch | 65 ++++++++++++++++++++++++++++++++++
 4 files changed, 155 insertions(+), 155 deletions(-)
 delete mode 100644 testing/vlc/APKBUILD
 delete mode 100644 testing/vlc/uclibc.patch
 create mode 100644 unstable/vlc/APKBUILD
 create mode 100644 unstable/vlc/uclibc.patch

diff --git a/testing/vlc/APKBUILD b/testing/vlc/APKBUILD
deleted file mode 100644
index d28ddf07..00000000
--- a/testing/vlc/APKBUILD
+++ /dev/null
@@ -1,90 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=vlc
-pkgver=1.0.0
-pkgrel=0
-pkgdesc="A multi-platform MPEG, VCD/DVD, and DivX player"
-url="http://www.videolan.org/vlc/"
-license="GPL-2"
-subpackages="$pkgname-dev $pkgname-doc"
-#depends="libnotify a52dec fluidsynth zvbi libdvbpsi lirc-utils libdca hal 
-#	libproxy sdl_image libdvdnav>=4.1.3 lua libxv libv4l libcddb smbclient
-#	libmatroska taglib sysfsutils libmpcdec ffmpeg>=0.5 libshout libmad
-#	qt fribidi libmpeg2 libmodplug avahi ttf-dejavu"
-depends="ttf-dejavu"
-makedepends="
-	a52dec-dev
-	alsa-lib-dev
-	dbus-dev
-	ffmpeg-dev
-	fribidi-dev
-	gtk+-dev
-	libgcrypt-dev
-	libice-dev
-	libiconv-dev
-	libmad-dev
-	libmpeg2-dev
-	libnotify-dev
-	libogg-dev
-	libsm-dev
-	libx11-dev
-	libxext-dev
-	libxv-dev
-	lua-dev
-	mesa-dev
-	pkgconfig
-	sdl-dev
-	sysfsutils-dev
-	x264-dev
-	"
-source="http://download.videolan.org/pub/videolan/$pkgname/$pkgver/$pkgname-$pkgver.tar.bz2
-	uclibc.patch
-	"
-
-build ()
-{
-	cd "$srcdir"/$pkgname-$pkgver
-	sed -i -e 's:/usr/share/fonts/truetype/freefont/FreeSerifBold.ttf:/usr/share/fonts/TTF/DejaVuSerif-Bold.ttf:' modules/misc/freetype.c
-
-	patch -p1 < ../uclibc.patch || return 1
-	export CFLAGS="$CFLAGS -D_GNU_SOURCE"
-
-	./configure --prefix=/usr \
-		--disable-mmx \
-		--disable-nls \
-		--disable-optimizations \
-		--disable-qt4 --disable-skins2 \
-		--disable-rpath \
-		--enable-httpd \
-		--enable-realrtsp \
-		--enable-sout \
-		--enable-vlm \
-		|| return 1
-
-#		--enable-dvdread \
-#		--enable-dvdnav \
-#		--enable-qt4 \
-#		--enable-faad \
-#		--enable-skins2 \
-#		--enable-dvb \
-#		--enable-v4l \
-#		--enable-theora \
-#		--enable-flac \
-#		--enable-snapshot \
-#		--enable-hal \
-#		--enable-dbus \
-#		--enable-dbus-control \
-#		--enable-lirc \
-#		--enable-shout \
-#		--enable-pvr \
-
-	make || return 1
-	make DESTDIR="$pkgdir"/ install || return 1
-	for res in 16 32 48 128; do
-		install -D -m644 share/vlc${res}x${res}.png \
-			"$pkgdir"/usr/share/icons/hicolor/${res}x${res}/apps/vlc.png || return 1
-	done
-	rm -rf "$pkgdir"/usr/lib/mozilla
-}
-
-md5sums="fc78904ab5fa73f518d8fe4e852e7f67  vlc-1.0.0.tar.bz2
-2a16bf6c14a94f41490872aa189db755  uclibc.patch"
diff --git a/testing/vlc/uclibc.patch b/testing/vlc/uclibc.patch
deleted file mode 100644
index f71b189a..00000000
--- a/testing/vlc/uclibc.patch
+++ /dev/null
@@ -1,65 +0,0 @@
---- a/src/misc/linux_specific.c	2009-07-08 09:29:41.000000000 +0000
-+++ b/src/misc/linux_specific.c	2009-07-08 09:30:47.000000000 +0000
-@@ -72,14 +72,14 @@
- }
- #endif
- 
--#ifdef __GLIBC__
-+#if defined(__GLIBC__) && !defined(__UCLIBC__)
- # include <gnu/libc-version.h>
- # include <stdlib.h>
- #endif
- 
- void system_Init (libvlc_int_t *libvlc, int *argc, const char *argv[])
- {
--#ifdef __GLIBC__
-+#if defined(__GLIBC__) && !defined(__UCLIBC__)
-     const char *glcv = gnu_get_libc_version ();
- 
-     /* gettext in glibc 2.5-2.7 is not thread-safe. LibVLC keeps crashing,
---- a/src/control/vlm.c	2009-07-09 09:21:55.000000000 +0000
-+++ b/src/control/vlm.c	2009-07-09 09:22:24.000000000 +0000
-@@ -21,6 +21,10 @@
-  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
-  *****************************************************************************/
- 
-+#ifdef HAVE_CONFIG_H
-+# include "config.h"
-+#endif
-+
- #include <vlc/libvlc.h>
- #include <vlc/libvlc_vlm.h>
- #include <vlc_es.h>
---- a/src/misc/mtime.c	2009-07-09 11:57:46.000000000 +0000
-+++ b/src/misc/mtime.c	2009-07-09 13:48:16.000000000 +0000
-@@ -78,7 +78,7 @@
- #  define _POSIX_CLOCK_SELECTION (-1)
- #endif
- 
--# if (_POSIX_CLOCK_SELECTION < 0)
-+# if (_POSIX_CLOCK_SELECTION < 0) || defined(__UCLIBC__)
- /*
-  * We cannot use the monotonic clock is clock selection is not available,
-  * as it would screw vlc_cond_timedwait() completely. Instead, we have to
---- a/src/misc/threads.c	2009-07-09 13:54:08.000000000 +0000
-+++ b/src/misc/threads.c	2009-07-09 13:54:32.000000000 +0000
-@@ -474,7 +474,7 @@
-    /* Fairly outdated POSIX support (that was defined in 2001) */
- #  define _POSIX_CLOCK_SELECTION (-1)
- # endif
--# if (_POSIX_CLOCK_SELECTION >= 0)
-+# if (_POSIX_CLOCK_SELECTION >= 0) && !defined(__UCLIBC__)
-     /* NOTE: This must be the same clock as the one in mtime.c */
-     pthread_condattr_setclock (&attr, CLOCK_MONOTONIC);
- # endif
---- a/modules/stream_filter/decomp.c	2009-07-09 14:10:09.000000000 +0000
-+++ b/modules/stream_filter/decomp.c	2009-07-09 14:11:37.000000000 +0000
-@@ -28,7 +28,7 @@
- #include <vlc_network.h>
- #include <assert.h>
- #include <unistd.h>
--#ifndef _POSIX_SPAWN
-+#if !defined(_POSIX_SPAWN) || defined(__UCLIBC__)
- # define _POSIX_SPAWN (-1)
- #endif
- #include <fcntl.h>
diff --git a/unstable/vlc/APKBUILD b/unstable/vlc/APKBUILD
new file mode 100644
index 00000000..d28ddf07
--- /dev/null
+++ b/unstable/vlc/APKBUILD
@@ -0,0 +1,90 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=vlc
+pkgver=1.0.0
+pkgrel=0
+pkgdesc="A multi-platform MPEG, VCD/DVD, and DivX player"
+url="http://www.videolan.org/vlc/"
+license="GPL-2"
+subpackages="$pkgname-dev $pkgname-doc"
+#depends="libnotify a52dec fluidsynth zvbi libdvbpsi lirc-utils libdca hal 
+#	libproxy sdl_image libdvdnav>=4.1.3 lua libxv libv4l libcddb smbclient
+#	libmatroska taglib sysfsutils libmpcdec ffmpeg>=0.5 libshout libmad
+#	qt fribidi libmpeg2 libmodplug avahi ttf-dejavu"
+depends="ttf-dejavu"
+makedepends="
+	a52dec-dev
+	alsa-lib-dev
+	dbus-dev
+	ffmpeg-dev
+	fribidi-dev
+	gtk+-dev
+	libgcrypt-dev
+	libice-dev
+	libiconv-dev
+	libmad-dev
+	libmpeg2-dev
+	libnotify-dev
+	libogg-dev
+	libsm-dev
+	libx11-dev
+	libxext-dev
+	libxv-dev
+	lua-dev
+	mesa-dev
+	pkgconfig
+	sdl-dev
+	sysfsutils-dev
+	x264-dev
+	"
+source="http://download.videolan.org/pub/videolan/$pkgname/$pkgver/$pkgname-$pkgver.tar.bz2
+	uclibc.patch
+	"
+
+build ()
+{
+	cd "$srcdir"/$pkgname-$pkgver
+	sed -i -e 's:/usr/share/fonts/truetype/freefont/FreeSerifBold.ttf:/usr/share/fonts/TTF/DejaVuSerif-Bold.ttf:' modules/misc/freetype.c
+
+	patch -p1 < ../uclibc.patch || return 1
+	export CFLAGS="$CFLAGS -D_GNU_SOURCE"
+
+	./configure --prefix=/usr \
+		--disable-mmx \
+		--disable-nls \
+		--disable-optimizations \
+		--disable-qt4 --disable-skins2 \
+		--disable-rpath \
+		--enable-httpd \
+		--enable-realrtsp \
+		--enable-sout \
+		--enable-vlm \
+		|| return 1
+
+#		--enable-dvdread \
+#		--enable-dvdnav \
+#		--enable-qt4 \
+#		--enable-faad \
+#		--enable-skins2 \
+#		--enable-dvb \
+#		--enable-v4l \
+#		--enable-theora \
+#		--enable-flac \
+#		--enable-snapshot \
+#		--enable-hal \
+#		--enable-dbus \
+#		--enable-dbus-control \
+#		--enable-lirc \
+#		--enable-shout \
+#		--enable-pvr \
+
+	make || return 1
+	make DESTDIR="$pkgdir"/ install || return 1
+	for res in 16 32 48 128; do
+		install -D -m644 share/vlc${res}x${res}.png \
+			"$pkgdir"/usr/share/icons/hicolor/${res}x${res}/apps/vlc.png || return 1
+	done
+	rm -rf "$pkgdir"/usr/lib/mozilla
+}
+
+md5sums="fc78904ab5fa73f518d8fe4e852e7f67  vlc-1.0.0.tar.bz2
+2a16bf6c14a94f41490872aa189db755  uclibc.patch"
diff --git a/unstable/vlc/uclibc.patch b/unstable/vlc/uclibc.patch
new file mode 100644
index 00000000..f71b189a
--- /dev/null
+++ b/unstable/vlc/uclibc.patch
@@ -0,0 +1,65 @@
+--- a/src/misc/linux_specific.c	2009-07-08 09:29:41.000000000 +0000
++++ b/src/misc/linux_specific.c	2009-07-08 09:30:47.000000000 +0000
+@@ -72,14 +72,14 @@
+ }
+ #endif
+ 
+-#ifdef __GLIBC__
++#if defined(__GLIBC__) && !defined(__UCLIBC__)
+ # include <gnu/libc-version.h>
+ # include <stdlib.h>
+ #endif
+ 
+ void system_Init (libvlc_int_t *libvlc, int *argc, const char *argv[])
+ {
+-#ifdef __GLIBC__
++#if defined(__GLIBC__) && !defined(__UCLIBC__)
+     const char *glcv = gnu_get_libc_version ();
+ 
+     /* gettext in glibc 2.5-2.7 is not thread-safe. LibVLC keeps crashing,
+--- a/src/control/vlm.c	2009-07-09 09:21:55.000000000 +0000
++++ b/src/control/vlm.c	2009-07-09 09:22:24.000000000 +0000
+@@ -21,6 +21,10 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
+  *****************************************************************************/
+ 
++#ifdef HAVE_CONFIG_H
++# include "config.h"
++#endif
++
+ #include <vlc/libvlc.h>
+ #include <vlc/libvlc_vlm.h>
+ #include <vlc_es.h>
+--- a/src/misc/mtime.c	2009-07-09 11:57:46.000000000 +0000
++++ b/src/misc/mtime.c	2009-07-09 13:48:16.000000000 +0000
+@@ -78,7 +78,7 @@
+ #  define _POSIX_CLOCK_SELECTION (-1)
+ #endif
+ 
+-# if (_POSIX_CLOCK_SELECTION < 0)
++# if (_POSIX_CLOCK_SELECTION < 0) || defined(__UCLIBC__)
+ /*
+  * We cannot use the monotonic clock is clock selection is not available,
+  * as it would screw vlc_cond_timedwait() completely. Instead, we have to
+--- a/src/misc/threads.c	2009-07-09 13:54:08.000000000 +0000
++++ b/src/misc/threads.c	2009-07-09 13:54:32.000000000 +0000
+@@ -474,7 +474,7 @@
+    /* Fairly outdated POSIX support (that was defined in 2001) */
+ #  define _POSIX_CLOCK_SELECTION (-1)
+ # endif
+-# if (_POSIX_CLOCK_SELECTION >= 0)
++# if (_POSIX_CLOCK_SELECTION >= 0) && !defined(__UCLIBC__)
+     /* NOTE: This must be the same clock as the one in mtime.c */
+     pthread_condattr_setclock (&attr, CLOCK_MONOTONIC);
+ # endif
+--- a/modules/stream_filter/decomp.c	2009-07-09 14:10:09.000000000 +0000
++++ b/modules/stream_filter/decomp.c	2009-07-09 14:11:37.000000000 +0000
+@@ -28,7 +28,7 @@
+ #include <vlc_network.h>
+ #include <assert.h>
+ #include <unistd.h>
+-#ifndef _POSIX_SPAWN
++#if !defined(_POSIX_SPAWN) || defined(__UCLIBC__)
+ # define _POSIX_SPAWN (-1)
+ #endif
+ #include <fcntl.h>
-- 
cgit v1.2.3


From e5ab44d7e4883c6866238ff45489c3477bd9bc76 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 14:45:27 +0000
Subject: testing/wine: add patch for dn_skipname

---
 testing/wine/APKBUILD          |  5 ++++-
 testing/wine/dn_skipname.patch | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 testing/wine/dn_skipname.patch

diff --git a/testing/wine/APKBUILD b/testing/wine/APKBUILD
index 30406ef6..0f1a2bda 100644
--- a/testing/wine/APKBUILD
+++ b/testing/wine/APKBUILD
@@ -11,12 +11,14 @@ makedepends="fontconfig-dev openldap-dev libxslt-dev libxxf86dga-dev
 	libpng-dev jpeg-dev freetype-dev"
 # lcms
 source="http://ibiblio.org/pub/linux/system/emulators/$pkgname/$pkgname-$pkgver.tar.bz2
+	dn_skipname.patch
 	libpng14.patch"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 -i "$srcdir"/libpng14.patch
+	patch -p1 -i "$srcdir"/libpng14.patch || return 1
+	patch -p1 -i "$srcdir"/dn_skipname.patch || return 1
 }
 
 build() {
@@ -33,4 +35,5 @@ package() {
 	mkdir -p "$pkgdir"/etc/wine
 }
 md5sums="ef5947bcb9667b75b8de4a2ce16d0ec2  wine-1.1.38.tar.bz2
+6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch
 51f78b18168d5abd78411e9e66458d55  libpng14.patch"
diff --git a/testing/wine/dn_skipname.patch b/testing/wine/dn_skipname.patch
new file mode 100644
index 00000000..99ecf831
--- /dev/null
+++ b/testing/wine/dn_skipname.patch
@@ -0,0 +1,38 @@
+--- ./dlls/dnsapi/ns_parse.c.orig
++++ ./dlls/dnsapi/ns_parse.c
+@@ -69,6 +69,35 @@
+ } while (0)
+ 
+ /* Public. */
++#ifdef __UCLIBC__
++int
++dn_skipname(const u_char *comp_dn, const u_char *eom)
++{
++       const u_char *cp;
++       int n;
++
++       cp = comp_dn;
++       while (cp < eom && (n = *cp++)) {
++               /*
++                * check for indirection
++                */
++               switch (n & INDIR_MASK) {
++               case 0:                 /* normal case, n == len */
++                       cp += n;
++                       continue;
++               case INDIR_MASK:        /* indirection */
++                       cp++;
++                       break;
++               default:                /* illegal type */
++                       return (-1);
++               }
++               break;
++       }
++       if (cp > eom)
++               return (-1);
++       return (cp - comp_dn);
++}
++#endif
+ 
+ static int
+ dns_ns_skiprr(const u_char *ptr, const u_char *eom, ns_sect section, int count) {
-- 
cgit v1.2.3


From fd595fa6fb507fc70865eee020a307a02d182cef Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 14:54:33 +0000
Subject: testing/wine: upgrade to 1.1.43

---
 testing/wine/APKBUILD       | 13 +++-----
 testing/wine/libpng14.patch | 76 ---------------------------------------------
 2 files changed, 5 insertions(+), 84 deletions(-)
 delete mode 100644 testing/wine/libpng14.patch

diff --git a/testing/wine/APKBUILD b/testing/wine/APKBUILD
index 0f1a2bda..11945826 100644
--- a/testing/wine/APKBUILD
+++ b/testing/wine/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wine
-pkgver=1.1.38
-pkgrel=1
+pkgver=1.1.43
+pkgrel=0
 pkgdesc="A compatibility layer for running Windows programs"
 url="http://www.winehq.com"
 license="LGPL"
@@ -11,13 +11,11 @@ makedepends="fontconfig-dev openldap-dev libxslt-dev libxxf86dga-dev
 	libpng-dev jpeg-dev freetype-dev"
 # lcms
 source="http://ibiblio.org/pub/linux/system/emulators/$pkgname/$pkgname-$pkgver.tar.bz2
-	dn_skipname.patch
-	libpng14.patch"
+	dn_skipname.patch"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 -i "$srcdir"/libpng14.patch || return 1
 	patch -p1 -i "$srcdir"/dn_skipname.patch || return 1
 }
 
@@ -34,6 +32,5 @@ package() {
 	make prefix="$pkgdir"/usr install || return 1
 	mkdir -p "$pkgdir"/etc/wine
 }
-md5sums="ef5947bcb9667b75b8de4a2ce16d0ec2  wine-1.1.38.tar.bz2
-6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch
-51f78b18168d5abd78411e9e66458d55  libpng14.patch"
+md5sums="78e3c8d8d39625d7959ffe070a59028d  wine-1.1.43.tar.bz2
+6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch"
diff --git a/testing/wine/libpng14.patch b/testing/wine/libpng14.patch
deleted file mode 100644
index 14f6ddc0..00000000
--- a/testing/wine/libpng14.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-diff --git a/programs/winemenubuilder/winemenubuilder.c b/programs/winemenubuilder/winemenubuilder.c
-index e14fe81..62165f6 100644
---- a/programs/winemenubuilder/winemenubuilder.c
-+++ b/programs/winemenubuilder/winemenubuilder.c
-@@ -188,8 +188,10 @@ static void *libpng_handle;
- MAKE_FUNCPTR(png_create_info_struct);
- MAKE_FUNCPTR(png_create_write_struct);
- MAKE_FUNCPTR(png_destroy_write_struct);
-+MAKE_FUNCPTR(png_get_error_ptr);
- MAKE_FUNCPTR(png_init_io);
- MAKE_FUNCPTR(png_set_bgr);
-+MAKE_FUNCPTR(png_set_error_fn);
- MAKE_FUNCPTR(png_set_text);
- MAKE_FUNCPTR(png_set_IHDR);
- MAKE_FUNCPTR(png_write_end);
-@@ -209,8 +211,10 @@ static void *load_libpng(void)
-         LOAD_FUNCPTR(png_create_info_struct);
-         LOAD_FUNCPTR(png_create_write_struct);
-         LOAD_FUNCPTR(png_destroy_write_struct);
-+        LOAD_FUNCPTR(png_get_error_ptr);
-         LOAD_FUNCPTR(png_init_io);
-         LOAD_FUNCPTR(png_set_bgr);
-+        LOAD_FUNCPTR(png_set_error_fn);
-         LOAD_FUNCPTR(png_set_IHDR);
-         LOAD_FUNCPTR(png_set_text);
-         LOAD_FUNCPTR(png_write_end);
-@@ -221,6 +225,23 @@ static void *load_libpng(void)
-     return libpng_handle;
- }
- 
-+static void user_error_fn(png_structp png_ptr, png_const_charp error_message)
-+{
-+    jmp_buf *pjmpbuf;
-+
-+    /* This uses setjmp/longjmp just like the default. We can't use the
-+     * default because there's no way to access the jmp buffer in the png_struct
-+     * that works in 1.2 and 1.4 and allows us to dynamically load libpng. */
-+    WINE_ERR("PNG error: %s\n", wine_dbgstr_an(error_message, -1));
-+    pjmpbuf = ppng_get_error_ptr(png_ptr);
-+    longjmp(*pjmpbuf, 1);
-+}
-+
-+static void user_warning_fn(png_structp png_ptr, png_const_charp warning_message)
-+{
-+    WINE_WARN("PNG warning: %s\n", wine_dbgstr_an(warning_message, -1));
-+}
-+
- static BOOL SaveIconResAsPNG(const BITMAPINFO *pIcon, const char *png_filename, LPCWSTR commentW)
- {
-     static const char comment_key[] = "Created from";
-@@ -234,6 +255,7 @@ static BOOL SaveIconResAsPNG(const BITMAPINFO *pIcon, const char *png_filename,
-     int nWidth  = pIcon->bmiHeader.biWidth;
-     int nHeight = pIcon->bmiHeader.biHeight;
-     int nBpp    = pIcon->bmiHeader.biBitCount;
-+    jmp_buf jmpbuf;
- 
-     switch (nBpp)
-     {
-@@ -306,12 +328,12 @@ static BOOL SaveIconResAsPNG(const BITMAPINFO *pIcon, const char *png_filename,
-         !(info_ptr = ppng_create_info_struct(png_ptr)))
-         goto error;
- 
--    if (setjmp(png_jmpbuf(png_ptr)))
-+    if (setjmp(jmpbuf))
-     {
-         /* All future errors jump here */
--        WINE_ERR("png error\n");
-         goto error;
-     }
-+    ppng_set_error_fn(png_ptr, &jmpbuf, user_error_fn, user_warning_fn);
- 
-     ppng_init_io(png_ptr, fp);
-     ppng_set_IHDR(png_ptr, info_ptr, nWidth, nHeight, 8,
--- 
-1.6.3.3
-
-- 
cgit v1.2.3


From 35bf1cf31093542fe2a32efcc1e0fa5205bf477b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 19:30:11 +0000
Subject: testing/pycrypto: bump pkgrel so we rebuild against uclibc nptl

---
 testing/pycrypto/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/pycrypto/APKBUILD b/testing/pycrypto/APKBUILD
index 1ed827ca..7bc5eb0b 100644
--- a/testing/pycrypto/APKBUILD
+++ b/testing/pycrypto/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pycrypto
 pkgver=2.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A collection of cryptographic algorithms and protocols, implemented for use from Python."
 url="http://www.amk.ca/python/code/crypto.html"
 license="GPL"
-- 
cgit v1.2.3


From 3cc23a72157a1f8c4c497814898ff8bcfc5eab14 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 19:34:15 +0000
Subject: testing/twisted: bump pkgrel for rebuild against new uclibc

---
 testing/twisted/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/twisted/APKBUILD b/testing/twisted/APKBUILD
index 684db097..5c6d8541 100644
--- a/testing/twisted/APKBUILD
+++ b/testing/twisted/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=twisted
 pkgver=8.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Asynchronous networking framework written in Python."
 url="http://twistedmatrix.com/"
 license="MIT"
-- 
cgit v1.2.3


From 6f57bb75418bda97eede5a20a5b26aed85808098 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 5 May 2010 19:52:53 +0000
Subject: testing/udev: dont depend on uclibc

---
 testing/udev/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/udev/APKBUILD b/testing/udev/APKBUILD
index de342d4f..0d55e6fd 100644
--- a/testing/udev/APKBUILD
+++ b/testing/udev/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="The userspace dev tools (udev)"
 url="http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html"
 license="GPL"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="uclibc"
+depends=
 makedepends=""
 install=
 source="http://www.kernel.org/pub/linux/utils/kernel/hotplug/$pkgname-$pkgver.tar.bz2
-- 
cgit v1.2.3


From da125d1bdc96f9fdf3c4bdbb96affc69e1c58062 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:20:29 +0000
Subject: main/dbus-glib: let abuild detect shared object deps

---
 main/dbus-glib/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/dbus-glib/APKBUILD b/main/dbus-glib/APKBUILD
index b4d93ca6..4939ca59 100644
--- a/main/dbus-glib/APKBUILD
+++ b/main/dbus-glib/APKBUILD
@@ -6,8 +6,8 @@ pkgdesc="GLib bindings for DBUS"
 url="http://www.freedesktop.org/wiki/Software/DBusBindings"
 license="GPL"
 subpackages="$pkgname-dev $pkgname-doc"
-depends="dbus glib libiconv expat gettext"
-makedepends="pkgconfig dbus-dev glib-dev libiconv-dev gettext-dev g++ expat-dev"
+depends=
+makedepends="pkgconfig dbus-dev glib-dev libiconv-dev gettext-dev expat-dev"
 source="http://dbus.freedesktop.org/releases/$pkgname/$pkgname-$pkgver.tar.gz"
 depends_dev="glib-dev dbus-dev"
 
-- 
cgit v1.2.3


From 99ba2dda0a11692353abef16507b11f96d96ef18 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:22:04 +0000
Subject: main/enchant: upgrade to 1.6.0

---
 main/enchant/APKBUILD | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/main/enchant/APKBUILD b/main/enchant/APKBUILD
index 7eb99567..a2698dac 100644
--- a/main/enchant/APKBUILD
+++ b/main/enchant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=enchant
-pkgver=1.5.0
-pkgrel=2
+pkgver=1.6.0
+pkgrel=0
 pkgdesc="A wrapper library for generic spell checking"
 url="http://www.abisource.com/enchant/"
 license="LGPL"
@@ -11,11 +11,14 @@ depends_dev="glib-dev"
 makedepends="aspell-dev dbus-glib-dev hunspell-dev libiconv-dev gettext-dev"
 source="http://www.abisource.com/downloads/$pkgname/$pkgver/$pkgname-$pkgver.tar.gz"
 
-build () 
-{ 
+build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr --disable-static || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="7dfaed14e142b4a0004b770c9568ed02  enchant-1.5.0.tar.gz"
+md5sums="de11011aff801dc61042828041fb59c7  enchant-1.6.0.tar.gz"
-- 
cgit v1.2.3


From 222b530126ca07b783cd0f0a13b44103c0bb24f8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:22:34 +0000
Subject: main/gcc: depend on libgomp

Its needed when compiling som stuff, even if gcc is not linked to
it itself.
---
 main/gcc/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/gcc/APKBUILD b/main/gcc/APKBUILD
index dfbf2529..f1d8c836 100644
--- a/main/gcc/APKBUILD
+++ b/main/gcc/APKBUILD
@@ -6,11 +6,11 @@ _specsver=0.1.7
 _espfver=0.3.6
 _uclibc_abiver=0.9.32
 
-pkgrel=1
+pkgrel=2
 pkgdesc="The GNU Compiler Collection"
 url="http://gcc.gnu.org"
 license="GPL LGPL"
-depends="binutils libgcc"
+depends="binutils libgcc libgomp"
 makedepends="bison flex gmp-dev mpfr-dev texinfo"
 subpackages="$pkgname-doc libstdc++:libcxx g++:gpp libgcc libgomp"
 source="ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-core-$pkgver.tar.bz2
-- 
cgit v1.2.3


From 3ae134fedaf9ee20d66fe8419c3c21c4c670a2f2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:23:43 +0000
Subject: main/imagemagick: upgrade to 6.6.1.5

---
 main/imagemagick/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/imagemagick/APKBUILD b/main/imagemagick/APKBUILD
index eaaad7d8..3778adc9 100644
--- a/main/imagemagick/APKBUILD
+++ b/main/imagemagick/APKBUILD
@@ -1,9 +1,9 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=imagemagick
-pkgver=6.6.0.10
+pkgver=6.6.1.5
 _pkgver=${pkgver%.*}-${pkgver##*.}
-pkgrel=1
+pkgrel=0
 pkgdesc="A collection of tools and libraries for many image formats"
 url="http://www.imagemagick.org/"
 license="GPL"
@@ -47,4 +47,4 @@ dev() {
 		"$pkgdir"/usr/lib/ImageMagick-$_v/modules-Q16/filters/
 }
 
-md5sums="6aa19d1b08a0dfee5c78de864a8176e8  ImageMagick-6.6.0-10.tar.gz"
+md5sums="ab2468747f3960bdc8d779e89b052860  ImageMagick-6.6.1-5.tar.gz"
-- 
cgit v1.2.3


From 9018b3bd49ab9b88e1da2e5989280f03234106d3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:24:49 +0000
Subject: main/lvm2: bump pkgrel so last fix is applied

---
 main/lvm2/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/lvm2/APKBUILD b/main/lvm2/APKBUILD
index 33d949b5..fb136497 100644
--- a/main/lvm2/APKBUILD
+++ b/main/lvm2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lvm2
 pkgver=2.02.64
-pkgrel=0
+pkgrel=1
 pkgdesc="Logical Volume Manager 2 utilities"
 url="http://sourceware.org/lvm2/"
 license="GPL"
-- 
cgit v1.2.3


From ffe332f6c25834327dc5eaa59ef3eb850c84ee93 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 06:31:51 +0000
Subject: main/flac: refuse to build if libiconv is installed

---
 main/flac/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/flac/APKBUILD b/main/flac/APKBUILD
index 33f097fb..03806b59 100644
--- a/main/flac/APKBUILD
+++ b/main/flac/APKBUILD
@@ -7,7 +7,7 @@ url="http://flac.sourceforge.net/"
 license="custom:Xiph LGPL GPL FDL"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="libogg-dev"
+makedepends="libogg-dev !libiconv"
 source="http://downloads.sf.net/sourceforge/$pkgname/$pkgname-$pkgver.tar.gz
 	"
 
-- 
cgit v1.2.3


From 35be8167678102ab0ef86a602c8fede737c4b7cc Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 08:14:50 +0000
Subject: main/sox: upgrade to 14.3.1

---
 main/sox/APKBUILD | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/main/sox/APKBUILD b/main/sox/APKBUILD
index e5a90283..1f2fdcdd 100644
--- a/main/sox/APKBUILD
+++ b/main/sox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sox
-pkgver=14.3.0
-pkgrel=1
+pkgver=14.3.1
+pkgrel=0
 pkgdesc="The Swiss Army knife of sound processing tools"
 url="http://sox.sourceforge.net/"
 license="GPL LGPL"
@@ -23,6 +23,7 @@ build() {
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--with-dyn-default \
+		--disable-nls \
 		--with-distro="Alpine Linux" || return 1
 	make || return 1
 }
@@ -33,5 +34,5 @@ package() {
 	ln -sf play "$pkgdir"/usr/bin/rec || return 1
 	ln -sf ../man1/sox.1.gz "$pkgdir"/usr/share/man/man7/soxeffect.7
 }
-md5sums="8e3509804e6227273ef84092e1a2fea7  sox-14.3.0.tar.gz
+md5sums="b99871c7bbae84feac9d0d1f010331ba  sox-14.3.1.tar.gz
 d8267f718ba6b4fb2f48c5104af31364  sox-uclibc.patch"
-- 
cgit v1.2.3


From 6c0283f7f164abd4946849b38d5ca437f5075bbd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 08:54:39 +0000
Subject: testing/cdparanoia: dont depend on uclibc

---
 testing/cdparanoia/APKBUILD | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/testing/cdparanoia/APKBUILD b/testing/cdparanoia/APKBUILD
index 7080bfc8..e31d894f 100644
--- a/testing/cdparanoia/APKBUILD
+++ b/testing/cdparanoia/APKBUILD
@@ -2,11 +2,11 @@
 # Maintainer: Michael Mason <ms13sp@gmail.com>
 pkgname=cdparanoia
 pkgver=10.2
-pkgrel=0
+pkgrel=1
 pkgdesc="An audio CD extraction application"
 url="http://www.xiph.org/paranoia"
 license="GPL"
-depends="uclibc"
+depends=
 makedepends="libtool autoconf automake"
 install=
 subpackages="$pkgname-dev"
@@ -26,7 +26,10 @@ build() {
 		--infodir=/usr/share/info
 	make || return 1
 	#make DESTDIR="$pkgdir" install
+}
 
+package() {
+	cd "$srcdir/$pkgname-III-$pkgver"
 	install -m755 -D "$srcdir"/"$pkgname-III-$pkgver"/cdparanoia "$pkgdir"/usr/bin/cdparanoia
 	install -m644 -D "$srcdir"/"$pkgname-III-$pkgver"/interface/libcdda_interface.a "$pkgdir"/usr/lib/libcdda_interface.a
 	install -m755 -D "$srcdir"/"$pkgname-III-$pkgver"/interface/libcdda_interface.so.0."$pkgver" "$pkgdir"/usr/lib/libcdda_interface.so.0."$pkgver"
-- 
cgit v1.2.3


From d40af55829b6a27d7311f56d6c5965c552691cf0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 08:57:03 +0000
Subject: testing/opensips: dont depend on uclibc

---
 testing/opensips/APKBUILD | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/testing/opensips/APKBUILD b/testing/opensips/APKBUILD
index d54b3dec..c148ce22 100644
--- a/testing/opensips/APKBUILD
+++ b/testing/opensips/APKBUILD
@@ -2,16 +2,15 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=opensips
 pkgver=1.5.0
-pkgrel=4
+pkgrel=5
 pkgdesc="Flexible and customizable sip routing engine"
 url="http://www.opensips.org/"
 license="GPL"
-depends="uclibc expat"
+depends=
 makedepends="bison flex expat-dev coreutils"
 install="$pkgname.pre-install $pkgname.post-install"
 subpackages="$pkgname-doc"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver-notls_src.tar.gz
-	$install
 	$pkgname.initd"
 
 build() {
@@ -25,6 +24,10 @@ build() {
 	cd ..
 
 	make prefix=/usr || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver-notls"
 	make prefix=/usr basedir="$pkgdir" install
 	chmod 750 "$pkgdir"/etc/opensips/opensips.cfg
 	install -d "$pkgdir"/var/run/opensips
@@ -32,6 +35,4 @@ build() {
 }
 
 md5sums="ba99592a6e42e8b4dc2d38964420dfec  opensips-1.5.0-notls_src.tar.gz
-3a8a5d3c4c23ce9f2fc60b449ad61820  opensips.pre-install
-d9b551148d2b60466c05b4295b935091  opensips.post-install
 7fb51d35517f7f10cfe6e89139f7060a  opensips.initd"
-- 
cgit v1.2.3


From 11e6153ac00b417647dff916428bf990c93d14bf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:11:51 +0000
Subject: main/xfce4-screenshooter: upgrade to 1.7.9

---
 main/xfce4-screenshooter/APKBUILD | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/main/xfce4-screenshooter/APKBUILD b/main/xfce4-screenshooter/APKBUILD
index bd646537..4b131922 100644
--- a/main/xfce4-screenshooter/APKBUILD
+++ b/main/xfce4-screenshooter/APKBUILD
@@ -1,21 +1,19 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-screenshooter
-pkgver=1.6.0
-pkgrel=1
+pkgver=1.7.9
+pkgrel=0
 pkgdesc="screenshot application for Xfce4"
 url="http://goodies.xfce.org/projects/applications/xfce4-screenshooter"
 license="GPL2"
 subpackages="$pkgname-doc"
 depends=
 makedepends="xfce4-panel-dev intltool hicolor-icon-theme libsm-dev
-	e2fsprogs-dev"
+	e2fsprogs-dev libsoup-dev libxext-dev"
 install="xfce4-screenshooter.post-install xfce4-screenshooter.post-upgrade
 	xfce4-screenshooter.post-deinstall"
-source="http://goodies.xfce.org/releases/$pkgname/$pkgname-$pkgver.tar.gz
-	$install"
+source="http://archive.xfce.org/src/apps/xfce4-screenshooter/${pkgver%.*}/xfce4-screenshooter-$pkgver.tar.bz2"
 
-build ()
-{
+build () {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
@@ -23,10 +21,11 @@ build ()
 		--localstatedir=/var \
 		--disable-static
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="331750879b966eec639eb3fe3045cb16  xfce4-screenshooter-1.6.0.tar.gz
-db51db79681eadc47be4932355a77c25  xfce4-screenshooter.post-install
-db51db79681eadc47be4932355a77c25  xfce4-screenshooter.post-upgrade
-db51db79681eadc47be4932355a77c25  xfce4-screenshooter.post-deinstall"
+md5sums="c01d1cf3830bf8d60e09c0cdd223034c  xfce4-screenshooter-1.7.9.tar.bz2"
-- 
cgit v1.2.3


From db73a73fee08a867adfd56a01fe7fdc96f966ba1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:18:20 +0000
Subject: main/abiword: upgrade to 2.8.4

---
 main/abiword/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/abiword/APKBUILD b/main/abiword/APKBUILD
index 9ba0eb5c..eb33e1f6 100644
--- a/main/abiword/APKBUILD
+++ b/main/abiword/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=abiword
-pkgver=2.8.3
-pkgrel=1
+pkgver=2.8.4
+pkgrel=0
 pkgdesc="A fully-featured word processor"
 url="http://www.abisource.com"
 license="GPL"
@@ -21,4 +21,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
-md5sums="8984b09663e1514ca0e361b0627ea285  abiword-2.8.3.tar.gz"
+md5sums="f782ecb8e07d07ec179f7a143353cc29  abiword-2.8.4.tar.gz"
-- 
cgit v1.2.3


From 703ffea29a9e076ab78e0e3706b6faab123b89a0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:21:04 +0000
Subject: main/atop: upgrade to 1.25

---
 main/atop/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/atop/APKBUILD b/main/atop/APKBUILD
index 59edf26d..2a9eafdb 100644
--- a/main/atop/APKBUILD
+++ b/main/atop/APKBUILD
@@ -1,14 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=atop
-pkgver=1.24
-pkgrel=2
+pkgver=1.25
+pkgrel=0
 pkgdesc="Resource-specific view of processes"
 url="http://www.atcomputing.nl/Tools/atop"
 license="GPL-2"
 depends=
 makedepends="zlib-dev ncurses-dev"
 subpackages="$pkgname-doc"
-source="http://www.atoptool.nl/packages/atop-$pkgver.tar.gz
+source="http://www.atoptool.nl/download/atop-$pkgver.tar.gz
 	atop-bb-compat.patch
 	atop.initd"
 
@@ -40,6 +40,6 @@ package() {
 
 }
 
-md5sums="46522f7da28460e810e193ab46907af9  atop-1.24.tar.gz
+md5sums="8b67756a71ca49728b402da369c4f26e  atop-1.25.tar.gz
 a4119e314cdc6d50bf027add32e1902b  atop-bb-compat.patch
 06aba14ddeadbb1d0c3594536785213b  atop.initd"
-- 
cgit v1.2.3


From 78a8c79d41e412b1c32b4de62c6d8d4f1e15b5d5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:46:41 +0000
Subject: main/gobject-introspection: upgrade to 0.6.10

---
 main/gobject-introspection/APKBUILD | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/main/gobject-introspection/APKBUILD b/main/gobject-introspection/APKBUILD
index da6aafb2..ebbefb1c 100644
--- a/main/gobject-introspection/APKBUILD
+++ b/main/gobject-introspection/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gobject-introspection
-pkgver=0.6.9
-pkgrel=1
+pkgver=0.6.10
+pkgrel=0
 pkgdesc="Introspection system for GObject-based libraries"
 url="http://live.gnome.org/GObjectInstrospection"
 license="LGPL GPL"
 makedepends="flex bison glib-dev libffi-dev python-dev"
-depends="python glib-dev libffi-dev"
+depends="python glib-dev libffi-dev cairo-dev"
 source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/0.6/$pkgname-$pkgver.tar.bz2"
 
 # since this is a dev package by definition  we dont bother separate -dev
@@ -17,7 +17,8 @@ build() {
 	cd "$_builddir"
 	export CPPFLAGS=
 	./configure --prefix=/usr --disable-static || return 1
-	make || return 1
+	# FIXME: parallel builds is broken
+	make -j1 || return 1
 }
 
 package() {
@@ -32,4 +33,4 @@ libgirepository() {
 	mv "$pkgdir"/usr/lib/libgirepository*.so* "$subpkgdir"/usr/lib/
 }
 
-md5sums="37cb473c6bafd03c4a48e1f37e19cc04  gobject-introspection-0.6.9.tar.bz2"
+md5sums="cdf7af644a0407c3fd2d57ba2bb3549f  gobject-introspection-0.6.10.tar.bz2"
-- 
cgit v1.2.3


From 3bcff9bf533bfd7081c8d91ca9162b9445354472 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:48:00 +0000
Subject: main/iproute2: upgrade to 2.6.33

---
 main/iproute2/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/iproute2/APKBUILD b/main/iproute2/APKBUILD
index fed741b4..01cdcee6 100644
--- a/main/iproute2/APKBUILD
+++ b/main/iproute2/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iproute2
-pkgver=2.6.31
+pkgver=2.6.33
 _realver=2.6.31
-pkgrel=1
+pkgrel=0
 pkgdesc="IP Routing Utilities"
 url="http://www.linux-foundation.org/en/Net:Iproute2"
 license="GPL2"
-- 
cgit v1.2.3


From 4c39f3f67e0771d29b7262144b3690ed49414d31 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:50:00 +0000
Subject: main/libksba: upgrade to 1.0.7

---
 main/libksba/APKBUILD | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/main/libksba/APKBUILD b/main/libksba/APKBUILD
index 9169690b..ed719a0e 100644
--- a/main/libksba/APKBUILD
+++ b/main/libksba/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libksba
-pkgver=1.0.3
-pkgrel=1
+pkgver=1.0.7
+pkgrel=0
 pkgdesc="Libksba is a CMS and X.509 access library"
 url="ftp://ftp.gnupg.org/gcrypt/alpha/libksba"
 license="GPL"
@@ -12,9 +12,12 @@ source="ftp://ftp.gnupg.org/gcrypt/$pkgname/$pkgname-$pkgver.tar.bz2"
 
 build () {
 	cd "$srcdir"/$pkgname-$pkgver
-
 	./configure --prefix=/usr
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
-md5sums="91682491186d4ed43fff351aab2f5aad  libksba-1.0.3.tar.bz2"
+md5sums="eebce521a90600369c33c5fa6b9bbbd8  libksba-1.0.7.tar.bz2"
-- 
cgit v1.2.3


From af36f84236df772723ff5596b8ed3b066fcef0c3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:50:41 +0000
Subject: main/librsvg: upgrade to 2.26.3

---
 main/librsvg/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/librsvg/APKBUILD b/main/librsvg/APKBUILD
index a0e7acf5..db588711 100644
--- a/main/librsvg/APKBUILD
+++ b/main/librsvg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=librsvg
-pkgver=2.26.2
-pkgrel=1
+pkgver=2.26.3
+pkgrel=0
 pkgdesc="SAX-based renderer for SVG files into a GdkPixbuf"
 url="http://librsvg.sourceforge.net/"
 license="LGPL"
@@ -31,4 +31,4 @@ package() {
 	rm -rf "$pkgdir"/usr/lib/mozilla
 }
 
-md5sums="6bb1993f9180176e45d6084089f47aa8  librsvg-2.26.2.tar.bz2"
+md5sums="8df68c2c02cdf2a96a92b43bf737bf9c  librsvg-2.26.3.tar.bz2"
-- 
cgit v1.2.3


From 84d66fb7d67f5f192ca94a9cfc147e189c0f8d8a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:51:04 +0000
Subject: main/libsoup: upgrade to 2.30.1

---
 main/libsoup/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libsoup/APKBUILD b/main/libsoup/APKBUILD
index f2f0434f..66a25b5a 100644
--- a/main/libsoup/APKBUILD
+++ b/main/libsoup/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libsoup
-pkgver=2.30.0
-pkgrel=1
+pkgver=2.30.1
+pkgrel=0
 pkgdesc="Gnome HTTP Library"
 url="http://www.gnome.org"
 license="LGPL"
@@ -27,4 +27,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="2d18154b869da541c2c0909b443f053a  libsoup-2.30.0.tar.bz2"
+md5sums="d80fb560a72370fba347785b00a750fb  libsoup-2.30.1.tar.bz2"
-- 
cgit v1.2.3


From c2561cc27d2fb38ca2d5e52221ca7b613b99e0cd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:52:59 +0000
Subject: main/libvorbis: upgrade to 1.3.1

---
 main/libvorbis/APKBUILD | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/main/libvorbis/APKBUILD b/main/libvorbis/APKBUILD
index 7f6a6978..82964167 100644
--- a/main/libvorbis/APKBUILD
+++ b/main/libvorbis/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libvorbis
-pkgver=1.2.3
-pkgrel=1
+pkgver=1.3.1
+pkgrel=0
 pkgdesc="Vorbis codec library"
 url="http://www.xiph.org/ogg/vorbis/"
 license="custom"
@@ -17,7 +17,11 @@ build ()
 	./configure --prefix=/usr \
 		--disable-static || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="5aa77f55c0e0aab8eb8ed982335daac8  libvorbis-1.2.3.tar.gz"
+md5sums="016e523fac70bdd786258a9d15fd36e9  libvorbis-1.3.1.tar.gz"
-- 
cgit v1.2.3


From 04c6a8fb845a7b0086921e6e90323b011be35628 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 09:56:55 +0000
Subject: main/pinentry: upgrade to 0.8.0

and build pinentry-gtk
---
 main/pinentry/APKBUILD                    | 44 ++++++++++++++++---------------
 main/pinentry/pinentry-gtk.post-deinstall |  8 ++++++
 main/pinentry/pinentry-gtk.post-install   |  4 +++
 main/pinentry/pinentry.post-deinstall     |  6 +++++
 main/pinentry/pinentry.post-install       |  6 +++++
 5 files changed, 47 insertions(+), 21 deletions(-)
 create mode 100644 main/pinentry/pinentry-gtk.post-deinstall
 create mode 100644 main/pinentry/pinentry-gtk.post-install
 create mode 100644 main/pinentry/pinentry.post-deinstall
 create mode 100644 main/pinentry/pinentry.post-install

diff --git a/main/pinentry/APKBUILD b/main/pinentry/APKBUILD
index d9fbe9a5..3f08adac 100644
--- a/main/pinentry/APKBUILD
+++ b/main/pinentry/APKBUILD
@@ -1,42 +1,44 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pinentry
-pkgver=0.7.6
+pkgver=0.8.0
 _uiconv_ver=0.3
-pkgrel=1
+pkgrel=0
 pkgdesc="Collection of simple PIN or passphrase entry dialogs which utilize the Assuan protocol"
 url="http://www.gnupg.org/aegypten2"
 license="GPL-2"
-depends="ncurses libcap"
-makedepends="ncurses-dev libcap-dev"
-subpackages="$pkgname-doc"
+depends=
+install="pinentry.post-install pinentry.post-deinstall"
+makedepends="ncurses-dev libcap-dev gtk+-dev"
+subpackages="$pkgname-doc $pkgname-gtk"
 source="ftp://ftp.gnupg.org/gcrypt/$pkgname/$pkgname-$pkgver.tar.gz
 	http://git.alpinelinux.org/cgit/uiconv/snapshot/uiconv-$_uiconv_ver.tar.bz2
 	"
 
 build () {
-	# we build it against uiconv to avoid the bloaty GNU libiconv.
-	# it will be linked statically so we don't need it in depends
-	cd "$srcdir/uiconv-$_uiconv_ver"
-	make
-	make DESTDIR="$srcdir" PREFIX=/uiconv install
-
 	cd "$srcdir"/$pkgname-$pkgver
-
-	# the configure script have a broken --with-libiconv-prefix option
-	# so we set the -I and -L flags hard
-	export CFLAGS="$CFLAGS -I $srcdir/uiconv/include"
-	export LDFLAGS="$LDFLAGS -L $srcdir/uiconv/lib"
-
 	./configure --prefix=/usr \
 		--disable-pinentry-gtk \
-		--disable-pinentry-gtk2 \
+		--enable-pinentry-gtk2 \
 		--disable-pinentry-qt \
 		--enable-pinentry-curses \
-		--enable-fallback-curses \
-		--with-libiconv-prefix="$srcdir"/uiconv
+		--enable-pinentry-gtk2 \
+		--enable-fallback-curses
 
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
+	# created by post install scripts so we can override with gtk version
+	rm -f "$pkgdir"/usr/bin/pinentry
+}
+
+gtk() {
+	install="pinentry-gtk.post-install pinentry-gtk.post-deinstall"
+	mkdir -p "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/pinentry-gtk* "$subpkgdir"/usr/bin/
 }
-md5sums="5a4f676375fa882009da02013d77210f  pinentry-0.7.6.tar.gz
+
+md5sums="590be1b00f9ab63205843c7fed8caf35  pinentry-0.8.0.tar.gz
 5cd7f80085324d08cb976fec674cd98d  uiconv-0.3.tar.bz2"
diff --git a/main/pinentry/pinentry-gtk.post-deinstall b/main/pinentry/pinentry-gtk.post-deinstall
new file mode 100644
index 00000000..887ef798
--- /dev/null
+++ b/main/pinentry/pinentry-gtk.post-deinstall
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ -f /usr/bin/pinentry-curses ]; then
+	ln -sf pinentry-curses /usr/bin/pinentry
+else
+	rm -f /usr/bin/pinentry
+fi
+
diff --git a/main/pinentry/pinentry-gtk.post-install b/main/pinentry/pinentry-gtk.post-install
new file mode 100644
index 00000000..8b51ca00
--- /dev/null
+++ b/main/pinentry/pinentry-gtk.post-install
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+ln -sf pinentry-gtk-2 /usr/bin/pinentry
+
diff --git a/main/pinentry/pinentry.post-deinstall b/main/pinentry/pinentry.post-deinstall
new file mode 100644
index 00000000..38939e5b
--- /dev/null
+++ b/main/pinentry/pinentry.post-deinstall
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if ! [ -f /usr/bin/pinentry-gtk-2 ]; then
+	rm -f /usr/bin/pinentry
+fi
+
diff --git a/main/pinentry/pinentry.post-install b/main/pinentry/pinentry.post-install
new file mode 100644
index 00000000..0dfd31e9
--- /dev/null
+++ b/main/pinentry/pinentry.post-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if ! [ -f /usr/bin/pinentry-gtk-2 ]; then
+	ln -sf pinentry-curses /usr/bin/pinentry
+fi
+
-- 
cgit v1.2.3


From 9ce18d40be01900d15737be4a8fabff9662918aa Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 11:02:27 +0000
Subject: main/x264: upgrade to 20100410

---
 main/x264/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/x264/APKBUILD b/main/x264/APKBUILD
index 2dbe78d7..737ac4fe 100644
--- a/main/x264/APKBUILD
+++ b/main/x264/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=x264
-pkgver=20100312
-pkgrel=1
+pkgver=20100410
+pkgrel=0
 pkgdesc="free library for encoding H264/AVC video streams"
 url="http://www.videolan.org/developers/x264.html"
 license="GPL"
@@ -26,4 +26,4 @@ package() {
 	cd "$_builddir"
 	make DESTDIR="$pkgdir" bindir=/usr/bin libdir=/usr/lib includedir=/usr/include install || return 1
 }
-md5sums="769d3755963bb95b66ea428efe1d6bc0  x264-snapshot-20100312-2245.tar.bz2"
+md5sums="13195a516eece721dc743b1dd787a02f  x264-snapshot-20100410-2245.tar.bz2"
-- 
cgit v1.2.3


From 5a44038a08585703673c91cb15a27943d319d118 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 11:08:43 +0000
Subject: main/xf86-input-evdev: upgrade to 2.4.0

---
 main/xf86-input-evdev/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/xf86-input-evdev/APKBUILD b/main/xf86-input-evdev/APKBUILD
index 657a1e66..d0946ebf 100644
--- a/main/xf86-input-evdev/APKBUILD
+++ b/main/xf86-input-evdev/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-input-evdev
-pkgver=2.3.2
-pkgrel=1
+pkgver=2.4.0
+pkgrel=0
 pkgdesc="X.org evdev input driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
@@ -23,4 +23,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="b2bfe368022eedf2671ee28daba31efc  xf86-input-evdev-2.3.2.tar.bz2"
+md5sums="1dbf4d57d99682ba466c7855ed555f19  xf86-input-evdev-2.4.0.tar.bz2"
-- 
cgit v1.2.3


From d202f732faca2e3dcb48dafd3b73618ea5e460e8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 11:09:22 +0000
Subject: main/xf86-video-ati: upgrade to 6.13.0

---
 main/xf86-video-ati/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/xf86-video-ati/APKBUILD b/main/xf86-video-ati/APKBUILD
index 84abb0cf..bef7a30b 100644
--- a/main/xf86-video-ati/APKBUILD
+++ b/main/xf86-video-ati/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-ati
-pkgver=6.12.192
-pkgrel=1
+pkgver=6.13.0
+pkgrel=0
 pkgdesc="ATI video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
@@ -29,4 +29,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="7c331b8ca71c81f2680d065cfc181f3e  xf86-video-ati-6.12.192.tar.bz2"
+md5sums="7b2642442091808002963920c7693aeb  xf86-video-ati-6.13.0.tar.bz2"
-- 
cgit v1.2.3


From 72486378da8ca5dcadb86a88dd0cc3a4f7807312 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 11:31:58 +0000
Subject: main/valgrind: upgrade to 3.5.0

---
 main/valgrind/APKBUILD | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/main/valgrind/APKBUILD b/main/valgrind/APKBUILD
index 31c813ae..0465ac4a 100644
--- a/main/valgrind/APKBUILD
+++ b/main/valgrind/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=valgrind
-pkgver=3.4.1
-pkgrel=2
+pkgver=3.5.0
+pkgrel=0
 pkgdesc="A tool to help find memory-management problems in programs"
 url="http://valgrind.org/"
 license="GPL"
@@ -16,26 +16,29 @@ makedepends="sed paxctl pax-utils"
 options="!strip"
 subpackages="$pkgname-dev $pkgname-doc"
 source="http://$pkgname.org/downloads/$pkgname-$pkgver.tar.bz2
-	$pkgname-3.4.0-uclibc.patch
 	"
 
-build() {
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
 	local i
-	cd "$srcdir/$pkgname-$pkgver"
-	for i in ../*.patch; do
+	for i in "$srcdir"/*.patch; do
+		[ -f "$i" ] || continue
 		msg "Applying $i"
 		patch -p1 < $i || return 1
 	done
+}
 
-	# make sure our CFLAGS are respected
-	sed -e 's:^CFLAGS="-Wno-long-long":CFLAGS="$CFLAGS -Wno-long-long -fno-stack-protector":' \
-		-i configure.in
-
+build() {
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		 --without-mpicc \
 		--mandir=/usr/share/man || return 1
-
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install || return 1
 
 	# we have options=!strip above so we strip the /usr/bin/* manually
@@ -46,10 +49,9 @@ build() {
 
 	# pax causes some issues
 	# http://marc.info/?l=gentoo-hardened&m=119512627126298&w=2
-	scanelf "$pkgdir"/usr/lib/valgrind/x86-linux \
-		| awk '$1 == "ET_EXEC" {print $2}' | xargs paxctl -c -m
+#	scanelf "$pkgdir"/usr/lib/valgrind/x86-linux \
+#		| awk '$1 == "ET_EXEC" {print $2}' | xargs paxctl -c -m
 
 }
 
-md5sums="b5f039dd2271aaf9ae570ab4116f87c7  valgrind-3.4.1.tar.bz2
-37bc90d0783bc0f8ba5754c8407e3dcc  valgrind-3.4.0-uclibc.patch"
+md5sums="f03522a4687cf76c676c9494fcc0a517  valgrind-3.5.0.tar.bz2"
-- 
cgit v1.2.3


From 32f0a3c67282dbd23e9d607208bb8725cb638047 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 11:48:51 +0000
Subject: testing/qemu: upgrade to 0.12.3

and put the misc arch's emulators in subpackages
---
 testing/qemu/APKBUILD | 54 +++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/testing/qemu/APKBUILD b/testing/qemu/APKBUILD
index bfe0c629..7199ce93 100644
--- a/testing/qemu/APKBUILD
+++ b/testing/qemu/APKBUILD
@@ -1,13 +1,31 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=qemu
-pkgver=0.11.1
-pkgrel=1
+pkgver=0.12.3
+pkgrel=0
 pkgdesc="QEMU is a generic machine emulator and virtualizer"
 url="http://www.nongnu.org/qemu/"
 license="GPL-2 LGPL-2"
 makedepends="zlib-dev sdl-dev alsa-lib-dev gnutls-dev ncurses-dev"
 depends=
 install="qemu.pre-install"
+subpackages="
+$pkgname-arm
+$pkgname-cris
+$pkgname-m68k
+$pkgname-microblaze
+$pkgname-mips
+$pkgname-mips64
+$pkgname-mips64el
+$pkgname-mipsel
+$pkgname-ppc
+$pkgname-ppc64
+$pkgname-ppcemb
+$pkgname-sh4
+$pkgname-sh4eb
+$pkgname-sparc
+$pkgname-sparc64
+$pkgname-x86_64
+"
 source="http://savannah.nongnu.org/download/$pkgname/$pkgname-$pkgver.tar.gz
 	kqemu.patch
 	"
@@ -23,7 +41,7 @@ prepare() {
 		Makefile Makefile.target tests/Makefile
 	sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
 		Makefile.target
-	patch -p1 -i ../kqemu.patch || return 1
+#	patch -p1 -i ../kqemu.patch || return 1
 }
 
 build() {
@@ -33,8 +51,8 @@ build() {
 		--audio-card-list=ac97,sb16,es1370,adlib \
 		--disable-darwin-user \
 		--disable-bsd-user \
-		--disable-nptl \
-		--cc="$CC"
+		--disable-linux-user \
+		--cc="${CC:-gcc}"
 
 	make || return 1
 }
@@ -44,5 +62,29 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="193285b0bcf655a7f7577d05ffcb82b1  qemu-0.11.1.tar.gz
+_subsys() {
+	pkgdesc="Qemu $1 system emulator"
+	depend="qemu"
+	mkdir -p "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/qemu-system-$1 "$subpkgdir"/usr/bin/
+}
+
+arm() { _subsys arm; }
+cris() { _subsys cris; }
+m68k() { _subsys m68k; }
+microblaze() { _subsys microblaze; }
+mips() { _subsys mips; }
+mips64() { _subsys mips64; }
+mips64el() { _subsys mips64el; }
+mipsel() { _subsys mipsel; }
+ppc() { _subsys ppc; }
+ppc64() { _subsys ppc64; }
+ppcemb() { _subsys ppcemb; }
+sh4() { _subsys sh4; }
+sh4eb() { _subsys sh4eb; }
+sparc() { _subsys sparc; }
+sparc64() { _subsys sparc64; }
+x86_64() { _subsys x86_64; }
+
+md5sums="d215e4568650e8019816397174c090e1  qemu-0.12.3.tar.gz
 f63f7412f016d8ccddabfd02ea28e748  kqemu.patch"
-- 
cgit v1.2.3


From 75ff374836b4debeac557416f3ad156d3bd38b35 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 12:13:26 +0000
Subject: main/opennhrp: increase timeout value for scripts

helps when there are registration storms
---
 main/opennhrp/APKBUILD                      |  8 +++++++-
 main/opennhrp/opennhrp-script-timeout.patch | 13 +++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 main/opennhrp/opennhrp-script-timeout.patch

diff --git a/main/opennhrp/APKBUILD b/main/opennhrp/APKBUILD
index 4c9d94c9..164b6ccb 100644
--- a/main/opennhrp/APKBUILD
+++ b/main/opennhrp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=opennhrp
 pkgver=0.11.5
-pkgrel=1
+pkgrel=2
 pkgdesc="NBMA Next Hop Resolution Protocol daemon"
 url="http://sourceforge.net/projects/opennhrp"
 license="GPL-3"
@@ -10,6 +10,7 @@ makedepends="c-ares-dev"
 subpackages="$pkgname-doc"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.bz2
 	opennhrp-0.9.3-peer-up-bgp.patch
+	opennhrp-script-timeout.patch
 	$pkgname.initd
 	$pkgname.confd
 	"
@@ -23,11 +24,16 @@ build() {
 	
 	sed -i -e 's/-Werror//' Make.rules
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 	install -Dm755 "$srcdir"/opennhrp.initd "$pkgdir"/etc/init.d/opennhrp
 	install -Dm644 "$srcdir"/opennhrp.confd "$pkgdir"/etc/conf.d/opennhrp
 }
 md5sums="0982ce7c39bd760f0b58161f0883d4ec  opennhrp-0.11.5.tar.bz2
 f81539fc92800bb79668dda119a97d1d  opennhrp-0.9.3-peer-up-bgp.patch
+0178b95cba207156263096487b34f4ba  opennhrp-script-timeout.patch
 ae65f88ccf849ef882669a8b4f0c7fc0  opennhrp.initd
 8eee86233728dc0d156bbfee6d98f338  opennhrp.confd"
diff --git a/main/opennhrp/opennhrp-script-timeout.patch b/main/opennhrp/opennhrp-script-timeout.patch
new file mode 100644
index 00000000..f28e01db
--- /dev/null
+++ b/main/opennhrp/opennhrp-script-timeout.patch
@@ -0,0 +1,13 @@
+diff --git a/nhrp/nhrp_peer.c b/nhrp/nhrp_peer.c
+index 4bcdd75..fb6c81c 100644
+--- a/nhrp/nhrp_peer.c
++++ b/nhrp/nhrp_peer.c
+@@ -21,7 +21,7 @@
+ #include "nhrp_peer.h"
+ #include "nhrp_interface.h"
+ 
+-#define NHRP_SCRIPT_TIMEOUT		20
++#define NHRP_SCRIPT_TIMEOUT		120
+ #define NHRP_PEER_FORMAT_LEN		128
+ #define NHRP_NEGATIVE_CACHE_TIME	(3*60)
+ #define NHRP_EXPIRY_TIME		(5*60)
-- 
cgit v1.2.3


From 9f06eca49f5d661dfb3156b94f75d258642a3160 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 12:53:01 +0000
Subject: testing/libelf: new aport

libelf is a free ELF object file access library
http://www.mr511.de/software/
---
 testing/libelf/APKBUILD | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 testing/libelf/APKBUILD

diff --git a/testing/libelf/APKBUILD b/testing/libelf/APKBUILD
new file mode 100644
index 00000000..88a52258
--- /dev/null
+++ b/testing/libelf/APKBUILD
@@ -0,0 +1,26 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=libelf
+pkgver=0.8.13
+pkgrel=0
+pkgdesc="libelf is a free ELF object file access library"
+url="http://www.mr511.de/software/"
+license="GPL"
+depends=
+makedepends=
+subpackages="$pkgname-dev"
+source="http://www.mr511.de/software/$pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--enable-shared \
+		--enable-gnu-names \
+		--enable-compat || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make install prefix="$pkgdir"/usr || return 1
+}
+md5sums="4136d7b4c04df68b686570afa26988ac  libelf-0.8.13.tar.gz"
-- 
cgit v1.2.3


From 692ff74b5435bbd20dfc3b7504319e655433195a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 13:01:37 +0000
Subject: testing/ltrace: new aport

Tracks runtime library calls in dynamically linked programs
http://packages.debian.org/sid/ltrace
---
 testing/ltrace/APKBUILD | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 testing/ltrace/APKBUILD

diff --git a/testing/ltrace/APKBUILD b/testing/ltrace/APKBUILD
new file mode 100644
index 00000000..145c2a54
--- /dev/null
+++ b/testing/ltrace/APKBUILD
@@ -0,0 +1,25 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=ltrace
+pkgver=0.5.3
+pkgrel=0
+pkgdesc="Tracks runtime library calls in dynamically linked programs"
+url="http://ltrace.alioth.debian.org/"
+license="GPL"
+depends=
+makedepends="libelf-dev"
+subpackages="$pkgname-doc"
+source="http://ftp.debian.org/debian/pool/main/l/$pkgname/${pkgname}_$pkgver.orig.tar.gz"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		|| return 1
+	make
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make install DESTDIR="$pkgdir" || return 1
+}
+md5sums="3fa7fe715ab879db08bd06d1d59fd90f  ltrace_0.5.3.orig.tar.gz"
-- 
cgit v1.2.3


From 72cefb41c7b32cb26e040e144a1a8fb90c65e370 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 13:41:44 +0000
Subject: main/linux-grsec: fix kernel oops when restarting racoon

---
 main/linux-grsec/APKBUILD                                  |  4 +++-
 .../xfrm-fix-policy-unreferencing-on-larval-drop.patch     | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 main/linux-grsec/xfrm-fix-policy-unreferencing-on-larval-drop.patch

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 4cbcb41e..a529ae86 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=2.6.32.12
 _kernver=2.6.32
-pkgrel=3
+pkgrel=4
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -31,6 +31,7 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	0016-xfrm-remove-policy-garbage-collection.patch
 	0017-flow-delayed-deletion-of-flow-cache-entries.patch
 	0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
+	xfrm-fix-policy-unreferencing-on-larval-drop.patch
 	kernelconfig.x86
 	"
 subpackages="$pkgname-dev linux-firmware:firmware"
@@ -154,4 +155,5 @@ c09b82b89a49ba2a3836a0bc3a3312f4  0015-xfrm-cache-bundles-instead-of-policies-fo
 41618efb65ab9ddacfb59a1cde9b4edd  0016-xfrm-remove-policy-garbage-collection.patch
 3b83f0972ab715819d1119b120a987e7  0017-flow-delayed-deletion-of-flow-cache-entries.patch
 45a676c7a1759fec60b724d557b4e295  0018-xfrm-Fix-crashes-in-xfrm_lookup.patch
+c7e606c11c05ff03012b21c3fe0ece47  xfrm-fix-policy-unreferencing-on-larval-drop.patch
 7f442049b29ab749180e54ff8f20f1d0  kernelconfig.x86"
diff --git a/main/linux-grsec/xfrm-fix-policy-unreferencing-on-larval-drop.patch b/main/linux-grsec/xfrm-fix-policy-unreferencing-on-larval-drop.patch
new file mode 100644
index 00000000..25dc0dcd
--- /dev/null
+++ b/main/linux-grsec/xfrm-fix-policy-unreferencing-on-larval-drop.patch
@@ -0,0 +1,14 @@
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 31f4ba4..f4ea3a0 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1805,7 +1805,7 @@ restart:
+ 			/* EREMOTE tells the caller to generate
+ 			 * a one-shot blackhole route. */
+ 			dst_release(dst);
+-			xfrm_pols_put(pols, num_pols);
++			xfrm_pols_put(pols, drop_pols);
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
+ 			return -EREMOTE;
+ 		}
+
-- 
cgit v1.2.3


From 937678412b046f1b98061185d17f923589353295 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:20:38 +0000
Subject: main/libao: upgrade to 1.0.0

---
 main/libao/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libao/APKBUILD b/main/libao/APKBUILD
index d9452338..9c179172 100644
--- a/main/libao/APKBUILD
+++ b/main/libao/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libao
-pkgver=0.8.8
-pkgrel=2
+pkgver=1.0.0
+pkgrel=0
 pkgdesc="Cross-platform audio output library and plugins"
 url="http://www.xiph.org/ao"
 license="GPL"
@@ -23,4 +23,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
-md5sums="b92cba3cbcf1ee9bc221118a85d23dcd  libao-0.8.8.tar.gz"
+md5sums="08283fbe1f587619053a156254afecec  libao-1.0.0.tar.gz"
-- 
cgit v1.2.3


From 6b394e1bebf0cb9cba69aea68e535ae0035ebe41 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:24:33 +0000
Subject: main/mpd: rebuild against new libao

---
 main/mpd/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/mpd/APKBUILD b/main/mpd/APKBUILD
index 5877ab3f..a549978c 100644
--- a/main/mpd/APKBUILD
+++ b/main/mpd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <natanael.copa@gmail.com>
 pkgname=mpd
 pkgver=0.15.9
-pkgrel=1
+pkgrel=2
 pkgdesc="Music daemon that plays MP3, FLAC, and Ogg Vorbis files"
 url="http://musicpd.org"
 pkgusers="mpd"
-- 
cgit v1.2.3


From 689665b80e53c3b4c550949327401cb8f4a6e39e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:26:15 +0000
Subject: main/sox: rebuild against new libao

---
 main/sox/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/sox/APKBUILD b/main/sox/APKBUILD
index 1f2fdcdd..37b016a9 100644
--- a/main/sox/APKBUILD
+++ b/main/sox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sox
 pkgver=14.3.1
-pkgrel=0
+pkgrel=1
 pkgdesc="The Swiss Army knife of sound processing tools"
 url="http://sox.sourceforge.net/"
 license="GPL LGPL"
-- 
cgit v1.2.3


From 74c104e49eab69da9fbf110cbdbe668232dcdd03 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:28:00 +0000
Subject: main/rdesktop: rebuild against new libao

---
 main/rdesktop/APKBUILD | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/main/rdesktop/APKBUILD b/main/rdesktop/APKBUILD
index 597af311..45a865e0 100644
--- a/main/rdesktop/APKBUILD
+++ b/main/rdesktop/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rdesktop
 pkgver=1.6.0
-pkgrel=1
+pkgrel=2
 pkgdesc="rdesktop is used to connect to windows terminal servers"
 url="http://www.rdesktop.org/"
 license="GPL"
 subpackages="$pkgname-doc"
-depends="libx11 openssl libao libsamplerate"
+depends=
 makedepends="libx11-dev libao-dev openssl-dev libsamplerate-dev"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz"
 
@@ -16,6 +16,10 @@ build ()
 	./configure --prefix=/usr \
 		--with-sound=ao
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 md5sums="c6fcbed7f0ad7e60ac5fcb2d324d8b16  rdesktop-1.6.0.tar.gz"
-- 
cgit v1.2.3


From 867ecdcf47cda9c93d116620f77dd68f4332cdd2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:33:25 +0000
Subject: main/libassuan: upgrade to 2.0.0

---
 main/libassuan/APKBUILD | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/main/libassuan/APKBUILD b/main/libassuan/APKBUILD
index 2b2498c4..ee8a0d97 100644
--- a/main/libassuan/APKBUILD
+++ b/main/libassuan/APKBUILD
@@ -1,18 +1,23 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libassuan
-pkgver=1.0.5
+pkgver=2.0.0
 pkgrel=0
 pkgdesc="Libassuan is the IPC library used by some GnuPG related software"
 url="ftp://ftp.gnupg.org/gcrypt/libgcrypt"
 license="GPL"
-makedepends="pth-dev"
-subpackages="$pkgname-doc"
+depends=
+makedepends="pth-dev libgpg-error-dev"
+subpackages="$pkgname-dev $pkgname-doc"
 source="ftp://ftp.gnupg.org/gcrypt/$pkgname/$pkgname-$pkgver.tar.bz2"
 
 build () {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
-md5sums="c2db0974fcce4401f48f3fa41c4edc5a  libassuan-1.0.5.tar.bz2"
+md5sums="59bc0ae7194c412d7a522029005684b2  libassuan-2.0.0.tar.bz2"
-- 
cgit v1.2.3


From f6943a052b9b948db5504836b86ae9c4401aae32 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 14:36:58 +0000
Subject: main/gnupg: upgrade to 2.0.15

---
 main/gnupg/APKBUILD | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/main/gnupg/APKBUILD b/main/gnupg/APKBUILD
index 4e04d84b..b35f8566 100644
--- a/main/gnupg/APKBUILD
+++ b/main/gnupg/APKBUILD
@@ -1,13 +1,13 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gnupg
-pkgver=2.0.10
-pkgrel=1
+pkgver=2.0.15
+pkgrel=0
 pkgdesc="GNU Privacy Guard 2 - a PGP replacement tool"
 url="http://www.gnupg.org/"
 license="GPL"
-depends="curl zlib libksba libgcrypt libgpg-error pth pinentry libiconv"
+depends=
 makedepends="curl-dev libassuan libksba-dev libgcrypt-dev libgpg-error-dev 
-	pth-dev zlib-dev libiconv-dev"
+	pth-dev zlib-dev libiconv-dev libassuan-dev"
 subpackages="$pkgname-doc"
 source="ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-$pkgver.tar.bz2"
 
@@ -16,6 +16,10 @@ build () {
 	./configure --prefix=/usr \
 		--disable-nls
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 }
-md5sums="1cb778dd555f87685a8fde2f7113725e  gnupg-2.0.10.tar.bz2"
+md5sums="c1286e85b66349879dc4b760dd83e2f1  gnupg-2.0.15.tar.bz2"
-- 
cgit v1.2.3


From aaf2cd95be5f05882b77e0db34c8d193eb23a5ad Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 15:10:10 +0000
Subject: main/libc0.9.32: fix resolv issues with ipv6

---
 main/libc0.9.32/resolv.patch | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 main/libc0.9.32/resolv.patch

diff --git a/main/libc0.9.32/resolv.patch b/main/libc0.9.32/resolv.patch
new file mode 100644
index 00000000..8b84177d
--- /dev/null
+++ b/main/libc0.9.32/resolv.patch
@@ -0,0 +1,13 @@
+diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
+index 84289a6..5107dec 100644
+--- a/libc/inet/resolv.c
++++ b/libc/inet/resolv.c
+@@ -689,7 +689,7 @@ int attribute_hidden __decode_dotted(const unsigned char *packet,
+ 
+ 		if (used + b + 1 >= dest_len)
+ 			return -1;
+-		if (offset + b + 1 >= packet_len)
++		if (offset + b >= packet_len)
+ 			return -1;
+ 		memcpy(dest + used, packet + offset, b);
+ 		offset += b;
-- 
cgit v1.2.3


From 35c81ce5b042347317736d23b2d6e5c056f00c05 Mon Sep 17 00:00:00 2001
From: Michael Mason <ms13sp@gmail.com>
Date: Thu, 6 May 2010 15:19:06 +0000
Subject: freeswitch bug fixes for freswitch user and rundir

---
 main/freeswitch/APKBUILD               | 8 +++++---
 main/freeswitch/freeswitch.pre-install | 3 +--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 241b7064..22d59f38 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=2
+pkgrel=3
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
@@ -31,7 +31,8 @@ build() {
 		--sysconfdir=/etc/freeswitch \
 		--with-modinstdir=/usr/lib/freeswitch \
 		--mandir=/usr/share/man \
-		--infodir=/usr/share/info
+		--infodir=/usr/share/info \
+		--without-rundir
 
 	# check how/when parallel builds are fixed here:
 	# http://jira.freeswitch.org/browse/FSBUILD-6
@@ -51,6 +52,7 @@ build() {
 package(){
 	cd "$srcdir/$pkgname-$pkgver"
 	make -j1 DESTDIR="$pkgdir" install
+	mkdir "$pkgdir"/var/run/freeswitch
 	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
 	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
 }
@@ -60,5 +62,5 @@ c05f2356be159e99b3845f5260a33599  modules.conf
 c608cca8ad773acebf201f581438c7e7  freeswitch.confd
 dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
 c0d7ad55063b1f62c9a2fcfa37b2fc0a  freeswitch.post-install
-a34305ba1f8a8e7e6dbb9c678cc442b9  freeswitch.pre-install
+661e2dff4022522b95c875f2f88aa66a  freeswitch.pre-install
 a7188703019a74fd7f128d165b3ecf42  freeswitch.post-deinstall"
diff --git a/main/freeswitch/freeswitch.pre-install b/main/freeswitch/freeswitch.pre-install
index b8065b52..23756f31 100755
--- a/main/freeswitch/freeswitch.pre-install
+++ b/main/freeswitch/freeswitch.pre-install
@@ -1,4 +1,3 @@
 #!/bin/sh
 
-adduser -h /dev/null -s /bin/false -D freeswitch 2>/dev/null
-mkdir /var/run/freeswitch
+adduser -H /var/run/freeswitch  -s /bin/false -D freeswitch 2>/dev/null
-- 
cgit v1.2.3


From d8a27ffd75be6dca3dccc2cd318d706f96e166b4 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 15:27:16 +0000
Subject: main/libc0.9.32: apply the patch from last commit

---
 main/libc0.9.32/APKBUILD | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 7dc33f12..d65397c5 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100427
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=2
+pkgrel=3
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -16,6 +16,7 @@ replaces=uclibc
 source="
 	http://git.uclibc.org/uClibc/snapshot/master.tar.bz2
 	compat-stack-guard.patch
+	resolv.patch
 	uclibcconfig.x86
 	uclibcconfig.i486
 	"
@@ -88,5 +89,6 @@ utils() {
 
 md5sums="1189f8f739b1977a86b7afa8637e6827  master.tar.bz2
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
+b12fcf44388db8b3331541234def9477  resolv.patch
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.x86
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.i486"
-- 
cgit v1.2.3


From 31c2bc9c26bfe7545d60e1c56a8bc88f82033a7e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 6 May 2010 16:42:27 +0000
Subject: testing/alsa-utils: upgrade to 1.0.23

---
 testing/alsa-utils/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testing/alsa-utils/APKBUILD b/testing/alsa-utils/APKBUILD
index 6b48a210..8894a9cb 100644
--- a/testing/alsa-utils/APKBUILD
+++ b/testing/alsa-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alsa-utils
-pkgver=1.0.22
-pkgrel=1
+pkgver=1.0.23
+pkgrel=0
 pkgdesc="Advanced Linux Sound Architecture Utils (alsactl, alsamixer, etc.)"
 url="http://www.alsa-project.org"
 license="GPL"
@@ -33,7 +33,7 @@ package() {
 	install -D -m755 ../alsa.initd "$pkgdir"/etc/init.d/alsa
 	install -D -m644 ../alsa.confd "$pkgdir"/etc/conf.d/alsa
 }
-md5sums="f7180316188552ee1e6759a03f1fe98d  alsa-utils-1.0.22.tar.bz2
+md5sums="cb0cf46029ac9549cf3a31bff6a4f4e1  alsa-utils-1.0.23.tar.bz2
 5e65f278b5a77e3ee2821ad955c4cd91  alsaconf.patch
 4a66dad46d5366e05098cde97f3d37b5  alsa.initd
 85b1f1e759fe5953eca329237f4ac256  alsa.confd"
-- 
cgit v1.2.3


From 72dc3b5920c3cab4b8e562bb452fbccb3392e081 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 7 May 2010 06:43:14 +0000
Subject: main/libc0.9.32

updated fix for resolv
---
 main/libc0.9.32/APKBUILD                |  6 +++---
 main/libc0.9.32/resolv.patch            | 13 -------------
 main/libc0.9.32/uclibc-resolv-fix.patch | 22 ++++++++++++++++++++++
 3 files changed, 25 insertions(+), 16 deletions(-)
 delete mode 100644 main/libc0.9.32/resolv.patch
 create mode 100644 main/libc0.9.32/uclibc-resolv-fix.patch

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index d65397c5..355df118 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100427
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=3
+pkgrel=4
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -16,7 +16,7 @@ replaces=uclibc
 source="
 	http://git.uclibc.org/uClibc/snapshot/master.tar.bz2
 	compat-stack-guard.patch
-	resolv.patch
+	uclibc-resolv-fix.patch
 	uclibcconfig.x86
 	uclibcconfig.i486
 	"
@@ -89,6 +89,6 @@ utils() {
 
 md5sums="1189f8f739b1977a86b7afa8637e6827  master.tar.bz2
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
-b12fcf44388db8b3331541234def9477  resolv.patch
+14d0d155887319f32f164da0bea48c9e  uclibc-resolv-fix.patch
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.x86
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.i486"
diff --git a/main/libc0.9.32/resolv.patch b/main/libc0.9.32/resolv.patch
deleted file mode 100644
index 8b84177d..00000000
--- a/main/libc0.9.32/resolv.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
-index 84289a6..5107dec 100644
---- a/libc/inet/resolv.c
-+++ b/libc/inet/resolv.c
-@@ -689,7 +689,7 @@ int attribute_hidden __decode_dotted(const unsigned char *packet,
- 
- 		if (used + b + 1 >= dest_len)
- 			return -1;
--		if (offset + b + 1 >= packet_len)
-+		if (offset + b >= packet_len)
- 			return -1;
- 		memcpy(dest + used, packet + offset, b);
- 		offset += b;
diff --git a/main/libc0.9.32/uclibc-resolv-fix.patch b/main/libc0.9.32/uclibc-resolv-fix.patch
new file mode 100644
index 00000000..afde80df
--- /dev/null
+++ b/main/libc0.9.32/uclibc-resolv-fix.patch
@@ -0,0 +1,22 @@
+diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
+index 84289a6..84a6b41 100644
+--- a/libc/inet/resolv.c
++++ b/libc/inet/resolv.c
+@@ -689,7 +689,7 @@ int attribute_hidden __decode_dotted(const unsigned char *packet,
+ 
+ 		if (used + b + 1 >= dest_len)
+ 			return -1;
+-		if (offset + b + 1 >= packet_len)
++		if (offset + b >= packet_len)
+ 			return -1;
+ 		memcpy(dest + used, packet + offset, b);
+ 		offset += b;
+@@ -2456,7 +2456,7 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
+ 		char *dst = buf;
+ 		unsigned char *tp = (unsigned char *)addr + addrlen - 1;
+ 		do {
+-			dst += sprintf(dst, "%x.%x.", tp[i] & 0xf, tp[i] >> 4);
++			dst += sprintf(dst, "%x.%x.", tp[0] & 0xf, tp[0] >> 4);
+ 			tp--;
+ 		} while (tp >= (unsigned char *)addr);
+ 		strcpy(dst, "ip6.arpa");
-- 
cgit v1.2.3


From 215a090bd2a116758f7de6c7d088390aa94a329c Mon Sep 17 00:00:00 2001
From: Timo Teras <timo.teras@iki.fi>
Date: Fri, 7 May 2010 11:53:48 +0300
Subject: main/libc0.9.32: more dns fixes, and static build fix

---
 ...d-fix-internal-locking-weaks-to-get-pulle.patch | 125 +++++++++++++++++++++
 ...ous-memory-corruption-and-off-by-one-fixe.patch |  69 ++++++++++++
 main/libc0.9.32/APKBUILD                           |  10 +-
 main/libc0.9.32/uclibc-resolv-fix.patch            |  22 ----
 4 files changed, 200 insertions(+), 26 deletions(-)
 create mode 100644 main/libc0.9.32/0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 create mode 100644 main/libc0.9.32/0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 delete mode 100644 main/libc0.9.32/uclibc-resolv-fix.patch

diff --git a/main/libc0.9.32/0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch b/main/libc0.9.32/0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
new file mode 100644
index 00000000..2898a0d0
--- /dev/null
+++ b/main/libc0.9.32/0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
@@ -0,0 +1,125 @@
+From 67403d1d692c3b8022b0adca127a2c14ef8e3237 Mon Sep 17 00:00:00 2001
+From: Timo Teras <timo.teras@iki.fi>
+Date: Fri, 7 May 2010 11:28:27 +0300
+Subject: [PATCH 1/2] static build: fix internal locking weaks to get pulled in always
+
+Linker is smart and does not pull in weaks.os, ever. This happens
+because that compilation unit does not get strong references and
+ld eliminates dead code. We really need the weaks for static build
+in a compilation unit that is always there, otherwise it won't work.
+
+Signed-off-by: Timo Teras <timo.teras@iki.fi>
+---
+ libc/misc/internals/__uClibc_main.c |   35 ++++++++++++++++++++++++++++++
+ libc/misc/pthread/Makefile.in       |    1 -
+ libc/misc/pthread/weaks.c           |   40 -----------------------------------
+ 3 files changed, 35 insertions(+), 41 deletions(-)
+ delete mode 100644 libc/misc/pthread/weaks.c
+
+diff --git a/libc/misc/internals/__uClibc_main.c b/libc/misc/internals/__uClibc_main.c
+index f7e45c6..f9e1244 100644
+--- a/libc/misc/internals/__uClibc_main.c
++++ b/libc/misc/internals/__uClibc_main.c
+@@ -68,6 +68,41 @@ uintptr_t __guard attribute_relro;
+  */
+ 
+ void internal_function _dl_aux_init (ElfW(auxv_t) *av);
++
++/*
++ * uClibc internal locking requires that we have weak aliases
++ * for dummy functions in case libpthread.a is not linked in.
++ * This needs to be in compilation unit that is pulled always
++ * in or linker will disregard these weaks.
++ */
++
++static int __pthread_return_0 (pthread_mutex_t *unused) { return 0; }
++weak_alias (__pthread_return_0, __pthread_mutex_lock)
++weak_alias (__pthread_return_0, __pthread_mutex_trylock)
++weak_alias (__pthread_return_0, __pthread_mutex_unlock)
++
++int weak_function
++__pthread_mutex_init(pthread_mutex_t *mutex, const pthread_mutexattr_t *attr)
++{
++        return 0;
++}
++
++void weak_function
++_pthread_cleanup_push_defer(struct _pthread_cleanup_buffer *__buffer,
++                            void (*__routine) (void *), void *__arg)
++{
++        __buffer->__routine = __routine;
++        __buffer->__arg = __arg;
++}
++
++void weak_function
++_pthread_cleanup_pop_restore(struct _pthread_cleanup_buffer *__buffer,
++                             int __execute)
++{
++        if (__execute)
++                __buffer->__routine(__buffer->__arg);
++}
++
+ #endif /* !SHARED */
+ 
+ /*
+diff --git a/libc/misc/pthread/Makefile.in b/libc/misc/pthread/Makefile.in
+index 69cdf10..2f436ac 100644
+--- a/libc/misc/pthread/Makefile.in
++++ b/libc/misc/pthread/Makefile.in
+@@ -11,7 +11,6 @@ MISC_PTHREAD_DIR := $(top_srcdir)libc/misc/pthread
+ MISC_PTHREAD_OUT := $(top_builddir)libc/misc/pthread
+ 
+ libc-shared-$(UCLIBC_HAS_TLS) += $(MISC_PTHREAD_OUT)/tsd.os
+-libc-static-$(UCLIBC_HAS_THREADS) += $(MISC_PTHREAD_OUT)/weaks.o
+ 
+ objclean-y += CLEAN_libc/misc/pthread
+ 
+diff --git a/libc/misc/pthread/weaks.c b/libc/misc/pthread/weaks.c
+deleted file mode 100644
+index fb1d85f..0000000
+--- a/libc/misc/pthread/weaks.c
++++ /dev/null
+@@ -1,40 +0,0 @@
+-/* The weak pthread functions for Linux.
+-   Copyright (C) 1996, 1997, 1998 Free Software Foundation, Inc.
+-   This file is part of the GNU C Library.
+-
+-   The GNU C Library is free software; you can redistribute it and/or
+-   modify it under the terms of the GNU Library General Public License as
+-   published by the Free Software Foundation; either version 2 of the
+-   License, or (at your option) any later version.
+-
+-   The GNU C Library is distributed in the hope that it will be useful,
+-   but WITHOUT ANY WARRANTY; without even the implied warranty of
+-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+-   Library General Public License for more details.
+-
+-   You should have received a copy of the GNU Library General Public
+-   License along with the GNU C Library; see the file COPYING.LIB.  If not,
+-   write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+-   Boston, MA 02111-1307, USA.  */
+-
+-#include <libc-internal.h>
+-
+-/* Weaks for internal library use only.
+- *
+- * We need to define weaks here to cover all the pthread functions that
+- * libc itself will use so that we aren't forced to link libc against
+- * libpthread.  This file is only used in libc.a and since we have
+- * weaks here, they will be automatically overridden by libpthread.a
+- * if it gets linked in.
+- */
+-
+-static int __pthread_return_0 (void) { return 0; }
+-static void __pthread_return_void (void) { return; }
+-
+-weak_alias (__pthread_return_0, __pthread_mutex_init)
+-weak_alias (__pthread_return_0, __pthread_mutex_lock)
+-weak_alias (__pthread_return_0, __pthread_mutex_trylock)
+-weak_alias (__pthread_return_0, __pthread_mutex_unlock)
+-weak_alias (__pthread_return_void, _pthread_cleanup_push_defer)
+-weak_alias (__pthread_return_void, _pthread_cleanup_pop_restore)
+-
+-- 
+1.6.3.3
+
diff --git a/main/libc0.9.32/0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch b/main/libc0.9.32/0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
new file mode 100644
index 00000000..562d648a
--- /dev/null
+++ b/main/libc0.9.32/0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
@@ -0,0 +1,69 @@
+From bfe9a589a402d4b6265e32b1b5ca0942efdcff3b Mon Sep 17 00:00:00 2001
+From: Timo Teras <timo.teras@iki.fi>
+Date: Fri, 7 May 2010 11:30:04 +0300
+Subject: [PATCH 2/2] resolv: various memory corruption and off by one fixes
+
+Fixes resolution of names with AAAA entries and gethostbyaddr issues.
+
+Signed-off-by: Timo Teras <timo.teras@iki.fi>
+---
+ libc/inet/resolv.c |   12 ++++++++----
+ 1 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
+index 84289a6..320aec4 100644
+--- a/libc/inet/resolv.c
++++ b/libc/inet/resolv.c
+@@ -689,7 +689,7 @@ int attribute_hidden __decode_dotted(const unsigned char *packet,
+ 
+ 		if (used + b + 1 >= dest_len)
+ 			return -1;
+-		if (offset + b + 1 >= packet_len)
++		if (offset + b >= packet_len)
+ 			return -1;
+ 		memcpy(dest + used, packet + offset, b);
+ 		offset += b;
+@@ -2417,7 +2417,7 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
+ 	/* Layout in buf:
+ 	 * char *alias[ALIAS_DIM];
+ 	 * struct in[6]_addr* addr_list[2];
+-	 * struct in[6]_addr* in;
++	 * struct in[6]_addr in;
+ 	 * char scratch_buffer[256+];
+ 	 */
+ #define in6 ((struct in6_addr *)in)
+@@ -2431,9 +2431,13 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
+ #ifndef __UCLIBC_HAS_IPV6__
+ 	buf += sizeof(*in);
+ 	buflen -= sizeof(*in);
++	if (addrlen > sizeof(*in))
++		return ERANGE;
+ #else
+ 	buf += sizeof(*in6);
+ 	buflen -= sizeof(*in6);
++	if (addrlen > sizeof(*in6))
++		return ERANGE;
+ #endif
+ 	if ((ssize_t)buflen < 256)
+ 		return ERANGE;
+@@ -2441,7 +2445,7 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
+ 	alias[1] = NULL;
+ 	addr_list[0] = in;
+ 	addr_list[1] = NULL;
+-	memcpy(&in, addr, addrlen);
++	memcpy(in, addr, addrlen);
+ 
+ 	if (0) /* nothing */;
+ #ifdef __UCLIBC_HAS_IPV4__
+@@ -2456,7 +2460,7 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
+ 		char *dst = buf;
+ 		unsigned char *tp = (unsigned char *)addr + addrlen - 1;
+ 		do {
+-			dst += sprintf(dst, "%x.%x.", tp[i] & 0xf, tp[i] >> 4);
++			dst += sprintf(dst, "%x.%x.", tp[0] & 0xf, tp[0] >> 4);
+ 			tp--;
+ 		} while (tp >= (unsigned char *)addr);
+ 		strcpy(dst, "ip6.arpa");
+-- 
+1.6.3.3
+
diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 355df118..da342144 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100427
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=4
+pkgrel=5
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -16,7 +16,8 @@ replaces=uclibc
 source="
 	http://git.uclibc.org/uClibc/snapshot/master.tar.bz2
 	compat-stack-guard.patch
-	uclibc-resolv-fix.patch
+	0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
+	0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 	uclibcconfig.x86
 	uclibcconfig.i486
 	"
@@ -87,8 +88,9 @@ utils() {
 	mv "$pkgdir"/usr/bin/* "$subpkgdir"/usr/bin/
 }
 
-md5sums="1189f8f739b1977a86b7afa8637e6827  master.tar.bz2
+md5sums="46e98672dc2a4309d9a7c65b4e626845  master.tar.bz2
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
-14d0d155887319f32f164da0bea48c9e  uclibc-resolv-fix.patch
+826666b365f2d63a71d67eb76c94f7bc  0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
+0800a489a738c7b1d8c3643cb9806926  0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.x86
 791e2fc050cab523ce1c907ca39a2486  uclibcconfig.i486"
diff --git a/main/libc0.9.32/uclibc-resolv-fix.patch b/main/libc0.9.32/uclibc-resolv-fix.patch
deleted file mode 100644
index afde80df..00000000
--- a/main/libc0.9.32/uclibc-resolv-fix.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
-index 84289a6..84a6b41 100644
---- a/libc/inet/resolv.c
-+++ b/libc/inet/resolv.c
-@@ -689,7 +689,7 @@ int attribute_hidden __decode_dotted(const unsigned char *packet,
- 
- 		if (used + b + 1 >= dest_len)
- 			return -1;
--		if (offset + b + 1 >= packet_len)
-+		if (offset + b >= packet_len)
- 			return -1;
- 		memcpy(dest + used, packet + offset, b);
- 		offset += b;
-@@ -2456,7 +2456,7 @@ int gethostbyaddr_r(const void *addr, socklen_t addrlen,
- 		char *dst = buf;
- 		unsigned char *tp = (unsigned char *)addr + addrlen - 1;
- 		do {
--			dst += sprintf(dst, "%x.%x.", tp[i] & 0xf, tp[i] >> 4);
-+			dst += sprintf(dst, "%x.%x.", tp[0] & 0xf, tp[0] >> 4);
- 			tp--;
- 		} while (tp >= (unsigned char *)addr);
- 		strcpy(dst, "ip6.arpa");
-- 
cgit v1.2.3


From 34efd1b6b7f9fea90f5385a80698b2e471f96e43 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 7 May 2010 06:51:38 +0000
Subject: main/asterisk: upgrade to 1.6.2.7

---
 main/asterisk/APKBUILD | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/main/asterisk/APKBUILD b/main/asterisk/APKBUILD
index 2a955f8b..e1aec9bb 100644
--- a/main/asterisk/APKBUILD
+++ b/main/asterisk/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Timo Teras <timo.teras@iki.fi>
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=asterisk
-pkgver=1.6.2.6
-pkgrel=2
+pkgver=1.6.2.7
+pkgrel=0
 pkgdesc="Asterisk: A Module Open Source PBX System"
 url="http://www.asterisk.org/"
 license="GPL"
@@ -16,7 +16,6 @@ subpackages="$pkgname-dev $pkgname-doc $pkgname-pgsql $pkgname-odbc
 source="http://downloads.digium.com/pub/asterisk/releases/$pkgname-$pkgver.tar.gz
 	100-uclibc-daemon.patch
 	101-caps-uclibc.patch
-	102-gsm-pic.patch	
 	400-bug-227.patch
 	asterisk.initd
 	asterisk.confd
@@ -111,10 +110,9 @@ sample() {
 	make samples DESTDIR="$subpkgdir"
 }
 
-md5sums="f068ef2433eebdc7f6dd635986f36d77  asterisk-1.6.2.6.tar.gz
+md5sums="861f57ba43bfe05dc645e0679a260e41  asterisk-1.6.2.7.tar.gz
 b00c9d98ce2ad445501248a197c6e436  100-uclibc-daemon.patch
 6e1129e30c4fd2c25c86c81685a485a9  101-caps-uclibc.patch
-97b39fd9777a2521d4f9f095482b7ac2  102-gsm-pic.patch
 79e9634b5054bceb3b8dc246654bb243  400-bug-227.patch
 0ce3219e05f55af884a7dc6b99c2b276  asterisk.initd
 ed31d7ba37bcf8b0346dcf8593c395f0  asterisk.confd
-- 
cgit v1.2.3


From 3da769993966a1c505657df078ba6fd1fb4e46c9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 7 May 2010 14:08:33 +0000
Subject: main/libc0.9.32: updated snapshot

---
 main/libc0.9.32/APKBUILD         | 20 ++++++++++++--------
 main/libc0.9.32/uclibcconfig.x86 |  3 ++-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index da342144..db7a9b0c 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -1,9 +1,9 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 _abiver=0.9.32
 pkgname=libc$_abiver
-_gitver=100427
+_gitver=100507
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=5
+pkgrel=0
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -13,8 +13,9 @@ depends_dev="linux-headers=>2.6.32"
 #options="!strip"
 replaces=uclibc
 
-source="
-	http://git.uclibc.org/uClibc/snapshot/master.tar.bz2
+_snapurl="http://git.uclibc.org/uClibc/snapshot/master.tar.bz2"
+_snapfile="$pkgname-$pkgver.tar.bz2"
+source="http://build.alpinelinux.org:8010/distfiles/$_snapfile
 	compat-stack-guard.patch
 	0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 	0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
@@ -27,7 +28,10 @@ _builddir="$srcdir"/master
 
 snapshot() {
 	local _date=$(date +%y%m%d%H%M)
-	rm -f "$SRCDEST"/master.tar.bz2
+	pkgver=${_abiver}_alpha0_git$_gitver
+
+	rm -f "$SRCDEST"/$_snapfile
+	wget -O "$SRCDEST"/$_snapfile $_snapurl
 	pkgrel=0
 	sed -i -e "s/^_gitver=.*/_gitver=$(date +%y%m%d)/" \
 		-e "s/^pkgrel=.*/pkgrel=$pkgrel/" \
@@ -88,9 +92,9 @@ utils() {
 	mv "$pkgdir"/usr/bin/* "$subpkgdir"/usr/bin/
 }
 
-md5sums="46e98672dc2a4309d9a7c65b4e626845  master.tar.bz2
+md5sums="46e98672dc2a4309d9a7c65b4e626845  libc0.9.32-0.9.32_alpha0_git100507.tar.bz2
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
 826666b365f2d63a71d67eb76c94f7bc  0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 0800a489a738c7b1d8c3643cb9806926  0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
-791e2fc050cab523ce1c907ca39a2486  uclibcconfig.x86
-791e2fc050cab523ce1c907ca39a2486  uclibcconfig.i486"
+e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.x86
+e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.i486"
diff --git a/main/libc0.9.32/uclibcconfig.x86 b/main/libc0.9.32/uclibcconfig.x86
index be5cfbb5..1368b58e 100644
--- a/main/libc0.9.32/uclibcconfig.x86
+++ b/main/libc0.9.32/uclibcconfig.x86
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Version: 0.9.32-git
-# Tue May  4 07:38:19 2010
+# Fri May  7 11:46:52 2010
 #
 # TARGET_alpha is not set
 # TARGET_arm is not set
@@ -123,6 +123,7 @@ UCLIBC_HAS_TZ_CACHING=y
 UCLIBC_HAS_TZ_FILE=y
 UCLIBC_HAS_TZ_FILE_READ_MANY=y
 UCLIBC_TZ_FILE_PATH="/etc/TZ"
+UCLIBC_FALLBACK_TO_ETC_LOCALTIME=y
 
 #
 # Advanced Library Settings
-- 
cgit v1.2.3


From 939d896172b9f6a456771e31c72a00db2221a3af Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 7 May 2010 15:51:27 +0000
Subject: main/freeswitch: dont remove users on uninstall

---
 main/freeswitch/APKBUILD                  | 9 +++------
 main/freeswitch/freeswitch.post-deinstall | 4 ----
 main/freeswitch/freeswitch.post-install   | 1 -
 3 files changed, 3 insertions(+), 11 deletions(-)
 delete mode 100755 main/freeswitch/freeswitch.post-deinstall

diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 22d59f38..8280a848 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=3
+pkgrel=4
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
@@ -16,7 +16,6 @@ source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
 	freeswitch.initd
 	freeswitch.post-install
 	freeswitch.pre-install
-	freeswitch.post-deinstall
 	"
 
 build() {
@@ -32,7 +31,6 @@ build() {
 		--with-modinstdir=/usr/lib/freeswitch \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
-		--without-rundir
 
 	# check how/when parallel builds are fixed here:
 	# http://jira.freeswitch.org/browse/FSBUILD-6
@@ -61,6 +59,5 @@ md5sums="388effee587887a81fe7f411b7350590  freeswitch-1.0.6.tar.gz
 c05f2356be159e99b3845f5260a33599  modules.conf
 c608cca8ad773acebf201f581438c7e7  freeswitch.confd
 dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
-c0d7ad55063b1f62c9a2fcfa37b2fc0a  freeswitch.post-install
-661e2dff4022522b95c875f2f88aa66a  freeswitch.pre-install
-a7188703019a74fd7f128d165b3ecf42  freeswitch.post-deinstall"
+697f8069eb8eaa158fa6c063d0e5fed7  freeswitch.post-install
+661e2dff4022522b95c875f2f88aa66a  freeswitch.pre-install"
diff --git a/main/freeswitch/freeswitch.post-deinstall b/main/freeswitch/freeswitch.post-deinstall
deleted file mode 100755
index 5ec871cb..00000000
--- a/main/freeswitch/freeswitch.post-deinstall
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-deluser freeswitch
-delgroup freeswitch
diff --git a/main/freeswitch/freeswitch.post-install b/main/freeswitch/freeswitch.post-install
index 3b1c414c..21577b1b 100755
--- a/main/freeswitch/freeswitch.post-install
+++ b/main/freeswitch/freeswitch.post-install
@@ -1,5 +1,4 @@
 #!/bin/sh
 
-chown -R freeswitch:freeswitch /etc/freeswitch/
 chown -R freeswitch:freeswitch /var/run/freeswitch/
 
-- 
cgit v1.2.3


From 9f050562e98e9355710fa2aa173dae037793fb37 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 7 May 2010 18:37:34 +0000
Subject: main/linux-grsec: actually apply the last xfrm patch

was not applied previously
---
 main/linux-grsec/APKBUILD | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index a529ae86..5228ecc0 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=2.6.32.12
 _kernver=2.6.32
-pkgrel=4
+pkgrel=5
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -46,7 +46,8 @@ prepare() {
 	fi
 
 	# first apply the grsecurity patch and then the rest
-	for i in "$srcdir"/grsecurity*.patch "$srcdir"/0[0-9]*.patch; do
+	for i in "$srcdir"/grsecurity*.patch "$srcdir"/0[0-9]*.patch \
+			"$srcdir"/xfrm*; do
 		[ -f $i ] || continue
 		msg "Applying $i..."
 		patch -s -p1 -N < $i || return 1
-- 
cgit v1.2.3


From d11f31e81a96681f8b74c6bb8d6dfe43a62f1147 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Sat, 8 May 2010 10:52:54 +0000
Subject: main/freeswitch: changed locations to partially support FHS

---
 main/freeswitch/APKBUILD                | 40 ++++++++++++++++-----------------
 main/freeswitch/freeswitch.initd        | 39 ++++++++++++++++++++++++++------
 main/freeswitch/freeswitch.post-install |  3 ++-
 main/freeswitch/freeswitch.pre-install  |  4 +++-
 4 files changed, 56 insertions(+), 30 deletions(-)

diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 8280a848..27081c2e 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -1,15 +1,15 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=4
+pkgrel=5
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
 depends=""
 makedepends="curl-dev unixodbc-dev zlib-dev openssl-dev
 	autoconf automake libtool"
-install=
-subpackages="$pkgname-dev"
+install="$pkgname.pre-install $pkgname.post-install"
+subpackages="$pkgname-dev $pkgname-sounds $pkgname-moh"
 source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
 	modules.conf
 	freeswitch.confd
@@ -29,28 +29,26 @@ build() {
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/freeswitch \
 		--with-modinstdir=/usr/lib/freeswitch \
+		--with-rundir=/var/run/freeswitch \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
 
-	# check how/when parallel builds are fixed here:
-	# http://jira.freeswitch.org/browse/FSBUILD-6
-
-	# build the libs and prerequisites in parallel first
-	make libs/apr/libapr-1.la \
-		libs/apr-util/libaprutil-1.la \
-		libs/speex/libspeex/libspeexdsp.la \
-		libs/sqlite/libsqlite3.la \
-		libs/pcre/libpcre.la \
-		libs/srtp/libsrtp.la \
-		src/include/switch_version.h
-
-	# then the rest should build in parallel too
-	make || return 1
+	make all || return 1
 }
 package(){
 	cd "$srcdir/$pkgname-$pkgver"
 	make -j1 DESTDIR="$pkgdir" install
-	mkdir "$pkgdir"/var/run/freeswitch
+	# we need to do some moving/cleanup to allow some... kind of FHS
+	mkdir -p "$pkgdir"/var/run/freeswitch
+	mkdir -p "$pkgdir"/var/lib/freeswitch
+	mkdir -p "$pkgdir"/var/log
+	mkdir -p "$pkgdir"/usr/share/freeswitch
+	mv "$pkgdir"/usr/db "$pkgdir"/var/lib/freeswitch/
+	mv "$pkgdir"/usr/grammar "$pkgdir"/var/lib/freeswitch/
+	mv "$pkgdir"/usr/htdocs "$pkgdir"/usr/share/freeswitch/
+	mv "$pkgdir"/usr/recordings "$pkgdir"/var/lib/freeswitch/
+	mv "$pkgdir"/usr/scripts "$pkgdir"/usr/share/freeswitch/
+	mv "$pkgdir"/usr/log "$pkgdir"/var/log/freeswitch
 	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
 	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
 }
@@ -58,6 +56,6 @@ package(){
 md5sums="388effee587887a81fe7f411b7350590  freeswitch-1.0.6.tar.gz
 c05f2356be159e99b3845f5260a33599  modules.conf
 c608cca8ad773acebf201f581438c7e7  freeswitch.confd
-dd3a6535c54fc6ed8399d6bb57d88369  freeswitch.initd
-697f8069eb8eaa158fa6c063d0e5fed7  freeswitch.post-install
-661e2dff4022522b95c875f2f88aa66a  freeswitch.pre-install"
+a15f739b6f4f2c1685ab9f8831d30ca6  freeswitch.initd
+107c52398ff88275006b8223ee0b4907  freeswitch.post-install
+25945ad43b7dd988f37bf6f2603e22be  freeswitch.pre-install"
diff --git a/main/freeswitch/freeswitch.initd b/main/freeswitch/freeswitch.initd
index 84381d77..0538fff5 100755
--- a/main/freeswitch/freeswitch.initd
+++ b/main/freeswitch/freeswitch.initd
@@ -7,27 +7,52 @@ depend() {
     need net
 }
 
+opts="reload"
+
 start() {
     local OPTS
 
     [ -n "${FREESWITCH_USER}" ] && \
-        OPTS="${OPTS} -u ${FREESWITCH_USER}" 
+        OPTS="${OPTS} -u ${FREESWITCH_USER}"
 
     [ -n "${FREESWITCH_GROUP}" ] && \
-        OPTS="${OPTS} -g ${FREESWITCH_GROUP}" 
+        OPTS="${OPTS} -g ${FREESWITCH_GROUP}"
 
     [ -n "${FREESWITCH_OPTS}" ] && \
-        OPTS="${OPTS} ${FREESWITCH_OPTS}" 
+        OPTS="${OPTS} ${FREESWITCH_OPTS}"
 
-    ebegin "Starting Freeswitch" 
+    ebegin "Starting Freeswitch"
+    limits
     start-stop-daemon --start --quiet --exec /usr/bin/freeswitch \
-        --pidfile /var/run/freeswitch.pid -- -nc ${OPTS}
+    -- -nc -conf /etc/freeswitch -log /var/log/freeswitch \
+    -run /var/run/freeswitch -db /var/lib/freeswitch/db \
+    -htdocs /usr/share/freeswitch/htdocs \
+    -scripts /usr/share/freeswitch/scripts ${OPTS}
     eend $?
 }
 
+# Recomended ULIMIT settings
+# http://tinyurl.com/2dr467l (i,q,u,x not suppoted)
+
+limits() {
+   ulimit -c unlimited
+   ulimit -d unlimited
+   ulimit -f unlimited
+   ulimit -n 999999
+   ulimit -v unlimited
+   ulimit -s 244
+   ulimit -l unlimited
+}
+
 stop() {
-    ebegin "Stopping Freeswitch" 
-    start-stop-daemon --stop --quiet --pidfile /var/run/freeswitch.pid
+    ebegin "Stopping Freeswitch"
+    /usr/bin/freeswitch -stop
     eend $?
 }
 
+reload() {
+    start-stop-daemon --stop --signal 1 --quiet --pidfile \
+    /var/run/freeswitch.pid --name freeswitch
+    return 0
+}
+
diff --git a/main/freeswitch/freeswitch.post-install b/main/freeswitch/freeswitch.post-install
index 21577b1b..fef23cae 100755
--- a/main/freeswitch/freeswitch.post-install
+++ b/main/freeswitch/freeswitch.post-install
@@ -1,4 +1,5 @@
 #!/bin/sh
 
-chown -R freeswitch:freeswitch /var/run/freeswitch/
+chown -R freeswitch:freeswitch /var/*/freeswitch
 
+exit 0 
diff --git a/main/freeswitch/freeswitch.pre-install b/main/freeswitch/freeswitch.pre-install
index 23756f31..043b963b 100755
--- a/main/freeswitch/freeswitch.pre-install
+++ b/main/freeswitch/freeswitch.pre-install
@@ -1,3 +1,5 @@
 #!/bin/sh
 
-adduser -H /var/run/freeswitch  -s /bin/false -D freeswitch 2>/dev/null
+adduser -H -h /var/run/freeswitch -s /bin/false -D freeswitch 2>/dev/null
+
+exit 0
-- 
cgit v1.2.3


From d11109c53833fc56337b9229cf313a7b6adb5bd4 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Sat, 8 May 2010 10:55:49 +0000
Subject: main/freeswitch: small fix.

---
 main/freeswitch/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 27081c2e..149ecd42 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -9,7 +9,7 @@ depends=""
 makedepends="curl-dev unixodbc-dev zlib-dev openssl-dev
 	autoconf automake libtool"
 install="$pkgname.pre-install $pkgname.post-install"
-subpackages="$pkgname-dev $pkgname-sounds $pkgname-moh"
+subpackages="$pkgname-dev"
 source="http://files.freeswitch.org/freeswitch-$pkgver.tar.gz
 	modules.conf
 	freeswitch.confd
-- 
cgit v1.2.3


From 0717904e94aaa8bbdc4513781463e38f5f5ded7c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 09:19:58 +0000
Subject: main/git: fix segfault when cherry-pick

---
 main/git/APKBUILD                                  | 16 +++++---
 .../git-do-not-dump-core-when-iconv-fails.patch    | 43 ++++++++++++++++++++++
 2 files changed, 53 insertions(+), 6 deletions(-)
 create mode 100644 main/git/git-do-not-dump-core-when-iconv-fails.patch

diff --git a/main/git/APKBUILD b/main/git/APKBUILD
index 728fd7b1..5d5153c2 100644
--- a/main/git/APKBUILD
+++ b/main/git/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=git
 pkgver=1.7.1
-pkgrel=0
+pkgrel=1
 pkgdesc="GIT - the stupid content tracker"
 url="http://git.or.cz/"
 license="GPL2"
@@ -10,6 +10,7 @@ subpackages="$pkgname-doc $pkgname-perl"
 makedepends="zlib-dev openssl-dev curl-dev expat-dev perl-dev python-dev"
 source="http://kernel.org/pub/software/scm/git/git-$pkgver.tar.bz2
 	bb-tar.patch
+	git-do-not-dump-core-when-iconv-fails.patch
 	"
 
 _makeopts="NO_ICONV=YesPlease
@@ -17,14 +18,16 @@ _makeopts="NO_ICONV=YesPlease
 	NO_TCLTK=YesPlease
 	NO_SVN_TESTS=YesPlease"
 
-build () {
-	cd $srcdir/$pkgname-$pkgver
-	patch -p1 -i ../bb-tar.patch || return 1
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	patch -p1 -i "$srcdir"/bb-tar.patch || return 1
+	patch -p1 -i "$srcdir"/git-do-not-dump-core-when-iconv-fails.patch  \
+		|| return 1
 	make prefix=/usr DESTDIR="$pkgdir" $_makeopts || return 1
 }
 
 package() {
-	cd $srcdir/$pkgname-$pkgver
+	cd "$srcdir"/$pkgname-$pkgver
 	make prefix=/usr DESTDIR="$pkgdir" $_makeopts install
 }
 
@@ -43,4 +46,5 @@ perl() {
 
 
 md5sums="3da231dbe82ad103373cb530ae7475d5  git-1.7.1.tar.bz2
-e63a201556c4f089de790805c09a2e5b  bb-tar.patch"
+e63a201556c4f089de790805c09a2e5b  bb-tar.patch
+7c660517316261b383a094ef03aad0aa  git-do-not-dump-core-when-iconv-fails.patch"
diff --git a/main/git/git-do-not-dump-core-when-iconv-fails.patch b/main/git/git-do-not-dump-core-when-iconv-fails.patch
new file mode 100644
index 00000000..b338ee48
--- /dev/null
+++ b/main/git/git-do-not-dump-core-when-iconv-fails.patch
@@ -0,0 +1,43 @@
+commit 43acff34b902c38808ac0f326090f2516250e1f0
+Author: Jonathan Nieder <jrnieder@gmail.com>
+Date:   Sat May 8 18:17:29 2010 -0500
+
+    cherry-pick: do not dump core when iconv fails
+    
+    When cherry-picking, usually the new and old commit encodings are both
+    UTF-8.  Most old iconv implementations do not support this trivial
+    conversion, so on old platforms, out->message remains NULL, and later
+    attempts to read it segfault.
+    
+    Fix this by noticing the input and output encodings match and skipping
+    the iconv step, like the other reencode_string() call sites already do.
+    Also stop segfaulting on other iconv failures: if iconv fails for some
+    other reason, the best we can do is to pass the old message through.
+    
+    This fixes a regression introduced in v1.7.1-rc0~15^2~2 (revert:
+    clarify label on conflict hunks, 2010-03-20).
+    
+    Reported-by: Andreas Krey <a.krey@gmx.de>
+    Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+    Signed-off-by: Junio C Hamano <gitster@pobox.com>
+
+diff --git a/builtin/revert.c b/builtin/revert.c
+index 778a56e..7d68ef7 100644
+--- a/builtin/revert.c
++++ b/builtin/revert.c
+@@ -109,8 +109,13 @@ static int get_message(const char *raw_message, struct commit_message *out)
+ 		encoding = "UTF-8";
+ 	if (!git_commit_encoding)
+ 		git_commit_encoding = "UTF-8";
+-	if ((out->reencoded_message = reencode_string(raw_message,
+-					git_commit_encoding, encoding)))
++
++	out->reencoded_message = NULL;
++	out->message = raw_message;
++	if (strcmp(encoding, git_commit_encoding))
++		out->reencoded_message = reencode_string(raw_message,
++					git_commit_encoding, encoding);
++	if (out->reencoded_message)
+ 		out->message = out->reencoded_message;
+ 
+ 	abbrev = find_unique_abbrev(commit->object.sha1, DEFAULT_ABBREV);
-- 
cgit v1.2.3


From ae3f072c05c7c64aff458e7883136989f7563683 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Mon, 10 May 2010 09:23:16 +0000
Subject: main/php: fixed mysql socked file location.

---
 main/php/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index 1f62f11f..c0806718 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php
 pkgver=5.3.2
 _suhosinver=${pkgver}-0.9.9.1
-pkgrel=2
+pkgrel=3
 pkgdesc="The PHP language runtime engine"
 url="http://www.php.net/"
 license="PHP-3"
@@ -112,7 +112,7 @@ build() {
 		--with-jpeg-dir=shared,/usr \
 		--with-ldap=shared \
 		--with-mcrypt=shared \
-		--with-mysql-sock=/tmp/mysql.sock \
+		--with-mysql-sock=/var/run/mysqld/mysqld.sock \
 		--with-mysql=shared,mysqlnd \
 		--with-mysqli=shared,mysqlnd \
 		--with-openssl=shared \
-- 
cgit v1.2.3


From 0d3ebca5ac8e59dd587ad1bac7ea201fdec07464 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 12:04:40 +0000
Subject: main/alsa-lib: disable versioned symbols

uclibc does not support them.

Should make gstreamer alsa plugin work properly.
---
 main/alsa-lib/APKBUILD | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/main/alsa-lib/APKBUILD b/main/alsa-lib/APKBUILD
index ded73194..1b4503c9 100644
--- a/main/alsa-lib/APKBUILD
+++ b/main/alsa-lib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alsa-lib
 pkgver=1.0.23
-pkgrel=0
+pkgrel=1
 pkgdesc="An alternative implementation of Linux sound support"
 url="http://www.alsa-project.org"
 license="GPL"
@@ -19,6 +19,7 @@ build() {
 		--enable-seq \
 		--enable-aload \
 		--disable-dependency-tracking \
+		--without-versioned \
 		|| return 1
 	make || return 1
 }
-- 
cgit v1.2.3


From 784f6b19161dce1b630484ab43d3ec3d0bec4c3a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:20:09 +0000
Subject: main/mercurial: upgrade to 1.5.2

---
 main/mercurial/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/mercurial/APKBUILD b/main/mercurial/APKBUILD
index 236b2758..dd7d2653 100644
--- a/main/mercurial/APKBUILD
+++ b/main/mercurial/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mercurial
-pkgver=1.5.1
-pkgrel=1
+pkgver=1.5.2
+pkgrel=0
 pkgdesc="A scalable distributed SCM tool"
 url="http://www.selenic.com/mercurial"
 license="GPL"
@@ -29,4 +29,4 @@ package() {
 	install -Dm644 contrib/vim/HGAnnotate.vim \
 		"${vimpath}/syntax/HGAnnotate.vim" || return 1
 }
-md5sums="22eac5602d777f9601e23700e641503f  mercurial-1.5.1.tar.gz"
+md5sums="deafaaf017fc3c8a9deef39e566aec80  mercurial-1.5.2.tar.gz"
-- 
cgit v1.2.3


From 9e98d34f9ede93095873578cc8208a041a062ad2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:20:40 +0000
Subject: main/libxcb: upgrade to 1.6

---
 main/libxcb/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD
index d1275f04..6086b38d 100644
--- a/main/libxcb/APKBUILD
+++ b/main/libxcb/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxcb
-pkgver=1.5
-pkgrel=1
+pkgver=1.6
+pkgrel=0
 pkgdesc="X11 client-side library"
 url="http://xcb.freedesktop.org/"
 license="custom"
@@ -24,4 +24,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="d19c0ba6ba42ebccd3d62d8bb147b551  libxcb-1.5.tar.bz2"
+md5sums="cba9f6d1137ef00d9b326726d0bab6fd  libxcb-1.6.tar.bz2"
-- 
cgit v1.2.3


From f4f6ba33e0e9c60d8263cfc46dd94152d7c600f3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:21:13 +0000
Subject: main/libtasn1: upgrade to 2.6

---
 main/libtasn1/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libtasn1/APKBUILD b/main/libtasn1/APKBUILD
index f0075713..84b96532 100644
--- a/main/libtasn1/APKBUILD
+++ b/main/libtasn1/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libtasn1
-pkgver=2.5
-pkgrel=1
+pkgver=2.6
+pkgrel=0
 pkgdesc="The ASN.1 library used in GNUTLS"
 url="http://www.gnu.org/software/gnutls/"
 license="GPL3 LGPL"
@@ -22,4 +22,4 @@ package() {
 	cd "$_builddir"
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="e60b863697713c3d6a59b1e8c6f9b0d1  libtasn1-2.5.tar.gz"
+md5sums="d410671e13038324336917ceed7470a5  libtasn1-2.6.tar.gz"
-- 
cgit v1.2.3


From 604f7581c0a0a0be10580018729ffe7c21151a28 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:21:47 +0000
Subject: main/libgsf: upgrade to 1.14.18

---
 main/libgsf/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libgsf/APKBUILD b/main/libgsf/APKBUILD
index f8bdaa9a..c8d1e687 100644
--- a/main/libgsf/APKBUILD
+++ b/main/libgsf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgsf
-pkgver=1.14.16
-pkgrel=1
+pkgver=1.14.18
+pkgrel=0
 pkgdesc="The GNOME Structured File Library is a utility library for reading and writing structured file formats."
 url="http://www.gnome.org/"
 license="GPL LGPL"
@@ -31,4 +31,4 @@ package() {
 	rm -f "$pkgdir"/usr/share/man/man1/gsf-office-thumbnailer.1
 }
 
-md5sums="8478d83fda0b6e57f36550c11a693ee1  libgsf-1.14.16.tar.bz2"
+md5sums="2c15d875b1931c40c7e7a2368f3ed948  libgsf-1.14.18.tar.bz2"
-- 
cgit v1.2.3


From f13d96db8c5e7439302f727b7a9d9eea07acda80 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:24:21 +0000
Subject: main/hunspell: upgrade to 1.2.11

---
 main/hunspell/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/hunspell/APKBUILD b/main/hunspell/APKBUILD
index aea33aff..efd3476c 100644
--- a/main/hunspell/APKBUILD
+++ b/main/hunspell/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hunspell
-pkgver=1.2.10
+pkgver=1.2.11
 pkgrel=0
 pkgdesc="Spell checker and morphological analyzer library and program"
 url="http://hunspell.sourceforge.net/"
@@ -22,4 +22,4 @@ package() {
 	make -j1 DESTDIR="$pkgdir" install || return 1
 	rm -rf "$pkgdir"/usr/share/locale/locale.alias
 }
-md5sums="cc701ae1015e5442e85d592c325ea8aa  hunspell-1.2.10.tar.gz"
+md5sums="8f57cdc4db091d69e1f682ed4d8ab282  hunspell-1.2.11.tar.gz"
-- 
cgit v1.2.3


From 20bb03ab35e96ec8b008b3c9646d4380f2eb3eb2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:31:01 +0000
Subject: main/imlib2: upgrade to 1.4.4

---
 main/imlib2/APKBUILD             | 15 +++++----------
 main/imlib2/bufferoverflow.patch | 13 -------------
 main/imlib2/libpng14.patch       | 12 ------------
 3 files changed, 5 insertions(+), 35 deletions(-)
 delete mode 100644 main/imlib2/bufferoverflow.patch
 delete mode 100644 main/imlib2/libpng14.patch

diff --git a/main/imlib2/APKBUILD b/main/imlib2/APKBUILD
index 5176e2e5..fcd4e38a 100644
--- a/main/imlib2/APKBUILD
+++ b/main/imlib2/APKBUILD
@@ -1,23 +1,20 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=imlib2
-pkgver=1.4.2
-pkgrel=5
+pkgver=1.4.4
+pkgrel=0
 pkgdesc="Library that does image file loading and saving as well as rendering, manipulation, arbitrary polygon support"
 url="http://sourceforge.net/projects/enlightenment/"
 license="BSD"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
 makedepends="tiff-dev giflib-dev bzip2-dev freetype-dev libxext-dev
-	libpng-dev libid3tag-dev jpeg-dev libsm-dev zlib-dev"
+	libpng-dev libid3tag-dev jpeg-dev libsm-dev zlib-dev util-linux-ng-dev"
 source="http://downloads.sourceforge.net/enlightenment/$pkgname-$pkgver.tar.bz2
-	bufferoverflow.patch
-	libpng14.patch"
+	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -Np0 -i "$srcdir"/bufferoverflow.patch || return 1
-	patch -Np1 -i "$srcdir"/libpng14.patch || return 1
 }
 
 build() {
@@ -36,6 +33,4 @@ package() {
 	make DESTDIR=$pkgdir install || return 1
 	install -Dm644 COPYING $pkgdir/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="9f15568e76ebda9092c571e0df261f54  imlib2-1.4.2.tar.bz2
-76def1fe0ac2ac1686ff24d29979606f  bufferoverflow.patch
-68f671641e298ef7eead0aded4087c53  libpng14.patch"
+md5sums="b6de51879502e857d5b1f7622267a030  imlib2-1.4.4.tar.bz2"
diff --git a/main/imlib2/bufferoverflow.patch b/main/imlib2/bufferoverflow.patch
deleted file mode 100644
index 397b43fb..00000000
--- a/main/imlib2/bufferoverflow.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- src/modules/loaders/loader_xpm.c
-+++ src/modules/loaders/loader_xpm.c.new
-@@ -246,8 +246,8 @@
-                                  return 0;
-                               }
-                             ptr = im->data;
--                            end = ptr + (sizeof(DATA32) * w * h);
-                             pixels = w * h;
-+                            end = ptr + pixels;
-                          }
-                        else
-                          {
-
diff --git a/main/imlib2/libpng14.patch b/main/imlib2/libpng14.patch
deleted file mode 100644
index 04092284..00000000
--- a/main/imlib2/libpng14.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur imlib2-1.4.2-orig/src/modules/loaders/loader_png.c imlib2-1.4.2/src/modules/loaders/loader_png.c
---- imlib2-1.4.2-orig/src/modules/loaders/loader_png.c	2010-01-19 03:37:21.000000000 -0500
-+++ imlib2-1.4.2/src/modules/loaders/loader_png.c	2010-01-19 03:38:51.000000000 -0500
-@@ -38,7 +38,7 @@
- 
-         /* if we haven't read the header before, set the header data */
-         fread(buf, 1, PNG_BYTES_TO_CHECK, f);
--        if (!png_check_sig(buf, PNG_BYTES_TO_CHECK))
-+        if (png_sig_cmp(buf, 0, PNG_BYTES_TO_CHECK))
-           {
-              fclose(f);
-              return 0;
-- 
cgit v1.2.3


From b547b547bbbad6de97bd7bb1b54b57c2e4b45a2a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 13:32:21 +0000
Subject: main/dbus-glib: upgrade to 0.86

---
 main/dbus-glib/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/dbus-glib/APKBUILD b/main/dbus-glib/APKBUILD
index 4939ca59..799560fb 100644
--- a/main/dbus-glib/APKBUILD
+++ b/main/dbus-glib/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dbus-glib
-pkgver=0.82
-pkgrel=1
+pkgver=0.86
+pkgrel=0
 pkgdesc="GLib bindings for DBUS"
 url="http://www.freedesktop.org/wiki/Software/DBusBindings"
 license="GPL"
@@ -25,4 +25,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="aa2a4517de0e9144be3bce2cf8cdd924  dbus-glib-0.82.tar.gz"
+md5sums="cd0ab148fb0c786fc88be49d19971f50  dbus-glib-0.86.tar.gz"
-- 
cgit v1.2.3


From 2697a5397c0c7ea3582396c87edeb299439e5771 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 14:34:16 +0000
Subject: main/gtk-doc: upgrade to 1.14

---
 main/gtk-doc/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gtk-doc/APKBUILD b/main/gtk-doc/APKBUILD
index 9c86f49c..7b804017 100644
--- a/main/gtk-doc/APKBUILD
+++ b/main/gtk-doc/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk-doc
-pkgver=1.13
+pkgver=1.14
 pkgrel=0
 pkgdesc="Documentation tool for public library API"
 url="http://www.gtk.org/gtk-doc/"
 license="GPL FDL"
 depends="docbook-xsl gnome-doc-utils perl pkgconfig"
-makedepends="rarian-dev"
+makedepends="rarian-dev py-libxml2 gettext"
 source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/$pkgver/$pkgname-$pkgver.tar.bz2"
 
 build() { 
@@ -20,4 +20,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="27940d6cd5c9dcda8fc003043d8c299a  gtk-doc-1.13.tar.bz2"
+md5sums="7aa8a1262c70692ebbdf33395fddd5c4  gtk-doc-1.14.tar.bz2"
-- 
cgit v1.2.3


From 12bd73bd9081b4e5ac7e561d064f9ddf42395833 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 10 May 2010 14:41:12 +0000
Subject: main/apk-tools: fix segfault for apk info

ref #345
---
 main/apk-tools/APKBUILD            | 11 ++++++++---
 main/apk-tools/info-segfault.patch | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 main/apk-tools/info-segfault.patch

diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index 30f7eb5e..e9fd040f 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,26 +1,30 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
 makedepends="zlib-dev openssl-dev pkgconfig"
 source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
+	info-segfault.patch
 	"
 
 
 url="http://git.alpinelinux.org/cgit/apk-tools/"
 license=GPL-2
 
-build() {
+prepare() {
 	cd "$srcdir/$pkgname-$pkgver"
 	sed -i -e 's:-Werror::' Make.rules
 	for i in ../*.patch; do
 		[ -f $i ] || continue
 		patch -p1 -i $i || return 1
 	done
+}
 
+build() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make || return 1
 	make static || return 1
 	make DESTDIR="$pkgdir" install
@@ -40,4 +44,5 @@ static() {
 		"$subpkgdir"/sbin/apk.static
 }
 
-md5sums="c87cb88f90eb8d7021d37e3b5386863d  apk-tools-2.0.2.tar.bz2"
+md5sums="c87cb88f90eb8d7021d37e3b5386863d  apk-tools-2.0.2.tar.bz2
+aeab86a00119f9945edd6d3c3a8bb9c1  info-segfault.patch"
diff --git a/main/apk-tools/info-segfault.patch b/main/apk-tools/info-segfault.patch
new file mode 100644
index 00000000..9479fade
--- /dev/null
+++ b/main/apk-tools/info-segfault.patch
@@ -0,0 +1,22 @@
+commit 87420aaf295f58847332ba3aa89691a0259baace
+Author: Timo Teras <timo.teras@iki.fi>
+Date:   Wed May 5 08:56:06 2010 +0300
+
+    info: fix querying of removed, but referenced packages
+    
+    Check that package name has packages associated with it before
+    dereferencing the pointer. Fixes #345.
+
+diff --git a/src/info.c b/src/info.c
+index 7ca486c..d944fca 100644
+--- a/src/info.c
++++ b/src/info.c
+@@ -283,7 +283,7 @@ static int info_package(struct info_ctx *ctx, struct apk_database *db,
+ 
+ 	for (i = 0; i < argc; i++) {
+ 		name = apk_db_query_name(db, APK_BLOB_STR(argv[i]));
+-		if (name == NULL) {
++		if (name == NULL || name->pkgs == NULL) {
+ 			apk_error("Not found: %s", argv[i]);
+ 			return 1;
+ 		}
-- 
cgit v1.2.3


From c142813db6323befd942c1d19ae1d143ce043523 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Tue, 11 May 2010 11:03:14 +0000
Subject: main/php: add php-pear

xml is now buildin to support pear install.
---
 main/php/APKBUILD | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index c0806718..c2ab6e79 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php
 pkgver=5.3.2
 _suhosinver=${pkgver}-0.9.9.1
-pkgrel=3
+pkgrel=4
 pkgdesc="The PHP language runtime engine"
 url="http://www.php.net/"
 license="PHP-3"
@@ -15,7 +15,7 @@ makedepends="pcre-dev libxml2-dev libiconv-dev openssl-dev zlib-dev bzip2-dev
 	gd-dev gmp-dev gettext-dev imap-dev aspell-dev
 	net-snmp-dev libxslt-dev cyrus-sasl-dev openldap-dev pkgconfig
 	libgcrypt-dev"
-subpackages="$pkgname-dev $pkgname-doc $pkgname-cli
+subpackages="$pkgname-dev $pkgname-doc $pkgname-cli $pkgname-pear
 	$pkgname-bcmath
 	$pkgname-bz2
 	$pkgname-calendar
@@ -54,7 +54,6 @@ subpackages="$pkgname-dev $pkgname-doc $pkgname-cli
 	$pkgname-sysvmsg
 	$pkgname-sysvsem
 	$pkgname-sysvshm
-	$pkgname-xml
 	$pkgname-xmlrpc
 	$pkgname-xsl
 	$pkgname-zip
@@ -96,7 +95,7 @@ build() {
 		--enable-sysvmsg=shared \
 		--enable-sysvsem=shared \
 		--enable-sysvshm=shared \
-		--enable-xml=shared \
+		--enable-xml \
 		--enable-zip=shared \
 		--with-bz2=shared \
 		--with-curl=shared \
@@ -178,6 +177,17 @@ cli() {
 	mv "$pkgdir"/usr/bin/php "$subpkgdir"/usr/bin/
 }
 
+pear() {
+	depends="php"
+	mkdir -p "$subpkgdir"/usr/bin
+	mkdir -p "$subpkgdir"/usr/share
+	mkdir -p "$subpkgdir"/etc/php
+	mv "$pkgdir"/usr/share/pear "$subpkgdir"/usr/share/
+	mv "$pkgdir"/usr/bin/pear* "$subpkgdir"/usr/bin/
+	mv "$pkgdir"/usr/bin/pecl "$subpkgdir"/usr/bin/
+	mv "$pkgdir"/etc/php/pear.conf "$subpkgdir"/etc/php/
+}
+
 _mv_mod() {
 	pkgdesc="$1 php extension"
 	mkdir -p "$subpkgdir/$_extdir"
-- 
cgit v1.2.3


From 85656262f5d65aebc52916254d15785a9b3878c5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 11 May 2010 12:38:15 +0000
Subject: main/php: enable shared xml

we need patch the make install to find the xml.so
---
 main/php/APKBUILD                   |  8 +++++++-
 main/php/php-install-pear-xml.patch | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 main/php/php-install-pear-xml.patch

diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index c2ab6e79..43a33a6f 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -54,6 +54,7 @@ subpackages="$pkgname-dev $pkgname-doc $pkgname-cli $pkgname-pear
 	$pkgname-sysvmsg
 	$pkgname-sysvsem
 	$pkgname-sysvshm
+	$pkgname-xml
 	$pkgname-xmlrpc
 	$pkgname-xsl
 	$pkgname-zip
@@ -62,6 +63,7 @@ subpackages="$pkgname-dev $pkgname-doc $pkgname-cli $pkgname-pear
 
 source="http://www.php.net/distributions/${pkgname}-${pkgver}.tar.bz2
         http://download.suhosin.org/suhosin-patch-${_suhosinver}.patch.gz
+	php-install-pear-xml.patch
 	zend_execute_API.c.patch
 	"
 
@@ -70,6 +72,9 @@ _extdir="/usr/lib/php/20090626"
 build() {
         cd "$srcdir/$pkgname-$pkgver"
 
+	# beat the pear installer into using xml.so
+	patch -p1 -i "$srcdir"/php-install-pear-xml.patch || return 1
+
 	# apply suhosin patch
 	gunzip -c ${srcdir}/suhosin-patch-${_suhosinver}.patch.gz \
 		| patch -p1 || return 1
@@ -95,7 +100,7 @@ build() {
 		--enable-sysvmsg=shared \
 		--enable-sysvsem=shared \
 		--enable-sysvshm=shared \
-		--enable-xml \
+		--enable-xml=shared \
 		--enable-zip=shared \
 		--with-bz2=shared \
 		--with-curl=shared \
@@ -253,4 +258,5 @@ dev() {
 
 md5sums="46f500816125202c48a458d0133254a4  php-5.3.2.tar.bz2
 4647b05330862d6a1fc4469245cc6ade  suhosin-patch-5.3.2-0.9.9.1.patch.gz
+5111e3be06d391f8772587c675240fab  php-install-pear-xml.patch
 55f9d24316a57e0c0f6b4b84791a1a17  zend_execute_API.c.patch"
diff --git a/main/php/php-install-pear-xml.patch b/main/php/php-install-pear-xml.patch
new file mode 100644
index 00000000..f7a6fff5
--- /dev/null
+++ b/main/php/php-install-pear-xml.patch
@@ -0,0 +1,15 @@
+--- ./pear/Makefile.frag.orig
++++ ./pear/Makefile.frag
+@@ -2,8 +2,11 @@
+ 
+ peardir=$(PEAR_INSTALLDIR)
+ 
++# help the built php to find xml extension so we can install pear
++PEAR_INSTALL_XML_FLAGS = -d extension_dir="$(top_builddir)/modules" -d extension=xml.so
++
+ # Skip all php.ini files altogether
+-PEAR_INSTALL_FLAGS = -n -dshort_open_tag=0 -dsafe_mode=0 -dopen_basedir= -derror_reporting=1803 -dmemory_limit=-1 -ddetect_unicode=0
++PEAR_INSTALL_FLAGS = -n -dshort_open_tag=0 -dsafe_mode=0 -dopen_basedir= -derror_reporting=1803 -dmemory_limit=-1 -ddetect_unicode=0 $(PEAR_INSTALL_XML_FLAGS)
+ 
+ WGET = `which wget 2>/dev/null`
+ FETCH = `which fetch 2>/dev/null`
-- 
cgit v1.2.3


From d095b1300684cc6208608d6f9407473fcd3265b1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 11 May 2010 13:01:38 +0000
Subject: main/libc0.9.32: fix for libm and PIC

This solves issue with qemu
---
 main/libc0.9.32/APKBUILD              |  4 ++-
 main/libc0.9.32/uclibc-libm-pic.patch | 67 +++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 main/libc0.9.32/uclibc-libm-pic.patch

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index db7a9b0c..84fe97a8 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100507
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=0
+pkgrel=1
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -19,6 +19,7 @@ source="http://build.alpinelinux.org:8010/distfiles/$_snapfile
 	compat-stack-guard.patch
 	0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 	0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
+	uclibc-libm-pic.patch
 	uclibcconfig.x86
 	uclibcconfig.i486
 	"
@@ -96,5 +97,6 @@ md5sums="46e98672dc2a4309d9a7c65b4e626845  libc0.9.32-0.9.32_alpha0_git100507.ta
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
 826666b365f2d63a71d67eb76c94f7bc  0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 0800a489a738c7b1d8c3643cb9806926  0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
+2f9739a980be24a842c57516155c7885  uclibc-libm-pic.patch
 e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.x86
 e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.i486"
diff --git a/main/libc0.9.32/uclibc-libm-pic.patch b/main/libc0.9.32/uclibc-libm-pic.patch
new file mode 100644
index 00000000..ad87b78b
--- /dev/null
+++ b/main/libc0.9.32/uclibc-libm-pic.patch
@@ -0,0 +1,67 @@
+GCC can emit prologue/epilogue code for the functions in various
+different cases:
+ - frame pointers
+ - PIC build (to load ebx for indirect calls/jumps)
+ - forced stack smashing protection
+
+If we used jump in such cases, we'd corrupt the call stack and
+crash.
+
+Signed-off-by: Timo Teräs <timo.teras at iki.fi>
+---
+ libm/ldouble_wrappers.c |   12 +++++++-----
+ 1 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/libm/ldouble_wrappers.c b/libm/ldouble_wrappers.c
+index 7d5af90..5b424dc 100644
+--- a/libm/ldouble_wrappers.c
++++ b/libm/ldouble_wrappers.c
+@@ -60,7 +60,9 @@ long long func##l(long double x) \
+  * The return value is returned in st(0) per ABI in both cases (returning
+  * a long double or returning a double). So we can simply jump to func.
+  * Using __GI_func in jump to make optimized intra-library jump.
+- * gcc will still generate a useless "ret" after asm. Oh well...
++ *
++ * We do need to use call (instead of tail jump) as gcc can create
++ * stack frame, and push/modify/pop ebx during PIC build.
+  */
+ # define WRAPPER1(func) \
+ long double func##l(long double x) \
+@@ -69,7 +71,7 @@ long double func##l(long double x) \
+ 	__asm ( \
+ 	"	fldt	%1\n" \
+ 	"	fstpl	%1\n" \
+-	"	jmp	" __stringify(__GI_##func) "\n" \
++	"	call	" __stringify(__GI_##func) "\n" \
+ 	: "=t" (st_top) \
+ 	: "m" (x) \
+ 	); \
+@@ -82,7 +84,7 @@ int func##l(long double x) \
+ 	__asm ( \
+ 	"	fldt	%1\n" \
+ 	"	fstpl	%1\n" \
+-	"	jmp	" __stringify(__GI_##func) "\n" \
++	"	call	" __stringify(__GI_##func) "\n" \
+ 	: "=a" (ret) \
+ 	: "m" (x) \
+ 	); \
+@@ -95,7 +97,7 @@ long func##l(long double x) \
+ 	__asm ( \
+ 	"	fldt	%1\n" \
+ 	"	fstpl	%1\n" \
+-	"	jmp	" __stringify(__GI_##func) "\n" \
++	"	call	" __stringify(__GI_##func) "\n" \
+ 	: "=a" (ret) \
+ 	: "m" (x) \
+ 	); \
+@@ -108,7 +110,7 @@ long long func##l(long double x) \
+ 	__asm ( \
+ 	"	fldt	%1\n" \
+ 	"	fstpl	%1\n" \
+-	"	jmp	" __stringify(__GI_##func) "\n" \
++	"	call	" __stringify(__GI_##func) "\n" \
+ 	: "=A" (ret) \
+ 	: "m" (x) \
+ 	); \
+-- 
+1.7.0.4
-- 
cgit v1.2.3


From 2148c8adcbd9a2cc492d33f5ad9030378ae3b0db Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 11 May 2010 14:38:57 +0000
Subject: main/fetchmail: upgrade to 6.3.17

---
 main/fetchmail/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/fetchmail/APKBUILD b/main/fetchmail/APKBUILD
index 3c099e78..5e1ba967 100644
--- a/main/fetchmail/APKBUILD
+++ b/main/fetchmail/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Michael Mason <ms13sp@gmail.com> 
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fetchmail
-pkgver=6.3.16
-pkgrel=1
+pkgver=6.3.17
+pkgrel=0
 pkgdesc="A remote-mail retrieval and forwarding utility"
 url="http://fetchmail.berlios.de/"
 license="GPL"
@@ -41,5 +41,5 @@ fetchmailconf() {
 	mv usr/lib "$subpkgdir"/usr/
 }
 
-md5sums="1a40acb371376c7d54fe468c99dfc216  fetchmail-6.3.16.tar.bz2
+md5sums="7b1d449ecddb6164e22c32854adc4a75  fetchmail-6.3.17.tar.bz2
 b27fe01a7c25534d62d175c8ba22fc48  fetchmail.initd"
-- 
cgit v1.2.3


From 3730991b1d1c34e4da7fccebe397b02c220733f9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 08:05:56 +0000
Subject: main/libc0.9.32: fix for resolver with nptl

http://lists.uclibc.org/pipermail/uclibc/2010-May/044056.html
---
 main/libc0.9.32/APKBUILD                |  4 +++-
 main/libc0.9.32/uclibc-resolv-tls.patch | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 main/libc0.9.32/uclibc-resolv-tls.patch

diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 84fe97a8..47bc5862 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100507
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=1
+pkgrel=2
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -20,6 +20,7 @@ source="http://build.alpinelinux.org:8010/distfiles/$_snapfile
 	0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 	0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 	uclibc-libm-pic.patch
+	uclibc-resolv-tls.patch
 	uclibcconfig.x86
 	uclibcconfig.i486
 	"
@@ -98,5 +99,6 @@ md5sums="46e98672dc2a4309d9a7c65b4e626845  libc0.9.32-0.9.32_alpha0_git100507.ta
 826666b365f2d63a71d67eb76c94f7bc  0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 0800a489a738c7b1d8c3643cb9806926  0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 2f9739a980be24a842c57516155c7885  uclibc-libm-pic.patch
+d08831b452acdeaa3037525ee617edab  uclibc-resolv-tls.patch
 e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.x86
 e2eb3bb00a0fe4d6f3d5b5c56b027bab  uclibcconfig.i486"
diff --git a/main/libc0.9.32/uclibc-resolv-tls.patch b/main/libc0.9.32/uclibc-resolv-tls.patch
new file mode 100644
index 00000000..45a22851
--- /dev/null
+++ b/main/libc0.9.32/uclibc-resolv-tls.patch
@@ -0,0 +1,15 @@
+diff --git a/libc/inet/resolv.c b/libc/inet/resolv.c
+index 320aec4..f8066d2 100644
+--- a/libc/inet/resolv.c
++++ b/libc/inet/resolv.c
+@@ -2916,8 +2916,8 @@ static void res_sync_func(void)
+ 			__nameserver[n].sa4 = rp->nsaddr_list[n]; /* struct copy */
+ #endif
+ 	}
+-	__resolv_timeout = rp->retrans;
+-	__resolv_attempts = rp->retry;
++	__resolv_timeout = rp->retrans ?: RES_TIMEOUT;
++	__resolv_attempts = rp->retry ?: RES_DFLRETRY;
+ 	/* Extend and comment what program is known
+ 	 * to use which _res.XXX member(s).
+ 
-- 
cgit v1.2.3


From 17a22befb16c244fb8ba2a7550a0fbf61d653beb Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 08:24:51 +0000
Subject: main/asterisk-addons: new aport

additional modules for asterisk: mysql mp3 ooh323 saycountpl
---
 main/asterisk-addons/APKBUILD | 67 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 main/asterisk-addons/APKBUILD

diff --git a/main/asterisk-addons/APKBUILD b/main/asterisk-addons/APKBUILD
new file mode 100644
index 00000000..a872791d
--- /dev/null
+++ b/main/asterisk-addons/APKBUILD
@@ -0,0 +1,67 @@
+# Contributor: Carlo Landmeter
+# Maintainer: 
+pkgname=asterisk-addons
+pkgver=1.6.2.1
+pkgrel=0
+pkgdesc="Asterisk addons"
+url="http://www.asterisk.org"
+license="GPL2"
+makedepends="mysql-dev asterisk-dev"
+install=
+subpackages="$pkgname-mysql $pkgname-mp3 $pkgname-ooh323 $pkgname-saycountpl"
+depends=$subpackages
+source="http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-addons-1.6.2.1.tar.gz"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	./bootstrap.sh
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	
+	make -j1 || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make -j1 DESTDIR="$pkgdir" install
+	make -j1 DESTDIR="$pkgdir" samples
+	# we are not building the mobile module because aports does not have bluez so we delete mobile.conf
+	rm -rf "$pkgdir"/etc
+}
+
+_find_and_move() {
+        local pattern="$1"
+        cd "$pkgdir" || return 1
+        find -name "$pattern" -type f | while read f; do
+                local dest="$subpkgdir/${f%/*}"
+                mkdir -p "$dest"
+                mv "$f" "$dest"
+        done
+}
+
+mysql() {
+	_find_and_move '*mysql*'
+}
+
+mp3() {
+	_find_and_move '*mp3*'
+}
+
+ooh323() {
+	_find_and_move '*ooh323*'
+}
+
+saycountpl() {
+	_find_and_move '*saycountpl*'
+	mv "$pkgdir"/var "$subpkgdir"
+}
+
+md5sums="95e33f22f53d58ac95c54d2c8b8d9d76  asterisk-addons-1.6.2.1.tar.gz"
-- 
cgit v1.2.3


From 3baa1fc3046fa6e520c095de31ce7552c55450ab Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 08:37:27 +0000
Subject: main/asterisk-addons: build fix

needs autoconf automake
---
 main/asterisk-addons/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/asterisk-addons/APKBUILD b/main/asterisk-addons/APKBUILD
index a872791d..90ab4305 100644
--- a/main/asterisk-addons/APKBUILD
+++ b/main/asterisk-addons/APKBUILD
@@ -6,10 +6,10 @@ pkgrel=0
 pkgdesc="Asterisk addons"
 url="http://www.asterisk.org"
 license="GPL2"
-makedepends="mysql-dev asterisk-dev"
+makedepends="mysql-dev asterisk-dev autoconf automake"
 install=
 subpackages="$pkgname-mysql $pkgname-mp3 $pkgname-ooh323 $pkgname-saycountpl"
-depends=$subpackages
+depends="$subpackages"
 source="http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-addons-1.6.2.1.tar.gz"
 
 _builddir="$srcdir"/$pkgname-$pkgver
-- 
cgit v1.2.3


From 4fbbb627548e7f72a952d6779b08645bedd73760 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 08:58:33 +0000
Subject: main/asterisk-addons: fix subs depend and description

---
 main/asterisk-addons/APKBUILD | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/main/asterisk-addons/APKBUILD b/main/asterisk-addons/APKBUILD
index 90ab4305..92fb1990 100644
--- a/main/asterisk-addons/APKBUILD
+++ b/main/asterisk-addons/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=asterisk-addons
 pkgver=1.6.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Asterisk addons"
 url="http://www.asterisk.org"
 license="GPL2"
@@ -48,18 +48,26 @@ _find_and_move() {
 }
 
 mysql() {
+	pkgdesc="Asterisk mysql addons"
+	depends="asterisk"
 	_find_and_move '*mysql*'
 }
 
 mp3() {
+	pkgdesc="Asterisk mp3 addon"
+	depends="asterisk"
 	_find_and_move '*mp3*'
 }
 
 ooh323() {
+	pkgdesc="Asterisk h323 channel driver"
+	depends="asterisk"
 	_find_and_move '*ooh323*'
 }
 
 saycountpl() {
+	pkgdesc="Asterisk say count pl application"
+	depends="asterisk"
 	_find_and_move '*saycountpl*'
 	mv "$pkgdir"/var "$subpkgdir"
 }
-- 
cgit v1.2.3


From 576e978b936ff46e0ca43463338bc74180db7a2e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 09:36:46 +0000
Subject: main/nfs-utils: subpackage for rpcgen

---
 main/nfs-utils/APKBUILD | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/main/nfs-utils/APKBUILD b/main/nfs-utils/APKBUILD
index 45ee5a70..4807e752 100644
--- a/main/nfs-utils/APKBUILD
+++ b/main/nfs-utils/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=nfs-utils
 pkgver=1.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="kernel-mode NFS"
 url="http://nfs.sourceforge.net/"
 license="GPL"
 depends="portmap"
 makedepends="e2fsprogs-dev"
-subpackages="$pkgname-doc"
+subpackages="$pkgname-doc rpcgen"
 source="http://downloads.sourceforge.net/nfs/$pkgname-$pkgver.tar.bz2
 	nfs.initd
 	nfs.confd
@@ -37,13 +37,21 @@ build() {
 		--with-statedir=/var/lib/nfs
 
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make -j1 DESTDIR="$pkgdir" install
 
 	install -m755 -D "$srcdir"/nfs.initd "$pkgdir"/etc/init.d/nfs
 	install -m644 -D "$srcdir"/nfs.confd "$pkgdir"/etc/conf.d/nfs
 	install -m644 -D "$srcdir"/nfs.exports "$pkgdir"/etc/exports
-	#mkdir -p "$pkgdir"/usr/lib/nfs
-	install -m755 -D tools/rpcgen/rpcgen "$pkgdir"/usr/bin/rpcgen
+}
+
+rpcgen() {
+	pkgdesc="Remote Procedure Call (RPC) protocol compiler"
+	cd "$srcdir/$pkgname-$pkgver"
+	install -m755 -D tools/rpcgen/rpcgen "$subpkgdir"/usr/bin/rpcgen
 }
 
 md5sums="779cf81044e92cb51ad590960e7b3671  nfs-utils-1.2.0.tar.bz2
-- 
cgit v1.2.3


From 1623d353a651506fa3f45621440e340b01ff277c Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:40:20 +0000
Subject: main/unixodbc: upgrade to 2.3.0

---
 main/unixodbc/APKBUILD | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/main/unixodbc/APKBUILD b/main/unixodbc/APKBUILD
index 461f4d41..48d2efe9 100644
--- a/main/unixodbc/APKBUILD
+++ b/main/unixodbc/APKBUILD
@@ -1,18 +1,20 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=unixodbc
-pkgver=2.2.14
-pkgrel=2
+pkgver=2.3.0
+pkgrel=0
 pkgdesc="ODBC is an open specification to access Data Sources"
 url="http://www.unixodbc.org/"
 license="GPL2"
-depends="readline"
+depends=
 makedepends="readline-dev"
 subpackages="$pkgname-dev"
 source="http://www.unixodbc.org/unixODBC-${pkgver}.tar.gz"
 
+_builddir="$srcdir/unixODBC-$pkgver"
+
 build() {
-	cd "$srcdir/unixODBC-$pkgver"
+	cd "$_builddir"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
@@ -24,9 +26,9 @@ build() {
 }
 
 package() {
-	cd "$srcdir/unixODBC-$pkgver"
+	cd "$_builddir"
 	make -j1 DESTDIR="$pkgdir" install
 
 }
 
-md5sums="f47c2efb28618ecf5f33319140a7acd0  unixODBC-2.2.14.tar.gz"
+md5sums="f2ad22cbdffe836c58987ed2332c2e99  unixODBC-2.3.0.tar.gz"
-- 
cgit v1.2.3


From 8e0d1d48946e43ca3bd83dd41eda1275f81e21a0 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:42:32 +0000
Subject: main/ncftp: upgrade to 3.2.4

---
 main/ncftp/APKBUILD | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/main/ncftp/APKBUILD b/main/ncftp/APKBUILD
index 29ae6197..94b08e15 100644
--- a/main/ncftp/APKBUILD
+++ b/main/ncftp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=ncftp
-pkgver=3.2.3
-pkgrel=1
+pkgver=3.2.4
+pkgrel=0
 pkgdesc="A set of free application programs implementing FTP"
 url="http://www.ncftp.com/"
 license="custom"
@@ -11,19 +11,31 @@ install="$pkgname.post-install"
 source="ftp://ftp.$pkgname.com/$pkgname/$pkgname-$pkgver-src.tar.bz2"
 subpackages="$pkgname-doc $pkgname-bookmarks"
 
+_builddir="$srcdir/$pkgname-$pkgver"
+
+prepare() {
+	mkdir -p "$pkgdir"/usr/share || return 1
+}
+
 build () {
-	cd "${srcdir}/${pkgname}-${pkgver}" || return 1
-	install -d "${pkgdir}"/usr/share | return 1
+	cd "$_builddir" || return 1
+
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--mandir=/usr/share/man || return 1
-	cd "${srcdir}/${pkgname}-${pkgver}"/libncftp
+	
+	cd "$_builddir"/libncftp
 	make shared || return 1
-	make PREFIX="${pkgdir}"/usr soinstall || return 1
-	cd "${srcdir}/${pkgname}-${pkgver}" || return 1
+	cd "$_builddir" || return 1
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"/libncftp
+	make PREFIX="${pkgdir}"/usr soinstall || return 1
+	cd "$_builddir" || return 1
 	make DESTDIR="$pkgdir" install || return 1
-	install -D doc/LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}"/LICENSE || return 1
+	install -D doc/LICENSE.txt "$pkgdir"/usr/share/licenses/"$pkgname"/LICENSE || return 1
 }
 
 bookmarks () {
@@ -32,4 +44,4 @@ bookmarks () {
 	mv "$pkgdir"/usr/bin/ncftpbookmarks "$subpkgdir"/usr/bin/ || return 1
 }
 
-md5sums="fac4aa169e1734e8d9617afd4a9b51e5  ncftp-3.2.3-src.tar.bz2"
+md5sums="216d6befdd7381b11ffdc8b6e0c1bd12  ncftp-3.2.4-src.tar.bz2"
-- 
cgit v1.2.3


From 28915d9d49091b82f94b72502fe2071919b80ec7 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:43:39 +0000
Subject: main/libxml2: upgrade to 2.7.7

---
 main/libxml2/APKBUILD   | 12 +++++-------
 main/libxml2/zlib.patch | 32 --------------------------------
 2 files changed, 5 insertions(+), 39 deletions(-)
 delete mode 100644 main/libxml2/zlib.patch

diff --git a/main/libxml2/APKBUILD b/main/libxml2/APKBUILD
index 4843af7a..6c314eb5 100644
--- a/main/libxml2/APKBUILD
+++ b/main/libxml2/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter at gmail>
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=libxml2
-pkgver=2.7.6
-pkgrel=3
+pkgver=2.7.7
+pkgrel=0
 pkgdesc="XML parsing library, version 2"
 url="http://www.xmlsoft.org/"
 license="MIT"
@@ -10,8 +10,7 @@ depends=
 makedepends="zlib-dev python-dev"
 subpackages="$pkgname-doc $pkgname-dev py-$pkgname:py"
 source="ftp://ftp.xmlsoft.org/${pkgname}/${pkgname}-${pkgver}.tar.gz
-	largefile64.patch
-	zlib.patch"
+	largefile64.patch"
 
 options="!strip"
 
@@ -46,6 +45,5 @@ py() {
 }
 
 
-md5sums="7740a8ec23878a2f50120e1faa2730f2  libxml2-2.7.6.tar.gz
-5ad4915665608ebfa5b89f7908467a72  largefile64.patch
-0365d5397164b8739219e56e5ca069d1  zlib.patch"
+md5sums="9abc9959823ca9ff904f1fbcf21df066  libxml2-2.7.7.tar.gz
+5ad4915665608ebfa5b89f7908467a72  largefile64.patch"
diff --git a/main/libxml2/zlib.patch b/main/libxml2/zlib.patch
deleted file mode 100644
index 4bf486d1..00000000
--- a/main/libxml2/zlib.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From a7e79f28689c574e0bbef17f4cb3da00249181ff Mon Sep 17 00:00:00 2001
-From: Mark Adler <madler@alumni.caltech.edu>
-Date: Tue, 19 Jan 2010 15:28:48 +0000
-Subject: libxml violates the zlib interface and crashes
-
-* xmlIO.c: remove an abuse of zlib API and use a clean interface
-  available in zlib >= 1.2.3
----
-diff --git a/xmlIO.c b/xmlIO.c
-index c03ac43..8fc00e3 100644
---- a/xmlIO.c
-+++ b/xmlIO.c
-@@ -2518,6 +2518,9 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
- #ifdef HAVE_ZLIB_H
- 	if ((xmlInputCallbackTable[i].opencallback == xmlGzfileOpen) &&
- 		(strcmp(URI, "-") != 0)) {
-+#if defined(ZLIB_VERNUM) && ZLIB_VERNUM >= 0x1230
-+            ret->compressed = !gzdirect(context);
-+#else
- 	    if (((z_stream *)context)->avail_in > 4) {
- 	        char *cptr, buff4[4];
- 		cptr = (char *) ((z_stream *)context)->next_in;
-@@ -2529,6 +2532,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
- 		    gzrewind(context);
- 		}
- 	    }
-+#endif
- 	}
- #endif
-     }
---
-cgit v0.8.3.1
-- 
cgit v1.2.3


From b11b8ab1541e74329205cc49cbc594c450971724 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:44:50 +0000
Subject: main/lftp: upgrade to 4.0.7

---
 main/lftp/APKBUILD | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/main/lftp/APKBUILD b/main/lftp/APKBUILD
index cf79f761..76f3869e 100644
--- a/main/lftp/APKBUILD
+++ b/main/lftp/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=lftp
-pkgver=4.0.5
-pkgrel=1
+pkgver=4.0.7
+pkgrel=0
 pkgdesc="LFTP is sophisticated ftp/http client"
 url="http://lftp.yar.ru/"
 license="GPL"
@@ -11,8 +11,10 @@ makedepends="openssl-dev readline-dev ncurses-dev gettext-dev"
 subpackages="$pkgname-doc"
 source="http://ftp.yars.free.net/pub/source/lftp/lftp-${pkgver}.tar.bz2"
 
+_builddir="$srcdir/$pkgname-$pkgver"
+
 build() {
-	cd "$srcdir/$pkgname-$pkgver"
+	cd "$_builddir"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/lftp \
@@ -25,8 +27,8 @@ build() {
 }
 
 package() {
-	cd "$srcdir/$pkgname-$pkgver"
+	cd "$_builddir"
 	make -j1 DESTDIR="$pkgdir" install
 }
 
-md5sums="5400cad5f91e131ac2ded7c24aea594c  lftp-4.0.5.tar.bz2"
+md5sums="a40e4518fc477c82ffcc5b04d9ff64ff  lftp-4.0.7.tar.bz2"
-- 
cgit v1.2.3


From 3eeb4072692751a8a71d541c117c7d9dedb973a9 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:46:19 +0000
Subject: main/irssi: upgrade to 0.8.15

---
 main/irssi/APKBUILD | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/main/irssi/APKBUILD b/main/irssi/APKBUILD
index e20661c3..253c96ea 100644
--- a/main/irssi/APKBUILD
+++ b/main/irssi/APKBUILD
@@ -1,8 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=irssi
-pkgver=0.8.14
-#_pkgver=0.8.14
-pkgrel=2
+pkgver=0.8.15
+pkgrel=0
 pkgdesc="A modular textUI IRC client with IPv6 support"
 url="http://irssi.org/"
 license='GPL'
@@ -11,8 +10,10 @@ makedepends="glib-dev openssl-dev ncurses-dev perl-dev pkgconfig"
 source="http://irssi.org/files/irssi-${pkgver}.tar.bz2"
 subpackages="$pkgname-doc $pkgname-dev $pkgname-perl"
 
+_builddir="$srcdir/$pkgname-$pkgver"
+
 build() {
-	cd "$srcdir/$pkgname-${pkgver}"
+	cd "$_builddir"
 
 	./configure --prefix=/usr \
 	--sysconfdir=/etc \
@@ -22,13 +23,24 @@ build() {
 	make DESTDIR="$pkgdir" install
 }
 
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
 perl() {
 	depends="$pkgname perl"
+	pkgdesc="Irssi perl support and scripts"
 	mkdir -p "$subpkgdir"/usr/share/irssi
 	mv "$pkgdir"/usr/share/irssi/scripts "$subpkgdir"/usr/share/irssi/
 	mkdir -p "$subpkgdir"/usr/lib/irssi
 	mv "$pkgdir"/usr/lib/irssi/modules "$subpkgdir"/usr/lib/irssi/
 	mv "$pkgdir"/usr/lib/perl5 "$subpkgdir"/usr/lib/
+	#need write permission when stripping
+	chmod +w "$subpkgdir"/usr/lib/perl5/core_perl/auto/Irssi/TextUI/TextUI.so
+	chmod +w "$subpkgdir"/usr/lib/perl5/core_perl/auto/Irssi/Irssi.so
+	chmod +w "$subpkgdir"/usr/lib/perl5/core_perl/auto/Irssi/Irc/Irc.so
+	chmod +w "$subpkgdir"/usr/lib/perl5/core_perl/auto/Irssi/UI/UI.so
 }
 
-md5sums="00efe7638dd596d5930dfa2aeae87b3a  irssi-0.8.14.tar.bz2"
+md5sums="1dcb3f511b88df94b0c996f36668c7da  irssi-0.8.15.tar.bz2"
-- 
cgit v1.2.3


From 11273f797707a8bb7e65a561581863304672135a Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:47:38 +0000
Subject: main/curl: upgrade to 7.20.1

---
 main/curl/APKBUILD | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/main/curl/APKBUILD b/main/curl/APKBUILD
index 380d934a..f868ab19 100644
--- a/main/curl/APKBUILD
+++ b/main/curl/APKBUILD
@@ -1,18 +1,19 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=curl
-pkgver=7.19.7
-pkgrel=1
+pkgver=7.20.1
+pkgrel=0
 pkgdesc="An URL retrival utility and library"
 url="http://curl.haxx.se"
 license="MIT"
 depends=
 makedepends="zlib-dev openssl-dev"
-source="http://curl.osmirror.nl/download/curl-$pkgver.tar.bz2"
-
+source="http://curl.haxx.se/download/curl-$pkgver.tar.bz2"
 subpackages="$pkgname-doc $pkgname-dev"
 
+_builddir="$srcdir/$pkgname-$pkgver"
+
 build() {
-	cd "$srcdir/$pkgname-$pkgver"
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--mandir=/usr/share/man \
 		--without-libidn \
@@ -21,8 +22,8 @@ build() {
 }
 
 package() {
-	cd "$srcdir/$pkgname-$pkgver"
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="79a8fbb2eed5464b97bdf94bee109380  curl-7.19.7.tar.bz2"
+md5sums="244b16b2a38c70e47130c8494b7371b9  curl-7.20.1.tar.bz2"
-- 
cgit v1.2.3


From ab1a76054e476edd4a0342d01ac765af084b7a92 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:49:38 +0000
Subject: main/clamav: upgrade to 0.96

---
 main/clamav/APKBUILD | 71 +++++++++++++++++++++++++++++++---------------------
 1 file changed, 42 insertions(+), 29 deletions(-)

diff --git a/main/clamav/APKBUILD b/main/clamav/APKBUILD
index fc5b1941..b59af1b9 100644
--- a/main/clamav/APKBUILD
+++ b/main/clamav/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter at gmail>
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=clamav
-pkgver=0.95.3
-pkgrel=1
+pkgver=0.96
+pkgrel=0
 pkgusers=clamav
 pkggroups=clamav
 pkgdesc="An anti-virus toolkit for UNIX"
@@ -21,48 +21,61 @@ source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
 	clamav.logrotate
 	"
 
-build() {
-	cd "$srcdir/$pkgname-$pkgver"
+_builddir="$srcdir/$pkgname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
 
 	patch -p0 -i "$srcdir/clamav-0.95.1-nls.patch" || return 1
+}
+
+build() {
+	cd "$_builddir"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/clamav \
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info \
-		--without-iconv
+		--without-iconv \
+		--disable-llvm
+	
 	make || return 1
+}
+
+package() {
+        cd "$_builddir"
+
 	make DESTDIR="$pkgdir" install
 
-	# Change /etc/clamd.conf to be usable out of the box
-	sed -i -e "s:^\(Example\):\# \1:" \
-		-e "s:.*\(PidFile\) .*:\1 /var/run/clamav/clamd.pid:" \
-		-e "s:.*\(LocalSocket\) .*:\1 /var/run/clamav/clamd.sock:" \
-		-e "s:.*\(User\) .*:\1 clamav:" \
-		-e "s:^\#\(LogFile\) .*:\1 /var/log/clamav/clamd.log:" \
-		-e "s:^\#\(LogTime\).*:\1 yes:" \
-		-e "s:^\#\(AllowSupplementaryGroups\).*:\1 yes:" \
-		"$pkgdir"/etc/clamav/clamd.conf
+        # Change /etc/clamd.conf to be usable out of the box
+        sed -i -e "s:^\(Example\):\# \1:" \
+                -e "s:.*\(PidFile\) .*:\1 /var/run/clamav/clamd.pid:" \
+                -e "s:.*\(LocalSocket\) .*:\1 /var/run/clamav/clamd.sock:" \
+                -e "s:.*\(User\) .*:\1 clamav:" \
+                -e "s:^\#\(LogFile\) .*:\1 /var/log/clamav/clamd.log:" \
+                -e "s:^\#\(LogTime\).*:\1 yes:" \
+                -e "s:^\#\(AllowSupplementaryGroups\).*:\1 yes:" \
+                "$pkgdir"/etc/clamav/clamd.conf
 
-	# Do the same for /etc/freshclam.conf
-	sed -i -e "s:^\(Example\):\# \1:" \
-		-e "s:.*\(PidFile\) .*:\1 /var/run/clamav/freshclam.pid:" \
-		-e "s:.*\(DatabaseOwner\) .*:\1 clamav:" \
-		-e "s:^\#\(UpdateLogFile\) .*:\1 /var/log/clamav/freshclam.log:" \
-		-e "s:^\#\(NotifyClamd\).*:\1 /etc/clamav/clamd.conf:" \
-		-e "s:^\#\(ScriptedUpdates\).*:\1 yes:" \
-		-e "s:^\#\(AllowSupplementaryGroups\).*:\1 yes:" \
-		"$pkgdir"/etc/clamav/freshclam.conf
+        # Do the same for /etc/freshclam.conf
+        sed -i -e "s:^\(Example\):\# \1:" \
+                -e "s:.*\(PidFile\) .*:\1 /var/run/clamav/freshclam.pid:" \
+                -e "s:.*\(DatabaseOwner\) .*:\1 clamav:" \
+                -e "s:^\#\(UpdateLogFile\) .*:\1 /var/log/clamav/freshclam.log:" \
+                -e "s:^\#\(NotifyClamd\).*:\1 /etc/clamav/clamd.conf:" \
+                -e "s:^\#\(ScriptedUpdates\).*:\1 yes:" \
+                -e "s:^\#\(AllowSupplementaryGroups\).*:\1 yes:" \
+                "$pkgdir"/etc/clamav/freshclam.conf
 
-	install -m755 -D "$srcdir"/clamd.initd "$pkgdir"/etc/init.d/clamd
-	install -m644 -D "$srcdir"/clamd.confd "$pkgdir"/etc/conf.d/clamd
+        install -m755 -D "$srcdir"/clamd.initd "$pkgdir"/etc/init.d/clamd
+        install -m644 -D "$srcdir"/clamd.confd "$pkgdir"/etc/conf.d/clamd
         install -m755 -D "$srcdir"/freshclam.initd "$pkgdir"/etc/init.d/freshclam
-	install -m644 -D "$srcdir"/freshclam.confd "$pkgdir"/etc/conf.d/freshclam
-	install -m644 -D "$srcdir"/clamav.logrotate "$pkgdir"/etc/logrotate.d/clamav
-	mkdir -p "$pkgdir"/var/run/clamav "$pkgdir"/var/log/clamav
+        install -m644 -D "$srcdir"/freshclam.confd "$pkgdir"/etc/conf.d/freshclam
+        install -m644 -D "$srcdir"/clamav.logrotate "$pkgdir"/etc/logrotate.d/clamav
+        mkdir -p "$pkgdir"/var/run/clamav "$pkgdir"/var/log/clamav
 }
 
-md5sums="eaf9fccc3cc3567605a9732313652967  clamav-0.95.3.tar.gz
+md5sums="28ac7bec4cc03627a8e2d6e8647ee661  clamav-0.96.tar.gz
 d64432c463850663c5041c3097f3e903  clamd.initd
 567bc32b657dd7031b9b7beaa946203a  clamd.confd
 f4d1f415322905128dc27135566ad136  freshclam.initd
-- 
cgit v1.2.3


From 46a1314e8ae3975088f893c2d5c1f519077d175b Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Wed, 12 May 2010 10:58:36 +0000
Subject: main/net-snmp: upgrade to 5.5

---
 main/net-snmp/APKBUILD            | 38 ++++++++++++++++++++++----------------
 main/net-snmp/CVE-2008-6123.patch | 19 -------------------
 2 files changed, 22 insertions(+), 35 deletions(-)
 delete mode 100644 main/net-snmp/CVE-2008-6123.patch

diff --git a/main/net-snmp/APKBUILD b/main/net-snmp/APKBUILD
index 7ff3a8ac..ad3462f8 100644
--- a/main/net-snmp/APKBUILD
+++ b/main/net-snmp/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=net-snmp
-pkgver=5.4.2.1
-pkgrel=4
+pkgver=5.5
+pkgrel=0
 pkgdesc="Simple Network Management Protocol"
 url="http://www.net-snmp.org/"
 license="GPL"
@@ -14,14 +14,17 @@ source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
 	snmpd.confd
 	snmptrapd.initd
 	snmptrapd.confd
-	CVE-2008-6123.patch
 	"
 
-build() {
-	cd "$srcdir/$pkgname-$pkgver"
-	patch -p0 -i ../CVE-2008-6123.patch || return 1
+_builddir="$srcdir/$pkgname-$pkgver"
 
+build() {
+	cd "$_builddir"
+	
 	export lt_cv_sys_max_cmd_len=8192
+	
+	#build fails on: libnetsnmpmibs.so: undefined reference to `pthread_create'
+	LDFLAGS="$LDFLAGS -lpthread"
 
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/snmp \
@@ -40,16 +43,20 @@ build() {
 		--disable-embedded-perl
 		# embedded-perl seems to create TEXTREL's
 
-	make -j1 || return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"        
 	make -j1 DESTDIR="$pkgdir" install
 
-	install -m755 -D "$srcdir"/snmpd.initd "$pkgdir"/etc/init.d/snmpd
-	install -m644 -D "$srcdir"/snmpd.confd "$pkgdir"/etc/conf.d/snmpd
+        install -m755 -D "$srcdir"/snmpd.initd "$pkgdir"/etc/init.d/snmpd
+        install -m644 -D "$srcdir"/snmpd.confd "$pkgdir"/etc/conf.d/snmpd
         install -m755 -D "$srcdir"/snmptrapd.initd "$pkgdir"/etc/init.d/snmptrapd
-	install -m644 -D "$srcdir"/snmptrapd.confd "$pkgdir"/etc/conf.d/snmptrapd
-	install -m644 -D EXAMPLE.conf "$pkgdir"/etc/snmp/snmpd.conf.example
-	mkdir -p "$pkgdir"/var/lib/net-snmp
-	find "$pkgdir" -name perllocal.pod -delete
+        install -m644 -D "$srcdir"/snmptrapd.confd "$pkgdir"/etc/conf.d/snmptrapd
+        install -m644 -D EXAMPLE.conf "$pkgdir"/etc/snmp/snmpd.conf.example
+        mkdir -p "$pkgdir"/var/lib/net-snmp
+        find "$pkgdir" -name perllocal.pod -delete
 }
 
 tools() {
@@ -58,9 +65,8 @@ tools() {
 }
 
 
-md5sums="984932520143f0c8bf7b7ce1fc9e1da1  net-snmp-5.4.2.1.tar.gz
+md5sums="5b2551e7bd024fbbee84dca22a5f13a1  net-snmp-5.5.tar.gz
 198a4a7b80557fa8112394df5ec9914e  snmpd.initd
 96510a2f3bc9f21648b03f7e8d76c0d3  snmpd.confd
 7ce3e9e880fc6313ae87eb000bae4bda  snmptrapd.initd
-363f7728a76bdfc46e29b7e1f5cf4950  snmptrapd.confd
-e8eac801c76e03bca7e7bf6b267b0d3d  CVE-2008-6123.patch"
+363f7728a76bdfc46e29b7e1f5cf4950  snmptrapd.confd"
diff --git a/main/net-snmp/CVE-2008-6123.patch b/main/net-snmp/CVE-2008-6123.patch
deleted file mode 100644
index b4b06f63..00000000
--- a/main/net-snmp/CVE-2008-6123.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -Naur snmplib.orig/snmpUDPDomain.c snmplib/snmpUDPDomain.c
---- snmplib.orig/snmpUDPDomain.c	2007-10-11 22:46:30.000000000 +0200
-+++ snmplib/snmpUDPDomain.c	2009-07-10 23:41:37.000000000 +0200
-@@ -104,12 +110,12 @@
- 	char tmp[64];
-         to = (struct sockaddr_in *) &(addr_pair->remote_addr);
-         if (to == NULL) {
--            sprintf(tmp, "UDP: [%s]->unknown",
-+            sprintf(tmp, "UDP: unknown->[%s]",
-                     inet_ntoa(addr_pair->local_addr));
-         } else {
--            sprintf(tmp, "UDP: [%s]->", inet_ntoa(addr_pair->local_addr));
--            sprintf(tmp + strlen(tmp), "[%s]:%hd",
-+            sprintf(tmp, "UDP: [%s]:%hu->",
-                     inet_ntoa(to->sin_addr), ntohs(to->sin_port));
-+            sprintf(tmp + strlen(tmp), "[%s]", inet_ntoa(addr_pair->local_addr));
-         }
-         return strdup(tmp);
-     }
-- 
cgit v1.2.3


From 623c7e2679d62e97194391e225facf33e5c325f0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 14:56:18 +0000
Subject: main/libgsf: dev package depends on bzip2

---
 main/libgsf/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/libgsf/APKBUILD b/main/libgsf/APKBUILD
index c8d1e687..3f34d315 100644
--- a/main/libgsf/APKBUILD
+++ b/main/libgsf/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgsf
 pkgver=1.14.18
-pkgrel=0
+pkgrel=1
 pkgdesc="The GNOME Structured File Library is a utility library for reading and writing structured file formats."
 url="http://www.gnome.org/"
 license="GPL LGPL"
@@ -10,7 +10,7 @@ depends=
 makedepends="libxml2-dev glib-dev bzip2-dev intltool python zlib-dev"
 source="http://ftp.gnome.org/pub/GNOME/sources/$pkgname/1.14/$pkgname-$pkgver.tar.bz2"
 
-depends_dev="glib-dev libxml2-dev pkgconfig"
+depends_dev="glib-dev bzip2-dev libxml2-dev pkgconfig"
 
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
-- 
cgit v1.2.3


From 4754388c35ee6ad4db9291d85208706d36b3e27b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 18:06:13 +0000
Subject: main/glib: depend on bzip2

---
 main/glib/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/glib/APKBUILD b/main/glib/APKBUILD
index e975ad92..1e88f6c7 100644
--- a/main/glib/APKBUILD
+++ b/main/glib/APKBUILD
@@ -1,16 +1,16 @@
-# Maintainer: Carlo Landmeter <clandmeter at gmail.com>
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=glib
 pkgver=2.24.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Common C routines used by Gtk+ and other libs"
 url="http://www.gtk.org"
 license='GPL'
 depends=
-makedepends="gettext-dev libiconv-dev zlib-dev pkgconfig"
+makedepends="gettext-dev libiconv-dev zlib-dev bzip2-dev pkgconfig"
 source="http://ftp.gnome.org/pub/gnome/sources/glib/${pkgver%.*}/glib-$pkgver.tar.bz2"
 subpackages="$pkgname-doc $pkgname-dev"
 
-depends_dev="perl gettext-dev libiconv-dev zlib-dev pkgconfig"
+depends_dev="perl gettext-dev libiconv-dev zlib-dev bzip2-dev pkgconfig"
 
 _builddir="$srcdir/$pkgname-$pkgver"
 
-- 
cgit v1.2.3


From 0ae3453479574b13451908881b854a767ddb3e8a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 18:57:23 +0000
Subject: testing/goffice: new aport

A library of document-centric objects and utilities built on top of GLib and Gtk+
http://www.gnome.org
---
 testing/goffice/APKBUILD | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 testing/goffice/APKBUILD

diff --git a/testing/goffice/APKBUILD b/testing/goffice/APKBUILD
new file mode 100644
index 00000000..51c0be8d
--- /dev/null
+++ b/testing/goffice/APKBUILD
@@ -0,0 +1,29 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=goffice
+pkgver=0.8.3
+pkgrel=0
+pkgdesc="A library of document-centric objects and utilities built on top of GLib and Gtk+"
+url="http://www.gnome.org"
+license="GPL"
+makedepends="libgsf-dev intltool cairo-dev gtk+-dev"
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/0.8/$pkgname-$pkgver.tar.bz2"
+
+depends_dev="glib-dev libgsf-dev cairo-dev libxml2-dev"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		 --without-gconf \
+		--disable-static \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="f8c4fd47e1ef9d2512126d1074952201  goffice-0.8.3.tar.bz2"
-- 
cgit v1.2.3


From 98905c98d74fe87b31964df79e020eaba87c3e5f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 19:32:25 +0000
Subject: testing/gnumeric: new aport

A GNOME Spreadsheet Program
http://www.gnome.org/projects/gnumeric/
---
 testing/gnumeric/APKBUILD | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 testing/gnumeric/APKBUILD

diff --git a/testing/gnumeric/APKBUILD b/testing/gnumeric/APKBUILD
new file mode 100644
index 00000000..ef7d620a
--- /dev/null
+++ b/testing/gnumeric/APKBUILD
@@ -0,0 +1,30 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gnumeric
+pkgver=1.10.3
+pkgrel=0
+pkgdesc="A GNOME Spreadsheet Program"
+url="http://www.gnome.org/projects/gnumeric/"
+license="GPL"
+makedepends="gtk+-dev intltool desktop-file-utils libglade-dev goffice-dev
+	rarian"
+install=
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/1.10/$pkgname-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--disable-schemas-install \
+		--disable-static \
+		--enable-ssindex || return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make -j1 DESTDIR="$pkgdir" install || return 1
+}
+md5sums="7da8b0acac1395c6fb049d5be7da37ef  gnumeric-1.10.3.tar.bz2"
-- 
cgit v1.2.3


From 6647b1d632bb5ee6a3f0bfb9af32fa7d0b074f2b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 20:20:16 +0000
Subject: main/goffice: moved from testing

---
 main/goffice/APKBUILD    | 29 +++++++++++++++++++++++++++++
 testing/goffice/APKBUILD | 29 -----------------------------
 2 files changed, 29 insertions(+), 29 deletions(-)
 create mode 100644 main/goffice/APKBUILD
 delete mode 100644 testing/goffice/APKBUILD

diff --git a/main/goffice/APKBUILD b/main/goffice/APKBUILD
new file mode 100644
index 00000000..51c0be8d
--- /dev/null
+++ b/main/goffice/APKBUILD
@@ -0,0 +1,29 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=goffice
+pkgver=0.8.3
+pkgrel=0
+pkgdesc="A library of document-centric objects and utilities built on top of GLib and Gtk+"
+url="http://www.gnome.org"
+license="GPL"
+makedepends="libgsf-dev intltool cairo-dev gtk+-dev"
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/0.8/$pkgname-$pkgver.tar.bz2"
+
+depends_dev="glib-dev libgsf-dev cairo-dev libxml2-dev"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		 --without-gconf \
+		--disable-static \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="f8c4fd47e1ef9d2512126d1074952201  goffice-0.8.3.tar.bz2"
diff --git a/testing/goffice/APKBUILD b/testing/goffice/APKBUILD
deleted file mode 100644
index 51c0be8d..00000000
--- a/testing/goffice/APKBUILD
+++ /dev/null
@@ -1,29 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=goffice
-pkgver=0.8.3
-pkgrel=0
-pkgdesc="A library of document-centric objects and utilities built on top of GLib and Gtk+"
-url="http://www.gnome.org"
-license="GPL"
-makedepends="libgsf-dev intltool cairo-dev gtk+-dev"
-subpackages="$pkgname-dev $pkgname-doc"
-source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/0.8/$pkgname-$pkgver.tar.bz2"
-
-depends_dev="glib-dev libgsf-dev cairo-dev libxml2-dev"
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--localstatedir=/var \
-		 --without-gconf \
-		--disable-static \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install || return 1
-}
-md5sums="f8c4fd47e1ef9d2512126d1074952201  goffice-0.8.3.tar.bz2"
-- 
cgit v1.2.3


From 27bfa3b740264709e5a6429eec1f68346b64b33b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 12 May 2010 20:40:33 +0000
Subject: main/abiword: build plugins

---
 main/abiword/APKBUILD | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/main/abiword/APKBUILD b/main/abiword/APKBUILD
index eb33e1f6..3ecdf6aa 100644
--- a/main/abiword/APKBUILD
+++ b/main/abiword/APKBUILD
@@ -1,18 +1,22 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=abiword
 pkgver=2.8.4
-pkgrel=0
+pkgrel=1
 pkgdesc="A fully-featured word processor"
 url="http://www.abisource.com"
 license="GPL"
 makedepends="pkgconfig libglade-dev libgsf-dev enchant-dev fribidi-dev wv-dev
-	popt-dev jpeg-dev librsvg-dev bzip2-dev"
-subpackages="$pkgname-dev"
+	popt-dev jpeg-dev librsvg-dev bzip2-dev goffice-dev"
+subpackages="$pkgname-dev $pkgname-doc $pkgname-plugin-goffice:goffice
+	$pkgname-plugin-opendocument:opendocument"
 source="http://www.abisource.com/downloads/$pkgname/$pkgver/source/$pkgname-$pkgver.tar.gz"
 
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
+		--enable-shared \
+		--disable-static \
+		--enable-plugins="opendocument goffice" \
 		|| return 1
 	make || return 1
 }
@@ -21,4 +25,21 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
+
+_plugin() {
+	local plugin="$1"
+	pkgdesc="$2"
+	local dir="usr/lib/abiword-${pkgver%.*}/plugins"
+	mkdir -p "$subpkgdir"/$dir
+	mv "$pkgdir"/$dir/$plugin.so "$subpkgdir"/$dir/
+}
+
+goffice() {
+	_plugin goffice "GOffice interaction plugin for AbiWord"
+}
+
+opendocument() {
+	_plugin opendocument "OpenDocument support plugin for AbiWord"
+}
+
 md5sums="f782ecb8e07d07ec179f7a143353cc29  abiword-2.8.4.tar.gz"
-- 
cgit v1.2.3


From 7f6fabd695a88e5704e680f91caae0369b5a487e Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Thu, 13 May 2010 06:50:59 +0000
Subject: testing/swatch: new aport

---
 testing/swatch/APKBUILD     |  58 +++++++++++++++++++++++++
 testing/swatch/swatch.confd |   8 ++++
 testing/swatch/swatch.initd |  50 +++++++++++++++++++++
 testing/swatch/swatchrc     | 103 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 219 insertions(+)
 create mode 100644 testing/swatch/APKBUILD
 create mode 100644 testing/swatch/swatch.confd
 create mode 100755 testing/swatch/swatch.initd
 create mode 100644 testing/swatch/swatchrc

diff --git a/testing/swatch/APKBUILD b/testing/swatch/APKBUILD
new file mode 100644
index 00000000..9d06df63
--- /dev/null
+++ b/testing/swatch/APKBUILD
@@ -0,0 +1,58 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=swatch
+pkgver=3.2.3
+pkgrel=0
+pkgdesc="Logfile monitoring tool"
+url="http://sourceforge.net/projects/swatch/"
+license="GPL"
+depends="perl perl-date-calc perl-date-format perl-date-manip perl-file-tail perl-carp-clan"
+makedepends="perl-dev"
+install=
+subpackages="$pkgname-doc"
+source="http://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.gz
+	swatch.initd
+	swatch.confd
+	swatchrc"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+        make || return 1
+        make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+        make realclean || return 1
+
+	# remove perllocal.pod and .packlist
+	find "$pkgdir" -name perllocal.pod -delete
+	find "$pkgdir" -name .packlist -delete
+
+
+#echo "pkdir= $pkgdir"
+#echo "srcdir= $srcdir"
+
+	mkdir -p "$pkgdir"/etc/init.d/
+	mkdir -p "$pkgdir"/etc/conf.d/
+	mkdir -p "$pkgdir"/etc/$pkgname/
+
+	cp "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	cp "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+	cp "$srcdir"/${pkgname}rc "$pkgdir"/etc/$pkgname/${pkgname}rc
+
+	chmod 755 "$pkgdir"/etc/init.d/$pkgname
+}
+
+md5sums="1162f1024cf07fc750ed4960d61ac4e8  swatch-3.2.3.tar.gz
+cc99f0831b4a069f90fdedee82495523  swatch.initd
+a02a10a0266781a1ce16cc3b5e84968c  swatch.confd
+8a92d37f96982030e0283dc7fe706da8  swatchrc"
diff --git a/testing/swatch/swatch.confd b/testing/swatch/swatch.confd
new file mode 100644
index 00000000..5cbdc0a2
--- /dev/null
+++ b/testing/swatch/swatch.confd
@@ -0,0 +1,8 @@
+## tail-args
+#   Arguments for tail program
+tailargs="-n 0 -F"
+
+## script-dir
+#   This switch causes the temporary watcher script to be written to a file in the specified directory rather than the user's home directory.
+#   It is highly advised that you do NOT use directories that are writable by others such as /tmp.
+scriptdir="/tmp/swatch"
diff --git a/testing/swatch/swatch.initd b/testing/swatch/swatch.initd
new file mode 100755
index 00000000..ec625e40
--- /dev/null
+++ b/testing/swatch/swatch.initd
@@ -0,0 +1,50 @@
+#!/sbin/runscript
+
+# swatch init.d file for alpine linux.
+
+name=swatch
+daemon=/usr/bin/$name
+configfile=/etc/${name}/swatchrc
+tailfile=/var/log/messages
+
+SVC="${SVCNAME#*.}"
+if [ -n "${SVC}" ] && [ "${SVCNAME}" != "${name}" ]; then
+	SVCPID="${name}.${SVC}.pid"
+	configfile="${configfile}.${SVC}"
+	tailfile=$(find /var/log -name "${SVC}" | head -1)
+	[ ! "${tailfile}" ] && tailfile="/var/log/${SVC}"
+else
+	SVCPID="${name}.pid"
+fi
+
+depend() {
+#	need net
+	after syslog
+}
+
+start() {
+	ebegin "Starting ${name}"
+		einfo "Preparing to monitor ${tailfile}"
+		if [ ! -e "${tailfile}" ]; then
+			eerror "${tailfile} does not exist"
+			return 1
+		fi
+		if [ ! -e "${configfile}" ]; then
+			eerror "Configfile ${configfile} is missing"
+			return 1
+		fi
+		mkdir -p "${scriptdir}"
+		start-stop-daemon --start --quiet --background \
+			--make-pidfile --pidfile /var/run/${SVCPID} \
+			--exec ${daemon} -- \
+			--config-file="${configfile}" --script-dir="${scriptdir}" \
+			--tail-file="${tailfile}" --tail-args="${tailargs}"
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ${name}"
+		kill $(ps | grep .swatch_script.$(cat /var/run/${SVCPID}) | grep -v 'grep' | awk '{ print $1}')
+	eend $?
+}
+
diff --git a/testing/swatch/swatchrc b/testing/swatch/swatchrc
new file mode 100644
index 00000000..3ea2615a
--- /dev/null
+++ b/testing/swatch/swatchrc
@@ -0,0 +1,103 @@
+###############################################################################
+### Swatch example config
+#
+# The configuration file is used by the swatch(8) program to determine what
+# types of expression patterns to look for and what type of action(s) should be
+# taken when a pattern is matched.
+# Each line should contain a keyword and a, sometimes optional, value for that
+# keyword. The keyword and value are separated by a space or an equal (=) sign.
+#
+# watchfor regex
+# ignore regex
+#
+# echo [modes]
+#    Echo the matched line. The text mode may be normal, bold, underscore,
+#    blink, inverse, black, red, green, yellow, blue, magenta, cyan, white,
+#    black_h, red_h, green_h, yellow_h, blue_h, magenta_h, cyan_h,
+#    and/or white_h. The _h colors specify a highlighting color. The other
+#    colors are assigned to the letters. Some modes may not work on some
+#    terminals. Normal is the default.
+# bell [N]
+#    Echo the matched line, and send a bell N times (default = 1).
+# exec command
+#    Execute command. The command may contain variables which are substituted
+#    with fields from the matched line. A $N will be replaced by the Nth field
+#    in the line. A $0 or $* will be replaced by the entire line.
+# mail [addresses=address:address:...][,subject=your_text_here]
+#    Send mail to address(es) containing the matched lines as they appear
+#    (default address is the user who is running the program).
+# pipe command[,keep_open]
+#    Pipe matched lines into command. Use the keep_open option to force the
+#    pipe to stay open until a different pipe action is run or until swatch
+#    exits.
+# write [user:user:...]
+#    Use write(1) to send matched lines to user(s).
+# threshold track_by=key, type=<limit|threshold|both, count=number, seconds=number>
+#    Thresholding can be done for the complete watchfor block and/or for
+#    individual actions. Add ``threshold=on'' as an option along with the other
+#    threshold options when thresholding an individual action.
+#        track_by
+#            The value of this should be something that is unique to the
+#            watchfor regular expression. Tip: enclose unique parts of the
+#            regular expression in parentheses, then use the sub matches as
+#            part of the value (e.g. track_by=``$2:$4'').
+#        type
+#            There are three types of thresholding. They are as follows:
+#                limit
+#                    Perform action(s) for the first "count`` matches during
+#                    the time interval specified by ''seconds", then ignore
+#                    events for the rest of the time interval (kind of like
+#                    throttle)
+#                threshold
+#                    Perform action(s) on each match for up to count matches 
+#                    during the time interval specified by seconds
+#                both
+#                    Perform actions(s) once per time interval after "count``
+#                    matches occur, then ignore additional matches during the
+#                    time interval specified by ''seconds"
+# continue
+#    Use this action to cause swatch to continue to try to match other
+#    pattern/action groups after it is done with the current pattern/action
+#    block.
+# quit
+#    Use this action to cause swatch to clean up and quit immediately. 
+###############################################################################
+
+## Successful SSH Login Attempts
+watchfor        /sshd.*(: [aA]ccepted)(.*)( from )(.*)( port .*)$/
+		threshold track_by=$4,type=limit,count=1,seconds=60
+		echo bold green
+		#mail='receiver@foo.bar',SUBJECT=sshd: Accepted connection,MAILER=sendmail -t -S smtp.foo.bar -f sender\@foo.bar
+
+## Invalid SSH Login Attempts
+watchfor	/sshd.*(: [iI]nvalid [uU]ser )(.*)( from )(.*)$/
+		threshold track_by=$4,type=both,count=3,seconds=60
+		echo bold red
+
+## Failed SSH Login Attempts
+watchfor	/sshd.*(: [fF]ailed password for )(.*)( from )(.*)( port )(.*)$/
+		threshold track_by=$4,type=both,count=3,seconds=60
+		echo bold red
+
+## Failed SSH Login Attempts
+watchfor	/([aA]uthentication [fF]ailure for [iI]llegal [uU]ser )(.*)( from )(.*)$/
+        	threshold track_by=$4,type=both,count)3,seconds=60
+		echo bold red
+
+
+## Invalid sudo commands 
+watchfor        /sudo:.*[Cc]ommand not allowed/
+                echo bold red
+
+## File system full
+watchfor	/file system full/
+		echo bold blue
+
+## System crashes and halts
+watchfor	/(panic|halt)/
+		echo bold red
+
+## File system errors
+watchfor	/[Mm]edia [Ee]rror/
+		echo bold yellow
+
-- 
cgit v1.2.3


From b5f98cdf2a359dbb9f7de57c98c4e881e968004d Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:33:14 +0000
Subject: testing/perl-carp-clan: new aport

---
 testing/perl-carp-clan/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-carp-clan/APKBUILD

diff --git a/testing/perl-carp-clan/APKBUILD b/testing/perl-carp-clan/APKBUILD
new file mode 100644
index 00000000..e26e5d93
--- /dev/null
+++ b/testing/perl-carp-clan/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-carp-clan
+_realname=Carp-Clan
+pkgver=6.04
+pkgrel=0
+pkgdesc="Perl - Report errors from perspective of caller of a 'clan' of modules"
+url="http://search.cpan.org/~stbey/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-test-exception"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/S/ST/STBEY/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="b6316bc51bb530d994f2784615939fb2  Carp-Clan-6.04.tar.gz"
-- 
cgit v1.2.3


From 1c2427c34ccba72bfaaa8cc44bb0516fcff550f1 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:38:35 +0000
Subject: testing/perl-date-format: new aport

---
 testing/perl-date-format/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-date-format/APKBUILD

diff --git a/testing/perl-date-format/APKBUILD b/testing/perl-date-format/APKBUILD
new file mode 100644
index 00000000..6615a97f
--- /dev/null
+++ b/testing/perl-date-format/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-date-format
+_realname=TimeDate
+pkgver=1.20
+pkgrel=0
+pkgdesc="Perl - Date formating subroutines"
+url="http://search.cpan.org/~gbarr/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/G/GB/GBARR/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="7da7452bce4c684e4238e6d09b390200  TimeDate-1.20.tar.gz"
-- 
cgit v1.2.3


From 9dd9726a0249f577599ea7e959ac3538a7676ad0 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:39:07 +0000
Subject: testing/perl-date-manip: new aport

---
 testing/perl-date-manip/APKBUILD | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 testing/perl-date-manip/APKBUILD

diff --git a/testing/perl-date-manip/APKBUILD b/testing/perl-date-manip/APKBUILD
new file mode 100644
index 00000000..34a15d9f
--- /dev/null
+++ b/testing/perl-date-manip/APKBUILD
@@ -0,0 +1,34 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-date-manip
+_realname=Date-Manip
+pkgver=6.11
+pkgrel=0
+pkgdesc="Perl - Date manipulation routines"
+url="http://search.cpan.org/~sbeck/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-test-pod perl-test-inter perl-yaml-syck perl-test-pod-coverage"
+makedepends="perl-dev"
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/S/SB/SBECK/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	perl Build.PL || return 1
+	./Build test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	./Build destdir="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="7880db506f14080635972eb5607fa79d  Date-Manip-6.11.tar.gz"
-- 
cgit v1.2.3


From 5c2f329c1509cba7369866180ede25eb468d2c2a Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:39:37 +0000
Subject: testing/perl-devel-symdump: new aport

---
 testing/perl-devel-symdump/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-devel-symdump/APKBUILD

diff --git a/testing/perl-devel-symdump/APKBUILD b/testing/perl-devel-symdump/APKBUILD
new file mode 100644
index 00000000..16038e9a
--- /dev/null
+++ b/testing/perl-devel-symdump/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-devel-symdump
+_realname=Devel-Symdump
+pkgver=2.08
+pkgrel=0
+pkgdesc="Perl - Dump symbol names or the symbol table"
+url="http://search.cpan.org/~andk/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-test-pod"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/A/AN/ANDK/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="68e3a2f2f989bff295ee63aed5a2a1e5  Devel-Symdump-2.08.tar.gz"
-- 
cgit v1.2.3


From 05c32fdf9b4c32245eed8effc1c42299b3a11350 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:40:30 +0000
Subject: testing/perl-file-tail: new aport

---
 testing/perl-file-tail/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-file-tail/APKBUILD

diff --git a/testing/perl-file-tail/APKBUILD b/testing/perl-file-tail/APKBUILD
new file mode 100644
index 00000000..96237374
--- /dev/null
+++ b/testing/perl-file-tail/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-file-tail
+_realname=File-Tail
+pkgver=0.99.3
+pkgrel=0
+pkgdesc="Perl - Extension for reading from continously updated files"
+url="http://search.cpan.org/~mgrabnar/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/M/MG/MGRABNAR/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="ef0fb7bcb4181ba593f4a09940f61d1c  File-Tail-0.99.3.tar.gz"
-- 
cgit v1.2.3


From 45fa2f39e2705ff936d540fbe769d30c07414f71 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:41:09 +0000
Subject: testing/perl-pod-coverage: new aport

---
 testing/perl-pod-coverage/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-pod-coverage/APKBUILD

diff --git a/testing/perl-pod-coverage/APKBUILD b/testing/perl-pod-coverage/APKBUILD
new file mode 100644
index 00000000..cb17f529
--- /dev/null
+++ b/testing/perl-pod-coverage/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-pod-coverage
+_realname=Pod-Coverage
+pkgver=0.20
+pkgrel=0
+pkgdesc="Perl - Checks if the documentation of a module is comprehensive"
+url="http://search.cpan.org/~rclamp/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-devel-symdump perl-test-pod"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/R/RC/RCLAMP/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="292a5b8d3a93597af441d3e6467b8ad6  Pod-Coverage-0.20.tar.gz"
-- 
cgit v1.2.3


From b7ea1d32a513c7f88403483d2f3480bf218ed331 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:42:30 +0000
Subject: testing/perl-sub-uplevel: new aport

---
 testing/perl-sub-uplevel/APKBUILD | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 testing/perl-sub-uplevel/APKBUILD

diff --git a/testing/perl-sub-uplevel/APKBUILD b/testing/perl-sub-uplevel/APKBUILD
new file mode 100644
index 00000000..10e4a49a
--- /dev/null
+++ b/testing/perl-sub-uplevel/APKBUILD
@@ -0,0 +1,35 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-sub-uplevel
+_realname=Sub-Uplevel
+pkgver=0.22
+pkgrel=0
+pkgdesc="Perl - Apparently run a function in a higher stack frame"
+url="http://search.cpan.org/~dagolden/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl "
+makedepends="perl-dev"
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/D/DA/DAGOLDEN/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="c166738a97c0424a0075ebe205d285db  Sub-Uplevel-0.22.tar.gz"
-- 
cgit v1.2.3


From 32b0e5735b4468338c8a955df7fdc1823bdd7a82 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:43:58 +0000
Subject: testing/perl-test-exception: new aport

---
 testing/perl-test-exception/APKBUILD | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 testing/perl-test-exception/APKBUILD

diff --git a/testing/perl-test-exception/APKBUILD b/testing/perl-test-exception/APKBUILD
new file mode 100644
index 00000000..7b276c63
--- /dev/null
+++ b/testing/perl-test-exception/APKBUILD
@@ -0,0 +1,35 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-test-exception
+_realname=Test-Exception
+pkgver=0.29
+pkgrel=0
+pkgdesc="Perl - Test exception based code"
+url="http://search.cpan.org/~adie/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-sub-uplevel"
+makedepends="perl-dev"
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/A/AD/ADIE/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="9aea475db531d4fd4ce40cf25a0acd14  Test-Exception-0.29.tar.gz"
-- 
cgit v1.2.3


From 7b770fb3b8aa275e812ffb948ca5f8304c59061e Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:44:24 +0000
Subject: testing/perl-test-inter: new aport

---
 testing/perl-test-inter/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-test-inter/APKBUILD

diff --git a/testing/perl-test-inter/APKBUILD b/testing/perl-test-inter/APKBUILD
new file mode 100644
index 00000000..29bdf219
--- /dev/null
+++ b/testing/perl-test-inter/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-test-inter
+_realname=Test-Inter
+pkgver=1.01
+pkgrel=0
+pkgdesc="Perl - Framework for more readable interactive test scripts"
+url="http://search.cpan.org/~sbeck/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-test-pod perl-pod-coverage perl-test-pod-coverage"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/S/SB/SBECK/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="445166a7472e609b96e4474d95552827  Test-Inter-1.01.tar.gz"
-- 
cgit v1.2.3


From 45b7b258918e56c528cd56a4cef134f4a79ffd0f Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:45:13 +0000
Subject: testing/perl-test-pod-coverage: new aport

---
 testing/perl-test-pod-coverage/APKBUILD | 36 +++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-test-pod-coverage/APKBUILD

diff --git a/testing/perl-test-pod-coverage/APKBUILD b/testing/perl-test-pod-coverage/APKBUILD
new file mode 100644
index 00000000..9a885e0b
--- /dev/null
+++ b/testing/perl-test-pod-coverage/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-test-pod-coverage
+_realname=Test-Pod-Coverage
+pkgver=1.08
+pkgrel=0
+pkgdesc="Perl - Check for pod coverage in your distribution."
+url="http://search.cpan.org/~petdance/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl perl-pod-coverage perl-test-pod perl-devel-symdump"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/P/PE/PETDANCE/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="33405cca7c75b7b89c06ba30eea66692  Test-Pod-Coverage-1.08.tar.gz"
-- 
cgit v1.2.3


From 4411ab47a361bb2483e368022c0b103b6e09d948 Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Wed, 5 May 2010 07:46:23 +0000
Subject: testing/perl-yaml-syck: new aport

---
 testing/perl-yaml-syck/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/perl-yaml-syck/APKBUILD

diff --git a/testing/perl-yaml-syck/APKBUILD b/testing/perl-yaml-syck/APKBUILD
new file mode 100644
index 00000000..d1c62805
--- /dev/null
+++ b/testing/perl-yaml-syck/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Mika Havela <mika.havela@gmail.com>
+# Maintainer: Mika Havela <mika.havela@gmail.com>
+pkgname=perl-yaml-syck
+_realname=YAML-Syck
+pkgver=1.07
+pkgrel=0
+pkgdesc="Perl - Fast, lightweight YAML loader and dumper"
+url="http://search.cpan.org/~audreyt/$_realname-$pkgver/"
+license="Artistic GPL"
+depends="perl"
+makedepends="perl-dev"
+install=
+#subpackages="$pkgname-doc"
+source="http://search.cpan.org/CPAN/authors/id/A/AU/AUDREYT/$_realname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$_realname-$pkgver"
+
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+	make || return 1
+	make test || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	# creates file collision among perl modules
+	find "$pkgdir" -name perllocal.pod -delete
+}
+
+md5sums="410ef7e24185de2a04390e0543876cad  YAML-Syck-1.07.tar.gz"
-- 
cgit v1.2.3


From 861cf340e330410e66a48e220ecb13734a8c3eae Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 13 May 2010 11:46:24 +0000
Subject: main/rrdtool: provide perl-rrd subpackage

ref #348
---
 main/rrdtool/APKBUILD | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/main/rrdtool/APKBUILD b/main/rrdtool/APKBUILD
index b5794f36..e91e0af4 100644
--- a/main/rrdtool/APKBUILD
+++ b/main/rrdtool/APKBUILD
@@ -1,13 +1,13 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rrdtool
 pkgver=1.2.30
-pkgrel=2
+pkgrel=3
 pkgdesc="Data logging and graphing application"
 url="http://www.rrdtool.org"
 license="GPL"
 depends=
-makedepends="libart-lgpl-dev libpng-dev freetype-dev"
-subpackages="$pkgname-dev $pkgname-doc"
+makedepends="libart-lgpl-dev libpng-dev freetype-dev perl-dev"
+subpackages="$pkgname-dev $pkgname-doc perl-rrd:perl_rrd"
 source="http://oss.oetiker.ch/$pkgname/pub/$pkgname-$pkgver.tar.gz"
 
 _builddir="$srcdir"/$pkgname-$pkgver
@@ -15,8 +15,6 @@ build() {
 	cd "$_builddir"
 	./configure --prefix=/usr \
 		--disable-tcl \
-		--disable-perl \
-		--disable-perl-site-install \
 		--disable-python \
 		--disable-ruby \
 		--disable-rrdcgi
@@ -37,4 +35,10 @@ dev() {
 	mv "$pkgdir"/usr/share/$pkgname/examples "$subpkgdir"/usr/share/$pkgname/
 }
 
+perl_rrd() {
+	pkgdesc="Perl interface for rrdtool"
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/perl "$subpkgdir"/usr/lib/
+}
+
 md5sums="19b24f7184a8dbf7b48c1bbb565ad9fb  rrdtool-1.2.30.tar.gz"
-- 
cgit v1.2.3


From 0ada67ec8947b79b168c1d717e5ccd939eb29f59 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 13 May 2010 11:58:23 +0000
Subject: testing/boost: new aport

Free peer-reviewed portable C++ source libraries
http://www.boost.org/
---
 testing/boost/APKBUILD                             | 147 +++++++++++++++++++++
 .../boost-1.41.0-parameter-needs-python.patch      | 106 +++++++++++++++
 testing/boost/boost-uclibc-thread.patch            |  11 ++
 testing/boost/random-Jamfile                       |  15 +++
 4 files changed, 279 insertions(+)
 create mode 100644 testing/boost/APKBUILD
 create mode 100644 testing/boost/boost-1.41.0-parameter-needs-python.patch
 create mode 100644 testing/boost/boost-uclibc-thread.patch
 create mode 100644 testing/boost/random-Jamfile

diff --git a/testing/boost/APKBUILD b/testing/boost/APKBUILD
new file mode 100644
index 00000000..1c40e470
--- /dev/null
+++ b/testing/boost/APKBUILD
@@ -0,0 +1,147 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=boost
+pkgver=1.43.0
+
+_x=${pkgver%%.*}	# strip .y.z
+_y=${pkgver%.*}		# strip .z
+_y=${_y#*.}		# strip x.
+_z=${pkgver##*.}	# strip x.y.
+_ver=${_x}_${_y}_${_z}
+
+pkgrel=0
+pkgdesc="Free peer-reviewed portable C++ source libraries"
+url="http://www.boost.org/"
+license="custom"
+depends=
+makedepends="python-dev>=2.6 flex bison bzip2-dev zlib-dev"
+subpackages="$pkgname-dev $pkgname-doc
+$pkgname-date_time
+$pkgname-filesystem
+$pkgname-graph
+$pkgname-iostreams
+$pkgname-math
+$pkgname-prg_exec_monitor
+$pkgname-program_options
+$pkgname-python:py
+$pkgname-random
+$pkgname-regex
+$pkgname-serialization
+$pkgname-signals
+$pkgname-system
+$pkgname-thread
+$pkgname-unit_test_framework
+$pkgname-wave
+$pkgname-wserialization
+"
+source="http://downloads.sourceforge.net/$pkgname/${pkgname}_$_ver.tar.gz
+	boost-1.41.0-parameter-needs-python.patch
+	boost-uclibc-thread.patch
+	random-Jamfile"
+
+_builddir="$srcdir"/${pkgname}_${_ver}
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		[ -r "$i" ] || continue
+		msg "Applying $i"
+		patch -p1 -i "$i" || return 1
+	done
+
+	# add support for /dev/urandom
+	mkdir -p libs/random/build
+	cp "$srcdir"/random-Jamfile libs/random/build/Jamfile.2
+	sed -i -e 's/#ifdef __linux__/#if 1/' \
+		libs/random/src/random_device.cpp \
+		|| return 1
+	
+	# create user-config.jam
+	cat > user-config.jam <<__EOF__
+
+using gcc : : $CC : <cxxflags>"${CXXFLAGS}" <linkflags>"${LDFLAGS}" ;
+
+__EOF__
+}
+
+_options="--user-config=\"$_builddir/user-config.jam\"
+	--prefix=\"$pkgdir/usr\"
+	release
+	debug-symbols=off
+	threading=single,multi
+	runtime-link=shared
+	link=shared,static
+	cflags=-fno-strict-aliasing
+	-sPYTHON_ROOT=/usr
+	-sPYTHON_VERSION=2.6
+	-sTOOLS=gcc
+	--layout=tagged
+	-q
+	-j${JOBS:-2}
+"
+
+build() { 
+	msg "Building bjam"
+	export BOOST_ROOT="$_builddir"
+	cd "$_builddir"/tools/jam/src
+	CC= ./build.sh cc || return 1
+	_bindir="bin.linuxx86"
+	[ "${CARCH}" = "x86_64" ] && _bindir="bin.linuxx86_64"
+	install -m755 -d "$pkgdir"/usr/bin
+	install -m755 ${_bindir}/bjam "$pkgdir"/usr/bin/bjam || return 1
+	_bjam="$pkgdir"/usr/bin/bjam
+
+	msg "Building bcp"
+	cd "${_builddir}"/tools/bcp
+	"${_bjam}" -j${JOBS:-2} || return 1
+	install -m755 "$srcdir"/${pkgname}_${_ver}/dist/bin/bcp \
+		"$pkgdir"/usr/bin/bcp || return 1
+
+	msg "Building boost"
+	cd "$_builddir"
+	"${_bjam}" $_options 
+}
+
+package() {
+	cd "$_builddir"
+	export BOOST_ROOT="$_builddir"
+	_bjam="$pkgdir"/usr/bin/bjam
+	"${_bjam}" $_options \
+		--includedir="$pkgdir"/usr/include \
+		--libdir="$pkgdir"/usr/lib \
+		install || return 1
+
+	cd "$srcdir"/${pkgname}_${_ver}/libs/python/pyste/install
+	python setup.py install --root="$pkgdir" || return 1
+	install -m755 -d "$pkgdir"/usr/share/licenses/$pkgname
+	install -m644 "$srcdir"/${pkgname}_${_ver}/LICENSE_1_0.txt \
+		"$pkgdir"/usr/share/licenses/$pkgname/ || return 1
+}
+
+_mvlib() {
+	pkgdesc="Boost $1 library"
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/libboost_$1* "$subpkgdir"/usr/lib/
+}
+
+date_time() { _mvlib date_time; }
+filesystem() { _mvlib filesystem; }
+graph() { _mvlib graph; }
+iostreams() { _mvlib iostreams; }
+math() { _mvlib math; }
+prg_exec_monitor() { _mvlib prg_exec_monitor; }
+program_options() { _mvlib program_options; }
+py() { _mvlib python; }
+random() { _mvlib random; }
+regex() { _mvlib regex; }
+serialization() { _mvlib serialization; }
+signals() { _mvlib signals; }
+system() { _mvlib system; }
+thread() { _mvlib thread; }
+unit_test_framework() { _mvlib unit_test_framework; }
+wave() { _mvlib wave; }
+wserialization() { _mvlib wserialization; }
+
+
+md5sums="734565ca4819bf04bd8e903e116c3fb1  boost_1_43_0.tar.gz
+83dbee9d7291a0f322fd2b8936aeace7  boost-1.41.0-parameter-needs-python.patch
+7ea3caa231764eca4522ae303939214d  boost-uclibc-thread.patch
+1d43f6ee1fc426f1ddcb4aafc6b77b9b  random-Jamfile"
diff --git a/testing/boost/boost-1.41.0-parameter-needs-python.patch b/testing/boost/boost-1.41.0-parameter-needs-python.patch
new file mode 100644
index 00000000..016995fc
--- /dev/null
+++ b/testing/boost/boost-1.41.0-parameter-needs-python.patch
@@ -0,0 +1,106 @@
+--- a/boost/parameter/aux_/maybe.hpp	2008-03-22 21:45:55.000000000 +0000
++++ b/boost/parameter/aux_/maybe.hpp.new	2009-10-22 03:55:24.000000000 +0000
+@@ -2,20 +2,41 @@
+ // subject to the Boost Software License, Version 1.0. (See accompanying
+ // file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+ 
+-#ifndef BOOST_PARAMETER_MAYBE_060211_HPP
+-# define BOOST_PARAMETER_MAYBE_060211_HPP
++//
++// 2009.10.21 TDS remove depenency on boost::python::detail::referent_storage
++//
++#ifndef BOOST_PARAMETER_MAYBE_091021_HPP
++# define BOOST_PARAMETER_MAYBE_091021_HPP
+ 
+ # include <boost/mpl/if.hpp>
+ # include <boost/mpl/identity.hpp>
+ # include <boost/type_traits/is_reference.hpp>
+ # include <boost/type_traits/add_reference.hpp>
+ # include <boost/optional.hpp>
+-# include <boost/python/detail/referent_storage.hpp>
++# include <boost/aligned_storage.hpp>
+ # include <boost/type_traits/remove_cv.hpp>
+ # include <boost/type_traits/add_const.hpp>
+ 
+ namespace boost { namespace parameter { namespace aux {
+ 
++template <class T> struct referent_size;
++
++template <class T>
++struct referent_size<T&>
++{
++  BOOST_STATIC_CONSTANT(std::size_t, value = sizeof(T));
++};
++
++// A metafunction returning a POD type which can store U, where T ==
++// U&. If T is not a reference type, returns a POD which can store T.
++template <class T>
++struct referent_storage
++{
++  typedef typename boost::aligned_storage<
++    referent_size<T>::value
++    >::type type;
++};
++
+ struct maybe_base {};
+ 
+ template <class T>
+@@ -33,8 +54,8 @@
+         BOOST_DEDUCED_TYPENAME remove_reference<reference>::type
+     >::type non_cv_value;
+         
+-    explicit maybe(T value)
+-      : value(value)
++    explicit maybe(T value_)
++      : value(value_)
+       , constructed(false)
+     {}
+ 
+@@ -48,28 +69,28 @@
+             this->destroy();
+     }
+ 
+-    reference construct(reference value) const
++    reference construct(reference value_) const
+     {
+-        return value;
++        return value_;
+     }
+ 
+     template <class U>
+-    reference construct2(U const& value) const
++    reference construct2(U const& value_) const
+     {
+-        new (m_storage.bytes) non_cv_value(value);
++        new (m_storage.address()) non_cv_value(value_);
+         constructed = true;
+-        return *(non_cv_value*)m_storage.bytes;
++        return *(non_cv_value*)m_storage.address();
+     }
+ 
+     template <class U>
+-    reference construct(U const& value) const
++    reference construct(U const& value_) const
+     {
+-        return this->construct2(value);
++        return this->construct2(value_);
+     }
+ 
+     void destroy()
+     {
+-        ((non_cv_value*)m_storage.bytes)->~non_cv_value();
++        ((non_cv_value*)m_storage.address())->~non_cv_value();
+     }
+ 
+     typedef reference(maybe<T>::*safe_bool)() const;
+@@ -87,7 +108,9 @@
+ private:
+     boost::optional<T> value;
+     mutable bool constructed;
+-    mutable typename boost::python::detail::referent_storage<
++
++
++    mutable typename referent_storage<
+         reference
+     >::type m_storage;
+ };
diff --git a/testing/boost/boost-uclibc-thread.patch b/testing/boost/boost-uclibc-thread.patch
new file mode 100644
index 00000000..e9e6b79e
--- /dev/null
+++ b/testing/boost/boost-uclibc-thread.patch
@@ -0,0 +1,11 @@
+--- ./libs/thread/src/pthread/thread.cpp.orig
++++ ./libs/thread/src/pthread/thread.cpp
+@@ -380,7 +380,7 @@
+     {
+ #if defined(PTW32_VERSION) || defined(__hpux)
+         return pthread_num_processors_np();
+-#elif defined(_GNU_SOURCE)
++#elif defined(_GNU_SOURCE) && !defined(__UCLIBC__)
+         return get_nprocs();
+ #elif defined(__APPLE__) || defined(__FreeBSD__)
+         int count;
diff --git a/testing/boost/random-Jamfile b/testing/boost/random-Jamfile
new file mode 100644
index 00000000..5cb6f6bc
--- /dev/null
+++ b/testing/boost/random-Jamfile
@@ -0,0 +1,15 @@
+# Copyright (c) 2006 Tiziano Mueller
+#
+# Use, modification and distribution of the file is subject to the
+# Boost Software License, Version 1.0.
+# (See at http://www.boost.org/LICENSE_1_0.txt)
+
+
+project boost/random
+	: source-location ../ ;
+
+SOURCES = random_device ;
+
+lib boost_random
+	: $(SOURCES).cpp 
+	: <link>shared:<define>BOOST_RANDOM_DYN_LINK=1 ;
-- 
cgit v1.2.3


From 00b6d3eac9db51b03e0c3ce62e1a1d16f8a0d29b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 12:42:13 +0000
Subject: main/zlib: header fixes

fixes cgit and possibly libxml2
---
 main/zlib/APKBUILD                   | 14 +++++++++++---
 main/zlib/gzflush.patch              | 12 ------------
 main/zlib/zlib-1.2.5-lfs-decls.patch | 13 +++++++++++++
 3 files changed, 24 insertions(+), 15 deletions(-)
 delete mode 100644 main/zlib/gzflush.patch
 create mode 100644 main/zlib/zlib-1.2.5-lfs-decls.patch

diff --git a/main/zlib/APKBUILD b/main/zlib/APKBUILD
index 1f4465a9..62d3ec49 100644
--- a/main/zlib/APKBUILD
+++ b/main/zlib/APKBUILD
@@ -1,15 +1,22 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=zlib
 pkgver=1.2.5
-pkgrel=0
+pkgrel=1
 pkgdesc="A compression/decompression Library"
 license=custom:zlib
 url="http://zlib.net"
 depends=
-source="http://zlib.net/$pkgname-$pkgver.tar.gz"
+source="http://zlib.net/$pkgname-$pkgver.tar.gz
+	zlib-1.2.5-lfs-decls.patch
+	"
 subpackages="$pkgname-dev $pkgname-doc"
 
 _builddir="$srcdir/$pkgname-$pkgver"
+prepare() {
+	cd "$_builddir"
+	patch -p1 -i "$srcdir"/zlib-1.2.5-lfs-decls.patch
+}
+
 build() {
 	cd "$_builddir"
 	# we trade size for a little more speed.
@@ -31,4 +38,5 @@ dev() {
 	mv "$pkgdir"/lib/libz.a "$subpkgdir"/lib/libz.a
 }
 
-md5sums="c735eab2d659a96e5a594c9e8541ad63  zlib-1.2.5.tar.gz"
+md5sums="c735eab2d659a96e5a594c9e8541ad63  zlib-1.2.5.tar.gz
+4cb279ea3beab621f3526bf7b7ab99e5  zlib-1.2.5-lfs-decls.patch"
diff --git a/main/zlib/gzflush.patch b/main/zlib/gzflush.patch
deleted file mode 100644
index 5e97e657..00000000
--- a/main/zlib/gzflush.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/gzwrite.c	2010-01-18 21:18:27.000000000 +0100
-+++ b/gzwrite.c	2010-01-28 04:37:20.330530306 +0100
-@@ -435,7 +435,8 @@
-     state = (gz_statep)file;
- 
-     /* check that we're writing and that there's no error */
--    if (state->mode != GZ_WRITE|| state->err != Z_OK)
-+    if (state->mode != GZ_WRITE || state->err != Z_OK)
-+        return Z_STREAM_ERROR;
- 
-     /* check flush parameter */
-     if (flush < 0 || flush > Z_FINISH)
diff --git a/main/zlib/zlib-1.2.5-lfs-decls.patch b/main/zlib/zlib-1.2.5-lfs-decls.patch
new file mode 100644
index 00000000..36e26af0
--- /dev/null
+++ b/main/zlib/zlib-1.2.5-lfs-decls.patch
@@ -0,0 +1,13 @@
+Index: zlib-1.2.5/zlib.h
+===================================================================
+--- zlib-1.2.5.orig/zlib.h
++++ zlib-1.2.5/zlib.h
+@@ -1578,7 +1578,7 @@ ZEXTERN int ZEXPORT inflateBackInit_ OF(
+ #  define gzoffset gzoffset64
+ #  define adler32_combine adler32_combine64
+ #  define crc32_combine crc32_combine64
+-#  ifdef _LARGEFILE64_SOURCE
++#  ifndef _LARGEFILE64_SOURCE
+      ZEXTERN gzFile ZEXPORT gzopen64 OF((const char *, const char *));
+      ZEXTERN z_off_t ZEXPORT gzseek64 OF((gzFile, z_off_t, int));
+      ZEXTERN z_off_t ZEXPORT gztell64 OF((gzFile));
-- 
cgit v1.2.3


From b78fcdb157be6bb304bc75d2be6e084b290e670d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:47:45 +0000
Subject: main/ruby: remove leftovers

---
 main/ruby/test.db | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 main/ruby/test.db

diff --git a/main/ruby/test.db b/main/ruby/test.db
deleted file mode 100644
index e69de29b..00000000
-- 
cgit v1.2.3


From 009f3f560af7ae4dc072d5763077b985ad8a6fbd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:49:05 +0000
Subject: main/openssl: upgrade to 1.0.0

and introduce libssl1.0 and libcrypto1.0 packages
---
 main/openssl/APKBUILD                      |   46 +-
 main/openssl/fix-manpages.patch            | 1329 ++++++++++++++++++++++++++++
 main/openssl/openssl-0.9.8k-quote-cc.patch |   72 --
 3 files changed, 1362 insertions(+), 85 deletions(-)
 create mode 100644 main/openssl/fix-manpages.patch
 delete mode 100644 main/openssl/openssl-0.9.8k-quote-cc.patch

diff --git a/main/openssl/APKBUILD b/main/openssl/APKBUILD
index 0aeeca9d..1bab1385 100644
--- a/main/openssl/APKBUILD
+++ b/main/openssl/APKBUILD
@@ -1,21 +1,21 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openssl
-pkgver=0.9.8n
-pkgrel=1
+pkgver=1.0.0
+pkgrel=0
 pkgdesc="Toolkit for SSL v2/v3 and TLS v1"
-url=http://openssl.org
+url="http://openssl.org"
 depends=
-makedepends="perl"
+makedepends="perl zlib-dev"
 license="openssl"
 
-subpackages="$pkgname-dev $pkgname-doc libcrypto"
+subpackages="$pkgname-dev $pkgname-doc libcrypto1.0:libcrypto libssl1.0:libssl"
 
 source="http://www.openssl.org/source/${pkgname}-${pkgver}.tar.gz
-        http://www.linuxfromscratch.org/patches/downloads/openssl/openssl-0.9.8g-fix_manpages-1.patch
+	fix-manpages.patch
 	openssl-bb-basename.patch
-	openssl-0.9.8k-padlock-sha.patch
 	"
 
+#	openssl-0.9.8k-padlock-sha.patch
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
@@ -27,7 +27,11 @@ prepare() {
 
 build() {
 	cd "$_builddir"
-	./config --prefix=/usr --openssldir=/etc/ssl shared enable-montasm
+	./config --prefix=/usr \
+		--openssldir=/etc/ssl \
+		shared zlib enable-montasm enable-md2 \
+		-Wa,--noexecstack \
+		|| return 1
 
 	make -j1 || return 1
 }
@@ -37,9 +41,16 @@ package() {
 	make -j1 INSTALL_PREFIX="$pkgdir" MANDIR=/usr/share/man install
 }
 
+dev() {
+	replaces="libcrypto openssl"
+	default_dev
+	# move symlinks
+	mv "$pkgdir"/usr/lib/*.so "$subpkgdir"/usr/lib/
+}
+
 libcrypto() {
 	pkgdesc="Crypto library from openssl"
-	replaces="openssl"
+	replaces="openssl libcrypto"
 	mkdir -p "$subpkgdir"/lib "$subpkgdir"/usr/lib
 	for i in "$pkgdir"/usr/lib/libcrypto*; do
 		mv $i "$subpkgdir"/lib/
@@ -48,7 +59,16 @@ libcrypto() {
 	mv "$pkgdir"/usr/lib/engines "$subpkgdir"/usr/lib/
 }
 
-md5sums="076d8efc3ed93646bd01f04e23c07066  openssl-0.9.8n.tar.gz
-04a6a88c2ee4badd4f8649792b73eaf3  openssl-0.9.8g-fix_manpages-1.patch
-c6a9857a5dbd30cead0404aa7dd73977  openssl-bb-basename.patch
-86b7f1bf50e1f3ba407ec62001a51a0d  openssl-0.9.8k-padlock-sha.patch"
+libssl() {
+	pkgdesc="SSL shared libraries"
+	replaces="openssl"
+	mkdir -p "$subpkgdir"/lib "$subpkgdir"/usr/lib
+	for i in "$pkgdir"/usr/lib/libssl*; do
+		mv $i "$subpkgdir"/lib/
+		ln -s ../../lib/${i##*/} "$subpkgdir"/usr/lib/${i##*/}
+	done
+}
+
+md5sums="89eaa86e25b2845f920ec00ae4c864ed  openssl-1.0.0.tar.gz
+115c481cd59b3dba631364e8fb1778f5  fix-manpages.patch
+c6a9857a5dbd30cead0404aa7dd73977  openssl-bb-basename.patch"
diff --git a/main/openssl/fix-manpages.patch b/main/openssl/fix-manpages.patch
new file mode 100644
index 00000000..7c6ac990
--- /dev/null
+++ b/main/openssl/fix-manpages.patch
@@ -0,0 +1,1329 @@
+diff --git a/FAQ b/FAQ
+index 2134e3a..18a8831 100644
+--- a/FAQ
++++ b/FAQ
+@@ -724,7 +724,7 @@ OpenSSL by calling CRYPTO_set_locking_callback() and
+ CRYPTO_set_id_callback(), for all versions of OpenSSL up to and
+ including 0.9.8[abc...]. As of version 0.9.9, CRYPTO_set_id_callback()
+ and associated APIs are deprecated by CRYPTO_THREADID_set_callback()
+-and friends. This is described in the threads(3) manpage.
++and friends. This is described in the openssl_threads(3) manpage.
+ 
+ * I've compiled a program under Windows and it crashes: why?
+ 
+diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c
+index 88088ce..e5da17f 100644
+--- a/crypto/rand/md_rand.c
++++ b/crypto/rand/md_rand.c
+@@ -196,7 +196,7 @@ static void ssleay_rand_add(const void *buf, int num, double add)
+ 	int do_not_lock;
+ 
+ 	/*
+-	 * (Based on the rand(3) manpage)
++	 * (Based on the openssl_rand(3) manpage)
+ 	 *
+ 	 * The input is chopped up into units of 20 bytes (or less for
+ 	 * the last block).  Each of these blocks is run through the hash
+@@ -361,7 +361,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num)
+ 	num_ceil = (1 + (num-1)/(MD_DIGEST_LENGTH/2)) * (MD_DIGEST_LENGTH/2);
+ 
+ 	/*
+-	 * (Based on the rand(3) manpage:)
++	 * (Based on the openssl_rand(3) manpage)
+ 	 *
+ 	 * For each group of 10 bytes (or less), we do the following:
+ 	 *
+diff --git a/doc/apps/openssl.pod b/doc/apps/openssl.pod
+index 738142e..e904f05 100644
+--- a/doc/apps/openssl.pod
++++ b/doc/apps/openssl.pod
+@@ -163,7 +163,7 @@ Create or examine a netscape certificate sequence
+ 
+ Online Certificate Status Protocol utility.
+ 
+-=item L<B<passwd>|passwd(1)>
++=item L<B<passwd>|openssl-passwd(1)>
+ 
+ Generation of hashed passwords.
+ 
+@@ -401,7 +401,7 @@ L<crl(1)|crl(1)>, L<crl2pkcs7(1)|crl2pkcs7(1)>, L<dgst(1)|dgst(1)>,
+ L<dhparam(1)|dhparam(1)>, L<dsa(1)|dsa(1)>, L<dsaparam(1)|dsaparam(1)>,
+ L<enc(1)|enc(1)>, L<gendsa(1)|gendsa(1)>, L<genpkey(1)|genpkey(1)>,
+ L<genrsa(1)|genrsa(1)>, L<nseq(1)|nseq(1)>, L<openssl(1)|openssl(1)>,
+-L<passwd(1)|passwd(1)>,
++L<openssl-passwd(1)|openssl-passwd(1)>,
+ L<pkcs12(1)|pkcs12(1)>, L<pkcs7(1)|pkcs7(1)>, L<pkcs8(1)|pkcs8(1)>,
+ L<rand(1)|rand(1)>, L<req(1)|req(1)>, L<rsa(1)|rsa(1)>,
+ L<rsautl(1)|rsautl(1)>, L<s_client(1)|s_client(1)>,
+diff --git a/doc/apps/passwd.pod b/doc/apps/passwd.pod
+deleted file mode 100644
+index f449825..0000000
+--- a/doc/apps/passwd.pod
++++ /dev/null
+@@ -1,82 +0,0 @@
+-=pod
+-
+-=head1 NAME
+-
+-passwd - compute password hashes
+-
+-=head1 SYNOPSIS
+-
+-B<openssl passwd>
+-[B<-crypt>]
+-[B<-1>]
+-[B<-apr1>]
+-[B<-salt> I<string>]
+-[B<-in> I<file>]
+-[B<-stdin>]
+-[B<-noverify>]
+-[B<-quiet>]
+-[B<-table>]
+-{I<password>}
+-
+-=head1 DESCRIPTION
+-
+-The B<passwd> command computes the hash of a password typed at
+-run-time or the hash of each password in a list.  The password list is
+-taken from the named file for option B<-in file>, from stdin for
+-option B<-stdin>, or from the command line, or from the terminal otherwise.
+-The Unix standard algorithm B<crypt> and the MD5-based BSD password
+-algorithm B<1> and its Apache variant B<apr1> are available.
+-
+-=head1 OPTIONS
+-
+-=over 4
+-
+-=item B<-crypt>
+-
+-Use the B<crypt> algorithm (default).
+-
+-=item B<-1>
+-
+-Use the MD5 based BSD password algorithm B<1>.
+-
+-=item B<-apr1>
+-
+-Use the B<apr1> algorithm (Apache variant of the BSD algorithm).
+-
+-=item B<-salt> I<string>
+-
+-Use the specified salt.
+-When reading a password from the terminal, this implies B<-noverify>.
+-
+-=item B<-in> I<file>
+-
+-Read passwords from I<file>.
+-
+-=item B<-stdin>
+-
+-Read passwords from B<stdin>.
+-
+-=item B<-noverify>
+-
+-Don't verify when reading a password from the terminal.
+-
+-=item B<-quiet>
+-
+-Don't output warnings when passwords given at the command line are truncated.
+-
+-=item B<-table>
+-
+-In the output list, prepend the cleartext password and a TAB character
+-to each password hash.
+-
+-=back
+-
+-=head1 EXAMPLES
+-
+-B<openssl passwd -crypt -salt xx password> prints B<xxj31ZMTZzkVA>.
+-
+-B<openssl passwd -1 -salt xxxxxxxx password> prints B<$1$xxxxxxxx$UYCIxa628.9qXjpQCjM4a.>.
+-
+-B<openssl passwd -apr1 -salt xxxxxxxx password> prints B<$apr1$xxxxxxxx$dxHfLAsjHkDRmG83UXe8K0>.
+-
+-=cut
+diff --git a/doc/crypto/BN_generate_prime.pod b/doc/crypto/BN_generate_prime.pod
+index 7dccacb..71e7078 100644
+--- a/doc/crypto/BN_generate_prime.pod
++++ b/doc/crypto/BN_generate_prime.pod
+@@ -90,7 +90,7 @@ The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+ 
+ =head1 SEE ALSO
+ 
+-L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>
++L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/BN_rand.pod b/doc/crypto/BN_rand.pod
+index 81f93c2..690aa85 100644
+--- a/doc/crypto/BN_rand.pod
++++ b/doc/crypto/BN_rand.pod
+@@ -45,7 +45,7 @@ The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+ 
+ =head1 SEE ALSO
+ 
+-L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<bn(3)|bn(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<RAND_add(3)|RAND_add(3)>, L<RAND_bytes(3)|RAND_bytes(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/CONF_modules_free.pod b/doc/crypto/CONF_modules_free.pod
+index 87bc7b7..347020c 100644
+--- a/doc/crypto/CONF_modules_free.pod
++++ b/doc/crypto/CONF_modules_free.pod
+@@ -37,7 +37,7 @@ None of the functions return a value.
+ =head1 SEE ALSO
+ 
+ L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>,
+-L<CONF_modules_load_file(3), CONF_modules_load_file(3)>
++L<CONF_modules_load_file(3)|CONF_modules_load_file(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/CONF_modules_load_file.pod b/doc/crypto/CONF_modules_load_file.pod
+index 9965d69..6dd9b1d 100644
+--- a/doc/crypto/CONF_modules_load_file.pod
++++ b/doc/crypto/CONF_modules_load_file.pod
+@@ -51,7 +51,7 @@ return value of the failing module (this will always be zero or negative).
+ =head1 SEE ALSO
+ 
+ L<conf(5)|conf(5)>, L<OPENSSL_config(3)|OPENSSL_config(3)>,
+-L<CONF_free(3), CONF_free(3)>, L<err(3),err(3)>
++L<CONF_free(3)|CONF_free(3)>, L<openssl_err(3)|openssl_err(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/DH_generate_key.pod b/doc/crypto/DH_generate_key.pod
+index 81f09fd..0d9f1e5 100644
+--- a/doc/crypto/DH_generate_key.pod
++++ b/doc/crypto/DH_generate_key.pod
+@@ -40,7 +40,7 @@ The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+ 
+ =head1 SEE ALSO
+ 
+-L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<DH_size(3)|DH_size(3)>
++L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<DH_size(3)|DH_size(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/DH_generate_parameters.pod b/doc/crypto/DH_generate_parameters.pod
+index 9081e9e..0c0f78c 100644
+--- a/doc/crypto/DH_generate_parameters.pod
++++ b/doc/crypto/DH_generate_parameters.pod
+@@ -59,7 +59,7 @@ a usable generator.
+ 
+ =head1 SEE ALSO
+ 
+-L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<dh(3)|dh(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<DH_free(3)|DH_free(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/DSA_do_sign.pod b/doc/crypto/DSA_do_sign.pod
+index 5dfc733..0a6d5f1 100644
+--- a/doc/crypto/DSA_do_sign.pod
++++ b/doc/crypto/DSA_do_sign.pod
+@@ -36,7 +36,7 @@ L<ERR_get_error(3)|ERR_get_error(3)>.
+ 
+ =head1 SEE ALSO
+ 
+-L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<DSA_SIG_new(3)|DSA_SIG_new(3)>,
+ L<DSA_sign(3)|DSA_sign(3)>
+ 
+diff --git a/doc/crypto/DSA_generate_key.pod b/doc/crypto/DSA_generate_key.pod
+index af83ccf..95080eb 100644
+--- a/doc/crypto/DSA_generate_key.pod
++++ b/doc/crypto/DSA_generate_key.pod
+@@ -24,7 +24,7 @@ The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
+ 
+ =head1 SEE ALSO
+ 
+-L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/DSA_generate_parameters.pod b/doc/crypto/DSA_generate_parameters.pod
+index be7c924..2b1f78f 100644
+--- a/doc/crypto/DSA_generate_parameters.pod
++++ b/doc/crypto/DSA_generate_parameters.pod
+@@ -90,7 +90,7 @@ Seed lengths E<gt> 20 are not supported.
+ 
+ =head1 SEE ALSO
+ 
+-L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<DSA_free(3)|DSA_free(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/DSA_sign.pod b/doc/crypto/DSA_sign.pod
+index 97389e8..2e6f6f3 100644
+--- a/doc/crypto/DSA_sign.pod
++++ b/doc/crypto/DSA_sign.pod
+@@ -55,7 +55,7 @@ Standard, DSS), ANSI X9.30
+ 
+ =head1 SEE ALSO
+ 
+-L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>,
++L<dsa(3)|dsa(3)>, L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<DSA_do_sign(3)|DSA_do_sign(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/ERR_GET_LIB.pod b/doc/crypto/ERR_GET_LIB.pod
+index 2a129da..a881bdb 100644
+--- a/doc/crypto/ERR_GET_LIB.pod
++++ b/doc/crypto/ERR_GET_LIB.pod
+@@ -41,7 +41,7 @@ The library number, function code and reason code respectively.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
++L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/ERR_clear_error.pod b/doc/crypto/ERR_clear_error.pod
+index 566e1f4..0f503e7 100644
+--- a/doc/crypto/ERR_clear_error.pod
++++ b/doc/crypto/ERR_clear_error.pod
+@@ -20,7 +20,7 @@ ERR_clear_error() has no return value.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
++L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/ERR_error_string.pod b/doc/crypto/ERR_error_string.pod
+index cdfa7fe..d774ec1 100644
+--- a/doc/crypto/ERR_error_string.pod
++++ b/doc/crypto/ERR_error_string.pod
+@@ -60,7 +60,7 @@ none is registered for the error code.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
++L<openssl_err(3)|openssl_err(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
+ L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+ L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+ L<ERR_print_errors(3)|ERR_print_errors(3)>
+diff --git a/doc/crypto/ERR_get_error.pod b/doc/crypto/ERR_get_error.pod
+index 3444304..cd3d7ce 100644
+--- a/doc/crypto/ERR_get_error.pod
++++ b/doc/crypto/ERR_get_error.pod
+@@ -61,7 +61,7 @@ The error code, or 0 if there is no error in the queue.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
++L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+ L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/ERR_load_crypto_strings.pod b/doc/crypto/ERR_load_crypto_strings.pod
+index 9bdec75..9c1b991 100644
+--- a/doc/crypto/ERR_load_crypto_strings.pod
++++ b/doc/crypto/ERR_load_crypto_strings.pod
+@@ -35,7 +35,7 @@ ERR_free_strings() return no values.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>
++L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/ERR_load_strings.pod b/doc/crypto/ERR_load_strings.pod
+index 5acdd0e..261c87d 100644
+--- a/doc/crypto/ERR_load_strings.pod
++++ b/doc/crypto/ERR_load_strings.pod
+@@ -43,7 +43,7 @@ ERR_get_next_error_library() returns a new library number.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
++L<openssl_err(3)|openssl_err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/ERR_print_errors.pod b/doc/crypto/ERR_print_errors.pod
+index b100a5f..a8b34b7 100644
+--- a/doc/crypto/ERR_print_errors.pod
++++ b/doc/crypto/ERR_print_errors.pod
+@@ -38,7 +38,7 @@ ERR_print_errors() and ERR_print_errors_fp() return no values.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
++L<openssl_err(3)|openssl_err(3)>, L<ERR_error_string(3)|ERR_error_string(3)>,
+ L<ERR_get_error(3)|ERR_get_error(3)>,
+ L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+ L<SSL_load_error_strings(3)|SSL_load_error_strings(3)>
+diff --git a/doc/crypto/ERR_put_error.pod b/doc/crypto/ERR_put_error.pod
+index acd241f..9c0263a 100644
+--- a/doc/crypto/ERR_put_error.pod
++++ b/doc/crypto/ERR_put_error.pod
+@@ -34,7 +34,7 @@ no values.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
++L<openssl_err(3)|openssl_err(3)>, L<ERR_load_strings(3)|ERR_load_strings(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/ERR_remove_state.pod b/doc/crypto/ERR_remove_state.pod
+index 72925fb..8dd63da 100644
+--- a/doc/crypto/ERR_remove_state.pod
++++ b/doc/crypto/ERR_remove_state.pod
+@@ -25,7 +25,7 @@ ERR_remove_state() returns no value.
+ 
+ =head1 SEE ALSO
+ 
+-L<err(3)|err(3)>
++L<openssl_err(3)|openssl_err(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/EVP_BytesToKey.pod b/doc/crypto/EVP_BytesToKey.pod
+index d375c46..6d6cf39 100644
+--- a/doc/crypto/EVP_BytesToKey.pod
++++ b/doc/crypto/EVP_BytesToKey.pod
+@@ -59,7 +59,7 @@ EVP_BytesToKey() returns the size of the derived key in bytes.
+ 
+ =head1 SEE ALSO
+ 
+-L<evp(3)|evp(3)>, L<rand(3)|rand(3)>,
++L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/EVP_OpenInit.pod b/doc/crypto/EVP_OpenInit.pod
+index 2e710da..31172e4 100644
+--- a/doc/crypto/EVP_OpenInit.pod
++++ b/doc/crypto/EVP_OpenInit.pod
+@@ -54,7 +54,7 @@ EVP_OpenFinal() returns 0 if the decrypt failed or 1 for success.
+ 
+ =head1 SEE ALSO
+ 
+-L<evp(3)|evp(3)>, L<rand(3)|rand(3)>,
++L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>,
+ L<EVP_SealInit(3)|EVP_SealInit(3)>
+ 
+diff --git a/doc/crypto/EVP_SealInit.pod b/doc/crypto/EVP_SealInit.pod
+index 7d793e1..a37101f 100644
+--- a/doc/crypto/EVP_SealInit.pod
++++ b/doc/crypto/EVP_SealInit.pod
+@@ -74,7 +74,7 @@ with B<type> set to NULL.
+ 
+ =head1 SEE ALSO
+ 
+-L<evp(3)|evp(3)>, L<rand(3)|rand(3)>,
++L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<EVP_EncryptInit(3)|EVP_EncryptInit(3)>,
+ L<EVP_OpenInit(3)|EVP_OpenInit(3)>
+ 
+diff --git a/doc/crypto/EVP_SignInit.pod b/doc/crypto/EVP_SignInit.pod
+index 620a623..090f6e1 100644
+--- a/doc/crypto/EVP_SignInit.pod
++++ b/doc/crypto/EVP_SignInit.pod
+@@ -89,7 +89,7 @@ The previous two bugs are fixed in the newer EVP_SignDigest*() function.
+ =head1 SEE ALSO
+ 
+ L<EVP_VerifyInit(3)|EVP_VerifyInit(3)>,
+-L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<err(3)|err(3)>,
++L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<openssl_err(3)|openssl_err(3)>,
+ L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>,
+ L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>,
+ L<sha(3)|sha(3)>, L<dgst(1)|dgst(1)>
+diff --git a/doc/crypto/EVP_VerifyInit.pod b/doc/crypto/EVP_VerifyInit.pod
+index 9097f09..2a8d225 100644
+--- a/doc/crypto/EVP_VerifyInit.pod
++++ b/doc/crypto/EVP_VerifyInit.pod
+@@ -80,7 +80,7 @@ The previous two bugs are fixed in the newer EVP_VerifyDigest*() function.
+ 
+ L<evp(3)|evp(3)>,
+ L<EVP_SignInit(3)|EVP_SignInit(3)>,
+-L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<err(3)|err(3)>,
++L<EVP_DigestInit(3)|EVP_DigestInit(3)>, L<openssl_err(3)|openssl_err(3)>,
+ L<evp(3)|evp(3)>, L<hmac(3)|hmac(3)>, L<md2(3)|md2(3)>,
+ L<md5(3)|md5(3)>, L<mdc2(3)|mdc2(3)>, L<ripemd(3)|ripemd(3)>,
+ L<sha(3)|sha(3)>, L<dgst(1)|dgst(1)>
+diff --git a/doc/crypto/OPENSSL_config.pod b/doc/crypto/OPENSSL_config.pod
+index e7bba2a..888de88 100644
+--- a/doc/crypto/OPENSSL_config.pod
++++ b/doc/crypto/OPENSSL_config.pod
+@@ -73,7 +73,7 @@ Neither OPENSSL_config() nor OPENSSL_no_config() return a value.
+ =head1 SEE ALSO
+ 
+ L<conf(5)|conf(5)>, L<CONF_load_modules_file(3)|CONF_load_modules_file(3)>,
+-L<CONF_modules_free(3),CONF_modules_free(3)>
++L<CONF_modules_free(3)|CONF_modules_free(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/RAND_add.pod b/doc/crypto/RAND_add.pod
+index 67c66f3..a6fc28a 100644
+--- a/doc/crypto/RAND_add.pod
++++ b/doc/crypto/RAND_add.pod
+@@ -65,7 +65,7 @@ The other functions do not return values.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>, L<RAND_egd(3)|RAND_egd(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<RAND_egd(3)|RAND_egd(3)>,
+ L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/RAND_bytes.pod b/doc/crypto/RAND_bytes.pod
+index 1a9b91e..20c4110 100644
+--- a/doc/crypto/RAND_bytes.pod
++++ b/doc/crypto/RAND_bytes.pod
+@@ -38,7 +38,7 @@ method.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<ERR_get_error(3)|ERR_get_error(3)>,
+ L<RAND_add(3)|RAND_add(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/RAND_cleanup.pod b/doc/crypto/RAND_cleanup.pod
+index 3a8f074..c99537d 100644
+--- a/doc/crypto/RAND_cleanup.pod
++++ b/doc/crypto/RAND_cleanup.pod
+@@ -20,7 +20,7 @@ RAND_cleanup() returns no value.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>
++L<openssl_rand(3)|openssl_rand(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/RAND_egd.pod b/doc/crypto/RAND_egd.pod
+index 8b8c61d..c367290 100644
+--- a/doc/crypto/RAND_egd.pod
++++ b/doc/crypto/RAND_egd.pod
+@@ -72,7 +72,7 @@ success, and -1 if the connection failed. The PRNG state is not considered.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<RAND_add(3)|RAND_add(3)>,
+ L<RAND_cleanup(3)|RAND_cleanup(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/RAND_load_file.pod b/doc/crypto/RAND_load_file.pod
+index d8c134e..a079013 100644
+--- a/doc/crypto/RAND_load_file.pod
++++ b/doc/crypto/RAND_load_file.pod
+@@ -43,7 +43,7 @@ error.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
++L<openssl_rand(3)|openssl_rand(3)>, L<RAND_add(3)|RAND_add(3)>, L<RAND_cleanup(3)|RAND_cleanup(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/RAND_set_rand_method.pod b/doc/crypto/RAND_set_rand_method.pod
+index e5b780f..7f3ad1b 100644
+--- a/doc/crypto/RAND_set_rand_method.pod
++++ b/doc/crypto/RAND_set_rand_method.pod
+@@ -67,7 +67,7 @@ algorithms.
+ 
+ =head1 SEE ALSO
+ 
+-L<rand(3)|rand(3)>, L<engine(3)|engine(3)>
++L<openssl_rand(3)|openssl_rand(3)>, L<engine(3)|engine(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/RSA_blinding_on.pod b/doc/crypto/RSA_blinding_on.pod
+index fd2c69a..7b98614 100644
+--- a/doc/crypto/RSA_blinding_on.pod
++++ b/doc/crypto/RSA_blinding_on.pod
+@@ -34,7 +34,7 @@ RSA_blinding_off() returns no value.
+ 
+ =head1 SEE ALSO
+ 
+-L<rsa(3)|rsa(3)>, L<rand(3)|rand(3)>
++L<rsa(3)|rsa(3)>, L<openssl_rand(3)|openssl_rand(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/RSA_generate_key.pod b/doc/crypto/RSA_generate_key.pod
+index 52dbb14..3db3487 100644
+--- a/doc/crypto/RSA_generate_key.pod
++++ b/doc/crypto/RSA_generate_key.pod
+@@ -59,7 +59,7 @@ RSA_generate_key() goes into an infinite loop for illegal input values.
+ 
+ =head1 SEE ALSO
+ 
+-L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>,
++L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>,
+ L<RSA_free(3)|RSA_free(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/RSA_public_encrypt.pod b/doc/crypto/RSA_public_encrypt.pod
+index ab0fe3b..3b00daf 100644
+--- a/doc/crypto/RSA_public_encrypt.pod
++++ b/doc/crypto/RSA_public_encrypt.pod
+@@ -73,7 +73,7 @@ SSL, PKCS #1 v2.0
+ 
+ =head1 SEE ALSO
+ 
+-L<ERR_get_error(3)|ERR_get_error(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>,
++L<ERR_get_error(3)|ERR_get_error(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>,
+ L<RSA_size(3)|RSA_size(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod b/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod
+index e70380b..121f3df 100644
+--- a/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod
++++ b/doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod
+@@ -48,7 +48,7 @@ These functions serve no recognizable purpose.
+ =head1 SEE ALSO
+ 
+ L<ERR_get_error(3)|ERR_get_error(3)>, L<objects(3)|objects(3)>,
+-L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, L<RSA_sign(3)|RSA_sign(3)>,
+ L<RSA_verify(3)|RSA_verify(3)>
+ 
+ =head1 HISTORY
+diff --git a/doc/crypto/X509_NAME_ENTRY_get_object.pod b/doc/crypto/X509_NAME_ENTRY_get_object.pod
+index 41902c0..4716e7e 100644
+--- a/doc/crypto/X509_NAME_ENTRY_get_object.pod
++++ b/doc/crypto/X509_NAME_ENTRY_get_object.pod
+@@ -65,7 +65,7 @@ set first so the relevant field information can be looked up internally.
+ =head1 SEE ALSO
+ 
+ L<ERR_get_error(3)|ERR_get_error(3)>, L<d2i_X509_NAME(3)|d2i_X509_NAME(3)>,
+-L<OBJ_nid2obj(3),OBJ_nid2obj(3)>
++L<OBJ_nid2obj(3)|OBJ_nid2obj(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/bn.pod b/doc/crypto/bn.pod
+index cd2f8e5..a6f8c58 100644
+--- a/doc/crypto/bn.pod
++++ b/doc/crypto/bn.pod
+@@ -167,7 +167,7 @@ of B<BIGNUM>s to external formats is described in L<BN_bn2bin(3)|BN_bn2bin(3)>.
+ =head1 SEE ALSO
+ 
+ L<bn_internal(3)|bn_internal(3)>,
+-L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>,
++L<dh(3)|dh(3)>, L<openssl_err(3)|openssl_err(3)>, L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>,
+ L<BN_new(3)|BN_new(3)>, L<BN_CTX_new(3)|BN_CTX_new(3)>,
+ L<BN_copy(3)|BN_copy(3)>, L<BN_swap(3)|BN_swap(3)>, L<BN_num_bytes(3)|BN_num_bytes(3)>,
+ L<BN_add(3)|BN_add(3)>, L<BN_add_word(3)|BN_add_word(3)>,
+diff --git a/doc/crypto/crypto.pod b/doc/crypto/crypto.pod
+index 7a52799..ca71202 100644
+--- a/doc/crypto/crypto.pod
++++ b/doc/crypto/crypto.pod
+@@ -46,7 +46,7 @@ L<sha(3)|sha(3)>
+ 
+ =item AUXILIARY FUNCTIONS
+ 
+-L<err(3)|err(3)>, L<threads(3)|threads(3)>, L<rand(3)|rand(3)>,
++L<openssl_err(3)|openssl_err(3)>, L<openssl_threads(3)|openssl_threads(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<OPENSSL_VERSION_NUMBER(3)|OPENSSL_VERSION_NUMBER(3)>
+ 
+ =item INPUT/OUTPUT, DATA ENCODING
+diff --git a/doc/crypto/des.pod b/doc/crypto/des.pod
+index 6f0cf1c..3fd2c47 100644
+--- a/doc/crypto/des.pod
++++ b/doc/crypto/des.pod
+@@ -115,7 +115,7 @@ each byte is the parity bit.  The key schedule is an expanded form of
+ the key; it is used to speed the encryption process.
+ 
+ DES_random_key() generates a random key.  The PRNG must be seeded
+-prior to using this function (see L<rand(3)|rand(3)>).  If the PRNG
++prior to using this function (see L<openssl_rand(3)|openssl_rand(3)>).  If the PRNG
+ could not generate a secure key, 0 is returned.
+ 
+ Before a DES key can be used, it must be converted into the
+@@ -317,7 +317,7 @@ the MIT Kerberos library.
+ 
+ =head1 SEE ALSO
+ 
+-crypt(3), L<des_modes(7)|des_modes(7)>, L<evp(3)|evp(3)>, L<rand(3)|rand(3)>
++crypt(3), L<des_modes(7)|des_modes(7)>, L<evp(3)|evp(3)>, L<openssl_rand(3)|openssl_rand(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/crypto/dh.pod b/doc/crypto/dh.pod
+index c3ccd06..28707bf 100644
+--- a/doc/crypto/dh.pod
++++ b/doc/crypto/dh.pod
+@@ -67,8 +67,8 @@ modify keys.
+ 
+ =head1 SEE ALSO
+ 
+-L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
+-L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>,
++L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<openssl_err(3)|openssl_err(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>,
+ L<DH_set_method(3)|DH_set_method(3)>, L<DH_new(3)|DH_new(3)>,
+ L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>,
+ L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
+diff --git a/doc/crypto/dsa.pod b/doc/crypto/dsa.pod
+index da07d2b..3187a73 100644
+--- a/doc/crypto/dsa.pod
++++ b/doc/crypto/dsa.pod
+@@ -100,7 +100,7 @@ Standard, DSS), ANSI X9.30
+ 
+ =head1 SEE ALSO
+ 
+-L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
++L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<openssl_err(3)|openssl_err(3)>, L<openssl_rand(3)|openssl_rand(3)>,
+ L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<engine(3)|engine(3)>,
+ L<DSA_new(3)|DSA_new(3)>,
+ L<DSA_size(3)|DSA_size(3)>,
+diff --git a/doc/crypto/engine.pod b/doc/crypto/engine.pod
+index f5ab1c3..63f7ebc 100644
+--- a/doc/crypto/engine.pod
++++ b/doc/crypto/engine.pod
+@@ -594,6 +594,6 @@ implementations.
+ 
+ =head1 SEE ALSO
+ 
+-L<rsa(3)|rsa(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<rand(3)|rand(3)>
++L<rsa(3)|rsa(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<openssl_rand(3)|openssl_rand(3)>
+ 
+ =cut
+diff --git a/doc/crypto/err.pod b/doc/crypto/err.pod
+deleted file mode 100644
+index 6f72955..0000000
+--- a/doc/crypto/err.pod
++++ /dev/null
+@@ -1,187 +0,0 @@
+-=pod
+-
+-=head1 NAME
+-
+-err - error codes
+-
+-=head1 SYNOPSIS
+-
+- #include <openssl/err.h>
+-
+- unsigned long ERR_get_error(void);
+- unsigned long ERR_peek_error(void);
+- unsigned long ERR_get_error_line(const char **file, int *line);
+- unsigned long ERR_peek_error_line(const char **file, int *line);
+- unsigned long ERR_get_error_line_data(const char **file, int *line,
+-         const char **data, int *flags);
+- unsigned long ERR_peek_error_line_data(const char **file, int *line,
+-         const char **data, int *flags);
+-
+- int ERR_GET_LIB(unsigned long e);
+- int ERR_GET_FUNC(unsigned long e);
+- int ERR_GET_REASON(unsigned long e);
+-
+- void ERR_clear_error(void);
+-
+- char *ERR_error_string(unsigned long e, char *buf);
+- const char *ERR_lib_error_string(unsigned long e);
+- const char *ERR_func_error_string(unsigned long e);
+- const char *ERR_reason_error_string(unsigned long e);
+-
+- void ERR_print_errors(BIO *bp);
+- void ERR_print_errors_fp(FILE *fp);
+-
+- void ERR_load_crypto_strings(void);
+- void ERR_free_strings(void);
+-
+- void ERR_remove_state(unsigned long pid);
+-
+- void ERR_put_error(int lib, int func, int reason, const char *file,
+-         int line);
+- void ERR_add_error_data(int num, ...);
+-
+- void ERR_load_strings(int lib,ERR_STRING_DATA str[]);
+- unsigned long ERR_PACK(int lib, int func, int reason);
+- int ERR_get_next_error_library(void);
+-
+-=head1 DESCRIPTION
+-
+-When a call to the OpenSSL library fails, this is usually signalled
+-by the return value, and an error code is stored in an error queue
+-associated with the current thread. The B<err> library provides
+-functions to obtain these error codes and textual error messages.
+-
+-The L<ERR_get_error(3)|ERR_get_error(3)> manpage describes how to
+-access error codes.
+-
+-Error codes contain information about where the error occurred, and
+-what went wrong. L<ERR_GET_LIB(3)|ERR_GET_LIB(3)> describes how to
+-extract this information. A method to obtain human-readable error
+-messages is described in L<ERR_error_string(3)|ERR_error_string(3)>.
+-
+-L<ERR_clear_error(3)|ERR_clear_error(3)> can be used to clear the
+-error queue.
+-
+-Note that L<ERR_remove_state(3)|ERR_remove_state(3)> should be used to
+-avoid memory leaks when threads are terminated.
+-
+-=head1 ADDING NEW ERROR CODES TO OPENSSL
+-
+-See L<ERR_put_error(3)> if you want to record error codes in the
+-OpenSSL error system from within your application.
+-
+-The remainder of this section is of interest only if you want to add
+-new error codes to OpenSSL or add error codes from external libraries.
+-
+-=head2 Reporting errors
+-
+-Each sub-library has a specific macro XXXerr() that is used to report
+-errors. Its first argument is a function code B<XXX_F_...>, the second
+-argument is a reason code B<XXX_R_...>. Function codes are derived
+-from the function names; reason codes consist of textual error
+-descriptions. For example, the function ssl23_read() reports a
+-"handshake failure" as follows:
+-
+- SSLerr(SSL_F_SSL23_READ, SSL_R_SSL_HANDSHAKE_FAILURE);
+-
+-Function and reason codes should consist of upper case characters,
+-numbers and underscores only. The error file generation script translates
+-function codes into function names by looking in the header files
+-for an appropriate function name, if none is found it just uses
+-the capitalized form such as "SSL23_READ" in the above example.
+-
+-The trailing section of a reason code (after the "_R_") is translated
+-into lower case and underscores changed to spaces.
+-
+-When you are using new function or reason codes, run B<make errors>.
+-The necessary B<#define>s will then automatically be added to the
+-sub-library's header file.
+-
+-Although a library will normally report errors using its own specific
+-XXXerr macro, another library's macro can be used. This is normally
+-only done when a library wants to include ASN1 code which must use
+-the ASN1err() macro.
+-
+-=head2 Adding new libraries
+-
+-When adding a new sub-library to OpenSSL, assign it a library number
+-B<ERR_LIB_XXX>, define a macro XXXerr() (both in B<err.h>), add its
+-name to B<ERR_str_libraries[]> (in B<crypto/err/err.c>), and add
+-C<ERR_load_XXX_strings()> to the ERR_load_crypto_strings() function
+-(in B<crypto/err/err_all.c>). Finally, add an entry
+-
+- L	XXX	xxx.h	xxx_err.c
+-
+-to B<crypto/err/openssl.ec>, and add B<xxx_err.c> to the Makefile.
+-Running B<make errors> will then generate a file B<xxx_err.c>, and
+-add all error codes used in the library to B<xxx.h>.
+-
+-Additionally the library include file must have a certain form.
+-Typically it will initially look like this:
+-
+- #ifndef HEADER_XXX_H
+- #define HEADER_XXX_H
+-
+- #ifdef __cplusplus
+- extern "C" {
+- #endif
+-
+- /* Include files */
+-
+- #include <openssl/bio.h>
+- #include <openssl/x509.h>
+-
+- /* Macros, structures and function prototypes */
+-
+-
+- /* BEGIN ERROR CODES */
+-
+-The B<BEGIN ERROR CODES> sequence is used by the error code
+-generation script as the point to place new error codes, any text
+-after this point will be overwritten when B<make errors> is run.
+-The closing #endif etc will be automatically added by the script.
+-
+-The generated C error code file B<xxx_err.c> will load the header
+-files B<stdio.h>, B<openssl/err.h> and B<openssl/xxx.h> so the
+-header file must load any additional header files containing any
+-definitions it uses.
+-
+-=head1 USING ERROR CODES IN EXTERNAL LIBRARIES
+-
+-It is also possible to use OpenSSL's error code scheme in external
+-libraries. The library needs to load its own codes and call the OpenSSL
+-error code insertion script B<mkerr.pl> explicitly to add codes to
+-the header file and generate the C error code file. This will normally
+-be done if the external library needs to generate new ASN1 structures
+-but it can also be used to add more general purpose error code handling.
+-
+-TBA more details
+-
+-=head1 INTERNALS
+-
+-The error queues are stored in a hash table with one B<ERR_STATE>
+-entry for each pid. ERR_get_state() returns the current thread's
+-B<ERR_STATE>. An B<ERR_STATE> can hold up to B<ERR_NUM_ERRORS> error
+-codes. When more error codes are added, the old ones are overwritten,
+-on the assumption that the most recent errors are most important.
+-
+-Error strings are also stored in hash table. The hash tables can
+-be obtained by calling ERR_get_err_state_table(void) and
+-ERR_get_string_table(void) respectively.
+-
+-=head1 SEE ALSO
+-
+-L<CRYPTO_set_id_callback(3)|CRYPTO_set_id_callback(3)>,
+-L<CRYPTO_set_locking_callback(3)|CRYPTO_set_locking_callback(3)>,
+-L<ERR_get_error(3)|ERR_get_error(3)>,
+-L<ERR_GET_LIB(3)|ERR_GET_LIB(3)>,
+-L<ERR_clear_error(3)|ERR_clear_error(3)>,
+-L<ERR_error_string(3)|ERR_error_string(3)>,
+-L<ERR_print_errors(3)|ERR_print_errors(3)>,
+-L<ERR_load_crypto_strings(3)|ERR_load_crypto_strings(3)>,
+-L<ERR_remove_state(3)|ERR_remove_state(3)>,
+-L<ERR_put_error(3)|ERR_put_error(3)>,
+-L<ERR_load_strings(3)|ERR_load_strings(3)>,
+-L<SSL_get_error(3)|SSL_get_error(3)>
+-
+-=cut
+diff --git a/doc/crypto/rand.pod b/doc/crypto/rand.pod
+deleted file mode 100644
+index 1c068c8..0000000
+--- a/doc/crypto/rand.pod
++++ /dev/null
+@@ -1,175 +0,0 @@
+-=pod
+-
+-=head1 NAME
+-
+-rand - pseudo-random number generator
+-
+-=head1 SYNOPSIS
+-
+- #include <openssl/rand.h>
+-
+- int  RAND_set_rand_engine(ENGINE *engine);
+-
+- int  RAND_bytes(unsigned char *buf, int num);
+- int  RAND_pseudo_bytes(unsigned char *buf, int num);
+-
+- void RAND_seed(const void *buf, int num);
+- void RAND_add(const void *buf, int num, int entropy);
+- int  RAND_status(void);
+-
+- int  RAND_load_file(const char *file, long max_bytes);
+- int  RAND_write_file(const char *file);
+- const char *RAND_file_name(char *file, size_t num);
+-
+- int  RAND_egd(const char *path);
+-
+- void RAND_set_rand_method(const RAND_METHOD *meth);
+- const RAND_METHOD *RAND_get_rand_method(void);
+- RAND_METHOD *RAND_SSLeay(void);
+-
+- void RAND_cleanup(void);
+-
+- /* For Win32 only */
+- void RAND_screen(void);
+- int RAND_event(UINT, WPARAM, LPARAM);
+-
+-=head1 DESCRIPTION
+-
+-Since the introduction of the ENGINE API, the recommended way of controlling
+-default implementations is by using the ENGINE API functions. The default
+-B<RAND_METHOD>, as set by RAND_set_rand_method() and returned by
+-RAND_get_rand_method(), is only used if no ENGINE has been set as the default
+-"rand" implementation. Hence, these two functions are no longer the recommened
+-way to control defaults.
+-
+-If an alternative B<RAND_METHOD> implementation is being used (either set
+-directly or as provided by an ENGINE module), then it is entirely responsible
+-for the generation and management of a cryptographically secure PRNG stream. The
+-mechanisms described below relate solely to the software PRNG implementation
+-built in to OpenSSL and used by default.
+-
+-These functions implement a cryptographically secure pseudo-random
+-number generator (PRNG). It is used by other library functions for
+-example to generate random keys, and applications can use it when they
+-need randomness.
+-
+-A cryptographic PRNG must be seeded with unpredictable data such as
+-mouse movements or keys pressed at random by the user. This is
+-described in L<RAND_add(3)|RAND_add(3)>. Its state can be saved in a seed file
+-(see L<RAND_load_file(3)|RAND_load_file(3)>) to avoid having to go through the
+-seeding process whenever the application is started.
+-
+-L<RAND_bytes(3)|RAND_bytes(3)> describes how to obtain random data from the
+-PRNG. 
+-
+-=head1 INTERNALS
+-
+-The RAND_SSLeay() method implements a PRNG based on a cryptographic
+-hash function.
+-
+-The following description of its design is based on the SSLeay
+-documentation:
+-
+-First up I will state the things I believe I need for a good RNG.
+-
+-=over 4
+-
+-=item 1
+-
+-A good hashing algorithm to mix things up and to convert the RNG 'state'
+-to random numbers.
+-
+-=item 2
+-
+-An initial source of random 'state'.
+-
+-=item 3
+-
+-The state should be very large.  If the RNG is being used to generate
+-4096 bit RSA keys, 2 2048 bit random strings are required (at a minimum).
+-If your RNG state only has 128 bits, you are obviously limiting the
+-search space to 128 bits, not 2048.  I'm probably getting a little
+-carried away on this last point but it does indicate that it may not be
+-a bad idea to keep quite a lot of RNG state.  It should be easier to
+-break a cipher than guess the RNG seed data.
+-
+-=item 4
+-
+-Any RNG seed data should influence all subsequent random numbers
+-generated.  This implies that any random seed data entered will have
+-an influence on all subsequent random numbers generated.
+-
+-=item 5
+-
+-When using data to seed the RNG state, the data used should not be
+-extractable from the RNG state.  I believe this should be a
+-requirement because one possible source of 'secret' semi random
+-data would be a private key or a password.  This data must
+-not be disclosed by either subsequent random numbers or a
+-'core' dump left by a program crash.
+-
+-=item 6
+-
+-Given the same initial 'state', 2 systems should deviate in their RNG state
+-(and hence the random numbers generated) over time if at all possible.
+-
+-=item 7
+-
+-Given the random number output stream, it should not be possible to determine
+-the RNG state or the next random number.
+-
+-=back
+-
+-The algorithm is as follows.
+-
+-There is global state made up of a 1023 byte buffer (the 'state'), a
+-working hash value ('md'), and a counter ('count').
+-
+-Whenever seed data is added, it is inserted into the 'state' as
+-follows.
+-
+-The input is chopped up into units of 20 bytes (or less for
+-the last block).  Each of these blocks is run through the hash
+-function as follows:  The data passed to the hash function
+-is the current 'md', the same number of bytes from the 'state'
+-(the location determined by in incremented looping index) as
+-the current 'block', the new key data 'block', and 'count'
+-(which is incremented after each use).
+-The result of this is kept in 'md' and also xored into the
+-'state' at the same locations that were used as input into the
+-hash function. I
+-believe this system addresses points 1 (hash function; currently
+-SHA-1), 3 (the 'state'), 4 (via the 'md'), 5 (by the use of a hash
+-function and xor).
+-
+-When bytes are extracted from the RNG, the following process is used.
+-For each group of 10 bytes (or less), we do the following:
+-
+-Input into the hash function the local 'md' (which is initialized from
+-the global 'md' before any bytes are generated), the bytes that are to
+-be overwritten by the random bytes, and bytes from the 'state'
+-(incrementing looping index). From this digest output (which is kept
+-in 'md'), the top (up to) 10 bytes are returned to the caller and the
+-bottom 10 bytes are xored into the 'state'.
+-
+-Finally, after we have finished 'num' random bytes for the caller,
+-'count' (which is incremented) and the local and global 'md' are fed
+-into the hash function and the results are kept in the global 'md'.
+-
+-I believe the above addressed points 1 (use of SHA-1), 6 (by hashing
+-into the 'state' the 'old' data from the caller that is about to be
+-overwritten) and 7 (by not using the 10 bytes given to the caller to
+-update the 'state', but they are used to update 'md').
+-
+-So of the points raised, only 2 is not addressed (but see
+-L<RAND_add(3)|RAND_add(3)>).
+-
+-=head1 SEE ALSO
+-
+-L<BN_rand(3)|BN_rand(3)>, L<RAND_add(3)|RAND_add(3)>,
+-L<RAND_load_file(3)|RAND_load_file(3)>, L<RAND_egd(3)|RAND_egd(3)>,
+-L<RAND_bytes(3)|RAND_bytes(3)>,
+-L<RAND_set_rand_method(3)|RAND_set_rand_method(3)>,
+-L<RAND_cleanup(3)|RAND_cleanup(3)> 
+-
+-=cut
+diff --git a/doc/crypto/rsa.pod b/doc/crypto/rsa.pod
+index 45ac53f..5fa0dcc 100644
+--- a/doc/crypto/rsa.pod
++++ b/doc/crypto/rsa.pod
+@@ -108,7 +108,7 @@ RSA was covered by a US patent which expired in September 2000.
+ =head1 SEE ALSO
+ 
+ L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>,
+-L<rand(3)|rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>,
++L<openssl_rand(3)|openssl_rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>,
+ L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
+ L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>,
+ L<RSA_generate_key(3)|RSA_generate_key(3)>,
+diff --git a/doc/crypto/threads.pod b/doc/crypto/threads.pod
+deleted file mode 100644
+index dc0e939..0000000
+--- a/doc/crypto/threads.pod
++++ /dev/null
+@@ -1,210 +0,0 @@
+-=pod
+-
+-=head1 NAME
+-
+-CRYPTO_THREADID_set_callback, CRYPTO_THREADID_get_callback,
+-CRYPTO_THREADID_current, CRYPTO_THREADID_cmp, CRYPTO_THREADID_cpy,
+-CRYPTO_THREADID_hash, CRYPTO_set_locking_callback, CRYPTO_num_locks,
+-CRYPTO_set_dynlock_create_callback, CRYPTO_set_dynlock_lock_callback,
+-CRYPTO_set_dynlock_destroy_callback, CRYPTO_get_new_dynlockid,
+-CRYPTO_destroy_dynlockid, CRYPTO_lock - OpenSSL thread support
+-
+-=head1 SYNOPSIS
+-
+- #include <openssl/crypto.h>
+-
+- /* Don't use this structure directly. */
+- typedef struct crypto_threadid_st
+-         {
+-         void *ptr;
+-         unsigned long val;
+-         } CRYPTO_THREADID;
+- /* Only use CRYPTO_THREADID_set_[numeric|pointer]() within callbacks */
+- void CRYPTO_THREADID_set_numeric(CRYPTO_THREADID *id, unsigned long val);
+- void CRYPTO_THREADID_set_pointer(CRYPTO_THREADID *id, void *ptr);
+- int CRYPTO_THREADID_set_callback(void (*threadid_func)(CRYPTO_THREADID *));
+- void (*CRYPTO_THREADID_get_callback(void))(CRYPTO_THREADID *);
+- void CRYPTO_THREADID_current(CRYPTO_THREADID *id);
+- int CRYPTO_THREADID_cmp(const CRYPTO_THREADID *a,
+-                         const CRYPTO_THREADID *b);
+- void CRYPTO_THREADID_cpy(CRYPTO_THREADID *dest,
+-                          const CRYPTO_THREADID *src);
+- unsigned long CRYPTO_THREADID_hash(const CRYPTO_THREADID *id);
+-
+- int CRYPTO_num_locks(void);
+-
+- /* struct CRYPTO_dynlock_value needs to be defined by the user */
+- struct CRYPTO_dynlock_value;
+-
+- void CRYPTO_set_dynlock_create_callback(struct CRYPTO_dynlock_value *
+-	(*dyn_create_function)(char *file, int line));
+- void CRYPTO_set_dynlock_lock_callback(void (*dyn_lock_function)
+-	(int mode, struct CRYPTO_dynlock_value *l,
+-	const char *file, int line));
+- void CRYPTO_set_dynlock_destroy_callback(void (*dyn_destroy_function)
+-	(struct CRYPTO_dynlock_value *l, const char *file, int line));
+-
+- int CRYPTO_get_new_dynlockid(void);
+-
+- void CRYPTO_destroy_dynlockid(int i);
+-
+- void CRYPTO_lock(int mode, int n, const char *file, int line);
+-
+- #define CRYPTO_w_lock(type)	\
+-	CRYPTO_lock(CRYPTO_LOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
+- #define CRYPTO_w_unlock(type)	\
+-	CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_WRITE,type,__FILE__,__LINE__)
+- #define CRYPTO_r_lock(type)	\
+-	CRYPTO_lock(CRYPTO_LOCK|CRYPTO_READ,type,__FILE__,__LINE__)
+- #define CRYPTO_r_unlock(type)	\
+-	CRYPTO_lock(CRYPTO_UNLOCK|CRYPTO_READ,type,__FILE__,__LINE__)
+- #define CRYPTO_add(addr,amount,type)	\
+-	CRYPTO_add_lock(addr,amount,type,__FILE__,__LINE__)
+-
+-=head1 DESCRIPTION
+-
+-OpenSSL can safely be used in multi-threaded applications provided
+-that at least two callback functions are set, locking_function and
+-threadid_func.
+-
+-locking_function(int mode, int n, const char *file, int line) is
+-needed to perform locking on shared data structures. 
+-(Note that OpenSSL uses a number of global data structures that
+-will be implicitly shared whenever multiple threads use OpenSSL.)
+-Multi-threaded applications will crash at random if it is not set.
+-
+-locking_function() must be able to handle up to CRYPTO_num_locks()
+-different mutex locks. It sets the B<n>-th lock if B<mode> &
+-B<CRYPTO_LOCK>, and releases it otherwise.
+-
+-B<file> and B<line> are the file number of the function setting the
+-lock. They can be useful for debugging.
+-
+-threadid_func(CRYPTO_THREADID *id) is needed to record the currently-executing
+-thread's identifier into B<id>. The implementation of this callback should not
+-fill in B<id> directly, but should use CRYPTO_THREADID_set_numeric() if thread
+-IDs are numeric, or CRYPTO_THREADID_set_pointer() if they are pointer-based.
+-If the application does not register such a callback using
+-CRYPTO_THREADID_set_callback(), then a default implementation is used - on
+-Windows and BeOS this uses the system's default thread identifying APIs, and on
+-all other platforms it uses the address of B<errno>. The latter is satisfactory
+-for thread-safety if and only if the platform has a thread-local error number
+-facility.
+-
+-Once threadid_func() is registered, or if the built-in default implementation is
+-to be used;
+-
+-=over 4
+-
+-=item *
+-CRYPTO_THREADID_current() records the currently-executing thread ID into the
+-given B<id> object.
+-
+-=item *
+-CRYPTO_THREADID_cmp() compares two thread IDs (returning zero for equality, ie.
+-the same semantics as memcmp()).
+-
+-=item *
+-CRYPTO_THREADID_cpy() duplicates a thread ID value,
+-
+-=item *
+-CRYPTO_THREADID_hash() returns a numeric value usable as a hash-table key. This
+-is usually the exact numeric or pointer-based thread ID used internally, however
+-this also handles the unusual case where pointers are larger than 'long'
+-variables and the platform's thread IDs are pointer-based - in this case, mixing
+-is done to attempt to produce a unique numeric value even though it is not as
+-wide as the platform's true thread IDs.
+-
+-=back
+-
+-Additionally, OpenSSL supports dynamic locks, and sometimes, some parts
+-of OpenSSL need it for better performance.  To enable this, the following
+-is required:
+-
+-=over 4
+-
+-=item *
+-Three additional callback function, dyn_create_function, dyn_lock_function
+-and dyn_destroy_function.
+-
+-=item *
+-A structure defined with the data that each lock needs to handle.
+-
+-=back
+-
+-struct CRYPTO_dynlock_value has to be defined to contain whatever structure
+-is needed to handle locks.
+-
+-dyn_create_function(const char *file, int line) is needed to create a
+-lock.  Multi-threaded applications might crash at random if it is not set.
+-
+-dyn_lock_function(int mode, CRYPTO_dynlock *l, const char *file, int line)
+-is needed to perform locking off dynamic lock numbered n. Multi-threaded
+-applications might crash at random if it is not set.
+-
+-dyn_destroy_function(CRYPTO_dynlock *l, const char *file, int line) is
+-needed to destroy the lock l. Multi-threaded applications might crash at
+-random if it is not set.
+-
+-CRYPTO_get_new_dynlockid() is used to create locks.  It will call
+-dyn_create_function for the actual creation.
+-
+-CRYPTO_destroy_dynlockid() is used to destroy locks.  It will call
+-dyn_destroy_function for the actual destruction.
+-
+-CRYPTO_lock() is used to lock and unlock the locks.  mode is a bitfield
+-describing what should be done with the lock.  n is the number of the
+-lock as returned from CRYPTO_get_new_dynlockid().  mode can be combined
+-from the following values.  These values are pairwise exclusive, with
+-undefined behaviour if misused (for example, CRYPTO_READ and CRYPTO_WRITE
+-should not be used together):
+-
+-	CRYPTO_LOCK	0x01
+-	CRYPTO_UNLOCK	0x02
+-	CRYPTO_READ	0x04
+-	CRYPTO_WRITE	0x08
+-
+-=head1 RETURN VALUES
+-
+-CRYPTO_num_locks() returns the required number of locks.
+-
+-CRYPTO_get_new_dynlockid() returns the index to the newly created lock.
+-
+-The other functions return no values.
+-
+-=head1 NOTES
+-
+-You can find out if OpenSSL was configured with thread support:
+-
+- #define OPENSSL_THREAD_DEFINES
+- #include <openssl/opensslconf.h>
+- #if defined(OPENSSL_THREADS)
+-   // thread support enabled
+- #else
+-   // no thread support
+- #endif
+-
+-Also, dynamic locks are currently not used internally by OpenSSL, but
+-may do so in the future.
+-
+-=head1 EXAMPLES
+-
+-B<crypto/threads/mttest.c> shows examples of the callback functions on
+-Solaris, Irix and Win32.
+-
+-=head1 HISTORY
+-
+-CRYPTO_set_locking_callback() is
+-available in all versions of SSLeay and OpenSSL.
+-CRYPTO_num_locks() was added in OpenSSL 0.9.4.
+-All functions dealing with dynamic locks were added in OpenSSL 0.9.5b-dev.
+-B<CRYPTO_THREADID> and associated functions were introduced in OpenSSL 1.0.0
+-to replace (actually, deprecate) the previous CRYPTO_set_id_callback(),
+-CRYPTO_get_id_callback(), and CRYPTO_thread_id() functions which assumed
+-thread IDs to always be represented by 'unsigned long'.
+-
+-=head1 SEE ALSO
+-
+-L<crypto(3)|crypto(3)>
+-
+-=cut
+diff --git a/doc/ssl/SSL_get_error.pod b/doc/ssl/SSL_get_error.pod
+index 48c6b15..5432293 100644
+--- a/doc/ssl/SSL_get_error.pod
++++ b/doc/ssl/SSL_get_error.pod
+@@ -105,7 +105,7 @@ OpenSSL error queue contains more information on the error.
+ 
+ =head1 SEE ALSO
+ 
+-L<ssl(3)|ssl(3)>, L<err(3)|err(3)>
++L<ssl(3)|ssl(3)>, L<openssl_err(3)|openssl_err(3)>
+ 
+ =head1 HISTORY
+ 
+diff --git a/doc/ssl/SSL_want.pod b/doc/ssl/SSL_want.pod
+index c0059c0..2e51a75 100644
+--- a/doc/ssl/SSL_want.pod
++++ b/doc/ssl/SSL_want.pod
+@@ -72,6 +72,6 @@ return 1, when the corresponding condition is true or 0 otherwise.
+ 
+ =head1 SEE ALSO
+ 
+-L<ssl(3)|ssl(3)>, L<err(3)|err(3)>, L<SSL_get_error(3)|SSL_get_error(3)>
++L<ssl(3)|ssl(3)>, L<openssl_err(3)|openssl_err(3)>, L<SSL_get_error(3)|SSL_get_error(3)>
+ 
+ =cut
diff --git a/main/openssl/openssl-0.9.8k-quote-cc.patch b/main/openssl/openssl-0.9.8k-quote-cc.patch
deleted file mode 100644
index 5a616628..00000000
--- a/main/openssl/openssl-0.9.8k-quote-cc.patch
+++ /dev/null
@@ -1,72 +0,0 @@
---- openssl-0.9.8k/Makefile.orig	2009-04-07 12:28:31.000000000 +0000
-+++ openssl-0.9.8k/Makefile	2009-04-07 12:30:13.000000000 +0000
-@@ -359,7 +359,7 @@
- 			$(AR) libcrypto.a fips/fipscanister.o ; \
- 		else \
- 			if [ "$(FIPSCANLIB)" = "libcrypto" ]; then \
--				FIPSLD_CC=$(CC); CC=fips/fipsld; \
-+				FIPSLD_CC="$(CC)"; CC=fips/fipsld; \
- 				export CC FIPSLD_CC; \
- 			fi; \
- 			$(MAKE) -e SHLIBDIRS='crypto' build-shared; \
-@@ -382,9 +382,9 @@
- fips/fipscanister.o:	build_fips
- libfips$(SHLIB_EXT):		fips/fipscanister.o
- 	@if [ "$(SHLIB_TARGET)" != "" ]; then \
--		FIPSLD_CC=$(CC); CC=fips/fipsld; export CC FIPSLD_CC; \
-+		FIPSLD_CC="$(CC)"; CC=fips/fipsld; export CC FIPSLD_CC; \
- 		$(MAKE) -f Makefile.shared -e $(BUILDENV) \
--			CC=$${CC} LIBNAME=fips THIS=$@ \
-+			CC="$${CC}" LIBNAME=fips THIS=$@ \
- 			LIBEXTRAS=fips/fipscanister.o \
- 			LIBDEPS="$(EX_LIBS)" \
- 			LIBVERSION=${SHLIB_MAJOR}.${SHLIB_MINOR} \
---- openssl-0.9.8k/apps/Makefile.orig	2009-04-07 12:35:30.000000000 +0000
-+++ openssl-0.9.8k/apps/Makefile	2009-04-07 12:56:53.000000000 +0000
-@@ -153,12 +153,12 @@
- 	shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \
- 		shlib_target="$(SHLIB_TARGET)"; \
- 	elif [ -n "$(FIPSCANLIB)" ]; then \
--	  FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
-+	  FIPSLD_CC="$(CC)"; CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
- 	fi; \
- 	LIBRARIES="$(LIBSSL) $(LIBKRB5) $(LIBCRYPTO)" ; \
- 	[ "x$(FIPSCANLIB)" = "xlibfips" ] && LIBRARIES="$$LIBRARIES -lfips"; \
- 	$(MAKE) -f $(TOP)/Makefile.shared -e \
--		CC=$${CC} APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
-+		CC="$${CC}" APPNAME=$(EXE) OBJECTS="$(PROGRAM).o $(E_OBJ)" \
- 		LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \
- 		link_app.$${shlib_target}
- 	-(cd ..; \
---- openssl-0.9.8k/test/Makefile.orig	2009-04-07 13:26:06.000000000 +0000
-+++ openssl-0.9.8k/test/Makefile	2009-04-07 13:26:38.000000000 +0000
-@@ -402,13 +402,13 @@
- 	if [ "$(FIPSCANLIB)" = "libfips" ]; then \
- 		LIBRARIES="-L$(TOP) -lfips"; \
- 	elif [ -n "$(FIPSCANLIB)" ]; then \
--		FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
-+		FIPSLD_CC="$(CC)"; CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
- 		LIBRARIES="$${FIPSLIBDIR:-$(TOP)/fips/}fipscanister.o"; \
- 	else \
- 		LIBRARIES="$(LIBCRYPTO)"; \
- 	fi; \
- 	$(MAKE) -f $(TOP)/Makefile.shared -e \
--		CC=$${CC} APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
-+		CC="$${CC}" APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
- 		LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \
- 		link_app.$${shlib_target}
- 
-@@ -417,11 +417,11 @@
- 	fi; \
- 	LIBRARIES="$(LIBSSL) $(LIBCRYPTO) $(LIBKRB5)"; \
- 	if [ -z "$(SHARED_LIBS)" -a -n "$(FIPSCANLIB)" ] ; then \
--		FIPSLD_CC=$(CC); CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
-+		FIPSLD_CC="$(CC)"; CC=$(TOP)/fips/fipsld; export CC FIPSLD_CC; \
- 	fi; \
- 	[ "$(FIPSCANLIB)" = "libfips" ] && LIBRARIES="$$LIBRARIES -lfips"; \
- 	$(MAKE) -f $(TOP)/Makefile.shared -e \
--		CC=$${CC} APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
-+		CC="$${CC}" APPNAME=$$target$(EXE_EXT) OBJECTS="$$target.o" \
- 		LIBDEPS="$(PEX_LIBS) $$LIBRARIES $(EX_LIBS)" \
- 		link_app.$${shlib_target}
- 
-- 
cgit v1.2.3


From 501f043aea075871ba83bcad4b720e18249428f3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:52:43 +0000
Subject: main/ruby: rebuild aginst openssl-1.0

---
 main/ruby/APKBUILD                 |  23 +++--
 main/ruby/ruby-openssl-1.0.0.patch | 167 +++++++++++++++++++++++++++++++++++++
 2 files changed, 185 insertions(+), 5 deletions(-)
 create mode 100644 main/ruby/ruby-openssl-1.0.0.patch

diff --git a/main/ruby/APKBUILD b/main/ruby/APKBUILD
index a24a4cbc..87063abd 100644
--- a/main/ruby/APKBUILD
+++ b/main/ruby/APKBUILD
@@ -3,19 +3,27 @@
 pkgname=ruby
 pkgver=1.8.7_p174
 _pkgver=1.8.7-p174
-pkgrel=4
+pkgrel=6
 pkgdesc="An object-oriented language for quick and easy programming"
 url="http://www.ruby-lang.org/en/"
 license="Ruby"
 depends=
 makedepends="zlib-dev openssl-dev libiconv-dev gdbm-dev db-dev readline-dev"
 subpackages="$pkgname-doc $pkgname-dev"
-source="ftp://ftp.ruby-lang.org/pub/ruby/1.8/${pkgname}-${_pkgver}.tar.bz2"
+source="ftp://ftp.ruby-lang.org/pub/ruby/1.8/${pkgname}-${_pkgver}.tar.bz2
+	ruby-openssl-1.0.0.patch"
 #
 # maybe its a good idea to split dep libs to seperate pkg's.
 #
+
+_builddir="$srcdir/$pkgname-${_pkgver}"
+prepare() {
+	cd "$_builddir"
+	patch -p0 -i "$srcdir"/ruby-openssl-1.0.0.patch
+}
+
 build() {
-	cd "$srcdir/$pkgname-${_pkgver}"
+	cd "$_builddir"
 
 	# -fomit-frame-pointer makes ruby segfault, see gentoo bug #150413
 	# In many places aliasing rules are broken; play it safe
@@ -24,7 +32,7 @@ build() {
 
 	# turn off distcc/ccache
 	# http://bugs.alpinelinux.org/issues/show/1
-	export CC=cc
+	export CC=gcc
 
 	./configure --build=${CHOST:-i486-alpine-linux-uclibc} \
 		--prefix=/usr \
@@ -36,10 +44,15 @@ build() {
 		--with-extra-site-search-path='/usr/lib/site_ruby/$(ruby_ver)/i686-linux' \
 		--enable-shared
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install
 
 	install -Dm644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}"/COPYING || return 1
 
 }
 
-md5sums="88c45aaf627b4404e5e4273cb03ba2ee  ruby-1.8.7-p174.tar.bz2"
+md5sums="88c45aaf627b4404e5e4273cb03ba2ee  ruby-1.8.7-p174.tar.bz2
+3361f559a6b338b792ff4946a41708dd  ruby-openssl-1.0.0.patch"
diff --git a/main/ruby/ruby-openssl-1.0.0.patch b/main/ruby/ruby-openssl-1.0.0.patch
new file mode 100644
index 00000000..1ebded91
--- /dev/null
+++ b/main/ruby/ruby-openssl-1.0.0.patch
@@ -0,0 +1,167 @@
+diff -up ext/openssl/ossl.c.ossl10 ext/openssl/ossl.c
+--- ext/openssl/ossl.c.ossl10	2007-02-13 00:01:19.000000000 +0100
++++ ext/openssl/ossl.c	2009-08-26 12:29:41.000000000 +0200
+@@ -92,7 +92,7 @@ ossl_x509_ary2sk(VALUE ary)
+ 
+ #define OSSL_IMPL_SK2ARY(name, type)	        \
+ VALUE						\
+-ossl_##name##_sk2ary(STACK *sk)			\
++ossl_##name##_sk2ary(STACK_OF(type) *sk)	\
+ {						\
+     type *t;					\
+     int i, num;					\
+@@ -102,7 +102,7 @@ ossl_##name##_sk2ary(STACK *sk)			\
+ 	OSSL_Debug("empty sk!");		\
+ 	return Qnil;				\
+     }						\
+-    num = sk_num(sk);				\
++    num = sk_##type##_num(sk);			\
+     if (num < 0) {				\
+ 	OSSL_Debug("items in sk < -1???");	\
+ 	return rb_ary_new();			\
+@@ -110,7 +110,7 @@ ossl_##name##_sk2ary(STACK *sk)			\
+     ary = rb_ary_new2(num);			\
+ 						\
+     for (i=0; i<num; i++) {			\
+-	t = (type *)sk_value(sk, i);		\
++	t = sk_##type##_value(sk, i);		\
+ 	rb_ary_push(ary, ossl_##name##_new(t));	\
+     }						\
+     return ary;					\
+diff -up ext/openssl/ossl_pkcs7.c.ossl10 ext/openssl/ossl_pkcs7.c
+--- ext/openssl/ossl_pkcs7.c.ossl10	2007-02-13 00:01:19.000000000 +0100
++++ ext/openssl/ossl_pkcs7.c	2009-08-26 12:53:05.000000000 +0200
+@@ -543,12 +543,11 @@ ossl_pkcs7_add_certificate(VALUE self, V
+     return self;
+ }
+ 
+-static STACK *
+-pkcs7_get_certs_or_crls(VALUE self, int want_certs)
++static STACK_OF(X509) *
++pkcs7_get_certs(VALUE self)
+ {
+     PKCS7 *pkcs7;
+     STACK_OF(X509) *certs;
+-    STACK_OF(X509_CRL) *crls;
+     int i;
+ 
+     GetPKCS7(self, pkcs7);
+@@ -556,17 +555,38 @@ pkcs7_get_certs_or_crls(VALUE self, int 
+     switch(i){
+     case NID_pkcs7_signed:
+         certs = pkcs7->d.sign->cert;
+-        crls = pkcs7->d.sign->crl;
+         break;
+     case NID_pkcs7_signedAndEnveloped:
+         certs = pkcs7->d.signed_and_enveloped->cert;
++        break;
++    default:
++        certs = NULL;
++    }
++
++    return certs;
++}
++
++static STACK_OF(X509_CRL) *
++pkcs7_get_crls(VALUE self)
++{
++    PKCS7 *pkcs7;
++    STACK_OF(X509_CRL) *crls;
++    int i;
++
++    GetPKCS7(self, pkcs7);
++    i = OBJ_obj2nid(pkcs7->type);
++    switch(i){
++    case NID_pkcs7_signed:
++        crls = pkcs7->d.sign->crl;
++        break;
++    case NID_pkcs7_signedAndEnveloped:
+         crls = pkcs7->d.signed_and_enveloped->crl;
+         break;
+     default:
+-        certs = crls = NULL;
++        crls = NULL;
+     }
+ 
+-    return want_certs ? certs : crls;
++    return crls;
+ }
+ 
+ static VALUE
+@@ -581,7 +601,7 @@ ossl_pkcs7_set_certificates(VALUE self, 
+     STACK_OF(X509) *certs;
+     X509 *cert;
+ 
+-    certs = pkcs7_get_certs_or_crls(self, 1);
++    certs = pkcs7_get_certs(self);
+     while((cert = sk_X509_pop(certs))) X509_free(cert);
+     rb_iterate(rb_each, ary, ossl_pkcs7_set_certs_i, self);
+ 
+@@ -591,7 +611,7 @@ ossl_pkcs7_set_certificates(VALUE self, 
+ static VALUE
+ ossl_pkcs7_get_certificates(VALUE self)
+ {
+-    return ossl_x509_sk2ary(pkcs7_get_certs_or_crls(self, 1));
++    return ossl_x509_sk2ary(pkcs7_get_certs(self));
+ }
+ 
+ static VALUE
+@@ -621,7 +641,7 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ar
+     STACK_OF(X509_CRL) *crls;
+     X509_CRL *crl;
+ 
+-    crls = pkcs7_get_certs_or_crls(self, 0);
++    crls = pkcs7_get_crls(self);
+     while((crl = sk_X509_CRL_pop(crls))) X509_CRL_free(crl);
+     rb_iterate(rb_each, ary, ossl_pkcs7_set_crls_i, self);
+ 
+@@ -631,7 +651,7 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ar
+ static VALUE
+ ossl_pkcs7_get_crls(VALUE self)
+ {
+-    return ossl_x509crl_sk2ary(pkcs7_get_certs_or_crls(self, 0));
++    return ossl_x509crl_sk2ary(pkcs7_get_crls(self));
+ }
+ 
+ static VALUE
+diff -up ext/openssl/ossl_ssl.c.ossl10 ext/openssl/ossl_ssl.c
+--- ext/openssl/ossl_ssl.c.ossl10	2007-03-12 05:12:32.000000000 +0100
++++ ext/openssl/ossl_ssl.c	2009-08-26 12:08:48.000000000 +0200
+@@ -89,12 +89,18 @@ static char *ossl_sslctx_attrs[] = {
+ static char *ossl_ssl_attr_readers[] = { "io", "context", };
+ static char *ossl_ssl_attrs[] = { "sync_close", };
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++#define OSSL_MORE_CONST const
++#define STACK _STACK
++#else
++#define OSSL_MORE_CONST
++#endif
+ /*
+  * SSLContext class
+  */
+ struct {
+     const char *name;
+-    SSL_METHOD *(*func)(void);
++    OSSL_MORE_CONST SSL_METHOD *(*func)(void);
+ } ossl_ssl_method_tab[] = {
+ #define OSSL_SSL_METHOD_ENTRY(name) { #name, name##_method }
+     OSSL_SSL_METHOD_ENTRY(TLSv1),
+@@ -407,7 +413,7 @@ ossl_sslctx_setup(VALUE self)
+ }
+ 
+ static VALUE
+-ossl_ssl_cipher_to_ary(SSL_CIPHER *cipher)
++ossl_ssl_cipher_to_ary(OSSL_MORE_CONST SSL_CIPHER *cipher)
+ {
+     VALUE ary;
+     int bits, alg_bits;
+@@ -805,7 +811,7 @@ static VALUE
+ ossl_ssl_get_cipher(VALUE self)
+ {
+     SSL *ssl;
+-    SSL_CIPHER *cipher;
++    OSSL_MORE_CONST SSL_CIPHER *cipher;
+ 
+     Data_Get_Struct(self, SSL, ssl);
+     if (!ssl) {
\ No newline at end of file
-- 
cgit v1.2.3


From 3ff3dbe55b44f36f3f30ada4fa3b2569c214b68a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:55:01 +0000
Subject: main/pound: rebuild against openssl-1.0

---
 main/pound/APKBUILD                |  11 +-
 main/pound/pound-2.5-openssl.patch | 290 +++++++++++++++++++++++++++++++++++++
 2 files changed, 300 insertions(+), 1 deletion(-)
 create mode 100644 main/pound/pound-2.5-openssl.patch

diff --git a/main/pound/APKBUILD b/main/pound/APKBUILD
index b48afd58..263438af 100644
--- a/main/pound/APKBUILD
+++ b/main/pound/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pound
 pkgver=2.5
-pkgrel=1
+pkgrel=2
 pkgdesc="A reverse proxy, load balancer, and SSL wrapper"
 url="http://www.apsis.ch/pound/index_html"
 license="GPL"
@@ -10,9 +10,17 @@ makedepends="pcre-dev openssl-dev"
 subpackages="$pkgname-doc"
 source="http://www.apsis.ch/$pkgname/Pound-$pkgver.tgz
 	pound.cfg
+	pound-2.5-openssl.patch
 	$pkgname.initd"
 
 _builddir="$srcdir"/Pound-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		patch -p1 -i "$i" || return 1
+	done
+}
+
 build() { 
 	cd "$_builddir"
 	./configure --prefix=/usr --sysconfdir=/etc/pound
@@ -28,4 +36,5 @@ package() {
 }
 md5sums="8a39f5902094619afcda7d12d9d8342c  Pound-2.5.tgz
 736b12a47acbb7fc2802ed7f51e959d0  pound.cfg
+c2c48dc395ffc045f9d35394992292d0  pound-2.5-openssl.patch
 074fc58c89bb70e8fcd767ee70ebd0f0  pound.initd"
diff --git a/main/pound/pound-2.5-openssl.patch b/main/pound/pound-2.5-openssl.patch
new file mode 100644
index 00000000..efefd548
--- /dev/null
+++ b/main/pound/pound-2.5-openssl.patch
@@ -0,0 +1,290 @@
+diff -up Pound-2.5/config.c.openssl Pound-2.5/config.c
+--- Pound-2.5/config.c.openssl	2010-02-10 12:23:09.000000000 +0100
++++ Pound-2.5/config.c	2010-02-10 12:23:07.000000000 +0100
+@@ -431,14 +431,22 @@ t_hash(const TABNODE *e)
+         res = (res ^ *k++) * 16777619;
+     return res;
+ }
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++static IMPLEMENT_LHASH_HASH_FN(t, TABNODE)
++#else
+ static IMPLEMENT_LHASH_HASH_FN(t_hash, const TABNODE *)
++#endif
+ 
+ static int
+ t_cmp(const TABNODE *d1, const TABNODE *d2)
+ {
+     return strcmp(d1->key, d2->key);
+ }
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++static IMPLEMENT_LHASH_COMP_FN(t, TABNODE)
++#else
+ static IMPLEMENT_LHASH_COMP_FN(t_cmp, const TABNODE *)
++#endif
+ 
+ /*
+  * parse a service
+@@ -460,7 +468,11 @@ parse_service(const char *svc_name)
+     pthread_mutex_init(&res->mut, NULL);
+     if(svc_name)
+         strncpy(res->name, svc_name, KEY_SIZE);
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    if((res->sessions = LHM_lh_new(TABNODE, t)) == NULL)
++#else
+     if((res->sessions = lh_new(LHASH_HASH_FN(t_hash), LHASH_COMP_FN(t_cmp))) == NULL)
++#endif
+         conf_err("lh_new failed - aborted");
+     ign_case = ignore_case;
+     while(conf_fgets(lin, MAXBUF)) {
+diff -up Pound-2.5/pound.h.openssl Pound-2.5/pound.h
+--- Pound-2.5/pound.h.openssl	2010-02-02 12:49:02.000000000 +0100
++++ Pound-2.5/pound.h	2010-02-10 12:15:18.000000000 +0100
+@@ -322,6 +322,10 @@ typedef struct _tn {
+ /* maximal session key size */
+ #define KEY_SIZE    127
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++DECLARE_LHASH_OF(TABNODE);
++#endif
++
+ /* service definition */
+ typedef struct _service {
+     char                name[KEY_SIZE + 1]; /* symbolic name */
+@@ -337,7 +341,11 @@ typedef struct _service {
+     int                 sess_ttl;   /* session time-to-live */
+     regex_t             sess_start; /* pattern to identify the session data */
+     regex_t             sess_pat;   /* pattern to match the session data */
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    LHASH_OF(TABNODE)   *sessions;  /* currently active sessions */
++#else
+     LHASH               *sessions;  /* currently active sessions */
++#endif
+     int                 dynscale;   /* true if the back-ends should be dynamically rescaled */
+     int                 disabled;   /* true if the service is disabled */
+     struct _service     *next;
+diff -up Pound-2.5/svc.c.openssl Pound-2.5/svc.c
+--- Pound-2.5/svc.c.openssl	2010-02-02 12:49:02.000000000 +0100
++++ Pound-2.5/svc.c	2010-02-10 12:13:29.000000000 +0100
+@@ -27,12 +27,17 @@
+ 
+ #include    "pound.h"
+ 
++#ifndef LHASH_OF
++#define LHASH_OF(x) LHASH
++#define CHECKED_LHASH_OF(type, h) h
++#endif
++
+ /*
+  * Add a new key/content pair to a hash table
+  * the table should be already locked
+  */
+ static void
+-t_add(LHASH *const tab, const char *key, const void *content, const size_t cont_len)
++t_add(LHASH_OF(TABNODE) *const tab, const char *key, const void *content, const size_t cont_len)
+ {
+     TABNODE *t, *old;
+ 
+@@ -53,7 +58,11 @@ t_add(LHASH *const tab, const char *key,
+     }
+     memcpy(t->content, content, cont_len);
+     t->last_acc = time(NULL);
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    if((old = LHM_lh_insert(TABNODE, tab, t)) != NULL) {
++#else
+     if((old = (TABNODE *)lh_insert(tab, t)) != NULL) {
++#endif
+         free(old->key);
+         free(old->content);
+         free(old);
+@@ -68,12 +77,16 @@ t_add(LHASH *const tab, const char *key,
+  * side-effect: update the time of last access
+  */
+ static void *
+-t_find(LHASH *const tab, char *const key)
++t_find(LHASH_OF(TABNODE) *const tab, char *const key)
+ {
+     TABNODE t, *res;
+ 
+     t.key = key;
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    if((res = LHM_lh_retrieve(TABNODE, tab, &t)) != NULL) {
++#else
+     if((res = (TABNODE *)lh_retrieve(tab, &t)) != NULL) {
++#endif
+         res->last_acc = time(NULL);
+         return res->content;
+     }
+@@ -84,12 +97,16 @@ t_find(LHASH *const tab, char *const key
+  * Delete a key
+  */
+ static void
+-t_remove(LHASH *const tab, char *const key)
++t_remove(LHASH_OF(TABNODE) *const tab, char *const key)
+ {
+     TABNODE t, *res;
+ 
+     t.key = key;
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    if((res = LHM_lh_delete(TABNODE, tab, &t)) != NULL) {
++#else
+     if((res = (TABNODE *)lh_delete(tab, &t)) != NULL) {
++#endif
+         free(res->key);
+         free(res->content);
+         free(res);
+@@ -98,59 +115,75 @@ t_remove(LHASH *const tab, char *const k
+ }
+ 
+ typedef struct  {
+-    LHASH   *tab;
++    LHASH_OF(TABNODE) *tab;
+     time_t  lim;
+     void    *content;
+     int     cont_len;
+ }   ALL_ARG;
+ 
+ static void
+-t_old(TABNODE *t, void *arg)
++t_old_doall_arg(TABNODE *t, ALL_ARG *a)
+ {
+-    ALL_ARG *a;
+-
+-    a = (ALL_ARG *)arg;
+     if(t->last_acc < a->lim)
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++        LHM_lh_delete(TABNODE, a->tab, t);
++#else
+         lh_delete(a->tab, t);
++#endif
+     return;
+ }
+-IMPLEMENT_LHASH_DOALL_ARG_FN(t_old, TABNODE *, void *)
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_old, TABNODE, ALL_ARG)
++#else
++#define t_old t_old_doall_arg
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_old, TABNODE *, ALL_ARG *)
++#endif
+ 
+ /*
+  * Expire all old nodes
+  */
+ static void
+-t_expire(LHASH *const tab, const time_t lim)
++t_expire(LHASH_OF(TABNODE) *const tab, const time_t lim)
+ {
+     ALL_ARG a;
+     int down_load;
+ 
+     a.tab = tab;
+     a.lim = lim;
+-    down_load = tab->down_load;
+-    tab->down_load = 0;
++    down_load = CHECKED_LHASH_OF(TABNODE, tab)->down_load;
++    CHECKED_LHASH_OF(TABNODE, tab)->down_load = 0;
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    LHM_lh_doall_arg(TABNODE, tab, LHASH_DOALL_ARG_FN(t_old), ALL_ARG, &a);
++#else
+     lh_doall_arg(tab, LHASH_DOALL_ARG_FN(t_old), &a);
+-    tab->down_load = down_load;
++#endif
++    CHECKED_LHASH_OF(TABNODE, tab)->down_load = down_load;
+     return;
+ }
+ 
+ static void
+-t_cont(TABNODE *t, void *arg)
++t_cont_doall_arg(TABNODE *t, ALL_ARG *a)
+ {
+-    ALL_ARG *a;
+-
+-    a = (ALL_ARG *)arg;
+     if(memcmp(t->content, a->content, a->cont_len) == 0)
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++        LHM_lh_delete(TABNODE, a->tab, t);
++#else
+         lh_delete(a->tab, t);
++#endif
+     return;
+ }
+-IMPLEMENT_LHASH_DOALL_ARG_FN(t_cont, TABNODE *, void *)
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_cont, TABNODE, ALL_ARG)
++#else
++#define t_cont t_cont_doall_arg
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_cont, TABNODE *, ALL_ARG *)
++#endif
+ 
+ /*
+  * Remove all nodes with the given content
+  */
+ static void
+-t_clean(LHASH *const tab, void *const content, const size_t cont_len)
++t_clean(LHASH_OF(TABNODE) *const tab, void *const content, const size_t cont_len)
+ {
+     ALL_ARG a;
+     int down_load;
+@@ -158,10 +191,14 @@ t_clean(LHASH *const tab, void *const co
+     a.tab = tab;
+     a.content = content;
+     a.cont_len = cont_len;
+-    down_load = tab->down_load;
+-    tab->down_load = 0;
++    down_load = CHECKED_LHASH_OF(TABNODE, tab)->down_load;
++    CHECKED_LHASH_OF(TABNODE, tab)->down_load = 0;
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    LHM_lh_doall_arg(TABNODE, tab, LHASH_DOALL_ARG_FN(t_cont), ALL_ARG, &a);
++#else
+     lh_doall_arg(tab, LHASH_DOALL_ARG_FN(t_cont), &a);
+-    tab->down_load = down_load;
++#endif
++    CHECKED_LHASH_OF(TABNODE, tab)->down_load = down_load;
+     return;
+ }
+ 
+@@ -1410,13 +1447,11 @@ typedef struct  {
+ }   DUMP_ARG;
+ 
+ static void
+-t_dump(TABNODE *t, void *arg)
++t_dump_doall_arg(TABNODE *t, DUMP_ARG *a)
+ {
+-    DUMP_ARG    *a;
+     BACKEND     *be, *bep;
+     int         n_be, sz;
+ 
+-    a = (DUMP_ARG *)arg;
+     memcpy(&bep, t->content, sizeof(bep));
+     for(n_be = 0, be = a->backends; be; be = be->next, n_be++)
+         if(be == bep)
+@@ -1432,19 +1467,28 @@ t_dump(TABNODE *t, void *arg)
+     return;
+ }
+ 
+-IMPLEMENT_LHASH_DOALL_ARG_FN(t_dump, TABNODE *, void *)
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_dump, TABNODE, DUMP_ARG)
++#else
++#define t_dump t_dump_doall_arg
++IMPLEMENT_LHASH_DOALL_ARG_FN(t_dump, TABNODE *, DUMP_ARG *)
++#endif
+ 
+ /*
+  * write sessions to the control socket
+  */
+ static void
+-dump_sess(const int control_sock, LHASH *const sess, BACKEND *const backends)
++dump_sess(const int control_sock, LHASH_OF(TABNODE) *const sess, BACKEND *const backends)
+ {
+     DUMP_ARG a;
+ 
+     a.control_sock = control_sock;
+     a.backends = backends;
++#if OPENSSL_VERSION_NUMBER >= 0x10000000L
++    LHM_lh_doall_arg(TABNODE, sess, LHASH_DOALL_ARG_FN(t_dump), DUMP_ARG, &a);
++#else
+     lh_doall_arg(sess, LHASH_DOALL_ARG_FN(t_dump), &a);
++#endif
+     return;
+ }
+ 
-- 
cgit v1.2.3


From 9ca82f726fc4b1f0a2391b06d5ac7656d66cefab Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:57:16 +0000
Subject: main/[various]: rebuild against openssl-1.0

---
 main/abuild/APKBUILD                    | 2 +-
 main/apk-tools/APKBUILD                 | 2 +-
 main/asterisk/APKBUILD                  | 2 +-
 main/bind/APKBUILD                      | 2 +-
 main/cgit/APKBUILD                      | 9 ++++++---
 main/claws-mail/APKBUILD                | 2 +-
 main/cups/APKBUILD                      | 2 +-
 main/curl/APKBUILD                      | 2 +-
 main/cyrus-sasl/APKBUILD                | 2 +-
 main/dovecot/APKBUILD                   | 2 +-
 main/email/APKBUILD                     | 2 +-
 main/fetchmail/APKBUILD                 | 2 +-
 main/freeswitch/APKBUILD                | 2 +-
 main/git/APKBUILD                       | 2 +-
 main/hostapd/APKBUILD                   | 2 +-
 main/imap/APKBUILD                      | 2 +-
 main/ipsec-tools/APKBUILD               | 2 +-
 main/irssi/APKBUILD                     | 2 +-
 main/iscsitarget/APKBUILD               | 2 +-
 main/lftp/APKBUILD                      | 2 +-
 main/lighttpd/APKBUILD                  | 2 +-
 main/links/APKBUILD                     | 2 +-
 main/mini_httpd/APKBUILD                | 2 +-
 main/mysql/APKBUILD                     | 2 +-
 main/neon/APKBUILD                      | 2 +-
 main/net-snmp/APKBUILD                  | 2 +-
 main/ngircd/APKBUILD                    | 2 +-
 main/nmap/APKBUILD                      | 2 +-
 main/nrpe/APKBUILD                      | 2 +-
 main/openldap/APKBUILD                  | 2 +-
 main/openntpd/APKBUILD                  | 2 +-
 main/openssh/APKBUILD                   | 2 +-
 main/openvpn/APKBUILD                   | 2 +-
 main/perl-crypt-openssl-random/APKBUILD | 2 +-
 main/perl-crypt-openssl-rsa/APKBUILD    | 2 +-
 main/perl-net-ssleay/APKBUILD           | 2 +-
 main/pgcluster/APKBUILD                 | 2 +-
 main/php/APKBUILD                       | 2 +-
 main/pjproject/APKBUILD                 | 2 +-
 main/postfix/APKBUILD                   | 2 +-
 main/postgresql/APKBUILD                | 2 +-
 main/python/APKBUILD                    | 2 +-
 main/rdesktop/APKBUILD                  | 2 +-
 main/squid/APKBUILD                     | 2 +-
 main/ssmtp/APKBUILD                     | 2 +-
 main/subversion/APKBUILD                | 2 +-
 main/sylpheed/APKBUILD                  | 2 +-
 main/tcpdump/APKBUILD                   | 2 +-
 main/transmission/APKBUILD              | 2 +-
 main/vsftpd/APKBUILD                    | 2 +-
 main/wget/APKBUILD                      | 2 +-
 main/wireshark/APKBUILD                 | 2 +-
 main/wpa_supplicant/APKBUILD            | 2 +-
 main/xchat/APKBUILD                     | 2 +-
 main/xorg-server/APKBUILD               | 2 +-
 55 files changed, 60 insertions(+), 57 deletions(-)

diff --git a/main/abuild/APKBUILD b/main/abuild/APKBUILD
index db457836..8aed5444 100644
--- a/main/abuild/APKBUILD
+++ b/main/abuild/APKBUILD
@@ -2,7 +2,7 @@
 pkgdesc="Script to build Alpine Packages"
 pkgname=abuild
 pkgver=2.2
-pkgrel=0
+pkgrel=1
 url=http://git.alpinelinux.org/cgit/abuild/
 source="http://git.alpinelinux.org/cgit/abuild/snapshot/abuild-$pkgver.tar.bz2
 	"
diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index e9fd040f..b90107a2 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
diff --git a/main/asterisk/APKBUILD b/main/asterisk/APKBUILD
index e1aec9bb..1ed4b410 100644
--- a/main/asterisk/APKBUILD
+++ b/main/asterisk/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Timo Teras <timo.teras@iki.fi>
 pkgname=asterisk
 pkgver=1.6.2.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Asterisk: A Module Open Source PBX System"
 url="http://www.asterisk.org/"
 license="GPL"
diff --git a/main/bind/APKBUILD b/main/bind/APKBUILD
index 21f570ec..93a30472 100644
--- a/main/bind/APKBUILD
+++ b/main/bind/APKBUILD
@@ -4,7 +4,7 @@ pkgname=bind
 pkgver=9.7.0_p1
 _ver=${pkgver%_p*}
 _p=${pkgver#*_p}
-pkgrel=1
+pkgrel=2
 pkgdesc="BIND - Berkeley Internet Name Domain - Name Server and tools"
 url="http://www.isc.org"
 license="as-is"
diff --git a/main/cgit/APKBUILD b/main/cgit/APKBUILD
index af8ea6d1..6b30ed78 100644
--- a/main/cgit/APKBUILD
+++ b/main/cgit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cgit
 pkgver=0.8.3.1
-pkgrel=1
+pkgrel=2
 _gitver=1.6.4.3
 pkgdesc="a fast webinterface for git"
 url="http://hjemli.net/git/cgit"
@@ -14,14 +14,17 @@ source="
 	"
 
 _makeopts="NO_ICONV=YesPlease
-	NO_NSEC=YesPlease
 	NO_TCLTK=YesPlease
 	NO_SVN_TESTS=YesPlease"
 
-build() {
+prepare() {
 	cd "$srcdir/$pkgname-$pkgver"
 	rm -rf git
 	ln -s ../git-$_gitver git
+}
+
+build() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make $_makeopts
 }
 
diff --git a/main/claws-mail/APKBUILD b/main/claws-mail/APKBUILD
index 586db2e4..a98dac56 100644
--- a/main/claws-mail/APKBUILD
+++ b/main/claws-mail/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=claws-mail
 pkgver=3.7.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A GTK+ based e-mail client."
 url="http://www.claws-mail.org"
 license="GPL3"
diff --git a/main/cups/APKBUILD b/main/cups/APKBUILD
index 8ece114d..8ae5f384 100644
--- a/main/cups/APKBUILD
+++ b/main/cups/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cups
 pkgver=1.4.3
-pkgrel=1
+pkgrel=2
 pkgdesc="The CUPS Printing System"
 url="http://www.cups.org/"
 license="GPL"
diff --git a/main/curl/APKBUILD b/main/curl/APKBUILD
index f868ab19..f7d6c504 100644
--- a/main/curl/APKBUILD
+++ b/main/curl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=curl
 pkgver=7.20.1
-pkgrel=0
+pkgrel=1
 pkgdesc="An URL retrival utility and library"
 url="http://curl.haxx.se"
 license="MIT"
diff --git a/main/cyrus-sasl/APKBUILD b/main/cyrus-sasl/APKBUILD
index 519bd908..98c75439 100644
--- a/main/cyrus-sasl/APKBUILD
+++ b/main/cyrus-sasl/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cyrus-sasl
 pkgver=2.1.23
-pkgrel=3
+pkgrel=4
 pkgdesc="Cyrus Simple Authentication Service Layer (SASL)"
 url="http://cyrusimap.web.cmu.edu/downloads.html#sasl"
 license="custom"
diff --git a/main/dovecot/APKBUILD b/main/dovecot/APKBUILD
index 500aa84c..6dd77003 100644
--- a/main/dovecot/APKBUILD
+++ b/main/dovecot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dovecot
 pkgver=1.2.11
-pkgrel=2
+pkgrel=3
 pkgdesc="IMAP and POP3 server"
 url="http://www.dovecot.org/"
 license="LGPL-2.1"
diff --git a/main/email/APKBUILD b/main/email/APKBUILD
index 11478b4f..8c81437c 100644
--- a/main/email/APKBUILD
+++ b/main/email/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=email
 pkgver=3.1.2
-pkgrel=1
+pkgrel=2
 pkgdesc="A command line SMTP client that's simple"
 url="http://www.cleancode.org/projects/email"
 license="GPL"
diff --git a/main/fetchmail/APKBUILD b/main/fetchmail/APKBUILD
index 5e1ba967..b86bd2a0 100644
--- a/main/fetchmail/APKBUILD
+++ b/main/fetchmail/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=fetchmail
 pkgver=6.3.17
-pkgrel=0
+pkgrel=1
 pkgdesc="A remote-mail retrieval and forwarding utility"
 url="http://fetchmail.berlios.de/"
 license="GPL"
diff --git a/main/freeswitch/APKBUILD b/main/freeswitch/APKBUILD
index 149ecd42..860ec0ff 100644
--- a/main/freeswitch/APKBUILD
+++ b/main/freeswitch/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 pkgname=freeswitch
 pkgver=1.0.6
-pkgrel=5
+pkgrel=6
 pkgdesc="A communications platform written in C from the ground up"
 url="http://www.freeswitch.org"
 license="GPL"
diff --git a/main/git/APKBUILD b/main/git/APKBUILD
index 5d5153c2..f8d9e8bb 100644
--- a/main/git/APKBUILD
+++ b/main/git/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=git
 pkgver=1.7.1
-pkgrel=1
+pkgrel=2
 pkgdesc="GIT - the stupid content tracker"
 url="http://git.or.cz/"
 license="GPL2"
diff --git a/main/hostapd/APKBUILD b/main/hostapd/APKBUILD
index a0acf6a6..915792b2 100644
--- a/main/hostapd/APKBUILD
+++ b/main/hostapd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hostapd
 pkgver=0.6.10
-pkgrel=1
+pkgrel=2
 pkgdesc="daemon for wireless software access points"
 url="http://hostap.epitest.fi/hostapd/"
 license="custom"
diff --git a/main/imap/APKBUILD b/main/imap/APKBUILD
index 39f0acb7..547cf396 100644
--- a/main/imap/APKBUILD
+++ b/main/imap/APKBUILD
@@ -5,7 +5,7 @@
 # build it shared
 pkgname=imap
 pkgver=2007e
-pkgrel=4
+pkgrel=5
 pkgdesc="An IMAP/POP server"
 url="http://www.washington.edu/imap"
 license="APACHE"
diff --git a/main/ipsec-tools/APKBUILD b/main/ipsec-tools/APKBUILD
index 0b612f32..4d8ef0d0 100644
--- a/main/ipsec-tools/APKBUILD
+++ b/main/ipsec-tools/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=ipsec-tools
 pkgver=0.8_alpha20090903
 _myver=0.8-alpha20090903
-pkgrel=7
+pkgrel=8
 pkgdesc="User-space IPsec tools for various IPsec implementations"
 url="http://ipsec-tools.sourceforge.net/"
 license="BSD"
diff --git a/main/irssi/APKBUILD b/main/irssi/APKBUILD
index 253c96ea..59cbdb33 100644
--- a/main/irssi/APKBUILD
+++ b/main/irssi/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail.com>
 pkgname=irssi
 pkgver=0.8.15
-pkgrel=0
+pkgrel=1
 pkgdesc="A modular textUI IRC client with IPv6 support"
 url="http://irssi.org/"
 license='GPL'
diff --git a/main/iscsitarget/APKBUILD b/main/iscsitarget/APKBUILD
index 6ef57463..a53e6286 100644
--- a/main/iscsitarget/APKBUILD
+++ b/main/iscsitarget/APKBUILD
@@ -2,7 +2,7 @@
 
 pkgname=iscsitarget
 pkgver=1.4.19
-pkgrel=1
+pkgrel=2
 pkgdesc="Open Source iSCSI target with professional features - userspace utils"
 url="http://iscsitarget.sourceforge.net/"
 license="GPL-2"
diff --git a/main/lftp/APKBUILD b/main/lftp/APKBUILD
index 76f3869e..714b7cf2 100644
--- a/main/lftp/APKBUILD
+++ b/main/lftp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=lftp
 pkgver=4.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="LFTP is sophisticated ftp/http client"
 url="http://lftp.yar.ru/"
 license="GPL"
diff --git a/main/lighttpd/APKBUILD b/main/lighttpd/APKBUILD
index 345b54ae..5c03ed55 100644
--- a/main/lighttpd/APKBUILD
+++ b/main/lighttpd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lighttpd
 pkgver=1.4.26
 _streamver=2.2.0
-pkgrel=3
+pkgrel=4
 pkgdesc="a secure, fast, compliant and very flexible web-server"
 url="http://www.lighttpd.net/"
 license="custom"
diff --git a/main/links/APKBUILD b/main/links/APKBUILD
index 49fa483a..bc2e3f32 100644
--- a/main/links/APKBUILD
+++ b/main/links/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=links
 pkgver=2.2
-pkgrel=1
+pkgrel=2
 pkgdesc="A text WWW browser, similar to Lynx"
 url="http://atrey.karlin.mff.cuni.cz/~clock/twibright/links/"
 license="GPL"
diff --git a/main/mini_httpd/APKBUILD b/main/mini_httpd/APKBUILD
index a27ac976..58c86f1e 100644
--- a/main/mini_httpd/APKBUILD
+++ b/main/mini_httpd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mini_httpd
 pkgver=1.19
-pkgrel=4
+pkgrel=5
 pkgdesc="Small forking webserver with ssl and ipv6 support"
 url="http://www.acme.com/software/mini_httpd/"
 license="BSD"
diff --git a/main/mysql/APKBUILD b/main/mysql/APKBUILD
index e45e96ed..ff1776fd 100644
--- a/main/mysql/APKBUILD
+++ b/main/mysql/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mysql
 pkgver=5.1.46
-pkgrel=0
+pkgrel=1
 pkgdesc="A fast SQL database server"
 url="http://www.mysql.com/"
 license='GPL'
diff --git a/main/neon/APKBUILD b/main/neon/APKBUILD
index 9aaea2c7..b756630c 100644
--- a/main/neon/APKBUILD
+++ b/main/neon/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=neon
 pkgver=0.29.3
-pkgrel=0
+pkgrel=1
 pkgdesc="HTTP and WebDAV client library with a C interface"
 url="http://www.webdav.org/neon/"
 license="GPL LGPL"
diff --git a/main/net-snmp/APKBUILD b/main/net-snmp/APKBUILD
index ad3462f8..3b68686d 100644
--- a/main/net-snmp/APKBUILD
+++ b/main/net-snmp/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter@gmail.com>
 pkgname=net-snmp
 pkgver=5.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple Network Management Protocol"
 url="http://www.net-snmp.org/"
 license="GPL"
diff --git a/main/ngircd/APKBUILD b/main/ngircd/APKBUILD
index 409de6af..3b6dce21 100644
--- a/main/ngircd/APKBUILD
+++ b/main/ngircd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ngircd
 pkgver=15
-pkgrel=1
+pkgrel=2
 pkgdesc="Next Generation IRC Daemon"
 url="http://ngircd.barton.de/"
 license="GPL"
diff --git a/main/nmap/APKBUILD b/main/nmap/APKBUILD
index e2b9d284..6ced585c 100644
--- a/main/nmap/APKBUILD
+++ b/main/nmap/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname=nmap 
 pkgver=5.21
-pkgrel=1
+pkgrel=2
 pkgdesc="A network exploration tool and security/port scanner"
 url="http:/nmap.org"
 license="custom:GPL"
diff --git a/main/nrpe/APKBUILD b/main/nrpe/APKBUILD
index b87b6410..6b504167 100644
--- a/main/nrpe/APKBUILD
+++ b/main/nrpe/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=nrpe
 pkgver=2.12
-pkgrel=3
+pkgrel=4
 pkgusers="nagios"
 pkggroups="nagios"
 pkgdesc="NRPE allows you to remotely execute Nagios plugins on other Linux/Unix machines."
diff --git a/main/openldap/APKBUILD b/main/openldap/APKBUILD
index 45d751ed..cc369db6 100644
--- a/main/openldap/APKBUILD
+++ b/main/openldap/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openldap
 pkgver=2.4.21
-pkgrel=1
+pkgrel=2
 pkgdesc="LDAP Server"
 url="http://www.openldap.org/"
 license="custom"
diff --git a/main/openntpd/APKBUILD b/main/openntpd/APKBUILD
index fe3b1844..8737a19d 100644
--- a/main/openntpd/APKBUILD
+++ b/main/openntpd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=openntpd
 pkgver=3.9_p1
 _myver=3.9p1
-pkgrel=7
+pkgrel=8
 pkgdesc="Lightweight NTP server ported from OpenBSD"
 url=http://www.openntpd.org/
 install=openntpd.pre-install
diff --git a/main/openssh/APKBUILD b/main/openssh/APKBUILD
index 5059c5f6..3fc470ae 100644
--- a/main/openssh/APKBUILD
+++ b/main/openssh/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=openssh
 pkgver=5.4_p1
 _myver=${pkgver%_*}${pkgver#*_}
-pkgrel=1
+pkgrel=2
 pkgdesc="Port of OpenBSD's free SSH release"
 url="http://www.openssh.org/portable.html"
 license="as-is"
diff --git a/main/openvpn/APKBUILD b/main/openvpn/APKBUILD
index 8b82bf5c..3bd1119a 100644
--- a/main/openvpn/APKBUILD
+++ b/main/openvpn/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openvpn
 pkgver=2.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A robust, and highly configurable VPN (Virtual Private Network)"
 url="http://openvpn.sourceforge.net/"
 license="custom"
diff --git a/main/perl-crypt-openssl-random/APKBUILD b/main/perl-crypt-openssl-random/APKBUILD
index f8e24cb9..3334a629 100644
--- a/main/perl-crypt-openssl-random/APKBUILD
+++ b/main/perl-crypt-openssl-random/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-crypt-openssl-random
 _realname=Crypt-OpenSSL-Random
 pkgver=0.04
-pkgrel=1
+pkgrel=2
 pkgdesc="RSA encoding and decoding, using the openSSL libraries"
 url="http://search.cpan.org/~iroberts/Crypt-OpenSSL-Random-0.04/"
 license="Unknown"
diff --git a/main/perl-crypt-openssl-rsa/APKBUILD b/main/perl-crypt-openssl-rsa/APKBUILD
index 263a8955..bce2e807 100644
--- a/main/perl-crypt-openssl-rsa/APKBUILD
+++ b/main/perl-crypt-openssl-rsa/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-crypt-openssl-rsa
 _realname=Crypt-OpenSSL-RSA
 pkgver=0.26
-pkgrel=1
+pkgrel=2
 pkgdesc="RSA encoding and decoding, using the openSSL libraries"
 url="http://search.cpan.org/~iroberts/Crypt-OpenSSL-RSA-0.25/"
 license="Unknown"
diff --git a/main/perl-net-ssleay/APKBUILD b/main/perl-net-ssleay/APKBUILD
index 77a007cb..d6c366aa 100644
--- a/main/perl-net-ssleay/APKBUILD
+++ b/main/perl-net-ssleay/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=perl-net-ssleay
 _realname=Net-SSLeay
 pkgver=1.36
-pkgrel=1
+pkgrel=2
 pkgdesc="Perl extension for using OpenSSL"
 url="http://search.cpan.org/dist/Net-SSLeay/"
 license="GPL"
diff --git a/main/pgcluster/APKBUILD b/main/pgcluster/APKBUILD
index f1f0c67b..ec2a51af 100644
--- a/main/pgcluster/APKBUILD
+++ b/main/pgcluster/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=pgcluster
 pkgver=1.9.0_rc5
 _myver=1.9.0rc5
-pkgrel=3
+pkgrel=4
 pkgdesc="PostgreSQL with multi-master cluster/replication patch"
 url="http://pgfoundry.org/projects/pgcluster/"
 license="BSD"
diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index 43a33a6f..8bd5fb8b 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php
 pkgver=5.3.2
 _suhosinver=${pkgver}-0.9.9.1
-pkgrel=4
+pkgrel=5
 pkgdesc="The PHP language runtime engine"
 url="http://www.php.net/"
 license="PHP-3"
diff --git a/main/pjproject/APKBUILD b/main/pjproject/APKBUILD
index da43af73..77722b13 100644
--- a/main/pjproject/APKBUILD
+++ b/main/pjproject/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pjproject
 pkgver=1.6
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI Softphone"
 url="http://www.pjsip.org/pjsua.htm"
 license="GPL"
diff --git a/main/postfix/APKBUILD b/main/postfix/APKBUILD
index 8393e8cc..2367e986 100644
--- a/main/postfix/APKBUILD
+++ b/main/postfix/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postfix
 pkgver=2.6.5
-pkgrel=3
+pkgrel=4
 pkgdesc="Secure and fast drop-in replacement for Sendmail (MTA)"
 url="http://www.postfix.org/"
 license="IPL-1"
diff --git a/main/postgresql/APKBUILD b/main/postgresql/APKBUILD
index a771a979..d82ee786 100644
--- a/main/postgresql/APKBUILD
+++ b/main/postgresql/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postgresql
 pkgver=8.4.3
-pkgrel=1
+pkgrel=2
 pkgdesc="A sophisticated object-relational DBMS"
 url="http://www.postgresql.org/"
 license="BSD"
diff --git a/main/python/APKBUILD b/main/python/APKBUILD
index a7df0842..07fb2d4c 100644
--- a/main/python/APKBUILD
+++ b/main/python/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=python
 pkgver=2.6.5
-pkgrel=1
+pkgrel=2
 pkgdesc="A high-level scripting language"
 url="http://www.python.org"
 license="custom"
diff --git a/main/rdesktop/APKBUILD b/main/rdesktop/APKBUILD
index 45a865e0..c491e990 100644
--- a/main/rdesktop/APKBUILD
+++ b/main/rdesktop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=rdesktop
 pkgver=1.6.0
-pkgrel=2
+pkgrel=3
 pkgdesc="rdesktop is used to connect to windows terminal servers"
 url="http://www.rdesktop.org/"
 license="GPL"
diff --git a/main/squid/APKBUILD b/main/squid/APKBUILD
index 44564778..22e51652 100644
--- a/main/squid/APKBUILD
+++ b/main/squid/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=squid
 pkgver=2.7.7
 _ver=2.7.STABLE7
-pkgrel=4
+pkgrel=5
 pkgdesc="A full-featured Web proxy cache server."
 url="http://www.squid-cache.org"
 install="squid.pre-install squid.pre-upgrade squid.post-install"
diff --git a/main/ssmtp/APKBUILD b/main/ssmtp/APKBUILD
index 590cee0d..272022f4 100644
--- a/main/ssmtp/APKBUILD
+++ b/main/ssmtp/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=ssmtp
 pkgver=2.64
-pkgrel=2
+pkgrel=3
 pkgdesc="Extremely simple MTA to get mail off the system to a mail hub"
 subpackages="$pkgname-doc"
 arch=""
diff --git a/main/subversion/APKBUILD b/main/subversion/APKBUILD
index 15a57dbc..e33abe6e 100644
--- a/main/subversion/APKBUILD
+++ b/main/subversion/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=subversion
 pkgver=1.6.9
-pkgrel=1
+pkgrel=2
 pkgdesc="Replacement for CVS, another versioning system (svn)"
 url="http://subversion.tigris.org/"
 license="apache bsd"
diff --git a/main/sylpheed/APKBUILD b/main/sylpheed/APKBUILD
index 2fe2daef..5d7dc146 100644
--- a/main/sylpheed/APKBUILD
+++ b/main/sylpheed/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=sylpheed
 pkgver=3.0.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Lightweight and user-friendly e-mail client"
 url="http://sylpheed.sraoss.jp/en/"
 license="GPL"
diff --git a/main/tcpdump/APKBUILD b/main/tcpdump/APKBUILD
index a38ece54..5a1efbdd 100644
--- a/main/tcpdump/APKBUILD
+++ b/main/tcpdump/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=tcpdump
 pkgver=4.1.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A tool for network monitoring and data acquisition"
 url="http://www.tcpdump.org"
 license="BSD"
diff --git a/main/transmission/APKBUILD b/main/transmission/APKBUILD
index 9cd4f2dc..1e8f07b8 100644
--- a/main/transmission/APKBUILD
+++ b/main/transmission/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer:Carlo Landmeter
 pkgname=transmission
 pkgver=1.74
-pkgrel=1
+pkgrel=2
 pkgdesc="Lightweight GTK BitTorrent client"
 url="http://www.tansmissionbt.com"
 install="$pkgname.pre-install"
diff --git a/main/vsftpd/APKBUILD b/main/vsftpd/APKBUILD
index 1be9c18c..a7b78362 100644
--- a/main/vsftpd/APKBUILD
+++ b/main/vsftpd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=vsftpd
 pkgver=2.2.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Very secure ftpd"
 url="http://vsftpd.beasts.org"
 license="GPL"
diff --git a/main/wget/APKBUILD b/main/wget/APKBUILD
index c5ea9891..55285c1f 100644
--- a/main/wget/APKBUILD
+++ b/main/wget/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=wget
 pkgver=1.12
-pkgrel=1
+pkgrel=2
 pkgdesc="A network utility to retrieve files from the Web"
 url="http://www.gnu.org/software/wget/wget.html"
 license="GPL3"
diff --git a/main/wireshark/APKBUILD b/main/wireshark/APKBUILD
index d262ce92..bd315fa3 100644
--- a/main/wireshark/APKBUILD
+++ b/main/wireshark/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jeremy Thomerson <jeremy@thomersonfamily.com>
 pkgname=wireshark
 pkgver=1.2.6
-pkgrel=1
+pkgrel=2
 pkgdesc="network protocol analyzer - GTK version"
 url="http://www.wireshark.org"
 license="GPLv2"
diff --git a/main/wpa_supplicant/APKBUILD b/main/wpa_supplicant/APKBUILD
index 1d3d325b..3474daa1 100644
--- a/main/wpa_supplicant/APKBUILD
+++ b/main/wpa_supplicant/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wpa_supplicant
 pkgver=0.7.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A utility providing key negotiation for WPA wireless networks"
 url="http://hostap.epitest.fi/wpa_supplicant"
 license="GPL"
diff --git a/main/xchat/APKBUILD b/main/xchat/APKBUILD
index 712ac091..9fe4bbe2 100644
--- a/main/xchat/APKBUILD
+++ b/main/xchat/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xchat
 pkgver=2.8.6
-pkgrel=3
+pkgrel=4
 pkgdesc="A GTK+ based IRC client"
 url="http://www.xchat.org/"
 license="GPL"
diff --git a/main/xorg-server/APKBUILD b/main/xorg-server/APKBUILD
index 069f4880..1dbb5b18 100644
--- a/main/xorg-server/APKBUILD
+++ b/main/xorg-server/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xorg-server
 pkgver=1.7.6
-pkgrel=1
+pkgrel=2
 pkgdesc="X.Org X servers"
 url="http://xorg.freedesktop.org"
 license="custom"
-- 
cgit v1.2.3


From d15964ab95df39fe1a0633800cd5d886dfabf074 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 14 May 2010 17:59:48 +0000
Subject: main/abiword: build plugins

---
 main/abiword/APKBUILD | 45 ++++++++++++++++++++++++++++++++++-----------
 1 file changed, 34 insertions(+), 11 deletions(-)

diff --git a/main/abiword/APKBUILD b/main/abiword/APKBUILD
index 3ecdf6aa..c134f199 100644
--- a/main/abiword/APKBUILD
+++ b/main/abiword/APKBUILD
@@ -1,14 +1,31 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=abiword
 pkgver=2.8.4
-pkgrel=1
+pkgrel=2
 pkgdesc="A fully-featured word processor"
 url="http://www.abisource.com"
 license="GPL"
 makedepends="pkgconfig libglade-dev libgsf-dev enchant-dev fribidi-dev wv-dev
 	popt-dev jpeg-dev librsvg-dev bzip2-dev goffice-dev"
-subpackages="$pkgname-dev $pkgname-doc $pkgname-plugin-goffice:goffice
-	$pkgname-plugin-opendocument:opendocument"
+	
+# openxml plugin
+makedepends="$makedepends boost-dev"
+
+# collab plugin
+makedepends="$makedepends gnutls-dev libsoup-dev dbus-glib-dev"
+
+
+subpackages="$pkgname-dev $pkgname-doc $pkgname-plugins"
+
+_plugins="applix babelfish bmp clarisworks collab docbook eml freetranslation
+	garble gdict gimp google hancom hrtext iscii kword loadbindings mht
+	mif mswrite openwriter openxml opml paint passepartout pdb pdf
+	presentation s5 sdw t602 urldict wikipedia wml xslfo"
+
+for _i in $_plugins; do
+	subpackages="$subpackages $pkgname-plugin-$_i:$_i"
+done
+
 source="http://www.abisource.com/downloads/$pkgname/$pkgver/source/$pkgname-$pkgver.tar.gz"
 
 build() {
@@ -16,30 +33,36 @@ build() {
 	./configure --prefix=/usr \
 		--enable-shared \
 		--disable-static \
-		--enable-plugins="opendocument goffice" \
+		--enable-plugins \
 		|| return 1
 	make || return 1
 }
 
+#	="opendocument goffice latex" \
 package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 
-_plugin() {
+_do_plugin() {
 	local plugin="$1"
-	pkgdesc="$2"
+	pkgdesc="Abiword $1 plugin"
 	local dir="usr/lib/abiword-${pkgver%.*}/plugins"
 	mkdir -p "$subpkgdir"/$dir
 	mv "$pkgdir"/$dir/$plugin.so "$subpkgdir"/$dir/
 }
 
-goffice() {
-	_plugin goffice "GOffice interaction plugin for AbiWord"
-}
+for _i in $_plugins; do
+	eval "$_i() { _do_plugin $_i; }"
+done
 
-opendocument() {
-	_plugin opendocument "OpenDocument support plugin for AbiWord"
+plugins() {
+	pkgdesc="Abiword plugins, all of them"
+	depends=
+	for _i in $_plugins; do
+		depends="$depends $pkgname-plugin-$_i"
+	done
+	mkdir -p "$subpkgdir"
 }
 
 md5sums="f782ecb8e07d07ec179f7a143353cc29  abiword-2.8.4.tar.gz"
-- 
cgit v1.2.3


From 33d41acb4318bd395f6b57ddc14ab27767ca06aa Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 15 May 2010 19:13:45 +0000
Subject: main/boost: moved from testing

abiword needs it
---
 main/boost/APKBUILD                                | 147 +++++++++++++++++++++
 .../boost-1.41.0-parameter-needs-python.patch      | 106 +++++++++++++++
 main/boost/boost-uclibc-thread.patch               |  11 ++
 main/boost/random-Jamfile                          |  15 +++
 testing/boost/APKBUILD                             | 147 ---------------------
 .../boost-1.41.0-parameter-needs-python.patch      | 106 ---------------
 testing/boost/boost-uclibc-thread.patch            |  11 --
 testing/boost/random-Jamfile                       |  15 ---
 8 files changed, 279 insertions(+), 279 deletions(-)
 create mode 100644 main/boost/APKBUILD
 create mode 100644 main/boost/boost-1.41.0-parameter-needs-python.patch
 create mode 100644 main/boost/boost-uclibc-thread.patch
 create mode 100644 main/boost/random-Jamfile
 delete mode 100644 testing/boost/APKBUILD
 delete mode 100644 testing/boost/boost-1.41.0-parameter-needs-python.patch
 delete mode 100644 testing/boost/boost-uclibc-thread.patch
 delete mode 100644 testing/boost/random-Jamfile

diff --git a/main/boost/APKBUILD b/main/boost/APKBUILD
new file mode 100644
index 00000000..1c40e470
--- /dev/null
+++ b/main/boost/APKBUILD
@@ -0,0 +1,147 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=boost
+pkgver=1.43.0
+
+_x=${pkgver%%.*}	# strip .y.z
+_y=${pkgver%.*}		# strip .z
+_y=${_y#*.}		# strip x.
+_z=${pkgver##*.}	# strip x.y.
+_ver=${_x}_${_y}_${_z}
+
+pkgrel=0
+pkgdesc="Free peer-reviewed portable C++ source libraries"
+url="http://www.boost.org/"
+license="custom"
+depends=
+makedepends="python-dev>=2.6 flex bison bzip2-dev zlib-dev"
+subpackages="$pkgname-dev $pkgname-doc
+$pkgname-date_time
+$pkgname-filesystem
+$pkgname-graph
+$pkgname-iostreams
+$pkgname-math
+$pkgname-prg_exec_monitor
+$pkgname-program_options
+$pkgname-python:py
+$pkgname-random
+$pkgname-regex
+$pkgname-serialization
+$pkgname-signals
+$pkgname-system
+$pkgname-thread
+$pkgname-unit_test_framework
+$pkgname-wave
+$pkgname-wserialization
+"
+source="http://downloads.sourceforge.net/$pkgname/${pkgname}_$_ver.tar.gz
+	boost-1.41.0-parameter-needs-python.patch
+	boost-uclibc-thread.patch
+	random-Jamfile"
+
+_builddir="$srcdir"/${pkgname}_${_ver}
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		[ -r "$i" ] || continue
+		msg "Applying $i"
+		patch -p1 -i "$i" || return 1
+	done
+
+	# add support for /dev/urandom
+	mkdir -p libs/random/build
+	cp "$srcdir"/random-Jamfile libs/random/build/Jamfile.2
+	sed -i -e 's/#ifdef __linux__/#if 1/' \
+		libs/random/src/random_device.cpp \
+		|| return 1
+	
+	# create user-config.jam
+	cat > user-config.jam <<__EOF__
+
+using gcc : : $CC : <cxxflags>"${CXXFLAGS}" <linkflags>"${LDFLAGS}" ;
+
+__EOF__
+}
+
+_options="--user-config=\"$_builddir/user-config.jam\"
+	--prefix=\"$pkgdir/usr\"
+	release
+	debug-symbols=off
+	threading=single,multi
+	runtime-link=shared
+	link=shared,static
+	cflags=-fno-strict-aliasing
+	-sPYTHON_ROOT=/usr
+	-sPYTHON_VERSION=2.6
+	-sTOOLS=gcc
+	--layout=tagged
+	-q
+	-j${JOBS:-2}
+"
+
+build() { 
+	msg "Building bjam"
+	export BOOST_ROOT="$_builddir"
+	cd "$_builddir"/tools/jam/src
+	CC= ./build.sh cc || return 1
+	_bindir="bin.linuxx86"
+	[ "${CARCH}" = "x86_64" ] && _bindir="bin.linuxx86_64"
+	install -m755 -d "$pkgdir"/usr/bin
+	install -m755 ${_bindir}/bjam "$pkgdir"/usr/bin/bjam || return 1
+	_bjam="$pkgdir"/usr/bin/bjam
+
+	msg "Building bcp"
+	cd "${_builddir}"/tools/bcp
+	"${_bjam}" -j${JOBS:-2} || return 1
+	install -m755 "$srcdir"/${pkgname}_${_ver}/dist/bin/bcp \
+		"$pkgdir"/usr/bin/bcp || return 1
+
+	msg "Building boost"
+	cd "$_builddir"
+	"${_bjam}" $_options 
+}
+
+package() {
+	cd "$_builddir"
+	export BOOST_ROOT="$_builddir"
+	_bjam="$pkgdir"/usr/bin/bjam
+	"${_bjam}" $_options \
+		--includedir="$pkgdir"/usr/include \
+		--libdir="$pkgdir"/usr/lib \
+		install || return 1
+
+	cd "$srcdir"/${pkgname}_${_ver}/libs/python/pyste/install
+	python setup.py install --root="$pkgdir" || return 1
+	install -m755 -d "$pkgdir"/usr/share/licenses/$pkgname
+	install -m644 "$srcdir"/${pkgname}_${_ver}/LICENSE_1_0.txt \
+		"$pkgdir"/usr/share/licenses/$pkgname/ || return 1
+}
+
+_mvlib() {
+	pkgdesc="Boost $1 library"
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/libboost_$1* "$subpkgdir"/usr/lib/
+}
+
+date_time() { _mvlib date_time; }
+filesystem() { _mvlib filesystem; }
+graph() { _mvlib graph; }
+iostreams() { _mvlib iostreams; }
+math() { _mvlib math; }
+prg_exec_monitor() { _mvlib prg_exec_monitor; }
+program_options() { _mvlib program_options; }
+py() { _mvlib python; }
+random() { _mvlib random; }
+regex() { _mvlib regex; }
+serialization() { _mvlib serialization; }
+signals() { _mvlib signals; }
+system() { _mvlib system; }
+thread() { _mvlib thread; }
+unit_test_framework() { _mvlib unit_test_framework; }
+wave() { _mvlib wave; }
+wserialization() { _mvlib wserialization; }
+
+
+md5sums="734565ca4819bf04bd8e903e116c3fb1  boost_1_43_0.tar.gz
+83dbee9d7291a0f322fd2b8936aeace7  boost-1.41.0-parameter-needs-python.patch
+7ea3caa231764eca4522ae303939214d  boost-uclibc-thread.patch
+1d43f6ee1fc426f1ddcb4aafc6b77b9b  random-Jamfile"
diff --git a/main/boost/boost-1.41.0-parameter-needs-python.patch b/main/boost/boost-1.41.0-parameter-needs-python.patch
new file mode 100644
index 00000000..016995fc
--- /dev/null
+++ b/main/boost/boost-1.41.0-parameter-needs-python.patch
@@ -0,0 +1,106 @@
+--- a/boost/parameter/aux_/maybe.hpp	2008-03-22 21:45:55.000000000 +0000
++++ b/boost/parameter/aux_/maybe.hpp.new	2009-10-22 03:55:24.000000000 +0000
+@@ -2,20 +2,41 @@
+ // subject to the Boost Software License, Version 1.0. (See accompanying
+ // file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+ 
+-#ifndef BOOST_PARAMETER_MAYBE_060211_HPP
+-# define BOOST_PARAMETER_MAYBE_060211_HPP
++//
++// 2009.10.21 TDS remove depenency on boost::python::detail::referent_storage
++//
++#ifndef BOOST_PARAMETER_MAYBE_091021_HPP
++# define BOOST_PARAMETER_MAYBE_091021_HPP
+ 
+ # include <boost/mpl/if.hpp>
+ # include <boost/mpl/identity.hpp>
+ # include <boost/type_traits/is_reference.hpp>
+ # include <boost/type_traits/add_reference.hpp>
+ # include <boost/optional.hpp>
+-# include <boost/python/detail/referent_storage.hpp>
++# include <boost/aligned_storage.hpp>
+ # include <boost/type_traits/remove_cv.hpp>
+ # include <boost/type_traits/add_const.hpp>
+ 
+ namespace boost { namespace parameter { namespace aux {
+ 
++template <class T> struct referent_size;
++
++template <class T>
++struct referent_size<T&>
++{
++  BOOST_STATIC_CONSTANT(std::size_t, value = sizeof(T));
++};
++
++// A metafunction returning a POD type which can store U, where T ==
++// U&. If T is not a reference type, returns a POD which can store T.
++template <class T>
++struct referent_storage
++{
++  typedef typename boost::aligned_storage<
++    referent_size<T>::value
++    >::type type;
++};
++
+ struct maybe_base {};
+ 
+ template <class T>
+@@ -33,8 +54,8 @@
+         BOOST_DEDUCED_TYPENAME remove_reference<reference>::type
+     >::type non_cv_value;
+         
+-    explicit maybe(T value)
+-      : value(value)
++    explicit maybe(T value_)
++      : value(value_)
+       , constructed(false)
+     {}
+ 
+@@ -48,28 +69,28 @@
+             this->destroy();
+     }
+ 
+-    reference construct(reference value) const
++    reference construct(reference value_) const
+     {
+-        return value;
++        return value_;
+     }
+ 
+     template <class U>
+-    reference construct2(U const& value) const
++    reference construct2(U const& value_) const
+     {
+-        new (m_storage.bytes) non_cv_value(value);
++        new (m_storage.address()) non_cv_value(value_);
+         constructed = true;
+-        return *(non_cv_value*)m_storage.bytes;
++        return *(non_cv_value*)m_storage.address();
+     }
+ 
+     template <class U>
+-    reference construct(U const& value) const
++    reference construct(U const& value_) const
+     {
+-        return this->construct2(value);
++        return this->construct2(value_);
+     }
+ 
+     void destroy()
+     {
+-        ((non_cv_value*)m_storage.bytes)->~non_cv_value();
++        ((non_cv_value*)m_storage.address())->~non_cv_value();
+     }
+ 
+     typedef reference(maybe<T>::*safe_bool)() const;
+@@ -87,7 +108,9 @@
+ private:
+     boost::optional<T> value;
+     mutable bool constructed;
+-    mutable typename boost::python::detail::referent_storage<
++
++
++    mutable typename referent_storage<
+         reference
+     >::type m_storage;
+ };
diff --git a/main/boost/boost-uclibc-thread.patch b/main/boost/boost-uclibc-thread.patch
new file mode 100644
index 00000000..e9e6b79e
--- /dev/null
+++ b/main/boost/boost-uclibc-thread.patch
@@ -0,0 +1,11 @@
+--- ./libs/thread/src/pthread/thread.cpp.orig
++++ ./libs/thread/src/pthread/thread.cpp
+@@ -380,7 +380,7 @@
+     {
+ #if defined(PTW32_VERSION) || defined(__hpux)
+         return pthread_num_processors_np();
+-#elif defined(_GNU_SOURCE)
++#elif defined(_GNU_SOURCE) && !defined(__UCLIBC__)
+         return get_nprocs();
+ #elif defined(__APPLE__) || defined(__FreeBSD__)
+         int count;
diff --git a/main/boost/random-Jamfile b/main/boost/random-Jamfile
new file mode 100644
index 00000000..5cb6f6bc
--- /dev/null
+++ b/main/boost/random-Jamfile
@@ -0,0 +1,15 @@
+# Copyright (c) 2006 Tiziano Mueller
+#
+# Use, modification and distribution of the file is subject to the
+# Boost Software License, Version 1.0.
+# (See at http://www.boost.org/LICENSE_1_0.txt)
+
+
+project boost/random
+	: source-location ../ ;
+
+SOURCES = random_device ;
+
+lib boost_random
+	: $(SOURCES).cpp 
+	: <link>shared:<define>BOOST_RANDOM_DYN_LINK=1 ;
diff --git a/testing/boost/APKBUILD b/testing/boost/APKBUILD
deleted file mode 100644
index 1c40e470..00000000
--- a/testing/boost/APKBUILD
+++ /dev/null
@@ -1,147 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=boost
-pkgver=1.43.0
-
-_x=${pkgver%%.*}	# strip .y.z
-_y=${pkgver%.*}		# strip .z
-_y=${_y#*.}		# strip x.
-_z=${pkgver##*.}	# strip x.y.
-_ver=${_x}_${_y}_${_z}
-
-pkgrel=0
-pkgdesc="Free peer-reviewed portable C++ source libraries"
-url="http://www.boost.org/"
-license="custom"
-depends=
-makedepends="python-dev>=2.6 flex bison bzip2-dev zlib-dev"
-subpackages="$pkgname-dev $pkgname-doc
-$pkgname-date_time
-$pkgname-filesystem
-$pkgname-graph
-$pkgname-iostreams
-$pkgname-math
-$pkgname-prg_exec_monitor
-$pkgname-program_options
-$pkgname-python:py
-$pkgname-random
-$pkgname-regex
-$pkgname-serialization
-$pkgname-signals
-$pkgname-system
-$pkgname-thread
-$pkgname-unit_test_framework
-$pkgname-wave
-$pkgname-wserialization
-"
-source="http://downloads.sourceforge.net/$pkgname/${pkgname}_$_ver.tar.gz
-	boost-1.41.0-parameter-needs-python.patch
-	boost-uclibc-thread.patch
-	random-Jamfile"
-
-_builddir="$srcdir"/${pkgname}_${_ver}
-prepare() {
-	cd "$_builddir"
-	for i in "$srcdir"/*.patch; do
-		[ -r "$i" ] || continue
-		msg "Applying $i"
-		patch -p1 -i "$i" || return 1
-	done
-
-	# add support for /dev/urandom
-	mkdir -p libs/random/build
-	cp "$srcdir"/random-Jamfile libs/random/build/Jamfile.2
-	sed -i -e 's/#ifdef __linux__/#if 1/' \
-		libs/random/src/random_device.cpp \
-		|| return 1
-	
-	# create user-config.jam
-	cat > user-config.jam <<__EOF__
-
-using gcc : : $CC : <cxxflags>"${CXXFLAGS}" <linkflags>"${LDFLAGS}" ;
-
-__EOF__
-}
-
-_options="--user-config=\"$_builddir/user-config.jam\"
-	--prefix=\"$pkgdir/usr\"
-	release
-	debug-symbols=off
-	threading=single,multi
-	runtime-link=shared
-	link=shared,static
-	cflags=-fno-strict-aliasing
-	-sPYTHON_ROOT=/usr
-	-sPYTHON_VERSION=2.6
-	-sTOOLS=gcc
-	--layout=tagged
-	-q
-	-j${JOBS:-2}
-"
-
-build() { 
-	msg "Building bjam"
-	export BOOST_ROOT="$_builddir"
-	cd "$_builddir"/tools/jam/src
-	CC= ./build.sh cc || return 1
-	_bindir="bin.linuxx86"
-	[ "${CARCH}" = "x86_64" ] && _bindir="bin.linuxx86_64"
-	install -m755 -d "$pkgdir"/usr/bin
-	install -m755 ${_bindir}/bjam "$pkgdir"/usr/bin/bjam || return 1
-	_bjam="$pkgdir"/usr/bin/bjam
-
-	msg "Building bcp"
-	cd "${_builddir}"/tools/bcp
-	"${_bjam}" -j${JOBS:-2} || return 1
-	install -m755 "$srcdir"/${pkgname}_${_ver}/dist/bin/bcp \
-		"$pkgdir"/usr/bin/bcp || return 1
-
-	msg "Building boost"
-	cd "$_builddir"
-	"${_bjam}" $_options 
-}
-
-package() {
-	cd "$_builddir"
-	export BOOST_ROOT="$_builddir"
-	_bjam="$pkgdir"/usr/bin/bjam
-	"${_bjam}" $_options \
-		--includedir="$pkgdir"/usr/include \
-		--libdir="$pkgdir"/usr/lib \
-		install || return 1
-
-	cd "$srcdir"/${pkgname}_${_ver}/libs/python/pyste/install
-	python setup.py install --root="$pkgdir" || return 1
-	install -m755 -d "$pkgdir"/usr/share/licenses/$pkgname
-	install -m644 "$srcdir"/${pkgname}_${_ver}/LICENSE_1_0.txt \
-		"$pkgdir"/usr/share/licenses/$pkgname/ || return 1
-}
-
-_mvlib() {
-	pkgdesc="Boost $1 library"
-	mkdir -p "$subpkgdir"/usr/lib
-	mv "$pkgdir"/usr/lib/libboost_$1* "$subpkgdir"/usr/lib/
-}
-
-date_time() { _mvlib date_time; }
-filesystem() { _mvlib filesystem; }
-graph() { _mvlib graph; }
-iostreams() { _mvlib iostreams; }
-math() { _mvlib math; }
-prg_exec_monitor() { _mvlib prg_exec_monitor; }
-program_options() { _mvlib program_options; }
-py() { _mvlib python; }
-random() { _mvlib random; }
-regex() { _mvlib regex; }
-serialization() { _mvlib serialization; }
-signals() { _mvlib signals; }
-system() { _mvlib system; }
-thread() { _mvlib thread; }
-unit_test_framework() { _mvlib unit_test_framework; }
-wave() { _mvlib wave; }
-wserialization() { _mvlib wserialization; }
-
-
-md5sums="734565ca4819bf04bd8e903e116c3fb1  boost_1_43_0.tar.gz
-83dbee9d7291a0f322fd2b8936aeace7  boost-1.41.0-parameter-needs-python.patch
-7ea3caa231764eca4522ae303939214d  boost-uclibc-thread.patch
-1d43f6ee1fc426f1ddcb4aafc6b77b9b  random-Jamfile"
diff --git a/testing/boost/boost-1.41.0-parameter-needs-python.patch b/testing/boost/boost-1.41.0-parameter-needs-python.patch
deleted file mode 100644
index 016995fc..00000000
--- a/testing/boost/boost-1.41.0-parameter-needs-python.patch
+++ /dev/null
@@ -1,106 +0,0 @@
---- a/boost/parameter/aux_/maybe.hpp	2008-03-22 21:45:55.000000000 +0000
-+++ b/boost/parameter/aux_/maybe.hpp.new	2009-10-22 03:55:24.000000000 +0000
-@@ -2,20 +2,41 @@
- // subject to the Boost Software License, Version 1.0. (See accompanying
- // file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
- 
--#ifndef BOOST_PARAMETER_MAYBE_060211_HPP
--# define BOOST_PARAMETER_MAYBE_060211_HPP
-+//
-+// 2009.10.21 TDS remove depenency on boost::python::detail::referent_storage
-+//
-+#ifndef BOOST_PARAMETER_MAYBE_091021_HPP
-+# define BOOST_PARAMETER_MAYBE_091021_HPP
- 
- # include <boost/mpl/if.hpp>
- # include <boost/mpl/identity.hpp>
- # include <boost/type_traits/is_reference.hpp>
- # include <boost/type_traits/add_reference.hpp>
- # include <boost/optional.hpp>
--# include <boost/python/detail/referent_storage.hpp>
-+# include <boost/aligned_storage.hpp>
- # include <boost/type_traits/remove_cv.hpp>
- # include <boost/type_traits/add_const.hpp>
- 
- namespace boost { namespace parameter { namespace aux {
- 
-+template <class T> struct referent_size;
-+
-+template <class T>
-+struct referent_size<T&>
-+{
-+  BOOST_STATIC_CONSTANT(std::size_t, value = sizeof(T));
-+};
-+
-+// A metafunction returning a POD type which can store U, where T ==
-+// U&. If T is not a reference type, returns a POD which can store T.
-+template <class T>
-+struct referent_storage
-+{
-+  typedef typename boost::aligned_storage<
-+    referent_size<T>::value
-+    >::type type;
-+};
-+
- struct maybe_base {};
- 
- template <class T>
-@@ -33,8 +54,8 @@
-         BOOST_DEDUCED_TYPENAME remove_reference<reference>::type
-     >::type non_cv_value;
-         
--    explicit maybe(T value)
--      : value(value)
-+    explicit maybe(T value_)
-+      : value(value_)
-       , constructed(false)
-     {}
- 
-@@ -48,28 +69,28 @@
-             this->destroy();
-     }
- 
--    reference construct(reference value) const
-+    reference construct(reference value_) const
-     {
--        return value;
-+        return value_;
-     }
- 
-     template <class U>
--    reference construct2(U const& value) const
-+    reference construct2(U const& value_) const
-     {
--        new (m_storage.bytes) non_cv_value(value);
-+        new (m_storage.address()) non_cv_value(value_);
-         constructed = true;
--        return *(non_cv_value*)m_storage.bytes;
-+        return *(non_cv_value*)m_storage.address();
-     }
- 
-     template <class U>
--    reference construct(U const& value) const
-+    reference construct(U const& value_) const
-     {
--        return this->construct2(value);
-+        return this->construct2(value_);
-     }
- 
-     void destroy()
-     {
--        ((non_cv_value*)m_storage.bytes)->~non_cv_value();
-+        ((non_cv_value*)m_storage.address())->~non_cv_value();
-     }
- 
-     typedef reference(maybe<T>::*safe_bool)() const;
-@@ -87,7 +108,9 @@
- private:
-     boost::optional<T> value;
-     mutable bool constructed;
--    mutable typename boost::python::detail::referent_storage<
-+
-+
-+    mutable typename referent_storage<
-         reference
-     >::type m_storage;
- };
diff --git a/testing/boost/boost-uclibc-thread.patch b/testing/boost/boost-uclibc-thread.patch
deleted file mode 100644
index e9e6b79e..00000000
--- a/testing/boost/boost-uclibc-thread.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- ./libs/thread/src/pthread/thread.cpp.orig
-+++ ./libs/thread/src/pthread/thread.cpp
-@@ -380,7 +380,7 @@
-     {
- #if defined(PTW32_VERSION) || defined(__hpux)
-         return pthread_num_processors_np();
--#elif defined(_GNU_SOURCE)
-+#elif defined(_GNU_SOURCE) && !defined(__UCLIBC__)
-         return get_nprocs();
- #elif defined(__APPLE__) || defined(__FreeBSD__)
-         int count;
diff --git a/testing/boost/random-Jamfile b/testing/boost/random-Jamfile
deleted file mode 100644
index 5cb6f6bc..00000000
--- a/testing/boost/random-Jamfile
+++ /dev/null
@@ -1,15 +0,0 @@
-# Copyright (c) 2006 Tiziano Mueller
-#
-# Use, modification and distribution of the file is subject to the
-# Boost Software License, Version 1.0.
-# (See at http://www.boost.org/LICENSE_1_0.txt)
-
-
-project boost/random
-	: source-location ../ ;
-
-SOURCES = random_device ;
-
-lib boost_random
-	: $(SOURCES).cpp 
-	: <link>shared:<define>BOOST_RANDOM_DYN_LINK=1 ;
-- 
cgit v1.2.3


From 8ea4aca9ab4f6f1ccbd9ca47e141cf6d8d5b2c62 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 11:13:10 +0000
Subject: testing/iscsi-scst-grsec: build fix: we dont need openssl-dev

---
 testing/iscsi-scst-grsec/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/iscsi-scst-grsec/APKBUILD b/testing/iscsi-scst-grsec/APKBUILD
index 0fae6a74..c8c95c15 100644
--- a/testing/iscsi-scst-grsec/APKBUILD
+++ b/testing/iscsi-scst-grsec/APKBUILD
@@ -22,7 +22,7 @@ url="http://scst.sourceforge.net/"
 license="GPL-2"
 depends="linux-${_flavor}=${_kernelver}"
 install=
-makedepends="linux-${_flavor}-dev=${_kernelver} openssl-dev scst-grsec-dev"
+makedepends="linux-${_flavor}-dev=${_kernelver} scst-grsec-dev"
 subpackages=
 source="http://downloads.sourceforge.net/scst/$_realname-$_realver.tar.gz
         config.c.patch
-- 
cgit v1.2.3


From 644950cc659ff47d780ff29d66183876e83cda14 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 11:16:38 +0000
Subject: testing/wzftpd-svn: moved from testing/wzftpd

make dir name correspond to pkgname
---
 testing/wzdftpd-svn/APKBUILD          | 46 +++++++++++++++++++++++++++++++++++
 testing/wzdftpd-svn/wzdftpd-svn.initd | 32 ++++++++++++++++++++++++
 testing/wzdftpd/APKBUILD              | 46 -----------------------------------
 testing/wzdftpd/wzdftpd-svn.initd     | 32 ------------------------
 4 files changed, 78 insertions(+), 78 deletions(-)
 create mode 100644 testing/wzdftpd-svn/APKBUILD
 create mode 100644 testing/wzdftpd-svn/wzdftpd-svn.initd
 delete mode 100644 testing/wzdftpd/APKBUILD
 delete mode 100644 testing/wzdftpd/wzdftpd-svn.initd

diff --git a/testing/wzdftpd-svn/APKBUILD b/testing/wzdftpd-svn/APKBUILD
new file mode 100644
index 00000000..b9b46265
--- /dev/null
+++ b/testing/wzdftpd-svn/APKBUILD
@@ -0,0 +1,46 @@
+# This is an example APKBUILD file. Use this as a start to creating your own,
+# and remove these comments.
+# NOTE: Please fill out the license field for your package! If it is unknown,
+# then please put 'unknown'.
+
+# Contributor: Your Name <youremail@domain.com>
+pkgname=wzdftpd-svn
+pkgver=2040
+pkgrel=2
+pkgdesc="A portable, modular, small, and efficient FTP server"
+url="http://www.wzdftpd.net"
+license='GPL'
+depends=
+makedepends="cmake mysql-dev sqlite-dev tcl-dev openssl-dev flex"
+source="http://alpine.nethq.org/clandmeter/src/wzdftpd-svn2040.tar.gz
+wzdftpd-svn.initd"
+subpackages="$pkgname-doc"
+
+build() {
+        mkdir "$srcdir/${pkgname}"
+        mv "$srcdir/wzdftpd-src" "$srcdir/${pkgname}/"
+        cd "$srcdir/${pkgname}/"
+        cmake \
+        -D CMAKE_INSTALL_PREFIX:PATH=/usr \
+        -D WITH_DUPECHECK:BOOL=ON \
+        -D WITH_SFV:BOOL=ON \
+        -D BUILD_TESTING:BOOL=OFF \
+        -D WITH_Zeroconf:BOOL=ON \
+        -D TCL_LIBRARY:FILEPATH=/usr/lib/libtcl8.5.so \
+        -D WITH_PAM:BOOL=OFF \
+        -D WITH_PerlDev:BOOL=OFF \
+        -D CONF_INSTALL_PATH:PATH=/etc/wzdftpd \
+        ./wzdftpd-src || return 1
+        make || return 1
+        make DESTDIR="$pkgdir/" install
+        mv $pkgdir/usr/var $pkgdir/
+        sed -i -e 's|usr/var|var|' \
+        -e 's|usr/etc|etc|' \
+        -e 's|usr//etc|etc|' \
+	-e 's|#pid_file|pid_file|' \
+        $pkgdir/etc/wzdftpd/wzd.cfg.sample
+	install -Dm 755 "$startdir"/$pkgname.initd $pkgdir/etc/init.d/wzdftpd
+}
+
+md5sums="4bdb2fcaa4ca316261e9f77380818769  wzdftpd-svn2040.tar.gz
+ae2b7497cc7729bfaf346ba0d3b607d2  wzdftpd-svn.initd"
diff --git a/testing/wzdftpd-svn/wzdftpd-svn.initd b/testing/wzdftpd-svn/wzdftpd-svn.initd
new file mode 100644
index 00000000..25f4da6f
--- /dev/null
+++ b/testing/wzdftpd-svn/wzdftpd-svn.initd
@@ -0,0 +1,32 @@
+#!/sbin/runscript
+
+depend() {
+	need net
+	after firewall
+	use dns
+}
+
+checkconfig() {
+	if [ ! -f /etc/wzdftpd/wzd.cfg ] ; then
+		eerror "No /etc/wzdftpd/wzd.cnf file exists!"
+		return 1
+	fi
+	if [ ! -d /var/run/wzdftpd ] ; then
+		install -dD -o ftp -g ftp /var/run/wzdftpd
+	fi
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Starting wzdftpd"
+	/usr/sbin/wzdftpd >/dev/null 2>&1 &
+	eend $?
+}
+
+stop () {
+	ebegin "Stopping wzdftpd"
+	start-stop-daemon --stop --quiet \
+		--pidfile=/var/run/wzdftpd/wzdftpd.pid --retry 20
+	eend $?
+}
+
diff --git a/testing/wzdftpd/APKBUILD b/testing/wzdftpd/APKBUILD
deleted file mode 100644
index b9b46265..00000000
--- a/testing/wzdftpd/APKBUILD
+++ /dev/null
@@ -1,46 +0,0 @@
-# This is an example APKBUILD file. Use this as a start to creating your own,
-# and remove these comments.
-# NOTE: Please fill out the license field for your package! If it is unknown,
-# then please put 'unknown'.
-
-# Contributor: Your Name <youremail@domain.com>
-pkgname=wzdftpd-svn
-pkgver=2040
-pkgrel=2
-pkgdesc="A portable, modular, small, and efficient FTP server"
-url="http://www.wzdftpd.net"
-license='GPL'
-depends=
-makedepends="cmake mysql-dev sqlite-dev tcl-dev openssl-dev flex"
-source="http://alpine.nethq.org/clandmeter/src/wzdftpd-svn2040.tar.gz
-wzdftpd-svn.initd"
-subpackages="$pkgname-doc"
-
-build() {
-        mkdir "$srcdir/${pkgname}"
-        mv "$srcdir/wzdftpd-src" "$srcdir/${pkgname}/"
-        cd "$srcdir/${pkgname}/"
-        cmake \
-        -D CMAKE_INSTALL_PREFIX:PATH=/usr \
-        -D WITH_DUPECHECK:BOOL=ON \
-        -D WITH_SFV:BOOL=ON \
-        -D BUILD_TESTING:BOOL=OFF \
-        -D WITH_Zeroconf:BOOL=ON \
-        -D TCL_LIBRARY:FILEPATH=/usr/lib/libtcl8.5.so \
-        -D WITH_PAM:BOOL=OFF \
-        -D WITH_PerlDev:BOOL=OFF \
-        -D CONF_INSTALL_PATH:PATH=/etc/wzdftpd \
-        ./wzdftpd-src || return 1
-        make || return 1
-        make DESTDIR="$pkgdir/" install
-        mv $pkgdir/usr/var $pkgdir/
-        sed -i -e 's|usr/var|var|' \
-        -e 's|usr/etc|etc|' \
-        -e 's|usr//etc|etc|' \
-	-e 's|#pid_file|pid_file|' \
-        $pkgdir/etc/wzdftpd/wzd.cfg.sample
-	install -Dm 755 "$startdir"/$pkgname.initd $pkgdir/etc/init.d/wzdftpd
-}
-
-md5sums="4bdb2fcaa4ca316261e9f77380818769  wzdftpd-svn2040.tar.gz
-ae2b7497cc7729bfaf346ba0d3b607d2  wzdftpd-svn.initd"
diff --git a/testing/wzdftpd/wzdftpd-svn.initd b/testing/wzdftpd/wzdftpd-svn.initd
deleted file mode 100644
index 25f4da6f..00000000
--- a/testing/wzdftpd/wzdftpd-svn.initd
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/sbin/runscript
-
-depend() {
-	need net
-	after firewall
-	use dns
-}
-
-checkconfig() {
-	if [ ! -f /etc/wzdftpd/wzd.cfg ] ; then
-		eerror "No /etc/wzdftpd/wzd.cnf file exists!"
-		return 1
-	fi
-	if [ ! -d /var/run/wzdftpd ] ; then
-		install -dD -o ftp -g ftp /var/run/wzdftpd
-	fi
-}
-
-start() {
-	checkconfig || return 1
-	ebegin "Starting wzdftpd"
-	/usr/sbin/wzdftpd >/dev/null 2>&1 &
-	eend $?
-}
-
-stop () {
-	ebegin "Stopping wzdftpd"
-	start-stop-daemon --stop --quiet \
-		--pidfile=/var/run/wzdftpd/wzdftpd.pid --retry 20
-	eend $?
-}
-
-- 
cgit v1.2.3


From 9cd561572c99fe885ad7abed9a611db6be0044b6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 11:53:36 +0000
Subject: testing/madplay: removed

doesnt build. seems unmaintained
---
 testing/madplay/APKBUILD | 28 ----------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 testing/madplay/APKBUILD

diff --git a/testing/madplay/APKBUILD b/testing/madplay/APKBUILD
deleted file mode 100644
index daa36727..00000000
--- a/testing/madplay/APKBUILD
+++ /dev/null
@@ -1,28 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=madplay
-pkgver=0.15.2b
-pkgrel=1
-pkgdesc="The MAD audio player"
-url="http://www.underbit.com/products/mad/"
-license="GPL-2"
-depends=""
-makedepends="alsa-lib-dev libmad-dev libid3tag-dev"
-subpackages="$pkgname-doc"
-source="http://downloads.sourceforge.net/mad/madplay-$pkgver.tar.gz"
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr \
-		--mandir=/usr/share/man \
-		--disable-nls \
-		--with-alsa \
-		|| return 1
-	make
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install
-}
-
-md5sums="6814b47ceaa99880c754c5195aa1aac1  madplay-0.15.2b.tar.gz"
-- 
cgit v1.2.3


From 89e5a3bd0117976fd4b318dec13cb2b02c710f68 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 12:27:42 +0000
Subject: testing/sems: upgrade to 1.2.1

---
 testing/sems/0001-makefile-fail-on-errors.patch | 170 ------------------------
 testing/sems/0002-include-headers.patch         | 116 ----------------
 testing/sems/APKBUILD                           |  13 +-
 3 files changed, 5 insertions(+), 294 deletions(-)
 delete mode 100644 testing/sems/0001-makefile-fail-on-errors.patch
 delete mode 100644 testing/sems/0002-include-headers.patch

diff --git a/testing/sems/0001-makefile-fail-on-errors.patch b/testing/sems/0001-makefile-fail-on-errors.patch
deleted file mode 100644
index 9dcbb230..00000000
--- a/testing/sems/0001-makefile-fail-on-errors.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-From 7773c850b91d5c78679606065402caac29219dd8 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Fri, 18 Dec 2009 08:57:27 +0000
-Subject: [PATCH 1/2] makefile fail on errors
-
----
- Makefile                         |    8 ++++----
- apps/Makefile                    |   12 ++++++------
- core/Makefile                    |    2 +-
- core/plug-in/Makefile            |   14 +++++++-------
- core/plug-in/Makefile.app_module |    4 ++--
- 5 files changed, 20 insertions(+), 20 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 7dd01de..c210761 100644
---- a/Makefile
-+++ b/Makefile
-@@ -28,21 +28,21 @@ clean:
- 
- .PHONY: modules
- modules:
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo  "" ; \
- 			echo  "" ; \
--			$(MAKE) -C $$r all; \
-+			$(MAKE) -C $$r all || exit 1; \
- 		fi ; \
- 	done 
- 
- .PHONY: install
- install:
--	-@for r in $(imodules) "" ; do \
-+	@for r in $(imodules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo "" ; \
- 			echo "" ; \
--			$(MAKE) -C $$r install; \
-+			$(MAKE) -C $$r install || exit 1; \
- 		fi ; \
- 	done
- 	-@if [ -d ser-0.9.6-sems ]; then \
-diff --git a/apps/Makefile b/apps/Makefile
-index 23c6437..57df618 100644
---- a/apps/Makefile
-+++ b/apps/Makefile
-@@ -30,11 +30,11 @@ clean:
- 
- .PHONY: modules
- modules:
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo  "" ; \
- 			echo  "" ; \
--			COREPATH=../$(COREPATH) $(MAKE) -C $$r all; \
-+			COREPATH=../$(COREPATH) $(MAKE) -C $$r all || exit 1; \
- 		fi ; \
- 	done 
- 
-@@ -43,20 +43,20 @@ install: install-bin install-cfg
- 
- .PHONY: install-bin
- install-bin:
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo "" ; \
- 			echo "" ; \
--			COREPATH=../$(COREPATH) $(MAKE) -C $$r install; \
-+			COREPATH=../$(COREPATH) $(MAKE) -C $$r install || exit 1; \
- 		fi ; \
- 	done
- 
- .PHONY: install-cfg
- install-cfg: $(DESTDIR)$(cfg-target)
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo "" ; \
- 			echo "" ; \
--			COREPATH=../$(COREPATH) $(MAKE) -C $$r install-cfg; \
-+			COREPATH=../$(COREPATH) $(MAKE) -C $$r install-cfg || exit 1; \
- 		fi ; \
- 	done
-diff --git a/core/Makefile b/core/Makefile
-index e3734d5..e1fe274 100644
---- a/core/Makefile
-+++ b/core/Makefile
-@@ -11,7 +11,7 @@ AUDIO_FILES=$(notdir $(wildcard wav/*.wav))
- 
- .PHONY: all
- all: ../Makefile.defs
--	-@$(MAKE) deps    && \
-+	@$(MAKE) deps    && \
- 	  $(MAKE) $(NAME) && \
- 	  $(MAKE) modules
- 
-diff --git a/core/plug-in/Makefile b/core/plug-in/Makefile
-index e7d988c..cc38e2f 100644
---- a/core/plug-in/Makefile
-+++ b/core/plug-in/Makefile
-@@ -1,6 +1,6 @@
- include ../../Makefile.defs
- 
--exclude_modules ?= g722
-+exclude_modules ?= g722 speex
- #echo
- 
- modules = $(filter-out $(subst ;, ,$(exclude_modules)) \
-@@ -25,30 +25,30 @@ clean:
- 
- .PHONY: modules
- modules:
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo  "" ; \
- 			echo  "" ; \
--			$(MAKE) -C $$r all; \
-+			$(MAKE) -C $$r all || exit 1; \
- 		fi ; \
- 	done 
- 
- .PHONY: install
- install:
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo "" ; \
- 			echo "" ; \
--			$(MAKE) -C $$r install; \
-+			$(MAKE) -C $$r install || exit 1; \
- 		fi ; \
- 	done
- 
- .PHONY: install-cfg
- install-cfg: $(DESTDIR)$(cfg-target)
--	-@for r in $(modules) "" ; do \
-+	@for r in $(modules) "" ; do \
- 		if [ -n "$$r" ]; then \
- 			echo "" ; \
- 			echo "" ; \
--			COREPATH=../$(COREPATH) $(MAKE) -C $$r install-cfg; \
-+			COREPATH=../$(COREPATH) $(MAKE) -C $$r install-cfg || exit 1; \
- 		fi ; \
- 	done
-diff --git a/core/plug-in/Makefile.app_module b/core/plug-in/Makefile.app_module
-index 8b7acaa..a6e1ef2 100644
---- a/core/plug-in/Makefile.app_module
-+++ b/core/plug-in/Makefile.app_module
-@@ -27,12 +27,12 @@ depends  = $(srcs:.cpp=.d)
- 
- .PHONY: all
- all: $(extra_target)
--	-@$(MAKE) deps    && \
-+	@$(MAKE) deps    && \
- 	  $(MAKE) $(lib_full_name)
- 
- .PHONY: module_package
- module_package: $(extra_target)
--	-@$(MAKE) deps    && \
-+	@$(MAKE) deps    && \
- 	  $(MAKE) $(lib_name)
- 
- 
--- 
-1.6.5.6
-
diff --git a/testing/sems/0002-include-headers.patch b/testing/sems/0002-include-headers.patch
deleted file mode 100644
index 5e9a2477..00000000
--- a/testing/sems/0002-include-headers.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 43faa45d0455c5bb53a0f992ffc7bdf92c94c945 Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Fri, 18 Dec 2009 08:58:18 +0000
-Subject: [PATCH 2/2] include headers
-
----
- apps/annrecorder/AnnRecorder.cpp          |    2 ++
- apps/callback/CallBack.cpp                |    1 +
- apps/diameter_client/ServerConnection.cpp |    1 +
- apps/diameter_client/ServerConnection.h   |    1 +
- core/AmMediaProcessor.cpp                 |    1 +
- core/AmRtpReceiver.cpp                    |    1 +
- core/plug-in/sipctrl/udp_trsp.cpp         |    1 +
- core/plug-in/stats/query_stats.cxx        |    1 +
- 8 files changed, 9 insertions(+), 0 deletions(-)
-
-diff --git a/apps/annrecorder/AnnRecorder.cpp b/apps/annrecorder/AnnRecorder.cpp
-index b32cd58..7ba9639 100644
---- a/apps/annrecorder/AnnRecorder.cpp
-+++ b/apps/annrecorder/AnnRecorder.cpp
-@@ -25,6 +25,8 @@
-  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-  */
- 
-+#include <unistd.h>
-+
- #include "AnnRecorder.h"
- #include "AmConfig.h"
- #include "AmUtils.h"
-diff --git a/apps/callback/CallBack.cpp b/apps/callback/CallBack.cpp
-index 360e698..6019705 100644
---- a/apps/callback/CallBack.cpp
-+++ b/apps/callback/CallBack.cpp
-@@ -32,6 +32,7 @@
- #include "AmPlugIn.h"
- 
- #include <stdlib.h>
-+#include <unistd.h>
- 
- EXPORT_SESSION_FACTORY(CallBackFactory,MOD_NAME);
- string CallBackFactory::gw_user;
-diff --git a/apps/diameter_client/ServerConnection.cpp b/apps/diameter_client/ServerConnection.cpp
-index 4157304..3e2a14f 100644
---- a/apps/diameter_client/ServerConnection.cpp
-+++ b/apps/diameter_client/ServerConnection.cpp
-@@ -30,6 +30,7 @@
- #include "ampi/DiameterClientAPI.h"
- #include "diameter_client.h"
- 
-+#include <unistd.h>
- #include <stdlib.h>
- #include <string.h>
- #include "log.h"
-diff --git a/apps/diameter_client/ServerConnection.h b/apps/diameter_client/ServerConnection.h
-index d797d15..0af146a 100644
---- a/apps/diameter_client/ServerConnection.h
-+++ b/apps/diameter_client/ServerConnection.h
-@@ -38,6 +38,7 @@
- #include <vector>
- #include <map>
- #include <utility>
-+#include <stdint.h>
- using std::string;
- using std::vector;
- using std::map;
-diff --git a/core/AmMediaProcessor.cpp b/core/AmMediaProcessor.cpp
-index 9650c91..0da86b0 100644
---- a/core/AmMediaProcessor.cpp
-+++ b/core/AmMediaProcessor.cpp
-@@ -29,6 +29,7 @@
- #include "AmSession.h"
- #include "AmRtpStream.h"
- 
-+#include <unistd.h>
- #include <assert.h>
- #include <sys/time.h>
- #include <signal.h>
-diff --git a/core/AmRtpReceiver.cpp b/core/AmRtpReceiver.cpp
-index 5216b15..7f7fb4a 100644
---- a/core/AmRtpReceiver.cpp
-+++ b/core/AmRtpReceiver.cpp
-@@ -37,6 +37,7 @@
- #include <strings.h>
- #endif
- 
-+#include <unistd.h>
- #include <sys/time.h>
- #include <sys/poll.h>
- 
-diff --git a/core/plug-in/sipctrl/udp_trsp.cpp b/core/plug-in/sipctrl/udp_trsp.cpp
-index 49a8358..74f00ae 100644
---- a/core/plug-in/sipctrl/udp_trsp.cpp
-+++ b/core/plug-in/sipctrl/udp_trsp.cpp
-@@ -36,6 +36,7 @@
- #include <sys/param.h>
- #include <arpa/inet.h>
- 
-+#include <unistd.h>
- #include <errno.h>
- #include <string.h>
- 
-diff --git a/core/plug-in/stats/query_stats.cxx b/core/plug-in/stats/query_stats.cxx
-index 674f16c..10c498a 100644
---- a/core/plug-in/stats/query_stats.cxx
-+++ b/core/plug-in/stats/query_stats.cxx
-@@ -7,6 +7,7 @@
- #include <netinet/in.h>
- #include <arpa/inet.h>
- #include <stdlib.h>
-+#include <unistd.h>
- 
- #include <map>
- #include <string>
--- 
-1.6.5.6
-
diff --git a/testing/sems/APKBUILD b/testing/sems/APKBUILD
index 97af0045..2f1e6ee0 100644
--- a/testing/sems/APKBUILD
+++ b/testing/sems/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Francesco Colista <francesco.colista@gmail.com>
 # Maintainer: Francesco Colista <francesco.colista@gmail.com>
 pkgname=sems
-pkgver=1.1.1
-pkgrel=2
+pkgver=1.2.1
+pkgrel=0
 pkgdesc="High performance, extensible media server for SIP (RFC3261) based VoIP  services"
 url="http://iptel.org/sems/"
 license="GPL-2"
@@ -10,9 +10,7 @@ depends="kamailio"
 makedepends="python-dev openssl-dev lame-dev"
 install=
 subpackages=
-source="http://ftp.iptel.org/pub/$pkgname/1.1/$pkgver/src/$pkgname-$pkgver.tar.gz
-	0001-makefile-fail-on-errors.patch
-	0002-include-headers.patch
+source="http://ftp.iptel.org/pub/sems/sems-$pkgver.tar.gz
 	0003-cc-and-cflags.patch
 	"
 
@@ -20,6 +18,7 @@ prepare() {
 	cd "$srcdir"/$pkgname-$pkgver
 	for i in "$srcdir"/*.patch; do
 		[ -f "$i" ] || continue
+		msg "Applying $i"
 		patch -p1 -i $i || return 1
 	done
 
@@ -55,7 +54,5 @@ package() {
 #	 install -m644 -D "$srcdir"//$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
 }
 
-md5sums="4a6422d09ddadaf9eacd8cae8f0848d5  sems-1.1.1.tar.gz
-f893ceef9295b593d2b1837a538b315a  0001-makefile-fail-on-errors.patch
-3d217a6d217fa8704d108f23815d4b97  0002-include-headers.patch
+md5sums="f0545c0708849e1a723d453244c2a79e  sems-1.2.1.tar.gz
 0054e6ed7e11393e71204876179d3199  0003-cc-and-cflags.patch"
-- 
cgit v1.2.3


From 6833f57b55e763d2e3fdac70daf15d73091e97f3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 12:39:02 +0000
Subject: unstable/wzdftpd-svn: moved from testing

doesnt build
---
 testing/wzdftpd-svn/APKBUILD           | 46 ----------------------------------
 testing/wzdftpd-svn/wzdftpd-svn.initd  | 32 -----------------------
 unstable/wzdftpd-svn/APKBUILD          | 46 ++++++++++++++++++++++++++++++++++
 unstable/wzdftpd-svn/wzdftpd-svn.initd | 32 +++++++++++++++++++++++
 4 files changed, 78 insertions(+), 78 deletions(-)
 delete mode 100644 testing/wzdftpd-svn/APKBUILD
 delete mode 100644 testing/wzdftpd-svn/wzdftpd-svn.initd
 create mode 100644 unstable/wzdftpd-svn/APKBUILD
 create mode 100644 unstable/wzdftpd-svn/wzdftpd-svn.initd

diff --git a/testing/wzdftpd-svn/APKBUILD b/testing/wzdftpd-svn/APKBUILD
deleted file mode 100644
index b9b46265..00000000
--- a/testing/wzdftpd-svn/APKBUILD
+++ /dev/null
@@ -1,46 +0,0 @@
-# This is an example APKBUILD file. Use this as a start to creating your own,
-# and remove these comments.
-# NOTE: Please fill out the license field for your package! If it is unknown,
-# then please put 'unknown'.
-
-# Contributor: Your Name <youremail@domain.com>
-pkgname=wzdftpd-svn
-pkgver=2040
-pkgrel=2
-pkgdesc="A portable, modular, small, and efficient FTP server"
-url="http://www.wzdftpd.net"
-license='GPL'
-depends=
-makedepends="cmake mysql-dev sqlite-dev tcl-dev openssl-dev flex"
-source="http://alpine.nethq.org/clandmeter/src/wzdftpd-svn2040.tar.gz
-wzdftpd-svn.initd"
-subpackages="$pkgname-doc"
-
-build() {
-        mkdir "$srcdir/${pkgname}"
-        mv "$srcdir/wzdftpd-src" "$srcdir/${pkgname}/"
-        cd "$srcdir/${pkgname}/"
-        cmake \
-        -D CMAKE_INSTALL_PREFIX:PATH=/usr \
-        -D WITH_DUPECHECK:BOOL=ON \
-        -D WITH_SFV:BOOL=ON \
-        -D BUILD_TESTING:BOOL=OFF \
-        -D WITH_Zeroconf:BOOL=ON \
-        -D TCL_LIBRARY:FILEPATH=/usr/lib/libtcl8.5.so \
-        -D WITH_PAM:BOOL=OFF \
-        -D WITH_PerlDev:BOOL=OFF \
-        -D CONF_INSTALL_PATH:PATH=/etc/wzdftpd \
-        ./wzdftpd-src || return 1
-        make || return 1
-        make DESTDIR="$pkgdir/" install
-        mv $pkgdir/usr/var $pkgdir/
-        sed -i -e 's|usr/var|var|' \
-        -e 's|usr/etc|etc|' \
-        -e 's|usr//etc|etc|' \
-	-e 's|#pid_file|pid_file|' \
-        $pkgdir/etc/wzdftpd/wzd.cfg.sample
-	install -Dm 755 "$startdir"/$pkgname.initd $pkgdir/etc/init.d/wzdftpd
-}
-
-md5sums="4bdb2fcaa4ca316261e9f77380818769  wzdftpd-svn2040.tar.gz
-ae2b7497cc7729bfaf346ba0d3b607d2  wzdftpd-svn.initd"
diff --git a/testing/wzdftpd-svn/wzdftpd-svn.initd b/testing/wzdftpd-svn/wzdftpd-svn.initd
deleted file mode 100644
index 25f4da6f..00000000
--- a/testing/wzdftpd-svn/wzdftpd-svn.initd
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/sbin/runscript
-
-depend() {
-	need net
-	after firewall
-	use dns
-}
-
-checkconfig() {
-	if [ ! -f /etc/wzdftpd/wzd.cfg ] ; then
-		eerror "No /etc/wzdftpd/wzd.cnf file exists!"
-		return 1
-	fi
-	if [ ! -d /var/run/wzdftpd ] ; then
-		install -dD -o ftp -g ftp /var/run/wzdftpd
-	fi
-}
-
-start() {
-	checkconfig || return 1
-	ebegin "Starting wzdftpd"
-	/usr/sbin/wzdftpd >/dev/null 2>&1 &
-	eend $?
-}
-
-stop () {
-	ebegin "Stopping wzdftpd"
-	start-stop-daemon --stop --quiet \
-		--pidfile=/var/run/wzdftpd/wzdftpd.pid --retry 20
-	eend $?
-}
-
diff --git a/unstable/wzdftpd-svn/APKBUILD b/unstable/wzdftpd-svn/APKBUILD
new file mode 100644
index 00000000..b9b46265
--- /dev/null
+++ b/unstable/wzdftpd-svn/APKBUILD
@@ -0,0 +1,46 @@
+# This is an example APKBUILD file. Use this as a start to creating your own,
+# and remove these comments.
+# NOTE: Please fill out the license field for your package! If it is unknown,
+# then please put 'unknown'.
+
+# Contributor: Your Name <youremail@domain.com>
+pkgname=wzdftpd-svn
+pkgver=2040
+pkgrel=2
+pkgdesc="A portable, modular, small, and efficient FTP server"
+url="http://www.wzdftpd.net"
+license='GPL'
+depends=
+makedepends="cmake mysql-dev sqlite-dev tcl-dev openssl-dev flex"
+source="http://alpine.nethq.org/clandmeter/src/wzdftpd-svn2040.tar.gz
+wzdftpd-svn.initd"
+subpackages="$pkgname-doc"
+
+build() {
+        mkdir "$srcdir/${pkgname}"
+        mv "$srcdir/wzdftpd-src" "$srcdir/${pkgname}/"
+        cd "$srcdir/${pkgname}/"
+        cmake \
+        -D CMAKE_INSTALL_PREFIX:PATH=/usr \
+        -D WITH_DUPECHECK:BOOL=ON \
+        -D WITH_SFV:BOOL=ON \
+        -D BUILD_TESTING:BOOL=OFF \
+        -D WITH_Zeroconf:BOOL=ON \
+        -D TCL_LIBRARY:FILEPATH=/usr/lib/libtcl8.5.so \
+        -D WITH_PAM:BOOL=OFF \
+        -D WITH_PerlDev:BOOL=OFF \
+        -D CONF_INSTALL_PATH:PATH=/etc/wzdftpd \
+        ./wzdftpd-src || return 1
+        make || return 1
+        make DESTDIR="$pkgdir/" install
+        mv $pkgdir/usr/var $pkgdir/
+        sed -i -e 's|usr/var|var|' \
+        -e 's|usr/etc|etc|' \
+        -e 's|usr//etc|etc|' \
+	-e 's|#pid_file|pid_file|' \
+        $pkgdir/etc/wzdftpd/wzd.cfg.sample
+	install -Dm 755 "$startdir"/$pkgname.initd $pkgdir/etc/init.d/wzdftpd
+}
+
+md5sums="4bdb2fcaa4ca316261e9f77380818769  wzdftpd-svn2040.tar.gz
+ae2b7497cc7729bfaf346ba0d3b607d2  wzdftpd-svn.initd"
diff --git a/unstable/wzdftpd-svn/wzdftpd-svn.initd b/unstable/wzdftpd-svn/wzdftpd-svn.initd
new file mode 100644
index 00000000..25f4da6f
--- /dev/null
+++ b/unstable/wzdftpd-svn/wzdftpd-svn.initd
@@ -0,0 +1,32 @@
+#!/sbin/runscript
+
+depend() {
+	need net
+	after firewall
+	use dns
+}
+
+checkconfig() {
+	if [ ! -f /etc/wzdftpd/wzd.cfg ] ; then
+		eerror "No /etc/wzdftpd/wzd.cnf file exists!"
+		return 1
+	fi
+	if [ ! -d /var/run/wzdftpd ] ; then
+		install -dD -o ftp -g ftp /var/run/wzdftpd
+	fi
+}
+
+start() {
+	checkconfig || return 1
+	ebegin "Starting wzdftpd"
+	/usr/sbin/wzdftpd >/dev/null 2>&1 &
+	eend $?
+}
+
+stop () {
+	ebegin "Stopping wzdftpd"
+	start-stop-daemon --stop --quiet \
+		--pidfile=/var/run/wzdftpd/wzdftpd.pid --retry 20
+	eend $?
+}
+
-- 
cgit v1.2.3


From 1f8dfc6d8f08087eab8a659c781193fab87c0168 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 19:14:17 +0000
Subject: testing/xf86-video-openchrome-svn: removed

---
 testing/xf86-video-openchrome-svn/APKBUILD | 33 ------------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 testing/xf86-video-openchrome-svn/APKBUILD

diff --git a/testing/xf86-video-openchrome-svn/APKBUILD b/testing/xf86-video-openchrome-svn/APKBUILD
deleted file mode 100644
index 692af749..00000000
--- a/testing/xf86-video-openchrome-svn/APKBUILD
+++ /dev/null
@@ -1,33 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=xf86-video-openchrome-svn
-pkgver=811
-pkgrel=0
-pkgdesc="X.Org driver for VIA/S3G cards"
-url="http://xorg.freedesktop.org/"
-license="custom"
-subpackages="$pkgname-dev $pkgname-doc"
-depends=
-makedepends="pkgconfig xorg-server-dev libxi-dev libxvmc-dev fontsproto glproto
-	randrproto videoproto renderproto xf86driproto mesa-dev subversion
-	automake autoconf libtool"
-
-source=
-
-build ()
-{
-	cd "$srcdir"
-	if [ -d openchrome ]; then
-		cd openchrome
-		svn up
-	else
-		svn co -r $pkgver http://svn.openchrome.org/svn/trunk openchrome 
-		cd openchrome
-	fi
-	export GCC_SPECS=/usr/share/gcc/hardenednoznow.specs
-
-	./autogen.sh 
-	./configure --prefix=/usr || return 1
-	make || return 1
-	make DESTDIR="$pkgdir" install || return 1
-	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
-}
-- 
cgit v1.2.3


From d0d660406974bff332106249841396338b831527 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 16 May 2010 19:15:20 +0000
Subject: testing/[various]: rebuild against openssl-1.0.0

---
 testing/bacula-client/APKBUILD | 2 +-
 testing/bacula/APKBUILD        | 2 +-
 testing/cherokee/APKBUILD      | 2 +-
 testing/coova-chilli/APKBUILD  | 2 +-
 testing/freeradius/APKBUILD    | 2 +-
 testing/iscsi-scst/APKBUILD    | 2 +-
 testing/lua-crypto/APKBUILD    | 2 +-
 testing/lua-nixio/APKBUILD     | 2 +-
 testing/prosody/APKBUILD       | 2 +-
 testing/psqlodbc/APKBUILD      | 2 +-
 testing/ulogd/APKBUILD         | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/testing/bacula-client/APKBUILD b/testing/bacula-client/APKBUILD
index d9876919..b3921077 100644
--- a/testing/bacula-client/APKBUILD
+++ b/testing/bacula-client/APKBUILD
@@ -3,7 +3,7 @@
 pkgname="bacula-client"
 _realname="bacula"
 pkgver=5.0.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Client (File Daemon) of Bacula, a network based backup program"
 url="http://www.bacula.org"
 license="GPL2"
diff --git a/testing/bacula/APKBUILD b/testing/bacula/APKBUILD
index c7603387..ff4161ea 100644
--- a/testing/bacula/APKBUILD
+++ b/testing/bacula/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Leonardo Arena <rnalrd@gmail.com>
 pkgname="bacula"
 pkgver=5.0.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Enterprise ready, network based backup program"
 url="http://www.bacula.org"
 license="GPL2"
diff --git a/testing/cherokee/APKBUILD b/testing/cherokee/APKBUILD
index e122b570..7705d87c 100644
--- a/testing/cherokee/APKBUILD
+++ b/testing/cherokee/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mika Havela <mika.havela@gmail.com>
 pkgname=cherokee
 pkgver=0.99.41
-pkgrel=1
+pkgrel=2
 pkgdesc="A very fast, flexible and easy to configure Web Server"
 url="http://www.cherokee-project.com/"
 license="GPL2"
diff --git a/testing/coova-chilli/APKBUILD b/testing/coova-chilli/APKBUILD
index 256475ba..b9b12289 100644
--- a/testing/coova-chilli/APKBUILD
+++ b/testing/coova-chilli/APKBUILD
@@ -5,7 +5,7 @@
 
 pkgname=coova-chilli
 pkgver=1.0.14
-pkgrel=0
+pkgrel=1
 pkgdesc="CoovaChilli is an open source access controller for wireless LAN"
 url="http://www.coova.org/"
 license="GPL"
diff --git a/testing/freeradius/APKBUILD b/testing/freeradius/APKBUILD
index 51633591..addf0268 100644
--- a/testing/freeradius/APKBUILD
+++ b/testing/freeradius/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=freeradius
 pkgver=2.1.7
-pkgrel=0
+pkgrel=1
 pkgdesc="RADIUS (Remote Authentication Dial-In User Service) server"
 url="http://freeradius.org/"
 license="GPL"
diff --git a/testing/iscsi-scst/APKBUILD b/testing/iscsi-scst/APKBUILD
index dee7d15e..1624175d 100644
--- a/testing/iscsi-scst/APKBUILD
+++ b/testing/iscsi-scst/APKBUILD
@@ -3,7 +3,7 @@
 
 pkgname=iscsi-scst
 pkgver=1.0.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="ISCSI target for SCST - userspace tools"
 url="http://iscsi-scst.sourceforge.net/"
 license="GPL-2"
diff --git a/testing/lua-crypto/APKBUILD b/testing/lua-crypto/APKBUILD
index 34bbfb18..027affb3 100644
--- a/testing/lua-crypto/APKBUILD
+++ b/testing/lua-crypto/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=lua-crypto
 pkgver=0.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="a Lua frontend to the OpenSSL cryptographic library"
 url="http://luacrypto.luaforge.net/"
 license="MIT/X11"
diff --git a/testing/lua-nixio/APKBUILD b/testing/lua-nixio/APKBUILD
index 9b7ad2bb..9a900dfb 100644
--- a/testing/lua-nixio/APKBUILD
+++ b/testing/lua-nixio/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=lua-nixio
 _name=nixio
 pkgver=0.3
-pkgrel=1
+pkgrel=2
 pkgdesc="General POSIX IO library for Lua"
 url="http://dev.luci.freifunk-halle.net/nixio/doc/"
 license="Apache"
diff --git a/testing/prosody/APKBUILD b/testing/prosody/APKBUILD
index 8d7c6912..05996f9a 100644
--- a/testing/prosody/APKBUILD
+++ b/testing/prosody/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Mika Havela <mika.havela@gmail.com>
 pkgname=prosody
 pkgver=0.4.2
-pkgrel=3
+pkgrel=4
 pkgdesc="Lua based Jabber/XMPP server"
 url="http://prosody.im/"
 license="MIT"
diff --git a/testing/psqlodbc/APKBUILD b/testing/psqlodbc/APKBUILD
index 69c5122c..a14579a2 100644
--- a/testing/psqlodbc/APKBUILD
+++ b/testing/psqlodbc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=psqlodbc
 pkgver=08.04.0200
-pkgrel=1
+pkgrel=2
 pkgdesc="PostgreSQL ODBC driver"
 url="http://www.postgresql.org"
 license="GPL"
diff --git a/testing/ulogd/APKBUILD b/testing/ulogd/APKBUILD
index 6dad6b8d..3b856804 100644
--- a/testing/ulogd/APKBUILD
+++ b/testing/ulogd/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=ulogd
 pkgver=2.0.0_beta3
 _pkgver=2.0.0beta3
-pkgrel=1
+pkgrel=2
 pkgdesc="A userspace logging daemon for netfilter/iptables related logging"
 url="http://netfilter.org/projects/ulogd/index.html"
 license="GPL"
-- 
cgit v1.2.3


From 03b9aad26a9203a457bb5ca635b5aa0c9544be6c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 11:52:00 +0000
Subject: main/gstreamer: upgrade to 0.10.29

---
 main/gstreamer/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gstreamer/APKBUILD b/main/gstreamer/APKBUILD
index 2259c6ff..ffcd46b7 100644
--- a/main/gstreamer/APKBUILD
+++ b/main/gstreamer/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gstreamer
-pkgver=0.10.25
-pkgrel=1
+pkgver=0.10.29
+pkgrel=0
 pkgdesc="GStreamer Multimedia Framework"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
@@ -26,4 +26,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 	cd "$pkgdir"/usr/bin
 }
-md5sums="88544e034a051baf472983791d233076  gstreamer-0.10.25.tar.bz2"
+md5sums="c92d6bce4fc65fa9d5a3ad35cdd1a466  gstreamer-0.10.29.tar.bz2"
-- 
cgit v1.2.3


From c99eaeb4ff7ed78bc83ec929c6f4a823dfc1abae Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 11:54:41 +0000
Subject: main/gst-plugins-base: upgrade to 0.10.29

---
 main/gst-plugins-base/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gst-plugins-base/APKBUILD b/main/gst-plugins-base/APKBUILD
index f5b6b13b..423f5873 100644
--- a/main/gst-plugins-base/APKBUILD
+++ b/main/gst-plugins-base/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-base
-pkgver=0.10.25
-pkgrel=3
+pkgver=0.10.29
+pkgrel=0
 pkgdesc="GStreamer Multimedia Framework Base Plugins"
 url="http://gstreamer.freedesktop.org/"
 license="GPL LGPL"
@@ -34,4 +34,4 @@ package() {
 	make -j1 DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="d29669dd79276c5cd94e1613c03cd9ab  gst-plugins-base-0.10.25.tar.bz2"
+md5sums="d07e251152cccbaa81807c14cf0fd8c0  gst-plugins-base-0.10.29.tar.bz2"
-- 
cgit v1.2.3


From d54ca54b4c4b44ec370e0c44035de3ee10d8ec0b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 11:56:31 +0000
Subject: main/gst-plugins-good: upgrade to 0.10.22

---
 main/gst-plugins-good/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gst-plugins-good/APKBUILD b/main/gst-plugins-good/APKBUILD
index eee04aaf..8abe0593 100644
--- a/main/gst-plugins-good/APKBUILD
+++ b/main/gst-plugins-good/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-good
-pkgver=0.10.17
-pkgrel=3
+pkgver=0.10.22
+pkgrel=0
 pkgdesc="GStreamer Multimedia Framework Good Plugins"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
@@ -41,4 +41,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="833546cd2b8bbf86b8ed083b00897918  gst-plugins-good-0.10.17.tar.bz2"
+md5sums="4804aaa32044af9846914304991cc9d6  gst-plugins-good-0.10.22.tar.bz2"
-- 
cgit v1.2.3


From bd77004aeecaa4b160c72bc84b306f4bb94abd3f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 11:58:03 +0000
Subject: main/gst-plugins-ugly: upgrade to 0.10.14

---
 main/gst-plugins-ugly/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gst-plugins-ugly/APKBUILD b/main/gst-plugins-ugly/APKBUILD
index ebfec2d6..f5c7fdac 100644
--- a/main/gst-plugins-ugly/APKBUILD
+++ b/main/gst-plugins-ugly/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-ugly
-pkgver=0.10.13
-pkgrel=1
+pkgver=0.10.14
+pkgrel=0
 pkgdesc="GStreamer Multimedia Framework Ugly Plugins (gst-plugins-ugly)"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
@@ -26,4 +26,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="1619365247ef9cd7da1cd890285bf87a  gst-plugins-ugly-0.10.13.tar.bz2"
+md5sums="0bc0d27bcce88c73ef6c81e88624e686  gst-plugins-ugly-0.10.14.tar.bz2"
-- 
cgit v1.2.3


From c294ece833c3353739597e18239ac1132a2657e5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:07:27 +0000
Subject: main/gst-plugins-bad: upgrade to 0.10.18

---
 main/gst-plugins-bad/APKBUILD | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/main/gst-plugins-bad/APKBUILD b/main/gst-plugins-bad/APKBUILD
index b5b522d0..4821c459 100644
--- a/main/gst-plugins-bad/APKBUILD
+++ b/main/gst-plugins-bad/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-bad
-pkgver=0.10.14
-pkgrel=1
+pkgver=0.10.18
+pkgrel=0
 pkgdesc="GStreamer bad plugins"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL GPL"
@@ -13,9 +13,8 @@ makedepends="pkgconfig gst-plugins-base-dev gstreamer-dev xvidcore-dev
 #'libdca>=0.0.5' 'bzip2' 'libdc1394>=2.1.0' 'exempi>=2.1.0' 'jack-audio-connection-kit>=0.116.2' 'neon>=0.28.4' 'faac>=1.28' 'libexif>=0.6.17' 'musicbrainz>=2.1.5' 'faad2>=2.7' 'libmms>=0.4' 'libcdaudio>=0.99.12' 'libmpcdec>=1.2.6' 'mjpegtools>=1.9.0' 'libdvdnav>=4.1.3' 'libmodplug>=0.8.7' 'jasper>=1.900.1' 'liblrdf>=0.4.0' 'libofa>=0.9.3')
 source="http://gstreamer.freedesktop.org//src/gst-plugins-bad/gst-plugins-bad-$pkgver.tar.bz2"
 
-build () 
-{ 
-	cd ""$srcdir"/gst-plugins-bad-$pkgver"
+build() { 
+	cd "$srcdir"/gst-plugins-bad-$pkgver
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--localstatedir=/var \
@@ -25,7 +24,11 @@ build ()
 		--with-package-origin="http://www.alpinelinux.org/" \
 		|| return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/gst-plugins-bad-$pkgver
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="6be38b04fc76cdfef3a3b02b8434efa2  gst-plugins-bad-0.10.14.tar.bz2"
+md5sums="84838893b447e774d401a698ff812b32  gst-plugins-bad-0.10.18.tar.bz2"
-- 
cgit v1.2.3


From 8887fa124ce1cc546e1ea5b175421af6631fbfb8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:10:45 +0000
Subject: main/xfprint: rebuild against openssl-1.0.0

---
 main/xfprint/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/xfprint/APKBUILD b/main/xfprint/APKBUILD
index 80c06f5b..daa69536 100644
--- a/main/xfprint/APKBUILD
+++ b/main/xfprint/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfprint
 pkgver=4.6.1
-pkgrel=2
+pkgrel=3
 pkgdesc="A print dialog and a printer manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
-- 
cgit v1.2.3


From 2cff4fe2b09ec9b97f8a711e10b2fee1f259a152 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:12:04 +0000
Subject: main/apk-tools: retry rebuild against openssl-1.0

last did not work
---
 main/apk-tools/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index b90107a2..87d4d699 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=3
+pkgrel=4
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
-- 
cgit v1.2.3


From eb00cdfa624cc5cc1e301f9720b228a5c9267192 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:21:48 +0000
Subject: testing/collectd: rebuild against openssl-1.0

---
 testing/collectd/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/collectd/APKBUILD b/testing/collectd/APKBUILD
index 39e6a7db..2905922a 100644
--- a/testing/collectd/APKBUILD
+++ b/testing/collectd/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: 
 pkgname=collectd
 pkgver=4.9.1
-pkgrel=1
+pkgrel=2
 pkgdesc="The system statistics collection daemon"
 url="http://collectd.org"
 license="GPL"
 depends=
 makedepends="pkgconfig curl-dev net-snmp-dev postgresql-dev perl-dev
-	libgcrypt-dev mysql-dev zlib-dev"
+	libgcrypt-dev mysql-dev zlib-dev openssl-dev"
 install=
 subpackages="$pkgname-dev $pkgname-doc $pkgname-perl $pkgname-snmp $pkgname-curl
 	$pkgname-write_http $pkgname-nginx $pkgname-apache $pkgname-postgresql
-- 
cgit v1.2.3


From 10f32a3ac161e2c382bdbfffa7845720d3054d8b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:22:32 +0000
Subject: testing/freeradius: retry rebuild against openssl-1.0

---
 testing/freeradius/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/freeradius/APKBUILD b/testing/freeradius/APKBUILD
index addf0268..8d5caa8b 100644
--- a/testing/freeradius/APKBUILD
+++ b/testing/freeradius/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: 
 pkgname=freeradius
 pkgver=2.1.7
-pkgrel=1
+pkgrel=2
 pkgdesc="RADIUS (Remote Authentication Dial-In User Service) server"
 url="http://freeradius.org/"
 license="GPL"
-- 
cgit v1.2.3


From 78b90fc2e5ce19d43eb6fdb437537b98d2de457b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:23:28 +0000
Subject: testing/coova-chilli: retry rebuild against openssl-1.0

---
 testing/coova-chilli/APKBUILD | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/testing/coova-chilli/APKBUILD b/testing/coova-chilli/APKBUILD
index b9b12289..ab84e373 100644
--- a/testing/coova-chilli/APKBUILD
+++ b/testing/coova-chilli/APKBUILD
@@ -5,7 +5,7 @@
 
 pkgname=coova-chilli
 pkgver=1.0.14
-pkgrel=1
+pkgrel=2
 pkgdesc="CoovaChilli is an open source access controller for wireless LAN"
 url="http://www.coova.org/"
 license="GPL"
@@ -31,6 +31,10 @@ build() {
 		--sysconfdir=/etc \
 		--with-openssl
 	make -j1  || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 }
 
-- 
cgit v1.2.3


From ac6a449cf71a3e835cec34c20a78b253fc83e3f6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 12:25:14 +0000
Subject: testing/ulogd: add package function

---
 testing/ulogd/APKBUILD | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/testing/ulogd/APKBUILD b/testing/ulogd/APKBUILD
index 3b856804..52ba2dd0 100644
--- a/testing/ulogd/APKBUILD
+++ b/testing/ulogd/APKBUILD
@@ -21,6 +21,10 @@ build() {
 		--mandir=/usr/share/man \
 		--infodir=/usr/share/info
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$_pkgver"
 	make DESTDIR="$pkgdir" install
 	install -Dm644 ulogd.conf "$pkgdir"/etc/ulogd.conf
 	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
-- 
cgit v1.2.3


From 1da03ef03fa399722054e3e290826a3ec8595997 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 13:29:41 +0000
Subject: main/gtk+: upgrade to 2.20.1

---
 main/gtk+/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gtk+/APKBUILD b/main/gtk+/APKBUILD
index 3300e88a..1f5e4437 100644
--- a/main/gtk+/APKBUILD
+++ b/main/gtk+/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk+
-pkgver=2.20.0
-pkgrel=1
+pkgver=2.20.1
+pkgrel=0
 pkgdesc="The GTK+ Toolkit (v2)"
 url="http://www.gtk.org/"
 install="$pkgname.post-install $pkgname.post-upgrade $pkgname.post-deinstall"
@@ -57,4 +57,4 @@ dev() {
 	mv "$pkgdir"/usr/share/gir* "$subpkgdir"/usr/share/
 }
 
-md5sums="5517f78b1eb9b1eb60bd48a0152d09e6  gtk+-2.20.0.tar.bz2"
+md5sums="53e6f3a93bd22934878fc4a4a34c68aa  gtk+-2.20.1.tar.bz2"
-- 
cgit v1.2.3


From a65744be2f0fa1abdf320ee94b9597de9454398a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 13:52:38 +0000
Subject: main/cups: cups-dev needs openssl-dev and zlib-dev

---
 main/cups/APKBUILD | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/main/cups/APKBUILD b/main/cups/APKBUILD
index 8ae5f384..d63b0c14 100644
--- a/main/cups/APKBUILD
+++ b/main/cups/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cups
 pkgver=1.4.3
-pkgrel=2
+pkgrel=3
 pkgdesc="The CUPS Printing System"
 url="http://www.cups.org/"
 license="GPL"
 subpackages="$pkgname-dev $pkgname-doc libcups $pkgname-client"
-makedepends="openssl-dev libpaper-dev dbus-dev jpeg-dev>=8"
+makedepends="openssl-dev libpaper-dev dbus-dev jpeg-dev>=8 zlib-dev"
 depends="cups-client poppler-utils"
 install=
 pkggroups="lp lpadmin"
@@ -16,6 +16,8 @@ source="ftp://ftp.easysw.com/pub/$pkgname/$pkgver/$pkgname-$pkgver-source.tar.bz
 	cupsd.initd
 	"
 
+depends_dev="openssl-dev zlib-dev"
+
 build ()
 {
 	cd "$srcdir"/$pkgname-$pkgver
-- 
cgit v1.2.3


From ca30d3cb1080430917f2258c31ff1a2e1617a588 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:27:28 +0000
Subject: main/gst-plugins-good: let it replace gst-plugins-bad

seems like some plugin moved from bad to here so we need allow "good"
replace "bad"
---
 main/gst-plugins-good/APKBUILD | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/main/gst-plugins-good/APKBUILD b/main/gst-plugins-good/APKBUILD
index 8abe0593..d493cc2a 100644
--- a/main/gst-plugins-good/APKBUILD
+++ b/main/gst-plugins-good/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-good
 pkgver=0.10.22
-pkgrel=0
+pkgrel=1
 pkgdesc="GStreamer Multimedia Framework Good Plugins"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
@@ -9,6 +9,7 @@ subpackages="$pkgname-dev"
 depends=
 makedepends="gstreamer-dev glib-dev liboil-dev gst-plugins-base-dev
 	libsoup-dev flac-dev libogg-dev taglib-dev jpeg-dev zlib-dev"
+replaces="gst-plugins-bad"
 
 # might consider those:
 #libavc1394
-- 
cgit v1.2.3


From 807aaf8092ac3d3cb22997b3a281797cea1cb0e9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:40:18 +0000
Subject: main/bash: upgrade to 4.1.007

---
 main/bash/APKBUILD | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/main/bash/APKBUILD b/main/bash/APKBUILD
index f5b5a929..27f2cf97 100644
--- a/main/bash/APKBUILD
+++ b/main/bash/APKBUILD
@@ -1,11 +1,11 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 
 pkgname=bash
-pkgver=4.1.005
+pkgver=4.1.007
 _patchlevel=${pkgver##*.}
 _myver=${pkgver%.*}
 _patchbase=${_myver%.*}${_myver#*.}
-pkgrel=1
+pkgrel=0
 pkgdesc="The GNU Bourne Again shell"
 license='GPL'
 url="http://www.gnu.org/software/bash/bash.html"
@@ -70,4 +70,6 @@ md5sums="9800d8724815fd84994d9be65ab5e7b8  bash-4.1.tar.gz
 118d465095d4a4706eb1d34696a2666a  bash41-002
 120f7cf039a40d35fe375e59d6f17adc  bash41-003
 336ee037fc2cc1e2350b05097fbdc87c  bash41-004
-9471e666797f0b03eb2175ed752a9550  bash41-005"
+9471e666797f0b03eb2175ed752a9550  bash41-005
+fb80ccd58cb1e34940f3adf4ce6e4a1e  bash41-006
+192a8b161d419a1d0d211169f1d1046e  bash41-007"
-- 
cgit v1.2.3


From 1fd9b6f12b6f8a7f470a6ac6c382b65b6f144f3b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:40:37 +0000
Subject: main/cpufreqd: upgrade to 2.4.2

---
 main/cpufreqd/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/cpufreqd/APKBUILD b/main/cpufreqd/APKBUILD
index 98a8f6e8..e70d415e 100644
--- a/main/cpufreqd/APKBUILD
+++ b/main/cpufreqd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cpufreqd
-pkgver=2.3.4
-pkgrel=2
+pkgver=2.4.2
+pkgrel=0
 pkgdesc="A small daemon to adjust cpu speed (and indeed voltage)"
 url="http://sourceforge.net/projects/cpufreqd"
 license="GPL2"
@@ -26,5 +26,5 @@ package() {
 	install -Dm 755 ../cpufreqd.initd "$pkgdir"/etc/init.d/cpufreqd \
 		|| return 1
 }
-md5sums="f4193f688305566a8422dd3989667668  cpufreqd-2.3.4.tar.bz2
+md5sums="2ca80a77849c9a69b81e27c1843c97f5  cpufreqd-2.4.2.tar.bz2
 4c3298abc888ac4f688249ee542ce784  cpufreqd.initd"
-- 
cgit v1.2.3


From 80da548a4f3f4dc1e193c3dc1db74423f3ae66ab Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:44:06 +0000
Subject: main/gawk: upgrade to 3.1.8

---
 main/gawk/APKBUILD | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/main/gawk/APKBUILD b/main/gawk/APKBUILD
index 45e11601..b1389cd3 100644
--- a/main/gawk/APKBUILD
+++ b/main/gawk/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gawk
-pkgver=3.1.7
-pkgrel=1
+pkgver=3.1.8
+pkgrel=0
 pkgdesc="GNU awk pattern-matching language"
 url="http://www.gnu.org/software/gawk/gawk.html"
 license="GPL"
@@ -22,9 +22,13 @@ build() {
 		--infodir=/usr/share/info \
 		--disable-nls
 	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 
 }
 
-md5sums="a38d5dec19320ace01f1d16c8beb1363  gawk-3.1.7.tar.gz
+md5sums="35937a0f83f0efe7a8c2dee635624784  gawk-3.1.8.tar.gz
 b84506d253e04db3c5af9016fead45a3  gawk.post-deinstall"
-- 
cgit v1.2.3


From dd16e66b86ae69e66ae0f06df9bd927297bb7787 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:51:10 +0000
Subject: main/popt: upgrade to 1.16

---
 main/popt/APKBUILD | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/main/popt/APKBUILD b/main/popt/APKBUILD
index 33a7cea0..146f927d 100644
--- a/main/popt/APKBUILD
+++ b/main/popt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=popt
-pkgver=1.15
-pkgrel=1
+pkgver=1.16
+pkgrel=0
 pkgdesc="A commandline option parser"
 url="http://rpm5.org"
 license="custom"
@@ -11,9 +11,13 @@ subpackages="$pkgname-doc $pkgname-dev"
 
 build ()
 {
-	cd $srcdir/$pkgname-$pkgver
+	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr 
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR=$pkgdir install || return 1
 }
-md5sums="c61ef795fa450eb692602a661ec8d7f1  popt-1.15.tar.gz"
+md5sums="3743beefa3dd6247a73f8f7a32c14c33  popt-1.16.tar.gz"
-- 
cgit v1.2.3


From 153b45706c12c855f2036cd5af5b8da34d7fbf8a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:51:31 +0000
Subject: main/xf86-video-siliconmotion: upgrade to 1.7.4

---
 main/xf86-video-siliconmotion/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/xf86-video-siliconmotion/APKBUILD b/main/xf86-video-siliconmotion/APKBUILD
index 280c1c39..39a34827 100644
--- a/main/xf86-video-siliconmotion/APKBUILD
+++ b/main/xf86-video-siliconmotion/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xf86-video-siliconmotion
-pkgver=1.7.3
-pkgrel=2
+pkgver=1.7.4
+pkgrel=0
 pkgdesc="Silicon Motion video driver"
 url="http://xorg.freedesktop.org/"
 license="custom"
@@ -24,4 +24,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="29fb322cd3adab52cc7f1ac86f9315bb  xf86-video-siliconmotion-1.7.3.tar.bz2"
+md5sums="3059e87586e16c34da89437cc6215b49  xf86-video-siliconmotion-1.7.4.tar.bz2"
-- 
cgit v1.2.3


From ab572325f457d4e85d086c13833726dde9bd4ded Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 14:52:16 +0000
Subject: main/xfsprogs: upgrade to 3.1.2

---
 main/xfsprogs/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/xfsprogs/APKBUILD b/main/xfsprogs/APKBUILD
index 83749d63..dadad1d4 100644
--- a/main/xfsprogs/APKBUILD
+++ b/main/xfsprogs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfsprogs
-pkgver=3.1.1
-pkgrel=1
+pkgver=3.1.2
+pkgrel=0
 pkgdesc="XFS filesystem utilities"
 url="http://oss.sgi.com/projects/xfs/"
 license="LGPL"
@@ -36,4 +36,4 @@ package() {
 	cd "$_builddir"
 	make -j1 DIST_ROOT="$pkgdir" install install-dev
 }
-md5sums="c2308b46ee707597ac50aae418d321b8  xfsprogs-3.1.1.tar.gz"
+md5sums="86d10178ee6897cb099c97303e6d9da0  xfsprogs-3.1.2.tar.gz"
-- 
cgit v1.2.3


From 80f783a77b2e862c4aa30edb5493cf8be30cbea6 Mon Sep 17 00:00:00 2001
From: Nathan Angelacos <nangel@nothome.org>
Date: Mon, 17 May 2010 18:35:05 +0000
Subject: main/postgresql: enhancements to the database restore on reboot

---
 main/postgresql/APKBUILD         | 10 +++++-----
 main/postgresql/pg-restore.confd |  2 +-
 main/postgresql/pg-restore.initd | 20 +++++++++++++-------
 main/postgresql/postgresql.confd |  2 +-
 main/postgresql/postgresql.initd | 36 ++++++++++++++++++++++++++++--------
 5 files changed, 48 insertions(+), 22 deletions(-)

diff --git a/main/postgresql/APKBUILD b/main/postgresql/APKBUILD
index d82ee786..ca034fae 100644
--- a/main/postgresql/APKBUILD
+++ b/main/postgresql/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postgresql
 pkgver=8.4.3
-pkgrel=2
+pkgrel=3
 pkgdesc="A sophisticated object-relational DBMS"
 url="http://www.postgresql.org/"
 license="BSD"
@@ -57,7 +57,7 @@ client() {
 
 
 md5sums="7f70e7b140fb190f268837255582b07e  postgresql-8.4.3.tar.bz2
-740bc8414ee27b4c81dee1690c32679f  postgresql.initd
-d6b58fc2411fdadcb9b762464c5bee7d  postgresql.confd
-e64d0ab26b077ed80d883c0c40704ff4  pg-restore.initd
-8d1b69ac56a1a0d1cfd7da337bf6c5e2  pg-restore.confd"
+66c197b8186a6df0752fe2aed40c90c4  postgresql.initd
+12199d445bfa42aafc2a958012737107  postgresql.confd
+7f8de63848c51c8a30c39bec6b1b1606  pg-restore.initd
+bf45384752b320b369f1425939763178  pg-restore.confd"
diff --git a/main/postgresql/pg-restore.confd b/main/postgresql/pg-restore.confd
index 18bff4c2..84a179f6 100644
--- a/main/postgresql/pg-restore.confd
+++ b/main/postgresql/pg-restore.confd
@@ -10,7 +10,7 @@
 #
 #KEEP_DUMP=yes
 
-# If you enable the KEEP_DUMP bove you probably also want the --clean option
+# If you enable KEEP_DUMP above you probably also want the --clean option
 # the the pg_dumpall command.
 #PG_DUMPALL_OPTS="--clean"
 
diff --git a/main/postgresql/pg-restore.initd b/main/postgresql/pg-restore.initd
index aaf07cbe..91c69d18 100644
--- a/main/postgresql/pg-restore.initd
+++ b/main/postgresql/pg-restore.initd
@@ -1,5 +1,7 @@
 #!/sbin/runscript
 
+. /etc/conf.d/postgresql
+
 opts="${opts} dump restore"
 
 depend() {
@@ -7,18 +9,22 @@ depend() {
 }
 
 restore() {
-	[ -z "$PGDUMP" ] && return 0
+	yesno "$PGDUMP" && return 0
 	ebegin "Restoring PostgreSQL $PGDUMP"
-	psql -U ${PG_USER:-postgres} ${PSQL_OPTS} -f "$PGDUMP"
-	eend $?
-	if [ -z "$KEEP_DUMP" ]; then
-		rm -f "$PGDUMP"
-	fi
+	psql -U ${PG_USER:-postgres} ${PSQL_OPTS} -f "$PGDUMP" >/dev/null 2>/dev/null
+	yesno "$KEEP_DUMP" || rm -f "$PGDUMP"
+
+	su -l ${PGUSER} \
+                -c "env PGDATA=\"${PGDATA}\" /usr/bin/pg_ctl reload " >/dev/null
+	eend $res
 }
 
 dump() {
-	[ -z "$PGDUMP" ] && return 0
+	yesno "$PGDUMP" && return 0
+	mkdir -p "$( dirname "$PGDUMP" )"
+	ebegin "Saving PostgreSQL databases to $PGDUMP"
 	pg_dumpall -U ${PG_USER:-postgres} ${PG_DUMPALL_OPTS} -f "$PGDUMP"
+	eend $?
 }
 
 start() {
diff --git a/main/postgresql/postgresql.confd b/main/postgresql/postgresql.confd
index 4fe28a45..29ef20d9 100644
--- a/main/postgresql/postgresql.confd
+++ b/main/postgresql/postgresql.confd
@@ -52,5 +52,5 @@ WAIT_FOR_START="-w"
 #   export R_HOME="/usr/lib/R"
 
 # Automatically set up a new database if missing on startup
-#AUTO_SETUP=yes
+AUTO_SETUP=yes
 
diff --git a/main/postgresql/postgresql.initd b/main/postgresql/postgresql.initd
index 23b0acff..2de91d0d 100644
--- a/main/postgresql/postgresql.initd
+++ b/main/postgresql/postgresql.initd
@@ -2,6 +2,7 @@
 # Copyright 1999-2008 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 # $Header: /var/cvsroot/gentoo-x86/dev-db/postgresql-server/files/postgresql.init-8.3,v 1.4 2008/09/28 22:53:02 caleb Exp $
+# Modifications to support Alpine Linux pg-restore
 
 opts="${opts} reload setup"
 
@@ -11,10 +12,11 @@ depend() {
 }
 
 checkconfig() {
-	[ -d "$PGDATA" ] && return 0
+	[ -d "$PGDATA/base" ] && return 0
+	echo "checking config"
 
-	if [ -z "$AUTO_SETUP" ] || [ "$AUTO_SETUP" = "no" ]; then
-		eerror "Directory not found: $PGDATA"
+	if [ -z "$AUTO_SETUP" ] ; then
+		eerror "Database not found at: $PGDATA"
 		eerror "Please make sure that PGDATA points to the right path."
 		eerror "You can run '/etc/init.d/postgresql setup' to setup a new database cluster."
 		return 1
@@ -101,18 +103,36 @@ reload() {
 
 setup() { 
 	ebegin "Creating a new PostgreSQL database cluster" 
-	rmdir "${PGDATA}" 2>/dev/null
-	if [ -d "${PGDATA}" ] ; then 
-		eend 1 "${PGDATA} already exist" 
+	
+	if [ -d "${PGDATA}/base" ] ; then 
+		eend 1 "${PGDATA}/base already exists" 
 		return 
 	fi 
-	mkdir -p "${PGDATA}" 
+
+	mkdir -p "${PGDATA}"  2>/dev/null
+
+	# If the pg_hba.conf and friends exist, move them
+	local tmpdir="$( dirname "$PGDATA" )/tmp"
+	mkdir -p "${tmpdir}" >/dev/null
+	echo mv "${PGDATA}"/* "${tmpdir}" 
+	mv "${PGDATA}"/* "${tmpdir}"  2>/dev/null
+
+	rm -rf "${PGDATA}"/* 2>/dev/null
 	chown -Rf postgres:postgres "${PGDATA}" 
 	chmod 0700 "${PGDATA}" 
 	cd "${PGDATA}" # to avoid the: could not change directory to "/root" 
 	su -c "/usr/bin/initdb --pgdata ${PGDATA}" postgres
 	einfo "You can use the '/etc/init.d/postgresql' script to run PostgreSQL instead"
 	einfo "of 'pg_ctl'."
-	eend $? 
+	local res=$?
+
+	# move the pg_hba.conf and friends
+	mv $tmpdir/* "$PGDATA" 2>/dev/null 
+	rm -rf $tmpdir 2>/dev/null
+
+	# Do not send a SIGHUP to postmaster;  its not necessary for a new database
+	# and allows pg-restore to do a blind restore of an old database
+
+	eend $res
 } 
 
-- 
cgit v1.2.3


From 7ced7ee00605ae4d7bea1d97d23ac8fe3077c798 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 19:24:28 +0000
Subject: main/midori: upgrade to 0.2.5

---
 main/midori/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/midori/APKBUILD b/main/midori/APKBUILD
index 69bed3a9..4b05196e 100644
--- a/main/midori/APKBUILD
+++ b/main/midori/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=midori
-pkgver=0.2.4
-pkgrel=1
+pkgver=0.2.5
+pkgrel=0
 pkgdesc="A lightweight web browser based on Gtk WebKit"
 url="http://www.twotoasts.de/index.php?/pages/midori_summary.html"
 license="GPL"
@@ -45,4 +45,4 @@ package() {
 	# PAX does not like the JIT
 	paxctl -c -m -p "$pkgdir"/usr/bin/midori
 }
-md5sums="ccd2ae162993c2c92c9e0eac7778c62d  midori-0.2.4.tar.bz2"
+md5sums="3aeacd04d4d3e5c3bc16824696ff57b2  midori-0.2.5.tar.bz2"
-- 
cgit v1.2.3


From 80a488ebe5e73a07f124ed22fac35a6c23fceade Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 19:36:29 +0000
Subject: main/webkit: upgrade to 1.2.1

---
 main/webkit/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/webkit/APKBUILD b/main/webkit/APKBUILD
index f030358b..cde64573 100644
--- a/main/webkit/APKBUILD
+++ b/main/webkit/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=webkit
-pkgver=1.2.0
-pkgrel=1
+pkgver=1.2.1
+pkgrel=0
 pkgdesc="portable web rendering engine WebKit for GTK+"
 url="http://webkitgtk.org/"
 license="LGPL BSD"
@@ -42,4 +42,4 @@ gtklauncher() {
 		"$subpkgdir"/usr/bin/GtkLauncher
 }
 
-md5sums="b2bfcbc4bbf1d0a51f848cb54c21ee66  webkit-1.2.0.tar.gz"
+md5sums="eb6f473d8d7be56ecd226e7dd55dcb9b  webkit-1.2.1.tar.gz"
-- 
cgit v1.2.3


From fc031f3160d4ebd386d11216e941bdce12c94e3e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 17 May 2010 19:43:54 +0000
Subject: testing/qemu: upgrade to 0.12.4

---
 testing/qemu/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/qemu/APKBUILD b/testing/qemu/APKBUILD
index 7199ce93..4d3d7100 100644
--- a/testing/qemu/APKBUILD
+++ b/testing/qemu/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=qemu
-pkgver=0.12.3
+pkgver=0.12.4
 pkgrel=0
 pkgdesc="QEMU is a generic machine emulator and virtualizer"
 url="http://www.nongnu.org/qemu/"
@@ -86,5 +86,5 @@ sparc() { _subsys sparc; }
 sparc64() { _subsys sparc64; }
 x86_64() { _subsys x86_64; }
 
-md5sums="d215e4568650e8019816397174c090e1  qemu-0.12.3.tar.gz
+md5sums="93e6b134dff89b2799f57b7d9e0e0fc5  qemu-0.12.4.tar.gz
 f63f7412f016d8ccddabfd02ea28e748  kqemu.patch"
-- 
cgit v1.2.3


From 67313c76e851795859655bc6f944e5d73753e596 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 06:09:03 +0000
Subject: main/samba: upgrade to 3.5.2

---
 main/samba/APKBUILD                 | 22 ++++++++++++++++------
 main/samba/samba-uclibc-fstab.patch | 15 +++++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)
 create mode 100644 main/samba/samba-uclibc-fstab.patch

diff --git a/main/samba/APKBUILD b/main/samba/APKBUILD
index 5a7a1d52..864ed9be 100644
--- a/main/samba/APKBUILD
+++ b/main/samba/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=samba
-pkgver=3.4.7
-pkgrel=1
+pkgver=3.5.2
+pkgrel=0
 pkgdesc="Tools to access a server's filespace and printers via SMB"
 url="http://www.samba.org"
 license="GPL3"
@@ -13,11 +13,20 @@ source="http://us1.$pkgname.org/$pkgname/ftp/stable/$pkgname-$pkgver.tar.gz
 	samba.initd
 	samba.confd
 	samba.logrotate
+	samba-uclibc-fstab.patch
 	"
 pkggroups="winbind"
 
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*.patch; do
+		patch -p1 -i "$i" || return 1
+	done
+}
+
 build() { 
-	cd "$srcdir"/$pkgname-$pkgver/source3
+	cd "$_builddir"/source3
 	./configure --prefix=/usr \
 		--sysconfdir=/etc/samba \
 		--with-configdir=/etc/samba \
@@ -38,7 +47,7 @@ build() {
 }
 
 package() {
-	cd "$srcdir"/$pkgname-$pkgver/source3
+	cd "$_builddir"/source3
 	make DESTDIR="$pkgdir" install
 
 	install -d "$pkgdir"/var/log/samba \
@@ -108,7 +117,8 @@ tdb() {
 		usr/bin/tdb*
 }
 
-md5sums="f5e11690d54466c143f4598bcce2a8bb  samba-3.4.7.tar.gz
+md5sums="6f8cf649207ccd8c2c17e28c335f4e9d  samba-3.5.2.tar.gz
 c8a7f6ac5df2f73dbf023e25ea39927b  samba.initd
 c150433426e18261e6e3eed3930e1a76  samba.confd
-b7cafabfb4fa5b3ab5f2e857d8d1c733  samba.logrotate"
+b7cafabfb4fa5b3ab5f2e857d8d1c733  samba.logrotate
+811e5a3f570d0053cf27a73248be4ae6  samba-uclibc-fstab.patch"
diff --git a/main/samba/samba-uclibc-fstab.patch b/main/samba/samba-uclibc-fstab.patch
new file mode 100644
index 00000000..3fdbc903
--- /dev/null
+++ b/main/samba/samba-uclibc-fstab.patch
@@ -0,0 +1,15 @@
+--- ./client/mount.cifs.c.orig
++++ ./client/mount.cifs.c
+@@ -39,7 +39,11 @@
+ #include <mntent.h>
+ #include <fcntl.h>
+ #include <limits.h>
+-#include <fstab.h>
++#if defined(__UCLIBC__)
++ #define _PATH_FSTAB "/etc/fstab"
++#else
++ #include <fstab.h>
++#endif
+ #include "mount.h"
+ 
+ #define MOUNT_CIFS_VERSION_MAJOR "1"
-- 
cgit v1.2.3


From eff162c7184c7ba524dff6be7c8737bf30ebbab2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 06:43:57 +0000
Subject: main/feh: upgrade to 1.5

---
 main/feh/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/feh/APKBUILD b/main/feh/APKBUILD
index 0631a7f6..af556078 100644
--- a/main/feh/APKBUILD
+++ b/main/feh/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=feh
-pkgver=1.4.2
-pkgrel=1
+pkgver=1.5
+pkgrel=0
 pkgdesc="feh is a fast, lightweight image viewer which uses imlib2"
 url="http://www.linuxbrit.co.uk/feh/"
 license="MIT"
@@ -23,4 +23,4 @@ package() {
 	make DESTDIR=$pkgdir docsdir=/usr/share/doc/feh install || return 1
 	install -D -m644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
 }
-md5sums="19906a6e319e99e0d98856f64324fed8  feh-1.4.2.tar.bz2"
+md5sums="aee156f0a82582108c5a56fbe85319ae  feh-1.5.tar.bz2"
-- 
cgit v1.2.3


From 78b1da053750b7008573c12d6adca3f567e63caf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 06:45:57 +0000
Subject: main/gmp: upgrade to 5.0.1

---
 main/gmp/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gmp/APKBUILD b/main/gmp/APKBUILD
index 36ad708d..0ddfbd33 100644
--- a/main/gmp/APKBUILD
+++ b/main/gmp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gmp
-pkgver=4.3.2
-pkgrel=1
+pkgver=5.0.1
+pkgrel=0
 pkgdesc="A free library for arbitrary precision arithmetic"
 url="http://gmplib.org/"
 license="LGPL3"
@@ -35,5 +35,5 @@ package() {
 	cd "$_builddir"
 	make -j1 DESTDIR="${pkgdir}" install || return 1
 }
-md5sums="dd60683d7057917e34630b4a787932e8  gmp-4.3.2.tar.bz2
+md5sums="6bac6df75c192a13419dfd71d19240a7  gmp-5.0.1.tar.bz2
 13c34f00e77ded6673270cfea06c35c3  gmp-4.1.4-noexecstack.patch"
-- 
cgit v1.2.3


From ef24e15982c9fee6a8c2985de8d602c8ca5ecc3e Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 09:14:15 +0000
Subject: testing/bluez: new aport

Tools for the Bluetooth protocol stack
http://www.bluez.org/
---
 testing/bluez/APKBUILD | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 testing/bluez/APKBUILD

diff --git a/testing/bluez/APKBUILD b/testing/bluez/APKBUILD
new file mode 100644
index 00000000..32c9ec97
--- /dev/null
+++ b/testing/bluez/APKBUILD
@@ -0,0 +1,70 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=bluez
+pkgver=4.64
+pkgrel=0
+pkgdesc="Tools for the Bluetooth protocol stack"
+url="http://www.bluez.org/"
+license="GPL2"
+depends=
+makedepends="dbus-dev gstreamer-dev alsa-lib-dev libusb-dev libnl-dev"
+subpackages="$pkgname-dev $pkgname-doc libbluetooth $pkgname-alsa $pkgname-cups
+	$pkgname-netlink"
+source="http://www.kernel.org/pub/linux/bluetooth/$pkgname-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--libexecdir=/lib \
+		--mandir=/usr/share/man \
+		--enable-gstreamer \
+		--enable-alsa \
+		--enable-usb \
+		--enable-netlink \
+		--enable-tools \
+		--enable-bccmd \
+		--enable-hid2hci \
+		--enable-dfutool \
+		--enable-hidd \
+		--enable-pand \
+		--enable-dund \
+		--enable-cups \
+		--enable-configfiles \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make install DESTDIR="$pkgdir"
+}
+
+libbluetooth() {
+	pkgdesc="Libraries for Bluetooth protocol stack"
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/libbluetooth.so.* "$subpkgdir"/usr/lib/
+}
+
+alsa() {
+	pkgdesc="Bluez plugin for ALSA"
+	mkdir -p "$subpkgdir"/etc "$subpkgdir"/usr/lib
+	mv "$pkgdir"/etc/alsa* "$subpkgdir"/etc/
+	mv "$pkgdir"/usr/lib/alsa* "$subpkgdir"/usr/lib/
+}
+
+cups() {
+	pkgdesc="Bluez backend for CUPS"
+	mkdir -p "$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/lib/cups "$subpkgdir"/usr/lib/
+}
+
+netlink() {
+	pkgdesc="Bluez netlink plugin"
+	mkdir -p "$subpkgdir"/usr/lib/bluetooth/plugins
+	mv "$pkgdir"/usr/lib/bluetooth/plugins/netlink.so \
+		"$subpkgdir"/usr/lib/bluetooth/plugins
+}
+
+md5sums="d6e60bad937fe72b0bc77e327ee470b0  bluez-4.64.tar.bz2"
-- 
cgit v1.2.3


From 35b23793a77b576f76ee085dc8c1de00a6f06d54 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 09:17:00 +0000
Subject: Revert "main/gmp: upgrade to 5.0.1"

This reverts commit 78b1da053750b7008573c12d6adca3f567e63caf.
---
 main/gmp/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/gmp/APKBUILD b/main/gmp/APKBUILD
index 0ddfbd33..36ad708d 100644
--- a/main/gmp/APKBUILD
+++ b/main/gmp/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gmp
-pkgver=5.0.1
-pkgrel=0
+pkgver=4.3.2
+pkgrel=1
 pkgdesc="A free library for arbitrary precision arithmetic"
 url="http://gmplib.org/"
 license="LGPL3"
@@ -35,5 +35,5 @@ package() {
 	cd "$_builddir"
 	make -j1 DESTDIR="${pkgdir}" install || return 1
 }
-md5sums="6bac6df75c192a13419dfd71d19240a7  gmp-5.0.1.tar.bz2
+md5sums="dd60683d7057917e34630b4a787932e8  gmp-4.3.2.tar.bz2
 13c34f00e77ded6673270cfea06c35c3  gmp-4.1.4-noexecstack.patch"
-- 
cgit v1.2.3


From c57c0aa99c616c9cb29a80498595889c3812a6ec Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 18 May 2010 20:33:58 +0000
Subject: main/gst-plugins-ugly: add x264 support

---
 main/gst-plugins-ugly/APKBUILD | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/main/gst-plugins-ugly/APKBUILD b/main/gst-plugins-ugly/APKBUILD
index f5c7fdac..818b3ec9 100644
--- a/main/gst-plugins-ugly/APKBUILD
+++ b/main/gst-plugins-ugly/APKBUILD
@@ -1,13 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-plugins-ugly
 pkgver=0.10.14
-pkgrel=0
+pkgrel=1
 pkgdesc="GStreamer Multimedia Framework Ugly Plugins (gst-plugins-ugly)"
 url="http://gstreamer.freedesktop.org/"
 license="LGPL"
 depends= #"gstreamer0.10-ugly>=0.10.11 libdvdread>=4.1.3 lame>=3.98.2 libmpeg2>=0.5.1 a52dec>=0.7.4 libid3tag>=0.15.1b libmad>=0.15.1b libsidplay>=1.36.59 libcdio>=0.81"
 makedepends="pkgconfig lame-dev libmpeg2-dev a52dec-dev libid3tag-dev
-	libmad-dev glib-dev liboil-dev gstreamer-dev gst-plugins-base-dev"
+	libmad-dev glib-dev liboil-dev gstreamer-dev gst-plugins-base-dev
+	x264-dev"
 source="http://gstreamer.freedesktop.org//src/gst-plugins-ugly/gst-plugins-ugly-$pkgver.tar.bz2"
 
 build() { 
-- 
cgit v1.2.3


From 6e48595b3aaa5fa73f67a4a161537cec7e3254a7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 06:20:31 +0000
Subject: main/mplayer: upgrade to 1.0_rc4_p20100506 (SVN-r30554)

---
 testing/mplayer/APKBUILD | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/testing/mplayer/APKBUILD b/testing/mplayer/APKBUILD
index 5662a655..f5f1ae7b 100644
--- a/testing/mplayer/APKBUILD
+++ b/testing/mplayer/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mplayer
-pkgver=1.0_rc4_p20091124
-_svnver=SVN-r29964
+pkgver=1.0_rc4_p20100506
+_svnver=SVN-r30554
 pkgrel=5
 pkgdesc="A movie player for linux"
 url="http://www.mplayerhq.hu/"
@@ -15,17 +15,7 @@ makedepends="libxxf86dga-dev libxv-dev libmad-dev lame-dev libao-dev
 # cdparanoia libcaca lirc-utils libgl-dev smbclient-dev 
 # aalib-dev jack-audio-connection-kit libmng-dev libxss-dev
 
-source="http://mirrors.kernel.org/gentoo/distfiles/$pkgname-$pkgver.tbz2"
-
-unpack() {
-	default_unpack
-	cd "$srcdir"
-	for i in in $source; do
-		case $i in
-			*.tbz2)	tar -jxf  ${i##*/};;
-		esac
-	done
-}
+source="http://mirrors.kernel.org/gentoo/distfiles/$pkgname-$pkgver.tar.bz2"
 
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
@@ -75,4 +65,4 @@ package() {
 		"$pkgdir"/usr/share/mplayer/subfont.ttf || return 1
 	rm -rf "$pkgdir"/usr/share/mplayer/font
 }
-md5sums="3ef3c9bdd85004f099552592a97f069c  mplayer-1.0_rc4_p20091124.tbz2"
+md5sums="38126e7d1cf4044115a617dc331cddcc  mplayer-1.0_rc4_p20100506.tar.bz2"
-- 
cgit v1.2.3


From 169ec9a981e04031a3f5636bff971f466beda82f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 06:21:19 +0000
Subject: main/mplayer: moved from testing

---
 main/mplayer/APKBUILD                  | 68 ++++++++++++++++++++++++++++++++++
 main/mplayer/liba52_gcc_bug.patch      | 10 +++++
 main/mplayer/mplayer/configure.orig    |  0
 main/mplayer/mplayer/configure.rej     | 10 +++++
 testing/mplayer/APKBUILD               | 68 ----------------------------------
 testing/mplayer/liba52_gcc_bug.patch   | 10 -----
 testing/mplayer/mplayer/configure.orig |  0
 testing/mplayer/mplayer/configure.rej  | 10 -----
 8 files changed, 88 insertions(+), 88 deletions(-)
 create mode 100644 main/mplayer/APKBUILD
 create mode 100644 main/mplayer/liba52_gcc_bug.patch
 create mode 100644 main/mplayer/mplayer/configure.orig
 create mode 100644 main/mplayer/mplayer/configure.rej
 delete mode 100644 testing/mplayer/APKBUILD
 delete mode 100644 testing/mplayer/liba52_gcc_bug.patch
 delete mode 100644 testing/mplayer/mplayer/configure.orig
 delete mode 100644 testing/mplayer/mplayer/configure.rej

diff --git a/main/mplayer/APKBUILD b/main/mplayer/APKBUILD
new file mode 100644
index 00000000..f5f1ae7b
--- /dev/null
+++ b/main/mplayer/APKBUILD
@@ -0,0 +1,68 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=mplayer
+pkgver=1.0_rc4_p20100506
+_svnver=SVN-r30554
+pkgrel=5
+pkgdesc="A movie player for linux"
+url="http://www.mplayerhq.hu/"
+license="GPL"
+depends=
+subpackages="$pkgname-doc"
+makedepends="libxxf86dga-dev libxv-dev libmad-dev lame-dev libao-dev
+	libtheora-dev xvidcore-dev zlib-dev sdl-dev freetype-dev
+	x264-dev faac-dev ttf-dejavu libxvmc-dev alsa-lib-dev live-media-dev"
+
+# cdparanoia libcaca lirc-utils libgl-dev smbclient-dev 
+# aalib-dev jack-audio-connection-kit libmng-dev libxss-dev
+
+source="http://mirrors.kernel.org/gentoo/distfiles/$pkgname-$pkgver.tar.bz2"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	sed -i "s/UNKNOWN/$_svnver/" version.sh
+
+	export GCC_SPECS=/usr/share/gcc/hardenednopie.specs
+	./configure --prefix=/usr \
+		--disable-gui \
+		--disable-gif \
+		--disable-arts \
+		--enable-x11 \
+		--enable-runtime-cpudetection \
+		--confdir=/etc/mplayer \
+		--disable-nas \
+		--disable-gl \
+		--enable-tv-v4l1 \
+		--enable-tv-v4l2 \
+		--enable-largefiles \
+		--disable-liblzo \
+		--disable-speex \
+		--disable-openal \
+		--disable-fribidi \
+		--disable-libdv \
+		--disable-musepack \
+		--language=all\
+		--disable-esd \
+		--disable-mga \
+		--disable-lirc \
+		--enable-debug \
+		--enable-radio \
+		--enable-radio-capture \
+		--extra-cflags="-I/usr/lib/live-media -O2" \
+		--disable-nemesi \
+		--enable-freetype \
+		--enable-xvmc \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make -j1 DESTDIR="$pkgdir" install || return 1
+	install -Dm644 etc/codecs.conf etc/input.conf etc/example.conf \
+		"$pkgdir"/etc/mplayer/ || return 1
+	install -dm755 "$pkgdir"/usr/share/mplayer/
+	ln -s /usr/share/fonts/TTF/DejaVuSans.ttf \
+		"$pkgdir"/usr/share/mplayer/subfont.ttf || return 1
+	rm -rf "$pkgdir"/usr/share/mplayer/font
+}
+md5sums="38126e7d1cf4044115a617dc331cddcc  mplayer-1.0_rc4_p20100506.tar.bz2"
diff --git a/main/mplayer/liba52_gcc_bug.patch b/main/mplayer/liba52_gcc_bug.patch
new file mode 100644
index 00000000..c0d42f87
--- /dev/null
+++ b/main/mplayer/liba52_gcc_bug.patch
@@ -0,0 +1,10 @@
+--- mplayer/configure.old	2009-04-16 12:02:10.000000000 +0200
++++ mplayer/configure	2009-05-22 15:23:38.000000000 +0200
+@@ -6410,6 +6410,7 @@
+ def_liba52='#undef CONFIG_LIBA52'
+ def_liba52_internal="#undef CONFIG_LIBA52_INTERNAL"
+ if test "$_liba52_internal" = yes ; then
++	test "$cc_vendor" = gnu && test "$cc_version" = 4.4.0 && CFLAGS=$(echo $CFLAGS|sed "s/ *-O4 */ -O2 /")
+   _liba52=yes
+   def_liba52_internal="#define CONFIG_LIBA52_INTERNAL 1"
+   _res_comment="internal"
diff --git a/main/mplayer/mplayer/configure.orig b/main/mplayer/mplayer/configure.orig
new file mode 100644
index 00000000..e69de29b
diff --git a/main/mplayer/mplayer/configure.rej b/main/mplayer/mplayer/configure.rej
new file mode 100644
index 00000000..c0d42f87
--- /dev/null
+++ b/main/mplayer/mplayer/configure.rej
@@ -0,0 +1,10 @@
+--- mplayer/configure.old	2009-04-16 12:02:10.000000000 +0200
++++ mplayer/configure	2009-05-22 15:23:38.000000000 +0200
+@@ -6410,6 +6410,7 @@
+ def_liba52='#undef CONFIG_LIBA52'
+ def_liba52_internal="#undef CONFIG_LIBA52_INTERNAL"
+ if test "$_liba52_internal" = yes ; then
++	test "$cc_vendor" = gnu && test "$cc_version" = 4.4.0 && CFLAGS=$(echo $CFLAGS|sed "s/ *-O4 */ -O2 /")
+   _liba52=yes
+   def_liba52_internal="#define CONFIG_LIBA52_INTERNAL 1"
+   _res_comment="internal"
diff --git a/testing/mplayer/APKBUILD b/testing/mplayer/APKBUILD
deleted file mode 100644
index f5f1ae7b..00000000
--- a/testing/mplayer/APKBUILD
+++ /dev/null
@@ -1,68 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=mplayer
-pkgver=1.0_rc4_p20100506
-_svnver=SVN-r30554
-pkgrel=5
-pkgdesc="A movie player for linux"
-url="http://www.mplayerhq.hu/"
-license="GPL"
-depends=
-subpackages="$pkgname-doc"
-makedepends="libxxf86dga-dev libxv-dev libmad-dev lame-dev libao-dev
-	libtheora-dev xvidcore-dev zlib-dev sdl-dev freetype-dev
-	x264-dev faac-dev ttf-dejavu libxvmc-dev alsa-lib-dev live-media-dev"
-
-# cdparanoia libcaca lirc-utils libgl-dev smbclient-dev 
-# aalib-dev jack-audio-connection-kit libmng-dev libxss-dev
-
-source="http://mirrors.kernel.org/gentoo/distfiles/$pkgname-$pkgver.tar.bz2"
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	sed -i "s/UNKNOWN/$_svnver/" version.sh
-
-	export GCC_SPECS=/usr/share/gcc/hardenednopie.specs
-	./configure --prefix=/usr \
-		--disable-gui \
-		--disable-gif \
-		--disable-arts \
-		--enable-x11 \
-		--enable-runtime-cpudetection \
-		--confdir=/etc/mplayer \
-		--disable-nas \
-		--disable-gl \
-		--enable-tv-v4l1 \
-		--enable-tv-v4l2 \
-		--enable-largefiles \
-		--disable-liblzo \
-		--disable-speex \
-		--disable-openal \
-		--disable-fribidi \
-		--disable-libdv \
-		--disable-musepack \
-		--language=all\
-		--disable-esd \
-		--disable-mga \
-		--disable-lirc \
-		--enable-debug \
-		--enable-radio \
-		--enable-radio-capture \
-		--extra-cflags="-I/usr/lib/live-media -O2" \
-		--disable-nemesi \
-		--enable-freetype \
-		--enable-xvmc \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make -j1 DESTDIR="$pkgdir" install || return 1
-	install -Dm644 etc/codecs.conf etc/input.conf etc/example.conf \
-		"$pkgdir"/etc/mplayer/ || return 1
-	install -dm755 "$pkgdir"/usr/share/mplayer/
-	ln -s /usr/share/fonts/TTF/DejaVuSans.ttf \
-		"$pkgdir"/usr/share/mplayer/subfont.ttf || return 1
-	rm -rf "$pkgdir"/usr/share/mplayer/font
-}
-md5sums="38126e7d1cf4044115a617dc331cddcc  mplayer-1.0_rc4_p20100506.tar.bz2"
diff --git a/testing/mplayer/liba52_gcc_bug.patch b/testing/mplayer/liba52_gcc_bug.patch
deleted file mode 100644
index c0d42f87..00000000
--- a/testing/mplayer/liba52_gcc_bug.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- mplayer/configure.old	2009-04-16 12:02:10.000000000 +0200
-+++ mplayer/configure	2009-05-22 15:23:38.000000000 +0200
-@@ -6410,6 +6410,7 @@
- def_liba52='#undef CONFIG_LIBA52'
- def_liba52_internal="#undef CONFIG_LIBA52_INTERNAL"
- if test "$_liba52_internal" = yes ; then
-+	test "$cc_vendor" = gnu && test "$cc_version" = 4.4.0 && CFLAGS=$(echo $CFLAGS|sed "s/ *-O4 */ -O2 /")
-   _liba52=yes
-   def_liba52_internal="#define CONFIG_LIBA52_INTERNAL 1"
-   _res_comment="internal"
diff --git a/testing/mplayer/mplayer/configure.orig b/testing/mplayer/mplayer/configure.orig
deleted file mode 100644
index e69de29b..00000000
diff --git a/testing/mplayer/mplayer/configure.rej b/testing/mplayer/mplayer/configure.rej
deleted file mode 100644
index c0d42f87..00000000
--- a/testing/mplayer/mplayer/configure.rej
+++ /dev/null
@@ -1,10 +0,0 @@
---- mplayer/configure.old	2009-04-16 12:02:10.000000000 +0200
-+++ mplayer/configure	2009-05-22 15:23:38.000000000 +0200
-@@ -6410,6 +6410,7 @@
- def_liba52='#undef CONFIG_LIBA52'
- def_liba52_internal="#undef CONFIG_LIBA52_INTERNAL"
- if test "$_liba52_internal" = yes ; then
-+	test "$cc_vendor" = gnu && test "$cc_version" = 4.4.0 && CFLAGS=$(echo $CFLAGS|sed "s/ *-O4 */ -O2 /")
-   _liba52=yes
-   def_liba52_internal="#define CONFIG_LIBA52_INTERNAL 1"
-   _res_comment="internal"
-- 
cgit v1.2.3


From be78f98d726d94bc4bb6ac517d02fe58a40a9c2f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 06:33:33 +0000
Subject: testing/wine: upgrade to 1.1.44

---
 testing/wine/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/wine/APKBUILD b/testing/wine/APKBUILD
index 11945826..99e4a5bd 100644
--- a/testing/wine/APKBUILD
+++ b/testing/wine/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=wine
-pkgver=1.1.43
+pkgver=1.1.44
 pkgrel=0
 pkgdesc="A compatibility layer for running Windows programs"
 url="http://www.winehq.com"
@@ -32,5 +32,5 @@ package() {
 	make prefix="$pkgdir"/usr install || return 1
 	mkdir -p "$pkgdir"/etc/wine
 }
-md5sums="78e3c8d8d39625d7959ffe070a59028d  wine-1.1.43.tar.bz2
+md5sums="f18649bd71b9099fecad22436d239cba  wine-1.1.44.tar.bz2
 6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch"
-- 
cgit v1.2.3


From 1219b7f68c82c11f4836bb1d7b7c1d316b577404 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 06:34:04 +0000
Subject: main/wine: moved from testing

---
 main/wine/APKBUILD             | 36 ++++++++++++++++++++++++++++++++++++
 main/wine/dn_skipname.patch    | 38 ++++++++++++++++++++++++++++++++++++++
 testing/wine/APKBUILD          | 36 ------------------------------------
 testing/wine/dn_skipname.patch | 38 --------------------------------------
 4 files changed, 74 insertions(+), 74 deletions(-)
 create mode 100644 main/wine/APKBUILD
 create mode 100644 main/wine/dn_skipname.patch
 delete mode 100644 testing/wine/APKBUILD
 delete mode 100644 testing/wine/dn_skipname.patch

diff --git a/main/wine/APKBUILD b/main/wine/APKBUILD
new file mode 100644
index 00000000..99e4a5bd
--- /dev/null
+++ b/main/wine/APKBUILD
@@ -0,0 +1,36 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=wine
+pkgver=1.1.44
+pkgrel=0
+pkgdesc="A compatibility layer for running Windows programs"
+url="http://www.winehq.com"
+license="LGPL"
+subpackages="$pkgname-dev $pkgname-doc"
+makedepends="fontconfig-dev openldap-dev libxslt-dev libxxf86dga-dev
+	libxcursor-dev libxrandr-dev libxdamage-dev mesa-dev flex bison
+	libpng-dev jpeg-dev freetype-dev"
+# lcms
+source="http://ibiblio.org/pub/linux/system/emulators/$pkgname/$pkgname-$pkgver.tar.bz2
+	dn_skipname.patch"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	patch -p1 -i "$srcdir"/dn_skipname.patch || return 1
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--with-x
+	make depend && make 
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make prefix="$pkgdir"/usr install || return 1
+	mkdir -p "$pkgdir"/etc/wine
+}
+md5sums="f18649bd71b9099fecad22436d239cba  wine-1.1.44.tar.bz2
+6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch"
diff --git a/main/wine/dn_skipname.patch b/main/wine/dn_skipname.patch
new file mode 100644
index 00000000..99ecf831
--- /dev/null
+++ b/main/wine/dn_skipname.patch
@@ -0,0 +1,38 @@
+--- ./dlls/dnsapi/ns_parse.c.orig
++++ ./dlls/dnsapi/ns_parse.c
+@@ -69,6 +69,35 @@
+ } while (0)
+ 
+ /* Public. */
++#ifdef __UCLIBC__
++int
++dn_skipname(const u_char *comp_dn, const u_char *eom)
++{
++       const u_char *cp;
++       int n;
++
++       cp = comp_dn;
++       while (cp < eom && (n = *cp++)) {
++               /*
++                * check for indirection
++                */
++               switch (n & INDIR_MASK) {
++               case 0:                 /* normal case, n == len */
++                       cp += n;
++                       continue;
++               case INDIR_MASK:        /* indirection */
++                       cp++;
++                       break;
++               default:                /* illegal type */
++                       return (-1);
++               }
++               break;
++       }
++       if (cp > eom)
++               return (-1);
++       return (cp - comp_dn);
++}
++#endif
+ 
+ static int
+ dns_ns_skiprr(const u_char *ptr, const u_char *eom, ns_sect section, int count) {
diff --git a/testing/wine/APKBUILD b/testing/wine/APKBUILD
deleted file mode 100644
index 99e4a5bd..00000000
--- a/testing/wine/APKBUILD
+++ /dev/null
@@ -1,36 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=wine
-pkgver=1.1.44
-pkgrel=0
-pkgdesc="A compatibility layer for running Windows programs"
-url="http://www.winehq.com"
-license="LGPL"
-subpackages="$pkgname-dev $pkgname-doc"
-makedepends="fontconfig-dev openldap-dev libxslt-dev libxxf86dga-dev
-	libxcursor-dev libxrandr-dev libxdamage-dev mesa-dev flex bison
-	libpng-dev jpeg-dev freetype-dev"
-# lcms
-source="http://ibiblio.org/pub/linux/system/emulators/$pkgname/$pkgname-$pkgver.tar.bz2
-	dn_skipname.patch"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-prepare() {
-	cd "$_builddir"
-	patch -p1 -i "$srcdir"/dn_skipname.patch || return 1
-}
-
-build() {
-	cd "$_builddir"
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--with-x
-	make depend && make 
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make prefix="$pkgdir"/usr install || return 1
-	mkdir -p "$pkgdir"/etc/wine
-}
-md5sums="f18649bd71b9099fecad22436d239cba  wine-1.1.44.tar.bz2
-6ebeaa64eddf97be3267db236ce84b71  dn_skipname.patch"
diff --git a/testing/wine/dn_skipname.patch b/testing/wine/dn_skipname.patch
deleted file mode 100644
index 99ecf831..00000000
--- a/testing/wine/dn_skipname.patch
+++ /dev/null
@@ -1,38 +0,0 @@
---- ./dlls/dnsapi/ns_parse.c.orig
-+++ ./dlls/dnsapi/ns_parse.c
-@@ -69,6 +69,35 @@
- } while (0)
- 
- /* Public. */
-+#ifdef __UCLIBC__
-+int
-+dn_skipname(const u_char *comp_dn, const u_char *eom)
-+{
-+       const u_char *cp;
-+       int n;
-+
-+       cp = comp_dn;
-+       while (cp < eom && (n = *cp++)) {
-+               /*
-+                * check for indirection
-+                */
-+               switch (n & INDIR_MASK) {
-+               case 0:                 /* normal case, n == len */
-+                       cp += n;
-+                       continue;
-+               case INDIR_MASK:        /* indirection */
-+                       cp++;
-+                       break;
-+               default:                /* illegal type */
-+                       return (-1);
-+               }
-+               break;
-+       }
-+       if (cp > eom)
-+               return (-1);
-+       return (cp - comp_dn);
-+}
-+#endif
- 
- static int
- dns_ns_skiprr(const u_char *ptr, const u_char *eom, ns_sect section, int count) {
-- 
cgit v1.2.3


From 1c6f938da5885d7c1390baac9f2e3d8deaf0c641 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 06:58:11 +0000
Subject: main/mercurial: upgrade to 1.5.3

---
 main/mercurial/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/mercurial/APKBUILD b/main/mercurial/APKBUILD
index dd7d2653..f3711832 100644
--- a/main/mercurial/APKBUILD
+++ b/main/mercurial/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mercurial
-pkgver=1.5.2
+pkgver=1.5.3
 pkgrel=0
 pkgdesc="A scalable distributed SCM tool"
 url="http://www.selenic.com/mercurial"
@@ -29,4 +29,4 @@ package() {
 	install -Dm644 contrib/vim/HGAnnotate.vim \
 		"${vimpath}/syntax/HGAnnotate.vim" || return 1
 }
-md5sums="deafaaf017fc3c8a9deef39e566aec80  mercurial-1.5.2.tar.gz"
+md5sums="0969b8109f1b5a9c4debf985cca938f9  mercurial-1.5.3.tar.gz"
-- 
cgit v1.2.3


From 80b81a91d09812b6ff99c9cb1cd93f757327bc8c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 08:02:28 +0000
Subject: testing/bluez: added init.d script

---
 testing/bluez/APKBUILD         | 13 ++++++++++---
 testing/bluez/bluetooth-conf.d |  7 +++++++
 testing/bluez/bluetooth-init.d | 31 +++++++++++++++++++++++++++++++
 testing/bluez/bluetooth.confd  |  7 +++++++
 testing/bluez/bluetooth.initd  | 32 ++++++++++++++++++++++++++++++++
 5 files changed, 87 insertions(+), 3 deletions(-)
 create mode 100644 testing/bluez/bluetooth-conf.d
 create mode 100644 testing/bluez/bluetooth-init.d
 create mode 100644 testing/bluez/bluetooth.confd
 create mode 100644 testing/bluez/bluetooth.initd

diff --git a/testing/bluez/APKBUILD b/testing/bluez/APKBUILD
index 32c9ec97..b8a18a35 100644
--- a/testing/bluez/APKBUILD
+++ b/testing/bluez/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=bluez
 pkgver=4.64
-pkgrel=0
+pkgrel=1
 pkgdesc="Tools for the Bluetooth protocol stack"
 url="http://www.bluez.org/"
 license="GPL2"
@@ -9,7 +9,10 @@ depends=
 makedepends="dbus-dev gstreamer-dev alsa-lib-dev libusb-dev libnl-dev"
 subpackages="$pkgname-dev $pkgname-doc libbluetooth $pkgname-alsa $pkgname-cups
 	$pkgname-netlink"
-source="http://www.kernel.org/pub/linux/bluetooth/$pkgname-$pkgver.tar.bz2"
+source="http://www.kernel.org/pub/linux/bluetooth/$pkgname-$pkgver.tar.bz2
+	bluetooth.initd
+	bluetooth.confd
+	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 build() {
@@ -39,6 +42,8 @@ build() {
 package() {
 	cd "$_builddir"
 	make install DESTDIR="$pkgdir"
+	install -Dm755 "$srcdir"/bluetooth.initd "$pkgdir"/etc/init.d/bluetooth
+	install -Dm644 "$srcdir"/bluetooth.confd "$pkgdir"/etc/conf.d/bluetooth
 }
 
 libbluetooth() {
@@ -67,4 +72,6 @@ netlink() {
 		"$subpkgdir"/usr/lib/bluetooth/plugins
 }
 
-md5sums="d6e60bad937fe72b0bc77e327ee470b0  bluez-4.64.tar.bz2"
+md5sums="d6e60bad937fe72b0bc77e327ee470b0  bluez-4.64.tar.bz2
+66408fb89b05e7ce7e61c4c3c356d2c6  bluetooth.initd
+a159d897a057f4675548327329c4cc22  bluetooth.confd"
diff --git a/testing/bluez/bluetooth-conf.d b/testing/bluez/bluetooth-conf.d
new file mode 100644
index 00000000..b0cc7444
--- /dev/null
+++ b/testing/bluez/bluetooth-conf.d
@@ -0,0 +1,7 @@
+# Bluetooth configuraton file
+
+# Bind rfcomm devices (allowed values are "true" and "false")
+RFCOMM_ENABLE=true
+
+# Config file for rfcomm
+RFCOMM_CONFIG="/etc/bluetooth/rfcomm.conf"
diff --git a/testing/bluez/bluetooth-init.d b/testing/bluez/bluetooth-init.d
new file mode 100644
index 00000000..111902aa
--- /dev/null
+++ b/testing/bluez/bluetooth-init.d
@@ -0,0 +1,31 @@
+#!/sbin/runscript
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-wireless/bluez/files/4.60/bluetooth-init.d,v 1.1 2010/02/01 19:47:46 pacho Exp $
+
+depend() {
+	after coldplug
+	need dbus localmount
+}
+
+start() {
+   	ebegin "Starting Bluetooth"
+
+	udevadm trigger --subsystem-match=bluetooth
+	eend $?
+
+	if [ "${RFCOMM_ENABLE}" = "true" -a -x /usr/bin/rfcomm ]; then
+		if [ -f "${RFCOMM_CONFIG}" ]; then
+			ebegin "    Starting rfcomm"
+			/usr/bin/rfcomm -f "${RFCOMM_CONFIG}" bind all
+			eend $?
+		else
+			ewarn "Not enabling rfcomm because RFCOMM_CONFIG does not exists"
+		fi
+	fi
+}
+
+stop() {
+	ebegin "Shutting down Bluetooth"
+	eend 0
+}
diff --git a/testing/bluez/bluetooth.confd b/testing/bluez/bluetooth.confd
new file mode 100644
index 00000000..b0cc7444
--- /dev/null
+++ b/testing/bluez/bluetooth.confd
@@ -0,0 +1,7 @@
+# Bluetooth configuraton file
+
+# Bind rfcomm devices (allowed values are "true" and "false")
+RFCOMM_ENABLE=true
+
+# Config file for rfcomm
+RFCOMM_CONFIG="/etc/bluetooth/rfcomm.conf"
diff --git a/testing/bluez/bluetooth.initd b/testing/bluez/bluetooth.initd
new file mode 100644
index 00000000..9ec58e97
--- /dev/null
+++ b/testing/bluez/bluetooth.initd
@@ -0,0 +1,32 @@
+#!/sbin/runscript
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-wireless/bluez/files/4.60/bluetooth-init.d,v 1.1 2010/02/01 19:47:46 pacho Exp $
+
+depend() {
+	after coldplug
+	need dbus localmount
+}
+
+start() {
+   	ebegin "Starting Bluetooth"
+
+	if [ -x /sbin/udevadm ]; then
+		udevadm trigger --subsystem-match=bluetooth
+		eend $?
+	fi
+
+	if [ "${RFCOMM_ENABLE}" = "true" -a -x /usr/bin/rfcomm ]; then
+		if [ -f "${RFCOMM_CONFIG}" ]; then
+			/usr/bin/rfcomm -f "${RFCOMM_CONFIG}" bind all
+		else
+			ewarn "Not enabling rfcomm because RFCOMM_CONFIG does not exists"
+		fi
+	fi
+	eend $?
+}
+
+stop() {
+	ebegin "Shutting down Bluetooth"
+	eend 0
+}
-- 
cgit v1.2.3


From c35bfc47c2e5be92706bccde2c603d223dfb1c51 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 08:06:14 +0000
Subject: testing/bluez-firmware: new aport

Firmware for Broadcom BCM203x Blutonium devices
http://www.bluez.org/
---
 testing/bluez-firmware/APKBUILD | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 testing/bluez-firmware/APKBUILD

diff --git a/testing/bluez-firmware/APKBUILD b/testing/bluez-firmware/APKBUILD
new file mode 100644
index 00000000..95e03ae5
--- /dev/null
+++ b/testing/bluez-firmware/APKBUILD
@@ -0,0 +1,22 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=bluez-firmware
+pkgver=1.2
+pkgrel=0
+pkgdesc="Firmware for Broadcom BCM203x Blutonium devices"
+url="http://www.bluez.org/"
+license="GPL2"
+depends=""
+makedepends=""
+source="http://bluez.sf.net/download/$pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir/$pkgname-$pkgver"
+	./configure --libdir=/lib || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="1cc3cefad872e937e05de5a0a2b390dd  bluez-firmware-1.2.tar.gz"
-- 
cgit v1.2.3


From 26be3c6d5f986eee21cd4f7a94d7d0713ed24df6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 08:08:52 +0000
Subject: testing/bluez-hcidump: new aport

Bluetooth HCI package analyzer
http://www.bluez.org/
---
 testing/bluez-hcidump/APKBUILD | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 testing/bluez-hcidump/APKBUILD

diff --git a/testing/bluez-hcidump/APKBUILD b/testing/bluez-hcidump/APKBUILD
new file mode 100644
index 00000000..0ee37d68
--- /dev/null
+++ b/testing/bluez-hcidump/APKBUILD
@@ -0,0 +1,25 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=bluez-hcidump
+pkgver=1.42
+pkgrel=0
+pkgdesc="Bluetooth HCI package analyzer"
+url="http://www.bluez.org/"
+license="GPL2"
+depends=
+makedepends="bluez-dev"
+subpackages="$pkgname-doc"
+source="http://bluez.sf.net/download/$pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--mandir=/usr/share/man \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="5704737aaf72104eeaf77335218a1827  bluez-hcidump-1.42.tar.gz"
-- 
cgit v1.2.3


From b95e47c98a7fa1f9099ef1cc31fb829ef584f13a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 09:19:09 +0000
Subject: main/abuild: upgrade to 2.3

---
 main/abuild/APKBUILD      |  6 +++---
 testing/openobex/APKBUILD | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 testing/openobex/APKBUILD

diff --git a/main/abuild/APKBUILD b/main/abuild/APKBUILD
index 8aed5444..989c7beb 100644
--- a/main/abuild/APKBUILD
+++ b/main/abuild/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgdesc="Script to build Alpine Packages"
 pkgname=abuild
-pkgver=2.2
-pkgrel=1
+pkgver=2.3
+pkgrel=0
 url=http://git.alpinelinux.org/cgit/abuild/
 source="http://git.alpinelinux.org/cgit/abuild/snapshot/abuild-$pkgver.tar.bz2
 	"
@@ -21,4 +21,4 @@ package() {
 	install -m 644 abuild.conf "$pkgdir"/etc/abuild.conf
 }
 
-md5sums="d5f6d5c9df7c7d00e2a26b245b37227d  abuild-2.2.tar.bz2"
+md5sums="7c738e0018202160366b8329ec693502  abuild-2.3.tar.bz2"
diff --git a/testing/openobex/APKBUILD b/testing/openobex/APKBUILD
new file mode 100644
index 00000000..4c83330c
--- /dev/null
+++ b/testing/openobex/APKBUILD
@@ -0,0 +1,34 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=openobex
+pkgver=1.5
+pkgrel=0
+pkgdesc="Implementation of the OBject EXchange (OBEX) protocol"
+url="http://dev.zuckschwerdt.org/openobex/"
+license="GPL LGPL"
+depends=
+makedepends="bluez-dev libusb-dev"
+subpackages="$pkgname-dev libopenobex"
+source="http://www.kernel.org/pub/linux/bluetooth/$pkgname-$pkgver.tar.bz2"
+
+build() {
+	cd "$srcdir/$pkgname-$pkgver"
+	./configure --prefix=/usr \
+		--enable-apps \
+		--enable-irda \
+		--enable-bluetooth \
+		--enable-usb \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
+	make DESTDIR="$pkgdir" install || return 1
+}
+
+libopenobex() {
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/libopenobex.so.* "$subpkgdir"/usr/lib/
+}
+
+md5sums="fce1b82eafb74bde54fe117372393ba8  openobex-1.5.tar.bz2"
-- 
cgit v1.2.3


From 139c5b05dfde86523f53eb18e1e8eee913fe6a89 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 09:28:46 +0000
Subject: testing/libical: new aport

An open source reference implementation of the icalendar data type and serialization format
http://sourceforge.net/projects/freeassociation/
---
 testing/libical/APKBUILD | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 testing/libical/APKBUILD

diff --git a/testing/libical/APKBUILD b/testing/libical/APKBUILD
new file mode 100644
index 00000000..12266221
--- /dev/null
+++ b/testing/libical/APKBUILD
@@ -0,0 +1,26 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=libical
+pkgver=0.44
+pkgrel=0
+pkgdesc="An open source reference implementation of the icalendar data type and serialization format"
+url="http://sourceforge.net/projects/freeassociation/"
+license="LGPL MPL"
+depends=
+makedepends=
+subpackages="$pkgname-dev"
+source="http://downloads.sourceforge.net/freeassociation/$pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--enable-shared \
+		--disable-static \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install
+}
+md5sums="e0403c31e1ed82569325685f8c15959c  libical-0.44.tar.gz"
-- 
cgit v1.2.3


From 55ded0fb5f4b33bb41d28a3af624df28b99089c3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 09:42:07 +0000
Subject: testing/obexd: new aport

D-Bus service providing high-level OBEX client and server side functionality
http://www.bluez.org/
---
 testing/obexd/APKBUILD | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 testing/obexd/APKBUILD

diff --git a/testing/obexd/APKBUILD b/testing/obexd/APKBUILD
new file mode 100644
index 00000000..d6533e89
--- /dev/null
+++ b/testing/obexd/APKBUILD
@@ -0,0 +1,25 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=obexd
+pkgver=0.25
+pkgrel=0
+pkgdesc="D-Bus service providing high-level OBEX client and server side functionality"
+url="http://www.bluez.org/"
+license="GPL2"
+depends=
+makedepends="dbus-glib-dev openobex-dev glib-dev bluez-dev libical-dev"
+source="http://www.kernel.org/pub/linux/bluetooth/$pkgname-$pkgver.tar.bz2"
+
+build () 
+{ 
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--libexecdir=/usr/lib/obexd \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install
+}
+md5sums="d3f7d7bd77564dfb8cda906566ab2638  obexd-0.25.tar.bz2"
-- 
cgit v1.2.3


From 64f514a26ea30945ec91fa965d3667e7c6dd0257 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 09:53:08 +0000
Subject: main/psqlodbc: moved from testing

---
 main/psqlodbc/APKBUILD    | 26 ++++++++++++++++++++++++++
 testing/psqlodbc/APKBUILD | 26 --------------------------
 2 files changed, 26 insertions(+), 26 deletions(-)
 create mode 100644 main/psqlodbc/APKBUILD
 delete mode 100644 testing/psqlodbc/APKBUILD

diff --git a/main/psqlodbc/APKBUILD b/main/psqlodbc/APKBUILD
new file mode 100644
index 00000000..a14579a2
--- /dev/null
+++ b/main/psqlodbc/APKBUILD
@@ -0,0 +1,26 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=psqlodbc
+pkgver=08.04.0200
+pkgrel=2
+pkgdesc="PostgreSQL ODBC driver"
+url="http://www.postgresql.org"
+license="GPL"
+depends=
+makedepends="postgresql-dev unixodbc-dev openssl-dev"
+subpackages="$pkgname-dev"
+source="ftp://ftp2.it.postgresql.org/mirrors/postgres//odbc/versions/src/$pkgname-$pkgver.tar.gz"
+
+_builddir="$srcdir/$pkgname-$pkgver"
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr
+	make || return 1
+}
+
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+md5sums="8296be11d24e3111319826fbaf034066  psqlodbc-08.04.0200.tar.gz"
diff --git a/testing/psqlodbc/APKBUILD b/testing/psqlodbc/APKBUILD
deleted file mode 100644
index a14579a2..00000000
--- a/testing/psqlodbc/APKBUILD
+++ /dev/null
@@ -1,26 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=psqlodbc
-pkgver=08.04.0200
-pkgrel=2
-pkgdesc="PostgreSQL ODBC driver"
-url="http://www.postgresql.org"
-license="GPL"
-depends=
-makedepends="postgresql-dev unixodbc-dev openssl-dev"
-subpackages="$pkgname-dev"
-source="ftp://ftp2.it.postgresql.org/mirrors/postgres//odbc/versions/src/$pkgname-$pkgver.tar.gz"
-
-_builddir="$srcdir/$pkgname-$pkgver"
-
-build() {
-	cd "$_builddir"
-	./configure --prefix=/usr
-	make || return 1
-}
-
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install
-}
-md5sums="8296be11d24e3111319826fbaf034066  psqlodbc-08.04.0200.tar.gz"
-- 
cgit v1.2.3


From d4f5a6a6f4f1ad6f0e0f63c7b4e8379564f5095a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 09:57:46 +0000
Subject: testing/libical: build fix: needs perl

---
 testing/libical/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/libical/APKBUILD b/testing/libical/APKBUILD
index 12266221..22ef9678 100644
--- a/testing/libical/APKBUILD
+++ b/testing/libical/APKBUILD
@@ -6,7 +6,7 @@ pkgdesc="An open source reference implementation of the icalendar data type and
 url="http://sourceforge.net/projects/freeassociation/"
 license="LGPL MPL"
 depends=
-makedepends=
+makedepends="perl"
 subpackages="$pkgname-dev"
 source="http://downloads.sourceforge.net/freeassociation/$pkgname-$pkgver.tar.gz"
 
-- 
cgit v1.2.3


From c6eeea4b4e742ac3213ab4a601a3957894782646 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:32:07 +0000
Subject: main/gmp5: upgrade gmp to 5.0.1

---
 main/gmp5/APKBUILD                    | 47 +++++++++++++++++++++++++++++++++++
 main/gmp5/gmp-4.1.4-noexecstack.patch | 20 +++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 main/gmp5/APKBUILD
 create mode 100644 main/gmp5/gmp-4.1.4-noexecstack.patch

diff --git a/main/gmp5/APKBUILD b/main/gmp5/APKBUILD
new file mode 100644
index 00000000..c2a4ad6f
--- /dev/null
+++ b/main/gmp5/APKBUILD
@@ -0,0 +1,47 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+_name=gmp
+pkgname=${_name}5
+
+pkgver=5.0.1
+pkgrel=0
+pkgdesc="A free library for arbitrary precision arithmetic"
+url="http://gmplib.org/"
+license="LGPL3"
+makedepends="m4 texinfo"
+depends=
+subpackages="$pkgname-doc $pkgname-dev"
+source="ftp://ftp.gnu.org/gnu/gmp/gmp-$pkgver.tar.bz2
+	gmp-4.1.4-noexecstack.patch
+	"
+
+_builddir="$srcdir"/$_name-$pkgver
+build() {
+	cd "$_builddir"
+	patch -p1 < "$srcdir"/gmp-4.1.4-noexecstack.patch || return 1 
+
+	ABI="32" ./configure --prefix=/usr \
+		--build=${CHOST} \
+		--infodir=/usr/share/info \
+		--mandir=/usr/share/man \
+		--localstatedir=/var/state/gmp \
+		--disable-mpfr \
+		--disable-mpbsd \
+		--disable-cxx  \
+		--with-pic \
+		|| return 1
+
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make -j1 DESTDIR="${pkgdir}" install || return 1
+}
+
+dev() {
+	replaces="gmp"
+	default_dev
+}
+
+md5sums="6bac6df75c192a13419dfd71d19240a7  gmp-5.0.1.tar.bz2
+13c34f00e77ded6673270cfea06c35c3  gmp-4.1.4-noexecstack.patch"
diff --git a/main/gmp5/gmp-4.1.4-noexecstack.patch b/main/gmp5/gmp-4.1.4-noexecstack.patch
new file mode 100644
index 00000000..093bec1a
--- /dev/null
+++ b/main/gmp5/gmp-4.1.4-noexecstack.patch
@@ -0,0 +1,20 @@
+fixed executable stack
+
+http://bugs.gentoo.org/115038
+
+--- gmp-4.1.4/configure
++++ gmp-4.1.4/configure
+@@ -21689,6 +21689,13 @@
+ fi
+ echo "')" >> $gmp_configm4
+ echo "define(\`__CONFIG_M4_INCLUDED__')" >> $gmp_configm4
++# Gentoo hack
++case $host_os in
++	*linux*)
++		echo '.section .note.GNU-stack,"",%progbits' >> $gmp_configm4
++		echo '.previous' >> $gmp_configm4
++		;;
++esac
+ 
+ # Create Makefiles
+ # FIXME: Upcoming version of autoconf/automake may not like broken lines.
-- 
cgit v1.2.3


From 0265c02eb1711c2ae56e4e1a8fd330bd94fe9f26 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:32:45 +0000
Subject: main/mpfr: rebuild against gmp5

---
 main/mpfr/APKBUILD | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/main/mpfr/APKBUILD b/main/mpfr/APKBUILD
index 92367632..e2d92d12 100644
--- a/main/mpfr/APKBUILD
+++ b/main/mpfr/APKBUILD
@@ -1,19 +1,18 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mpfr
 pkgver=2.4.2
-pkgrel=1
+pkgrel=2
 pkgdesc="multiple-precision floating-point library"
 url="http://www.mpfr.org/"
 license="GPL LGPL"
 depends=
-makedepends="gmp-dev texinfo"
+makedepends="gmp5-dev texinfo"
 source="http://www.mpfr.org/mpfr-current/mpfr-$pkgver.tar.bz2"
 subpackages="$pkgname-doc $pkgname-dev"
 
 build() { 
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
-		--disable-thread-safe \
 		--enable-shared || return 1;
 	make || return 1;
 }
@@ -22,4 +21,9 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="${pkgdir}" install || return 1;
 }
+
+dev() {
+	replaces=mpfr
+	default_dev
+}
 md5sums="89e59fe665e2b3ad44a6789f40b059a0  mpfr-2.4.2.tar.bz2"
-- 
cgit v1.2.3


From 441b7bd9acace99104df7342f02bbb1352c50470 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:33:06 +0000
Subject: main/gcc: rebuild against gmp5

---
 main/gcc/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/gcc/APKBUILD b/main/gcc/APKBUILD
index f1d8c836..4668a068 100644
--- a/main/gcc/APKBUILD
+++ b/main/gcc/APKBUILD
@@ -6,12 +6,12 @@ _specsver=0.1.7
 _espfver=0.3.6
 _uclibc_abiver=0.9.32
 
-pkgrel=2
+pkgrel=3
 pkgdesc="The GNU Compiler Collection"
 url="http://gcc.gnu.org"
 license="GPL LGPL"
 depends="binutils libgcc libgomp"
-makedepends="bison flex gmp-dev mpfr-dev texinfo"
+makedepends="bison flex gmp5-dev mpfr-dev texinfo"
 subpackages="$pkgname-doc libstdc++:libcxx g++:gpp libgcc libgomp"
 source="ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-core-$pkgver.tar.bz2
 	ftp://gcc.gnu.org/pub/gcc/releases/gcc-$pkgver/gcc-g++-$pkgver.tar.bz2
-- 
cgit v1.2.3


From 26fa467fd03461609c57504d44fe8de6f2b8b809 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:33:40 +0000
Subject: main/guile: rebuild against gmp5

---
 main/guile/APKBUILD | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/main/guile/APKBUILD b/main/guile/APKBUILD
index e09000f4..8850b0f1 100644
--- a/main/guile/APKBUILD
+++ b/main/guile/APKBUILD
@@ -1,22 +1,25 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=guile
 pkgver=1.8.7
-pkgrel=1
+pkgrel=2
 pkgdesc="Guile is a portable, embeddable Scheme implementation written in C"
 url="http://www.gnu.org/software/guile/"
 license="GPL"
 subpackages="$pkgname-dev $pkgname-doc"
-makedepends="gmp-dev libtool ncurses-dev texinfo"
+makedepends="gmp5-dev libtool ncurses-dev texinfo"
 depends=
 install=
 source="ftp://ftp.gnu.org/pub/gnu/$pkgname/$pkgname-$pkgver.tar.gz"
 
-build ()
-{
+build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
 		--disable-error-on-warning || return 1
 	make LDFLAGS+="-lpthread" || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-- 
cgit v1.2.3


From 4193e11fe7f5019eca0e92f648728ba0781ddd62 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:33:50 +0000
Subject: main/php: rebuild against gmp5

---
 main/php/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/php/APKBUILD b/main/php/APKBUILD
index 8bd5fb8b..7c044c8c 100644
--- a/main/php/APKBUILD
+++ b/main/php/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=php
 pkgver=5.3.2
 _suhosinver=${pkgver}-0.9.9.1
-pkgrel=5
+pkgrel=6
 pkgdesc="The PHP language runtime engine"
 url="http://www.php.net/"
 license="PHP-3"
@@ -12,7 +12,7 @@ install="$pkgname.post-upgrade"
 makedepends="pcre-dev libxml2-dev libiconv-dev openssl-dev zlib-dev bzip2-dev
 	curl-dev libpng-dev jpeg-dev freetype-dev libmcrypt-dev mysql-dev
 	sqlite-dev libtool libltdl postgresql-dev db-dev unixodbc-dev icu-dev
-	gd-dev gmp-dev gettext-dev imap-dev aspell-dev
+	gd-dev gmp5-dev gettext-dev imap-dev aspell-dev
 	net-snmp-dev libxslt-dev cyrus-sasl-dev openldap-dev pkgconfig
 	libgcrypt-dev"
 subpackages="$pkgname-dev $pkgname-doc $pkgname-cli $pkgname-pear
-- 
cgit v1.2.3


From 79bb0e89fb713c82e64f64827f354e61df0a559c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 13:37:22 +0000
Subject: testing/pycrypto: rebuild against gmp5

---
 testing/pycrypto/APKBUILD | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/testing/pycrypto/APKBUILD b/testing/pycrypto/APKBUILD
index 7bc5eb0b..f5a48e75 100644
--- a/testing/pycrypto/APKBUILD
+++ b/testing/pycrypto/APKBUILD
@@ -1,17 +1,22 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pycrypto
 pkgver=2.0.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A collection of cryptographic algorithms and protocols, implemented for use from Python."
 url="http://www.amk.ca/python/code/crypto.html"
 license="GPL"
 depends="python"
-makedepends="gmp-dev python-dev"
+makedepends="gmp5-dev python-dev"
 source="http://www.amk.ca/files/python/crypto/$pkgname-$pkgver.tar.gz"
 
 build ()
 {
 	cd "$srcdir"/$pkgname-$pkgver
-	python setup.py build install --root="$pkgdir"
+	python setup.py build 
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	python setup.py install --root="$pkgdir"
 }
 md5sums="4d5674f3898a573691ffb335e8d749cd  pycrypto-2.0.1.tar.gz"
-- 
cgit v1.2.3


From 8c1128e93e03012dabadb9a3f723dbd20eb60cd4 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 15:43:11 +0000
Subject: main/ffmpeg: rebuild against new x264

---
 main/ffmpeg/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main/ffmpeg/APKBUILD b/main/ffmpeg/APKBUILD
index 5f3e0d94..840d01f6 100644
--- a/main/ffmpeg/APKBUILD
+++ b/main/ffmpeg/APKBUILD
@@ -2,7 +2,7 @@
 pkgname=ffmpeg
 _svnrev=30526
 pkgver=0.5_svn$_svnrev
-pkgrel=2
+pkgrel=3
 pkgdesc="Complete and free Internet live audio and video broadcasting solution for Linux/Unix"
 url="http://ffmpeg.mplayerhq.hu/"
 license="GPL"
-- 
cgit v1.2.3


From 7c31307340cff7d0b391b68c94aca8491e8cadb9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 18:26:22 +0000
Subject: testing/cabextract: new aport

A program to extract Microsoft cabinet (.CAB) files.
http://www.cabextract.org.uk/
---
 testing/cabextract/APKBUILD | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 testing/cabextract/APKBUILD

diff --git a/testing/cabextract/APKBUILD b/testing/cabextract/APKBUILD
new file mode 100644
index 00000000..56327b3f
--- /dev/null
+++ b/testing/cabextract/APKBUILD
@@ -0,0 +1,25 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=cabextract
+pkgver=1.2
+pkgrel=0
+pkgdesc="A program to extract Microsoft cabinet (.CAB) files."
+url="http://www.cabextract.org.uk/"
+license="GPL"
+depends=
+makedepends=
+source="http://www.$pkgname.org.uk/$pkgname-$pkgver.tar.gz"
+
+build () {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR=""$pkgdir"" install || return 1
+}
+md5sums="dc421a690648b503265c82ade84e143e  cabextract-1.2.tar.gz"
-- 
cgit v1.2.3


From 9a89b9987c335375fdcd7d186c389d32552d068c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 19 May 2010 19:49:02 +0000
Subject: main/libc0.9.32: add the ldd segfautl fix

---
 main/libc0.9.32/0001-ldd-segfault-fix.patch | 49 +++++++++++++++++++++++++++++
 main/libc0.9.32/APKBUILD                    |  4 ++-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 main/libc0.9.32/0001-ldd-segfault-fix.patch

diff --git a/main/libc0.9.32/0001-ldd-segfault-fix.patch b/main/libc0.9.32/0001-ldd-segfault-fix.patch
new file mode 100644
index 00000000..4384fa54
--- /dev/null
+++ b/main/libc0.9.32/0001-ldd-segfault-fix.patch
@@ -0,0 +1,49 @@
+From f29b6882327573ec4e694c1c852307c957d544b9 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Tue, 5 May 2009 14:10:42 +0000
+Subject: [PATCH] ldd segfault fix
+
+Fixes ldd segfault on this testcase:
+
+extern void _dl_getenv(void);
+void foo(void)
+{
+	printf("foo: %x\n", &_dl_getenv);
+}
+
+linked as -shared
+---
+ utils/ldd.c |    8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/utils/ldd.c b/utils/ldd.c
+index 1f1dc25..2cd173c 100644
+--- a/utils/ldd.c
++++ b/utils/ldd.c
+@@ -576,18 +576,20 @@ static struct library *find_elf_interpreter(ElfW(Ehdr) *ehdr)
+ 				}
+ 				newlib->name = NULL;
+ 				newlib->path = NULL;
+-				return NULL;
++				break;
+ 			}
+ 		}
+-		if (newlib == NULL)
++		if (newlib == NULL) {
+ 			newlib = malloc(sizeof(struct library));
++			if (newlib)
++				newlib->next = NULL;
++		}
+ 		if (!newlib)
+ 			return NULL;
+ 		newlib->name = malloc(strlen(s) + 1);
+ 		strcpy(newlib->name, s);
+ 		newlib->path = strdup(newlib->name);
+ 		newlib->resolved = 1;
+-		newlib->next = NULL;
+ 
+ #if 0
+ 		/*printf("find_elf_interpreter is adding '%s' to '%s'\n", newlib->name, newlib->path); */
+-- 
+1.6.2.3
+
diff --git a/main/libc0.9.32/APKBUILD b/main/libc0.9.32/APKBUILD
index 47bc5862..0b7751f3 100644
--- a/main/libc0.9.32/APKBUILD
+++ b/main/libc0.9.32/APKBUILD
@@ -3,7 +3,7 @@ _abiver=0.9.32
 pkgname=libc$_abiver
 _gitver=100507
 pkgver=${_abiver}_alpha0_git$_gitver
-pkgrel=2
+pkgrel=3
 pkgdesc="C library for developing embedded Linux systems"
 url=http://uclibc.org
 license="LGPL-2"
@@ -17,6 +17,7 @@ _snapurl="http://git.uclibc.org/uClibc/snapshot/master.tar.bz2"
 _snapfile="$pkgname-$pkgver.tar.bz2"
 source="http://build.alpinelinux.org:8010/distfiles/$_snapfile
 	compat-stack-guard.patch
+	0001-ldd-segfault-fix.patch
 	0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 	0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 	uclibc-libm-pic.patch
@@ -96,6 +97,7 @@ utils() {
 
 md5sums="46e98672dc2a4309d9a7c65b4e626845  libc0.9.32-0.9.32_alpha0_git100507.tar.bz2
 4d408f72142ce55a0754948cc9cfe447  compat-stack-guard.patch
+4079b20c763727863bc53408e4988434  0001-ldd-segfault-fix.patch
 826666b365f2d63a71d67eb76c94f7bc  0001-static-build-fix-internal-locking-weaks-to-get-pulle.patch
 0800a489a738c7b1d8c3643cb9806926  0002-resolv-various-memory-corruption-and-off-by-one-fixe.patch
 2f9739a980be24a842c57516155c7885  uclibc-libm-pic.patch
-- 
cgit v1.2.3


From f1cb432df524a548d0bc765c63113bbaa140e77d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 05:58:30 +0000
Subject: main/gst-ffmpeg: moved to dir corresponing to pkgname

---
 main/gst-ffmpeg/APKBUILD         | 32 ++++++++++++++++++++++++++++++++
 main/gst-plugins-ffmpeg/APKBUILD | 32 --------------------------------
 2 files changed, 32 insertions(+), 32 deletions(-)
 create mode 100644 main/gst-ffmpeg/APKBUILD
 delete mode 100644 main/gst-plugins-ffmpeg/APKBUILD

diff --git a/main/gst-ffmpeg/APKBUILD b/main/gst-ffmpeg/APKBUILD
new file mode 100644
index 00000000..c6fc5e04
--- /dev/null
+++ b/main/gst-ffmpeg/APKBUILD
@@ -0,0 +1,32 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gst-ffmpeg
+pkgver=0.10.7
+pkgrel=1
+pkgdesc="Gstreamer FFMpeg Plugin"
+url="http://www.gstreamer.net"
+license="GPL"
+makedepends="gstreamer-dev gst-plugins-base-dev liboil-dev ffmpeg-dev"
+source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.bz2"
+
+build ()
+{
+	cd "$srcdir"/gst-ffmpeg-$pkgver
+	sed -i \
+		-e 's,ffmpeg/avformat.h,libavformat/avformat.h,' \
+		-e 's,ffmpeg/avcodec.h,libavcodec/avcodec.h,' \
+		-e 's,ffmpeg/swscale.h,libswscale/swscale.h,' \
+		ext/ffmpeg/gst*	\
+		ext/libpostproc/gstpostproc.c \
+		|| return 1
+
+	export CFLAGS="$CFLAGS -fno-strict-aliasing"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--with-system-ffmpeg \
+		--localstatedir=/var || return 1
+	make || return 1
+	make DESTDIR="$pkgdir" install || return 1
+	rm -f "$pkgdir"/usr/lib/gstreamer-0.10/*.{l,}a
+}
+
+md5sums="6be89b26592f36ef631b22a68b8e06c4  gst-ffmpeg-0.10.7.tar.bz2"
diff --git a/main/gst-plugins-ffmpeg/APKBUILD b/main/gst-plugins-ffmpeg/APKBUILD
deleted file mode 100644
index c6fc5e04..00000000
--- a/main/gst-plugins-ffmpeg/APKBUILD
+++ /dev/null
@@ -1,32 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=gst-ffmpeg
-pkgver=0.10.7
-pkgrel=1
-pkgdesc="Gstreamer FFMpeg Plugin"
-url="http://www.gstreamer.net"
-license="GPL"
-makedepends="gstreamer-dev gst-plugins-base-dev liboil-dev ffmpeg-dev"
-source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.bz2"
-
-build ()
-{
-	cd "$srcdir"/gst-ffmpeg-$pkgver
-	sed -i \
-		-e 's,ffmpeg/avformat.h,libavformat/avformat.h,' \
-		-e 's,ffmpeg/avcodec.h,libavcodec/avcodec.h,' \
-		-e 's,ffmpeg/swscale.h,libswscale/swscale.h,' \
-		ext/ffmpeg/gst*	\
-		ext/libpostproc/gstpostproc.c \
-		|| return 1
-
-	export CFLAGS="$CFLAGS -fno-strict-aliasing"
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--with-system-ffmpeg \
-		--localstatedir=/var || return 1
-	make || return 1
-	make DESTDIR="$pkgdir" install || return 1
-	rm -f "$pkgdir"/usr/lib/gstreamer-0.10/*.{l,}a
-}
-
-md5sums="6be89b26592f36ef631b22a68b8e06c4  gst-ffmpeg-0.10.7.tar.bz2"
-- 
cgit v1.2.3


From eb88bee664a60e5d30b2103212493a352b796ed1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 06:04:26 +0000
Subject: main/gst-ffmpeg: upgrade to 0.10.10

---
 main/gst-ffmpeg/APKBUILD | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/main/gst-ffmpeg/APKBUILD b/main/gst-ffmpeg/APKBUILD
index c6fc5e04..739f2e48 100644
--- a/main/gst-ffmpeg/APKBUILD
+++ b/main/gst-ffmpeg/APKBUILD
@@ -1,15 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-ffmpeg
-pkgver=0.10.7
-pkgrel=1
+pkgver=0.10.10
+pkgrel=0
 pkgdesc="Gstreamer FFMpeg Plugin"
 url="http://www.gstreamer.net"
 license="GPL"
 makedepends="gstreamer-dev gst-plugins-base-dev liboil-dev ffmpeg-dev"
 source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.bz2"
 
-build ()
-{
+build() {
 	cd "$srcdir"/gst-ffmpeg-$pkgver
 	sed -i \
 		-e 's,ffmpeg/avformat.h,libavformat/avformat.h,' \
@@ -25,8 +24,12 @@ build ()
 		--with-system-ffmpeg \
 		--localstatedir=/var || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/gst-ffmpeg-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 	rm -f "$pkgdir"/usr/lib/gstreamer-0.10/*.{l,}a
 }
 
-md5sums="6be89b26592f36ef631b22a68b8e06c4  gst-ffmpeg-0.10.7.tar.bz2"
+md5sums="447292deff5f3748444e6a5fba41da29  gst-ffmpeg-0.10.10.tar.bz2"
-- 
cgit v1.2.3


From 0e64b190eb202c2a09d3ad0c80296d3f25cad5bb Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 07:00:55 +0000
Subject: testing/cabextract: removed

was already in main
---
 testing/cabextract/APKBUILD | 25 -------------------------
 1 file changed, 25 deletions(-)
 delete mode 100644 testing/cabextract/APKBUILD

diff --git a/testing/cabextract/APKBUILD b/testing/cabextract/APKBUILD
deleted file mode 100644
index 56327b3f..00000000
--- a/testing/cabextract/APKBUILD
+++ /dev/null
@@ -1,25 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=cabextract
-pkgver=1.2
-pkgrel=0
-pkgdesc="A program to extract Microsoft cabinet (.CAB) files."
-url="http://www.cabextract.org.uk/"
-license="GPL"
-depends=
-makedepends=
-source="http://www.$pkgname.org.uk/$pkgname-$pkgver.tar.gz"
-
-build () {
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--mandir=/usr/share/man \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR=""$pkgdir"" install || return 1
-}
-md5sums="dc421a690648b503265c82ade84e143e  cabextract-1.2.tar.gz"
-- 
cgit v1.2.3


From 2fa58d39ed8589c17c46e87b1745481eb4b43232 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 07:51:38 +0000
Subject: main/gst-ffmpeg: use internal ffmpeg instead of external

---
 main/gst-ffmpeg/APKBUILD | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/main/gst-ffmpeg/APKBUILD b/main/gst-ffmpeg/APKBUILD
index 739f2e48..d9441e8c 100644
--- a/main/gst-ffmpeg/APKBUILD
+++ b/main/gst-ffmpeg/APKBUILD
@@ -1,28 +1,20 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-ffmpeg
 pkgver=0.10.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Gstreamer FFMpeg Plugin"
 url="http://www.gstreamer.net"
 license="GPL"
-makedepends="gstreamer-dev gst-plugins-base-dev liboil-dev ffmpeg-dev"
+makedepends="gstreamer-dev gst-plugins-base-dev liboil-dev coreutils"
 source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.bz2"
 
 build() {
 	cd "$srcdir"/gst-ffmpeg-$pkgver
-	sed -i \
-		-e 's,ffmpeg/avformat.h,libavformat/avformat.h,' \
-		-e 's,ffmpeg/avcodec.h,libavcodec/avcodec.h,' \
-		-e 's,ffmpeg/swscale.h,libswscale/swscale.h,' \
-		ext/ffmpeg/gst*	\
-		ext/libpostproc/gstpostproc.c \
-		|| return 1
-
 	export CFLAGS="$CFLAGS -fno-strict-aliasing"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
-		--with-system-ffmpeg \
-		--localstatedir=/var || return 1
+		--localstatedir=/var \
+		--with-ffmpeg-extra-configure="--enable-pic --disable-mmx --disable-mmx2" || return 1
 	make || return 1
 }
 
-- 
cgit v1.2.3


From ebfda1dde1e15573926b9bd83cae8648c201c85a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 08:08:56 +0000
Subject: main/gst-ffmpeg: disable PIC so we get the mmx stuff

---
 main/gst-ffmpeg/APKBUILD | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/main/gst-ffmpeg/APKBUILD b/main/gst-ffmpeg/APKBUILD
index d9441e8c..f376e83c 100644
--- a/main/gst-ffmpeg/APKBUILD
+++ b/main/gst-ffmpeg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-ffmpeg
 pkgver=0.10.10
-pkgrel=1
+pkgrel=2
 pkgdesc="Gstreamer FFMpeg Plugin"
 url="http://www.gstreamer.net"
 license="GPL"
@@ -10,11 +10,12 @@ source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.b
 
 build() {
 	cd "$srcdir"/gst-ffmpeg-$pkgver
-	export CFLAGS="$CFLAGS -fno-strict-aliasing"
+	export CFLAGS="$CFLAGS -fno-strict-aliasing -fno-PIC"
+	export LDFLAGS="$LDFLAGS -nopie"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--localstatedir=/var \
-		--with-ffmpeg-extra-configure="--enable-pic --disable-mmx --disable-mmx2" || return 1
+		|| return 1
 	make || return 1
 }
 
-- 
cgit v1.2.3


From 81b36fe36dd99216711c14b4867ec035d9030cc6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 08:17:05 +0000
Subject: Revert "main/gst-ffmpeg: disable PIC so we get the mmx stuff"

This reverts commit ebfda1dde1e15573926b9bd83cae8648c201c85a.
---
 main/gst-ffmpeg/APKBUILD | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/main/gst-ffmpeg/APKBUILD b/main/gst-ffmpeg/APKBUILD
index f376e83c..e27d02a6 100644
--- a/main/gst-ffmpeg/APKBUILD
+++ b/main/gst-ffmpeg/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gst-ffmpeg
 pkgver=0.10.10
-pkgrel=2
+pkgrel=3
 pkgdesc="Gstreamer FFMpeg Plugin"
 url="http://www.gstreamer.net"
 license="GPL"
@@ -10,12 +10,11 @@ source="http://gstreamer.freedesktop.org/src/gst-ffmpeg/gst-ffmpeg-$pkgver.tar.b
 
 build() {
 	cd "$srcdir"/gst-ffmpeg-$pkgver
-	export CFLAGS="$CFLAGS -fno-strict-aliasing -fno-PIC"
-	export LDFLAGS="$LDFLAGS -nopie"
+	export CFLAGS="$CFLAGS -fno-strict-aliasing"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--localstatedir=/var \
-		|| return 1
+		--with-ffmpeg-extra-configure="--enable-pic --disable-mmx --disable-mmx2" || return 1
 	make || return 1
 }
 
-- 
cgit v1.2.3


From 40446c186e93955efa055fb9dade491966e1cfe5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 09:53:03 +0000
Subject: testing/kamailio: upgrade to 3.0.1

---
 testing/kamailio/APKBUILD                   | 20 ++++++++--------
 testing/kamailio/kamailio-3-backslash.patch | 36 +++++++++++++++++++++++++++++
 testing/kamailio/kamailio-backslash.patch   | 15 ------------
 3 files changed, 47 insertions(+), 24 deletions(-)
 create mode 100644 testing/kamailio/kamailio-3-backslash.patch
 delete mode 100644 testing/kamailio/kamailio-backslash.patch

diff --git a/testing/kamailio/APKBUILD b/testing/kamailio/APKBUILD
index 604796d5..d113912c 100644
--- a/testing/kamailio/APKBUILD
+++ b/testing/kamailio/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Michael Mason <ms13sp@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=kamailio
-pkgver=3.0.0
-pkgrel=2
+pkgver=3.0.1
+pkgrel=0
 pkgdesc="Open Source SIP Server"
 url="http://www.kamailio.org/"
 pkgusers="kamailio"
@@ -14,25 +14,27 @@ makedepends="bison flex expat-dev postgresql-dev pcre-dev
 install=
 subpackages="$pkgname-doc $pkgname-postgres 
 	$pkgname-mediaproxy $pkgname-unixodbc"
-source="http://sip-router.org/tarballs/sr/kamailio_3.0/kamailio-${pkgver}_src_2010-01-12_6d1e9f.tar.gz
+source="http://www.kamailio.org/pub/kamailio/$pkgver/src/kamailio-${pkgver}_src.tar.gz
 	kamailio.cfg
 	kamailio.initd
 	kamailio.pre-install
 	kamailio.post-install
-	kamailio-backslash.patch
+	kamailio-3-backslash.patch
 	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 -i "$srcdir"/kamailio-backslash.patch || return 1
+	patch -p1 -i "$srcdir"/kamailio-3-backslash.patch || return 1
 
-	sed -i -e 's:^cfg-target.*:cfg-target = $(cfg-dir):' \
-		-e 's:^cfg-prefix.*:cfg-prefix = $(basedir):' \
+	sed -i \
 		-e "s:-O9 -funroll-loops:$CFLAGS:g" \
 		Makefile.defs \
 		|| return 1
 
+#		-e 's:^cfg-target.*:cfg-target = $(cfg-dir):' \
+#		-e 's:^cfg-prefix.*:cfg-prefix = $(basedir):' \
+
 	cd utils/kamctl/
 	sed -i -e 's:/var/run/kamailio.pid:/var/run/kamailio/kamailio.pid:g' \
 		kamctl.base kamctlrc || return 1
@@ -141,9 +143,9 @@ unixodbc() {
 	_mv_mod_k db_unixodbc
 }
 
-md5sums="a043944e195338d56bdfdcd6c86a468b  kamailio-3.0.0_src_2010-01-12_6d1e9f.tar.gz
+md5sums="c0e488ab240f9a4668c10068e3fb2cae  kamailio-3.0.1_src.tar.gz
 eb665248ee39cf755a247286affc5cbb  kamailio.cfg
 81100c479890a2a8c2628db22fdd1a0c  kamailio.initd
 c646af2dd31f5c4289a2f802c873d98f  kamailio.pre-install
 3fbaf633ff1620d0d526fc4047c7bed9  kamailio.post-install
-10f8be110985a841dd5b892f86eb6722  kamailio-backslash.patch"
+36f81be3a082a81497e261ac8e6c5414  kamailio-3-backslash.patch"
diff --git a/testing/kamailio/kamailio-3-backslash.patch b/testing/kamailio/kamailio-3-backslash.patch
new file mode 100644
index 00000000..f132aeba
--- /dev/null
+++ b/testing/kamailio/kamailio-3-backslash.patch
@@ -0,0 +1,36 @@
+diff --git a/scripts/kamdbctl.base b/scripts/kamdbctl.base
+index 83f5a8a..5b640be 100644
+--- a/utils/kamctl/kamdbctl.base
++++ b/utils/kamctl/kamdbctl.base
+@@ -32,13 +32,13 @@ INSTALL_PRESENCE_TABLES=${INSTALL_PRESENCE_TABLES:-ask}
+ 
+ # Used by dbtext and db_berkeley to define tables to be created, used by
+ # postgres to do the grants
+-STANDARD_TABLES=${STANDARD_TABLES:-version acc dbaliases lcr domain grp
+-		uri speed_dial gw pdt subscriber location re_grp trusted
+-		address missed_calls usr_preferences aliases silo dialog
++STANDARD_TABLES=${STANDARD_TABLES:-version acc dbaliases lcr domain grp \
++		uri speed_dial gw pdt subscriber location re_grp trusted \
++		address missed_calls usr_preferences aliases silo dialog \
+ 		dispatcher dialplan}
+-EXTRA_TABLES=${EXTRA_TABLES:-imc_members imc_rooms cpl sip_trace domainpolicy carrierroute
++EXTRA_TABLES=${EXTRA_TABLES:-imc_members imc_rooms cpl sip_trace domainpolicy carrierroute \
+ 		carrier_name domain_name carrierfailureroute userblacklist globalblacklist htable purplemap}
+-PRESENCE_TABLES=${PRESENCE_TABLES:-presentity active_watchers watchers xcap 
++PRESENCE_TABLES=${PRESENCE_TABLES:-presentity active_watchers watchers xcap \
+ 		pua rls_presentity rls_watchers}
+ 
+ # SQL definitions
+@@ -61,9 +61,9 @@ GREP=${GREP:-grep}
+ SED=${SED:-sed}
+ 
+ # define what modules should be installed
+-STANDARD_MODULES=${STANDARD_MODULES:-standard acc lcr domain group permissions
+-				     registrar usrloc msilo alias_db uri_db
+-				     speeddial avpops auth_db pdt dialog dispatcher
++STANDARD_MODULES=${STANDARD_MODULES:-standard acc lcr domain group permissions \
++				     registrar usrloc msilo alias_db uri_db \
++				     speeddial avpops auth_db pdt dialog dispatcher \
+ 				     dialplan}
+ EXTRA_MODULES=${EXTRA_MODULES:-imc cpl siptrace domainpolicy carrierroute userblacklist htable purple}
+ 
diff --git a/testing/kamailio/kamailio-backslash.patch b/testing/kamailio/kamailio-backslash.patch
deleted file mode 100644
index c474db38..00000000
--- a/testing/kamailio/kamailio-backslash.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/utils/kamctl/kamdbctl.base	Tue Dec 22 07:01:57 2009
-+++ b/utils/kamctl/kamdbctl.base	Tue Dec 22 07:02:26 2009
-@@ -32,9 +32,9 @@
- 
- # Used by dbtext and db_berkeley to define tables to be created, used by
- # postgres to do the grants
--STANDARD_TABLES=${STANDARD_TABLES:-version acc dbaliases lcr domain grp
--		uri speed_dial gw pdt subscriber location re_grp trusted
--		address missed_calls usr_preferences aliases silo dialog
-+STANDARD_TABLES=${STANDARD_TABLES:-version acc dbaliases lcr domain grp \
-+		uri speed_dial gw pdt subscriber location re_grp trusted \
-+		address missed_calls usr_preferences aliases silo dialog \
- 		dispatcher dialplan}
- EXTRA_TABLES=${EXTRA_TABLES:-imc_members imc_rooms cpl sip_trace domainpolicy carrierroute
- 		carrier_name domain_name carrierfailureroute userblacklist globalblacklist htable purplemap}
-- 
cgit v1.2.3


From 96ee98c664e964f813ea011974413a2fcf0c516d Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:22:36 +0000
Subject: testing/openxcap: new aport

---
 testing/openxcap/APKBUILD       |  36 ++++++++++++
 testing/openxcap/config.ini     | 118 ++++++++++++++++++++++++++++++++++++++++
 testing/openxcap/openxcap.initd |  23 ++++++++
 3 files changed, 177 insertions(+)
 create mode 100644 testing/openxcap/APKBUILD
 create mode 100644 testing/openxcap/config.ini
 create mode 100644 testing/openxcap/openxcap.initd

diff --git a/testing/openxcap/APKBUILD b/testing/openxcap/APKBUILD
new file mode 100644
index 00000000..c0650283
--- /dev/null
+++ b/testing/openxcap/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=openxcap
+pkgver=1.2.0
+pkgrel=2
+pkgdesc="Open source fully featured XCAP server "
+url="http://openxcap.org"
+pkgusers="openxcap"
+pkggroups="openxcap"
+license="GPL"
+depends="python python-application python-gnutls twisted twisted-web2 python-imaging python-lxml python-mysqldb"
+makedepends="python-dev"
+install="$pkgname.pre-install $pkgname.post-install"
+source="http://download.ag-projects.com/XCAP/$pkgname-$pkgver.tar.gz
+	config.ini
+	openxcap.initd
+"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	
+	python setup.py install --root="$pkgdir" || return 1
+	
+	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" \
+		> "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
+
+	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+        install -d -o openxcap "$pkgdir"/var/run/openxcap
+}
+
+md5sums="ec34570deee2019a1ebf9a012a476c26  openxcap-1.2.0.tar.gz
+7a18872843586717eaf3879444cc13d2  config.ini
+dad5f337c29c9e245846d9991d057b6e  openxcap.initd"
diff --git a/testing/openxcap/config.ini b/testing/openxcap/config.ini
new file mode 100644
index 00000000..bcf5b22f
--- /dev/null
+++ b/testing/openxcap/config.ini
@@ -0,0 +1,118 @@
+;
+; Configuration file for OpenXCAP
+;
+; The values in the commented lines represent the defaults built in the
+; server software
+;
+[Server]
+
+; IP address to listen for requests
+; 0.0.0.0 means any address of this host
+
+; address = 0.0.0.0
+
+; This is a comma separated list of XCAP root URIs. The first is the
+; primary XCAP root URI, while the others (if specified) are aliases.
+; The primary root URI is used when generating xcap-diff
+; If the scheme is https, then the server will listen for requests in TLS mode.
+
+root = http://xcap.example.com/xcap-root
+
+; The backend to be used for storage and authentication. Current supported
+; values are Database and OpenSIPS. OpenSIPS backend inherits all the settings
+; from the Database backend but performs extra actions related to the
+; integration with OpenSIPS for which it read the settings from [OpenSIPS]
+; section
+
+backend = OpenSIPS
+
+; Validate XCAP documents against XML schemas
+
+; document_validation = Yes
+
+
+[Logging]
+
+; Start, stop and major server error messages are always logged to syslog.
+
+; This section can be used to log more details about XCAP clients accessing
+; the server. The values in the commented lines represent the defaults built 
+; in the server software
+
+; Directory where to write access.log file that will contain requests and/or
+; responses to OpenXCAP server in Apache style. If set to an empty string,
+; access logs will be printed to stdout if the server runs in no-fork mode
+; or to syslog if the server runs in the background
+
+; directory=/var/log/openxcap 
+
+; The following parameters control what kind of information (like
+; stacktrace, body or headers) is logged for which response codes. The
+; values must be a comma-separated list of HTTP response codes or the  
+; keyword 'any' that matches all response codes.
+
+; log_stacktrace=500
+; log_response_headers=500
+; log_response_body=500
+; log_request_headers=500
+; log_request_body=500
+
+
+[Authentication]
+
+; The HTTP authentication type, this can be either 'basic' or 'digest'. The
+; standard states 'digest' as the mandatory, however it can be changed to
+; basic
+
+; type = digest
+
+; Specify if the passwords are stored as plain text - Yes
+; or in a hashed format MD5('username:domain:password') - No
+; cleartext_passwords = Yes
+
+; The default authentication realm, if none indicated in the HTTP request
+; URI
+default_realm = example.com
+
+; A comma-separated list of hosts or networks to trust.
+; The elements can be an IP address in CIDR format, a
+; hostname or an IP address (in the latter 2 a mask of 32
+; is assumed), or the special keywords 'any' and 'none'
+; (being equivalent to 0.0.0.0/0 and 0.0.0.0/32
+; respectively).
+; trusted_peers =
+
+
+[TLS]
+
+; Location of X509 certificate and private key that identify this server.
+; The path is relative to /etc/openxcap, or it can be given as an absolute
+; path.
+
+; Server X509 certificate
+; certificate =
+
+; Server X509 private key
+; private_key =
+
+
+[Database]
+
+; The database connection URI for the datase with subscriber accounts
+authentication_db_uri = pgsql://username:password@db/opensips
+
+; The database connection URI for the database that stores the XCAP documents
+storage_db_uri = mysql://username:password@db/opensips
+
+; Authentication and storage tables
+; subscriber_table = subscriber
+; xcap_table = xcap
+
+
+[OpenSIPS]
+
+; The address and port of the xml-rpc management interface
+xmlrpc_url = http://sip.example.com:8080
+
+; Publish xcap-diff event via OpenSIPS management interface 
+; enable_publish_xcapdiff = yes
diff --git a/testing/openxcap/openxcap.initd b/testing/openxcap/openxcap.initd
new file mode 100644
index 00000000..e58a7792
--- /dev/null
+++ b/testing/openxcap/openxcap.initd
@@ -0,0 +1,23 @@
+#!/sbin/runscript
+#
+
+daemon=/usr/bin/openxcap
+pidfile=/var/run/openxcap/openxcap.pid"
+
+depend() {
+	 need net
+	 after firewall
+}
+
+start() {
+    	ebegin "Starting OpenXCAP Presence Server"
+	start-stop-daemon --start --quiet --pidfile $pidfile --exec $daemon
+	eend $?
+}
+
+stop() {
+   	ebegin "Stopping OpenXCAP Presence Server"
+	start-stop-daemon --stop --quiet --signal 15 --pidfile $pidfile
+	eend $?
+}
+
-- 
cgit v1.2.3


From 7a31914bf75b2996031612116a0b1513a851d42b Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:25:44 +0000
Subject: testing/twisted-web2: new aport

---
 testing/twisted-web2/APKBUILD | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 testing/twisted-web2/APKBUILD

diff --git a/testing/twisted-web2/APKBUILD b/testing/twisted-web2/APKBUILD
new file mode 100644
index 00000000..78e70633
--- /dev/null
+++ b/testing/twisted-web2/APKBUILD
@@ -0,0 +1,20 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=twisted-web2
+pkgver=8.1.0
+pkgrel=0
+pkgdesc="The twisted.web2 package in Twisted."
+url="http://twistedmatrix.com/"
+license="GPL"
+depends="twisted"
+makedepends="python-dev"
+source="http://tmrc.mit.edu/mirror/twisted/Web2/8.1/TwistedWeb2-$pkgver.tar.bz2"
+
+build() {
+    cd $srcdir/TwistedWeb2-8.1.0/
+        python setup.py install --prefix=/usr --root=$pkgdir || return 1
+}
+
+
+md5sums="e34b48edf6fef075bd41ddbd215aed32  TwistedWeb2-8.1.0.tar.bz2"
-- 
cgit v1.2.3


From 81eef98b7e8c8e97c7d5c49d7beb9ca57494bed1 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:26:08 +0000
Subject: testing/python-mysqldb: new aport

---
 testing/python-mysqldb/APKBUILD | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 testing/python-mysqldb/APKBUILD

diff --git a/testing/python-mysqldb/APKBUILD b/testing/python-mysqldb/APKBUILD
new file mode 100644
index 00000000..e2ab68aa
--- /dev/null
+++ b/testing/python-mysqldb/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+pkgname=python-mysqldb
+pkgver=1.2.3c1
+pkgrel=0
+pkgdesc="MySQL Module for python"
+url="http://sourceforge.net/projects/mysql-python/"
+license="GPL"
+depends="python libmysqlclient"
+makedepends="python26-setuptools mysql-dev"
+source="http://downloads.sourceforge.net/mysql-python/MySQL-python-${pkgver}.tar.gz"
+
+build() {
+	cd "$srcdir"/MySQL-python-$pkgver
+
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+
+	python setup.py install --root="$pkgdir"
+
+	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" \
+	        > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
+}
+
+md5sums="310dd856e439d070b59ece6dd7a0734d  MySQL-python-1.2.3c1.tar.gz"
-- 
cgit v1.2.3


From e515a2777a433711db0bbe4b2e26c14e0dcc2cd6 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:26:32 +0000
Subject: testing/python-lxml: new aport

---
 testing/python-lxml/APKBUILD | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 testing/python-lxml/APKBUILD

diff --git a/testing/python-lxml/APKBUILD b/testing/python-lxml/APKBUILD
new file mode 100644
index 00000000..a1d20ea0
--- /dev/null
+++ b/testing/python-lxml/APKBUILD
@@ -0,0 +1,26 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=python-lxml
+_pkgname=lxml
+pkgver=2.2.6
+pkgrel=0
+pkgdesc="Python LXML Library"
+url="http://codespeak.net/lxml"
+license="GPL"
+depends="libxml2 libxslt"
+makedepends="libxml2-dev libxslt-dev python26-setuptools"
+install=
+source="http://codespeak.net/lxml/$_pkgname-$pkgver.tgz"
+
+build() {
+	cd "$srcdir"/$_pkgname-$pkgver
+
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+
+	python setup.py install --root="$pkgdir"
+
+	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
+}
+
+md5sums="b1f700fb22d7ee9b977ee3eceb65b20c  lxml-2.2.6.tgz"
-- 
cgit v1.2.3


From c4d52845b0f31c48e8ac9328c8f73bedc4a05798 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:27:18 +0000
Subject: testing/python-imaging: new aport

---
 testing/python-imaging/APKBUILD | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 testing/python-imaging/APKBUILD

diff --git a/testing/python-imaging/APKBUILD b/testing/python-imaging/APKBUILD
new file mode 100644
index 00000000..1fd46b07
--- /dev/null
+++ b/testing/python-imaging/APKBUILD
@@ -0,0 +1,21 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=python-imaging
+pkgver=1.1.7
+pkgrel=0
+pkgdesc="Python image manipulation library"
+url="http://pypi.python.org/pypi/PLI"
+license="PSF"
+depends="python"
+makedepends="python-dev"
+install=
+subpackages=""
+source="http://effbot.org/downloads/Imaging-$pkgver.tar.gz"
+build() {
+	cd "$srcdir"/Imaging-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+}
+
+md5sums="fc14a54e1ce02a0225be8854bfba478e  Imaging-1.1.7.tar.gz"
-- 
cgit v1.2.3


From e5d2453c693989dbd855c76c192e57579b669ee4 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 06:27:58 +0000
Subject: testing/openxcap: pre,post scripts added

---
 testing/openxcap/openxcap.post-install | 5 +++++
 testing/openxcap/openxcap.pre-install  | 5 +++++
 2 files changed, 10 insertions(+)
 create mode 100755 testing/openxcap/openxcap.post-install
 create mode 100755 testing/openxcap/openxcap.pre-install

diff --git a/testing/openxcap/openxcap.post-install b/testing/openxcap/openxcap.post-install
new file mode 100755
index 00000000..b3dff420
--- /dev/null
+++ b/testing/openxcap/openxcap.post-install
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+chown -R openxcap:openxcap /var/run/openxcap
+chgrp openxcap /etc/openxcap/config.ini
+exit 0
diff --git a/testing/openxcap/openxcap.pre-install b/testing/openxcap/openxcap.pre-install
new file mode 100755
index 00000000..cc2b529e
--- /dev/null
+++ b/testing/openxcap/openxcap.pre-install
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+addgroup openxcap 2>/dev/null
+adduser -G openxcap -h /var/run/openxcap -s /bin/false -S -D -H openxcap 2>/dev/null
+exit 0
-- 
cgit v1.2.3


From 01e49c3dbcef67b5d17908a7b8f15f362fdbf89b Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 20 May 2010 12:10:40 +0000
Subject: testing/python-imaging: freetype added as dep

---
 testing/python-imaging/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/python-imaging/APKBUILD b/testing/python-imaging/APKBUILD
index 1fd46b07..04542952 100644
--- a/testing/python-imaging/APKBUILD
+++ b/testing/python-imaging/APKBUILD
@@ -7,8 +7,8 @@ pkgrel=0
 pkgdesc="Python image manipulation library"
 url="http://pypi.python.org/pypi/PLI"
 license="PSF"
-depends="python"
-makedepends="python-dev"
+depends="python freetype"
+makedepends="python-dev freetype-dev"
 install=
 subpackages=""
 source="http://effbot.org/downloads/Imaging-$pkgver.tar.gz"
-- 
cgit v1.2.3


From 02392a99b663056f404c0d848ab859349a468453 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 11:44:43 +0000
Subject: main/e2fsprogs: upgrade to 1.41.12

---
 main/e2fsprogs/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/e2fsprogs/APKBUILD b/main/e2fsprogs/APKBUILD
index 26b6d43b..bfaaa7b4 100644
--- a/main/e2fsprogs/APKBUILD
+++ b/main/e2fsprogs/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=e2fsprogs
-pkgver=1.41.11
-pkgrel=1
+pkgver=1.41.12
+pkgrel=0
 pkgdesc="Standard Ext2/3/4 filesystem utilities"
 url="http://e2fsprogs.sourceforge.net"
 license="GPL LGPL MIT"
@@ -46,4 +46,4 @@ libcom_err() {
 	mv "$pkgdir"/lib/libcom_err* "$subpkgdir"/lib/
 }
 
-md5sums="fb507a40c2706bc38306f150d069e345  e2fsprogs-1.41.11.tar.gz"
+md5sums="1b24a21fc0c2381ef420961cbfec733f  e2fsprogs-1.41.12.tar.gz"
-- 
cgit v1.2.3


From 145d2c46426558fa3ea13fab947f1927797c83c3 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 11:45:26 +0000
Subject: main/ntfs-3g: upgrade to 2010.5.16

---
 main/ntfs-3g/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/ntfs-3g/APKBUILD b/main/ntfs-3g/APKBUILD
index c61d00c1..9a2e0006 100644
--- a/main/ntfs-3g/APKBUILD
+++ b/main/ntfs-3g/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ntfs-3g
-pkgver=2010.3.6
-pkgrel=1
+pkgver=2010.5.16
+pkgrel=0
 pkgdesc="A userspace ntfs driver with write support"
 url="http://www.tuxera.com/community/ntfs-3g-download/"
 license="GPL"
@@ -27,4 +27,4 @@ package() {
 
 }
 
-md5sums="12ce21aa044c6068a4df6e8cbd3c5cfa  ntfs-3g-2010.3.6.tgz"
+md5sums="aeff7659a4943c9223d79116f051a863  ntfs-3g-2010.5.16.tgz"
-- 
cgit v1.2.3


From 769f0c906507c54ea836aeb3fc85f075ca723691 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 14:24:20 +0000
Subject: main/distcc: rename distcc-python to distcc-pump

---
 main/distcc/APKBUILD | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/main/distcc/APKBUILD b/main/distcc/APKBUILD
index c022995d..c24efc91 100644
--- a/main/distcc/APKBUILD
+++ b/main/distcc/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=distcc
 pkgver=3.1
-pkgrel=3
+pkgrel=4
 pkgdesc="A distributed C, C++, Obj C compiler"
 url="http://distcc.org"
 license="GPL-2"
@@ -11,7 +11,7 @@ source="http://$pkgname.googlecode.com/files/$pkgname-$pkgver.tar.bz2
 	distcc-3.1-clone.patch
 	distcc-hardened.patch
 	distccd.initd distccd.confd"
-subpackages="$pkgname-doc $pkgname-python"
+subpackages="$pkgname-doc $pkgname-pump"
 
 build () 
 { 
@@ -39,9 +39,10 @@ build ()
 	ln -sf /usr/bin/$pkgname "$d"/cpp
 }
 
-python() {
-	pkgdesc="Python bindings to distcc"
-	mkdir -p "$subpkgdir"/usr/lib
+pump() {
+	pkgdesc="pump mode for distcc a distributed compiler client and server"
+	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/pump "$subpkgdir"/usr/bin/
 	mv "$pkgdir"/usr/lib/python* "$subpkgdir"/usr/lib/
 }
 
-- 
cgit v1.2.3


From 5d568f0381ad4cf41354cec0bd3e7e12d3f05d60 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 20 May 2010 14:47:10 +0000
Subject: main/newt: upgrade to 0.52.11

and create py-newt sub package
---
 main/newt/APKBUILD                | 18 ++++++++++++------
 main/newt/newt-0.52.7-notcl.patch | 35 -----------------------------------
 2 files changed, 12 insertions(+), 41 deletions(-)
 delete mode 100644 main/newt/newt-0.52.7-notcl.patch

diff --git a/main/newt/APKBUILD b/main/newt/APKBUILD
index c87d36e9..858ecd26 100644
--- a/main/newt/APKBUILD
+++ b/main/newt/APKBUILD
@@ -1,20 +1,20 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=newt
-pkgver=0.52.10
-pkgrel=1
+pkgver=0.52.11
+pkgrel=0
 pkgdesc="Redhat's Newt windowing toolkit development files"
 url="https://fedorahosted.org/newt/"
 license="LGPL-2"
 depends=
 makedepends="slang-dev popt-dev python-dev ncurses-dev wget"
-subpackages="$pkgname-dev $pkgname-doc"
+subpackages="$pkgname-dev $pkgname-doc py-newt:py"
 source="https://fedorahosted.org/releases/n/e/newt/newt-$pkgver.tar.gz
-	$pkgname-0.52.7-notcl.patch
 	"
 
 prepare() {
 	cd "$srcdir"/$pkgname-$pkgver
 	for i in ../*.patch; do
+		[ -r "$i" ] || continue
 		msg "Applying $i..."
 		patch -p1 < $i || return 1
 	done
@@ -38,5 +38,11 @@ package() {
 	make -j1 DESTDIR="$pkgdir" prefix="/usr" RPM_OPT_FLAGS="ERROR" install \
 		||  true
 }
-md5sums="bcbcc87ec19ba37d34f819209afa2e15  newt-0.52.10.tar.gz
-6780156f3b66a3f05efe1ee821617031  newt-0.52.7-notcl.patch"
+
+py() {
+	pkgdesc="A NEWT module for Python"
+	mkdir -p "$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/lib/python* "$subpkgdir"/usr/lib/
+}
+
+md5sums="4b9a0685ecd180c42d2c4a5806e3fc52  newt-0.52.11.tar.gz"
diff --git a/main/newt/newt-0.52.7-notcl.patch b/main/newt/newt-0.52.7-notcl.patch
deleted file mode 100644
index b9f86e6b..00000000
--- a/main/newt/newt-0.52.7-notcl.patch
+++ /dev/null
@@ -1,35 +0,0 @@
---- newt-0.52.7/Makefile.in.orig	2008-01-15 16:57:12.000000000 +0100
-+++ newt-0.52.7/Makefile.in	2008-01-15 16:58:38.000000000 +0100
-@@ -15,7 +15,7 @@
- PYTHONVERS = @PYTHONVERS@
- WHIPTCLSO = @WHIPTCLSO@
- 
--PROGS = test whiptail $(WHIPTCLSO) testgrid testtree showchars showkey
-+PROGS = test whiptail testgrid testtree showchars showkey
- TESTOBJS = test.o testgrid.o testtree.o showchars.o showkey.o
- NDIALOGOBJS = whiptail.o dialogboxes.o
- WHIPTCLOBJS = shared/whiptcl.o shared/dialogboxes.o
-@@ -78,9 +78,6 @@
- whiptail: $(NDIALOGOBJS) $(LIBNEWTSH)
- 	$(CC) -g -o whiptail $(NDIALOGOBJS) -L . -lnewt $(LIBS) -lpopt
- 
--whiptcl.so: $(WHIPTCLOBJS) $(LIBNEWTSH)
--	$(CC) -shared $(SHCFLAGS) -o whiptcl.so $(WHIPTCLOBJS) -L . -lnewt  $(LIBTCL) -lslang -lpopt -lm
--
- $(LIBNEWT): $(LIBOBJS)
- 	ar rv $@ $^
- 
-@@ -120,12 +117,11 @@
- 	install -m 644 whiptail.1 $(instroot)/$(man1dir)
- 	make -C po datadir=$(instroot)/$(datadir) install
- 
--install-sh: sharedlib $(WHIPTCLSO) _snackmodule.so
-+install-sh: sharedlib _snackmodule.so
- 	[ -d $(instroot)/$(libdir) ] || install -m 755 -d $(instroot)/$(libdir)
- 	install -m 755 $(LIBNEWTSH) $(instroot)/$(libdir)
- 	ln -sf $(LIBNEWTSONAME) $(instroot)/$(libdir)/libnewt.so
- 	ln -sf $(LIBNEWTSH) $(instroot)/$(libdir)/$(LIBNEWTSONAME)
--	[ -n "$(WHIPTCLSO)" ] && install -m 755 whiptcl.so $(instroot)/$(libdir) || :
- 	for ver in $(PYTHONVERS) ; do \
- 	   [ -d $(instroot)/$(libdir)/$$ver/site-packages ] || install -m 755 -d $(instroot)/$(libdir)/$$ver/site-packages ;\
- 	   install -m 755 $$ver/_snackmodule.so $(instroot)/$(libdir)/$$ver/site-packages ;\
-- 
cgit v1.2.3


From 38cf6c1e43708e1b56b94fc1abc9a2c849db320a Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Thu, 20 May 2010 18:15:07 +0000
Subject: testing/nagios: upgraded to 3.2.1

fixes #350
---
 testing/nagios/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testing/nagios/APKBUILD b/testing/nagios/APKBUILD
index 0234cac1..41ffe264 100644
--- a/testing/nagios/APKBUILD
+++ b/testing/nagios/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter at gmail>
 # Maintainer: Carlo Landmeter <clandmeter at gmail>
 pkgname=nagios
-pkgver=3.1.0
-pkgrel=1
+pkgver=3.2.1
+pkgrel=0
 pkgdesc="Popular monitoring tool"
 url="http://www.nagios.org/"
 license="GPL-2"
@@ -49,7 +49,7 @@ web() {
 	install -m644 -D "$srcdir"/lighttpd-nagios.conf "$subpkgdir"/etc/lighttpd-nagios.conf
 }
 
-md5sums="02d3b0e13f772481d0ac9e00bdc3e979  nagios-3.1.0.tar.gz
+md5sums="d4655ee8c95c9679fd4fd53dac34bbe3  nagios-3.2.1.tar.gz
 431dfe7403323e247a88b97beade5d78  nagios.confd
 2ead8695b32222abe922692664aa9de1  nagios.initd
 d63c36f47d26f1f71ae2faf272eec640  lighttpd-nagios.conf"
-- 
cgit v1.2.3


From 6ded59b0e00bc55688693e1393267e8447a400e0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 07:50:55 +0000
Subject: testing/nagios: added package() function

---
 testing/nagios/APKBUILD | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/testing/nagios/APKBUILD b/testing/nagios/APKBUILD
index 41ffe264..1bde07a8 100644
--- a/testing/nagios/APKBUILD
+++ b/testing/nagios/APKBUILD
@@ -33,6 +33,10 @@ build() {
 		--enable-embedded-perl \
 		--with-perlcache
 	make all || return 1
+}
+
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
 	make DESTDIR="$pkgdir" install
 	make DESTDIR="$pkgdir" install-config
 	make DESTDIR="$pkgdir" install-commandmode
-- 
cgit v1.2.3


From 0411e8673b6610316fabfac56795927ecc02c399 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 12:05:25 +0000
Subject: main/busybox: add patches from upstream

---
 main/busybox/APKBUILD      | 16 +++++++++++-----
 testing/py-crypto/APKBUILD | 23 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 5 deletions(-)
 create mode 100644 testing/py-crypto/APKBUILD

diff --git a/main/busybox/APKBUILD b/main/busybox/APKBUILD
index e625da83..d379e5a8 100644
--- a/main/busybox/APKBUILD
+++ b/main/busybox/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=busybox
 pkgver=1.16.1
-pkgrel=3
+pkgrel=4
 pkgdesc="Size optimized toolbox of many common UNIX utilities"
 url=http://busybox.net
 license="GPL-2"
@@ -12,10 +12,13 @@ triggers="busybox.trigger:/bin /usr/bin /sbin /usr/sbin /lib/modules/*"
 source="http://busybox.net/downloads/$pkgname-$pkgver.tar.bz2
 	$pkgname-1.11.1-bb.patch
 	flock-bb.patch
-	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-dnsd.patch
-	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-hwclock.patch
-	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-indexcgi.patch
-	http://www.busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-sed.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-ash.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-cpio.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-dhcpd.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-dnsd.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-hwclock.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-indexcgi.patch
+	http://busybox.net/downloads/fixes-1.16.1/busybox-1.16.1-sed.patch
 	busyboxconfig"
 
 _builddir="$srcdir"/$pkgname-$pkgver
@@ -74,6 +77,9 @@ static() {
 md5sums="319486ec65078d07fde26eb620fecde7  busybox-1.16.1.tar.bz2
 4c0f3b486eaa0674961b7ddcd0c60a9b  busybox-1.11.1-bb.patch
 20d9beea7d0c0aaca14553a8f98fee12  flock-bb.patch
+b328c15e90c58c44f283838f224c3c97  busybox-1.16.1-ash.patch
+301feec832c938c235d370ae09f90713  busybox-1.16.1-cpio.patch
+54607ef7a80b6c3aa397788ce9166cc3  busybox-1.16.1-dhcpd.patch
 9fd18c9833253119996039429bee1992  busybox-1.16.1-dnsd.patch
 b16ad6491dcb4f053f84ae2c4064918d  busybox-1.16.1-hwclock.patch
 c3bc34309334c456b6f905f0708c914f  busybox-1.16.1-indexcgi.patch
diff --git a/testing/py-crypto/APKBUILD b/testing/py-crypto/APKBUILD
new file mode 100644
index 00000000..75f31dd6
--- /dev/null
+++ b/testing/py-crypto/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=py-crypto
+pkgver=2.0.1
+pkgrel=2
+pkgdesc="A collection of cryptographic algorithms and protocols, implemented for use from Python."
+url="http://www.amk.ca/python/code/crypto.html"
+license="GPL"
+depends="python"
+makedepends="gmp5-dev python-dev"
+source="http://www.amk.ca/files/python/crypto/pycrypto-$pkgver.tar.gz"
+
+_builddir="$srcdir"/pycrypto-$pkgver
+build ()
+{
+	cd "$_builddir"
+	python setup.py build 
+}
+
+package() {
+	cd "$_builddir"
+	python setup.py install --root="$pkgdir"
+}
+md5sums="4d5674f3898a573691ffb335e8d749cd  pycrypto-2.0.1.tar.gz"
-- 
cgit v1.2.3


From c2e81b694405faf1a9ff12e4489d4b36a2433546 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:15:33 +0000
Subject: testing/py-zope-interface: renamed from zope-interface

---
 testing/py-zope-interface/APKBUILD | 23 +++++++++++++++++++++++
 testing/zope-interface/APKBUILD    | 18 ------------------
 2 files changed, 23 insertions(+), 18 deletions(-)
 create mode 100644 testing/py-zope-interface/APKBUILD
 delete mode 100644 testing/zope-interface/APKBUILD

diff --git a/testing/py-zope-interface/APKBUILD b/testing/py-zope-interface/APKBUILD
new file mode 100644
index 00000000..a6c42395
--- /dev/null
+++ b/testing/py-zope-interface/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=py-zope-interface
+pkgver=3.5.1
+pkgrel=0
+pkgdesc="Separate distribution of the zope.interface package used in Zope 3."
+url="http://www.zope.org/Products/ZopeInterface/"
+license="ZPL"
+depends="python"
+makedepends="python-dev"
+source="http://pypi.python.org/packages/source/z/zope.interface/zope.interface-$pkgver.tar.gz"
+
+_builddir="$srcdir"/zope.interface-$pkgver
+build() {
+	cd "$_builddir"
+	python setup.py build
+}
+
+package() {
+	cd "$_builddir"
+	python setup.py install --prefix=/usr --root="$pkgdir"
+	rm "$pkgdir"/usr/lib/python2.6/site-packages/zope/interface/README*.txt
+}
+md5sums="685fc532550abb07cca6190c9cd2b901  zope.interface-3.5.1.tar.gz"
diff --git a/testing/zope-interface/APKBUILD b/testing/zope-interface/APKBUILD
deleted file mode 100644
index 8db2a557..00000000
--- a/testing/zope-interface/APKBUILD
+++ /dev/null
@@ -1,18 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=zope-interface
-pkgver=3.5.1
-pkgrel=0
-pkgdesc="Separate distribution of the zope.interface package used in Zope 3."
-url="http://www.zope.org/Products/ZopeInterface/"
-license="ZPL"
-depends="python"
-makedepends="python-dev"
-source="http://pypi.python.org/packages/source/z/zope.interface/zope.interface-$pkgver.tar.gz"
-
-build () 
-{ 
-	cd "$srcdir"/zope.interface-$pkgver
-	python setup.py install --prefix=/usr --root="$pkgdir"
-	rm "$pkgdir"/usr/lib/python2.6/site-packages/zope/interface/README*.txt
-}
-md5sums="685fc532550abb07cca6190c9cd2b901  zope.interface-3.5.1.tar.gz"
-- 
cgit v1.2.3


From b8838f1b034e45a60eb2621a6dfeb293a1469bfb Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:16:58 +0000
Subject: testing/py-zope-interface: upgrade to 3.6.1

---
 testing/py-zope-interface/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/py-zope-interface/APKBUILD b/testing/py-zope-interface/APKBUILD
index a6c42395..2f9ecacc 100644
--- a/testing/py-zope-interface/APKBUILD
+++ b/testing/py-zope-interface/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=py-zope-interface
-pkgver=3.5.1
+pkgver=3.6.1
 pkgrel=0
 pkgdesc="Separate distribution of the zope.interface package used in Zope 3."
 url="http://www.zope.org/Products/ZopeInterface/"
@@ -20,4 +20,4 @@ package() {
 	python setup.py install --prefix=/usr --root="$pkgdir"
 	rm "$pkgdir"/usr/lib/python2.6/site-packages/zope/interface/README*.txt
 }
-md5sums="685fc532550abb07cca6190c9cd2b901  zope.interface-3.5.1.tar.gz"
+md5sums="7a895181b8d10be4a7e9a3afa13cd3be  zope.interface-3.6.1.tar.gz"
-- 
cgit v1.2.3


From d772901cebce3b455e1c480c4e7d985ea5b10de8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:20:19 +0000
Subject: testing/py-application: renamed from python-application

---
 testing/py-application/APKBUILD     | 24 ++++++++++++++++++++++++
 testing/python-application/APKBUILD | 23 -----------------------
 2 files changed, 24 insertions(+), 23 deletions(-)
 create mode 100644 testing/py-application/APKBUILD
 delete mode 100644 testing/python-application/APKBUILD

diff --git a/testing/py-application/APKBUILD b/testing/py-application/APKBUILD
new file mode 100644
index 00000000..01676611
--- /dev/null
+++ b/testing/py-application/APKBUILD
@@ -0,0 +1,24 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+pkgname=py-application
+_name=python-application
+pkgver=1.1.5
+pkgrel=0
+pkgdesc="Basic building blocks for python applications"
+url="http://pypi.python.org/pypi/python-application"
+license="PSF"
+depends="python"
+makedepends="python-dev"
+install=
+subpackages=""
+source="http://pypi.python.org/packages/source/p/python-application/python-application-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$_name-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+	echo "/usr/lib/python2.6/site-packages/$_name-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_name.pth
+
+}
+
+md5sums="d43399becc6b2850a2ea80a34375781b  python-application-1.1.5.tar.gz"
diff --git a/testing/python-application/APKBUILD b/testing/python-application/APKBUILD
deleted file mode 100644
index bda915d8..00000000
--- a/testing/python-application/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-pkgname=python-application
-pkgver=1.1.5
-pkgrel=0
-pkgdesc="Basic building blocks for python applications"
-url="http://pypi.python.org/pypi/python-application"
-license="PSF"
-depends="python"
-makedepends="python-dev"
-install=
-subpackages=""
-source="http://pypi.python.org/packages/source/p/$pkgname/$pkgname-$pkgver.tar.gz"
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
-
-}
-
-md5sums="d43399becc6b2850a2ea80a34375781b  python-application-1.1.5.tar.gz"
-- 
cgit v1.2.3


From 3ceefd19a12655ed49e44c524af3b6cfce82b973 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:22:54 +0000
Subject: testing/py-cjson: renamed from python-cjson

---
 testing/py-cjson/APKBUILD     | 24 ++++++++++++++++++++++++
 testing/python-cjson/APKBUILD | 23 -----------------------
 2 files changed, 24 insertions(+), 23 deletions(-)
 create mode 100644 testing/py-cjson/APKBUILD
 delete mode 100644 testing/python-cjson/APKBUILD

diff --git a/testing/py-cjson/APKBUILD b/testing/py-cjson/APKBUILD
new file mode 100644
index 00000000..0a4a272a
--- /dev/null
+++ b/testing/py-cjson/APKBUILD
@@ -0,0 +1,24 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=py-cjson
+_name=python-cjson
+pkgver=1.0.5
+pkgrel=1
+pkgdesc="Fast JSON encoder/decoder for Python"
+url="http://pypi.python.org/pypi/python-gnutls"
+license="PSF"
+depends="python"
+makedepends="python-dev"
+install=
+subpackages=""
+source="http://pypi.python.org/packages/source/p/python-cjson/$_name-$pkgver.tar.gz"
+build() {
+	cd "$srcdir"/$_name-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+	echo "/usr/lib/python2.6/site-packages/$_name-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_name.pth
+
+}
+
+md5sums="4d55b66ecdf0300313af9d030d9644a3  python-cjson-1.0.5.tar.gz"
diff --git a/testing/python-cjson/APKBUILD b/testing/python-cjson/APKBUILD
deleted file mode 100644
index f3274d5f..00000000
--- a/testing/python-cjson/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-
-pkgname=python-cjson
-pkgver=1.0.5
-pkgrel=1
-pkgdesc="Fast JSON encoder/decoder for Python"
-url="http://pypi.python.org/pypi/python-gnutls"
-license="PSF"
-depends="python"
-makedepends="python-dev"
-install=
-subpackages=""
-source="http://pypi.python.org/packages/source/p/$pkgname/$pkgname-$pkgver.tar.gz"
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
-
-}
-
-md5sums="4d55b66ecdf0300313af9d030d9644a3  python-cjson-1.0.5.tar.gz"
-- 
cgit v1.2.3


From 4f613659e70363b3617690c189282ab2fb7d5ce1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:26:38 +0000
Subject: testing/py-gnutls: renamed from python-gnutls

---
 testing/py-gnutls/APKBUILD     | 24 ++++++++++++++++++++++++
 testing/python-gnutls/APKBUILD | 23 -----------------------
 2 files changed, 24 insertions(+), 23 deletions(-)
 create mode 100644 testing/py-gnutls/APKBUILD
 delete mode 100644 testing/python-gnutls/APKBUILD

diff --git a/testing/py-gnutls/APKBUILD b/testing/py-gnutls/APKBUILD
new file mode 100644
index 00000000..8d5a2f23
--- /dev/null
+++ b/testing/py-gnutls/APKBUILD
@@ -0,0 +1,24 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=py-gnutls
+_name=python-gnutls
+pkgver=1.1.9
+pkgrel=1
+pkgdesc="Python wrapper for the GNUTLS library"
+url="http://pypi.python.org/pypi/python-gnutls"
+license="PSF"
+depends="python"
+makedepends="python-dev gnutls-dev"
+install=
+subpackages=""
+source="http://pypi.python.org/packages/source/p/$_name/$_name-$pkgver.tar.gz"
+build() {
+	cd "$srcdir"/$_name-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+	echo "/usr/lib/python2.6/site-packages/$_name-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_name.pth
+
+}
+
+md5sums="bdd81a9dd3c2f87393cd6c014bf6885b  python-gnutls-1.1.9.tar.gz"
diff --git a/testing/python-gnutls/APKBUILD b/testing/python-gnutls/APKBUILD
deleted file mode 100644
index df19c123..00000000
--- a/testing/python-gnutls/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-
-pkgname=python-gnutls
-pkgver=1.1.9
-pkgrel=1
-pkgdesc="Python wrapper for the GNUTLS library"
-url="http://pypi.python.org/pypi/python-gnutls"
-license="PSF"
-depends="python"
-makedepends="python-dev gnutls-dev"
-install=
-subpackages=""
-source="http://pypi.python.org/packages/source/p/$pkgname/$pkgname-$pkgver.tar.gz"
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
-
-}
-
-md5sums="bdd81a9dd3c2f87393cd6c014bf6885b  python-gnutls-1.1.9.tar.gz"
-- 
cgit v1.2.3


From de9709aafcab8fddcff508db73bffc5692c2990a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:28:09 +0000
Subject: testing/py-imaging: renamed from python-imaging

---
 testing/py-imaging/APKBUILD     | 21 +++++++++++++++++++++
 testing/python-imaging/APKBUILD | 21 ---------------------
 2 files changed, 21 insertions(+), 21 deletions(-)
 create mode 100644 testing/py-imaging/APKBUILD
 delete mode 100644 testing/python-imaging/APKBUILD

diff --git a/testing/py-imaging/APKBUILD b/testing/py-imaging/APKBUILD
new file mode 100644
index 00000000..d800ba03
--- /dev/null
+++ b/testing/py-imaging/APKBUILD
@@ -0,0 +1,21 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=py-imaging
+pkgver=1.1.7
+pkgrel=0
+pkgdesc="Python image manipulation library"
+url="http://pypi.python.org/pypi/PLI"
+license="PSF"
+depends="python freetype"
+makedepends="python-dev freetype-dev"
+install=
+subpackages=""
+source="http://effbot.org/downloads/Imaging-$pkgver.tar.gz"
+build() {
+	cd "$srcdir"/Imaging-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+}
+
+md5sums="fc14a54e1ce02a0225be8854bfba478e  Imaging-1.1.7.tar.gz"
diff --git a/testing/python-imaging/APKBUILD b/testing/python-imaging/APKBUILD
deleted file mode 100644
index 04542952..00000000
--- a/testing/python-imaging/APKBUILD
+++ /dev/null
@@ -1,21 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-
-pkgname=python-imaging
-pkgver=1.1.7
-pkgrel=0
-pkgdesc="Python image manipulation library"
-url="http://pypi.python.org/pypi/PLI"
-license="PSF"
-depends="python freetype"
-makedepends="python-dev freetype-dev"
-install=
-subpackages=""
-source="http://effbot.org/downloads/Imaging-$pkgver.tar.gz"
-build() {
-	cd "$srcdir"/Imaging-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-}
-
-md5sums="fc14a54e1ce02a0225be8854bfba478e  Imaging-1.1.7.tar.gz"
-- 
cgit v1.2.3


From e6193f20ad9e80b14bbd0264e492e0bafc79100b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:31:29 +0000
Subject: testing/py-setuptools: renamed from python26-setuptools

---
 testing/py-setuptools/APKBUILD       | 27 +++++++++++++++++++++++++++
 testing/python26-setuptools/APKBUILD | 27 ---------------------------
 2 files changed, 27 insertions(+), 27 deletions(-)
 create mode 100644 testing/py-setuptools/APKBUILD
 delete mode 100644 testing/python26-setuptools/APKBUILD

diff --git a/testing/py-setuptools/APKBUILD b/testing/py-setuptools/APKBUILD
new file mode 100644
index 00000000..2ccca3b4
--- /dev/null
+++ b/testing/py-setuptools/APKBUILD
@@ -0,0 +1,27 @@
+# Contributor: Andrew Manison <amanison@anselsystems.com>
+# Maintainer: 
+pkgname=py-setuptools
+_pkgname=${pkgname#py-}
+pkgver=0.6c11
+pkgrel=0
+pkgdesc="setuptools is a collection of enhancements to the Python distutils"
+url="http://pypi.python.org/pypi/setuptools"
+license="PSF"
+depends="python"
+makedepends="python-dev"
+install=
+subpackages=""
+source="http://pypi.python.org/packages/source/s/$_pkgname/$_pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$_pkgname-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+	echo "/usr/lib/python2.6/site-packages/$_pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_pkgname.pth
+
+	# we don't provide a non-suffixed easy_install
+	echo "Removing non-suffixed easy_install ( $pkgdir/usr/bin/easy_install)"
+	rm "$pkgdir"/usr/bin/easy_install
+}
+
+md5sums="7df2a529a074f613b509fb44feefe74e  setuptools-0.6c11.tar.gz"
diff --git a/testing/python26-setuptools/APKBUILD b/testing/python26-setuptools/APKBUILD
deleted file mode 100644
index e8322dd5..00000000
--- a/testing/python26-setuptools/APKBUILD
+++ /dev/null
@@ -1,27 +0,0 @@
-# Contributor: Andrew Manison <amanison@anselsystems.com>
-# Maintainer: 
-pkgname=python26-setuptools
-_pkgname=${pkgname#python26-}
-pkgver=0.6c11
-pkgrel=0
-pkgdesc="setuptools is a collection of enhancements to the Python distutils"
-url="http://pypi.python.org/pypi/setuptools"
-license="PSF"
-depends="python"
-makedepends="python-dev"
-install=
-subpackages=""
-source="http://pypi.python.org/packages/source/s/$_pkgname/$_pkgname-$pkgver.tar.gz"
-
-build() {
-	cd "$srcdir"/$_pkgname-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-	echo "/usr/lib/python2.6/site-packages/$_pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_pkgname.pth
-
-	# we don't provide a non-suffixed easy_install
-	echo "Removing non-suffixed easy_install ( $pkgdir/usr/bin/easy_install)"
-	rm "$pkgdir"/usr/bin/easy_install
-}
-
-md5sums="7df2a529a074f613b509fb44feefe74e  setuptools-0.6c11.tar.gz"
-- 
cgit v1.2.3


From 31058fea3fe4109c6222fc00e60f4541086e4680 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:33:49 +0000
Subject: testing/py-lxml: renamed from python-lxml

---
 testing/py-lxml/APKBUILD     | 26 ++++++++++++++++++++++++++
 testing/python-lxml/APKBUILD | 26 --------------------------
 2 files changed, 26 insertions(+), 26 deletions(-)
 create mode 100644 testing/py-lxml/APKBUILD
 delete mode 100644 testing/python-lxml/APKBUILD

diff --git a/testing/py-lxml/APKBUILD b/testing/py-lxml/APKBUILD
new file mode 100644
index 00000000..58b250df
--- /dev/null
+++ b/testing/py-lxml/APKBUILD
@@ -0,0 +1,26 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=py-lxml
+_pkgname=lxml
+pkgver=2.2.6
+pkgrel=0
+pkgdesc="Python LXML Library"
+url="http://codespeak.net/lxml"
+license="GPL"
+depends="libxml2 libxslt"
+makedepends="libxml2-dev libxslt-dev py-setuptools"
+install=
+source="http://codespeak.net/lxml/$_pkgname-$pkgver.tgz"
+
+build() {
+	cd "$srcdir"/$_pkgname-$pkgver
+
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+
+	python setup.py install --root="$pkgdir"
+
+	echo "/usr/lib/python2.6/site-packages/$_pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_pkgname.pth
+}
+
+md5sums="b1f700fb22d7ee9b977ee3eceb65b20c  lxml-2.2.6.tgz"
diff --git a/testing/python-lxml/APKBUILD b/testing/python-lxml/APKBUILD
deleted file mode 100644
index a1d20ea0..00000000
--- a/testing/python-lxml/APKBUILD
+++ /dev/null
@@ -1,26 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-
-pkgname=python-lxml
-_pkgname=lxml
-pkgver=2.2.6
-pkgrel=0
-pkgdesc="Python LXML Library"
-url="http://codespeak.net/lxml"
-license="GPL"
-depends="libxml2 libxslt"
-makedepends="libxml2-dev libxslt-dev python26-setuptools"
-install=
-source="http://codespeak.net/lxml/$_pkgname-$pkgver.tgz"
-
-build() {
-	cd "$srcdir"/$_pkgname-$pkgver
-
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-
-	python setup.py install --root="$pkgdir"
-
-	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
-}
-
-md5sums="b1f700fb22d7ee9b977ee3eceb65b20c  lxml-2.2.6.tgz"
-- 
cgit v1.2.3


From 5f3e19c1bca037bbc4448fbe2135831cbbd7f2a6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:35:11 +0000
Subject: testing/py-mysqldb: renamed from python-mysqldb

---
 testing/py-mysqldb/APKBUILD     | 23 +++++++++++++++++++++++
 testing/python-mysqldb/APKBUILD | 23 -----------------------
 2 files changed, 23 insertions(+), 23 deletions(-)
 create mode 100644 testing/py-mysqldb/APKBUILD
 delete mode 100644 testing/python-mysqldb/APKBUILD

diff --git a/testing/py-mysqldb/APKBUILD b/testing/py-mysqldb/APKBUILD
new file mode 100644
index 00000000..a4486a4e
--- /dev/null
+++ b/testing/py-mysqldb/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+pkgname=py-mysqldb
+pkgver=1.2.3c1
+pkgrel=0
+pkgdesc="MySQL Module for python"
+url="http://sourceforge.net/projects/mysql-python/"
+license="GPL"
+depends="python libmysqlclient"
+makedepends="py-setuptools mysql-dev"
+source="http://downloads.sourceforge.net/mysql-python/MySQL-python-${pkgver}.tar.gz"
+
+build() {
+	cd "$srcdir"/MySQL-python-$pkgver
+
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+
+	python setup.py install --root="$pkgdir"
+
+	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" \
+	        > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
+}
+
+md5sums="310dd856e439d070b59ece6dd7a0734d  MySQL-python-1.2.3c1.tar.gz"
diff --git a/testing/python-mysqldb/APKBUILD b/testing/python-mysqldb/APKBUILD
deleted file mode 100644
index e2ab68aa..00000000
--- a/testing/python-mysqldb/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-pkgname=python-mysqldb
-pkgver=1.2.3c1
-pkgrel=0
-pkgdesc="MySQL Module for python"
-url="http://sourceforge.net/projects/mysql-python/"
-license="GPL"
-depends="python libmysqlclient"
-makedepends="python26-setuptools mysql-dev"
-source="http://downloads.sourceforge.net/mysql-python/MySQL-python-${pkgver}.tar.gz"
-
-build() {
-	cd "$srcdir"/MySQL-python-$pkgver
-
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-
-	python setup.py install --root="$pkgdir"
-
-	echo "/usr/lib/python2.6/site-packages/$pkgname-$pkgver-py2.6.egg" \
-	        > "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
-}
-
-md5sums="310dd856e439d070b59ece6dd7a0734d  MySQL-python-1.2.3c1.tar.gz"
-- 
cgit v1.2.3


From f9ca1925e34255433cc81edbfee99526c16bebc7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:36:18 +0000
Subject: testing/py-buildutils: renamed from python26-buildutils

---
 testing/py-buildutils/APKBUILD | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 testing/py-buildutils/APKBUILD

diff --git a/testing/py-buildutils/APKBUILD b/testing/py-buildutils/APKBUILD
new file mode 100644
index 00000000..f414f35e
--- /dev/null
+++ b/testing/py-buildutils/APKBUILD
@@ -0,0 +1,23 @@
+# Contributor: Andrew Manison <amanison@anselsystems.com>
+# Maintainer: 
+pkgname=py-buildutils
+_pkgname=${pkgname#py-}
+pkgver=0.3
+pkgrel=0
+pkgdesc="buildutils is a collection of enhancements to the Python distutils"
+url="http://pypi.python.org/pypi/buildutils/0.3"
+license="GPL"
+depends="python py-setuptools"
+makedepends="python-dev"
+install=
+subpackages=""
+source="http://pypi.python.org/packages/source/b/$_pkgname/$_pkgname-$pkgver.tar.gz"
+
+build() {
+	cd "$srcdir"/$_pkgname-$pkgver
+	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
+	python setup.py install --root="$pkgdir"
+	echo "/usr/lib/python2.6/site-packages/$_pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_pkgname.pth
+}
+
+md5sums="fec620dee05f591edad386366b52e17b  buildutils-0.3.tar.gz"
-- 
cgit v1.2.3


From 171b5c7d1d242eebd519815069d6359b6113a180 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:45:48 +0000
Subject: testing/py-twisted: renamed from twisted

---
 testing/py-twisted/APKBUILD | 23 +++++++++++++++++++++++
 testing/twisted/APKBUILD    | 18 ------------------
 2 files changed, 23 insertions(+), 18 deletions(-)
 create mode 100644 testing/py-twisted/APKBUILD
 delete mode 100644 testing/twisted/APKBUILD

diff --git a/testing/py-twisted/APKBUILD b/testing/py-twisted/APKBUILD
new file mode 100644
index 00000000..bc21c236
--- /dev/null
+++ b/testing/py-twisted/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=py-twisted
+pkgver=8.2.0
+pkgrel=2
+pkgdesc="Asynchronous networking framework written in Python."
+url="http://twistedmatrix.com/"
+license="MIT"
+depends="python py-crypto py-zope-interface"
+makedepends="python-dev"
+source="http://tmrc.mit.edu/mirror/$pkgname/Twisted/8.2/Twisted-$pkgver.tar.bz2"
+
+build () 
+{ 
+	cd "$srcdir"/Twisted-$pkgver
+	python setup.py build || return 1
+}
+
+package() {
+	cd "$srcdir"/Twisted-$pkgver
+	python setup.py install --prefix=/usr --root="$pkgdir" || return 1
+	install -D -m644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
+}
+md5sums="c85f151999df3ecf04c49a781b4438d2  Twisted-8.2.0.tar.bz2"
diff --git a/testing/twisted/APKBUILD b/testing/twisted/APKBUILD
deleted file mode 100644
index 5c6d8541..00000000
--- a/testing/twisted/APKBUILD
+++ /dev/null
@@ -1,18 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=twisted
-pkgver=8.2.0
-pkgrel=2
-pkgdesc="Asynchronous networking framework written in Python."
-url="http://twistedmatrix.com/"
-license="MIT"
-depends="python pycrypto zope-interface"
-makedepends="python-dev"
-source="http://tmrc.mit.edu/mirror/$pkgname/Twisted/8.2/Twisted-$pkgver.tar.bz2"
-
-build () 
-{ 
-	cd "$srcdir"/Twisted-$pkgver
-	python setup.py install --prefix=/usr --root="$pkgdir" || return 1
-	install -D -m644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
-}
-md5sums="c85f151999df3ecf04c49a781b4438d2  Twisted-8.2.0.tar.bz2"
-- 
cgit v1.2.3


From 7bb556c46d2fb50876b697cfe1bf426f253648f2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 13:49:28 +0000
Subject: py-twisted-web2: renamed from twisted-web2

---
 testing/py-twisted-web2/APKBUILD | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 testing/py-twisted-web2/APKBUILD

diff --git a/testing/py-twisted-web2/APKBUILD b/testing/py-twisted-web2/APKBUILD
new file mode 100644
index 00000000..de0a6d37
--- /dev/null
+++ b/testing/py-twisted-web2/APKBUILD
@@ -0,0 +1,20 @@
+# Contributor: Francesco Colista <francesco.colista@gmail.com>
+# Maintainer: Francesco Colista <francesco.colista@gmail.com>
+
+pkgname=py-twisted-web2
+pkgver=8.1.0
+pkgrel=0
+pkgdesc="The twisted.web2 package in Twisted."
+url="http://twistedmatrix.com/"
+license="GPL"
+depends="py-twisted"
+makedepends="python-dev"
+source="http://tmrc.mit.edu/mirror/twisted/Web2/8.1/TwistedWeb2-$pkgver.tar.bz2"
+
+build() {
+    cd "$srcdir"/TwistedWeb2-8.1.0/
+        python setup.py install --prefix=/usr --root="$pkgdir" || return 1
+}
+
+
+md5sums="e34b48edf6fef075bd41ddbd215aed32  TwistedWeb2-8.1.0.tar.bz2"
-- 
cgit v1.2.3


From 32644891bac7914b13f9fabbac9a863fa896f884 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 14:14:14 +0000
Subject: testing/pycrypto,python26-buildutils,twisted-web2: renamed

---
 testing/pycrypto/APKBUILD            | 22 ----------------------
 testing/python26-buildutils/APKBUILD | 23 -----------------------
 testing/twisted-web2/APKBUILD        | 20 --------------------
 3 files changed, 65 deletions(-)
 delete mode 100644 testing/pycrypto/APKBUILD
 delete mode 100644 testing/python26-buildutils/APKBUILD
 delete mode 100644 testing/twisted-web2/APKBUILD

diff --git a/testing/pycrypto/APKBUILD b/testing/pycrypto/APKBUILD
deleted file mode 100644
index f5a48e75..00000000
--- a/testing/pycrypto/APKBUILD
+++ /dev/null
@@ -1,22 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=pycrypto
-pkgver=2.0.1
-pkgrel=2
-pkgdesc="A collection of cryptographic algorithms and protocols, implemented for use from Python."
-url="http://www.amk.ca/python/code/crypto.html"
-license="GPL"
-depends="python"
-makedepends="gmp5-dev python-dev"
-source="http://www.amk.ca/files/python/crypto/$pkgname-$pkgver.tar.gz"
-
-build ()
-{
-	cd "$srcdir"/$pkgname-$pkgver
-	python setup.py build 
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	python setup.py install --root="$pkgdir"
-}
-md5sums="4d5674f3898a573691ffb335e8d749cd  pycrypto-2.0.1.tar.gz"
diff --git a/testing/python26-buildutils/APKBUILD b/testing/python26-buildutils/APKBUILD
deleted file mode 100644
index 5db0a6bf..00000000
--- a/testing/python26-buildutils/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Contributor: Andrew Manison <amanison@anselsystems.com>
-# Maintainer: 
-pkgname=python26-buildutils
-_pkgname=${pkgname#python26-}
-pkgver=0.3
-pkgrel=0
-pkgdesc="buildutils is a collection of enhancements to the Python distutils"
-url="http://pypi.python.org/pypi/buildutils/0.3"
-license="GPL"
-depends="python python26-setuptools"
-makedepends="python-dev"
-install=
-subpackages=""
-source="http://pypi.python.org/packages/source/b/$_pkgname/$_pkgname-$pkgver.tar.gz"
-
-build() {
-	cd "$srcdir"/$_pkgname-$pkgver
-	mkdir -p "$pkgdir"/usr/lib/python2.6/site-packages
-	python setup.py install --root="$pkgdir"
-	echo "/usr/lib/python2.6/site-packages/$_pkgname-$pkgver-py2.6.egg" > "$pkgdir"/usr/lib/python2.6/site-packages/$_pkgname.pth
-}
-
-md5sums="fec620dee05f591edad386366b52e17b  buildutils-0.3.tar.gz"
diff --git a/testing/twisted-web2/APKBUILD b/testing/twisted-web2/APKBUILD
deleted file mode 100644
index 78e70633..00000000
--- a/testing/twisted-web2/APKBUILD
+++ /dev/null
@@ -1,20 +0,0 @@
-# Contributor: Francesco Colista <francesco.colista@gmail.com>
-# Maintainer: Francesco Colista <francesco.colista@gmail.com>
-
-pkgname=twisted-web2
-pkgver=8.1.0
-pkgrel=0
-pkgdesc="The twisted.web2 package in Twisted."
-url="http://twistedmatrix.com/"
-license="GPL"
-depends="twisted"
-makedepends="python-dev"
-source="http://tmrc.mit.edu/mirror/twisted/Web2/8.1/TwistedWeb2-$pkgver.tar.bz2"
-
-build() {
-    cd $srcdir/TwistedWeb2-8.1.0/
-        python setup.py install --prefix=/usr --root=$pkgdir || return 1
-}
-
-
-md5sums="e34b48edf6fef075bd41ddbd215aed32  TwistedWeb2-8.1.0.tar.bz2"
-- 
cgit v1.2.3


From 266adc718373b9971f3cb88804c541de4a7a8ddf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 14:16:40 +0000
Subject: testing/mediaproxy: dependencies changed name

---
 testing/mediaproxy/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/testing/mediaproxy/APKBUILD b/testing/mediaproxy/APKBUILD
index 6702781d..3cd3d4d9 100644
--- a/testing/mediaproxy/APKBUILD
+++ b/testing/mediaproxy/APKBUILD
@@ -2,15 +2,15 @@
 # Maintainer: 
 pkgname=mediaproxy
 pkgver=2.3.8
-pkgrel=3
+pkgrel=4
 pkgdesc="MediaProxy"
 url="http://www.ag-projects.com/MediaProxy/"
 pkgusers="kamailio"
 pkggroups="kamailio"
 license="GPL"
-depends="python python-application python-gnutls twisted python-cjson iptables"
-makedepends="libnetfilter_conntrack-dev libnfnetlink-dev python26-buildutils
-	python26-setuptools python-dev"
+depends="python py-application py-gnutls py-twisted py-cjson iptables"
+makedepends="libnetfilter_conntrack-dev libnfnetlink-dev py-buildutils
+	py-setuptools python-dev"
 install=
 subpackages=""
 #subpackages="$pkgname-dev $pkgname-doc"
-- 
cgit v1.2.3


From dfa5df7148ac4d673f0376edcaacaf86b51521cc Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 14:17:30 +0000
Subject: testing/openxcap: dependencies changed name

---
 testing/openxcap/APKBUILD | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/testing/openxcap/APKBUILD b/testing/openxcap/APKBUILD
index c0650283..61e6d2d4 100644
--- a/testing/openxcap/APKBUILD
+++ b/testing/openxcap/APKBUILD
@@ -3,13 +3,14 @@
 
 pkgname=openxcap
 pkgver=1.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Open source fully featured XCAP server "
 url="http://openxcap.org"
 pkgusers="openxcap"
 pkggroups="openxcap"
 license="GPL"
-depends="python python-application python-gnutls twisted twisted-web2 python-imaging python-lxml python-mysqldb"
+depends="python py-application py-gnutls py-twisted py-twisted-web2 py-imaging
+	py-lxml py-mysqldb"
 makedepends="python-dev"
 install="$pkgname.pre-install $pkgname.post-install"
 source="http://download.ag-projects.com/XCAP/$pkgname-$pkgver.tar.gz
-- 
cgit v1.2.3


From 68fcfe3a64c3b9cc00f8d16604c082ceb7d0b277 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Fri, 21 May 2010 14:20:54 +0000
Subject: testing/openxcap: config.ini fix

---
 testing/openxcap/APKBUILD | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/testing/openxcap/APKBUILD b/testing/openxcap/APKBUILD
index 61e6d2d4..0a4379b6 100644
--- a/testing/openxcap/APKBUILD
+++ b/testing/openxcap/APKBUILD
@@ -29,6 +29,8 @@ build() {
 		> "$pkgdir"/usr/lib/python2.6/site-packages/$pkgname.pth
 
 	install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	install -m644 -D "$srcdir"/config.ini \
+	                "$pkgdir"/etc/openxcap/config.ini
         install -d -o openxcap "$pkgdir"/var/run/openxcap
 }
 
-- 
cgit v1.2.3


From b324d6e706466a723e1735e8f789f6e8351557b6 Mon Sep 17 00:00:00 2001
From: Leonardo Arena <rnalrd@gmail.com>
Date: Fri, 21 May 2010 14:22:57 +0000
Subject: testing/openxcap: init.d fix

---
 testing/openxcap/APKBUILD       | 2 +-
 testing/openxcap/openxcap.initd | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/testing/openxcap/APKBUILD b/testing/openxcap/APKBUILD
index 0a4379b6..118a8782 100644
--- a/testing/openxcap/APKBUILD
+++ b/testing/openxcap/APKBUILD
@@ -36,4 +36,4 @@ build() {
 
 md5sums="ec34570deee2019a1ebf9a012a476c26  openxcap-1.2.0.tar.gz
 7a18872843586717eaf3879444cc13d2  config.ini
-dad5f337c29c9e245846d9991d057b6e  openxcap.initd"
+5bebac590cb06b0eacaf040116bc354e  openxcap.initd"
diff --git a/testing/openxcap/openxcap.initd b/testing/openxcap/openxcap.initd
index e58a7792..69108afd 100644
--- a/testing/openxcap/openxcap.initd
+++ b/testing/openxcap/openxcap.initd
@@ -2,7 +2,7 @@
 #
 
 daemon=/usr/bin/openxcap
-pidfile=/var/run/openxcap/openxcap.pid"
+pidfile=/var/run/openxcap/openxcap.pid
 
 depend() {
 	 need net
-- 
cgit v1.2.3


From 6450177f2f95119cb3e8332b1863d92cef0ae90a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 21 May 2010 14:35:04 +0000
Subject: main/qemu: moved from testing

---
 main/qemu/APKBUILD                      |  90 +++
 main/qemu/kqemu.c                       | 997 ++++++++++++++++++++++++++++++++
 main/qemu/kqemu.patch                   |  32 +
 main/qemu/qemu-0.10.3-nopl-fix.patch    |  32 +
 main/qemu/qemu.pre-install              |   6 +
 testing/qemu/APKBUILD                   |  90 ---
 testing/qemu/kqemu.c                    | 997 --------------------------------
 testing/qemu/kqemu.patch                |  32 -
 testing/qemu/qemu-0.10.3-nopl-fix.patch |  32 -
 testing/qemu/qemu.pre-install           |   6 -
 10 files changed, 1157 insertions(+), 1157 deletions(-)
 create mode 100644 main/qemu/APKBUILD
 create mode 100644 main/qemu/kqemu.c
 create mode 100644 main/qemu/kqemu.patch
 create mode 100644 main/qemu/qemu-0.10.3-nopl-fix.patch
 create mode 100644 main/qemu/qemu.pre-install
 delete mode 100644 testing/qemu/APKBUILD
 delete mode 100644 testing/qemu/kqemu.c
 delete mode 100644 testing/qemu/kqemu.patch
 delete mode 100644 testing/qemu/qemu-0.10.3-nopl-fix.patch
 delete mode 100644 testing/qemu/qemu.pre-install

diff --git a/main/qemu/APKBUILD b/main/qemu/APKBUILD
new file mode 100644
index 00000000..4d3d7100
--- /dev/null
+++ b/main/qemu/APKBUILD
@@ -0,0 +1,90 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=qemu
+pkgver=0.12.4
+pkgrel=0
+pkgdesc="QEMU is a generic machine emulator and virtualizer"
+url="http://www.nongnu.org/qemu/"
+license="GPL-2 LGPL-2"
+makedepends="zlib-dev sdl-dev alsa-lib-dev gnutls-dev ncurses-dev"
+depends=
+install="qemu.pre-install"
+subpackages="
+$pkgname-arm
+$pkgname-cris
+$pkgname-m68k
+$pkgname-microblaze
+$pkgname-mips
+$pkgname-mips64
+$pkgname-mips64el
+$pkgname-mipsel
+$pkgname-ppc
+$pkgname-ppc64
+$pkgname-ppcemb
+$pkgname-sh4
+$pkgname-sh4eb
+$pkgname-sparc
+$pkgname-sparc64
+$pkgname-x86_64
+"
+source="http://savannah.nongnu.org/download/$pkgname/$pkgname-$pkgver.tar.gz
+	kqemu.patch
+	"
+
+prepare() {
+	cd "$srcdir"/$pkgname-$pkgver
+	# avoid fdt till an updated release appears
+	sed -i -e 's:fdt="yes":fdt="no":' configure
+	# prevent docs to get automatically installed
+	sed -i '/$(DESTDIR)$(docdir)/d' Makefile
+	# Alter target makefiles to accept CFLAGS
+	sed -i 's/^\(C\|OP_C\|HELPER_C\)FLAGS=/\1FLAGS+=/' \
+		Makefile Makefile.target tests/Makefile
+	sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
+		Makefile.target
+#	patch -p1 -i ../kqemu.patch || return 1
+}
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--audio-drv-list=oss,alsa,sdl \
+		--audio-card-list=ac97,sb16,es1370,adlib \
+		--disable-darwin-user \
+		--disable-bsd-user \
+		--disable-linux-user \
+		--cc="${CC:-gcc}"
+
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+
+_subsys() {
+	pkgdesc="Qemu $1 system emulator"
+	depend="qemu"
+	mkdir -p "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/qemu-system-$1 "$subpkgdir"/usr/bin/
+}
+
+arm() { _subsys arm; }
+cris() { _subsys cris; }
+m68k() { _subsys m68k; }
+microblaze() { _subsys microblaze; }
+mips() { _subsys mips; }
+mips64() { _subsys mips64; }
+mips64el() { _subsys mips64el; }
+mipsel() { _subsys mipsel; }
+ppc() { _subsys ppc; }
+ppc64() { _subsys ppc64; }
+ppcemb() { _subsys ppcemb; }
+sh4() { _subsys sh4; }
+sh4eb() { _subsys sh4eb; }
+sparc() { _subsys sparc; }
+sparc64() { _subsys sparc64; }
+x86_64() { _subsys x86_64; }
+
+md5sums="93e6b134dff89b2799f57b7d9e0e0fc5  qemu-0.12.4.tar.gz
+f63f7412f016d8ccddabfd02ea28e748  kqemu.patch"
diff --git a/main/qemu/kqemu.c b/main/qemu/kqemu.c
new file mode 100644
index 00000000..035d310a
--- /dev/null
+++ b/main/qemu/kqemu.c
@@ -0,0 +1,997 @@
+/*
+ *  KQEMU support
+ *
+ *  Copyright (c) 2005-2008 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
+ */
+#include "config.h"
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <winioctl.h>
+#else
+#include <sys/types.h>
+#include <sys/mman.h>
+#include <sys/ioctl.h>
+#endif
+#ifdef HOST_SOLARIS
+#include <sys/ioccom.h>
+#endif
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <inttypes.h>
+
+#include "cpu.h"
+#include "exec-all.h"
+#include "qemu-common.h"
+
+#ifdef USE_KQEMU
+
+#define DEBUG
+//#define PROFILE
+
+
+#ifdef DEBUG
+#  define LOG_INT(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
+#  define LOG_INT_STATE(env) log_cpu_state_mask(CPU_LOG_INT, (env), 0)
+#else
+#  define LOG_INT(...) do { } while (0)
+#  define LOG_INT_STATE(env) do { } while (0)
+#endif
+
+#include <unistd.h>
+#include <fcntl.h>
+#include "kqemu.h"
+
+#ifdef _WIN32
+#define KQEMU_DEVICE "\\\\.\\kqemu"
+#else
+#define KQEMU_DEVICE "/dev/kqemu"
+#endif
+
+static void qpi_init(void);
+
+#ifdef _WIN32
+#define KQEMU_INVALID_FD INVALID_HANDLE_VALUE
+HANDLE kqemu_fd = KQEMU_INVALID_FD;
+#define kqemu_closefd(x) CloseHandle(x)
+#else
+#define KQEMU_INVALID_FD -1
+int kqemu_fd = KQEMU_INVALID_FD;
+#define kqemu_closefd(x) close(x)
+#endif
+
+/* 0 = not allowed
+   1 = user kqemu
+   2 = kernel kqemu
+*/
+int kqemu_allowed = 1;
+uint64_t *pages_to_flush;
+unsigned int nb_pages_to_flush;
+uint64_t *ram_pages_to_update;
+unsigned int nb_ram_pages_to_update;
+uint64_t *modified_ram_pages;
+unsigned int nb_modified_ram_pages;
+uint8_t *modified_ram_pages_table;
+int qpi_io_memory;
+uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
+
+#define cpuid(index, eax, ecx, edx) \
+  asm volatile ("cpuid" \
+                : "=a" (eax), "=c" (ecx), "=d" (edx) \
+                : "0" (index))
+
+#ifdef __x86_64__
+static int is_cpuid_supported(void)
+{
+    return 1;
+}
+#else
+static int is_cpuid_supported(void)
+{
+    int v0, v1;
+    asm volatile ("pushf\n"
+                  "popl %0\n"
+                  "movl %0, %1\n"
+                  "xorl $0x00200000, %0\n"
+                  "pushl %0\n"
+                  "popf\n"
+                  "pushf\n"
+                  "popl %0\n"
+                  : "=a" (v0), "=d" (v1)
+                  :
+                  : "cc");
+    return (v0 != v1);
+}
+#endif
+
+static void kqemu_update_cpuid(CPUState *env)
+{
+    int critical_features_mask, features, ext_features, ext_features_mask;
+    uint32_t eax, ecx, edx;
+
+    /* the following features are kept identical on the host and
+       target cpus because they are important for user code. Strictly
+       speaking, only SSE really matters because the OS must support
+       it if the user code uses it. */
+    critical_features_mask =
+        CPUID_CMOV | CPUID_CX8 |
+        CPUID_FXSR | CPUID_MMX | CPUID_SSE |
+        CPUID_SSE2 | CPUID_SEP;
+    ext_features_mask = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR;
+    if (!is_cpuid_supported()) {
+        features = 0;
+        ext_features = 0;
+    } else {
+        cpuid(1, eax, ecx, edx);
+        features = edx;
+        ext_features = ecx;
+    }
+#ifdef __x86_64__
+    /* NOTE: on x86_64 CPUs, SYSENTER is not supported in
+       compatibility mode, so in order to have the best performances
+       it is better not to use it */
+    features &= ~CPUID_SEP;
+#endif
+    env->cpuid_features = (env->cpuid_features & ~critical_features_mask) |
+        (features & critical_features_mask);
+    env->cpuid_ext_features = (env->cpuid_ext_features & ~ext_features_mask) |
+        (ext_features & ext_features_mask);
+    /* XXX: we could update more of the target CPUID state so that the
+       non accelerated code sees exactly the same CPU features as the
+       accelerated code */
+}
+
+int kqemu_init(CPUState *env)
+{
+    struct kqemu_init kinit;
+    int ret, version;
+#ifdef _WIN32
+    DWORD temp;
+#endif
+
+    if (!kqemu_allowed)
+        return -1;
+
+#ifdef _WIN32
+    kqemu_fd = CreateFile(KQEMU_DEVICE, GENERIC_WRITE | GENERIC_READ,
+                          FILE_SHARE_READ | FILE_SHARE_WRITE,
+                          NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
+                          NULL);
+    if (kqemu_fd == KQEMU_INVALID_FD) {
+        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %lu\n",
+                KQEMU_DEVICE, GetLastError());
+        return -1;
+    }
+#else
+    kqemu_fd = open(KQEMU_DEVICE, O_RDWR);
+    if (kqemu_fd == KQEMU_INVALID_FD) {
+        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %s\n",
+                KQEMU_DEVICE, strerror(errno));
+        return -1;
+    }
+#endif
+    version = 0;
+#ifdef _WIN32
+    DeviceIoControl(kqemu_fd, KQEMU_GET_VERSION, NULL, 0,
+                    &version, sizeof(version), &temp, NULL);
+#else
+    ioctl(kqemu_fd, KQEMU_GET_VERSION, &version);
+#endif
+    if (version != KQEMU_VERSION) {
+        fprintf(stderr, "Version mismatch between kqemu module and qemu (%08x %08x) - disabling kqemu use\n",
+                version, KQEMU_VERSION);
+        goto fail;
+    }
+
+    pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH *
+                                  sizeof(uint64_t));
+    if (!pages_to_flush)
+        goto fail;
+
+    ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE *
+                                       sizeof(uint64_t));
+    if (!ram_pages_to_update)
+        goto fail;
+
+    modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES *
+                                      sizeof(uint64_t));
+    if (!modified_ram_pages)
+        goto fail;
+    modified_ram_pages_table = qemu_mallocz(phys_ram_size >> TARGET_PAGE_BITS);
+    if (!modified_ram_pages_table)
+        goto fail;
+
+    memset(&kinit, 0, sizeof(kinit)); /* set the paddings to zero */
+    kinit.ram_base = phys_ram_base;
+    kinit.ram_size = phys_ram_size;
+    kinit.ram_dirty = phys_ram_dirty;
+    kinit.pages_to_flush = pages_to_flush;
+    kinit.ram_pages_to_update = ram_pages_to_update;
+    kinit.modified_ram_pages = modified_ram_pages;
+#ifdef _WIN32
+    ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &kinit, sizeof(kinit),
+                          NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
+#else
+    ret = ioctl(kqemu_fd, KQEMU_INIT, &kinit);
+#endif
+    if (ret < 0) {
+        fprintf(stderr, "Error %d while initializing QEMU acceleration layer - disabling it for now\n", ret);
+    fail:
+        kqemu_closefd(kqemu_fd);
+        kqemu_fd = KQEMU_INVALID_FD;
+        return -1;
+    }
+    kqemu_update_cpuid(env);
+    env->kqemu_enabled = kqemu_allowed;
+    nb_pages_to_flush = 0;
+    nb_ram_pages_to_update = 0;
+
+    qpi_init();
+    return 0;
+}
+
+void kqemu_flush_page(CPUState *env, target_ulong addr)
+{
+    LOG_INT("kqemu_flush_page: addr=" TARGET_FMT_lx "\n", addr);
+    if (nb_pages_to_flush >= KQEMU_MAX_PAGES_TO_FLUSH)
+        nb_pages_to_flush = KQEMU_FLUSH_ALL;
+    else
+        pages_to_flush[nb_pages_to_flush++] = addr;
+}
+
+void kqemu_flush(CPUState *env, int global)
+{
+    LOG_INT("kqemu_flush:\n");
+    nb_pages_to_flush = KQEMU_FLUSH_ALL;
+}
+
+void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr)
+{
+    LOG_INT("kqemu_set_notdirty: addr=%08lx\n", 
+                (unsigned long)ram_addr);
+    /* we only track transitions to dirty state */
+    if (phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] != 0xff)
+        return;
+    if (nb_ram_pages_to_update >= KQEMU_MAX_RAM_PAGES_TO_UPDATE)
+        nb_ram_pages_to_update = KQEMU_RAM_PAGES_UPDATE_ALL;
+    else
+        ram_pages_to_update[nb_ram_pages_to_update++] = ram_addr;
+}
+
+static void kqemu_reset_modified_ram_pages(void)
+{
+    int i;
+    unsigned long page_index;
+
+    for(i = 0; i < nb_modified_ram_pages; i++) {
+        page_index = modified_ram_pages[i] >> TARGET_PAGE_BITS;
+        modified_ram_pages_table[page_index] = 0;
+    }
+    nb_modified_ram_pages = 0;
+}
+
+void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
+{
+    unsigned long page_index;
+    int ret;
+#ifdef _WIN32
+    DWORD temp;
+#endif
+
+    page_index = ram_addr >> TARGET_PAGE_BITS;
+    if (!modified_ram_pages_table[page_index]) {
+#if 0
+        printf("%d: modify_page=%08lx\n", nb_modified_ram_pages, ram_addr);
+#endif
+        modified_ram_pages_table[page_index] = 1;
+        modified_ram_pages[nb_modified_ram_pages++] = ram_addr;
+        if (nb_modified_ram_pages >= KQEMU_MAX_MODIFIED_RAM_PAGES) {
+            /* flush */
+#ifdef _WIN32
+            ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
+                                  &nb_modified_ram_pages,
+                                  sizeof(nb_modified_ram_pages),
+                                  NULL, 0, &temp, NULL);
+#else
+            ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
+                        &nb_modified_ram_pages);
+#endif
+            kqemu_reset_modified_ram_pages();
+        }
+    }
+}
+
+void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, 
+                        ram_addr_t phys_offset)
+{
+    struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1;
+    uint64_t end;
+    int ret, io_index;
+
+    end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
+    start_addr &= TARGET_PAGE_MASK;
+    kphys_mem->phys_addr = start_addr;
+    kphys_mem->size = end - start_addr;
+    kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK;
+    io_index = phys_offset & ~TARGET_PAGE_MASK;
+    switch(io_index) {
+    case IO_MEM_RAM:
+        kphys_mem->io_index = KQEMU_IO_MEM_RAM;
+        break;
+    case IO_MEM_ROM:
+        kphys_mem->io_index = KQEMU_IO_MEM_ROM;
+        break;
+    default:
+        if (qpi_io_memory == io_index) {
+            kphys_mem->io_index = KQEMU_IO_MEM_COMM;
+        } else {
+            kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED;
+        }
+        break;
+    }
+#ifdef _WIN32
+    {
+        DWORD temp;
+        ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM, 
+                              kphys_mem, sizeof(*kphys_mem),
+                              NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
+    }
+#else
+    ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem);
+#endif
+    if (ret < 0) {
+        fprintf(stderr, "kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016" PRIx64 " size=0x%08lx phys_offset=0x%08lx\n",
+                ret, start_addr, 
+                (unsigned long)size, (unsigned long)phys_offset);
+    }
+}
+
+struct fpstate {
+    uint16_t fpuc;
+    uint16_t dummy1;
+    uint16_t fpus;
+    uint16_t dummy2;
+    uint16_t fptag;
+    uint16_t dummy3;
+
+    uint32_t fpip;
+    uint32_t fpcs;
+    uint32_t fpoo;
+    uint32_t fpos;
+    uint8_t fpregs1[8 * 10];
+};
+
+struct fpxstate {
+    uint16_t fpuc;
+    uint16_t fpus;
+    uint16_t fptag;
+    uint16_t fop;
+    uint32_t fpuip;
+    uint16_t cs_sel;
+    uint16_t dummy0;
+    uint32_t fpudp;
+    uint16_t ds_sel;
+    uint16_t dummy1;
+    uint32_t mxcsr;
+    uint32_t mxcsr_mask;
+    uint8_t fpregs1[8 * 16];
+    uint8_t xmm_regs[16 * 16];
+    uint8_t dummy2[96];
+};
+
+static struct fpxstate fpx1 __attribute__((aligned(16)));
+
+static void restore_native_fp_frstor(CPUState *env)
+{
+    int fptag, i, j;
+    struct fpstate fp1, *fp = &fp1;
+
+    fp->fpuc = env->fpuc;
+    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
+    fptag = 0;
+    for (i=7; i>=0; i--) {
+	fptag <<= 2;
+	if (env->fptags[i]) {
+            fptag |= 3;
+        } else {
+            /* the FPU automatically computes it */
+        }
+    }
+    fp->fptag = fptag;
+    j = env->fpstt;
+    for(i = 0;i < 8; i++) {
+        memcpy(&fp->fpregs1[i * 10], &env->fpregs[j].d, 10);
+        j = (j + 1) & 7;
+    }
+    asm volatile ("frstor %0" : "=m" (*fp));
+}
+
+static void save_native_fp_fsave(CPUState *env)
+{
+    int fptag, i, j;
+    uint16_t fpuc;
+    struct fpstate fp1, *fp = &fp1;
+
+    asm volatile ("fsave %0" : : "m" (*fp));
+    env->fpuc = fp->fpuc;
+    env->fpstt = (fp->fpus >> 11) & 7;
+    env->fpus = fp->fpus & ~0x3800;
+    fptag = fp->fptag;
+    for(i = 0;i < 8; i++) {
+        env->fptags[i] = ((fptag & 3) == 3);
+        fptag >>= 2;
+    }
+    j = env->fpstt;
+    for(i = 0;i < 8; i++) {
+        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 10], 10);
+        j = (j + 1) & 7;
+    }
+    /* we must restore the default rounding state */
+    fpuc = 0x037f | (env->fpuc & (3 << 10));
+    asm volatile("fldcw %0" : : "m" (fpuc));
+}
+
+static void restore_native_fp_fxrstor(CPUState *env)
+{
+    struct fpxstate *fp = &fpx1;
+    int i, j, fptag;
+
+    fp->fpuc = env->fpuc;
+    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
+    fptag = 0;
+    for(i = 0; i < 8; i++)
+        fptag |= (env->fptags[i] << i);
+    fp->fptag = fptag ^ 0xff;
+
+    j = env->fpstt;
+    for(i = 0;i < 8; i++) {
+        memcpy(&fp->fpregs1[i * 16], &env->fpregs[j].d, 10);
+        j = (j + 1) & 7;
+    }
+    if (env->cpuid_features & CPUID_SSE) {
+        fp->mxcsr = env->mxcsr;
+        /* XXX: check if DAZ is not available */
+        fp->mxcsr_mask = 0xffff;
+        memcpy(fp->xmm_regs, env->xmm_regs, CPU_NB_REGS * 16);
+    }
+    asm volatile ("fxrstor %0" : "=m" (*fp));
+}
+
+static void save_native_fp_fxsave(CPUState *env)
+{
+    struct fpxstate *fp = &fpx1;
+    int fptag, i, j;
+    uint16_t fpuc;
+
+    asm volatile ("fxsave %0" : : "m" (*fp));
+    env->fpuc = fp->fpuc;
+    env->fpstt = (fp->fpus >> 11) & 7;
+    env->fpus = fp->fpus & ~0x3800;
+    fptag = fp->fptag ^ 0xff;
+    for(i = 0;i < 8; i++) {
+        env->fptags[i] = (fptag >> i) & 1;
+    }
+    j = env->fpstt;
+    for(i = 0;i < 8; i++) {
+        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 16], 10);
+        j = (j + 1) & 7;
+    }
+    if (env->cpuid_features & CPUID_SSE) {
+        env->mxcsr = fp->mxcsr;
+        memcpy(env->xmm_regs, fp->xmm_regs, CPU_NB_REGS * 16);
+    }
+
+    /* we must restore the default rounding state */
+    asm volatile ("fninit");
+    fpuc = 0x037f | (env->fpuc & (3 << 10));
+    asm volatile("fldcw %0" : : "m" (fpuc));
+}
+
+static int do_syscall(CPUState *env,
+                      struct kqemu_cpu_state *kenv)
+{
+    int selector;
+
+    selector = (env->star >> 32) & 0xffff;
+#ifdef TARGET_X86_64
+    if (env->hflags & HF_LMA_MASK) {
+        int code64;
+
+        env->regs[R_ECX] = kenv->next_eip;
+        env->regs[11] = env->eflags;
+
+        code64 = env->hflags & HF_CS64_MASK;
+
+        cpu_x86_set_cpl(env, 0);
+        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
+                               0, 0xffffffff,
+                               DESC_G_MASK | DESC_P_MASK |
+                               DESC_S_MASK |
+                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
+        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
+                               0, 0xffffffff,
+                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
+                               DESC_S_MASK |
+                               DESC_W_MASK | DESC_A_MASK);
+        env->eflags &= ~env->fmask;
+        if (code64)
+            env->eip = env->lstar;
+        else
+            env->eip = env->cstar;
+    } else
+#endif
+    {
+        env->regs[R_ECX] = (uint32_t)kenv->next_eip;
+
+        cpu_x86_set_cpl(env, 0);
+        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
+                           0, 0xffffffff,
+                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
+                               DESC_S_MASK |
+                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
+        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
+                               0, 0xffffffff,
+                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
+                               DESC_S_MASK |
+                               DESC_W_MASK | DESC_A_MASK);
+        env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
+        env->eip = (uint32_t)env->star;
+    }
+    return 2;
+}
+
+#ifdef CONFIG_PROFILER
+
+#define PC_REC_SIZE 1
+#define PC_REC_HASH_BITS 16
+#define PC_REC_HASH_SIZE (1 << PC_REC_HASH_BITS)
+
+typedef struct PCRecord {
+    unsigned long pc;
+    int64_t count;
+    struct PCRecord *next;
+} PCRecord;
+
+static PCRecord *pc_rec_hash[PC_REC_HASH_SIZE];
+static int nb_pc_records;
+
+static void kqemu_record_pc(unsigned long pc)
+{
+    unsigned long h;
+    PCRecord **pr, *r;
+
+    h = pc / PC_REC_SIZE;
+    h = h ^ (h >> PC_REC_HASH_BITS);
+    h &= (PC_REC_HASH_SIZE - 1);
+    pr = &pc_rec_hash[h];
+    for(;;) {
+        r = *pr;
+        if (r == NULL)
+            break;
+        if (r->pc == pc) {
+            r->count++;
+            return;
+        }
+        pr = &r->next;
+    }
+    r = malloc(sizeof(PCRecord));
+    r->count = 1;
+    r->pc = pc;
+    r->next = NULL;
+    *pr = r;
+    nb_pc_records++;
+}
+
+static int pc_rec_cmp(const void *p1, const void *p2)
+{
+    PCRecord *r1 = *(PCRecord **)p1;
+    PCRecord *r2 = *(PCRecord **)p2;
+    if (r1->count < r2->count)
+        return 1;
+    else if (r1->count == r2->count)
+        return 0;
+    else
+        return -1;
+}
+
+static void kqemu_record_flush(void)
+{
+    PCRecord *r, *r_next;
+    int h;
+
+    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
+        for(r = pc_rec_hash[h]; r != NULL; r = r_next) {
+            r_next = r->next;
+            free(r);
+        }
+        pc_rec_hash[h] = NULL;
+    }
+    nb_pc_records = 0;
+}
+
+void kqemu_record_dump(void)
+{
+    PCRecord **pr, *r;
+    int i, h;
+    FILE *f;
+    int64_t total, sum;
+
+    pr = malloc(sizeof(PCRecord *) * nb_pc_records);
+    i = 0;
+    total = 0;
+    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
+        for(r = pc_rec_hash[h]; r != NULL; r = r->next) {
+            pr[i++] = r;
+            total += r->count;
+        }
+    }
+    qsort(pr, nb_pc_records, sizeof(PCRecord *), pc_rec_cmp);
+
+    f = fopen("/tmp/kqemu.stats", "w");
+    if (!f) {
+        perror("/tmp/kqemu.stats");
+        exit(1);
+    }
+    fprintf(f, "total: %" PRId64 "\n", total);
+    sum = 0;
+    for(i = 0; i < nb_pc_records; i++) {
+        r = pr[i];
+        sum += r->count;
+        fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n",
+                r->pc,
+                r->count,
+                (double)r->count / (double)total * 100.0,
+                (double)sum / (double)total * 100.0);
+    }
+    fclose(f);
+    free(pr);
+
+    kqemu_record_flush();
+}
+#endif
+
+static inline void kqemu_load_seg(struct kqemu_segment_cache *ksc,
+                                  const SegmentCache *sc)
+{
+    ksc->selector = sc->selector;
+    ksc->flags = sc->flags;
+    ksc->limit = sc->limit;
+    ksc->base = sc->base;
+}
+
+static inline void kqemu_save_seg(SegmentCache *sc,
+                                  const struct kqemu_segment_cache *ksc)
+{
+    sc->selector = ksc->selector;
+    sc->flags = ksc->flags;
+    sc->limit = ksc->limit;
+    sc->base = ksc->base;
+}
+
+int kqemu_cpu_exec(CPUState *env)
+{
+    struct kqemu_cpu_state kcpu_state, *kenv = &kcpu_state;
+    int ret, cpl, i;
+#ifdef CONFIG_PROFILER
+    int64_t ti;
+#endif
+#ifdef _WIN32
+    DWORD temp;
+#endif
+
+#ifdef CONFIG_PROFILER
+    ti = profile_getclock();
+#endif
+    LOG_INT("kqemu: cpu_exec: enter\n");
+    LOG_INT_STATE(env);
+    for(i = 0; i < CPU_NB_REGS; i++)
+        kenv->regs[i] = env->regs[i];
+    kenv->eip = env->eip;
+    kenv->eflags = env->eflags;
+    for(i = 0; i < 6; i++)
+        kqemu_load_seg(&kenv->segs[i], &env->segs[i]);
+    kqemu_load_seg(&kenv->ldt, &env->ldt);
+    kqemu_load_seg(&kenv->tr, &env->tr);
+    kqemu_load_seg(&kenv->gdt, &env->gdt);
+    kqemu_load_seg(&kenv->idt, &env->idt);
+    kenv->cr0 = env->cr[0];
+    kenv->cr2 = env->cr[2];
+    kenv->cr3 = env->cr[3];
+    kenv->cr4 = env->cr[4];
+    kenv->a20_mask = env->a20_mask;
+    kenv->efer = env->efer;
+    kenv->tsc_offset = 0;
+    kenv->star = env->star;
+    kenv->sysenter_cs = env->sysenter_cs;
+    kenv->sysenter_esp = env->sysenter_esp;
+    kenv->sysenter_eip = env->sysenter_eip;
+#ifdef TARGET_X86_64
+    kenv->lstar = env->lstar;
+    kenv->cstar = env->cstar;
+    kenv->fmask = env->fmask;
+    kenv->kernelgsbase = env->kernelgsbase;
+#endif
+    if (env->dr[7] & 0xff) {
+        kenv->dr7 = env->dr[7];
+        kenv->dr0 = env->dr[0];
+        kenv->dr1 = env->dr[1];
+        kenv->dr2 = env->dr[2];
+        kenv->dr3 = env->dr[3];
+    } else {
+        kenv->dr7 = 0;
+    }
+    kenv->dr6 = env->dr[6];
+    cpl = (env->hflags & HF_CPL_MASK);
+    kenv->cpl = cpl;
+    kenv->nb_pages_to_flush = nb_pages_to_flush;
+    kenv->user_only = (env->kqemu_enabled == 1);
+    kenv->nb_ram_pages_to_update = nb_ram_pages_to_update;
+    nb_ram_pages_to_update = 0;
+    kenv->nb_modified_ram_pages = nb_modified_ram_pages;
+
+    kqemu_reset_modified_ram_pages();
+
+    if (env->cpuid_features & CPUID_FXSR)
+        restore_native_fp_fxrstor(env);
+    else
+        restore_native_fp_frstor(env);
+
+#ifdef _WIN32
+    if (DeviceIoControl(kqemu_fd, KQEMU_EXEC,
+                        kenv, sizeof(struct kqemu_cpu_state),
+                        kenv, sizeof(struct kqemu_cpu_state),
+                        &temp, NULL)) {
+        ret = kenv->retval;
+    } else {
+        ret = -1;
+    }
+#else
+    ioctl(kqemu_fd, KQEMU_EXEC, kenv);
+    ret = kenv->retval;
+#endif
+    if (env->cpuid_features & CPUID_FXSR)
+        save_native_fp_fxsave(env);
+    else
+        save_native_fp_fsave(env);
+
+    for(i = 0; i < CPU_NB_REGS; i++)
+        env->regs[i] = kenv->regs[i];
+    env->eip = kenv->eip;
+    env->eflags = kenv->eflags;
+    for(i = 0; i < 6; i++)
+        kqemu_save_seg(&env->segs[i], &kenv->segs[i]);
+    cpu_x86_set_cpl(env, kenv->cpl);
+    kqemu_save_seg(&env->ldt, &kenv->ldt);
+    env->cr[0] = kenv->cr0;
+    env->cr[4] = kenv->cr4;
+    env->cr[3] = kenv->cr3;
+    env->cr[2] = kenv->cr2;
+    env->dr[6] = kenv->dr6;
+#ifdef TARGET_X86_64
+    env->kernelgsbase = kenv->kernelgsbase;
+#endif
+
+    /* flush pages as indicated by kqemu */
+    if (kenv->nb_pages_to_flush >= KQEMU_FLUSH_ALL) {
+        tlb_flush(env, 1);
+    } else {
+        for(i = 0; i < kenv->nb_pages_to_flush; i++) {
+            tlb_flush_page(env, pages_to_flush[i]);
+        }
+    }
+    nb_pages_to_flush = 0;
+
+#ifdef CONFIG_PROFILER
+    kqemu_time += profile_getclock() - ti;
+    kqemu_exec_count++;
+#endif
+
+    if (kenv->nb_ram_pages_to_update > 0) {
+        cpu_tlb_update_dirty(env);
+    }
+
+    if (kenv->nb_modified_ram_pages > 0) {
+        for(i = 0; i < kenv->nb_modified_ram_pages; i++) {
+            unsigned long addr;
+            addr = modified_ram_pages[i];
+            tb_invalidate_phys_page_range(addr, addr + TARGET_PAGE_SIZE, 0);
+        }
+    }
+
+    /* restore the hidden flags */
+    {
+        unsigned int new_hflags;
+#ifdef TARGET_X86_64
+        if ((env->hflags & HF_LMA_MASK) &&
+            (env->segs[R_CS].flags & DESC_L_MASK)) {
+            /* long mode */
+            new_hflags = HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
+        } else
+#endif
+        {
+            /* legacy / compatibility case */
+            new_hflags = (env->segs[R_CS].flags & DESC_B_MASK)
+                >> (DESC_B_SHIFT - HF_CS32_SHIFT);
+            new_hflags |= (env->segs[R_SS].flags & DESC_B_MASK)
+                >> (DESC_B_SHIFT - HF_SS32_SHIFT);
+            if (!(env->cr[0] & CR0_PE_MASK) ||
+                   (env->eflags & VM_MASK) ||
+                   !(env->hflags & HF_CS32_MASK)) {
+                /* XXX: try to avoid this test. The problem comes from the
+                   fact that is real mode or vm86 mode we only modify the
+                   'base' and 'selector' fields of the segment cache to go
+                   faster. A solution may be to force addseg to one in
+                   translate-i386.c. */
+                new_hflags |= HF_ADDSEG_MASK;
+            } else {
+                new_hflags |= ((env->segs[R_DS].base |
+                                env->segs[R_ES].base |
+                                env->segs[R_SS].base) != 0) <<
+                    HF_ADDSEG_SHIFT;
+            }
+        }
+        env->hflags = (env->hflags &
+           ~(HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)) |
+            new_hflags;
+    }
+    /* update FPU flags */
+    env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |
+        ((env->cr[0] << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));
+    if (env->cr[4] & CR4_OSFXSR_MASK)
+        env->hflags |= HF_OSFXSR_MASK;
+    else
+        env->hflags &= ~HF_OSFXSR_MASK;
+
+    LOG_INT("kqemu: kqemu_cpu_exec: ret=0x%x\n", ret);
+    if (ret == KQEMU_RET_SYSCALL) {
+        /* syscall instruction */
+        return do_syscall(env, kenv);
+    } else
+    if ((ret & 0xff00) == KQEMU_RET_INT) {
+        env->exception_index = ret & 0xff;
+        env->error_code = 0;
+        env->exception_is_int = 1;
+        env->exception_next_eip = kenv->next_eip;
+#ifdef CONFIG_PROFILER
+        kqemu_ret_int_count++;
+#endif
+        LOG_INT("kqemu: interrupt v=%02x:\n", env->exception_index);
+        LOG_INT_STATE(env);
+        return 1;
+    } else if ((ret & 0xff00) == KQEMU_RET_EXCEPTION) {
+        env->exception_index = ret & 0xff;
+        env->error_code = kenv->error_code;
+        env->exception_is_int = 0;
+        env->exception_next_eip = 0;
+#ifdef CONFIG_PROFILER
+        kqemu_ret_excp_count++;
+#endif
+        LOG_INT("kqemu: exception v=%02x e=%04x:\n",
+                    env->exception_index, env->error_code);
+        LOG_INT_STATE(env);
+        return 1;
+    } else if (ret == KQEMU_RET_INTR) {
+#ifdef CONFIG_PROFILER
+        kqemu_ret_intr_count++;
+#endif
+        LOG_INT_STATE(env);
+        return 0;
+    } else if (ret == KQEMU_RET_SOFTMMU) {
+#ifdef CONFIG_PROFILER
+        {
+            unsigned long pc = env->eip + env->segs[R_CS].base;
+            kqemu_record_pc(pc);
+        }
+#endif
+        LOG_INT_STATE(env);
+        return 2;
+    } else {
+        cpu_dump_state(env, stderr, fprintf, 0);
+        fprintf(stderr, "Unsupported return value: 0x%x\n", ret);
+        exit(1);
+    }
+    return 0;
+}
+
+void kqemu_cpu_interrupt(CPUState *env)
+{
+#if defined(_WIN32)
+    /* cancelling the I/O request causes KQEMU to finish executing the
+       current block and successfully returning. */
+    CancelIo(kqemu_fd);
+#endif
+}
+
+/* 
+   QEMU paravirtualization interface. The current interface only
+   allows to modify the IF and IOPL flags when running in
+   kqemu.
+
+   At this point it is not very satisfactory. I leave it for reference
+   as it adds little complexity.
+*/
+
+#define QPI_COMM_PAGE_PHYS_ADDR 0xff000000
+
+static uint32_t qpi_mem_readb(void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static uint32_t qpi_mem_readw(void *opaque, target_phys_addr_t addr)
+{
+    return 0;
+}
+
+static void qpi_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+}
+
+static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+}
+
+static uint32_t qpi_mem_readl(void *opaque, target_phys_addr_t addr)
+{
+    CPUState *env;
+
+    env = cpu_single_env;
+    if (!env)
+        return 0;
+    return env->eflags & (IF_MASK | IOPL_MASK);
+}
+
+/* Note: after writing to this address, the guest code must make sure
+   it is exiting the current TB. pushf/popf can be used for that
+   purpose. */
+static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+{
+    CPUState *env;
+
+    env = cpu_single_env;
+    if (!env)
+        return;
+    env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | 
+        (val & (IF_MASK | IOPL_MASK));
+}
+
+static CPUReadMemoryFunc *qpi_mem_read[3] = {
+    qpi_mem_readb,
+    qpi_mem_readw,
+    qpi_mem_readl,
+};
+
+static CPUWriteMemoryFunc *qpi_mem_write[3] = {
+    qpi_mem_writeb,
+    qpi_mem_writew,
+    qpi_mem_writel,
+};
+
+static void qpi_init(void)
+{
+    kqemu_comm_base = 0xff000000 | 1;
+    qpi_io_memory = cpu_register_io_memory(0, 
+                                           qpi_mem_read, 
+                                           qpi_mem_write, NULL);
+    cpu_register_physical_memory(kqemu_comm_base & ~0xfff, 
+                                 0x1000, qpi_io_memory);
+}
+#endif
diff --git a/main/qemu/kqemu.patch b/main/qemu/kqemu.patch
new file mode 100644
index 00000000..337a356c
--- /dev/null
+++ b/main/qemu/kqemu.patch
@@ -0,0 +1,32 @@
+--- a/kqemu.c	2009-07-17 00:56:23.000000000 +0000
++++ b/kqemu.c	2009-08-22 13:20:00.000000000 +0000
+@@ -93,9 +93,9 @@
+ int qpi_io_memory;
+ uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
+ 
+-#define cpuid(index, eax, ebx, ecx, edx) \
++#define cpuid(index, eax, ecx, edx) \
+   asm volatile ("cpuid" \
+-                : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) \
++                : "=a" (eax), "=c" (ecx), "=d" (edx) \
+                 : "0" (index))
+ 
+ #ifdef __x86_64__
+@@ -125,7 +125,7 @@
+ static void kqemu_update_cpuid(CPUState *env)
+ {
+     int critical_features_mask, features, ext_features, ext_features_mask;
+-    uint32_t eax, ebx, ecx, edx;
++    uint32_t eax, ecx, edx;
+ 
+     /* the following features are kept identical on the host and
+        target cpus because they are important for user code. Strictly
+@@ -140,7 +140,7 @@
+         features = 0;
+         ext_features = 0;
+     } else {
+-        cpuid(1, eax, ebx, ecx, edx);
++        cpuid(1, eax, ecx, edx);
+         features = edx;
+         ext_features = ecx;
+     }
diff --git a/main/qemu/qemu-0.10.3-nopl-fix.patch b/main/qemu/qemu-0.10.3-nopl-fix.patch
new file mode 100644
index 00000000..bdef0efc
--- /dev/null
+++ b/main/qemu/qemu-0.10.3-nopl-fix.patch
@@ -0,0 +1,32 @@
+--- i386-dis.c	2009-03-22 00:05:48.000000000 +0100
++++ i386-dis_new.c	2009-04-21 08:31:08.000000000 +0200
+@@ -784,13 +784,13 @@
+   { "movhpX",		EX, XM, SIMD_Fixup, 'l' },
+   /* 18 */
+   { GRP14 },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
+-  { "(bad)",		XX, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
++  { "nopQ",		Ev, XX, XX },
+   /* 20 */
+   { "movL",		Rm, Cm, XX },
+   { "movL",		Rm, Dm, XX },
+@@ -1072,7 +1072,7 @@
+   /*       0 1 2 3 4 5 6 7 8 9 a b c d e f        */
+   /*       -------------------------------        */
+   /* 00 */ 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1, /* 0f */
+-  /* 10 */ 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0, /* 1f */
++  /* 10 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, /* 1f */
+   /* 20 */ 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1, /* 2f */
+   /* 30 */ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, /* 3f */
+   /* 40 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, /* 4f */
diff --git a/main/qemu/qemu.pre-install b/main/qemu/qemu.pre-install
new file mode 100644
index 00000000..0119bacb
--- /dev/null
+++ b/main/qemu/qemu.pre-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if ! getent group | grep -q "^kvm:"; then
+	addgroup kvm
+fi
+
diff --git a/testing/qemu/APKBUILD b/testing/qemu/APKBUILD
deleted file mode 100644
index 4d3d7100..00000000
--- a/testing/qemu/APKBUILD
+++ /dev/null
@@ -1,90 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=qemu
-pkgver=0.12.4
-pkgrel=0
-pkgdesc="QEMU is a generic machine emulator and virtualizer"
-url="http://www.nongnu.org/qemu/"
-license="GPL-2 LGPL-2"
-makedepends="zlib-dev sdl-dev alsa-lib-dev gnutls-dev ncurses-dev"
-depends=
-install="qemu.pre-install"
-subpackages="
-$pkgname-arm
-$pkgname-cris
-$pkgname-m68k
-$pkgname-microblaze
-$pkgname-mips
-$pkgname-mips64
-$pkgname-mips64el
-$pkgname-mipsel
-$pkgname-ppc
-$pkgname-ppc64
-$pkgname-ppcemb
-$pkgname-sh4
-$pkgname-sh4eb
-$pkgname-sparc
-$pkgname-sparc64
-$pkgname-x86_64
-"
-source="http://savannah.nongnu.org/download/$pkgname/$pkgname-$pkgver.tar.gz
-	kqemu.patch
-	"
-
-prepare() {
-	cd "$srcdir"/$pkgname-$pkgver
-	# avoid fdt till an updated release appears
-	sed -i -e 's:fdt="yes":fdt="no":' configure
-	# prevent docs to get automatically installed
-	sed -i '/$(DESTDIR)$(docdir)/d' Makefile
-	# Alter target makefiles to accept CFLAGS
-	sed -i 's/^\(C\|OP_C\|HELPER_C\)FLAGS=/\1FLAGS+=/' \
-		Makefile Makefile.target tests/Makefile
-	sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
-		Makefile.target
-#	patch -p1 -i ../kqemu.patch || return 1
-}
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr \
-		--audio-drv-list=oss,alsa,sdl \
-		--audio-card-list=ac97,sb16,es1370,adlib \
-		--disable-darwin-user \
-		--disable-bsd-user \
-		--disable-linux-user \
-		--cc="${CC:-gcc}"
-
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install || return 1
-}
-
-_subsys() {
-	pkgdesc="Qemu $1 system emulator"
-	depend="qemu"
-	mkdir -p "$subpkgdir"/usr/bin
-	mv "$pkgdir"/usr/bin/qemu-system-$1 "$subpkgdir"/usr/bin/
-}
-
-arm() { _subsys arm; }
-cris() { _subsys cris; }
-m68k() { _subsys m68k; }
-microblaze() { _subsys microblaze; }
-mips() { _subsys mips; }
-mips64() { _subsys mips64; }
-mips64el() { _subsys mips64el; }
-mipsel() { _subsys mipsel; }
-ppc() { _subsys ppc; }
-ppc64() { _subsys ppc64; }
-ppcemb() { _subsys ppcemb; }
-sh4() { _subsys sh4; }
-sh4eb() { _subsys sh4eb; }
-sparc() { _subsys sparc; }
-sparc64() { _subsys sparc64; }
-x86_64() { _subsys x86_64; }
-
-md5sums="93e6b134dff89b2799f57b7d9e0e0fc5  qemu-0.12.4.tar.gz
-f63f7412f016d8ccddabfd02ea28e748  kqemu.patch"
diff --git a/testing/qemu/kqemu.c b/testing/qemu/kqemu.c
deleted file mode 100644
index 035d310a..00000000
--- a/testing/qemu/kqemu.c
+++ /dev/null
@@ -1,997 +0,0 @@
-/*
- *  KQEMU support
- *
- *  Copyright (c) 2005-2008 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
- */
-#include "config.h"
-#ifdef _WIN32
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-#include <winioctl.h>
-#else
-#include <sys/types.h>
-#include <sys/mman.h>
-#include <sys/ioctl.h>
-#endif
-#ifdef HOST_SOLARIS
-#include <sys/ioccom.h>
-#endif
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <inttypes.h>
-
-#include "cpu.h"
-#include "exec-all.h"
-#include "qemu-common.h"
-
-#ifdef USE_KQEMU
-
-#define DEBUG
-//#define PROFILE
-
-
-#ifdef DEBUG
-#  define LOG_INT(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
-#  define LOG_INT_STATE(env) log_cpu_state_mask(CPU_LOG_INT, (env), 0)
-#else
-#  define LOG_INT(...) do { } while (0)
-#  define LOG_INT_STATE(env) do { } while (0)
-#endif
-
-#include <unistd.h>
-#include <fcntl.h>
-#include "kqemu.h"
-
-#ifdef _WIN32
-#define KQEMU_DEVICE "\\\\.\\kqemu"
-#else
-#define KQEMU_DEVICE "/dev/kqemu"
-#endif
-
-static void qpi_init(void);
-
-#ifdef _WIN32
-#define KQEMU_INVALID_FD INVALID_HANDLE_VALUE
-HANDLE kqemu_fd = KQEMU_INVALID_FD;
-#define kqemu_closefd(x) CloseHandle(x)
-#else
-#define KQEMU_INVALID_FD -1
-int kqemu_fd = KQEMU_INVALID_FD;
-#define kqemu_closefd(x) close(x)
-#endif
-
-/* 0 = not allowed
-   1 = user kqemu
-   2 = kernel kqemu
-*/
-int kqemu_allowed = 1;
-uint64_t *pages_to_flush;
-unsigned int nb_pages_to_flush;
-uint64_t *ram_pages_to_update;
-unsigned int nb_ram_pages_to_update;
-uint64_t *modified_ram_pages;
-unsigned int nb_modified_ram_pages;
-uint8_t *modified_ram_pages_table;
-int qpi_io_memory;
-uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
-
-#define cpuid(index, eax, ecx, edx) \
-  asm volatile ("cpuid" \
-                : "=a" (eax), "=c" (ecx), "=d" (edx) \
-                : "0" (index))
-
-#ifdef __x86_64__
-static int is_cpuid_supported(void)
-{
-    return 1;
-}
-#else
-static int is_cpuid_supported(void)
-{
-    int v0, v1;
-    asm volatile ("pushf\n"
-                  "popl %0\n"
-                  "movl %0, %1\n"
-                  "xorl $0x00200000, %0\n"
-                  "pushl %0\n"
-                  "popf\n"
-                  "pushf\n"
-                  "popl %0\n"
-                  : "=a" (v0), "=d" (v1)
-                  :
-                  : "cc");
-    return (v0 != v1);
-}
-#endif
-
-static void kqemu_update_cpuid(CPUState *env)
-{
-    int critical_features_mask, features, ext_features, ext_features_mask;
-    uint32_t eax, ecx, edx;
-
-    /* the following features are kept identical on the host and
-       target cpus because they are important for user code. Strictly
-       speaking, only SSE really matters because the OS must support
-       it if the user code uses it. */
-    critical_features_mask =
-        CPUID_CMOV | CPUID_CX8 |
-        CPUID_FXSR | CPUID_MMX | CPUID_SSE |
-        CPUID_SSE2 | CPUID_SEP;
-    ext_features_mask = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR;
-    if (!is_cpuid_supported()) {
-        features = 0;
-        ext_features = 0;
-    } else {
-        cpuid(1, eax, ecx, edx);
-        features = edx;
-        ext_features = ecx;
-    }
-#ifdef __x86_64__
-    /* NOTE: on x86_64 CPUs, SYSENTER is not supported in
-       compatibility mode, so in order to have the best performances
-       it is better not to use it */
-    features &= ~CPUID_SEP;
-#endif
-    env->cpuid_features = (env->cpuid_features & ~critical_features_mask) |
-        (features & critical_features_mask);
-    env->cpuid_ext_features = (env->cpuid_ext_features & ~ext_features_mask) |
-        (ext_features & ext_features_mask);
-    /* XXX: we could update more of the target CPUID state so that the
-       non accelerated code sees exactly the same CPU features as the
-       accelerated code */
-}
-
-int kqemu_init(CPUState *env)
-{
-    struct kqemu_init kinit;
-    int ret, version;
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-    if (!kqemu_allowed)
-        return -1;
-
-#ifdef _WIN32
-    kqemu_fd = CreateFile(KQEMU_DEVICE, GENERIC_WRITE | GENERIC_READ,
-                          FILE_SHARE_READ | FILE_SHARE_WRITE,
-                          NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
-                          NULL);
-    if (kqemu_fd == KQEMU_INVALID_FD) {
-        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %lu\n",
-                KQEMU_DEVICE, GetLastError());
-        return -1;
-    }
-#else
-    kqemu_fd = open(KQEMU_DEVICE, O_RDWR);
-    if (kqemu_fd == KQEMU_INVALID_FD) {
-        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %s\n",
-                KQEMU_DEVICE, strerror(errno));
-        return -1;
-    }
-#endif
-    version = 0;
-#ifdef _WIN32
-    DeviceIoControl(kqemu_fd, KQEMU_GET_VERSION, NULL, 0,
-                    &version, sizeof(version), &temp, NULL);
-#else
-    ioctl(kqemu_fd, KQEMU_GET_VERSION, &version);
-#endif
-    if (version != KQEMU_VERSION) {
-        fprintf(stderr, "Version mismatch between kqemu module and qemu (%08x %08x) - disabling kqemu use\n",
-                version, KQEMU_VERSION);
-        goto fail;
-    }
-
-    pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH *
-                                  sizeof(uint64_t));
-    if (!pages_to_flush)
-        goto fail;
-
-    ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE *
-                                       sizeof(uint64_t));
-    if (!ram_pages_to_update)
-        goto fail;
-
-    modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES *
-                                      sizeof(uint64_t));
-    if (!modified_ram_pages)
-        goto fail;
-    modified_ram_pages_table = qemu_mallocz(phys_ram_size >> TARGET_PAGE_BITS);
-    if (!modified_ram_pages_table)
-        goto fail;
-
-    memset(&kinit, 0, sizeof(kinit)); /* set the paddings to zero */
-    kinit.ram_base = phys_ram_base;
-    kinit.ram_size = phys_ram_size;
-    kinit.ram_dirty = phys_ram_dirty;
-    kinit.pages_to_flush = pages_to_flush;
-    kinit.ram_pages_to_update = ram_pages_to_update;
-    kinit.modified_ram_pages = modified_ram_pages;
-#ifdef _WIN32
-    ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &kinit, sizeof(kinit),
-                          NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
-#else
-    ret = ioctl(kqemu_fd, KQEMU_INIT, &kinit);
-#endif
-    if (ret < 0) {
-        fprintf(stderr, "Error %d while initializing QEMU acceleration layer - disabling it for now\n", ret);
-    fail:
-        kqemu_closefd(kqemu_fd);
-        kqemu_fd = KQEMU_INVALID_FD;
-        return -1;
-    }
-    kqemu_update_cpuid(env);
-    env->kqemu_enabled = kqemu_allowed;
-    nb_pages_to_flush = 0;
-    nb_ram_pages_to_update = 0;
-
-    qpi_init();
-    return 0;
-}
-
-void kqemu_flush_page(CPUState *env, target_ulong addr)
-{
-    LOG_INT("kqemu_flush_page: addr=" TARGET_FMT_lx "\n", addr);
-    if (nb_pages_to_flush >= KQEMU_MAX_PAGES_TO_FLUSH)
-        nb_pages_to_flush = KQEMU_FLUSH_ALL;
-    else
-        pages_to_flush[nb_pages_to_flush++] = addr;
-}
-
-void kqemu_flush(CPUState *env, int global)
-{
-    LOG_INT("kqemu_flush:\n");
-    nb_pages_to_flush = KQEMU_FLUSH_ALL;
-}
-
-void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr)
-{
-    LOG_INT("kqemu_set_notdirty: addr=%08lx\n", 
-                (unsigned long)ram_addr);
-    /* we only track transitions to dirty state */
-    if (phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] != 0xff)
-        return;
-    if (nb_ram_pages_to_update >= KQEMU_MAX_RAM_PAGES_TO_UPDATE)
-        nb_ram_pages_to_update = KQEMU_RAM_PAGES_UPDATE_ALL;
-    else
-        ram_pages_to_update[nb_ram_pages_to_update++] = ram_addr;
-}
-
-static void kqemu_reset_modified_ram_pages(void)
-{
-    int i;
-    unsigned long page_index;
-
-    for(i = 0; i < nb_modified_ram_pages; i++) {
-        page_index = modified_ram_pages[i] >> TARGET_PAGE_BITS;
-        modified_ram_pages_table[page_index] = 0;
-    }
-    nb_modified_ram_pages = 0;
-}
-
-void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
-{
-    unsigned long page_index;
-    int ret;
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-    page_index = ram_addr >> TARGET_PAGE_BITS;
-    if (!modified_ram_pages_table[page_index]) {
-#if 0
-        printf("%d: modify_page=%08lx\n", nb_modified_ram_pages, ram_addr);
-#endif
-        modified_ram_pages_table[page_index] = 1;
-        modified_ram_pages[nb_modified_ram_pages++] = ram_addr;
-        if (nb_modified_ram_pages >= KQEMU_MAX_MODIFIED_RAM_PAGES) {
-            /* flush */
-#ifdef _WIN32
-            ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
-                                  &nb_modified_ram_pages,
-                                  sizeof(nb_modified_ram_pages),
-                                  NULL, 0, &temp, NULL);
-#else
-            ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
-                        &nb_modified_ram_pages);
-#endif
-            kqemu_reset_modified_ram_pages();
-        }
-    }
-}
-
-void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, 
-                        ram_addr_t phys_offset)
-{
-    struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1;
-    uint64_t end;
-    int ret, io_index;
-
-    end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
-    start_addr &= TARGET_PAGE_MASK;
-    kphys_mem->phys_addr = start_addr;
-    kphys_mem->size = end - start_addr;
-    kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK;
-    io_index = phys_offset & ~TARGET_PAGE_MASK;
-    switch(io_index) {
-    case IO_MEM_RAM:
-        kphys_mem->io_index = KQEMU_IO_MEM_RAM;
-        break;
-    case IO_MEM_ROM:
-        kphys_mem->io_index = KQEMU_IO_MEM_ROM;
-        break;
-    default:
-        if (qpi_io_memory == io_index) {
-            kphys_mem->io_index = KQEMU_IO_MEM_COMM;
-        } else {
-            kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED;
-        }
-        break;
-    }
-#ifdef _WIN32
-    {
-        DWORD temp;
-        ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM, 
-                              kphys_mem, sizeof(*kphys_mem),
-                              NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
-    }
-#else
-    ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem);
-#endif
-    if (ret < 0) {
-        fprintf(stderr, "kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016" PRIx64 " size=0x%08lx phys_offset=0x%08lx\n",
-                ret, start_addr, 
-                (unsigned long)size, (unsigned long)phys_offset);
-    }
-}
-
-struct fpstate {
-    uint16_t fpuc;
-    uint16_t dummy1;
-    uint16_t fpus;
-    uint16_t dummy2;
-    uint16_t fptag;
-    uint16_t dummy3;
-
-    uint32_t fpip;
-    uint32_t fpcs;
-    uint32_t fpoo;
-    uint32_t fpos;
-    uint8_t fpregs1[8 * 10];
-};
-
-struct fpxstate {
-    uint16_t fpuc;
-    uint16_t fpus;
-    uint16_t fptag;
-    uint16_t fop;
-    uint32_t fpuip;
-    uint16_t cs_sel;
-    uint16_t dummy0;
-    uint32_t fpudp;
-    uint16_t ds_sel;
-    uint16_t dummy1;
-    uint32_t mxcsr;
-    uint32_t mxcsr_mask;
-    uint8_t fpregs1[8 * 16];
-    uint8_t xmm_regs[16 * 16];
-    uint8_t dummy2[96];
-};
-
-static struct fpxstate fpx1 __attribute__((aligned(16)));
-
-static void restore_native_fp_frstor(CPUState *env)
-{
-    int fptag, i, j;
-    struct fpstate fp1, *fp = &fp1;
-
-    fp->fpuc = env->fpuc;
-    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for (i=7; i>=0; i--) {
-	fptag <<= 2;
-	if (env->fptags[i]) {
-            fptag |= 3;
-        } else {
-            /* the FPU automatically computes it */
-        }
-    }
-    fp->fptag = fptag;
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&fp->fpregs1[i * 10], &env->fpregs[j].d, 10);
-        j = (j + 1) & 7;
-    }
-    asm volatile ("frstor %0" : "=m" (*fp));
-}
-
-static void save_native_fp_fsave(CPUState *env)
-{
-    int fptag, i, j;
-    uint16_t fpuc;
-    struct fpstate fp1, *fp = &fp1;
-
-    asm volatile ("fsave %0" : : "m" (*fp));
-    env->fpuc = fp->fpuc;
-    env->fpstt = (fp->fpus >> 11) & 7;
-    env->fpus = fp->fpus & ~0x3800;
-    fptag = fp->fptag;
-    for(i = 0;i < 8; i++) {
-        env->fptags[i] = ((fptag & 3) == 3);
-        fptag >>= 2;
-    }
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 10], 10);
-        j = (j + 1) & 7;
-    }
-    /* we must restore the default rounding state */
-    fpuc = 0x037f | (env->fpuc & (3 << 10));
-    asm volatile("fldcw %0" : : "m" (fpuc));
-}
-
-static void restore_native_fp_fxrstor(CPUState *env)
-{
-    struct fpxstate *fp = &fpx1;
-    int i, j, fptag;
-
-    fp->fpuc = env->fpuc;
-    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for(i = 0; i < 8; i++)
-        fptag |= (env->fptags[i] << i);
-    fp->fptag = fptag ^ 0xff;
-
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&fp->fpregs1[i * 16], &env->fpregs[j].d, 10);
-        j = (j + 1) & 7;
-    }
-    if (env->cpuid_features & CPUID_SSE) {
-        fp->mxcsr = env->mxcsr;
-        /* XXX: check if DAZ is not available */
-        fp->mxcsr_mask = 0xffff;
-        memcpy(fp->xmm_regs, env->xmm_regs, CPU_NB_REGS * 16);
-    }
-    asm volatile ("fxrstor %0" : "=m" (*fp));
-}
-
-static void save_native_fp_fxsave(CPUState *env)
-{
-    struct fpxstate *fp = &fpx1;
-    int fptag, i, j;
-    uint16_t fpuc;
-
-    asm volatile ("fxsave %0" : : "m" (*fp));
-    env->fpuc = fp->fpuc;
-    env->fpstt = (fp->fpus >> 11) & 7;
-    env->fpus = fp->fpus & ~0x3800;
-    fptag = fp->fptag ^ 0xff;
-    for(i = 0;i < 8; i++) {
-        env->fptags[i] = (fptag >> i) & 1;
-    }
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 16], 10);
-        j = (j + 1) & 7;
-    }
-    if (env->cpuid_features & CPUID_SSE) {
-        env->mxcsr = fp->mxcsr;
-        memcpy(env->xmm_regs, fp->xmm_regs, CPU_NB_REGS * 16);
-    }
-
-    /* we must restore the default rounding state */
-    asm volatile ("fninit");
-    fpuc = 0x037f | (env->fpuc & (3 << 10));
-    asm volatile("fldcw %0" : : "m" (fpuc));
-}
-
-static int do_syscall(CPUState *env,
-                      struct kqemu_cpu_state *kenv)
-{
-    int selector;
-
-    selector = (env->star >> 32) & 0xffff;
-#ifdef TARGET_X86_64
-    if (env->hflags & HF_LMA_MASK) {
-        int code64;
-
-        env->regs[R_ECX] = kenv->next_eip;
-        env->regs[11] = env->eflags;
-
-        code64 = env->hflags & HF_CS64_MASK;
-
-        cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_W_MASK | DESC_A_MASK);
-        env->eflags &= ~env->fmask;
-        if (code64)
-            env->eip = env->lstar;
-        else
-            env->eip = env->cstar;
-    } else
-#endif
-    {
-        env->regs[R_ECX] = (uint32_t)kenv->next_eip;
-
-        cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
-                           0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_W_MASK | DESC_A_MASK);
-        env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
-        env->eip = (uint32_t)env->star;
-    }
-    return 2;
-}
-
-#ifdef CONFIG_PROFILER
-
-#define PC_REC_SIZE 1
-#define PC_REC_HASH_BITS 16
-#define PC_REC_HASH_SIZE (1 << PC_REC_HASH_BITS)
-
-typedef struct PCRecord {
-    unsigned long pc;
-    int64_t count;
-    struct PCRecord *next;
-} PCRecord;
-
-static PCRecord *pc_rec_hash[PC_REC_HASH_SIZE];
-static int nb_pc_records;
-
-static void kqemu_record_pc(unsigned long pc)
-{
-    unsigned long h;
-    PCRecord **pr, *r;
-
-    h = pc / PC_REC_SIZE;
-    h = h ^ (h >> PC_REC_HASH_BITS);
-    h &= (PC_REC_HASH_SIZE - 1);
-    pr = &pc_rec_hash[h];
-    for(;;) {
-        r = *pr;
-        if (r == NULL)
-            break;
-        if (r->pc == pc) {
-            r->count++;
-            return;
-        }
-        pr = &r->next;
-    }
-    r = malloc(sizeof(PCRecord));
-    r->count = 1;
-    r->pc = pc;
-    r->next = NULL;
-    *pr = r;
-    nb_pc_records++;
-}
-
-static int pc_rec_cmp(const void *p1, const void *p2)
-{
-    PCRecord *r1 = *(PCRecord **)p1;
-    PCRecord *r2 = *(PCRecord **)p2;
-    if (r1->count < r2->count)
-        return 1;
-    else if (r1->count == r2->count)
-        return 0;
-    else
-        return -1;
-}
-
-static void kqemu_record_flush(void)
-{
-    PCRecord *r, *r_next;
-    int h;
-
-    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
-        for(r = pc_rec_hash[h]; r != NULL; r = r_next) {
-            r_next = r->next;
-            free(r);
-        }
-        pc_rec_hash[h] = NULL;
-    }
-    nb_pc_records = 0;
-}
-
-void kqemu_record_dump(void)
-{
-    PCRecord **pr, *r;
-    int i, h;
-    FILE *f;
-    int64_t total, sum;
-
-    pr = malloc(sizeof(PCRecord *) * nb_pc_records);
-    i = 0;
-    total = 0;
-    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
-        for(r = pc_rec_hash[h]; r != NULL; r = r->next) {
-            pr[i++] = r;
-            total += r->count;
-        }
-    }
-    qsort(pr, nb_pc_records, sizeof(PCRecord *), pc_rec_cmp);
-
-    f = fopen("/tmp/kqemu.stats", "w");
-    if (!f) {
-        perror("/tmp/kqemu.stats");
-        exit(1);
-    }
-    fprintf(f, "total: %" PRId64 "\n", total);
-    sum = 0;
-    for(i = 0; i < nb_pc_records; i++) {
-        r = pr[i];
-        sum += r->count;
-        fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n",
-                r->pc,
-                r->count,
-                (double)r->count / (double)total * 100.0,
-                (double)sum / (double)total * 100.0);
-    }
-    fclose(f);
-    free(pr);
-
-    kqemu_record_flush();
-}
-#endif
-
-static inline void kqemu_load_seg(struct kqemu_segment_cache *ksc,
-                                  const SegmentCache *sc)
-{
-    ksc->selector = sc->selector;
-    ksc->flags = sc->flags;
-    ksc->limit = sc->limit;
-    ksc->base = sc->base;
-}
-
-static inline void kqemu_save_seg(SegmentCache *sc,
-                                  const struct kqemu_segment_cache *ksc)
-{
-    sc->selector = ksc->selector;
-    sc->flags = ksc->flags;
-    sc->limit = ksc->limit;
-    sc->base = ksc->base;
-}
-
-int kqemu_cpu_exec(CPUState *env)
-{
-    struct kqemu_cpu_state kcpu_state, *kenv = &kcpu_state;
-    int ret, cpl, i;
-#ifdef CONFIG_PROFILER
-    int64_t ti;
-#endif
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-#ifdef CONFIG_PROFILER
-    ti = profile_getclock();
-#endif
-    LOG_INT("kqemu: cpu_exec: enter\n");
-    LOG_INT_STATE(env);
-    for(i = 0; i < CPU_NB_REGS; i++)
-        kenv->regs[i] = env->regs[i];
-    kenv->eip = env->eip;
-    kenv->eflags = env->eflags;
-    for(i = 0; i < 6; i++)
-        kqemu_load_seg(&kenv->segs[i], &env->segs[i]);
-    kqemu_load_seg(&kenv->ldt, &env->ldt);
-    kqemu_load_seg(&kenv->tr, &env->tr);
-    kqemu_load_seg(&kenv->gdt, &env->gdt);
-    kqemu_load_seg(&kenv->idt, &env->idt);
-    kenv->cr0 = env->cr[0];
-    kenv->cr2 = env->cr[2];
-    kenv->cr3 = env->cr[3];
-    kenv->cr4 = env->cr[4];
-    kenv->a20_mask = env->a20_mask;
-    kenv->efer = env->efer;
-    kenv->tsc_offset = 0;
-    kenv->star = env->star;
-    kenv->sysenter_cs = env->sysenter_cs;
-    kenv->sysenter_esp = env->sysenter_esp;
-    kenv->sysenter_eip = env->sysenter_eip;
-#ifdef TARGET_X86_64
-    kenv->lstar = env->lstar;
-    kenv->cstar = env->cstar;
-    kenv->fmask = env->fmask;
-    kenv->kernelgsbase = env->kernelgsbase;
-#endif
-    if (env->dr[7] & 0xff) {
-        kenv->dr7 = env->dr[7];
-        kenv->dr0 = env->dr[0];
-        kenv->dr1 = env->dr[1];
-        kenv->dr2 = env->dr[2];
-        kenv->dr3 = env->dr[3];
-    } else {
-        kenv->dr7 = 0;
-    }
-    kenv->dr6 = env->dr[6];
-    cpl = (env->hflags & HF_CPL_MASK);
-    kenv->cpl = cpl;
-    kenv->nb_pages_to_flush = nb_pages_to_flush;
-    kenv->user_only = (env->kqemu_enabled == 1);
-    kenv->nb_ram_pages_to_update = nb_ram_pages_to_update;
-    nb_ram_pages_to_update = 0;
-    kenv->nb_modified_ram_pages = nb_modified_ram_pages;
-
-    kqemu_reset_modified_ram_pages();
-
-    if (env->cpuid_features & CPUID_FXSR)
-        restore_native_fp_fxrstor(env);
-    else
-        restore_native_fp_frstor(env);
-
-#ifdef _WIN32
-    if (DeviceIoControl(kqemu_fd, KQEMU_EXEC,
-                        kenv, sizeof(struct kqemu_cpu_state),
-                        kenv, sizeof(struct kqemu_cpu_state),
-                        &temp, NULL)) {
-        ret = kenv->retval;
-    } else {
-        ret = -1;
-    }
-#else
-    ioctl(kqemu_fd, KQEMU_EXEC, kenv);
-    ret = kenv->retval;
-#endif
-    if (env->cpuid_features & CPUID_FXSR)
-        save_native_fp_fxsave(env);
-    else
-        save_native_fp_fsave(env);
-
-    for(i = 0; i < CPU_NB_REGS; i++)
-        env->regs[i] = kenv->regs[i];
-    env->eip = kenv->eip;
-    env->eflags = kenv->eflags;
-    for(i = 0; i < 6; i++)
-        kqemu_save_seg(&env->segs[i], &kenv->segs[i]);
-    cpu_x86_set_cpl(env, kenv->cpl);
-    kqemu_save_seg(&env->ldt, &kenv->ldt);
-    env->cr[0] = kenv->cr0;
-    env->cr[4] = kenv->cr4;
-    env->cr[3] = kenv->cr3;
-    env->cr[2] = kenv->cr2;
-    env->dr[6] = kenv->dr6;
-#ifdef TARGET_X86_64
-    env->kernelgsbase = kenv->kernelgsbase;
-#endif
-
-    /* flush pages as indicated by kqemu */
-    if (kenv->nb_pages_to_flush >= KQEMU_FLUSH_ALL) {
-        tlb_flush(env, 1);
-    } else {
-        for(i = 0; i < kenv->nb_pages_to_flush; i++) {
-            tlb_flush_page(env, pages_to_flush[i]);
-        }
-    }
-    nb_pages_to_flush = 0;
-
-#ifdef CONFIG_PROFILER
-    kqemu_time += profile_getclock() - ti;
-    kqemu_exec_count++;
-#endif
-
-    if (kenv->nb_ram_pages_to_update > 0) {
-        cpu_tlb_update_dirty(env);
-    }
-
-    if (kenv->nb_modified_ram_pages > 0) {
-        for(i = 0; i < kenv->nb_modified_ram_pages; i++) {
-            unsigned long addr;
-            addr = modified_ram_pages[i];
-            tb_invalidate_phys_page_range(addr, addr + TARGET_PAGE_SIZE, 0);
-        }
-    }
-
-    /* restore the hidden flags */
-    {
-        unsigned int new_hflags;
-#ifdef TARGET_X86_64
-        if ((env->hflags & HF_LMA_MASK) &&
-            (env->segs[R_CS].flags & DESC_L_MASK)) {
-            /* long mode */
-            new_hflags = HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
-        } else
-#endif
-        {
-            /* legacy / compatibility case */
-            new_hflags = (env->segs[R_CS].flags & DESC_B_MASK)
-                >> (DESC_B_SHIFT - HF_CS32_SHIFT);
-            new_hflags |= (env->segs[R_SS].flags & DESC_B_MASK)
-                >> (DESC_B_SHIFT - HF_SS32_SHIFT);
-            if (!(env->cr[0] & CR0_PE_MASK) ||
-                   (env->eflags & VM_MASK) ||
-                   !(env->hflags & HF_CS32_MASK)) {
-                /* XXX: try to avoid this test. The problem comes from the
-                   fact that is real mode or vm86 mode we only modify the
-                   'base' and 'selector' fields of the segment cache to go
-                   faster. A solution may be to force addseg to one in
-                   translate-i386.c. */
-                new_hflags |= HF_ADDSEG_MASK;
-            } else {
-                new_hflags |= ((env->segs[R_DS].base |
-                                env->segs[R_ES].base |
-                                env->segs[R_SS].base) != 0) <<
-                    HF_ADDSEG_SHIFT;
-            }
-        }
-        env->hflags = (env->hflags &
-           ~(HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)) |
-            new_hflags;
-    }
-    /* update FPU flags */
-    env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |
-        ((env->cr[0] << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));
-    if (env->cr[4] & CR4_OSFXSR_MASK)
-        env->hflags |= HF_OSFXSR_MASK;
-    else
-        env->hflags &= ~HF_OSFXSR_MASK;
-
-    LOG_INT("kqemu: kqemu_cpu_exec: ret=0x%x\n", ret);
-    if (ret == KQEMU_RET_SYSCALL) {
-        /* syscall instruction */
-        return do_syscall(env, kenv);
-    } else
-    if ((ret & 0xff00) == KQEMU_RET_INT) {
-        env->exception_index = ret & 0xff;
-        env->error_code = 0;
-        env->exception_is_int = 1;
-        env->exception_next_eip = kenv->next_eip;
-#ifdef CONFIG_PROFILER
-        kqemu_ret_int_count++;
-#endif
-        LOG_INT("kqemu: interrupt v=%02x:\n", env->exception_index);
-        LOG_INT_STATE(env);
-        return 1;
-    } else if ((ret & 0xff00) == KQEMU_RET_EXCEPTION) {
-        env->exception_index = ret & 0xff;
-        env->error_code = kenv->error_code;
-        env->exception_is_int = 0;
-        env->exception_next_eip = 0;
-#ifdef CONFIG_PROFILER
-        kqemu_ret_excp_count++;
-#endif
-        LOG_INT("kqemu: exception v=%02x e=%04x:\n",
-                    env->exception_index, env->error_code);
-        LOG_INT_STATE(env);
-        return 1;
-    } else if (ret == KQEMU_RET_INTR) {
-#ifdef CONFIG_PROFILER
-        kqemu_ret_intr_count++;
-#endif
-        LOG_INT_STATE(env);
-        return 0;
-    } else if (ret == KQEMU_RET_SOFTMMU) {
-#ifdef CONFIG_PROFILER
-        {
-            unsigned long pc = env->eip + env->segs[R_CS].base;
-            kqemu_record_pc(pc);
-        }
-#endif
-        LOG_INT_STATE(env);
-        return 2;
-    } else {
-        cpu_dump_state(env, stderr, fprintf, 0);
-        fprintf(stderr, "Unsupported return value: 0x%x\n", ret);
-        exit(1);
-    }
-    return 0;
-}
-
-void kqemu_cpu_interrupt(CPUState *env)
-{
-#if defined(_WIN32)
-    /* cancelling the I/O request causes KQEMU to finish executing the
-       current block and successfully returning. */
-    CancelIo(kqemu_fd);
-#endif
-}
-
-/* 
-   QEMU paravirtualization interface. The current interface only
-   allows to modify the IF and IOPL flags when running in
-   kqemu.
-
-   At this point it is not very satisfactory. I leave it for reference
-   as it adds little complexity.
-*/
-
-#define QPI_COMM_PAGE_PHYS_ADDR 0xff000000
-
-static uint32_t qpi_mem_readb(void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static uint32_t qpi_mem_readw(void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static void qpi_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-}
-
-static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-}
-
-static uint32_t qpi_mem_readl(void *opaque, target_phys_addr_t addr)
-{
-    CPUState *env;
-
-    env = cpu_single_env;
-    if (!env)
-        return 0;
-    return env->eflags & (IF_MASK | IOPL_MASK);
-}
-
-/* Note: after writing to this address, the guest code must make sure
-   it is exiting the current TB. pushf/popf can be used for that
-   purpose. */
-static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    CPUState *env;
-
-    env = cpu_single_env;
-    if (!env)
-        return;
-    env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | 
-        (val & (IF_MASK | IOPL_MASK));
-}
-
-static CPUReadMemoryFunc *qpi_mem_read[3] = {
-    qpi_mem_readb,
-    qpi_mem_readw,
-    qpi_mem_readl,
-};
-
-static CPUWriteMemoryFunc *qpi_mem_write[3] = {
-    qpi_mem_writeb,
-    qpi_mem_writew,
-    qpi_mem_writel,
-};
-
-static void qpi_init(void)
-{
-    kqemu_comm_base = 0xff000000 | 1;
-    qpi_io_memory = cpu_register_io_memory(0, 
-                                           qpi_mem_read, 
-                                           qpi_mem_write, NULL);
-    cpu_register_physical_memory(kqemu_comm_base & ~0xfff, 
-                                 0x1000, qpi_io_memory);
-}
-#endif
diff --git a/testing/qemu/kqemu.patch b/testing/qemu/kqemu.patch
deleted file mode 100644
index 337a356c..00000000
--- a/testing/qemu/kqemu.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- a/kqemu.c	2009-07-17 00:56:23.000000000 +0000
-+++ b/kqemu.c	2009-08-22 13:20:00.000000000 +0000
-@@ -93,9 +93,9 @@
- int qpi_io_memory;
- uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
- 
--#define cpuid(index, eax, ebx, ecx, edx) \
-+#define cpuid(index, eax, ecx, edx) \
-   asm volatile ("cpuid" \
--                : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) \
-+                : "=a" (eax), "=c" (ecx), "=d" (edx) \
-                 : "0" (index))
- 
- #ifdef __x86_64__
-@@ -125,7 +125,7 @@
- static void kqemu_update_cpuid(CPUState *env)
- {
-     int critical_features_mask, features, ext_features, ext_features_mask;
--    uint32_t eax, ebx, ecx, edx;
-+    uint32_t eax, ecx, edx;
- 
-     /* the following features are kept identical on the host and
-        target cpus because they are important for user code. Strictly
-@@ -140,7 +140,7 @@
-         features = 0;
-         ext_features = 0;
-     } else {
--        cpuid(1, eax, ebx, ecx, edx);
-+        cpuid(1, eax, ecx, edx);
-         features = edx;
-         ext_features = ecx;
-     }
diff --git a/testing/qemu/qemu-0.10.3-nopl-fix.patch b/testing/qemu/qemu-0.10.3-nopl-fix.patch
deleted file mode 100644
index bdef0efc..00000000
--- a/testing/qemu/qemu-0.10.3-nopl-fix.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- i386-dis.c	2009-03-22 00:05:48.000000000 +0100
-+++ i386-dis_new.c	2009-04-21 08:31:08.000000000 +0200
-@@ -784,13 +784,13 @@
-   { "movhpX",		EX, XM, SIMD_Fixup, 'l' },
-   /* 18 */
-   { GRP14 },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
--  { "(bad)",		XX, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-+  { "nopQ",		Ev, XX, XX },
-   /* 20 */
-   { "movL",		Rm, Cm, XX },
-   { "movL",		Rm, Dm, XX },
-@@ -1072,7 +1072,7 @@
-   /*       0 1 2 3 4 5 6 7 8 9 a b c d e f        */
-   /*       -------------------------------        */
-   /* 00 */ 1,1,1,1,0,0,0,0,0,0,0,0,0,1,0,1, /* 0f */
--  /* 10 */ 1,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0, /* 1f */
-+  /* 10 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, /* 1f */
-   /* 20 */ 1,1,1,1,1,0,1,0,1,1,1,1,1,1,1,1, /* 2f */
-   /* 30 */ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, /* 3f */
-   /* 40 */ 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1, /* 4f */
diff --git a/testing/qemu/qemu.pre-install b/testing/qemu/qemu.pre-install
deleted file mode 100644
index 0119bacb..00000000
--- a/testing/qemu/qemu.pre-install
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh
-
-if ! getent group | grep -q "^kvm:"; then
-	addgroup kvm
-fi
-
-- 
cgit v1.2.3


From 6553f2c48ba6457aac2e0b61c3d5542977ca5ffe Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 08:34:42 +0000
Subject: testing/cryptsetup: upgrade to 1.1.0

---
 testing/cryptsetup/APKBUILD | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/testing/cryptsetup/APKBUILD b/testing/cryptsetup/APKBUILD
index 2f6fed11..887d15d3 100644
--- a/testing/cryptsetup/APKBUILD
+++ b/testing/cryptsetup/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=cryptsetup
-pkgver=1.0.7
-pkgrel=1
+pkgver=1.1.0
+pkgrel=0
 pkgdesc="Userspace setup tool for transparent encryption of block devices using the Linux 2.6 cryptoapi"
 url="http://code.google.com/p/cryptsetup/"
 license="GPL"
@@ -13,7 +13,8 @@ source="http://$pkgname.googlecode.com/files/$pkgname-$pkgver.tar.bz2"
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
-		--disable-static
+		--disable-static \
+		|| return 1
 	make || return 1
 }
 
@@ -21,4 +22,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR=$pkgdir install
 }
-md5sums="5eea2a77391a8a1a651b31cbaef59e22  cryptsetup-1.0.7.tar.bz2"
+md5sums="8177f1833f4d6aaacc5812046d2010b6  cryptsetup-1.1.0.tar.bz2"
-- 
cgit v1.2.3


From a9b251d4921e9ee649670ffcad6703ce411722f8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:37:23 +0000
Subject: testing/babl: new aport

Dynamic, any to any, pixel format conversion library
http://gegl.org/babl/
---
 testing/babl/APKBUILD | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 testing/babl/APKBUILD

diff --git a/testing/babl/APKBUILD b/testing/babl/APKBUILD
new file mode 100644
index 00000000..46648b6d
--- /dev/null
+++ b/testing/babl/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=babl
+pkgver=0.1.2
+pkgrel=0
+pkgdesc="Dynamic, any to any, pixel format conversion library"
+url="http://gegl.org/babl/"
+license="LGPL3"
+depends=
+makedepends=
+subpackages="$pkgname-dev"
+source="ftp://ftp.gtk.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="8eebd8d78d3173db7af5e3e60b1e03ea  babl-0.1.2.tar.bz2"
-- 
cgit v1.2.3


From e2ac44c772d819a90954e7b1001d9f77a34ea3bf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:38:12 +0000
Subject: testing/gegl: new aport

Graph based image processing framework
http://www.gegl.org/
---
 testing/gegl/APKBUILD          | 36 ++++++++++++++++++++++++++++++++++++
 testing/gegl/gegl-uclibc.patch | 22 ++++++++++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 testing/gegl/APKBUILD
 create mode 100644 testing/gegl/gegl-uclibc.patch

diff --git a/testing/gegl/APKBUILD b/testing/gegl/APKBUILD
new file mode 100644
index 00000000..1db5bd38
--- /dev/null
+++ b/testing/gegl/APKBUILD
@@ -0,0 +1,36 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gegl
+pkgver=0.1.2
+pkgrel=0
+pkgdesc="Graph based image processing framework"
+url="http://www.gegl.org/"
+license="GPL3 LGPL3"
+makedepends="babl-dev libpng-dev jpeg-dev gtk+-dev librsvg-dev lua-dev"
+subpackages="$pkgname-dev"
+source="ftp://ftp.gimp.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2
+	gegl-uclibc.patch"
+
+depends_dev="babl-dev glib-dev"
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*patch; do
+		patch -p1 -i "$i" || return 1
+	done
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--with-librsvg \
+		--disable-docs \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="d35ffe17dc042652eca3205488ece262  gegl-0.1.2.tar.bz2
+e8efbd53553220b97650a3b693461fa5  gegl-uclibc.patch"
diff --git a/testing/gegl/gegl-uclibc.patch b/testing/gegl/gegl-uclibc.patch
new file mode 100644
index 00000000..cb93f0fe
--- /dev/null
+++ b/testing/gegl/gegl-uclibc.patch
@@ -0,0 +1,22 @@
+--- ./gegl/buffer/gegl-buffer.c.orig
++++ ./gegl/buffer/gegl-buffer.c
+@@ -80,7 +80,7 @@
+ /* #define GEGL_BUFFER_DEBUG_ALLOCATIONS to print allocation stack
+  * traces for leaked GeglBuffers using GNU C libs backtrace_symbols()
+  */
+-#ifndef G_OS_WIN32
++#if !defined(G_OS_WIN32) && !defined(__UCLIBC__)
+ #include <execinfo.h>
+ #endif
+ 
+@@ -876,8 +876,8 @@
+ gegl_buffer_get_alloc_stack (void)
+ {
+   char  *result         = NULL;
+-#ifdef G_OS_WIN32
+-  result = g_strdup ("backtrack not available on win32\n");
++#if defined(G_OS_WIN32) || defined(__UCLIBC__)
++  result = g_strdup ("backtrack not available\n");
+ #else
+   void  *functions[MAX_N_FUNCTIONS];
+   int    n_functions    = 0;
-- 
cgit v1.2.3


From ede51034c926bc2319fe15ec03d654d4a464cc3d Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:38:53 +0000
Subject: teseting/gimp: new aport

GNU Image Manipulation Program
http://www.gimp.org/
---
 testing/gimp/APKBUILD                 | 46 ++++++++++++++++++++++++
 testing/gimp/gtk-2.19-statusbar.patch | 67 +++++++++++++++++++++++++++++++++++
 testing/gimp/libpng-1.4.patch         | 26 ++++++++++++++
 3 files changed, 139 insertions(+)
 create mode 100644 testing/gimp/APKBUILD
 create mode 100644 testing/gimp/gtk-2.19-statusbar.patch
 create mode 100644 testing/gimp/libpng-1.4.patch

diff --git a/testing/gimp/APKBUILD b/testing/gimp/APKBUILD
new file mode 100644
index 00000000..171766f5
--- /dev/null
+++ b/testing/gimp/APKBUILD
@@ -0,0 +1,46 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gimp
+pkgver=2.6.8
+pkgrel=0
+pkgdesc="GNU Image Manipulation Program"
+url="http://www.gimp.org/"
+license="GPL"
+makedepends="gtk+-dev libxpm-dev libxmu-dev librsvg-dev dbus-glib-dev
+	libexif-dev desktop-file-utils intltool gegl-dev tiff-dev
+	jpeg-dev libpng-dev curl-dev"
+install=
+subpackages="$pkgname-dev $pkgname-doc"
+source="ftp://ftp.$pkgname.org/pub/$pkgname/v2.6/$pkgname-$pkgver.tar.bz2
+	libpng-1.4.patch
+	gtk-2.19-statusbar.patch"
+
+prepare() { 
+	cd "$srcdir"/$pkgname-$pkgver
+	patch -Np1 -i "../libpng-1.4.patch" || return 1
+	patch -Np1 -i "$srcdir"/gtk-2.19-statusbar.patch || return 1
+}
+
+build() { 
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--enable-mp \
+		--enable-gimp-console \
+		--enable-gimp-remote \
+		--disable-devel-docs \
+		--disable-python \
+		--without-gvfs \
+		--without-gnomevfs \
+		--with-gif-compression=lzw \
+		--without-aa || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+	ln -s gimptool-2.0 "$pkgdir/usr/bin/gimptool" || return 1
+}
+md5sums="a4d9462c9420954824a80c9b1963f9d9  gimp-2.6.8.tar.bz2
+211eccab51593526e852816e647f7da4  libpng-1.4.patch
+8be7d21231e3032e4723cf86588375c0  gtk-2.19-statusbar.patch"
diff --git a/testing/gimp/gtk-2.19-statusbar.patch b/testing/gimp/gtk-2.19-statusbar.patch
new file mode 100644
index 00000000..8bc278b4
--- /dev/null
+++ b/testing/gimp/gtk-2.19-statusbar.patch
@@ -0,0 +1,67 @@
+From 501c4f65f08c111df0654cb887d95c2c06e82710 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Wed, 24 Mar 2010 17:08:01 +0000
+Subject: backport statusbar code needed for GTK+ >= 2.19.1
+
+Use the hbox that is provided via gtk_statusbar_get_message_area()
+since GTK+ 2.19.1.
+---
+diff --git a/app/display/gimpstatusbar.c b/app/display/gimpstatusbar.c
+index 5e89427..36651cd 100644
+--- a/app/display/gimpstatusbar.c
++++ b/app/display/gimpstatusbar.c
+@@ -49,6 +49,9 @@
+ /*  maximal width of the string holding the cursor-coordinates  */
+ #define CURSOR_LEN        256
+ 
++/*  the spacing of the hbox                                     */
++#define HBOX_SPACING        1
++
+ /*  spacing between the icon and the statusbar label            */
+ #define ICON_SPACING        2
+ 
+@@ -152,6 +155,7 @@ static void
+ gimp_statusbar_init (GimpStatusbar *statusbar)
+ {
+   GtkWidget     *hbox;
++  GtkWidget     *label;
+   GtkWidget     *image;
+   GimpUnitStore *store;
+ 
+@@ -171,13 +175,27 @@ gimp_statusbar_init (GimpStatusbar *statusbar)
+   statusbar->progress_active      = FALSE;
+   statusbar->progress_shown       = FALSE;
+ 
+-  /* remove the label and insert a hbox */
+-  gtk_container_remove (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame),
+-                        g_object_ref (GTK_STATUSBAR (statusbar)->label));
+-
+-  hbox = gtk_hbox_new (FALSE, 1);
+-  gtk_container_add (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame), hbox);
+-  gtk_widget_show (hbox);
++  label = g_object_ref (GTK_STATUSBAR (statusbar)->label);
++
++  /* remove the message area or label and insert a hbox */
++#if GTK_CHECK_VERSION (2, 19, 1)
++  {
++    hbox = gtk_statusbar_get_message_area (GTK_STATUSBAR (statusbar));
++    gtk_box_set_spacing (GTK_BOX (hbox), HBOX_SPACING);
++    gtk_container_remove (GTK_CONTAINER (hbox), label);
++  }
++#else
++  {
++    GtkWidget *label_parent;
++
++    label_parent = gtk_widget_get_parent (label);
++    gtk_container_remove (GTK_CONTAINER (label_parent), label);
++
++    hbox = gtk_hbox_new (FALSE, HBOX_SPACING);
++    gtk_container_add (GTK_CONTAINER (label_parent), hbox);
++    gtk_widget_show (hbox);
++  }
++#endif
+ 
+   statusbar->cursor_label = gtk_label_new ("8888, 8888");
+   gtk_misc_set_alignment (GTK_MISC (statusbar->cursor_label), 0.5, 0.5);
+--
+cgit v0.8.3.1
diff --git a/testing/gimp/libpng-1.4.patch b/testing/gimp/libpng-1.4.patch
new file mode 100644
index 00000000..8f7963d2
--- /dev/null
+++ b/testing/gimp/libpng-1.4.patch
@@ -0,0 +1,26 @@
+diff -Naur gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c gimp-2.7.0/plug-ins/file-ico/ico-load.c
+--- gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c	2010-01-18 19:01:46.000000000 -0500
++++ gimp-2.7.0/plug-ins/file-ico/ico-load.c	2010-01-18 19:14:43.000000000 -0500
+@@ -286,14 +286,22 @@
+   switch (color_type)
+     {
+     case PNG_COLOR_TYPE_GRAY:
++#if PNG_LIBPNG_VER < 10400
+       png_set_gray_1_2_4_to_8 (png_ptr);
++#else
++      png_set_expand_gray_1_2_4_to_8(png_ptr);
++#endif
+       if ( bit_depth == 16 )
+         png_set_strip_16 (png_ptr);
+       png_set_gray_to_rgb (png_ptr);
+       png_set_add_alpha (png_ptr, 0xff, PNG_FILLER_AFTER);
+       break;
+     case PNG_COLOR_TYPE_GRAY_ALPHA:
++#if PNG_LIBPNG_VER < 10400
+       png_set_gray_1_2_4_to_8 (png_ptr);
++#else
++      png_set_expand_gray_1_2_4_to_8(png_ptr);
++#endif
+       if ( bit_depth == 16 )
+         png_set_strip_16 (png_ptr);
+       png_set_gray_to_rgb (png_ptr);
-- 
cgit v1.2.3


From 28100c216e2838a9bbc22ba7162d355cf71e99d8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:54:49 +0000
Subject: main/babl: moved from testing

---
 main/babl/APKBUILD    | 23 +++++++++++++++++++++++
 testing/babl/APKBUILD | 23 -----------------------
 2 files changed, 23 insertions(+), 23 deletions(-)
 create mode 100644 main/babl/APKBUILD
 delete mode 100644 testing/babl/APKBUILD

diff --git a/main/babl/APKBUILD b/main/babl/APKBUILD
new file mode 100644
index 00000000..46648b6d
--- /dev/null
+++ b/main/babl/APKBUILD
@@ -0,0 +1,23 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=babl
+pkgver=0.1.2
+pkgrel=0
+pkgdesc="Dynamic, any to any, pixel format conversion library"
+url="http://gegl.org/babl/"
+license="LGPL3"
+depends=
+makedepends=
+subpackages="$pkgname-dev"
+source="ftp://ftp.gtk.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2"
+
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="8eebd8d78d3173db7af5e3e60b1e03ea  babl-0.1.2.tar.bz2"
diff --git a/testing/babl/APKBUILD b/testing/babl/APKBUILD
deleted file mode 100644
index 46648b6d..00000000
--- a/testing/babl/APKBUILD
+++ /dev/null
@@ -1,23 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=babl
-pkgver=0.1.2
-pkgrel=0
-pkgdesc="Dynamic, any to any, pixel format conversion library"
-url="http://gegl.org/babl/"
-license="LGPL3"
-depends=
-makedepends=
-subpackages="$pkgname-dev"
-source="ftp://ftp.gtk.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2"
-
-build() {
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr || return 1
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install || return 1
-}
-md5sums="8eebd8d78d3173db7af5e3e60b1e03ea  babl-0.1.2.tar.bz2"
-- 
cgit v1.2.3


From ca650ad135f79741f6db6c4ef7503a1b3d52bd7a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:55:15 +0000
Subject: main/gegl: moved from testing

---
 main/gegl/APKBUILD             | 36 ++++++++++++++++++++++++++++++++++++
 main/gegl/gegl-uclibc.patch    | 22 ++++++++++++++++++++++
 testing/gegl/APKBUILD          | 36 ------------------------------------
 testing/gegl/gegl-uclibc.patch | 22 ----------------------
 4 files changed, 58 insertions(+), 58 deletions(-)
 create mode 100644 main/gegl/APKBUILD
 create mode 100644 main/gegl/gegl-uclibc.patch
 delete mode 100644 testing/gegl/APKBUILD
 delete mode 100644 testing/gegl/gegl-uclibc.patch

diff --git a/main/gegl/APKBUILD b/main/gegl/APKBUILD
new file mode 100644
index 00000000..1db5bd38
--- /dev/null
+++ b/main/gegl/APKBUILD
@@ -0,0 +1,36 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gegl
+pkgver=0.1.2
+pkgrel=0
+pkgdesc="Graph based image processing framework"
+url="http://www.gegl.org/"
+license="GPL3 LGPL3"
+makedepends="babl-dev libpng-dev jpeg-dev gtk+-dev librsvg-dev lua-dev"
+subpackages="$pkgname-dev"
+source="ftp://ftp.gimp.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2
+	gegl-uclibc.patch"
+
+depends_dev="babl-dev glib-dev"
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in "$srcdir"/*patch; do
+		patch -p1 -i "$i" || return 1
+	done
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--with-librsvg \
+		--disable-docs \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="d35ffe17dc042652eca3205488ece262  gegl-0.1.2.tar.bz2
+e8efbd53553220b97650a3b693461fa5  gegl-uclibc.patch"
diff --git a/main/gegl/gegl-uclibc.patch b/main/gegl/gegl-uclibc.patch
new file mode 100644
index 00000000..cb93f0fe
--- /dev/null
+++ b/main/gegl/gegl-uclibc.patch
@@ -0,0 +1,22 @@
+--- ./gegl/buffer/gegl-buffer.c.orig
++++ ./gegl/buffer/gegl-buffer.c
+@@ -80,7 +80,7 @@
+ /* #define GEGL_BUFFER_DEBUG_ALLOCATIONS to print allocation stack
+  * traces for leaked GeglBuffers using GNU C libs backtrace_symbols()
+  */
+-#ifndef G_OS_WIN32
++#if !defined(G_OS_WIN32) && !defined(__UCLIBC__)
+ #include <execinfo.h>
+ #endif
+ 
+@@ -876,8 +876,8 @@
+ gegl_buffer_get_alloc_stack (void)
+ {
+   char  *result         = NULL;
+-#ifdef G_OS_WIN32
+-  result = g_strdup ("backtrack not available on win32\n");
++#if defined(G_OS_WIN32) || defined(__UCLIBC__)
++  result = g_strdup ("backtrack not available\n");
+ #else
+   void  *functions[MAX_N_FUNCTIONS];
+   int    n_functions    = 0;
diff --git a/testing/gegl/APKBUILD b/testing/gegl/APKBUILD
deleted file mode 100644
index 1db5bd38..00000000
--- a/testing/gegl/APKBUILD
+++ /dev/null
@@ -1,36 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=gegl
-pkgver=0.1.2
-pkgrel=0
-pkgdesc="Graph based image processing framework"
-url="http://www.gegl.org/"
-license="GPL3 LGPL3"
-makedepends="babl-dev libpng-dev jpeg-dev gtk+-dev librsvg-dev lua-dev"
-subpackages="$pkgname-dev"
-source="ftp://ftp.gimp.org/pub/$pkgname/0.1/$pkgname-$pkgver.tar.bz2
-	gegl-uclibc.patch"
-
-depends_dev="babl-dev glib-dev"
-_builddir="$srcdir"/$pkgname-$pkgver
-prepare() {
-	cd "$_builddir"
-	for i in "$srcdir"/*patch; do
-		patch -p1 -i "$i" || return 1
-	done
-}
-
-build() {
-	cd "$_builddir"
-	./configure --prefix=/usr \
-		--with-librsvg \
-		--disable-docs \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install || return 1
-}
-md5sums="d35ffe17dc042652eca3205488ece262  gegl-0.1.2.tar.bz2
-e8efbd53553220b97650a3b693461fa5  gegl-uclibc.patch"
diff --git a/testing/gegl/gegl-uclibc.patch b/testing/gegl/gegl-uclibc.patch
deleted file mode 100644
index cb93f0fe..00000000
--- a/testing/gegl/gegl-uclibc.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- ./gegl/buffer/gegl-buffer.c.orig
-+++ ./gegl/buffer/gegl-buffer.c
-@@ -80,7 +80,7 @@
- /* #define GEGL_BUFFER_DEBUG_ALLOCATIONS to print allocation stack
-  * traces for leaked GeglBuffers using GNU C libs backtrace_symbols()
-  */
--#ifndef G_OS_WIN32
-+#if !defined(G_OS_WIN32) && !defined(__UCLIBC__)
- #include <execinfo.h>
- #endif
- 
-@@ -876,8 +876,8 @@
- gegl_buffer_get_alloc_stack (void)
- {
-   char  *result         = NULL;
--#ifdef G_OS_WIN32
--  result = g_strdup ("backtrack not available on win32\n");
-+#if defined(G_OS_WIN32) || defined(__UCLIBC__)
-+  result = g_strdup ("backtrack not available\n");
- #else
-   void  *functions[MAX_N_FUNCTIONS];
-   int    n_functions    = 0;
-- 
cgit v1.2.3


From 27f6d4cd2e95d93f227cf24423b357224480b10f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 22 May 2010 13:55:45 +0000
Subject: main/gimp: moved from testing

---
 main/gimp/APKBUILD                    | 46 ++++++++++++++++++++++++
 main/gimp/gtk-2.19-statusbar.patch    | 67 +++++++++++++++++++++++++++++++++++
 main/gimp/libpng-1.4.patch            | 26 ++++++++++++++
 testing/gimp/APKBUILD                 | 46 ------------------------
 testing/gimp/gtk-2.19-statusbar.patch | 67 -----------------------------------
 testing/gimp/libpng-1.4.patch         | 26 --------------
 6 files changed, 139 insertions(+), 139 deletions(-)
 create mode 100644 main/gimp/APKBUILD
 create mode 100644 main/gimp/gtk-2.19-statusbar.patch
 create mode 100644 main/gimp/libpng-1.4.patch
 delete mode 100644 testing/gimp/APKBUILD
 delete mode 100644 testing/gimp/gtk-2.19-statusbar.patch
 delete mode 100644 testing/gimp/libpng-1.4.patch

diff --git a/main/gimp/APKBUILD b/main/gimp/APKBUILD
new file mode 100644
index 00000000..171766f5
--- /dev/null
+++ b/main/gimp/APKBUILD
@@ -0,0 +1,46 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gimp
+pkgver=2.6.8
+pkgrel=0
+pkgdesc="GNU Image Manipulation Program"
+url="http://www.gimp.org/"
+license="GPL"
+makedepends="gtk+-dev libxpm-dev libxmu-dev librsvg-dev dbus-glib-dev
+	libexif-dev desktop-file-utils intltool gegl-dev tiff-dev
+	jpeg-dev libpng-dev curl-dev"
+install=
+subpackages="$pkgname-dev $pkgname-doc"
+source="ftp://ftp.$pkgname.org/pub/$pkgname/v2.6/$pkgname-$pkgver.tar.bz2
+	libpng-1.4.patch
+	gtk-2.19-statusbar.patch"
+
+prepare() { 
+	cd "$srcdir"/$pkgname-$pkgver
+	patch -Np1 -i "../libpng-1.4.patch" || return 1
+	patch -Np1 -i "$srcdir"/gtk-2.19-statusbar.patch || return 1
+}
+
+build() { 
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--enable-mp \
+		--enable-gimp-console \
+		--enable-gimp-remote \
+		--disable-devel-docs \
+		--disable-python \
+		--without-gvfs \
+		--without-gnomevfs \
+		--with-gif-compression=lzw \
+		--without-aa || return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+	ln -s gimptool-2.0 "$pkgdir/usr/bin/gimptool" || return 1
+}
+md5sums="a4d9462c9420954824a80c9b1963f9d9  gimp-2.6.8.tar.bz2
+211eccab51593526e852816e647f7da4  libpng-1.4.patch
+8be7d21231e3032e4723cf86588375c0  gtk-2.19-statusbar.patch"
diff --git a/main/gimp/gtk-2.19-statusbar.patch b/main/gimp/gtk-2.19-statusbar.patch
new file mode 100644
index 00000000..8bc278b4
--- /dev/null
+++ b/main/gimp/gtk-2.19-statusbar.patch
@@ -0,0 +1,67 @@
+From 501c4f65f08c111df0654cb887d95c2c06e82710 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Wed, 24 Mar 2010 17:08:01 +0000
+Subject: backport statusbar code needed for GTK+ >= 2.19.1
+
+Use the hbox that is provided via gtk_statusbar_get_message_area()
+since GTK+ 2.19.1.
+---
+diff --git a/app/display/gimpstatusbar.c b/app/display/gimpstatusbar.c
+index 5e89427..36651cd 100644
+--- a/app/display/gimpstatusbar.c
++++ b/app/display/gimpstatusbar.c
+@@ -49,6 +49,9 @@
+ /*  maximal width of the string holding the cursor-coordinates  */
+ #define CURSOR_LEN        256
+ 
++/*  the spacing of the hbox                                     */
++#define HBOX_SPACING        1
++
+ /*  spacing between the icon and the statusbar label            */
+ #define ICON_SPACING        2
+ 
+@@ -152,6 +155,7 @@ static void
+ gimp_statusbar_init (GimpStatusbar *statusbar)
+ {
+   GtkWidget     *hbox;
++  GtkWidget     *label;
+   GtkWidget     *image;
+   GimpUnitStore *store;
+ 
+@@ -171,13 +175,27 @@ gimp_statusbar_init (GimpStatusbar *statusbar)
+   statusbar->progress_active      = FALSE;
+   statusbar->progress_shown       = FALSE;
+ 
+-  /* remove the label and insert a hbox */
+-  gtk_container_remove (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame),
+-                        g_object_ref (GTK_STATUSBAR (statusbar)->label));
+-
+-  hbox = gtk_hbox_new (FALSE, 1);
+-  gtk_container_add (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame), hbox);
+-  gtk_widget_show (hbox);
++  label = g_object_ref (GTK_STATUSBAR (statusbar)->label);
++
++  /* remove the message area or label and insert a hbox */
++#if GTK_CHECK_VERSION (2, 19, 1)
++  {
++    hbox = gtk_statusbar_get_message_area (GTK_STATUSBAR (statusbar));
++    gtk_box_set_spacing (GTK_BOX (hbox), HBOX_SPACING);
++    gtk_container_remove (GTK_CONTAINER (hbox), label);
++  }
++#else
++  {
++    GtkWidget *label_parent;
++
++    label_parent = gtk_widget_get_parent (label);
++    gtk_container_remove (GTK_CONTAINER (label_parent), label);
++
++    hbox = gtk_hbox_new (FALSE, HBOX_SPACING);
++    gtk_container_add (GTK_CONTAINER (label_parent), hbox);
++    gtk_widget_show (hbox);
++  }
++#endif
+ 
+   statusbar->cursor_label = gtk_label_new ("8888, 8888");
+   gtk_misc_set_alignment (GTK_MISC (statusbar->cursor_label), 0.5, 0.5);
+--
+cgit v0.8.3.1
diff --git a/main/gimp/libpng-1.4.patch b/main/gimp/libpng-1.4.patch
new file mode 100644
index 00000000..8f7963d2
--- /dev/null
+++ b/main/gimp/libpng-1.4.patch
@@ -0,0 +1,26 @@
+diff -Naur gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c gimp-2.7.0/plug-ins/file-ico/ico-load.c
+--- gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c	2010-01-18 19:01:46.000000000 -0500
++++ gimp-2.7.0/plug-ins/file-ico/ico-load.c	2010-01-18 19:14:43.000000000 -0500
+@@ -286,14 +286,22 @@
+   switch (color_type)
+     {
+     case PNG_COLOR_TYPE_GRAY:
++#if PNG_LIBPNG_VER < 10400
+       png_set_gray_1_2_4_to_8 (png_ptr);
++#else
++      png_set_expand_gray_1_2_4_to_8(png_ptr);
++#endif
+       if ( bit_depth == 16 )
+         png_set_strip_16 (png_ptr);
+       png_set_gray_to_rgb (png_ptr);
+       png_set_add_alpha (png_ptr, 0xff, PNG_FILLER_AFTER);
+       break;
+     case PNG_COLOR_TYPE_GRAY_ALPHA:
++#if PNG_LIBPNG_VER < 10400
+       png_set_gray_1_2_4_to_8 (png_ptr);
++#else
++      png_set_expand_gray_1_2_4_to_8(png_ptr);
++#endif
+       if ( bit_depth == 16 )
+         png_set_strip_16 (png_ptr);
+       png_set_gray_to_rgb (png_ptr);
diff --git a/testing/gimp/APKBUILD b/testing/gimp/APKBUILD
deleted file mode 100644
index 171766f5..00000000
--- a/testing/gimp/APKBUILD
+++ /dev/null
@@ -1,46 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=gimp
-pkgver=2.6.8
-pkgrel=0
-pkgdesc="GNU Image Manipulation Program"
-url="http://www.gimp.org/"
-license="GPL"
-makedepends="gtk+-dev libxpm-dev libxmu-dev librsvg-dev dbus-glib-dev
-	libexif-dev desktop-file-utils intltool gegl-dev tiff-dev
-	jpeg-dev libpng-dev curl-dev"
-install=
-subpackages="$pkgname-dev $pkgname-doc"
-source="ftp://ftp.$pkgname.org/pub/$pkgname/v2.6/$pkgname-$pkgver.tar.bz2
-	libpng-1.4.patch
-	gtk-2.19-statusbar.patch"
-
-prepare() { 
-	cd "$srcdir"/$pkgname-$pkgver
-	patch -Np1 -i "../libpng-1.4.patch" || return 1
-	patch -Np1 -i "$srcdir"/gtk-2.19-statusbar.patch || return 1
-}
-
-build() { 
-	cd "$srcdir"/$pkgname-$pkgver
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--enable-mp \
-		--enable-gimp-console \
-		--enable-gimp-remote \
-		--disable-devel-docs \
-		--disable-python \
-		--without-gvfs \
-		--without-gnomevfs \
-		--with-gif-compression=lzw \
-		--without-aa || return 1
-	make || return 1
-}
-
-package() {
-	cd "$srcdir"/$pkgname-$pkgver
-	make DESTDIR="$pkgdir" install || return 1
-	ln -s gimptool-2.0 "$pkgdir/usr/bin/gimptool" || return 1
-}
-md5sums="a4d9462c9420954824a80c9b1963f9d9  gimp-2.6.8.tar.bz2
-211eccab51593526e852816e647f7da4  libpng-1.4.patch
-8be7d21231e3032e4723cf86588375c0  gtk-2.19-statusbar.patch"
diff --git a/testing/gimp/gtk-2.19-statusbar.patch b/testing/gimp/gtk-2.19-statusbar.patch
deleted file mode 100644
index 8bc278b4..00000000
--- a/testing/gimp/gtk-2.19-statusbar.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 501c4f65f08c111df0654cb887d95c2c06e82710 Mon Sep 17 00:00:00 2001
-From: Nils Philippsen <nils@redhat.com>
-Date: Wed, 24 Mar 2010 17:08:01 +0000
-Subject: backport statusbar code needed for GTK+ >= 2.19.1
-
-Use the hbox that is provided via gtk_statusbar_get_message_area()
-since GTK+ 2.19.1.
----
-diff --git a/app/display/gimpstatusbar.c b/app/display/gimpstatusbar.c
-index 5e89427..36651cd 100644
---- a/app/display/gimpstatusbar.c
-+++ b/app/display/gimpstatusbar.c
-@@ -49,6 +49,9 @@
- /*  maximal width of the string holding the cursor-coordinates  */
- #define CURSOR_LEN        256
- 
-+/*  the spacing of the hbox                                     */
-+#define HBOX_SPACING        1
-+
- /*  spacing between the icon and the statusbar label            */
- #define ICON_SPACING        2
- 
-@@ -152,6 +155,7 @@ static void
- gimp_statusbar_init (GimpStatusbar *statusbar)
- {
-   GtkWidget     *hbox;
-+  GtkWidget     *label;
-   GtkWidget     *image;
-   GimpUnitStore *store;
- 
-@@ -171,13 +175,27 @@ gimp_statusbar_init (GimpStatusbar *statusbar)
-   statusbar->progress_active      = FALSE;
-   statusbar->progress_shown       = FALSE;
- 
--  /* remove the label and insert a hbox */
--  gtk_container_remove (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame),
--                        g_object_ref (GTK_STATUSBAR (statusbar)->label));
--
--  hbox = gtk_hbox_new (FALSE, 1);
--  gtk_container_add (GTK_CONTAINER (GTK_STATUSBAR (statusbar)->frame), hbox);
--  gtk_widget_show (hbox);
-+  label = g_object_ref (GTK_STATUSBAR (statusbar)->label);
-+
-+  /* remove the message area or label and insert a hbox */
-+#if GTK_CHECK_VERSION (2, 19, 1)
-+  {
-+    hbox = gtk_statusbar_get_message_area (GTK_STATUSBAR (statusbar));
-+    gtk_box_set_spacing (GTK_BOX (hbox), HBOX_SPACING);
-+    gtk_container_remove (GTK_CONTAINER (hbox), label);
-+  }
-+#else
-+  {
-+    GtkWidget *label_parent;
-+
-+    label_parent = gtk_widget_get_parent (label);
-+    gtk_container_remove (GTK_CONTAINER (label_parent), label);
-+
-+    hbox = gtk_hbox_new (FALSE, HBOX_SPACING);
-+    gtk_container_add (GTK_CONTAINER (label_parent), hbox);
-+    gtk_widget_show (hbox);
-+  }
-+#endif
- 
-   statusbar->cursor_label = gtk_label_new ("8888, 8888");
-   gtk_misc_set_alignment (GTK_MISC (statusbar->cursor_label), 0.5, 0.5);
---
-cgit v0.8.3.1
diff --git a/testing/gimp/libpng-1.4.patch b/testing/gimp/libpng-1.4.patch
deleted file mode 100644
index 8f7963d2..00000000
--- a/testing/gimp/libpng-1.4.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff -Naur gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c gimp-2.7.0/plug-ins/file-ico/ico-load.c
---- gimp-2.7.0-orig/plug-ins/file-ico/ico-load.c	2010-01-18 19:01:46.000000000 -0500
-+++ gimp-2.7.0/plug-ins/file-ico/ico-load.c	2010-01-18 19:14:43.000000000 -0500
-@@ -286,14 +286,22 @@
-   switch (color_type)
-     {
-     case PNG_COLOR_TYPE_GRAY:
-+#if PNG_LIBPNG_VER < 10400
-       png_set_gray_1_2_4_to_8 (png_ptr);
-+#else
-+      png_set_expand_gray_1_2_4_to_8(png_ptr);
-+#endif
-       if ( bit_depth == 16 )
-         png_set_strip_16 (png_ptr);
-       png_set_gray_to_rgb (png_ptr);
-       png_set_add_alpha (png_ptr, 0xff, PNG_FILLER_AFTER);
-       break;
-     case PNG_COLOR_TYPE_GRAY_ALPHA:
-+#if PNG_LIBPNG_VER < 10400
-       png_set_gray_1_2_4_to_8 (png_ptr);
-+#else
-+      png_set_expand_gray_1_2_4_to_8(png_ptr);
-+#endif
-       if ( bit_depth == 16 )
-         png_set_strip_16 (png_ptr);
-       png_set_gray_to_rgb (png_ptr);
-- 
cgit v1.2.3


From c5ccba0b2480f46dc64a8562ebc40af6905017f7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 23 May 2010 10:52:23 +0000
Subject: main/epdfview: enable printing

---
 main/epdfview/APKBUILD | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/main/epdfview/APKBUILD b/main/epdfview/APKBUILD
index c89c1e31..814ba521 100644
--- a/main/epdfview/APKBUILD
+++ b/main/epdfview/APKBUILD
@@ -1,27 +1,35 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=epdfview
 pkgver=0.1.7
-pkgrel=2
+pkgrel=3
 pkgdesc="A free lightweight PDF document viewer."
 url="http://www.emma-soft.com/projects/epdfview/"
 license="GPL"
 #depends="poppler-glib>=0.10.0 heimdal>=1.2.1-1 libcups>=1.3.7-2 gnutls>=2.4.1 
 depends="desktop-file-utils hicolor-icon-theme"
-makedepends="poppler-gtk-dev"
+makedepends="poppler-gtk-dev cups-dev"
 source="http://www.emma-soft.com/projects/$pkgname/chrome/site/releases/$pkgname-$pkgver.tar.bz2
 	$pkgname.desktop.patch
 	fix-scrolling.patch"
 
-build ()
-{
-	cd ""$srcdir"/$pkgname-$pkgver"
+_builddir="$srcdir"/$pkgname-$pkgver
+package() {
+	cd "$_builddir"
 	patch -Np0 -i ../epdfview.desktop.patch || return 1
 	patch -Np0 -i ../fix-scrolling.patch || return 1
+}
+
+build() {
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		--localstatedir=/var \
 		|| return 1
 	make || return 1
+}
+
+package() {
+	cd "$_builddir"
 	make -j1 DESTDIR="$pkgdir" install || return 1
 	for i in 24 32 48; do
 		install -d "$pkgdir"/usr/share/icons/hicolor/${i}x${i}/apps \
-- 
cgit v1.2.3


From 4084b3e761be455fb91c1e6c361f9853c0837170 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 23 May 2010 20:19:41 +0000
Subject: testing/pidgin: new aport

graphical multi-protocol instant messaging client for X
http://pidgin.im/
---
 testing/pidgin/APKBUILD      | 64 ++++++++++++++++++++++++++++++++++++++++++++
 testing/pidgin/msn_fix.patch | 28 +++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 testing/pidgin/APKBUILD
 create mode 100644 testing/pidgin/msn_fix.patch

diff --git a/testing/pidgin/APKBUILD b/testing/pidgin/APKBUILD
new file mode 100644
index 00000000..a4db3e8b
--- /dev/null
+++ b/testing/pidgin/APKBUILD
@@ -0,0 +1,64 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=pidgin
+pkgver=2.7.0
+pkgrel=0
+pkgdesc="graphical multi-protocol instant messaging client for X"
+url="http://pidgin.im/"
+license="GPL"
+depends=
+makedepends="gtk+-dev intltool libsm-dev startup-notification-dev gtkspell-dev
+	libxml2-dev gstreamer-dev libidn-dev dbus-glib-dev gnutls-dev
+	cyrus-sasl-dev ncurses-dev"
+subpackages="$pkgname-dev $pkgname-doc finch libpurple"
+source="http://downloads.sourceforge.net/pidgin/$pkgver/pidgin-$pkgver.tar.bz2
+	msn_fix.patch"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	patch -Np0 -i ""$srcdir"/msn_fix.patch" || return 1
+}
+
+build() { 
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--disable-avahi \
+		--disable-doxygen \
+		--disable-gnutls \
+		--disable-meanwhile \
+		--disable-nm \
+		--disable-nss \
+		--disable-perl \
+		--disable-schemas-install \
+		--disable-screensaver \
+		--disable-tcl \
+		--disable-vv \
+		--enable-cyrus-sasl \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
+finch() {
+	pkgdesc="text-based multi-protocol instant messaging client"
+	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/lib/gnt "$pkgdir"/usr/lib/libgnt.so.* \
+		"$pkgdir"/usr/lib/finch \
+		"$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/bin/finch "$subpkgdir"/usr/bin/
+}
+
+libpurple() {
+	pkgdesc="multi-protocol instant messaging library"
+	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/share/sounds
+	mv "$pkgdir"/usr/lib/*purple* "$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/share/purple "$pkgdir"/usr/share/sounds \
+		"$subpkgdir"/usr/share/
+}
+md5sums="63a36f91d29f5ac5a402ffd2d7dbbb72  pidgin-2.7.0.tar.bz2
+bbf9d6f6fc19342af7e059dc13432d27  msn_fix.patch"
diff --git a/testing/pidgin/msn_fix.patch b/testing/pidgin/msn_fix.patch
new file mode 100644
index 00000000..f93fef8a
--- /dev/null
+++ b/testing/pidgin/msn_fix.patch
@@ -0,0 +1,28 @@
+#
+#
+# patch "libpurple/protocols/msn/slplink.c"
+#  from [a96a53635871463de0177e5a99fe4ebdc2c7d577]
+#    to [87ada76abf90c44e615679efc5f8128bb941bba1]
+#
+============================================================
+--- libpurple/protocols/msn/slplink.c	a96a53635871463de0177e5a99fe4ebdc2c7d577
++++ libpurple/protocols/msn/slplink.c	87ada76abf90c44e615679efc5f8128bb941bba1
+@@ -383,6 +383,7 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
+ msn_slplink_release_slpmsg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg)
+ {
+ 	MsnMessage *msg;
++	const char *passport;
+ 
+ 	slpmsg->msg = msg = msn_message_new_msnslp();
+ 
+@@ -421,7 +422,8 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
+ 
+ 	msg->msnslp_header.total_size = slpmsg->size;
+ 
+-	msn_message_set_attr(msg, "P2P-Dest", slplink->remote_user);
++	passport = purple_normalize(slplink->session->account, slplink->remote_user);
++	msn_message_set_attr(msg, "P2P-Dest", passport);
+ 
+ 	msg->ack_cb = msg_ack;
+ 	msg->nak_cb = msg_nak;
+
-- 
cgit v1.2.3


From 2a2bc6ca4ccdd80363c32287be0227c21e5d07c8 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sun, 23 May 2010 20:22:35 +0000
Subject: testing/gtkspell: new aport

GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget
http://gtkspell.sourceforge.net/
---
 testing/gtkspell/APKBUILD | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 testing/gtkspell/APKBUILD

diff --git a/testing/gtkspell/APKBUILD b/testing/gtkspell/APKBUILD
new file mode 100644
index 00000000..7e8d2a1d
--- /dev/null
+++ b/testing/gtkspell/APKBUILD
@@ -0,0 +1,24 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gtkspell
+pkgver=2.0.16
+pkgrel=0
+pkgdesc="GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget"
+url="http://gtkspell.sourceforge.net/"
+license="GPL"
+makedepends="gtk+-dev enchant-dev intltool"
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://$pkgname.sourceforge.net/download/$pkgname-$pkgver.tar.gz"
+
+depends_dev="gtk+-dev"
+build() {
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="f75dcc9338f182c571b321d37c606a94  gtkspell-2.0.16.tar.gz"
-- 
cgit v1.2.3


From bbdc5310e9b64b577ed7e9a42aef342056ea7e91 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 24 May 2010 12:36:03 +0000
Subject: main/linux-grsec: upgrade to 2.1.14-2.6.32.13-201005151340

---
 main/linux-grsec/APKBUILD                          |    12 +-
 .../grsecurity-2.1.14-2.6.32.12-201004292005.patch | 55920 ------------------
 .../grsecurity-2.1.14-2.6.32.13-201005151340.patch | 56087 +++++++++++++++++++
 3 files changed, 56092 insertions(+), 55927 deletions(-)
 delete mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch
 create mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 5228ecc0..02edf0be 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,9 +2,9 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=2.6.32.12
+pkgver=2.6.32.13
 _kernver=2.6.32
-pkgrel=5
+pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,12 +14,11 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	grsecurity-2.1.14-2.6.32.12-201004292005.patch
+	grsecurity-2.1.14-2.6.32.13-201005151340.patch
 	0001-grsec-revert-conflicting-flow-cache-changes.patch
 	0002-gre-fix-hard-header-destination-address-checking.patch
 	0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 	0004-arp-flush-arp-cache-on-device-change.patch
-	0005-r8169-fix-broken-register-writes.patch
 	0007-r8169-Fix-rtl8169_rx_interrupt.patch
 	0009-ipsec-Fix-bogus-bundle-flowi.patch
 	0010-xfrm-Remove-xfrm_state_genid.patch
@@ -138,13 +137,12 @@ firmware() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-9d097d34648a1734b1a7f97c5d000f03  patch-2.6.32.12.bz2
-6c360e4ba40b91137f6ab8b5996e9b1f  grsecurity-2.1.14-2.6.32.12-201004292005.patch
+ba6abb1ffee513a1d4f831599ddae490  patch-2.6.32.13.bz2
+00a61e28da8869669171ab12480513e1  grsecurity-2.1.14-2.6.32.13-201005151340.patch
 1d247140abec49b96250aec9aa59b324  0001-grsec-revert-conflicting-flow-cache-changes.patch
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
-afa06334c81f21c20571286a83d3d928  0005-r8169-fix-broken-register-writes.patch
 5f8b9a76d95319c5b1aa26b54a42e6b5  0007-r8169-Fix-rtl8169_rx_interrupt.patch
 cf168620efa63479a6e03da78906e32f  0009-ipsec-Fix-bogus-bundle-flowi.patch
 3af4b5ae1afae3278b0070f585b874e3  0010-xfrm-Remove-xfrm_state_genid.patch
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch
deleted file mode 100644
index e491c258..00000000
--- a/main/linux-grsec/grsecurity-2.1.14-2.6.32.12-201004292005.patch
+++ /dev/null
@@ -1,55920 +0,0 @@
-diff -urNp linux-2.6.32.12/arch/alpha/include/asm/elf.h linux-2.6.32.12/arch/alpha/include/asm/elf.h
---- linux-2.6.32.12/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/alpha/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- 
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be 
-    registered using atexit.  This provides a mean for the dynamic
-    linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.32.12/arch/alpha/include/asm/pgtable.h linux-2.6.32.12/arch/alpha/include/asm/pgtable.h
---- linux-2.6.32.12/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/alpha/include/asm/pgtable.h	2010-04-04 20:46:41.472784147 -0400
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
- 
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.32.12/arch/alpha/kernel/module.c linux-2.6.32.12/arch/alpha/kernel/module.c
---- linux-2.6.32.12/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/alpha/kernel/module.c	2010-04-04 20:46:41.472784147 -0400
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
- 
- 	/* The small sections were sorted to the end of the segment.
- 	   The following should definitely cover them.  */
--	gp = (u64)me->module_core + me->core_size - 0x8000;
-+	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- 	got = sechdrs[me->arch.gotsecindex].sh_addr;
- 
- 	for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.32.12/arch/alpha/kernel/osf_sys.c linux-2.6.32.12/arch/alpha/kernel/osf_sys.c
---- linux-2.6.32.12/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/alpha/kernel/osf_sys.c	2010-04-04 20:46:41.472784147 -0400
-@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
- 	   merely specific addresses, but regions of memory -- perhaps
- 	   this feature should be incorporated into all ports?  */
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
- 		if (addr != (unsigned long) -ENOMEM)
-@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
- 	}
- 
- 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
--	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
--					 len, limit);
-+	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
-+
- 	if (addr != (unsigned long) -ENOMEM)
- 		return addr;
- 
-diff -urNp linux-2.6.32.12/arch/alpha/mm/fault.c linux-2.6.32.12/arch/alpha/mm/fault.c
---- linux-2.6.32.12/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/alpha/mm/fault.c	2010-04-04 20:46:41.472784147 -0400
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
- 	__reload_thread(pcb);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int ldah, ldq, jmp;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+		    jmp == 0x6BFB0000U)
-+		{
-+			unsigned long r27, addr;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			err = get_user(r27, (unsigned long *)addr);
-+			if (err)
-+				break;
-+
-+			regs->r27 = r27;
-+			regs->pc = r27;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #2 */
-+		unsigned int ldah, lda, br;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+		err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+		    (br & 0xFFE00000U) == 0xC3E00000U)
-+		{
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int br;
-+
-+		err = get_user(br, (unsigned int *)regs->pc);
-+
-+		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+			unsigned int br2, ldq, nop, jmp;
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			err = get_user(br2, (unsigned int *)addr);
-+			err |= get_user(ldq, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			err |= get_user(jmp, (unsigned int *)(addr+12));
-+			err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+			if (err)
-+				break;
-+
-+			if (br2 == 0xC3600000U &&
-+			    ldq == 0xA77B000CU &&
-+			    nop == 0x47FF041FU &&
-+			    jmp == 0x6B7B0000U)
-+			{
-+				regs->r28 = regs->pc+4;
-+				regs->r27 = addr+16;
-+				regs->pc = resolver;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
- 
- /*
-  * This routine handles page faults.  It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
-  good_area:
- 	si_code = SEGV_ACCERR;
- 	if (cause < 0) {
--		if (!(vma->vm_flags & VM_EXEC))
-+		if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+			do_group_exit(SIGKILL);
-+#else
- 			goto bad_area;
-+#endif
-+
-+		}
- 	} else if (!cause) {
- 		/* Allow reads even for write-only mappings */
- 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.32.12/arch/arm/include/asm/elf.h linux-2.6.32.12/arch/arm/include/asm/elf.h
---- linux-2.6.32.12/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/include/asm/elf.h	2010-04-04 20:46:41.472784147 -0400
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
- 
- /* When the program starts, a1 contains a pointer to a function to be 
-    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
-diff -urNp linux-2.6.32.12/arch/arm/include/asm/kmap_types.h linux-2.6.32.12/arch/arm/include/asm/kmap_types.h
---- linux-2.6.32.12/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/include/asm/kmap_types.h	2010-04-04 20:46:41.472784147 -0400
-@@ -19,6 +19,7 @@ enum km_type {
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
- 	KM_L2_CACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.12/arch/arm/include/asm/uaccess.h linux-2.6.32.12/arch/arm/include/asm/uaccess.h
---- linux-2.6.32.12/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/include/asm/uaccess.h	2010-04-04 20:46:41.472784147 -0400
-@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
- 
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else /* security hole - plug it */
-@@ -412,6 +415,9 @@ static inline unsigned long __must_check
- 
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-diff -urNp linux-2.6.32.12/arch/arm/kernel/kgdb.c linux-2.6.32.12/arch/arm/kernel/kgdb.c
---- linux-2.6.32.12/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/kernel/kgdb.c	2010-04-04 20:46:41.472784147 -0400
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
-  * and we handle the normal undef case within the do_undefinstr
-  * handler.
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff -urNp linux-2.6.32.12/arch/arm/mach-at91/pm.c linux-2.6.32.12/arch/arm/mach-at91/pm.c
---- linux-2.6.32.12/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-at91/pm.c	2010-04-04 20:46:41.472784147 -0400
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
- 
- 
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- 	.valid	= at91_pm_valid_state,
- 	.begin	= at91_pm_begin,
- 	.enter	= at91_pm_enter,
-diff -urNp linux-2.6.32.12/arch/arm/mach-omap1/pm.c linux-2.6.32.12/arch/arm/mach-omap1/pm.c
---- linux-2.6.32.12/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-omap1/pm.c	2010-04-04 20:46:41.472784147 -0400
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
- 
- 
- 
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- 	.prepare	= omap_pm_prepare,
- 	.enter		= omap_pm_enter,
- 	.finish		= omap_pm_finish,
-diff -urNp linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c
---- linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-omap2/pm24xx.c	2010-04-04 20:46:41.472784147 -0400
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- 	enable_hlt();
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.prepare	= omap2_pm_prepare,
- 	.enter		= omap2_pm_enter,
- 	.finish		= omap2_pm_finish,
-diff -urNp linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c
---- linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-omap2/pm34xx.c	2010-04-04 20:46:41.472784147 -0400
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- 	return;
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.begin		= omap3_pm_begin,
- 	.end		= omap3_pm_end,
- 	.prepare	= omap3_pm_prepare,
-diff -urNp linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c
---- linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-pnx4008/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
- 	       (state == PM_SUSPEND_MEM);
- }
- 
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- 	.enter = pnx4008_pm_enter,
- 	.valid = pnx4008_pm_valid,
- };
-diff -urNp linux-2.6.32.12/arch/arm/mach-pxa/pm.c linux-2.6.32.12/arch/arm/mach-pxa/pm.c
---- linux-2.6.32.12/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-pxa/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- 		pxa_cpu_pm_fns->finish();
- }
- 
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- 	.valid		= pxa_pm_valid,
- 	.enter		= pxa_pm_enter,
- 	.prepare	= pxa_pm_prepare,
-diff -urNp linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c
---- linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-pxa/sharpsl_pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
- }
- 
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- 	.prepare	= pxa_pm_prepare,
- 	.finish		= pxa_pm_finish,
- 	.enter		= corgi_pxa_pm_enter,
-diff -urNp linux-2.6.32.12/arch/arm/mach-sa1100/pm.c linux-2.6.32.12/arch/arm/mach-sa1100/pm.c
---- linux-2.6.32.12/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mach-sa1100/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- 	return virt_to_phys(sp);
- }
- 
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- 	.enter		= sa11x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.12/arch/arm/mm/fault.c linux-2.6.32.12/arch/arm/mm/fault.c
---- linux-2.6.32.12/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
-@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
- 	}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (fsr & FSR_LNX_PF) {
-+		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	tsk->thread.address = addr;
- 	tsk->thread.error_code = fsr;
- 	tsk->thread.trap_no = 14;
-@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
- }
- #endif					/* CONFIG_MMU */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-4: ");
-+	for (i = -1; i < 20; i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08lx ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * First Level Translation Fault Handler
-  *
-diff -urNp linux-2.6.32.12/arch/arm/mm/mmap.c linux-2.6.32.12/arch/arm/mm/mmap.c
---- linux-2.6.32.12/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/mm/mmap.c	2010-04-04 20:46:41.476773136 -0400
-@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (len > TASK_SIZE)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -94,8 +98,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-diff -urNp linux-2.6.32.12/arch/arm/plat-s3c/pm.c linux-2.6.32.12/arch/arm/plat-s3c/pm.c
---- linux-2.6.32.12/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/arm/plat-s3c/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- 	s3c_pm_check_cleanup();
- }
- 
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- 	.enter		= s3c_pm_enter,
- 	.prepare	= s3c_pm_prepare,
- 	.finish		= s3c_pm_finish,
-diff -urNp linux-2.6.32.12/arch/avr32/include/asm/elf.h linux-2.6.32.12/arch/avr32/include/asm/elf.h
---- linux-2.6.32.12/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/avr32/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-diff -urNp linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/avr32/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
-@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
- D(11)	KM_IRQ1,
- D(12)	KM_SOFTIRQ0,
- D(13)	KM_SOFTIRQ1,
--D(14)	KM_TYPE_NR
-+D(14)	KM_CLEARPAGE,
-+D(15)	KM_TYPE_NR
- };
- 
- #undef D
-diff -urNp linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c
---- linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/avr32/mach-at32ap/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -176,7 +176,7 @@ out:
- 	return 0;
- }
- 
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- 	.valid	= avr32_pm_valid_state,
- 	.enter	= avr32_pm_enter,
- };
-diff -urNp linux-2.6.32.12/arch/avr32/mm/fault.c linux-2.6.32.12/arch/avr32/mm/fault.c
---- linux-2.6.32.12/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/avr32/mm/fault.c	2010-04-04 20:46:41.476773136 -0400
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
- 
- int exception_trace = 1;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (unsigned char *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults. It determines the address and the
-  * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- 	up_read(&mm->mmap_sem);
- 
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		if (exception_trace && printk_ratelimit())
- 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
- 			       "sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.32.12/arch/blackfin/kernel/kgdb.c linux-2.6.32.12/arch/blackfin/kernel/kgdb.c
---- linux-2.6.32.12/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/blackfin/kernel/kgdb.c	2010-04-04 20:46:41.476773136 -0400
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;		/* this means that we do not want to exit from the handler */
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.32.12/arch/blackfin/mach-common/pm.c linux-2.6.32.12/arch/blackfin/mach-common/pm.c
---- linux-2.6.32.12/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/blackfin/mach-common/pm.c	2010-04-04 20:46:41.476773136 -0400
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
- 	return 0;
- }
- 
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- 	.enter = bfin_pm_enter,
- 	.valid	= bfin_pm_valid,
- };
-diff -urNp linux-2.6.32.12/arch/frv/include/asm/kmap_types.h linux-2.6.32.12/arch/frv/include/asm/kmap_types.h
---- linux-2.6.32.12/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/frv/include/asm/kmap_types.h	2010-04-04 20:46:41.476773136 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/hp/common/hwsw_iommu.c	2010-04-04 20:46:41.476773136 -0400
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
- 
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
- 
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
- 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
- 
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- 	if (use_swiotlb(dev))
- 		return &swiotlb_dma_ops;
-diff -urNp linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/hp/common/sba_iommu.c	2010-04-04 20:46:41.476773136 -0400
-@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
- 	},
- };
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static int __init
- sba_init(void)
-@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
- 
- __setup("sbapagesize=",sba_page_override);
- 
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- 	.alloc_coherent		= sba_alloc_coherent,
- 	.free_coherent		= sba_free_coherent,
- 	.map_page		= sba_map_page,
-diff -urNp linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c
---- linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/ia32/binfmt_elf32.c	2010-04-04 20:46:41.476773136 -0400
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
- 
- #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
- 
-diff -urNp linux-2.6.32.12/arch/ia64/ia32/ia32priv.h linux-2.6.32.12/arch/ia64/ia32/ia32priv.h
---- linux-2.6.32.12/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/ia32/ia32priv.h	2010-04-04 20:46:41.476773136 -0400
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA	ELFDATA2LSB
- #define ELF_ARCH	EM_386
- 
--#define IA32_STACK_TOP		IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK	(current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK	0UL
-+#endif
-+
-+#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
- #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
- 
-diff -urNp linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/include/asm/dma-mapping.h	2010-04-04 20:46:41.476773136 -0400
-@@ -12,7 +12,7 @@
- 
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
- 
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *daddr, gfp_t gfp)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	void *caddr;
- 
- 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *caddr, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	debug_dma_free_coherent(dev, size, caddr, daddr);
- 	ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->mapping_error(dev, daddr);
- }
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->dma_supported(dev, mask);
- }
- 
-diff -urNp linux-2.6.32.12/arch/ia64/include/asm/elf.h linux-2.6.32.12/arch/ia64/include/asm/elf.h
---- linux-2.6.32.12/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/include/asm/elf.h	2010-04-04 20:46:41.476773136 -0400
-@@ -43,6 +43,13 @@
-  */
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND		0x70000001
- 
- /* IA-64 relocations: */
-diff -urNp linux-2.6.32.12/arch/ia64/include/asm/machvec.h linux-2.6.32.12/arch/ia64/include/asm/machvec.h
---- linux-2.6.32.12/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/include/asm/machvec.h	2010-04-04 20:46:41.476773136 -0400
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
- 
- /*
-  * WARNING: The legacy I/O space is _architected_.  Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
- # endif /* CONFIG_IA64_GENERIC */
- 
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
- 
- /*
-  * Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.32.12/arch/ia64/include/asm/pgtable.h linux-2.6.32.12/arch/ia64/include/asm/pgtable.h
---- linux-2.6.32.12/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+#endif
-+
- #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.32.12/arch/ia64/include/asm/uaccess.h linux-2.6.32.12/arch/ia64/include/asm/uaccess.h
---- linux-2.6.32.12/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/include/asm/uaccess.h	2010-04-04 20:46:41.480470677 -0400
-@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
- 	const void *__cu_from = (from);							\
- 	long __cu_len = (n);								\
- 											\
--	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
-+	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
- 	long __cu_len = (n);								\
- 											\
- 	__chk_user_ptr(__cu_from);							\
--	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
-+	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/dma-mapping.c	2010-04-04 20:46:41.480470677 -0400
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
- 
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- 	return dma_ops;
- }
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/module.c linux-2.6.32.12/arch/ia64/kernel/module.c
---- linux-2.6.32.12/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
--	if (mod && mod->arch.init_unw_table &&
--	    module_region == mod->module_init) {
-+	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- 		unw_remove_unwind_table(mod->arch.init_unw_table);
- 		mod->arch.init_unw_table = NULL;
- 	}
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
- }
- 
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_init < mod->init_size;
-+	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
- 
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_core < mod->core_size;
-+	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
- 
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
- 		break;
- 
- 	      case RV_BDREL:
--		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+		if (in_init_rx(mod, val))
-+			val -= (uint64_t) mod->module_init_rx;
-+		else if (in_init_rw(mod, val))
-+			val -= (uint64_t) mod->module_init_rw;
-+		else if (in_core_rx(mod, val))
-+			val -= (uint64_t) mod->module_core_rx;
-+		else if (in_core_rw(mod, val))
-+			val -= (uint64_t) mod->module_core_rw;
- 		break;
- 
- 	      case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
- 		 *     addresses have been selected...
- 		 */
- 		uint64_t gp;
--		if (mod->core_size > MAX_LTOFF)
-+		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- 			/*
- 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- 			 * at the end of the module.
- 			 */
--			gp = mod->core_size - MAX_LTOFF / 2;
-+			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- 		else
--			gp = mod->core_size / 2;
--		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- 		mod->arch.gp = gp;
- 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- 	}
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/pci-dma.c linux-2.6.32.12/arch/ia64/kernel/pci-dma.c
---- linux-2.6.32.12/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/pci-dma.c	2010-04-04 20:46:41.480470677 -0400
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- 	.dma_mask = &fallback_dev.coherent_dma_mask,
- };
- 
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
- 
- static int __init pci_iommu_init(void)
- {
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/pci-swiotlb.c	2010-04-04 20:46:41.480470677 -0400
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
- 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
- 
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
- 	.map_page = swiotlb_map_page,
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/sys_ia64.c	2010-04-04 20:46:41.480470677 -0400
-@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
- 	if (REGION_NUMBER(addr) == RGN_HPAGE)
- 		addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		addr = mm->free_area_cache;
-+	else
-+#endif
-+
- 	if (!addr)
- 		addr = mm->free_area_cache;
- 
-@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
- 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
-+			if (start_addr != mm->mmap_base) {
- 				/* Start a new search --- just in case we missed some holes.  */
--				addr = TASK_UNMAPPED_BASE;
-+				addr = mm->mmap_base;
- 				goto full_search;
- 			}
- 			return -ENOMEM;
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/topology.c linux-2.6.32.12/arch/ia64/kernel/topology.c
---- linux-2.6.32.12/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/topology.c	2010-04-04 20:46:41.480470677 -0400
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
- 	return ret;
- }
- 
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- 	.show   = cache_show
- };
- 
-diff -urNp linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/kernel/vmlinux.lds.S	2010-04-04 20:46:41.480470677 -0400
-@@ -190,7 +190,7 @@ SECTIONS
-   /* Per-cpu data: */
-   . = ALIGN(PERCPU_PAGE_SIZE);
-   PERCPU_VADDR(PERCPU_ADDR, :percpu)
--  __phys_per_cpu_start = __per_cpu_load;
-+  __phys_per_cpu_start = per_cpu_load;
-   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
-   						 * into percpu page size
- 						 */
-diff -urNp linux-2.6.32.12/arch/ia64/mm/fault.c linux-2.6.32.12/arch/ia64/mm/fault.c
---- linux-2.6.32.12/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
- 	return pte_present(pte);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
- 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
- 
--	if ((vma->vm_flags & mask) != mask)
-+	if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
- 
-+	}
-+
-   survive:
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.12/arch/ia64/mm/init.c linux-2.6.32.12/arch/ia64/mm/init.c
---- linux-2.6.32.12/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/mm/init.c	2010-04-04 20:46:41.480470677 -0400
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- 		vma->vm_end = vma->vm_start + PAGE_SIZE;
- 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+			if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+				vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+		}
-+#endif
-+
- 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 		down_write(&current->mm->mmap_sem);
- 		if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/ia64/sn/pci/pci_dma.c	2010-04-04 20:46:41.480470677 -0400
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
- 	return ret;
- }
- 
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- 	.alloc_coherent		= sn_dma_alloc_coherent,
- 	.free_coherent		= sn_dma_free_coherent,
- 	.map_page		= sn_dma_map_page,
-diff -urNp linux-2.6.32.12/arch/m32r/lib/usercopy.c linux-2.6.32.12/arch/m32r/lib/usercopy.c
---- linux-2.6.32.12/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/m32r/lib/usercopy.c	2010-04-04 20:46:41.480470677 -0400
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetch(from);
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		__copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetchw(to);
- 	if (access_ok(VERIFY_READ, from, n))
- 		__copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c
---- linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/alchemy/devboards/pm.c	2010-04-04 20:46:41.480470677 -0400
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
- 
- }
- 
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- 	.valid		= suspend_valid_only_mem,
- 	.begin		= db1x_pm_begin,
- 	.enter		= db1x_pm_enter,
-diff -urNp linux-2.6.32.12/arch/mips/include/asm/elf.h linux-2.6.32.12/arch/mips/include/asm/elf.h
---- linux-2.6.32.12/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
- #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
- #endif
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.32.12/arch/mips/include/asm/page.h linux-2.6.32.12/arch/mips/include/asm/page.h
---- linux-2.6.32.12/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/include/asm/page.h	2010-04-04 20:46:41.480470677 -0400
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
-   #ifdef CONFIG_CPU_MIPS32
-     typedef struct { unsigned long pte_low, pte_high; } pte_t;
-     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
--    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
-   #else
-      typedef struct { unsigned long long pte; } pte_t;
-      #define pte_val(x)	((x).pte)
-diff -urNp linux-2.6.32.12/arch/mips/include/asm/system.h linux-2.6.32.12/arch/mips/include/asm/system.h
---- linux-2.6.32.12/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/include/asm/system.h	2010-04-04 20:46:41.480470677 -0400
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
-  */
- #define __ARCH_WANT_UNLOCKED_CTXSW
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ALMASK)
- 
- #endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/kernel/binfmt_elfn32.c	2010-04-04 20:46:41.480470677 -0400
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff -urNp linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/kernel/binfmt_elfo32.c	2010-04-04 20:46:41.480470677 -0400
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- 
- /*
-diff -urNp linux-2.6.32.12/arch/mips/kernel/kgdb.c linux-2.6.32.12/arch/mips/kernel/kgdb.c
---- linux-2.6.32.12/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/kernel/kgdb.c	2010-04-04 20:46:41.480470677 -0400
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;
- }
- 
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
- 
- /*
-diff -urNp linux-2.6.32.12/arch/mips/kernel/process.c linux-2.6.32.12/arch/mips/kernel/process.c
---- linux-2.6.32.12/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/kernel/process.c	2010-04-04 20:46:41.480470677 -0400
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
- out:
- 	return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() & ~PAGE_MASK;
--
--	return sp & ALMASK;
--}
-diff -urNp linux-2.6.32.12/arch/mips/kernel/syscall.c linux-2.6.32.12/arch/mips/kernel/syscall.c
---- linux-2.6.32.12/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/kernel/syscall.c	2010-04-04 20:46:41.480470677 -0400
-@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
- 	do_color_align = 0;
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
- 		    (!vmm || addr + len <= vmm->vm_start))
- 			return addr;
- 	}
--	addr = TASK_UNMAPPED_BASE;
-+	addr = current->mm->mmap_base;
- 	if (do_color_align)
- 		addr = COLOUR_ALIGN(addr, pgoff);
- 	else
-diff -urNp linux-2.6.32.12/arch/mips/mm/fault.c linux-2.6.32.12/arch/mips/mm/fault.c
---- linux-2.6.32.12/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/mips/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h>		/* For VMALLOC_END */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults.  It determines the address,
-  * and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.32.12/arch/parisc/include/asm/elf.h linux-2.6.32.12/arch/parisc/include/asm/elf.h
---- linux-2.6.32.12/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/include/asm/elf.h	2010-04-04 20:46:41.480470677 -0400
-@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-    but it's not easy, and we've already done it here.  */
-diff -urNp linux-2.6.32.12/arch/parisc/include/asm/pgtable.h linux-2.6.32.12/arch/parisc/include/asm/pgtable.h
---- linux-2.6.32.12/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/include/asm/pgtable.h	2010-04-04 20:46:41.480470677 -0400
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY       PAGE_EXECREAD
- #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.32.12/arch/parisc/kernel/module.c linux-2.6.32.12/arch/parisc/kernel/module.c
---- linux-2.6.32.12/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/kernel/module.c	2010-04-04 20:46:41.480470677 -0400
-@@ -95,16 +95,38 @@
- 
- /* three functions to determine where in the module core
-  * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rx &&
-+		loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rw &&
-+		loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
--	return (loc >= me->module_init &&
--		loc <= (me->module_init + me->init_size));
-+	return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rx &&
-+		loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rw &&
-+		loc < (me->module_core_rw + me->core_size_rw));
- }
- 
- static inline int in_core(struct module *me, void *loc)
- {
--	return (loc >= me->module_core &&
--		loc <= (me->module_core + me->core_size));
-+	return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
- 
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
- 	}
- 
- 	/* align things a bit */
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.got_offset = me->core_size;
--	me->core_size += gots * sizeof(struct got_entry);
--
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.fdesc_offset = me->core_size;
--	me->core_size += fdescs * sizeof(Elf_Fdesc);
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += gots * sizeof(struct got_entry);
-+
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.fdesc_offset = me->core_size_rw;
-+	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
- 
- 	me->arch.got_max = gots;
- 	me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
- 
- 	BUG_ON(value == 0);
- 
--	got = me->module_core + me->arch.got_offset;
-+	got = me->module_core_rw + me->arch.got_offset;
- 	for (i = 0; got[i].addr; i++)
- 		if (got[i].addr == value)
- 			goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
--	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
- 
- 	if (!value) {
- 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
- 
- 	/* Create new one */
- 	fdesc->addr = value;
--	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 	return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
- 
- 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- 	end = table + sechdrs[me->arch.unwind_section].sh_size;
--	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 
- 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- 	       me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/kernel/sys_parisc.c	2010-04-04 20:46:41.480470677 -0400
-@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (flags & MAP_FIXED)
- 		return addr;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (filp) {
- 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.32.12/arch/parisc/kernel/traps.c linux-2.6.32.12/arch/parisc/kernel/traps.c
---- linux-2.6.32.12/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/kernel/traps.c	2010-04-04 20:46:41.480470677 -0400
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
- 
- 			down_read(&current->mm->mmap_sem);
- 			vma = find_vma(current->mm,regs->iaoq[0]);
--			if (vma && (regs->iaoq[0] >= vma->vm_start)
--				&& (vma->vm_flags & VM_EXEC)) {
--
-+			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- 				fault_address = regs->iaoq[0];
- 				fault_space = regs->iasq[0];
- 
-diff -urNp linux-2.6.32.12/arch/parisc/mm/fault.c linux-2.6.32.12/arch/parisc/mm/fault.c
---- linux-2.6.32.12/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/parisc/mm/fault.c	2010-04-04 20:46:41.480470677 -0400
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
- 
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
--	if (code == 6 || code == 16)
-+	if (code == 6 || code == 7 || code == 16)
- 	    return VM_EXEC;
- 
- 	switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
- 			}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when rt_sigreturn trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int bl, depwi;
-+
-+		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+		if (err)
-+			break;
-+
-+		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+			err = get_user(ldw, (unsigned int *)addr);
-+			err |= get_user(bv, (unsigned int *)(addr+4));
-+			err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+			if (err)
-+				break;
-+
-+			if (ldw == 0x0E801096U &&
-+			    bv == 0xEAC0C000U &&
-+			    ldw2 == 0x0E881095U)
-+			{
-+				unsigned int resolver, map;
-+
-+				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+				if (err)
-+					break;
-+
-+				regs->gr[20] = instruction_pointer(regs)+8;
-+				regs->gr[21] = map;
-+				regs->gr[22] = resolver;
-+				regs->iaoq[0] = resolver | 3UL;
-+				regs->iaoq[1] = regs->iaoq[0] + 4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+#endif
-+
-+	do { /* PaX: rt_sigreturn emulation */
-+		unsigned int ldi1, ldi2, bel, nop;
-+
-+		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+		    ldi2 == 0x3414015AU &&
-+		    bel == 0xE4008200U &&
-+		    nop == 0x08000240U)
-+		{
-+			regs->gr[25] = (ldi1 & 2) >> 1;
-+			regs->gr[20] = __NR_rt_sigreturn;
-+			regs->gr[31] = regs->iaoq[1] + 16;
-+			regs->sr[0] = regs->iasq[1];
-+			regs->iaoq[0] = 0x100UL;
-+			regs->iaoq[1] = regs->iaoq[0] + 4;
-+			regs->iasq[0] = regs->sr[2];
-+			regs->iasq[1] = regs->sr[2];
-+			return 2;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
- 
- 	acc_type = parisc_acctyp(code,regs->iir);
- 
--	if ((vma->vm_flags & acc_type) != acc_type)
-+	if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+		    (address & ~3UL) == instruction_pointer(regs))
-+		{
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 3:
-+				return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			case 2:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
-+	}
- 
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/device.h linux-2.6.32.12/arch/powerpc/include/asm/device.h
---- linux-2.6.32.12/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/device.h	2010-04-04 20:46:41.485273950 -0400
-@@ -14,7 +14,7 @@ struct dev_archdata {
- 	struct device_node	*of_node;
- 
- 	/* DMA operations on that device */
--	struct dma_map_ops	*dma_ops;
-+	const struct dma_map_ops	*dma_ops;
- 
- 	/*
- 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/dma-mapping.h	2010-04-04 20:46:41.485273950 -0400
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- 	/* We don't handle the NULL dev case for ISA for now. We could
- 	 * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
- 	return dev->archdata.dma_ops;
- }
- 
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- 	dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
- 
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	BUG_ON(!dma_ops);
- 
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (dma_ops->mapping_error)
- 		return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/elf.h linux-2.6.32.12/arch/powerpc/include/asm/elf.h
---- linux-2.6.32.12/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/elf.h	2010-04-04 20:46:41.485273950 -0400
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE		(0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
-+#endif
- 
- /*
-  * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
- 	(0x7ff >> (PAGE_SHIFT - 12)) : \
- 	(0x3ffff >> (PAGE_SHIFT - 12)))
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
- 
- /*
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/iommu.h linux-2.6.32.12/arch/powerpc/include/asm/iommu.h
---- linux-2.6.32.12/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/iommu.h	2010-04-04 20:46:41.485273950 -0400
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
- 
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/kmap_types.h	2010-04-04 20:46:41.485273950 -0400
-@@ -26,6 +26,7 @@ enum km_type {
- 	KM_SOFTIRQ1,
- 	KM_PPC_SYNC_PAGE,
- 	KM_PPC_SYNC_ICACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/page_64.h linux-2.6.32.12/arch/powerpc/include/asm/page_64.h
---- linux-2.6.32.12/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/page_64.h	2010-04-04 20:46:41.485273950 -0400
-@@ -180,15 +180,18 @@ do {						\
-  * stack by default, so in the absense of a PT_GNU_STACK program header
-  * we turn execute permission off.
-  */
--#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- 	(test_thread_flag(TIF_32BIT) ? \
- 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
- 
- #include <asm-generic/getorder.h>
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/page.h linux-2.6.32.12/arch/powerpc/include/asm/page.h
---- linux-2.6.32.12/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/page.h	2010-04-04 20:46:41.485273950 -0400
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
-  * and needs to be executable.  This means the whole heap ends
-  * up being executable.
-  */
--#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
- #endif
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- #ifndef __ASSEMBLY__
- 
- #undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/pci.h linux-2.6.32.12/arch/powerpc/include/asm/pci.h
---- linux-2.6.32.12/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/pci.h	2010-04-04 20:46:41.485273950 -0400
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
- }
- 
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else	/* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops()	NULL
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/pte-hash32.h	2010-04-04 20:46:41.485273950 -0400
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
- #define _PAGE_USER	0x004	/* usermode access allowed */
- #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
-+#define _PAGE_EXEC	_PAGE_GUARDED
- #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
- #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/reg.h linux-2.6.32.12/arch/powerpc/include/asm/reg.h
---- linux-2.6.32.12/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/reg.h	2010-04-04 20:46:41.485273950 -0400
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
- #define   DSISR_NOHPTE		0x40000000	/* no translation found */
-+#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
- #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
- #define   DSISR_ISSTORE		0x02000000	/* access was a store */
- #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/swiotlb.h	2010-04-04 20:46:41.485273950 -0400
-@@ -13,7 +13,7 @@
- 
- #include <linux/swiotlb.h>
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static inline void dma_mark_clean(void *addr, size_t size) {}
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/include/asm/uaccess.h	2010-04-04 20:46:41.485273950 -0400
-@@ -327,52 +327,6 @@ do {								\
- extern unsigned long __copy_tofrom_user(void __user *to,
- 		const void __user *from, unsigned long size);
- 
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
--		const void __user *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_READ, from, n))
--		return __copy_tofrom_user((__force void __user *)to, from, n);
--	if ((unsigned long)from < TASK_SIZE) {
--		over = (unsigned long)from + n - TASK_SIZE;
--		return __copy_tofrom_user((__force void __user *)to, from,
--				n - over) + over;
--	}
--	return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
--		const void *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_WRITE, to, n))
--		return __copy_tofrom_user(to, (__force void __user *)from, n);
--	if ((unsigned long)to < TASK_SIZE) {
--		over = (unsigned long)to + n - TASK_SIZE;
--		return __copy_tofrom_user(to, (__force void __user *)from,
--				n - over) + over;
--	}
--	return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
--	__copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
--				    unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
--				  unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
--				  unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- 		const void __user *from, unsigned long n)
- {
-@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
- 	return __copy_tofrom_user((__force void __user *)to, from, n);
- }
- 
-@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
- 
-@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
- 	return __copy_to_user_inatomic(to, from, size);
- }
- 
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+		const void __user *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_READ, from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		return __copy_tofrom_user((__force void __user *)to, from, n);
-+	}
-+	if ((unsigned long)from < TASK_SIZE) {
-+		over = (unsigned long)from + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n - over))
-+			check_object_size(to, n - over, false);
-+		return __copy_tofrom_user((__force void __user *)to, from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+		const void *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_WRITE, to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from, n);
-+	}
-+	if ((unsigned long)to < TASK_SIZE) {
-+		over = (unsigned long)to + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n - over, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+	__copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
-+	if (likely(access_ok(VERIFY_READ, from, n)))
-+		n = __copy_from_user(to, from, n);
-+	else
-+		memset(to, 0, n);
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		n = __copy_to_user(to, from, n);
-+	}
-+	return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+				  unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
- 
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c
---- linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/cacheinfo.c	2010-04-04 20:46:41.485273950 -0400
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
- 	&cache_assoc_attr,
- };
- 
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- 	.show = cache_index_show,
- };
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma.c linux-2.6.32.12/arch/powerpc/kernel/dma.c
---- linux-2.6.32.12/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/dma.c	2010-04-04 20:46:41.485273950 -0400
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
- }
- #endif
- 
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- 	.alloc_coherent	= dma_direct_alloc_coherent,
- 	.free_coherent	= dma_direct_free_coherent,
- 	.map_sg		= dma_direct_map_sg,
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/dma-iommu.c	2010-04-04 20:46:41.485273950 -0400
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
- }
- 
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- 	struct iommu_table *tbl = get_iommu_table_base(dev);
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/dma-swiotlb.c	2010-04-04 20:46:41.485273950 -0400
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
-  * map_page, and unmap_page on highmem, use normal dma_ops
-  * for everything else.
-  */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = dma_direct_alloc_coherent,
- 	.free_coherent = dma_direct_free_coherent,
- 	.map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/exceptions-64e.S	2010-04-04 20:46:41.485273950 -0400
-@@ -455,6 +455,7 @@ storage_fault_common:
- 	std	r14,_DAR(r1)
- 	std	r15,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	mr	r4,r14
- 	mr	r5,r15
- 	ld	r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- 	cmpdi	r3,0
- 	bne-	1f
- 	b	.ret_from_except_lite
--1:	bl	.save_nvgprs
--	mr	r5,r3
-+1:	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	ld	r4,_DAR(r1)
- 	bl	.bad_page_fault
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/exceptions-64s.S	2010-04-04 20:46:41.485273950 -0400
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11:	ld	r4,_DAR(r1)
- 	ld	r5,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	bl	.do_page_fault
- 	cmpdi	r3,0
- 	beq+	13f
--	bl	.save_nvgprs
- 	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	lwz	r4,_DAR(r1)
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/ibmebus.c	2010-04-04 20:46:41.485273950 -0400
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
- 	return 1;
- }
- 
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- 	.alloc_coherent = ibmebus_alloc_coherent,
- 	.free_coherent  = ibmebus_free_coherent,
- 	.map_sg         = ibmebus_map_sg,
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/kgdb.c linux-2.6.32.12/arch/powerpc/kernel/kgdb.c
---- linux-2.6.32.12/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/kgdb.c	2010-04-04 20:46:41.485273950 -0400
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
- 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- 		return 0;
- 
--	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- 		regs->nip += 4;
- 
- 	return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
- /*
-  * Global data
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/module_32.c linux-2.6.32.12/arch/powerpc/kernel/module_32.c
---- linux-2.6.32.12/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/module_32.c	2010-04-04 20:46:41.485273950 -0400
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
- 			me->arch.core_plt_section = i;
- 	}
- 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
--		printk("Module doesn't contain .plt or .init.plt sections.\n");
-+		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- 		return -ENOEXEC;
- 	}
- 
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
- 
- 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- 	/* Init, or core PLT? */
--	if (location >= mod->module_core
--	    && location < mod->module_core + mod->core_size)
-+	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
--	else
-+	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+	else {
-+		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+		return ~0UL;
-+	}
- 
- 	/* Find this entry, or if that fails, the next avail. entry */
- 	while (entry->jump[0]) {
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/module.c linux-2.6.32.12/arch/powerpc/kernel/module.c
---- linux-2.6.32.12/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/module.c	2010-04-04 20:46:41.485273950 -0400
-@@ -31,11 +31,24 @@
- 
- LIST_HEAD(module_bug_list);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- 	if (size == 0)
- 		return NULL;
- 
-+	return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+	if (size == 0)
-+		return NULL;
-+
- 	return vmalloc_exec(size);
- }
- 
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- 				    const Elf_Shdr *sechdrs,
- 				    const char *name)
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/pci-common.c linux-2.6.32.12/arch/powerpc/kernel/pci-common.c
---- linux-2.6.32.12/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/pci-common.c	2010-04-04 20:46:41.485273950 -0400
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
- 
- 
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
- 
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- 	pci_dma_ops = dma_ops;
- }
- 
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- 	return pci_dma_ops;
- }
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/process.c linux-2.6.32.12/arch/powerpc/kernel/process.c
---- linux-2.6.32.12/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/process.c	2010-04-04 20:46:41.485273950 -0400
-@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
- 		sp -= get_random_int() & ~PAGE_MASK;
- 	return sp & ~0xf;
- }
--
--static inline unsigned long brk_rnd(void)
--{
--        unsigned long rnd = 0;
--
--	/* 8MB for 32bit, 1GB for 64bit */
--	if (is_32bit_task())
--		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
--	else
--		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
--	return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long base = mm->brk;
--	unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
--	/*
--	 * If we are using 1TB segments and we are allowed to randomise
--	 * the heap, we can put it above 1TB so it is backed by a 1TB
--	 * segment. Otherwise the heap will be in the bottom 1TB
--	 * which always uses 256MB segments and this may result in a
--	 * performance penalty.
--	 */
--	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
--		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
--	ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < mm->brk)
--		return mm->brk;
--
--	return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
--	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < base)
--		return base;
--
--	return ret;
--}
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/signal_32.c linux-2.6.32.12/arch/powerpc/kernel/signal_32.c
---- linux-2.6.32.12/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/signal_32.c	2010-04-04 20:46:41.489273754 -0400
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
- 	/* Save user registers on the stack */
- 	frame = &rt_sf->uc.uc_mcontext;
- 	addr = frame;
--	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		if (save_user_regs(regs, frame, 0, 1))
- 			goto badframe;
- 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/signal_64.c linux-2.6.32.12/arch/powerpc/kernel/signal_64.c
---- linux-2.6.32.12/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/signal_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
- 	current->thread.fpscr.val = 0;
- 
- 	/* Set up to return from userspace. */
--	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- 	} else {
- 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c
---- linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/sys_ppc32.c	2010-04-04 20:46:41.489273754 -0400
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
- 	if (oldlenp) {
- 		if (!error) {
- 			if (get_user(oldlen, oldlenp) ||
--			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- 				error = -EFAULT;
- 		}
--		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- 	}
- 	return error;
- }
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/vdso.c linux-2.6.32.12/arch/powerpc/kernel/vdso.c
---- linux-2.6.32.12/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/vdso.c	2010-04-04 20:46:41.489273754 -0400
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
- 
- #include "setup.h"
- 
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = VDSO32_MBASE;
- #endif
- 
--	current->mm->context.vdso_base = 0;
-+	current->mm->context.vdso_base = ~0UL;
- 
- 	/* vDSO has a problem and was disabled, just don't "enable" it for the
- 	 * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = get_unmapped_area(NULL, vdso_base,
- 				      (vdso_pages << PAGE_SHIFT) +
- 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
--				      0, 0);
-+				      0, MAP_PRIVATE | MAP_EXECUTABLE);
- 	if (IS_ERR_VALUE(vdso_base)) {
- 		rc = vdso_base;
- 		goto fail_mmapsem;
-diff -urNp linux-2.6.32.12/arch/powerpc/kernel/vio.c linux-2.6.32.12/arch/powerpc/kernel/vio.c
---- linux-2.6.32.12/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/kernel/vio.c	2010-04-04 20:46:41.489273754 -0400
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
- 	vio_cmo_dealloc(viodev, alloc_size);
- }
- 
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
- 	.free_coherent  = vio_dma_iommu_free_coherent,
- 	.map_sg         = vio_dma_iommu_map_sg,
- 	.unmap_sg       = vio_dma_iommu_unmap_sg,
-+	.dma_supported  = dma_iommu_dma_supported,
- 	.map_page       = vio_dma_iommu_map_page,
- 	.unmap_page     = vio_dma_iommu_unmap_page,
- 
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
- 
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
--	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/lib/usercopy_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
- 
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_READ, from, n)))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_WRITE, to, n)))
--		n = __copy_to_user(to, from, n);
--	return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- 			   unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
- 	return n;
- }
- 
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.12/arch/powerpc/mm/fault.c linux-2.6.32.12/arch/powerpc/mm/fault.c
---- linux-2.6.32.12/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/mm/fault.c	2010-04-04 20:46:41.489273754 -0400
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
- 
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
- 
- 
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
- }
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int __user *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * Check whether the instruction at regs->nip is a store using
-  * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
- 	 * indicate errors in DSISR but can validly be set in SRR1.
- 	 */
- 	if (trap == 0x400)
--		error_code &= 0x48200000;
-+		error_code &= 0x58200000;
- 	else
- 		is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
-          * "undefined".  Of those that can be set, this is the only
-          * one which seems bad.
-          */
--	if (error_code & 0x10000000)
-+	if (error_code & DSISR_GUARDED)
-                 /* Guarded storage error. */
- 		goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- 		 * processors use the same I/D cache coherency mechanism
- 		 * as embedded.
- 		 */
--		if (error_code & DSISR_PROTFAULT)
-+		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- 			goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
- 
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- 	/* User mode accesses cause a SIGSEGV */
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+			if (is_exec && regs->nip == address) {
-+#endif
-+				switch (pax_handle_fetch_fault(regs)) {
-+				}
-+
-+				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		_exception(SIGSEGV, regs, code, address);
- 		return 0;
- 	}
-diff -urNp linux-2.6.32.12/arch/powerpc/mm/mmap_64.c linux-2.6.32.12/arch/powerpc/mm/mmap_64.c
---- linux-2.6.32.12/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/mm/mmap_64.c	2010-04-04 20:46:41.489273754 -0400
-@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.12/arch/powerpc/mm/slice.c linux-2.6.32.12/arch/powerpc/mm/slice.c
---- linux-2.6.32.12/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/mm/slice.c	2010-04-04 20:46:41.489273754 -0400
-@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
- 	if (fixed && addr > (mm->task_size - len))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+		addr = 0;
-+#endif
-+
- 	/* If hint, make sure it matches our alignment restrictions */
- 	if (!fixed && addr) {
- 		addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c
---- linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-04-04 20:46:41.489273754 -0400
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- 	lite5200_pm_target_state = PM_SUSPEND_ON;
- }
- 
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- 	.valid		= lite5200_pm_valid,
- 	.begin		= lite5200_pm_begin,
- 	.prepare	= lite5200_pm_prepare,
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c
---- linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-04-04 20:46:41.489273754 -0400
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- 	iounmap(mbar);
- }
- 
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- 	.valid		= mpc52xx_pm_valid,
- 	.prepare	= mpc52xx_pm_prepare,
- 	.enter		= mpc52xx_pm_enter,
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c
---- linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/83xx/suspend.c	2010-04-04 20:46:41.489273754 -0400
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- 	return ret;
- }
- 
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- 	.valid = mpc83xx_suspend_valid,
- 	.begin = mpc83xx_suspend_begin,
- 	.enter = mpc83xx_suspend_enter,
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/cell/iommu.c	2010-04-04 20:46:41.489273754 -0400
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
- 
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
- 
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- 	.alloc_coherent = dma_fixed_alloc_coherent,
- 	.free_coherent  = dma_fixed_free_coherent,
- 	.map_sg         = dma_fixed_map_sg,
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/ps3/system-bus.c	2010-04-04 20:46:41.489273754 -0400
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
- 	return mask >= DMA_BIT_MASK(32);
- }
- 
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
- 	.unmap_page = ps3_unmap_page,
- };
- 
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig
---- linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/powerpc/platforms/pseries/Kconfig	2010-04-04 20:46:41.489273754 -0400
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- 	depends on PPC64 && PPC_BOOK3S
- 	bool "IBM pSeries & new (POWER5-based) iSeries"
- 	select MPIC
-+	select PCI_MSI
-+	select XICS
- 	select PPC_I8259
- 	select PPC_RTAS
- 	select RTAS_ERROR_LOGGING
-diff -urNp linux-2.6.32.12/arch/s390/include/asm/elf.h linux-2.6.32.12/arch/s390/include/asm/elf.h
---- linux-2.6.32.12/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/include/asm/elf.h	2010-04-04 20:46:41.489273754 -0400
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
-    that it will "exec", and that there is sufficient room for the brk.  */
- #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports. */
- 
-diff -urNp linux-2.6.32.12/arch/s390/include/asm/setup.h linux-2.6.32.12/arch/s390/include/asm/setup.h
---- linux-2.6.32.12/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/include/asm/setup.h	2010-04-04 20:46:41.489273754 -0400
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode	(1)
- #else
- #define switch_amode	(0)
- #endif
- 
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec	(1)
- #else
- #define s390_noexec	(0)
- #endif
-diff -urNp linux-2.6.32.12/arch/s390/include/asm/uaccess.h linux-2.6.32.12/arch/s390/include/asm/uaccess.h
---- linux-2.6.32.12/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/include/asm/uaccess.h	2010-04-04 20:46:41.489273754 -0400
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n) && (n <= 256))
- 		return uaccess.copy_from_user_small(n, from, to);
- 	else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else
-diff -urNp linux-2.6.32.12/arch/s390/Kconfig linux-2.6.32.12/arch/s390/Kconfig
---- linux-2.6.32.12/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/Kconfig	2010-04-04 20:46:41.489273754 -0400
-@@ -194,28 +194,26 @@ config AUDIT_ARCH
- 
- config S390_SWITCH_AMODE
- 	bool "Switch kernel/user addressing modes"
-+	default y
- 	help
- 	  This option allows to switch the addressing modes of kernel and user
--	  space. The kernel parameter switch_amode=on will enable this feature,
--	  default is disabled. Enabling this (via kernel parameter) on machines
--	  earlier than IBM System z9-109 EC/BC will reduce system performance.
-+	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
-+	  will reduce system performance.
- 
- 	  Note that this option will also be selected by selecting the execute
--	  protection option below. Enabling the execute protection via the
--	  noexec kernel parameter will also switch the addressing modes,
--	  independent of the switch_amode kernel parameter.
-+	  protection option below. Enabling the execute protection will also
-+	  switch the addressing modes, independent of this option.
- 
- 
- config S390_EXEC_PROTECT
- 	bool "Data execute protection"
-+	default y
- 	select S390_SWITCH_AMODE
- 	help
- 	  This option allows to enable a buffer overflow protection for user
- 	  space programs and it also selects the addressing mode option above.
--	  The kernel parameter noexec=on will enable this feature and also
--	  switch the addressing modes, default is disabled. Enabling this (via
--	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
--	  will reduce system performance.
-+	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+	  reduce system performance.
- 
- comment "Code generation options"
- 
-diff -urNp linux-2.6.32.12/arch/s390/kernel/module.c linux-2.6.32.12/arch/s390/kernel/module.c
---- linux-2.6.32.12/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/kernel/module.c	2010-04-04 20:46:41.492578989 -0400
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
- 
- 	/* Increase core size by size of got & plt and set start
- 	   offsets for got and plt. */
--	me->core_size = ALIGN(me->core_size, 4);
--	me->arch.got_offset = me->core_size;
--	me->core_size += me->arch.got_size;
--	me->arch.plt_offset = me->core_size;
--	me->core_size += me->arch.plt_size;
-+	me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += me->arch.got_size;
-+	me->arch.plt_offset = me->core_size_rx;
-+	me->core_size_rx += me->arch.plt_size;
- 	return 0;
- }
- 
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		if (info->got_initialized == 0) {
- 			Elf_Addr *gotent;
- 
--			gotent = me->module_core + me->arch.got_offset +
-+			gotent = me->module_core_rw + me->arch.got_offset +
- 				info->got_offset;
- 			*gotent = val;
- 			info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		else if (r_type == R_390_GOTENT ||
- 			 r_type == R_390_GOTPLTENT)
- 			*(unsigned int *) loc =
--				(val + (Elf_Addr) me->module_core - loc) >> 1;
-+				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- 		else if (r_type == R_390_GOT64 ||
- 			 r_type == R_390_GOTPLT64)
- 			*(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
- 		if (info->plt_initialized == 0) {
- 			unsigned int *ip;
--			ip = me->module_core + me->arch.plt_offset +
-+			ip = me->module_core_rx + me->arch.plt_offset +
- 				info->plt_offset;
- #ifndef CONFIG_64BIT
- 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
- 			      (r_type == R_390_PLT32DBL &&
- 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
--				val = (Elf_Addr) me->module_core +
-+				val = (Elf_Addr) me->module_core_rx +
- 					me->arch.plt_offset +
- 					info->plt_offset;
- 			val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
- 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
- 		val = val + rela->r_addend -
--			((Elf_Addr) me->module_core + me->arch.got_offset);
-+			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- 		if (r_type == R_390_GOTOFF16)
- 			*(unsigned short *) loc = val;
- 		else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		break;
- 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
- 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
--		val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- 			rela->r_addend - loc;
- 		if (r_type == R_390_GOTPC)
- 			*(unsigned int *) loc = val;
-diff -urNp linux-2.6.32.12/arch/s390/kernel/setup.c linux-2.6.32.12/arch/s390/kernel/setup.c
---- linux-2.6.32.12/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/kernel/setup.c	2010-04-04 20:46:41.492578989 -0400
-@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
- early_param("mem", early_parse_mem);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- 				 unsigned long user32_amode)
- {
-@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
- 		return 0;
- 	}
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
--	switch_amode = 1;
--	return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- 					unsigned long user32_amode)
-@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
- 
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
--	if (!strncmp(p, "off", 3))
--		return 0;
--	switch_amode = 1;
--	s390_noexec = 1;
--	return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- 	if (s390_noexec) {
-diff -urNp linux-2.6.32.12/arch/s390/mm/mmap.c linux-2.6.32.12/arch/s390/mm/mmap.c
---- linux-2.6.32.12/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/s390/mm/mmap.c	2010-04-04 20:46:41.492578989 -0400
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c
---- linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sh/boards/mach-hp6xx/pm.c	2010-04-04 20:46:41.492578989 -0400
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
- 	return 0;
- }
- 
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- 	.enter		= hp6x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c
---- linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sh/kernel/cpu/sh4/sq.c	2010-04-04 20:46:41.492578989 -0400
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
- 	NULL,
- };
- 
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- 	.show	= sq_sysfs_show,
- 	.store	= sq_sysfs_store,
- };
-diff -urNp linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c
---- linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sh/kernel/cpu/shmobile/pm.c	2010-04-04 20:46:41.492578989 -0400
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
- 	return 0;
- }
- 
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- 	.enter          = sh_pm_enter,
- 	.valid          = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.12/arch/sh/kernel/kgdb.c linux-2.6.32.12/arch/sh/kernel/kgdb.c
---- linux-2.6.32.12/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sh/kernel/kgdb.c	2010-04-04 20:46:41.492578989 -0400
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/atomic_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -14,18 +14,38 @@
- #define ATOMIC64_INIT(i)	{ (i) }
- 
- #define atomic_read(v)		((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- #define atomic64_read(v)	((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- 
- #define atomic_set(v, i)	(((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
- #define atomic64_set(v, i)	(((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
- 
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(int, atomic64_t *);
-+extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(int, atomic64_t *);
- 
- extern int atomic_add_ret(int, atomic_t *);
- extern int atomic64_add_ret(int, atomic64_t *);
-+extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern int atomic64_sub_ret(int, atomic64_t *);
- 
-@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
- 
- #define atomic_inc_return(v) atomic_add_ret(1, v)
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
- 
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
- 
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+	atomic64_add_unchecked(1, v);
-+}
- 
- #define atomic_dec(v) atomic_sub(1, v)
- #define atomic64_dec(v) atomic64_sub(1, v)
-@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
- 
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%icc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
- 
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%xcc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic64_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/dma-mapping.h	2010-04-04 20:46:41.492578989 -0400
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h)	(1)
- 
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- 	if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/elf_32.h linux-2.6.32.12/arch/sparc/include/asm/elf_32.h
---- linux-2.6.32.12/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/elf_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -116,6 +116,13 @@ typedef struct {
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  This can NOT be done in userspace
-    on Sparc.  */
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/elf_64.h linux-2.6.32.12/arch/sparc/include/asm/elf_64.h
---- linux-2.6.32.12/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/elf_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE		0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  */
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/pgtable_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
- 
- #define PMD_SHIFT		SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
- 
- #ifdef MODULE
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/pgtsrmmu.h	2010-04-04 20:46:41.492578989 -0400
-@@ -115,6 +115,13 @@
- 				    SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- 				    SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- 				    SRMMU_DIRTY | SRMMU_REF)
- 
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/spinlock_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
- 	__asm__ __volatile__ (
- "1:	ldsw		[%2], %0\n"
- "	brlz,pn		%0, 2f\n"
--"4:	 add		%0, 1, %1\n"
-+"4:	 addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
- "	.previous"
- 	: "=&r" (tmp1), "=&r" (tmp2)
- 	: "r" (lock)
--	: "memory");
-+	: "memory", "cc");
- }
- 
- static int inline arch_read_trylock(raw_rwlock_t *lock)
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
- "1:	ldsw		[%2], %0\n"
- "	brlz,a,pn	%0, 2f\n"
- "	 mov		0, %0\n"
--"	add		%0, 1, %1\n"
-+"	addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
- 
- 	__asm__ __volatile__(
- "1:	lduw	[%2], %0\n"
--"	sub	%0, 1, %1\n"
-+"	subcc	%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs	%%icc, 6\n"
-+#endif
-+
- "	cas	[%2], %0, %1\n"
- "	cmp	%0, %1\n"
- "	bne,pn	%%xcc, 1b\n"
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/uaccess_32.h	2010-04-04 20:46:41.492578989 -0400
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
- 
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) to, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
- 		return __copy_user(to, (__force void __user *) from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_user(to, (__force void __user *) from, n);
- }
- 
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) from, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
- 		return __copy_user((__force void __user *) to, from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	return __copy_user((__force void __user *) to, from, n);
- }
- 
-diff -urNp linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/include/asm/uaccess_64.h	2010-04-04 20:46:41.492578989 -0400
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
-        : "=r" (x) : "r" (__m(addr)), "i" (retval))
- 
- extern int __get_user_bad(void);
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- extern unsigned long __must_check ___copy_from_user(void *to,
- 						    const void __user *from,
-@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
--	unsigned long ret = ___copy_from_user(to, from, size);
-+	unsigned long ret;
- 
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(to, size, false);
-+
-+	ret = ___copy_from_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_from_user_fixup(to, from, size);
- 	return ret;
-@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
--	unsigned long ret = ___copy_to_user(to, from, size);
-+	unsigned long ret;
-+
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(from, size, true);
- 
-+	ret = ___copy_to_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_to_user_fixup(to, from, size);
- 	return ret;
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/iommu.c linux-2.6.32.12/arch/sparc/kernel/iommu.c
---- linux-2.6.32.12/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/iommu.c	2010-04-04 20:46:41.492578989 -0400
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- 	.alloc_coherent		= dma_4u_alloc_coherent,
- 	.free_coherent		= dma_4u_free_coherent,
- 	.map_page		= dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
- 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
- };
- 
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/ioport.c linux-2.6.32.12/arch/sparc/kernel/ioport.c
---- linux-2.6.32.12/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/ioport.c	2010-04-04 20:46:41.492578989 -0400
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
- 	BUG();
- }
- 
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- 	.alloc_coherent		= sbus_alloc_coherent,
- 	.free_coherent		= sbus_free_coherent,
- 	.map_page		= sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- 	.sync_sg_for_device	= sbus_sync_sg_for_device,
- };
- 
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
- 	}
- }
- 
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- 	.alloc_coherent		= pci32_alloc_coherent,
- 	.free_coherent		= pci32_free_coherent,
- 	.map_page		= pci32_map_page,
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/kgdb_32.c	2010-04-04 20:46:41.492578989 -0400
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x7d */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/kgdb_64.c	2010-04-04 20:46:41.492578989 -0400
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x72 */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/Makefile linux-2.6.32.12/arch/sparc/kernel/Makefile
---- linux-2.6.32.12/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/Makefile	2010-04-04 20:46:41.492578989 -0400
-@@ -3,7 +3,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- extra-y     := head_$(BITS).o
- extra-y     += init_task.o
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/pci_sun4v.c	2010-04-04 20:46:41.492578989 -0400
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- 	.alloc_coherent			= dma_4v_alloc_coherent,
- 	.free_coherent			= dma_4v_free_coherent,
- 	.map_page			= dma_4v_map_page,
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/sys_sparc_32.c	2010-04-04 20:46:41.492578989 -0400
-@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (ARCH_SUN4C && len > 0x20000000)
- 		return -ENOMEM;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (flags & MAP_SHARED)
- 		addr = COLOUR_ALIGN(addr);
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/sys_sparc_64.c	2010-04-04 20:46:41.492578989 -0400
-@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
- 	}
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
-+		start_addr = addr = mm->mmap_base;
- 	        mm->cached_hole_size = 0;
- 	}
- 
-@@ -175,8 +179,8 @@ full_search:
- 			vma = find_vma(mm, VA_EXCLUDE_END);
- 		}
- 		if (unlikely(task_size < addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
- 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- 	    sysctl_legacy_va_layout) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
-@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
- 			gap = (task_size / 6 * 5);
- 
- 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.12/arch/sparc/kernel/traps_64.c linux-2.6.32.12/arch/sparc/kernel/traps_64.c
---- linux-2.6.32.12/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/kernel/traps_64.c	2010-04-04 20:46:41.496772577 -0400
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
- 
- 	lvl -= 0x100;
- 	if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		if (lvl == 6)
-+			pax_report_refcount_overflow(regs);
-+#endif
-+
- 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- 		die_if_kernel(buffer, regs);
- 	}
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- 	char buffer[32];
--	
-+
- 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
- 		return;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (lvl == 6)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
- 
- 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-diff -urNp linux-2.6.32.12/arch/sparc/lib/atomic_64.S linux-2.6.32.12/arch/sparc/lib/atomic_64.S
---- linux-2.6.32.12/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/lib/atomic_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_add, .-atomic_add
- 
-+	.globl	atomic_add_unchecked
-+	.type	atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	add	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_add_unchecked, .-atomic_add_unchecked
-+
- 	.globl	atomic_sub
- 	.type	atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_sub, .-atomic_sub
- 
-+	.globl	atomic_sub_unchecked
-+	.type	atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	sub	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- 	.globl	atomic_add_ret
- 	.type	atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add, .-atomic64_add
- 
-+	.globl	atomic64_add_unchecked
-+	.type	atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- 	.globl	atomic64_sub
- 	.type	atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add_ret, .-atomic64_add_ret
- 
-+	.globl	atomic64_add_ret_unchecked
-+	.type	atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 add	%g7, %o0, %g7
-+	mov	%g7, %o0
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- 	.globl	atomic64_sub_ret
- 	.type	atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-diff -urNp linux-2.6.32.12/arch/sparc/lib/ksyms.c linux-2.6.32.12/arch/sparc/lib/ksyms.c
---- linux-2.6.32.12/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/lib/ksyms.c	2010-04-04 20:46:41.496772577 -0400
-@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
- 
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
- EXPORT_SYMBOL(atomic64_add_ret);
-diff -urNp linux-2.6.32.12/arch/sparc/lib/rwsem_64.S linux-2.6.32.12/arch/sparc/lib/rwsem_64.S
---- linux-2.6.32.12/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/lib/rwsem_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -11,7 +11,12 @@
- 	.globl		__down_read
- __down_read:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- 	.globl		__down_read_trylock
- __down_read_trylock:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cmp		%g7, 0
- 	bl,pn		%icc, 2f
- 	 mov		0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- 	cmp		%g3, 0
- 	bne,pn		%icc, 2f
- 	 mov		0, %o1
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- 	lduw		[%o0], %g1
--	sub		%g1, 1, %g7
-+	subcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-diff -urNp linux-2.6.32.12/arch/sparc/Makefile linux-2.6.32.12/arch/sparc/Makefile
---- linux-2.6.32.12/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/Makefile	2010-04-04 20:46:41.496772577 -0400
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
- 
-diff -urNp linux-2.6.32.12/arch/sparc/mm/fault_32.c linux-2.6.32.12/arch/sparc/mm/fault_32.c
---- linux-2.6.32.12/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/mm/fault_32.c	2010-04-04 20:46:41.496772577 -0400
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
- 	return safe_compute_effective_address(regs, insn);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->pc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned int addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->pc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned int addr;
-+
-+			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr, save, call;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			else
-+				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->pc = call_dl_resolve;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+				regs->pc = addr;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->pc-4));
-+		err |= get_user(call, (unsigned int *)regs->pc);
-+		err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+			regs->u_regs[UREG_RETPC] = regs->pc;
-+			regs->pc = dl_resolve;
-+			regs->npc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- 			       unsigned long address)
- {
-@@ -231,6 +495,24 @@ good_area:
- 		if(!(vma->vm_flags & VM_WRITE))
- 			goto bad_area;
- 	} else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		/* Allow reads even for write-only mappings */
- 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- 			goto bad_area;
-diff -urNp linux-2.6.32.12/arch/sparc/mm/fault_64.c linux-2.6.32.12/arch/sparc/mm/fault_64.c
---- linux-2.6.32.12/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/mm/fault_64.c	2010-04-04 20:46:41.496772577 -0400
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
- 	show_regs(regs);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned long addr;
-+
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #4 */
-+		unsigned int sethi, mov1, call, mov2;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    mov1 == 0x8210000FU &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    mov2 == 0x9E100001U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #5 */
-+		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    (or1 & 0xFFFFE000U) == 0x82106000U &&
-+		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+		    sllx == 0x83287020U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #6 */
-+		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    sllx == 0x83287020U &&
-+		    (or & 0xFFFFE000U) == 0x8A116000U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+			unsigned int save, call;
-+			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+			else
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->tpc = call_dl_resolve;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+				if (test_thread_flag(TIF_32BIT))
-+					addr &= 0xFFFFFFFFUL;
-+
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+
-+			/* PaX: 64-bit PLT stub */
-+			err = get_user(sethi1, (unsigned int *)addr);
-+			err |= get_user(sethi2, (unsigned int *)(addr+4));
-+			err |= get_user(or1, (unsigned int *)(addr+8));
-+			err |= get_user(or2, (unsigned int *)(addr+12));
-+			err |= get_user(sllx, (unsigned int *)(addr+16));
-+			err |= get_user(add, (unsigned int *)(addr+20));
-+			err |= get_user(jmpl, (unsigned int *)(addr+24));
-+			err |= get_user(nop, (unsigned int *)(addr+28));
-+			if (err)
-+				break;
-+
-+			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+			    (or1 & 0xFFFFE000U) == 0x88112000U &&
-+			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+			    sllx == 0x89293020U &&
-+			    add == 0x8A010005U &&
-+			    jmpl == 0x89C14000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+				regs->u_regs[UREG_G4] <<= 32;
-+				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+				regs->u_regs[UREG_G4] = addr + 24;
-+				addr = regs->u_regs[UREG_G5];
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->tpc-4));
-+		err |= get_user(call, (unsigned int *)regs->tpc);
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				dl_resolve &= 0xFFFFFFFFUL;
-+
-+			regs->u_regs[UREG_RETPC] = regs->tpc;
-+			regs->tpc = dl_resolve;
-+			regs->tnpc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (ba & 0xFFF00000U) == 0x30600000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- 	struct mm_struct *mm = current->mm;
-@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
- 	if (!vma)
- 		goto bad_area;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	/* PaX: detect ITLB misses on non-exec pages */
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+	{
-+		if (address != regs->tpc)
-+			goto good_area;
-+
-+		up_read(&mm->mmap_sem);
-+		switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+		case 2:
-+		case 3:
-+			return;
-+#endif
-+
-+		}
-+		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	/* Pure DTLB misses do not tell us whether the fault causing
- 	 * load/store/atomic was a write or not, it only says that there
- 	 * was no match.  So in such a case we (carefully) read the
-diff -urNp linux-2.6.32.12/arch/sparc/mm/init_32.c linux-2.6.32.12/arch/sparc/mm/init_32.c
---- linux-2.6.32.12/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/mm/init_32.c	2010-04-04 20:46:41.496772577 -0400
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
- 
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- 	switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
- 
- 	/* Initialize the protection map with non-constant, MMU dependent values. */
- 	protection_map[0] = PAGE_NONE;
--	protection_map[1] = PAGE_READONLY;
--	protection_map[2] = PAGE_COPY;
--	protection_map[3] = PAGE_COPY;
-+	protection_map[1] = PAGE_READONLY_NOEXEC;
-+	protection_map[2] = PAGE_COPY_NOEXEC;
-+	protection_map[3] = PAGE_COPY_NOEXEC;
- 	protection_map[4] = PAGE_READONLY;
- 	protection_map[5] = PAGE_READONLY;
- 	protection_map[6] = PAGE_COPY;
- 	protection_map[7] = PAGE_COPY;
- 	protection_map[8] = PAGE_NONE;
--	protection_map[9] = PAGE_READONLY;
--	protection_map[10] = PAGE_SHARED;
--	protection_map[11] = PAGE_SHARED;
-+	protection_map[9] = PAGE_READONLY_NOEXEC;
-+	protection_map[10] = PAGE_SHARED_NOEXEC;
-+	protection_map[11] = PAGE_SHARED_NOEXEC;
- 	protection_map[12] = PAGE_READONLY;
- 	protection_map[13] = PAGE_READONLY;
- 	protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.32.12/arch/sparc/mm/Makefile linux-2.6.32.12/arch/sparc/mm/Makefile
---- linux-2.6.32.12/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/mm/Makefile	2010-04-04 20:46:41.496772577 -0400
-@@ -2,7 +2,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
- obj-y                   += fault_$(BITS).o
-diff -urNp linux-2.6.32.12/arch/sparc/mm/srmmu.c linux-2.6.32.12/arch/sparc/mm/srmmu.c
---- linux-2.6.32.12/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/sparc/mm/srmmu.c	2010-04-04 20:46:41.496772577 -0400
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
- 
-diff -urNp linux-2.6.32.12/arch/um/include/asm/kmap_types.h linux-2.6.32.12/arch/um/include/asm/kmap_types.h
---- linux-2.6.32.12/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/um/include/asm/kmap_types.h	2010-04-04 20:46:41.496772577 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.12/arch/um/include/asm/page.h linux-2.6.32.12/arch/um/include/asm/page.h
---- linux-2.6.32.12/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/um/include/asm/page.h	2010-04-04 20:46:41.496772577 -0400
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK	(~(PAGE_SIZE-1))
- 
-+#define ktla_ktva(addr)			(addr)
-+#define ktva_ktla(addr)			(addr)
-+
- #ifndef __ASSEMBLY__
- 
- struct page;
-diff -urNp linux-2.6.32.12/arch/um/sys-i386/syscalls.c linux-2.6.32.12/arch/um/sys-i386/syscalls.c
---- linux-2.6.32.12/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/um/sys-i386/syscalls.c	2010-04-04 20:46:41.496772577 -0400
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-diff -urNp linux-2.6.32.12/arch/x86/boot/bitops.h linux-2.6.32.12/arch/x86/boot/bitops.h
---- linux-2.6.32.12/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/bitops.h	2010-04-04 20:46:41.496772577 -0400
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
- 	u8 v;
- 	const u32 *p = (const u32 *)addr;
- 
--	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- 	return v;
- }
- 
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
- 
- static inline void set_bit(int nr, void *addr)
- {
--	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
- 
- #endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.32.12/arch/x86/boot/boot.h linux-2.6.32.12/arch/x86/boot/boot.h
---- linux-2.6.32.12/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/boot.h	2010-04-04 20:46:41.496772577 -0400
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- 	u16 seg;
--	asm("movw %%ds,%0" : "=rm" (seg));
-+	asm volatile("movw %%ds,%0" : "=rm" (seg));
- 	return seg;
- }
- 
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- 	u8 diff;
--	asm("repe; cmpsb; setnz %0"
-+	asm volatile("repe; cmpsb; setnz %0"
- 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- 	return diff;
- }
-diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/head_32.S linux-2.6.32.12/arch/x86/boot/compressed/head_32.S
---- linux-2.6.32.12/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/compressed/head_32.S	2010-04-04 20:46:41.496772577 -0400
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl    %eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
-  * and where it was actually loaded.
-  */
- 	movl	%ebp, %ebx
--	subl	$LOAD_PHYSICAL_ADDR, %ebx
-+	subl	$____LOAD_PHYSICAL_ADDR, %ebx
- 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
- /*
-  * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
- 
- 1:	subl	$4, %edi
- 	movl	(%edi), %ecx
--	testl	%ecx, %ecx
--	jz	2f
-+	jecxz	2f
- 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
- 	jmp	1b
- 2:
-diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/head_64.S linux-2.6.32.12/arch/x86/boot/compressed/head_64.S
---- linux-2.6.32.12/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/compressed/head_64.S	2010-04-04 20:46:41.496772577 -0400
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl	%eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- 	notq	%rax
- 	andq	%rax, %rbp
- #else
--	movq	$LOAD_PHYSICAL_ADDR, %rbp
-+	movq	$____LOAD_PHYSICAL_ADDR, %rbp
- #endif
- 
- 	/* Target address to relocate to for decompression */
-diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/misc.c linux-2.6.32.12/arch/x86/boot/compressed/misc.c
---- linux-2.6.32.12/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/compressed/misc.c	2010-04-04 20:46:41.496772577 -0400
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- 		case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- 			dest = output;
--			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- 			dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
- 		error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
--	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- 		error("Wrong destination address");
- #endif
- 
-diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c
---- linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/compressed/mkpiggy.c	2010-04-04 20:46:41.496772577 -0400
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
- 
- 	offs = (olen > ilen) ? olen - ilen : 0;
- 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
--	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
-+	offs += 64*1024;	/* Add 64K bytes slack */
- 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
- 
- 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff -urNp linux-2.6.32.12/arch/x86/boot/compressed/relocs.c linux-2.6.32.12/arch/x86/boot/compressed/relocs.c
---- linux-2.6.32.12/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/compressed/relocs.c	2010-04-04 20:46:41.500459645 -0400
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
- 
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
- 
- static int is_safe_abs_reloc(const char* sym_name)
- {
--	int i;
-+	unsigned int i;
- 
- 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- 		if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
- 			if (sym->st_shndx == SHN_ABS) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
- 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
- 				/*
- 				 * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
-diff -urNp linux-2.6.32.12/arch/x86/boot/cpucheck.c linux-2.6.32.12/arch/x86/boot/cpucheck.c
---- linux-2.6.32.12/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/cpucheck.c	2010-04-04 20:46:41.500459645 -0400
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- 	u16 fcw = -1, fsw = -1;
- 	u32 cr0;
- 
--	asm("movl %%cr0,%0" : "=r" (cr0));
-+	asm volatile("movl %%cr0,%0" : "=r" (cr0));
- 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- 	u32 f0, f1;
- 
--	asm("pushfl ; "
-+	asm volatile("pushfl ; "
- 	    "pushfl ; "
- 	    "popl %0 ; "
- 	    "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- 		set_bit(X86_FEATURE_FPU, cpu.flags);
- 
- 	if (has_eflag(X86_EFLAGS_ID)) {
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_intel_level),
- 		      "=b" (cpu_vendor[0]),
- 		      "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
- 
- 		if (max_intel_level >= 0x00000001 &&
- 		    max_intel_level <= 0x0000ffff) {
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "=a" (tfms),
- 			      "=c" (cpu.flags[4]),
- 			      "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- 				cpu.model += ((tfms >> 16) & 0xf) << 4;
- 		}
- 
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_amd_level)
- 		    : "a" (0x80000000)
- 		    : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- 		if (max_amd_level >= 0x80000001 &&
- 		    max_amd_level <= 0x8000ffff) {
- 			u32 eax = 0x80000001;
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "+a" (eax),
- 			      "=c" (cpu.flags[6]),
- 			      "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_K7_HWCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax &= ~(1 << 15);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		get_flags();	/* Make sure it really did something */
- 		err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_VIA_FCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax |= (1<<1)|(1<<7);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		set_bit(X86_FEATURE_CX8, cpu.flags);
- 		err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 eax, edx;
- 		u32 level = 1;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
--		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
--		asm("cpuid"
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+		asm volatile("cpuid"
- 		    : "+a" (level), "=d" (cpu.flags[0])
- 		    : : "ecx", "ebx");
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		err = check_flags();
- 	}
-diff -urNp linux-2.6.32.12/arch/x86/boot/header.S linux-2.6.32.12/arch/x86/boot/header.S
---- linux-2.6.32.12/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/header.S	2010-04-04 20:46:41.500459645 -0400
-@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
- 						# single linked list of
- 						# struct setup_data
- 
--pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
-+pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
- 
- #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
- #define VO_INIT_SIZE	(VO__end - VO__text)
-diff -urNp linux-2.6.32.12/arch/x86/boot/memory.c linux-2.6.32.12/arch/x86/boot/memory.c
---- linux-2.6.32.12/arch/x86/boot/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/memory.c	2010-04-29 17:46:37.065247062 -0400
-@@ -19,7 +19,7 @@
- 
- static int detect_memory_e820(void)
- {
--	int count = 0;
-+	unsigned int count = 0;
- 	struct biosregs ireg, oreg;
- 	struct e820entry *desc = boot_params.e820_map;
- 	static struct e820entry buf; /* static so it is zeroed */
-diff -urNp linux-2.6.32.12/arch/x86/boot/video.c linux-2.6.32.12/arch/x86/boot/video.c
---- linux-2.6.32.12/arch/x86/boot/video.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/video.c	2010-04-29 17:46:37.069058404 -0400
-@@ -90,7 +90,7 @@ static void store_mode_params(void)
- static unsigned int get_entry(void)
- {
- 	char entry_buf[4];
--	int i, len = 0;
-+	unsigned int i, len = 0;
- 	int key;
- 	unsigned int v;
- 
-diff -urNp linux-2.6.32.12/arch/x86/boot/video-vesa.c linux-2.6.32.12/arch/x86/boot/video-vesa.c
---- linux-2.6.32.12/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/boot/video-vesa.c	2010-04-04 20:46:41.500459645 -0400
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
- 
- 	boot_params.screen_info.vesapm_seg = oreg.es;
- 	boot_params.screen_info.vesapm_off = oreg.di;
-+	boot_params.screen_info.vesapm_size = oreg.cx;
- }
- 
- /*
-diff -urNp linux-2.6.32.12/arch/x86/ia32/ia32entry.S linux-2.6.32.12/arch/x86/ia32/ia32entry.S
---- linux-2.6.32.12/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/ia32/ia32entry.S	2010-04-04 20:58:33.225084964 -0400
-@@ -13,6 +13,7 @@
- #include <asm/thread_info.h>	
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
-@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
- 	SWAPGS_UNSAFE_STACK
- 	movq	PER_CPU_VAR(kernel_stack), %rsp
- 	addq	$(KERNEL_STACK_OFFSET),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs, here we enable it straight after entry:
-@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
- 	SAVE_ARGS 0,0,1
-  	/* no need to do an access_ok check here because rbp has been
-  	   32bit zero extended */ 
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%rbp
-+#endif
-+
- 1:	movl	(%rbp),%ebp
-  	.section __ex_table,"a"
-  	.quad 1b,ia32_badarg
-@@ -166,6 +178,11 @@ sysenter_dispatch:
- 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz	sysexit_audit
- sysexit_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl    $~TS_COMPAT,TI_status(%r10)
- 	/* clear IF, that popfq doesn't enable interrupts early */
- 	andl  $~0x200,EFLAGS-R11(%rsp) 
-@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
- 	movl	%esp,%r8d
- 	CFI_REGISTER	rsp,r8
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
- 	/* no need to do an access_ok check here because r8 has been
- 	   32bit zero extended */ 
- 	/* hardware stack frame is complete now */	
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%r8
-+#endif
-+
- 1:	movl	(%r8),%r9d
- 	.section __ex_table,"a"
- 	.quad 1b,ia32_badarg
-@@ -327,6 +355,11 @@ cstar_dispatch:
- 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz sysretl_audit
- sysretl_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl $~TS_COMPAT,TI_status(%r10)
- 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- 	movl RIP-ARGOFFSET(%rsp),%ecx
-@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
- 	CFI_REL_OFFSET	rip,RIP-RIP
- 	PARAVIRT_ADJUST_EXCEPTION_FRAME
- 	SWAPGS
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-diff -urNp linux-2.6.32.12/arch/x86/ia32/ia32_signal.c linux-2.6.32.12/arch/x86/ia32/ia32_signal.c
---- linux-2.6.32.12/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/ia32/ia32_signal.c	2010-04-04 20:46:41.500459645 -0400
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
- 	sp -= frame_size;
- 	/* Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- 	return (void __user *) sp;
- }
- 
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
- 		0xb8,
- 		__NR_ia32_rt_sigreturn,
- 		0x80cd,
--		0,
-+		0
- 	};
- 
- 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/alternative.h linux-2.6.32.12/arch/x86/include/asm/alternative.h
---- linux-2.6.32.12/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/alternative.h	2010-04-04 20:46:41.500459645 -0400
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
-       "	 .byte 662b-661b\n"			/* sourcelen       */	\
-       "	 .byte 664f-663f\n"			/* replacementlen  */	\
-       ".previous\n"							\
--      ".section .altinstr_replacement, \"ax\"\n"			\
-+      ".section .altinstr_replacement, \"a\"\n"			\
-       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
-       ".previous"
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/apm.h linux-2.6.32.12/arch/x86/include/asm/apm.h
---- linux-2.6.32.12/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/apm.h	2010-04-04 20:46:41.500459645 -0400
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%al\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%bl\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/atomic_32.h linux-2.6.32.12/arch/x86/include/asm/atomic_32.h
---- linux-2.6.32.12/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/atomic_32.h	2010-04-04 20:46:41.500459645 -0400
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "+m" (v->counter));
- }
- 
-@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (v->counter));
- }
- 
-@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+	local_irq_save(flags);
-+	__i = atomic_read(v);
-+	atomic_set(v, i + __i);
-+	local_irq_restore(flags);
-+	return i + __i;
-+#endif
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	int __i;
-+#ifdef CONFIG_M386
-+	unsigned long flags;
-+	if (unlikely(boot_cpu_data.x86 <= 3))
-+		goto no_xadd;
-+#endif
-+	/* Modern 486+ processor */
-+	__i = i;
- 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
-@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "into\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
- 
- #define atomic_inc_return(v)  (atomic_add_return(1, v))
-+#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
- #define atomic_dec_return(v)  (atomic_sub_return(1, v))
- 
- /* These are x86-specific, used by some header files */
-@@ -266,6 +461,14 @@ typedef struct {
- 	u64 __aligned(8) counter;
- } atomic64_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val)	{ (val) }
- 
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/atomic_64.h linux-2.6.32.12/arch/x86/include/asm/atomic_64.h
---- linux-2.6.32.12/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/atomic_64.h	2010-04-04 20:46:41.500459645 -0400
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- 	int __i = i;
--	asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
- }
- 
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic64_set - set atomic64 variable
-  * @v: pointer to type atomic64_t
-  * @i: required value
-@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
- }
- 
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic64_add - add integer to atomic64 variable
-  * @i: integer value to add
-  * @v: pointer to type atomic64_t
-@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
-  */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "addq %1,%0"
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
-@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
-  */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "subq %1,%0"
-+	asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
-  */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "incq %0"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
-@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
-  */
- static inline void atomic64_dec(atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "decq %0"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- 	long __i = i;
--	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movq %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+	long __i = i;
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
- }
- 
- #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
-+#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
- #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
- 
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
-  */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "er" (a));
-+
-+		old = atomic64_cmpxchg((v), c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- /**
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/boot.h linux-2.6.32.12/arch/x86/include/asm/boot.h
---- linux-2.6.32.12/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/boot.h	2010-04-04 20:46:41.500459645 -0400
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
- 
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
- 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
- 
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/cacheflush.h linux-2.6.32.12/arch/x86/include/asm/cacheflush.h
---- linux-2.6.32.12/arch/x86/include/asm/cacheflush.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/cacheflush.h	2010-04-29 17:46:37.069058404 -0400
-@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
- static inline unsigned long get_page_memtype(struct page *pg)
- {
- 	if (!PageUncached(pg) && !PageWC(pg))
--		return -1;
-+		return ~0UL;
- 	else if (!PageUncached(pg) && PageWC(pg))
- 		return _PAGE_CACHE_WC;
- 	else if (PageUncached(pg) && !PageWC(pg))
-@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
- 		SetPageWC(pg);
- 		break;
- 	default:
--	case -1:
-+	case ~0UL:
- 		ClearPageUncached(pg);
- 		ClearPageWC(pg);
- 		break;
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/cache.h linux-2.6.32.12/arch/x86/include/asm/cache.h
---- linux-2.6.32.12/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/cache.h	2010-04-04 20:46:41.500459645 -0400
-@@ -8,6 +8,7 @@
- #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
- 
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
- 
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/checksum_32.h linux-2.6.32.12/arch/x86/include/asm/checksum_32.h
---- linux-2.6.32.12/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/checksum_32.h	2010-04-04 20:46:41.500459645 -0400
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
- 					    int len, __wsum sum,
- 					    int *src_err_ptr, int *dst_err_ptr);
- 
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
- /*
-  *	Note: when you get a NULL pointer exception here this means someone
-  *	passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
- 						 int *err_ptr)
- {
- 	might_sleep();
--	return csum_partial_copy_generic((__force void *)src, dst,
-+	return csum_partial_copy_generic_from_user((__force void *)src, dst,
- 					 len, sum, err_ptr, NULL);
- }
- 
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
- {
- 	might_sleep();
- 	if (access_ok(VERIFY_WRITE, dst, len))
--		return csum_partial_copy_generic(src, (__force void *)dst,
-+		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- 						 len, sum, NULL, err_ptr);
- 
- 	if (len)
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/desc.h linux-2.6.32.12/arch/x86/include/asm/desc.h
---- linux-2.6.32.12/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/desc.h	2010-04-29 17:46:36.819981711 -0400
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
- 
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
- 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- 	desc->type = (info->read_exec_only ^ 1) << 1;
- 	desc->type |= info->contents << 2;
-+	desc->type |= info->seg_not_present ^ 1;
- 	desc->s = 1;
- 	desc->dpl = 0x3;
- 	desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
- }
- 
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
--	struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
- 
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
--	return per_cpu(gdt_page, cpu).gdt;
-+	return cpu_gdt_table[cpu];
- }
- 
- #ifdef CONFIG_X86_64
-@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- 					  const gate_desc *gate)
- {
-+	pax_open_kernel();
- 	memcpy(&idt[entry], gate, sizeof(*gate));
-+	pax_close_kernel();
- }
- 
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- 					  const void *desc)
- {
-+	pax_open_kernel();
- 	memcpy(&ldt[entry], desc, 8);
-+	pax_close_kernel();
- }
- 
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- 					  const void *desc, int type)
- {
- 	unsigned int size;
-+
- 	switch (type) {
- 	case DESC_TSS:
- 		size = sizeof(tss_desc);
-@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
- 		size = sizeof(struct desc_struct);
- 		break;
- 	}
-+
-+	pax_open_kernel();
- 	memcpy(&gdt[entry], desc, size);
-+	pax_close_kernel();
- }
- 
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
- 
- static inline void native_load_tr_desc(void)
- {
-+	pax_open_kernel();
- 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+	pax_close_kernel();
- }
- 
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
- 	unsigned int i;
- 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
- 
-+	pax_open_kernel();
- 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+	pax_close_kernel();
- }
- 
- #define _LDT_empty(info)				\
-@@ -309,7 +319,7 @@ static inline void set_desc_limit(struct
- 	desc->limit = (limit >> 16) & 0xf;
- }
- 
--static inline void _set_gate(int gate, unsigned type, void *addr,
-+static inline void _set_gate(int gate, unsigned type, const void *addr,
- 			     unsigned dpl, unsigned ist, unsigned seg)
- {
- 	gate_desc s;
-@@ -327,7 +337,7 @@ static inline void _set_gate(int gate, u
-  * Pentium F0 0F bugfix can have resulted in the mapped
-  * IDT being write-protected.
-  */
--static inline void set_intr_gate(unsigned int n, void *addr)
-+static inline void set_intr_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +366,19 @@ static inline void alloc_intr_gate(unsig
- /*
-  * This routine sets up an interrupt gate at directory privilege level 3.
-  */
--static inline void set_system_intr_gate(unsigned int n, void *addr)
-+static inline void set_system_intr_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
- }
- 
--static inline void set_system_trap_gate(unsigned int n, void *addr)
-+static inline void set_system_trap_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
- }
- 
--static inline void set_trap_gate(unsigned int n, void *addr)
-+static inline void set_trap_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +387,31 @@ static inline void set_trap_gate(unsigne
- static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
- {
- 	BUG_ON((unsigned)n > 0xFF);
--	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
-+	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
- }
- 
--static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
- }
- 
--static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
- 
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+	struct desc_struct d;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/device.h linux-2.6.32.12/arch/x86/include/asm/device.h
---- linux-2.6.32.12/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/device.h	2010-04-04 20:46:41.500459645 -0400
-@@ -6,7 +6,7 @@ struct dev_archdata {
- 	void	*acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+	const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- 	void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/dma-mapping.h	2010-04-04 20:46:41.500459645 -0400
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- 	return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	if (ops->mapping_error)
- 		return ops->mapping_error(dev, dma_addr);
- 
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- 		gfp_t gfp)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *memory;
- 
- 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *vaddr, dma_addr_t bus)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	WARN_ON(irqs_disabled());       /* for portability */
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/e820.h linux-2.6.32.12/arch/x86/include/asm/e820.h
---- linux-2.6.32.12/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/e820.h	2010-04-04 20:46:41.500459645 -0400
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
- #define ISA_END_ADDRESS		0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
- 
--#define BIOS_BEGIN		0x000a0000
-+#define BIOS_BEGIN		0x000c0000
- #define BIOS_END		0x00100000
- 
- #ifdef __KERNEL__
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/elf.h linux-2.6.32.12/arch/x86/include/asm/elf.h
---- linux-2.6.32.12/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/elf.h	2010-04-04 20:58:33.220592413 -0400
-@@ -257,7 +257,25 @@ extern int force_personality32;
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE	0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE	0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-@@ -311,8 +329,7 @@ do {									\
- #define ARCH_DLINFO							\
- do {									\
- 	if (vdso_enabled)						\
--		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
--			    (unsigned long)current->mm->context.vdso);	\
-+		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
- } while (0)
- 
- #define AT_SYSINFO		32
-@@ -323,7 +340,7 @@ do {									\
- 
- #endif /* !CONFIG_X86_32 */
- 
--#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
- 
- #define VDSO_ENTRY							\
- 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages	syscall32_setup_pages
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/futex.h linux-2.6.32.12/arch/x86/include/asm/futex.h
---- linux-2.6.32.12/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/futex.h	2010-04-04 20:58:33.220592413 -0400
-@@ -11,17 +11,54 @@
- #include <asm/processor.h>
- #include <asm/system.h>
- 
-+#ifdef CONFIG_X86_32
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile(						\
-+		     "movw\t%w6, %%ds\n"			\
-+		     "1:\t" insn "\n"				\
-+		     "2:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%ds\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "3:\tmov\t%3, %1\n"			\
-+		     "\tjmp\t2b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 3b)			\
-+		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
-+
-+#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile("movw\t%w7, %%es\n"			\
-+		     "1:\tmovl\t%%es:%2, %0\n"			\
-+		     "\tmovl\t%0, %3\n"				\
-+		     "\t" insn "\n"				\
-+		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
-+		     "\tjnz\t1b\n"				\
-+		     "3:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%es\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "4:\tmov\t%5, %1\n"			\
-+		     "\tjmp\t3b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 4b)			\
-+		     _ASM_EXTABLE(2b, 4b)			\
-+		     : "=&a" (oldval), "=&r" (ret),		\
-+		       "+m" (*uaddr), "=&r" (tem)		\
-+		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
-+#else
-+#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\t" insn "\n"				\
- 		     "2:\t.section .fixup,\"ax\"\n"		\
- 		     "3:\tmov\t%3, %1\n"			\
- 		     "\tjmp\t2b\n"				\
- 		     "\t.previous\n"				\
- 		     _ASM_EXTABLE(1b, 3b)			\
--		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "=r" (oldval), "=r" (ret),		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
- 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
- 
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\tmovl	%2, %0\n"			\
- 		     "\tmovl\t%0, %3\n"				\
- 		     "\t" insn "\n"				\
-@@ -34,10 +71,12 @@
- 		     _ASM_EXTABLE(1b, 4b)			\
- 		     _ASM_EXTABLE(2b, 4b)			\
- 		     : "=&a" (oldval), "=&r" (ret),		\
--		       "+m" (*uaddr), "=&r" (tem)		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
-+		       "=&r" (tem)				\
- 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
-+#endif
- 
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
- 
- 	switch (op) {
- 	case FUTEX_OP_SET:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
-+#else
- 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_ADD:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
-+				   uaddr, oparg);
-+#else
- 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
- 				   uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_OR:
- 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
-@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
- 	return ret;
- }
- 
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- 						int newval)
- {
- 
-@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
- 		return -ENOSYS;
- #endif
- 
--	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- 		return -EFAULT;
- 
--	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
--		     "2:\t.section .fixup, \"ax\"\n"
-+	asm volatile(
-+#ifdef CONFIG_X86_32
-+		     "\tmovw %w5, %%ds\n"
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
-+		     "2:\tpushl   %%ss\n"
-+		     "\tpopl    %%ds\n"
-+#else
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+		     "2:\n"
-+#endif
-+		     "\t.section .fixup, \"ax\"\n"
- 		     "3:\tmov     %2, %0\n"
- 		     "\tjmp     2b\n"
- 		     "\t.previous\n"
- 		     _ASM_EXTABLE(1b, 3b)
-+#ifdef CONFIG_X86_32
- 		     : "=a" (oldval), "+m" (*uaddr)
-+		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
-+#else
-+		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
- 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
-+#endif
- 		     : "memory"
- 	);
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/i387.h linux-2.6.32.12/arch/x86/include/asm/i387.h
---- linux-2.6.32.12/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/i387.h	2010-04-04 20:58:33.220592413 -0400
-@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
- }
- 
- /* We need a safe address that is cheap to find and that is already
--   in L1 during context switch. The best choices are unfortunately
--   different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+   in L1 during context switch. */
-+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
- 
- /*
-  * These must be called with preempt disabled
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/io_64.h linux-2.6.32.12/arch/x86/include/asm/io_64.h
---- linux-2.6.32.12/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/io_64.h	2010-04-04 20:46:41.500459645 -0400
-@@ -140,6 +140,17 @@ __OUTS(l)
- 
- #include <linux/vmalloc.h>
- 
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
- 
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/iommu.h linux-2.6.32.12/arch/x86/include/asm/iommu.h
---- linux-2.6.32.12/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/iommu.h	2010-04-04 20:46:41.500459645 -0400
-@@ -3,7 +3,7 @@
- 
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/irqflags.h linux-2.6.32.12/arch/x86/include/asm/irqflags.h
---- linux-2.6.32.12/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/irqflags.h	2010-04-07 19:33:06.601891934 -0400
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
- 	sti;					\
- 	sysexit
- 
-+#define GET_CR0_INTO_RDI		mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0		mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI		mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3		mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN		iret
- #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/kvm_host.h linux-2.6.32.12/arch/x86/include/asm/kvm_host.h
---- linux-2.6.32.12/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:37.497949072 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:57.941485514 -0400
-@@ -532,7 +532,7 @@ struct kvm_x86_ops {
- 	const struct trace_print_flags *exit_reasons_str;
- };
- 
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
- 
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/local.h linux-2.6.32.12/arch/x86/include/asm/local.h
---- linux-2.6.32.12/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/local.h	2010-04-04 20:46:41.500459645 -0400
-@@ -18,26 +18,90 @@ typedef struct {
- 
- static inline void local_inc(local_t *l)
- {
--	asm volatile(_ASM_INC "%0"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_dec(local_t *l)
- {
--	asm volatile(_ASM_DEC "%0"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_add(long i, local_t *l)
- {
--	asm volatile(_ASM_ADD "%1,%0"
-+	asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
- 
- static inline void local_sub(long i, local_t *l)
- {
--	asm volatile(_ASM_SUB "%1,%0"
-+	asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
-@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_SUB "%2,%0; sete %1"
-+	asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_DEC "%0; sete %1"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_INC "%0; sete %1"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_ADD "%2,%0; sets %1"
-+	asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -133,7 +265,23 @@ static inline long local_add_return(long
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
--	asm volatile(_ASM_XADD "%0, %1;"
-+	asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_MOV "%0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (i), "+m" (l->a.counter)
- 		     : : "memory");
- 	return i + __i;
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h
---- linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/mc146818rtc.h	2010-04-29 17:46:37.069058404 -0400
-@@ -81,8 +81,8 @@ static inline unsigned char current_lock
- #else
- #define lock_cmos_prefix(reg) do {} while (0)
- #define lock_cmos_suffix(reg) do {} while (0)
--#define lock_cmos(reg)
--#define unlock_cmos()
-+#define lock_cmos(reg) do {} while (0)
-+#define unlock_cmos() do {} while (0)
- #define do_i_have_lock_cmos() 0
- #define current_lock_cmos_reg() 0
- #endif
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/microcode.h linux-2.6.32.12/arch/x86/include/asm/microcode.h
---- linux-2.6.32.12/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/microcode.h	2010-04-04 20:46:41.500459645 -0400
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
- 
- struct microcode_ops {
--	enum ucode_state (*request_microcode_user) (int cpu,
-+	enum ucode_state (* const request_microcode_user) (int cpu,
- 				const void __user *buf, size_t size);
- 
--	enum ucode_state (*request_microcode_fw) (int cpu,
-+	enum ucode_state (* const request_microcode_fw) (int cpu,
- 				struct device *device);
- 
--	void (*microcode_fini_cpu) (int cpu);
-+	void (* const microcode_fini_cpu) (int cpu);
- 
- 	/*
- 	 * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
- 
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
- 
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return NULL;
- }
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/mman.h linux-2.6.32.12/arch/x86/include/asm/mman.h
---- linux-2.6.32.12/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/mman.h	2010-04-04 20:46:41.500459645 -0400
-@@ -5,4 +5,14 @@
- 
- #include <asm-generic/mman.h>
- 
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check	i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+		unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/mmu_context.h linux-2.6.32.12/arch/x86/include/asm/mmu_context.h
---- linux-2.6.32.12/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/mmu_context.h	2010-04-29 17:46:36.829235058 -0400
-@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
- 
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	unsigned int i;
-+	pgd_t *pgd;
-+
-+	pax_open_kernel();
-+	pgd = get_cpu_pgd(smp_processor_id());
-+	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+		if (paravirt_enabled())
-+			set_pgd(pgd+i, native_make_pgd(0));
-+		else
-+			pgd[i] = native_make_pgd(0);
-+	pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,27 +49,70 @@ static inline void switch_mm(struct mm_s
- 			     struct task_struct *tsk)
- {
- 	unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
-+	int tlbstate = TLBSTATE_OK;
-+#endif
- 
- 	if (likely(prev != next)) {
- 		/* stop flush ipis for the previous mm */
- 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
- #ifdef CONFIG_SMP
-+#ifdef CONFIG_X86_32
-+		tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- 		cpumask_set_cpu(cpu, mm_cpumask(next));
- 
- 		/* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#else
- 		load_cr3(next->pgd);
-+#endif
- 
- 		/*
- 		 * load the LDT, if the LDT is different:
- 		 */
- 		if (unlikely(prev->context.ldt != next->context.ldt))
- 			load_LDT_nolock(&next->context);
--	}
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		if (!nx_enabled) {
-+			smp_mb__before_clear_bit();
-+			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+			smp_mb__after_clear_bit();
-+			cpu_set(cpu, next->context.cpu_user_cs_mask);
-+		}
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+			     prev->context.user_cs_limit != next->context.user_cs_limit))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
- #ifdef CONFIG_SMP
-+		else if (unlikely(tlbstate != TLBSTATE_OK))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
-+	}
- 	else {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
-+#ifdef CONFIG_SMP
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
- 
-@@ -63,11 +121,28 @@ static inline void switch_mm(struct mm_s
- 			 * tlb flush IPI delivery. We must reload CR3
- 			 * to make sure to use no freed page tables.
- 			 */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 			load_cr3(next->pgd);
-+#endif
-+
- 			load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+			if (!nx_enabled)
-+				cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- 		}
--	}
- #endif
-+	}
- }
- 
- #define activate_mm(prev, next)			\
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/mmu.h linux-2.6.32.12/arch/x86/include/asm/mmu.h
---- linux-2.6.32.12/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/mmu.h	2010-04-04 20:46:41.500459645 -0400
-@@ -9,10 +9,23 @@
-  * we put the segment information here.
-  */
- typedef struct {
--	void *ldt;
-+	struct desc_struct *ldt;
- 	int size;
- 	struct mutex lock;
--	void *vdso;
-+	unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	unsigned long user_cs_base;
-+	unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+	cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/module.h linux-2.6.32.12/arch/x86/include/asm/module.h
---- linux-2.6.32.12/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/module.h	2010-04-04 21:01:05.305858196 -0400
-@@ -59,13 +59,31 @@
- #error unknown processor family
- #endif
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
- #ifdef CONFIG_X86_32
- # ifdef CONFIG_4KSTACKS
- #  define MODULE_STACKSIZE "4KSTACKS "
- # else
- #  define MODULE_STACKSIZE ""
- # endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+# ifdef CONFIG_PAX_KERNEXEC
-+#  define MODULE_PAX_KERNEXEC "KERNEXEC "
-+# else
-+#  define MODULE_PAX_KERNEXEC ""
-+# endif
-+# ifdef CONFIG_GRKERNSEC
-+#  define MODULE_GRSEC "GRSECURITY "
-+# else
-+#  define MODULE_GRSEC ""
-+# endif
-+# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
-+#else
-+# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
- #endif
- 
- #endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/page_32_types.h linux-2.6.32.12/arch/x86/include/asm/page_32_types.h
---- linux-2.6.32.12/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/page_32_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -15,6 +15,10 @@
-  */
- #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
-+#endif
-+
- #ifdef CONFIG_4KSTACKS
- #define THREAD_ORDER	0
- #else
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/page_64_types.h linux-2.6.32.12/arch/x86/include/asm/page_64_types.h
---- linux-2.6.32.12/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/page_64_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -39,6 +39,9 @@
- #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
- #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
- #define __PHYSICAL_MASK_SHIFT	46
- #define __VIRTUAL_MASK_SHIFT	47
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/paravirt.h linux-2.6.32.12/arch/x86/include/asm/paravirt.h
---- linux-2.6.32.12/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/paravirt.h	2010-04-07 16:58:23.343008831 -0400
-@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
- 	pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+	return pv_mmu_ops.pax_open_kernel();
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+	return pv_mmu_ops.pax_close_kernel();
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
- 
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +960,7 @@ extern void default_banner(void);
- 
- #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr)	*%cs:addr
-+#define PARA_INDIRECT(addr)	*%ss:addr
- #endif
- 
- #define INTERRUPT_RETURN						\
-@@ -1022,6 +1037,21 @@ extern void default_banner(void);
- 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
- 		  CLBR_NONE,						\
- 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif	/* CONFIG_X86_32 */
- 
- #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/paravirt_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -316,6 +316,12 @@ struct pv_mmu_ops {
- 	   an mfn.  We can tell which is which from the index. */
- 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- 			   phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	unsigned long (*pax_open_kernel)(void);
-+	unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
- 
- struct raw_spinlock;
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pci_x86.h linux-2.6.32.12/arch/x86/include/asm/pci_x86.h
---- linux-2.6.32.12/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pci_x86.h	2010-04-04 20:46:41.505526780 -0400
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
- 
- struct pci_raw_ops {
--	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val);
--	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 val);
- };
- 
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
- 
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
- 
- /* arch_initcall level */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgalloc.h linux-2.6.32.12/arch/x86/include/asm/pgalloc.h
---- linux-2.6.32.12/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgalloc.h	2010-04-04 20:46:41.505526780 -0400
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
- 				       pmd_t *pmd, pte_t *pte)
- {
- 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+				       pmd_t *pmd, pte_t *pte)
-+{
-+	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable-2level.h	2010-04-04 20:46:41.505526780 -0400
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable_32.h	2010-04-04 20:46:41.505526780 -0400
-@@ -26,8 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
- 
--extern pgd_t swapper_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
- # include <asm/pgtable-2level.h>
- #endif
- 
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE			\
- 	(in_nmi() ? KM_NMI_PTE : 	\
-@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr)		\
- do {						\
-+	pax_open_kernel();			\
- 	pte_clear(&init_mm, (vaddr), (ptep));	\
-+	pax_close_kernel();			\
- 	__flush_tlb_one((vaddr));		\
- } while (0)
- 
-@@ -84,6 +89,9 @@ do {						\
- 
- #endif /* !__ASSEMBLY__ */
- 
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
-  * kern_addr_valid() is (1) for FLATMEM and (0) for
-  * SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable_32_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -8,7 +8,7 @@
-  */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE	(1UL << PMD_SHIFT)
-+# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK	(~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
- # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+#endif
-+
- #define MODULES_VADDR	VMALLOC_START
- #define MODULES_END	VMALLOC_END
- #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable-3level.h	2010-04-04 20:46:41.505526780 -0400
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+	pax_close_kernel();
- }
- 
- /*
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable_64.h	2010-04-04 20:58:33.220592413 -0400
-@@ -16,10 +16,13 @@
- 
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
- 
- #define swapper_pg_dir init_level4_pgt
- 
-@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
- 
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+	pax_open_kernel();
- 	*pgdp = pgd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pgd_clear(pgd_t *pgd)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	native_set_pgd(pgd, native_make_pgd(0));
-+#endif
-+
- }
- 
- /*
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable.h linux-2.6.32.12/arch/x86/include/asm/pgtable.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable.h	2010-04-04 20:58:33.220592413 -0400
-@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
- 
- #define arch_end_context_switch(prev)	do {} while(0)
- 
-+#define pax_open_kernel()	native_pax_open_kernel()
-+#define pax_close_kernel()	native_pax_close_kernel()
- #endif	/* CONFIG_PARAVIRT */
- 
-+#define  __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	preempt_disable();
-+	barrier();
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(cr0 & X86_CR0_WP));
-+	write_cr0(cr0);
-+	return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
-+	write_cr0(cr0);
-+	barrier();
-+	preempt_enable_no_resched();
-+	return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
-  * The following only work if pte_present() is true.
-  * Undefined behaviour if not..
-  */
-+static inline int pte_user(pte_t pte)
-+{
-+	return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- 	return pte_flags(pte) & _PAGE_DIRTY;
-@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
- 	return pte_clear_flags(pte, _PAGE_RW);
- }
- 
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+	return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
--	return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_clear_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_set_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_clear_flags(pte, _PAGE_USER);
- }
- 
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
- #endif
- 
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+	return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
- 
- static inline int pte_none(pte_t pte)
-@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
- 
- static inline int pgd_bad(pgd_t pgd)
- {
--	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
- 
- static inline int pgd_none(pgd_t pgd)
-@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
-  * pgd_offset() returns a (pgd_t *)
-  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
-  */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
-  * a shortcut which implies the use of the kernel's pgd, instead
-  * of a process's
-@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
- 
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
- 
- extern int direct_gbpages;
-@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
-  * dst and src can be on the same page, but the range must not overlap,
-  * and must not cross a page boundary.
-  */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
--       memcpy(dst, src, count * sizeof(pgd_t));
-+	pax_open_kernel();
-+	while (count--)
-+		*dst++ = *src++;
-+	pax_close_kernel();
- }
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+#endif
- 
- #include <asm-generic/pgtable.h>
- #endif	/* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/pgtable_types.h	2010-04-04 20:46:41.505526780 -0400
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT		7	/* on 4KB pages */
- #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
-+#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
- 
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
- 
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX	(_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
- 
- #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
- 					 _PAGE_ACCESSED)
- 
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC						\
- 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
-  * bits are combined, this will alow user to access the high address mapped
-  * VDSO in the presence of CONFIG_COMPAT_VDSO
-  */
--#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
--#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
- #endif
- 
-@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
- 
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
- 
- #define pgprot_writecombine	pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/processor.h linux-2.6.32.12/arch/x86/include/asm/processor.h
---- linux-2.6.32.12/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/processor.h	2010-04-04 20:58:33.220592413 -0400
-@@ -272,7 +272,7 @@ struct tss_struct {
- 
- } ____cacheline_aligned;
- 
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
- 
- /*
-  * Save the original ist values for checking stack pointers during debugging
-@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
-  */
- #define TASK_SIZE		PAGE_OFFSET
- #define TASK_SIZE_MAX		TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
-+#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP		TASK_SIZE
--#define STACK_TOP_MAX		STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX		TASK_SIZE
- 
- #define INIT_THREAD  {							  \
- 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
-@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
-  */
- #define INIT_TSS  {							  \
- 	.x86_tss = {							  \
--		.sp0		= sizeof(init_stack) + (long)&init_stack, \
-+		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
- 		.ss0		= __KERNEL_DS,				  \
- 		.ss1		= __KERNEL_CS,				  \
- 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
-@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
- 
- #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info)                                                 \
--({                                                                     \
--       unsigned long *__ptr = (unsigned long *)(info);                 \
--       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
--})
-+#define KSTK_TOP(info)         ((info)->task.thread.sp0)
- 
- /*
-  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
- #define task_pt_regs(task)                                             \
- ({                                                                     \
-        struct pt_regs *__regs__;                                       \
--       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
-        __regs__ - 1;                                                   \
- })
- 
-@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
- /*
-  * User space process size. 47bits minus one guard page.
-  */
--#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
- 
- /* This decides where the kernel will search for a free chunk of vm
-  * space during mmap's.
-  */
- #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
--					0xc0000000 : 0xFFFFe000)
-+					0xc0000000 : 0xFFFFf000)
- 
- #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
- 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
-  */
- #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
- 
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/ptrace.h linux-2.6.32.12/arch/x86/include/asm/ptrace.h
---- linux-2.6.32.12/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/ptrace.h	2010-04-04 20:46:41.505526780 -0400
-@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
- }
- 
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
-  * This is true if V8086 mode was enabled OR if the register set was from
-  * protected mode with RPL-3 CS value.  This tricky test checks that with
-  * one comparison.  Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
-  */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
--	return !!(regs->cs & 3);
-+	return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
- 
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- 		USER_RPL;
- #else
--	return user_mode(regs);
-+	return user_mode_novm(regs);
- #endif
- }
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/reboot.h linux-2.6.32.12/arch/x86/include/asm/reboot.h
---- linux-2.6.32.12/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/reboot.h	2010-04-04 20:46:41.505526780 -0400
-@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
- 
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void machine_real_restart(const unsigned char *code, unsigned int length);
- 
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/rwsem.h linux-2.6.32.12/arch/x86/include/asm/rwsem.h
---- linux-2.6.32.12/arch/x86/include/asm/rwsem.h	2010-04-29 17:49:37.501451369 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/rwsem.h	2010-04-29 20:01:51.893191958 -0400
-@@ -118,10 +118,26 @@ static inline void __down_read(struct rw
- {
- 	asm volatile("# beginning down_read\n\t"
- 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* adds 0x00000001, returns the old value */
--		     "  jns        1f\n"
-+		     "  jns        2f\n"
- 		     "  call call_rwsem_down_read_failed\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending down_read\n\t"
- 		     : "+m" (sem->count)
- 		     : "a" (sem)
-@@ -136,13 +152,29 @@ static inline int __down_read_trylock(st
- 	rwsem_count_t result, tmp;
- 	asm volatile("# beginning __down_read_trylock\n\t"
- 		     "  mov          %0,%1\n\t"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "  mov          %1,%2\n\t"
- 		     "  add          %3,%2\n\t"
--		     "  jle	     2f\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "sub %3,%2\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "  jle	     3f\n\t"
- 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
--		     "  jnz	     1b\n\t"
--		     "2:\n\t"
-+		     "  jnz	     2b\n\t"
-+		     "3:\n\t"
- 		     "# ending __down_read_trylock\n\t"
- 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
- 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
-@@ -160,12 +192,28 @@ static inline void __down_write_nested(s
- 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
- 	asm volatile("# beginning down_write\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtract 0x0000ffff, returns the old value */
- 		     "  test      %1,%1\n\t"
- 		     /* was the count 0 before? */
--		     "  jz        1f\n"
-+		     "  jz        2f\n"
- 		     "  call call_rwsem_down_write_failed\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending down_write"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -198,10 +246,26 @@ static inline void __up_read(struct rw_s
- 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
- 	asm volatile("# beginning __up_read\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtracts 1, returns the old value */
--		     "  jns        1f\n\t"
-+		     "  jns        2f\n\t"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending __up_read\n"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -216,11 +280,27 @@ static inline void __up_write(struct rw_
- 	rwsem_count_t tmp;
- 	asm volatile("# beginning __up_write\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* tries to transition
- 			0xffff0001 -> 0x00000000 */
--		     "  jz       1f\n"
-+		     "  jz       2f\n"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __up_write\n"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (-RWSEM_ACTIVE_WRITE_BIAS)
-@@ -234,13 +314,29 @@ static inline void __downgrade_write(str
- {
- 	asm volatile("# beginning __downgrade_write\n\t"
- 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /*
- 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
- 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
- 		      */
--		     "  jns       1f\n\t"
-+		     "  jns       2f\n\t"
- 		     "  call call_rwsem_downgrade_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __downgrade_write\n"
- 		     : "+m" (sem->count)
- 		     : "a" (sem), "er" (-RWSEM_WAITING_BIAS)
-@@ -253,7 +349,23 @@ static inline void __downgrade_write(str
- static inline void rwsem_atomic_add(rwsem_count_t delta,
- 				    struct rw_semaphore *sem)
- {
--	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
-+	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (sem->count)
- 		     : "er" (delta));
- }
-@@ -266,7 +378,23 @@ static inline rwsem_count_t rwsem_atomic
- {
- 	rwsem_count_t tmp = delta;
- 
--	asm volatile(LOCK_PREFIX "xadd %0,%1"
-+	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (tmp), "+m" (sem->count)
- 		     : : "memory");
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/segment.h linux-2.6.32.12/arch/x86/include/asm/segment.h
---- linux-2.6.32.12/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/segment.h	2010-04-04 20:46:41.505526780 -0400
-@@ -62,8 +62,8 @@
-  *  26 - ESPFIX small SS
-  *  27 - per-cpu			[ offset to per-cpu data area ]
-  *  28 - stack_canary-20		[ for stack protector ]
-- *  29 - unused
-- *  30 - unused
-+ *  29 - PCI BIOS CS
-+ *  30 - PCI BIOS DS
-  *  31 - TSS for double fault handler
-  */
- #define GDT_ENTRY_TLS_MIN	6
-@@ -77,6 +77,8 @@
- 
- #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
-+
- #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
- 
- #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +90,7 @@
- #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
- 
--#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +104,12 @@
- #define __KERNEL_STACK_CANARY		0
- #endif
- 
-+#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS	31
- 
- /*
-@@ -139,7 +147,7 @@
-  */
- 
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
- 
- 
- #else
-@@ -163,6 +171,8 @@
- #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS	__USER_DS
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8	/* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +193,7 @@
- #endif
- 
- #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/spinlock.h linux-2.6.32.12/arch/x86/include/asm/spinlock.h
---- linux-2.6.32.12/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/spinlock.h	2010-04-04 20:46:41.505526780 -0400
-@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
--		     "jns 1f\n"
--		     "call __read_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl $1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jns 2f\n"
-+		     "call __read_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw) : "memory");
- }
- 
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
--		     "jz 1f\n"
--		     "call __write_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl %1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jz 2f\n"
-+		     "call __write_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
- 
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     :"+m" (rw->lock) : : "memory");
- }
- 
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "addl %1, %0"
-+	asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/system.h linux-2.6.32.12/arch/x86/include/asm/system.h
---- linux-2.6.32.12/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/system.h	2010-04-04 20:46:41.505526780 -0400
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
- {
- 	unsigned long __limit;
- 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
--	return __limit + 1;
-+	return __limit;
- }
- 
- static inline void native_clts(void)
-@@ -340,7 +340,7 @@ void enable_hlt(void);
- 
- void cpu_idle_wait(void);
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
- 
- void default_idle(void);
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/uaccess_32.h	2010-04-04 20:46:41.505526780 -0400
-@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
- 	return __copy_to_user_ll(to, from, n);
- }
- 
-@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	/* Avoid zeroing the tail if the copy fails..
- 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- 	 * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +146,10 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
- 	return __copy_from_user_ll(to, from, n);
- }
- 
-@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
- 				const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -182,14 +200,62 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- 				  unsigned long n)
- {
--       return __copy_from_user_ll_nocache_nozero(to, from, n);
-+	if ((long)n < 0)
-+		return n;
-+
-+	return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to:   Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_WRITE, to, n))
-+		n = __copy_to_user(to, from, n);
-+	return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to:   Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_READ, from, n))
-+		n = __copy_from_user(to, from, n);
-+	else if ((long)n > 0) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		memset(to, 0, n);
-+	}
-+	return n;
- }
- 
--unsigned long __must_check copy_to_user(void __user *to,
--					const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
--					  const void __user *from,
--					  unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- 				    long count);
- long __must_check __strncpy_from_user(char *dst,
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/uaccess_64.h	2010-04-04 20:58:33.220592413 -0400
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x)	(current_thread_info()->addr_limit = (x))
- 
- /*
-  * Copy To/From Userspace
-@@ -19,20 +22,24 @@ __must_check unsigned long
- copy_user_generic(void *to, const void *from, unsigned len);
- 
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
- copy_in_user(void __user *to, const void __user *from, unsigned len);
- 
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(dst, size, false);
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
- 			      ret, "b", "b", "=q", 1);
-@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
- 			       ret, "q", "", "=r", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(src, size, true);
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
-+	}
- 	switch (size) {
- 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
- 			      ret, "b", "b", "iq", 1);
-@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
- 			       ret, "q", "", "er", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
-+{
-+	if (access_ok(VERIFY_WRITE, to, len))
-+		len = __copy_to_user(to, from, len);
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
-+{
-+	if ((int)len < 0)
-+		return len;
-+
-+	if (access_ok(VERIFY_READ, from, len))
-+		len = __copy_from_user(to, from, len);
-+	else if ((int)len > 0) {
-+		if (!__builtin_constant_p(len))
-+			check_object_size(to, len, false);
-+		memset(to, 0, len);
-+	}
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1: {
- 		u8 tmp;
-@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
- 		return ret;
- 	}
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
- 	}
-@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
- __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
- 					    unsigned size);
- 
--static __must_check __always_inline int
-+static __must_check __always_inline unsigned long
- __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return copy_user_generic((__force void *)dst, src, size);
- }
- 
--extern long __copy_user_nocache(void *dst, const void __user *src,
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
- 				unsigned size, int zerorest);
- 
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
- {
- 	might_sleep();
-+
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 1);
- }
- 
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
- 				  unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 0);
- }
- 
--unsigned long
-+extern unsigned long
- copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
- 
- #endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/uaccess.h linux-2.6.32.12/arch/x86/include/asm/uaccess.h
---- linux-2.6.32.12/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/uaccess.h	2010-04-04 20:58:33.220592413 -0400
-@@ -8,8 +8,11 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
-+#include <linux/slab.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-+#include <asm/segment.h>
- 
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-@@ -29,7 +32,12 @@
- 
- #define get_ds()	(KERNEL_DS)
- #define get_fs()	(current_thread_info()->addr_limit)
-+#ifdef CONFIG_X86_32
-+void __set_fs(mm_segment_t x, int cpu);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x)	(current_thread_info()->addr_limit = (x))
-+#endif
- 
- #define segment_eq(a, b)	((a).seg == (b).seg)
- 
-@@ -77,7 +85,33 @@
-  * checks that the pointer is in the user space range - after calling
-  * this function, memory access functions may still return -EFAULT.
-  */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size)					\
-+({									\
-+	long __size = size;						\
-+	unsigned long __addr = (unsigned long)addr;			\
-+	unsigned long __addr_ao = __addr & PAGE_MASK;			\
-+	unsigned long __end_ao = __addr + __size - 1;			\
-+	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
-+	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
-+		while(__addr_ao <= __end_ao) {				\
-+			char __c_ao;					\
-+			__addr_ao += PAGE_SIZE;				\
-+			if (__size > PAGE_SIZE)				\
-+				cond_resched();				\
-+			if (__get_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			if (type != VERIFY_WRITE) {			\
-+				__addr = __addr_ao;			\
-+				continue;				\
-+			}						\
-+			if (__put_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			__addr = __addr_ao;				\
-+		}							\
-+	}								\
-+	__ret_ao;							\
-+})
- 
- /*
-  * The exception table consists of pairs of addresses: the first is the
-@@ -183,13 +217,21 @@ extern int __get_user_bad(void);
- 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
- 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
- 
--
-+#ifdef CONFIG_X86_32
-+#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
-+#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
-+#else
-+#define _ASM_LOAD_USER_DS(ds)
-+#define _ASM_LOAD_KERNEL_DS
-+#endif
- 
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret)			\
--	asm volatile("1:	movl %%eax,0(%2)\n"			\
--		     "2:	movl %%edx,4(%2)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	movl %%eax,%%ds:0(%2)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%2)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "4:	movl %3,%0\n"				\
- 		     "	jmp 3b\n"					\
-@@ -197,15 +239,18 @@ extern int __get_user_bad(void);
- 		     _ASM_EXTABLE(1b, 4b)				\
- 		     _ASM_EXTABLE(2b, 4b)				\
- 		     : "=r" (err)					\
--		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
-+		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex_u64(x, addr)					\
--	asm volatile("1:	movl %%eax,0(%1)\n"			\
--		     "2:	movl %%edx,4(%1)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	movl %%eax,%%ds:0(%1)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%1)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
- 		     _ASM_EXTABLE(2b, 3b - 2b)				\
--		     : : "A" (x), "r" (addr))
-+		     : : "A" (x), "r" (addr), "r"(__USER_DS))
- 
- #define __put_user_x8(x, ptr, __ret_pu)				\
- 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
-@@ -374,16 +419,18 @@ do {									\
- } while (0)
- 
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
--		     : "=r" (err), ltype(x)				\
--		     : "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : "=r" (err), ltype (x)				\
-+		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
- 
- #define __get_user_size_ex(x, ptr, size)				\
- do {									\
-@@ -407,10 +454,12 @@ do {									\
- } while (0)
- 
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : ltype(x) : "m" (__m(addr)))
-+		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
- 
- #define __put_user_nocheck(x, ptr, size)			\
- ({								\
-@@ -424,13 +473,24 @@ do {									\
- 	int __gu_err;							\
- 	unsigned long __gu_val;						\
- 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
--	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
-+	(x) = (__typeof__(*(ptr)))__gu_val;				\
- 	__gu_err;							\
- })
- 
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x)					\
-+({							\
-+	unsigned long ____x = (unsigned long)(x);	\
-+	if (____x < PAX_USER_SHADOW_BASE)		\
-+		____x += PAX_USER_SHADOW_BASE;		\
-+	(void __user *)____x;				\
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
- 
- /*
-  * Tell gcc we read from memory instead of writing: this is because
-@@ -438,21 +498,26 @@ struct __large_struct { unsigned long bu
-  * aliasing issues.
-  */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
- 		     : "=r"(err)					\
--		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : : ltype(x), "m" (__m(addr)))
-+		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
- 
- /*
-  * uaccess_try and catch
-@@ -530,7 +595,7 @@ struct __large_struct { unsigned long bu
- #define get_user_ex(x, ptr)	do {					\
- 	unsigned long __gue_val;					\
- 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
--	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
-+	(x) = (__typeof__(*(ptr)))__gue_val;				\
- } while (0)
- 
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +632,7 @@ extern struct movsl_mask {
- 
- #define ARCH_HAS_NOCACHE_UACCESS 1
- 
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/vgtod.h linux-2.6.32.12/arch/x86/include/asm/vgtod.h
---- linux-2.6.32.12/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/vgtod.h	2010-04-04 20:46:41.509696869 -0400
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- 	int		sysctl_enabled;
- 	struct timezone sys_tz;
- 	struct { /* extract of a clocksource struct */
-+		char	name[8];
- 		cycle_t (*vread)(void);
- 		cycle_t	cycle_last;
- 		cycle_t	mask;
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/vmi.h linux-2.6.32.12/arch/x86/include/asm/vmi.h
---- linux-2.6.32.12/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/vmi.h	2010-04-04 20:46:41.509696869 -0400
-@@ -191,6 +191,7 @@ struct vrom_header {
- 	u8      reserved[96];   /* Reserved for headers */
- 	char    vmi_init[8];    /* VMI_Init jump point */
- 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
-+	char    rom_data[8048];	/* rest of the option ROM */
- } __attribute__((packed));
- 
- struct pnp_header {
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/vsyscall.h linux-2.6.32.12/arch/x86/include/asm/vsyscall.h
---- linux-2.6.32.12/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/vsyscall.h	2010-04-04 20:46:41.509696869 -0400
-@@ -15,9 +15,10 @@ enum vsyscall_num {
- 
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
- 
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
- 
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL	2
- 
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
- 
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
- 
- extern void map_vsyscall(void);
- 
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
- 
- #endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.32.12/arch/x86/include/asm/xsave.h linux-2.6.32.12/arch/x86/include/asm/xsave.h
---- linux-2.6.32.12/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/include/asm/xsave.h	2010-04-04 20:58:33.225084964 -0400
-@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- 	int err;
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
-+		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
- 	u32 lmask = mask;
- 	u32 hmask = mask >> 32;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
-+		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.32.12/arch/x86/Kconfig linux-2.6.32.12/arch/x86/Kconfig
---- linux-2.6.32.12/arch/x86/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/Kconfig	2010-04-04 20:46:41.509696869 -0400
-@@ -1083,7 +1083,7 @@ config PAGE_OFFSET
- 	hex
- 	default 0xB0000000 if VMSPLIT_3G_OPT
- 	default 0x80000000 if VMSPLIT_2G
--	default 0x78000000 if VMSPLIT_2G_OPT
-+	default 0x70000000 if VMSPLIT_2G_OPT
- 	default 0x40000000 if VMSPLIT_1G
- 	default 0xC0000000
- 	depends on X86_32
-@@ -1409,7 +1409,7 @@ config ARCH_USES_PG_UNCACHED
- 
- config EFI
- 	bool "EFI runtime service support"
--	depends on ACPI
-+	depends on ACPI && !PAX_KERNEXEC
- 	---help---
- 	  This enables the kernel to use EFI runtime services that are
- 	  available (such as the EFI variable services).
-@@ -1496,6 +1496,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- 	default "0x1000000"
-+	range 0x400000 0x40000000
- 	---help---
- 	  This gives the physical address where the kernel is loaded.
- 
-@@ -1560,6 +1561,7 @@ config PHYSICAL_ALIGN
- 	hex
- 	prompt "Alignment value to which kernel should be aligned" if X86_32
- 	default "0x1000000"
-+	range 0x400000 0x1000000 if PAX_KERNEXEC
- 	range 0x2000 0x1000000
- 	---help---
- 	  This value puts the alignment restrictions on physical address
-@@ -1591,9 +1593,10 @@ config HOTPLUG_CPU
- 	  Say N if you want to disable CPU hotplug.
- 
- config COMPAT_VDSO
--	def_bool y
-+	def_bool n
- 	prompt "Compat VDSO support"
- 	depends on X86_32 || IA32_EMULATION
-+	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
- 	---help---
- 	  Map the 32-bit VDSO to the predictable old-style address too.
- 	---help---
-diff -urNp linux-2.6.32.12/arch/x86/Kconfig.cpu linux-2.6.32.12/arch/x86/Kconfig.cpu
---- linux-2.6.32.12/arch/x86/Kconfig.cpu	2010-04-29 17:49:37.481119841 -0400
-+++ linux-2.6.32.12/arch/x86/Kconfig.cpu	2010-04-29 17:49:57.921493895 -0400
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
- 
- config X86_F00F_BUG
- 	def_bool y
--	depends on M586MMX || M586TSC || M586 || M486 || M386
-+	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
- 
- config X86_WP_WORKS_OK
- 	def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
- 
- config X86_ALIGNMENT_16
- 	def_bool y
--	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
- 
- config X86_INTEL_USERCOPY
- 	def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- 	def_bool y
--	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
- 
- config X86_MINIMUM_CPU_FAMILY
- 	int
-diff -urNp linux-2.6.32.12/arch/x86/Kconfig.debug linux-2.6.32.12/arch/x86/Kconfig.debug
---- linux-2.6.32.12/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/Kconfig.debug	2010-04-04 20:46:41.509696869 -0400
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- 	bool "Write protect kernel read-only data structures"
- 	default y
--	depends on DEBUG_KERNEL
-+	depends on DEBUG_KERNEL && BROKEN
- 	---help---
- 	  Mark the kernel read-only data as write-protected in the pagetables,
- 	  in order to catch accidental (and incorrect) writes to such const
-diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/boot.c linux-2.6.32.12/arch/x86/kernel/acpi/boot.c
---- linux-2.6.32.12/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/acpi/boot.c	2010-04-04 20:46:41.509696869 -0400
-@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
- 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
- 		     },
- 	 },
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- /*
-diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S
---- linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/acpi/realmode/wakeup.S	2010-04-04 20:46:41.509696869 -0400
-@@ -104,7 +104,7 @@ _start:
- 	movl	%eax, %ecx
- 	orl	%edx, %ecx
- 	jz	1f
--	movl	$0xc0000080, %ecx
-+	mov	$MSR_EFER, %ecx
- 	wrmsr
- 1:
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/acpi/sleep.c	2010-04-04 20:46:41.509696869 -0400
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
- 
- #include "realmode/wakeup.h"
- #include "sleep.h"
- 
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
- 
- /* address in low memory of the wakeup routine. */
-@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
- 	header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
- 	stack_start.sp = temp_stack + sizeof(temp_stack);
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address =
- 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
-+	pax_close_kernel();
-+
- 	initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- 	initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- 		return;
- 	}
- 
--	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
--	if (!acpi_realmode) {
--		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
--		return;
--	}
--
--	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
- 
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/acpi/wakeup_32.S	2010-04-04 20:46:41.509696869 -0400
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- 	# and restore the stack ... but you need gdt for this to work
- 	movl	saved_context_esp, %esp
- 
--	movl	%cs:saved_magic, %eax
--	cmpl	$0x12345678, %eax
-+	cmpl	$0x12345678, saved_magic
- 	jne	bogus_magic
- 
- 	# jump to place where we left off
--	movl	saved_eip, %eax
--	jmp	*%eax
-+	jmp	*(saved_eip)
- 
- bogus_magic:
- 	jmp	bogus_magic
-diff -urNp linux-2.6.32.12/arch/x86/kernel/alternative.c linux-2.6.32.12/arch/x86/kernel/alternative.c
---- linux-2.6.32.12/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/alternative.c	2010-04-04 20:46:41.509696869 -0400
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
- 
- 		BUG_ON(p->len > MAX_PATCH_LEN);
- 		/* prep the buffer with the original instructions */
--		memcpy(insnbuf, p->instr, p->len);
-+		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- 					 (unsigned long)p->instr, p->len);
- 
-@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
-  * instructions. And on the local CPU you need to be protected again NMI or MCE
-  * handlers seeing an inconsistent instruction while you patch.
-  */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- 					      size_t len)
- {
- 	unsigned long flags;
- 	local_irq_save(flags);
--	memcpy(addr, opcode, len);
-+
-+	pax_open_kernel();
-+	memcpy(ktla_ktva(addr), opcode, len);
-+	pax_close_kernel();
-+
- 	sync_core();
- 	local_irq_restore(flags);
- 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
-  */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
--	unsigned long flags;
--	char *vaddr;
-+	unsigned char *vaddr = ktla_ktva(addr);
- 	struct page *pages[2];
--	int i;
-+	size_t i;
- 
- 	if (!core_kernel_text((unsigned long)addr)) {
--		pages[0] = vmalloc_to_page(addr);
--		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+		pages[0] = vmalloc_to_page(vaddr);
-+		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- 	} else {
--		pages[0] = virt_to_page(addr);
-+		pages[0] = virt_to_page(vaddr);
- 		WARN_ON(!PageReserved(pages[0]));
--		pages[1] = virt_to_page(addr + PAGE_SIZE);
-+		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- 	}
- 	BUG_ON(!pages[0]);
--	local_irq_save(flags);
--	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
--	if (pages[1])
--		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
--	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
--	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
--	clear_fixmap(FIX_TEXT_POKE0);
--	if (pages[1])
--		clear_fixmap(FIX_TEXT_POKE1);
--	local_flush_tlb();
--	sync_core();
--	/* Could also do a CLFLUSH here to speed up CPU recovery; but
--	   that causes hangs on some VIA CPUs. */
-+	text_poke_early(addr, opcode, len);
- 	for (i = 0; i < len; i++)
--		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
--	local_irq_restore(flags);
-+		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
- 	return addr;
- }
-diff -urNp linux-2.6.32.12/arch/x86/kernel/amd_iommu.c linux-2.6.32.12/arch/x86/kernel/amd_iommu.c
---- linux-2.6.32.12/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:37.521943068 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:57.953503497 -0400
-@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
- 	}
- }
- 
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- 	.alloc_coherent = alloc_coherent,
- 	.free_coherent = free_coherent,
- 	.map_page = map_page,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/apic/io_apic.c	2010-04-04 20:46:41.509696869 -0400
-@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
- 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- 				GFP_ATOMIC);
- 	if (!ioapic_entries)
--		return 0;
-+		return NULL;
- 
- 	for (apic = 0; apic < nr_ioapics; apic++) {
- 		ioapic_entries[apic] =
-@@ -728,7 +728,7 @@ nomem:
- 		kfree(ioapic_entries[apic]);
- 	kfree(ioapic_entries);
- 
--	return 0;
-+	return NULL;
- }
- 
- /*
-@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
- 
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- 	/* Used to the online set of cpus does not change
- 	 * during assign_irq_vector.
-@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
- 	spin_lock(&vector_lock);
- }
- 
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- 	spin_unlock(&vector_lock);
- }
-diff -urNp linux-2.6.32.12/arch/x86/kernel/apm_32.c linux-2.6.32.12/arch/x86/kernel/apm_32.c
---- linux-2.6.32.12/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/apm_32.c	2010-04-04 20:46:41.513555986 -0400
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
-  * This is for buggy BIOS's that refer to (real mode) segment 0x40
-  * even though they are called in protected mode.
-  */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- static const char driver_version[] = "1.16ac";	/* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- 			  &call->esi);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
- 					 &call->eax);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 	return error;
- }
-@@ -975,7 +989,7 @@ recalc:
- 
- static void apm_power_off(void)
- {
--	unsigned char po_bios_call[] = {
-+	const unsigned char po_bios_call[] = {
- 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
- 		0x8e, 0xd0,		/* movw  ax,ss       */
- 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
-@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
- static struct miscdevice apm_device = {
- 	APM_MINOR_DEV,
- 	"apm_bios",
--	&apm_bios_fops
-+	&apm_bios_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- 
-@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
- 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
- 
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- /*
-@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
- 	 * code to that CPU.
- 	 */
- 	gdt = get_cpu_gdt_table(0);
-+
-+	pax_open_kernel();
- 	set_desc_base(&gdt[APM_CS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- 	set_desc_base(&gdt[APM_CS_16 >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- 	set_desc_base(&gdt[APM_DS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+	pax_close_kernel();
- 
- 	proc_create("apm", 0, NULL, &apm_file_ops);
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/asm-offsets_32.c	2010-04-04 20:46:41.513555986 -0400
-@@ -115,6 +115,11 @@ void foo(void)
- 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
- 
- #ifdef CONFIG_XEN
-diff -urNp linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/asm-offsets_64.c	2010-04-04 20:58:33.220592413 -0400
-@@ -63,6 +63,18 @@ int main(void)
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
-+#endif
-+
- #endif
- 
- 
-@@ -115,6 +127,7 @@ int main(void)
- 	ENTRY(cr8);
- 	BLANK();
- #undef ENTRY
-+	DEFINE(TSS_size, sizeof(struct tss_struct));
- 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- 	BLANK();
- 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/common.c linux-2.6.32.12/arch/x86/kernel/cpu/common.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/common.c	2010-04-04 20:47:28.952733264 -0400
-@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
- 
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
- 
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
--	/*
--	 * We need valid kernel segments for data and code in long mode too
--	 * IRET will check the segment types  kkeil 2000/10/28
--	 * Also sysret mandates a special GDT layout
--	 *
--	 * TLS descriptors are currently at a different place compared to i386.
--	 * Hopefully nobody expects them at a fixed place (Wine?)
--	 */
--	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
--	/*
--	 * Segments used for calling PnP BIOS have byte granularity.
--	 * They code segments and data segments have fixed 64k limits,
--	 * the transfer segment sizes are set at run time.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/*
--	 * The APM segments have byte granularity and their bases
--	 * are set at run time.  All have 64k limits.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* data */
--	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
--	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
- {
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 	/* Reload the per-cpu base */
-@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
- 	/* Filter out anything that depends on CPUID levels we don't have */
- 	filter_cpuid_features(c, true);
- 
-+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
-+	setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- 	/* If the model name is still unset, do table lookup. */
- 	if (!c->x86_model_id[0]) {
- 		const char *p;
-@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
- 	int i;
- 
- 	cpu = stack_smp_processor_id();
--	t = &per_cpu(init_tss, cpu);
-+	t = init_tss + cpu;
- 	orig_ist = &per_cpu(orig_ist, cpu);
- 
- #ifdef CONFIG_NUMA
-@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
- 	switch_to_new_gdt(cpu);
- 	loadsegment(fs, 0);
- 
--	load_idt((const struct desc_ptr *)&idt_descr);
-+	load_idt(&idt_descr);
- 
- 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- 	syscall_init();
-@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
- {
- 	int cpu = smp_processor_id();
- 	struct task_struct *curr = current;
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 	struct thread_struct *thread = &curr->thread;
- 
- 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-04-04 20:46:41.513555986 -0400
-@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
- 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-04-04 20:46:41.513555986 -0400
-@@ -225,7 +225,7 @@ static struct cpu_model models[] =
- 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
- 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
- 
--	{ NULL, }
-+	{ NULL, NULL, 0, NULL}
- };
- #undef _BANIAS
- #undef BANIAS
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/intel.c linux-2.6.32.12/arch/x86/kernel/cpu/intel.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/intel.c	2010-04-04 20:41:49.916475305 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/intel.c	2010-04-04 20:46:41.513555986 -0400
-@@ -140,7 +140,7 @@ static void __cpuinit trap_init_f00f_bug
- 	 * Update the IDT descriptor and reload the IDT so that
- 	 * it uses the read-only mapped virtual address.
- 	 */
--	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- 	load_idt(&idt_descr);
- }
- #endif
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-04-29 17:49:57.985196208 -0400
-@@ -916,7 +916,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show   = show,
- 	.store  = store,
- };
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/Makefile linux-2.6.32.12/arch/x86/kernel/cpu/Makefile
---- linux-2.6.32.12/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/Makefile	2010-04-04 20:46:41.513555986 -0400
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
- 
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o		:= $(nostackp)
--
- obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
- obj-y			+= proc.o capflags.o powerflags.o common.o
- obj-y			+= vmware.o hypervisor.o sched.o
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-04-04 20:46:41.513555986 -0400
-@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- 	.show			= show,
- 	.store			= store,
- };
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mcheck/mce.c	2010-04-04 20:46:41.513555986 -0400
-@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
- 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- 				m->cs, m->ip);
- 
--		if (m->cs == __KERNEL_CS)
-+		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- 			print_symbol("{%s}", m->ip);
- 		pr_cont("\n");
- 	}
-@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
-  */
- 
- static DEFINE_SPINLOCK(mce_state_lock);
--static int		open_count;		/* #times opened */
-+static atomic_t		open_count;		/* #times opened */
- static int		open_exclu;		/* already open exclusive? */
- 
- static int mce_open(struct inode *inode, struct file *file)
- {
- 	spin_lock(&mce_state_lock);
- 
--	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
- 		spin_unlock(&mce_state_lock);
- 
- 		return -EBUSY;
-@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
- 
- 	if (file->f_flags & O_EXCL)
- 		open_exclu = 1;
--	open_count++;
-+	atomic_inc(&open_count);
- 
- 	spin_unlock(&mce_state_lock);
- 
-@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
- {
- 	spin_lock(&mce_state_lock);
- 
--	open_count--;
-+	atomic_dec(&open_count);
- 	open_exclu = 0;
- 
- 	spin_unlock(&mce_state_lock);
-@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
- 	MISC_MCELOG_MINOR,
- 	"mcelog",
- 	&mce_chrdev_ops,
-+	{NULL, NULL}, NULL, NULL
- };
- 
- /*
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/amd.c	2010-04-04 20:46:41.513555986 -0400
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
- 	return 0;
- }
- 
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- 	.vendor            = X86_VENDOR_AMD,
- 	.set               = amd_set_mtrr,
- 	.get               = amd_get_mtrr,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/centaur.c	2010-04-04 20:46:41.513555986 -0400
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
- 	return 0;
- }
- 
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CENTAUR,
- 	.set               = centaur_set_mcr,
- 	.get               = centaur_get_mcr,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-04-04 20:46:41.513555986 -0400
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- 	post_set();
- }
- 
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CYRIX,
- 	.set_all	   = cyrix_set_all,
- 	.set               = cyrix_set_arr,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/generic.c	2010-04-04 20:46:41.513555986 -0400
-@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
- 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
- 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
- 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
--	{}
-+	{ 0, 0 }
- };
- 
- static unsigned long smp_changes_mask;
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
-  * Generic structure...
-  */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- 	.use_intel_if		= 1,
- 	.set_all		= generic_set_all,
- 	.get			= generic_get_mtrr,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/main.c	2010-04-04 20:46:41.513555986 -0400
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
- 
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
- 
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
- 
- static void set_mtrr(unsigned int reg, unsigned long base,
- 		     unsigned long size, mtrr_type type);
- 
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- 		mtrr_ops[ops->vendor] = ops;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-04-04 20:46:41.517551870 -0400
-@@ -12,19 +12,19 @@
- extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
- 
- struct mtrr_ops {
--	u32	vendor;
--	u32	use_intel_if;
--	void	(*set)(unsigned int reg, unsigned long base,
-+	const u32	vendor;
-+	const u32	use_intel_if;
-+	void	(* const set)(unsigned int reg, unsigned long base,
- 		       unsigned long size, mtrr_type type);
--	void	(*set_all)(void);
-+	void	(* const set_all)(void);
- 
--	void	(*get)(unsigned int reg, unsigned long *base,
-+	void	(* const get)(unsigned int reg, unsigned long *base,
- 		       unsigned long *size, mtrr_type *type);
--	int	(*get_free_region)(unsigned long base, unsigned long size,
-+	int	(* const get_free_region)(unsigned long base, unsigned long size,
- 				   int replace_reg);
--	int	(*validate_add_page)(unsigned long base, unsigned long size,
-+	int	(* const validate_add_page)(unsigned long base, unsigned long size,
- 				     unsigned int type);
--	int	(*have_wrcomb)(void);
-+	int	(* const have_wrcomb)(void);
- };
- 
- extern int generic_get_free_region(unsigned long base, unsigned long size,
-@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- 				     unsigned int type);
- 
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
- 
- extern int positive_have_wrcomb(void);
- 
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
- 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
- 
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
- 
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
- 
- #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-04-04 20:46:41.517551870 -0400
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
- 
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
--	int (*reserve)(void);
--	void (*unreserve)(void);
--	int (*setup)(unsigned nmi_hz);
--	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
--	void (*stop)(void);
-+	int (* const reserve)(void);
-+	void (* const unreserve)(void);
-+	int (* const setup)(unsigned nmi_hz);
-+	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+	void (* const stop)(void);
- 	unsigned perfctr;
- 	unsigned evntsel;
- 	u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
- 
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
- 	return 1;
- }
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- 	.reserve	= single_msr_reserve,
- 	.unreserve	= single_msr_unreserve,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:57.989487280 -0400
-@@ -2354,7 +2354,7 @@ perf_callchain_user(struct pt_regs *regs
- 			break;
- 
- 		callchain_store(entry, frame.return_address);
--		fp = frame.next_frame;
-+		fp = (__force const void __user *)frame.next_frame;
- 	}
- }
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/crash.c linux-2.6.32.12/arch/x86/kernel/crash.c
---- linux-2.6.32.12/arch/x86/kernel/crash.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/crash.c	2010-04-29 17:49:57.989487280 -0400
-@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, 
- 	regs = args->regs;
- 
- #ifdef CONFIG_X86_32
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		crash_fixup_ss_esp(&fixed_regs, regs);
- 		regs = &fixed_regs;
- 	}
-diff -urNp linux-2.6.32.12/arch/x86/kernel/doublefault_32.c linux-2.6.32.12/arch/x86/kernel/doublefault_32.c
---- linux-2.6.32.12/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/doublefault_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -11,7 +11,7 @@
- 
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
- 
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
- 
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- 	unsigned long gdt, tss;
- 
- 	store_gdt(&gdt_desc);
--	gdt = gdt_desc.address;
-+	gdt = (unsigned long)gdt_desc.address;
- 
- 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
- 
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
- 		/* 0x2 bit is always set */
- 		.flags		= X86_EFLAGS_SF | 0x2,
- 		.sp		= STACK_START,
--		.es		= __USER_DS,
-+		.es		= __KERNEL_DS,
- 		.cs		= __KERNEL_CS,
- 		.ss		= __KERNEL_DS,
--		.ds		= __USER_DS,
-+		.ds		= __KERNEL_DS,
- 		.fs		= __KERNEL_PERCPU,
- 
- 		.__cr3		= __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/dumpstack_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
- 	 * When in-kernel, we also print out the stack and code at the
- 	 * time of the fault..
- 	 */
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned int code_prologue = code_bytes * 43 / 64;
- 		unsigned int code_len = code_bytes;
- 		unsigned char c;
- 		u8 *ip;
-+		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
- 
- 		printk(KERN_EMERG "Stack:\n");
- 		show_stack_log_lvl(NULL, regs, &regs->sp,
-@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
- 
- 		printk(KERN_EMERG "Code: ");
- 
--		ip = (u8 *)regs->ip - code_prologue;
-+		ip = (u8 *)regs->ip - code_prologue + cs_base;
- 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- 			/* try starting at IP */
--			ip = (u8 *)regs->ip;
-+			ip = (u8 *)regs->ip + cs_base;
- 			code_len = code_len - code_prologue + 1;
- 		}
- 		for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
- 				printk(" Bad EIP value.");
- 				break;
- 			}
--			if (ip == (u8 *)regs->ip)
-+			if (ip == (u8 *)regs->ip + cs_base)
- 				printk("<%02x> ", c);
- 			else
- 				printk("%02x ", c);
-@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
- {
- 	unsigned short ud2;
- 
-+	ip = ktla_ktva(ip);
- 	if (ip < PAGE_OFFSET)
- 		return 0;
- 	if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.32.12/arch/x86/kernel/dumpstack.c linux-2.6.32.12/arch/x86/kernel/dumpstack.c
---- linux-2.6.32.12/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/dumpstack.c	2010-04-04 20:46:41.517551870 -0400
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
- 
- 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version);
-@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
- 		panic("Fatal exception in interrupt");
- 	if (panic_on_oops)
- 		panic("Fatal exception");
--	do_exit(signr);
-+	do_group_exit(signr);
- }
- 
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
- 	unsigned long flags = oops_begin();
- 	int sig = SIGSEGV;
- 
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		report_bug(regs->ip, regs);
- 
- 	if (__die(str, regs, err))
-diff -urNp linux-2.6.32.12/arch/x86/kernel/e820.c linux-2.6.32.12/arch/x86/kernel/e820.c
---- linux-2.6.32.12/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/e820.c	2010-04-04 20:46:41.517551870 -0400
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
--	{}
-+	{ 0, 0, {0}, 0 }
- };
- 
- static int __init find_overlapped_early(u64 start, u64 end)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/efi_32.c linux-2.6.32.12/arch/x86/kernel/efi_32.c
---- linux-2.6.32.12/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/efi_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -38,70 +38,38 @@
-  */
- 
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
- 
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
--	unsigned long cr4;
--	unsigned long temp;
- 	struct desc_ptr gdt_descr;
- 
- 	local_irq_save(efi_rt_eflags);
- 
--	/*
--	 * If I don't have PAE, I should just duplicate two entries in page
--	 * directory. If I have PAE, I just need to duplicate one entry in
--	 * page directory.
--	 */
--	cr4 = read_cr4_safe();
- 
--	if (cr4 & X86_CR4_PAE) {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		swapper_pg_dir[0].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--	} else {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		efi_bak_pg_dir_pointer[1].pgd =
--		    swapper_pg_dir[pgd_index(0x400000)].pgd;
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--		temp = PAGE_OFFSET + 0x400000;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    swapper_pg_dir[pgd_index(temp)].pgd;
--	}
-+	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
- 	 */
- 	__flush_tlb_all();
- 
--	gdt_descr.address = __pa(get_cpu_gdt_table(0));
-+	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- }
- 
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
--	unsigned long cr4;
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
-+	gdt_descr.address = get_cpu_gdt_table(0);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 
--	cr4 = read_cr4_safe();
--
--	if (cr4 & X86_CR4_PAE) {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--	} else {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    efi_bak_pg_dir_pointer[1].pgd;
--	}
-+	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S
---- linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/efi_stub_32.S	2010-04-04 20:46:41.517551870 -0400
-@@ -6,6 +6,7 @@
-  */
- 
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
- 
- /*
-@@ -20,7 +21,7 @@
-  * service functions will comply with gcc calling convention, too.
-  */
- 
--.text
-+__INIT
- ENTRY(efi_call_phys)
- 	/*
- 	 * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
- 	 * The mapping of lower virtual memory has been created in prelog and
- 	 * epilog.
- 	 */
--	movl	$1f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	jmp	*%edx
-+	jmp	1f-__PAGE_OFFSET
- 1:
- 
- 	/*
-@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
- 	 * parameter 2, ..., param n. To make things easy, we save the return
- 	 * address of efi_call_phys in a global variable.
- 	 */
--	popl	%edx
--	movl	%edx, saved_return_addr
--	/* get the function pointer into ECX*/
--	popl	%ecx
--	movl	%ecx, efi_rt_function_ptr
--	movl	$2f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	pushl	%edx
-+	popl	(saved_return_addr)
-+	popl	(efi_rt_function_ptr)
- 
- 	/*
- 	 * 3. Clear PG bit in %CR0.
-@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
- 	/*
- 	 * 5. Call the physical function.
- 	 */
--	jmp	*%ecx
-+	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
- 
--2:
- 	/*
- 	 * 6. After EFI runtime service returns, control will return to
- 	 * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
- 	movl	%cr0, %edx
- 	orl	$0x80000000, %edx
- 	movl	%edx, %cr0
--	jmp	1f
--1:
-+
- 	/*
- 	 * 8. Now restore the virtual mode from flat mode by
- 	 * adding EIP with PAGE_OFFSET.
- 	 */
--	movl	$1f, %edx
--	jmp	*%edx
-+	jmp	1f+__PAGE_OFFSET
- 1:
- 
- 	/*
- 	 * 9. Balance the stack. And because EAX contain the return value,
- 	 * we'd better not clobber it.
- 	 */
--	leal	efi_rt_function_ptr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
-+	pushl	(efi_rt_function_ptr)
- 
- 	/*
--	 * 10. Push the saved return address onto the stack and return.
-+	 * 10. Return to the saved return address.
- 	 */
--	leal	saved_return_addr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
--	ret
-+	jmpl	*(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
- 
--.data
-+__INITDATA
- saved_return_addr:
- 	.long 0
- efi_rt_function_ptr:
-diff -urNp linux-2.6.32.12/arch/x86/kernel/entry_32.S linux-2.6.32.12/arch/x86/kernel/entry_32.S
---- linux-2.6.32.12/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/entry_32.S	2010-04-04 20:47:28.952733264 -0400
-@@ -191,7 +191,67 @@
- 
- #endif	/* CONFIG_X86_32_LAZY_GS */
- 
--.macro SAVE_ALL
-+.macro PAX_EXIT_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+#endif
-+	mov %cs, %esi
-+	cmp $__KERNEXEC_KERNEL_CS, %esi
-+	jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	btr $16, %esi
-+	ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+	mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro PAX_ENTER_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	bts $16, %esi
-+	jnc 1f
-+	mov %cs, %esi
-+	cmp $__KERNEL_CS, %esi
-+	jz 3f
-+	ljmp $__KERNEL_CS, $3f
-+1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+	mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro __SAVE_ALL _DS
- 	cld
- 	PUSH_GS
- 	pushl %fs
-@@ -224,7 +284,7 @@
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
--	movl $(__USER_DS), %edx
-+	movl $\_DS, %edx
- 	movl %edx, %ds
- 	movl %edx, %es
- 	movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +292,15 @@
- 	SET_KERNEL_GS %edx
- .endm
- 
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+	__SAVE_ALL __KERNEL_DS
-+	PAX_ENTER_KERNEL
-+#else
-+	__SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
-@@ -352,7 +421,15 @@ check_userspace:
- 	movb PT_CS(%esp), %al
- 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
- 	cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jae resume_userspace
-+
-+	PAX_EXIT_KERNEL
-+	jmp resume_kernel
-+#else
- 	jb resume_kernel		# not returning to v8086 or userspace
-+#endif
- 
- ENTRY(resume_userspace)
- 	LOCKDEP_SYS_EXIT
-@@ -414,10 +491,9 @@ sysenter_past_esp:
- 	/*CFI_REL_OFFSET cs, 0*/
- 	/*
- 	 * Push current_thread_info()->sysenter_return to the stack.
--	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
--	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
- 	 */
--	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+	GET_THREAD_INFO(%ebp)
-+	pushl TI_sysenter_return(%ebp)
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET eip, 0
- 
-@@ -430,9 +506,19 @@ sysenter_past_esp:
-  * Load the potential sixth argument from user stack.
-  * Careful about security.
-  */
-+	movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov PT_OLDSS(%esp),%ds
-+1:	movl %ds:(%ebp),%ebp
-+	push %ss
-+	pop %ds
-+#else
- 	cmpl $__PAGE_OFFSET-3,%ebp
- 	jae syscall_fault
- 1:	movl (%ebp),%ebp
-+#endif
-+
- 	movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- 	.align 4
-@@ -455,12 +541,23 @@ sysenter_do_call:
- 	testl $_TIF_ALLWORK_MASK, %ecx
- 	jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	pushl %eax
-+	CFI_ADJUST_CFA_OFFSET 4
-+	call pax_randomize_kstack
-+	popl %eax
-+	CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- /* if something modifies registers it must also disable sysexit */
- 	movl PT_EIP(%esp), %edx
- 	movl PT_OLDESP(%esp), %ecx
- 	xorl %ebp,%ebp
- 	TRACE_IRQS_ON
- 1:	mov  PT_FS(%esp), %fs
-+2:	mov  PT_DS(%esp), %ds
-+3:	mov  PT_ES(%esp), %es
- 	PTGS_TO_GS
- 	ENABLE_INTERRUPTS_SYSEXIT
- 
-@@ -504,11 +601,17 @@ sysexit_audit:
- 
- 	CFI_ENDPROC
- .pushsection .fixup,"ax"
--2:	movl $0,PT_FS(%esp)
-+4:	movl $0,PT_FS(%esp)
-+	jmp 1b
-+5:	movl $0,PT_DS(%esp)
-+	jmp 1b
-+6:	movl $0,PT_ES(%esp)
- 	jmp 1b
- .section __ex_table,"a"
- 	.align 4
--	.long 1b,2b
-+	.long 1b,4b
-+	.long 2b,5b
-+	.long 3b,6b
- .popsection
- 	PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -538,6 +641,10 @@ syscall_exit:
- 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
- 	jne syscall_exit_work
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	call pax_randomize_kstack
-+#endif
-+
- restore_all:
- 	TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,7 +709,13 @@ ldt_ss:
- 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
- 	mov %dx, %ax			/* eax: new kernel esp */
- 	sub %eax, %edx			/* offset (low word is 0) */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	shr $16, %edx
- 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-@@ -642,25 +755,19 @@ work_resched:
- 
- work_notifysig:				# deal with pending signals and
- 					# notify-resume requests
-+	movl %esp, %eax
- #ifdef CONFIG_VM86
- 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
--	movl %esp, %eax
--	jne work_notifysig_v86		# returning to kernel-space or
-+	jz 1f				# returning to kernel-space or
- 					# vm86-space
--	xorl %edx, %edx
--	call do_notify_resume
--	jmp resume_userspace_sig
- 
--	ALIGN
--work_notifysig_v86:
- 	pushl %ecx			# save ti_flags for do_notify_resume
- 	CFI_ADJUST_CFA_OFFSET 4
- 	call save_v86_state		# %eax contains pt_regs pointer
- 	popl %ecx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	movl %eax, %esp
--#else
--	movl %esp, %eax
-+1:
- #endif
- 	xorl %edx, %edx
- 	call do_notify_resume
-@@ -695,6 +802,10 @@ END(syscall_exit_work)
- 
- 	RING0_INT_FRAME			# can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %ss
-+	pop %ds
-+#endif
- 	GET_THREAD_INFO(%ebp)
- 	movl $-EFAULT,PT_EAX(%esp)
- 	jmp resume_userspace
-@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
-  * normal stack and adjusts ESP with the matching offset.
-  */
- 	/* fixup the stack */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- 	shl $16, %eax
-@@ -1198,7 +1315,6 @@ return_to_handler:
- 	ret
- #endif
- 
--.section .rodata,"a"
- #include "syscall_table_32.S"
- 
- syscall_table_size=(.-sys_call_table)
-@@ -1250,12 +1366,15 @@ error_code:
- 	movl %ecx, %fs
- 	UNWIND_ESPFIX_STACK
- 	GS_TO_REG %ecx
-+
-+	PAX_ENTER_KERNEL
-+
- 	movl PT_GS(%esp), %edi		# get the function address
- 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
- 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
- 	REG_TO_PTGS %ecx
- 	SET_KERNEL_GS %ecx
--	movl $(__USER_DS), %ecx
-+	movl $(__KERNEL_DS), %ecx
- 	movl %ecx, %ds
- 	movl %ecx, %es
- 	TRACE_IRQS_OFF
-@@ -1351,6 +1470,9 @@ nmi_stack_correct:
- 	xorl %edx,%edx		# zero error code
- 	movl %esp,%eax		# pt_regs pointer
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	jmp restore_all_notrace
- 	CFI_ENDPROC
- 
-@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
- 	FIXUP_ESPFIX_STACK		# %eax == %esp
- 	xorl %edx,%edx			# zero error code
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	RESTORE_REGS
- 	lss 12+4(%esp), %esp		# back to espfix stack
- 	CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.32.12/arch/x86/kernel/entry_64.S linux-2.6.32.12/arch/x86/kernel/entry_64.S
---- linux-2.6.32.12/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/entry_64.S	2010-04-07 16:58:23.343008831 -0400
-@@ -53,6 +53,7 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
- #include <linux/elf-em.h>
-@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
- 
-+	.macro ljmpq sel, off
-+#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+	.byte 0x48; ljmp *1234f(%rip)
-+	.pushsection .rodata
-+	.align 16
-+	1234: .quad \off; .word \sel
-+	.popsection
-+#else
-+	push $\sel
-+	push $\off
-+	lretq
-+#endif
-+	.endm
-+
-+ENTRY(pax_enter_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	jnc 1f
-+	mov %cs,%edi
-+	cmp $__KERNEL_CS,%edi
-+	jz 3f
-+	ljmpq __KERNEL_CS,3f
-+1:	ljmpq __KERNEXEC_KERNEL_CS,2f
-+2:	SET_RDI_INTO_CR0
-+3:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	mov %cs,%rdi
-+	cmp $__KERNEXEC_KERNEL_CS,%edi
-+	jnz 2f
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	ljmpq __KERNEL_CS,1f
-+1:	SET_RDI_INTO_CR0
-+2:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel)
-+
-+ENTRY(pax_enter_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+	push %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	mov %rdi,%rbx
-+	add $__START_KERNEL_map,%rbx
-+	sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rdi
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0,i*8(%rbx)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	pop %rdi
-+#endif
-+	SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rbx
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rbx
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	add $__START_KERNEL_map,%rdi
-+	sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	mov %rdi,%rbx
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0x67,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0x67,i*8(%rdi)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	PV_RESTORE_REGS(CLBR_RDI)
-+	pop %rbx
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel_user)
- 
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
- 
- 	movq	%rsp,PER_CPU_VAR(old_rsp)
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs off/on section - it's straight
- 	 * and short:
-@@ -502,6 +691,11 @@ sysret_check:
- 	andl %edi,%edx
- 	jnz  sysret_careful
- 	CFI_REMEMBER_STATE
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	/*
- 	 * sysretq will re-enable interrupts:
- 	 */
-@@ -800,7 +994,16 @@ END(interrupt)
- 	CFI_ADJUST_CFA_OFFSET 10*8
- 	call save_args
- 	PARTIAL_FRAME 0
--	call \func
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rdi)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	call \func
- 	.endm
- 
- 	/*
-@@ -844,12 +1047,18 @@ retint_swapgs:		/* return to user-space 
- 	 * The iretq could re-enable interrupts:
- 	 */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	TRACE_IRQS_IRETQ
- 	SWAPGS
- 	jmp restore_args
- 
- retint_restore_args:	/* return to kernel space */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+	call pax_exit_kernel
- 	/*
- 	 * The iretq could re-enable interrupts:
- 	 */
-@@ -1032,7 +1241,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
- 	jmp error_exit		/* %ebx: no swapgs flag */
-@@ -1049,7 +1267,16 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
- 	jmp paranoid_exit	/* %ebx: no swapgs flag */
-@@ -1066,9 +1293,23 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi		/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
--	PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+	lea init_tss(%rbp), %rbp
-+#else
-+	lea init_tss(%rip), %rbp
-+#endif
- 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- 	call \do_sym
- 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
-@@ -1085,7 +1326,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
--	movq %rsp,%rdi			/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
- 	call \do_sym
-@@ -1104,7 +1354,16 @@ ENTRY(\sym)
- 	call save_paranoid
- 	DEFAULT_FRAME 0
- 	TRACE_IRQS_OFF
--	movq %rsp,%rdi			/* pt_regs pointer */
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
- 	call \do_sym
-@@ -1408,11 +1667,13 @@ ENTRY(paranoid_exit)
- 	testl $3,CS(%rsp)
- 	jnz   paranoid_userspace
- paranoid_swapgs:
-+	call pax_exit_kernel
- 	TRACE_IRQS_IRETQ 0
- 	SWAPGS_UNSAFE_STACK
- 	RESTORE_ALL 8
- 	jmp irq_return
- paranoid_restore:
-+	call pax_exit_kernel
- 	TRACE_IRQS_IRETQ 0
- 	RESTORE_ALL 8
- 	jmp irq_return
-@@ -1529,6 +1790,16 @@ ENTRY(nmi)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call save_paranoid
- 	DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testl $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+#else
-+	call pax_enter_kernel
-+#endif
-+2:
- 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- 	movq %rsp,%rdi
- 	movq $-1,%rsi
-@@ -1544,6 +1815,7 @@ ENTRY(nmi)
- nmi_swapgs:
- 	SWAPGS_UNSAFE_STACK
- nmi_restore:
-+	call pax_exit_kernel
- 	RESTORE_ALL 8
- 	jmp irq_return
- nmi_userspace:
-diff -urNp linux-2.6.32.12/arch/x86/kernel/ftrace.c linux-2.6.32.12/arch/x86/kernel/ftrace.c
---- linux-2.6.32.12/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/ftrace.c	2010-04-04 20:46:41.517551870 -0400
-@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
- {
- 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- 		smp_rmb();
-+		pax_open_kernel();
- 		ftrace_mod_code();
-+		pax_close_kernel();
- 		atomic_inc(&nmi_update_count);
- 	}
- 	/* Must have previous changes seen before executions */
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
- 
- 
- 
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
- 
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
- {
- 	unsigned char replaced[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	/*
- 	 * Note: Due to modules and __init, code can
- 	 *  disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
- 	unsigned char old[MCOUNT_INSN_SIZE], *new;
- 	int ret;
- 
--	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
- 	new = ftrace_call_replace(ip, (unsigned long)func);
- 	ret = ftrace_modify_code(ip, old, new);
- 
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
- 	switch (faulted) {
- 	case 0:
- 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
--		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- 		break;
- 	case 1:
- 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
--		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- 		break;
- 	case 2:
- 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
--		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- 		break;
- 	}
- 
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
- {
- 	unsigned char code[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- 		return -EFAULT;
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/head32.c linux-2.6.32.12/arch/x86/kernel/head32.c
---- linux-2.6.32.12/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/head32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -16,6 +16,7 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
- 
- static void __init i386_default_early_setup(void)
- {
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- 	reserve_trampoline_memory();
- 
--	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
- 
- #ifdef CONFIG_BLK_DEV_INITRD
- 	/* Reserve INITRD */
-diff -urNp linux-2.6.32.12/arch/x86/kernel/head_32.S linux-2.6.32.12/arch/x86/kernel/head_32.S
---- linux-2.6.32.12/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/head_32.S	2010-04-04 20:58:33.220592413 -0400
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
- 
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
-  * References to members of the new_cpu_data structure.
-  */
-@@ -52,11 +59,7 @@
-  * and small than max_low_pfn, otherwise will waste some page table entries
-  */
- 
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
- 
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- 
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
-  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
-  * %esi points to the real-mode code as a 32-bit pointer.
-  * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-  * can.
-  */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
- 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
- 		us to not reload segments */
-@@ -97,6 +113,55 @@ ENTRY(startup_32)
- 	movl %eax,%gs
- 2:
- 
-+#ifdef CONFIG_SMP
-+	movl $pa(cpu_gdt_table),%edi
-+	movl $__per_cpu_load,%eax
-+	movw %ax,__KERNEL_PERCPU + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_PERCPU + 4(%edi)
-+	movb %ah,__KERNEL_PERCPU + 7(%edi)
-+	movl $__per_cpu_end - 1,%eax
-+	subl $__per_cpu_start,%eax
-+	movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+1:
-+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	movl $pa(boot_gdt),%edi
-+	movl $__LOAD_PHYSICAL_ADDR,%eax
-+	movw %ax,__BOOT_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__BOOT_CS + 4(%edi)
-+	movb %ah,__BOOT_CS + 7(%edi)
-+	rorl $16,%eax
-+
-+	ljmp $(__BOOT_CS),$1f
-+1:
-+
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+	addl $__PAGE_OFFSET,%eax
-+1:
-+	movw %ax,__KERNEL_CS + 2(%edi)
-+	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_CS + 4(%edi)
-+	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
-+	movb %ah,__KERNEL_CS + 7(%edi)
-+	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
-+	rorl $16,%eax
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
- /*
-  * Clear BSS first so that there are no surprises...
-  */
-@@ -140,9 +205,7 @@ ENTRY(startup_32)
- 	cmpl $num_subarch_entries, %eax
- 	jae bad_subarch
- 
--	movl pa(subarch_entries)(,%eax,4), %eax
--	subl $__PAGE_OFFSET, %eax
--	jmp *%eax
-+	jmp *pa(subarch_entries)(,%eax,4)
- 
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +217,10 @@ WEAK(xen_entry)
- 	__INITDATA
- 
- subarch_entries:
--	.long default_entry		/* normal x86/PC */
--	.long lguest_entry		/* lguest hypervisor */
--	.long xen_entry			/* Xen hypervisor */
--	.long default_entry		/* Moorestown MID */
-+	.long ta(default_entry)		/* normal x86/PC */
-+	.long ta(lguest_entry)		/* lguest hypervisor */
-+	.long ta(xen_entry)		/* Xen hypervisor */
-+	.long ta(default_entry)		/* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +281,11 @@ default_entry:
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else	/* Not PAE */
- 
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- 	jmp 3f
- /*
-@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
- 	orl %edx,%eax
- 	movl %eax,%cr4
- 
-+#ifdef CONFIG_X86_PAE
- 	btl $5, %eax		# check if PAE is enabled
- 	jnc 6f
- 
-@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
- 	jnc 6f
- 
- 	/* Setup EFER (Extended Feature Enable Register) */
--	movl $0xc0000080, %ecx
-+	movl $MSR_EFER, %ecx
- 	rdmsr
- 
- 	btsl $11, %eax
- 	/* Make changes effective */
- 	wrmsr
- 
-+	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+	movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
- 
- /*
-@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
- 
- #ifdef CONFIG_SMP
- 	cmpb $0, ready
--	jz  1f				/* Initial CPU cleans BSS */
--	jmp checkCPUtype
--1:
-+	jnz checkCPUtype		/* Initial CPU cleans BSS */
- #endif /* CONFIG_SMP */
- 
- /*
-@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
- 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
- 	movl %eax,%ss			# after changing gdt.
- 
--	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
-+#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
- 	movl %eax,%ds
- 	movl %eax,%es
- 
-@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
- 	 */
- 	cmpb $0,ready
- 	jne 1f
--	movl $per_cpu__gdt_page,%eax
-+	movl $cpu_gdt_table,%eax
- 	movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+	addl $__per_cpu_load,%ecx
-+#endif
- 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- 	shrl $16, %ecx
- 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
- #ifdef CONFIG_SMP
- 	movb ready, %cl
- 	movb $1, ready
--	cmpb $0,%cl		# the first CPU calls start_kernel
--	je   1f
--	movl (stack_start), %esp
--1:
- #endif /* CONFIG_SMP */
- 	jmp *(initial_code)
- 
-@@ -546,22 +617,22 @@ early_page_fault:
- 	jmp early_fault
- 
- early_fault:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $1,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pusha
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	movl %cr2,%eax
- 	pushl %eax
- 	pushl %edx		/* trapno */
- 	pushl $fault_msg
- 	call printk
-+;	call dump_stack
- #endif
--	call dump_stack
- hlt_loop:
- 	hlt
- 	jmp hlt_loop
-@@ -569,8 +640,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- 	ALIGN
- ignore_int:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $2,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pushl %eax
- 	pushl %ecx
- 	pushl %edx
-@@ -579,9 +653,6 @@ ignore_int:
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	pushl 16(%esp)
- 	pushl 24(%esp)
- 	pushl 32(%esp)
-@@ -608,27 +679,45 @@ ENTRY(initial_code)
- /*
-  * BSS section
-  */
--__PAGE_ALIGNED_BSS
--	.align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- 	.fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- 	.fill 1024,4,0
- #endif
-+
- swapper_pg_fixmap:
- 	.fill 1024,4,0
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- 	.fill 4096,1,0
- 
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+	.fill 256,8,0
-+
-+/*
-  * This starts the data section.
-  */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
--	/* Page-aligned for the benefit of paravirt? */
--	.align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- ENTRY(swapper_pg_dir)
- 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
- # if KPMDS == 3
-@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
- 
- .data
- ENTRY(stack_start)
--	.long init_thread_union+THREAD_SIZE
-+	.long init_thread_union+THREAD_SIZE-8
- 	.long __BOOT_DS
- 
- ready:	.byte 0
- 
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- 	.long 0
- 
-@@ -691,7 +781,7 @@ fault_msg:
- 	.word 0				# 32 bit align gdt_desc.address
- boot_gdt_descr:
- 	.word __BOOT_DS+7
--	.long boot_gdt - __PAGE_OFFSET
-+	.long pa(boot_gdt)
- 
- 	.word 0				# 32-bit align idt_desc.address
- idt_descr:
-@@ -702,7 +792,7 @@ idt_descr:
- 	.word 0				# 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- 	.word GDT_ENTRIES*8-1
--	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
-+	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
- 
- /*
-  * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
- 	.align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- 	.fill GDT_ENTRY_BOOT_CS,8,0
--	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
--	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
-+	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
-+
-+	.align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad 0x0000000000000000	/* NULL descriptor */
-+	.quad 0x0000000000000000	/* 0x0b reserved */
-+	.quad 0x0000000000000000	/* 0x13 reserved */
-+	.quad 0x0000000000000000	/* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+	.quad 0x0000000000000000	/* 0x20 unused */
-+#endif
-+
-+	.quad 0x0000000000000000	/* 0x28 unused */
-+	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
-+	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
-+	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
-+	.quad 0x0000000000000000	/* 0x4b reserved */
-+	.quad 0x0000000000000000	/* 0x53 reserved */
-+	.quad 0x0000000000000000	/* 0x5b reserved */
-+
-+	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
-+	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
-+	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
-+
-+	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
-+	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
-+
-+	/*
-+	 * Segments used for calling PnP BIOS have byte granularity.
-+	 * The code segments and data segments have fixed 64k limits,
-+	 * the transfer segment sizes are set at run time.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
-+	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
-+	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
-+	.quad 0x0000930000000000	/* 0xa8 16-bit data */
-+	.quad 0x0000930000000000	/* 0xb0 16-bit data */
-+
-+	/*
-+	 * The APM segments have byte granularity and their bases
-+	 * are set at run time.  All have 64k limits.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
-+	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
-+	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
-+
-+	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
-+	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
-+	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
-+	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
-+	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
-+	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+	/* Be sure this is zeroed to avoid false validations in Xen */
-+	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+	.endr
-diff -urNp linux-2.6.32.12/arch/x86/kernel/head64.c linux-2.6.32.12/arch/x86/kernel/head64.c
---- linux-2.6.32.12/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/head64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -29,7 +29,13 @@
- static void __init zap_identity_mappings(void)
- {
- 	pgd_t *pgd = pgd_offset_k(0UL);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	set_pgd(pgd, native_make_pgd(0));
-+#else
- 	pgd_clear(pgd);
-+#endif
-+
- 	__flush_tlb_all();
- }
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/head_64.S linux-2.6.32.12/arch/x86/kernel/head_64.S
---- linux-2.6.32.12/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/head_64.S	2010-04-04 20:58:33.220592413 -0400
-@@ -19,6 +19,7 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
- 
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
- 
- 	.text
- 	__HEAD
-@@ -85,35 +90,22 @@ startup_64:
- 	 */
- 	addq	%rbp, init_level4_pgt + 0(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
- 
- 	addq	%rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+	addq	%rbp, level3_ident_pgt + 8(%rip)
-+#endif
- 
--	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
--	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
-+	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
- 
--	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
- 
--	/* Add an Identity mapping if I am above 1G */
--	leaq	_text(%rip), %rdi
--	andq	$PMD_PAGE_MASK, %rdi
--
--	movq	%rdi, %rax
--	shrq	$PUD_SHIFT, %rax
--	andq	$(PTRS_PER_PUD - 1), %rax
--	jz	ident_complete
--
--	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
--	leaq	level3_ident_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--
--	movq	%rdi, %rax
--	shrq	$PMD_SHIFT, %rax
--	andq	$(PTRS_PER_PMD - 1), %rax
--	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
--	leaq	level2_spare_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
- 
- 	/*
- 	 * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
- 	 * after the boot processor executes this code.
- 	 */
- 
--	/* Enable PAE mode and PGE */
--	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
-+	/* Enable PAE mode and PSE/PGE */
-+	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- 	movq	%rax, %cr4
- 
- 	/* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
- 	movl	$MSR_EFER, %ecx
- 	rdmsr
- 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
--	btl	$20,%edi		/* No Execute supported? */
-+	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
- 	jnc     1f
- 	btsl	$_EFER_NX, %eax
-+	leaq	init_level4_pgt(%rip), %rdi
-+	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1:	wrmsr				/* Make changes effective */
- 
- 	/* Setup cr0 */
-@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
- 	.quad	x86_64_start_kernel
- 	ENTRY(initial_gs)
- 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
--	__FINITDATA
- 
- 	ENTRY(stack_start)
- 	.quad  init_thread_union+THREAD_SIZE-8
- 	.word  0
-+	__FINITDATA
- 
- bad_address:
- 	jmp bad_address
- 
--	.section ".init.text","ax"
-+	__INIT
- #ifdef CONFIG_EARLY_PRINTK
- 	.globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1:	hlt
- 	jmp 1b
-+	.previous
- 
- #ifdef CONFIG_EARLY_PRINTK
-+	__INITDATA
- early_recursion_flag:
- 	.long 0
-+	.previous
- 
-+	.section .rodata,"a",@progbits
- early_idt_msg:
- 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- 	.asciz "RIP %s\n"
--#endif /* CONFIG_EARLY_PRINTK */
- 	.previous
-+#endif /* CONFIG_EARLY_PRINTK */
- 
-+	.section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- 	.balign	PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
-+	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
-+	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
- 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- 	.fill	511,8,0
-+#else
-+	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+	.fill	510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_pgt)
-+	.fill	512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+	.fill	L3_VMEMMAP_START,8,0
-+	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 
- NEXT_PAGE(level3_kernel_pgt)
- 	.fill	L3_START_KERNEL,8,0
-@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
- 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+NEXT_PAGE(level2_vmemmap_pgt)
-+	.fill	512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
--	.fill	506,8,0
--	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
--	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
--	.fill	5,8,0
-+	.fill	507,8,0
-+	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+	.fill	4,8,0
- 
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- 	.fill	512,8,0
- 
--NEXT_PAGE(level2_ident_pgt)
--	/* Since I easily can, map the first 1G.
-+	/* Since I easily can, map the first 2G.
- 	 * Don't set NX because code runs from these pages.
- 	 */
--	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
- 
- NEXT_PAGE(level2_kernel_pgt)
- 	/*
-@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
- 	 *  If you want to increase this then increase MODULES_VADDR
- 	 *  too.)
- 	 */
--	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
--		KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
--	.fill   512, 8, 0
-+	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
- 
- #undef PMDS
- #undef NEXT_PAGE
- 
--	.data
-+	.align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad	0x0000000000000000	/* NULL descriptor */
-+	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
-+	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
-+	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
-+	.quad	0x00cffb000000ffff	/* __USER32_CS */
-+	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
-+	.quad	0x00affb000000ffff	/* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
-+#else
-+	.quad	0x0			/* unused */
-+#endif
-+
-+	.quad	0,0			/* TSS */
-+	.quad	0,0			/* LDT */
-+	.quad	0,0,0			/* three TLS descriptors */
-+	.quad	0x0000f40000000000	/* node/CPU stored in limit */
-+	/* asm/segment.h:GDT_ENTRIES must match this */
-+
-+	/* zero the remaining page */
-+	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+	.endr
-+
- 	.align 16
- 	.globl early_gdt_descr
- early_gdt_descr:
- 	.word	GDT_ENTRIES*8-1
- early_gdt_descr_base:
--	.quad	INIT_PER_CPU_VAR(gdt_page)
-+	.quad	cpu_gdt_table
- 
- ENTRY(phys_base)
- 	/* This must match the first entry in level2_kernel_pgt */
- 	.quad   0x0000000000000000
- 
- #include "../../x86/xen/xen-head.S"
--	
--	.section .bss, "aw", @nobits
-+
-+	.section .rodata,"a",@progbits
- 	.align L1_CACHE_BYTES
- ENTRY(idt_table)
--	.skip IDT_ENTRIES * 16
-+	.fill 512,8,0
- 
- 	__PAGE_ALIGNED_BSS
- 	.align PAGE_SIZE
-diff -urNp linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/i386_ksyms_32.c	2010-04-04 20:46:41.517551870 -0400
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
- 
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
- 
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
- 
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff -urNp linux-2.6.32.12/arch/x86/kernel/init_task.c linux-2.6.32.12/arch/x86/kernel/init_task.c
---- linux-2.6.32.12/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/init_task.c	2010-04-04 20:46:41.517551870 -0400
-@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
-  * section. Since TSS's are completely CPU-local, we want them
-  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
-  */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/ioport.c linux-2.6.32.12/arch/x86/kernel/ioport.c
---- linux-2.6.32.12/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/ioport.c	2010-04-04 20:46:41.517551870 -0400
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
- 
- 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- 		return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+	if (turn_on) {
-+		gr_handle_ioperm();
-+		return -EPERM;
-+	}
-+#endif
- 	if (turn_on && !capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
- 	 * because the ->io_bitmap_max value must match the bitmap
- 	 * contents:
- 	 */
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 
- 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
- 
-@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
- 		return -EINVAL;
- 	/* Trying to gain more privileges? */
- 	if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+		gr_handle_iopl();
-+		return -EPERM;
-+#else
- 		if (!capable(CAP_SYS_RAWIO))
- 			return -EPERM;
-+#endif
- 	}
- 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/irq_32.c linux-2.6.32.12/arch/x86/kernel/irq_32.c
---- linux-2.6.32.12/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/irq_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
- 		return 0;
- 
- 	/* build the stack frame on the IRQ stack */
--	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 	irqctx->tinfo.task = curctx->tinfo.task;
- 	irqctx->tinfo.previous_esp = current_stack_pointer;
- 
-@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
- 		irqctx->tinfo.previous_esp = current_stack_pointer;
- 
- 		/* build the stack frame on the softirq stack */
--		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 
- 		call_on_stack(__do_softirq, isp);
- 		/*
-diff -urNp linux-2.6.32.12/arch/x86/kernel/kgdb.c linux-2.6.32.12/arch/x86/kernel/kgdb.c
---- linux-2.6.32.12/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/kgdb.c	2010-04-04 20:46:41.521777445 -0400
-@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
- 	return instruction_pointer(regs);
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: */
- 	.gdb_bpt_instr		= { 0xcc },
- 	.flags			= KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/kprobes.c linux-2.6.32.12/arch/x86/kernel/kprobes.c
---- linux-2.6.32.12/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/kprobes.c	2010-04-04 20:46:41.521777445 -0400
-@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
- 		char op;
- 		s32 raddr;
- 	} __attribute__((packed)) * jop;
--	jop = (struct __arch_jmp_op *)from;
-+
-+	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+	pax_open_kernel();
- 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- 	jop->op = RELATIVEJUMP_INSTRUCTION;
-+	pax_close_kernel();
- }
- 
- /*
-@@ -345,16 +349,18 @@ static void __kprobes fix_riprel(struct 
- 
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
--	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_open_kernel();
-+	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_close_kernel();
- 
- 	fix_riprel(p);
- 
--	if (can_boost(p->addr))
-+	if (can_boost(ktla_ktva(p->addr)))
- 		p->ainsn.boostable = 0;
- 	else
- 		p->ainsn.boostable = -1;
- 
--	p->opcode = *p->addr;
-+	p->opcode = *(ktla_ktva(p->addr));
- }
- 
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,7 +438,7 @@ static void __kprobes prepare_singlestep
- 	if (p->opcode == BREAKPOINT_INSTRUCTION)
- 		regs->ip = (unsigned long)p->addr;
- 	else
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
- 
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -453,7 +459,7 @@ static void __kprobes setup_singlestep(s
- 	if (p->ainsn.boostable == 1 && !p->post_handler) {
- 		/* Boost up -- we can execute copied instructions directly */
- 		reset_current_kprobe();
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 		preempt_enable_no_resched();
- 		return;
- 	}
-@@ -523,7 +529,7 @@ static int __kprobes kprobe_handler(stru
- 	struct kprobe_ctlblk *kcb;
- 
- 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
--	if (*addr != BREAKPOINT_INSTRUCTION) {
-+	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- 		/*
- 		 * The breakpoint instruction was removed right
- 		 * after we hit it.  Another cpu has removed
-@@ -775,7 +781,7 @@ static void __kprobes resume_execution(s
- 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- 	unsigned long *tos = stack_addr(regs);
--	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 	unsigned long orig_ip = (unsigned long)p->addr;
- 	kprobe_opcode_t *insn = p->ainsn.insn;
- 
-@@ -958,7 +964,7 @@ int __kprobes kprobe_exceptions_notify(s
- 	struct die_args *args = data;
- 	int ret = NOTIFY_DONE;
- 
--	if (args->regs && user_mode_vm(args->regs))
-+	if (args->regs && user_mode(args->regs))
- 		return ret;
- 
- 	switch (val) {
-diff -urNp linux-2.6.32.12/arch/x86/kernel/ldt.c linux-2.6.32.12/arch/x86/kernel/ldt.c
---- linux-2.6.32.12/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/ldt.c	2010-04-04 20:46:41.521777445 -0400
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
- 	if (reload) {
- #ifdef CONFIG_SMP
- 		preempt_disable();
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- 		if (!cpumask_equal(mm_cpumask(current->mm),
- 				   cpumask_of(smp_processor_id())))
- 			smp_call_function(flush_ldt, current->mm, 1);
- 		preempt_enable();
- #else
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- #endif
- 	}
- 	if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
- 		return err;
- 
- 	for (i = 0; i < old->size; i++)
--		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+		write_ldt_entry(new->ldt, i, old->ldt + i);
- 	return 0;
- }
- 
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
- 		retval = copy_ldt(&mm->context, &old_mm->context);
- 		mutex_unlock(&old_mm->context.lock);
- 	}
-+
-+	if (tsk == current) {
-+		mm->context.vdso = ~0UL;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		mm->context.user_cs_base = 0UL;
-+		mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+	}
-+
- 	return retval;
- }
- 
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+		error = -EINVAL;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	fill_ldt(&ldt, &ldt_info);
- 	if (oldmode)
- 		ldt.avl = 0;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/machine_kexec_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
- 
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- 	struct desc_ptr curidt;
- 
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
- }
- 
- 
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- 	struct desc_ptr curgdt;
- 
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- 	}
- 
- 	control_page = page_address(image->control_code_page);
--	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
- 
- 	relocate_kernel_ptr = control_page;
- 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c
---- linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/machine_kexec_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
- 	}
- 	/* clear the unused entries */
- 	while (addr < end_addr) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		set_pgd(level4p++, native_make_pgd(0));
-+#else
- 		pgd_clear(level4p++);
-+#endif
-+
- 		addr += PGDIR_SIZE;
- 	}
- out:
-diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_amd.c linux-2.6.32.12/arch/x86/kernel/microcode_amd.c
---- linux-2.6.32.12/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/microcode_amd.c	2010-04-04 20:46:41.521777445 -0400
-@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- 	.request_microcode_user           = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info_amd,
-@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
- 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
- };
- 
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return &microcode_amd_ops;
- }
-diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_core.c linux-2.6.32.12/arch/x86/kernel/microcode_core.c
---- linux-2.6.32.12/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/microcode_core.c	2010-04-04 20:46:41.521777445 -0400
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
- 
- #define MICROCODE_VERSION	"2.00"
- 
--static struct microcode_ops	*microcode_ops;
-+static const struct microcode_ops	*microcode_ops;
- 
- /*
-  * Synchronization.
-diff -urNp linux-2.6.32.12/arch/x86/kernel/microcode_intel.c linux-2.6.32.12/arch/x86/kernel/microcode_intel.c
---- linux-2.6.32.12/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/microcode_intel.c	2010-04-04 20:46:41.521777445 -0400
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
- 
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
--	return copy_from_user(to, from, n);
-+	return copy_from_user(to, (__force const void __user *)from, n);
- }
- 
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
--	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
- }
- 
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- 	.request_microcode_user		  = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
- 	.microcode_fini_cpu               = microcode_fini_cpu,
- };
- 
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return &microcode_intel_ops;
- }
-diff -urNp linux-2.6.32.12/arch/x86/kernel/module.c linux-2.6.32.12/arch/x86/kernel/module.c
---- linux-2.6.32.12/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/module.c	2010-04-04 20:46:41.521777445 -0400
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
- 
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- 	struct vm_struct *area;
- 
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- 	if (!area)
- 		return NULL;
- 
--	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
--					PAGE_KERNEL_EXEC);
-+	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	return __module_alloc(size, PAGE_KERNEL);
-+#else
-+	return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
- 
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+	struct vm_struct *area;
-+
-+	if (size == 0)
-+		return NULL;
-+
-+	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+	return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+	return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- 			      Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 	unsigned int i;
- 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- 	Elf32_Sym *sym;
--	uint32_t *location;
-+	uint32_t *plocation, location;
- 
- 	DEBUGP("Applying relocate section %u to %u\n", relsec,
- 	       sechdrs[relsec].sh_info);
- 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- 		/* This is where to make the change */
--		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
--			+ rel[i].r_offset;
-+		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+		location = (uint32_t)plocation;
-+		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+			plocation = ktla_ktva((void *)plocation);
- 		/* This is the symbol it is referring to.  Note that all
- 		   undefined symbols have been resolved.  */
- 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 		switch (ELF32_R_TYPE(rel[i].r_info)) {
- 		case R_386_32:
- 			/* We add the value into the location given */
--			*location += sym->st_value;
-+			pax_open_kernel();
-+			*plocation += sym->st_value;
-+			pax_close_kernel();
- 			break;
- 		case R_386_PC32:
- 			/* Add the value, subtract its postition */
--			*location += sym->st_value - (uint32_t)location;
-+			pax_open_kernel();
-+			*plocation += sym->st_value - location;
-+			pax_close_kernel();
- 			break;
- 		default:
- 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
- 		case R_X86_64_NONE:
- 			break;
- 		case R_X86_64_64:
-+			pax_open_kernel();
- 			*(u64 *)loc = val;
-+			pax_close_kernel();
- 			break;
- 		case R_X86_64_32:
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
- 			if (val != *(u32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_32S:
-+			pax_open_kernel();
- 			*(s32 *)loc = val;
-+			pax_close_kernel();
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_PC32:
- 			val -= (u64)loc;
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
-+
- #if 0
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/paravirt.c linux-2.6.32.12/arch/x86/kernel/paravirt.c
---- linux-2.6.32.12/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/paravirt.c	2010-04-29 17:46:36.865234674 -0400
-@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
-  * corresponding structure. */
- static void *get_call_destination(u8 type)
- {
--	struct paravirt_patch_template tmpl = {
-+	const struct paravirt_patch_template tmpl = {
- 		.pv_init_ops = pv_init_ops,
- 		.pv_time_ops = pv_time_ops,
- 		.pv_cpu_ops = pv_cpu_ops,
-@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
- 	if (opfunc == NULL)
- 		/* If there's no function, patch it with a ud2a (BUG) */
- 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
--	else if (opfunc == _paravirt_nop)
-+	else if (opfunc == (void *)_paravirt_nop)
- 		/* If the operation is a nop, then nop the callsite */
- 		ret = paravirt_patch_nop();
- 
- 	/* identity functions just return their single argument */
--	else if (opfunc == _paravirt_ident_32)
-+	else if (opfunc == (void *)_paravirt_ident_32)
- 		ret = paravirt_patch_ident_32(insnbuf, len);
--	else if (opfunc == _paravirt_ident_64)
-+	else if (opfunc == (void *)_paravirt_ident_64)
- 		ret = paravirt_patch_ident_64(insnbuf, len);
- 
- 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
-@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
- 	if (insn_len > len || start == NULL)
- 		insn_len = len;
- 	else
--		memcpy(insnbuf, start, insn_len);
-+		memcpy(insnbuf, ktla_ktva(start), insn_len);
- 
- 	return insn_len;
- }
-@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
- 	preempt_enable();
- }
- 
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- 	.name = "bare hardware",
- 	.paravirt_enabled = 0,
- 	.kernel_rpl = 0,
- 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
- };
- 
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- 	.patch = native_patch,
- };
- 
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- 	.sched_clock = native_sched_clock,
- };
- 
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
- 
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- 	.cpuid = native_cpuid,
- 	.get_debugreg = native_get_debugreg,
- 	.set_debugreg = native_set_debugreg,
-@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
- 	.end_context_switch = paravirt_nop,
- };
- 
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- 	.startup_ipi_hook = paravirt_nop,
- #endif
-@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
- #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
- 
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
- 
- 	.read_cr2 = native_read_cr2,
- 	.write_cr2 = native_write_cr2,
-@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- 	},
- 
- 	.set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.pax_open_kernel = native_pax_open_kernel,
-+	.pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
- 
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/paravirt-spinlocks.c	2010-04-04 20:46:41.521777445 -0400
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
- 	__raw_spin_lock(lock);
- }
- 
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- 	.spin_is_locked = __ticket_spin_is_locked,
- 	.spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/pci-calgary_64.c	2010-04-04 20:46:41.521777445 -0400
-@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
- 	free_pages((unsigned long)vaddr, get_order(size));
- }
- 
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- 	.alloc_coherent = calgary_alloc_coherent,
- 	.free_coherent = calgary_free_coherent,
- 	.map_sg = calgary_map_sg,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-dma.c linux-2.6.32.12/arch/x86/kernel/pci-dma.c
---- linux-2.6.32.12/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/pci-dma.c	2010-04-04 20:46:41.521777445 -0400
-@@ -14,7 +14,7 @@
- 
- static int forbid_dac __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
- 
- int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- #ifdef CONFIG_PCI
- 	if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/pci-gart_64.c	2010-04-29 17:49:57.989487280 -0400
-@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
- 	return -1;
- }
- 
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- 	.map_sg				= gart_map_sg,
- 	.unmap_sg			= gart_unmap_sg,
- 	.map_page			= gart_map_page,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-nommu.c linux-2.6.32.12/arch/x86/kernel/pci-nommu.c
---- linux-2.6.32.12/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/pci-nommu.c	2010-04-04 20:46:41.521777445 -0400
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
- 	flush_write_buffers();
- }
- 
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- 	.alloc_coherent		= dma_generic_alloc_coherent,
- 	.free_coherent		= nommu_free_coherent,
- 	.map_sg			= nommu_map_sg,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/pci-swiotlb.c	2010-04-04 20:46:41.521777445 -0400
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
- 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
- 
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- 	.mapping_error = swiotlb_dma_mapping_error,
- 	.alloc_coherent = x86_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/process_32.c linux-2.6.32.12/arch/x86/kernel/process_32.c
---- linux-2.6.32.12/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/process_32.c	2010-04-04 20:46:41.521777445 -0400
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- 	return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX	return tsk->thread.eip;
- }
- 
- #ifndef CONFIG_SMP
-@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
- 	unsigned short ss, gs;
- 	const char *board;
- 
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		sp = regs->sp;
- 		ss = regs->ss & 0xffff;
- 		gs = get_user_gs(regs);
-@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
- 	regs.bx = (unsigned long) fn;
- 	regs.dx = (unsigned long) arg;
- 
--	regs.ds = __USER_DS;
--	regs.es = __USER_DS;
-+	regs.ds = __KERNEL_DS;
-+	regs.es = __KERNEL_DS;
- 	regs.fs = __KERNEL_PERCPU;
- 	regs.gs = __KERNEL_STACK_CANARY;
- 	regs.orig_ax = -1;
-@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
- 	struct task_struct *tsk;
- 	int err;
- 
--	childregs = task_pt_regs(p);
-+	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- 	*childregs = *regs;
- 	childregs->ax = 0;
- 	childregs->sp = sp;
-@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
- 	 * Set a new TLS for the child thread?
- 	 */
- 	if (clone_flags & CLONE_SETTLS)
-+//XXX needs set_fs()?
- 		err = do_set_thread_area(p, -1,
- 			(struct user_desc __user *)childregs->si, 0);
- 
-@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread,
- 				 *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	bool preload_fpu;
- 
- 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
- 	 */
- 	lazy_save_gs(prev->gs);
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
-+		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
-+#endif
-+
- 	/*
- 	 * Load the per-thread Thread-Local Storage descriptor.
- 	 */
-@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
- 	return 0;
- }
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+asmlinkage void pax_randomize_kstack(void)
-+{
-+	struct thread_struct *thread = &current->thread;
-+	unsigned long time;
-+
-+	if (!randomize_va_space)
-+		return;
-+
-+	rdtscl(time);
-+
-+	/* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+	time &= 0x1EUL;
-+	time <<= 2;
-+#else
-+	time &= 0xFUL;
-+	time <<= 3;
-+#endif
-+
-+	thread->sp0 ^= time;
-+	load_sp0(init_tss + smp_processor_id(), thread);
-+}
-+#endif
-diff -urNp linux-2.6.32.12/arch/x86/kernel/process_64.c linux-2.6.32.12/arch/x86/kernel/process_64.c
---- linux-2.6.32.12/arch/x86/kernel/process_64.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/process_64.c	2010-04-04 20:46:41.521777445 -0400
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- 	/* idle loop has pid 0 */
--	if (current->pid)
-+	if (task_pid_nr(current))
- 		return;
- 	__exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
- 	if (!board)
- 		board = "";
- 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version, board);
-@@ -381,7 +381,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread;
- 	struct thread_struct *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	unsigned fsindex, gsindex;
- 	bool preload_fpu;
- 
-@@ -561,12 +561,11 @@ unsigned long get_wchan(struct task_stru
- 	if (!p || p == current || p->state == TASK_RUNNING)
- 		return 0;
- 	stack = (unsigned long)task_stack_page(p);
--	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
- 		return 0;
- 	fp = *(u64 *)(p->thread.sp);
- 	do {
--		if (fp < (unsigned long)stack ||
--		    fp >= (unsigned long)stack+THREAD_SIZE)
-+		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
- 			return 0;
- 		ip = *(u64 *)(fp+8);
- 		if (!in_sched_functions(ip))
-diff -urNp linux-2.6.32.12/arch/x86/kernel/process.c linux-2.6.32.12/arch/x86/kernel/process.c
---- linux-2.6.32.12/arch/x86/kernel/process.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/process.c	2010-04-04 20:46:41.521777445 -0400
-@@ -73,7 +73,7 @@ void exit_thread(void)
- 	unsigned long *bp = t->io_bitmap_ptr;
- 
- 	if (bp) {
--		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+		struct tss_struct *tss = init_tss + get_cpu();
- 
- 		t->io_bitmap_ptr = NULL;
- 		clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +93,9 @@ void flush_thread(void)
- 
- 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
- 
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
-+	loadsegment(gs, 0);
-+#endif
- 	tsk->thread.debugreg0 = 0;
- 	tsk->thread.debugreg1 = 0;
- 	tsk->thread.debugreg2 = 0;
-@@ -600,17 +603,3 @@ static int __init idle_setup(char *str)
- 	return 0;
- }
- early_param("idle", idle_setup);
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() % 8192;
--	return sp & ~0xf;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long range_end = mm->brk + 0x02000000;
--	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
--}
--
-diff -urNp linux-2.6.32.12/arch/x86/kernel/ptrace.c linux-2.6.32.12/arch/x86/kernel/ptrace.c
---- linux-2.6.32.12/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/ptrace.c	2010-04-04 20:46:41.525738446 -0400
-@@ -925,7 +925,7 @@ static const struct user_regset_view use
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- 	int ret;
--	unsigned long __user *datap = (unsigned long __user *)data;
-+	unsigned long __user *datap = (__force unsigned long __user *)data;
- 
- 	switch (request) {
- 	/* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_get_thread_area(child, addr,
--					 (struct user_desc __user *) data);
-+					 (__force struct user_desc __user *) data);
- 		break;
- 
- 	case PTRACE_SET_THREAD_AREA:
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_set_thread_area(child, addr,
--					 (struct user_desc __user *) data, 0);
-+					 (__force struct user_desc __user *) data, 0);
- 		break;
- #endif
- 
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
- #ifdef CONFIG_X86_PTRACE_BTS
- 	case PTRACE_BTS_CONFIG:
- 		ret = ptrace_bts_config
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_STATUS:
- 		ret = ptrace_bts_status
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_GET:
- 		ret = ptrace_bts_read_record
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- 
- 	case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_DRAIN:
- 		ret = ptrace_bts_drain
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- #endif /* CONFIG_X86_PTRACE_BTS */
- 
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
- 	info.si_code = si_code;
- 
- 	/* User-mode ip? */
--	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
- 
- 	/* Send us the fake SIGTRAP */
- 	force_sig_info(SIGTRAP, &info, tsk);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/reboot.c linux-2.6.32.12/arch/x86/kernel/reboot.c
---- linux-2.6.32.12/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/reboot.c	2010-04-04 20:46:41.525738446 -0400
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
- 
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
- 
-@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
- 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static int __init reboot_init(void)
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
-    controller to pulse the CPU reset line, which is more thorough, but
-    doesn't work with at least one type of 486 motherboard.  It is easy
-    to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
--	0x0000000000000000ULL,	/* Null descriptor */
--	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
--	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
-+	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
-+	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
-+	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
- };
- 
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
-  * specified by the code and length parameters.
-  * We assume that length will aways be less that 100!
-  */
--void machine_real_restart(const unsigned char *code, int length)
-+void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- 	local_irq_disable();
- 
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
- 	/* Remap the kernel at virtual address zero, as well as offset zero
- 	   from the kernel segment.  This assumes the kernel segment starts at
- 	   virtual address PAGE_OFFSET. */
--	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
--		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
- 	   boot)".  This seems like a fairly standard thing that gets set by
- 	   REBOOT.COM programs, and the previous reset routine did this
- 	   too. */
--	*((unsigned short *)0x472) = reboot_mode;
-+	*(unsigned short *)(__va(0x472)) = reboot_mode;
- 
- 	/* For the switch to real mode, copy some code to low memory.  It has
- 	   to be in the first 64k because it is running in 16-bit mode, and it
- 	   has to have the same physical and virtual address, because it turns
- 	   off paging.  Copy it near the end of the first page, out of the way
- 	   of BIOS variables. */
--	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
--		real_mode_switch, sizeof (real_mode_switch));
--	memcpy((void *)(0x1000 - 100), code, length);
-+	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+	memcpy(__va(0x1000 - 100), code, length);
- 
- 	/* Set up the IDT for real mode. */
- 	load_idt(&real_mode_idt);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/setup.c linux-2.6.32.12/arch/x86/kernel/setup.c
---- linux-2.6.32.12/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/setup.c	2010-04-04 20:46:41.525738446 -0400
-@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
- 
- 	if (!boot_params.hdr.root_flags)
- 		root_mountflags &= ~MS_RDONLY;
--	init_mm.start_code = (unsigned long) _text;
--	init_mm.end_code = (unsigned long) _etext;
-+	init_mm.start_code = ktla_ktva((unsigned long) _text);
-+	init_mm.end_code = ktla_ktva((unsigned long) _etext);
- 	init_mm.end_data = (unsigned long) _edata;
- 	init_mm.brk = _brk_end;
- 
--	code_resource.start = virt_to_phys(_text);
--	code_resource.end = virt_to_phys(_etext)-1;
--	data_resource.start = virt_to_phys(_etext);
-+	code_resource.start = virt_to_phys(ktla_ktva(_text));
-+	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+	data_resource.start = virt_to_phys(_sdata);
- 	data_resource.end = virt_to_phys(_edata)-1;
- 	bss_resource.start = virt_to_phys(&__bss_start);
- 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/setup_percpu.c linux-2.6.32.12/arch/x86/kernel/setup_percpu.c
---- linux-2.6.32.12/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/setup_percpu.c	2010-04-04 20:46:41.525738446 -0400
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
- 
-+#ifdef CONFIG_SMP
- DEFINE_PER_CPU(int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
- 
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
- 
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
- 
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
- {
- #ifdef CONFIG_X86_32
- 	struct desc_struct gdt;
-+	unsigned long base = per_cpu_offset(cpu);
- 
--	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
--			0x2 | DESCTYPE_S, 0x8);
--	gdt.s = 1;
-+	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+			0x83 | DESCTYPE_S, 0xC);
- 	write_gdt_entry(get_cpu_gdt_table(cpu),
- 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- 	/* alrighty, percpu areas up and running */
- 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- 	for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		unsigned long canary = per_cpu(stack_canary, cpu);
-+#endif
-+#endif
- 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- 		per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		if (cpu == boot_cpu_id)
-+			per_cpu(stack_canary, cpu) = canary;
-+#endif
-+#endif
- 		/*
- 		 * Up to this point, the boot CPU has been using .data.init
- 		 * area.  Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.32.12/arch/x86/kernel/signal.c linux-2.6.32.12/arch/x86/kernel/signal.c
---- linux-2.6.32.12/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/signal.c	2010-04-04 20:46:41.525738446 -0400
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
- 	 * Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
- 	 */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- 	sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
- 	 * Return an always-bogus address instead so we will die with SIGSEGV.
- 	 */
- 	if (onsigstack && !likely(on_sig_stack(sp)))
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	/* save i387 state */
- 	if (used_math() && save_i387_xstate(*fpstate) < 0)
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
- 	}
- 
- 	if (current->mm->context.vdso)
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- 	else
--		restorer = &frame->retcode;
-+		restorer = (void __user *)&frame->retcode;
- 	if (ka->sa.sa_flags & SA_RESTORER)
- 		restorer = ka->sa.sa_restorer;
- 
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
- 	 * reasons and because gdb uses it as a signature to notice
- 	 * signal handler stack frames.
- 	 */
--	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
- 
- 	if (err)
- 		return -EFAULT;
-@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
- 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
- 
- 		/* Set up to return from userspace.  */
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- 		if (ka->sa.sa_flags & SA_RESTORER)
- 			restorer = ka->sa.sa_restorer;
- 		put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
- 		 * reasons and because gdb uses it as a signature to notice
- 		 * signal handler stack frames.
- 		 */
--		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- 	} put_user_catch(err);
- 
- 	if (err)
-@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
- 	 * X86_32: vm86 regs switched out by assembly code before reaching
- 	 * here, so testing against kernel CS suffices.
- 	 */
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		return;
- 
- 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/smpboot.c linux-2.6.32.12/arch/x86/kernel/smpboot.c
---- linux-2.6.32.12/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/smpboot.c	2010-04-04 20:58:33.225084964 -0400
-@@ -729,7 +729,11 @@ do_rest:
- 		(unsigned long)task_stack_page(c_idle.idle) -
- 		KERNEL_STACK_OFFSET + THREAD_SIZE;
- #endif
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+	pax_close_kernel();
-+
- 	initial_code = (unsigned long)start_secondary;
- 	stack_start.sp = (void *) c_idle.idle->thread.sp;
- 
-@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
- 
- 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_X86_32
- 	/* init low mem mapping */
- 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-diff -urNp linux-2.6.32.12/arch/x86/kernel/step.c linux-2.6.32.12/arch/x86/kernel/step.c
---- linux-2.6.32.12/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/step.c	2010-04-04 20:46:41.525738446 -0400
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
- 		struct desc_struct *desc;
- 		unsigned long base;
- 
--		seg &= ~7UL;
-+		seg >>= 3;
- 
- 		mutex_lock(&child->mm->context.lock);
--		if (unlikely((seg >> 3) >= child->mm->context.size))
-+		if (unlikely(seg >= child->mm->context.size))
- 			addr = -1L; /* bogus selector, access would fault */
- 		else {
- 			desc = child->mm->context.ldt + seg;
-@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
- 	unsigned char opcode[15];
- 	unsigned long addr = convert_ip_to_linear(child, regs);
- 
-+	if (addr == -EINVAL)
-+		return 0;
-+
- 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- 	for (i = 0; i < copied; i++) {
- 		switch (opcode[i]) {
-@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
- 
- #ifdef CONFIG_X86_64
- 		case 0x40 ... 0x4f:
--			if (regs->cs != __USER_CS)
-+			if ((regs->cs & 0xffff) != __USER_CS)
- 				/* 32-bit mode: register increment */
- 				return 0;
- 			/* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/syscall_table_32.S	2010-04-04 20:46:41.525738446 -0400
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
- 	.long sys_exit
-diff -urNp linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/sys_i386_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -24,6 +24,21 @@
- 
- #include <asm/syscalls.h>
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,205 @@ out:
- 	return err;
- }
- 
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+		unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+	struct mm_struct *mm = current->mm;
-+	struct vm_area_struct *vma;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+		    (!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+	if (len > mm->cached_hole_size) {
-+		start_addr = addr = mm->free_area_cache;
-+	} else {
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
-+	}
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+		start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+			start_addr = addr = mm->mmap_base;
-+		else
-+			addr = start_addr;
-+	}
-+#endif
-+
-+full_search:
-+	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+		/* At this point:  (!vma || addr < vma->vm_end). */
-+		if (pax_task_size - len < addr) {
-+			/*
-+			 * Start a new search - just in case we missed
-+			 * some holes.
-+			 */
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
-+				mm->cached_hole_size = 0;
-+				goto full_search;
-+			}
-+			return -ENOMEM;
-+		}
-+		if (!vma || addr + len <= vma->vm_start) {
-+			/*
-+			 * Remember the place where we stopped the search:
-+			 */
-+			mm->free_area_cache = addr + len;
-+			return addr;
-+		}
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+		addr = vma->vm_end;
-+		if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+			start_addr = addr = mm->mmap_base;
-+			mm->cached_hole_size = 0;
-+			goto full_search;
-+		}
-+	}
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+			  const unsigned long len, const unsigned long pgoff,
-+			  const unsigned long flags)
-+{
-+	struct vm_area_struct *vma;
-+	struct mm_struct *mm = current->mm;
-+	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	/* requested length too big for entire address space */
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+		goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	/* requesting a specific address */
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+				(!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+
-+	/* check if free_area_cache is useful for us */
-+	if (len <= mm->cached_hole_size) {
-+		mm->cached_hole_size = 0;
-+		mm->free_area_cache = mm->mmap_base;
-+	}
-+
-+	/* either no address requested or can't fit in requested address hole */
-+	addr = mm->free_area_cache;
-+
-+	/* make sure it can fit in the remaining address space */
-+	if (addr > len) {
-+		vma = find_vma(mm, addr-len);
-+		if (!vma || addr <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr-len);
-+	}
-+
-+	if (mm->mmap_base < len)
-+		goto bottomup;
-+
-+	addr = mm->mmap_base-len;
-+
-+	do {
-+		/*
-+		 * Lookup failure means no vma is above this address,
-+		 * else if new region fits below vma->vm_start,
-+		 * return with success:
-+		 */
-+		vma = find_vma(mm, addr);
-+		if (!vma || addr+len <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr);
-+
-+		/* remember the largest hole we saw so far */
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+
-+		/* try just below the current vma->vm_start */
-+		addr = vma->vm_start-len;
-+	} while (len < vma->vm_start);
-+
-+bottomup:
-+	/*
-+	 * A failed mmap() very likely causes application failure,
-+	 * so fall back to the bottom-up function here. This scenario
-+	 * can happen with large stack limits and large mmap()
-+	 * allocations.
-+	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
-+	mm->cached_hole_size = ~0UL;
-+	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+	/*
-+	 * Restore the topdown base:
-+	 */
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
-+	mm->cached_hole_size = ~0UL;
-+
-+	return addr;
-+}
- 
- struct sel_arg_struct {
- 	unsigned long n;
-@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- 	case SEMTIMEDOP:
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
--					(const struct timespec __user *)fifth);
-+					(__force const struct timespec __user *)fifth);
- 
- 	case SEMGET:
- 		return sys_semget(first, second, third);
-@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- 			if (ret)
- 				return ret;
--			return put_user(raddr, (ulong __user *) third);
-+			return put_user(raddr, (__force ulong __user *) third);
- 		}
- 		case 1:	/* iBCS2 emulator entry point */
- 			if (!segment_eq(get_fs(), get_ds()))
-diff -urNp linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/sys_x86_64.c	2010-04-04 20:46:41.525738446 -0400
-@@ -32,8 +32,8 @@ out:
- 	return error;
- }
- 
--static void find_start_end(unsigned long flags, unsigned long *begin,
--			   unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+			   unsigned long *begin, unsigned long *end)
- {
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- 		unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
- 				*begin = new_begin;
- 		}
- 	} else {
--		*begin = TASK_UNMAPPED_BASE;
-+		*begin = mm->mmap_base;
- 		*end = TASK_SIZE;
- 	}
- }
-@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
--	find_start_end(flags, &begin, &end);
-+	find_start_end(mm, flags, &begin, &end);
- 
- 	if (len > end)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- 		goto bottomup;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -198,13 +206,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/time.c linux-2.6.32.12/arch/x86/kernel/time.c
---- linux-2.6.32.12/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/time.c	2010-04-04 20:46:41.525738446 -0400
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
- 
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- 	unsigned long pc = instruction_pointer(regs);
- 
--	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+	if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
--		return *(unsigned long *)(regs->bp + sizeof(long));
-+		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- 		unsigned long *sp =
- 			(unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
- 		 * or above a saved flags. Eflags has bits 22-31 zero,
- 		 * kernel addresses don't.
- 		 */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		return ktla_ktva(sp[0]);
-+#else
- 		if (sp[0] >> 22)
- 			return sp[0];
- 		if (sp[1] >> 22)
- 			return sp[1];
- #endif
-+
-+#endif
- 	}
- 	return pc;
- }
-diff -urNp linux-2.6.32.12/arch/x86/kernel/tls.c linux-2.6.32.12/arch/x86/kernel/tls.c
---- linux-2.6.32.12/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/tls.c	2010-04-04 20:46:41.525738446 -0400
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
- 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+		return -EINVAL;
-+#endif
-+
- 	set_tls_desc(p, idx, &info, 1);
- 
- 	return 0;
-diff -urNp linux-2.6.32.12/arch/x86/kernel/trampoline_32.S linux-2.6.32.12/arch/x86/kernel/trampoline_32.S
---- linux-2.6.32.12/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/trampoline_32.S	2010-04-04 20:46:41.525738446 -0400
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- 	inc	%ax		# protected mode (PE) bit
- 	lmsw	%ax		# into protected mode
- 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
--	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
- 
- 	# These need to be in the same 64K segment as the above;
- 	# hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.32.12/arch/x86/kernel/traps.c linux-2.6.32.12/arch/x86/kernel/traps.c
---- linux-2.6.32.12/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/traps.c	2010-04-04 20:46:41.525738446 -0400
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
- 
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
- 
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		die(str, regs, err);
- }
- #endif
- 
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- 	long error_code, siginfo_t *info)
- {
- 	struct task_struct *tsk = current;
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		/*
- 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- 		 * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
- 	}
- #endif
- 
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto kernel_trap;
- 
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- 	    printk_ratelimit()) {
- 		printk(KERN_INFO
- 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
--		       tsk->comm, tsk->pid, str,
-+		       tsk->comm, task_pid_nr(tsk), str,
- 		       regs->ip, regs->sp, error_code);
- 		print_vma_addr(" in ", regs->ip);
- 		printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- 	if (!fixup_exception(regs)) {
- 		tsk->thread.error_code = error_code;
- 		tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+			str = "PAX: suspicious stack segment fault";
-+#endif
-+
- 		die(str, regs, error_code);
- 	}
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (trapnr == 4)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	return;
- 
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
- 	conditional_sti(regs);
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto gp_in_vm86;
- #endif
- 
- 	tsk = current;
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto gp_in_kernel;
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+		struct mm_struct *mm = tsk->mm;
-+		unsigned long limit;
-+
-+		down_write(&mm->mmap_sem);
-+		limit = mm->context.user_cs_limit;
-+		if (limit < TASK_SIZE) {
-+			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+			up_write(&mm->mmap_sem);
-+			return;
-+		}
-+		up_write(&mm->mmap_sem);
-+	}
-+#endif
-+
- 	tsk->thread.error_code = error_code;
- 	tsk->thread.trap_no = 13;
- 
-@@ -305,6 +327,13 @@ gp_in_kernel:
- 	if (notify_die(DIE_GPF, "general protection fault", regs,
- 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
- 		return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+		die("PAX: suspicious general protection fault", regs, error_code);
-+	else
-+#endif
-+
- 	die("general protection fault", regs, error_code);
- }
- 
-@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
- 	}
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto debug_vm86;
- #endif
- 
-@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
- 	 * kernel space (but re-enable TF when returning to user mode).
- 	 */
- 	if (condition & DR_STEP) {
--		if (!user_mode(regs))
-+		if (!user_mode_novm(regs))
- 			goto clear_TF_reenable;
- 	}
- 
-@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
- 	 * Handle strange cache flush from user space exception
- 	 * in all other cases.  This is undocumented behaviour.
- 	 */
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- 		return;
- 	}
-diff -urNp linux-2.6.32.12/arch/x86/kernel/tsc.c linux-2.6.32.12/arch/x86/kernel/tsc.c
---- linux-2.6.32.12/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/tsc.c	2010-04-04 20:46:41.525738446 -0400
-@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
- 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static void __init check_system_tsc_reliable(void)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/vm86_32.c linux-2.6.32.12/arch/x86/kernel/vm86_32.c
---- linux-2.6.32.12/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/vm86_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
- 
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
- 		do_exit(SIGSEGV);
- 	}
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	current->thread.sp0 = current->thread.saved_sp0;
- 	current->thread.sysenter_cs = __KERNEL_CS;
- 	load_sp0(tss, &current->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- 	struct task_struct *tsk;
- 	int tmp, ret = -EPERM;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	if (tsk->thread.saved_sp0)
- 		goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- 	int tmp, ret;
- 	struct vm86plus_struct __user *v86;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		ret = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	switch (regs->bx) {
- 	case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
- 	tsk->thread.saved_fs = info->regs32->fs;
- 	tsk->thread.saved_gs = get_user_gs(info->regs32);
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- 	if (cpu_has_sep)
- 		tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
- 		goto cannot_handle;
- 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- 		goto cannot_handle;
--	intr_ptr = (unsigned long __user *) (i << 2);
-+	intr_ptr = (__force unsigned long __user *) (i << 2);
- 	if (get_user(segoffs, intr_ptr))
- 		goto cannot_handle;
- 	if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.32.12/arch/x86/kernel/vmi_32.c linux-2.6.32.12/arch/x86/kernel/vmi_32.c
---- linux-2.6.32.12/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/vmi_32.c	2010-04-04 20:46:41.525738446 -0400
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
- 
- #define call_vrom_func(rom,func) \
--   (((VROMFUNC *)(rom->func))())
-+   (((VROMFUNC *)(ktva_ktla(rom.func)))())
- 
- #define call_vrom_long_func(rom,func,arg) \
--   (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+	__reloc;\
-+})
- 
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- 	void (*set_initial_ap_state)(int, int);
- 	void (*halt)(void);
-   	void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} vmi_ops __read_only;
- 
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
- 
- /*
-  * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- 				unsigned long ip, unsigned long dest)
- {
--        *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+	*(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
- 
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
- {
- 	u64 reloc;
- 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
- 	switch(rel->type) {
- 		case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
- 
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
- 
- static void vmi_pmd_clear(pmd_t *pmd)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
- 	ap.ss = __KERNEL_DS;
- 	ap.esp = (unsigned long) start_esp;
- 
--	ap.ds = __USER_DS;
--	ap.es = __USER_DS;
-+	ap.ds = __KERNEL_DS;
-+	ap.es = __KERNEL_DS;
- 	ap.fs = __KERNEL_PERCPU;
- 	ap.gs = __KERNEL_STACK_CANARY;
- 
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- 	paravirt_leave_lazy_mmu();
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+	return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+	return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- 	struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
- 		return 0;
- 	if (rom->vrom_signature != VMI_SIGNATURE)
- 		return 0;
-+	if (rom->rom_length * 512 > sizeof(*rom)) {
-+		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+		return 0;
-+	}
- 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
- 		struct vrom_header *romstart;
- 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
- 		if (check_vmi_rom(romstart)) {
--			vmi_rom = romstart;
-+			vmi_rom = *romstart;
- 			return 1;
- 		}
- 	}
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
- 
- 	para_fill(pv_irq_ops.safe_halt, Halt);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- 	/*
- 	 * Alternative instruction rewriting doesn't happen soon enough
- 	 * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
- 
- void __init vmi_init(void)
- {
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		probe_vmi_rom();
- 	else
--		check_vmi_rom(vmi_rom);
-+		check_vmi_rom(&vmi_rom);
- 
- 	/* In case probing for or validating the ROM failed, basil */
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
--	reserve_top_address(-vmi_rom->virtual_top);
-+	reserve_top_address(-vmi_rom.virtual_top);
- 
- #ifdef CONFIG_X86_IO_APIC
- 	/* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- 	unsigned long flags;
- 
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/vmlinux.lds.S	2010-04-04 20:46:41.529538490 -0400
-@@ -26,6 +26,22 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#undef PMD_SIZE
-+#undef PMD_SHIFT
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+#define PMD_SHIFT 21
-+#else
-+#define PMD_SHIFT 22
-+#endif
-+#define PMD_SIZE (1 << PMD_SHIFT)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET	0
-+#endif
- 
- #undef i386     /* in case the preprocessor is a 32bit one */
- 
-@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
- 
-+jiffies = jiffies_64;
-+
- PHDRS {
- 	text PT_LOAD FLAGS(5);          /* R_E */
--	data PT_LOAD FLAGS(7);          /* RWE */
-+#ifdef CONFIG_XEN
-+	rodata PT_LOAD FLAGS(5);        /* R_E */
-+#else
-+	rodata PT_LOAD FLAGS(4);        /* R__ */
-+#endif
-+#ifdef CONFIG_X86_32
-+	module PT_LOAD FLAGS(5);        /* R_E */
-+#endif
-+	data PT_LOAD FLAGS(6);          /* RW_ */
- #ifdef CONFIG_X86_64
- 	user PT_LOAD FLAGS(5);          /* R_E */
-+#endif
-+	init.begin PT_LOAD FLAGS(6);    /* RW_ */
- #ifdef CONFIG_SMP
- 	percpu PT_LOAD FLAGS(6);        /* RW_ */
- #endif
-+	text.init PT_LOAD FLAGS(5);     /* R_E */
-+	text.exit PT_LOAD FLAGS(5);     /* R_E */
- 	init PT_LOAD FLAGS(7);          /* RWE */
--#endif
- 	note PT_NOTE FLAGS(0);          /* ___ */
- }
- 
- SECTIONS
- {
- #ifdef CONFIG_X86_32
--        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
--        phys_startup_32 = startup_32 - LOAD_OFFSET;
-+	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
--        . = __START_KERNEL;
--        phys_startup_64 = startup_64 - LOAD_OFFSET;
-+	. = __START_KERNEL;
- #endif
- 
- 	/* Text and read-only data */
--	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
--		_text = .;
-+	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- 		/* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+		_text = .;
- 		HEAD_TEXT
- #ifdef CONFIG_X86_32
- 		. = ALIGN(PAGE_SIZE);
-@@ -82,28 +113,64 @@ SECTIONS
- 		IRQENTRY_TEXT
- 		*(.fixup)
- 		*(.gnu.warning)
--		/* End of text section */
--		_etext = .;
- 	} :text = 0x9090
- 
--	NOTES :text :note
-+	. += __KERNEL_TEXT_OFFSET;
-+
-+	. = ALIGN(PAGE_SIZE);
-+	NOTES :rodata :note
- 
--	EXCEPTION_TABLE(16) :text = 0x9090
-+	EXCEPTION_TABLE(16) :rodata
- 
- 	RO_DATA(PAGE_SIZE)
- 
-+#ifdef CONFIG_X86_32
-+	. = ALIGN(PAGE_SIZE);
-+	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+		*(.idt)
-+		. = ALIGN(PAGE_SIZE);
-+		*(.empty_zero_page)
-+		*(.swapper_pg_pmd)
-+		*(.swapper_pg_dir)
-+	}
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+		*(.vmi.rom)
-+	} :module
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+		MODULES_EXEC_VADDR = .;
-+		BYTE(0)
-+		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+		. = ALIGN(PMD_SIZE);
-+		MODULES_EXEC_END = . - 1;
-+#endif
-+
-+	} :module
-+#endif
-+
- 	/* Data */
- 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
-+		/* End of text section */
-+		_etext = . - __KERNEL_TEXT_OFFSET;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	. = ALIGN(PMD_SIZE);
-+#else
-+	. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		/* Start of data section */
- 		_sdata = .;
- 
- 		/* init_task */
- 		INIT_TASK_DATA(THREAD_SIZE)
- 
--#ifdef CONFIG_X86_32
--		/* 32 bit has nosave before _edata */
- 		NOSAVE_DATA
--#endif
- 
- 		PAGE_ALIGNED_DATA(PAGE_SIZE)
- 
-@@ -166,12 +233,6 @@ SECTIONS
- 	}
- 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
- 
--	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
--	.jiffies : AT(VLOAD(.jiffies)) {
--		*(.jiffies)
--	}
--	jiffies = VVIRT(.jiffies);
--
- 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- 		*(.vsyscall_3)
- 	}
-@@ -187,12 +248,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
- 
- 	/* Init code and data - will be freed after init */
--	. = ALIGN(PAGE_SIZE);
- 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+		BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		. = ALIGN(PMD_SIZE);
-+#else
-+		. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		__init_begin = .; /* paired with __init_end */
--	}
-+	} :init.begin
- 
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- 	/*
- 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
- 	 * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +269,27 @@ SECTIONS
- 	PERCPU_VADDR(0, :percpu)
- #endif
- 
--	INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
--	:init
--#endif
-+	. = ALIGN(PAGE_SIZE);
-+	init_begin = .;
-+	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+		VMLINUX_SYMBOL(_sinittext) = .;
-+		INIT_TEXT
-+		VMLINUX_SYMBOL(_einittext) = .;
-+		. = ALIGN(PAGE_SIZE);
-+	} :text.init
-+
-+	/*
-+	 * .exit.text is discard at runtime, not link time, to deal with
-+	 *  references from .altinstructions and .eh_frame
-+	 */
-+	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-+		EXIT_TEXT
-+		. = ALIGN(16);
-+	} :text.exit
-+	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
- 
--	INIT_DATA_SECTION(16)
-+	. = ALIGN(PAGE_SIZE);
-+	INIT_DATA_SECTION(16) :init
- 
- 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- 		__x86_cpu_dev_start = .;
-@@ -232,19 +315,11 @@ SECTIONS
- 		*(.altinstr_replacement)
- 	}
- 
--	/*
--	 * .exit.text is discard at runtime, not link time, to deal with
--	 *  references from .altinstructions and .eh_frame
--	 */
--	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
--		EXIT_TEXT
--	}
--
- 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- 		EXIT_DATA
- 	}
- 
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- 	PERCPU(PAGE_SIZE)
- #endif
- 
-@@ -267,12 +342,6 @@ SECTIONS
- 		. = ALIGN(PAGE_SIZE);
- 	}
- 
--#ifdef CONFIG_X86_64
--	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
--		NOSAVE_DATA
--	}
--#endif
--
- 	/* BSS */
- 	. = ALIGN(PAGE_SIZE);
- 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +357,7 @@ SECTIONS
- 		__brk_base = .;
- 		. += 64 * 1024;		/* 64k alignment slop space */
- 		*(.brk_reservation)	/* areas brk users have reserved */
-+		. = ALIGN(PMD_SIZE);
- 		__brk_limit = .;
- 	}
- 
-@@ -316,13 +386,12 @@ SECTIONS
-  * for the boot processor.
-  */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
- 
- /*
-  * Build-time check on the image size:
-  */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/vsyscall_64.c	2010-04-04 20:46:41.529538490 -0400
-@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
- 
- 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- 	/* copy vsyscall data */
-+	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- 	vsyscall_gtod_data.clock.vread = clock->vread;
- 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- 	vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
- 	   We do this here because otherwise user space would do it on
- 	   its own in a likely inferior way (no access to jiffies).
- 	   If you don't like it pass NULL. */
--	if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+	if (tcache && tcache->blob[0] == (j = jiffies)) {
- 		p = tcache->blob[1];
- 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- 		/* Load per CPU data from RDTSCP */
-@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
- 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
- 	  .mode = 0644,
- 	  .proc_handler = proc_dointvec },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table kernel_root_table2[] = {
- 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
- 	  .child = kernel_table2 },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/x8664_ksyms_64.c	2010-04-04 20:46:41.529538490 -0400
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
- 
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
- 
- EXPORT_SYMBOL(copy_page);
-diff -urNp linux-2.6.32.12/arch/x86/kernel/xsave.c linux-2.6.32.12/arch/x86/kernel/xsave.c
---- linux-2.6.32.12/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kernel/xsave.c	2010-04-04 20:46:41.529538490 -0400
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
- 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
- 		return -1;
- 
--	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- 					    fx_sw_user->extended_size -
- 					    FP_XSTATE_MAGIC2_SIZE));
- 	/*
-@@ -196,7 +196,7 @@ fx_only:
- 	 * the other extended state.
- 	 */
- 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
--	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
- 
- /*
-@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
- 	if (task_thread_info(tsk)->status & TS_XSAVE)
- 		err = restore_user_xstate(buf);
- 	else
--		err = fxrstor_checking((__force struct i387_fxsave_struct *)
-+		err = fxrstor_checking((struct i387_fxsave_struct __user *)
- 				       buf);
- 	if (unlikely(err)) {
- 		/*
-diff -urNp linux-2.6.32.12/arch/x86/kvm/emulate.c linux-2.6.32.12/arch/x86/kvm/emulate.c
---- linux-2.6.32.12/arch/x86/kvm/emulate.c	2010-04-29 17:49:37.541027029 -0400
-+++ linux-2.6.32.12/arch/x86/kvm/emulate.c	2010-04-29 17:49:57.993228946 -0400
-@@ -81,8 +81,8 @@
- #define Src2CL      (1<<29)
- #define Src2ImmByte (2<<29)
- #define Src2One     (3<<29)
--#define Src2Imm16   (4<<29)
--#define Src2Mask    (7<<29)
-+#define Src2Imm16   (4U<<29)
-+#define Src2Mask    (7U<<29)
- 
- enum {
- 	Group1_80, Group1_81, Group1_82, Group1_83,
-@@ -411,6 +411,7 @@ static u32 group2_table[] = {
- 
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
- 	do {								\
-+		unsigned long _tmp;					\
- 		__asm__ __volatile__ (					\
- 			_PRE_EFLAGS("0", "4", "2")			\
- 			_op _suffix " %"_x"3,%1; "			\
-@@ -424,8 +425,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								\
--		unsigned long _tmp;					\
--									\
- 		switch ((_dst).bytes) {					\
- 		case 2:							\
- 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -441,7 +440,6 @@ static u32 group2_table[] = {
- 
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								     \
--		unsigned long _tmp;					     \
- 		switch ((_dst).bytes) {				             \
- 		case 1:							     \
- 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
-diff -urNp linux-2.6.32.12/arch/x86/kvm/lapic.c linux-2.6.32.12/arch/x86/kvm/lapic.c
---- linux-2.6.32.12/arch/x86/kvm/lapic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/kvm/lapic.c	2010-04-29 17:46:37.073091406 -0400
-@@ -52,7 +52,7 @@
- #define APIC_BUS_CYCLE_NS 1
- 
- /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
--#define apic_debug(fmt, arg...)
-+#define apic_debug(fmt, arg...) do {} while (0)
- 
- #define APIC_LVT_NUM			6
- /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff -urNp linux-2.6.32.12/arch/x86/kvm/svm.c linux-2.6.32.12/arch/x86/kvm/svm.c
---- linux-2.6.32.12/arch/x86/kvm/svm.c	2010-04-29 17:49:37.601044544 -0400
-+++ linux-2.6.32.12/arch/x86/kvm/svm.c	2010-04-29 17:49:58.005400983 -0400
-@@ -2395,9 +2395,12 @@ static int handle_exit(struct kvm_run *k
- static void reload_tss(struct kvm_vcpu *vcpu)
- {
- 	int cpu = raw_smp_processor_id();
--
- 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+	pax_open_kernel();
- 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -2845,7 +2848,7 @@ static bool svm_gb_page_enable(void)
- 	return true;
- }
- 
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- 	.cpu_has_kvm_support = has_svm,
- 	.disabled_by_bios = is_disabled,
- 	.hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.32.12/arch/x86/kvm/vmx.c linux-2.6.32.12/arch/x86/kvm/vmx.c
---- linux-2.6.32.12/arch/x86/kvm/vmx.c	2010-04-29 17:49:37.601044544 -0400
-+++ linux-2.6.32.12/arch/x86/kvm/vmx.c	2010-04-29 17:49:58.025065700 -0400
-@@ -568,7 +568,11 @@ static void reload_tss(void)
- 
- 	kvm_get_gdt(&gdt);
- 	descs = (void *)gdt.base;
-+
-+	pax_open_kernel();
- 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -1395,8 +1399,11 @@ static __init int hardware_setup(void)
- 	if (!cpu_has_vmx_flexpriority())
- 		flexpriority_enabled = 0;
- 
--	if (!cpu_has_vmx_tpr_shadow())
--		kvm_x86_ops->update_cr8_intercept = NULL;
-+	if (!cpu_has_vmx_tpr_shadow()) {
-+		pax_open_kernel();
-+		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+		pax_close_kernel();
-+	}
- 
- 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
- 		kvm_disable_largepages();
-@@ -2347,7 +2354,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
- 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
- 
- 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
--	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3703,6 +3710,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		"jmp .Lkvm_vmx_return \n\t"
- 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- 		".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+		".Lkvm_vmx_return2: "
-+#endif
-+
- 		/* Save guest registers, load host registers, keep flags */
- 		"xchg %0,     (%%"R"sp) \n\t"
- 		"mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3749,6 +3762,11 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- 	      : "cc", "memory"
- 		, R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
-@@ -3767,7 +3785,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 	if (vmx->rmode.irq.pending)
- 		fixup_rmode_irq(vmx);
- 
--	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
- 	vmx->launched = 1;
- 
- 	vmx_complete_interrupts(vmx);
-@@ -3942,7 +3960,7 @@ static bool vmx_gb_page_enable(void)
- 	return false;
- }
- 
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- 	.cpu_has_kvm_support = cpu_has_kvm_support,
- 	.disabled_by_bios = vmx_disabled_by_bios,
- 	.hardware_setup = hardware_setup,
-diff -urNp linux-2.6.32.12/arch/x86/kvm/x86.c linux-2.6.32.12/arch/x86/kvm/x86.c
---- linux-2.6.32.12/arch/x86/kvm/x86.c	2010-04-29 17:49:37.601044544 -0400
-+++ linux-2.6.32.12/arch/x86/kvm/x86.c	2010-04-29 17:49:58.041485405 -0400
-@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- 				    struct kvm_cpuid_entry2 __user *entries);
- 
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
- 
- int ignore_msrs = 0;
- module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
- 
- struct kvm_stats_debugfs_item debugfs_entries[] = {
--	{ "pf_fixed", VCPU_STAT(pf_fixed) },
--	{ "pf_guest", VCPU_STAT(pf_guest) },
--	{ "tlb_flush", VCPU_STAT(tlb_flush) },
--	{ "invlpg", VCPU_STAT(invlpg) },
--	{ "exits", VCPU_STAT(exits) },
--	{ "io_exits", VCPU_STAT(io_exits) },
--	{ "mmio_exits", VCPU_STAT(mmio_exits) },
--	{ "signal_exits", VCPU_STAT(signal_exits) },
--	{ "irq_window", VCPU_STAT(irq_window_exits) },
--	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
--	{ "halt_exits", VCPU_STAT(halt_exits) },
--	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
--	{ "hypercalls", VCPU_STAT(hypercalls) },
--	{ "request_irq", VCPU_STAT(request_irq_exits) },
--	{ "irq_exits", VCPU_STAT(irq_exits) },
--	{ "host_state_reload", VCPU_STAT(host_state_reload) },
--	{ "efer_reload", VCPU_STAT(efer_reload) },
--	{ "fpu_reload", VCPU_STAT(fpu_reload) },
--	{ "insn_emulation", VCPU_STAT(insn_emulation) },
--	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
--	{ "irq_injections", VCPU_STAT(irq_injections) },
--	{ "nmi_injections", VCPU_STAT(nmi_injections) },
--	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
--	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
--	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
--	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
--	{ "mmu_flooded", VM_STAT(mmu_flooded) },
--	{ "mmu_recycled", VM_STAT(mmu_recycled) },
--	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
--	{ "mmu_unsync", VM_STAT(mmu_unsync) },
--	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
--	{ "largepages", VM_STAT(lpages) },
-+	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
-+	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
-+	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
-+	{ "invlpg", VCPU_STAT(invlpg), NULL },
-+	{ "exits", VCPU_STAT(exits), NULL },
-+	{ "io_exits", VCPU_STAT(io_exits), NULL },
-+	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
-+	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
-+	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
-+	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
-+	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
-+	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
-+	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
-+	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
-+	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
-+	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
-+	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
-+	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
-+	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
-+	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
-+	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
-+	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
-+	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
-+	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
-+	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
-+	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
-+	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
-+	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
-+	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
-+	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
-+	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
-+	{ "largepages", VM_STAT(lpages), NULL },
- 	{ NULL }
- };
- 
-@@ -1635,7 +1635,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- 				    struct kvm_interrupt *irq)
- {
--	if (irq->irq < 0 || irq->irq >= 256)
-+	if (irq->irq >= 256)
- 		return -EINVAL;
- 	if (irqchip_in_kernel(vcpu->kvm))
- 		return -ENXIO;
-@@ -3205,10 +3205,10 @@ static struct notifier_block kvmclock_cp
-         .notifier_call  = kvmclock_cpufreq_notifier
- };
- 
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- 	int r, cpu;
--	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
- 
- 	if (kvm_x86_ops) {
- 		printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.32.12/arch/x86/lib/checksum_32.S linux-2.6.32.12/arch/x86/lib/checksum_32.S
---- linux-2.6.32.12/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/checksum_32.S	2010-04-04 20:46:41.529538490 -0400
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--				
-+#include <asm/segment.h>
-+
- /*
-  * computes a partial checksum, e.g. for TCP/UDP fragments
-  */
-@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
- 
- #define ARGBASE 16		
- #define FP		12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	subl  $4,%esp	
- 	CFI_ADJUST_CFA_OFFSET 4
- 	pushl %edi
-@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
- 	jmp 4f
- SRC(1:	movw (%esi), %bx	)
- 	addl $2, %esi
--DST(	movw %bx, (%edi)	)
-+DST(	movw %bx, %es:(%edi)	)
- 	addl $2, %edi
- 	addw %bx, %ax	
- 	adcl $0, %eax
-@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
- SRC(1:	movl (%esi), %ebx	)
- SRC(	movl 4(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 4(%edi)	)
-+DST(	movl %edx, %es:4(%edi)	)
- 
- SRC(	movl 8(%esi), %ebx	)
- SRC(	movl 12(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 8(%edi)	)
-+DST(	movl %ebx, %es:8(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 12(%edi)	)
-+DST(	movl %edx, %es:12(%edi)	)
- 
- SRC(	movl 16(%esi), %ebx 	)
- SRC(	movl 20(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 16(%edi)	)
-+DST(	movl %ebx, %es:16(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 20(%edi)	)
-+DST(	movl %edx, %es:20(%edi)	)
- 
- SRC(	movl 24(%esi), %ebx	)
- SRC(	movl 28(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 24(%edi)	)
-+DST(	movl %ebx, %es:24(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 28(%edi)	)
-+DST(	movl %edx, %es:28(%edi)	)
- 
- 	lea 32(%esi), %esi
- 	lea 32(%edi), %edi
-@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
- 	shrl $2, %edx			# This clears CF
- SRC(3:	movl (%esi), %ebx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	lea 4(%esi), %esi
- 	lea 4(%edi), %edi
- 	dec %edx
-@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
- 	jb 5f
- SRC(	movw (%esi), %cx	)
- 	leal 2(%esi), %esi
--DST(	movw %cx, (%edi)	)
-+DST(	movw %cx, %es:(%edi)	)
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%ecx
- SRC(5:	movb (%esi), %cl	)
--DST(	movb %cl, (%edi)	)
-+DST(	movb %cl, %es:(%edi)	)
- 6:	addl %ecx, %eax
- 	adcl $0, %eax
- 7:
-@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
- 
- 6001:
- 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 
- 	# zero the complete destination - computing the rest
- 	# is too much work 
-@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
- 
- 6002:
- 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT,(%ebx)
-+	movl $-EFAULT,%ss:(%ebx)
- 	jmp 5000b
- 
- .previous
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE ebx
-@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
- 	CFI_ADJUST_CFA_OFFSET -4
- 	ret	
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 
- #else
- 
- /* Version for PentiumII/PPro */
- 
- #define ROUND1(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	addl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	; 
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ROUND(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	adcl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	;
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ARGBASE 12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
-@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
- 	subl %ebx, %edi  
- 	lea  -1(%esi),%edx
- 	andl $-32,%edx
--	lea 3f(%ebx,%ebx), %ebx
-+	lea 3f(%ebx,%ebx,2), %ebx
- 	testl %esi, %esi 
- 	jmp *%ebx
- 1:	addl $64,%esi
-@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
- 	jb 5f
- SRC(	movw (%esi), %dx         )
- 	leal 2(%esi), %esi
--DST(	movw %dx, (%edi)         )
-+DST(	movw %dx, %es:(%edi)     )
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%edx
- 5:
- SRC(	movb (%esi), %dl         )
--DST(	movb %dl, (%edi)         )
-+DST(	movb %dl, %es:(%edi)     )
- 6:	addl %edx, %eax
- 	adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	# zero the complete destination (computing the rest is too much work)
- 	movl ARGBASE+8(%esp),%edi	# dst
- 	movl ARGBASE+12(%esp),%ecx	# len
-@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
- 	rep; stosb
- 	jmp 7b
- 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	jmp  7b			
- .previous				
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %esi
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE esi
-@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
- 	CFI_RESTORE ebx
- 	ret
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 				
- #undef ROUND
- #undef ROUND1		
-diff -urNp linux-2.6.32.12/arch/x86/lib/clear_page_64.S linux-2.6.32.12/arch/x86/lib/clear_page_64.S
---- linux-2.6.32.12/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/clear_page_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -43,7 +43,7 @@ ENDPROC(clear_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.12/arch/x86/lib/copy_page_64.S linux-2.6.32.12/arch/x86/lib/copy_page_64.S
---- linux-2.6.32.12/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/copy_page_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -104,7 +104,7 @@ ENDPROC(copy_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.12/arch/x86/lib/copy_user_64.S linux-2.6.32.12/arch/x86/lib/copy_user_64.S
---- linux-2.6.32.12/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/copy_user_64.S	2010-04-04 20:58:33.225084964 -0400
-@@ -15,13 +15,14 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- 	.byte 0xe9	/* 32bit jump */
- 	.long \orig-1f	/* by default jump to orig */
- 1:
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 2:	.byte 0xe9			/* near jump with 32bit immediate */
- 	.long \alt-1b /* offset */   /* or alternatively to alt */
- 	.previous
-@@ -64,32 +65,6 @@
- #endif
- 	.endm
- 
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rdi,%rcx
--	addq %rdx,%rcx
--	jc bad_to_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_to_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rsi,%rcx
--	addq %rdx,%rcx
--	jc bad_from_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_from_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- 	CFI_STARTPROC
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
- 
- ENTRY(__copy_from_user_inatomic)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- 	CFI_ENDPROC
- ENDPROC(__copy_from_user_inatomic)
-@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
- ENTRY(bad_from_user)
- bad_from_user:
- 	CFI_STARTPROC
-+	testl %edx,%edx
-+	js bad_to_user
- 	movl %edx,%ecx
- 	xorl %eax,%eax
- 	rep
-diff -urNp linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/copy_user_nocache_64.S	2010-04-04 20:58:33.225084964 -0400
-@@ -14,6 +14,7 @@
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +51,15 @@
-  */
- ENTRY(__copy_user_nocache)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	cmpl $8,%edx
- 	jb 20f		/* less then 8 bytes, go to byte copy loop */
- 	ALIGN_DESTINATION
-diff -urNp linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/csum-wrappers_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
- 			len -= 2;
- 		}
- 	}
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	isum = csum_partial_copy_generic((__force const void *)src,
- 				dst, len, isum, errp, NULL);
- 	if (unlikely(*errp))
-@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
- 	}
- 
- 	*errp = 0;
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return csum_partial_copy_generic(src, (void __force *)dst,
- 					 len, isum, NULL, errp);
- }
-diff -urNp linux-2.6.32.12/arch/x86/lib/getuser.S linux-2.6.32.12/arch/x86/lib/getuser.S
---- linux-2.6.32.12/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/getuser.S	2010-04-04 20:58:33.225084964 -0400
-@@ -33,14 +33,38 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- 	.text
- ENTRY(__get_user_1)
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- 	CFI_STARTPROC
- 	add $1,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- 	CFI_STARTPROC
- 	add $3,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae	bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4:	movq -7(%_ASM_AX),%_ASM_DX
- 	xor %eax,%eax
- 	ret
-@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
- 
- bad_get_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %edx,%edx
- 	mov $(-EFAULT),%_ASM_AX
- 	ret
-diff -urNp linux-2.6.32.12/arch/x86/lib/memcpy_64.S linux-2.6.32.12/arch/x86/lib/memcpy_64.S
---- linux-2.6.32.12/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/memcpy_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
- 	 * It is also a lot simpler. Use this when possible:
- 	 */
- 
--	.section .altinstr_replacement, "ax"
-+	.section .altinstr_replacement, "a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.12/arch/x86/lib/memset_64.S linux-2.6.32.12/arch/x86/lib/memset_64.S
---- linux-2.6.32.12/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/memset_64.S	2010-04-04 20:46:41.529538490 -0400
-@@ -118,7 +118,7 @@ ENDPROC(__memset)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.12/arch/x86/lib/mmx_32.c linux-2.6.32.12/arch/x86/lib/mmx_32.c
---- linux-2.6.32.12/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/mmx_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
- {
- 	void *p;
- 	int i;
-+	unsigned long cr0;
- 
- 	if (unlikely(in_interrupt()))
- 		return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"		/* This set is 28 bytes */
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"		/* This set is 28 bytes */
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from));
-+			: "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for ( ; i > 5; i--) {
- 		__asm__ __volatile__ (
--		"1:  prefetch 320(%0)\n"
--		"2:  movq (%0), %%mm0\n"
--		"  movq 8(%0), %%mm1\n"
--		"  movq 16(%0), %%mm2\n"
--		"  movq 24(%0), %%mm3\n"
--		"  movq %%mm0, (%1)\n"
--		"  movq %%mm1, 8(%1)\n"
--		"  movq %%mm2, 16(%1)\n"
--		"  movq %%mm3, 24(%1)\n"
--		"  movq 32(%0), %%mm0\n"
--		"  movq 40(%0), %%mm1\n"
--		"  movq 48(%0), %%mm2\n"
--		"  movq 56(%0), %%mm3\n"
--		"  movq %%mm0, 32(%1)\n"
--		"  movq %%mm1, 40(%1)\n"
--		"  movq %%mm2, 48(%1)\n"
--		"  movq %%mm3, 56(%1)\n"
-+		"1:  prefetch 320(%1)\n"
-+		"2:  movq (%1), %%mm0\n"
-+		"  movq 8(%1), %%mm1\n"
-+		"  movq 16(%1), %%mm2\n"
-+		"  movq 24(%1), %%mm3\n"
-+		"  movq %%mm0, (%2)\n"
-+		"  movq %%mm1, 8(%2)\n"
-+		"  movq %%mm2, 16(%2)\n"
-+		"  movq %%mm3, 24(%2)\n"
-+		"  movq 32(%1), %%mm0\n"
-+		"  movq 40(%1), %%mm1\n"
-+		"  movq 48(%1), %%mm2\n"
-+		"  movq 56(%1), %%mm3\n"
-+		"  movq %%mm0, 32(%2)\n"
-+		"  movq %%mm1, 40(%2)\n"
-+		"  movq %%mm2, 48(%2)\n"
-+		"  movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
- 	 * but that is for later. -AV
- 	 */
- 	__asm__ __volatile__(
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < (4096-320)/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movntq %%mm0, (%1)\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movntq %%mm1, 8(%1)\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movntq %%mm2, 16(%1)\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movntq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm4\n"
--		"   movntq %%mm4, 32(%1)\n"
--		"   movq 40(%0), %%mm5\n"
--		"   movntq %%mm5, 40(%1)\n"
--		"   movq 48(%0), %%mm6\n"
--		"   movntq %%mm6, 48(%1)\n"
--		"   movq 56(%0), %%mm7\n"
--		"   movntq %%mm7, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movntq %%mm0, (%2)\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movntq %%mm1, 8(%2)\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movntq %%mm2, 16(%2)\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movntq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm4\n"
-+		"   movntq %%mm4, 32(%2)\n"
-+		"   movq 40(%1), %%mm5\n"
-+		"   movntq %%mm5, 40(%2)\n"
-+		"   movq 48(%1), %%mm6\n"
-+		"   movntq %%mm6, 48(%2)\n"
-+		"   movq 56(%1), %%mm7\n"
-+		"   movntq %%mm7, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < 4096/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movq %%mm0, (%1)\n"
--		"   movq %%mm1, 8(%1)\n"
--		"   movq %%mm2, 16(%1)\n"
--		"   movq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm0\n"
--		"   movq 40(%0), %%mm1\n"
--		"   movq 48(%0), %%mm2\n"
--		"   movq 56(%0), %%mm3\n"
--		"   movq %%mm0, 32(%1)\n"
--		"   movq %%mm1, 40(%1)\n"
--		"   movq %%mm2, 48(%1)\n"
--		"   movq %%mm3, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movq %%mm0, (%2)\n"
-+		"   movq %%mm1, 8(%2)\n"
-+		"   movq %%mm2, 16(%2)\n"
-+		"   movq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm0\n"
-+		"   movq 40(%1), %%mm1\n"
-+		"   movq 48(%1), %%mm2\n"
-+		"   movq 56(%1), %%mm3\n"
-+		"   movq %%mm0, 32(%2)\n"
-+		"   movq %%mm1, 40(%2)\n"
-+		"   movq %%mm2, 48(%2)\n"
-+		"   movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-diff -urNp linux-2.6.32.12/arch/x86/lib/putuser.S linux-2.6.32.12/arch/x86/lib/putuser.S
---- linux-2.6.32.12/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/putuser.S	2010-04-04 20:58:33.225084964 -0400
-@@ -15,7 +15,8 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- /*
-  * __put_user_X
-@@ -29,59 +30,156 @@
-  * as they get called from within inline assembly.
-  */
- 
--#define ENTER	CFI_STARTPROC ; \
--		GET_THREAD_INFO(%_ASM_BX)
-+#define ENTER	CFI_STARTPROC
- #define EXIT	ret ; \
- 		CFI_ENDPROC
- 
- .text
- ENTRY(__put_user_1)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_1)
- 
- ENTRY(__put_user_2)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $1,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_2)
- 
- ENTRY(__put_user_4)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $3,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_4)
- 
- ENTRY(__put_user_8)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $7,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 4:	mov %_ASM_AX,(%_ASM_CX)
- #ifdef CONFIG_X86_32
- 5:	movl %edx,4(%_ASM_CX)
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_8)
- 
- bad_put_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	movl $-EFAULT,%eax
- 	EXIT
- END(bad_put_user)
-diff -urNp linux-2.6.32.12/arch/x86/lib/usercopy_32.c linux-2.6.32.12/arch/x86/lib/usercopy_32.c
---- linux-2.6.32.12/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/usercopy_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
-  * Copy a null terminated string from userspace.
-  */
- 
--#define __do_strncpy_from_user(dst, src, count, res)			   \
--do {									   \
--	int __d0, __d1, __d2;						   \
--	might_fault();							   \
--	__asm__ __volatile__(						   \
--		"	testl %1,%1\n"					   \
--		"	jz 2f\n"					   \
--		"0:	lodsb\n"					   \
--		"	stosb\n"					   \
--		"	testb %%al,%%al\n"				   \
--		"	jz 1f\n"					   \
--		"	decl %1\n"					   \
--		"	jnz 0b\n"					   \
--		"1:	subl %1,%0\n"					   \
--		"2:\n"							   \
--		".section .fixup,\"ax\"\n"				   \
--		"3:	movl %5,%0\n"					   \
--		"	jmp 2b\n"					   \
--		".previous\n"						   \
--		_ASM_EXTABLE(0b,3b)					   \
--		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
--		  "=&D" (__d2)						   \
--		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
--		: "memory");						   \
--} while (0)
-+static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
-+{
-+	int __d0, __d1, __d2;
-+	long res = -EFAULT;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w10,%%ds\n"
-+		"	testl %1,%1\n"
-+		"	jz 2f\n"
-+		"0:	lodsb\n"
-+		"	stosb\n"
-+		"	testb %%al,%%al\n"
-+		"	jz 1f\n"
-+		"	decl %1\n"
-+		"	jnz 0b\n"
-+		"1:	subl %1,%0\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	movl %5,%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
-+		  "=&D" (__d2)
-+		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
-+		  "r"(__USER_DS)
-+		: "memory");
-+	return res;
-+}
- 
- /**
-  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
-@@ -85,9 +92,7 @@ do {									   \
- long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
--	long res;
--	__do_strncpy_from_user(dst, src, count, res);
--	return res;
-+	return __do_strncpy_from_user(dst, src, count);
- }
- EXPORT_SYMBOL(__strncpy_from_user);
- 
-@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
--		__do_strncpy_from_user(dst, src, count, res);
-+		res = __do_strncpy_from_user(dst, src, count);
- 	return res;
- }
- EXPORT_SYMBOL(strncpy_from_user);
-@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
-  * Zero Userspace
-  */
- 
--#define __do_clear_user(addr,size)					\
--do {									\
--	int __d0;							\
--	might_fault();							\
--	__asm__ __volatile__(						\
--		"0:	rep; stosl\n"					\
--		"	movl %2,%0\n"					\
--		"1:	rep; stosb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"3:	lea 0(%2,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		_ASM_EXTABLE(0b,3b)					\
--		_ASM_EXTABLE(1b,2b)					\
--		: "=&c"(size), "=&D" (__d0)				\
--		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
--} while (0)
-+static unsigned long __do_clear_user(void __user *addr, unsigned long size)
-+{
-+	int __d0;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w6,%%es\n"
-+		"0:	rep; stosl\n"
-+		"	movl %2,%0\n"
-+		"1:	rep; stosb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	lea 0(%2,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		_ASM_EXTABLE(1b,2b)
-+		: "=&c"(size), "=&D" (__d0)
-+		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
-+		  "r"(__USER_DS));
-+	return size;
-+}
- 
- /**
-  * clear_user: - Zero a block of memory in user space.
-@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
- {
- 	might_fault();
- 	if (access_ok(VERIFY_WRITE, to, n))
--		__do_clear_user(to, n);
-+		n = __do_clear_user(to, n);
- 	return n;
- }
- EXPORT_SYMBOL(clear_user);
-@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
- unsigned long
- __clear_user(void __user *to, unsigned long n)
- {
--	__do_clear_user(to, n);
--	return n;
-+	return __do_clear_user(to, n);
- }
- EXPORT_SYMBOL(__clear_user);
- 
-@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
- 	might_fault();
- 
- 	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
- 		"	testl %0, %0\n"
- 		"	jz 3f\n"
--		"	andl %0,%%ecx\n"
-+		"	movl %0,%%ecx\n"
- 		"0:	repne; scasb\n"
- 		"	setne %%al\n"
- 		"	subl %%ecx,%0\n"
- 		"	addl %0,%%eax\n"
- 		"1:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
- 		".section .fixup,\"ax\"\n"
- 		"2:	xorl %%eax,%%eax\n"
- 		"	jmp 1b\n"
-@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
- 		"	.long 0b,2b\n"
- 		".previous"
- 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
--		:"0" (n), "1" (s), "2" (0), "3" (mask)
-+		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
- 		:"cc");
- 	return res & mask;
- }
-@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
- 
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "       movw %w6, %%es\n"
- 		       "       .align 2,0x90\n"
- 		       "1:     movl 32(%4), %%eax\n"
- 		       "       cmpl $67, %0\n"
-@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
- 		       "       .align 2,0x90\n"
- 		       "3:     movl 0(%4), %%eax\n"
- 		       "4:     movl 4(%4), %%edx\n"
--		       "5:     movl %%eax, 0(%3)\n"
--		       "6:     movl %%edx, 4(%3)\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
- 		       "7:     movl 8(%4), %%eax\n"
- 		       "8:     movl 12(%4),%%edx\n"
--		       "9:     movl %%eax, 8(%3)\n"
--		       "10:    movl %%edx, 12(%3)\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
- 		       "11:    movl 16(%4), %%eax\n"
- 		       "12:    movl 20(%4), %%edx\n"
--		       "13:    movl %%eax, 16(%3)\n"
--		       "14:    movl %%edx, 20(%3)\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
- 		       "15:    movl 24(%4), %%eax\n"
- 		       "16:    movl 28(%4), %%edx\n"
--		       "17:    movl %%eax, 24(%3)\n"
--		       "18:    movl %%edx, 28(%3)\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
- 		       "19:    movl 32(%4), %%eax\n"
- 		       "20:    movl 36(%4), %%edx\n"
--		       "21:    movl %%eax, 32(%3)\n"
--		       "22:    movl %%edx, 36(%3)\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
- 		       "23:    movl 40(%4), %%eax\n"
- 		       "24:    movl 44(%4), %%edx\n"
--		       "25:    movl %%eax, 40(%3)\n"
--		       "26:    movl %%edx, 44(%3)\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
- 		       "27:    movl 48(%4), %%eax\n"
- 		       "28:    movl 52(%4), %%edx\n"
--		       "29:    movl %%eax, 48(%3)\n"
--		       "30:    movl %%edx, 52(%3)\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
- 		       "31:    movl 56(%4), %%eax\n"
- 		       "32:    movl 60(%4), %%edx\n"
--		       "33:    movl %%eax, 56(%3)\n"
--		       "34:    movl %%edx, 60(%3)\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
- 		       "       addl $-64, %0\n"
- 		       "       addl $64, %4\n"
- 		       "       addl $64, %3\n"
-@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
- 		       "36:    movl %%eax, %0\n"
- 		       "37:    rep; movsb\n"
- 		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%es\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "101:   lea 0(%%eax,%0,4),%0\n"
- 		       "       jmp 100b\n"
-@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
- 		       "       .long 99b,101b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
-+		       : "eax", "edx", "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+	int d0, d1;
-+	__asm__ __volatile__(
-+		       "       movw %w6, %%ds\n"
-+		       "       .align 2,0x90\n"
-+		       "1:     movl 32(%4), %%eax\n"
-+		       "       cmpl $67, %0\n"
-+		       "       jbe 3f\n"
-+		       "2:     movl 64(%4), %%eax\n"
-+		       "       .align 2,0x90\n"
-+		       "3:     movl 0(%4), %%eax\n"
-+		       "4:     movl 4(%4), %%edx\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
-+		       "7:     movl 8(%4), %%eax\n"
-+		       "8:     movl 12(%4),%%edx\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
-+		       "11:    movl 16(%4), %%eax\n"
-+		       "12:    movl 20(%4), %%edx\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
-+		       "15:    movl 24(%4), %%eax\n"
-+		       "16:    movl 28(%4), %%edx\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
-+		       "19:    movl 32(%4), %%eax\n"
-+		       "20:    movl 36(%4), %%edx\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
-+		       "23:    movl 40(%4), %%eax\n"
-+		       "24:    movl 44(%4), %%edx\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
-+		       "27:    movl 48(%4), %%eax\n"
-+		       "28:    movl 52(%4), %%edx\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
-+		       "31:    movl 56(%4), %%eax\n"
-+		       "32:    movl 60(%4), %%edx\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
-+		       "       addl $-64, %0\n"
-+		       "       addl $64, %4\n"
-+		       "       addl $64, %3\n"
-+		       "       cmpl $63, %0\n"
-+		       "       ja  1b\n"
-+		       "35:    movl  %0, %%eax\n"
-+		       "       shrl  $2, %0\n"
-+		       "       andl  $3, %%eax\n"
-+		       "       cld\n"
-+		       "99:    rep; movsl\n"
-+		       "36:    movl %%eax, %0\n"
-+		       "37:    rep; movsb\n"
-+		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%ds\n"
-+		       ".section .fixup,\"ax\"\n"
-+		       "101:   lea 0(%%eax,%0,4),%0\n"
-+		       "       jmp 100b\n"
-+		       ".previous\n"
-+		       ".section __ex_table,\"a\"\n"
-+		       "       .align 4\n"
-+		       "       .long 1b,100b\n"
-+		       "       .long 2b,100b\n"
-+		       "       .long 3b,100b\n"
-+		       "       .long 4b,100b\n"
-+		       "       .long 5b,100b\n"
-+		       "       .long 6b,100b\n"
-+		       "       .long 7b,100b\n"
-+		       "       .long 8b,100b\n"
-+		       "       .long 9b,100b\n"
-+		       "       .long 10b,100b\n"
-+		       "       .long 11b,100b\n"
-+		       "       .long 12b,100b\n"
-+		       "       .long 13b,100b\n"
-+		       "       .long 14b,100b\n"
-+		       "       .long 15b,100b\n"
-+		       "       .long 16b,100b\n"
-+		       "       .long 17b,100b\n"
-+		       "       .long 18b,100b\n"
-+		       "       .long 19b,100b\n"
-+		       "       .long 20b,100b\n"
-+		       "       .long 21b,100b\n"
-+		       "       .long 22b,100b\n"
-+		       "       .long 23b,100b\n"
-+		       "       .long 24b,100b\n"
-+		       "       .long 25b,100b\n"
-+		       "       .long 26b,100b\n"
-+		       "       .long 27b,100b\n"
-+		       "       .long 28b,100b\n"
-+		       "       .long 29b,100b\n"
-+		       "       .long 30b,100b\n"
-+		       "       .long 31b,100b\n"
-+		       "       .long 32b,100b\n"
-+		       "       .long 33b,100b\n"
-+		       "       .long 34b,100b\n"
-+		       "       .long 35b,100b\n"
-+		       "       .long 36b,100b\n"
-+		       "       .long 37b,100b\n"
-+		       "       .long 99b,101b\n"
-+		       ".previous"
-+		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "        movw %w6, %%ds\n"
- 		       "        .align 2,0x90\n"
- 		       "0:      movl 32(%4), %%eax\n"
- 		       "        cmpl $67, %0\n"
-@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .align 2,0x90\n"
- 		       "2:      movl 0(%4), %%eax\n"
- 		       "21:     movl 4(%4), %%edx\n"
--		       "        movl %%eax, 0(%3)\n"
--		       "        movl %%edx, 4(%3)\n"
-+		       "        movl %%eax, %%es:0(%3)\n"
-+		       "        movl %%edx, %%es:4(%3)\n"
- 		       "3:      movl 8(%4), %%eax\n"
- 		       "31:     movl 12(%4),%%edx\n"
--		       "        movl %%eax, 8(%3)\n"
--		       "        movl %%edx, 12(%3)\n"
-+		       "        movl %%eax, %%es:8(%3)\n"
-+		       "        movl %%edx, %%es:12(%3)\n"
- 		       "4:      movl 16(%4), %%eax\n"
- 		       "41:     movl 20(%4), %%edx\n"
--		       "        movl %%eax, 16(%3)\n"
--		       "        movl %%edx, 20(%3)\n"
-+		       "        movl %%eax, %%es:16(%3)\n"
-+		       "        movl %%edx, %%es:20(%3)\n"
- 		       "10:     movl 24(%4), %%eax\n"
- 		       "51:     movl 28(%4), %%edx\n"
--		       "        movl %%eax, 24(%3)\n"
--		       "        movl %%edx, 28(%3)\n"
-+		       "        movl %%eax, %%es:24(%3)\n"
-+		       "        movl %%edx, %%es:28(%3)\n"
- 		       "11:     movl 32(%4), %%eax\n"
- 		       "61:     movl 36(%4), %%edx\n"
--		       "        movl %%eax, 32(%3)\n"
--		       "        movl %%edx, 36(%3)\n"
-+		       "        movl %%eax, %%es:32(%3)\n"
-+		       "        movl %%edx, %%es:36(%3)\n"
- 		       "12:     movl 40(%4), %%eax\n"
- 		       "71:     movl 44(%4), %%edx\n"
--		       "        movl %%eax, 40(%3)\n"
--		       "        movl %%edx, 44(%3)\n"
-+		       "        movl %%eax, %%es:40(%3)\n"
-+		       "        movl %%edx, %%es:44(%3)\n"
- 		       "13:     movl 48(%4), %%eax\n"
- 		       "81:     movl 52(%4), %%edx\n"
--		       "        movl %%eax, 48(%3)\n"
--		       "        movl %%edx, 52(%3)\n"
-+		       "        movl %%eax, %%es:48(%3)\n"
-+		       "        movl %%edx, %%es:52(%3)\n"
- 		       "14:     movl 56(%4), %%eax\n"
- 		       "91:     movl 60(%4), %%edx\n"
--		       "        movl %%eax, 56(%3)\n"
--		       "        movl %%edx, 60(%3)\n"
-+		       "        movl %%eax, %%es:56(%3)\n"
-+		       "        movl %%edx, %%es:60(%3)\n"
- 		       "        addl $-64, %0\n"
- 		       "        addl $64, %4\n"
- 		       "        addl $64, %3\n"
-@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        movl %%eax,%0\n"
- 		       "7:      rep; movsb\n"
- 		       "8:\n"
-+		       "        pushl %%ss\n"
-+		       "        popl %%ds\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "9:      lea 0(%%eax,%0,4),%0\n"
- 		       "16:     pushl %0\n"
-@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .long 7b,16b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     pushl %0\n"
-@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     jmp 8b\n"
-@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
-  */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- 					unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+					unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- 					unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- 				const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
- 
- /* Generic arbitrary sized copy.  */
--#define __copy_user(to, from, size)					\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 2b\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,2b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
--
--#define __copy_user_zeroing(to, from, size)				\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 6f\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"6:	pushl %0\n"					\
--		"	pushl %%eax\n"					\
--		"	xorl %%eax,%%eax\n"				\
--		"	rep; stosb\n"					\
--		"	popl %%eax\n"					\
--		"	popl %0\n"					\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,6b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
-+static unsigned long
-+__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 6f\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"6:	pushl %0\n"
-+		"	pushl %%eax\n"
-+		"	xorl %%eax,%%eax\n"
-+		"	rep; stosb\n"
-+		"	popl %%eax\n"
-+		"	popl %0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,6b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
- 
- unsigned long __copy_to_user_ll(void __user *to, const void *from,
- 				unsigned long n)
-@@ -775,9 +966,9 @@ survive:
- 	}
- #endif
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_to_user(to, from, n);
- 	else
--		n = __copy_user_intel(to, from, n);
-+		n = __generic_copy_to_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
- 					unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- 	else
- 		n = __copy_user_zeroing_intel(to, from, n);
- 	return n;
-@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
- 					 unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- 	else
--		n = __copy_user_intel((void __user *)to,
--				      (const void *)from, n);
-+		n = __generic_copy_from_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_zeroing_intel_nocache(to, from, n);
- 	else
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- #else
--	__copy_user_zeroing(to, from, n);
-+	n = __copy_user_zeroing(to, from, n);
- #endif
- 	return n;
- }
-@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_intel_nocache(to, from, n);
- 	else
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- #else
--	__copy_user(to, from, n);
-+	n = __generic_copy_from_user(to, from, n);
- #endif
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
- 
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to:   Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x, int cpu)
- {
--	if (access_ok(VERIFY_WRITE, to, n))
--		n = __copy_to_user(to, from, n);
--	return n;
-+	unsigned long limit = x.seg;
-+	struct desc_struct d;
-+
-+	current_thread_info()->addr_limit = x;
-+	if (unlikely(paravirt_enabled()))
-+		return;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
- }
--EXPORT_SYMBOL(copy_to_user);
- 
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to:   Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void set_fs(mm_segment_t x)
- {
--	if (access_ok(VERIFY_READ, from, n))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
-+	__set_fs(x, get_cpu());
-+	put_cpu();
- }
--EXPORT_SYMBOL(copy_from_user);
-+#else
-+void set_fs(mm_segment_t x)
-+{
-+	current_thread_info()->addr_limit = x;
-+}
-+#endif
-+
-+EXPORT_SYMBOL(set_fs);
-diff -urNp linux-2.6.32.12/arch/x86/lib/usercopy_64.c linux-2.6.32.12/arch/x86/lib/usercopy_64.c
---- linux-2.6.32.12/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/lib/usercopy_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -42,6 +42,8 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- 	long res;
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	__do_strncpy_from_user(dst, src, count, res);
- 	return res;
- }
-@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
- {
- 	long __d0;
- 	might_fault();
-+	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
-+		addr += PAX_USER_SHADOW_BASE;
- 	/* no memory constraint because it doesn't change any memory gcc knows
- 	   about */
- 	asm volatile(
-@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
- 
- unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
- {
--	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
-+	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-+		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
-+			to += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
-+			from += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)to, (__force void *)from, len);
--	} 
--	return len;		
-+	}
-+	return len;
- }
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.12/arch/x86/Makefile linux-2.6.32.12/arch/x86/Makefile
---- linux-2.6.32.12/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/Makefile	2010-04-04 20:46:41.533557286 -0400
-@@ -189,3 +189,12 @@ define archhelp
-   echo  '                  FDARGS="..."  arguments for the booted kernel'
-   echo  '                  FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.32.12/arch/x86/mm/extable.c linux-2.6.32.12/arch/x86/mm/extable.c
---- linux-2.6.32.12/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/extable.c	2010-04-04 20:46:41.533557286 -0400
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
- 
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+	const struct exception_table_entry *x = a, *y = b;
-+
-+	/* avoid overflow */
-+	if (x->insn > y->insn)
-+		return 1;
-+	if (x->insn < y->insn)
-+		return -1;
-+	return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+	struct exception_table_entry t, *x = a, *y = b;
-+
-+	t = *x;
-+
-+	pax_open_kernel();
-+	*x = *y;
-+	*y = t;
-+	pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+		  struct exception_table_entry *finish)
-+{
-+	sort(start, finish - start, sizeof(struct exception_table_entry),
-+	     cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+	/*trim the beginning*/
-+	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+		m->extable++;
-+		m->num_exentries--;
-+	}
-+	/*trim the end*/
-+	while (m->num_exentries &&
-+		within_module_init(m->extable[m->num_exentries-1].insn, m))
-+		m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
- 
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fixup;
- 
- #ifdef CONFIG_PNPBIOS
--	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- 		extern u32 pnp_bios_is_utter_crap;
- 		pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.32.12/arch/x86/mm/fault.c linux-2.6.32.12/arch/x86/mm/fault.c
---- linux-2.6.32.12/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/fault.c	2010-04-29 17:46:36.897235141 -0400
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h>		/* __kprobes, ...		*/
- #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
- #include <linux/perf_event.h>		/* perf_sw_event		*/
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
- 
- #include <asm/traps.h>			/* dotraplinkage, ...		*/
- #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
- #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
- 
- /*
-  * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
- 	int ret = 0;
- 
- 	/* kprobe_running() needs smp_processor_id() */
--	if (kprobes_built_in() && !user_mode_vm(regs)) {
-+	if (kprobes_built_in() && !user_mode(regs)) {
- 		preempt_disable();
- 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
- 			ret = 1;
-@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
- 	force_sig_info(si_signo, &info, tsk);
- }
- 
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+	pgd = pgd_offset(mm, address);
-+	if (!pgd_present(*pgd))
-+		return NULL;
-+	pud = pud_offset(pgd, address);
-+	if (!pud_present(*pud))
-+		return NULL;
-+	pmd = pmd_offset(pud, address);
-+	if (!pmd_present(*pmd))
-+		return NULL;
-+	return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
- 
-@@ -332,15 +365,27 @@ void vmalloc_sync_all(void)
- 
- 		const pgd_t *pgd_ref = pgd_offset_k(address);
- 		unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		unsigned long cpu;
-+#else
- 		struct page *page;
-+#endif
- 
- 		if (pgd_none(*pgd_ref))
- 			continue;
- 
- 		spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+			pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- 		list_for_each_entry(page, &pgd_list, lru) {
- 			pgd_t *pgd;
- 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- 			if (pgd_none(*pgd))
- 				set_pgd(pgd, *pgd_ref);
- 			else
-@@ -373,7 +418,14 @@ static noinline int vmalloc_fault(unsign
- 	 * happen within a race in page table update. In the later
- 	 * case just flush:
- 	 */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+	pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- 	pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- 	pgd_ref = pgd_offset_k(address);
- 	if (pgd_none(*pgd_ref))
- 		return -1;
-@@ -535,7 +587,7 @@ static int is_errata93(struct pt_regs *r
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
--	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- 		return 1;
- #endif
- 	return 0;
-@@ -562,7 +614,7 @@ static int is_f00f_bug(struct pt_regs *r
- }
- 
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
- 
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +623,26 @@ show_fault_oops(struct pt_regs *regs, un
- 	if (!oops_may_print())
- 		return;
- 
--	if (error_code & PF_INSTR) {
-+	if (nx_enabled && (error_code & PF_INSTR)) {
- 		unsigned int level;
- 
- 		pte_t *pte = lookup_address(address, &level);
- 
- 		if (pte && pte_present(*pte) && !pte_exec(*pte))
--			printk(nx_warning, current_uid());
-+			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- 	}
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (init_mm.start_code <= address && address < init_mm.end_code) {
-+		if (current->signal->curr_ip)
-+			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+		else
-+			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	}
-+#endif
-+
- 	printk(KERN_ALERT "BUG: unable to handle kernel ");
- 	if (address < PAGE_SIZE)
- 		printk(KERN_CONT "NULL pointer dereference");
-@@ -704,6 +767,68 @@ __bad_area_nosemaphore(struct pt_regs *r
- 		       unsigned long address, int si_code)
- {
- 	struct task_struct *tsk = current;
-+	struct mm_struct *mm = tsk->mm;
-+
-+#ifdef CONFIG_X86_64
-+	if (mm && (error_code & PF_INSTR)) {
-+		if (regs->ip == (unsigned long)vgettimeofday) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+			return;
-+		} else if (regs->ip == (unsigned long)vtime) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+			return;
-+		} else if (regs->ip == (unsigned long)vgetcpu) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+			return;
-+		}
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm && (error_code & PF_USER)) {
-+		unsigned long ip = regs->ip;
-+
-+		if (v8086_mode(regs))
-+			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
-+
-+		/*
-+		 * It's possible to have interrupts off here:
-+		 */
-+		local_irq_enable();
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
-+		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+	}
-+#endif
- 
- 	/* User mode accesses just cause a SIGSEGV */
- 	if (error_code & PF_USER) {
-@@ -848,6 +973,106 @@ static int spurious_fault_check(unsigned
- 	return 1;
- }
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+	pte_t *pte;
-+	pmd_t *pmd;
-+	spinlock_t *ptl;
-+	unsigned char pte_mask;
-+
-+	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+		return 0;
-+
-+	/* PaX: it's our fault, let's handle it if we can */
-+
-+	/* PaX: take a look at read faults before acquiring any locks */
-+	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+		/* instruction fetch attempt from a protected page in user mode */
-+		up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		switch (pax_handle_fetch_fault(regs)) {
-+		case 2:
-+			return 1;
-+		}
-+#endif
-+
-+		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+		do_group_exit(SIGKILL);
-+	}
-+
-+	pmd = pax_get_pmd(mm, address);
-+	if (unlikely(!pmd))
-+		return 0;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+		/* write attempt to a protected page in user mode */
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+#ifdef CONFIG_SMP
-+	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+	if (likely(address > get_limit(regs->cs)))
-+#endif
-+	{
-+		set_pte(pte, pte_mkread(*pte));
-+		__flush_tlb_one(address);
-+		pte_unmap_unlock(pte, ptl);
-+		up_read(&mm->mmap_sem);
-+		return 1;
-+	}
-+
-+	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+	/*
-+	 * PaX: fill DTLB with user rights and retry
-+	 */
-+	__asm__ __volatile__ (
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"movw %w4,%%es\n"
-+#endif
-+		"orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+		"invlpg (%0)\n"
-+#endif
-+		"testb $0,%%es:(%0)\n"
-+		"xorb %3,(%1)\n"
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"pushl %%ss\n"
-+		"popl %%es\n"
-+#endif
-+		:
-+		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
-+		: "memory", "cc");
-+	pte_unmap_unlock(pte, ptl);
-+	up_read(&mm->mmap_sem);
-+	return 1;
-+}
-+#endif
-+
- /*
-  * Handle a spurious fault caused by a stale TLB entry.
-  *
-@@ -914,6 +1139,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+		return 1;
-+
- 	if (write) {
- 		/* write, present and write, not present: */
- 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -947,17 +1175,31 @@ do_page_fault(struct pt_regs *regs, unsi
- {
- 	struct vm_area_struct *vma;
- 	struct task_struct *tsk;
--	unsigned long address;
- 	struct mm_struct *mm;
- 	int write;
- 	int fault;
- 
-+	/* Get the faulting address: */
-+	unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
-+		if (!search_exception_tables(regs->ip)) {
-+			bad_area_nosemaphore(regs, error_code, address);
-+			return;
-+		}
-+		if (address < PAX_USER_SHADOW_BASE) {
-+			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+			printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
-+			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+		} else
-+			address -= PAX_USER_SHADOW_BASE;
-+	}
-+#endif
-+
- 	tsk = current;
- 	mm = tsk->mm;
- 
--	/* Get the faulting address: */
--	address = read_cr2();
--
- 	/*
- 	 * Detect and handle instructions that would cause a page fault for
- 	 * both a tracked kernel page and a userspace page.
-@@ -1017,7 +1259,7 @@ do_page_fault(struct pt_regs *regs, unsi
- 	 * User-mode registers count as a user access even for any
- 	 * potential system fault or CPU buglet:
- 	 */
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		local_irq_enable();
- 		error_code |= PF_USER;
- 	} else {
-@@ -1071,6 +1313,11 @@ do_page_fault(struct pt_regs *regs, unsi
- 		might_sleep();
- 	}
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+		return;
-+#endif
-+
- 	vma = find_vma(mm, address);
- 	if (unlikely(!vma)) {
- 		bad_area(regs, error_code, address);
-@@ -1082,18 +1329,24 @@ do_page_fault(struct pt_regs *regs, unsi
- 		bad_area(regs, error_code, address);
- 		return;
- 	}
--	if (error_code & PF_USER) {
--		/*
--		 * Accessing the stack below %sp is always a bug.
--		 * The large cushion allows instructions like enter
--		 * and pusha to work. ("enter $65535, $31" pushes
--		 * 32 pointers and then decrements %sp by 65535.)
--		 */
--		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
--			bad_area(regs, error_code, address);
--			return;
--		}
-+	/*
-+	 * Accessing the stack below %sp is always a bug.
-+	 * The large cushion allows instructions like enter
-+	 * and pusha to work. ("enter $65535, $31" pushes
-+	 * 32 pointers and then decrements %sp by 65535.)
-+	 */
-+	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+		bad_area(regs, error_code, address);
-+		return;
-+	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+		bad_area(regs, error_code, address);
-+		return;
- 	}
-+#endif
-+
- 	if (unlikely(expand_stack(vma, address))) {
- 		bad_area(regs, error_code, address);
- 		return;
-@@ -1137,3 +1390,199 @@ good_area:
- 
- 	up_read(&mm->mmap_sem);
- }
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned char mov1, mov2;
-+		unsigned short jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 11) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov1, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+			regs->cx = addr1;
-+			regs->ax = addr2;
-+			regs->ip = addr2;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned char mov, jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 9) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+		if (err)
-+			break;
-+
-+		if (mov == 0xB9 && jmp == 0xE9) {
-+			regs->cx = addr1;
-+			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned int addr1;
-+		unsigned long addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned long addr1, addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	if (v8086_mode(regs))
-+		return 1;
-+
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+
-+#ifdef CONFIG_X86_32
-+	return pax_handle_fetch_fault_32(regs);
-+#else
-+	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+		return pax_handle_fetch_fault_32(regs);
-+	else
-+		return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+	for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+#ifdef CONFIG_X86_32
-+			printk(KERN_CONT "???????? ");
-+#else
-+			printk(KERN_CONT "???????????????? ");
-+#endif
-+		else
-+			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+	long ret;
-+	mm_segment_t old_fs = get_fs();
-+
-+	set_fs(KERNEL_DS);
-+	pagefault_disable();
-+	pax_open_kernel();
-+	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+	pax_close_kernel();
-+	pagefault_enable();
-+	set_fs(old_fs);
-+
-+	return ret ? -EFAULT : 0;
-+}
-diff -urNp linux-2.6.32.12/arch/x86/mm/gup.c linux-2.6.32.12/arch/x86/mm/gup.c
---- linux-2.6.32.12/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/gup.c	2010-04-04 20:46:41.533557286 -0400
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
- 	addr = start;
- 	len = (unsigned long) nr_pages << PAGE_SHIFT;
- 	end = start + len;
--	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- 					(void __user *)start, len)))
- 		return 0;
- 
-diff -urNp linux-2.6.32.12/arch/x86/mm/highmem_32.c linux-2.6.32.12/arch/x86/mm/highmem_32.c
---- linux-2.6.32.12/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/highmem_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
- 	idx = type + KM_TYPE_NR*smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- 	BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte-idx, mk_pte(page, prot));
-+	pax_close_kernel();
- 
- 	return (void *)vaddr;
- }
-diff -urNp linux-2.6.32.12/arch/x86/mm/hugetlbpage.c linux-2.6.32.12/arch/x86/mm/hugetlbpage.c
---- linux-2.6.32.12/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/hugetlbpage.c	2010-04-04 20:46:41.533557286 -0400
-@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
--	unsigned long start_addr;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = mm->free_area_cache;
-+		start_addr = mm->free_area_cache;
- 	} else {
--	        start_addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -281,13 +286,13 @@ full_search:
- 
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
--		if (TASK_SIZE - len < addr) {
-+		if (pax_task_size - len < addr) {
- 			/*
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma, *prev_vma;
--	unsigned long base = mm->mmap_base, addr = addr0;
-+	unsigned long base = mm->mmap_base, addr;
- 	unsigned long largest_hole = mm->cached_hole_size;
--	int first_time = 1;
- 
- 	/* don't allow allocations above current base */
- 	if (mm->free_area_cache > base)
-@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
- 	        largest_hole = 0;
- 		mm->free_area_cache  = base;
- 	}
--try_again:
-+
- 	/* make sure it can fit in the remaining address space */
- 	if (mm->free_area_cache < len)
- 		goto fail;
-@@ -364,22 +368,26 @@ try_again:
- 
- fail:
- 	/*
--	 * if hint left us with no space for the requested
--	 * mapping then try again:
--	 */
--	if (first_time) {
--		mm->free_area_cache = base;
--		largest_hole = 0;
--		first_time = 0;
--		goto try_again;
--	}
--	/*
- 	 * A failed mmap() very likely causes application failure,
- 	 * so fall back to the bottom-up function here. This scenario
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
- 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- 			len, pgoff, flags);
-@@ -387,6 +395,7 @@ fail:
- 	/*
- 	 * Restore the topdown base:
- 	 */
-+	mm->mmap_base = base;
- 	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
-@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (len & ~huge_page_mask(h))
- 		return -EINVAL;
--	if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
- 		return -ENOMEM;
- 
- 	if (flags & MAP_FIXED) {
-@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
- 	if (addr) {
- 		addr = ALIGN(addr, huge_page_size(h));
- 		vma = find_vma(mm, addr);
--		if (TASK_SIZE - len >= addr &&
-+		if (pax_task_size - len >= addr &&
- 		    (!vma || addr + len <= vma->vm_start))
- 			return addr;
- 	}
-diff -urNp linux-2.6.32.12/arch/x86/mm/init_32.c linux-2.6.32.12/arch/x86/mm/init_32.c
---- linux-2.6.32.12/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/init_32.c	2010-04-04 20:58:33.225084964 -0400
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
- 
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
--	pud_t *pud;
--	pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
--	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
--		if (after_bootmem)
--			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
--		else
--			pmd_table = (pmd_t *)alloc_low_page();
--		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
--		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
--		pud = pud_offset(pgd, 0);
--		BUG_ON(pmd_table != pmd_offset(pud, 0));
--
--		return pmd_table;
--	}
--#endif
--	pud = pud_offset(pgd, 0);
--	pmd_table = pmd_offset(pud, 0);
--
--	return pmd_table;
--}
--
--/*
-  * Create a page table and place a pointer to it in a middle page
-  * directory entry:
-  */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
- 			page_table = (pte_t *)alloc_low_page();
- 
- 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- 	}
- 
- 	return pte_offset_kernel(pmd, 0);
- }
- 
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+	pud_t *pud;
-+	pmd_t *pmd_table;
-+
-+	pud = pud_offset(pgd, 0);
-+	pmd_table = pmd_offset(pud, 0);
-+
-+	return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- 	int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
- 	int pgd_idx, pmd_idx;
- 	unsigned long vaddr;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte = NULL;
- 
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
- 	pgd = pgd_base + pgd_idx;
- 
- 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
--		pmd = pmd + pmd_index(vaddr);
-+		pud = pud_offset(pgd, vaddr);
-+		pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- 							pmd++, pmd_idx++) {
- 			pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
- 	}
- }
- 
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
--	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
--		return 1;
--	return 0;
-+	if ((start > ktla_ktva((unsigned long)_etext) ||
-+	     end <= ktla_ktva((unsigned long)_stext)) &&
-+	    (start > ktla_ktva((unsigned long)_einittext) ||
-+	     end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+		return 0;
-+	return 1;
- }
- 
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
- 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- 	unsigned long start_pfn, end_pfn;
- 	pgd_t *pgd_base = swapper_pg_dir;
--	int pgd_idx, pmd_idx, pte_ofs;
-+	unsigned int pgd_idx, pmd_idx, pte_ofs;
- 	unsigned long pfn;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte;
- 	unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- 	pfn = start_pfn;
- 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 	pgd = pgd_base + pgd_idx;
--	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
-+	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+		pud = pud_offset(pgd, 0);
-+		pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
- 
- 		if (pfn >= end_pfn)
- 			continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- 		     pmd++, pmd_idx++) {
--			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
- 
- 			/*
- 			 * Map with big pages if possible, otherwise
- 			 * create normal page tables:
- 			 */
- 			if (use_pse) {
--				unsigned int addr2;
- 				pgprot_t prot = PAGE_KERNEL_LARGE;
- 				/*
- 				 * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- 					__pgprot(PTE_IDENT_ATTR |
- 						 _PAGE_PSE);
- 
--				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
--					PAGE_OFFSET + PAGE_SIZE-1;
--
--				if (is_kernel_text(addr) ||
--				    is_kernel_text(addr2))
-+				if (is_kernel_text(address, address + PMD_SIZE))
- 					prot = PAGE_KERNEL_LARGE_EXEC;
- 
- 				pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 			pte += pte_ofs;
- 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
--			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- 				pgprot_t prot = PAGE_KERNEL;
- 				/*
- 				 * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- 				 */
- 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
- 
--				if (is_kernel_text(addr))
-+				if (is_kernel_text(address, address + PAGE_SIZE))
- 					prot = PAGE_KERNEL_EXEC;
- 
- 				pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
- 
- 		pud = pud_offset(pgd, va);
- 		pmd = pmd_offset(pud, va);
--		if (!pmd_present(*pmd))
-+		if (!pmd_present(*pmd) || pmd_huge(*pmd))
- 			break;
- 
- 		pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
- 
- static void __init pagetable_init(void)
- {
--	pgd_t *pgd_base = swapper_pg_dir;
--
--	permanent_kmaps_init(pgd_base);
-+	permanent_kmaps_init(swapper_pg_dir);
- }
- 
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
-  * ACPI suspend needs this for resume, because things like the intel-agp
-  * driver might have split up a kernel 4MB mapping.
-  */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- 	__attribute__ ((aligned(PAGE_SIZE)));
- 
- static inline void save_pg_dir(void)
- {
--	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- 		flush_tlb_all();
- }
- 
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
- 
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
- 	 * Initialize the boot-time allocator (with low memory only):
- 	 */
- 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
--	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- 				 PAGE_SIZE);
- 	if (bootmap == -1L)
- 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -864,6 +863,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- 	BUG_ON(!mem_map);
- #endif
-@@ -881,7 +886,7 @@ void __init mem_init(void)
- 	set_highmem_pages_init();
- 
- 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
--	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
-+	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
- 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
- 
- 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +928,10 @@ void __init mem_init(void)
- 		((unsigned long)&__init_end -
- 		 (unsigned long)&__init_begin) >> 10,
- 
--		(unsigned long)&_etext, (unsigned long)&_edata,
--		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+		(unsigned long)&_sdata, (unsigned long)&_edata,
-+		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
- 
--		(unsigned long)&_text, (unsigned long)&_etext,
-+		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
- 
- 	/*
-@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read write\n",
- 		 start, start+size);
- 
-@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read only\n",
- 		 start, start+size);
- 
-@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
- 	unsigned long start = PFN_ALIGN(_text);
- 	unsigned long size = PFN_ALIGN(_etext) - start;
- 
-+	start = ktla_ktva(start);
- 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- 		size >> 10);
-diff -urNp linux-2.6.32.12/arch/x86/mm/init_64.c linux-2.6.32.12/arch/x86/mm/init_64.c
---- linux-2.6.32.12/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/init_64.c	2010-04-04 20:58:33.225084964 -0400
-@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
- 	pmd = fill_pmd(pud, vaddr);
- 	pte = fill_pte(pmd, vaddr);
- 
-+	pax_open_kernel();
- 	set_pte(pte, new_pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
- 		pgd = pgd_offset_k((unsigned long)__va(phys));
- 		if (pgd_none(*pgd)) {
- 			pud = (pud_t *) spp_getpage();
--			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- 		}
- 		pud = pud_offset(pgd, (unsigned long)__va(phys));
- 		if (pud_none(*pud)) {
- 			pmd = (pmd_t *) spp_getpage();
--			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- 		}
- 		pmd = pmd_offset(pud, phys);
- 		BUG_ON(!pmd_none(*pmd));
-@@ -656,6 +656,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- 	/* clear_bss() already clear the empty_zero_page */
- 
- 	reservedpages = 0;
-@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- 	.vm_start	= VSYSCALL_START,
- 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
--	.vm_page_prot	= PAGE_READONLY_EXEC,
--	.vm_flags	= VM_READ | VM_EXEC
-+	.vm_page_prot	= PAGE_READONLY,
-+	.vm_flags	= VM_READ
- };
- 
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
- 	if (vma == &gate_vma)
- 		return "[vsyscall]";
-diff -urNp linux-2.6.32.12/arch/x86/mm/init.c linux-2.6.32.12/arch/x86/mm/init.c
---- linux-2.6.32.12/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/init.c	2010-04-04 20:46:41.533557286 -0400
-@@ -69,11 +69,7 @@ static void __init find_early_table_spac
- 	 * cause a hotspot and fill up ZONE_DMA. The page tables
- 	 * need roughly 0.5KB per GB.
- 	 */
--#ifdef CONFIG_X86_32
--	start = 0x7000;
--#else
--	start = 0x8000;
--#endif
-+	start = 0x100000;
- 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- 					tables, PAGE_SIZE);
- 	if (e820_table_start == -1UL)
-@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
-  */
- int devmem_is_allowed(unsigned long pagenr)
- {
--	if (pagenr <= 256)
-+	if (!pagenr)
-+		return 1;
-+#ifdef CONFIG_VM86
-+	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
-+		return 1;
-+#endif
-+	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 1;
- 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- 		return 0;
-@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
- 
- void free_initmem(void)
- {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+#ifdef CONFIG_X86_32
-+	/* PaX: limit KERNEL_CS to actual size */
-+	unsigned long addr, limit;
-+	struct desc_struct d;
-+	int cpu;
-+
-+	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+	limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+	}
-+
-+	/* PaX: make KERNEL_CS read-only */
-+	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+	if (!paravirt_enabled())
-+		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+			pgd = pgd_offset_k(addr);
-+			pud = pud_offset(pgd, addr);
-+			pmd = pmd_offset(pud, addr);
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		}
-+*/
-+#ifdef CONFIG_X86_PAE
-+	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+	unsigned long addr, end;
-+
-+	/* PaX: make kernel code/rodata read-only, rest non-executable */
-+	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+
-+	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+	end = addr + KERNEL_IMAGE_SIZE;
-+	for (; addr < end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+	flush_tlb_all();
-+#endif
-+
- 	free_init_pages("unused kernel memory",
- 			(unsigned long)(&__init_begin),
- 			(unsigned long)(&__init_end));
-diff -urNp linux-2.6.32.12/arch/x86/mm/iomap_32.c linux-2.6.32.12/arch/x86/mm/iomap_32.c
---- linux-2.6.32.12/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/iomap_32.c	2010-04-04 20:46:41.533557286 -0400
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
- 	debug_kmap_atomic(type);
- 	idx = type + KM_TYPE_NR * smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+	pax_close_kernel();
-+
- 	arch_flush_lazy_mmu_mode();
- 
- 	return (void *)vaddr;
-diff -urNp linux-2.6.32.12/arch/x86/mm/ioremap.c linux-2.6.32.12/arch/x86/mm/ioremap.c
---- linux-2.6.32.12/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/ioremap.c	2010-04-04 20:46:41.533557286 -0400
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- 	 * Second special case: Some BIOSen report the PC BIOS
- 	 * area (640->1Mb) as ram even though it is not.
- 	 */
--	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
--		    pagenr < (BIOS_END >> PAGE_SHIFT))
-+	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 0;
- 
- 	for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
- 	/*
- 	 * Don't allow anybody to remap normal RAM that we're using..
- 	 */
--	for (pfn = phys_addr >> PAGE_SHIFT;
--				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
--				pfn++) {
--
-+	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- 		int is_ram = page_is_ram(pfn);
- 
--		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- 			return NULL;
- 		WARN_ON_ONCE(is_ram);
- 	}
-@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
- 
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
- 
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
- 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
- 
- 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
--	memset(bm_pte, 0, sizeof(bm_pte));
--	pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+	pmd_populate_user(&init_mm, pmd, bm_pte);
- 
- 	/*
- 	 * The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/kmemcheck/kmemcheck.c	2010-04-04 20:46:41.533557286 -0400
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
- 	 * memory (e.g. tracked pages)? For now, we need this to avoid
- 	 * invoking kmemcheck for PnP BIOS calls.
- 	 */
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		return false;
--	if (regs->cs != __KERNEL_CS)
-+	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- 		return false;
- 
- 	pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.32.12/arch/x86/mm/mmap.c linux-2.6.32.12/arch/x86/mm/mmap.c
---- linux-2.6.32.12/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/mmap.c	2010-04-04 20:46:41.537568318 -0400
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
-  * Leave an at least ~128 MB hole with possible stack randomization.
-  */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
- 
- /*
-  * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- 	return rnd << PAGE_SHIFT;
- }
- 
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (gap < MIN_GAP)
- 		gap = MIN_GAP;
- 	else if (gap > MAX_GAP)
- 		gap = MAX_GAP;
- 
--	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
- 
- /*
-  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
-  * does, but not when emulating X86_32
-  */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
--	if (mmap_is_ia32())
-+	if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+			return SEGMEXEC_TASK_UNMAPPED_BASE;
-+		else
-+#endif
-+
- 		return TASK_UNMAPPED_BASE;
--	else
-+	} else
- 		return TASK_UNMAPPED_BASE + mmap_rnd();
- }
- 
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	if (mmap_is_legacy()) {
--		mm->mmap_base = mmap_legacy_base();
-+		mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
--		mm->mmap_base = mmap_base();
-+		mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.12/arch/x86/mm/numa_32.c linux-2.6.32.12/arch/x86/mm/numa_32.c
---- linux-2.6.32.12/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/numa_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
- }
- #endif
- 
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
- 
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.32.12/arch/x86/mm/pageattr.c linux-2.6.32.12/arch/x86/mm/pageattr.c
---- linux-2.6.32.12/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/pageattr.c	2010-04-04 20:46:41.537568318 -0400
-@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
- 	 * Does not cover __inittext since that is gone later on. On
- 	 * 64bit we do not enforce !NX on the low mapping
- 	 */
--	if (within(address, (unsigned long)_text, (unsigned long)_etext))
-+	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
- 		pgprot_val(forbidden) |= _PAGE_NX;
- 
-+#ifdef CONFIG_DEBUG_RODATA
- 	/*
- 	 * The .rodata section needs to be read-only. Using the pfn
- 	 * catches all aliases.
-@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
- 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- 		pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
- 
- 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
- 
-@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- 	/* change init_mm */
-+	pax_open_kernel();
- 	set_pte_atomic(kpte, pte);
-+	pax_close_kernel();
-+
- #ifdef CONFIG_X86_32
- 	if (!SHARED_KERNEL_PMD) {
- 		struct page *page;
-diff -urNp linux-2.6.32.12/arch/x86/mm/pageattr-test.c linux-2.6.32.12/arch/x86/mm/pageattr-test.c
---- linux-2.6.32.12/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/pageattr-test.c	2010-04-04 20:46:41.537568318 -0400
-@@ -36,7 +36,7 @@ enum {
- 
- static int pte_testbit(pte_t pte)
- {
--	return pte_flags(pte) & _PAGE_UNUSED1;
-+	return pte_flags(pte) & _PAGE_CPA_TEST;
- }
- 
- struct split_state {
-diff -urNp linux-2.6.32.12/arch/x86/mm/pat.c linux-2.6.32.12/arch/x86/mm/pat.c
---- linux-2.6.32.12/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/pat.c	2010-04-04 20:46:41.537568318 -0400
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
- 
-  conflict:
- 	printk(KERN_INFO "%s:%d conflicting memory types "
--	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- 	       new->end, cattr_name(new->type), cattr_name(entry->type));
- 	return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
- 
- 	if (err) {
- 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
--			current->comm, current->pid, start, end);
-+			current->comm, task_pid_nr(current), start, end);
- 	}
- 
- 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
- 		printk(KERN_INFO
- 			"%s:%d ioremap_change_attr failed %s "
- 			"for %Lx-%Lx\n",
--			current->comm, current->pid,
-+			current->comm, task_pid_nr(current),
- 			cattr_name(flags),
- 			base, (unsigned long long)(base + size));
- 		return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
- 			free_memtype(paddr, paddr + size);
- 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- 				" for %Lx-%Lx, got %s\n",
--				current->comm, current->pid,
-+				current->comm, task_pid_nr(current),
- 				cattr_name(want_flags),
- 				(unsigned long long)paddr,
- 				(unsigned long long)(paddr + size),
-diff -urNp linux-2.6.32.12/arch/x86/mm/pgtable_32.c linux-2.6.32.12/arch/x86/mm/pgtable_32.c
---- linux-2.6.32.12/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/pgtable_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
- 		return;
- 	}
- 	pte = pte_offset_kernel(pmd, vaddr);
-+
-+	pax_open_kernel();
- 	if (pte_val(pteval))
- 		set_pte_at(&init_mm, vaddr, pte, pteval);
- 	else
- 		pte_clear(&init_mm, vaddr, pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-diff -urNp linux-2.6.32.12/arch/x86/mm/pgtable.c linux-2.6.32.12/arch/x86/mm/pgtable.c
---- linux-2.6.32.12/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/pgtable.c	2010-04-04 20:58:33.225084964 -0400
-@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
- #if PAGETABLE_LEVELS > 3
- void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
- 	tlb_remove_page(tlb, virt_to_page(pud));
-+#endif
-+
- }
- #endif	/* PAGETABLE_LEVELS > 3 */
- #endif	/* PAGETABLE_LEVELS > 2 */
-@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
- 	list_del(&page->lru);
- }
- 
--#define UNSHARED_PTRS_PER_PGD				\
--	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+	while (count--)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
-+#else
-+		*dst++ = *src++;
-+#endif
-+
-+}
-+
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	while (count--)
-+		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
-+#endif
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#ifdef CONFIG_X86_64
-+#define pxd_t				pud_t
-+#define pyd_t				pgd_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud)		pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
-+#define PYD_SIZE			PGDIR_SIZE
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud)		pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
-+#endif
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
-+#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
- 
- static void pgd_ctor(pgd_t *pgd)
- {
-@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
- 	pgd_list_del(pgd);
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- }
-+#endif
- 
- /*
-  * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * -- wli
-  */
- 
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
-  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
-  * updating the top-level pagetable entries to guarantee the
-@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
-  * and initialize the kernel pmds here.
-  */
--#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
- 
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
- 	if (mm == current->active_mm)
- 		write_cr3(read_cr3());
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS	USER_PGD_PTRS
- #else  /* !CONFIG_X86_PAE */
- 
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS	0
-+#define PREALLOCATED_PXDS	0
- 
- #endif	/* CONFIG_X86_PAE */
- 
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++)
--		if (pmds[i])
--			free_page((unsigned long)pmds[i]);
-+	for(i = 0; i < PREALLOCATED_PXDS; i++)
-+		if (pxds[i])
-+			free_page((unsigned long)pxds[i]);
- }
- 
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- 	int i;
- 	bool failed = false;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
--		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
--		if (pmd == NULL)
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+		if (pxd == NULL)
- 			failed = true;
--		pmds[i] = pmd;
-+		pxds[i] = pxd;
- 	}
- 
- 	if (failed) {
--		free_pmds(pmds);
-+		free_pxds(pxds);
- 		return -ENOMEM;
- 	}
- 
-@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
-  * preallocate which never got a corresponding vma will need to be
-  * freed manually.
-  */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
- 		pgd_t pgd = pgdp[i];
- 
- 		if (pgd_val(pgd) != 0) {
--			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
- 
--			pgdp[i] = native_make_pgd(0);
-+			set_pgd(pgdp + i, native_make_pgd(0));
- 
--			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
--			pmd_free(mm, pmd);
-+			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+			pxd_free(mm, pxd);
- 		}
- 	}
- }
- 
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
--	pud_t *pud;
-+	pyd_t *pyd;
- 	unsigned long addr;
- 	int i;
- 
--	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- 		return;
- 
--	pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+	pyd = pyd_offset(mm, 0L);
-+#else
-+	pyd = pyd_offset(pgd, 0L);
-+#endif
- 
-- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
--	     i++, pud++, addr += PUD_SIZE) {
--		pmd_t *pmd = pmds[i];
-+ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
-+	     i++, pyd++, addr += PYD_SIZE) {
-+		pxd_t *pxd = pxds[i];
- 
- 		if (i >= KERNEL_PGD_BOUNDARY)
--			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
--			       sizeof(pmd_t) * PTRS_PER_PMD);
-+			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+			       sizeof(pxd_t) * PTRS_PER_PMD);
- 
--		pud_populate(mm, pud, pmd);
-+		pyd_populate(mm, pyd, pxd);
- 	}
- }
- 
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- 	pgd_t *pgd;
--	pmd_t *pmds[PREALLOCATED_PMDS];
-+	pxd_t *pxds[PREALLOCATED_PXDS];
-+
- 	unsigned long flags;
- 
- 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 
- 	mm->pgd = pgd;
- 
--	if (preallocate_pmds(pmds) != 0)
-+	if (preallocate_pxds(pxds) != 0)
- 		goto out_free_pgd;
- 
- 	if (paravirt_pgd_alloc(mm) != 0)
--		goto out_free_pmds;
-+		goto out_free_pxds;
- 
- 	/*
- 	 * Make sure that pre-populating the pmds is atomic with
-@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 	spin_lock_irqsave(&pgd_lock, flags);
- 
- 	pgd_ctor(pgd);
--	pgd_prepopulate_pmd(mm, pgd, pmds);
-+	pgd_prepopulate_pxd(mm, pgd, pxds);
- 
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- 
- 	return pgd;
- 
--out_free_pmds:
--	free_pmds(pmds);
-+out_free_pxds:
-+	free_pxds(pxds);
- out_free_pgd:
- 	free_page((unsigned long)pgd);
- out:
-@@ -288,7 +354,7 @@ out:
- 
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
--	pgd_mop_up_pmds(mm, pgd);
-+	pgd_mop_up_pxds(mm, pgd);
- 	pgd_dtor(pgd);
- 	paravirt_pgd_free(mm, pgd);
- 	free_page((unsigned long)pgd);
-diff -urNp linux-2.6.32.12/arch/x86/mm/setup_nx.c linux-2.6.32.12/arch/x86/mm/setup_nx.c
---- linux-2.6.32.12/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/setup_nx.c	2010-04-04 20:46:41.537568318 -0400
-@@ -4,11 +4,10 @@
- 
- #include <asm/pgtable.h>
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
- 
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
-  * noexec = on|off
-  *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
- 	if (!str)
- 		return -EINVAL;
- 	if (!strncmp(str, "on", 2)) {
--		__supported_pte_mask |= _PAGE_NX;
--		disable_nx = 0;
-+		nx_enabled = 1;
- 	} else if (!strncmp(str, "off", 3)) {
--		disable_nx = 1;
--		__supported_pte_mask &= ~_PAGE_NX;
-+		nx_enabled = 0;
- 	}
- 	return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
- 
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
--	unsigned int v[4], l, h;
-+	if (!nx_enabled && cpu_has_nx) {
-+		unsigned l, h;
- 
--	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
--		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
--		if ((v[3] & (1 << 20)) && !disable_nx) {
--			rdmsr(MSR_EFER, l, h);
--			l |= EFER_NX;
--			wrmsr(MSR_EFER, l, h);
--			nx_enabled = 1;
--			__supported_pte_mask |= _PAGE_NX;
--		}
-+		__supported_pte_mask &= ~_PAGE_NX;
-+		rdmsr(MSR_EFER, l, h);
-+		l &= ~EFER_NX;
-+		wrmsr(MSR_EFER, l, h);
- 	}
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- 	unsigned long efer;
- 
- 	rdmsrl(MSR_EFER, efer);
--	if (!(efer & EFER_NX) || disable_nx)
-+	if (!(efer & EFER_NX) || !nx_enabled)
- 		__supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff -urNp linux-2.6.32.12/arch/x86/mm/tlb.c linux-2.6.32.12/arch/x86/mm/tlb.c
---- linux-2.6.32.12/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/mm/tlb.c	2010-04-04 20:58:33.225084964 -0400
-@@ -12,7 +12,7 @@
- #include <asm/uv/uv.h>
- 
- DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
--			= { &init_mm, 0, };
-+			= { &init_mm, 0 };
- 
- /*
-  *	Smarter SMP flushing macros.
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- 		BUG();
- 	cpumask_clear_cpu(cpu,
- 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
- 
-diff -urNp linux-2.6.32.12/arch/x86/oprofile/backtrace.c linux-2.6.32.12/arch/x86/oprofile/backtrace.c
---- linux-2.6.32.12/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/oprofile/backtrace.c	2010-04-04 20:46:41.537568318 -0400
-@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
- 	struct frame_head bufhead[2];
- 
- 	/* Also check accessibility of one struct frame_head beyond */
--	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
-+	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
- 		return NULL;
- 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
- 		return NULL;
-@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
- {
- 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
- 
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned long stack = kernel_stack_pointer(regs);
- 		if (depth)
- 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff -urNp linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/oprofile/op_model_p4.c	2010-04-04 20:46:41.537568318 -0400
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
- #endif
- }
- 
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- 	return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.32.12/arch/x86/pci/common.c linux-2.6.32.12/arch/x86/pci/common.c
---- linux-2.6.32.12/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/common.c	2010-04-04 20:46:41.537568318 -0400
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
- 
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val)
-@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- void __init dmi_check_pciprobe(void)
-diff -urNp linux-2.6.32.12/arch/x86/pci/direct.c linux-2.6.32.12/arch/x86/pci/direct.c
---- linux-2.6.32.12/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/direct.c	2010-04-04 20:46:41.537568318 -0400
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
- 
- #undef PCI_CONF1_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- 	.read =		pci_conf1_read,
- 	.write =	pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
- 
- #undef PCI_CONF2_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- 	.read =		pci_conf2_read,
- 	.write =	pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
-  * This should be close to trivial, but it isn't, because there are buggy
-  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
-  */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- 	u32 x = 0;
- 	int year, devfn;
-diff -urNp linux-2.6.32.12/arch/x86/pci/fixup.c linux-2.6.32.12/arch/x86/pci/fixup.c
---- linux-2.6.32.12/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/fixup.c	2010-04-04 20:46:41.537568318 -0400
-@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
-diff -urNp linux-2.6.32.12/arch/x86/pci/irq.c linux-2.6.32.12/arch/x86/pci/irq.c
---- linux-2.6.32.12/arch/x86/pci/irq.c	2010-04-29 17:49:37.625451376 -0400
-+++ linux-2.6.32.12/arch/x86/pci/irq.c	2010-04-29 17:49:58.053442872 -0400
-@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
- 	static struct pci_device_id __initdata pirq_440gx[] = {
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
--		{ },
-+		{ PCI_DEVICE(0, 0) }
- 	};
- 
- 	/* 440GX has a proprietary PIRQ router -- don't use it */
-@@ -1109,7 +1109,7 @@ static struct dmi_system_id __initdata p
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- int __init pcibios_irq_init(void)
-diff -urNp linux-2.6.32.12/arch/x86/pci/mmconfig_32.c linux-2.6.32.12/arch/x86/pci/mmconfig_32.c
---- linux-2.6.32.12/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/mmconfig_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.12/arch/x86/pci/mmconfig_64.c linux-2.6.32.12/arch/x86/pci/mmconfig_64.c
---- linux-2.6.32.12/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/mmconfig_64.c	2010-04-04 20:46:41.537568318 -0400
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.12/arch/x86/pci/numaq_32.c linux-2.6.32.12/arch/x86/pci/numaq_32.c
---- linux-2.6.32.12/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/numaq_32.c	2010-04-04 20:46:41.537568318 -0400
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
- 
- #undef PCI_CONF1_MQ_ADDRESS
- 
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- 	.read	= pci_conf1_mq_read,
- 	.write	= pci_conf1_mq_write
- };
-diff -urNp linux-2.6.32.12/arch/x86/pci/olpc.c linux-2.6.32.12/arch/x86/pci/olpc.c
---- linux-2.6.32.12/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/olpc.c	2010-04-04 20:46:41.537568318 -0400
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- 	.read =	pci_olpc_read,
- 	.write = pci_olpc_write,
- };
-diff -urNp linux-2.6.32.12/arch/x86/pci/pcbios.c linux-2.6.32.12/arch/x86/pci/pcbios.c
---- linux-2.6.32.12/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/pci/pcbios.c	2010-04-04 20:46:41.537568318 -0400
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
- 
- /*
-  * Returns the entry point for the given service, NULL on error
-  */
- 
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- 	unsigned char return_code;	/* %al */
- 	unsigned long address;		/* %ebx */
- 	unsigned long length;		/* %ecx */
- 	unsigned long entry;		/* %edx */
- 	unsigned long flags;
-+	struct desc_struct d, *gdt;
- 
- 	local_irq_save(flags);
--	__asm__("lcall *(%%edi); cld"
-+
-+	gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- 		: "=a" (return_code),
- 		  "=b" (address),
- 		  "=c" (length),
- 		  "=d" (entry)
- 		: "0" (service),
- 		  "1" (0),
--		  "D" (&bios32_indirect));
-+		  "D" (&bios32_indirect),
-+		  "r"(__PCIBIOS_DS)
-+		: "memory");
-+
-+	pax_open_kernel();
-+	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+	pax_close_kernel();
-+
- 	local_irq_restore(flags);
- 
- 	switch (return_code) {
--		case 0:
--			return address + entry;
--		case 0x80:	/* Not present */
--			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
--			return 0;
--		default: /* Shouldn't happen */
--			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
--				service, return_code);
-+	case 0: {
-+		int cpu;
-+		unsigned char flags;
-+
-+		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+			printk(KERN_WARNING "bios32_service: not valid\n");
- 			return 0;
-+		}
-+		address = address + PAGE_OFFSET;
-+		length += 16UL; /* some BIOSs underreport this... */
-+		flags = 4;
-+		if (length >= 64*1024*1024) {
-+			length >>= PAGE_SHIFT;
-+			flags |= 8;
-+		}
-+
-+		for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+			gdt = get_cpu_gdt_table(cpu);
-+			pack_descriptor(&d, address, length, 0x9b, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+			pack_descriptor(&d, address, length, 0x93, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+		}
-+		return entry;
-+	}
-+	case 0x80:	/* Not present */
-+		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+		return 0;
-+	default: /* Shouldn't happen */
-+		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+			service, return_code);
-+		return 0;
- 	}
- }
- 
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
- 
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
- 
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- 	unsigned long flags, pcibios_entry;
- 
- 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
--		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+		pci_indirect.address = pcibios_entry;
- 
- 		local_irq_save(flags);
--		__asm__(
--			"lcall *(%%edi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%edi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- 			  "=b" (ebx),
- 			  "=c" (ecx)
- 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
--			  "D" (&pci_indirect)
-+			  "D" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS)
- 			: "memory");
- 		local_irq_restore(flags);
- 
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 8 bits, do not trust the
- 		 * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xff;
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_WORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 16 bits, do not trust the
- 		 * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xffff;
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
-  * Function table for BIOS32 access
-  */
- 
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- 	.read =		pci_bios_read,
- 	.write =	pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
-  * Try to find PCI BIOS.
-  */
- 
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- 	union bios32 *check;
- 	unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
- 
- 	DBG("PCI: Fetching IRQ routing table... ");
- 	__asm__("push %%es\n\t"
-+		"movw %w8, %%ds\n\t"
- 		"push %%ds\n\t"
- 		"pop  %%es\n\t"
--		"lcall *(%%esi); cld\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
- 		"pop %%es\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
- 		  "1" (0),
- 		  "D" ((long) &opt),
- 		  "S" (&pci_indirect),
--		  "m" (opt)
-+		  "m" (opt),
-+		  "r" (__PCIBIOS_DS)
- 		: "memory");
- 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- 	if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
- {
- 	int ret;
- 
--	__asm__("lcall *(%%esi); cld\n\t"
-+	__asm__("movw %w5, %%ds\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
- 		: "0" (PCIBIOS_SET_PCI_HW_INT),
- 		  "b" ((dev->bus->number << 8) | dev->devfn),
- 		  "c" ((irq << 8) | (pin + 10)),
--		  "S" (&pci_indirect));
-+		  "S" (&pci_indirect),
-+		  "r" (__PCIBIOS_DS));
- 	return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.32.12/arch/x86/power/cpu.c linux-2.6.32.12/arch/x86/power/cpu.c
---- linux-2.6.32.12/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/power/cpu.c	2010-04-04 20:46:41.537568318 -0400
-@@ -126,7 +126,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- 	int cpu = smp_processor_id();
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 
- 	set_tss_desc(cpu, t);	/*
- 				 * This just modifies memory; should not be
-@@ -136,7 +136,9 @@ static void fix_processor_context(void)
- 				 */
- 
- #ifdef CONFIG_X86_64
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
-+	pax_close_kernel();
- 
- 	syscall_init();				/* This sets MSR_*STAR and related */
- #endif
-diff -urNp linux-2.6.32.12/arch/x86/vdso/Makefile linux-2.6.32.12/arch/x86/vdso/Makefile
---- linux-2.6.32.12/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/Makefile	2010-04-04 20:46:41.537568318 -0400
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
- 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
- 
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
- 
- #
-diff -urNp linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/vclock_gettime.c	2010-04-04 20:46:41.541133870 -0400
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
- 
- #define gtod vdso_vsyscall_gtod_data
- 
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+	long secs;
-+	asm volatile("syscall"
-+		: "=a" (secs)
-+		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+	return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- 	long ret;
- 	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- 	return ret;
- }
- 
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+	cycle_t ret = (cycle_t)vget_cycles();
-+
-+	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- 	long v;
--	cycles_t (*vread)(void);
--	vread = gtod->clock.vread;
--	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+		v = __vdso_vread_tsc();
-+	else
-+		v = __vdso_vread_hpet();
-+	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- 	return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
- 
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
- 
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
--	if (likely(gtod->sysctl_enabled))
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- 		switch (clock) {
- 		case CLOCK_REALTIME:
- 			if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
- int clock_gettime(clockid_t, struct timespec *)
- 	__attribute__((weak, alias("__vdso_clock_gettime")));
- 
--notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
- 	long ret;
--	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+	asm("syscall" : "=a" (ret) :
-+	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+	return ret;
-+}
-+
-+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+	{
- 		if (likely(tv != NULL)) {
- 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- 				     offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
- 		}
- 		return 0;
- 	}
--	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
--	return ret;
-+	return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- 	__attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/vdso32-setup.c	2010-04-04 20:46:41.541133870 -0400
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
- 
- enum {
- 	VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
- void enable_sep_cpu(void)
- {
- 	int cpu = get_cpu();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 
- 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
- 		put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
- 	if (compat)
- 		addr = VDSO_HIGH_BASE;
- 	else {
--		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- 		if (IS_ERR_VALUE(addr)) {
- 			ret = addr;
- 			goto up_fail;
- 		}
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	if (compat_uses_vma || !compat) {
- 		/*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
- 	}
- 
- 	current_thread_info()->sysenter_return =
--		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
- 
-   up_fail:
- 	if (ret)
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 
- 	up_write(&mm->mmap_sem);
- 
-@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table abi_root_table2[] = {
-@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
- 		.mode = 0555,
- 		.child = abi_table2
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static __init int ia32_binfmt_init(void)
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+		return "[vdso]";
-+#endif
-+
- 	return NULL;
- }
- 
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
- 	struct mm_struct *mm = tsk->mm;
- 
- 	/* Check to see if this task was created in compat vdso mode */
--	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- 		return &gate_vma;
- 	return NULL;
- }
-diff -urNp linux-2.6.32.12/arch/x86/vdso/vdso.lds.S linux-2.6.32.12/arch/x86/vdso/vdso.lds.S
---- linux-2.6.32.12/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/vdso.lds.S	2010-04-04 20:46:41.541133870 -0400
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef	VEXTERN
-+
-+#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef	VEXTERN
-diff -urNp linux-2.6.32.12/arch/x86/vdso/vextern.h linux-2.6.32.12/arch/x86/vdso/vextern.h
---- linux-2.6.32.12/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/vextern.h	2010-04-04 20:46:41.541133870 -0400
-@@ -11,6 +11,5 @@
-    put into vextern.h and be referenced as a pointer with vdso prefix.
-    The main kernel later fills in the values.   */
- 
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.32.12/arch/x86/vdso/vma.c linux-2.6.32.12/arch/x86/vdso/vma.c
---- linux-2.6.32.12/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/vdso/vma.c	2010-04-04 20:46:41.541133870 -0400
-@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
- 	if (!vbase)
- 		goto oom;
- 
--	if (memcmp(vbase, "\177ELF", 4)) {
-+	if (memcmp(vbase, ELFMAG, SELFMAG)) {
- 		printk("VDSO: I'm broken; not ELF\n");
- 		vdso_enabled = 0;
- 	}
-@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
- 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+	vunmap(vbase);
- 	return 0;
- 
-  oom:
-@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
- 		goto up_fail;
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	ret = install_special_mapping(mm, addr, vdso_size,
- 				      VM_READ|VM_EXEC|
-@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
- 				      VM_ALWAYSDUMP,
- 				      vdso_pages);
- 	if (ret) {
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 		goto up_fail;
- 	}
- 
-@@ -132,10 +133,3 @@ up_fail:
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
--	vdso_enabled = simple_strtoul(s, NULL, 0);
--	return 0;
--}
--__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.32.12/arch/x86/xen/enlighten.c linux-2.6.32.12/arch/x86/xen/enlighten.c
---- linux-2.6.32.12/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/xen/enlighten.c	2010-04-04 20:46:41.541133870 -0400
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
- 
- struct shared_info xen_dummy_shared_info;
- 
--void *xen_initial_gdt;
--
- /*
-  * Point at some empty memory to start with. We map the real shared_info
-  * page as soon as fixmap is up and running.
-@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
- 
- 	preempt_disable();
- 
--	start = __get_cpu_var(idt_desc).address;
-+	start = (unsigned long)__get_cpu_var(idt_desc).address;
- 	end = start + __get_cpu_var(idt_desc).size + 1;
- 
- 	xen_mc_flush();
-@@ -1133,13 +1131,6 @@ asmlinkage void __init xen_start_kernel(
- 
- 	machine_ops = xen_machine_ops;
- 
--	/*
--	 * The only reliable way to retain the initial address of the
--	 * percpu gdt_page is to remember it here, so we can go and
--	 * mark it RW later, when the initial percpu area is freed.
--	 */
--	xen_initial_gdt = &per_cpu(gdt_page, 0);
--
- 	xen_smp_init();
- 
- 	pgd = (pgd_t *)xen_start_info->pt_base;
-diff -urNp linux-2.6.32.12/arch/x86/xen/mmu.c linux-2.6.32.12/arch/x86/xen/mmu.c
---- linux-2.6.32.12/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/xen/mmu.c	2010-04-04 20:46:41.541133870 -0400
-@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	convert_pfn_mfn(init_level4_pgt);
- 	convert_pfn_mfn(level3_ident_pgt);
- 	convert_pfn_mfn(level3_kernel_pgt);
-+	convert_pfn_mfn(level3_vmalloc_pgt);
-+	convert_pfn_mfn(level3_vmemmap_pgt);
- 
- 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
- 
-diff -urNp linux-2.6.32.12/arch/x86/xen/smp.c linux-2.6.32.12/arch/x86/xen/smp.c
---- linux-2.6.32.12/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/xen/smp.c	2010-04-04 20:46:41.541133870 -0400
-@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
- {
- 	BUG_ON(smp_processor_id() != 0);
- 	native_smp_prepare_boot_cpu();
--
--	/* We've switched to the "real" per-cpu gdt, so make sure the
--	   old memory can be recycled */
--	make_lowmem_page_readwrite(xen_initial_gdt);
--
- 	xen_setup_vcpu_info_placement();
- }
- 
-@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
- 	gdt = get_cpu_gdt_table(cpu);
- 
- 	ctxt->flags = VGCF_IN_KERNEL;
--	ctxt->user_regs.ds = __USER_DS;
--	ctxt->user_regs.es = __USER_DS;
-+	ctxt->user_regs.ds = __KERNEL_DS;
-+	ctxt->user_regs.es = __KERNEL_DS;
- 	ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- 	ctxt->user_regs.fs = __KERNEL_PERCPU;
-diff -urNp linux-2.6.32.12/arch/x86/xen/xen-ops.h linux-2.6.32.12/arch/x86/xen/xen-ops.h
---- linux-2.6.32.12/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/arch/x86/xen/xen-ops.h	2010-04-04 20:46:41.541133870 -0400
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
- 
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
- 
-diff -urNp linux-2.6.32.12/block/blk-integrity.c linux-2.6.32.12/block/blk-integrity.c
---- linux-2.6.32.12/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/blk-integrity.c	2010-04-04 20:46:41.541133870 -0400
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
- 	NULL,
- };
- 
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- 	.show	= &integrity_attr_show,
- 	.store	= &integrity_attr_store,
- };
-diff -urNp linux-2.6.32.12/block/blk-iopoll.c linux-2.6.32.12/block/blk-iopoll.c
---- linux-2.6.32.12/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/blk-iopoll.c	2010-04-04 20:46:41.541133870 -0400
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
- 
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- 	int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.32.12/block/blk-map.c linux-2.6.32.12/block/blk-map.c
---- linux-2.6.32.12/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/blk-map.c	2010-04-04 20:46:41.541133870 -0400
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
- 	 * direct dma. else, set up kernel bounce buffers
- 	 */
- 	uaddr = (unsigned long) ubuf;
--	if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- 	else
- 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
- 	if (!len || !kbuf)
- 		return -EINVAL;
- 
--	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- 	if (do_copy)
- 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- 	else
-diff -urNp linux-2.6.32.12/block/blk-softirq.c linux-2.6.32.12/block/blk-softirq.c
---- linux-2.6.32.12/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/blk-softirq.c	2010-04-04 20:46:41.541133870 -0400
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
-  * Softirq action handler - move entries to local list and loop over them
-  * while passing them to the queue registered handler.
-  */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- 	struct list_head *cpu_list, local_list;
- 
-diff -urNp linux-2.6.32.12/block/blk-sysfs.c linux-2.6.32.12/block/blk-sysfs.c
---- linux-2.6.32.12/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/blk-sysfs.c	2010-04-04 20:46:41.541133870 -0400
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
- 	kmem_cache_free(blk_requestq_cachep, q);
- }
- 
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- 	.show	= queue_attr_show,
- 	.store	= queue_attr_store,
- };
-diff -urNp linux-2.6.32.12/block/elevator.c linux-2.6.32.12/block/elevator.c
---- linux-2.6.32.12/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/block/elevator.c	2010-04-04 20:46:41.541133870 -0400
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
- 	return error;
- }
- 
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- 	.show	= elv_attr_show,
- 	.store	= elv_attr_store,
- };
-diff -urNp linux-2.6.32.12/crypto/lrw.c linux-2.6.32.12/crypto/lrw.c
---- linux-2.6.32.12/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/crypto/lrw.c	2010-04-04 20:46:41.541133870 -0400
-@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
- 	struct priv *ctx = crypto_tfm_ctx(parent);
- 	struct crypto_cipher *child = ctx->child;
- 	int err, i;
--	be128 tmp = { 0 };
-+	be128 tmp = { 0, 0 };
- 	int bsize = crypto_cipher_blocksize(child);
- 
- 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
-diff -urNp linux-2.6.32.12/Documentation/dontdiff linux-2.6.32.12/Documentation/dontdiff
---- linux-2.6.32.12/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/Documentation/dontdiff	2010-04-04 20:47:28.952733264 -0400
-@@ -3,6 +3,7 @@
- *.bin
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
-@@ -40,6 +41,7 @@
- *.ver
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
-@@ -49,11 +51,16 @@
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -76,7 +83,10 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -103,13 +113,14 @@ gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
- keywords.c
- ksym.c*
- ksym.h*
-@@ -133,7 +144,9 @@ mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +162,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -163,6 +177,7 @@ setup
- setup.bin
- setup.elf
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -186,14 +201,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff -urNp linux-2.6.32.12/Documentation/kernel-parameters.txt linux-2.6.32.12/Documentation/kernel-parameters.txt
---- linux-2.6.32.12/Documentation/kernel-parameters.txt	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/Documentation/kernel-parameters.txt	2010-04-04 20:46:41.541133870 -0400
-@@ -1833,6 +1833,12 @@ and is between 256 and 4096 characters. 
- 			the specified number of seconds.  This is to be used if
- 			your oopses keep scrolling off the screen.
- 
-+	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
-+			virtualization environments that don't cope well with the
-+			expand down segment used by UDEREF on X86-32.
-+
-+	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
-+
- 	pcbit=		[HW,ISDN]
- 
- 	pcd.		[PARIDE]
-diff -urNp linux-2.6.32.12/drivers/acpi/battery.c linux-2.6.32.12/drivers/acpi/battery.c
---- linux-2.6.32.12/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/battery.c	2010-04-04 20:46:41.541133870 -0400
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- 	}
- 
- static struct battery_file {
--	struct file_operations ops;
-+	const struct file_operations ops;
- 	mode_t mode;
- 	const char *name;
- } acpi_battery_file[] = {
-diff -urNp linux-2.6.32.12/drivers/acpi/blacklist.c linux-2.6.32.12/drivers/acpi/blacklist.c
---- linux-2.6.32.12/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/blacklist.c	2010-04-04 20:46:41.541133870 -0400
-@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
- 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
- 	 "Incorrect _ADR", 1},
- 
--	{""}
-+	{"", "", 0, NULL, all_versions, NULL, 0}
- };
- 
- #if	CONFIG_ACPI_BLACKLIST_YEAR
-diff -urNp linux-2.6.32.12/drivers/acpi/dock.c linux-2.6.32.12/drivers/acpi/dock.c
---- linux-2.6.32.12/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/dock.c	2010-04-04 20:46:41.544756868 -0400
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- 	struct list_head list;
- 	struct list_head hotplug_list;
- 	acpi_handle handle;
--	struct acpi_dock_ops *ops;
-+	const struct acpi_dock_ops *ops;
- 	void *context;
- };
- 
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
-  * the dock driver after _DCK is executed.
-  */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- 			     void *context)
- {
- 	struct dock_dependent_device *dd;
-diff -urNp linux-2.6.32.12/drivers/acpi/osl.c linux-2.6.32.12/drivers/acpi/osl.c
---- linux-2.6.32.12/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/osl.c	2010-04-04 20:46:41.544756868 -0400
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 	if (!value)
- 		value = &dummy;
- 
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 
- 	switch (width) {
- 	case 8:
-diff -urNp linux-2.6.32.12/drivers/acpi/power_meter.c linux-2.6.32.12/drivers/acpi/power_meter.c
---- linux-2.6.32.12/drivers/acpi/power_meter.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/power_meter.c	2010-04-29 17:46:37.081234462 -0400
-@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
- 		return res;
- 
- 	temp /= 1000;
--	if (temp < 0)
--		return -EINVAL;
- 
- 	mutex_lock(&resource->lock);
- 	resource->trip[attr->index - 7] = temp;
-diff -urNp linux-2.6.32.12/drivers/acpi/proc.c linux-2.6.32.12/drivers/acpi/proc.c
---- linux-2.6.32.12/drivers/acpi/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/proc.c	2010-04-29 17:46:37.081234462 -0400
-@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
- 				size_t count, loff_t * ppos)
- {
- 	struct list_head *node, *next;
--	char strbuf[5];
--	char str[5] = "";
--	unsigned int len = count;
-+	char strbuf[5] = {0};
- 	struct acpi_device *found_dev = NULL;
- 
--	if (len > 4)
--		len = 4;
--	if (len < 0)
--		return -EFAULT;
-+	if (count > 4)
-+		count = 4;
- 
--	if (copy_from_user(strbuf, buffer, len))
-+	if (copy_from_user(strbuf, buffer, count))
- 		return -EFAULT;
--	strbuf[len] = '\0';
--	sscanf(strbuf, "%s", str);
-+	strbuf[count] = '\0';
- 
- 	mutex_lock(&acpi_device_lock);
- 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
-@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
- 		if (!dev->wakeup.flags.valid)
- 			continue;
- 
--		if (!strncmp(dev->pnp.bus_id, str, 4)) {
-+		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
- 			dev->wakeup.state.enabled =
- 			    dev->wakeup.state.enabled ? 0 : 1;
- 			found_dev = dev;
-diff -urNp linux-2.6.32.12/drivers/acpi/processor_core.c linux-2.6.32.12/drivers/acpi/processor_core.c
---- linux-2.6.32.12/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/processor_core.c	2010-04-04 20:46:41.544756868 -0400
-@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
- 		return 0;
- 	}
- 
--	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+	BUG_ON(pr->id >= nr_cpu_ids);
- 
- 	/*
- 	 * Buggy BIOS check
-diff -urNp linux-2.6.32.12/drivers/acpi/processor_idle.c linux-2.6.32.12/drivers/acpi/processor_idle.c
---- linux-2.6.32.12/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/processor_idle.c	2010-04-04 20:46:41.544756868 -0400
-@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
- 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
- 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
- 	 (void *)1},
--	{},
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
- };
- 
- 
-diff -urNp linux-2.6.32.12/drivers/acpi/sleep.c linux-2.6.32.12/drivers/acpi/sleep.c
---- linux-2.6.32.12/drivers/acpi/sleep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/sleep.c	2010-04-04 20:46:41.544756868 -0400
-@@ -297,7 +297,7 @@ static int acpi_suspend_state_valid(susp
- 	}
- }
- 
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin,
- 	.prepare_late = acpi_pm_prepare,
-@@ -325,7 +325,7 @@ static int acpi_suspend_begin_old(suspen
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin_old,
- 	.prepare_late = acpi_pm_disable_gpes,
-@@ -552,7 +552,7 @@ static void acpi_pm_enable_gpes(void)
- 	acpi_enable_all_runtime_gpes();
- }
- 
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- 	.begin = acpi_hibernation_begin,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -605,7 +605,7 @@ static int acpi_hibernation_pre_snapshot
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- 	.begin = acpi_hibernation_begin_old,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff -urNp linux-2.6.32.12/drivers/acpi/video.c linux-2.6.32.12/drivers/acpi/video.c
---- linux-2.6.32.12/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/acpi/video.c	2010-04-04 20:46:41.544756868 -0400
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
- 				vd->brightness->levels[request_level]);
- }
- 
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- 	.get_brightness = acpi_video_get_brightness,
- 	.update_status  = acpi_video_set_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/ahci.c linux-2.6.32.12/drivers/ata/ahci.c
---- linux-2.6.32.12/drivers/ata/ahci.c	2010-04-29 17:49:37.661448235 -0400
-+++ linux-2.6.32.12/drivers/ata/ahci.c	2010-04-29 17:49:58.057498948 -0400
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
- 	.sdev_attrs		= ahci_sdev_attrs,
- };
- 
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
- 	.port_stop		= ahci_port_stop,
- };
- 
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_vt8251_hardreset,
- };
- 
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_p5wdh_hardreset,
- };
- 
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- 	.inherits		= &ahci_ops,
- 	.softreset		= ahci_sb600_softreset,
- 	.pmp_softreset		= ahci_sb600_softreset,
-@@ -687,7 +687,7 @@ static const struct pci_device_id ahci_p
- 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
- 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
- 
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- 
-diff -urNp linux-2.6.32.12/drivers/ata/ata_generic.c linux-2.6.32.12/drivers/ata/ata_generic.c
---- linux-2.6.32.12/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/ata_generic.c	2010-04-04 20:46:41.544756868 -0400
-@@ -95,7 +95,7 @@ static struct scsi_host_template generic
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_mode	= generic_set_mode,
-diff -urNp linux-2.6.32.12/drivers/ata/ata_piix.c linux-2.6.32.12/drivers/ata/ata_piix.c
---- linux-2.6.32.12/drivers/ata/ata_piix.c	2010-04-29 17:49:37.669446700 -0400
-+++ linux-2.6.32.12/drivers/ata/ata_piix.c	2010-04-29 18:01:47.141162449 -0400
-@@ -299,7 +299,7 @@ static const struct pci_device_id piix_p
- 	{ 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
- 	/* SATA Controller IDE (CPT) */
- 	{ 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- static struct pci_driver piix_pci_driver = {
-@@ -317,7 +317,7 @@ static struct scsi_host_template piix_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= piix_set_piomode,
-@@ -325,22 +325,22 @@ static struct ata_port_operations piix_p
- 	.prereset		= piix_pata_prereset,
- };
- 
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.bmdma_status		= piix_vmw_bmdma_status,
- };
- 
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.cable_detect		= ich_pata_cable_detect,
- 	.set_dmamode		= ich_set_dmamode,
- };
- 
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- };
- 
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- 	.inherits		= &piix_sata_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= piix_sidpr_scr_read,
-@@ -616,7 +616,7 @@ static const struct ich_laptop ich_lapto
- 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
- 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
- 	/* end marker */
--	{ 0, }
-+	{ 0, 0, 0 }
- };
- 
- /**
-@@ -1094,7 +1094,7 @@ static int piix_broken_suspend(void)
- 			},
- 		},
- 
--		{ }	/* terminate list */
-+		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
- 	};
- 	static const char *oemstrs[] = {
- 		"Tecra M3,",
-diff -urNp linux-2.6.32.12/drivers/ata/libata-acpi.c linux-2.6.32.12/drivers/ata/libata-acpi.c
---- linux-2.6.32.12/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/libata-acpi.c	2010-04-04 20:46:41.544756868 -0400
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
- 	ata_acpi_uevent(dev->link->ap, dev, event);
- }
- 
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- 	.handler = ata_acpi_dev_notify_dock,
- 	.uevent = ata_acpi_dev_uevent,
- };
- 
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- 	.handler = ata_acpi_ap_notify_dock,
- 	.uevent = ata_acpi_ap_uevent,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/libata-core.c linux-2.6.32.12/drivers/ata/libata-core.c
---- linux-2.6.32.12/drivers/ata/libata-core.c	2010-04-29 17:49:37.689144697 -0400
-+++ linux-2.6.32.12/drivers/ata/libata-core.c	2010-04-29 17:49:58.081481928 -0400
-@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
- 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
- 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
- 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
--	{ -1, },
-+	{ -1, 0, 0 }
- };
- 
- /**
-@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
- 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
- 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
- 
--	{ 0xFF }
-+	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
-@@ -4388,7 +4388,7 @@ static const struct ata_blacklist_entry 
- 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
- 
- 	/* End Marker */
--	{ }
-+	{ NULL, NULL, 0 }
- };
- 
- static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
-@@ -5964,7 +5964,7 @@ static void ata_host_stop(struct device 
-  *	LOCKING:
-  *	None.
-  */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- 	static DEFINE_SPINLOCK(lock);
- 	const struct ata_port_operations *cur;
-@@ -5976,6 +5976,7 @@ static void ata_finalize_port_ops(struct
- 		return;
- 
- 	spin_lock(&lock);
-+	pax_open_kernel();
- 
- 	for (cur = ops->inherits; cur; cur = cur->inherits) {
- 		void **inherit = (void **)cur;
-@@ -5989,8 +5990,9 @@ static void ata_finalize_port_ops(struct
- 		if (IS_ERR(*pp))
- 			*pp = NULL;
- 
--	ops->inherits = NULL;
-+	((struct ata_port_operations *)ops)->inherits = NULL;
- 
-+	pax_close_kernel();
- 	spin_unlock(&lock);
- }
- 
-@@ -6087,7 +6089,7 @@ int ata_host_start(struct ata_host *host
-  */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
--		   unsigned long flags, struct ata_port_operations *ops)
-+		   unsigned long flags, const struct ata_port_operations *ops)
- {
- 	spin_lock_init(&host->lock);
- 	host->dev = dev;
-@@ -6750,7 +6752,7 @@ static void ata_dummy_error_handler(stru
- 	/* truly dummy */
- }
- 
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- 	.qc_prep		= ata_noop_qc_prep,
- 	.qc_issue		= ata_dummy_qc_issue,
- 	.error_handler		= ata_dummy_error_handler,
-diff -urNp linux-2.6.32.12/drivers/ata/libata-eh.c linux-2.6.32.12/drivers/ata/libata-eh.c
---- linux-2.6.32.12/drivers/ata/libata-eh.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/libata-eh.c	2010-04-04 20:46:41.544756868 -0400
-@@ -3581,7 +3581,7 @@ void ata_do_eh(struct ata_port *ap, ata_
-  */
- void ata_std_error_handler(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	ata_reset_fn_t hardreset = ops->hardreset;
- 
- 	/* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.32.12/drivers/ata/libata-pmp.c linux-2.6.32.12/drivers/ata/libata-pmp.c
---- linux-2.6.32.12/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/libata-pmp.c	2010-04-04 20:46:41.544756868 -0400
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
-  */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- 	struct ata_link *pmp_link = &ap->link;
- 	struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.32.12/drivers/ata/pata_acpi.c linux-2.6.32.12/drivers/ata/pata_acpi.c
---- linux-2.6.32.12/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_acpi.c	2010-04-04 20:46:41.549452547 -0400
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= pacpi_qc_issue,
- 	.cable_detect		= pacpi_cable_detect,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_ali.c linux-2.6.32.12/drivers/ata/pata_ali.c
---- linux-2.6.32.12/drivers/ata/pata_ali.c	2010-04-29 17:49:37.689144697 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_ali.c	2010-04-29 17:49:58.081481928 -0400
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
-  *	Port operations for PIO only ALi
-  */
- 
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations 
-  *	Port operations for DMA capable ALi without cable
-  *	detect
-  */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.mode_filter	= ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
- /*
-  *	Port operations for DMA capable ALi with cable detect and LBA48
-  */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.dev_config	= ali_warn_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_amd.c linux-2.6.32.12/drivers/ata/pata_amd.c
---- linux-2.6.32.12/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_amd.c	2010-04-04 20:46:41.549452547 -0400
-@@ -397,28 +397,28 @@ static const struct ata_port_operations 
- 	.prereset	= amd_pre_reset,
- };
- 
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= amd33_set_piomode,
- 	.set_dmamode	= amd33_set_dmamode,
- };
- 
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd66_set_piomode,
- 	.set_dmamode	= amd66_set_dmamode,
- };
- 
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd100_set_piomode,
- 	.set_dmamode	= amd100_set_dmamode,
- };
- 
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= amd_cable_detect,
- 	.set_piomode	= amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations 
- 	.host_stop	= nv_host_stop,
- };
- 
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv100_set_piomode,
- 	.set_dmamode	= nv100_set_dmamode,
- };
- 
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv133_set_piomode,
- 	.set_dmamode	= nv133_set_dmamode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_artop.c linux-2.6.32.12/drivers/ata/pata_artop.c
---- linux-2.6.32.12/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_artop.c	2010-04-04 20:46:41.549452547 -0400
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
- 	.qc_defer		= artop6210_qc_defer,
- };
- 
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= artop6260_cable_detect,
- 	.set_piomode		= artop6260_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_at32.c linux-2.6.32.12/drivers/ata/pata_at32.c
---- linux-2.6.32.12/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_at32.c	2010-04-04 20:46:41.549452547 -0400
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= pata_at32_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_at91.c linux-2.6.32.12/drivers/ata/pata_at91.c
---- linux-2.6.32.12/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_at91.c	2010-04-04 20:46:41.549452547 -0400
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 
- 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_atiixp.c linux-2.6.32.12/drivers/ata/pata_atiixp.c
---- linux-2.6.32.12/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_atiixp.c	2010-04-04 20:46:41.549452547 -0400
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_atp867x.c linux-2.6.32.12/drivers/ata/pata_atp867x.c
---- linux-2.6.32.12/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_atp867x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= atp867x_cable_detect,
- 	.set_piomode		= atp867x_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_bf54x.c linux-2.6.32.12/drivers/ata/pata_bf54x.c
---- linux-2.6.32.12/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_bf54x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.set_piomode		= bfin_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cmd640.c linux-2.6.32.12/drivers/ata/pata_cmd640.c
---- linux-2.6.32.12/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cmd640.c	2010-04-04 20:46:41.549452547 -0400
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cmd64x.c linux-2.6.32.12/drivers/ata/pata_cmd64x.c
---- linux-2.6.32.12/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cmd64x.c	2010-04-04 20:46:41.549452547 -0400
-@@ -275,18 +275,18 @@ static const struct ata_port_operations 
- 	.set_dmamode	= cmd64x_set_dmamode,
- };
- 
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd646r1_bmdma_stop,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd648_bmdma_stop,
- 	.cable_detect	= cmd648_cable_detect,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5520.c linux-2.6.32.12/drivers/ata/pata_cs5520.c
---- linux-2.6.32.12/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cs5520.c	2010-04-04 20:46:41.549452547 -0400
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_prep		= ata_sff_dumb_qc_prep,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5530.c linux-2.6.32.12/drivers/ata/pata_cs5530.c
---- linux-2.6.32.12/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cs5530.c	2010-04-04 20:46:41.549452547 -0400
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5535.c linux-2.6.32.12/drivers/ata/pata_cs5535.c
---- linux-2.6.32.12/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cs5535.c	2010-04-04 20:46:41.549452547 -0400
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= cs5535_cable_detect,
- 	.set_piomode	= cs5535_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cs5536.c linux-2.6.32.12/drivers/ata/pata_cs5536.c
---- linux-2.6.32.12/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cs5536.c	2010-04-04 20:46:41.549452547 -0400
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= cs5536_cable_detect,
- 	.set_piomode		= cs5536_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_cypress.c linux-2.6.32.12/drivers/ata/pata_cypress.c
---- linux-2.6.32.12/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_cypress.c	2010-04-04 20:46:41.549452547 -0400
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= cy82c693_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_efar.c linux-2.6.32.12/drivers/ata/pata_efar.c
---- linux-2.6.32.12/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_efar.c	2010-04-04 20:46:41.549452547 -0400
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= efar_cable_detect,
- 	.set_piomode		= efar_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt366.c linux-2.6.32.12/drivers/ata/pata_hpt366.c
---- linux-2.6.32.12/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_hpt366.c	2010-04-04 20:46:41.549452547 -0400
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
-  *	Configuration for HPT366/68
-  */
- 
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= hpt36x_cable_detect,
- 	.mode_filter	= hpt366_filter,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt37x.c linux-2.6.32.12/drivers/ata/pata_hpt37x.c
---- linux-2.6.32.12/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_hpt37x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
-  *	Configuration for HPT370
-  */
- 
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
-  *	Configuration for HPT370A. Close to 370 but less filters
-  */
- 
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- 	.inherits	= &hpt370_port_ops,
- 	.mode_filter	= hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
-  *	and DMA mode setting functionality.
-  */
- 
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
-  *	but we have a different cable detection procedure for function 1.
-  */
- 
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- 	.inherits	= &hpt372_port_ops,
- 	.prereset	= hpt374_fn1_pre_reset,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_hpt3x2n.c	2010-04-04 20:46:41.552552724 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
-  *	Configuration for HPT3x2n.
-  */
- 
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt3x2n_bmdma_stop,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_hpt3x3.c linux-2.6.32.12/drivers/ata/pata_hpt3x3.c
---- linux-2.6.32.12/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_hpt3x3.c	2010-04-04 20:46:41.552552724 -0400
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= hpt3x3_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_icside.c linux-2.6.32.12/drivers/ata/pata_icside.c
---- linux-2.6.32.12/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_icside.c	2010-04-04 20:46:41.552552724 -0400
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
- 	}
- }
- 
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	/* no need to build any PRD tables for DMA */
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_isapnp.c linux-2.6.32.12/drivers/ata/pata_isapnp.c
---- linux-2.6.32.12/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_isapnp.c	2010-04-04 20:46:41.552552724 -0400
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	/* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.32.12/drivers/ata/pata_it8213.c linux-2.6.32.12/drivers/ata/pata_it8213.c
---- linux-2.6.32.12/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_it8213.c	2010-04-04 20:46:41.552552724 -0400
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
- };
- 
- 
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= it8213_cable_detect,
- 	.set_piomode		= it8213_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_it821x.c linux-2.6.32.12/drivers/ata/pata_it821x.c
---- linux-2.6.32.12/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_it821x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_ixp4xx_cf.c	2010-04-04 20:46:41.552552724 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_jmicron.c linux-2.6.32.12/drivers/ata/pata_jmicron.c
---- linux-2.6.32.12/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_jmicron.c	2010-04-04 20:46:41.552552724 -0400
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= jmicron_pre_reset,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_legacy.c linux-2.6.32.12/drivers/ata/pata_legacy.c
---- linux-2.6.32.12/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_legacy.c	2010-04-04 20:46:41.552552724 -0400
-@@ -106,7 +106,7 @@ struct legacy_probe {
- 
- struct legacy_controller {
- 	const char *name;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned int pio_mask;
- 	unsigned int flags;
- 	unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations 
-  *	pio_mask as well.
-  */
- 
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
- 
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.set_mode	= legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
- 	return buflen;
- }
- 
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= pdc20230_set_piomode,
- 	.sff_data_xfer	= pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
- }
- 
- 
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
- 	return ata_sff_qc_issue(qc);
- }
- 
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c46x_set_piomode,
- 	.qc_issue	= opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
- 	return 0;
- }
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6500_set_piomode,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580dp_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
- 	return 0;
- }
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= winbond_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
- 	int pio_modes = controller->pio_mask;
- 	unsigned long io = probe->port;
- 	u32 mask = (1 << probe->slot);
--	struct ata_port_operations *ops = controller->ops;
-+	const struct ata_port_operations *ops = controller->ops;
- 	struct legacy_data *ld = &legacy_data[probe->slot];
- 	struct ata_host *host = NULL;
- 	struct ata_port *ap;
-diff -urNp linux-2.6.32.12/drivers/ata/pata_marvell.c linux-2.6.32.12/drivers/ata/pata_marvell.c
---- linux-2.6.32.12/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_marvell.c	2010-04-04 20:46:41.552552724 -0400
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= marvell_cable_detect,
- 	.prereset		= marvell_pre_reset,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_mpc52xx.c linux-2.6.32.12/drivers/ata/pata_mpc52xx.c
---- linux-2.6.32.12/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_mpc52xx.c	2010-04-04 20:46:41.552552724 -0400
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_dev_select		= mpc52xx_ata_dev_select,
- 	.set_piomode		= mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_mpiix.c linux-2.6.32.12/drivers/ata/pata_mpiix.c
---- linux-2.6.32.12/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_mpiix.c	2010-04-04 20:46:41.552552724 -0400
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= mpiix_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_netcell.c linux-2.6.32.12/drivers/ata/pata_netcell.c
---- linux-2.6.32.12/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_netcell.c	2010-04-04 20:46:41.552552724 -0400
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_80wire,
- 	.read_id	= netcell_read_id,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_ninja32.c linux-2.6.32.12/drivers/ata/pata_ninja32.c
---- linux-2.6.32.12/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_ninja32.c	2010-04-04 20:46:41.552552724 -0400
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.sff_dev_select = ninja32_dev_select,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_ns87410.c linux-2.6.32.12/drivers/ata/pata_ns87410.c
---- linux-2.6.32.12/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_ns87410.c	2010-04-04 20:46:41.552552724 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= ns87410_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_ns87415.c linux-2.6.32.12/drivers/ata/pata_ns87415.c
---- linux-2.6.32.12/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_ns87415.c	2010-04-04 20:46:41.552552724 -0400
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
- }
- #endif		/* 87560 SuperIO Support */
- 
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma	= ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
- };
- 
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- 	.inherits		= &ns87415_pata_ops,
- 	.sff_tf_read		= ns87560_tf_read,
- 	.sff_check_status	= ns87560_check_status,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_octeon_cf.c linux-2.6.32.12/drivers/ata/pata_octeon_cf.c
---- linux-2.6.32.12/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_octeon_cf.c	2010-04-04 20:46:41.552552724 -0400
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_oldpiix.c linux-2.6.32.12/drivers/ata/pata_oldpiix.c
---- linux-2.6.32.12/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_oldpiix.c	2010-04-04 20:46:41.552552724 -0400
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= oldpiix_qc_issue,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_opti.c linux-2.6.32.12/drivers/ata/pata_opti.c
---- linux-2.6.32.12/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_opti.c	2010-04-04 20:46:41.552552724 -0400
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= opti_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_optidma.c linux-2.6.32.12/drivers/ata/pata_optidma.c
---- linux-2.6.32.12/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_optidma.c	2010-04-04 20:46:41.552552724 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
- 	.prereset	= optidma_pre_reset,
- };
- 
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- 	.inherits	= &optidma_port_ops,
- 	.set_piomode	= optiplus_set_pio_mode,
- 	.set_dmamode	= optiplus_set_dma_mode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_palmld.c linux-2.6.32.12/drivers/ata/pata_palmld.c
---- linux-2.6.32.12/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_palmld.c	2010-04-04 20:46:41.552552724 -0400
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_pcmcia.c linux-2.6.32.12/drivers/ata/pata_pcmcia.c
---- linux-2.6.32.12/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_pcmcia.c	2010-04-04 20:46:41.552552724 -0400
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= pcmcia_set_mode,
- };
- 
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_data_xfer_8bit,
- 	.cable_detect	= ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
- 	unsigned long io_base, ctl_base;
- 	void __iomem *io_addr, *ctl_addr;
- 	int n_ports = 1;
--	struct ata_port_operations *ops = &pcmcia_port_ops;
-+	const struct ata_port_operations *ops = &pcmcia_port_ops;
- 
- 	info = kzalloc(sizeof(*info), GFP_KERNEL);
- 	if (info == NULL)
-diff -urNp linux-2.6.32.12/drivers/ata/pata_pdc2027x.c linux-2.6.32.12/drivers/ata/pata_pdc2027x.c
---- linux-2.6.32.12/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_pdc2027x.c	2010-04-04 20:46:41.552552724 -0400
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
- 	.cable_detect		= pdc2027x_cable_detect,
- 	.prereset		= pdc2027x_prereset,
- };
- 
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- 	.inherits		= &pdc2027x_pata100_ops,
- 	.mode_filter		= pdc2027x_mode_filter,
- 	.set_piomode		= pdc2027x_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_pdc202xx_old.c	2010-04-04 20:46:41.552552724 -0400
-@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.cable_detect		= ata_cable_40wire,
-@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
- 	.set_dmamode		= pdc202xx_set_dmamode,
- };
- 
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- 	.inherits		= &pdc2024x_port_ops,
- 
- 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_platform.c linux-2.6.32.12/drivers/ata/pata_platform.c
---- linux-2.6.32.12/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_platform.c	2010-04-04 20:46:41.552552724 -0400
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_qdi.c linux-2.6.32.12/drivers/ata/pata_qdi.c
---- linux-2.6.32.12/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_qdi.c	2010-04-04 20:46:41.552552724 -0400
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
- 	.set_piomode	= qdi6500_set_piomode,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &qdi6500_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_radisys.c linux-2.6.32.12/drivers/ata/pata_radisys.c
---- linux-2.6.32.12/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_radisys.c	2010-04-04 20:46:41.556857392 -0400
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= radisys_qc_issue,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_rb532_cf.c linux-2.6.32.12/drivers/ata/pata_rb532_cf.c
---- linux-2.6.32.12/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_rb532_cf.c	2010-04-04 20:46:41.556857392 -0400
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
- 	return IRQ_HANDLED;
- }
- 
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer32,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_rdc.c linux-2.6.32.12/drivers/ata/pata_rdc.c
---- linux-2.6.32.12/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_rdc.c	2010-04-04 20:46:41.556857392 -0400
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
- 	pci_write_config_byte(dev, 0x48, udma_enable);
- }
- 
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= rdc_pata_cable_detect,
- 	.set_piomode		= rdc_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_rz1000.c linux-2.6.32.12/drivers/ata/pata_rz1000.c
---- linux-2.6.32.12/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_rz1000.c	2010-04-04 20:46:41.556857392 -0400
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= rz1000_set_mode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_sc1200.c linux-2.6.32.12/drivers/ata/pata_sc1200.c
---- linux-2.6.32.12/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_sc1200.c	2010-04-04 20:46:41.556857392 -0400
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
- 	.qc_issue	= sc1200_qc_issue,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_scc.c linux-2.6.32.12/drivers/ata/pata_scc.c
---- linux-2.6.32.12/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_scc.c	2010-04-04 20:46:41.556857392 -0400
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.set_piomode		= scc_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_sch.c linux-2.6.32.12/drivers/ata/pata_sch.c
---- linux-2.6.32.12/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_sch.c	2010-04-04 20:46:41.556857392 -0400
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_unknown,
- 	.set_piomode		= sch_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_serverworks.c linux-2.6.32.12/drivers/ata/pata_serverworks.c
---- linux-2.6.32.12/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_serverworks.c	2010-04-04 20:46:41.556857392 -0400
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= serverworks_cable_detect,
- 	.mode_filter	= serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations server
- 	.set_dmamode	= serverworks_set_dmamode,
- };
- 
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- 	.inherits	= &serverworks_osb4_port_ops,
- 	.mode_filter	= serverworks_csb_filter,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_sil680.c linux-2.6.32.12/drivers/ata/pata_sil680.c
---- linux-2.6.32.12/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_sil680.c	2010-04-04 20:46:41.556857392 -0400
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- 	.inherits	= &ata_bmdma32_port_ops,
- 	.cable_detect	= sil680_cable_detect,
- 	.set_piomode	= sil680_set_piomode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_sis.c linux-2.6.32.12/drivers/ata/pata_sis.c
---- linux-2.6.32.12/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_sis.c	2010-04-04 20:46:41.556857392 -0400
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= sis_pre_reset,
- };
- 
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_133_early_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_100_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_66_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_old_set_dmamode,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_sl82c105.c linux-2.6.32.12/drivers/ata/pata_sl82c105.c
---- linux-2.6.32.12/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_sl82c105.c	2010-04-04 20:46:41.556857392 -0400
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_defer	= sl82c105_qc_defer,
- 	.bmdma_start 	= sl82c105_bmdma_start,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_triflex.c linux-2.6.32.12/drivers/ata/pata_triflex.c
---- linux-2.6.32.12/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_triflex.c	2010-04-04 20:46:41.556857392 -0400
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.bmdma_start 	= triflex_bmdma_start,
- 	.bmdma_stop	= triflex_bmdma_stop,
-diff -urNp linux-2.6.32.12/drivers/ata/pata_via.c linux-2.6.32.12/drivers/ata/pata_via.c
---- linux-2.6.32.12/drivers/ata/pata_via.c	2010-04-29 17:49:37.709698369 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_via.c	2010-04-29 17:49:58.093238510 -0400
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= via_cable_detect,
- 	.set_piomode	= via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
- 	.port_start	= via_port_start,
- };
- 
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- 	.inherits	= &via_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
-diff -urNp linux-2.6.32.12/drivers/ata/pata_winbond.c linux-2.6.32.12/drivers/ata/pata_winbond.c
---- linux-2.6.32.12/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pata_winbond.c	2010-04-04 20:46:41.556857392 -0400
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= winbond_data_xfer,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.12/drivers/ata/pdc_adma.c linux-2.6.32.12/drivers/ata/pdc_adma.c
---- linux-2.6.32.12/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/pdc_adma.c	2010-04-04 20:46:41.556857392 -0400
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
- 	.dma_boundary		= ADMA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_fsl.c linux-2.6.32.12/drivers/ata/sata_fsl.c
---- linux-2.6.32.12/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_fsl.c	2010-04-04 20:46:41.556857392 -0400
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
- 	.dma_boundary = ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_inic162x.c linux-2.6.32.12/drivers/ata/sata_inic162x.c
---- linux-2.6.32.12/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_inic162x.c	2010-04-04 20:46:41.556857392 -0400
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
- 	return 0;
- }
- 
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- 	.inherits		= &sata_port_ops,
- 
- 	.check_atapi_dma	= inic_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_mv.c linux-2.6.32.12/drivers/ata/sata_mv.c
---- linux-2.6.32.12/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_mv.c	2010-04-04 20:46:41.556857392 -0400
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
- 	.dma_boundary		= MV_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
- 	.port_stop		= mv_port_stop,
- };
- 
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- 	.inherits		= &mv5_ops,
- 	.dev_config             = mv6_dev_config,
- 	.scr_read		= mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
- 	.bmdma_status		= mv_bmdma_status,
- };
- 
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- 	.inherits		= &mv6_ops,
- 	.dev_config		= ATA_OP_NULL,
- 	.qc_prep		= mv_qc_prep_iie,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_nv.c linux-2.6.32.12/drivers/ata/sata_nv.c
---- linux-2.6.32.12/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_nv.c	2010-04-04 20:46:41.556857392 -0400
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
-  * cases.  Define nv_hardreset() which only kicks in for post-boot
-  * probing and use it for all variants.
-  */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.lost_interrupt		= ATA_OP_NULL,
- 	.scr_read		= nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
- 	.hardreset		= nv_hardreset,
- };
- 
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_nf2_freeze,
- 	.thaw			= nv_nf2_thaw,
- };
- 
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_ck804_freeze,
- 	.thaw			= nv_ck804_thaw,
- 	.host_stop		= nv_ck804_host_stop,
- };
- 
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- 	.inherits		= &nv_ck804_ops,
- 
- 	.check_atapi_dma	= nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
- 	.host_stop		= nv_adma_host_stop,
- };
- 
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- 	.inherits		= &nv_generic_ops,
- 
- 	.qc_defer		= ata_std_qc_defer,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_promise.c linux-2.6.32.12/drivers/ata/sata_promise.c
---- linux-2.6.32.12/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_promise.c	2010-04-04 20:46:41.556857392 -0400
-@@ -195,7 +195,7 @@ static const struct ata_port_operations 
- 	.error_handler		= pdc_error_handler,
- };
- 
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_sata_cable_detect,
- 	.freeze			= pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
- 
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
-    and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- 	.inherits		= &pdc_sata_ops,
- 	.freeze			= pdc_freeze,
- 	.thaw			= pdc_thaw,
- 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
- };
- 
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_pata_cable_detect,
- 	.freeze			= pdc_freeze,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_qstor.c linux-2.6.32.12/drivers/ata/sata_qstor.c
---- linux-2.6.32.12/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_qstor.c	2010-04-04 20:46:41.556857392 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
- 	.dma_boundary		= QS_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= qs_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_sil24.c linux-2.6.32.12/drivers/ata/sata_sil24.c
---- linux-2.6.32.12/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_sil24.c	2010-04-04 20:46:41.556857392 -0400
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sil24_qc_defer,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_sil.c linux-2.6.32.12/drivers/ata/sata_sil.c
---- linux-2.6.32.12/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_sil.c	2010-04-04 20:46:41.556857392 -0400
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
- 	.sg_tablesize		= ATA_MAX_PRD
- };
- 
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.dev_config		= sil_dev_config,
- 	.set_mode		= sil_set_mode,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_sis.c linux-2.6.32.12/drivers/ata/sata_sis.c
---- linux-2.6.32.12/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_sis.c	2010-04-04 20:46:41.561786507 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= sis_scr_read,
- 	.scr_write		= sis_scr_write,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_svw.c linux-2.6.32.12/drivers/ata/sata_svw.c
---- linux-2.6.32.12/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_svw.c	2010-04-04 20:46:41.561786507 -0400
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
- };
- 
- 
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= k2_sata_tf_load,
- 	.sff_tf_read		= k2_sata_tf_read,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_sx4.c linux-2.6.32.12/drivers/ata/sata_sx4.c
---- linux-2.6.32.12/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_sx4.c	2010-04-04 20:46:41.561786507 -0400
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
- };
- 
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= pdc_check_atapi_dma,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_uli.c linux-2.6.32.12/drivers/ata/sata_uli.c
---- linux-2.6.32.12/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_uli.c	2010-04-04 20:46:41.561786507 -0400
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= uli_scr_read,
- 	.scr_write		= uli_scr_write,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_via.c linux-2.6.32.12/drivers/ata/sata_via.c
---- linux-2.6.32.12/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_via.c	2010-04-04 20:46:41.561786507 -0400
-@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= svia_tf_load,
- };
- 
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.freeze			= svia_noop_freeze,
- 	.prereset		= vt6420_prereset,
- };
- 
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.cable_detect		= vt6421_pata_cable_detect,
- 	.set_piomode		= vt6421_set_pio_mode,
- 	.set_dmamode		= vt6421_set_dma_mode,
- };
- 
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.scr_read		= svia_scr_read,
- 	.scr_write		= svia_scr_write,
- };
- 
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- 	.inherits		= &svia_base_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= vt8251_scr_read,
-diff -urNp linux-2.6.32.12/drivers/ata/sata_vsc.c linux-2.6.32.12/drivers/ata/sata_vsc.c
---- linux-2.6.32.12/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ata/sata_vsc.c	2010-04-04 20:46:41.561786507 -0400
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
- };
- 
- 
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	/* The IRQ handling is not quite standard SFF behaviour so we
- 	   cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.32.12/drivers/atm/adummy.c linux-2.6.32.12/drivers/atm/adummy.c
---- linux-2.6.32.12/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/adummy.c	2010-04-04 20:46:41.561786507 -0400
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
- 		vcc->pop(vcc, skb);
- 	else
- 		dev_kfree_skb_any(skb);
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/drivers/atm/ambassador.c linux-2.6.32.12/drivers/atm/ambassador.c
---- linux-2.6.32.12/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/ambassador.c	2010-04-04 20:46:41.561786507 -0400
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
-   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-   
-   // VC layer stats
--  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-   
-   // free the descriptor
-   kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
- 	  dump_skb ("<<<", vc, skb);
- 	  
- 	  // VC layer stats
--	  atomic_inc(&atm_vcc->stats->rx);
-+	  atomic_inc_unchecked(&atm_vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
-       } else {
-       	PRINTK (KERN_INFO, "dropped over-size frame");
- 	// should we count this?
--	atomic_inc(&atm_vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
-       }
-       
-     } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
-   }
-   
-   if (check_area (skb->data, skb->len)) {
--    atomic_inc(&atm_vcc->stats->tx_err);
-+    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
-     return -ENOMEM; // ?
-   }
-   
-diff -urNp linux-2.6.32.12/drivers/atm/atmtcp.c linux-2.6.32.12/drivers/atm/atmtcp.c
---- linux-2.6.32.12/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/atmtcp.c	2010-04-04 20:46:41.561786507 -0400
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
- 		if (dev_data) return 0;
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOLINK;
- 	}
- 	size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (!new_skb) {
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOBUFS;
- 	}
- 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- 	return 0;
- }
- 
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
- 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- 	read_unlock(&vcc_sklist_lock);
- 	if (!out_vcc) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		goto done;
- 	}
- 	skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
- 	__net_timestamp(new_skb);
- 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
-diff -urNp linux-2.6.32.12/drivers/atm/eni.c linux-2.6.32.12/drivers/atm/eni.c
---- linux-2.6.32.12/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/eni.c	2010-04-04 20:46:41.561786507 -0400
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- 		    vcc->dev->number);
- 		length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    size);
- 		}
- 		eff = length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
- 			length = eff = 0;
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 		}
- 	}
- 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- 			vcc->push(vcc,skb);
- 			pushed++;
- 		}
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
- 		    PCI_DMA_TODEVICE);
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb_irq(skb);
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 		wake_up(&eni_dev->tx_wait);
- dma_complete++;
- 	}
-diff -urNp linux-2.6.32.12/drivers/atm/firestream.c linux-2.6.32.12/drivers/atm/firestream.c
---- linux-2.6.32.12/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/firestream.c	2010-04-04 20:46:41.561786507 -0400
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
- 				}
- 			}
- 
--			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 
- 			fs_dprintk (FS_DEBUG_TXMEM, "i");
- 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
- #endif
- 				skb_put (skb, qe->p1 & 0xffff); 
- 				ATM_SKB(skb)->vcc = atm_vcc;
--				atomic_inc(&atm_vcc->stats->rx);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx);
- 				__net_timestamp(skb);
- 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- 				atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
- 				kfree (pe);
- 			}
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		case 0x1f: /*  Reassembly abort: no buffers. */
- 			/* Silently increment error counter. */
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
-diff -urNp linux-2.6.32.12/drivers/atm/fore200e.c linux-2.6.32.12/drivers/atm/fore200e.c
---- linux-2.6.32.12/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/fore200e.c	2010-04-04 20:46:41.561786507 -0400
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
- #endif
- 		/* check error condition */
- 		if (*entry->status & STATUS_ERROR)
--		    atomic_inc(&vcc->stats->tx_err);
-+		    atomic_inc_unchecked(&vcc->stats->tx_err);
- 		else
--		    atomic_inc(&vcc->stats->tx);
-+		    atomic_inc_unchecked(&vcc->stats->tx);
- 	    }
- 	}
- 
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
-     if (skb == NULL) {
- 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     } 
- 
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
- 
- 	dev_kfree_skb_any(skb);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     }
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-     vcc->push(vcc, skb);
--    atomic_inc(&vcc->stats->rx);
-+    atomic_inc_unchecked(&vcc->stats->rx);
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
- 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- 			fore200e->atm_dev->number,
- 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	    }
- 	}
- 
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
- 		goto retry_here;
- 	    }
- 
--	    atomic_inc(&vcc->stats->tx_err);
-+	    atomic_inc_unchecked(&vcc->stats->tx_err);
- 
- 	    fore200e->tx_sat++;
- 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.32.12/drivers/atm/he.c linux-2.6.32.12/drivers/atm/he.c
---- linux-2.6.32.12/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/he.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 
- 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
--				atomic_inc(&vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 				RBRQ_LEN_ERR(he_dev->rbrq_head)
- 							? "LEN_ERR" : "",
- 							vcc->vpi, vcc->vci);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 		vcc->push(vcc, skb);
- 		spin_lock(&he_dev->global_lock);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- return_host_buffers:
- 		++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
- 					tpd->vcc->pop(tpd->vcc, tpd->skb);
- 				else
- 					dev_kfree_skb_any(tpd->skb);
--				atomic_inc(&tpd->vcc->stats->tx_err);
-+				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- 			}
- 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- 			return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- 
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 		return -ENOMEM;
- 	}
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 					vcc->pop(vcc, skb);
- 				else
- 					dev_kfree_skb_any(skb);
--				atomic_inc(&vcc->stats->tx_err);
-+				atomic_inc_unchecked(&vcc->stats->tx_err);
- 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 				return -ENOMEM;
- 			}
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 	__enqueue_tpd(he_dev, tpd, cid);
- 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/drivers/atm/horizon.c linux-2.6.32.12/drivers/atm/horizon.c
---- linux-2.6.32.12/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/horizon.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
- 	{
- 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- 	  // VC layer stats
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
- 	dev->tx_iovec = NULL;
- 	
- 	// VC layer stats
--	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 	
- 	// free the skb
- 	hrz_kfree_skb (skb);
-diff -urNp linux-2.6.32.12/drivers/atm/idt77252.c linux-2.6.32.12/drivers/atm/idt77252.c
---- linux-2.6.32.12/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/idt77252.c	2010-04-04 20:46:41.565779517 -0400
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
- 		else
- 			dev_kfree_skb(skb);
- 
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 	}
- 
- 	atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			if ((sb = dev_alloc_skb(64)) == NULL) {
- 				printk("%s: Can't allocate buffers for aal0.\n",
- 				       card->name);
--				atomic_add(i, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i, &vcc->stats->rx_drop);
- 				break;
- 			}
- 			if (!atm_charge(vcc, sb->truesize)) {
- 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- 					 card->name);
--				atomic_add(i - 1, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- 				dev_kfree_skb(sb);
- 				break;
- 			}
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			ATM_SKB(sb)->vcc = vcc;
- 			__net_timestamp(sb);
- 			vcc->push(vcc, sb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			cell += ATM_CELL_PAYLOAD;
- 		}
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			         "(CDC: %08x)\n",
- 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (stat & SAR_RSQE_CRC) {
- 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 				RXPRINTK("%s: Can't alloc RX skb.\n",
- 					 card->name);
- 				recycle_rx_pool_skb(card, rpp);
--				atomic_inc(&vcc->stats->rx_err);
-+				atomic_inc_unchecked(&vcc->stats->rx_err);
- 				return;
- 			}
- 			if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			__net_timestamp(skb);
- 
- 			vcc->push(vcc, skb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			return;
- 		}
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 		__net_timestamp(skb);
- 
- 		vcc->push(vcc, skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- 		if (skb->truesize > SAR_FB_SIZE_3)
- 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		if (vcc->qos.aal != ATM_AAL0) {
- 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- 				card->name, vpi, vci);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto drop;
- 		}
- 	
- 		if ((sb = dev_alloc_skb(64)) == NULL) {
- 			printk("%s: Can't allocate buffers for AAL0.\n",
- 			       card->name);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto drop;
- 		}
- 
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		ATM_SKB(sb)->vcc = vcc;
- 		__net_timestamp(sb);
- 		vcc->push(vcc, sb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- drop:
- 		skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	if (vc == NULL) {
- 		printk("%s: NULL connection in send().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 	if (!test_bit(VCF_TX, &vc->flags)) {
- 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 		break;
- 	default:
- 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 
- 	if (skb_shinfo(skb)->nr_frags != 0) {
- 		printk("%s: No scatter-gather yet.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	err = queue_skb(card, vc, skb, oam);
- 	if (err) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return err;
- 	}
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
- 	skb = dev_alloc_skb(64);
- 	if (!skb) {
- 		printk("%s: Out of memory in send_oam().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOMEM;
- 	}
- 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.32.12/drivers/atm/iphase.c linux-2.6.32.12/drivers/atm/iphase.c
---- linux-2.6.32.12/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/iphase.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	status = (u_short) (buf_desc_ptr->desc_mode);  
- 	if (status & (RX_CER | RX_PTE | RX_OFL))  
- 	{  
--                atomic_inc(&vcc->stats->rx_err);
-+                atomic_inc_unchecked(&vcc->stats->rx_err);
- 		IF_ERR(printk("IA: bad packet, dropping it");)  
-                 if (status & RX_CER) { 
-                     IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	len = dma_addr - buf_addr;  
-         if (len > iadev->rx_buf_sz) {
-            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
--           atomic_inc(&vcc->stats->rx_err);
-+           atomic_inc_unchecked(&vcc->stats->rx_err);
- 	   goto out_free_desc;
-         }
- 		  
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
-           ia_vcc = INPH_IA_VCC(vcc);
-           if (ia_vcc == NULL)
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              dev_kfree_skb_any(skb);
-              atm_return(vcc, atm_guess_pdu2truesize(len));
-              goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
-           if ((length > iadev->rx_buf_sz) || (length > 
-                               (skb->len - sizeof(struct cpcs_trailer))))
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
-                                                             length, skb->len);)
-              dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
- 
- 	  IF_RX(printk("rx_dle_intr: skb push");)  
- 	  vcc->push(vcc,skb);  
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
-           iadev->rx_pkt_cnt++;
-       }  
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
-          {
-              struct k_sonet_stats *stats;
-              stats = &PRIV(_ia_dev[board])->sonet_stats;
--             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
--             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
--             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
--             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
--             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
--             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
--             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
--             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
--             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
-+             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
-+             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
-+             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
-+             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
-+             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
-          }
-             ia_cmds.status = 0;
-             break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
- 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
- 	{  
- 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
--                atomic_inc(&vcc->stats->tx);
-+                atomic_inc_unchecked(&vcc->stats->tx);
- 		if (vcc->pop)   
- 		    vcc->pop(vcc, skb);   
- 		else  
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
-         ATM_DESC(skb) = vcc->vci;
-         skb_queue_tail(&iadev->tx_dma_q, skb);
- 
--        atomic_inc(&vcc->stats->tx);
-+        atomic_inc_unchecked(&vcc->stats->tx);
-         iadev->tx_pkt_cnt++;
- 	/* Increment transaction counter */  
- 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
-         
- #if 0        
-         /* add flow control logic */ 
--        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
-           if (iavcc->vc_desc_cnt > 10) {
-              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
-             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.32.12/drivers/atm/lanai.c linux-2.6.32.12/drivers/atm/lanai.c
---- linux-2.6.32.12/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/lanai.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
- 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- 	lanai_endtx(lanai, lvcc);
- 	lanai_free_skb(lvcc->tx.atmvcc, skb);
--	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
- 
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
- 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- 	__net_timestamp(skb);
- 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
-     out:
- 	lvcc->rx.buf.ptr = end;
- 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
- 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
- 		lanai->stats.service_rxnotaal5++;
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		return 0;
- 	}
- 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
- 		int bytes;
- 		read_unlock(&vcc_sklist_lock);
- 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_trash++;
- 		bytes = (SERVICE_GET_END(s) * 16) -
- 		    (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
- 	}
- 	if (s & SERVICE_STREAM) {
- 		read_unlock(&vcc_sklist_lock);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_stream++;
- 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- 		    "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
- 		return 0;
- 	}
- 	DPRINTK("got rx crc error on vci %d\n", vci);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 	lvcc->stats.x.aal5.service_rxcrc++;
- 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.32.12/drivers/atm/nicstar.c linux-2.6.32.12/drivers/atm/nicstar.c
---- linux-2.6.32.12/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/nicstar.c	2010-04-04 20:46:41.565779517 -0400
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if ((vc = (vc_map *) vcc->dev_data) == NULL)
-    {
-       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (!vc->tx)
-    {
-       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
-    {
-       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (skb_shinfo(skb)->nr_frags != 0)
-    {
-       printk("nicstar%d: No scatter-gather yet.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
- 
-    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
-    {
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EIO;
-    }
--   atomic_inc(&vcc->stats->tx);
-+   atomic_inc_unchecked(&vcc->stats->tx);
- 
-    return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
-          {
-             printk("nicstar%d: Can't allocate buffers for aal0.\n",
-                    card->index);
--            atomic_add(i,&vcc->stats->rx_drop);
-+            atomic_add_unchecked(i,&vcc->stats->rx_drop);
-             break;
-          }
-          if (!atm_charge(vcc, sb->truesize))
-          {
-             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
-                      card->index);
--            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-             dev_kfree_skb_any(sb);
-             break;
-          }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          ATM_SKB(sb)->vcc = vcc;
- 	 __net_timestamp(sb);
-          vcc->push(vcc, sb);
--         atomic_inc(&vcc->stats->rx);
-+         atomic_inc_unchecked(&vcc->stats->rx);
-          cell += ATM_CELL_PAYLOAD;
-       }
- 
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
- 	 if (iovb == NULL)
- 	 {
- 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-             recycle_rx_buf(card, skb);
-             return;
- 	 }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
-    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
-    {
-       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
--      atomic_inc(&vcc->stats->rx_err);
-+      atomic_inc_unchecked(&vcc->stats->rx_err);
-       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
-       NS_SKB(iovb)->iovcnt = 0;
-       iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_rx_buf(card, skb);
-          vc->rx_iov = NULL;
-          recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                       NS_SKB(iovb)->iovcnt);
-          vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             printk(" - PDU size mismatch.\n");
-          else
-             printk(".\n");
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	   NS_SKB(iovb)->iovcnt);
- 	 vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          if (!atm_charge(vcc, skb->truesize))
-          {
-             push_rxbufs(card, skb);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             ATM_SKB(skb)->vcc = vcc;
- 	    __net_timestamp(skb);
-             vcc->push(vcc, skb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
-       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, sb->truesize))
-             {
-                push_rxbufs(card, sb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
- 	    {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(sb)->vcc = vcc;
- 	       __net_timestamp(sb);
-                vcc->push(vcc, sb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, skb->truesize))
-             {
-                push_rxbufs(card, skb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
-             {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(skb)->vcc = vcc;
- 	       __net_timestamp(skb);
-                vcc->push(vcc, skb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (hb == NULL)
-             {
-                printk("nicstar%d: Out of huge buffers.\n", card->index);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                             NS_SKB(iovb)->iovcnt);
-                vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             }
- 	    else
- 	       dev_kfree_skb_any(hb);
--	    atomic_inc(&vcc->stats->rx_drop);
-+	    atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
- #endif /* NS_USE_DESTRUCTORS */
- 	    __net_timestamp(hb);
-             vcc->push(vcc, hb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
- 
-diff -urNp linux-2.6.32.12/drivers/atm/solos-pci.c linux-2.6.32.12/drivers/atm/solos-pci.c
---- linux-2.6.32.12/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/solos-pci.c	2010-04-04 20:46:41.565779517 -0400
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- 				}
- 				atm_charge(vcc, skb->truesize);
- 				vcc->push(vcc, skb);
--				atomic_inc(&vcc->stats->rx);
-+				atomic_inc_unchecked(&vcc->stats->rx);
- 				break;
- 
- 			case PKT_STATUS:
-@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
- 			vcc = SKB_CB(oldskb)->vcc;
- 
- 			if (vcc) {
--				atomic_inc(&vcc->stats->tx);
-+				atomic_inc_unchecked(&vcc->stats->tx);
- 				solos_pop(vcc, oldskb);
- 			} else
- 				dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.32.12/drivers/atm/suni.c linux-2.6.32.12/drivers/atm/suni.c
---- linux-2.6.32.12/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/suni.c	2010-04-04 20:46:41.565779517 -0400
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
- 
- 
- #define ADD_LIMITED(s,v) \
--    atomic_add((v),&stats->s); \
--    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+    atomic_add_unchecked((v),&stats->s); \
-+    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
- 
- 
- static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.32.12/drivers/atm/uPD98402.c linux-2.6.32.12/drivers/atm/uPD98402.c
---- linux-2.6.32.12/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/uPD98402.c	2010-04-04 20:46:41.565779517 -0400
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
- 	struct sonet_stats tmp;
-  	int error = 0;
- 
--	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- 	if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
- 
- 
- #define ADD_LIMITED(s,v) \
--    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
--    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
--	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
- 
- 
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
- 		if (reason & uPD98402_INT_PFM) stat_event(dev);
- 		if (reason & uPD98402_INT_PCO) {
- 			(void) GET(PCOCR); /* clear interrupt cause */
--			atomic_add(GET(HECCT),
-+			atomic_add_unchecked(GET(HECCT),
- 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
- 		}
- 		if ((reason & uPD98402_INT_RFO) && 
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
- 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- 	  uPD98402_INT_LOS),PIMR); /* enable them */
- 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
--	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.12/drivers/atm/zatm.c linux-2.6.32.12/drivers/atm/zatm.c
---- linux-2.6.32.12/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/atm/zatm.c	2010-04-04 20:46:41.569782507 -0400
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		}
- 		if (!size) {
- 			dev_kfree_skb_irq(skb);
--			if (vcc) atomic_inc(&vcc->stats->rx_err);
-+			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- 			continue;
- 		}
- 		if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		skb->len = size;
- 		ATM_SKB(skb)->vcc = vcc;
- 		vcc->push(vcc,skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
- 			skb_queue_head(&zatm_vcc->backlog,skb);
- 			break;
- 		}
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 	wake_up(&zatm_vcc->tx_wait);
- }
- 
-diff -urNp linux-2.6.32.12/drivers/base/bus.c linux-2.6.32.12/drivers/base/bus.c
---- linux-2.6.32.12/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/base/bus.c	2010-04-04 20:46:41.569782507 -0400
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- 	.show	= drv_attr_show,
- 	.store	= drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- 	.show	= bus_attr_show,
- 	.store	= bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- 	.filter = bus_uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/base/class.c linux-2.6.32.12/drivers/base/class.c
---- linux-2.6.32.12/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/base/class.c	2010-04-04 20:46:41.569782507 -0400
-@@ -63,7 +63,7 @@ static void class_release(struct kobject
- 	kfree(cp);
- }
- 
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- 	.show	= class_attr_show,
- 	.store	= class_attr_store,
- };
-diff -urNp linux-2.6.32.12/drivers/base/core.c linux-2.6.32.12/drivers/base/core.c
---- linux-2.6.32.12/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/base/core.c	2010-04-04 20:46:41.569782507 -0400
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- 	.show	= dev_attr_show,
- 	.store	= dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
- 	return retval;
- }
- 
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- 	.filter =	dev_uevent_filter,
- 	.name =		dev_uevent_name,
- 	.uevent =	dev_uevent,
-diff -urNp linux-2.6.32.12/drivers/base/memory.c linux-2.6.32.12/drivers/base/memory.c
---- linux-2.6.32.12/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/base/memory.c	2010-04-04 20:46:41.569782507 -0400
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
- 	return retval;
- }
- 
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- 	.name		= memory_uevent_name,
- 	.uevent		= memory_uevent,
- };
-diff -urNp linux-2.6.32.12/drivers/base/sys.c linux-2.6.32.12/drivers/base/sys.c
---- linux-2.6.32.12/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/base/sys.c	2010-04-04 20:46:41.569782507 -0400
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= sysdev_show,
- 	.store	= sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- 	.show	= sysdev_class_show,
- 	.store	= sysdev_class_store,
- };
-diff -urNp linux-2.6.32.12/drivers/block/pktcdvd.c linux-2.6.32.12/drivers/block/pktcdvd.c
---- linux-2.6.32.12/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/block/pktcdvd.c	2010-04-04 20:46:41.569782507 -0400
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
- 	return len;
- }
- 
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- 	.show = kobj_pkt_show,
- 	.store = kobj_pkt_store
- };
-diff -urNp linux-2.6.32.12/drivers/char/agp/frontend.c linux-2.6.32.12/drivers/char/agp/frontend.c
---- linux-2.6.32.12/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/agp/frontend.c	2010-04-04 20:46:41.569782507 -0400
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
- 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- 		return -EFAULT;
- 
--	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- 		return -EFAULT;
- 
- 	client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.32.12/drivers/char/agp/intel-agp.c linux-2.6.32.12/drivers/char/agp/intel-agp.c
---- linux-2.6.32.12/drivers/char/agp/intel-agp.c	2010-04-29 17:49:37.777981896 -0400
-+++ linux-2.6.32.12/drivers/char/agp/intel-agp.c	2010-04-29 17:49:58.121109354 -0400
-@@ -2564,7 +2564,7 @@ static struct pci_device_id agp_intel_pc
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
-diff -urNp linux-2.6.32.12/drivers/char/hpet.c linux-2.6.32.12/drivers/char/hpet.c
---- linux-2.6.32.12/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hpet.c	2010-04-29 17:46:36.909235393 -0400
-@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
- 	return 0;
- }
- 
--static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
- 
- static int
- hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-@@ -550,7 +550,7 @@ static inline unsigned long hpet_time_di
- }
- 
- static int
--hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
-+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
- {
- 	struct hpet_timer __iomem *timer;
- 	struct hpet __iomem *hpet;
-@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
- 		},
- };
- 
--static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
-+static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
- 
- static int __init hpet_init(void)
- {
-diff -urNp linux-2.6.32.12/drivers/char/hvc_beat.c linux-2.6.32.12/drivers/char/hvc_beat.c
---- linux-2.6.32.12/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_beat.c	2010-04-04 20:46:41.569782507 -0400
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
- 	return cnt;
- }
- 
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- 	.get_chars = hvc_beat_get_chars,
- 	.put_chars = hvc_beat_put_chars,
- };
-diff -urNp linux-2.6.32.12/drivers/char/hvc_console.c linux-2.6.32.12/drivers/char/hvc_console.c
---- linux-2.6.32.12/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_console.c	2010-04-04 20:46:41.569782507 -0400
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
-  * console interfaces but can still be used as a tty device.  This has to be
-  * static because kmalloc will not work during early console init.
-  */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
- 
-@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
-  * vty adapters do NOT get an hvc_instantiate() callback since they
-  * appear after early console init.
-  */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- 	struct hvc_struct *hp;
- 
-@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
- };
- 
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
--					struct hv_ops *ops, int outbuf_size)
-+					const struct hv_ops *ops, int outbuf_size)
- {
- 	struct hvc_struct *hp;
- 	int i;
-diff -urNp linux-2.6.32.12/drivers/char/hvc_console.h linux-2.6.32.12/drivers/char/hvc_console.h
---- linux-2.6.32.12/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_console.h	2010-04-04 20:46:41.569782507 -0400
-@@ -55,7 +55,7 @@ struct hvc_struct {
- 	int outbuf_size;
- 	int n_outbuf;
- 	uint32_t vtermno;
--	struct hv_ops *ops;
-+	const struct hv_ops *ops;
- 	int irq_requested;
- 	int data;
- 	struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
- 
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
- 
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
--				struct hv_ops *ops, int outbuf_size);
-+				const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
- 
-diff -urNp linux-2.6.32.12/drivers/char/hvc_iseries.c linux-2.6.32.12/drivers/char/hvc_iseries.c
---- linux-2.6.32.12/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_iseries.c	2010-04-04 20:46:41.569782507 -0400
-@@ -197,7 +197,7 @@ done:
- 	return sent;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = get_chars,
- 	.put_chars = put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.12/drivers/char/hvc_iucv.c linux-2.6.32.12/drivers/char/hvc_iucv.c
---- linux-2.6.32.12/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_iucv.c	2010-04-04 20:46:41.569782507 -0400
-@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
- 
- 
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- 	.get_chars = hvc_iucv_get_chars,
- 	.put_chars = hvc_iucv_put_chars,
- 	.notifier_add = hvc_iucv_notifier_add,
-diff -urNp linux-2.6.32.12/drivers/char/hvc_rtas.c linux-2.6.32.12/drivers/char/hvc_rtas.c
---- linux-2.6.32.12/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_rtas.c	2010-04-04 20:46:41.569782507 -0400
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
- 	return i;
- }
- 
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- 	.get_chars = hvc_rtas_read_console,
- 	.put_chars = hvc_rtas_write_console,
- };
-diff -urNp linux-2.6.32.12/drivers/char/hvcs.c linux-2.6.32.12/drivers/char/hvcs.c
---- linux-2.6.32.12/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvcs.c	2010-04-04 20:46:41.573523483 -0400
-@@ -269,7 +269,7 @@ struct hvcs_struct {
- 	unsigned int index;
- 
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 
- 	/*
- 	 * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 
--	if (hvcsd->open_count > 0) {
-+	if (atomic_read(&hvcsd->open_count) > 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
- 				"The hvcs device node is still in use.\n");
-@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
- 		if ((retval = hvcs_partner_connect(hvcsd)))
- 			goto error_release;
- 
--	hvcsd->open_count = 1;
-+	atomic_set(&hvcsd->open_count, 1);
- 	hvcsd->tty = tty;
- 	tty->driver_data = hvcsd;
- 
-@@ -1169,7 +1169,7 @@ fast_open:
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	kref_get(&hvcsd->kref);
--	hvcsd->open_count++;
-+	atomic_inc(&hvcsd->open_count);
- 	hvcsd->todo_mask |= HVCS_SCHED_READ;
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
- 
-@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
- 	hvcsd = tty->driver_data;
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
--	if (--hvcsd->open_count == 0) {
-+	if (atomic_dec_and_test(&hvcsd->open_count)) {
- 
- 		vio_disable_interrupts(hvcsd->vdev);
- 
-@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
- 		free_irq(irq, hvcsd);
- 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
- 		return;
--	} else if (hvcsd->open_count < 0) {
-+	} else if (atomic_read(&hvcsd->open_count) < 0) {
- 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- 				" is missmanaged.\n",
--		hvcsd->vdev->unit_address, hvcsd->open_count);
-+		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
- 	}
- 
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	/* Preserve this so that we know how many kref refs to put */
--	temp_open_count = hvcsd->open_count;
-+	temp_open_count = atomic_read(&hvcsd->open_count);
- 
- 	/*
- 	 * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
- 	hvcsd->tty->driver_data = NULL;
- 	hvcsd->tty = NULL;
- 
--	hvcsd->open_count = 0;
-+	atomic_set(&hvcsd->open_count, 0);
- 
- 	/* This will drop any buffered data on the floor which is OK in a hangup
- 	 * scenario. */
-@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
- 	 * the middle of a write operation?  This is a crummy place to do this
- 	 * but we want to keep it all in the spinlock.
- 	 */
--	if (hvcsd->open_count <= 0) {
-+	if (atomic_read(&hvcsd->open_count) <= 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		return -ENODEV;
- 	}
-@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
- {
- 	struct hvcs_struct *hvcsd = tty->driver_data;
- 
--	if (!hvcsd || hvcsd->open_count <= 0)
-+	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
- 		return 0;
- 
- 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.32.12/drivers/char/hvc_udbg.c linux-2.6.32.12/drivers/char/hvc_udbg.c
---- linux-2.6.32.12/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_udbg.c	2010-04-04 20:46:41.573523483 -0400
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
- 	return i;
- }
- 
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- 	.get_chars = hvc_udbg_get,
- 	.put_chars = hvc_udbg_put,
- };
-diff -urNp linux-2.6.32.12/drivers/char/hvc_vio.c linux-2.6.32.12/drivers/char/hvc_vio.c
---- linux-2.6.32.12/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_vio.c	2010-04-04 20:46:41.573523483 -0400
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
- 	return got;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = filtered_get_chars,
- 	.put_chars = hvc_put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.12/drivers/char/hvc_xen.c linux-2.6.32.12/drivers/char/hvc_xen.c
---- linux-2.6.32.12/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/hvc_xen.c	2010-04-04 20:46:41.573523483 -0400
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
- 	return recv;
- }
- 
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- 	.get_chars = read_console,
- 	.put_chars = write_console,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/ipmi/ipmi_msghandler.c	2010-04-04 20:46:41.573523483 -0400
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- 	struct proc_dir_entry *proc_dir;
- 	char                  proc_dir_name[10];
- 
--	atomic_t stats[IPMI_NUM_STATS];
-+	atomic_unchecked_t stats[IPMI_NUM_STATS];
- 
- 	/*
- 	 * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
- 
- 
- #define ipmi_inc_stat(intf, stat) \
--	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
--	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
- 
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
- 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
- 	init_waitqueue_head(&intf->waitq);
- 	for (i = 0; i < IPMI_NUM_STATS; i++)
--		atomic_set(&intf->stats[i], 0);
-+		atomic_set_unchecked(&intf->stats[i], 0);
- 
- 	intf->proc_dir = NULL;
- 
-diff -urNp linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/ipmi/ipmi_si_intf.c	2010-04-04 20:46:41.573523483 -0400
-@@ -277,7 +277,7 @@ struct smi_info {
- 	unsigned char slave_addr;
- 
- 	/* Counters and things for the proc filesystem. */
--	atomic_t stats[SI_NUM_STATS];
-+	atomic_unchecked_t stats[SI_NUM_STATS];
- 
- 	struct task_struct *thread;
- 
-@@ -285,9 +285,9 @@ struct smi_info {
- };
- 
- #define smi_inc_stat(smi, stat) \
--	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
--	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
- 
- #define SI_MAX_PARMS 4
- 
-@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
- 	atomic_set(&new_smi->req_events, 0);
- 	new_smi->run_to_completion = 0;
- 	for (i = 0; i < SI_NUM_STATS; i++)
--		atomic_set(&new_smi->stats[i], 0);
-+		atomic_set_unchecked(&new_smi->stats[i], 0);
- 
- 	new_smi->interrupt_disabled = 0;
- 	atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.32.12/drivers/char/keyboard.c linux-2.6.32.12/drivers/char/keyboard.c
---- linux-2.6.32.12/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/keyboard.c	2010-04-04 20:46:41.573523483 -0400
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
- 	     kbd->kbdmode == VC_MEDIUMRAW) &&
- 	     value != KVAL(K_SAK))
- 		return;		/* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+	{
-+		void *func = fn_handler[value];
-+		if (func == fn_show_state || func == fn_show_ptregs ||
-+		    func == fn_show_mem)
-+			return;
-+	}
-+#endif
-+
- 	fn_handler[value](vc);
- }
- 
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
-                 .evbit = { BIT_MASK(EV_SND) },
-         },
- 
--	{ },    /* Terminating entry */
-+	{ 0 },    /* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.32.12/drivers/char/mem.c linux-2.6.32.12/drivers/char/mem.c
---- linux-2.6.32.12/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/mem.c	2010-04-04 20:46:41.573523483 -0400
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
- 
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- 					     unsigned long size)
- {
-@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
- 	if (!valid_phys_addr_range(p, count))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_mem_write();
-+	return -EPERM;
-+#endif
-+
- 	written = 0;
- 
- #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
-@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
- 						&vma->vm_page_prot))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
-+		return -EPERM;
-+#endif
-+
- 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
- 						 size,
- 						 vma->vm_page_prot);
-@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
- 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
- 	int err = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_kmem_write();
-+	return -EPERM;
-+#endif
-+
- 	if (p < (unsigned long) high_memory) {
- 
- 		wrote = count;
-@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
- 
- static int open_port(struct inode * inode, struct file * filp)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_open_port();
-+	return -EPERM;
-+#endif
-+
-+	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
-+}
-+
-+static int open_mem(struct inode * inode, struct file * filp)
-+{
- 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
- }
- 
-@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
- #define full_lseek      null_lseek
- #define write_zero	write_null
- #define read_full       read_zero
--#define open_mem	open_port
- #define open_kmem	open_mem
- #define open_oldmem	open_mem
- 
-@@ -888,6 +917,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
- 
- static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.32.12/drivers/char/nvram.c linux-2.6.32.12/drivers/char/nvram.c
---- linux-2.6.32.12/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/nvram.c	2010-04-04 20:46:41.573523483 -0400
-@@ -429,7 +429,10 @@ static const struct file_operations nvra
- static struct miscdevice nvram_dev = {
- 	NVRAM_MINOR,
- 	"nvram",
--	&nvram_fops
-+	&nvram_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static int __init nvram_init(void)
-diff -urNp linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/pcmcia/ipwireless/tty.c	2010-04-04 20:46:41.573523483 -0400
-@@ -51,7 +51,7 @@ struct ipw_tty {
- 	int tty_type;
- 	struct ipw_network *network;
- 	struct tty_struct *linux_tty;
--	int open_count;
-+	atomic_t open_count;
- 	unsigned int control_lines;
- 	struct mutex ipw_tty_mutex;
- 	int tx_bytes_queued;
-@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -ENODEV;
- 	}
--	if (tty->open_count == 0)
-+	if (atomic_read(&tty->open_count) == 0)
- 		tty->tx_bytes_queued = 0;
- 
--	tty->open_count++;
-+	atomic_inc(&tty->open_count);
- 
- 	tty->linux_tty = linux_tty;
- 	linux_tty->driver_data = tty;
-@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
- 
- static void do_ipw_close(struct ipw_tty *tty)
- {
--	tty->open_count--;
--
--	if (tty->open_count == 0) {
-+	if (atomic_dec_return(&tty->open_count) == 0) {
- 		struct tty_struct *linux_tty = tty->linux_tty;
- 
- 		if (linux_tty != NULL) {
-@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
- 		return;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (tty->open_count == 0) {
-+	if (atomic_read(&tty->open_count) == 0) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
- 		return;
- 	}
- 
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
- 		return -ENODEV;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -EINVAL;
- 	}
-@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
- 	if (!tty)
- 		return 0;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return 0;
- 
- 	return tty->tx_bytes_queued;
-@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return get_control_lines(tty);
-@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return set_control_lines(tty, set, clear);
-@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	/* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
- 				   against a parallel ioctl etc */
- 				mutex_lock(&ttyj->ipw_tty_mutex);
- 			}
--			while (ttyj->open_count)
-+			while (atomic_read(&ttyj->open_count))
- 				do_ipw_close(ttyj);
- 			ipwireless_disassociate_network_ttys(network,
- 							     ttyj->channel_idx);
-diff -urNp linux-2.6.32.12/drivers/char/pty.c linux-2.6.32.12/drivers/char/pty.c
---- linux-2.6.32.12/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/pty.c	2010-04-04 20:46:41.573523483 -0400
-@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
- 	return ret;
- }
- 
--static struct file_operations ptmx_fops;
-+static const struct file_operations ptmx_fops = {
-+	.llseek		= no_llseek,
-+	.read		= tty_read,
-+	.write		= tty_write,
-+	.poll		= tty_poll,
-+	.unlocked_ioctl	= tty_ioctl,
-+	.compat_ioctl	= tty_compat_ioctl,
-+	.open		= ptmx_open,
-+	.release	= tty_release,
-+	.fasync		= tty_fasync,
-+};
-+
- 
- static void __init unix98_pty_init(void)
- {
-@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
- 	register_sysctl_table(pty_root_table);
- 
- 	/* Now create the /dev/ptmx special device */
--	tty_default_fops(&ptmx_fops);
--	ptmx_fops.open = ptmx_open;
--
- 	cdev_init(&ptmx_cdev, &ptmx_fops);
- 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
- 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
-diff -urNp linux-2.6.32.12/drivers/char/random.c linux-2.6.32.12/drivers/char/random.c
---- linux-2.6.32.12/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/random.c	2010-04-04 20:46:41.573523483 -0400
-@@ -254,8 +254,13 @@
- /*
-  * Configuration information
-  */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
- 
- /*
-@@ -292,10 +297,17 @@ static struct poolinfo {
- 	int poolwords;
- 	int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+	{ 512,	411,	308,	208,	104,	1 },
-+	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+	{ 128,	103,	76,	51,	25,	1 },
-+#else
- 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- 	{ 128,	103,	76,	51,	25,	1 },
- 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- 	{ 32,	26,	20,	14,	7,	1 },
-+#endif
- #if 0
- 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
- 	{ 2048,	1638,	1231,	819,	411,	1 },
-@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
- 
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
- 
-diff -urNp linux-2.6.32.12/drivers/char/sonypi.c linux-2.6.32.12/drivers/char/sonypi.c
---- linux-2.6.32.12/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/sonypi.c	2010-04-04 20:46:41.573523483 -0400
-@@ -491,7 +491,7 @@ static struct sonypi_device {
- 	spinlock_t fifo_lock;
- 	wait_queue_head_t fifo_proc_list;
- 	struct fasync_struct *fifo_async;
--	int open_count;
-+	atomic_t open_count;
- 	int model;
- 	struct input_dev *input_jog_dev;
- 	struct input_dev *input_key_dev;
-@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- 	mutex_lock(&sonypi_device.lock);
--	sonypi_device.open_count--;
-+	atomic_dec(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	return 0;
- }
-@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
- 	lock_kernel();
- 	mutex_lock(&sonypi_device.lock);
- 	/* Flush input queue on first open */
--	if (!sonypi_device.open_count)
-+	if (!atomic_read(&sonypi_device.open_count))
- 		kfifo_reset(sonypi_device.fifo);
--	sonypi_device.open_count++;
-+	atomic_inc(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	unlock_kernel();
- 	return 0;
-diff -urNp linux-2.6.32.12/drivers/char/tpm/tpm_bios.c linux-2.6.32.12/drivers/char/tpm/tpm_bios.c
---- linux-2.6.32.12/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/tpm/tpm_bios.c	2010-04-04 20:46:41.573523483 -0400
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
- 	event = addr;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
- 		return NULL;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	(*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
- 	int i;
- 
- 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
--		seq_putc(m, data[i]);
-+		if (!seq_putc(m, data[i]))
-+			return -EFAULT;
- 
- 	return 0;
- }
-@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
- 	log->bios_event_log_end = log->bios_event_log + len;
- 
- 	virt = acpi_os_map_memory(start, len);
-+	if (!virt) {
-+		kfree(log->bios_event_log);
-+		log->bios_event_log = NULL;
-+		return -EFAULT;
-+	}
- 
- 	memcpy(log->bios_event_log, virt, len);
- 
-diff -urNp linux-2.6.32.12/drivers/char/tty_io.c linux-2.6.32.12/drivers/char/tty_io.c
---- linux-2.6.32.12/drivers/char/tty_io.c	2010-04-29 17:49:37.826084348 -0400
-+++ linux-2.6.32.12/drivers/char/tty_io.c	2010-04-29 17:49:58.141506968 -0400
-@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
- DEFINE_MUTEX(tty_mutex);
- EXPORT_SYMBOL(tty_mutex);
- 
--static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
--static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
- ssize_t redirected_tty_write(struct file *, const char __user *,
- 							size_t, loff_t *);
--static unsigned int tty_poll(struct file *, poll_table *);
- static int tty_open(struct inode *, struct file *);
--static int tty_release(struct inode *, struct file *);
- long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
--#ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
--				unsigned long arg);
--#else
--#define tty_compat_ioctl NULL
--#endif
--static int tty_fasync(int fd, struct file *filp, int on);
- static void release_tty(struct tty_struct *tty, int idx);
- static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
- static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
-@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
-  *	read calls may be outstanding in parallel.
-  */
- 
--static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
-+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
- 			loff_t *ppos)
- {
- 	int i;
-@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
- 	return i;
- }
- 
-+EXPORT_SYMBOL(tty_read);
-+
- void tty_write_unlock(struct tty_struct *tty)
- {
- 	mutex_unlock(&tty->atomic_write_lock);
-@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
-  *	write method will not be invoked in parallel for each device.
-  */
- 
--static ssize_t tty_write(struct file *file, const char __user *buf,
-+ssize_t tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
- 	struct tty_struct *tty;
-@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
- 	return ret;
- }
- 
-+EXPORT_SYMBOL(tty_write);
-+
- ssize_t redirected_tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
-@@ -1867,7 +1860,7 @@ static int tty_open(struct inode *inode,
-  *		Takes bkl. See tty_release_dev
-  */
- 
--static int tty_release(struct inode *inode, struct file *filp)
-+int tty_release(struct inode *inode, struct file *filp)
- {
- 	lock_kernel();
- 	tty_release_dev(filp);
-@@ -1875,6 +1868,8 @@ static int tty_release(struct inode *ino
- 	return 0;
- }
- 
-+EXPORT_SYMBOL(tty_release);
-+
- /**
-  *	tty_poll	-	check tty status
-  *	@filp: file being polled
-@@ -1887,7 +1882,7 @@ static int tty_release(struct inode *ino
-  *	may be re-entered freely by other callers.
-  */
- 
--static unsigned int tty_poll(struct file *filp, poll_table *wait)
-+unsigned int tty_poll(struct file *filp, poll_table *wait)
- {
- 	struct tty_struct *tty;
- 	struct tty_ldisc *ld;
-@@ -1904,7 +1899,9 @@ static unsigned int tty_poll(struct file
- 	return ret;
- }
- 
--static int tty_fasync(int fd, struct file *filp, int on)
-+EXPORT_SYMBOL(tty_poll);
-+
-+int tty_fasync(int fd, struct file *filp, int on)
- {
- 	struct tty_struct *tty;
- 	unsigned long flags;
-@@ -1948,6 +1945,8 @@ out:
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_fasync);
-+
- /**
-  *	tiocsti			-	fake input character
-  *	@tty: tty to fake input into
-@@ -2582,8 +2581,10 @@ long tty_ioctl(struct file *file, unsign
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- 				unsigned long arg)
- {
- 	struct inode *inode = file->f_dentry->d_inode;
-@@ -2607,6 +2608,8 @@ static long tty_compat_ioctl(struct file
- 
- 	return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
- 
- /*
-@@ -3050,11 +3053,6 @@ struct tty_struct *get_current_tty(void)
- }
- EXPORT_SYMBOL_GPL(get_current_tty);
- 
--void tty_default_fops(struct file_operations *fops)
--{
--	*fops = tty_fops;
--}
--
- /*
-  * Initialize the console device. This is called *early*, so
-  * we can't necessarily depend on lots of kernel help here.
-diff -urNp linux-2.6.32.12/drivers/char/tty_ldisc.c linux-2.6.32.12/drivers/char/tty_ldisc.c
---- linux-2.6.32.12/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/tty_ldisc.c	2010-04-04 20:46:41.577798214 -0400
-@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
- 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- 		struct tty_ldisc_ops *ldo = ld->ops;
- 
--		ldo->refcount--;
-+		atomic_dec(&ldo->refcount);
- 		module_put(ldo->owner);
- 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
-@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
- 	tty_ldiscs[disc] = new_ldisc;
- 	new_ldisc->num = disc;
--	new_ldisc->refcount = 0;
-+	atomic_set(&new_ldisc->refcount, 0);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
- 	return ret;
-@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
- 		return -EINVAL;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	if (tty_ldiscs[disc]->refcount)
-+	if (atomic_read(&tty_ldiscs[disc]->refcount))
- 		ret = -EBUSY;
- 	else
- 		tty_ldiscs[disc] = NULL;
-@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
- 	if (ldops) {
- 		ret = ERR_PTR(-EAGAIN);
- 		if (try_module_get(ldops->owner)) {
--			ldops->refcount++;
-+			atomic_inc(&ldops->refcount);
- 			ret = ldops;
- 		}
- 	}
-@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	ldops->refcount--;
-+	atomic_dec(&ldops->refcount);
- 	module_put(ldops->owner);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff -urNp linux-2.6.32.12/drivers/char/virtio_console.c linux-2.6.32.12/drivers/char/virtio_console.c
---- linux-2.6.32.12/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/virtio_console.c	2010-04-04 20:46:41.577798214 -0400
-@@ -44,6 +44,7 @@ static unsigned int in_len;
- static char *in, *inbuf;
- 
- /* The operations for our console. */
-+/* cannot be const */
- static struct hv_ops virtio_cons;
- 
- /* The hvc device */
-diff -urNp linux-2.6.32.12/drivers/char/vt_ioctl.c linux-2.6.32.12/drivers/char/vt_ioctl.c
---- linux-2.6.32.12/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/char/vt_ioctl.c	2010-04-04 20:46:41.577798214 -0400
-@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
- 	case KDSKBENT:
- 		if (!perm)
- 			return -EPERM;
-+
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG))
-+			return -EPERM;
-+#endif
-+
- 		if (!i && v == K_NOSUCHMAP) {
- 			/* deallocate map */
- 			key_map = key_maps[s];
-@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
- 			goto reterr;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG)) {
-+			ret = -EPERM;
-+			goto reterr;
-+		}
-+#endif
-+
- 		q = func_table[i];
- 		first_free = funcbufptr + (funcbufsize - funcbufleft);
- 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
-diff -urNp linux-2.6.32.12/drivers/cpufreq/cpufreq.c linux-2.6.32.12/drivers/cpufreq/cpufreq.c
---- linux-2.6.32.12/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/cpufreq/cpufreq.c	2010-04-04 20:46:41.577798214 -0400
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
- 	complete(&policy->kobj_unregister);
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= show,
- 	.store	= store,
- };
-diff -urNp linux-2.6.32.12/drivers/cpuidle/sysfs.c linux-2.6.32.12/drivers/cpuidle/sysfs.c
---- linux-2.6.32.12/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/cpuidle/sysfs.c	2010-04-29 17:46:36.917238919 -0400
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- 	.show = cpuidle_show,
- 	.store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- 	.show = cpuidle_state_show,
- };
- 
-@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
- 	.release = cpuidle_state_sysfs_release,
- };
- 
--static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
-+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
- {
- 	kobject_put(&device->kobjs[i]->kobj);
- 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff -urNp linux-2.6.32.12/drivers/dma/ioat/dma.c linux-2.6.32.12/drivers/dma/ioat/dma.c
---- linux-2.6.32.12/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/dma/ioat/dma.c	2010-04-04 20:46:41.577798214 -0400
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
- 	return entry->show(&chan->common, page);
- }
- 
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- 	.show	= ioat_attr_show,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/dma/ioat/dma.h linux-2.6.32.12/drivers/dma/ioat/dma.h
---- linux-2.6.32.12/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/dma/ioat/dma.h	2010-04-04 20:46:41.577798214 -0400
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
- 			   unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff -urNp linux-2.6.32.12/drivers/edac/edac_core.h linux-2.6.32.12/drivers/edac/edac_core.h
---- linux-2.6.32.12/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/edac/edac_core.h	2010-04-04 20:46:41.577798214 -0400
-@@ -99,11 +99,11 @@ extern int edac_debug_level;
- 
- #else				/* !CONFIG_EDAC_DEBUG */
- 
--#define debugf0( ... )
--#define debugf1( ... )
--#define debugf2( ... )
--#define debugf3( ... )
--#define debugf4( ... )
-+#define debugf0( ... ) do {} while (0)
-+#define debugf1( ... ) do {} while (0)
-+#define debugf2( ... ) do {} while (0)
-+#define debugf3( ... ) do {} while (0)
-+#define debugf4( ... ) do {} while (0)
- 
- #endif				/* !CONFIG_EDAC_DEBUG */
- 
-diff -urNp linux-2.6.32.12/drivers/edac/edac_device_sysfs.c linux-2.6.32.12/drivers/edac/edac_device_sysfs.c
---- linux-2.6.32.12/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/edac/edac_device_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
- }
- 
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- 	.show = edac_dev_ctl_info_show,
- 	.store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
- }
- 
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- 	.show = edac_dev_instance_show,
- 	.store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
- }
- 
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- 	.show = edac_dev_block_show,
- 	.store = edac_dev_block_store
- };
-diff -urNp linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/edac/edac_mc_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
- 	return -EIO;
- }
- 
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- 	.show = csrowdev_show,
- 	.store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
- }
- 
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- 	.show = mcidev_show,
- 	.store = mcidev_store
- };
-diff -urNp linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c
---- linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/edac/edac_pci_sysfs.c	2010-04-04 20:46:41.577798214 -0400
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
- }
- 
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- 	.show = edac_pci_instance_show,
- 	.store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- 	.show = edac_pci_dev_show,
- 	.store = edac_pci_dev_store
- };
-diff -urNp linux-2.6.32.12/drivers/firewire/core-cdev.c linux-2.6.32.12/drivers/firewire/core-cdev.c
---- linux-2.6.32.12/drivers/firewire/core-cdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firewire/core-cdev.c	2010-04-29 17:46:37.101039010 -0400
-@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
- 	int ret;
- 
- 	if ((request->channels == 0 && request->bandwidth == 0) ||
--	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
--	    request->bandwidth < 0)
-+	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
- 		return -EINVAL;
- 
- 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
-diff -urNp linux-2.6.32.12/drivers/firmware/dmi_scan.c linux-2.6.32.12/drivers/firmware/dmi_scan.c
---- linux-2.6.32.12/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firmware/dmi_scan.c	2010-04-04 20:46:41.577798214 -0400
-@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
- 		}
- 	}
- 	else {
--		/*
--		 * no iounmap() for that ioremap(); it would be a no-op, but
--		 * it's so early in setup that sucker gets confused into doing
--		 * what it shouldn't if we actually call it.
--		 */
- 		p = dmi_ioremap(0xF0000, 0x10000);
- 		if (p == NULL)
- 			goto error;
-diff -urNp linux-2.6.32.12/drivers/firmware/edd.c linux-2.6.32.12/drivers/firmware/edd.c
---- linux-2.6.32.12/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firmware/edd.c	2010-04-04 20:46:41.577798214 -0400
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
- 	return ret;
- }
- 
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- 	.show = edd_attr_show,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/firmware/efivars.c linux-2.6.32.12/drivers/firmware/efivars.c
---- linux-2.6.32.12/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firmware/efivars.c	2010-04-04 20:46:41.577798214 -0400
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- 	.show = efivar_attr_show,
- 	.store = efivar_attr_store,
- };
-diff -urNp linux-2.6.32.12/drivers/firmware/iscsi_ibft.c linux-2.6.32.12/drivers/firmware/iscsi_ibft.c
---- linux-2.6.32.12/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firmware/iscsi_ibft.c	2010-04-04 20:46:41.581454607 -0400
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
- 	return ret;
- }
- 
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- 	.show = ibft_show_attribute,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/firmware/memmap.c linux-2.6.32.12/drivers/firmware/memmap.c
---- linux-2.6.32.12/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/firmware/memmap.c	2010-04-04 20:46:41.581454607 -0400
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- 	NULL
- };
- 
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- 	.show = memmap_attr_show,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_drv.c linux-2.6.32.12/drivers/gpu/drm/drm_drv.c
---- linux-2.6.32.12/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/drm_drv.c	2010-04-04 20:46:41.581454607 -0400
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
- 	char *kdata = NULL;
- 
- 	atomic_inc(&dev->ioctl_count);
--	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- 	++file_priv->ioctl_count;
- 
- 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_fops.c linux-2.6.32.12/drivers/gpu/drm/drm_fops.c
---- linux-2.6.32.12/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:37.845185844 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:58.154995647 -0400
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
- 	}
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
--		atomic_set(&dev->counts[i], 0);
-+		atomic_set_unchecked(&dev->counts[i], 0);
- 
- 	dev->sigdata.lock = NULL;
- 
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
- 
- 	retcode = drm_open_helper(inode, filp, dev);
- 	if (!retcode) {
--		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- 		spin_lock(&dev->count_lock);
--		if (!dev->open_count++) {
-+		if (atomic_inc_return(&dev->open_count) == 1) {
- 			spin_unlock(&dev->count_lock);
- 			retcode = drm_setup(dev);
- 			goto out;
-@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
- 
- 	lock_kernel();
- 
--	DRM_DEBUG("open_count = %d\n", dev->open_count);
-+	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
- 
- 	if (dev->driver->preclose)
- 		dev->driver->preclose(dev, file_priv);
-@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
- 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- 		  task_pid_nr(current),
- 		  (long)old_encode_dev(file_priv->minor->device),
--		  dev->open_count);
-+		  atomic_read(&dev->open_count));
- 
- 	/* if the master has gone away we can't do anything with the lock */
- 	if (file_priv->minor->master)
-@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
- 	 * End inline drm_release
- 	 */
- 
--	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- 	spin_lock(&dev->count_lock);
--	if (!--dev->open_count) {
-+	if (atomic_dec_and_test(&dev->open_count)) {
- 		if (atomic_read(&dev->ioctl_count)) {
- 			DRM_ERROR("Device busy: %d\n",
- 				  atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/drm_ioctl.c	2010-04-04 20:46:41.581454607 -0400
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
- 			stats->data[i].value =
- 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- 		else
--			stats->data[i].value = atomic_read(&dev->counts[i]);
-+			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- 		stats->data[i].type = dev->types[i];
- 	}
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/drm_lock.c linux-2.6.32.12/drivers/gpu/drm/drm_lock.c
---- linux-2.6.32.12/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/drm_lock.c	2010-04-04 20:46:41.581454607 -0400
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
- 		if (drm_lock_take(&master->lock, lock->context)) {
- 			master->lock.file_priv = file_priv;
- 			master->lock.lock_time = jiffies;
--			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- 			break;	/* Got lock */
- 		}
- 
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
- 		return -EINVAL;
- 	}
- 
--	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
- 
- 	/* kernel_context_switch isn't used by any of the x86 drm
- 	 * modules but is required by the Sparc driver.
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i810/i810_dma.c	2010-04-04 20:46:41.581454607 -0400
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
- 				 dma->buflist[vertex->idx],
- 				 vertex->discard, vertex->used);
- 
--	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
- 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- 			     mc->last_render);
- 
--	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7017.c	2010-04-04 20:46:41.581454607 -0400
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- 	.init = ch7017_init,
- 	.detect = ch7017_detect,
- 	.mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-04-04 20:46:41.581454607 -0400
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- 	.init = ch7xxx_init,
- 	.detect = ch7xxx_detect,
- 	.mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo.h	2010-04-04 20:46:41.581454607 -0400
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- 	 *
- 	 * \return singly-linked list of modes or NULL if no modes found.
- 	 */
--	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Clean up driver-specific bits of the output
- 	 */
--	void (*destroy) (struct intel_dvo_device *dvo);
-+	void (* const destroy) (struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Debugging hook to dump device registers to log file
- 	 */
--	void (*dump_regs)(struct intel_dvo_device *dvo);
-+	void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
- 
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
- 
- #endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_ivch.c	2010-04-04 20:46:41.581454607 -0400
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
- 	}
- }
- 
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- 	.init = ivch_init,
- 	.dpms = ivch_dpms,
- 	.save = ivch_save,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_sil164.c	2010-04-04 20:46:41.581454607 -0400
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- 	.init = sil164_init,
- 	.detect = sil164_detect,
- 	.mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/dvo_tfp410.c	2010-04-04 20:46:41.581454607 -0400
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- 	.init = tfp410_init,
- 	.detect = tfp410_detect,
- 	.mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/i915/i915_drv.c	2010-04-04 20:46:41.581454607 -0400
-@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
- 	return i915_resume(dev);
- }
- 
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- 	.fault = i915_gem_fault,
- 	.open = drm_gem_vm_open,
- 	.close = drm_gem_vm_close,
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/radeon/mkregtable.c	2010-04-04 20:46:41.581454607 -0400
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
- 	regex_t mask_rex;
- 	regmatch_t match[4];
- 	char buf[1024];
--	size_t end;
-+	long end;
- 	int len;
- 	int done = 0;
- 	int r;
- 	unsigned o;
- 	struct offset *offset;
- 	char last_reg_s[10];
--	int last_reg;
-+	unsigned long last_reg;
- 
- 	if (regcomp
- 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c
---- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_atombios.c	2010-04-04 20:46:41.581454607 -0400
-@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
- 	}
- }
- 
--struct bios_connector {
-+static struct bios_connector {
- 	bool valid;
- 	uint16_t line_mux;
- 	uint16_t devices;
- 	int connector_type;
- 	struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- 								 drm_device
-@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
- 	uint8_t dac;
- 	union atom_supported_devices *supported_devices;
- 	int i, j;
--	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c
---- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_display.c	2010-04-29 17:46:37.101039010 -0400
-@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
- 
- 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
- 						error = freq - current_freq;
--						error = error < 0 ? 0xffffffff : error;
-+						error = (int32_t)error < 0 ? 0xffffffff : error;
- 					} else
- 						error = abs(current_freq - freq);
- 					vco_diff = abs(vco - best_vco);
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_state.c	2010-04-04 20:46:41.581454607 -0400
-@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
- {
- 	drm_radeon_private_t *dev_priv = dev->dev_private;
- 	drm_radeon_getparam_t *param = data;
--	int value;
-+	int value = 0;
- 
- 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/radeon/radeon_ttm.c	2010-04-04 20:46:41.581454607 -0400
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
- 	DRM_INFO("radeon: ttm finalized\n");
- }
- 
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
--	struct ttm_buffer_object *bo;
--	int r;
--
--	bo = (struct ttm_buffer_object *)vma->vm_private_data;
--	if (bo == NULL) {
--		return VM_FAULT_NOPAGE;
--	}
--	r = ttm_vm_ops->fault(vma, vmf);
--	return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- 	struct drm_file *file_priv;
- 	struct radeon_device *rdev;
--	int r;
- 
- 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- 		return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
- 
- 	file_priv = (struct drm_file *)filp->private_data;
- 	rdev = file_priv->minor->dev->dev_private;
--	if (rdev == NULL) {
-+	if (!rdev)
- 		return -EINVAL;
--	}
--	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
--	if (unlikely(r != 0)) {
--		return r;
--	}
--	if (unlikely(ttm_vm_ops == NULL)) {
--		ttm_vm_ops = vma->vm_ops;
--		radeon_ttm_vm_ops = *ttm_vm_ops;
--		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
--	}
--	vma->vm_ops = &radeon_ttm_vm_ops;
--	return 0;
-+	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
- 
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo.c	2010-04-29 17:46:36.939238869 -0400
-@@ -39,7 +39,7 @@
- #include <linux/module.h>
- 
- #define TTM_ASSERT_LOCKED(param)
--#define TTM_DEBUG(fmt, arg...)
-+#define TTM_DEBUG(fmt, arg...) do {} while (0)
- #define TTM_BO_HASH_ORDER 13
- 
- static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
- 	NULL
- };
- 
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- 	.show = &ttm_bo_global_show
- };
- 
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-04-04 20:46:41.585591308 -0400
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
- {
- 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- 	    vma->vm_private_data;
--	struct ttm_bo_device *bdev = bo->bdev;
-+	struct ttm_bo_device *bdev;
- 	unsigned long bus_base;
- 	unsigned long bus_offset;
- 	unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
- 	unsigned long address = (unsigned long)vmf->virtual_address;
- 	int retval = VM_FAULT_NOPAGE;
- 
-+	if (!bo)
-+		return VM_FAULT_NOPAGE;
-+	bdev = bo->bdev;
-+
- 	/*
- 	 * Work around locking order reversal in fault / nopfn
- 	 * between mmap_sem and bo_reserve: Perform a trylock operation
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c
---- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_global.c	2010-04-04 20:46:41.585591308 -0400
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- 	struct mutex mutex;
- 	void *object;
--	int refcount;
-+	atomic_t refcount;
- };
- 
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- 		struct ttm_global_item *item = &glob[i];
- 		mutex_init(&item->mutex);
- 		item->object = NULL;
--		item->refcount = 0;
-+		atomic_set(&item->refcount, 0);
- 	}
- }
- 
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- 		struct ttm_global_item *item = &glob[i];
- 		BUG_ON(item->object != NULL);
--		BUG_ON(item->refcount != 0);
-+		BUG_ON(atomic_read(&item->refcount) != 0);
- 	}
- }
- 
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
- 	void *object;
- 
- 	mutex_lock(&item->mutex);
--	if (item->refcount == 0) {
-+	if (atomic_read(&item->refcount) == 0) {
- 		item->object = kzalloc(ref->size, GFP_KERNEL);
- 		if (unlikely(item->object == NULL)) {
- 			ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
- 			goto out_err;
- 
- 	}
--	++item->refcount;
-+	atomic_inc(&item->refcount);
- 	ref->object = item->object;
- 	object = item->object;
- 	mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
- 	struct ttm_global_item *item = &glob[ref->global_type];
- 
- 	mutex_lock(&item->mutex);
--	BUG_ON(item->refcount == 0);
-+	BUG_ON(atomic_read(&item->refcount) == 0);
- 	BUG_ON(ref->object != item->object);
--	if (--item->refcount == 0) {
-+	if (atomic_dec_and_test(&item->refcount)) {
- 		ref->release(ref);
- 		item->object = NULL;
- 	}
-diff -urNp linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c
---- linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/gpu/drm/ttm/ttm_memory.c	2010-04-04 20:46:41.585591308 -0400
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
- 	NULL
- };
- 
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- 	.show = &ttm_mem_zone_show,
- 	.store = &ttm_mem_zone_store
- };
-diff -urNp linux-2.6.32.12/drivers/hid/usbhid/hiddev.c linux-2.6.32.12/drivers/hid/usbhid/hiddev.c
---- linux-2.6.32.12/drivers/hid/usbhid/hiddev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hid/usbhid/hiddev.c	2010-04-29 17:46:37.113104605 -0400
-@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
- 		return put_user(HID_VERSION, (int __user *)arg);
- 
- 	case HIDIOCAPPLICATION:
--		if (arg < 0 || arg >= hid->maxapplication)
-+		if (arg >= hid->maxapplication)
- 			return -EINVAL;
- 
- 		for (i = 0; i < hid->maxcollection; i++)
-diff -urNp linux-2.6.32.12/drivers/hwmon/k8temp.c linux-2.6.32.12/drivers/hwmon/k8temp.c
---- linux-2.6.32.12/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hwmon/k8temp.c	2010-04-04 20:46:41.585591308 -0400
-@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
- 
- static struct pci_device_id k8temp_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, k8temp_ids);
-diff -urNp linux-2.6.32.12/drivers/hwmon/sis5595.c linux-2.6.32.12/drivers/hwmon/sis5595.c
---- linux-2.6.32.12/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hwmon/sis5595.c	2010-04-04 20:46:41.585591308 -0400
-@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
- 
- static struct pci_device_id sis5595_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
-diff -urNp linux-2.6.32.12/drivers/hwmon/via686a.c linux-2.6.32.12/drivers/hwmon/via686a.c
---- linux-2.6.32.12/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hwmon/via686a.c	2010-04-04 20:46:41.585591308 -0400
-@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
- 
- static struct pci_device_id via686a_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
-diff -urNp linux-2.6.32.12/drivers/hwmon/vt8231.c linux-2.6.32.12/drivers/hwmon/vt8231.c
---- linux-2.6.32.12/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hwmon/vt8231.c	2010-04-04 20:46:41.585591308 -0400
-@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
- 
- static struct pci_device_id vt8231_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
-diff -urNp linux-2.6.32.12/drivers/hwmon/w83791d.c linux-2.6.32.12/drivers/hwmon/w83791d.c
---- linux-2.6.32.12/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/hwmon/w83791d.c	2010-04-04 20:46:41.585591308 -0400
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
- 			  struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
- 
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
- 
- #ifdef DEBUG
-diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c
---- linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c	2010-04-29 17:49:37.945518391 -0400
-+++ linux-2.6.32.12/drivers/i2c/busses/i2c-i801.c	2010-04-29 18:00:43.521920899 -0400
-@@ -582,7 +582,7 @@ static struct pci_device_id i801_ids[] =
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CPT_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, i801_ids);
-diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c
---- linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/i2c/busses/i2c-piix4.c	2010-04-04 20:46:41.585591308 -0400
-@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
- 		.ident = "IBM",
- 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
--	{ },
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
-@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, piix4_ids);
-diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c
---- linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/i2c/busses/i2c-sis630.c	2010-04-04 20:46:41.585591308 -0400
-@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
- static struct pci_device_id sis630_ids[] __devinitdata = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis630_ids);
-diff -urNp linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c
---- linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/i2c/busses/i2c-sis96x.c	2010-04-04 20:46:41.585591308 -0400
-@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
- 
- static struct pci_device_id sis96x_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis96x_ids);
-diff -urNp linux-2.6.32.12/drivers/ide/ide-cd.c linux-2.6.32.12/drivers/ide/ide-cd.c
---- linux-2.6.32.12/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ide/ide-cd.c	2010-04-04 20:46:41.585591308 -0400
-@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
- 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- 		if ((unsigned long)buf & alignment
- 		    || blk_rq_bytes(rq) & q->dma_pad_mask
--		    || object_is_on_stack(buf))
-+		    || object_starts_on_stack(buf))
- 			drive->dma = 0;
- 	}
- }
-diff -urNp linux-2.6.32.12/drivers/ieee1394/dv1394.c linux-2.6.32.12/drivers/ieee1394/dv1394.c
---- linux-2.6.32.12/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/dv1394.c	2010-04-04 20:46:41.585591308 -0400
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
- 	based upon DIF section and sequence
- */
- 
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
-@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
- 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
- 	},
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
-diff -urNp linux-2.6.32.12/drivers/ieee1394/eth1394.c linux-2.6.32.12/drivers/ieee1394/eth1394.c
---- linux-2.6.32.12/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/eth1394.c	2010-04-04 20:46:41.585591308 -0400
-@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
- 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
- 		.version = ETHER1394_GASP_VERSION,
- 	},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
-diff -urNp linux-2.6.32.12/drivers/ieee1394/hosts.c linux-2.6.32.12/drivers/ieee1394/hosts.c
---- linux-2.6.32.12/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/hosts.c	2010-04-04 20:46:41.589782410 -0400
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
- }
- 
- static struct hpsb_host_driver dummy_driver = {
-+	.name =		   "dummy",
- 	.transmit_packet = dummy_transmit_packet,
- 	.devctl =	   dummy_devctl,
- 	.isoctl =	   dummy_isoctl
-diff -urNp linux-2.6.32.12/drivers/ieee1394/ohci1394.c linux-2.6.32.12/drivers/ieee1394/ohci1394.c
---- linux-2.6.32.12/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/ohci1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
- 
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
- 
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
- 		.subvendor =	PCI_ANY_ID,
- 		.subdevice =	PCI_ANY_ID,
- 	},
--	{ 0, },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
-diff -urNp linux-2.6.32.12/drivers/ieee1394/raw1394.c linux-2.6.32.12/drivers/ieee1394/raw1394.c
---- linux-2.6.32.12/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/raw1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
- 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
-diff -urNp linux-2.6.32.12/drivers/ieee1394/sbp2.c linux-2.6.32.12/drivers/ieee1394/sbp2.c
---- linux-2.6.32.12/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/sbp2.c	2010-04-04 20:46:41.589782410 -0400
-@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
- 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
- 
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
- 
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- 	int ret;
- 
-diff -urNp linux-2.6.32.12/drivers/ieee1394/video1394.c linux-2.6.32.12/drivers/ieee1394/video1394.c
---- linux-2.6.32.12/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/ieee1394/video1394.c	2010-04-04 20:46:41.589782410 -0400
-@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
-                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
-                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
-         },
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
-diff -urNp linux-2.6.32.12/drivers/infiniband/core/cm.c linux-2.6.32.12/drivers/infiniband/core/cm.c
---- linux-2.6.32.12/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/infiniband/core/cm.c	2010-04-04 20:46:41.589782410 -0400
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM
- 
- struct cm_counter_group {
- 	struct kobject obj;
--	atomic_long_t counter[CM_ATTR_COUNT];
-+	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
- 
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
- 	struct ib_mad_send_buf *msg = NULL;
- 	int ret;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REQ_COUNTER]);
- 
- 	/* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
- 	if (!cm_id_priv)
- 		return;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REP_COUNTER]);
- 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- 	if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
- 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- 		spin_unlock_irq(&cm_id_priv->lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_RTU_COUNTER]);
- 		goto out;
- 	}
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
- 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- 				   dreq_msg->local_comm_id);
- 	if (!cm_id_priv) {
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		cm_issue_drep(work->port, work->mad_recv_wc);
- 		return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
- 	case IB_CM_MRA_REP_RCVD:
- 		break;
- 	case IB_CM_TIMEWAIT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_DREQ_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
- 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
- 				  cm_id_priv->msg, timeout)) {
- 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
--				atomic_long_inc(&work->port->
-+				atomic_long_inc_unchecked(&work->port->
- 						counter_group[CM_RECV_DUPLICATES].
- 						counter[CM_MRA_COUNTER]);
- 			goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
- 		break;
- 	case IB_CM_MRA_REQ_RCVD:
- 	case IB_CM_MRA_REP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_MRA_COUNTER]);
- 		/* fall through */
- 	default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
- 	case IB_CM_LAP_IDLE:
- 		break;
- 	case IB_CM_MRA_LAP_SENT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_LAP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
- 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- 	if (cur_cm_id_priv) {
- 		spin_unlock_irq(&cm.lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_SIDR_REQ_COUNTER]);
- 		goto out; /* Duplicate message. */
- 	}
-@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
- 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- 		msg->retries = 1;
- 
--	atomic_long_add(1 + msg->retries,
-+	atomic_long_add_unchecked(1 + msg->retries,
- 			&port->counter_group[CM_XMIT].counter[attr_index]);
- 	if (msg->retries)
--		atomic_long_add(msg->retries,
-+		atomic_long_add_unchecked(msg->retries,
- 				&port->counter_group[CM_XMIT_RETRIES].
- 				counter[attr_index]);
- 
-@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
- 	}
- 
- 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
--	atomic_long_inc(&port->counter_group[CM_RECV].
-+	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- 			counter[attr_id - CM_ATTR_ID_OFFSET]);
- 
- 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
- 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
- 
- 	return sprintf(buf, "%ld\n",
--		       atomic_long_read(&group->counter[cm_attr->index]));
-+		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
- 
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- 	.show = cm_show_counter
- };
- 
-diff -urNp linux-2.6.32.12/drivers/infiniband/core/sysfs.c linux-2.6.32.12/drivers/infiniband/core/sysfs.c
---- linux-2.6.32.12/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/infiniband/core/sysfs.c	2010-04-04 20:46:41.589782410 -0400
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
- 	return port_attr->show(p, port_attr, buf);
- }
- 
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- 	.show = port_attr_show
- };
- 
-diff -urNp linux-2.6.32.12/drivers/input/keyboard/atkbd.c linux-2.6.32.12/drivers/input/keyboard/atkbd.c
---- linux-2.6.32.12/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/keyboard/atkbd.c	2010-04-04 20:46:41.589782410 -0400
-@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
-diff -urNp linux-2.6.32.12/drivers/input/mouse/lifebook.c linux-2.6.32.12/drivers/input/mouse/lifebook.c
---- linux-2.6.32.12/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/mouse/lifebook.c	2010-04-04 20:46:41.589782410 -0400
-@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
- 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
-diff -urNp linux-2.6.32.12/drivers/input/mouse/psmouse-base.c linux-2.6.32.12/drivers/input/mouse/psmouse-base.c
---- linux-2.6.32.12/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/mouse/psmouse-base.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
-diff -urNp linux-2.6.32.12/drivers/input/mouse/synaptics.c linux-2.6.32.12/drivers/input/mouse/synaptics.c
---- linux-2.6.32.12/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/mouse/synaptics.c	2010-04-04 20:46:41.593451026 -0400
-@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
- 				break;
- 			case 2:
- 				if (SYN_MODEL_PEN(priv->model_id))
--					;   /* Nothing, treat a pen as a single finger */
-+					break;   /* Nothing, treat a pen as a single finger */
- 				break;
- 			case 4 ... 15:
- 				if (SYN_CAP_PALMDETECT(priv->capabilities))
-@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
- 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
- 		},
--
- 	},
- 	{
- 		.ident = "Toshiba Portege M300",
-@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
- 		},
--
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.12/drivers/input/mousedev.c linux-2.6.32.12/drivers/input/mousedev.c
---- linux-2.6.32.12/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/mousedev.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
- 
- #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
- static struct miscdevice psaux_mouse = {
--	PSMOUSE_MINOR, "psaux", &mousedev_fops
-+	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
- };
- static int psaux_registered;
- #endif
-diff -urNp linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h
---- linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.12/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:46:41.593451026 -0400
-@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
-@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #ifdef CONFIG_PNP
-@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
-@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #endif /* CONFIG_X86 */
-diff -urNp linux-2.6.32.12/drivers/input/serio/serio_raw.c linux-2.6.32.12/drivers/input/serio/serio_raw.c
---- linux-2.6.32.12/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/input/serio/serio_raw.c	2010-04-04 20:46:41.593451026 -0400
-@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
-diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/common.c linux-2.6.32.12/drivers/isdn/gigaset/common.c
---- linux-2.6.32.12/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/isdn/gigaset/common.c	2010-04-04 20:46:41.593451026 -0400
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
- 	cs->commands_pending = 0;
- 	cs->cur_at_seq = 0;
- 	cs->gotfwver = -1;
--	cs->open_count = 0;
-+	atomic_set(&cs->open_count, 0);
- 	cs->dev = NULL;
- 	cs->tty = NULL;
- 	cs->tty_dev = NULL;
-diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/isdn/gigaset/gigaset.h	2010-04-04 20:46:41.593451026 -0400
-@@ -446,7 +446,7 @@ struct cardstate {
- 	spinlock_t cmdlock;
- 	unsigned curlen, cmdbytes;
- 
--	unsigned open_count;
-+	atomic_t open_count;
- 	struct tty_struct *tty;
- 	struct tasklet_struct if_wake_tasklet;
- 	unsigned control_state;
-diff -urNp linux-2.6.32.12/drivers/isdn/gigaset/interface.c linux-2.6.32.12/drivers/isdn/gigaset/interface.c
---- linux-2.6.32.12/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.12/drivers/isdn/gigaset/interface.c	2010-04-04 20:46:41.593451026 -0400
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
- 		return -ERESTARTSYS; // FIXME -EINTR?
- 	tty->driver_data = cs;
- 
--	++cs->open_count;
--
--	if (cs->open_count == 1) {
-+	if (atomic_inc_return(&cs->open_count) == 1) {
- 		spin_lock_irqsave(&cs->lock, flags);
- 		cs->tty = tty;
- 		spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
--		if (!--cs->open_count) {
-+		if (!atomic_dec_return(&cs->open_count)) {
- 			spin_lock_irqsave(&cs->lock, flags);
- 			cs->tty = NULL;
- 			spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED)
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
- 		goto out;
- 	}
- 
--	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 		goto out;
- 	}
-diff -urNp linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/isdn/hardware/avm/b1.c	2010-04-04 20:46:41.593451026 -0400
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (t4file->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (config->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-diff -urNp linux-2.6.32.12/drivers/isdn/icn/icn.c linux-2.6.32.12/drivers/isdn/icn/icn.c
---- linux-2.6.32.12/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/isdn/icn/icn.c	2010-04-04 20:46:41.593451026 -0400
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
- 		if (count > len)
- 			count = len;
- 		if (user) {
--			if (copy_from_user(msg, buf, count))
-+			if (count > sizeof msg || copy_from_user(msg, buf, count))
- 				return -EFAULT;
- 		} else
- 			memcpy(msg, buf, count);
-diff -urNp linux-2.6.32.12/drivers/lguest/core.c linux-2.6.32.12/drivers/lguest/core.c
---- linux-2.6.32.12/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/lguest/core.c	2010-04-04 20:46:41.593451026 -0400
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- 	 * it's worked so far.  The end address needs +1 because __get_vm_area
- 	 * allocates an extra guard page, so we need space for that.
- 	 */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- 	if (!switcher_vma) {
- 		err = -ENOMEM;
- 		printk("lguest: could not map switcher pages high\n");
-diff -urNp linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c
---- linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/macintosh/via-pmu-backlight.c	2010-04-04 20:46:41.593451026 -0400
-@@ -15,7 +15,7 @@
- 
- #define MAX_PMU_LEVEL 0xFF
- 
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- 	.get_brightness	= pmu_backlight_get_brightness,
- 	.update_status	= pmu_backlight_update_status,
- 
-diff -urNp linux-2.6.32.12/drivers/macintosh/via-pmu.c linux-2.6.32.12/drivers/macintosh/via-pmu.c
---- linux-2.6.32.12/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/macintosh/via-pmu.c	2010-04-04 20:46:41.593451026 -0400
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
- 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
- 
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- 	.enter = powerbook_sleep,
- 	.valid = pmu_sleep_valid,
- };
-diff -urNp linux-2.6.32.12/drivers/md/bitmap.c linux-2.6.32.12/drivers/md/bitmap.c
---- linux-2.6.32.12/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/md/bitmap.c	2010-04-04 20:46:41.593451026 -0400
-@@ -58,7 +58,7 @@
- #  if DEBUG > 0
- #    define PRINTK(x...) printk(KERN_DEBUG x)
- #  else
--#    define PRINTK(x...)
-+#    define PRINTK(x...) do {} while (0)
- #  endif
- #endif
- 
-diff -urNp linux-2.6.32.12/drivers/md/dm-sysfs.c linux-2.6.32.12/drivers/md/dm-sysfs.c
---- linux-2.6.32.12/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/md/dm-sysfs.c	2010-04-04 20:46:41.593451026 -0400
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- 	NULL,
- };
- 
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- 	.show	= dm_attr_show,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/md/dm-table.c linux-2.6.32.12/drivers/md/dm-table.c
---- linux-2.6.32.12/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/md/dm-table.c	2010-04-04 20:46:41.593451026 -0400
-@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
- 	if (!dev_size)
- 		return 0;
- 
--	if ((start >= dev_size) || (start + len > dev_size)) {
-+	if ((start >= dev_size) || (len > dev_size - start)) {
- 		DMWARN("%s: %s too small for target: "
- 		       "start=%llu, len=%llu, dev_size=%llu",
- 		       dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.32.12/drivers/md/md.c linux-2.6.32.12/drivers/md/md.c
---- linux-2.6.32.12/drivers/md/md.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/md/md.c	2010-04-04 20:46:41.597784214 -0400
-@@ -2508,7 +2508,7 @@ static void rdev_free(struct kobject *ko
- 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- 	kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- 	.show		= rdev_attr_show,
- 	.store		= rdev_attr_store,
- };
-@@ -3878,7 +3878,7 @@ static void md_free(struct kobject *ko)
- 	kfree(mddev);
- }
- 
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- 	.show	= md_attr_show,
- 	.store	= md_attr_store,
- };
-@@ -6004,7 +6004,7 @@ static int md_seq_show(struct seq_file *
- 				chunk_kb ? "KB" : "B");
- 			if (bitmap->file) {
- 				seq_printf(seq, ", file: ");
--				seq_path(seq, &bitmap->file->f_path, " \t\n");
-+				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- 			}
- 
- 			seq_printf(seq, "\n");
-@@ -6098,7 +6098,7 @@ static int is_mddev_idle(mddev_t *mddev,
- 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- 			      (int)part_stat_read(&disk->part0, sectors[1]) -
--			      atomic_read(&disk->sync_io);
-+			      atomic_read_unchecked(&disk->sync_io);
- 		/* sync IO will cause sync_io to increase before the disk_stats
- 		 * as sync_io is counted when a request starts, and
- 		 * disk_stats is counted when it completes.
-diff -urNp linux-2.6.32.12/drivers/md/md.h linux-2.6.32.12/drivers/md/md.h
---- linux-2.6.32.12/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/md/md.h	2010-04-04 20:46:41.597784214 -0400
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
- 
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
--        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
- 
- struct mdk_personality
-diff -urNp linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/media/dvb/dvb-core/dvbdev.c	2010-04-04 20:46:41.597784214 -0400
-@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
- 			const struct dvb_device *template, void *priv, int type)
- {
- 	struct dvb_device *dvbdev;
-+	/* cannot be const */
- 	struct file_operations *dvbdevfops;
- 	struct device *clsdev;
- 	int minor;
-diff -urNp linux-2.6.32.12/drivers/media/radio/radio-cadet.c linux-2.6.32.12/drivers/media/radio/radio-cadet.c
---- linux-2.6.32.12/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/media/radio/radio-cadet.c	2010-04-04 20:46:41.597784214 -0400
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
- 	while (i < count && dev->rdsin != dev->rdsout)
- 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
- 
--	if (copy_to_user(data, readbuf, i))
-+	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- 		return -EFAULT;
- 	return i;
- }
-diff -urNp linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c
---- linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/media/video/usbvideo/konicawc.c	2010-04-04 20:46:41.597784214 -0400
-@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c
---- linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/media/video/usbvideo/quickcam_messenger.c	2010-04-04 20:46:41.597784214 -0400
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.12/drivers/message/fusion/mptdebug.h linux-2.6.32.12/drivers/message/fusion/mptdebug.h
---- linux-2.6.32.12/drivers/message/fusion/mptdebug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/message/fusion/mptdebug.h	2010-04-29 17:46:37.113104605 -0400
-@@ -71,7 +71,7 @@
- 		CMD;						\
- }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif
- 
- 
-diff -urNp linux-2.6.32.12/drivers/message/fusion/mptsas.c linux-2.6.32.12/drivers/message/fusion/mptsas.c
---- linux-2.6.32.12/drivers/message/fusion/mptsas.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/message/fusion/mptsas.c	2010-04-29 17:46:37.113104605 -0400
-@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
- 		return 0;
- }
- 
-+static inline void
-+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-+{
-+	if (phy_info->port_details) {
-+		phy_info->port_details->rphy = rphy;
-+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-+		    ioc->name, rphy));
-+	}
-+
-+	if (rphy) {
-+		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-+		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-+		    ioc->name, rphy, rphy->dev.release));
-+	}
-+}
-+
- /* no mutex */
- static void
- mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
-@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
- 		return NULL;
- }
- 
--static inline void
--mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
--{
--	if (phy_info->port_details) {
--		phy_info->port_details->rphy = rphy;
--		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
--		    ioc->name, rphy));
--	}
--
--	if (rphy) {
--		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
--		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
--		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
--		    ioc->name, rphy, rphy->dev.release));
--	}
--}
--
- static inline struct sas_port *
- mptsas_get_port(struct mptsas_phyinfo *phy_info)
- {
-diff -urNp linux-2.6.32.12/drivers/message/i2o/i2o_proc.c linux-2.6.32.12/drivers/message/i2o/i2o_proc.c
---- linux-2.6.32.12/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/message/i2o/i2o_proc.c	2010-04-04 20:46:41.597784214 -0400
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- 	"Array Controller Device"
- };
- 
--static char *chtostr(u8 * chars, int n)
--{
--	char tmp[256];
--	tmp[0] = 0;
--	return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- 				   char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
- 
- 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", ddm_table.module_id);
--		seq_printf(seq, "%-29s",
--			   chtostr(ddm_table.module_name_version, 28));
-+		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- 		seq_printf(seq, "%9d  ", ddm_table.data_size);
- 		seq_printf(seq, "%8d", ddm_table.code_size);
- 
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
- 
- 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", dst->module_id);
--		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
--		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+		seq_printf(seq, "%-.28s", dst->module_name_version);
-+		seq_printf(seq, "%-.8s", dst->date);
- 		seq_printf(seq, "%8d ", dst->module_size);
- 		seq_printf(seq, "%8d ", dst->mpb_size);
- 		seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
- 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
- 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
- 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
--	seq_printf(seq, "Vendor info   : %s\n",
--		   chtostr((u8 *) (work32 + 2), 16));
--	seq_printf(seq, "Product info  : %s\n",
--		   chtostr((u8 *) (work32 + 6), 16));
--	seq_printf(seq, "Description   : %s\n",
--		   chtostr((u8 *) (work32 + 10), 16));
--	seq_printf(seq, "Product rev.  : %s\n",
--		   chtostr((u8 *) (work32 + 14), 8));
-+	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
-+	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
-+	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
-+	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
- 
- 	seq_printf(seq, "Serial number : ");
- 	print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
- 	}
- 
- 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
--	seq_printf(seq, "Module name         : %s\n",
--		   chtostr(result.module_name, 24));
--	seq_printf(seq, "Module revision     : %s\n",
--		   chtostr(result.module_rev, 8));
-+	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
-+	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
- 
- 	seq_printf(seq, "Serial number       : ");
- 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
- 		return 0;
- 	}
- 
--	seq_printf(seq, "Device name     : %s\n",
--		   chtostr(result.device_name, 64));
--	seq_printf(seq, "Service name    : %s\n",
--		   chtostr(result.service_name, 64));
--	seq_printf(seq, "Physical name   : %s\n",
--		   chtostr(result.physical_location, 64));
--	seq_printf(seq, "Instance number : %s\n",
--		   chtostr(result.instance_number, 4));
-+	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
-+	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
-+	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
-+	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/drivers/misc/kgdbts.c linux-2.6.32.12/drivers/misc/kgdbts.c
---- linux-2.6.32.12/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/misc/kgdbts.c	2010-04-04 20:46:41.597784214 -0400
-@@ -118,7 +118,7 @@
- 	} while (0)
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- 	.name			= "kgdbts",
- 	.read_char		= kgdbts_get_char,
- 	.write_char		= kgdbts_put_char,
-diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/misc/sgi-gru/gruhandles.c	2010-04-04 20:46:41.597784214 -0400
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
- 
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
--	atomic_long_inc(&mcs_op_statistics[op].count);
--	atomic_long_add(clks, &mcs_op_statistics[op].total);
-+	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- 	if (mcs_op_statistics[op].max < clks)
- 		mcs_op_statistics[op].max = clks;
- }
-diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/misc/sgi-gru/gruprocfs.c	2010-04-04 20:46:41.597784214 -0400
-@@ -32,9 +32,9 @@
- 
- #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
- 
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
--	unsigned long val = atomic_long_read(v);
-+	unsigned long val = atomic_long_read_unchecked(v);
- 
- 	if (val)
- 		seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
- 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
- 
- 	for (op = 0; op < mcsop_last; op++) {
--		count = atomic_long_read(&mcs_op_statistics[op].count);
--		total = atomic_long_read(&mcs_op_statistics[op].total);
-+		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- 		max = mcs_op_statistics[op].max;
- 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- 			   count ? total / count : 0, max);
-diff -urNp linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/misc/sgi-gru/grutables.h	2010-04-04 20:46:41.597784214 -0400
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
-  * GRU statistics.
-  */
- struct gru_stats_s {
--	atomic_long_t vdata_alloc;
--	atomic_long_t vdata_free;
--	atomic_long_t gts_alloc;
--	atomic_long_t gts_free;
--	atomic_long_t vdata_double_alloc;
--	atomic_long_t gts_double_allocate;
--	atomic_long_t assign_context;
--	atomic_long_t assign_context_failed;
--	atomic_long_t free_context;
--	atomic_long_t load_user_context;
--	atomic_long_t load_kernel_context;
--	atomic_long_t lock_kernel_context;
--	atomic_long_t unlock_kernel_context;
--	atomic_long_t steal_user_context;
--	atomic_long_t steal_kernel_context;
--	atomic_long_t steal_context_failed;
--	atomic_long_t nopfn;
--	atomic_long_t break_cow;
--	atomic_long_t asid_new;
--	atomic_long_t asid_next;
--	atomic_long_t asid_wrap;
--	atomic_long_t asid_reuse;
--	atomic_long_t intr;
--	atomic_long_t intr_mm_lock_failed;
--	atomic_long_t call_os;
--	atomic_long_t call_os_offnode_reference;
--	atomic_long_t call_os_check_for_bug;
--	atomic_long_t call_os_wait_queue;
--	atomic_long_t user_flush_tlb;
--	atomic_long_t user_unload_context;
--	atomic_long_t user_exception;
--	atomic_long_t set_context_option;
--	atomic_long_t migrate_check;
--	atomic_long_t migrated_retarget;
--	atomic_long_t migrated_unload;
--	atomic_long_t migrated_unload_delay;
--	atomic_long_t migrated_nopfn_retarget;
--	atomic_long_t migrated_nopfn_unload;
--	atomic_long_t tlb_dropin;
--	atomic_long_t tlb_dropin_fail_no_asid;
--	atomic_long_t tlb_dropin_fail_upm;
--	atomic_long_t tlb_dropin_fail_invalid;
--	atomic_long_t tlb_dropin_fail_range_active;
--	atomic_long_t tlb_dropin_fail_idle;
--	atomic_long_t tlb_dropin_fail_fmm;
--	atomic_long_t tlb_dropin_fail_no_exception;
--	atomic_long_t tlb_dropin_fail_no_exception_war;
--	atomic_long_t tfh_stale_on_fault;
--	atomic_long_t mmu_invalidate_range;
--	atomic_long_t mmu_invalidate_page;
--	atomic_long_t mmu_clear_flush_young;
--	atomic_long_t flush_tlb;
--	atomic_long_t flush_tlb_gru;
--	atomic_long_t flush_tlb_gru_tgh;
--	atomic_long_t flush_tlb_gru_zero_asid;
--
--	atomic_long_t copy_gpa;
--
--	atomic_long_t mesq_receive;
--	atomic_long_t mesq_receive_none;
--	atomic_long_t mesq_send;
--	atomic_long_t mesq_send_failed;
--	atomic_long_t mesq_noop;
--	atomic_long_t mesq_send_unexpected_error;
--	atomic_long_t mesq_send_lb_overflow;
--	atomic_long_t mesq_send_qlimit_reached;
--	atomic_long_t mesq_send_amo_nacked;
--	atomic_long_t mesq_send_put_nacked;
--	atomic_long_t mesq_qf_not_full;
--	atomic_long_t mesq_qf_locked;
--	atomic_long_t mesq_qf_noop_not_full;
--	atomic_long_t mesq_qf_switch_head_failed;
--	atomic_long_t mesq_qf_unexpected_error;
--	atomic_long_t mesq_noop_unexpected_error;
--	atomic_long_t mesq_noop_lb_overflow;
--	atomic_long_t mesq_noop_qlimit_reached;
--	atomic_long_t mesq_noop_amo_nacked;
--	atomic_long_t mesq_noop_put_nacked;
-+	atomic_long_unchecked_t vdata_alloc;
-+	atomic_long_unchecked_t vdata_free;
-+	atomic_long_unchecked_t gts_alloc;
-+	atomic_long_unchecked_t gts_free;
-+	atomic_long_unchecked_t vdata_double_alloc;
-+	atomic_long_unchecked_t gts_double_allocate;
-+	atomic_long_unchecked_t assign_context;
-+	atomic_long_unchecked_t assign_context_failed;
-+	atomic_long_unchecked_t free_context;
-+	atomic_long_unchecked_t load_user_context;
-+	atomic_long_unchecked_t load_kernel_context;
-+	atomic_long_unchecked_t lock_kernel_context;
-+	atomic_long_unchecked_t unlock_kernel_context;
-+	atomic_long_unchecked_t steal_user_context;
-+	atomic_long_unchecked_t steal_kernel_context;
-+	atomic_long_unchecked_t steal_context_failed;
-+	atomic_long_unchecked_t nopfn;
-+	atomic_long_unchecked_t break_cow;
-+	atomic_long_unchecked_t asid_new;
-+	atomic_long_unchecked_t asid_next;
-+	atomic_long_unchecked_t asid_wrap;
-+	atomic_long_unchecked_t asid_reuse;
-+	atomic_long_unchecked_t intr;
-+	atomic_long_unchecked_t intr_mm_lock_failed;
-+	atomic_long_unchecked_t call_os;
-+	atomic_long_unchecked_t call_os_offnode_reference;
-+	atomic_long_unchecked_t call_os_check_for_bug;
-+	atomic_long_unchecked_t call_os_wait_queue;
-+	atomic_long_unchecked_t user_flush_tlb;
-+	atomic_long_unchecked_t user_unload_context;
-+	atomic_long_unchecked_t user_exception;
-+	atomic_long_unchecked_t set_context_option;
-+	atomic_long_unchecked_t migrate_check;
-+	atomic_long_unchecked_t migrated_retarget;
-+	atomic_long_unchecked_t migrated_unload;
-+	atomic_long_unchecked_t migrated_unload_delay;
-+	atomic_long_unchecked_t migrated_nopfn_retarget;
-+	atomic_long_unchecked_t migrated_nopfn_unload;
-+	atomic_long_unchecked_t tlb_dropin;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+	atomic_long_unchecked_t tlb_dropin_fail_upm;
-+	atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+	atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+	atomic_long_unchecked_t tlb_dropin_fail_idle;
-+	atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+	atomic_long_unchecked_t tfh_stale_on_fault;
-+	atomic_long_unchecked_t mmu_invalidate_range;
-+	atomic_long_unchecked_t mmu_invalidate_page;
-+	atomic_long_unchecked_t mmu_clear_flush_young;
-+	atomic_long_unchecked_t flush_tlb;
-+	atomic_long_unchecked_t flush_tlb_gru;
-+	atomic_long_unchecked_t flush_tlb_gru_tgh;
-+	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-+
-+	atomic_long_unchecked_t copy_gpa;
-+
-+	atomic_long_unchecked_t mesq_receive;
-+	atomic_long_unchecked_t mesq_receive_none;
-+	atomic_long_unchecked_t mesq_send;
-+	atomic_long_unchecked_t mesq_send_failed;
-+	atomic_long_unchecked_t mesq_noop;
-+	atomic_long_unchecked_t mesq_send_unexpected_error;
-+	atomic_long_unchecked_t mesq_send_lb_overflow;
-+	atomic_long_unchecked_t mesq_send_qlimit_reached;
-+	atomic_long_unchecked_t mesq_send_amo_nacked;
-+	atomic_long_unchecked_t mesq_send_put_nacked;
-+	atomic_long_unchecked_t mesq_qf_not_full;
-+	atomic_long_unchecked_t mesq_qf_locked;
-+	atomic_long_unchecked_t mesq_qf_noop_not_full;
-+	atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+	atomic_long_unchecked_t mesq_qf_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_lb_overflow;
-+	atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+	atomic_long_unchecked_t mesq_noop_amo_nacked;
-+	atomic_long_unchecked_t mesq_noop_put_nacked;
- 
- };
- 
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
- 	cchop_deallocate, tghop_invalidate, mcsop_last};
- 
- struct mcs_op_statistic {
--	atomic_long_t	count;
--	atomic_long_t	total;
-+	atomic_long_unchecked_t	count;
-+	atomic_long_unchecked_t	total;
- 	unsigned long	max;
- };
- 
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
- 
- #define STAT(id)	do {						\
- 				if (gru_options & OPT_STATS)		\
--					atomic_long_inc(&gru_stats.id);	\
-+					atomic_long_inc_unchecked(&gru_stats.id);	\
- 			} while (0)
- 
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.32.12/drivers/mtd/devices/doc2000.c linux-2.6.32.12/drivers/mtd/devices/doc2000.c
---- linux-2.6.32.12/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/mtd/devices/doc2000.c	2010-04-04 20:46:41.597784214 -0400
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
- 
- 		/* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
--		if (len != 0x200 && eccbuf)
-+		if (len != 0x200)
- 			printk(KERN_WARNING
- 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
- 			       (long) to, (long) len);
-diff -urNp linux-2.6.32.12/drivers/mtd/devices/doc2001.c linux-2.6.32.12/drivers/mtd/devices/doc2001.c
---- linux-2.6.32.12/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/mtd/devices/doc2001.c	2010-04-04 20:46:41.597784214 -0400
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
- 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
- 
- 	/* Don't allow read past end of device */
--	if (from >= this->totlen)
-+	if (from >= this->totlen || !len)
- 		return -EINVAL;
- 
- 	/* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.32.12/drivers/mtd/ubi/build.c linux-2.6.32.12/drivers/mtd/ubi/build.c
---- linux-2.6.32.12/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/mtd/ubi/build.c	2010-04-04 20:46:41.597784214 -0400
-@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
- static int __init bytes_str_to_int(const char *str)
- {
- 	char *endp;
--	unsigned long result;
-+	unsigned long result, scale = 1;
- 
- 	result = simple_strtoul(str, &endp, 0);
- 	if (str == endp || result >= INT_MAX) {
-@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
- 
- 	switch (*endp) {
- 	case 'G':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'M':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'K':
--		result *= 1024;
-+		scale *= 1024;
- 		if (endp[1] == 'i' && endp[2] == 'B')
- 			endp += 2;
- 	case '\0':
-@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
- 		return -EINVAL;
- 	}
- 
--	return result;
-+	if ((intoverflow_t)result*scale >= INT_MAX) {
-+		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
-+		       str);
-+		return -EINVAL;
-+	}
-+
-+	return result*scale;
- }
- 
- /**
-diff -urNp linux-2.6.32.12/drivers/net/e1000e/82571.c linux-2.6.32.12/drivers/net/e1000e/82571.c
---- linux-2.6.32.12/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/e1000e/82571.c	2010-04-04 20:46:41.597784214 -0400
-@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 	u32 swsm = 0;
- 	u32 swsm2 = 0;
-@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- 	/* .check_mng_mode: mac type dependent */
- 	/* .check_for_link: media type dependent */
- 	.id_led_init		= e1000e_id_led_init,
-@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= NULL,
-@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_82571,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_82571,
-diff -urNp linux-2.6.32.12/drivers/net/e1000e/e1000.h linux-2.6.32.12/drivers/net/e1000e/e1000.h
---- linux-2.6.32.12/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/e1000e/e1000.h	2010-04-04 20:46:41.597784214 -0400
-@@ -375,9 +375,9 @@ struct e1000_info {
- 	u32			pba;
- 	u32			max_hw_frame_size;
- 	s32			(*get_variants)(struct e1000_adapter *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- /* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.32.12/drivers/net/e1000e/es2lan.c linux-2.6.32.12/drivers/net/e1000e/es2lan.c
---- linux-2.6.32.12/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/e1000e/es2lan.c	2010-04-04 20:46:41.597784214 -0400
-@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 
- 	/* Set media type */
-@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000e_check_mng_mode_generic,
- 	/* check_for_link dependent on media type */
-@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy	 	= e1000e_phy_sw_reset,
-@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
- 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
- };
- 
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.32.12/drivers/net/e1000e/hw.h linux-2.6.32.12/drivers/net/e1000e/hw.h
---- linux-2.6.32.12/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.12/drivers/net/e1000e/hw.h	2010-04-04 20:46:41.601781347 -0400
-@@ -756,34 +756,34 @@ struct e1000_mac_operations {
- 
- /* Function pointers for the PHY. */
- struct e1000_phy_operations {
--	s32  (*acquire_phy)(struct e1000_hw *);
--	s32  (*check_polarity)(struct e1000_hw *);
--	s32  (*check_reset_block)(struct e1000_hw *);
--	s32  (*commit_phy)(struct e1000_hw *);
--	s32  (*force_speed_duplex)(struct e1000_hw *);
--	s32  (*get_cfg_done)(struct e1000_hw *hw);
--	s32  (*get_cable_length)(struct e1000_hw *);
--	s32  (*get_phy_info)(struct e1000_hw *);
--	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
--	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
--	void (*release_phy)(struct e1000_hw *);
--	s32  (*reset_phy)(struct e1000_hw *);
--	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
--	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
--	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
--	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
--	s32  (*cfg_on_link_up)(struct e1000_hw *);
-+	s32  (* acquire_phy)(struct e1000_hw *);
-+	s32  (* check_polarity)(struct e1000_hw *);
-+	s32  (* check_reset_block)(struct e1000_hw *);
-+	s32  (* commit_phy)(struct e1000_hw *);
-+	s32  (* force_speed_duplex)(struct e1000_hw *);
-+	s32  (* get_cfg_done)(struct e1000_hw *hw);
-+	s32  (* get_cable_length)(struct e1000_hw *);
-+	s32  (* get_phy_info)(struct e1000_hw *);
-+	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
-+	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-+	void (* release_phy)(struct e1000_hw *);
-+	s32  (* reset_phy)(struct e1000_hw *);
-+	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
-+	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-+	s32  (* cfg_on_link_up)(struct e1000_hw *);
- };
- 
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
--	s32  (*acquire_nvm)(struct e1000_hw *);
--	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release_nvm)(struct e1000_hw *);
--	s32  (*update_nvm)(struct e1000_hw *);
--	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
--	s32  (*validate_nvm)(struct e1000_hw *);
--	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire_nvm)(struct e1000_hw *);
-+	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release_nvm)(struct e1000_hw *);
-+	s32  (* const update_nvm)(struct e1000_hw *);
-+	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
-+	s32  (* const validate_nvm)(struct e1000_hw *);
-+	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_mac_info {
-diff -urNp linux-2.6.32.12/drivers/net/e1000e/ich8lan.c linux-2.6.32.12/drivers/net/e1000e/ich8lan.c
---- linux-2.6.32.12/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
-+++ linux-2.6.32.12/drivers/net/e1000e/ich8lan.c	2010-04-04 20:46:41.601781347 -0400
-@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
- 	}
- }
- 
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
- 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
-@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
- 	/* id_led_init dependent on mac type */
- };
- 
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
- 	.check_reset_block	= e1000_check_reset_block_ich8lan,
- 	.commit_phy		= NULL,
-@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
- 	.write_phy_reg		= e1000e_write_phy_reg_igp,
- };
- 
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
- 	.read_nvm	 	= e1000_read_nvm_ich8lan,
- 	.release_nvm		= e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.32.12/drivers/net/ibmveth.c linux-2.6.32.12/drivers/net/ibmveth.c
---- linux-2.6.32.12/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/ibmveth.c	2010-04-04 20:46:41.601781347 -0400
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
- 	NULL,
- };
- 
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- 	.show   = veth_pool_show,
- 	.store  = veth_pool_store,
- };
-diff -urNp linux-2.6.32.12/drivers/net/igb/e1000_82575.c linux-2.6.32.12/drivers/net/igb/e1000_82575.c
---- linux-2.6.32.12/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:38.085476187 -0400
-+++ linux-2.6.32.12/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:58.193505226 -0400
-@@ -1401,7 +1401,7 @@ void igb_vmdq_set_replication_pf(struct 
- 	wr32(E1000_VT_CTL, vt_ctl);
- }
- 
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- 	.reset_hw             = igb_reset_hw_82575,
- 	.init_hw              = igb_init_hw_82575,
- 	.check_for_link       = igb_check_for_link_82575,
-@@ -1410,13 +1410,13 @@ static struct e1000_mac_operations e1000
- 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
- 
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- 	.acquire              = igb_acquire_phy_82575,
- 	.get_cfg_done         = igb_get_cfg_done_82575,
- 	.release              = igb_release_phy_82575,
- };
- 
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- 	.acquire              = igb_acquire_nvm_82575,
- 	.read                 = igb_read_nvm_eerd,
- 	.release              = igb_release_nvm_82575,
-diff -urNp linux-2.6.32.12/drivers/net/igb/e1000_hw.h linux-2.6.32.12/drivers/net/igb/e1000_hw.h
---- linux-2.6.32.12/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:38.085476187 -0400
-+++ linux-2.6.32.12/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:58.197572571 -0400
-@@ -303,17 +303,17 @@ struct e1000_phy_operations {
- };
- 
- struct e1000_nvm_operations {
--	s32  (*acquire)(struct e1000_hw *);
--	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release)(struct e1000_hw *);
--	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire)(struct e1000_hw *);
-+	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release)(struct e1000_hw *);
-+	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_info {
- 	s32 (*get_invariants)(struct e1000_hw *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- extern const struct e1000_info e1000_82575_info;
-diff -urNp linux-2.6.32.12/drivers/net/irda/vlsi_ir.c linux-2.6.32.12/drivers/net/irda/vlsi_ir.c
---- linux-2.6.32.12/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/irda/vlsi_ir.c	2010-04-04 20:46:41.601781347 -0400
-@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
- 			/* no race - tx-ring already empty */
- 			vlsi_set_baud(idev, iobase);
- 			netif_wake_queue(ndev);
--		}
--		else
--			;
-+		} else {
- 			/* keep the speed change pending like it would
- 			 * for any len>0 packet. tx completion interrupt
- 			 * will apply it when the tx ring becomes empty.
- 			 */
-+		}
- 		spin_unlock_irqrestore(&idev->lock, flags);
- 		dev_kfree_skb_any(skb);
- 		return NETDEV_TX_OK;
-diff -urNp linux-2.6.32.12/drivers/net/iseries_veth.c linux-2.6.32.12/drivers/net/iseries_veth.c
---- linux-2.6.32.12/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/iseries_veth.c	2010-04-04 20:46:41.601781347 -0400
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
- 	NULL
- };
- 
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- 		.show = veth_cnx_attribute_show
- };
- 
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
- 	NULL
- };
- 
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- 	.show = veth_port_attribute_show
- };
- 
-diff -urNp linux-2.6.32.12/drivers/net/pcnet32.c linux-2.6.32.12/drivers/net/pcnet32.c
---- linux-2.6.32.12/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/pcnet32.c	2010-04-04 20:46:41.601781347 -0400
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
-  * VLB I/O addresses
-  */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
-     { 0x300, 0x320, 0x340, 0x360, 0 };
- 
- static int pcnet32_debug = 0;
-diff -urNp linux-2.6.32.12/drivers/net/tg3.h linux-2.6.32.12/drivers/net/tg3.h
---- linux-2.6.32.12/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
-+++ linux-2.6.32.12/drivers/net/tg3.h	2010-04-04 20:46:41.601781347 -0400
-@@ -95,6 +95,7 @@
- #define  CHIPREV_ID_5750_A0		 0x4000
- #define  CHIPREV_ID_5750_A1		 0x4001
- #define  CHIPREV_ID_5750_A3		 0x4003
-+#define  CHIPREV_ID_5750_C1		 0x4201
- #define  CHIPREV_ID_5750_C2		 0x4202
- #define  CHIPREV_ID_5752_A0_HW		 0x5000
- #define  CHIPREV_ID_5752_A0		 0x6000
-diff -urNp linux-2.6.32.12/drivers/net/tulip/de4x5.c linux-2.6.32.12/drivers/net/tulip/de4x5.c
---- linux-2.6.32.12/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/tulip/de4x5.c	2010-04-04 20:46:41.601781347 -0400
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	for (i=0; i<ETH_ALEN; i++) {
- 	    tmp.addr[i] = dev->dev_addr[i];
- 	}
--	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- 	break;
- 
-     case DE4X5_SET_HWADDR:           /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	spin_lock_irqsave(&lp->lock, flags);
- 	memcpy(&statbuf, &lp->pktStats, ioc->len);
- 	spin_unlock_irqrestore(&lp->lock, flags);
--	if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- 		return -EFAULT;
- 	break;
-     }
-diff -urNp linux-2.6.32.12/drivers/net/usb/hso.c linux-2.6.32.12/drivers/net/usb/hso.c
---- linux-2.6.32.12/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/usb/hso.c	2010-04-04 20:46:41.605567348 -0400
-@@ -258,7 +258,7 @@ struct hso_serial {
- 
- 	/* from usb_serial_port */
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 	spinlock_t serial_lock;
- 
- 	int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
- 	struct urb *urb;
- 
- 	urb = serial->rx_urb[0];
--	if (serial->open_count > 0) {
-+	if (atomic_read(&serial->open_count) > 0) {
- 		count = put_rxbuf_data(urb, serial);
- 		if (count == -1)
- 			return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
- 	DUMP1(urb->transfer_buffer, urb->actual_length);
- 
- 	/* Anyone listening? */
--	if (serial->open_count == 0)
-+	if (atomic_read(&serial->open_count) == 0)
- 		return;
- 
- 	if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
- 	spin_unlock_irq(&serial->serial_lock);
- 
- 	/* check for port already opened, if not set the termios */
--	serial->open_count++;
--	if (serial->open_count == 1) {
-+	if (atomic_inc_return(&serial->open_count) == 1) {
- 		tty->low_latency = 1;
- 		serial->rx_state = RX_IDLE;
- 		/* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
- 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- 		if (result) {
- 			hso_stop_serial_device(serial->parent);
--			serial->open_count--;
-+			atomic_dec(&serial->open_count);
- 			kref_put(&serial->parent->ref, hso_serial_ref_free);
- 		}
- 	} else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
- 
- 	/* reset the rts and dtr */
- 	/* do the actual close */
--	serial->open_count--;
-+	atomic_dec(&serial->open_count);
- 
--	if (serial->open_count <= 0) {
--		serial->open_count = 0;
-+	if (atomic_read(&serial->open_count) <= 0) {
-+		atomic_set(&serial->open_count,  0);
- 		spin_lock_irq(&serial->serial_lock);
- 		if (serial->tty == tty) {
- 			serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
- 
- 	/* the actual setup */
- 	spin_lock_irqsave(&serial->serial_lock, flags);
--	if (serial->open_count)
-+	if (atomic_read(&serial->open_count))
- 		_hso_serial_set_termios(tty, old);
- 	else
- 		tty->termios = old;
-@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
- 	/* Start all serial ports */
- 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
--			if (dev2ser(serial_table[i])->open_count) {
-+			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
- 				result =
- 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
- 				hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/b43/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
- 	size_t file_struct_offset;
- };
-diff -urNp linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/b43legacy/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- 	size_t file_struct_offset;
- 	/* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-04-04 20:46:41.605567348 -0400
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
- 	 },
- };
- 
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl1000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:46:41.605567348 -0400
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
- 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
- 
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- 	.ucode = &iwl3945_ucode,
- 	.lib = &iwl3945_lib,
- 	.hcmd = &iwl3945_hcmd,
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:38.221487644 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:58.277496729 -0400
-@@ -2340,7 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
- 	},
- };
- 
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- 	.ucode = &iwl4965_ucode,
- 	.lib = &iwl4965_lib,
- 	.hcmd = &iwl4965_hcmd,
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:38.221487644 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:58.285504530 -0400
-@@ -1628,14 +1628,14 @@ static struct iwl_lib_ops iwl5150_lib = 
- 	 },
- };
- 
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5000_lib,
- 	.hcmd = &iwl5000_hcmd,
- 	.utils = &iwl5000_hcmd_utils,
- };
- 
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5150_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-04-04 20:46:41.605567348 -0400
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
- 	.calc_rssi = iwl5000_calc_rssi,
- };
- 
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl6000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-04-29 17:46:37.170092362 -0400
-@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
- #endif
- 
- #else
--#define IWL_DEBUG(__priv, level, fmt, args...)
--#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
-+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
- static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
- 				      void *p, u32 len)
- {}
-diff -urNp linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h
---- linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-04-04 20:46:41.605567348 -0400
-@@ -67,7 +67,7 @@ struct iwl_tx_queue;
- 
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff -urNp linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/libertas/debugfs.c	2010-04-04 20:46:41.605567348 -0400
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- 	const char *name;
- 	int perm;
--	struct file_operations fops;
-+	const struct file_operations fops;
- };
- 
- static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/net/wireless/rndis_wlan.c	2010-04-29 17:46:37.185749089 -0400
-@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
- 
- 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
- 
--	if (rts_threshold < 0 || rts_threshold > 2347)
-+	if (rts_threshold > 2347)
- 		rts_threshold = 2347;
- 
- 	tmp = cpu_to_le32(rts_threshold);
-diff -urNp linux-2.6.32.12/drivers/oprofile/buffer_sync.c linux-2.6.32.12/drivers/oprofile/buffer_sync.c
---- linux-2.6.32.12/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/buffer_sync.c	2010-04-04 20:46:41.605567348 -0400
-@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
- 		if (cookie == NO_COOKIE)
- 			offset = pc;
- 		if (cookie == INVALID_COOKIE) {
--			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 			offset = pc;
- 		}
- 		if (cookie != last_cookie) {
-@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
- 	/* add userspace sample */
- 
- 	if (!mm) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- 		return 0;
- 	}
- 
- 	cookie = lookup_dcookie(mm, s->eip, &offset);
- 
- 	if (cookie == INVALID_COOKIE) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 		return 0;
- 	}
- 
-@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
- 		/* ignore backtraces if failed to add a sample */
- 		if (state == sb_bt_start) {
- 			state = sb_bt_ignore;
--			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- 		}
- 	}
- 	release_mm(mm);
-diff -urNp linux-2.6.32.12/drivers/oprofile/event_buffer.c linux-2.6.32.12/drivers/oprofile/event_buffer.c
---- linux-2.6.32.12/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/event_buffer.c	2010-04-04 20:46:41.605567348 -0400
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
- 	}
- 
- 	if (buffer_pos == buffer_size) {
--		atomic_inc(&oprofile_stats.event_lost_overflow);
-+		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- 		return;
- 	}
- 
-diff -urNp linux-2.6.32.12/drivers/oprofile/oprof.c linux-2.6.32.12/drivers/oprofile/oprof.c
---- linux-2.6.32.12/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/oprof.c	2010-04-04 20:46:41.605567348 -0400
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
- 	if (oprofile_ops.switch_events())
- 		return;
- 
--	atomic_inc(&oprofile_stats.multiplex_counter);
-+	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- 	start_switch_worker();
- }
- 
-diff -urNp linux-2.6.32.12/drivers/oprofile/oprofilefs.c linux-2.6.32.12/drivers/oprofile/oprofilefs.c
---- linux-2.6.32.12/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/oprofilefs.c	2010-04-04 20:46:41.609229988 -0400
-@@ -187,7 +187,7 @@ static const struct file_operations atom
- 
- 
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
--	char const *name, atomic_t *val)
-+	char const *name, atomic_unchecked_t *val)
- {
- 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
- 						     &atomic_ro_fops, 0444);
-diff -urNp linux-2.6.32.12/drivers/oprofile/oprofile_stats.c linux-2.6.32.12/drivers/oprofile/oprofile_stats.c
---- linux-2.6.32.12/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/oprofile_stats.c	2010-04-04 20:46:41.609229988 -0400
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- 		cpu_buf->sample_invalid_eip = 0;
- 	}
- 
--	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
--	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.event_lost_overflow, 0);
--	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.multiplex_counter, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
- 
- 
-diff -urNp linux-2.6.32.12/drivers/oprofile/oprofile_stats.h linux-2.6.32.12/drivers/oprofile/oprofile_stats.h
---- linux-2.6.32.12/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/oprofile/oprofile_stats.h	2010-04-04 20:46:41.609229988 -0400
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
- 
- struct oprofile_stat_struct {
--	atomic_t sample_lost_no_mm;
--	atomic_t sample_lost_no_mapping;
--	atomic_t bt_lost_no_mapping;
--	atomic_t event_lost_overflow;
--	atomic_t multiplex_counter;
-+	atomic_unchecked_t sample_lost_no_mm;
-+	atomic_unchecked_t sample_lost_no_mapping;
-+	atomic_unchecked_t bt_lost_no_mapping;
-+	atomic_unchecked_t event_lost_overflow;
-+	atomic_unchecked_t multiplex_counter;
- };
- 
- extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.32.12/drivers/parisc/pdc_stable.c linux-2.6.32.12/drivers/parisc/pdc_stable.c
---- linux-2.6.32.12/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/parisc/pdc_stable.c	2010-04-04 20:46:41.609229988 -0400
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
- 	return ret;
- }
- 
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- 	.show = pdcspath_attr_show,
- 	.store = pdcspath_attr_store,
- };
-diff -urNp linux-2.6.32.12/drivers/parport/procfs.c linux-2.6.32.12/drivers/parport/procfs.c
---- linux-2.6.32.12/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/parport/procfs.c	2010-04-04 20:46:41.609229988 -0400
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
- 
- 	*ppos += len;
- 
--	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
- 
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
- 
- 	*ppos += len;
- 
--	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
- 
-diff -urNp linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/hotplug/acpiphp_glue.c	2010-04-04 20:46:41.609229988 -0400
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
- }
- 
- 
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- 	.handler = handle_hotplug_event_func,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/hotplug/cpqphp_nvram.c	2010-04-04 20:46:41.609229988 -0400
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
- 
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- 	if (rom_start) {
- 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- 	}
-+#endif
-+
- 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
- 
- 	/* initialize our int15 lock */
-diff -urNp linux-2.6.32.12/drivers/pci/hotplug/fakephp.c linux-2.6.32.12/drivers/pci/hotplug/fakephp.c
---- linux-2.6.32.12/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/hotplug/fakephp.c	2010-04-04 20:46:41.609229988 -0400
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
- }
- 
- static struct kobj_type legacy_ktype = {
--	.sysfs_ops = &(struct sysfs_ops){
-+	.sysfs_ops = &(const struct sysfs_ops){
- 		.store = legacy_store, .show = legacy_show
- 	},
- 	.release = &legacy_release,
-diff -urNp linux-2.6.32.12/drivers/pci/intel-iommu.c linux-2.6.32.12/drivers/pci/intel-iommu.c
---- linux-2.6.32.12/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/intel-iommu.c	2010-04-04 20:46:41.609229988 -0400
-@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
- 	return !dma_addr;
- }
- 
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- 	.alloc_coherent = intel_alloc_coherent,
- 	.free_coherent = intel_free_coherent,
- 	.map_sg = intel_map_sg,
-diff -urNp linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c
---- linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/pcie/portdrv_pci.c	2010-04-04 20:46:41.609229988 -0400
-@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
- static const struct pci_device_id port_pci_ids[] = { {
- 	/* handle any PCI-Express port */
- 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, port_pci_ids);
- 
-diff -urNp linux-2.6.32.12/drivers/pci/probe.c linux-2.6.32.12/drivers/pci/probe.c
---- linux-2.6.32.12/drivers/pci/probe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/probe.c	2010-04-29 17:46:37.193749810 -0400
-@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
- 	return ret;
- }
- 
--static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
- 					struct device_attribute *attr,
- 					char *buf)
- {
- 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
- }
- 
--static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
- 					struct device_attribute *attr,
- 					char *buf)
- {
-diff -urNp linux-2.6.32.12/drivers/pci/proc.c linux-2.6.32.12/drivers/pci/proc.c
---- linux-2.6.32.12/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/proc.c	2010-04-04 20:46:41.609229988 -0400
-@@ -480,7 +480,16 @@ static const struct file_operations proc
- static int __init pci_proc_init(void)
- {
- 	struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- 	proc_create("devices", 0, proc_bus_pci_dir,
- 		    &proc_bus_pci_dev_operations);
- 	proc_initialized = 1;
-diff -urNp linux-2.6.32.12/drivers/pci/slot.c linux-2.6.32.12/drivers/pci/slot.c
---- linux-2.6.32.12/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pci/slot.c	2010-04-04 20:46:41.609229988 -0400
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
- 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
- 
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- 	.show = pci_slot_attr_show,
- 	.store = pci_slot_attr_store,
- };
-diff -urNp linux-2.6.32.12/drivers/pcmcia/ti113x.h linux-2.6.32.12/drivers/pcmcia/ti113x.h
---- linux-2.6.32.12/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pcmcia/ti113x.h	2010-04-04 20:46:41.609229988 -0400
-@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
- 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
- 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
- 
--	{}
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
-diff -urNp linux-2.6.32.12/drivers/pcmcia/yenta_socket.c linux-2.6.32.12/drivers/pcmcia/yenta_socket.c
---- linux-2.6.32.12/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pcmcia/yenta_socket.c	2010-04-04 20:46:41.609229988 -0400
-@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
- 
- 	/* match any cardbus bridge */
- 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
--	{ /* all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, yenta_table);
- 
-diff -urNp linux-2.6.32.12/drivers/platform/x86/acer-wmi.c linux-2.6.32.12/drivers/platform/x86/acer-wmi.c
---- linux-2.6.32.12/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/acer-wmi.c	2010-04-04 20:46:41.609229988 -0400
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
- 	return 0;
- }
- 
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/asus_acpi.c linux-2.6.32.12/drivers/platform/x86/asus_acpi.c
---- linux-2.6.32.12/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/asus_acpi.c	2010-04-04 20:46:41.609229988 -0400
-@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
- 	return 0;
- }
- 
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- 	.get_brightness = read_brightness,
- 	.update_status  = set_brightness_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/asus-laptop.c linux-2.6.32.12/drivers/platform/x86/asus-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/asus-laptop.c	2010-04-04 20:46:41.609229988 -0400
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/compal-laptop.c linux-2.6.32.12/drivers/platform/x86/compal-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/compal-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status	= bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/dell-laptop.c linux-2.6.32.12/drivers/platform/x86/dell-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/dell-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
- 	return buffer.output[1];
- }
- 
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- 	.get_brightness = dell_get_intensity,
- 	.update_status  = dell_send_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:38.317493070 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:58.337509449 -0400
-@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/fujitsu-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
- 	return ret;
- }
- 
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/msi-laptop.c linux-2.6.32.12/drivers/platform/x86/msi-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/msi-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status  = bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/panasonic-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
- 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
- 
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- 	.get_brightness	= bl_get,
- 	.update_status	= bl_set_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/sony-laptop.c linux-2.6.32.12/drivers/platform/x86/sony-laptop.c
---- linux-2.6.32.12/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/sony-laptop.c	2010-04-04 20:46:41.612789562 -0400
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
- }
- 
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- 	.update_status = sony_backlight_update_status,
- 	.get_brightness = sony_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c
---- linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 17:49:38.333363657 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 18:04:08.901389713 -0400
-@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
- 			       BACKLIGHT_UPDATE_HOTKEY);
- }
- 
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- 	.get_brightness = brightness_get,
- 	.update_status  = brightness_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c
---- linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/platform/x86/toshiba_acpi.c	2010-04-04 20:46:41.612789562 -0400
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- 	return AE_OK;
- }
- 
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
-         .get_brightness = get_lcd,
-         .update_status  = set_lcd_status,
- };
-diff -urNp linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pnp/pnpbios/bioscalls.c	2010-04-04 20:46:41.612789562 -0400
-@@ -60,7 +60,7 @@ do { \
- 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
- 
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
- 
- 	cpu = get_cpu();
- 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
- 	spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
- 			     :"memory");
- 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
- 
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	/* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
- 	return status;
- }
- 
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- 	int i;
- 
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
- 	pnp_bios_callpoint.offset = header->fields.pm16offset;
- 	pnp_bios_callpoint.segment = PNP_CS16;
- 
-+	pax_open_kernel();
-+
- 	for_each_possible_cpu(i) {
- 		struct desc_struct *gdt = get_cpu_gdt_table(i);
- 		if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
- 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- 			 (unsigned long)__va(header->fields.pm16dseg));
- 	}
-+
-+	pax_close_kernel();
- }
-diff -urNp linux-2.6.32.12/drivers/pnp/quirks.c linux-2.6.32.12/drivers/pnp/quirks.c
---- linux-2.6.32.12/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pnp/quirks.c	2010-04-04 20:46:41.612789562 -0400
-@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
- 	/* PnP resources that might overlap PCI BARs */
- 	{"PNP0c01", quirk_system_pci_resources},
- 	{"PNP0c02", quirk_system_pci_resources},
--	{""}
-+	{"", NULL}
- };
- 
- void pnp_fixup_device(struct pnp_dev *dev)
-diff -urNp linux-2.6.32.12/drivers/pnp/resource.c linux-2.6.32.12/drivers/pnp/resource.c
---- linux-2.6.32.12/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/pnp/resource.c	2010-04-04 20:46:41.612789562 -0400
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*irq < 0 || *irq > 15)
-+	if (*irq > 15)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*dma < 0 || *dma == 4 || *dma > 7)
-+	if (*dma == 4 || *dma > 7)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-diff -urNp linux-2.6.32.12/drivers/s390/cio/qdio_perf.c linux-2.6.32.12/drivers/s390/cio/qdio_perf.c
---- linux-2.6.32.12/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/s390/cio/qdio_perf.c	2010-04-04 20:46:41.612789562 -0400
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.qdio_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.pci_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thin_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound),
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_in));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_out));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_sync));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.inbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.fast_requeue));
-+		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_target_full));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- 	seq_printf(m, "\n");
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/drivers/s390/cio/qdio_perf.h linux-2.6.32.12/drivers/s390/cio/qdio_perf.h
---- linux-2.6.32.12/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/s390/cio/qdio_perf.h	2010-04-04 20:46:41.612789562 -0400
-@@ -13,46 +13,46 @@
- 
- struct qdio_perf_stats {
- 	/* interrupt handler calls */
--	atomic_long_t qdio_int;
--	atomic_long_t pci_int;
--	atomic_long_t thin_int;
-+	atomic_long_unchecked_t qdio_int;
-+	atomic_long_unchecked_t pci_int;
-+	atomic_long_unchecked_t thin_int;
- 
- 	/* tasklet runs */
--	atomic_long_t tasklet_inbound;
--	atomic_long_t tasklet_outbound;
--	atomic_long_t tasklet_thinint;
--	atomic_long_t tasklet_thinint_loop;
--	atomic_long_t thinint_inbound;
--	atomic_long_t thinint_inbound_loop;
--	atomic_long_t thinint_inbound_loop2;
-+	atomic_long_unchecked_t tasklet_inbound;
-+	atomic_long_unchecked_t tasklet_outbound;
-+	atomic_long_unchecked_t tasklet_thinint;
-+	atomic_long_unchecked_t tasklet_thinint_loop;
-+	atomic_long_unchecked_t thinint_inbound;
-+	atomic_long_unchecked_t thinint_inbound_loop;
-+	atomic_long_unchecked_t thinint_inbound_loop2;
- 
- 	/* signal adapter calls */
--	atomic_long_t siga_out;
--	atomic_long_t siga_in;
--	atomic_long_t siga_sync;
-+	atomic_long_unchecked_t siga_out;
-+	atomic_long_unchecked_t siga_in;
-+	atomic_long_unchecked_t siga_sync;
- 
- 	/* misc */
--	atomic_long_t inbound_handler;
--	atomic_long_t outbound_handler;
--	atomic_long_t fast_requeue;
--	atomic_long_t outbound_target_full;
-+	atomic_long_unchecked_t inbound_handler;
-+	atomic_long_unchecked_t outbound_handler;
-+	atomic_long_unchecked_t fast_requeue;
-+	atomic_long_unchecked_t outbound_target_full;
- 
- 	/* for debugging */
--	atomic_long_t debug_tl_out_timer;
--	atomic_long_t debug_stop_polling;
--	atomic_long_t debug_eqbs_all;
--	atomic_long_t debug_eqbs_incomplete;
--	atomic_long_t debug_sqbs_all;
--	atomic_long_t debug_sqbs_incomplete;
-+	atomic_long_unchecked_t debug_tl_out_timer;
-+	atomic_long_unchecked_t debug_stop_polling;
-+	atomic_long_unchecked_t debug_eqbs_all;
-+	atomic_long_unchecked_t debug_eqbs_incomplete;
-+	atomic_long_unchecked_t debug_sqbs_all;
-+	atomic_long_unchecked_t debug_sqbs_incomplete;
- };
- 
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
- 
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- 	if (qdio_performance_stats)
--		atomic_long_inc(count);
-+		atomic_long_inc_unchecked(count);
- }
- 
- int qdio_setup_perf_stats(void);
-diff -urNp linux-2.6.32.12/drivers/scsi/ipr.c linux-2.6.32.12/drivers/scsi/ipr.c
---- linux-2.6.32.12/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/ipr.c	2010-04-04 20:46:41.616874360 -0400
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
- 	return true;
- }
- 
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- 	.phy_reset = ipr_ata_phy_reset,
- 	.hardreset = ipr_sata_reset,
- 	.post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/libfc/fc_exch.c	2010-04-04 20:46:41.616874360 -0400
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- 	 * all together if not used XXX
- 	 */
- 	struct {
--		atomic_t no_free_exch;
--		atomic_t no_free_exch_xid;
--		atomic_t xid_not_found;
--		atomic_t xid_busy;
--		atomic_t seq_not_found;
--		atomic_t non_bls_resp;
-+		atomic_unchecked_t no_free_exch;
-+		atomic_unchecked_t no_free_exch_xid;
-+		atomic_unchecked_t xid_not_found;
-+		atomic_unchecked_t xid_busy;
-+		atomic_unchecked_t seq_not_found;
-+		atomic_unchecked_t non_bls_resp;
- 	} stats;
- };
- #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
- 	/* allocate memory for exchange */
- 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- 	if (!ep) {
--		atomic_inc(&mp->stats.no_free_exch);
-+		atomic_inc_unchecked(&mp->stats.no_free_exch);
- 		goto out;
- 	}
- 	memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- 	return ep;
- err:
- 	spin_unlock_bh(&pool->lock);
--	atomic_inc(&mp->stats.no_free_exch_xid);
-+	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- 	mempool_free(ep, mp->ep_pool);
- 	return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
- 		ep = fc_exch_find(mp, xid);
- 		if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_OX_ID;
- 			goto out;
- 		}
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		ep = fc_exch_find(mp, xid);
- 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- 			if (ep) {
--				atomic_inc(&mp->stats.xid_busy);
-+				atomic_inc_unchecked(&mp->stats.xid_busy);
- 				reject = FC_RJT_RX_ID;
- 				goto rel;
- 			}
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 			}
- 			xid = ep->xid;	/* get our XID */
- 		} else if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_RX_ID;	/* XID not found */
- 			goto out;
- 		}
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
- 			goto rel;
- 		}
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
- 
- 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- 	if (!ep) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->esb_stat & ESB_ST_COMPLETE) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->rxid == FC_XID_UNKNOWN)
- 		ep->rxid = ntohs(fh->fh_rx_id);
- 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	if (ep->did != ntoh24(fh->fh_s_id) &&
- 	    ep->did != FC_FID_FLOGI) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			goto rel;
- 		}
- 	}
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
- 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
- 
- 	if (!sp)
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 	else
--		atomic_inc(&mp->stats.non_bls_resp);
-+		atomic_inc_unchecked(&mp->stats.non_bls_resp);
- 
- 	fc_frame_free(fp);
- }
-diff -urNp linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/libsas/sas_ata.c	2010-04-04 20:46:41.616874360 -0400
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
- 	}
- }
- 
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- 	.phy_reset		= sas_ata_phy_reset,
- 	.post_internal_cmd	= sas_ata_post_internal,
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h
---- linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-04-29 17:46:37.209772088 -0400
-@@ -79,7 +79,7 @@
- 		CMD;						\
- }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
- 
- 
-diff -urNp linux-2.6.32.12/drivers/scsi/scsi_logging.h linux-2.6.32.12/drivers/scsi/scsi_logging.h
---- linux-2.6.32.12/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/scsi_logging.h	2010-04-04 20:46:41.616874360 -0400
-@@ -51,7 +51,7 @@ do {								\
- 		} while (0);					\
- } while (0)
- #else
--#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
-+#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
- #endif /* CONFIG_SCSI_LOGGING */
- 
- /*
-diff -urNp linux-2.6.32.12/drivers/scsi/sg.c linux-2.6.32.12/drivers/scsi/sg.c
---- linux-2.6.32.12/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/scsi/sg.c	2010-04-04 20:46:41.616874360 -0400
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- 	const struct file_operations * fops;
- };
- 
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- 	{"allow_dio", &adio_fops},
- 	{"debug", &debug_fops},
- 	{"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- 	int k, mask;
- 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
--	struct sg_proc_leaf * leaf;
-+	const struct sg_proc_leaf * leaf;
- 
- 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- 	if (!sg_proc_sgp)
-diff -urNp linux-2.6.32.12/drivers/serial/8250_pci.c linux-2.6.32.12/drivers/serial/8250_pci.c
---- linux-2.6.32.12/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/serial/8250_pci.c	2010-04-04 20:46:41.616874360 -0400
-@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
- 		PCI_ANY_ID, PCI_ANY_ID,
- 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
- 		0xffff00, pbn_default },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static struct pci_driver serial_pci_driver = {
-diff -urNp linux-2.6.32.12/drivers/serial/kgdboc.c linux-2.6.32.12/drivers/serial/kgdboc.c
---- linux-2.6.32.12/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/serial/kgdboc.c	2010-04-04 20:46:41.616874360 -0400
-@@ -18,7 +18,7 @@
- 
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io		kgdboc_io_ops;
-+static const struct kgdb_io	kgdboc_io_ops;
- 
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured		= -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- 	.name			= "kgdboc",
- 	.read_char		= kgdboc_get_char,
- 	.write_char		= kgdboc_put_char,
-diff -urNp linux-2.6.32.12/drivers/staging/android/binder.c linux-2.6.32.12/drivers/staging/android/binder.c
---- linux-2.6.32.12/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/android/binder.c	2010-04-04 20:46:41.616874360 -0400
-@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
- 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
- 
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- 	.open = binder_vma_open,
- 	.close = binder_vma_close,
- };
-diff -urNp linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c
---- linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/b3dfg/b3dfg.c	2010-04-04 20:46:41.616874360 -0400
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
- 	return VM_FAULT_NOPAGE;
- }
- 
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- 	.fault = b3dfg_vma_fault,
- };
- 
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
- 	return r;
- }
- 
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- 	.owner = THIS_MODULE,
- 	.open = b3dfg_open,
- 	.release = b3dfg_release,
-diff -urNp linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/comedi/comedi_fops.c	2010-04-04 20:46:41.616874360 -0400
-@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
- 	mutex_unlock(&dev->mutex);
- }
- 
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- 	.close = comedi_unmap,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/adsp_driver.c	2010-04-04 20:46:41.616874360 -0400
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
- static dev_t adsp_devno;
- static struct class *adsp_class;
- 
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = adsp_open,
- 	.unlocked_ioctl = adsp_ioctl,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_aac.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1022,7 +1022,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audio_open,
- 	.release = audio_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-04-04 20:46:41.621505029 -0400
-@@ -833,7 +833,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audamrnb_open,
- 	.release = audamrnb_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_evrc.c	2010-04-04 20:46:41.621505029 -0400
-@@ -805,7 +805,7 @@ dma_fail:
- 	return rc;
- }
- 
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audevrc_open,
- 	.release = audevrc_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_in.c	2010-04-04 20:46:41.621505029 -0400
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_in_open,
- 	.release	= audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_in_ioctl,
- };
- 
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- 	.owner          = THIS_MODULE,
- 	.open           = audpre_open,
- 	.unlocked_ioctl = audpre_ioctl,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_mp3.c	2010-04-04 20:46:41.621505029 -0400
-@@ -941,7 +941,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_out.c	2010-04-04 20:46:41.621505029 -0400
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_ioctl,
- };
- 
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audpp_open,
- 	.unlocked_ioctl	= audpp_ioctl,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-04-04 20:46:41.621505029 -0400
-@@ -816,7 +816,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audqcelp_open,
- 	.release = audqcelp_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c
---- linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/qdsp5/snd.c	2010-04-04 20:46:41.621505029 -0400
-@@ -242,7 +242,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= snd_open,
- 	.release	= snd_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c
---- linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/smd/smd_qmi.c	2010-04-04 20:46:41.621505029 -0400
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
- 	return 0;
- }
- 
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- 	.owner = THIS_MODULE,
- 	.read = qmi_read,
- 	.write = qmi_write,
-diff -urNp linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c
---- linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-04-04 20:46:41.621505029 -0400
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
- 	return rc;
- }
- 
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
- 	.unlocked_ioctl	 = rpcrouter_ioctl,
- };
- 
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-diff -urNp linux-2.6.32.12/drivers/staging/dst/dcore.c linux-2.6.32.12/drivers/staging/dst/dcore.c
---- linux-2.6.32.12/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dst/dcore.c	2010-04-04 20:46:41.621505029 -0400
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
- 	return 0;
- }
- 
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- 	.open		= dst_bdev_open,
- 	.release	= dst_bdev_release,
- 	.owner		= THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
- 	n->size = ctl->size;
- 
- 	atomic_set(&n->refcnt, 1);
--	atomic_long_set(&n->gen, 0);
-+	atomic_long_set_unchecked(&n->gen, 0);
- 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
- 
- 	err = dst_node_sysfs_init(n);
-diff -urNp linux-2.6.32.12/drivers/staging/dst/trans.c linux-2.6.32.12/drivers/staging/dst/trans.c
---- linux-2.6.32.12/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/dst/trans.c	2010-04-04 20:46:41.621505029 -0400
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
- 	t->error = 0;
- 	t->retries = 0;
- 	atomic_set(&t->refcnt, 1);
--	t->gen = atomic_long_inc_return(&n->gen);
-+	t->gen = atomic_long_inc_return_unchecked(&n->gen);
- 
- 	t->enc = bio_data_dir(bio);
- 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff -urNp linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/go7007/go7007-v4l2.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
- 	return 0;
- }
- 
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- 	.open	= go7007_vm_open,
- 	.close	= go7007_vm_close,
- 	.fault	= go7007_vm_fault,
-diff -urNp linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c
---- linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/hv/blkvsc_drv.c	2010-04-04 20:46:41.621505029 -0400
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
- 
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- 	.owner = THIS_MODULE,
- 	.open = blkvsc_open,
- 	.release = blkvsc_release,
-diff -urNp linux-2.6.32.12/drivers/staging/panel/panel.c linux-2.6.32.12/drivers/staging/panel/panel.c
---- linux-2.6.32.12/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/panel/panel.c	2010-04-04 20:46:41.621505029 -0400
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- 	.write   = lcd_write,
- 	.open    = lcd_open,
- 	.release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
- 	return 0;
- }
- 
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- 	.read    = keypad_read,		/* read */
- 	.open    = keypad_open,		/* open */
- 	.release = keypad_release,	/* close */
-diff -urNp linux-2.6.32.12/drivers/staging/phison/phison.c linux-2.6.32.12/drivers/staging/phison/phison.c
---- linux-2.6.32.12/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/phison/phison.c	2010-04-04 20:46:41.621505029 -0400
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= phison_pre_reset,
- };
-diff -urNp linux-2.6.32.12/drivers/staging/poch/poch.c linux-2.6.32.12/drivers/staging/poch/poch.c
---- linux-2.6.32.12/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/poch/poch.c	2010-04-04 20:46:41.625742858 -0400
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- 	.owner = THIS_MODULE,
- 	.open = poch_open,
- 	.release = poch_release,
-diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/inode.c linux-2.6.32.12/drivers/staging/pohmelfs/inode.c
---- linux-2.6.32.12/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/pohmelfs/inode.c	2010-04-04 20:46:41.625742858 -0400
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
- 	mutex_init(&psb->mcache_lock);
- 	psb->mcache_root = RB_ROOT;
- 	psb->mcache_timeout = msecs_to_jiffies(5000);
--	atomic_long_set(&psb->mcache_gen, 0);
-+	atomic_long_set_unchecked(&psb->mcache_gen, 0);
- 
- 	psb->trans_max_pages = 100;
- 
-diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/pohmelfs/mcache.c	2010-04-04 20:46:41.625742858 -0400
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
- 	m->data = data;
- 	m->start = start;
- 	m->size = size;
--	m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
- 
- 	mutex_lock(&psb->mcache_lock);
- 	err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/pohmelfs/netfs.h	2010-04-04 20:46:41.625742858 -0400
-@@ -570,7 +570,7 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- 	struct rb_root		mcache_root;
- 	struct mutex		mcache_lock;
--	atomic_long_t		mcache_gen;
-+	atomic_long_unchecked_t	mcache_gen;
- 	unsigned long		mcache_timeout;
- 
- 	unsigned int		idx;
-diff -urNp linux-2.6.32.12/drivers/staging/sep/sep_driver.c linux-2.6.32.12/drivers/staging/sep/sep_driver.c
---- linux-2.6.32.12/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/sep/sep_driver.c	2010-04-04 20:46:41.625742858 -0400
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
- static dev_t sep_devno;
- 
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- 	.owner = THIS_MODULE,
- 	.ioctl = sep_ioctl,
- 	.poll = sep_poll,
-diff -urNp linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/staging/vme/devices/vme_user.c	2010-04-04 20:46:41.625742858 -0400
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
- 
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
-         .open = vme_user_open,
-         .release = vme_user_release,
-         .read = vme_user_read,
-diff -urNp linux-2.6.32.12/drivers/uio/uio.c linux-2.6.32.12/drivers/uio/uio.c
---- linux-2.6.32.12/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/uio/uio.c	2010-04-04 20:46:41.625742858 -0400
-@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
- 	return entry->show(mem, buf);
- }
- 
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- 	.show = map_type_show,
- };
- 
-@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
- 	return entry->show(port, buf);
- }
- 
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- 	.show = portio_type_show,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/usb/atm/usbatm.c linux-2.6.32.12/drivers/usb/atm/usbatm.c
---- linux-2.6.32.12/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/atm/usbatm.c	2010-04-04 20:46:41.625742858 -0400
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
- 		if (printk_ratelimit())
- 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- 				__func__, vpi, vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 		return;
- 	}
- 
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
- 		if (length > ATM_MAX_AAL5_PDU) {
- 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- 				  __func__, length, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
- 		if (sarb->len < pdu_length) {
- 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- 				  __func__, pdu_length, sarb->len, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
- 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- 				  __func__, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
- 			if (printk_ratelimit())
- 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- 					__func__, length);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto out;
- 		}
- 
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
- 
- 		vcc->push(vcc, skb);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	out:
- 		skb_trim(sarb, 0);
- 	}
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
- 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
- 
- 			usbatm_pop(vcc, skb);
--			atomic_inc(&vcc->stats->tx);
-+			atomic_inc_unchecked(&vcc->stats->tx);
- 
- 			skb = skb_dequeue(&instance->sndqueue);
- 		}
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
- 	if (!left--)
- 		return sprintf(page,
- 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
--			       atomic_read(&atm_dev->stats.aal5.tx),
--			       atomic_read(&atm_dev->stats.aal5.tx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx),
--			       atomic_read(&atm_dev->stats.aal5.rx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx_drop));
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
- 
- 	if (!left--) {
- 		if (instance->disconnected)
-diff -urNp linux-2.6.32.12/drivers/usb/class/cdc-acm.c linux-2.6.32.12/drivers/usb/class/cdc-acm.c
---- linux-2.6.32.12/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:38.389083173 -0400
-+++ linux-2.6.32.12/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:58.429105010 -0400
-@@ -1535,7 +1535,7 @@ static struct usb_device_id acm_ids[] = 
- 		USB_CDC_ACM_PROTO_AT_CDMA) },
- 
- 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(usb, acm_ids);
-diff -urNp linux-2.6.32.12/drivers/usb/class/usblp.c linux-2.6.32.12/drivers/usb/class/usblp.c
---- linux-2.6.32.12/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/class/usblp.c	2010-04-04 20:46:41.625742858 -0400
-@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
- 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
- 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
- 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
--	{ 0, 0 }
-+	{ 0, 0, 0 }
- };
- 
- static int usblp_wwait(struct usblp *usblp, int nonblock);
-@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
- 	{ USB_INTERFACE_INFO(7, 1, 2) },
- 	{ USB_INTERFACE_INFO(7, 1, 3) },
- 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
--	{ }						/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, usblp_ids);
-diff -urNp linux-2.6.32.12/drivers/usb/core/hcd.c linux-2.6.32.12/drivers/usb/core/hcd.c
---- linux-2.6.32.12/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/core/hcd.c	2010-04-04 20:46:41.625742858 -0400
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
- 
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
- 
- /*
-  * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
-  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
-  */
-  
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
- 
- 	if (mon_ops)
-diff -urNp linux-2.6.32.12/drivers/usb/core/hcd.h linux-2.6.32.12/drivers/usb/core/hcd.h
---- linux-2.6.32.12/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/core/hcd.h	2010-04-04 20:46:41.625742858 -0400
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
- struct usb_mon_operations {
--	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
--	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
--	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
- 
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
- 
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
- 		(*mon_ops->urb_complete)(bus, urb, status);
- }
- 
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
- 
- #else
-diff -urNp linux-2.6.32.12/drivers/usb/core/hub.c linux-2.6.32.12/drivers/usb/core/hub.c
---- linux-2.6.32.12/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/core/hub.c	2010-04-04 20:46:41.625742858 -0400
-@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
-       .bDeviceClass = USB_CLASS_HUB},
-     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
-       .bInterfaceClass = USB_CLASS_HUB},
--    { }						/* Terminating entry */
-+    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, hub_id_table);
-diff -urNp linux-2.6.32.12/drivers/usb/core/message.c linux-2.6.32.12/drivers/usb/core/message.c
---- linux-2.6.32.12/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/core/message.c	2010-04-04 20:46:41.629706570 -0400
-@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
- 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
- 	if (buf) {
- 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
--		if (len > 0) {
--			smallbuf = kmalloc(++len, GFP_NOIO);
-+		if (len++ > 0) {
-+			smallbuf = kmalloc(len, GFP_NOIO);
- 			if (!smallbuf)
- 				return buf;
- 			memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.32.12/drivers/usb/host/ehci-pci.c linux-2.6.32.12/drivers/usb/host/ehci-pci.c
---- linux-2.6.32.12/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/host/ehci-pci.c	2010-04-04 20:46:41.629706570 -0400
-@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
- 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
- 	},
--	{ /* end: all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, pci_ids);
- 
-diff -urNp linux-2.6.32.12/drivers/usb/host/uhci-hcd.c linux-2.6.32.12/drivers/usb/host/uhci-hcd.c
---- linux-2.6.32.12/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/host/uhci-hcd.c	2010-04-04 20:46:41.629706570 -0400
-@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
- 	/* handle any USB UHCI controller */
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
- 	.driver_data =	(unsigned long) &uhci_driver,
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
-diff -urNp linux-2.6.32.12/drivers/usb/misc/appledisplay.c linux-2.6.32.12/drivers/usb/misc/appledisplay.c
---- linux-2.6.32.12/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/misc/appledisplay.c	2010-04-04 20:46:41.629706570 -0400
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
- 		return pdata->msgdata[1];
- }
- 
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- 	.get_brightness	= appledisplay_bl_get_brightness,
- 	.update_status	= appledisplay_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/usb/mon/mon_main.c linux-2.6.32.12/drivers/usb/mon/mon_main.c
---- linux-2.6.32.12/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/mon/mon_main.c	2010-04-04 20:46:41.629706570 -0400
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
-  * Ops
-  */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- 	.urb_submit =	mon_submit,
- 	.urb_submit_error = mon_submit_error,
- 	.urb_complete =	mon_complete,
-diff -urNp linux-2.6.32.12/drivers/usb/storage/debug.h linux-2.6.32.12/drivers/usb/storage/debug.h
---- linux-2.6.32.12/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/storage/debug.h	2010-04-04 20:46:41.629706570 -0400
-@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
- #define US_DEBUGPX(x...) printk( x )
- #define US_DEBUG(x) x 
- #else
--#define US_DEBUGP(x...)
--#define US_DEBUGPX(x...)
--#define US_DEBUG(x)
-+#define US_DEBUGP(x...) do {} while (0)
-+#define US_DEBUGPX(x...) do {} while (0)
-+#define US_DEBUG(x) do {} while (0)
- #endif
- 
- #endif
-diff -urNp linux-2.6.32.12/drivers/usb/storage/usb.c linux-2.6.32.12/drivers/usb/storage/usb.c
---- linux-2.6.32.12/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/storage/usb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
- 
- static struct us_unusual_dev us_unusual_dev_list[] = {
- #	include "unusual_devs.h" 
--	{ }		/* Terminating entry */
-+	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
- };
- 
- #undef UNUSUAL_DEV
-diff -urNp linux-2.6.32.12/drivers/usb/storage/usual-tables.c linux-2.6.32.12/drivers/usb/storage/usual-tables.c
---- linux-2.6.32.12/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/usb/storage/usual-tables.c	2010-04-04 20:46:41.629706570 -0400
-@@ -48,7 +48,7 @@
- 
- struct usb_device_id usb_storage_usb_ids[] = {
- #	include "unusual_devs.h"
--	{ }		/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
- 
-diff -urNp linux-2.6.32.12/drivers/uwb/wlp/messages.c linux-2.6.32.12/drivers/uwb/wlp/messages.c
---- linux-2.6.32.12/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/uwb/wlp/messages.c	2010-04-04 20:46:41.629706570 -0400
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
- 	size_t len = skb->len;
- 	size_t used;
- 	ssize_t result;
--	struct wlp_nonce enonce, rnonce;
-+	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- 	enum wlp_assc_error assc_err;
- 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff -urNp linux-2.6.32.12/drivers/uwb/wlp/sysfs.c linux-2.6.32.12/drivers/uwb/wlp/sysfs.c
---- linux-2.6.32.12/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/uwb/wlp/sysfs.c	2010-04-04 20:46:41.629706570 -0400
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
- 	return ret;
- }
- 
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- 	.show	= wlp_wss_attr_show,
- 	.store	= wlp_wss_attr_store,
- };
-diff -urNp linux-2.6.32.12/drivers/video/atmel_lcdfb.c linux-2.6.32.12/drivers/video/atmel_lcdfb.c
---- linux-2.6.32.12/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/atmel_lcdfb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
- 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
- 
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- 	.update_status = atmel_bl_update_status,
- 	.get_brightness = atmel_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/video/aty/aty128fb.c linux-2.6.32.12/drivers/video/aty/aty128fb.c
---- linux-2.6.32.12/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/aty/aty128fb.c	2010-04-04 20:46:41.629706570 -0400
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- 	.get_brightness	= aty128_bl_get_brightness,
- 	.update_status	= aty128_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/aty/atyfb_base.c linux-2.6.32.12/drivers/video/aty/atyfb_base.c
---- linux-2.6.32.12/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/aty/atyfb_base.c	2010-04-04 20:46:41.629706570 -0400
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- 	.get_brightness = aty_bl_get_brightness,
- 	.update_status	= aty_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/aty/radeon_backlight.c linux-2.6.32.12/drivers/video/aty/radeon_backlight.c
---- linux-2.6.32.12/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/aty/radeon_backlight.c	2010-04-04 20:46:41.629706570 -0400
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- 	.get_brightness = radeon_bl_get_brightness,
- 	.update_status	= radeon_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c
---- linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/adp5520_bl.c	2010-04-04 20:46:41.629706570 -0400
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
- 	return error ? data->current_brightness : reg_val;
- }
- 
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- 	.update_status	= adp5520_bl_update_status,
- 	.get_brightness	= adp5520_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/adx_bl.c linux-2.6.32.12/drivers/video/backlight/adx_bl.c
---- linux-2.6.32.12/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/adx_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
- 	return 1;
- }
- 
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- 	.options = 0,
- 	.update_status = adx_backlight_update_status,
- 	.get_brightness = adx_backlight_get_brightness,
-diff -urNp linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c
---- linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/atmel-pwm-bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
- 	return pwm_channel_enable(&pwmbl->pwmc);
- }
- 
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- 	.get_brightness = atmel_pwm_bl_get_intensity,
- 	.update_status  = atmel_pwm_bl_set_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/backlight.c linux-2.6.32.12/drivers/video/backlight/backlight.c
---- linux-2.6.32.12/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/backlight.c	2010-04-04 20:46:41.633638271 -0400
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
-  * ERR_PTR() or a pointer to the newly allocated device.
-  */
- struct backlight_device *backlight_device_register(const char *name,
--		struct device *parent, void *devdata, struct backlight_ops *ops)
-+		struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- 	struct backlight_device *new_bd;
- 	int rc;
-diff -urNp linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c
---- linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/corgi_lcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
- 
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- 	.get_brightness	= corgi_bl_get_intensity,
- 	.update_status  = corgi_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c
---- linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/cr_bllcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
- 	return intensity;
- }
- 
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- 	.get_brightness = cr_backlight_get_intensity,
- 	.update_status = cr_backlight_set_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/da903x_bl.c linux-2.6.32.12/drivers/video/backlight/da903x_bl.c
---- linux-2.6.32.12/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/da903x_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- 	.update_status	= da903x_backlight_update_status,
- 	.get_brightness	= da903x_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/generic_bl.c linux-2.6.32.12/drivers/video/backlight/generic_bl.c
---- linux-2.6.32.12/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/generic_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
- 
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.get_brightness = genericbl_get_intensity,
- 	.update_status  = genericbl_send_intensity,
-diff -urNp linux-2.6.32.12/drivers/video/backlight/hp680_bl.c linux-2.6.32.12/drivers/video/backlight/hp680_bl.c
---- linux-2.6.32.12/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/hp680_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
- 	return current_intensity;
- }
- 
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- 	.get_brightness = hp680bl_get_intensity,
- 	.update_status  = hp680bl_set_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c
---- linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/jornada720_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -93,7 +93,7 @@ out:
- 	return ret;
- }
- 
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- 	.get_brightness = jornada_bl_get_brightness,
- 	.update_status = jornada_bl_update_status,
- 	.options = BL_CORE_SUSPENDRESUME,
-diff -urNp linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c
---- linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/kb3886_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
- 	return kb3886bl_intensity;
- }
- 
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- 	.get_brightness = kb3886bl_get_intensity,
- 	.update_status  = kb3886bl_send_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/locomolcd.c linux-2.6.32.12/drivers/video/backlight/locomolcd.c
---- linux-2.6.32.12/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/locomolcd.c	2010-04-04 20:46:41.633638271 -0400
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
- 	return current_intensity;
- }
- 
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- 	.get_brightness = locomolcd_get_intensity,
- 	.update_status  = locomolcd_set_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c
---- linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:38.397382140 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:58.433026851 -0400
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- 	unsigned long iostart;
- 	unsigned long iolen;
- 	/* Backlight operations structure. */
--	struct backlight_ops backlight_ops;
-+	const struct backlight_ops backlight_ops;
- };
- 
- /* Module parameters. */
-diff -urNp linux-2.6.32.12/drivers/video/backlight/omap1_bl.c linux-2.6.32.12/drivers/video/backlight/omap1_bl.c
---- linux-2.6.32.12/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/omap1_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
- 	return bl->current_intensity;
- }
- 
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- 	.get_brightness = omapbl_get_intensity,
- 	.update_status  = omapbl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/progear_bl.c linux-2.6.32.12/drivers/video/backlight/progear_bl.c
---- linux-2.6.32.12/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/progear_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
- 	return intensity - HW_LEVEL_MIN;
- }
- 
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- 	.get_brightness = progearbl_get_intensity,
- 	.update_status = progearbl_set_intensity,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/pwm_bl.c linux-2.6.32.12/drivers/video/backlight/pwm_bl.c
---- linux-2.6.32.12/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/pwm_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
- 	return bl->props.brightness;
- }
- 
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- 	.update_status	= pwm_backlight_update_status,
- 	.get_brightness	= pwm_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/tosa_bl.c linux-2.6.32.12/drivers/video/backlight/tosa_bl.c
---- linux-2.6.32.12/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/tosa_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
- 	return props->brightness;
- }
- 
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- 	.get_brightness		= tosa_bl_get_brightness,
- 	.update_status		= tosa_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c
---- linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/backlight/wm831x_bl.c	2010-04-04 20:46:41.633638271 -0400
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.update_status	= wm831x_backlight_update_status,
- 	.get_brightness	= wm831x_backlight_get_brightness,
-diff -urNp linux-2.6.32.12/drivers/video/bf54x-lq043fb.c linux-2.6.32.12/drivers/video/bf54x-lq043fb.c
---- linux-2.6.32.12/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/bf54x-lq043fb.c	2010-04-04 20:46:41.633638271 -0400
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c
---- linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/bfin-t350mcqb-fb.c	2010-04-04 20:46:41.633638271 -0400
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.12/drivers/video/fbcmap.c linux-2.6.32.12/drivers/video/fbcmap.c
---- linux-2.6.32.12/drivers/video/fbcmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/fbcmap.c	2010-04-29 17:46:37.213234717 -0400
-@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
- 		rc = -ENODEV;
- 		goto out;
- 	}
--	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
--				!info->fbops->fb_setcmap)) {
-+	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
- 		rc = -EINVAL;
- 		goto out1;
- 	}
-diff -urNp linux-2.6.32.12/drivers/video/fbmem.c linux-2.6.32.12/drivers/video/fbmem.c
---- linux-2.6.32.12/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/fbmem.c	2010-04-04 20:46:41.633638271 -0400
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dx += image->width + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_UD) {
--		for (x = 0; x < num && image->dx >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dx -= image->width + 8;
- 		}
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dy += image->height + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_CCW) {
--		for (x = 0; x < num && image->dy >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dy -= image->height + 8;
- 		}
-@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
- 			return -EFAULT;
- 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- 			return -EINVAL;
--		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+		if (con2fb.framebuffer >= FB_MAX)
- 			return -EINVAL;
- 		if (!registered_fb[con2fb.framebuffer])
- 			request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.32.12/drivers/video/fbmon.c linux-2.6.32.12/drivers/video/fbmon.c
---- linux-2.6.32.12/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/fbmon.c	2010-04-04 20:46:41.633638271 -0400
-@@ -45,7 +45,7 @@
- #ifdef DEBUG
- #define DPRINTK(fmt, args...) printk(fmt,## args)
- #else
--#define DPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
- #endif
- 
- #define FBMON_FIX_HEADER  1
-diff -urNp linux-2.6.32.12/drivers/video/i810/i810_accel.c linux-2.6.32.12/drivers/video/i810/i810_accel.c
---- linux-2.6.32.12/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/i810/i810_accel.c	2010-04-04 20:46:41.633638271 -0400
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
- 		}
- 	}
- 	printk("ringbuffer lockup!!!\n");
-+	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- 	i810_report_error(mmio); 
- 	par->dev_flags |= LOCKUP;
- 	info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.32.12/drivers/video/i810/i810_main.c linux-2.6.32.12/drivers/video/i810/i810_main.c
---- linux-2.6.32.12/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/i810/i810_main.c	2010-04-04 20:46:41.633638271 -0400
-@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
- 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- static struct pci_driver i810fb_driver = {
-diff -urNp linux-2.6.32.12/drivers/video/modedb.c linux-2.6.32.12/drivers/video/modedb.c
---- linux-2.6.32.12/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/modedb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
-     {
- 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
- 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
- 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
- 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
- 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
- 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
--	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
- 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
- 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
- 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
- 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
- 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
- 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
- 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
- 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
- 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
- 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
- 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
- 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
- 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
- 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
--	0, FB_VMODE_NONINTERLACED   	
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
- 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
-         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
- 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
- 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
- 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
- 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
- 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
- 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
- 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
- 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
- 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
- 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
- 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
- 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
- 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
- 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
- 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
- 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
- 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
- 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
- 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
- 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
- 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
- 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
- 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
- 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
- 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
- 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--	FB_VMODE_NONINTERLACED
-+	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
- 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
- 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-    }, {
- 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
- 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     },
- };
- 
-diff -urNp linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c
---- linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/nvidia/nv_backlight.c	2010-04-04 20:46:41.637780128 -0400
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- 	.get_brightness = nvidia_bl_get_brightness,
- 	.update_status	= nvidia_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/riva/fbdev.c linux-2.6.32.12/drivers/video/riva/fbdev.c
---- linux-2.6.32.12/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/riva/fbdev.c	2010-04-04 20:46:41.637780128 -0400
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- 	.get_brightness = riva_bl_get_brightness,
- 	.update_status	= riva_bl_update_status,
- };
-diff -urNp linux-2.6.32.12/drivers/video/uvesafb.c linux-2.6.32.12/drivers/video/uvesafb.c
---- linux-2.6.32.12/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/uvesafb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- 		NULL,
- 	};
- 
--	return call_usermodehelper(v86d_path, argv, envp, 1);
-+	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
- 
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
- 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- 		par->pmi_setpal = par->ypan = 0;
- 	} else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+		if (!par->pmi_code) {
-+			par->pmi_setpal = par->ypan = 0;
-+			return 0;
-+		}
-+#endif
-+
- 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- 						+ task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+		pax_close_kernel();
-+
-+		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- 		printk(KERN_INFO "uvesafb: protected mode interface info at "
- 				 "%04x:%04x\n",
- 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1799,6 +1822,11 @@ out:
- 	if (par->vbe_modes)
- 		kfree(par->vbe_modes);
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	if (par->pmi_code)
-+		module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 	framebuffer_release(info);
- 	return err;
- }
-@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
- 				kfree(par->vbe_state_orig);
- 			if (par->vbe_state_saved)
- 				kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+			if (par->pmi_code)
-+				module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 		}
- 
- 		framebuffer_release(info);
-diff -urNp linux-2.6.32.12/drivers/video/vesafb.c linux-2.6.32.12/drivers/video/vesafb.c
---- linux-2.6.32.12/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/video/vesafb.c	2010-04-04 20:46:41.637780128 -0400
-@@ -9,6 +9,7 @@
-  */
- 
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
- static int   vram_total __initdata;		/* Set total amount of memory */
- static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
- static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
--static void  (*pmi_start)(void) __read_mostly;
--static void  (*pmi_pal)  (void) __read_mostly;
-+static void  (*pmi_start)(void) __read_only;
-+static void  (*pmi_pal)  (void) __read_only;
- static int   depth      __read_mostly;
- static int   vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
- 	unsigned int size_vmode;
- 	unsigned int size_remap;
- 	unsigned int size_total;
-+	void *pmi_code = NULL;
- 
- 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- 		return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
- 		size_remap = size_total;
- 	vesafb_fix.smem_len = size_remap;
- 
--#ifndef __i386__
--	screen_info.vesapm_seg = 0;
--#endif
--
- 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- 		printk(KERN_WARNING
- 		       "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
- 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
- 
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+	if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+	if (0)
-+#endif
-+
-+#endif
-+	screen_info.vesapm_seg = 0;
-+
- 	if (screen_info.vesapm_seg) {
--		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
--		       screen_info.vesapm_seg,screen_info.vesapm_off);
-+		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- 	}
- 
- 	if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
- 
- 	if (ypan || pmi_setpal) {
- 		unsigned short *pmi_base;
--		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
--		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
--		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+		pmi_code = pmi_base;
-+#endif
-+
-+		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pmi_start = ktva_ktla(pmi_start);
-+		pmi_pal = ktva_ktla(pmi_pal);
-+		pax_close_kernel();
-+#endif
-+
- 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- 		if (pmi_base[3]) {
- 			printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
- 	       info->node, info->fix.id);
- 	return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	module_free_exec(NULL, pmi_code);
-+#endif
-+
- 	if (info->screen_base)
- 		iounmap(info->screen_base);
- 	framebuffer_release(info);
-diff -urNp linux-2.6.32.12/drivers/xen/sys-hypervisor.c linux-2.6.32.12/drivers/xen/sys-hypervisor.c
---- linux-2.6.32.12/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/drivers/xen/sys-hypervisor.c	2010-04-04 20:46:41.637780128 -0400
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
- 	return 0;
- }
- 
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- 	.show = hyp_sysfs_show,
- 	.store = hyp_sysfs_store,
- };
-diff -urNp linux-2.6.32.12/fs/9p/vfs_inode.c linux-2.6.32.12/fs/9p/vfs_inode.c
---- linux-2.6.32.12/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/9p/vfs_inode.c	2010-04-04 20:46:41.637780128 -0400
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 
- 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- 		IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.32.12/fs/aio.c linux-2.6.32.12/fs/aio.c
---- linux-2.6.32.12/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/aio.c	2010-04-04 20:46:41.637780128 -0400
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
- 	size += sizeof(struct io_event) * nr_events;
- 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
- 
--	if (nr_pages < 0)
-+	if (nr_pages <= 0)
- 		return -EINVAL;
- 
- 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-diff -urNp linux-2.6.32.12/fs/attr.c linux-2.6.32.12/fs/attr.c
---- linux-2.6.32.12/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/attr.c	2010-04-04 20:46:41.637780128 -0400
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
- 		unsigned long limit;
- 
- 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- 		if (limit != RLIM_INFINITY && offset > limit)
- 			goto out_sig;
- 		if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.32.12/fs/autofs/root.c linux-2.6.32.12/fs/autofs/root.c
---- linux-2.6.32.12/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/autofs/root.c	2010-04-04 20:46:41.637780128 -0400
-@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
- 	set_bit(n,sbi->symlink_bitmap);
- 	sl = &sbi->symlink[n];
- 	sl->len = strlen(symname);
--	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
-+	slsize = sl->len+1;
-+	sl->data = kmalloc(slsize, GFP_KERNEL);
- 	if (!sl->data) {
- 		clear_bit(n,sbi->symlink_bitmap);
- 		unlock_kernel();
-diff -urNp linux-2.6.32.12/fs/autofs4/symlink.c linux-2.6.32.12/fs/autofs4/symlink.c
---- linux-2.6.32.12/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/autofs4/symlink.c	2010-04-04 20:46:41.637780128 -0400
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
--	nd_set_link(nd, (char *)ino->u.symlink);
-+	nd_set_link(nd, ino->u.symlink);
- 	return NULL;
- }
- 
-diff -urNp linux-2.6.32.12/fs/befs/linuxvfs.c linux-2.6.32.12/fs/befs/linuxvfs.c
---- linux-2.6.32.12/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/befs/linuxvfs.c	2010-04-04 20:46:41.637780128 -0400
-@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
- {
- 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
--		char *link = nd_get_link(nd);
-+		const char *link = nd_get_link(nd);
- 		if (!IS_ERR(link))
- 			kfree(link);
- 	}
-diff -urNp linux-2.6.32.12/fs/binfmt_aout.c linux-2.6.32.12/fs/binfmt_aout.c
---- linux-2.6.32.12/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/binfmt_aout.c	2010-04-04 20:46:41.637780128 -0400
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
- 
- /* If the size of the dump file exceeds the rlimit, then see what would happen
-    if we wrote the stack, but not the data area.  */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- 		dump.u_dsize = 0;
- 
- /* Make sure we have enough room to write the stack and data areas. */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- 		dump.u_ssize = 0;
- 
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- 	if (rlim >= RLIM_INFINITY)
- 		rlim = ~0;
-+
-+	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- 	if (ex.a_data + ex.a_bss > rlim)
- 		return -ENOMEM;
- 
-@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
- 	install_exec_creds(bprm);
-  	current->flags &= ~PF_FORKNOEXEC;
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+			current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+	}
-+#endif
-+
- 	if (N_MAGIC(ex) == OMAGIC) {
- 		unsigned long text_addr, map_size;
- 		loff_t pos;
-@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
- 
- 		down_write(&current->mm->mmap_sem);
-  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
--				PROT_READ | PROT_WRITE | PROT_EXEC,
-+				PROT_READ | PROT_WRITE,
- 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- 				fd_offset + ex.a_text);
- 		up_write(&current->mm->mmap_sem);
-diff -urNp linux-2.6.32.12/fs/binfmt_elf.c linux-2.6.32.12/fs/binfmt_elf.c
---- linux-2.6.32.12/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/binfmt_elf.c	2010-04-04 20:47:28.956670452 -0400
-@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
- #define elf_core_dump	NULL
- #endif
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
- 		.load_binary	= load_elf_binary,
- 		.load_shlib	= load_elf_library,
- 		.core_dump	= elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		.handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- 		.min_coredump	= ELF_EXEC_PAGESIZE,
- 		.hasvdso	= 1
- };
-@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
- 
- static int set_brk(unsigned long start, unsigned long end)
- {
-+	unsigned long e = end;
-+
- 	start = ELF_PAGEALIGN(start);
- 	end = ELF_PAGEALIGN(end);
- 	if (end > start) {
-@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
- 		if (BAD_ADDR(addr))
- 			return addr;
- 	}
--	current->mm->start_brk = current->mm->brk = end;
-+	current->mm->start_brk = current->mm->brk = e;
- 	return 0;
- }
- 
-@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
- 	elf_addr_t __user *u_rand_bytes;
- 	const char *k_platform = ELF_PLATFORM;
- 	const char *k_base_platform = ELF_BASE_PLATFORM;
--	unsigned char k_rand_bytes[16];
-+	u32 k_rand_bytes[4];
- 	int items;
- 	elf_addr_t *elf_info;
- 	int ei_index = 0;
-@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
- 	 * Generate 16 random bytes for userspace PRNG seeding.
- 	 */
- 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
--	u_rand_bytes = (elf_addr_t __user *)
--		       STACK_ALLOC(p, sizeof(k_rand_bytes));
-+	srandom32(k_rand_bytes[0] ^ random32());
-+	srandom32(k_rand_bytes[1] ^ random32());
-+	srandom32(k_rand_bytes[2] ^ random32());
-+	srandom32(k_rand_bytes[3] ^ random32());
-+	p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+	u_rand_bytes = (elf_addr_t __user *) p;
- 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- 		return -EFAULT;
- 
-@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
- {
- 	struct elf_phdr *elf_phdata;
- 	struct elf_phdr *eppnt;
--	unsigned long load_addr = 0;
-+	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- 	int load_addr_set = 0;
- 	unsigned long last_bss = 0, elf_bss = 0;
--	unsigned long error = ~0UL;
-+	unsigned long error = -EINVAL;
- 	unsigned long total_size;
- 	int retval, i, size;
- 
-@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
- 		goto out_close;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	eppnt = elf_phdata;
- 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- 		if (eppnt->p_type == PT_LOAD) {
-@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
- 			k = load_addr + eppnt->p_vaddr;
- 			if (BAD_ADDR(k) ||
- 			    eppnt->p_filesz > eppnt->p_memsz ||
--			    eppnt->p_memsz > TASK_SIZE ||
--			    TASK_SIZE - eppnt->p_memsz < k) {
-+			    eppnt->p_memsz > pax_task_size ||
-+			    pax_task_size - eppnt->p_memsz < k) {
- 				error = -ENOMEM;
- 				goto out_close;
- 			}
-@@ -532,6 +552,177 @@ out:
- 	return error;
- }
- 
-+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
-+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (elf_phdata->p_flags & PF_PAGEEXEC)
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (elf_phdata->p_flags & PF_SEGMEXEC)
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (elf_phdata->p_flags & PF_EMUTRAMP)
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (elf_phdata->p_flags & PF_MPROTECT)
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	unsigned long i;
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+	pax_flags = pax_parse_ei_pax(elf_ex);
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	for (i = 0UL; i < elf_ex->e_phnum; i++)
-+		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+				return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+			if (pax_softmode)
-+				pax_flags = pax_parse_softmode(&elf_phdata[i]);
-+			else
-+#endif
-+
-+				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
-+			break;
-+		}
-+#endif
-+
-+	if (0 > pax_check_flags(&pax_flags))
-+		return -EINVAL;
-+
-+	current->mm->pax_flags = pax_flags;
-+	return 0;
-+}
-+#endif
-+
- /*
-  * These are the functions used to load ELF style executables and shared
-  * libraries.  There is no binary dependent code anywhere else.
-@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
- {
- 	unsigned int random_variable = 0;
- 
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		return stack_top - current->mm->delta_stack;
-+#endif
-+
- 	if ((current->flags & PF_RANDOMIZE) &&
- 		!(current->personality & ADDR_NO_RANDOMIZE)) {
- 		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
-  	unsigned long load_addr = 0, load_bias = 0;
- 	int load_addr_set = 0;
- 	char * elf_interpreter = NULL;
--	unsigned long error;
-+	unsigned long error = 0;
- 	struct elf_phdr *elf_ppnt, *elf_phdata;
- 	unsigned long elf_bss, elf_brk;
- 	int retval, i;
-@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
- 	unsigned long start_code, end_code, start_data, end_data;
- 	unsigned long reloc_func_desc = 0;
- 	int executable_stack = EXSTACK_DEFAULT;
--	unsigned long def_flags = 0;
- 	struct {
- 		struct elfhdr elf_ex;
- 		struct elfhdr interp_elf_ex;
- 	} *loc;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- 	if (!loc) {
-@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
- 
- 	/* OK, This is the point of no return */
- 	current->flags &= ~PF_FORKNOEXEC;
--	current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	current->mm->delta_mmap = 0UL;
-+	current->mm->delta_stack = 0UL;
-+#endif
-+
-+	current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
-+		send_sig(SIGKILL, current, 0);
-+		goto out_free_dentry;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+	pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+	if (pax_set_initial_flags_func)
-+		(pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+		current->mm->context.user_cs_limit = PAGE_SIZE;
-+		current->mm->def_flags |= VM_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+	}
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+		put_cpu();
-+	}
-+#endif
- 
- 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
- 	   may depend on the personality.  */
- 	SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		executable_stack = EXSTACK_DISABLE_X;
-+		current->personality &= ~READ_IMPLIES_EXEC;
-+	} else
-+#endif
-+
- 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- 		current->personality |= READ_IMPLIES_EXEC;
- 
-@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
- #else
- 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+			/* PaX: randomize base address at the default exe base if requested */
-+			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+				elf_flags |= MAP_FIXED;
-+			}
-+#endif
-+
- 		}
- 
- 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
- 		 * allowed task size. Note that p_filesz must always be
- 		 * <= p_memsz so it is only necessary to check p_memsz.
- 		 */
--		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
--		    elf_ppnt->p_memsz > TASK_SIZE ||
--		    TASK_SIZE - elf_ppnt->p_memsz < k) {
-+		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+		    elf_ppnt->p_memsz > pax_task_size ||
-+		    pax_task_size - elf_ppnt->p_memsz < k) {
- 			/* set_brk can never work. Avoid overflows. */
- 			send_sig(SIGKILL, current, 0);
- 			retval = -EINVAL;
-@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
- 	start_data += load_bias;
- 	end_data += load_bias;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
-+#endif
-+
- 	/* Calling set_brk effectively mmaps the pages that we need
- 	 * for the bss and break sections.  We must do this before
- 	 * mapping in the interpreter, to make sure it doesn't wind
-@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
- 		goto out_free_dentry;
- 	}
- 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
--		send_sig(SIGSEGV, current, 0);
--		retval = -EFAULT; /* Nobody gets to see this, but.. */
--		goto out_free_dentry;
-+		/*
-+		 * This bss-zeroing can fail if the ELF
-+		 * file specifies odd protections. So
-+		 * we don't check the return value
-+		 */
- 	}
- 
- 	if (elf_interpreter) {
-@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
- 			unsigned long n = off;
- 			if (n > PAGE_SIZE)
- 				n = PAGE_SIZE;
--			if (!dump_write(file, buf, n))
-+			if (!dump_write(file, buf, n)) {
-+				free_page((unsigned long)buf);
- 				return 0;
-+			}
- 			off -= n;
- 		}
- 		free_page((unsigned long)buf);
-@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
-  * Decide what to dump of a segment, part, all or none.
-  */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
--				   unsigned long mm_flags)
-+				   unsigned long mm_flags, long signr)
- {
- #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
- 
-@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
- 	if (vma->vm_file == NULL)
- 		return 0;
- 
--	if (FILTER(MAPPED_PRIVATE))
-+	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- 		goto whole;
- 
- 	/*
-@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
- #undef DUMP_WRITE
- 
- #define DUMP_WRITE(addr, nr)	\
-+	do { \
-+	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
--		goto end_coredump;
-+		goto end_coredump; \
-+	} while (0);
- 
- static void fill_elf_header(struct elfhdr *elf, int segs,
- 			    u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
- {
- 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- 	int i = 0;
--	do
-+	do {
- 		i += 2;
--	while (auxv[i - 2] != AT_NULL);
-+	} while (auxv[i - 2] != AT_NULL);
- 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
- 
-@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
- 		phdr.p_offset = offset;
- 		phdr.p_vaddr = vma->vm_start;
- 		phdr.p_paddr = 0;
--		phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- 		phdr.p_memsz = vma->vm_end - vma->vm_start;
- 		offset += phdr.p_filesz;
- 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
- 		unsigned long addr;
- 		unsigned long end;
- 
--		end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
- 
- 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- 			struct page *page;
-@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
- 			page = get_dump_page(addr);
- 			if (page) {
- 				void *kaddr = kmap(page);
-+				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- 				stop = ((size += PAGE_SIZE) > limit) ||
- 					!dump_write(file, kaddr, PAGE_SIZE);
- 				kunmap(page);
-@@ -2042,6 +2334,97 @@ out:
- 
- #endif		/* USE_ELF_CORE_DUMP */
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+	struct elfhdr elf_h;
-+	struct elf_phdr elf_p;
-+	unsigned long i;
-+	unsigned long oldflags;
-+	bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+		return;
-+
-+	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_NOELFRELOCS
-+	is_textrel_rw = false;
-+	is_textrel_rx = false;
-+#else
-+	/* possible TEXTREL */
-+	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#endif
-+
-+	/* possible RELRO */
-+	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+		return;
-+
-+	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+	    !elf_check_arch(&elf_h) ||
-+	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+		return;
-+
-+	for (i = 0UL; i < elf_h.e_phnum; i++) {
-+		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+			return;
-+		switch (elf_p.p_type) {
-+		case PT_DYNAMIC:
-+			if (!is_textrel_rw && !is_textrel_rx)
-+				continue;
-+			i = 0UL;
-+			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+				elf_dyn dyn;
-+
-+				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+					return;
-+				if (dyn.d_tag == DT_NULL)
-+					return;
-+				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+					gr_log_textrel(vma);
-+					if (is_textrel_rw)
-+						vma->vm_flags |= VM_MAYWRITE;
-+					else
-+						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+						vma->vm_flags &= ~VM_MAYWRITE;
-+					return;
-+				}
-+				i++;
-+			}
-+			return;
-+
-+		case PT_GNU_RELRO:
-+			if (!is_relro)
-+				continue;
-+			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+				vma->vm_flags &= ~VM_MAYWRITE;
-+			return;
-+		}
-+	}
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- 	return register_binfmt(&elf_format);
-diff -urNp linux-2.6.32.12/fs/binfmt_flat.c linux-2.6.32.12/fs/binfmt_flat.c
---- linux-2.6.32.12/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/binfmt_flat.c	2010-04-04 20:46:41.641560293 -0400
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
- 				realdatastart = (unsigned long) -ENOMEM;
- 			printk("Unable to allocate RAM for process data, errno %d\n",
- 					(int)-realdatastart);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
-+			up_write(&current->mm->mmap_sem);
- 			ret = realdatastart;
- 			goto err;
- 		}
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read data+bss, errno %d\n", (int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
- 			do_munmap(current->mm, realdatastart, data_len + extra);
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len + data_len + extra +
- 				MAX_SHARED_LIBS * sizeof(unsigned long));
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-diff -urNp linux-2.6.32.12/fs/binfmt_misc.c linux-2.6.32.12/fs/binfmt_misc.c
---- linux-2.6.32.12/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/binfmt_misc.c	2010-04-04 20:46:41.641560293 -0400
-@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
- 	static struct tree_descr bm_files[] = {
- 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
- 		[3] = {"register", &bm_register_operations, S_IWUSR},
--		/* last one */ {""}
-+		/* last one */ {"", NULL, 0}
- 	};
- 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
- 	if (!err)
-diff -urNp linux-2.6.32.12/fs/bio.c linux-2.6.32.12/fs/bio.c
---- linux-2.6.32.12/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/bio.c	2010-04-04 20:46:41.641560293 -0400
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
- 
- 	i = 0;
- 	while (i < bio_slab_nr) {
--		struct bio_slab *bslab = &bio_slabs[i];
-+		bslab = &bio_slabs[i];
- 
- 		if (!bslab->slab && entry == -1)
- 			entry = i;
-@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
- 	const int read = bio_data_dir(bio) == READ;
- 	struct bio_map_data *bmd = bio->bi_private;
- 	int i;
--	char *p = bmd->sgvecs[0].iov_base;
-+	char *p = (__force char *)bmd->sgvecs[0].iov_base;
- 
- 	__bio_for_each_segment(bvec, bio, i, 0) {
- 		char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.32.12/fs/block_dev.c linux-2.6.32.12/fs/block_dev.c
---- linux-2.6.32.12/fs/block_dev.c	2010-04-29 17:49:38.421500081 -0400
-+++ linux-2.6.32.12/fs/block_dev.c	2010-04-29 17:49:58.449523678 -0400
-@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, 
- 	else if (bdev->bd_contains == bdev)
- 		res = 0;  	 /* is a whole device which isn't held */
- 
--	else if (bdev->bd_contains->bd_holder == bd_claim)
-+	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
- 		res = 0; 	 /* is a partition of a device that is being partitioned */
- 	else if (bdev->bd_contains->bd_holder != NULL)
- 		res = -EBUSY;	 /* is a partition of a held device */
-diff -urNp linux-2.6.32.12/fs/btrfs/ctree.c linux-2.6.32.12/fs/btrfs/ctree.c
---- linux-2.6.32.12/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/ctree.c	2010-04-04 20:46:41.641560293 -0400
-@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
- 
- 	ret = 0;
- 	if (slot == 0) {
--		struct btrfs_disk_key disk_key;
- 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- 	}
-diff -urNp linux-2.6.32.12/fs/btrfs/disk-io.c linux-2.6.32.12/fs/btrfs/disk-io.c
---- linux-2.6.32.12/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/disk-io.c	2010-04-04 20:46:41.641560293 -0400
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
- 
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
- 
-@@ -2585,7 +2585,7 @@ out:
- 	return 0;
- }
- 
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- 	.write_cache_pages_lock_hook = btree_lock_page_hook,
- 	.readpage_end_io_hook = btree_readpage_end_io_hook,
- 	.submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.32.12/fs/btrfs/extent_io.h linux-2.6.32.12/fs/btrfs/extent_io.h
---- linux-2.6.32.12/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/extent_io.h	2010-04-04 20:46:41.641560293 -0400
-@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
- 				       struct bio *bio, int mirror_num,
- 				       unsigned long bio_flags);
- struct extent_io_ops {
--	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- 			     u64 start, u64 end, int *page_started,
- 			     unsigned long *nr_written);
--	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
--	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- 	extent_submit_bio_hook_t *submit_bio_hook;
--	int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- 			      size_t size, struct bio *bio,
- 			      unsigned long bio_flags);
--	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
--	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- 				       u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- 					u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				    struct extent_state *state);
--	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				      struct extent_state *state, int uptodate);
--	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- 			    unsigned long old, unsigned long bits);
--	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- 			      unsigned long bits);
--	int (*merge_extent_hook)(struct inode *inode,
-+	int (* const merge_extent_hook)(struct inode *inode,
- 				 struct extent_state *new,
- 				 struct extent_state *other);
--	int (*split_extent_hook)(struct inode *inode,
-+	int (* const split_extent_hook)(struct inode *inode,
- 				 struct extent_state *orig, u64 split);
--	int (*write_cache_pages_lock_hook)(struct page *page);
-+	int (* const write_cache_pages_lock_hook)(struct page *page);
- };
- 
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- 	u64 dirty_bytes;
- 	spinlock_t lock;
- 	spinlock_t buffer_lock;
--	struct extent_io_ops *ops;
-+	const struct extent_io_ops *ops;
- };
- 
- struct extent_state {
-diff -urNp linux-2.6.32.12/fs/btrfs/free-space-cache.c linux-2.6.32.12/fs/btrfs/free-space-cache.c
---- linux-2.6.32.12/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/free-space-cache.c	2010-04-04 20:46:41.641560293 -0400
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
- 
- 	while(1) {
- 		if (entry->bytes < bytes || entry->offset < min_start) {
--			struct rb_node *node;
--
- 			node = rb_next(&entry->offset_index);
- 			if (!node)
- 				break;
-@@ -1226,7 +1224,7 @@ again:
- 	 */
- 	while (entry->bitmap || found_bitmap ||
- 	       (!entry->bitmap && entry->bytes < min_bytes)) {
--		struct rb_node *node = rb_next(&entry->offset_index);
-+		node = rb_next(&entry->offset_index);
- 
- 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
- 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.32.12/fs/btrfs/inode.c linux-2.6.32.12/fs/btrfs/inode.c
---- linux-2.6.32.12/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/inode.c	2010-04-04 20:46:41.641560293 -0400
-@@ -63,7 +63,7 @@ static const struct inode_operations btr
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
- 
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
- 	.fsync		= btrfs_sync_file,
- };
- 
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- 	.fill_delalloc = run_delalloc_range,
- 	.submit_bio_hook = btrfs_submit_bio_hook,
- 	.merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.32.12/fs/btrfs/sysfs.c linux-2.6.32.12/fs/btrfs/sysfs.c
---- linux-2.6.32.12/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/btrfs/sysfs.c	2010-04-04 20:46:41.641560293 -0400
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
- 	complete(&root->kobj_unregister);
- }
- 
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- 	.show	= btrfs_super_attr_show,
- 	.store	= btrfs_super_attr_store,
- };
- 
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- 	.show	= btrfs_root_attr_show,
- 	.store	= btrfs_root_attr_store,
- };
-diff -urNp linux-2.6.32.12/fs/buffer.c linux-2.6.32.12/fs/buffer.c
---- linux-2.6.32.12/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/buffer.c	2010-04-04 20:46:41.641560293 -0400
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-diff -urNp linux-2.6.32.12/fs/cachefiles/bind.c linux-2.6.32.12/fs/cachefiles/bind.c
---- linux-2.6.32.12/fs/cachefiles/bind.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/cachefiles/bind.c	2010-04-29 17:46:37.245246835 -0400
-@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
- 	       args);
- 
- 	/* start by checking things over */
--	ASSERT(cache->fstop_percent >= 0 &&
--	       cache->fstop_percent < cache->fcull_percent &&
-+	ASSERT(cache->fstop_percent < cache->fcull_percent &&
- 	       cache->fcull_percent < cache->frun_percent &&
- 	       cache->frun_percent  < 100);
- 
--	ASSERT(cache->bstop_percent >= 0 &&
--	       cache->bstop_percent < cache->bcull_percent &&
-+	ASSERT(cache->bstop_percent < cache->bcull_percent &&
- 	       cache->bcull_percent < cache->brun_percent &&
- 	       cache->brun_percent  < 100);
- 
-diff -urNp linux-2.6.32.12/fs/cachefiles/daemon.c linux-2.6.32.12/fs/cachefiles/daemon.c
---- linux-2.6.32.12/fs/cachefiles/daemon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/cachefiles/daemon.c	2010-04-29 17:46:37.253252101 -0400
-@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
- 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
- 		return -EIO;
- 
--	if (datalen < 0 || datalen > PAGE_SIZE - 1)
-+	if (datalen > PAGE_SIZE - 1)
- 		return -EOPNOTSUPP;
- 
- 	/* drag the command string into the kernel so we can parse it */
-@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
- 	if (args[0] != '%' || args[1] != '\0')
- 		return -EINVAL;
- 
--	if (fstop < 0 || fstop >= cache->fcull_percent)
-+	if (fstop >= cache->fcull_percent)
- 		return cachefiles_daemon_range_error(cache, args);
- 
- 	cache->fstop_percent = fstop;
-@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
- 	if (args[0] != '%' || args[1] != '\0')
- 		return -EINVAL;
- 
--	if (bstop < 0 || bstop >= cache->bcull_percent)
-+	if (bstop >= cache->bcull_percent)
- 		return cachefiles_daemon_range_error(cache, args);
- 
- 	cache->bstop_percent = bstop;
-diff -urNp linux-2.6.32.12/fs/cachefiles/rdwr.c linux-2.6.32.12/fs/cachefiles/rdwr.c
---- linux-2.6.32.12/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/cachefiles/rdwr.c	2010-04-04 20:46:41.641560293 -0400
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
- 			old_fs = get_fs();
- 			set_fs(KERNEL_DS);
- 			ret = file->f_op->write(
--				file, (const void __user *) data, len, &pos);
-+				file, (__force const void __user *) data, len, &pos);
- 			set_fs(old_fs);
- 			kunmap(page);
- 			if (ret != len)
-diff -urNp linux-2.6.32.12/fs/cifs/cifs_uniupr.h linux-2.6.32.12/fs/cifs/cifs_uniupr.h
---- linux-2.6.32.12/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/cifs/cifs_uniupr.h	2010-04-04 20:46:41.645781188 -0400
-@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
- 	{0x0490, 0x04cc, UniCaseRangeU0490},
- 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
- 	{0xff40, 0xff5a, UniCaseRangeUff40},
--	{0}
-+	{0, 0, NULL}
- };
- #endif
- 
-diff -urNp linux-2.6.32.12/fs/cifs/link.c linux-2.6.32.12/fs/cifs/link.c
---- linux-2.6.32.12/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/cifs/link.c	2010-04-04 20:46:41.645781188 -0400
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
- 
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
--	char *p = nd_get_link(nd);
-+	const char *p = nd_get_link(nd);
- 	if (!IS_ERR(p))
- 		kfree(p);
- }
-diff -urNp linux-2.6.32.12/fs/compat_binfmt_elf.c linux-2.6.32.12/fs/compat_binfmt_elf.c
---- linux-2.6.32.12/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/compat_binfmt_elf.c	2010-04-04 20:46:41.645781188 -0400
-@@ -29,10 +29,12 @@
- #undef	elfhdr
- #undef	elf_phdr
- #undef	elf_note
-+#undef	elf_dyn
- #undef	elf_addr_t
- #define elfhdr		elf32_hdr
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
-+#define elf_dyn		Elf32_Dyn
- #define elf_addr_t	Elf32_Addr
- 
- /*
-diff -urNp linux-2.6.32.12/fs/compat.c linux-2.6.32.12/fs/compat.c
---- linux-2.6.32.12/fs/compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/compat.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
- 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
- 				struct page *page;
- 
--#ifdef CONFIG_STACK_GROWSUP
- 				ret = expand_stack_downwards(bprm->vma, pos);
- 				if (ret < 0) {
- 					/* We've exceed the stack rlimit. */
- 					ret = -E2BIG;
- 					goto out;
- 				}
--#endif
- 				ret = get_user_pages(current, bprm->mm, pos,
- 						     1, 1, 1, &page, NULL);
- 				if (ret <= 0) {
-@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
- 	compat_uptr_t __user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+	retval = -EAGAIN;
-+	if (gr_handle_nproc())
-+		goto out_file;
-+	retval = -EACCES;
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+		goto out_file;
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, (char __user * __user *)argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	retval = search_binary_handler(bprm, regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1543,6 +1585,14 @@ int compat_do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput(bprm->mm);
-diff -urNp linux-2.6.32.12/fs/compat_ioctl.c linux-2.6.32.12/fs/compat_ioctl.c
---- linux-2.6.32.12/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/compat_ioctl.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1827,15 +1827,15 @@ struct ioctl_trans {
- };
- 
- #define HANDLE_IOCTL(cmd,handler) \
--	{ (cmd), (ioctl_trans_handler_t)(handler) },
-+	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
- 
- /* pointer to compatible structure or no argument */
- #define COMPATIBLE_IOCTL(cmd) \
--	{ (cmd), do_ioctl32_pointer },
-+	{ (cmd), do_ioctl32_pointer, NULL },
- 
- /* argument is an unsigned long integer, not a pointer */
- #define ULONG_IOCTL(cmd) \
--	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
-+	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
- 
- /* ioctl should not be warned about even if it's not implemented.
-    Valid reasons to use this:
-diff -urNp linux-2.6.32.12/fs/debugfs/inode.c linux-2.6.32.12/fs/debugfs/inode.c
---- linux-2.6.32.12/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/debugfs/inode.c	2010-04-04 20:46:41.645781188 -0400
-@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
- 
- static int debug_fill_super(struct super_block *sb, void *data, int silent)
- {
--	static struct tree_descr debug_files[] = {{""}};
-+	static struct tree_descr debug_files[] = {{"", NULL, 0}};
- 
- 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
- }
-diff -urNp linux-2.6.32.12/fs/dlm/lockspace.c linux-2.6.32.12/fs/dlm/lockspace.c
---- linux-2.6.32.12/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/dlm/lockspace.c	2010-04-04 20:46:41.645781188 -0400
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
- 	kfree(ls);
- }
- 
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- 	.show  = dlm_attr_show,
- 	.store = dlm_attr_store,
- };
-diff -urNp linux-2.6.32.12/fs/ecryptfs/inode.c linux-2.6.32.12/fs/ecryptfs/inode.c
---- linux-2.6.32.12/fs/ecryptfs/inode.c	2010-04-29 17:49:38.429034237 -0400
-+++ linux-2.6.32.12/fs/ecryptfs/inode.c	2010-04-29 17:49:58.465067636 -0400
-@@ -655,7 +655,7 @@ static int ecryptfs_readlink_lower(struc
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
--						   (char __user *)lower_buf,
-+						   (__force char __user *)lower_buf,
- 						   lower_bufsiz);
- 	set_fs(old_fs);
- 	if (rc < 0)
-@@ -701,7 +701,7 @@ static void *ecryptfs_follow_link(struct
- 	}
- 	old_fs = get_fs();
- 	set_fs(get_ds());
--	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- 	set_fs(old_fs);
- 	if (rc < 0)
- 		goto out_free;
-diff -urNp linux-2.6.32.12/fs/exec.c linux-2.6.32.12/fs/exec.c
---- linux-2.6.32.12/fs/exec.c	2010-04-04 20:41:50.037938751 -0400
-+++ linux-2.6.32.12/fs/exec.c	2010-04-04 20:46:41.645781188 -0400
-@@ -56,12 +56,24 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
- 
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
- 
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
- 		goto out;
- 
- 	file = do_filp_open(AT_FDCWD, tmp,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_READ | MAY_EXEC | MAY_OPEN);
- 	putname(tmp);
- 	error = PTR_ERR(file);
-@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
- 		int write)
- {
- 	struct page *page;
--	int ret;
- 
--#ifdef CONFIG_STACK_GROWSUP
--	if (write) {
--		ret = expand_stack_downwards(bprm->vma, pos);
--		if (ret < 0)
--			return NULL;
--	}
--#endif
--	ret = get_user_pages(current, bprm->mm, pos,
--			1, write, 1, &page, NULL);
--	if (ret <= 0)
-+	if (0 > expand_stack_downwards(bprm->vma, pos))
-+		return NULL;
-+	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- 		return NULL;
- 
- 	if (write) {
-@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
- 	vma->vm_end = STACK_TOP_MAX;
- 	vma->vm_start = vma->vm_end - PAGE_SIZE;
- 	vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 	err = insert_vm_struct(mm, vma);
- 	if (err)
-@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
- 	mm->stack_vm = mm->total_vm = 1;
- 	up_write(&mm->mmap_sem);
- 	bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
-+#endif
-+
- 	return 0;
- err:
- 	up_write(&mm->mmap_sem);
-@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
- 	int r;
- 	mm_segment_t oldfs = get_fs();
- 	set_fs(KERNEL_DS);
--	r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- 	set_fs(oldfs);
- 	return r;
- }
-@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
- 	unsigned long new_end = old_end - shift;
- 	struct mmu_gather *tlb;
- 
--	BUG_ON(new_start > new_end);
-+	if (new_start >= new_end || new_start < mmap_min_addr)
-+		return -EFAULT;
- 
- 	/*
- 	 * ensure there are no vmas between where we want to go
-@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
- 	if (vma != find_vma(mm, new_start))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- 	/*
- 	 * cover the whole range: [new_start, old_end)
- 	 */
-@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
- 	bprm->exec -= stack_shift;
- 
- 	down_write(&mm->mmap_sem);
-+
-+	/* Move stack pages down in memory. */
-+	if (stack_shift) {
-+		ret = shift_arg_pages(vma, stack_shift);
-+		if (ret)
-+			goto out_unlock;
-+	}
-+
- 	vm_flags = VM_STACK_FLAGS;
- 
- 	/*
-@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
- 		vm_flags &= ~VM_EXEC;
- 	vm_flags |= mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- 			vm_flags);
- 	if (ret)
- 		goto out_unlock;
- 	BUG_ON(prev != vma);
- 
--	/* Move stack pages down in memory. */
--	if (stack_shift) {
--		ret = shift_arg_pages(vma, stack_shift);
--		if (ret)
--			goto out_unlock;
--	}
--
- 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- 	stack_size = vma->vm_end - vma->vm_start;
- 	/*
-@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
- 	int err;
- 
- 	file = do_filp_open(AT_FDCWD, name,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_EXEC | MAY_OPEN);
- 	if (IS_ERR(file))
- 		goto out;
-@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	result = vfs_read(file, (void __user *)addr, count, &pos);
-+	result = vfs_read(file, (__force void __user *)addr, count, &pos);
- 	set_fs(old_fs);
- 	return result;
- }
-@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
- 	}
- 	rcu_read_unlock();
- 
--	if (p->fs->users > n_fs) {
-+	if (atomic_read(&p->fs->users) > n_fs) {
- 		bprm->unsafe |= LSM_UNSAFE_SHARE;
- 	} else {
- 		res = -EAGAIN;
-@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
- 	char __user *__user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+
-+	if (gr_handle_nproc()) {
-+		retval = -EAGAIN;
-+		goto out_file;
-+	}
-+
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+		retval = -EACCES;
-+		goto out_file;
-+	}
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	current->flags &= ~PF_KTHREAD;
- 	retval = search_binary_handler(bprm,regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1390,6 +1471,14 @@ int do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput (bprm->mm);
-@@ -1553,6 +1642,169 @@ out:
- 	return ispipe;
- }
- 
-+int pax_check_flags(unsigned long *flags)
-+{
-+	int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+	if (*flags & MF_PAX_SEGMEXEC)
-+	{
-+		*flags &= ~MF_PAX_SEGMEXEC;
-+		retval = -EINVAL;
-+	}
-+#endif
-+
-+	if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	    &&  (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_PAGEEXEC;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_MPROTECT;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_EMUTRAMP;
-+		retval = -EINVAL;
-+	}
-+
-+	return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+	struct task_struct *tsk = current;
-+	struct mm_struct *mm = current->mm;
-+	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+	char *path_exec = NULL;
-+	char *path_fault = NULL;
-+	unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+	if (buffer_exec && buffer_fault) {
-+		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+		down_read(&mm->mmap_sem);
-+		vma = mm->mmap;
-+		while (vma && (!vma_exec || !vma_fault)) {
-+			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+				vma_exec = vma;
-+			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+				vma_fault = vma;
-+			vma = vma->vm_next;
-+		}
-+		if (vma_exec) {
-+			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+			if (IS_ERR(path_exec))
-+				path_exec = "<path too long>";
-+			else {
-+				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+				if (path_exec) {
-+					*path_exec = 0;
-+					path_exec = buffer_exec;
-+				} else
-+					path_exec = "<path too long>";
-+			}
-+		}
-+		if (vma_fault) {
-+			start = vma_fault->vm_start;
-+			end = vma_fault->vm_end;
-+			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+			if (vma_fault->vm_file) {
-+				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+				if (IS_ERR(path_fault))
-+					path_fault = "<path too long>";
-+				else {
-+					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+					if (path_fault) {
-+						*path_fault = 0;
-+						path_fault = buffer_fault;
-+					} else
-+						path_fault = "<path too long>";
-+				}
-+			} else
-+				path_fault = "<anonymous mapping>";
-+		}
-+		up_read(&mm->mmap_sem);
-+	}
-+	if (tsk->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+	else
-+		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+			task_uid(tsk), task_euid(tsk), pc, sp);
-+	free_page((unsigned long)buffer_exec);
-+	free_page((unsigned long)buffer_fault);
-+	pax_report_insns(pc, sp);
-+	do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	else
-+		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+	show_regs(regs);
-+	force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+void pax_report_leak_to_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- 	struct task_struct *t;
-@@ -1755,17 +2007,17 @@ static void wait_for_dump_helpers(struct
- 	pipe = file->f_path.dentry->d_inode->i_pipe;
- 
- 	pipe_lock(pipe);
--	pipe->readers++;
--	pipe->writers--;
-+	atomic_inc(&pipe->readers);
-+	atomic_dec(&pipe->writers);
- 
--	while ((pipe->readers > 1) && (!signal_pending(current))) {
-+	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- 		wake_up_interruptible_sync(&pipe->wait);
- 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 		pipe_wait(pipe);
- 	}
- 
--	pipe->readers--;
--	pipe->writers++;
-+	atomic_dec(&pipe->readers);
-+	atomic_inc(&pipe->writers);
- 	pipe_unlock(pipe);
- 
- }
-@@ -1836,6 +2088,10 @@ void do_coredump(long signr, int exit_co
- 	 */
- 	clear_thread_flag(TIF_SIGPENDING);
- 
-+	if (signr == SIGKILL || signr == SIGILL)
-+		gr_handle_brute_attach(current);
-+	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- 	/*
- 	 * lock_kernel() because format_corename() is controlled by sysctl, which
- 	 * uses lock_kernel()
-diff -urNp linux-2.6.32.12/fs/ext2/balloc.c linux-2.6.32.12/fs/ext2/balloc.c
---- linux-2.6.32.12/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext2/balloc.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.12/fs/ext2/xattr.c linux-2.6.32.12/fs/ext2/xattr.c
---- linux-2.6.32.12/fs/ext2/xattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext2/xattr.c	2010-04-29 17:46:37.253252101 -0400
-@@ -85,8 +85,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static int ext2_xattr_set2(struct inode *, struct buffer_head *,
-diff -urNp linux-2.6.32.12/fs/ext3/balloc.c linux-2.6.32.12/fs/ext3/balloc.c
---- linux-2.6.32.12/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext3/balloc.c	2010-04-04 20:46:41.645781188 -0400
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.12/fs/ext3/namei.c linux-2.6.32.12/fs/ext3/namei.c
---- linux-2.6.32.12/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext3/namei.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext3_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext3_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.12/fs/ext3/xattr.c linux-2.6.32.12/fs/ext3/xattr.c
---- linux-2.6.32.12/fs/ext3/xattr.c	2010-04-29 17:49:38.429034237 -0400
-+++ linux-2.6.32.12/fs/ext3/xattr.c	2010-04-29 17:49:58.485032679 -0400
-@@ -89,8 +89,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(f...) do {} while (0)
-+# define ea_bdebug(f...) do {} while (0)
- #endif
- 
- static void ext3_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.32.12/fs/ext4/balloc.c linux-2.6.32.12/fs/ext4/balloc.c
---- linux-2.6.32.12/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext4/balloc.c	2010-04-04 20:46:41.649500937 -0400
-@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
- 	/* Hm, nope.  Are (enough) root reserved blocks available? */
- 	if (sbi->s_resuid == current_fsuid() ||
- 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
--	    capable(CAP_SYS_RESOURCE)) {
-+	    capable_nolog(CAP_SYS_RESOURCE)) {
- 		if (free_blocks >= (nblocks + dirty_blocks))
- 			return 1;
- 	}
-diff -urNp linux-2.6.32.12/fs/ext4/ioctl.c linux-2.6.32.12/fs/ext4/ioctl.c
---- linux-2.6.32.12/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext4/ioctl.c	2010-04-04 20:46:41.649500937 -0400
-@@ -221,6 +221,9 @@ setversion_out:
- 		struct file *donor_filp;
- 		int err;
- 
-+		/* temporary workaround for bugs in here */
-+		return -EOPNOTSUPP;
-+
- 		if (!(filp->f_mode & FMODE_READ) ||
- 		    !(filp->f_mode & FMODE_WRITE))
- 			return -EBADF;
-diff -urNp linux-2.6.32.12/fs/ext4/namei.c linux-2.6.32.12/fs/ext4/namei.c
---- linux-2.6.32.12/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext4/namei.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext4_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext4_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.12/fs/ext4/super.c linux-2.6.32.12/fs/ext4/super.c
---- linux-2.6.32.12/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext4/super.c	2010-04-04 20:46:41.649500937 -0400
-@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
- }
- 
- 
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- 	.show	= ext4_attr_show,
- 	.store	= ext4_attr_store,
- };
-diff -urNp linux-2.6.32.12/fs/ext4/xattr.c linux-2.6.32.12/fs/ext4/xattr.c
---- linux-2.6.32.12/fs/ext4/xattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ext4/xattr.c	2010-04-29 17:46:37.279760502 -0400
-@@ -82,8 +82,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static void ext4_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.32.12/fs/fcntl.c linux-2.6.32.12/fs/fcntl.c
---- linux-2.6.32.12/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fcntl.c	2010-04-04 20:46:41.649500937 -0400
-@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
- 	switch (cmd) {
- 	case F_DUPFD:
- 	case F_DUPFD_CLOEXEC:
-+		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 			break;
- 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
- 	ret = ((fown->euid == 0 ||
- 		fown->euid == cred->suid || fown->euid == cred->uid ||
- 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
--	       !security_file_send_sigiotask(p, fown, sig));
-+	       !security_file_send_sigiotask(p, fown, sig) &&
-+	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
- 	rcu_read_unlock();
- 	return ret;
- }
-diff -urNp linux-2.6.32.12/fs/fifo.c linux-2.6.32.12/fs/fifo.c
---- linux-2.6.32.12/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fifo.c	2010-04-04 20:46:41.649500937 -0400
-@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &read_pipefifo_fops;
- 		pipe->r_counter++;
--		if (pipe->readers++ == 0)
-+		if (atomic_inc_return(&pipe->readers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->writers) {
-+		if (!atomic_read(&pipe->writers)) {
- 			if ((filp->f_flags & O_NONBLOCK)) {
- 				/* suppress POLLHUP until we have
- 				 * seen a writer */
-@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
- 	 *  errno=ENXIO when there is no process reading the FIFO.
- 	 */
- 		ret = -ENXIO;
--		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- 			goto err;
- 
- 		filp->f_op = &write_pipefifo_fops;
- 		pipe->w_counter++;
--		if (!pipe->writers++)
-+		if (atomic_inc_return(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			wait_for_partner(inode, &pipe->r_counter);
- 			if (signal_pending(current))
- 				goto err_wr;
-@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &rdwr_pipefifo_fops;
- 
--		pipe->readers++;
--		pipe->writers++;
-+		atomic_inc(&pipe->readers);
-+		atomic_inc(&pipe->writers);
- 		pipe->r_counter++;
- 		pipe->w_counter++;
--		if (pipe->readers == 1 || pipe->writers == 1)
-+		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 		break;
- 
-@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
- 	return 0;
- 
- err_rd:
--	if (!--pipe->readers)
-+	if (atomic_dec_and_test(&pipe->readers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err_wr:
--	if (!--pipe->writers)
-+	if (atomic_dec_and_test(&pipe->writers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err:
--	if (!pipe->readers && !pipe->writers)
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- 		free_pipe_info(inode);
- 
- err_nocleanup:
-diff -urNp linux-2.6.32.12/fs/file.c linux-2.6.32.12/fs/file.c
---- linux-2.6.32.12/fs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/file.c	2010-04-04 20:46:41.649500937 -0400
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
- 	 * N.B. For clone tasks sharing a files structure, this test
- 	 * will limit the total number of files that can be opened.
- 	 */
-+
-+	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EMFILE;
- 
-diff -urNp linux-2.6.32.12/fs/fs_struct.c linux-2.6.32.12/fs/fs_struct.c
---- linux-2.6.32.12/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fs_struct.c	2010-04-04 20:46:41.649500937 -0400
-@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
- 	struct task_struct *g, *p;
- 	struct fs_struct *fs;
- 	int count = 0;
-+	unsigned long flags;
- 
- 	read_lock(&tasklist_lock);
- 	do_each_thread(g, p) {
- 		task_lock(p);
-+		gr_fs_write_lock_irqsave(p, flags);
- 		fs = p->fs;
- 		if (fs) {
- 			write_lock(&fs->lock);
-@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
- 			}
- 			write_unlock(&fs->lock);
- 		}
-+		gr_fs_write_unlock_irqrestore(p, flags);
- 		task_unlock(p);
- 	} while_each_thread(g, p);
- 	read_unlock(&tasklist_lock);
-@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
- void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
- 		task_lock(tsk);
-+		gr_fs_write_lock_irqsave(tsk, flags);
- 		write_lock(&fs->lock);
- 		tsk->fs = NULL;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(tsk, flags);
- 		task_unlock(tsk);
- 		if (kill)
- 			free_fs_struct(fs);
-@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
- 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- 	/* We don't need to lock fs - think why ;-) */
- 	if (fs) {
--		fs->users = 1;
-+		atomic_set(&fs->users, 1);
- 		fs->in_exec = 0;
- 		rwlock_init(&fs->lock);
- 		fs->umask = old->umask;
-@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
- 	struct fs_struct *fs = current->fs;
- 	struct fs_struct *new_fs = copy_fs_struct(fs);
- 	int kill;
-+	unsigned long flags;
- 
- 	if (!new_fs)
- 		return -ENOMEM;
- 
- 	task_lock(current);
-+	gr_fs_write_lock_irqsave(current, flags);
- 	write_lock(&fs->lock);
--	kill = !--fs->users;
-+	kill = !atomic_dec_return(&fs->users);
- 	current->fs = new_fs;
- 	write_unlock(&fs->lock);
-+	gr_fs_write_unlock_irqrestore(current, flags);
- 	task_unlock(current);
- 
- 	if (kill)
-@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
- 
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
--	.users		= 1,
-+	.users		= ATOMIC_INIT(1),
- 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
- 	.umask		= 0022,
- };
-@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
- void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
-@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
- 		task_lock(current);
- 
- 		write_lock(&init_fs.lock);
--		init_fs.users++;
-+		atomic_inc(&init_fs.users);
- 		write_unlock(&init_fs.lock);
- 
-+		gr_fs_write_lock_irqsave(current, flags);
- 		write_lock(&fs->lock);
- 		current->fs = &init_fs;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(current, flags);
- 
- 		task_unlock(current);
- 		if (kill)
-diff -urNp linux-2.6.32.12/fs/fuse/control.c linux-2.6.32.12/fs/fuse/control.c
---- linux-2.6.32.12/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fuse/control.c	2010-04-04 20:46:41.649500937 -0400
-@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
- 
- static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
- {
--	struct tree_descr empty_descr = {""};
-+	struct tree_descr empty_descr = {"", NULL, 0};
- 	struct fuse_conn *fc;
- 	int err;
- 
-diff -urNp linux-2.6.32.12/fs/fuse/cuse.c linux-2.6.32.12/fs/fuse/cuse.c
---- linux-2.6.32.12/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fuse/cuse.c	2010-04-04 20:46:41.649500937 -0400
-@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
- 	return rc;
- }
- 
--static struct file_operations cuse_channel_fops; /* initialized during init */
--
-+static const struct file_operations cuse_channel_fops = { /* initialized during init */
-+	.owner		= THIS_MODULE,
-+	.llseek		= no_llseek,
-+	.read		= do_sync_read,
-+	.aio_read	= fuse_dev_read,
-+	.write		= do_sync_write,
-+	.aio_write	= fuse_dev_write,
-+	.poll		= fuse_dev_poll,
-+	.open		= cuse_channel_open,
-+	.release	= cuse_channel_release,
-+	.fasync		= fuse_dev_fasync,
-+};
- 
- /**************************************************************************
-  * Misc stuff and module initializatiion
-@@ -575,12 +585,6 @@ static int __init cuse_init(void)
- 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
- 		INIT_LIST_HEAD(&cuse_conntbl[i]);
- 
--	/* inherit and extend fuse_dev_operations */
--	cuse_channel_fops		= fuse_dev_operations;
--	cuse_channel_fops.owner		= THIS_MODULE;
--	cuse_channel_fops.open		= cuse_channel_open;
--	cuse_channel_fops.release	= cuse_channel_release;
--
- 	cuse_class = class_create(THIS_MODULE, "cuse");
- 	if (IS_ERR(cuse_class))
- 		return PTR_ERR(cuse_class);
-diff -urNp linux-2.6.32.12/fs/fuse/dev.c linux-2.6.32.12/fs/fuse/dev.c
---- linux-2.6.32.12/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fuse/dev.c	2010-04-04 20:46:41.649500937 -0400
-@@ -745,7 +745,7 @@ __releases(&fc->lock)
-  * request_end().  Otherwise add it to the processing list, and set
-  * the 'sent' flag.
-  */
--static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
- 			      unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
- 	spin_unlock(&fc->lock);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_read);
- 
- static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
- 			    struct fuse_copy_state *cs)
-@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
- {
- 	struct fuse_notify_inval_entry_out outarg;
- 	int err = -EINVAL;
--	char buf[FUSE_NAME_MAX+1];
-+	char *buf = NULL;
- 	struct qstr name;
- 
- 	if (size < sizeof(outarg))
-@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
- 	if (outarg.namelen > FUSE_NAME_MAX)
- 		goto err;
- 
-+	err = -ENOMEM;
-+	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+	if (!buf)
-+		goto err;
-+
- 	name.name = buf;
- 	name.len = outarg.namelen;
- 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
-@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
- 
- 	down_read(&fc->killsb);
- 	err = -ENOENT;
--	if (!fc->sb)
--		goto err_unlock;
--
--	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+	if (fc->sb)
-+		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- 	up_read(&fc->killsb);
-+	kfree(buf);
- 	return err;
- 
- err:
- 	fuse_copy_finish(cs);
-+	kfree(buf);
- 	return err;
- }
- 
-@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
-  * it from the list and copy the rest of the buffer to the request.
-  * The request is finished by calling request_end()
-  */
--static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
- 			       unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
- 	fuse_copy_finish(&cs);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_write);
- 
--static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
-+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
- {
- 	unsigned mask = POLLOUT | POLLWRNORM;
- 	struct fuse_conn *fc = fuse_get_conn(file);
-@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
- 
- 	return mask;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_poll);
- 
- /*
-  * Abort all requests on the given list (pending or processing)
-@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
- }
- EXPORT_SYMBOL_GPL(fuse_dev_release);
- 
--static int fuse_dev_fasync(int fd, struct file *file, int on)
-+int fuse_dev_fasync(int fd, struct file *file, int on)
- {
- 	struct fuse_conn *fc = fuse_get_conn(file);
- 	if (!fc)
-@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
- 	/* No locking - fasync_helper does its own locking */
- 	return fasync_helper(fd, file, on, &fc->fasync);
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
- 
- const struct file_operations fuse_dev_operations = {
- 	.owner		= THIS_MODULE,
-diff -urNp linux-2.6.32.12/fs/fuse/dir.c linux-2.6.32.12/fs/fuse/dir.c
---- linux-2.6.32.12/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fuse/dir.c	2010-04-04 20:46:41.649500937 -0400
-@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
- 	return link;
- }
- 
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- 	if (!IS_ERR(link))
- 		free_page((unsigned long) link);
-diff -urNp linux-2.6.32.12/fs/fuse/fuse_i.h linux-2.6.32.12/fs/fuse/fuse_i.h
---- linux-2.6.32.12/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/fuse/fuse_i.h	2010-04-04 20:46:41.649500937 -0400
-@@ -521,6 +521,16 @@ extern const struct file_operations fuse
- 
- extern const struct dentry_operations fuse_dentry_operations;
- 
-+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+			      unsigned long nr_segs, loff_t pos);
-+
-+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+			       unsigned long nr_segs, loff_t pos);
-+
-+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
-+
-+extern int fuse_dev_fasync(int fd, struct file *file, int on);
-+
- /**
-  * Inode to nodeid comparison.
-  */
-diff -urNp linux-2.6.32.12/fs/gfs2/sys.c linux-2.6.32.12/fs/gfs2/sys.c
---- linux-2.6.32.12/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/gfs2/sys.c	2010-04-04 20:46:41.649500937 -0400
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
- 	return a->store ? a->store(sdp, buf, len) : len;
- }
- 
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- 	.show  = gfs2_attr_show,
- 	.store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- 	.uevent = gfs2_uevent,
- };
- 
-diff -urNp linux-2.6.32.12/fs/hfs/inode.c linux-2.6.32.12/fs/hfs/inode.c
---- linux-2.6.32.12/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/hfs/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
- 
- 	if (S_ISDIR(main_inode->i_mode)) {
- 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_dir));
- 		if (rec.type != HFS_CDR_DIR ||
-@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
- 				sizeof(struct hfs_cat_file));
- 	} else {
- 		if (fd.entrylength < sizeof(struct hfs_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_file));
- 		if (rec.type != HFS_CDR_FIL ||
-diff -urNp linux-2.6.32.12/fs/hfsplus/inode.c linux-2.6.32.12/fs/hfsplus/inode.c
---- linux-2.6.32.12/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/hfsplus/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		hfsplus_get_perms(inode, &folder->permissions, 1);
-@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 
-@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		/* simple node checks? */
-@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 		hfsplus_inode_write_fork(inode, &file->data_fork);
-diff -urNp linux-2.6.32.12/fs/hugetlbfs/inode.c linux-2.6.32.12/fs/hugetlbfs/inode.c
---- linux-2.6.32.12/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/hugetlbfs/inode.c	2010-04-06 22:13:08.677504702 -0400
-@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
- 	.kill_sb	= kill_litter_super,
- };
- 
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
- 
- static int can_do_hugetlb_shm(void)
- {
-diff -urNp linux-2.6.32.12/fs/ioctl.c linux-2.6.32.12/fs/ioctl.c
---- linux-2.6.32.12/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ioctl.c	2010-04-04 20:46:41.653544810 -0400
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
- 			    u64 phys, u64 len, u32 flags)
- {
- 	struct fiemap_extent extent;
--	struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
- 
- 	/* only count the extents */
- 	if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
- 
- 	fieinfo.fi_flags = fiemap.fm_flags;
- 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
--	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
- 
- 	if (fiemap.fm_extent_count != 0 &&
- 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
- 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- 	fiemap.fm_flags = fieinfo.fi_flags;
- 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
--	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- 		error = -EFAULT;
- 
- 	return error;
-diff -urNp linux-2.6.32.12/fs/jffs2/debug.h linux-2.6.32.12/fs/jffs2/debug.h
---- linux-2.6.32.12/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/jffs2/debug.h	2010-04-04 20:46:41.653544810 -0400
-@@ -52,13 +52,13 @@
- #if CONFIG_JFFS2_FS_DEBUG > 0
- #define D1(x) x
- #else
--#define D1(x)
-+#define D1(x) do {} while (0);
- #endif
- 
- #if CONFIG_JFFS2_FS_DEBUG > 1
- #define D2(x) x
- #else
--#define D2(x)
-+#define D2(x) do {} while (0);
- #endif
- 
- /* The prefixes of JFFS2 messages */
-@@ -114,73 +114,73 @@
- #ifdef JFFS2_DBG_READINODE_MESSAGES
- #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode(fmt, ...)
-+#define dbg_readinode(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_READINODE2_MESSAGES
- #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode2(fmt, ...)
-+#define dbg_readinode2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Fragtree build debugging messages */
- #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
- #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree(fmt, ...)
-+#define dbg_fragtree(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
- #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree2(fmt, ...)
-+#define dbg_fragtree2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Directory entry list manilulation debugging messages */
- #ifdef JFFS2_DBG_DENTLIST_MESSAGES
- #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_dentlist(fmt, ...)
-+#define dbg_dentlist(fmt, ...)	do {} while (0)
- #endif
- 
- /* Print the messages about manipulating node_refs */
- #ifdef JFFS2_DBG_NODEREF_MESSAGES
- #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_noderef(fmt, ...)
-+#define dbg_noderef(fmt, ...)	do {} while (0)
- #endif
- 
- /* Manipulations with the list of inodes (JFFS2 inocache) */
- #ifdef JFFS2_DBG_INOCACHE_MESSAGES
- #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_inocache(fmt, ...)
-+#define dbg_inocache(fmt, ...)	do {} while (0)
- #endif
- 
- /* Summary debugging messages */
- #ifdef JFFS2_DBG_SUMMARY_MESSAGES
- #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_summary(fmt, ...)
-+#define dbg_summary(fmt, ...)	do {} while (0)
- #endif
- 
- /* File system build messages */
- #ifdef JFFS2_DBG_FSBUILD_MESSAGES
- #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fsbuild(fmt, ...)
-+#define dbg_fsbuild(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the object allocations */
- #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
- #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_memalloc(fmt, ...)
-+#define dbg_memalloc(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the XATTR subsystem */
- #ifdef JFFS2_DBG_XATTR_MESSAGES
- #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_xattr(fmt, ...)
-+#define dbg_xattr(fmt, ...)	do {} while (0)
- #endif 
- 
- /* "Sanity" checks */
-diff -urNp linux-2.6.32.12/fs/jffs2/erase.c linux-2.6.32.12/fs/jffs2/erase.c
---- linux-2.6.32.12/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/jffs2/erase.c	2010-04-04 20:46:41.653544810 -0400
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
- 		struct jffs2_unknown_node marker = {
- 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--			.totlen =	cpu_to_je32(c->cleanmarker_size)
-+			.totlen =	cpu_to_je32(c->cleanmarker_size),
-+			.hdr_crc =	cpu_to_je32(0)
- 		};
- 
- 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.32.12/fs/jffs2/summary.h linux-2.6.32.12/fs/jffs2/summary.h
---- linux-2.6.32.12/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/jffs2/summary.h	2010-04-04 20:46:41.653544810 -0400
-@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
- 
- #define jffs2_sum_active() (0)
- #define jffs2_sum_init(a) (0)
--#define jffs2_sum_exit(a)
--#define jffs2_sum_disable_collecting(a)
-+#define jffs2_sum_exit(a) do {} while (0)
-+#define jffs2_sum_disable_collecting(a) do {} while (0)
- #define jffs2_sum_is_disabled(a) (0)
--#define jffs2_sum_reset_collected(a)
-+#define jffs2_sum_reset_collected(a) do {} while (0)
- #define jffs2_sum_add_kvec(a,b,c,d) (0)
--#define jffs2_sum_move_collected(a,b)
-+#define jffs2_sum_move_collected(a,b) do {} while (0)
- #define jffs2_sum_write_sumnode(a) (0)
--#define jffs2_sum_add_padding_mem(a,b)
--#define jffs2_sum_add_inode_mem(a,b,c)
--#define jffs2_sum_add_dirent_mem(a,b,c)
--#define jffs2_sum_add_xattr_mem(a,b,c)
--#define jffs2_sum_add_xref_mem(a,b,c)
-+#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
-+#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
- #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
- 
- #endif /* CONFIG_JFFS2_SUMMARY */
-diff -urNp linux-2.6.32.12/fs/jffs2/wbuf.c linux-2.6.32.12/fs/jffs2/wbuf.c
---- linux-2.6.32.12/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/jffs2/wbuf.c	2010-04-04 20:46:41.653544810 -0400
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
- {
- 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--	.totlen = constant_cpu_to_je32(8)
-+	.totlen = constant_cpu_to_je32(8),
-+	.hdr_crc = constant_cpu_to_je32(0)
- };
- 
- /*
-diff -urNp linux-2.6.32.12/fs/lockd/svc.c linux-2.6.32.12/fs/lockd/svc.c
---- linux-2.6.32.12/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/lockd/svc.c	2010-04-04 20:46:41.653544810 -0400
-@@ -43,7 +43,7 @@
- 
- static struct svc_program	nlmsvc_program;
- 
--struct nlmsvc_binding *		nlmsvc_ops;
-+const struct nlmsvc_binding *	nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
- 
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.32.12/fs/locks.c linux-2.6.32.12/fs/locks.c
---- linux-2.6.32.12/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/locks.c	2010-04-04 20:46:41.653544810 -0400
-@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
- 		return;
- 
- 	if (filp->f_op && filp->f_op->flock) {
--		struct file_lock fl = {
-+		struct file_lock flock = {
- 			.fl_pid = current->tgid,
- 			.fl_file = filp,
- 			.fl_flags = FL_FLOCK,
- 			.fl_type = F_UNLCK,
- 			.fl_end = OFFSET_MAX,
- 		};
--		filp->f_op->flock(filp, F_SETLKW, &fl);
--		if (fl.fl_ops && fl.fl_ops->fl_release_private)
--			fl.fl_ops->fl_release_private(&fl);
-+		filp->f_op->flock(filp, F_SETLKW, &flock);
-+		if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+			flock.fl_ops->fl_release_private(&flock);
- 	}
- 
- 	lock_kernel();
-diff -urNp linux-2.6.32.12/fs/namei.c linux-2.6.32.12/fs/namei.c
---- linux-2.6.32.12/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/namei.c	2010-04-04 20:46:41.653544810 -0400
-@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
- 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- 	error = PTR_ERR(cookie);
- 	if (!IS_ERR(cookie)) {
--		char *s = nd_get_link(nd);
-+		const char *s = nd_get_link(nd);
- 		error = 0;
- 		if (s)
- 			error = __vfs_follow_link(nd, s);
-@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
- 	err = security_inode_follow_link(path->dentry, nd);
- 	if (err)
- 		goto loop;
-+
-+	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+		err = -EACCES;
-+		goto loop;
-+	}
-+
- 	current->link_count++;
- 	current->total_link_count++;
- 	nd->depth++;
-@@ -1016,11 +1023,18 @@ return_reval:
- 				break;
- 		}
- return_base:
-+		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+			path_put(&nd->path);
-+			return -ENOENT;
-+		}
- 		return 0;
- out_dput:
- 		path_put_conditional(&next, nd);
- 		break;
- 	}
-+	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+		err = -ENOENT;
-+
- 	path_put(&nd->path);
- return_err:
- 	return err;
-@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
- 	int error;
- 	struct dentry *dir = nd->path.dentry;
- 
-+	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
-+		error = -EACCES;
-+		goto out_unlock;
-+	}
-+
- 	if (!IS_POSIXACL(dir->d_inode))
- 		mode &= ~current_umask();
- 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
- 	if (error)
- 		goto out_unlock;
- 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+	if (!error)
-+		gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	dput(nd->path.dentry);
-@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
- 					 &nd, flag);
- 		if (error)
- 			return ERR_PTR(error);
-+
-+		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
-+			error = -EACCES;
-+			goto exit;
-+		}
-+
- 		goto ok;
- 	}
- 
-@@ -1795,6 +1832,24 @@ do_last:
- 	/*
- 	 * It already exists.
- 	 */
-+
-+	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_rawio(path.dentry->d_inode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	audit_inode(pathname, path.dentry);
- 
-@@ -1887,6 +1942,13 @@ do_link:
- 	error = security_inode_follow_link(path.dentry, &nd);
- 	if (error)
- 		goto exit_dput;
-+
-+	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+				  path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto exit_dput;
-+	}
-+
- 	error = __do_follow_link(&path, &nd);
- 	if (error) {
- 		/* Does someone understand code flow here? Or it is only
-@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	error = may_mknod(mode);
- 	if (error)
- 		goto out_dput;
-+
-+	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+		error = -EPERM;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	}
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
- 		mode &= ~current_umask();
- 	error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
- 	char * name;
- 	struct dentry *dentry;
- 	struct nameidata nd;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
- 	error = PTR_ERR(dentry);
- 	if (IS_ERR(dentry))
- 		goto exit2;
-+
-+	if (dentry->d_inode != NULL) {
-+		if (dentry->d_inode->i_nlink <= 1) {
-+			saved_ino = dentry->d_inode->i_ino;
-+			saved_dev = dentry->d_inode->i_sb->s_dev;
-+		}
-+
-+		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+			error = -EACCES;
-+			goto exit3;
-+		}
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto exit3;
-@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
- 	if (error)
- 		goto exit4;
- 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+	if (!error && (saved_dev || saved_ino))
-+		gr_handle_delete(saved_ino, saved_dev);
- exit4:
- 	mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
- 	struct dentry *dentry;
- 	struct nameidata nd;
- 	struct inode *inode = NULL;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
- 		if (nd.last.name[nd.last.len])
- 			goto slashes;
- 		inode = dentry->d_inode;
--		if (inode)
-+		if (inode) {
-+			if (inode->i_nlink <= 1) {
-+				saved_ino = inode->i_ino;
-+				saved_dev = inode->i_sb->s_dev;
-+			}
-+
- 			atomic_inc(&inode->i_count);
-+
-+			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+				error = -EACCES;
-+				goto exit2;
-+			}
-+		}
- 		error = mnt_want_write(nd.path.mnt);
- 		if (error)
- 			goto exit2;
-@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
- 		if (error)
- 			goto exit3;
- 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+		if (!error && (saved_ino || saved_dev))
-+			gr_handle_delete(saved_ino, saved_dev);
- exit3:
- 		mnt_drop_write(nd.path.mnt);
- 	exit2:
-@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	error = PTR_ERR(new_dentry);
- 	if (IS_ERR(new_dentry))
- 		goto out_unlock;
-+
-+	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+			       old_path.dentry->d_inode,
-+			       old_path.dentry->d_inode->i_mode, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+				old_path.dentry, old_path.mnt, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 	if (new_dentry == trap)
- 		goto exit5;
- 
-+	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+				     to);
-+	if (error)
-+		goto exit5;
-+
- 	error = mnt_want_write(oldnd.path.mnt);
- 	if (error)
- 		goto exit5;
-@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 		goto exit6;
- 	error = vfs_rename(old_dir->d_inode, old_dentry,
- 				   new_dir->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- 	mnt_drop_write(oldnd.path.mnt);
- exit5:
-diff -urNp linux-2.6.32.12/fs/namespace.c linux-2.6.32.12/fs/namespace.c
---- linux-2.6.32.12/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/namespace.c	2010-04-04 20:46:41.653544810 -0400
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
- 		if (!(sb->s_flags & MS_RDONLY))
- 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- 		up_write(&sb->s_umount);
-+
-+		gr_log_remount(mnt->mnt_devname, retval);
-+
- 		return retval;
- 	}
- 
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
- 		security_sb_umount_busy(mnt);
- 	up_write(&namespace_sem);
- 	release_mounts(&umount_list);
-+
-+	gr_log_unmount(mnt->mnt_devname, retval);
-+
- 	return retval;
- }
- 
-@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
- 	if (retval)
- 		goto dput_out;
- 
-+	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
-+	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
- 	if (flags & MS_REMOUNT)
- 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- 				    data_page);
-@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
- 				      dev_name, data_page);
- dput_out:
- 	path_put(&path);
-+
-+	gr_log_mount(dev_name, dir_name, retval);
-+
- 	return retval;
- }
- 
-@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
- 		goto out1;
- 	}
- 
-+	if (gr_handle_chroot_pivot()) {
-+		error = -EPERM;
-+		path_put(&old);
-+		goto out1;
-+	}
-+
- 	read_lock(&current->fs->lock);
- 	root = current->fs->root;
- 	path_get(&current->fs->root);
-diff -urNp linux-2.6.32.12/fs/nfs/inode.c linux-2.6.32.12/fs/nfs/inode.c
---- linux-2.6.32.12/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
-+++ linux-2.6.32.12/fs/nfs/inode.c	2010-04-04 20:46:41.653544810 -0400
-@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
- 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
- 
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
- 
- static unsigned long nfs_read_attr_generation_counter(void)
- {
--	return atomic_long_read(&nfs_attr_generation_counter);
-+	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
- 
- unsigned long nfs_inc_attr_generation_counter(void)
- {
--	return atomic_long_inc_return(&nfs_attr_generation_counter);
-+	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
- 
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.32.12/fs/nfs/nfs4proc.c linux-2.6.32.12/fs/nfs/nfs4proc.c
---- linux-2.6.32.12/fs/nfs/nfs4proc.c	2010-04-29 17:49:38.445067399 -0400
-+++ linux-2.6.32.12/fs/nfs/nfs4proc.c	2010-04-29 17:49:58.597031543 -0400
-@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
- static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_do_open_reclaim(ctx, state);
-@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
- 
- int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs_server *server = NFS_SERVER(state->inode);
- 	int err;
- 	do {
-@@ -1493,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs
- static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -1593,7 +1593,7 @@ out_err:
- 
- static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs4_state *res;
- 	int status;
- 
-@@ -1684,7 +1684,7 @@ static int nfs4_do_setattr(struct inode 
- 			   struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2050,7 +2050,7 @@ static int _nfs4_server_capabilities(str
- 
- int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2084,7 +2084,7 @@ static int _nfs4_lookup_root(struct nfs_
- static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_fsinfo *info)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2173,7 +2173,7 @@ static int _nfs4_proc_getattr(struct nfs
- 
- static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2261,7 +2261,7 @@ static int nfs4_proc_lookupfh(struct nfs
- 			      struct qstr *name, struct nfs_fh *fhandle,
- 			      struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
-@@ -2290,7 +2290,7 @@ static int _nfs4_proc_lookup(struct inod
- 
- static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2354,7 +2354,7 @@ static int _nfs4_proc_access(struct inod
- 
- static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2410,7 +2410,7 @@ static int _nfs4_proc_readlink(struct in
- static int nfs4_proc_readlink(struct inode *inode, struct page *page,
- 		unsigned int pgbase, unsigned int pglen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2508,7 +2508,7 @@ static int _nfs4_proc_remove(struct inod
- 
- static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2582,7 +2582,7 @@ static int _nfs4_proc_rename(struct inod
- static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
- 		struct inode *new_dir, struct qstr *new_name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
-@@ -2629,7 +2629,7 @@ static int _nfs4_proc_link(struct inode 
- 
- static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2721,7 +2721,7 @@ out:
- static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
- 		struct page *page, unsigned int len, struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2752,7 +2752,7 @@ out:
- static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2801,7 +2801,7 @@ static int _nfs4_proc_readdir(struct den
- static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
-                   u64 cookie, struct page *page, unsigned int count, int plus)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
-@@ -2849,7 +2849,7 @@ out:
- static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr, dev_t rdev)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2881,7 +2881,7 @@ static int _nfs4_proc_statfs(struct nfs_
- 
- static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2912,7 +2912,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
- 
- static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -2958,7 +2958,7 @@ static int _nfs4_proc_pathconf(struct nf
- static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_pathconf *pathconf)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -3257,7 +3257,7 @@ out_free:
- 
- static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	ssize_t ret;
- 	do {
- 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
-@@ -3313,7 +3313,7 @@ static int __nfs4_proc_set_acl(struct in
- 
- static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -3578,7 +3578,7 @@ out:
- int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
-@@ -3651,7 +3651,7 @@ out:
- 
- static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4044,7 +4044,7 @@ static int _nfs4_do_setlk(struct nfs4_st
- static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4062,7 +4062,7 @@ static int nfs4_lock_reclaim(struct nfs4
- static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, request);
-@@ -4120,7 +4120,7 @@ out:
- 
- static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4180,7 +4180,7 @@ nfs4_proc_lock(struct file *filp, int cm
- int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, fl);
-diff -urNp linux-2.6.32.12/fs/nfsd/lockd.c linux-2.6.32.12/fs/nfsd/lockd.c
---- linux-2.6.32.12/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/nfsd/lockd.c	2010-04-04 20:46:41.653544810 -0400
-@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
- 	fput(filp);
- }
- 
--static struct nlmsvc_binding	nfsd_nlm_ops = {
-+static const struct nlmsvc_binding	nfsd_nlm_ops = {
- 	.fopen		= nlm_fopen,		/* open file for locking */
- 	.fclose		= nlm_fclose,		/* close file */
- };
-diff -urNp linux-2.6.32.12/fs/nfsd/vfs.c linux-2.6.32.12/fs/nfsd/vfs.c
---- linux-2.6.32.12/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/nfsd/vfs.c	2010-04-04 20:46:41.657782339 -0400
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
- 	} else {
- 		oldfs = get_fs();
- 		set_fs(KERNEL_DS);
--		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
- 		set_fs(oldfs);
- 	}
- 
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
- 
- 	/* Write the data. */
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
- 	set_fs(oldfs);
- 	if (host_err < 0)
- 		goto out_nfserr;
-@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
- 	 */
- 
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
- 	set_fs(oldfs);
- 
- 	if (host_err < 0)
-diff -urNp linux-2.6.32.12/fs/nls/nls_base.c linux-2.6.32.12/fs/nls/nls_base.c
---- linux-2.6.32.12/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/nls/nls_base.c	2010-04-04 20:46:41.657782339 -0400
-@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
-     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
-     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
-     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
--    {0,						       /* end of table    */}
-+    {0, 0, 0, 0, 0,				       /* end of table    */}
- };
- 
- #define UNICODE_MAX	0x0010ffff
-diff -urNp linux-2.6.32.12/fs/ntfs/file.c linux-2.6.32.12/fs/ntfs/file.c
---- linux-2.6.32.12/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ntfs/file.c	2010-04-04 20:46:41.657782339 -0400
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
- #endif /* NTFS_RW */
- };
- 
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
- 
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.32.12/fs/ocfs2/cluster/masklog.c linux-2.6.32.12/fs/ocfs2/cluster/masklog.c
---- linux-2.6.32.12/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ocfs2/cluster/masklog.c	2010-04-04 20:46:41.657782339 -0400
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
- 	return mlog_mask_store(mlog_attr->mask, buf, count);
- }
- 
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- 	.show  = mlog_show,
- 	.store = mlog_store,
- };
-diff -urNp linux-2.6.32.12/fs/ocfs2/localalloc.c linux-2.6.32.12/fs/ocfs2/localalloc.c
---- linux-2.6.32.12/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ocfs2/localalloc.c	2010-04-04 20:46:41.657782339 -0400
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
- 		goto bail;
- 	}
- 
--	atomic_inc(&osb->alloc_stats.moves);
-+	atomic_inc_unchecked(&osb->alloc_stats.moves);
- 
- 	status = 0;
- bail:
-diff -urNp linux-2.6.32.12/fs/ocfs2/ocfs2.h linux-2.6.32.12/fs/ocfs2/ocfs2.h
---- linux-2.6.32.12/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ocfs2/ocfs2.h	2010-04-04 20:46:41.657782339 -0400
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
- 
- struct ocfs2_alloc_stats
- {
--	atomic_t moves;
--	atomic_t local_data;
--	atomic_t bitmap_data;
--	atomic_t bg_allocs;
--	atomic_t bg_extends;
-+	atomic_unchecked_t moves;
-+	atomic_unchecked_t local_data;
-+	atomic_unchecked_t bitmap_data;
-+	atomic_unchecked_t bg_allocs;
-+	atomic_unchecked_t bg_extends;
- };
- 
- enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.32.12/fs/ocfs2/suballoc.c linux-2.6.32.12/fs/ocfs2/suballoc.c
---- linux-2.6.32.12/fs/ocfs2/suballoc.c	2010-04-29 17:49:38.449086403 -0400
-+++ linux-2.6.32.12/fs/ocfs2/suballoc.c	2010-04-29 17:49:58.609026943 -0400
-@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
- 				mlog_errno(status);
- 			goto bail;
- 		}
--		atomic_inc(&osb->alloc_stats.bg_extends);
-+		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
- 
- 		/* You should never ask for this much metadata */
- 		BUG_ON(bits_wanted >
-@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- 	ac->ac_bits_given += (*num_bits);
-@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	BUG_ON(num_bits != 1);
- 
-@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 						      cluster_start,
- 						      num_clusters);
- 		if (!status)
--			atomic_inc(&osb->alloc_stats.local_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.local_data);
- 	} else {
- 		if (min_clusters > (osb->bitmap_cpg - 1)) {
- 			/* The only paths asking for contiguousness
-@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- 								 bg_blkno,
- 								 bg_bit_off);
--			atomic_inc(&osb->alloc_stats.bitmap_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- 		}
- 	}
- 	if (status < 0) {
-diff -urNp linux-2.6.32.12/fs/ocfs2/super.c linux-2.6.32.12/fs/ocfs2/super.c
---- linux-2.6.32.12/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/ocfs2/super.c	2010-04-04 20:46:41.657782339 -0400
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
- 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
- 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
- 			"Stats",
--			atomic_read(&osb->alloc_stats.bitmap_data),
--			atomic_read(&osb->alloc_stats.local_data),
--			atomic_read(&osb->alloc_stats.bg_allocs),
--			atomic_read(&osb->alloc_stats.moves),
--			atomic_read(&osb->alloc_stats.bg_extends));
-+			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+			atomic_read_unchecked(&osb->alloc_stats.local_data),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+			atomic_read_unchecked(&osb->alloc_stats.moves),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
- 
- 	out += snprintf(buf + out, len - out,
- 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
-@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
- 	spin_lock_init(&osb->osb_xattr_lock);
- 	ocfs2_init_inode_steal_slot(osb);
- 
--	atomic_set(&osb->alloc_stats.moves, 0);
--	atomic_set(&osb->alloc_stats.local_data, 0);
--	atomic_set(&osb->alloc_stats.bitmap_data, 0);
--	atomic_set(&osb->alloc_stats.bg_allocs, 0);
--	atomic_set(&osb->alloc_stats.bg_extends, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
- 
- 	/* Copy the blockcheck stats from the superblock probe */
- 	osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.32.12/fs/open.c linux-2.6.32.12/fs/open.c
---- linux-2.6.32.12/fs/open.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/open.c	2010-04-04 20:46:41.657782339 -0400
-@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
- 	if (length < 0)
- 		return -EINVAL;
- 
-+	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_size = length;
- 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
- 	if (filp) {
-@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
- 	if (__mnt_is_readonly(path.mnt))
- 		res = -EROFS;
- 
-+	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+		res = -EACCES;
-+
- out_path_release:
- 	path_put(&path);
- out:
-@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
- 	if (error)
- 		goto dput_and_out;
- 
-+	gr_log_chdir(path.dentry, path.mnt);
-+
- 	set_fs_pwd(current->fs, &path);
- 
- dput_and_out:
-@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
- 		goto out_putf;
- 
- 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+		error = -EPERM;
-+
-+	if (!error)
-+		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- 	if (!error)
- 		set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
- 	if (!capable(CAP_SYS_CHROOT))
- 		goto dput_and_out;
- 
-+	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+		goto dput_and_out;
-+
-+	if (gr_handle_chroot_caps(&path)) {
-+		error = -ENOMEM;
-+		goto dput_and_out;
-+	}
-+
- 	set_fs_root(current->fs, &path);
-+
-+	gr_handle_chroot_chdir(&path);
-+
- 	error = 0;
- dput_and_out:
- 	path_put(&path);
-@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
- 	err = mnt_want_write_file(file);
- 	if (err)
- 		goto out_putf;
-+
-+	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EPERM;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	err = notify_change(dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(file->f_path.mnt);
- out_putf:
- 	fput(file);
-@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto dput_and_out;
-+
-+	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	error = notify_change(path.dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(path.mnt);
- dput_and_out:
- 	path_put(&path);
-@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
- 	return sys_fchmodat(AT_FDCWD, filename, mode);
- }
- 
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- 	struct inode *inode = dentry->d_inode;
- 	int error;
- 	struct iattr newattrs;
- 
-+	if (!gr_acl_handle_chown(dentry, mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_valid =  ATTR_CTIME;
- 	if (user != (uid_t) -1) {
- 		newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
- 		goto out_fput;
- 	dentry = file->f_path.dentry;
- 	audit_inode(NULL, dentry);
--	error = chown_common(dentry, user, group);
-+	error = chown_common(dentry, user, group, file->f_path.mnt);
- 	mnt_drop_write(file->f_path.mnt);
- out_fput:
- 	fput(file);
-diff -urNp linux-2.6.32.12/fs/pipe.c linux-2.6.32.12/fs/pipe.c
---- linux-2.6.32.12/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/pipe.c	2010-04-04 20:46:41.657782339 -0400
-@@ -401,9 +401,9 @@ redo:
- 		}
- 		if (bufs)	/* More to do? */
- 			continue;
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			/* syscall merging: Usually we must not sleep
- 			 * if O_NONBLOCK is set, or if we got some data.
- 			 * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
- 
--	if (!pipe->readers) {
-+	if (!atomic_read(&pipe->readers)) {
- 		send_sig(SIGPIPE, current, 0);
- 		ret = -EPIPE;
- 		goto out;
-@@ -511,7 +511,7 @@ redo1:
- 	for (;;) {
- 		int bufs;
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 			do_wakeup = 0;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- out:
- 	mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
- 	mask = 0;
- 	if (filp->f_mode & FMODE_READ) {
- 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
--		if (!pipe->writers && filp->f_version != pipe->w_counter)
-+		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- 			mask |= POLLHUP;
- 	}
- 
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
- 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
- 		 * behave exactly like pipes for poll().
- 		 */
--		if (!pipe->readers)
-+		if (!atomic_read(&pipe->readers))
- 			mask |= POLLERR;
- 	}
- 
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
- 
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
--	pipe->readers -= decr;
--	pipe->writers -= decw;
-+	atomic_sub(decr, &pipe->readers);
-+	atomic_sub(decw, &pipe->writers);
- 
--	if (!pipe->readers && !pipe->writers) {
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- 		free_pipe_info(inode);
- 	} else {
- 		wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->readers++;
-+		atomic_inc(&inode->i_pipe->readers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->writers++;
-+		atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
- 	if (inode->i_pipe) {
- 		ret = 0;
- 		if (filp->f_mode & FMODE_READ)
--			inode->i_pipe->readers++;
-+			atomic_inc(&inode->i_pipe->readers);
- 		if (filp->f_mode & FMODE_WRITE)
--			inode->i_pipe->writers++;
-+			atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
- 	inode->i_pipe = NULL;
- }
- 
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- 	/*
-@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
- 		goto fail_iput;
- 	inode->i_pipe = pipe;
- 
--	pipe->readers = pipe->writers = 1;
-+	atomic_set(&pipe->readers, 1);
-+	atomic_set(&pipe->writers, 1);
- 	inode->i_fop = &rdwr_pipefifo_fops;
- 
- 	/*
-diff -urNp linux-2.6.32.12/fs/proc/array.c linux-2.6.32.12/fs/proc/array.c
---- linux-2.6.32.12/fs/proc/array.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/array.c	2010-04-04 20:46:41.657782339 -0400
-@@ -410,6 +410,21 @@ static void task_show_stack_usage(struct
- }
- #endif		/* CONFIG_MMU */
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+	if (p->mm)
-+		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+	else
-+		seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task)
- {
-@@ -430,9 +445,20 @@ int proc_pid_status(struct seq_file *m, 
- #endif
- 	task_context_switch_counts(m, task);
- 	task_show_stack_usage(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	task_pax(m, task);
-+#endif
-+
- 	return 0;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -529,6 +555,19 @@ static int do_task_stat(struct seq_file 
- 		gtime = task_gtime(task);
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (PAX_RAND_FLAGS(mm)) {
-+		eip = 0;
-+		esp = 0;
-+		wchan = 0;
-+	}
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	wchan = 0;
-+	eip =0;
-+	esp =0;
-+#endif
-+
- 	/* scale priority and nice values from timeslices to -20..20 */
- 	/* to make it look like a "normal" Unix priority/nice value  */
- 	priority = task_prio(task);
-@@ -569,9 +608,15 @@ static int do_task_stat(struct seq_file 
- 		vsize,
- 		mm ? get_mm_rss(mm) : 0,
- 		rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
-+#else
- 		mm ? mm->start_code : 0,
- 		mm ? mm->end_code : 0,
- 		(permitted && mm) ? task->stack_start : 0,
-+#endif
- 		esp,
- 		eip,
- 		/* The signal information here is obsolete.
-@@ -624,3 +669,10 @@ int proc_pid_statm(struct seq_file *m, s
- 
- 	return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
-+}
-+#endif
-diff -urNp linux-2.6.32.12/fs/proc/base.c linux-2.6.32.12/fs/proc/base.c
---- linux-2.6.32.12/fs/proc/base.c	2010-04-29 17:49:38.453075413 -0400
-+++ linux-2.6.32.12/fs/proc/base.c	2010-04-29 17:49:58.609026943 -0400
-@@ -102,6 +102,22 @@ struct pid_entry {
- 	union proc_op op;
- };
- 
-+struct getdents_callback {
-+	struct linux_dirent __user * current_dir;
-+	struct linux_dirent __user * previous;
-+	struct file * file;
-+	int count;
-+	int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
-+			   loff_t offset, u64 ino, unsigned int d_type)
-+{
-+	struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+	buf->error = -EINVAL;
-+	return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) {			\
- 	.name = (NAME),					\
- 	.len  = sizeof(NAME) - 1,			\
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
- 	if (task == current)
- 		return 0;
- 
-+	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+		return -EPERM;
-+
- 	/*
- 	 * If current is actively ptrace'ing, and would also be
- 	 * permitted to freshly attach with ptrace now, permit it.
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
- 	if (!mm->arg_end)
- 		goto out_mm;	/* Shh! No looking before we're done */
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out_mm;
-+
-  	len = mm->arg_end - mm->arg_start;
-  
- 	if (len > PAGE_SIZE)
-@@ -287,12 +309,26 @@ out:
- 	return res;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- 	int res = 0;
- 	struct mm_struct *mm = get_task_mm(task);
- 	if (mm) {
- 		unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (PAX_RAND_FLAGS(mm)) {
-+			mmput(mm);
-+			return res;
-+		}
-+#endif
-+
- 		do {
- 			nwords += 2;
- 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
- }
- #endif /* CONFIG_KALLSYMS */
- 
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 
- #define MAX_STACK_TRACE_DEPTH	64
- 
-@@ -522,7 +558,7 @@ static int proc_pid_limits(struct task_s
- 	return count;
- }
- 
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- 	long nr;
-@@ -936,6 +972,9 @@ static ssize_t environ_read(struct file 
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out;
-+
- 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
- 		goto out;
- 
-@@ -1456,7 +1495,11 @@ static struct inode *proc_pid_make_inode
- 		rcu_read_lock();
- 		cred = __task_cred(task);
- 		inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 		inode->i_gid = cred->egid;
-+#endif
- 		rcu_read_unlock();
- 	}
- 	security_task_to_inode(task, inode);
-@@ -1474,6 +1517,9 @@ static int pid_getattr(struct vfsmount *
- 	struct inode *inode = dentry->d_inode;
- 	struct task_struct *task;
- 	const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+#endif
- 
- 	generic_fillattr(inode, stat);
- 
-@@ -1481,12 +1527,34 @@ static int pid_getattr(struct vfsmount *
- 	stat->uid = 0;
- 	stat->gid = 0;
- 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+		rcu_read_unlock();
-+		return -ENOENT;
-+	}
-+
- 	if (task) {
-+		cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+		)
-+#endif
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
--			cred = __task_cred(task);
- 			stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			stat->gid = cred->egid;
-+#endif
- 		}
- 	}
- 	rcu_read_unlock();
-@@ -1518,11 +1586,20 @@ static int pid_revalidate(struct dentry 
- 
- 	if (task) {
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
- 			rcu_read_lock();
- 			cred = __task_cred(task);
- 			inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = cred->egid;
-+#endif
- 			rcu_read_unlock();
- 		} else {
- 			inode->i_uid = 0;
-@@ -1643,7 +1720,8 @@ static int proc_fd_info(struct inode *in
- 	int fd = proc_fd(inode);
- 
- 	if (task) {
--		files = get_files_struct(task);
-+		if (!gr_acl_handle_procpidmem(task))
-+			files = get_files_struct(task);
- 		put_task_struct(task);
- 	}
- 	if (files) {
-@@ -1895,12 +1973,22 @@ static const struct file_operations proc
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- 	int rv;
-+	struct task_struct *task;
- 
- 	rv = generic_permission(inode, mask, NULL);
--	if (rv == 0)
--		return 0;
-+
- 	if (task_pid(current) == proc_pid(inode))
- 		rv = 0;
-+
-+	task = get_proc_task(inode);
-+	if (task == NULL)
-+		return rv;
-+
-+	if (gr_acl_handle_procpidmem(task))
-+		rv = -EACCES;
-+
-+	put_task_struct(task);
-+
- 	return rv;
- }
- 
-@@ -2009,6 +2097,9 @@ static struct dentry *proc_pident_lookup
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	/*
- 	 * Yes, it does not scale. And it should not. Don't add
- 	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2053,6 +2144,9 @@ static int proc_pident_readdir(struct fi
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	ret = 0;
- 	i = filp->f_pos;
- 	switch (i) {
-@@ -2320,7 +2414,7 @@ static void *proc_self_follow_link(struc
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- 				void *cookie)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-@@ -2433,6 +2527,9 @@ static struct dentry *proc_base_lookup(s
- 	if (p > last)
- 		goto out;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	error = proc_base_instantiate(dir, dentry, task, p);
- 
- out:
-@@ -2519,7 +2616,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",    S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2547,7 +2644,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",      S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2577,6 +2674,9 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
- 
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2701,7 +2801,14 @@ static struct dentry *proc_pid_instantia
- 	if (!inode)
- 		goto out;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- 	inode->i_op = &proc_tgid_base_inode_operations;
- 	inode->i_fop = &proc_tgid_base_operations;
- 	inode->i_flags|=S_IMMUTABLE;
-@@ -2743,7 +2850,11 @@ struct dentry *proc_pid_lookup(struct in
- 	if (!task)
- 		goto out;
- 
-+	if (gr_check_hidden_task(task))
-+		goto out_put_task;
-+
- 	result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- 	put_task_struct(task);
- out:
- 	return result;
-@@ -2808,6 +2919,11 @@ int proc_pid_readdir(struct file * filp,
- {
- 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+	const struct cred *itercred;
-+#endif
-+	filldir_t __filldir = filldir;
- 	struct tgid_iter iter;
- 	struct pid_namespace *ns;
- 
-@@ -2826,8 +2942,27 @@ int proc_pid_readdir(struct file * filp,
- 	for (iter = next_tgid(ns, iter);
- 	     iter.task;
- 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		rcu_read_lock();
-+		itercred = __task_cred(iter.task);
-+#endif
-+		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+			)
-+#endif
-+		)
-+			__filldir = &gr_fake_filldir;
-+		else
-+			__filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	rcu_read_unlock();
-+#endif
- 		filp->f_pos = iter.tgid + TGID_OFFSET;
--		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- 			put_task_struct(iter.task);
- 			goto out;
- 		}
-@@ -2853,7 +2988,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",   S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -2880,7 +3015,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",     S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.32.12/fs/proc/cmdline.c linux-2.6.32.12/fs/proc/cmdline.c
---- linux-2.6.32.12/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/cmdline.c	2010-04-04 20:46:41.661529739 -0400
-@@ -23,7 +23,11 @@ static const struct file_operations cmdl
- 
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- 	return 0;
- }
- module_init(proc_cmdline_init);
-diff -urNp linux-2.6.32.12/fs/proc/devices.c linux-2.6.32.12/fs/proc/devices.c
---- linux-2.6.32.12/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/devices.c	2010-04-04 20:46:41.661529739 -0400
-@@ -64,7 +64,11 @@ static const struct file_operations proc
- 
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_devices_init);
-diff -urNp linux-2.6.32.12/fs/proc/inode.c linux-2.6.32.12/fs/proc/inode.c
---- linux-2.6.32.12/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/inode.c	2010-04-04 20:46:41.661529739 -0400
-@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
- 		if (de->mode) {
- 			inode->i_mode = de->mode;
- 			inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = de->gid;
-+#endif
- 		}
- 		if (de->size)
- 			inode->i_size = de->size;
-diff -urNp linux-2.6.32.12/fs/proc/internal.h linux-2.6.32.12/fs/proc/internal.h
---- linux-2.6.32.12/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/internal.h	2010-04-04 20:46:41.661529739 -0400
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
- 				struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- 				struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
- 
- extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.32.12/fs/proc/Kconfig linux-2.6.32.12/fs/proc/Kconfig
---- linux-2.6.32.12/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/Kconfig	2010-04-04 20:46:41.661529739 -0400
-@@ -30,12 +30,12 @@ config PROC_FS
- 
- config PROC_KCORE
- 	bool "/proc/kcore support" if !ARM
--	depends on PROC_FS && MMU
-+	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
- 
- config PROC_VMCORE
-         bool "/proc/vmcore support (EXPERIMENTAL)"
--        depends on PROC_FS && CRASH_DUMP
--	default y
-+        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+	default n
-         help
-         Exports the dump image of crashed kernel in ELF format.
- 
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- 	  limited in memory.
- 
- config PROC_PAGE_MONITOR
-- 	default y
--	depends on PROC_FS && MMU
-+ 	default n
-+	depends on PROC_FS && MMU && !GRKERNSEC
- 	bool "Enable /proc page monitoring" if EMBEDDED
-  	help
- 	  Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.32.12/fs/proc/kcore.c linux-2.6.32.12/fs/proc/kcore.c
---- linux-2.6.32.12/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/kcore.c	2010-04-04 20:46:41.661529739 -0400
-@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
- 
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	return -EPERM;
-+#endif
- 	if (!capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 	if (kcore_need_update)
-diff -urNp linux-2.6.32.12/fs/proc/meminfo.c linux-2.6.32.12/fs/proc/meminfo.c
---- linux-2.6.32.12/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/meminfo.c	2010-04-04 20:46:41.661529739 -0400
-@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
- 		vmi.used >> 10,
- 		vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
--		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- 		);
- 
-diff -urNp linux-2.6.32.12/fs/proc/nommu.c linux-2.6.32.12/fs/proc/nommu.c
---- linux-2.6.32.12/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/nommu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.12/fs/proc/proc_net.c linux-2.6.32.12/fs/proc/proc_net.c
---- linux-2.6.32.12/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/proc_net.c	2010-04-04 20:46:41.661529739 -0400
-@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
- 	struct task_struct *task;
- 	struct nsproxy *ns;
- 	struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	if (cred->fsuid)
-+		return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
-+		return net;
-+#endif
- 
- 	rcu_read_lock();
- 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.32.12/fs/proc/proc_sysctl.c linux-2.6.32.12/fs/proc/proc_sysctl.c
---- linux-2.6.32.12/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/proc_sysctl.c	2010-04-04 20:46:41.661529739 -0400
-@@ -7,6 +7,8 @@
- #include <linux/security.h>
- #include "internal.h"
- 
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
- static const struct inode_operations proc_sys_inode_operations;
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
- 	if (!p)
- 		goto out;
- 
-+	if (gr_handle_sysctl(p, MAY_EXEC))
-+		goto out;
-+
- 	err = ERR_PTR(-ENOMEM);
- 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- 	if (h)
-@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
- 		if (*pos < file->f_pos)
- 			continue;
- 
-+		if (gr_handle_sysctl(table, 0))
-+			continue;
-+
- 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- 		if (res)
- 			return res;
-@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
- 	if (IS_ERR(head))
- 		return PTR_ERR(head);
- 
-+	if (table && gr_handle_sysctl(table, MAY_EXEC))
-+		return -ENOENT;
-+
- 	generic_fillattr(inode, stat);
- 	if (table)
- 		stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.32.12/fs/proc/root.c linux-2.6.32.12/fs/proc/root.c
---- linux-2.6.32.12/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/root.c	2010-04-04 20:46:41.661529739 -0400
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- 	proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_mkdir("bus", NULL);
-+#endif
- 	proc_sys_init();
- }
- 
-diff -urNp linux-2.6.32.12/fs/proc/task_mmu.c linux-2.6.32.12/fs/proc/task_mmu.c
---- linux-2.6.32.12/fs/proc/task_mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/task_mmu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
- 		"VmStk:\t%8lu kB\n"
- 		"VmExe:\t%8lu kB\n"
- 		"VmLib:\t%8lu kB\n"
--		"VmPTE:\t%8lu kB\n",
--		hiwater_vm << (PAGE_SHIFT-10),
-+		"VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+		,hiwater_vm << (PAGE_SHIFT-10),
- 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- 		mm->locked_vm << (PAGE_SHIFT-10),
- 		hiwater_rss << (PAGE_SHIFT-10),
- 		total_rss << (PAGE_SHIFT-10),
- 		data << (PAGE_SHIFT-10),
- 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
--		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		, mm->context.user_cs_base, mm->context.user_cs_limit
-+#endif
-+
-+	);
- }
- 
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
- 	return ret;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- {
- 	struct mm_struct *mm = vma->vm_mm;
-@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
- 	}
- 
- 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
- 			vma->vm_start,
- 			vma->vm_end,
-+#endif
- 			flags & VM_READ ? 'r' : '-',
- 			flags & VM_WRITE ? 'w' : '-',
- 			flags & VM_EXEC ? 'x' : '-',
- 			flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- 			pgoff,
-+#endif
- 			MAJOR(dev), MINOR(dev), ino, &len);
- 
- 	/*
-@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
- 	 */
- 	if (file) {
- 		pad_len_spaces(m, len);
--		seq_path(m, &file->f_path, "\n");
-+		seq_path(m, &file->f_path, "\n\\");
- 	} else {
- 		const char *name = arch_vma_name(vma);
- 		if (!name) {
- 			if (mm) {
--				if (vma->vm_start <= mm->start_brk &&
--						vma->vm_end >= mm->brk) {
-+				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 					name = "[heap]";
--				} else if (vma->vm_start <= mm->start_stack &&
--					   vma->vm_end >= mm->start_stack) {
-+				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+					   (vma->vm_start <= mm->start_stack &&
-+					    vma->vm_end >= mm->start_stack)) {
- 					name = "[stack]";
- 				} else {
- 					unsigned long stack_start;
-@@ -403,9 +429,16 @@ static int show_smap(struct seq_file *m,
- 	};
- 
- 	memset(&mss, 0, sizeof mss);
--	mss.vma = vma;
--	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
--		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+		mss.vma = vma;
-+		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	}
-+#endif
- 
- 	show_map_vma(m, vma);
- 
-@@ -421,7 +454,11 @@ static int show_smap(struct seq_file *m,
- 		   "Swap:           %8lu kB\n"
- 		   "KernelPageSize: %8lu kB\n"
- 		   "MMUPageSize:    %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- 		   (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- 		   mss.resident >> 10,
- 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- 		   mss.shared_clean  >> 10,
-diff -urNp linux-2.6.32.12/fs/proc/task_nommu.c linux-2.6.32.12/fs/proc/task_nommu.c
---- linux-2.6.32.12/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/proc/task_nommu.c	2010-04-04 20:46:41.661529739 -0400
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
- 	else
- 		bytes += kobjsize(mm);
- 	
--	if (current->fs && current->fs->users > 1)
-+	if (current->fs && atomic_read(&current->fs->users) > 1)
- 		sbytes += kobjsize(current->fs);
- 	else
- 		bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.12/fs/readdir.c linux-2.6.32.12/fs/readdir.c
---- linux-2.6.32.12/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/readdir.c	2010-04-04 20:46:41.661529739 -0400
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
- 
- struct readdir_callback {
- 	struct old_linux_dirent __user * dirent;
-+	struct file * file;
- 	int result;
- };
- 
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
- 		buf->result = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	buf->result++;
- 	dirent = buf->dirent;
- 	if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
- 
- 	buf.result = 0;
- 	buf.dirent = dirent;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, fillonedir, &buf);
- 	if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- 	struct linux_dirent __user * current_dir;
- 	struct linux_dirent __user * previous;
-+	struct file * file;
- 	int count;
- 	int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
- 		buf->error = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
- 	buf.previous = NULL;
- 	buf.count = count;
- 	buf.error = 0;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, filldir, &buf);
- 	if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- 	struct linux_dirent64 __user * current_dir;
- 	struct linux_dirent64 __user * previous;
-+	struct file *file;
- 	int count;
- 	int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
- 	buf->error = -EINVAL;	/* only used if we fail.. */
- 	if (reclen > buf->count)
- 		return -EINVAL;
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
- 
- 	buf.current_dir = dirent;
- 	buf.previous = NULL;
-+	buf.file = file;
- 	buf.count = count;
- 	buf.error = 0;
- 
-diff -urNp linux-2.6.32.12/fs/reiserfs/do_balan.c linux-2.6.32.12/fs/reiserfs/do_balan.c
---- linux-2.6.32.12/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/reiserfs/do_balan.c	2010-04-04 20:46:41.661529739 -0400
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
- 		return;
- 	}
- 
--	atomic_inc(&(fs_generation(tb->tb_sb)));
-+	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- 	do_balance_starts(tb);
- 
- 	/* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.32.12/fs/reiserfs/item_ops.c linux-2.6.32.12/fs/reiserfs/item_ops.c
---- linux-2.6.32.12/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/reiserfs/item_ops.c	2010-04-04 20:46:41.661529739 -0400
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- 	.bytes_number = sd_bytes_number,
- 	.decrement_key = sd_decrement_key,
- 	.is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- 	.bytes_number = direct_bytes_number,
- 	.decrement_key = direct_decrement_key,
- 	.is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- 	.bytes_number = indirect_bytes_number,
- 	.decrement_key = indirect_decrement_key,
- 	.is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
- 	printk("\n");
- }
- 
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- 	.bytes_number = direntry_bytes_number,
- 	.decrement_key = direntry_decrement_key,
- 	.is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
- 			 "Invalid item type observed, run fsck ASAP");
- }
- 
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- 	errcatch_bytes_number,
- 	errcatch_decrement_key,
- 	errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
- #error Item types must use disk-format assigned values.
- #endif
- 
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- 	&stat_data_ops,
- 	&indirect_ops,
- 	&direct_ops,
-diff -urNp linux-2.6.32.12/fs/reiserfs/procfs.c linux-2.6.32.12/fs/reiserfs/procfs.c
---- linux-2.6.32.12/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/reiserfs/procfs.c	2010-04-04 20:46:41.661529739 -0400
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
- 		   "SMALL_TAILS " : "NO_TAILS ",
- 		   replay_only(sb) ? "REPLAY_ONLY " : "",
- 		   convert_reiserfs(sb) ? "CONV " : "",
--		   atomic_read(&r->s_generation_counter),
-+		   atomic_read_unchecked(&r->s_generation_counter),
- 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
- 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
-diff -urNp linux-2.6.32.12/fs/select.c linux-2.6.32.12/fs/select.c
---- linux-2.6.32.12/fs/select.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/select.c	2010-04-04 20:46:41.661529739 -0400
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
-  	struct poll_list *walk = head;
-  	unsigned long todo = nfds;
- 
-+	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EINVAL;
- 
-diff -urNp linux-2.6.32.12/fs/seq_file.c linux-2.6.32.12/fs/seq_file.c
---- linux-2.6.32.12/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/seq_file.c	2010-04-04 20:46:41.661529739 -0400
-@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
- 		return 0;
- 	}
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			return -ENOMEM;
- 	}
-@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
- Eoverflow:
- 	m->op->stop(m, p);
- 	kfree(m->buf);
--	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+	m->size <<= 1;
-+	m->buf = kmalloc(m->size, GFP_KERNEL);
- 	return !m->buf ? -ENOMEM : -EAGAIN;
- }
- 
-@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
- 	m->version = file->f_version;
- 	/* grab buffer if we didn't have one */
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 	}
-@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
- 			goto Fill;
- 		m->op->stop(m, p);
- 		kfree(m->buf);
--		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+		m->size <<= 1;
-+		m->buf = kmalloc(m->size, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 		m->count = 0;
-diff -urNp linux-2.6.32.12/fs/smbfs/symlink.c linux-2.6.32.12/fs/smbfs/symlink.c
---- linux-2.6.32.12/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/smbfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
- 
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-diff -urNp linux-2.6.32.12/fs/splice.c linux-2.6.32.12/fs/splice.c
---- linux-2.6.32.12/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/splice.c	2010-04-04 20:46:41.661529739 -0400
-@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
- 	pipe_lock(pipe);
- 
- 	for (;;) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
- 			do_wakeup = 0;
- 		}
- 
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_write(file, (const char __user *)buf, count, &pos);
-+	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
- 			goto err;
- 
- 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
--		vec[i].iov_base = (void __user *) page_address(page);
-+		vec[i].iov_base = (__force void __user *) page_address(page);
- 		vec[i].iov_len = this_len;
- 		pages[i] = page;
- 		spd.nr_pages++;
-@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- 	while (!pipe->nrbufs) {
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			return 0;
- 
--		if (!pipe->waiting_writers && sd->num_spliced)
-+		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- 			return 0;
- 
- 		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
- 		 * out of the pipe right after the splice_to_pipe(). So set
- 		 * PIPE_READERS appropriately.
- 		 */
--		pipe->readers = 1;
-+		atomic_set(&pipe->readers, 1);
- 
- 		current->splice_pipe = pipe;
- 	}
-@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			if (flags & SPLICE_F_NONBLOCK) {
- 				ret = -EAGAIN;
- 				break;
-@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
- 	pipe_lock(pipe);
- 
- 	while (pipe->nrbufs >= PIPE_BUFFERS) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			ret = -EPIPE;
- 			break;
-@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -1789,14 +1789,14 @@ retry:
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
- 			break;
- 		}
- 
--		if (!ipipe->nrbufs && !ipipe->writers)
-+		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- 			break;
- 
- 		/*
-@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
- 	 * return EAGAIN if we have the potential of some data in the
- 	 * future, otherwise just return 0
- 	 */
--	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- 		ret = -EAGAIN;
- 
- 	pipe_unlock(ipipe);
-diff -urNp linux-2.6.32.12/fs/sysfs/file.c linux-2.6.32.12/fs/sysfs/file.c
---- linux-2.6.32.12/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/sysfs/file.c	2010-04-04 20:46:41.661529739 -0400
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- 	size_t			count;
- 	loff_t			pos;
- 	char			* page;
--	struct sysfs_ops	* ops;
-+	const struct sysfs_ops	* ops;
- 	struct mutex		mutex;
- 	int			needs_read_fill;
- 	int			event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int ret = 0;
- 	ssize_t count;
- 
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int rc;
- 
- 	/* need attr_sd for attr and ops, its parent for kobj */
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
- 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- 	struct sysfs_buffer *buffer;
--	struct sysfs_ops *ops;
-+	const struct sysfs_ops *ops;
- 	int error = -EACCES;
- 	char *p;
- 
-diff -urNp linux-2.6.32.12/fs/sysfs/symlink.c linux-2.6.32.12/fs/sysfs/symlink.c
---- linux-2.6.32.12/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/sysfs/symlink.c	2010-04-04 20:46:41.661529739 -0400
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
- 
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
--	char *page = nd_get_link(nd);
-+	const char *page = nd_get_link(nd);
- 	if (!IS_ERR(page))
- 		free_page((unsigned long)page);
- }
-diff -urNp linux-2.6.32.12/fs/udf/balloc.c linux-2.6.32.12/fs/udf/balloc.c
---- linux-2.6.32.12/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/udf/balloc.c	2010-04-04 20:46:41.665784997 -0400
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- 			  count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- 			  partmap->s_partition_len);
-diff -urNp linux-2.6.32.12/fs/udf/misc.c linux-2.6.32.12/fs/udf/misc.c
---- linux-2.6.32.12/fs/udf/misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/udf/misc.c	2010-04-29 17:46:37.289044536 -0400
-@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
- 		iinfo->i_lenEAttr += size;
- 		return (struct genericFormat *)&ea[offset];
- 	}
--	if (loc & 0x02)
--		;
-+	if (loc & 0x02) {
-+	}
- 
- 	return NULL;
- }
-diff -urNp linux-2.6.32.12/fs/udf/udfdecl.h linux-2.6.32.12/fs/udf/udfdecl.h
---- linux-2.6.32.12/fs/udf/udfdecl.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/udf/udfdecl.h	2010-04-29 17:46:37.289044536 -0400
-@@ -26,7 +26,7 @@ do { \
- 	printk(f, ##a); \
- } while (0)
- #else
--#define udf_debug(f, a...) /**/
-+#define udf_debug(f, a...) do {} while (0)
- #endif
- 
- #define udf_info(f, a...) \
-diff -urNp linux-2.6.32.12/fs/utimes.c linux-2.6.32.12/fs/utimes.c
---- linux-2.6.32.12/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/utimes.c	2010-04-04 20:46:41.665784997 -0400
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
- 				goto mnt_drop_write_and_out;
- 		}
- 	}
-+
-+	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+		error = -EACCES;
-+		goto mnt_drop_write_and_out;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	error = notify_change(path->dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/xfs/linux-2.6/xfs_ioctl.c	2010-04-04 20:46:41.665784997 -0400
-@@ -134,7 +134,7 @@ xfs_find_handle(
- 	}
- 
- 	error = -EFAULT;
--	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- 		goto out_put;
- 
-diff -urNp linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:38.453075413 -0400
-+++ linux-2.6.32.12/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:58.609026943 -0400
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- 	struct nameidata *nd,
- 	void		*p)
- {
--	char		*s = nd_get_link(nd);
-+	const char	*s = nd_get_link(nd);
- 
- 	if (!IS_ERR(s))
- 		kfree(s);
-diff -urNp linux-2.6.32.12/fs/xfs/xfs_bmap.c linux-2.6.32.12/fs/xfs/xfs_bmap.c
---- linux-2.6.32.12/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/fs/xfs/xfs_bmap.c	2010-04-04 20:46:41.665784997 -0400
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- 	int			nmap,
- 	int			ret_nmap);
- #else
--#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
- 
- #if defined(XFS_RW_TRACE)
-diff -urNp linux-2.6.32.12/grsecurity/gracl_alloc.c linux-2.6.32.12/grsecurity/gracl_alloc.c
---- linux-2.6.32.12/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_alloc.c	2010-04-04 20:46:41.665784997 -0400
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+	if (alloc_stack_next == 1)
-+		return 0;
-+
-+	kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+	alloc_stack_next--;
-+
-+	return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+	if (alloc_stack_next >= alloc_stack_size)
-+		return 1;
-+
-+	alloc_stack[alloc_stack_next - 1] = buf;
-+
-+	alloc_stack_next++;
-+
-+	return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+	void *ret = NULL;
-+
-+	if (!len || len > PAGE_SIZE)
-+		goto out;
-+
-+	ret = kmalloc(len, GFP_KERNEL);
-+
-+	if (ret) {
-+		if (alloc_push(ret)) {
-+			kfree(ret);
-+			ret = NULL;
-+		}
-+	}
-+
-+out:
-+	return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+	if (!len || (num > (PAGE_SIZE / len)))
-+		return NULL;
-+
-+	return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+	if (gr_acl_is_enabled() || !alloc_stack)
-+		return;
-+
-+	while (alloc_pop()) ;
-+
-+	if (alloc_stack) {
-+		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+			kfree(alloc_stack);
-+		else
-+			vfree(alloc_stack);
-+	}
-+
-+	alloc_stack = NULL;
-+	alloc_stack_size = 1;
-+	alloc_stack_next = 1;
-+
-+	return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+	if ((size * sizeof (void *)) <= PAGE_SIZE)
-+		alloc_stack =
-+		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+	else
-+		alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+	alloc_stack_size = size;
-+
-+	if (!alloc_stack)
-+		return 0;
-+	else
-+		return 1;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/gracl.c linux-2.6.32.12/grsecurity/gracl.c
---- linux-2.6.32.12/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl.c	2010-04-29 17:48:04.497204424 -0400
-@@ -0,0 +1,3897 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+   can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DECLARE_MUTEX(gr_dev_sem);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+			    const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+extern struct vfsmount *sock_mnt;
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+	return (gr_status & GR_READY);
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+	switch (current->role->roletype &
-+		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+		 GR_ROLE_SPECIAL)) {
-+	case GR_ROLE_DEFAULT:
-+		return 'D';
-+	case GR_ROLE_USER:
-+		return 'U';
-+	case GR_ROLE_GROUP:
-+		return 'G';
-+	case GR_ROLE_SPECIAL:
-+		return 'S';
-+	}
-+
-+	return 'X';
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+	if (current->role->roletype & GR_ROLE_TPE)
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (inode && S_ISBLK(inode->i_mode) &&
-+	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+	    !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+	if (likely(lena != lenb))
-+		return 0;
-+
-+	return !memcmp(a, b, lena);
-+}
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+	                   struct dentry *root, struct vfsmount *rootmnt,
-+			   char *buffer, int buflen)
-+{
-+	char * end = buffer+buflen;
-+	char * retval;
-+	int namelen;
-+
-+	*--end = '\0';
-+	buflen--;
-+
-+	if (buflen < 1)
-+		goto Elong;
-+	/* Get '/' right */
-+	retval = end-1;
-+	*retval = '/';
-+
-+	for (;;) {
-+		struct dentry * parent;
-+
-+		if (dentry == root && vfsmnt == rootmnt)
-+			break;
-+		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+			/* Global root? */
-+			spin_lock(&vfsmount_lock);
-+			if (vfsmnt->mnt_parent == vfsmnt) {
-+				spin_unlock(&vfsmount_lock);
-+				goto global_root;
-+			}
-+			dentry = vfsmnt->mnt_mountpoint;
-+			vfsmnt = vfsmnt->mnt_parent;
-+			spin_unlock(&vfsmount_lock);
-+			continue;
-+		}
-+		parent = dentry->d_parent;
-+		prefetch(parent);
-+		namelen = dentry->d_name.len;
-+		buflen -= namelen + 1;
-+		if (buflen < 0)
-+			goto Elong;
-+		end -= namelen;
-+		memcpy(end, dentry->d_name.name, namelen);
-+		*--end = '/';
-+		retval = end;
-+		dentry = parent;
-+	}
-+
-+	return retval;
-+
-+global_root:
-+	namelen = dentry->d_name.len;
-+	buflen -= namelen;
-+	if (buflen < 0)
-+		goto Elong;
-+	retval -= namelen-1;	/* hit the slash */
-+	memcpy(retval, dentry->d_name.name, namelen);
-+	return retval;
-+Elong:
-+	return ERR_PTR(-ENAMETOOLONG);
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+	char *retval;
-+
-+	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+	if (unlikely(IS_ERR(retval)))
-+		retval = strcpy(buf, "<path too long>");
-+	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+		retval[1] = '\0';
-+
-+	return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+		char *buf, int buflen)
-+{
-+	char *res;
-+
-+	/* we can use real_root, real_root_mnt, because this is only called
-+	   by the RBAC system */
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+	return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+	    char *buf, int buflen)
-+{
-+	char *res;
-+	struct dentry *root;
-+	struct vfsmount *rootmnt;
-+	struct task_struct *reaper = &init_task;
-+
-+	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+	read_lock(&reaper->fs->lock);
-+	root = dget(reaper->fs->root.dentry);
-+	rootmnt = mntget(reaper->fs->root.mnt);
-+	read_unlock(&reaper->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+	spin_unlock(&dcache_lock);
-+
-+	dput(root);
-+	mntput(rootmnt);
-+	return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	char *ret;
-+	spin_lock(&dcache_lock);
-+	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+	spin_unlock(&dcache_lock);
-+	return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+	/* masks off auditable permission flags, then shifts them to create
-+	   auditing flags, and adds the special case of append auditing if
-+	   we're requesting write */
-+	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+	unsigned int index = shash(userp, subj_map_set.s_size);
-+	struct subject_map *match;
-+
-+	match = subj_map_set.s_hash[index];
-+
-+	while (match && match->user != userp)
-+		match = match->next;
-+
-+	if (match != NULL)
-+		return match->kernel;
-+	else
-+		return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
-+	struct subject_map **curr;
-+
-+	subjmap->prev = NULL;
-+
-+	curr = &subj_map_set.s_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = subjmap;
-+
-+	subjmap->next = *curr;
-+	*curr = subjmap;
-+
-+	return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+		      const gid_t gid)
-+{
-+	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+	struct acl_role_label *match;
-+	struct role_allowed_ip *ipp;
-+	unsigned int x;
-+
-+	match = acl_role_set.r_hash[index];
-+
-+	while (match) {
-+		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+			for (x = 0; x < match->domain_child_num; x++) {
-+				if (match->domain_children[x] == uid)
-+					goto found;
-+			}
-+		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+			break;
-+		match = match->next;
-+	}
-+found:
-+	if (match == NULL) {
-+	      try_group:
-+		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+		match = acl_role_set.r_hash[index];
-+
-+		while (match) {
-+			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+				for (x = 0; x < match->domain_child_num; x++) {
-+					if (match->domain_children[x] == gid)
-+						goto found2;
-+				}
-+			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+				break;
-+			match = match->next;
-+		}
-+found2:
-+		if (match == NULL)
-+			match = default_role;
-+		if (match->allowed_ips == NULL)
-+			return match;
-+		else {
-+			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+				if (likely
-+				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+				     (ntohl(ipp->addr) & ipp->netmask)))
-+					return match;
-+			}
-+			match = default_role;
-+		}
-+	} else if (match->allowed_ips == NULL) {
-+		return match;
-+	} else {
-+		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+			if (likely
-+			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+			     (ntohl(ipp->addr) & ipp->netmask)))
-+				return match;
-+		}
-+		goto try_group;
-+	}
-+
-+	return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+		      const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+			  const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 !match->deleted))
-+		match = match->next;
-+
-+	if (match && match->deleted)
-+		return match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 match->deleted))
-+		match = match->next;
-+
-+	if (match && !match->deleted)
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+	unsigned int index = fhash(ino, dev, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
-+				    inodev_set.i_size);
-+	struct inodev_entry **curr;
-+
-+	entry->prev = NULL;
-+
-+	curr = &inodev_set.i_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = entry;
-+	
-+	entry->next = *curr;
-+	*curr = entry;
-+
-+	return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+	unsigned int index =
-+	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+	struct acl_role_label **curr;
-+	struct acl_role_label *tmp;
-+
-+	curr = &acl_role_set.r_hash[index];
-+
-+	/* if role was already inserted due to domains and already has
-+	   a role in the same bucket as it attached, then we need to
-+	   combine these two buckets
-+	*/
-+	if (role->next) {
-+		tmp = role->next;
-+		while (tmp->next)
-+			tmp = tmp->next;
-+		tmp->next = *curr;
-+	} else
-+		role->next = *curr;
-+	*curr = role;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+	int i;
-+
-+	if (role_list == NULL) {
-+		role_list = role;
-+		role->prev = NULL;
-+	} else {
-+		role->prev = role_list;
-+		role_list = role;
-+	}
-+	
-+	/* used for hash chains */
-+	role->next = NULL;
-+
-+	if (role->roletype & GR_ROLE_DOMAIN) {
-+		for (i = 0; i < role->domain_child_num; i++)
-+			__insert_acl_role_label(role, role->domain_children[i]);
-+	} else
-+		__insert_acl_role_label(role, role->uidgid);
-+}
-+					
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+	struct name_entry **curr, *nentry;
-+	struct inodev_entry *ientry;
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+
-+	curr = &name_set.n_hash[index];
-+
-+	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+		curr = &((*curr)->next);
-+
-+	if (*curr != NULL)
-+		return 1;
-+
-+	nentry = acl_alloc(sizeof (struct name_entry));
-+	if (nentry == NULL)
-+		return 0;
-+	ientry = acl_alloc(sizeof (struct inodev_entry));
-+	if (ientry == NULL)
-+		return 0;
-+	ientry->nentry = nentry;
-+
-+	nentry->key = key;
-+	nentry->name = name;
-+	nentry->inode = inode;
-+	nentry->device = device;
-+	nentry->len = len;
-+	nentry->deleted = deleted;
-+
-+	nentry->prev = NULL;
-+	curr = &name_set.n_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = nentry;
-+	nentry->next = *curr;
-+	*curr = nentry;
-+
-+	/* insert us into the table searchable by inode/dev */
-+	insert_inodev_entry(ientry);
-+
-+	return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index =
-+	    fhash(obj->inode, obj->device, subj->obj_hash_size);
-+	struct acl_object_label **curr;
-+
-+	
-+	obj->prev = NULL;
-+
-+	curr = &subj->obj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
-+	struct acl_subject_label **curr;
-+
-+	obj->prev = NULL;
-+
-+	curr = &role->subj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+	unsigned int table_sizes[] = {
-+		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+		4194301, 8388593, 16777213, 33554393, 67108859
-+	};
-+	void *newtable = NULL;
-+	unsigned int pwr = 0;
-+
-+	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+	       table_sizes[pwr] <= *len)
-+		pwr++;
-+
-+	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+		return newtable;
-+
-+	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+		newtable =
-+		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+	else
-+		newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+	*len = table_sizes[pwr];
-+
-+	return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+	struct task_struct *reaper = &init_task;
-+	unsigned int stacksize;
-+
-+	subj_map_set.s_size = arg->role_db.num_subjects;
-+	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+	name_set.n_size = arg->role_db.num_objects;
-+	inodev_set.i_size = arg->role_db.num_objects;
-+
-+	if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+	    !name_set.n_size || !inodev_set.i_size)
-+		return 1;
-+
-+	if (!gr_init_uidset())
-+		return 1;
-+
-+	/* set up the stack that holds allocation info */
-+
-+	stacksize = arg->role_db.num_pointers + 5;
-+
-+	if (!acl_alloc_stack_init(stacksize))
-+		return 1;
-+
-+	/* grab reference for the real root dentry and vfsmount */
-+	read_lock(&reaper->fs->lock);
-+	real_root_mnt = mntget(reaper->fs->root.mnt);
-+	real_root = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+	
-+	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
-+	if (fakefs_obj == NULL)
-+		return 1;
-+	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+	subj_map_set.s_hash =
-+	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+	acl_role_set.r_hash =
-+	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+	inodev_set.i_hash =
-+	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+	    !name_set.n_hash || !inodev_set.i_hash)
-+		return 1;
-+
-+	memset(subj_map_set.s_hash, 0,
-+	       sizeof(struct subject_map *) * subj_map_set.s_size);
-+	memset(acl_role_set.r_hash, 0,
-+	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+	memset(name_set.n_hash, 0,
-+	       sizeof (struct name_entry *) * name_set.n_size);
-+	memset(inodev_set.i_hash, 0,
-+	       sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+	return 0;
-+}
-+
-+/* free information not needed after startup
-+   currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+	__u32 i;
-+
-+	if (subj_map_set.s_hash) {
-+		for (i = 0; i < subj_map_set.s_size; i++) {
-+			if (subj_map_set.s_hash[i]) {
-+				kfree(subj_map_set.s_hash[i]);
-+				subj_map_set.s_hash[i] = NULL;
-+			}
-+		}
-+
-+		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+		    PAGE_SIZE)
-+			kfree(subj_map_set.s_hash);
-+		else
-+			vfree(subj_map_set.s_hash);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+	struct acl_subject_label *s;
-+	struct acl_role_label *r;
-+	struct task_struct *task, *task2;
-+	unsigned int x;
-+
-+	gr_clear_learn_entries();
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(task2, task) {
-+		task->acl_sp_role = 0;
-+		task->acl_role_id = 0;
-+		task->acl = NULL;
-+		task->role = NULL;
-+	} while_each_thread(task2, task);
-+	read_unlock(&tasklist_lock);
-+
-+	/* release the reference to the real root dentry and vfsmount */
-+	if (real_root)
-+		dput(real_root);
-+	real_root = NULL;
-+	if (real_root_mnt)
-+		mntput(real_root_mnt);
-+	real_root_mnt = NULL;
-+
-+	/* free all object hash tables */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (r->subj_hash == NULL)
-+			goto next_role;
-+		FOR_EACH_SUBJECT_START(r, s, x)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_SUBJECT_END(s, x)
-+		FOR_EACH_NESTED_SUBJECT_START(r, s)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_NESTED_SUBJECT_END(s)
-+		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+			kfree(r->subj_hash);
-+		else
-+			vfree(r->subj_hash);
-+		r->subj_hash = NULL;
-+next_role:
-+	FOR_EACH_ROLE_END(r)
-+
-+	acl_free_all();
-+
-+	if (acl_role_set.r_hash) {
-+		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+		    PAGE_SIZE)
-+			kfree(acl_role_set.r_hash);
-+		else
-+			vfree(acl_role_set.r_hash);
-+	}
-+	if (name_set.n_hash) {
-+		if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(name_set.n_hash);
-+		else
-+			vfree(name_set.n_hash);
-+	}
-+
-+	if (inodev_set.i_hash) {
-+		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(inodev_set.i_hash);
-+		else
-+			vfree(inodev_set.i_hash);
-+	}
-+
-+	gr_free_uidset();
-+
-+	memset(&name_set, 0, sizeof (struct name_db));
-+	memset(&inodev_set, 0, sizeof (struct inodev_db));
-+	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+	default_role = NULL;
-+	role_list = NULL;
-+
-+	return;
-+}
-+
-+static __u32
-+count_user_objs(struct acl_object_label *userp)
-+{
-+	struct acl_object_label o_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			break;
-+
-+		userp = o_tmp.prev;
-+		num++;
-+	}
-+
-+	return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+	struct acl_object_label *g_tmp, **guser;
-+	unsigned int len;
-+	char *tmp;
-+
-+	if (obj->globbed == NULL)
-+		return 0;
-+
-+	guser = &obj->globbed;
-+	while (*guser) {
-+		g_tmp = (struct acl_object_label *)
-+			acl_alloc(sizeof (struct acl_object_label));
-+		if (g_tmp == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(g_tmp, *guser,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		len = strnlen_user(g_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, g_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		g_tmp->filename = tmp;
-+
-+		*guser = g_tmp;
-+		guser = &(g_tmp->next);
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+	       struct acl_role_label *role)
-+{
-+	struct acl_object_label *o_tmp;
-+	unsigned int len;
-+	int ret;
-+	char *tmp;
-+
-+	while (userp) {
-+		if ((o_tmp = (struct acl_object_label *)
-+		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		userp = o_tmp->prev;
-+
-+		len = strnlen_user(o_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, o_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		o_tmp->filename = tmp;
-+
-+		insert_acl_obj_label(o_tmp, subj);
-+		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+			return -ENOMEM;
-+
-+		ret = copy_user_glob(o_tmp);
-+		if (ret)
-+			return ret;
-+
-+		if (o_tmp->nested) {
-+			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
-+			if (IS_ERR(o_tmp->nested))
-+				return PTR_ERR(o_tmp->nested);
-+
-+			/* insert into nested subject list */
-+			o_tmp->nested->next = role->hash->first;
-+			role->hash->first = o_tmp->nested;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+	struct acl_subject_label s_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_tmp, userp,
-+				   sizeof (struct acl_subject_label)))
-+			break;
-+
-+		userp = s_tmp.prev;
-+		/* do not count nested subjects against this count, since
-+		   they are not included in the hash table, but are
-+		   attached to objects.  We have already counted
-+		   the subjects in userspace for the allocation 
-+		   stack
-+		*/
-+		if (!(s_tmp.mode & GR_NESTED))
-+			num++;
-+	}
-+
-+	return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+	ruserip = rolep->allowed_ips;
-+
-+	while (ruserip) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_allowed_ip *)
-+		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, ruserip,
-+				   sizeof (struct role_allowed_ip)))
-+			return -EFAULT;
-+
-+		ruserip = rtmp->prev;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->allowed_ips = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!ruserip)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+	struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+	
-+	unsigned int len;
-+	char *tmp;
-+
-+	rusertp = rolep->transitions;
-+
-+	while (rusertp) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_transition *)
-+		     acl_alloc(sizeof (struct role_transition))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, rusertp,
-+				   sizeof (struct role_transition)))
-+			return -EFAULT;
-+
-+		rusertp = rtmp->prev;
-+
-+		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, rtmp->rolename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		rtmp->rolename = tmp;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->transitions = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!rusertp)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+	unsigned int len;
-+	char *tmp;
-+	__u32 num_objs;
-+	struct acl_ip_label **i_tmp, *i_utmp2;
-+	struct gr_hash_struct ghash;
-+	struct subject_map *subjmap;
-+	unsigned int i_num;
-+	int err;
-+
-+	s_tmp = lookup_subject_map(userp);
-+
-+	/* we've already copied this subject into the kernel, just return
-+	   the reference to it, and don't copy it over again
-+	*/
-+	if (s_tmp)
-+		return(s_tmp);
-+
-+	if ((s_tmp = (struct acl_subject_label *)
-+	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+	if (subjmap == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap->user = userp;
-+	subjmap->kernel = s_tmp;
-+	insert_subj_map_entry(subjmap);
-+
-+	if (copy_from_user(s_tmp, userp,
-+			   sizeof (struct acl_subject_label)))
-+		return ERR_PTR(-EFAULT);
-+
-+	len = strnlen_user(s_tmp->filename, PATH_MAX);
-+
-+	if (!len || len >= PATH_MAX)
-+		return ERR_PTR(-EINVAL);
-+
-+	if ((tmp = (char *) acl_alloc(len)) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	if (copy_from_user(tmp, s_tmp->filename, len))
-+		return ERR_PTR(-EFAULT);
-+	tmp[len-1] = '\0';
-+	s_tmp->filename = tmp;
-+
-+	if (!strcmp(s_tmp->filename, "/"))
-+		role->root_label = s_tmp;
-+
-+	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
-+		return ERR_PTR(-EFAULT);
-+
-+	/* copy user and group transition tables */
-+
-+	if (s_tmp->user_trans_num) {
-+		uid_t *uidlist;
-+
-+		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+		if (uidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->user_transitions = uidlist;
-+	}
-+
-+	if (s_tmp->group_trans_num) {
-+		gid_t *gidlist;
-+
-+		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+		if (gidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->group_transitions = gidlist;
-+	}
-+
-+	/* set up object hash table */
-+	num_objs = count_user_objs(ghash.first);
-+
-+	s_tmp->obj_hash_size = num_objs;
-+	s_tmp->obj_hash =
-+	    (struct acl_object_label **)
-+	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+	if (!s_tmp->obj_hash)
-+		return ERR_PTR(-ENOMEM);
-+
-+	memset(s_tmp->obj_hash, 0,
-+	       s_tmp->obj_hash_size *
-+	       sizeof (struct acl_object_label *));
-+
-+	/* add in objects */
-+	err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+	if (err)
-+		return ERR_PTR(err);
-+
-+	/* set pointer for parent subject */
-+	if (s_tmp->parent_subject) {
-+		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
-+
-+		if (IS_ERR(s_tmp2))
-+			return s_tmp2;
-+
-+		s_tmp->parent_subject = s_tmp2;
-+	}
-+
-+	/* add in ip acls */
-+
-+	if (!s_tmp->ip_num) {
-+		s_tmp->ips = NULL;
-+		goto insert;
-+	}
-+
-+	i_tmp =
-+	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+					       sizeof (struct acl_ip_label *));
-+
-+	if (!i_tmp)
-+		return ERR_PTR(-ENOMEM);
-+
-+	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+		*(i_tmp + i_num) =
-+		    (struct acl_ip_label *)
-+		    acl_alloc(sizeof (struct acl_ip_label));
-+		if (!*(i_tmp + i_num))
-+			return ERR_PTR(-ENOMEM);
-+
-+		if (copy_from_user
-+		    (&i_utmp2, s_tmp->ips + i_num,
-+		     sizeof (struct acl_ip_label *)))
-+			return ERR_PTR(-EFAULT);
-+
-+		if (copy_from_user
-+		    (*(i_tmp + i_num), i_utmp2,
-+		     sizeof (struct acl_ip_label)))
-+			return ERR_PTR(-EFAULT);
-+		
-+		if ((*(i_tmp + i_num))->iface == NULL)
-+			continue;
-+
-+		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
-+		if (!len || len >= IFNAMSIZ)
-+			return ERR_PTR(-EINVAL);
-+		tmp = acl_alloc(len);
-+		if (tmp == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
-+			return ERR_PTR(-EFAULT);
-+		(*(i_tmp + i_num))->iface = tmp;
-+	}
-+
-+	s_tmp->ips = i_tmp;
-+
-+insert:
-+	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+		return ERR_PTR(-ENOMEM);
-+
-+	return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label s_pre;
-+	struct acl_subject_label * ret;
-+	int err;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_pre, userp,
-+				   sizeof (struct acl_subject_label)))
-+			return -EFAULT;
-+		
-+		/* do not add nested subjects here, add
-+		   while parsing objects
-+		*/
-+
-+		if (s_pre.mode & GR_NESTED) {
-+			userp = s_pre.prev;
-+			continue;
-+		}
-+
-+		ret = do_copy_user_subj(userp, role);
-+
-+		err = PTR_ERR(ret);
-+		if (IS_ERR(ret))
-+			return err;
-+
-+		insert_acl_subj_label(ret, role);
-+
-+		userp = s_pre.prev;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+	struct sprole_pw *sptmp;
-+	struct gr_hash_struct *ghash;
-+	uid_t *domainlist;
-+	unsigned int r_num;
-+	unsigned int len;
-+	char *tmp;
-+	int err = 0;
-+	__u16 i;
-+	__u32 num_subjs;
-+
-+	/* we need a default and kernel role */
-+	if (arg->role_db.num_roles < 2)
-+		return -EINVAL;
-+
-+	/* copy special role authentication info from userspace */
-+
-+	num_sprole_pws = arg->num_sprole_pws;
-+	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+	if (!acl_special_roles) {
-+		err = -ENOMEM;
-+		goto cleanup;
-+	}
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+		if (!sptmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(sptmp, arg->sprole_pws + i,
-+				   sizeof (struct sprole_pw))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len =
-+		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(tmp, sptmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+		printk(KERN_ALERT "Copying special role %s\n", tmp);
-+#endif
-+		sptmp->rolename = tmp;
-+		acl_special_roles[i] = sptmp;
-+	}
-+
-+	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+		r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+		if (!r_tmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(&r_utmp2, r_utmp + r_num,
-+				   sizeof (struct acl_role_label *))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(r_tmp, r_utmp2,
-+				   sizeof (struct acl_role_label))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= PATH_MAX) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(tmp, r_tmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+		r_tmp->rolename = tmp;
-+
-+		if (!strcmp(r_tmp->rolename, "default")
-+		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+			default_role = r_tmp;
-+		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+			kernel_role = r_tmp;
-+		}
-+
-+		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		r_tmp->hash = ghash;
-+
-+		num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+		r_tmp->subj_hash_size = num_subjs;
-+		r_tmp->subj_hash =
-+		    (struct acl_subject_label **)
-+		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+		if (!r_tmp->subj_hash) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		err = copy_user_allowedips(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		/* copy domain info */
-+		if (r_tmp->domain_children != NULL) {
-+			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+			if (domainlist == NULL) {
-+				err = -ENOMEM;
-+				goto cleanup;
-+			}
-+			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
-+				err = -EFAULT;
-+				goto cleanup;
-+			}
-+			r_tmp->domain_children = domainlist;
-+		}
-+
-+		err = copy_user_transitions(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		memset(r_tmp->subj_hash, 0,
-+		       r_tmp->subj_hash_size *
-+		       sizeof (struct acl_subject_label *));
-+
-+		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
-+
-+		if (err)
-+			goto cleanup;
-+
-+		/* set nested subject list to null */
-+		r_tmp->hash->first = NULL;
-+
-+		insert_acl_role_label(r_tmp);
-+	}
-+
-+	goto return_err;
-+      cleanup:
-+	free_variables();
-+      return_err:
-+	return err;
-+
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+	int error = 0;
-+
-+	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+	if (init_variables(args)) {
-+		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+		error = -ENOMEM;
-+		free_variables();
-+		goto out;
-+	}
-+
-+	error = copy_user_acl(args);
-+	free_init_variables();
-+	if (error) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	if ((error = gr_set_acls(0))) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	pax_open_kernel();
-+	gr_status |= GR_READY;
-+	pax_close_kernel();
-+
-+      out:
-+	return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+	char c;
-+
-+	while ((c = *p++) != '\0') {
-+	switch (c) {
-+		case '?':
-+			if (*n == '\0')
-+				return 1;
-+			else if (*n == '/')
-+				return 1;
-+			break;
-+		case '\\':
-+			if (*n != c)
-+				return 1;
-+			break;
-+		case '*':
-+			for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+				if (*n == '/')
-+					return 1;
-+				else if (c == '?') {
-+					if (*n == '\0')
-+						return 1;
-+					else
-+						++n;
-+				}
-+			}
-+			if (c == '\0') {
-+				return 0;
-+			} else {
-+				const char *endp;
-+
-+				if ((endp = strchr(n, '/')) == NULL)
-+					endp = n + strlen(n);
-+
-+				if (c == '[') {
-+					for (--p; n < endp; ++n)
-+						if (!glob_match(p, n))
-+							return 0;
-+				} else if (c == '/') {
-+					while (*n != '\0' && *n != '/')
-+						++n;
-+					if (*n == '/' && !glob_match(p, n + 1))
-+						return 0;
-+				} else {
-+					for (--p; n < endp; ++n)
-+						if (*n == c && !glob_match(p, n))
-+							return 0;
-+				}
-+
-+				return 1;
-+			}
-+		case '[':
-+			{
-+			int not;
-+			char cold;
-+
-+			if (*n == '\0' || *n == '/')
-+				return 1;
-+
-+			not = (*p == '!' || *p == '^');
-+			if (not)
-+				++p;
-+
-+			c = *p++;
-+			for (;;) {
-+				unsigned char fn = (unsigned char)*n;
-+
-+				if (c == '\0')
-+					return 1;
-+				else {
-+					if (c == fn)
-+						goto matched;
-+					cold = c;
-+					c = *p++;
-+
-+					if (c == '-' && *p != ']') {
-+						unsigned char cend = *p++;
-+
-+						if (cend == '\0')
-+							return 1;
-+
-+						if (cold <= fn && fn <= cend)
-+							goto matched;
-+
-+						c = *p++;
-+					}
-+				}
-+
-+				if (c == ']')
-+					break;
-+			}
-+			if (!not)
-+				return 1;
-+			break;
-+		matched:
-+			while (c != ']') {
-+				if (c == '\0')
-+					return 1;
-+
-+				c = *p++;
-+			}
-+			if (not)
-+				return 1;
-+		}
-+		break;
-+	default:
-+		if (c != *n)
-+			return 1;
-+	}
-+
-+	++n;
-+	}
-+
-+	if (*n == '\0')
-+		return 0;
-+
-+	if (*n == '/')
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+	struct dentry *dentry, struct vfsmount *mnt, char **path)
-+{
-+	struct acl_object_label *tmp;
-+
-+	if (*path == NULL)
-+		*path = gr_to_filename_nolock(dentry, mnt);
-+
-+	tmp = globbed;
-+
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, *path))
-+			return tmp;
-+		tmp = tmp->next;
-+	}
-+
-+	return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const ino_t curr_ino, const dev_t curr_dev,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	struct acl_subject_label *tmpsubj;
-+	struct acl_object_label *retval;
-+	struct acl_object_label *retval2;
-+
-+	tmpsubj = (struct acl_subject_label *) subj;
-+	read_lock(&gr_inode_lock);
-+	do {
-+		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+		if (retval) {
-+			if (checkglob && retval->globbed) {
-+				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
-+						(struct vfsmount *)orig_mnt, path);
-+				if (retval2)
-+					retval = retval2;
-+			}
-+			break;
-+		}
-+	} while ((tmpsubj = tmpsubj->parent_subject));
-+	read_unlock(&gr_inode_lock);
-+
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const struct dentry *curr_dentry,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	return __full_lookup(orig_dentry, orig_mnt,
-+			     curr_dentry->d_inode->i_ino, 
-+			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_object_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
-+#ifdef CONFIG_HUGETLBFS
-+	    mnt == hugetlbfs_vfsmount ||
-+#endif
-+		/* ignore Eric Biederman */
-+	    IS_PRIVATE(l_dentry->d_inode))) {
-+		retval = fakefs_obj;
-+		goto out;
-+	}
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+	if (retval == NULL)
-+		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+	spin_unlock(&dcache_lock);
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+		     const struct acl_subject_label *subj, char *path)
-+{
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	       const struct acl_role_label *role)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_subject_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			read_lock(&gr_inode_lock);
-+			retval =
-+				lookup_acl_subj_label(dentry->d_inode->i_ino,
-+						dentry->d_inode->i_sb->s_dev, role);
-+			read_unlock(&gr_inode_lock);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+					  dentry->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	read_lock(&gr_inode_lock);
-+	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+				  dentry->d_inode->i_sb->s_dev, role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (unlikely(retval == NULL)) {
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+					  real_root->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+	}
-+out:
-+	spin_unlock(&dcache_lock);
-+
-+	return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real, 
-+		       const unsigned int effective, const unsigned int fs)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       type, real, effective, fs, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+	      const struct dentry * parent_dentry,
-+	      const struct vfsmount * parent_mnt,
-+	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+	struct acl_object_label *obj;
-+	__u32 oldmode, newmode;
-+	__u32 needmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (GR_CREATE | GR_LINK);
-+
-+	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+	oldmode = obj->mode;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		oldmode |= (GR_CREATE | GR_LINK);
-+
-+	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID | GR_AUDIT_SETID;
-+
-+	newmode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    oldmode | needmode);
-+
-+	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
-+			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
-+			      GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
-+		goto bad;
-+
-+	if ((oldmode & needmode) != needmode)
-+		goto bad;
-+
-+	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+	if ((newmode & needmode) != needmode)
-+		goto bad;
-+
-+	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+		return newmode;
-+bad:
-+	needmode = oldmode;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID;
-+	
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		gr_log_learn(old_dentry, old_mnt, needmode);
-+		return (GR_CREATE | GR_LINK);
-+	} else if (newmode & GR_SUPPRESS)
-+		return GR_SUPPRESS;
-+	else
-+		return 0;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+	       const struct vfsmount * mnt)
-+{
-+	__u32 retval = mode;
-+	struct acl_subject_label *curracl;
-+	struct acl_object_label *currobj;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	curracl = current->acl;
-+
-+	currobj = chk_obj_label(dentry, mnt, curracl);
-+	retval = currobj->mode & mode;
-+
-+	if (unlikely
-+	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		retval = new_mode;
-+
-+		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+			new_mode |= GR_INHERIT;
-+
-+		if (!(mode & GR_NOLEARN))
-+			gr_log_learn(dentry, mnt, new_mode);
-+	}
-+
-+	return retval;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+		const struct vfsmount * mnt, const __u32 mode)
-+{
-+	struct name_entry *match;
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *curracl;
-+	char *path;
-+	__u32 retval;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	preempt_disable();
-+	path = gr_to_filename_rbac(new_dentry, mnt);
-+	match = lookup_name_entry_create(path);
-+
-+	if (!match)
-+		goto check_parent;
-+
-+	curracl = current->acl;
-+
-+	read_lock(&gr_inode_lock);
-+	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (matchpo) {
-+		if ((matchpo->mode & mode) !=
-+		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
-+		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+			__u32 new_mode = mode;
-+
-+			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+			gr_log_learn(new_dentry, mnt, new_mode);
-+
-+			preempt_enable();
-+			return new_mode;
-+		}
-+		preempt_enable();
-+		return (matchpo->mode & mode);
-+	}
-+
-+      check_parent:
-+	curracl = current->acl;
-+
-+	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+	retval = matchpo->mode & mode;
-+
-+	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		gr_log_learn(new_dentry, mnt, new_mode);
-+		preempt_enable();
-+		return new_mode;
-+	}
-+
-+	preempt_enable();
-+	return retval;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY) || !task))
-+		return 0;
-+
-+	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+	    task->acl != current->acl)
-+		return 1;
-+
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	tsk->signal->used_accept = 0;
-+	tsk->acl_sp_role = 0;
-+	tsk->acl_role_id = current->acl_role_id;
-+	tsk->acl = current->acl;
-+	tsk->role = current->role;
-+	tsk->signal->curr_ip = current->signal->curr_ip;
-+	if (current->exec_file)
-+		get_file(current->exec_file);
-+	tsk->exec_file = current->exec_file;
-+	tsk->is_writable = current->is_writable;
-+	if (unlikely(current->signal->used_accept))
-+		current->signal->curr_ip = 0;
-+
-+	return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+	struct acl_subject_label *proc;
-+	unsigned short i;
-+
-+	proc = task->acl;
-+
-+	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return;
-+
-+	for (i = 0; i < RLIM_NLIMITS; i++) {
-+		if (!(proc->resmask & (1 << i)))
-+			continue;
-+
-+		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	uid_t *uidlist;
-+	int curuid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('u', real, effective, fs);
-+
-+	num = current->acl->user_trans_num;
-+	uidlist = current->acl->user_transitions;
-+
-+	if (uidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				realok = 1;
-+			if (effective == curuid)
-+				effectiveok = 1;
-+			if (fs == curuid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->user_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				break;
-+			if (effective == curuid)
-+				break;
-+			if (fs == curuid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	gid_t *gidlist;
-+	int curgid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('g', real, effective, fs);
-+
-+	num = current->acl->group_trans_num;
-+	gidlist = current->acl->group_transitions;
-+
-+	if (gidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				realok = 1;
-+			if (effective == curgid)
-+				effectiveok = 1;
-+			if (fs == curgid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->group_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				break;
-+			if (effective == curgid)
-+				break;
-+			if (fs == curgid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+	struct acl_role_label *role = task->role;
-+	struct acl_subject_label *subj = NULL;
-+	struct acl_object_label *obj;
-+	struct file *filp;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	filp = task->exec_file;
-+
-+	/* kernel process, we'll give them the kernel role */
-+	if (unlikely(!filp)) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+		return;
-+	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+		role = lookup_acl_role_label(task, uid, gid);
-+
-+	/* perform subject lookup in possibly new role
-+	   we can use this result below in the case where role == task->role
-+	*/
-+	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+	/* if we changed uid/gid, but result in the same role
-+	   and are using inheritance, don't lose the inherited subject
-+	   if current subject is other than what normal lookup
-+	   would result in, we arrived via inheritance, don't
-+	   lose subject
-+	*/
-+	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+				   (subj == task->acl)))
-+		task->acl = subj;
-+
-+	task->role = role;
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+	gr_set_proc_res(task);
-+
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	struct task_struct *task = current;
-+	struct acl_subject_label *newacl;
-+	struct acl_object_label *obj;
-+	__u32 retmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+	task_lock(task);
-+	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
-+	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+	     !(task->role->roletype & GR_ROLE_GOD) &&
-+	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
-+                task_unlock(task);
-+		if (unsafe_share)
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+		else
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+		return -EACCES;
-+	}
-+	task_unlock(task);
-+
-+	obj = chk_obj_label(dentry, mnt, task->acl);
-+	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (!(task->acl->mode & GR_INHERITLEARN) &&
-+	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+		if (obj->nested)
-+			task->acl = obj->nested;
-+		else
-+			task->acl = newacl;
-+	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+	gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+	return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *matchps;
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+
-+	FOR_EACH_ROLE_START(role)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+				matchpo->mode |= GR_DELETED;
-+		FOR_EACH_SUBJECT_END(subj,x)
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if (subj->inode == ino && subj->device == dev)
-+				subj->mode |= GR_DELETED;
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+			matchps->mode |= GR_DELETED;
-+	FOR_EACH_ROLE_END(role)
-+
-+	inodev->nentry->deleted = 1;
-+
-+	return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	struct inodev_entry *inodev;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	write_lock(&gr_inode_lock);
-+	inodev = lookup_inodev_entry(ino, dev);
-+	if (inodev != NULL)
-+		do_handle_delete(inodev, ino, dev);
-+	write_unlock(&gr_inode_lock);
-+
-+	return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+		     const ino_t newinode, const dev_t newdevice,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			subj->obj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_obj_label(match, subj);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+		      const ino_t newinode, const dev_t newdevice,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			role->subj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_subj_label(match, role);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+		    const ino_t newinode, const dev_t newdevice)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != oldinode ||
-+	       match->nentry->device != olddevice || !match->nentry->deleted))
-+		match = match->next;
-+
-+	if (match && (match->nentry->inode == oldinode)
-+	    && (match->nentry->device == olddevice) &&
-+	    match->nentry->deleted) {
-+		if (match->prev == NULL) {
-+			inodev_set.i_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->nentry->inode = newinode;
-+		match->nentry->device = newdevice;
-+		match->nentry->deleted = 0;
-+
-+		insert_inodev_entry(match);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+		 const struct vfsmount *mnt)
-+{
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+	
-+	FOR_EACH_ROLE_START(role)
-+		update_acl_subj_label(matchn->inode, matchn->device,
-+				      dentry->d_inode->i_ino,
-+				      dentry->d_inode->i_sb->s_dev, role);
-+
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if ((subj->inode == dentry->d_inode->i_ino) &&
-+			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
-+				subj->inode = dentry->d_inode->i_ino;
-+				subj->device = dentry->d_inode->i_sb->s_dev;
-+			}
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			update_acl_obj_label(matchn->inode, matchn->device,
-+					     dentry->d_inode->i_ino,
-+					     dentry->d_inode->i_sb->s_dev, subj);
-+		FOR_EACH_SUBJECT_END(subj,x)
-+	FOR_EACH_ROLE_END(role)
-+
-+	update_inodev_entry(matchn->inode, matchn->device,
-+			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
-+
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	struct name_entry *matchn;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+	if (unlikely((unsigned long)matchn)) {
-+		write_lock(&gr_inode_lock);
-+		do_handle_create(matchn, dentry, mnt);
-+		write_unlock(&gr_inode_lock);
-+	}
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	struct name_entry *matchn;
-+	struct inodev_entry *inodev;
-+
-+	/* vfs_rename swaps the name and parent link for old_dentry and
-+	   new_dentry
-+	   at this point, old_dentry has the new name, parent link, and inode
-+	   for the renamed file
-+	   if a file is being replaced by a rename, new_dentry has the inode
-+	   and name for the replaced file
-+	*/
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+	/* we wouldn't have to check d_inode if it weren't for
-+	   NFS silly-renaming
-+	 */
-+
-+	write_lock(&gr_inode_lock);
-+	if (unlikely(replace && new_dentry->d_inode)) {
-+		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
-+					     new_dentry->d_inode->i_sb->s_dev);
-+		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
-+			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
-+					 new_dentry->d_inode->i_sb->s_dev);
-+	}
-+
-+	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
-+				     old_dentry->d_inode->i_sb->s_dev);
-+	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
-+		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
-+				 old_dentry->d_inode->i_sb->s_dev);
-+
-+	if (unlikely((unsigned long)matchn))
-+		do_handle_create(matchn, old_dentry, mnt);
-+
-+	write_unlock(&gr_inode_lock);
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+			 unsigned char **sum)
-+{
-+	struct acl_role_label *r;
-+	struct role_allowed_ip *ipp;
-+	struct role_transition *trans;
-+	unsigned int i;
-+	int found = 0;
-+
-+	/* check transition table */
-+
-+	for (trans = current->role->transitions; trans; trans = trans->next) {
-+		if (!strcmp(rolename, trans->rolename)) {
-+			found = 1;
-+			break;
-+		}
-+	}
-+
-+	if (!found)
-+		return 0;
-+
-+	/* handle special roles that do not require authentication
-+	   and check ip */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			found = 0;
-+			if (r->allowed_ips != NULL) {
-+				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
-+					     (ntohl(ipp->addr) & ipp->netmask))
-+						found = 1;
-+				}
-+			} else
-+				found = 2;
-+			if (!found)
-+				return 0;
-+
-+			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+				*salt = NULL;
-+				*sum = NULL;
-+				return 1;
-+			}
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+			*salt = acl_special_roles[i]->salt;
-+			*sum = acl_special_roles[i]->sum;
-+			return 1;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+	struct acl_object_label *obj;
-+	struct acl_role_label *r;
-+	struct acl_role_label *assigned = NULL;
-+	struct task_struct *tsk;
-+	struct file *filp;
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			assigned = r;
-+			break;
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	if (!assigned)
-+		return;
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+
-+	tsk = current->parent;
-+	if (tsk == NULL)
-+		goto out_unlock;
-+
-+	filp = tsk->exec_file;
-+	if (filp == NULL)
-+		goto out_unlock;
-+
-+	tsk->is_writable = 0;
-+
-+	tsk->acl_sp_role = 1;
-+	tsk->acl_role_id = ++acl_sp_role_value;
-+	tsk->role = assigned;
-+	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+	struct task_struct *p, *p2, *p3;
-+	struct files_struct *files;
-+	struct fdtable *fdt;
-+	struct file *our_file = NULL, *file;
-+	int i;
-+
-+	if (task->signal->tty == NULL)
-+		return 1;
-+
-+	files = get_files_struct(task);
-+	if (files != NULL) {
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+				get_file(file);
-+				our_file = file;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	}
-+
-+	if (our_file == NULL)
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(p2, p) {
-+		files = get_files_struct(p);
-+		if (files == NULL ||
-+		    (p->signal && p->signal->tty == task->signal->tty)) {
-+			if (files != NULL)
-+				put_files_struct(files);
-+			continue;
-+		}
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+				p3 = task;
-+				while (p3->pid > 0) {
-+					if (p3 == p)
-+						break;
-+					p3 = p3->parent;
-+				}
-+				if (p3 == p)
-+					break;
-+				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+				gr_handle_alertkill(p);
-+				rcu_read_unlock();
-+				put_files_struct(files);
-+				read_unlock(&tasklist_lock);
-+				fput(our_file);
-+				return 0;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	} while_each_thread(p2, p);
-+	read_unlock(&tasklist_lock);
-+
-+	fput(our_file);
-+	return 1;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
-+{
-+	struct gr_arg_wrapper uwrap;
-+	unsigned char *sprole_salt = NULL;
-+	unsigned char *sprole_sum = NULL;
-+	int error = sizeof (struct gr_arg_wrapper);
-+	int error2 = 0;
-+
-+	down(&gr_dev_sem);
-+
-+	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	if (count != sizeof (struct gr_arg_wrapper)) {
-+		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	
-+	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+		gr_auth_expires = 0;
-+		gr_auth_attempts = 0;
-+	}
-+
-+	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+	    time_after(gr_auth_expires, get_seconds())) {
-+		error = -EBUSY;
-+		goto out;
-+	}
-+
-+	/* if non-root trying to do anything other than use a special role,
-+	   do not attempt authentication, do not count towards authentication
-+	   locking
-+	 */
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    current_uid()) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	/* ensure pw and special role name are null terminated */
-+
-+	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+	/* Okay. 
-+	 * We have our enough of the argument structure..(we have yet
-+	 * to copy_from_user the tables themselves) . Copy the tables
-+	 * only if we need them, i.e. for loading operations. */
-+
-+	switch (gr_usermode->mode) {
-+	case GR_STATUS:
-+			if (gr_status & GR_READY) {
-+				error = 1;
-+				if (!gr_check_secure_terminal(current))
-+					error = 3;
-+			} else
-+				error = 2;
-+			goto out;
-+	case GR_SHUTDOWN:
-+		if ((gr_status & GR_READY)
-+		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+			free_variables();
-+			memset(gr_usermode, 0, sizeof (struct gr_arg));
-+			memset(gr_system_salt, 0, GR_SALT_LEN);
-+			memset(gr_system_sum, 0, GR_SHA_LEN);
-+		} else if (gr_status & GR_READY) {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+			error = -EPERM;
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+			error = -EAGAIN;
-+		}
-+		break;
-+	case GR_ENABLE:
-+		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+		else {
-+			if (gr_status & GR_READY)
-+				error = -EAGAIN;
-+			else
-+				error = error2;
-+			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+		}
-+		break;
-+	case GR_RELOAD:
-+		if (!(gr_status & GR_READY)) {
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+			error = -EAGAIN;
-+		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			lock_kernel();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				unlock_kernel();
-+				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				unlock_kernel();
-+				error = error2;
-+				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			}
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SEGVMOD:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+				struct acl_subject_label *segvacl;
-+				segvacl =
-+				    lookup_acl_subj_label(gr_usermode->segv_inode,
-+							  gr_usermode->segv_device,
-+							  current->role);
-+				if (segvacl) {
-+					segvacl->crashes = 0;
-+					segvacl->expires = 0;
-+				}
-+			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+				gr_remove_uid(gr_usermode->segv_uid);
-+			}
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SPROLE:
-+	case GR_SPROLEPAM:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+			current->role->expires = 0;
-+			current->role->auth_attempts = 0;
-+		}
-+
-+		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+		    time_after(current->role->expires, get_seconds())) {
-+			error = -EBUSY;
-+			goto out;
-+		}
-+
-+		if (lookup_special_role_auth
-+		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+		    && ((!sprole_salt && !sprole_sum)
-+			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+			char *p = "";
-+			assign_special_role(gr_usermode->sp_role);
-+			read_lock(&tasklist_lock);
-+			if (current->parent)
-+				p = current->parent->role->rolename;
-+			read_unlock(&tasklist_lock);
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+					p, acl_sp_role_value);
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+			error = -EPERM;
-+			if(!(current->role->auth_attempts++))
-+				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+			goto out;
-+		}
-+		break;
-+	case GR_UNSPROLE:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->roletype & GR_ROLE_SPECIAL) {
-+			char *p = "";
-+			int i = 0;
-+
-+			read_lock(&tasklist_lock);
-+			if (current->parent) {
-+				p = current->parent->role->rolename;
-+				i = current->parent->acl_role_id;
-+			}
-+			read_unlock(&tasklist_lock);
-+
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+			gr_set_acls(1);
-+		} else {
-+			error = -EPERM;
-+			goto out;
-+		}
-+		break;
-+	default:
-+		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+		error = -EINVAL;
-+		break;
-+	}
-+
-+	if (error != -EPERM)
-+		goto out;
-+
-+	if(!(gr_auth_attempts++))
-+		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+      out:
-+	up(&gr_dev_sem);
-+	return error;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	struct acl_object_label *obj;
-+	struct task_struct *task, *task2;
-+	struct file *filp;
-+	struct acl_role_label *role = current->role;
-+	__u16 acl_role_id = current->acl_role_id;
-+	const struct cred *cred;
-+	char *tmpname;
-+	struct name_entry *nmatch;
-+	struct acl_subject_label *tmpsubj;
-+
-+	rcu_read_lock();
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	do_each_thread(task2, task) {
-+		/* check to see if we're called from the exit handler,
-+		   if so, only replace ACLs that have inherited the admin
-+		   ACL */
-+
-+		if (type && (task->role != role ||
-+			     task->acl_role_id != acl_role_id))
-+			continue;
-+
-+		task->acl_role_id = 0;
-+		task->acl_sp_role = 0;
-+
-+		if ((filp = task->exec_file)) {
-+			cred = __task_cred(task);
-+			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+			/* the following is to apply the correct subject 
-+			   on binaries running when the RBAC system 
-+			   is enabled, when the binaries have been 
-+			   replaced or deleted since their execution
-+			   -----
-+			   when the RBAC system starts, the inode/dev
-+			   from exec_file will be one the RBAC system
-+			   is unaware of.  It only knows the inode/dev
-+			   of the present file on disk, or the absence
-+			   of it.
-+			*/
-+			preempt_disable();
-+			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+			
-+			nmatch = lookup_name_entry(tmpname);
-+			preempt_enable();
-+			tmpsubj = NULL;
-+			if (nmatch) {
-+				if (nmatch->deleted)
-+					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+				else
-+					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+				if (tmpsubj != NULL)
-+					task->acl = tmpsubj;
-+			}
-+			if (tmpsubj == NULL)
-+				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+							   task->role);
-+			if (task->acl) {
-+				struct acl_subject_label *curr;
-+				curr = task->acl;
-+
-+				task->is_writable = 0;
-+				/* ignore additional mmap checks for processes that are writable 
-+				   by the default ACL */
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+
-+				gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+			} else {
-+				read_unlock(&grsec_exec_file_lock);
-+				read_unlock(&tasklist_lock);
-+				rcu_read_unlock();
-+				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+				return 1;
-+			}
-+		} else {
-+			// it's a kernel process
-+			task->role = kernel_role;
-+			task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+			task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+		}
-+	} while_each_thread(task2, task);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	rcu_read_unlock();
-+
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	struct acl_subject_label *acl;
-+	const struct cred *cred;
-+
-+	if (unlikely((gr_status & GR_READY) &&
-+		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+		goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	gr_log_resource(task, res, wanted, gt);
-+#endif
-+      skip_reslog:
-+
-+	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+		return;
-+
-+	acl = task->acl;
-+
-+	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+		   !(acl->resmask & (1 << (unsigned short) res))))
-+		return;
-+
-+	if (wanted >= acl->res[res].rlim_cur) {
-+		unsigned long res_add;
-+
-+		res_add = wanted;
-+		switch (res) {
-+		case RLIMIT_CPU:
-+			res_add += GR_RLIM_CPU_BUMP;
-+			break;
-+		case RLIMIT_FSIZE:
-+			res_add += GR_RLIM_FSIZE_BUMP;
-+			break;
-+		case RLIMIT_DATA:
-+			res_add += GR_RLIM_DATA_BUMP;
-+			break;
-+		case RLIMIT_STACK:
-+			res_add += GR_RLIM_STACK_BUMP;
-+			break;
-+		case RLIMIT_CORE:
-+			res_add += GR_RLIM_CORE_BUMP;
-+			break;
-+		case RLIMIT_RSS:
-+			res_add += GR_RLIM_RSS_BUMP;
-+			break;
-+		case RLIMIT_NPROC:
-+			res_add += GR_RLIM_NPROC_BUMP;
-+			break;
-+		case RLIMIT_NOFILE:
-+			res_add += GR_RLIM_NOFILE_BUMP;
-+			break;
-+		case RLIMIT_MEMLOCK:
-+			res_add += GR_RLIM_MEMLOCK_BUMP;
-+			break;
-+		case RLIMIT_AS:
-+			res_add += GR_RLIM_AS_BUMP;
-+			break;
-+		case RLIMIT_LOCKS:
-+			res_add += GR_RLIM_LOCKS_BUMP;
-+			break;
-+		case RLIMIT_SIGPENDING:
-+			res_add += GR_RLIM_SIGPENDING_BUMP;
-+			break;
-+		case RLIMIT_MSGQUEUE:
-+			res_add += GR_RLIM_MSGQUEUE_BUMP;
-+			break;
-+		case RLIMIT_NICE:
-+			res_add += GR_RLIM_NICE_BUMP;
-+			break;
-+		case RLIMIT_RTPRIO:
-+			res_add += GR_RLIM_RTPRIO_BUMP;
-+			break;
-+		case RLIMIT_RTTIME:
-+			res_add += GR_RLIM_RTTIME_BUMP;
-+			break;
-+		}
-+
-+		acl->res[res].rlim_cur = res_add;
-+
-+		if (wanted > acl->res[res].rlim_max)
-+			acl->res[res].rlim_max = res_add;
-+
-+		/* only log the subject filename, since resource logging is supported for
-+		   single-subject learning only */
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid, cred->gid, acl->filename,
-+			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+			       "", (unsigned long) res, &task->signal->curr_ip);
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	struct task_struct *task = current;
-+        struct acl_subject_label *proc;
-+	unsigned long flags;
-+
-+        if (unlikely(!(gr_status & GR_READY)))
-+                return;
-+
-+	flags = pax_get_flags(task);
-+
-+        proc = task->acl;
-+
-+	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+		flags &= ~MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+		flags &= ~MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+		flags &= ~MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+		flags &= ~MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+		flags &= ~MF_PAX_MPROTECT;
-+
-+	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+		flags |= MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+		flags |= MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+		flags |= MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+		flags |= MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+		flags |= MF_PAX_MPROTECT;
-+
-+	pax_set_flags(task, flags);
-+
-+        return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+   system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+	struct name_entry *nmatch;
-+	char *p, *lastp = NULL;
-+	struct acl_object_label *obj = NULL, *tmp;
-+	struct acl_subject_label *tmpsubj;
-+	char c = '\0';
-+
-+	read_lock(&gr_inode_lock);
-+
-+	p = name + len - 1;
-+	do {
-+		nmatch = lookup_name_entry(name);
-+		if (lastp != NULL)
-+			*lastp = c;
-+
-+		if (nmatch == NULL)
-+			goto next_component;
-+		tmpsubj = current->acl;
-+		do {
-+			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+			if (obj != NULL) {
-+				tmp = obj->globbed;
-+				while (tmp) {
-+					if (!glob_match(tmp->filename, name)) {
-+						obj = tmp;
-+						goto found_obj;
-+					}
-+					tmp = tmp->next;
-+				}
-+				goto found_obj;
-+			}
-+		} while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+		/* end case */
-+		if (p == name)
-+			break;
-+
-+		while (*p != '/')
-+			p--;
-+		if (p == name)
-+			lastp = p + 1;
-+		else {
-+			lastp = p;
-+			p--;
-+		}
-+		c = *lastp;
-+		*lastp = '\0';
-+	} while (1);
-+found_obj:
-+	read_unlock(&gr_inode_lock);
-+	/* obj returned will always be non-null */
-+	return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+   op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+	ctl_table *tmp;
-+	const char *proc_sys = "/proc/sys";
-+	char *path;
-+	struct acl_object_label *obj;
-+	unsigned short len = 0, pos = 0, depth = 0, i;
-+	__u32 err = 0;
-+	__u32 mode = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	/* for now, ignore operations on non-sysctl entries if it's not a
-+	   readdir*/
-+	if (table->child != NULL && op != 0)
-+		return 0;
-+
-+	mode |= GR_FIND;
-+	/* it's only a read if it's an entry, read on dirs is for readdir */
-+	if (op & MAY_READ)
-+		mode |= GR_READ;
-+	if (op & MAY_WRITE)
-+		mode |= GR_WRITE;
-+
-+	preempt_disable();
-+
-+	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+	/* it's only a read/write if it's an actual entry, not a dir
-+	   (which are opened for readdir)
-+	*/
-+
-+	/* convert the requested sysctl entry into a pathname */
-+
-+	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+		len += strlen(tmp->procname);
-+		len++;
-+		depth++;
-+	}
-+
-+	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+		/* deny */
-+		goto out;
-+	}
-+
-+	memset(path, 0, PAGE_SIZE);
-+
-+	memcpy(path, proc_sys, strlen(proc_sys));
-+
-+	pos += strlen(proc_sys);
-+
-+	for (; depth > 0; depth--) {
-+		path[pos] = '/';
-+		pos++;
-+		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+			if (depth == i) {
-+				memcpy(path + pos, tmp->procname,
-+				       strlen(tmp->procname));
-+				pos += strlen(tmp->procname);
-+			}
-+			i++;
-+		}
-+	}
-+
-+	obj = gr_lookup_by_name(path, pos);
-+	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+		     ((err & mode) != mode))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		err = 0;
-+		gr_log_learn_sysctl(path, new_mode);
-+	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+		err = -ENOENT;
-+	} else if (!(err & GR_FIND)) {
-+		err = -ENOENT;
-+	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = -EACCES;
-+	} else if ((err & mode) != mode) {
-+		err = -EACCES;
-+	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = 0;
-+	} else
-+		err = 0;
-+
-+      out:
-+	preempt_enable();
-+
-+	return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	struct file *filp;
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	filp = task->exec_file;
-+
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 1;
-+	}
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 0;
-+	}
-+#endif
-+
-+	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+
-+	if (retmode & GR_NOPTRACE)
-+		return 1;
-+
-+	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+	    && (current->acl != task->acl || (current->acl != current->role->root_label
-+	    && current->pid != task->pid)))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY))
-+		return 0;
-+#endif
-+
-+	read_lock(&grsec_exec_file_lock);
-+	if (unlikely(!task->exec_file)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		return 0;
-+	}
-+
-+	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+
-+	if (retmode & GR_NOPTRACE) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+		
-+	if (retmode & GR_PTRACERD) {
-+		switch (request) {
-+		case PTRACE_POKETEXT:
-+		case PTRACE_POKEDATA:
-+		case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+		case PTRACE_SETREGS:
-+		case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+		case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+		case PTRACE_SETVRREGS:
-+#endif
-+			return 1;
-+		default:
-+			return 0;
-+		}
-+	} else if (!(current->acl->mode & GR_POVERRIDE) &&
-+		   !(current->role->roletype & GR_ROLE_GOD) &&
-+		   (current->acl != task->acl)) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+	struct task_struct *task = current;
-+	struct acl_object_label *obj, *obj2;
-+
-+	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
-+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+				     task->role->root_label);
-+		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+			return 1;
-+		}
-+	}
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	unsigned long runtime;
-+	unsigned long cputime;
-+	unsigned int wday, cday;
-+	__u8 whr, chr;
-+	__u8 wmin, cmin;
-+	__u8 wsec, csec;
-+	struct timespec timeval;
-+
-+	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+		     !(task->acl->mode & GR_PROCACCT)))
-+		return;
-+
-+	do_posix_clock_monotonic_gettime(&timeval);
-+	runtime = timeval.tv_sec - task->start_time.tv_sec;
-+	wday = runtime / (3600 * 24);
-+	runtime -= wday * (3600 * 24);
-+	whr = runtime / 3600;
-+	runtime -= whr * 3600;
-+	wmin = runtime / 60;
-+	runtime -= wmin * 60;
-+	wsec = runtime;
-+
-+	cputime = (task->utime + task->stime) / HZ;
-+	cday = cputime / (3600 * 24);
-+	cputime -= cday * (3600 * 24);
-+	chr = cputime / 3600;
-+	cputime -= chr * 3600;
-+	cmin = cputime / 60;
-+	cputime -= cmin * 60;
-+	csec = cputime;
-+
-+	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+	return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+	if (gr_status & GR_READY) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+	}
-+	return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred;
-+#endif
-+	int ret = 0;
-+
-+	/* restrict taskstats viewing to un-chrooted root users
-+	   who have the 'view' subject flag if the RBAC system is enabled
-+	*/
-+
-+	read_lock(&tasklist_lock);
-+	task = find_task_by_vpid(pid);
-+	if (task) {
-+		gr_fs_read_lock(task);
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+		if (proc_is_chrooted(task))
-+			ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		if (cred->uid != 0)
-+			ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
-+			ret = -EACCES;
-+#endif
-+#endif
-+		if (gr_status & GR_READY) {
-+			if (!(task->acl->mode & GR_VIEW))
-+				ret = -EACCES;
-+		}
-+		
-+		gr_fs_read_unlock(task);
-+	} else
-+		ret = -ENOENT;
-+
-+	read_unlock(&tasklist_lock);
-+
-+	return ret;
-+}
-+#endif
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+	struct task_struct *task = current;
-+	struct dentry *dentry = file->f_path.dentry;
-+	struct vfsmount *mnt = file->f_path.mnt;
-+	struct acl_object_label *obj, *tmp;
-+	struct acl_subject_label *subj;
-+	unsigned int bufsize;
-+	int is_not_root;
-+	char *path;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 1;
-+
-+	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return 1;
-+
-+	/* ignore Eric Biederman */
-+	if (IS_PRIVATE(dentry->d_inode))
-+		return 1;
-+
-+	subj = task->acl;
-+	do {
-+		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
-+		if (obj != NULL)
-+			return (obj->mode & GR_FIND) ? 1 : 0;
-+	} while ((subj = subj->parent_subject));
-+	
-+	/* this is purely an optimization since we're looking for an object
-+	   for the directory we're doing a readdir on
-+	   if it's possible for any globbed object to match the entry we're
-+	   filling into the directory, then the object we find here will be
-+	   an anchor point with attached globbed objects
-+	*/
-+	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+	if (obj->globbed == NULL)
-+		return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+	is_not_root = ((obj->filename[0] == '/') &&
-+		   (obj->filename[1] == '\0')) ? 0 : 1;
-+	bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+	/* check bufsize > PAGE_SIZE || bufsize == 0 */
-+	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+		return 1;
-+
-+	preempt_disable();
-+	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   bufsize);
-+
-+	bufsize = strlen(path);
-+
-+	/* if base is "/", don't append an additional slash */
-+	if (is_not_root)
-+		*(path + bufsize) = '/';
-+	memcpy(path + bufsize + is_not_root, name, namelen);
-+	*(path + bufsize + namelen + is_not_root) = '\0';
-+
-+	tmp = obj->globbed;
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, path)) {
-+			preempt_enable();
-+			return (tmp->mode & GR_FIND) ? 1 : 0;
-+		}
-+		tmp = tmp->next;
-+	}
-+	preempt_enable();
-+	return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff -urNp linux-2.6.32.12/grsecurity/gracl_cap.c linux-2.6.32.12/grsecurity/gracl_cap.c
---- linux-2.6.32.12/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_cap.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,131 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static const char *captab_log[] = {
-+	"CAP_CHOWN",
-+	"CAP_DAC_OVERRIDE",
-+	"CAP_DAC_READ_SEARCH",
-+	"CAP_FOWNER",
-+	"CAP_FSETID",
-+	"CAP_KILL",
-+	"CAP_SETGID",
-+	"CAP_SETUID",
-+	"CAP_SETPCAP",
-+	"CAP_LINUX_IMMUTABLE",
-+	"CAP_NET_BIND_SERVICE",
-+	"CAP_NET_BROADCAST",
-+	"CAP_NET_ADMIN",
-+	"CAP_NET_RAW",
-+	"CAP_IPC_LOCK",
-+	"CAP_IPC_OWNER",
-+	"CAP_SYS_MODULE",
-+	"CAP_SYS_RAWIO",
-+	"CAP_SYS_CHROOT",
-+	"CAP_SYS_PTRACE",
-+	"CAP_SYS_PACCT",
-+	"CAP_SYS_ADMIN",
-+	"CAP_SYS_BOOT",
-+	"CAP_SYS_NICE",
-+	"CAP_SYS_RESOURCE",
-+	"CAP_SYS_TIME",
-+	"CAP_SYS_TTY_CONFIG",
-+	"CAP_MKNOD",
-+	"CAP_LEASE",
-+	"CAP_AUDIT_WRITE",
-+	"CAP_AUDIT_CONTROL",
-+	"CAP_SETFCAP",
-+	"CAP_MAC_OVERRIDE",
-+	"CAP_MAC_ADMIN"
-+};
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+	    && cap_raised(cred->cap_effective, cap)) {
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid,
-+			       cred->gid, task->exec_file ?
-+			       gr_to_filename(task->exec_file->f_path.dentry,
-+			       task->exec_file->f_path.mnt) : curracl->filename,
-+			       curracl->filename, 0UL,
-+			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
-+		return 1;
-+	}
-+
-+	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
-+		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+	return 0;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = current->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	return 0;
-+}
-+
-diff -urNp linux-2.6.32.12/grsecurity/gracl_fs.c linux-2.6.32.12/grsecurity/gracl_fs.c
---- linux-2.6.32.12/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_fs.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,424 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return GR_FIND;
-+
-+	mode =
-+	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return mode;
-+	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_FIND)))
-+		return 0;
-+
-+	return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	__u32 reqmode = GR_FIND;
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return reqmode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	else if (unlikely(fmode & FMODE_WRITE))
-+		reqmode |= GR_WRITE;
-+	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
-+		reqmode &= ~GR_READ;
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
-+		reqmode |= GR_SETID;
-+
-+	mode =
-+	    gr_check_create(dentry, p_dentry, p_mnt,
-+			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     const int fmode)
-+{
-+	__u32 mode, reqmode = GR_FIND;
-+
-+	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+		reqmode |= GR_EXEC;
-+	if (fmode & S_IWOTH)
-+		reqmode |= GR_WRITE;
-+	if (fmode & S_IROTH)
-+		reqmode |= GR_READ;
-+
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		     mode_t mode)
-+{
-+	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+		return 1;
-+
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_FCHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		    mode_t mode)
-+{
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_CHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+			   GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create permission,
-+   any additional privilege required is based on the
-+   privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	__u32 mode;
-+	__u32 needmode = GR_CREATE | GR_LINK;
-+	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+	mode =
-+	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+			  old_mnt);
-+
-+	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	__u32 needmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	mode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    GR_CREATE | GR_AUDIT_CREATE |
-+			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	if (unlikely(mode & (S_ISUID | S_ISGID)))
-+		reqmode |= GR_SETID;
-+
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+		    const struct dentry *parent_dentry,
-+		    const struct vfsmount *parent_mnt)
-+{
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+		     struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     struct dentry *old_dentry,
-+		     struct inode *old_parent_inode,
-+		     struct vfsmount *old_mnt, const char *newname)
-+{
-+	__u32 comp1, comp2;
-+	int error = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (!new_dentry->d_inode) {
-+		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+				       GR_DELETE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, old_mnt);
-+	} else {
-+		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+				       GR_CREATE | GR_DELETE |
-+				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, parent_mnt);
-+		comp2 =
-+		    gr_search_file(old_dentry,
-+				   GR_READ | GR_WRITE | GR_AUDIT_READ |
-+				   GR_DELETE | GR_AUDIT_DELETE |
-+				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+	}
-+
-+	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+		 && !(comp2 & GR_SUPPRESS)) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+		error = -EACCES;
-+	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+		error = -EACCES;
-+
-+	return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	u16 id;
-+	char *rolename;
-+	struct file *exec_file;
-+
-+	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
-+		id = current->acl_role_id;
-+		rolename = current->role->rolename;
-+		gr_set_acls(1);
-+		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+	}
-+
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (task != current && task->acl->mode & GR_PROTPROCFD)
-+		return -EACCES;
-+
-+	return 0;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/gracl_ip.c linux-2.6.32.12/grsecurity/gracl_ip.c
---- linux-2.6.32.12/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_ip.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,339 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND			0x01
-+#define GR_CONNECT		0x02
-+#define GR_INVERT		0x04
-+#define GR_BINDOVERRIDE		0x08
-+#define GR_CONNECTOVERRIDE	0x10
-+
-+static const char * gr_protocols[256] = {
-+	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
-+	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
-+	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+	};
-+
-+static const char * gr_socktypes[11] = {
-+	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
-+	"unknown:7", "unknown:8", "unknown:9", "packet"
-+	};
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+	return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+	return gr_socktypes[type];
-+}
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+	struct acl_subject_label *curr;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		goto exit;
-+
-+	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
-+	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
-+		goto exit;	// let the kernel handle it
-+
-+	curr = current->acl;
-+
-+	if (!curr->ips)
-+		goto exit;
-+
-+	if ((curr->ip_type & (1 << type)) &&
-+	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
-+		goto exit;
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		/* we don't place acls on raw sockets , and sometimes
-+		   dgram/ip sockets are opened for ioctl and not
-+		   bind/connect, so we'll fake a bind learn log */
-+		if (type == SOCK_RAW || type == SOCK_PACKET) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_CONNECT, &current->signal->curr_ip);
-+		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_BIND, &current->signal->curr_ip);
-+		}
-+		/* we'll log when they use connect or bind */
-+		goto exit;
-+	}
-+
-+	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
-+		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+
-+	return 0;
-+      exit:
-+	return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+	if ((ip->mode & mode) &&
-+	    (ip_port >= ip->low) &&
-+	    (ip_port <= ip->high) &&
-+	    ((ntohl(ip_addr) & our_netmask) ==
-+	     (ntohl(our_addr) & our_netmask))
-+	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+	    && (ip->type & (1 << type))) {
-+		if (ip->mode & GR_INVERT)
-+			return 2; // specifically denied
-+		else
-+			return 1; // allowed
-+	}
-+
-+	return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+		      struct sockaddr_in *addr, const int type)
-+{
-+	char iface[IFNAMSIZ] = {0};
-+	struct acl_subject_label *curr;
-+	struct acl_ip_label *ip;
-+	struct inet_sock *isk;
-+	struct net_device *dev;
-+	struct in_device *idev;
-+	unsigned long i;
-+	int ret;
-+	int mode = full_mode & (GR_BIND | GR_CONNECT);
-+	__u32 ip_addr = 0;
-+	__u32 our_addr;
-+	__u32 our_netmask;
-+	char *p;
-+	__u16 ip_port = 0;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+		return 0;
-+
-+	curr = current->acl;
-+	isk = inet_sk(sk);
-+
-+	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+		addr->sin_addr.s_addr = curr->inaddr_any_override;
-+	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+		struct sockaddr_in saddr;
-+		int err;
-+
-+		saddr.sin_family = AF_INET;
-+		saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+		saddr.sin_port = isk->sport;
-+
-+		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+
-+		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+	}
-+
-+	if (!curr->ips)
-+		return 0;
-+
-+	ip_addr = addr->sin_addr.s_addr;
-+	ip_port = ntohs(addr->sin_port);
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+			       current->role->roletype, cred->uid,
-+			       cred->gid, current->exec_file ?
-+			       gr_to_filename(current->exec_file->f_path.dentry,
-+			       current->exec_file->f_path.mnt) :
-+			       curr->filename, curr->filename,
-+			       &ip_addr, ip_port, type,
-+			       sk->sk_protocol, mode, &current->signal->curr_ip);
-+		return 0;
-+	}
-+
-+	for (i = 0; i < curr->ip_num; i++) {
-+		ip = *(curr->ips + i);
-+		if (ip->iface != NULL) {
-+			strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+			p = strchr(iface, ':');
-+			if (p != NULL)
-+				*p = '\0';
-+			dev = dev_get_by_name(sock_net(sk), iface);
-+			if (dev == NULL)
-+				continue;
-+			idev = in_dev_get(dev);
-+			if (idev == NULL) {
-+				dev_put(dev);
-+				continue;
-+			}
-+			rcu_read_lock();
-+			for_ifa(idev) {
-+				if (!strcmp(ip->iface, ifa->ifa_label)) {
-+					our_addr = ifa->ifa_address;
-+					our_netmask = 0xffffffff;
-+					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+					if (ret == 1) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						return 0;
-+					} else if (ret == 2) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						goto denied;
-+					}
-+				}
-+			} endfor_ifa(idev);
-+			rcu_read_unlock();
-+			in_dev_put(idev);
-+			dev_put(dev);
-+		} else {
-+			our_addr = ip->addr;
-+			our_netmask = ip->netmask;
-+			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+			if (ret == 1)
-+				return 0;
-+			else if (ret == 2)
-+				goto denied;
-+		}
-+	}
-+
-+denied:
-+	if (mode == GR_BIND)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+	else if (mode == GR_CONNECT)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+	return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+	if (addr)
-+		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+	else {
-+		struct sockaddr_in sin;
-+		const struct inet_sock *inet = inet_sk(sk);
-+
-+		sin.sin_addr.s_addr = inet->daddr;
-+		sin.sin_port = inet->dport;
-+
-+		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+	}
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+	struct sockaddr_in sin;
-+
-+	if (unlikely(skb->len < sizeof (struct udphdr)))
-+		return 0;	// skip this packet
-+
-+	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+	sin.sin_port = udp_hdr(skb)->source;
-+
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff -urNp linux-2.6.32.12/grsecurity/gracl_learn.c linux-2.6.32.12/grsecurity/gracl_learn.c
---- linux-2.6.32.12/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_learn.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,211 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+				   size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DECLARE_MUTEX(gr_learn_user_sem);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+   uses a semaphore around the userspace copying, and the other kernel contexts
-+   use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+	DECLARE_WAITQUEUE(wait, current);
-+	ssize_t retval = 0;
-+
-+	add_wait_queue(&learn_wait, &wait);
-+	set_current_state(TASK_INTERRUPTIBLE);
-+	do {
-+		down(&gr_learn_user_sem);
-+		spin_lock(&gr_learn_lock);
-+		if (learn_buffer_len)
-+			break;
-+		spin_unlock(&gr_learn_lock);
-+		up(&gr_learn_user_sem);
-+		if (file->f_flags & O_NONBLOCK) {
-+			retval = -EAGAIN;
-+			goto out;
-+		}
-+		if (signal_pending(current)) {
-+			retval = -ERESTARTSYS;
-+			goto out;
-+		}
-+
-+		schedule();
-+	} while (1);
-+
-+	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+	learn_buffer_user_len = learn_buffer_len;
-+	retval = learn_buffer_len;
-+	learn_buffer_len = 0;
-+
-+	spin_unlock(&gr_learn_lock);
-+
-+	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+		retval = -EFAULT;
-+
-+	up(&gr_learn_user_sem);
-+out:
-+	set_current_state(TASK_RUNNING);
-+	remove_wait_queue(&learn_wait, &wait);
-+	return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+	poll_wait(file, &learn_wait, wait);
-+
-+	if (learn_buffer_len)
-+		return (POLLIN | POLLRDNORM);
-+
-+	return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+	char *tmp;
-+
-+	down(&gr_learn_user_sem);
-+	if (learn_buffer != NULL) {
-+		spin_lock(&gr_learn_lock);
-+		tmp = learn_buffer;
-+		learn_buffer = NULL;
-+		spin_unlock(&gr_learn_lock);
-+		vfree(learn_buffer);
-+	}
-+	if (learn_buffer_user != NULL) {
-+		vfree(learn_buffer_user);
-+		learn_buffer_user = NULL;
-+	}
-+	learn_buffer_len = 0;
-+	up(&gr_learn_user_sem);
-+
-+	return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+	va_list args;
-+	unsigned int len;
-+
-+	if (!gr_learn_attached)
-+		return;
-+
-+	spin_lock(&gr_learn_lock);
-+
-+	/* leave a gap at the end so we know when it's "full" but don't have to
-+	   compute the exact length of the string we're trying to append
-+	*/
-+	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+		spin_unlock(&gr_learn_lock);
-+		wake_up_interruptible(&learn_wait);
-+		return;
-+	}
-+	if (learn_buffer == NULL) {
-+		spin_unlock(&gr_learn_lock);
-+		return;
-+	}
-+
-+	va_start(args, fmt);
-+	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+	va_end(args);
-+
-+	learn_buffer_len += len + 1;
-+
-+	spin_unlock(&gr_learn_lock);
-+	wake_up_interruptible(&learn_wait);
-+
-+	return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+	if (file->f_mode & FMODE_READ && gr_learn_attached)
-+		return -EBUSY;
-+	if (file->f_mode & FMODE_READ) {
-+		int retval = 0;
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer == NULL)
-+			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer_user == NULL)
-+			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		if (learn_buffer_user == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 1;
-+out_error:
-+		up(&gr_learn_user_sem);
-+		return retval;
-+	}
-+	return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+	char *tmp;
-+
-+	if (file->f_mode & FMODE_READ) {
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer != NULL) {
-+			spin_lock(&gr_learn_lock);
-+			tmp = learn_buffer;
-+			learn_buffer = NULL;
-+			spin_unlock(&gr_learn_lock);
-+			vfree(tmp);
-+		}
-+		if (learn_buffer_user != NULL) {
-+			vfree(learn_buffer_user);
-+			learn_buffer_user = NULL;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 0;
-+		up(&gr_learn_user_sem);
-+	}
-+
-+	return 0;
-+}
-+		
-+const struct file_operations grsec_fops = {
-+	.read		= read_learn,
-+	.write		= write_grsec_handler,
-+	.open		= open_learn,
-+	.release	= close_learn,
-+	.poll		= poll_learn,
-+};
-diff -urNp linux-2.6.32.12/grsecurity/gracl_res.c linux-2.6.32.12/grsecurity/gracl_res.c
---- linux-2.6.32.12/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_res.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+	[RLIMIT_CPU] = "RLIMIT_CPU",
-+	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+	[RLIMIT_DATA] = "RLIMIT_DATA",
-+	[RLIMIT_STACK] = "RLIMIT_STACK",
-+	[RLIMIT_CORE] = "RLIMIT_CORE",
-+	[RLIMIT_RSS] = "RLIMIT_RSS",
-+	[RLIMIT_NPROC] = "RLIMIT_NPROC",
-+	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+	[RLIMIT_AS] = "RLIMIT_AS",
-+	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+	[RLIMIT_NICE] = "RLIMIT_NICE",
-+	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+	[GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+		const int res, const unsigned long wanted, const int gt)
-+{
-+	const struct cred *cred;
-+
-+	if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+		return;
-+
-+	// not yet supported resource
-+	if (!restab_log[res])
-+		return;
-+
-+	rcu_read_lock();
-+	cred = __task_cred(task);
-+
-+	if (res == RLIMIT_NPROC && 
-+	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
-+	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_MEMLOCK &&
-+		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+		goto out_rcu_unlock;
-+	rcu_read_unlock();
-+
-+	preempt_disable();
-+
-+	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
-+		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
-+		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
-+		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
-+	preempt_enable_no_resched();
-+
-+	return;
-+out_rcu_unlock:
-+	rcu_read_unlock();
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/gracl_segv.c linux-2.6.32.12/grsecurity/gracl_segv.c
---- linux-2.6.32.12/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_segv.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,310 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+			      struct acl_role_label *role);
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int
-+gr_init_uidset(void)
-+{
-+	uid_set =
-+	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+	uid_used = 0;
-+
-+	return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+	if (uid_set)
-+		kfree(uid_set);
-+
-+	return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+	struct crash_uid *tmp = uid_set;
-+	uid_t buid;
-+	int low = 0, high = uid_used - 1, mid;
-+
-+	while (high >= low) {
-+		mid = (low + high) >> 1;
-+		buid = tmp[mid].uid;
-+		if (buid == uid)
-+			return mid;
-+		if (buid > uid)
-+			high = mid - 1;
-+		if (buid < uid)
-+			low = mid + 1;
-+	}
-+
-+	return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+	unsigned short i, j;
-+	struct crash_uid index;
-+
-+	for (i = 1; i < uid_used; i++) {
-+		index = uid_set[i];
-+		j = i;
-+		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+			uid_set[j] = uid_set[j - 1];
-+			j--;
-+		}
-+		uid_set[j] = index;
-+	}
-+
-+	return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+	int loc;
-+
-+	if (uid_used == GR_UIDTABLE_MAX)
-+		return;
-+
-+	loc = gr_find_uid(uid);
-+
-+	if (loc >= 0) {
-+		uid_set[loc].expires = expires;
-+		return;
-+	}
-+
-+	uid_set[uid_used].uid = uid;
-+	uid_set[uid_used].expires = expires;
-+	uid_used++;
-+
-+	gr_insertsort();
-+
-+	return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+	unsigned short i;
-+
-+	for (i = loc + 1; i < uid_used; i++)
-+		uid_set[i - 1] = uid_set[i];
-+
-+	uid_used--;
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	int loc;
-+	int ret = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	spin_lock(&gr_uid_lock);
-+	loc = gr_find_uid(uid);
-+
-+	if (loc < 0)
-+		goto out_unlock;
-+
-+	if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+		gr_remove_uid(loc);
-+	else
-+		ret = 1;
-+
-+out_unlock:
-+	spin_unlock(&gr_uid_lock);
-+	return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+	if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+	    cred->uid != cred->fsuid)
-+		return 1;
-+	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+	    cred->gid != cred->fsgid)
-+		return 1;
-+
-+	return 0;
-+}
-+static __inline__ int
-+gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+	unsigned long int flags;
-+	int ret, blocked, ignored;
-+	struct k_sigaction *action;
-+
-+	spin_lock_irqsave(&t->sighand->siglock, flags);
-+	action = &t->sighand->action[sig-1];
-+	ignored = action->sa.sa_handler == SIG_IGN;
-+	blocked = sigismember(&t->blocked, sig);
-+	if (blocked || ignored) {
-+		action->sa.sa_handler = SIG_DFL;
-+		if (blocked) {
-+			sigdelset(&t->blocked, sig);
-+			recalc_sigpending_and_wake(t);
-+		}
-+	}
-+	if (action->sa.sa_handler == SIG_DFL)
-+		t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+	spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+	return ret;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	struct acl_subject_label *curr;
-+	struct acl_subject_label *curr2;
-+	struct task_struct *tsk, *tsk2;
-+	const struct cred *cred;
-+	const struct cred *cred2;
-+
-+	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+		return;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curr = task->acl;
-+
-+	if (!(curr->resmask & (1 << GR_CRASH_RES)))
-+		return;
-+
-+	if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->expires = 0;
-+		curr->crashes = 0;
-+	}
-+
-+	curr->crashes++;
-+
-+	if (!curr->expires)
-+		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds())) {
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		if (cred->uid && proc_is_setxid(cred)) {
-+			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			spin_lock(&gr_uid_lock);
-+			gr_insert_uid(cred->uid, curr->expires);
-+			spin_unlock(&gr_uid_lock);
-+			curr->expires = 0;
-+			curr->crashes = 0;
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				cred2 = __task_cred(tsk);
-+				if (tsk != task && cred2->uid == cred->uid)
-+					gr_fake_force_sig(SIGKILL, tsk);
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		} else {
-+			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				if (likely(tsk != task)) {
-+					curr2 = tsk->acl;
-+
-+					if (curr2->device == curr->device &&
-+					    curr2->inode == curr->inode)
-+						gr_fake_force_sig(SIGKILL, tsk);
-+				}
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		}
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	struct acl_subject_label *curr;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	read_lock(&gr_inode_lock);
-+	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+				     filp->f_path.dentry->d_inode->i_sb->s_dev,
-+				     current->role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
-+	    (!curr->crashes && !curr->expires))
-+		return 0;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds()))
-+		return 1;
-+	else if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->crashes = 0;
-+		curr->expires = 0;
-+	}
-+
-+	return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	struct acl_subject_label *curracl;
-+	__u32 curr_ip;
-+	struct task_struct *p, *p2;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curracl = task->acl;
-+	curr_ip = task->signal->curr_ip;
-+
-+	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+		read_lock(&tasklist_lock);
-+		do_each_thread(p2, p) {
-+			if (p->signal->curr_ip == curr_ip)
-+				gr_fake_force_sig(SIGKILL, p);
-+		} while_each_thread(p2, p);
-+		read_unlock(&tasklist_lock);
-+	} else if (curracl->mode & GR_KILLPROC)
-+		gr_fake_force_sig(SIGKILL, task);
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/gracl_shm.c linux-2.6.32.12/grsecurity/gracl_shm.c
---- linux-2.6.32.12/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/gracl_shm.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,37 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	struct task_struct *task;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	task = find_task_by_vpid(shm_cprid);
-+
-+	if (unlikely(!task))
-+		task = find_task_by_vpid(shm_lapid);
-+
-+	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+			      (task->pid == shm_lapid)) &&
-+		     (task->acl->mode & GR_PROTSHM) &&
-+		     (task->acl != current->acl))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+		return 0;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+	return 1;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_chdir.c linux-2.6.32.12/grsecurity/grsec_chdir.c
---- linux-2.6.32.12/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_chdir.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	if ((grsec_enable_chdir && grsec_enable_group &&
-+	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+					      !grsec_enable_group)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+	}
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_chroot.c linux-2.6.32.12/grsecurity/grsec_chroot.c
---- linux-2.6.32.12/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_chroot.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,348 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	struct pid *spid = NULL;
-+
-+	if (unlikely(!grsec_enable_chroot_unix))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	spid = find_vpid(pid);
-+	if (spid) {
-+		struct task_struct *p;
-+		p = pid_task(spid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		if (unlikely(!have_same_root(current, p))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	}
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+			&& proc_is_chrooted(current)) {
-+		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
-+	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+		return 0;
-+
-+	gr_fs_read_lock(p);
-+	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+	    !have_same_root(current, p)) {
-+		gr_fs_read_unlock(p);
-+		return 1;
-+	}
-+	gr_fs_read_unlock(p);
-+#endif
-+	return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+	struct dentry *dentry = (struct dentry *)u_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+	struct dentry *realroot;
-+	struct vfsmount *realrootmnt;
-+	struct dentry *currentroot;
-+	struct vfsmount *currentmnt;
-+	struct task_struct *reaper = &init_task;
-+	int ret = 1;
-+
-+	read_lock(&reaper->fs->lock);
-+	realrootmnt = mntget(reaper->fs->root.mnt);
-+	realroot = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+
-+	read_lock(&current->fs->lock);
-+	currentmnt = mntget(current->fs->root.mnt);
-+	currentroot = dget(current->fs->root.dentry);
-+	read_unlock(&current->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	for (;;) {
-+		if (unlikely((dentry == realroot && mnt == realrootmnt)
-+		     || (dentry == currentroot && mnt == currentmnt)))
-+			break;
-+		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+		dentry = dentry->d_parent;
-+	}
-+	spin_unlock(&dcache_lock);
-+
-+	dput(currentroot);
-+	mntput(currentmnt);
-+
-+	/* access is outside of chroot */
-+	if (dentry == realroot && mnt == realrootmnt)
-+		ret = 0;
-+
-+	dput(realroot);
-+	mntput(realrootmnt);
-+	return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	if (!grsec_enable_chroot_fchdir)
-+		return 1;
-+
-+	if (!proc_is_chrooted(current))
-+		return 1;
-+	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+		return 0;
-+	}
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	struct pid *pid = NULL;
-+	time_t starttime;
-+
-+	if (unlikely(!grsec_enable_chroot_shmat))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	pid = find_vpid(shm_cprid);
-+	if (pid) {
-+		struct task_struct *p;
-+		p = pid_task(pid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		starttime = p->start_time.tv_sec;
-+		if (unlikely(!have_same_root(current, p) &&
-+			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	} else {
-+		pid = find_vpid(shm_lapid);
-+		if (pid) {
-+			struct task_struct *p;
-+			p = pid_task(pid, PIDTYPE_PID);
-+			gr_fs_read_lock(p);
-+			if (unlikely(!have_same_root(current, p))) {
-+				gr_fs_read_unlock(p);
-+				read_unlock(&tasklist_lock);
-+				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+				return 0;
-+			}
-+			gr_fs_read_unlock(p);
-+		}
-+	}
-+
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+	    !gr_is_outside_chroot(dentry, mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_caps(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
-+		(init_task.fs->root.dentry != path->dentry) &&
-+		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
-+
-+		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+		const struct cred *old = current_cred();
-+		struct cred *new = prepare_creds();
-+		if (new == NULL)
-+			return 1;
-+
-+		new->cap_permitted = cap_drop(old->cap_permitted, 
-+					      chroot_caps);
-+		new->cap_inheritable = cap_drop(old->cap_inheritable, 
-+						chroot_caps);
-+		new->cap_effective = cap_drop(old->cap_effective,
-+					      chroot_caps);
-+
-+		commit_creds(new);
-+
-+		return 0;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+	    && (op & MAY_WRITE))
-+		return -EACCES;
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	if (grsec_enable_chroot_chdir)
-+		set_fs_pwd(current->fs, path);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	if (grsec_enable_chroot_chmod &&
-+	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_handle_chroot_caps);
-+#endif
-diff -urNp linux-2.6.32.12/grsecurity/grsec_disabled.c linux-2.6.32.12/grsecurity/grsec_disabled.c
---- linux-2.6.32.12/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_disabled.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,426 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+	return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+		      const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+		   unsigned int *vm_flags)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+		       const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+		     const struct vfsmount * mnt, const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		    mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+		     const struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     const struct dentry *old_dentry,
-+		     const struct inode *old_parent_inode,
-+		     const struct vfsmount *old_mnt, const char *newname)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+		      const int namelen, const ino_t ino)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff -urNp linux-2.6.32.12/grsecurity/grsec_exec.c linux-2.6.32.12/grsecurity/grsec_exec.c
---- linux-2.6.32.12/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_exec.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,89 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DECLARE_MUTEX(gr_exec_arg_sem);
-+#endif
-+
-+int
-+gr_handle_nproc(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	const struct cred *cred = current_cred();
-+	if (grsec_enable_execve && cred->user &&
-+	    (atomic_read(&cred->user->processes) >
-+	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
-+	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
-+		return -EAGAIN;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	char *grarg = gr_exec_arg_buf;
-+	unsigned int i, x, execlen = 0;
-+	char c;
-+
-+	if (!((grsec_enable_execlog && grsec_enable_group &&
-+	       in_group_p(grsec_audit_gid))
-+	      || (grsec_enable_execlog && !grsec_enable_group)))
-+		return;
-+
-+	down(&gr_exec_arg_sem);
-+	memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+	if (unlikely(argv == NULL))
-+		goto log;
-+
-+	for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+		const char __user *p;
-+		unsigned int len;
-+
-+		if (copy_from_user(&p, argv + i, sizeof(p)))
-+			goto log;
-+		if (!p)
-+			goto log;
-+		len = strnlen_user(p, 128 - execlen);
-+		if (len > 128 - execlen)
-+			len = 128 - execlen;
-+		else if (len > 0)
-+			len--;
-+		if (copy_from_user(grarg + execlen, p, len))
-+			goto log;
-+
-+		/* rewrite unprintable characters */
-+		for (x = 0; x < len; x++) {
-+			c = *(grarg + execlen + x);
-+			if (c < 32 || c > 126)
-+				*(grarg + execlen + x) = ' ';
-+		}
-+
-+		execlen += len;
-+		*(grarg + execlen) = ' ';
-+		*(grarg + execlen + 1) = '\0';
-+		execlen++;
-+	}
-+
-+      log:
-+	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+			bprm->file->f_path.mnt, grarg);
-+	up(&gr_exec_arg_sem);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_fifo.c linux-2.6.32.12/grsecurity/grsec_fifo.c
---- linux-2.6.32.12/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_fifo.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+	       const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+	    (cred->fsuid != dentry->d_inode->i_uid)) {
-+		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
-+			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_fork.c linux-2.6.32.12/grsecurity/grsec_fork.c
---- linux-2.6.32.12/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_fork.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,15 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
-+		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_init.c linux-2.6.32.12/grsecurity/grsec_init.c
---- linux-2.6.32.12/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_init.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,241 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execve;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+	int j;
-+	/* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+	for (j = 0; j < 4; j++) {
-+		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+		if (gr_shared_page[j] == NULL) {
-+			panic("Unable to allocate grsecurity shared page");
-+			return;
-+		}
-+	}
-+
-+	/* allocate log buffers */
-+	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_alert_log_fmt) {
-+		panic("Unable to allocate grsecurity alert log format buffer");
-+		return;
-+	}
-+	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_audit_log_fmt) {
-+		panic("Unable to allocate grsecurity audit log format buffer");
-+		return;
-+	}
-+	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_alert_log_buf) {
-+		panic("Unable to allocate grsecurity alert log buffer");
-+		return;
-+	}
-+	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_audit_log_buf) {
-+		panic("Unable to allocate grsecurity audit log buffer");
-+		return;
-+	}
-+
-+	/* allocate memory for authentication structure */
-+	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+		panic("Unable to allocate grsecurity authentication structure");
-+		return;
-+	}
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+	grsec_lock = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	grsec_enable_group = 1;
-+	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	grsec_enable_blackhole = 1;
-+	grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	grsec_enable_execve = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	grsec_enable_tpe = 1;
-+	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	grsec_enable_socket_all = 1;
-+	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	grsec_enable_socket_client = 1;
-+	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	grsec_enable_socket_server = 1;
-+	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_link.c linux-2.6.32.12/grsecurity/grsec_link.c
---- linux-2.6.32.12/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_link.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,43 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+		      const struct inode *inode,
-+		      const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+		   const struct vfsmount *mnt,
-+		   struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+	    (!S_ISREG(mode) || (mode & S_ISUID) ||
-+	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
-+	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
-+	    !capable(CAP_FOWNER) && cred->uid) {
-+		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_log.c linux-2.6.32.12/grsecurity/grsec_log.c
---- linux-2.6.32.12/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_log.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,296 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#define BEGIN_LOCKS(x) \
-+	rcu_read_lock(); \
-+	read_lock(&tasklist_lock); \
-+	read_lock(&grsec_exec_file_lock); \
-+	if (x != GR_DO_AUDIT) \
-+		spin_lock(&grsec_alert_lock); \
-+	else \
-+		spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+	if (x != GR_DO_AUDIT) \
-+		spin_unlock(&grsec_alert_lock); \
-+	else \
-+		spin_unlock(&grsec_audit_lock); \
-+	read_unlock(&grsec_exec_file_lock); \
-+	read_unlock(&tasklist_lock); \
-+	rcu_read_unlock(); \
-+	if (x == GR_DONT_AUDIT) \
-+		gr_handle_alertkill(current)
-+
-+enum {
-+	FLOODING,
-+	NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+	if (audit == GR_DO_AUDIT)
-+		goto set_fmt;
-+
-+	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet = 0;
-+	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+		grsec_alert_fyet++;
-+	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet++;
-+		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+		return FLOODING;
-+	} else return FLOODING;
-+
-+set_fmt:
-+	memset(buf, 0, PAGE_SIZE);
-+	if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else if (current->signal->curr_ip) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
-+	} else if (gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+		strcpy(buf, fmt);
-+	}
-+
-+	return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+	__attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+	return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+	__attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+	va_list ap;
-+
-+	va_start(ap, msg);
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+	va_end(ap);
-+
-+	return;
-+}
-+
-+static void gr_log_end(int audit)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
-+	printk("%s\n", buf);
-+
-+	return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+	int logtype;
-+	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+	char *str1, *str2, *str3;
-+	void *voidptr;
-+	int num1, num2;
-+	unsigned long ulong1, ulong2;
-+	struct dentry *dentry;
-+	struct vfsmount *mnt;
-+	struct file *file;
-+	struct task_struct *task;
-+	const struct cred *cred, *pcred;
-+	va_list ap;
-+
-+	BEGIN_LOCKS(audit);
-+	logtype = gr_log_start(audit);
-+	if (logtype == FLOODING) {
-+		END_LOCKS(audit);
-+		return;
-+	}
-+	va_start(ap, argtypes);
-+	switch (argtypes) {
-+	case GR_TTYSNIFF:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
-+		break;
-+	case GR_SYSCTL_HIDDEN:
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, str1);
-+		break;
-+	case GR_RBAC:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_STR_RBAC:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_MODE2:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+		break;
-+	case GR_RBAC_MODE3:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		str3 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+		break;
-+	case GR_FILENAME:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_STR_FILENAME:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_FILENAME_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_FILENAME_TWO_INT:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+		break;
-+	case GR_FILENAME_TWO_INT_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+		break;
-+	case GR_TEXTREL:
-+		file = va_arg(ap, struct file *);
-+		ulong1 = va_arg(ap, unsigned long);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+		break;
-+	case GR_PTRACE:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+		break;
-+	case GR_RESOURCE:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		str1 = va_arg(ap, char *);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CAP:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_SIG:
-+		str1 = va_arg(ap, char *);
-+		voidptr = va_arg(ap, void *);
-+		gr_log_middle_varargs(audit, msg, str1, voidptr);
-+		break;
-+	case GR_SIG2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		num1 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CRASH1:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+		break;
-+	case GR_CRASH2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+		break;
-+	case GR_PSACCT:
-+		{
-+			unsigned int wday, cday;
-+			__u8 whr, chr;
-+			__u8 wmin, cmin;
-+			__u8 wsec, csec;
-+			char cur_tty[64] = { 0 };
-+			char parent_tty[64] = { 0 };
-+
-+			task = va_arg(ap, struct task_struct *);
-+			wday = va_arg(ap, unsigned int);
-+			cday = va_arg(ap, unsigned int);
-+			whr = va_arg(ap, int);
-+			chr = va_arg(ap, int);
-+			wmin = va_arg(ap, int);
-+			cmin = va_arg(ap, int);
-+			wsec = va_arg(ap, int);
-+			csec = va_arg(ap, int);
-+			ulong1 = va_arg(ap, unsigned long);
-+			cred = __task_cred(task);
-+			pcred = __task_cred(task->parent);
-+
-+			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		}
-+		break;
-+	default:
-+		gr_log_middle(audit, msg, ap);
-+	}
-+	va_end(ap);
-+	gr_log_end(audit);
-+	END_LOCKS(audit);
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_mem.c linux-2.6.32.12/grsecurity/grsec_mem.c
---- linux-2.6.32.12/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_mem.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,85 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_mem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_kmem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_open_port(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
-+	return;
-+}
-+
-+int
-+gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
-+{
-+	unsigned long start, end;
-+
-+	start = offset;
-+	end = start + vma->vm_end - vma->vm_start;
-+
-+	if (start > end) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	}
-+
-+	/* allowed ranges : ISA I/O BIOS */
-+	if ((start >= __pa(high_memory))
-+#if defined(CONFIG_X86) || defined(CONFIG_PPC)
-+	    || (start >= 0x000a0000 && end <= 0x00100000)
-+	    || (start >= 0x00000000 && end <= 0x00001000)
-+#endif
-+	)
-+		return 0;
-+
-+	if (vma->vm_flags & VM_WRITE) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	} else
-+		vma->vm_flags &= ~VM_MAYWRITE;
-+
-+	return 0;
-+}
-+
-+void
-+gr_log_nonroot_mod_load(const char *modname)
-+{
-+        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
-+        return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_mount.c linux-2.6.32.12/grsecurity/grsec_mount.c
---- linux-2.6.32.12/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_mount.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,62 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_ptrace.c linux-2.6.32.12/grsecurity/grsec_ptrace.c
---- linux-2.6.32.12/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_ptrace.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,14 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	if (grsec_enable_audit_ptrace)
-+		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_sig.c linux-2.6.32.12/grsecurity/grsec_sig.c
---- linux-2.6.32.12/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_sig.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+char *signames[] = {
-+	[SIGSEGV] = "Segmentation fault",
-+	[SIGILL] = "Illegal instruction",
-+	[SIGABRT] = "Abort",
-+	[SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+				    (sig == SIGABRT) || (sig == SIGBUS))) {
-+		if (t->pid == current->pid) {
-+			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+		} else {
-+			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+		}
-+	}
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (current->pid > 1 && gr_check_protected_task(p)) {
-+		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+		return -EPERM;
-+	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void gr_handle_brute_attach(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	if (p->parent && p->parent->exec_file == p->exec_file)
-+		p->parent->brute = 1;
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	if (current->brute)
-+		msleep(30 * 1000);
-+#endif
-+	return;
-+}
-+
-diff -urNp linux-2.6.32.12/grsecurity/grsec_sock.c linux-2.6.32.12/grsecurity/grsec_sock.c
---- linux-2.6.32.12/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_sock.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,271 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+	struct conn_table_entry *next;
-+	struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+
-+static __inline__ int 
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
-+	   __u16 sport, __u16 dport)
-+{
-+	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+		     sig->gr_sport == sport && sig->gr_dport == dport))
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+	struct conn_table_entry **match;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	newent->sig = sig;
-+	
-+	match = &gr_conn_table[index];
-+	newent->next = *match;
-+	*match = newent;
-+
-+	return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+	struct conn_table_entry *match, *last = NULL;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, 
-+		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
-+		sig->gr_dport)) {
-+		last = match;
-+		match = match->next;
-+	}
-+
-+	if (match) {
-+		if (last)
-+			last->next = match->next;
-+		else
-+			gr_conn_table[index] = NULL;
-+		kfree(match);
-+	}
-+
-+	return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+					     __u16 sport, __u16 dport)
-+{
-+	struct conn_table_entry *match;
-+	unsigned int index;
-+
-+	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+		match = match->next;
-+
-+	if (match)
-+		return match->sig;
-+	else
-+		return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *sig = task->signal;
-+	struct conn_table_entry *newent;
-+
-+	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+	if (newent == NULL)
-+		return;
-+	/* no bh lock needed since we are called with bh disabled */
-+	spin_lock(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(sig);
-+	sig->gr_saddr = inet->rcv_saddr;
-+	sig->gr_daddr = inet->daddr;
-+	sig->gr_sport = inet->sport;
-+	sig->gr_dport = inet->dport;
-+	gr_add_to_task_ip_table_nolock(sig, newent);
-+	spin_unlock(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	spin_lock_bh(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(task->signal);
-+	spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *p, *set;
-+	const struct inet_sock *inet = inet_sk(sk);	
-+
-+	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+		return;
-+
-+	set = current->signal;
-+
-+	spin_lock_bh(&gr_conn_table_lock);
-+	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+				    inet->dport, inet->sport);
-+	if (unlikely(p != NULL)) {
-+		set->curr_ip = p->curr_ip;
-+		set->used_accept = 1;
-+		gr_del_task_from_ip_table_nolock(p);
-+		spin_unlock_bh(&gr_conn_table_lock);
-+		return;
-+	}
-+	spin_unlock_bh(&gr_conn_table_lock);
-+
-+	set->curr_ip = inet->daddr;
-+	set->used_accept = 1;
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+	    (family != AF_UNIX) && (family != AF_LOCAL)) {
-+		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sk_family != AF_UNIX) &&
-+	    (sck->sk_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_acl_is_enabled())
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_ISCSI &&
-+		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+		 gr_is_capable(CAP_SYS_ADMIN))
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_AUDIT &&
-+		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+		 gr_is_capable(CAP_AUDIT_WRITE) &&
-+		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+		 gr_is_capable(CAP_AUDIT_CONTROL))
-+		return current_cap();
-+	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
-+		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
-+		  gr_is_capable(CAP_NET_ADMIN)))
-+		return current_cap();
-+	else
-+		return __cap_empty_set;
-+#else
-+	return current_cap();
-+#endif
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_sysctl.c linux-2.6.32.12/grsecurity/grsec_sysctl.c
---- linux-2.6.32.12/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_sysctl.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,447 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+static int __maybe_unused one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "linking_restrictions",
-+		.data		= &grsec_enable_link,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "fifo_restrictions",
-+		.data		= &grsec_enable_fifo,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "execve_limiting",
-+		.data		= &grsec_enable_execve,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "ip_blackhole",
-+		.data		= &grsec_enable_blackhole,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "lastack_retries",
-+		.data		= &grsec_lastack_retries,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "exec_logging",
-+		.data		= &grsec_enable_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "signal_logging",
-+		.data		= &grsec_enable_signal,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "forkfail_logging",
-+		.data		= &grsec_enable_forkfail,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "timechange_logging",
-+		.data		= &grsec_enable_time,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_shmat",
-+		.data		= &grsec_enable_chroot_shmat,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_unix",
-+		.data		= &grsec_enable_chroot_unix,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mount",
-+		.data		= &grsec_enable_chroot_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_fchdir",
-+		.data		= &grsec_enable_chroot_fchdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chroot",
-+		.data		= &grsec_enable_chroot_double,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_pivot",
-+		.data		= &grsec_enable_chroot_pivot,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_enforce_chdir",
-+		.data		= &grsec_enable_chroot_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chmod",
-+		.data		= &grsec_enable_chroot_chmod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mknod",
-+		.data		= &grsec_enable_chroot_mknod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_restrict_nice",
-+		.data		= &grsec_enable_chroot_nice,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_execlog",
-+		.data		= &grsec_enable_chroot_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_caps",
-+		.data		= &grsec_enable_chroot_caps,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_sysctl",
-+		.data		= &grsec_enable_chroot_sysctl,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe",
-+		.data		= &grsec_enable_tpe,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_gid",
-+		.data		= &grsec_tpe_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_restrict_all",
-+		.data		= &grsec_enable_tpe_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all",
-+		.data		= &grsec_enable_socket_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all_gid",
-+		.data		= &grsec_socket_all_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client",
-+		.data		= &grsec_enable_socket_client,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client_gid",
-+		.data		= &grsec_socket_client_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server",
-+		.data		= &grsec_enable_socket_server,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server_gid",
-+		.data		= &grsec_socket_server_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_group",
-+		.data		= &grsec_enable_group,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_gid",
-+		.data		= &grsec_audit_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_chdir",
-+		.data		= &grsec_enable_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_mount",
-+		.data		= &grsec_enable_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_textrel",
-+		.data		= &grsec_enable_audit_textrel,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "dmesg",
-+		.data		= &grsec_enable_dmesg,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_findtask",
-+		.data		= &grsec_enable_chroot_findtask,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "resource_logging",
-+		.data		= &grsec_resource_logging,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_ptrace",
-+		.data		= &grsec_enable_audit_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "harden_ptrace",
-+		.data		= &grsec_enable_harden_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsec_lock",
-+		.data		= &grsec_lock,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "romount_protect",
-+		.data		= &grsec_enable_rofs,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec_minmax,
-+		.extra1		= &one,
-+		.extra2		= &one,
-+	},
-+#endif
-+	{ .ctl_name = 0 }
-+};
-+#endif
-diff -urNp linux-2.6.32.12/grsecurity/grsec_textrel.c linux-2.6.32.12/grsecurity/grsec_textrel.c
---- linux-2.6.32.12/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_textrel.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	if (grsec_enable_audit_textrel)
-+		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_time.c linux-2.6.32.12/grsecurity/grsec_time.c
---- linux-2.6.32.12/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_time.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,13 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	if (grsec_enable_time)
-+		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsec_tpe.c linux-2.6.32.12/grsecurity/grsec_tpe.c
---- linux-2.6.32.12/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsec_tpe.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,38 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+	const struct cred *cred = current_cred();
-+
-+	if (cred->uid && ((grsec_enable_tpe &&
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+	    !in_group_p(grsec_tpe_gid)
-+#else
-+	    in_group_p(grsec_tpe_gid)
-+#endif
-+	    ) || gr_acl_tpe_check()) &&
-+	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
-+						(inode->i_mode & S_IWOTH))))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
-+	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
-+	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#endif
-+#endif
-+	return 1;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/grsum.c linux-2.6.32.12/grsecurity/grsum.c
---- linux-2.6.32.12/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/grsum.c	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,59 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+	char *p;
-+	struct crypto_hash *tfm;
-+	struct hash_desc desc;
-+	struct scatterlist sg;
-+	unsigned char temp_sum[GR_SHA_LEN];
-+	volatile int retval = 0;
-+	volatile int dummy = 0;
-+	unsigned int i;
-+
-+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+	if (IS_ERR(tfm)) {
-+		/* should never happen, since sha256 should be built in */
-+		return 1;
-+	}
-+
-+	desc.tfm = tfm;
-+	desc.flags = 0;
-+
-+	crypto_hash_init(&desc);
-+
-+	p = salt;
-+	sg_set_buf(&sg, p, GR_SALT_LEN);
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	p = entry->pw;
-+	sg_set_buf(&sg, p, strlen(p));
-+	
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	crypto_hash_final(&desc, temp_sum);
-+
-+	memset(entry->pw, 0, GR_PW_LEN);
-+
-+	for (i = 0; i < GR_SHA_LEN; i++)
-+		if (sum[i] != temp_sum[i])
-+			retval = 1;
-+		else
-+			dummy = 1;	// waste a cycle
-+
-+	crypto_free_hash(tfm);
-+
-+	return retval;
-+}
-diff -urNp linux-2.6.32.12/grsecurity/Kconfig linux-2.6.32.12/grsecurity/Kconfig
---- linux-2.6.32.12/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/Kconfig	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,965 @@
-+#
-+# grecurity configuration
-+#
-+
-+menu "Grsecurity"
-+
-+config GRKERNSEC
-+	bool "Grsecurity"
-+	select CRYPTO
-+	select CRYPTO_SHA256
-+	help
-+	  If you say Y here, you will be able to configure many features
-+	  that will enhance the security of your system.  It is highly
-+	  recommended that you say Y here and read through the help
-+	  for each option so that you fully understand the features and
-+	  can evaluate their usefulness for your machine.
-+
-+choice
-+	prompt "Security Level"
-+	depends on GRKERNSEC
-+	default GRKERNSEC_CUSTOM
-+
-+config GRKERNSEC_LOW
-+	bool "Low"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_CHDIR
-+
-+	help
-+	  If you choose this option, several of the grsecurity options will
-+	  be enabled that will give you greater protection against a number
-+	  of attacks, while assuring that none of your software will have any
-+	  conflicts with the additional security measures.  If you run a lot
-+	  of unusual software, or you are having problems with the higher
-+	  security levels, you should say Y here.  With this option, the
-+	  following features are enabled:
-+
-+	  - Linking restrictions
-+	  - FIFO restrictions
-+	  - Enforcing RLIMIT_NPROC on execve
-+	  - Restricted dmesg
-+	  - Enforced chdir("/") on chroot
-+	  - Runtime module disabling
-+
-+config GRKERNSEC_MEDIUM
-+	bool "Medium"
-+	select PAX
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_USERGROUP
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
-+
-+	help
-+	  If you say Y here, several features in addition to those included
-+	  in the low additional security level will be enabled.  These
-+	  features provide even more security to your system, though in rare
-+	  cases they may be incompatible with very old or poorly written
-+	  software.  If you enable this option, make sure that your auth
-+	  service (identd) is running as gid 1001.  With this option, 
-+	  the following features (in addition to those provided in the 
-+	  low additional security level) will be enabled:
-+
-+	  - Failed fork logging
-+	  - Time change logging
-+	  - Signal logging
-+	  - Deny mounts in chroot
-+	  - Deny double chrooting
-+	  - Deny sysctl writes in chroot
-+	  - Deny mknod in chroot
-+	  - Deny access to abstract AF_UNIX sockets out of chroot
-+	  - Deny pivot_root in chroot
-+	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
-+	  - /proc restrictions with special GID set to 10 (usually wheel)
-+	  - Address Space Layout Randomization (ASLR)
-+	  - Prevent exploitation of most refcount overflows
-+	  - Bounds checking of copying between the kernel and userland
-+
-+config GRKERNSEC_HIGH
-+	bool "High"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SHMAT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_FCHDIR
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_CHROOT_CAPS
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_CHROOT_FINDTASK
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_HIDESYM
-+	select GRKERNSEC_BRUTE
-+	select GRKERNSEC_PROC_USERGROUP
-+	select GRKERNSEC_KMEM
-+	select GRKERNSEC_RESLOG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_PROC_ADD
-+	select GRKERNSEC_CHROOT_CHMOD
-+	select GRKERNSEC_CHROOT_NICE
-+	select GRKERNSEC_AUDIT_MOUNT
-+	select GRKERNSEC_MODHARDEN if (MODULES)
-+	select GRKERNSEC_HARDEN_PTRACE
-+	select GRKERNSEC_VM86 if (X86_32)
-+	select PAX
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_NOEXEC
-+	select PAX_MPROTECT
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
-+	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
-+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
-+	select PAX_SEGMEXEC if (X86_32)
-+	select PAX_PAGEEXEC
-+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
-+	select PAX_EMUTRAMP if (PARISC)
-+	select PAX_EMUSIGRT if (PARISC)
-+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
-+	help
-+	  If you say Y here, many of the features of grsecurity will be
-+	  enabled, which will protect you against many kinds of attacks
-+	  against your system.  The heightened security comes at a cost
-+	  of an increased chance of incompatibilities with rare software
-+	  on your machine.  Since this security level enables PaX, you should
-+	  view <http://pax.grsecurity.net> and read about the PaX
-+	  project.  While you are there, download chpax and run it on
-+	  binaries that cause problems with PaX.  Also remember that
-+	  since the /proc restrictions are enabled, you must run your
-+	  identd as gid 1001.  This security level enables the following 
-+	  features in addition to those listed in the low and medium 
-+	  security levels:
-+
-+	  - Additional /proc restrictions
-+	  - Chmod restrictions in chroot
-+	  - No signals, ptrace, or viewing of processes outside of chroot
-+	  - Capability restrictions in chroot
-+	  - Deny fchdir out of chroot
-+	  - Priority restrictions in chroot
-+	  - Segmentation-based implementation of PaX
-+	  - Mprotect restrictions
-+	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
-+	  - Kernel stack randomization
-+	  - Mount/unmount/remount logging
-+	  - Kernel symbol hiding
-+	  - Prevention of memory exhaustion-based exploits
-+	  - Hardening of module auto-loading
-+	  - Ptrace restrictions
-+	  - Restricted vm86 mode
-+
-+config GRKERNSEC_CUSTOM
-+	bool "Custom"
-+	help
-+	  If you say Y here, you will be able to configure every grsecurity
-+	  option, which allows you to enable many more features that aren't
-+	  covered in the basic security levels.  These additional features
-+	  include TPE, socket restrictions, and the sysctl system for
-+	  grsecurity.  It is advised that you read through the help for
-+	  each option to determine its usefulness in your situation.
-+
-+endchoice
-+
-+menu "Address Space Protection"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
-+	help
-+	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+	  be written to via mmap or otherwise to modify the running kernel.
-+	  /dev/port will also not be allowed to be opened. If you have module
-+	  support disabled, enabling this will close up four ways that are
-+	  currently used  to insert malicious code into the running kernel.
-+	  Even with all these features enabled, we still highly recommend that
-+	  you use the RBAC system, as it is still possible for an attacker to
-+	  modify the running kernel through privileged I/O granted by ioperm/iopl.
-+	  If you are not using XFree86, you may be able to stop this additional
-+	  case by enabling the 'Disable privileged I/O' option. Though nothing
-+	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+	  but only to video memory, which is the only writing we allow in this
-+	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+	  not be allowed to mprotect it with PROT_WRITE later.
-+	  It is highly recommended that you say Y here if you meet all the
-+	  conditions above.
-+
-+config GRKERNSEC_VM86
-+	bool "Restrict VM86 mode"
-+	depends on X86_32
-+
-+	help
-+	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+	  make use of a special execution mode on 32bit x86 processors called
-+	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
-+	  video cards and will still work with this option enabled.  The purpose
-+	  of the option is to prevent exploitation of emulation errors in
-+	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+	  Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+	bool "Disable privileged I/O"
-+	depends on X86
-+	select RTC_CLASS
-+	select RTC_INTF_DEV
-+	select RTC_DRV_CMOS
-+
-+	help
-+	  If you say Y here, all ioperm and iopl calls will return an error.
-+	  Ioperm and iopl can be used to modify the running kernel.
-+	  Unfortunately, some programs need this access to operate properly,
-+	  the most notable of which are XFree86 and hwclock.  hwclock can be
-+	  remedied by having RTC support in the kernel, so real-time 
-+	  clock support is enabled if this option is enabled, to ensure 
-+	  that hwclock operates correctly.  XFree86 still will not 
-+	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
-+	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
-+	  protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
-+	default y if (PAX_NOEXEC || PAX_ASLR)
-+	depends on PAX_NOEXEC || PAX_ASLR
-+	help
-+	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+	  give no information about the addresses of its mappings if
-+	  PaX features that rely on random addresses are enabled on the task.
-+	  If you use PaX it is greatly recommended that you say Y here as it
-+	  closes up a hole that makes the full ASLR useless for suid
-+	  binaries.
-+
-+config GRKERNSEC_BRUTE
-+	bool "Deter exploit bruteforcing"
-+	help
-+	  If you say Y here, attempts to bruteforce exploits against forking
-+	  daemons such as apache or sshd will be deterred.  When a child of a
-+	  forking daemon is killed by PaX or crashes due to an illegal
-+	  instruction, the parent process will be delayed 30 seconds upon every
-+	  subsequent fork until the administrator is able to assess the
-+	  situation and restart the daemon.  It is recommended that you also
-+	  enable signal logging in the auditing section so that logs are
-+	  generated when a process performs an illegal instruction.
-+
-+config GRKERNSEC_MODHARDEN
-+	bool "Harden module auto-loading"
-+	depends on MODULES
-+	help
-+	  If you say Y here, module auto-loading in response to use of some
-+	  feature implemented by an unloaded module will be restricted to
-+	  root users.  Enabling this option helps defend against attacks 
-+	  by unprivileged users who abuse the auto-loading behavior to 
-+	  cause a vulnerable module to load that is then exploited.
-+
-+	  If this option prevents a legitimate use of auto-loading for a 
-+	  non-root user, the administrator can execute modprobe manually 
-+	  with the exact name of the module mentioned in the alert log.
-+	  Alternatively, the administrator can add the module to the list
-+	  of modules loaded at boot by modifying init scripts.
-+
-+	  Modification of init scripts will most likely be needed on 
-+	  Ubuntu servers with encrypted home directory support enabled,
-+	  as the first non-root user logging in will cause the ecb(aes),
-+	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+	bool "Hide kernel symbols"
-+	help
-+	  If you say Y here, getting information on loaded modules, and
-+	  displaying all kernel symbols through a syscall will be restricted
-+	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
-+	  /proc/kallsyms will be restricted to the root user.  The RBAC
-+	  system can hide that entry even from root.  Note that this option
-+	  is only effective provided the following conditions are met:
-+	  1) The kernel using grsecurity is not precompiled by some distribution
-+	  2) You are using the RBAC system and hiding other files such as your
-+	     kernel image and System.map.  Alternatively, enabling this option
-+	     causes the permissions on /boot, /lib/modules, and the kernel
-+	     source directory to change at compile time to prevent 
-+	     reading by non-root users.
-+	  If the above conditions are met, this option will aid in providing a
-+	  useful protection against local kernel exploitation of overflows
-+	  and arbitrary read/write vulnerabilities.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_NO_RBAC
-+	bool "Disable RBAC system"
-+	help
-+	  If you say Y here, the /dev/grsec device will be removed from the kernel,
-+	  preventing the RBAC system from being enabled.  You should only say Y
-+	  here if you have no intention of using the RBAC system, so as to prevent
-+	  an attacker with root access from misusing the RBAC system to hide files
-+	  and processes when loadable module support and /dev/[k]mem have been
-+	  locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+	bool "Hide kernel processes"
-+	help
-+	  If you say Y here, all kernel threads will be hidden to all
-+	  processes but those whose subject has the "view hidden processes"
-+	  flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+	int "Maximum tries before password lockout"
-+	default 3
-+	help
-+	  This option enforces the maximum number of times a user can attempt
-+	  to authorize themselves with the grsecurity RBAC system before being
-+	  denied the ability to attempt authorization again for a specified time.
-+	  The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+	int "Time to wait after max password tries, in seconds"
-+	default 30
-+	help
-+	  This option specifies the time the user must wait after attempting to
-+	  authorize to the RBAC system with the maximum number of invalid
-+	  passwords.  The higher the number, the harder it will be to brute-force
-+	  a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+	bool "Proc restrictions"
-+	help
-+	  If you say Y here, the permissions of the /proc filesystem
-+	  will be altered to enhance system security and privacy.  You MUST
-+  	  choose either a user only restriction or a user and group restriction.
-+	  Depending upon the option you choose, you can either restrict users to
-+	  see only the processes they themselves run, or choose a group that can
-+	  view all processes and files normally restricted to root if you choose
-+	  the "restrict to user only" option.  NOTE: If you're running identd as
-+	  a non-root user, you will have to run it as the group you specify here.
-+
-+config GRKERNSEC_PROC_USER
-+	bool "Restrict /proc to user only"
-+	depends on GRKERNSEC_PROC
-+	help
-+	  If you say Y here, non-root users will only be able to view their own
-+	  processes, and restricts them from viewing network-related information,
-+	  and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+	bool "Allow special group"
-+	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+	help
-+	  If you say Y here, you will be able to select a group that will be
-+	  able to view all processes, network-related information, and
-+	  kernel and symbol information.  This option is useful if you want
-+	  to run identd as a non-root user.
-+
-+config GRKERNSEC_PROC_GID
-+	int "GID for special group"
-+	depends on GRKERNSEC_PROC_USERGROUP
-+	default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+	bool "Additional restrictions"
-+	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+	help
-+	  If you say Y here, additional restrictions will be placed on
-+	  /proc that keep normal users from viewing device information and 
-+	  slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+	bool "Linking restrictions"
-+	help
-+	  If you say Y here, /tmp race exploits will be prevented, since users
-+	  will no longer be able to follow symlinks owned by other users in
-+	  world-writable +t directories (i.e. /tmp), unless the owner of the
-+	  symlink is the owner of the directory. users will also not be
-+	  able to hardlink to files they do not own.  If the sysctl option is
-+	  enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_FIFO
-+	bool "FIFO restrictions"
-+	help
-+	  If you say Y here, users will not be able to write to FIFOs they don't
-+	  own in world-writable +t directories (i.e. /tmp), unless the owner of
-+	  the FIFO is the same owner of the directory it's held in.  If the sysctl
-+	  option is enabled, a sysctl option with name "fifo_restrictions" is
-+	  created.
-+
-+config GRKERNSEC_ROFS
-+	bool "Runtime read-only mount protection"
-+	help
-+	  If you say Y here, a sysctl option with name "romount_protect" will
-+	  be created.  By setting this option to 1 at runtime, filesystems
-+	  will be protected in the following ways:
-+	  * No new writable mounts will be allowed
-+	  * Existing read-only mounts won't be able to be remounted read/write
-+	  * Write operations will be denied on all block devices
-+	  This option acts independently of grsec_lock: once it is set to 1,
-+	  it cannot be turned off.  Therefore, please be mindful of the resulting
-+	  behavior if this option is enabled in an init script on a read-only
-+	  filesystem.  This feature is mainly intended for secure embedded systems.
-+
-+config GRKERNSEC_CHROOT
-+	bool "Chroot jail restrictions"
-+	help
-+	  If you say Y here, you will be able to choose several options that will
-+	  make breaking out of a chrooted jail much more difficult.  If you
-+	  encounter no software incompatibilities with the following options, it
-+	  is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+	bool "Deny mounts"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  mount or remount filesystems.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+	bool "Deny double-chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chroot
-+	  again outside the chroot.  This is a widely used method of breaking
-+	  out of a chroot jail and should not be allowed.  If the sysctl 
-+	  option is enabled, a sysctl option with name 
-+	  "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+	bool "Deny pivot_root in chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to use
-+	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
-+	  works similar to chroot in that it changes the root filesystem.  This
-+	  function could be misused in a chrooted process to attempt to break out
-+	  of the chroot, and therefore should not be allowed.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+	bool "Enforce chdir(\"/\") on all chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the current working directory of all newly-chrooted
-+	  applications will be set to the the root directory of the chroot.
-+	  The man page on chroot(2) states:
-+	  Note that this call does not change  the  current  working
-+	  directory,  so  that `.' can be outside the tree rooted at
-+	  `/'.  In particular, the  super-user  can  escape  from  a
-+	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+	  It is recommended that you say Y here, since it's not known to break
-+	  any software.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+	bool "Deny (f)chmod +s"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chmod
-+	  or fchmod files to make them have suid or sgid bits.  This protects
-+	  against another published method of breaking a chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+	bool "Deny fchdir out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+	  to a file descriptor of the chrooting process that points to a directory
-+	  outside the filesystem will be stopped.  If the sysctl option
-+	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+	bool "Deny mknod"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be allowed to
-+	  mknod.  The problem with using mknod inside a chroot is that it
-+	  would allow an attacker to create a device entry that is the same
-+	  as one on the physical root of your system, which could range from
-+	  anything from the console device to a device for your harddrive (which
-+	  they could then use to wipe the drive or steal data).  It is recommended
-+	  that you say Y here, unless you run into software incompatibilities.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+	bool "Deny shmat() out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to attach
-+	  to shared memory segments that were created outside of the chroot jail.
-+	  It is recommended that you say Y here.  If the sysctl option is enabled,
-+	  a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+	bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  connect to abstract (meaning not belonging to a filesystem) Unix
-+	  domain sockets that were bound outside of a chroot.  It is recommended
-+	  that you say Y here.  If the sysctl option is enabled, a sysctl option
-+	  with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+	bool "Protect outside processes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
-+	  getsid, or view any process outside of the chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_findtask" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+	bool "Restrict priority changes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to raise
-+	  the priority of processes in the chroot, or alter the priority of
-+	  processes outside the chroot.  This provides more security than simply
-+	  removing CAP_SYS_NICE from the process' capability set.  If the
-+	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+	  is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+	bool "Deny sysctl writes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, an attacker in a chroot will not be able to
-+	  write to sysctl entries, either by sysctl(2) or through a /proc
-+	  interface.  It is strongly recommended that you say Y here. If the
-+	  sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+	bool "Capability restrictions"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the capabilities on all root processes within a
-+	  chroot jail will be lowered to stop module insertion, raw i/o,
-+	  system and net admin tasks, rebooting the system, modifying immutable
-+	  files, modifying IPC owned by another, and changing the system time.
-+	  This is left an option because it can break some apps.  Disable this
-+	  if your chrooted apps are having problems performing those kinds of
-+	  tasks.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_caps" is created.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+	bool "Single group for auditing"
-+	help
-+	  If you say Y here, the exec, chdir, and (un)mount logging features
-+	  will only operate on a group you specify.  This option is recommended
-+	  if you only want to watch certain users instead of having a large
-+	  amount of logs from the entire system.  If the sysctl option is enabled,
-+	  a sysctl option with name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+	int "GID for auditing"
-+	depends on GRKERNSEC_AUDIT_GROUP
-+	default 1007
-+
-+config GRKERNSEC_EXECLOG
-+	bool "Exec logging"
-+	help
-+	  If you say Y here, all execve() calls will be logged (since the
-+	  other exec*() calls are frontends to execve(), all execution
-+	  will be logged).  Useful for shell-servers that like to keep track
-+	  of their users.  If the sysctl option is enabled, a sysctl option with
-+	  name "exec_logging" is created.
-+	  WARNING: This option when enabled will produce a LOT of logs, especially
-+	  on an active system.
-+
-+config GRKERNSEC_RESLOG
-+	bool "Resource logging"
-+	help
-+	  If you say Y here, all attempts to overstep resource limits will
-+	  be logged with the resource name, the requested size, and the current
-+	  limit.  It is highly recommended that you say Y here.  If the sysctl
-+	  option is enabled, a sysctl option with name "resource_logging" is
-+	  created.  If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+	bool "Log execs within chroot"
-+	help
-+	  If you say Y here, all executions inside a chroot jail will be logged
-+	  to syslog.  This can cause a large amount of logs if certain
-+	  applications (eg. djb's daemontools) are installed on the system, and
-+	  is therefore left as an option.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+	bool "Ptrace logging"
-+	help
-+	  If you say Y here, all attempts to attach to a process via ptrace
-+	  will be logged.  If the sysctl option is enabled, a sysctl option
-+	  with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+	bool "Chdir logging"
-+	help
-+	  If you say Y here, all chdir() calls will be logged.  If the sysctl
-+ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+	bool "(Un)Mount logging"
-+	help
-+	  If you say Y here, all mounts and unmounts will be logged.  If the
-+	  sysctl option is enabled, a sysctl option with name "audit_mount" is
-+	  created.
-+
-+config GRKERNSEC_SIGNAL
-+	bool "Signal logging"
-+	help
-+	  If you say Y here, certain important signals will be logged, such as
-+	  SIGSEGV, which will as a result inform you of when a error in a program
-+	  occurred, which in some cases could mean a possible exploit attempt.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+	bool "Fork failure logging"
-+	help
-+	  If you say Y here, all failed fork() attempts will be logged.
-+	  This could suggest a fork bomb, or someone attempting to overstep
-+	  their process limit.  If the sysctl option is enabled, a sysctl option
-+	  with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+	bool "Time change logging"
-+	help
-+	  If you say Y here, any changes of the system clock will be logged.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+	bool "/proc/<pid>/ipaddr support"
-+	help
-+	  If you say Y here, a new entry will be added to each /proc/<pid>
-+	  directory that contains the IP address of the person using the task.
-+	  The IP is carried across local TCP and AF_UNIX stream sockets.
-+	  This information can be useful for IDS/IPSes to perform remote response
-+	  to a local attack.  The entry is readable by only the owner of the
-+	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+	  the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+	bool 'ELF text relocations logging (READ HELP)'
-+	depends on PAX_MPROTECT
-+	help
-+	  If you say Y here, text relocations will be logged with the filename
-+	  of the offending library or binary.  The purpose of the feature is
-+	  to help Linux distribution developers get rid of libraries and
-+	  binaries that need text relocations which hinder the future progress
-+	  of PaX.  Only Linux distribution developers should say Y here, and
-+	  never on a production machine, as this option creates an information
-+	  leak that could aid an attacker in defeating the randomization of
-+	  a single memory region.  If the sysctl option is enabled, a sysctl
-+	  option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_EXECVE
-+	bool "Enforce RLIMIT_NPROC on execs"
-+	help
-+	  If you say Y here, users with a resource limit on processes will
-+	  have the value checked during execve() calls.  The current system
-+	  only checks the system limit during fork() calls.  If the sysctl option
-+	  is enabled, a sysctl option with name "execve_limiting" is created.
-+
-+config GRKERNSEC_DMESG
-+	bool "Dmesg(8) restriction"
-+	help
-+	  If you say Y here, non-root users will not be able to use dmesg(8)
-+	  to view up to the last 4kb of messages in the kernel's log buffer.
-+	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+	  created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+	bool "Deter ptrace-based process snooping"
-+	help
-+	  If you say Y here, TTY sniffers and other malicious monitoring
-+	  programs implemented through ptrace will be defeated.  If you
-+	  have been using the RBAC system, this option has already been
-+	  enabled for several years for all users, with the ability to make
-+	  fine-grained exceptions.
-+
-+	  This option only affects the ability of non-root users to ptrace
-+	  processes that are not a descendent of the ptracing process.
-+	  This means that strace ./binary and gdb ./binary will still work,
-+	  but attaching to arbitrary processes will not.  If the sysctl
-+	  option is enabled, a sysctl option with name "harden_ptrace" is
-+	  created.
-+
-+config GRKERNSEC_TPE
-+	bool "Trusted Path Execution (TPE)"
-+	help
-+	  If you say Y here, you will be able to choose a gid to add to the
-+	  supplementary groups of users you want to mark as "untrusted."
-+	  These users will not be able to execute any files that are not in
-+	  root-owned directories writable only by root.  If the sysctl option
-+	  is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+	bool "Partially restrict non-root users"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, All non-root users other than the ones in the
-+	  group specified in the main TPE option will only be allowed to
-+	  execute files in directories they own that are not group or
-+	  world-writable, or in directories owned by root and writable only by
-+	  root.  If the sysctl option is enabled, a sysctl option with name
-+	  "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+	bool "Invert GID option"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, the group you specify in the TPE configuration will
-+	  decide what group TPE restrictions will be *disabled* for.  This
-+	  option is useful if you want TPE restrictions to be applied to most
-+	  users on the system.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for untrusted users"
-+	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for trusted users"
-+	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+	bool "Larger entropy pools"
-+	help
-+	  If you say Y here, the entropy pools used for many features of Linux
-+	  and grsecurity will be doubled in size.  Since several grsecurity
-+	  features use additional randomness, it is recommended that you say Y
-+	  here.  Saying Y here has a similar effect as modifying
-+	  /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+	help
-+	  If you say Y here, neither TCP resets nor ICMP
-+	  destination-unreachable packets will be sent in response to packets
-+	  send to ports for which no associated listening process exists.
-+	  This feature supports both IPV4 and IPV6 and exempts the 
-+	  loopback interface from blackholing.  Enabling this feature 
-+	  makes a host more resilient to DoS attacks and reduces network
-+	  visibility against scanners.
-+
-+	  The blackhole feature as-implemented is equivalent to the FreeBSD
-+	  blackhole feature, as prevents RST responses to all packets, not
-+	  just SYNs.  Under most application behavior this causes no
-+	  problems, but applications (like haproxy) may not close certain
-+	  connections in a way that cleanly terminates them on the remote
-+	  end, leaving the remote host in LAST_ACK state.  Because of this
-+	  side-effect and to prevent intentional LAST_ACK DoSes, this
-+	  feature also adds automatic mitigation against such attacks.
-+	  The mitigation drastically reduces the amount of time a socket
-+	  can spend in LAST_ACK state.  If you're using haproxy and not
-+	  all servers it connects to have this option enabled, consider
-+	  disabling this feature on the haproxy host.
-+
-+	  If this option is enabled, two sysctl options with names
-+	  "ip_blackhole" and "lastack_retries" will be created.
-+	  While "ip_blackhole" takes the standard zero/non-zero on/off
-+	  toggle, "lastack_retries" uses the same kinds of values as
-+	  "tcp_retries1" and "tcp_retries2".  The default value of 4
-+	  prevents a socket from lasting more than 45 seconds in LAST_ACK
-+	  state.
-+
-+config GRKERNSEC_SOCKET
-+	bool "Socket restrictions"
-+	help
-+	  If you say Y here, you will be able to choose from several options.
-+	  If you assign a GID on your system and add it to the supplementary
-+	  groups of users you want to restrict socket access to, this patch
-+	  will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+	bool "Deny any sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine or run server
-+	  applications from your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+	int "GID to deny all sockets for"
-+	depends on GRKERNSEC_SOCKET_ALL
-+	default 1004
-+	help
-+	  Here you can choose the GID to disable socket access for. Remember to
-+	  add the users you want socket access disabled for to the GID
-+	  specified here.  If the sysctl option is enabled, a sysctl option
-+	  with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+	bool "Deny client sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine, but will be
-+	  able to run servers.  If this option is enabled, all users in the group
-+	  you specify will have to use passive mode when initiating ftp transfers
-+	  from the shell on your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+	int "GID to deny client sockets for"
-+	depends on GRKERNSEC_SOCKET_CLIENT
-+	default 1003
-+	help
-+	  Here you can choose the GID to disable client socket access for.
-+	  Remember to add the users you want client socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+	bool "Deny server sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to run server applications from your machine.  If the sysctl
-+	  option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+	int "GID to deny server sockets for"
-+	depends on GRKERNSEC_SOCKET_SERVER
-+	default 1002
-+	help
-+	  Here you can choose the GID to disable server socket access for.
-+	  Remember to add the users you want server socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_server_gid" is created.
-+
-+endmenu
-+menu "Sysctl support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+	bool "Sysctl support"
-+	help
-+	  If you say Y here, you will be able to change the options that
-+	  grsecurity runs with at bootup, without having to recompile your
-+	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
-+	  to enable (1) or disable (0) various features.  All the sysctl entries
-+	  are mutable until the "grsec_lock" entry is set to a non-zero value.
-+	  All features enabled in the kernel configuration are disabled at boot
-+	  if you do not say Y to the "Turn on features by default" option.
-+	  All options should be set at startup, and the grsec_lock entry should
-+	  be set to a non-zero value after all the options are set.
-+	  *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_ON
-+	bool "Turn on features by default"
-+	depends on GRKERNSEC_SYSCTL
-+	help
-+	  If you say Y here, instead of having all features enabled in the
-+	  kernel configuration disabled at boot time, the features will be
-+	  enabled at boot time.  It is recommended you say Y here unless
-+	  there is some reason you would want all sysctl-tunable features to
-+	  be disabled by default.  As mentioned elsewhere, it is important
-+	  to enable the grsec_lock entry once you have finished modifying
-+	  the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+	int "Seconds in between log messages (minimum)"
-+	default 10
-+	help
-+	  This option allows you to enforce the number of seconds between
-+	  grsecurity log messages.  The default should be suitable for most
-+	  people, however, if you choose to change it, choose a value small enough
-+	  to allow informative logs to be produced, but large enough to
-+	  prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+	int "Number of messages in a burst (maximum)"
-+	default 4
-+	help
-+	  This option allows you to choose the maximum number of messages allowed
-+	  within the flood time interval you chose in a separate option.  The
-+	  default should be suitable for most people, however if you find that
-+	  many of your logs are being interpreted as flooding, you may want to
-+	  raise this value.
-+
-+endmenu
-+
-+endmenu
-diff -urNp linux-2.6.32.12/grsecurity/Makefile linux-2.6.32.12/grsecurity/Makefile
---- linux-2.6.32.12/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/grsecurity/Makefile	2010-04-04 20:46:41.668784531 -0400
-@@ -0,0 +1,29 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released 
-+# under the GPL v2 or higher
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
-+	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
-+	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+	gracl_learn.o grsec_log.o
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+	@-chmod -f 500 /boot
-+	@-chmod -f 500 /lib/modules
-+	@-chmod -f 700 .
-+	@echo '  grsec: protected kernel image paths'
-+endif
-diff -urNp linux-2.6.32.12/include/acpi/acoutput.h linux-2.6.32.12/include/acpi/acoutput.h
---- linux-2.6.32.12/include/acpi/acoutput.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/acpi/acoutput.h	2010-04-29 17:46:37.297250222 -0400
-@@ -264,8 +264,8 @@
-  * leaving no executable debug code!
-  */
- #define ACPI_FUNCTION_NAME(a)
--#define ACPI_DEBUG_PRINT(pl)
--#define ACPI_DEBUG_PRINT_RAW(pl)
-+#define ACPI_DEBUG_PRINT(pl) do {} while (0)
-+#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
- 
- #endif				/* ACPI_DEBUG_OUTPUT */
- 
-diff -urNp linux-2.6.32.12/include/acpi/acpi_drivers.h linux-2.6.32.12/include/acpi/acpi_drivers.h
---- linux-2.6.32.12/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/acpi/acpi_drivers.h	2010-04-04 20:46:41.668784531 -0400
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
-                                   Dock Station
-   -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
--	acpi_notify_handler handler;
--	acpi_notify_handler uevent;
-+	const acpi_notify_handler handler;
-+	const acpi_notify_handler uevent;
- };
- 
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
--					struct acpi_dock_ops *ops,
-+					const struct acpi_dock_ops *ops,
- 					void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
--					       struct acpi_dock_ops *ops,
-+					       const struct acpi_dock_ops *ops,
- 					       void *context)
- {
- 	return -ENODEV;
-diff -urNp linux-2.6.32.12/include/asm-generic/atomic-long.h linux-2.6.32.12/include/asm-generic/atomic-long.h
---- linux-2.6.32.12/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/atomic-long.h	2010-04-04 20:46:41.668784531 -0400
-@@ -22,6 +22,12 @@
- 
- typedef atomic64_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
- 
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic64_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
- 	atomic64_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
- 	atomic64_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
- 	atomic64_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic64_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
- 
- typedef atomic_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
- 	atomic_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
- 	atomic_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
- 	atomic_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
- 
- #endif  /*  BITS_PER_LONG == 64  */
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+	atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+
-+	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#endif
-+
- #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
-diff -urNp linux-2.6.32.12/include/asm-generic/dma-mapping-common.h linux-2.6.32.12/include/asm-generic/dma-mapping-common.h
---- linux-2.6.32.12/include/asm-generic/dma-mapping-common.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/dma-mapping-common.h	2010-04-04 20:46:41.673688119 -0400
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
- 					      enum dma_data_direction dir,
- 					      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
- 					  enum dma_data_direction dir,
- 					  struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
- 				   int nents, enum dma_data_direction dir,
- 				   struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	int i, ents;
- 	struct scatterlist *s;
- 
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
- 				      int nents, enum dma_data_direction dir,
- 				      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
- 				      size_t offset, size_t size,
- 				      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- 				  size_t size, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
- 					   size_t size,
- 					   enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
- 					      dma_addr_t addr, size_t size,
- 					      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
- 						 size_t size,
- 						 enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
- 						    size_t size,
- 						    enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- 		    int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- 		       int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.32.12/include/asm-generic/futex.h linux-2.6.32.12/include/asm-generic/futex.h
---- linux-2.6.32.12/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/futex.h	2010-04-04 20:46:41.673688119 -0400
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
- 
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
- }
- 
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- 	return -ENOSYS;
- }
-diff -urNp linux-2.6.32.12/include/asm-generic/int-l64.h linux-2.6.32.12/include/asm-generic/int-l64.h
---- linux-2.6.32.12/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/int-l64.h	2010-04-04 20:46:41.673688119 -0400
-@@ -46,6 +46,8 @@ typedef unsigned int u32;
- typedef signed long s64;
- typedef unsigned long u64;
- 
-+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.12/include/asm-generic/int-ll64.h linux-2.6.32.12/include/asm-generic/int-ll64.h
---- linux-2.6.32.12/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/int-ll64.h	2010-04-04 20:46:41.673688119 -0400
-@@ -51,6 +51,8 @@ typedef unsigned int u32;
- typedef signed long long s64;
- typedef unsigned long long u64;
- 
-+typedef unsigned long long intoverflow_t;
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.12/include/asm-generic/kmap_types.h linux-2.6.32.12/include/asm-generic/kmap_types.h
---- linux-2.6.32.12/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/kmap_types.h	2010-04-04 20:46:41.673688119 -0400
-@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
- KMAP_D(16)	KM_IRQ_PTE,
- KMAP_D(17)	KM_NMI,
- KMAP_D(18)	KM_NMI_PTE,
--KMAP_D(19)	KM_TYPE_NR
-+KMAP_D(19)	KM_CLEARPAGE,
-+KMAP_D(20)	KM_TYPE_NR
- };
- 
- #undef KMAP_D
-diff -urNp linux-2.6.32.12/include/asm-generic/pgtable.h linux-2.6.32.12/include/asm-generic/pgtable.h
---- linux-2.6.32.12/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/pgtable.h	2010-04-04 20:46:41.673688119 -0400
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
- 				unsigned long size);
- #endif
- 
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
- 
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.32.12/include/asm-generic/vmlinux.lds.h linux-2.6.32.12/include/asm-generic/vmlinux.lds.h
---- linux-2.6.32.12/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/asm-generic/vmlinux.lds.h	2010-04-04 20:46:41.673688119 -0400
-@@ -199,6 +199,7 @@
- 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
- 		VMLINUX_SYMBOL(__start_rodata) = .;			\
- 		*(.rodata) *(.rodata.*)					\
-+		*(.data.read_only)					\
- 		*(__vermagic)		/* Kernel version magic */	\
- 		*(__markers_strings)	/* Markers: strings */		\
- 		*(__tracepoints_strings)/* Tracepoints: strings */	\
-@@ -656,22 +657,24 @@
-  * section in the linker script will go there too.  @phdr should have
-  * a leading colon.
-  *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
-  * If there is no need to put the percpu section at a predetermined
-  * address, use PERCPU().
-  */
- #define PERCPU_VADDR(vaddr, phdr)					\
--	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
--	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
-+	per_cpu_load = .;						\
-+	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
- 				- LOAD_OFFSET) {			\
-+		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
- 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
- 		*(.data.percpu.first)					\
--		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu)						\
-+		. = ALIGN(PAGE_SIZE);					\
-+		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu.shared_aligned)				\
- 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
- 	} phdr								\
--	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
- 
- /**
-  * PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.32.12/include/drm/drm_pciids.h linux-2.6.32.12/include/drm/drm_pciids.h
---- linux-2.6.32.12/include/drm/drm_pciids.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.12/include/drm/drm_pciids.h	2010-04-29 18:05:16.209337414 -0400
-@@ -377,7 +377,7 @@
- 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define r128_PCI_IDS \
- 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -417,14 +417,14 @@
- 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mga_PCI_IDS \
- 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
- 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mach64_PCI_IDS \
- 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -447,7 +447,7 @@
- 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define sisdrv_PCI_IDS \
- 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -458,7 +458,7 @@
- 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
- 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define tdfx_PCI_IDS \
- 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -467,7 +467,7 @@
- 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define viadrv_PCI_IDS \
- 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -479,14 +479,14 @@
- 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
- 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i810_PCI_IDS \
- 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i830_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -494,11 +494,11 @@
- 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define gamma_PCI_IDS \
- 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define savage_PCI_IDS \
- 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-@@ -524,10 +524,10 @@
- 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
- 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
- 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define ffb_PCI_IDS \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i915_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
-@@ -560,4 +560,4 @@
- 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
-diff -urNp linux-2.6.32.12/include/drm/drmP.h linux-2.6.32.12/include/drm/drmP.h
---- linux-2.6.32.12/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/drm/drmP.h	2010-04-04 20:46:41.673688119 -0400
-@@ -814,7 +814,7 @@ struct drm_driver {
- 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
- 
- 	/* Driver private ops for this object */
--	struct vm_operations_struct *gem_vm_ops;
-+	const struct vm_operations_struct *gem_vm_ops;
- 
- 	int major;
- 	int minor;
-@@ -917,7 +917,7 @@ struct drm_device {
- 
- 	/** \name Usage Counters */
- 	/*@{ */
--	int open_count;			/**< Outstanding files open */
-+	atomic_t open_count;		/**< Outstanding files open */
- 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
- 	atomic_t vma_count;		/**< Outstanding vma areas open */
- 	int buf_use;			/**< Buffers in use -- cannot alloc */
-@@ -928,7 +928,7 @@ struct drm_device {
- 	/*@{ */
- 	unsigned long counters;
- 	enum drm_stat_type types[15];
--	atomic_t counts[15];
-+	atomic_unchecked_t counts[15];
- 	/*@} */
- 
- 	struct list_head filelist;
-diff -urNp linux-2.6.32.12/include/linux/a.out.h linux-2.6.32.12/include/linux/a.out.h
---- linux-2.6.32.12/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/a.out.h	2010-04-04 20:46:41.673688119 -0400
-@@ -39,6 +39,14 @@ enum machine_type {
-   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
- };
- 
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
-+#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
-+#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff -urNp linux-2.6.32.12/include/linux/atmdev.h linux-2.6.32.12/include/linux/atmdev.h
---- linux-2.6.32.12/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/atmdev.h	2010-04-04 20:46:41.673688119 -0400
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
- 
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.12/include/linux/backlight.h linux-2.6.32.12/include/linux/backlight.h
---- linux-2.6.32.12/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/backlight.h	2010-04-04 20:46:41.673688119 -0400
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
- 
- struct backlight_ops {
--	unsigned int options;
-+	const unsigned int options;
- 
- #define BL_CORE_SUSPENDRESUME	(1 << 0)
- 
- 	/* Notify the backlight driver some property has changed */
--	int (*update_status)(struct backlight_device *);
-+	int (* const update_status)(struct backlight_device *);
- 	/* Return the current backlight brightness (accounting for power,
- 	   fb_blank etc.) */
--	int (*get_brightness)(struct backlight_device *);
-+	int (* const get_brightness)(struct backlight_device *);
- 	/* Check if given framebuffer device is the one bound to this backlight;
- 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
--	int (*check_fb)(struct fb_info *);
-+	int (* const check_fb)(struct fb_info *);
- };
- 
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- 	   registered this device has been unloaded, and if class_get_devdata()
- 	   points to something in the body of that driver, it is also invalid. */
- 	struct mutex ops_lock;
--	struct backlight_ops *ops;
-+	const struct backlight_ops *ops;
- 
- 	/* The framebuffer notifier block */
- 	struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_stat
- }
- 
- extern struct backlight_device *backlight_device_register(const char *name,
--	struct device *dev, void *devdata, struct backlight_ops *ops);
-+	struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- 				   enum backlight_update_reason reason);
-diff -urNp linux-2.6.32.12/include/linux/binfmts.h linux-2.6.32.12/include/linux/binfmts.h
---- linux-2.6.32.12/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/binfmts.h	2010-04-04 20:46:41.673688119 -0400
-@@ -78,6 +78,7 @@ struct linux_binfmt {
- 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
- 	int (*load_shlib)(struct file *);
- 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- 	unsigned long min_coredump;	/* minimal dump size */
- 	int hasvdso;
- };
-diff -urNp linux-2.6.32.12/include/linux/blkdev.h linux-2.6.32.12/include/linux/blkdev.h
---- linux-2.6.32.12/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/blkdev.h	2010-04-04 20:46:41.673688119 -0400
-@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
- #endif /* CONFIG_BLK_DEV_INTEGRITY */
- 
- struct block_device_operations {
--	int (*open) (struct block_device *, fmode_t);
--	int (*release) (struct gendisk *, fmode_t);
--	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*direct_access) (struct block_device *, sector_t,
-+	int (* const open) (struct block_device *, fmode_t);
-+	int (* const release) (struct gendisk *, fmode_t);
-+	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const direct_access) (struct block_device *, sector_t,
- 						void **, unsigned long *);
--	int (*media_changed) (struct gendisk *);
--	unsigned long long (*set_capacity) (struct gendisk *,
-+	int (* const media_changed) (struct gendisk *);
-+	unsigned long long (* const set_capacity) (struct gendisk *,
- 						unsigned long long);
--	int (*revalidate_disk) (struct gendisk *);
--	int (*getgeo)(struct block_device *, struct hd_geometry *);
--	struct module *owner;
-+	int (* const revalidate_disk) (struct gendisk *);
-+	int (*const getgeo)(struct block_device *, struct hd_geometry *);
-+	struct module * const owner;
- };
- 
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.32.12/include/linux/cache.h linux-2.6.32.12/include/linux/cache.h
---- linux-2.6.32.12/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/cache.h	2010-04-04 20:46:41.673688119 -0400
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
- 
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff -urNp linux-2.6.32.12/include/linux/capability.h linux-2.6.32.12/include/linux/capability.h
---- linux-2.6.32.12/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/capability.h	2010-04-04 20:46:41.673688119 -0400
-@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
- 	(security_real_capable_noaudit((t), (cap)) == 0)
- 
- extern int capable(int cap);
-+int capable_nolog(int cap);
- 
- /* audit system wants to get cap info from files as well */
- struct dentry;
-diff -urNp linux-2.6.32.12/include/linux/compiler-gcc4.h linux-2.6.32.12/include/linux/compiler-gcc4.h
---- linux-2.6.32.12/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/compiler-gcc4.h	2010-04-04 20:46:41.673688119 -0400
-@@ -36,4 +36,8 @@
-    the kernel context */
- #define __cold			__attribute__((__cold__))
- 
-+#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
-+#define __bos0(ptr)		__bos((ptr), 0)
-+#define __bos1(ptr)		__bos((ptr), 1)
- #endif
-diff -urNp linux-2.6.32.12/include/linux/compiler.h linux-2.6.32.12/include/linux/compiler.h
---- linux-2.6.32.12/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/compiler.h	2010-04-04 20:46:41.673688119 -0400
-@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
- #define __cold
- #endif
- 
-+#ifndef __alloc_size
-+#define __alloc_size
-+#endif
-+
-+#ifndef __bos
-+#define __bos
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-diff -urNp linux-2.6.32.12/include/linux/decompress/mm.h linux-2.6.32.12/include/linux/decompress/mm.h
---- linux-2.6.32.12/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
-+++ linux-2.6.32.12/include/linux/decompress/mm.h	2010-04-04 20:46:41.673688119 -0400
-@@ -78,7 +78,7 @@ static void free(void *where)
-  * warnings when not needed (indeed large_malloc / large_free are not
-  * needed by inflate */
- 
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- 
- #define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.32.12/include/linux/dma-mapping.h linux-2.6.32.12/include/linux/dma-mapping.h
---- linux-2.6.32.12/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/dma-mapping.h	2010-04-04 20:46:41.673688119 -0400
-@@ -16,50 +16,50 @@ enum dma_data_direction {
- };
- 
- struct dma_map_ops {
--	void* (*alloc_coherent)(struct device *dev, size_t size,
-+	void* (* const alloc_coherent)(struct device *dev, size_t size,
- 				dma_addr_t *dma_handle, gfp_t gfp);
--	void (*free_coherent)(struct device *dev, size_t size,
-+	void (* const free_coherent)(struct device *dev, size_t size,
- 			      void *vaddr, dma_addr_t dma_handle);
--	dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- 			       unsigned long offset, size_t size,
- 			       enum dma_data_direction dir,
- 			       struct dma_attrs *attrs);
--	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- 			   size_t size, enum dma_data_direction dir,
- 			   struct dma_attrs *attrs);
--	int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- 		      int nents, enum dma_data_direction dir,
- 		      struct dma_attrs *attrs);
--	void (*unmap_sg)(struct device *dev,
-+	void (* const unmap_sg)(struct device *dev,
- 			 struct scatterlist *sg, int nents,
- 			 enum dma_data_direction dir,
- 			 struct dma_attrs *attrs);
--	void (*sync_single_for_cpu)(struct device *dev,
-+	void (* const sync_single_for_cpu)(struct device *dev,
- 				    dma_addr_t dma_handle, size_t size,
- 				    enum dma_data_direction dir);
--	void (*sync_single_for_device)(struct device *dev,
-+	void (* const sync_single_for_device)(struct device *dev,
- 				       dma_addr_t dma_handle, size_t size,
- 				       enum dma_data_direction dir);
--	void (*sync_single_range_for_cpu)(struct device *dev,
-+	void (* const sync_single_range_for_cpu)(struct device *dev,
- 					  dma_addr_t dma_handle,
- 					  unsigned long offset,
- 					  size_t size,
- 					  enum dma_data_direction dir);
--	void (*sync_single_range_for_device)(struct device *dev,
-+	void (* const sync_single_range_for_device)(struct device *dev,
- 					     dma_addr_t dma_handle,
- 					     unsigned long offset,
- 					     size_t size,
- 					     enum dma_data_direction dir);
--	void (*sync_sg_for_cpu)(struct device *dev,
-+	void (* const sync_sg_for_cpu)(struct device *dev,
- 				struct scatterlist *sg, int nents,
- 				enum dma_data_direction dir);
--	void (*sync_sg_for_device)(struct device *dev,
-+	void (* const sync_sg_for_device)(struct device *dev,
- 				   struct scatterlist *sg, int nents,
- 				   enum dma_data_direction dir);
--	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
--	int (*dma_supported)(struct device *dev, u64 mask);
-+	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+	int (* const dma_supported)(struct device *dev, u64 mask);
- 	int (*set_dma_mask)(struct device *dev, u64 mask);
--	int is_phys;
-+	const int is_phys;
- };
- 
- #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.32.12/include/linux/dst.h linux-2.6.32.12/include/linux/dst.h
---- linux-2.6.32.12/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/dst.h	2010-04-04 20:46:41.673688119 -0400
-@@ -380,7 +380,7 @@ struct dst_node
- 	struct thread_pool	*pool;
- 
- 	/* Transaction IDs live here */
--	atomic_long_t		gen;
-+	atomic_long_unchecked_t	gen;
- 
- 	/*
- 	 * How frequently and how many times transaction
-diff -urNp linux-2.6.32.12/include/linux/elf.h linux-2.6.32.12/include/linux/elf.h
---- linux-2.6.32.12/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/elf.h	2010-04-04 20:46:41.673688119 -0400
-@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
- #define PT_GNU_EH_FRAME		0x6474e550
- 
- #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
-+#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
- 
- /* These constants define the different elf file types */
- #define ET_NONE   0
-@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
- #define DT_DEBUG	21
- #define DT_TEXTREL	22
- #define DT_JMPREL	23
-+#define DT_FLAGS	30
-+  #define DF_TEXTREL  0x00000004
- #define DT_ENCODING	32
- #define OLD_DT_LOOS	0x60000000
- #define DT_LOOS		0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W		0x2
- #define PF_X		0x1
- 
-+#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
-+#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
-+#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
-+#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
-+#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
-+#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
-+/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
-+/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
-+#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
-+#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
-+#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
-+#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
-   Elf32_Word	p_type;
-   Elf32_Off	p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define	EI_OSABI	7
- #define	EI_PAD		8
- 
-+#define	EI_PAX		14
-+
- #define	ELFMAG0		0x7f		/* EI_MAG */
- #define	ELFMAG1		'E'
- #define	ELFMAG2		'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
- #define elf_addr_t	Elf32_Off
-+#define elf_dyn		Elf32_Dyn
- 
- #else
- 
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr	elf64_phdr
- #define elf_note	elf64_note
- #define elf_addr_t	Elf64_Off
-+#define elf_dyn		Elf64_Dyn
- 
- #endif
- 
-diff -urNp linux-2.6.32.12/include/linux/fs.h linux-2.6.32.12/include/linux/fs.h
---- linux-2.6.32.12/include/linux/fs.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.12/include/linux/fs.h	2010-04-29 17:49:58.621028174 -0400
-@@ -90,6 +90,11 @@ struct inodes_stat_t {
- /* Expect random access pattern */
- #define FMODE_RANDOM		((__force fmode_t)4096)
- 
-+/* Hack for grsec so as not to require read permission simply to execute
-+ * a binary
-+ */
-+#define FMODE_GREXEC		((__force fmode_t)8192)
-+
- /*
-  * The below are the various read and write types that we support. Some of
-  * them include behavioral modifiers that send information down to the
-@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
- 		unsigned long, unsigned long);
- 
- struct address_space_operations {
--	int (*writepage)(struct page *page, struct writeback_control *wbc);
--	int (*readpage)(struct file *, struct page *);
--	void (*sync_page)(struct page *);
-+	int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+	int (* const readpage)(struct file *, struct page *);
-+	void (* const sync_page)(struct page *);
- 
- 	/* Write back some dirty pages from this mapping. */
--	int (*writepages)(struct address_space *, struct writeback_control *);
-+	int (* const writepages)(struct address_space *, struct writeback_control *);
- 
- 	/* Set a page dirty.  Return true if this dirtied it */
--	int (*set_page_dirty)(struct page *page);
-+	int (* const set_page_dirty)(struct page *page);
- 
--	int (*readpages)(struct file *filp, struct address_space *mapping,
-+	int (* const readpages)(struct file *filp, struct address_space *mapping,
- 			struct list_head *pages, unsigned nr_pages);
- 
--	int (*write_begin)(struct file *, struct address_space *mapping,
-+	int (* const write_begin)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned flags,
- 				struct page **pagep, void **fsdata);
--	int (*write_end)(struct file *, struct address_space *mapping,
-+	int (* const write_end)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned copied,
- 				struct page *page, void *fsdata);
- 
- 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
--	sector_t (*bmap)(struct address_space *, sector_t);
--	void (*invalidatepage) (struct page *, unsigned long);
--	int (*releasepage) (struct page *, gfp_t);
--	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+	sector_t (* const bmap)(struct address_space *, sector_t);
-+	void (* const invalidatepage) (struct page *, unsigned long);
-+	int (* const releasepage) (struct page *, gfp_t);
-+	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- 			loff_t offset, unsigned long nr_segs);
--	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- 						void **, unsigned long *);
- 	/* migrate the contents of a page to the specified target */
--	int (*migratepage) (struct address_space *,
-+	int (* const migratepage) (struct address_space *,
- 			struct page *, struct page *);
--	int (*launder_page) (struct page *);
--	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+	int (* const launder_page) (struct page *);
-+	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- 					unsigned long);
--	int (*error_remove_page)(struct address_space *, struct page *);
-+	int (* const error_remove_page)(struct address_space *, struct page *);
- };
- 
- /*
-@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
- typedef struct files_struct *fl_owner_t;
- 
- struct file_lock_operations {
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
- };
- 
- struct lock_manager_operations {
--	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
--	void (*fl_notify)(struct file_lock *);	/* unblock callback */
--	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
--	void (*fl_break)(struct file_lock *);
--	int (*fl_mylease)(struct file_lock *, struct file_lock *);
--	int (*fl_change)(struct file_lock **, int);
-+	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
-+	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
-+	void (* const fl_break)(struct file_lock *);
-+	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+	int (* const fl_change)(struct file_lock **, int);
- };
- 
- struct lock_manager {
-@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
- 	unsigned int fi_flags;		/* Flags as passed from user */
- 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
- 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
--	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- 						 * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
- 		unsigned long, loff_t *);
- 
- struct super_operations {
--   	struct inode *(*alloc_inode)(struct super_block *sb);
--	void (*destroy_inode)(struct inode *);
-+   	struct inode *(* const alloc_inode)(struct super_block *sb);
-+	void (* const destroy_inode)(struct inode *);
- 
--   	void (*dirty_inode) (struct inode *);
--	int (*write_inode) (struct inode *, int);
--	void (*drop_inode) (struct inode *);
--	void (*delete_inode) (struct inode *);
--	void (*put_super) (struct super_block *);
--	void (*write_super) (struct super_block *);
--	int (*sync_fs)(struct super_block *sb, int wait);
--	int (*freeze_fs) (struct super_block *);
--	int (*unfreeze_fs) (struct super_block *);
--	int (*statfs) (struct dentry *, struct kstatfs *);
--	int (*remount_fs) (struct super_block *, int *, char *);
--	void (*clear_inode) (struct inode *);
--	void (*umount_begin) (struct super_block *);
-+   	void (* const dirty_inode) (struct inode *);
-+	int (* const write_inode) (struct inode *, int);
-+	void (* const drop_inode) (struct inode *);
-+	void (* const delete_inode) (struct inode *);
-+	void (* const put_super) (struct super_block *);
-+	void (* const write_super) (struct super_block *);
-+	int (* const sync_fs)(struct super_block *sb, int wait);
-+	int (* const freeze_fs) (struct super_block *);
-+	int (* const unfreeze_fs) (struct super_block *);
-+	int (* const statfs) (struct dentry *, struct kstatfs *);
-+	int (* const remount_fs) (struct super_block *, int *, char *);
-+	void (* const clear_inode) (struct inode *);
-+	void (* const umount_begin) (struct super_block *);
- 
--	int (*show_options)(struct seq_file *, struct vfsmount *);
--	int (*show_stats)(struct seq_file *, struct vfsmount *);
-+	int (* const show_options)(struct seq_file *, struct vfsmount *);
-+	int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
--	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
--	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
--	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
- 
- /*
-diff -urNp linux-2.6.32.12/include/linux/fs_struct.h linux-2.6.32.12/include/linux/fs_struct.h
---- linux-2.6.32.12/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/fs_struct.h	2010-04-04 20:46:41.677383221 -0400
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
- 
- struct fs_struct {
--	int users;
-+	atomic_t users;
- 	rwlock_t lock;
- 	int umask;
- 	int in_exec;
-diff -urNp linux-2.6.32.12/include/linux/genhd.h linux-2.6.32.12/include/linux/genhd.h
---- linux-2.6.32.12/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/genhd.h	2010-04-04 20:46:41.677383221 -0400
-@@ -161,7 +161,7 @@ struct gendisk {
- 
- 	struct timer_rand_state *random;
- 
--	atomic_t sync_io;		/* RAID */
-+	atomic_unchecked_t sync_io;	/* RAID */
- 	struct work_struct async_notify;
- #ifdef  CONFIG_BLK_DEV_INTEGRITY
- 	struct blk_integrity *integrity;
-diff -urNp linux-2.6.32.12/include/linux/gracl.h linux-2.6.32.12/include/linux/gracl.h
---- linux-2.6.32.12/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/gracl.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,309 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION  "grsecurity 2.1.14"
-+#define GRSECURITY_VERSION 0x2114
-+
-+enum {
-+	GR_SHUTDOWN = 0,
-+	GR_ENABLE = 1,
-+	GR_SPROLE = 2,
-+	GR_RELOAD = 3,
-+	GR_SEGVMOD = 4,
-+	GR_STATUS = 5,
-+	GR_UNSPROLE = 6,
-+	GR_PASSSET = 7,
-+	GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+	GR_PW_LEN = 128,
-+	GR_SALT_LEN = 16,
-+	GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+	GR_SPROLE_LEN = 64,
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+	unsigned char *rolename;
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+	__u32 key;
-+	ino_t inode;
-+	dev_t device;
-+	char *name;
-+	__u16 len;
-+	__u8 deleted;
-+	struct name_entry *prev;
-+	struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+	struct name_entry *nentry;
-+	struct inodev_entry *prev;
-+	struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+	struct acl_role_label **r_hash;
-+	__u32 r_size;
-+};
-+
-+struct inodev_db {
-+	struct inodev_entry **i_hash;
-+	__u32 i_size;
-+};
-+
-+struct name_db {
-+	struct name_entry **n_hash;
-+	__u32 n_size;
-+};
-+
-+struct crash_uid {
-+	uid_t uid;
-+	unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+	void **table;
-+	void **nametable;
-+	void *first;
-+	__u32 table_size;
-+	__u32 used_size;
-+	int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+	kernel_cap_t cap_mask;
-+	kernel_cap_t cap_lower;
-+
-+	struct rlimit res[GR_NLIMITS];
-+	__u32 resmask;
-+
-+	__u8 user_trans_type;
-+	__u8 group_trans_type;
-+	uid_t *user_transitions;
-+	gid_t *group_transitions;
-+	__u16 user_trans_num;
-+	__u16 group_trans_num;
-+
-+	__u32 ip_proto[8];
-+	__u32 ip_type;
-+	struct acl_ip_label **ips;
-+	__u32 ip_num;
-+	__u32 inaddr_any_override;
-+
-+	__u32 crashes;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *parent_subject;
-+	struct gr_hash_struct *hash;
-+	struct acl_subject_label *prev;
-+	struct acl_subject_label *next;
-+
-+	struct acl_object_label **obj_hash;
-+	__u32 obj_hash_size;
-+	__u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+	__u32 addr;
-+	__u32 netmask;
-+
-+	struct role_allowed_ip *prev;
-+	struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+	char *rolename;
-+
-+	struct role_transition *prev;
-+	struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+	char *rolename;
-+	uid_t uidgid;
-+	__u16 roletype;
-+
-+	__u16 auth_attempts;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *root_label;
-+	struct gr_hash_struct *hash;
-+
-+	struct acl_role_label *prev;
-+	struct acl_role_label *next;
-+
-+	struct role_transition *transitions;
-+	struct role_allowed_ip *allowed_ips;
-+	uid_t *domain_children;
-+	__u16 domain_child_num;
-+
-+	struct acl_subject_label **subj_hash;
-+	__u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+	struct acl_role_label **r_table;
-+	__u32 num_pointers;		/* Number of allocations to track */
-+	__u32 num_roles;		/* Number of roles */
-+	__u32 num_domain_children;	/* Number of domain children */
-+	__u32 num_subjects;		/* Number of subjects */
-+	__u32 num_objects;		/* Number of objects */
-+};
-+
-+struct acl_object_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+
-+	struct acl_subject_label *nested;
-+	struct acl_object_label *globbed;
-+
-+	/* next two structures not used */
-+
-+	struct acl_object_label *prev;
-+	struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+	char *iface;
-+	__u32 addr;
-+	__u32 netmask;
-+	__u16 low, high;
-+	__u8 mode;
-+	__u32 type;
-+	__u32 proto[8];
-+
-+	/* next two structures not used */
-+
-+	struct acl_ip_label *prev;
-+	struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+	struct user_acl_role_db role_db;
-+	unsigned char pw[GR_PW_LEN];
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];
-+	unsigned char sp_role[GR_SPROLE_LEN];
-+	struct sprole_pw *sprole_pws;
-+	dev_t segv_device;
-+	ino_t segv_inode;
-+	uid_t segv_uid;
-+	__u16 num_sprole_pws;
-+	__u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+	struct gr_arg *arg;
-+	__u32 version;
-+	__u32 size;
-+};
-+
-+struct subject_map {
-+	struct acl_subject_label *user;
-+	struct acl_subject_label *kernel;
-+	struct subject_map *prev;
-+	struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+	struct subject_map **s_hash;
-+	__u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+   Makes good use of the low bits of the inode.  Generally 0-1 times
-+   in loop for successful match.  0-3 for unsuccessful match.
-+   Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+	return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+	return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+	return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+	role = role_list; \
-+	while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+		role = role->prev; \
-+	}
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+	subj = NULL; \
-+	iter = 0; \
-+	while (iter < role->subj_hash_size) { \
-+		if (subj == NULL) \
-+			subj = role->subj_hash[iter]; \
-+		if (subj == NULL) { \
-+			iter++; \
-+			continue; \
-+		}
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+		subj = subj->next; \
-+		if (subj == NULL) \
-+			iter++; \
-+	}
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+	subj = role->hash->first; \
-+	while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+		subj = subj->next; \
-+	}
-+
-+#endif
-+
-diff -urNp linux-2.6.32.12/include/linux/gralloc.h linux-2.6.32.12/include/linux/gralloc.h
---- linux-2.6.32.12/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/gralloc.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff -urNp linux-2.6.32.12/include/linux/grdefs.h linux-2.6.32.12/include/linux/grdefs.h
---- linux-2.6.32.12/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/grdefs.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,136 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+	GR_READY = 0x01,
-+	GR_STATUS_INIT = 0x00	// disabled state
-+};
-+
-+/* Begin  ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+	GR_ROLE_USER = 0x0001,
-+	GR_ROLE_GROUP = 0x0002,
-+	GR_ROLE_DEFAULT = 0x0004,
-+	GR_ROLE_SPECIAL = 0x0008,
-+	GR_ROLE_AUTH = 0x0010,
-+	GR_ROLE_NOPW = 0x0020,
-+	GR_ROLE_GOD = 0x0040,
-+	GR_ROLE_LEARN = 0x0080,
-+	GR_ROLE_TPE = 0x0100,
-+	GR_ROLE_DOMAIN = 0x0200,
-+	GR_ROLE_PAM = 0x0400
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+	GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+	GR_READ 	= 0x00000001,
-+	GR_APPEND 	= 0x00000002,
-+	GR_WRITE 	= 0x00000004,
-+	GR_EXEC 	= 0x00000008,
-+	GR_FIND 	= 0x00000010,
-+	GR_INHERIT 	= 0x00000020,
-+	GR_SETID 	= 0x00000040,
-+	GR_CREATE 	= 0x00000080,
-+	GR_DELETE 	= 0x00000100,
-+	GR_LINK		= 0x00000200,
-+	GR_AUDIT_READ 	= 0x00000400,
-+	GR_AUDIT_APPEND = 0x00000800,
-+	GR_AUDIT_WRITE 	= 0x00001000,
-+	GR_AUDIT_EXEC 	= 0x00002000,
-+	GR_AUDIT_FIND 	= 0x00004000,
-+	GR_AUDIT_INHERIT= 0x00008000,
-+	GR_AUDIT_SETID 	= 0x00010000,
-+	GR_AUDIT_CREATE = 0x00020000,
-+	GR_AUDIT_DELETE = 0x00040000,
-+	GR_AUDIT_LINK	= 0x00080000,
-+	GR_PTRACERD 	= 0x00100000,
-+	GR_NOPTRACE	= 0x00200000,
-+	GR_SUPPRESS 	= 0x00400000,
-+	GR_NOLEARN 	= 0x00800000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+	GR_KILL 	= 0x00000001,
-+	GR_VIEW 	= 0x00000002,
-+	GR_PROTECTED 	= 0x00000004,
-+	GR_LEARN 	= 0x00000008,
-+	GR_OVERRIDE 	= 0x00000010,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_DUMMY 	= 0x00000020,
-+	GR_PROTSHM	= 0x00000040,
-+	GR_KILLPROC	= 0x00000080,
-+	GR_KILLIPPROC	= 0x00000100,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_NOTROJAN	= 0x00000200,
-+	GR_PROTPROCFD	= 0x00000400,
-+	GR_PROCACCT	= 0x00000800,
-+	GR_RELAXPTRACE	= 0x00001000,
-+	GR_NESTED	= 0x00002000,
-+	GR_INHERITLEARN	= 0x00004000,
-+	GR_PROCFIND	= 0x00008000,
-+	GR_POVERRIDE	= 0x00010000,
-+	GR_KERNELAUTH	= 0x00020000,
-+};
-+
-+enum {
-+	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
-+	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
-+	GR_PAX_ENABLE_MPROTECT	= 0x0004,
-+	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
-+	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
-+	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
-+	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
-+	GR_PAX_DISABLE_MPROTECT	= 0x0400,
-+	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
-+	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
-+};
-+
-+enum {
-+	GR_ID_USER	= 0x01,
-+	GR_ID_GROUP	= 0x02,
-+};
-+
-+enum {
-+	GR_ID_ALLOW	= 0x01,
-+	GR_ID_DENY	= 0x02,
-+};
-+
-+#define GR_CRASH_RES	31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+	GR_RLIM_CPU_BUMP = 60,
-+	GR_RLIM_FSIZE_BUMP = 50000,
-+	GR_RLIM_DATA_BUMP = 10000,
-+	GR_RLIM_STACK_BUMP = 1000,
-+	GR_RLIM_CORE_BUMP = 10000,
-+	GR_RLIM_RSS_BUMP = 500000,
-+	GR_RLIM_NPROC_BUMP = 1,
-+	GR_RLIM_NOFILE_BUMP = 5,
-+	GR_RLIM_MEMLOCK_BUMP = 50000,
-+	GR_RLIM_AS_BUMP = 500000,
-+	GR_RLIM_LOCKS_BUMP = 2,
-+	GR_RLIM_SIGPENDING_BUMP = 5,
-+	GR_RLIM_MSGQUEUE_BUMP = 10000,
-+	GR_RLIM_NICE_BUMP = 1,
-+	GR_RLIM_RTPRIO_BUMP = 1,
-+	GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff -urNp linux-2.6.32.12/include/linux/grinternal.h linux-2.6.32.12/include/linux/grinternal.h
---- linux-2.6.32.12/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/grinternal.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,215 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+	__attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+			    const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+			     const struct dentry *parent,
-+			     const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_execve;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_findtask;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_sidcaps;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) (tsk->exec_file ? \
-+			gr_to_filename2(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
-+			gr_to_filename(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
-+			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
-+			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
-+			    tsk_a->fs->root.dentry)))
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
-+			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
-+		       task->pid, cred->uid, \
-+		       cred->euid, cred->gid, cred->egid, \
-+		       gr_parent_task_fullpath(task), \
-+		       task->parent->comm, task->parent->pid, \
-+		       pcred->uid, pcred->euid, \
-+		       pcred->gid, pcred->egid
-+
-+#define GR_CHROOT_CAPS {{ \
-+	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+	read_lock(&grsec_exec_file_lock); \
-+	gr_add_learn_entry(normal_msg "\n", ## args); \
-+	read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+	GR_DO_AUDIT,
-+	GR_DONT_AUDIT,
-+	GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+	GR_TTYSNIFF,
-+	GR_RBAC,
-+	GR_RBAC_STR,
-+	GR_STR_RBAC,
-+	GR_RBAC_MODE2,
-+	GR_RBAC_MODE3,
-+	GR_FILENAME,
-+	GR_SYSCTL_HIDDEN,
-+	GR_NOARGS,
-+	GR_ONE_INT,
-+	GR_ONE_INT_TWO_STR,
-+	GR_ONE_STR,
-+	GR_STR_INT,
-+	GR_TWO_INT,
-+	GR_THREE_INT,
-+	GR_FIVE_INT_TWO_STR,
-+	GR_TWO_STR,
-+	GR_THREE_STR,
-+	GR_FOUR_STR,
-+	GR_STR_FILENAME,
-+	GR_FILENAME_STR,
-+	GR_FILENAME_TWO_INT,
-+	GR_FILENAME_TWO_INT_STR,
-+	GR_TEXTREL,
-+	GR_PTRACE,
-+	GR_RESOURCE,
-+	GR_CAP,
-+	GR_SIG,
-+	GR_SIG2,
-+	GR_CRASH1,
-+	GR_CRASH2,
-+	GR_PSACCT
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.12/include/linux/grmsg.h linux-2.6.32.12/include/linux/grmsg.h
---- linux-2.6.32.12/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/grmsg.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,107 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_KMEM_MSG "denied write of /dev/kmem by "
-+#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
-+#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
-+#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_NPROC_MSG "denied overstep of process limit by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %d by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-diff -urNp linux-2.6.32.12/include/linux/grsecurity.h linux-2.6.32.12/include/linux/grsecurity.h
---- linux-2.6.32.12/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/include/linux/grsecurity.h	2010-04-04 20:46:41.677383221 -0400
-@@ -0,0 +1,199 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+void gr_handle_brute_attach(struct task_struct *p);
-+void gr_handle_brute_check(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+					const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+				   const struct vfsmount *mnt);
-+int gr_handle_chroot_caps(struct path *path);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+				  const struct vfsmount *mnt,
-+				  const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+int gr_handle_nproc(void);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+int gr_random_pid(void);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+			 const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+			       const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+				 const struct inode *inode,
-+				 const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+			  const struct vfsmount *mnt,
-+			  const struct dentry *dir, const int flag,
-+			  const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+			      const struct vfsmount *mnt,
-+			      struct inode *inode,
-+			      const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+			      const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_acl_handle_mmap(const struct file *file,
-+			      const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+				  const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+				    const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+				 const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+			      const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+			const struct vfsmount *mnt,
-+			const int unsafe_share);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+				const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+				 const struct dentry *p_dentry,
-+				 const struct vfsmount *p_mnt, const int fmode,
-+				 const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+			     const struct vfsmount *mnt);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt,
-+				 const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+				   const struct dentry *parent_dentry,
-+				   const struct vfsmount *parent_mnt,
-+				   const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+				const struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				const struct dentry *old_dentry,
-+				const struct vfsmount *old_mnt, const char *to);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+				struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				struct dentry *old_dentry,
-+				struct inode *old_parent_inode,
-+				struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+				struct dentry *old_dentry,
-+				struct dentry *new_dentry,
-+				struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+			   const struct dentry *parent_dentry,
-+			   const struct vfsmount *parent_mnt,
-+			   const struct dentry *old_dentry,
-+			   const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+				 const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void gr_log_nonroot_mod_load(const char *modname);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_write(void);
-+void gr_handle_kmem_write(void);
-+void gr_handle_open_port(void);
-+int gr_handle_mem_mmap(const unsigned long offset,
-+			      struct vm_area_struct *vma);
-+
-+extern int grsec_enable_dmesg;
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.12/include/linux/hdpu_features.h linux-2.6.32.12/include/linux/hdpu_features.h
---- linux-2.6.32.12/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/hdpu_features.h	2010-04-04 20:46:41.677383221 -0400
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- 	spinlock_t lock;
- 	int excl;
--        int open_count;
-+	atomic_t open_count;
- 	unsigned char cached_val;
- 	int inited;
- 	unsigned long *set_addr;
-diff -urNp linux-2.6.32.12/include/linux/highmem.h linux-2.6.32.12/include/linux/highmem.h
---- linux-2.6.32.12/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/highmem.h	2010-04-04 20:46:41.677383221 -0400
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
- 	kunmap_atomic(kaddr, KM_USER0);
- }
- 
-+static inline void sanitize_highpage(struct page *page)
-+{
-+	void *kaddr;
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
-+	kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+	clear_page(kaddr);
-+	kunmap_atomic(kaddr, KM_CLEARPAGE);
-+	local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- 	unsigned start1, unsigned end1,
- 	unsigned start2, unsigned end2)
-diff -urNp linux-2.6.32.12/include/linux/init_task.h linux-2.6.32.12/include/linux/init_task.h
---- linux-2.6.32.12/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/init_task.h	2010-04-04 20:46:41.677383221 -0400
-@@ -115,6 +115,13 @@ extern struct cred init_cred;
- # define INIT_PERF_EVENTS(tsk)
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+# define INIT_GR_FS_LOCK					\
-+	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
-+#else
-+# define INIT_GR_FS_LOCK
-+#endif
-+
- /*
-  *  INIT_TASK is used to set up the first task table, touch at
-  * your own risk!. Base=0, limit=0x1fffff (=2MB)
-@@ -184,6 +191,7 @@ extern struct cred init_cred;
- 	INIT_FTRACE_GRAPH						\
- 	INIT_TRACE_RECURSION						\
- 	INIT_TASK_RCU_PREEMPT(tsk)					\
-+	INIT_GR_FS_LOCK							\
- }
- 
- 
-diff -urNp linux-2.6.32.12/include/linux/interrupt.h linux-2.6.32.12/include/linux/interrupt.h
---- linux-2.6.32.12/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/interrupt.h	2010-04-04 20:46:41.677383221 -0400
-@@ -357,7 +357,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
-  * kernel/softirq.c when adding a new softirq.
-  */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
- 
- /* softirq mask and active fields moved to irq_cpustat_t in
-  * asm/hardirq.h to get better cache usage.  KAO
-@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
- 
- struct softirq_action
- {
--	void	(*action)(struct softirq_action *);
-+	void	(*action)(void);
- };
- 
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff -urNp linux-2.6.32.12/include/linux/jbd2.h linux-2.6.32.12/include/linux/jbd2.h
---- linux-2.6.32.12/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/jbd2.h	2010-04-04 20:46:41.677383221 -0400
-@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd2_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.12/include/linux/jbd.h linux-2.6.32.12/include/linux/jbd.h
---- linux-2.6.32.12/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/jbd.h	2010-04-04 20:46:41.677383221 -0400
-@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.12/include/linux/kallsyms.h linux-2.6.32.12/include/linux/kallsyms.h
---- linux-2.6.32.12/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/kallsyms.h	2010-04-04 20:46:41.677383221 -0400
-@@ -15,7 +15,8 @@
- 
- struct module;
- 
--#ifdef CONFIG_KALLSYMS
-+#ifndef __INCLUDED_BY_HIDESYM
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
- 
-@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, with HIDESYM enabled */
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+#endif
- 
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.32.12/include/linux/kgdb.h linux-2.6.32.12/include/linux/kgdb.h
---- linux-2.6.32.12/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/kgdb.h	2010-04-04 20:46:41.677383221 -0400
-@@ -251,20 +251,20 @@ struct kgdb_arch {
-  */
- struct kgdb_io {
- 	const char		*name;
--	int			(*read_char) (void);
--	void			(*write_char) (u8);
--	void			(*flush) (void);
--	int			(*init) (void);
--	void			(*pre_exception) (void);
--	void			(*post_exception) (void);
-+	int			(* const read_char) (void);
-+	void			(* const write_char) (u8);
-+	void			(* const flush) (void);
-+	int			(* const init) (void);
-+	void			(* const pre_exception) (void);
-+	void			(* const post_exception) (void);
- };
- 
--extern struct kgdb_arch		arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
- 
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
- 
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
- 
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.32.12/include/linux/kobject.h linux-2.6.32.12/include/linux/kobject.h
---- linux-2.6.32.12/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/kobject.h	2010-04-04 20:46:41.677383221 -0400
-@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
- 
- struct kobj_type {
- 	void (*release)(struct kobject *kobj);
--	struct sysfs_ops *sysfs_ops;
-+	const struct sysfs_ops *sysfs_ops;
- 	struct attribute **default_attrs;
- };
- 
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
- 
- struct kset_uevent_ops {
--	int (*filter)(struct kset *kset, struct kobject *kobj);
--	const char *(*name)(struct kset *kset, struct kobject *kobj);
--	int (*uevent)(struct kset *kset, struct kobject *kobj,
-+	int (* const filter)(struct kset *kset, struct kobject *kobj);
-+	const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+	int (* const uevent)(struct kset *kset, struct kobject *kobj,
- 		      struct kobj_uevent_env *env);
- };
- 
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- 			 const char *buf, size_t count);
- };
- 
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
- 
- /**
-  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- 	struct list_head list;
- 	spinlock_t list_lock;
- 	struct kobject kobj;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- };
- 
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
--						struct kset_uevent_ops *u,
-+						const struct kset_uevent_ops *u,
- 						struct kobject *parent_kobj);
- 
- static inline struct kset *to_kset(struct kobject *kobj)
-diff -urNp linux-2.6.32.12/include/linux/kvm_host.h linux-2.6.32.12/include/linux/kvm_host.h
---- linux-2.6.32.12/include/linux/kvm_host.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.12/include/linux/kvm_host.h	2010-04-29 17:49:58.621028174 -0400
-@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module);
- void kvm_exit(void);
- 
-@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
- 					struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
- 
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
- 
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.32.12/include/linux/libata.h linux-2.6.32.12/include/linux/libata.h
---- linux-2.6.32.12/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/libata.h	2010-04-04 20:46:41.677383221 -0400
-@@ -64,11 +64,11 @@
- #ifdef ATA_VERBOSE_DEBUG
- #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
- #else
--#define VPRINTK(fmt, args...)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_VERBOSE_DEBUG */
- #else
--#define DPRINTK(fmt, args...)
--#define VPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_DEBUG */
- 
- #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
-@@ -524,11 +524,11 @@ struct ata_ioports {
- 
- struct ata_host {
- 	spinlock_t		lock;
--	struct device 		*dev;
-+	struct device		*dev;
- 	void __iomem * const	*iomap;
- 	unsigned int		n_ports;
- 	void			*private_data;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned long		flags;
- #ifdef CONFIG_ATA_ACPI
- 	acpi_handle		acpi_handle;
-@@ -709,7 +709,7 @@ struct ata_link {
- 
- struct ata_port {
- 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	spinlock_t		*lock;
- 	/* Flags owned by the EH context. Only EH should touch these once the
- 	   port is active */
-@@ -891,7 +891,7 @@ struct ata_port_info {
- 	unsigned long		pio_mask;
- 	unsigned long		mwdma_mask;
- 	unsigned long		udma_mask;
--	struct ata_port_operations *port_ops;
-+	const struct ata_port_operations *port_ops;
- 	void 			*private_data;
- };
- 
-@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
- 
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
- 
- static inline const unsigned long *
-@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
- 			     struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
--			  unsigned long, struct ata_port_operations *);
-+			  unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff -urNp linux-2.6.32.12/include/linux/lockd/bind.h linux-2.6.32.12/include/linux/lockd/bind.h
---- linux-2.6.32.12/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/lockd/bind.h	2010-04-04 20:46:41.681061354 -0400
-@@ -23,13 +23,13 @@ struct svc_rqst;
-  * This is the set of functions for lockd->nfsd communication
-  */
- struct nlmsvc_binding {
--	__be32			(*fopen)(struct svc_rqst *,
-+	__be32			(* const fopen)(struct svc_rqst *,
- 						struct nfs_fh *,
- 						struct file **);
--	void			(*fclose)(struct file *);
-+	void			(* const fclose)(struct file *);
- };
- 
--extern struct nlmsvc_binding *	nlmsvc_ops;
-+extern const struct nlmsvc_binding *	nlmsvc_ops;
- 
- /*
-  * Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.32.12/include/linux/mm.h linux-2.6.32.12/include/linux/mm.h
---- linux-2.6.32.12/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/mm.h	2010-04-04 20:46:41.681061354 -0400
-@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
- #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
-+#endif
-+
- #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
- #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
- #endif
-@@ -880,6 +884,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
- 
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
- 
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -1152,6 +1158,7 @@ out:
- }
- 
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
- 
- extern unsigned long do_brk(unsigned long, unsigned long);
- 
-@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- 					     struct vm_area_struct **pprev);
- 
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
-    NULL if none.  Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
- 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
- 
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- 			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
- 
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.32.12/include/linux/mm_types.h linux-2.6.32.12/include/linux/mm_types.h
---- linux-2.6.32.12/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/mm_types.h	2010-04-04 20:46:41.681061354 -0400
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
- #endif
-+
-+	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
- 
- struct core_thread {
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- 	struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	unsigned long delta_mmap;		/* randomized offset */
-+	unsigned long delta_stack;		/* randomized offset */
-+#endif
-+
- };
- 
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.32.12/include/linux/mmu_notifier.h linux-2.6.32.12/include/linux/mmu_notifier.h
---- linux-2.6.32.12/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/mmu_notifier.h	2010-04-04 20:46:41.681061354 -0400
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
-  */
- #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
- ({									\
--	pte_t __pte;							\
-+	pte_t ___pte;							\
- 	struct vm_area_struct *___vma = __vma;				\
- 	unsigned long ___address = __address;				\
--	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
-+	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
- 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
--	__pte;								\
-+	___pte;								\
- })
- 
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
-diff -urNp linux-2.6.32.12/include/linux/mod_devicetable.h linux-2.6.32.12/include/linux/mod_devicetable.h
---- linux-2.6.32.12/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/mod_devicetable.h	2010-04-04 20:46:41.681061354 -0400
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
- 
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
- 
- struct pci_device_id {
- 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
- 
--#define HID_ANY_ID				(~0)
-+#define HID_ANY_ID				(~0U)
- 
- struct hid_device_id {
- 	__u16 bus;
-diff -urNp linux-2.6.32.12/include/linux/module.h linux-2.6.32.12/include/linux/module.h
---- linux-2.6.32.12/include/linux/module.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.12/include/linux/module.h	2010-04-29 17:49:58.621028174 -0400
-@@ -287,16 +287,16 @@ struct module
- 	int (*init)(void);
- 
- 	/* If this is non-NULL, vfree after init() returns */
--	void *module_init;
-+	void *module_init_rx, *module_init_rw;
- 
- 	/* Here is the actual code + data, vfree'd on unload. */
--	void *module_core;
-+	void *module_core_rx, *module_core_rw;
- 
- 	/* Here are the sizes of the init and core sections */
--	unsigned int init_size, core_size;
-+	unsigned int init_size_rw, core_size_rw;
- 
- 	/* The size of the executable code in each section.  */
--	unsigned int init_text_size, core_text_size;
-+	unsigned int init_size_rx, core_size_rx;
- 
- 	/* Arch-specific module values */
- 	struct mod_arch_specific arch;
-@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
- 
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (ktla_ktva(addr) >= (unsigned long)start &&
-+	    ktla_ktva(addr) < (unsigned long)start + size)
-+		return 1;
-+#endif
-+
-+	return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_core <= addr &&
--	       addr < (unsigned long)mod->module_core + mod->core_size;
-+	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
- 
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_init <= addr &&
--	       addr < (unsigned long)mod->module_init + mod->init_size;
-+	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
- 
- /* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.32.12/include/linux/moduleloader.h linux-2.6.32.12/include/linux/moduleloader.h
---- linux-2.6.32.12/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/moduleloader.h	2010-04-04 20:46:41.681061354 -0400
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
-    sections.  Returns NULL on failure. */
- void *module_alloc(unsigned long size);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF.  Return -error
-    or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.32.12/include/linux/namei.h linux-2.6.32.12/include/linux/namei.h
---- linux-2.6.32.12/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/namei.h	2010-04-04 20:46:41.681061354 -0400
-@@ -22,7 +22,7 @@ struct nameidata {
- 	unsigned int	flags;
- 	int		last_type;
- 	unsigned	depth;
--	char *saved_names[MAX_NESTED_LINKS + 1];
-+	const char *saved_names[MAX_NESTED_LINKS + 1];
- 
- 	/* Intent data */
- 	union {
-@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
- 
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- 	nd->saved_names[nd->depth] = path;
- }
- 
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- 	return nd->saved_names[nd->depth];
- }
-diff -urNp linux-2.6.32.12/include/linux/nodemask.h linux-2.6.32.12/include/linux/nodemask.h
---- linux-2.6.32.12/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/nodemask.h	2010-04-04 20:46:41.681061354 -0400
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
- 
- #define any_online_node(mask)			\
- ({						\
--	int node;				\
--	for_each_node_mask(node, (mask))	\
--		if (node_online(node))		\
-+	int __node;				\
-+	for_each_node_mask(__node, (mask))	\
-+		if (node_online(__node))	\
- 			break;			\
--	node;					\
-+	__node;					\
- })
- 
- #define num_online_nodes()	num_node_state(N_ONLINE)
-diff -urNp linux-2.6.32.12/include/linux/oprofile.h linux-2.6.32.12/include/linux/oprofile.h
---- linux-2.6.32.12/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/oprofile.h	2010-04-04 20:46:41.681061354 -0400
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- 	char const * name, ulong * val);
-  
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
--	char const * name, atomic_t * val);
-+	char const * name, atomic_unchecked_t * val);
-  
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.32.12/include/linux/pipe_fs_i.h linux-2.6.32.12/include/linux/pipe_fs_i.h
---- linux-2.6.32.12/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/pipe_fs_i.h	2010-04-04 20:46:41.681061354 -0400
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- 	wait_queue_head_t wait;
- 	unsigned int nrbufs, curbuf;
- 	struct page *tmp_page;
--	unsigned int readers;
--	unsigned int writers;
--	unsigned int waiting_writers;
-+	atomic_t readers;
-+	atomic_t writers;
-+	atomic_t waiting_writers;
- 	unsigned int r_counter;
- 	unsigned int w_counter;
- 	struct fasync_struct *fasync_readers;
-diff -urNp linux-2.6.32.12/include/linux/poison.h linux-2.6.32.12/include/linux/poison.h
---- linux-2.6.32.12/include/linux/poison.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/poison.h	2010-04-04 20:46:41.681061354 -0400
-@@ -7,8 +7,8 @@
-  * under normal circumstances, used to verify that nobody uses
-  * non-initialized list entries.
-  */
--#define LIST_POISON1  ((void *) 0x00100100)
--#define LIST_POISON2  ((void *) 0x00200200)
-+#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
- 
- /********** include/linux/timer.h **********/
- /*
-diff -urNp linux-2.6.32.12/include/linux/proc_fs.h linux-2.6.32.12/include/linux/proc_fs.h
---- linux-2.6.32.12/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/proc_fs.h	2010-04-04 20:46:41.681061354 -0400
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
- 	return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
- 
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+	return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+	
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- 	mode_t mode, struct proc_dir_entry *base, 
- 	read_proc_t *read_proc, void * data)
-diff -urNp linux-2.6.32.12/include/linux/random.h linux-2.6.32.12/include/linux/random.h
---- linux-2.6.32.12/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/random.h	2010-04-04 20:46:41.681061354 -0400
-@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
- 
-+static inline unsigned long pax_get_random_long(void)
-+{
-+	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
- 
- #endif /* _LINUX_RANDOM_H */
-diff -urNp linux-2.6.32.12/include/linux/reiserfs_fs.h linux-2.6.32.12/include/linux/reiserfs_fs.h
---- linux-2.6.32.12/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/reiserfs_fs.h	2010-04-04 20:46:41.681061354 -0400
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
- #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
- 
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
- */
- 
- struct item_operations {
--	int (*bytes_number) (struct item_head * ih, int block_size);
--	void (*decrement_key) (struct cpu_key *);
--	int (*is_left_mergeable) (struct reiserfs_key * ih,
-+	int (* const bytes_number) (struct item_head * ih, int block_size);
-+	void (* const decrement_key) (struct cpu_key *);
-+	int (* const is_left_mergeable) (struct reiserfs_key * ih,
- 				  unsigned long bsize);
--	void (*print_item) (struct item_head *, char *item);
--	void (*check_item) (struct item_head *, char *item);
-+	void (* const print_item) (struct item_head *, char *item);
-+	void (* const check_item) (struct item_head *, char *item);
- 
--	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- 			  int is_affected, int insert_size);
--	int (*check_left) (struct virtual_item * vi, int free,
-+	int (* const check_left) (struct virtual_item * vi, int free,
- 			   int start_skip, int end_skip);
--	int (*check_right) (struct virtual_item * vi, int free);
--	int (*part_size) (struct virtual_item * vi, int from, int to);
--	int (*unit_num) (struct virtual_item * vi);
--	void (*print_vi) (struct virtual_item * vi);
-+	int (* const check_right) (struct virtual_item * vi, int free);
-+	int (* const part_size) (struct virtual_item * vi, int from, int to);
-+	int (* const unit_num) (struct virtual_item * vi);
-+	void (* const print_vi) (struct virtual_item * vi);
- };
- 
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
- 
- #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.32.12/include/linux/reiserfs_fs_sb.h linux-2.6.32.12/include/linux/reiserfs_fs_sb.h
---- linux-2.6.32.12/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/reiserfs_fs_sb.h	2010-04-04 20:46:41.681061354 -0400
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- 	/* Comment? -Hans */
- 	wait_queue_head_t s_wait;
- 	/* To be obsoleted soon by per buffer seals.. -Hans */
--	atomic_t s_generation_counter;	// increased by one every time the
-+	atomic_unchecked_t s_generation_counter;	// increased by one every time the
- 	// tree gets re-balanced
- 	unsigned long s_properties;	/* File system properties. Currently holds
- 					   on-disk FS format */
-diff -urNp linux-2.6.32.12/include/linux/sched.h linux-2.6.32.12/include/linux/sched.h
---- linux-2.6.32.12/include/linux/sched.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/sched.h	2010-04-04 20:46:41.681061354 -0400
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
- 
- /*
-  * List of flags we want to share for kernel threads,
-@@ -664,6 +665,15 @@ struct signal_struct {
- 	struct tty_audit_buf *tty_audit_buf;
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+	u32 curr_ip;
-+	u32 gr_saddr;
-+	u32 gr_daddr;
-+	u16 gr_sport;
-+	u16 gr_dport;
-+	u8 used_accept:1;
-+#endif
-+
- 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
- };
- 
-@@ -1217,7 +1227,7 @@ struct rcu_node;
- 
- struct task_struct {
- 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
--	void *stack;
-+	struct thread_info *stack;
- 	atomic_t usage;
- 	unsigned int flags;	/* per process flags, defined below */
- 	unsigned int ptrace;
-@@ -1329,8 +1339,8 @@ struct task_struct {
- 	struct list_head thread_group;
- 
- 	struct completion *vfork_done;		/* for vfork() */
--	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
--	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
-+	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
-+	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
- 
- 	cputime_t utime, stime, utimescaled, stimescaled;
- 	cputime_t gtime;
-@@ -1344,16 +1354,6 @@ struct task_struct {
- 	struct task_cputime cputime_expires;
- 	struct list_head cpu_timers[3];
- 
--/* process credentials */
--	const struct cred *real_cred;	/* objective and real subjective task
--					 * credentials (COW) */
--	const struct cred *cred;	/* effective (overridable) subjective task
--					 * credentials (COW) */
--	struct mutex cred_guard_mutex;	/* guard against foreign influences on
--					 * credential calculations
--					 * (notably. ptrace) */
--	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- 	char comm[TASK_COMM_LEN]; /* executable name excluding path
- 				     - access with [gs]et_task_comm (which lock
- 				       it with task_lock())
-@@ -1437,6 +1437,15 @@ struct task_struct {
- 	int hardirq_context;
- 	int softirq_context;
- #endif
-+
-+/* process credentials */
-+	const struct cred *real_cred;	/* objective and real subjective task
-+					 * credentials (COW) */
-+	struct mutex cred_guard_mutex;	/* guard against foreign influences on
-+					 * credential calculations
-+					 * (notably. ptrace) */
-+	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- 	u64 curr_chain_key;
-@@ -1457,6 +1466,9 @@ struct task_struct {
- 
- 	struct backing_dev_info *backing_dev_info;
- 
-+	const struct cred *cred;	/* effective (overridable) subjective task
-+					 * credentials (COW) */
-+
- 	struct io_context *io_context;
- 
- 	unsigned long ptrace_message;
-@@ -1520,6 +1532,19 @@ struct task_struct {
- 	unsigned long default_timer_slack_ns;
- 
- 	struct list_head	*scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+	/* grsecurity */
-+	rwlock_t gr_fs_lock;
-+	struct acl_subject_label *acl;
-+	struct acl_role_label *role;
-+	struct file *exec_file;
-+	u16 acl_role_id;
-+	u8 acl_sp_role;
-+	u8 is_writable;
-+	u8 brute;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- 	/* Index of current stored adress in ret_stack */
- 	int curr_ret_stack;
-@@ -1544,6 +1569,52 @@ struct task_struct {
- 	unsigned long stack_start;
- };
- 
-+#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
-+#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern unsigned int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+	if (likely(tsk->mm))
-+		return tsk->mm->pax_flags;
-+	else
-+		return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+	if (likely(tsk->mm)) {
-+		tsk->mm->pax_flags = flags;
-+		return 0;
-+	}
-+	return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+void pax_report_insns(void *pc, void *sp);
-+void pax_report_refcount_overflow(struct pt_regs *regs);
-+void pax_report_leak_to_user(const void *ptr, unsigned long len);
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len);
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
- 
-@@ -2143,7 +2214,7 @@ extern void __cleanup_sighand(struct sig
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
- 
--extern NORET_TYPE void do_group_exit(int);
-+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
- 
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2245,6 +2316,33 @@ static inline void task_unlock(struct ta
- 	spin_unlock(&p->alloc_lock);
- }
- 
-+/* grsec: protects only ->fs as task_lock is overkill and we can't
-+   be using a spin_lock in interrupt context
-+*/
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_fs_write_lock_irqsave(x, y)				\
-+	write_lock_irqsave(&x->gr_fs_lock, y)
-+#define gr_fs_write_unlock_irqrestore(x, y) 			\
-+	write_unlock_irqrestore(&x->gr_fs_lock, y)
-+#else
-+#define gr_fs_write_lock_irqsave(x, y)
-+#define gr_fs_write_unlock_irqrestore(x, y)
-+#endif
-+
-+static inline void gr_fs_read_lock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_lock(&p->gr_fs_lock);
-+#endif
-+}
-+
-+static inline void gr_fs_read_unlock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_unlock(&p->gr_fs_lock);
-+#endif
-+}
-+
- extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
- 							unsigned long *flags);
- 
-@@ -2256,8 +2354,8 @@ static inline void unlock_task_sighand(s
- 
- #ifndef __HAVE_THREAD_FUNCTIONS
- 
--#define task_thread_info(task)	((struct thread_info *)(task)->stack)
--#define task_stack_page(task)	((task)->stack)
-+#define task_thread_info(task)	((task)->stack)
-+#define task_stack_page(task)	((void *)(task)->stack)
- 
- static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
- {
-@@ -2272,13 +2370,31 @@ static inline unsigned long *end_of_stac
- 
- #endif
- 
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
--	void *stack = task_stack_page(current);
-+	const void *stack = task_stack_page(current);
- 
- 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
- 
-+/* 0: not at all, 1: fully, -1: partially (implies an error) */
-+static inline int object_is_on_stack(const void *obj, unsigned long len)
-+{
-+	const void *stack = task_stack_page(current);
-+	const void *stackend = stack + THREAD_SIZE;
-+
-+	if (obj + len < obj)
-+		return -1;
-+
-+	if (stack <= obj && obj + len <= stackend)
-+		return 1;
-+
-+	if (obj + len <= stack || stackend <=  obj)
-+		return 0;
-+
-+	return -1;
-+}
-+
- extern void thread_info_cache_init(void);
- 
- #ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.32.12/include/linux/screen_info.h linux-2.6.32.12/include/linux/screen_info.h
---- linux-2.6.32.12/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/screen_info.h	2010-04-04 20:46:41.681061354 -0400
-@@ -42,7 +42,8 @@ struct screen_info {
- 	__u16 pages;		/* 0x32 */
- 	__u16 vesa_attributes;	/* 0x34 */
- 	__u32 capabilities;     /* 0x36 */
--	__u8  _reserved[6];	/* 0x3a */
-+	__u16 vesapm_size;	/* 0x3a */
-+	__u8  _reserved[4];	/* 0x3c */
- } __attribute__((packed));
- 
- #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
-diff -urNp linux-2.6.32.12/include/linux/security.h linux-2.6.32.12/include/linux/security.h
---- linux-2.6.32.12/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/security.h	2010-04-04 20:46:41.681061354 -0400
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
- 
- /* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.32.12/include/linux/shm.h linux-2.6.32.12/include/linux/shm.h
---- linux-2.6.32.12/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/shm.h	2010-04-04 20:46:41.681061354 -0400
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
- 	pid_t			shm_cprid;
- 	pid_t			shm_lprid;
- 	struct user_struct	*mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+	time_t			shm_createtime;
-+	pid_t			shm_lapid;
-+#endif
- };
- 
- /* shm_mode upper byte flags */
-diff -urNp linux-2.6.32.12/include/linux/slab.h linux-2.6.32.12/include/linux/slab.h
---- linux-2.6.32.12/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/slab.h	2010-04-04 20:47:28.956670452 -0400
-@@ -11,6 +11,7 @@
- 
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
- 
- /*
-  * Flags to pass to kmem_cache_create().
-@@ -82,10 +83,13 @@
-  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
-  * Both make kfree a no-op.
-  */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR				\
-+({						\
-+	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+	(void *)(-MAX_ERRNO-1L);		\
-+})
- 
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
--				(unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
- 
- /*
-  * struct kmem_cache related prototypes
-@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- /*
-  * Allocator specific definitions. These are mainly used to establish optimized
-@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
- 
- void __init kmem_cache_init_late(void);
- 
-+#define kmalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kmalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
-+#define kmalloc_node(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = kmalloc_node((size_t)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define kzalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kzalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
- #endif	/* _LINUX_SLAB_H */
-diff -urNp linux-2.6.32.12/include/linux/slub_def.h linux-2.6.32.12/include/linux/slub_def.h
---- linux-2.6.32.12/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/slub_def.h	2010-04-04 20:46:41.685762250 -0400
-@@ -86,7 +86,7 @@ struct kmem_cache {
- 	struct kmem_cache_order_objects max;
- 	struct kmem_cache_order_objects min;
- 	gfp_t allocflags;	/* gfp flags to use on each alloc */
--	int refcount;		/* Refcount for slab cache destroy */
-+	atomic_t refcount;	/* Refcount for slab cache destroy */
- 	void (*ctor)(void *);
- 	int inuse;		/* Offset to metadata */
- 	int align;		/* Alignment */
-diff -urNp linux-2.6.32.12/include/linux/sonet.h linux-2.6.32.12/include/linux/sonet.h
---- linux-2.6.32.12/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/sonet.h	2010-04-04 20:46:41.685762250 -0400
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
- 
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.12/include/linux/suspend.h linux-2.6.32.12/include/linux/suspend.h
---- linux-2.6.32.12/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/suspend.h	2010-04-04 20:46:41.685762250 -0400
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
-  *	which require special recovery actions in that situation.
-  */
- struct platform_suspend_ops {
--	int (*valid)(suspend_state_t state);
--	int (*begin)(suspend_state_t state);
--	int (*prepare)(void);
--	int (*prepare_late)(void);
--	int (*enter)(suspend_state_t state);
--	void (*wake)(void);
--	void (*finish)(void);
--	void (*end)(void);
--	void (*recover)(void);
-+	int (* const valid)(suspend_state_t state);
-+	int (* const begin)(suspend_state_t state);
-+	int (* const prepare)(void);
-+	int (* const prepare_late)(void);
-+	int (* const enter)(suspend_state_t state);
-+	void (* const wake)(void);
-+	void (* const finish)(void);
-+	void (* const end)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
-  * suspend_set_ops - set platform dependent suspend operations
-  * @ops: The new suspend operations to set.
-  */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
- 
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem	NULL
- 
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
- 
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
-  *	platforms which require special recovery actions in that situation.
-  */
- struct platform_hibernation_ops {
--	int (*begin)(void);
--	void (*end)(void);
--	int (*pre_snapshot)(void);
--	void (*finish)(void);
--	int (*prepare)(void);
--	int (*enter)(void);
--	void (*leave)(void);
--	int (*pre_restore)(void);
--	void (*restore_cleanup)(void);
--	void (*recover)(void);
-+	int (* const begin)(void);
-+	void (* const end)(void);
-+	int (* const pre_snapshot)(void);
-+	void (* const finish)(void);
-+	int (* const prepare)(void);
-+	int (* const enter)(void);
-+	void (* const leave)(void);
-+	int (* const pre_restore)(void);
-+	void (* const restore_cleanup)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
- 
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
- 
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff -urNp linux-2.6.32.12/include/linux/sysctl.h linux-2.6.32.12/include/linux/sysctl.h
---- linux-2.6.32.12/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/sysctl.h	2010-04-04 20:46:41.685762250 -0400
-@@ -164,7 +164,11 @@ enum
- 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
- 
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
-+};
-+#endif
- 
- /* CTL_VM names: */
- enum
-diff -urNp linux-2.6.32.12/include/linux/sysfs.h linux-2.6.32.12/include/linux/sysfs.h
---- linux-2.6.32.12/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/sysfs.h	2010-04-04 20:46:41.685762250 -0400
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
- 
- struct sysfs_ops {
--	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
--	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
-+	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
-+	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
- 
- struct sysfs_dirent;
-diff -urNp linux-2.6.32.12/include/linux/thread_info.h linux-2.6.32.12/include/linux/thread_info.h
---- linux-2.6.32.12/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/thread_info.h	2010-04-04 20:46:41.685762250 -0400
-@@ -23,7 +23,7 @@ struct restart_block {
- 		};
- 		/* For futex_wait and futex_wait_requeue_pi */
- 		struct {
--			u32 *uaddr;
-+			u32 __user *uaddr;
- 			u32 val;
- 			u32 flags;
- 			u32 bitset;
-diff -urNp linux-2.6.32.12/include/linux/tty.h linux-2.6.32.12/include/linux/tty.h
---- linux-2.6.32.12/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.12/include/linux/tty.h	2010-04-04 20:46:41.685762250 -0400
-@@ -13,6 +13,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_ldisc.h>
- #include <linux/mutex.h>
-+#include <linux/poll.h>
- 
- #include <asm/system.h>
- 
-@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
- extern dev_t tty_devnum(struct tty_struct *tty);
- extern void proc_clear_tty(struct task_struct *p);
- extern struct tty_struct *get_current_tty(void);
--extern void tty_default_fops(struct file_operations *fops);
- extern struct tty_struct *alloc_tty_struct(void);
- extern void free_tty_struct(struct tty_struct *tty);
- extern void initialize_tty_struct(struct tty_struct *tty,
-@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
- 
-+/* tty_io.c */
-+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
-+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
-+extern unsigned int tty_poll(struct file *, poll_table *);
-+#ifdef CONFIG_COMPAT
-+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+				unsigned long arg);
-+#else
-+#define tty_compat_ioctl NULL
-+#endif
-+extern int tty_release(struct inode *, struct file *);
-+extern int tty_fasync(int fd, struct file *filp, int on);
- 
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-diff -urNp linux-2.6.32.12/include/linux/tty_ldisc.h linux-2.6.32.12/include/linux/tty_ldisc.h
---- linux-2.6.32.12/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/tty_ldisc.h	2010-04-04 20:46:41.685762250 -0400
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
- 
- 	struct  module *owner;
- 	
--	int refcount;
-+	atomic_t refcount;
- };
- 
- struct tty_ldisc {
-diff -urNp linux-2.6.32.12/include/linux/types.h linux-2.6.32.12/include/linux/types.h
---- linux-2.6.32.12/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/types.h	2010-04-04 20:46:41.685762250 -0400
-@@ -191,10 +191,26 @@ typedef struct {
- 	volatile int counter;
- } atomic_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- 	volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
- 
- struct ustat {
-diff -urNp linux-2.6.32.12/include/linux/uaccess.h linux-2.6.32.12/include/linux/uaccess.h
---- linux-2.6.32.12/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/uaccess.h	2010-04-04 20:46:41.685762250 -0400
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
- 		long ret;				\
- 		mm_segment_t old_fs = get_fs();		\
- 							\
--		set_fs(KERNEL_DS);			\
- 		pagefault_disable();			\
-+		set_fs(KERNEL_DS);			\
- 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
--		pagefault_enable();			\
- 		set_fs(old_fs);				\
-+		pagefault_enable();			\
- 		ret;					\
- 	})
- 
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
- 
- /*
-  * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size);
- 
- #endif		/* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.32.12/include/linux/vmalloc.h linux-2.6.32.12/include/linux/vmalloc.h
---- linux-2.6.32.12/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/linux/vmalloc.h	2010-04-04 20:46:41.685762250 -0400
-@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
- #define VM_MAP		0x00000004	/* vmap()ed pages */
- #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
- #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
- 
- /*
-@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
- 
- void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
- 
-+#define vmalloc(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define __vmalloc(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = __vmalloc((unsigned long)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_user(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_user((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_exec(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_exec((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_node(x, y)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_node((unsigned long)___x, (y));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32_user(x)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32_user((unsigned long)___x);\
-+	___retval;						\
-+})
-+
- #endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.32.12/include/net/irda/ircomm_tty.h linux-2.6.32.12/include/net/irda/ircomm_tty.h
---- linux-2.6.32.12/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/net/irda/ircomm_tty.h	2010-04-04 20:46:41.685762250 -0400
-@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
-         unsigned short    close_delay;
-         unsigned short    closing_wait; /* time to wait before closing */
- 
--	int  open_count;
--	int  blocked_open;	/* # of blocked opens */
-+	atomic_t open_count;
-+	atomic_t blocked_open;	/* # of blocked opens */
- 
- 	/* Protect concurent access to :
- 	 *	o self->open_count
-diff -urNp linux-2.6.32.12/include/net/neighbour.h linux-2.6.32.12/include/net/neighbour.h
---- linux-2.6.32.12/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/net/neighbour.h	2010-04-04 20:46:41.685762250 -0400
-@@ -125,12 +125,12 @@ struct neighbour
- struct neigh_ops
- {
- 	int			family;
--	void			(*solicit)(struct neighbour *, struct sk_buff*);
--	void			(*error_report)(struct neighbour *, struct sk_buff*);
--	int			(*output)(struct sk_buff*);
--	int			(*connected_output)(struct sk_buff*);
--	int			(*hh_output)(struct sk_buff*);
--	int			(*queue_xmit)(struct sk_buff*);
-+	void			(* const solicit)(struct neighbour *, struct sk_buff*);
-+	void			(* const error_report)(struct neighbour *, struct sk_buff*);
-+	int			(* const output)(struct sk_buff*);
-+	int			(* const connected_output)(struct sk_buff*);
-+	int			(* const hh_output)(struct sk_buff*);
-+	int			(* const queue_xmit)(struct sk_buff*);
- };
- 
- struct pneigh_entry
-diff -urNp linux-2.6.32.12/include/net/sctp/sctp.h linux-2.6.32.12/include/net/sctp/sctp.h
---- linux-2.6.32.12/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/net/sctp/sctp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
- 
- #else	/* SCTP_DEBUG */
- 
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.32.12/include/net/tcp.h linux-2.6.32.12/include/net/tcp.h
---- linux-2.6.32.12/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/net/tcp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
- struct tcp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.12/include/net/udp.h linux-2.6.32.12/include/net/udp.h
---- linux-2.6.32.12/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/net/udp.h	2010-04-04 20:46:41.685762250 -0400
-@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
- 	struct udp_table	*udp_table;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.12/include/sound/ac97_codec.h linux-2.6.32.12/include/sound/ac97_codec.h
---- linux-2.6.32.12/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/sound/ac97_codec.h	2010-04-04 20:46:41.685762250 -0400
-@@ -419,15 +419,15 @@
- struct snd_ac97;
- 
- struct snd_ac97_build_ops {
--	int (*build_3d) (struct snd_ac97 *ac97);
--	int (*build_specific) (struct snd_ac97 *ac97);
--	int (*build_spdif) (struct snd_ac97 *ac97);
--	int (*build_post_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_3d) (struct snd_ac97 *ac97);
-+	int (* const build_specific) (struct snd_ac97 *ac97);
-+	int (* const build_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
--	void (*suspend) (struct snd_ac97 *ac97);
--	void (*resume) (struct snd_ac97 *ac97);
-+	void (* const suspend) (struct snd_ac97 *ac97);
-+	void (* const resume) (struct snd_ac97 *ac97);
- #endif
--	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
-+	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
- };
- 
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
- 
- struct snd_ac97 {
- 	/* -- lowlevel (hardware) driver specific -- */
--	struct snd_ac97_build_ops * build_ops;
-+	const struct snd_ac97_build_ops * build_ops;
- 	void *private_data;
- 	void (*private_free) (struct snd_ac97 *ac97);
- 	/* --- */
-diff -urNp linux-2.6.32.12/include/trace/events/irq.h linux-2.6.32.12/include/trace/events/irq.h
---- linux-2.6.32.12/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/trace/events/irq.h	2010-04-04 20:46:41.685762250 -0400
-@@ -34,7 +34,7 @@
-  */
- TRACE_EVENT(irq_handler_entry,
- 
--	TP_PROTO(int irq, struct irqaction *action),
-+	TP_PROTO(int irq, const struct irqaction *action),
- 
- 	TP_ARGS(irq, action),
- 
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
-  */
- TRACE_EVENT(irq_handler_exit,
- 
--	TP_PROTO(int irq, struct irqaction *action, int ret),
-+	TP_PROTO(int irq, const struct irqaction *action, int ret),
- 
- 	TP_ARGS(irq, action, ret),
- 
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
-  */
- TRACE_EVENT(softirq_entry,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
-  */
- TRACE_EVENT(softirq_exit,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-diff -urNp linux-2.6.32.12/include/video/uvesafb.h linux-2.6.32.12/include/video/uvesafb.h
---- linux-2.6.32.12/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/include/video/uvesafb.h	2010-04-04 20:46:41.685762250 -0400
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
- 	u8 pmi_setpal;			/* PMI for palette changes */
- 	u16 *pmi_base;			/* protected mode interface location */
-+	u8 *pmi_code;			/* protected mode code location */
- 	void *pmi_start;
- 	void *pmi_pal;
- 	u8 *vbe_state_orig;		/*
-diff -urNp linux-2.6.32.12/init/do_mounts.c linux-2.6.32.12/init/do_mounts.c
---- linux-2.6.32.12/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/do_mounts.c	2010-04-04 20:46:41.685762250 -0400
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
- 
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
--	int err = sys_mount(name, "/root", fs, flags, data);
-+	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- 	if (err)
- 		return err;
- 
--	sys_chdir("/root");
-+	sys_chdir((__force char __user *)"/root");
- 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
- 	va_start(args, fmt);
- 	vsprintf(buf, fmt, args);
- 	va_end(args);
--	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, FDEJECT, 0);
- 		sys_close(fd);
- 	}
- 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
--	fd = sys_open("/dev/console", O_RDWR, 0);
-+	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, TCGETS, (long)&termios);
- 		termios.c_lflag &= ~ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
--		sys_read(fd, &c, 1);
-+		sys_read(fd, (char __user *)&c, 1);
- 		termios.c_lflag |= ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
- 		sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- 	mount_root();
- out:
- 	devtmpfs_mount("dev");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force char __user *)".");
- }
-diff -urNp linux-2.6.32.12/init/do_mounts.h linux-2.6.32.12/init/do_mounts.h
---- linux-2.6.32.12/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/do_mounts.h	2010-04-04 20:46:41.685762250 -0400
-@@ -15,15 +15,15 @@ extern int root_mountflags;
- 
- static inline int create_dev(char *name, dev_t dev)
- {
--	sys_unlink(name);
--	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+	sys_unlink((__force char __user *)name);
-+	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
- 
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- 	struct stat64 stat;
--	if (sys_stat64(name, &stat) != 0)
-+	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
- 		return 0;
- 	if (!S_ISBLK(stat.st_mode))
- 		return 0;
-diff -urNp linux-2.6.32.12/init/do_mounts_initrd.c linux-2.6.32.12/init/do_mounts_initrd.c
---- linux-2.6.32.12/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/do_mounts_initrd.c	2010-04-04 20:46:41.685762250 -0400
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
- 	sys_close(old_fd);sys_close(root_fd);
- 	sys_close(0);sys_close(1);sys_close(2);
- 	sys_setsid();
--	(void) sys_open("/dev/console",O_RDWR,0);
-+	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- 	(void) sys_dup(0);
- 	(void) sys_dup(0);
- 	return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- 	create_dev("/dev/root.old", Root_RAM0);
- 	/* mount initrd on rootfs' /root */
- 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
--	sys_mkdir("/old", 0700);
--	root_fd = sys_open("/", 0, 0);
--	old_fd = sys_open("/old", 0, 0);
-+	sys_mkdir((__force const char __user *)"/old", 0700);
-+	root_fd = sys_open((__force const char __user *)"/", 0, 0);
-+	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
- 	/* move initrd over / and chdir/chroot in initrd root */
--	sys_chdir("/root");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_chdir((__force const char __user *)"/root");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force const char __user *)".");
- 
- 	/*
- 	 * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
- 
- 	/* move initrd to rootfs' /old */
- 	sys_fchdir(old_fd);
--	sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
- 	/* switch root and cwd back to / of rootfs */
- 	sys_fchdir(root_fd);
--	sys_chroot(".");
-+	sys_chroot((__force const char __user *)".");
- 	sys_close(old_fd);
- 	sys_close(root_fd);
- 
- 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
--		sys_chdir("/old");
-+		sys_chdir((__force const char __user *)"/old");
- 		return;
- 	}
- 
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- 	mount_root();
- 
- 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
--	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
- 	if (!error)
- 		printk("okay\n");
- 	else {
--		int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
- 		if (error == -ENOENT)
- 			printk("/initrd does not exist. Ignored.\n");
- 		else
- 			printk("failed\n");
- 		printk(KERN_NOTICE "Unmounting old root\n");
--		sys_umount("/old", MNT_DETACH);
-+		sys_umount((__force char __user *)"/old", MNT_DETACH);
- 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- 		if (fd < 0) {
- 			error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- 		 * mounted in the normal path.
- 		 */
- 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
--			sys_unlink("/initrd.image");
-+			sys_unlink((__force const char __user *)"/initrd.image");
- 			handle_initrd();
- 			return 1;
- 		}
- 	}
--	sys_unlink("/initrd.image");
-+	sys_unlink((__force const char __user *)"/initrd.image");
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/init/do_mounts_md.c linux-2.6.32.12/init/do_mounts_md.c
---- linux-2.6.32.12/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/do_mounts_md.c	2010-04-04 20:46:41.689696132 -0400
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- 			partitioned ? "_d" : "", minor,
- 			md_setup_args[ent].device_names);
- 
--		fd = sys_open(name, 0, 0);
-+		fd = sys_open((__force char __user *)name, 0, 0);
- 		if (fd < 0) {
- 			printk(KERN_ERR "md: open failed - cannot start "
- 					"array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- 			 * array without it
- 			 */
- 			sys_close(fd);
--			fd = sys_open(name, 0, 0);
-+			fd = sys_open((__force char __user *)name, 0, 0);
- 			sys_ioctl(fd, BLKRRPART, 0);
- 		}
- 		sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
- 
- 	wait_for_device_probe();
- 
--	fd = sys_open("/dev/md0", 0, 0);
-+	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- 		sys_close(fd);
-diff -urNp linux-2.6.32.12/init/initramfs.c linux-2.6.32.12/init/initramfs.c
---- linux-2.6.32.12/init/initramfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/initramfs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- 	}
- }
- 
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- 	struct timespec t[2];
- 
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- 	struct dir_entry *de, *tmp;
- 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
- 		list_del(&de->list);
--		do_utime(de->name, de->mtime);
-+		do_utime((__force char __user *)de->name, de->mtime);
- 		kfree(de->name);
- 		kfree(de);
- 	}
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- 	if (nlink >= 2) {
- 		char *old = find_link(major, minor, ino, mode, collected);
- 		if (old)
--			return (sys_link(old, collected) < 0) ? -1 : 1;
-+			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
- 	}
- 	return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path
- {
- 	struct stat st;
- 
--	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
- 		if (S_ISDIR(st.st_mode))
--			sys_rmdir(path);
-+			sys_rmdir((__force char __user *)path);
- 		else
--			sys_unlink(path);
-+			sys_unlink((__force char __user *)path);
- 	}
- }
- 
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- 			int openflags = O_WRONLY|O_CREAT;
- 			if (ml != 1)
- 				openflags |= O_TRUNC;
--			wfd = sys_open(collected, openflags, mode);
-+			wfd = sys_open((__force char __user *)collected, openflags, mode);
- 
- 			if (wfd >= 0) {
- 				sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- 			}
- 		}
- 	} else if (S_ISDIR(mode)) {
--		sys_mkdir(collected, mode);
--		sys_chown(collected, uid, gid);
--		sys_chmod(collected, mode);
-+		sys_mkdir((__force char __user *)collected, mode);
-+		sys_chown((__force char __user *)collected, uid, gid);
-+		sys_chmod((__force char __user *)collected, mode);
- 		dir_add(collected, mtime);
- 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
- 		if (maybe_link() == 0) {
--			sys_mknod(collected, mode, rdev);
--			sys_chown(collected, uid, gid);
--			sys_chmod(collected, mode);
--			do_utime(collected, mtime);
-+			sys_mknod((__force char __user *)collected, mode, rdev);
-+			sys_chown((__force char __user *)collected, uid, gid);
-+			sys_chmod((__force char __user *)collected, mode);
-+			do_utime((__force char __user *)collected, mtime);
- 		}
- 	}
- 	return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- 	if (count >= body_len) {
--		sys_write(wfd, victim, body_len);
-+		sys_write(wfd, (__force char __user *)victim, body_len);
- 		sys_close(wfd);
--		do_utime(vcollected, mtime);
-+		do_utime((__force char __user *)vcollected, mtime);
- 		kfree(vcollected);
- 		eat(body_len);
- 		state = SkipIt;
- 		return 0;
- 	} else {
--		sys_write(wfd, victim, count);
-+		sys_write(wfd, (__force char __user *)victim, count);
- 		body_len -= count;
- 		eat(count);
- 		return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- 	collected[N_ALIGN(name_len) + body_len] = '\0';
- 	clean_path(collected, 0);
--	sys_symlink(collected + N_ALIGN(name_len), collected);
--	sys_lchown(collected, uid, gid);
--	do_utime(collected, mtime);
-+	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
-+	sys_lchown((__force char __user *)collected, uid, gid);
-+	do_utime((__force char __user *)collected, mtime);
- 	state = SkipIt;
- 	next_state = Reset;
- 	return 0;
-diff -urNp linux-2.6.32.12/init/Kconfig linux-2.6.32.12/init/Kconfig
---- linux-2.6.32.12/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/Kconfig	2010-04-04 20:46:41.689696132 -0400
-@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
- 
- config COMPAT_BRK
- 	bool "Disable heap randomization"
--	default y
-+	default n
- 	help
- 	  Randomizing heap placement makes heap exploits harder, but it
- 	  also breaks ancient binaries (including anything libc5 based).
-@@ -1116,9 +1116,9 @@ config HAVE_GENERIC_DMA_COHERENT
- 
- config SLABINFO
- 	bool
--	depends on PROC_FS
-+	depends on PROC_FS && !GRKERNSEC_PROC_ADD
- 	depends on SLAB || SLUB_DEBUG
--	default y
-+	default n
- 
- config RT_MUTEXES
- 	boolean
-diff -urNp linux-2.6.32.12/init/main.c linux-2.6.32.12/init/main.c
---- linux-2.6.32.12/init/main.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.12/init/main.c	2010-04-04 20:58:33.225084964 -0400
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
- 
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
- 
- __setup("reset_devices", set_reset_devices);
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void pax_enter_kernel_user(void);
-+extern void pax_exit_kernel_user(void);
-+extern pteval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+	unsigned int cpu;
-+
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+	}
-+	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
-+#else
-+	char *p;
-+	p = (char *)pax_enter_kernel_user;
-+	*p = 0xc3;
-+	p = (char *)pax_exit_kernel_user;
-+	*p = 0xc3;
-+	clone_pgd_mask = ~(pteval_t)0UL;
-+#endif
-+
-+	return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+unsigned int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+	get_option(&str, &pax_softmode);
-+	return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -697,52 +742,53 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
- 
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
- 
- int do_one_initcall(initcall_t fn)
- {
- 	int count = preempt_count();
- 	ktime_t calltime, delta, rettime;
-+	const char *msg1 = "", *msg2 = "";
- 
- 	if (initcall_debug) {
--		call.caller = task_pid_nr(current);
--		printk("calling  %pF @ %i\n", fn, call.caller);
-+		trace_call.caller = task_pid_nr(current);
-+		printk("calling  %pF @ %i\n", fn, trace_call.caller);
- 		calltime = ktime_get();
--		trace_boot_call(&call, fn);
-+		trace_boot_call(&trace_call, fn);
- 		enable_boot_trace();
- 	}
- 
--	ret.result = fn();
-+	trace_ret.result = fn();
- 
- 	if (initcall_debug) {
- 		disable_boot_trace();
- 		rettime = ktime_get();
- 		delta = ktime_sub(rettime, calltime);
--		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
--		trace_boot_ret(&ret, fn);
-+		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+		trace_boot_ret(&trace_ret, fn);
- 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
--			ret.result, ret.duration);
-+			trace_ret.result, trace_ret.duration);
- 	}
- 
- 	msgbuf[0] = 0;
- 
--	if (ret.result && ret.result != -ENODEV && initcall_debug)
--		sprintf(msgbuf, "error code %d ", ret.result);
-+	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+		sprintf(msgbuf, "error code %d ", trace_ret.result);
- 
- 	if (preempt_count() != count) {
--		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+		msg1 = " preemption imbalance";
- 		preempt_count() = count;
- 	}
- 	if (irqs_disabled()) {
--		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+		msg2 = " disabled interrupts";
- 		local_irq_enable();
- 	}
--	if (msgbuf[0]) {
--		printk("initcall %pF returned with %s\n", fn, msgbuf);
-+	if (msgbuf[0] || *msg1 || *msg2) {
-+		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- 	}
- 
--	return ret.result;
-+	return trace_ret.result;
- }
- 
- 
-@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
- 	if (!ramdisk_execute_command)
- 		ramdisk_execute_command = "/init";
- 
--	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
- 		ramdisk_execute_command = NULL;
- 		prepare_namespace();
- 	}
- 
-+	grsecurity_init();
-+
- 	/*
- 	 * Ok, we have completed the initial bootup, and
- 	 * we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.32.12/init/noinitramfs.c linux-2.6.32.12/init/noinitramfs.c
---- linux-2.6.32.12/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/init/noinitramfs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- 	int err;
- 
--	err = sys_mkdir("/dev", 0755);
-+	err = sys_mkdir((const char __user *)"/dev", 0755);
- 	if (err < 0)
- 		goto out;
- 
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- 	if (err < 0)
- 		goto out;
- 
--	err = sys_mkdir("/root", 0700);
-+	err = sys_mkdir((const char __user *)"/root", 0700);
- 	if (err < 0)
- 		goto out;
- 
-diff -urNp linux-2.6.32.12/ipc/ipc_sysctl.c linux-2.6.32.12/ipc/ipc_sysctl.c
---- linux-2.6.32.12/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/ipc/ipc_sysctl.c	2010-04-04 20:46:41.689696132 -0400
-@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
- 		.extra1		= &zero,
- 		.extra2		= &one,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table ipc_root_table[] = {
-@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
- 		.mode		= 0555,
- 		.child		= ipc_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init ipc_sysctl_init(void)
-diff -urNp linux-2.6.32.12/ipc/mqueue.c linux-2.6.32.12/ipc/mqueue.c
---- linux-2.6.32.12/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.12/ipc/mqueue.c	2010-04-04 20:46:41.689696132 -0400
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
- 			mq_bytes = (mq_msg_tblsz +
- 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
- 
-+			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- 			spin_lock(&mq_lock);
- 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- 		 	    u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.32.12/ipc/shm.c linux-2.6.32.12/ipc/shm.c
---- linux-2.6.32.12/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/ipc/shm.c	2010-04-04 20:46:41.689696132 -0400
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime, const uid_t cuid,
-+			   const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- 	ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
- 	shp->shm_lprid = 0;
- 	shp->shm_atim = shp->shm_dtim = 0;
- 	shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+	{
-+		struct timespec timeval;
-+		do_posix_clock_monotonic_gettime(&timeval);
-+
-+		shp->shm_createtime = timeval.tv_sec;
-+	}
-+#endif
- 	shp->shm_segsz = size;
- 	shp->shm_nattch = 0;
- 	shp->shm_file = file;
-@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
- 	if (err)
- 		goto out_unlock;
- 
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+			     shp->shm_perm.cuid, shmid) ||
-+	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+		err = -EACCES;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	path.dentry = dget(shp->shm_file->f_path.dentry);
- 	path.mnt    = shp->shm_file->f_path.mnt;
- 	shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+	shp->shm_lapid = current->pid;
-+#endif
- 	size = i_size_read(path.dentry->d_inode);
- 	shm_unlock(shp);
- 
-diff -urNp linux-2.6.32.12/kernel/acct.c linux-2.6.32.12/kernel/acct.c
---- linux-2.6.32.12/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/acct.c	2010-04-04 20:46:41.689696132 -0400
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
- 	 */
- 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
--	file->f_op->write(file, (char *)&ac,
-+	file->f_op->write(file, (__force char __user *)&ac,
- 			       sizeof(acct_t), &file->f_pos);
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- 	set_fs(fs);
-diff -urNp linux-2.6.32.12/kernel/capability.c linux-2.6.32.12/kernel/capability.c
---- linux-2.6.32.12/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/capability.c	2010-04-04 20:46:41.689696132 -0400
-@@ -306,10 +306,21 @@ int capable(int cap)
- 		BUG();
- 	}
- 
--	if (security_capable(cap) == 0) {
-+	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- 		current->flags |= PF_SUPERPRIV;
- 		return 1;
- 	}
- 	return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
-+		current->flags |= PF_SUPERPRIV;
-+		return 1;
-+	}
-+	return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.32.12/kernel/configs.c linux-2.6.32.12/kernel/configs.c
---- linux-2.6.32.12/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/configs.c	2010-04-04 20:46:41.689696132 -0400
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- 	struct proc_dir_entry *entry;
- 
- 	/* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+			    &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+			    &ikconfig_file_ops);
-+#endif
-+#else
- 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- 			    &ikconfig_file_ops);
-+#endif
-+
- 	if (!entry)
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.12/kernel/cpu.c linux-2.6.32.12/kernel/cpu.c
---- linux-2.6.32.12/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/cpu.c	2010-04-04 20:46:41.689696132 -0400
-@@ -19,7 +19,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
- 
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
- 
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
-  * Should always be manipulated under cpu_add_remove_lock
-diff -urNp linux-2.6.32.12/kernel/cred.c linux-2.6.32.12/kernel/cred.c
---- linux-2.6.32.12/kernel/cred.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/cred.c	2010-04-04 20:46:41.689696132 -0400
-@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
- 
- 	get_cred(new); /* we will require a ref for the subj creds too */
- 
-+	gr_set_role_label(task, new->uid, new->gid);
-+
- 	/* dumpability changes */
- 	if (old->euid != new->euid ||
- 	    old->egid != new->egid ||
-diff -urNp linux-2.6.32.12/kernel/exit.c linux-2.6.32.12/kernel/exit.c
---- linux-2.6.32.12/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/exit.c	2010-04-04 20:46:41.689696132 -0400
-@@ -56,6 +56,10 @@
- #include <asm/mmu_context.h>
- #include "cred-internals.h"
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern rwlock_t grsec_exec_file_lock;
-+#endif
-+
- static void exit_mm(struct task_struct * tsk);
- 
- static void __unhash_process(struct task_struct *p)
-@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
- 	struct task_struct *leader;
- 	int zap_leader;
- repeat:
-+	gr_del_task_from_ip_table(p);
-+
- 	tracehook_prepare_release_task(p);
- 	/* don't need to get the RCU readlock here - the process is dead and
- 	 * can't be modifying its own credentials */
-@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
- {
- 	write_lock_irq(&tasklist_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
- 	ptrace_unlink(current);
- 	/* Reparent to init */
- 	current->real_parent = current->parent = kthreadd_task;
- 	list_move_tail(&current->sibling, &current->real_parent->children);
- 
-+	gr_set_kernel_label(current);
-+
- 	/* Set the exit signal to SIGCHLD so we signal init on exit */
- 	current->exit_signal = SIGCHLD;
- 
-@@ -390,7 +407,7 @@ int allow_signal(int sig)
- 	 * know it'll be handled, so that they don't get converted to
- 	 * SIGKILL or just silently dropped.
- 	 */
--	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- 	recalc_sigpending();
- 	spin_unlock_irq(&current->sighand->siglock);
- 	return 0;
-@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
- 	vsnprintf(current->comm, sizeof(current->comm), name, args);
- 	va_end(args);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
-+	gr_set_kernel_label(current);
-+
- 	/*
- 	 * If we were started as result of loading a module, close all of the
- 	 * user space pages.  We don't need them, and if we didn't close them
-@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
- 	tsk->exit_code = code;
- 	taskstats_exit(tsk, group_dead);
- 
-+	gr_acl_handle_psacct(tsk, code);
-+	gr_acl_handle_exit();
-+
- 	exit_mm(tsk);
- 
- 	if (group_dead)
-@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
- 
- 	if (unlikely(wo->wo_flags & WNOWAIT)) {
- 		int exit_code = p->exit_code;
--		int why, status;
-+		int why;
- 
- 		get_task_struct(p);
- 		read_unlock(&tasklist_lock);
-diff -urNp linux-2.6.32.12/kernel/fork.c linux-2.6.32.12/kernel/fork.c
---- linux-2.6.32.12/kernel/fork.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/fork.c	2010-04-04 20:46:41.689696132 -0400
-@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
- 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
- 
- #ifdef CONFIG_CC_STACKPROTECTOR
--	tsk->stack_canary = get_random_int();
-+	tsk->stack_canary = pax_get_random_long();
- #endif
- 
- 	/* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
- 	mm->locked_vm = 0;
- 	mm->mmap = NULL;
- 	mm->mmap_cache = NULL;
--	mm->free_area_cache = oldmm->mmap_base;
--	mm->cached_hole_size = ~0UL;
-+	mm->free_area_cache = oldmm->free_area_cache;
-+	mm->cached_hole_size = oldmm->cached_hole_size;
- 	mm->map_count = 0;
- 	cpumask_clear(mm_cpumask(mm));
- 	mm->mm_rb = RB_ROOT;
-@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
- 		tmp->vm_flags &= ~VM_LOCKED;
- 		tmp->vm_mm = mm;
- 		tmp->vm_next = NULL;
-+		tmp->vm_mirror = NULL;
- 		anon_vma_link(tmp);
- 		file = tmp->vm_file;
- 		if (file) {
-@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
- 		if (retval)
- 			goto out;
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+		struct vm_area_struct *mpnt_m;
-+
-+		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+			if (!mpnt->vm_mirror)
-+				continue;
-+
-+			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+				mpnt->vm_mirror = mpnt_m;
-+			} else {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+				mpnt->vm_mirror->vm_mirror = mpnt;
-+			}
-+		}
-+		BUG_ON(mpnt_m);
-+	}
-+#endif
-+
- 	/* a new mm has just been created */
- 	arch_dup_mmap(oldmm, mm);
- 	retval = 0;
-@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
- 			write_unlock(&fs->lock);
- 			return -EAGAIN;
- 		}
--		fs->users++;
-+		atomic_inc(&fs->users);
- 		write_unlock(&fs->lock);
- 		return 0;
- 	}
-@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
- 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- 	retval = -EAGAIN;
-+
-+	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- 	if (atomic_read(&p->real_cred->user->processes) >=
- 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
--		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
--		    p->real_cred->user != INIT_USER)
-+		if (p->real_cred->user != INIT_USER &&
-+		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- 			goto bad_fork_free;
- 	}
- 
-@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
- 	p->vfork_done = NULL;
- 	spin_lock_init(&p->alloc_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	rwlock_init(&p->gr_fs_lock);
-+#endif
-+
- 	init_sigpending(&p->pending);
- 
- 	p->utime = cputime_zero;
-@@ -1179,6 +1212,8 @@ static struct task_struct *copy_process(
- 			goto bad_fork_free_pid;
- 	}
- 
-+	gr_copy_label(p);
-+
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1344,6 +1379,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- 	free_task(p);
- fork_out:
-+	gr_log_forkfail(retval);
-+
- 	return ERR_PTR(retval);
- }
- 
-@@ -1437,6 +1474,8 @@ long do_fork(unsigned long clone_flags,
- 		if (clone_flags & CLONE_PARENT_SETTID)
- 			put_user(nr, parent_tidptr);
- 
-+		gr_handle_brute_check();
-+
- 		if (clone_flags & CLONE_VFORK) {
- 			p->vfork_done = &vfork;
- 			init_completion(&vfork);
-@@ -1569,7 +1608,7 @@ static int unshare_fs(unsigned long unsh
- 		return 0;
- 
- 	/* don't need lock here; in the worst case we'll do useless copy */
--	if (fs->users == 1)
-+	if (atomic_read(&fs->users) == 1)
- 		return 0;
- 
- 	*new_fsp = copy_fs_struct(fs);
-@@ -1689,14 +1728,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
- 		task_lock(current);
- 
- 		if (new_fs) {
-+			unsigned long flags;
-+
-+			gr_fs_write_lock_irqsave(current, flags);
- 			fs = current->fs;
- 			write_lock(&fs->lock);
- 			current->fs = new_fs;
--			if (--fs->users)
-+			if (atomic_dec_return(&fs->users))
- 				new_fs = NULL;
- 			else
- 				new_fs = fs;
- 			write_unlock(&fs->lock);
-+			gr_fs_write_unlock_irqrestore(current, flags);
- 		}
- 
- 		if (new_mm) {
-diff -urNp linux-2.6.32.12/kernel/futex.c linux-2.6.32.12/kernel/futex.c
---- linux-2.6.32.12/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/futex.c	2010-04-04 20:46:41.689696132 -0400
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
- 	struct page *page;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+		return -EFAULT;
-+#endif
-+
- 	/*
- 	 * The futex address must be "naturally" aligned.
- 	 */
-@@ -1852,7 +1858,7 @@ retry:
- 
- 	restart = &current_thread_info()->restart_block;
- 	restart->fn = futex_wait_restart;
--	restart->futex.uaddr = (u32 *)uaddr;
-+	restart->futex.uaddr = uaddr;
- 	restart->futex.val = val;
- 	restart->futex.time = abs_time->tv64;
- 	restart->futex.bitset = bitset;
-@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- {
- 	struct robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *cred = current_cred();
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->robust_list;
- 		rcu_read_unlock();
- 	}
-@@ -2467,7 +2481,7 @@ retry:
-  */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- 				     struct robust_list __user * __user *head,
--				     int *pi)
-+				     unsigned int *pi)
- {
- 	unsigned long uentry;
- 
-diff -urNp linux-2.6.32.12/kernel/futex_compat.c linux-2.6.32.12/kernel/futex_compat.c
---- linux-2.6.32.12/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/futex_compat.c	2010-04-04 20:46:41.693491350 -0400
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
- {
- 	struct compat_robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+	const struct cred *cred = current_cred();
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->compat_robust_list;
- 		read_unlock(&tasklist_lock);
- 	}
-diff -urNp linux-2.6.32.12/kernel/gcov/base.c linux-2.6.32.12/kernel/gcov/base.c
---- linux-2.6.32.12/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/gcov/base.c	2010-04-04 20:46:41.693491350 -0400
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
- 
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
--	return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- 				void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
- 	prev = NULL;
- 	/* Remove entries located in module from linked list. */
- 	for (info = gcov_info_head; info; info = info->next) {
--		if (within(info, mod->module_core, mod->core_size)) {
-+		if (within_module_core_rw((unsigned long)info, mod)) {
- 			if (prev)
- 				prev->next = info->next;
- 			else
-diff -urNp linux-2.6.32.12/kernel/hrtimer.c linux-2.6.32.12/kernel/hrtimer.c
---- linux-2.6.32.12/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
-+++ linux-2.6.32.12/kernel/hrtimer.c	2010-04-04 20:46:41.693491350 -0400
-@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
- 	local_irq_restore(flags);
- }
- 
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- 	hrtimer_peek_ahead_timers();
- }
-diff -urNp linux-2.6.32.12/kernel/kallsyms.c linux-2.6.32.12/kernel/kallsyms.c
---- linux-2.6.32.12/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/kallsyms.c	2010-04-06 22:21:53.692294722 -0400
-@@ -11,6 +11,9 @@
-  *      Changed the compression method from stem compression to "table lookup"
-  *      compression (see scripts/kallsyms.c for a more complete description)
-  */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
- 
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+	if (system_state != SYSTEM_BOOTING)
-+		return 0;
-+
- 	if (addr >= (unsigned long)_sinittext
- 	    && addr <= (unsigned long)_einittext)
- 		return 1;
-@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
- 
- static inline int is_kernel(unsigned long addr)
- {
-+	if (is_kernel_inittext(addr))
-+		return 1;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
-+		return 0;
-+#endif
-+
-+	if (is_kernel_text(addr))
-+		return 1;
-+
-+	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
-+		return 1;
-+
-+	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
-+		return 1;
-+	return in_gate_area_no_task(addr);
-+#endif
-+
- 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
- 		return 1;
- 	return in_gate_area_no_task(addr);
-@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
- 
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
--	iter->name[0] = '\0';
- 	iter->nameoff = get_symbol_offset(new_pos);
- 	iter->pos = new_pos;
- }
-@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
- {
- 	struct kallsym_iter *iter = m->private;
- 
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	if (current_uid())
-+		return 0;
-+#endif
-+
- 	/* Some debugging symbols have no name.  Ignore them. */
- 	if (!iter->name[0])
- 		return 0;
-@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
- 	struct kallsym_iter *iter;
- 	int ret;
- 
--	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- 	if (!iter)
- 		return -ENOMEM;
- 	reset_iter(iter, 0);
-diff -urNp linux-2.6.32.12/kernel/kgdb.c linux-2.6.32.12/kernel/kgdb.c
---- linux-2.6.32.12/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/kgdb.c	2010-04-04 20:46:41.693491350 -0400
-@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int			exception_level;
- 
--static struct kgdb_io		*kgdb_io_ops;
-+static const struct kgdb_io	*kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
- 
- /* kgdb console driver is loaded */
-@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
-  *
-  *	Register it with the KGDB core.
-  */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- 	int err;
- 
-@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
-  *
-  *	Unregister it with the KGDB core.
-  */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- 	BUG_ON(kgdb_connected);
- 
-diff -urNp linux-2.6.32.12/kernel/kmod.c linux-2.6.32.12/kernel/kmod.c
---- linux-2.6.32.12/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/kmod.c	2010-04-04 20:46:41.693491350 -0400
-@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
- 	if (ret >= MODULE_NAME_LEN)
- 		return -ENAMETOOLONG;
- 
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+	/* we could do a tighter check here, but some distros
-+	   are taking it upon themselves to remove CAP_SYS_MODULE
-+	   from even root-running apps which cause modules to be 
-+	   auto-loaded
-+	*/
-+	if (current_uid()) {
-+		gr_log_nonroot_mod_load(module_name);
-+		return -EPERM;
-+	}
-+#endif
-+
- 	/* If modprobe needs a service that is in a module, we get a recursive
- 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
- 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
-diff -urNp linux-2.6.32.12/kernel/kprobes.c linux-2.6.32.12/kernel/kprobes.c
---- linux-2.6.32.12/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/kprobes.c	2010-04-29 17:46:36.959467563 -0400
-@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
- 	 * kernel image and loaded module images reside. This is required
- 	 * so x86_64 can correctly handle the %rip-relative fixups.
- 	 */
--	kip->insns = module_alloc(PAGE_SIZE);
-+	kip->insns = module_alloc_exec(PAGE_SIZE);
- 	if (!kip->insns) {
- 		kfree(kip);
- 		return NULL;
-@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
- 		 */
- 		if (!list_is_singular(&kprobe_insn_pages)) {
- 			list_del(&kip->list);
--			module_free(NULL, kip->insns);
-+			module_free_exec(NULL, kip->insns);
- 			kfree(kip);
- 		}
- 		return 1;
-@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
- {
- 	int i, err = 0;
- 	unsigned long offset = 0, size = 0;
--	char *modname, namebuf[128];
-+	char *modname, namebuf[KSYM_NAME_LEN];
- 	const char *symbol_name;
- 	void *addr;
- 	struct kprobe_blackpoint *kb;
-@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
- 	const char *sym = NULL;
- 	unsigned int i = *(loff_t *) v;
- 	unsigned long offset = 0;
--	char *modname, namebuf[128];
-+	char *modname, namebuf[KSYM_NAME_LEN];
- 
- 	head = &kprobe_table[i];
- 	preempt_disable();
-diff -urNp linux-2.6.32.12/kernel/lockdep.c linux-2.6.32.12/kernel/lockdep.c
---- linux-2.6.32.12/kernel/lockdep.c	2010-04-29 17:49:38.578001941 -0400
-+++ linux-2.6.32.12/kernel/lockdep.c	2010-04-29 18:02:39.221319476 -0400
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- 	int i;
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	start = ktla_ktva(start);
-+#endif
-+
- 	/*
- 	 * static variable?
- 	 */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- 	 */
- 	for_each_possible_cpu(i) {
- 		start = (unsigned long) per_cpu_ptr(&__per_cpu_start, i);
--		end   = (unsigned long) per_cpu_ptr(&__per_cpu_start, i)
--					+ PERCPU_ENOUGH_ROOM;
-+		end   = start + PERCPU_ENOUGH_ROOM;
- 
- 		if ((addr >= start) && (addr < end))
- 			return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
- 	if (!static_obj(lock->key)) {
- 		debug_locks_off();
- 		printk("INFO: trying to register non-static key.\n");
-+		printk("lock:%pS key:%pS.\n", lock, lock->key);
- 		printk("the code is fine but needs lockdep annotation.\n");
- 		printk("turning off the locking correctness validator.\n");
- 		dump_stack();
-diff -urNp linux-2.6.32.12/kernel/lockdep_proc.c linux-2.6.32.12/kernel/lockdep_proc.c
---- linux-2.6.32.12/kernel/lockdep_proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/lockdep_proc.c	2010-04-29 17:46:37.305259446 -0400
-@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
- 
- static void print_name(struct seq_file *m, struct lock_class *class)
- {
--	char str[128];
-+	char str[KSYM_NAME_LEN];
- 	const char *name = class->name;
- 
- 	if (!name) {
-diff -urNp linux-2.6.32.12/kernel/module.c linux-2.6.32.12/kernel/module.c
---- linux-2.6.32.12/kernel/module.c	2010-04-29 17:49:38.586002480 -0400
-+++ linux-2.6.32.12/kernel/module.c	2010-04-29 17:49:58.693515313 -0400
-@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
- 
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
- 
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
- 		return true;
- 
- 	list_for_each_entry_rcu(mod, &modules, list) {
--		struct symsearch arr[] = {
-+		struct symsearch modarr[] = {
- 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
- 			  NOT_GPL_ONLY, false },
- 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
- #endif
- 		};
- 
--		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- 			return true;
- 	}
- 	return false;
-@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
- 	void *ptr;
- 	int cpu;
- 
--	if (align > PAGE_SIZE) {
-+	if (align-1 >= PAGE_SIZE) {
- 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- 		       name, align, PAGE_SIZE);
- 		align = PAGE_SIZE;
-@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
- 	destroy_params(mod->kp, mod->num_kp);
- 
- 	/* This may be NULL, but that's OK */
--	module_free(mod, mod->module_init);
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
- 	kfree(mod->args);
- 	if (mod->percpu)
- 		percpu_modfree(mod->percpu);
-@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
- 		percpu_modfree(mod->refptr);
- #endif
- 	/* Free lock-classes: */
--	lockdep_free_key_range(mod->module_core, mod->core_size);
-+	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
- 
- 	/* Finally, free the core (containing the module structure) */
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_core_rx);
-+	module_free(mod, mod->module_core_rw);
- 
- #ifdef CONFIG_MPU
- 	update_protections(current->mm);
-@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
- 					      strtab + sym[i].st_name, mod);
- 			/* Ok if resolved.  */
- 			if (ksym) {
-+				pax_open_kernel();
- 				sym[i].st_value = ksym->value;
-+				pax_close_kernel();
- 				break;
- 			}
- 
-@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
- 				secbase = (unsigned long)mod->percpu;
- 			else
- 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+			pax_open_kernel();
- 			sym[i].st_value += secbase;
-+			pax_close_kernel();
- 			break;
- 		}
- 	}
-@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->core_text_size = mod->core_size;
- 	}
- 
- 	DEBUGP("Init section allocation order:\n");
-@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || !strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
--					 | INIT_OFFSET_MASK);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+			s->sh_entsize |= INIT_OFFSET_MASK;
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->init_text_size = mod->init_size;
- 	}
- }
- 
-@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
- 
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
--		     Elf_Shdr *sechdrs,
--		     const char *secstrings,
--		     struct module *mod)
-+		     const Elf_Shdr *sechdrs,
-+		     const char *secstrings)
- {
- 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
- 
- 	/* Put symbol section at end of init part of module. */
- 	symsect->sh_flags |= SHF_ALLOC;
--	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- 					 symindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
- 
-@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
- 		}
- 
- 	/* Append room for core symbols at end of core part. */
--	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
--	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
- 
- 	/* Put string table section at end of init part of module. */
- 	strsect->sh_flags |= SHF_ALLOC;
--	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- 					 strindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
- 
- 	/* Append room for core symbols' strings at end of core part. */
--	*pstroffs = mod->core_size;
-+	*pstroffs = mod->core_size_rx;
- 	__set_bit(0, strmap);
--	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
- 
- 	return symoffs;
- }
-@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
- 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
- 
-+	pax_open_kernel();
-+
- 	/* Set types up while we still have access to sections. */
- 	for (i = 0; i < mod->num_symtab; i++)
- 		mod->symtab[i].st_info
--			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+			= elf_type(&mod->symtab[i], sechdrs, secstrings);
- 
--	mod->core_symtab = dst = mod->module_core + symoffs;
-+	mod->core_symtab = dst = mod->module_core_rx + symoffs;
- 	src = mod->symtab;
- 	*dst = *src;
- 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
- 	}
- 	mod->core_num_syms = ndst;
- 
--	mod->core_strtab = s = mod->module_core + stroffs;
-+	mod->core_strtab = s = mod->module_core_rx + stroffs;
- 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- 		if (test_bit(i, strmap))
- 			*++s = mod->strtab[i];
-+
-+	pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
- #endif
- }
- 
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- 	void *ret = module_alloc(size);
- 
- 	if (ret) {
- 		/* Update module bounds. */
--		if ((unsigned long)ret < module_addr_min)
--			module_addr_min = (unsigned long)ret;
--		if ((unsigned long)ret + size > module_addr_max)
--			module_addr_max = (unsigned long)ret + size;
-+		if ((unsigned long)ret < module_addr_min_rw)
-+			module_addr_min_rw = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rw)
-+			module_addr_max_rw = (unsigned long)ret + size;
-+	}
-+	return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+	void *ret = module_alloc_exec(size);
-+
-+	if (ret) {
-+		/* Update module bounds. */
-+		if ((unsigned long)ret < module_addr_min_rx)
-+			module_addr_min_rx = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rx)
-+			module_addr_max_rx = (unsigned long)ret + size;
- 	}
- 	return ret;
- }
-@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
- 	unsigned int i;
- 
- 	/* only scan the sections containing data */
--	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
--			   (unsigned long)mod->module_core,
-+	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+			   (unsigned long)mod->module_core_rw,
- 			   sizeof(struct module), GFP_KERNEL);
- 
- 	for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
- 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- 			continue;
- 
--		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
--				   (unsigned long)mod->module_core,
-+		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+				   (unsigned long)mod->module_core_rw,
- 				   sechdrs[i].sh_size, GFP_KERNEL);
- 	}
- }
-@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
- 				secstrings, &stroffs, strmap);
- 
- 	/* Do the allocs. */
--	ptr = module_alloc_update_bounds(mod->core_size);
-+	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. Just mark it as not being a
-@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
- 		err = -ENOMEM;
- 		goto free_percpu;
- 	}
--	memset(ptr, 0, mod->core_size);
--	mod->module_core = ptr;
-+	memset(ptr, 0, mod->core_size_rw);
-+	mod->module_core_rw = ptr;
- 
--	ptr = module_alloc_update_bounds(mod->init_size);
-+	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. This block doesn't need to be
- 	 * scanned as it contains data and code that will be freed
- 	 * after the module is initialized.
- 	 */
--	kmemleak_ignore(ptr);
--	if (!ptr && mod->init_size) {
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rw) {
-+		err = -ENOMEM;
-+		goto free_core_rw;
-+	}
-+	memset(ptr, 0, mod->init_size_rw);
-+	mod->module_init_rw = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr) {
- 		err = -ENOMEM;
--		goto free_core;
-+		goto free_init_rw;
- 	}
--	memset(ptr, 0, mod->init_size);
--	mod->module_init = ptr;
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->core_size_rx);
-+	pax_close_kernel();
-+	mod->module_core_rx = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rx) {
-+		err = -ENOMEM;
-+		goto free_core_rx;
-+	}
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->init_size_rx);
-+	pax_close_kernel();
-+	mod->module_init_rx = ptr;
- 
- 	/* Transfer each section which specifies SHF_ALLOC */
- 	DEBUGP("final section addresses:\n");
-@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
- 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- 			continue;
- 
--		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
--			dest = mod->module_init
--				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
--		else
--			dest = mod->module_core + sechdrs[i].sh_entsize;
-+		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_init_rw
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+			else
-+				dest = mod->module_init_rx
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+		} else {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+			else
-+				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+		}
-+
-+		if (sechdrs[i].sh_type != SHT_NOBITS) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+				pax_open_kernel();
-+				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+				pax_close_kernel();
-+			} else
-+#endif
- 
--		if (sechdrs[i].sh_type != SHT_NOBITS)
--			memcpy(dest, (void *)sechdrs[i].sh_addr,
--			       sechdrs[i].sh_size);
-+			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+		}
- 		/* Update sh_addr to point to copy in image. */
--		sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+		else
-+#endif
-+
-+			sechdrs[i].sh_addr = (unsigned long)dest;
- 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- 	}
- 	/* Module has been moved. */
-@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
- 				      mod->name);
- 	if (!mod->refptr) {
- 		err = -ENOMEM;
--		goto free_init;
-+		goto free_init_rx;
- 	}
- #endif
- 	/* Now we've moved module, initialize linked lists, etc. */
-@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
- 
- 	/* Now do relocations. */
- 	for (i = 1; i < hdr->e_shnum; i++) {
--		const char *strtab = (char *)sechdrs[strindex].sh_addr;
- 		unsigned int info = sechdrs[i].sh_info;
-+		strtab = (char *)sechdrs[strindex].sh_addr;
- 
- 		/* Not a valid relocation section? */
- 		if (info >= hdr->e_shnum)
-@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
- 	 * Do it before processing of module parameters, so the module
- 	 * can provide parameter accessor functions of its own.
- 	 */
--	if (mod->module_init)
--		flush_icache_range((unsigned long)mod->module_init,
--				   (unsigned long)mod->module_init
--				   + mod->init_size);
--	flush_icache_range((unsigned long)mod->module_core,
--			   (unsigned long)mod->module_core + mod->core_size);
-+	if (mod->module_init_rx)
-+		flush_icache_range((unsigned long)mod->module_init_rx,
-+				   (unsigned long)mod->module_init_rx
-+				   + mod->init_size_rx);
-+	flush_icache_range((unsigned long)mod->module_core_rx,
-+			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
- 
- 	set_fs(old_fs);
- 
-@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
-  free_unload:
- 	module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- 	percpu_modfree(mod->refptr);
-- free_init:
- #endif
--	module_free(mod, mod->module_init);
-- free_core:
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+	module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+	module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+	module_free(mod, mod->module_core_rw);
- 	/* mod will be freed with core. Don't access it beyond this line! */
-  free_percpu:
- 	if (percpu)
-@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
- 	mod->symtab = mod->core_symtab;
- 	mod->strtab = mod->core_strtab;
- #endif
--	module_free(mod, mod->module_init);
--	mod->module_init = NULL;
--	mod->init_size = 0;
--	mod->init_text_size = 0;
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
-+	mod->module_init_rw = NULL;
-+	mod->module_init_rx = NULL;
-+	mod->init_size_rw = 0;
-+	mod->init_size_rx = 0;
- 	mutex_unlock(&module_mutex);
- 
- 	return 0;
-@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
- 	unsigned long nextval;
- 
- 	/* At worse, next value is at end of module */
--	if (within_module_init(addr, mod))
--		nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+	if (within_module_init_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+	else if (within_module_init_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+	else if (within_module_core_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+	else if (within_module_core_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- 	else
--		nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+		return NULL;
- 
- 	/* Scan for closest preceeding symbol, and next symbol. (ELF
- 	   starts real symbols at 1). */
-@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
- 	char buf[8];
- 
- 	seq_printf(m, "%s %u",
--		   mod->name, mod->init_size + mod->core_size);
-+		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- 	print_unload_info(m, mod);
- 
- 	/* Informative for users. */
-@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
- 		   mod->state == MODULE_STATE_COMING ? "Loading":
- 		   "Live");
- 	/* Used by oprofile and other similar tools. */
--	seq_printf(m, " 0x%p", mod->module_core);
-+	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
- 
- 	/* Taints info */
- 	if (mod->taints)
-@@ -2979,7 +3066,17 @@ static const struct file_operations proc
- 
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- 	proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_modules_init);
-@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
- {
- 	struct module *mod;
- 
--	if (addr < module_addr_min || addr > module_addr_max)
-+	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
- 		return NULL;
- 
- 	list_for_each_entry_rcu(mod, &modules, list)
--		if (within_module_core(addr, mod)
--		    || within_module_init(addr, mod))
-+		if (within_module_init(addr, mod) || within_module_core(addr, mod))
- 			return mod;
- 	return NULL;
- }
-@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
-  */
- struct module *__module_text_address(unsigned long addr)
- {
--	struct module *mod = __module_address(addr);
-+	struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+	addr = ktla_ktva(addr);
-+#endif
-+
-+	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+		return NULL;
-+
-+	mod = __module_address(addr);
-+
- 	if (mod) {
- 		/* Make sure it's within the text section. */
--		if (!within(addr, mod->module_init, mod->init_text_size)
--		    && !within(addr, mod->module_core, mod->core_text_size))
-+		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- 			mod = NULL;
- 	}
- 	return mod;
-diff -urNp linux-2.6.32.12/kernel/panic.c linux-2.6.32.12/kernel/panic.c
---- linux-2.6.32.12/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/panic.c	2010-04-04 20:46:41.693491350 -0400
-@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
-  */
- void __stack_chk_fail(void)
- {
--	panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+	dump_stack();
-+	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
- 		__builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.32.12/kernel/params.c linux-2.6.32.12/kernel/params.c
---- linux-2.6.32.12/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/params.c	2010-04-04 20:46:41.693491350 -0400
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- 	.show = module_attr_show,
- 	.store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.12/kernel/pid.c linux-2.6.32.12/kernel/pid.c
---- linux-2.6.32.12/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/pid.c	2010-04-04 20:46:41.693491350 -0400
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
- 
- int pid_max = PID_MAX_DEFAULT;
- 
--#define RESERVED_PIDS		300
-+#define RESERVED_PIDS		500
- 
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
-  */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
--	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+	struct task_struct *task;
-+	
-+	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+	if (gr_pid_is_chrooted(task))
-+		return NULL;
-+
-+	return task;
- }
- 
- struct task_struct *find_task_by_vpid(pid_t vnr)
-diff -urNp linux-2.6.32.12/kernel/posix-cpu-timers.c linux-2.6.32.12/kernel/posix-cpu-timers.c
---- linux-2.6.32.12/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/posix-cpu-timers.c	2010-04-04 20:46:41.697788265 -0400
-@@ -6,6 +6,7 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
- 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
- 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-diff -urNp linux-2.6.32.12/kernel/power/hibernate.c linux-2.6.32.12/kernel/power/hibernate.c
---- linux-2.6.32.12/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/power/hibernate.c	2010-04-04 20:46:41.697788265 -0400
-@@ -48,14 +48,14 @@ enum {
- 
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
- 
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
- 
- /**
-  * hibernation_set_ops - set the global hibernate operations
-  * @ops: the hibernation operations to use in subsequent hibernation transitions
-  */
- 
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
- 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff -urNp linux-2.6.32.12/kernel/power/poweroff.c linux-2.6.32.12/kernel/power/poweroff.c
---- linux-2.6.32.12/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/power/poweroff.c	2010-04-04 20:46:41.697788265 -0400
-@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
- 	.enable_mask	= SYSRQ_ENABLE_BOOT,
- };
- 
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- 	register_sysrq_key('o', &sysrq_poweroff_op);
- 	return 0;
-diff -urNp linux-2.6.32.12/kernel/power/process.c linux-2.6.32.12/kernel/power/process.c
---- linux-2.6.32.12/kernel/power/process.c	2010-04-29 17:49:38.590000225 -0400
-+++ linux-2.6.32.12/kernel/power/process.c	2010-04-29 17:49:58.697130575 -0400
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
- 	struct timeval start, end;
- 	u64 elapsed_csecs64;
- 	unsigned int elapsed_csecs;
-+	bool timedout = false;
- 
- 	do_gettimeofday(&start);
- 
- 	end_time = jiffies + TIMEOUT;
- 	do {
- 		todo = 0;
-+		if (time_after(jiffies, end_time))
-+			timedout = true;
- 		read_lock(&tasklist_lock);
- 		do_each_thread(g, p) {
- 			if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
- 			 * It is "frozen enough".  If the task does wake
- 			 * up, it will immediately call try_to_freeze.
- 			 */
--			if (!task_is_stopped_or_traced(p) &&
--			    !freezer_should_skip(p))
-+			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- 				todo++;
-+				if (timedout) {
-+					printk(KERN_ERR "Task refusing to freeze:\n");
-+					sched_show_task(p);
-+				}
-+			}
- 		} while_each_thread(g, p);
- 		read_unlock(&tasklist_lock);
- 		yield();			/* Yield is okay here */
--		if (time_after(jiffies, end_time))
--			break;
--	} while (todo);
-+	} while (todo && !timedout);
- 
- 	do_gettimeofday(&end);
- 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff -urNp linux-2.6.32.12/kernel/power/suspend.c linux-2.6.32.12/kernel/power/suspend.c
---- linux-2.6.32.12/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/power/suspend.c	2010-04-04 20:46:41.697788265 -0400
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
- 	[PM_SUSPEND_MEM]	= "mem",
- };
- 
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
- 
- /**
-  *	suspend_set_ops - Set the global suspend method table.
-  *	@ops:	Pointer to ops structure.
-  */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- 	mutex_lock(&pm_mutex);
- 	suspend_ops = ops;
-diff -urNp linux-2.6.32.12/kernel/printk.c linux-2.6.32.12/kernel/printk.c
---- linux-2.6.32.12/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/printk.c	2010-04-04 20:46:41.697788265 -0400
-@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
- 	char c;
- 	int error = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
-+		return -EPERM;
-+#endif
-+
- 	error = security_syslog(type);
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.12/kernel/ptrace.c linux-2.6.32.12/kernel/ptrace.c
---- linux-2.6.32.12/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/ptrace.c	2010-04-04 20:46:41.697788265 -0400
-@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
- 	     cred->gid != tcred->egid ||
- 	     cred->gid != tcred->sgid ||
- 	     cred->gid != tcred->gid) &&
--	    !capable(CAP_SYS_PTRACE)) {
-+	    !capable_nolog(CAP_SYS_PTRACE)) {
- 		rcu_read_unlock();
- 		return -EPERM;
- 	}
-@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
- 	smp_rmb();
- 	if (task->mm)
- 		dumpable = get_dumpable(task->mm);
--	if (!dumpable && !capable(CAP_SYS_PTRACE))
-+	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
- 		return -EPERM;
- 
- 	return security_ptrace_access_check(task, mode);
-@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
- 		goto unlock_tasklist;
- 
- 	task->ptrace = PT_PTRACED;
--	if (capable(CAP_SYS_PTRACE))
-+	if (capable_nolog(CAP_SYS_PTRACE))
- 		task->ptrace |= PT_PTRACE_CAP;
- 
- 	__ptrace_link(task, current);
-@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
- 		ret = ptrace_setoptions(child, data);
- 		break;
- 	case PTRACE_GETEVENTMSG:
--		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- 		break;
- 
- 	case PTRACE_GETSIGINFO:
- 		ret = ptrace_getsiginfo(child, &siginfo);
- 		if (!ret)
--			ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- 						   &siginfo);
- 		break;
- 
- 	case PTRACE_SETSIGINFO:
--		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- 				   sizeof siginfo))
- 			ret = -EFAULT;
- 		else
-@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
- 		goto out;
- 	}
- 
-+	if (gr_handle_ptrace(child, request)) {
-+		ret = -EPERM;
-+		goto out_put_task_struct;
-+	}
-+
- 	if (request == PTRACE_ATTACH) {
- 		ret = ptrace_attach(child);
- 		/*
- 		 * Some architectures need to do book-keeping after
- 		 * a ptrace attach.
- 		 */
--		if (!ret)
-+		if (!ret) {
- 			arch_ptrace_attach(child);
-+			gr_audit_ptrace(child);
-+		}
- 		goto out_put_task_struct;
- 	}
- 
-@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
- 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- 	if (copied != sizeof(tmp))
- 		return -EIO;
--	return put_user(tmp, (unsigned long __user *)data);
-+	return put_user(tmp, (__force unsigned long __user *)data);
- }
- 
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-diff -urNp linux-2.6.32.12/kernel/rcutree.c linux-2.6.32.12/kernel/rcutree.c
---- linux-2.6.32.12/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/rcutree.c	2010-04-04 20:46:41.697788265 -0400
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
- /*
-  * Do softirq processing for the current CPU.
-  */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- 	/*
- 	 * Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.32.12/kernel/relay.c linux-2.6.32.12/kernel/relay.c
---- linux-2.6.32.12/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/relay.c	2010-04-04 20:46:41.697788265 -0400
-@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
- 		return 0;
- 
- 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
--	if (ret < 0 || ret < total_len)
-+	if ((int)ret < 0 || ret < total_len)
- 		return ret;
- 
-         if (read_start + ret == nonpad_end)
-diff -urNp linux-2.6.32.12/kernel/resource.c linux-2.6.32.12/kernel/resource.c
---- linux-2.6.32.12/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/resource.c	2010-04-04 20:46:41.697788265 -0400
-@@ -132,8 +132,18 @@ static const struct file_operations proc
- 
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
- 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- 	return 0;
- }
- __initcall(ioresources_init);
-diff -urNp linux-2.6.32.12/kernel/sched.c linux-2.6.32.12/kernel/sched.c
---- linux-2.6.32.12/kernel/sched.c	2010-04-29 17:49:38.609495328 -0400
-+++ linux-2.6.32.12/kernel/sched.c	2010-04-29 17:49:58.717524885 -0400
-@@ -4841,7 +4841,7 @@ out:
-  * In CONFIG_NO_HZ case, the idle load balance owner will do the
-  * rebalancing for all the cpus for whom scheduler ticks are stopped.
-  */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- 	int this_cpu = smp_processor_id();
- 	struct rq *this_rq = cpu_rq(this_cpu);
-@@ -6110,6 +6110,8 @@ int can_nice(const struct task_struct *p
- 	/* convert nice value [19,-20] to rlimit style value [1,40] */
- 	int nice_rlim = 20 - nice;
- 
-+	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- 		capable(CAP_SYS_NICE));
- }
-@@ -6143,7 +6145,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- 	if (nice > 19)
- 		nice = 19;
- 
--	if (increment < 0 && !can_nice(current, nice))
-+	if (increment < 0 && (!can_nice(current, nice) ||
-+			      gr_handle_chroot_nice()))
- 		return -EPERM;
- 
- 	retval = security_task_setnice(current, nice);
-@@ -6293,6 +6296,8 @@ recheck:
- 		if (rt_policy(policy)) {
- 			unsigned long rlim_rtprio;
- 
-+			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
-+
- 			if (!lock_task_sighand(p, &flags))
- 				return -ESRCH;
- 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
-@@ -7452,7 +7457,7 @@ static struct ctl_table sd_ctl_dir[] = {
- 		.procname	= "sched_domain",
- 		.mode		= 0555,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table sd_ctl_root[] = {
-@@ -7462,7 +7467,7 @@ static struct ctl_table sd_ctl_root[] = 
- 		.mode		= 0555,
- 		.child		= sd_ctl_dir,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table *sd_alloc_ctl_entry(int n)
-diff -urNp linux-2.6.32.12/kernel/signal.c linux-2.6.32.12/kernel/signal.c
---- linux-2.6.32.12/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/signal.c	2010-04-29 17:46:37.333938325 -0400
-@@ -41,12 +41,12 @@
- 
- static struct kmem_cache *sigqueue_cachep;
- 
--static void __user *sig_handler(struct task_struct *t, int sig)
-+static __sighandler_t sig_handler(struct task_struct *t, int sig)
- {
- 	return t->sighand->action[sig - 1].sa.sa_handler;
- }
- 
--static int sig_handler_ignored(void __user *handler, int sig)
-+static int sig_handler_ignored(__sighandler_t handler, int sig)
- {
- 	/* Is it explicitly or implicitly ignored? */
- 	return handler == SIG_IGN ||
-@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
- static int sig_task_ignored(struct task_struct *t, int sig,
- 		int from_ancestor_ns)
- {
--	void __user *handler;
-+	__sighandler_t handler;
- 
- 	handler = sig_handler(t, sig);
- 
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
- 	 */
- 	user = get_uid(__task_cred(t)->user);
- 	atomic_inc(&user->sigpending);
-+
-+	if (!override_rlimit)
-+		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- 	if (override_rlimit ||
- 	    atomic_read(&user->sigpending) <=
- 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
- 
- int unhandled_signal(struct task_struct *tsk, int sig)
- {
--	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
-+	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
- 	if (is_global_init(tsk))
- 		return 1;
- 	if (handler != SIG_IGN && handler != SIG_DFL)
-@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
- 		}
- 	}
- 
-+	if (gr_handle_signal(t, sig))
-+		return -EPERM;
-+
- 	return security_task_kill(t, info, sig, 0);
- }
- 
-@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
- 	return send_signal(sig, info, p, 1);
- }
- 
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- 	return send_signal(sig, info, t, 0);
-@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
- 	ret = specific_send_sig_info(sig, info, t);
- 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
- 
-+	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+	gr_handle_crash(t, sig);
-+
- 	return ret;
- }
- 
-@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
- {
- 	int ret = check_kill_permission(sig, info, p);
- 
--	if (!ret && sig)
-+	if (!ret && sig) {
- 		ret = do_send_sig_info(sig, info, p, true);
-+		if (!ret)
-+			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+	}
- 
- 	return ret;
- }
-diff -urNp linux-2.6.32.12/kernel/smp.c linux-2.6.32.12/kernel/smp.c
---- linux-2.6.32.12/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/smp.c	2010-04-04 20:46:41.701624986 -0400
-@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
- }
- EXPORT_SYMBOL(smp_call_function);
- 
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- 	spin_lock(&call_function.lock);
- }
- 
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- 	spin_unlock(&call_function.lock);
- }
- 
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- 	spin_lock_irq(&call_function.lock);
- }
- 
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- 	spin_unlock_irq(&call_function.lock);
- }
-diff -urNp linux-2.6.32.12/kernel/softirq.c linux-2.6.32.12/kernel/softirq.c
---- linux-2.6.32.12/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/softirq.c	2010-04-04 20:46:41.701624986 -0400
-@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
- 
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
- 
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
- };
-@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
- 
- asmlinkage void __do_softirq(void)
- {
--	struct softirq_action *h;
-+	const struct softirq_action *h;
- 	__u32 pending;
- 	int max_restart = MAX_SOFTIRQ_RESTART;
- 	int cpu;
-@@ -216,7 +216,7 @@ restart:
- 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
- 
- 			trace_softirq_entry(h, softirq_vec);
--			h->action(h);
-+			h->action();
- 			trace_softirq_exit(h, softirq_vec);
- 			if (unlikely(prev_count != preempt_count())) {
- 				printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
- 	local_irq_restore(flags);
- }
- 
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
- 	softirq_vec[nr].action = action;
- }
-@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
- 
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
- 
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- 	struct tasklet_struct *list;
- 
-@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
- 	}
- }
- 
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- 	struct tasklet_struct *list;
- 
-diff -urNp linux-2.6.32.12/kernel/sys.c linux-2.6.32.12/kernel/sys.c
---- linux-2.6.32.12/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/sys.c	2010-04-04 20:46:41.701624986 -0400
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
- 		error = -EACCES;
- 		goto out;
- 	}
-+
-+	if (gr_handle_chroot_setpriority(p, niceval)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
- 	no_nice = security_task_setnice(p, niceval);
- 	if (no_nice) {
- 		error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who)
- 					error = set_one_prio(p, niceval, error);
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* For find_user() */
- 			break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who) {
- 					niceval = 20 - task_nice(p);
- 					if (niceval > retval)
- 						retval = niceval;
- 				}
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* for find_user() */
- 			break;
-@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(new->gid, new->egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1 ||
- 	    (egid != (gid_t) -1 && egid != old->gid))
- 		new->sgid = new->egid;
-@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_group_change(gid, gid, gid))
-+		goto error;
-+
- 	if (capable(CAP_SETGID))
- 		new->gid = new->egid = new->sgid = new->fsgid = gid;
- 	else if (gid == old->gid || gid == old->sgid)
-@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(new->uid, new->euid, -1))
-+		goto error;
-+
- 	if (new->uid != old->uid) {
- 		retval = set_user(new);
- 		if (retval < 0)
-@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_crash_uid(uid))
-+		goto error;
-+	if (gr_check_user_change(uid, uid, uid))
-+		goto error;
-+
- 	if (capable(CAP_SETUID)) {
- 		new->suid = new->uid = uid;
- 		if (uid != old->uid) {
-@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(ruid, euid, -1))
-+		goto error;
-+
- 	if (ruid != (uid_t) -1) {
- 		new->uid = ruid;
- 		if (ruid != old->uid) {
-@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(rgid, egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1)
- 		new->gid = rgid;
- 	if (egid != (gid_t) -1)
-@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
- 		goto error;
- 
-+	if (gr_check_user_change(-1, -1, uid))
-+		goto error;
-+
- 	if (uid == old->uid  || uid == old->euid  ||
- 	    uid == old->suid || uid == old->fsuid ||
- 	    capable(CAP_SETUID)) {
-@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- 	if (gid == old->gid  || gid == old->egid  ||
- 	    gid == old->sgid || gid == old->fsgid ||
- 	    capable(CAP_SETGID)) {
-+		if (gr_check_group_change(-1, -1, gid))
-+			goto error;
-+
- 		if (gid != old_fsgid) {
- 			new->fsgid = gid;
- 			goto change_okay;
-@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
- 			error = get_dumpable(me->mm);
- 			break;
- 		case PR_SET_DUMPABLE:
--			if (arg2 < 0 || arg2 > 1) {
-+			if (arg2 > 1) {
- 				error = -EINVAL;
- 				break;
- 			}
-diff -urNp linux-2.6.32.12/kernel/sysctl.c linux-2.6.32.12/kernel/sysctl.c
---- linux-2.6.32.12/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/sysctl.c	2010-04-04 20:46:41.701624986 -0400
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
- 
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+				const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
- 
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
- static int proc_taint(struct ctl_table *table, int write,
- 			       void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
- 
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
- 
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "softmode",
-+		.data		= &pax_softmode,
-+		.maxlen		= sizeof(unsigned int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+
-+	{ .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
- 
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
- #endif
- 
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsecurity",
-+		.mode		= 0500,
-+		.child		= grsecurity_table,
-+	},
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "pax",
-+		.mode		= 0500,
-+		.child		= pax_table,
-+	},
-+#endif
-+
- 	{
- 		.ctl_name	= CTL_UNNUMBERED,
- 		.procname	= "sched_child_runs_first",
-@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
- 	return 0;
- }
- 
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- 		       void __user *oldval, size_t __user *oldlenp,
- 		       void __user *newval, size_t newlen,
-@@ -1821,7 +1864,7 @@ repeat:
- 		if (n == table->ctl_name) {
- 			int error;
- 			if (table->child) {
--				if (sysctl_perm(root, table, MAY_EXEC))
-+				if (sysctl_perm_nochk(root, table, MAY_EXEC))
- 					return -EPERM;
- 				name++;
- 				nlen--;
-@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
- 	int error;
- 	int mode;
- 
-+	if (table->parent != NULL && table->parent->procname != NULL &&
-+	   table->procname != NULL &&
-+	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+		return -EACCES;
-+	if (gr_handle_chroot_sysctl(op))
-+		return -EACCES;
-+	error = gr_handle_sysctl(table, op);
-+	if (error)
-+		return error;
-+
-+	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+	if (error)
-+		return error;
-+
-+	if (root->permissions)
-+		mode = root->permissions(root, current->nsproxy, table);
-+	else
-+		mode = table->mode;
-+
-+	return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+	int error;
-+	int mode;
-+
- 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.12/kernel/taskstats.c linux-2.6.32.12/kernel/taskstats.c
---- linux-2.6.32.12/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/taskstats.c	2010-04-04 20:46:41.701624986 -0400
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
- 
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
-  * Maximum length of a cpumask that can be specified in
-  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
- 	size_t size;
- 	cpumask_var_t mask;
- 
-+	if (gr_is_taskstats_denied(current->pid))
-+		return -EACCES;
-+
- 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.12/kernel/time/tick-broadcast.c linux-2.6.32.12/kernel/time/tick-broadcast.c
---- linux-2.6.32.12/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/time/tick-broadcast.c	2010-04-04 20:46:41.701624986 -0400
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
- 		 * then clear the broadcast bit.
- 		 */
- 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
--			int cpu = smp_processor_id();
-+			cpu = smp_processor_id();
- 
- 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- 			tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.32.12/kernel/time.c linux-2.6.32.12/kernel/time.c
---- linux-2.6.32.12/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/time.c	2010-04-04 20:46:41.701624986 -0400
-@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
- 		return err;
- 
- 	do_settimeofday(&tv);
-+
-+	gr_log_timechange();
-+
- 	return 0;
- }
- 
-@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
- 			return -EFAULT;
- 	}
- 
-+	gr_log_timechange();
-+
- 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
- }
- 
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
-  * Avoid unnecessary multiplications/divisions in the
-  * two most common HZ cases:
-  */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- 	return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
- 
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- 	return (USEC_PER_SEC / HZ) * j;
-diff -urNp linux-2.6.32.12/kernel/timer.c linux-2.6.32.12/kernel/timer.c
---- linux-2.6.32.12/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/timer.c	2010-04-04 20:46:41.701624986 -0400
-@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
- /*
-  * This function runs timers and the timer-tq in bottom half context.
-  */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- 	struct tvec_base *base = __get_cpu_var(tvec_bases);
- 
-diff -urNp linux-2.6.32.12/kernel/trace/ftrace.c linux-2.6.32.12/kernel/trace/ftrace.c
---- linux-2.6.32.12/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
-+++ linux-2.6.32.12/kernel/trace/ftrace.c	2010-04-04 20:46:41.701624986 -0400
-@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
- 
- 	ip = rec->ip;
- 
-+	ret = ftrace_arch_code_modify_prepare();
-+	FTRACE_WARN_ON(ret);
-+	if (ret)
-+		return 0;
-+
- 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- 	if (ret) {
- 		ftrace_bug(ret, ip);
- 		rec->flags |= FTRACE_FL_FAILED;
--		return 0;
- 	}
--	return 1;
-+	return ret ? 0 : 1;
- }
- 
- /*
-diff -urNp linux-2.6.32.12/kernel/trace/Kconfig linux-2.6.32.12/kernel/trace/Kconfig
---- linux-2.6.32.12/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/trace/Kconfig	2010-04-04 20:46:41.701624986 -0400
-@@ -126,6 +126,7 @@ if FTRACE
- config FUNCTION_TRACER
- 	bool "Kernel Function Tracer"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FRAME_POINTER
- 	select KALLSYMS
- 	select GENERIC_TRACER
-@@ -343,6 +344,7 @@ config POWER_TRACER
- config STACK_TRACER
- 	bool "Trace max stack"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FUNCTION_TRACER
- 	select STACKTRACE
- 	select KALLSYMS
-diff -urNp linux-2.6.32.12/kernel/trace/ring_buffer.c linux-2.6.32.12/kernel/trace/ring_buffer.c
---- linux-2.6.32.12/kernel/trace/ring_buffer.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.12/kernel/trace/ring_buffer.c	2010-04-29 17:46:37.362529614 -0400
-@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
-  * the reader page). But if the next page is a header page,
-  * its flags will be non zero.
-  */
--static int inline
-+static inline int
- rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- 		struct buffer_page *page, struct list_head *list)
- {
-diff -urNp linux-2.6.32.12/kernel/trace/trace.c linux-2.6.32.12/kernel/trace/trace.c
---- linux-2.6.32.12/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.12/kernel/trace/trace.c	2010-04-04 20:46:41.705142860 -0400
-@@ -3808,10 +3808,9 @@ static const struct file_operations trac
- };
- #endif
- 
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+	static struct dentry *d_tracer;
- 	static int once;
- 
- 	if (d_tracer)
-@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
- 	return d_tracer;
- }
- 
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+	static struct dentry *d_percpu;
- 	static int once;
- 	struct dentry *d_tracer;
- 
-diff -urNp linux-2.6.32.12/kernel/trace/trace_events.c linux-2.6.32.12/kernel/trace/trace_events.c
---- linux-2.6.32.12/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/trace/trace_events.c	2010-04-04 20:46:41.705142860 -0400
-@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
-  * Modules must own their file_operations to keep up with
-  * reference counting.
-  */
-+
-+/* cannot be const */
- struct ftrace_module_file_ops {
- 	struct list_head		list;
- 	struct module			*mod;
-diff -urNp linux-2.6.32.12/kernel/trace/trace_output.c linux-2.6.32.12/kernel/trace/trace_output.c
---- linux-2.6.32.12/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/trace/trace_output.c	2010-04-04 20:46:41.705142860 -0400
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
- 		return 0;
- 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- 	if (!IS_ERR(p)) {
--		p = mangle_path(s->buffer + s->len, p, "\n");
-+		p = mangle_path(s->buffer + s->len, p, "\n\\");
- 		if (p) {
- 			s->len = p - s->buffer;
- 			return 1;
-diff -urNp linux-2.6.32.12/kernel/trace/trace_stack.c linux-2.6.32.12/kernel/trace/trace_stack.c
---- linux-2.6.32.12/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/trace/trace_stack.c	2010-04-04 20:46:41.705142860 -0400
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- 		return;
- 
- 	/* we do not handle interrupt stacks yet */
--	if (!object_is_on_stack(&this_size))
-+	if (!object_starts_on_stack(&this_size))
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.12/kernel/utsname_sysctl.c linux-2.6.32.12/kernel/utsname_sysctl.c
---- linux-2.6.32.12/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/kernel/utsname_sysctl.c	2010-04-04 20:46:41.705142860 -0400
-@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
- 		.proc_handler	= proc_do_uts_string,
- 		.strategy	= sysctl_uts_string,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table uts_root_table[] = {
-@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
- 		.mode		= 0555,
- 		.child		= uts_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init utsname_sysctl_init(void)
-diff -urNp linux-2.6.32.12/lib/bug.c linux-2.6.32.12/lib/bug.c
---- linux-2.6.32.12/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/bug.c	2010-04-04 20:46:41.705142860 -0400
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
- 		return BUG_TRAP_TYPE_NONE;
- 
- 	bug = find_bug(bugaddr);
-+	if (!bug)
-+		return BUG_TRAP_TYPE_NONE;
- 
- 	printk(KERN_EMERG "------------[ cut here ]------------\n");
- 
-diff -urNp linux-2.6.32.12/lib/debugobjects.c linux-2.6.32.12/lib/debugobjects.c
---- linux-2.6.32.12/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/debugobjects.c	2010-04-04 20:46:41.705142860 -0400
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
- 	if (limit > 4)
- 		return;
- 
--	is_on_stack = object_is_on_stack(addr);
-+	is_on_stack = object_starts_on_stack(addr);
- 	if (is_on_stack == onstack)
- 		return;
- 
-diff -urNp linux-2.6.32.12/lib/dma-debug.c linux-2.6.32.12/lib/dma-debug.c
---- linux-2.6.32.12/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/dma-debug.c	2010-04-04 20:46:41.705142860 -0400
-@@ -861,7 +861,7 @@ out:
- 
- static void check_for_stack(struct device *dev, void *addr)
- {
--	if (object_is_on_stack(addr))
-+	if (object_starts_on_stack(addr))
- 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- 				"stack [addr=%p]\n", addr);
- }
-diff -urNp linux-2.6.32.12/lib/idr.c linux-2.6.32.12/lib/idr.c
---- linux-2.6.32.12/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/idr.c	2010-04-04 20:46:41.705142860 -0400
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
- 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
- 
- 			/* if already at the top layer, we need to grow */
--			if (id >= 1 << (idp->layers * IDR_BITS)) {
-+			if (id >= (1 << (idp->layers * IDR_BITS))) {
- 				*starting_id = id;
- 				return IDR_NEED_TO_GROW;
- 			}
-diff -urNp linux-2.6.32.12/lib/inflate.c linux-2.6.32.12/lib/inflate.c
---- linux-2.6.32.12/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/inflate.c	2010-04-04 20:46:41.705142860 -0400
-@@ -266,7 +266,7 @@ static void free(void *where)
- 		malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
- 
-diff -urNp linux-2.6.32.12/lib/Kconfig.debug linux-2.6.32.12/lib/Kconfig.debug
---- linux-2.6.32.12/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/Kconfig.debug	2010-04-04 20:46:41.705142860 -0400
-@@ -905,7 +905,7 @@ config LATENCYTOP
- 	select STACKTRACE
- 	select SCHEDSTATS
- 	select SCHED_DEBUG
--	depends on HAVE_LATENCYTOP_SUPPORT
-+	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- 	help
- 	  Enable this option if you want to use the LatencyTOP tool
- 	  to find out which userspace is blocking on what kernel operations.
-diff -urNp linux-2.6.32.12/lib/kobject.c linux-2.6.32.12/lib/kobject.c
---- linux-2.6.32.12/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/kobject.c	2010-04-04 20:46:41.705142860 -0400
-@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
- 	return ret;
- }
- 
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- 	.show	= kobj_attr_show,
- 	.store	= kobj_attr_store,
- };
-@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
-  * If the kset was not able to be created, NULL will be returned.
-  */
- static struct kset *kset_create(const char *name,
--				struct kset_uevent_ops *uevent_ops,
-+				const struct kset_uevent_ops *uevent_ops,
- 				struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
-  * If the kset was not able to be created, NULL will be returned.
-  */
- struct kset *kset_create_and_add(const char *name,
--				 struct kset_uevent_ops *uevent_ops,
-+				 const struct kset_uevent_ops *uevent_ops,
- 				 struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-diff -urNp linux-2.6.32.12/lib/kobject_uevent.c linux-2.6.32.12/lib/kobject_uevent.c
---- linux-2.6.32.12/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/kobject_uevent.c	2010-04-04 20:46:41.705142860 -0400
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
- 	const char *subsystem;
- 	struct kobject *top_kobj;
- 	struct kset *kset;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- 	u64 seq;
- 	int i = 0;
- 	int retval = 0;
-diff -urNp linux-2.6.32.12/lib/parser.c linux-2.6.32.12/lib/parser.c
---- linux-2.6.32.12/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/parser.c	2010-04-04 20:46:41.705142860 -0400
-@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
- 	char *buf;
- 	int ret;
- 
--	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
-+	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
- 	if (!buf)
- 		return -ENOMEM;
- 	memcpy(buf, s->from, s->to - s->from);
-diff -urNp linux-2.6.32.12/lib/radix-tree.c linux-2.6.32.12/lib/radix-tree.c
---- linux-2.6.32.12/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/radix-tree.c	2010-04-04 20:46:41.705142860 -0400
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- 	int nr;
- 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
- 
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff -urNp linux-2.6.32.12/lib/random32.c linux-2.6.32.12/lib/random32.c
---- linux-2.6.32.12/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/lib/random32.c	2010-04-04 20:46:41.705142860 -0400
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
-  */
- static inline u32 __seed(u32 x, u32 m)
- {
--	return (x < m) ? x + m : x;
-+	return (x <= m) ? x + m + 1 : x;
- }
- 
- /**
-diff -urNp linux-2.6.32.12/localversion-grsec linux-2.6.32.12/localversion-grsec
---- linux-2.6.32.12/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.12/localversion-grsec	2010-04-04 20:46:41.705142860 -0400
-@@ -0,0 +1 @@
-+-grsec
-diff -urNp linux-2.6.32.12/Makefile linux-2.6.32.12/Makefile
---- linux-2.6.32.12/Makefile	2010-04-29 17:49:37.365428457 -0400
-+++ linux-2.6.32.12/Makefile	2010-04-29 17:49:57.861101311 -0400
-@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
- 
- HOSTCC       = gcc
- HOSTCXX      = g++
--HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
- 
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -644,7 +644,7 @@ export mod_strip_cmd
- 
- 
- ifeq ($(KBUILD_EXTMOD),)
--core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- 
- vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-diff -urNp linux-2.6.32.12/mm/filemap.c linux-2.6.32.12/mm/filemap.c
---- linux-2.6.32.12/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/filemap.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
- 	struct address_space *mapping = file->f_mapping;
- 
- 	if (!mapping->a_ops->readpage)
--		return -ENOEXEC;
-+		return -ENODEV;
- 	file_accessed(file);
- 	vma->vm_ops = &generic_file_vm_ops;
- 	vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
-                         *pos = i_size_read(inode);
- 
- 		if (limit != RLIM_INFINITY) {
-+			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- 			if (*pos >= limit) {
- 				send_sig(SIGXFSZ, current, 0);
- 				return -EFBIG;
-diff -urNp linux-2.6.32.12/mm/fremap.c linux-2.6.32.12/mm/fremap.c
---- linux-2.6.32.12/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/fremap.c	2010-04-04 20:46:41.708732353 -0400
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
-  retry:
- 	vma = find_vma(mm, start);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+		goto out;
-+#endif
-+
- 	/*
- 	 * Make sure the vma is shared, that it supports prefaulting,
- 	 * and that the remapped range is valid and fully within
-diff -urNp linux-2.6.32.12/mm/highmem.c linux-2.6.32.12/mm/highmem.c
---- linux-2.6.32.12/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/highmem.c	2010-04-04 20:46:41.708732353 -0400
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- 		 * So no dangers, even with speculative execution.
- 		 */
- 		page = pte_page(pkmap_page_table[i]);
-+		pax_open_kernel();
- 		pte_clear(&init_mm, (unsigned long)page_address(page),
- 			  &pkmap_page_table[i]);
--
-+		pax_close_kernel();
- 		set_page_address(page, NULL);
- 		need_flush = 1;
- 	}
-@@ -177,9 +178,11 @@ start:
- 		}
- 	}
- 	vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+	pax_open_kernel();
- 	set_pte_at(&init_mm, vaddr,
- 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+	pax_close_kernel();
- 	pkmap_count[last_pkmap_nr] = 1;
- 	set_page_address(page, (void *)vaddr);
- 
-diff -urNp linux-2.6.32.12/mm/hugetlb.c linux-2.6.32.12/mm/hugetlb.c
---- linux-2.6.32.12/mm/hugetlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/hugetlb.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1924,6 +1924,26 @@ static int unmap_ref_private(struct mm_s
- 	return 1;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	struct vm_area_struct *vma_m;
-+	unsigned long address_m;
-+	pte_t *ptep_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+	get_page(page_m);
-+	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- 			unsigned long address, pte_t *ptep, pte_t pte,
- 			struct page *pagecache_page)
-@@ -1995,6 +2015,11 @@ retry_avoidcopy:
- 		huge_ptep_clear_flush(vma, address, ptep);
- 		set_huge_pte_at(mm, address, ptep,
- 				make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- 		/* Make the old page be freed below */
- 		new_page = old_page;
- 	}
-@@ -2124,6 +2149,10 @@ retry:
- 				&& (vma->vm_flags & VM_SHARED)));
- 	set_huge_pte_at(mm, address, ptep, new_pte);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- 		/* Optimization, do the COW without a second fault */
- 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2152,6 +2181,28 @@ int hugetlb_fault(struct mm_struct *mm, 
- 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- 	struct hstate *h = hstate_vma(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+			h = hstate_vma(vma);
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+			return VM_FAULT_OOM;
-+		address_m &= HPAGE_MASK;
-+		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+	}
-+#endif
-+
- 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- 	if (!ptep)
- 		return VM_FAULT_OOM;
-diff -urNp linux-2.6.32.12/mm/Kconfig linux-2.6.32.12/mm/Kconfig
---- linux-2.6.32.12/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/Kconfig	2010-04-04 20:46:41.708732353 -0400
-@@ -228,7 +228,7 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
-         int "Low address space to protect from user allocation"
- 	depends on MMU
--        default 4096
-+        default 65536
-         help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.12/mm/maccess.c linux-2.6.32.12/mm/maccess.c
---- linux-2.6.32.12/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/maccess.c	2010-04-04 20:46:41.708732353 -0400
-@@ -14,7 +14,7 @@
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.32.12/mm/madvise.c linux-2.6.32.12/mm/madvise.c
---- linux-2.6.32.12/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/madvise.c	2010-04-04 20:46:41.708732353 -0400
-@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
- 	pgoff_t pgoff;
- 	unsigned long new_flags = vma->vm_flags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	switch (behavior) {
- 	case MADV_NORMAL:
- 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -103,6 +107,13 @@ success:
- 	/*
- 	 * vm_flags is protected by the mmap_sem held in write mode.
- 	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m)
-+		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- 	vma->vm_flags = new_flags;
- 
- out:
-@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
- 			     struct vm_area_struct ** prev,
- 			     unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	*prev = vma;
- 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- 		return -EINVAL;
-@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
- 		zap_page_range(vma, start, end - start, &details);
- 	} else
- 		zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+			struct zap_details details = {
-+				.nonlinear_vma = vma_m,
-+				.last_index = ULONG_MAX,
-+			};
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+		} else
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
- 	if (end < start)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			goto out;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		goto out;
-+
- 	error = 0;
- 	if (end == start)
- 		goto out;
-diff -urNp linux-2.6.32.12/mm/memory.c linux-2.6.32.12/mm/memory.c
---- linux-2.6.32.12/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/memory.c	2010-04-04 20:46:41.708732353 -0400
-@@ -48,6 +48,7 @@
- #include <linux/ksm.h>
- #include <linux/rmap.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/delayacct.h>
- #include <linux/init.h>
- #include <linux/writeback.h>
-@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
- 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- 	i = 0;
- 
--	do {
-+	while (nr_pages) {
- 		struct vm_area_struct *vma;
- 
--		vma = find_extend_vma(mm, start);
-+		vma = find_vma(mm, start);
- 		if (!vma && in_gate_area(tsk, start)) {
- 			unsigned long pg = start & PAGE_MASK;
- 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
- 			continue;
- 		}
- 
--		if (!vma ||
-+		if (!vma || start < vma->vm_start ||
- 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- 		    !(vm_flags & vma->vm_flags))
- 			return i ? : -EFAULT;
-@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
- 			start += PAGE_SIZE;
- 			nr_pages--;
- 		} while (nr_pages && start < vma->vm_end);
--	} while (nr_pages);
-+	}
- 	return i;
- }
- 
-@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
- 		copy_user_highpage(dst, src, va, vma);
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	spinlock_t *ptl;
-+	pte_t *pte, entry;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	entry = *pte;
-+	if (!pte_present(entry)) {
-+		if (!pte_none(entry)) {
-+			BUG_ON(pte_file(entry));
-+			free_swap_and_cache(pte_to_swp_entry(entry));
-+			pte_clear_not_present_full(mm, address, pte, 0);
-+		}
-+	} else {
-+		struct page *page;
-+
-+		flush_cache_page(vma, address, pte_pfn(entry));
-+		entry = ptep_clear_flush(vma, address, pte);
-+		BUG_ON(pte_dirty(entry));
-+		page = vm_normal_page(vma, address, entry);
-+		if (page) {
-+			update_hiwater_rss(mm);
-+			if (PageAnon(page))
-+				dec_mm_counter(mm, anon_rss);
-+			else
-+				dec_mm_counter(mm, file_rss);
-+			page_remove_rmap(page);
-+			page_cache_release(page);
-+		}
-+	}
-+	pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || !PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(!PageLocked(page_m));
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_anon_rmap(page_m, vma_m, address_m);
-+	inc_mm_counter(mm, anon_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+	unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_file_rmap(page_m);
-+	inc_mm_counter(mm, file_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+	struct page *page_m;
-+	pte_t entry;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+		goto out;
-+
-+	entry = *pte;
-+	page_m  = vm_normal_page(vma, address, entry);
-+	if (!page_m)
-+		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+	else if (PageAnon(page_m)) {
-+		if (pax_find_mirror_vma(vma)) {
-+			pte_unmap_unlock(pte, ptl);
-+			lock_page(page_m);
-+			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+			if (pte_same(entry, *pte))
-+				pax_mirror_anon_pte(vma, address, page_m, ptl);
-+			else
-+				unlock_page(page_m);
-+		}
-+	} else
-+		pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+	pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
-  * This routine handles present pages, when users try to write
-  * to a shared page. It is done by copying the page to a new address
-@@ -2146,6 +2327,12 @@ gotten:
- 	 */
- 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(new_page));
-+#endif
-+
- 		if (old_page) {
- 			if (!PageAnon(old_page)) {
- 				dec_mm_counter(mm, file_rss);
-@@ -2197,6 +2384,10 @@ gotten:
- 			page_remove_rmap(old_page);
- 		}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- 		/* Free the old page.. */
- 		new_page = old_page;
- 		ret |= VM_FAULT_WRITE;
-@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
- 	swap_free(entry);
- 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- 		try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- 	unlock_page(page);
- 
- 	if (flags & FAULT_FLAG_WRITE) {
-@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
- 		unsigned long address, pte_t *page_table, pmd_t *pmd,
- 		unsigned int flags)
- {
--	struct page *page;
-+	struct page *page = NULL;
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
-@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
- 	if (!pte_none(*page_table))
- 		goto release;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		BUG_ON(!trylock_page(page));
-+#endif
-+
- 	inc_mm_counter(mm, anon_rss);
- 	page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2670,6 +2876,12 @@ setpte:
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (page)
-+		pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- 	return 0;
-@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
- 	 */
- 	/* Only go through if we didn't race with anybody else... */
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon && pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(page));
-+#endif
-+
- 		flush_icache_page(vma, page);
- 		entry = mk_pte(page, vma->vm_page_prot);
- 		if (flags & FAULT_FLAG_WRITE)
-@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
- 
- 		/* no need to invalidate: a not-present page won't be cached */
- 		update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon)
-+			pax_mirror_anon_pte(vma, address, page, ptl);
-+		else
-+			pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- 	} else {
- 		if (charged)
- 			mem_cgroup_uncharge_page(page);
-@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
- 		if (flags & FAULT_FLAG_WRITE)
- 			flush_tlb_page(vma, address);
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_pte(vma, address, pte, pmd, ptl);
-+	return 0;
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(pte, ptl);
- 	return 0;
-@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
- 	pmd_t *pmd;
- 	pte_t *pte;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	__set_current_state(TASK_RUNNING);
- 
- 	count_vm_event(PGFAULT);
-@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
- 	if (unlikely(is_vm_hugetlb_page(vma)))
- 		return hugetlb_fault(mm, vma, address, flags);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+		pgd_t *pgd_m;
-+		pud_t *pud_m;
-+		pmd_t *pmd_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		pgd_m = pgd_offset(mm, address_m);
-+		pud_m = pud_alloc(mm, pgd_m, address_m);
-+		if (!pud_m)
-+			return VM_FAULT_OOM;
-+		pmd_m = pmd_alloc(mm, pud_m, address_m);
-+		if (!pmd_m)
-+			return VM_FAULT_OOM;
-+		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+			return VM_FAULT_OOM;
-+		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+	}
-+#endif
-+
- 	pgd = pgd_offset(mm, address);
- 	pud = pud_alloc(mm, pgd, address);
- 	if (!pud)
-@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.32.12/mm/memory-failure.c linux-2.6.32.12/mm/memory-failure.c
---- linux-2.6.32.12/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/memory-failure.c	2010-04-04 20:46:41.708732353 -0400
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
- 
- int sysctl_memory_failure_recovery __read_mostly = 1;
- 
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
- 
- /*
-  * Send all the processes who have the page mapped an ``action optional''
-@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
- 		return 0;
- 	}
- 
--	atomic_long_add(1, &mce_bad_pages);
-+	atomic_long_add_unchecked(1, &mce_bad_pages);
- 
- 	/*
- 	 * We need/can do nothing about count=0 pages.
-diff -urNp linux-2.6.32.12/mm/mempolicy.c linux-2.6.32.12/mm/mempolicy.c
---- linux-2.6.32.12/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.12/mm/mempolicy.c	2010-04-04 20:46:41.708732353 -0400
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
- 	struct vm_area_struct *next;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	err = 0;
- 	for (; vma && vma->vm_start < end; vma = next) {
- 		next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
- 			err = policy_vma(vma, new);
- 		if (err)
- 			break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		vma_m = pax_find_mirror_vma(vma);
-+		if (vma_m) {
-+			err = policy_vma(vma_m, new);
-+			if (err)
-+				break;
-+		}
-+#endif
-+
- 	}
- 	return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
- 
- 	if (end < start)
- 		return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (end == start)
- 		return 0;
- 
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
- 
- 	if (file) {
- 		seq_printf(m, " file=");
--		seq_path(m, &file->f_path, "\n\t= ");
-+		seq_path(m, &file->f_path, "\n\t\\= ");
- 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 		seq_printf(m, " heap");
- 	} else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.32.12/mm/migrate.c linux-2.6.32.12/mm/migrate.c
---- linux-2.6.32.12/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/migrate.c	2010-04-04 20:46:41.708732353 -0400
-@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-diff -urNp linux-2.6.32.12/mm/mlock.c linux-2.6.32.12/mm/mlock.c
---- linux-2.6.32.12/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/mlock.c	2010-04-04 20:46:41.708732353 -0400
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
- 		return -EINVAL;
- 	if (end == start)
- 		return 0;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	vma = find_vma_prev(current->mm, start, &prev);
- 	if (!vma || vma->vm_start > start)
- 		return -ENOMEM;
-@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	/* check against resource limits */
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- 		error = do_mlock(start, len, 1);
- 	up_write(&current->mm->mmap_sem);
-@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
- static int do_mlockall(int flags)
- {
- 	struct vm_area_struct * vma, * prev = NULL;
--	unsigned int def_flags = 0;
-+	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
- 
- 	if (flags & MCL_FUTURE)
--		def_flags = VM_LOCKED;
-+		def_flags |= VM_LOCKED;
- 	current->mm->def_flags = def_flags;
- 	if (flags == MCL_FUTURE)
- 		goto out;
-@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
- 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
- 		unsigned int newflags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+			break;
-+#endif
-+
-+		BUG_ON(vma->vm_end > TASK_SIZE);
- 		newflags = vma->vm_flags | VM_LOCKED;
- 		if (!(flags & MCL_CURRENT))
- 			newflags &= ~VM_LOCKED;
-@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	ret = -ENOMEM;
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
- 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- 	    capable(CAP_IPC_LOCK))
- 		ret = do_mlockall(flags);
-diff -urNp linux-2.6.32.12/mm/mmap.c linux-2.6.32.12/mm/mmap.c
---- linux-2.6.32.12/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/mmap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -45,6 +45,16 @@
- #define arch_rebalance_pgtables(addr, len)		(addr)
- #endif
- 
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+		up_read(&mm->mmap_sem);
-+		BUG();
-+	}
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- 		struct vm_area_struct *vma, struct vm_area_struct *prev,
- 		unsigned long start, unsigned long end);
-@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
-  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
-  *
-  */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
- 
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
--	return __pgprot(pgprot_val(protection_map[vm_flags &
-+	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if (!nx_enabled &&
-+	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+	    (vm_flags & (VM_READ | VM_WRITE)))
-+		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+	return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
- 
-@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
- 	struct vm_area_struct *next = vma->vm_next;
- 
- 	might_sleep();
-+	BUG_ON(vma->vm_mirror);
- 	if (vma->vm_ops && vma->vm_ops->close)
- 		vma->vm_ops->close(vma);
- 	if (vma->vm_file) {
-@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- 	 * not page aligned -Ram Gupta
- 	 */
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- 			(mm->end_data - mm->start_data) > rlim)
- 		goto out;
-@@ -694,6 +715,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		if (vma->vm_pgoff == vm_pgoff)
-@@ -713,6 +740,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		pgoff_t vm_pglen;
-@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- 			struct vm_area_struct *prev, unsigned long addr,
- 			unsigned long end, unsigned long vm_flags,
--		     	struct anon_vma *anon_vma, struct file *file,
-+			struct anon_vma *anon_vma, struct file *file,
- 			pgoff_t pgoff, struct mempolicy *policy)
- {
- 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- 	struct vm_area_struct *area, *next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- 	/*
- 	 * We later require that vma->vm_flags == vm_flags,
- 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
- 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
- 		next = next->vm_next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (prev)
-+		prev_m = pax_find_mirror_vma(prev);
-+	if (area)
-+		area_m = pax_find_mirror_vma(area);
-+	if (next)
-+		next_m = pax_find_mirror_vma(next);
-+#endif
-+
- 	/*
- 	 * Can it merge with the predecessor?
- 	 */
-@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
- 							/* cases 1, 6 */
- 			vma_adjust(prev, prev->vm_start,
- 				next->vm_end, prev->vm_pgoff, NULL);
--		} else					/* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 2, 5, 7 */
- 			vma_adjust(prev, prev->vm_start,
- 				end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		}
- 		return prev;
- 	}
- 
-@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
-  			mpol_equal(policy, vma_policy(next)) &&
- 			can_vma_merge_before(next, vm_flags,
- 					anon_vma, file, pgoff+pglen)) {
--		if (prev && addr < prev->vm_end)	/* case 4 */
-+		if (prev && addr < prev->vm_end) {	/* case 4 */
- 			vma_adjust(prev, prev->vm_start,
- 				addr, prev->vm_pgoff, NULL);
--		else					/* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 3, 8 */
- 			vma_adjust(area, addr, next->vm_end,
- 				next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (area_m)
-+				vma_adjust(area_m, addr_m, next_m->vm_end,
-+					next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+		}
- 		return area;
- 	}
- 
-@@ -888,14 +967,11 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- 						struct file *file, long pages)
- {
--	const unsigned long stack_flags
--		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
--
- 	if (file) {
- 		mm->shared_vm += pages;
- 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- 			mm->exec_vm += pages;
--	} else if (flags & stack_flags)
-+	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- 		mm->stack_vm += pages;
- 	if (flags & (VM_RESERVED|VM_IO))
- 		mm->reserved_vm += pages;
-@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	 * (the exception is when the underlying filesystem is noexec
- 	 *  mounted, in which case we dont add PROT_EXEC.)
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- 			prot |= PROT_EXEC;
- 
-@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	/* Obtain the address to map to. we verify (or select) it and ensure
- 	 * that it represents a valid section of the address space.
- 	 */
--	addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- 	if (addr & ~PAGE_MASK)
- 		return addr;
- 
-@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
- 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT) {
-+			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
-+				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+			else
-+				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+		}
-+#endif
-+
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+		vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- 	if (flags & MAP_LOCKED)
- 		if (!can_do_mlock())
- 			return -EPERM;
-@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- 			return -EAGAIN;
- 	}
-@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
- 	if (error)
- 		return error;
- 
-+	if (!gr_acl_handle_mmap(file, prot))
-+		return -EACCES;
-+
- 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
-  */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
--	unsigned int vm_flags = vma->vm_flags;
-+	unsigned long vm_flags = vma->vm_flags;
- 
- 	/* If it was private or non-writable, the write bit is already clear */
--	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- 		return 0;
- 
- 	/* The backer wishes to know when pages are first written to? */
-@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
- 	unsigned long charged = 0;
- 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	/* Clear old maps */
- 	error = -ENOMEM;
--munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limit. */
-@@ -1163,6 +1273,16 @@ munmap_back:
- 		goto unacct_error;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			error = -ENOMEM;
-+			goto free_vma;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -1185,6 +1305,19 @@ munmap_back:
- 		error = file->f_op->mmap(file, vma);
- 		if (error)
- 			goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma_m && (vm_flags & VM_EXECUTABLE))
-+			added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+			vma->vm_flags |= VM_PAGEEXEC;
-+			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+		}
-+#endif
-+
- 		if (vm_flags & VM_EXECUTABLE)
- 			added_exe_file_vma(mm);
- 
-@@ -1208,6 +1341,11 @@ munmap_back:
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- 	file = vma->vm_file;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	/* Once vma denies write, undo our temporary denial count */
- 	if (correct_wcount)
- 		atomic_inc(&inode->i_writecount);
-@@ -1216,6 +1354,7 @@ out:
- 
- 	mm->total_vm += len >> PAGE_SHIFT;
- 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+	track_exec_limit(mm, addr, addr + len, vm_flags);
- 	if (vm_flags & VM_LOCKED) {
- 		/*
- 		 * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
- 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- 	charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- 	kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- 	if (charged)
-@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -1293,9 +1442,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				addr = TASK_UNMAPPED_BASE;
--			        start_addr = addr;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -1317,10 +1465,16 @@ full_search:
- 
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the lowest possible address?
- 	 */
--	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- 		mm->free_area_cache = addr;
- 		mm->cached_hole_size = ~0UL;
- 	}
-@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -1404,13 +1562,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--  	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-@@ -1419,6 +1585,12 @@ bottomup:
- 
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the highest possible address?
- 	 */
-@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
- 		mm->free_area_cache = addr;
- 
- 	/* dont allow allocations above current base */
--	if (mm->free_area_cache > mm->mmap_base)
-+	if (mm->free_area_cache > mm->mmap_base) {
- 		mm->free_area_cache = mm->mmap_base;
-+		mm->cached_hole_size = ~0UL;
-+	}
- }
- 
- unsigned long
-@@ -1535,6 +1709,27 @@ out:
- 	return prev ? prev->vm_next : vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *vma_m;
-+
-+	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+		BUG_ON(vma->vm_mirror);
-+		return NULL;
-+	}
-+	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+	vma_m = vma->vm_mirror;
-+	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+	BUG_ON(vma->vm_file != vma_m->vm_file);
-+	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
-+	return vma_m;
-+}
-+#endif
-+
- /*
-  * Verify that the stack growth is acceptable and
-  * update accounting. This is shared with both the
-@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
- 		return -ENOMEM;
- 
- 	/* Stack limit test */
-+	gr_learn_resource(current, RLIMIT_STACK, size, 1);
- 	if (size > rlim[RLIMIT_STACK].rlim_cur)
- 		return -ENOMEM;
- 
-@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
- 		unsigned long limit;
- 		locked = mm->locked_vm + grow;
- 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > limit && !capable(CAP_IPC_LOCK))
- 			return -ENOMEM;
- 	}
-@@ -1595,35 +1792,40 @@ static
- #endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
--	int error;
-+	int error, locknext;
- 
- 	if (!(vma->vm_flags & VM_GROWSUP))
- 		return -EFAULT;
- 
-+	/* Also guard against wrapping around to address 0. */
-+	if (address < PAGE_ALIGN(address+1))
-+		address = PAGE_ALIGN(address+1);
-+	else
-+		return -ENOMEM;
-+
- 	/*
- 	 * We must make sure the anon_vma is allocated
- 	 * so that the anon_vma locking is not a noop.
- 	 */
- 	if (unlikely(anon_vma_prepare(vma)))
- 		return -ENOMEM;
-+	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
-+		return -ENOMEM;
- 	anon_vma_lock(vma);
-+	if (locknext)
-+		anon_vma_lock(vma->vm_next);
- 
- 	/*
- 	 * vma->vm_start/vm_end cannot change under us because the caller
- 	 * is required to hold the mmap_sem in read mode.  We need the
--	 * anon_vma lock to serialize against concurrent expand_stacks.
--	 * Also guard against wrapping around to address 0.
-+	 * anon_vma locks to serialize against concurrent expand_stacks
-+	 * and expand_upwards.
- 	 */
--	if (address < PAGE_ALIGN(address+4))
--		address = PAGE_ALIGN(address+4);
--	else {
--		anon_vma_unlock(vma);
--		return -ENOMEM;
--	}
- 	error = 0;
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address > vma->vm_end) {
-+	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- 		unsigned long size, grow;
- 
- 		size = address - vma->vm_start;
-@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
- 		if (!error)
- 			vma->vm_end = address;
- 	}
-+	if (locknext)
-+		anon_vma_unlock(vma->vm_next);
- 	anon_vma_unlock(vma);
- 	return error;
- }
-@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
- static int expand_downwards(struct vm_area_struct *vma,
- 				   unsigned long address)
- {
--	int error;
-+	int error, lockprev = 0;
-+	struct vm_area_struct *prev = NULL;
- 
- 	/*
- 	 * We must make sure the anon_vma is allocated
-@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
- 	if (error)
- 		return error;
- 
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+	find_vma_prev(vma->vm_mm, address, &prev);
-+	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+	if (lockprev && unlikely(anon_vma_prepare(prev)))
-+		return -ENOMEM;
-+	if (lockprev)
-+		anon_vma_lock(prev);
-+
- 	anon_vma_lock(vma);
- 
- 	/*
-@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
- 	 */
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address < vma->vm_start) {
-+	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- 		unsigned long size, grow;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+
-+		vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- 		size = vma->vm_end - address;
- 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
- 
-@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
- 		if (!error) {
- 			vma->vm_start = address;
- 			vma->vm_pgoff -= grow;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (vma_m) {
-+				vma_m->vm_start -= grow << PAGE_SHIFT;
-+				vma_m->vm_pgoff -= grow;
-+			}
-+#endif
-+
- 		}
- 	}
- 	anon_vma_unlock(vma);
-+	if (lockprev)
-+		anon_vma_unlock(prev);
- 	return error;
- }
- 
-@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
- 	do {
- 		long nrpages = vma_pages(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+			vma = remove_vma(vma);
-+			continue;
-+		}
-+#endif
-+
- 		mm->total_vm -= nrpages;
- 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- 		vma = remove_vma(vma);
-@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
- 
- 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- 	do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma->vm_mirror) {
-+			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+			vma->vm_mirror->vm_mirror = NULL;
-+			vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+			vma->vm_mirror = NULL;
-+		}
-+#endif
-+
- 		rb_erase(&vma->vm_rb, &mm->mm_rb);
- 		mm->map_count--;
- 		tail_vma = vma;
-@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
- 	struct mempolicy *pol;
- 	struct vm_area_struct *new;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m, *new_m = NULL;
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (is_vm_hugetlb_page(vma) && (addr &
- 					~(huge_page_mask(hstate_vma(vma)))))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+		if (mm->map_count >= sysctl_max_map_count-1)
-+			return -ENOMEM;
-+	} else
-+#endif
-+
- 	if (mm->map_count >= sysctl_max_map_count)
- 		return -ENOMEM;
- 
-@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
- 	if (!new)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+		if (!new_m) {
-+			kmem_cache_free(vm_area_cachep, new);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	/* most fields are the same, copy all, and then fixup */
- 	*new = *vma;
- 
-@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
- 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		*new_m = *vma_m;
-+		new_m->vm_mirror = new;
-+		new->vm_mirror = new_m;
-+
-+		if (new_below)
-+			new_m->vm_end = addr_m;
-+		else {
-+			new_m->vm_start = addr_m;
-+			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+		}
-+	}
-+#endif
-+
- 	pol = mpol_dup(vma_policy(vma));
- 	if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (new_m)
-+			kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- 		kmem_cache_free(vm_area_cachep, new);
- 		return PTR_ERR(pol);
- 	}
-@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
- 	else
- 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		mpol_get(pol);
-+		vma_set_policy(new_m, pol);
-+
-+		if (new_m->vm_file) {
-+			get_file(new_m->vm_file);
-+			if (vma_m->vm_flags & VM_EXECUTABLE)
-+				added_exe_file_vma(mm);
-+		}
-+
-+		if (new_m->vm_ops && new_m->vm_ops->open)
-+			new_m->vm_ops->open(new_m);
-+
-+		if (new_below)
-+			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+		else
-+			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
-  * work.  This now handles partial unmappings.
-  * Jeremy Fitzhardinge <jeremy@goop.org>
-  */
-+#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
-+	int ret = __do_munmap(mm, start, len);
-+	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+		return ret;
-+
-+	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
-+{
- 	unsigned long end;
- 	struct vm_area_struct *vma, *prev, *last;
- 
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- 		return -EINVAL;
- 
-@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
- 	/* Fix up all other VM information */
- 	remove_vma_list(mm, vma);
- 
-+	track_exec_limit(mm, start, end, 0UL);
-+
- 	return 0;
- }
- 
-@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
- 
- 	profile_munmap(addr);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+		return -EINVAL;
-+#endif
-+
- 	down_write(&mm->mmap_sem);
- 	ret = do_munmap(mm, addr, len);
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
- 
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
--	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
--		WARN_ON(1);
--		up_read(&mm->mmap_sem);
--	}
--#endif
--}
--
- /*
-  *  this is really a simplified "do_mmap".  it only handles
-  *  anonymous maps.  eventually we may be able to do some
-@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
- 	struct rb_node ** rb_link, * rb_parent;
- 	pgoff_t pgoff = addr >> PAGE_SHIFT;
- 	int error;
-+	unsigned long charged;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
- 
- 	len = PAGE_ALIGN(len);
- 	if (!len)
-@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
- 
- 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- 	if (error & ~PAGE_MASK)
- 		return error;
- 
-+	charged = len >> PAGE_SHIFT;
-+
- 	/*
- 	 * mlock MCL_FUTURE?
- 	 */
- 	if (mm->def_flags & VM_LOCKED) {
- 		unsigned long locked, lock_limit;
--		locked = len >> PAGE_SHIFT;
-+		locked = charged;
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
- 	/*
- 	 * Clear old maps.  this also does some error checking for us
- 	 */
-- munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limits *after* clearing old maps... */
--	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+	if (!may_expand_vm(mm, charged))
- 		return -ENOMEM;
- 
- 	if (mm->map_count > sysctl_max_map_count)
- 		return -ENOMEM;
- 
--	if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+	if (security_vm_enough_memory(charged))
- 		return -ENOMEM;
- 
- 	/* Can we just expand an old private anonymous mapping? */
-@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
- 	 */
- 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- 	if (!vma) {
--		vm_unacct_memory(len >> PAGE_SHIFT);
-+		vm_unacct_memory(charged);
- 		return -ENOMEM;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			kmem_cache_free(vm_area_cachep, vma);
-+			vm_unacct_memory(charged);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
- 	vma->vm_page_prot = vm_get_page_prot(flags);
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
--	mm->total_vm += len >> PAGE_SHIFT;
-+	mm->total_vm += charged;
- 	if (flags & VM_LOCKED) {
- 		if (!mlock_vma_pages_range(vma, addr, addr + len))
--			mm->locked_vm += (len >> PAGE_SHIFT);
-+			mm->locked_vm += charged;
- 	}
-+	track_exec_limit(mm, addr, addr + len, flags);
- 	return addr;
- }
- 
-@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
- 	 * Walk the list again, actually closing and freeing it,
- 	 * with preemption enabled, without holding any MM locks.
- 	 */
--	while (vma)
-+	while (vma) {
-+		vma->vm_mirror = NULL;
- 		vma = remove_vma(vma);
-+	}
- 
- 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
- 	struct vm_area_struct * __vma, * prev;
- 	struct rb_node ** rb_link, * rb_parent;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- 	/*
- 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
- 	 * until its first write fault, when page's anon_vma and index
-@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
- 	if ((vma->vm_flags & VM_ACCOUNT) &&
- 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m)
-+			return -ENOMEM;
-+	}
-+#endif
-+
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	return 0;
- }
- 
-@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
- 	struct rb_node **rb_link, *rb_parent;
- 	struct mempolicy *pol;
- 
-+	BUG_ON(vma->vm_mirror);
-+
- 	/*
- 	 * If anonymous vma has not yet been faulted, update new pgoff
- 	 * to match new location, to increase its chance of merging.
-@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
- 	return new_vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *prev_m;
-+	struct rb_node **rb_link_m, *rb_parent_m;
-+	struct mempolicy *pol_m;
-+
-+	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+	*vma_m = *vma;
-+	pol_m = vma_policy(vma_m);
-+	mpol_get(pol_m);
-+	vma_set_policy(vma_m, pol_m);
-+	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+	if (vma_m->vm_file)
-+		get_file(vma_m->vm_file);
-+	if (vma_m->vm_ops && vma_m->vm_ops->open)
-+		vma_m->vm_ops->open(vma_m);
-+	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+	vma_m->vm_mirror = vma;
-+	vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
-  * Return true if the calling process may expand its vm space by the passed
-  * number of pages
-@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
- 	unsigned long lim;
- 
- 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
--
-+	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- 	if (cur + npages > lim)
- 		return 0;
- 	return 1;
-@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->pax_flags & MF_PAX_MPROTECT) {
-+		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+		else
-+			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+	}
-+#endif
-+
- 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 
-diff -urNp linux-2.6.32.12/mm/mprotect.c linux-2.6.32.12/mm/mprotect.c
---- linux-2.6.32.12/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/mprotect.c	2010-04-04 20:46:41.713805609 -0400
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
- 
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_
- 	flush_tlb_range(vma, start, end);
- }
- 
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+	unsigned long oldlimit, newlimit = 0UL;
-+
-+	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+		return;
-+
-+	spin_lock(&mm->page_table_lock);
-+	oldlimit = mm->context.user_cs_limit;
-+	if ((prot & VM_EXEC) && oldlimit < end)
-+		/* USER_CS limit moved up */
-+		newlimit = end;
-+	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+		/* USER_CS limit moved down */
-+		newlimit = start;
-+
-+	if (newlimit) {
-+		mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+		wmb();
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+	}
-+	spin_unlock(&mm->page_table_lock);
-+	if (newlimit == end) {
-+		struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+		for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+			if (is_vm_hugetlb_page(vma))
-+				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+			else
-+				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+	}
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- 	unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
- 	int error;
- 	int dirty_accountable = 0;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+	unsigned long start_m, end_m;
-+
-+	start_m = start + SEGMEXEC_TASK_SIZE;
-+	end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (newflags == oldflags) {
- 		*pprev = vma;
- 		return 0;
-@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+		if (start != vma->vm_start) {
-+			error = split_vma(mm, vma, start, 1);
-+			if (error)
-+				goto fail;
-+			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+			*pprev = (*pprev)->vm_next;
-+		}
-+
-+		if (end != vma->vm_end) {
-+			error = split_vma(mm, vma, end, 0);
-+			if (error)
-+				goto fail;
-+		}
-+
-+		if (pax_find_mirror_vma(vma)) {
-+			error = __do_munmap(mm, start_m, end_m - start_m);
-+			if (error)
-+				goto fail;
-+		} else {
-+			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+			if (!vma_m) {
-+				error = -ENOMEM;
-+				goto fail;
-+			}
-+			vma->vm_flags = newflags;
-+			pax_mirror_vma(vma_m, vma);
-+		}
-+	}
-+#endif
-+
- 	/*
- 	 * First try to merge with previous and/or next vma.
- 	 */
-@@ -196,8 +284,14 @@ success:
- 	 * held in write mode.
- 	 */
- 	vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->binfmt && mm->binfmt->handle_mprotect)
-+		mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
--					  vm_get_page_prot(newflags));
-+					  vm_get_page_prot(vma->vm_flags));
- 
- 	if (vma_wants_writenotify(vma)) {
- 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	end = start + len;
- 	if (end <= start)
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (!arch_validate_prot(prot))
- 		return -EINVAL;
- 
-@@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	/*
- 	 * Does the application expect PROT_READ to imply PROT_EXEC:
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		prot |= PROT_EXEC;
- 
- 	vm_flags = calc_vm_prot_bits(prot);
-@@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	if (start > vma->vm_start)
- 		prev = vma;
- 
-+	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+		current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- 	for (nstart = start ; ; ) {
- 		unsigned long newflags;
- 
-@@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 		if (error)
- 			goto out;
- 		perf_event_mmap(vma);
-+
-+		track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- 		nstart = tmp;
- 
- 		if (nstart < prev->vm_end)
-diff -urNp linux-2.6.32.12/mm/mremap.c linux-2.6.32.12/mm/mremap.c
---- linux-2.6.32.12/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/mremap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
- 			continue;
- 		pte = ptep_clear_flush(vma, old_addr, old_pte);
- 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+			pte = pte_exprotect(pte);
-+#endif
-+
- 		set_pte_at(mm, new_addr, new_pte, pte);
- 	}
- 
-@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
- 	if (is_vm_hugetlb_page(vma))
- 		goto Einval;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		goto Einval;
-+#endif
-+
- 	/* We can't remap across vm area boundaries */
- 	if (old_len > vma->vm_end - addr)
- 		goto Efault;
-@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
- 	unsigned long map_flags;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (new_addr & ~PAGE_MASK)
- 		goto out;
- 
--	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- 		goto out;
- 
- 	/* Check if the location we're moving into overlaps the
- 	 * old location at all, and fail if it does.
- 	 */
--	if ((new_addr <= addr) && (new_addr+new_len) > addr)
--		goto out;
--
--	if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+	if (addr + old_len > new_addr && new_addr + new_len > addr)
- 		goto out;
- 
- 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
- 	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- 		goto out;
-@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
- 	if (!new_len)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+	    old_len > pax_task_size || addr > pax_task_size-old_len)
-+		goto out;
-+
- 	if (flags & MREMAP_FIXED) {
- 		if (flags & MREMAP_MAYMOVE)
- 			ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
- 						   addr + new_len);
- 			}
- 			ret = addr;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- 			goto out;
- 		}
- 	}
-@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
- 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- 		if (ret)
- 			goto out;
-+
-+		map_flags = vma->vm_flags;
- 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+		if (!(ret & ~PAGE_MASK)) {
-+			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+		}
- 	}
- out:
- 	if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.32.12/mm/nommu.c linux-2.6.32.12/mm/nommu.c
---- linux-2.6.32.12/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/nommu.c	2010-04-04 20:46:41.713805609 -0400
-@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
- EXPORT_SYMBOL(find_vma);
- 
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
--	return find_vma(mm, addr);
--}
--
--/*
-  * expand a stack to a given address
-  * - not supported under NOMMU conditions
-  */
-diff -urNp linux-2.6.32.12/mm/page_alloc.c linux-2.6.32.12/mm/page_alloc.c
---- linux-2.6.32.12/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/page_alloc.c	2010-04-29 17:46:37.045244082 -0400
-@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
- 	int bad = 0;
- 	int wasMlocked = __TestClearPageMlocked(page);
- 
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	unsigned long index = 1UL << order;
-+#endif
-+
- 	kmemcheck_free_shadow(page, order);
- 
- 	for (i = 0 ; i < (1 << order) ; ++i)
-@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
- 		debug_check_no_obj_freed(page_address(page),
- 					   PAGE_SIZE << order);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	for (; index; --index)
-+		sanitize_highpage(page + index - 1);
-+#endif
-+
- 	arch_free_page(page, order);
- 	kernel_map_pages(page, 1 << order, 0);
- 
-@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
- 	arch_alloc_page(page, order);
- 	kernel_map_pages(page, 1 << order, 1);
- 
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- 	if (gfp_flags & __GFP_ZERO)
- 		prep_zero_page(page, order, gfp_flags);
-+#endif
- 
- 	if (order && (gfp_flags & __GFP_COMP))
- 		prep_compound_page(page, order);
-@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
- 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	sanitize_highpage(page);
-+#endif
-+
- 	arch_free_page(page, 0);
- 	kernel_map_pages(page, 1, 0);
- 
-@@ -3723,7 +3740,7 @@ static void __init setup_usemap(struct p
- 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
- }
- #else
--static void inline setup_usemap(struct pglist_data *pgdat,
-+static inline void setup_usemap(struct pglist_data *pgdat,
- 				struct zone *zone, unsigned long zonesize) {}
- #endif /* CONFIG_SPARSEMEM */
- 
-diff -urNp linux-2.6.32.12/mm/percpu.c linux-2.6.32.12/mm/percpu.c
---- linux-2.6.32.12/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/percpu.c	2010-04-04 20:46:41.713805609 -0400
-@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
- static unsigned int pcpu_last_unit_cpu __read_mostly;
- 
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
- 
- static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
-diff -urNp linux-2.6.32.12/mm/rmap.c linux-2.6.32.12/mm/rmap.c
---- linux-2.6.32.12/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/rmap.c	2010-04-04 20:46:41.713805609 -0400
-@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
- 		struct mm_struct *mm = vma->vm_mm;
- 		struct anon_vma *allocated;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+#endif
-+
- 		anon_vma = find_mergeable_anon_vma(vma);
- 		allocated = NULL;
- 		if (!anon_vma) {
-@@ -121,6 +125,15 @@ int anon_vma_prepare(struct vm_area_stru
- 		/* page_table_lock to protect against threads */
- 		spin_lock(&mm->page_table_lock);
- 		if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			vma_m = pax_find_mirror_vma(vma);
-+			if (vma_m) {
-+				vma_m->anon_vma = anon_vma;
-+				__anon_vma_link(vma_m);
-+			}
-+#endif
-+
- 			vma->anon_vma = anon_vma;
- 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- 			allocated = NULL;
-diff -urNp linux-2.6.32.12/mm/shmem.c linux-2.6.32.12/mm/shmem.c
---- linux-2.6.32.12/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/shmem.c	2010-04-04 20:46:41.716811517 -0400
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
- 
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
- 
- #ifdef CONFIG_SHMEM
- /*
-diff -urNp linux-2.6.32.12/mm/slab.c linux-2.6.32.12/mm/slab.c
---- linux-2.6.32.12/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/slab.c	2010-04-04 20:46:41.716811517 -0400
-@@ -308,7 +308,7 @@ struct kmem_list3 {
-  * Need this for bootstrapping a per node allocator.
-  */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define	CACHE_CACHE 0
- #define	SIZE_AC MAX_NUMNODES
- #define	SIZE_L3 (2 * MAX_NUMNODES)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
-  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
-  */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
--					const struct slab *slab, void *obj)
-+					const struct slab *slab, const void *obj)
- {
- 	u32 offset = (obj - slab->s_mem);
- 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -584,14 +584,14 @@ struct cache_names {
- static struct cache_names __initdata cache_names[] = {
- #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
- #include <linux/kmalloc_sizes.h>
--	{NULL,}
-+	{NULL, NULL}
- #undef CACHE
- };
- 
- static struct arraycache_init initarray_cache __initdata =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- static struct arraycache_init initarray_generic =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- 
- /* internal cache of cache description objs */
- static struct kmem_cache cache_cache = {
-@@ -4082,7 +4082,7 @@ out:
- 	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
- }
- 
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- 
- static void print_slabinfo_header(struct seq_file *m)
- {
-@@ -4480,6 +4480,51 @@ static int __init slab_proc_init(void)
- module_init(slab_proc_init);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct kmem_cache *cachep;
-+	struct slab *slabp;
-+	struct page *page;
-+	unsigned int objnr;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = virt_to_head_page(ptr);
-+
-+	if (!PageSlab(page)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	cachep = page_get_cache(page);
-+	slabp = page_get_slab(page);
-+	objnr = obj_to_index(cachep, slabp, ptr);
-+	BUG_ON(objnr >= cachep->num);
-+	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /**
-  * ksize - get the actual amount of memory allocated for a given object
-  * @objp: Pointer to the object
-diff -urNp linux-2.6.32.12/mm/slob.c linux-2.6.32.12/mm/slob.c
---- linux-2.6.32.12/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/slob.c	2010-04-04 20:46:41.716811517 -0400
-@@ -29,7 +29,7 @@
-  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
-  * alloc_pages() directly, allocating compound pages so the page order
-  * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
-  * provide ksize(). These objects are detected in kfree() because slob_page()
-  * is false for them.
-  *
-@@ -58,6 +58,7 @@
-  */
- 
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- 			unsigned long flags;	/* mandatory */
- 			atomic_t _count;	/* mandatory */
- 			slobidx_t units;	/* free units left in page */
--			unsigned long pad[2];
-+			unsigned long pad[1];
-+			unsigned long size;	/* size when >=PAGE_SIZE */
- 			slob_t *free;		/* first free slob_t in page */
- 			struct list_head list;	/* linked list of free pages */
- 		};
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
-  */
- static inline int is_slob_page(struct slob_page *sp)
- {
--	return PageSlab((struct page *)sp);
-+	return PageSlab((struct page *)sp) && !sp->size;
- }
- 
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
- 
- static inline struct slob_page *slob_page(const void *addr)
- {
--	return (struct slob_page *)virt_to_page(addr);
-+	return (struct slob_page *)virt_to_head_page(addr);
- }
- 
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
- /*
-  * Return the size of a slob block.
-  */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- 	if (s->units > 0)
- 		return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
-  * Return the next free slob block pointer after this one.
-  */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- 	slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
-  * Returns true if s is the last free block in its page.
-  */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
- 	if (!page)
- 		return NULL;
- 
-+	set_slob_page(page);
- 	return page_address(page);
- }
- 
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
- 		if (!b)
- 			return NULL;
- 		sp = slob_page(b);
--		set_slob_page(sp);
- 
- 		spin_lock_irqsave(&slob_lock, flags);
- 		sp->units = SLOB_UNITS(PAGE_SIZE);
- 		sp->free = b;
-+		sp->size = 0;
- 		INIT_LIST_HEAD(&sp->list);
- 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- 		set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
- 
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
--	unsigned int *m;
--	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+	slob_t *m;
- 	void *ret;
- 
- 	lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		if (!m)
- 			return NULL;
--		*m = size;
-+		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+		m[0].units = size;
-+		m[1].units = align;
- 		ret = (void *)m + align;
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- 		if (ret) {
--			struct page *page;
--			page = virt_to_page(ret);
--			page->private = size;
-+			struct slob_page *sp;
-+			sp = slob_page(ret);
-+			sp->size = size;
- 		}
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
- 	kmemleak_alloc(ret, size, 1, gfp);
- 	return ret;
- }
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+
-+	return __kmalloc_node_align(size, gfp, node, align);
-+}
- EXPORT_SYMBOL(__kmalloc_node);
- 
- void kfree(const void *block)
-@@ -528,13 +540,84 @@ void kfree(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		slob_free(m, *m + align);
--	} else
-+		slob_t *m = (slob_t *)(block - align);
-+		slob_free(m, m[0].units + align);
-+	} else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		put_page(&sp->page);
-+	}
- }
- EXPORT_SYMBOL(kfree);
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct slob_page *sp;
-+	const slob_t *free;
-+	const void *base;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	sp = slob_page(ptr);
-+	if (!PageSlab((struct page*)sp)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	if (sp->size) {
-+		base = page_address(&sp->page);
-+		if (base <= ptr && n <= sp->size - (ptr - base))
-+			return;
-+		goto report;
-+	}
-+
-+	/* some tricky double walking to find the chunk */
-+	base = (void *)((unsigned long)ptr & PAGE_MASK);
-+	free = sp->free;
-+
-+	while (!slob_last(free) && (void *)free <= ptr) {
-+		base = free + slob_units(free);
-+		free = slob_next(free);
-+	}
-+
-+	while (base < (void *)free) {
-+		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+		int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+		int offset;
-+
-+		if (ptr < base + align)
-+			goto report;
-+
-+		offset = ptr - base - align;
-+		if (offset < m) {
-+			if (n <= m - offset)
-+				return;
-+			goto report;
-+		}
-+		base += size;
-+	}
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +630,10 @@ size_t ksize(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		return SLOB_UNITS(*m) * SLOB_UNIT;
-+		slob_t *m = (slob_t *)(block - align);
-+		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- 	} else
--		return sp->page.private;
-+		return sp->size;
- }
- EXPORT_SYMBOL(ksize);
- 
-@@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
- {
- 	void *b;
- 
-+#ifdef CONFIG_PAX_USERCOPY
-+	b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- 	if (c->size < PAGE_SIZE) {
- 		b = slob_alloc(c->size, flags, c->align, node);
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    SLOB_UNITS(c->size) * SLOB_UNIT,
- 					    flags, node);
- 	} else {
-+		struct slob_page *sp;
-+
- 		b = slob_new_pages(flags, get_order(c->size), node);
-+		sp = slob_page(b);
-+		sp->size = c->size;
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    PAGE_SIZE << get_order(c->size),
- 					    flags, node);
- 	}
-+#endif
- 
- 	if (c->ctor)
- 		c->ctor(b);
-@@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
- 
- static void __kmem_cache_free(void *b, int size)
- {
--	if (size < PAGE_SIZE)
-+	struct slob_page *sp = slob_page(b);
-+
-+	if (is_slob_page(sp))
- 		slob_free(b, size);
--	else
-+	else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		slob_free_pages(b, get_order(size));
-+	}
- }
- 
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
- 
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+	int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	if (size + c->align < PAGE_SIZE) {
-+		size += c->align;
-+		b -= c->align;
-+	}
-+#endif
-+
- 	kmemleak_free_recursive(b, c->flags);
- 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- 		struct slob_rcu *slob_rcu;
--		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+		slob_rcu = b + (size - sizeof(struct slob_rcu));
- 		INIT_RCU_HEAD(&slob_rcu->head);
--		slob_rcu->size = c->size;
-+		slob_rcu->size = size;
- 		call_rcu(&slob_rcu->head, kmem_rcu_free);
- 	} else {
--		__kmem_cache_free(b, c->size);
-+		__kmem_cache_free(b, size);
- 	}
- 
- 	trace_kmem_cache_free(_RET_IP_, b);
-diff -urNp linux-2.6.32.12/mm/slub.c linux-2.6.32.12/mm/slub.c
---- linux-2.6.32.12/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/slub.c	2010-04-04 20:46:41.716811517 -0400
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
- 
- 	page = virt_to_head_page(x);
- 
-+	BUG_ON(!PageSlab(page));
-+
- 	slab_free(s, page, x, _RET_IP_);
- 
- 	trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
-  * Merge control. If this is set then no merging of slab caches will occur.
-  * (Could be removed. This was introduced to pacify the merge skeptics.)
-  */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
- 
- /*
-  * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
- 	 * list to avoid pounding the page allocator excessively.
- 	 */
- 	set_min_partial(s, ilog2(s->size));
--	s->refcount = 1;
-+	atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- 	s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- 	down_write(&slub_lock);
--	s->refcount--;
--	if (!s->refcount) {
-+	if (atomic_dec_and_test(&s->refcount)) {
- 		list_del(&s->list);
- 		up_write(&slub_lock);
- 		if (kmem_cache_close(s)) {
-@@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t 
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct page *page;
-+	struct kmem_cache *s;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = get_object_page(ptr);
-+
-+	if (!page) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	s = page->slab;
-+	offset = (ptr - page_address(page)) % s->size;
-+	if (offset <= s->objsize && n <= s->objsize - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- size_t ksize(const void *object)
- {
- 	struct page *page;
-@@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
- 	 */
- 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
- 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
--	kmalloc_caches[0].refcount = -1;
-+	atomic_set(&kmalloc_caches[0].refcount, -1);
- 	caches++;
- 
- 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
- 	/*
- 	 * We may have set a slab to be unmergeable during bootstrap.
- 	 */
--	if (s->refcount < 0)
-+	if (atomic_read(&s->refcount) < 0)
- 		return 1;
- 
- 	return 0;
-@@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
- 	if (s) {
- 		int cpu;
- 
--		s->refcount++;
-+		atomic_inc(&s->refcount);
- 		/*
- 		 * Adjust the object sizes so that we clear
- 		 * the complete object on kzalloc.
-@@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
- 
- 		if (sysfs_slab_alias(s, name)) {
- 			down_write(&slub_lock);
--			s->refcount--;
-+			atomic_dec(&s->refcount);
- 			up_write(&slub_lock);
- 			goto err;
- 		}
-@@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
- 
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
--	return sprintf(buf, "%d\n", s->refcount - 1);
-+	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
- 
-@@ -4503,7 +4544,7 @@ static void kmem_cache_release(struct ko
- 	kfree(s);
- }
- 
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- 	.show = slab_attr_show,
- 	.store = slab_attr_store,
- };
-@@ -4522,7 +4563,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-@@ -4696,7 +4737,7 @@ __initcall(slab_sysfs_init);
- /*
-  * The /proc/slabinfo ABI
-  */
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static void print_slabinfo_header(struct seq_file *m)
- {
- 	seq_puts(m, "slabinfo - version: 2.1\n");
-diff -urNp linux-2.6.32.12/mm/util.c linux-2.6.32.12/mm/util.c
---- linux-2.6.32.12/mm/util.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/util.c	2010-04-04 20:46:41.716811517 -0400
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 	mm->get_unmapped_area = arch_get_unmapped_area;
- 	mm->unmap_area = arch_unmap_area;
- }
-diff -urNp linux-2.6.32.12/mm/vmalloc.c linux-2.6.32.12/mm/vmalloc.c
---- linux-2.6.32.12/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/mm/vmalloc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
- 
- 	pte = pte_offset_kernel(pmd, addr);
- 	do {
--		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
--		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+			BUG_ON(!pte_exec(*pte));
-+			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+			continue;
-+		}
-+#endif
-+
-+		{
-+			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+		}
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
- }
- 
-@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
- 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
- {
- 	pte_t *pte;
-+	int ret = -ENOMEM;
- 
- 	/*
- 	 * nr is a running index into the array which helps higher level
-@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
- 	pte = pte_alloc_kernel(pmd, addr);
- 	if (!pte)
- 		return -ENOMEM;
-+
-+	pax_open_kernel();
- 	do {
- 		struct page *page = pages[*nr];
- 
--		if (WARN_ON(!pte_none(*pte)))
--			return -EBUSY;
--		if (WARN_ON(!page))
--			return -ENOMEM;
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (pgprot_val(prot) & _PAGE_NX)
-+#endif
-+
-+		if (WARN_ON(!pte_none(*pte))) {
-+			ret = -EBUSY;
-+			goto out;
-+		}
-+		if (WARN_ON(!page)) {
-+			ret = -ENOMEM;
-+			goto out;
-+		}
- 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- 		(*nr)++;
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
--	return 0;
-+	ret = 0;
-+out:
-+	pax_close_kernel();
-+	return ret;
- }
- 
- static int vmap_pmd_range(pud_t *pud, unsigned long addr,
-@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
- 	 * and fall back on vmalloc() if that fails. Others
- 	 * just put it in the vmalloc space.
- 	 */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- 	unsigned long addr = (unsigned long)x;
- 	if (addr >= MODULES_VADDR && addr < MODULES_END)
- 		return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+		return 1;
-+#endif
-+
-+#endif
-+
- 	return is_vmalloc_addr(x);
- }
- 
-@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
- 	struct rb_node *tmp;
- 
- 	while (*p) {
--		struct vmap_area *tmp;
-+		struct vmap_area *varea;
- 
- 		parent = *p;
--		tmp = rb_entry(parent, struct vmap_area, rb_node);
--		if (va->va_start < tmp->va_end)
-+		varea = rb_entry(parent, struct vmap_area, rb_node);
-+		if (va->va_start < varea->va_end)
- 			p = &(*p)->rb_left;
--		else if (va->va_end > tmp->va_start)
-+		else if (va->va_end > varea->va_start)
- 			p = &(*p)->rb_right;
- 		else
- 			BUG();
-@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
- 	struct vm_struct *area;
- 
- 	BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (flags & VM_KERNEXEC) {
-+		if (start != VMALLOC_START || end != VMALLOC_END)
-+			return NULL;
-+		start = (unsigned long)&MODULES_EXEC_VADDR;
-+		end = (unsigned long)&MODULES_EXEC_END;
-+	}
-+#endif
-+
- 	if (flags & VM_IOREMAP) {
- 		int bit = fls(size);
- 
-@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
- 	if (count > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		flags |= VM_KERNEXEC;
-+#endif
-+
- 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- 					__builtin_return_address(0));
- 	if (!area)
-@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
- 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
-+						node, gfp_mask, caller);
-+	else
-+#endif
-+
- 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
- 				  VMALLOC_END, node, gfp_mask, caller);
- 
-@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
- 	return addr;
- }
- 
-+#undef __vmalloc
- void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
- {
- 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
-@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc
- void *vmalloc(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
-  * The resulting memory area is zeroed so it can be mapped to userspace
-  * without leaking data.
-  */
-+#undef vmalloc_user
- void *vmalloc_user(unsigned long size)
- {
- 	struct vm_struct *area;
-@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc_node
- void *vmalloc_node(unsigned long size, int node)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
--
-+#undef vmalloc_exec
- void *vmalloc_exec(unsigned long size)
- {
--	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- 			      -1, __builtin_return_address(0));
- }
- 
-@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
-  *	Allocate enough 32bit PA addressable pages to cover @size from the
-  *	page level allocator and map them into contiguous kernel virtual space.
-  */
-+#undef vmalloc_32
- void *vmalloc_32(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
-@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
-  * The resulting memory area is 32bit addressable and zeroed so it can be
-  * mapped to userspace without leaking data.
-  */
-+#undef vmalloc_32_user
- void *vmalloc_32_user(unsigned long size)
- {
- 	struct vm_struct *area;
-diff -urNp linux-2.6.32.12/net/8021q/vlan.c linux-2.6.32.12/net/8021q/vlan.c
---- linux-2.6.32.12/net/8021q/vlan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/8021q/vlan.c	2010-04-29 17:46:37.373258882 -0400
-@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
- 		err = -EPERM;
- 		if (!capable(CAP_NET_ADMIN))
- 			break;
--		if ((args.u.name_type >= 0) &&
--		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
-+		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
- 			struct vlan_net *vn;
- 
- 			vn = net_generic(net, vlan_net_id);
-diff -urNp linux-2.6.32.12/net/atm/atm_misc.c linux-2.6.32.12/net/atm/atm_misc.c
---- linux-2.6.32.12/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/atm/atm_misc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
- 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- 		return 1;
- 	atm_return(vcc,truesize);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return 0;
- }
- 
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
- 		}
- 	}
- 	atm_return(vcc,guess);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return NULL;
- }
- 
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
- 
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
- 
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.12/net/atm/proc.c linux-2.6.32.12/net/atm/proc.c
---- linux-2.6.32.12/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/atm/proc.c	2010-04-04 20:46:41.716811517 -0400
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
-   const struct k_atm_aal_stats *stats)
- {
- 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
--	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
--	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
--	    atomic_read(&stats->rx_drop));
-+	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+	    atomic_read_unchecked(&stats->rx_drop));
- }
- 
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-diff -urNp linux-2.6.32.12/net/atm/resources.c linux-2.6.32.12/net/atm/resources.c
---- linux-2.6.32.12/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/atm/resources.c	2010-04-04 20:46:41.716811517 -0400
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
- static void copy_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.12/net/bridge/br_private.h linux-2.6.32.12/net/bridge/br_private.h
---- linux-2.6.32.12/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/bridge/br_private.h	2010-04-04 20:46:41.716811517 -0400
-@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
- 
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
- 
- /* br_sysfs_br.c */
-diff -urNp linux-2.6.32.12/net/bridge/br_stp_if.c linux-2.6.32.12/net/bridge/br_stp_if.c
---- linux-2.6.32.12/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/bridge/br_stp_if.c	2010-04-04 20:46:41.716811517 -0400
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
- 	char *envp[] = { NULL };
- 
- 	if (br->stp_enabled == BR_USER_STP) {
--		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- 			br->dev->name, r);
- 
-diff -urNp linux-2.6.32.12/net/bridge/br_sysfs_if.c linux-2.6.32.12/net/bridge/br_sysfs_if.c
---- linux-2.6.32.12/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/bridge/br_sysfs_if.c	2010-04-04 20:46:41.716811517 -0400
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
- 	return ret;
- }
- 
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- 	.show = brport_show,
- 	.store = brport_store,
- };
-diff -urNp linux-2.6.32.12/net/core/dev.c linux-2.6.32.12/net/core/dev.c
---- linux-2.6.32.12/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/core/dev.c	2010-04-04 20:46:41.721901011 -0400
-@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
- 
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
- 
-@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
- EXPORT_SYMBOL(netif_napi_del);
- 
- 
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- 	unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.32.12/net/core/flow.c linux-2.6.32.12/net/core/flow.c
---- linux-2.6.32.12/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/core/flow.c	2010-04-04 20:46:41.721901011 -0400
-@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
- 
- static u32 flow_hash_shift;
- #define flow_hash_size	(1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
- 
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
- 
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- 	u32 hash_rnd;
- 	int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
- 
- #define flow_hash_rnd_recalc(cpu) \
- 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- 	atomic_t cpuleft;
- 	struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
- 
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
- 
-diff -urNp linux-2.6.32.12/net/dccp/ccids/ccid3.c linux-2.6.32.12/net/dccp/ccids/ccid3.c
---- linux-2.6.32.12/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/dccp/ccids/ccid3.c	2010-04-04 20:46:41.721901011 -0400
-@@ -41,7 +41,7 @@
- static int ccid3_debug;
- #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
- #else
--#define ccid3_pr_debug(format, a...)
-+#define ccid3_pr_debug(format, a...) do {} while (0)
- #endif
- 
- /*
-diff -urNp linux-2.6.32.12/net/dccp/dccp.h linux-2.6.32.12/net/dccp/dccp.h
---- linux-2.6.32.12/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/dccp/dccp.h	2010-04-04 20:46:41.721901011 -0400
-@@ -44,9 +44,9 @@ extern int dccp_debug;
- #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
- #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
- #else
--#define dccp_pr_debug(format, a...)
--#define dccp_pr_debug_cat(format, a...)
--#define dccp_debug(format, a...)
-+#define dccp_pr_debug(format, a...) do {} while (0)
-+#define dccp_pr_debug_cat(format, a...) do {} while (0)
-+#define dccp_debug(format, a...) do {} while (0)
- #endif
- 
- extern struct inet_hashinfo dccp_hashinfo;
-diff -urNp linux-2.6.32.12/net/decnet/sysctl_net_decnet.c linux-2.6.32.12/net/decnet/sysctl_net_decnet.c
---- linux-2.6.32.12/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/decnet/sysctl_net_decnet.c	2010-04-04 20:46:41.721901011 -0400
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, addr, len))
-+	if (len > sizeof addr || copy_to_user(buffer, addr, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, devname, len))
-+	if (len > sizeof devname || copy_to_user(buffer, devname, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-diff -urNp linux-2.6.32.12/net/ipv4/inet_hashtables.c linux-2.6.32.12/net/ipv4/inet_hashtables.c
---- linux-2.6.32.12/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/inet_hashtables.c	2010-04-04 20:46:41.721901011 -0400
-@@ -18,11 +18,14 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
- 
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/ip.h>
- 
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
-  * Allocate and initialize a new local port bind bucket.
-  * The bindhash mutex for snum's hash chain must be held here.
-@@ -490,6 +493,8 @@ ok:
- 		}
- 		spin_unlock(&head->lock);
- 
-+		gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- 		if (tw) {
- 			inet_twsk_deschedule(tw, death_row);
- 			inet_twsk_put(tw);
-diff -urNp linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-04-04 20:46:41.721901011 -0400
-@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
- 
- 	*len = 0;
- 
--	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
-+	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
- 	if (*octets == NULL) {
- 		if (net_ratelimit())
- 			printk("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.32.12/net/ipv4/tcp_ipv4.c linux-2.6.32.12/net/ipv4/tcp_ipv4.c
---- linux-2.6.32.12/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/tcp_ipv4.c	2010-04-04 20:46:41.721901011 -0400
-@@ -84,6 +84,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
- 
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- 	TCP_SKB_CB(skb)->sacked	 = 0;
- 
- 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
--	if (!sk)
-+	if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 1;
-+#endif
- 		goto no_tcp_socket;
-+	}
- 
- process:
--	if (sk->sk_state == TCP_TIME_WAIT)
-+	if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 2;
-+#endif
- 		goto do_time_wait;
-+	}
- 
- 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- 		goto discard_and_relse;
-@@ -1650,6 +1661,10 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (!grsec_enable_blackhole || (ret == 1 &&
-+		    (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- 		tcp_v4_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.12/net/ipv4/tcp_minisocks.c linux-2.6.32.12/net/ipv4/tcp_minisocks.c
---- linux-2.6.32.12/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/tcp_minisocks.c	2010-04-04 20:46:41.721901011 -0400
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
- 
- embryonic_reset:
- 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole)
-+#endif
- 	if (!(flg & TCP_FLAG_RST))
- 		req->rsk_ops->send_reset(sk, skb);
- 
-diff -urNp linux-2.6.32.12/net/ipv4/tcp_probe.c linux-2.6.32.12/net/ipv4/tcp_probe.c
---- linux-2.6.32.12/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/tcp_probe.c	2010-04-04 20:46:41.721901011 -0400
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
- 		if (cnt + width >= len)
- 			break;
- 
--		if (copy_to_user(buf + cnt, tbuf, width))
-+		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- 			return -EFAULT;
- 		cnt += width;
- 	}
-diff -urNp linux-2.6.32.12/net/ipv4/tcp_timer.c linux-2.6.32.12/net/ipv4/tcp_timer.c
---- linux-2.6.32.12/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/tcp_timer.c	2010-04-04 20:46:41.721901011 -0400
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
- 		}
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if ((sk->sk_state == TCP_LAST_ACK) &&
-+	    (grsec_lastack_retries > 0) &&
-+	    (grsec_lastack_retries < retry_until))
-+		retry_until = grsec_lastack_retries;
-+#endif
-+
- 	if (retransmits_timed_out(sk, retry_until)) {
- 		/* Has it gone just too far? */
- 		tcp_write_err(sk);
-diff -urNp linux-2.6.32.12/net/ipv4/udp.c linux-2.6.32.12/net/ipv4/udp.c
---- linux-2.6.32.12/net/ipv4/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv4/udp.c	2010-04-04 20:46:41.724917264 -0400
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
- 
-@@ -371,6 +376,9 @@ found:
- 	return s;
- }
- 
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
-  * This routine is called by the ICMP module when it gets some
-  * sort of error condition.  If err < 0 then the socket should
-@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
- 		dport = usin->sin_port;
- 		if (dport == 0)
- 			return -EINVAL;
-+
-+		err = gr_search_udp_sendmsg(sk, usin);
-+		if (err)
-+			return err;
- 	} else {
- 		if (sk->sk_state != TCP_ESTABLISHED)
- 			return -EDESTADDRREQ;
-+
-+		err = gr_search_udp_sendmsg(sk, NULL);
-+		if (err)
-+			return err;
-+
- 		daddr = inet->daddr;
- 		dport = inet->dport;
- 		/* Open fast path for connected socket.
-@@ -945,6 +962,10 @@ try_again:
- 	if (!skb)
- 		goto out;
- 
-+	err = gr_search_udp_recvmsg(sk, skb);
-+	if (err)
-+		goto out_free;
-+
- 	ulen = skb->len - sizeof(struct udphdr);
- 	copied = len;
- 	if (copied > ulen)
-@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
- 		goto csum_error;
- 
- 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
- 
- 	/*
-diff -urNp linux-2.6.32.12/net/ipv6/exthdrs.c linux-2.6.32.12/net/ipv6/exthdrs.c
---- linux-2.6.32.12/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv6/exthdrs.c	2010-04-04 20:46:41.724917264 -0400
-@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
- 		.type	= IPV6_TLV_JUMBO,
- 		.func	= ipv6_hop_jumbo,
- 	},
--	{ -1, }
-+	{ -1, NULL }
- };
- 
- int ipv6_parse_hopopts(struct sk_buff *skb)
-diff -urNp linux-2.6.32.12/net/ipv6/raw.c linux-2.6.32.12/net/ipv6/raw.c
---- linux-2.6.32.12/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv6/raw.c	2010-04-04 20:46:41.724917264 -0400
-@@ -600,7 +600,7 @@ out:
- 	return err;
- }
- 
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- 			struct flowi *fl, struct rt6_info *rt,
- 			unsigned int flags)
- {
-diff -urNp linux-2.6.32.12/net/ipv6/tcp_ipv6.c linux-2.6.32.12/net/ipv6/tcp_ipv6.c
---- linux-2.6.32.12/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv6/tcp_ipv6.c	2010-04-04 20:46:41.724917264 -0400
-@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
- 	return 0;
- 
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	tcp_v6_send_reset(sk, skb);
- discard:
- 	if (opt_skb)
-@@ -1700,6 +1703,9 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		tcp_v6_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.12/net/ipv6/udp.c linux-2.6.32.12/net/ipv6/udp.c
---- linux-2.6.32.12/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/ipv6/udp.c	2010-04-04 20:46:41.724917264 -0400
-@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
- 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- 				proto == IPPROTO_UDPLITE);
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
- 
- 		kfree_skb(skb);
-diff -urNp linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/irda/ircomm/ircomm_tty.c	2010-04-04 20:46:41.724917264 -0400
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
- 	add_wait_queue(&self->open_wait, &wait);
- 
- 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 	/* As far as I can see, we protect open_count - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	if (!tty_hung_up_p(filp)) {
- 		extra_count = 1;
--		self->open_count--;
-+		atomic_dec(&self->open_count);
- 	}
- 	spin_unlock_irqrestore(&self->spinlock, flags);
--	self->blocked_open++;
-+	atomic_inc(&self->blocked_open);
- 
- 	while (1) {
- 		if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
- 		}
- 
- 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
--		      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 		schedule();
- 	}
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
- 	if (extra_count) {
- 		/* ++ is not atomic, so this should be protected - Jean II */
- 		spin_lock_irqsave(&self->spinlock, flags);
--		self->open_count++;
-+		atomic_inc(&self->open_count);
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 	}
--	self->blocked_open--;
-+	atomic_dec(&self->blocked_open);
- 
- 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count);
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
- 
- 	if (!retval)
- 		self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
- 	}
- 	/* ++ is not atomic, so this should be protected - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
--	self->open_count++;
-+	atomic_inc(&self->open_count);
- 
- 	tty->driver_data = self;
- 	self->tty = tty;
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
--		   self->line, self->open_count);
-+		   self->line, atomic_read(&self->open_count));
- 
- 	/* Not really used by us, but lets do it anyway */
- 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
- 		return;
- 	}
- 
--	if ((tty->count == 1) && (self->open_count != 1)) {
-+	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
- 		/*
- 		 * Uh, oh.  tty->count is 1, which means that the tty
- 		 * structure will be freed.  state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
- 		 */
- 		IRDA_DEBUG(0, "%s(), bad serial port count; "
- 			   "tty->count is 1, state->count is %d\n", __func__ ,
--			   self->open_count);
--		self->open_count = 1;
-+			   atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 1);
- 	}
- 
--	if (--self->open_count < 0) {
-+	if (atomic_dec_return(&self->open_count) < 0) {
- 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
--			   __func__, self->line, self->open_count);
--		self->open_count = 0;
-+			   __func__, self->line, atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 0);
- 	}
--	if (self->open_count) {
-+	if (atomic_read(&self->open_count)) {
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
- 	tty->closing = 0;
- 	self->tty = NULL;
- 
--	if (self->blocked_open) {
-+	if (atomic_read(&self->blocked_open)) {
- 		if (self->close_delay)
- 			schedule_timeout_interruptible(self->close_delay);
- 		wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
- 	self->tty = NULL;
--	self->open_count = 0;
-+	atomic_set(&self->open_count, 0);
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
- 	seq_putc(m, '\n');
- 
- 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
--	seq_printf(m, "Open count: %d\n", self->open_count);
-+	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
- 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
- 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
- 
-diff -urNp linux-2.6.32.12/net/mac80211/ieee80211_i.h linux-2.6.32.12/net/mac80211/ieee80211_i.h
---- linux-2.6.32.12/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.12/net/mac80211/ieee80211_i.h	2010-04-04 20:46:41.724917264 -0400
-@@ -635,7 +635,7 @@ struct ieee80211_local {
- 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- 	spinlock_t queue_stop_reason_lock;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int monitors, cooked_mntrs;
- 	/* number of interfaces with corresponding FIF_ flags */
- 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff -urNp linux-2.6.32.12/net/mac80211/iface.c linux-2.6.32.12/net/mac80211/iface.c
---- linux-2.6.32.12/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/mac80211/iface.c	2010-04-04 20:46:41.724917264 -0400
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
- 		break;
- 	}
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		res = drv_start(local);
- 		if (res)
- 			goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
- 	 * Validate the MAC address for this device.
- 	 */
- 	if (!is_valid_ether_addr(dev->dev_addr)) {
--		if (!local->open_count)
-+		if (!atomic_read(&local->open_count))
- 			drv_stop(local);
- 		return -EADDRNOTAVAIL;
- 	}
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
- 
- 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
- 
--	local->open_count++;
-+	atomic_inc(&local->open_count);
- 	if (hw_reconf_flags) {
- 		ieee80211_hw_config(local, hw_reconf_flags);
- 		/*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
-  err_del_interface:
- 	drv_remove_interface(local, &conf);
-  err_stop:
--	if (!local->open_count)
-+	if (!atomic_read(&local->open_count))
- 		drv_stop(local);
-  err_del_bss:
- 	sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
- 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
- 	}
- 
--	local->open_count--;
-+	atomic_dec(&local->open_count);
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
- 
- 	ieee80211_recalc_ps(local, -1);
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		ieee80211_clear_tx_pending(local);
- 		ieee80211_stop_device(local);
- 
-diff -urNp linux-2.6.32.12/net/mac80211/main.c linux-2.6.32.12/net/mac80211/main.c
---- linux-2.6.32.12/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.12/net/mac80211/main.c	2010-04-04 20:46:41.724917264 -0400
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
- 		local->hw.conf.power_level = power;
- 	}
- 
--	if (changed && local->open_count) {
-+	if (changed && atomic_read(&local->open_count)) {
- 		ret = drv_config(local, changed);
- 		/*
- 		 * Goal:
-diff -urNp linux-2.6.32.12/net/mac80211/pm.c linux-2.6.32.12/net/mac80211/pm.c
---- linux-2.6.32.12/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/mac80211/pm.c	2010-04-04 20:46:41.724917264 -0400
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
- 	}
- 
- 	/* stop hardware - this must stop RX */
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		ieee80211_stop_device(local);
- 
- 	local->suspended = true;
-diff -urNp linux-2.6.32.12/net/mac80211/rate.c linux-2.6.32.12/net/mac80211/rate.c
---- linux-2.6.32.12/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/mac80211/rate.c	2010-04-04 20:46:41.724917264 -0400
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
- 	struct rate_control_ref *ref, *old;
- 
- 	ASSERT_RTNL();
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		return -EBUSY;
- 
- 	ref = rate_control_alloc(name, local);
-diff -urNp linux-2.6.32.12/net/mac80211/tx.c linux-2.6.32.12/net/mac80211/tx.c
---- linux-2.6.32.12/net/mac80211/tx.c	2010-04-29 17:49:38.690617032 -0400
-+++ linux-2.6.32.12/net/mac80211/tx.c	2010-04-29 17:49:58.741536660 -0400
-@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
- 	return cpu_to_le16(dur);
- }
- 
--static int inline is_ieee80211_device(struct ieee80211_local *local,
-+static inline int is_ieee80211_device(struct ieee80211_local *local,
- 				      struct net_device *dev)
- {
- 	return local == wdev_priv(dev->ieee80211_ptr);
-diff -urNp linux-2.6.32.12/net/mac80211/util.c linux-2.6.32.12/net/mac80211/util.c
---- linux-2.6.32.12/net/mac80211/util.c	2010-04-29 17:49:38.690617032 -0400
-+++ linux-2.6.32.12/net/mac80211/util.c	2010-04-29 17:49:58.749029456 -0400
-@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
- 		local->resuming = true;
- 
- 	/* restart hardware */
--	if (local->open_count) {
-+	if (atomic_read(&local->open_count)) {
- 		/*
- 		 * Upon resume hardware can sometimes be goofy due to
- 		 * various platform / driver / bus issues, so restarting
- 		 * the device may at times not work immediately. Propagate
- 		 * the error.
- 		 */
--		res = drv_start(local);
-+                res = drv_start(local);
- 		if (res) {
- 			WARN(local->suspended, "Harware became unavailable "
- 			     "upon resume. This is could be a software issue"
-diff -urNp linux-2.6.32.12/net/sctp/socket.c linux-2.6.32.12/net/sctp/socket.c
---- linux-2.6.32.12/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/sctp/socket.c	2010-04-04 20:46:41.728797784 -0400
-@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
- 	struct sctp_sndrcvinfo *sinfo;
- 	struct sctp_initmsg *sinit;
- 	sctp_assoc_t associd = 0;
--	sctp_cmsgs_t cmsgs = { NULL };
-+	sctp_cmsgs_t cmsgs = { NULL, NULL };
- 	int err;
- 	sctp_scope_t scope;
- 	long timeo;
-@@ -5802,7 +5802,6 @@ pp_found:
- 		 */
- 		int reuse = sk->sk_reuse;
- 		struct sock *sk2;
--		struct hlist_node *node;
- 
- 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- 		if (pp->fastreuse && sk->sk_reuse &&
-diff -urNp linux-2.6.32.12/net/socket.c linux-2.6.32.12/net/socket.c
---- linux-2.6.32.12/net/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/socket.c	2010-04-04 20:46:41.728797784 -0400
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
- 
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
- 
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+			      const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct socket *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+			     struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+			  struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+			    const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- 			 unsigned long nr_segs, loff_t pos);
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
- 			     mnt);
- }
- 
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
- 
- static struct file_system_type sock_fs_type = {
- 	.name =		"sockfs",
-@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
- 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
- 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
- 
-+	if(!gr_search_socket(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_handle_sock_all(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
- 	retval = sock_create(family, type, protocol, &sock);
- 	if (retval < 0)
- 		goto out;
-@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 	if (sock) {
- 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- 		if (err >= 0) {
-+			if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+				err = -EACCES;
-+				goto error;
-+			}
-+			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+			if (err)
-+				goto error;
-+
- 			err = security_socket_bind(sock,
- 						   (struct sockaddr *)&address,
- 						   addrlen);
-@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 						      (struct sockaddr *)
- 						      &address, addrlen);
- 		}
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
- 		if ((unsigned)backlog > somaxconn)
- 			backlog = somaxconn;
- 
-+		if (gr_handle_sock_server_other(sock)) {
-+			err = -EPERM;
-+			goto error;
-+		}
-+
-+		err = gr_search_listen(sock);
-+		if (err)
-+			goto error;
-+
- 		err = security_socket_listen(sock, backlog);
- 		if (!err)
- 			err = sock->ops->listen(sock, backlog);
- 
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	newsock->type = sock->type;
- 	newsock->ops = sock->ops;
- 
-+	if (gr_handle_sock_server_other(sock)) {
-+		err = -EPERM;
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
-+	err = gr_search_accept(sock);
-+	if (err) {
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
- 	/*
- 	 * We don't need try_module_get here, as the listening socket (sock)
- 	 * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	fd_install(newfd, newfile);
- 	err = newfd;
- 
-+	gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- 	fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 		int, addrlen)
- {
- 	struct socket *sock;
-+	struct sockaddr *sck;
- 	struct sockaddr_storage address;
- 	int err, fput_needed;
- 
-@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 	if (err < 0)
- 		goto out_put;
- 
-+	sck = (struct sockaddr *)&address;
-+
-+	if (gr_handle_sock_client(sck)) {
-+		err = -EACCES;
-+		goto out_put;
-+	}
-+
-+	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+	if (err)
-+		goto out_put;
-+
- 	err =
- 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- 	if (err)
-diff -urNp linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/sunrpc/xprtrdma/svc_rdma.c	2010-04-04 20:46:41.728797784 -0400
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
- 		len -= *ppos;
- 		if (len > *lenp)
- 			len = *lenp;
--		if (len && copy_to_user(buffer, str_buf, len))
-+		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- 			return -EFAULT;
- 		*lenp = len;
- 		*ppos += len;
-diff -urNp linux-2.6.32.12/net/sysctl_net.c linux-2.6.32.12/net/sysctl_net.c
---- linux-2.6.32.12/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/sysctl_net.c	2010-04-04 20:46:41.728797784 -0400
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
- 			       struct ctl_table *table)
- {
- 	/* Allow network administrator to have same access as root. */
--	if (capable(CAP_NET_ADMIN)) {
-+	if (capable_nolog(CAP_NET_ADMIN)) {
- 		int mode = (table->mode >> 6) & 7;
- 		return (mode << 6) | (mode << 3) | mode;
- 	}
-diff -urNp linux-2.6.32.12/net/tipc/socket.c linux-2.6.32.12/net/tipc/socket.c
---- linux-2.6.32.12/net/tipc/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/tipc/socket.c	2010-04-29 17:46:37.401277007 -0400
-@@ -1449,8 +1449,9 @@ static int connect(struct socket *sock, 
- 	} else {
- 		if (res == 0)
- 			res = -ETIMEDOUT;
--		else
--			; /* leave "res" unchanged */
-+		else {
-+			/* leave "res" unchanged */
-+		}
- 		sock->state = SS_DISCONNECTING;
- 	}
- 
-diff -urNp linux-2.6.32.12/net/unix/af_unix.c linux-2.6.32.12/net/unix/af_unix.c
---- linux-2.6.32.12/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/unix/af_unix.c	2010-04-04 20:46:41.728797784 -0400
-@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
- 		err = -ECONNREFUSED;
- 		if (!S_ISSOCK(inode->i_mode))
- 			goto put_fail;
-+
-+		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+			err = -EACCES;
-+			goto put_fail;
-+		}
-+
- 		u = unix_find_socket_byinode(net, inode);
- 		if (!u)
- 			goto put_fail;
-@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
- 		if (u) {
- 			struct dentry *dentry;
- 			dentry = unix_sk(u)->dentry;
-+
-+			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+				err = -EPERM;
-+				sock_put(u);
-+				goto fail;
-+			}
-+
- 			if (dentry)
- 				touch_atime(unix_sk(u)->mnt, dentry);
- 		} else
-@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
- 		err = security_path_mknod(&nd.path, dentry, mode, 0);
- 		if (err)
- 			goto out_mknod_drop_write;
-+		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+			err = -EACCES;
-+			goto out_mknod_drop_write;
-+		}
- 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- 		mnt_drop_write(nd.path.mnt);
- 		if (err)
- 			goto out_mknod_dput;
-+
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- 		dput(nd.path.dentry);
- 		nd.path.dentry = dentry;
-@@ -861,6 +881,10 @@ out_mknod_drop_write:
- 			goto out_unlock;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+		sk->sk_peercred.pid = current->pid;
-+#endif
-+
- 		list = &unix_socket_table[addr->hash];
- 	} else {
- 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
-diff -urNp linux-2.6.32.12/net/xfrm/xfrm_policy.c linux-2.6.32.12/net/xfrm/xfrm_policy.c
---- linux-2.6.32.12/net/xfrm/xfrm_policy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/net/xfrm/xfrm_policy.c	2010-04-29 17:46:37.421275445 -0400
-@@ -1477,7 +1477,7 @@ free_dst:
- 	goto out;
- }
- 
--static int inline
-+static inline int
- xfrm_dst_alloc_copy(void **target, void *src, int size)
- {
- 	if (!*target) {
-@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void 
- 	return 0;
- }
- 
--static int inline
-+static inline int
- xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry 
- #endif
- }
- 
--static int inline
-+static inline int
- xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-diff -urNp linux-2.6.32.12/samples/kobject/kset-example.c linux-2.6.32.12/samples/kobject/kset-example.c
---- linux-2.6.32.12/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/samples/kobject/kset-example.c	2010-04-04 20:46:41.728797784 -0400
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
- }
- 
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- 	.show = foo_attr_show,
- 	.store = foo_attr_store,
- };
-diff -urNp linux-2.6.32.12/scripts/basic/fixdep.c linux-2.6.32.12/scripts/basic/fixdep.c
---- linux-2.6.32.12/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/basic/fixdep.c	2010-04-04 20:46:41.728797784 -0400
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
- 
- static void parse_config_file(char *map, size_t len)
- {
--	int *end = (int *) (map + len);
-+	unsigned int *end = (unsigned int *) (map + len);
- 	/* start at +1, so that p can never be < map */
--	int *m   = (int *) map + 1;
-+	unsigned int *m   = (unsigned int *) map + 1;
- 	char *p, *q;
- 
- 	for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
--	int *p = (int *)test;
-+	unsigned int *p = (unsigned int *)test;
- 
- 	if (*p != INT_CONF) {
- 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.32.12/scripts/kallsyms.c linux-2.6.32.12/scripts/kallsyms.c
---- linux-2.6.32.12/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/kallsyms.c	2010-04-04 20:46:41.728797784 -0400
-@@ -43,10 +43,10 @@ struct text_range {
- 
- static unsigned long long _text;
- static struct text_range text_ranges[] = {
--	{ "_stext",     "_etext"     },
--	{ "_sinittext", "_einittext" },
--	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
--	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
-+	{ "_stext",     "_etext",     0, 0 },
-+	{ "_sinittext", "_einittext", 0, 0 },
-+	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
-+	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
- };
- #define text_range_text     (&text_ranges[0])
- #define text_range_inittext (&text_ranges[1])
-diff -urNp linux-2.6.32.12/scripts/mod/file2alias.c linux-2.6.32.12/scripts/mod/file2alias.c
---- linux-2.6.32.12/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/mod/file2alias.c	2010-04-04 20:46:41.728797784 -0400
-@@ -72,7 +72,7 @@ static void device_id_check(const char *
- 			    unsigned long size, unsigned long id_size,
- 			    void *symval)
- {
--	int i;
-+	unsigned int i;
- 
- 	if (size % id_size || size < id_size) {
- 		if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
--			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- 			 unsigned char range_lo, unsigned char range_hi,
- 			 struct module *mod)
- {
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
- 	for (i = 0; i < count; i++) {
- 		const char *id = (char *)devs[i].id;
- 		char acpi_id[sizeof(devs[0].id)];
--		int j;
-+		unsigned int j;
- 
- 		buf_printf(&mod->dev_table_buf,
- 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
- 
- 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
- 			const char *id = (char *)card->devs[j].id;
--			int i2, j2;
-+			unsigned int i2, j2;
- 			int dup = 0;
- 
- 			if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
- 			/* add an individual alias for every device entry */
- 			if (!dup) {
- 				char acpi_id[sizeof(card->devs[0].id)];
--				int k;
-+				unsigned int k;
- 
- 				buf_printf(&mod->dev_table_buf,
- 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- 			char *alias)
- {
--	int i, j;
-+	unsigned int i, j;
- 
- 	sprintf(alias, "dmi*");
- 
-diff -urNp linux-2.6.32.12/scripts/mod/modpost.c linux-2.6.32.12/scripts/mod/modpost.c
---- linux-2.6.32.12/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/mod/modpost.c	2010-04-04 20:46:41.728797784 -0400
-@@ -835,6 +835,7 @@ enum mismatch {
- 	INIT_TO_EXIT,
- 	EXIT_TO_INIT,
- 	EXPORT_TO_INIT_EXIT,
-+	DATA_TO_TEXT
- };
- 
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
- 	.fromsec = { "__ksymtab*", NULL },
- 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- 	.mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+	.fromsec = { DATA_SECTIONS, NULL },
-+	.tosec   = { TEXT_SECTIONS, NULL },
-+	.mismatch = DATA_TO_TEXT
- }
- };
- 
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
- 			continue;
- 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- 			continue;
--		if (sym->st_value == addr)
--			return sym;
- 		/* Find a symbol nearby - addr are maybe negative */
- 		d = sym->st_value - addr;
-+		if (d == 0)
-+			return sym;
- 		if (d < 0)
- 			d = addr - sym->st_value;
- 		if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
- 		"Fix this by removing the %sannotation of %s "
- 		"or drop the export.\n",
- 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+	case DATA_TO_TEXT:
-+/*
-+		fprintf(stderr,
-+		"The variable %s references\n"
-+		"the %s %s%s%s\n",
-+		fromsym, to, sec2annotation(tosec), tosym, to_p);
-+*/
-+		break;
- 	case NO_MISMATCH:
- 		/* To get warnings on missing members */
- 		break;
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
- 	va_end(ap);
- }
- 
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- 	if (buf->size - buf->pos < len) {
- 		buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
- 	if (fstat(fileno(file), &st) < 0)
- 		goto close_write;
- 
--	if (st.st_size != b->pos)
-+	if (st.st_size != (off_t)b->pos)
- 		goto close_write;
- 
- 	tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.32.12/scripts/mod/modpost.h linux-2.6.32.12/scripts/mod/modpost.h
---- linux-2.6.32.12/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/mod/modpost.h	2010-04-04 20:46:41.728797784 -0400
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
- 
- struct buffer {
- 	char *p;
--	int pos;
--	int size;
-+	unsigned int pos;
-+	unsigned int size;
- };
- 
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
- 
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
- 
- struct module {
- 	struct module *next;
-diff -urNp linux-2.6.32.12/scripts/mod/sumversion.c linux-2.6.32.12/scripts/mod/sumversion.c
---- linux-2.6.32.12/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/mod/sumversion.c	2010-04-04 20:46:41.728797784 -0400
-@@ -455,7 +455,7 @@ static void write_version(const char *fi
- 		goto out;
- 	}
- 
--	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- 		warn("writing sum in %s failed: %s\n",
- 			filename, strerror(errno));
- 		goto out;
-diff -urNp linux-2.6.32.12/scripts/pnmtologo.c linux-2.6.32.12/scripts/pnmtologo.c
---- linux-2.6.32.12/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/scripts/pnmtologo.c	2010-04-04 20:46:41.728797784 -0400
-@@ -237,14 +237,14 @@ static void write_header(void)
-     fprintf(out, " *  Linux logo %s\n", logoname);
-     fputs(" */\n\n", out);
-     fputs("#include <linux/linux_logo.h>\n\n", out);
--    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_data[] = {\n",
- 	    logoname);
- }
- 
- static void write_footer(void)
- {
-     fputs("\n};\n\n", out);
--    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+    fprintf(out, "const struct linux_logo %s = {\n", logoname);
-     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
-     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
-     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
-     fputs("\n};\n\n", out);
- 
-     /* write logo clut */
--    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_clut[] = {\n",
- 	    logoname);
-     write_hex_cnt = 0;
-     for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.32.12/security/commoncap.c linux-2.6.32.12/security/commoncap.c
---- linux-2.6.32.12/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/commoncap.c	2010-04-04 20:46:41.728797784 -0400
-@@ -27,7 +27,7 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
--
-+#include <net/sock.h>
- /*
-  * If a non-root user executes a setuid-root binary in
-  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
-@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
- 	}
- }
- 
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
--	NETLINK_CB(skb).eff_cap = current_cap();
-+	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.12/security/integrity/ima/ima_api.c linux-2.6.32.12/security/integrity/ima/ima_api.c
---- linux-2.6.32.12/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/integrity/ima/ima_api.c	2010-04-04 20:46:41.728797784 -0400
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
- 	int result;
- 
- 	/* can overflow, only indicator */
--	atomic_long_inc(&ima_htable.violations);
-+	atomic_long_inc_unchecked(&ima_htable.violations);
- 
- 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- 	if (!entry) {
-diff -urNp linux-2.6.32.12/security/integrity/ima/ima_fs.c linux-2.6.32.12/security/integrity/ima/ima_fs.c
---- linux-2.6.32.12/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/integrity/ima/ima_fs.c	2010-04-04 20:46:41.728797784 -0400
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
--				     loff_t *ppos, atomic_long_t *val)
-+				     loff_t *ppos, atomic_long_unchecked_t *val)
- {
- 	char tmpbuf[TMPBUFLEN];
- 	ssize_t len;
- 
--	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
- 
-diff -urNp linux-2.6.32.12/security/integrity/ima/ima.h linux-2.6.32.12/security/integrity/ima/ima.h
---- linux-2.6.32.12/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/integrity/ima/ima.h	2010-04-04 20:46:41.728797784 -0400
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
- extern spinlock_t ima_queue_lock;
- 
- struct ima_h_table {
--	atomic_long_t len;	/* number of stored measurements in the list */
--	atomic_long_t violations;
-+	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
-+	atomic_long_unchecked_t violations;
- 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.32.12/security/integrity/ima/ima_queue.c linux-2.6.32.12/security/integrity/ima/ima_queue.c
---- linux-2.6.32.12/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/integrity/ima/ima_queue.c	2010-04-04 20:46:41.728797784 -0400
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
- 	INIT_LIST_HEAD(&qe->later);
- 	list_add_tail_rcu(&qe->later, &ima_measurements);
- 
--	atomic_long_inc(&ima_htable.len);
-+	atomic_long_inc_unchecked(&ima_htable.len);
- 	key = ima_hash_key(entry->digest);
- 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- 	return 0;
-diff -urNp linux-2.6.32.12/security/Kconfig linux-2.6.32.12/security/Kconfig
---- linux-2.6.32.12/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/security/Kconfig	2010-04-29 17:46:37.065247062 -0400
-@@ -4,6 +4,499 @@
- 
- menu "Security options"
- 
-+source grsecurity/Kconfig
-+
-+menu "PaX"
-+
-+	config PAX_PER_CPU_PGD
-+	bool
-+
-+	config TASK_SIZE_MAX_SHIFT
-+	int
-+	depends on X86_64
-+	default 47 if !PAX_PER_CPU_PGD
-+	default 42 if PAX_PER_CPU_PGD
-+
-+config PAX
-+	bool "Enable various PaX features"
-+	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
-+	help
-+	  This allows you to enable various PaX features.  PaX adds
-+	  intrusion prevention mechanisms to the kernel that reduce
-+	  the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+	depends on PAX
-+
-+config PAX_SOFTMODE
-+	bool 'Support soft mode'
-+	select PAX_PT_PAX_FLAGS
-+	help
-+	  Enabling this option will allow you to run PaX in soft mode, that
-+	  is, PaX features will not be enforced by default, only on executables
-+	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
-+	  is the only way to mark executables for soft mode use.
-+
-+	  Soft mode can be activated by using the "pax_softmode=1" kernel command
-+	  line option on boot.  Furthermore you can control various PaX features
-+	  at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+	bool 'Use legacy ELF header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'chpax' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  an otherwise reserved part of the ELF header.  This marking has
-+	  numerous drawbacks (no support for soft-mode, toolchain does not
-+	  know about the non-standard use of the ELF header) therefore it
-+	  has been deprecated in favour of PT_PAX_FLAGS support.
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable this option otherwise they
-+	  will not get any protection.
-+
-+	  Note that if you enable PT_PAX_FLAGS marking support as well,
-+	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
-+
-+config PAX_PT_PAX_FLAGS
-+	bool 'Use ELF program header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'paxctl' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
-+	  has the benefits of supporting both soft mode and being fully
-+	  integrated into the toolchain (the binutils patch is available
-+	  from http://pax.grsecurity.net).
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable the EI_PAX marking support
-+	  otherwise they will not get any protection.
-+
-+	  Note that if you enable the legacy EI_PAX marking support as well,
-+	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+choice
-+	prompt 'MAC system integration'
-+	default PAX_HAVE_ACL_FLAGS
-+	help
-+	  Mandatory Access Control systems have the option of controlling
-+	  PaX flags on a per executable basis, choose the method supported
-+	  by your particular system.
-+
-+	  - "none": if your MAC system does not interact with PaX,
-+	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+	  NOTE: this option is for developers/integrators only.
-+
-+	config PAX_NO_ACL_FLAGS
-+		bool 'none'
-+
-+	config PAX_HAVE_ACL_FLAGS
-+		bool 'direct'
-+
-+	config PAX_HOOK_ACL_FLAGS
-+		bool 'hook'
-+endchoice
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+	depends on PAX
-+
-+config PAX_NOEXEC
-+	bool "Enforce non-executable pages"
-+	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
-+	help
-+	  By design some architectures do not allow for protecting memory
-+	  pages against execution or even if they do, Linux does not make
-+	  use of this feature.  In practice this means that if a page is
-+	  readable (such as the stack or heap) it is also executable.
-+
-+	  There is a well known exploit technique that makes use of this
-+	  fact and a common programming mistake where an attacker can
-+	  introduce code of his choice somewhere in the attacked program's
-+	  memory (typically the stack or the heap) and then execute it.
-+
-+	  If the attacked program was running with different (typically
-+	  higher) privileges than that of the attacker, then he can elevate
-+	  his own privilege level (e.g. get a root shell, write to files for
-+	  which he does not have write access to, etc).
-+
-+	  Enabling this option will let you choose from various features
-+	  that prevent the injection and execution of 'foreign' code in
-+	  a program.
-+
-+	  This will also break programs that rely on the old behaviour and
-+	  expect that dynamically allocated memory via the malloc() family
-+	  of functions is executable (which it is not).  Notable examples
-+	  are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+	bool "Paging based non-executable pages"
-+	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+	select S390_SWITCH_AMODE if S390
-+	select S390_EXEC_PROTECT if S390
-+	help
-+	  This implementation is based on the paging feature of the CPU.
-+	  On i386 without hardware non-executable bit support there is a
-+	  variable but usually low performance impact, however on Intel's
-+	  P4 core based CPUs it is very high so you should not enable this
-+	  for kernels meant to be used on such CPUs.
-+
-+	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+	  with hardware non-executable bit support there is no performance
-+	  impact, on ppc the impact is negligible.
-+
-+	  Note that several architectures require various emulations due to
-+	  badly designed userland ABIs, this will cause a performance impact
-+	  but will disappear as soon as userland is fixed. For example, ppc
-+	  userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+	bool "Segmentation based non-executable pages"
-+	depends on PAX_NOEXEC && X86_32
-+	help
-+	  This implementation is based on the segmentation feature of the
-+	  CPU and has a very small performance impact, however applications
-+	  will be limited to a 1.5 GB address space instead of the normal
-+	  3 GB.
-+
-+config PAX_EMUTRAMP
-+	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+	default y if PARISC
-+	help
-+	  There are some programs and libraries that for one reason or
-+	  another attempt to execute special small code snippets from
-+	  non-executable memory pages.  Most notable examples are the
-+	  signal handler return code generated by the kernel itself and
-+	  the GCC trampolines.
-+
-+	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+	  such programs will no longer work under your kernel.
-+
-+	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+	  utilities to enable trampoline emulation for the affected programs
-+	  yet still have the protection provided by the non-executable pages.
-+
-+	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+	  your system will not even boot.
-+
-+	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+	  for the affected files.
-+
-+	  NOTE: enabling this feature *may* open up a loophole in the
-+	  protection provided by non-executable pages that an attacker
-+	  could abuse.  Therefore the best solution is to not have any
-+	  files on your system that would require this option.  This can
-+	  be achieved by not using libc5 (which relies on the kernel
-+	  signal handler return code) and not using or rewriting programs
-+	  that make use of the nested function implementation of GCC.
-+	  Skilled users can just fix GCC itself so that it implements
-+	  nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+	bool "Automatically emulate sigreturn trampolines"
-+	depends on PAX_EMUTRAMP && PARISC
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate signal return trampolines executing on the stack
-+	  that would otherwise lead to task termination.
-+
-+	  This solution is intended as a temporary one for users with
-+	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+	  Modula-3 runtime, etc) or executables linked to such, basically
-+	  everything that does not specify its own SA_RESTORER function in
-+	  normal executable memory like glibc 2.1+ does.
-+
-+	  On parisc you MUST enable this option, otherwise your system will
-+	  not even boot.
-+
-+	  NOTE: this feature cannot be disabled on a per executable basis
-+	  and since it *does* open up a loophole in the protection provided
-+	  by non-executable pages, the best solution is to not have any
-+	  files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+	bool "Restrict mprotect()"
-+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+	help
-+	  Enabling this option will prevent programs from
-+	   - changing the executable status of memory pages that were
-+	     not originally created as executable,
-+	   - making read-only executable pages writable again,
-+	   - creating executable pages from anonymous memory.
-+
-+	  You should say Y here to complete the protection provided by
-+	  the enforcement of non-executable pages.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_NOELFRELOCS
-+	bool "Disallow ELF text relocations"
-+	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
-+	help
-+	  Non-executable pages and mprotect() restrictions are effective
-+	  in preventing the introduction of new executable code into an
-+	  attacked task's address space.  There remain only two venues
-+	  for this kind of attack: if the attacker can execute already
-+	  existing code in the attacked task then he can either have it
-+	  create and mmap() a file containing his code or have it mmap()
-+	  an already existing ELF library that does not have position
-+	  independent code in it and use mprotect() on it to make it
-+	  writable and copy his code there.  While protecting against
-+	  the former approach is beyond PaX, the latter can be prevented
-+	  by having only PIC ELF libraries on one's system (which do not
-+	  need to relocate their code).  If you are sure this is your case,
-+	  then enable this option otherwise be careful as you may not even
-+	  be able to boot or log on your system (for example, some PAM
-+	  modules are erroneously compiled as non-PIC by default).
-+
-+	  NOTE: if you are using dynamic ELF executables (as suggested
-+	  when using ASLR) then you must have made sure that you linked
-+	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
-+	  referenced there has already been updated to support this).
-+
-+config PAX_ETEXECRELOCS
-+	bool "Allow ELF ET_EXEC text relocations"
-+	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+	default y
-+	help
-+	  On some architectures there are incorrectly created applications
-+	  that require text relocations and would not work without enabling
-+	  this option.  If you are an alpha, ia64 or parisc user, you should
-+	  enable this option and disable it once you have made sure that
-+	  none of your applications need it.
-+
-+config PAX_EMUPLT
-+	bool "Automatically emulate ELF PLT"
-+	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate the Procedure Linkage Table entries in ELF files.
-+	  On some architectures such entries are in writable memory, and
-+	  become non-executable leading to task termination.  Therefore
-+	  it is mandatory that you enable this option on alpha, parisc,
-+	  sparc and sparc64, otherwise your system would not even boot.
-+
-+	  NOTE: this feature *does* open up a loophole in the protection
-+	  provided by the non-executable pages, therefore the proper
-+	  solution is to modify the toolchain to produce a PLT that does
-+	  not need to be writable.
-+
-+config PAX_DLRESOLVE
-+	bool 'Emulate old glibc resolver stub'
-+	depends on PAX_EMUPLT && SPARC
-+	default n
-+	help
-+	  This option is needed if userland has an old glibc (before 2.4)
-+	  that puts a 'save' instruction into the runtime generated resolver
-+	  stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+	bool "Enforce non-executable kernel pages"
-+	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
-+	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+	help
-+	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+	  that is, enabling this option will make it harder to inject
-+	  and execute 'foreign' code in kernel memory itself.
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+	int "Minimum amount of memory reserved for module code"
-+	default "4"
-+	depends on PAX_KERNEXEC && X86_32 && MODULES
-+	help
-+	  Due to implementation details the kernel must reserve a fixed
-+	  amount of memory for module code at compile time that cannot be
-+	  changed at runtime.  Here you can specify the minimum amount
-+	  in MB that will be reserved.  Due to the same implementation
-+	  details this size will always be rounded up to the next 2/4 MB
-+	  boundary (depends on PAE) so the actually available memory for
-+	  module code will usually be more than this minimum.
-+
-+	  The default 4 MB should be enough for most users but if you have
-+	  an excessive number of modules (e.g., most distribution configs
-+	  compile many drivers as modules) or use huge modules such as
-+	  nvidia's kernel driver, you will need to adjust this amount.
-+	  A good rule of thumb is to look at your currently loaded kernel
-+	  modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+	depends on PAX
-+
-+config PAX_ASLR
-+	bool "Address Space Layout Randomization"
-+	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
-+	help
-+	  Many if not most exploit techniques rely on the knowledge of
-+	  certain addresses in the attacked program.  The following options
-+	  will allow the kernel to apply a certain amount of randomization
-+	  to specific parts of the program thereby forcing an attacker to
-+	  guess them in most cases.  Any failed guess will most likely crash
-+	  the attacked program which allows the kernel to detect such attempts
-+	  and react on them.  PaX itself provides no reaction mechanisms,
-+	  instead it is strongly encouraged that you make use of Nergal's
-+	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+	  (http://www.grsecurity.net/) built-in crash detection features or
-+	  develop one yourself.
-+
-+	  By saying Y here you can choose to randomize the following areas:
-+	   - top of the task's kernel stack
-+	   - top of the task's userland stack
-+	   - base address for mmap() requests that do not specify one
-+	     (this includes all libraries)
-+	   - base address of the main executable
-+
-+	  It is strongly recommended to say Y here as address space layout
-+	  randomization has negligible impact on performance yet it provides
-+	  a very effective protection.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+	bool "Randomize kernel stack base"
-+	depends on PAX_ASLR && X86_TSC && X86_32
-+	help
-+	  By saying Y here the kernel will randomize every task's kernel
-+	  stack on every system call.  This will not only force an attacker
-+	  to guess it but also prevent him from making use of possible
-+	  leaked information about it.
-+
-+	  Since the kernel stack is a rather scarce resource, randomization
-+	  may cause unexpected stack overflows, therefore you should very
-+	  carefully test your system.  Note that once enabled in the kernel
-+	  configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+	bool "Randomize user stack base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will randomize every task's userland
-+	  stack.  The randomization is done in two steps where the second
-+	  one may apply a big amount of shift to the top of the stack and
-+	  cause problems for programs that want to use lots of memory (more
-+	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+	  For this reason the second step can be controlled by 'chpax' or
-+	  'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+	bool "Randomize mmap() base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will use a randomized base address for
-+	  mmap() requests that do not specify one themselves.  As a result
-+	  all dynamically loaded libraries will appear at random addresses
-+	  and therefore be harder to exploit by a technique where an attacker
-+	  attempts to execute library code for his purposes (e.g. spawn a
-+	  shell from an exploited program that is running at an elevated
-+	  privilege level).
-+
-+	  Furthermore, if a program is relinked as a dynamic ELF file, its
-+	  base address will be randomized as well, completing the full
-+	  randomization of the address space layout.  Attacking such programs
-+	  becomes a guess game.  You can find an example of doing this at
-+	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+	  feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+	bool "Sanitize all freed memory"
-+	help
-+	  By saying Y here the kernel will erase memory pages as soon as they
-+	  are freed.  This in turn reduces the lifetime of data stored in the
-+	  pages, making it less likely that sensitive information such as
-+	  passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+	  This is especially useful for programs whose runtime is short, long
-+	  lived processes and the kernel itself benefit from this as long as
-+	  they operate on whole memory pages and ensure timely freeing of pages
-+	  that may hold sensitive information.
-+
-+	  The tradeoff is performance impact, on a single CPU system kernel
-+	  compilation sees a 3% slowdown, other systems and workloads may vary
-+	  and you are advised to test this feature on your expected workload
-+	  before deploying it.
-+
-+	  Note that this feature does not protect data stored in live pages,
-+	  e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_UDEREF
-+	bool "Prevent invalid userland pointer dereference"
-+	depends on X86 && !UML_X86 && !XEN
-+	select PAX_PER_CPU_PGD if X86_64
-+	help
-+	  By saying Y here the kernel will be prevented from dereferencing
-+	  userland pointers in contexts where the kernel expects only kernel
-+	  pointers.  This is both a useful runtime debugging feature and a
-+	  security measure that prevents exploiting a class of kernel bugs.
-+
-+	  The tradeoff is that some virtualization solutions may experience
-+	  a huge slowdown and therefore you should not enable this feature
-+	  for kernels meant to run in such environments.  Whether a given VM
-+	  solution is affected or not is best determined by simply trying it
-+	  out, the performance impact will be obvious right on boot as this
-+	  mechanism engages from very early on.  A good rule of thumb is that
-+	  VMs running on CPUs without hardware virtualization support (i.e.,
-+	  the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+	bool "Prevent various kernel object reference counter overflows"
-+	depends on GRKERNSEC && (X86 || SPARC64)
-+	help
-+	  By saying Y here the kernel will detect and prevent overflowing
-+	  various (but not all) kinds of object reference counters.  Such
-+	  overflows can normally occur due to bugs only and are often, if
-+	  not always, exploitable.
-+
-+	  The tradeoff is that data structures protected by an overflowed
-+	  refcount will never be freed and therefore will leak memory.  Note
-+	  that this leak also happens even without this protection but in
-+	  that case the overflow can eventually trigger the freeing of the
-+	  data structure while it is still being used elsewhere, resulting
-+	  in the exploitable situation that this feature prevents.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+
-+config PAX_USERCOPY
-+	bool "Bounds check heap object copies between kernel and userland"
-+	depends on X86 || PPC || SPARC
-+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+	help
-+	  By saying Y here the kernel will enforce the size of heap objects
-+	  when they are copied in either direction between the kernel and
-+	  userland, even if only a part of the heap object is copied.
-+
-+	  Specifically, this checking prevents information leaking from the
-+	  kernel heap during kernel to userland copies (if the kernel heap
-+	  object is otherwise fully initialized) and prevents kernel heap
-+	  overflows during userland to kernel copies.
-+
-+	  Note that the current implementation provides the strictest checks
-+	  for the SLUB allocator.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+endmenu
-+
-+endmenu
-+
- config KEYS
- 	bool "Enable access key retention support"
- 	help
-@@ -146,7 +639,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- 	int "Low address space for LSM to protect from user allocation"
- 	depends on SECURITY && SECURITY_SELINUX
--	default 65536
-+	default 32768
- 	help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.12/security/min_addr.c linux-2.6.32.12/security/min_addr.c
---- linux-2.6.32.12/security/min_addr.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.12/security/min_addr.c	2010-04-04 20:46:41.732880788 -0400
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
-  */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- 		mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- 	mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
- 
- /*
-diff -urNp linux-2.6.32.12/sound/aoa/codecs/onyx.c linux-2.6.32.12/sound/aoa/codecs/onyx.c
---- linux-2.6.32.12/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/aoa/codecs/onyx.c	2010-04-04 20:46:41.732880788 -0400
-@@ -53,7 +53,7 @@ struct onyx {
- 				spdif_locked:1,
- 				analog_locked:1,
- 				original_mute:2;
--	int			open_count;
-+	atomic_t		open_count;
- 	struct codec_info	*codec_info;
- 
- 	/* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count++;
-+	atomic_inc(&onyx->open_count);
- 	mutex_unlock(&onyx->mutex);
- 
- 	return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count--;
--	if (!onyx->open_count)
-+	if (atomic_dec_and_test(&onyx->open_count))
- 		onyx->spdif_locked = onyx->analog_locked = 0;
- 	mutex_unlock(&onyx->mutex);
- 
-diff -urNp linux-2.6.32.12/sound/core/oss/pcm_oss.c linux-2.6.32.12/sound/core/oss/pcm_oss.c
---- linux-2.6.32.12/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/core/oss/pcm_oss.c	2010-04-04 20:46:41.732880788 -0400
-@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
- 	}
- }
- #else /* !CONFIG_SND_VERBOSE_PROCFS */
--#define snd_pcm_oss_proc_init(pcm)
--#define snd_pcm_oss_proc_done(pcm)
-+#define snd_pcm_oss_proc_init(pcm) do {} while (0)
-+#define snd_pcm_oss_proc_done(pcm) do {} while (0)
- #endif /* CONFIG_SND_VERBOSE_PROCFS */
- 
- /*
-diff -urNp linux-2.6.32.12/sound/core/seq/seq_lock.h linux-2.6.32.12/sound/core/seq/seq_lock.h
---- linux-2.6.32.12/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/core/seq/seq_lock.h	2010-04-04 20:46:41.732880788 -0400
-@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
- #else /* SMP || CONFIG_SND_DEBUG */
- 
- typedef spinlock_t snd_use_lock_t;	/* dummy */
--#define snd_use_lock_init(lockp) /**/
--#define snd_use_lock_use(lockp) /**/
--#define snd_use_lock_free(lockp) /**/
--#define snd_use_lock_sync(lockp) /**/
-+#define snd_use_lock_init(lockp) do {} while (0)
-+#define snd_use_lock_use(lockp) do {} while (0)
-+#define snd_use_lock_free(lockp) do {} while (0)
-+#define snd_use_lock_sync(lockp) do {} while (0)
- 
- #endif /* SMP || CONFIG_SND_DEBUG */
- 
-diff -urNp linux-2.6.32.12/sound/drivers/mts64.c linux-2.6.32.12/sound/drivers/mts64.c
---- linux-2.6.32.12/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/drivers/mts64.c	2010-04-04 20:46:41.732880788 -0400
-@@ -65,7 +65,7 @@ struct mts64 {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int current_midi_output_port;
- 	int current_midi_input_port;
- 	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
- {
- 	struct mts64 *mts = substream->rmidi->private_data;
- 
--	if (mts->open_count == 0) {
-+	if (atomic_read(&mts->open_count) == 0) {
- 		/* We don't need a spinlock here, because this is just called 
- 		   if the device has not been opened before. 
- 		   So there aren't any IRQs from the device */
-@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
- 
- 		msleep(50);
- 	}
--	++(mts->open_count);
-+	atomic_inc(&mts->open_count);
- 
- 	return 0;
- }
-@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
- 	struct mts64 *mts = substream->rmidi->private_data;
- 	unsigned long flags;
- 
--	--(mts->open_count);
--	if (mts->open_count == 0) {
-+	if (atomic_dec_return(&mts->open_count) == 0) {
- 		/* We need the spinlock_irqsave here because we can still
- 		   have IRQs at this point */
- 		spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
- 
- 		msleep(500);
- 
--	} else if (mts->open_count < 0)
--		mts->open_count = 0;
-+	} else if (atomic_read(&mts->open_count) < 0)
-+		atomic_set(&mts->open_count, 0);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.12/sound/drivers/portman2x4.c linux-2.6.32.12/sound/drivers/portman2x4.c
---- linux-2.6.32.12/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/drivers/portman2x4.c	2010-04-04 20:46:41.732880788 -0400
-@@ -83,7 +83,7 @@ struct portman {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int mode[PORTMAN_NUM_INPUT_PORTS];
- 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff -urNp linux-2.6.32.12/sound/oss/sb_audio.c linux-2.6.32.12/sound/oss/sb_audio.c
---- linux-2.6.32.12/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/oss/sb_audio.c	2010-04-04 20:46:41.732880788 -0400
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- 		buf16 = (signed short *)(localbuf + localoffs);
- 		while (c)
- 		{
--			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- 			if (copy_from_user(lbuf8,
- 					   userbuf+useroffs + p,
- 					   locallen))
-diff -urNp linux-2.6.32.12/sound/pci/ac97/ac97_codec.c linux-2.6.32.12/sound/pci/ac97/ac97_codec.c
---- linux-2.6.32.12/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/pci/ac97/ac97_codec.c	2010-04-04 20:46:41.732880788 -0400
-@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
- }
- 
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
- 
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff -urNp linux-2.6.32.12/sound/pci/ac97/ac97_patch.c linux-2.6.32.12/sound/pci/ac97/ac97_patch.c
---- linux-2.6.32.12/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.12/sound/pci/ac97/ac97_patch.c	2010-04-04 20:46:41.732880788 -0400
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- 	.build_specific = patch_wolfson_wm9703_specific,
- };
- 
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- 	.build_specific = patch_wolfson_wm9704_specific,
- };
- 
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- 	.build_specific = patch_wolfson_wm9705_specific,
- };
- 
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- 	.build_specific = patch_wolfson_wm9711_specific,
- };
- 
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
- }
- #endif
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- 	.build_specific = patch_wolfson_wm9713_specific,
- 	.build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM	
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
- 	return patch_sigmatel_stac97xx_specific(ac97);
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- 	.build_3d	= patch_sigmatel_stac9708_3d,
- 	.build_specific	= patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- 	.build_spdif = patch_cirrus_build_spdif
- };
- 
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- 	.build_spdif = patch_conexant_build_spdif
- };
- 
-@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
- 	{ AC97_VIDEO, 0x9f1f },
- 	{ AC97_AUX, 0x9f1f },
- 	{ AC97_PCM, 0x9f1f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_ad1819(struct snd_ac97 * ac97)
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
- 	}
- }
- 
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- 	.build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- 	.build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
- 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
- 
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- 	.build_specific	= patch_alc650_specific,
- 	.update_jacks = alc650_update_jacks
- };
-@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- 	.build_specific	= patch_alc655_specific,
- 	.update_jacks = alc655_update_jacks
- };
-@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- 	.build_specific	= patch_alc850_specific,
- 	.update_jacks = alc850_update_jacks
- };
-@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- 	.build_specific	= patch_cm9738_specific,
- 	.update_jacks = cm9738_update_jacks
- };
-@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
- 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
- 
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- 	.build_specific	= patch_cm9739_specific,
- 	.build_post_spdif = patch_cm9739_post_spdif,
- 	.update_jacks = cm9739_update_jacks
-@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- 	.build_specific	= patch_cm9761_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif,
- 	.update_jacks = cm9761_update_jacks
-@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
- 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- 	.build_specific	= patch_cm9780_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
- };
-@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- 	.build_specific	= patch_vt1616_specific
- };
- 
-@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- 	.build_specific	= patch_it2646_specific,
- 	.update_jacks = it2646_update_jacks
- };
-@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- 	.build_specific	= patch_si3036_specific,
- };
- 
-@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
- 	{ AC97_AUX, 0x1f1f },
- 	{ AC97_PCM, 0x1f1f },
- 	{ AC97_REC_GAIN, 0x0f0f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_lm4550(struct snd_ac97 *ac97)
-@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- 	.build_specific	= patch_ucb1400_specific,
- };
- 
-diff -urNp linux-2.6.32.12/sound/pci/ens1370.c linux-2.6.32.12/sound/pci/ens1370.c
---- linux-2.6.32.12/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/pci/ens1370.c	2010-04-04 20:46:41.732880788 -0400
-@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
- 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
- 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
-diff -urNp linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c
---- linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/pci/hda/patch_intelhdmi.c	2010-04-29 17:46:37.441762570 -0400
-@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
- 		cp_ready);
- 
- 	/* TODO */
--	if (cp_state)
--		;
--	if (cp_ready)
--		;
-+	if (cp_state) {
-+	}
-+	if (cp_ready) {
-+	}
- }
- 
- 
-diff -urNp linux-2.6.32.12/sound/pci/intel8x0.c linux-2.6.32.12/sound/pci/intel8x0.c
---- linux-2.6.32.12/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/pci/intel8x0.c	2010-04-04 20:46:41.732880788 -0400
-@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
-@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
- 		.type = AC97_TUNE_HP_ONLY
- 	},
- #endif
--	{ } /* terminator */
-+	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
- };
- 
- static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
-diff -urNp linux-2.6.32.12/sound/pci/intel8x0m.c linux-2.6.32.12/sound/pci/intel8x0m.c
---- linux-2.6.32.12/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/sound/pci/intel8x0m.c	2010-04-04 20:46:41.737788480 -0400
-@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- 	{ 0x5455, "ALi M5455" },
- 	{ 0x746d, "AMD AMD8111" },
- #endif
--	{ 0 },
-+	{ 0, NULL },
- };
- 
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.32.12/usr/gen_init_cpio.c linux-2.6.32.12/usr/gen_init_cpio.c
---- linux-2.6.32.12/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.12/usr/gen_init_cpio.c	2010-04-04 20:46:41.737788480 -0400
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
- 	int retval;
- 	int rc = -1;
- 	int namesize;
--	int i;
-+	unsigned int i;
- 
- 	mode |= S_IFREG;
- 
-@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
-                        *env_var = *expanded = '\0';
-                        strncat(env_var, start + 2, end - start - 2);
-                        strncat(expanded, new_location, start - new_location);
--                       strncat(expanded, getenv(env_var), PATH_MAX);
--                       strncat(expanded, end + 1, PATH_MAX);
-+                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
-                        strncpy(new_location, expanded, PATH_MAX);
-+                       new_location[PATH_MAX] = 0;
-                } else
-                        break;
-        }
-diff -urNp linux-2.6.32.12/virt/kvm/kvm_main.c linux-2.6.32.12/virt/kvm/kvm_main.c
---- linux-2.6.32.12/virt/kvm/kvm_main.c	2010-04-29 17:49:38.869035092 -0400
-+++ linux-2.6.32.12/virt/kvm/kvm_main.c	2010-04-29 17:49:58.805045845 -0400
-@@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vcpu_fops = {
- 	.release        = kvm_vcpu_release,
- 	.unlocked_ioctl = kvm_vcpu_ioctl,
-@@ -2344,6 +2345,7 @@ static int kvm_vm_mmap(struct file *file
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vm_fops = {
- 	.release        = kvm_vm_release,
- 	.unlocked_ioctl = kvm_vm_ioctl,
-@@ -2431,6 +2433,7 @@ out:
- 	return r;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_chardev_ops = {
- 	.unlocked_ioctl = kvm_dev_ioctl,
- 	.compat_ioctl   = kvm_dev_ioctl,
-@@ -2440,6 +2443,9 @@ static struct miscdevice kvm_dev = {
- 	KVM_MINOR,
- 	"kvm",
- 	&kvm_chardev_ops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static void hardware_enable(void *junk)
-@@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
- 	kvm_arch_vcpu_put(vcpu);
- }
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module)
- {
- 	int r;
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch
new file mode 100644
index 00000000..84b90626
--- /dev/null
+++ b/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch
@@ -0,0 +1,56087 @@
+diff -urNp linux-2.6.32.13/arch/alpha/include/asm/elf.h linux-2.6.32.13/arch/alpha/include/asm/elf.h
+--- linux-2.6.32.13/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/alpha/include/asm/elf.h	2010-05-15 13:21:13.518878295 -0400
+@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ 
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
++#endif
++
+ /* $0 is set by ld.so to a pointer to a function which might be 
+    registered using atexit.  This provides a mean for the dynamic
+    linker to call DT_FINI functions for shared libraries that have
+diff -urNp linux-2.6.32.13/arch/alpha/include/asm/pgtable.h linux-2.6.32.13/arch/alpha/include/asm/pgtable.h
+--- linux-2.6.32.13/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/alpha/include/asm/pgtable.h	2010-05-15 13:21:13.518878295 -0400
+@@ -101,6 +101,17 @@ struct vm_area_struct;
+ #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
+ #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
+ #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
+ 
+ #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
+diff -urNp linux-2.6.32.13/arch/alpha/kernel/module.c linux-2.6.32.13/arch/alpha/kernel/module.c
+--- linux-2.6.32.13/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/alpha/kernel/module.c	2010-05-15 13:21:13.518878295 -0400
+@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
+ 
+ 	/* The small sections were sorted to the end of the segment.
+ 	   The following should definitely cover them.  */
+-	gp = (u64)me->module_core + me->core_size - 0x8000;
++	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
+ 	got = sechdrs[me->arch.gotsecindex].sh_addr;
+ 
+ 	for (i = 0; i < n; i++) {
+diff -urNp linux-2.6.32.13/arch/alpha/kernel/osf_sys.c linux-2.6.32.13/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.32.13/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/alpha/kernel/osf_sys.c	2010-05-15 13:21:13.518878295 -0400
+@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
+ 	   merely specific addresses, but regions of memory -- perhaps
+ 	   this feature should be incorporated into all ports?  */
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
+ 		if (addr != (unsigned long) -ENOMEM)
+@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
+ 	}
+ 
+ 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
+-	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
+-					 len, limit);
++	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
++
+ 	if (addr != (unsigned long) -ENOMEM)
+ 		return addr;
+ 
+diff -urNp linux-2.6.32.13/arch/alpha/mm/fault.c linux-2.6.32.13/arch/alpha/mm/fault.c
+--- linux-2.6.32.13/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/alpha/mm/fault.c	2010-05-15 13:21:13.518878295 -0400
+@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
+ 	__reload_thread(pcb);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int ldah, ldq, jmp;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
++		    jmp == 0x6BFB0000U)
++		{
++			unsigned long r27, addr;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
++
++			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			err = get_user(r27, (unsigned long *)addr);
++			if (err)
++				break;
++
++			regs->r27 = r27;
++			regs->pc = r27;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #2 */
++		unsigned int ldah, lda, br;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(lda, (unsigned int *)(regs->pc+4));
++		err |= get_user(br, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
++		    (br & 0xFFE00000U) == 0xC3E00000U)
++		{
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
++
++			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int br;
++
++		err = get_user(br, (unsigned int *)regs->pc);
++
++		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
++			unsigned int br2, ldq, nop, jmp;
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
++
++			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			err = get_user(br2, (unsigned int *)addr);
++			err |= get_user(ldq, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			err |= get_user(jmp, (unsigned int *)(addr+12));
++			err |= get_user(resolver, (unsigned long *)(addr+16));
++
++			if (err)
++				break;
++
++			if (br2 == 0xC3600000U &&
++			    ldq == 0xA77B000CU &&
++			    nop == 0x47FF041FU &&
++			    jmp == 0x6B7B0000U)
++			{
++				regs->r28 = regs->pc+4;
++				regs->r27 = addr+16;
++				regs->pc = resolver;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
+ 
+ /*
+  * This routine handles page faults.  It determines the address,
+@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
+  good_area:
+ 	si_code = SEGV_ACCERR;
+ 	if (cause < 0) {
+-		if (!(vma->vm_flags & VM_EXEC))
++		if (!(vma->vm_flags & VM_EXEC)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
++			do_group_exit(SIGKILL);
++#else
+ 			goto bad_area;
++#endif
++
++		}
+ 	} else if (!cause) {
+ 		/* Allow reads even for write-only mappings */
+ 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
+diff -urNp linux-2.6.32.13/arch/arm/include/asm/elf.h linux-2.6.32.13/arch/arm/include/asm/elf.h
+--- linux-2.6.32.13/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/include/asm/elf.h	2010-05-15 13:21:13.518878295 -0400
+@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00008000UL
++
++#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#endif
+ 
+ /* When the program starts, a1 contains a pointer to a function to be 
+    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
+diff -urNp linux-2.6.32.13/arch/arm/include/asm/kmap_types.h linux-2.6.32.13/arch/arm/include/asm/kmap_types.h
+--- linux-2.6.32.13/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/include/asm/kmap_types.h	2010-05-15 13:21:13.518878295 -0400
+@@ -19,6 +19,7 @@ enum km_type {
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
+ 	KM_L2_CACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/arm/include/asm/uaccess.h linux-2.6.32.13/arch/arm/include/asm/uaccess.h
+--- linux-2.6.32.13/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/include/asm/uaccess.h	2010-05-15 13:21:13.518878295 -0400
+@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
+ 
+ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else /* security hole - plug it */
+@@ -412,6 +415,9 @@ static inline unsigned long __must_check
+ 
+ static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+diff -urNp linux-2.6.32.13/arch/arm/kernel/kgdb.c linux-2.6.32.13/arch/arm/kernel/kgdb.c
+--- linux-2.6.32.13/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/kernel/kgdb.c	2010-05-15 13:21:13.518878295 -0400
+@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
+  * and we handle the normal undef case within the do_undefinstr
+  * handler.
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ #ifndef __ARMEB__
+ 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
+ #else /* ! __ARMEB__ */
+diff -urNp linux-2.6.32.13/arch/arm/mach-at91/pm.c linux-2.6.32.13/arch/arm/mach-at91/pm.c
+--- linux-2.6.32.13/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-at91/pm.c	2010-05-15 13:21:13.518878295 -0400
+@@ -348,7 +348,7 @@ static void at91_pm_end(void)
+ }
+ 
+ 
+-static struct platform_suspend_ops at91_pm_ops ={
++static const struct platform_suspend_ops at91_pm_ops ={
+ 	.valid	= at91_pm_valid_state,
+ 	.begin	= at91_pm_begin,
+ 	.enter	= at91_pm_enter,
+diff -urNp linux-2.6.32.13/arch/arm/mach-omap1/pm.c linux-2.6.32.13/arch/arm/mach-omap1/pm.c
+--- linux-2.6.32.13/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-omap1/pm.c	2010-05-15 13:21:13.518878295 -0400
+@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
+ 
+ 
+ 
+-static struct platform_suspend_ops omap_pm_ops ={
++static const struct platform_suspend_ops omap_pm_ops ={
+ 	.prepare	= omap_pm_prepare,
+ 	.enter		= omap_pm_enter,
+ 	.finish		= omap_pm_finish,
+diff -urNp linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c
+--- linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c	2010-05-15 13:21:13.518878295 -0400
+@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
+ 	enable_hlt();
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.prepare	= omap2_pm_prepare,
+ 	.enter		= omap2_pm_enter,
+ 	.finish		= omap2_pm_finish,
+diff -urNp linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c
+--- linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c	2010-05-15 13:21:13.518878295 -0400
+@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
+ 	return;
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.begin		= omap3_pm_begin,
+ 	.end		= omap3_pm_end,
+ 	.prepare	= omap3_pm_prepare,
+diff -urNp linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c
+--- linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c	2010-05-15 13:21:13.518878295 -0400
+@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
+ 	       (state == PM_SUSPEND_MEM);
+ }
+ 
+-static struct platform_suspend_ops pnx4008_pm_ops = {
++static const struct platform_suspend_ops pnx4008_pm_ops = {
+ 	.enter = pnx4008_pm_enter,
+ 	.valid = pnx4008_pm_valid,
+ };
+diff -urNp linux-2.6.32.13/arch/arm/mach-pxa/pm.c linux-2.6.32.13/arch/arm/mach-pxa/pm.c
+--- linux-2.6.32.13/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-pxa/pm.c	2010-05-15 13:21:13.518878295 -0400
+@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
+ 		pxa_cpu_pm_fns->finish();
+ }
+ 
+-static struct platform_suspend_ops pxa_pm_ops = {
++static const struct platform_suspend_ops pxa_pm_ops = {
+ 	.valid		= pxa_pm_valid,
+ 	.enter		= pxa_pm_enter,
+ 	.prepare	= pxa_pm_prepare,
+diff -urNp linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c
+--- linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c	2010-05-15 13:21:13.531870735 -0400
+@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
+ }
+ 
+ #ifdef CONFIG_PM
+-static struct platform_suspend_ops sharpsl_pm_ops = {
++static const struct platform_suspend_ops sharpsl_pm_ops = {
+ 	.prepare	= pxa_pm_prepare,
+ 	.finish		= pxa_pm_finish,
+ 	.enter		= corgi_pxa_pm_enter,
+diff -urNp linux-2.6.32.13/arch/arm/mach-sa1100/pm.c linux-2.6.32.13/arch/arm/mach-sa1100/pm.c
+--- linux-2.6.32.13/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mach-sa1100/pm.c	2010-05-15 13:21:13.531870735 -0400
+@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
+ 	return virt_to_phys(sp);
+ }
+ 
+-static struct platform_suspend_ops sa11x0_pm_ops = {
++static const struct platform_suspend_ops sa11x0_pm_ops = {
+ 	.enter		= sa11x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.13/arch/arm/mm/fault.c linux-2.6.32.13/arch/arm/mm/fault.c
+--- linux-2.6.32.13/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mm/fault.c	2010-05-15 13:21:13.542880278 -0400
+@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
+ 	}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (fsr & FSR_LNX_PF) {
++		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	tsk->thread.address = addr;
+ 	tsk->thread.error_code = fsr;
+ 	tsk->thread.trap_no = 14;
+@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
+ }
+ #endif					/* CONFIG_MMU */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-4: ");
++	for (i = -1; i < 20; i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08lx ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * First Level Translation Fault Handler
+  *
+diff -urNp linux-2.6.32.13/arch/arm/mm/mmap.c linux-2.6.32.13/arch/arm/mm/mmap.c
+--- linux-2.6.32.13/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/mm/mmap.c	2010-05-15 13:21:13.546915063 -0400
+@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (len > TASK_SIZE)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -94,8 +98,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+diff -urNp linux-2.6.32.13/arch/arm/plat-s3c/pm.c linux-2.6.32.13/arch/arm/plat-s3c/pm.c
+--- linux-2.6.32.13/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/arm/plat-s3c/pm.c	2010-05-15 13:21:13.546915063 -0400
+@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
+ 	s3c_pm_check_cleanup();
+ }
+ 
+-static struct platform_suspend_ops s3c_pm_ops = {
++static const struct platform_suspend_ops s3c_pm_ops = {
+ 	.enter		= s3c_pm_enter,
+ 	.prepare	= s3c_pm_prepare,
+ 	.finish		= s3c_pm_finish,
+diff -urNp linux-2.6.32.13/arch/avr32/include/asm/elf.h linux-2.6.32.13/arch/avr32/include/asm/elf.h
+--- linux-2.6.32.13/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/avr32/include/asm/elf.h	2010-05-15 13:21:13.546915063 -0400
+@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00001000UL
++
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+diff -urNp linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h
+--- linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h	2010-05-15 13:21:13.546915063 -0400
+@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
+ D(11)	KM_IRQ1,
+ D(12)	KM_SOFTIRQ0,
+ D(13)	KM_SOFTIRQ1,
+-D(14)	KM_TYPE_NR
++D(14)	KM_CLEARPAGE,
++D(15)	KM_TYPE_NR
+ };
+ 
+ #undef D
+diff -urNp linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c
+--- linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c	2010-05-15 13:21:13.546915063 -0400
+@@ -176,7 +176,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops avr32_pm_ops = {
++static const struct platform_suspend_ops avr32_pm_ops = {
+ 	.valid	= avr32_pm_valid_state,
+ 	.enter	= avr32_pm_enter,
+ };
+diff -urNp linux-2.6.32.13/arch/avr32/mm/fault.c linux-2.6.32.13/arch/avr32/mm/fault.c
+--- linux-2.6.32.13/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/avr32/mm/fault.c	2010-05-15 13:21:13.546915063 -0400
+@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
+ 
+ int exception_trace = 1;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (unsigned char *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults. It determines the address and the
+  * problem, and then passes it off to one of the appropriate routines.
+@@ -157,6 +174,16 @@ bad_area:
+ 	up_read(&mm->mmap_sem);
+ 
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
++				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		if (exception_trace && printk_ratelimit())
+ 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
+ 			       "sp %08lx ecr %lu\n",
+diff -urNp linux-2.6.32.13/arch/blackfin/kernel/kgdb.c linux-2.6.32.13/arch/blackfin/kernel/kgdb.c
+--- linux-2.6.32.13/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/blackfin/kernel/kgdb.c	2010-05-15 13:21:13.568389913 -0400
+@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;		/* this means that we do not want to exit from the handler */
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0xa1},
+ #ifdef CONFIG_SMP
+ 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
+diff -urNp linux-2.6.32.13/arch/blackfin/mach-common/pm.c linux-2.6.32.13/arch/blackfin/mach-common/pm.c
+--- linux-2.6.32.13/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/blackfin/mach-common/pm.c	2010-05-15 13:21:13.568389913 -0400
+@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
+ 	return 0;
+ }
+ 
+-struct platform_suspend_ops bfin_pm_ops = {
++const struct platform_suspend_ops bfin_pm_ops = {
+ 	.enter = bfin_pm_enter,
+ 	.valid	= bfin_pm_valid,
+ };
+diff -urNp linux-2.6.32.13/arch/frv/include/asm/kmap_types.h linux-2.6.32.13/arch/frv/include/asm/kmap_types.h
+--- linux-2.6.32.13/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/frv/include/asm/kmap_types.h	2010-05-15 13:21:13.568389913 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c
+--- linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c	2010-05-15 13:21:13.584352190 -0400
+@@ -17,7 +17,7 @@
+ #include <linux/swiotlb.h>
+ #include <asm/machvec.h>
+ 
+-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
++extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
+ 
+ /* swiotlb declarations & definitions: */
+ extern int swiotlb_late_init_with_default_size (size_t size);
+@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
+ 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
+ }
+ 
+-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
++const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
+ {
+ 	if (use_swiotlb(dev))
+ 		return &swiotlb_dma_ops;
+diff -urNp linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c
+--- linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c	2010-05-15 13:21:13.614291139 -0400
+@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
+ 	},
+ };
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static int __init
+ sba_init(void)
+@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
+ 
+ __setup("sbapagesize=",sba_page_override);
+ 
+-struct dma_map_ops sba_dma_ops = {
++const struct dma_map_ops sba_dma_ops = {
+ 	.alloc_coherent		= sba_alloc_coherent,
+ 	.free_coherent		= sba_free_coherent,
+ 	.map_page		= sba_map_page,
+diff -urNp linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c
+--- linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c	2010-05-15 13:21:13.614854679 -0400
+@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
+ 
+ #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ /* Ugly but avoids duplication */
+ #include "../../../fs/binfmt_elf.c"
+ 
+diff -urNp linux-2.6.32.13/arch/ia64/ia32/ia32priv.h linux-2.6.32.13/arch/ia64/ia32/ia32priv.h
+--- linux-2.6.32.13/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/ia32/ia32priv.h	2010-05-15 13:21:13.614854679 -0400
+@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
+ #define ELF_DATA	ELFDATA2LSB
+ #define ELF_ARCH	EM_386
+ 
+-#define IA32_STACK_TOP		IA32_PAGE_OFFSET
++#ifdef CONFIG_PAX_RANDUSTACK
++#define __IA32_DELTA_STACK	(current->mm->delta_stack)
++#else
++#define __IA32_DELTA_STACK	0UL
++#endif
++
++#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
++
+ #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
+ #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
+ 
+diff -urNp linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h
+--- linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h	2010-05-15 13:21:13.614854679 -0400
+@@ -12,7 +12,7 @@
+ 
+ #define ARCH_HAS_DMA_GET_REQUIRED_MASK
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ extern struct ia64_machine_vector ia64_mv;
+ extern void set_iommu_machvec(void);
+ 
+@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *daddr, gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	void *caddr;
+ 
+ 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
+@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *caddr, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	debug_dma_free_coherent(dev, size, caddr, daddr);
+ 	ops->free_coherent(dev, size, caddr, daddr);
+ }
+@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->mapping_error(dev, daddr);
+ }
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->dma_supported(dev, mask);
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/ia64/include/asm/elf.h linux-2.6.32.13/arch/ia64/include/asm/elf.h
+--- linux-2.6.32.13/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/include/asm/elf.h	2010-05-15 13:21:13.614854679 -0400
+@@ -43,6 +43,13 @@
+  */
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ #define PT_IA_64_UNWIND		0x70000001
+ 
+ /* IA-64 relocations: */
+diff -urNp linux-2.6.32.13/arch/ia64/include/asm/machvec.h linux-2.6.32.13/arch/ia64/include/asm/machvec.h
+--- linux-2.6.32.13/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/include/asm/machvec.h	2010-05-15 13:21:13.614854679 -0400
+@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
+ /* DMA-mapping interface: */
+ typedef void ia64_mv_dma_init (void);
+ typedef u64 ia64_mv_dma_get_required_mask (struct device *);
+-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
++typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
+ 
+ /*
+  * WARNING: The legacy I/O space is _architected_.  Platforms are
+@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
+ # endif /* CONFIG_IA64_GENERIC */
+ 
+ extern void swiotlb_dma_init(void);
+-extern struct dma_map_ops *dma_get_ops(struct device *);
++extern const struct dma_map_ops *dma_get_ops(struct device *);
+ 
+ /*
+  * Define default versions so we can extend machvec for new platforms without having
+diff -urNp linux-2.6.32.13/arch/ia64/include/asm/pgtable.h linux-2.6.32.13/arch/ia64/include/asm/pgtable.h
+--- linux-2.6.32.13/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/include/asm/pgtable.h	2010-05-15 13:21:13.618628456 -0400
+@@ -143,6 +143,17 @@
+ #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
++# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++#endif
++
+ #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
+ #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
+ #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
+diff -urNp linux-2.6.32.13/arch/ia64/include/asm/uaccess.h linux-2.6.32.13/arch/ia64/include/asm/uaccess.h
+--- linux-2.6.32.13/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/include/asm/uaccess.h	2010-05-15 13:21:13.626873619 -0400
+@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
+ 	const void *__cu_from = (from);							\
+ 	long __cu_len = (n);								\
+ 											\
+-	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
++	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
+ 	long __cu_len = (n);								\
+ 											\
+ 	__chk_user_ptr(__cu_from);							\
+-	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
++	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c
+--- linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c	2010-05-15 13:21:13.626873619 -0400
+@@ -3,7 +3,7 @@
+ /* Set this to 1 if there is a HW IOMMU in the system */
+ int iommu_detected __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
+@@ -16,7 +16,7 @@ static int __init dma_init(void)
+ }
+ fs_initcall(dma_init);
+ 
+-struct dma_map_ops *dma_get_ops(struct device *dev)
++const struct dma_map_ops *dma_get_ops(struct device *dev)
+ {
+ 	return dma_ops;
+ }
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/module.c linux-2.6.32.13/arch/ia64/kernel/module.c
+--- linux-2.6.32.13/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/module.c	2010-05-15 13:21:13.626873619 -0400
+@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
+ void
+ module_free (struct module *mod, void *module_region)
+ {
+-	if (mod && mod->arch.init_unw_table &&
+-	    module_region == mod->module_init) {
++	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
+ 		unw_remove_unwind_table(mod->arch.init_unw_table);
+ 		mod->arch.init_unw_table = NULL;
+ 	}
+@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
+ }
+ 
+ static inline int
++in_init_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
++}
++
++static inline int
++in_init_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
++}
++
++static inline int
+ in_init (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_init < mod->init_size;
++	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
++}
++
++static inline int
++in_core_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
++}
++
++static inline int
++in_core_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
+ }
+ 
+ static inline int
+ in_core (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_core < mod->core_size;
++	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
+ }
+ 
+ static inline int
+@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
+ 		break;
+ 
+ 	      case RV_BDREL:
+-		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
++		if (in_init_rx(mod, val))
++			val -= (uint64_t) mod->module_init_rx;
++		else if (in_init_rw(mod, val))
++			val -= (uint64_t) mod->module_init_rw;
++		else if (in_core_rx(mod, val))
++			val -= (uint64_t) mod->module_core_rx;
++		else if (in_core_rw(mod, val))
++			val -= (uint64_t) mod->module_core_rw;
+ 		break;
+ 
+ 	      case RV_LTV:
+@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
+ 		 *     addresses have been selected...
+ 		 */
+ 		uint64_t gp;
+-		if (mod->core_size > MAX_LTOFF)
++		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
+ 			/*
+ 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
+ 			 * at the end of the module.
+ 			 */
+-			gp = mod->core_size - MAX_LTOFF / 2;
++			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
+ 		else
+-			gp = mod->core_size / 2;
+-		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
++			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
++		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
+ 		mod->arch.gp = gp;
+ 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
+ 	}
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/pci-dma.c linux-2.6.32.13/arch/ia64/kernel/pci-dma.c
+--- linux-2.6.32.13/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/pci-dma.c	2010-05-15 13:21:13.626873619 -0400
+@@ -43,7 +43,7 @@ struct device fallback_dev = {
+ 	.dma_mask = &fallback_dev.coherent_dma_mask,
+ };
+ 
+-extern struct dma_map_ops intel_dma_ops;
++extern const struct dma_map_ops intel_dma_ops;
+ 
+ static int __init pci_iommu_init(void)
+ {
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c
+--- linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c	2010-05-15 13:21:13.626873619 -0400
+@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
+ 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
+ }
+ 
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+ 	.map_page = swiotlb_map_page,
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c
+--- linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c	2010-05-15 13:21:13.626873619 -0400
+@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
+ 	if (REGION_NUMBER(addr) == RGN_HPAGE)
+ 		addr = 0;
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		addr = mm->free_area_cache;
++	else
++#endif
++
+ 	if (!addr)
+ 		addr = mm->free_area_cache;
+ 
+@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+ 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
++			if (start_addr != mm->mmap_base) {
+ 				/* Start a new search --- just in case we missed some holes.  */
+-				addr = TASK_UNMAPPED_BASE;
++				addr = mm->mmap_base;
+ 				goto full_search;
+ 			}
+ 			return -ENOMEM;
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/topology.c linux-2.6.32.13/arch/ia64/kernel/topology.c
+--- linux-2.6.32.13/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/topology.c	2010-05-15 13:21:13.626873619 -0400
+@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cache_sysfs_ops = {
++static const struct sysfs_ops cache_sysfs_ops = {
+ 	.show   = cache_show
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S
+--- linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S	2010-05-15 13:21:13.626873619 -0400
+@@ -190,7 +190,7 @@ SECTIONS
+   /* Per-cpu data: */
+   . = ALIGN(PERCPU_PAGE_SIZE);
+   PERCPU_VADDR(PERCPU_ADDR, :percpu)
+-  __phys_per_cpu_start = __per_cpu_load;
++  __phys_per_cpu_start = per_cpu_load;
+   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
+   						 * into percpu page size
+ 						 */
+diff -urNp linux-2.6.32.13/arch/ia64/mm/fault.c linux-2.6.32.13/arch/ia64/mm/fault.c
+--- linux-2.6.32.13/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/mm/fault.c	2010-05-15 13:21:13.626873619 -0400
+@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
+ 	return pte_present(pte);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ void __kprobes
+ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
+ {
+@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
+ 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
+ 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
+ 
+-	if ((vma->vm_flags & mask) != mask)
++	if ((vma->vm_flags & mask) != mask) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
+ 
++	}
++
+   survive:
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.13/arch/ia64/mm/init.c linux-2.6.32.13/arch/ia64/mm/init.c
+--- linux-2.6.32.13/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/mm/init.c	2010-05-15 13:21:13.626873619 -0400
+@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
+ 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
+ 		vma->vm_end = vma->vm_start + PAGE_SIZE;
+ 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
++			vma->vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++			if (current->mm->pax_flags & MF_PAX_MPROTECT)
++				vma->vm_flags &= ~VM_MAYEXEC;
++#endif
++
++		}
++#endif
++
+ 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 		down_write(&current->mm->mmap_sem);
+ 		if (insert_vm_struct(current->mm, vma)) {
+diff -urNp linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c
+--- linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c	2010-05-15 13:21:13.626873619 -0400
+@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
+ 	return ret;
+ }
+ 
+-static struct dma_map_ops sn_dma_ops = {
++static const struct dma_map_ops sn_dma_ops = {
+ 	.alloc_coherent		= sn_dma_alloc_coherent,
+ 	.free_coherent		= sn_dma_free_coherent,
+ 	.map_page		= sn_dma_map_page,
+diff -urNp linux-2.6.32.13/arch/m32r/lib/usercopy.c linux-2.6.32.13/arch/m32r/lib/usercopy.c
+--- linux-2.6.32.13/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/m32r/lib/usercopy.c	2010-05-15 13:21:13.630645180 -0400
+@@ -14,6 +14,9 @@
+ unsigned long
+ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetch(from);
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		__copy_user(to,from,n);
+@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
+ unsigned long
+ __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetchw(to);
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		__copy_user_zeroing(to,from,n);
+diff -urNp linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c
+--- linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c	2010-05-15 13:21:13.630645180 -0400
+@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
+ 
+ }
+ 
+-static struct platform_suspend_ops db1x_pm_ops = {
++static const struct platform_suspend_ops db1x_pm_ops = {
+ 	.valid		= suspend_valid_only_mem,
+ 	.begin		= db1x_pm_begin,
+ 	.enter		= db1x_pm_enter,
+diff -urNp linux-2.6.32.13/arch/mips/include/asm/elf.h linux-2.6.32.13/arch/mips/include/asm/elf.h
+--- linux-2.6.32.13/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/include/asm/elf.h	2010-05-15 13:21:13.630645180 -0400
+@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
+ #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
+ #endif
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #endif /* _ASM_ELF_H */
+diff -urNp linux-2.6.32.13/arch/mips/include/asm/page.h linux-2.6.32.13/arch/mips/include/asm/page.h
+--- linux-2.6.32.13/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/include/asm/page.h	2010-05-15 13:21:13.630645180 -0400
+@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
+   #ifdef CONFIG_CPU_MIPS32
+     typedef struct { unsigned long pte_low, pte_high; } pte_t;
+     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
+-    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
++    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
+   #else
+      typedef struct { unsigned long long pte; } pte_t;
+      #define pte_val(x)	((x).pte)
+diff -urNp linux-2.6.32.13/arch/mips/include/asm/system.h linux-2.6.32.13/arch/mips/include/asm/system.h
+--- linux-2.6.32.13/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/include/asm/system.h	2010-05-15 13:21:13.630645180 -0400
+@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
+  */
+ #define __ARCH_WANT_UNLOCKED_CTXSW
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ALMASK)
+ 
+ #endif /* _ASM_SYSTEM_H */
+diff -urNp linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c
+--- linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c	2010-05-15 13:21:13.630645180 -0400
+@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ #include <linux/module.h>
+ #include <linux/elfcore.h>
+diff -urNp linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c
+--- linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c	2010-05-15 13:21:13.630645180 -0400
+@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/mips/kernel/kgdb.c linux-2.6.32.13/arch/mips/kernel/kgdb.c
+--- linux-2.6.32.13/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/kernel/kgdb.c	2010-05-15 13:21:13.630645180 -0400
+@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;
+ }
+ 
++/* cannot be const */
+ struct kgdb_arch arch_kgdb_ops;
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/mips/kernel/process.c linux-2.6.32.13/arch/mips/kernel/process.c
+--- linux-2.6.32.13/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/kernel/process.c	2010-05-15 13:21:13.630645180 -0400
+@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
+ out:
+ 	return pc;
+ }
+-
+-/*
+- * Don't forget that the stack pointer must be aligned on a 8 bytes
+- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
+- */
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() & ~PAGE_MASK;
+-
+-	return sp & ALMASK;
+-}
+diff -urNp linux-2.6.32.13/arch/mips/kernel/syscall.c linux-2.6.32.13/arch/mips/kernel/syscall.c
+--- linux-2.6.32.13/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/kernel/syscall.c	2010-05-15 13:21:13.630645180 -0400
+@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
+ 	do_color_align = 0;
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
+ 		    (!vmm || addr + len <= vmm->vm_start))
+ 			return addr;
+ 	}
+-	addr = TASK_UNMAPPED_BASE;
++	addr = current->mm->mmap_base;
+ 	if (do_color_align)
+ 		addr = COLOUR_ALIGN(addr, pgoff);
+ 	else
+diff -urNp linux-2.6.32.13/arch/mips/mm/fault.c linux-2.6.32.13/arch/mips/mm/fault.c
+--- linux-2.6.32.13/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/mips/mm/fault.c	2010-05-15 13:21:13.630645180 -0400
+@@ -26,6 +26,23 @@
+ #include <asm/ptrace.h>
+ #include <asm/highmem.h>		/* For VMALLOC_END */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults.  It determines the address,
+  * and the problem, and then passes it off to one of the appropriate
+diff -urNp linux-2.6.32.13/arch/parisc/include/asm/elf.h linux-2.6.32.13/arch/parisc/include/asm/elf.h
+--- linux-2.6.32.13/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/include/asm/elf.h	2010-05-15 13:21:13.630645180 -0400
+@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+    but it's not easy, and we've already done it here.  */
+diff -urNp linux-2.6.32.13/arch/parisc/include/asm/pgtable.h linux-2.6.32.13/arch/parisc/include/asm/pgtable.h
+--- linux-2.6.32.13/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/include/asm/pgtable.h	2010-05-15 13:21:13.630645180 -0400
+@@ -207,6 +207,17 @@
+ #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
+ #define PAGE_COPY       PAGE_EXECREAD
+ #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
+ #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
+ #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
+diff -urNp linux-2.6.32.13/arch/parisc/kernel/module.c linux-2.6.32.13/arch/parisc/kernel/module.c
+--- linux-2.6.32.13/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/kernel/module.c	2010-05-15 13:21:13.630645180 -0400
+@@ -95,16 +95,38 @@
+ 
+ /* three functions to determine where in the module core
+  * or init pieces the location is */
++static inline int in_init_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rx &&
++		loc < (me->module_init_rx + me->init_size_rx));
++}
++
++static inline int in_init_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rw &&
++		loc < (me->module_init_rw + me->init_size_rw));
++}
++
+ static inline int in_init(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_init &&
+-		loc <= (me->module_init + me->init_size));
++	return in_init_rx(me, loc) || in_init_rw(me, loc);
++}
++
++static inline int in_core_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rx &&
++		loc < (me->module_core_rx + me->core_size_rx));
++}
++
++static inline int in_core_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rw &&
++		loc < (me->module_core_rw + me->core_size_rw));
+ }
+ 
+ static inline int in_core(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_core &&
+-		loc <= (me->module_core + me->core_size));
++	return in_core_rx(me, loc) || in_core_rw(me, loc);
+ }
+ 
+ static inline int in_local(struct module *me, void *loc)
+@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
+ 	}
+ 
+ 	/* align things a bit */
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += gots * sizeof(struct got_entry);
+-
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.fdesc_offset = me->core_size;
+-	me->core_size += fdescs * sizeof(Elf_Fdesc);
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += gots * sizeof(struct got_entry);
++
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.fdesc_offset = me->core_size_rw;
++	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
+ 
+ 	me->arch.got_max = gots;
+ 	me->arch.fdesc_max = fdescs;
+@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
+ 
+ 	BUG_ON(value == 0);
+ 
+-	got = me->module_core + me->arch.got_offset;
++	got = me->module_core_rw + me->arch.got_offset;
+ 	for (i = 0; got[i].addr; i++)
+ 		if (got[i].addr == value)
+ 			goto out;
+@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
+ #ifdef CONFIG_64BIT
+ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
+ {
+-	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
++	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
+ 
+ 	if (!value) {
+ 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
+@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
+ 
+ 	/* Create new one */
+ 	fdesc->addr = value;
+-	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 	return (Elf_Addr)fdesc;
+ }
+ #endif /* CONFIG_64BIT */
+@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
+ 
+ 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
+ 	end = table + sechdrs[me->arch.unwind_section].sh_size;
+-	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 
+ 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
+ 	       me->arch.unwind_section, table, end, gp);
+diff -urNp linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c
+--- linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c	2010-05-15 13:21:13.630645180 -0400
+@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (filp) {
+ 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
+diff -urNp linux-2.6.32.13/arch/parisc/kernel/traps.c linux-2.6.32.13/arch/parisc/kernel/traps.c
+--- linux-2.6.32.13/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/kernel/traps.c	2010-05-15 13:21:13.630645180 -0400
+@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
+ 
+ 			down_read(&current->mm->mmap_sem);
+ 			vma = find_vma(current->mm,regs->iaoq[0]);
+-			if (vma && (regs->iaoq[0] >= vma->vm_start)
+-				&& (vma->vm_flags & VM_EXEC)) {
+-
++			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
+ 				fault_address = regs->iaoq[0];
+ 				fault_space = regs->iasq[0];
+ 
+diff -urNp linux-2.6.32.13/arch/parisc/mm/fault.c linux-2.6.32.13/arch/parisc/mm/fault.c
+--- linux-2.6.32.13/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/parisc/mm/fault.c	2010-05-15 13:21:13.630645180 -0400
+@@ -15,6 +15,7 @@
+ #include <linux/sched.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
+ static unsigned long
+ parisc_acctyp(unsigned long code, unsigned int inst)
+ {
+-	if (code == 6 || code == 16)
++	if (code == 6 || code == 7 || code == 16)
+ 	    return VM_EXEC;
+ 
+ 	switch (inst & 0xf0000000) {
+@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
+ 			}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when rt_sigreturn trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int bl, depwi;
++
++		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
++
++		if (err)
++			break;
++
++		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
++			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
++
++			err = get_user(ldw, (unsigned int *)addr);
++			err |= get_user(bv, (unsigned int *)(addr+4));
++			err |= get_user(ldw2, (unsigned int *)(addr+8));
++
++			if (err)
++				break;
++
++			if (ldw == 0x0E801096U &&
++			    bv == 0xEAC0C000U &&
++			    ldw2 == 0x0E881095U)
++			{
++				unsigned int resolver, map;
++
++				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
++				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
++				if (err)
++					break;
++
++				regs->gr[20] = instruction_pointer(regs)+8;
++				regs->gr[21] = map;
++				regs->gr[22] = resolver;
++				regs->iaoq[0] = resolver | 3UL;
++				regs->iaoq[1] = regs->iaoq[0] + 4;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++
++#ifndef CONFIG_PAX_EMUSIGRT
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++#endif
++
++	do { /* PaX: rt_sigreturn emulation */
++		unsigned int ldi1, ldi2, bel, nop;
++
++		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
++		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
++		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
++
++		if (err)
++			break;
++
++		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
++		    ldi2 == 0x3414015AU &&
++		    bel == 0xE4008200U &&
++		    nop == 0x08000240U)
++		{
++			regs->gr[25] = (ldi1 & 2) >> 1;
++			regs->gr[20] = __NR_rt_sigreturn;
++			regs->gr[31] = regs->iaoq[1] + 16;
++			regs->sr[0] = regs->iasq[1];
++			regs->iaoq[0] = 0x100UL;
++			regs->iaoq[1] = regs->iaoq[0] + 4;
++			regs->iasq[0] = regs->sr[2];
++			regs->iasq[1] = regs->sr[2];
++			return 2;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fix;
+@@ -192,8 +303,33 @@ good_area:
+ 
+ 	acc_type = parisc_acctyp(code,regs->iir);
+ 
+-	if ((vma->vm_flags & acc_type) != acc_type)
++	if ((vma->vm_flags & acc_type) != acc_type) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
++		    (address & ~3UL) == instruction_pointer(regs))
++		{
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 3:
++				return;
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			case 2:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
++	}
+ 
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/device.h linux-2.6.32.13/arch/powerpc/include/asm/device.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/device.h	2010-05-15 13:21:13.630645180 -0400
+@@ -14,7 +14,7 @@ struct dev_archdata {
+ 	struct device_node	*of_node;
+ 
+ 	/* DMA operations on that device */
+-	struct dma_map_ops	*dma_ops;
++	const struct dma_map_ops	*dma_ops;
+ 
+ 	/*
+ 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h	2010-05-15 13:21:13.630645180 -0400
+@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
+ #ifdef CONFIG_PPC64
+ extern struct dma_map_ops dma_iommu_ops;
+ #endif
+-extern struct dma_map_ops dma_direct_ops;
++extern const struct dma_map_ops dma_direct_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ 	/* We don't handle the NULL dev case for ISA for now. We could
+ 	 * do it via an out of line call but it is not needed for now. The
+@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
+ 	return dev->archdata.dma_ops;
+ }
+ 
+-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
++static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
+ {
+ 	dev->archdata.dma_ops = ops;
+ }
+@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return 0;
+@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
+ 
+ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return -EIO;
+@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	BUG_ON(!dma_ops);
+@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!dma_ops);
+ 
+@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (dma_ops->mapping_error)
+ 		return dma_ops->mapping_error(dev, dma_addr);
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/elf.h linux-2.6.32.13/arch/powerpc/include/asm/elf.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/elf.h	2010-05-15 13:21:13.643322255 -0400
+@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-extern unsigned long randomize_et_dyn(unsigned long base);
+-#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
++#define ELF_ET_DYN_BASE		(0x20000000)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
++
++#ifdef __powerpc64__
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#else
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
++#endif
+ 
+ /*
+  * Our registers are always unsigned longs, whether we're a 32 bit
+@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
+ 	(0x7ff >> (PAGE_SHIFT - 12)) : \
+ 	(0x3ffff >> (PAGE_SHIFT - 12)))
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* __KERNEL__ */
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/iommu.h linux-2.6.32.13/arch/powerpc/include/asm/iommu.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/iommu.h	2010-05-15 13:21:13.643322255 -0400
+@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
+ extern void iommu_init_early_dart(void);
+ extern void iommu_init_early_pasemi(void);
+ 
++/* dma-iommu.c */
++extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
++
+ #ifdef CONFIG_PCI
+ extern void pci_iommu_init(void);
+ extern void pci_direct_iommu_init(void);
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h	2010-05-15 13:21:13.643322255 -0400
+@@ -26,6 +26,7 @@ enum km_type {
+ 	KM_SOFTIRQ1,
+ 	KM_PPC_SYNC_PAGE,
+ 	KM_PPC_SYNC_ICACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/page_64.h linux-2.6.32.13/arch/powerpc/include/asm/page_64.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/page_64.h	2010-05-15 13:21:13.643322255 -0400
+@@ -180,15 +180,18 @@ do {						\
+  * stack by default, so in the absense of a PT_GNU_STACK program header
+  * we turn execute permission off.
+  */
+-#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_STACK_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
++#ifndef CONFIG_PAX_PAGEEXEC
+ #define VM_STACK_DEFAULT_FLAGS \
+ 	(test_thread_flag(TIF_32BIT) ? \
+ 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
++#endif
+ 
+ #include <asm-generic/getorder.h>
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/page.h linux-2.6.32.13/arch/powerpc/include/asm/page.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/page.h	2010-05-15 13:21:13.643322255 -0400
+@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
+  * and needs to be executable.  This means the whole heap ends
+  * up being executable.
+  */
+-#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_DATA_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
+ #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
+ #endif
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ #undef STRICT_MM_TYPECHECKS
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/pci.h linux-2.6.32.13/arch/powerpc/include/asm/pci.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/pci.h	2010-05-15 13:21:13.643322255 -0400
+@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
+ }
+ 
+ #ifdef CONFIG_PCI
+-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
+-extern struct dma_map_ops *get_pci_dma_ops(void);
++extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
++extern const struct dma_map_ops *get_pci_dma_ops(void);
+ #else	/* CONFIG_PCI */
+ #define set_pci_dma_ops(d)
+ #define get_pci_dma_ops()	NULL
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h	2010-05-15 13:21:13.643322255 -0400
+@@ -21,6 +21,7 @@
+ #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
+ #define _PAGE_USER	0x004	/* usermode access allowed */
+ #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
++#define _PAGE_EXEC	_PAGE_GUARDED
+ #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
+ #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
+ #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/reg.h linux-2.6.32.13/arch/powerpc/include/asm/reg.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/reg.h	2010-05-15 13:21:13.643322255 -0400
+@@ -191,6 +191,7 @@
+ #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
+ #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
+ #define   DSISR_NOHPTE		0x40000000	/* no translation found */
++#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
+ #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
+ #define   DSISR_ISSTORE		0x02000000	/* access was a store */
+ #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h	2010-05-15 13:21:13.643322255 -0400
+@@ -13,7 +13,7 @@
+ 
+ #include <linux/swiotlb.h>
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static inline void dma_mark_clean(void *addr, size_t size) {}
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h
+--- linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h	2010-05-15 13:21:13.643322255 -0400
+@@ -327,52 +327,6 @@ do {								\
+ extern unsigned long __copy_tofrom_user(void __user *to,
+ 		const void __user *from, unsigned long size);
+ 
+-#ifndef __powerpc64__
+-
+-static inline unsigned long copy_from_user(void *to,
+-		const void __user *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_tofrom_user((__force void __user *)to, from, n);
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + n - TASK_SIZE;
+-		return __copy_tofrom_user((__force void __user *)to, from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-static inline unsigned long copy_to_user(void __user *to,
+-		const void *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __copy_tofrom_user(to, (__force void __user *)from, n);
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, (__force void __user *)from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-#else /* __powerpc64__ */
+-
+-#define __copy_in_user(to, from, size) \
+-	__copy_tofrom_user((to), (from), (size))
+-
+-extern unsigned long copy_from_user(void *to, const void __user *from,
+-				    unsigned long n);
+-extern unsigned long copy_to_user(void __user *to, const void *from,
+-				  unsigned long n);
+-extern unsigned long copy_in_user(void __user *to, const void __user *from,
+-				  unsigned long n);
+-
+-#endif /* __powerpc64__ */
+-
+ static inline unsigned long __copy_from_user_inatomic(void *to,
+ 		const void __user *from, unsigned long n)
+ {
+@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
+ 	return __copy_tofrom_user((__force void __user *)to, from, n);
+ }
+ 
+@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
+ }
+ 
+@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
+ 	return __copy_to_user_inatomic(to, from, size);
+ }
+ 
++#ifndef __powerpc64__
++
++static inline unsigned long __must_check copy_from_user(void *to,
++		const void __user *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_READ, from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		return __copy_tofrom_user((__force void __user *)to, from, n);
++	}
++	if ((unsigned long)from < TASK_SIZE) {
++		over = (unsigned long)from + n - TASK_SIZE;
++		if (!__builtin_constant_p(n - over))
++			check_object_size(to, n - over, false);
++		return __copy_tofrom_user((__force void __user *)to, from,
++				n - over) + over;
++	}
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to,
++		const void *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_WRITE, to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		return __copy_tofrom_user(to, (__force void __user *)from, n);
++	}
++	if ((unsigned long)to < TASK_SIZE) {
++		over = (unsigned long)to + n - TASK_SIZE;
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n - over, true);
++		return __copy_tofrom_user(to, (__force void __user *)from,
++				n - over) + over;
++	}
++	return n;
++}
++
++#else /* __powerpc64__ */
++
++#define __copy_in_user(to, from, size) \
++	__copy_tofrom_user((to), (from), (size))
++
++static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		n = __copy_from_user(to, from, n);
++	else
++		memset(to, 0, n);
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (likely(access_ok(VERIFY_WRITE, to, n))) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		n = __copy_to_user(to, from, n);
++	}
++	return n;
++}
++
++extern unsigned long copy_in_user(void __user *to, const void __user *from,
++				  unsigned long n);
++
++#endif /* __powerpc64__ */
++
+ extern unsigned long __clear_user(void __user *addr, unsigned long size);
+ 
+ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c
+--- linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c	2010-05-15 13:21:13.643322255 -0400
+@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
+ 	&cache_assoc_attr,
+ };
+ 
+-static struct sysfs_ops cache_index_ops = {
++static const struct sysfs_ops cache_index_ops = {
+ 	.show = cache_index_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma.c linux-2.6.32.13/arch/powerpc/kernel/dma.c
+--- linux-2.6.32.13/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/dma.c	2010-05-15 13:21:13.643322255 -0400
+@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
+ }
+ #endif
+ 
+-struct dma_map_ops dma_direct_ops = {
++const struct dma_map_ops dma_direct_ops = {
+ 	.alloc_coherent	= dma_direct_alloc_coherent,
+ 	.free_coherent	= dma_direct_free_coherent,
+ 	.map_sg		= dma_direct_map_sg,
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c
+--- linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c	2010-05-15 13:21:13.643322255 -0400
+@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
+ }
+ 
+ /* We support DMA to/from any memory page via the iommu */
+-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
++int dma_iommu_dma_supported(struct device *dev, u64 mask)
+ {
+ 	struct iommu_table *tbl = get_iommu_table_base(dev);
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c
+--- linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c	2010-05-15 13:21:13.646883281 -0400
+@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
+  * map_page, and unmap_page on highmem, use normal dma_ops
+  * for everything else.
+  */
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = dma_direct_alloc_coherent,
+ 	.free_coherent = dma_direct_free_coherent,
+ 	.map_sg = swiotlb_map_sg_attrs,
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S
+--- linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S	2010-05-15 13:21:13.646883281 -0400
+@@ -455,6 +455,7 @@ storage_fault_common:
+ 	std	r14,_DAR(r1)
+ 	std	r15,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	mr	r4,r14
+ 	mr	r5,r15
+ 	ld	r14,PACA_EXGEN+EX_R14(r13)
+@@ -464,8 +465,7 @@ storage_fault_common:
+ 	cmpdi	r3,0
+ 	bne-	1f
+ 	b	.ret_from_except_lite
+-1:	bl	.save_nvgprs
+-	mr	r5,r3
++1:	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	ld	r4,_DAR(r1)
+ 	bl	.bad_page_fault
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S
+--- linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S	2010-05-15 13:21:13.646883281 -0400
+@@ -818,10 +818,10 @@ handle_page_fault:
+ 11:	ld	r4,_DAR(r1)
+ 	ld	r5,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	bl	.do_page_fault
+ 	cmpdi	r3,0
+ 	beq+	13f
+-	bl	.save_nvgprs
+ 	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	lwz	r4,_DAR(r1)
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c
+--- linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c	2010-05-15 13:21:13.646883281 -0400
+@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
+ 	return 1;
+ }
+ 
+-static struct dma_map_ops ibmebus_dma_ops = {
++static const struct dma_map_ops ibmebus_dma_ops = {
+ 	.alloc_coherent = ibmebus_alloc_coherent,
+ 	.free_coherent  = ibmebus_free_coherent,
+ 	.map_sg         = ibmebus_map_sg,
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/kgdb.c linux-2.6.32.13/arch/powerpc/kernel/kgdb.c
+--- linux-2.6.32.13/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/kgdb.c	2010-05-15 13:21:13.658890137 -0400
+@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
+ 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
+ 		return 0;
+ 
+-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+ 		regs->nip += 4;
+ 
+ 	return 1;
+@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
+ /*
+  * Global data
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/module_32.c linux-2.6.32.13/arch/powerpc/kernel/module_32.c
+--- linux-2.6.32.13/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/module_32.c	2010-05-15 13:21:13.658890137 -0400
+@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
+ 			me->arch.core_plt_section = i;
+ 	}
+ 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
+-		printk("Module doesn't contain .plt or .init.plt sections.\n");
++		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
+ 		return -ENOEXEC;
+ 	}
+ 
+@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
+ 
+ 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
+ 	/* Init, or core PLT? */
+-	if (location >= mod->module_core
+-	    && location < mod->module_core + mod->core_size)
++	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
++	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
+-	else
++	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
++		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
++	else {
++		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
++		return ~0UL;
++	}
+ 
+ 	/* Find this entry, or if that fails, the next avail. entry */
+ 	while (entry->jump[0]) {
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/module.c linux-2.6.32.13/arch/powerpc/kernel/module.c
+--- linux-2.6.32.13/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/module.c	2010-05-15 13:21:13.658890137 -0400
+@@ -31,11 +31,24 @@
+ 
+ LIST_HEAD(module_bug_list);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
+ void *module_alloc(unsigned long size)
+ {
+ 	if (size == 0)
+ 		return NULL;
+ 
++	return vmalloc(size);
++}
++
++void *module_alloc_exec(unsigned long size)
++#else
++void *module_alloc(unsigned long size)
++#endif
++
++{
++	if (size == 0)
++		return NULL;
++
+ 	return vmalloc_exec(size);
+ }
+ 
+@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++#endif
++
+ static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
+ 				    const Elf_Shdr *sechdrs,
+ 				    const char *name)
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/pci-common.c linux-2.6.32.13/arch/powerpc/kernel/pci-common.c
+--- linux-2.6.32.13/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/pci-common.c	2010-05-15 13:21:13.678895652 -0400
+@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
+ unsigned int ppc_pci_flags = 0;
+ 
+ 
+-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
++static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
+ 
+-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
++void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
+ {
+ 	pci_dma_ops = dma_ops;
+ }
+ 
+-struct dma_map_ops *get_pci_dma_ops(void)
++const struct dma_map_ops *get_pci_dma_ops(void)
+ {
+ 	return pci_dma_ops;
+ }
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/process.c linux-2.6.32.13/arch/powerpc/kernel/process.c
+--- linux-2.6.32.13/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/process.c	2010-05-15 13:21:13.678895652 -0400
+@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
+ 		sp -= get_random_int() & ~PAGE_MASK;
+ 	return sp & ~0xf;
+ }
+-
+-static inline unsigned long brk_rnd(void)
+-{
+-        unsigned long rnd = 0;
+-
+-	/* 8MB for 32bit, 1GB for 64bit */
+-	if (is_32bit_task())
+-		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+-	else
+-		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+-
+-	return rnd << PAGE_SHIFT;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long base = mm->brk;
+-	unsigned long ret;
+-
+-#ifdef CONFIG_PPC_STD_MMU_64
+-	/*
+-	 * If we are using 1TB segments and we are allowed to randomise
+-	 * the heap, we can put it above 1TB so it is backed by a 1TB
+-	 * segment. Otherwise the heap will be in the bottom 1TB
+-	 * which always uses 256MB segments and this may result in a
+-	 * performance penalty.
+-	 */
+-	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
+-		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
+-#endif
+-
+-	ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < mm->brk)
+-		return mm->brk;
+-
+-	return ret;
+-}
+-
+-unsigned long randomize_et_dyn(unsigned long base)
+-{
+-	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < base)
+-		return base;
+-
+-	return ret;
+-}
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/signal_32.c linux-2.6.32.13/arch/powerpc/kernel/signal_32.c
+--- linux-2.6.32.13/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/signal_32.c	2010-05-15 13:21:13.686885851 -0400
+@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
+ 	/* Save user registers on the stack */
+ 	frame = &rt_sf->uc.uc_mcontext;
+ 	addr = frame;
+-	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		if (save_user_regs(regs, frame, 0, 1))
+ 			goto badframe;
+ 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/signal_64.c linux-2.6.32.13/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.32.13/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/signal_64.c	2010-05-15 13:21:13.686885851 -0400
+@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
+ 	current->thread.fpscr.val = 0;
+ 
+ 	/* Set up to return from userspace. */
+-	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
+ 	} else {
+ 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c
+--- linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c	2010-05-15 13:21:13.686885851 -0400
+@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
+ 	if (oldlenp) {
+ 		if (!error) {
+ 			if (get_user(oldlen, oldlenp) ||
+-			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
++			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
++			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
+ 				error = -EFAULT;
+ 		}
+-		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
+ 	}
+ 	return error;
+ }
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/vdso.c linux-2.6.32.13/arch/powerpc/kernel/vdso.c
+--- linux-2.6.32.13/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/vdso.c	2010-05-15 13:21:13.686885851 -0400
+@@ -36,6 +36,7 @@
+ #include <asm/firmware.h>
+ #include <asm/vdso.h>
+ #include <asm/vdso_datapage.h>
++#include <asm/mman.h>
+ 
+ #include "setup.h"
+ 
+@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = VDSO32_MBASE;
+ #endif
+ 
+-	current->mm->context.vdso_base = 0;
++	current->mm->context.vdso_base = ~0UL;
+ 
+ 	/* vDSO has a problem and was disabled, just don't "enable" it for the
+ 	 * process
+@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = get_unmapped_area(NULL, vdso_base,
+ 				      (vdso_pages << PAGE_SHIFT) +
+ 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
+-				      0, 0);
++				      0, MAP_PRIVATE | MAP_EXECUTABLE);
+ 	if (IS_ERR_VALUE(vdso_base)) {
+ 		rc = vdso_base;
+ 		goto fail_mmapsem;
+diff -urNp linux-2.6.32.13/arch/powerpc/kernel/vio.c linux-2.6.32.13/arch/powerpc/kernel/vio.c
+--- linux-2.6.32.13/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/kernel/vio.c	2010-05-15 13:21:13.690884467 -0400
+@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
+ 	vio_cmo_dealloc(viodev, alloc_size);
+ }
+ 
+-struct dma_map_ops vio_dma_mapping_ops = {
++static const struct dma_map_ops vio_dma_mapping_ops = {
+ 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
+ 	.free_coherent  = vio_dma_iommu_free_coherent,
+ 	.map_sg         = vio_dma_iommu_map_sg,
+ 	.unmap_sg       = vio_dma_iommu_unmap_sg,
++	.dma_supported  = dma_iommu_dma_supported,
+ 	.map_page       = vio_dma_iommu_map_page,
+ 	.unmap_page     = vio_dma_iommu_unmap_page,
+ 
+@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
+ 
+ static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
+ {
+-	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
+ 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c
+--- linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c	2010-05-15 13:21:13.690884467 -0400
+@@ -9,22 +9,6 @@
+ #include <linux/module.h>
+ #include <asm/uaccess.h>
+ 
+-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_READ, from, n)))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
+-}
+-
+-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_WRITE, to, n)))
+-		n = __copy_to_user(to, from, n);
+-	return n;
+-}
+-
+ unsigned long copy_in_user(void __user *to, const void __user *from,
+ 			   unsigned long n)
+ {
+@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
+ 	return n;
+ }
+ 
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.13/arch/powerpc/mm/fault.c linux-2.6.32.13/arch/powerpc/mm/fault.c
+--- linux-2.6.32.13/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/mm/fault.c	2010-05-15 13:21:13.690884467 -0400
+@@ -30,6 +30,10 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/perf_event.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/firmware.h>
+ #include <asm/page.h>
+@@ -40,6 +44,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/tlbflush.h>
+ #include <asm/siginfo.h>
++#include <asm/ptrace.h>
+ 
+ 
+ #ifdef CONFIG_KPROBES
+@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
+ }
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->nip = fault address)
++ *
++ * returns 1 when task should be killed
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int __user *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * Check whether the instruction at regs->nip is a store using
+  * an update addressing form which will update r1.
+@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
+ 	 * indicate errors in DSISR but can validly be set in SRR1.
+ 	 */
+ 	if (trap == 0x400)
+-		error_code &= 0x48200000;
++		error_code &= 0x58200000;
+ 	else
+ 		is_write = error_code & DSISR_ISSTORE;
+ #else
+@@ -250,7 +282,7 @@ good_area:
+          * "undefined".  Of those that can be set, this is the only
+          * one which seems bad.
+          */
+-	if (error_code & 0x10000000)
++	if (error_code & DSISR_GUARDED)
+                 /* Guarded storage error. */
+ 		goto bad_area;
+ #endif /* CONFIG_8xx */
+@@ -265,7 +297,7 @@ good_area:
+ 		 * processors use the same I/D cache coherency mechanism
+ 		 * as embedded.
+ 		 */
+-		if (error_code & DSISR_PROTFAULT)
++		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
+ 			goto bad_area;
+ #endif /* CONFIG_PPC_STD_MMU */
+ 
+@@ -335,6 +367,23 @@ bad_area:
+ bad_area_nosemaphore:
+ 	/* User mode accesses cause a SIGSEGV */
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++#ifdef CONFIG_PPC_STD_MMU
++			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
++#else
++			if (is_exec && regs->nip == address) {
++#endif
++				switch (pax_handle_fetch_fault(regs)) {
++				}
++
++				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		_exception(SIGSEGV, regs, code, address);
+ 		return 0;
+ 	}
+diff -urNp linux-2.6.32.13/arch/powerpc/mm/mmap_64.c linux-2.6.32.13/arch/powerpc/mm/mmap_64.c
+--- linux-2.6.32.13/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/mm/mmap_64.c	2010-05-15 13:21:13.694737832 -0400
+@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.13/arch/powerpc/mm/slice.c linux-2.6.32.13/arch/powerpc/mm/slice.c
+--- linux-2.6.32.13/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/mm/slice.c	2010-05-15 13:21:13.702894969 -0400
+@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
+ 	if (fixed && addr > (mm->task_size - len))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
++		addr = 0;
++#endif
++
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+ 		addr = _ALIGN_UP(addr, 1ul << pshift);
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c
+--- linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-05-15 13:21:13.702894969 -0400
+@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
+ 	lite5200_pm_target_state = PM_SUSPEND_ON;
+ }
+ 
+-static struct platform_suspend_ops lite5200_pm_ops = {
++static const struct platform_suspend_ops lite5200_pm_ops = {
+ 	.valid		= lite5200_pm_valid,
+ 	.begin		= lite5200_pm_begin,
+ 	.prepare	= lite5200_pm_prepare,
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c
+--- linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-05-15 13:21:13.706882202 -0400
+@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
+ 	iounmap(mbar);
+ }
+ 
+-static struct platform_suspend_ops mpc52xx_pm_ops = {
++static const struct platform_suspend_ops mpc52xx_pm_ops = {
+ 	.valid		= mpc52xx_pm_valid,
+ 	.prepare	= mpc52xx_pm_prepare,
+ 	.enter		= mpc52xx_pm_enter,
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c
+--- linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c	2010-05-15 13:21:13.714896740 -0400
+@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
+ 	return ret;
+ }
+ 
+-static struct platform_suspend_ops mpc83xx_suspend_ops = {
++static const struct platform_suspend_ops mpc83xx_suspend_ops = {
+ 	.valid = mpc83xx_suspend_valid,
+ 	.begin = mpc83xx_suspend_begin,
+ 	.enter = mpc83xx_suspend_enter,
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c
+--- linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c	2010-05-15 13:21:13.726905139 -0400
+@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
+ 
+ static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
+ 
+-struct dma_map_ops dma_iommu_fixed_ops = {
++const struct dma_map_ops dma_iommu_fixed_ops = {
+ 	.alloc_coherent = dma_fixed_alloc_coherent,
+ 	.free_coherent  = dma_fixed_free_coherent,
+ 	.map_sg         = dma_fixed_map_sg,
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c
+--- linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c	2010-05-15 13:21:13.726905139 -0400
+@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
+ 	return mask >= DMA_BIT_MASK(32);
+ }
+ 
+-static struct dma_map_ops ps3_sb_dma_ops = {
++static const struct dma_map_ops ps3_sb_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_sb_map_sg,
+@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
+ 	.unmap_page = ps3_unmap_page,
+ };
+ 
+-static struct dma_map_ops ps3_ioc0_dma_ops = {
++static const struct dma_map_ops ps3_ioc0_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_ioc0_map_sg,
+diff -urNp linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig
+--- linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig	2010-05-15 13:21:13.726905139 -0400
+@@ -2,6 +2,8 @@ config PPC_PSERIES
+ 	depends on PPC64 && PPC_BOOK3S
+ 	bool "IBM pSeries & new (POWER5-based) iSeries"
+ 	select MPIC
++	select PCI_MSI
++	select XICS
+ 	select PPC_I8259
+ 	select PPC_RTAS
+ 	select RTAS_ERROR_LOGGING
+diff -urNp linux-2.6.32.13/arch/s390/include/asm/elf.h linux-2.6.32.13/arch/s390/include/asm/elf.h
+--- linux-2.6.32.13/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/include/asm/elf.h	2010-05-15 13:21:13.745465180 -0400
+@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
+    that it will "exec", and that there is sufficient room for the brk.  */
+ #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports. */
+ 
+diff -urNp linux-2.6.32.13/arch/s390/include/asm/setup.h linux-2.6.32.13/arch/s390/include/asm/setup.h
+--- linux-2.6.32.13/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/include/asm/setup.h	2010-05-15 13:21:13.746887701 -0400
+@@ -50,13 +50,13 @@ extern unsigned long memory_end;
+ void detect_memory_layout(struct mem_chunk chunk[]);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-extern unsigned int switch_amode;
++#define switch_amode	(1)
+ #else
+ #define switch_amode	(0)
+ #endif
+ 
+ #ifdef CONFIG_S390_EXEC_PROTECT
+-extern unsigned int s390_noexec;
++#define s390_noexec	(1)
+ #else
+ #define s390_noexec	(0)
+ #endif
+diff -urNp linux-2.6.32.13/arch/s390/include/asm/uaccess.h linux-2.6.32.13/arch/s390/include/asm/uaccess.h
+--- linux-2.6.32.13/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/include/asm/uaccess.h	2010-05-15 13:21:13.746887701 -0400
+@@ -232,6 +232,10 @@ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
+ static inline unsigned long __must_check
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n) && (n <= 256))
+ 		return uaccess.copy_from_user_small(n, from, to);
+ 	else
+@@ -283,6 +290,10 @@ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else
+diff -urNp linux-2.6.32.13/arch/s390/Kconfig linux-2.6.32.13/arch/s390/Kconfig
+--- linux-2.6.32.13/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/Kconfig	2010-05-15 13:21:13.754899687 -0400
+@@ -194,28 +194,26 @@ config AUDIT_ARCH
+ 
+ config S390_SWITCH_AMODE
+ 	bool "Switch kernel/user addressing modes"
++	default y
+ 	help
+ 	  This option allows to switch the addressing modes of kernel and user
+-	  space. The kernel parameter switch_amode=on will enable this feature,
+-	  default is disabled. Enabling this (via kernel parameter) on machines
+-	  earlier than IBM System z9-109 EC/BC will reduce system performance.
++	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
++	  will reduce system performance.
+ 
+ 	  Note that this option will also be selected by selecting the execute
+-	  protection option below. Enabling the execute protection via the
+-	  noexec kernel parameter will also switch the addressing modes,
+-	  independent of the switch_amode kernel parameter.
++	  protection option below. Enabling the execute protection will also
++	  switch the addressing modes, independent of this option.
+ 
+ 
+ config S390_EXEC_PROTECT
+ 	bool "Data execute protection"
++	default y
+ 	select S390_SWITCH_AMODE
+ 	help
+ 	  This option allows to enable a buffer overflow protection for user
+ 	  space programs and it also selects the addressing mode option above.
+-	  The kernel parameter noexec=on will enable this feature and also
+-	  switch the addressing modes, default is disabled. Enabling this (via
+-	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
+-	  will reduce system performance.
++	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
++	  reduce system performance.
+ 
+ comment "Code generation options"
+ 
+diff -urNp linux-2.6.32.13/arch/s390/kernel/module.c linux-2.6.32.13/arch/s390/kernel/module.c
+--- linux-2.6.32.13/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/kernel/module.c	2010-05-15 13:21:13.754899687 -0400
+@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
+ 
+ 	/* Increase core size by size of got & plt and set start
+ 	   offsets for got and plt. */
+-	me->core_size = ALIGN(me->core_size, 4);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += me->arch.got_size;
+-	me->arch.plt_offset = me->core_size;
+-	me->core_size += me->arch.plt_size;
++	me->core_size_rw = ALIGN(me->core_size_rw, 4);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += me->arch.got_size;
++	me->arch.plt_offset = me->core_size_rx;
++	me->core_size_rx += me->arch.plt_size;
+ 	return 0;
+ }
+ 
+@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		if (info->got_initialized == 0) {
+ 			Elf_Addr *gotent;
+ 
+-			gotent = me->module_core + me->arch.got_offset +
++			gotent = me->module_core_rw + me->arch.got_offset +
+ 				info->got_offset;
+ 			*gotent = val;
+ 			info->got_initialized = 1;
+@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		else if (r_type == R_390_GOTENT ||
+ 			 r_type == R_390_GOTPLTENT)
+ 			*(unsigned int *) loc =
+-				(val + (Elf_Addr) me->module_core - loc) >> 1;
++				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
+ 		else if (r_type == R_390_GOT64 ||
+ 			 r_type == R_390_GOTPLT64)
+ 			*(unsigned long *) loc = val;
+@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
+ 		if (info->plt_initialized == 0) {
+ 			unsigned int *ip;
+-			ip = me->module_core + me->arch.plt_offset +
++			ip = me->module_core_rx + me->arch.plt_offset +
+ 				info->plt_offset;
+ #ifndef CONFIG_64BIT
+ 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
+@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
+ 			      (r_type == R_390_PLT32DBL &&
+ 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
+-				val = (Elf_Addr) me->module_core +
++				val = (Elf_Addr) me->module_core_rx +
+ 					me->arch.plt_offset +
+ 					info->plt_offset;
+ 			val += rela->r_addend - loc;
+@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
+ 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
+ 		val = val + rela->r_addend -
+-			((Elf_Addr) me->module_core + me->arch.got_offset);
++			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
+ 		if (r_type == R_390_GOTOFF16)
+ 			*(unsigned short *) loc = val;
+ 		else if (r_type == R_390_GOTOFF32)
+@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		break;
+ 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
+ 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
+-		val = (Elf_Addr) me->module_core + me->arch.got_offset +
++		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
+ 			rela->r_addend - loc;
+ 		if (r_type == R_390_GOTPC)
+ 			*(unsigned int *) loc = val;
+diff -urNp linux-2.6.32.13/arch/s390/kernel/setup.c linux-2.6.32.13/arch/s390/kernel/setup.c
+--- linux-2.6.32.13/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/kernel/setup.c	2010-05-15 13:21:13.754899687 -0400
+@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
+ early_param("mem", early_parse_mem);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-unsigned int switch_amode = 0;
+-EXPORT_SYMBOL_GPL(switch_amode);
+-
+ static int set_amode_and_uaccess(unsigned long user_amode,
+ 				 unsigned long user32_amode)
+ {
+@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
+ 		return 0;
+ 	}
+ }
+-
+-/*
+- * Switch kernel/user addressing modes?
+- */
+-static int __init early_parse_switch_amode(char *p)
+-{
+-	switch_amode = 1;
+-	return 0;
+-}
+-early_param("switch_amode", early_parse_switch_amode);
+-
+ #else /* CONFIG_S390_SWITCH_AMODE */
+ static inline int set_amode_and_uaccess(unsigned long user_amode,
+ 					unsigned long user32_amode)
+@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
+ }
+ #endif /* CONFIG_S390_SWITCH_AMODE */
+ 
+-#ifdef CONFIG_S390_EXEC_PROTECT
+-unsigned int s390_noexec = 0;
+-EXPORT_SYMBOL_GPL(s390_noexec);
+-
+-/*
+- * Enable execute protection?
+- */
+-static int __init early_parse_noexec(char *p)
+-{
+-	if (!strncmp(p, "off", 3))
+-		return 0;
+-	switch_amode = 1;
+-	s390_noexec = 1;
+-	return 0;
+-}
+-early_param("noexec", early_parse_noexec);
+-#endif /* CONFIG_S390_EXEC_PROTECT */
+-
+ static void setup_addressing_mode(void)
+ {
+ 	if (s390_noexec) {
+diff -urNp linux-2.6.32.13/arch/s390/mm/mmap.c linux-2.6.32.13/arch/s390/mm/mmap.c
+--- linux-2.6.32.13/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/s390/mm/mmap.c	2010-05-15 13:21:13.770895237 -0400
+@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c
+--- linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c	2010-05-15 13:21:13.770895237 -0400
+@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops hp6x0_pm_ops = {
++static const struct platform_suspend_ops hp6x0_pm_ops = {
+ 	.enter		= hp6x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c
+--- linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c	2010-05-15 13:21:13.782909212 -0400
+@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops sq_sysfs_ops = {
++static const struct sysfs_ops sq_sysfs_ops = {
+ 	.show	= sq_sysfs_show,
+ 	.store	= sq_sysfs_store,
+ };
+diff -urNp linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c
+--- linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c	2010-05-15 13:21:13.782909212 -0400
+@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops sh_pm_ops = {
++static const struct platform_suspend_ops sh_pm_ops = {
+ 	.enter          = sh_pm_enter,
+ 	.valid          = suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.13/arch/sh/kernel/kgdb.c linux-2.6.32.13/arch/sh/kernel/kgdb.c
+--- linux-2.6.32.13/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sh/kernel/kgdb.c	2010-05-15 13:21:13.782909212 -0400
+@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: trapa #0x3c */
+ #ifdef CONFIG_CPU_LITTLE_ENDIAN
+ 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h
+--- linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h	2010-05-15 13:21:13.782909212 -0400
+@@ -14,18 +14,38 @@
+ #define ATOMIC64_INIT(i)	{ (i) }
+ 
+ #define atomic_read(v)		((v)->counter)
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
+ #define atomic64_read(v)	((v)->counter)
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
+ 
+ #define atomic_set(v, i)	(((v)->counter) = i)
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
+ #define atomic64_set(v, i)	(((v)->counter) = i)
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
+ 
+ extern void atomic_add(int, atomic_t *);
++extern void atomic_add_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_add(int, atomic64_t *);
++extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
+ extern void atomic_sub(int, atomic_t *);
++extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_sub(int, atomic64_t *);
+ 
+ extern int atomic_add_ret(int, atomic_t *);
+ extern int atomic64_add_ret(int, atomic64_t *);
++extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
+ extern int atomic_sub_ret(int, atomic_t *);
+ extern int atomic64_sub_ret(int, atomic64_t *);
+ 
+@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ #define atomic_inc_return(v) atomic_add_ret(1, v)
+ #define atomic64_inc_return(v) atomic64_add_ret(1, v)
++#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
+ 
+ #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
+ #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
+@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
+ #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
+ 
+ #define atomic_inc(v) atomic_add(1, v)
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	atomic_add_unchecked(1, v);
++}
+ #define atomic64_inc(v) atomic64_add(1, v)
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
++	atomic64_add_unchecked(1, v);
++}
+ 
+ #define atomic_dec(v) atomic_sub(1, v)
+ #define atomic64_dec(v) atomic64_sub(1, v)
+@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%icc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
+ 
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%xcc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic64_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h
+--- linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h	2010-05-15 13:21:13.782909212 -0400
+@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
+ #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+ #define dma_is_consistent(d, h)	(1)
+ 
+-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
++extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
+ extern struct bus_type pci_bus_type;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
+ 	if (dev->bus == &pci_bus_type)
+@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
+@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
+ 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/elf_32.h linux-2.6.32.13/arch/sparc/include/asm/elf_32.h
+--- linux-2.6.32.13/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/elf_32.h	2010-05-15 13:21:13.782909212 -0400
+@@ -116,6 +116,13 @@ typedef struct {
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  This can NOT be done in userspace
+    on Sparc.  */
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/elf_64.h linux-2.6.32.13/arch/sparc/include/asm/elf_64.h
+--- linux-2.6.32.13/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/elf_64.h	2010-05-15 13:21:13.788083684 -0400
+@@ -163,6 +163,12 @@ typedef struct {
+ #define ELF_ET_DYN_BASE		0x0000010000000000UL
+ #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  */
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h
+--- linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h	2010-05-15 13:21:13.788083684 -0400
+@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
+ BTFIXUPDEF_INT(page_none)
+ BTFIXUPDEF_INT(page_copy)
+ BTFIXUPDEF_INT(page_readonly)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++BTFIXUPDEF_INT(page_shared_noexec)
++BTFIXUPDEF_INT(page_copy_noexec)
++BTFIXUPDEF_INT(page_readonly_noexec)
++#endif
++
+ BTFIXUPDEF_INT(page_kernel)
+ 
+ #define PMD_SHIFT		SUN4C_PMD_SHIFT
+@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
+ #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
+ #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++extern pgprot_t PAGE_SHARED_NOEXEC;
++# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
++# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ extern unsigned long page_kernel;
+ 
+ #ifdef MODULE
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h
+--- linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h	2010-05-15 13:21:13.788083684 -0400
+@@ -115,6 +115,13 @@
+ 				    SRMMU_EXEC | SRMMU_REF)
+ #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
+ 				    SRMMU_EXEC | SRMMU_REF)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
++#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#endif
++
+ #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
+ 				    SRMMU_DIRTY | SRMMU_REF)
+ 
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h
+--- linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h	2010-05-15 13:21:13.798894063 -0400
+@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
+ 	__asm__ __volatile__ (
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,pn		%0, 2f\n"
+-"4:	 add		%0, 1, %1\n"
++"4:	 addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
+ "	.previous"
+ 	: "=&r" (tmp1), "=&r" (tmp2)
+ 	: "r" (lock)
+-	: "memory");
++	: "memory", "cc");
+ }
+ 
+ static int inline arch_read_trylock(raw_rwlock_t *lock)
+@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,a,pn	%0, 2f\n"
+ "	 mov		0, %0\n"
+-"	add		%0, 1, %1\n"
++"	addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
+ 
+ 	__asm__ __volatile__(
+ "1:	lduw	[%2], %0\n"
+-"	sub	%0, 1, %1\n"
++"	subcc	%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs	%%icc, 6\n"
++#endif
++
+ "	cas	[%2], %0, %1\n"
+ "	cmp	%0, %1\n"
+ "	bne,pn	%%xcc, 1b\n"
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h
+--- linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h	2010-05-15 13:21:13.798894063 -0400
+@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
+ 
+ static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) to, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
+ 		return __copy_user(to, (__force void __user *) from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_user(to, (__force void __user *) from, n);
+ }
+ 
+ static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) from, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
+ 		return __copy_user((__force void __user *) to, from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	return __copy_user((__force void __user *) to, from, n);
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h
+--- linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h	2010-05-15 13:21:13.798894063 -0400
+@@ -9,6 +9,7 @@
+ #include <linux/compiler.h>
+ #include <linux/string.h>
+ #include <linux/thread_info.h>
++#include <linux/kernel.h>
+ #include <asm/asi.h>
+ #include <asm/system.h>
+ #include <asm/spitfire.h>
+@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
+        : "=r" (x) : "r" (__m(addr)), "i" (retval))
+ 
+ extern int __get_user_bad(void);
++extern void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ extern unsigned long __must_check ___copy_from_user(void *to,
+ 						    const void __user *from,
+@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
+ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_from_user(to, from, size);
++	unsigned long ret;
+ 
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(to, size, false);
++
++	ret = ___copy_from_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_from_user_fixup(to, from, size);
+ 	return ret;
+@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
+ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_to_user(to, from, size);
++	unsigned long ret;
++
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(from, size, true);
+ 
++	ret = ___copy_to_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_to_user_fixup(to, from, size);
+ 	return ret;
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/iommu.c linux-2.6.32.13/arch/sparc/kernel/iommu.c
+--- linux-2.6.32.13/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/iommu.c	2010-05-15 13:21:13.798894063 -0400
+@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4u_dma_ops = {
++static const struct dma_map_ops sun4u_dma_ops = {
+ 	.alloc_coherent		= dma_4u_alloc_coherent,
+ 	.free_coherent		= dma_4u_free_coherent,
+ 	.map_page		= dma_4u_map_page,
+@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
+ 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
++const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/ioport.c linux-2.6.32.13/arch/sparc/kernel/ioport.c
+--- linux-2.6.32.13/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/ioport.c	2010-05-15 13:21:13.798894063 -0400
+@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
+ 	BUG();
+ }
+ 
+-struct dma_map_ops sbus_dma_ops = {
++const struct dma_map_ops sbus_dma_ops = {
+ 	.alloc_coherent		= sbus_alloc_coherent,
+ 	.free_coherent		= sbus_free_coherent,
+ 	.map_page		= sbus_map_page,
+@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
+ 	.sync_sg_for_device	= sbus_sync_sg_for_device,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sbus_dma_ops;
++const struct dma_map_ops *dma_ops = &sbus_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int __init sparc_register_ioport(void)
+@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
+ 	}
+ }
+ 
+-struct dma_map_ops pci32_dma_ops = {
++const struct dma_map_ops pci32_dma_ops = {
+ 	.alloc_coherent		= pci32_alloc_coherent,
+ 	.free_coherent		= pci32_free_coherent,
+ 	.map_page		= pci32_map_page,
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c
+--- linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c	2010-05-15 13:21:13.810880669 -0400
+@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x7d */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
+ };
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c
+--- linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c	2010-05-15 13:21:13.810880669 -0400
+@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x72 */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
+ };
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/Makefile linux-2.6.32.13/arch/sparc/kernel/Makefile
+--- linux-2.6.32.13/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/Makefile	2010-05-15 13:21:13.810880669 -0400
+@@ -3,7 +3,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ extra-y     := head_$(BITS).o
+ extra-y     += init_task.o
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c
+--- linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c	2010-05-15 13:21:13.810880669 -0400
+@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4v_dma_ops = {
++static const struct dma_map_ops sun4v_dma_ops = {
+ 	.alloc_coherent			= dma_4v_alloc_coherent,
+ 	.free_coherent			= dma_4v_free_coherent,
+ 	.map_page			= dma_4v_map_page,
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c
+--- linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c	2010-05-15 13:21:13.810880669 -0400
+@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (ARCH_SUN4C && len > 0x20000000)
+ 		return -ENOMEM;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (flags & MAP_SHARED)
+ 		addr = COLOUR_ALIGN(addr);
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c
+--- linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c	2010-05-15 13:21:13.810880669 -0400
+@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
+ 	}
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
++		start_addr = addr = mm->mmap_base;
+ 	        mm->cached_hole_size = 0;
+ 	}
+ 
+@@ -175,8 +179,8 @@ full_search:
+ 			vma = find_vma(mm, VA_EXCLUDE_END);
+ 		}
+ 		if (unlikely(task_size < addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
+ 	    sysctl_legacy_va_layout) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 			gap = (task_size / 6 * 5);
+ 
+ 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.13/arch/sparc/kernel/traps_64.c linux-2.6.32.13/arch/sparc/kernel/traps_64.c
+--- linux-2.6.32.13/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/kernel/traps_64.c	2010-05-15 13:21:13.836227385 -0400
+@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
+ 
+ 	lvl -= 0x100;
+ 	if (regs->tstate & TSTATE_PRIV) {
++
++#ifdef CONFIG_PAX_REFCOUNT
++		if (lvl == 6)
++			pax_report_refcount_overflow(regs);
++#endif
++
+ 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
+ 		die_if_kernel(buffer, regs);
+ 	}
+@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
+ void bad_trap_tl1(struct pt_regs *regs, long lvl)
+ {
+ 	char buffer[32];
+-	
++
+ 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
+ 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
+ 		return;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++	if (lvl == 6)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
+ 
+ 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
+diff -urNp linux-2.6.32.13/arch/sparc/lib/atomic_64.S linux-2.6.32.13/arch/sparc/lib/atomic_64.S
+--- linux-2.6.32.13/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/lib/atomic_64.S	2010-05-15 13:21:13.836227385 -0400
+@@ -18,7 +18,12 @@
+ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_add, .-atomic_add
+ 
++	.globl	atomic_add_unchecked
++	.type	atomic_add_unchecked,#function
++atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	add	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_add_unchecked, .-atomic_add_unchecked
++
+ 	.globl	atomic_sub
+ 	.type	atomic_sub,#function
+ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_sub, .-atomic_sub
+ 
++	.globl	atomic_sub_unchecked
++	.type	atomic_sub_unchecked,#function
++atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	sub	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
++
+ 	.globl	atomic_add_ret
+ 	.type	atomic_add_ret,#function
+ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
+ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
+ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add, .-atomic64_add
+ 
++	.globl	atomic64_add_unchecked
++	.type	atomic64_add_unchecked,#function
++atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
++
+ 	.globl	atomic64_sub
+ 	.type	atomic64_sub,#function
+ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
+ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add_ret, .-atomic64_add_ret
+ 
++	.globl	atomic64_add_ret_unchecked
++	.type	atomic64_add_ret_unchecked,#function
++atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 add	%g7, %o0, %g7
++	mov	%g7, %o0
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
++
+ 	.globl	atomic64_sub_ret
+ 	.type	atomic64_sub_ret,#function
+ atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+diff -urNp linux-2.6.32.13/arch/sparc/lib/ksyms.c linux-2.6.32.13/arch/sparc/lib/ksyms.c
+--- linux-2.6.32.13/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/lib/ksyms.c	2010-05-15 13:21:13.836227385 -0400
+@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
+ 
+ /* Atomic counter implementation. */
+ EXPORT_SYMBOL(atomic_add);
++EXPORT_SYMBOL(atomic_add_unchecked);
+ EXPORT_SYMBOL(atomic_add_ret);
+ EXPORT_SYMBOL(atomic_sub);
++EXPORT_SYMBOL(atomic_sub_unchecked);
+ EXPORT_SYMBOL(atomic_sub_ret);
+ EXPORT_SYMBOL(atomic64_add);
+ EXPORT_SYMBOL(atomic64_add_ret);
+diff -urNp linux-2.6.32.13/arch/sparc/lib/rwsem_64.S linux-2.6.32.13/arch/sparc/lib/rwsem_64.S
+--- linux-2.6.32.13/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/lib/rwsem_64.S	2010-05-15 13:21:13.836227385 -0400
+@@ -11,7 +11,12 @@
+ 	.globl		__down_read
+ __down_read:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -33,7 +38,12 @@ __down_read:
+ 	.globl		__down_read_trylock
+ __down_read_trylock:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cmp		%g7, 0
+ 	bl,pn		%icc, 2f
+ 	 mov		0, %o1
+@@ -51,7 +61,12 @@ __down_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -77,7 +92,12 @@ __down_write_trylock:
+ 	cmp		%g3, 0
+ 	bne,pn		%icc, 2f
+ 	 mov		0, %o1
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -90,7 +110,12 @@ __down_write_trylock:
+ __up_read:
+ 1:
+ 	lduw		[%o0], %g1
+-	sub		%g1, 1, %g7
++	subcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -118,7 +143,12 @@ __up_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -143,7 +173,12 @@ __downgrade_write:
+ 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+diff -urNp linux-2.6.32.13/arch/sparc/Makefile linux-2.6.32.13/arch/sparc/Makefile
+--- linux-2.6.32.13/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/Makefile	2010-05-15 13:21:13.836227385 -0400
+@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
+ # Export what is needed by arch/sparc/boot/Makefile
+ export VMLINUX_INIT VMLINUX_MAIN
+ VMLINUX_INIT := $(head-y) $(init-y)
+-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
+ VMLINUX_MAIN += $(drivers-y) $(net-y)
+ 
+diff -urNp linux-2.6.32.13/arch/sparc/mm/fault_32.c linux-2.6.32.13/arch/sparc/mm/fault_32.c
+--- linux-2.6.32.13/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/mm/fault_32.c	2010-05-15 13:21:13.836227385 -0400
+@@ -21,6 +21,9 @@
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+ #include <linux/kdebug.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/system.h>
+ #include <asm/page.h>
+@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
+ 	return safe_compute_effective_address(regs, insn);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->pc);
++		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned int addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->pc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned int addr;
++
++			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(ba, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr, save, call;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			else
++				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->pc = call_dl_resolve;
++				regs->npc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++				regs->pc = addr;
++				regs->npc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->pc-4));
++		err |= get_user(call, (unsigned int *)regs->pc);
++		err |= get_user(nop, (unsigned int *)(regs->pc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
++
++			regs->u_regs[UREG_RETPC] = regs->pc;
++			regs->pc = dl_resolve;
++			regs->npc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
+ 			       unsigned long address)
+ {
+@@ -231,6 +495,24 @@ good_area:
+ 		if(!(vma->vm_flags & VM_WRITE))
+ 			goto bad_area;
+ 	} else {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		/* Allow reads even for write-only mappings */
+ 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
+ 			goto bad_area;
+diff -urNp linux-2.6.32.13/arch/sparc/mm/fault_64.c linux-2.6.32.13/arch/sparc/mm/fault_64.c
+--- linux-2.6.32.13/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/mm/fault_64.c	2010-05-15 13:21:13.842890995 -0400
+@@ -20,6 +20,9 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/percpu.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
+ 	show_regs(regs);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->tpc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->tpc);
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->tpc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned long addr;
++
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #4 */
++		unsigned int sethi, mov1, call, mov2;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(call, (unsigned int *)(regs->tpc+8));
++		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    mov1 == 0x8210000FU &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    mov2 == 0x9E100001U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
++			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #5 */
++		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    (or1 & 0xFFFFE000U) == 0x82106000U &&
++		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++		    sllx == 0x83287020U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #6 */
++		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or, (unsigned int *)(regs->tpc+16));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    sllx == 0x83287020U &&
++		    (or & 0xFFFFE000U) == 0x8A116000U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++			unsigned int save, call;
++			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++			else
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->tpc = call_dl_resolve;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++				if (test_thread_flag(TIF_32BIT))
++					addr &= 0xFFFFFFFFUL;
++
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++
++			/* PaX: 64-bit PLT stub */
++			err = get_user(sethi1, (unsigned int *)addr);
++			err |= get_user(sethi2, (unsigned int *)(addr+4));
++			err |= get_user(or1, (unsigned int *)(addr+8));
++			err |= get_user(or2, (unsigned int *)(addr+12));
++			err |= get_user(sllx, (unsigned int *)(addr+16));
++			err |= get_user(add, (unsigned int *)(addr+20));
++			err |= get_user(jmpl, (unsigned int *)(addr+24));
++			err |= get_user(nop, (unsigned int *)(addr+28));
++			if (err)
++				break;
++
++			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
++			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++			    (or1 & 0xFFFFE000U) == 0x88112000U &&
++			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++			    sllx == 0x89293020U &&
++			    add == 0x8A010005U &&
++			    jmpl == 0x89C14000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++				regs->u_regs[UREG_G4] <<= 32;
++				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
++				regs->u_regs[UREG_G4] = addr + 24;
++				addr = regs->u_regs[UREG_G5];
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->tpc-4));
++		err |= get_user(call, (unsigned int *)regs->tpc);
++		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				dl_resolve &= 0xFFFFFFFFUL;
++
++			regs->u_regs[UREG_RETPC] = regs->tpc;
++			regs->tpc = dl_resolve;
++			regs->tnpc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (ba & 0xFFF00000U) == 0x30600000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ 	struct mm_struct *mm = current->mm;
+@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
+ 	if (!vma)
+ 		goto bad_area;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	/* PaX: detect ITLB misses on non-exec pages */
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
++	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
++	{
++		if (address != regs->tpc)
++			goto good_area;
++
++		up_read(&mm->mmap_sem);
++		switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++		case 2:
++		case 3:
++			return;
++#endif
++
++		}
++		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	/* Pure DTLB misses do not tell us whether the fault causing
+ 	 * load/store/atomic was a write or not, it only says that there
+ 	 * was no match.  So in such a case we (carefully) read the
+diff -urNp linux-2.6.32.13/arch/sparc/mm/init_32.c linux-2.6.32.13/arch/sparc/mm/init_32.c
+--- linux-2.6.32.13/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/mm/init_32.c	2010-05-15 13:21:13.842890995 -0400
+@@ -317,6 +317,9 @@ extern void device_scan(void);
+ pgprot_t PAGE_SHARED __read_mostly;
+ EXPORT_SYMBOL(PAGE_SHARED);
+ 
++pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
++EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
++
+ void __init paging_init(void)
+ {
+ 	switch(sparc_cpu_model) {
+@@ -345,17 +348,17 @@ void __init paging_init(void)
+ 
+ 	/* Initialize the protection map with non-constant, MMU dependent values. */
+ 	protection_map[0] = PAGE_NONE;
+-	protection_map[1] = PAGE_READONLY;
+-	protection_map[2] = PAGE_COPY;
+-	protection_map[3] = PAGE_COPY;
++	protection_map[1] = PAGE_READONLY_NOEXEC;
++	protection_map[2] = PAGE_COPY_NOEXEC;
++	protection_map[3] = PAGE_COPY_NOEXEC;
+ 	protection_map[4] = PAGE_READONLY;
+ 	protection_map[5] = PAGE_READONLY;
+ 	protection_map[6] = PAGE_COPY;
+ 	protection_map[7] = PAGE_COPY;
+ 	protection_map[8] = PAGE_NONE;
+-	protection_map[9] = PAGE_READONLY;
+-	protection_map[10] = PAGE_SHARED;
+-	protection_map[11] = PAGE_SHARED;
++	protection_map[9] = PAGE_READONLY_NOEXEC;
++	protection_map[10] = PAGE_SHARED_NOEXEC;
++	protection_map[11] = PAGE_SHARED_NOEXEC;
+ 	protection_map[12] = PAGE_READONLY;
+ 	protection_map[13] = PAGE_READONLY;
+ 	protection_map[14] = PAGE_SHARED;
+diff -urNp linux-2.6.32.13/arch/sparc/mm/Makefile linux-2.6.32.13/arch/sparc/mm/Makefile
+--- linux-2.6.32.13/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/mm/Makefile	2010-05-15 13:21:13.842890995 -0400
+@@ -2,7 +2,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
+ obj-y                   += fault_$(BITS).o
+diff -urNp linux-2.6.32.13/arch/sparc/mm/srmmu.c linux-2.6.32.13/arch/sparc/mm/srmmu.c
+--- linux-2.6.32.13/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/sparc/mm/srmmu.c	2010-05-15 13:21:13.854885513 -0400
+@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
+ 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
+ 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
+ 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
++	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
++	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
++#endif
++
+ 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
+ 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
+ 
+diff -urNp linux-2.6.32.13/arch/um/include/asm/kmap_types.h linux-2.6.32.13/arch/um/include/asm/kmap_types.h
+--- linux-2.6.32.13/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/um/include/asm/kmap_types.h	2010-05-15 13:21:13.854885513 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.13/arch/um/include/asm/page.h linux-2.6.32.13/arch/um/include/asm/page.h
+--- linux-2.6.32.13/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/um/include/asm/page.h	2010-05-15 13:21:13.854885513 -0400
+@@ -14,6 +14,9 @@
+ #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
+ #define PAGE_MASK	(~(PAGE_SIZE-1))
+ 
++#define ktla_ktva(addr)			(addr)
++#define ktva_ktla(addr)			(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ struct page;
+diff -urNp linux-2.6.32.13/arch/um/sys-i386/syscalls.c linux-2.6.32.13/arch/um/sys-i386/syscalls.c
+--- linux-2.6.32.13/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/um/sys-i386/syscalls.c	2010-05-15 13:21:13.862896966 -0400
+@@ -11,6 +11,21 @@
+ #include "asm/uaccess.h"
+ #include "asm/unistd.h"
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+diff -urNp linux-2.6.32.13/arch/x86/boot/bitops.h linux-2.6.32.13/arch/x86/boot/bitops.h
+--- linux-2.6.32.13/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/bitops.h	2010-05-15 13:21:13.862896966 -0400
+@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
+ 	u8 v;
+ 	const u32 *p = (const u32 *)addr;
+ 
+-	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
++	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+ 	return v;
+ }
+ 
+@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
+ 
+ static inline void set_bit(int nr, void *addr)
+ {
+-	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
++	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
+ }
+ 
+ #endif /* BOOT_BITOPS_H */
+diff -urNp linux-2.6.32.13/arch/x86/boot/boot.h linux-2.6.32.13/arch/x86/boot/boot.h
+--- linux-2.6.32.13/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/boot.h	2010-05-15 13:21:13.862896966 -0400
+@@ -82,7 +82,7 @@ static inline void io_delay(void)
+ static inline u16 ds(void)
+ {
+ 	u16 seg;
+-	asm("movw %%ds,%0" : "=rm" (seg));
++	asm volatile("movw %%ds,%0" : "=rm" (seg));
+ 	return seg;
+ }
+ 
+@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
+ static inline int memcmp(const void *s1, const void *s2, size_t len)
+ {
+ 	u8 diff;
+-	asm("repe; cmpsb; setnz %0"
++	asm volatile("repe; cmpsb; setnz %0"
+ 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
+ 	return diff;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/head_32.S linux-2.6.32.13/arch/x86/boot/compressed/head_32.S
+--- linux-2.6.32.13/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/compressed/head_32.S	2010-05-15 13:21:13.862896966 -0400
+@@ -76,7 +76,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl    %eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -149,7 +149,7 @@ relocated:
+  * and where it was actually loaded.
+  */
+ 	movl	%ebp, %ebx
+-	subl	$LOAD_PHYSICAL_ADDR, %ebx
++	subl	$____LOAD_PHYSICAL_ADDR, %ebx
+ 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
+ /*
+  * Process relocations.
+@@ -157,8 +157,7 @@ relocated:
+ 
+ 1:	subl	$4, %edi
+ 	movl	(%edi), %ecx
+-	testl	%ecx, %ecx
+-	jz	2f
++	jecxz	2f
+ 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
+ 	jmp	1b
+ 2:
+diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/head_64.S linux-2.6.32.13/arch/x86/boot/compressed/head_64.S
+--- linux-2.6.32.13/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/compressed/head_64.S	2010-05-15 13:21:13.862896966 -0400
+@@ -91,7 +91,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl	%eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -234,7 +234,7 @@ ENTRY(startup_64)
+ 	notq	%rax
+ 	andq	%rax, %rbp
+ #else
+-	movq	$LOAD_PHYSICAL_ADDR, %rbp
++	movq	$____LOAD_PHYSICAL_ADDR, %rbp
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/misc.c linux-2.6.32.13/arch/x86/boot/compressed/misc.c
+--- linux-2.6.32.13/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/compressed/misc.c	2010-05-15 13:21:13.866567010 -0400
+@@ -288,7 +288,7 @@ static void parse_elf(void *output)
+ 		case PT_LOAD:
+ #ifdef CONFIG_RELOCATABLE
+ 			dest = output;
+-			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
++			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
+ #else
+ 			dest = (void *)(phdr->p_paddr);
+ #endif
+@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
+ 		error("Destination address too large");
+ #endif
+ #ifndef CONFIG_RELOCATABLE
+-	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
++	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
+ 		error("Wrong destination address");
+ #endif
+ 
+diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c
+--- linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c	2010-05-15 13:21:13.866567010 -0400
+@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
+ 
+ 	offs = (olen > ilen) ? olen - ilen : 0;
+ 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
+-	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
++	offs += 64*1024;	/* Add 64K bytes slack */
+ 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
+ 
+ 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
+diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/relocs.c linux-2.6.32.13/arch/x86/boot/compressed/relocs.c
+--- linux-2.6.32.13/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/compressed/relocs.c	2010-05-15 13:21:13.866567010 -0400
+@@ -10,8 +10,11 @@
+ #define USE_BSD
+ #include <endian.h>
+ 
++#include "../../../../include/linux/autoconf.h"
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ 
+@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
+ 
+ static int is_safe_abs_reloc(const char* sym_name)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
+ 		if (!strcmp(sym_name, safe_abs_relocs[i]))
+@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
+ 
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
+ 			if (sym->st_shndx == SHN_ABS) {
+ 				continue;
+ 			}
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
+ 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
+ 				/*
+ 				 * NONE can be ignored and and PC relative
+@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
+ 
+ static void emit_relocs(int as_text)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc);
+@@ -634,6 +693,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
+diff -urNp linux-2.6.32.13/arch/x86/boot/cpucheck.c linux-2.6.32.13/arch/x86/boot/cpucheck.c
+--- linux-2.6.32.13/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/cpucheck.c	2010-05-15 13:21:13.878594921 -0400
+@@ -74,7 +74,7 @@ static int has_fpu(void)
+ 	u16 fcw = -1, fsw = -1;
+ 	u32 cr0;
+ 
+-	asm("movl %%cr0,%0" : "=r" (cr0));
++	asm volatile("movl %%cr0,%0" : "=r" (cr0));
+ 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
+ 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
+ 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
+@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
+ {
+ 	u32 f0, f1;
+ 
+-	asm("pushfl ; "
++	asm volatile("pushfl ; "
+ 	    "pushfl ; "
+ 	    "popl %0 ; "
+ 	    "movl %0,%1 ; "
+@@ -115,7 +115,7 @@ static void get_flags(void)
+ 		set_bit(X86_FEATURE_FPU, cpu.flags);
+ 
+ 	if (has_eflag(X86_EFLAGS_ID)) {
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_intel_level),
+ 		      "=b" (cpu_vendor[0]),
+ 		      "=d" (cpu_vendor[1]),
+@@ -124,7 +124,7 @@ static void get_flags(void)
+ 
+ 		if (max_intel_level >= 0x00000001 &&
+ 		    max_intel_level <= 0x0000ffff) {
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "=a" (tfms),
+ 			      "=c" (cpu.flags[4]),
+ 			      "=d" (cpu.flags[0])
+@@ -136,7 +136,7 @@ static void get_flags(void)
+ 				cpu.model += ((tfms >> 16) & 0xf) << 4;
+ 		}
+ 
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_amd_level)
+ 		    : "a" (0x80000000)
+ 		    : "ebx", "ecx", "edx");
+@@ -144,7 +144,7 @@ static void get_flags(void)
+ 		if (max_amd_level >= 0x80000001 &&
+ 		    max_amd_level <= 0x8000ffff) {
+ 			u32 eax = 0x80000001;
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "+a" (eax),
+ 			      "=c" (cpu.flags[6]),
+ 			      "=d" (cpu.flags[1])
+@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_K7_HWCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax &= ~(1 << 15);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		get_flags();	/* Make sure it really did something */
+ 		err = check_flags();
+@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_VIA_FCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax |= (1<<1)|(1<<7);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		set_bit(X86_FEATURE_CX8, cpu.flags);
+ 		err = check_flags();
+@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 eax, edx;
+ 		u32 level = 1;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+-		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
+-		asm("cpuid"
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
++		asm volatile("cpuid"
+ 		    : "+a" (level), "=d" (cpu.flags[0])
+ 		    : : "ecx", "ebx");
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		err = check_flags();
+ 	}
+diff -urNp linux-2.6.32.13/arch/x86/boot/header.S linux-2.6.32.13/arch/x86/boot/header.S
+--- linux-2.6.32.13/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/header.S	2010-05-15 13:21:13.878594921 -0400
+@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
+ 						# single linked list of
+ 						# struct setup_data
+ 
+-pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
++pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
+ 
+ #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
+ #define VO_INIT_SIZE	(VO__end - VO__text)
+diff -urNp linux-2.6.32.13/arch/x86/boot/memory.c linux-2.6.32.13/arch/x86/boot/memory.c
+--- linux-2.6.32.13/arch/x86/boot/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/memory.c	2010-05-15 13:21:13.878594921 -0400
+@@ -19,7 +19,7 @@
+ 
+ static int detect_memory_e820(void)
+ {
+-	int count = 0;
++	unsigned int count = 0;
+ 	struct biosregs ireg, oreg;
+ 	struct e820entry *desc = boot_params.e820_map;
+ 	static struct e820entry buf; /* static so it is zeroed */
+diff -urNp linux-2.6.32.13/arch/x86/boot/video.c linux-2.6.32.13/arch/x86/boot/video.c
+--- linux-2.6.32.13/arch/x86/boot/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/video.c	2010-05-15 13:21:13.878594921 -0400
+@@ -90,7 +90,7 @@ static void store_mode_params(void)
+ static unsigned int get_entry(void)
+ {
+ 	char entry_buf[4];
+-	int i, len = 0;
++	unsigned int i, len = 0;
+ 	int key;
+ 	unsigned int v;
+ 
+diff -urNp linux-2.6.32.13/arch/x86/boot/video-vesa.c linux-2.6.32.13/arch/x86/boot/video-vesa.c
+--- linux-2.6.32.13/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/boot/video-vesa.c	2010-05-15 13:21:13.878594921 -0400
+@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
+ 
+ 	boot_params.screen_info.vesapm_seg = oreg.es;
+ 	boot_params.screen_info.vesapm_off = oreg.di;
++	boot_params.screen_info.vesapm_size = oreg.cx;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/x86/ia32/ia32entry.S linux-2.6.32.13/arch/x86/ia32/ia32entry.S
+--- linux-2.6.32.13/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/ia32/ia32entry.S	2010-05-15 13:21:13.878594921 -0400
+@@ -13,6 +13,7 @@
+ #include <asm/thread_info.h>	
+ #include <asm/segment.h>
+ #include <asm/irqflags.h>
++#include <asm/pgtable.h>
+ #include <linux/linkage.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
+ 	SWAPGS_UNSAFE_STACK
+ 	movq	PER_CPU_VAR(kernel_stack), %rsp
+ 	addq	$(KERNEL_STACK_OFFSET),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs, here we enable it straight after entry:
+@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
+ 	SAVE_ARGS 0,0,1
+  	/* no need to do an access_ok check here because rbp has been
+  	   32bit zero extended */ 
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%rbp
++#endif
++
+ 1:	movl	(%rbp),%ebp
+  	.section __ex_table,"a"
+  	.quad 1b,ia32_badarg
+@@ -166,6 +178,11 @@ sysenter_dispatch:
+ 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz	sysexit_audit
+ sysexit_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl    $~TS_COMPAT,TI_status(%r10)
+ 	/* clear IF, that popfq doesn't enable interrupts early */
+ 	andl  $~0x200,EFLAGS-R11(%rsp) 
+@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
+ 	movl	%esp,%r8d
+ 	CFI_REGISTER	rsp,r8
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
+ 	/* no need to do an access_ok check here because r8 has been
+ 	   32bit zero extended */ 
+ 	/* hardware stack frame is complete now */	
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%r8
++#endif
++
+ 1:	movl	(%r8),%r9d
+ 	.section __ex_table,"a"
+ 	.quad 1b,ia32_badarg
+@@ -327,6 +355,11 @@ cstar_dispatch:
+ 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz sysretl_audit
+ sysretl_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl $~TS_COMPAT,TI_status(%r10)
+ 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
+ 	movl RIP-ARGOFFSET(%rsp),%ecx
+@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
+ 	CFI_REL_OFFSET	rip,RIP-RIP
+ 	PARAVIRT_ADJUST_EXCEPTION_FRAME
+ 	SWAPGS
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+diff -urNp linux-2.6.32.13/arch/x86/ia32/ia32_signal.c linux-2.6.32.13/arch/x86/ia32/ia32_signal.c
+--- linux-2.6.32.13/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/ia32/ia32_signal.c	2010-05-15 13:21:13.878594921 -0400
+@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
+ 	sp -= frame_size;
+ 	/* Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ 	return (void __user *) sp;
+ }
+ 
+@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
+ 		0xb8,
+ 		__NR_ia32_rt_sigreturn,
+ 		0x80cd,
+-		0,
++		0
+ 	};
+ 
+ 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/alternative.h linux-2.6.32.13/arch/x86/include/asm/alternative.h
+--- linux-2.6.32.13/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/alternative.h	2010-05-15 13:21:13.878594921 -0400
+@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
+       "	 .byte 662b-661b\n"			/* sourcelen       */	\
+       "	 .byte 664f-663f\n"			/* replacementlen  */	\
+       ".previous\n"							\
+-      ".section .altinstr_replacement, \"ax\"\n"			\
++      ".section .altinstr_replacement, \"a\"\n"			\
+       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
+       ".previous"
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/apm.h linux-2.6.32.13/arch/x86/include/asm/apm.h
+--- linux-2.6.32.13/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/apm.h	2010-05-15 13:21:13.878594921 -0400
+@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%al\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%bl\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/atomic_32.h linux-2.6.32.13/arch/x86/include/asm/atomic_32.h
+--- linux-2.6.32.13/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/atomic_32.h	2010-05-15 13:21:13.878594921 -0400
+@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_sub_unchecked - subtract integer from atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "+m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++
++#ifdef CONFIG_M386
++no_xadd: /* Legacy 386 processor */
++	local_irq_save(flags);
++	__i = atomic_read(v);
++	atomic_set(v, i + __i);
++	local_irq_restore(flags);
++	return i + __i;
++#endif
++}
++
++/**
++ * atomic_add_return_unchecked - add integer and return
++ * @v: pointer of type atomic_unchecked_t
++ * @i: integer value to add
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
++{
++	int __i;
++#ifdef CONFIG_M386
++	unsigned long flags;
++	if (unlikely(boot_cpu_data.x86 <= 3))
++		goto no_xadd;
++#endif
++	/* Modern 486+ processor */
++	__i = i;
+ 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "into\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+ 
+ #define atomic_inc_return(v)  (atomic_add_return(1, v))
++#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
+ #define atomic_dec_return(v)  (atomic_sub_return(1, v))
+ 
+ /* These are x86-specific, used by some header files */
+@@ -266,6 +461,14 @@ typedef struct {
+ 	u64 __aligned(8) counter;
+ } atomic64_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	u64 __aligned(8) counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
++
+ #define ATOMIC64_INIT(val)	{ (val) }
+ 
+ extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/atomic_64.h linux-2.6.32.13/arch/x86/include/asm/atomic_64.h
+--- linux-2.6.32.13/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/atomic_64.h	2010-05-15 13:21:13.878594921 -0400
+@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_sub_unchecked - subtract the atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
+ static inline int atomic_add_return(int i, atomic_t *v)
+ {
+ 	int __i = i;
+-	asm volatile(LOCK_PREFIX "xaddl %0, %1"
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
+ }
+ 
+ /**
++ * atomic64_read_unchecked - read atomic64 variable
++ * @v: pointer of type atomic64_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ * Doesn't imply a read memory barrier.
++ */
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic64_set - set atomic64 variable
+  * @v: pointer to type atomic64_t
+  * @i: required value
+@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
+ }
+ 
+ /**
++ * atomic64_set_unchecked - set atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic64_add - add integer to atomic64 variable
+  * @i: integer value to add
+  * @v: pointer to type atomic64_t
+@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
+  */
+ static inline void atomic64_add(long i, atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "addq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "er" (i), "m" (v->counter));
++}
++
++/**
++ * atomic64_add_unchecked - add integer to atomic64 variable
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "addq %1,%0"
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
+  */
+ static inline void atomic64_sub(long i, atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subq %1,%0"
++	asm volatile(LOCK_PREFIX "subq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+ }
+@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
+  */
+ static inline void atomic64_inc(atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic64_inc_unchecked - increment atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "incq %0"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
+  */
+ static inline void atomic64_dec(atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decq %0"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decq %0; sete %1"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incq %0; sete %1"
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
+ static inline long atomic64_add_return(long i, atomic64_t *v)
+ {
+ 	long __i = i;
+-	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
++	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movq %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++}
++
++/**
++ * atomic64_add_return_unchecked - add and return
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
++{
++	long __i = i;
++	asm volatile(LOCK_PREFIX "xaddq %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
+ }
+ 
+ #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
++#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
+ #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
+ 
+ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
+@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
+  */
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "er" (a));
++
++		old = atomic64_cmpxchg((v), c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/boot.h linux-2.6.32.13/arch/x86/include/asm/boot.h
+--- linux-2.6.32.13/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/boot.h	2010-05-15 13:21:13.878594921 -0400
+@@ -11,10 +11,15 @@
+ #include <asm/pgtable_types.h>
+ 
+ /* Physical address where kernel should be loaded. */
+-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
++#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
+ 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
+ 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
+ 
++#ifndef __ASSEMBLY__
++extern unsigned char __LOAD_PHYSICAL_ADDR[];
++#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
++#endif
++
+ /* Minimum kernel alignment, as a power of two */
+ #ifdef CONFIG_X86_64
+ #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/cacheflush.h linux-2.6.32.13/arch/x86/include/asm/cacheflush.h
+--- linux-2.6.32.13/arch/x86/include/asm/cacheflush.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/cacheflush.h	2010-05-15 13:21:13.878594921 -0400
+@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
+ static inline unsigned long get_page_memtype(struct page *pg)
+ {
+ 	if (!PageUncached(pg) && !PageWC(pg))
+-		return -1;
++		return ~0UL;
+ 	else if (!PageUncached(pg) && PageWC(pg))
+ 		return _PAGE_CACHE_WC;
+ 	else if (PageUncached(pg) && !PageWC(pg))
+@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
+ 		SetPageWC(pg);
+ 		break;
+ 	default:
+-	case -1:
++	case ~0UL:
+ 		ClearPageUncached(pg);
+ 		ClearPageWC(pg);
+ 		break;
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/cache.h linux-2.6.32.13/arch/x86/include/asm/cache.h
+--- linux-2.6.32.13/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/cache.h	2010-05-15 13:21:13.878594921 -0400
+@@ -8,6 +8,7 @@
+ #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+ 
+ #define __read_mostly __attribute__((__section__(".data.read_mostly")))
++#define __read_only __attribute__((__section__(".data.read_only")))
+ 
+ #ifdef CONFIG_X86_VSMP
+ /* vSMP Internode cacheline shift */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/checksum_32.h linux-2.6.32.13/arch/x86/include/asm/checksum_32.h
+--- linux-2.6.32.13/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/checksum_32.h	2010-05-15 13:21:13.878594921 -0400
+@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
+ 					    int len, __wsum sum,
+ 					    int *src_err_ptr, int *dst_err_ptr);
+ 
++asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
++asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
+ /*
+  *	Note: when you get a NULL pointer exception here this means someone
+  *	passed in an incorrect kernel address to one of these functions.
+@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
+ 						 int *err_ptr)
+ {
+ 	might_sleep();
+-	return csum_partial_copy_generic((__force void *)src, dst,
++	return csum_partial_copy_generic_from_user((__force void *)src, dst,
+ 					 len, sum, err_ptr, NULL);
+ }
+ 
+@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
+ {
+ 	might_sleep();
+ 	if (access_ok(VERIFY_WRITE, dst, len))
+-		return csum_partial_copy_generic(src, (__force void *)dst,
++		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
+ 						 len, sum, NULL, err_ptr);
+ 
+ 	if (len)
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/desc.h linux-2.6.32.13/arch/x86/include/asm/desc.h
+--- linux-2.6.32.13/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/desc.h	2010-05-15 13:21:13.882891085 -0400
+@@ -4,6 +4,7 @@
+ #include <asm/desc_defs.h>
+ #include <asm/ldt.h>
+ #include <asm/mmu.h>
++#include <asm/pgtable.h>
+ #include <linux/smp.h>
+ 
+ static inline void fill_ldt(struct desc_struct *desc,
+@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
+ 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
+ 	desc->type = (info->read_exec_only ^ 1) << 1;
+ 	desc->type |= info->contents << 2;
++	desc->type |= info->seg_not_present ^ 1;
+ 	desc->s = 1;
+ 	desc->dpl = 0x3;
+ 	desc->p = info->seg_not_present ^ 1;
+@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
+ }
+ 
+ extern struct desc_ptr idt_descr;
+-extern gate_desc idt_table[];
+-
+-struct gdt_page {
+-	struct desc_struct gdt[GDT_ENTRIES];
+-} __attribute__((aligned(PAGE_SIZE)));
+-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
++extern gate_desc idt_table[256];
+ 
++extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
+ static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
+ {
+-	return per_cpu(gdt_page, cpu).gdt;
++	return cpu_gdt_table[cpu];
+ }
+ 
+ #ifdef CONFIG_X86_64
+@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
+ static inline void native_write_idt_entry(gate_desc *idt, int entry,
+ 					  const gate_desc *gate)
+ {
++	pax_open_kernel();
+ 	memcpy(&idt[entry], gate, sizeof(*gate));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
+ 					  const void *desc)
+ {
++	pax_open_kernel();
+ 	memcpy(&ldt[entry], desc, 8);
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
+ 					  const void *desc, int type)
+ {
+ 	unsigned int size;
++
+ 	switch (type) {
+ 	case DESC_TSS:
+ 		size = sizeof(tss_desc);
+@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
+ 		size = sizeof(struct desc_struct);
+ 		break;
+ 	}
++
++	pax_open_kernel();
+ 	memcpy(&gdt[entry], desc, size);
++	pax_close_kernel();
+ }
+ 
+ static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
+@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
+ 
+ static inline void native_load_tr_desc(void)
+ {
++	pax_open_kernel();
+ 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_load_gdt(const struct desc_ptr *dtr)
+@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
+ 	unsigned int i;
+ 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+ 
++	pax_open_kernel();
+ 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
+ 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
++	pax_close_kernel();
+ }
+ 
+ #define _LDT_empty(info)				\
+@@ -309,7 +319,7 @@ static inline void set_desc_limit(struct
+ 	desc->limit = (limit >> 16) & 0xf;
+ }
+ 
+-static inline void _set_gate(int gate, unsigned type, void *addr,
++static inline void _set_gate(int gate, unsigned type, const void *addr,
+ 			     unsigned dpl, unsigned ist, unsigned seg)
+ {
+ 	gate_desc s;
+@@ -327,7 +337,7 @@ static inline void _set_gate(int gate, u
+  * Pentium F0 0F bugfix can have resulted in the mapped
+  * IDT being write-protected.
+  */
+-static inline void set_intr_gate(unsigned int n, void *addr)
++static inline void set_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
+@@ -356,19 +366,19 @@ static inline void alloc_intr_gate(unsig
+ /*
+  * This routine sets up an interrupt gate at directory privilege level 3.
+  */
+-static inline void set_system_intr_gate(unsigned int n, void *addr)
++static inline void set_system_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_trap_gate(unsigned int n, void *addr)
++static inline void set_system_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_trap_gate(unsigned int n, void *addr)
++static inline void set_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
+@@ -377,19 +387,31 @@ static inline void set_trap_gate(unsigne
+ static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+-	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
++	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
+ }
+ 
+-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
+ }
+ 
++#ifdef CONFIG_X86_32
++static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
++{
++	struct desc_struct d;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, base, limit, 0xFB, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
++}
++#endif
++
+ #endif /* _ASM_X86_DESC_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/device.h linux-2.6.32.13/arch/x86/include/asm/device.h
+--- linux-2.6.32.13/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/device.h	2010-05-15 13:21:13.882891085 -0400
+@@ -6,7 +6,7 @@ struct dev_archdata {
+ 	void	*acpi_handle;
+ #endif
+ #ifdef CONFIG_X86_64
+-struct dma_map_ops *dma_ops;
++	const struct dma_map_ops *dma_ops;
+ #endif
+ #ifdef CONFIG_DMAR
+ 	void *iommu; /* hook for IOMMU specific extension */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h
+--- linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h	2010-05-15 13:21:13.882891085 -0400
+@@ -25,9 +25,9 @@ extern int iommu_merge;
+ extern struct device x86_dma_fallback_dev;
+ extern int panic_on_overflow;
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #ifdef CONFIG_X86_32
+ 	return dma_ops;
+@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
+ /* Make sure we keep the same behaviour */
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	if (ops->mapping_error)
+ 		return ops->mapping_error(dev, dma_addr);
+ 
+@@ -122,7 +122,7 @@ static inline void *
+ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
+ 		gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *memory;
+ 
+ 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *vaddr, dma_addr_t bus)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	WARN_ON(irqs_disabled());       /* for portability */
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/e820.h linux-2.6.32.13/arch/x86/include/asm/e820.h
+--- linux-2.6.32.13/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/e820.h	2010-05-15 13:21:13.882891085 -0400
+@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
+ #define ISA_END_ADDRESS		0x100000
+ #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
+ 
+-#define BIOS_BEGIN		0x000a0000
++#define BIOS_BEGIN		0x000c0000
+ #define BIOS_END		0x00100000
+ 
+ #ifdef __KERNEL__
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/elf.h linux-2.6.32.13/arch/x86/include/asm/elf.h
+--- linux-2.6.32.13/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/elf.h	2010-05-15 13:21:13.882891085 -0400
+@@ -257,7 +257,25 @@ extern int force_personality32;
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
++#else
+ #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++#ifdef CONFIG_X86_32
++#define PAX_ELF_ET_DYN_BASE	0x10000000UL
++
++#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#else
++#define PAX_ELF_ET_DYN_BASE	0x400000UL
++
++#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#endif
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+@@ -311,8 +329,7 @@ do {									\
+ #define ARCH_DLINFO							\
+ do {									\
+ 	if (vdso_enabled)						\
+-		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
+-			    (unsigned long)current->mm->context.vdso);	\
++		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
+ } while (0)
+ 
+ #define AT_SYSINFO		32
+@@ -323,7 +340,7 @@ do {									\
+ 
+ #endif /* !CONFIG_X86_32 */
+ 
+-#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
++#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
+ 
+ #define VDSO_ENTRY							\
+ 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
+@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
+ extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
+ #define compat_arch_setup_additional_pages	syscall32_setup_pages
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* _ASM_X86_ELF_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/futex.h linux-2.6.32.13/arch/x86/include/asm/futex.h
+--- linux-2.6.32.13/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/futex.h	2010-05-15 13:21:13.882891085 -0400
+@@ -11,17 +11,54 @@
+ #include <asm/processor.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_X86_32
+ #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile(						\
++		     "movw\t%w6, %%ds\n"			\
++		     "1:\t" insn "\n"				\
++		     "2:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%ds\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "3:\tmov\t%3, %1\n"			\
++		     "\tjmp\t2b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 3b)			\
++		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
++
++#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile("movw\t%w7, %%es\n"			\
++		     "1:\tmovl\t%%es:%2, %0\n"			\
++		     "\tmovl\t%0, %3\n"				\
++		     "\t" insn "\n"				\
++		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
++		     "\tjnz\t1b\n"				\
++		     "3:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%es\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "4:\tmov\t%5, %1\n"			\
++		     "\tjmp\t3b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 4b)			\
++		     _ASM_EXTABLE(2b, 4b)			\
++		     : "=&a" (oldval), "=&r" (ret),		\
++		       "+m" (*uaddr), "=&r" (tem)		\
++		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
++#else
++#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\t" insn "\n"				\
+ 		     "2:\t.section .fixup,\"ax\"\n"		\
+ 		     "3:\tmov\t%3, %1\n"			\
+ 		     "\tjmp\t2b\n"				\
+ 		     "\t.previous\n"				\
+ 		     _ASM_EXTABLE(1b, 3b)			\
+-		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "=r" (oldval), "=r" (ret),		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
+ 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
+ 
+ #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\tmovl	%2, %0\n"			\
+ 		     "\tmovl\t%0, %3\n"				\
+ 		     "\t" insn "\n"				\
+@@ -34,10 +71,12 @@
+ 		     _ASM_EXTABLE(1b, 4b)			\
+ 		     _ASM_EXTABLE(2b, 4b)			\
+ 		     : "=&a" (oldval), "=&r" (ret),		\
+-		       "+m" (*uaddr), "=&r" (tem)		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
++		       "=&r" (tem)				\
+ 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
++#endif
+ 
+-static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
++static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
+ 
+ 	switch (op) {
+ 	case FUTEX_OP_SET:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
++#else
+ 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_ADD:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
++				   uaddr, oparg);
++#else
+ 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
+ 				   uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_OR:
+ 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
+@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
+ 	return ret;
+ }
+ 
+-static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
++static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
+ 						int newval)
+ {
+ 
+@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
+ 		return -ENOSYS;
+ #endif
+ 
+-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
++	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ 		return -EFAULT;
+ 
+-	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
+-		     "2:\t.section .fixup, \"ax\"\n"
++	asm volatile(
++#ifdef CONFIG_X86_32
++		     "\tmovw %w5, %%ds\n"
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
++		     "2:\tpushl   %%ss\n"
++		     "\tpopl    %%ds\n"
++#else
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
++		     "2:\n"
++#endif
++		     "\t.section .fixup, \"ax\"\n"
+ 		     "3:\tmov     %2, %0\n"
+ 		     "\tjmp     2b\n"
+ 		     "\t.previous\n"
+ 		     _ASM_EXTABLE(1b, 3b)
++#ifdef CONFIG_X86_32
+ 		     : "=a" (oldval), "+m" (*uaddr)
++		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
++#else
++		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
+ 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
++#endif
+ 		     : "memory"
+ 	);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/i387.h linux-2.6.32.13/arch/x86/include/asm/i387.h
+--- linux-2.6.32.13/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/i387.h	2010-05-15 13:21:13.886644440 -0400
+@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
+ }
+ 
+ /* We need a safe address that is cheap to find and that is already
+-   in L1 during context switch. The best choices are unfortunately
+-   different for UP and SMP */
+-#ifdef CONFIG_SMP
+-#define safe_address (__per_cpu_offset[0])
+-#else
+-#define safe_address (kstat_cpu(0).cpustat.user)
+-#endif
++   in L1 during context switch. */
++#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
+ 
+ /*
+  * These must be called with preempt disabled
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/io_64.h linux-2.6.32.13/arch/x86/include/asm/io_64.h
+--- linux-2.6.32.13/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/io_64.h	2010-05-15 13:21:13.886644440 -0400
+@@ -140,6 +140,17 @@ __OUTS(l)
+ 
+ #include <linux/vmalloc.h>
+ 
++#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
++static inline int valid_phys_addr_range(unsigned long addr, size_t count)
++{
++	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
++static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
++{
++	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
+ #include <asm-generic/iomap.h>
+ 
+ void __memcpy_fromio(void *, unsigned long, unsigned);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/iommu.h linux-2.6.32.13/arch/x86/include/asm/iommu.h
+--- linux-2.6.32.13/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/iommu.h	2010-05-15 13:21:13.886644440 -0400
+@@ -3,7 +3,7 @@
+ 
+ extern void pci_iommu_shutdown(void);
+ extern void no_iommu_init(void);
+-extern struct dma_map_ops nommu_dma_ops;
++extern const struct dma_map_ops nommu_dma_ops;
+ extern int force_iommu, no_iommu;
+ extern int iommu_detected;
+ extern int iommu_pass_through;
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/irqflags.h linux-2.6.32.13/arch/x86/include/asm/irqflags.h
+--- linux-2.6.32.13/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/irqflags.h	2010-05-15 13:21:13.886644440 -0400
+@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
+ 	sti;					\
+ 	sysexit
+ 
++#define GET_CR0_INTO_RDI		mov %cr0, %rdi
++#define SET_RDI_INTO_CR0		mov %rdi, %cr0
++#define GET_CR3_INTO_RDI		mov %cr3, %rdi
++#define SET_RDI_INTO_CR3		mov %rdi, %cr3
++
+ #else
+ #define INTERRUPT_RETURN		iret
+ #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/kvm_host.h linux-2.6.32.13/arch/x86/include/asm/kvm_host.h
+--- linux-2.6.32.13/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:37.497949072 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/kvm_host.h	2010-05-15 13:21:13.886644440 -0400
+@@ -532,7 +532,7 @@ struct kvm_x86_ops {
+ 	const struct trace_print_flags *exit_reasons_str;
+ };
+ 
+-extern struct kvm_x86_ops *kvm_x86_ops;
++extern const struct kvm_x86_ops *kvm_x86_ops;
+ 
+ int kvm_mmu_module_init(void);
+ void kvm_mmu_module_exit(void);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/local.h linux-2.6.32.13/arch/x86/include/asm/local.h
+--- linux-2.6.32.13/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/local.h	2010-05-15 13:21:13.886644440 -0400
+@@ -18,26 +18,90 @@ typedef struct {
+ 
+ static inline void local_inc(local_t *l)
+ {
+-	asm volatile(_ASM_INC "%0"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_dec(local_t *l)
+ {
+-	asm volatile(_ASM_DEC "%0"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_add(long i, local_t *l)
+ {
+-	asm volatile(_ASM_ADD "%1,%0"
++	asm volatile(_ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+ 
+ static inline void local_sub(long i, local_t *l)
+ {
+-	asm volatile(_ASM_SUB "%1,%0"
++	asm volatile(_ASM_SUB "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_SUB "%2,%0; sete %1"
++	asm volatile(_ASM_SUB "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_DEC "%0; sete %1"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_INC "%0; sete %1"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_ADD "%2,%0; sets %1"
++	asm volatile(_ASM_ADD "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -133,7 +265,23 @@ static inline long local_add_return(long
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
+-	asm volatile(_ASM_XADD "%0, %1;"
++	asm volatile(_ASM_XADD "%0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_MOV "%0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (i), "+m" (l->a.counter)
+ 		     : : "memory");
+ 	return i + __i;
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h
+--- linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h	2010-05-15 13:21:13.886644440 -0400
+@@ -81,8 +81,8 @@ static inline unsigned char current_lock
+ #else
+ #define lock_cmos_prefix(reg) do {} while (0)
+ #define lock_cmos_suffix(reg) do {} while (0)
+-#define lock_cmos(reg)
+-#define unlock_cmos()
++#define lock_cmos(reg) do {} while (0)
++#define unlock_cmos() do {} while (0)
+ #define do_i_have_lock_cmos() 0
+ #define current_lock_cmos_reg() 0
+ #endif
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/microcode.h linux-2.6.32.13/arch/x86/include/asm/microcode.h
+--- linux-2.6.32.13/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/microcode.h	2010-05-15 13:21:13.886644440 -0400
+@@ -12,13 +12,13 @@ struct device;
+ enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
+ 
+ struct microcode_ops {
+-	enum ucode_state (*request_microcode_user) (int cpu,
++	enum ucode_state (* const request_microcode_user) (int cpu,
+ 				const void __user *buf, size_t size);
+ 
+-	enum ucode_state (*request_microcode_fw) (int cpu,
++	enum ucode_state (* const request_microcode_fw) (int cpu,
+ 				struct device *device);
+ 
+-	void (*microcode_fini_cpu) (int cpu);
++	void (* const microcode_fini_cpu) (int cpu);
+ 
+ 	/*
+ 	 * The generic 'microcode_core' part guarantees that
+@@ -38,18 +38,18 @@ struct ucode_cpu_info {
+ extern struct ucode_cpu_info ucode_cpu_info[];
+ 
+ #ifdef CONFIG_MICROCODE_INTEL
+-extern struct microcode_ops * __init init_intel_microcode(void);
++extern const struct microcode_ops * __init init_intel_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_intel_microcode(void)
++static inline const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return NULL;
+ }
+ #endif /* CONFIG_MICROCODE_INTEL */
+ 
+ #ifdef CONFIG_MICROCODE_AMD
+-extern struct microcode_ops * __init init_amd_microcode(void);
++extern const struct microcode_ops * __init init_amd_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_amd_microcode(void)
++static inline const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/mman.h linux-2.6.32.13/arch/x86/include/asm/mman.h
+--- linux-2.6.32.13/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/mman.h	2010-05-15 13:21:13.886644440 -0400
+@@ -5,4 +5,14 @@
+ 
+ #include <asm-generic/mman.h>
+ 
++#ifdef __KERNEL__
++#ifndef __ASSEMBLY__
++#ifdef CONFIG_X86_32
++#define arch_mmap_check	i386_mmap_check
++int i386_mmap_check(unsigned long addr, unsigned long len,
++		unsigned long flags);
++#endif
++#endif
++#endif
++
+ #endif /* _ASM_X86_MMAN_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/mmu_context.h linux-2.6.32.13/arch/x86/include/asm/mmu_context.h
+--- linux-2.6.32.13/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/mmu_context.h	2010-05-15 13:21:13.886644440 -0400
+@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
+ 
+ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+ {
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	unsigned int i;
++	pgd_t *pgd;
++
++	pax_open_kernel();
++	pgd = get_cpu_pgd(smp_processor_id());
++	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
++		if (paravirt_enabled())
++			set_pgd(pgd+i, native_make_pgd(0));
++		else
++			pgd[i] = native_make_pgd(0);
++	pax_close_kernel();
++#endif
++
+ #ifdef CONFIG_SMP
+ 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
+@@ -34,27 +49,70 @@ static inline void switch_mm(struct mm_s
+ 			     struct task_struct *tsk)
+ {
+ 	unsigned cpu = smp_processor_id();
++#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
++	int tlbstate = TLBSTATE_OK;
++#endif
+ 
+ 	if (likely(prev != next)) {
+ 		/* stop flush ipis for the previous mm */
+ 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ #ifdef CONFIG_SMP
++#ifdef CONFIG_X86_32
++		tlbstate = percpu_read(cpu_tlbstate.state);
++#endif
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		percpu_write(cpu_tlbstate.active_mm, next);
+ #endif
+ 		cpumask_set_cpu(cpu, mm_cpumask(next));
+ 
+ 		/* Re-load page tables */
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#else
+ 		load_cr3(next->pgd);
++#endif
+ 
+ 		/*
+ 		 * load the LDT, if the LDT is different:
+ 		 */
+ 		if (unlikely(prev->context.ldt != next->context.ldt))
+ 			load_LDT_nolock(&next->context);
+-	}
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		if (!nx_enabled) {
++			smp_mb__before_clear_bit();
++			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
++			smp_mb__after_clear_bit();
++			cpu_set(cpu, next->context.cpu_user_cs_mask);
++		}
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
++			     prev->context.user_cs_limit != next->context.user_cs_limit))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
+ #ifdef CONFIG_SMP
++		else if (unlikely(tlbstate != TLBSTATE_OK))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++#endif
++
++	}
+ 	else {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#endif
++
++#ifdef CONFIG_SMP
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
+ 
+@@ -63,11 +121,28 @@ static inline void switch_mm(struct mm_s
+ 			 * tlb flush IPI delivery. We must reload CR3
+ 			 * to make sure to use no freed page tables.
+ 			 */
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 			load_cr3(next->pgd);
++#endif
++
+ 			load_LDT_nolock(&next->context);
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++			if (!nx_enabled)
++				cpu_set(cpu, next->context.cpu_user_cs_mask);
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
++#endif
++				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++
+ 		}
+-	}
+ #endif
++	}
+ }
+ 
+ #define activate_mm(prev, next)			\
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/mmu.h linux-2.6.32.13/arch/x86/include/asm/mmu.h
+--- linux-2.6.32.13/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/mmu.h	2010-05-15 13:21:13.886644440 -0400
+@@ -9,10 +9,23 @@
+  * we put the segment information here.
+  */
+ typedef struct {
+-	void *ldt;
++	struct desc_struct *ldt;
+ 	int size;
+ 	struct mutex lock;
+-	void *vdso;
++	unsigned long vdso;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	unsigned long user_cs_base;
++	unsigned long user_cs_limit;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++	cpumask_t cpu_user_cs_mask;
++#endif
++
++#endif
++#endif
++
+ } mm_context_t;
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/module.h linux-2.6.32.13/arch/x86/include/asm/module.h
+--- linux-2.6.32.13/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/module.h	2010-05-15 13:21:13.886644440 -0400
+@@ -59,13 +59,31 @@
+ #error unknown processor family
+ #endif
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define MODULE_PAX_UDEREF "UDEREF "
++#else
++#define MODULE_PAX_UDEREF ""
++#endif
++
+ #ifdef CONFIG_X86_32
+ # ifdef CONFIG_4KSTACKS
+ #  define MODULE_STACKSIZE "4KSTACKS "
+ # else
+ #  define MODULE_STACKSIZE ""
+ # endif
+-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
++# ifdef CONFIG_PAX_KERNEXEC
++#  define MODULE_PAX_KERNEXEC "KERNEXEC "
++# else
++#  define MODULE_PAX_KERNEXEC ""
++# endif
++# ifdef CONFIG_GRKERNSEC
++#  define MODULE_GRSEC "GRSECURITY "
++# else
++#  define MODULE_GRSEC ""
++# endif
++# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
++#else
++# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
+ #endif
+ 
+ #endif /* _ASM_X86_MODULE_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/page_32_types.h linux-2.6.32.13/arch/x86/include/asm/page_32_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/page_32_types.h	2010-05-15 13:21:13.886644440 -0400
+@@ -15,6 +15,10 @@
+  */
+ #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
++#endif
++
+ #ifdef CONFIG_4KSTACKS
+ #define THREAD_ORDER	0
+ #else
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/page_64_types.h linux-2.6.32.13/arch/x86/include/asm/page_64_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/page_64_types.h	2010-05-15 13:21:13.886644440 -0400
+@@ -39,6 +39,9 @@
+ #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
+ #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
+ #define __PHYSICAL_MASK_SHIFT	46
+ #define __VIRTUAL_MASK_SHIFT	47
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/paravirt.h linux-2.6.32.13/arch/x86/include/asm/paravirt.h
+--- linux-2.6.32.13/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/paravirt.h	2010-05-15 13:21:13.886644440 -0400
+@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
+ 	pv_mmu_ops.set_fixmap(idx, phys, flags);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long pax_open_kernel(void)
++{
++	return pv_mmu_ops.pax_open_kernel();
++}
++
++static inline unsigned long pax_close_kernel(void)
++{
++	return pv_mmu_ops.pax_close_kernel();
++}
++#else
++static inline unsigned long pax_open_kernel(void) { return 0; }
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
+ 
+ static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
+@@ -945,7 +960,7 @@ extern void default_banner(void);
+ 
+ #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
+ #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
+-#define PARA_INDIRECT(addr)	*%cs:addr
++#define PARA_INDIRECT(addr)	*%ss:addr
+ #endif
+ 
+ #define INTERRUPT_RETURN						\
+@@ -1022,6 +1037,21 @@ extern void default_banner(void);
+ 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
+ 		  CLBR_NONE,						\
+ 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
++
++#define GET_CR0_INTO_RDI				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR0				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++
++#define GET_CR3_INTO_RDI				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR3				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
++
+ #endif	/* CONFIG_X86_32 */
+ 
+ #endif /* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h	2010-05-15 13:21:13.902905019 -0400
+@@ -316,6 +316,12 @@ struct pv_mmu_ops {
+ 	   an mfn.  We can tell which is which from the index. */
+ 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
+ 			   phys_addr_t phys, pgprot_t flags);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long (*pax_open_kernel)(void);
++	unsigned long (*pax_close_kernel)(void);
++#endif
++
+ };
+ 
+ struct raw_spinlock;
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pci_x86.h linux-2.6.32.13/arch/x86/include/asm/pci_x86.h
+--- linux-2.6.32.13/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pci_x86.h	2010-05-15 13:21:13.902905019 -0400
+@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+ 
+ struct pci_raw_ops {
+-	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val);
+-	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 val);
+ };
+ 
+-extern struct pci_raw_ops *raw_pci_ops;
+-extern struct pci_raw_ops *raw_pci_ext_ops;
++extern const struct pci_raw_ops *raw_pci_ops;
++extern const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+-extern struct pci_raw_ops pci_direct_conf1;
++extern const struct pci_raw_ops pci_direct_conf1;
+ extern bool port_cf9_safe;
+ 
+ /* arch_initcall level */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgalloc.h linux-2.6.32.13/arch/x86/include/asm/pgalloc.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgalloc.h	2010-05-15 13:21:13.902905019 -0400
+@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
+ 				       pmd_t *pmd, pte_t *pte)
+ {
+ 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
++	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
++}
++
++static inline void pmd_populate_user(struct mm_struct *mm,
++				       pmd_t *pmd, pte_t *pte)
++{
++	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
+ 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h	2010-05-15 13:21:13.902905019 -0400
+@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h	2010-05-15 13:21:13.902905019 -0400
+@@ -26,8 +26,6 @@
+ struct mm_struct;
+ struct vm_area_struct;
+ 
+-extern pgd_t swapper_pg_dir[1024];
+-
+ static inline void pgtable_cache_init(void) { }
+ static inline void check_pgt_cache(void) { }
+ void paging_init(void);
+@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
+ # include <asm/pgtable-2level.h>
+ #endif
+ 
++extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
++#ifdef CONFIG_X86_PAE
++extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
++#endif
++
+ #if defined(CONFIG_HIGHPTE)
+ #define __KM_PTE			\
+ 	(in_nmi() ? KM_NMI_PTE : 	\
+@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
+ /* Clear a kernel PTE and flush it from the TLB */
+ #define kpte_clear_flush(ptep, vaddr)		\
+ do {						\
++	pax_open_kernel();			\
+ 	pte_clear(&init_mm, (vaddr), (ptep));	\
++	pax_close_kernel();			\
+ 	__flush_tlb_one((vaddr));		\
+ } while (0)
+ 
+@@ -84,6 +89,9 @@ do {						\
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
++#define HAVE_ARCH_UNMAPPED_AREA
++#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
++
+ /*
+  * kern_addr_valid() is (1) for FLATMEM and (0) for
+  * SPARSEMEM and DISCONTIGMEM
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h	2010-05-15 13:21:13.902905019 -0400
+@@ -8,7 +8,7 @@
+  */
+ #ifdef CONFIG_X86_PAE
+ # include <asm/pgtable-3level_types.h>
+-# define PMD_SIZE	(1UL << PMD_SHIFT)
++# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
+ # define PMD_MASK	(~(PMD_SIZE - 1))
+ #else
+ # include <asm/pgtable-2level_types.h>
+@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
+ # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifndef __ASSEMBLY__
++extern unsigned char MODULES_EXEC_VADDR[];
++extern unsigned char MODULES_EXEC_END[];
++#endif
++#include <asm/boot.h>
++#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
++#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
++#else
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++#endif
++
+ #define MODULES_VADDR	VMALLOC_START
+ #define MODULES_END	VMALLOC_END
+ #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h	2010-05-15 13:21:13.902905019 -0400
+@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pud(pud_t *pudp, pud_t pud)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
++	pax_close_kernel();
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h	2010-05-15 13:21:13.906812769 -0400
+@@ -16,10 +16,13 @@
+ 
+ extern pud_t level3_kernel_pgt[512];
+ extern pud_t level3_ident_pgt[512];
++extern pud_t level3_vmalloc_pgt[512];
++extern pud_t level3_vmemmap_pgt[512];
++extern pud_t level2_vmemmap_pgt[512];
+ extern pmd_t level2_kernel_pgt[512];
+ extern pmd_t level2_fixmap_pgt[512];
+-extern pmd_t level2_ident_pgt[512];
+-extern pgd_t init_level4_pgt[];
++extern pmd_t level2_ident_pgt[512*2];
++extern pgd_t init_level4_pgt[512];
+ 
+ #define swapper_pg_dir init_level4_pgt
+ 
+@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pmd_clear(pmd_t *pmd)
+@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
+ 
+ static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
++	pax_open_kernel();
+ 	*pgdp = pgd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pgd_clear(pgd_t *pgd)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	native_set_pgd(pgd, native_make_pgd(0));
++#endif
++
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h	2010-05-15 13:23:38.946686210 -0400
+@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
+ #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
+ #define MODULES_END      _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
++#define MODULES_EXEC_VADDR MODULES_VADDR
++#define MODULES_EXEC_END MODULES_END
+ 
+ #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable.h linux-2.6.32.13/arch/x86/include/asm/pgtable.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable.h	2010-05-15 13:21:13.906812769 -0400
+@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
+ 
+ #define arch_end_context_switch(prev)	do {} while(0)
+ 
++#define pax_open_kernel()	native_pax_open_kernel()
++#define pax_close_kernel()	native_pax_close_kernel()
+ #endif	/* CONFIG_PARAVIRT */
+ 
++#define  __HAVE_ARCH_PAX_OPEN_KERNEL
++#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
++
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long native_pax_open_kernel(void)
++{
++	unsigned long cr0;
++
++	preempt_disable();
++	barrier();
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(cr0 & X86_CR0_WP));
++	write_cr0(cr0);
++	return cr0 ^ X86_CR0_WP;
++}
++
++static inline unsigned long native_pax_close_kernel(void)
++{
++	unsigned long cr0;
++
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
++	write_cr0(cr0);
++	barrier();
++	preempt_enable_no_resched();
++	return cr0 ^ X86_CR0_WP;
++}
++#else
++static inline unsigned long native_pax_open_kernel(void) { return 0; }
++static inline unsigned long native_pax_close_kernel(void) { return 0; }
++#endif
++
+ /*
+  * The following only work if pte_present() is true.
+  * Undefined behaviour if not..
+  */
++static inline int pte_user(pte_t pte)
++{
++	return pte_val(pte) & _PAGE_USER;
++}
++
+ static inline int pte_dirty(pte_t pte)
+ {
+ 	return pte_flags(pte) & _PAGE_DIRTY;
+@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
+ 	return pte_clear_flags(pte, _PAGE_RW);
+ }
+ 
++static inline pte_t pte_mkread(pte_t pte)
++{
++	return __pte(pte_val(pte) | _PAGE_USER);
++}
++
+ static inline pte_t pte_mkexec(pte_t pte)
+ {
+-	return pte_clear_flags(pte, _PAGE_NX);
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_clear_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_set_flags(pte, _PAGE_USER);
++}
++
++static inline pte_t pte_exprotect(pte_t pte)
++{
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_set_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_clear_flags(pte, _PAGE_USER);
+ }
+ 
+ static inline pte_t pte_mkdirty(pte_t pte)
+@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
+ #endif
+ 
+ #ifndef __ASSEMBLY__
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
++static inline pgd_t *get_cpu_pgd(unsigned int cpu)
++{
++	return cpu_pgd[cpu];
++}
++#endif
++
+ #include <linux/mm_types.h>
+ 
+ static inline int pte_none(pte_t pte)
+@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
+ 
+ static inline int pgd_bad(pgd_t pgd)
+ {
+-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
++	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
+ }
+ 
+ static inline int pgd_none(pgd_t pgd)
+@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
+  * pgd_offset() returns a (pgd_t *)
+  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
+  */
+-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
++#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
++#endif
++
+ /*
+  * a shortcut which implies the use of the kernel's pgd, instead
+  * of a process's
+@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
+ #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
+ #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
+ 
++#ifdef CONFIG_X86_32
++#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
++#else
++#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
++#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
++#else
++#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
++#endif
++
++#endif
++
+ #ifndef __ASSEMBLY__
+ 
+ extern int direct_gbpages;
+@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
+  * dst and src can be on the same page, but the range must not overlap,
+  * and must not cross a page boundary.
+  */
+-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
++static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
+ {
+-       memcpy(dst, src, count * sizeof(pgd_t));
++	pax_open_kernel();
++	while (count--)
++		*dst++ = *src++;
++	pax_close_kernel();
+ }
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++#endif
+ 
+ #include <asm-generic/pgtable.h>
+ #endif	/* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h
+--- linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h	2010-05-15 13:21:13.906812769 -0400
+@@ -16,12 +16,11 @@
+ #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
+ #define _PAGE_BIT_PAT		7	/* on 4KB pages */
+ #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
+-#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
++#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
+ #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
+ #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
+ #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
+-#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
+-#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
++#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
+ #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
+ 
+ /* If _PAGE_BIT_PRESENT is clear, we use these: */
+@@ -39,7 +38,6 @@
+ #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
+ #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
+ #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
+-#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
+ #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
+ #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
+ #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
+@@ -55,8 +53,10 @@
+ 
+ #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
+-#else
++#elif defined(CONFIG_KMEMCHECK)
+ #define _PAGE_NX	(_AT(pteval_t, 0))
++#else
++#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
+ #endif
+ 
+ #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
+@@ -93,6 +93,9 @@
+ #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
+ 					 _PAGE_ACCESSED)
+ 
++#define PAGE_READONLY_NOEXEC PAGE_READONLY
++#define PAGE_SHARED_NOEXEC PAGE_SHARED
++
+ #define __PAGE_KERNEL_EXEC						\
+ 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
+ #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
+@@ -103,8 +106,8 @@
+ #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
+ #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
+ #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
+-#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
+-#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
++#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
++#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
+ #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
+@@ -163,8 +166,8 @@
+  * bits are combined, this will alow user to access the high address mapped
+  * VDSO in the presence of CONFIG_COMPAT_VDSO
+  */
+-#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
+-#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
++#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
++#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
+ #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
+ #endif
+ 
+@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
+ 
+ extern pteval_t __supported_pte_mask;
+ extern void set_nx(void);
++
++#ifdef CONFIG_X86_32
++#ifdef CONFIG_X86_PAE
+ extern int nx_enabled;
++#else
++#define nx_enabled (0)
++#endif
++#else
++#define nx_enabled (1)
++#endif
+ 
+ #define pgprot_writecombine	pgprot_writecombine
+ extern pgprot_t pgprot_writecombine(pgprot_t prot);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/processor.h linux-2.6.32.13/arch/x86/include/asm/processor.h
+--- linux-2.6.32.13/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/processor.h	2010-05-15 13:21:13.906812769 -0400
+@@ -272,7 +272,7 @@ struct tss_struct {
+ 
+ } ____cacheline_aligned;
+ 
+-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
++extern struct tss_struct init_tss[NR_CPUS];
+ 
+ /*
+  * Save the original ist values for checking stack pointers during debugging
+@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
+  */
+ #define TASK_SIZE		PAGE_OFFSET
+ #define TASK_SIZE_MAX		TASK_SIZE
++
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
++#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
++#else
+ #define STACK_TOP		TASK_SIZE
+-#define STACK_TOP_MAX		STACK_TOP
++#endif
++
++#define STACK_TOP_MAX		TASK_SIZE
+ 
+ #define INIT_THREAD  {							  \
+ 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
+@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
+  */
+ #define INIT_TSS  {							  \
+ 	.x86_tss = {							  \
+-		.sp0		= sizeof(init_stack) + (long)&init_stack, \
++		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
+ 		.ss0		= __KERNEL_DS,				  \
+ 		.ss1		= __KERNEL_CS,				  \
+ 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
+@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
+ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+ 
+ #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
+-#define KSTK_TOP(info)                                                 \
+-({                                                                     \
+-       unsigned long *__ptr = (unsigned long *)(info);                 \
+-       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
+-})
++#define KSTK_TOP(info)         ((info)->task.thread.sp0)
+ 
+ /*
+  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
+@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
+ #define task_pt_regs(task)                                             \
+ ({                                                                     \
+        struct pt_regs *__regs__;                                       \
+-       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
++       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
+        __regs__ - 1;                                                   \
+ })
+ 
+@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
+ /*
+  * User space process size. 47bits minus one guard page.
+  */
+-#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
++#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
+ 
+ /* This decides where the kernel will search for a free chunk of vm
+  * space during mmap's.
+  */
+ #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
+-					0xc0000000 : 0xFFFFe000)
++					0xc0000000 : 0xFFFFf000)
+ 
+ #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
+ 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
+@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
+  */
+ #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
++#endif
++
+ #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
+ 
+ /* Get/set a process' ability to use the timestamp counter instruction */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/ptrace.h linux-2.6.32.13/arch/x86/include/asm/ptrace.h
+--- linux-2.6.32.13/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/ptrace.h	2010-05-15 13:21:13.906812769 -0400
+@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
+ }
+ 
+ /*
+- * user_mode_vm(regs) determines whether a register set came from user mode.
++ * user_mode(regs) determines whether a register set came from user mode.
+  * This is true if V8086 mode was enabled OR if the register set was from
+  * protected mode with RPL-3 CS value.  This tricky test checks that with
+  * one comparison.  Many places in the kernel can bypass this full check
+- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
++ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
++ * be used.
+  */
+-static inline int user_mode(struct pt_regs *regs)
++static inline int user_mode_novm(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
+ #else
+-	return !!(regs->cs & 3);
++	return !!(regs->cs & SEGMENT_RPL_MASK);
+ #endif
+ }
+ 
+-static inline int user_mode_vm(struct pt_regs *regs)
++static inline int user_mode(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
+ 		USER_RPL;
+ #else
+-	return user_mode(regs);
++	return user_mode_novm(regs);
+ #endif
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/reboot.h linux-2.6.32.13/arch/x86/include/asm/reboot.h
+--- linux-2.6.32.13/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/reboot.h	2010-05-15 13:21:13.906812769 -0400
+@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
+ 
+ void native_machine_crash_shutdown(struct pt_regs *regs);
+ void native_machine_shutdown(void);
+-void machine_real_restart(const unsigned char *code, int length);
++void machine_real_restart(const unsigned char *code, unsigned int length);
+ 
+ typedef void (*nmi_shootdown_cb)(int, struct die_args*);
+ void nmi_shootdown_cpus(nmi_shootdown_cb callback);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/rwsem.h linux-2.6.32.13/arch/x86/include/asm/rwsem.h
+--- linux-2.6.32.13/arch/x86/include/asm/rwsem.h	2010-04-29 17:49:37.501451369 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/rwsem.h	2010-05-15 13:21:13.906812769 -0400
+@@ -118,10 +118,26 @@ static inline void __down_read(struct rw
+ {
+ 	asm volatile("# beginning down_read\n\t"
+ 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* adds 0x00000001, returns the old value */
+-		     "  jns        1f\n"
++		     "  jns        2f\n"
+ 		     "  call call_rwsem_down_read_failed\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending down_read\n\t"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem)
+@@ -136,13 +152,29 @@ static inline int __down_read_trylock(st
+ 	rwsem_count_t result, tmp;
+ 	asm volatile("# beginning __down_read_trylock\n\t"
+ 		     "  mov          %0,%1\n\t"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "  mov          %1,%2\n\t"
+ 		     "  add          %3,%2\n\t"
+-		     "  jle	     2f\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "sub %3,%2\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "  jle	     3f\n\t"
+ 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
+-		     "  jnz	     1b\n\t"
+-		     "2:\n\t"
++		     "  jnz	     2b\n\t"
++		     "3:\n\t"
+ 		     "# ending __down_read_trylock\n\t"
+ 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
+ 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
+@@ -160,12 +192,28 @@ static inline void __down_write_nested(s
+ 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
+ 	asm volatile("# beginning down_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtract 0x0000ffff, returns the old value */
+ 		     "  test      %1,%1\n\t"
+ 		     /* was the count 0 before? */
+-		     "  jz        1f\n"
++		     "  jz        2f\n"
+ 		     "  call call_rwsem_down_write_failed\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending down_write"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -198,10 +246,26 @@ static inline void __up_read(struct rw_s
+ 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
+ 	asm volatile("# beginning __up_read\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtracts 1, returns the old value */
+-		     "  jns        1f\n\t"
++		     "  jns        2f\n\t"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending __up_read\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -216,11 +280,27 @@ static inline void __up_write(struct rw_
+ 	rwsem_count_t tmp;
+ 	asm volatile("# beginning __up_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* tries to transition
+ 			0xffff0001 -> 0x00000000 */
+-		     "  jz       1f\n"
++		     "  jz       2f\n"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __up_write\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (-RWSEM_ACTIVE_WRITE_BIAS)
+@@ -234,13 +314,29 @@ static inline void __downgrade_write(str
+ {
+ 	asm volatile("# beginning __downgrade_write\n\t"
+ 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /*
+ 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
+ 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
+ 		      */
+-		     "  jns       1f\n\t"
++		     "  jns       2f\n\t"
+ 		     "  call call_rwsem_downgrade_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __downgrade_write\n"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem), "er" (-RWSEM_WAITING_BIAS)
+@@ -253,7 +349,23 @@ static inline void __downgrade_write(str
+ static inline void rwsem_atomic_add(rwsem_count_t delta,
+ 				    struct rw_semaphore *sem)
+ {
+-	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
++	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (sem->count)
+ 		     : "er" (delta));
+ }
+@@ -266,7 +378,23 @@ static inline rwsem_count_t rwsem_atomic
+ {
+ 	rwsem_count_t tmp = delta;
+ 
+-	asm volatile(LOCK_PREFIX "xadd %0,%1"
++	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (tmp), "+m" (sem->count)
+ 		     : : "memory");
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/segment.h linux-2.6.32.13/arch/x86/include/asm/segment.h
+--- linux-2.6.32.13/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/segment.h	2010-05-15 13:21:13.906812769 -0400
+@@ -62,8 +62,8 @@
+  *  26 - ESPFIX small SS
+  *  27 - per-cpu			[ offset to per-cpu data area ]
+  *  28 - stack_canary-20		[ for stack protector ]
+- *  29 - unused
+- *  30 - unused
++ *  29 - PCI BIOS CS
++ *  30 - PCI BIOS DS
+  *  31 - TSS for double fault handler
+  */
+ #define GDT_ENTRY_TLS_MIN	6
+@@ -77,6 +77,8 @@
+ 
+ #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
++
+ #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
+ 
+ #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
+@@ -88,7 +90,7 @@
+ #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
+ #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
+ 
+-#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
++#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
+ #ifdef CONFIG_SMP
+ #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
+ #else
+@@ -102,6 +104,12 @@
+ #define __KERNEL_STACK_CANARY		0
+ #endif
+ 
++#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
++#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
++
++#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
++#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
++
+ #define GDT_ENTRY_DOUBLEFAULT_TSS	31
+ 
+ /*
+@@ -139,7 +147,7 @@
+  */
+ 
+ /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
+-#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
++#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
+ 
+ 
+ #else
+@@ -163,6 +171,8 @@
+ #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
+ #define __USER32_DS	__USER_DS
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
++
+ #define GDT_ENTRY_TSS 8	/* needs two entries */
+ #define GDT_ENTRY_LDT 10 /* needs two entries */
+ #define GDT_ENTRY_TLS_MIN 12
+@@ -183,6 +193,7 @@
+ #endif
+ 
+ #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
++#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
+ #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
+ #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
+ #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/spinlock.h linux-2.6.32.13/arch/x86/include/asm/spinlock.h
+--- linux-2.6.32.13/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/spinlock.h	2010-05-15 13:21:13.906812769 -0400
+@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
+ static inline void __raw_read_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
+-		     "jns 1f\n"
+-		     "call __read_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl $1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jns 2f\n"
++		     "call __read_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw) : "memory");
+ }
+ 
+ static inline void __raw_write_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
+-		     "jz 1f\n"
+-		     "call __write_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl %1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jz 2f\n"
++		     "call __write_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
+ 
+ static inline void __raw_read_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     :"+m" (rw->lock) : : "memory");
+ }
+ 
+ static inline void __raw_write_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1, %0"
++	asm volatile(LOCK_PREFIX "addl %1, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/system.h linux-2.6.32.13/arch/x86/include/asm/system.h
+--- linux-2.6.32.13/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/system.h	2010-05-15 13:21:13.906812769 -0400
+@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
+ {
+ 	unsigned long __limit;
+ 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
+-	return __limit + 1;
++	return __limit;
+ }
+ 
+ static inline void native_clts(void)
+@@ -340,7 +340,7 @@ void enable_hlt(void);
+ 
+ void cpu_idle_wait(void);
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ~0xfUL)
+ extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
+ 
+ void default_idle(void);
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h
+--- linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h	2010-05-15 13:21:13.906812769 -0400
+@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
+ static __always_inline unsigned long __must_check
+ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
+ 	return __copy_to_user_ll(to, from, n);
+ }
+ 
+@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
+ static __always_inline unsigned long
+ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	/* Avoid zeroing the tail if the copy fails..
+ 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
+ 	 * but as the zeroing behaviour is only significant when n is not
+@@ -138,6 +146,10 @@ static __always_inline unsigned long
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
+ 	return __copy_from_user_ll(to, from, n);
+ }
+ 
+@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
+ 				const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -182,14 +200,62 @@ static __always_inline unsigned long
+ __copy_from_user_inatomic_nocache(void *to, const void __user *from,
+ 				  unsigned long n)
+ {
+-       return __copy_from_user_ll_nocache_nozero(to, from, n);
++	if ((long)n < 0)
++		return n;
++
++	return __copy_from_user_ll_nocache_nozero(to, from, n);
++}
++
++/**
++ * copy_to_user: - Copy a block of data into user space.
++ * @to:   Destination address, in user space.
++ * @from: Source address, in kernel space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from kernel space to user space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ */
++static __always_inline unsigned long __must_check
++copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if (access_ok(VERIFY_WRITE, to, n))
++		n = __copy_to_user(to, from, n);
++	return n;
++}
++
++/**
++ * copy_from_user: - Copy a block of data from user space.
++ * @to:   Destination address, in kernel space.
++ * @from: Source address, in user space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from user space to kernel space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ *
++ * If some data could not be copied, this function will pad the copied
++ * data to the requested size using zero bytes.
++ */
++static __always_inline unsigned long __must_check
++copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if (access_ok(VERIFY_READ, from, n))
++		n = __copy_from_user(to, from, n);
++	else if ((long)n > 0) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		memset(to, 0, n);
++	}
++	return n;
+ }
+ 
+-unsigned long __must_check copy_to_user(void __user *to,
+-					const void *from, unsigned long n);
+-unsigned long __must_check copy_from_user(void *to,
+-					  const void __user *from,
+-					  unsigned long n);
+ long __must_check strncpy_from_user(char *dst, const char __user *src,
+ 				    long count);
+ long __must_check __strncpy_from_user(char *dst,
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h
+--- linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h	2010-05-15 13:21:13.906812769 -0400
+@@ -9,6 +9,9 @@
+ #include <linux/prefetch.h>
+ #include <linux/lockdep.h>
+ #include <asm/page.h>
++#include <asm/pgtable.h>
++
++#define set_fs(x)	(current_thread_info()->addr_limit = (x))
+ 
+ /*
+  * Copy To/From Userspace
+@@ -19,20 +22,24 @@ __must_check unsigned long
+ copy_user_generic(void *to, const void *from, unsigned len);
+ 
+ __must_check unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned len);
+-__must_check unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned len);
+-__must_check unsigned long
+ copy_in_user(void __user *to, const void __user *from, unsigned len);
+ 
+ static __always_inline __must_check
+-int __copy_from_user(void *dst, const void __user *src, unsigned size)
++unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(dst, size, false);
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
+ 			      ret, "b", "b", "=q", 1);
+@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
+ 			       ret, "q", "", "=r", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_to_user(void __user *dst, const void *src, unsigned size)
++unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(src, size, true);
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
++	}
+ 	switch (size) {
+ 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
+ 			      ret, "b", "b", "iq", 1);
+@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
+ 			       ret, "q", "", "er", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
++unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
++{
++	if (access_ok(VERIFY_WRITE, to, len))
++		len = __copy_to_user(to, from, len);
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
++{
++	if ((int)len < 0)
++		return len;
++
++	if (access_ok(VERIFY_READ, from, len))
++		len = __copy_from_user(to, from, len);
++	else if ((int)len > 0) {
++		if (!__builtin_constant_p(len))
++			check_object_size(to, len, false);
++		memset(to, 0, len);
++	}
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1: {
+ 		u8 tmp;
+@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
+ 		return ret;
+ 	}
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
+ 	}
+@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
+ __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
+ 					    unsigned size);
+ 
+-static __must_check __always_inline int
++static __must_check __always_inline unsigned long
+ __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return copy_user_generic((__force void *)dst, src, size);
+ }
+ 
+-extern long __copy_user_nocache(void *dst, const void __user *src,
++extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
+ 				unsigned size, int zerorest);
+ 
+-static inline int
+-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
++static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
+ {
+ 	might_sleep();
++
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 1);
+ }
+ 
+-static inline int
+-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
++static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
+ 				  unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 0);
+ }
+ 
+-unsigned long
++extern unsigned long
+ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
+ 
+ #endif /* _ASM_X86_UACCESS_64_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess.h linux-2.6.32.13/arch/x86/include/asm/uaccess.h
+--- linux-2.6.32.13/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/uaccess.h	2010-05-15 13:21:13.906812769 -0400
+@@ -8,8 +8,11 @@
+ #include <linux/thread_info.h>
+ #include <linux/prefetch.h>
+ #include <linux/string.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
+ #include <asm/asm.h>
+ #include <asm/page.h>
++#include <asm/segment.h>
+ 
+ #define VERIFY_READ 0
+ #define VERIFY_WRITE 1
+@@ -29,7 +32,12 @@
+ 
+ #define get_ds()	(KERNEL_DS)
+ #define get_fs()	(current_thread_info()->addr_limit)
++#ifdef CONFIG_X86_32
++void __set_fs(mm_segment_t x, int cpu);
++void set_fs(mm_segment_t x);
++#else
+ #define set_fs(x)	(current_thread_info()->addr_limit = (x))
++#endif
+ 
+ #define segment_eq(a, b)	((a).seg == (b).seg)
+ 
+@@ -77,7 +85,33 @@
+  * checks that the pointer is in the user space range - after calling
+  * this function, memory access functions may still return -EFAULT.
+  */
+-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define access_ok(type, addr, size)					\
++({									\
++	long __size = size;						\
++	unsigned long __addr = (unsigned long)addr;			\
++	unsigned long __addr_ao = __addr & PAGE_MASK;			\
++	unsigned long __end_ao = __addr + __size - 1;			\
++	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
++	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
++		while(__addr_ao <= __end_ao) {				\
++			char __c_ao;					\
++			__addr_ao += PAGE_SIZE;				\
++			if (__size > PAGE_SIZE)				\
++				cond_resched();				\
++			if (__get_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			if (type != VERIFY_WRITE) {			\
++				__addr = __addr_ao;			\
++				continue;				\
++			}						\
++			if (__put_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			__addr = __addr_ao;				\
++		}							\
++	}								\
++	__ret_ao;							\
++})
+ 
+ /*
+  * The exception table consists of pairs of addresses: the first is the
+@@ -183,13 +217,21 @@ extern int __get_user_bad(void);
+ 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
+ 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
+ 
+-
++#ifdef CONFIG_X86_32
++#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
++#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
++#else
++#define _ASM_LOAD_USER_DS(ds)
++#define _ASM_LOAD_KERNEL_DS
++#endif
+ 
+ #ifdef CONFIG_X86_32
+ #define __put_user_asm_u64(x, addr, err, errret)			\
+-	asm volatile("1:	movl %%eax,0(%2)\n"			\
+-		     "2:	movl %%edx,4(%2)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	movl %%eax,%%ds:0(%2)\n"		\
++		     "2:	movl %%edx,%%ds:4(%2)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "4:	movl %3,%0\n"				\
+ 		     "	jmp 3b\n"					\
+@@ -197,15 +239,18 @@ extern int __get_user_bad(void);
+ 		     _ASM_EXTABLE(1b, 4b)				\
+ 		     _ASM_EXTABLE(2b, 4b)				\
+ 		     : "=r" (err)					\
+-		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
++		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex_u64(x, addr)					\
+-	asm volatile("1:	movl %%eax,0(%1)\n"			\
+-		     "2:	movl %%edx,4(%1)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	movl %%eax,%%ds:0(%1)\n"		\
++		     "2:	movl %%edx,%%ds:4(%1)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+ 		     _ASM_EXTABLE(2b, 3b - 2b)				\
+-		     : : "A" (x), "r" (addr))
++		     : : "A" (x), "r" (addr), "r"(__USER_DS))
+ 
+ #define __put_user_x8(x, ptr, __ret_pu)				\
+ 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
+@@ -374,16 +419,18 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+-		     : "=r" (err), ltype(x)				\
+-		     : "m" (__m(addr)), "i" (errret), "0" (err))
++		     : "=r" (err), ltype (x)				\
++		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
+ 
+ #define __get_user_size_ex(x, ptr, size)				\
+ do {									\
+@@ -407,10 +454,12 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : ltype(x) : "m" (__m(addr)))
++		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
+ 
+ #define __put_user_nocheck(x, ptr, size)			\
+ ({								\
+@@ -424,13 +473,24 @@ do {									\
+ 	int __gu_err;							\
+ 	unsigned long __gu_val;						\
+ 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
+-	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
++	(x) = (__typeof__(*(ptr)))__gu_val;				\
+ 	__gu_err;							\
+ })
+ 
+ /* FIXME: this hack is definitely wrong -AK */
+ struct __large_struct { unsigned long buf[100]; };
+-#define __m(x) (*(struct __large_struct __user *)(x))
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#define ____m(x)					\
++({							\
++	unsigned long ____x = (unsigned long)(x);	\
++	if (____x < PAX_USER_SHADOW_BASE)		\
++		____x += PAX_USER_SHADOW_BASE;		\
++	(void __user *)____x;				\
++})
++#else
++#define ____m(x) (x)
++#endif
++#define __m(x) (*(struct __large_struct __user *)____m(x))
+ 
+ /*
+  * Tell gcc we read from memory instead of writing: this is because
+@@ -438,21 +498,26 @@ struct __large_struct { unsigned long bu
+  * aliasing issues.
+  */
+ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+ 		     : "=r"(err)					\
+-		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
++		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : : ltype(x), "m" (__m(addr)))
++		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
+ 
+ /*
+  * uaccess_try and catch
+@@ -530,7 +595,7 @@ struct __large_struct { unsigned long bu
+ #define get_user_ex(x, ptr)	do {					\
+ 	unsigned long __gue_val;					\
+ 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
+-	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
++	(x) = (__typeof__(*(ptr)))__gue_val;				\
+ } while (0)
+ 
+ #ifdef CONFIG_X86_WP_WORKS_OK
+@@ -567,6 +632,7 @@ extern struct movsl_mask {
+ 
+ #define ARCH_HAS_NOCACHE_UACCESS 1
+ 
++#define ARCH_HAS_SORT_EXTABLE
+ #ifdef CONFIG_X86_32
+ # include "uaccess_32.h"
+ #else
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/vgtod.h linux-2.6.32.13/arch/x86/include/asm/vgtod.h
+--- linux-2.6.32.13/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/vgtod.h	2010-05-15 13:21:13.906812769 -0400
+@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
+ 	int		sysctl_enabled;
+ 	struct timezone sys_tz;
+ 	struct { /* extract of a clocksource struct */
++		char	name[8];
+ 		cycle_t (*vread)(void);
+ 		cycle_t	cycle_last;
+ 		cycle_t	mask;
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/vmi.h linux-2.6.32.13/arch/x86/include/asm/vmi.h
+--- linux-2.6.32.13/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/vmi.h	2010-05-15 13:21:13.928275178 -0400
+@@ -191,6 +191,7 @@ struct vrom_header {
+ 	u8      reserved[96];   /* Reserved for headers */
+ 	char    vmi_init[8];    /* VMI_Init jump point */
+ 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
++	char    rom_data[8048];	/* rest of the option ROM */
+ } __attribute__((packed));
+ 
+ struct pnp_header {
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/vsyscall.h linux-2.6.32.13/arch/x86/include/asm/vsyscall.h
+--- linux-2.6.32.13/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/vsyscall.h	2010-05-15 13:21:13.928275178 -0400
+@@ -15,9 +15,10 @@ enum vsyscall_num {
+ 
+ #ifdef __KERNEL__
+ #include <linux/seqlock.h>
++#include <linux/getcpu.h>
++#include <linux/time.h>
+ 
+ #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
+-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
+ 
+ /* Definitions for CONFIG_GENERIC_TIME definitions */
+ #define __section_vsyscall_gtod_data __attribute__ \
+@@ -31,7 +32,6 @@ enum vsyscall_num {
+ #define VGETCPU_LSL	2
+ 
+ extern int __vgetcpu_mode;
+-extern volatile unsigned long __jiffies;
+ 
+ /* kernel space (writeable) */
+ extern int vgetcpu_mode;
+@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
+ 
+ extern void map_vsyscall(void);
+ 
++extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
++extern time_t vtime(time_t *t);
++extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
+ #endif /* __KERNEL__ */
+ 
+ #endif /* _ASM_X86_VSYSCALL_H */
+diff -urNp linux-2.6.32.13/arch/x86/include/asm/xsave.h linux-2.6.32.13/arch/x86/include/asm/xsave.h
+--- linux-2.6.32.13/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/include/asm/xsave.h	2010-05-15 13:21:13.928275178 -0400
+@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
+ static inline int xsave_user(struct xsave_struct __user *buf)
+ {
+ 	int err;
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
++		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
+ 	u32 lmask = mask;
+ 	u32 hmask = mask >> 32;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
++		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+diff -urNp linux-2.6.32.13/arch/x86/Kconfig linux-2.6.32.13/arch/x86/Kconfig
+--- linux-2.6.32.13/arch/x86/Kconfig	2010-05-15 13:20:18.407099662 -0400
++++ linux-2.6.32.13/arch/x86/Kconfig	2010-05-15 13:40:23.896554812 -0400
+@@ -531,6 +531,7 @@ source "arch/x86/lguest/Kconfig"
+ 
+ config PARAVIRT
+ 	bool "Enable paravirtualization code"
++	depends on !PAX_PER_CPU_PGD
+ 	---help---
+ 	  This changes the kernel so it can modify itself when it is run
+ 	  under a hypervisor, potentially improving performance significantly
+@@ -1083,7 +1084,7 @@ config PAGE_OFFSET
+ 	hex
+ 	default 0xB0000000 if VMSPLIT_3G_OPT
+ 	default 0x80000000 if VMSPLIT_2G
+-	default 0x78000000 if VMSPLIT_2G_OPT
++	default 0x70000000 if VMSPLIT_2G_OPT
+ 	default 0x40000000 if VMSPLIT_1G
+ 	default 0xC0000000
+ 	depends on X86_32
+@@ -1414,7 +1415,7 @@ config ARCH_USES_PG_UNCACHED
+ 
+ config EFI
+ 	bool "EFI runtime service support"
+-	depends on ACPI
++	depends on ACPI && !PAX_KERNEXEC
+ 	---help---
+ 	  This enables the kernel to use EFI runtime services that are
+ 	  available (such as the EFI variable services).
+@@ -1501,6 +1502,7 @@ config KEXEC_JUMP
+ config PHYSICAL_START
+ 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
+ 	default "0x1000000"
++	range 0x400000 0x40000000
+ 	---help---
+ 	  This gives the physical address where the kernel is loaded.
+ 
+@@ -1565,6 +1567,7 @@ config PHYSICAL_ALIGN
+ 	hex
+ 	prompt "Alignment value to which kernel should be aligned" if X86_32
+ 	default "0x1000000"
++	range 0x400000 0x1000000 if PAX_KERNEXEC
+ 	range 0x2000 0x1000000
+ 	---help---
+ 	  This value puts the alignment restrictions on physical address
+@@ -1596,9 +1599,10 @@ config HOTPLUG_CPU
+ 	  Say N if you want to disable CPU hotplug.
+ 
+ config COMPAT_VDSO
+-	def_bool y
++	def_bool n
+ 	prompt "Compat VDSO support"
+ 	depends on X86_32 || IA32_EMULATION
++	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
+ 	---help---
+ 	  Map the 32-bit VDSO to the predictable old-style address too.
+ 	---help---
+diff -urNp linux-2.6.32.13/arch/x86/Kconfig.cpu linux-2.6.32.13/arch/x86/Kconfig.cpu
+--- linux-2.6.32.13/arch/x86/Kconfig.cpu	2010-04-29 17:49:37.481119841 -0400
++++ linux-2.6.32.13/arch/x86/Kconfig.cpu	2010-05-15 13:21:13.930870481 -0400
+@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
+ 
+ config X86_F00F_BUG
+ 	def_bool y
+-	depends on M586MMX || M586TSC || M586 || M486 || M386
++	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
+ 
+ config X86_WP_WORKS_OK
+ 	def_bool y
+@@ -360,7 +360,7 @@ config X86_POPAD_OK
+ 
+ config X86_ALIGNMENT_16
+ 	def_bool y
+-	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
++	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+ 
+ config X86_INTEL_USERCOPY
+ 	def_bool y
+@@ -406,7 +406,7 @@ config X86_CMPXCHG64
+ # generates cmov.
+ config X86_CMOV
+ 	def_bool y
+-	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
++	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
+ 
+ config X86_MINIMUM_CPU_FAMILY
+ 	int
+diff -urNp linux-2.6.32.13/arch/x86/Kconfig.debug linux-2.6.32.13/arch/x86/Kconfig.debug
+--- linux-2.6.32.13/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/Kconfig.debug	2010-05-15 13:21:13.942893840 -0400
+@@ -99,7 +99,7 @@ config X86_PTDUMP
+ config DEBUG_RODATA
+ 	bool "Write protect kernel read-only data structures"
+ 	default y
+-	depends on DEBUG_KERNEL
++	depends on DEBUG_KERNEL && BROKEN
+ 	---help---
+ 	  Mark the kernel read-only data as write-protected in the pagetables,
+ 	  in order to catch accidental (and incorrect) writes to such const
+diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/boot.c linux-2.6.32.13/arch/x86/kernel/acpi/boot.c
+--- linux-2.6.32.13/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
++++ linux-2.6.32.13/arch/x86/kernel/acpi/boot.c	2010-05-15 13:21:13.954911113 -0400
+@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
+ 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
+ 		     },
+ 	 },
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S
+--- linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S	2010-05-15 13:21:13.954911113 -0400
+@@ -104,7 +104,7 @@ _start:
+ 	movl	%eax, %ecx
+ 	orl	%edx, %ecx
+ 	jz	1f
+-	movl	$0xc0000080, %ecx
++	mov	$MSR_EFER, %ecx
+ 	wrmsr
+ 1:
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c
+--- linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c	2010-05-15 13:20:18.407099662 -0400
++++ linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c	2010-05-15 13:21:13.954911113 -0400
+@@ -11,11 +11,12 @@
+ #include <linux/cpumask.h>
+ #include <asm/segment.h>
+ #include <asm/desc.h>
++#include <asm/e820.h>
+ 
+ #include "realmode/wakeup.h"
+ #include "sleep.h"
+ 
+-unsigned long acpi_wakeup_address;
++unsigned long acpi_wakeup_address = 0x2000;
+ unsigned long acpi_realmode_flags;
+ 
+ /* address in low memory of the wakeup routine. */
+@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
+ 	header->trampoline_segment = setup_trampoline() >> 4;
+ #ifdef CONFIG_SMP
+ 	stack_start.sp = temp_stack + sizeof(temp_stack);
++
++	pax_open_kernel();
+ 	early_gdt_descr.address =
+ 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
++	pax_close_kernel();
++
+ 	initial_gs = per_cpu_offset(smp_processor_id());
+ #endif
+ 	initial_code = (unsigned long)wakeup_long64;
+@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
+ 		return;
+ 	}
+ 
+-	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
+-
+-	if (!acpi_realmode) {
+-		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
+-		return;
+-	}
+-
+-	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
++	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
++	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
+ }
+ 
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S
+--- linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S	2010-05-15 13:21:13.954911113 -0400
+@@ -30,13 +30,11 @@ wakeup_pmode_return:
+ 	# and restore the stack ... but you need gdt for this to work
+ 	movl	saved_context_esp, %esp
+ 
+-	movl	%cs:saved_magic, %eax
+-	cmpl	$0x12345678, %eax
++	cmpl	$0x12345678, saved_magic
+ 	jne	bogus_magic
+ 
+ 	# jump to place where we left off
+-	movl	saved_eip, %eax
+-	jmp	*%eax
++	jmp	*(saved_eip)
+ 
+ bogus_magic:
+ 	jmp	bogus_magic
+diff -urNp linux-2.6.32.13/arch/x86/kernel/alternative.c linux-2.6.32.13/arch/x86/kernel/alternative.c
+--- linux-2.6.32.13/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/alternative.c	2010-05-15 13:21:13.962912884 -0400
+@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
+ 
+ 		BUG_ON(p->len > MAX_PATCH_LEN);
+ 		/* prep the buffer with the original instructions */
+-		memcpy(insnbuf, p->instr, p->len);
++		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
+ 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
+ 					 (unsigned long)p->instr, p->len);
+ 
+@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
+  * instructions. And on the local CPU you need to be protected again NMI or MCE
+  * handlers seeing an inconsistent instruction while you patch.
+  */
+-static void *__init_or_module text_poke_early(void *addr, const void *opcode,
++static void *__kprobes text_poke_early(void *addr, const void *opcode,
+ 					      size_t len)
+ {
+ 	unsigned long flags;
+ 	local_irq_save(flags);
+-	memcpy(addr, opcode, len);
++
++	pax_open_kernel();
++	memcpy(ktla_ktva(addr), opcode, len);
++	pax_close_kernel();
++
+ 	sync_core();
+ 	local_irq_restore(flags);
+ 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
+  */
+ void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
+ {
+-	unsigned long flags;
+-	char *vaddr;
++	unsigned char *vaddr = ktla_ktva(addr);
+ 	struct page *pages[2];
+-	int i;
++	size_t i;
+ 
+ 	if (!core_kernel_text((unsigned long)addr)) {
+-		pages[0] = vmalloc_to_page(addr);
+-		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
++		pages[0] = vmalloc_to_page(vaddr);
++		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
+ 	} else {
+-		pages[0] = virt_to_page(addr);
++		pages[0] = virt_to_page(vaddr);
+ 		WARN_ON(!PageReserved(pages[0]));
+-		pages[1] = virt_to_page(addr + PAGE_SIZE);
++		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
+ 	}
+ 	BUG_ON(!pages[0]);
+-	local_irq_save(flags);
+-	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
+-	if (pages[1])
+-		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
+-	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
+-	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
+-	clear_fixmap(FIX_TEXT_POKE0);
+-	if (pages[1])
+-		clear_fixmap(FIX_TEXT_POKE1);
+-	local_flush_tlb();
+-	sync_core();
+-	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+-	   that causes hangs on some VIA CPUs. */
++	text_poke_early(addr, opcode, len);
+ 	for (i = 0; i < len; i++)
+-		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
+-	local_irq_restore(flags);
++		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
+ 	return addr;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/kernel/amd_iommu.c linux-2.6.32.13/arch/x86/kernel/amd_iommu.c
+--- linux-2.6.32.13/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:37.521943068 -0400
++++ linux-2.6.32.13/arch/x86/kernel/amd_iommu.c	2010-05-15 13:21:13.968009761 -0400
+@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
+ 	}
+ }
+ 
+-static struct dma_map_ops amd_iommu_dma_ops = {
++static const struct dma_map_ops amd_iommu_dma_ops = {
+ 	.alloc_coherent = alloc_coherent,
+ 	.free_coherent = free_coherent,
+ 	.map_page = map_page,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c
+--- linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c	2010-05-15 13:21:13.979712258 -0400
+@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
+ 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
+ 				GFP_ATOMIC);
+ 	if (!ioapic_entries)
+-		return 0;
++		return NULL;
+ 
+ 	for (apic = 0; apic < nr_ioapics; apic++) {
+ 		ioapic_entries[apic] =
+@@ -728,7 +728,7 @@ nomem:
+ 		kfree(ioapic_entries[apic]);
+ 	kfree(ioapic_entries);
+ 
+-	return 0;
++	return NULL;
+ }
+ 
+ /*
+@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
+ }
+ EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
+ 
+-void lock_vector_lock(void)
++void lock_vector_lock(void) __acquires(vector_lock)
+ {
+ 	/* Used to the online set of cpus does not change
+ 	 * during assign_irq_vector.
+@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
+ 	spin_lock(&vector_lock);
+ }
+ 
+-void unlock_vector_lock(void)
++void unlock_vector_lock(void) __releases(vector_lock)
+ {
+ 	spin_unlock(&vector_lock);
+ }
+diff -urNp linux-2.6.32.13/arch/x86/kernel/apm_32.c linux-2.6.32.13/arch/x86/kernel/apm_32.c
+--- linux-2.6.32.13/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/apm_32.c	2010-05-15 13:21:14.011066799 -0400
+@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
+  * This is for buggy BIOS's that refer to (real mode) segment 0x40
+  * even though they are called in protected mode.
+  */
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ static const char driver_version[] = "1.16ac";	/* no spaces */
+@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
+ 			  &call->esi);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	return call->eax & 0xff;
+@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
+ 					 &call->eax);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 	return error;
+ }
+@@ -975,7 +989,7 @@ recalc:
+ 
+ static void apm_power_off(void)
+ {
+-	unsigned char po_bios_call[] = {
++	const unsigned char po_bios_call[] = {
+ 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
+ 		0x8e, 0xd0,		/* movw  ax,ss       */
+ 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
+@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
+ static struct miscdevice apm_device = {
+ 	APM_MINOR_DEV,
+ 	"apm_bios",
+-	&apm_bios_fops
++	&apm_bios_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ 
+@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+ 
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ /*
+@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
+ 	 * code to that CPU.
+ 	 */
+ 	gdt = get_cpu_gdt_table(0);
++
++	pax_open_kernel();
+ 	set_desc_base(&gdt[APM_CS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
+ 	set_desc_base(&gdt[APM_CS_16 >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
+ 	set_desc_base(&gdt[APM_DS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
++	pax_close_kernel();
+ 
+ 	proc_create("apm", 0, NULL, &apm_file_ops);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c
+--- linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c	2010-05-15 13:21:14.011066799 -0400
+@@ -115,6 +115,11 @@ void foo(void)
+ 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
+ #endif
+ 
+ #ifdef CONFIG_XEN
+diff -urNp linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c
+--- linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c	2010-05-15 13:21:14.011066799 -0400
+@@ -63,6 +63,18 @@ int main(void)
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
+ 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
++	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
++	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
++#endif
++
+ #endif
+ 
+ 
+@@ -115,6 +127,7 @@ int main(void)
+ 	ENTRY(cr8);
+ 	BLANK();
+ #undef ENTRY
++	DEFINE(TSS_size, sizeof(struct tss_struct));
+ 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
+ 	BLANK();
+ 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/common.c linux-2.6.32.13/arch/x86/kernel/cpu/common.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/common.c	2010-05-15 13:21:14.011066799 -0400
+@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
+ 
+ static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
+ 
+-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
+-#ifdef CONFIG_X86_64
+-	/*
+-	 * We need valid kernel segments for data and code in long mode too
+-	 * IRET will check the segment types  kkeil 2000/10/28
+-	 * Also sysret mandates a special GDT layout
+-	 *
+-	 * TLS descriptors are currently at a different place compared to i386.
+-	 * Hopefully nobody expects them at a fixed place (Wine?)
+-	 */
+-	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
+-#else
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
+-	/*
+-	 * Segments used for calling PnP BIOS have byte granularity.
+-	 * They code segments and data segments have fixed 64k limits,
+-	 * the transfer segment sizes are set at run time.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/*
+-	 * The APM segments have byte granularity and their bases
+-	 * are set at run time.  All have 64k limits.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* data */
+-	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
+-
+-	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	GDT_STACK_CANARY_INIT
+-#endif
+-} };
+-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+-
+ static int __init x86_xsave_setup(char *s)
+ {
+ 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
+@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
+ {
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
++	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 	/* Reload the per-cpu base */
+@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
+ 	/* Filter out anything that depends on CPUID levels we don't have */
+ 	filter_cpuid_features(c, true);
+ 
++#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
++	setup_clear_cpu_cap(X86_FEATURE_SEP);
++#endif
++
+ 	/* If the model name is still unset, do table lookup. */
+ 	if (!c->x86_model_id[0]) {
+ 		const char *p;
+@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
+ 	int i;
+ 
+ 	cpu = stack_smp_processor_id();
+-	t = &per_cpu(init_tss, cpu);
++	t = init_tss + cpu;
+ 	orig_ist = &per_cpu(orig_ist, cpu);
+ 
+ #ifdef CONFIG_NUMA
+@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
+ 	switch_to_new_gdt(cpu);
+ 	loadsegment(fs, 0);
+ 
+-	load_idt((const struct desc_ptr *)&idt_descr);
++	load_idt(&idt_descr);
+ 
+ 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
+ 	syscall_init();
+@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
+ {
+ 	int cpu = smp_processor_id();
+ 	struct task_struct *curr = current;
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 	struct thread_struct *thread = &curr->thread;
+ 
+ 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-05-15 13:21:14.043267946 -0400
+@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-05-15 13:21:14.043267946 -0400
+@@ -225,7 +225,7 @@ static struct cpu_model models[] =
+ 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
+ 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
+ 
+-	{ NULL, }
++	{ NULL, NULL, 0, NULL}
+ };
+ #undef _BANIAS
+ #undef BANIAS
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/intel.c linux-2.6.32.13/arch/x86/kernel/cpu/intel.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/intel.c	2010-05-15 13:20:18.427075180 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/intel.c	2010-05-15 13:21:14.043267946 -0400
+@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
+ 	 * Update the IDT descriptor and reload the IDT so that
+ 	 * it uses the read-only mapped virtual address.
+ 	 */
+-	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
++	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
+ 	load_idt(&idt_descr);
+ }
+ #endif
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-15 13:20:18.427075180 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-15 13:21:14.043267946 -0400
+@@ -917,7 +917,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show   = show,
+ 	.store  = store,
+ };
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/Makefile linux-2.6.32.13/arch/x86/kernel/cpu/Makefile
+--- linux-2.6.32.13/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/Makefile	2010-05-15 13:21:14.043267946 -0400
+@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
+ CFLAGS_REMOVE_common.o = -pg
+ endif
+ 
+-# Make sure load_percpu_segment has no stackprotector
+-nostackp := $(call cc-option, -fno-stack-protector)
+-CFLAGS_common.o		:= $(nostackp)
+-
+ obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
+ obj-y			+= proc.o capflags.o powerflags.o common.o
+ obj-y			+= vmware.o hypervisor.o sched.o
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-05-15 13:21:14.043267946 -0400
+@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops threshold_ops = {
++static const struct sysfs_ops threshold_ops = {
+ 	.show			= show,
+ 	.store			= store,
+ };
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c	2010-05-15 13:21:14.043267946 -0400
+@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
+ 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
+ 				m->cs, m->ip);
+ 
+-		if (m->cs == __KERNEL_CS)
++		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
+ 			print_symbol("{%s}", m->ip);
+ 		pr_cont("\n");
+ 	}
+@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
+  */
+ 
+ static DEFINE_SPINLOCK(mce_state_lock);
+-static int		open_count;		/* #times opened */
++static atomic_t		open_count;		/* #times opened */
+ static int		open_exclu;		/* already open exclusive? */
+ 
+ static int mce_open(struct inode *inode, struct file *file)
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
++	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
+ 		spin_unlock(&mce_state_lock);
+ 
+ 		return -EBUSY;
+@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
+ 
+ 	if (file->f_flags & O_EXCL)
+ 		open_exclu = 1;
+-	open_count++;
++	atomic_inc(&open_count);
+ 
+ 	spin_unlock(&mce_state_lock);
+ 
+@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	open_count--;
++	atomic_dec(&open_count);
+ 	open_exclu = 0;
+ 
+ 	spin_unlock(&mce_state_lock);
+@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
+ 	MISC_MCELOG_MINOR,
+ 	"mcelog",
+ 	&mce_chrdev_ops,
++	{NULL, NULL}, NULL, NULL
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c	2010-05-15 13:21:14.043267946 -0400
+@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops amd_mtrr_ops = {
++static const struct mtrr_ops amd_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_AMD,
+ 	.set               = amd_set_mtrr,
+ 	.get               = amd_get_mtrr,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c	2010-05-15 13:21:14.043267946 -0400
+@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops centaur_mtrr_ops = {
++static const struct mtrr_ops centaur_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CENTAUR,
+ 	.set               = centaur_set_mcr,
+ 	.get               = centaur_get_mcr,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-05-15 13:21:14.043267946 -0400
+@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
+ 	post_set();
+ }
+ 
+-static struct mtrr_ops cyrix_mtrr_ops = {
++static const struct mtrr_ops cyrix_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CYRIX,
+ 	.set_all	   = cyrix_set_all,
+ 	.set               = cyrix_set_arr,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c	2010-05-15 13:21:14.043267946 -0400
+@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
+ 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
+ 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
+ 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
+-	{}
++	{ 0, 0 }
+ };
+ 
+ static unsigned long smp_changes_mask;
+@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
+ /*
+  * Generic structure...
+  */
+-struct mtrr_ops generic_mtrr_ops = {
++const struct mtrr_ops generic_mtrr_ops = {
+ 	.use_intel_if		= 1,
+ 	.set_all		= generic_set_all,
+ 	.get			= generic_get_mtrr,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c	2010-05-15 13:21:14.043267946 -0400
+@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
+ u64 size_or_mask, size_and_mask;
+ static bool mtrr_aps_delayed_init;
+ 
+-static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
++static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
+ 
+-struct mtrr_ops *mtrr_if;
++const struct mtrr_ops *mtrr_if;
+ 
+ static void set_mtrr(unsigned int reg, unsigned long base,
+ 		     unsigned long size, mtrr_type type);
+ 
+-void set_mtrr_ops(struct mtrr_ops *ops)
++void set_mtrr_ops(const struct mtrr_ops *ops)
+ {
+ 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
+ 		mtrr_ops[ops->vendor] = ops;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h
+--- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-05-15 13:21:14.043267946 -0400
+@@ -12,19 +12,19 @@
+ extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
+ 
+ struct mtrr_ops {
+-	u32	vendor;
+-	u32	use_intel_if;
+-	void	(*set)(unsigned int reg, unsigned long base,
++	const u32	vendor;
++	const u32	use_intel_if;
++	void	(* const set)(unsigned int reg, unsigned long base,
+ 		       unsigned long size, mtrr_type type);
+-	void	(*set_all)(void);
++	void	(* const set_all)(void);
+ 
+-	void	(*get)(unsigned int reg, unsigned long *base,
++	void	(* const get)(unsigned int reg, unsigned long *base,
+ 		       unsigned long *size, mtrr_type *type);
+-	int	(*get_free_region)(unsigned long base, unsigned long size,
++	int	(* const get_free_region)(unsigned long base, unsigned long size,
+ 				   int replace_reg);
+-	int	(*validate_add_page)(unsigned long base, unsigned long size,
++	int	(* const validate_add_page)(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+-	int	(*have_wrcomb)(void);
++	int	(* const have_wrcomb)(void);
+ };
+ 
+ extern int generic_get_free_region(unsigned long base, unsigned long size,
+@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
+ extern int generic_validate_add_page(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+ 
+-extern struct mtrr_ops generic_mtrr_ops;
++extern const struct mtrr_ops generic_mtrr_ops;
+ 
+ extern int positive_have_wrcomb(void);
+ 
+@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
+ 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
+ void get_mtrr_state(void);
+ 
+-extern void set_mtrr_ops(struct mtrr_ops *ops);
++extern void set_mtrr_ops(const struct mtrr_ops *ops);
+ 
+ extern u64 size_or_mask, size_and_mask;
+-extern struct mtrr_ops *mtrr_if;
++extern const struct mtrr_ops *mtrr_if;
+ 
+ #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
+ #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-05-15 13:21:14.043267946 -0400
+@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
+ 
+ /* Interface defining a CPU specific perfctr watchdog */
+ struct wd_ops {
+-	int (*reserve)(void);
+-	void (*unreserve)(void);
+-	int (*setup)(unsigned nmi_hz);
+-	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
+-	void (*stop)(void);
++	int (* const reserve)(void);
++	void (* const unreserve)(void);
++	int (* const setup)(unsigned nmi_hz);
++	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
++	void (* const stop)(void);
+ 	unsigned perfctr;
+ 	unsigned evntsel;
+ 	u64 checkbit;
+@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
+ #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
+ #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops;
+ 
+ static int setup_intel_arch_watchdog(unsigned nmi_hz)
+@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
+ 	return 1;
+ }
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops __read_mostly = {
+ 	.reserve	= single_msr_reserve,
+ 	.unreserve	= single_msr_unreserve,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c
+--- linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c	2010-05-15 13:21:14.046723916 -0400
+@@ -2354,7 +2354,7 @@ perf_callchain_user(struct pt_regs *regs
+ 			break;
+ 
+ 		callchain_store(entry, frame.return_address);
+-		fp = frame.next_frame;
++		fp = (__force const void __user *)frame.next_frame;
+ 	}
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/crash.c linux-2.6.32.13/arch/x86/kernel/crash.c
+--- linux-2.6.32.13/arch/x86/kernel/crash.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.13/arch/x86/kernel/crash.c	2010-05-15 13:21:14.046723916 -0400
+@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, 
+ 	regs = args->regs;
+ 
+ #ifdef CONFIG_X86_32
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		crash_fixup_ss_esp(&fixed_regs, regs);
+ 		regs = &fixed_regs;
+ 	}
+diff -urNp linux-2.6.32.13/arch/x86/kernel/doublefault_32.c linux-2.6.32.13/arch/x86/kernel/doublefault_32.c
+--- linux-2.6.32.13/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/doublefault_32.c	2010-05-15 13:21:14.046723916 -0400
+@@ -11,7 +11,7 @@
+ 
+ #define DOUBLEFAULT_STACKSIZE (1024)
+ static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
+-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
++#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
+ 
+ #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
+ 
+@@ -21,7 +21,7 @@ static void doublefault_fn(void)
+ 	unsigned long gdt, tss;
+ 
+ 	store_gdt(&gdt_desc);
+-	gdt = gdt_desc.address;
++	gdt = (unsigned long)gdt_desc.address;
+ 
+ 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+ 
+@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
+ 		/* 0x2 bit is always set */
+ 		.flags		= X86_EFLAGS_SF | 0x2,
+ 		.sp		= STACK_START,
+-		.es		= __USER_DS,
++		.es		= __KERNEL_DS,
+ 		.cs		= __KERNEL_CS,
+ 		.ss		= __KERNEL_DS,
+-		.ds		= __USER_DS,
++		.ds		= __KERNEL_DS,
+ 		.fs		= __KERNEL_PERCPU,
+ 
+ 		.__cr3		= __pa_nodebug(swapper_pg_dir),
+diff -urNp linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c
+--- linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c	2010-05-15 13:21:14.068544431 -0400
+@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
+ 	 * When in-kernel, we also print out the stack and code at the
+ 	 * time of the fault..
+ 	 */
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned int code_prologue = code_bytes * 43 / 64;
+ 		unsigned int code_len = code_bytes;
+ 		unsigned char c;
+ 		u8 *ip;
++		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
+ 
+ 		printk(KERN_EMERG "Stack:\n");
+ 		show_stack_log_lvl(NULL, regs, &regs->sp,
+@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
+ 
+ 		printk(KERN_EMERG "Code: ");
+ 
+-		ip = (u8 *)regs->ip - code_prologue;
++		ip = (u8 *)regs->ip - code_prologue + cs_base;
+ 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
+ 			/* try starting at IP */
+-			ip = (u8 *)regs->ip;
++			ip = (u8 *)regs->ip + cs_base;
+ 			code_len = code_len - code_prologue + 1;
+ 		}
+ 		for (i = 0; i < code_len; i++, ip++) {
+@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
+ 				printk(" Bad EIP value.");
+ 				break;
+ 			}
+-			if (ip == (u8 *)regs->ip)
++			if (ip == (u8 *)regs->ip + cs_base)
+ 				printk("<%02x> ", c);
+ 			else
+ 				printk("%02x ", c);
+@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
+ {
+ 	unsigned short ud2;
+ 
++	ip = ktla_ktva(ip);
+ 	if (ip < PAGE_OFFSET)
+ 		return 0;
+ 	if (probe_kernel_address((unsigned short *)ip, ud2))
+diff -urNp linux-2.6.32.13/arch/x86/kernel/dumpstack.c linux-2.6.32.13/arch/x86/kernel/dumpstack.c
+--- linux-2.6.32.13/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/dumpstack.c	2010-05-15 13:21:14.068544431 -0400
+@@ -180,7 +180,7 @@ void dump_stack(void)
+ #endif
+ 
+ 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version);
+@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
+ 		panic("Fatal exception in interrupt");
+ 	if (panic_on_oops)
+ 		panic("Fatal exception");
+-	do_exit(signr);
++	do_group_exit(signr);
+ }
+ 
+ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
+ 	unsigned long flags = oops_begin();
+ 	int sig = SIGSEGV;
+ 
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		report_bug(regs->ip, regs);
+ 
+ 	if (__die(str, regs, err))
+diff -urNp linux-2.6.32.13/arch/x86/kernel/e820.c linux-2.6.32.13/arch/x86/kernel/e820.c
+--- linux-2.6.32.13/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/e820.c	2010-05-15 13:21:14.068544431 -0400
+@@ -733,7 +733,7 @@ struct early_res {
+ };
+ static struct early_res early_res[MAX_EARLY_RES] __initdata = {
+ 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
+-	{}
++	{ 0, 0, {0}, 0 }
+ };
+ 
+ static int __init find_overlapped_early(u64 start, u64 end)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/efi_32.c linux-2.6.32.13/arch/x86/kernel/efi_32.c
+--- linux-2.6.32.13/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/efi_32.c	2010-05-15 13:21:14.068544431 -0400
+@@ -38,70 +38,38 @@
+  */
+ 
+ static unsigned long efi_rt_eflags;
+-static pgd_t efi_bak_pg_dir_pointer[2];
++static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
+ 
+-void efi_call_phys_prelog(void)
++void __init efi_call_phys_prelog(void)
+ {
+-	unsigned long cr4;
+-	unsigned long temp;
+ 	struct desc_ptr gdt_descr;
+ 
+ 	local_irq_save(efi_rt_eflags);
+ 
+-	/*
+-	 * If I don't have PAE, I should just duplicate two entries in page
+-	 * directory. If I have PAE, I just need to duplicate one entry in
+-	 * page directory.
+-	 */
+-	cr4 = read_cr4_safe();
+ 
+-	if (cr4 & X86_CR4_PAE) {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		swapper_pg_dir[0].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-	} else {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		efi_bak_pg_dir_pointer[1].pgd =
+-		    swapper_pg_dir[pgd_index(0x400000)].pgd;
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-		temp = PAGE_OFFSET + 0x400000;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    swapper_pg_dir[pgd_index(temp)].pgd;
+-	}
++	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+ 	 */
+ 	__flush_tlb_all();
+ 
+-	gdt_descr.address = __pa(get_cpu_gdt_table(0));
++	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ }
+ 
+-void efi_call_phys_epilog(void)
++void __init efi_call_phys_epilog(void)
+ {
+-	unsigned long cr4;
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
++	gdt_descr.address = get_cpu_gdt_table(0);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 
+-	cr4 = read_cr4_safe();
+-
+-	if (cr4 & X86_CR4_PAE) {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-	} else {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    efi_bak_pg_dir_pointer[1].pgd;
+-	}
++	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+diff -urNp linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S
+--- linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S	2010-05-15 13:21:14.068544431 -0400
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <linux/linkage.h>
++#include <linux/init.h>
+ #include <asm/page_types.h>
+ 
+ /*
+@@ -20,7 +21,7 @@
+  * service functions will comply with gcc calling convention, too.
+  */
+ 
+-.text
++__INIT
+ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 0. The function can only be called in Linux kernel. So CS has been
+@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
+ 	 * The mapping of lower virtual memory has been created in prelog and
+ 	 * epilog.
+ 	 */
+-	movl	$1f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	jmp	*%edx
++	jmp	1f-__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
+ 	 * parameter 2, ..., param n. To make things easy, we save the return
+ 	 * address of efi_call_phys in a global variable.
+ 	 */
+-	popl	%edx
+-	movl	%edx, saved_return_addr
+-	/* get the function pointer into ECX*/
+-	popl	%ecx
+-	movl	%ecx, efi_rt_function_ptr
+-	movl	$2f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	pushl	%edx
++	popl	(saved_return_addr)
++	popl	(efi_rt_function_ptr)
+ 
+ 	/*
+ 	 * 3. Clear PG bit in %CR0.
+@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 5. Call the physical function.
+ 	 */
+-	jmp	*%ecx
++	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
+ 
+-2:
+ 	/*
+ 	 * 6. After EFI runtime service returns, control will return to
+ 	 * following instruction. We'd better readjust stack pointer first.
+@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
+ 	movl	%cr0, %edx
+ 	orl	$0x80000000, %edx
+ 	movl	%edx, %cr0
+-	jmp	1f
+-1:
++
+ 	/*
+ 	 * 8. Now restore the virtual mode from flat mode by
+ 	 * adding EIP with PAGE_OFFSET.
+ 	 */
+-	movl	$1f, %edx
+-	jmp	*%edx
++	jmp	1f+__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+ 	 * 9. Balance the stack. And because EAX contain the return value,
+ 	 * we'd better not clobber it.
+ 	 */
+-	leal	efi_rt_function_ptr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
++	pushl	(efi_rt_function_ptr)
+ 
+ 	/*
+-	 * 10. Push the saved return address onto the stack and return.
++	 * 10. Return to the saved return address.
+ 	 */
+-	leal	saved_return_addr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
+-	ret
++	jmpl	*(saved_return_addr)
+ ENDPROC(efi_call_phys)
+ .previous
+ 
+-.data
++__INITDATA
+ saved_return_addr:
+ 	.long 0
+ efi_rt_function_ptr:
+diff -urNp linux-2.6.32.13/arch/x86/kernel/entry_32.S linux-2.6.32.13/arch/x86/kernel/entry_32.S
+--- linux-2.6.32.13/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/entry_32.S	2010-05-15 13:21:14.068544431 -0400
+@@ -191,7 +191,67 @@
+ 
+ #endif	/* CONFIG_X86_32_LAZY_GS */
+ 
+-.macro SAVE_ALL
++.macro PAX_EXIT_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++#endif
++	mov %cs, %esi
++	cmp $__KERNEXEC_KERNEL_CS, %esi
++	jnz 2f
++#ifdef CONFIG_PARAVIRT
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	btr $16, %esi
++	ljmp $__KERNEL_CS, $1f
++1:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
++#else
++	mov %esi, %cr0
++#endif
++2:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro PAX_ENTER_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	bts $16, %esi
++	jnc 1f
++	mov %cs, %esi
++	cmp $__KERNEL_CS, %esi
++	jz 3f
++	ljmp $__KERNEL_CS, $3f
++1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
++2:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++#else
++	mov %esi, %cr0
++#endif
++3:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro __SAVE_ALL _DS
+ 	cld
+ 	PUSH_GS
+ 	pushl %fs
+@@ -224,7 +284,7 @@
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+-	movl $(__USER_DS), %edx
++	movl $\_DS, %edx
+ 	movl %edx, %ds
+ 	movl %edx, %es
+ 	movl $(__KERNEL_PERCPU), %edx
+@@ -232,6 +292,15 @@
+ 	SET_KERNEL_GS %edx
+ .endm
+ 
++.macro SAVE_ALL
++#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
++	__SAVE_ALL __KERNEL_DS
++	PAX_ENTER_KERNEL
++#else
++	__SAVE_ALL __USER_DS
++#endif
++.endm
++
+ .macro RESTORE_INT_REGS
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+@@ -352,7 +421,15 @@ check_userspace:
+ 	movb PT_CS(%esp), %al
+ 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
+ 	cmpl $USER_RPL, %eax
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jae resume_userspace
++
++	PAX_EXIT_KERNEL
++	jmp resume_kernel
++#else
+ 	jb resume_kernel		# not returning to v8086 or userspace
++#endif
+ 
+ ENTRY(resume_userspace)
+ 	LOCKDEP_SYS_EXIT
+@@ -414,10 +491,9 @@ sysenter_past_esp:
+ 	/*CFI_REL_OFFSET cs, 0*/
+ 	/*
+ 	 * Push current_thread_info()->sysenter_return to the stack.
+-	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
+-	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
+ 	 */
+-	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
++	GET_THREAD_INFO(%ebp)
++	pushl TI_sysenter_return(%ebp)
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET eip, 0
+ 
+@@ -430,9 +506,19 @@ sysenter_past_esp:
+  * Load the potential sixth argument from user stack.
+  * Careful about security.
+  */
++	movl PT_OLDESP(%esp),%ebp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov PT_OLDSS(%esp),%ds
++1:	movl %ds:(%ebp),%ebp
++	push %ss
++	pop %ds
++#else
+ 	cmpl $__PAGE_OFFSET-3,%ebp
+ 	jae syscall_fault
+ 1:	movl (%ebp),%ebp
++#endif
++
+ 	movl %ebp,PT_EBP(%esp)
+ .section __ex_table,"a"
+ 	.align 4
+@@ -455,12 +541,23 @@ sysenter_do_call:
+ 	testl $_TIF_ALLWORK_MASK, %ecx
+ 	jne sysexit_audit
+ sysenter_exit:
++
++#ifdef CONFIG_PAX_RANDKSTACK
++	pushl %eax
++	CFI_ADJUST_CFA_OFFSET 4
++	call pax_randomize_kstack
++	popl %eax
++	CFI_ADJUST_CFA_OFFSET -4
++#endif
++
+ /* if something modifies registers it must also disable sysexit */
+ 	movl PT_EIP(%esp), %edx
+ 	movl PT_OLDESP(%esp), %ecx
+ 	xorl %ebp,%ebp
+ 	TRACE_IRQS_ON
+ 1:	mov  PT_FS(%esp), %fs
++2:	mov  PT_DS(%esp), %ds
++3:	mov  PT_ES(%esp), %es
+ 	PTGS_TO_GS
+ 	ENABLE_INTERRUPTS_SYSEXIT
+ 
+@@ -504,11 +601,17 @@ sysexit_audit:
+ 
+ 	CFI_ENDPROC
+ .pushsection .fixup,"ax"
+-2:	movl $0,PT_FS(%esp)
++4:	movl $0,PT_FS(%esp)
++	jmp 1b
++5:	movl $0,PT_DS(%esp)
++	jmp 1b
++6:	movl $0,PT_ES(%esp)
+ 	jmp 1b
+ .section __ex_table,"a"
+ 	.align 4
+-	.long 1b,2b
++	.long 1b,4b
++	.long 2b,5b
++	.long 3b,6b
+ .popsection
+ 	PTGS_TO_GS_EX
+ ENDPROC(ia32_sysenter_target)
+@@ -538,6 +641,10 @@ syscall_exit:
+ 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
+ 	jne syscall_exit_work
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++	call pax_randomize_kstack
++#endif
++
+ restore_all:
+ 	TRACE_IRQS_IRET
+ restore_all_notrace:
+@@ -602,7 +709,13 @@ ldt_ss:
+ 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
+ 	mov %dx, %ax			/* eax: new kernel esp */
+ 	sub %eax, %edx			/* offset (low word is 0) */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	shr $16, %edx
+ 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
+ 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
+@@ -642,25 +755,19 @@ work_resched:
+ 
+ work_notifysig:				# deal with pending signals and
+ 					# notify-resume requests
++	movl %esp, %eax
+ #ifdef CONFIG_VM86
+ 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
+-	movl %esp, %eax
+-	jne work_notifysig_v86		# returning to kernel-space or
++	jz 1f				# returning to kernel-space or
+ 					# vm86-space
+-	xorl %edx, %edx
+-	call do_notify_resume
+-	jmp resume_userspace_sig
+ 
+-	ALIGN
+-work_notifysig_v86:
+ 	pushl %ecx			# save ti_flags for do_notify_resume
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	call save_v86_state		# %eax contains pt_regs pointer
+ 	popl %ecx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	movl %eax, %esp
+-#else
+-	movl %esp, %eax
++1:
+ #endif
+ 	xorl %edx, %edx
+ 	call do_notify_resume
+@@ -695,6 +802,10 @@ END(syscall_exit_work)
+ 
+ 	RING0_INT_FRAME			# can't unwind into user space anyway
+ syscall_fault:
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %ss
++	pop %ds
++#endif
+ 	GET_THREAD_INFO(%ebp)
+ 	movl $-EFAULT,PT_EAX(%esp)
+ 	jmp resume_userspace
+@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
+  * normal stack and adjusts ESP with the matching offset.
+  */
+ 	/* fixup the stack */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
+ 	shl $16, %eax
+@@ -1198,7 +1315,6 @@ return_to_handler:
+ 	ret
+ #endif
+ 
+-.section .rodata,"a"
+ #include "syscall_table_32.S"
+ 
+ syscall_table_size=(.-sys_call_table)
+@@ -1250,12 +1366,15 @@ error_code:
+ 	movl %ecx, %fs
+ 	UNWIND_ESPFIX_STACK
+ 	GS_TO_REG %ecx
++
++	PAX_ENTER_KERNEL
++
+ 	movl PT_GS(%esp), %edi		# get the function address
+ 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
+ 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
+ 	REG_TO_PTGS %ecx
+ 	SET_KERNEL_GS %ecx
+-	movl $(__USER_DS), %ecx
++	movl $(__KERNEL_DS), %ecx
+ 	movl %ecx, %ds
+ 	movl %ecx, %es
+ 	TRACE_IRQS_OFF
+@@ -1351,6 +1470,9 @@ nmi_stack_correct:
+ 	xorl %edx,%edx		# zero error code
+ 	movl %esp,%eax		# pt_regs pointer
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	jmp restore_all_notrace
+ 	CFI_ENDPROC
+ 
+@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
+ 	FIXUP_ESPFIX_STACK		# %eax == %esp
+ 	xorl %edx,%edx			# zero error code
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	RESTORE_REGS
+ 	lss 12+4(%esp), %esp		# back to espfix stack
+ 	CFI_ADJUST_CFA_OFFSET -24
+diff -urNp linux-2.6.32.13/arch/x86/kernel/entry_64.S linux-2.6.32.13/arch/x86/kernel/entry_64.S
+--- linux-2.6.32.13/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/entry_64.S	2010-05-15 13:23:38.934774262 -0400
+@@ -53,6 +53,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+ #include <linux/elf-em.h>
+@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
+ ENDPROC(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
++	.macro ljmpq sel, off
++#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
++	.byte 0x48; ljmp *1234f(%rip)
++	.pushsection .rodata
++	.align 16
++	1234: .quad \off; .word \sel
++	.popsection
++#else
++	push $\sel
++	push $\off
++	lretq
++#endif
++	.endm
++
++ENTRY(pax_enter_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	jnc 1f
++	mov %cs,%edi
++	cmp $__KERNEL_CS,%edi
++	jz 3f
++	ljmpq __KERNEL_CS,3f
++1:	ljmpq __KERNEXEC_KERNEL_CS,2f
++2:	SET_RDI_INTO_CR0
++3:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel)
++
++ENTRY(pax_exit_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	mov %cs,%rdi
++	cmp $__KERNEXEC_KERNEL_CS,%edi
++	jnz 2f
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	ljmpq __KERNEL_CS,1f
++1:	SET_RDI_INTO_CR0
++2:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI);
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel)
++
++ENTRY(pax_enter_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++	push %rbx
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR3_INTO_RDI
++	mov %rdi,%rbx
++	add $__START_KERNEL_map,%rbx
++	sub phys_base(%rip),%rbx
++
++#ifdef CONFIG_PARAVIRT
++	push %rdi
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0,i*8(%rbx)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	pop %rdi
++#endif
++	SET_RDI_INTO_CR3
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rbx
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel_user)
++
++ENTRY(pax_exit_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	push %rbx
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++	GET_CR3_INTO_RDI
++	add $__START_KERNEL_map,%rdi
++	sub phys_base(%rip),%rdi
++
++#ifdef CONFIG_PARAVIRT
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	mov %rdi,%rbx
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0x67,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0x67,i*8(%rdi)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	PV_RESTORE_REGS(CLBR_RDI)
++	pop %rbx
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel_user)
+ 
+ .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
+ #ifdef CONFIG_TRACE_IRQFLAGS
+@@ -317,7 +501,7 @@ ENTRY(save_args)
+ 	leaq -ARGOFFSET+16(%rsp),%rdi	/* arg1 for handler */
+ 	movq_cfi rbp, 8		/* push %rbp */
+ 	leaq 8(%rsp), %rbp		/* mov %rsp, %ebp */
+-	testl $3, CS(%rdi)
++	testb $3, CS(%rdi)
+ 	je 1f
+ 	SWAPGS
+ 	/*
+@@ -409,7 +593,7 @@ ENTRY(ret_from_fork)
+ 
+ 	RESTORE_REST
+ 
+-	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
++	testb $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
+ 	je   int_ret_from_sys_call
+ 
+ 	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
+@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
+ 
+ 	movq	%rsp,PER_CPU_VAR(old_rsp)
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs off/on section - it's straight
+ 	 * and short:
+@@ -502,6 +691,11 @@ sysret_check:
+ 	andl %edi,%edx
+ 	jnz  sysret_careful
+ 	CFI_REMEMBER_STATE
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	/*
+ 	 * sysretq will re-enable interrupts:
+ 	 */
+@@ -613,7 +807,7 @@ tracesys:
+ GLOBAL(int_ret_from_sys_call)
+ 	DISABLE_INTERRUPTS(CLBR_NONE)
+ 	TRACE_IRQS_OFF
+-	testl $3,CS-ARGOFFSET(%rsp)
++	testb $3,CS-ARGOFFSET(%rsp)
+ 	je retint_restore_args
+ 	movl $_TIF_ALLWORK_MASK,%edi
+ 	/* edi:	mask to check */
+@@ -800,6 +994,16 @@ END(interrupt)
+ 	CFI_ADJUST_CFA_OFFSET 10*8
+ 	call save_args
+ 	PARTIAL_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rdi)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	call \func
+ 	.endm
+ 
+@@ -822,7 +1026,7 @@ ret_from_intr:
+ 	CFI_ADJUST_CFA_OFFSET	-8
+ exit_intr:
+ 	GET_THREAD_INFO(%rcx)
+-	testl $3,CS-ARGOFFSET(%rsp)
++	testb $3,CS-ARGOFFSET(%rsp)
+ 	je retint_kernel
+ 
+ 	/* Interrupt came from user space */
+@@ -844,12 +1048,18 @@ retint_swapgs:		/* return to user-space 
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	TRACE_IRQS_IRETQ
+ 	SWAPGS
+ 	jmp restore_args
+ 
+ retint_restore_args:	/* return to kernel space */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++	call pax_exit_kernel
+ 	/*
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+@@ -1032,6 +1242,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+@@ -1049,6 +1269,16 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+@@ -1066,9 +1296,24 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+-	PER_CPU(init_tss, %rbp)
++#ifdef CONFIG_SMP
++	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
++	lea init_tss(%rbp), %rbp
++#else
++	lea init_tss(%rip), %rbp
++#endif
+ 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+ 	call \do_sym
+ 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+@@ -1085,6 +1330,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+@@ -1104,6 +1359,16 @@ ENTRY(\sym)
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+@@ -1405,14 +1670,27 @@ ENTRY(paranoid_exit)
+ 	TRACE_IRQS_OFF
+ 	testl %ebx,%ebx				/* swapgs needed? */
+ 	jnz paranoid_restore
+-	testl $3,CS(%rsp)
++	testb $3,CS(%rsp)
+ 	jnz   paranoid_userspace
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel
++	TRACE_IRQS_IRETQ 0
++	SWAPGS_UNSAFE_STACK
++	RESTORE_ALL 8
++	jmp irq_return
++#endif
+ paranoid_swapgs:
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#else
++	call pax_exit_kernel
++#endif
+ 	TRACE_IRQS_IRETQ 0
+ 	SWAPGS_UNSAFE_STACK
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ paranoid_restore:
++	call pax_exit_kernel
+ 	TRACE_IRQS_IRETQ 0
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+@@ -1470,7 +1748,7 @@ ENTRY(error_entry)
+ 	movq_cfi r14, R14+8
+ 	movq_cfi r15, R15+8
+ 	xorl %ebx,%ebx
+-	testl $3,CS+8(%rsp)
++	testb $3,CS+8(%rsp)
+ 	je error_kernelspace
+ error_swapgs:
+ 	SWAPGS
+@@ -1529,6 +1807,16 @@ ENTRY(nmi)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
+ 	movq %rsp,%rdi
+ 	movq $-1,%rsi
+@@ -1539,11 +1827,12 @@ ENTRY(nmi)
+ 	DISABLE_INTERRUPTS(CLBR_NONE)
+ 	testl %ebx,%ebx				/* swapgs needed? */
+ 	jnz nmi_restore
+-	testl $3,CS(%rsp)
++	testb $3,CS(%rsp)
+ 	jnz nmi_userspace
+ nmi_swapgs:
+ 	SWAPGS_UNSAFE_STACK
+ nmi_restore:
++	call pax_exit_kernel
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ nmi_userspace:
+diff -urNp linux-2.6.32.13/arch/x86/kernel/ftrace.c linux-2.6.32.13/arch/x86/kernel/ftrace.c
+--- linux-2.6.32.13/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/ftrace.c	2010-05-15 13:21:14.070771689 -0400
+@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
+ {
+ 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
+ 		smp_rmb();
++		pax_open_kernel();
+ 		ftrace_mod_code();
++		pax_close_kernel();
+ 		atomic_inc(&nmi_update_count);
+ 	}
+ 	/* Must have previous changes seen before executions */
+@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
+ 
+ 
+ 
+-static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
++static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
+ 
+ static unsigned char *ftrace_nop_replace(void)
+ {
+@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
+ {
+ 	unsigned char replaced[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	/*
+ 	 * Note: Due to modules and __init, code can
+ 	 *  disappear and change, we need to protect against faulting
+@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
+ 	unsigned char old[MCOUNT_INSN_SIZE], *new;
+ 	int ret;
+ 
+-	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
++	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
+ 	new = ftrace_call_replace(ip, (unsigned long)func);
+ 	ret = ftrace_modify_code(ip, old, new);
+ 
+@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
+ 	switch (faulted) {
+ 	case 0:
+ 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
+-		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 1:
+ 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
+-		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 2:
+ 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
+-		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
+ 		break;
+ 	}
+ 
+@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
+ {
+ 	unsigned char code[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/head32.c linux-2.6.32.13/arch/x86/kernel/head32.c
+--- linux-2.6.32.13/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/head32.c	2010-05-15 13:21:14.070771689 -0400
+@@ -16,6 +16,7 @@
+ #include <asm/apic.h>
+ #include <asm/io_apic.h>
+ #include <asm/bios_ebda.h>
++#include <asm/boot.h>
+ 
+ static void __init i386_default_early_setup(void)
+ {
+@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
+ {
+ 	reserve_trampoline_memory();
+ 
+-	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
++	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
+ 
+ #ifdef CONFIG_BLK_DEV_INITRD
+ 	/* Reserve INITRD */
+diff -urNp linux-2.6.32.13/arch/x86/kernel/head_32.S linux-2.6.32.13/arch/x86/kernel/head_32.S
+--- linux-2.6.32.13/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/head_32.S	2010-05-15 13:21:14.070771689 -0400
+@@ -19,10 +19,17 @@
+ #include <asm/setup.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/msr-index.h>
+ 
+ /* Physical address */
+ #define pa(X) ((X) - __PAGE_OFFSET)
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /*
+  * References to members of the new_cpu_data structure.
+  */
+@@ -52,11 +59,7 @@
+  * and small than max_low_pfn, otherwise will waste some page table entries
+  */
+ 
+-#if PTRS_PER_PMD > 1
+-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
+-#else
+-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
+-#endif
++#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
+ 
+ /* Enough space to fit pagetables for the low memory linear map */
+ MAPPING_BEYOND_END = \
+@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
+ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+ 
+ /*
++ * Real beginning of normal "text" segment
++ */
++ENTRY(stext)
++ENTRY(_stext)
++
++/*
+  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
+  * %esi points to the real-mode code as a 32-bit pointer.
+  * CS and DS must be 4 GB flat segments, but we don't depend on
+@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+  * can.
+  */
+ __HEAD
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jmp startup_32
++/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
++.fill PAGE_SIZE-5,1,0xcc
++#endif
++
+ ENTRY(startup_32)
+ 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
+ 		us to not reload segments */
+@@ -97,6 +113,55 @@ ENTRY(startup_32)
+ 	movl %eax,%gs
+ 2:
+ 
++#ifdef CONFIG_SMP
++	movl $pa(cpu_gdt_table),%edi
++	movl $__per_cpu_load,%eax
++	movw %ax,__KERNEL_PERCPU + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_PERCPU + 4(%edi)
++	movb %ah,__KERNEL_PERCPU + 7(%edi)
++	movl $__per_cpu_end - 1,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,__KERNEL_PERCPU + 0(%edi)
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++1:
++	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	movl $pa(boot_gdt),%edi
++	movl $__LOAD_PHYSICAL_ADDR,%eax
++	movw %ax,__BOOT_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__BOOT_CS + 4(%edi)
++	movb %ah,__BOOT_CS + 7(%edi)
++	rorl $16,%eax
++
++	ljmp $(__BOOT_CS),$1f
++1:
++
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++	addl $__PAGE_OFFSET,%eax
++1:
++	movw %ax,__KERNEL_CS + 2(%edi)
++	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_CS + 4(%edi)
++	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
++	movb %ah,__KERNEL_CS + 7(%edi)
++	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
++	rorl $16,%eax
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
+ /*
+  * Clear BSS first so that there are no surprises...
+  */
+@@ -140,9 +205,7 @@ ENTRY(startup_32)
+ 	cmpl $num_subarch_entries, %eax
+ 	jae bad_subarch
+ 
+-	movl pa(subarch_entries)(,%eax,4), %eax
+-	subl $__PAGE_OFFSET, %eax
+-	jmp *%eax
++	jmp *pa(subarch_entries)(,%eax,4)
+ 
+ bad_subarch:
+ WEAK(lguest_entry)
+@@ -154,10 +217,10 @@ WEAK(xen_entry)
+ 	__INITDATA
+ 
+ subarch_entries:
+-	.long default_entry		/* normal x86/PC */
+-	.long lguest_entry		/* lguest hypervisor */
+-	.long xen_entry			/* Xen hypervisor */
+-	.long default_entry		/* Moorestown MID */
++	.long ta(default_entry)		/* normal x86/PC */
++	.long ta(lguest_entry)		/* lguest hypervisor */
++	.long ta(xen_entry)		/* Xen hypervisor */
++	.long ta(default_entry)		/* Moorestown MID */
+ num_subarch_entries = (. - subarch_entries) / 4
+ .previous
+ #endif /* CONFIG_PARAVIRT */
+@@ -218,8 +281,11 @@ default_entry:
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#endif
+ #else	/* Not PAE */
+ 
+ page_pde_offset = (__PAGE_OFFSET >> 20);
+@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_dir+0xffc)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
++#endif
+ #endif
+ 	jmp 3f
+ /*
+@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
+ 	orl %edx,%eax
+ 	movl %eax,%cr4
+ 
++#ifdef CONFIG_X86_PAE
+ 	btl $5, %eax		# check if PAE is enabled
+ 	jnc 6f
+ 
+@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
+ 	jnc 6f
+ 
+ 	/* Setup EFER (Extended Feature Enable Register) */
+-	movl $0xc0000080, %ecx
++	movl $MSR_EFER, %ecx
+ 	rdmsr
+ 
+ 	btsl $11, %eax
+ 	/* Make changes effective */
+ 	wrmsr
+ 
++	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
++	movl $1,pa(nx_enabled)
++#endif
++
+ 6:
+ 
+ /*
+@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
+ 
+ #ifdef CONFIG_SMP
+ 	cmpb $0, ready
+-	jz  1f				/* Initial CPU cleans BSS */
+-	jmp checkCPUtype
+-1:
++	jnz checkCPUtype		/* Initial CPU cleans BSS */
+ #endif /* CONFIG_SMP */
+ 
+ /*
+@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
+ 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
+ 	movl %eax,%ss			# after changing gdt.
+ 
+-	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
++#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
+ 	movl %eax,%ds
+ 	movl %eax,%es
+ 
+@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
+ 	 */
+ 	cmpb $0,ready
+ 	jne 1f
+-	movl $per_cpu__gdt_page,%eax
++	movl $cpu_gdt_table,%eax
+ 	movl $per_cpu__stack_canary,%ecx
++#ifdef CONFIG_SMP
++	addl $__per_cpu_load,%ecx
++#endif
+ 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+ 	shrl $16, %ecx
+ 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
+ #ifdef CONFIG_SMP
+ 	movb ready, %cl
+ 	movb $1, ready
+-	cmpb $0,%cl		# the first CPU calls start_kernel
+-	je   1f
+-	movl (stack_start), %esp
+-1:
+ #endif /* CONFIG_SMP */
+ 	jmp *(initial_code)
+ 
+@@ -546,22 +617,22 @@ early_page_fault:
+ 	jmp early_fault
+ 
+ early_fault:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $1,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pusha
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	movl %cr2,%eax
+ 	pushl %eax
+ 	pushl %edx		/* trapno */
+ 	pushl $fault_msg
+ 	call printk
++;	call dump_stack
+ #endif
+-	call dump_stack
+ hlt_loop:
+ 	hlt
+ 	jmp hlt_loop
+@@ -569,8 +640,11 @@ hlt_loop:
+ /* This is the default interrupt "handler" :-) */
+ 	ALIGN
+ ignore_int:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $2,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pushl %eax
+ 	pushl %ecx
+ 	pushl %edx
+@@ -579,9 +653,6 @@ ignore_int:
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	pushl 16(%esp)
+ 	pushl 24(%esp)
+ 	pushl 32(%esp)
+@@ -608,27 +679,45 @@ ENTRY(initial_code)
+ /*
+  * BSS section
+  */
+-__PAGE_ALIGNED_BSS
+-	.align PAGE_SIZE_asm
+ #ifdef CONFIG_X86_PAE
++.section .swapper_pg_pmd,"a",@progbits
+ swapper_pg_pmd:
+ 	.fill 1024*KPMDS,4,0
+ #else
++.section .swapper_pg_dir,"a",@progbits
+ ENTRY(swapper_pg_dir)
+ 	.fill 1024,4,0
+ #endif
++
+ swapper_pg_fixmap:
+ 	.fill 1024,4,0
++
++.section .empty_zero_page,"a",@progbits
+ ENTRY(empty_zero_page)
+ 	.fill 4096,1,0
+ 
+ /*
++ * The IDT has to be page-aligned to simplify the Pentium
++ * F0 0F bug workaround.. We have a special link segment
++ * for this.
++ */
++.section .idt,"a",@progbits
++ENTRY(idt_table)
++	.fill 256,8,0
++
++/*
+  * This starts the data section.
+  */
+ #ifdef CONFIG_X86_PAE
+-__PAGE_ALIGNED_DATA
+-	/* Page-aligned for the benefit of paravirt? */
+-	.align PAGE_SIZE_asm
++.section .swapper_pg_dir,"a",@progbits
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ENTRY(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ ENTRY(swapper_pg_dir)
+ 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
+ # if KPMDS == 3
+@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
+ 
+ .data
+ ENTRY(stack_start)
+-	.long init_thread_union+THREAD_SIZE
++	.long init_thread_union+THREAD_SIZE-8
+ 	.long __BOOT_DS
+ 
+ ready:	.byte 0
+ 
++.section .rodata,"a",@progbits
+ early_recursion_flag:
+ 	.long 0
+ 
+@@ -691,7 +781,7 @@ fault_msg:
+ 	.word 0				# 32 bit align gdt_desc.address
+ boot_gdt_descr:
+ 	.word __BOOT_DS+7
+-	.long boot_gdt - __PAGE_OFFSET
++	.long pa(boot_gdt)
+ 
+ 	.word 0				# 32-bit align idt_desc.address
+ idt_descr:
+@@ -702,7 +792,7 @@ idt_descr:
+ 	.word 0				# 32 bit align gdt_desc.address
+ ENTRY(early_gdt_descr)
+ 	.word GDT_ENTRIES*8-1
+-	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
++	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
+ 
+ /*
+  * The boot_gdt must mirror the equivalent in setup.S and is
+@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
+ 	.align L1_CACHE_BYTES
+ ENTRY(boot_gdt)
+ 	.fill GDT_ENTRY_BOOT_CS,8,0
+-	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
+-	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
++	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
++
++	.align PAGE_SIZE_asm
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad 0x0000000000000000	/* NULL descriptor */
++	.quad 0x0000000000000000	/* 0x0b reserved */
++	.quad 0x0000000000000000	/* 0x13 reserved */
++	.quad 0x0000000000000000	/* 0x1b reserved */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
++#else
++	.quad 0x0000000000000000	/* 0x20 unused */
++#endif
++
++	.quad 0x0000000000000000	/* 0x28 unused */
++	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
++	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
++	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
++	.quad 0x0000000000000000	/* 0x4b reserved */
++	.quad 0x0000000000000000	/* 0x53 reserved */
++	.quad 0x0000000000000000	/* 0x5b reserved */
++
++	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
++	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
++	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
++
++	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
++	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
++
++	/*
++	 * Segments used for calling PnP BIOS have byte granularity.
++	 * The code segments and data segments have fixed 64k limits,
++	 * the transfer segment sizes are set at run time.
++	 */
++	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
++	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
++	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
++	.quad 0x0000930000000000	/* 0xa8 16-bit data */
++	.quad 0x0000930000000000	/* 0xb0 16-bit data */
++
++	/*
++	 * The APM segments have byte granularity and their bases
++	 * are set at run time.  All have 64k limits.
++	 */
++	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
++	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
++	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
++
++	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
++	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
++	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
++	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
++	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
++	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
++
++	/* Be sure this is zeroed to avoid false validations in Xen */
++	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
++	.endr
+diff -urNp linux-2.6.32.13/arch/x86/kernel/head64.c linux-2.6.32.13/arch/x86/kernel/head64.c
+--- linux-2.6.32.13/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/head64.c	2010-05-15 13:21:14.070771689 -0400
+@@ -29,7 +29,13 @@
+ static void __init zap_identity_mappings(void)
+ {
+ 	pgd_t *pgd = pgd_offset_k(0UL);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	set_pgd(pgd, native_make_pgd(0));
++#else
+ 	pgd_clear(pgd);
++#endif
++
+ 	__flush_tlb_all();
+ }
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/head_64.S linux-2.6.32.13/arch/x86/kernel/head_64.S
+--- linux-2.6.32.13/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/head_64.S	2010-05-15 13:21:14.070771689 -0400
+@@ -19,6 +19,7 @@
+ #include <asm/cache.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/cpufeature.h>
+ 
+ #ifdef CONFIG_PARAVIRT
+ #include <asm/asm-offsets.h>
+@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
+ L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
+ L4_START_KERNEL = pgd_index(__START_KERNEL_map)
+ L3_START_KERNEL = pud_index(__START_KERNEL_map)
++L4_VMALLOC_START = pgd_index(VMALLOC_START)
++L3_VMALLOC_START = pud_index(VMALLOC_START)
++L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
++L3_VMEMMAP_START = pud_index(VMEMMAP_START)
+ 
+ 	.text
+ 	__HEAD
+@@ -85,35 +90,22 @@ startup_64:
+ 	 */
+ 	addq	%rbp, init_level4_pgt + 0(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
+ 
+ 	addq	%rbp, level3_ident_pgt + 0(%rip)
++#ifndef CONFIG_XEN
++	addq	%rbp, level3_ident_pgt + 8(%rip)
++#endif
+ 
+-	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
+-	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
++	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
+ 
+-	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
+ 
+-	/* Add an Identity mapping if I am above 1G */
+-	leaq	_text(%rip), %rdi
+-	andq	$PMD_PAGE_MASK, %rdi
+-
+-	movq	%rdi, %rax
+-	shrq	$PUD_SHIFT, %rax
+-	andq	$(PTRS_PER_PUD - 1), %rax
+-	jz	ident_complete
+-
+-	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
+-	leaq	level3_ident_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-
+-	movq	%rdi, %rax
+-	shrq	$PMD_SHIFT, %rax
+-	andq	$(PTRS_PER_PMD - 1), %rax
+-	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
+-	leaq	level2_spare_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-ident_complete:
++	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
+ 
+ 	/*
+ 	 * Fixup the kernel text+data virtual addresses. Note that
+@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
+ 	 * after the boot processor executes this code.
+ 	 */
+ 
+-	/* Enable PAE mode and PGE */
+-	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
++	/* Enable PAE mode and PSE/PGE */
++	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
+ 	movq	%rax, %cr4
+ 
+ 	/* Setup early boot stage 4 level pagetables. */
+@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
+ 	movl	$MSR_EFER, %ecx
+ 	rdmsr
+ 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
+-	btl	$20,%edi		/* No Execute supported? */
++	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
+ 	jnc     1f
+ 	btsl	$_EFER_NX, %eax
++	leaq	init_level4_pgt(%rip), %rdi
++	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
+ 1:	wrmsr				/* Make changes effective */
+ 
+ 	/* Setup cr0 */
+@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
+ 	.quad	x86_64_start_kernel
+ 	ENTRY(initial_gs)
+ 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
+-	__FINITDATA
+ 
+ 	ENTRY(stack_start)
+ 	.quad  init_thread_union+THREAD_SIZE-8
+ 	.word  0
++	__FINITDATA
+ 
+ bad_address:
+ 	jmp bad_address
+ 
+-	.section ".init.text","ax"
++	__INIT
+ #ifdef CONFIG_EARLY_PRINTK
+ 	.globl early_idt_handlers
+ early_idt_handlers:
+@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
+ #endif /* EARLY_PRINTK */
+ 1:	hlt
+ 	jmp 1b
++	.previous
+ 
+ #ifdef CONFIG_EARLY_PRINTK
++	__INITDATA
+ early_recursion_flag:
+ 	.long 0
++	.previous
+ 
++	.section .rodata,"a",@progbits
+ early_idt_msg:
+ 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
+ early_idt_ripmsg:
+ 	.asciz "RIP %s\n"
+-#endif /* CONFIG_EARLY_PRINTK */
+ 	.previous
++#endif /* CONFIG_EARLY_PRINTK */
+ 
++	.section .rodata,"a",@progbits
+ #define NEXT_PAGE(name) \
+ 	.balign	PAGE_SIZE; \
+ ENTRY(name)
+@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
++	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
++	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
+ 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
+ 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++NEXT_PAGE(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ NEXT_PAGE(level3_ident_pgt)
+ 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++#ifdef CONFIG_XEN
+ 	.fill	511,8,0
++#else
++	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
++	.fill	510,8,0
++#endif
++
++NEXT_PAGE(level3_vmalloc_pgt)
++	.fill	512,8,0
++
++NEXT_PAGE(level3_vmemmap_pgt)
++	.fill	L3_VMEMMAP_START,8,0
++	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 
+ NEXT_PAGE(level3_kernel_pgt)
+ 	.fill	L3_START_KERNEL,8,0
+@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
+ 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++NEXT_PAGE(level2_vmemmap_pgt)
++	.fill	512,8,0
++
+ NEXT_PAGE(level2_fixmap_pgt)
+-	.fill	506,8,0
+-	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+-	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
+-	.fill	5,8,0
++	.fill	507,8,0
++	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
++	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
++	.fill	4,8,0
+ 
+-NEXT_PAGE(level1_fixmap_pgt)
++NEXT_PAGE(level1_vsyscall_pgt)
+ 	.fill	512,8,0
+ 
+-NEXT_PAGE(level2_ident_pgt)
+-	/* Since I easily can, map the first 1G.
++	/* Since I easily can, map the first 2G.
+ 	 * Don't set NX because code runs from these pages.
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
++NEXT_PAGE(level2_ident_pgt)
++	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
+ 
+ NEXT_PAGE(level2_kernel_pgt)
+ 	/*
+@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
+ 	 *  If you want to increase this then increase MODULES_VADDR
+ 	 *  too.)
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
+-		KERNEL_IMAGE_SIZE/PMD_SIZE)
+-
+-NEXT_PAGE(level2_spare_pgt)
+-	.fill   512, 8, 0
++	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
+ 
+ #undef PMDS
+ #undef NEXT_PAGE
+ 
+-	.data
++	.align PAGE_SIZE
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad	0x0000000000000000	/* NULL descriptor */
++	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
++	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
++	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
++	.quad	0x00cffb000000ffff	/* __USER32_CS */
++	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
++	.quad	0x00affb000000ffff	/* __USER_CS */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
++#else
++	.quad	0x0			/* unused */
++#endif
++
++	.quad	0,0			/* TSS */
++	.quad	0,0			/* LDT */
++	.quad	0,0,0			/* three TLS descriptors */
++	.quad	0x0000f40000000000	/* node/CPU stored in limit */
++	/* asm/segment.h:GDT_ENTRIES must match this */
++
++	/* zero the remaining page */
++	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
++	.endr
++
+ 	.align 16
+ 	.globl early_gdt_descr
+ early_gdt_descr:
+ 	.word	GDT_ENTRIES*8-1
+ early_gdt_descr_base:
+-	.quad	INIT_PER_CPU_VAR(gdt_page)
++	.quad	cpu_gdt_table
+ 
+ ENTRY(phys_base)
+ 	/* This must match the first entry in level2_kernel_pgt */
+ 	.quad   0x0000000000000000
+ 
+ #include "../../x86/xen/xen-head.S"
+-	
+-	.section .bss, "aw", @nobits
++
++	.section .rodata,"a",@progbits
+ 	.align L1_CACHE_BYTES
+ ENTRY(idt_table)
+-	.skip IDT_ENTRIES * 16
++	.fill 512,8,0
+ 
+ 	__PAGE_ALIGNED_BSS
+ 	.align PAGE_SIZE
+diff -urNp linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c
+--- linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c	2010-05-15 13:21:14.070771689 -0400
+@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
+ EXPORT_SYMBOL(cmpxchg8b_emu);
+ #endif
+ 
++EXPORT_SYMBOL_GPL(cpu_gdt_table);
++
+ /* Networking helper routines. */
+ EXPORT_SYMBOL(csum_partial_copy_generic);
++EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
++EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
+ 
+ EXPORT_SYMBOL(__get_user_1);
+ EXPORT_SYMBOL(__get_user_2);
+@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
+ 
+ EXPORT_SYMBOL(csum_partial);
+ EXPORT_SYMBOL(empty_zero_page);
++
++#ifdef CONFIG_PAX_KERNEXEC
++EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
++#endif
+diff -urNp linux-2.6.32.13/arch/x86/kernel/init_task.c linux-2.6.32.13/arch/x86/kernel/init_task.c
+--- linux-2.6.32.13/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/init_task.c	2010-05-15 13:21:14.070771689 -0400
+@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
+  * section. Since TSS's are completely CPU-local, we want them
+  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
+  */
+-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
+-
++struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
++EXPORT_SYMBOL(init_tss);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/ioport.c linux-2.6.32.13/arch/x86/kernel/ioport.c
+--- linux-2.6.32.13/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/ioport.c	2010-05-15 13:21:14.070771689 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/sched.h>
+ #include <linux/kernel.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/ioport.h>
+@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
+ 
+ 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
+ 		return -EINVAL;
++#ifdef CONFIG_GRKERNSEC_IO
++	if (turn_on) {
++		gr_handle_ioperm();
++		return -EPERM;
++	}
++#endif
+ 	if (turn_on && !capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 
+@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
+ 	 * because the ->io_bitmap_max value must match the bitmap
+ 	 * contents:
+ 	 */
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 
+ 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
+ 
+@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
+ 		return -EINVAL;
+ 	/* Trying to gain more privileges? */
+ 	if (level > old) {
++#ifdef CONFIG_GRKERNSEC_IO
++		gr_handle_iopl();
++		return -EPERM;
++#else
+ 		if (!capable(CAP_SYS_RAWIO))
+ 			return -EPERM;
++#endif
+ 	}
+ 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/irq_32.c linux-2.6.32.13/arch/x86/kernel/irq_32.c
+--- linux-2.6.32.13/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/irq_32.c	2010-05-15 13:21:14.070771689 -0400
+@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
+ 		return 0;
+ 
+ 	/* build the stack frame on the IRQ stack */
+-	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 	irqctx->tinfo.task = curctx->tinfo.task;
+ 	irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
+ 		irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+ 		/* build the stack frame on the softirq stack */
+-		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 
+ 		call_on_stack(__do_softirq, isp);
+ 		/*
+diff -urNp linux-2.6.32.13/arch/x86/kernel/kgdb.c linux-2.6.32.13/arch/x86/kernel/kgdb.c
+--- linux-2.6.32.13/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/kgdb.c	2010-05-15 13:21:14.070771689 -0400
+@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
+ 	return instruction_pointer(regs);
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: */
+ 	.gdb_bpt_instr		= { 0xcc },
+ 	.flags			= KGDB_HW_BREAKPOINT,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/kprobes.c linux-2.6.32.13/arch/x86/kernel/kprobes.c
+--- linux-2.6.32.13/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/kprobes.c	2010-05-15 13:23:38.934774262 -0400
+@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
+ 		char op;
+ 		s32 raddr;
+ 	} __attribute__((packed)) * jop;
+-	jop = (struct __arch_jmp_op *)from;
++
++	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
++
++	pax_open_kernel();
+ 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
+ 	jop->op = RELATIVEJUMP_INSTRUCTION;
++	pax_close_kernel();
+ }
+ 
+ /*
+@@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct 
+ 			disp = (u8 *) p->addr + *((s32 *) insn) -
+ 			       (u8 *) p->ainsn.insn;
+ 			BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
++			pax_open_kernel();
+ 			*(s32 *)insn = (s32) disp;
++			pax_close_kernel();
+ 		}
+ 	}
+ #endif
+@@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct 
+ 
+ static void __kprobes arch_copy_kprobe(struct kprobe *p)
+ {
+-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_open_kernel();
++	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_close_kernel();
+ 
+ 	fix_riprel(p);
+ 
+-	if (can_boost(p->addr))
++	if (can_boost(ktla_ktva(p->addr)))
+ 		p->ainsn.boostable = 0;
+ 	else
+ 		p->ainsn.boostable = -1;
+ 
+-	p->opcode = *p->addr;
++	p->opcode = *(ktla_ktva(p->addr));
+ }
+ 
+ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+@@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
+ 	if (p->opcode == BREAKPOINT_INSTRUCTION)
+ 		regs->ip = (unsigned long)p->addr;
+ 	else
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ }
+ 
+ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+@@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
+ 	if (p->ainsn.boostable == 1 && !p->post_handler) {
+ 		/* Boost up -- we can execute copied instructions directly */
+ 		reset_current_kprobe();
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 		preempt_enable_no_resched();
+ 		return;
+ 	}
+@@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
+ 	struct kprobe_ctlblk *kcb;
+ 
+ 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
+-	if (*addr != BREAKPOINT_INSTRUCTION) {
++	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
+ 		/*
+ 		 * The breakpoint instruction was removed right
+ 		 * after we hit it.  Another cpu has removed
+@@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
+ 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
+ {
+ 	unsigned long *tos = stack_addr(regs);
+-	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
++	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 	unsigned long orig_ip = (unsigned long)p->addr;
+ 	kprobe_opcode_t *insn = p->ainsn.insn;
+ 
+@@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
+ 	struct die_args *args = data;
+ 	int ret = NOTIFY_DONE;
+ 
+-	if (args->regs && user_mode_vm(args->regs))
++	if (args->regs && user_mode(args->regs))
+ 		return ret;
+ 
+ 	switch (val) {
+diff -urNp linux-2.6.32.13/arch/x86/kernel/ldt.c linux-2.6.32.13/arch/x86/kernel/ldt.c
+--- linux-2.6.32.13/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/ldt.c	2010-05-15 13:21:14.074681352 -0400
+@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
+ 	if (reload) {
+ #ifdef CONFIG_SMP
+ 		preempt_disable();
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ 		if (!cpumask_equal(mm_cpumask(current->mm),
+ 				   cpumask_of(smp_processor_id())))
+ 			smp_call_function(flush_ldt, current->mm, 1);
+ 		preempt_enable();
+ #else
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ #endif
+ 	}
+ 	if (oldsize) {
+@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
+ 		return err;
+ 
+ 	for (i = 0; i < old->size; i++)
+-		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
++		write_ldt_entry(new->ldt, i, old->ldt + i);
+ 	return 0;
+ }
+ 
+@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
+ 		retval = copy_ldt(&mm->context, &old_mm->context);
+ 		mutex_unlock(&old_mm->context.lock);
+ 	}
++
++	if (tsk == current) {
++		mm->context.vdso = ~0UL;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		mm->context.user_cs_base = 0UL;
++		mm->context.user_cs_limit = ~0UL;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		cpus_clear(mm->context.cpu_user_cs_mask);
++#endif
++
++#endif
++#endif
++
++	}
++
+ 	return retval;
+ }
+ 
+@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
++		error = -EINVAL;
++		goto out_unlock;
++	}
++#endif
++
+ 	fill_ldt(&ldt, &ldt_info);
+ 	if (oldmode)
+ 		ldt.avl = 0;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c
+--- linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c	2010-05-15 13:21:14.082777933 -0400
+@@ -26,7 +26,7 @@
+ #include <asm/system.h>
+ #include <asm/cacheflush.h>
+ 
+-static void set_idt(void *newidt, __u16 limit)
++static void set_idt(struct desc_struct *newidt, __u16 limit)
+ {
+ 	struct desc_ptr curidt;
+ 
+@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
+ }
+ 
+ 
+-static void set_gdt(void *newgdt, __u16 limit)
++static void set_gdt(struct desc_struct *newgdt, __u16 limit)
+ {
+ 	struct desc_ptr curgdt;
+ 
+@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
+ 	}
+ 
+ 	control_page = page_address(image->control_code_page);
+-	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
++	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
+ 
+ 	relocate_kernel_ptr = control_page;
+ 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c
+--- linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c	2010-05-15 13:21:14.082777933 -0400
+@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
+ 	}
+ 	/* clear the unused entries */
+ 	while (addr < end_addr) {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		set_pgd(level4p++, native_make_pgd(0));
++#else
+ 		pgd_clear(level4p++);
++#endif
++
+ 		addr += PGDIR_SIZE;
+ 	}
+ out:
+diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_amd.c linux-2.6.32.13/arch/x86/kernel/microcode_amd.c
+--- linux-2.6.32.13/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/microcode_amd.c	2010-05-15 13:21:14.082777933 -0400
+@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_amd_ops = {
++static const struct microcode_ops microcode_amd_ops = {
+ 	.request_microcode_user           = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info_amd,
+@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
+ 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
+ };
+ 
+-struct microcode_ops * __init init_amd_microcode(void)
++const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return &microcode_amd_ops;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_core.c linux-2.6.32.13/arch/x86/kernel/microcode_core.c
+--- linux-2.6.32.13/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/microcode_core.c	2010-05-15 13:21:14.082777933 -0400
+@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
+ 
+ #define MICROCODE_VERSION	"2.00"
+ 
+-static struct microcode_ops	*microcode_ops;
++static const struct microcode_ops	*microcode_ops;
+ 
+ /*
+  * Synchronization.
+diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_intel.c linux-2.6.32.13/arch/x86/kernel/microcode_intel.c
+--- linux-2.6.32.13/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/microcode_intel.c	2010-05-15 13:21:14.082777933 -0400
+@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
+ 
+ static int get_ucode_user(void *to, const void *from, size_t n)
+ {
+-	return copy_from_user(to, from, n);
++	return copy_from_user(to, (__force const void __user *)from, n);
+ }
+ 
+ static enum ucode_state
+ request_microcode_user(int cpu, const void __user *buf, size_t size)
+ {
+-	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
++	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
+ }
+ 
+ static void microcode_fini_cpu(int cpu)
+@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_intel_ops = {
++static const struct microcode_ops microcode_intel_ops = {
+ 	.request_microcode_user		  = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info,
+@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
+ 	.microcode_fini_cpu               = microcode_fini_cpu,
+ };
+ 
+-struct microcode_ops * __init init_intel_microcode(void)
++const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return &microcode_intel_ops;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/kernel/module.c linux-2.6.32.13/arch/x86/kernel/module.c
+--- linux-2.6.32.13/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/module.c	2010-05-15 13:21:14.082777933 -0400
+@@ -34,7 +34,7 @@
+ #define DEBUGP(fmt...)
+ #endif
+ 
+-void *module_alloc(unsigned long size)
++static void *__module_alloc(unsigned long size, pgprot_t prot)
+ {
+ 	struct vm_struct *area;
+ 
+@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
+ 	if (!area)
+ 		return NULL;
+ 
+-	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
+-					PAGE_KERNEL_EXEC);
++	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
++}
++
++void *module_alloc(unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	return __module_alloc(size, PAGE_KERNEL);
++#else
++	return __module_alloc(size, PAGE_KERNEL_EXEC);
++#endif
++
+ }
+ 
+ /* Free memory returned from module_alloc */
+@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_X86_32
++void *module_alloc_exec(unsigned long size)
++{
++	struct vm_struct *area;
++
++	if (size == 0)
++		return NULL;
++
++	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
++	return area ? area->addr : NULL;
++}
++EXPORT_SYMBOL(module_alloc_exec);
++
++void module_free_exec(struct module *mod, void *module_region)
++{
++	vunmap(module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++#else
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++
++void *module_alloc_exec(unsigned long size)
++{
++	return __module_alloc(size, PAGE_KERNEL_RX);
++}
++EXPORT_SYMBOL(module_alloc_exec);
++#endif
++#endif
++
+ /* We don't need anything special. */
+ int module_frob_arch_sections(Elf_Ehdr *hdr,
+ 			      Elf_Shdr *sechdrs,
+@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 	unsigned int i;
+ 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
+ 	Elf32_Sym *sym;
+-	uint32_t *location;
++	uint32_t *plocation, location;
+ 
+ 	DEBUGP("Applying relocate section %u to %u\n", relsec,
+ 	       sechdrs[relsec].sh_info);
+ 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+ 		/* This is where to make the change */
+-		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
+-			+ rel[i].r_offset;
++		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
++		location = (uint32_t)plocation;
++		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
++			plocation = ktla_ktva((void *)plocation);
+ 		/* This is the symbol it is referring to.  Note that all
+ 		   undefined symbols have been resolved.  */
+ 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
+@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 		switch (ELF32_R_TYPE(rel[i].r_info)) {
+ 		case R_386_32:
+ 			/* We add the value into the location given */
+-			*location += sym->st_value;
++			pax_open_kernel();
++			*plocation += sym->st_value;
++			pax_close_kernel();
+ 			break;
+ 		case R_386_PC32:
+ 			/* Add the value, subtract its postition */
+-			*location += sym->st_value - (uint32_t)location;
++			pax_open_kernel();
++			*plocation += sym->st_value - location;
++			pax_close_kernel();
+ 			break;
+ 		default:
+ 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
+@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
+ 		case R_X86_64_NONE:
+ 			break;
+ 		case R_X86_64_64:
++			pax_open_kernel();
+ 			*(u64 *)loc = val;
++			pax_close_kernel();
+ 			break;
+ 		case R_X86_64_32:
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
+ 			if (val != *(u32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_32S:
++			pax_open_kernel();
+ 			*(s32 *)loc = val;
++			pax_close_kernel();
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_PC32:
+ 			val -= (u64)loc;
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
++
+ #if 0
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/paravirt.c linux-2.6.32.13/arch/x86/kernel/paravirt.c
+--- linux-2.6.32.13/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/paravirt.c	2010-05-15 13:21:14.088032889 -0400
+@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
+  * corresponding structure. */
+ static void *get_call_destination(u8 type)
+ {
+-	struct paravirt_patch_template tmpl = {
++	const struct paravirt_patch_template tmpl = {
+ 		.pv_init_ops = pv_init_ops,
+ 		.pv_time_ops = pv_time_ops,
+ 		.pv_cpu_ops = pv_cpu_ops,
+@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
+ 	if (opfunc == NULL)
+ 		/* If there's no function, patch it with a ud2a (BUG) */
+ 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
+-	else if (opfunc == _paravirt_nop)
++	else if (opfunc == (void *)_paravirt_nop)
+ 		/* If the operation is a nop, then nop the callsite */
+ 		ret = paravirt_patch_nop();
+ 
+ 	/* identity functions just return their single argument */
+-	else if (opfunc == _paravirt_ident_32)
++	else if (opfunc == (void *)_paravirt_ident_32)
+ 		ret = paravirt_patch_ident_32(insnbuf, len);
+-	else if (opfunc == _paravirt_ident_64)
++	else if (opfunc == (void *)_paravirt_ident_64)
+ 		ret = paravirt_patch_ident_64(insnbuf, len);
+ 
+ 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
+@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
+ 	if (insn_len > len || start == NULL)
+ 		insn_len = len;
+ 	else
+-		memcpy(insnbuf, start, insn_len);
++		memcpy(insnbuf, ktla_ktva(start), insn_len);
+ 
+ 	return insn_len;
+ }
+@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
+ 	preempt_enable();
+ }
+ 
+-struct pv_info pv_info = {
++struct pv_info pv_info __read_only = {
+ 	.name = "bare hardware",
+ 	.paravirt_enabled = 0,
+ 	.kernel_rpl = 0,
+ 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
+ };
+ 
+-struct pv_init_ops pv_init_ops = {
++struct pv_init_ops pv_init_ops __read_only = {
+ 	.patch = native_patch,
+ };
+ 
+-struct pv_time_ops pv_time_ops = {
++struct pv_time_ops pv_time_ops __read_only = {
+ 	.sched_clock = native_sched_clock,
+ };
+ 
+-struct pv_irq_ops pv_irq_ops = {
++struct pv_irq_ops pv_irq_ops __read_only = {
+ 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
+ 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
+ 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
+@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
+ #endif
+ };
+ 
+-struct pv_cpu_ops pv_cpu_ops = {
++struct pv_cpu_ops pv_cpu_ops __read_only = {
+ 	.cpuid = native_cpuid,
+ 	.get_debugreg = native_get_debugreg,
+ 	.set_debugreg = native_set_debugreg,
+@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
+ 	.end_context_switch = paravirt_nop,
+ };
+ 
+-struct pv_apic_ops pv_apic_ops = {
++struct pv_apic_ops pv_apic_ops __read_only = {
+ #ifdef CONFIG_X86_LOCAL_APIC
+ 	.startup_ipi_hook = paravirt_nop,
+ #endif
+@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
+ #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
+ #endif
+ 
+-struct pv_mmu_ops pv_mmu_ops = {
++struct pv_mmu_ops pv_mmu_ops __read_only = {
+ 
+ 	.read_cr2 = native_read_cr2,
+ 	.write_cr2 = native_write_cr2,
+@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+ 	},
+ 
+ 	.set_fixmap = native_set_fixmap,
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.pax_open_kernel = native_pax_open_kernel,
++	.pax_close_kernel = native_pax_close_kernel,
++#endif
++
+ };
+ 
+ EXPORT_SYMBOL_GPL(pv_time_ops);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c
+--- linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c	2010-05-15 13:21:14.088032889 -0400
+@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
+ 	__raw_spin_lock(lock);
+ }
+ 
+-struct pv_lock_ops pv_lock_ops = {
++struct pv_lock_ops pv_lock_ops __read_only = {
+ #ifdef CONFIG_SMP
+ 	.spin_is_locked = __ticket_spin_is_locked,
+ 	.spin_is_contended = __ticket_spin_is_contended,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c
+--- linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c	2010-05-15 13:21:14.095776197 -0400
+@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
+ 	free_pages((unsigned long)vaddr, get_order(size));
+ }
+ 
+-static struct dma_map_ops calgary_dma_ops = {
++static const struct dma_map_ops calgary_dma_ops = {
+ 	.alloc_coherent = calgary_alloc_coherent,
+ 	.free_coherent = calgary_free_coherent,
+ 	.map_sg = calgary_map_sg,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-dma.c linux-2.6.32.13/arch/x86/kernel/pci-dma.c
+--- linux-2.6.32.13/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/pci-dma.c	2010-05-15 13:21:14.095776197 -0400
+@@ -14,7 +14,7 @@
+ 
+ static int forbid_dac __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int iommu_sac_force __read_mostly;
+@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
+ 
+ int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ #ifdef CONFIG_PCI
+ 	if (mask > 0xffffffff && forbid_dac > 0) {
+diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c
+--- linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c	2010-05-15 13:20:18.438563899 -0400
++++ linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c	2010-05-15 13:21:14.095776197 -0400
+@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
+ 	return -1;
+ }
+ 
+-static struct dma_map_ops gart_dma_ops = {
++static const struct dma_map_ops gart_dma_ops = {
+ 	.map_sg				= gart_map_sg,
+ 	.unmap_sg			= gart_unmap_sg,
+ 	.map_page			= gart_map_page,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-nommu.c linux-2.6.32.13/arch/x86/kernel/pci-nommu.c
+--- linux-2.6.32.13/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/pci-nommu.c	2010-05-15 13:21:14.095776197 -0400
+@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
+ 	flush_write_buffers();
+ }
+ 
+-struct dma_map_ops nommu_dma_ops = {
++const struct dma_map_ops nommu_dma_ops = {
+ 	.alloc_coherent		= dma_generic_alloc_coherent,
+ 	.free_coherent		= nommu_free_coherent,
+ 	.map_sg			= nommu_map_sg,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c
+--- linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c	2010-05-15 13:21:14.095776197 -0400
+@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
+ 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
+ }
+ 
+-static struct dma_map_ops swiotlb_dma_ops = {
++static const struct dma_map_ops swiotlb_dma_ops = {
+ 	.mapping_error = swiotlb_dma_mapping_error,
+ 	.alloc_coherent = x86_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/process_32.c linux-2.6.32.13/arch/x86/kernel/process_32.c
+--- linux-2.6.32.13/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/process_32.c	2010-05-15 13:21:14.095776197 -0400
+@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
+ unsigned long thread_saved_pc(struct task_struct *tsk)
+ {
+ 	return ((unsigned long *)tsk->thread.sp)[3];
++//XXX	return tsk->thread.eip;
+ }
+ 
+ #ifndef CONFIG_SMP
+@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	unsigned short ss, gs;
+ 	const char *board;
+ 
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		sp = regs->sp;
+ 		ss = regs->ss & 0xffff;
+ 		gs = get_user_gs(regs);
+@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
+ 	regs.bx = (unsigned long) fn;
+ 	regs.dx = (unsigned long) arg;
+ 
+-	regs.ds = __USER_DS;
+-	regs.es = __USER_DS;
++	regs.ds = __KERNEL_DS;
++	regs.es = __KERNEL_DS;
+ 	regs.fs = __KERNEL_PERCPU;
+ 	regs.gs = __KERNEL_STACK_CANARY;
+ 	regs.orig_ax = -1;
+@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
+ 	struct task_struct *tsk;
+ 	int err;
+ 
+-	childregs = task_pt_regs(p);
++	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
+ 	*childregs = *regs;
+ 	childregs->ax = 0;
+ 	childregs->sp = sp;
+@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
+ 	 * Set a new TLS for the child thread?
+ 	 */
+ 	if (clone_flags & CLONE_SETTLS)
++//XXX needs set_fs()?
+ 		err = do_set_thread_area(p, -1,
+ 			(struct user_desc __user *)childregs->si, 0);
+ 
+@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread,
+ 				 *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	bool preload_fpu;
+ 
+ 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
+@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
+ 	 */
+ 	lazy_save_gs(prev->gs);
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
++		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
++#endif
++
+ 	/*
+ 	 * Load the per-thread Thread-Local Storage descriptor.
+ 	 */
+@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++asmlinkage void pax_randomize_kstack(void)
++{
++	struct thread_struct *thread = &current->thread;
++	unsigned long time;
++
++	if (!randomize_va_space)
++		return;
++
++	rdtscl(time);
++
++	/* P4 seems to return a 0 LSB, ignore it */
++#ifdef CONFIG_MPENTIUM4
++	time &= 0x1EUL;
++	time <<= 2;
++#else
++	time &= 0xFUL;
++	time <<= 3;
++#endif
++
++	thread->sp0 ^= time;
++	load_sp0(init_tss + smp_processor_id(), thread);
++}
++#endif
+diff -urNp linux-2.6.32.13/arch/x86/kernel/process_64.c linux-2.6.32.13/arch/x86/kernel/process_64.c
+--- linux-2.6.32.13/arch/x86/kernel/process_64.c	2010-05-15 13:20:18.438563899 -0400
++++ linux-2.6.32.13/arch/x86/kernel/process_64.c	2010-05-15 13:21:14.095776197 -0400
+@@ -91,7 +91,7 @@ static void __exit_idle(void)
+ void exit_idle(void)
+ {
+ 	/* idle loop has pid 0 */
+-	if (current->pid)
++	if (task_pid_nr(current))
+ 		return;
+ 	__exit_idle();
+ }
+@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	if (!board)
+ 		board = "";
+ 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version, board);
+@@ -380,7 +380,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread;
+ 	struct thread_struct *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	unsigned fsindex, gsindex;
+ 	bool preload_fpu;
+ 
+@@ -560,12 +560,11 @@ unsigned long get_wchan(struct task_stru
+ 	if (!p || p == current || p->state == TASK_RUNNING)
+ 		return 0;
+ 	stack = (unsigned long)task_stack_page(p);
+-	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
++	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
+ 		return 0;
+ 	fp = *(u64 *)(p->thread.sp);
+ 	do {
+-		if (fp < (unsigned long)stack ||
+-		    fp >= (unsigned long)stack+THREAD_SIZE)
++		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
+ 			return 0;
+ 		ip = *(u64 *)(fp+8);
+ 		if (!in_sched_functions(ip))
+diff -urNp linux-2.6.32.13/arch/x86/kernel/process.c linux-2.6.32.13/arch/x86/kernel/process.c
+--- linux-2.6.32.13/arch/x86/kernel/process.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.13/arch/x86/kernel/process.c	2010-05-15 13:21:14.095776197 -0400
+@@ -73,7 +73,7 @@ void exit_thread(void)
+ 	unsigned long *bp = t->io_bitmap_ptr;
+ 
+ 	if (bp) {
+-		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
++		struct tss_struct *tss = init_tss + get_cpu();
+ 
+ 		t->io_bitmap_ptr = NULL;
+ 		clear_thread_flag(TIF_IO_BITMAP);
+@@ -93,6 +93,9 @@ void flush_thread(void)
+ 
+ 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
+ 
++#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
++	loadsegment(gs, 0);
++#endif
+ 	tsk->thread.debugreg0 = 0;
+ 	tsk->thread.debugreg1 = 0;
+ 	tsk->thread.debugreg2 = 0;
+@@ -600,17 +603,3 @@ static int __init idle_setup(char *str)
+ 	return 0;
+ }
+ early_param("idle", idle_setup);
+-
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() % 8192;
+-	return sp & ~0xf;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long range_end = mm->brk + 0x02000000;
+-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+-}
+-
+diff -urNp linux-2.6.32.13/arch/x86/kernel/ptrace.c linux-2.6.32.13/arch/x86/kernel/ptrace.c
+--- linux-2.6.32.13/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/ptrace.c	2010-05-15 13:21:14.110913724 -0400
+@@ -925,7 +925,7 @@ static const struct user_regset_view use
+ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
+ {
+ 	int ret;
+-	unsigned long __user *datap = (unsigned long __user *)data;
++	unsigned long __user *datap = (__force unsigned long __user *)data;
+ 
+ 	switch (request) {
+ 	/* read the word at location addr in the USER area. */
+@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_get_thread_area(child, addr,
+-					 (struct user_desc __user *) data);
++					 (__force struct user_desc __user *) data);
+ 		break;
+ 
+ 	case PTRACE_SET_THREAD_AREA:
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_set_thread_area(child, addr,
+-					 (struct user_desc __user *) data, 0);
++					 (__force struct user_desc __user *) data, 0);
+ 		break;
+ #endif
+ 
+@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
+ #ifdef CONFIG_X86_PTRACE_BTS
+ 	case PTRACE_BTS_CONFIG:
+ 		ret = ptrace_bts_config
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_STATUS:
+ 		ret = ptrace_bts_status
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_SIZE:
+@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_GET:
+ 		ret = ptrace_bts_read_record
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_CLEAR:
+@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_DRAIN:
+ 		ret = ptrace_bts_drain
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ #endif /* CONFIG_X86_PTRACE_BTS */
+ 
+@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
+ 	info.si_code = si_code;
+ 
+ 	/* User-mode ip? */
+-	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
++	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
+ 
+ 	/* Send us the fake SIGTRAP */
+ 	force_sig_info(SIGTRAP, &info, tsk);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/reboot.c linux-2.6.32.13/arch/x86/kernel/reboot.c
+--- linux-2.6.32.13/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/reboot.c	2010-05-15 13:21:14.110913724 -0400
+@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
+ EXPORT_SYMBOL(pm_power_off);
+ 
+ static const struct desc_ptr no_idt = {};
+-static int reboot_mode;
++static unsigned short reboot_mode;
+ enum reboot_type reboot_type = BOOT_KBD;
+ int reboot_force;
+ 
+@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
+ 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static int __init reboot_init(void)
+@@ -292,12 +292,12 @@ core_initcall(reboot_init);
+    controller to pulse the CPU reset line, which is more thorough, but
+    doesn't work with at least one type of 486 motherboard.  It is easy
+    to stop this code working; hence the copious comments. */
+-static const unsigned long long
+-real_mode_gdt_entries [3] =
++static struct desc_struct
++real_mode_gdt_entries [3] __read_only =
+ {
+-	0x0000000000000000ULL,	/* Null descriptor */
+-	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
+-	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
++	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
++	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
++	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
+ };
+ 
+ static const struct desc_ptr
+@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
+  * specified by the code and length parameters.
+  * We assume that length will aways be less that 100!
+  */
+-void machine_real_restart(const unsigned char *code, int length)
++void machine_real_restart(const unsigned char *code, unsigned int length)
+ {
+ 	local_irq_disable();
+ 
+@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
+ 	/* Remap the kernel at virtual address zero, as well as offset zero
+ 	   from the kernel segment.  This assumes the kernel segment starts at
+ 	   virtual address PAGE_OFFSET. */
+-	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+-		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * Use `swapper_pg_dir' as our page directory.
+@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
+ 	   boot)".  This seems like a fairly standard thing that gets set by
+ 	   REBOOT.COM programs, and the previous reset routine did this
+ 	   too. */
+-	*((unsigned short *)0x472) = reboot_mode;
++	*(unsigned short *)(__va(0x472)) = reboot_mode;
+ 
+ 	/* For the switch to real mode, copy some code to low memory.  It has
+ 	   to be in the first 64k because it is running in 16-bit mode, and it
+ 	   has to have the same physical and virtual address, because it turns
+ 	   off paging.  Copy it near the end of the first page, out of the way
+ 	   of BIOS variables. */
+-	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
+-		real_mode_switch, sizeof (real_mode_switch));
+-	memcpy((void *)(0x1000 - 100), code, length);
++	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
++	memcpy(__va(0x1000 - 100), code, length);
+ 
+ 	/* Set up the IDT for real mode. */
+ 	load_idt(&real_mode_idt);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/setup.c linux-2.6.32.13/arch/x86/kernel/setup.c
+--- linux-2.6.32.13/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/setup.c	2010-05-15 13:21:14.110913724 -0400
+@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	if (!boot_params.hdr.root_flags)
+ 		root_mountflags &= ~MS_RDONLY;
+-	init_mm.start_code = (unsigned long) _text;
+-	init_mm.end_code = (unsigned long) _etext;
++	init_mm.start_code = ktla_ktva((unsigned long) _text);
++	init_mm.end_code = ktla_ktva((unsigned long) _etext);
+ 	init_mm.end_data = (unsigned long) _edata;
+ 	init_mm.brk = _brk_end;
+ 
+-	code_resource.start = virt_to_phys(_text);
+-	code_resource.end = virt_to_phys(_etext)-1;
+-	data_resource.start = virt_to_phys(_etext);
++	code_resource.start = virt_to_phys(ktla_ktva(_text));
++	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
++	data_resource.start = virt_to_phys(_sdata);
+ 	data_resource.end = virt_to_phys(_edata)-1;
+ 	bss_resource.start = virt_to_phys(&__bss_start);
+ 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/setup_percpu.c linux-2.6.32.13/arch/x86/kernel/setup_percpu.c
+--- linux-2.6.32.13/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/setup_percpu.c	2010-05-15 13:21:14.119542394 -0400
+@@ -25,19 +25,17 @@
+ # define DBG(x...)
+ #endif
+ 
++#ifdef CONFIG_SMP
+ DEFINE_PER_CPU(int, cpu_number);
+ EXPORT_PER_CPU_SYMBOL(cpu_number);
++#endif
+ 
+-#ifdef CONFIG_X86_64
+ #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
+-#else
+-#define BOOT_PERCPU_OFFSET 0
+-#endif
+ 
+ DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
+ EXPORT_PER_CPU_SYMBOL(this_cpu_off);
+ 
+-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
++unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
+ 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
+ };
+ EXPORT_SYMBOL(__per_cpu_offset);
+@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
+ {
+ #ifdef CONFIG_X86_32
+ 	struct desc_struct gdt;
++	unsigned long base = per_cpu_offset(cpu);
+ 
+-	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
+-			0x2 | DESCTYPE_S, 0x8);
+-	gdt.s = 1;
++	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
++			0x83 | DESCTYPE_S, 0xC);
+ 	write_gdt_entry(get_cpu_gdt_table(cpu),
+ 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
+ #endif
+@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
+ 	/* alrighty, percpu areas up and running */
+ 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
+ 	for_each_possible_cpu(cpu) {
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		unsigned long canary = per_cpu(stack_canary, cpu);
++#endif
++#endif
+ 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
+ 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
+ 		per_cpu(cpu_number, cpu) = cpu;
+@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
+ 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
+ #endif
+ #endif
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		if (cpu == boot_cpu_id)
++			per_cpu(stack_canary, cpu) = canary;
++#endif
++#endif
+ 		/*
+ 		 * Up to this point, the boot CPU has been using .data.init
+ 		 * area.  Reload any changed state for the boot CPU.
+diff -urNp linux-2.6.32.13/arch/x86/kernel/signal.c linux-2.6.32.13/arch/x86/kernel/signal.c
+--- linux-2.6.32.13/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/signal.c	2010-05-15 13:21:14.119542394 -0400
+@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
+ 	 * Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
+ 	 */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ #else /* !CONFIG_X86_32 */
+ 	sp = round_down(sp, 16) - 8;
+ #endif
+@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
+ 	 * Return an always-bogus address instead so we will die with SIGSEGV.
+ 	 */
+ 	if (onsigstack && !likely(on_sig_stack(sp)))
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	/* save i387 state */
+ 	if (used_math() && save_i387_xstate(*fpstate) < 0)
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	return (void __user *)sp;
+ }
+@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
+ 	}
+ 
+ 	if (current->mm->context.vdso)
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
+ 	else
+-		restorer = &frame->retcode;
++		restorer = (void __user *)&frame->retcode;
+ 	if (ka->sa.sa_flags & SA_RESTORER)
+ 		restorer = ka->sa.sa_restorer;
+ 
+@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
+ 	 * reasons and because gdb uses it as a signature to notice
+ 	 * signal handler stack frames.
+ 	 */
+-	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
++	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
+ 
+ 	if (err)
+ 		return -EFAULT;
+@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
+ 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+ 
+ 		/* Set up to return from userspace.  */
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+ 		if (ka->sa.sa_flags & SA_RESTORER)
+ 			restorer = ka->sa.sa_restorer;
+ 		put_user_ex(restorer, &frame->pretcode);
+@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
+ 		 * reasons and because gdb uses it as a signature to notice
+ 		 * signal handler stack frames.
+ 		 */
+-		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
++		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
+ 	} put_user_catch(err);
+ 
+ 	if (err)
+@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
+ 	 * X86_32: vm86 regs switched out by assembly code before reaching
+ 	 * here, so testing against kernel CS suffices.
+ 	 */
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		return;
+ 
+ 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/smpboot.c linux-2.6.32.13/arch/x86/kernel/smpboot.c
+--- linux-2.6.32.13/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.13/arch/x86/kernel/smpboot.c	2010-05-15 13:21:14.130650342 -0400
+@@ -729,7 +729,11 @@ do_rest:
+ 		(unsigned long)task_stack_page(c_idle.idle) -
+ 		KERNEL_STACK_OFFSET + THREAD_SIZE;
+ #endif
++
++	pax_open_kernel();
+ 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
++	pax_close_kernel();
++
+ 	initial_code = (unsigned long)start_secondary;
+ 	stack_start.sp = (void *) c_idle.idle->thread.sp;
+ 
+@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
+ 
+ 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_X86_32
+ 	/* init low mem mapping */
+ 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+diff -urNp linux-2.6.32.13/arch/x86/kernel/step.c linux-2.6.32.13/arch/x86/kernel/step.c
+--- linux-2.6.32.13/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/step.c	2010-05-15 13:21:14.130650342 -0400
+@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
+ 		struct desc_struct *desc;
+ 		unsigned long base;
+ 
+-		seg &= ~7UL;
++		seg >>= 3;
+ 
+ 		mutex_lock(&child->mm->context.lock);
+-		if (unlikely((seg >> 3) >= child->mm->context.size))
++		if (unlikely(seg >= child->mm->context.size))
+ 			addr = -1L; /* bogus selector, access would fault */
+ 		else {
+ 			desc = child->mm->context.ldt + seg;
+@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
+ 	unsigned char opcode[15];
+ 	unsigned long addr = convert_ip_to_linear(child, regs);
+ 
++	if (addr == -EINVAL)
++		return 0;
++
+ 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
+ 	for (i = 0; i < copied; i++) {
+ 		switch (opcode[i]) {
+@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
+ 
+ #ifdef CONFIG_X86_64
+ 		case 0x40 ... 0x4f:
+-			if (regs->cs != __USER_CS)
++			if ((regs->cs & 0xffff) != __USER_CS)
+ 				/* 32-bit mode: register increment */
+ 				return 0;
+ 			/* 64-bit mode: REX prefix */
+diff -urNp linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S
+--- linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S	2010-05-15 13:21:14.130650342 -0400
+@@ -1,3 +1,4 @@
++.section .rodata,"a",@progbits
+ ENTRY(sys_call_table)
+ 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
+ 	.long sys_exit
+diff -urNp linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c
+--- linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c	2010-05-15 13:21:14.130650342 -0400
+@@ -24,6 +24,21 @@
+ 
+ #include <asm/syscalls.h>
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+@@ -58,6 +73,205 @@ out:
+ 	return err;
+ }
+ 
++unsigned long
++arch_get_unmapped_area(struct file *filp, unsigned long addr,
++		unsigned long len, unsigned long pgoff, unsigned long flags)
++{
++	struct mm_struct *mm = current->mm;
++	struct vm_area_struct *vma;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++		    (!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++	if (len > mm->cached_hole_size) {
++		start_addr = addr = mm->free_area_cache;
++	} else {
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
++	}
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
++		start_addr = 0x00110000UL;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			start_addr += mm->delta_mmap & 0x03FFF000UL;
++#endif
++
++		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
++			start_addr = addr = mm->mmap_base;
++		else
++			addr = start_addr;
++	}
++#endif
++
++full_search:
++	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
++		/* At this point:  (!vma || addr < vma->vm_end). */
++		if (pax_task_size - len < addr) {
++			/*
++			 * Start a new search - just in case we missed
++			 * some holes.
++			 */
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
++				mm->cached_hole_size = 0;
++				goto full_search;
++			}
++			return -ENOMEM;
++		}
++		if (!vma || addr + len <= vma->vm_start) {
++			/*
++			 * Remember the place where we stopped the search:
++			 */
++			mm->free_area_cache = addr + len;
++			return addr;
++		}
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++		addr = vma->vm_end;
++		if (mm->start_brk <= addr && addr < mm->mmap_base) {
++			start_addr = addr = mm->mmap_base;
++			mm->cached_hole_size = 0;
++			goto full_search;
++		}
++	}
++}
++
++unsigned long
++arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
++			  const unsigned long len, const unsigned long pgoff,
++			  const unsigned long flags)
++{
++	struct vm_area_struct *vma;
++	struct mm_struct *mm = current->mm;
++	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	/* requested length too big for entire address space */
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
++		goto bottomup;
++#endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	/* requesting a specific address */
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++				(!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++
++	/* check if free_area_cache is useful for us */
++	if (len <= mm->cached_hole_size) {
++		mm->cached_hole_size = 0;
++		mm->free_area_cache = mm->mmap_base;
++	}
++
++	/* either no address requested or can't fit in requested address hole */
++	addr = mm->free_area_cache;
++
++	/* make sure it can fit in the remaining address space */
++	if (addr > len) {
++		vma = find_vma(mm, addr-len);
++		if (!vma || addr <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr-len);
++	}
++
++	if (mm->mmap_base < len)
++		goto bottomup;
++
++	addr = mm->mmap_base-len;
++
++	do {
++		/*
++		 * Lookup failure means no vma is above this address,
++		 * else if new region fits below vma->vm_start,
++		 * return with success:
++		 */
++		vma = find_vma(mm, addr);
++		if (!vma || addr+len <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr);
++
++		/* remember the largest hole we saw so far */
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++
++		/* try just below the current vma->vm_start */
++		addr = vma->vm_start-len;
++	} while (len < vma->vm_start);
++
++bottomup:
++	/*
++	 * A failed mmap() very likely causes application failure,
++	 * so fall back to the bottom-up function here. This scenario
++	 * can happen with large stack limits and large mmap()
++	 * allocations.
++	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
++	mm->cached_hole_size = ~0UL;
++	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
++	/*
++	 * Restore the topdown base:
++	 */
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
++	mm->cached_hole_size = ~0UL;
++
++	return addr;
++}
+ 
+ struct sel_arg_struct {
+ 	unsigned long n;
+@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
+ 	case SEMTIMEDOP:
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
+-					(const struct timespec __user *)fifth);
++					(__force const struct timespec __user *)fifth);
+ 
+ 	case SEMGET:
+ 		return sys_semget(first, second, third);
+@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
+ 			if (ret)
+ 				return ret;
+-			return put_user(raddr, (ulong __user *) third);
++			return put_user(raddr, (__force ulong __user *) third);
+ 		}
+ 		case 1:	/* iBCS2 emulator entry point */
+ 			if (!segment_eq(get_fs(), get_ds()))
+diff -urNp linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c
+--- linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c	2010-05-15 13:21:14.130650342 -0400
+@@ -32,8 +32,8 @@ out:
+ 	return error;
+ }
+ 
+-static void find_start_end(unsigned long flags, unsigned long *begin,
+-			   unsigned long *end)
++static void find_start_end(struct mm_struct *mm, unsigned long flags,
++			   unsigned long *begin, unsigned long *end)
+ {
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
+ 		unsigned long new_begin;
+@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
+ 				*begin = new_begin;
+ 		}
+ 	} else {
+-		*begin = TASK_UNMAPPED_BASE;
++		*begin = mm->mmap_base;
+ 		*end = TASK_SIZE;
+ 	}
+ }
+@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
+-	find_start_end(flags, &begin, &end);
++	find_start_end(mm, flags, &begin, &end);
+ 
+ 	if (len > end)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
+ 		goto bottomup;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -198,13 +206,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/time.c linux-2.6.32.13/arch/x86/kernel/time.c
+--- linux-2.6.32.13/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/time.c	2010-05-15 13:21:14.130650342 -0400
+@@ -26,17 +26,13 @@
+ int timer_ack;
+ #endif
+ 
+-#ifdef CONFIG_X86_64
+-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
+-#endif
+-
+ unsigned long profile_pc(struct pt_regs *regs)
+ {
+ 	unsigned long pc = instruction_pointer(regs);
+ 
+-	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
++	if (!user_mode(regs) && in_lock_functions(pc)) {
+ #ifdef CONFIG_FRAME_POINTER
+-		return *(unsigned long *)(regs->bp + sizeof(long));
++		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
+ #else
+ 		unsigned long *sp =
+ 			(unsigned long *)kernel_stack_pointer(regs);
+@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
+ 		 * or above a saved flags. Eflags has bits 22-31 zero,
+ 		 * kernel addresses don't.
+ 		 */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		return ktla_ktva(sp[0]);
++#else
+ 		if (sp[0] >> 22)
+ 			return sp[0];
+ 		if (sp[1] >> 22)
+ 			return sp[1];
+ #endif
++
++#endif
+ 	}
+ 	return pc;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/kernel/tls.c linux-2.6.32.13/arch/x86/kernel/tls.c
+--- linux-2.6.32.13/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/tls.c	2010-05-15 13:21:14.130650342 -0400
+@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
+ 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
++		return -EINVAL;
++#endif
++
+ 	set_tls_desc(p, idx, &info, 1);
+ 
+ 	return 0;
+diff -urNp linux-2.6.32.13/arch/x86/kernel/trampoline_32.S linux-2.6.32.13/arch/x86/kernel/trampoline_32.S
+--- linux-2.6.32.13/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/trampoline_32.S	2010-05-15 13:21:14.130650342 -0400
+@@ -32,6 +32,12 @@
+ #include <asm/segment.h>
+ #include <asm/page_types.h>
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /* We can free up trampoline after bootup if cpu hotplug is not supported. */
+ __CPUINITRODATA
+ .code16
+@@ -60,7 +66,7 @@ r_base = .
+ 	inc	%ax		# protected mode (PE) bit
+ 	lmsw	%ax		# into protected mode
+ 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
+-	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
++	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
+ 
+ 	# These need to be in the same 64K segment as the above;
+ 	# hence we don't use the boot_gdt_descr defined in head.S
+diff -urNp linux-2.6.32.13/arch/x86/kernel/traps.c linux-2.6.32.13/arch/x86/kernel/traps.c
+--- linux-2.6.32.13/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/traps.c	2010-05-15 13:21:14.130650342 -0400
+@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
+ 
+ /* Do we ignore FPU interrupts ? */
+ char ignore_fpu_irq;
+-
+-/*
+- * The IDT has to be page-aligned to simplify the Pentium
+- * F0 0F bug workaround.
+- */
+-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
+ #endif
+ 
+ DECLARE_BITMAP(used_vectors, NR_VECTORS);
+@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
+ static inline void
+ die_if_kernel(const char *str, struct pt_regs *regs, long err)
+ {
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		die(str, regs, err);
+ }
+ #endif
+ 
+ static void __kprobes
+-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
++do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
+ 	long error_code, siginfo_t *info)
+ {
+ 	struct task_struct *tsk = current;
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		/*
+ 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
+ 		 * On nmi (interrupt 2), do_trap should not be called.
+@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
+ 	}
+ #endif
+ 
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto kernel_trap;
+ 
+ #ifdef CONFIG_X86_32
+@@ -158,7 +152,7 @@ trap_signal:
+ 	    printk_ratelimit()) {
+ 		printk(KERN_INFO
+ 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
+-		       tsk->comm, tsk->pid, str,
++		       tsk->comm, task_pid_nr(tsk), str,
+ 		       regs->ip, regs->sp, error_code);
+ 		print_vma_addr(" in ", regs->ip);
+ 		printk("\n");
+@@ -175,8 +169,20 @@ kernel_trap:
+ 	if (!fixup_exception(regs)) {
+ 		tsk->thread.error_code = error_code;
+ 		tsk->thread.trap_no = trapnr;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
++			str = "PAX: suspicious stack segment fault";
++#endif
++
+ 		die(str, regs, error_code);
+ 	}
++
++#ifdef CONFIG_PAX_REFCOUNT
++	if (trapnr == 4)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	return;
+ 
+ #ifdef CONFIG_X86_32
+@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
+ 	conditional_sti(regs);
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto gp_in_vm86;
+ #endif
+ 
+ 	tsk = current;
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto gp_in_kernel;
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
++		struct mm_struct *mm = tsk->mm;
++		unsigned long limit;
++
++		down_write(&mm->mmap_sem);
++		limit = mm->context.user_cs_limit;
++		if (limit < TASK_SIZE) {
++			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
++			up_write(&mm->mmap_sem);
++			return;
++		}
++		up_write(&mm->mmap_sem);
++	}
++#endif
++
+ 	tsk->thread.error_code = error_code;
+ 	tsk->thread.trap_no = 13;
+ 
+@@ -305,6 +327,13 @@ gp_in_kernel:
+ 	if (notify_die(DIE_GPF, "general protection fault", regs,
+ 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
+ 		return;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
++		die("PAX: suspicious general protection fault", regs, error_code);
++	else
++#endif
++
+ 	die("general protection fault", regs, error_code);
+ }
+ 
+@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	}
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto debug_vm86;
+ #endif
+ 
+@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	 * kernel space (but re-enable TF when returning to user mode).
+ 	 */
+ 	if (condition & DR_STEP) {
+-		if (!user_mode(regs))
++		if (!user_mode_novm(regs))
+ 			goto clear_TF_reenable;
+ 	}
+ 
+@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
+ 	 * Handle strange cache flush from user space exception
+ 	 * in all other cases.  This is undocumented behaviour.
+ 	 */
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
+ 		return;
+ 	}
+diff -urNp linux-2.6.32.13/arch/x86/kernel/tsc.c linux-2.6.32.13/arch/x86/kernel/tsc.c
+--- linux-2.6.32.13/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/tsc.c	2010-05-15 13:21:14.134912019 -0400
+@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
+ 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static void __init check_system_tsc_reliable(void)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/vm86_32.c linux-2.6.32.13/arch/x86/kernel/vm86_32.c
+--- linux-2.6.32.13/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/vm86_32.c	2010-05-15 13:21:14.142909281 -0400
+@@ -41,6 +41,7 @@
+ #include <linux/ptrace.h>
+ #include <linux/audit.h>
+ #include <linux/stddef.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
+ 		do_exit(SIGSEGV);
+ 	}
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	current->thread.sp0 = current->thread.saved_sp0;
+ 	current->thread.sysenter_cs = __KERNEL_CS;
+ 	load_sp0(tss, &current->thread);
+@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
+ 	struct task_struct *tsk;
+ 	int tmp, ret = -EPERM;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	if (tsk->thread.saved_sp0)
+ 		goto out;
+@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
+ 	int tmp, ret;
+ 	struct vm86plus_struct __user *v86;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		ret = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	switch (regs->bx) {
+ 	case VM86_REQUEST_IRQ:
+@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
+ 	tsk->thread.saved_fs = info->regs32->fs;
+ 	tsk->thread.saved_gs = get_user_gs(info->regs32);
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
+ 	if (cpu_has_sep)
+ 		tsk->thread.sysenter_cs = 0;
+@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
+ 		goto cannot_handle;
+ 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
+ 		goto cannot_handle;
+-	intr_ptr = (unsigned long __user *) (i << 2);
++	intr_ptr = (__force unsigned long __user *) (i << 2);
+ 	if (get_user(segoffs, intr_ptr))
+ 		goto cannot_handle;
+ 	if ((segoffs >> 16) == BIOSSEG)
+diff -urNp linux-2.6.32.13/arch/x86/kernel/vmi_32.c linux-2.6.32.13/arch/x86/kernel/vmi_32.c
+--- linux-2.6.32.13/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/vmi_32.c	2010-05-15 13:21:14.150906044 -0400
+@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
+ typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
+ 
+ #define call_vrom_func(rom,func) \
+-   (((VROMFUNC *)(rom->func))())
++   (((VROMFUNC *)(ktva_ktla(rom.func)))())
+ 
+ #define call_vrom_long_func(rom,func,arg) \
+-   (((VROMLONGFUNC *)(rom->func)) (arg))
++({\
++	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
++	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
++	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
++	__reloc;\
++})
+ 
+-static struct vrom_header *vmi_rom;
++static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
+ static int disable_pge;
+ static int disable_pse;
+ static int disable_sep;
+@@ -76,10 +81,10 @@ static struct {
+ 	void (*set_initial_ap_state)(int, int);
+ 	void (*halt)(void);
+   	void (*set_lazy_mode)(int mode);
+-} vmi_ops;
++} vmi_ops __read_only;
+ 
+ /* Cached VMI operations */
+-struct vmi_timer_ops vmi_timer_ops;
++struct vmi_timer_ops vmi_timer_ops __read_only;
+ 
+ /*
+  * VMI patching routines.
+@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
+ static inline void patch_offset(void *insnbuf,
+ 				unsigned long ip, unsigned long dest)
+ {
+-        *(unsigned long *)(insnbuf+1) = dest-ip-5;
++	*(unsigned long *)(insnbuf+1) = dest-ip-5;
+ }
+ 
+ static unsigned patch_internal(int call, unsigned len, void *insnbuf,
+@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
+ {
+ 	u64 reloc;
+ 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
++
+ 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
+ 	switch(rel->type) {
+ 		case VMI_RELOCATION_CALL_REL:
+@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
+ 
+ static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
+ }
+ 
+ static void vmi_pmd_clear(pmd_t *pmd)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
+ }
+ #endif
+@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
+ 	ap.ss = __KERNEL_DS;
+ 	ap.esp = (unsigned long) start_esp;
+ 
+-	ap.ds = __USER_DS;
+-	ap.es = __USER_DS;
++	ap.ds = __KERNEL_DS;
++	ap.es = __KERNEL_DS;
+ 	ap.fs = __KERNEL_PERCPU;
+ 	ap.gs = __KERNEL_STACK_CANARY;
+ 
+@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
+ 	paravirt_leave_lazy_mmu();
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static unsigned long vmi_pax_open_kernel(void)
++{
++	return 0;
++}
++
++static unsigned long vmi_pax_close_kernel(void)
++{
++	return 0;
++}
++#endif
++
+ static inline int __init check_vmi_rom(struct vrom_header *rom)
+ {
+ 	struct pci_header *pci;
+@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
+ 		return 0;
+ 	if (rom->vrom_signature != VMI_SIGNATURE)
+ 		return 0;
++	if (rom->rom_length * 512 > sizeof(*rom)) {
++		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
++		return 0;
++	}
+ 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
+ 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
+ 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
+@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
+ 		struct vrom_header *romstart;
+ 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
+ 		if (check_vmi_rom(romstart)) {
+-			vmi_rom = romstart;
++			vmi_rom = *romstart;
+ 			return 1;
+ 		}
+ 	}
+@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
+ 
+ 	para_fill(pv_irq_ops.safe_halt, Halt);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
++	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
++#endif
++
+ 	/*
+ 	 * Alternative instruction rewriting doesn't happen soon enough
+ 	 * to convert VMI_IRET to a call instead of a jump; so we have
+@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
+ 
+ void __init vmi_init(void)
+ {
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		probe_vmi_rom();
+ 	else
+-		check_vmi_rom(vmi_rom);
++		check_vmi_rom(&vmi_rom);
+ 
+ 	/* In case probing for or validating the ROM failed, basil */
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+-	reserve_top_address(-vmi_rom->virtual_top);
++	reserve_top_address(-vmi_rom.virtual_top);
+ 
+ #ifdef CONFIG_X86_IO_APIC
+ 	/* This is virtual hardware; timer routing is wired correctly */
+@@ -874,7 +901,7 @@ void __init vmi_activate(void)
+ {
+ 	unsigned long flags;
+ 
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S
+--- linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S	2010-05-15 13:21:14.162641857 -0400
+@@ -26,6 +26,22 @@
+ #include <asm/page_types.h>
+ #include <asm/cache.h>
+ #include <asm/boot.h>
++#include <asm/segment.h>
++
++#undef PMD_SIZE
++#undef PMD_SHIFT
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
++#define PMD_SHIFT 21
++#else
++#define PMD_SHIFT 22
++#endif
++#define PMD_SIZE (1 << PMD_SHIFT)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
++#else
++#define __KERNEL_TEXT_OFFSET	0
++#endif
+ 
+ #undef i386     /* in case the preprocessor is a 32bit one */
+ 
+@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
+ #ifdef CONFIG_X86_32
+ OUTPUT_ARCH(i386)
+ ENTRY(phys_startup_32)
+-jiffies = jiffies_64;
+ #else
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(phys_startup_64)
+-jiffies_64 = jiffies;
+ #endif
+ 
++jiffies = jiffies_64;
++
+ PHDRS {
+ 	text PT_LOAD FLAGS(5);          /* R_E */
+-	data PT_LOAD FLAGS(7);          /* RWE */
++#ifdef CONFIG_XEN
++	rodata PT_LOAD FLAGS(5);        /* R_E */
++#else
++	rodata PT_LOAD FLAGS(4);        /* R__ */
++#endif
++#ifdef CONFIG_X86_32
++	module PT_LOAD FLAGS(5);        /* R_E */
++#endif
++	data PT_LOAD FLAGS(6);          /* RW_ */
+ #ifdef CONFIG_X86_64
+ 	user PT_LOAD FLAGS(5);          /* R_E */
++#endif
++	init.begin PT_LOAD FLAGS(6);    /* RW_ */
+ #ifdef CONFIG_SMP
+ 	percpu PT_LOAD FLAGS(6);        /* RW_ */
+ #endif
++	text.init PT_LOAD FLAGS(5);     /* R_E */
++	text.exit PT_LOAD FLAGS(5);     /* R_E */
+ 	init PT_LOAD FLAGS(7);          /* RWE */
+-#endif
+ 	note PT_NOTE FLAGS(0);          /* ___ */
+ }
+ 
+ SECTIONS
+ {
+ #ifdef CONFIG_X86_32
+-        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
+-        phys_startup_32 = startup_32 - LOAD_OFFSET;
++	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
+ #else
+-        . = __START_KERNEL;
+-        phys_startup_64 = startup_64 - LOAD_OFFSET;
++	. = __START_KERNEL;
+ #endif
+ 
+ 	/* Text and read-only data */
+-	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
+-		_text = .;
++	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
+ 		/* bootstrapping code */
++#ifdef CONFIG_X86_32
++		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#else
++		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#endif
++		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++		_text = .;
+ 		HEAD_TEXT
+ #ifdef CONFIG_X86_32
+ 		. = ALIGN(PAGE_SIZE);
+@@ -82,28 +113,64 @@ SECTIONS
+ 		IRQENTRY_TEXT
+ 		*(.fixup)
+ 		*(.gnu.warning)
+-		/* End of text section */
+-		_etext = .;
+ 	} :text = 0x9090
+ 
+-	NOTES :text :note
++	. += __KERNEL_TEXT_OFFSET;
++
++	. = ALIGN(PAGE_SIZE);
++	NOTES :rodata :note
+ 
+-	EXCEPTION_TABLE(16) :text = 0x9090
++	EXCEPTION_TABLE(16) :rodata
+ 
+ 	RO_DATA(PAGE_SIZE)
+ 
++#ifdef CONFIG_X86_32
++	. = ALIGN(PAGE_SIZE);
++	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
++		*(.idt)
++		. = ALIGN(PAGE_SIZE);
++		*(.empty_zero_page)
++		*(.swapper_pg_pmd)
++		*(.swapper_pg_dir)
++	}
++
++	. = ALIGN(PAGE_SIZE);
++	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
++		*(.vmi.rom)
++	} :module
++
++	. = ALIGN(PAGE_SIZE);
++	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
++		MODULES_EXEC_VADDR = .;
++		BYTE(0)
++		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
++		. = ALIGN(PMD_SIZE);
++		MODULES_EXEC_END = . - 1;
++#endif
++
++	} :module
++#endif
++
+ 	/* Data */
+ 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
++		/* End of text section */
++		_etext = . - __KERNEL_TEXT_OFFSET;
++
++#ifdef CONFIG_PAX_KERNEXEC
++	. = ALIGN(PMD_SIZE);
++#else
++	. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		/* Start of data section */
+ 		_sdata = .;
+ 
+ 		/* init_task */
+ 		INIT_TASK_DATA(THREAD_SIZE)
+ 
+-#ifdef CONFIG_X86_32
+-		/* 32 bit has nosave before _edata */
+ 		NOSAVE_DATA
+-#endif
+ 
+ 		PAGE_ALIGNED_DATA(PAGE_SIZE)
+ 
+@@ -166,12 +233,6 @@ SECTIONS
+ 	}
+ 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
+ 
+-	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
+-	.jiffies : AT(VLOAD(.jiffies)) {
+-		*(.jiffies)
+-	}
+-	jiffies = VVIRT(.jiffies);
+-
+ 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
+ 		*(.vsyscall_3)
+ 	}
+@@ -187,12 +248,19 @@ SECTIONS
+ #endif /* CONFIG_X86_64 */
+ 
+ 	/* Init code and data - will be freed after init */
+-	. = ALIGN(PAGE_SIZE);
+ 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
++		BYTE(0)
++
++#ifdef CONFIG_PAX_KERNEXEC
++		. = ALIGN(PMD_SIZE);
++#else
++		. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		__init_begin = .; /* paired with __init_end */
+-	}
++	} :init.begin
+ 
+-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
++#ifdef CONFIG_SMP
+ 	/*
+ 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
+ 	 * output PHDR, so the next output section - .init.text - should
+@@ -201,12 +269,27 @@ SECTIONS
+ 	PERCPU_VADDR(0, :percpu)
+ #endif
+ 
+-	INIT_TEXT_SECTION(PAGE_SIZE)
+-#ifdef CONFIG_X86_64
+-	:init
+-#endif
++	. = ALIGN(PAGE_SIZE);
++	init_begin = .;
++	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
++		VMLINUX_SYMBOL(_sinittext) = .;
++		INIT_TEXT
++		VMLINUX_SYMBOL(_einittext) = .;
++		. = ALIGN(PAGE_SIZE);
++	} :text.init
++
++	/*
++	 * .exit.text is discard at runtime, not link time, to deal with
++	 *  references from .altinstructions and .eh_frame
++	 */
++	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
++		EXIT_TEXT
++		. = ALIGN(16);
++	} :text.exit
++	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
+ 
+-	INIT_DATA_SECTION(16)
++	. = ALIGN(PAGE_SIZE);
++	INIT_DATA_SECTION(16) :init
+ 
+ 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
+ 		__x86_cpu_dev_start = .;
+@@ -232,19 +315,11 @@ SECTIONS
+ 		*(.altinstr_replacement)
+ 	}
+ 
+-	/*
+-	 * .exit.text is discard at runtime, not link time, to deal with
+-	 *  references from .altinstructions and .eh_frame
+-	 */
+-	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
+-		EXIT_TEXT
+-	}
+-
+ 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
+ 		EXIT_DATA
+ 	}
+ 
+-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
++#ifndef CONFIG_SMP
+ 	PERCPU(PAGE_SIZE)
+ #endif
+ 
+@@ -267,12 +342,6 @@ SECTIONS
+ 		. = ALIGN(PAGE_SIZE);
+ 	}
+ 
+-#ifdef CONFIG_X86_64
+-	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
+-		NOSAVE_DATA
+-	}
+-#endif
+-
+ 	/* BSS */
+ 	. = ALIGN(PAGE_SIZE);
+ 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+@@ -288,6 +357,7 @@ SECTIONS
+ 		__brk_base = .;
+ 		. += 64 * 1024;		/* 64k alignment slop space */
+ 		*(.brk_reservation)	/* areas brk users have reserved */
++		. = ALIGN(PMD_SIZE);
+ 		__brk_limit = .;
+ 	}
+ 
+@@ -316,13 +386,12 @@ SECTIONS
+  * for the boot processor.
+  */
+ #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
+-INIT_PER_CPU(gdt_page);
+ INIT_PER_CPU(irq_stack_union);
+ 
+ /*
+  * Build-time check on the image size:
+  */
+-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
++. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
+ 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c
+--- linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c	2010-05-15 13:21:14.162641857 -0400
+@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
+ 
+ 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
+ 	/* copy vsyscall data */
++	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
+ 	vsyscall_gtod_data.clock.vread = clock->vread;
+ 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
+ 	vsyscall_gtod_data.clock.mask = clock->mask;
+@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
+ 	   We do this here because otherwise user space would do it on
+ 	   its own in a likely inferior way (no access to jiffies).
+ 	   If you don't like it pass NULL. */
+-	if (tcache && tcache->blob[0] == (j = __jiffies)) {
++	if (tcache && tcache->blob[0] == (j = jiffies)) {
+ 		p = tcache->blob[1];
+ 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
+ 		/* Load per CPU data from RDTSCP */
+@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
+ 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
+ 	  .mode = 0644,
+ 	  .proc_handler = proc_dointvec },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table kernel_root_table2[] = {
+ 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
+ 	  .child = kernel_table2 },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c
+--- linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c	2010-05-15 13:21:14.162641857 -0400
+@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
+ 
+ EXPORT_SYMBOL(copy_user_generic);
+ EXPORT_SYMBOL(__copy_user_nocache);
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(__copy_from_user_inatomic);
+ 
+ EXPORT_SYMBOL(copy_page);
+diff -urNp linux-2.6.32.13/arch/x86/kernel/xsave.c linux-2.6.32.13/arch/x86/kernel/xsave.c
+--- linux-2.6.32.13/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kernel/xsave.c	2010-05-15 13:21:14.162641857 -0400
+@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
+ 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
+ 		return -1;
+ 
+-	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
++	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
+ 					    fx_sw_user->extended_size -
+ 					    FP_XSTATE_MAGIC2_SIZE));
+ 	/*
+@@ -196,7 +196,7 @@ fx_only:
+ 	 * the other extended state.
+ 	 */
+ 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
+-	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
++	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
+ }
+ 
+ /*
+@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
+ 	if (task_thread_info(tsk)->status & TS_XSAVE)
+ 		err = restore_user_xstate(buf);
+ 	else
+-		err = fxrstor_checking((__force struct i387_fxsave_struct *)
++		err = fxrstor_checking((struct i387_fxsave_struct __user *)
+ 				       buf);
+ 	if (unlikely(err)) {
+ 		/*
+diff -urNp linux-2.6.32.13/arch/x86/kvm/emulate.c linux-2.6.32.13/arch/x86/kvm/emulate.c
+--- linux-2.6.32.13/arch/x86/kvm/emulate.c	2010-04-29 17:49:37.541027029 -0400
++++ linux-2.6.32.13/arch/x86/kvm/emulate.c	2010-05-15 13:21:14.178920275 -0400
+@@ -81,8 +81,8 @@
+ #define Src2CL      (1<<29)
+ #define Src2ImmByte (2<<29)
+ #define Src2One     (3<<29)
+-#define Src2Imm16   (4<<29)
+-#define Src2Mask    (7<<29)
++#define Src2Imm16   (4U<<29)
++#define Src2Mask    (7U<<29)
+ 
+ enum {
+ 	Group1_80, Group1_81, Group1_82, Group1_83,
+@@ -411,6 +411,7 @@ static u32 group2_table[] = {
+ 
+ #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
+ 	do {								\
++		unsigned long _tmp;					\
+ 		__asm__ __volatile__ (					\
+ 			_PRE_EFLAGS("0", "4", "2")			\
+ 			_op _suffix " %"_x"3,%1; "			\
+@@ -424,8 +425,6 @@ static u32 group2_table[] = {
+ /* Raw emulation: instruction has two explicit operands. */
+ #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								\
+-		unsigned long _tmp;					\
+-									\
+ 		switch ((_dst).bytes) {					\
+ 		case 2:							\
+ 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
+@@ -441,7 +440,6 @@ static u32 group2_table[] = {
+ 
+ #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								     \
+-		unsigned long _tmp;					     \
+ 		switch ((_dst).bytes) {				             \
+ 		case 1:							     \
+ 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
+diff -urNp linux-2.6.32.13/arch/x86/kvm/lapic.c linux-2.6.32.13/arch/x86/kvm/lapic.c
+--- linux-2.6.32.13/arch/x86/kvm/lapic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/kvm/lapic.c	2010-05-15 13:21:14.186649754 -0400
+@@ -52,7 +52,7 @@
+ #define APIC_BUS_CYCLE_NS 1
+ 
+ /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+-#define apic_debug(fmt, arg...)
++#define apic_debug(fmt, arg...) do {} while (0)
+ 
+ #define APIC_LVT_NUM			6
+ /* 14 is the version for Xeon and Pentium 8.4.8*/
+diff -urNp linux-2.6.32.13/arch/x86/kvm/svm.c linux-2.6.32.13/arch/x86/kvm/svm.c
+--- linux-2.6.32.13/arch/x86/kvm/svm.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.13/arch/x86/kvm/svm.c	2010-05-15 13:21:14.206681110 -0400
+@@ -2395,9 +2395,12 @@ static int handle_exit(struct kvm_run *k
+ static void reload_tss(struct kvm_vcpu *vcpu)
+ {
+ 	int cpu = raw_smp_processor_id();
+-
+ 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
++
++	pax_open_kernel();
+ 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -2845,7 +2848,7 @@ static bool svm_gb_page_enable(void)
+ 	return true;
+ }
+ 
+-static struct kvm_x86_ops svm_x86_ops = {
++static const struct kvm_x86_ops svm_x86_ops = {
+ 	.cpu_has_kvm_support = has_svm,
+ 	.disabled_by_bios = is_disabled,
+ 	.hardware_setup = svm_hardware_setup,
+diff -urNp linux-2.6.32.13/arch/x86/kvm/vmx.c linux-2.6.32.13/arch/x86/kvm/vmx.c
+--- linux-2.6.32.13/arch/x86/kvm/vmx.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.13/arch/x86/kvm/vmx.c	2010-05-15 13:23:38.934774262 -0400
+@@ -568,7 +568,11 @@ static void reload_tss(void)
+ 
+ 	kvm_get_gdt(&gdt);
+ 	descs = (void *)gdt.base;
++
++	pax_open_kernel();
+ 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -1395,8 +1399,11 @@ static __init int hardware_setup(void)
+ 	if (!cpu_has_vmx_flexpriority())
+ 		flexpriority_enabled = 0;
+ 
+-	if (!cpu_has_vmx_tpr_shadow())
+-		kvm_x86_ops->update_cr8_intercept = NULL;
++	if (!cpu_has_vmx_tpr_shadow()) {
++		pax_open_kernel();
++		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
++		pax_close_kernel();
++	}
+ 
+ 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
+ 		kvm_disable_largepages();
+@@ -2347,7 +2354,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
+ 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
+ 
+ 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
+-	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
++	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
+ 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+ 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
+ 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
+@@ -3703,6 +3710,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		"jmp .Lkvm_vmx_return \n\t"
+ 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
+ 		".Lkvm_vmx_return: "
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
++		".Lkvm_vmx_return2: "
++#endif
++
+ 		/* Save guest registers, load host registers, keep flags */
+ 		"xchg %0,     (%%"R"sp) \n\t"
+ 		"mov %%"R"ax, %c[rax](%0) \n\t"
+@@ -3749,8 +3762,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
+ #endif
+ 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		,[cs]"i"(__KERNEL_CS)
++#endif
++
+ 	      : "cc", "memory"
+-		, R"bx", R"di", R"si"
++		, R"ax", R"bx", R"di", R"si"
+ #ifdef CONFIG_X86_64
+ 		, "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
+ #endif
+@@ -3767,7 +3785,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 	if (vmx->rmode.irq.pending)
+ 		fixup_rmode_irq(vmx);
+ 
+-	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
++	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
+ 	vmx->launched = 1;
+ 
+ 	vmx_complete_interrupts(vmx);
+@@ -3942,7 +3960,7 @@ static bool vmx_gb_page_enable(void)
+ 	return false;
+ }
+ 
+-static struct kvm_x86_ops vmx_x86_ops = {
++static const struct kvm_x86_ops vmx_x86_ops = {
+ 	.cpu_has_kvm_support = cpu_has_kvm_support,
+ 	.disabled_by_bios = vmx_disabled_by_bios,
+ 	.hardware_setup = hardware_setup,
+diff -urNp linux-2.6.32.13/arch/x86/kvm/x86.c linux-2.6.32.13/arch/x86/kvm/x86.c
+--- linux-2.6.32.13/arch/x86/kvm/x86.c	2010-05-15 13:20:18.454567530 -0400
++++ linux-2.6.32.13/arch/x86/kvm/x86.c	2010-05-15 13:21:14.230911822 -0400
+@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
+ static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
+ 				    struct kvm_cpuid_entry2 __user *entries);
+ 
+-struct kvm_x86_ops *kvm_x86_ops;
++const struct kvm_x86_ops *kvm_x86_ops;
+ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ 
+ int ignore_msrs = 0;
+ module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
+ struct kvm_stats_debugfs_item debugfs_entries[] = {
+-	{ "pf_fixed", VCPU_STAT(pf_fixed) },
+-	{ "pf_guest", VCPU_STAT(pf_guest) },
+-	{ "tlb_flush", VCPU_STAT(tlb_flush) },
+-	{ "invlpg", VCPU_STAT(invlpg) },
+-	{ "exits", VCPU_STAT(exits) },
+-	{ "io_exits", VCPU_STAT(io_exits) },
+-	{ "mmio_exits", VCPU_STAT(mmio_exits) },
+-	{ "signal_exits", VCPU_STAT(signal_exits) },
+-	{ "irq_window", VCPU_STAT(irq_window_exits) },
+-	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
+-	{ "halt_exits", VCPU_STAT(halt_exits) },
+-	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
+-	{ "hypercalls", VCPU_STAT(hypercalls) },
+-	{ "request_irq", VCPU_STAT(request_irq_exits) },
+-	{ "irq_exits", VCPU_STAT(irq_exits) },
+-	{ "host_state_reload", VCPU_STAT(host_state_reload) },
+-	{ "efer_reload", VCPU_STAT(efer_reload) },
+-	{ "fpu_reload", VCPU_STAT(fpu_reload) },
+-	{ "insn_emulation", VCPU_STAT(insn_emulation) },
+-	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
+-	{ "irq_injections", VCPU_STAT(irq_injections) },
+-	{ "nmi_injections", VCPU_STAT(nmi_injections) },
+-	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
+-	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
+-	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
+-	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
+-	{ "mmu_flooded", VM_STAT(mmu_flooded) },
+-	{ "mmu_recycled", VM_STAT(mmu_recycled) },
+-	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
+-	{ "mmu_unsync", VM_STAT(mmu_unsync) },
+-	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
+-	{ "largepages", VM_STAT(lpages) },
++	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
++	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
++	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
++	{ "invlpg", VCPU_STAT(invlpg), NULL },
++	{ "exits", VCPU_STAT(exits), NULL },
++	{ "io_exits", VCPU_STAT(io_exits), NULL },
++	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
++	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
++	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
++	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
++	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
++	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
++	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
++	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
++	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
++	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
++	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
++	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
++	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
++	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
++	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
++	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
++	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
++	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
++	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
++	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
++	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
++	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
++	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
++	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
++	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
++	{ "largepages", VM_STAT(lpages), NULL },
+ 	{ NULL }
+ };
+ 
+@@ -1635,7 +1635,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
+ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
+ 				    struct kvm_interrupt *irq)
+ {
+-	if (irq->irq < 0 || irq->irq >= 256)
++	if (irq->irq >= 256)
+ 		return -EINVAL;
+ 	if (irqchip_in_kernel(vcpu->kvm))
+ 		return -ENXIO;
+@@ -3205,10 +3205,10 @@ static struct notifier_block kvmclock_cp
+         .notifier_call  = kvmclock_cpufreq_notifier
+ };
+ 
+-int kvm_arch_init(void *opaque)
++int kvm_arch_init(const void *opaque)
+ {
+ 	int r, cpu;
+-	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
++	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
+ 
+ 	if (kvm_x86_ops) {
+ 		printk(KERN_ERR "kvm: already loaded the other module\n");
+diff -urNp linux-2.6.32.13/arch/x86/lib/checksum_32.S linux-2.6.32.13/arch/x86/lib/checksum_32.S
+--- linux-2.6.32.13/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/checksum_32.S	2010-05-15 13:21:14.230911822 -0400
+@@ -28,7 +28,8 @@
+ #include <linux/linkage.h>
+ #include <asm/dwarf2.h>
+ #include <asm/errno.h>
+-				
++#include <asm/segment.h>
++
+ /*
+  * computes a partial checksum, e.g. for TCP/UDP fragments
+  */
+@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
+ 
+ #define ARGBASE 16		
+ #define FP		12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	subl  $4,%esp	
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	pushl %edi
+@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
+ 	jmp 4f
+ SRC(1:	movw (%esi), %bx	)
+ 	addl $2, %esi
+-DST(	movw %bx, (%edi)	)
++DST(	movw %bx, %es:(%edi)	)
+ 	addl $2, %edi
+ 	addw %bx, %ax	
+ 	adcl $0, %eax
+@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
+ SRC(1:	movl (%esi), %ebx	)
+ SRC(	movl 4(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 4(%edi)	)
++DST(	movl %edx, %es:4(%edi)	)
+ 
+ SRC(	movl 8(%esi), %ebx	)
+ SRC(	movl 12(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 8(%edi)	)
++DST(	movl %ebx, %es:8(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 12(%edi)	)
++DST(	movl %edx, %es:12(%edi)	)
+ 
+ SRC(	movl 16(%esi), %ebx 	)
+ SRC(	movl 20(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 16(%edi)	)
++DST(	movl %ebx, %es:16(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 20(%edi)	)
++DST(	movl %edx, %es:20(%edi)	)
+ 
+ SRC(	movl 24(%esi), %ebx	)
+ SRC(	movl 28(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 24(%edi)	)
++DST(	movl %ebx, %es:24(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 28(%edi)	)
++DST(	movl %edx, %es:28(%edi)	)
+ 
+ 	lea 32(%esi), %esi
+ 	lea 32(%edi), %edi
+@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
+ 	shrl $2, %edx			# This clears CF
+ SRC(3:	movl (%esi), %ebx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	lea 4(%esi), %esi
+ 	lea 4(%edi), %edi
+ 	dec %edx
+@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
+ 	jb 5f
+ SRC(	movw (%esi), %cx	)
+ 	leal 2(%esi), %esi
+-DST(	movw %cx, (%edi)	)
++DST(	movw %cx, %es:(%edi)	)
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%ecx
+ SRC(5:	movb (%esi), %cl	)
+-DST(	movb %cl, (%edi)	)
++DST(	movb %cl, %es:(%edi)	)
+ 6:	addl %ecx, %eax
+ 	adcl $0, %eax
+ 7:
+@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6001:
+ 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 
+ 	# zero the complete destination - computing the rest
+ 	# is too much work 
+@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6002:
+ 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT,(%ebx)
++	movl $-EFAULT,%ss:(%ebx)
+ 	jmp 5000b
+ 
+ .previous
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE ebx
+@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	ret	
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 
+ #else
+ 
+ /* Version for PentiumII/PPro */
+ 
+ #define ROUND1(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	addl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	; 
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ROUND(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	adcl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	;
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ARGBASE 12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
+ 	subl %ebx, %edi  
+ 	lea  -1(%esi),%edx
+ 	andl $-32,%edx
+-	lea 3f(%ebx,%ebx), %ebx
++	lea 3f(%ebx,%ebx,2), %ebx
+ 	testl %esi, %esi 
+ 	jmp *%ebx
+ 1:	addl $64,%esi
+@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
+ 	jb 5f
+ SRC(	movw (%esi), %dx         )
+ 	leal 2(%esi), %esi
+-DST(	movw %dx, (%edi)         )
++DST(	movw %dx, %es:(%edi)     )
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%edx
+ 5:
+ SRC(	movb (%esi), %dl         )
+-DST(	movb %dl, (%edi)         )
++DST(	movb %dl, %es:(%edi)     )
+ 6:	addl %edx, %eax
+ 	adcl $0, %eax
+ 7:
+ .section .fixup, "ax"
+ 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	# zero the complete destination (computing the rest is too much work)
+ 	movl ARGBASE+8(%esp),%edi	# dst
+ 	movl ARGBASE+12(%esp),%ecx	# len
+@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
+ 	rep; stosb
+ 	jmp 7b
+ 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	jmp  7b			
+ .previous				
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %esi
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE esi
+@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
+ 	CFI_RESTORE ebx
+ 	ret
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 				
+ #undef ROUND
+ #undef ROUND1		
+diff -urNp linux-2.6.32.13/arch/x86/lib/clear_page_64.S linux-2.6.32.13/arch/x86/lib/clear_page_64.S
+--- linux-2.6.32.13/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/clear_page_64.S	2010-05-15 13:21:14.230911822 -0400
+@@ -43,7 +43,7 @@ ENDPROC(clear_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.13/arch/x86/lib/copy_page_64.S linux-2.6.32.13/arch/x86/lib/copy_page_64.S
+--- linux-2.6.32.13/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/copy_page_64.S	2010-05-15 13:21:14.230911822 -0400
+@@ -104,7 +104,7 @@ ENDPROC(copy_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.13/arch/x86/lib/copy_user_64.S linux-2.6.32.13/arch/x86/lib/copy_user_64.S
+--- linux-2.6.32.13/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/copy_user_64.S	2010-05-15 13:21:14.234766826 -0400
+@@ -15,13 +15,14 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/cpufeature.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALTERNATIVE_JUMP feature,orig,alt
+ 0:
+ 	.byte 0xe9	/* 32bit jump */
+ 	.long \orig-1f	/* by default jump to orig */
+ 1:
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 2:	.byte 0xe9			/* near jump with 32bit immediate */
+ 	.long \alt-1b /* offset */   /* or alternatively to alt */
+ 	.previous
+@@ -64,32 +65,6 @@
+ #endif
+ 	.endm
+ 
+-/* Standard copy_to_user with segment limit checking */
+-ENTRY(copy_to_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rdi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_to_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_to_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_to_user)
+-
+-/* Standard copy_from_user with segment limit checking */
+-ENTRY(copy_from_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rsi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_from_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_from_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_from_user)
+-
+ ENTRY(copy_user_generic)
+ 	CFI_STARTPROC
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
+ 
+ ENTRY(__copy_from_user_inatomic)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+ 	CFI_ENDPROC
+ ENDPROC(__copy_from_user_inatomic)
+@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
+ ENTRY(bad_from_user)
+ bad_from_user:
+ 	CFI_STARTPROC
++	testl %edx,%edx
++	js bad_to_user
+ 	movl %edx,%ecx
+ 	xorl %eax,%eax
+ 	rep
+diff -urNp linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S
+--- linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S	2010-05-15 13:21:14.234766826 -0400
+@@ -14,6 +14,7 @@
+ #include <asm/current.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALIGN_DESTINATION
+ #ifdef FIX_ALIGNMENT
+@@ -50,6 +51,15 @@
+  */
+ ENTRY(__copy_user_nocache)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	cmpl $8,%edx
+ 	jb 20f		/* less then 8 bytes, go to byte copy loop */
+ 	ALIGN_DESTINATION
+diff -urNp linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c
+--- linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c	2010-05-15 13:21:14.234766826 -0400
+@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
+ 			len -= 2;
+ 		}
+ 	}
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	isum = csum_partial_copy_generic((__force const void *)src,
+ 				dst, len, isum, errp, NULL);
+ 	if (unlikely(*errp))
+@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
+ 	}
+ 
+ 	*errp = 0;
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return csum_partial_copy_generic(src, (void __force *)dst,
+ 					 len, isum, NULL, errp);
+ }
+diff -urNp linux-2.6.32.13/arch/x86/lib/getuser.S linux-2.6.32.13/arch/x86/lib/getuser.S
+--- linux-2.6.32.13/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/getuser.S	2010-05-15 13:21:14.234766826 -0400
+@@ -33,14 +33,38 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/asm.h>
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ 	.text
+ ENTRY(__get_user_1)
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 1:	movzb (%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
+ ENTRY(__get_user_2)
+ 	CFI_STARTPROC
+ 	add $1,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 2:	movzwl -1(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
+ ENTRY(__get_user_4)
+ 	CFI_STARTPROC
+ 	add $3,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 3:	mov -3(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae	bad_get_user
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
+ 4:	movq -7(%_ASM_AX),%_ASM_DX
+ 	xor %eax,%eax
+ 	ret
+@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
+ 
+ bad_get_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %edx,%edx
+ 	mov $(-EFAULT),%_ASM_AX
+ 	ret
+diff -urNp linux-2.6.32.13/arch/x86/lib/memcpy_64.S linux-2.6.32.13/arch/x86/lib/memcpy_64.S
+--- linux-2.6.32.13/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/memcpy_64.S	2010-05-15 13:21:14.234766826 -0400
+@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
+ 	 * It is also a lot simpler. Use this when possible:
+ 	 */
+ 
+-	.section .altinstr_replacement, "ax"
++	.section .altinstr_replacement, "a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.13/arch/x86/lib/memset_64.S linux-2.6.32.13/arch/x86/lib/memset_64.S
+--- linux-2.6.32.13/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/memset_64.S	2010-05-15 13:21:14.234766826 -0400
+@@ -118,7 +118,7 @@ ENDPROC(__memset)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.13/arch/x86/lib/mmx_32.c linux-2.6.32.13/arch/x86/lib/mmx_32.c
+--- linux-2.6.32.13/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/mmx_32.c	2010-05-15 13:21:14.234766826 -0400
+@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
+ {
+ 	void *p;
+ 	int i;
++	unsigned long cr0;
+ 
+ 	if (unlikely(in_interrupt()))
+ 		return __memcpy(to, from, len);
+@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"		/* This set is 28 bytes */
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"		/* This set is 28 bytes */
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from));
++			: "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for ( ; i > 5; i--) {
+ 		__asm__ __volatile__ (
+-		"1:  prefetch 320(%0)\n"
+-		"2:  movq (%0), %%mm0\n"
+-		"  movq 8(%0), %%mm1\n"
+-		"  movq 16(%0), %%mm2\n"
+-		"  movq 24(%0), %%mm3\n"
+-		"  movq %%mm0, (%1)\n"
+-		"  movq %%mm1, 8(%1)\n"
+-		"  movq %%mm2, 16(%1)\n"
+-		"  movq %%mm3, 24(%1)\n"
+-		"  movq 32(%0), %%mm0\n"
+-		"  movq 40(%0), %%mm1\n"
+-		"  movq 48(%0), %%mm2\n"
+-		"  movq 56(%0), %%mm3\n"
+-		"  movq %%mm0, 32(%1)\n"
+-		"  movq %%mm1, 40(%1)\n"
+-		"  movq %%mm2, 48(%1)\n"
+-		"  movq %%mm3, 56(%1)\n"
++		"1:  prefetch 320(%1)\n"
++		"2:  movq (%1), %%mm0\n"
++		"  movq 8(%1), %%mm1\n"
++		"  movq 16(%1), %%mm2\n"
++		"  movq 24(%1), %%mm3\n"
++		"  movq %%mm0, (%2)\n"
++		"  movq %%mm1, 8(%2)\n"
++		"  movq %%mm2, 16(%2)\n"
++		"  movq %%mm3, 24(%2)\n"
++		"  movq 32(%1), %%mm0\n"
++		"  movq 40(%1), %%mm1\n"
++		"  movq 48(%1), %%mm2\n"
++		"  movq 56(%1), %%mm3\n"
++		"  movq %%mm0, 32(%2)\n"
++		"  movq %%mm1, 40(%2)\n"
++		"  movq %%mm2, 48(%2)\n"
++		"  movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
+ 	 * but that is for later. -AV
+ 	 */
+ 	__asm__ __volatile__(
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < (4096-320)/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movntq %%mm0, (%1)\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movntq %%mm1, 8(%1)\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movntq %%mm2, 16(%1)\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movntq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm4\n"
+-		"   movntq %%mm4, 32(%1)\n"
+-		"   movq 40(%0), %%mm5\n"
+-		"   movntq %%mm5, 40(%1)\n"
+-		"   movq 48(%0), %%mm6\n"
+-		"   movntq %%mm6, 48(%1)\n"
+-		"   movq 56(%0), %%mm7\n"
+-		"   movntq %%mm7, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movntq %%mm0, (%2)\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movntq %%mm1, 8(%2)\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movntq %%mm2, 16(%2)\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movntq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm4\n"
++		"   movntq %%mm4, 32(%2)\n"
++		"   movq 40(%1), %%mm5\n"
++		"   movntq %%mm5, 40(%2)\n"
++		"   movq 48(%1), %%mm6\n"
++		"   movntq %%mm6, 48(%2)\n"
++		"   movq 56(%1), %%mm7\n"
++		"   movntq %%mm7, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
++		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < 4096/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movq %%mm0, (%1)\n"
+-		"   movq %%mm1, 8(%1)\n"
+-		"   movq %%mm2, 16(%1)\n"
+-		"   movq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm0\n"
+-		"   movq 40(%0), %%mm1\n"
+-		"   movq 48(%0), %%mm2\n"
+-		"   movq 56(%0), %%mm3\n"
+-		"   movq %%mm0, 32(%1)\n"
+-		"   movq %%mm1, 40(%1)\n"
+-		"   movq %%mm2, 48(%1)\n"
+-		"   movq %%mm3, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movq %%mm0, (%2)\n"
++		"   movq %%mm1, 8(%2)\n"
++		"   movq %%mm2, 16(%2)\n"
++		"   movq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm0\n"
++		"   movq 40(%1), %%mm1\n"
++		"   movq 48(%1), %%mm2\n"
++		"   movq 56(%1), %%mm3\n"
++		"   movq %%mm0, 32(%2)\n"
++		"   movq %%mm1, 40(%2)\n"
++		"   movq %%mm2, 48(%2)\n"
++		"   movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+diff -urNp linux-2.6.32.13/arch/x86/lib/putuser.S linux-2.6.32.13/arch/x86/lib/putuser.S
+--- linux-2.6.32.13/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/putuser.S	2010-05-15 13:21:14.234766826 -0400
+@@ -15,7 +15,8 @@
+ #include <asm/thread_info.h>
+ #include <asm/errno.h>
+ #include <asm/asm.h>
+-
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ /*
+  * __put_user_X
+@@ -29,59 +30,156 @@
+  * as they get called from within inline assembly.
+  */
+ 
+-#define ENTER	CFI_STARTPROC ; \
+-		GET_THREAD_INFO(%_ASM_BX)
++#define ENTER	CFI_STARTPROC
+ #define EXIT	ret ; \
+ 		CFI_ENDPROC
+ 
+ .text
+ ENTRY(__put_user_1)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 1:	movb %al,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_1)
+ 
+ ENTRY(__put_user_2)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $1,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 2:	movw %ax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_2)
+ 
+ ENTRY(__put_user_4)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $3,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 3:	movl %eax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_4)
+ 
+ ENTRY(__put_user_8)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $7,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 4:	mov %_ASM_AX,(%_ASM_CX)
+ #ifdef CONFIG_X86_32
+ 5:	movl %edx,4(%_ASM_CX)
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_8)
+ 
+ bad_put_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	movl $-EFAULT,%eax
+ 	EXIT
+ END(bad_put_user)
+diff -urNp linux-2.6.32.13/arch/x86/lib/usercopy_32.c linux-2.6.32.13/arch/x86/lib/usercopy_32.c
+--- linux-2.6.32.13/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/usercopy_32.c	2010-05-15 13:21:14.234766826 -0400
+@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
+  * Copy a null terminated string from userspace.
+  */
+ 
+-#define __do_strncpy_from_user(dst, src, count, res)			   \
+-do {									   \
+-	int __d0, __d1, __d2;						   \
+-	might_fault();							   \
+-	__asm__ __volatile__(						   \
+-		"	testl %1,%1\n"					   \
+-		"	jz 2f\n"					   \
+-		"0:	lodsb\n"					   \
+-		"	stosb\n"					   \
+-		"	testb %%al,%%al\n"				   \
+-		"	jz 1f\n"					   \
+-		"	decl %1\n"					   \
+-		"	jnz 0b\n"					   \
+-		"1:	subl %1,%0\n"					   \
+-		"2:\n"							   \
+-		".section .fixup,\"ax\"\n"				   \
+-		"3:	movl %5,%0\n"					   \
+-		"	jmp 2b\n"					   \
+-		".previous\n"						   \
+-		_ASM_EXTABLE(0b,3b)					   \
+-		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
+-		  "=&D" (__d2)						   \
+-		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
+-		: "memory");						   \
+-} while (0)
++static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
++{
++	int __d0, __d1, __d2;
++	long res = -EFAULT;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w10,%%ds\n"
++		"	testl %1,%1\n"
++		"	jz 2f\n"
++		"0:	lodsb\n"
++		"	stosb\n"
++		"	testb %%al,%%al\n"
++		"	jz 1f\n"
++		"	decl %1\n"
++		"	jnz 0b\n"
++		"1:	subl %1,%0\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"3:	movl %5,%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
++		  "=&D" (__d2)
++		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
++		  "r"(__USER_DS)
++		: "memory");
++	return res;
++}
+ 
+ /**
+  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
+@@ -85,9 +92,7 @@ do {									   \
+ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+-	long res;
+-	__do_strncpy_from_user(dst, src, count, res);
+-	return res;
++	return __do_strncpy_from_user(dst, src, count);
+ }
+ EXPORT_SYMBOL(__strncpy_from_user);
+ 
+@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
+ {
+ 	long res = -EFAULT;
+ 	if (access_ok(VERIFY_READ, src, 1))
+-		__do_strncpy_from_user(dst, src, count, res);
++		res = __do_strncpy_from_user(dst, src, count);
+ 	return res;
+ }
+ EXPORT_SYMBOL(strncpy_from_user);
+@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
+  * Zero Userspace
+  */
+ 
+-#define __do_clear_user(addr,size)					\
+-do {									\
+-	int __d0;							\
+-	might_fault();							\
+-	__asm__ __volatile__(						\
+-		"0:	rep; stosl\n"					\
+-		"	movl %2,%0\n"					\
+-		"1:	rep; stosb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"3:	lea 0(%2,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		_ASM_EXTABLE(0b,3b)					\
+-		_ASM_EXTABLE(1b,2b)					\
+-		: "=&c"(size), "=&D" (__d0)				\
+-		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
+-} while (0)
++static unsigned long __do_clear_user(void __user *addr, unsigned long size)
++{
++	int __d0;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w6,%%es\n"
++		"0:	rep; stosl\n"
++		"	movl %2,%0\n"
++		"1:	rep; stosb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"3:	lea 0(%2,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		_ASM_EXTABLE(1b,2b)
++		: "=&c"(size), "=&D" (__d0)
++		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
++		  "r"(__USER_DS));
++	return size;
++}
+ 
+ /**
+  * clear_user: - Zero a block of memory in user space.
+@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
+ {
+ 	might_fault();
+ 	if (access_ok(VERIFY_WRITE, to, n))
+-		__do_clear_user(to, n);
++		n = __do_clear_user(to, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(clear_user);
+@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
+ unsigned long
+ __clear_user(void __user *to, unsigned long n)
+ {
+-	__do_clear_user(to, n);
+-	return n;
++	return __do_clear_user(to, n);
+ }
+ EXPORT_SYMBOL(__clear_user);
+ 
+@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
+ 	might_fault();
+ 
+ 	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
+ 		"	testl %0, %0\n"
+ 		"	jz 3f\n"
+-		"	andl %0,%%ecx\n"
++		"	movl %0,%%ecx\n"
+ 		"0:	repne; scasb\n"
+ 		"	setne %%al\n"
+ 		"	subl %%ecx,%0\n"
+ 		"	addl %0,%%eax\n"
+ 		"1:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
+ 		".section .fixup,\"ax\"\n"
+ 		"2:	xorl %%eax,%%eax\n"
+ 		"	jmp 1b\n"
+@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
+ 		"	.long 0b,2b\n"
+ 		".previous"
+ 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
+-		:"0" (n), "1" (s), "2" (0), "3" (mask)
++		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
+ 		:"cc");
+ 	return res & mask;
+ }
+@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
+ 
+ #ifdef CONFIG_X86_INTEL_USERCOPY
+ static unsigned long
+-__copy_user_intel(void __user *to, const void *from, unsigned long size)
++__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "       movw %w6, %%es\n"
+ 		       "       .align 2,0x90\n"
+ 		       "1:     movl 32(%4), %%eax\n"
+ 		       "       cmpl $67, %0\n"
+@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
+ 		       "       .align 2,0x90\n"
+ 		       "3:     movl 0(%4), %%eax\n"
+ 		       "4:     movl 4(%4), %%edx\n"
+-		       "5:     movl %%eax, 0(%3)\n"
+-		       "6:     movl %%edx, 4(%3)\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
+ 		       "7:     movl 8(%4), %%eax\n"
+ 		       "8:     movl 12(%4),%%edx\n"
+-		       "9:     movl %%eax, 8(%3)\n"
+-		       "10:    movl %%edx, 12(%3)\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
+ 		       "11:    movl 16(%4), %%eax\n"
+ 		       "12:    movl 20(%4), %%edx\n"
+-		       "13:    movl %%eax, 16(%3)\n"
+-		       "14:    movl %%edx, 20(%3)\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
+ 		       "15:    movl 24(%4), %%eax\n"
+ 		       "16:    movl 28(%4), %%edx\n"
+-		       "17:    movl %%eax, 24(%3)\n"
+-		       "18:    movl %%edx, 28(%3)\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
+ 		       "19:    movl 32(%4), %%eax\n"
+ 		       "20:    movl 36(%4), %%edx\n"
+-		       "21:    movl %%eax, 32(%3)\n"
+-		       "22:    movl %%edx, 36(%3)\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
+ 		       "23:    movl 40(%4), %%eax\n"
+ 		       "24:    movl 44(%4), %%edx\n"
+-		       "25:    movl %%eax, 40(%3)\n"
+-		       "26:    movl %%edx, 44(%3)\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
+ 		       "27:    movl 48(%4), %%eax\n"
+ 		       "28:    movl 52(%4), %%edx\n"
+-		       "29:    movl %%eax, 48(%3)\n"
+-		       "30:    movl %%edx, 52(%3)\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
+ 		       "31:    movl 56(%4), %%eax\n"
+ 		       "32:    movl 60(%4), %%edx\n"
+-		       "33:    movl %%eax, 56(%3)\n"
+-		       "34:    movl %%edx, 60(%3)\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
+ 		       "       addl $-64, %0\n"
+ 		       "       addl $64, %4\n"
+ 		       "       addl $64, %3\n"
+@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
+ 		       "36:    movl %%eax, %0\n"
+ 		       "37:    rep; movsb\n"
+ 		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%es\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "101:   lea 0(%%eax,%0,4),%0\n"
+ 		       "       jmp 100b\n"
+@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
+ 		       "       .long 99b,101b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
++		       : "eax", "edx", "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
++{
++	int d0, d1;
++	__asm__ __volatile__(
++		       "       movw %w6, %%ds\n"
++		       "       .align 2,0x90\n"
++		       "1:     movl 32(%4), %%eax\n"
++		       "       cmpl $67, %0\n"
++		       "       jbe 3f\n"
++		       "2:     movl 64(%4), %%eax\n"
++		       "       .align 2,0x90\n"
++		       "3:     movl 0(%4), %%eax\n"
++		       "4:     movl 4(%4), %%edx\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
++		       "7:     movl 8(%4), %%eax\n"
++		       "8:     movl 12(%4),%%edx\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
++		       "11:    movl 16(%4), %%eax\n"
++		       "12:    movl 20(%4), %%edx\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
++		       "15:    movl 24(%4), %%eax\n"
++		       "16:    movl 28(%4), %%edx\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
++		       "19:    movl 32(%4), %%eax\n"
++		       "20:    movl 36(%4), %%edx\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
++		       "23:    movl 40(%4), %%eax\n"
++		       "24:    movl 44(%4), %%edx\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
++		       "27:    movl 48(%4), %%eax\n"
++		       "28:    movl 52(%4), %%edx\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
++		       "31:    movl 56(%4), %%eax\n"
++		       "32:    movl 60(%4), %%edx\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
++		       "       addl $-64, %0\n"
++		       "       addl $64, %4\n"
++		       "       addl $64, %3\n"
++		       "       cmpl $63, %0\n"
++		       "       ja  1b\n"
++		       "35:    movl  %0, %%eax\n"
++		       "       shrl  $2, %0\n"
++		       "       andl  $3, %%eax\n"
++		       "       cld\n"
++		       "99:    rep; movsl\n"
++		       "36:    movl %%eax, %0\n"
++		       "37:    rep; movsb\n"
++		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%ds\n"
++		       ".section .fixup,\"ax\"\n"
++		       "101:   lea 0(%%eax,%0,4),%0\n"
++		       "       jmp 100b\n"
++		       ".previous\n"
++		       ".section __ex_table,\"a\"\n"
++		       "       .align 4\n"
++		       "       .long 1b,100b\n"
++		       "       .long 2b,100b\n"
++		       "       .long 3b,100b\n"
++		       "       .long 4b,100b\n"
++		       "       .long 5b,100b\n"
++		       "       .long 6b,100b\n"
++		       "       .long 7b,100b\n"
++		       "       .long 8b,100b\n"
++		       "       .long 9b,100b\n"
++		       "       .long 10b,100b\n"
++		       "       .long 11b,100b\n"
++		       "       .long 12b,100b\n"
++		       "       .long 13b,100b\n"
++		       "       .long 14b,100b\n"
++		       "       .long 15b,100b\n"
++		       "       .long 16b,100b\n"
++		       "       .long 17b,100b\n"
++		       "       .long 18b,100b\n"
++		       "       .long 19b,100b\n"
++		       "       .long 20b,100b\n"
++		       "       .long 21b,100b\n"
++		       "       .long 22b,100b\n"
++		       "       .long 23b,100b\n"
++		       "       .long 24b,100b\n"
++		       "       .long 25b,100b\n"
++		       "       .long 26b,100b\n"
++		       "       .long 27b,100b\n"
++		       "       .long 28b,100b\n"
++		       "       .long 29b,100b\n"
++		       "       .long 30b,100b\n"
++		       "       .long 31b,100b\n"
++		       "       .long 32b,100b\n"
++		       "       .long 33b,100b\n"
++		       "       .long 34b,100b\n"
++		       "       .long 35b,100b\n"
++		       "       .long 36b,100b\n"
++		       "       .long 37b,100b\n"
++		       "       .long 99b,101b\n"
++		       ".previous"
++		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "        movw %w6, %%ds\n"
+ 		       "        .align 2,0x90\n"
+ 		       "0:      movl 32(%4), %%eax\n"
+ 		       "        cmpl $67, %0\n"
+@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .align 2,0x90\n"
+ 		       "2:      movl 0(%4), %%eax\n"
+ 		       "21:     movl 4(%4), %%edx\n"
+-		       "        movl %%eax, 0(%3)\n"
+-		       "        movl %%edx, 4(%3)\n"
++		       "        movl %%eax, %%es:0(%3)\n"
++		       "        movl %%edx, %%es:4(%3)\n"
+ 		       "3:      movl 8(%4), %%eax\n"
+ 		       "31:     movl 12(%4),%%edx\n"
+-		       "        movl %%eax, 8(%3)\n"
+-		       "        movl %%edx, 12(%3)\n"
++		       "        movl %%eax, %%es:8(%3)\n"
++		       "        movl %%edx, %%es:12(%3)\n"
+ 		       "4:      movl 16(%4), %%eax\n"
+ 		       "41:     movl 20(%4), %%edx\n"
+-		       "        movl %%eax, 16(%3)\n"
+-		       "        movl %%edx, 20(%3)\n"
++		       "        movl %%eax, %%es:16(%3)\n"
++		       "        movl %%edx, %%es:20(%3)\n"
+ 		       "10:     movl 24(%4), %%eax\n"
+ 		       "51:     movl 28(%4), %%edx\n"
+-		       "        movl %%eax, 24(%3)\n"
+-		       "        movl %%edx, 28(%3)\n"
++		       "        movl %%eax, %%es:24(%3)\n"
++		       "        movl %%edx, %%es:28(%3)\n"
+ 		       "11:     movl 32(%4), %%eax\n"
+ 		       "61:     movl 36(%4), %%edx\n"
+-		       "        movl %%eax, 32(%3)\n"
+-		       "        movl %%edx, 36(%3)\n"
++		       "        movl %%eax, %%es:32(%3)\n"
++		       "        movl %%edx, %%es:36(%3)\n"
+ 		       "12:     movl 40(%4), %%eax\n"
+ 		       "71:     movl 44(%4), %%edx\n"
+-		       "        movl %%eax, 40(%3)\n"
+-		       "        movl %%edx, 44(%3)\n"
++		       "        movl %%eax, %%es:40(%3)\n"
++		       "        movl %%edx, %%es:44(%3)\n"
+ 		       "13:     movl 48(%4), %%eax\n"
+ 		       "81:     movl 52(%4), %%edx\n"
+-		       "        movl %%eax, 48(%3)\n"
+-		       "        movl %%edx, 52(%3)\n"
++		       "        movl %%eax, %%es:48(%3)\n"
++		       "        movl %%edx, %%es:52(%3)\n"
+ 		       "14:     movl 56(%4), %%eax\n"
+ 		       "91:     movl 60(%4), %%edx\n"
+-		       "        movl %%eax, 56(%3)\n"
+-		       "        movl %%edx, 60(%3)\n"
++		       "        movl %%eax, %%es:56(%3)\n"
++		       "        movl %%edx, %%es:60(%3)\n"
+ 		       "        addl $-64, %0\n"
+ 		       "        addl $64, %4\n"
+ 		       "        addl $64, %3\n"
+@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        movl %%eax,%0\n"
+ 		       "7:      rep; movsb\n"
+ 		       "8:\n"
++		       "        pushl %%ss\n"
++		       "        popl %%ds\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "9:      lea 0(%%eax,%0,4),%0\n"
+ 		       "16:     pushl %0\n"
+@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .long 7b,16b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     pushl %0\n"
+@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     jmp 8b\n"
+@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
+  */
+ unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
+ 					unsigned long size);
+-unsigned long __copy_user_intel(void __user *to, const void *from,
++unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
++					unsigned long size);
++unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
+ 					unsigned long size);
+ unsigned long __copy_user_zeroing_intel_nocache(void *to,
+ 				const void __user *from, unsigned long size);
+ #endif /* CONFIG_X86_INTEL_USERCOPY */
+ 
+ /* Generic arbitrary sized copy.  */
+-#define __copy_user(to, from, size)					\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 2b\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,2b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
+-
+-#define __copy_user_zeroing(to, from, size)				\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 6f\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"6:	pushl %0\n"					\
+-		"	pushl %%eax\n"					\
+-		"	xorl %%eax,%%eax\n"				\
+-		"	rep; stosb\n"					\
+-		"	popl %%eax\n"					\
+-		"	popl %0\n"					\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,6b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
++static unsigned long
++__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 6f\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"6:	pushl %0\n"
++		"	pushl %%eax\n"
++		"	xorl %%eax,%%eax\n"
++		"	rep; stosb\n"
++		"	popl %%eax\n"
++		"	popl %0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,6b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
+ 
+ unsigned long __copy_to_user_ll(void __user *to, const void *from,
+ 				unsigned long n)
+@@ -775,9 +966,9 @@ survive:
+ 	}
+ #endif
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_to_user(to, from, n);
+ 	else
+-		n = __copy_user_intel(to, from, n);
++		n = __generic_copy_to_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_to_user_ll);
+@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
+ 					unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ 	else
+ 		n = __copy_user_zeroing_intel(to, from, n);
+ 	return n;
+@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
+ 					 unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ 	else
+-		n = __copy_user_intel((void __user *)to,
+-				      (const void *)from, n);
++		n = __generic_copy_from_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nozero);
+@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_zeroing_intel_nocache(to, from, n);
+ 	else
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ #else
+-	__copy_user_zeroing(to, from, n);
++	n = __copy_user_zeroing(to, from, n);
+ #endif
+ 	return n;
+ }
+@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_intel_nocache(to, from, n);
+ 	else
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ #else
+-	__copy_user(to, from, n);
++	n = __generic_copy_from_user(to, from, n);
+ #endif
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
+ 
+-/**
+- * copy_to_user: - Copy a block of data into user space.
+- * @to:   Destination address, in user space.
+- * @from: Source address, in kernel space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from kernel space to user space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- */
+-unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned long n)
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++void __set_fs(mm_segment_t x, int cpu)
+ {
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		n = __copy_to_user(to, from, n);
+-	return n;
++	unsigned long limit = x.seg;
++	struct desc_struct d;
++
++	current_thread_info()->addr_limit = x;
++	if (unlikely(paravirt_enabled()))
++		return;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
+ }
+-EXPORT_SYMBOL(copy_to_user);
+ 
+-/**
+- * copy_from_user: - Copy a block of data from user space.
+- * @to:   Destination address, in kernel space.
+- * @from: Source address, in user space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from user space to kernel space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- *
+- * If some data could not be copied, this function will pad the copied
+- * data to the requested size using zero bytes.
+- */
+-unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned long n)
++void set_fs(mm_segment_t x)
+ {
+-	if (access_ok(VERIFY_READ, from, n))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
++	__set_fs(x, get_cpu());
++	put_cpu();
+ }
+-EXPORT_SYMBOL(copy_from_user);
++#else
++void set_fs(mm_segment_t x)
++{
++	current_thread_info()->addr_limit = x;
++}
++#endif
++
++EXPORT_SYMBOL(set_fs);
+diff -urNp linux-2.6.32.13/arch/x86/lib/usercopy_64.c linux-2.6.32.13/arch/x86/lib/usercopy_64.c
+--- linux-2.6.32.13/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/lib/usercopy_64.c	2010-05-15 13:21:14.234766826 -0400
+@@ -42,6 +42,8 @@ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+ 	long res;
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	__do_strncpy_from_user(dst, src, count, res);
+ 	return res;
+ }
+@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
+ {
+ 	long __d0;
+ 	might_fault();
++	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
++		addr += PAX_USER_SHADOW_BASE;
+ 	/* no memory constraint because it doesn't change any memory gcc knows
+ 	   about */
+ 	asm volatile(
+@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
+ 
+ unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
+ {
+-	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
++	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
++		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
++			to += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
++			from += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)to, (__force void *)from, len);
+-	} 
+-	return len;		
++	}
++	return len;
+ }
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/Makefile linux-2.6.32.13/arch/x86/Makefile
+--- linux-2.6.32.13/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/Makefile	2010-05-15 13:21:14.234766826 -0400
+@@ -189,3 +189,12 @@ define archhelp
+   echo  '                  FDARGS="..."  arguments for the booted kernel'
+   echo  '                  FDINITRD=file initrd for the booted kernel'
+ endef
++
++define OLD_LD
++
++*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
++*** Please upgrade your binutils to 2.18 or newer
++endef
++
++archprepare:
++	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
+diff -urNp linux-2.6.32.13/arch/x86/mm/extable.c linux-2.6.32.13/arch/x86/mm/extable.c
+--- linux-2.6.32.13/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/extable.c	2010-05-15 13:21:14.234766826 -0400
+@@ -1,14 +1,71 @@
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
++#include <linux/sort.h>
+ #include <asm/uaccess.h>
++#include <asm/pgtable.h>
+ 
++/*
++ * The exception table needs to be sorted so that the binary
++ * search that we use to find entries in it works properly.
++ * This is used both for the kernel exception table and for
++ * the exception tables of modules that get loaded.
++ */
++static int cmp_ex(const void *a, const void *b)
++{
++	const struct exception_table_entry *x = a, *y = b;
++
++	/* avoid overflow */
++	if (x->insn > y->insn)
++		return 1;
++	if (x->insn < y->insn)
++		return -1;
++	return 0;
++}
++
++static void swap_ex(void *a, void *b, int size)
++{
++	struct exception_table_entry t, *x = a, *y = b;
++
++	t = *x;
++
++	pax_open_kernel();
++	*x = *y;
++	*y = t;
++	pax_close_kernel();
++}
++
++void sort_extable(struct exception_table_entry *start,
++		  struct exception_table_entry *finish)
++{
++	sort(start, finish - start, sizeof(struct exception_table_entry),
++	     cmp_ex, swap_ex);
++}
++
++#ifdef CONFIG_MODULES
++/*
++ * If the exception table is sorted, any referring to the module init
++ * will be at the beginning or the end.
++ */
++void trim_init_extable(struct module *m)
++{
++	/*trim the beginning*/
++	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
++		m->extable++;
++		m->num_exentries--;
++	}
++	/*trim the end*/
++	while (m->num_exentries &&
++		within_module_init(m->extable[m->num_exentries-1].insn, m))
++		m->num_exentries--;
++}
++#endif /* CONFIG_MODULES */
+ 
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fixup;
+ 
+ #ifdef CONFIG_PNPBIOS
+-	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
++	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
+ 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
+ 		extern u32 pnp_bios_is_utter_crap;
+ 		pnp_bios_is_utter_crap = 1;
+diff -urNp linux-2.6.32.13/arch/x86/mm/fault.c linux-2.6.32.13/arch/x86/mm/fault.c
+--- linux-2.6.32.13/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/fault.c	2010-05-15 13:23:38.934774262 -0400
+@@ -11,10 +11,19 @@
+ #include <linux/kprobes.h>		/* __kprobes, ...		*/
+ #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
+ #include <linux/perf_event.h>		/* perf_sw_event		*/
++#include <linux/unistd.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/traps.h>			/* dotraplinkage, ...		*/
+ #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
+ #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
++#include <asm/vsyscall.h>
++#include <asm/tlbflush.h>
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#include <asm/stacktrace.h>
++#include "../kernel/dumpstack.h"
++#endif
+ 
+ /*
+  * Page fault error code bits:
+@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
+ 	int ret = 0;
+ 
+ 	/* kprobe_running() needs smp_processor_id() */
+-	if (kprobes_built_in() && !user_mode_vm(regs)) {
++	if (kprobes_built_in() && !user_mode(regs)) {
+ 		preempt_disable();
+ 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
+ 			ret = 1;
+@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
+ 	force_sig_info(si_signo, &info, tsk);
+ }
+ 
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault(struct pt_regs *regs);
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
++{
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++	pgd = pgd_offset(mm, address);
++	if (!pgd_present(*pgd))
++		return NULL;
++	pud = pud_offset(pgd, address);
++	if (!pud_present(*pud))
++		return NULL;
++	pmd = pmd_offset(pud, address);
++	if (!pmd_present(*pmd))
++		return NULL;
++	return pmd;
++}
++#endif
++
+ DEFINE_SPINLOCK(pgd_lock);
+ LIST_HEAD(pgd_list);
+ 
+@@ -224,11 +257,24 @@ void vmalloc_sync_all(void)
+ 	     address += PMD_SIZE) {
+ 
+ 		unsigned long flags;
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		unsigned long cpu;
++#else
+ 		struct page *page;
++#endif
+ 
+ 		spin_lock_irqsave(&pgd_lock, flags);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++			pgd_t *pgd = get_cpu_pgd(cpu);
++#else
+ 		list_for_each_entry(page, &pgd_list, lru) {
+-			if (!vmalloc_sync_one(page_address(page), address))
++			pgd_t *pgd = page_address(page);
++#endif
++
++			if (!vmalloc_sync_one(pgd, address))
+ 				break;
+ 		}
+ 		spin_unlock_irqrestore(&pgd_lock, flags);
+@@ -257,6 +303,9 @@ static noinline int vmalloc_fault(unsign
+ 	 * Do _not_ use "current" here. We might be inside
+ 	 * an interrupt in the middle of a task switch..
+ 	 */
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
++#endif
+ 	pgd_paddr = read_cr3();
+ 	pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
+ 	if (!pmd_k)
+@@ -332,15 +381,27 @@ void vmalloc_sync_all(void)
+ 
+ 		const pgd_t *pgd_ref = pgd_offset_k(address);
+ 		unsigned long flags;
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		unsigned long cpu;
++#else
+ 		struct page *page;
++#endif
+ 
+ 		if (pgd_none(*pgd_ref))
+ 			continue;
+ 
+ 		spin_lock_irqsave(&pgd_lock, flags);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++			pgd_t *pgd = pgd_offset_cpu(cpu, address);
++#else
+ 		list_for_each_entry(page, &pgd_list, lru) {
+ 			pgd_t *pgd;
+ 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
++#endif
++
+ 			if (pgd_none(*pgd))
+ 				set_pgd(pgd, *pgd_ref);
+ 			else
+@@ -373,7 +434,14 @@ static noinline int vmalloc_fault(unsign
+ 	 * happen within a race in page table update. In the later
+ 	 * case just flush:
+ 	 */
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
++	pgd = pgd_offset_cpu(smp_processor_id(), address);
++#else
+ 	pgd = pgd_offset(current->active_mm, address);
++#endif
++
+ 	pgd_ref = pgd_offset_k(address);
+ 	if (pgd_none(*pgd_ref))
+ 		return -1;
+@@ -535,7 +603,7 @@ static int is_errata93(struct pt_regs *r
+ static int is_errata100(struct pt_regs *regs, unsigned long address)
+ {
+ #ifdef CONFIG_X86_64
+-	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
++	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
+ 		return 1;
+ #endif
+ 	return 0;
+@@ -562,7 +630,7 @@ static int is_f00f_bug(struct pt_regs *r
+ }
+ 
+ static const char nx_warning[] = KERN_CRIT
+-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
++"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
+ 
+ static void
+ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -571,15 +639,26 @@ show_fault_oops(struct pt_regs *regs, un
+ 	if (!oops_may_print())
+ 		return;
+ 
+-	if (error_code & PF_INSTR) {
++	if (nx_enabled && (error_code & PF_INSTR)) {
+ 		unsigned int level;
+ 
+ 		pte_t *pte = lookup_address(address, &level);
+ 
+ 		if (pte && pte_present(*pte) && !pte_exec(*pte))
+-			printk(nx_warning, current_uid());
++			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
+ 	}
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	if (init_mm.start_code <= address && address < init_mm.end_code) {
++		if (current->signal->curr_ip)
++			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++		else
++			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	}
++#endif
++
+ 	printk(KERN_ALERT "BUG: unable to handle kernel ");
+ 	if (address < PAGE_SIZE)
+ 		printk(KERN_CONT "NULL pointer dereference");
+@@ -704,6 +783,68 @@ __bad_area_nosemaphore(struct pt_regs *r
+ 		       unsigned long address, int si_code)
+ {
+ 	struct task_struct *tsk = current;
++	struct mm_struct *mm = tsk->mm;
++
++#ifdef CONFIG_X86_64
++	if (mm && (error_code & PF_INSTR)) {
++		if (regs->ip == (unsigned long)vgettimeofday) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
++			return;
++		} else if (regs->ip == (unsigned long)vtime) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
++			return;
++		} else if (regs->ip == (unsigned long)vgetcpu) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
++			return;
++		}
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm && (error_code & PF_USER)) {
++		unsigned long ip = regs->ip;
++
++		if (v8086_mode(regs))
++			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
++
++		/*
++		 * It's possible to have interrupts off here:
++		 */
++		local_irq_enable();
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
++		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++	}
++#endif
+ 
+ 	/* User mode accesses just cause a SIGSEGV */
+ 	if (error_code & PF_USER) {
+@@ -848,6 +989,106 @@ static int spurious_fault_check(unsigned
+ 	return 1;
+ }
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
++{
++	pte_t *pte;
++	pmd_t *pmd;
++	spinlock_t *ptl;
++	unsigned char pte_mask;
++
++	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
++	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
++		return 0;
++
++	/* PaX: it's our fault, let's handle it if we can */
++
++	/* PaX: take a look at read faults before acquiring any locks */
++	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
++		/* instruction fetch attempt from a protected page in user mode */
++		up_read(&mm->mmap_sem);
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		switch (pax_handle_fetch_fault(regs)) {
++		case 2:
++			return 1;
++		}
++#endif
++
++		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++		do_group_exit(SIGKILL);
++	}
++
++	pmd = pax_get_pmd(mm, address);
++	if (unlikely(!pmd))
++		return 0;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
++		/* write attempt to a protected page in user mode */
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++#ifdef CONFIG_SMP
++	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
++#else
++	if (likely(address > get_limit(regs->cs)))
++#endif
++	{
++		set_pte(pte, pte_mkread(*pte));
++		__flush_tlb_one(address);
++		pte_unmap_unlock(pte, ptl);
++		up_read(&mm->mmap_sem);
++		return 1;
++	}
++
++	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
++
++	/*
++	 * PaX: fill DTLB with user rights and retry
++	 */
++	__asm__ __volatile__ (
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"movw %w4,%%es\n"
++#endif
++		"orb %2,(%1)\n"
++#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
++/*
++ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
++ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
++ * page fault when examined during a TLB load attempt. this is true not only
++ * for PTEs holding a non-present entry but also present entries that will
++ * raise a page fault (such as those set up by PaX, or the copy-on-write
++ * mechanism). in effect it means that we do *not* need to flush the TLBs
++ * for our target pages since their PTEs are simply not in the TLBs at all.
++
++ * the best thing in omitting it is that we gain around 15-20% speed in the
++ * fast path of the page fault handler and can get rid of tracing since we
++ * can no longer flush unintended entries.
++ */
++		"invlpg (%0)\n"
++#endif
++		"testb $0,%%es:(%0)\n"
++		"xorb %3,(%1)\n"
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"pushl %%ss\n"
++		"popl %%es\n"
++#endif
++		:
++		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
++		: "memory", "cc");
++	pte_unmap_unlock(pte, ptl);
++	up_read(&mm->mmap_sem);
++	return 1;
++}
++#endif
++
+ /*
+  * Handle a spurious fault caused by a stale TLB entry.
+  *
+@@ -914,6 +1155,9 @@ int show_unhandled_signals = 1;
+ static inline int
+ access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
+ {
++	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
++		return 1;
++
+ 	if (write) {
+ 		/* write, present and write, not present: */
+ 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
+@@ -947,17 +1191,31 @@ do_page_fault(struct pt_regs *regs, unsi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct task_struct *tsk;
+-	unsigned long address;
+ 	struct mm_struct *mm;
+ 	int write;
+ 	int fault;
+ 
++	/* Get the faulting address: */
++	unsigned long address = read_cr2();
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
++		if (!search_exception_tables(regs->ip)) {
++			bad_area_nosemaphore(regs, error_code, address);
++			return;
++		}
++		if (address < PAX_USER_SHADOW_BASE) {
++			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
++			printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
++			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
++		} else
++			address -= PAX_USER_SHADOW_BASE;
++	}
++#endif
++
+ 	tsk = current;
+ 	mm = tsk->mm;
+ 
+-	/* Get the faulting address: */
+-	address = read_cr2();
+-
+ 	/*
+ 	 * Detect and handle instructions that would cause a page fault for
+ 	 * both a tracked kernel page and a userspace page.
+@@ -1017,7 +1275,7 @@ do_page_fault(struct pt_regs *regs, unsi
+ 	 * User-mode registers count as a user access even for any
+ 	 * potential system fault or CPU buglet:
+ 	 */
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		local_irq_enable();
+ 		error_code |= PF_USER;
+ 	} else {
+@@ -1071,6 +1329,11 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		might_sleep();
+ 	}
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
++		return;
++#endif
++
+ 	vma = find_vma(mm, address);
+ 	if (unlikely(!vma)) {
+ 		bad_area(regs, error_code, address);
+@@ -1082,18 +1345,24 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		bad_area(regs, error_code, address);
+ 		return;
+ 	}
+-	if (error_code & PF_USER) {
+-		/*
+-		 * Accessing the stack below %sp is always a bug.
+-		 * The large cushion allows instructions like enter
+-		 * and pusha to work. ("enter $65535, $31" pushes
+-		 * 32 pointers and then decrements %sp by 65535.)
+-		 */
+-		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
+-			bad_area(regs, error_code, address);
+-			return;
+-		}
++	/*
++	 * Accessing the stack below %sp is always a bug.
++	 * The large cushion allows instructions like enter
++	 * and pusha to work. ("enter $65535, $31" pushes
++	 * 32 pointers and then decrements %sp by 65535.)
++	 */
++	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
++		bad_area(regs, error_code, address);
++		return;
++	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
++		bad_area(regs, error_code, address);
++		return;
+ 	}
++#endif
++
+ 	if (unlikely(expand_stack(vma, address))) {
+ 		bad_area(regs, error_code, address);
+ 		return;
+@@ -1137,3 +1406,199 @@ good_area:
+ 
+ 	up_read(&mm->mmap_sem);
+ }
++
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault_32(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned char mov1, mov2;
++		unsigned short jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 11) >> 32)
++			break;
++#endif
++
++		err = get_user(mov1, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
++			regs->cx = addr1;
++			regs->ax = addr2;
++			regs->ip = addr2;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned char mov, jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 9) >> 32)
++			break;
++#endif
++
++		err = get_user(mov, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++
++		if (err)
++			break;
++
++		if (mov == 0xB9 && jmp == 0xE9) {
++			regs->cx = addr1;
++			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++
++#ifdef CONFIG_X86_64
++static int pax_handle_fetch_fault_64(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned int addr1;
++		unsigned long addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned long addr1, addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->ip = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when gcc trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	if (v8086_mode(regs))
++		return 1;
++
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++
++#ifdef CONFIG_X86_32
++	return pax_handle_fetch_fault_32(regs);
++#else
++	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
++		return pax_handle_fetch_fault_32(regs);
++	else
++		return pax_handle_fetch_fault_64(regs);
++#endif
++}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
++	for (i = -1; i < 80 / (long)sizeof(long); i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++#ifdef CONFIG_X86_32
++			printk(KERN_CONT "???????? ");
++#else
++			printk(KERN_CONT "???????????????? ");
++#endif
++		else
++			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
++	}
++	printk("\n");
++}
++#endif
++
++/**
++ * probe_kernel_write(): safely attempt to write to a location
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++long notrace probe_kernel_write(void *dst, const void *src, size_t size)
++{
++	long ret;
++	mm_segment_t old_fs = get_fs();
++
++	set_fs(KERNEL_DS);
++	pagefault_disable();
++	pax_open_kernel();
++	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
++	pax_close_kernel();
++	pagefault_enable();
++	set_fs(old_fs);
++
++	return ret ? -EFAULT : 0;
++}
+diff -urNp linux-2.6.32.13/arch/x86/mm/gup.c linux-2.6.32.13/arch/x86/mm/gup.c
+--- linux-2.6.32.13/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/gup.c	2010-05-15 13:21:14.234766826 -0400
+@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
+ 	addr = start;
+ 	len = (unsigned long) nr_pages << PAGE_SHIFT;
+ 	end = start + len;
+-	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
++	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+ 					(void __user *)start, len)))
+ 		return 0;
+ 
+diff -urNp linux-2.6.32.13/arch/x86/mm/highmem_32.c linux-2.6.32.13/arch/x86/mm/highmem_32.c
+--- linux-2.6.32.13/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/highmem_32.c	2010-05-15 13:21:14.238617110 -0400
+@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
+ 	idx = type + KM_TYPE_NR*smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+ 	BUG_ON(!pte_none(*(kmap_pte-idx)));
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte-idx, mk_pte(page, prot));
++	pax_close_kernel();
+ 
+ 	return (void *)vaddr;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/mm/hugetlbpage.c linux-2.6.32.13/arch/x86/mm/hugetlbpage.c
+--- linux-2.6.32.13/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/hugetlbpage.c	2010-05-15 13:21:14.238617110 -0400
+@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+-	unsigned long start_addr;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = mm->free_area_cache;
++		start_addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -281,13 +286,13 @@ full_search:
+ 
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+-		if (TASK_SIZE - len < addr) {
++		if (pax_task_size - len < addr) {
+ 			/*
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma, *prev_vma;
+-	unsigned long base = mm->mmap_base, addr = addr0;
++	unsigned long base = mm->mmap_base, addr;
+ 	unsigned long largest_hole = mm->cached_hole_size;
+-	int first_time = 1;
+ 
+ 	/* don't allow allocations above current base */
+ 	if (mm->free_area_cache > base)
+@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
+ 	        largest_hole = 0;
+ 		mm->free_area_cache  = base;
+ 	}
+-try_again:
++
+ 	/* make sure it can fit in the remaining address space */
+ 	if (mm->free_area_cache < len)
+ 		goto fail;
+@@ -364,22 +368,26 @@ try_again:
+ 
+ fail:
+ 	/*
+-	 * if hint left us with no space for the requested
+-	 * mapping then try again:
+-	 */
+-	if (first_time) {
+-		mm->free_area_cache = base;
+-		largest_hole = 0;
+-		first_time = 0;
+-		goto try_again;
+-	}
+-	/*
+ 	 * A failed mmap() very likely causes application failure,
+ 	 * so fall back to the bottom-up function here. This scenario
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+ 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
+ 			len, pgoff, flags);
+@@ -387,6 +395,7 @@ fail:
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
++	mm->mmap_base = base;
+ 	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > TASK_SIZE)
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED) {
+@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (pax_task_size - len >= addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+diff -urNp linux-2.6.32.13/arch/x86/mm/init_32.c linux-2.6.32.13/arch/x86/mm/init_32.c
+--- linux-2.6.32.13/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/init_32.c	2010-05-15 13:21:14.238617110 -0400
+@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
+ }
+ 
+ /*
+- * Creates a middle page table and puts a pointer to it in the
+- * given global directory entry. This only returns the gd entry
+- * in non-PAE compilation mode, since the middle layer is folded.
+- */
+-static pmd_t * __init one_md_table_init(pgd_t *pgd)
+-{
+-	pud_t *pud;
+-	pmd_t *pmd_table;
+-
+-#ifdef CONFIG_X86_PAE
+-	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
+-		if (after_bootmem)
+-			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
+-		else
+-			pmd_table = (pmd_t *)alloc_low_page();
+-		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
+-		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
+-		pud = pud_offset(pgd, 0);
+-		BUG_ON(pmd_table != pmd_offset(pud, 0));
+-
+-		return pmd_table;
+-	}
+-#endif
+-	pud = pud_offset(pgd, 0);
+-	pmd_table = pmd_offset(pud, 0);
+-
+-	return pmd_table;
+-}
+-
+-/*
+  * Create a page table and place a pointer to it in a middle page
+  * directory entry:
+  */
+@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
+ 			page_table = (pte_t *)alloc_low_page();
+ 
+ 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
++#else
+ 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
++#endif
+ 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
+ 	}
+ 
+ 	return pte_offset_kernel(pmd, 0);
+ }
+ 
++static pmd_t * __init one_md_table_init(pgd_t *pgd)
++{
++	pud_t *pud;
++	pmd_t *pmd_table;
++
++	pud = pud_offset(pgd, 0);
++	pmd_table = pmd_offset(pud, 0);
++
++	return pmd_table;
++}
++
+ pmd_t * __init populate_extra_pmd(unsigned long vaddr)
+ {
+ 	int pgd_idx = pgd_index(vaddr);
+@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
+ 	int pgd_idx, pmd_idx;
+ 	unsigned long vaddr;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte = NULL;
+ 
+@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
+ 	pgd = pgd_base + pgd_idx;
+ 
+ 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
+-		pmd = pmd + pmd_index(vaddr);
++		pud = pud_offset(pgd, vaddr);
++		pmd = pmd_offset(pud, vaddr);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
++
+ 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
+ 							pmd++, pmd_idx++) {
+ 			pte = page_table_kmap_check(one_page_table_init(pmd),
+@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
+ 	}
+ }
+ 
+-static inline int is_kernel_text(unsigned long addr)
++static inline int is_kernel_text(unsigned long start, unsigned long end)
+ {
+-	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
+-		return 1;
+-	return 0;
++	if ((start > ktla_ktva((unsigned long)_etext) ||
++	     end <= ktla_ktva((unsigned long)_stext)) &&
++	    (start > ktla_ktva((unsigned long)_einittext) ||
++	     end <= ktla_ktva((unsigned long)_sinittext)) &&
++
++#ifdef CONFIG_ACPI_SLEEP
++	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
++#endif
++
++	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
++		return 0;
++	return 1;
+ }
+ 
+ /*
+@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
+ 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
+ 	unsigned long start_pfn, end_pfn;
+ 	pgd_t *pgd_base = swapper_pg_dir;
+-	int pgd_idx, pmd_idx, pte_ofs;
++	unsigned int pgd_idx, pmd_idx, pte_ofs;
+ 	unsigned long pfn;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 	unsigned pages_2m, pages_4k;
+@@ -278,8 +279,13 @@ repeat:
+ 	pfn = start_pfn;
+ 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 	pgd = pgd_base + pgd_idx;
+-	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
++	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
++		pud = pud_offset(pgd, 0);
++		pmd = pmd_offset(pud, 0);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
+ 
+ 		if (pfn >= end_pfn)
+ 			continue;
+@@ -291,14 +297,13 @@ repeat:
+ #endif
+ 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
+ 		     pmd++, pmd_idx++) {
+-			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
++			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
+ 
+ 			/*
+ 			 * Map with big pages if possible, otherwise
+ 			 * create normal page tables:
+ 			 */
+ 			if (use_pse) {
+-				unsigned int addr2;
+ 				pgprot_t prot = PAGE_KERNEL_LARGE;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -308,11 +313,7 @@ repeat:
+ 					__pgprot(PTE_IDENT_ATTR |
+ 						 _PAGE_PSE);
+ 
+-				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
+-					PAGE_OFFSET + PAGE_SIZE-1;
+-
+-				if (is_kernel_text(addr) ||
+-				    is_kernel_text(addr2))
++				if (is_kernel_text(address, address + PMD_SIZE))
+ 					prot = PAGE_KERNEL_LARGE_EXEC;
+ 
+ 				pages_2m++;
+@@ -329,7 +330,7 @@ repeat:
+ 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 			pte += pte_ofs;
+ 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
+-			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
++			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
+ 				pgprot_t prot = PAGE_KERNEL;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -337,7 +338,7 @@ repeat:
+ 				 */
+ 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
+ 
+-				if (is_kernel_text(addr))
++				if (is_kernel_text(address, address + PAGE_SIZE))
+ 					prot = PAGE_KERNEL_EXEC;
+ 
+ 				pages_4k++;
+@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
+ 
+ 		pud = pud_offset(pgd, va);
+ 		pmd = pmd_offset(pud, va);
+-		if (!pmd_present(*pmd))
++		if (!pmd_present(*pmd) || pmd_huge(*pmd))
+ 			break;
+ 
+ 		pte = pte_offset_kernel(pmd, va);
+@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
+ 
+ static void __init pagetable_init(void)
+ {
+-	pgd_t *pgd_base = swapper_pg_dir;
+-
+-	permanent_kmaps_init(pgd_base);
++	permanent_kmaps_init(swapper_pg_dir);
+ }
+ 
+ #ifdef CONFIG_ACPI_SLEEP
+@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
+  * ACPI suspend needs this for resume, because things like the intel-agp
+  * driver might have split up a kernel 4MB mapping.
+  */
+-char swsusp_pg_dir[PAGE_SIZE]
++pgd_t swsusp_pg_dir[PTRS_PER_PGD]
+ 	__attribute__ ((aligned(PAGE_SIZE)));
+ 
+ static inline void save_pg_dir(void)
+ {
+-	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
++	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
+ }
+ #else /* !CONFIG_ACPI_SLEEP */
+ static inline void save_pg_dir(void)
+@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
+ 		flush_tlb_all();
+ }
+ 
+-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
++pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+ 
+ /* user-defined highmem size */
+@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
+ 	 * Initialize the boot-time allocator (with low memory only):
+ 	 */
+ 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
+-	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
++	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
+ 				 PAGE_SIZE);
+ 	if (bootmap == -1L)
+ 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
+@@ -864,6 +863,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_FLATMEM
+ 	BUG_ON(!mem_map);
+ #endif
+@@ -881,7 +886,7 @@ void __init mem_init(void)
+ 	set_highmem_pages_init();
+ 
+ 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
+-	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
++	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
+ 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
+ 
+ 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
+@@ -923,10 +928,10 @@ void __init mem_init(void)
+ 		((unsigned long)&__init_end -
+ 		 (unsigned long)&__init_begin) >> 10,
+ 
+-		(unsigned long)&_etext, (unsigned long)&_edata,
+-		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
++		(unsigned long)&_sdata, (unsigned long)&_edata,
++		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
+ 
+-		(unsigned long)&_text, (unsigned long)&_etext,
++		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
+ 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
+ 
+ 	/*
+@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read write\n",
+ 		 start, start+size);
+ 
+@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read only\n",
+ 		 start, start+size);
+ 
+@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
+ 	unsigned long start = PFN_ALIGN(_text);
+ 	unsigned long size = PFN_ALIGN(_etext) - start;
+ 
++	start = ktla_ktva(start);
+ 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+ 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
+ 		size >> 10);
+diff -urNp linux-2.6.32.13/arch/x86/mm/init_64.c linux-2.6.32.13/arch/x86/mm/init_64.c
+--- linux-2.6.32.13/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/init_64.c	2010-05-15 13:21:14.238617110 -0400
+@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
+ 	pmd = fill_pmd(pud, vaddr);
+ 	pte = fill_pte(pmd, vaddr);
+ 
++	pax_open_kernel();
+ 	set_pte(pte, new_pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
+ 		pgd = pgd_offset_k((unsigned long)__va(phys));
+ 		if (pgd_none(*pgd)) {
+ 			pud = (pud_t *) spp_getpage();
+-			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
+ 		}
+ 		pud = pud_offset(pgd, (unsigned long)__va(phys));
+ 		if (pud_none(*pud)) {
+ 			pmd = (pmd_t *) spp_getpage();
+-			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
+ 		}
+ 		pmd = pmd_offset(pud, phys);
+ 		BUG_ON(!pmd_none(*pmd));
+@@ -656,6 +656,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ 	/* clear_bss() already clear the empty_zero_page */
+ 
+ 	reservedpages = 0;
+@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
+ static struct vm_area_struct gate_vma = {
+ 	.vm_start	= VSYSCALL_START,
+ 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
+-	.vm_page_prot	= PAGE_READONLY_EXEC,
+-	.vm_flags	= VM_READ | VM_EXEC
++	.vm_page_prot	= PAGE_READONLY,
++	.vm_flags	= VM_READ
+ };
+ 
+ struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
+@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
+ 	if (vma == &gate_vma)
+ 		return "[vsyscall]";
+diff -urNp linux-2.6.32.13/arch/x86/mm/init.c linux-2.6.32.13/arch/x86/mm/init.c
+--- linux-2.6.32.13/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/init.c	2010-05-15 13:21:14.238617110 -0400
+@@ -69,11 +69,7 @@ static void __init find_early_table_spac
+ 	 * cause a hotspot and fill up ZONE_DMA. The page tables
+ 	 * need roughly 0.5KB per GB.
+ 	 */
+-#ifdef CONFIG_X86_32
+-	start = 0x7000;
+-#else
+-	start = 0x8000;
+-#endif
++	start = 0x100000;
+ 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
+ 					tables, PAGE_SIZE);
+ 	if (e820_table_start == -1UL)
+@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
+  */
+ int devmem_is_allowed(unsigned long pagenr)
+ {
+-	if (pagenr <= 256)
++	if (!pagenr)
++		return 1;
++#ifdef CONFIG_VM86
++	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
++		return 1;
++#endif
++	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 1;
+ 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+ 		return 0;
+@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
+ 
+ void free_initmem(void)
+ {
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++#ifdef CONFIG_X86_32
++	/* PaX: limit KERNEL_CS to actual size */
++	unsigned long addr, limit;
++	struct desc_struct d;
++	int cpu;
++
++	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
++	limit = (limit - 1UL) >> PAGE_SHIFT;
++
++	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
++		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
++	}
++
++	/* PaX: make KERNEL_CS read-only */
++	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
++	if (!paravirt_enabled())
++		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
++/*
++		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
++			pgd = pgd_offset_k(addr);
++			pud = pud_offset(pgd, addr);
++			pmd = pmd_offset(pud, addr);
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		}
++*/
++#ifdef CONFIG_X86_PAE
++	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
++	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++#ifdef CONFIG_MODULES
++	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
++#endif
++
++#else
++	unsigned long addr, end;
++
++	/* PaX: make kernel code/rodata read-only, rest non-executable */
++	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++
++	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
++	end = addr + KERNEL_IMAGE_SIZE;
++	for (; addr < end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++	flush_tlb_all();
++#endif
++
+ 	free_init_pages("unused kernel memory",
+ 			(unsigned long)(&__init_begin),
+ 			(unsigned long)(&__init_end));
+diff -urNp linux-2.6.32.13/arch/x86/mm/iomap_32.c linux-2.6.32.13/arch/x86/mm/iomap_32.c
+--- linux-2.6.32.13/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/iomap_32.c	2010-05-15 13:21:14.238617110 -0400
+@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
+ 	debug_kmap_atomic(type);
+ 	idx = type + KM_TYPE_NR * smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
++	pax_close_kernel();
++
+ 	arch_flush_lazy_mmu_mode();
+ 
+ 	return (void *)vaddr;
+diff -urNp linux-2.6.32.13/arch/x86/mm/ioremap.c linux-2.6.32.13/arch/x86/mm/ioremap.c
+--- linux-2.6.32.13/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/ioremap.c	2010-05-15 13:21:14.238617110 -0400
+@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
+ 	 * Second special case: Some BIOSen report the PC BIOS
+ 	 * area (640->1Mb) as ram even though it is not.
+ 	 */
+-	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
+-		    pagenr < (BIOS_END >> PAGE_SHIFT))
++	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
++		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 0;
+ 
+ 	for (i = 0; i < e820.nr_map; i++) {
+@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
+ 	/*
+ 	 * Don't allow anybody to remap normal RAM that we're using..
+ 	 */
+-	for (pfn = phys_addr >> PAGE_SHIFT;
+-				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
+-				pfn++) {
+-
++	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
+ 		int is_ram = page_is_ram(pfn);
+ 
+-		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
++		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
+ 			return NULL;
+ 		WARN_ON_ONCE(is_ram);
+ 	}
+@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
+ early_param("early_ioremap_debug", early_ioremap_debug_setup);
+ 
+ static __initdata int after_paging_init;
+-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
++static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
+ 
+ static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
+ {
+@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
+ 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
+ 
+ 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
+-	memset(bm_pte, 0, sizeof(bm_pte));
+-	pmd_populate_kernel(&init_mm, pmd, bm_pte);
++	pmd_populate_user(&init_mm, pmd, bm_pte);
+ 
+ 	/*
+ 	 * The boot-ioremap range spans multiple pmds, for which
+diff -urNp linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c
+--- linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c	2010-05-15 13:21:14.238617110 -0400
+@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
+ 	 * memory (e.g. tracked pages)? For now, we need this to avoid
+ 	 * invoking kmemcheck for PnP BIOS calls.
+ 	 */
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		return false;
+-	if (regs->cs != __KERNEL_CS)
++	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
+ 		return false;
+ 
+ 	pte = kmemcheck_pte_lookup(address);
+diff -urNp linux-2.6.32.13/arch/x86/mm/mmap.c linux-2.6.32.13/arch/x86/mm/mmap.c
+--- linux-2.6.32.13/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/mmap.c	2010-05-15 13:21:14.238617110 -0400
+@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
+  * Leave an at least ~128 MB hole with possible stack randomization.
+  */
+ #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
+-#define MAX_GAP (TASK_SIZE/6*5)
++#define MAX_GAP (pax_task_size/6*5)
+ 
+ /*
+  * True on X86_32 or when emulating IA32 on X86_64
+@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
+ 	return rnd << PAGE_SHIFT;
+ }
+ 
+-static unsigned long mmap_base(void)
++static unsigned long mmap_base(struct mm_struct *mm)
+ {
+ 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (gap < MIN_GAP)
+ 		gap = MIN_GAP;
+ 	else if (gap > MAX_GAP)
+ 		gap = MAX_GAP;
+ 
+-	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
++	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
+ }
+ 
+ /*
+  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
+  * does, but not when emulating X86_32
+  */
+-static unsigned long mmap_legacy_base(void)
++static unsigned long mmap_legacy_base(struct mm_struct *mm)
+ {
+-	if (mmap_is_ia32())
++	if (mmap_is_ia32()) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (mm->pax_flags & MF_PAX_SEGMEXEC)
++			return SEGMEXEC_TASK_UNMAPPED_BASE;
++		else
++#endif
++
+ 		return TASK_UNMAPPED_BASE;
+-	else
++	} else
+ 		return TASK_UNMAPPED_BASE + mmap_rnd();
+ }
+ 
+@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	if (mmap_is_legacy()) {
+-		mm->mmap_base = mmap_legacy_base();
++		mm->mmap_base = mmap_legacy_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+-		mm->mmap_base = mmap_base();
++		mm->mmap_base = mmap_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.13/arch/x86/mm/numa_32.c linux-2.6.32.13/arch/x86/mm/numa_32.c
+--- linux-2.6.32.13/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/numa_32.c	2010-05-15 13:21:14.238617110 -0400
+@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
+ }
+ #endif
+ 
+-extern unsigned long find_max_low_pfn(void);
+ extern unsigned long highend_pfn, highstart_pfn;
+ 
+ #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
+diff -urNp linux-2.6.32.13/arch/x86/mm/pageattr.c linux-2.6.32.13/arch/x86/mm/pageattr.c
+--- linux-2.6.32.13/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/pageattr.c	2010-05-15 13:21:14.238617110 -0400
+@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
+ 	 * Does not cover __inittext since that is gone later on. On
+ 	 * 64bit we do not enforce !NX on the low mapping
+ 	 */
+-	if (within(address, (unsigned long)_text, (unsigned long)_etext))
++	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
+ 		pgprot_val(forbidden) |= _PAGE_NX;
+ 
++#ifdef CONFIG_DEBUG_RODATA
+ 	/*
+ 	 * The .rodata section needs to be read-only. Using the pfn
+ 	 * catches all aliases.
+@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
+ 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
+ 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
+ 		pgprot_val(forbidden) |= _PAGE_RW;
++#endif
+ 
+ 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
+ 
+@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
+ static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
+ {
+ 	/* change init_mm */
++	pax_open_kernel();
+ 	set_pte_atomic(kpte, pte);
++	pax_close_kernel();
++
+ #ifdef CONFIG_X86_32
+ 	if (!SHARED_KERNEL_PMD) {
+ 		struct page *page;
+diff -urNp linux-2.6.32.13/arch/x86/mm/pageattr-test.c linux-2.6.32.13/arch/x86/mm/pageattr-test.c
+--- linux-2.6.32.13/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/pageattr-test.c	2010-05-15 13:21:14.238617110 -0400
+@@ -36,7 +36,7 @@ enum {
+ 
+ static int pte_testbit(pte_t pte)
+ {
+-	return pte_flags(pte) & _PAGE_UNUSED1;
++	return pte_flags(pte) & _PAGE_CPA_TEST;
+ }
+ 
+ struct split_state {
+diff -urNp linux-2.6.32.13/arch/x86/mm/pat.c linux-2.6.32.13/arch/x86/mm/pat.c
+--- linux-2.6.32.13/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/pat.c	2010-05-15 13:21:14.258921790 -0400
+@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
+ 
+  conflict:
+ 	printk(KERN_INFO "%s:%d conflicting memory types "
+-	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
++	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
+ 	       new->end, cattr_name(new->type), cattr_name(entry->type));
+ 	return -EBUSY;
+ }
+@@ -559,7 +559,7 @@ unlock_ret:
+ 
+ 	if (err) {
+ 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
+-			current->comm, current->pid, start, end);
++			current->comm, task_pid_nr(current), start, end);
+ 	}
+ 
+ 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
+@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
+ 		printk(KERN_INFO
+ 			"%s:%d ioremap_change_attr failed %s "
+ 			"for %Lx-%Lx\n",
+-			current->comm, current->pid,
++			current->comm, task_pid_nr(current),
+ 			cattr_name(flags),
+ 			base, (unsigned long long)(base + size));
+ 		return -EINVAL;
+@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
+ 			free_memtype(paddr, paddr + size);
+ 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
+ 				" for %Lx-%Lx, got %s\n",
+-				current->comm, current->pid,
++				current->comm, task_pid_nr(current),
+ 				cattr_name(want_flags),
+ 				(unsigned long long)paddr,
+ 				(unsigned long long)(paddr + size),
+diff -urNp linux-2.6.32.13/arch/x86/mm/pgtable_32.c linux-2.6.32.13/arch/x86/mm/pgtable_32.c
+--- linux-2.6.32.13/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/pgtable_32.c	2010-05-15 13:21:14.258921790 -0400
+@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
+ 		return;
+ 	}
+ 	pte = pte_offset_kernel(pmd, vaddr);
++
++	pax_open_kernel();
+ 	if (pte_val(pteval))
+ 		set_pte_at(&init_mm, vaddr, pte, pteval);
+ 	else
+ 		pte_clear(&init_mm, vaddr, pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+diff -urNp linux-2.6.32.13/arch/x86/mm/pgtable.c linux-2.6.32.13/arch/x86/mm/pgtable.c
+--- linux-2.6.32.13/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/pgtable.c	2010-05-15 13:21:14.258921790 -0400
+@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
+ #if PAGETABLE_LEVELS > 3
+ void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
+ 	tlb_remove_page(tlb, virt_to_page(pud));
++#endif
++
+ }
+ #endif	/* PAGETABLE_LEVELS > 3 */
+ #endif	/* PAGETABLE_LEVELS > 2 */
+@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
+ 	list_del(&page->lru);
+ }
+ 
+-#define UNSHARED_PTRS_PER_PGD				\
+-	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++	while (count--)
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
++#else
++		*dst++ = *src++;
++#endif
++
++}
++
++void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	while (count--)
++		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
++#endif
++
++}
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++static inline void pgd_ctor(pgd_t *pgd) {}
++static inline void pgd_dtor(pgd_t *pgd) {}
++#ifdef CONFIG_X86_64
++#define pxd_t				pud_t
++#define pyd_t				pgd_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
++#define pxd_free(mm, pud)		pud_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
++#define PYD_SIZE			PGDIR_SIZE
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pud)		pmd_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
++#endif
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
++#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
+ 
+ static void pgd_ctor(pgd_t *pgd)
+ {
+@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
+ 	pgd_list_del(pgd);
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ }
++#endif
+ 
+ /*
+  * List of all pgd's needed for non-PAE so it can invalidate entries
+@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * -- wli
+  */
+ 
+-#ifdef CONFIG_X86_PAE
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ /*
+  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
+  * updating the top-level pagetable entries to guarantee the
+@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
+  * and initialize the kernel pmds here.
+  */
+-#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
++#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+ 
+ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
+ {
+@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
+ 	if (mm == current->active_mm)
+ 		write_cr3(read_cr3());
+ }
++#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
++#define PREALLOCATED_PXDS	USER_PGD_PTRS
+ #else  /* !CONFIG_X86_PAE */
+ 
+ /* No need to prepopulate any pagetable entries in non-PAE modes. */
+-#define PREALLOCATED_PMDS	0
++#define PREALLOCATED_PXDS	0
+ 
+ #endif	/* CONFIG_X86_PAE */
+ 
+-static void free_pmds(pmd_t *pmds[])
++static void free_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++)
+-		if (pmds[i])
+-			free_page((unsigned long)pmds[i]);
++	for(i = 0; i < PREALLOCATED_PXDS; i++)
++		if (pxds[i])
++			free_page((unsigned long)pxds[i]);
+ }
+ 
+-static int preallocate_pmds(pmd_t *pmds[])
++static int preallocate_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 	bool failed = false;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
+-		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
+-		if (pmd == NULL)
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
++		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
++		if (pxd == NULL)
+ 			failed = true;
+-		pmds[i] = pmd;
++		pxds[i] = pxd;
+ 	}
+ 
+ 	if (failed) {
+-		free_pmds(pmds);
++		free_pxds(pxds);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
+  * preallocate which never got a corresponding vma will need to be
+  * freed manually.
+  */
+-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
++static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
+ 		pgd_t pgd = pgdp[i];
+ 
+ 		if (pgd_val(pgd) != 0) {
+-			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
++			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
+ 
+-			pgdp[i] = native_make_pgd(0);
++			set_pgd(pgdp + i, native_make_pgd(0));
+ 
+-			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
+-			pmd_free(mm, pmd);
++			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
++			pxd_free(mm, pxd);
+ 		}
+ 	}
+ }
+ 
+-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
++static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
+ {
+-	pud_t *pud;
++	pyd_t *pyd;
+ 	unsigned long addr;
+ 	int i;
+ 
+-	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
++	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
+ 		return;
+ 
+-	pud = pud_offset(pgd, 0);
++#ifdef CONFIG_X86_64
++	pyd = pyd_offset(mm, 0L);
++#else
++	pyd = pyd_offset(pgd, 0L);
++#endif
+ 
+- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
+-	     i++, pud++, addr += PUD_SIZE) {
+-		pmd_t *pmd = pmds[i];
++ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
++	     i++, pyd++, addr += PYD_SIZE) {
++		pxd_t *pxd = pxds[i];
+ 
+ 		if (i >= KERNEL_PGD_BOUNDARY)
+-			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
+-			       sizeof(pmd_t) * PTRS_PER_PMD);
++			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
++			       sizeof(pxd_t) * PTRS_PER_PMD);
+ 
+-		pud_populate(mm, pud, pmd);
++		pyd_populate(mm, pyd, pxd);
+ 	}
+ }
+ 
+ pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+ 	pgd_t *pgd;
+-	pmd_t *pmds[PREALLOCATED_PMDS];
++	pxd_t *pxds[PREALLOCATED_PXDS];
++
+ 	unsigned long flags;
+ 
+ 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
+@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 
+ 	mm->pgd = pgd;
+ 
+-	if (preallocate_pmds(pmds) != 0)
++	if (preallocate_pxds(pxds) != 0)
+ 		goto out_free_pgd;
+ 
+ 	if (paravirt_pgd_alloc(mm) != 0)
+-		goto out_free_pmds;
++		goto out_free_pxds;
+ 
+ 	/*
+ 	 * Make sure that pre-populating the pmds is atomic with
+@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 	spin_lock_irqsave(&pgd_lock, flags);
+ 
+ 	pgd_ctor(pgd);
+-	pgd_prepopulate_pmd(mm, pgd, pmds);
++	pgd_prepopulate_pxd(mm, pgd, pxds);
+ 
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ 
+ 	return pgd;
+ 
+-out_free_pmds:
+-	free_pmds(pmds);
++out_free_pxds:
++	free_pxds(pxds);
+ out_free_pgd:
+ 	free_page((unsigned long)pgd);
+ out:
+@@ -288,7 +354,7 @@ out:
+ 
+ void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ {
+-	pgd_mop_up_pmds(mm, pgd);
++	pgd_mop_up_pxds(mm, pgd);
+ 	pgd_dtor(pgd);
+ 	paravirt_pgd_free(mm, pgd);
+ 	free_page((unsigned long)pgd);
+diff -urNp linux-2.6.32.13/arch/x86/mm/setup_nx.c linux-2.6.32.13/arch/x86/mm/setup_nx.c
+--- linux-2.6.32.13/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/setup_nx.c	2010-05-15 13:21:14.258921790 -0400
+@@ -4,11 +4,10 @@
+ 
+ #include <asm/pgtable.h>
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ int nx_enabled;
+ 
+-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+-static int disable_nx __cpuinitdata;
+-
++#ifndef CONFIG_PAX_PAGEEXEC
+ /*
+  * noexec = on|off
+  *
+@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
+ 	if (!str)
+ 		return -EINVAL;
+ 	if (!strncmp(str, "on", 2)) {
+-		__supported_pte_mask |= _PAGE_NX;
+-		disable_nx = 0;
++		nx_enabled = 1;
+ 	} else if (!strncmp(str, "off", 3)) {
+-		disable_nx = 1;
+-		__supported_pte_mask &= ~_PAGE_NX;
++		nx_enabled = 0;
+ 	}
+ 	return 0;
+ }
+ early_param("noexec", noexec_setup);
+ #endif
++#endif
+ 
+ #ifdef CONFIG_X86_PAE
+ void __init set_nx(void)
+ {
+-	unsigned int v[4], l, h;
++	if (!nx_enabled && cpu_has_nx) {
++		unsigned l, h;
+ 
+-	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
+-		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
+-
+-		if ((v[3] & (1 << 20)) && !disable_nx) {
+-			rdmsr(MSR_EFER, l, h);
+-			l |= EFER_NX;
+-			wrmsr(MSR_EFER, l, h);
+-			nx_enabled = 1;
+-			__supported_pte_mask |= _PAGE_NX;
+-		}
++		__supported_pte_mask &= ~_PAGE_NX;
++		rdmsr(MSR_EFER, l, h);
++		l &= ~EFER_NX;
++		wrmsr(MSR_EFER, l, h);
+ 	}
+ }
+ #else
+@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
+ 	unsigned long efer;
+ 
+ 	rdmsrl(MSR_EFER, efer);
+-	if (!(efer & EFER_NX) || disable_nx)
++	if (!(efer & EFER_NX) || !nx_enabled)
+ 		__supported_pte_mask &= ~_PAGE_NX;
+ }
+ #endif
+diff -urNp linux-2.6.32.13/arch/x86/mm/tlb.c linux-2.6.32.13/arch/x86/mm/tlb.c
+--- linux-2.6.32.13/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/mm/tlb.c	2010-05-15 13:21:14.258921790 -0400
+@@ -12,7 +12,7 @@
+ #include <asm/uv/uv.h>
+ 
+ DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
+-			= { &init_mm, 0, };
++			= { &init_mm, 0 };
+ 
+ /*
+  *	Smarter SMP flushing macros.
+@@ -61,7 +61,11 @@ void leave_mm(int cpu)
+ 		BUG();
+ 	cpumask_clear_cpu(cpu,
+ 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	load_cr3(swapper_pg_dir);
++#endif
++
+ }
+ EXPORT_SYMBOL_GPL(leave_mm);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/oprofile/backtrace.c linux-2.6.32.13/arch/x86/oprofile/backtrace.c
+--- linux-2.6.32.13/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/oprofile/backtrace.c	2010-05-15 13:21:14.258921790 -0400
+@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
+ 	struct frame_head bufhead[2];
+ 
+ 	/* Also check accessibility of one struct frame_head beyond */
+-	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
++	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
+ 		return NULL;
+ 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
+ 		return NULL;
+@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
+ {
+ 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
+ 
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned long stack = kernel_stack_pointer(regs);
+ 		if (depth)
+ 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff -urNp linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c
+--- linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c	2010-05-15 13:21:14.270940782 -0400
+@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
+ #endif
+ }
+ 
+-static int inline addr_increment(void)
++static inline int addr_increment(void)
+ {
+ #ifdef CONFIG_SMP
+ 	return smp_num_siblings == 2 ? 2 : 1;
+diff -urNp linux-2.6.32.13/arch/x86/pci/common.c linux-2.6.32.13/arch/x86/pci/common.c
+--- linux-2.6.32.13/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/common.c	2010-05-15 13:21:14.270940782 -0400
+@@ -31,8 +31,8 @@ int noioapicreroute = 1;
+ int pcibios_last_bus = -1;
+ unsigned long pirq_table_addr;
+ struct pci_bus *pci_root_bus;
+-struct pci_raw_ops *raw_pci_ops;
+-struct pci_raw_ops *raw_pci_ext_ops;
++const struct pci_raw_ops *raw_pci_ops;
++const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+ int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val)
+@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ void __init dmi_check_pciprobe(void)
+diff -urNp linux-2.6.32.13/arch/x86/pci/direct.c linux-2.6.32.13/arch/x86/pci/direct.c
+--- linux-2.6.32.13/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/direct.c	2010-05-15 13:21:14.270940782 -0400
+@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
+ 
+ #undef PCI_CONF1_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf1 = {
++const struct pci_raw_ops pci_direct_conf1 = {
+ 	.read =		pci_conf1_read,
+ 	.write =	pci_conf1_write,
+ };
+@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
+ 
+ #undef PCI_CONF2_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf2 = {
++const struct pci_raw_ops pci_direct_conf2 = {
+ 	.read =		pci_conf2_read,
+ 	.write =	pci_conf2_write,
+ };
+@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
+  * This should be close to trivial, but it isn't, because there are buggy
+  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
+  */
+-static int __init pci_sanity_check(struct pci_raw_ops *o)
++static int __init pci_sanity_check(const struct pci_raw_ops *o)
+ {
+ 	u32 x = 0;
+ 	int year, devfn;
+diff -urNp linux-2.6.32.13/arch/x86/pci/fixup.c linux-2.6.32.13/arch/x86/pci/fixup.c
+--- linux-2.6.32.13/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/fixup.c	2010-05-15 13:21:14.270940782 -0400
+@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
+diff -urNp linux-2.6.32.13/arch/x86/pci/irq.c linux-2.6.32.13/arch/x86/pci/irq.c
+--- linux-2.6.32.13/arch/x86/pci/irq.c	2010-04-29 17:49:37.625451376 -0400
++++ linux-2.6.32.13/arch/x86/pci/irq.c	2010-05-15 13:21:14.270940782 -0400
+@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
+ 	static struct pci_device_id __initdata pirq_440gx[] = {
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
+-		{ },
++		{ PCI_DEVICE(0, 0) }
+ 	};
+ 
+ 	/* 440GX has a proprietary PIRQ router -- don't use it */
+@@ -1109,7 +1109,7 @@ static struct dmi_system_id __initdata p
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ int __init pcibios_irq_init(void)
+diff -urNp linux-2.6.32.13/arch/x86/pci/mmconfig_32.c linux-2.6.32.13/arch/x86/pci/mmconfig_32.c
+--- linux-2.6.32.13/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/mmconfig_32.c	2010-05-15 13:21:14.270940782 -0400
+@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.13/arch/x86/pci/mmconfig_64.c linux-2.6.32.13/arch/x86/pci/mmconfig_64.c
+--- linux-2.6.32.13/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/mmconfig_64.c	2010-05-15 13:21:14.270940782 -0400
+@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.13/arch/x86/pci/numaq_32.c linux-2.6.32.13/arch/x86/pci/numaq_32.c
+--- linux-2.6.32.13/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/numaq_32.c	2010-05-15 13:21:14.270940782 -0400
+@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
+ 
+ #undef PCI_CONF1_MQ_ADDRESS
+ 
+-static struct pci_raw_ops pci_direct_conf1_mq = {
++static const struct pci_raw_ops pci_direct_conf1_mq = {
+ 	.read	= pci_conf1_mq_read,
+ 	.write	= pci_conf1_mq_write
+ };
+diff -urNp linux-2.6.32.13/arch/x86/pci/olpc.c linux-2.6.32.13/arch/x86/pci/olpc.c
+--- linux-2.6.32.13/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/olpc.c	2010-05-15 13:21:14.270940782 -0400
+@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_olpc_conf = {
++static const struct pci_raw_ops pci_olpc_conf = {
+ 	.read =	pci_olpc_read,
+ 	.write = pci_olpc_write,
+ };
+diff -urNp linux-2.6.32.13/arch/x86/pci/pcbios.c linux-2.6.32.13/arch/x86/pci/pcbios.c
+--- linux-2.6.32.13/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/pci/pcbios.c	2010-05-15 13:21:14.274578804 -0400
+@@ -56,50 +56,93 @@ union bios32 {
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} bios32_indirect = { 0, __KERNEL_CS };
++} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+ /*
+  * Returns the entry point for the given service, NULL on error
+  */
+ 
+-static unsigned long bios32_service(unsigned long service)
++static unsigned long __devinit bios32_service(unsigned long service)
+ {
+ 	unsigned char return_code;	/* %al */
+ 	unsigned long address;		/* %ebx */
+ 	unsigned long length;		/* %ecx */
+ 	unsigned long entry;		/* %edx */
+ 	unsigned long flags;
++	struct desc_struct d, *gdt;
+ 
+ 	local_irq_save(flags);
+-	__asm__("lcall *(%%edi); cld"
++
++	gdt = get_cpu_gdt_table(smp_processor_id());
++
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++
++	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
+ 		: "=a" (return_code),
+ 		  "=b" (address),
+ 		  "=c" (length),
+ 		  "=d" (entry)
+ 		: "0" (service),
+ 		  "1" (0),
+-		  "D" (&bios32_indirect));
++		  "D" (&bios32_indirect),
++		  "r"(__PCIBIOS_DS)
++		: "memory");
++
++	pax_open_kernel();
++	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
++	pax_close_kernel();
++
+ 	local_irq_restore(flags);
+ 
+ 	switch (return_code) {
+-		case 0:
+-			return address + entry;
+-		case 0x80:	/* Not present */
+-			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
+-			return 0;
+-		default: /* Shouldn't happen */
+-			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
+-				service, return_code);
++	case 0: {
++		int cpu;
++		unsigned char flags;
++
++		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
++		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
++			printk(KERN_WARNING "bios32_service: not valid\n");
+ 			return 0;
++		}
++		address = address + PAGE_OFFSET;
++		length += 16UL; /* some BIOSs underreport this... */
++		flags = 4;
++		if (length >= 64*1024*1024) {
++			length >>= PAGE_SHIFT;
++			flags |= 8;
++		}
++
++		for (cpu = 0; cpu < NR_CPUS; cpu++) {
++			gdt = get_cpu_gdt_table(cpu);
++			pack_descriptor(&d, address, length, 0x9b, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++			pack_descriptor(&d, address, length, 0x93, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++		}
++		return entry;
++	}
++	case 0x80:	/* Not present */
++		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
++		return 0;
++	default: /* Shouldn't happen */
++		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
++			service, return_code);
++		return 0;
+ 	}
+ }
+ 
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} pci_indirect = { 0, __KERNEL_CS };
++} pci_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+-static int pci_bios_present;
++static int pci_bios_present __read_only;
+ 
+ static int __devinit check_pcibios(void)
+ {
+@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
+ 	unsigned long flags, pcibios_entry;
+ 
+ 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
+-		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
++		pci_indirect.address = pcibios_entry;
+ 
+ 		local_irq_save(flags);
+-		__asm__(
+-			"lcall *(%%edi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%edi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
+ 			  "=b" (ebx),
+ 			  "=c" (ecx)
+ 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
+-			  "D" (&pci_indirect)
++			  "D" (&pci_indirect),
++			  "r" (__PCIBIOS_DS)
+ 			: "memory");
+ 		local_irq_restore(flags);
+ 
+@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 8 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xff;
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_WORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 16 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xffff;
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
+  * Function table for BIOS32 access
+  */
+ 
+-static struct pci_raw_ops pci_bios_access = {
++static const struct pci_raw_ops pci_bios_access = {
+ 	.read =		pci_bios_read,
+ 	.write =	pci_bios_write
+ };
+@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
+  * Try to find PCI BIOS.
+  */
+ 
+-static struct pci_raw_ops * __devinit pci_find_bios(void)
++static const struct pci_raw_ops * __devinit pci_find_bios(void)
+ {
+ 	union bios32 *check;
+ 	unsigned char sum;
+@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
+ 
+ 	DBG("PCI: Fetching IRQ routing table... ");
+ 	__asm__("push %%es\n\t"
++		"movw %w8, %%ds\n\t"
+ 		"push %%ds\n\t"
+ 		"pop  %%es\n\t"
+-		"lcall *(%%esi); cld\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
+ 		"pop %%es\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
+ 		  "1" (0),
+ 		  "D" ((long) &opt),
+ 		  "S" (&pci_indirect),
+-		  "m" (opt)
++		  "m" (opt),
++		  "r" (__PCIBIOS_DS)
+ 		: "memory");
+ 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
+ 	if (ret & 0xff00)
+@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
+ {
+ 	int ret;
+ 
+-	__asm__("lcall *(%%esi); cld\n\t"
++	__asm__("movw %w5, %%ds\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
+ 		: "0" (PCIBIOS_SET_PCI_HW_INT),
+ 		  "b" ((dev->bus->number << 8) | dev->devfn),
+ 		  "c" ((irq << 8) | (pin + 10)),
+-		  "S" (&pci_indirect));
++		  "S" (&pci_indirect),
++		  "r" (__PCIBIOS_DS));
+ 	return !(ret & 0xff00);
+ }
+ EXPORT_SYMBOL(pcibios_set_irq_routing);
+diff -urNp linux-2.6.32.13/arch/x86/power/cpu.c linux-2.6.32.13/arch/x86/power/cpu.c
+--- linux-2.6.32.13/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/power/cpu.c	2010-05-15 13:21:14.274578804 -0400
+@@ -126,7 +126,7 @@ static void do_fpu_end(void)
+ static void fix_processor_context(void)
+ {
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 
+ 	set_tss_desc(cpu, t);	/*
+ 				 * This just modifies memory; should not be
+@@ -136,7 +136,9 @@ static void fix_processor_context(void)
+ 				 */
+ 
+ #ifdef CONFIG_X86_64
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
++	pax_close_kernel();
+ 
+ 	syscall_init();				/* This sets MSR_*STAR and related */
+ #endif
+diff -urNp linux-2.6.32.13/arch/x86/vdso/Makefile linux-2.6.32.13/arch/x86/vdso/Makefile
+--- linux-2.6.32.13/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/Makefile	2010-05-15 13:21:14.274578804 -0400
+@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
+ 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
+ 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
+ 
+-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+ GCOV_PROFILE := n
+ 
+ #
+diff -urNp linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c
+--- linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c	2010-05-15 13:21:14.274578804 -0400
+@@ -22,24 +22,48 @@
+ #include <asm/hpet.h>
+ #include <asm/unistd.h>
+ #include <asm/io.h>
++#include <asm/fixmap.h>
+ #include "vextern.h"
+ 
+ #define gtod vdso_vsyscall_gtod_data
+ 
++notrace noinline long __vdso_fallback_time(long *t)
++{
++	long secs;
++	asm volatile("syscall"
++		: "=a" (secs)
++		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
++	return secs;
++}
++
+ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+ {
+ 	long ret;
+ 	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
++	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
+ 	return ret;
+ }
+ 
++notrace static inline cycle_t __vdso_vread_hpet(void)
++{
++	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
++}
++
++notrace static inline cycle_t __vdso_vread_tsc(void)
++{
++	cycle_t ret = (cycle_t)vget_cycles();
++
++	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
++}
++
+ notrace static inline long vgetns(void)
+ {
+ 	long v;
+-	cycles_t (*vread)(void);
+-	vread = gtod->clock.vread;
+-	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
++	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
++		v = __vdso_vread_tsc();
++	else
++		v = __vdso_vread_hpet();
++	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
+ 	return (v * gtod->clock.mult) >> gtod->clock.shift;
+ }
+ 
+@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
+ 
+ notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
+ {
+-	if (likely(gtod->sysctl_enabled))
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
+ 		switch (clock) {
+ 		case CLOCK_REALTIME:
+ 			if (likely(gtod->clock.vread))
+@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
+ int clock_gettime(clockid_t, struct timespec *)
+ 	__attribute__((weak, alias("__vdso_clock_gettime")));
+ 
+-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
+ {
+ 	long ret;
+-	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
++	asm("syscall" : "=a" (ret) :
++	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
++	return ret;
++}
++
++notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++{
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
++	{
+ 		if (likely(tv != NULL)) {
+ 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
+ 				     offsetof(struct timespec, tv_nsec) ||
+@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
+ 		}
+ 		return 0;
+ 	}
+-	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+-	return ret;
++	return __vdso_fallback_gettimeofday(tv, tz);
+ }
+ int gettimeofday(struct timeval *, struct timezone *)
+ 	__attribute__((weak, alias("__vdso_gettimeofday")));
+diff -urNp linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c
+--- linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c	2010-05-15 13:21:14.274578804 -0400
+@@ -25,6 +25,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/vdso.h>
+ #include <asm/proto.h>
++#include <asm/mman.h>
+ 
+ enum {
+ 	VDSO_DISABLED = 0,
+@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
+ void enable_sep_cpu(void)
+ {
+ 	int cpu = get_cpu();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 
+ 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
+ 		put_cpu();
+@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
+ 	if (compat)
+ 		addr = VDSO_HIGH_BASE;
+ 	else {
+-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
+ 		if (IS_ERR_VALUE(addr)) {
+ 			ret = addr;
+ 			goto up_fail;
+ 		}
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	if (compat_uses_vma || !compat) {
+ 		/*
+@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
+ 	}
+ 
+ 	current_thread_info()->sysenter_return =
+-		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
++		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
+ 
+   up_fail:
+ 	if (ret)
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 
+ 	up_write(&mm->mmap_sem);
+ 
+@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table abi_root_table2[] = {
+@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
+ 		.mode = 0555,
+ 		.child = abi_table2
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static __init int ia32_binfmt_init(void)
+@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
++		return "[vdso]";
++#endif
++
+ 	return NULL;
+ }
+ 
+@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
+ 	struct mm_struct *mm = tsk->mm;
+ 
+ 	/* Check to see if this task was created in compat vdso mode */
+-	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
++	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
+ 		return &gate_vma;
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.13/arch/x86/vdso/vdso.lds.S linux-2.6.32.13/arch/x86/vdso/vdso.lds.S
+--- linux-2.6.32.13/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/vdso.lds.S	2010-05-15 13:21:14.274578804 -0400
+@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
+ #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
+ #include "vextern.h"
+ #undef	VEXTERN
++
++#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
++VEXTERN(fallback_gettimeofday)
++VEXTERN(fallback_time)
++VEXTERN(getcpu)
++#undef	VEXTERN
+diff -urNp linux-2.6.32.13/arch/x86/vdso/vextern.h linux-2.6.32.13/arch/x86/vdso/vextern.h
+--- linux-2.6.32.13/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/vextern.h	2010-05-15 13:21:14.274578804 -0400
+@@ -11,6 +11,5 @@
+    put into vextern.h and be referenced as a pointer with vdso prefix.
+    The main kernel later fills in the values.   */
+ 
+-VEXTERN(jiffies)
+ VEXTERN(vgetcpu_mode)
+ VEXTERN(vsyscall_gtod_data)
+diff -urNp linux-2.6.32.13/arch/x86/vdso/vma.c linux-2.6.32.13/arch/x86/vdso/vma.c
+--- linux-2.6.32.13/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/vdso/vma.c	2010-05-15 13:21:14.274578804 -0400
+@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
+ 	if (!vbase)
+ 		goto oom;
+ 
+-	if (memcmp(vbase, "\177ELF", 4)) {
++	if (memcmp(vbase, ELFMAG, SELFMAG)) {
+ 		printk("VDSO: I'm broken; not ELF\n");
+ 		vdso_enabled = 0;
+ 	}
+@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
+ 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
+ #include "vextern.h"
+ #undef VEXTERN
++	vunmap(vbase);
+ 	return 0;
+ 
+  oom:
+@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
+ 		goto up_fail;
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	ret = install_special_mapping(mm, addr, vdso_size,
+ 				      VM_READ|VM_EXEC|
+@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
+ 				      VM_ALWAYSDUMP,
+ 				      vdso_pages);
+ 	if (ret) {
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 		goto up_fail;
+ 	}
+ 
+@@ -132,10 +133,3 @@ up_fail:
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+-
+-static __init int vdso_setup(char *s)
+-{
+-	vdso_enabled = simple_strtoul(s, NULL, 0);
+-	return 0;
+-}
+-__setup("vdso=", vdso_setup);
+diff -urNp linux-2.6.32.13/arch/x86/xen/enlighten.c linux-2.6.32.13/arch/x86/xen/enlighten.c
+--- linux-2.6.32.13/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/xen/enlighten.c	2010-05-15 13:23:38.934774262 -0400
+@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
+ 
+ struct shared_info xen_dummy_shared_info;
+ 
+-void *xen_initial_gdt;
+-
+ /*
+  * Point at some empty memory to start with. We map the real shared_info
+  * page as soon as fixmap is up and running.
+@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
+ 
+ 	preempt_disable();
+ 
+-	start = __get_cpu_var(idt_desc).address;
++	start = (unsigned long)__get_cpu_var(idt_desc).address;
+ 	end = start + __get_cpu_var(idt_desc).size + 1;
+ 
+ 	xen_mc_flush();
+@@ -1102,6 +1100,16 @@ asmlinkage void __init xen_start_kernel(
+ #ifdef CONFIG_X86_64
+ 	/* Work out if we support NX */
+ 	check_efer();
++#elif defined(CONFIG_X86_PAE)
++	if (cpu_has_nx) {
++		unsigned l, h;
++
++		nx_enabled = 1;
++		__supported_pte_mask |= _PAGE_NX;
++		rdmsr(MSR_EFER, l, h);
++		l |= EFER_NX;
++		wrmsr(MSR_EFER, l, h);
++	}
+ #endif
+ 
+ 	xen_setup_features();
+@@ -1133,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(
+ 
+ 	machine_ops = xen_machine_ops;
+ 
+-	/*
+-	 * The only reliable way to retain the initial address of the
+-	 * percpu gdt_page is to remember it here, so we can go and
+-	 * mark it RW later, when the initial percpu area is freed.
+-	 */
+-	xen_initial_gdt = &per_cpu(gdt_page, 0);
+-
+ 	xen_smp_init();
+ 
+ 	pgd = (pgd_t *)xen_start_info->pt_base;
+diff -urNp linux-2.6.32.13/arch/x86/xen/mmu.c linux-2.6.32.13/arch/x86/xen/mmu.c
+--- linux-2.6.32.13/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/xen/mmu.c	2010-05-15 13:21:14.282910849 -0400
+@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	convert_pfn_mfn(init_level4_pgt);
+ 	convert_pfn_mfn(level3_ident_pgt);
+ 	convert_pfn_mfn(level3_kernel_pgt);
++	convert_pfn_mfn(level3_vmalloc_pgt);
++	convert_pfn_mfn(level3_vmemmap_pgt);
+ 
+ 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+ 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
++	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+ 
+diff -urNp linux-2.6.32.13/arch/x86/xen/smp.c linux-2.6.32.13/arch/x86/xen/smp.c
+--- linux-2.6.32.13/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/xen/smp.c	2010-05-15 13:21:14.282910849 -0400
+@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
+ {
+ 	BUG_ON(smp_processor_id() != 0);
+ 	native_smp_prepare_boot_cpu();
+-
+-	/* We've switched to the "real" per-cpu gdt, so make sure the
+-	   old memory can be recycled */
+-	make_lowmem_page_readwrite(xen_initial_gdt);
+-
+ 	xen_setup_vcpu_info_placement();
+ }
+ 
+@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
+ 	gdt = get_cpu_gdt_table(cpu);
+ 
+ 	ctxt->flags = VGCF_IN_KERNEL;
+-	ctxt->user_regs.ds = __USER_DS;
+-	ctxt->user_regs.es = __USER_DS;
++	ctxt->user_regs.ds = __KERNEL_DS;
++	ctxt->user_regs.es = __KERNEL_DS;
+ 	ctxt->user_regs.ss = __KERNEL_DS;
+ #ifdef CONFIG_X86_32
+ 	ctxt->user_regs.fs = __KERNEL_PERCPU;
+diff -urNp linux-2.6.32.13/arch/x86/xen/xen-head.S linux-2.6.32.13/arch/x86/xen/xen-head.S
+--- linux-2.6.32.13/arch/x86/xen/xen-head.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/xen/xen-head.S	2010-05-15 13:21:14.282910849 -0400
+@@ -19,6 +19,17 @@ ENTRY(startup_xen)
+ #ifdef CONFIG_X86_32
+ 	mov %esi,xen_start_info
+ 	mov $init_thread_union+THREAD_SIZE,%esp
++#ifdef CONFIG_SMP
++	movl $cpu_gdt_table,%edi
++	movl $__per_cpu_load,%eax
++	movw %ax,__KERNEL_PERCPU + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_PERCPU + 4(%edi)
++	movb %ah,__KERNEL_PERCPU + 7(%edi)
++	movl $__per_cpu_end - 1,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,__KERNEL_PERCPU + 0(%edi)
++#endif
+ #else
+ 	mov %rsi,xen_start_info
+ 	mov $init_thread_union+THREAD_SIZE,%rsp
+diff -urNp linux-2.6.32.13/arch/x86/xen/xen-ops.h linux-2.6.32.13/arch/x86/xen/xen-ops.h
+--- linux-2.6.32.13/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/arch/x86/xen/xen-ops.h	2010-05-15 13:21:14.282910849 -0400
+@@ -10,8 +10,6 @@
+ extern const char xen_hypervisor_callback[];
+ extern const char xen_failsafe_callback[];
+ 
+-extern void *xen_initial_gdt;
+-
+ struct trap_info;
+ void xen_copy_trap_info(struct trap_info *traps);
+ 
+diff -urNp linux-2.6.32.13/block/blk-integrity.c linux-2.6.32.13/block/blk-integrity.c
+--- linux-2.6.32.13/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/blk-integrity.c	2010-05-15 13:21:14.282910849 -0400
+@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops integrity_ops = {
++static const struct sysfs_ops integrity_ops = {
+ 	.show	= &integrity_attr_show,
+ 	.store	= &integrity_attr_store,
+ };
+diff -urNp linux-2.6.32.13/block/blk-iopoll.c linux-2.6.32.13/block/blk-iopoll.c
+--- linux-2.6.32.13/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/blk-iopoll.c	2010-05-15 13:21:14.282910849 -0400
+@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
+ }
+ EXPORT_SYMBOL(blk_iopoll_complete);
+ 
+-static void blk_iopoll_softirq(struct softirq_action *h)
++static void blk_iopoll_softirq(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
+ 	int rearm = 0, budget = blk_iopoll_budget;
+diff -urNp linux-2.6.32.13/block/blk-map.c linux-2.6.32.13/block/blk-map.c
+--- linux-2.6.32.13/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/blk-map.c	2010-05-15 13:21:14.282910849 -0400
+@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
+ 	 * direct dma. else, set up kernel bounce buffers
+ 	 */
+ 	uaddr = (unsigned long) ubuf;
+-	if (blk_rq_aligned(q, ubuf, len) && !map_data)
++	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
+ 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
+ 	else
+ 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
+@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
+ 	if (!len || !kbuf)
+ 		return -EINVAL;
+ 
+-	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
++	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
+ 	if (do_copy)
+ 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
+ 	else
+diff -urNp linux-2.6.32.13/block/blk-softirq.c linux-2.6.32.13/block/blk-softirq.c
+--- linux-2.6.32.13/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/blk-softirq.c	2010-05-15 13:21:14.282910849 -0400
+@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
+  * Softirq action handler - move entries to local list and loop over them
+  * while passing them to the queue registered handler.
+  */
+-static void blk_done_softirq(struct softirq_action *h)
++static void blk_done_softirq(void)
+ {
+ 	struct list_head *cpu_list, local_list;
+ 
+diff -urNp linux-2.6.32.13/block/blk-sysfs.c linux-2.6.32.13/block/blk-sysfs.c
+--- linux-2.6.32.13/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/blk-sysfs.c	2010-05-15 13:21:14.282910849 -0400
+@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
+ 	kmem_cache_free(blk_requestq_cachep, q);
+ }
+ 
+-static struct sysfs_ops queue_sysfs_ops = {
++static const struct sysfs_ops queue_sysfs_ops = {
+ 	.show	= queue_attr_show,
+ 	.store	= queue_attr_store,
+ };
+diff -urNp linux-2.6.32.13/block/elevator.c linux-2.6.32.13/block/elevator.c
+--- linux-2.6.32.13/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/block/elevator.c	2010-05-15 13:21:14.282910849 -0400
+@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
+ 	return error;
+ }
+ 
+-static struct sysfs_ops elv_sysfs_ops = {
++static const struct sysfs_ops elv_sysfs_ops = {
+ 	.show	= elv_attr_show,
+ 	.store	= elv_attr_store,
+ };
+diff -urNp linux-2.6.32.13/crypto/lrw.c linux-2.6.32.13/crypto/lrw.c
+--- linux-2.6.32.13/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/crypto/lrw.c	2010-05-15 13:21:14.282910849 -0400
+@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
+ 	struct priv *ctx = crypto_tfm_ctx(parent);
+ 	struct crypto_cipher *child = ctx->child;
+ 	int err, i;
+-	be128 tmp = { 0 };
++	be128 tmp = { 0, 0 };
+ 	int bsize = crypto_cipher_blocksize(child);
+ 
+ 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
+diff -urNp linux-2.6.32.13/Documentation/dontdiff linux-2.6.32.13/Documentation/dontdiff
+--- linux-2.6.32.13/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/Documentation/dontdiff	2010-05-15 13:21:14.282910849 -0400
+@@ -3,6 +3,7 @@
+ *.bin
+ *.cpio
+ *.csp
++*.dbg
+ *.dsp
+ *.dvi
+ *.elf
+@@ -40,6 +41,7 @@
+ *.ver
+ *.xml
+ *_MODULES
++*_reg_safe.h
+ *_vga16.c
+ *~
+ *.9
+@@ -49,11 +51,16 @@
+ 53c700_d.h
+ CVS
+ ChangeSet
++GPATH
++GRTAGS
++GSYMS
++GTAGS
+ Image
+ Kerntypes
+ Module.markers
+ Module.symvers
+ PENDING
++PERF*
+ SCCS
+ System.map*
+ TAGS
+@@ -76,7 +83,10 @@ btfixupprep
+ build
+ bvmlinux
+ bzImage*
++capflags.c
+ classlist.h*
++clut_vga16.c
++common-cmds.h
+ comp*.log
+ compile.h*
+ conf
+@@ -103,13 +113,14 @@ gen_crc32table
+ gen_init_cpio
+ genksyms
+ *_gray256.c
++hash
+ ihex2fw
+ ikconfig.h*
+ initramfs_data.cpio
++initramfs_data.cpio.bz2
+ initramfs_data.cpio.gz
+ initramfs_list
+ kallsyms
+-kconfig
+ keywords.c
+ ksym.c*
+ ksym.h*
+@@ -133,7 +144,9 @@ mkboot
+ mkbugboot
+ mkcpustr
+ mkdep
++mkpiggy
+ mkprep
++mkregtable
+ mktables
+ mktree
+ modpost
+@@ -149,6 +162,7 @@ patches*
+ pca200e.bin
+ pca200e_ecd.bin2
+ piggy.gz
++piggy.S
+ piggyback
+ pnmtologo
+ ppc_defs.h*
+@@ -163,6 +177,7 @@ setup
+ setup.bin
+ setup.elf
+ sImage
++slabinfo
+ sm_tbl*
+ split-include
+ syscalltab.h
+@@ -186,14 +201,20 @@ version.h*
+ vmlinux
+ vmlinux-*
+ vmlinux.aout
++vmlinux.bin.all
++vmlinux.bin.bz2
+ vmlinux.lds
++vmlinux.relocs
++voffset.h
+ vsyscall.lds
+ vsyscall_32.lds
+ wanxlfw.inc
+ uImage
+ unifdef
++utsrelease.h
+ wakeup.bin
+ wakeup.elf
+ wakeup.lds
+ zImage*
+ zconf.hash.c
++zoffset.h
+diff -urNp linux-2.6.32.13/Documentation/kernel-parameters.txt linux-2.6.32.13/Documentation/kernel-parameters.txt
+--- linux-2.6.32.13/Documentation/kernel-parameters.txt	2010-05-15 13:20:18.374565913 -0400
++++ linux-2.6.32.13/Documentation/kernel-parameters.txt	2010-05-15 13:21:14.282910849 -0400
+@@ -1836,6 +1836,12 @@ and is between 256 and 4096 characters. 
+ 			the specified number of seconds.  This is to be used if
+ 			your oopses keep scrolling off the screen.
+ 
++	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
++			virtualization environments that don't cope well with the
++			expand down segment used by UDEREF on X86-32.
++
++	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
++
+ 	pcbit=		[HW,ISDN]
+ 
+ 	pcd.		[PARIDE]
+diff -urNp linux-2.6.32.13/drivers/acpi/battery.c linux-2.6.32.13/drivers/acpi/battery.c
+--- linux-2.6.32.13/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/battery.c	2010-05-15 13:21:14.282910849 -0400
+@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
+ 	}
+ 
+ static struct battery_file {
+-	struct file_operations ops;
++	const struct file_operations ops;
+ 	mode_t mode;
+ 	const char *name;
+ } acpi_battery_file[] = {
+diff -urNp linux-2.6.32.13/drivers/acpi/blacklist.c linux-2.6.32.13/drivers/acpi/blacklist.c
+--- linux-2.6.32.13/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/blacklist.c	2010-05-15 13:21:14.295422110 -0400
+@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
+ 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
+ 	 "Incorrect _ADR", 1},
+ 
+-	{""}
++	{"", "", 0, NULL, all_versions, NULL, 0}
+ };
+ 
+ #if	CONFIG_ACPI_BLACKLIST_YEAR
+diff -urNp linux-2.6.32.13/drivers/acpi/dock.c linux-2.6.32.13/drivers/acpi/dock.c
+--- linux-2.6.32.13/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/dock.c	2010-05-15 13:21:14.298962418 -0400
+@@ -77,7 +77,7 @@ struct dock_dependent_device {
+ 	struct list_head list;
+ 	struct list_head hotplug_list;
+ 	acpi_handle handle;
+-	struct acpi_dock_ops *ops;
++	const struct acpi_dock_ops *ops;
+ 	void *context;
+ };
+ 
+@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
+  * the dock driver after _DCK is executed.
+  */
+ int
+-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
++register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
+ 			     void *context)
+ {
+ 	struct dock_dependent_device *dd;
+diff -urNp linux-2.6.32.13/drivers/acpi/osl.c linux-2.6.32.13/drivers/acpi/osl.c
+--- linux-2.6.32.13/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/osl.c	2010-05-15 13:21:14.298962418 -0400
+@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 	if (!value)
+ 		value = &dummy;
+ 
+@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 
+ 	switch (width) {
+ 	case 8:
+diff -urNp linux-2.6.32.13/drivers/acpi/power_meter.c linux-2.6.32.13/drivers/acpi/power_meter.c
+--- linux-2.6.32.13/drivers/acpi/power_meter.c	2010-05-15 13:20:18.454567530 -0400
++++ linux-2.6.32.13/drivers/acpi/power_meter.c	2010-05-15 13:21:14.298962418 -0400
+@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
+ 		return res;
+ 
+ 	temp /= 1000;
+-	if (temp < 0)
+-		return -EINVAL;
+ 
+ 	mutex_lock(&resource->lock);
+ 	resource->trip[attr->index - 7] = temp;
+diff -urNp linux-2.6.32.13/drivers/acpi/proc.c linux-2.6.32.13/drivers/acpi/proc.c
+--- linux-2.6.32.13/drivers/acpi/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/proc.c	2010-05-15 13:21:14.307002164 -0400
+@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
+ 				size_t count, loff_t * ppos)
+ {
+ 	struct list_head *node, *next;
+-	char strbuf[5];
+-	char str[5] = "";
+-	unsigned int len = count;
++	char strbuf[5] = {0};
+ 	struct acpi_device *found_dev = NULL;
+ 
+-	if (len > 4)
+-		len = 4;
+-	if (len < 0)
+-		return -EFAULT;
++	if (count > 4)
++		count = 4;
+ 
+-	if (copy_from_user(strbuf, buffer, len))
++	if (copy_from_user(strbuf, buffer, count))
+ 		return -EFAULT;
+-	strbuf[len] = '\0';
+-	sscanf(strbuf, "%s", str);
++	strbuf[count] = '\0';
+ 
+ 	mutex_lock(&acpi_device_lock);
+ 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
+@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
+ 		if (!dev->wakeup.flags.valid)
+ 			continue;
+ 
+-		if (!strncmp(dev->pnp.bus_id, str, 4)) {
++		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
+ 			dev->wakeup.state.enabled =
+ 			    dev->wakeup.state.enabled ? 0 : 1;
+ 			found_dev = dev;
+diff -urNp linux-2.6.32.13/drivers/acpi/processor_core.c linux-2.6.32.13/drivers/acpi/processor_core.c
+--- linux-2.6.32.13/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/processor_core.c	2010-05-15 13:21:14.307002164 -0400
+@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
+ 		return 0;
+ 	}
+ 
+-	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
++	BUG_ON(pr->id >= nr_cpu_ids);
+ 
+ 	/*
+ 	 * Buggy BIOS check
+diff -urNp linux-2.6.32.13/drivers/acpi/processor_idle.c linux-2.6.32.13/drivers/acpi/processor_idle.c
+--- linux-2.6.32.13/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/processor_idle.c	2010-05-15 13:21:14.330926828 -0400
+@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
+ 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+ 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
+ 	 (void *)1},
+-	{},
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
+ };
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/acpi/sleep.c linux-2.6.32.13/drivers/acpi/sleep.c
+--- linux-2.6.32.13/drivers/acpi/sleep.c	2010-05-15 13:20:18.454567530 -0400
++++ linux-2.6.32.13/drivers/acpi/sleep.c	2010-05-15 13:21:14.330926828 -0400
+@@ -302,7 +302,7 @@ static int acpi_suspend_state_valid(susp
+ 	}
+ }
+ 
+-static struct platform_suspend_ops acpi_suspend_ops = {
++static const struct platform_suspend_ops acpi_suspend_ops = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin,
+ 	.prepare_late = acpi_pm_prepare,
+@@ -330,7 +330,7 @@ static int acpi_suspend_begin_old(suspen
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_suspend_ops acpi_suspend_ops_old = {
++static const struct platform_suspend_ops acpi_suspend_ops_old = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin_old,
+ 	.prepare_late = acpi_pm_disable_gpes,
+@@ -701,7 +701,7 @@ static void acpi_pm_enable_gpes(void)
+ 	acpi_enable_all_runtime_gpes();
+ }
+ 
+-static struct platform_hibernation_ops acpi_hibernation_ops = {
++static const struct platform_hibernation_ops acpi_hibernation_ops = {
+ 	.begin = acpi_hibernation_begin,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot,
+@@ -754,7 +754,7 @@ static int acpi_hibernation_pre_snapshot
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_hibernation_ops acpi_hibernation_ops_old = {
++static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
+ 	.begin = acpi_hibernation_begin_old,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
+diff -urNp linux-2.6.32.13/drivers/acpi/video.c linux-2.6.32.13/drivers/acpi/video.c
+--- linux-2.6.32.13/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/acpi/video.c	2010-05-15 13:21:14.330926828 -0400
+@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
+ 				vd->brightness->levels[request_level]);
+ }
+ 
+-static struct backlight_ops acpi_backlight_ops = {
++static const struct backlight_ops acpi_backlight_ops = {
+ 	.get_brightness = acpi_video_get_brightness,
+ 	.update_status  = acpi_video_set_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/ahci.c linux-2.6.32.13/drivers/ata/ahci.c
+--- linux-2.6.32.13/drivers/ata/ahci.c	2010-04-29 17:49:37.661448235 -0400
++++ linux-2.6.32.13/drivers/ata/ahci.c	2010-05-15 13:21:14.374114367 -0400
+@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
+ 	.sdev_attrs		= ahci_sdev_attrs,
+ };
+ 
+-static struct ata_port_operations ahci_ops = {
++static const struct ata_port_operations ahci_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
+@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
+ 	.port_stop		= ahci_port_stop,
+ };
+ 
+-static struct ata_port_operations ahci_vt8251_ops = {
++static const struct ata_port_operations ahci_vt8251_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_vt8251_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_p5wdh_ops = {
++static const struct ata_port_operations ahci_p5wdh_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_p5wdh_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_sb600_ops = {
++static const struct ata_port_operations ahci_sb600_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.softreset		= ahci_sb600_softreset,
+ 	.pmp_softreset		= ahci_sb600_softreset,
+@@ -687,7 +687,7 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
+ 
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/ata/ata_generic.c linux-2.6.32.13/drivers/ata/ata_generic.c
+--- linux-2.6.32.13/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/ata_generic.c	2010-05-15 13:21:14.387424242 -0400
+@@ -95,7 +95,7 @@ static struct scsi_host_template generic
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations generic_port_ops = {
++static const struct ata_port_operations generic_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_mode	= generic_set_mode,
+diff -urNp linux-2.6.32.13/drivers/ata/ata_piix.c linux-2.6.32.13/drivers/ata/ata_piix.c
+--- linux-2.6.32.13/drivers/ata/ata_piix.c	2010-04-29 17:49:37.669446700 -0400
++++ linux-2.6.32.13/drivers/ata/ata_piix.c	2010-05-15 13:21:14.387424242 -0400
+@@ -299,7 +299,7 @@ static const struct pci_device_id piix_p
+ 	{ 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (CPT) */
+ 	{ 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ static struct pci_driver piix_pci_driver = {
+@@ -317,7 +317,7 @@ static struct scsi_host_template piix_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations piix_pata_ops = {
++static const struct ata_port_operations piix_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= piix_set_piomode,
+@@ -325,22 +325,22 @@ static struct ata_port_operations piix_p
+ 	.prereset		= piix_pata_prereset,
+ };
+ 
+-static struct ata_port_operations piix_vmw_ops = {
++static const struct ata_port_operations piix_vmw_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.bmdma_status		= piix_vmw_bmdma_status,
+ };
+ 
+-static struct ata_port_operations ich_pata_ops = {
++static const struct ata_port_operations ich_pata_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.cable_detect		= ich_pata_cable_detect,
+ 	.set_dmamode		= ich_set_dmamode,
+ };
+ 
+-static struct ata_port_operations piix_sata_ops = {
++static const struct ata_port_operations piix_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ };
+ 
+-static struct ata_port_operations piix_sidpr_sata_ops = {
++static const struct ata_port_operations piix_sidpr_sata_ops = {
+ 	.inherits		= &piix_sata_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= piix_sidpr_scr_read,
+@@ -616,7 +616,7 @@ static const struct ich_laptop ich_lapto
+ 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
+ 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
+ 	/* end marker */
+-	{ 0, }
++	{ 0, 0, 0 }
+ };
+ 
+ /**
+@@ -1094,7 +1094,7 @@ static int piix_broken_suspend(void)
+ 			},
+ 		},
+ 
+-		{ }	/* terminate list */
++		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
+ 	};
+ 	static const char *oemstrs[] = {
+ 		"Tecra M3,",
+diff -urNp linux-2.6.32.13/drivers/ata/libata-acpi.c linux-2.6.32.13/drivers/ata/libata-acpi.c
+--- linux-2.6.32.13/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/libata-acpi.c	2010-05-15 13:21:14.387424242 -0400
+@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
+ 	ata_acpi_uevent(dev->link->ap, dev, event);
+ }
+ 
+-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
+ 	.handler = ata_acpi_dev_notify_dock,
+ 	.uevent = ata_acpi_dev_uevent,
+ };
+ 
+-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
+ 	.handler = ata_acpi_ap_notify_dock,
+ 	.uevent = ata_acpi_ap_uevent,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/libata-core.c linux-2.6.32.13/drivers/ata/libata-core.c
+--- linux-2.6.32.13/drivers/ata/libata-core.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.13/drivers/ata/libata-core.c	2010-05-15 13:21:14.390775531 -0400
+@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
+ 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
+ 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
+ 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
+-	{ -1, },
++	{ -1, 0, 0 }
+ };
+ 
+ /**
+@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
+ 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
+ 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
+ 
+-	{ 0xFF }
++	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
+@@ -4388,7 +4388,7 @@ static const struct ata_blacklist_entry 
+ 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
+ 
+ 	/* End Marker */
+-	{ }
++	{ NULL, NULL, 0 }
+ };
+ 
+ static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
+@@ -5964,7 +5964,7 @@ static void ata_host_stop(struct device 
+  *	LOCKING:
+  *	None.
+  */
+-static void ata_finalize_port_ops(struct ata_port_operations *ops)
++static void ata_finalize_port_ops(const struct ata_port_operations *ops)
+ {
+ 	static DEFINE_SPINLOCK(lock);
+ 	const struct ata_port_operations *cur;
+@@ -5976,6 +5976,7 @@ static void ata_finalize_port_ops(struct
+ 		return;
+ 
+ 	spin_lock(&lock);
++	pax_open_kernel();
+ 
+ 	for (cur = ops->inherits; cur; cur = cur->inherits) {
+ 		void **inherit = (void **)cur;
+@@ -5989,8 +5990,9 @@ static void ata_finalize_port_ops(struct
+ 		if (IS_ERR(*pp))
+ 			*pp = NULL;
+ 
+-	ops->inherits = NULL;
++	((struct ata_port_operations *)ops)->inherits = NULL;
+ 
++	pax_close_kernel();
+ 	spin_unlock(&lock);
+ }
+ 
+@@ -6087,7 +6089,7 @@ int ata_host_start(struct ata_host *host
+  */
+ /* KILLME - the only user left is ipr */
+ void ata_host_init(struct ata_host *host, struct device *dev,
+-		   unsigned long flags, struct ata_port_operations *ops)
++		   unsigned long flags, const struct ata_port_operations *ops)
+ {
+ 	spin_lock_init(&host->lock);
+ 	host->dev = dev;
+@@ -6750,7 +6752,7 @@ static void ata_dummy_error_handler(stru
+ 	/* truly dummy */
+ }
+ 
+-struct ata_port_operations ata_dummy_port_ops = {
++const struct ata_port_operations ata_dummy_port_ops = {
+ 	.qc_prep		= ata_noop_qc_prep,
+ 	.qc_issue		= ata_dummy_qc_issue,
+ 	.error_handler		= ata_dummy_error_handler,
+diff -urNp linux-2.6.32.13/drivers/ata/libata-eh.c linux-2.6.32.13/drivers/ata/libata-eh.c
+--- linux-2.6.32.13/drivers/ata/libata-eh.c	2010-05-15 13:20:18.462978524 -0400
++++ linux-2.6.32.13/drivers/ata/libata-eh.c	2010-05-15 13:21:14.390775531 -0400
+@@ -3586,7 +3586,7 @@ void ata_do_eh(struct ata_port *ap, ata_
+  */
+ void ata_std_error_handler(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	ata_reset_fn_t hardreset = ops->hardreset;
+ 
+ 	/* ignore built-in hardreset if SCR access is not available */
+diff -urNp linux-2.6.32.13/drivers/ata/libata-pmp.c linux-2.6.32.13/drivers/ata/libata-pmp.c
+--- linux-2.6.32.13/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/libata-pmp.c	2010-05-15 13:21:14.390775531 -0400
+@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
+  */
+ static int sata_pmp_eh_recover(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
+ 	struct ata_link *pmp_link = &ap->link;
+ 	struct ata_device *pmp_dev = pmp_link->device;
+diff -urNp linux-2.6.32.13/drivers/ata/pata_acpi.c linux-2.6.32.13/drivers/ata/pata_acpi.c
+--- linux-2.6.32.13/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_acpi.c	2010-05-15 13:21:14.390775531 -0400
+@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pacpi_ops = {
++static const struct ata_port_operations pacpi_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= pacpi_qc_issue,
+ 	.cable_detect		= pacpi_cable_detect,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_ali.c linux-2.6.32.13/drivers/ata/pata_ali.c
+--- linux-2.6.32.13/drivers/ata/pata_ali.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.13/drivers/ata/pata_ali.c	2010-05-15 13:21:14.402931362 -0400
+@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
+  *	Port operations for PIO only ALi
+  */
+ 
+-static struct ata_port_operations ali_early_port_ops = {
++static const struct ata_port_operations ali_early_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= ali_set_piomode,
+@@ -382,7 +382,7 @@ static const struct ata_port_operations 
+  *	Port operations for DMA capable ALi without cable
+  *	detect
+  */
+-static struct ata_port_operations ali_20_port_ops = {
++static const struct ata_port_operations ali_20_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.mode_filter	= ali_20_filter,
+@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c2_port_ops = {
++static const struct ata_port_operations ali_c2_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c4_port_ops = {
++static const struct ata_port_operations ali_c4_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
+ /*
+  *	Port operations for DMA capable ALi with cable detect and LBA48
+  */
+-static struct ata_port_operations ali_c5_port_ops = {
++static const struct ata_port_operations ali_c5_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.dev_config	= ali_warn_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_amd.c linux-2.6.32.13/drivers/ata/pata_amd.c
+--- linux-2.6.32.13/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_amd.c	2010-05-15 13:21:14.402931362 -0400
+@@ -397,28 +397,28 @@ static const struct ata_port_operations 
+ 	.prereset	= amd_pre_reset,
+ };
+ 
+-static struct ata_port_operations amd33_port_ops = {
++static const struct ata_port_operations amd33_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= amd33_set_piomode,
+ 	.set_dmamode	= amd33_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd66_port_ops = {
++static const struct ata_port_operations amd66_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd66_set_piomode,
+ 	.set_dmamode	= amd66_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd100_port_ops = {
++static const struct ata_port_operations amd100_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd100_set_piomode,
+ 	.set_dmamode	= amd100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd133_port_ops = {
++static const struct ata_port_operations amd133_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= amd_cable_detect,
+ 	.set_piomode	= amd133_set_piomode,
+@@ -433,13 +433,13 @@ static const struct ata_port_operations 
+ 	.host_stop	= nv_host_stop,
+ };
+ 
+-static struct ata_port_operations nv100_port_ops = {
++static const struct ata_port_operations nv100_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv100_set_piomode,
+ 	.set_dmamode	= nv100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations nv133_port_ops = {
++static const struct ata_port_operations nv133_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv133_set_piomode,
+ 	.set_dmamode	= nv133_set_dmamode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_artop.c linux-2.6.32.13/drivers/ata/pata_artop.c
+--- linux-2.6.32.13/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_artop.c	2010-05-15 13:21:14.402931362 -0400
+@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations artop6210_ops = {
++static const struct ata_port_operations artop6210_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= artop6210_set_piomode,
+@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
+ 	.qc_defer		= artop6210_qc_defer,
+ };
+ 
+-static struct ata_port_operations artop6260_ops = {
++static const struct ata_port_operations artop6260_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= artop6260_cable_detect,
+ 	.set_piomode		= artop6260_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_at32.c linux-2.6.32.13/drivers/ata/pata_at32.c
+--- linux-2.6.32.13/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_at32.c	2010-05-15 13:21:14.402931362 -0400
+@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations at32_port_ops = {
++static const struct ata_port_operations at32_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= pata_at32_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_at91.c linux-2.6.32.13/drivers/ata/pata_at91.c
+--- linux-2.6.32.13/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_at91.c	2010-05-15 13:21:14.402931362 -0400
+@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_at91_port_ops = {
++static const struct ata_port_operations pata_at91_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 
+ 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_atiixp.c linux-2.6.32.13/drivers/ata/pata_atiixp.c
+--- linux-2.6.32.13/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_atiixp.c	2010-05-15 13:21:14.444201793 -0400
+@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations atiixp_port_ops = {
++static const struct ata_port_operations atiixp_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_atp867x.c linux-2.6.32.13/drivers/ata/pata_atp867x.c
+--- linux-2.6.32.13/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_atp867x.c	2010-05-15 13:21:14.451300458 -0400
+@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations atp867x_ops = {
++static const struct ata_port_operations atp867x_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= atp867x_cable_detect,
+ 	.set_piomode		= atp867x_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_bf54x.c linux-2.6.32.13/drivers/ata/pata_bf54x.c
+--- linux-2.6.32.13/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_bf54x.c	2010-05-15 13:21:14.451300458 -0400
+@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations bfin_pata_ops = {
++static const struct ata_port_operations bfin_pata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.set_piomode		= bfin_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cmd640.c linux-2.6.32.13/drivers/ata/pata_cmd640.c
+--- linux-2.6.32.13/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cmd640.c	2010-05-15 13:21:14.451300458 -0400
+@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cmd640_port_ops = {
++static const struct ata_port_operations cmd640_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cmd64x.c linux-2.6.32.13/drivers/ata/pata_cmd64x.c
+--- linux-2.6.32.13/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cmd64x.c	2010-05-15 13:21:14.451300458 -0400
+@@ -275,18 +275,18 @@ static const struct ata_port_operations 
+ 	.set_dmamode	= cmd64x_set_dmamode,
+ };
+ 
+-static struct ata_port_operations cmd64x_port_ops = {
++static const struct ata_port_operations cmd64x_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd646r1_port_ops = {
++static const struct ata_port_operations cmd646r1_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd646r1_bmdma_stop,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd648_port_ops = {
++static const struct ata_port_operations cmd648_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd648_bmdma_stop,
+ 	.cable_detect	= cmd648_cable_detect,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5520.c linux-2.6.32.13/drivers/ata/pata_cs5520.c
+--- linux-2.6.32.13/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cs5520.c	2010-05-15 13:21:14.475033843 -0400
+@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5520_port_ops = {
++static const struct ata_port_operations cs5520_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_prep		= ata_sff_dumb_qc_prep,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5530.c linux-2.6.32.13/drivers/ata/pata_cs5530.c
+--- linux-2.6.32.13/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cs5530.c	2010-05-15 13:21:14.487977689 -0400
+@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5530_port_ops = {
++static const struct ata_port_operations cs5530_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5535.c linux-2.6.32.13/drivers/ata/pata_cs5535.c
+--- linux-2.6.32.13/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cs5535.c	2010-05-15 13:21:14.487977689 -0400
+@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5535_port_ops = {
++static const struct ata_port_operations cs5535_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= cs5535_cable_detect,
+ 	.set_piomode	= cs5535_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5536.c linux-2.6.32.13/drivers/ata/pata_cs5536.c
+--- linux-2.6.32.13/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cs5536.c	2010-05-15 13:21:14.487977689 -0400
+@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5536_port_ops = {
++static const struct ata_port_operations cs5536_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= cs5536_cable_detect,
+ 	.set_piomode		= cs5536_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_cypress.c linux-2.6.32.13/drivers/ata/pata_cypress.c
+--- linux-2.6.32.13/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_cypress.c	2010-05-15 13:21:14.487977689 -0400
+@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cy82c693_port_ops = {
++static const struct ata_port_operations cy82c693_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= cy82c693_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_efar.c linux-2.6.32.13/drivers/ata/pata_efar.c
+--- linux-2.6.32.13/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_efar.c	2010-05-15 13:21:14.487977689 -0400
+@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations efar_ops = {
++static const struct ata_port_operations efar_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= efar_cable_detect,
+ 	.set_piomode		= efar_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt366.c linux-2.6.32.13/drivers/ata/pata_hpt366.c
+--- linux-2.6.32.13/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_hpt366.c	2010-05-15 13:21:14.487977689 -0400
+@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
+  *	Configuration for HPT366/68
+  */
+ 
+-static struct ata_port_operations hpt366_port_ops = {
++static const struct ata_port_operations hpt366_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= hpt36x_cable_detect,
+ 	.mode_filter	= hpt366_filter,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt37x.c linux-2.6.32.13/drivers/ata/pata_hpt37x.c
+--- linux-2.6.32.13/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_hpt37x.c	2010-05-15 13:21:14.490951596 -0400
+@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
+  *	Configuration for HPT370
+  */
+ 
+-static struct ata_port_operations hpt370_port_ops = {
++static const struct ata_port_operations hpt370_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt370_bmdma_stop,
+@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
+  *	Configuration for HPT370A. Close to 370 but less filters
+  */
+ 
+-static struct ata_port_operations hpt370a_port_ops = {
++static const struct ata_port_operations hpt370a_port_ops = {
+ 	.inherits	= &hpt370_port_ops,
+ 	.mode_filter	= hpt370a_filter,
+ };
+@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
+  *	and DMA mode setting functionality.
+  */
+ 
+-static struct ata_port_operations hpt372_port_ops = {
++static const struct ata_port_operations hpt372_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt37x_bmdma_stop,
+@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
+  *	but we have a different cable detection procedure for function 1.
+  */
+ 
+-static struct ata_port_operations hpt374_fn1_port_ops = {
++static const struct ata_port_operations hpt374_fn1_port_ops = {
+ 	.inherits	= &hpt372_port_ops,
+ 	.prereset	= hpt374_fn1_pre_reset,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c
+--- linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c	2010-05-15 13:21:14.498954899 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
+  *	Configuration for HPT3x2n.
+  */
+ 
+-static struct ata_port_operations hpt3x2n_port_ops = {
++static const struct ata_port_operations hpt3x2n_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt3x2n_bmdma_stop,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt3x3.c linux-2.6.32.13/drivers/ata/pata_hpt3x3.c
+--- linux-2.6.32.13/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_hpt3x3.c	2010-05-15 13:21:14.498954899 -0400
+@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations hpt3x3_port_ops = {
++static const struct ata_port_operations hpt3x3_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= hpt3x3_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_icside.c linux-2.6.32.13/drivers/ata/pata_icside.c
+--- linux-2.6.32.13/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_icside.c	2010-05-15 13:21:14.498954899 -0400
+@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
+ 	}
+ }
+ 
+-static struct ata_port_operations pata_icside_port_ops = {
++static const struct ata_port_operations pata_icside_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	/* no need to build any PRD tables for DMA */
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_isapnp.c linux-2.6.32.13/drivers/ata/pata_isapnp.c
+--- linux-2.6.32.13/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_isapnp.c	2010-05-15 13:21:14.498954899 -0400
+@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations isapnp_port_ops = {
++static const struct ata_port_operations isapnp_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations isapnp_noalt_port_ops = {
++static const struct ata_port_operations isapnp_noalt_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	/* No altstatus so we don't want to use the lost interrupt poll */
+diff -urNp linux-2.6.32.13/drivers/ata/pata_it8213.c linux-2.6.32.13/drivers/ata/pata_it8213.c
+--- linux-2.6.32.13/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_it8213.c	2010-05-15 13:21:14.498954899 -0400
+@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
+ };
+ 
+ 
+-static struct ata_port_operations it8213_ops = {
++static const struct ata_port_operations it8213_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= it8213_cable_detect,
+ 	.set_piomode		= it8213_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_it821x.c linux-2.6.32.13/drivers/ata/pata_it821x.c
+--- linux-2.6.32.13/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_it821x.c	2010-05-15 13:21:14.498954899 -0400
+@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations it821x_smart_port_ops = {
++static const struct ata_port_operations it821x_smart_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_passthru_port_ops = {
++static const struct ata_port_operations it821x_passthru_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_rdc_port_ops = {
++static const struct ata_port_operations it821x_rdc_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c
+--- linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c	2010-05-15 13:21:14.498954899 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ixp4xx_port_ops = {
++static const struct ata_port_operations ixp4xx_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_jmicron.c linux-2.6.32.13/drivers/ata/pata_jmicron.c
+--- linux-2.6.32.13/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_jmicron.c	2010-05-15 13:21:14.502920623 -0400
+@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations jmicron_ops = {
++static const struct ata_port_operations jmicron_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= jmicron_pre_reset,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_legacy.c linux-2.6.32.13/drivers/ata/pata_legacy.c
+--- linux-2.6.32.13/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_legacy.c	2010-05-15 13:21:14.502920623 -0400
+@@ -106,7 +106,7 @@ struct legacy_probe {
+ 
+ struct legacy_controller {
+ 	const char *name;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned int pio_mask;
+ 	unsigned int flags;
+ 	unsigned int pflags;
+@@ -223,12 +223,12 @@ static const struct ata_port_operations 
+  *	pio_mask as well.
+  */
+ 
+-static struct ata_port_operations simple_port_ops = {
++static const struct ata_port_operations simple_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+ 
+-static struct ata_port_operations legacy_port_ops = {
++static const struct ata_port_operations legacy_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.set_mode	= legacy_set_mode,
+@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
+ 	return buflen;
+ }
+ 
+-static struct ata_port_operations pdc20230_port_ops = {
++static const struct ata_port_operations pdc20230_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= pdc20230_set_piomode,
+ 	.sff_data_xfer	= pdc_data_xfer_vlb,
+@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560a_port_ops = {
++static const struct ata_port_operations ht6560a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560a_set_piomode,
+ };
+@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560b_port_ops = {
++static const struct ata_port_operations ht6560b_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560b_set_piomode,
+ };
+@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
+ }
+ 
+ 
+-static struct ata_port_operations opti82c611a_port_ops = {
++static const struct ata_port_operations opti82c611a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c611a_set_piomode,
+ };
+@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
+ 	return ata_sff_qc_issue(qc);
+ }
+ 
+-static struct ata_port_operations opti82c46x_port_ops = {
++static const struct ata_port_operations opti82c46x_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c46x_set_piomode,
+ 	.qc_issue	= opti82c46x_qc_issue,
+@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6500_set_piomode,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580dp_port_ops = {
++static const struct ata_port_operations qdi6580dp_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580dp_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= winbond_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
+ 	int pio_modes = controller->pio_mask;
+ 	unsigned long io = probe->port;
+ 	u32 mask = (1 << probe->slot);
+-	struct ata_port_operations *ops = controller->ops;
++	const struct ata_port_operations *ops = controller->ops;
+ 	struct legacy_data *ld = &legacy_data[probe->slot];
+ 	struct ata_host *host = NULL;
+ 	struct ata_port *ap;
+diff -urNp linux-2.6.32.13/drivers/ata/pata_marvell.c linux-2.6.32.13/drivers/ata/pata_marvell.c
+--- linux-2.6.32.13/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_marvell.c	2010-05-15 13:21:14.502920623 -0400
+@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations marvell_ops = {
++static const struct ata_port_operations marvell_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= marvell_cable_detect,
+ 	.prereset		= marvell_pre_reset,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_mpc52xx.c linux-2.6.32.13/drivers/ata/pata_mpc52xx.c
+--- linux-2.6.32.13/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_mpc52xx.c	2010-05-15 13:21:14.515739682 -0400
+@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpc52xx_ata_port_ops = {
++static const struct ata_port_operations mpc52xx_ata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_dev_select		= mpc52xx_ata_dev_select,
+ 	.set_piomode		= mpc52xx_ata_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_mpiix.c linux-2.6.32.13/drivers/ata/pata_mpiix.c
+--- linux-2.6.32.13/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_mpiix.c	2010-05-15 13:21:14.515739682 -0400
+@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpiix_port_ops = {
++static const struct ata_port_operations mpiix_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= mpiix_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_netcell.c linux-2.6.32.13/drivers/ata/pata_netcell.c
+--- linux-2.6.32.13/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_netcell.c	2010-05-15 13:21:14.515739682 -0400
+@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations netcell_ops = {
++static const struct ata_port_operations netcell_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_80wire,
+ 	.read_id	= netcell_read_id,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_ninja32.c linux-2.6.32.13/drivers/ata/pata_ninja32.c
+--- linux-2.6.32.13/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_ninja32.c	2010-05-15 13:21:14.515739682 -0400
+@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ninja32_port_ops = {
++static const struct ata_port_operations ninja32_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.sff_dev_select = ninja32_dev_select,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_ns87410.c linux-2.6.32.13/drivers/ata/pata_ns87410.c
+--- linux-2.6.32.13/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_ns87410.c	2010-05-15 13:21:14.515739682 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ns87410_port_ops = {
++static const struct ata_port_operations ns87410_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= ns87410_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_ns87415.c linux-2.6.32.13/drivers/ata/pata_ns87415.c
+--- linux-2.6.32.13/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_ns87415.c	2010-05-15 13:21:14.515739682 -0400
+@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
+ }
+ #endif		/* 87560 SuperIO Support */
+ 
+-static struct ata_port_operations ns87415_pata_ops = {
++static const struct ata_port_operations ns87415_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma	= ns87415_check_atapi_dma,
+@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
+ };
+ 
+ #if defined(CONFIG_SUPERIO)
+-static struct ata_port_operations ns87560_pata_ops = {
++static const struct ata_port_operations ns87560_pata_ops = {
+ 	.inherits		= &ns87415_pata_ops,
+ 	.sff_tf_read		= ns87560_tf_read,
+ 	.sff_check_status	= ns87560_check_status,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_octeon_cf.c linux-2.6.32.13/drivers/ata/pata_octeon_cf.c
+--- linux-2.6.32.13/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_octeon_cf.c	2010-05-15 13:21:14.515739682 -0400
+@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct ata_port_operations octeon_cf_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_oldpiix.c linux-2.6.32.13/drivers/ata/pata_oldpiix.c
+--- linux-2.6.32.13/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_oldpiix.c	2010-05-15 13:21:14.515739682 -0400
+@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations oldpiix_pata_ops = {
++static const struct ata_port_operations oldpiix_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= oldpiix_qc_issue,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_opti.c linux-2.6.32.13/drivers/ata/pata_opti.c
+--- linux-2.6.32.13/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_opti.c	2010-05-15 13:21:14.515739682 -0400
+@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations opti_port_ops = {
++static const struct ata_port_operations opti_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= opti_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_optidma.c linux-2.6.32.13/drivers/ata/pata_optidma.c
+--- linux-2.6.32.13/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_optidma.c	2010-05-15 13:21:14.518593102 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations optidma_port_ops = {
++static const struct ata_port_operations optidma_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= optidma_set_pio_mode,
+@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
+ 	.prereset	= optidma_pre_reset,
+ };
+ 
+-static struct ata_port_operations optiplus_port_ops = {
++static const struct ata_port_operations optiplus_port_ops = {
+ 	.inherits	= &optidma_port_ops,
+ 	.set_piomode	= optiplus_set_pio_mode,
+ 	.set_dmamode	= optiplus_set_dma_mode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_palmld.c linux-2.6.32.13/drivers/ata/pata_palmld.c
+--- linux-2.6.32.13/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_palmld.c	2010-05-15 13:21:14.518593102 -0400
+@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations palmld_port_ops = {
++static const struct ata_port_operations palmld_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_pcmcia.c linux-2.6.32.13/drivers/ata/pata_pcmcia.c
+--- linux-2.6.32.13/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_pcmcia.c	2010-05-15 13:21:14.522920519 -0400
+@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pcmcia_port_ops = {
++static const struct ata_port_operations pcmcia_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= pcmcia_set_mode,
+ };
+ 
+-static struct ata_port_operations pcmcia_8bit_port_ops = {
++static const struct ata_port_operations pcmcia_8bit_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_data_xfer_8bit,
+ 	.cable_detect	= ata_cable_40wire,
+@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
+ 	unsigned long io_base, ctl_base;
+ 	void __iomem *io_addr, *ctl_addr;
+ 	int n_ports = 1;
+-	struct ata_port_operations *ops = &pcmcia_port_ops;
++	const struct ata_port_operations *ops = &pcmcia_port_ops;
+ 
+ 	info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 	if (info == NULL)
+diff -urNp linux-2.6.32.13/drivers/ata/pata_pdc2027x.c linux-2.6.32.13/drivers/ata/pata_pdc2027x.c
+--- linux-2.6.32.13/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_pdc2027x.c	2010-05-15 13:21:14.522920519 -0400
+@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata100_ops = {
++static const struct ata_port_operations pdc2027x_pata100_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
+ 	.cable_detect		= pdc2027x_cable_detect,
+ 	.prereset		= pdc2027x_prereset,
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata133_ops = {
++static const struct ata_port_operations pdc2027x_pata133_ops = {
+ 	.inherits		= &pdc2027x_pata100_ops,
+ 	.mode_filter		= pdc2027x_mode_filter,
+ 	.set_piomode		= pdc2027x_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c
+--- linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c	2010-05-15 13:21:14.522920519 -0400
+@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2024x_port_ops = {
++static const struct ata_port_operations pdc2024x_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.cable_detect		= ata_cable_40wire,
+@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
+ 	.set_dmamode		= pdc202xx_set_dmamode,
+ };
+ 
+-static struct ata_port_operations pdc2026x_port_ops = {
++static const struct ata_port_operations pdc2026x_port_ops = {
+ 	.inherits		= &pdc2024x_port_ops,
+ 
+ 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_platform.c linux-2.6.32.13/drivers/ata/pata_platform.c
+--- linux-2.6.32.13/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_platform.c	2010-05-15 13:21:14.522920519 -0400
+@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_platform_port_ops = {
++static const struct ata_port_operations pata_platform_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_qdi.c linux-2.6.32.13/drivers/ata/pata_qdi.c
+--- linux-2.6.32.13/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_qdi.c	2010-05-15 13:21:14.526754945 -0400
+@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= qdi_data_xfer,
+@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
+ 	.set_piomode	= qdi6500_set_piomode,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &qdi6500_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_radisys.c linux-2.6.32.13/drivers/ata/pata_radisys.c
+--- linux-2.6.32.13/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_radisys.c	2010-05-15 13:21:14.526754945 -0400
+@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations radisys_pata_ops = {
++static const struct ata_port_operations radisys_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= radisys_qc_issue,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_rb532_cf.c linux-2.6.32.13/drivers/ata/pata_rb532_cf.c
+--- linux-2.6.32.13/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_rb532_cf.c	2010-05-15 13:21:14.526754945 -0400
+@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
+ 	return IRQ_HANDLED;
+ }
+ 
+-static struct ata_port_operations rb532_pata_port_ops = {
++static const struct ata_port_operations rb532_pata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer32,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_rdc.c linux-2.6.32.13/drivers/ata/pata_rdc.c
+--- linux-2.6.32.13/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_rdc.c	2010-05-15 13:21:14.530928469 -0400
+@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
+ 	pci_write_config_byte(dev, 0x48, udma_enable);
+ }
+ 
+-static struct ata_port_operations rdc_pata_ops = {
++static const struct ata_port_operations rdc_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= rdc_pata_cable_detect,
+ 	.set_piomode		= rdc_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_rz1000.c linux-2.6.32.13/drivers/ata/pata_rz1000.c
+--- linux-2.6.32.13/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_rz1000.c	2010-05-15 13:21:14.530928469 -0400
+@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations rz1000_port_ops = {
++static const struct ata_port_operations rz1000_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= rz1000_set_mode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_sc1200.c linux-2.6.32.13/drivers/ata/pata_sc1200.c
+--- linux-2.6.32.13/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_sc1200.c	2010-05-15 13:21:14.530928469 -0400
+@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations sc1200_port_ops = {
++static const struct ata_port_operations sc1200_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+ 	.qc_issue	= sc1200_qc_issue,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_scc.c linux-2.6.32.13/drivers/ata/pata_scc.c
+--- linux-2.6.32.13/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_scc.c	2010-05-15 13:21:14.530928469 -0400
+@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations scc_pata_ops = {
++static const struct ata_port_operations scc_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.set_piomode		= scc_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_sch.c linux-2.6.32.13/drivers/ata/pata_sch.c
+--- linux-2.6.32.13/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_sch.c	2010-05-15 13:21:14.534836180 -0400
+@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sch_pata_ops = {
++static const struct ata_port_operations sch_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_unknown,
+ 	.set_piomode		= sch_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_serverworks.c linux-2.6.32.13/drivers/ata/pata_serverworks.c
+--- linux-2.6.32.13/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_serverworks.c	2010-05-15 13:21:14.534836180 -0400
+@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations serverworks_osb4_port_ops = {
++static const struct ata_port_operations serverworks_osb4_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= serverworks_cable_detect,
+ 	.mode_filter	= serverworks_osb4_filter,
+@@ -307,7 +307,7 @@ static struct ata_port_operations server
+ 	.set_dmamode	= serverworks_set_dmamode,
+ };
+ 
+-static struct ata_port_operations serverworks_csb_port_ops = {
++static const struct ata_port_operations serverworks_csb_port_ops = {
+ 	.inherits	= &serverworks_osb4_port_ops,
+ 	.mode_filter	= serverworks_csb_filter,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_sil680.c linux-2.6.32.13/drivers/ata/pata_sil680.c
+--- linux-2.6.32.13/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_sil680.c	2010-05-15 13:21:14.538682329 -0400
+@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sil680_port_ops = {
++static const struct ata_port_operations sil680_port_ops = {
+ 	.inherits	= &ata_bmdma32_port_ops,
+ 	.cable_detect	= sil680_cable_detect,
+ 	.set_piomode	= sil680_set_piomode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_sis.c linux-2.6.32.13/drivers/ata/pata_sis.c
+--- linux-2.6.32.13/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_sis.c	2010-05-15 13:21:14.538682329 -0400
+@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_133_for_sata_ops = {
++static const struct ata_port_operations sis_133_for_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_base_ops = {
++static const struct ata_port_operations sis_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= sis_pre_reset,
+ };
+ 
+-static struct ata_port_operations sis_133_ops = {
++static const struct ata_port_operations sis_133_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_133_early_ops = {
++static const struct ata_port_operations sis_133_early_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_133_early_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_100_ops = {
++static const struct ata_port_operations sis_100_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_100_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_66_ops = {
++static const struct ata_port_operations sis_66_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_66_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_old_ops = {
++static const struct ata_port_operations sis_old_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_old_set_dmamode,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_sl82c105.c linux-2.6.32.13/drivers/ata/pata_sl82c105.c
+--- linux-2.6.32.13/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_sl82c105.c	2010-05-15 13:21:14.538682329 -0400
+@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sl82c105_port_ops = {
++static const struct ata_port_operations sl82c105_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_defer	= sl82c105_qc_defer,
+ 	.bmdma_start 	= sl82c105_bmdma_start,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_triflex.c linux-2.6.32.13/drivers/ata/pata_triflex.c
+--- linux-2.6.32.13/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_triflex.c	2010-05-15 13:21:14.538682329 -0400
+@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations triflex_port_ops = {
++static const struct ata_port_operations triflex_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.bmdma_start 	= triflex_bmdma_start,
+ 	.bmdma_stop	= triflex_bmdma_stop,
+diff -urNp linux-2.6.32.13/drivers/ata/pata_via.c linux-2.6.32.13/drivers/ata/pata_via.c
+--- linux-2.6.32.13/drivers/ata/pata_via.c	2010-04-29 17:49:37.709698369 -0400
++++ linux-2.6.32.13/drivers/ata/pata_via.c	2010-05-15 13:21:14.538682329 -0400
+@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations via_port_ops = {
++static const struct ata_port_operations via_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= via_cable_detect,
+ 	.set_piomode	= via_set_piomode,
+@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
+ 	.port_start	= via_port_start,
+ };
+ 
+-static struct ata_port_operations via_port_ops_noirq = {
++static const struct ata_port_operations via_port_ops_noirq = {
+ 	.inherits	= &via_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+diff -urNp linux-2.6.32.13/drivers/ata/pata_winbond.c linux-2.6.32.13/drivers/ata/pata_winbond.c
+--- linux-2.6.32.13/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pata_winbond.c	2010-05-15 13:21:14.538682329 -0400
+@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= winbond_data_xfer,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.13/drivers/ata/pdc_adma.c linux-2.6.32.13/drivers/ata/pdc_adma.c
+--- linux-2.6.32.13/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/pdc_adma.c	2010-05-15 13:21:14.538682329 -0400
+@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
+ 	.dma_boundary		= ADMA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations adma_ata_ops = {
++static const struct ata_port_operations adma_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_fsl.c linux-2.6.32.13/drivers/ata/sata_fsl.c
+--- linux-2.6.32.13/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_fsl.c	2010-05-15 13:21:14.542941562 -0400
+@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
+ 	.dma_boundary = ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sata_fsl_ops = {
++static const struct ata_port_operations sata_fsl_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer = ata_std_qc_defer,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_inic162x.c linux-2.6.32.13/drivers/ata/sata_inic162x.c
+--- linux-2.6.32.13/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_inic162x.c	2010-05-15 13:21:14.542941562 -0400
+@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations inic_port_ops = {
++static const struct ata_port_operations inic_port_ops = {
+ 	.inherits		= &sata_port_ops,
+ 
+ 	.check_atapi_dma	= inic_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_mv.c linux-2.6.32.13/drivers/ata/sata_mv.c
+--- linux-2.6.32.13/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_mv.c	2010-05-15 13:21:14.567430978 -0400
+@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
+ 	.dma_boundary		= MV_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations mv5_ops = {
++static const struct ata_port_operations mv5_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
+ 	.port_stop		= mv_port_stop,
+ };
+ 
+-static struct ata_port_operations mv6_ops = {
++static const struct ata_port_operations mv6_ops = {
+ 	.inherits		= &mv5_ops,
+ 	.dev_config             = mv6_dev_config,
+ 	.scr_read		= mv_scr_read,
+@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
+ 	.bmdma_status		= mv_bmdma_status,
+ };
+ 
+-static struct ata_port_operations mv_iie_ops = {
++static const struct ata_port_operations mv_iie_ops = {
+ 	.inherits		= &mv6_ops,
+ 	.dev_config		= ATA_OP_NULL,
+ 	.qc_prep		= mv_qc_prep_iie,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_nv.c linux-2.6.32.13/drivers/ata/sata_nv.c
+--- linux-2.6.32.13/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_nv.c	2010-05-15 13:21:14.570612236 -0400
+@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
+  * cases.  Define nv_hardreset() which only kicks in for post-boot
+  * probing and use it for all variants.
+  */
+-static struct ata_port_operations nv_generic_ops = {
++static const struct ata_port_operations nv_generic_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.lost_interrupt		= ATA_OP_NULL,
+ 	.scr_read		= nv_scr_read,
+@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
+ 	.hardreset		= nv_hardreset,
+ };
+ 
+-static struct ata_port_operations nv_nf2_ops = {
++static const struct ata_port_operations nv_nf2_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_nf2_freeze,
+ 	.thaw			= nv_nf2_thaw,
+ };
+ 
+-static struct ata_port_operations nv_ck804_ops = {
++static const struct ata_port_operations nv_ck804_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_ck804_freeze,
+ 	.thaw			= nv_ck804_thaw,
+ 	.host_stop		= nv_ck804_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_adma_ops = {
++static const struct ata_port_operations nv_adma_ops = {
+ 	.inherits		= &nv_ck804_ops,
+ 
+ 	.check_atapi_dma	= nv_adma_check_atapi_dma,
+@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
+ 	.host_stop		= nv_adma_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_swncq_ops = {
++static const struct ata_port_operations nv_swncq_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 
+ 	.qc_defer		= ata_std_qc_defer,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_promise.c linux-2.6.32.13/drivers/ata/sata_promise.c
+--- linux-2.6.32.13/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_promise.c	2010-05-15 13:21:14.570612236 -0400
+@@ -195,7 +195,7 @@ static const struct ata_port_operations 
+ 	.error_handler		= pdc_error_handler,
+ };
+ 
+-static struct ata_port_operations pdc_sata_ops = {
++static const struct ata_port_operations pdc_sata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_sata_cable_detect,
+ 	.freeze			= pdc_sata_freeze,
+@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
+ 
+ /* First-generation chips need a more restrictive ->check_atapi_dma op,
+    and ->freeze/thaw that ignore the hotplug controls. */
+-static struct ata_port_operations pdc_old_sata_ops = {
++static const struct ata_port_operations pdc_old_sata_ops = {
+ 	.inherits		= &pdc_sata_ops,
+ 	.freeze			= pdc_freeze,
+ 	.thaw			= pdc_thaw,
+ 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
+ };
+ 
+-static struct ata_port_operations pdc_pata_ops = {
++static const struct ata_port_operations pdc_pata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_pata_cable_detect,
+ 	.freeze			= pdc_freeze,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_qstor.c linux-2.6.32.13/drivers/ata/sata_qstor.c
+--- linux-2.6.32.13/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_qstor.c	2010-05-15 13:21:14.570612236 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
+ 	.dma_boundary		= QS_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations qs_ata_ops = {
++static const struct ata_port_operations qs_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= qs_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_sil24.c linux-2.6.32.13/drivers/ata/sata_sil24.c
+--- linux-2.6.32.13/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_sil24.c	2010-05-15 13:21:14.570612236 -0400
+@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sil24_ops = {
++static const struct ata_port_operations sil24_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sil24_qc_defer,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_sil.c linux-2.6.32.13/drivers/ata/sata_sil.c
+--- linux-2.6.32.13/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_sil.c	2010-05-15 13:21:14.570612236 -0400
+@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
+ 	.sg_tablesize		= ATA_MAX_PRD
+ };
+ 
+-static struct ata_port_operations sil_ops = {
++static const struct ata_port_operations sil_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.dev_config		= sil_dev_config,
+ 	.set_mode		= sil_set_mode,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_sis.c linux-2.6.32.13/drivers/ata/sata_sis.c
+--- linux-2.6.32.13/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_sis.c	2010-05-15 13:21:14.578938263 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_ops = {
++static const struct ata_port_operations sis_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= sis_scr_read,
+ 	.scr_write		= sis_scr_write,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_svw.c linux-2.6.32.13/drivers/ata/sata_svw.c
+--- linux-2.6.32.13/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_svw.c	2010-05-15 13:21:14.578938263 -0400
+@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
+ };
+ 
+ 
+-static struct ata_port_operations k2_sata_ops = {
++static const struct ata_port_operations k2_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= k2_sata_tf_load,
+ 	.sff_tf_read		= k2_sata_tf_read,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_sx4.c linux-2.6.32.13/drivers/ata/sata_sx4.c
+--- linux-2.6.32.13/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_sx4.c	2010-05-15 13:21:14.594941059 -0400
+@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
+ };
+ 
+ /* TODO: inherit from base port_ops after converting to new EH */
+-static struct ata_port_operations pdc_20621_ops = {
++static const struct ata_port_operations pdc_20621_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= pdc_check_atapi_dma,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_uli.c linux-2.6.32.13/drivers/ata/sata_uli.c
+--- linux-2.6.32.13/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_uli.c	2010-05-15 13:21:14.594941059 -0400
+@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations uli_ops = {
++static const struct ata_port_operations uli_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= uli_scr_read,
+ 	.scr_write		= uli_scr_write,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_via.c linux-2.6.32.13/drivers/ata/sata_via.c
+--- linux-2.6.32.13/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_via.c	2010-05-15 13:21:14.599908388 -0400
+@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations svia_base_ops = {
++static const struct ata_port_operations svia_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= svia_tf_load,
+ };
+ 
+-static struct ata_port_operations vt6420_sata_ops = {
++static const struct ata_port_operations vt6420_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.freeze			= svia_noop_freeze,
+ 	.prereset		= vt6420_prereset,
+ };
+ 
+-static struct ata_port_operations vt6421_pata_ops = {
++static const struct ata_port_operations vt6421_pata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.cable_detect		= vt6421_pata_cable_detect,
+ 	.set_piomode		= vt6421_set_pio_mode,
+ 	.set_dmamode		= vt6421_set_dma_mode,
+ };
+ 
+-static struct ata_port_operations vt6421_sata_ops = {
++static const struct ata_port_operations vt6421_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.scr_read		= svia_scr_read,
+ 	.scr_write		= svia_scr_write,
+ };
+ 
+-static struct ata_port_operations vt8251_ops = {
++static const struct ata_port_operations vt8251_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= vt8251_scr_read,
+diff -urNp linux-2.6.32.13/drivers/ata/sata_vsc.c linux-2.6.32.13/drivers/ata/sata_vsc.c
+--- linux-2.6.32.13/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ata/sata_vsc.c	2010-05-15 13:21:14.606569540 -0400
+@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
+ };
+ 
+ 
+-static struct ata_port_operations vsc_sata_ops = {
++static const struct ata_port_operations vsc_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	/* The IRQ handling is not quite standard SFF behaviour so we
+ 	   cannot use the default lost interrupt handler */
+diff -urNp linux-2.6.32.13/drivers/atm/adummy.c linux-2.6.32.13/drivers/atm/adummy.c
+--- linux-2.6.32.13/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/adummy.c	2010-05-15 13:21:14.606569540 -0400
+@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
+ 		vcc->pop(vcc, skb);
+ 	else
+ 		dev_kfree_skb_any(skb);
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/drivers/atm/ambassador.c linux-2.6.32.13/drivers/atm/ambassador.c
+--- linux-2.6.32.13/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/ambassador.c	2010-05-15 13:21:14.622930740 -0400
+@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
+   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
+   
+   // VC layer stats
+-  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+   
+   // free the descriptor
+   kfree (tx_descr);
+@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
+ 	  dump_skb ("<<<", vc, skb);
+ 	  
+ 	  // VC layer stats
+-	  atomic_inc(&atm_vcc->stats->rx);
++	  atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  atm_vcc->push (atm_vcc, skb);
+@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
+       } else {
+       	PRINTK (KERN_INFO, "dropped over-size frame");
+ 	// should we count this?
+-	atomic_inc(&atm_vcc->stats->rx_drop);
++	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+       }
+       
+     } else {
+@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
+   }
+   
+   if (check_area (skb->data, skb->len)) {
+-    atomic_inc(&atm_vcc->stats->tx_err);
++    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
+     return -ENOMEM; // ?
+   }
+   
+diff -urNp linux-2.6.32.13/drivers/atm/atmtcp.c linux-2.6.32.13/drivers/atm/atmtcp.c
+--- linux-2.6.32.13/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/atmtcp.c	2010-05-15 13:21:14.626657707 -0400
+@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+ 		if (dev_data) return 0;
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOLINK;
+ 	}
+ 	size = skb->len+sizeof(struct atmtcp_hdr);
+@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (!new_skb) {
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOBUFS;
+ 	}
+ 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
+@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ 	return 0;
+ }
+ 
+@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
+ 	read_unlock(&vcc_sklist_lock);
+ 	if (!out_vcc) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		goto done;
+ 	}
+ 	skb_pull(skb,sizeof(struct atmtcp_hdr));
+@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	__net_timestamp(new_skb);
+ 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ done:
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+diff -urNp linux-2.6.32.13/drivers/atm/eni.c linux-2.6.32.13/drivers/atm/eni.c
+--- linux-2.6.32.13/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/eni.c	2010-05-15 13:21:14.634928336 -0400
+@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
+ 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
+ 		    vcc->dev->number);
+ 		length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		length = ATM_CELL_SIZE-1; /* no HEC */
+@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    size);
+ 		}
+ 		eff = length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
+@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
+ 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
+ 			length = eff = 0;
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		}
+ 	}
+ 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
+@@ -770,7 +770,7 @@ rx_dequeued++;
+ 			vcc->push(vcc,skb);
+ 			pushed++;
+ 		}
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	wake_up(&eni_dev->rx_wait);
+ }
+@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
+ 		    PCI_DMA_TODEVICE);
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb_irq(skb);
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 		wake_up(&eni_dev->tx_wait);
+ dma_complete++;
+ 	}
+diff -urNp linux-2.6.32.13/drivers/atm/firestream.c linux-2.6.32.13/drivers/atm/firestream.c
+--- linux-2.6.32.13/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/firestream.c	2010-05-15 13:21:14.647057643 -0400
+@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
+ 				}
+ 			}
+ 
+-			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 
+ 			fs_dprintk (FS_DEBUG_TXMEM, "i");
+ 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
+@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
+ #endif
+ 				skb_put (skb, qe->p1 & 0xffff); 
+ 				ATM_SKB(skb)->vcc = atm_vcc;
+-				atomic_inc(&atm_vcc->stats->rx);
++				atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 				__net_timestamp(skb);
+ 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
+ 				atm_vcc->push (atm_vcc, skb);
+@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
+ 				kfree (pe);
+ 			}
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		case 0x1f: /*  Reassembly abort: no buffers. */
+ 			/* Silently increment error counter. */
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
+ 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
+diff -urNp linux-2.6.32.13/drivers/atm/fore200e.c linux-2.6.32.13/drivers/atm/fore200e.c
+--- linux-2.6.32.13/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/fore200e.c	2010-05-15 13:21:14.676169638 -0400
+@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
+ #endif
+ 		/* check error condition */
+ 		if (*entry->status & STATUS_ERROR)
+-		    atomic_inc(&vcc->stats->tx_err);
++		    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		else
+-		    atomic_inc(&vcc->stats->tx);
++		    atomic_inc_unchecked(&vcc->stats->tx);
+ 	    }
+ 	}
+ 
+@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
+     if (skb == NULL) {
+ 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     } 
+ 
+@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
+ 
+ 	dev_kfree_skb_any(skb);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     }
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+     vcc->push(vcc, skb);
+-    atomic_inc(&vcc->stats->rx);
++    atomic_inc_unchecked(&vcc->stats->rx);
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
+ 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
+ 			fore200e->atm_dev->number,
+ 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	    }
+ 	}
+ 
+@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
+ 		goto retry_here;
+ 	    }
+ 
+-	    atomic_inc(&vcc->stats->tx_err);
++	    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 
+ 	    fore200e->tx_sat++;
+ 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
+diff -urNp linux-2.6.32.13/drivers/atm/he.c linux-2.6.32.13/drivers/atm/he.c
+--- linux-2.6.32.13/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/he.c	2010-05-15 13:21:14.691446990 -0400
+@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 
+ 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
+ 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
+-				atomic_inc(&vcc->stats->rx_drop);
++				atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 				RBRQ_LEN_ERR(he_dev->rbrq_head)
+ 							? "LEN_ERR" : "",
+ 							vcc->vpi, vcc->vci);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 		vcc->push(vcc, skb);
+ 		spin_lock(&he_dev->global_lock);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ return_host_buffers:
+ 		++pdus_assembled;
+@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
+ 					tpd->vcc->pop(tpd->vcc, tpd->skb);
+ 				else
+ 					dev_kfree_skb_any(tpd->skb);
+-				atomic_inc(&tpd->vcc->stats->tx_err);
++				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
+ 			}
+ 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
+ 			return;
+@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ #endif
+@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 		return -ENOMEM;
+ 	}
+@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 					vcc->pop(vcc, skb);
+ 				else
+ 					dev_kfree_skb_any(skb);
+-				atomic_inc(&vcc->stats->tx_err);
++				atomic_inc_unchecked(&vcc->stats->tx_err);
+ 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 				return -ENOMEM;
+ 			}
+@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 	__enqueue_tpd(he_dev, tpd, cid);
+ 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/drivers/atm/horizon.c linux-2.6.32.13/drivers/atm/horizon.c
+--- linux-2.6.32.13/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/horizon.c	2010-05-15 13:21:14.706969618 -0400
+@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
+ 	{
+ 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
+ 	  // VC layer stats
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  vcc->push (vcc, skb);
+@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
+ 	dev->tx_iovec = NULL;
+ 	
+ 	// VC layer stats
+-	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 	
+ 	// free the skb
+ 	hrz_kfree_skb (skb);
+diff -urNp linux-2.6.32.13/drivers/atm/idt77252.c linux-2.6.32.13/drivers/atm/idt77252.c
+--- linux-2.6.32.13/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/idt77252.c	2010-05-15 13:21:14.706969618 -0400
+@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
+ 		else
+ 			dev_kfree_skb(skb);
+ 
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 	}
+ 
+ 	atomic_dec(&scq->used);
+@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			if ((sb = dev_alloc_skb(64)) == NULL) {
+ 				printk("%s: Can't allocate buffers for aal0.\n",
+ 				       card->name);
+-				atomic_add(i, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i, &vcc->stats->rx_drop);
+ 				break;
+ 			}
+ 			if (!atm_charge(vcc, sb->truesize)) {
+ 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
+ 					 card->name);
+-				atomic_add(i - 1, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
+ 				dev_kfree_skb(sb);
+ 				break;
+ 			}
+@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			ATM_SKB(sb)->vcc = vcc;
+ 			__net_timestamp(sb);
+ 			vcc->push(vcc, sb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			cell += ATM_CELL_PAYLOAD;
+ 		}
+@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			         "(CDC: %08x)\n",
+ 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (stat & SAR_RSQE_CRC) {
+ 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (skb_queue_len(&rpp->queue) > 1) {
+@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 				RXPRINTK("%s: Can't alloc RX skb.\n",
+ 					 card->name);
+ 				recycle_rx_pool_skb(card, rpp);
+-				atomic_inc(&vcc->stats->rx_err);
++				atomic_inc_unchecked(&vcc->stats->rx_err);
+ 				return;
+ 			}
+ 			if (!atm_charge(vcc, skb->truesize)) {
+@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			__net_timestamp(skb);
+ 
+ 			vcc->push(vcc, skb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			return;
+ 		}
+@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 		__net_timestamp(skb);
+ 
+ 		vcc->push(vcc, skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 		if (skb->truesize > SAR_FB_SIZE_3)
+ 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
+@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		if (vcc->qos.aal != ATM_AAL0) {
+ 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
+ 				card->name, vpi, vci);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto drop;
+ 		}
+ 	
+ 		if ((sb = dev_alloc_skb(64)) == NULL) {
+ 			printk("%s: Can't allocate buffers for AAL0.\n",
+ 			       card->name);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto drop;
+ 		}
+ 
+@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		ATM_SKB(sb)->vcc = vcc;
+ 		__net_timestamp(sb);
+ 		vcc->push(vcc, sb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ drop:
+ 		skb_pull(queue, 64);
+@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	if (vc == NULL) {
+ 		printk("%s: NULL connection in send().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 	if (!test_bit(VCF_TX, &vc->flags)) {
+ 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 		break;
+ 	default:
+ 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (skb_shinfo(skb)->nr_frags != 0) {
+ 		printk("%s: No scatter-gather yet.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	err = queue_skb(card, vc, skb, oam);
+ 	if (err) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return err;
+ 	}
+@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
+ 	skb = dev_alloc_skb(64);
+ 	if (!skb) {
+ 		printk("%s: Out of memory in send_oam().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOMEM;
+ 	}
+ 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+diff -urNp linux-2.6.32.13/drivers/atm/iphase.c linux-2.6.32.13/drivers/atm/iphase.c
+--- linux-2.6.32.13/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/iphase.c	2010-05-15 13:21:14.750617431 -0400
+@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	status = (u_short) (buf_desc_ptr->desc_mode);  
+ 	if (status & (RX_CER | RX_PTE | RX_OFL))  
+ 	{  
+-                atomic_inc(&vcc->stats->rx_err);
++                atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		IF_ERR(printk("IA: bad packet, dropping it");)  
+                 if (status & RX_CER) { 
+                     IF_ERR(printk(" cause: packet CRC error\n");)
+@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	len = dma_addr - buf_addr;  
+         if (len > iadev->rx_buf_sz) {
+            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
+-           atomic_inc(&vcc->stats->rx_err);
++           atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	   goto out_free_desc;
+         }
+ 		  
+@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
+           ia_vcc = INPH_IA_VCC(vcc);
+           if (ia_vcc == NULL)
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              dev_kfree_skb_any(skb);
+              atm_return(vcc, atm_guess_pdu2truesize(len));
+              goto INCR_DLE;
+@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
+           if ((length > iadev->rx_buf_sz) || (length > 
+                               (skb->len - sizeof(struct cpcs_trailer))))
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
+                                                             length, skb->len);)
+              dev_kfree_skb_any(skb);
+@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
+ 
+ 	  IF_RX(printk("rx_dle_intr: skb push");)  
+ 	  vcc->push(vcc,skb);  
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+           iadev->rx_pkt_cnt++;
+       }  
+ INCR_DLE:
+@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
+          {
+              struct k_sonet_stats *stats;
+              stats = &PRIV(_ia_dev[board])->sonet_stats;
+-             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
+-             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
+-             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
+-             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
+-             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
+-             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
+-             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
+-             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
+-             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
++             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
++             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
++             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
++             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
++             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
++             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
++             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
++             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
++             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
+          }
+             ia_cmds.status = 0;
+             break;
+@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
+ 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
+ 	{  
+ 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
+-                atomic_inc(&vcc->stats->tx);
++                atomic_inc_unchecked(&vcc->stats->tx);
+ 		if (vcc->pop)   
+ 		    vcc->pop(vcc, skb);   
+ 		else  
+@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
+         ATM_DESC(skb) = vcc->vci;
+         skb_queue_tail(&iadev->tx_dma_q, skb);
+ 
+-        atomic_inc(&vcc->stats->tx);
++        atomic_inc_unchecked(&vcc->stats->tx);
+         iadev->tx_pkt_cnt++;
+ 	/* Increment transaction counter */  
+ 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
+         
+ #if 0        
+         /* add flow control logic */ 
+-        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
++        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
+           if (iavcc->vc_desc_cnt > 10) {
+              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
+             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
+diff -urNp linux-2.6.32.13/drivers/atm/lanai.c linux-2.6.32.13/drivers/atm/lanai.c
+--- linux-2.6.32.13/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/lanai.c	2010-05-15 13:21:14.750617431 -0400
+@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
+ 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
+ 	lanai_endtx(lanai, lvcc);
+ 	lanai_free_skb(lvcc->tx.atmvcc, skb);
+-	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
++	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
+ }
+ 
+ /* Try to fill the buffer - don't call unless there is backlog */
+@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
+ 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
+ 	__net_timestamp(skb);
+ 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
+     out:
+ 	lvcc->rx.buf.ptr = end;
+ 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
+@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
+ 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
+ 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
+ 		lanai->stats.service_rxnotaal5++;
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		return 0;
+ 	}
+ 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
+@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
+ 		int bytes;
+ 		read_unlock(&vcc_sklist_lock);
+ 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_trash++;
+ 		bytes = (SERVICE_GET_END(s) * 16) -
+ 		    (((unsigned long) lvcc->rx.buf.ptr) -
+@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
+ 	}
+ 	if (s & SERVICE_STREAM) {
+ 		read_unlock(&vcc_sklist_lock);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_stream++;
+ 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
+ 		    "PDU on VCI %d!\n", lanai->number, vci);
+@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
+ 		return 0;
+ 	}
+ 	DPRINTK("got rx crc error on vci %d\n", vci);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 	lvcc->stats.x.aal5.service_rxcrc++;
+ 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
+ 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
+diff -urNp linux-2.6.32.13/drivers/atm/nicstar.c linux-2.6.32.13/drivers/atm/nicstar.c
+--- linux-2.6.32.13/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/nicstar.c	2010-05-15 13:21:14.787751803 -0400
+@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if ((vc = (vc_map *) vcc->dev_data) == NULL)
+    {
+       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (!vc->tx)
+    {
+       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
+    {
+       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (skb_shinfo(skb)->nr_frags != 0)
+    {
+       printk("nicstar%d: No scatter-gather yet.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
+ 
+    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
+    {
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EIO;
+    }
+-   atomic_inc(&vcc->stats->tx);
++   atomic_inc_unchecked(&vcc->stats->tx);
+ 
+    return 0;
+ }
+@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
+          {
+             printk("nicstar%d: Can't allocate buffers for aal0.\n",
+                    card->index);
+-            atomic_add(i,&vcc->stats->rx_drop);
++            atomic_add_unchecked(i,&vcc->stats->rx_drop);
+             break;
+          }
+          if (!atm_charge(vcc, sb->truesize))
+          {
+             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
+                      card->index);
+-            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
++            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
+             dev_kfree_skb_any(sb);
+             break;
+          }
+@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          ATM_SKB(sb)->vcc = vcc;
+ 	 __net_timestamp(sb);
+          vcc->push(vcc, sb);
+-         atomic_inc(&vcc->stats->rx);
++         atomic_inc_unchecked(&vcc->stats->rx);
+          cell += ATM_CELL_PAYLOAD;
+       }
+ 
+@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ 	 if (iovb == NULL)
+ 	 {
+ 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+             recycle_rx_buf(card, skb);
+             return;
+ 	 }
+@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
+    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
+    {
+       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
+-      atomic_inc(&vcc->stats->rx_err);
++      atomic_inc_unchecked(&vcc->stats->rx_err);
+       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
+       NS_SKB(iovb)->iovcnt = 0;
+       iovb->len = 0;
+@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_rx_buf(card, skb);
+          vc->rx_iov = NULL;
+          recycle_iov_buf(card, iovb);
+@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                       NS_SKB(iovb)->iovcnt);
+          vc->rx_iov = NULL;
+@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             printk(" - PDU size mismatch.\n");
+          else
+             printk(".\n");
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	   NS_SKB(iovb)->iovcnt);
+ 	 vc->rx_iov = NULL;
+@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          if (!atm_charge(vcc, skb->truesize))
+          {
+             push_rxbufs(card, skb);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             ATM_SKB(skb)->vcc = vcc;
+ 	    __net_timestamp(skb);
+             vcc->push(vcc, skb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
+@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, sb->truesize))
+             {
+                push_rxbufs(card, sb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+ 	    {
+@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(sb)->vcc = vcc;
+ 	       __net_timestamp(sb);
+                vcc->push(vcc, sb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, skb);
+@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, skb->truesize))
+             {
+                push_rxbufs(card, skb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+             {
+@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(skb)->vcc = vcc;
+ 	       __net_timestamp(skb);
+                vcc->push(vcc, skb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, sb);
+@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (hb == NULL)
+             {
+                printk("nicstar%d: Out of huge buffers.\n", card->index);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                             NS_SKB(iovb)->iovcnt);
+                vc->rx_iov = NULL;
+@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             }
+ 	    else
+ 	       dev_kfree_skb_any(hb);
+-	    atomic_inc(&vcc->stats->rx_drop);
++	    atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ #endif /* NS_USE_DESTRUCTORS */
+ 	    __net_timestamp(hb);
+             vcc->push(vcc, hb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+ 
+diff -urNp linux-2.6.32.13/drivers/atm/solos-pci.c linux-2.6.32.13/drivers/atm/solos-pci.c
+--- linux-2.6.32.13/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/solos-pci.c	2010-05-15 13:21:14.815606670 -0400
+@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
+ 				}
+ 				atm_charge(vcc, skb->truesize);
+ 				vcc->push(vcc, skb);
+-				atomic_inc(&vcc->stats->rx);
++				atomic_inc_unchecked(&vcc->stats->rx);
+ 				break;
+ 
+ 			case PKT_STATUS:
+@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
+ 			vcc = SKB_CB(oldskb)->vcc;
+ 
+ 			if (vcc) {
+-				atomic_inc(&vcc->stats->tx);
++				atomic_inc_unchecked(&vcc->stats->tx);
+ 				solos_pop(vcc, oldskb);
+ 			} else
+ 				dev_kfree_skb_irq(oldskb);
+diff -urNp linux-2.6.32.13/drivers/atm/suni.c linux-2.6.32.13/drivers/atm/suni.c
+--- linux-2.6.32.13/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/suni.c	2010-05-15 13:21:14.815606670 -0400
+@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    atomic_add((v),&stats->s); \
+-    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
++    atomic_add_unchecked((v),&stats->s); \
++    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
+ 
+ 
+ static void suni_hz(unsigned long from_timer)
+diff -urNp linux-2.6.32.13/drivers/atm/uPD98402.c linux-2.6.32.13/drivers/atm/uPD98402.c
+--- linux-2.6.32.13/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/uPD98402.c	2010-05-15 13:21:14.815606670 -0400
+@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
+ 	struct sonet_stats tmp;
+  	int error = 0;
+ 
+-	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
++	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
+ 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
+ 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
+ 	if (zero && !error) {
+@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
+-    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
+-	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
++    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
++    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
+ 
+ 
+ static void stat_event(struct atm_dev *dev)
+@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
+ 		if (reason & uPD98402_INT_PFM) stat_event(dev);
+ 		if (reason & uPD98402_INT_PCO) {
+ 			(void) GET(PCOCR); /* clear interrupt cause */
+-			atomic_add(GET(HECCT),
++			atomic_add_unchecked(GET(HECCT),
+ 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
+ 		}
+ 		if ((reason & uPD98402_INT_RFO) && 
+@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
+ 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
+ 	  uPD98402_INT_LOS),PIMR); /* enable them */
+ 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
+-	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.13/drivers/atm/zatm.c linux-2.6.32.13/drivers/atm/zatm.c
+--- linux-2.6.32.13/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/atm/zatm.c	2010-05-15 13:21:14.815606670 -0400
+@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		}
+ 		if (!size) {
+ 			dev_kfree_skb_irq(skb);
+-			if (vcc) atomic_inc(&vcc->stats->rx_err);
++			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			continue;
+ 		}
+ 		if (!atm_charge(vcc,skb->truesize)) {
+@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		skb->len = size;
+ 		ATM_SKB(skb)->vcc = vcc;
+ 		vcc->push(vcc,skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	zout(pos & 0xffff,MTA(mbx));
+ #if 0 /* probably a stupid idea */
+@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
+ 			skb_queue_head(&zatm_vcc->backlog,skb);
+ 			break;
+ 		}
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 	wake_up(&zatm_vcc->tx_wait);
+ }
+ 
+diff -urNp linux-2.6.32.13/drivers/base/bus.c linux-2.6.32.13/drivers/base/bus.c
+--- linux-2.6.32.13/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/base/bus.c	2010-05-15 13:21:14.831148567 -0400
+@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops driver_sysfs_ops = {
++static const struct sysfs_ops driver_sysfs_ops = {
+ 	.show	= drv_attr_show,
+ 	.store	= drv_attr_store,
+ };
+@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops bus_sysfs_ops = {
++static const struct sysfs_ops bus_sysfs_ops = {
+ 	.show	= bus_attr_show,
+ 	.store	= bus_attr_store,
+ };
+@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops bus_uevent_ops = {
++static const struct kset_uevent_ops bus_uevent_ops = {
+ 	.filter = bus_uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/base/class.c linux-2.6.32.13/drivers/base/class.c
+--- linux-2.6.32.13/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/base/class.c	2010-05-15 13:21:14.874164060 -0400
+@@ -63,7 +63,7 @@ static void class_release(struct kobject
+ 	kfree(cp);
+ }
+ 
+-static struct sysfs_ops class_sysfs_ops = {
++static const struct sysfs_ops class_sysfs_ops = {
+ 	.show	= class_attr_show,
+ 	.store	= class_attr_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/base/core.c linux-2.6.32.13/drivers/base/core.c
+--- linux-2.6.32.13/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/base/core.c	2010-05-15 13:21:14.878954723 -0400
+@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops dev_sysfs_ops = {
++static const struct sysfs_ops dev_sysfs_ops = {
+ 	.show	= dev_attr_show,
+ 	.store	= dev_attr_store,
+ };
+@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops device_uevent_ops = {
++static const struct kset_uevent_ops device_uevent_ops = {
+ 	.filter =	dev_uevent_filter,
+ 	.name =		dev_uevent_name,
+ 	.uevent =	dev_uevent,
+diff -urNp linux-2.6.32.13/drivers/base/memory.c linux-2.6.32.13/drivers/base/memory.c
+--- linux-2.6.32.13/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/base/memory.c	2010-05-15 13:21:14.882954278 -0400
+@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops memory_uevent_ops = {
++static const struct kset_uevent_ops memory_uevent_ops = {
+ 	.name		= memory_uevent_name,
+ 	.uevent		= memory_uevent,
+ };
+diff -urNp linux-2.6.32.13/drivers/base/sys.c linux-2.6.32.13/drivers/base/sys.c
+--- linux-2.6.32.13/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/base/sys.c	2010-05-15 13:21:14.890945998 -0400
+@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= sysdev_show,
+ 	.store	= sysdev_store,
+ };
+@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_class_ops = {
++static const struct sysfs_ops sysfs_class_ops = {
+ 	.show	= sysdev_class_show,
+ 	.store	= sysdev_class_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/block/pktcdvd.c linux-2.6.32.13/drivers/block/pktcdvd.c
+--- linux-2.6.32.13/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/block/pktcdvd.c	2010-05-15 13:21:14.919938646 -0400
+@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
+ 	return len;
+ }
+ 
+-static struct sysfs_ops kobj_pkt_ops = {
++static const struct sysfs_ops kobj_pkt_ops = {
+ 	.show = kobj_pkt_show,
+ 	.store = kobj_pkt_store
+ };
+diff -urNp linux-2.6.32.13/drivers/char/agp/frontend.c linux-2.6.32.13/drivers/char/agp/frontend.c
+--- linux-2.6.32.13/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/agp/frontend.c	2010-05-15 13:21:14.919938646 -0400
+@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
+ 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
+ 		return -EFAULT;
+ 
+-	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
++	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
+ 		return -EFAULT;
+ 
+ 	client = agp_find_client_by_pid(reserve.pid);
+diff -urNp linux-2.6.32.13/drivers/char/agp/intel-agp.c linux-2.6.32.13/drivers/char/agp/intel-agp.c
+--- linux-2.6.32.13/drivers/char/agp/intel-agp.c	2010-04-29 17:49:37.777981896 -0400
++++ linux-2.6.32.13/drivers/char/agp/intel-agp.c	2010-05-15 13:21:14.919938646 -0400
+@@ -2564,7 +2564,7 @@ static struct pci_device_id agp_intel_pc
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
+diff -urNp linux-2.6.32.13/drivers/char/hpet.c linux-2.6.32.13/drivers/char/hpet.c
+--- linux-2.6.32.13/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hpet.c	2010-05-15 13:21:14.922737516 -0400
+@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
+ 	return 0;
+ }
+ 
+-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
++static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
+ 
+ static int
+ hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+@@ -550,7 +550,7 @@ static inline unsigned long hpet_time_di
+ }
+ 
+ static int
+-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
++hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
+ {
+ 	struct hpet_timer __iomem *timer;
+ 	struct hpet __iomem *hpet;
+@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
+ 		},
+ };
+ 
+-static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
++static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
+ 
+ static int __init hpet_init(void)
+ {
+diff -urNp linux-2.6.32.13/drivers/char/hvc_beat.c linux-2.6.32.13/drivers/char/hvc_beat.c
+--- linux-2.6.32.13/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_beat.c	2010-05-15 13:21:14.922737516 -0400
+@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
+ 	return cnt;
+ }
+ 
+-static struct hv_ops hvc_beat_get_put_ops = {
++static const struct hv_ops hvc_beat_get_put_ops = {
+ 	.get_chars = hvc_beat_get_chars,
+ 	.put_chars = hvc_beat_put_chars,
+ };
+diff -urNp linux-2.6.32.13/drivers/char/hvc_console.c linux-2.6.32.13/drivers/char/hvc_console.c
+--- linux-2.6.32.13/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_console.c	2010-05-15 13:21:14.922737516 -0400
+@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
+  * console interfaces but can still be used as a tty device.  This has to be
+  * static because kmalloc will not work during early console init.
+  */
+-static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
++static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
+ static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
+ 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
+ 
+@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
+  * vty adapters do NOT get an hvc_instantiate() callback since they
+  * appear after early console init.
+  */
+-int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
++int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
+ {
+ 	struct hvc_struct *hp;
+ 
+@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
+ };
+ 
+ struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
+-					struct hv_ops *ops, int outbuf_size)
++					const struct hv_ops *ops, int outbuf_size)
+ {
+ 	struct hvc_struct *hp;
+ 	int i;
+diff -urNp linux-2.6.32.13/drivers/char/hvc_console.h linux-2.6.32.13/drivers/char/hvc_console.h
+--- linux-2.6.32.13/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_console.h	2010-05-15 13:21:14.922737516 -0400
+@@ -55,7 +55,7 @@ struct hvc_struct {
+ 	int outbuf_size;
+ 	int n_outbuf;
+ 	uint32_t vtermno;
+-	struct hv_ops *ops;
++	const struct hv_ops *ops;
+ 	int irq_requested;
+ 	int data;
+ 	struct winsize ws;
+@@ -76,11 +76,11 @@ struct hv_ops {
+ };
+ 
+ /* Register a vterm and a slot index for use as a console (console_init) */
+-extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
++extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
+ 
+ /* register a vterm for hvc tty operation (module_init or hotplug add) */
+ extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
+-				struct hv_ops *ops, int outbuf_size);
++				const struct hv_ops *ops, int outbuf_size);
+ /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
+ extern int hvc_remove(struct hvc_struct *hp);
+ 
+diff -urNp linux-2.6.32.13/drivers/char/hvc_iseries.c linux-2.6.32.13/drivers/char/hvc_iseries.c
+--- linux-2.6.32.13/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_iseries.c	2010-05-15 13:21:14.922737516 -0400
+@@ -197,7 +197,7 @@ done:
+ 	return sent;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = get_chars,
+ 	.put_chars = put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.13/drivers/char/hvc_iucv.c linux-2.6.32.13/drivers/char/hvc_iucv.c
+--- linux-2.6.32.13/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_iucv.c	2010-05-15 13:21:14.922737516 -0400
+@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
+ 
+ 
+ /* HVC operations */
+-static struct hv_ops hvc_iucv_ops = {
++static const struct hv_ops hvc_iucv_ops = {
+ 	.get_chars = hvc_iucv_get_chars,
+ 	.put_chars = hvc_iucv_put_chars,
+ 	.notifier_add = hvc_iucv_notifier_add,
+diff -urNp linux-2.6.32.13/drivers/char/hvc_rtas.c linux-2.6.32.13/drivers/char/hvc_rtas.c
+--- linux-2.6.32.13/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_rtas.c	2010-05-15 13:21:14.922737516 -0400
+@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_rtas_get_put_ops = {
++static const struct hv_ops hvc_rtas_get_put_ops = {
+ 	.get_chars = hvc_rtas_read_console,
+ 	.put_chars = hvc_rtas_write_console,
+ };
+diff -urNp linux-2.6.32.13/drivers/char/hvcs.c linux-2.6.32.13/drivers/char/hvcs.c
+--- linux-2.6.32.13/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvcs.c	2010-05-15 13:21:14.967285135 -0400
+@@ -269,7 +269,7 @@ struct hvcs_struct {
+ 	unsigned int index;
+ 
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 
+ 	/*
+ 	 * Used to tell the driver kernel_thread what operations need to take
+@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 
+-	if (hvcsd->open_count > 0) {
++	if (atomic_read(&hvcsd->open_count) > 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
+ 				"The hvcs device node is still in use.\n");
+@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
+ 		if ((retval = hvcs_partner_connect(hvcsd)))
+ 			goto error_release;
+ 
+-	hvcsd->open_count = 1;
++	atomic_set(&hvcsd->open_count, 1);
+ 	hvcsd->tty = tty;
+ 	tty->driver_data = hvcsd;
+ 
+@@ -1169,7 +1169,7 @@ fast_open:
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	kref_get(&hvcsd->kref);
+-	hvcsd->open_count++;
++	atomic_inc(&hvcsd->open_count);
+ 	hvcsd->todo_mask |= HVCS_SCHED_READ;
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 
+@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
+ 	hvcsd = tty->driver_data;
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+-	if (--hvcsd->open_count == 0) {
++	if (atomic_dec_and_test(&hvcsd->open_count)) {
+ 
+ 		vio_disable_interrupts(hvcsd->vdev);
+ 
+@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
+ 		free_irq(irq, hvcsd);
+ 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
+ 		return;
+-	} else if (hvcsd->open_count < 0) {
++	} else if (atomic_read(&hvcsd->open_count) < 0) {
+ 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
+ 				" is missmanaged.\n",
+-		hvcsd->vdev->unit_address, hvcsd->open_count);
++		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
+ 	}
+ 
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	/* Preserve this so that we know how many kref refs to put */
+-	temp_open_count = hvcsd->open_count;
++	temp_open_count = atomic_read(&hvcsd->open_count);
+ 
+ 	/*
+ 	 * Don't kref put inside the spinlock because the destruction
+@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
+ 	hvcsd->tty->driver_data = NULL;
+ 	hvcsd->tty = NULL;
+ 
+-	hvcsd->open_count = 0;
++	atomic_set(&hvcsd->open_count, 0);
+ 
+ 	/* This will drop any buffered data on the floor which is OK in a hangup
+ 	 * scenario. */
+@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
+ 	 * the middle of a write operation?  This is a crummy place to do this
+ 	 * but we want to keep it all in the spinlock.
+ 	 */
+-	if (hvcsd->open_count <= 0) {
++	if (atomic_read(&hvcsd->open_count) <= 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		return -ENODEV;
+ 	}
+@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
+ {
+ 	struct hvcs_struct *hvcsd = tty->driver_data;
+ 
+-	if (!hvcsd || hvcsd->open_count <= 0)
++	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
+ 		return 0;
+ 
+ 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
+diff -urNp linux-2.6.32.13/drivers/char/hvc_udbg.c linux-2.6.32.13/drivers/char/hvc_udbg.c
+--- linux-2.6.32.13/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_udbg.c	2010-05-15 13:21:14.967285135 -0400
+@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_udbg_ops = {
++static const struct hv_ops hvc_udbg_ops = {
+ 	.get_chars = hvc_udbg_get,
+ 	.put_chars = hvc_udbg_put,
+ };
+diff -urNp linux-2.6.32.13/drivers/char/hvc_vio.c linux-2.6.32.13/drivers/char/hvc_vio.c
+--- linux-2.6.32.13/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_vio.c	2010-05-15 13:21:14.967285135 -0400
+@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
+ 	return got;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = filtered_get_chars,
+ 	.put_chars = hvc_put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.13/drivers/char/hvc_xen.c linux-2.6.32.13/drivers/char/hvc_xen.c
+--- linux-2.6.32.13/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/hvc_xen.c	2010-05-15 13:21:14.967285135 -0400
+@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
+ 	return recv;
+ }
+ 
+-static struct hv_ops hvc_ops = {
++static const struct hv_ops hvc_ops = {
+ 	.get_chars = read_console,
+ 	.put_chars = write_console,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c
+--- linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c	2010-05-15 13:21:15.002974818 -0400
+@@ -414,7 +414,7 @@ struct ipmi_smi {
+ 	struct proc_dir_entry *proc_dir;
+ 	char                  proc_dir_name[10];
+ 
+-	atomic_t stats[IPMI_NUM_STATS];
++	atomic_unchecked_t stats[IPMI_NUM_STATS];
+ 
+ 	/*
+ 	 * run_to_completion duplicate of smb_info, smi_info
+@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
+ 
+ 
+ #define ipmi_inc_stat(intf, stat) \
+-	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
++	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
+ #define ipmi_get_stat(intf, stat) \
+-	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
+ 
+ static int is_lan_addr(struct ipmi_addr *addr)
+ {
+@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
+ 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
+ 	init_waitqueue_head(&intf->waitq);
+ 	for (i = 0; i < IPMI_NUM_STATS; i++)
+-		atomic_set(&intf->stats[i], 0);
++		atomic_set_unchecked(&intf->stats[i], 0);
+ 
+ 	intf->proc_dir = NULL;
+ 
+diff -urNp linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c
+--- linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c	2010-05-15 13:21:15.014624441 -0400
+@@ -277,7 +277,7 @@ struct smi_info {
+ 	unsigned char slave_addr;
+ 
+ 	/* Counters and things for the proc filesystem. */
+-	atomic_t stats[SI_NUM_STATS];
++	atomic_unchecked_t stats[SI_NUM_STATS];
+ 
+ 	struct task_struct *thread;
+ 
+@@ -285,9 +285,9 @@ struct smi_info {
+ };
+ 
+ #define smi_inc_stat(smi, stat) \
+-	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
++	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
+ #define smi_get_stat(smi, stat) \
+-	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
+ 
+ #define SI_MAX_PARMS 4
+ 
+@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
+ 	atomic_set(&new_smi->req_events, 0);
+ 	new_smi->run_to_completion = 0;
+ 	for (i = 0; i < SI_NUM_STATS; i++)
+-		atomic_set(&new_smi->stats[i], 0);
++		atomic_set_unchecked(&new_smi->stats[i], 0);
+ 
+ 	new_smi->interrupt_disabled = 0;
+ 	atomic_set(&new_smi->stop_operation, 0);
+diff -urNp linux-2.6.32.13/drivers/char/keyboard.c linux-2.6.32.13/drivers/char/keyboard.c
+--- linux-2.6.32.13/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/keyboard.c	2010-05-15 13:21:15.018564312 -0400
+@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
+ 	     kbd->kbdmode == VC_MEDIUMRAW) &&
+ 	     value != KVAL(K_SAK))
+ 		return;		/* SAK is allowed even in raw mode */
++
++#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
++	{
++		void *func = fn_handler[value];
++		if (func == fn_show_state || func == fn_show_ptregs ||
++		    func == fn_show_mem)
++			return;
++	}
++#endif
++
+ 	fn_handler[value](vc);
+ }
+ 
+@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
+                 .evbit = { BIT_MASK(EV_SND) },
+         },
+ 
+-	{ },    /* Terminating entry */
++	{ 0 },    /* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE(input, kbd_ids);
+diff -urNp linux-2.6.32.13/drivers/char/mem.c linux-2.6.32.13/drivers/char/mem.c
+--- linux-2.6.32.13/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/mem.c	2010-05-15 13:21:15.018564312 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/raw.h>
+ #include <linux/tty.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/ptrace.h>
+ #include <linux/device.h>
+ #include <linux/highmem.h>
+@@ -35,6 +36,10 @@
+ # include <linux/efi.h>
+ #endif
+ 
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++extern struct file_operations grsec_fops;
++#endif
++
+ static inline unsigned long size_inside_page(unsigned long start,
+ 					     unsigned long size)
+ {
+@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
+ 	if (!valid_phys_addr_range(p, count))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_mem_write();
++	return -EPERM;
++#endif
++
+ 	written = 0;
+ 
+ #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
+@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
+ 						&vma->vm_page_prot))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
++		return -EPERM;
++#endif
++
+ 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
+ 						 size,
+ 						 vma->vm_page_prot);
+@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
+ 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+ 	int err = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_kmem_write();
++	return -EPERM;
++#endif
++
+ 	if (p < (unsigned long) high_memory) {
+ 
+ 		wrote = count;
+@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
+ 
+ static int open_port(struct inode * inode, struct file * filp)
+ {
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_open_port();
++	return -EPERM;
++#endif
++
++	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
++}
++
++static int open_mem(struct inode * inode, struct file * filp)
++{
+ 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
+ }
+ 
+@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
+ #define full_lseek      null_lseek
+ #define write_zero	write_null
+ #define read_full       read_zero
+-#define open_mem	open_port
+ #define open_kmem	open_mem
+ #define open_oldmem	open_mem
+ 
+@@ -888,6 +917,9 @@ static const struct memdev {
+ #ifdef CONFIG_CRASH_DUMP
+ 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
+ #endif
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
++#endif
+ };
+ 
+ static int memory_open(struct inode *inode, struct file *filp)
+diff -urNp linux-2.6.32.13/drivers/char/nvram.c linux-2.6.32.13/drivers/char/nvram.c
+--- linux-2.6.32.13/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/nvram.c	2010-05-15 13:21:15.018564312 -0400
+@@ -429,7 +429,10 @@ static const struct file_operations nvra
+ static struct miscdevice nvram_dev = {
+ 	NVRAM_MINOR,
+ 	"nvram",
+-	&nvram_fops
++	&nvram_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static int __init nvram_init(void)
+diff -urNp linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c
+--- linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c	2010-05-15 13:21:15.018564312 -0400
+@@ -51,7 +51,7 @@ struct ipw_tty {
+ 	int tty_type;
+ 	struct ipw_network *network;
+ 	struct tty_struct *linux_tty;
+-	int open_count;
++	atomic_t open_count;
+ 	unsigned int control_lines;
+ 	struct mutex ipw_tty_mutex;
+ 	int tx_bytes_queued;
+@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -ENODEV;
+ 	}
+-	if (tty->open_count == 0)
++	if (atomic_read(&tty->open_count) == 0)
+ 		tty->tx_bytes_queued = 0;
+ 
+-	tty->open_count++;
++	atomic_inc(&tty->open_count);
+ 
+ 	tty->linux_tty = linux_tty;
+ 	linux_tty->driver_data = tty;
+@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
+ 
+ static void do_ipw_close(struct ipw_tty *tty)
+ {
+-	tty->open_count--;
+-
+-	if (tty->open_count == 0) {
++	if (atomic_dec_return(&tty->open_count) == 0) {
+ 		struct tty_struct *linux_tty = tty->linux_tty;
+ 
+ 		if (linux_tty != NULL) {
+@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
+ 		return;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (tty->open_count == 0) {
++	if (atomic_read(&tty->open_count) == 0) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
+ 		return;
+ 	}
+ 
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
+ 		return -ENODEV;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -EINVAL;
+ 	}
+@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
+@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
+ 	if (!tty)
+ 		return 0;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return 0;
+ 
+ 	return tty->tx_bytes_queued;
+@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return get_control_lines(tty);
+@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return set_control_lines(tty, set, clear);
+@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	/* FIXME: Exactly how is the tty object locked here .. */
+@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
+ 				   against a parallel ioctl etc */
+ 				mutex_lock(&ttyj->ipw_tty_mutex);
+ 			}
+-			while (ttyj->open_count)
++			while (atomic_read(&ttyj->open_count))
+ 				do_ipw_close(ttyj);
+ 			ipwireless_disassociate_network_ttys(network,
+ 							     ttyj->channel_idx);
+diff -urNp linux-2.6.32.13/drivers/char/pty.c linux-2.6.32.13/drivers/char/pty.c
+--- linux-2.6.32.13/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/pty.c	2010-05-15 13:21:15.035728941 -0400
+@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
+ 	return ret;
+ }
+ 
+-static struct file_operations ptmx_fops;
++static const struct file_operations ptmx_fops = {
++	.llseek		= no_llseek,
++	.read		= tty_read,
++	.write		= tty_write,
++	.poll		= tty_poll,
++	.unlocked_ioctl	= tty_ioctl,
++	.compat_ioctl	= tty_compat_ioctl,
++	.open		= ptmx_open,
++	.release	= tty_release,
++	.fasync		= tty_fasync,
++};
++
+ 
+ static void __init unix98_pty_init(void)
+ {
+@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
+ 	register_sysctl_table(pty_root_table);
+ 
+ 	/* Now create the /dev/ptmx special device */
+-	tty_default_fops(&ptmx_fops);
+-	ptmx_fops.open = ptmx_open;
+-
+ 	cdev_init(&ptmx_cdev, &ptmx_fops);
+ 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
+ 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
+diff -urNp linux-2.6.32.13/drivers/char/random.c linux-2.6.32.13/drivers/char/random.c
+--- linux-2.6.32.13/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/random.c	2010-05-15 13:21:15.038954680 -0400
+@@ -254,8 +254,13 @@
+ /*
+  * Configuration information
+  */
++#ifdef CONFIG_GRKERNSEC_RANDNET
++#define INPUT_POOL_WORDS 512
++#define OUTPUT_POOL_WORDS 128
++#else
+ #define INPUT_POOL_WORDS 128
+ #define OUTPUT_POOL_WORDS 32
++#endif
+ #define SEC_XFER_SIZE 512
+ 
+ /*
+@@ -292,10 +297,17 @@ static struct poolinfo {
+ 	int poolwords;
+ 	int tap1, tap2, tap3, tap4, tap5;
+ } poolinfo_table[] = {
++#ifdef CONFIG_GRKERNSEC_RANDNET
++	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
++	{ 512,	411,	308,	208,	104,	1 },
++	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
++	{ 128,	103,	76,	51,	25,	1 },
++#else
+ 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
+ 	{ 128,	103,	76,	51,	25,	1 },
+ 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
+ 	{ 32,	26,	20,	14,	7,	1 },
++#endif
+ #if 0
+ 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
+ 	{ 2048,	1638,	1231,	819,	411,	1 },
+@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+ #include <linux/sysctl.h>
+ 
+ static int min_read_thresh = 8, min_write_thresh;
+-static int max_read_thresh = INPUT_POOL_WORDS * 32;
++static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
+ static int max_write_thresh = INPUT_POOL_WORDS * 32;
+ static char sysctl_bootid[16];
+ 
+diff -urNp linux-2.6.32.13/drivers/char/sonypi.c linux-2.6.32.13/drivers/char/sonypi.c
+--- linux-2.6.32.13/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/sonypi.c	2010-05-15 13:21:15.038954680 -0400
+@@ -491,7 +491,7 @@ static struct sonypi_device {
+ 	spinlock_t fifo_lock;
+ 	wait_queue_head_t fifo_proc_list;
+ 	struct fasync_struct *fifo_async;
+-	int open_count;
++	atomic_t open_count;
+ 	int model;
+ 	struct input_dev *input_jog_dev;
+ 	struct input_dev *input_key_dev;
+@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
+ static int sonypi_misc_release(struct inode *inode, struct file *file)
+ {
+ 	mutex_lock(&sonypi_device.lock);
+-	sonypi_device.open_count--;
++	atomic_dec(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	return 0;
+ }
+@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
+ 	lock_kernel();
+ 	mutex_lock(&sonypi_device.lock);
+ 	/* Flush input queue on first open */
+-	if (!sonypi_device.open_count)
++	if (!atomic_read(&sonypi_device.open_count))
+ 		kfifo_reset(sonypi_device.fifo);
+-	sonypi_device.open_count++;
++	atomic_inc(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	unlock_kernel();
+ 	return 0;
+diff -urNp linux-2.6.32.13/drivers/char/tpm/tpm_bios.c linux-2.6.32.13/drivers/char/tpm/tpm_bios.c
+--- linux-2.6.32.13/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/tpm/tpm_bios.c	2010-05-15 13:21:15.042644897 -0400
+@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
+ 	event = addr;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	return addr;
+@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
+ 		return NULL;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	(*pos)++;
+@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
+ 	int i;
+ 
+ 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
+-		seq_putc(m, data[i]);
++		if (!seq_putc(m, data[i]))
++			return -EFAULT;
+ 
+ 	return 0;
+ }
+@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
+ 	log->bios_event_log_end = log->bios_event_log + len;
+ 
+ 	virt = acpi_os_map_memory(start, len);
++	if (!virt) {
++		kfree(log->bios_event_log);
++		log->bios_event_log = NULL;
++		return -EFAULT;
++	}
+ 
+ 	memcpy(log->bios_event_log, virt, len);
+ 
+diff -urNp linux-2.6.32.13/drivers/char/tty_io.c linux-2.6.32.13/drivers/char/tty_io.c
+--- linux-2.6.32.13/drivers/char/tty_io.c	2010-04-29 17:49:37.826084348 -0400
++++ linux-2.6.32.13/drivers/char/tty_io.c	2010-05-15 13:21:15.058626500 -0400
+@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
+ DEFINE_MUTEX(tty_mutex);
+ EXPORT_SYMBOL(tty_mutex);
+ 
+-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
+-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
+ ssize_t redirected_tty_write(struct file *, const char __user *,
+ 							size_t, loff_t *);
+-static unsigned int tty_poll(struct file *, poll_table *);
+ static int tty_open(struct inode *, struct file *);
+-static int tty_release(struct inode *, struct file *);
+ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+-#ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+-				unsigned long arg);
+-#else
+-#define tty_compat_ioctl NULL
+-#endif
+-static int tty_fasync(int fd, struct file *filp, int on);
+ static void release_tty(struct tty_struct *tty, int idx);
+ static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+ static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
+  *	read calls may be outstanding in parallel.
+  */
+ 
+-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
++ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 			loff_t *ppos)
+ {
+ 	int i;
+@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
+ 	return i;
+ }
+ 
++EXPORT_SYMBOL(tty_read);
++
+ void tty_write_unlock(struct tty_struct *tty)
+ {
+ 	mutex_unlock(&tty->atomic_write_lock);
+@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
+  *	write method will not be invoked in parallel for each device.
+  */
+ 
+-static ssize_t tty_write(struct file *file, const char __user *buf,
++ssize_t tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+ 	struct tty_struct *tty;
+@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
+ 	return ret;
+ }
+ 
++EXPORT_SYMBOL(tty_write);
++
+ ssize_t redirected_tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+@@ -1867,7 +1860,7 @@ static int tty_open(struct inode *inode,
+  *		Takes bkl. See tty_release_dev
+  */
+ 
+-static int tty_release(struct inode *inode, struct file *filp)
++int tty_release(struct inode *inode, struct file *filp)
+ {
+ 	lock_kernel();
+ 	tty_release_dev(filp);
+@@ -1875,6 +1868,8 @@ static int tty_release(struct inode *ino
+ 	return 0;
+ }
+ 
++EXPORT_SYMBOL(tty_release);
++
+ /**
+  *	tty_poll	-	check tty status
+  *	@filp: file being polled
+@@ -1887,7 +1882,7 @@ static int tty_release(struct inode *ino
+  *	may be re-entered freely by other callers.
+  */
+ 
+-static unsigned int tty_poll(struct file *filp, poll_table *wait)
++unsigned int tty_poll(struct file *filp, poll_table *wait)
+ {
+ 	struct tty_struct *tty;
+ 	struct tty_ldisc *ld;
+@@ -1904,7 +1899,9 @@ static unsigned int tty_poll(struct file
+ 	return ret;
+ }
+ 
+-static int tty_fasync(int fd, struct file *filp, int on)
++EXPORT_SYMBOL(tty_poll);
++
++int tty_fasync(int fd, struct file *filp, int on)
+ {
+ 	struct tty_struct *tty;
+ 	unsigned long flags;
+@@ -1948,6 +1945,8 @@ out:
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_fasync);
++
+ /**
+  *	tiocsti			-	fake input character
+  *	@tty: tty to fake input into
+@@ -2582,8 +2581,10 @@ long tty_ioctl(struct file *file, unsign
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_ioctl);
++
+ #ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
++long tty_compat_ioctl(struct file *file, unsigned int cmd,
+ 				unsigned long arg)
+ {
+ 	struct inode *inode = file->f_dentry->d_inode;
+@@ -2607,6 +2608,8 @@ static long tty_compat_ioctl(struct file
+ 
+ 	return retval;
+ }
++
++EXPORT_SYMBOL(tty_compat_ioctl);
+ #endif
+ 
+ /*
+@@ -3050,11 +3053,6 @@ struct tty_struct *get_current_tty(void)
+ }
+ EXPORT_SYMBOL_GPL(get_current_tty);
+ 
+-void tty_default_fops(struct file_operations *fops)
+-{
+-	*fops = tty_fops;
+-}
+-
+ /*
+  * Initialize the console device. This is called *early*, so
+  * we can't necessarily depend on lots of kernel help here.
+diff -urNp linux-2.6.32.13/drivers/char/tty_ldisc.c linux-2.6.32.13/drivers/char/tty_ldisc.c
+--- linux-2.6.32.13/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/tty_ldisc.c	2010-05-15 13:21:15.058626500 -0400
+@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
+ 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+ 		struct tty_ldisc_ops *ldo = ld->ops;
+ 
+-		ldo->refcount--;
++		atomic_dec(&ldo->refcount);
+ 		module_put(ldo->owner);
+ 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+ 	tty_ldiscs[disc] = new_ldisc;
+ 	new_ldisc->num = disc;
+-	new_ldisc->refcount = 0;
++	atomic_set(&new_ldisc->refcount, 0);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+ 	return ret;
+@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	if (tty_ldiscs[disc]->refcount)
++	if (atomic_read(&tty_ldiscs[disc]->refcount))
+ 		ret = -EBUSY;
+ 	else
+ 		tty_ldiscs[disc] = NULL;
+@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
+ 	if (ldops) {
+ 		ret = ERR_PTR(-EAGAIN);
+ 		if (try_module_get(ldops->owner)) {
+-			ldops->refcount++;
++			atomic_inc(&ldops->refcount);
+ 			ret = ldops;
+ 		}
+ 	}
+@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	ldops->refcount--;
++	atomic_dec(&ldops->refcount);
+ 	module_put(ldops->owner);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ }
+diff -urNp linux-2.6.32.13/drivers/char/virtio_console.c linux-2.6.32.13/drivers/char/virtio_console.c
+--- linux-2.6.32.13/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/virtio_console.c	2010-05-15 13:21:15.058626500 -0400
+@@ -44,6 +44,7 @@ static unsigned int in_len;
+ static char *in, *inbuf;
+ 
+ /* The operations for our console. */
++/* cannot be const */
+ static struct hv_ops virtio_cons;
+ 
+ /* The hvc device */
+diff -urNp linux-2.6.32.13/drivers/char/vt_ioctl.c linux-2.6.32.13/drivers/char/vt_ioctl.c
+--- linux-2.6.32.13/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/char/vt_ioctl.c	2010-05-15 13:21:15.062960555 -0400
+@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
+ 	case KDSKBENT:
+ 		if (!perm)
+ 			return -EPERM;
++
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG))
++			return -EPERM;
++#endif
++
+ 		if (!i && v == K_NOSUCHMAP) {
+ 			/* deallocate map */
+ 			key_map = key_maps[s];
+@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
+ 			goto reterr;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG)) {
++			ret = -EPERM;
++			goto reterr;
++		}
++#endif
++
+ 		q = func_table[i];
+ 		first_free = funcbufptr + (funcbufsize - funcbufleft);
+ 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
+diff -urNp linux-2.6.32.13/drivers/cpufreq/cpufreq.c linux-2.6.32.13/drivers/cpufreq/cpufreq.c
+--- linux-2.6.32.13/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/cpufreq/cpufreq.c	2010-05-15 13:21:15.062960555 -0400
+@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
+ 	complete(&policy->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= show,
+ 	.store	= store,
+ };
+diff -urNp linux-2.6.32.13/drivers/cpuidle/sysfs.c linux-2.6.32.13/drivers/cpuidle/sysfs.c
+--- linux-2.6.32.13/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/cpuidle/sysfs.c	2010-05-15 13:21:15.062960555 -0400
+@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_sysfs_ops = {
++static const struct sysfs_ops cpuidle_sysfs_ops = {
+ 	.show = cpuidle_show,
+ 	.store = cpuidle_store,
+ };
+@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_state_sysfs_ops = {
++static const struct sysfs_ops cpuidle_state_sysfs_ops = {
+ 	.show = cpuidle_state_show,
+ };
+ 
+@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
+ 	.release = cpuidle_state_sysfs_release,
+ };
+ 
+-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
++static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
+ {
+ 	kobject_put(&device->kobjs[i]->kobj);
+ 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
+diff -urNp linux-2.6.32.13/drivers/dma/ioat/dma.c linux-2.6.32.13/drivers/dma/ioat/dma.c
+--- linux-2.6.32.13/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/dma/ioat/dma.c	2010-05-15 13:21:15.074651091 -0400
+@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
+ 	return entry->show(&chan->common, page);
+ }
+ 
+-struct sysfs_ops ioat_sysfs_ops = {
++const struct sysfs_ops ioat_sysfs_ops = {
+ 	.show	= ioat_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/dma/ioat/dma.h linux-2.6.32.13/drivers/dma/ioat/dma.h
+--- linux-2.6.32.13/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/dma/ioat/dma.h	2010-05-15 13:21:15.090639890 -0400
+@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
+ 			   unsigned long *phys_complete);
+ void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
+ void ioat_kobject_del(struct ioatdma_device *device);
+-extern struct sysfs_ops ioat_sysfs_ops;
++extern const struct sysfs_ops ioat_sysfs_ops;
+ extern struct ioat_sysfs_entry ioat_version_attr;
+ extern struct ioat_sysfs_entry ioat_cap_attr;
+ #endif /* IOATDMA_H */
+diff -urNp linux-2.6.32.13/drivers/edac/edac_core.h linux-2.6.32.13/drivers/edac/edac_core.h
+--- linux-2.6.32.13/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/edac/edac_core.h	2010-05-15 13:21:15.090639890 -0400
+@@ -99,11 +99,11 @@ extern int edac_debug_level;
+ 
+ #else				/* !CONFIG_EDAC_DEBUG */
+ 
+-#define debugf0( ... )
+-#define debugf1( ... )
+-#define debugf2( ... )
+-#define debugf3( ... )
+-#define debugf4( ... )
++#define debugf0( ... ) do {} while (0)
++#define debugf1( ... ) do {} while (0)
++#define debugf2( ... ) do {} while (0)
++#define debugf3( ... ) do {} while (0)
++#define debugf4( ... ) do {} while (0)
+ 
+ #endif				/* !CONFIG_EDAC_DEBUG */
+ 
+diff -urNp linux-2.6.32.13/drivers/edac/edac_device_sysfs.c linux-2.6.32.13/drivers/edac/edac_device_sysfs.c
+--- linux-2.6.32.13/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/edac/edac_device_sysfs.c	2010-05-15 13:21:15.090639890 -0400
+@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
+ }
+ 
+ /* edac_dev file operations for an 'ctl_info' */
+-static struct sysfs_ops device_ctl_info_ops = {
++static const struct sysfs_ops device_ctl_info_ops = {
+ 	.show = edac_dev_ctl_info_show,
+ 	.store = edac_dev_ctl_info_store
+ };
+@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
+ }
+ 
+ /* edac_dev file operations for an 'instance' */
+-static struct sysfs_ops device_instance_ops = {
++static const struct sysfs_ops device_instance_ops = {
+ 	.show = edac_dev_instance_show,
+ 	.store = edac_dev_instance_store
+ };
+@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
+ }
+ 
+ /* edac_dev file operations for a 'block' */
+-static struct sysfs_ops device_block_ops = {
++static const struct sysfs_ops device_block_ops = {
+ 	.show = edac_dev_block_show,
+ 	.store = edac_dev_block_store
+ };
+diff -urNp linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c
+--- linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c	2010-05-15 13:21:15.090639890 -0400
+@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops csrowfs_ops = {
++static const struct sysfs_ops csrowfs_ops = {
+ 	.show = csrowdev_show,
+ 	.store = csrowdev_store
+ };
+@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
+ }
+ 
+ /* Intermediate show/store table */
+-static struct sysfs_ops mci_ops = {
++static const struct sysfs_ops mci_ops = {
+ 	.show = mcidev_show,
+ 	.store = mcidev_store
+ };
+diff -urNp linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c
+--- linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c	2010-05-15 13:21:15.090639890 -0400
+@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
+ }
+ 
+ /* fs_ops table */
+-static struct sysfs_ops pci_instance_ops = {
++static const struct sysfs_ops pci_instance_ops = {
+ 	.show = edac_pci_instance_show,
+ 	.store = edac_pci_instance_store
+ };
+@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops edac_pci_sysfs_ops = {
++static const struct sysfs_ops edac_pci_sysfs_ops = {
+ 	.show = edac_pci_dev_show,
+ 	.store = edac_pci_dev_store
+ };
+diff -urNp linux-2.6.32.13/drivers/firewire/core-cdev.c linux-2.6.32.13/drivers/firewire/core-cdev.c
+--- linux-2.6.32.13/drivers/firewire/core-cdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firewire/core-cdev.c	2010-05-15 13:21:15.094957471 -0400
+@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
+ 	int ret;
+ 
+ 	if ((request->channels == 0 && request->bandwidth == 0) ||
+-	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
+-	    request->bandwidth < 0)
++	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
+ 		return -EINVAL;
+ 
+ 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
+diff -urNp linux-2.6.32.13/drivers/firmware/dmi_scan.c linux-2.6.32.13/drivers/firmware/dmi_scan.c
+--- linux-2.6.32.13/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firmware/dmi_scan.c	2010-05-15 13:21:15.094957471 -0400
+@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
+ 		}
+ 	}
+ 	else {
+-		/*
+-		 * no iounmap() for that ioremap(); it would be a no-op, but
+-		 * it's so early in setup that sucker gets confused into doing
+-		 * what it shouldn't if we actually call it.
+-		 */
+ 		p = dmi_ioremap(0xF0000, 0x10000);
+ 		if (p == NULL)
+ 			goto error;
+diff -urNp linux-2.6.32.13/drivers/firmware/edd.c linux-2.6.32.13/drivers/firmware/edd.c
+--- linux-2.6.32.13/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firmware/edd.c	2010-05-15 13:21:15.094957471 -0400
+@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops edd_attr_ops = {
++static const struct sysfs_ops edd_attr_ops = {
+ 	.show = edd_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/firmware/efivars.c linux-2.6.32.13/drivers/firmware/efivars.c
+--- linux-2.6.32.13/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firmware/efivars.c	2010-05-15 13:21:15.102953838 -0400
+@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops efivar_attr_ops = {
++static const struct sysfs_ops efivar_attr_ops = {
+ 	.show = efivar_attr_show,
+ 	.store = efivar_attr_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/firmware/iscsi_ibft.c linux-2.6.32.13/drivers/firmware/iscsi_ibft.c
+--- linux-2.6.32.13/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firmware/iscsi_ibft.c	2010-05-15 13:21:15.102953838 -0400
+@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops ibft_attr_ops = {
++static const struct sysfs_ops ibft_attr_ops = {
+ 	.show = ibft_show_attribute,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/firmware/memmap.c linux-2.6.32.13/drivers/firmware/memmap.c
+--- linux-2.6.32.13/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/firmware/memmap.c	2010-05-15 13:21:15.102953838 -0400
+@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
+ 	NULL
+ };
+ 
+-static struct sysfs_ops memmap_attr_ops = {
++static const struct sysfs_ops memmap_attr_ops = {
+ 	.show = memmap_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_drv.c linux-2.6.32.13/drivers/gpu/drm/drm_drv.c
+--- linux-2.6.32.13/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/drm_drv.c	2010-05-15 13:21:15.118645498 -0400
+@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
+ 	char *kdata = NULL;
+ 
+ 	atomic_inc(&dev->ioctl_count);
+-	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
+ 	++file_priv->ioctl_count;
+ 
+ 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_fops.c linux-2.6.32.13/drivers/gpu/drm/drm_fops.c
+--- linux-2.6.32.13/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:37.845185844 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/drm_fops.c	2010-05-15 13:21:15.130631389 -0400
+@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
+-		atomic_set(&dev->counts[i], 0);
++		atomic_set_unchecked(&dev->counts[i], 0);
+ 
+ 	dev->sigdata.lock = NULL;
+ 
+@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
+ 
+ 	retcode = drm_open_helper(inode, filp, dev);
+ 	if (!retcode) {
+-		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
++		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
+ 		spin_lock(&dev->count_lock);
+-		if (!dev->open_count++) {
++		if (atomic_inc_return(&dev->open_count) == 1) {
+ 			spin_unlock(&dev->count_lock);
+ 			retcode = drm_setup(dev);
+ 			goto out;
+@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
+ 
+ 	lock_kernel();
+ 
+-	DRM_DEBUG("open_count = %d\n", dev->open_count);
++	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
+ 
+ 	if (dev->driver->preclose)
+ 		dev->driver->preclose(dev, file_priv);
+@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
+ 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
+ 		  task_pid_nr(current),
+ 		  (long)old_encode_dev(file_priv->minor->device),
+-		  dev->open_count);
++		  atomic_read(&dev->open_count));
+ 
+ 	/* if the master has gone away we can't do anything with the lock */
+ 	if (file_priv->minor->master)
+@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
+ 	 * End inline drm_release
+ 	 */
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
+ 	spin_lock(&dev->count_lock);
+-	if (!--dev->open_count) {
++	if (atomic_dec_and_test(&dev->open_count)) {
+ 		if (atomic_read(&dev->ioctl_count)) {
+ 			DRM_ERROR("Device busy: %d\n",
+ 				  atomic_read(&dev->ioctl_count));
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c
+--- linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c	2010-05-15 13:21:15.138734335 -0400
+@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
+ 			stats->data[i].value =
+ 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
+ 		else
+-			stats->data[i].value = atomic_read(&dev->counts[i]);
++			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
+ 		stats->data[i].type = dev->types[i];
+ 	}
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_lock.c linux-2.6.32.13/drivers/gpu/drm/drm_lock.c
+--- linux-2.6.32.13/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/drm_lock.c	2010-05-15 13:21:15.138734335 -0400
+@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
+ 		if (drm_lock_take(&master->lock, lock->context)) {
+ 			master->lock.file_priv = file_priv;
+ 			master->lock.lock_time = jiffies;
+-			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
++			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
+ 			break;	/* Got lock */
+ 		}
+ 
+@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
+ 		return -EINVAL;
+ 	}
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
+ 
+ 	/* kernel_context_switch isn't used by any of the x86 drm
+ 	 * modules but is required by the Sparc driver.
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c
+--- linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c	2010-05-15 13:21:15.158669145 -0400
+@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
+ 				 dma->buflist[vertex->idx],
+ 				 vertex->discard, vertex->used);
+ 
+-	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
+ 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
+ 			     mc->last_render);
+ 
+-	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c	2010-05-15 13:21:15.175041309 -0400
+@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7017_ops = {
++const struct intel_dvo_dev_ops ch7017_ops = {
+ 	.init = ch7017_init,
+ 	.detect = ch7017_detect,
+ 	.mode_valid = ch7017_mode_valid,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-05-15 13:21:15.175041309 -0400
+@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7xxx_ops = {
++const struct intel_dvo_dev_ops ch7xxx_ops = {
+ 	.init = ch7xxx_init,
+ 	.detect = ch7xxx_detect,
+ 	.mode_valid = ch7xxx_mode_valid,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h	2010-05-15 13:21:15.175041309 -0400
+@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
+ 	 *
+ 	 * \return singly-linked list of modes or NULL if no modes found.
+ 	 */
+-	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
++	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Clean up driver-specific bits of the output
+ 	 */
+-	void (*destroy) (struct intel_dvo_device *dvo);
++	void (* const destroy) (struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Debugging hook to dump device registers to log file
+ 	 */
+-	void (*dump_regs)(struct intel_dvo_device *dvo);
++	void (* const dump_regs)(struct intel_dvo_device *dvo);
+ };
+ 
+-extern struct intel_dvo_dev_ops sil164_ops;
+-extern struct intel_dvo_dev_ops ch7xxx_ops;
+-extern struct intel_dvo_dev_ops ivch_ops;
+-extern struct intel_dvo_dev_ops tfp410_ops;
+-extern struct intel_dvo_dev_ops ch7017_ops;
++extern const struct intel_dvo_dev_ops sil164_ops;
++extern const struct intel_dvo_dev_ops ch7xxx_ops;
++extern const struct intel_dvo_dev_ops ivch_ops;
++extern const struct intel_dvo_dev_ops tfp410_ops;
++extern const struct intel_dvo_dev_ops ch7017_ops;
+ 
+ #endif /* _INTEL_DVO_H */
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c	2010-05-15 13:21:15.175041309 -0400
+@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ivch_ops= {
++const struct intel_dvo_dev_ops ivch_ops= {
+ 	.init = ivch_init,
+ 	.dpms = ivch_dpms,
+ 	.save = ivch_save,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c	2010-05-15 13:21:15.175041309 -0400
+@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops sil164_ops = {
++const struct intel_dvo_dev_ops sil164_ops = {
+ 	.init = sil164_init,
+ 	.detect = sil164_detect,
+ 	.mode_valid = sil164_mode_valid,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c	2010-05-15 13:21:15.178966455 -0400
+@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops tfp410_ops = {
++const struct intel_dvo_dev_ops tfp410_ops = {
+ 	.init = tfp410_init,
+ 	.detect = tfp410_detect,
+ 	.mode_valid = tfp410_mode_valid,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c
+--- linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c	2010-05-15 13:21:15.178966455 -0400
+@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
+ 	return i915_resume(dev);
+ }
+ 
+-static struct vm_operations_struct i915_gem_vm_ops = {
++static const struct vm_operations_struct i915_gem_vm_ops = {
+ 	.fault = i915_gem_fault,
+ 	.open = drm_gem_vm_open,
+ 	.close = drm_gem_vm_close,
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c
+--- linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c	2010-05-15 13:21:15.190982657 -0400
+@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
+ 	regex_t mask_rex;
+ 	regmatch_t match[4];
+ 	char buf[1024];
+-	size_t end;
++	long end;
+ 	int len;
+ 	int done = 0;
+ 	int r;
+ 	unsigned o;
+ 	struct offset *offset;
+ 	char last_reg_s[10];
+-	int last_reg;
++	unsigned long last_reg;
+ 
+ 	if (regcomp
+ 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c	2010-05-15 13:21:15.194751236 -0400
+@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
+ 	}
+ }
+ 
+-struct bios_connector {
++static struct bios_connector {
+ 	bool valid;
+ 	uint16_t line_mux;
+ 	uint16_t devices;
+ 	int connector_type;
+ 	struct radeon_i2c_bus_rec ddc_bus;
+-};
++} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ 								 drm_device
+@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
+ 	uint8_t dac;
+ 	union atom_supported_devices *supported_devices;
+ 	int i, j;
+-	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c
+--- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c	2010-05-15 13:21:15.198961996 -0400
+@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
+ 
+ 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
+ 						error = freq - current_freq;
+-						error = error < 0 ? 0xffffffff : error;
++						error = (int32_t)error < 0 ? 0xffffffff : error;
+ 					} else
+ 						error = abs(current_freq - freq);
+ 					vco_diff = abs(vco - best_vco);
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c
+--- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c	2010-05-15 13:21:15.206905040 -0400
+@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
+ {
+ 	drm_radeon_private_t *dev_priv = dev->dev_private;
+ 	drm_radeon_getparam_t *param = data;
+-	int value;
++	int value = 0;
+ 
+ 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c
+--- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c	2010-05-15 13:21:15.206905040 -0400
+@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
+ 	DRM_INFO("radeon: ttm finalized\n");
+ }
+ 
+-static struct vm_operations_struct radeon_ttm_vm_ops;
+-static const struct vm_operations_struct *ttm_vm_ops = NULL;
+-
+-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+-{
+-	struct ttm_buffer_object *bo;
+-	int r;
+-
+-	bo = (struct ttm_buffer_object *)vma->vm_private_data;
+-	if (bo == NULL) {
+-		return VM_FAULT_NOPAGE;
+-	}
+-	r = ttm_vm_ops->fault(vma, vmf);
+-	return r;
+-}
+-
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ 	struct drm_file *file_priv;
+ 	struct radeon_device *rdev;
+-	int r;
+ 
+ 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
+ 		return drm_mmap(filp, vma);
+@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
+ 
+ 	file_priv = (struct drm_file *)filp->private_data;
+ 	rdev = file_priv->minor->dev->dev_private;
+-	if (rdev == NULL) {
++	if (!rdev)
+ 		return -EINVAL;
+-	}
+-	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+-	if (unlikely(r != 0)) {
+-		return r;
+-	}
+-	if (unlikely(ttm_vm_ops == NULL)) {
+-		ttm_vm_ops = vma->vm_ops;
+-		radeon_ttm_vm_ops = *ttm_vm_ops;
+-		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
+-	}
+-	vma->vm_ops = &radeon_ttm_vm_ops;
+-	return 0;
++	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c
+--- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c	2010-05-15 13:21:15.206905040 -0400
+@@ -39,7 +39,7 @@
+ #include <linux/module.h>
+ 
+ #define TTM_ASSERT_LOCKED(param)
+-#define TTM_DEBUG(fmt, arg...)
++#define TTM_DEBUG(fmt, arg...) do {} while (0)
+ #define TTM_BO_HASH_ORDER 13
+ 
+ static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
+@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_bo_global_ops = {
++static const struct sysfs_ops ttm_bo_global_ops = {
+ 	.show = &ttm_bo_global_show
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c
+--- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-05-15 13:21:15.206905040 -0400
+@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
+ {
+ 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
+ 	    vma->vm_private_data;
+-	struct ttm_bo_device *bdev = bo->bdev;
++	struct ttm_bo_device *bdev;
+ 	unsigned long bus_base;
+ 	unsigned long bus_offset;
+ 	unsigned long bus_size;
+@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
+ 	unsigned long address = (unsigned long)vmf->virtual_address;
+ 	int retval = VM_FAULT_NOPAGE;
+ 
++	if (!bo)
++		return VM_FAULT_NOPAGE;
++	bdev = bo->bdev;
++
+ 	/*
+ 	 * Work around locking order reversal in fault / nopfn
+ 	 * between mmap_sem and bo_reserve: Perform a trylock operation
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c
+--- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c	2010-05-15 13:21:15.206905040 -0400
+@@ -36,7 +36,7 @@
+ struct ttm_global_item {
+ 	struct mutex mutex;
+ 	void *object;
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ static struct ttm_global_item glob[TTM_GLOBAL_NUM];
+@@ -49,7 +49,7 @@ void ttm_global_init(void)
+ 		struct ttm_global_item *item = &glob[i];
+ 		mutex_init(&item->mutex);
+ 		item->object = NULL;
+-		item->refcount = 0;
++		atomic_set(&item->refcount, 0);
+ 	}
+ }
+ 
+@@ -59,7 +59,7 @@ void ttm_global_release(void)
+ 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
+ 		struct ttm_global_item *item = &glob[i];
+ 		BUG_ON(item->object != NULL);
+-		BUG_ON(item->refcount != 0);
++		BUG_ON(atomic_read(&item->refcount) != 0);
+ 	}
+ }
+ 
+@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 	void *object;
+ 
+ 	mutex_lock(&item->mutex);
+-	if (item->refcount == 0) {
++	if (atomic_read(&item->refcount) == 0) {
+ 		item->object = kzalloc(ref->size, GFP_KERNEL);
+ 		if (unlikely(item->object == NULL)) {
+ 			ret = -ENOMEM;
+@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 			goto out_err;
+ 
+ 	}
+-	++item->refcount;
++	atomic_inc(&item->refcount);
+ 	ref->object = item->object;
+ 	object = item->object;
+ 	mutex_unlock(&item->mutex);
+@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
+ 	struct ttm_global_item *item = &glob[ref->global_type];
+ 
+ 	mutex_lock(&item->mutex);
+-	BUG_ON(item->refcount == 0);
++	BUG_ON(atomic_read(&item->refcount) == 0);
+ 	BUG_ON(ref->object != item->object);
+-	if (--item->refcount == 0) {
++	if (atomic_dec_and_test(&item->refcount)) {
+ 		ref->release(ref);
+ 		item->object = NULL;
+ 	}
+diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c
+--- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c	2010-05-15 13:21:15.206905040 -0400
+@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_mem_zone_ops = {
++static const struct sysfs_ops ttm_mem_zone_ops = {
+ 	.show = &ttm_mem_zone_show,
+ 	.store = &ttm_mem_zone_store
+ };
+diff -urNp linux-2.6.32.13/drivers/hid/usbhid/hiddev.c linux-2.6.32.13/drivers/hid/usbhid/hiddev.c
+--- linux-2.6.32.13/drivers/hid/usbhid/hiddev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hid/usbhid/hiddev.c	2010-05-15 13:21:15.206905040 -0400
+@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
+ 		return put_user(HID_VERSION, (int __user *)arg);
+ 
+ 	case HIDIOCAPPLICATION:
+-		if (arg < 0 || arg >= hid->maxapplication)
++		if (arg >= hid->maxapplication)
+ 			return -EINVAL;
+ 
+ 		for (i = 0; i < hid->maxcollection; i++)
+diff -urNp linux-2.6.32.13/drivers/hwmon/k8temp.c linux-2.6.32.13/drivers/hwmon/k8temp.c
+--- linux-2.6.32.13/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hwmon/k8temp.c	2010-05-15 13:21:15.206905040 -0400
+@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
+ 
+ static struct pci_device_id k8temp_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, k8temp_ids);
+diff -urNp linux-2.6.32.13/drivers/hwmon/sis5595.c linux-2.6.32.13/drivers/hwmon/sis5595.c
+--- linux-2.6.32.13/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hwmon/sis5595.c	2010-05-15 13:21:15.222963784 -0400
+@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
+ 
+ static struct pci_device_id sis5595_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
+diff -urNp linux-2.6.32.13/drivers/hwmon/via686a.c linux-2.6.32.13/drivers/hwmon/via686a.c
+--- linux-2.6.32.13/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hwmon/via686a.c	2010-05-15 13:21:15.230602217 -0400
+@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
+ 
+ static struct pci_device_id via686a_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
+diff -urNp linux-2.6.32.13/drivers/hwmon/vt8231.c linux-2.6.32.13/drivers/hwmon/vt8231.c
+--- linux-2.6.32.13/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hwmon/vt8231.c	2010-05-15 13:21:15.230602217 -0400
+@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
+ 
+ static struct pci_device_id vt8231_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
+diff -urNp linux-2.6.32.13/drivers/hwmon/w83791d.c linux-2.6.32.13/drivers/hwmon/w83791d.c
+--- linux-2.6.32.13/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/hwmon/w83791d.c	2010-05-15 13:21:15.234719424 -0400
+@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
+ 			  struct i2c_board_info *info);
+ static int w83791d_remove(struct i2c_client *client);
+ 
+-static int w83791d_read(struct i2c_client *client, u8 register);
+-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
++static int w83791d_read(struct i2c_client *client, u8 reg);
++static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
+ static struct w83791d_data *w83791d_update_device(struct device *dev);
+ 
+ #ifdef DEBUG
+diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c
+--- linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c	2010-04-29 17:49:37.945518391 -0400
++++ linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c	2010-05-15 13:21:15.234719424 -0400
+@@ -582,7 +582,7 @@ static struct pci_device_id i801_ids[] =
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CPT_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, i801_ids);
+diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c
+--- linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c	2010-05-15 13:21:15.234719424 -0400
+@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
+ 		.ident = "IBM",
+ 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+-	{ },
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
+@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, piix4_ids);
+diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c
+--- linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c	2010-05-15 13:21:15.234719424 -0400
+@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
+ static struct pci_device_id sis630_ids[] __devinitdata = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis630_ids);
+diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c
+--- linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c	2010-05-15 13:21:15.234719424 -0400
+@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
+ 
+ static struct pci_device_id sis96x_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis96x_ids);
+diff -urNp linux-2.6.32.13/drivers/ide/ide-cd.c linux-2.6.32.13/drivers/ide/ide-cd.c
+--- linux-2.6.32.13/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ide/ide-cd.c	2010-05-15 13:21:15.234719424 -0400
+@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
+ 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
+ 		if ((unsigned long)buf & alignment
+ 		    || blk_rq_bytes(rq) & q->dma_pad_mask
+-		    || object_is_on_stack(buf))
++		    || object_starts_on_stack(buf))
+ 			drive->dma = 0;
+ 	}
+ }
+diff -urNp linux-2.6.32.13/drivers/ieee1394/dv1394.c linux-2.6.32.13/drivers/ieee1394/dv1394.c
+--- linux-2.6.32.13/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/dv1394.c	2010-05-15 13:21:15.234719424 -0400
+@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
+ 	based upon DIF section and sequence
+ */
+ 
+-static void inline
++static inline void
+ frame_put_packet (struct frame *f, struct packet *p)
+ {
+ 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
+@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
+ 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
+ 	},
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
+diff -urNp linux-2.6.32.13/drivers/ieee1394/eth1394.c linux-2.6.32.13/drivers/ieee1394/eth1394.c
+--- linux-2.6.32.13/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/eth1394.c	2010-05-15 13:21:15.250965621 -0400
+@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
+ 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
+ 		.version = ETHER1394_GASP_VERSION,
+ 	},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
+diff -urNp linux-2.6.32.13/drivers/ieee1394/hosts.c linux-2.6.32.13/drivers/ieee1394/hosts.c
+--- linux-2.6.32.13/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/hosts.c	2010-05-15 13:21:15.250965621 -0400
+@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
+ }
+ 
+ static struct hpsb_host_driver dummy_driver = {
++	.name =		   "dummy",
+ 	.transmit_packet = dummy_transmit_packet,
+ 	.devctl =	   dummy_devctl,
+ 	.isoctl =	   dummy_isoctl
+diff -urNp linux-2.6.32.13/drivers/ieee1394/ohci1394.c linux-2.6.32.13/drivers/ieee1394/ohci1394.c
+--- linux-2.6.32.13/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/ohci1394.c	2010-05-15 13:21:15.283282671 -0400
+@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
+ printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
+ 
+ /* Module Parameters */
+-static int phys_dma = 1;
++static int phys_dma;
+ module_param(phys_dma, int, 0444);
+-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
++MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
+ 
+ static void dma_trm_tasklet(unsigned long data);
+ static void dma_trm_reset(struct dma_trm_ctx *d);
+@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
+ 		.subvendor =	PCI_ANY_ID,
+ 		.subdevice =	PCI_ANY_ID,
+ 	},
+-	{ 0, },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
+diff -urNp linux-2.6.32.13/drivers/ieee1394/raw1394.c linux-2.6.32.13/drivers/ieee1394/raw1394.c
+--- linux-2.6.32.13/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/raw1394.c	2010-05-15 13:21:15.340016183 -0400
+@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
+ 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
+diff -urNp linux-2.6.32.13/drivers/ieee1394/sbp2.c linux-2.6.32.13/drivers/ieee1394/sbp2.c
+--- linux-2.6.32.13/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/sbp2.c	2010-05-15 13:21:15.374974502 -0400
+@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
+ 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
+ 
+@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
+ MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
+ MODULE_LICENSE("GPL");
+ 
+-static int sbp2_module_init(void)
++static int __init sbp2_module_init(void)
+ {
+ 	int ret;
+ 
+diff -urNp linux-2.6.32.13/drivers/ieee1394/video1394.c linux-2.6.32.13/drivers/ieee1394/video1394.c
+--- linux-2.6.32.13/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/ieee1394/video1394.c	2010-05-15 13:21:15.379405032 -0400
+@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
+                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
+         },
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
+diff -urNp linux-2.6.32.13/drivers/infiniband/core/cm.c linux-2.6.32.13/drivers/infiniband/core/cm.c
+--- linux-2.6.32.13/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/infiniband/core/cm.c	2010-05-15 13:21:15.390974340 -0400
+@@ -112,7 +112,7 @@ static char const counter_group_names[CM
+ 
+ struct cm_counter_group {
+ 	struct kobject obj;
+-	atomic_long_t counter[CM_ATTR_COUNT];
++	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
+ };
+ 
+ struct cm_counter_attribute {
+@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
+ 	struct ib_mad_send_buf *msg = NULL;
+ 	int ret;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REQ_COUNTER]);
+ 
+ 	/* Quick state check to discard duplicate REQs. */
+@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
+ 	if (!cm_id_priv)
+ 		return;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REP_COUNTER]);
+ 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+ 	if (ret)
+@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
+ 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
+ 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
+ 		spin_unlock_irq(&cm_id_priv->lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_RTU_COUNTER]);
+ 		goto out;
+ 	}
+@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
+ 				   dreq_msg->local_comm_id);
+ 	if (!cm_id_priv) {
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		cm_issue_drep(work->port, work->mad_recv_wc);
+ 		return -EINVAL;
+@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	case IB_CM_MRA_REP_RCVD:
+ 		break;
+ 	case IB_CM_TIMEWAIT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_DREQ_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
+ 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+ 				  cm_id_priv->msg, timeout)) {
+ 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
+-				atomic_long_inc(&work->port->
++				atomic_long_inc_unchecked(&work->port->
+ 						counter_group[CM_RECV_DUPLICATES].
+ 						counter[CM_MRA_COUNTER]);
+ 			goto out;
+@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
+ 		break;
+ 	case IB_CM_MRA_REQ_RCVD:
+ 	case IB_CM_MRA_REP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_MRA_COUNTER]);
+ 		/* fall through */
+ 	default:
+@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
+ 	case IB_CM_LAP_IDLE:
+ 		break;
+ 	case IB_CM_MRA_LAP_SENT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_LAP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
+ 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
+ 	if (cur_cm_id_priv) {
+ 		spin_unlock_irq(&cm.lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_SIDR_REQ_COUNTER]);
+ 		goto out; /* Duplicate message. */
+ 	}
+@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
+ 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
+ 		msg->retries = 1;
+ 
+-	atomic_long_add(1 + msg->retries,
++	atomic_long_add_unchecked(1 + msg->retries,
+ 			&port->counter_group[CM_XMIT].counter[attr_index]);
+ 	if (msg->retries)
+-		atomic_long_add(msg->retries,
++		atomic_long_add_unchecked(msg->retries,
+ 				&port->counter_group[CM_XMIT_RETRIES].
+ 				counter[attr_index]);
+ 
+@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
+ 	}
+ 
+ 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
+-	atomic_long_inc(&port->counter_group[CM_RECV].
++	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
+ 			counter[attr_id - CM_ATTR_ID_OFFSET]);
+ 
+ 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
+@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
+ 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
+ 
+ 	return sprintf(buf, "%ld\n",
+-		       atomic_long_read(&group->counter[cm_attr->index]));
++		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
+ }
+ 
+-static struct sysfs_ops cm_counter_ops = {
++static const struct sysfs_ops cm_counter_ops = {
+ 	.show = cm_show_counter
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/infiniband/core/sysfs.c linux-2.6.32.13/drivers/infiniband/core/sysfs.c
+--- linux-2.6.32.13/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/infiniband/core/sysfs.c	2010-05-15 13:21:15.420653417 -0400
+@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
+ 	return port_attr->show(p, port_attr, buf);
+ }
+ 
+-static struct sysfs_ops port_sysfs_ops = {
++static const struct sysfs_ops port_sysfs_ops = {
+ 	.show = port_attr_show
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/input/keyboard/atkbd.c linux-2.6.32.13/drivers/input/keyboard/atkbd.c
+--- linux-2.6.32.13/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/keyboard/atkbd.c	2010-05-15 13:21:15.420653417 -0400
+@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
+diff -urNp linux-2.6.32.13/drivers/input/mouse/lifebook.c linux-2.6.32.13/drivers/input/mouse/lifebook.c
+--- linux-2.6.32.13/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/mouse/lifebook.c	2010-05-15 13:21:15.420653417 -0400
+@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
+diff -urNp linux-2.6.32.13/drivers/input/mouse/psmouse-base.c linux-2.6.32.13/drivers/input/mouse/psmouse-base.c
+--- linux-2.6.32.13/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/mouse/psmouse-base.c	2010-05-15 13:21:15.430620618 -0400
+@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
+diff -urNp linux-2.6.32.13/drivers/input/mouse/synaptics.c linux-2.6.32.13/drivers/input/mouse/synaptics.c
+--- linux-2.6.32.13/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/mouse/synaptics.c	2010-05-15 13:21:15.430620618 -0400
+@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
+ 				break;
+ 			case 2:
+ 				if (SYN_MODEL_PEN(priv->model_id))
+-					;   /* Nothing, treat a pen as a single finger */
++					break;   /* Nothing, treat a pen as a single finger */
+ 				break;
+ 			case 4 ... 15:
+ 				if (SYN_CAP_PALMDETECT(priv->capabilities))
+@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
+ 		},
+-
+ 	},
+ 	{
+ 		.ident = "Toshiba Portege M300",
+@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
+ 		},
+-
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.13/drivers/input/mousedev.c linux-2.6.32.13/drivers/input/mousedev.c
+--- linux-2.6.32.13/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/mousedev.c	2010-05-15 13:21:15.435182881 -0400
+@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
+ 
+ #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
+ static struct miscdevice psaux_mouse = {
+-	PSMOUSE_MINOR, "psaux", &mousedev_fops
++	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
+ };
+ static int psaux_registered;
+ #endif
+diff -urNp linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h
+--- linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h	2010-05-15 13:21:15.435182881 -0400
+@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #ifdef CONFIG_PNP
+@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
+@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #endif /* CONFIG_X86 */
+diff -urNp linux-2.6.32.13/drivers/input/serio/serio_raw.c linux-2.6.32.13/drivers/input/serio/serio_raw.c
+--- linux-2.6.32.13/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/input/serio/serio_raw.c	2010-05-15 13:21:15.435182881 -0400
+@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
+diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/common.c linux-2.6.32.13/drivers/isdn/gigaset/common.c
+--- linux-2.6.32.13/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/isdn/gigaset/common.c	2010-05-15 13:21:15.435182881 -0400
+@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
+ 	cs->commands_pending = 0;
+ 	cs->cur_at_seq = 0;
+ 	cs->gotfwver = -1;
+-	cs->open_count = 0;
++	atomic_set(&cs->open_count, 0);
+ 	cs->dev = NULL;
+ 	cs->tty = NULL;
+ 	cs->tty_dev = NULL;
+diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h
+--- linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h	2010-05-15 13:21:15.435182881 -0400
+@@ -446,7 +446,7 @@ struct cardstate {
+ 	spinlock_t cmdlock;
+ 	unsigned curlen, cmdbytes;
+ 
+-	unsigned open_count;
++	atomic_t open_count;
+ 	struct tty_struct *tty;
+ 	struct tasklet_struct if_wake_tasklet;
+ 	unsigned control_state;
+diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/interface.c linux-2.6.32.13/drivers/isdn/gigaset/interface.c
+--- linux-2.6.32.13/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.13/drivers/isdn/gigaset/interface.c	2010-05-15 13:21:15.462977265 -0400
+@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
+ 		return -ERESTARTSYS; // FIXME -EINTR?
+ 	tty->driver_data = cs;
+ 
+-	++cs->open_count;
+-
+-	if (cs->open_count == 1) {
++	if (atomic_inc_return(&cs->open_count) == 1) {
+ 		spin_lock_irqsave(&cs->lock, flags);
+ 		cs->tty = tty;
+ 		spin_unlock_irqrestore(&cs->lock, flags);
+@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+-		if (!--cs->open_count) {
++		if (!atomic_dec_return(&cs->open_count)) {
+ 			spin_lock_irqsave(&cs->lock, flags);
+ 			cs->tty = NULL;
+ 			spin_unlock_irqrestore(&cs->lock, flags);
+@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		retval = 0;
+@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED)
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
+ 		goto out;
+ 	}
+ 
+-	if (!cs->open_count) {
++	if (!atomic_read(&cs->open_count)) {
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 		goto out;
+ 	}
+diff -urNp linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c
+--- linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c	2010-05-15 13:21:15.462977265 -0400
+@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (t4file->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (config->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+diff -urNp linux-2.6.32.13/drivers/isdn/icn/icn.c linux-2.6.32.13/drivers/isdn/icn/icn.c
+--- linux-2.6.32.13/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/isdn/icn/icn.c	2010-05-15 13:21:15.462977265 -0400
+@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
+ 		if (count > len)
+ 			count = len;
+ 		if (user) {
+-			if (copy_from_user(msg, buf, count))
++			if (count > sizeof msg || copy_from_user(msg, buf, count))
+ 				return -EFAULT;
+ 		} else
+ 			memcpy(msg, buf, count);
+diff -urNp linux-2.6.32.13/drivers/lguest/core.c linux-2.6.32.13/drivers/lguest/core.c
+--- linux-2.6.32.13/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/lguest/core.c	2010-05-15 13:21:15.466573931 -0400
+@@ -91,9 +91,17 @@ static __init int map_switcher(void)
+ 	 * it's worked so far.  The end address needs +1 because __get_vm_area
+ 	 * allocates an extra guard page, so we need space for that.
+ 	 */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
++				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
++				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#else
+ 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+ 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+ 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#endif
++
+ 	if (!switcher_vma) {
+ 		err = -ENOMEM;
+ 		printk("lguest: could not map switcher pages high\n");
+diff -urNp linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c
+--- linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c	2010-05-15 13:21:15.466573931 -0400
+@@ -15,7 +15,7 @@
+ 
+ #define MAX_PMU_LEVEL 0xFF
+ 
+-static struct backlight_ops pmu_backlight_data;
++static const struct backlight_ops pmu_backlight_data;
+ static DEFINE_SPINLOCK(pmu_backlight_lock);
+ static int sleeping, uses_pmu_bl;
+ static u8 bl_curve[FB_BACKLIGHT_LEVELS];
+@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops pmu_backlight_data = {
++static const struct backlight_ops pmu_backlight_data = {
+ 	.get_brightness	= pmu_backlight_get_brightness,
+ 	.update_status	= pmu_backlight_update_status,
+ 
+diff -urNp linux-2.6.32.13/drivers/macintosh/via-pmu.c linux-2.6.32.13/drivers/macintosh/via-pmu.c
+--- linux-2.6.32.13/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/macintosh/via-pmu.c	2010-05-15 13:21:15.488292870 -0400
+@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
+ 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
+ }
+ 
+-static struct platform_suspend_ops pmu_pm_ops = {
++static const struct platform_suspend_ops pmu_pm_ops = {
+ 	.enter = powerbook_sleep,
+ 	.valid = pmu_sleep_valid,
+ };
+diff -urNp linux-2.6.32.13/drivers/md/bitmap.c linux-2.6.32.13/drivers/md/bitmap.c
+--- linux-2.6.32.13/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/md/bitmap.c	2010-05-15 13:21:15.498921900 -0400
+@@ -58,7 +58,7 @@
+ #  if DEBUG > 0
+ #    define PRINTK(x...) printk(KERN_DEBUG x)
+ #  else
+-#    define PRINTK(x...)
++#    define PRINTK(x...) do {} while (0)
+ #  endif
+ #endif
+ 
+diff -urNp linux-2.6.32.13/drivers/md/dm-sysfs.c linux-2.6.32.13/drivers/md/dm-sysfs.c
+--- linux-2.6.32.13/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/md/dm-sysfs.c	2010-05-15 13:21:15.498921900 -0400
+@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops dm_sysfs_ops = {
++static const struct sysfs_ops dm_sysfs_ops = {
+ 	.show	= dm_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/md/dm-table.c linux-2.6.32.13/drivers/md/dm-table.c
+--- linux-2.6.32.13/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/md/dm-table.c	2010-05-15 13:21:15.498921900 -0400
+@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
+ 	if (!dev_size)
+ 		return 0;
+ 
+-	if ((start >= dev_size) || (start + len > dev_size)) {
++	if ((start >= dev_size) || (len > dev_size - start)) {
+ 		DMWARN("%s: %s too small for target: "
+ 		       "start=%llu, len=%llu, dev_size=%llu",
+ 		       dm_device_name(ti->table->md), bdevname(bdev, b),
+diff -urNp linux-2.6.32.13/drivers/md/md.c linux-2.6.32.13/drivers/md/md.c
+--- linux-2.6.32.13/drivers/md/md.c	2010-05-15 13:20:18.542567696 -0400
++++ linux-2.6.32.13/drivers/md/md.c	2010-05-15 13:21:15.498921900 -0400
+@@ -2514,7 +2514,7 @@ static void rdev_free(struct kobject *ko
+ 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
+ 	kfree(rdev);
+ }
+-static struct sysfs_ops rdev_sysfs_ops = {
++static const struct sysfs_ops rdev_sysfs_ops = {
+ 	.show		= rdev_attr_show,
+ 	.store		= rdev_attr_store,
+ };
+@@ -3884,7 +3884,7 @@ static void md_free(struct kobject *ko)
+ 	kfree(mddev);
+ }
+ 
+-static struct sysfs_ops md_sysfs_ops = {
++static const struct sysfs_ops md_sysfs_ops = {
+ 	.show	= md_attr_show,
+ 	.store	= md_attr_store,
+ };
+@@ -6010,7 +6010,7 @@ static int md_seq_show(struct seq_file *
+ 				chunk_kb ? "KB" : "B");
+ 			if (bitmap->file) {
+ 				seq_printf(seq, ", file: ");
+-				seq_path(seq, &bitmap->file->f_path, " \t\n");
++				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
+ 			}
+ 
+ 			seq_printf(seq, "\n");
+@@ -6104,7 +6104,7 @@ static int is_mddev_idle(mddev_t *mddev,
+ 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
+ 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
+ 			      (int)part_stat_read(&disk->part0, sectors[1]) -
+-			      atomic_read(&disk->sync_io);
++			      atomic_read_unchecked(&disk->sync_io);
+ 		/* sync IO will cause sync_io to increase before the disk_stats
+ 		 * as sync_io is counted when a request starts, and
+ 		 * disk_stats is counted when it completes.
+diff -urNp linux-2.6.32.13/drivers/md/md.h linux-2.6.32.13/drivers/md/md.h
+--- linux-2.6.32.13/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/md/md.h	2010-05-15 13:21:15.507356136 -0400
+@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
+ 
+ static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
+ {
+-        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
++	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
+ }
+ 
+ struct mdk_personality
+diff -urNp linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c
+--- linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c	2010-05-15 13:21:15.510998118 -0400
+@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
+ 			const struct dvb_device *template, void *priv, int type)
+ {
+ 	struct dvb_device *dvbdev;
++	/* cannot be const */
+ 	struct file_operations *dvbdevfops;
+ 	struct device *clsdev;
+ 	int minor;
+diff -urNp linux-2.6.32.13/drivers/media/radio/radio-cadet.c linux-2.6.32.13/drivers/media/radio/radio-cadet.c
+--- linux-2.6.32.13/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/media/radio/radio-cadet.c	2010-05-15 13:21:15.510998118 -0400
+@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
+ 	while (i < count && dev->rdsin != dev->rdsout)
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
+diff -urNp linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c
+--- linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c	2010-05-15 13:21:15.526921305 -0400
+@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c
+--- linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c	2010-05-15 13:21:15.526921305 -0400
+@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.13/drivers/message/fusion/mptdebug.h linux-2.6.32.13/drivers/message/fusion/mptdebug.h
+--- linux-2.6.32.13/drivers/message/fusion/mptdebug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/message/fusion/mptdebug.h	2010-05-15 13:21:15.526921305 -0400
+@@ -71,7 +71,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/message/fusion/mptsas.c linux-2.6.32.13/drivers/message/fusion/mptsas.c
+--- linux-2.6.32.13/drivers/message/fusion/mptsas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/message/fusion/mptsas.c	2010-05-15 13:21:15.526921305 -0400
+@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
+ 		return 0;
+ }
+ 
++static inline void
++mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
++{
++	if (phy_info->port_details) {
++		phy_info->port_details->rphy = rphy;
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
++		    ioc->name, rphy));
++	}
++
++	if (rphy) {
++		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
++		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
++		    ioc->name, rphy, rphy->dev.release));
++	}
++}
++
+ /* no mutex */
+ static void
+ mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
+@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
+ 		return NULL;
+ }
+ 
+-static inline void
+-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+-{
+-	if (phy_info->port_details) {
+-		phy_info->port_details->rphy = rphy;
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
+-		    ioc->name, rphy));
+-	}
+-
+-	if (rphy) {
+-		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
+-		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
+-		    ioc->name, rphy, rphy->dev.release));
+-	}
+-}
+-
+ static inline struct sas_port *
+ mptsas_get_port(struct mptsas_phyinfo *phy_info)
+ {
+diff -urNp linux-2.6.32.13/drivers/message/i2o/i2o_proc.c linux-2.6.32.13/drivers/message/i2o/i2o_proc.c
+--- linux-2.6.32.13/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/message/i2o/i2o_proc.c	2010-05-15 13:21:15.526921305 -0400
+@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
+ 	"Array Controller Device"
+ };
+ 
+-static char *chtostr(u8 * chars, int n)
+-{
+-	char tmp[256];
+-	tmp[0] = 0;
+-	return strncat(tmp, (char *)chars, n);
+-}
+-
+ static int i2o_report_query_status(struct seq_file *seq, int block_status,
+ 				   char *group)
+ {
+@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
+ 
+ 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", ddm_table.module_id);
+-		seq_printf(seq, "%-29s",
+-			   chtostr(ddm_table.module_name_version, 28));
++		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
+ 		seq_printf(seq, "%9d  ", ddm_table.data_size);
+ 		seq_printf(seq, "%8d", ddm_table.code_size);
+ 
+@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
+ 
+ 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", dst->module_id);
+-		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
+-		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
++		seq_printf(seq, "%-.28s", dst->module_name_version);
++		seq_printf(seq, "%-.8s", dst->date);
+ 		seq_printf(seq, "%8d ", dst->module_size);
+ 		seq_printf(seq, "%8d ", dst->mpb_size);
+ 		seq_printf(seq, "0x%04x", dst->module_flags);
+@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
+ 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
+ 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
+ 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
+-	seq_printf(seq, "Vendor info   : %s\n",
+-		   chtostr((u8 *) (work32 + 2), 16));
+-	seq_printf(seq, "Product info  : %s\n",
+-		   chtostr((u8 *) (work32 + 6), 16));
+-	seq_printf(seq, "Description   : %s\n",
+-		   chtostr((u8 *) (work32 + 10), 16));
+-	seq_printf(seq, "Product rev.  : %s\n",
+-		   chtostr((u8 *) (work32 + 14), 8));
++	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
++	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
++	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
++	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
+ 
+ 	seq_printf(seq, "Serial number : ");
+ 	print_serial_number(seq, (u8 *) (work32 + 16),
+@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
+ 	}
+ 
+ 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
+-	seq_printf(seq, "Module name         : %s\n",
+-		   chtostr(result.module_name, 24));
+-	seq_printf(seq, "Module revision     : %s\n",
+-		   chtostr(result.module_rev, 8));
++	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
++	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
+ 
+ 	seq_printf(seq, "Serial number       : ");
+ 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
+@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
+ 		return 0;
+ 	}
+ 
+-	seq_printf(seq, "Device name     : %s\n",
+-		   chtostr(result.device_name, 64));
+-	seq_printf(seq, "Service name    : %s\n",
+-		   chtostr(result.service_name, 64));
+-	seq_printf(seq, "Physical name   : %s\n",
+-		   chtostr(result.physical_location, 64));
+-	seq_printf(seq, "Instance number : %s\n",
+-		   chtostr(result.instance_number, 4));
++	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
++	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
++	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
++	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/drivers/misc/kgdbts.c linux-2.6.32.13/drivers/misc/kgdbts.c
+--- linux-2.6.32.13/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/misc/kgdbts.c	2010-05-15 13:21:15.554995461 -0400
+@@ -118,7 +118,7 @@
+ 	} while (0)
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io kgdbts_io_ops;
++static const struct kgdb_io kgdbts_io_ops;
+ static char get_buf[BUFMAX];
+ static int get_buf_cnt;
+ static char put_buf[BUFMAX];
+@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdbts_io_ops = {
++static const struct kgdb_io kgdbts_io_ops = {
+ 	.name			= "kgdbts",
+ 	.read_char		= kgdbts_get_char,
+ 	.write_char		= kgdbts_put_char,
+diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c
+--- linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c	2010-05-15 13:21:15.554995461 -0400
+@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
+ 
+ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
+ {
+-	atomic_long_inc(&mcs_op_statistics[op].count);
+-	atomic_long_add(clks, &mcs_op_statistics[op].total);
++	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
++	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
+ 	if (mcs_op_statistics[op].max < clks)
+ 		mcs_op_statistics[op].max = clks;
+ }
+diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c
+--- linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c	2010-05-15 13:21:15.554995461 -0400
+@@ -32,9 +32,9 @@
+ 
+ #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
+ 
+-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
++static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
+ {
+-	unsigned long val = atomic_long_read(v);
++	unsigned long val = atomic_long_read_unchecked(v);
+ 
+ 	if (val)
+ 		seq_printf(s, "%16lu %s\n", val, id);
+@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
+ 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+ 
+ 	for (op = 0; op < mcsop_last; op++) {
+-		count = atomic_long_read(&mcs_op_statistics[op].count);
+-		total = atomic_long_read(&mcs_op_statistics[op].total);
++		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
++		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
+ 		max = mcs_op_statistics[op].max;
+ 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
+ 			   count ? total / count : 0, max);
+diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h
+--- linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h	2010-05-15 13:21:15.554995461 -0400
+@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
+  * GRU statistics.
+  */
+ struct gru_stats_s {
+-	atomic_long_t vdata_alloc;
+-	atomic_long_t vdata_free;
+-	atomic_long_t gts_alloc;
+-	atomic_long_t gts_free;
+-	atomic_long_t vdata_double_alloc;
+-	atomic_long_t gts_double_allocate;
+-	atomic_long_t assign_context;
+-	atomic_long_t assign_context_failed;
+-	atomic_long_t free_context;
+-	atomic_long_t load_user_context;
+-	atomic_long_t load_kernel_context;
+-	atomic_long_t lock_kernel_context;
+-	atomic_long_t unlock_kernel_context;
+-	atomic_long_t steal_user_context;
+-	atomic_long_t steal_kernel_context;
+-	atomic_long_t steal_context_failed;
+-	atomic_long_t nopfn;
+-	atomic_long_t break_cow;
+-	atomic_long_t asid_new;
+-	atomic_long_t asid_next;
+-	atomic_long_t asid_wrap;
+-	atomic_long_t asid_reuse;
+-	atomic_long_t intr;
+-	atomic_long_t intr_mm_lock_failed;
+-	atomic_long_t call_os;
+-	atomic_long_t call_os_offnode_reference;
+-	atomic_long_t call_os_check_for_bug;
+-	atomic_long_t call_os_wait_queue;
+-	atomic_long_t user_flush_tlb;
+-	atomic_long_t user_unload_context;
+-	atomic_long_t user_exception;
+-	atomic_long_t set_context_option;
+-	atomic_long_t migrate_check;
+-	atomic_long_t migrated_retarget;
+-	atomic_long_t migrated_unload;
+-	atomic_long_t migrated_unload_delay;
+-	atomic_long_t migrated_nopfn_retarget;
+-	atomic_long_t migrated_nopfn_unload;
+-	atomic_long_t tlb_dropin;
+-	atomic_long_t tlb_dropin_fail_no_asid;
+-	atomic_long_t tlb_dropin_fail_upm;
+-	atomic_long_t tlb_dropin_fail_invalid;
+-	atomic_long_t tlb_dropin_fail_range_active;
+-	atomic_long_t tlb_dropin_fail_idle;
+-	atomic_long_t tlb_dropin_fail_fmm;
+-	atomic_long_t tlb_dropin_fail_no_exception;
+-	atomic_long_t tlb_dropin_fail_no_exception_war;
+-	atomic_long_t tfh_stale_on_fault;
+-	atomic_long_t mmu_invalidate_range;
+-	atomic_long_t mmu_invalidate_page;
+-	atomic_long_t mmu_clear_flush_young;
+-	atomic_long_t flush_tlb;
+-	atomic_long_t flush_tlb_gru;
+-	atomic_long_t flush_tlb_gru_tgh;
+-	atomic_long_t flush_tlb_gru_zero_asid;
+-
+-	atomic_long_t copy_gpa;
+-
+-	atomic_long_t mesq_receive;
+-	atomic_long_t mesq_receive_none;
+-	atomic_long_t mesq_send;
+-	atomic_long_t mesq_send_failed;
+-	atomic_long_t mesq_noop;
+-	atomic_long_t mesq_send_unexpected_error;
+-	atomic_long_t mesq_send_lb_overflow;
+-	atomic_long_t mesq_send_qlimit_reached;
+-	atomic_long_t mesq_send_amo_nacked;
+-	atomic_long_t mesq_send_put_nacked;
+-	atomic_long_t mesq_qf_not_full;
+-	atomic_long_t mesq_qf_locked;
+-	atomic_long_t mesq_qf_noop_not_full;
+-	atomic_long_t mesq_qf_switch_head_failed;
+-	atomic_long_t mesq_qf_unexpected_error;
+-	atomic_long_t mesq_noop_unexpected_error;
+-	atomic_long_t mesq_noop_lb_overflow;
+-	atomic_long_t mesq_noop_qlimit_reached;
+-	atomic_long_t mesq_noop_amo_nacked;
+-	atomic_long_t mesq_noop_put_nacked;
++	atomic_long_unchecked_t vdata_alloc;
++	atomic_long_unchecked_t vdata_free;
++	atomic_long_unchecked_t gts_alloc;
++	atomic_long_unchecked_t gts_free;
++	atomic_long_unchecked_t vdata_double_alloc;
++	atomic_long_unchecked_t gts_double_allocate;
++	atomic_long_unchecked_t assign_context;
++	atomic_long_unchecked_t assign_context_failed;
++	atomic_long_unchecked_t free_context;
++	atomic_long_unchecked_t load_user_context;
++	atomic_long_unchecked_t load_kernel_context;
++	atomic_long_unchecked_t lock_kernel_context;
++	atomic_long_unchecked_t unlock_kernel_context;
++	atomic_long_unchecked_t steal_user_context;
++	atomic_long_unchecked_t steal_kernel_context;
++	atomic_long_unchecked_t steal_context_failed;
++	atomic_long_unchecked_t nopfn;
++	atomic_long_unchecked_t break_cow;
++	atomic_long_unchecked_t asid_new;
++	atomic_long_unchecked_t asid_next;
++	atomic_long_unchecked_t asid_wrap;
++	atomic_long_unchecked_t asid_reuse;
++	atomic_long_unchecked_t intr;
++	atomic_long_unchecked_t intr_mm_lock_failed;
++	atomic_long_unchecked_t call_os;
++	atomic_long_unchecked_t call_os_offnode_reference;
++	atomic_long_unchecked_t call_os_check_for_bug;
++	atomic_long_unchecked_t call_os_wait_queue;
++	atomic_long_unchecked_t user_flush_tlb;
++	atomic_long_unchecked_t user_unload_context;
++	atomic_long_unchecked_t user_exception;
++	atomic_long_unchecked_t set_context_option;
++	atomic_long_unchecked_t migrate_check;
++	atomic_long_unchecked_t migrated_retarget;
++	atomic_long_unchecked_t migrated_unload;
++	atomic_long_unchecked_t migrated_unload_delay;
++	atomic_long_unchecked_t migrated_nopfn_retarget;
++	atomic_long_unchecked_t migrated_nopfn_unload;
++	atomic_long_unchecked_t tlb_dropin;
++	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
++	atomic_long_unchecked_t tlb_dropin_fail_upm;
++	atomic_long_unchecked_t tlb_dropin_fail_invalid;
++	atomic_long_unchecked_t tlb_dropin_fail_range_active;
++	atomic_long_unchecked_t tlb_dropin_fail_idle;
++	atomic_long_unchecked_t tlb_dropin_fail_fmm;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
++	atomic_long_unchecked_t tfh_stale_on_fault;
++	atomic_long_unchecked_t mmu_invalidate_range;
++	atomic_long_unchecked_t mmu_invalidate_page;
++	atomic_long_unchecked_t mmu_clear_flush_young;
++	atomic_long_unchecked_t flush_tlb;
++	atomic_long_unchecked_t flush_tlb_gru;
++	atomic_long_unchecked_t flush_tlb_gru_tgh;
++	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
++
++	atomic_long_unchecked_t copy_gpa;
++
++	atomic_long_unchecked_t mesq_receive;
++	atomic_long_unchecked_t mesq_receive_none;
++	atomic_long_unchecked_t mesq_send;
++	atomic_long_unchecked_t mesq_send_failed;
++	atomic_long_unchecked_t mesq_noop;
++	atomic_long_unchecked_t mesq_send_unexpected_error;
++	atomic_long_unchecked_t mesq_send_lb_overflow;
++	atomic_long_unchecked_t mesq_send_qlimit_reached;
++	atomic_long_unchecked_t mesq_send_amo_nacked;
++	atomic_long_unchecked_t mesq_send_put_nacked;
++	atomic_long_unchecked_t mesq_qf_not_full;
++	atomic_long_unchecked_t mesq_qf_locked;
++	atomic_long_unchecked_t mesq_qf_noop_not_full;
++	atomic_long_unchecked_t mesq_qf_switch_head_failed;
++	atomic_long_unchecked_t mesq_qf_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_lb_overflow;
++	atomic_long_unchecked_t mesq_noop_qlimit_reached;
++	atomic_long_unchecked_t mesq_noop_amo_nacked;
++	atomic_long_unchecked_t mesq_noop_put_nacked;
+ 
+ };
+ 
+@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
+ 	cchop_deallocate, tghop_invalidate, mcsop_last};
+ 
+ struct mcs_op_statistic {
+-	atomic_long_t	count;
+-	atomic_long_t	total;
++	atomic_long_unchecked_t	count;
++	atomic_long_unchecked_t	total;
+ 	unsigned long	max;
+ };
+ 
+@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
+ 
+ #define STAT(id)	do {						\
+ 				if (gru_options & OPT_STATS)		\
+-					atomic_long_inc(&gru_stats.id);	\
++					atomic_long_inc_unchecked(&gru_stats.id);	\
+ 			} while (0)
+ 
+ #ifdef CONFIG_SGI_GRU_DEBUG
+diff -urNp linux-2.6.32.13/drivers/mtd/devices/doc2000.c linux-2.6.32.13/drivers/mtd/devices/doc2000.c
+--- linux-2.6.32.13/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/mtd/devices/doc2000.c	2010-05-15 13:21:15.563050037 -0400
+@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
+ 
+ 		/* The ECC will not be calculated correctly if less than 512 is written */
+ /* DBB-
+-		if (len != 0x200 && eccbuf)
++		if (len != 0x200)
+ 			printk(KERN_WARNING
+ 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
+ 			       (long) to, (long) len);
+diff -urNp linux-2.6.32.13/drivers/mtd/devices/doc2001.c linux-2.6.32.13/drivers/mtd/devices/doc2001.c
+--- linux-2.6.32.13/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/mtd/devices/doc2001.c	2010-05-15 13:21:15.563050037 -0400
+@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
+ 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
+ 
+ 	/* Don't allow read past end of device */
+-	if (from >= this->totlen)
++	if (from >= this->totlen || !len)
+ 		return -EINVAL;
+ 
+ 	/* Don't allow a single read to cross a 512-byte block boundary */
+diff -urNp linux-2.6.32.13/drivers/mtd/ubi/build.c linux-2.6.32.13/drivers/mtd/ubi/build.c
+--- linux-2.6.32.13/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/mtd/ubi/build.c	2010-05-15 13:21:15.566632432 -0400
+@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
+ static int __init bytes_str_to_int(const char *str)
+ {
+ 	char *endp;
+-	unsigned long result;
++	unsigned long result, scale = 1;
+ 
+ 	result = simple_strtoul(str, &endp, 0);
+ 	if (str == endp || result >= INT_MAX) {
+@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
+ 
+ 	switch (*endp) {
+ 	case 'G':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'M':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'K':
+-		result *= 1024;
++		scale *= 1024;
+ 		if (endp[1] == 'i' && endp[2] == 'B')
+ 			endp += 2;
+ 	case '\0':
+@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
+ 		return -EINVAL;
+ 	}
+ 
+-	return result;
++	if ((intoverflow_t)result*scale >= INT_MAX) {
++		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
++		       str);
++		return -EINVAL;
++	}
++
++	return result*scale;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.13/drivers/net/e1000e/82571.c linux-2.6.32.13/drivers/net/e1000e/82571.c
+--- linux-2.6.32.13/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/e1000e/82571.c	2010-05-15 13:21:15.586662276 -0400
+@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 	u32 swsm = 0;
+ 	u32 swsm2 = 0;
+@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations e82571_mac_ops = {
++static const struct e1000_mac_operations e82571_mac_ops = {
+ 	/* .check_mng_mode: mac type dependent */
+ 	/* .check_for_link: media type dependent */
+ 	.id_led_init		= e1000e_id_led_init,
+@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_igp = {
++static const struct e1000_phy_operations e82_phy_ops_igp = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= NULL,
+@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_m88 = {
++static const struct e1000_phy_operations e82_phy_ops_m88 = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_bm = {
++static const struct e1000_phy_operations e82_phy_ops_bm = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_nvm_operations e82571_nvm_ops = {
++static const struct e1000_nvm_operations e82571_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_82571,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_82571,
+diff -urNp linux-2.6.32.13/drivers/net/e1000e/e1000.h linux-2.6.32.13/drivers/net/e1000e/e1000.h
+--- linux-2.6.32.13/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/e1000e/e1000.h	2010-05-15 13:21:15.586662276 -0400
+@@ -375,9 +375,9 @@ struct e1000_info {
+ 	u32			pba;
+ 	u32			max_hw_frame_size;
+ 	s32			(*get_variants)(struct e1000_adapter *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ /* hardware capability, feature, and workaround flags */
+diff -urNp linux-2.6.32.13/drivers/net/e1000e/es2lan.c linux-2.6.32.13/drivers/net/e1000e/es2lan.c
+--- linux-2.6.32.13/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/e1000e/es2lan.c	2010-05-15 13:21:15.611440944 -0400
+@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 
+ 	/* Set media type */
+@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations es2_mac_ops = {
++static const struct e1000_mac_operations es2_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000e_check_mng_mode_generic,
+ 	/* check_for_link dependent on media type */
+@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations es2_phy_ops = {
++static const struct e1000_phy_operations es2_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy	 	= e1000e_phy_sw_reset,
+@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
+ 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
+ };
+ 
+-static struct e1000_nvm_operations es2_nvm_ops = {
++static const struct e1000_nvm_operations es2_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_80003es2lan,
+diff -urNp linux-2.6.32.13/drivers/net/e1000e/hw.h linux-2.6.32.13/drivers/net/e1000e/hw.h
+--- linux-2.6.32.13/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.13/drivers/net/e1000e/hw.h	2010-05-15 13:21:15.627454440 -0400
+@@ -756,34 +756,34 @@ struct e1000_mac_operations {
+ 
+ /* Function pointers for the PHY. */
+ struct e1000_phy_operations {
+-	s32  (*acquire_phy)(struct e1000_hw *);
+-	s32  (*check_polarity)(struct e1000_hw *);
+-	s32  (*check_reset_block)(struct e1000_hw *);
+-	s32  (*commit_phy)(struct e1000_hw *);
+-	s32  (*force_speed_duplex)(struct e1000_hw *);
+-	s32  (*get_cfg_done)(struct e1000_hw *hw);
+-	s32  (*get_cable_length)(struct e1000_hw *);
+-	s32  (*get_phy_info)(struct e1000_hw *);
+-	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
+-	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
+-	void (*release_phy)(struct e1000_hw *);
+-	s32  (*reset_phy)(struct e1000_hw *);
+-	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
+-	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
+-	s32  (*cfg_on_link_up)(struct e1000_hw *);
++	s32  (* acquire_phy)(struct e1000_hw *);
++	s32  (* check_polarity)(struct e1000_hw *);
++	s32  (* check_reset_block)(struct e1000_hw *);
++	s32  (* commit_phy)(struct e1000_hw *);
++	s32  (* force_speed_duplex)(struct e1000_hw *);
++	s32  (* get_cfg_done)(struct e1000_hw *hw);
++	s32  (* get_cable_length)(struct e1000_hw *);
++	s32  (* get_phy_info)(struct e1000_hw *);
++	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
++	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
++	void (* release_phy)(struct e1000_hw *);
++	s32  (* reset_phy)(struct e1000_hw *);
++	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
++	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
++	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
++	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
++	s32  (* cfg_on_link_up)(struct e1000_hw *);
+ };
+ 
+ /* Function pointers for the NVM. */
+ struct e1000_nvm_operations {
+-	s32  (*acquire_nvm)(struct e1000_hw *);
+-	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release_nvm)(struct e1000_hw *);
+-	s32  (*update_nvm)(struct e1000_hw *);
+-	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
+-	s32  (*validate_nvm)(struct e1000_hw *);
+-	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire_nvm)(struct e1000_hw *);
++	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release_nvm)(struct e1000_hw *);
++	s32  (* const update_nvm)(struct e1000_hw *);
++	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
++	s32  (* const validate_nvm)(struct e1000_hw *);
++	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_mac_info {
+diff -urNp linux-2.6.32.13/drivers/net/e1000e/ich8lan.c linux-2.6.32.13/drivers/net/e1000e/ich8lan.c
+--- linux-2.6.32.13/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
++++ linux-2.6.32.13/drivers/net/e1000e/ich8lan.c	2010-05-15 13:21:15.627454440 -0400
+@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
+ 	}
+ }
+ 
+-static struct e1000_mac_operations ich8_mac_ops = {
++static const struct e1000_mac_operations ich8_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
+ 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
+@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
+ 	/* id_led_init dependent on mac type */
+ };
+ 
+-static struct e1000_phy_operations ich8_phy_ops = {
++static const struct e1000_phy_operations ich8_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
+ 	.check_reset_block	= e1000_check_reset_block_ich8lan,
+ 	.commit_phy		= NULL,
+@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
+ 	.write_phy_reg		= e1000e_write_phy_reg_igp,
+ };
+ 
+-static struct e1000_nvm_operations ich8_nvm_ops = {
++static const struct e1000_nvm_operations ich8_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
+ 	.read_nvm	 	= e1000_read_nvm_ich8lan,
+ 	.release_nvm		= e1000_release_nvm_ich8lan,
+diff -urNp linux-2.6.32.13/drivers/net/ibmveth.c linux-2.6.32.13/drivers/net/ibmveth.c
+--- linux-2.6.32.13/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/ibmveth.c	2010-05-15 13:21:15.630621605 -0400
+@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops veth_pool_ops = {
++static const struct sysfs_ops veth_pool_ops = {
+ 	.show   = veth_pool_show,
+ 	.store  = veth_pool_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/net/igb/e1000_82575.c linux-2.6.32.13/drivers/net/igb/e1000_82575.c
+--- linux-2.6.32.13/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.13/drivers/net/igb/e1000_82575.c	2010-05-15 13:21:15.646981498 -0400
+@@ -1401,7 +1401,7 @@ void igb_vmdq_set_replication_pf(struct 
+ 	wr32(E1000_VT_CTL, vt_ctl);
+ }
+ 
+-static struct e1000_mac_operations e1000_mac_ops_82575 = {
++static const struct e1000_mac_operations e1000_mac_ops_82575 = {
+ 	.reset_hw             = igb_reset_hw_82575,
+ 	.init_hw              = igb_init_hw_82575,
+ 	.check_for_link       = igb_check_for_link_82575,
+@@ -1410,13 +1410,13 @@ static struct e1000_mac_operations e1000
+ 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
+ };
+ 
+-static struct e1000_phy_operations e1000_phy_ops_82575 = {
++static const struct e1000_phy_operations e1000_phy_ops_82575 = {
+ 	.acquire              = igb_acquire_phy_82575,
+ 	.get_cfg_done         = igb_get_cfg_done_82575,
+ 	.release              = igb_release_phy_82575,
+ };
+ 
+-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
++static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
+ 	.acquire              = igb_acquire_nvm_82575,
+ 	.read                 = igb_read_nvm_eerd,
+ 	.release              = igb_release_nvm_82575,
+diff -urNp linux-2.6.32.13/drivers/net/igb/e1000_hw.h linux-2.6.32.13/drivers/net/igb/e1000_hw.h
+--- linux-2.6.32.13/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.13/drivers/net/igb/e1000_hw.h	2010-05-15 13:21:15.646981498 -0400
+@@ -303,17 +303,17 @@ struct e1000_phy_operations {
+ };
+ 
+ struct e1000_nvm_operations {
+-	s32  (*acquire)(struct e1000_hw *);
+-	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release)(struct e1000_hw *);
+-	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire)(struct e1000_hw *);
++	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release)(struct e1000_hw *);
++	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_info {
+ 	s32 (*get_invariants)(struct e1000_hw *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ extern const struct e1000_info e1000_82575_info;
+diff -urNp linux-2.6.32.13/drivers/net/irda/vlsi_ir.c linux-2.6.32.13/drivers/net/irda/vlsi_ir.c
+--- linux-2.6.32.13/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/irda/vlsi_ir.c	2010-05-15 13:21:15.650979196 -0400
+@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
+ 			/* no race - tx-ring already empty */
+ 			vlsi_set_baud(idev, iobase);
+ 			netif_wake_queue(ndev);
+-		}
+-		else
+-			;
++		} else {
+ 			/* keep the speed change pending like it would
+ 			 * for any len>0 packet. tx completion interrupt
+ 			 * will apply it when the tx ring becomes empty.
+ 			 */
++		}
+ 		spin_unlock_irqrestore(&idev->lock, flags);
+ 		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+diff -urNp linux-2.6.32.13/drivers/net/iseries_veth.c linux-2.6.32.13/drivers/net/iseries_veth.c
+--- linux-2.6.32.13/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/iseries_veth.c	2010-05-15 13:21:15.675080517 -0400
+@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_cnx_sysfs_ops = {
++static const struct sysfs_ops veth_cnx_sysfs_ops = {
+ 		.show = veth_cnx_attribute_show
+ };
+ 
+@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_port_sysfs_ops = {
++static const struct sysfs_ops veth_port_sysfs_ops = {
+ 	.show = veth_port_attribute_show
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/net/pcnet32.c linux-2.6.32.13/drivers/net/pcnet32.c
+--- linux-2.6.32.13/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/pcnet32.c	2010-05-15 13:21:15.695242570 -0400
+@@ -79,7 +79,7 @@ static int cards_found;
+ /*
+  * VLB I/O addresses
+  */
+-static unsigned int pcnet32_portlist[] __initdata =
++static unsigned int pcnet32_portlist[] __devinitdata =
+     { 0x300, 0x320, 0x340, 0x360, 0 };
+ 
+ static int pcnet32_debug = 0;
+diff -urNp linux-2.6.32.13/drivers/net/tg3.h linux-2.6.32.13/drivers/net/tg3.h
+--- linux-2.6.32.13/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
++++ linux-2.6.32.13/drivers/net/tg3.h	2010-05-15 13:21:15.715816686 -0400
+@@ -95,6 +95,7 @@
+ #define  CHIPREV_ID_5750_A0		 0x4000
+ #define  CHIPREV_ID_5750_A1		 0x4001
+ #define  CHIPREV_ID_5750_A3		 0x4003
++#define  CHIPREV_ID_5750_C1		 0x4201
+ #define  CHIPREV_ID_5750_C2		 0x4202
+ #define  CHIPREV_ID_5752_A0_HW		 0x5000
+ #define  CHIPREV_ID_5752_A0		 0x6000
+diff -urNp linux-2.6.32.13/drivers/net/tulip/de4x5.c linux-2.6.32.13/drivers/net/tulip/de4x5.c
+--- linux-2.6.32.13/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/tulip/de4x5.c	2010-05-15 13:21:15.731971640 -0400
+@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	for (i=0; i<ETH_ALEN; i++) {
+ 	    tmp.addr[i] = dev->dev_addr[i];
+ 	}
+-	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
++	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+ 	break;
+ 
+     case DE4X5_SET_HWADDR:           /* Set the hardware address */
+@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 	memcpy(&statbuf, &lp->pktStats, ioc->len);
+ 	spin_unlock_irqrestore(&lp->lock, flags);
+-	if (copy_to_user(ioc->data, &statbuf, ioc->len))
++	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
+ 		return -EFAULT;
+ 	break;
+     }
+diff -urNp linux-2.6.32.13/drivers/net/usb/hso.c linux-2.6.32.13/drivers/net/usb/hso.c
+--- linux-2.6.32.13/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/usb/hso.c	2010-05-15 13:21:15.731971640 -0400
+@@ -258,7 +258,7 @@ struct hso_serial {
+ 
+ 	/* from usb_serial_port */
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 	spinlock_t serial_lock;
+ 
+ 	int (*write_data) (struct hso_serial *serial);
+@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
+ 	struct urb *urb;
+ 
+ 	urb = serial->rx_urb[0];
+-	if (serial->open_count > 0) {
++	if (atomic_read(&serial->open_count) > 0) {
+ 		count = put_rxbuf_data(urb, serial);
+ 		if (count == -1)
+ 			return;
+@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
+ 	DUMP1(urb->transfer_buffer, urb->actual_length);
+ 
+ 	/* Anyone listening? */
+-	if (serial->open_count == 0)
++	if (atomic_read(&serial->open_count) == 0)
+ 		return;
+ 
+ 	if (status == 0) {
+@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
+ 	spin_unlock_irq(&serial->serial_lock);
+ 
+ 	/* check for port already opened, if not set the termios */
+-	serial->open_count++;
+-	if (serial->open_count == 1) {
++	if (atomic_inc_return(&serial->open_count) == 1) {
+ 		tty->low_latency = 1;
+ 		serial->rx_state = RX_IDLE;
+ 		/* Force default termio settings */
+@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
+ 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
+ 		if (result) {
+ 			hso_stop_serial_device(serial->parent);
+-			serial->open_count--;
++			atomic_dec(&serial->open_count);
+ 			kref_put(&serial->parent->ref, hso_serial_ref_free);
+ 		}
+ 	} else {
+@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
+ 
+ 	/* reset the rts and dtr */
+ 	/* do the actual close */
+-	serial->open_count--;
++	atomic_dec(&serial->open_count);
+ 
+-	if (serial->open_count <= 0) {
+-		serial->open_count = 0;
++	if (atomic_read(&serial->open_count) <= 0) {
++		atomic_set(&serial->open_count,  0);
+ 		spin_lock_irq(&serial->serial_lock);
+ 		if (serial->tty == tty) {
+ 			serial->tty->driver_data = NULL;
+@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
+ 
+ 	/* the actual setup */
+ 	spin_lock_irqsave(&serial->serial_lock, flags);
+-	if (serial->open_count)
++	if (atomic_read(&serial->open_count))
+ 		_hso_serial_set_termios(tty, old);
+ 	else
+ 		tty->termios = old;
+@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
+ 	/* Start all serial ports */
+ 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
+ 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
+-			if (dev2ser(serial_table[i])->open_count) {
++			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
+ 				result =
+ 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
+ 				hso_kick_transmit(dev2ser(serial_table[i]));
+diff -urNp linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c
+--- linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c	2010-05-15 13:21:15.742991879 -0400
+@@ -43,7 +43,7 @@ static struct dentry *rootdir;
+ struct b43_debugfs_fops {
+ 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
+ 	size_t file_struct_offset;
+ };
+diff -urNp linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c
+--- linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c	2010-05-15 13:21:15.742991879 -0400
+@@ -44,7 +44,7 @@ static struct dentry *rootdir;
+ struct b43legacy_debugfs_fops {
+ 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
+ 	size_t file_struct_offset;
+ 	/* Take wl->irq_lock before calling read/write? */
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-05-15 13:21:15.746908676 -0400
+@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 	 },
+ };
+ 
+-static struct iwl_ops iwl1000_ops = {
++static const struct iwl_ops iwl1000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl1000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-05-15 13:21:15.777121582 -0400
+@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
+ 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+ };
+ 
+-static struct iwl_ops iwl3945_ops = {
++static const struct iwl_ops iwl3945_ops = {
+ 	.ucode = &iwl3945_ucode,
+ 	.lib = &iwl3945_lib,
+ 	.hcmd = &iwl3945_hcmd,
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:38.221487644 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-05-15 13:21:15.803555313 -0400
+@@ -2340,7 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
+ 	},
+ };
+ 
+-static struct iwl_ops iwl4965_ops = {
++static const struct iwl_ops iwl4965_ops = {
+ 	.ucode = &iwl4965_ucode,
+ 	.lib = &iwl4965_lib,
+ 	.hcmd = &iwl4965_hcmd,
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:38.221487644 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-05-15 13:21:15.810712850 -0400
+@@ -1628,14 +1628,14 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 	 },
+ };
+ 
+-struct iwl_ops iwl5000_ops = {
++const struct iwl_ops iwl5000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+ 	.utils = &iwl5000_hcmd_utils,
+ };
+ 
+-static struct iwl_ops iwl5150_ops = {
++static const struct iwl_ops iwl5150_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5150_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-05-15 13:21:15.810712850 -0400
+@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
+ 	.calc_rssi = iwl5000_calc_rssi,
+ };
+ 
+-static struct iwl_ops iwl6000_ops = {
++static const struct iwl_ops iwl6000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl6000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-05-15 13:21:15.810712850 -0400
+@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
+ #endif
+ 
+ #else
+-#define IWL_DEBUG(__priv, level, fmt, args...)
+-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
++#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
++#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
+ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
+ 				      void *p, u32 len)
+ {}
+diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-05-15 13:21:15.810712850 -0400
+@@ -67,7 +67,7 @@ struct iwl_tx_queue;
+ 
+ /* shared structures from iwl-5000.c */
+ extern struct iwl_mod_params iwl50_mod_params;
+-extern struct iwl_ops iwl5000_ops;
++extern const struct iwl_ops iwl5000_ops;
+ extern struct iwl_ucode_ops iwl5000_ucode;
+ extern struct iwl_lib_ops iwl5000_lib;
+ extern struct iwl_hcmd_ops iwl5000_hcmd;
+diff -urNp linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c
+--- linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c	2010-05-15 13:21:15.810712850 -0400
+@@ -708,7 +708,7 @@ out_unlock:
+ struct lbs_debugfs_files {
+ 	const char *name;
+ 	int perm;
+-	struct file_operations fops;
++	const struct file_operations fops;
+ };
+ 
+ static const struct lbs_debugfs_files debugfs_files[] = {
+diff -urNp linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c	2010-05-15 13:21:15.822985498 -0400
+@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
+ 
+ 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
+ 
+-	if (rts_threshold < 0 || rts_threshold > 2347)
++	if (rts_threshold > 2347)
+ 		rts_threshold = 2347;
+ 
+ 	tmp = cpu_to_le32(rts_threshold);
+diff -urNp linux-2.6.32.13/drivers/oprofile/buffer_sync.c linux-2.6.32.13/drivers/oprofile/buffer_sync.c
+--- linux-2.6.32.13/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/buffer_sync.c	2010-05-15 13:21:15.822985498 -0400
+@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
+ 		if (cookie == NO_COOKIE)
+ 			offset = pc;
+ 		if (cookie == INVALID_COOKIE) {
+-			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 			offset = pc;
+ 		}
+ 		if (cookie != last_cookie) {
+@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
+ 	/* add userspace sample */
+ 
+ 	if (!mm) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mm);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
+ 		return 0;
+ 	}
+ 
+ 	cookie = lookup_dcookie(mm, s->eip, &offset);
+ 
+ 	if (cookie == INVALID_COOKIE) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 		return 0;
+ 	}
+ 
+@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
+ 		/* ignore backtraces if failed to add a sample */
+ 		if (state == sb_bt_start) {
+ 			state = sb_bt_ignore;
+-			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
+ 		}
+ 	}
+ 	release_mm(mm);
+diff -urNp linux-2.6.32.13/drivers/oprofile/event_buffer.c linux-2.6.32.13/drivers/oprofile/event_buffer.c
+--- linux-2.6.32.13/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/event_buffer.c	2010-05-15 13:21:15.822985498 -0400
+@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
+ 	}
+ 
+ 	if (buffer_pos == buffer_size) {
+-		atomic_inc(&oprofile_stats.event_lost_overflow);
++		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
+ 		return;
+ 	}
+ 
+diff -urNp linux-2.6.32.13/drivers/oprofile/oprof.c linux-2.6.32.13/drivers/oprofile/oprof.c
+--- linux-2.6.32.13/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/oprof.c	2010-05-15 13:21:15.822985498 -0400
+@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
+ 	if (oprofile_ops.switch_events())
+ 		return;
+ 
+-	atomic_inc(&oprofile_stats.multiplex_counter);
++	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
+ 	start_switch_worker();
+ }
+ 
+diff -urNp linux-2.6.32.13/drivers/oprofile/oprofilefs.c linux-2.6.32.13/drivers/oprofile/oprofilefs.c
+--- linux-2.6.32.13/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/oprofilefs.c	2010-05-15 13:21:15.822985498 -0400
+@@ -187,7 +187,7 @@ static const struct file_operations atom
+ 
+ 
+ int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
+-	char const *name, atomic_t *val)
++	char const *name, atomic_unchecked_t *val)
+ {
+ 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
+ 						     &atomic_ro_fops, 0444);
+diff -urNp linux-2.6.32.13/drivers/oprofile/oprofile_stats.c linux-2.6.32.13/drivers/oprofile/oprofile_stats.c
+--- linux-2.6.32.13/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/oprofile_stats.c	2010-05-15 13:21:15.822985498 -0400
+@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
+ 		cpu_buf->sample_invalid_eip = 0;
+ 	}
+ 
+-	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
+-	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.event_lost_overflow, 0);
+-	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.multiplex_counter, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
++	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/oprofile/oprofile_stats.h linux-2.6.32.13/drivers/oprofile/oprofile_stats.h
+--- linux-2.6.32.13/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/oprofile/oprofile_stats.h	2010-05-15 13:21:15.822985498 -0400
+@@ -13,11 +13,11 @@
+ #include <asm/atomic.h>
+ 
+ struct oprofile_stat_struct {
+-	atomic_t sample_lost_no_mm;
+-	atomic_t sample_lost_no_mapping;
+-	atomic_t bt_lost_no_mapping;
+-	atomic_t event_lost_overflow;
+-	atomic_t multiplex_counter;
++	atomic_unchecked_t sample_lost_no_mm;
++	atomic_unchecked_t sample_lost_no_mapping;
++	atomic_unchecked_t bt_lost_no_mapping;
++	atomic_unchecked_t event_lost_overflow;
++	atomic_unchecked_t multiplex_counter;
+ };
+ 
+ extern struct oprofile_stat_struct oprofile_stats;
+diff -urNp linux-2.6.32.13/drivers/parisc/pdc_stable.c linux-2.6.32.13/drivers/parisc/pdc_stable.c
+--- linux-2.6.32.13/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/parisc/pdc_stable.c	2010-05-15 13:21:15.822985498 -0400
+@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops pdcspath_attr_ops = {
++static const struct sysfs_ops pdcspath_attr_ops = {
+ 	.show = pdcspath_attr_show,
+ 	.store = pdcspath_attr_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/parport/procfs.c linux-2.6.32.13/drivers/parport/procfs.c
+--- linux-2.6.32.13/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/parport/procfs.c	2010-05-15 13:21:15.822985498 -0400
+@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
+ }
+ 
+ #ifdef CONFIG_PARPORT_1284
+@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
+ }
+ #endif /* IEEE1284.3 support. */
+ 
+diff -urNp linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c
+--- linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c	2010-05-15 13:21:15.842765021 -0400
+@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
+ }
+ 
+ 
+-static struct acpi_dock_ops acpiphp_dock_ops = {
++static const struct acpi_dock_ops acpiphp_dock_ops = {
+ 	.handler = handle_hotplug_event_func,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c
+--- linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c	2010-05-15 13:21:15.842765021 -0400
+@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
+ 
+ void compaq_nvram_init (void __iomem *rom_start)
+ {
++
++#ifndef CONFIG_PAX_KERNEXEC
+ 	if (rom_start) {
+ 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
+ 	}
++#endif
++
+ 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
+ 
+ 	/* initialize our int15 lock */
+diff -urNp linux-2.6.32.13/drivers/pci/hotplug/fakephp.c linux-2.6.32.13/drivers/pci/hotplug/fakephp.c
+--- linux-2.6.32.13/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/hotplug/fakephp.c	2010-05-15 13:21:15.847000534 -0400
+@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
+ }
+ 
+ static struct kobj_type legacy_ktype = {
+-	.sysfs_ops = &(struct sysfs_ops){
++	.sysfs_ops = &(const struct sysfs_ops){
+ 		.store = legacy_store, .show = legacy_show
+ 	},
+ 	.release = &legacy_release,
+diff -urNp linux-2.6.32.13/drivers/pci/intel-iommu.c linux-2.6.32.13/drivers/pci/intel-iommu.c
+--- linux-2.6.32.13/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/intel-iommu.c	2010-05-15 13:21:15.847000534 -0400
+@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
+ 	return !dma_addr;
+ }
+ 
+-struct dma_map_ops intel_dma_ops = {
++const struct dma_map_ops intel_dma_ops = {
+ 	.alloc_coherent = intel_alloc_coherent,
+ 	.free_coherent = intel_free_coherent,
+ 	.map_sg = intel_map_sg,
+diff -urNp linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c
+--- linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c	2010-05-15 13:21:15.867469095 -0400
+@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
+ static const struct pci_device_id port_pci_ids[] = { {
+ 	/* handle any PCI-Express port */
+ 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, port_pci_ids);
+ 
+diff -urNp linux-2.6.32.13/drivers/pci/probe.c linux-2.6.32.13/drivers/pci/probe.c
+--- linux-2.6.32.13/drivers/pci/probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/probe.c	2010-05-15 13:21:15.867469095 -0400
+@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
+ 	return ret;
+ }
+ 
+-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+ 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
+ }
+ 
+-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+diff -urNp linux-2.6.32.13/drivers/pci/proc.c linux-2.6.32.13/drivers/pci/proc.c
+--- linux-2.6.32.13/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/proc.c	2010-05-15 13:21:15.867469095 -0400
+@@ -480,7 +480,16 @@ static const struct file_operations proc
+ static int __init pci_proc_init(void)
+ {
+ 	struct pci_dev *dev = NULL;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
++#endif
+ 	proc_create("devices", 0, proc_bus_pci_dir,
+ 		    &proc_bus_pci_dev_operations);
+ 	proc_initialized = 1;
+diff -urNp linux-2.6.32.13/drivers/pci/slot.c linux-2.6.32.13/drivers/pci/slot.c
+--- linux-2.6.32.13/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pci/slot.c	2010-05-15 13:21:15.895764457 -0400
+@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
+ 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
+ }
+ 
+-static struct sysfs_ops pci_slot_sysfs_ops = {
++static const struct sysfs_ops pci_slot_sysfs_ops = {
+ 	.show = pci_slot_attr_show,
+ 	.store = pci_slot_attr_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/pcmcia/ti113x.h linux-2.6.32.13/drivers/pcmcia/ti113x.h
+--- linux-2.6.32.13/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pcmcia/ti113x.h	2010-05-15 13:21:15.895764457 -0400
+@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
+ 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
+ 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
+ 
+-	{}
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
+diff -urNp linux-2.6.32.13/drivers/pcmcia/yenta_socket.c linux-2.6.32.13/drivers/pcmcia/yenta_socket.c
+--- linux-2.6.32.13/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pcmcia/yenta_socket.c	2010-05-15 13:21:15.911499692 -0400
+@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
+ 
+ 	/* match any cardbus bridge */
+ 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
+-	{ /* all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, yenta_table);
+ 
+diff -urNp linux-2.6.32.13/drivers/platform/x86/acer-wmi.c linux-2.6.32.13/drivers/platform/x86/acer-wmi.c
+--- linux-2.6.32.13/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/acer-wmi.c	2010-05-15 13:21:15.911499692 -0400
+@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
+ 	return 0;
+ }
+ 
+-static struct backlight_ops acer_bl_ops = {
++static const struct backlight_ops acer_bl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/asus_acpi.c linux-2.6.32.13/drivers/platform/x86/asus_acpi.c
+--- linux-2.6.32.13/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/asus_acpi.c	2010-05-15 13:21:15.911499692 -0400
+@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
+ 	return 0;
+ }
+ 
+-static struct backlight_ops asus_backlight_data = {
++static const struct backlight_ops asus_backlight_data = {
+ 	.get_brightness = read_brightness,
+ 	.update_status  = set_brightness_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/asus-laptop.c linux-2.6.32.13/drivers/platform/x86/asus-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/asus-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops asusbl_ops = {
++static const struct backlight_ops asusbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/compal-laptop.c linux-2.6.32.13/drivers/platform/x86/compal-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/compal-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops compalbl_ops = {
++static const struct backlight_ops compalbl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status	= bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/dell-laptop.c linux-2.6.32.13/drivers/platform/x86/dell-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/dell-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
+ 	return buffer.output[1];
+ }
+ 
+-static struct backlight_ops dell_ops = {
++static const struct backlight_ops dell_ops = {
+ 	.get_brightness = dell_get_intensity,
+ 	.update_status  = dell_send_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:38.317493070 -0400
++++ linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops eeepcbl_ops = {
++static const struct backlight_ops eeepcbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
+ 	return ret;
+ }
+ 
+-static struct backlight_ops fujitsubl_ops = {
++static const struct backlight_ops fujitsubl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status = bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/msi-laptop.c linux-2.6.32.13/drivers/platform/x86/msi-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/msi-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops msibl_ops = {
++static const struct backlight_ops msibl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status  = bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c	2010-05-15 13:21:15.911499692 -0400
+@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
+ 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
+ }
+ 
+-static struct backlight_ops pcc_backlight_ops = {
++static const struct backlight_ops pcc_backlight_ops = {
+ 	.get_brightness	= bl_get,
+ 	.update_status	= bl_set_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/sony-laptop.c linux-2.6.32.13/drivers/platform/x86/sony-laptop.c
+--- linux-2.6.32.13/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/sony-laptop.c	2010-05-15 13:21:15.914756904 -0400
+@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
+ }
+ 
+ static struct backlight_device *sony_backlight_device;
+-static struct backlight_ops sony_backlight_ops = {
++static const struct backlight_ops sony_backlight_ops = {
+ 	.update_status = sony_backlight_update_status,
+ 	.get_brightness = sony_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c
+--- linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 17:49:38.333363657 -0400
++++ linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c	2010-05-15 13:21:15.914756904 -0400
+@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
+ 			       BACKLIGHT_UPDATE_HOTKEY);
+ }
+ 
+-static struct backlight_ops ibm_backlight_data = {
++static const struct backlight_ops ibm_backlight_data = {
+ 	.get_brightness = brightness_get,
+ 	.update_status  = brightness_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c
+--- linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c	2010-05-15 13:21:15.914756904 -0400
+@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
+ 	return AE_OK;
+ }
+ 
+-static struct backlight_ops toshiba_backlight_data = {
++static const struct backlight_ops toshiba_backlight_data = {
+         .get_brightness = get_lcd,
+         .update_status  = set_lcd_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c
+--- linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c	2010-05-15 13:21:15.914756904 -0400
+@@ -60,7 +60,7 @@ do { \
+ 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
+ } while(0)
+ 
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ /*
+@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
+ 
+ 	cpu = get_cpu();
+ 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
++
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
+ 	spin_lock_irqsave(&pnp_bios_lock, flags);
+@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
+ 			     :"memory");
+ 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
+ 
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	/* If we get here and this is set then the PnP BIOS faulted on us. */
+@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
+ 	return status;
+ }
+ 
+-void pnpbios_calls_init(union pnp_bios_install_struct *header)
++void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
+ {
+ 	int i;
+ 
+@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
+ 	pnp_bios_callpoint.offset = header->fields.pm16offset;
+ 	pnp_bios_callpoint.segment = PNP_CS16;
+ 
++	pax_open_kernel();
++
+ 	for_each_possible_cpu(i) {
+ 		struct desc_struct *gdt = get_cpu_gdt_table(i);
+ 		if (!gdt)
+@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
+ 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
+ 			 (unsigned long)__va(header->fields.pm16dseg));
+ 	}
++
++	pax_close_kernel();
+ }
+diff -urNp linux-2.6.32.13/drivers/pnp/quirks.c linux-2.6.32.13/drivers/pnp/quirks.c
+--- linux-2.6.32.13/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pnp/quirks.c	2010-05-15 13:21:15.914756904 -0400
+@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
+ 	/* PnP resources that might overlap PCI BARs */
+ 	{"PNP0c01", quirk_system_pci_resources},
+ 	{"PNP0c02", quirk_system_pci_resources},
+-	{""}
++	{"", NULL}
+ };
+ 
+ void pnp_fixup_device(struct pnp_dev *dev)
+diff -urNp linux-2.6.32.13/drivers/pnp/resource.c linux-2.6.32.13/drivers/pnp/resource.c
+--- linux-2.6.32.13/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/pnp/resource.c	2010-05-15 13:21:15.914756904 -0400
+@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*irq < 0 || *irq > 15)
++	if (*irq > 15)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*dma < 0 || *dma == 4 || *dma > 7)
++	if (*dma == 4 || *dma > 7)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+diff -urNp linux-2.6.32.13/drivers/s390/cio/qdio_perf.c linux-2.6.32.13/drivers/s390/cio/qdio_perf.c
+--- linux-2.6.32.13/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/s390/cio/qdio_perf.c	2010-05-15 13:21:15.914756904 -0400
+@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
+ static int qdio_perf_proc_show(struct seq_file *m, void *v)
+ {
+ 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.qdio_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
+ 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.pci_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
+ 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thin_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
+ 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
+ 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
+ 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound),
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_in));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
+ 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_out));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
+ 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_sync));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.inbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
+ 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.fast_requeue));
++		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
+ 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_target_full));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
+ 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
+ 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
+ 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
+ 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
+ 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
+ 	seq_printf(m, "\n");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/drivers/s390/cio/qdio_perf.h linux-2.6.32.13/drivers/s390/cio/qdio_perf.h
+--- linux-2.6.32.13/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/s390/cio/qdio_perf.h	2010-05-15 13:21:15.927411554 -0400
+@@ -13,46 +13,46 @@
+ 
+ struct qdio_perf_stats {
+ 	/* interrupt handler calls */
+-	atomic_long_t qdio_int;
+-	atomic_long_t pci_int;
+-	atomic_long_t thin_int;
++	atomic_long_unchecked_t qdio_int;
++	atomic_long_unchecked_t pci_int;
++	atomic_long_unchecked_t thin_int;
+ 
+ 	/* tasklet runs */
+-	atomic_long_t tasklet_inbound;
+-	atomic_long_t tasklet_outbound;
+-	atomic_long_t tasklet_thinint;
+-	atomic_long_t tasklet_thinint_loop;
+-	atomic_long_t thinint_inbound;
+-	atomic_long_t thinint_inbound_loop;
+-	atomic_long_t thinint_inbound_loop2;
++	atomic_long_unchecked_t tasklet_inbound;
++	atomic_long_unchecked_t tasklet_outbound;
++	atomic_long_unchecked_t tasklet_thinint;
++	atomic_long_unchecked_t tasklet_thinint_loop;
++	atomic_long_unchecked_t thinint_inbound;
++	atomic_long_unchecked_t thinint_inbound_loop;
++	atomic_long_unchecked_t thinint_inbound_loop2;
+ 
+ 	/* signal adapter calls */
+-	atomic_long_t siga_out;
+-	atomic_long_t siga_in;
+-	atomic_long_t siga_sync;
++	atomic_long_unchecked_t siga_out;
++	atomic_long_unchecked_t siga_in;
++	atomic_long_unchecked_t siga_sync;
+ 
+ 	/* misc */
+-	atomic_long_t inbound_handler;
+-	atomic_long_t outbound_handler;
+-	atomic_long_t fast_requeue;
+-	atomic_long_t outbound_target_full;
++	atomic_long_unchecked_t inbound_handler;
++	atomic_long_unchecked_t outbound_handler;
++	atomic_long_unchecked_t fast_requeue;
++	atomic_long_unchecked_t outbound_target_full;
+ 
+ 	/* for debugging */
+-	atomic_long_t debug_tl_out_timer;
+-	atomic_long_t debug_stop_polling;
+-	atomic_long_t debug_eqbs_all;
+-	atomic_long_t debug_eqbs_incomplete;
+-	atomic_long_t debug_sqbs_all;
+-	atomic_long_t debug_sqbs_incomplete;
++	atomic_long_unchecked_t debug_tl_out_timer;
++	atomic_long_unchecked_t debug_stop_polling;
++	atomic_long_unchecked_t debug_eqbs_all;
++	atomic_long_unchecked_t debug_eqbs_incomplete;
++	atomic_long_unchecked_t debug_sqbs_all;
++	atomic_long_unchecked_t debug_sqbs_incomplete;
+ };
+ 
+ extern struct qdio_perf_stats perf_stats;
+ extern int qdio_performance_stats;
+ 
+-static inline void qdio_perf_stat_inc(atomic_long_t *count)
++static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
+ {
+ 	if (qdio_performance_stats)
+-		atomic_long_inc(count);
++		atomic_long_inc_unchecked(count);
+ }
+ 
+ int qdio_setup_perf_stats(void);
+diff -urNp linux-2.6.32.13/drivers/scsi/ipr.c linux-2.6.32.13/drivers/scsi/ipr.c
+--- linux-2.6.32.13/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/scsi/ipr.c	2010-05-15 13:21:15.970703897 -0400
+@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
+ 	return true;
+ }
+ 
+-static struct ata_port_operations ipr_sata_ops = {
++static const struct ata_port_operations ipr_sata_ops = {
+ 	.phy_reset = ipr_ata_phy_reset,
+ 	.hardreset = ipr_sata_reset,
+ 	.post_internal_cmd = ipr_ata_post_internal,
+diff -urNp linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c
+--- linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c	2010-05-15 13:21:15.970703897 -0400
+@@ -86,12 +86,12 @@ struct fc_exch_mgr {
+ 	 * all together if not used XXX
+ 	 */
+ 	struct {
+-		atomic_t no_free_exch;
+-		atomic_t no_free_exch_xid;
+-		atomic_t xid_not_found;
+-		atomic_t xid_busy;
+-		atomic_t seq_not_found;
+-		atomic_t non_bls_resp;
++		atomic_unchecked_t no_free_exch;
++		atomic_unchecked_t no_free_exch_xid;
++		atomic_unchecked_t xid_not_found;
++		atomic_unchecked_t xid_busy;
++		atomic_unchecked_t seq_not_found;
++		atomic_unchecked_t non_bls_resp;
+ 	} stats;
+ };
+ #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
+@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
+ 	/* allocate memory for exchange */
+ 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.no_free_exch);
++		atomic_inc_unchecked(&mp->stats.no_free_exch);
+ 		goto out;
+ 	}
+ 	memset(ep, 0, sizeof(*ep));
+@@ -557,7 +557,7 @@ out:
+ 	return ep;
+ err:
+ 	spin_unlock_bh(&pool->lock);
+-	atomic_inc(&mp->stats.no_free_exch_xid);
++	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
+ 	mempool_free(ep, mp->ep_pool);
+ 	return NULL;
+ }
+@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
+ 		ep = fc_exch_find(mp, xid);
+ 		if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_OX_ID;
+ 			goto out;
+ 		}
+@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		ep = fc_exch_find(mp, xid);
+ 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
+ 			if (ep) {
+-				atomic_inc(&mp->stats.xid_busy);
++				atomic_inc_unchecked(&mp->stats.xid_busy);
+ 				reject = FC_RJT_RX_ID;
+ 				goto rel;
+ 			}
+@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 			}
+ 			xid = ep->xid;	/* get our XID */
+ 		} else if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_RX_ID;	/* XID not found */
+ 			goto out;
+ 		}
+@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
+ 			goto rel;
+ 		}
+@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
+ 
+ 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->esb_stat & ESB_ST_COMPLETE) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->rxid == FC_XID_UNKNOWN)
+ 		ep->rxid = ntohs(fh->fh_rx_id);
+ 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	if (ep->did != ntoh24(fh->fh_s_id) &&
+ 	    ep->did != FC_FID_FLOGI) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	sof = fr_sof(fp);
+@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			goto rel;
+ 		}
+ 	}
+@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
+ 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
+ 
+ 	if (!sp)
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 	else
+-		atomic_inc(&mp->stats.non_bls_resp);
++		atomic_inc_unchecked(&mp->stats.non_bls_resp);
+ 
+ 	fc_frame_free(fp);
+ }
+diff -urNp linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c
+--- linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c	2010-05-15 13:20:18.878584179 -0400
++++ linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c	2010-05-15 13:21:15.970703897 -0400
+@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
+ 	}
+ }
+ 
+-static struct ata_port_operations sas_sata_ops = {
++static const struct ata_port_operations sas_sata_ops = {
+ 	.phy_reset		= sas_ata_phy_reset,
+ 	.post_internal_cmd	= sas_ata_post_internal,
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h
+--- linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-05-15 13:21:15.991412669 -0400
+@@ -79,7 +79,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
+ 
+ 
+diff -urNp linux-2.6.32.13/drivers/scsi/scsi_logging.h linux-2.6.32.13/drivers/scsi/scsi_logging.h
+--- linux-2.6.32.13/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/scsi/scsi_logging.h	2010-05-15 13:21:15.991412669 -0400
+@@ -51,7 +51,7 @@ do {								\
+ 		} while (0);					\
+ } while (0)
+ #else
+-#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
++#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
+ #endif /* CONFIG_SCSI_LOGGING */
+ 
+ /*
+diff -urNp linux-2.6.32.13/drivers/scsi/sg.c linux-2.6.32.13/drivers/scsi/sg.c
+--- linux-2.6.32.13/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/scsi/sg.c	2010-05-15 13:21:15.991412669 -0400
+@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
+ 	const struct file_operations * fops;
+ };
+ 
+-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
++static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
+ 	{"allow_dio", &adio_fops},
+ 	{"debug", &debug_fops},
+ 	{"def_reserved_size", &dressz_fops},
+@@ -2307,7 +2307,7 @@ sg_proc_init(void)
+ {
+ 	int k, mask;
+ 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
+-	struct sg_proc_leaf * leaf;
++	const struct sg_proc_leaf * leaf;
+ 
+ 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
+ 	if (!sg_proc_sgp)
+diff -urNp linux-2.6.32.13/drivers/serial/8250_pci.c linux-2.6.32.13/drivers/serial/8250_pci.c
+--- linux-2.6.32.13/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/serial/8250_pci.c	2010-05-15 13:21:16.030795257 -0400
+@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
+ 		PCI_ANY_ID, PCI_ANY_ID,
+ 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
+ 		0xffff00, pbn_default },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static struct pci_driver serial_pci_driver = {
+diff -urNp linux-2.6.32.13/drivers/serial/kgdboc.c linux-2.6.32.13/drivers/serial/kgdboc.c
+--- linux-2.6.32.13/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/serial/kgdboc.c	2010-05-15 13:21:16.030795257 -0400
+@@ -18,7 +18,7 @@
+ 
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io		kgdboc_io_ops;
++static const struct kgdb_io	kgdboc_io_ops;
+ 
+ /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
+ static int configured		= -1;
+@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdboc_io_ops = {
++static const struct kgdb_io kgdboc_io_ops = {
+ 	.name			= "kgdboc",
+ 	.read_char		= kgdboc_get_char,
+ 	.write_char		= kgdboc_put_char,
+diff -urNp linux-2.6.32.13/drivers/staging/android/binder.c linux-2.6.32.13/drivers/staging/android/binder.c
+--- linux-2.6.32.13/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/android/binder.c	2010-05-15 13:21:16.072777583 -0400
+@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
+ 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
+ }
+ 
+-static struct vm_operations_struct binder_vm_ops = {
++static const struct vm_operations_struct binder_vm_ops = {
+ 	.open = binder_vma_open,
+ 	.close = binder_vma_close,
+ };
+diff -urNp linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c
+--- linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c	2010-05-15 13:21:16.111132239 -0400
+@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
+ 	return VM_FAULT_NOPAGE;
+ }
+ 
+-static struct vm_operations_struct b3dfg_vm_ops = {
++static const struct vm_operations_struct b3dfg_vm_ops = {
+ 	.fault = b3dfg_vma_fault,
+ };
+ 
+@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
+ 	return r;
+ }
+ 
+-static struct file_operations b3dfg_fops = {
++static const struct file_operations b3dfg_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = b3dfg_open,
+ 	.release = b3dfg_release,
+diff -urNp linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c
+--- linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c	2010-05-15 13:21:16.111132239 -0400
+@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
+ 	mutex_unlock(&dev->mutex);
+ }
+ 
+-static struct vm_operations_struct comedi_vm_ops = {
++static const struct vm_operations_struct comedi_vm_ops = {
+ 	.close = comedi_unmap,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c	2010-05-15 13:21:16.111132239 -0400
+@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
+ static dev_t adsp_devno;
+ static struct class *adsp_class;
+ 
+-static struct file_operations adsp_fops = {
++static const struct file_operations adsp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = adsp_open,
+ 	.unlocked_ioctl = adsp_ioctl,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c	2010-05-15 13:21:16.127017061 -0400
+@@ -1022,7 +1022,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_aac_fops = {
++static const struct file_operations audio_aac_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audio_open,
+ 	.release = audio_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-05-15 13:21:16.139031435 -0400
+@@ -833,7 +833,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_amrnb_fops = {
++static const struct file_operations audio_amrnb_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audamrnb_open,
+ 	.release = audamrnb_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c	2010-05-15 13:21:16.151007392 -0400
+@@ -805,7 +805,7 @@ dma_fail:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_evrc_fops = {
++static const struct file_operations audio_evrc_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audevrc_open,
+ 	.release = audevrc_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c	2010-05-15 13:21:16.155145249 -0400
+@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_in_open,
+ 	.release	= audio_in_release,
+@@ -922,7 +922,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_in_ioctl,
+ };
+ 
+-static struct file_operations audpre_fops = {
++static const struct file_operations audpre_fops = {
+ 	.owner          = THIS_MODULE,
+ 	.open           = audpre_open,
+ 	.unlocked_ioctl = audpre_ioctl,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c	2010-05-15 13:21:16.171026730 -0400
+@@ -941,7 +941,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_mp3_fops = {
++static const struct file_operations audio_mp3_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c	2010-05-15 13:21:16.175016772 -0400
+@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+@@ -819,7 +819,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_ioctl,
+ };
+ 
+-static struct file_operations audpp_fops = {
++static const struct file_operations audpp_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audpp_open,
+ 	.unlocked_ioctl	= audpp_ioctl,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-05-15 13:21:16.183014216 -0400
+@@ -816,7 +816,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_qcelp_fops = {
++static const struct file_operations audio_qcelp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audqcelp_open,
+ 	.release = audqcelp_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c
+--- linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c	2010-05-15 13:21:16.187015266 -0400
+@@ -242,7 +242,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations snd_fops = {
++static const struct file_operations snd_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= snd_open,
+ 	.release	= snd_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c
+--- linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c	2010-05-15 13:21:16.190693177 -0400
+@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
+ 	return 0;
+ }
+ 
+-static struct file_operations qmi_fops = {
++static const struct file_operations qmi_fops = {
+ 	.owner = THIS_MODULE,
+ 	.read = qmi_read,
+ 	.write = qmi_write,
+diff -urNp linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c
+--- linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-05-15 13:21:16.190693177 -0400
+@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
+ 	return rc;
+ }
+ 
+-static struct file_operations rpcrouter_server_fops = {
++static const struct file_operations rpcrouter_server_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
+ 	.unlocked_ioctl	 = rpcrouter_ioctl,
+ };
+ 
+-static struct file_operations rpcrouter_router_fops = {
++static const struct file_operations rpcrouter_router_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+diff -urNp linux-2.6.32.13/drivers/staging/dst/dcore.c linux-2.6.32.13/drivers/staging/dst/dcore.c
+--- linux-2.6.32.13/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dst/dcore.c	2010-05-15 13:21:16.190693177 -0400
+@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
+ 	return 0;
+ }
+ 
+-static struct block_device_operations dst_blk_ops = {
++static const struct block_device_operations dst_blk_ops = {
+ 	.open		= dst_bdev_open,
+ 	.release	= dst_bdev_release,
+ 	.owner		= THIS_MODULE,
+@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
+ 	n->size = ctl->size;
+ 
+ 	atomic_set(&n->refcnt, 1);
+-	atomic_long_set(&n->gen, 0);
++	atomic_long_set_unchecked(&n->gen, 0);
+ 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
+ 
+ 	err = dst_node_sysfs_init(n);
+diff -urNp linux-2.6.32.13/drivers/staging/dst/trans.c linux-2.6.32.13/drivers/staging/dst/trans.c
+--- linux-2.6.32.13/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/dst/trans.c	2010-05-15 13:21:16.211066896 -0400
+@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
+ 	t->error = 0;
+ 	t->retries = 0;
+ 	atomic_set(&t->refcnt, 1);
+-	t->gen = atomic_long_inc_return(&n->gen);
++	t->gen = atomic_long_inc_return_unchecked(&n->gen);
+ 
+ 	t->enc = bio_data_dir(bio);
+ 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
+diff -urNp linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c
+--- linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c	2010-05-15 13:21:16.231838911 -0400
+@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
+ 	return 0;
+ }
+ 
+-static struct vm_operations_struct go7007_vm_ops = {
++static const struct vm_operations_struct go7007_vm_ops = {
+ 	.open	= go7007_vm_open,
+ 	.close	= go7007_vm_close,
+ 	.fault	= go7007_vm_fault,
+diff -urNp linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c
+--- linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c	2010-05-15 13:21:16.231838911 -0400
+@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
+ /* The one and only one */
+ static struct blkvsc_driver_context g_blkvsc_drv;
+ 
+-static struct block_device_operations block_ops = {
++static const struct block_device_operations block_ops = {
+ 	.owner = THIS_MODULE,
+ 	.open = blkvsc_open,
+ 	.release = blkvsc_release,
+diff -urNp linux-2.6.32.13/drivers/staging/panel/panel.c linux-2.6.32.13/drivers/staging/panel/panel.c
+--- linux-2.6.32.13/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/panel/panel.c	2010-05-15 13:21:16.231838911 -0400
+@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations lcd_fops = {
++static const struct file_operations lcd_fops = {
+ 	.write   = lcd_write,
+ 	.open    = lcd_open,
+ 	.release = lcd_release,
+@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
+ 	return 0;
+ }
+ 
+-static struct file_operations keypad_fops = {
++static const struct file_operations keypad_fops = {
+ 	.read    = keypad_read,		/* read */
+ 	.open    = keypad_open,		/* open */
+ 	.release = keypad_release,	/* close */
+diff -urNp linux-2.6.32.13/drivers/staging/phison/phison.c linux-2.6.32.13/drivers/staging/phison/phison.c
+--- linux-2.6.32.13/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/phison/phison.c	2010-05-15 13:21:16.242656725 -0400
+@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations phison_ops = {
++static const struct ata_port_operations phison_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= phison_pre_reset,
+ };
+diff -urNp linux-2.6.32.13/drivers/staging/poch/poch.c linux-2.6.32.13/drivers/staging/poch/poch.c
+--- linux-2.6.32.13/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/poch/poch.c	2010-05-15 13:21:16.268445393 -0400
+@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations poch_fops = {
++static const struct file_operations poch_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = poch_open,
+ 	.release = poch_release,
+diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/inode.c linux-2.6.32.13/drivers/staging/pohmelfs/inode.c
+--- linux-2.6.32.13/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/pohmelfs/inode.c	2010-05-15 13:21:16.285190860 -0400
+@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
+ 	mutex_init(&psb->mcache_lock);
+ 	psb->mcache_root = RB_ROOT;
+ 	psb->mcache_timeout = msecs_to_jiffies(5000);
+-	atomic_long_set(&psb->mcache_gen, 0);
++	atomic_long_set_unchecked(&psb->mcache_gen, 0);
+ 
+ 	psb->trans_max_pages = 100;
+ 
+diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c
+--- linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c	2010-05-15 13:21:16.291030028 -0400
+@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
+ 	m->data = data;
+ 	m->start = start;
+ 	m->size = size;
+-	m->gen = atomic_long_inc_return(&psb->mcache_gen);
++	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
+ 
+ 	mutex_lock(&psb->mcache_lock);
+ 	err = pohmelfs_mcache_insert(psb, m);
+diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h
+--- linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h	2010-05-15 13:21:16.307023663 -0400
+@@ -570,7 +570,7 @@ struct pohmelfs_config;
+ struct pohmelfs_sb {
+ 	struct rb_root		mcache_root;
+ 	struct mutex		mcache_lock;
+-	atomic_long_t		mcache_gen;
++	atomic_long_unchecked_t	mcache_gen;
+ 	unsigned long		mcache_timeout;
+ 
+ 	unsigned int		idx;
+diff -urNp linux-2.6.32.13/drivers/staging/sep/sep_driver.c linux-2.6.32.13/drivers/staging/sep/sep_driver.c
+--- linux-2.6.32.13/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/sep/sep_driver.c	2010-05-15 13:21:16.365819296 -0400
+@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
+ static dev_t sep_devno;
+ 
+ /* the files operations structure of the driver */
+-static struct file_operations sep_file_operations = {
++static const struct file_operations sep_file_operations = {
+ 	.owner = THIS_MODULE,
+ 	.ioctl = sep_ioctl,
+ 	.poll = sep_poll,
+diff -urNp linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c
+--- linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c	2010-05-15 13:21:16.387343522 -0400
+@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
+ static int __init vme_user_probe(struct device *, int, int);
+ static int __exit vme_user_remove(struct device *, int, int);
+ 
+-static struct file_operations vme_user_fops = {
++static const struct file_operations vme_user_fops = {
+         .open = vme_user_open,
+         .release = vme_user_release,
+         .read = vme_user_read,
+diff -urNp linux-2.6.32.13/drivers/uio/uio.c linux-2.6.32.13/drivers/uio/uio.c
+--- linux-2.6.32.13/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/uio/uio.c	2010-05-15 13:21:16.387343522 -0400
+@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
+ 	return entry->show(mem, buf);
+ }
+ 
+-static struct sysfs_ops map_sysfs_ops = {
++static const struct sysfs_ops map_sysfs_ops = {
+ 	.show = map_type_show,
+ };
+ 
+@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
+ 	return entry->show(port, buf);
+ }
+ 
+-static struct sysfs_ops portio_sysfs_ops = {
++static const struct sysfs_ops portio_sysfs_ops = {
+ 	.show = portio_type_show,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/usb/atm/usbatm.c linux-2.6.32.13/drivers/usb/atm/usbatm.c
+--- linux-2.6.32.13/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/atm/usbatm.c	2010-05-15 13:21:16.394585811 -0400
+@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (printk_ratelimit())
+ 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
+ 				__func__, vpi, vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		return;
+ 	}
+ 
+@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (length > ATM_MAX_AAL5_PDU) {
+ 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
+ 				  __func__, length, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
+ 		if (sarb->len < pdu_length) {
+ 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
+ 				  __func__, pdu_length, sarb->len, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+ 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
+ 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
+ 				  __func__, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
+ 			if (printk_ratelimit())
+ 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
+ 					__func__, length);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto out;
+ 		}
+ 
+@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
+ 
+ 		vcc->push(vcc, skb);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	out:
+ 		skb_trim(sarb, 0);
+ 	}
+@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
+ 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
+ 
+ 			usbatm_pop(vcc, skb);
+-			atomic_inc(&vcc->stats->tx);
++			atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 			skb = skb_dequeue(&instance->sndqueue);
+ 		}
+@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
+ 	if (!left--)
+ 		return sprintf(page,
+ 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
+-			       atomic_read(&atm_dev->stats.aal5.tx),
+-			       atomic_read(&atm_dev->stats.aal5.tx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx),
+-			       atomic_read(&atm_dev->stats.aal5.rx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx_drop));
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
+ 
+ 	if (!left--) {
+ 		if (instance->disconnected)
+diff -urNp linux-2.6.32.13/drivers/usb/class/cdc-acm.c linux-2.6.32.13/drivers/usb/class/cdc-acm.c
+--- linux-2.6.32.13/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:38.389083173 -0400
++++ linux-2.6.32.13/drivers/usb/class/cdc-acm.c	2010-05-15 13:21:16.402576854 -0400
+@@ -1535,7 +1535,7 @@ static struct usb_device_id acm_ids[] = 
+ 		USB_CDC_ACM_PROTO_AT_CDMA) },
+ 
+ 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(usb, acm_ids);
+diff -urNp linux-2.6.32.13/drivers/usb/class/usblp.c linux-2.6.32.13/drivers/usb/class/usblp.c
+--- linux-2.6.32.13/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/class/usblp.c	2010-05-15 13:21:16.423521533 -0400
+@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
+ 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
+ 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
+ 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
+-	{ 0, 0 }
++	{ 0, 0, 0 }
+ };
+ 
+ static int usblp_wwait(struct usblp *usblp, int nonblock);
+@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
+ 	{ USB_INTERFACE_INFO(7, 1, 2) },
+ 	{ USB_INTERFACE_INFO(7, 1, 3) },
+ 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
+-	{ }						/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, usblp_ids);
+diff -urNp linux-2.6.32.13/drivers/usb/core/hcd.c linux-2.6.32.13/drivers/usb/core/hcd.c
+--- linux-2.6.32.13/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/core/hcd.c	2010-05-15 13:21:16.445526992 -0400
+@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
+ 
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+-struct usb_mon_operations *mon_ops;
++const struct usb_mon_operations *mon_ops;
+ 
+ /*
+  * The registration is unlocked.
+@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
+  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
+  */
+  
+-int usb_mon_register (struct usb_mon_operations *ops)
++int usb_mon_register (const struct usb_mon_operations *ops)
+ {
+ 
+ 	if (mon_ops)
+diff -urNp linux-2.6.32.13/drivers/usb/core/hcd.h linux-2.6.32.13/drivers/usb/core/hcd.h
+--- linux-2.6.32.13/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/core/hcd.h	2010-05-15 13:21:16.447026425 -0400
+@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+ struct usb_mon_operations {
+-	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
+-	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
+-	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
++	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
++	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
++	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
+ 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
+ };
+ 
+-extern struct usb_mon_operations *mon_ops;
++extern const struct usb_mon_operations *mon_ops;
+ 
+ static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
+ {
+@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
+ 		(*mon_ops->urb_complete)(bus, urb, status);
+ }
+ 
+-int usb_mon_register(struct usb_mon_operations *ops);
++int usb_mon_register(const struct usb_mon_operations *ops);
+ void usb_mon_deregister(void);
+ 
+ #else
+diff -urNp linux-2.6.32.13/drivers/usb/core/hub.c linux-2.6.32.13/drivers/usb/core/hub.c
+--- linux-2.6.32.13/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/core/hub.c	2010-05-15 13:21:16.479087397 -0400
+@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
+       .bDeviceClass = USB_CLASS_HUB},
+     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
+       .bInterfaceClass = USB_CLASS_HUB},
+-    { }						/* Terminating entry */
++    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, hub_id_table);
+diff -urNp linux-2.6.32.13/drivers/usb/core/message.c linux-2.6.32.13/drivers/usb/core/message.c
+--- linux-2.6.32.13/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/core/message.c	2010-05-15 13:21:16.479087397 -0400
+@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
+ 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
+ 	if (buf) {
+ 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
+-		if (len > 0) {
+-			smallbuf = kmalloc(++len, GFP_NOIO);
++		if (len++ > 0) {
++			smallbuf = kmalloc(len, GFP_NOIO);
+ 			if (!smallbuf)
+ 				return buf;
+ 			memcpy(smallbuf, buf, len);
+diff -urNp linux-2.6.32.13/drivers/usb/host/ehci-pci.c linux-2.6.32.13/drivers/usb/host/ehci-pci.c
+--- linux-2.6.32.13/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/host/ehci-pci.c	2010-05-15 13:21:16.495431959 -0400
+@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
+ 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
+ 	},
+-	{ /* end: all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, pci_ids);
+ 
+diff -urNp linux-2.6.32.13/drivers/usb/host/uhci-hcd.c linux-2.6.32.13/drivers/usb/host/uhci-hcd.c
+--- linux-2.6.32.13/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/host/uhci-hcd.c	2010-05-15 13:21:16.495431959 -0400
+@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
+ 	/* handle any USB UHCI controller */
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
+ 	.driver_data =	(unsigned long) &uhci_driver,
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
+diff -urNp linux-2.6.32.13/drivers/usb/misc/appledisplay.c linux-2.6.32.13/drivers/usb/misc/appledisplay.c
+--- linux-2.6.32.13/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/misc/appledisplay.c	2010-05-15 13:21:16.495431959 -0400
+@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
+ 		return pdata->msgdata[1];
+ }
+ 
+-static struct backlight_ops appledisplay_bl_data = {
++static const struct backlight_ops appledisplay_bl_data = {
+ 	.get_brightness	= appledisplay_bl_get_brightness,
+ 	.update_status	= appledisplay_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/usb/mon/mon_main.c linux-2.6.32.13/drivers/usb/mon/mon_main.c
+--- linux-2.6.32.13/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/mon/mon_main.c	2010-05-15 13:21:16.504078790 -0400
+@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
+ /*
+  * Ops
+  */
+-static struct usb_mon_operations mon_ops_0 = {
++static const struct usb_mon_operations mon_ops_0 = {
+ 	.urb_submit =	mon_submit,
+ 	.urb_submit_error = mon_submit_error,
+ 	.urb_complete =	mon_complete,
+diff -urNp linux-2.6.32.13/drivers/usb/storage/debug.h linux-2.6.32.13/drivers/usb/storage/debug.h
+--- linux-2.6.32.13/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/storage/debug.h	2010-05-15 13:21:16.521852812 -0400
+@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
+ #define US_DEBUGPX(x...) printk( x )
+ #define US_DEBUG(x) x 
+ #else
+-#define US_DEBUGP(x...)
+-#define US_DEBUGPX(x...)
+-#define US_DEBUG(x)
++#define US_DEBUGP(x...) do {} while (0)
++#define US_DEBUGPX(x...) do {} while (0)
++#define US_DEBUG(x) do {} while (0)
+ #endif
+ 
+ #endif
+diff -urNp linux-2.6.32.13/drivers/usb/storage/usb.c linux-2.6.32.13/drivers/usb/storage/usb.c
+--- linux-2.6.32.13/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/storage/usb.c	2010-05-15 13:21:16.547749964 -0400
+@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
+ 
+ static struct us_unusual_dev us_unusual_dev_list[] = {
+ #	include "unusual_devs.h" 
+-	{ }		/* Terminating entry */
++	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
+ };
+ 
+ #undef UNUSUAL_DEV
+diff -urNp linux-2.6.32.13/drivers/usb/storage/usual-tables.c linux-2.6.32.13/drivers/usb/storage/usual-tables.c
+--- linux-2.6.32.13/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/usb/storage/usual-tables.c	2010-05-15 13:21:16.559032137 -0400
+@@ -48,7 +48,7 @@
+ 
+ struct usb_device_id usb_storage_usb_ids[] = {
+ #	include "unusual_devs.h"
+-	{ }		/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
+ 
+diff -urNp linux-2.6.32.13/drivers/uwb/wlp/messages.c linux-2.6.32.13/drivers/uwb/wlp/messages.c
+--- linux-2.6.32.13/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/uwb/wlp/messages.c	2010-05-15 13:21:16.584920944 -0400
+@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
+ 	size_t len = skb->len;
+ 	size_t used;
+ 	ssize_t result;
+-	struct wlp_nonce enonce, rnonce;
++	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
+ 	enum wlp_assc_error assc_err;
+ 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
+ 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
+diff -urNp linux-2.6.32.13/drivers/uwb/wlp/sysfs.c linux-2.6.32.13/drivers/uwb/wlp/sysfs.c
+--- linux-2.6.32.13/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/uwb/wlp/sysfs.c	2010-05-15 13:21:16.587027337 -0400
+@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
+ 	return ret;
+ }
+ 
+-static
+-struct sysfs_ops wss_sysfs_ops = {
++static const struct sysfs_ops wss_sysfs_ops = {
+ 	.show	= wlp_wss_attr_show,
+ 	.store	= wlp_wss_attr_store,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/atmel_lcdfb.c linux-2.6.32.13/drivers/video/atmel_lcdfb.c
+--- linux-2.6.32.13/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/atmel_lcdfb.c	2010-05-15 13:21:16.587027337 -0400
+@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
+ 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
+ }
+ 
+-static struct backlight_ops atmel_lcdc_bl_ops = {
++static const struct backlight_ops atmel_lcdc_bl_ops = {
+ 	.update_status = atmel_bl_update_status,
+ 	.get_brightness = atmel_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/aty/aty128fb.c linux-2.6.32.13/drivers/video/aty/aty128fb.c
+--- linux-2.6.32.13/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/aty/aty128fb.c	2010-05-15 13:21:16.599120806 -0400
+@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty128_bl_data = {
++static const struct backlight_ops aty128_bl_data = {
+ 	.get_brightness	= aty128_bl_get_brightness,
+ 	.update_status	= aty128_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/aty/atyfb_base.c linux-2.6.32.13/drivers/video/aty/atyfb_base.c
+--- linux-2.6.32.13/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/aty/atyfb_base.c	2010-05-15 13:21:16.611030004 -0400
+@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty_bl_data = {
++static const struct backlight_ops aty_bl_data = {
+ 	.get_brightness = aty_bl_get_brightness,
+ 	.update_status	= aty_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/aty/radeon_backlight.c linux-2.6.32.13/drivers/video/aty/radeon_backlight.c
+--- linux-2.6.32.13/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/aty/radeon_backlight.c	2010-05-15 13:21:16.611030004 -0400
+@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops radeon_bl_data = {
++static const struct backlight_ops radeon_bl_data = {
+ 	.get_brightness = radeon_bl_get_brightness,
+ 	.update_status	= radeon_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
+ 	return error ? data->current_brightness : reg_val;
+ }
+ 
+-static struct backlight_ops adp5520_bl_ops = {
++static const struct backlight_ops adp5520_bl_ops = {
+ 	.update_status	= adp5520_bl_update_status,
+ 	.get_brightness	= adp5520_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/adx_bl.c linux-2.6.32.13/drivers/video/backlight/adx_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/adx_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
+ 	return 1;
+ }
+ 
+-static struct backlight_ops adx_backlight_ops = {
++static const struct backlight_ops adx_backlight_ops = {
+ 	.options = 0,
+ 	.update_status = adx_backlight_update_status,
+ 	.get_brightness = adx_backlight_get_brightness,
+diff -urNp linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c
+--- linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
+ 	return pwm_channel_enable(&pwmbl->pwmc);
+ }
+ 
+-static struct backlight_ops atmel_pwm_bl_ops = {
++static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.get_brightness = atmel_pwm_bl_get_intensity,
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/backlight.c linux-2.6.32.13/drivers/video/backlight/backlight.c
+--- linux-2.6.32.13/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/backlight.c	2010-05-15 13:21:16.611030004 -0400
+@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
+  * ERR_PTR() or a pointer to the newly allocated device.
+  */
+ struct backlight_device *backlight_device_register(const char *name,
+-		struct device *parent, void *devdata, struct backlight_ops *ops)
++		struct device *parent, void *devdata, const struct backlight_ops *ops)
+ {
+ 	struct backlight_device *new_bd;
+ 	int rc;
+diff -urNp linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c
+--- linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c	2010-05-15 13:21:16.611030004 -0400
+@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
+ }
+ EXPORT_SYMBOL(corgi_lcd_limit_intensity);
+ 
+-static struct backlight_ops corgi_bl_ops = {
++static const struct backlight_ops corgi_bl_ops = {
+ 	.get_brightness	= corgi_bl_get_intensity,
+ 	.update_status  = corgi_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c
+--- linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c	2010-05-15 13:21:16.611030004 -0400
+@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
+ 	return intensity;
+ }
+ 
+-static struct backlight_ops cr_backlight_ops = {
++static const struct backlight_ops cr_backlight_ops = {
+ 	.get_brightness = cr_backlight_get_intensity,
+ 	.update_status = cr_backlight_set_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/da903x_bl.c linux-2.6.32.13/drivers/video/backlight/da903x_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/da903x_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops da903x_backlight_ops = {
++static const struct backlight_ops da903x_backlight_ops = {
+ 	.update_status	= da903x_backlight_update_status,
+ 	.get_brightness	= da903x_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/generic_bl.c linux-2.6.32.13/drivers/video/backlight/generic_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/generic_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
+ }
+ EXPORT_SYMBOL(corgibl_limit_intensity);
+ 
+-static struct backlight_ops genericbl_ops = {
++static const struct backlight_ops genericbl_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.get_brightness = genericbl_get_intensity,
+ 	.update_status  = genericbl_send_intensity,
+diff -urNp linux-2.6.32.13/drivers/video/backlight/hp680_bl.c linux-2.6.32.13/drivers/video/backlight/hp680_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/hp680_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops hp680bl_ops = {
++static const struct backlight_ops hp680bl_ops = {
+ 	.get_brightness = hp680bl_get_intensity,
+ 	.update_status  = hp680bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -93,7 +93,7 @@ out:
+ 	return ret;
+ }
+ 
+-static struct backlight_ops jornada_bl_ops = {
++static const struct backlight_ops jornada_bl_ops = {
+ 	.get_brightness = jornada_bl_get_brightness,
+ 	.update_status = jornada_bl_update_status,
+ 	.options = BL_CORE_SUSPENDRESUME,
+diff -urNp linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
+ 	return kb3886bl_intensity;
+ }
+ 
+-static struct backlight_ops kb3886bl_ops = {
++static const struct backlight_ops kb3886bl_ops = {
+ 	.get_brightness = kb3886bl_get_intensity,
+ 	.update_status  = kb3886bl_send_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/locomolcd.c linux-2.6.32.13/drivers/video/backlight/locomolcd.c
+--- linux-2.6.32.13/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/locomolcd.c	2010-05-15 13:21:16.611030004 -0400
+@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops locomobl_data = {
++static const struct backlight_ops locomobl_data = {
+ 	.get_brightness = locomolcd_get_intensity,
+ 	.update_status  = locomolcd_set_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:38.397382140 -0400
++++ linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c	2010-05-15 13:21:16.611030004 -0400
+@@ -33,7 +33,7 @@ struct dmi_match_data {
+ 	unsigned long iostart;
+ 	unsigned long iolen;
+ 	/* Backlight operations structure. */
+-	struct backlight_ops backlight_ops;
++	const struct backlight_ops backlight_ops;
+ };
+ 
+ /* Module parameters. */
+diff -urNp linux-2.6.32.13/drivers/video/backlight/omap1_bl.c linux-2.6.32.13/drivers/video/backlight/omap1_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/omap1_bl.c	2010-05-15 13:21:16.647199475 -0400
+@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
+ 	return bl->current_intensity;
+ }
+ 
+-static struct backlight_ops omapbl_ops = {
++static const struct backlight_ops omapbl_ops = {
+ 	.get_brightness = omapbl_get_intensity,
+ 	.update_status  = omapbl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/progear_bl.c linux-2.6.32.13/drivers/video/backlight/progear_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/progear_bl.c	2010-05-15 13:21:16.647199475 -0400
+@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
+ 	return intensity - HW_LEVEL_MIN;
+ }
+ 
+-static struct backlight_ops progearbl_ops = {
++static const struct backlight_ops progearbl_ops = {
+ 	.get_brightness = progearbl_get_intensity,
+ 	.update_status = progearbl_set_intensity,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/pwm_bl.c linux-2.6.32.13/drivers/video/backlight/pwm_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/pwm_bl.c	2010-05-15 13:21:16.647199475 -0400
+@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
+ 	return bl->props.brightness;
+ }
+ 
+-static struct backlight_ops pwm_backlight_ops = {
++static const struct backlight_ops pwm_backlight_ops = {
+ 	.update_status	= pwm_backlight_update_status,
+ 	.get_brightness	= pwm_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/tosa_bl.c linux-2.6.32.13/drivers/video/backlight/tosa_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/tosa_bl.c	2010-05-15 13:21:16.647199475 -0400
+@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
+ 	return props->brightness;
+ }
+ 
+-static struct backlight_ops bl_ops = {
++static const struct backlight_ops bl_ops = {
+ 	.get_brightness		= tosa_bl_get_brightness,
+ 	.update_status		= tosa_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c
+--- linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c	2010-05-15 13:21:16.647199475 -0400
+@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops wm831x_backlight_ops = {
++static const struct backlight_ops wm831x_backlight_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.update_status	= wm831x_backlight_update_status,
+ 	.get_brightness	= wm831x_backlight_get_brightness,
+diff -urNp linux-2.6.32.13/drivers/video/bf54x-lq043fb.c linux-2.6.32.13/drivers/video/bf54x-lq043fb.c
+--- linux-2.6.32.13/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/bf54x-lq043fb.c	2010-05-15 13:21:16.647199475 -0400
+@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c
+--- linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c	2010-05-15 13:21:16.647199475 -0400
+@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/video/fbcmap.c linux-2.6.32.13/drivers/video/fbcmap.c
+--- linux-2.6.32.13/drivers/video/fbcmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/fbcmap.c	2010-05-15 13:21:16.647199475 -0400
+@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
+ 		rc = -ENODEV;
+ 		goto out;
+ 	}
+-	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+-				!info->fbops->fb_setcmap)) {
++	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
+ 		rc = -EINVAL;
+ 		goto out1;
+ 	}
+diff -urNp linux-2.6.32.13/drivers/video/fbmem.c linux-2.6.32.13/drivers/video/fbmem.c
+--- linux-2.6.32.13/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/fbmem.c	2010-05-15 13:21:16.659032956 -0400
+@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dx += image->width + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_UD) {
+-		for (x = 0; x < num && image->dx >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dx -= image->width + 8;
+ 		}
+@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dy += image->height + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_CCW) {
+-		for (x = 0; x < num && image->dy >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dy -= image->height + 8;
+ 		}
+@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
+ 			return -EFAULT;
+ 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+ 			return -EINVAL;
+-		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
++		if (con2fb.framebuffer >= FB_MAX)
+ 			return -EINVAL;
+ 		if (!registered_fb[con2fb.framebuffer])
+ 			request_module("fb%d", con2fb.framebuffer);
+diff -urNp linux-2.6.32.13/drivers/video/fbmon.c linux-2.6.32.13/drivers/video/fbmon.c
+--- linux-2.6.32.13/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/fbmon.c	2010-05-15 13:21:16.667905259 -0400
+@@ -45,7 +45,7 @@
+ #ifdef DEBUG
+ #define DPRINTK(fmt, args...) printk(fmt,## args)
+ #else
+-#define DPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
+ #endif
+ 
+ #define FBMON_FIX_HEADER  1
+diff -urNp linux-2.6.32.13/drivers/video/i810/i810_accel.c linux-2.6.32.13/drivers/video/i810/i810_accel.c
+--- linux-2.6.32.13/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/i810/i810_accel.c	2010-05-15 13:21:16.667905259 -0400
+@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
+ 		}
+ 	}
+ 	printk("ringbuffer lockup!!!\n");
++	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
+ 	i810_report_error(mmio); 
+ 	par->dev_flags |= LOCKUP;
+ 	info->pixmap.scan_align = 1;
+diff -urNp linux-2.6.32.13/drivers/video/i810/i810_main.c linux-2.6.32.13/drivers/video/i810/i810_main.c
+--- linux-2.6.32.13/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/i810/i810_main.c	2010-05-15 13:21:16.675089243 -0400
+@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
+ 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ static struct pci_driver i810fb_driver = {
+diff -urNp linux-2.6.32.13/drivers/video/modedb.c linux-2.6.32.13/drivers/video/modedb.c
+--- linux-2.6.32.13/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/modedb.c	2010-05-15 13:21:16.691535841 -0400
+@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
+     {
+ 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
+ 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
+ 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
+ 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
+ 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
+ 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
+-	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
+ 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
+ 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
+ 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
+ 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
+ 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
+ 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
+ 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
+ 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
+ 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
+ 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
+ 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
+ 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
+ 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
+ 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
+-	0, FB_VMODE_NONINTERLACED   	
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
+ 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
+         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
+ 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
+ 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
+ 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
+ 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
+ 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
+ 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
+ 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
+ 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
+ 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
+ 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
+ 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
+ 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
+ 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
+ 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
+ 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
+ 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
+ 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
+ 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
+ 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
+ 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+ 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+ 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+-	FB_VMODE_NONINTERLACED
++	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
+ 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
+ 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+    }, {
+ 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
+ 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     },
+ };
+ 
+diff -urNp linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c
+--- linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c	2010-05-15 13:21:16.691535841 -0400
+@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops nvidia_bl_ops = {
++static const struct backlight_ops nvidia_bl_ops = {
+ 	.get_brightness = nvidia_bl_get_brightness,
+ 	.update_status	= nvidia_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/riva/fbdev.c linux-2.6.32.13/drivers/video/riva/fbdev.c
+--- linux-2.6.32.13/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/riva/fbdev.c	2010-05-15 13:21:16.695039791 -0400
+@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops riva_bl_ops = {
++static const struct backlight_ops riva_bl_ops = {
+ 	.get_brightness = riva_bl_get_brightness,
+ 	.update_status	= riva_bl_update_status,
+ };
+diff -urNp linux-2.6.32.13/drivers/video/uvesafb.c linux-2.6.32.13/drivers/video/uvesafb.c
+--- linux-2.6.32.13/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/uvesafb.c	2010-05-15 13:21:16.714782153 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/fb.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
++#include <linux/moduleloader.h>
+ #include <video/edid.h>
+ #include <video/uvesafb.h>
+ #ifdef CONFIG_X86
+@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
+ 		NULL,
+ 	};
+ 
+-	return call_usermodehelper(v86d_path, argv, envp, 1);
++	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
+ }
+ 
+ /*
+@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
+ 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
+ 		par->pmi_setpal = par->ypan = 0;
+ 	} else {
++
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_MODULES
++		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
++#endif
++		if (!par->pmi_code) {
++			par->pmi_setpal = par->ypan = 0;
++			return 0;
++		}
++#endif
++
+ 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
+ 						+ task->t.regs.edi);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
++		pax_close_kernel();
++
++		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
++		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
++#else
+ 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
+ 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
++#endif
++
+ 		printk(KERN_INFO "uvesafb: protected mode interface info at "
+ 				 "%04x:%04x\n",
+ 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
+@@ -1799,6 +1822,11 @@ out:
+ 	if (par->vbe_modes)
+ 		kfree(par->vbe_modes);
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	if (par->pmi_code)
++		module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 	framebuffer_release(info);
+ 	return err;
+ }
+@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
+ 				kfree(par->vbe_state_orig);
+ 			if (par->vbe_state_saved)
+ 				kfree(par->vbe_state_saved);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++			if (par->pmi_code)
++				module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 		}
+ 
+ 		framebuffer_release(info);
+diff -urNp linux-2.6.32.13/drivers/video/vesafb.c linux-2.6.32.13/drivers/video/vesafb.c
+--- linux-2.6.32.13/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/video/vesafb.c	2010-05-15 13:21:16.727737170 -0400
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/module.h>
++#include <linux/moduleloader.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/string.h>
+@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
+ static int   vram_total __initdata;		/* Set total amount of memory */
+ static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
+ static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
+-static void  (*pmi_start)(void) __read_mostly;
+-static void  (*pmi_pal)  (void) __read_mostly;
++static void  (*pmi_start)(void) __read_only;
++static void  (*pmi_pal)  (void) __read_only;
+ static int   depth      __read_mostly;
+ static int   vga_compat __read_mostly;
+ /* --------------------------------------------------------------------- */
+@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
+ 	unsigned int size_vmode;
+ 	unsigned int size_remap;
+ 	unsigned int size_total;
++	void *pmi_code = NULL;
+ 
+ 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
+ 		return -ENODEV;
+@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
+ 		size_remap = size_total;
+ 	vesafb_fix.smem_len = size_remap;
+ 
+-#ifndef __i386__
+-	screen_info.vesapm_seg = 0;
+-#endif
+-
+ 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
+ 		printk(KERN_WARNING
+ 		       "vesafb: cannot reserve video memory at 0x%lx\n",
+@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
+ 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
+ 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
+ 
++#ifdef __i386__
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	pmi_code = module_alloc_exec(screen_info.vesapm_size);
++	if (!pmi_code)
++#elif !defined(CONFIG_PAX_KERNEXEC)
++	if (0)
++#endif
++
++#endif
++	screen_info.vesapm_seg = 0;
++
+ 	if (screen_info.vesapm_seg) {
+-		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
+-		       screen_info.vesapm_seg,screen_info.vesapm_off);
++		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
++		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
+ 	}
+ 
+ 	if (screen_info.vesapm_seg < 0xc000)
+@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
+ 
+ 	if (ypan || pmi_setpal) {
+ 		unsigned short *pmi_base;
+-		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+-		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
+-		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
++
++		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
++#else
++		pmi_code = pmi_base;
++#endif
++
++		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
++		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pmi_start = ktva_ktla(pmi_start);
++		pmi_pal = ktva_ktla(pmi_pal);
++		pax_close_kernel();
++#endif
++
+ 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
+ 		if (pmi_base[3]) {
+ 			printk(KERN_INFO "vesafb: pmi: ports = ");
+@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
+ 	       info->node, info->fix.id);
+ 	return 0;
+ err:
++
++#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	module_free_exec(NULL, pmi_code);
++#endif
++
+ 	if (info->screen_base)
+ 		iounmap(info->screen_base);
+ 	framebuffer_release(info);
+diff -urNp linux-2.6.32.13/drivers/xen/sys-hypervisor.c linux-2.6.32.13/drivers/xen/sys-hypervisor.c
+--- linux-2.6.32.13/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/drivers/xen/sys-hypervisor.c	2010-05-15 13:21:16.727737170 -0400
+@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
+ 	return 0;
+ }
+ 
+-static struct sysfs_ops hyp_sysfs_ops = {
++static const struct sysfs_ops hyp_sysfs_ops = {
+ 	.show = hyp_sysfs_show,
+ 	.store = hyp_sysfs_store,
+ };
+diff -urNp linux-2.6.32.13/fs/9p/vfs_inode.c linux-2.6.32.13/fs/9p/vfs_inode.c
+--- linux-2.6.32.13/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/9p/vfs_inode.c	2010-05-15 13:21:16.735266886 -0400
+@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
+ static void
+ v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 
+ 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
+ 		IS_ERR(s) ? "<error>" : s);
+diff -urNp linux-2.6.32.13/fs/aio.c linux-2.6.32.13/fs/aio.c
+--- linux-2.6.32.13/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/aio.c	2010-05-15 13:21:16.759050469 -0400
+@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
+ 	size += sizeof(struct io_event) * nr_events;
+ 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
+ 
+-	if (nr_pages < 0)
++	if (nr_pages <= 0)
+ 		return -EINVAL;
+ 
+ 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+diff -urNp linux-2.6.32.13/fs/attr.c linux-2.6.32.13/fs/attr.c
+--- linux-2.6.32.13/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/attr.c	2010-05-15 13:21:16.767048242 -0400
+@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
+ 		unsigned long limit;
+ 
+ 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
++		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
+ 		if (limit != RLIM_INFINITY && offset > limit)
+ 			goto out_sig;
+ 		if (offset > inode->i_sb->s_maxbytes)
+diff -urNp linux-2.6.32.13/fs/autofs/root.c linux-2.6.32.13/fs/autofs/root.c
+--- linux-2.6.32.13/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/autofs/root.c	2010-05-15 13:21:16.770726483 -0400
+@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
+ 	set_bit(n,sbi->symlink_bitmap);
+ 	sl = &sbi->symlink[n];
+ 	sl->len = strlen(symname);
+-	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
++	slsize = sl->len+1;
++	sl->data = kmalloc(slsize, GFP_KERNEL);
+ 	if (!sl->data) {
+ 		clear_bit(n,sbi->symlink_bitmap);
+ 		unlock_kernel();
+diff -urNp linux-2.6.32.13/fs/autofs4/symlink.c linux-2.6.32.13/fs/autofs4/symlink.c
+--- linux-2.6.32.13/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/autofs4/symlink.c	2010-05-15 13:21:16.786757439 -0400
+@@ -15,7 +15,7 @@
+ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
+ {
+ 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
+-	nd_set_link(nd, (char *)ino->u.symlink);
++	nd_set_link(nd, ino->u.symlink);
+ 	return NULL;
+ }
+ 
+diff -urNp linux-2.6.32.13/fs/befs/linuxvfs.c linux-2.6.32.13/fs/befs/linuxvfs.c
+--- linux-2.6.32.13/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/befs/linuxvfs.c	2010-05-15 13:21:16.795284033 -0400
+@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
+ {
+ 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
+ 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
+-		char *link = nd_get_link(nd);
++		const char *link = nd_get_link(nd);
+ 		if (!IS_ERR(link))
+ 			kfree(link);
+ 	}
+diff -urNp linux-2.6.32.13/fs/binfmt_aout.c linux-2.6.32.13/fs/binfmt_aout.c
+--- linux-2.6.32.13/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/binfmt_aout.c	2010-05-15 13:21:16.799043518 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/string.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #include <linux/ptrace.h>
+@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
+ 
+ /* If the size of the dump file exceeds the rlimit, then see what would happen
+    if we wrote the stack, but not the data area.  */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
+ 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
+ 		dump.u_dsize = 0;
+ 
+ /* Make sure we have enough room to write the stack and data areas. */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
+ 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
+ 		dump.u_ssize = 0;
+ 
+@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+ 	if (rlim >= RLIM_INFINITY)
+ 		rlim = ~0;
++
++	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
+ 	if (ex.a_data + ex.a_bss > rlim)
+ 		return -ENOMEM;
+ 
+@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
+ 	install_exec_creds(bprm);
+  	current->flags &= ~PF_FORKNOEXEC;
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
++		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
++			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
++			current->mm->pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++	}
++#endif
++
+ 	if (N_MAGIC(ex) == OMAGIC) {
+ 		unsigned long text_addr, map_size;
+ 		loff_t pos;
+@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
+ 
+ 		down_write(&current->mm->mmap_sem);
+  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+-				PROT_READ | PROT_WRITE | PROT_EXEC,
++				PROT_READ | PROT_WRITE,
+ 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
+ 				fd_offset + ex.a_text);
+ 		up_write(&current->mm->mmap_sem);
+diff -urNp linux-2.6.32.13/fs/binfmt_elf.c linux-2.6.32.13/fs/binfmt_elf.c
+--- linux-2.6.32.13/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/binfmt_elf.c	2010-05-15 13:21:16.818718975 -0400
+@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
+ #define elf_core_dump	NULL
+ #endif
+ 
++#ifdef CONFIG_PAX_MPROTECT
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
++#endif
++
+ #if ELF_EXEC_PAGESIZE > PAGE_SIZE
+ #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
+ #else
+@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
+ 		.load_binary	= load_elf_binary,
+ 		.load_shlib	= load_elf_library,
+ 		.core_dump	= elf_core_dump,
++
++#ifdef CONFIG_PAX_MPROTECT
++		.handle_mprotect= elf_handle_mprotect,
++#endif
++
+ 		.min_coredump	= ELF_EXEC_PAGESIZE,
+ 		.hasvdso	= 1
+ };
+@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
+ 
+ static int set_brk(unsigned long start, unsigned long end)
+ {
++	unsigned long e = end;
++
+ 	start = ELF_PAGEALIGN(start);
+ 	end = ELF_PAGEALIGN(end);
+ 	if (end > start) {
+@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+-	current->mm->start_brk = current->mm->brk = end;
++	current->mm->start_brk = current->mm->brk = e;
+ 	return 0;
+ }
+ 
+@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
+ 	elf_addr_t __user *u_rand_bytes;
+ 	const char *k_platform = ELF_PLATFORM;
+ 	const char *k_base_platform = ELF_BASE_PLATFORM;
+-	unsigned char k_rand_bytes[16];
++	u32 k_rand_bytes[4];
+ 	int items;
+ 	elf_addr_t *elf_info;
+ 	int ei_index = 0;
+@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
+ 	 * Generate 16 random bytes for userspace PRNG seeding.
+ 	 */
+ 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
+-	u_rand_bytes = (elf_addr_t __user *)
+-		       STACK_ALLOC(p, sizeof(k_rand_bytes));
++	srandom32(k_rand_bytes[0] ^ random32());
++	srandom32(k_rand_bytes[1] ^ random32());
++	srandom32(k_rand_bytes[2] ^ random32());
++	srandom32(k_rand_bytes[3] ^ random32());
++	p = STACK_ROUND(p, sizeof(k_rand_bytes));
++	u_rand_bytes = (elf_addr_t __user *) p;
+ 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
+ 		return -EFAULT;
+ 
+@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
+ {
+ 	struct elf_phdr *elf_phdata;
+ 	struct elf_phdr *eppnt;
+-	unsigned long load_addr = 0;
++	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
+ 	int load_addr_set = 0;
+ 	unsigned long last_bss = 0, elf_bss = 0;
+-	unsigned long error = ~0UL;
++	unsigned long error = -EINVAL;
+ 	unsigned long total_size;
+ 	int retval, i, size;
+ 
+@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
+ 		goto out_close;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	eppnt = elf_phdata;
+ 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
+ 		if (eppnt->p_type == PT_LOAD) {
+@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
+ 			k = load_addr + eppnt->p_vaddr;
+ 			if (BAD_ADDR(k) ||
+ 			    eppnt->p_filesz > eppnt->p_memsz ||
+-			    eppnt->p_memsz > TASK_SIZE ||
+-			    TASK_SIZE - eppnt->p_memsz < k) {
++			    eppnt->p_memsz > pax_task_size ||
++			    pax_task_size - eppnt->p_memsz < k) {
+ 				error = -ENOMEM;
+ 				goto out_close;
+ 			}
+@@ -532,6 +552,177 @@ out:
+ 	return error;
+ }
+ 
++#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
++static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (elf_phdata->p_flags & PF_PAGEEXEC)
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (elf_phdata->p_flags & PF_SEGMEXEC)
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (elf_phdata->p_flags & PF_EMUTRAMP)
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (elf_phdata->p_flags & PF_MPROTECT)
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	unsigned long i;
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++	pax_flags = pax_parse_ei_pax(elf_ex);
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	for (i = 0UL; i < elf_ex->e_phnum; i++)
++		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
++			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
++			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
++			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
++				return -EINVAL;
++
++#ifdef CONFIG_PAX_SOFTMODE
++			if (pax_softmode)
++				pax_flags = pax_parse_softmode(&elf_phdata[i]);
++			else
++#endif
++
++				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
++			break;
++		}
++#endif
++
++	if (0 > pax_check_flags(&pax_flags))
++		return -EINVAL;
++
++	current->mm->pax_flags = pax_flags;
++	return 0;
++}
++#endif
++
+ /*
+  * These are the functions used to load ELF style executables and shared
+  * libraries.  There is no binary dependent code anywhere else.
+@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
+ {
+ 	unsigned int random_variable = 0;
+ 
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		return stack_top - current->mm->delta_stack;
++#endif
++
+ 	if ((current->flags & PF_RANDOMIZE) &&
+ 		!(current->personality & ADDR_NO_RANDOMIZE)) {
+ 		random_variable = get_random_int() & STACK_RND_MASK;
+@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
+  	unsigned long load_addr = 0, load_bias = 0;
+ 	int load_addr_set = 0;
+ 	char * elf_interpreter = NULL;
+-	unsigned long error;
++	unsigned long error = 0;
+ 	struct elf_phdr *elf_ppnt, *elf_phdata;
+ 	unsigned long elf_bss, elf_brk;
+ 	int retval, i;
+@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
+ 	unsigned long start_code, end_code, start_data, end_data;
+ 	unsigned long reloc_func_desc = 0;
+ 	int executable_stack = EXSTACK_DEFAULT;
+-	unsigned long def_flags = 0;
+ 	struct {
+ 		struct elfhdr elf_ex;
+ 		struct elfhdr interp_elf_ex;
+ 	} *loc;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
+ 	if (!loc) {
+@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
+ 
+ 	/* OK, This is the point of no return */
+ 	current->flags &= ~PF_FORKNOEXEC;
+-	current->mm->def_flags = def_flags;
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	current->mm->call_dl_resolve = 0UL;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	current->mm->call_syscall = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	current->mm->delta_mmap = 0UL;
++	current->mm->delta_stack = 0UL;
++#endif
++
++	current->mm->def_flags = 0;
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
++		send_sig(SIGKILL, current, 0);
++		goto out_free_dentry;
++	}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++	pax_set_initial_flags(bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++	if (pax_set_initial_flags_func)
++		(pax_set_initial_flags_func)(bprm);
++#endif
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
++		current->mm->context.user_cs_limit = PAGE_SIZE;
++		current->mm->def_flags |= VM_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
++		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++	}
++#endif
++
++#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
++		put_cpu();
++	}
++#endif
+ 
+ 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
+ 	   may depend on the personality.  */
+ 	SET_PERSONALITY(loc->elf_ex);
++
++#ifdef CONFIG_PAX_ASLR
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
++		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
++		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		executable_stack = EXSTACK_DISABLE_X;
++		current->personality &= ~READ_IMPLIES_EXEC;
++	} else
++#endif
++
+ 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
+ 		current->personality |= READ_IMPLIES_EXEC;
+ 
+@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++			/* PaX: randomize base address at the default exe base if requested */
++			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
++#ifdef CONFIG_SPARC64
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
++#else
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
++#endif
++				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
++				elf_flags |= MAP_FIXED;
++			}
++#endif
++
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
+ 		 * allowed task size. Note that p_filesz must always be
+ 		 * <= p_memsz so it is only necessary to check p_memsz.
+ 		 */
+-		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
+-		    elf_ppnt->p_memsz > TASK_SIZE ||
+-		    TASK_SIZE - elf_ppnt->p_memsz < k) {
++		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
++		    elf_ppnt->p_memsz > pax_task_size ||
++		    pax_task_size - elf_ppnt->p_memsz < k) {
+ 			/* set_brk can never work. Avoid overflows. */
+ 			send_sig(SIGKILL, current, 0);
+ 			retval = -EINVAL;
+@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
+ 	start_data += load_bias;
+ 	end_data += load_bias;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
++		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
++#endif
++
+ 	/* Calling set_brk effectively mmaps the pages that we need
+ 	 * for the bss and break sections.  We must do this before
+ 	 * mapping in the interpreter, to make sure it doesn't wind
+@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
+ 		goto out_free_dentry;
+ 	}
+ 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
+-		send_sig(SIGSEGV, current, 0);
+-		retval = -EFAULT; /* Nobody gets to see this, but.. */
+-		goto out_free_dentry;
++		/*
++		 * This bss-zeroing can fail if the ELF
++		 * file specifies odd protections. So
++		 * we don't check the return value
++		 */
+ 	}
+ 
+ 	if (elf_interpreter) {
+@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
+ 			unsigned long n = off;
+ 			if (n > PAGE_SIZE)
+ 				n = PAGE_SIZE;
+-			if (!dump_write(file, buf, n))
++			if (!dump_write(file, buf, n)) {
++				free_page((unsigned long)buf);
+ 				return 0;
++			}
+ 			off -= n;
+ 		}
+ 		free_page((unsigned long)buf);
+@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
+  * Decide what to dump of a segment, part, all or none.
+  */
+ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+-				   unsigned long mm_flags)
++				   unsigned long mm_flags, long signr)
+ {
+ #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
+ 
+@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
+ 	if (vma->vm_file == NULL)
+ 		return 0;
+ 
+-	if (FILTER(MAPPED_PRIVATE))
++	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
+ 		goto whole;
+ 
+ 	/*
+@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
+ #undef DUMP_WRITE
+ 
+ #define DUMP_WRITE(addr, nr)	\
++	do { \
++	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
+ 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
+-		goto end_coredump;
++		goto end_coredump; \
++	} while (0);
+ 
+ static void fill_elf_header(struct elfhdr *elf, int segs,
+ 			    u16 machine, u32 flags, u8 osabi)
+@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
+ {
+ 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
+ 	int i = 0;
+-	do
++	do {
+ 		i += 2;
+-	while (auxv[i - 2] != AT_NULL);
++	} while (auxv[i - 2] != AT_NULL);
+ 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
+ }
+ 
+@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
+ 		phdr.p_offset = offset;
+ 		phdr.p_vaddr = vma->vm_start;
+ 		phdr.p_paddr = 0;
+-		phdr.p_filesz = vma_dump_size(vma, mm_flags);
++		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
+ 		phdr.p_memsz = vma->vm_end - vma->vm_start;
+ 		offset += phdr.p_filesz;
+ 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
+@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
+ 		unsigned long addr;
+ 		unsigned long end;
+ 
+-		end = vma->vm_start + vma_dump_size(vma, mm_flags);
++		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
+ 
+ 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
+ 			struct page *page;
+@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
+ 			page = get_dump_page(addr);
+ 			if (page) {
+ 				void *kaddr = kmap(page);
++				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
+ 				stop = ((size += PAGE_SIZE) > limit) ||
+ 					!dump_write(file, kaddr, PAGE_SIZE);
+ 				kunmap(page);
+@@ -2042,6 +2334,97 @@ out:
+ 
+ #endif		/* USE_ELF_CORE_DUMP */
+ 
++#ifdef CONFIG_PAX_MPROTECT
++/* PaX: non-PIC ELF libraries need relocations on their executable segments
++ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
++ * we'll remove VM_MAYWRITE for good on RELRO segments.
++ *
++ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
++ * basis because we want to allow the common case and not the special ones.
++ */
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
++{
++	struct elfhdr elf_h;
++	struct elf_phdr elf_p;
++	unsigned long i;
++	unsigned long oldflags;
++	bool is_textrel_rw, is_textrel_rx, is_relro;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
++		return;
++
++	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
++	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
++
++#ifdef CONFIG_PAX_NOELFRELOCS
++	is_textrel_rw = false;
++	is_textrel_rx = false;
++#else
++	/* possible TEXTREL */
++	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
++	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
++#endif
++
++	/* possible RELRO */
++	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
++
++	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
++		return;
++
++	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
++	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
++
++#ifdef CONFIG_PAX_ETEXECRELOCS
++	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++#else
++	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
++#endif
++
++	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++	    !elf_check_arch(&elf_h) ||
++	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
++	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
++		return;
++
++	for (i = 0UL; i < elf_h.e_phnum; i++) {
++		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
++			return;
++		switch (elf_p.p_type) {
++		case PT_DYNAMIC:
++			if (!is_textrel_rw && !is_textrel_rx)
++				continue;
++			i = 0UL;
++			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
++				elf_dyn dyn;
++
++				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
++					return;
++				if (dyn.d_tag == DT_NULL)
++					return;
++				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
++					gr_log_textrel(vma);
++					if (is_textrel_rw)
++						vma->vm_flags |= VM_MAYWRITE;
++					else
++						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
++						vma->vm_flags &= ~VM_MAYWRITE;
++					return;
++				}
++				i++;
++			}
++			return;
++
++		case PT_GNU_RELRO:
++			if (!is_relro)
++				continue;
++			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
++				vma->vm_flags &= ~VM_MAYWRITE;
++			return;
++		}
++	}
++}
++#endif
++
+ static int __init init_elf_binfmt(void)
+ {
+ 	return register_binfmt(&elf_format);
+diff -urNp linux-2.6.32.13/fs/binfmt_flat.c linux-2.6.32.13/fs/binfmt_flat.c
+--- linux-2.6.32.13/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/binfmt_flat.c	2010-05-15 13:21:16.818718975 -0400
+@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
+ 				realdatastart = (unsigned long) -ENOMEM;
+ 			printk("Unable to allocate RAM for process data, errno %d\n",
+ 					(int)-realdatastart);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
++			up_write(&current->mm->mmap_sem);
+ 			ret = realdatastart;
+ 			goto err;
+ 		}
+@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read data+bss, errno %d\n", (int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
+ 			do_munmap(current->mm, realdatastart, data_len + extra);
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len + data_len + extra +
+ 				MAX_SHARED_LIBS * sizeof(unsigned long));
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+diff -urNp linux-2.6.32.13/fs/binfmt_misc.c linux-2.6.32.13/fs/binfmt_misc.c
+--- linux-2.6.32.13/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/binfmt_misc.c	2010-05-15 13:21:16.827094561 -0400
+@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
+ 	static struct tree_descr bm_files[] = {
+ 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
+ 		[3] = {"register", &bm_register_operations, S_IWUSR},
+-		/* last one */ {""}
++		/* last one */ {"", NULL, 0}
+ 	};
+ 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
+ 	if (!err)
+diff -urNp linux-2.6.32.13/fs/bio.c linux-2.6.32.13/fs/bio.c
+--- linux-2.6.32.13/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/bio.c	2010-05-15 13:21:16.827094561 -0400
+@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
+ 
+ 	i = 0;
+ 	while (i < bio_slab_nr) {
+-		struct bio_slab *bslab = &bio_slabs[i];
++		bslab = &bio_slabs[i];
+ 
+ 		if (!bslab->slab && entry == -1)
+ 			entry = i;
+@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
+ 	const int read = bio_data_dir(bio) == READ;
+ 	struct bio_map_data *bmd = bio->bi_private;
+ 	int i;
+-	char *p = bmd->sgvecs[0].iov_base;
++	char *p = (__force char *)bmd->sgvecs[0].iov_base;
+ 
+ 	__bio_for_each_segment(bvec, bio, i, 0) {
+ 		char *addr = page_address(bvec->bv_page);
+diff -urNp linux-2.6.32.13/fs/block_dev.c linux-2.6.32.13/fs/block_dev.c
+--- linux-2.6.32.13/fs/block_dev.c	2010-04-29 17:49:38.421500081 -0400
++++ linux-2.6.32.13/fs/block_dev.c	2010-05-15 13:21:16.839060742 -0400
+@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, 
+ 	else if (bdev->bd_contains == bdev)
+ 		res = 0;  	 /* is a whole device which isn't held */
+ 
+-	else if (bdev->bd_contains->bd_holder == bd_claim)
++	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
+ 		res = 0; 	 /* is a partition of a device that is being partitioned */
+ 	else if (bdev->bd_contains->bd_holder != NULL)
+ 		res = -EBUSY;	 /* is a partition of a held device */
+diff -urNp linux-2.6.32.13/fs/btrfs/ctree.c linux-2.6.32.13/fs/btrfs/ctree.c
+--- linux-2.6.32.13/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/ctree.c	2010-05-15 13:21:16.884750763 -0400
+@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
+ 
+ 	ret = 0;
+ 	if (slot == 0) {
+-		struct btrfs_disk_key disk_key;
+ 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
+ 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
+ 	}
+diff -urNp linux-2.6.32.13/fs/btrfs/disk-io.c linux-2.6.32.13/fs/btrfs/disk-io.c
+--- linux-2.6.32.13/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/disk-io.c	2010-05-15 13:21:16.884750763 -0400
+@@ -39,7 +39,7 @@
+ #include "tree-log.h"
+ #include "free-space-cache.h"
+ 
+-static struct extent_io_ops btree_extent_io_ops;
++static const struct extent_io_ops btree_extent_io_ops;
+ static void end_workqueue_fn(struct btrfs_work *work);
+ static void free_fs_root(struct btrfs_root *root);
+ 
+@@ -2585,7 +2585,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct extent_io_ops btree_extent_io_ops = {
++static const struct extent_io_ops btree_extent_io_ops = {
+ 	.write_cache_pages_lock_hook = btree_lock_page_hook,
+ 	.readpage_end_io_hook = btree_readpage_end_io_hook,
+ 	.submit_bio_hook = btree_submit_bio_hook,
+diff -urNp linux-2.6.32.13/fs/btrfs/extent_io.h linux-2.6.32.13/fs/btrfs/extent_io.h
+--- linux-2.6.32.13/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/extent_io.h	2010-05-15 13:21:16.911563863 -0400
+@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
+ 				       struct bio *bio, int mirror_num,
+ 				       unsigned long bio_flags);
+ struct extent_io_ops {
+-	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
++	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
+ 			     u64 start, u64 end, int *page_started,
+ 			     unsigned long *nr_written);
+-	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+-	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
+ 	extent_submit_bio_hook_t *submit_bio_hook;
+-	int (*merge_bio_hook)(struct page *page, unsigned long offset,
++	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
+ 			      size_t size, struct bio *bio,
+ 			      unsigned long bio_flags);
+-	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
+-	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
+ 				       u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
+ 					u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				    struct extent_state *state);
+-	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				      struct extent_state *state, int uptodate);
+-	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
++	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
+ 			    unsigned long old, unsigned long bits);
+-	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
++	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
+ 			      unsigned long bits);
+-	int (*merge_extent_hook)(struct inode *inode,
++	int (* const merge_extent_hook)(struct inode *inode,
+ 				 struct extent_state *new,
+ 				 struct extent_state *other);
+-	int (*split_extent_hook)(struct inode *inode,
++	int (* const split_extent_hook)(struct inode *inode,
+ 				 struct extent_state *orig, u64 split);
+-	int (*write_cache_pages_lock_hook)(struct page *page);
++	int (* const write_cache_pages_lock_hook)(struct page *page);
+ };
+ 
+ struct extent_io_tree {
+@@ -88,7 +88,7 @@ struct extent_io_tree {
+ 	u64 dirty_bytes;
+ 	spinlock_t lock;
+ 	spinlock_t buffer_lock;
+-	struct extent_io_ops *ops;
++	const struct extent_io_ops *ops;
+ };
+ 
+ struct extent_state {
+diff -urNp linux-2.6.32.13/fs/btrfs/free-space-cache.c linux-2.6.32.13/fs/btrfs/free-space-cache.c
+--- linux-2.6.32.13/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/free-space-cache.c	2010-05-15 13:21:16.918599051 -0400
+@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
+ 
+ 	while(1) {
+ 		if (entry->bytes < bytes || entry->offset < min_start) {
+-			struct rb_node *node;
+-
+ 			node = rb_next(&entry->offset_index);
+ 			if (!node)
+ 				break;
+@@ -1226,7 +1224,7 @@ again:
+ 	 */
+ 	while (entry->bitmap || found_bitmap ||
+ 	       (!entry->bitmap && entry->bytes < min_bytes)) {
+-		struct rb_node *node = rb_next(&entry->offset_index);
++		node = rb_next(&entry->offset_index);
+ 
+ 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
+ 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+diff -urNp linux-2.6.32.13/fs/btrfs/inode.c linux-2.6.32.13/fs/btrfs/inode.c
+--- linux-2.6.32.13/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/inode.c	2010-05-15 13:21:16.951236359 -0400
+@@ -63,7 +63,7 @@ static const struct inode_operations btr
+ static const struct address_space_operations btrfs_aops;
+ static const struct address_space_operations btrfs_symlink_aops;
+ static const struct file_operations btrfs_dir_file_operations;
+-static struct extent_io_ops btrfs_extent_io_ops;
++static const struct extent_io_ops btrfs_extent_io_ops;
+ 
+ static struct kmem_cache *btrfs_inode_cachep;
+ struct kmem_cache *btrfs_trans_handle_cachep;
+@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
+ 	.fsync		= btrfs_sync_file,
+ };
+ 
+-static struct extent_io_ops btrfs_extent_io_ops = {
++static const struct extent_io_ops btrfs_extent_io_ops = {
+ 	.fill_delalloc = run_delalloc_range,
+ 	.submit_bio_hook = btrfs_submit_bio_hook,
+ 	.merge_bio_hook = btrfs_merge_bio_hook,
+diff -urNp linux-2.6.32.13/fs/btrfs/sysfs.c linux-2.6.32.13/fs/btrfs/sysfs.c
+--- linux-2.6.32.13/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/btrfs/sysfs.c	2010-05-15 13:21:16.956074066 -0400
+@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
+ 	complete(&root->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops btrfs_super_attr_ops = {
++static const struct sysfs_ops btrfs_super_attr_ops = {
+ 	.show	= btrfs_super_attr_show,
+ 	.store	= btrfs_super_attr_store,
+ };
+ 
+-static struct sysfs_ops btrfs_root_attr_ops = {
++static const struct sysfs_ops btrfs_root_attr_ops = {
+ 	.show	= btrfs_root_attr_show,
+ 	.store	= btrfs_root_attr_store,
+ };
+diff -urNp linux-2.6.32.13/fs/buffer.c linux-2.6.32.13/fs/buffer.c
+--- linux-2.6.32.13/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/buffer.c	2010-05-15 13:21:16.978563593 -0400
+@@ -25,6 +25,7 @@
+ #include <linux/percpu.h>
+ #include <linux/slab.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/blkdev.h>
+ #include <linux/file.h>
+ #include <linux/quotaops.h>
+diff -urNp linux-2.6.32.13/fs/cachefiles/bind.c linux-2.6.32.13/fs/cachefiles/bind.c
+--- linux-2.6.32.13/fs/cachefiles/bind.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/cachefiles/bind.c	2010-05-15 13:21:16.978563593 -0400
+@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
+ 	       args);
+ 
+ 	/* start by checking things over */
+-	ASSERT(cache->fstop_percent >= 0 &&
+-	       cache->fstop_percent < cache->fcull_percent &&
++	ASSERT(cache->fstop_percent < cache->fcull_percent &&
+ 	       cache->fcull_percent < cache->frun_percent &&
+ 	       cache->frun_percent  < 100);
+ 
+-	ASSERT(cache->bstop_percent >= 0 &&
+-	       cache->bstop_percent < cache->bcull_percent &&
++	ASSERT(cache->bstop_percent < cache->bcull_percent &&
+ 	       cache->bcull_percent < cache->brun_percent &&
+ 	       cache->brun_percent  < 100);
+ 
+diff -urNp linux-2.6.32.13/fs/cachefiles/daemon.c linux-2.6.32.13/fs/cachefiles/daemon.c
+--- linux-2.6.32.13/fs/cachefiles/daemon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/cachefiles/daemon.c	2010-05-15 13:21:16.995071409 -0400
+@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
+ 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
+ 		return -EIO;
+ 
+-	if (datalen < 0 || datalen > PAGE_SIZE - 1)
++	if (datalen > PAGE_SIZE - 1)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* drag the command string into the kernel so we can parse it */
+@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (fstop < 0 || fstop >= cache->fcull_percent)
++	if (fstop >= cache->fcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->fstop_percent = fstop;
+@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (bstop < 0 || bstop >= cache->bcull_percent)
++	if (bstop >= cache->bcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->bstop_percent = bstop;
+diff -urNp linux-2.6.32.13/fs/cachefiles/rdwr.c linux-2.6.32.13/fs/cachefiles/rdwr.c
+--- linux-2.6.32.13/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/cachefiles/rdwr.c	2010-05-15 13:21:16.995071409 -0400
+@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
+ 			old_fs = get_fs();
+ 			set_fs(KERNEL_DS);
+ 			ret = file->f_op->write(
+-				file, (const void __user *) data, len, &pos);
++				file, (__force const void __user *) data, len, &pos);
+ 			set_fs(old_fs);
+ 			kunmap(page);
+ 			if (ret != len)
+diff -urNp linux-2.6.32.13/fs/cifs/cifs_uniupr.h linux-2.6.32.13/fs/cifs/cifs_uniupr.h
+--- linux-2.6.32.13/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/cifs/cifs_uniupr.h	2010-05-15 13:21:16.995071409 -0400
+@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
+ 	{0x0490, 0x04cc, UniCaseRangeU0490},
+ 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
+ 	{0xff40, 0xff5a, UniCaseRangeUff40},
+-	{0}
++	{0, 0, NULL}
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.13/fs/cifs/link.c linux-2.6.32.13/fs/cifs/link.c
+--- linux-2.6.32.13/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/cifs/link.c	2010-05-15 13:21:16.995071409 -0400
+@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
+ 
+ void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
+ {
+-	char *p = nd_get_link(nd);
++	const char *p = nd_get_link(nd);
+ 	if (!IS_ERR(p))
+ 		kfree(p);
+ }
+diff -urNp linux-2.6.32.13/fs/compat_binfmt_elf.c linux-2.6.32.13/fs/compat_binfmt_elf.c
+--- linux-2.6.32.13/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/compat_binfmt_elf.c	2010-05-15 13:21:16.995071409 -0400
+@@ -29,10 +29,12 @@
+ #undef	elfhdr
+ #undef	elf_phdr
+ #undef	elf_note
++#undef	elf_dyn
+ #undef	elf_addr_t
+ #define elfhdr		elf32_hdr
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
++#define elf_dyn		Elf32_Dyn
+ #define elf_addr_t	Elf32_Addr
+ 
+ /*
+diff -urNp linux-2.6.32.13/fs/compat.c linux-2.6.32.13/fs/compat.c
+--- linux-2.6.32.13/fs/compat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/compat.c	2010-05-15 13:21:17.027084488 -0400
+@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
+ 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
+ 				struct page *page;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+ 				ret = expand_stack_downwards(bprm->vma, pos);
+ 				if (ret < 0) {
+ 					/* We've exceed the stack rlimit. */
+ 					ret = -E2BIG;
+ 					goto out;
+ 				}
+-#endif
+ 				ret = get_user_pages(current, bprm->mm, pos,
+ 						     1, 1, 1, &page, NULL);
+ 				if (ret <= 0) {
+@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
+ 	compat_uptr_t __user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++	retval = -EAGAIN;
++	if (gr_handle_nproc())
++		goto out_file;
++	retval = -EACCES;
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
++		goto out_file;
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, (char __user * __user *)argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	retval = search_binary_handler(bprm, regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	current->stack_start = current->mm->start_stack;
+ 
+@@ -1543,6 +1585,14 @@ int compat_do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput(bprm->mm);
+diff -urNp linux-2.6.32.13/fs/compat_ioctl.c linux-2.6.32.13/fs/compat_ioctl.c
+--- linux-2.6.32.13/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/compat_ioctl.c	2010-05-15 13:21:17.050796208 -0400
+@@ -1827,15 +1827,15 @@ struct ioctl_trans {
+ };
+ 
+ #define HANDLE_IOCTL(cmd,handler) \
+-	{ (cmd), (ioctl_trans_handler_t)(handler) },
++	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
+ 
+ /* pointer to compatible structure or no argument */
+ #define COMPATIBLE_IOCTL(cmd) \
+-	{ (cmd), do_ioctl32_pointer },
++	{ (cmd), do_ioctl32_pointer, NULL },
+ 
+ /* argument is an unsigned long integer, not a pointer */
+ #define ULONG_IOCTL(cmd) \
+-	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
++	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
+ 
+ /* ioctl should not be warned about even if it's not implemented.
+    Valid reasons to use this:
+diff -urNp linux-2.6.32.13/fs/debugfs/inode.c linux-2.6.32.13/fs/debugfs/inode.c
+--- linux-2.6.32.13/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/debugfs/inode.c	2010-05-15 13:21:17.062663383 -0400
+@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	static struct tree_descr debug_files[] = {{""}};
++	static struct tree_descr debug_files[] = {{"", NULL, 0}};
+ 
+ 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
+ }
+diff -urNp linux-2.6.32.13/fs/dlm/lockspace.c linux-2.6.32.13/fs/dlm/lockspace.c
+--- linux-2.6.32.13/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/dlm/lockspace.c	2010-05-15 13:21:17.082686362 -0400
+@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
+ 	kfree(ls);
+ }
+ 
+-static struct sysfs_ops dlm_attr_ops = {
++static const struct sysfs_ops dlm_attr_ops = {
+ 	.show  = dlm_attr_show,
+ 	.store = dlm_attr_store,
+ };
+diff -urNp linux-2.6.32.13/fs/ecryptfs/inode.c linux-2.6.32.13/fs/ecryptfs/inode.c
+--- linux-2.6.32.13/fs/ecryptfs/inode.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.13/fs/ecryptfs/inode.c	2010-05-15 13:21:17.090658956 -0400
+@@ -655,7 +655,7 @@ static int ecryptfs_readlink_lower(struc
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
+-						   (char __user *)lower_buf,
++						   (__force char __user *)lower_buf,
+ 						   lower_bufsiz);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+@@ -701,7 +701,7 @@ static void *ecryptfs_follow_link(struct
+ 	}
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+-	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
++	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+ 		goto out_free;
+diff -urNp linux-2.6.32.13/fs/exec.c linux-2.6.32.13/fs/exec.c
+--- linux-2.6.32.13/fs/exec.c	2010-04-04 20:41:50.037938751 -0400
++++ linux-2.6.32.13/fs/exec.c	2010-05-15 13:21:17.114657511 -0400
+@@ -56,12 +56,24 @@
+ #include <linux/fsnotify.h>
+ #include <linux/fs_struct.h>
+ #include <linux/pipe_fs_i.h>
++#include <linux/random.h>
++#include <linux/seq_file.h>
++
++#ifdef CONFIG_PAX_REFCOUNT
++#include <linux/kallsyms.h>
++#include <linux/kdebug.h>
++#endif
+ 
+ #include <asm/uaccess.h>
+ #include <asm/mmu_context.h>
+ #include <asm/tlb.h>
+ #include "internal.h"
+ 
++#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
++void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++EXPORT_SYMBOL(pax_set_initial_flags_func);
++#endif
++
+ int core_uses_pid;
+ char core_pattern[CORENAME_MAX_SIZE] = "core";
+ unsigned int core_pipe_limit;
+@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
+ 		goto out;
+ 
+ 	file = do_filp_open(AT_FDCWD, tmp,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_READ | MAY_EXEC | MAY_OPEN);
+ 	putname(tmp);
+ 	error = PTR_ERR(file);
+@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
+ 		int write)
+ {
+ 	struct page *page;
+-	int ret;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+-	if (write) {
+-		ret = expand_stack_downwards(bprm->vma, pos);
+-		if (ret < 0)
+-			return NULL;
+-	}
+-#endif
+-	ret = get_user_pages(current, bprm->mm, pos,
+-			1, write, 1, &page, NULL);
+-	if (ret <= 0)
++	if (0 > expand_stack_downwards(bprm->vma, pos))
++		return NULL;
++	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
+ 		return NULL;
+ 
+ 	if (write) {
+@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
+ 	vma->vm_end = STACK_TOP_MAX;
+ 	vma->vm_start = vma->vm_end - PAGE_SIZE;
+ 	vma->vm_flags = VM_STACK_FLAGS;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 	err = insert_vm_struct(mm, vma);
+ 	if (err)
+@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
+ 	mm->stack_vm = mm->total_vm = 1;
+ 	up_write(&mm->mmap_sem);
+ 	bprm->p = vma->vm_end - sizeof(void *);
++
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
++#endif
++
+ 	return 0;
+ err:
+ 	up_write(&mm->mmap_sem);
+@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
+ 	int r;
+ 	mm_segment_t oldfs = get_fs();
+ 	set_fs(KERNEL_DS);
+-	r = copy_strings(argc, (char __user * __user *)argv, bprm);
++	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
+ 	set_fs(oldfs);
+ 	return r;
+ }
+@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
+ 	unsigned long new_end = old_end - shift;
+ 	struct mmu_gather *tlb;
+ 
+-	BUG_ON(new_start > new_end);
++	if (new_start >= new_end || new_start < mmap_min_addr)
++		return -EFAULT;
+ 
+ 	/*
+ 	 * ensure there are no vmas between where we want to go
+@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
+ 	if (vma != find_vma(mm, new_start))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	BUG_ON(pax_find_mirror_vma(vma));
++#endif
++
+ 	/*
+ 	 * cover the whole range: [new_start, old_end)
+ 	 */
+@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
+ 	bprm->exec -= stack_shift;
+ 
+ 	down_write(&mm->mmap_sem);
++
++	/* Move stack pages down in memory. */
++	if (stack_shift) {
++		ret = shift_arg_pages(vma, stack_shift);
++		if (ret)
++			goto out_unlock;
++	}
++
+ 	vm_flags = VM_STACK_FLAGS;
+ 
+ 	/*
+@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
+ 		vm_flags &= ~VM_EXEC;
+ 	vm_flags |= mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			vm_flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
+ 			vm_flags);
+ 	if (ret)
+ 		goto out_unlock;
+ 	BUG_ON(prev != vma);
+ 
+-	/* Move stack pages down in memory. */
+-	if (stack_shift) {
+-		ret = shift_arg_pages(vma, stack_shift);
+-		if (ret)
+-			goto out_unlock;
+-	}
+-
+ 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+ 	stack_size = vma->vm_end - vma->vm_start;
+ 	/*
+@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
+ 	int err;
+ 
+ 	file = do_filp_open(AT_FDCWD, name,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_EXEC | MAY_OPEN);
+ 	if (IS_ERR(file))
+ 		goto out;
+@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	result = vfs_read(file, (void __user *)addr, count, &pos);
++	result = vfs_read(file, (__force void __user *)addr, count, &pos);
+ 	set_fs(old_fs);
+ 	return result;
+ }
+@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
+ 	}
+ 	rcu_read_unlock();
+ 
+-	if (p->fs->users > n_fs) {
++	if (atomic_read(&p->fs->users) > n_fs) {
+ 		bprm->unsafe |= LSM_UNSAFE_SHARE;
+ 	} else {
+ 		res = -EAGAIN;
+@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
+ 	char __user *__user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++
++	if (gr_handle_nproc()) {
++		retval = -EAGAIN;
++		goto out_file;
++	}
++
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
++		retval = -EACCES;
++		goto out_file;
++	}
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	current->flags &= ~PF_KTHREAD;
+ 	retval = search_binary_handler(bprm,regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	current->stack_start = current->mm->start_stack;
+ 
+@@ -1390,6 +1471,14 @@ int do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput (bprm->mm);
+@@ -1553,6 +1642,169 @@ out:
+ 	return ispipe;
+ }
+ 
++int pax_check_flags(unsigned long *flags)
++{
++	int retval = 0;
++
++#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
++	if (*flags & MF_PAX_SEGMEXEC)
++	{
++		*flags &= ~MF_PAX_SEGMEXEC;
++		retval = -EINVAL;
++	}
++#endif
++
++	if ((*flags & MF_PAX_PAGEEXEC)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	    &&  (*flags & MF_PAX_SEGMEXEC)
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_PAGEEXEC;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_MPROTECT)
++
++#ifdef CONFIG_PAX_MPROTECT
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_MPROTECT;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_EMUTRAMP)
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_EMUTRAMP;
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++EXPORT_SYMBOL(pax_check_flags);
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
++{
++	struct task_struct *tsk = current;
++	struct mm_struct *mm = current->mm;
++	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
++	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
++	char *path_exec = NULL;
++	char *path_fault = NULL;
++	unsigned long start = 0UL, end = 0UL, offset = 0UL;
++
++	if (buffer_exec && buffer_fault) {
++		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
++
++		down_read(&mm->mmap_sem);
++		vma = mm->mmap;
++		while (vma && (!vma_exec || !vma_fault)) {
++			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
++				vma_exec = vma;
++			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
++				vma_fault = vma;
++			vma = vma->vm_next;
++		}
++		if (vma_exec) {
++			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
++			if (IS_ERR(path_exec))
++				path_exec = "<path too long>";
++			else {
++				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
++				if (path_exec) {
++					*path_exec = 0;
++					path_exec = buffer_exec;
++				} else
++					path_exec = "<path too long>";
++			}
++		}
++		if (vma_fault) {
++			start = vma_fault->vm_start;
++			end = vma_fault->vm_end;
++			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
++			if (vma_fault->vm_file) {
++				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
++				if (IS_ERR(path_fault))
++					path_fault = "<path too long>";
++				else {
++					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
++					if (path_fault) {
++						*path_fault = 0;
++						path_fault = buffer_fault;
++					} else
++						path_fault = "<path too long>";
++				}
++			} else
++				path_fault = "<anonymous mapping>";
++		}
++		up_read(&mm->mmap_sem);
++	}
++	if (tsk->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
++	else
++		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
++	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
++			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
++			task_uid(tsk), task_euid(tsk), pc, sp);
++	free_page((unsigned long)buffer_exec);
++	free_page((unsigned long)buffer_fault);
++	pax_report_insns(pc, sp);
++	do_coredump(SIGKILL, SIGKILL, regs);
++}
++#endif
++
++#ifdef CONFIG_PAX_REFCOUNT
++void pax_report_refcount_overflow(struct pt_regs *regs)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++	else
++		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
++	show_regs(regs);
++	force_sig_specific(SIGKILL, current);
++}
++#endif
++
++#ifdef CONFIG_PAX_USERCOPY
++void pax_report_leak_to_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++
++void pax_report_overflow_from_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++#endif
++
+ static int zap_process(struct task_struct *start)
+ {
+ 	struct task_struct *t;
+@@ -1755,17 +2007,17 @@ static void wait_for_dump_helpers(struct
+ 	pipe = file->f_path.dentry->d_inode->i_pipe;
+ 
+ 	pipe_lock(pipe);
+-	pipe->readers++;
+-	pipe->writers--;
++	atomic_inc(&pipe->readers);
++	atomic_dec(&pipe->writers);
+ 
+-	while ((pipe->readers > 1) && (!signal_pending(current))) {
++	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
+ 		wake_up_interruptible_sync(&pipe->wait);
+ 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 		pipe_wait(pipe);
+ 	}
+ 
+-	pipe->readers--;
+-	pipe->writers++;
++	atomic_dec(&pipe->readers);
++	atomic_inc(&pipe->writers);
+ 	pipe_unlock(pipe);
+ 
+ }
+@@ -1836,6 +2088,10 @@ void do_coredump(long signr, int exit_co
+ 	 */
+ 	clear_thread_flag(TIF_SIGPENDING);
+ 
++	if (signr == SIGKILL || signr == SIGILL)
++		gr_handle_brute_attach(current);
++	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
++
+ 	/*
+ 	 * lock_kernel() because format_corename() is controlled by sysctl, which
+ 	 * uses lock_kernel()
+diff -urNp linux-2.6.32.13/fs/ext2/balloc.c linux-2.6.32.13/fs/ext2/balloc.c
+--- linux-2.6.32.13/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext2/balloc.c	2010-05-15 13:21:17.118672646 -0400
+@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.13/fs/ext2/xattr.c linux-2.6.32.13/fs/ext2/xattr.c
+--- linux-2.6.32.13/fs/ext2/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext2/xattr.c	2010-05-15 13:21:17.122783817 -0400
+@@ -85,8 +85,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static int ext2_xattr_set2(struct inode *, struct buffer_head *,
+diff -urNp linux-2.6.32.13/fs/ext3/balloc.c linux-2.6.32.13/fs/ext3/balloc.c
+--- linux-2.6.32.13/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext3/balloc.c	2010-05-15 13:21:17.135016428 -0400
+@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.13/fs/ext3/namei.c linux-2.6.32.13/fs/ext3/namei.c
+--- linux-2.6.32.13/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext3/namei.c	2010-05-15 13:21:17.155157464 -0400
+@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext3_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext3_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.13/fs/ext3/xattr.c linux-2.6.32.13/fs/ext3/xattr.c
+--- linux-2.6.32.13/fs/ext3/xattr.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.13/fs/ext3/xattr.c	2010-05-15 13:21:17.158583972 -0400
+@@ -89,8 +89,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(f...) do {} while (0)
++# define ea_bdebug(f...) do {} while (0)
+ #endif
+ 
+ static void ext3_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.13/fs/ext4/balloc.c linux-2.6.32.13/fs/ext4/balloc.c
+--- linux-2.6.32.13/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext4/balloc.c	2010-05-15 13:21:17.158583972 -0400
+@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
+ 	/* Hm, nope.  Are (enough) root reserved blocks available? */
+ 	if (sbi->s_resuid == current_fsuid() ||
+ 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
+-	    capable(CAP_SYS_RESOURCE)) {
++	    capable_nolog(CAP_SYS_RESOURCE)) {
+ 		if (free_blocks >= (nblocks + dirty_blocks))
+ 			return 1;
+ 	}
+diff -urNp linux-2.6.32.13/fs/ext4/ioctl.c linux-2.6.32.13/fs/ext4/ioctl.c
+--- linux-2.6.32.13/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext4/ioctl.c	2010-05-15 13:21:17.158583972 -0400
+@@ -221,6 +221,9 @@ setversion_out:
+ 		struct file *donor_filp;
+ 		int err;
+ 
++		/* temporary workaround for bugs in here */
++		return -EOPNOTSUPP;
++
+ 		if (!(filp->f_mode & FMODE_READ) ||
+ 		    !(filp->f_mode & FMODE_WRITE))
+ 			return -EBADF;
+diff -urNp linux-2.6.32.13/fs/ext4/namei.c linux-2.6.32.13/fs/ext4/namei.c
+--- linux-2.6.32.13/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext4/namei.c	2010-05-15 13:21:17.183216444 -0400
+@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext4_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext4_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.13/fs/ext4/super.c linux-2.6.32.13/fs/ext4/super.c
+--- linux-2.6.32.13/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext4/super.c	2010-05-15 13:21:17.215811745 -0400
+@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
+ }
+ 
+ 
+-static struct sysfs_ops ext4_attr_ops = {
++static const struct sysfs_ops ext4_attr_ops = {
+ 	.show	= ext4_attr_show,
+ 	.store	= ext4_attr_store,
+ };
+diff -urNp linux-2.6.32.13/fs/ext4/xattr.c linux-2.6.32.13/fs/ext4/xattr.c
+--- linux-2.6.32.13/fs/ext4/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ext4/xattr.c	2010-05-15 13:21:17.227060881 -0400
+@@ -82,8 +82,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static void ext4_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.13/fs/fcntl.c linux-2.6.32.13/fs/fcntl.c
+--- linux-2.6.32.13/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fcntl.c	2010-05-15 13:21:17.227060881 -0400
+@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
+ 	switch (cmd) {
+ 	case F_DUPFD:
+ 	case F_DUPFD_CLOEXEC:
++		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
+ 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 			break;
+ 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
+@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
+ 	ret = ((fown->euid == 0 ||
+ 		fown->euid == cred->suid || fown->euid == cred->uid ||
+ 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
+-	       !security_file_send_sigiotask(p, fown, sig));
++	       !security_file_send_sigiotask(p, fown, sig) &&
++	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
+ 	rcu_read_unlock();
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.13/fs/fifo.c linux-2.6.32.13/fs/fifo.c
+--- linux-2.6.32.13/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fifo.c	2010-05-15 13:21:17.252844788 -0400
+@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &read_pipefifo_fops;
+ 		pipe->r_counter++;
+-		if (pipe->readers++ == 0)
++		if (atomic_inc_return(&pipe->readers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->writers) {
++		if (!atomic_read(&pipe->writers)) {
+ 			if ((filp->f_flags & O_NONBLOCK)) {
+ 				/* suppress POLLHUP until we have
+ 				 * seen a writer */
+@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
+ 	 *  errno=ENXIO when there is no process reading the FIFO.
+ 	 */
+ 		ret = -ENXIO;
+-		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
++		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
+ 			goto err;
+ 
+ 		filp->f_op = &write_pipefifo_fops;
+ 		pipe->w_counter++;
+-		if (!pipe->writers++)
++		if (atomic_inc_return(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			wait_for_partner(inode, &pipe->r_counter);
+ 			if (signal_pending(current))
+ 				goto err_wr;
+@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &rdwr_pipefifo_fops;
+ 
+-		pipe->readers++;
+-		pipe->writers++;
++		atomic_inc(&pipe->readers);
++		atomic_inc(&pipe->writers);
+ 		pipe->r_counter++;
+ 		pipe->w_counter++;
+-		if (pipe->readers == 1 || pipe->writers == 1)
++		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 		break;
+ 
+@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
+ 	return 0;
+ 
+ err_rd:
+-	if (!--pipe->readers)
++	if (atomic_dec_and_test(&pipe->readers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err_wr:
+-	if (!--pipe->writers)
++	if (atomic_dec_and_test(&pipe->writers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err:
+-	if (!pipe->readers && !pipe->writers)
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
+ 		free_pipe_info(inode);
+ 
+ err_nocleanup:
+diff -urNp linux-2.6.32.13/fs/file.c linux-2.6.32.13/fs/file.c
+--- linux-2.6.32.13/fs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/file.c	2010-05-15 13:21:17.256078508 -0400
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/fdtable.h>
+ #include <linux/bitops.h>
+ #include <linux/interrupt.h>
+@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
+ 	 * N.B. For clone tasks sharing a files structure, this test
+ 	 * will limit the total number of files that can be opened.
+ 	 */
++
++	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
+ 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EMFILE;
+ 
+diff -urNp linux-2.6.32.13/fs/fs_struct.c linux-2.6.32.13/fs/fs_struct.c
+--- linux-2.6.32.13/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fs_struct.c	2010-05-15 13:21:17.256078508 -0400
+@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
+ 	struct task_struct *g, *p;
+ 	struct fs_struct *fs;
+ 	int count = 0;
++	unsigned long flags;
+ 
+ 	read_lock(&tasklist_lock);
+ 	do_each_thread(g, p) {
+ 		task_lock(p);
++		gr_fs_write_lock_irqsave(p, flags);
+ 		fs = p->fs;
+ 		if (fs) {
+ 			write_lock(&fs->lock);
+@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
+ 			}
+ 			write_unlock(&fs->lock);
+ 		}
++		gr_fs_write_unlock_irqrestore(p, flags);
+ 		task_unlock(p);
+ 	} while_each_thread(g, p);
+ 	read_unlock(&tasklist_lock);
+@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
+ void exit_fs(struct task_struct *tsk)
+ {
+ 	struct fs_struct *fs = tsk->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+ 		task_lock(tsk);
++		gr_fs_write_lock_irqsave(tsk, flags);
+ 		write_lock(&fs->lock);
+ 		tsk->fs = NULL;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(tsk, flags);
+ 		task_unlock(tsk);
+ 		if (kill)
+ 			free_fs_struct(fs);
+@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
+ 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
+ 	/* We don't need to lock fs - think why ;-) */
+ 	if (fs) {
+-		fs->users = 1;
++		atomic_set(&fs->users, 1);
+ 		fs->in_exec = 0;
+ 		rwlock_init(&fs->lock);
+ 		fs->umask = old->umask;
+@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
+ 	struct fs_struct *fs = current->fs;
+ 	struct fs_struct *new_fs = copy_fs_struct(fs);
+ 	int kill;
++	unsigned long flags;
+ 
+ 	if (!new_fs)
+ 		return -ENOMEM;
+ 
+ 	task_lock(current);
++	gr_fs_write_lock_irqsave(current, flags);
+ 	write_lock(&fs->lock);
+-	kill = !--fs->users;
++	kill = !atomic_dec_return(&fs->users);
+ 	current->fs = new_fs;
+ 	write_unlock(&fs->lock);
++	gr_fs_write_unlock_irqrestore(current, flags);
+ 	task_unlock(current);
+ 
+ 	if (kill)
+@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
+ 
+ /* to be mentioned only in INIT_TASK */
+ struct fs_struct init_fs = {
+-	.users		= 1,
++	.users		= ATOMIC_INIT(1),
+ 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
+ 	.umask		= 0022,
+ };
+@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
+ void daemonize_fs_struct(void)
+ {
+ 	struct fs_struct *fs = current->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
+ 		task_lock(current);
+ 
+ 		write_lock(&init_fs.lock);
+-		init_fs.users++;
++		atomic_inc(&init_fs.users);
+ 		write_unlock(&init_fs.lock);
+ 
++		gr_fs_write_lock_irqsave(current, flags);
+ 		write_lock(&fs->lock);
+ 		current->fs = &init_fs;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(current, flags);
+ 
+ 		task_unlock(current);
+ 		if (kill)
+diff -urNp linux-2.6.32.13/fs/fuse/control.c linux-2.6.32.13/fs/fuse/control.c
+--- linux-2.6.32.13/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fuse/control.c	2010-05-15 13:21:17.271074520 -0400
+@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
+ 
+ static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	struct tree_descr empty_descr = {""};
++	struct tree_descr empty_descr = {"", NULL, 0};
+ 	struct fuse_conn *fc;
+ 	int err;
+ 
+diff -urNp linux-2.6.32.13/fs/fuse/cuse.c linux-2.6.32.13/fs/fuse/cuse.c
+--- linux-2.6.32.13/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fuse/cuse.c	2010-05-15 13:21:17.289230785 -0400
+@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
+ 	return rc;
+ }
+ 
+-static struct file_operations cuse_channel_fops; /* initialized during init */
+-
++static const struct file_operations cuse_channel_fops = { /* initialized during init */
++	.owner		= THIS_MODULE,
++	.llseek		= no_llseek,
++	.read		= do_sync_read,
++	.aio_read	= fuse_dev_read,
++	.write		= do_sync_write,
++	.aio_write	= fuse_dev_write,
++	.poll		= fuse_dev_poll,
++	.open		= cuse_channel_open,
++	.release	= cuse_channel_release,
++	.fasync		= fuse_dev_fasync,
++};
+ 
+ /**************************************************************************
+  * Misc stuff and module initializatiion
+@@ -575,12 +585,6 @@ static int __init cuse_init(void)
+ 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
+ 		INIT_LIST_HEAD(&cuse_conntbl[i]);
+ 
+-	/* inherit and extend fuse_dev_operations */
+-	cuse_channel_fops		= fuse_dev_operations;
+-	cuse_channel_fops.owner		= THIS_MODULE;
+-	cuse_channel_fops.open		= cuse_channel_open;
+-	cuse_channel_fops.release	= cuse_channel_release;
+-
+ 	cuse_class = class_create(THIS_MODULE, "cuse");
+ 	if (IS_ERR(cuse_class))
+ 		return PTR_ERR(cuse_class);
+diff -urNp linux-2.6.32.13/fs/fuse/dev.c linux-2.6.32.13/fs/fuse/dev.c
+--- linux-2.6.32.13/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fuse/dev.c	2010-05-15 13:21:17.290606220 -0400
+@@ -745,7 +745,7 @@ __releases(&fc->lock)
+  * request_end().  Otherwise add it to the processing list, and set
+  * the 'sent' flag.
+  */
+-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+ 			      unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
+ 	spin_unlock(&fc->lock);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_read);
+ 
+ static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
+ 			    struct fuse_copy_state *cs)
+@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
+ {
+ 	struct fuse_notify_inval_entry_out outarg;
+ 	int err = -EINVAL;
+-	char buf[FUSE_NAME_MAX+1];
++	char *buf = NULL;
+ 	struct qstr name;
+ 
+ 	if (size < sizeof(outarg))
+@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
+ 	if (outarg.namelen > FUSE_NAME_MAX)
+ 		goto err;
+ 
++	err = -ENOMEM;
++	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
++	if (!buf)
++		goto err;
++
+ 	name.name = buf;
+ 	name.len = outarg.namelen;
+ 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
+@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
+ 
+ 	down_read(&fc->killsb);
+ 	err = -ENOENT;
+-	if (!fc->sb)
+-		goto err_unlock;
+-
+-	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+-
+-err_unlock:
++	if (fc->sb)
++		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+ 	up_read(&fc->killsb);
++	kfree(buf);
+ 	return err;
+ 
+ err:
+ 	fuse_copy_finish(cs);
++	kfree(buf);
+ 	return err;
+ }
+ 
+@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
+  * it from the list and copy the rest of the buffer to the request.
+  * The request is finished by calling request_end()
+  */
+-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
+ 			       unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
+ 	fuse_copy_finish(&cs);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_write);
+ 
+-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
++unsigned fuse_dev_poll(struct file *file, poll_table *wait)
+ {
+ 	unsigned mask = POLLOUT | POLLWRNORM;
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
+ 
+ 	return mask;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_poll);
+ 
+ /*
+  * Abort all requests on the given list (pending or processing)
+@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
+ }
+ EXPORT_SYMBOL_GPL(fuse_dev_release);
+ 
+-static int fuse_dev_fasync(int fd, struct file *file, int on)
++int fuse_dev_fasync(int fd, struct file *file, int on)
+ {
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+ 	if (!fc)
+@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
+ 	/* No locking - fasync_helper does its own locking */
+ 	return fasync_helper(fd, file, on, &fc->fasync);
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_fasync);
+ 
+ const struct file_operations fuse_dev_operations = {
+ 	.owner		= THIS_MODULE,
+diff -urNp linux-2.6.32.13/fs/fuse/dir.c linux-2.6.32.13/fs/fuse/dir.c
+--- linux-2.6.32.13/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fuse/dir.c	2010-05-15 13:21:17.295063654 -0400
+@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
+ 	return link;
+ }
+ 
+-static void free_link(char *link)
++static void free_link(const char *link)
+ {
+ 	if (!IS_ERR(link))
+ 		free_page((unsigned long) link);
+diff -urNp linux-2.6.32.13/fs/fuse/fuse_i.h linux-2.6.32.13/fs/fuse/fuse_i.h
+--- linux-2.6.32.13/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/fuse/fuse_i.h	2010-05-15 13:21:17.298596794 -0400
+@@ -521,6 +521,16 @@ extern const struct file_operations fuse
+ 
+ extern const struct dentry_operations fuse_dentry_operations;
+ 
++extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++			      unsigned long nr_segs, loff_t pos);
++
++extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++			       unsigned long nr_segs, loff_t pos);
++
++extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
++
++extern int fuse_dev_fasync(int fd, struct file *file, int on);
++
+ /**
+  * Inode to nodeid comparison.
+  */
+diff -urNp linux-2.6.32.13/fs/gfs2/sys.c linux-2.6.32.13/fs/gfs2/sys.c
+--- linux-2.6.32.13/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/gfs2/sys.c	2010-05-15 13:21:17.323073000 -0400
+@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
+ 	return a->store ? a->store(sdp, buf, len) : len;
+ }
+ 
+-static struct sysfs_ops gfs2_attr_ops = {
++static const struct sysfs_ops gfs2_attr_ops = {
+ 	.show  = gfs2_attr_show,
+ 	.store = gfs2_attr_store,
+ };
+@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops gfs2_uevent_ops = {
++static const struct kset_uevent_ops gfs2_uevent_ops = {
+ 	.uevent = gfs2_uevent,
+ };
+ 
+diff -urNp linux-2.6.32.13/fs/hfs/inode.c linux-2.6.32.13/fs/hfs/inode.c
+--- linux-2.6.32.13/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/hfs/inode.c	2010-05-15 13:21:17.331804288 -0400
+@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
+ 
+ 	if (S_ISDIR(main_inode->i_mode)) {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_dir));
+ 		if (rec.type != HFS_CDR_DIR ||
+@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
+ 				sizeof(struct hfs_cat_file));
+ 	} else {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_file));
+ 		if (rec.type != HFS_CDR_FIL ||
+diff -urNp linux-2.6.32.13/fs/hfsplus/inode.c linux-2.6.32.13/fs/hfsplus/inode.c
+--- linux-2.6.32.13/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/hfsplus/inode.c	2010-05-15 13:21:17.338586981 -0400
+@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		hfsplus_get_perms(inode, &folder->permissions, 1);
+@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 
+@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		/* simple node checks? */
+@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 		hfsplus_inode_write_fork(inode, &file->data_fork);
+diff -urNp linux-2.6.32.13/fs/hugetlbfs/inode.c linux-2.6.32.13/fs/hugetlbfs/inode.c
+--- linux-2.6.32.13/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/hugetlbfs/inode.c	2010-05-15 13:21:17.367723130 -0400
+@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
+ 	.kill_sb	= kill_litter_super,
+ };
+ 
+-static struct vfsmount *hugetlbfs_vfsmount;
++struct vfsmount *hugetlbfs_vfsmount;
+ 
+ static int can_do_hugetlb_shm(void)
+ {
+diff -urNp linux-2.6.32.13/fs/ioctl.c linux-2.6.32.13/fs/ioctl.c
+--- linux-2.6.32.13/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ioctl.c	2010-05-15 13:21:17.367723130 -0400
+@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
+ 			    u64 phys, u64 len, u32 flags)
+ {
+ 	struct fiemap_extent extent;
+-	struct fiemap_extent *dest = fieinfo->fi_extents_start;
++	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+ 
+ 	/* only count the extents */
+ 	if (fieinfo->fi_extents_max == 0) {
+@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
+ 
+ 	fieinfo.fi_flags = fiemap.fm_flags;
+ 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
+-	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
++	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
+ 
+ 	if (fiemap.fm_extent_count != 0 &&
+ 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
+@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
+ 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
+ 	fiemap.fm_flags = fieinfo.fi_flags;
+ 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
+-	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
++	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
+ 		error = -EFAULT;
+ 
+ 	return error;
+diff -urNp linux-2.6.32.13/fs/jffs2/debug.h linux-2.6.32.13/fs/jffs2/debug.h
+--- linux-2.6.32.13/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/jffs2/debug.h	2010-05-15 13:21:17.378571837 -0400
+@@ -52,13 +52,13 @@
+ #if CONFIG_JFFS2_FS_DEBUG > 0
+ #define D1(x) x
+ #else
+-#define D1(x)
++#define D1(x) do {} while (0);
+ #endif
+ 
+ #if CONFIG_JFFS2_FS_DEBUG > 1
+ #define D2(x) x
+ #else
+-#define D2(x)
++#define D2(x) do {} while (0);
+ #endif
+ 
+ /* The prefixes of JFFS2 messages */
+@@ -114,73 +114,73 @@
+ #ifdef JFFS2_DBG_READINODE_MESSAGES
+ #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode(fmt, ...)
++#define dbg_readinode(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_READINODE2_MESSAGES
+ #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode2(fmt, ...)
++#define dbg_readinode2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Fragtree build debugging messages */
+ #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
+ #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree(fmt, ...)
++#define dbg_fragtree(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
+ #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree2(fmt, ...)
++#define dbg_fragtree2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Directory entry list manilulation debugging messages */
+ #ifdef JFFS2_DBG_DENTLIST_MESSAGES
+ #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_dentlist(fmt, ...)
++#define dbg_dentlist(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Print the messages about manipulating node_refs */
+ #ifdef JFFS2_DBG_NODEREF_MESSAGES
+ #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_noderef(fmt, ...)
++#define dbg_noderef(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Manipulations with the list of inodes (JFFS2 inocache) */
+ #ifdef JFFS2_DBG_INOCACHE_MESSAGES
+ #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_inocache(fmt, ...)
++#define dbg_inocache(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Summary debugging messages */
+ #ifdef JFFS2_DBG_SUMMARY_MESSAGES
+ #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_summary(fmt, ...)
++#define dbg_summary(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* File system build messages */
+ #ifdef JFFS2_DBG_FSBUILD_MESSAGES
+ #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fsbuild(fmt, ...)
++#define dbg_fsbuild(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the object allocations */
+ #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
+ #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_memalloc(fmt, ...)
++#define dbg_memalloc(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the XATTR subsystem */
+ #ifdef JFFS2_DBG_XATTR_MESSAGES
+ #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_xattr(fmt, ...)
++#define dbg_xattr(fmt, ...)	do {} while (0)
+ #endif 
+ 
+ /* "Sanity" checks */
+diff -urNp linux-2.6.32.13/fs/jffs2/erase.c linux-2.6.32.13/fs/jffs2/erase.c
+--- linux-2.6.32.13/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/jffs2/erase.c	2010-05-15 13:21:17.386577527 -0400
+@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
+ 		struct jffs2_unknown_node marker = {
+ 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-			.totlen =	cpu_to_je32(c->cleanmarker_size)
++			.totlen =	cpu_to_je32(c->cleanmarker_size),
++			.hdr_crc =	cpu_to_je32(0)
+ 		};
+ 
+ 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
+diff -urNp linux-2.6.32.13/fs/jffs2/summary.h linux-2.6.32.13/fs/jffs2/summary.h
+--- linux-2.6.32.13/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/jffs2/summary.h	2010-05-15 13:21:17.386577527 -0400
+@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
+ 
+ #define jffs2_sum_active() (0)
+ #define jffs2_sum_init(a) (0)
+-#define jffs2_sum_exit(a)
+-#define jffs2_sum_disable_collecting(a)
++#define jffs2_sum_exit(a) do {} while (0)
++#define jffs2_sum_disable_collecting(a) do {} while (0)
+ #define jffs2_sum_is_disabled(a) (0)
+-#define jffs2_sum_reset_collected(a)
++#define jffs2_sum_reset_collected(a) do {} while (0)
+ #define jffs2_sum_add_kvec(a,b,c,d) (0)
+-#define jffs2_sum_move_collected(a,b)
++#define jffs2_sum_move_collected(a,b) do {} while (0)
+ #define jffs2_sum_write_sumnode(a) (0)
+-#define jffs2_sum_add_padding_mem(a,b)
+-#define jffs2_sum_add_inode_mem(a,b,c)
+-#define jffs2_sum_add_dirent_mem(a,b,c)
+-#define jffs2_sum_add_xattr_mem(a,b,c)
+-#define jffs2_sum_add_xref_mem(a,b,c)
++#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
++#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
+ #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
+ 
+ #endif /* CONFIG_JFFS2_SUMMARY */
+diff -urNp linux-2.6.32.13/fs/jffs2/wbuf.c linux-2.6.32.13/fs/jffs2/wbuf.c
+--- linux-2.6.32.13/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/jffs2/wbuf.c	2010-05-15 13:21:17.386577527 -0400
+@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
+ {
+ 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-	.totlen = constant_cpu_to_je32(8)
++	.totlen = constant_cpu_to_je32(8),
++	.hdr_crc = constant_cpu_to_je32(0)
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.13/fs/lockd/svc.c linux-2.6.32.13/fs/lockd/svc.c
+--- linux-2.6.32.13/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/lockd/svc.c	2010-05-15 13:21:17.394616660 -0400
+@@ -43,7 +43,7 @@
+ 
+ static struct svc_program	nlmsvc_program;
+ 
+-struct nlmsvc_binding *		nlmsvc_ops;
++const struct nlmsvc_binding *	nlmsvc_ops;
+ EXPORT_SYMBOL_GPL(nlmsvc_ops);
+ 
+ static DEFINE_MUTEX(nlmsvc_mutex);
+diff -urNp linux-2.6.32.13/fs/locks.c linux-2.6.32.13/fs/locks.c
+--- linux-2.6.32.13/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/locks.c	2010-05-15 13:21:17.398591192 -0400
+@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
+ 		return;
+ 
+ 	if (filp->f_op && filp->f_op->flock) {
+-		struct file_lock fl = {
++		struct file_lock flock = {
+ 			.fl_pid = current->tgid,
+ 			.fl_file = filp,
+ 			.fl_flags = FL_FLOCK,
+ 			.fl_type = F_UNLCK,
+ 			.fl_end = OFFSET_MAX,
+ 		};
+-		filp->f_op->flock(filp, F_SETLKW, &fl);
+-		if (fl.fl_ops && fl.fl_ops->fl_release_private)
+-			fl.fl_ops->fl_release_private(&fl);
++		filp->f_op->flock(filp, F_SETLKW, &flock);
++		if (flock.fl_ops && flock.fl_ops->fl_release_private)
++			flock.fl_ops->fl_release_private(&flock);
+ 	}
+ 
+ 	lock_kernel();
+diff -urNp linux-2.6.32.13/fs/namei.c linux-2.6.32.13/fs/namei.c
+--- linux-2.6.32.13/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/namei.c	2010-05-15 13:21:17.402570795 -0400
+@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
+ 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+ 	error = PTR_ERR(cookie);
+ 	if (!IS_ERR(cookie)) {
+-		char *s = nd_get_link(nd);
++		const char *s = nd_get_link(nd);
+ 		error = 0;
+ 		if (s)
+ 			error = __vfs_follow_link(nd, s);
+@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
+ 	err = security_inode_follow_link(path->dentry, nd);
+ 	if (err)
+ 		goto loop;
++
++	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
++				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
++		err = -EACCES;
++		goto loop;
++	}
++
+ 	current->link_count++;
+ 	current->total_link_count++;
+ 	nd->depth++;
+@@ -1016,11 +1023,18 @@ return_reval:
+ 				break;
+ 		}
+ return_base:
++		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
++			path_put(&nd->path);
++			return -ENOENT;
++		}
+ 		return 0;
+ out_dput:
+ 		path_put_conditional(&next, nd);
+ 		break;
+ 	}
++	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
++		err = -ENOENT;
++
+ 	path_put(&nd->path);
+ return_err:
+ 	return err;
+@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
+ 	int error;
+ 	struct dentry *dir = nd->path.dentry;
+ 
++	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
++		error = -EACCES;
++		goto out_unlock;
++	}
++
+ 	if (!IS_POSIXACL(dir->d_inode))
+ 		mode &= ~current_umask();
+ 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
+ 	if (error)
+ 		goto out_unlock;
+ 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
++	if (!error)
++		gr_handle_create(path->dentry, nd->path.mnt);
+ out_unlock:
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	dput(nd->path.dentry);
+@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
+ 					 &nd, flag);
+ 		if (error)
+ 			return ERR_PTR(error);
++
++		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
++			error = -EACCES;
++			goto exit;
++		}
++
+ 		goto ok;
+ 	}
+ 
+@@ -1795,6 +1832,24 @@ do_last:
+ 	/*
+ 	 * It already exists.
+ 	 */
++
++	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_rawio(path.dentry->d_inode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	audit_inode(pathname, path.dentry);
+ 
+@@ -1887,6 +1942,13 @@ do_link:
+ 	error = security_inode_follow_link(path.dentry, &nd);
+ 	if (error)
+ 		goto exit_dput;
++
++	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
++				  path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto exit_dput;
++	}
++
+ 	error = __do_follow_link(&path, &nd);
+ 	if (error) {
+ 		/* Does someone understand code flow here? Or it is only
+@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	error = may_mknod(mode);
+ 	if (error)
+ 		goto out_dput;
++
++	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
++		error = -EPERM;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	}
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
+ 		mode &= ~current_umask();
+ 	error = mnt_want_write(nd.path.mnt);
+@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
++
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
+ 	char * name;
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
+ 	error = PTR_ERR(dentry);
+ 	if (IS_ERR(dentry))
+ 		goto exit2;
++
++	if (dentry->d_inode != NULL) {
++		if (dentry->d_inode->i_nlink <= 1) {
++			saved_ino = dentry->d_inode->i_ino;
++			saved_dev = dentry->d_inode->i_sb->s_dev;
++		}
++
++		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
++			error = -EACCES;
++			goto exit3;
++		}
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto exit3;
+@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
+ 	if (error)
+ 		goto exit4;
+ 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
++	if (!error && (saved_dev || saved_ino))
++		gr_handle_delete(saved_ino, saved_dev);
+ exit4:
+ 	mnt_drop_write(nd.path.mnt);
+ exit3:
+@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
+ 	struct inode *inode = NULL;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
+ 		if (nd.last.name[nd.last.len])
+ 			goto slashes;
+ 		inode = dentry->d_inode;
+-		if (inode)
++		if (inode) {
++			if (inode->i_nlink <= 1) {
++				saved_ino = inode->i_ino;
++				saved_dev = inode->i_sb->s_dev;
++			}
++
+ 			atomic_inc(&inode->i_count);
++
++			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
++				error = -EACCES;
++				goto exit2;
++			}
++		}
+ 		error = mnt_want_write(nd.path.mnt);
+ 		if (error)
+ 			goto exit2;
+@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
+ 		if (error)
+ 			goto exit3;
+ 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
++		if (!error && (saved_ino || saved_dev))
++			gr_handle_delete(saved_ino, saved_dev);
+ exit3:
+ 		mnt_drop_write(nd.path.mnt);
+ 	exit2:
+@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	error = PTR_ERR(new_dentry);
+ 	if (IS_ERR(new_dentry))
+ 		goto out_unlock;
++
++	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
++			       old_path.dentry->d_inode,
++			       old_path.dentry->d_inode->i_mode, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
++				old_path.dentry, old_path.mnt, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
++	if (!error)
++		gr_handle_create(new_dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 	if (new_dentry == trap)
+ 		goto exit5;
+ 
++	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
++				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
++				     to);
++	if (error)
++		goto exit5;
++
+ 	error = mnt_want_write(oldnd.path.mnt);
+ 	if (error)
+ 		goto exit5;
+@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 		goto exit6;
+ 	error = vfs_rename(old_dir->d_inode, old_dentry,
+ 				   new_dir->d_inode, new_dentry);
++	if (!error)
++		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
++				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
+ exit6:
+ 	mnt_drop_write(oldnd.path.mnt);
+ exit5:
+diff -urNp linux-2.6.32.13/fs/namespace.c linux-2.6.32.13/fs/namespace.c
+--- linux-2.6.32.13/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/namespace.c	2010-05-15 13:21:17.430740691 -0400
+@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
+ 		if (!(sb->s_flags & MS_RDONLY))
+ 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
+ 		up_write(&sb->s_umount);
++
++		gr_log_remount(mnt->mnt_devname, retval);
++
+ 		return retval;
+ 	}
+ 
+@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
+ 		security_sb_umount_busy(mnt);
+ 	up_write(&namespace_sem);
+ 	release_mounts(&umount_list);
++
++	gr_log_unmount(mnt->mnt_devname, retval);
++
+ 	return retval;
+ }
+ 
+@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
+ 	if (retval)
+ 		goto dput_out;
+ 
++	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
++	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
+ 	if (flags & MS_REMOUNT)
+ 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
+ 				    data_page);
+@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
+ 				      dev_name, data_page);
+ dput_out:
+ 	path_put(&path);
++
++	gr_log_mount(dev_name, dir_name, retval);
++
+ 	return retval;
+ }
+ 
+@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
+ 		goto out1;
+ 	}
+ 
++	if (gr_handle_chroot_pivot()) {
++		error = -EPERM;
++		path_put(&old);
++		goto out1;
++	}
++
+ 	read_lock(&current->fs->lock);
+ 	root = current->fs->root;
+ 	path_get(&current->fs->root);
+diff -urNp linux-2.6.32.13/fs/nfs/inode.c linux-2.6.32.13/fs/nfs/inode.c
+--- linux-2.6.32.13/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
++++ linux-2.6.32.13/fs/nfs/inode.c	2010-05-15 13:21:17.459288785 -0400
+@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
+ 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
+ }
+ 
+-static atomic_long_t nfs_attr_generation_counter;
++static atomic_long_unchecked_t nfs_attr_generation_counter;
+ 
+ static unsigned long nfs_read_attr_generation_counter(void)
+ {
+-	return atomic_long_read(&nfs_attr_generation_counter);
++	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ unsigned long nfs_inc_attr_generation_counter(void)
+ {
+-	return atomic_long_inc_return(&nfs_attr_generation_counter);
++	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ void nfs_fattr_init(struct nfs_fattr *fattr)
+diff -urNp linux-2.6.32.13/fs/nfs/nfs4proc.c linux-2.6.32.13/fs/nfs/nfs4proc.c
+--- linux-2.6.32.13/fs/nfs/nfs4proc.c	2010-04-29 17:49:38.445067399 -0400
++++ linux-2.6.32.13/fs/nfs/nfs4proc.c	2010-05-15 13:21:17.510781468 -0400
+@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
+ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_do_open_reclaim(ctx, state);
+@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
+ 
+ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+ 	int err;
+ 	do {
+@@ -1493,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs
+ static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -1593,7 +1593,7 @@ out_err:
+ 
+ static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs4_state *res;
+ 	int status;
+ 
+@@ -1684,7 +1684,7 @@ static int nfs4_do_setattr(struct inode 
+ 			   struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2050,7 +2050,7 @@ static int _nfs4_server_capabilities(str
+ 
+ int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2084,7 +2084,7 @@ static int _nfs4_lookup_root(struct nfs_
+ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_fsinfo *info)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2173,7 +2173,7 @@ static int _nfs4_proc_getattr(struct nfs
+ 
+ static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2261,7 +2261,7 @@ static int nfs4_proc_lookupfh(struct nfs
+ 			      struct qstr *name, struct nfs_fh *fhandle,
+ 			      struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
+@@ -2290,7 +2290,7 @@ static int _nfs4_proc_lookup(struct inod
+ 
+ static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2354,7 +2354,7 @@ static int _nfs4_proc_access(struct inod
+ 
+ static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2410,7 +2410,7 @@ static int _nfs4_proc_readlink(struct in
+ static int nfs4_proc_readlink(struct inode *inode, struct page *page,
+ 		unsigned int pgbase, unsigned int pglen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2508,7 +2508,7 @@ static int _nfs4_proc_remove(struct inod
+ 
+ static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2582,7 +2582,7 @@ static int _nfs4_proc_rename(struct inod
+ static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
+ 		struct inode *new_dir, struct qstr *new_name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
+@@ -2629,7 +2629,7 @@ static int _nfs4_proc_link(struct inode 
+ 
+ static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2721,7 +2721,7 @@ out:
+ static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
+ 		struct page *page, unsigned int len, struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2752,7 +2752,7 @@ out:
+ static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2801,7 +2801,7 @@ static int _nfs4_proc_readdir(struct den
+ static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+                   u64 cookie, struct page *page, unsigned int count, int plus)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
+@@ -2849,7 +2849,7 @@ out:
+ static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr, dev_t rdev)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2881,7 +2881,7 @@ static int _nfs4_proc_statfs(struct nfs_
+ 
+ static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2912,7 +2912,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
+ 
+ static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -2958,7 +2958,7 @@ static int _nfs4_proc_pathconf(struct nf
+ static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_pathconf *pathconf)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -3257,7 +3257,7 @@ out_free:
+ 
+ static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	ssize_t ret;
+ 	do {
+ 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
+@@ -3313,7 +3313,7 @@ static int __nfs4_proc_set_acl(struct in
+ 
+ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -3578,7 +3578,7 @@ out:
+ int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
+@@ -3651,7 +3651,7 @@ out:
+ 
+ static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4044,7 +4044,7 @@ static int _nfs4_do_setlk(struct nfs4_st
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4062,7 +4062,7 @@ static int nfs4_lock_reclaim(struct nfs4
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, request);
+@@ -4120,7 +4120,7 @@ out:
+ 
+ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4180,7 +4180,7 @@ nfs4_proc_lock(struct file *filp, int cm
+ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, fl);
+diff -urNp linux-2.6.32.13/fs/nfsd/lockd.c linux-2.6.32.13/fs/nfsd/lockd.c
+--- linux-2.6.32.13/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/nfsd/lockd.c	2010-05-15 13:21:17.510781468 -0400
+@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
+ 	fput(filp);
+ }
+ 
+-static struct nlmsvc_binding	nfsd_nlm_ops = {
++static const struct nlmsvc_binding	nfsd_nlm_ops = {
+ 	.fopen		= nlm_fopen,		/* open file for locking */
+ 	.fclose		= nlm_fclose,		/* close file */
+ };
+diff -urNp linux-2.6.32.13/fs/nfsd/vfs.c linux-2.6.32.13/fs/nfsd/vfs.c
+--- linux-2.6.32.13/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/nfsd/vfs.c	2010-05-15 13:21:17.539124101 -0400
+@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
+ 	} else {
+ 		oldfs = get_fs();
+ 		set_fs(KERNEL_DS);
+-		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
++		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 		set_fs(oldfs);
+ 	}
+ 
+@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ 
+ 	/* Write the data. */
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
++	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 	set_fs(oldfs);
+ 	if (host_err < 0)
+ 		goto out_nfserr;
+@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
+ 	 */
+ 
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = inode->i_op->readlink(dentry, buf, *lenp);
++	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
+ 	set_fs(oldfs);
+ 
+ 	if (host_err < 0)
+diff -urNp linux-2.6.32.13/fs/nls/nls_base.c linux-2.6.32.13/fs/nls/nls_base.c
+--- linux-2.6.32.13/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/nls/nls_base.c	2010-05-15 13:21:17.550577951 -0400
+@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
+     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
+     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
+     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
+-    {0,						       /* end of table    */}
++    {0, 0, 0, 0, 0,				       /* end of table    */}
+ };
+ 
+ #define UNICODE_MAX	0x0010ffff
+diff -urNp linux-2.6.32.13/fs/ntfs/file.c linux-2.6.32.13/fs/ntfs/file.c
+--- linux-2.6.32.13/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ntfs/file.c	2010-05-15 13:21:17.582652999 -0400
+@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
+ #endif /* NTFS_RW */
+ };
+ 
+-const struct file_operations ntfs_empty_file_ops = {};
++const struct file_operations ntfs_empty_file_ops __read_only;
+ 
+-const struct inode_operations ntfs_empty_inode_ops = {};
++const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff -urNp linux-2.6.32.13/fs/ocfs2/cluster/masklog.c linux-2.6.32.13/fs/ocfs2/cluster/masklog.c
+--- linux-2.6.32.13/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ocfs2/cluster/masklog.c	2010-05-15 13:21:17.582652999 -0400
+@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
+ 	return mlog_mask_store(mlog_attr->mask, buf, count);
+ }
+ 
+-static struct sysfs_ops mlog_attr_ops = {
++static const struct sysfs_ops mlog_attr_ops = {
+ 	.show  = mlog_show,
+ 	.store = mlog_store,
+ };
+diff -urNp linux-2.6.32.13/fs/ocfs2/localalloc.c linux-2.6.32.13/fs/ocfs2/localalloc.c
+--- linux-2.6.32.13/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ocfs2/localalloc.c	2010-05-15 13:21:17.587704007 -0400
+@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
+ 		goto bail;
+ 	}
+ 
+-	atomic_inc(&osb->alloc_stats.moves);
++	atomic_inc_unchecked(&osb->alloc_stats.moves);
+ 
+ 	status = 0;
+ bail:
+diff -urNp linux-2.6.32.13/fs/ocfs2/ocfs2.h linux-2.6.32.13/fs/ocfs2/ocfs2.h
+--- linux-2.6.32.13/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ocfs2/ocfs2.h	2010-05-15 13:21:17.612604736 -0400
+@@ -217,11 +217,11 @@ enum ocfs2_vol_state
+ 
+ struct ocfs2_alloc_stats
+ {
+-	atomic_t moves;
+-	atomic_t local_data;
+-	atomic_t bitmap_data;
+-	atomic_t bg_allocs;
+-	atomic_t bg_extends;
++	atomic_unchecked_t moves;
++	atomic_unchecked_t local_data;
++	atomic_unchecked_t bitmap_data;
++	atomic_unchecked_t bg_allocs;
++	atomic_unchecked_t bg_extends;
+ };
+ 
+ enum ocfs2_local_alloc_state
+diff -urNp linux-2.6.32.13/fs/ocfs2/suballoc.c linux-2.6.32.13/fs/ocfs2/suballoc.c
+--- linux-2.6.32.13/fs/ocfs2/suballoc.c	2010-04-29 17:49:38.449086403 -0400
++++ linux-2.6.32.13/fs/ocfs2/suballoc.c	2010-05-15 13:21:17.655985201 -0400
+@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
+ 				mlog_errno(status);
+ 			goto bail;
+ 		}
+-		atomic_inc(&osb->alloc_stats.bg_extends);
++		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
+ 
+ 		/* You should never ask for this much metadata */
+ 		BUG_ON(bits_wanted >
+@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
+ 	ac->ac_bits_given += (*num_bits);
+@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	BUG_ON(num_bits != 1);
+ 
+@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 						      cluster_start,
+ 						      num_clusters);
+ 		if (!status)
+-			atomic_inc(&osb->alloc_stats.local_data);
++			atomic_inc_unchecked(&osb->alloc_stats.local_data);
+ 	} else {
+ 		if (min_clusters > (osb->bitmap_cpg - 1)) {
+ 			/* The only paths asking for contiguousness
+@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
+ 								 bg_blkno,
+ 								 bg_bit_off);
+-			atomic_inc(&osb->alloc_stats.bitmap_data);
++			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
+ 		}
+ 	}
+ 	if (status < 0) {
+diff -urNp linux-2.6.32.13/fs/ocfs2/super.c linux-2.6.32.13/fs/ocfs2/super.c
+--- linux-2.6.32.13/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/ocfs2/super.c	2010-05-15 13:21:17.677940986 -0400
+@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
+ 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
+ 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
+ 			"Stats",
+-			atomic_read(&osb->alloc_stats.bitmap_data),
+-			atomic_read(&osb->alloc_stats.local_data),
+-			atomic_read(&osb->alloc_stats.bg_allocs),
+-			atomic_read(&osb->alloc_stats.moves),
+-			atomic_read(&osb->alloc_stats.bg_extends));
++			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
++			atomic_read_unchecked(&osb->alloc_stats.local_data),
++			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
++			atomic_read_unchecked(&osb->alloc_stats.moves),
++			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
+ 
+ 	out += snprintf(buf + out, len - out,
+ 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
+@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
+ 	spin_lock_init(&osb->osb_xattr_lock);
+ 	ocfs2_init_inode_steal_slot(osb);
+ 
+-	atomic_set(&osb->alloc_stats.moves, 0);
+-	atomic_set(&osb->alloc_stats.local_data, 0);
+-	atomic_set(&osb->alloc_stats.bitmap_data, 0);
+-	atomic_set(&osb->alloc_stats.bg_allocs, 0);
+-	atomic_set(&osb->alloc_stats.bg_extends, 0);
++	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
++	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
+ 
+ 	/* Copy the blockcheck stats from the superblock probe */
+ 	osb->osb_ecc_stats = *stats;
+diff -urNp linux-2.6.32.13/fs/open.c linux-2.6.32.13/fs/open.c
+--- linux-2.6.32.13/fs/open.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/open.c	2010-05-15 13:21:17.687346474 -0400
+@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
+ 	if (length < 0)
+ 		return -EINVAL;
+ 
++	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
++		return -EACCES;
++
+ 	newattrs.ia_size = length;
+ 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
+ 	if (filp) {
+@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
+ 	if (__mnt_is_readonly(path.mnt))
+ 		res = -EROFS;
+ 
++	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
++		res = -EACCES;
++
+ out_path_release:
+ 	path_put(&path);
+ out:
+@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
+ 	if (error)
+ 		goto dput_and_out;
+ 
++	gr_log_chdir(path.dentry, path.mnt);
++
+ 	set_fs_pwd(current->fs, &path);
+ 
+ dput_and_out:
+@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
+ 		goto out_putf;
+ 
+ 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
++
++	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
++		error = -EPERM;
++
++	if (!error)
++		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
++
+ 	if (!error)
+ 		set_fs_pwd(current->fs, &file->f_path);
+ out_putf:
+@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
+ 	if (!capable(CAP_SYS_CHROOT))
+ 		goto dput_and_out;
+ 
++	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
++		goto dput_and_out;
++
++	if (gr_handle_chroot_caps(&path)) {
++		error = -ENOMEM;
++		goto dput_and_out;
++	}
++
+ 	set_fs_root(current->fs, &path);
++
++	gr_handle_chroot_chdir(&path);
++
+ 	error = 0;
+ dput_and_out:
+ 	path_put(&path);
+@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
+ 	err = mnt_want_write_file(file);
+ 	if (err)
+ 		goto out_putf;
++
++	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
++		err = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
++		err = -EPERM;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	err = notify_change(dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(file->f_path.mnt);
+ out_putf:
+ 	fput(file);
+@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto dput_and_out;
++
++	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	error = notify_change(path.dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(path.mnt);
+ dput_and_out:
+ 	path_put(&path);
+@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
+ 	return sys_fchmodat(AT_FDCWD, filename, mode);
+ }
+ 
+-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
++static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int error;
+ 	struct iattr newattrs;
+ 
++	if (!gr_acl_handle_chown(dentry, mnt))
++		return -EACCES;
++
+ 	newattrs.ia_valid =  ATTR_CTIME;
+ 	if (user != (uid_t) -1) {
+ 		newattrs.ia_valid |= ATTR_UID;
+@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
+ 		goto out_fput;
+ 	dentry = file->f_path.dentry;
+ 	audit_inode(NULL, dentry);
+-	error = chown_common(dentry, user, group);
++	error = chown_common(dentry, user, group, file->f_path.mnt);
+ 	mnt_drop_write(file->f_path.mnt);
+ out_fput:
+ 	fput(file);
+diff -urNp linux-2.6.32.13/fs/pipe.c linux-2.6.32.13/fs/pipe.c
+--- linux-2.6.32.13/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/pipe.c	2010-05-15 13:21:17.687346474 -0400
+@@ -401,9 +401,9 @@ redo:
+ 		}
+ 		if (bufs)	/* More to do? */
+ 			continue;
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			/* syscall merging: Usually we must not sleep
+ 			 * if O_NONBLOCK is set, or if we got some data.
+ 			 * But if a writer sleeps in kernel space, then
+@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+ 
+-	if (!pipe->readers) {
++	if (!atomic_read(&pipe->readers)) {
+ 		send_sig(SIGPIPE, current, 0);
+ 		ret = -EPIPE;
+ 		goto out;
+@@ -511,7 +511,7 @@ redo1:
+ 	for (;;) {
+ 		int bufs;
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -597,9 +597,9 @@ redo2:
+ 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 			do_wakeup = 0;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ out:
+ 	mutex_unlock(&inode->i_mutex);
+@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
+ 	mask = 0;
+ 	if (filp->f_mode & FMODE_READ) {
+ 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
+-		if (!pipe->writers && filp->f_version != pipe->w_counter)
++		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
+ 			mask |= POLLHUP;
+ 	}
+ 
+@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
+ 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
+ 		 * behave exactly like pipes for poll().
+ 		 */
+-		if (!pipe->readers)
++		if (!atomic_read(&pipe->readers))
+ 			mask |= POLLERR;
+ 	}
+ 
+@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
+ 
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+-	pipe->readers -= decr;
+-	pipe->writers -= decw;
++	atomic_sub(decr, &pipe->readers);
++	atomic_sub(decw, &pipe->writers);
+ 
+-	if (!pipe->readers && !pipe->writers) {
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
+ 		free_pipe_info(inode);
+ 	} else {
+ 		wake_up_interruptible_sync(&pipe->wait);
+@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->readers++;
++		atomic_inc(&inode->i_pipe->readers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->writers++;
++		atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+ 		if (filp->f_mode & FMODE_READ)
+-			inode->i_pipe->readers++;
++			atomic_inc(&inode->i_pipe->readers);
+ 		if (filp->f_mode & FMODE_WRITE)
+-			inode->i_pipe->writers++;
++			atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
+ 	inode->i_pipe = NULL;
+ }
+ 
+-static struct vfsmount *pipe_mnt __read_mostly;
++struct vfsmount *pipe_mnt __read_mostly;
+ static int pipefs_delete_dentry(struct dentry *dentry)
+ {
+ 	/*
+@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
+ 		goto fail_iput;
+ 	inode->i_pipe = pipe;
+ 
+-	pipe->readers = pipe->writers = 1;
++	atomic_set(&pipe->readers, 1);
++	atomic_set(&pipe->writers, 1);
+ 	inode->i_fop = &rdwr_pipefifo_fops;
+ 
+ 	/*
+diff -urNp linux-2.6.32.13/fs/proc/array.c linux-2.6.32.13/fs/proc/array.c
+--- linux-2.6.32.13/fs/proc/array.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/array.c	2010-05-15 13:21:17.690587811 -0400
+@@ -410,6 +410,21 @@ static void task_show_stack_usage(struct
+ }
+ #endif		/* CONFIG_MMU */
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline void task_pax(struct seq_file *m, struct task_struct *p)
++{
++	if (p->mm)
++		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
++			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
++			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
++			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
++			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
++			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
++	else
++		seq_printf(m, "PaX:\t-----\n");
++}
++#endif
++
+ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task)
+ {
+@@ -430,9 +445,20 @@ int proc_pid_status(struct seq_file *m, 
+ #endif
+ 	task_context_switch_counts(m, task);
+ 	task_show_stack_usage(m, task);
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	task_pax(m, task);
++#endif
++
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task, int whole)
+ {
+@@ -529,6 +555,19 @@ static int do_task_stat(struct seq_file 
+ 		gtime = task_gtime(task);
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (PAX_RAND_FLAGS(mm)) {
++		eip = 0;
++		esp = 0;
++		wchan = 0;
++	}
++#endif
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	wchan = 0;
++	eip =0;
++	esp =0;
++#endif
++
+ 	/* scale priority and nice values from timeslices to -20..20 */
+ 	/* to make it look like a "normal" Unix priority/nice value  */
+ 	priority = task_prio(task);
+@@ -569,9 +608,15 @@ static int do_task_stat(struct seq_file 
+ 		vsize,
+ 		mm ? get_mm_rss(mm) : 0,
+ 		rsslim,
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
++		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
++#else
+ 		mm ? mm->start_code : 0,
+ 		mm ? mm->end_code : 0,
+ 		(permitted && mm) ? task->stack_start : 0,
++#endif
+ 		esp,
+ 		eip,
+ 		/* The signal information here is obsolete.
+@@ -624,3 +669,10 @@ int proc_pid_statm(struct seq_file *m, s
+ 
+ 	return 0;
+ }
++
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++int proc_pid_ipaddr(struct task_struct *task, char *buffer)
++{
++	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
++}
++#endif
+diff -urNp linux-2.6.32.13/fs/proc/base.c linux-2.6.32.13/fs/proc/base.c
+--- linux-2.6.32.13/fs/proc/base.c	2010-05-15 13:20:19.242597763 -0400
++++ linux-2.6.32.13/fs/proc/base.c	2010-05-15 13:21:17.690587811 -0400
+@@ -102,6 +102,22 @@ struct pid_entry {
+ 	union proc_op op;
+ };
+ 
++struct getdents_callback {
++	struct linux_dirent __user * current_dir;
++	struct linux_dirent __user * previous;
++	struct file * file;
++	int count;
++	int error;
++};
++
++static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
++			   loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct getdents_callback * buf = (struct getdents_callback *) __buf;
++	buf->error = -EINVAL;
++	return 0;
++}
++
+ #define NOD(NAME, MODE, IOP, FOP, OP) {			\
+ 	.name = (NAME),					\
+ 	.len  = sizeof(NAME) - 1,			\
+@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
+ 	if (task == current)
+ 		return 0;
+ 
++	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
++		return -EPERM;
++
+ 	/*
+ 	 * If current is actively ptrace'ing, and would also be
+ 	 * permitted to freshly attach with ptrace now, permit it.
+@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
+ 	if (!mm->arg_end)
+ 		goto out_mm;	/* Shh! No looking before we're done */
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out_mm;
++
+  	len = mm->arg_end - mm->arg_start;
+  
+ 	if (len > PAGE_SIZE)
+@@ -287,12 +309,26 @@ out:
+ 	return res;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+ {
+ 	int res = 0;
+ 	struct mm_struct *mm = get_task_mm(task);
+ 	if (mm) {
+ 		unsigned int nwords = 0;
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (PAX_RAND_FLAGS(mm)) {
++			mmput(mm);
++			return res;
++		}
++#endif
++
+ 		do {
+ 			nwords += 2;
+ 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
+ }
+ #endif /* CONFIG_KALLSYMS */
+ 
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 
+ #define MAX_STACK_TRACE_DEPTH	64
+ 
+@@ -522,7 +558,7 @@ static int proc_pid_limits(struct task_s
+ 	return count;
+ }
+ 
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+ {
+ 	long nr;
+@@ -936,6 +972,9 @@ static ssize_t environ_read(struct file 
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out;
++
+ 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ 		goto out;
+ 
+@@ -1456,7 +1495,11 @@ static struct inode *proc_pid_make_inode
+ 		rcu_read_lock();
+ 		cred = __task_cred(task);
+ 		inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 		inode->i_gid = cred->egid;
++#endif
+ 		rcu_read_unlock();
+ 	}
+ 	security_task_to_inode(task, inode);
+@@ -1474,6 +1517,9 @@ static int pid_getattr(struct vfsmount *
+ 	struct inode *inode = dentry->d_inode;
+ 	struct task_struct *task;
+ 	const struct cred *cred;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++#endif
+ 
+ 	generic_fillattr(inode, stat);
+ 
+@@ -1481,12 +1527,34 @@ static int pid_getattr(struct vfsmount *
+ 	stat->uid = 0;
+ 	stat->gid = 0;
+ 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
++
++	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
+ 	if (task) {
++		cred = __task_cred(task);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++		)
++#endif
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+-			cred = __task_cred(task);
+ 			stat->uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			stat->gid = cred->egid;
++#endif
+ 		}
+ 	}
+ 	rcu_read_unlock();
+@@ -1518,11 +1586,20 @@ static int pid_revalidate(struct dentry 
+ 
+ 	if (task) {
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+ 			rcu_read_lock();
+ 			cred = __task_cred(task);
+ 			inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = cred->egid;
++#endif
+ 			rcu_read_unlock();
+ 		} else {
+ 			inode->i_uid = 0;
+@@ -1643,7 +1720,8 @@ static int proc_fd_info(struct inode *in
+ 	int fd = proc_fd(inode);
+ 
+ 	if (task) {
+-		files = get_files_struct(task);
++		if (!gr_acl_handle_procpidmem(task))
++			files = get_files_struct(task);
+ 		put_task_struct(task);
+ 	}
+ 	if (files) {
+@@ -1895,12 +1973,22 @@ static const struct file_operations proc
+ static int proc_fd_permission(struct inode *inode, int mask)
+ {
+ 	int rv;
++	struct task_struct *task;
+ 
+ 	rv = generic_permission(inode, mask, NULL);
+-	if (rv == 0)
+-		return 0;
++
+ 	if (task_pid(current) == proc_pid(inode))
+ 		rv = 0;
++
++	task = get_proc_task(inode);
++	if (task == NULL)
++		return rv;
++
++	if (gr_acl_handle_procpidmem(task))
++		rv = -EACCES;
++
++	put_task_struct(task);
++
+ 	return rv;
+ }
+ 
+@@ -2009,6 +2097,9 @@ static struct dentry *proc_pident_lookup
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	/*
+ 	 * Yes, it does not scale. And it should not. Don't add
+ 	 * new entries into /proc/<tgid>/ without very good reasons.
+@@ -2053,6 +2144,9 @@ static int proc_pident_readdir(struct fi
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	ret = 0;
+ 	i = filp->f_pos;
+ 	switch (i) {
+@@ -2320,7 +2414,7 @@ static void *proc_self_follow_link(struc
+ static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+ 				void *cookie)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+@@ -2433,6 +2527,9 @@ static struct dentry *proc_base_lookup(s
+ 	if (p > last)
+ 		goto out;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	error = proc_base_instantiate(dir, dentry, task, p);
+ 
+ out:
+@@ -2519,7 +2616,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",    S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
+@@ -2547,7 +2644,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",      S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+@@ -2577,6 +2674,9 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+ 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
++#endif
+ };
+ 
+ static int proc_tgid_base_readdir(struct file * filp,
+@@ -2701,7 +2801,14 @@ static struct dentry *proc_pid_instantia
+ 	if (!inode)
+ 		goto out;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
++#else
+ 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
++#endif
+ 	inode->i_op = &proc_tgid_base_inode_operations;
+ 	inode->i_fop = &proc_tgid_base_operations;
+ 	inode->i_flags|=S_IMMUTABLE;
+@@ -2743,7 +2850,11 @@ struct dentry *proc_pid_lookup(struct in
+ 	if (!task)
+ 		goto out;
+ 
++	if (gr_check_hidden_task(task))
++		goto out_put_task;
++
+ 	result = proc_pid_instantiate(dir, dentry, task, NULL);
++out_put_task:
+ 	put_task_struct(task);
+ out:
+ 	return result;
+@@ -2808,6 +2919,11 @@ int proc_pid_readdir(struct file * filp,
+ {
+ 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+ 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++	const struct cred *itercred;
++#endif
++	filldir_t __filldir = filldir;
+ 	struct tgid_iter iter;
+ 	struct pid_namespace *ns;
+ 
+@@ -2826,8 +2942,27 @@ int proc_pid_readdir(struct file * filp,
+ 	for (iter = next_tgid(ns, iter);
+ 	     iter.task;
+ 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		rcu_read_lock();
++		itercred = __task_cred(iter.task);
++#endif
++		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++			)
++#endif
++		)
++			__filldir = &gr_fake_filldir;
++		else
++			__filldir = filldir;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	rcu_read_unlock();
++#endif
+ 		filp->f_pos = iter.tgid + TGID_OFFSET;
+-		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
++		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
+ 			put_task_struct(iter.task);
+ 			goto out;
+ 		}
+@@ -2853,7 +2988,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",   S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
+@@ -2880,7 +3015,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",     S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+diff -urNp linux-2.6.32.13/fs/proc/cmdline.c linux-2.6.32.13/fs/proc/cmdline.c
+--- linux-2.6.32.13/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/cmdline.c	2010-05-15 13:21:17.694581759 -0400
+@@ -23,7 +23,11 @@ static const struct file_operations cmdl
+ 
+ static int __init proc_cmdline_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
++#else
+ 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
++#endif
+ 	return 0;
+ }
+ module_init(proc_cmdline_init);
+diff -urNp linux-2.6.32.13/fs/proc/devices.c linux-2.6.32.13/fs/proc/devices.c
+--- linux-2.6.32.13/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/devices.c	2010-05-15 13:21:17.706647417 -0400
+@@ -64,7 +64,11 @@ static const struct file_operations proc
+ 
+ static int __init proc_devices_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
++#else
+ 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_devices_init);
+diff -urNp linux-2.6.32.13/fs/proc/inode.c linux-2.6.32.13/fs/proc/inode.c
+--- linux-2.6.32.13/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/inode.c	2010-05-15 13:21:17.710596393 -0400
+@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
+ 		if (de->mode) {
+ 			inode->i_mode = de->mode;
+ 			inode->i_uid = de->uid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = de->gid;
++#endif
+ 		}
+ 		if (de->size)
+ 			inode->i_size = de->size;
+diff -urNp linux-2.6.32.13/fs/proc/internal.h linux-2.6.32.13/fs/proc/internal.h
+--- linux-2.6.32.13/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/internal.h	2010-05-15 13:21:17.714628011 -0400
+@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
+ 				struct pid *pid, struct task_struct *task);
+ extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+ 				struct pid *pid, struct task_struct *task);
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
++#endif
+ extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
+ 
+ extern const struct file_operations proc_maps_operations;
+diff -urNp linux-2.6.32.13/fs/proc/Kconfig linux-2.6.32.13/fs/proc/Kconfig
+--- linux-2.6.32.13/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/Kconfig	2010-05-15 13:21:17.722605604 -0400
+@@ -30,12 +30,12 @@ config PROC_FS
+ 
+ config PROC_KCORE
+ 	bool "/proc/kcore support" if !ARM
+-	depends on PROC_FS && MMU
++	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
+ 
+ config PROC_VMCORE
+         bool "/proc/vmcore support (EXPERIMENTAL)"
+-        depends on PROC_FS && CRASH_DUMP
+-	default y
++        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
++	default n
+         help
+         Exports the dump image of crashed kernel in ELF format.
+ 
+@@ -59,8 +59,8 @@ config PROC_SYSCTL
+ 	  limited in memory.
+ 
+ config PROC_PAGE_MONITOR
+- 	default y
+-	depends on PROC_FS && MMU
++ 	default n
++	depends on PROC_FS && MMU && !GRKERNSEC
+ 	bool "Enable /proc page monitoring" if EMBEDDED
+  	help
+ 	  Various /proc files exist to monitor process memory utilization:
+diff -urNp linux-2.6.32.13/fs/proc/kcore.c linux-2.6.32.13/fs/proc/kcore.c
+--- linux-2.6.32.13/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/kcore.c	2010-05-15 13:21:17.730660780 -0400
+@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
+ 
+ static int open_kcore(struct inode *inode, struct file *filp)
+ {
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	return -EPERM;
++#endif
+ 	if (!capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 	if (kcore_need_update)
+diff -urNp linux-2.6.32.13/fs/proc/meminfo.c linux-2.6.32.13/fs/proc/meminfo.c
+--- linux-2.6.32.13/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/meminfo.c	2010-05-15 13:21:17.734637714 -0400
+@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
+ 		vmi.used >> 10,
+ 		vmi.largest_chunk >> 10
+ #ifdef CONFIG_MEMORY_FAILURE
+-		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
++		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
+ #endif
+ 		);
+ 
+diff -urNp linux-2.6.32.13/fs/proc/nommu.c linux-2.6.32.13/fs/proc/nommu.c
+--- linux-2.6.32.13/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/nommu.c	2010-05-15 13:21:17.738599356 -0400
+@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.13/fs/proc/proc_net.c linux-2.6.32.13/fs/proc/proc_net.c
+--- linux-2.6.32.13/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/proc_net.c	2010-05-15 13:21:17.742599005 -0400
+@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
+ 	struct task_struct *task;
+ 	struct nsproxy *ns;
+ 	struct net *net = NULL;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred = current_cred();
++#endif
++
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	if (cred->fsuid)
++		return net;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
++		return net;
++#endif
+ 
+ 	rcu_read_lock();
+ 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
+diff -urNp linux-2.6.32.13/fs/proc/proc_sysctl.c linux-2.6.32.13/fs/proc/proc_sysctl.c
+--- linux-2.6.32.13/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/proc_sysctl.c	2010-05-15 13:21:17.746588317 -0400
+@@ -7,6 +7,8 @@
+ #include <linux/security.h>
+ #include "internal.h"
+ 
++extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
++
+ static const struct dentry_operations proc_sys_dentry_operations;
+ static const struct file_operations proc_sys_file_operations;
+ static const struct inode_operations proc_sys_inode_operations;
+@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
+ 	if (!p)
+ 		goto out;
+ 
++	if (gr_handle_sysctl(p, MAY_EXEC))
++		goto out;
++
+ 	err = ERR_PTR(-ENOMEM);
+ 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+ 	if (h)
+@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
+ 		if (*pos < file->f_pos)
+ 			continue;
+ 
++		if (gr_handle_sysctl(table, 0))
++			continue;
++
+ 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
+ 		if (res)
+ 			return res;
+@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
+ 	if (IS_ERR(head))
+ 		return PTR_ERR(head);
+ 
++	if (table && gr_handle_sysctl(table, MAY_EXEC))
++		return -ENOENT;
++
+ 	generic_fillattr(inode, stat);
+ 	if (table)
+ 		stat->mode = (stat->mode & S_IFMT) | table->mode;
+diff -urNp linux-2.6.32.13/fs/proc/root.c linux-2.6.32.13/fs/proc/root.c
+--- linux-2.6.32.13/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/root.c	2010-05-15 13:21:17.750584298 -0400
+@@ -134,7 +134,15 @@ void __init proc_root_init(void)
+ #ifdef CONFIG_PROC_DEVICETREE
+ 	proc_device_tree_init();
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_mkdir("bus", NULL);
++#endif
+ 	proc_sys_init();
+ }
+ 
+diff -urNp linux-2.6.32.13/fs/proc/task_mmu.c linux-2.6.32.13/fs/proc/task_mmu.c
+--- linux-2.6.32.13/fs/proc/task_mmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/task_mmu.c	2010-05-15 13:21:17.758934117 -0400
+@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
+ 		"VmStk:\t%8lu kB\n"
+ 		"VmExe:\t%8lu kB\n"
+ 		"VmLib:\t%8lu kB\n"
+-		"VmPTE:\t%8lu kB\n",
+-		hiwater_vm << (PAGE_SHIFT-10),
++		"VmPTE:\t%8lu kB\n"
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
++#endif
++
++		,hiwater_vm << (PAGE_SHIFT-10),
+ 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
+ 		mm->locked_vm << (PAGE_SHIFT-10),
+ 		hiwater_rss << (PAGE_SHIFT-10),
+ 		total_rss << (PAGE_SHIFT-10),
+ 		data << (PAGE_SHIFT-10),
+ 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
+-		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
++		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		, mm->context.user_cs_base, mm->context.user_cs_limit
++#endif
++
++	);
+ }
+ 
+ unsigned long task_vsize(struct mm_struct *mm)
+@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ {
+ 	struct mm_struct *mm = vma->vm_mm;
+@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
+ 	}
+ 
+ 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
++#else
+ 			vma->vm_start,
+ 			vma->vm_end,
++#endif
+ 			flags & VM_READ ? 'r' : '-',
+ 			flags & VM_WRITE ? 'w' : '-',
+ 			flags & VM_EXEC ? 'x' : '-',
+ 			flags & VM_MAYSHARE ? 's' : 'p',
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
++#else
+ 			pgoff,
++#endif
+ 			MAJOR(dev), MINOR(dev), ino, &len);
+ 
+ 	/*
+@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
+ 	 */
+ 	if (file) {
+ 		pad_len_spaces(m, len);
+-		seq_path(m, &file->f_path, "\n");
++		seq_path(m, &file->f_path, "\n\\");
+ 	} else {
+ 		const char *name = arch_vma_name(vma);
+ 		if (!name) {
+ 			if (mm) {
+-				if (vma->vm_start <= mm->start_brk &&
+-						vma->vm_end >= mm->brk) {
++				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 					name = "[heap]";
+-				} else if (vma->vm_start <= mm->start_stack &&
+-					   vma->vm_end >= mm->start_stack) {
++				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
++					   (vma->vm_start <= mm->start_stack &&
++					    vma->vm_end >= mm->start_stack)) {
+ 					name = "[stack]";
+ 				} else {
+ 					unsigned long stack_start;
+@@ -403,9 +429,16 @@ static int show_smap(struct seq_file *m,
+ 	};
+ 
+ 	memset(&mss, 0, sizeof mss);
+-	mss.vma = vma;
+-	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
+-		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
++#endif
++		mss.vma = vma;
++		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
++			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	}
++#endif
+ 
+ 	show_map_vma(m, vma);
+ 
+@@ -421,7 +454,11 @@ static int show_smap(struct seq_file *m,
+ 		   "Swap:           %8lu kB\n"
+ 		   "KernelPageSize: %8lu kB\n"
+ 		   "MMUPageSize:    %8lu kB\n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
++#else
+ 		   (vma->vm_end - vma->vm_start) >> 10,
++#endif
+ 		   mss.resident >> 10,
+ 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
+ 		   mss.shared_clean  >> 10,
+diff -urNp linux-2.6.32.13/fs/proc/task_nommu.c linux-2.6.32.13/fs/proc/task_nommu.c
+--- linux-2.6.32.13/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/proc/task_nommu.c	2010-05-15 13:21:17.758934117 -0400
+@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
+ 	else
+ 		bytes += kobjsize(mm);
+ 	
+-	if (current->fs && current->fs->users > 1)
++	if (current->fs && atomic_read(&current->fs->users) > 1)
+ 		sbytes += kobjsize(current->fs);
+ 	else
+ 		bytes += kobjsize(current->fs);
+@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.13/fs/readdir.c linux-2.6.32.13/fs/readdir.c
+--- linux-2.6.32.13/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/readdir.c	2010-05-15 13:21:17.778956743 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/security.h>
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
++#include <linux/namei.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -67,6 +68,7 @@ struct old_linux_dirent {
+ 
+ struct readdir_callback {
+ 	struct old_linux_dirent __user * dirent;
++	struct file * file;
+ 	int result;
+ };
+ 
+@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
+ 		buf->result = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	buf->result++;
+ 	dirent = buf->dirent;
+ 	if (!access_ok(VERIFY_WRITE, dirent,
+@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
+ 
+ 	buf.result = 0;
+ 	buf.dirent = dirent;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, fillonedir, &buf);
+ 	if (buf.result)
+@@ -142,6 +149,7 @@ struct linux_dirent {
+ struct getdents_callback {
+ 	struct linux_dirent __user * current_dir;
+ 	struct linux_dirent __user * previous;
++	struct file * file;
+ 	int count;
+ 	int error;
+ };
+@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
+ 		buf->error = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
+ 	buf.previous = NULL;
+ 	buf.count = count;
+ 	buf.error = 0;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, filldir, &buf);
+ 	if (error >= 0)
+@@ -228,6 +241,7 @@ out:
+ struct getdents_callback64 {
+ 	struct linux_dirent64 __user * current_dir;
+ 	struct linux_dirent64 __user * previous;
++	struct file *file;
+ 	int count;
+ 	int error;
+ };
+@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
+ 	buf->error = -EINVAL;	/* only used if we fail.. */
+ 	if (reclen > buf->count)
+ 		return -EINVAL;
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
+ 
+ 	buf.current_dir = dirent;
+ 	buf.previous = NULL;
++	buf.file = file;
+ 	buf.count = count;
+ 	buf.error = 0;
+ 
+diff -urNp linux-2.6.32.13/fs/reiserfs/do_balan.c linux-2.6.32.13/fs/reiserfs/do_balan.c
+--- linux-2.6.32.13/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/reiserfs/do_balan.c	2010-05-15 13:21:17.786600991 -0400
+@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
+ 		return;
+ 	}
+ 
+-	atomic_inc(&(fs_generation(tb->tb_sb)));
++	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
+ 	do_balance_starts(tb);
+ 
+ 	/* balance leaf returns 0 except if combining L R and S into
+diff -urNp linux-2.6.32.13/fs/reiserfs/item_ops.c linux-2.6.32.13/fs/reiserfs/item_ops.c
+--- linux-2.6.32.13/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/reiserfs/item_ops.c	2010-05-15 13:21:17.794567981 -0400
+@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations stat_data_ops = {
++static const struct item_operations stat_data_ops = {
+ 	.bytes_number = sd_bytes_number,
+ 	.decrement_key = sd_decrement_key,
+ 	.is_left_mergeable = sd_is_left_mergeable,
+@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations direct_ops = {
++static const struct item_operations direct_ops = {
+ 	.bytes_number = direct_bytes_number,
+ 	.decrement_key = direct_decrement_key,
+ 	.is_left_mergeable = direct_is_left_mergeable,
+@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations indirect_ops = {
++static const struct item_operations indirect_ops = {
+ 	.bytes_number = indirect_bytes_number,
+ 	.decrement_key = indirect_decrement_key,
+ 	.is_left_mergeable = indirect_is_left_mergeable,
+@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
+ 	printk("\n");
+ }
+ 
+-static struct item_operations direntry_ops = {
++static const struct item_operations direntry_ops = {
+ 	.bytes_number = direntry_bytes_number,
+ 	.decrement_key = direntry_decrement_key,
+ 	.is_left_mergeable = direntry_is_left_mergeable,
+@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
+ 			 "Invalid item type observed, run fsck ASAP");
+ }
+ 
+-static struct item_operations errcatch_ops = {
++static const struct item_operations errcatch_ops = {
+ 	errcatch_bytes_number,
+ 	errcatch_decrement_key,
+ 	errcatch_is_left_mergeable,
+@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
+ #error Item types must use disk-format assigned values.
+ #endif
+ 
+-struct item_operations *item_ops[TYPE_ANY + 1] = {
++const struct item_operations * const item_ops[TYPE_ANY + 1] = {
+ 	&stat_data_ops,
+ 	&indirect_ops,
+ 	&direct_ops,
+diff -urNp linux-2.6.32.13/fs/reiserfs/procfs.c linux-2.6.32.13/fs/reiserfs/procfs.c
+--- linux-2.6.32.13/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/reiserfs/procfs.c	2010-05-15 13:21:17.802593961 -0400
+@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
+ 		   "SMALL_TAILS " : "NO_TAILS ",
+ 		   replay_only(sb) ? "REPLAY_ONLY " : "",
+ 		   convert_reiserfs(sb) ? "CONV " : "",
+-		   atomic_read(&r->s_generation_counter),
++		   atomic_read_unchecked(&r->s_generation_counter),
+ 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
+ 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
+ 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
+diff -urNp linux-2.6.32.13/fs/select.c linux-2.6.32.13/fs/select.c
+--- linux-2.6.32.13/fs/select.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/select.c	2010-05-15 13:21:17.806683634 -0400
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/poll.h>
++#include <linux/security.h>
+ #include <linux/personality.h> /* for STICKY_TIMEOUTS */
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
+@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
+  	struct poll_list *walk = head;
+  	unsigned long todo = nfds;
+ 
++	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
+ 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EINVAL;
+ 
+diff -urNp linux-2.6.32.13/fs/seq_file.c linux-2.6.32.13/fs/seq_file.c
+--- linux-2.6.32.13/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/seq_file.c	2010-05-15 13:21:17.810601731 -0400
+@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
+ 		return 0;
+ 	}
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			return -ENOMEM;
+ 	}
+@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
+ Eoverflow:
+ 	m->op->stop(m, p);
+ 	kfree(m->buf);
+-	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++	m->size <<= 1;
++	m->buf = kmalloc(m->size, GFP_KERNEL);
+ 	return !m->buf ? -ENOMEM : -EAGAIN;
+ }
+ 
+@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
+ 	m->version = file->f_version;
+ 	/* grab buffer if we didn't have one */
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 	}
+@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
+ 			goto Fill;
+ 		m->op->stop(m, p);
+ 		kfree(m->buf);
+-		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++		m->size <<= 1;
++		m->buf = kmalloc(m->size, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 		m->count = 0;
+diff -urNp linux-2.6.32.13/fs/smbfs/symlink.c linux-2.6.32.13/fs/smbfs/symlink.c
+--- linux-2.6.32.13/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/smbfs/symlink.c	2010-05-15 13:21:17.810601731 -0400
+@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
+ 
+ static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+diff -urNp linux-2.6.32.13/fs/splice.c linux-2.6.32.13/fs/splice.c
+--- linux-2.6.32.13/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/splice.c	2010-05-15 13:21:17.818603295 -0400
+@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 	pipe_lock(pipe);
+ 
+ 	for (;;) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 			do_wakeup = 0;
+ 		}
+ 
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
++	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_write(file, (const char __user *)buf, count, &pos);
++	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
+ 			goto err;
+ 
+ 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
+-		vec[i].iov_base = (void __user *) page_address(page);
++		vec[i].iov_base = (__force void __user *) page_address(page);
+ 		vec[i].iov_len = this_len;
+ 		pages[i] = page;
+ 		spd.nr_pages++;
+@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+ int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
+ 	while (!pipe->nrbufs) {
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			return 0;
+ 
+-		if (!pipe->waiting_writers && sd->num_spliced)
++		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
+ 			return 0;
+ 
+ 		if (sd->flags & SPLICE_F_NONBLOCK)
+@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
+ 		 * out of the pipe right after the splice_to_pipe(). So set
+ 		 * PIPE_READERS appropriately.
+ 		 */
+-		pipe->readers = 1;
++		atomic_set(&pipe->readers, 1);
+ 
+ 		current->splice_pipe = pipe;
+ 	}
+@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			if (flags & SPLICE_F_NONBLOCK) {
+ 				ret = -EAGAIN;
+ 				break;
+@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
+ 	pipe_lock(pipe);
+ 
+ 	while (pipe->nrbufs >= PIPE_BUFFERS) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			ret = -EPIPE;
+ 			break;
+@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -1789,14 +1789,14 @@ retry:
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+ 			break;
+ 		}
+ 
+-		if (!ipipe->nrbufs && !ipipe->writers)
++		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
+ 			break;
+ 
+ 		/*
+@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
+ 	 * return EAGAIN if we have the potential of some data in the
+ 	 * future, otherwise just return 0
+ 	 */
+-	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
++	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
+ 		ret = -EAGAIN;
+ 
+ 	pipe_unlock(ipipe);
+diff -urNp linux-2.6.32.13/fs/sysfs/file.c linux-2.6.32.13/fs/sysfs/file.c
+--- linux-2.6.32.13/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/sysfs/file.c	2010-05-15 13:21:17.818603295 -0400
+@@ -53,7 +53,7 @@ struct sysfs_buffer {
+ 	size_t			count;
+ 	loff_t			pos;
+ 	char			* page;
+-	struct sysfs_ops	* ops;
++	const struct sysfs_ops	* ops;
+ 	struct mutex		mutex;
+ 	int			needs_read_fill;
+ 	int			event;
+@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int ret = 0;
+ 	ssize_t count;
+ 
+@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int rc;
+ 
+ 	/* need attr_sd for attr and ops, its parent for kobj */
+@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
+ 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+ 	struct sysfs_buffer *buffer;
+-	struct sysfs_ops *ops;
++	const struct sysfs_ops *ops;
+ 	int error = -EACCES;
+ 	char *p;
+ 
+diff -urNp linux-2.6.32.13/fs/sysfs/symlink.c linux-2.6.32.13/fs/sysfs/symlink.c
+--- linux-2.6.32.13/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/sysfs/symlink.c	2010-05-15 13:21:17.822590321 -0400
+@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
+ 
+ static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
+ {
+-	char *page = nd_get_link(nd);
++	const char *page = nd_get_link(nd);
+ 	if (!IS_ERR(page))
+ 		free_page((unsigned long)page);
+ }
+diff -urNp linux-2.6.32.13/fs/udf/balloc.c linux-2.6.32.13/fs/udf/balloc.c
+--- linux-2.6.32.13/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/udf/balloc.c	2010-05-15 13:21:17.834616935 -0400
+@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
+ 			  count, partmap->s_partition_len);
+@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
+ 			  partmap->s_partition_len);
+diff -urNp linux-2.6.32.13/fs/udf/misc.c linux-2.6.32.13/fs/udf/misc.c
+--- linux-2.6.32.13/fs/udf/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/udf/misc.c	2010-05-15 13:21:17.834616935 -0400
+@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
+ 		iinfo->i_lenEAttr += size;
+ 		return (struct genericFormat *)&ea[offset];
+ 	}
+-	if (loc & 0x02)
+-		;
++	if (loc & 0x02) {
++	}
+ 
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.13/fs/udf/udfdecl.h linux-2.6.32.13/fs/udf/udfdecl.h
+--- linux-2.6.32.13/fs/udf/udfdecl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/udf/udfdecl.h	2010-05-15 13:21:17.859848219 -0400
+@@ -26,7 +26,7 @@ do { \
+ 	printk(f, ##a); \
+ } while (0)
+ #else
+-#define udf_debug(f, a...) /**/
++#define udf_debug(f, a...) do {} while (0)
+ #endif
+ 
+ #define udf_info(f, a...) \
+diff -urNp linux-2.6.32.13/fs/utimes.c linux-2.6.32.13/fs/utimes.c
+--- linux-2.6.32.13/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/utimes.c	2010-05-15 13:21:17.859848219 -0400
+@@ -1,6 +1,7 @@
+ #include <linux/compiler.h>
+ #include <linux/file.h>
+ #include <linux/fs.h>
++#include <linux/security.h>
+ #include <linux/linkage.h>
+ #include <linux/mount.h>
+ #include <linux/namei.h>
+@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
+ 				goto mnt_drop_write_and_out;
+ 		}
+ 	}
++
++	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
++		error = -EACCES;
++		goto mnt_drop_write_and_out;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	error = notify_change(path->dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
+diff -urNp linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c
+--- linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c	2010-05-15 13:21:17.862604779 -0400
+@@ -134,7 +134,7 @@ xfs_find_handle(
+ 	}
+ 
+ 	error = -EFAULT;
+-	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
++	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
+ 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
+ 		goto out_put;
+ 
+diff -urNp linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:38.453075413 -0400
++++ linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c	2010-05-15 13:21:17.866593235 -0400
+@@ -468,7 +468,7 @@ xfs_vn_put_link(
+ 	struct nameidata *nd,
+ 	void		*p)
+ {
+-	char		*s = nd_get_link(nd);
++	const char	*s = nd_get_link(nd);
+ 
+ 	if (!IS_ERR(s))
+ 		kfree(s);
+diff -urNp linux-2.6.32.13/fs/xfs/xfs_bmap.c linux-2.6.32.13/fs/xfs/xfs_bmap.c
+--- linux-2.6.32.13/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/fs/xfs/xfs_bmap.c	2010-05-15 13:21:17.902607196 -0400
+@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
+ 	int			nmap,
+ 	int			ret_nmap);
+ #else
+-#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
++#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
+ #endif /* DEBUG */
+ 
+ #if defined(XFS_RW_TRACE)
+diff -urNp linux-2.6.32.13/grsecurity/gracl_alloc.c linux-2.6.32.13/grsecurity/gracl_alloc.c
+--- linux-2.6.32.13/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_alloc.c	2010-05-15 13:21:17.902607196 -0400
+@@ -0,0 +1,105 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++
++static unsigned long alloc_stack_next = 1;
++static unsigned long alloc_stack_size = 1;
++static void **alloc_stack;
++
++static __inline__ int
++alloc_pop(void)
++{
++	if (alloc_stack_next == 1)
++		return 0;
++
++	kfree(alloc_stack[alloc_stack_next - 2]);
++
++	alloc_stack_next--;
++
++	return 1;
++}
++
++static __inline__ int
++alloc_push(void *buf)
++{
++	if (alloc_stack_next >= alloc_stack_size)
++		return 1;
++
++	alloc_stack[alloc_stack_next - 1] = buf;
++
++	alloc_stack_next++;
++
++	return 0;
++}
++
++void *
++acl_alloc(unsigned long len)
++{
++	void *ret = NULL;
++
++	if (!len || len > PAGE_SIZE)
++		goto out;
++
++	ret = kmalloc(len, GFP_KERNEL);
++
++	if (ret) {
++		if (alloc_push(ret)) {
++			kfree(ret);
++			ret = NULL;
++		}
++	}
++
++out:
++	return ret;
++}
++
++void *
++acl_alloc_num(unsigned long num, unsigned long len)
++{
++	if (!len || (num > (PAGE_SIZE / len)))
++		return NULL;
++
++	return acl_alloc(num * len);
++}
++
++void
++acl_free_all(void)
++{
++	if (gr_acl_is_enabled() || !alloc_stack)
++		return;
++
++	while (alloc_pop()) ;
++
++	if (alloc_stack) {
++		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
++			kfree(alloc_stack);
++		else
++			vfree(alloc_stack);
++	}
++
++	alloc_stack = NULL;
++	alloc_stack_size = 1;
++	alloc_stack_next = 1;
++
++	return;
++}
++
++int
++acl_alloc_stack_init(unsigned long size)
++{
++	if ((size * sizeof (void *)) <= PAGE_SIZE)
++		alloc_stack =
++		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
++	else
++		alloc_stack = (void **) vmalloc(size * sizeof (void *));
++
++	alloc_stack_size = size;
++
++	if (!alloc_stack)
++		return 0;
++	else
++		return 1;
++}
+diff -urNp linux-2.6.32.13/grsecurity/gracl.c linux-2.6.32.13/grsecurity/gracl.c
+--- linux-2.6.32.13/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,3897 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/mount.h>
++#include <linux/tty.h>
++#include <linux/proc_fs.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/types.h>
++#include <linux/sysctl.h>
++#include <linux/netdevice.h>
++#include <linux/ptrace.h>
++#include <linux/gracl.h>
++#include <linux/gralloc.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/pid_namespace.h>
++#include <linux/fdtable.h>
++#include <linux/percpu.h>
++
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++
++static struct acl_role_db acl_role_set;
++static struct name_db name_set;
++static struct inodev_db inodev_set;
++
++/* for keeping track of userspace pointers used for subjects, so we
++   can share references in the kernel as well
++*/
++
++static struct dentry *real_root;
++static struct vfsmount *real_root_mnt;
++
++static struct acl_subj_map_db subj_map_set;
++
++static struct acl_role_label *default_role;
++
++static struct acl_role_label *role_list;
++
++static u16 acl_sp_role_value;
++
++extern char *gr_shared_page[4];
++static DECLARE_MUTEX(gr_dev_sem);
++DEFINE_RWLOCK(gr_inode_lock);
++
++struct gr_arg *gr_usermode;
++
++static unsigned int gr_status __read_only = GR_STATUS_INIT;
++
++extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
++extern void gr_clear_learn_entries(void);
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++extern void gr_log_resource(const struct task_struct *task,
++			    const int res, const unsigned long wanted, const int gt);
++#endif
++
++unsigned char *gr_system_salt;
++unsigned char *gr_system_sum;
++
++static struct sprole_pw **acl_special_roles = NULL;
++static __u16 num_sprole_pws = 0;
++
++static struct acl_role_label *kernel_role = NULL;
++
++static unsigned int gr_auth_attempts = 0;
++static unsigned long gr_auth_expires = 0UL;
++
++extern struct vfsmount *sock_mnt;
++extern struct vfsmount *pipe_mnt;
++extern struct vfsmount *shm_mnt;
++#ifdef CONFIG_HUGETLBFS
++extern struct vfsmount *hugetlbfs_vfsmount;
++#endif
++
++static struct acl_object_label *fakefs_obj;
++
++extern int gr_init_uidset(void);
++extern void gr_free_uidset(void);
++extern void gr_remove_uid(uid_t uid);
++extern int gr_find_uid(uid_t uid);
++
++__inline__ int
++gr_acl_is_enabled(void)
++{
++	return (gr_status & GR_READY);
++}
++
++char gr_roletype_to_char(void)
++{
++	switch (current->role->roletype &
++		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
++		 GR_ROLE_SPECIAL)) {
++	case GR_ROLE_DEFAULT:
++		return 'D';
++	case GR_ROLE_USER:
++		return 'U';
++	case GR_ROLE_GROUP:
++		return 'G';
++	case GR_ROLE_SPECIAL:
++		return 'S';
++	}
++
++	return 'X';
++}
++
++__inline__ int
++gr_acl_tpe_check(void)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++	if (current->role->roletype & GR_ROLE_TPE)
++		return 1;
++	else
++		return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (inode && S_ISBLK(inode->i_mode) &&
++	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
++	    !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++static int
++gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
++{
++	if (likely(lena != lenb))
++		return 0;
++
++	return !memcmp(a, b, lena);
++}
++
++static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++	                   struct dentry *root, struct vfsmount *rootmnt,
++			   char *buffer, int buflen)
++{
++	char * end = buffer+buflen;
++	char * retval;
++	int namelen;
++
++	*--end = '\0';
++	buflen--;
++
++	if (buflen < 1)
++		goto Elong;
++	/* Get '/' right */
++	retval = end-1;
++	*retval = '/';
++
++	for (;;) {
++		struct dentry * parent;
++
++		if (dentry == root && vfsmnt == rootmnt)
++			break;
++		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
++			/* Global root? */
++			spin_lock(&vfsmount_lock);
++			if (vfsmnt->mnt_parent == vfsmnt) {
++				spin_unlock(&vfsmount_lock);
++				goto global_root;
++			}
++			dentry = vfsmnt->mnt_mountpoint;
++			vfsmnt = vfsmnt->mnt_parent;
++			spin_unlock(&vfsmount_lock);
++			continue;
++		}
++		parent = dentry->d_parent;
++		prefetch(parent);
++		namelen = dentry->d_name.len;
++		buflen -= namelen + 1;
++		if (buflen < 0)
++			goto Elong;
++		end -= namelen;
++		memcpy(end, dentry->d_name.name, namelen);
++		*--end = '/';
++		retval = end;
++		dentry = parent;
++	}
++
++	return retval;
++
++global_root:
++	namelen = dentry->d_name.len;
++	buflen -= namelen;
++	if (buflen < 0)
++		goto Elong;
++	retval -= namelen-1;	/* hit the slash */
++	memcpy(retval, dentry->d_name.name, namelen);
++	return retval;
++Elong:
++	return ERR_PTR(-ENAMETOOLONG);
++}
++
++static char *
++gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
++{
++	char *retval;
++
++	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
++	if (unlikely(IS_ERR(retval)))
++		retval = strcpy(buf, "<path too long>");
++	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
++		retval[1] = '\0';
++
++	return retval;
++}
++
++static char *
++__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++		char *buf, int buflen)
++{
++	char *res;
++
++	/* we can use real_root, real_root_mnt, because this is only called
++	   by the RBAC system */
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
++
++	return res;
++}
++
++static char *
++d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++	    char *buf, int buflen)
++{
++	char *res;
++	struct dentry *root;
++	struct vfsmount *rootmnt;
++	struct task_struct *reaper = &init_task;
++
++	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
++	read_lock(&reaper->fs->lock);
++	root = dget(reaper->fs->root.dentry);
++	rootmnt = mntget(reaper->fs->root.mnt);
++	read_unlock(&reaper->fs->lock);
++
++	spin_lock(&dcache_lock);
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
++	spin_unlock(&dcache_lock);
++
++	dput(root);
++	mntput(rootmnt);
++	return res;
++}
++
++static char *
++gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	char *ret;
++	spin_lock(&dcache_lock);
++	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++	spin_unlock(&dcache_lock);
++	return ret;
++}
++
++char *
++gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++}
++
++char *
++gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++__inline__ __u32
++to_gr_audit(const __u32 reqmode)
++{
++	/* masks off auditable permission flags, then shifts them to create
++	   auditing flags, and adds the special case of append auditing if
++	   we're requesting write */
++	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
++}
++
++struct acl_subject_label *
++lookup_subject_map(const struct acl_subject_label *userp)
++{
++	unsigned int index = shash(userp, subj_map_set.s_size);
++	struct subject_map *match;
++
++	match = subj_map_set.s_hash[index];
++
++	while (match && match->user != userp)
++		match = match->next;
++
++	if (match != NULL)
++		return match->kernel;
++	else
++		return NULL;
++}
++
++static void
++insert_subj_map_entry(struct subject_map *subjmap)
++{
++	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
++	struct subject_map **curr;
++
++	subjmap->prev = NULL;
++
++	curr = &subj_map_set.s_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = subjmap;
++
++	subjmap->next = *curr;
++	*curr = subjmap;
++
++	return;
++}
++
++static struct acl_role_label *
++lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
++		      const gid_t gid)
++{
++	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
++	struct acl_role_label *match;
++	struct role_allowed_ip *ipp;
++	unsigned int x;
++
++	match = acl_role_set.r_hash[index];
++
++	while (match) {
++		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
++			for (x = 0; x < match->domain_child_num; x++) {
++				if (match->domain_children[x] == uid)
++					goto found;
++			}
++		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
++			break;
++		match = match->next;
++	}
++found:
++	if (match == NULL) {
++	      try_group:
++		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
++		match = acl_role_set.r_hash[index];
++
++		while (match) {
++			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
++				for (x = 0; x < match->domain_child_num; x++) {
++					if (match->domain_children[x] == gid)
++						goto found2;
++				}
++			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
++				break;
++			match = match->next;
++		}
++found2:
++		if (match == NULL)
++			match = default_role;
++		if (match->allowed_ips == NULL)
++			return match;
++		else {
++			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++				if (likely
++				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++				     (ntohl(ipp->addr) & ipp->netmask)))
++					return match;
++			}
++			match = default_role;
++		}
++	} else if (match->allowed_ips == NULL) {
++		return match;
++	} else {
++		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++			if (likely
++			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++			     (ntohl(ipp->addr) & ipp->netmask)))
++				return match;
++		}
++		goto try_group;
++	}
++
++	return match;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label(const ino_t ino, const dev_t dev,
++		      const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
++			  const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct name_entry *
++lookup_name_entry(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
++		match = match->next;
++
++	return match;
++}
++
++static struct name_entry *
++lookup_name_entry_create(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 !match->deleted))
++		match = match->next;
++
++	if (match && match->deleted)
++		return match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 match->deleted))
++		match = match->next;
++
++	if (match && !match->deleted)
++		return match;
++	else
++		return NULL;
++}
++
++static struct inodev_entry *
++lookup_inodev_entry(const ino_t ino, const dev_t dev)
++{
++	unsigned int index = fhash(ino, dev, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
++		match = match->next;
++
++	return match;
++}
++
++static void
++insert_inodev_entry(struct inodev_entry *entry)
++{
++	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
++				    inodev_set.i_size);
++	struct inodev_entry **curr;
++
++	entry->prev = NULL;
++
++	curr = &inodev_set.i_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = entry;
++	
++	entry->next = *curr;
++	*curr = entry;
++
++	return;
++}
++
++static void
++__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
++{
++	unsigned int index =
++	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
++	struct acl_role_label **curr;
++	struct acl_role_label *tmp;
++
++	curr = &acl_role_set.r_hash[index];
++
++	/* if role was already inserted due to domains and already has
++	   a role in the same bucket as it attached, then we need to
++	   combine these two buckets
++	*/
++	if (role->next) {
++		tmp = role->next;
++		while (tmp->next)
++			tmp = tmp->next;
++		tmp->next = *curr;
++	} else
++		role->next = *curr;
++	*curr = role;
++
++	return;
++}
++
++static void
++insert_acl_role_label(struct acl_role_label *role)
++{
++	int i;
++
++	if (role_list == NULL) {
++		role_list = role;
++		role->prev = NULL;
++	} else {
++		role->prev = role_list;
++		role_list = role;
++	}
++	
++	/* used for hash chains */
++	role->next = NULL;
++
++	if (role->roletype & GR_ROLE_DOMAIN) {
++		for (i = 0; i < role->domain_child_num; i++)
++			__insert_acl_role_label(role, role->domain_children[i]);
++	} else
++		__insert_acl_role_label(role, role->uidgid);
++}
++					
++static int
++insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
++{
++	struct name_entry **curr, *nentry;
++	struct inodev_entry *ientry;
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++
++	curr = &name_set.n_hash[index];
++
++	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
++		curr = &((*curr)->next);
++
++	if (*curr != NULL)
++		return 1;
++
++	nentry = acl_alloc(sizeof (struct name_entry));
++	if (nentry == NULL)
++		return 0;
++	ientry = acl_alloc(sizeof (struct inodev_entry));
++	if (ientry == NULL)
++		return 0;
++	ientry->nentry = nentry;
++
++	nentry->key = key;
++	nentry->name = name;
++	nentry->inode = inode;
++	nentry->device = device;
++	nentry->len = len;
++	nentry->deleted = deleted;
++
++	nentry->prev = NULL;
++	curr = &name_set.n_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = nentry;
++	nentry->next = *curr;
++	*curr = nentry;
++
++	/* insert us into the table searchable by inode/dev */
++	insert_inodev_entry(ientry);
++
++	return 1;
++}
++
++static void
++insert_acl_obj_label(struct acl_object_label *obj,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index =
++	    fhash(obj->inode, obj->device, subj->obj_hash_size);
++	struct acl_object_label **curr;
++
++	
++	obj->prev = NULL;
++
++	curr = &subj->obj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++static void
++insert_acl_subj_label(struct acl_subject_label *obj,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
++	struct acl_subject_label **curr;
++
++	obj->prev = NULL;
++
++	curr = &role->subj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
++
++static void *
++create_table(__u32 * len, int elementsize)
++{
++	unsigned int table_sizes[] = {
++		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
++		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
++		4194301, 8388593, 16777213, 33554393, 67108859
++	};
++	void *newtable = NULL;
++	unsigned int pwr = 0;
++
++	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
++	       table_sizes[pwr] <= *len)
++		pwr++;
++
++	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
++		return newtable;
++
++	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
++		newtable =
++		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
++	else
++		newtable = vmalloc(table_sizes[pwr] * elementsize);
++
++	*len = table_sizes[pwr];
++
++	return newtable;
++}
++
++static int
++init_variables(const struct gr_arg *arg)
++{
++	struct task_struct *reaper = &init_task;
++	unsigned int stacksize;
++
++	subj_map_set.s_size = arg->role_db.num_subjects;
++	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
++	name_set.n_size = arg->role_db.num_objects;
++	inodev_set.i_size = arg->role_db.num_objects;
++
++	if (!subj_map_set.s_size || !acl_role_set.r_size ||
++	    !name_set.n_size || !inodev_set.i_size)
++		return 1;
++
++	if (!gr_init_uidset())
++		return 1;
++
++	/* set up the stack that holds allocation info */
++
++	stacksize = arg->role_db.num_pointers + 5;
++
++	if (!acl_alloc_stack_init(stacksize))
++		return 1;
++
++	/* grab reference for the real root dentry and vfsmount */
++	read_lock(&reaper->fs->lock);
++	real_root_mnt = mntget(reaper->fs->root.mnt);
++	real_root = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++	
++	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
++	if (fakefs_obj == NULL)
++		return 1;
++	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
++
++	subj_map_set.s_hash =
++	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
++	acl_role_set.r_hash =
++	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
++	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
++	inodev_set.i_hash =
++	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
++
++	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
++	    !name_set.n_hash || !inodev_set.i_hash)
++		return 1;
++
++	memset(subj_map_set.s_hash, 0,
++	       sizeof(struct subject_map *) * subj_map_set.s_size);
++	memset(acl_role_set.r_hash, 0,
++	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
++	memset(name_set.n_hash, 0,
++	       sizeof (struct name_entry *) * name_set.n_size);
++	memset(inodev_set.i_hash, 0,
++	       sizeof (struct inodev_entry *) * inodev_set.i_size);
++
++	return 0;
++}
++
++/* free information not needed after startup
++   currently contains user->kernel pointer mappings for subjects
++*/
++
++static void
++free_init_variables(void)
++{
++	__u32 i;
++
++	if (subj_map_set.s_hash) {
++		for (i = 0; i < subj_map_set.s_size; i++) {
++			if (subj_map_set.s_hash[i]) {
++				kfree(subj_map_set.s_hash[i]);
++				subj_map_set.s_hash[i] = NULL;
++			}
++		}
++
++		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
++		    PAGE_SIZE)
++			kfree(subj_map_set.s_hash);
++		else
++			vfree(subj_map_set.s_hash);
++	}
++
++	return;
++}
++
++static void
++free_variables(void)
++{
++	struct acl_subject_label *s;
++	struct acl_role_label *r;
++	struct task_struct *task, *task2;
++	unsigned int x;
++
++	gr_clear_learn_entries();
++
++	read_lock(&tasklist_lock);
++	do_each_thread(task2, task) {
++		task->acl_sp_role = 0;
++		task->acl_role_id = 0;
++		task->acl = NULL;
++		task->role = NULL;
++	} while_each_thread(task2, task);
++	read_unlock(&tasklist_lock);
++
++	/* release the reference to the real root dentry and vfsmount */
++	if (real_root)
++		dput(real_root);
++	real_root = NULL;
++	if (real_root_mnt)
++		mntput(real_root_mnt);
++	real_root_mnt = NULL;
++
++	/* free all object hash tables */
++
++	FOR_EACH_ROLE_START(r)
++		if (r->subj_hash == NULL)
++			goto next_role;
++		FOR_EACH_SUBJECT_START(r, s, x)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_SUBJECT_END(s, x)
++		FOR_EACH_NESTED_SUBJECT_START(r, s)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_NESTED_SUBJECT_END(s)
++		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
++			kfree(r->subj_hash);
++		else
++			vfree(r->subj_hash);
++		r->subj_hash = NULL;
++next_role:
++	FOR_EACH_ROLE_END(r)
++
++	acl_free_all();
++
++	if (acl_role_set.r_hash) {
++		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
++		    PAGE_SIZE)
++			kfree(acl_role_set.r_hash);
++		else
++			vfree(acl_role_set.r_hash);
++	}
++	if (name_set.n_hash) {
++		if ((name_set.n_size * sizeof (struct name_entry *)) <=
++		    PAGE_SIZE)
++			kfree(name_set.n_hash);
++		else
++			vfree(name_set.n_hash);
++	}
++
++	if (inodev_set.i_hash) {
++		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
++		    PAGE_SIZE)
++			kfree(inodev_set.i_hash);
++		else
++			vfree(inodev_set.i_hash);
++	}
++
++	gr_free_uidset();
++
++	memset(&name_set, 0, sizeof (struct name_db));
++	memset(&inodev_set, 0, sizeof (struct inodev_db));
++	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
++	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
++
++	default_role = NULL;
++	role_list = NULL;
++
++	return;
++}
++
++static __u32
++count_user_objs(struct acl_object_label *userp)
++{
++	struct acl_object_label o_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			break;
++
++		userp = o_tmp.prev;
++		num++;
++	}
++
++	return num;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
++
++static int
++copy_user_glob(struct acl_object_label *obj)
++{
++	struct acl_object_label *g_tmp, **guser;
++	unsigned int len;
++	char *tmp;
++
++	if (obj->globbed == NULL)
++		return 0;
++
++	guser = &obj->globbed;
++	while (*guser) {
++		g_tmp = (struct acl_object_label *)
++			acl_alloc(sizeof (struct acl_object_label));
++		if (g_tmp == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(g_tmp, *guser,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		len = strnlen_user(g_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, g_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		g_tmp->filename = tmp;
++
++		*guser = g_tmp;
++		guser = &(g_tmp->next);
++	}
++
++	return 0;
++}
++
++static int
++copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
++	       struct acl_role_label *role)
++{
++	struct acl_object_label *o_tmp;
++	unsigned int len;
++	int ret;
++	char *tmp;
++
++	while (userp) {
++		if ((o_tmp = (struct acl_object_label *)
++		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		userp = o_tmp->prev;
++
++		len = strnlen_user(o_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, o_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		o_tmp->filename = tmp;
++
++		insert_acl_obj_label(o_tmp, subj);
++		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
++				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
++			return -ENOMEM;
++
++		ret = copy_user_glob(o_tmp);
++		if (ret)
++			return ret;
++
++		if (o_tmp->nested) {
++			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
++			if (IS_ERR(o_tmp->nested))
++				return PTR_ERR(o_tmp->nested);
++
++			/* insert into nested subject list */
++			o_tmp->nested->next = role->hash->first;
++			role->hash->first = o_tmp->nested;
++		}
++	}
++
++	return 0;
++}
++
++static __u32
++count_user_subjs(struct acl_subject_label *userp)
++{
++	struct acl_subject_label s_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&s_tmp, userp,
++				   sizeof (struct acl_subject_label)))
++			break;
++
++		userp = s_tmp.prev;
++		/* do not count nested subjects against this count, since
++		   they are not included in the hash table, but are
++		   attached to objects.  We have already counted
++		   the subjects in userspace for the allocation 
++		   stack
++		*/
++		if (!(s_tmp.mode & GR_NESTED))
++			num++;
++	}
++
++	return num;
++}
++
++static int
++copy_user_allowedips(struct acl_role_label *rolep)
++{
++	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
++
++	ruserip = rolep->allowed_ips;
++
++	while (ruserip) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_allowed_ip *)
++		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, ruserip,
++				   sizeof (struct role_allowed_ip)))
++			return -EFAULT;
++
++		ruserip = rtmp->prev;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->allowed_ips = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!ruserip)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_transitions(struct acl_role_label *rolep)
++{
++	struct role_transition *rusertp, *rtmp = NULL, *rlast;
++	
++	unsigned int len;
++	char *tmp;
++
++	rusertp = rolep->transitions;
++
++	while (rusertp) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_transition *)
++		     acl_alloc(sizeof (struct role_transition))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, rusertp,
++				   sizeof (struct role_transition)))
++			return -EFAULT;
++
++		rusertp = rtmp->prev;
++
++		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, rtmp->rolename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		rtmp->rolename = tmp;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->transitions = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!rusertp)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
++	unsigned int len;
++	char *tmp;
++	__u32 num_objs;
++	struct acl_ip_label **i_tmp, *i_utmp2;
++	struct gr_hash_struct ghash;
++	struct subject_map *subjmap;
++	unsigned int i_num;
++	int err;
++
++	s_tmp = lookup_subject_map(userp);
++
++	/* we've already copied this subject into the kernel, just return
++	   the reference to it, and don't copy it over again
++	*/
++	if (s_tmp)
++		return(s_tmp);
++
++	if ((s_tmp = (struct acl_subject_label *)
++	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
++	if (subjmap == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap->user = userp;
++	subjmap->kernel = s_tmp;
++	insert_subj_map_entry(subjmap);
++
++	if (copy_from_user(s_tmp, userp,
++			   sizeof (struct acl_subject_label)))
++		return ERR_PTR(-EFAULT);
++
++	len = strnlen_user(s_tmp->filename, PATH_MAX);
++
++	if (!len || len >= PATH_MAX)
++		return ERR_PTR(-EINVAL);
++
++	if ((tmp = (char *) acl_alloc(len)) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	if (copy_from_user(tmp, s_tmp->filename, len))
++		return ERR_PTR(-EFAULT);
++	tmp[len-1] = '\0';
++	s_tmp->filename = tmp;
++
++	if (!strcmp(s_tmp->filename, "/"))
++		role->root_label = s_tmp;
++
++	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
++		return ERR_PTR(-EFAULT);
++
++	/* copy user and group transition tables */
++
++	if (s_tmp->user_trans_num) {
++		uid_t *uidlist;
++
++		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
++		if (uidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->user_transitions = uidlist;
++	}
++
++	if (s_tmp->group_trans_num) {
++		gid_t *gidlist;
++
++		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
++		if (gidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->group_transitions = gidlist;
++	}
++
++	/* set up object hash table */
++	num_objs = count_user_objs(ghash.first);
++
++	s_tmp->obj_hash_size = num_objs;
++	s_tmp->obj_hash =
++	    (struct acl_object_label **)
++	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
++
++	if (!s_tmp->obj_hash)
++		return ERR_PTR(-ENOMEM);
++
++	memset(s_tmp->obj_hash, 0,
++	       s_tmp->obj_hash_size *
++	       sizeof (struct acl_object_label *));
++
++	/* add in objects */
++	err = copy_user_objs(ghash.first, s_tmp, role);
++
++	if (err)
++		return ERR_PTR(err);
++
++	/* set pointer for parent subject */
++	if (s_tmp->parent_subject) {
++		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
++
++		if (IS_ERR(s_tmp2))
++			return s_tmp2;
++
++		s_tmp->parent_subject = s_tmp2;
++	}
++
++	/* add in ip acls */
++
++	if (!s_tmp->ip_num) {
++		s_tmp->ips = NULL;
++		goto insert;
++	}
++
++	i_tmp =
++	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
++					       sizeof (struct acl_ip_label *));
++
++	if (!i_tmp)
++		return ERR_PTR(-ENOMEM);
++
++	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
++		*(i_tmp + i_num) =
++		    (struct acl_ip_label *)
++		    acl_alloc(sizeof (struct acl_ip_label));
++		if (!*(i_tmp + i_num))
++			return ERR_PTR(-ENOMEM);
++
++		if (copy_from_user
++		    (&i_utmp2, s_tmp->ips + i_num,
++		     sizeof (struct acl_ip_label *)))
++			return ERR_PTR(-EFAULT);
++
++		if (copy_from_user
++		    (*(i_tmp + i_num), i_utmp2,
++		     sizeof (struct acl_ip_label)))
++			return ERR_PTR(-EFAULT);
++		
++		if ((*(i_tmp + i_num))->iface == NULL)
++			continue;
++
++		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
++		if (!len || len >= IFNAMSIZ)
++			return ERR_PTR(-EINVAL);
++		tmp = acl_alloc(len);
++		if (tmp == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
++			return ERR_PTR(-EFAULT);
++		(*(i_tmp + i_num))->iface = tmp;
++	}
++
++	s_tmp->ips = i_tmp;
++
++insert:
++	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
++			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
++		return ERR_PTR(-ENOMEM);
++
++	return s_tmp;
++}
++
++static int
++copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label s_pre;
++	struct acl_subject_label * ret;
++	int err;
++
++	while (userp) {
++		if (copy_from_user(&s_pre, userp,
++				   sizeof (struct acl_subject_label)))
++			return -EFAULT;
++		
++		/* do not add nested subjects here, add
++		   while parsing objects
++		*/
++
++		if (s_pre.mode & GR_NESTED) {
++			userp = s_pre.prev;
++			continue;
++		}
++
++		ret = do_copy_user_subj(userp, role);
++
++		err = PTR_ERR(ret);
++		if (IS_ERR(ret))
++			return err;
++
++		insert_acl_subj_label(ret, role);
++
++		userp = s_pre.prev;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_acl(struct gr_arg *arg)
++{
++	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
++	struct sprole_pw *sptmp;
++	struct gr_hash_struct *ghash;
++	uid_t *domainlist;
++	unsigned int r_num;
++	unsigned int len;
++	char *tmp;
++	int err = 0;
++	__u16 i;
++	__u32 num_subjs;
++
++	/* we need a default and kernel role */
++	if (arg->role_db.num_roles < 2)
++		return -EINVAL;
++
++	/* copy special role authentication info from userspace */
++
++	num_sprole_pws = arg->num_sprole_pws;
++	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
++
++	if (!acl_special_roles) {
++		err = -ENOMEM;
++		goto cleanup;
++	}
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
++		if (!sptmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(sptmp, arg->sprole_pws + i,
++				   sizeof (struct sprole_pw))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len =
++		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(tmp, sptmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++		printk(KERN_ALERT "Copying special role %s\n", tmp);
++#endif
++		sptmp->rolename = tmp;
++		acl_special_roles[i] = sptmp;
++	}
++
++	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
++
++	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
++		r_tmp = acl_alloc(sizeof (struct acl_role_label));
++
++		if (!r_tmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(&r_utmp2, r_utmp + r_num,
++				   sizeof (struct acl_role_label *))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		if (copy_from_user(r_tmp, r_utmp2,
++				   sizeof (struct acl_role_label))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= PATH_MAX) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(tmp, r_tmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++		r_tmp->rolename = tmp;
++
++		if (!strcmp(r_tmp->rolename, "default")
++		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
++			default_role = r_tmp;
++		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
++			kernel_role = r_tmp;
++		}
++
++		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		r_tmp->hash = ghash;
++
++		num_subjs = count_user_subjs(r_tmp->hash->first);
++
++		r_tmp->subj_hash_size = num_subjs;
++		r_tmp->subj_hash =
++		    (struct acl_subject_label **)
++		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
++
++		if (!r_tmp->subj_hash) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		err = copy_user_allowedips(r_tmp);
++		if (err)
++			goto cleanup;
++
++		/* copy domain info */
++		if (r_tmp->domain_children != NULL) {
++			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
++			if (domainlist == NULL) {
++				err = -ENOMEM;
++				goto cleanup;
++			}
++			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
++				err = -EFAULT;
++				goto cleanup;
++			}
++			r_tmp->domain_children = domainlist;
++		}
++
++		err = copy_user_transitions(r_tmp);
++		if (err)
++			goto cleanup;
++
++		memset(r_tmp->subj_hash, 0,
++		       r_tmp->subj_hash_size *
++		       sizeof (struct acl_subject_label *));
++
++		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
++
++		if (err)
++			goto cleanup;
++
++		/* set nested subject list to null */
++		r_tmp->hash->first = NULL;
++
++		insert_acl_role_label(r_tmp);
++	}
++
++	goto return_err;
++      cleanup:
++	free_variables();
++      return_err:
++	return err;
++
++}
++
++static int
++gracl_init(struct gr_arg *args)
++{
++	int error = 0;
++
++	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
++	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
++
++	if (init_variables(args)) {
++		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
++		error = -ENOMEM;
++		free_variables();
++		goto out;
++	}
++
++	error = copy_user_acl(args);
++	free_init_variables();
++	if (error) {
++		free_variables();
++		goto out;
++	}
++
++	if ((error = gr_set_acls(0))) {
++		free_variables();
++		goto out;
++	}
++
++	pax_open_kernel();
++	gr_status |= GR_READY;
++	pax_close_kernel();
++
++      out:
++	return error;
++}
++
++/* derived from glibc fnmatch() 0: match, 1: no match*/
++
++static int
++glob_match(const char *p, const char *n)
++{
++	char c;
++
++	while ((c = *p++) != '\0') {
++	switch (c) {
++		case '?':
++			if (*n == '\0')
++				return 1;
++			else if (*n == '/')
++				return 1;
++			break;
++		case '\\':
++			if (*n != c)
++				return 1;
++			break;
++		case '*':
++			for (c = *p++; c == '?' || c == '*'; c = *p++) {
++				if (*n == '/')
++					return 1;
++				else if (c == '?') {
++					if (*n == '\0')
++						return 1;
++					else
++						++n;
++				}
++			}
++			if (c == '\0') {
++				return 0;
++			} else {
++				const char *endp;
++
++				if ((endp = strchr(n, '/')) == NULL)
++					endp = n + strlen(n);
++
++				if (c == '[') {
++					for (--p; n < endp; ++n)
++						if (!glob_match(p, n))
++							return 0;
++				} else if (c == '/') {
++					while (*n != '\0' && *n != '/')
++						++n;
++					if (*n == '/' && !glob_match(p, n + 1))
++						return 0;
++				} else {
++					for (--p; n < endp; ++n)
++						if (*n == c && !glob_match(p, n))
++							return 0;
++				}
++
++				return 1;
++			}
++		case '[':
++			{
++			int not;
++			char cold;
++
++			if (*n == '\0' || *n == '/')
++				return 1;
++
++			not = (*p == '!' || *p == '^');
++			if (not)
++				++p;
++
++			c = *p++;
++			for (;;) {
++				unsigned char fn = (unsigned char)*n;
++
++				if (c == '\0')
++					return 1;
++				else {
++					if (c == fn)
++						goto matched;
++					cold = c;
++					c = *p++;
++
++					if (c == '-' && *p != ']') {
++						unsigned char cend = *p++;
++
++						if (cend == '\0')
++							return 1;
++
++						if (cold <= fn && fn <= cend)
++							goto matched;
++
++						c = *p++;
++					}
++				}
++
++				if (c == ']')
++					break;
++			}
++			if (!not)
++				return 1;
++			break;
++		matched:
++			while (c != ']') {
++				if (c == '\0')
++					return 1;
++
++				c = *p++;
++			}
++			if (not)
++				return 1;
++		}
++		break;
++	default:
++		if (c != *n)
++			return 1;
++	}
++
++	++n;
++	}
++
++	if (*n == '\0')
++		return 0;
++
++	if (*n == '/')
++		return 0;
++
++	return 1;
++}
++
++static struct acl_object_label *
++chk_glob_label(struct acl_object_label *globbed,
++	struct dentry *dentry, struct vfsmount *mnt, char **path)
++{
++	struct acl_object_label *tmp;
++
++	if (*path == NULL)
++		*path = gr_to_filename_nolock(dentry, mnt);
++
++	tmp = globbed;
++
++	while (tmp) {
++		if (!glob_match(tmp->filename, *path))
++			return tmp;
++		tmp = tmp->next;
++	}
++
++	return NULL;
++}
++
++static struct acl_object_label *
++__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const ino_t curr_ino, const dev_t curr_dev,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	struct acl_subject_label *tmpsubj;
++	struct acl_object_label *retval;
++	struct acl_object_label *retval2;
++
++	tmpsubj = (struct acl_subject_label *) subj;
++	read_lock(&gr_inode_lock);
++	do {
++		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
++		if (retval) {
++			if (checkglob && retval->globbed) {
++				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
++						(struct vfsmount *)orig_mnt, path);
++				if (retval2)
++					retval = retval2;
++			}
++			break;
++		}
++	} while ((tmpsubj = tmpsubj->parent_subject));
++	read_unlock(&gr_inode_lock);
++
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const struct dentry *curr_dentry,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	return __full_lookup(orig_dentry, orig_mnt,
++			     curr_dentry->d_inode->i_ino, 
++			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
++}
++
++static struct acl_object_label *
++__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj, char *path, const int checkglob)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_object_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
++#ifdef CONFIG_HUGETLBFS
++	    mnt == hugetlbfs_vfsmount ||
++#endif
++		/* ignore Eric Biederman */
++	    IS_PRIVATE(l_dentry->d_inode))) {
++		retval = fakefs_obj;
++		goto out;
++	}
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++
++	if (retval == NULL)
++		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
++out:
++	spin_unlock(&dcache_lock);
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++		     const struct acl_subject_label *subj, char *path)
++{
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static struct acl_subject_label *
++chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	       const struct acl_role_label *role)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_subject_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			read_lock(&gr_inode_lock);
++			retval =
++				lookup_acl_subj_label(dentry->d_inode->i_ino,
++						dentry->d_inode->i_sb->s_dev, role);
++			read_unlock(&gr_inode_lock);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++					  dentry->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	read_lock(&gr_inode_lock);
++	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++				  dentry->d_inode->i_sb->s_dev, role);
++	read_unlock(&gr_inode_lock);
++
++	if (unlikely(retval == NULL)) {
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
++					  real_root->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++	}
++out:
++	spin_unlock(&dcache_lock);
++
++	return retval;
++}
++
++static void
++gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_sysctl(const char *path, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_id_change(const char type, const unsigned int real, 
++		       const unsigned int effective, const unsigned int fs)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       type, real, effective, fs, &task->signal->curr_ip);
++
++	return;
++}
++
++__u32
++gr_check_link(const struct dentry * new_dentry,
++	      const struct dentry * parent_dentry,
++	      const struct vfsmount * parent_mnt,
++	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
++{
++	struct acl_object_label *obj;
++	__u32 oldmode, newmode;
++	__u32 needmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (GR_CREATE | GR_LINK);
++
++	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
++	oldmode = obj->mode;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		oldmode |= (GR_CREATE | GR_LINK);
++
++	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID | GR_AUDIT_SETID;
++
++	newmode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    oldmode | needmode);
++
++	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
++			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
++			      GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
++		goto bad;
++
++	if ((oldmode & needmode) != needmode)
++		goto bad;
++
++	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
++	if ((newmode & needmode) != needmode)
++		goto bad;
++
++	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
++		return newmode;
++bad:
++	needmode = oldmode;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID;
++	
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		gr_log_learn(old_dentry, old_mnt, needmode);
++		return (GR_CREATE | GR_LINK);
++	} else if (newmode & GR_SUPPRESS)
++		return GR_SUPPRESS;
++	else
++		return 0;
++}
++
++__u32
++gr_search_file(const struct dentry * dentry, const __u32 mode,
++	       const struct vfsmount * mnt)
++{
++	__u32 retval = mode;
++	struct acl_subject_label *curracl;
++	struct acl_object_label *currobj;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	curracl = current->acl;
++
++	currobj = chk_obj_label(dentry, mnt, curracl);
++	retval = currobj->mode & mode;
++
++	if (unlikely
++	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
++	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		retval = new_mode;
++
++		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
++			new_mode |= GR_INHERIT;
++
++		if (!(mode & GR_NOLEARN))
++			gr_log_learn(dentry, mnt, new_mode);
++	}
++
++	return retval;
++}
++
++__u32
++gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
++		const struct vfsmount * mnt, const __u32 mode)
++{
++	struct name_entry *match;
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *curracl;
++	char *path;
++	__u32 retval;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	preempt_disable();
++	path = gr_to_filename_rbac(new_dentry, mnt);
++	match = lookup_name_entry_create(path);
++
++	if (!match)
++		goto check_parent;
++
++	curracl = current->acl;
++
++	read_lock(&gr_inode_lock);
++	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
++	read_unlock(&gr_inode_lock);
++
++	if (matchpo) {
++		if ((matchpo->mode & mode) !=
++		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
++		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++			__u32 new_mode = mode;
++
++			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++			gr_log_learn(new_dentry, mnt, new_mode);
++
++			preempt_enable();
++			return new_mode;
++		}
++		preempt_enable();
++		return (matchpo->mode & mode);
++	}
++
++      check_parent:
++	curracl = current->acl;
++
++	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
++	retval = matchpo->mode & mode;
++
++	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
++	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		gr_log_learn(new_dentry, mnt, new_mode);
++		preempt_enable();
++		return new_mode;
++	}
++
++	preempt_enable();
++	return retval;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY) || !task))
++		return 0;
++
++	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
++	    task->acl != current->acl)
++		return 1;
++
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	tsk->signal->used_accept = 0;
++	tsk->acl_sp_role = 0;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
++	tsk->signal->curr_ip = current->signal->curr_ip;
++	if (current->exec_file)
++		get_file(current->exec_file);
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
++	if (unlikely(current->signal->used_accept))
++		current->signal->curr_ip = 0;
++
++	return;
++}
++
++static void
++gr_set_proc_res(struct task_struct *task)
++{
++	struct acl_subject_label *proc;
++	unsigned short i;
++
++	proc = task->acl;
++
++	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
++		return;
++
++	for (i = 0; i < RLIM_NLIMITS; i++) {
++		if (!(proc->resmask & (1 << i)))
++			continue;
++
++		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
++		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
++	}
++
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	uid_t *uidlist;
++	int curuid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('u', real, effective, fs);
++
++	num = current->acl->user_trans_num;
++	uidlist = current->acl->user_transitions;
++
++	if (uidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->user_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				realok = 1;
++			if (effective == curuid)
++				effectiveok = 1;
++			if (fs == curuid)
++				fsok = 1;
++		}
++	} else if (current->acl->user_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				break;
++			if (effective == curuid)
++				break;
++			if (fs == curuid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	gid_t *gidlist;
++	int curgid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('g', real, effective, fs);
++
++	num = current->acl->group_trans_num;
++	gidlist = current->acl->group_transitions;
++
++	if (gidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->group_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				realok = 1;
++			if (effective == curgid)
++				effectiveok = 1;
++			if (fs == curgid)
++				fsok = 1;
++		}
++	} else if (current->acl->group_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				break;
++			if (effective == curgid)
++				break;
++			if (fs == curgid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++void
++gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
++{
++	struct acl_role_label *role = task->role;
++	struct acl_subject_label *subj = NULL;
++	struct acl_object_label *obj;
++	struct file *filp;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	filp = task->exec_file;
++
++	/* kernel process, we'll give them the kernel role */
++	if (unlikely(!filp)) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++		return;
++	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
++		role = lookup_acl_role_label(task, uid, gid);
++
++	/* perform subject lookup in possibly new role
++	   we can use this result below in the case where role == task->role
++	*/
++	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
++
++	/* if we changed uid/gid, but result in the same role
++	   and are using inheritance, don't lose the inherited subject
++	   if current subject is other than what normal lookup
++	   would result in, we arrived via inheritance, don't
++	   lose subject
++	*/
++	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
++				   (subj == task->acl)))
++		task->acl = subj;
++
++	task->role = role;
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++
++	gr_set_proc_res(task);
++
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	struct task_struct *task = current;
++	struct acl_subject_label *newacl;
++	struct acl_object_label *obj;
++	__u32 retmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	newacl = chk_subj_label(dentry, mnt, task->role);
++
++	task_lock(task);
++	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
++	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
++	     !(task->role->roletype & GR_ROLE_GOD) &&
++	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
++	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
++                task_unlock(task);
++		if (unsafe_share)
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
++		else
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
++		return -EACCES;
++	}
++	task_unlock(task);
++
++	obj = chk_obj_label(dentry, mnt, task->acl);
++	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (!(task->acl->mode & GR_INHERITLEARN) &&
++	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
++		if (obj->nested)
++			task->acl = obj->nested;
++		else
++			task->acl = newacl;
++	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
++		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(dentry, mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(dentry, mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++	gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++	return 0;
++}
++
++/* always called with valid inodev ptr */
++static void
++do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
++{
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *matchps;
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++
++	FOR_EACH_ROLE_START(role)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
++				matchpo->mode |= GR_DELETED;
++		FOR_EACH_SUBJECT_END(subj,x)
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if (subj->inode == ino && subj->device == dev)
++				subj->mode |= GR_DELETED;
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
++			matchps->mode |= GR_DELETED;
++	FOR_EACH_ROLE_END(role)
++
++	inodev->nentry->deleted = 1;
++
++	return;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	struct inodev_entry *inodev;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	write_lock(&gr_inode_lock);
++	inodev = lookup_inodev_entry(ino, dev);
++	if (inodev != NULL)
++		do_handle_delete(inodev, ino, dev);
++	write_unlock(&gr_inode_lock);
++
++	return;
++}
++
++static void
++update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
++		     const ino_t newinode, const dev_t newdevice,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			subj->obj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_obj_label(match, subj);
++	}
++
++	return;
++}
++
++static void
++update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
++		      const ino_t newinode, const dev_t newdevice,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			role->subj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_subj_label(match, role);
++	}
++
++	return;
++}
++
++static void
++update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
++		    const ino_t newinode, const dev_t newdevice)
++{
++	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != oldinode ||
++	       match->nentry->device != olddevice || !match->nentry->deleted))
++		match = match->next;
++
++	if (match && (match->nentry->inode == oldinode)
++	    && (match->nentry->device == olddevice) &&
++	    match->nentry->deleted) {
++		if (match->prev == NULL) {
++			inodev_set.i_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->nentry->inode = newinode;
++		match->nentry->device = newdevice;
++		match->nentry->deleted = 0;
++
++		insert_inodev_entry(match);
++	}
++
++	return;
++}
++
++static void
++do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
++		 const struct vfsmount *mnt)
++{
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++	
++	FOR_EACH_ROLE_START(role)
++		update_acl_subj_label(matchn->inode, matchn->device,
++				      dentry->d_inode->i_ino,
++				      dentry->d_inode->i_sb->s_dev, role);
++
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if ((subj->inode == dentry->d_inode->i_ino) &&
++			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
++				subj->inode = dentry->d_inode->i_ino;
++				subj->device = dentry->d_inode->i_sb->s_dev;
++			}
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			update_acl_obj_label(matchn->inode, matchn->device,
++					     dentry->d_inode->i_ino,
++					     dentry->d_inode->i_sb->s_dev, subj);
++		FOR_EACH_SUBJECT_END(subj,x)
++	FOR_EACH_ROLE_END(role)
++
++	update_inodev_entry(matchn->inode, matchn->device,
++			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
++
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	struct name_entry *matchn;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
++
++	if (unlikely((unsigned long)matchn)) {
++		write_lock(&gr_inode_lock);
++		do_handle_create(matchn, dentry, mnt);
++		write_unlock(&gr_inode_lock);
++	}
++	preempt_enable();
++
++	return;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	struct name_entry *matchn;
++	struct inodev_entry *inodev;
++
++	/* vfs_rename swaps the name and parent link for old_dentry and
++	   new_dentry
++	   at this point, old_dentry has the new name, parent link, and inode
++	   for the renamed file
++	   if a file is being replaced by a rename, new_dentry has the inode
++	   and name for the replaced file
++	*/
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
++
++	/* we wouldn't have to check d_inode if it weren't for
++	   NFS silly-renaming
++	 */
++
++	write_lock(&gr_inode_lock);
++	if (unlikely(replace && new_dentry->d_inode)) {
++		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
++					     new_dentry->d_inode->i_sb->s_dev);
++		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
++			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
++					 new_dentry->d_inode->i_sb->s_dev);
++	}
++
++	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
++				     old_dentry->d_inode->i_sb->s_dev);
++	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
++		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
++				 old_dentry->d_inode->i_sb->s_dev);
++
++	if (unlikely((unsigned long)matchn))
++		do_handle_create(matchn, old_dentry, mnt);
++
++	write_unlock(&gr_inode_lock);
++	preempt_enable();
++
++	return;
++}
++
++static int
++lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
++			 unsigned char **sum)
++{
++	struct acl_role_label *r;
++	struct role_allowed_ip *ipp;
++	struct role_transition *trans;
++	unsigned int i;
++	int found = 0;
++
++	/* check transition table */
++
++	for (trans = current->role->transitions; trans; trans = trans->next) {
++		if (!strcmp(rolename, trans->rolename)) {
++			found = 1;
++			break;
++		}
++	}
++
++	if (!found)
++		return 0;
++
++	/* handle special roles that do not require authentication
++	   and check ip */
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			found = 0;
++			if (r->allowed_ips != NULL) {
++				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
++					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
++					     (ntohl(ipp->addr) & ipp->netmask))
++						found = 1;
++				}
++			} else
++				found = 2;
++			if (!found)
++				return 0;
++
++			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
++			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
++				*salt = NULL;
++				*sum = NULL;
++				return 1;
++			}
++		}
++	FOR_EACH_ROLE_END(r)
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
++			*salt = acl_special_roles[i]->salt;
++			*sum = acl_special_roles[i]->sum;
++			return 1;
++		}
++	}
++
++	return 0;
++}
++
++static void
++assign_special_role(char *rolename)
++{
++	struct acl_object_label *obj;
++	struct acl_role_label *r;
++	struct acl_role_label *assigned = NULL;
++	struct task_struct *tsk;
++	struct file *filp;
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			assigned = r;
++			break;
++		}
++	FOR_EACH_ROLE_END(r)
++
++	if (!assigned)
++		return;
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++
++	tsk = current->parent;
++	if (tsk == NULL)
++		goto out_unlock;
++
++	filp = tsk->exec_file;
++	if (filp == NULL)
++		goto out_unlock;
++
++	tsk->is_writable = 0;
++
++	tsk->acl_sp_role = 1;
++	tsk->acl_role_id = ++acl_sp_role_value;
++	tsk->role = assigned;
++	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
++#endif
++
++out_unlock:
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	return;
++}
++
++int gr_check_secure_terminal(struct task_struct *task)
++{
++	struct task_struct *p, *p2, *p3;
++	struct files_struct *files;
++	struct fdtable *fdt;
++	struct file *our_file = NULL, *file;
++	int i;
++
++	if (task->signal->tty == NULL)
++		return 1;
++
++	files = get_files_struct(task);
++	if (files != NULL) {
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
++				get_file(file);
++				our_file = file;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	}
++
++	if (our_file == NULL)
++		return 1;
++
++	read_lock(&tasklist_lock);
++	do_each_thread(p2, p) {
++		files = get_files_struct(p);
++		if (files == NULL ||
++		    (p->signal && p->signal->tty == task->signal->tty)) {
++			if (files != NULL)
++				put_files_struct(files);
++			continue;
++		}
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
++			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
++				p3 = task;
++				while (p3->pid > 0) {
++					if (p3 == p)
++						break;
++					p3 = p3->parent;
++				}
++				if (p3 == p)
++					break;
++				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
++				gr_handle_alertkill(p);
++				rcu_read_unlock();
++				put_files_struct(files);
++				read_unlock(&tasklist_lock);
++				fput(our_file);
++				return 0;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	} while_each_thread(p2, p);
++	read_unlock(&tasklist_lock);
++
++	fput(our_file);
++	return 1;
++}
++
++ssize_t
++write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
++{
++	struct gr_arg_wrapper uwrap;
++	unsigned char *sprole_salt = NULL;
++	unsigned char *sprole_sum = NULL;
++	int error = sizeof (struct gr_arg_wrapper);
++	int error2 = 0;
++
++	down(&gr_dev_sem);
++
++	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
++		error = -EPERM;
++		goto out;
++	}
++
++	if (count != sizeof (struct gr_arg_wrapper)) {
++		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
++		error = -EINVAL;
++		goto out;
++	}
++
++	
++	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
++		gr_auth_expires = 0;
++		gr_auth_attempts = 0;
++	}
++
++	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
++		error = -EINVAL;
++		goto out;
++	}
++
++	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++	    time_after(gr_auth_expires, get_seconds())) {
++		error = -EBUSY;
++		goto out;
++	}
++
++	/* if non-root trying to do anything other than use a special role,
++	   do not attempt authentication, do not count towards authentication
++	   locking
++	 */
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
++	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    current_uid()) {
++		error = -EPERM;
++		goto out;
++	}
++
++	/* ensure pw and special role name are null terminated */
++
++	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
++	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
++
++	/* Okay. 
++	 * We have our enough of the argument structure..(we have yet
++	 * to copy_from_user the tables themselves) . Copy the tables
++	 * only if we need them, i.e. for loading operations. */
++
++	switch (gr_usermode->mode) {
++	case GR_STATUS:
++			if (gr_status & GR_READY) {
++				error = 1;
++				if (!gr_check_secure_terminal(current))
++					error = 3;
++			} else
++				error = 2;
++			goto out;
++	case GR_SHUTDOWN:
++		if ((gr_status & GR_READY)
++		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			free_variables();
++			memset(gr_usermode, 0, sizeof (struct gr_arg));
++			memset(gr_system_salt, 0, GR_SALT_LEN);
++			memset(gr_system_sum, 0, GR_SHA_LEN);
++		} else if (gr_status & GR_READY) {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
++			error = -EPERM;
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
++			error = -EAGAIN;
++		}
++		break;
++	case GR_ENABLE:
++		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
++		else {
++			if (gr_status & GR_READY)
++				error = -EAGAIN;
++			else
++				error = error2;
++			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
++		}
++		break;
++	case GR_RELOAD:
++		if (!(gr_status & GR_READY)) {
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
++			error = -EAGAIN;
++		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			lock_kernel();
++
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			free_variables();
++			if (!(error2 = gracl_init(gr_usermode))) {
++				unlock_kernel();
++				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
++			} else {
++				unlock_kernel();
++				error = error2;
++				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			}
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			error = -EPERM;
++		}
++		break;
++	case GR_SEGVMOD:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
++			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
++				struct acl_subject_label *segvacl;
++				segvacl =
++				    lookup_acl_subj_label(gr_usermode->segv_inode,
++							  gr_usermode->segv_device,
++							  current->role);
++				if (segvacl) {
++					segvacl->crashes = 0;
++					segvacl->expires = 0;
++				}
++			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
++				gr_remove_uid(gr_usermode->segv_uid);
++			}
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
++			error = -EPERM;
++		}
++		break;
++	case GR_SPROLE:
++	case GR_SPROLEPAM:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
++			current->role->expires = 0;
++			current->role->auth_attempts = 0;
++		}
++
++		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++		    time_after(current->role->expires, get_seconds())) {
++			error = -EBUSY;
++			goto out;
++		}
++
++		if (lookup_special_role_auth
++		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
++		    && ((!sprole_salt && !sprole_sum)
++			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
++			char *p = "";
++			assign_special_role(gr_usermode->sp_role);
++			read_lock(&tasklist_lock);
++			if (current->parent)
++				p = current->parent->role->rolename;
++			read_unlock(&tasklist_lock);
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
++					p, acl_sp_role_value);
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
++			error = -EPERM;
++			if(!(current->role->auth_attempts++))
++				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++			goto out;
++		}
++		break;
++	case GR_UNSPROLE:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->roletype & GR_ROLE_SPECIAL) {
++			char *p = "";
++			int i = 0;
++
++			read_lock(&tasklist_lock);
++			if (current->parent) {
++				p = current->parent->role->rolename;
++				i = current->parent->acl_role_id;
++			}
++			read_unlock(&tasklist_lock);
++
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
++			gr_set_acls(1);
++		} else {
++			error = -EPERM;
++			goto out;
++		}
++		break;
++	default:
++		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
++		error = -EINVAL;
++		break;
++	}
++
++	if (error != -EPERM)
++		goto out;
++
++	if(!(gr_auth_attempts++))
++		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++      out:
++	up(&gr_dev_sem);
++	return error;
++}
++
++int
++gr_set_acls(const int type)
++{
++	struct acl_object_label *obj;
++	struct task_struct *task, *task2;
++	struct file *filp;
++	struct acl_role_label *role = current->role;
++	__u16 acl_role_id = current->acl_role_id;
++	const struct cred *cred;
++	char *tmpname;
++	struct name_entry *nmatch;
++	struct acl_subject_label *tmpsubj;
++
++	rcu_read_lock();
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	do_each_thread(task2, task) {
++		/* check to see if we're called from the exit handler,
++		   if so, only replace ACLs that have inherited the admin
++		   ACL */
++
++		if (type && (task->role != role ||
++			     task->acl_role_id != acl_role_id))
++			continue;
++
++		task->acl_role_id = 0;
++		task->acl_sp_role = 0;
++
++		if ((filp = task->exec_file)) {
++			cred = __task_cred(task);
++			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
++
++			/* the following is to apply the correct subject 
++			   on binaries running when the RBAC system 
++			   is enabled, when the binaries have been 
++			   replaced or deleted since their execution
++			   -----
++			   when the RBAC system starts, the inode/dev
++			   from exec_file will be one the RBAC system
++			   is unaware of.  It only knows the inode/dev
++			   of the present file on disk, or the absence
++			   of it.
++			*/
++			preempt_disable();
++			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
++			
++			nmatch = lookup_name_entry(tmpname);
++			preempt_enable();
++			tmpsubj = NULL;
++			if (nmatch) {
++				if (nmatch->deleted)
++					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
++				else
++					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
++				if (tmpsubj != NULL)
++					task->acl = tmpsubj;
++			}
++			if (tmpsubj == NULL)
++				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
++							   task->role);
++			if (task->acl) {
++				struct acl_subject_label *curr;
++				curr = task->acl;
++
++				task->is_writable = 0;
++				/* ignore additional mmap checks for processes that are writable 
++				   by the default ACL */
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++
++				gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++			} else {
++				read_unlock(&grsec_exec_file_lock);
++				read_unlock(&tasklist_lock);
++				rcu_read_unlock();
++				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
++				return 1;
++			}
++		} else {
++			// it's a kernel process
++			task->role = kernel_role;
++			task->acl = kernel_role->root_label;
++#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
++			task->acl->mode &= ~GR_PROCFIND;
++#endif
++		}
++	} while_each_thread(task2, task);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
++
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	struct acl_subject_label *acl;
++	const struct cred *cred;
++
++	if (unlikely((gr_status & GR_READY) &&
++		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
++		goto skip_reslog;
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	gr_log_resource(task, res, wanted, gt);
++#endif
++      skip_reslog:
++
++	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
++		return;
++
++	acl = task->acl;
++
++	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
++		   !(acl->resmask & (1 << (unsigned short) res))))
++		return;
++
++	if (wanted >= acl->res[res].rlim_cur) {
++		unsigned long res_add;
++
++		res_add = wanted;
++		switch (res) {
++		case RLIMIT_CPU:
++			res_add += GR_RLIM_CPU_BUMP;
++			break;
++		case RLIMIT_FSIZE:
++			res_add += GR_RLIM_FSIZE_BUMP;
++			break;
++		case RLIMIT_DATA:
++			res_add += GR_RLIM_DATA_BUMP;
++			break;
++		case RLIMIT_STACK:
++			res_add += GR_RLIM_STACK_BUMP;
++			break;
++		case RLIMIT_CORE:
++			res_add += GR_RLIM_CORE_BUMP;
++			break;
++		case RLIMIT_RSS:
++			res_add += GR_RLIM_RSS_BUMP;
++			break;
++		case RLIMIT_NPROC:
++			res_add += GR_RLIM_NPROC_BUMP;
++			break;
++		case RLIMIT_NOFILE:
++			res_add += GR_RLIM_NOFILE_BUMP;
++			break;
++		case RLIMIT_MEMLOCK:
++			res_add += GR_RLIM_MEMLOCK_BUMP;
++			break;
++		case RLIMIT_AS:
++			res_add += GR_RLIM_AS_BUMP;
++			break;
++		case RLIMIT_LOCKS:
++			res_add += GR_RLIM_LOCKS_BUMP;
++			break;
++		case RLIMIT_SIGPENDING:
++			res_add += GR_RLIM_SIGPENDING_BUMP;
++			break;
++		case RLIMIT_MSGQUEUE:
++			res_add += GR_RLIM_MSGQUEUE_BUMP;
++			break;
++		case RLIMIT_NICE:
++			res_add += GR_RLIM_NICE_BUMP;
++			break;
++		case RLIMIT_RTPRIO:
++			res_add += GR_RLIM_RTPRIO_BUMP;
++			break;
++		case RLIMIT_RTTIME:
++			res_add += GR_RLIM_RTTIME_BUMP;
++			break;
++		}
++
++		acl->res[res].rlim_cur = res_add;
++
++		if (wanted > acl->res[res].rlim_max)
++			acl->res[res].rlim_max = res_add;
++
++		/* only log the subject filename, since resource logging is supported for
++		   single-subject learning only */
++		rcu_read_lock();
++		cred = __task_cred(task);
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid, cred->gid, acl->filename,
++			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
++			       "", (unsigned long) res, &task->signal->curr_ip);
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	struct task_struct *task = current;
++        struct acl_subject_label *proc;
++	unsigned long flags;
++
++        if (unlikely(!(gr_status & GR_READY)))
++                return;
++
++	flags = pax_get_flags(task);
++
++        proc = task->acl;
++
++	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
++		flags &= ~MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
++		flags &= ~MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
++		flags &= ~MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
++		flags &= ~MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
++		flags &= ~MF_PAX_MPROTECT;
++
++	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
++		flags |= MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
++		flags |= MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
++		flags |= MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
++		flags |= MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
++		flags |= MF_PAX_MPROTECT;
++
++	pax_set_flags(task, flags);
++
++        return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++/* Eric Biederman likes breaking userland ABI and every inode-based security
++   system to save 35kb of memory */
++
++/* we modify the passed in filename, but adjust it back before returning */
++static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
++{
++	struct name_entry *nmatch;
++	char *p, *lastp = NULL;
++	struct acl_object_label *obj = NULL, *tmp;
++	struct acl_subject_label *tmpsubj;
++	char c = '\0';
++
++	read_lock(&gr_inode_lock);
++
++	p = name + len - 1;
++	do {
++		nmatch = lookup_name_entry(name);
++		if (lastp != NULL)
++			*lastp = c;
++
++		if (nmatch == NULL)
++			goto next_component;
++		tmpsubj = current->acl;
++		do {
++			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
++			if (obj != NULL) {
++				tmp = obj->globbed;
++				while (tmp) {
++					if (!glob_match(tmp->filename, name)) {
++						obj = tmp;
++						goto found_obj;
++					}
++					tmp = tmp->next;
++				}
++				goto found_obj;
++			}
++		} while ((tmpsubj = tmpsubj->parent_subject));
++next_component:
++		/* end case */
++		if (p == name)
++			break;
++
++		while (*p != '/')
++			p--;
++		if (p == name)
++			lastp = p + 1;
++		else {
++			lastp = p;
++			p--;
++		}
++		c = *lastp;
++		*lastp = '\0';
++	} while (1);
++found_obj:
++	read_unlock(&gr_inode_lock);
++	/* obj returned will always be non-null */
++	return obj;
++}
++
++/* returns 0 when allowing, non-zero on error
++   op of 0 is used for readdir, so we don't log the names of hidden files
++*/
++__u32
++gr_handle_sysctl(const struct ctl_table *table, const int op)
++{
++	ctl_table *tmp;
++	const char *proc_sys = "/proc/sys";
++	char *path;
++	struct acl_object_label *obj;
++	unsigned short len = 0, pos = 0, depth = 0, i;
++	__u32 err = 0;
++	__u32 mode = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	/* for now, ignore operations on non-sysctl entries if it's not a
++	   readdir*/
++	if (table->child != NULL && op != 0)
++		return 0;
++
++	mode |= GR_FIND;
++	/* it's only a read if it's an entry, read on dirs is for readdir */
++	if (op & MAY_READ)
++		mode |= GR_READ;
++	if (op & MAY_WRITE)
++		mode |= GR_WRITE;
++
++	preempt_disable();
++
++	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
++
++	/* it's only a read/write if it's an actual entry, not a dir
++	   (which are opened for readdir)
++	*/
++
++	/* convert the requested sysctl entry into a pathname */
++
++	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++		len += strlen(tmp->procname);
++		len++;
++		depth++;
++	}
++
++	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
++		/* deny */
++		goto out;
++	}
++
++	memset(path, 0, PAGE_SIZE);
++
++	memcpy(path, proc_sys, strlen(proc_sys));
++
++	pos += strlen(proc_sys);
++
++	for (; depth > 0; depth--) {
++		path[pos] = '/';
++		pos++;
++		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++			if (depth == i) {
++				memcpy(path + pos, tmp->procname,
++				       strlen(tmp->procname));
++				pos += strlen(tmp->procname);
++			}
++			i++;
++		}
++	}
++
++	obj = gr_lookup_by_name(path, pos);
++	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
++
++	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
++		     ((err & mode) != mode))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		err = 0;
++		gr_log_learn_sysctl(path, new_mode);
++	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
++		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
++		err = -ENOENT;
++	} else if (!(err & GR_FIND)) {
++		err = -ENOENT;
++	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
++		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = -EACCES;
++	} else if ((err & mode) != mode) {
++		err = -EACCES;
++	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
++		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = 0;
++	} else
++		err = 0;
++
++      out:
++	preempt_enable();
++
++	return err;
++}
++#endif
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	struct file *filp;
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	filp = task->exec_file;
++
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 1;
++	}
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY)) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 0;
++	}
++#endif
++
++	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++
++	if (retmode & GR_NOPTRACE)
++		return 1;
++
++	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
++	    && (current->acl != task->acl || (current->acl != current->role->root_label
++	    && current->pid != task->pid)))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
++		read_unlock(&tasklist_lock);
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++	read_unlock(&tasklist_lock);
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY))
++		return 0;
++#endif
++
++	read_lock(&grsec_exec_file_lock);
++	if (unlikely(!task->exec_file)) {
++		read_unlock(&grsec_exec_file_lock);
++		return 0;
++	}
++
++	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++
++	if (retmode & GR_NOPTRACE) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++		
++	if (retmode & GR_PTRACERD) {
++		switch (request) {
++		case PTRACE_POKETEXT:
++		case PTRACE_POKEDATA:
++		case PTRACE_POKEUSR:
++#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
++		case PTRACE_SETREGS:
++		case PTRACE_SETFPREGS:
++#endif
++#ifdef CONFIG_X86
++		case PTRACE_SETFPXREGS:
++#endif
++#ifdef CONFIG_ALTIVEC
++		case PTRACE_SETVRREGS:
++#endif
++			return 1;
++		default:
++			return 0;
++		}
++	} else if (!(current->acl->mode & GR_POVERRIDE) &&
++		   !(current->role->roletype & GR_ROLE_GOD) &&
++		   (current->acl != task->acl)) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++
++	return 0;
++}
++
++static int is_writable_mmap(const struct file *filp)
++{
++	struct task_struct *task = current;
++	struct acl_object_label *obj, *obj2;
++
++	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
++	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
++		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
++				     task->role->root_label);
++		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
++			return 1;
++		}
++	}
++	return 0;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	unsigned long runtime;
++	unsigned long cputime;
++	unsigned int wday, cday;
++	__u8 whr, chr;
++	__u8 wmin, cmin;
++	__u8 wsec, csec;
++	struct timespec timeval;
++
++	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
++		     !(task->acl->mode & GR_PROCACCT)))
++		return;
++
++	do_posix_clock_monotonic_gettime(&timeval);
++	runtime = timeval.tv_sec - task->start_time.tv_sec;
++	wday = runtime / (3600 * 24);
++	runtime -= wday * (3600 * 24);
++	whr = runtime / 3600;
++	runtime -= whr * 3600;
++	wmin = runtime / 60;
++	runtime -= wmin * 60;
++	wsec = runtime;
++
++	cputime = (task->utime + task->stime) / HZ;
++	cday = cputime / (3600 * 24);
++	cputime -= cday * (3600 * 24);
++	chr = cputime / 3600;
++	cputime -= chr * 3600;
++	cmin = cputime / 60;
++	cputime -= cmin * 60;
++	csec = cputime;
++
++	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
++
++	return;
++}
++
++void gr_set_kernel_label(struct task_struct *task)
++{
++	if (gr_status & GR_READY) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++	}
++	return;
++}
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	struct task_struct *task;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred;
++#endif
++	int ret = 0;
++
++	/* restrict taskstats viewing to un-chrooted root users
++	   who have the 'view' subject flag if the RBAC system is enabled
++	*/
++
++	read_lock(&tasklist_lock);
++	task = find_task_by_vpid(pid);
++	if (task) {
++		gr_fs_read_lock(task);
++#ifdef CONFIG_GRKERNSEC_CHROOT
++		if (proc_is_chrooted(task))
++			ret = -EACCES;
++#endif
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		cred = __task_cred(task);
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		if (cred->uid != 0)
++			ret = -EACCES;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
++			ret = -EACCES;
++#endif
++#endif
++		if (gr_status & GR_READY) {
++			if (!(task->acl->mode & GR_VIEW))
++				ret = -EACCES;
++		}
++		
++		gr_fs_read_unlock(task);
++	} else
++		ret = -ENOENT;
++
++	read_unlock(&tasklist_lock);
++
++	return ret;
++}
++#endif
++
++int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
++{
++	struct task_struct *task = current;
++	struct dentry *dentry = file->f_path.dentry;
++	struct vfsmount *mnt = file->f_path.mnt;
++	struct acl_object_label *obj, *tmp;
++	struct acl_subject_label *subj;
++	unsigned int bufsize;
++	int is_not_root;
++	char *path;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 1;
++
++	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		return 1;
++
++	/* ignore Eric Biederman */
++	if (IS_PRIVATE(dentry->d_inode))
++		return 1;
++
++	subj = task->acl;
++	do {
++		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
++		if (obj != NULL)
++			return (obj->mode & GR_FIND) ? 1 : 0;
++	} while ((subj = subj->parent_subject));
++	
++	/* this is purely an optimization since we're looking for an object
++	   for the directory we're doing a readdir on
++	   if it's possible for any globbed object to match the entry we're
++	   filling into the directory, then the object we find here will be
++	   an anchor point with attached globbed objects
++	*/
++	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
++	if (obj->globbed == NULL)
++		return (obj->mode & GR_FIND) ? 1 : 0;
++
++	is_not_root = ((obj->filename[0] == '/') &&
++		   (obj->filename[1] == '\0')) ? 0 : 1;
++	bufsize = PAGE_SIZE - namelen - is_not_root;
++
++	/* check bufsize > PAGE_SIZE || bufsize == 0 */
++	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
++		return 1;
++
++	preempt_disable();
++	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   bufsize);
++
++	bufsize = strlen(path);
++
++	/* if base is "/", don't append an additional slash */
++	if (is_not_root)
++		*(path + bufsize) = '/';
++	memcpy(path + bufsize + is_not_root, name, namelen);
++	*(path + bufsize + namelen + is_not_root) = '\0';
++
++	tmp = obj->globbed;
++	while (tmp) {
++		if (!glob_match(tmp->filename, path)) {
++			preempt_enable();
++			return (tmp->mode & GR_FIND) ? 1 : 0;
++		}
++		tmp = tmp->next;
++	}
++	preempt_enable();
++	return (obj->mode & GR_FIND) ? 1 : 0;
++}
++
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
++
+diff -urNp linux-2.6.32.13/grsecurity/gracl_cap.c linux-2.6.32.13/grsecurity/gracl_cap.c
+--- linux-2.6.32.13/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_cap.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,131 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static const char *captab_log[] = {
++	"CAP_CHOWN",
++	"CAP_DAC_OVERRIDE",
++	"CAP_DAC_READ_SEARCH",
++	"CAP_FOWNER",
++	"CAP_FSETID",
++	"CAP_KILL",
++	"CAP_SETGID",
++	"CAP_SETUID",
++	"CAP_SETPCAP",
++	"CAP_LINUX_IMMUTABLE",
++	"CAP_NET_BIND_SERVICE",
++	"CAP_NET_BROADCAST",
++	"CAP_NET_ADMIN",
++	"CAP_NET_RAW",
++	"CAP_IPC_LOCK",
++	"CAP_IPC_OWNER",
++	"CAP_SYS_MODULE",
++	"CAP_SYS_RAWIO",
++	"CAP_SYS_CHROOT",
++	"CAP_SYS_PTRACE",
++	"CAP_SYS_PACCT",
++	"CAP_SYS_ADMIN",
++	"CAP_SYS_BOOT",
++	"CAP_SYS_NICE",
++	"CAP_SYS_RESOURCE",
++	"CAP_SYS_TIME",
++	"CAP_SYS_TTY_CONFIG",
++	"CAP_MKNOD",
++	"CAP_LEASE",
++	"CAP_AUDIT_WRITE",
++	"CAP_AUDIT_CONTROL",
++	"CAP_SETFCAP",
++	"CAP_MAC_OVERRIDE",
++	"CAP_MAC_ADMIN"
++};
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++
++int
++gr_is_capable(const int cap)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = task->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	curracl = task->acl;
++
++	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
++	    && cap_raised(cred->cap_effective, cap)) {
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid,
++			       cred->gid, task->exec_file ?
++			       gr_to_filename(task->exec_file->f_path.dentry,
++			       task->exec_file->f_path.mnt) : curracl->filename,
++			       curracl->filename, 0UL,
++			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
++		return 1;
++	}
++
++	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
++		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
++	return 0;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = current->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	return 0;
++}
++
+diff -urNp linux-2.6.32.13/grsecurity/gracl_fs.c linux-2.6.32.13/grsecurity/gracl_fs.c
+--- linux-2.6.32.13/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_fs.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,424 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/stat.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return GR_FIND;
++
++	mode =
++	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
++
++	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return mode;
++	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_FIND)))
++		return 0;
++
++	return GR_FIND;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	__u32 reqmode = GR_FIND;
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return reqmode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	else if (unlikely(fmode & FMODE_WRITE))
++		reqmode |= GR_WRITE;
++	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
++		reqmode &= ~GR_READ;
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
++		reqmode |= GR_SETID;
++
++	mode =
++	    gr_check_create(dentry, p_dentry, p_mnt,
++			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
++		     const int fmode)
++{
++	__u32 mode, reqmode = GR_FIND;
++
++	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
++		reqmode |= GR_EXEC;
++	if (fmode & S_IWOTH)
++		reqmode |= GR_WRITE;
++	if (fmode & S_IROTH)
++		reqmode |= GR_READ;
++
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		     mode_t mode)
++{
++	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
++		return 1;
++
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_FCHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		    mode_t mode)
++{
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_CHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
++			   GR_UNIXCONNECT_ACL_MSG);
++}
++
++/* hardlinks require at minimum create permission,
++   any additional privilege required is based on the
++   privilege of the file being linked to
++*/
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	__u32 mode;
++	__u32 needmode = GR_CREATE | GR_LINK;
++	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
++
++	mode =
++	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
++			  old_mnt);
++
++	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	__u32 needmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	mode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    GR_CREATE | GR_AUDIT_CREATE |
++			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
++
++	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
++		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return (GR_WRITE | GR_CREATE);
++}
++
++static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	if (unlikely(mode & (S_ISUID | S_ISGID)))
++		reqmode |= GR_SETID;
++
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  reqmode, GR_MKNOD_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry *new_dentry,
++		    const struct dentry *parent_dentry,
++		    const struct vfsmount *parent_mnt)
++{
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
++}
++
++#define RENAME_CHECK_SUCCESS(old, new) \
++	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
++	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
++
++int
++gr_acl_handle_rename(struct dentry *new_dentry,
++		     struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     struct dentry *old_dentry,
++		     struct inode *old_parent_inode,
++		     struct vfsmount *old_mnt, const char *newname)
++{
++	__u32 comp1, comp2;
++	int error = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (!new_dentry->d_inode) {
++		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
++					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
++					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
++		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
++				       GR_DELETE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, old_mnt);
++	} else {
++		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
++				       GR_CREATE | GR_DELETE |
++				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, parent_mnt);
++		comp2 =
++		    gr_search_file(old_dentry,
++				   GR_READ | GR_WRITE | GR_AUDIT_READ |
++				   GR_DELETE | GR_AUDIT_DELETE |
++				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
++	}
++
++	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
++	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
++		 && !(comp2 & GR_SUPPRESS)) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++		error = -EACCES;
++	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
++		error = -EACCES;
++
++	return error;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	u16 id;
++	char *rolename;
++	struct file *exec_file;
++
++	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
++		id = current->acl_role_id;
++		rolename = current->role->rolename;
++		gr_set_acls(1);
++		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
++	}
++
++	write_lock(&grsec_exec_file_lock);
++	exec_file = current->exec_file;
++	current->exec_file = NULL;
++	write_unlock(&grsec_exec_file_lock);
++
++	if (exec_file)
++		fput(exec_file);
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (task != current && task->acl->mode & GR_PROTPROCFD)
++		return -EACCES;
++
++	return 0;
++}
+diff -urNp linux-2.6.32.13/grsecurity/gracl_ip.c linux-2.6.32.13/grsecurity/gracl_ip.c
+--- linux-2.6.32.13/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_ip.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,339 @@
++#include <linux/kernel.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/skbuff.h>
++#include <linux/ip.h>
++#include <linux/udp.h>
++#include <linux/smp_lock.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/netdevice.h>
++#include <linux/inetdevice.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++#define GR_BIND			0x01
++#define GR_CONNECT		0x02
++#define GR_INVERT		0x04
++#define GR_BINDOVERRIDE		0x08
++#define GR_CONNECTOVERRIDE	0x10
++
++static const char * gr_protocols[256] = {
++	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
++	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
++	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
++	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
++	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
++	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
++	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
++	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
++	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
++	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
++	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
++	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
++	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
++	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
++	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
++	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
++	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
++	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
++	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
++	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
++	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
++	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
++	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
++	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
++	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
++	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
++	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
++	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
++	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
++	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
++	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
++	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
++	};
++
++static const char * gr_socktypes[11] = {
++	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
++	"unknown:7", "unknown:8", "unknown:9", "packet"
++	};
++
++const char *
++gr_proto_to_name(unsigned char proto)
++{
++	return gr_protocols[proto];
++}
++
++const char *
++gr_socktype_to_name(unsigned char type)
++{
++	return gr_socktypes[type];
++}
++
++int
++gr_search_socket(const int domain, const int type, const int protocol)
++{
++	struct acl_subject_label *curr;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled()))
++		goto exit;
++
++	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
++	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
++		goto exit;	// let the kernel handle it
++
++	curr = current->acl;
++
++	if (!curr->ips)
++		goto exit;
++
++	if ((curr->ip_type & (1 << type)) &&
++	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++		goto exit;
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		/* we don't place acls on raw sockets , and sometimes
++		   dgram/ip sockets are opened for ioctl and not
++		   bind/connect, so we'll fake a bind learn log */
++		if (type == SOCK_RAW || type == SOCK_PACKET) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_CONNECT, &current->signal->curr_ip);
++		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_BIND, &current->signal->curr_ip);
++		}
++		/* we'll log when they use connect or bind */
++		goto exit;
++	}
++
++	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
++		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
++
++	return 0;
++      exit:
++	return 1;
++}
++
++int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
++{
++	if ((ip->mode & mode) &&
++	    (ip_port >= ip->low) &&
++	    (ip_port <= ip->high) &&
++	    ((ntohl(ip_addr) & our_netmask) ==
++	     (ntohl(our_addr) & our_netmask))
++	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
++	    && (ip->type & (1 << type))) {
++		if (ip->mode & GR_INVERT)
++			return 2; // specifically denied
++		else
++			return 1; // allowed
++	}
++
++	return 0; // not specifically allowed, may continue parsing
++}
++
++static int
++gr_search_connectbind(const int full_mode, struct sock *sk,
++		      struct sockaddr_in *addr, const int type)
++{
++	char iface[IFNAMSIZ] = {0};
++	struct acl_subject_label *curr;
++	struct acl_ip_label *ip;
++	struct inet_sock *isk;
++	struct net_device *dev;
++	struct in_device *idev;
++	unsigned long i;
++	int ret;
++	int mode = full_mode & (GR_BIND | GR_CONNECT);
++	__u32 ip_addr = 0;
++	__u32 our_addr;
++	__u32 our_netmask;
++	char *p;
++	__u16 ip_port = 0;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
++		return 0;
++
++	curr = current->acl;
++	isk = inet_sk(sk);
++
++	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
++	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
++		addr->sin_addr.s_addr = curr->inaddr_any_override;
++	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
++		struct sockaddr_in saddr;
++		int err;
++
++		saddr.sin_family = AF_INET;
++		saddr.sin_addr.s_addr = curr->inaddr_any_override;
++		saddr.sin_port = isk->sport;
++
++		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++
++		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++	}
++
++	if (!curr->ips)
++		return 0;
++
++	ip_addr = addr->sin_addr.s_addr;
++	ip_port = ntohs(addr->sin_port);
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++			       current->role->roletype, cred->uid,
++			       cred->gid, current->exec_file ?
++			       gr_to_filename(current->exec_file->f_path.dentry,
++			       current->exec_file->f_path.mnt) :
++			       curr->filename, curr->filename,
++			       &ip_addr, ip_port, type,
++			       sk->sk_protocol, mode, &current->signal->curr_ip);
++		return 0;
++	}
++
++	for (i = 0; i < curr->ip_num; i++) {
++		ip = *(curr->ips + i);
++		if (ip->iface != NULL) {
++			strncpy(iface, ip->iface, IFNAMSIZ - 1);
++			p = strchr(iface, ':');
++			if (p != NULL)
++				*p = '\0';
++			dev = dev_get_by_name(sock_net(sk), iface);
++			if (dev == NULL)
++				continue;
++			idev = in_dev_get(dev);
++			if (idev == NULL) {
++				dev_put(dev);
++				continue;
++			}
++			rcu_read_lock();
++			for_ifa(idev) {
++				if (!strcmp(ip->iface, ifa->ifa_label)) {
++					our_addr = ifa->ifa_address;
++					our_netmask = 0xffffffff;
++					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++					if (ret == 1) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						return 0;
++					} else if (ret == 2) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						goto denied;
++					}
++				}
++			} endfor_ifa(idev);
++			rcu_read_unlock();
++			in_dev_put(idev);
++			dev_put(dev);
++		} else {
++			our_addr = ip->addr;
++			our_netmask = ip->netmask;
++			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++			if (ret == 1)
++				return 0;
++			else if (ret == 2)
++				goto denied;
++		}
++	}
++
++denied:
++	if (mode == GR_BIND)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++	else if (mode == GR_CONNECT)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++
++	return -EACCES;
++}
++
++int
++gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int
++gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int gr_search_listen(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int gr_search_accept(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int
++gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
++{
++	if (addr)
++		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
++	else {
++		struct sockaddr_in sin;
++		const struct inet_sock *inet = inet_sk(sk);
++
++		sin.sin_addr.s_addr = inet->daddr;
++		sin.sin_port = inet->dport;
++
++		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++	}
++}
++
++int
++gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
++{
++	struct sockaddr_in sin;
++
++	if (unlikely(skb->len < sizeof (struct udphdr)))
++		return 0;	// skip this packet
++
++	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
++	sin.sin_port = udp_hdr(skb)->source;
++
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++}
+diff -urNp linux-2.6.32.13/grsecurity/gracl_learn.c linux-2.6.32.13/grsecurity/gracl_learn.c
+--- linux-2.6.32.13/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_learn.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,211 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/poll.h>
++#include <linux/smp_lock.h>
++#include <linux/string.h>
++#include <linux/file.h>
++#include <linux/types.h>
++#include <linux/vmalloc.h>
++#include <linux/grinternal.h>
++
++extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
++				   size_t count, loff_t *ppos);
++extern int gr_acl_is_enabled(void);
++
++static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
++static int gr_learn_attached;
++
++/* use a 512k buffer */
++#define LEARN_BUFFER_SIZE (512 * 1024)
++
++static DEFINE_SPINLOCK(gr_learn_lock);
++static DECLARE_MUTEX(gr_learn_user_sem);
++
++/* we need to maintain two buffers, so that the kernel context of grlearn
++   uses a semaphore around the userspace copying, and the other kernel contexts
++   use a spinlock when copying into the buffer, since they cannot sleep
++*/
++static char *learn_buffer;
++static char *learn_buffer_user;
++static int learn_buffer_len;
++static int learn_buffer_user_len;
++
++static ssize_t
++read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
++{
++	DECLARE_WAITQUEUE(wait, current);
++	ssize_t retval = 0;
++
++	add_wait_queue(&learn_wait, &wait);
++	set_current_state(TASK_INTERRUPTIBLE);
++	do {
++		down(&gr_learn_user_sem);
++		spin_lock(&gr_learn_lock);
++		if (learn_buffer_len)
++			break;
++		spin_unlock(&gr_learn_lock);
++		up(&gr_learn_user_sem);
++		if (file->f_flags & O_NONBLOCK) {
++			retval = -EAGAIN;
++			goto out;
++		}
++		if (signal_pending(current)) {
++			retval = -ERESTARTSYS;
++			goto out;
++		}
++
++		schedule();
++	} while (1);
++
++	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
++	learn_buffer_user_len = learn_buffer_len;
++	retval = learn_buffer_len;
++	learn_buffer_len = 0;
++
++	spin_unlock(&gr_learn_lock);
++
++	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
++		retval = -EFAULT;
++
++	up(&gr_learn_user_sem);
++out:
++	set_current_state(TASK_RUNNING);
++	remove_wait_queue(&learn_wait, &wait);
++	return retval;
++}
++
++static unsigned int
++poll_learn(struct file * file, poll_table * wait)
++{
++	poll_wait(file, &learn_wait, wait);
++
++	if (learn_buffer_len)
++		return (POLLIN | POLLRDNORM);
++
++	return 0;
++}
++
++void
++gr_clear_learn_entries(void)
++{
++	char *tmp;
++
++	down(&gr_learn_user_sem);
++	if (learn_buffer != NULL) {
++		spin_lock(&gr_learn_lock);
++		tmp = learn_buffer;
++		learn_buffer = NULL;
++		spin_unlock(&gr_learn_lock);
++		vfree(learn_buffer);
++	}
++	if (learn_buffer_user != NULL) {
++		vfree(learn_buffer_user);
++		learn_buffer_user = NULL;
++	}
++	learn_buffer_len = 0;
++	up(&gr_learn_user_sem);
++
++	return;
++}
++
++void
++gr_add_learn_entry(const char *fmt, ...)
++{
++	va_list args;
++	unsigned int len;
++
++	if (!gr_learn_attached)
++		return;
++
++	spin_lock(&gr_learn_lock);
++
++	/* leave a gap at the end so we know when it's "full" but don't have to
++	   compute the exact length of the string we're trying to append
++	*/
++	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
++		spin_unlock(&gr_learn_lock);
++		wake_up_interruptible(&learn_wait);
++		return;
++	}
++	if (learn_buffer == NULL) {
++		spin_unlock(&gr_learn_lock);
++		return;
++	}
++
++	va_start(args, fmt);
++	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
++	va_end(args);
++
++	learn_buffer_len += len + 1;
++
++	spin_unlock(&gr_learn_lock);
++	wake_up_interruptible(&learn_wait);
++
++	return;
++}
++
++static int
++open_learn(struct inode *inode, struct file *file)
++{
++	if (file->f_mode & FMODE_READ && gr_learn_attached)
++		return -EBUSY;
++	if (file->f_mode & FMODE_READ) {
++		int retval = 0;
++		down(&gr_learn_user_sem);
++		if (learn_buffer == NULL)
++			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer_user == NULL)
++			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		if (learn_buffer_user == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 1;
++out_error:
++		up(&gr_learn_user_sem);
++		return retval;
++	}
++	return 0;
++}
++
++static int
++close_learn(struct inode *inode, struct file *file)
++{
++	char *tmp;
++
++	if (file->f_mode & FMODE_READ) {
++		down(&gr_learn_user_sem);
++		if (learn_buffer != NULL) {
++			spin_lock(&gr_learn_lock);
++			tmp = learn_buffer;
++			learn_buffer = NULL;
++			spin_unlock(&gr_learn_lock);
++			vfree(tmp);
++		}
++		if (learn_buffer_user != NULL) {
++			vfree(learn_buffer_user);
++			learn_buffer_user = NULL;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 0;
++		up(&gr_learn_user_sem);
++	}
++
++	return 0;
++}
++		
++const struct file_operations grsec_fops = {
++	.read		= read_learn,
++	.write		= write_grsec_handler,
++	.open		= open_learn,
++	.release	= close_learn,
++	.poll		= poll_learn,
++};
+diff -urNp linux-2.6.32.13/grsecurity/gracl_res.c linux-2.6.32.13/grsecurity/gracl_res.c
+--- linux-2.6.32.13/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_res.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grinternal.h>
++
++static const char *restab_log[] = {
++	[RLIMIT_CPU] = "RLIMIT_CPU",
++	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
++	[RLIMIT_DATA] = "RLIMIT_DATA",
++	[RLIMIT_STACK] = "RLIMIT_STACK",
++	[RLIMIT_CORE] = "RLIMIT_CORE",
++	[RLIMIT_RSS] = "RLIMIT_RSS",
++	[RLIMIT_NPROC] = "RLIMIT_NPROC",
++	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
++	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
++	[RLIMIT_AS] = "RLIMIT_AS",
++	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
++	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
++	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
++	[RLIMIT_NICE] = "RLIMIT_NICE",
++	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
++	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
++	[GR_CRASH_RES] = "RLIMIT_CRASH"
++};
++
++void
++gr_log_resource(const struct task_struct *task,
++		const int res, const unsigned long wanted, const int gt)
++{
++	const struct cred *cred;
++
++	if (!gr_acl_is_enabled() && !grsec_resource_logging)
++		return;
++
++	// not yet supported resource
++	if (!restab_log[res])
++		return;
++
++	rcu_read_lock();
++	cred = __task_cred(task);
++
++	if (res == RLIMIT_NPROC && 
++	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
++	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_MEMLOCK &&
++		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
++		goto out_rcu_unlock;
++	rcu_read_unlock();
++
++	preempt_disable();
++
++	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
++		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
++		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
++		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
++	preempt_enable_no_resched();
++
++	return;
++out_rcu_unlock:
++	rcu_read_unlock();
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/gracl_segv.c linux-2.6.32.13/grsecurity/gracl_segv.c
+--- linux-2.6.32.13/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_segv.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,310 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/timer.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static struct crash_uid *uid_set;
++static unsigned short uid_used;
++static DEFINE_SPINLOCK(gr_uid_lock);
++extern rwlock_t gr_inode_lock;
++extern struct acl_subject_label *
++	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
++			      struct acl_role_label *role);
++extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
++
++int
++gr_init_uidset(void)
++{
++	uid_set =
++	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
++	uid_used = 0;
++
++	return uid_set ? 1 : 0;
++}
++
++void
++gr_free_uidset(void)
++{
++	if (uid_set)
++		kfree(uid_set);
++
++	return;
++}
++
++int
++gr_find_uid(const uid_t uid)
++{
++	struct crash_uid *tmp = uid_set;
++	uid_t buid;
++	int low = 0, high = uid_used - 1, mid;
++
++	while (high >= low) {
++		mid = (low + high) >> 1;
++		buid = tmp[mid].uid;
++		if (buid == uid)
++			return mid;
++		if (buid > uid)
++			high = mid - 1;
++		if (buid < uid)
++			low = mid + 1;
++	}
++
++	return -1;
++}
++
++static __inline__ void
++gr_insertsort(void)
++{
++	unsigned short i, j;
++	struct crash_uid index;
++
++	for (i = 1; i < uid_used; i++) {
++		index = uid_set[i];
++		j = i;
++		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
++			uid_set[j] = uid_set[j - 1];
++			j--;
++		}
++		uid_set[j] = index;
++	}
++
++	return;
++}
++
++static __inline__ void
++gr_insert_uid(const uid_t uid, const unsigned long expires)
++{
++	int loc;
++
++	if (uid_used == GR_UIDTABLE_MAX)
++		return;
++
++	loc = gr_find_uid(uid);
++
++	if (loc >= 0) {
++		uid_set[loc].expires = expires;
++		return;
++	}
++
++	uid_set[uid_used].uid = uid;
++	uid_set[uid_used].expires = expires;
++	uid_used++;
++
++	gr_insertsort();
++
++	return;
++}
++
++void
++gr_remove_uid(const unsigned short loc)
++{
++	unsigned short i;
++
++	for (i = loc + 1; i < uid_used; i++)
++		uid_set[i - 1] = uid_set[i];
++
++	uid_used--;
++
++	return;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	int loc;
++	int ret = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	spin_lock(&gr_uid_lock);
++	loc = gr_find_uid(uid);
++
++	if (loc < 0)
++		goto out_unlock;
++
++	if (time_before_eq(uid_set[loc].expires, get_seconds()))
++		gr_remove_uid(loc);
++	else
++		ret = 1;
++
++out_unlock:
++	spin_unlock(&gr_uid_lock);
++	return ret;
++}
++
++static __inline__ int
++proc_is_setxid(const struct cred *cred)
++{
++	if (cred->uid != cred->euid || cred->uid != cred->suid ||
++	    cred->uid != cred->fsuid)
++		return 1;
++	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
++	    cred->gid != cred->fsgid)
++		return 1;
++
++	return 0;
++}
++static __inline__ int
++gr_fake_force_sig(int sig, struct task_struct *t)
++{
++	unsigned long int flags;
++	int ret, blocked, ignored;
++	struct k_sigaction *action;
++
++	spin_lock_irqsave(&t->sighand->siglock, flags);
++	action = &t->sighand->action[sig-1];
++	ignored = action->sa.sa_handler == SIG_IGN;
++	blocked = sigismember(&t->blocked, sig);
++	if (blocked || ignored) {
++		action->sa.sa_handler = SIG_DFL;
++		if (blocked) {
++			sigdelset(&t->blocked, sig);
++			recalc_sigpending_and_wake(t);
++		}
++	}
++	if (action->sa.sa_handler == SIG_DFL)
++		t->signal->flags &= ~SIGNAL_UNKILLABLE;
++	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
++
++	spin_unlock_irqrestore(&t->sighand->siglock, flags);
++
++	return ret;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	struct acl_subject_label *curr;
++	struct acl_subject_label *curr2;
++	struct task_struct *tsk, *tsk2;
++	const struct cred *cred;
++	const struct cred *cred2;
++
++	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
++		return;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curr = task->acl;
++
++	if (!(curr->resmask & (1 << GR_CRASH_RES)))
++		return;
++
++	if (time_before_eq(curr->expires, get_seconds())) {
++		curr->expires = 0;
++		curr->crashes = 0;
++	}
++
++	curr->crashes++;
++
++	if (!curr->expires)
++		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds())) {
++		rcu_read_lock();
++		cred = __task_cred(task);
++		if (cred->uid && proc_is_setxid(cred)) {
++			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			spin_lock(&gr_uid_lock);
++			gr_insert_uid(cred->uid, curr->expires);
++			spin_unlock(&gr_uid_lock);
++			curr->expires = 0;
++			curr->crashes = 0;
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				cred2 = __task_cred(tsk);
++				if (tsk != task && cred2->uid == cred->uid)
++					gr_fake_force_sig(SIGKILL, tsk);
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		} else {
++			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				if (likely(tsk != task)) {
++					curr2 = tsk->acl;
++
++					if (curr2->device == curr->device &&
++					    curr2->inode == curr->inode)
++						gr_fake_force_sig(SIGKILL, tsk);
++				}
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	struct acl_subject_label *curr;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	read_lock(&gr_inode_lock);
++	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
++				     filp->f_path.dentry->d_inode->i_sb->s_dev,
++				     current->role);
++	read_unlock(&gr_inode_lock);
++
++	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++	    (!curr->crashes && !curr->expires))
++		return 0;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds()))
++		return 1;
++	else if (time_before_eq(curr->expires, get_seconds())) {
++		curr->crashes = 0;
++		curr->expires = 0;
++	}
++
++	return 0;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	struct acl_subject_label *curracl;
++	__u32 curr_ip;
++	struct task_struct *p, *p2;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curracl = task->acl;
++	curr_ip = task->signal->curr_ip;
++
++	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
++		read_lock(&tasklist_lock);
++		do_each_thread(p2, p) {
++			if (p->signal->curr_ip == curr_ip)
++				gr_fake_force_sig(SIGKILL, p);
++		} while_each_thread(p2, p);
++		read_unlock(&tasklist_lock);
++	} else if (curracl->mode & GR_KILLPROC)
++		gr_fake_force_sig(SIGKILL, task);
++
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/gracl_shm.c linux-2.6.32.13/grsecurity/gracl_shm.c
+--- linux-2.6.32.13/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/gracl_shm.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,37 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/ipc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	struct task_struct *task;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	task = find_task_by_vpid(shm_cprid);
++
++	if (unlikely(!task))
++		task = find_task_by_vpid(shm_lapid);
++
++	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
++			      (task->pid == shm_lapid)) &&
++		     (task->acl->mode & GR_PROTSHM) &&
++		     (task->acl != current->acl))) {
++		read_unlock(&tasklist_lock);
++		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
++		return 0;
++	}
++	read_unlock(&tasklist_lock);
++
++	return 1;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_chdir.c linux-2.6.32.13/grsecurity/grsec_chdir.c
+--- linux-2.6.32.13/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_chdir.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,19 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	if ((grsec_enable_chdir && grsec_enable_group &&
++	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
++					      !grsec_enable_group)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
++	}
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_chroot.c linux-2.6.32.13/grsecurity/grsec_chroot.c
+--- linux-2.6.32.13/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_chroot.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,348 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/mount.h>
++#include <linux/types.h>
++#include <linux/pid_namespace.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_chroot_unix(const pid_t pid)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	struct pid *spid = NULL;
++
++	if (unlikely(!grsec_enable_chroot_unix))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	spid = find_vpid(pid);
++	if (spid) {
++		struct task_struct *p;
++		p = pid_task(spid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		if (unlikely(!have_same_root(current, p))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	}
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++int
++gr_handle_chroot_nice(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
++			&& proc_is_chrooted(current)) {
++		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
++	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++int
++gr_pid_is_chrooted(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
++		return 0;
++
++	gr_fs_read_lock(p);
++	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
++	    !have_same_root(current, p)) {
++		gr_fs_read_unlock(p);
++		return 1;
++	}
++	gr_fs_read_unlock(p);
++#endif
++	return 0;
++}
++
++EXPORT_SYMBOL(gr_pid_is_chrooted);
++
++#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
++int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
++{
++	struct dentry *dentry = (struct dentry *)u_dentry;
++	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
++	struct dentry *realroot;
++	struct vfsmount *realrootmnt;
++	struct dentry *currentroot;
++	struct vfsmount *currentmnt;
++	struct task_struct *reaper = &init_task;
++	int ret = 1;
++
++	read_lock(&reaper->fs->lock);
++	realrootmnt = mntget(reaper->fs->root.mnt);
++	realroot = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++
++	read_lock(&current->fs->lock);
++	currentmnt = mntget(current->fs->root.mnt);
++	currentroot = dget(current->fs->root.dentry);
++	read_unlock(&current->fs->lock);
++
++	spin_lock(&dcache_lock);
++	for (;;) {
++		if (unlikely((dentry == realroot && mnt == realrootmnt)
++		     || (dentry == currentroot && mnt == currentmnt)))
++			break;
++		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
++			if (mnt->mnt_parent == mnt)
++				break;
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++		dentry = dentry->d_parent;
++	}
++	spin_unlock(&dcache_lock);
++
++	dput(currentroot);
++	mntput(currentmnt);
++
++	/* access is outside of chroot */
++	if (dentry == realroot && mnt == realrootmnt)
++		ret = 0;
++
++	dput(realroot);
++	mntput(realrootmnt);
++	return ret;
++}
++#endif
++
++int
++gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	if (!grsec_enable_chroot_fchdir)
++		return 1;
++
++	if (!proc_is_chrooted(current))
++		return 1;
++	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
++		return 0;
++	}
++#endif
++	return 1;
++}
++
++int
++gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	struct pid *pid = NULL;
++	time_t starttime;
++
++	if (unlikely(!grsec_enable_chroot_shmat))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	pid = find_vpid(shm_cprid);
++	if (pid) {
++		struct task_struct *p;
++		p = pid_task(pid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		starttime = p->start_time.tv_sec;
++		if (unlikely(!have_same_root(current, p) &&
++			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	} else {
++		pid = find_vpid(shm_lapid);
++		if (pid) {
++			struct task_struct *p;
++			p = pid_task(pid, PIDTYPE_PID);
++			gr_fs_read_lock(p);
++			if (unlikely(!have_same_root(current, p))) {
++				gr_fs_read_unlock(p);
++				read_unlock(&tasklist_lock);
++				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++				return 0;
++			}
++			gr_fs_read_unlock(p);
++		}
++	}
++
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++void
++gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
++		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_mknod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_mount(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const char *dev_name)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
++		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_pivot(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
++	    !gr_is_outside_chroot(dentry, mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_caps(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
++		(init_task.fs->root.dentry != path->dentry) &&
++		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
++
++		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
++		const struct cred *old = current_cred();
++		struct cred *new = prepare_creds();
++		if (new == NULL)
++			return 1;
++
++		new->cap_permitted = cap_drop(old->cap_permitted, 
++					      chroot_caps);
++		new->cap_inheritable = cap_drop(old->cap_inheritable, 
++						chroot_caps);
++		new->cap_effective = cap_drop(old->cap_effective,
++					      chroot_caps);
++
++		commit_creds(new);
++
++		return 0;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_sysctl(const int op)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
++	    && (op & MAY_WRITE))
++		return -EACCES;
++#endif
++	return 0;
++}
++
++void
++gr_handle_chroot_chdir(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	if (grsec_enable_chroot_chdir)
++		set_fs_pwd(current->fs, path);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_chmod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	if (grsec_enable_chroot_chmod &&
++	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_handle_chroot_caps);
++#endif
+diff -urNp linux-2.6.32.13/grsecurity/grsec_disabled.c linux-2.6.32.13/grsecurity/grsec_disabled.c
+--- linux-2.6.32.13/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_disabled.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,426 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kdev_t.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <linux/skbuff.h>
++#include <linux/sysctl.h>
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++__u32
++gr_handle_sysctl(const struct ctl_table * table, const int op)
++{
++	return 0;
++}
++#endif
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	return 0;
++}
++#endif
++
++int
++gr_acl_is_enabled(void)
++{
++	return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++	return 0;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	return;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	return 0;
++}
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	return;
++}
++
++int
++gr_set_acls(const int type)
++{
++	return 0;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *tsk)
++{
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	return;
++}
++
++void
++gr_set_pax_flags(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	return 0;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	return 0;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	return 0;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	return;
++}
++
++int
++gr_search_socket(const int family, const int type, const int protocol)
++{
++	return 1;
++}
++
++int
++gr_search_connectbind(const int mode, const struct socket *sock,
++		      const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_is_capable(const int cap)
++{
++	return 1;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	return 1;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
++		   unsigned int *vm_flags)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry * dentry,
++		       const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry,
++		     const struct vfsmount * mnt, const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		     mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		    mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++void
++grsecurity_init(void)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_rename(const struct dentry *new_dentry,
++		     const struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     const struct dentry *old_dentry,
++		     const struct inode *old_parent_inode,
++		     const struct vfsmount *old_mnt, const char *newname)
++{
++	return 0;
++}
++
++int
++gr_acl_handle_filldir(const struct file *file, const char *name,
++		      const int namelen, const ino_t ino)
++{
++	return 1;
++}
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	return 1;
++}
++
++int
++gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_search_accept(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_listen(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	return 1;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	return;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	return 1;
++}
++
++void
++gr_set_role_label(const uid_t uid, const gid_t gid)
++{
++	return;
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	return 0;
++}
++
++int
++gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
++{
++	return 0;
++}
++
++int
++gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++void
++gr_set_kernel_label(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
+diff -urNp linux-2.6.32.13/grsecurity/grsec_exec.c linux-2.6.32.13/grsecurity/grsec_exec.c
+--- linux-2.6.32.13/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_exec.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,89 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/binfmts.h>
++#include <linux/smp_lock.h>
++#include <linux/fs.h>
++#include <linux/types.h>
++#include <linux/grdefs.h>
++#include <linux/grinternal.h>
++#include <linux/capability.h>
++
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++static char gr_exec_arg_buf[132];
++static DECLARE_MUTEX(gr_exec_arg_sem);
++#endif
++
++int
++gr_handle_nproc(void)
++{
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	const struct cred *cred = current_cred();
++	if (grsec_enable_execve && cred->user &&
++	    (atomic_read(&cred->user->processes) >
++	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
++	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
++		return -EAGAIN;
++	}
++#endif
++	return 0;
++}
++
++void
++gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
++{
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	char *grarg = gr_exec_arg_buf;
++	unsigned int i, x, execlen = 0;
++	char c;
++
++	if (!((grsec_enable_execlog && grsec_enable_group &&
++	       in_group_p(grsec_audit_gid))
++	      || (grsec_enable_execlog && !grsec_enable_group)))
++		return;
++
++	down(&gr_exec_arg_sem);
++	memset(grarg, 0, sizeof(gr_exec_arg_buf));
++
++	if (unlikely(argv == NULL))
++		goto log;
++
++	for (i = 0; i < bprm->argc && execlen < 128; i++) {
++		const char __user *p;
++		unsigned int len;
++
++		if (copy_from_user(&p, argv + i, sizeof(p)))
++			goto log;
++		if (!p)
++			goto log;
++		len = strnlen_user(p, 128 - execlen);
++		if (len > 128 - execlen)
++			len = 128 - execlen;
++		else if (len > 0)
++			len--;
++		if (copy_from_user(grarg + execlen, p, len))
++			goto log;
++
++		/* rewrite unprintable characters */
++		for (x = 0; x < len; x++) {
++			c = *(grarg + execlen + x);
++			if (c < 32 || c > 126)
++				*(grarg + execlen + x) = ' ';
++		}
++
++		execlen += len;
++		*(grarg + execlen) = ' ';
++		*(grarg + execlen + 1) = '\0';
++		execlen++;
++	}
++
++      log:
++	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
++			bprm->file->f_path.mnt, grarg);
++	up(&gr_exec_arg_sem);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_fifo.c linux-2.6.32.13/grsecurity/grsec_fifo.c
+--- linux-2.6.32.13/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_fifo.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,24 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
++	       const struct dentry *dir, const int flag, const int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_FIFO
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
++	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
++	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
++	    (cred->fsuid != dentry->d_inode->i_uid)) {
++		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
++			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_fork.c linux-2.6.32.13/grsecurity/grsec_fork.c
+--- linux-2.6.32.13/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_fork.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,15 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/errno.h>
++
++void
++gr_log_forkfail(const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
++		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_init.c linux-2.6.32.13/grsecurity/grsec_init.c
+--- linux-2.6.32.13/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_init.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,241 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/smp_lock.h>
++#include <linux/gracl.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/percpu.h>
++
++int grsec_enable_link;
++int grsec_enable_dmesg;
++int grsec_enable_harden_ptrace;
++int grsec_enable_fifo;
++int grsec_enable_execve;
++int grsec_enable_execlog;
++int grsec_enable_signal;
++int grsec_enable_forkfail;
++int grsec_enable_audit_ptrace;
++int grsec_enable_time;
++int grsec_enable_audit_textrel;
++int grsec_enable_group;
++int grsec_audit_gid;
++int grsec_enable_chdir;
++int grsec_enable_mount;
++int grsec_enable_rofs;
++int grsec_enable_chroot_findtask;
++int grsec_enable_chroot_mount;
++int grsec_enable_chroot_shmat;
++int grsec_enable_chroot_fchdir;
++int grsec_enable_chroot_double;
++int grsec_enable_chroot_pivot;
++int grsec_enable_chroot_chdir;
++int grsec_enable_chroot_chmod;
++int grsec_enable_chroot_mknod;
++int grsec_enable_chroot_nice;
++int grsec_enable_chroot_execlog;
++int grsec_enable_chroot_caps;
++int grsec_enable_chroot_sysctl;
++int grsec_enable_chroot_unix;
++int grsec_enable_tpe;
++int grsec_tpe_gid;
++int grsec_enable_blackhole;
++int grsec_lastack_retries;
++int grsec_enable_tpe_all;
++int grsec_enable_socket_all;
++int grsec_socket_all_gid;
++int grsec_enable_socket_client;
++int grsec_socket_client_gid;
++int grsec_enable_socket_server;
++int grsec_socket_server_gid;
++int grsec_resource_logging;
++int grsec_lock;
++
++DEFINE_SPINLOCK(grsec_alert_lock);
++unsigned long grsec_alert_wtime = 0;
++unsigned long grsec_alert_fyet = 0;
++
++DEFINE_SPINLOCK(grsec_audit_lock);
++
++DEFINE_RWLOCK(grsec_exec_file_lock);
++
++char *gr_shared_page[4];
++
++char *gr_alert_log_fmt;
++char *gr_audit_log_fmt;
++char *gr_alert_log_buf;
++char *gr_audit_log_buf;
++
++extern struct gr_arg *gr_usermode;
++extern unsigned char *gr_system_salt;
++extern unsigned char *gr_system_sum;
++
++void __init
++grsecurity_init(void)
++{
++	int j;
++	/* create the per-cpu shared pages */
++
++#ifdef CONFIG_X86
++	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
++#endif
++
++	for (j = 0; j < 4; j++) {
++		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
++		if (gr_shared_page[j] == NULL) {
++			panic("Unable to allocate grsecurity shared page");
++			return;
++		}
++	}
++
++	/* allocate log buffers */
++	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_alert_log_fmt) {
++		panic("Unable to allocate grsecurity alert log format buffer");
++		return;
++	}
++	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_audit_log_fmt) {
++		panic("Unable to allocate grsecurity audit log format buffer");
++		return;
++	}
++	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_alert_log_buf) {
++		panic("Unable to allocate grsecurity alert log buffer");
++		return;
++	}
++	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_audit_log_buf) {
++		panic("Unable to allocate grsecurity audit log buffer");
++		return;
++	}
++
++	/* allocate memory for authentication structure */
++	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
++	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
++	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
++
++	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
++		panic("Unable to allocate grsecurity authentication structure");
++		return;
++	}
++
++#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
++#ifndef CONFIG_GRKERNSEC_SYSCTL
++	grsec_lock = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	grsec_enable_audit_textrel = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	grsec_enable_group = 1;
++	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	grsec_enable_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	grsec_enable_harden_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	grsec_enable_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_LINK
++	grsec_enable_link = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	grsec_enable_dmesg = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	grsec_enable_blackhole = 1;
++	grsec_lastack_retries = 4;
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	grsec_enable_fifo = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	grsec_enable_execve = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	grsec_enable_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	grsec_enable_signal = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	grsec_enable_forkfail = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	grsec_enable_time = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	grsec_resource_logging = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	grsec_enable_chroot_findtask = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	grsec_enable_chroot_unix = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	grsec_enable_chroot_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	grsec_enable_chroot_fchdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	grsec_enable_chroot_shmat = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	grsec_enable_audit_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	grsec_enable_chroot_double = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	grsec_enable_chroot_pivot = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	grsec_enable_chroot_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	grsec_enable_chroot_chmod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	grsec_enable_chroot_mknod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	grsec_enable_chroot_nice = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	grsec_enable_chroot_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	grsec_enable_chroot_caps = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	grsec_enable_chroot_sysctl = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	grsec_enable_tpe = 1;
++	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	grsec_enable_tpe_all = 1;
++#endif
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	grsec_enable_socket_all = 1;
++	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	grsec_enable_socket_client = 1;
++	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	grsec_enable_socket_server = 1;
++	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
++#endif
++#endif
++
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_link.c linux-2.6.32.13/grsecurity/grsec_link.c
+--- linux-2.6.32.13/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_link.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,43 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_follow_link(const struct inode *parent,
++		      const struct inode *inode,
++		      const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
++	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
++	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
++		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_hardlink(const struct dentry *dentry,
++		   const struct vfsmount *mnt,
++		   struct inode *inode, const int mode, const char *to)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
++	    (!S_ISREG(mode) || (mode & S_ISUID) ||
++	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
++	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
++	    !capable(CAP_FOWNER) && cred->uid) {
++		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_log.c linux-2.6.32.13/grsecurity/grsec_log.c
+--- linux-2.6.32.13/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_log.c	2010-05-15 13:21:17.906582737 -0400
+@@ -0,0 +1,296 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/tty.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++#define BEGIN_LOCKS(x) \
++	rcu_read_lock(); \
++	read_lock(&tasklist_lock); \
++	read_lock(&grsec_exec_file_lock); \
++	if (x != GR_DO_AUDIT) \
++		spin_lock(&grsec_alert_lock); \
++	else \
++		spin_lock(&grsec_audit_lock)
++
++#define END_LOCKS(x) \
++	if (x != GR_DO_AUDIT) \
++		spin_unlock(&grsec_alert_lock); \
++	else \
++		spin_unlock(&grsec_audit_lock); \
++	read_unlock(&grsec_exec_file_lock); \
++	read_unlock(&tasklist_lock); \
++	rcu_read_unlock(); \
++	if (x == GR_DONT_AUDIT) \
++		gr_handle_alertkill(current)
++
++enum {
++	FLOODING,
++	NO_FLOODING
++};
++
++extern char *gr_alert_log_fmt;
++extern char *gr_audit_log_fmt;
++extern char *gr_alert_log_buf;
++extern char *gr_audit_log_buf;
++
++static int gr_log_start(int audit)
++{
++	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
++	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++
++	if (audit == GR_DO_AUDIT)
++		goto set_fmt;
++
++	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet = 0;
++	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
++		grsec_alert_fyet++;
++	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet++;
++		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
++		return FLOODING;
++	} else return FLOODING;
++
++set_fmt:
++	memset(buf, 0, PAGE_SIZE);
++	if (current->signal->curr_ip && gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else if (current->signal->curr_ip) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
++	} else if (gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else {
++		sprintf(fmt, "%s%s", loglevel, "grsec: ");
++		strcpy(buf, fmt);
++	}
++
++	return NO_FLOODING;
++}
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++	__attribute__ ((format (printf, 2, 0)));
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++
++	return;
++}
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++	__attribute__ ((format (printf, 2, 3)));
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++	va_list ap;
++
++	va_start(ap, msg);
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++	va_end(ap);
++
++	return;
++}
++
++static void gr_log_end(int audit)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
++	printk("%s\n", buf);
++
++	return;
++}
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
++{
++	int logtype;
++	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
++	char *str1, *str2, *str3;
++	void *voidptr;
++	int num1, num2;
++	unsigned long ulong1, ulong2;
++	struct dentry *dentry;
++	struct vfsmount *mnt;
++	struct file *file;
++	struct task_struct *task;
++	const struct cred *cred, *pcred;
++	va_list ap;
++
++	BEGIN_LOCKS(audit);
++	logtype = gr_log_start(audit);
++	if (logtype == FLOODING) {
++		END_LOCKS(audit);
++		return;
++	}
++	va_start(ap, argtypes);
++	switch (argtypes) {
++	case GR_TTYSNIFF:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
++		break;
++	case GR_SYSCTL_HIDDEN:
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, str1);
++		break;
++	case GR_RBAC:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_STR_RBAC:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_MODE2:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
++		break;
++	case GR_RBAC_MODE3:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		str3 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
++		break;
++	case GR_FILENAME:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
++		break;
++	case GR_STR_FILENAME:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_FILENAME_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_FILENAME_TWO_INT:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
++		break;
++	case GR_FILENAME_TWO_INT_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
++		break;
++	case GR_TEXTREL:
++		file = va_arg(ap, struct file *);
++		ulong1 = va_arg(ap, unsigned long);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
++		break;
++	case GR_PTRACE:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
++		break;
++	case GR_RESOURCE:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		str1 = va_arg(ap, char *);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CAP:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_SIG:
++		str1 = va_arg(ap, char *);
++		voidptr = va_arg(ap, void *);
++		gr_log_middle_varargs(audit, msg, str1, voidptr);
++		break;
++	case GR_SIG2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		num1 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CRASH1:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
++		break;
++	case GR_CRASH2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
++		break;
++	case GR_PSACCT:
++		{
++			unsigned int wday, cday;
++			__u8 whr, chr;
++			__u8 wmin, cmin;
++			__u8 wsec, csec;
++			char cur_tty[64] = { 0 };
++			char parent_tty[64] = { 0 };
++
++			task = va_arg(ap, struct task_struct *);
++			wday = va_arg(ap, unsigned int);
++			cday = va_arg(ap, unsigned int);
++			whr = va_arg(ap, int);
++			chr = va_arg(ap, int);
++			wmin = va_arg(ap, int);
++			cmin = va_arg(ap, int);
++			wsec = va_arg(ap, int);
++			csec = va_arg(ap, int);
++			ulong1 = va_arg(ap, unsigned long);
++			cred = __task_cred(task);
++			pcred = __task_cred(task->parent);
++
++			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		}
++		break;
++	default:
++		gr_log_middle(audit, msg, ap);
++	}
++	va_end(ap);
++	gr_log_end(audit);
++	END_LOCKS(audit);
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_mem.c linux-2.6.32.13/grsecurity/grsec_mem.c
+--- linux-2.6.32.13/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_mem.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,85 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/mman.h>
++#include <linux/grinternal.h>
++
++void
++gr_handle_ioperm(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
++	return;
++}
++
++void
++gr_handle_iopl(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
++	return;
++}
++
++void
++gr_handle_mem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
++	return;
++}
++
++void
++gr_handle_kmem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
++	return;
++}
++
++void
++gr_handle_open_port(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
++	return;
++}
++
++int
++gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
++{
++	unsigned long start, end;
++
++	start = offset;
++	end = start + vma->vm_end - vma->vm_start;
++
++	if (start > end) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	}
++
++	/* allowed ranges : ISA I/O BIOS */
++	if ((start >= __pa(high_memory))
++#if defined(CONFIG_X86) || defined(CONFIG_PPC)
++	    || (start >= 0x000a0000 && end <= 0x00100000)
++	    || (start >= 0x00000000 && end <= 0x00001000)
++#endif
++	)
++		return 0;
++
++	if (vma->vm_flags & VM_WRITE) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	} else
++		vma->vm_flags &= ~VM_MAYWRITE;
++
++	return 0;
++}
++
++void
++gr_log_nonroot_mod_load(const char *modname)
++{
++        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
++        return;
++}
++
++void
++gr_handle_vm86(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_mount.c linux-2.6.32.13/grsecurity/grsec_mount.c
+--- linux-2.6.32.13/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_mount.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,62 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mount.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_remount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_unmount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_mount(const char *from, const char *to, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
++#endif
++	return;
++}
++
++int
++gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
++
++int
++gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
++	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_ptrace.c linux-2.6.32.13/grsecurity/grsec_ptrace.c
+--- linux-2.6.32.13/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_ptrace.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,14 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_audit_ptrace(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	if (grsec_enable_audit_ptrace)
++		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_sig.c linux-2.6.32.13/grsecurity/grsec_sig.c
+--- linux-2.6.32.13/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_sig.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++char *signames[] = {
++	[SIGSEGV] = "Segmentation fault",
++	[SIGILL] = "Illegal instruction",
++	[SIGABRT] = "Abort",
++	[SIGBUS] = "Invalid alignment/Bus error"
++};
++
++void
++gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
++{
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
++				    (sig == SIGABRT) || (sig == SIGBUS))) {
++		if (t->pid == current->pid) {
++			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
++		} else {
++			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
++		}
++	}
++#endif
++	return;
++}
++
++int
++gr_handle_signal(const struct task_struct *p, const int sig)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (current->pid > 1 && gr_check_protected_task(p)) {
++		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
++		return -EPERM;
++	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++void gr_handle_brute_attach(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	if (p->parent && p->parent->exec_file == p->exec_file)
++		p->parent->brute = 1;
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++#endif
++	return;
++}
++
++void gr_handle_brute_check(void)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	if (current->brute)
++		msleep(30 * 1000);
++#endif
++	return;
++}
++
+diff -urNp linux-2.6.32.13/grsecurity/grsec_sock.c linux-2.6.32.13/grsecurity/grsec_sock.c
+--- linux-2.6.32.13/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_sock.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,271 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <net/sock.h>
++#include <net/inet_sock.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
++EXPORT_SYMBOL(gr_cap_rtnetlink);
++
++extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
++
++EXPORT_SYMBOL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL(gr_search_udp_sendmsg);
++
++#ifdef CONFIG_UNIX_MODULE
++EXPORT_SYMBOL(gr_acl_handle_unix);
++EXPORT_SYMBOL(gr_acl_handle_mknod);
++EXPORT_SYMBOL(gr_handle_chroot_unix);
++EXPORT_SYMBOL(gr_handle_create);
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define gr_conn_table_size 32749
++struct conn_table_entry {
++	struct conn_table_entry *next;
++	struct signal_struct *sig;
++};
++
++struct conn_table_entry *gr_conn_table[gr_conn_table_size];
++DEFINE_SPINLOCK(gr_conn_table_lock);
++
++extern const char * gr_socktype_to_name(unsigned char type);
++extern const char * gr_proto_to_name(unsigned char proto);
++
++static __inline__ int 
++conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
++{
++	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
++}
++
++static __inline__ int
++conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
++	   __u16 sport, __u16 dport)
++{
++	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
++		     sig->gr_sport == sport && sig->gr_dport == dport))
++		return 1;
++	else
++		return 0;
++}
++
++static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
++{
++	struct conn_table_entry **match;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	newent->sig = sig;
++	
++	match = &gr_conn_table[index];
++	newent->next = *match;
++	*match = newent;
++
++	return;
++}
++
++static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
++{
++	struct conn_table_entry *match, *last = NULL;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, 
++		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
++		sig->gr_dport)) {
++		last = match;
++		match = match->next;
++	}
++
++	if (match) {
++		if (last)
++			last->next = match->next;
++		else
++			gr_conn_table[index] = NULL;
++		kfree(match);
++	}
++
++	return;
++}
++
++static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
++					     __u16 sport, __u16 dport)
++{
++	struct conn_table_entry *match;
++	unsigned int index;
++
++	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
++		match = match->next;
++
++	if (match)
++		return match->sig;
++	else
++		return NULL;
++}
++
++#endif
++
++void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *sig = task->signal;
++	struct conn_table_entry *newent;
++
++	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
++	if (newent == NULL)
++		return;
++	/* no bh lock needed since we are called with bh disabled */
++	spin_lock(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(sig);
++	sig->gr_saddr = inet->rcv_saddr;
++	sig->gr_daddr = inet->daddr;
++	sig->gr_sport = inet->sport;
++	sig->gr_dport = inet->dport;
++	gr_add_to_task_ip_table_nolock(sig, newent);
++	spin_unlock(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void gr_del_task_from_ip_table(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC
++	spin_lock_bh(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(task->signal);
++	spin_unlock_bh(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void
++gr_attach_curr_ip(const struct sock *sk)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *p, *set;
++	const struct inet_sock *inet = inet_sk(sk);	
++
++	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
++		return;
++
++	set = current->signal;
++
++	spin_lock_bh(&gr_conn_table_lock);
++	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
++				    inet->dport, inet->sport);
++	if (unlikely(p != NULL)) {
++		set->curr_ip = p->curr_ip;
++		set->used_accept = 1;
++		gr_del_task_from_ip_table_nolock(p);
++		spin_unlock_bh(&gr_conn_table_lock);
++		return;
++	}
++	spin_unlock_bh(&gr_conn_table_lock);
++
++	set->curr_ip = inet->daddr;
++	set->used_accept = 1;
++#endif
++	return;
++}
++
++int
++gr_handle_sock_all(const int family, const int type, const int protocol)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
++	    (family != AF_UNIX) && (family != AF_LOCAL)) {
++		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server_other(const struct sock *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sk_family != AF_UNIX) &&
++	    (sck->sk_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_client(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++kernel_cap_t
++gr_cap_rtnetlink(struct sock *sock)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_acl_is_enabled())
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_ISCSI &&
++		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
++		 gr_is_capable(CAP_SYS_ADMIN))
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_AUDIT &&
++		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
++		 gr_is_capable(CAP_AUDIT_WRITE) &&
++		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
++		 gr_is_capable(CAP_AUDIT_CONTROL))
++		return current_cap();
++	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
++		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
++		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
++		  gr_is_capable(CAP_NET_ADMIN)))
++		return current_cap();
++	else
++		return __cap_empty_set;
++#else
++	return current_cap();
++#endif
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_sysctl.c linux-2.6.32.13/grsecurity/grsec_sysctl.c
+--- linux-2.6.32.13/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_sysctl.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,447 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/sysctl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
++{
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
++		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_GRKERNSEC_ROFS
++static int __maybe_unused one = 1;
++#endif
++
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++ctl_table grsecurity_table[] = {
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++#ifdef CONFIG_GRKERNSEC_LINK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "linking_restrictions",
++		.data		= &grsec_enable_link,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "fifo_restrictions",
++		.data		= &grsec_enable_fifo,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "execve_limiting",
++		.data		= &grsec_enable_execve,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "ip_blackhole",
++		.data		= &grsec_enable_blackhole,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "lastack_retries",
++		.data		= &grsec_lastack_retries,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "exec_logging",
++		.data		= &grsec_enable_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "signal_logging",
++		.data		= &grsec_enable_signal,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "forkfail_logging",
++		.data		= &grsec_enable_forkfail,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "timechange_logging",
++		.data		= &grsec_enable_time,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_shmat",
++		.data		= &grsec_enable_chroot_shmat,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_unix",
++		.data		= &grsec_enable_chroot_unix,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mount",
++		.data		= &grsec_enable_chroot_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_fchdir",
++		.data		= &grsec_enable_chroot_fchdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chroot",
++		.data		= &grsec_enable_chroot_double,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_pivot",
++		.data		= &grsec_enable_chroot_pivot,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_enforce_chdir",
++		.data		= &grsec_enable_chroot_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chmod",
++		.data		= &grsec_enable_chroot_chmod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mknod",
++		.data		= &grsec_enable_chroot_mknod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_restrict_nice",
++		.data		= &grsec_enable_chroot_nice,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_execlog",
++		.data		= &grsec_enable_chroot_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_caps",
++		.data		= &grsec_enable_chroot_caps,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_sysctl",
++		.data		= &grsec_enable_chroot_sysctl,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe",
++		.data		= &grsec_enable_tpe,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_gid",
++		.data		= &grsec_tpe_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_restrict_all",
++		.data		= &grsec_enable_tpe_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all",
++		.data		= &grsec_enable_socket_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all_gid",
++		.data		= &grsec_socket_all_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client",
++		.data		= &grsec_enable_socket_client,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client_gid",
++		.data		= &grsec_socket_client_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server",
++		.data		= &grsec_enable_socket_server,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server_gid",
++		.data		= &grsec_socket_server_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_group",
++		.data		= &grsec_enable_group,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_gid",
++		.data		= &grsec_audit_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_chdir",
++		.data		= &grsec_enable_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_mount",
++		.data		= &grsec_enable_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_textrel",
++		.data		= &grsec_enable_audit_textrel,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "dmesg",
++		.data		= &grsec_enable_dmesg,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_findtask",
++		.data		= &grsec_enable_chroot_findtask,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "resource_logging",
++		.data		= &grsec_resource_logging,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_ptrace",
++		.data		= &grsec_enable_audit_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "harden_ptrace",
++		.data		= &grsec_enable_harden_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsec_lock",
++		.data		= &grsec_lock,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_ROFS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "romount_protect",
++		.data		= &grsec_enable_rofs,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec_minmax,
++		.extra1		= &one,
++		.extra2		= &one,
++	},
++#endif
++	{ .ctl_name = 0 }
++};
++#endif
+diff -urNp linux-2.6.32.13/grsecurity/grsec_textrel.c linux-2.6.32.13/grsecurity/grsec_textrel.c
+--- linux-2.6.32.13/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_textrel.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,16 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_log_textrel(struct vm_area_struct * vma)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	if (grsec_enable_audit_textrel)
++		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_time.c linux-2.6.32.13/grsecurity/grsec_time.c
+--- linux-2.6.32.13/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_time.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,13 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_timechange(void)
++{
++#ifdef CONFIG_GRKERNSEC_TIME
++	if (grsec_enable_time)
++		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsec_tpe.c linux-2.6.32.13/grsecurity/grsec_tpe.c
+--- linux-2.6.32.13/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsec_tpe.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,38 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++extern int gr_acl_tpe_check(void);
++
++int
++gr_tpe_allow(const struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
++	const struct cred *cred = current_cred();
++
++	if (cred->uid && ((grsec_enable_tpe &&
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++	    !in_group_p(grsec_tpe_gid)
++#else
++	    in_group_p(grsec_tpe_gid)
++#endif
++	    ) || gr_acl_tpe_check()) &&
++	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
++						(inode->i_mode & S_IWOTH))))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
++	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
++	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#endif
++#endif
++	return 1;
++}
+diff -urNp linux-2.6.32.13/grsecurity/grsum.c linux-2.6.32.13/grsecurity/grsum.c
+--- linux-2.6.32.13/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/grsum.c	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,59 @@
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/scatterlist.h>
++#include <linux/crypto.h>
++#include <linux/gracl.h>
++
++
++#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
++#error "crypto and sha256 must be built into the kernel"
++#endif
++
++int
++chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
++{
++	char *p;
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++	unsigned char temp_sum[GR_SHA_LEN];
++	volatile int retval = 0;
++	volatile int dummy = 0;
++	unsigned int i;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		/* should never happen, since sha256 should be built in */
++		return 1;
++	}
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	crypto_hash_init(&desc);
++
++	p = salt;
++	sg_set_buf(&sg, p, GR_SALT_LEN);
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	p = entry->pw;
++	sg_set_buf(&sg, p, strlen(p));
++	
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	crypto_hash_final(&desc, temp_sum);
++
++	memset(entry->pw, 0, GR_PW_LEN);
++
++	for (i = 0; i < GR_SHA_LEN; i++)
++		if (sum[i] != temp_sum[i])
++			retval = 1;
++		else
++			dummy = 1;	// waste a cycle
++
++	crypto_free_hash(tfm);
++
++	return retval;
++}
+diff -urNp linux-2.6.32.13/grsecurity/Kconfig linux-2.6.32.13/grsecurity/Kconfig
+--- linux-2.6.32.13/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/Kconfig	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,965 @@
++#
++# grecurity configuration
++#
++
++menu "Grsecurity"
++
++config GRKERNSEC
++	bool "Grsecurity"
++	select CRYPTO
++	select CRYPTO_SHA256
++	help
++	  If you say Y here, you will be able to configure many features
++	  that will enhance the security of your system.  It is highly
++	  recommended that you say Y here and read through the help
++	  for each option so that you fully understand the features and
++	  can evaluate their usefulness for your machine.
++
++choice
++	prompt "Security Level"
++	depends on GRKERNSEC
++	default GRKERNSEC_CUSTOM
++
++config GRKERNSEC_LOW
++	bool "Low"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_CHDIR
++
++	help
++	  If you choose this option, several of the grsecurity options will
++	  be enabled that will give you greater protection against a number
++	  of attacks, while assuring that none of your software will have any
++	  conflicts with the additional security measures.  If you run a lot
++	  of unusual software, or you are having problems with the higher
++	  security levels, you should say Y here.  With this option, the
++	  following features are enabled:
++
++	  - Linking restrictions
++	  - FIFO restrictions
++	  - Enforcing RLIMIT_NPROC on execve
++	  - Restricted dmesg
++	  - Enforced chdir("/") on chroot
++	  - Runtime module disabling
++
++config GRKERNSEC_MEDIUM
++	bool "Medium"
++	select PAX
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_USERGROUP
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
++
++	help
++	  If you say Y here, several features in addition to those included
++	  in the low additional security level will be enabled.  These
++	  features provide even more security to your system, though in rare
++	  cases they may be incompatible with very old or poorly written
++	  software.  If you enable this option, make sure that your auth
++	  service (identd) is running as gid 1001.  With this option, 
++	  the following features (in addition to those provided in the 
++	  low additional security level) will be enabled:
++
++	  - Failed fork logging
++	  - Time change logging
++	  - Signal logging
++	  - Deny mounts in chroot
++	  - Deny double chrooting
++	  - Deny sysctl writes in chroot
++	  - Deny mknod in chroot
++	  - Deny access to abstract AF_UNIX sockets out of chroot
++	  - Deny pivot_root in chroot
++	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
++	  - /proc restrictions with special GID set to 10 (usually wheel)
++	  - Address Space Layout Randomization (ASLR)
++	  - Prevent exploitation of most refcount overflows
++	  - Bounds checking of copying between the kernel and userland
++
++config GRKERNSEC_HIGH
++	bool "High"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SHMAT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_FCHDIR
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_CHROOT_CAPS
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_CHROOT_FINDTASK
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_HIDESYM
++	select GRKERNSEC_BRUTE
++	select GRKERNSEC_PROC_USERGROUP
++	select GRKERNSEC_KMEM
++	select GRKERNSEC_RESLOG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_PROC_ADD
++	select GRKERNSEC_CHROOT_CHMOD
++	select GRKERNSEC_CHROOT_NICE
++	select GRKERNSEC_AUDIT_MOUNT
++	select GRKERNSEC_MODHARDEN if (MODULES)
++	select GRKERNSEC_HARDEN_PTRACE
++	select GRKERNSEC_VM86 if (X86_32)
++	select PAX
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_NOEXEC
++	select PAX_MPROTECT
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
++	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
++	select PAX_SEGMEXEC if (X86_32)
++	select PAX_PAGEEXEC
++	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
++	select PAX_EMUTRAMP if (PARISC)
++	select PAX_EMUSIGRT if (PARISC)
++	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
++	help
++	  If you say Y here, many of the features of grsecurity will be
++	  enabled, which will protect you against many kinds of attacks
++	  against your system.  The heightened security comes at a cost
++	  of an increased chance of incompatibilities with rare software
++	  on your machine.  Since this security level enables PaX, you should
++	  view <http://pax.grsecurity.net> and read about the PaX
++	  project.  While you are there, download chpax and run it on
++	  binaries that cause problems with PaX.  Also remember that
++	  since the /proc restrictions are enabled, you must run your
++	  identd as gid 1001.  This security level enables the following 
++	  features in addition to those listed in the low and medium 
++	  security levels:
++
++	  - Additional /proc restrictions
++	  - Chmod restrictions in chroot
++	  - No signals, ptrace, or viewing of processes outside of chroot
++	  - Capability restrictions in chroot
++	  - Deny fchdir out of chroot
++	  - Priority restrictions in chroot
++	  - Segmentation-based implementation of PaX
++	  - Mprotect restrictions
++	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
++	  - Kernel stack randomization
++	  - Mount/unmount/remount logging
++	  - Kernel symbol hiding
++	  - Prevention of memory exhaustion-based exploits
++	  - Hardening of module auto-loading
++	  - Ptrace restrictions
++	  - Restricted vm86 mode
++
++config GRKERNSEC_CUSTOM
++	bool "Custom"
++	help
++	  If you say Y here, you will be able to configure every grsecurity
++	  option, which allows you to enable many more features that aren't
++	  covered in the basic security levels.  These additional features
++	  include TPE, socket restrictions, and the sysctl system for
++	  grsecurity.  It is advised that you read through the help for
++	  each option to determine its usefulness in your situation.
++
++endchoice
++
++menu "Address Space Protection"
++depends on GRKERNSEC
++
++config GRKERNSEC_KMEM
++	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
++	help
++	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
++	  be written to via mmap or otherwise to modify the running kernel.
++	  /dev/port will also not be allowed to be opened. If you have module
++	  support disabled, enabling this will close up four ways that are
++	  currently used  to insert malicious code into the running kernel.
++	  Even with all these features enabled, we still highly recommend that
++	  you use the RBAC system, as it is still possible for an attacker to
++	  modify the running kernel through privileged I/O granted by ioperm/iopl.
++	  If you are not using XFree86, you may be able to stop this additional
++	  case by enabling the 'Disable privileged I/O' option. Though nothing
++	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
++	  but only to video memory, which is the only writing we allow in this
++	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
++	  not be allowed to mprotect it with PROT_WRITE later.
++	  It is highly recommended that you say Y here if you meet all the
++	  conditions above.
++
++config GRKERNSEC_VM86
++	bool "Restrict VM86 mode"
++	depends on X86_32
++
++	help
++	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
++	  make use of a special execution mode on 32bit x86 processors called
++	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
++	  video cards and will still work with this option enabled.  The purpose
++	  of the option is to prevent exploitation of emulation errors in
++	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
++	  Nearly all users should be able to enable this option.
++
++config GRKERNSEC_IO
++	bool "Disable privileged I/O"
++	depends on X86
++	select RTC_CLASS
++	select RTC_INTF_DEV
++	select RTC_DRV_CMOS
++
++	help
++	  If you say Y here, all ioperm and iopl calls will return an error.
++	  Ioperm and iopl can be used to modify the running kernel.
++	  Unfortunately, some programs need this access to operate properly,
++	  the most notable of which are XFree86 and hwclock.  hwclock can be
++	  remedied by having RTC support in the kernel, so real-time 
++	  clock support is enabled if this option is enabled, to ensure 
++	  that hwclock operates correctly.  XFree86 still will not 
++	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
++	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
++	  protect your kernel against modification, use the RBAC system.
++
++config GRKERNSEC_PROC_MEMMAP
++	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
++	default y if (PAX_NOEXEC || PAX_ASLR)
++	depends on PAX_NOEXEC || PAX_ASLR
++	help
++	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
++	  give no information about the addresses of its mappings if
++	  PaX features that rely on random addresses are enabled on the task.
++	  If you use PaX it is greatly recommended that you say Y here as it
++	  closes up a hole that makes the full ASLR useless for suid
++	  binaries.
++
++config GRKERNSEC_BRUTE
++	bool "Deter exploit bruteforcing"
++	help
++	  If you say Y here, attempts to bruteforce exploits against forking
++	  daemons such as apache or sshd will be deterred.  When a child of a
++	  forking daemon is killed by PaX or crashes due to an illegal
++	  instruction, the parent process will be delayed 30 seconds upon every
++	  subsequent fork until the administrator is able to assess the
++	  situation and restart the daemon.  It is recommended that you also
++	  enable signal logging in the auditing section so that logs are
++	  generated when a process performs an illegal instruction.
++
++config GRKERNSEC_MODHARDEN
++	bool "Harden module auto-loading"
++	depends on MODULES
++	help
++	  If you say Y here, module auto-loading in response to use of some
++	  feature implemented by an unloaded module will be restricted to
++	  root users.  Enabling this option helps defend against attacks 
++	  by unprivileged users who abuse the auto-loading behavior to 
++	  cause a vulnerable module to load that is then exploited.
++
++	  If this option prevents a legitimate use of auto-loading for a 
++	  non-root user, the administrator can execute modprobe manually 
++	  with the exact name of the module mentioned in the alert log.
++	  Alternatively, the administrator can add the module to the list
++	  of modules loaded at boot by modifying init scripts.
++
++	  Modification of init scripts will most likely be needed on 
++	  Ubuntu servers with encrypted home directory support enabled,
++	  as the first non-root user logging in will cause the ecb(aes),
++	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
++
++config GRKERNSEC_HIDESYM
++	bool "Hide kernel symbols"
++	help
++	  If you say Y here, getting information on loaded modules, and
++	  displaying all kernel symbols through a syscall will be restricted
++	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
++	  /proc/kallsyms will be restricted to the root user.  The RBAC
++	  system can hide that entry even from root.  Note that this option
++	  is only effective provided the following conditions are met:
++	  1) The kernel using grsecurity is not precompiled by some distribution
++	  2) You are using the RBAC system and hiding other files such as your
++	     kernel image and System.map.  Alternatively, enabling this option
++	     causes the permissions on /boot, /lib/modules, and the kernel
++	     source directory to change at compile time to prevent 
++	     reading by non-root users.
++	  If the above conditions are met, this option will aid in providing a
++	  useful protection against local kernel exploitation of overflows
++	  and arbitrary read/write vulnerabilities.
++
++endmenu
++menu "Role Based Access Control Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_NO_RBAC
++	bool "Disable RBAC system"
++	help
++	  If you say Y here, the /dev/grsec device will be removed from the kernel,
++	  preventing the RBAC system from being enabled.  You should only say Y
++	  here if you have no intention of using the RBAC system, so as to prevent
++	  an attacker with root access from misusing the RBAC system to hide files
++	  and processes when loadable module support and /dev/[k]mem have been
++	  locked down.
++
++config GRKERNSEC_ACL_HIDEKERN
++	bool "Hide kernel processes"
++	help
++	  If you say Y here, all kernel threads will be hidden to all
++	  processes but those whose subject has the "view hidden processes"
++	  flag.
++
++config GRKERNSEC_ACL_MAXTRIES
++	int "Maximum tries before password lockout"
++	default 3
++	help
++	  This option enforces the maximum number of times a user can attempt
++	  to authorize themselves with the grsecurity RBAC system before being
++	  denied the ability to attempt authorization again for a specified time.
++	  The lower the number, the harder it will be to brute-force a password.
++
++config GRKERNSEC_ACL_TIMEOUT
++	int "Time to wait after max password tries, in seconds"
++	default 30
++	help
++	  This option specifies the time the user must wait after attempting to
++	  authorize to the RBAC system with the maximum number of invalid
++	  passwords.  The higher the number, the harder it will be to brute-force
++	  a password.
++
++endmenu
++menu "Filesystem Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_PROC
++	bool "Proc restrictions"
++	help
++	  If you say Y here, the permissions of the /proc filesystem
++	  will be altered to enhance system security and privacy.  You MUST
++  	  choose either a user only restriction or a user and group restriction.
++	  Depending upon the option you choose, you can either restrict users to
++	  see only the processes they themselves run, or choose a group that can
++	  view all processes and files normally restricted to root if you choose
++	  the "restrict to user only" option.  NOTE: If you're running identd as
++	  a non-root user, you will have to run it as the group you specify here.
++
++config GRKERNSEC_PROC_USER
++	bool "Restrict /proc to user only"
++	depends on GRKERNSEC_PROC
++	help
++	  If you say Y here, non-root users will only be able to view their own
++	  processes, and restricts them from viewing network-related information,
++	  and viewing kernel symbol and module information.
++
++config GRKERNSEC_PROC_USERGROUP
++	bool "Allow special group"
++	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
++	help
++	  If you say Y here, you will be able to select a group that will be
++	  able to view all processes, network-related information, and
++	  kernel and symbol information.  This option is useful if you want
++	  to run identd as a non-root user.
++
++config GRKERNSEC_PROC_GID
++	int "GID for special group"
++	depends on GRKERNSEC_PROC_USERGROUP
++	default 1001
++
++config GRKERNSEC_PROC_ADD
++	bool "Additional restrictions"
++	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
++	help
++	  If you say Y here, additional restrictions will be placed on
++	  /proc that keep normal users from viewing device information and 
++	  slabinfo information that could be useful for exploits.
++
++config GRKERNSEC_LINK
++	bool "Linking restrictions"
++	help
++	  If you say Y here, /tmp race exploits will be prevented, since users
++	  will no longer be able to follow symlinks owned by other users in
++	  world-writable +t directories (i.e. /tmp), unless the owner of the
++	  symlink is the owner of the directory. users will also not be
++	  able to hardlink to files they do not own.  If the sysctl option is
++	  enabled, a sysctl option with name "linking_restrictions" is created.
++
++config GRKERNSEC_FIFO
++	bool "FIFO restrictions"
++	help
++	  If you say Y here, users will not be able to write to FIFOs they don't
++	  own in world-writable +t directories (i.e. /tmp), unless the owner of
++	  the FIFO is the same owner of the directory it's held in.  If the sysctl
++	  option is enabled, a sysctl option with name "fifo_restrictions" is
++	  created.
++
++config GRKERNSEC_ROFS
++	bool "Runtime read-only mount protection"
++	help
++	  If you say Y here, a sysctl option with name "romount_protect" will
++	  be created.  By setting this option to 1 at runtime, filesystems
++	  will be protected in the following ways:
++	  * No new writable mounts will be allowed
++	  * Existing read-only mounts won't be able to be remounted read/write
++	  * Write operations will be denied on all block devices
++	  This option acts independently of grsec_lock: once it is set to 1,
++	  it cannot be turned off.  Therefore, please be mindful of the resulting
++	  behavior if this option is enabled in an init script on a read-only
++	  filesystem.  This feature is mainly intended for secure embedded systems.
++
++config GRKERNSEC_CHROOT
++	bool "Chroot jail restrictions"
++	help
++	  If you say Y here, you will be able to choose several options that will
++	  make breaking out of a chrooted jail much more difficult.  If you
++	  encounter no software incompatibilities with the following options, it
++	  is recommended that you enable each one.
++
++config GRKERNSEC_CHROOT_MOUNT
++	bool "Deny mounts"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  mount or remount filesystems.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_deny_mount" is created.
++
++config GRKERNSEC_CHROOT_DOUBLE
++	bool "Deny double-chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chroot
++	  again outside the chroot.  This is a widely used method of breaking
++	  out of a chroot jail and should not be allowed.  If the sysctl 
++	  option is enabled, a sysctl option with name 
++	  "chroot_deny_chroot" is created.
++
++config GRKERNSEC_CHROOT_PIVOT
++	bool "Deny pivot_root in chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to use
++	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
++	  works similar to chroot in that it changes the root filesystem.  This
++	  function could be misused in a chrooted process to attempt to break out
++	  of the chroot, and therefore should not be allowed.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
++	  created.
++
++config GRKERNSEC_CHROOT_CHDIR
++	bool "Enforce chdir(\"/\") on all chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the current working directory of all newly-chrooted
++	  applications will be set to the the root directory of the chroot.
++	  The man page on chroot(2) states:
++	  Note that this call does not change  the  current  working
++	  directory,  so  that `.' can be outside the tree rooted at
++	  `/'.  In particular, the  super-user  can  escape  from  a
++	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
++
++	  It is recommended that you say Y here, since it's not known to break
++	  any software.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_enforce_chdir" is created.
++
++config GRKERNSEC_CHROOT_CHMOD
++	bool "Deny (f)chmod +s"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chmod
++	  or fchmod files to make them have suid or sgid bits.  This protects
++	  against another published method of breaking a chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
++	  created.
++
++config GRKERNSEC_CHROOT_FCHDIR
++	bool "Deny fchdir out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
++	  to a file descriptor of the chrooting process that points to a directory
++	  outside the filesystem will be stopped.  If the sysctl option
++	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
++
++config GRKERNSEC_CHROOT_MKNOD
++	bool "Deny mknod"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be allowed to
++	  mknod.  The problem with using mknod inside a chroot is that it
++	  would allow an attacker to create a device entry that is the same
++	  as one on the physical root of your system, which could range from
++	  anything from the console device to a device for your harddrive (which
++	  they could then use to wipe the drive or steal data).  It is recommended
++	  that you say Y here, unless you run into software incompatibilities.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_mknod" is created.
++
++config GRKERNSEC_CHROOT_SHMAT
++	bool "Deny shmat() out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to attach
++	  to shared memory segments that were created outside of the chroot jail.
++	  It is recommended that you say Y here.  If the sysctl option is enabled,
++	  a sysctl option with name "chroot_deny_shmat" is created.
++
++config GRKERNSEC_CHROOT_UNIX
++	bool "Deny access to abstract AF_UNIX sockets out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  connect to abstract (meaning not belonging to a filesystem) Unix
++	  domain sockets that were bound outside of a chroot.  It is recommended
++	  that you say Y here.  If the sysctl option is enabled, a sysctl option
++	  with name "chroot_deny_unix" is created.
++
++config GRKERNSEC_CHROOT_FINDTASK
++	bool "Protect outside processes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
++	  getsid, or view any process outside of the chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_findtask" is
++	  created.
++
++config GRKERNSEC_CHROOT_NICE
++	bool "Restrict priority changes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to raise
++	  the priority of processes in the chroot, or alter the priority of
++	  processes outside the chroot.  This provides more security than simply
++	  removing CAP_SYS_NICE from the process' capability set.  If the
++	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
++	  is created.
++
++config GRKERNSEC_CHROOT_SYSCTL
++	bool "Deny sysctl writes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, an attacker in a chroot will not be able to
++	  write to sysctl entries, either by sysctl(2) or through a /proc
++	  interface.  It is strongly recommended that you say Y here. If the
++	  sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_sysctl" is created.
++
++config GRKERNSEC_CHROOT_CAPS
++	bool "Capability restrictions"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the capabilities on all root processes within a
++	  chroot jail will be lowered to stop module insertion, raw i/o,
++	  system and net admin tasks, rebooting the system, modifying immutable
++	  files, modifying IPC owned by another, and changing the system time.
++	  This is left an option because it can break some apps.  Disable this
++	  if your chrooted apps are having problems performing those kinds of
++	  tasks.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_caps" is created.
++
++endmenu
++menu "Kernel Auditing"
++depends on GRKERNSEC
++
++config GRKERNSEC_AUDIT_GROUP
++	bool "Single group for auditing"
++	help
++	  If you say Y here, the exec, chdir, and (un)mount logging features
++	  will only operate on a group you specify.  This option is recommended
++	  if you only want to watch certain users instead of having a large
++	  amount of logs from the entire system.  If the sysctl option is enabled,
++	  a sysctl option with name "audit_group" is created.
++
++config GRKERNSEC_AUDIT_GID
++	int "GID for auditing"
++	depends on GRKERNSEC_AUDIT_GROUP
++	default 1007
++
++config GRKERNSEC_EXECLOG
++	bool "Exec logging"
++	help
++	  If you say Y here, all execve() calls will be logged (since the
++	  other exec*() calls are frontends to execve(), all execution
++	  will be logged).  Useful for shell-servers that like to keep track
++	  of their users.  If the sysctl option is enabled, a sysctl option with
++	  name "exec_logging" is created.
++	  WARNING: This option when enabled will produce a LOT of logs, especially
++	  on an active system.
++
++config GRKERNSEC_RESLOG
++	bool "Resource logging"
++	help
++	  If you say Y here, all attempts to overstep resource limits will
++	  be logged with the resource name, the requested size, and the current
++	  limit.  It is highly recommended that you say Y here.  If the sysctl
++	  option is enabled, a sysctl option with name "resource_logging" is
++	  created.  If the RBAC system is enabled, the sysctl value is ignored.
++
++config GRKERNSEC_CHROOT_EXECLOG
++	bool "Log execs within chroot"
++	help
++	  If you say Y here, all executions inside a chroot jail will be logged
++	  to syslog.  This can cause a large amount of logs if certain
++	  applications (eg. djb's daemontools) are installed on the system, and
++	  is therefore left as an option.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_execlog" is created.
++
++config GRKERNSEC_AUDIT_PTRACE
++	bool "Ptrace logging"
++	help
++	  If you say Y here, all attempts to attach to a process via ptrace
++	  will be logged.  If the sysctl option is enabled, a sysctl option
++	  with name "audit_ptrace" is created.
++
++config GRKERNSEC_AUDIT_CHDIR
++	bool "Chdir logging"
++	help
++	  If you say Y here, all chdir() calls will be logged.  If the sysctl
++ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
++
++config GRKERNSEC_AUDIT_MOUNT
++	bool "(Un)Mount logging"
++	help
++	  If you say Y here, all mounts and unmounts will be logged.  If the
++	  sysctl option is enabled, a sysctl option with name "audit_mount" is
++	  created.
++
++config GRKERNSEC_SIGNAL
++	bool "Signal logging"
++	help
++	  If you say Y here, certain important signals will be logged, such as
++	  SIGSEGV, which will as a result inform you of when a error in a program
++	  occurred, which in some cases could mean a possible exploit attempt.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "signal_logging" is created.
++
++config GRKERNSEC_FORKFAIL
++	bool "Fork failure logging"
++	help
++	  If you say Y here, all failed fork() attempts will be logged.
++	  This could suggest a fork bomb, or someone attempting to overstep
++	  their process limit.  If the sysctl option is enabled, a sysctl option
++	  with name "forkfail_logging" is created.
++
++config GRKERNSEC_TIME
++	bool "Time change logging"
++	help
++	  If you say Y here, any changes of the system clock will be logged.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "timechange_logging" is created.
++
++config GRKERNSEC_PROC_IPADDR
++	bool "/proc/<pid>/ipaddr support"
++	help
++	  If you say Y here, a new entry will be added to each /proc/<pid>
++	  directory that contains the IP address of the person using the task.
++	  The IP is carried across local TCP and AF_UNIX stream sockets.
++	  This information can be useful for IDS/IPSes to perform remote response
++	  to a local attack.  The entry is readable by only the owner of the
++	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
++	  the RBAC system), and thus does not create privacy concerns.
++
++config GRKERNSEC_AUDIT_TEXTREL
++	bool 'ELF text relocations logging (READ HELP)'
++	depends on PAX_MPROTECT
++	help
++	  If you say Y here, text relocations will be logged with the filename
++	  of the offending library or binary.  The purpose of the feature is
++	  to help Linux distribution developers get rid of libraries and
++	  binaries that need text relocations which hinder the future progress
++	  of PaX.  Only Linux distribution developers should say Y here, and
++	  never on a production machine, as this option creates an information
++	  leak that could aid an attacker in defeating the randomization of
++	  a single memory region.  If the sysctl option is enabled, a sysctl
++	  option with name "audit_textrel" is created.
++
++endmenu
++
++menu "Executable Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_EXECVE
++	bool "Enforce RLIMIT_NPROC on execs"
++	help
++	  If you say Y here, users with a resource limit on processes will
++	  have the value checked during execve() calls.  The current system
++	  only checks the system limit during fork() calls.  If the sysctl option
++	  is enabled, a sysctl option with name "execve_limiting" is created.
++
++config GRKERNSEC_DMESG
++	bool "Dmesg(8) restriction"
++	help
++	  If you say Y here, non-root users will not be able to use dmesg(8)
++	  to view up to the last 4kb of messages in the kernel's log buffer.
++	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
++	  created.
++
++config GRKERNSEC_HARDEN_PTRACE
++	bool "Deter ptrace-based process snooping"
++	help
++	  If you say Y here, TTY sniffers and other malicious monitoring
++	  programs implemented through ptrace will be defeated.  If you
++	  have been using the RBAC system, this option has already been
++	  enabled for several years for all users, with the ability to make
++	  fine-grained exceptions.
++
++	  This option only affects the ability of non-root users to ptrace
++	  processes that are not a descendent of the ptracing process.
++	  This means that strace ./binary and gdb ./binary will still work,
++	  but attaching to arbitrary processes will not.  If the sysctl
++	  option is enabled, a sysctl option with name "harden_ptrace" is
++	  created.
++
++config GRKERNSEC_TPE
++	bool "Trusted Path Execution (TPE)"
++	help
++	  If you say Y here, you will be able to choose a gid to add to the
++	  supplementary groups of users you want to mark as "untrusted."
++	  These users will not be able to execute any files that are not in
++	  root-owned directories writable only by root.  If the sysctl option
++	  is enabled, a sysctl option with name "tpe" is created.
++
++config GRKERNSEC_TPE_ALL
++	bool "Partially restrict non-root users"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, All non-root users other than the ones in the
++	  group specified in the main TPE option will only be allowed to
++	  execute files in directories they own that are not group or
++	  world-writable, or in directories owned by root and writable only by
++	  root.  If the sysctl option is enabled, a sysctl option with name
++	  "tpe_restrict_all" is created.
++
++config GRKERNSEC_TPE_INVERT
++	bool "Invert GID option"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, the group you specify in the TPE configuration will
++	  decide what group TPE restrictions will be *disabled* for.  This
++	  option is useful if you want TPE restrictions to be applied to most
++	  users on the system.
++
++config GRKERNSEC_TPE_GID
++	int "GID for untrusted users"
++	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++config GRKERNSEC_TPE_GID
++	int "GID for trusted users"
++	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++endmenu
++menu "Network Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_RANDNET
++	bool "Larger entropy pools"
++	help
++	  If you say Y here, the entropy pools used for many features of Linux
++	  and grsecurity will be doubled in size.  Since several grsecurity
++	  features use additional randomness, it is recommended that you say Y
++	  here.  Saying Y here has a similar effect as modifying
++	  /proc/sys/kernel/random/poolsize.
++
++config GRKERNSEC_BLACKHOLE
++	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
++	help
++	  If you say Y here, neither TCP resets nor ICMP
++	  destination-unreachable packets will be sent in response to packets
++	  send to ports for which no associated listening process exists.
++	  This feature supports both IPV4 and IPV6 and exempts the 
++	  loopback interface from blackholing.  Enabling this feature 
++	  makes a host more resilient to DoS attacks and reduces network
++	  visibility against scanners.
++
++	  The blackhole feature as-implemented is equivalent to the FreeBSD
++	  blackhole feature, as prevents RST responses to all packets, not
++	  just SYNs.  Under most application behavior this causes no
++	  problems, but applications (like haproxy) may not close certain
++	  connections in a way that cleanly terminates them on the remote
++	  end, leaving the remote host in LAST_ACK state.  Because of this
++	  side-effect and to prevent intentional LAST_ACK DoSes, this
++	  feature also adds automatic mitigation against such attacks.
++	  The mitigation drastically reduces the amount of time a socket
++	  can spend in LAST_ACK state.  If you're using haproxy and not
++	  all servers it connects to have this option enabled, consider
++	  disabling this feature on the haproxy host.
++
++	  If this option is enabled, two sysctl options with names
++	  "ip_blackhole" and "lastack_retries" will be created.
++	  While "ip_blackhole" takes the standard zero/non-zero on/off
++	  toggle, "lastack_retries" uses the same kinds of values as
++	  "tcp_retries1" and "tcp_retries2".  The default value of 4
++	  prevents a socket from lasting more than 45 seconds in LAST_ACK
++	  state.
++
++config GRKERNSEC_SOCKET
++	bool "Socket restrictions"
++	help
++	  If you say Y here, you will be able to choose from several options.
++	  If you assign a GID on your system and add it to the supplementary
++	  groups of users you want to restrict socket access to, this patch
++	  will perform up to three things, based on the option(s) you choose.
++
++config GRKERNSEC_SOCKET_ALL
++	bool "Deny any sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine or run server
++	  applications from your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_all" is created.
++
++config GRKERNSEC_SOCKET_ALL_GID
++	int "GID to deny all sockets for"
++	depends on GRKERNSEC_SOCKET_ALL
++	default 1004
++	help
++	  Here you can choose the GID to disable socket access for. Remember to
++	  add the users you want socket access disabled for to the GID
++	  specified here.  If the sysctl option is enabled, a sysctl option
++	  with name "socket_all_gid" is created.
++
++config GRKERNSEC_SOCKET_CLIENT
++	bool "Deny client sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine, but will be
++	  able to run servers.  If this option is enabled, all users in the group
++	  you specify will have to use passive mode when initiating ftp transfers
++	  from the shell on your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_client" is created.
++
++config GRKERNSEC_SOCKET_CLIENT_GID
++	int "GID to deny client sockets for"
++	depends on GRKERNSEC_SOCKET_CLIENT
++	default 1003
++	help
++	  Here you can choose the GID to disable client socket access for.
++	  Remember to add the users you want client socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_client_gid" is created.
++
++config GRKERNSEC_SOCKET_SERVER
++	bool "Deny server sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to run server applications from your machine.  If the sysctl
++	  option is enabled, a sysctl option with name "socket_server" is created.
++
++config GRKERNSEC_SOCKET_SERVER_GID
++	int "GID to deny server sockets for"
++	depends on GRKERNSEC_SOCKET_SERVER
++	default 1002
++	help
++	  Here you can choose the GID to disable server socket access for.
++	  Remember to add the users you want server socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_server_gid" is created.
++
++endmenu
++menu "Sysctl support"
++depends on GRKERNSEC && SYSCTL
++
++config GRKERNSEC_SYSCTL
++	bool "Sysctl support"
++	help
++	  If you say Y here, you will be able to change the options that
++	  grsecurity runs with at bootup, without having to recompile your
++	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
++	  to enable (1) or disable (0) various features.  All the sysctl entries
++	  are mutable until the "grsec_lock" entry is set to a non-zero value.
++	  All features enabled in the kernel configuration are disabled at boot
++	  if you do not say Y to the "Turn on features by default" option.
++	  All options should be set at startup, and the grsec_lock entry should
++	  be set to a non-zero value after all the options are set.
++	  *THIS IS EXTREMELY IMPORTANT*
++
++config GRKERNSEC_SYSCTL_ON
++	bool "Turn on features by default"
++	depends on GRKERNSEC_SYSCTL
++	help
++	  If you say Y here, instead of having all features enabled in the
++	  kernel configuration disabled at boot time, the features will be
++	  enabled at boot time.  It is recommended you say Y here unless
++	  there is some reason you would want all sysctl-tunable features to
++	  be disabled by default.  As mentioned elsewhere, it is important
++	  to enable the grsec_lock entry once you have finished modifying
++	  the sysctl entries.
++
++endmenu
++menu "Logging Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_FLOODTIME
++	int "Seconds in between log messages (minimum)"
++	default 10
++	help
++	  This option allows you to enforce the number of seconds between
++	  grsecurity log messages.  The default should be suitable for most
++	  people, however, if you choose to change it, choose a value small enough
++	  to allow informative logs to be produced, but large enough to
++	  prevent flooding.
++
++config GRKERNSEC_FLOODBURST
++	int "Number of messages in a burst (maximum)"
++	default 4
++	help
++	  This option allows you to choose the maximum number of messages allowed
++	  within the flood time interval you chose in a separate option.  The
++	  default should be suitable for most people, however if you find that
++	  many of your logs are being interpreted as flooding, you may want to
++	  raise this value.
++
++endmenu
++
++endmenu
+diff -urNp linux-2.6.32.13/grsecurity/Makefile linux-2.6.32.13/grsecurity/Makefile
+--- linux-2.6.32.13/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/grsecurity/Makefile	2010-05-15 13:21:17.910594530 -0400
+@@ -0,0 +1,29 @@
++# grsecurity's ACL system was originally written in 2001 by Michael Dalton
++# during 2001-2009 it has been completely redesigned by Brad Spengler
++# into an RBAC system
++#
++# All code in this directory and various hooks inserted throughout the kernel
++# are copyright Brad Spengler - Open Source Security, Inc., and released 
++# under the GPL v2 or higher
++
++obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
++	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
++	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
++
++obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
++	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
++	gracl_learn.o grsec_log.o
++obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
++
++ifndef CONFIG_GRKERNSEC
++obj-y += grsec_disabled.o
++endif
++
++ifdef CONFIG_GRKERNSEC_HIDESYM
++extra-y := grsec_hidesym.o
++$(obj)/grsec_hidesym.o:
++	@-chmod -f 500 /boot
++	@-chmod -f 500 /lib/modules
++	@-chmod -f 700 .
++	@echo '  grsec: protected kernel image paths'
++endif
+diff -urNp linux-2.6.32.13/include/acpi/acoutput.h linux-2.6.32.13/include/acpi/acoutput.h
+--- linux-2.6.32.13/include/acpi/acoutput.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/acpi/acoutput.h	2010-05-15 13:21:17.910594530 -0400
+@@ -264,8 +264,8 @@
+  * leaving no executable debug code!
+  */
+ #define ACPI_FUNCTION_NAME(a)
+-#define ACPI_DEBUG_PRINT(pl)
+-#define ACPI_DEBUG_PRINT_RAW(pl)
++#define ACPI_DEBUG_PRINT(pl) do {} while (0)
++#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
+ 
+ #endif				/* ACPI_DEBUG_OUTPUT */
+ 
+diff -urNp linux-2.6.32.13/include/acpi/acpi_drivers.h linux-2.6.32.13/include/acpi/acpi_drivers.h
+--- linux-2.6.32.13/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/acpi/acpi_drivers.h	2010-05-15 13:21:17.910594530 -0400
+@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
+                                   Dock Station
+   -------------------------------------------------------------------------- */
+ struct acpi_dock_ops {
+-	acpi_notify_handler handler;
+-	acpi_notify_handler uevent;
++	const acpi_notify_handler handler;
++	const acpi_notify_handler uevent;
+ };
+ 
+ #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
+@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
+ extern int register_dock_notifier(struct notifier_block *nb);
+ extern void unregister_dock_notifier(struct notifier_block *nb);
+ extern int register_hotplug_dock_device(acpi_handle handle,
+-					struct acpi_dock_ops *ops,
++					const struct acpi_dock_ops *ops,
+ 					void *context);
+ extern void unregister_hotplug_dock_device(acpi_handle handle);
+ #else
+@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
+ {
+ }
+ static inline int register_hotplug_dock_device(acpi_handle handle,
+-					       struct acpi_dock_ops *ops,
++					       const struct acpi_dock_ops *ops,
+ 					       void *context)
+ {
+ 	return -ENODEV;
+diff -urNp linux-2.6.32.13/include/asm-generic/atomic-long.h linux-2.6.32.13/include/asm-generic/atomic-long.h
+--- linux-2.6.32.13/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/atomic-long.h	2010-05-15 13:21:17.910594530 -0400
+@@ -22,6 +22,12 @@
+ 
+ typedef atomic64_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic64_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic64_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
+ 
+ static inline long atomic_long_read(atomic_long_t *l)
+@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic64_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
+ 	atomic64_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic64_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
+ 	atomic64_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic64_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
+ 
+ typedef atomic_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
+ static inline long atomic_long_read(atomic_long_t *l)
+ {
+@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
+ 	atomic_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
+ 	atomic_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
+ 
+ #endif  /*  BITS_PER_LONG == 64  */
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void pax_refcount_needs_these_functions(void)
++{
++	atomic_read_unchecked((atomic_unchecked_t *)NULL);
++	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
++	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
++
++	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
++	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
++}
++#else
++#define atomic_read_unchecked(v) atomic_read(v)
++#define atomic_set_unchecked(v, i) atomic_set((v), (i))
++#define atomic_add_unchecked(i, v) atomic_add((i), (v))
++#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
++#define atomic_inc_unchecked(v) atomic_inc(v)
++
++#define atomic_long_read_unchecked(v) atomic_long_read(v)
++#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
++#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
++#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
++#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
++#endif
++
+ #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
+diff -urNp linux-2.6.32.13/include/asm-generic/dma-mapping-common.h linux-2.6.32.13/include/asm-generic/dma-mapping-common.h
+--- linux-2.6.32.13/include/asm-generic/dma-mapping-common.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/dma-mapping-common.h	2010-05-15 13:21:17.910594530 -0400
+@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
+ 					      enum dma_data_direction dir,
+ 					      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(ptr, size);
+@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
+ 					  enum dma_data_direction dir,
+ 					  struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
+ 				   int nents, enum dma_data_direction dir,
+ 				   struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	int i, ents;
+ 	struct scatterlist *s;
+ 
+@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
+ 				      int nents, enum dma_data_direction dir,
+ 				      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	debug_dma_unmap_sg(dev, sg, nents, dir);
+@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
+ 				      size_t offset, size_t size,
+ 				      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(page_address(page) + offset, size);
+@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
+ static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+ 				  size_t size, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
+ 					   size_t size,
+ 					   enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_cpu)
+@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
+ 					      dma_addr_t addr, size_t size,
+ 					      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_device)
+@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
+ 						 size_t size,
+ 						 enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_cpu) {
+@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
+ 						    size_t size,
+ 						    enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_device) {
+@@ -155,7 +155,7 @@ static inline void
+ dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
+ 		    int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_cpu)
+@@ -167,7 +167,7 @@ static inline void
+ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
+ 		       int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_device)
+diff -urNp linux-2.6.32.13/include/asm-generic/futex.h linux-2.6.32.13/include/asm-generic/futex.h
+--- linux-2.6.32.13/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/futex.h	2010-05-15 13:21:17.910594530 -0400
+@@ -6,7 +6,7 @@
+ #include <asm/errno.h>
+ 
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
++futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
+ }
+ 
+ static inline int
+-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
++futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
+ {
+ 	return -ENOSYS;
+ }
+diff -urNp linux-2.6.32.13/include/asm-generic/int-l64.h linux-2.6.32.13/include/asm-generic/int-l64.h
+--- linux-2.6.32.13/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/int-l64.h	2010-05-15 13:21:17.910594530 -0400
+@@ -46,6 +46,8 @@ typedef unsigned int u32;
+ typedef signed long s64;
+ typedef unsigned long u64;
+ 
++typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.13/include/asm-generic/int-ll64.h linux-2.6.32.13/include/asm-generic/int-ll64.h
+--- linux-2.6.32.13/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/int-ll64.h	2010-05-15 13:21:17.910594530 -0400
+@@ -51,6 +51,8 @@ typedef unsigned int u32;
+ typedef signed long long s64;
+ typedef unsigned long long u64;
+ 
++typedef unsigned long long intoverflow_t;
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.13/include/asm-generic/kmap_types.h linux-2.6.32.13/include/asm-generic/kmap_types.h
+--- linux-2.6.32.13/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/kmap_types.h	2010-05-15 13:21:17.910594530 -0400
+@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
+ KMAP_D(16)	KM_IRQ_PTE,
+ KMAP_D(17)	KM_NMI,
+ KMAP_D(18)	KM_NMI_PTE,
+-KMAP_D(19)	KM_TYPE_NR
++KMAP_D(19)	KM_CLEARPAGE,
++KMAP_D(20)	KM_TYPE_NR
+ };
+ 
+ #undef KMAP_D
+diff -urNp linux-2.6.32.13/include/asm-generic/pgtable.h linux-2.6.32.13/include/asm-generic/pgtable.h
+--- linux-2.6.32.13/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/pgtable.h	2010-05-15 13:21:17.910594530 -0400
+@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
+ 				unsigned long size);
+ #endif
+ 
++#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
++static inline unsigned long pax_open_kernel(void) { return 0; }
++#endif
++
++#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #endif /* !__ASSEMBLY__ */
+ 
+ #endif /* _ASM_GENERIC_PGTABLE_H */
+diff -urNp linux-2.6.32.13/include/asm-generic/vmlinux.lds.h linux-2.6.32.13/include/asm-generic/vmlinux.lds.h
+--- linux-2.6.32.13/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/asm-generic/vmlinux.lds.h	2010-05-15 13:21:17.910594530 -0400
+@@ -199,6 +199,7 @@
+ 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
+ 		VMLINUX_SYMBOL(__start_rodata) = .;			\
+ 		*(.rodata) *(.rodata.*)					\
++		*(.data.read_only)					\
+ 		*(__vermagic)		/* Kernel version magic */	\
+ 		*(__markers_strings)	/* Markers: strings */		\
+ 		*(__tracepoints_strings)/* Tracepoints: strings */	\
+@@ -656,22 +657,24 @@
+  * section in the linker script will go there too.  @phdr should have
+  * a leading colon.
+  *
+- * Note that this macros defines __per_cpu_load as an absolute symbol.
++ * Note that this macros defines per_cpu_load as an absolute symbol.
+  * If there is no need to put the percpu section at a predetermined
+  * address, use PERCPU().
+  */
+ #define PERCPU_VADDR(vaddr, phdr)					\
+-	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
+-	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
++	per_cpu_load = .;						\
++	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
+ 				- LOAD_OFFSET) {			\
++		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
+ 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
+ 		*(.data.percpu.first)					\
+-		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu)						\
++		. = ALIGN(PAGE_SIZE);					\
++		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu.shared_aligned)				\
+ 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
+ 	} phdr								\
+-	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
++	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
+ 
+ /**
+  * PERCPU - define output section for percpu area, simple version
+diff -urNp linux-2.6.32.13/include/drm/drm_pciids.h linux-2.6.32.13/include/drm/drm_pciids.h
+--- linux-2.6.32.13/include/drm/drm_pciids.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.13/include/drm/drm_pciids.h	2010-05-15 13:21:17.910594530 -0400
+@@ -377,7 +377,7 @@
+ 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define r128_PCI_IDS \
+ 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -417,14 +417,14 @@
+ 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mga_PCI_IDS \
+ 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
+ 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mach64_PCI_IDS \
+ 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -447,7 +447,7 @@
+ 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define sisdrv_PCI_IDS \
+ 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -458,7 +458,7 @@
+ 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+ 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define tdfx_PCI_IDS \
+ 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -467,7 +467,7 @@
+ 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define viadrv_PCI_IDS \
+ 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -479,14 +479,14 @@
+ 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
+ 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i810_PCI_IDS \
+ 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i830_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -494,11 +494,11 @@
+ 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define gamma_PCI_IDS \
+ 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define savage_PCI_IDS \
+ 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
+@@ -524,10 +524,10 @@
+ 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
+ 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+ 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define ffb_PCI_IDS \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i915_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+@@ -560,4 +560,4 @@
+ 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+diff -urNp linux-2.6.32.13/include/drm/drmP.h linux-2.6.32.13/include/drm/drmP.h
+--- linux-2.6.32.13/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/drm/drmP.h	2010-05-15 13:21:17.910594530 -0400
+@@ -814,7 +814,7 @@ struct drm_driver {
+ 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
+ 
+ 	/* Driver private ops for this object */
+-	struct vm_operations_struct *gem_vm_ops;
++	const struct vm_operations_struct *gem_vm_ops;
+ 
+ 	int major;
+ 	int minor;
+@@ -917,7 +917,7 @@ struct drm_device {
+ 
+ 	/** \name Usage Counters */
+ 	/*@{ */
+-	int open_count;			/**< Outstanding files open */
++	atomic_t open_count;		/**< Outstanding files open */
+ 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
+ 	atomic_t vma_count;		/**< Outstanding vma areas open */
+ 	int buf_use;			/**< Buffers in use -- cannot alloc */
+@@ -928,7 +928,7 @@ struct drm_device {
+ 	/*@{ */
+ 	unsigned long counters;
+ 	enum drm_stat_type types[15];
+-	atomic_t counts[15];
++	atomic_unchecked_t counts[15];
+ 	/*@} */
+ 
+ 	struct list_head filelist;
+diff -urNp linux-2.6.32.13/include/linux/a.out.h linux-2.6.32.13/include/linux/a.out.h
+--- linux-2.6.32.13/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/a.out.h	2010-05-15 13:21:17.914599996 -0400
+@@ -39,6 +39,14 @@ enum machine_type {
+   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
+ };
+ 
++/* Constants for the N_FLAGS field */
++#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
++#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
++#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
++#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
++/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
++#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
++
+ #if !defined (N_MAGIC)
+ #define N_MAGIC(exec) ((exec).a_info & 0xffff)
+ #endif
+diff -urNp linux-2.6.32.13/include/linux/atmdev.h linux-2.6.32.13/include/linux/atmdev.h
+--- linux-2.6.32.13/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/atmdev.h	2010-05-15 13:21:17.914599996 -0400
+@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
+ #endif
+ 
+ struct k_atm_aal_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.13/include/linux/backlight.h linux-2.6.32.13/include/linux/backlight.h
+--- linux-2.6.32.13/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/backlight.h	2010-05-15 13:21:17.914599996 -0400
+@@ -36,18 +36,18 @@ struct backlight_device;
+ struct fb_info;
+ 
+ struct backlight_ops {
+-	unsigned int options;
++	const unsigned int options;
+ 
+ #define BL_CORE_SUSPENDRESUME	(1 << 0)
+ 
+ 	/* Notify the backlight driver some property has changed */
+-	int (*update_status)(struct backlight_device *);
++	int (* const update_status)(struct backlight_device *);
+ 	/* Return the current backlight brightness (accounting for power,
+ 	   fb_blank etc.) */
+-	int (*get_brightness)(struct backlight_device *);
++	int (* const get_brightness)(struct backlight_device *);
+ 	/* Check if given framebuffer device is the one bound to this backlight;
+ 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
+-	int (*check_fb)(struct fb_info *);
++	int (* const check_fb)(struct fb_info *);
+ };
+ 
+ /* This structure defines all the properties of a backlight */
+@@ -86,7 +86,7 @@ struct backlight_device {
+ 	   registered this device has been unloaded, and if class_get_devdata()
+ 	   points to something in the body of that driver, it is also invalid. */
+ 	struct mutex ops_lock;
+-	struct backlight_ops *ops;
++	const struct backlight_ops *ops;
+ 
+ 	/* The framebuffer notifier block */
+ 	struct notifier_block fb_notif;
+@@ -103,7 +103,7 @@ static inline void backlight_update_stat
+ }
+ 
+ extern struct backlight_device *backlight_device_register(const char *name,
+-	struct device *dev, void *devdata, struct backlight_ops *ops);
++	struct device *dev, void *devdata, const struct backlight_ops *ops);
+ extern void backlight_device_unregister(struct backlight_device *bd);
+ extern void backlight_force_update(struct backlight_device *bd,
+ 				   enum backlight_update_reason reason);
+diff -urNp linux-2.6.32.13/include/linux/binfmts.h linux-2.6.32.13/include/linux/binfmts.h
+--- linux-2.6.32.13/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/binfmts.h	2010-05-15 13:21:17.934614916 -0400
+@@ -78,6 +78,7 @@ struct linux_binfmt {
+ 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
+ 	int (*load_shlib)(struct file *);
+ 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
+ 	unsigned long min_coredump;	/* minimal dump size */
+ 	int hasvdso;
+ };
+diff -urNp linux-2.6.32.13/include/linux/blkdev.h linux-2.6.32.13/include/linux/blkdev.h
+--- linux-2.6.32.13/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/blkdev.h	2010-05-15 13:21:17.934614916 -0400
+@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
+ #endif /* CONFIG_BLK_DEV_INTEGRITY */
+ 
+ struct block_device_operations {
+-	int (*open) (struct block_device *, fmode_t);
+-	int (*release) (struct gendisk *, fmode_t);
+-	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*direct_access) (struct block_device *, sector_t,
++	int (* const open) (struct block_device *, fmode_t);
++	int (* const release) (struct gendisk *, fmode_t);
++	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const direct_access) (struct block_device *, sector_t,
+ 						void **, unsigned long *);
+-	int (*media_changed) (struct gendisk *);
+-	unsigned long long (*set_capacity) (struct gendisk *,
++	int (* const media_changed) (struct gendisk *);
++	unsigned long long (* const set_capacity) (struct gendisk *,
+ 						unsigned long long);
+-	int (*revalidate_disk) (struct gendisk *);
+-	int (*getgeo)(struct block_device *, struct hd_geometry *);
+-	struct module *owner;
++	int (* const revalidate_disk) (struct gendisk *);
++	int (*const getgeo)(struct block_device *, struct hd_geometry *);
++	struct module * const owner;
+ };
+ 
+ extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
+diff -urNp linux-2.6.32.13/include/linux/cache.h linux-2.6.32.13/include/linux/cache.h
+--- linux-2.6.32.13/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/cache.h	2010-05-15 13:21:17.934614916 -0400
+@@ -16,6 +16,10 @@
+ #define __read_mostly
+ #endif
+ 
++#ifndef __read_only
++#define __read_only __read_mostly
++#endif
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+diff -urNp linux-2.6.32.13/include/linux/capability.h linux-2.6.32.13/include/linux/capability.h
+--- linux-2.6.32.13/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/capability.h	2010-05-15 13:21:17.934614916 -0400
+@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
+ 	(security_real_capable_noaudit((t), (cap)) == 0)
+ 
+ extern int capable(int cap);
++int capable_nolog(int cap);
+ 
+ /* audit system wants to get cap info from files as well */
+ struct dentry;
+diff -urNp linux-2.6.32.13/include/linux/compiler-gcc4.h linux-2.6.32.13/include/linux/compiler-gcc4.h
+--- linux-2.6.32.13/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/compiler-gcc4.h	2010-05-15 13:21:17.934614916 -0400
+@@ -36,4 +36,8 @@
+    the kernel context */
+ #define __cold			__attribute__((__cold__))
+ 
++#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
++#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
++#define __bos0(ptr)		__bos((ptr), 0)
++#define __bos1(ptr)		__bos((ptr), 1)
+ #endif
+diff -urNp linux-2.6.32.13/include/linux/compiler.h linux-2.6.32.13/include/linux/compiler.h
+--- linux-2.6.32.13/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/compiler.h	2010-05-15 13:21:17.934614916 -0400
+@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
+ #define __cold
+ #endif
+ 
++#ifndef __alloc_size
++#define __alloc_size
++#endif
++
++#ifndef __bos
++#define __bos
++#endif
++
++#ifndef __bos0
++#define __bos0
++#endif
++
++#ifndef __bos1
++#define __bos1
++#endif
++
+ /* Simple shorthand for a section definition */
+ #ifndef __section
+ # define __section(S) __attribute__ ((__section__(#S)))
+diff -urNp linux-2.6.32.13/include/linux/decompress/mm.h linux-2.6.32.13/include/linux/decompress/mm.h
+--- linux-2.6.32.13/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
++++ linux-2.6.32.13/include/linux/decompress/mm.h	2010-05-15 13:21:17.938584561 -0400
+@@ -78,7 +78,7 @@ static void free(void *where)
+  * warnings when not needed (indeed large_malloc / large_free are not
+  * needed by inflate */
+ 
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ 
+ #define large_malloc(a) vmalloc(a)
+diff -urNp linux-2.6.32.13/include/linux/dma-mapping.h linux-2.6.32.13/include/linux/dma-mapping.h
+--- linux-2.6.32.13/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/dma-mapping.h	2010-05-15 13:21:17.938584561 -0400
+@@ -16,50 +16,50 @@ enum dma_data_direction {
+ };
+ 
+ struct dma_map_ops {
+-	void* (*alloc_coherent)(struct device *dev, size_t size,
++	void* (* const alloc_coherent)(struct device *dev, size_t size,
+ 				dma_addr_t *dma_handle, gfp_t gfp);
+-	void (*free_coherent)(struct device *dev, size_t size,
++	void (* const free_coherent)(struct device *dev, size_t size,
+ 			      void *vaddr, dma_addr_t dma_handle);
+-	dma_addr_t (*map_page)(struct device *dev, struct page *page,
++	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
+ 			       unsigned long offset, size_t size,
+ 			       enum dma_data_direction dir,
+ 			       struct dma_attrs *attrs);
+-	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
++	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
+ 			   size_t size, enum dma_data_direction dir,
+ 			   struct dma_attrs *attrs);
+-	int (*map_sg)(struct device *dev, struct scatterlist *sg,
++	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
+ 		      int nents, enum dma_data_direction dir,
+ 		      struct dma_attrs *attrs);
+-	void (*unmap_sg)(struct device *dev,
++	void (* const unmap_sg)(struct device *dev,
+ 			 struct scatterlist *sg, int nents,
+ 			 enum dma_data_direction dir,
+ 			 struct dma_attrs *attrs);
+-	void (*sync_single_for_cpu)(struct device *dev,
++	void (* const sync_single_for_cpu)(struct device *dev,
+ 				    dma_addr_t dma_handle, size_t size,
+ 				    enum dma_data_direction dir);
+-	void (*sync_single_for_device)(struct device *dev,
++	void (* const sync_single_for_device)(struct device *dev,
+ 				       dma_addr_t dma_handle, size_t size,
+ 				       enum dma_data_direction dir);
+-	void (*sync_single_range_for_cpu)(struct device *dev,
++	void (* const sync_single_range_for_cpu)(struct device *dev,
+ 					  dma_addr_t dma_handle,
+ 					  unsigned long offset,
+ 					  size_t size,
+ 					  enum dma_data_direction dir);
+-	void (*sync_single_range_for_device)(struct device *dev,
++	void (* const sync_single_range_for_device)(struct device *dev,
+ 					     dma_addr_t dma_handle,
+ 					     unsigned long offset,
+ 					     size_t size,
+ 					     enum dma_data_direction dir);
+-	void (*sync_sg_for_cpu)(struct device *dev,
++	void (* const sync_sg_for_cpu)(struct device *dev,
+ 				struct scatterlist *sg, int nents,
+ 				enum dma_data_direction dir);
+-	void (*sync_sg_for_device)(struct device *dev,
++	void (* const sync_sg_for_device)(struct device *dev,
+ 				   struct scatterlist *sg, int nents,
+ 				   enum dma_data_direction dir);
+-	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
+-	int (*dma_supported)(struct device *dev, u64 mask);
++	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
++	int (* const dma_supported)(struct device *dev, u64 mask);
+ 	int (*set_dma_mask)(struct device *dev, u64 mask);
+-	int is_phys;
++	const int is_phys;
+ };
+ 
+ #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+diff -urNp linux-2.6.32.13/include/linux/dst.h linux-2.6.32.13/include/linux/dst.h
+--- linux-2.6.32.13/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/dst.h	2010-05-15 13:21:17.938584561 -0400
+@@ -380,7 +380,7 @@ struct dst_node
+ 	struct thread_pool	*pool;
+ 
+ 	/* Transaction IDs live here */
+-	atomic_long_t		gen;
++	atomic_long_unchecked_t	gen;
+ 
+ 	/*
+ 	 * How frequently and how many times transaction
+diff -urNp linux-2.6.32.13/include/linux/elf.h linux-2.6.32.13/include/linux/elf.h
+--- linux-2.6.32.13/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/elf.h	2010-05-15 13:21:17.938584561 -0400
+@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
+ #define PT_GNU_EH_FRAME		0x6474e550
+ 
+ #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
++#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
++
++#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
++
++/* Constants for the e_flags field */
++#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
++#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
++#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
++#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
++/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
++#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
+ 
+ /* These constants define the different elf file types */
+ #define ET_NONE   0
+@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
+ #define DT_DEBUG	21
+ #define DT_TEXTREL	22
+ #define DT_JMPREL	23
++#define DT_FLAGS	30
++  #define DF_TEXTREL  0x00000004
+ #define DT_ENCODING	32
+ #define OLD_DT_LOOS	0x60000000
+ #define DT_LOOS		0x6000000d
+@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
+ #define PF_W		0x2
+ #define PF_X		0x1
+ 
++#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
++#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
++#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
++#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
++#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
++#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
++/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
++/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
++#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
++#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
++#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
++#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
++
+ typedef struct elf32_phdr{
+   Elf32_Word	p_type;
+   Elf32_Off	p_offset;
+@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
+ #define	EI_OSABI	7
+ #define	EI_PAD		8
+ 
++#define	EI_PAX		14
++
+ #define	ELFMAG0		0x7f		/* EI_MAG */
+ #define	ELFMAG1		'E'
+ #define	ELFMAG2		'L'
+@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
+ #define elf_addr_t	Elf32_Off
++#define elf_dyn		Elf32_Dyn
+ 
+ #else
+ 
+@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
+ #define elf_phdr	elf64_phdr
+ #define elf_note	elf64_note
+ #define elf_addr_t	Elf64_Off
++#define elf_dyn		Elf64_Dyn
+ 
+ #endif
+ 
+diff -urNp linux-2.6.32.13/include/linux/fs.h linux-2.6.32.13/include/linux/fs.h
+--- linux-2.6.32.13/include/linux/fs.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.13/include/linux/fs.h	2010-05-15 13:21:17.938584561 -0400
+@@ -90,6 +90,11 @@ struct inodes_stat_t {
+ /* Expect random access pattern */
+ #define FMODE_RANDOM		((__force fmode_t)4096)
+ 
++/* Hack for grsec so as not to require read permission simply to execute
++ * a binary
++ */
++#define FMODE_GREXEC		((__force fmode_t)8192)
++
+ /*
+  * The below are the various read and write types that we support. Some of
+  * them include behavioral modifiers that send information down to the
+@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
+ 		unsigned long, unsigned long);
+ 
+ struct address_space_operations {
+-	int (*writepage)(struct page *page, struct writeback_control *wbc);
+-	int (*readpage)(struct file *, struct page *);
+-	void (*sync_page)(struct page *);
++	int (* const writepage)(struct page *page, struct writeback_control *wbc);
++	int (* const readpage)(struct file *, struct page *);
++	void (* const sync_page)(struct page *);
+ 
+ 	/* Write back some dirty pages from this mapping. */
+-	int (*writepages)(struct address_space *, struct writeback_control *);
++	int (* const writepages)(struct address_space *, struct writeback_control *);
+ 
+ 	/* Set a page dirty.  Return true if this dirtied it */
+-	int (*set_page_dirty)(struct page *page);
++	int (* const set_page_dirty)(struct page *page);
+ 
+-	int (*readpages)(struct file *filp, struct address_space *mapping,
++	int (* const readpages)(struct file *filp, struct address_space *mapping,
+ 			struct list_head *pages, unsigned nr_pages);
+ 
+-	int (*write_begin)(struct file *, struct address_space *mapping,
++	int (* const write_begin)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned flags,
+ 				struct page **pagep, void **fsdata);
+-	int (*write_end)(struct file *, struct address_space *mapping,
++	int (* const write_end)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned copied,
+ 				struct page *page, void *fsdata);
+ 
+ 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
+-	sector_t (*bmap)(struct address_space *, sector_t);
+-	void (*invalidatepage) (struct page *, unsigned long);
+-	int (*releasepage) (struct page *, gfp_t);
+-	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
++	sector_t (* const bmap)(struct address_space *, sector_t);
++	void (* const invalidatepage) (struct page *, unsigned long);
++	int (* const releasepage) (struct page *, gfp_t);
++	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
+ 			loff_t offset, unsigned long nr_segs);
+-	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
++	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
+ 						void **, unsigned long *);
+ 	/* migrate the contents of a page to the specified target */
+-	int (*migratepage) (struct address_space *,
++	int (* const migratepage) (struct address_space *,
+ 			struct page *, struct page *);
+-	int (*launder_page) (struct page *);
+-	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
++	int (* const launder_page) (struct page *);
++	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
+ 					unsigned long);
+-	int (*error_remove_page)(struct address_space *, struct page *);
++	int (* const error_remove_page)(struct address_space *, struct page *);
+ };
+ 
+ /*
+@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
+ typedef struct files_struct *fl_owner_t;
+ 
+ struct file_lock_operations {
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
+ };
+ 
+ struct lock_manager_operations {
+-	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
+-	void (*fl_notify)(struct file_lock *);	/* unblock callback */
+-	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
+-	void (*fl_break)(struct file_lock *);
+-	int (*fl_mylease)(struct file_lock *, struct file_lock *);
+-	int (*fl_change)(struct file_lock **, int);
++	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
++	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
++	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
++	void (* const fl_break)(struct file_lock *);
++	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
++	int (* const fl_change)(struct file_lock **, int);
+ };
+ 
+ struct lock_manager {
+@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
+ 	unsigned int fi_flags;		/* Flags as passed from user */
+ 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
+ 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
+-	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
++	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
+ 						 * array */
+ };
+ int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
+@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
+ 		unsigned long, loff_t *);
+ 
+ struct super_operations {
+-   	struct inode *(*alloc_inode)(struct super_block *sb);
+-	void (*destroy_inode)(struct inode *);
++   	struct inode *(* const alloc_inode)(struct super_block *sb);
++	void (* const destroy_inode)(struct inode *);
+ 
+-   	void (*dirty_inode) (struct inode *);
+-	int (*write_inode) (struct inode *, int);
+-	void (*drop_inode) (struct inode *);
+-	void (*delete_inode) (struct inode *);
+-	void (*put_super) (struct super_block *);
+-	void (*write_super) (struct super_block *);
+-	int (*sync_fs)(struct super_block *sb, int wait);
+-	int (*freeze_fs) (struct super_block *);
+-	int (*unfreeze_fs) (struct super_block *);
+-	int (*statfs) (struct dentry *, struct kstatfs *);
+-	int (*remount_fs) (struct super_block *, int *, char *);
+-	void (*clear_inode) (struct inode *);
+-	void (*umount_begin) (struct super_block *);
++   	void (* const dirty_inode) (struct inode *);
++	int (* const write_inode) (struct inode *, int);
++	void (* const drop_inode) (struct inode *);
++	void (* const delete_inode) (struct inode *);
++	void (* const put_super) (struct super_block *);
++	void (* const write_super) (struct super_block *);
++	int (* const sync_fs)(struct super_block *sb, int wait);
++	int (* const freeze_fs) (struct super_block *);
++	int (* const unfreeze_fs) (struct super_block *);
++	int (* const statfs) (struct dentry *, struct kstatfs *);
++	int (* const remount_fs) (struct super_block *, int *, char *);
++	void (* const clear_inode) (struct inode *);
++	void (* const umount_begin) (struct super_block *);
+ 
+-	int (*show_options)(struct seq_file *, struct vfsmount *);
+-	int (*show_stats)(struct seq_file *, struct vfsmount *);
++	int (* const show_options)(struct seq_file *, struct vfsmount *);
++	int (* const show_stats)(struct seq_file *, struct vfsmount *);
+ #ifdef CONFIG_QUOTA
+-	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
+-	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
++	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
++	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+ #endif
+-	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
++	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.13/include/linux/fs_struct.h linux-2.6.32.13/include/linux/fs_struct.h
+--- linux-2.6.32.13/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/fs_struct.h	2010-05-15 13:21:17.938584561 -0400
+@@ -4,7 +4,7 @@
+ #include <linux/path.h>
+ 
+ struct fs_struct {
+-	int users;
++	atomic_t users;
+ 	rwlock_t lock;
+ 	int umask;
+ 	int in_exec;
+diff -urNp linux-2.6.32.13/include/linux/genhd.h linux-2.6.32.13/include/linux/genhd.h
+--- linux-2.6.32.13/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/genhd.h	2010-05-15 13:21:17.938584561 -0400
+@@ -161,7 +161,7 @@ struct gendisk {
+ 
+ 	struct timer_rand_state *random;
+ 
+-	atomic_t sync_io;		/* RAID */
++	atomic_unchecked_t sync_io;	/* RAID */
+ 	struct work_struct async_notify;
+ #ifdef  CONFIG_BLK_DEV_INTEGRITY
+ 	struct blk_integrity *integrity;
+diff -urNp linux-2.6.32.13/include/linux/gracl.h linux-2.6.32.13/include/linux/gracl.h
+--- linux-2.6.32.13/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/gracl.h	2010-05-15 13:21:17.938584561 -0400
+@@ -0,0 +1,309 @@
++#ifndef GR_ACL_H
++#define GR_ACL_H
++
++#include <linux/grdefs.h>
++#include <linux/resource.h>
++#include <linux/capability.h>
++#include <linux/dcache.h>
++#include <asm/resource.h>
++
++/* Major status information */
++
++#define GR_VERSION  "grsecurity 2.1.14"
++#define GRSECURITY_VERSION 0x2114
++
++enum {
++	GR_SHUTDOWN = 0,
++	GR_ENABLE = 1,
++	GR_SPROLE = 2,
++	GR_RELOAD = 3,
++	GR_SEGVMOD = 4,
++	GR_STATUS = 5,
++	GR_UNSPROLE = 6,
++	GR_PASSSET = 7,
++	GR_SPROLEPAM = 8,
++};
++
++/* Password setup definitions
++ * kernel/grhash.c */
++enum {
++	GR_PW_LEN = 128,
++	GR_SALT_LEN = 16,
++	GR_SHA_LEN = 32,
++};
++
++enum {
++	GR_SPROLE_LEN = 64,
++};
++
++#define GR_NLIMITS 32
++
++/* Begin Data Structures */
++
++struct sprole_pw {
++	unsigned char *rolename;
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
++};
++
++struct name_entry {
++	__u32 key;
++	ino_t inode;
++	dev_t device;
++	char *name;
++	__u16 len;
++	__u8 deleted;
++	struct name_entry *prev;
++	struct name_entry *next;
++};
++
++struct inodev_entry {
++	struct name_entry *nentry;
++	struct inodev_entry *prev;
++	struct inodev_entry *next;
++};
++
++struct acl_role_db {
++	struct acl_role_label **r_hash;
++	__u32 r_size;
++};
++
++struct inodev_db {
++	struct inodev_entry **i_hash;
++	__u32 i_size;
++};
++
++struct name_db {
++	struct name_entry **n_hash;
++	__u32 n_size;
++};
++
++struct crash_uid {
++	uid_t uid;
++	unsigned long expires;
++};
++
++struct gr_hash_struct {
++	void **table;
++	void **nametable;
++	void *first;
++	__u32 table_size;
++	__u32 used_size;
++	int type;
++};
++
++/* Userspace Grsecurity ACL data structures */
++
++struct acl_subject_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++	kernel_cap_t cap_mask;
++	kernel_cap_t cap_lower;
++
++	struct rlimit res[GR_NLIMITS];
++	__u32 resmask;
++
++	__u8 user_trans_type;
++	__u8 group_trans_type;
++	uid_t *user_transitions;
++	gid_t *group_transitions;
++	__u16 user_trans_num;
++	__u16 group_trans_num;
++
++	__u32 ip_proto[8];
++	__u32 ip_type;
++	struct acl_ip_label **ips;
++	__u32 ip_num;
++	__u32 inaddr_any_override;
++
++	__u32 crashes;
++	unsigned long expires;
++
++	struct acl_subject_label *parent_subject;
++	struct gr_hash_struct *hash;
++	struct acl_subject_label *prev;
++	struct acl_subject_label *next;
++
++	struct acl_object_label **obj_hash;
++	__u32 obj_hash_size;
++	__u16 pax_flags;
++};
++
++struct role_allowed_ip {
++	__u32 addr;
++	__u32 netmask;
++
++	struct role_allowed_ip *prev;
++	struct role_allowed_ip *next;
++};
++
++struct role_transition {
++	char *rolename;
++
++	struct role_transition *prev;
++	struct role_transition *next;
++};
++
++struct acl_role_label {
++	char *rolename;
++	uid_t uidgid;
++	__u16 roletype;
++
++	__u16 auth_attempts;
++	unsigned long expires;
++
++	struct acl_subject_label *root_label;
++	struct gr_hash_struct *hash;
++
++	struct acl_role_label *prev;
++	struct acl_role_label *next;
++
++	struct role_transition *transitions;
++	struct role_allowed_ip *allowed_ips;
++	uid_t *domain_children;
++	__u16 domain_child_num;
++
++	struct acl_subject_label **subj_hash;
++	__u32 subj_hash_size;
++};
++
++struct user_acl_role_db {
++	struct acl_role_label **r_table;
++	__u32 num_pointers;		/* Number of allocations to track */
++	__u32 num_roles;		/* Number of roles */
++	__u32 num_domain_children;	/* Number of domain children */
++	__u32 num_subjects;		/* Number of subjects */
++	__u32 num_objects;		/* Number of objects */
++};
++
++struct acl_object_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++
++	struct acl_subject_label *nested;
++	struct acl_object_label *globbed;
++
++	/* next two structures not used */
++
++	struct acl_object_label *prev;
++	struct acl_object_label *next;
++};
++
++struct acl_ip_label {
++	char *iface;
++	__u32 addr;
++	__u32 netmask;
++	__u16 low, high;
++	__u8 mode;
++	__u32 type;
++	__u32 proto[8];
++
++	/* next two structures not used */
++
++	struct acl_ip_label *prev;
++	struct acl_ip_label *next;
++};
++
++struct gr_arg {
++	struct user_acl_role_db role_db;
++	unsigned char pw[GR_PW_LEN];
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];
++	unsigned char sp_role[GR_SPROLE_LEN];
++	struct sprole_pw *sprole_pws;
++	dev_t segv_device;
++	ino_t segv_inode;
++	uid_t segv_uid;
++	__u16 num_sprole_pws;
++	__u16 mode;
++};
++
++struct gr_arg_wrapper {
++	struct gr_arg *arg;
++	__u32 version;
++	__u32 size;
++};
++
++struct subject_map {
++	struct acl_subject_label *user;
++	struct acl_subject_label *kernel;
++	struct subject_map *prev;
++	struct subject_map *next;
++};
++
++struct acl_subj_map_db {
++	struct subject_map **s_hash;
++	__u32 s_size;
++};
++
++/* End Data Structures Section */
++
++/* Hash functions generated by empirical testing by Brad Spengler
++   Makes good use of the low bits of the inode.  Generally 0-1 times
++   in loop for successful match.  0-3 for unsuccessful match.
++   Shift/add algorithm with modulus of table size and an XOR*/
++
++static __inline__ unsigned int
++rhash(const uid_t uid, const __u16 type, const unsigned int sz)
++{
++	return ((((uid + type) << (16 + type)) ^ uid) % sz);
++}
++
++ static __inline__ unsigned int
++shash(const struct acl_subject_label *userp, const unsigned int sz)
++{
++	return ((const unsigned long)userp % sz);
++}
++
++static __inline__ unsigned int
++fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
++{
++	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
++}
++
++static __inline__ unsigned int
++nhash(const char *name, const __u16 len, const unsigned int sz)
++{
++	return full_name_hash((const unsigned char *)name, len) % sz;
++}
++
++#define FOR_EACH_ROLE_START(role) \
++	role = role_list; \
++	while (role) {
++
++#define FOR_EACH_ROLE_END(role) \
++		role = role->prev; \
++	}
++
++#define FOR_EACH_SUBJECT_START(role,subj,iter) \
++	subj = NULL; \
++	iter = 0; \
++	while (iter < role->subj_hash_size) { \
++		if (subj == NULL) \
++			subj = role->subj_hash[iter]; \
++		if (subj == NULL) { \
++			iter++; \
++			continue; \
++		}
++
++#define FOR_EACH_SUBJECT_END(subj,iter) \
++		subj = subj->next; \
++		if (subj == NULL) \
++			iter++; \
++	}
++
++
++#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
++	subj = role->hash->first; \
++	while (subj != NULL) {
++
++#define FOR_EACH_NESTED_SUBJECT_END(subj) \
++		subj = subj->next; \
++	}
++
++#endif
++
+diff -urNp linux-2.6.32.13/include/linux/gralloc.h linux-2.6.32.13/include/linux/gralloc.h
+--- linux-2.6.32.13/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/gralloc.h	2010-05-15 13:21:17.938584561 -0400
+@@ -0,0 +1,9 @@
++#ifndef __GRALLOC_H
++#define __GRALLOC_H
++
++void acl_free_all(void);
++int acl_alloc_stack_init(unsigned long size);
++void *acl_alloc(unsigned long len);
++void *acl_alloc_num(unsigned long num, unsigned long len);
++
++#endif
+diff -urNp linux-2.6.32.13/include/linux/grdefs.h linux-2.6.32.13/include/linux/grdefs.h
+--- linux-2.6.32.13/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/grdefs.h	2010-05-15 13:21:17.938584561 -0400
+@@ -0,0 +1,136 @@
++#ifndef GRDEFS_H
++#define GRDEFS_H
++
++/* Begin grsecurity status declarations */
++
++enum {
++	GR_READY = 0x01,
++	GR_STATUS_INIT = 0x00	// disabled state
++};
++
++/* Begin  ACL declarations */
++
++/* Role flags */
++
++enum {
++	GR_ROLE_USER = 0x0001,
++	GR_ROLE_GROUP = 0x0002,
++	GR_ROLE_DEFAULT = 0x0004,
++	GR_ROLE_SPECIAL = 0x0008,
++	GR_ROLE_AUTH = 0x0010,
++	GR_ROLE_NOPW = 0x0020,
++	GR_ROLE_GOD = 0x0040,
++	GR_ROLE_LEARN = 0x0080,
++	GR_ROLE_TPE = 0x0100,
++	GR_ROLE_DOMAIN = 0x0200,
++	GR_ROLE_PAM = 0x0400
++};
++
++/* ACL Subject and Object mode flags */
++enum {
++	GR_DELETED = 0x80000000
++};
++
++/* ACL Object-only mode flags */
++enum {
++	GR_READ 	= 0x00000001,
++	GR_APPEND 	= 0x00000002,
++	GR_WRITE 	= 0x00000004,
++	GR_EXEC 	= 0x00000008,
++	GR_FIND 	= 0x00000010,
++	GR_INHERIT 	= 0x00000020,
++	GR_SETID 	= 0x00000040,
++	GR_CREATE 	= 0x00000080,
++	GR_DELETE 	= 0x00000100,
++	GR_LINK		= 0x00000200,
++	GR_AUDIT_READ 	= 0x00000400,
++	GR_AUDIT_APPEND = 0x00000800,
++	GR_AUDIT_WRITE 	= 0x00001000,
++	GR_AUDIT_EXEC 	= 0x00002000,
++	GR_AUDIT_FIND 	= 0x00004000,
++	GR_AUDIT_INHERIT= 0x00008000,
++	GR_AUDIT_SETID 	= 0x00010000,
++	GR_AUDIT_CREATE = 0x00020000,
++	GR_AUDIT_DELETE = 0x00040000,
++	GR_AUDIT_LINK	= 0x00080000,
++	GR_PTRACERD 	= 0x00100000,
++	GR_NOPTRACE	= 0x00200000,
++	GR_SUPPRESS 	= 0x00400000,
++	GR_NOLEARN 	= 0x00800000
++};
++
++#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
++		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
++		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
++
++/* ACL subject-only mode flags */
++enum {
++	GR_KILL 	= 0x00000001,
++	GR_VIEW 	= 0x00000002,
++	GR_PROTECTED 	= 0x00000004,
++	GR_LEARN 	= 0x00000008,
++	GR_OVERRIDE 	= 0x00000010,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_DUMMY 	= 0x00000020,
++	GR_PROTSHM	= 0x00000040,
++	GR_KILLPROC	= 0x00000080,
++	GR_KILLIPPROC	= 0x00000100,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_NOTROJAN	= 0x00000200,
++	GR_PROTPROCFD	= 0x00000400,
++	GR_PROCACCT	= 0x00000800,
++	GR_RELAXPTRACE	= 0x00001000,
++	GR_NESTED	= 0x00002000,
++	GR_INHERITLEARN	= 0x00004000,
++	GR_PROCFIND	= 0x00008000,
++	GR_POVERRIDE	= 0x00010000,
++	GR_KERNELAUTH	= 0x00020000,
++};
++
++enum {
++	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
++	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
++	GR_PAX_ENABLE_MPROTECT	= 0x0004,
++	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
++	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
++	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
++	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
++	GR_PAX_DISABLE_MPROTECT	= 0x0400,
++	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
++	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
++};
++
++enum {
++	GR_ID_USER	= 0x01,
++	GR_ID_GROUP	= 0x02,
++};
++
++enum {
++	GR_ID_ALLOW	= 0x01,
++	GR_ID_DENY	= 0x02,
++};
++
++#define GR_CRASH_RES	31
++#define GR_UIDTABLE_MAX 500
++
++/* begin resource learning section */
++enum {
++	GR_RLIM_CPU_BUMP = 60,
++	GR_RLIM_FSIZE_BUMP = 50000,
++	GR_RLIM_DATA_BUMP = 10000,
++	GR_RLIM_STACK_BUMP = 1000,
++	GR_RLIM_CORE_BUMP = 10000,
++	GR_RLIM_RSS_BUMP = 500000,
++	GR_RLIM_NPROC_BUMP = 1,
++	GR_RLIM_NOFILE_BUMP = 5,
++	GR_RLIM_MEMLOCK_BUMP = 50000,
++	GR_RLIM_AS_BUMP = 500000,
++	GR_RLIM_LOCKS_BUMP = 2,
++	GR_RLIM_SIGPENDING_BUMP = 5,
++	GR_RLIM_MSGQUEUE_BUMP = 10000,
++	GR_RLIM_NICE_BUMP = 1,
++	GR_RLIM_RTPRIO_BUMP = 1,
++	GR_RLIM_RTTIME_BUMP = 1000000
++};
++
++#endif
+diff -urNp linux-2.6.32.13/include/linux/grinternal.h linux-2.6.32.13/include/linux/grinternal.h
+--- linux-2.6.32.13/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/grinternal.h	2010-05-15 13:21:17.938584561 -0400
+@@ -0,0 +1,215 @@
++#ifndef __GRINTERNAL_H
++#define __GRINTERNAL_H
++
++#ifdef CONFIG_GRKERNSEC
++
++#include <linux/fs.h>
++#include <linux/mnt_namespace.h>
++#include <linux/nsproxy.h>
++#include <linux/gracl.h>
++#include <linux/grdefs.h>
++#include <linux/grmsg.h>
++
++void gr_add_learn_entry(const char *fmt, ...)
++	__attribute__ ((format (printf, 1, 2)));
++__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
++			    const struct vfsmount *mnt);
++__u32 gr_check_create(const struct dentry *new_dentry,
++			     const struct dentry *parent,
++			     const struct vfsmount *mnt, const __u32 mode);
++int gr_check_protected_task(const struct task_struct *task);
++__u32 to_gr_audit(const __u32 reqmode);
++int gr_set_acls(const int type);
++
++int gr_acl_is_enabled(void);
++char gr_roletype_to_char(void);
++
++void gr_handle_alertkill(struct task_struct *task);
++char *gr_to_filename(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename1(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename2(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename3(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++
++extern int grsec_enable_harden_ptrace;
++extern int grsec_enable_link;
++extern int grsec_enable_fifo;
++extern int grsec_enable_execve;
++extern int grsec_enable_shm;
++extern int grsec_enable_execlog;
++extern int grsec_enable_signal;
++extern int grsec_enable_audit_ptrace;
++extern int grsec_enable_forkfail;
++extern int grsec_enable_time;
++extern int grsec_enable_rofs;
++extern int grsec_enable_chroot_shmat;
++extern int grsec_enable_chroot_findtask;
++extern int grsec_enable_chroot_mount;
++extern int grsec_enable_chroot_double;
++extern int grsec_enable_chroot_pivot;
++extern int grsec_enable_chroot_chdir;
++extern int grsec_enable_chroot_chmod;
++extern int grsec_enable_chroot_mknod;
++extern int grsec_enable_chroot_fchdir;
++extern int grsec_enable_chroot_nice;
++extern int grsec_enable_chroot_execlog;
++extern int grsec_enable_chroot_caps;
++extern int grsec_enable_chroot_sysctl;
++extern int grsec_enable_chroot_unix;
++extern int grsec_enable_tpe;
++extern int grsec_tpe_gid;
++extern int grsec_enable_tpe_all;
++extern int grsec_enable_sidcaps;
++extern int grsec_enable_socket_all;
++extern int grsec_socket_all_gid;
++extern int grsec_enable_socket_client;
++extern int grsec_socket_client_gid;
++extern int grsec_enable_socket_server;
++extern int grsec_socket_server_gid;
++extern int grsec_audit_gid;
++extern int grsec_enable_group;
++extern int grsec_enable_audit_textrel;
++extern int grsec_enable_mount;
++extern int grsec_enable_chdir;
++extern int grsec_resource_logging;
++extern int grsec_enable_blackhole;
++extern int grsec_lastack_retries;
++extern int grsec_lock;
++
++extern spinlock_t grsec_alert_lock;
++extern unsigned long grsec_alert_wtime;
++extern unsigned long grsec_alert_fyet;
++
++extern spinlock_t grsec_audit_lock;
++
++extern rwlock_t grsec_exec_file_lock;
++
++#define gr_task_fullpath(tsk) (tsk->exec_file ? \
++			gr_to_filename2(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
++			gr_to_filename(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
++			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
++			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
++			    tsk_a->fs->root.dentry)))
++
++#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
++			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
++
++#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
++		       task->pid, cred->uid, \
++		       cred->euid, cred->gid, cred->egid, \
++		       gr_parent_task_fullpath(task), \
++		       task->parent->comm, task->parent->pid, \
++		       pcred->uid, pcred->euid, \
++		       pcred->gid, pcred->egid
++
++#define GR_CHROOT_CAPS {{ \
++	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
++	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
++	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
++	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
++
++#define security_learn(normal_msg,args...) \
++({ \
++	read_lock(&grsec_exec_file_lock); \
++	gr_add_learn_entry(normal_msg "\n", ## args); \
++	read_unlock(&grsec_exec_file_lock); \
++})
++
++enum {
++	GR_DO_AUDIT,
++	GR_DONT_AUDIT,
++	GR_DONT_AUDIT_GOOD
++};
++
++enum {
++	GR_TTYSNIFF,
++	GR_RBAC,
++	GR_RBAC_STR,
++	GR_STR_RBAC,
++	GR_RBAC_MODE2,
++	GR_RBAC_MODE3,
++	GR_FILENAME,
++	GR_SYSCTL_HIDDEN,
++	GR_NOARGS,
++	GR_ONE_INT,
++	GR_ONE_INT_TWO_STR,
++	GR_ONE_STR,
++	GR_STR_INT,
++	GR_TWO_INT,
++	GR_THREE_INT,
++	GR_FIVE_INT_TWO_STR,
++	GR_TWO_STR,
++	GR_THREE_STR,
++	GR_FOUR_STR,
++	GR_STR_FILENAME,
++	GR_FILENAME_STR,
++	GR_FILENAME_TWO_INT,
++	GR_FILENAME_TWO_INT_STR,
++	GR_TEXTREL,
++	GR_PTRACE,
++	GR_RESOURCE,
++	GR_CAP,
++	GR_SIG,
++	GR_SIG2,
++	GR_CRASH1,
++	GR_CRASH2,
++	GR_PSACCT
++};
++
++#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
++#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
++#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
++#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
++#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
++#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
++#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
++#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
++#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
++#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
++#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
++#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
++#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
++#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
++#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
++#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
++#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
++#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
++#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
++#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
++#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
++#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
++#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
++#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
++#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
++#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
++#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
++#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
++#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
++#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
++#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
++#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
++
++#endif
++
++#endif
+diff -urNp linux-2.6.32.13/include/linux/grmsg.h linux-2.6.32.13/include/linux/grmsg.h
+--- linux-2.6.32.13/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/grmsg.h	2010-05-15 13:21:17.938584561 -0400
+@@ -0,0 +1,107 @@
++#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
++#define GR_STOPMOD_MSG "denied modification of module state by "
++#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
++#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
++#define GR_IOPERM_MSG "denied use of ioperm() by "
++#define GR_IOPL_MSG "denied use of iopl() by "
++#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
++#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
++#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
++#define GR_KMEM_MSG "denied write of /dev/kmem by "
++#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
++#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
++#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
++#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
++#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
++#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
++#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
++#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
++#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
++#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
++#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
++#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
++#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
++#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
++#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
++#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
++#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
++#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
++#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
++#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
++#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
++#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
++#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
++#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
++#define GR_NPROC_MSG "denied overstep of process limit by "
++#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
++#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
++#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
++#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
++#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
++#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
++#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
++#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
++#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
++#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
++#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
++#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
++#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
++#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
++#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
++#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
++#define GR_INITF_ACL_MSG "init_variables() failed %s by "
++#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
++#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
++#define GR_SHUTS_ACL_MSG "shutdown auth success for "
++#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
++#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
++#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
++#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
++#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
++#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
++#define GR_ENABLEF_ACL_MSG "unable to load %s for "
++#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
++#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
++#define GR_RELOADF_ACL_MSG "failed reload of %s for "
++#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
++#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
++#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
++#define GR_SPROLEF_ACL_MSG "special role %s failure for "
++#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
++#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
++#define GR_INVMODE_ACL_MSG "invalid mode %d by "
++#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
++#define GR_FAILFORK_MSG "failed fork with errno %d by "
++#define GR_NICE_CHROOT_MSG "denied priority change by "
++#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
++#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
++#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
++#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
++#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
++#define GR_TIME_MSG "time set by "
++#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
++#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
++#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
++#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
++#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
++#define GR_BIND_MSG "denied bind() by "
++#define GR_CONNECT_MSG "denied connect() by "
++#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
++#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
++#define GR_CAP_ACL_MSG "use of %s denied for "
++#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
++#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
++#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
++#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
++#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
++#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
++#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
++#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
++#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
++#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
++#define GR_VM86_MSG "denied use of vm86 by "
++#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
+diff -urNp linux-2.6.32.13/include/linux/grsecurity.h linux-2.6.32.13/include/linux/grsecurity.h
+--- linux-2.6.32.13/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/include/linux/grsecurity.h	2010-05-15 13:21:17.942979526 -0400
+@@ -0,0 +1,199 @@
++#ifndef GR_SECURITY_H
++#define GR_SECURITY_H
++#include <linux/fs.h>
++#include <linux/fs_struct.h>
++#include <linux/binfmts.h>
++#include <linux/gracl.h>
++
++/* notify of brain-dead configs */
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
++#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
++#endif
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
++#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
++#endif
++#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
++#error "CONFIG_PAX enabled, but no PaX options are enabled."
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p);
++void gr_handle_brute_check(void);
++
++char gr_roletype_to_char(void);
++
++int gr_check_user_change(int real, int effective, int fs);
++int gr_check_group_change(int real, int effective, int fs);
++
++void gr_del_task_from_ip_table(struct task_struct *p);
++
++int gr_pid_is_chrooted(struct task_struct *p);
++int gr_handle_chroot_nice(void);
++int gr_handle_chroot_sysctl(const int op);
++int gr_handle_chroot_setpriority(struct task_struct *p,
++					const int niceval);
++int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
++int gr_handle_chroot_chroot(const struct dentry *dentry,
++				   const struct vfsmount *mnt);
++int gr_handle_chroot_caps(struct path *path);
++void gr_handle_chroot_chdir(struct path *path);
++int gr_handle_chroot_chmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mknod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mount(const struct dentry *dentry,
++				  const struct vfsmount *mnt,
++				  const char *dev_name);
++int gr_handle_chroot_pivot(void);
++int gr_handle_chroot_unix(const pid_t pid);
++
++int gr_handle_rawio(const struct inode *inode);
++int gr_handle_nproc(void);
++
++void gr_handle_ioperm(void);
++void gr_handle_iopl(void);
++
++int gr_tpe_allow(const struct file *file);
++
++int gr_random_pid(void);
++
++void gr_log_forkfail(const int retval);
++void gr_log_timechange(void);
++void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
++void gr_log_chdir(const struct dentry *dentry,
++			 const struct vfsmount *mnt);
++void gr_log_chroot_exec(const struct dentry *dentry,
++			       const struct vfsmount *mnt);
++void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
++void gr_log_remount(const char *devname, const int retval);
++void gr_log_unmount(const char *devname, const int retval);
++void gr_log_mount(const char *from, const char *to, const int retval);
++void gr_log_textrel(struct vm_area_struct *vma);
++
++int gr_handle_follow_link(const struct inode *parent,
++				 const struct inode *inode,
++				 const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_fifo(const struct dentry *dentry,
++			  const struct vfsmount *mnt,
++			  const struct dentry *dir, const int flag,
++			  const int acc_mode);
++int gr_handle_hardlink(const struct dentry *dentry,
++			      const struct vfsmount *mnt,
++			      struct inode *inode,
++			      const int mode, const char *to);
++
++int gr_is_capable(const int cap);
++int gr_is_capable_nolog(const int cap);
++void gr_learn_resource(const struct task_struct *task, const int limit,
++			      const unsigned long wanted, const int gt);
++void gr_copy_label(struct task_struct *tsk);
++void gr_handle_crash(struct task_struct *task, const int sig);
++int gr_handle_signal(const struct task_struct *p, const int sig);
++int gr_check_crash_uid(const uid_t uid);
++int gr_check_protected_task(const struct task_struct *task);
++int gr_acl_handle_mmap(const struct file *file,
++			      const unsigned long prot);
++int gr_acl_handle_mprotect(const struct file *file,
++				  const unsigned long prot);
++int gr_check_hidden_task(const struct task_struct *tsk);
++__u32 gr_acl_handle_truncate(const struct dentry *dentry,
++				    const struct vfsmount *mnt);
++__u32 gr_acl_handle_utime(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++__u32 gr_acl_handle_access(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chmod(const struct dentry *dentry,
++				 const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chown(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_ptrace(struct task_struct *task, const long request);
++int gr_handle_proc_ptrace(struct task_struct *task);
++__u32 gr_acl_handle_execve(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++int gr_check_crash_exec(const struct file *filp);
++int gr_acl_is_enabled(void);
++void gr_set_kernel_label(struct task_struct *task);
++void gr_set_role_label(struct task_struct *task, const uid_t uid,
++			      const gid_t gid);
++int gr_set_proc_label(const struct dentry *dentry,
++			const struct vfsmount *mnt,
++			const int unsafe_share);
++__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++__u32 gr_acl_handle_open(const struct dentry *dentry,
++				const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_creat(const struct dentry *dentry,
++				 const struct dentry *p_dentry,
++				 const struct vfsmount *p_mnt, const int fmode,
++				 const int imode);
++void gr_handle_create(const struct dentry *dentry,
++			     const struct vfsmount *mnt);
++__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt,
++				 const int mode);
++__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt);
++__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++void gr_handle_delete(const ino_t ino, const dev_t dev);
++__u32 gr_acl_handle_unlink(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
++				   const struct dentry *parent_dentry,
++				   const struct vfsmount *parent_mnt,
++				   const char *from);
++__u32 gr_acl_handle_link(const struct dentry *new_dentry,
++				const struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				const struct dentry *old_dentry,
++				const struct vfsmount *old_mnt, const char *to);
++int gr_acl_handle_rename(struct dentry *new_dentry,
++				struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				struct dentry *old_dentry,
++				struct inode *old_parent_inode,
++				struct vfsmount *old_mnt, const char *newname);
++void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++				struct dentry *old_dentry,
++				struct dentry *new_dentry,
++				struct vfsmount *mnt, const __u8 replace);
++__u32 gr_check_link(const struct dentry *new_dentry,
++			   const struct dentry *parent_dentry,
++			   const struct vfsmount *parent_mnt,
++			   const struct dentry *old_dentry,
++			   const struct vfsmount *old_mnt);
++int gr_acl_handle_filldir(const struct file *file, const char *name,
++				 const unsigned int namelen, const ino_t ino);
++
++__u32 gr_acl_handle_unix(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++void gr_acl_handle_exit(void);
++void gr_acl_handle_psacct(struct task_struct *task, const long code);
++int gr_acl_handle_procpidmem(const struct task_struct *task);
++int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
++int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
++void gr_audit_ptrace(struct task_struct *task);
++
++#ifdef CONFIG_GRKERNSEC
++void gr_log_nonroot_mod_load(const char *modname);
++void gr_handle_vm86(void);
++void gr_handle_mem_write(void);
++void gr_handle_kmem_write(void);
++void gr_handle_open_port(void);
++int gr_handle_mem_mmap(const unsigned long offset,
++			      struct vm_area_struct *vma);
++
++extern int grsec_enable_dmesg;
++#endif
++
++#endif
+diff -urNp linux-2.6.32.13/include/linux/hdpu_features.h linux-2.6.32.13/include/linux/hdpu_features.h
+--- linux-2.6.32.13/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/hdpu_features.h	2010-05-15 13:21:17.942979526 -0400
+@@ -3,7 +3,7 @@
+ struct cpustate_t {
+ 	spinlock_t lock;
+ 	int excl;
+-        int open_count;
++	atomic_t open_count;
+ 	unsigned char cached_val;
+ 	int inited;
+ 	unsigned long *set_addr;
+diff -urNp linux-2.6.32.13/include/linux/highmem.h linux-2.6.32.13/include/linux/highmem.h
+--- linux-2.6.32.13/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/highmem.h	2010-05-15 13:21:17.942979526 -0400
+@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
+ 	kunmap_atomic(kaddr, KM_USER0);
+ }
+ 
++static inline void sanitize_highpage(struct page *page)
++{
++	void *kaddr;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	kaddr = kmap_atomic(page, KM_CLEARPAGE);
++	clear_page(kaddr);
++	kunmap_atomic(kaddr, KM_CLEARPAGE);
++	local_irq_restore(flags);
++}
++
+ static inline void zero_user_segments(struct page *page,
+ 	unsigned start1, unsigned end1,
+ 	unsigned start2, unsigned end2)
+diff -urNp linux-2.6.32.13/include/linux/init_task.h linux-2.6.32.13/include/linux/init_task.h
+--- linux-2.6.32.13/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/init_task.h	2010-05-15 13:21:17.942979526 -0400
+@@ -115,6 +115,13 @@ extern struct cred init_cred;
+ # define INIT_PERF_EVENTS(tsk)
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++# define INIT_GR_FS_LOCK					\
++	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
++#else
++# define INIT_GR_FS_LOCK
++#endif
++
+ /*
+  *  INIT_TASK is used to set up the first task table, touch at
+  * your own risk!. Base=0, limit=0x1fffff (=2MB)
+@@ -184,6 +191,7 @@ extern struct cred init_cred;
+ 	INIT_FTRACE_GRAPH						\
+ 	INIT_TRACE_RECURSION						\
+ 	INIT_TASK_RCU_PREEMPT(tsk)					\
++	INIT_GR_FS_LOCK							\
+ }
+ 
+ 
+diff -urNp linux-2.6.32.13/include/linux/interrupt.h linux-2.6.32.13/include/linux/interrupt.h
+--- linux-2.6.32.13/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/interrupt.h	2010-05-15 13:21:17.942979526 -0400
+@@ -357,7 +357,7 @@ enum
+ /* map softirq index to softirq name. update 'softirq_to_name' in
+  * kernel/softirq.c when adding a new softirq.
+  */
+-extern char *softirq_to_name[NR_SOFTIRQS];
++extern const char * const softirq_to_name[NR_SOFTIRQS];
+ 
+ /* softirq mask and active fields moved to irq_cpustat_t in
+  * asm/hardirq.h to get better cache usage.  KAO
+@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
+ 
+ struct softirq_action
+ {
+-	void	(*action)(struct softirq_action *);
++	void	(*action)(void);
+ };
+ 
+ asmlinkage void do_softirq(void);
+ asmlinkage void __do_softirq(void);
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
+ extern void raise_softirq_irqoff(unsigned int nr);
+diff -urNp linux-2.6.32.13/include/linux/jbd2.h linux-2.6.32.13/include/linux/jbd2.h
+--- linux-2.6.32.13/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/jbd2.h	2010-05-15 13:21:17.942979526 -0400
+@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd2_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.13/include/linux/jbd.h linux-2.6.32.13/include/linux/jbd.h
+--- linux-2.6.32.13/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/jbd.h	2010-05-15 13:21:17.942979526 -0400
+@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.13/include/linux/kallsyms.h linux-2.6.32.13/include/linux/kallsyms.h
+--- linux-2.6.32.13/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/kallsyms.h	2010-05-15 13:21:17.942979526 -0400
+@@ -15,7 +15,8 @@
+ 
+ struct module;
+ 
+-#ifdef CONFIG_KALLSYMS
++#ifndef __INCLUDED_BY_HIDESYM
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ /* Lookup the address for a symbol. Returns 0 if not found. */
+ unsigned long kallsyms_lookup_name(const char *name);
+ 
+@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
+ /* Stupid that this does nothing, but I didn't create this mess. */
+ #define __print_symbol(fmt, addr)
+ #endif /*CONFIG_KALLSYMS*/
++#else /* when included by kallsyms.c, with HIDESYM enabled */
++extern void __print_symbol(const char *fmt, unsigned long address);
++#endif
+ 
+ /* This macro allows us to keep printk typechecking */
+ static void __check_printsym_format(const char *fmt, ...)
+diff -urNp linux-2.6.32.13/include/linux/kgdb.h linux-2.6.32.13/include/linux/kgdb.h
+--- linux-2.6.32.13/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/kgdb.h	2010-05-15 13:21:17.942979526 -0400
+@@ -251,20 +251,20 @@ struct kgdb_arch {
+  */
+ struct kgdb_io {
+ 	const char		*name;
+-	int			(*read_char) (void);
+-	void			(*write_char) (u8);
+-	void			(*flush) (void);
+-	int			(*init) (void);
+-	void			(*pre_exception) (void);
+-	void			(*post_exception) (void);
++	int			(* const read_char) (void);
++	void			(* const write_char) (u8);
++	void			(* const flush) (void);
++	int			(* const init) (void);
++	void			(* const pre_exception) (void);
++	void			(* const post_exception) (void);
+ };
+ 
+-extern struct kgdb_arch		arch_kgdb_ops;
++extern const struct kgdb_arch arch_kgdb_ops;
+ 
+ extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
+ 
+-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
+-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
++extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
++extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
+ 
+ extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
+ extern int kgdb_mem2hex(char *mem, char *buf, int count);
+diff -urNp linux-2.6.32.13/include/linux/kobject.h linux-2.6.32.13/include/linux/kobject.h
+--- linux-2.6.32.13/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/kobject.h	2010-05-15 13:21:17.942979526 -0400
+@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
+ 
+ struct kobj_type {
+ 	void (*release)(struct kobject *kobj);
+-	struct sysfs_ops *sysfs_ops;
++	const struct sysfs_ops *sysfs_ops;
+ 	struct attribute **default_attrs;
+ };
+ 
+@@ -118,9 +118,9 @@ struct kobj_uevent_env {
+ };
+ 
+ struct kset_uevent_ops {
+-	int (*filter)(struct kset *kset, struct kobject *kobj);
+-	const char *(*name)(struct kset *kset, struct kobject *kobj);
+-	int (*uevent)(struct kset *kset, struct kobject *kobj,
++	int (* const filter)(struct kset *kset, struct kobject *kobj);
++	const char *(* const name)(struct kset *kset, struct kobject *kobj);
++	int (* const uevent)(struct kset *kset, struct kobject *kobj,
+ 		      struct kobj_uevent_env *env);
+ };
+ 
+@@ -132,7 +132,7 @@ struct kobj_attribute {
+ 			 const char *buf, size_t count);
+ };
+ 
+-extern struct sysfs_ops kobj_sysfs_ops;
++extern const struct sysfs_ops kobj_sysfs_ops;
+ 
+ /**
+  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
+@@ -155,14 +155,14 @@ struct kset {
+ 	struct list_head list;
+ 	spinlock_t list_lock;
+ 	struct kobject kobj;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ };
+ 
+ extern void kset_init(struct kset *kset);
+ extern int __must_check kset_register(struct kset *kset);
+ extern void kset_unregister(struct kset *kset);
+ extern struct kset * __must_check kset_create_and_add(const char *name,
+-						struct kset_uevent_ops *u,
++						const struct kset_uevent_ops *u,
+ 						struct kobject *parent_kobj);
+ 
+ static inline struct kset *to_kset(struct kobject *kobj)
+diff -urNp linux-2.6.32.13/include/linux/kvm_host.h linux-2.6.32.13/include/linux/kvm_host.h
+--- linux-2.6.32.13/include/linux/kvm_host.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.13/include/linux/kvm_host.h	2010-05-15 13:21:17.942979526 -0400
+@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
+ void vcpu_load(struct kvm_vcpu *vcpu);
+ void vcpu_put(struct kvm_vcpu *vcpu);
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module);
+ void kvm_exit(void);
+ 
+@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
+ 					struct kvm_guest_debug *dbg);
+ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
+ 
+-int kvm_arch_init(void *opaque);
++int kvm_arch_init(const void *opaque);
+ void kvm_arch_exit(void);
+ 
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
+diff -urNp linux-2.6.32.13/include/linux/libata.h linux-2.6.32.13/include/linux/libata.h
+--- linux-2.6.32.13/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/libata.h	2010-05-15 13:21:17.942979526 -0400
+@@ -64,11 +64,11 @@
+ #ifdef ATA_VERBOSE_DEBUG
+ #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+ #else
+-#define VPRINTK(fmt, args...)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_VERBOSE_DEBUG */
+ #else
+-#define DPRINTK(fmt, args...)
+-#define VPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_DEBUG */
+ 
+ #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+@@ -524,11 +524,11 @@ struct ata_ioports {
+ 
+ struct ata_host {
+ 	spinlock_t		lock;
+-	struct device 		*dev;
++	struct device		*dev;
+ 	void __iomem * const	*iomap;
+ 	unsigned int		n_ports;
+ 	void			*private_data;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned long		flags;
+ #ifdef CONFIG_ATA_ACPI
+ 	acpi_handle		acpi_handle;
+@@ -709,7 +709,7 @@ struct ata_link {
+ 
+ struct ata_port {
+ 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	spinlock_t		*lock;
+ 	/* Flags owned by the EH context. Only EH should touch these once the
+ 	   port is active */
+@@ -891,7 +891,7 @@ struct ata_port_info {
+ 	unsigned long		pio_mask;
+ 	unsigned long		mwdma_mask;
+ 	unsigned long		udma_mask;
+-	struct ata_port_operations *port_ops;
++	const struct ata_port_operations *port_ops;
+ 	void 			*private_data;
+ };
+ 
+@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
+ extern const unsigned long sata_deb_timing_hotplug[];
+ extern const unsigned long sata_deb_timing_long[];
+ 
+-extern struct ata_port_operations ata_dummy_port_ops;
++extern const struct ata_port_operations ata_dummy_port_ops;
+ extern const struct ata_port_info ata_dummy_port_info;
+ 
+ static inline const unsigned long *
+@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
+ 			     struct scsi_host_template *sht);
+ extern void ata_host_detach(struct ata_host *host);
+ extern void ata_host_init(struct ata_host *, struct device *,
+-			  unsigned long, struct ata_port_operations *);
++			  unsigned long, const struct ata_port_operations *);
+ extern int ata_scsi_detect(struct scsi_host_template *sht);
+ extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
+ extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
+diff -urNp linux-2.6.32.13/include/linux/lockd/bind.h linux-2.6.32.13/include/linux/lockd/bind.h
+--- linux-2.6.32.13/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/lockd/bind.h	2010-05-15 13:21:17.942979526 -0400
+@@ -23,13 +23,13 @@ struct svc_rqst;
+  * This is the set of functions for lockd->nfsd communication
+  */
+ struct nlmsvc_binding {
+-	__be32			(*fopen)(struct svc_rqst *,
++	__be32			(* const fopen)(struct svc_rqst *,
+ 						struct nfs_fh *,
+ 						struct file **);
+-	void			(*fclose)(struct file *);
++	void			(* const fclose)(struct file *);
+ };
+ 
+-extern struct nlmsvc_binding *	nlmsvc_ops;
++extern const struct nlmsvc_binding *	nlmsvc_ops;
+ 
+ /*
+  * Similar to nfs_client_initdata, but without the NFS-specific
+diff -urNp linux-2.6.32.13/include/linux/mm.h linux-2.6.32.13/include/linux/mm.h
+--- linux-2.6.32.13/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/mm.h	2010-05-15 13:21:17.946623351 -0400
+@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
+ #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
+ #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
++#endif
++
+ #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
+ #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
+ #endif
+@@ -880,6 +884,8 @@ struct shrinker {
+ extern void register_shrinker(struct shrinker *);
+ extern void unregister_shrinker(struct shrinker *);
+ 
++pgprot_t vm_get_page_prot(unsigned long vm_flags);
++
+ int vma_wants_writenotify(struct vm_area_struct *vma);
+ 
+ extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
+@@ -1152,6 +1158,7 @@ out:
+ }
+ 
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
++extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
+ 
+@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
+ extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
+ 					     struct vm_area_struct **pprev);
+ 
++extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
++extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
++extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
++
+ /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
+    NULL if none.  Assume start_addr < end_addr. */
+ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
+@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
+ 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ }
+ 
+-pgprot_t vm_get_page_prot(unsigned long vm_flags);
+ struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
+ int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
+ 			unsigned long pfn, unsigned long size, pgprot_t);
+@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
+ extern int __memory_failure(unsigned long pfn, int trapno, int ref);
+ extern int sysctl_memory_failure_early_kill;
+ extern int sysctl_memory_failure_recovery;
+-extern atomic_long_t mce_bad_pages;
++extern atomic_long_unchecked_t mce_bad_pages;
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
++#else
++static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
++#endif
+ 
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_MM_H */
+diff -urNp linux-2.6.32.13/include/linux/mm_types.h linux-2.6.32.13/include/linux/mm_types.h
+--- linux-2.6.32.13/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/mm_types.h	2010-05-15 13:21:17.946623351 -0400
+@@ -186,6 +186,8 @@ struct vm_area_struct {
+ #ifdef CONFIG_NUMA
+ 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
+ #endif
++
++	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
+ };
+ 
+ struct core_thread {
+@@ -287,6 +289,24 @@ struct mm_struct {
+ #ifdef CONFIG_MMU_NOTIFIER
+ 	struct mmu_notifier_mm *mmu_notifier_mm;
+ #endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	unsigned long pax_flags;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	unsigned long call_dl_resolve;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	unsigned long call_syscall;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	unsigned long delta_mmap;		/* randomized offset */
++	unsigned long delta_stack;		/* randomized offset */
++#endif
++
+ };
+ 
+ /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
+diff -urNp linux-2.6.32.13/include/linux/mmu_notifier.h linux-2.6.32.13/include/linux/mmu_notifier.h
+--- linux-2.6.32.13/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/mmu_notifier.h	2010-05-15 13:21:17.946623351 -0400
+@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
+  */
+ #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
+ ({									\
+-	pte_t __pte;							\
++	pte_t ___pte;							\
+ 	struct vm_area_struct *___vma = __vma;				\
+ 	unsigned long ___address = __address;				\
+-	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
++	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
+ 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
+-	__pte;								\
++	___pte;								\
+ })
+ 
+ #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
+diff -urNp linux-2.6.32.13/include/linux/mod_devicetable.h linux-2.6.32.13/include/linux/mod_devicetable.h
+--- linux-2.6.32.13/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/mod_devicetable.h	2010-05-15 13:21:17.946623351 -0400
+@@ -12,7 +12,7 @@
+ typedef unsigned long kernel_ulong_t;
+ #endif
+ 
+-#define PCI_ANY_ID (~0)
++#define PCI_ANY_ID ((__u16)~0)
+ 
+ struct pci_device_id {
+ 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
+@@ -131,7 +131,7 @@ struct usb_device_id {
+ #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
+ #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
+ 
+-#define HID_ANY_ID				(~0)
++#define HID_ANY_ID				(~0U)
+ 
+ struct hid_device_id {
+ 	__u16 bus;
+diff -urNp linux-2.6.32.13/include/linux/module.h linux-2.6.32.13/include/linux/module.h
+--- linux-2.6.32.13/include/linux/module.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.13/include/linux/module.h	2010-05-15 13:21:17.946623351 -0400
+@@ -287,16 +287,16 @@ struct module
+ 	int (*init)(void);
+ 
+ 	/* If this is non-NULL, vfree after init() returns */
+-	void *module_init;
++	void *module_init_rx, *module_init_rw;
+ 
+ 	/* Here is the actual code + data, vfree'd on unload. */
+-	void *module_core;
++	void *module_core_rx, *module_core_rw;
+ 
+ 	/* Here are the sizes of the init and core sections */
+-	unsigned int init_size, core_size;
++	unsigned int init_size_rw, core_size_rw;
+ 
+ 	/* The size of the executable code in each section.  */
+-	unsigned int init_text_size, core_text_size;
++	unsigned int init_size_rx, core_size_rx;
+ 
+ 	/* Arch-specific module values */
+ 	struct mod_arch_specific arch;
+@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
+ bool is_module_address(unsigned long addr);
+ bool is_module_text_address(unsigned long addr);
+ 
++static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	if (ktla_ktva(addr) >= (unsigned long)start &&
++	    ktla_ktva(addr) < (unsigned long)start + size)
++		return 1;
++#endif
++
++	return ((void *)addr >= start && (void *)addr < start + size);
++}
++
++static inline int within_module_core_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
++}
++
++static inline int within_module_core_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
++}
++
++static inline int within_module_init_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
++}
++
++static inline int within_module_init_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
++}
++
+ static inline int within_module_core(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_core <= addr &&
+-	       addr < (unsigned long)mod->module_core + mod->core_size;
++	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
+ }
+ 
+ static inline int within_module_init(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_init <= addr &&
+-	       addr < (unsigned long)mod->module_init + mod->init_size;
++	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
+ }
+ 
+ /* Search for module by name: must hold module_mutex. */
+diff -urNp linux-2.6.32.13/include/linux/moduleloader.h linux-2.6.32.13/include/linux/moduleloader.h
+--- linux-2.6.32.13/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/moduleloader.h	2010-05-15 13:21:17.946623351 -0400
+@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
+    sections.  Returns NULL on failure. */
+ void *module_alloc(unsigned long size);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void *module_alloc_exec(unsigned long size);
++#else
++#define module_alloc_exec(x) module_alloc(x)
++#endif
++
+ /* Free memory returned from module_alloc. */
+ void module_free(struct module *mod, void *module_region);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region);
++#else
++#define module_free_exec(x, y) module_free((x), (y))
++#endif
++
+ /* Apply the given relocation to the (simplified) ELF.  Return -error
+    or 0. */
+ int apply_relocate(Elf_Shdr *sechdrs,
+diff -urNp linux-2.6.32.13/include/linux/namei.h linux-2.6.32.13/include/linux/namei.h
+--- linux-2.6.32.13/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/namei.h	2010-05-15 13:21:17.946623351 -0400
+@@ -22,7 +22,7 @@ struct nameidata {
+ 	unsigned int	flags;
+ 	int		last_type;
+ 	unsigned	depth;
+-	char *saved_names[MAX_NESTED_LINKS + 1];
++	const char *saved_names[MAX_NESTED_LINKS + 1];
+ 
+ 	/* Intent data */
+ 	union {
+@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
+ extern struct dentry *lock_rename(struct dentry *, struct dentry *);
+ extern void unlock_rename(struct dentry *, struct dentry *);
+ 
+-static inline void nd_set_link(struct nameidata *nd, char *path)
++static inline void nd_set_link(struct nameidata *nd, const char *path)
+ {
+ 	nd->saved_names[nd->depth] = path;
+ }
+ 
+-static inline char *nd_get_link(struct nameidata *nd)
++static inline const char *nd_get_link(const struct nameidata *nd)
+ {
+ 	return nd->saved_names[nd->depth];
+ }
+diff -urNp linux-2.6.32.13/include/linux/nodemask.h linux-2.6.32.13/include/linux/nodemask.h
+--- linux-2.6.32.13/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/nodemask.h	2010-05-15 13:21:17.946623351 -0400
+@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
+ 
+ #define any_online_node(mask)			\
+ ({						\
+-	int node;				\
+-	for_each_node_mask(node, (mask))	\
+-		if (node_online(node))		\
++	int __node;				\
++	for_each_node_mask(__node, (mask))	\
++		if (node_online(__node))	\
+ 			break;			\
+-	node;					\
++	__node;					\
+ })
+ 
+ #define num_online_nodes()	num_node_state(N_ONLINE)
+diff -urNp linux-2.6.32.13/include/linux/oprofile.h linux-2.6.32.13/include/linux/oprofile.h
+--- linux-2.6.32.13/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/oprofile.h	2010-05-15 13:21:17.946623351 -0400
+@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
+ int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
+ 	char const * name, ulong * val);
+  
+-/** Create a file for read-only access to an atomic_t. */
++/** Create a file for read-only access to an atomic_unchecked_t. */
+ int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
+-	char const * name, atomic_t * val);
++	char const * name, atomic_unchecked_t * val);
+  
+ /** create a directory */
+ struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
+diff -urNp linux-2.6.32.13/include/linux/pipe_fs_i.h linux-2.6.32.13/include/linux/pipe_fs_i.h
+--- linux-2.6.32.13/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/pipe_fs_i.h	2010-05-15 13:21:17.946623351 -0400
+@@ -46,9 +46,9 @@ struct pipe_inode_info {
+ 	wait_queue_head_t wait;
+ 	unsigned int nrbufs, curbuf;
+ 	struct page *tmp_page;
+-	unsigned int readers;
+-	unsigned int writers;
+-	unsigned int waiting_writers;
++	atomic_t readers;
++	atomic_t writers;
++	atomic_t waiting_writers;
+ 	unsigned int r_counter;
+ 	unsigned int w_counter;
+ 	struct fasync_struct *fasync_readers;
+diff -urNp linux-2.6.32.13/include/linux/poison.h linux-2.6.32.13/include/linux/poison.h
+--- linux-2.6.32.13/include/linux/poison.h	2010-05-15 13:20:19.331913169 -0400
++++ linux-2.6.32.13/include/linux/poison.h	2010-05-15 13:23:00.179313143 -0400
+@@ -19,8 +19,8 @@
+  * under normal circumstances, used to verify that nobody uses
+  * non-initialized list entries.
+  */
+-#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
+-#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
++#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
++#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
+ 
+ /********** include/linux/timer.h **********/
+ /*
+diff -urNp linux-2.6.32.13/include/linux/proc_fs.h linux-2.6.32.13/include/linux/proc_fs.h
+--- linux-2.6.32.13/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/proc_fs.h	2010-05-15 13:21:17.946623351 -0400
+@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
+ 	return proc_create_data(name, mode, parent, proc_fops, NULL);
+ }
+ 
++static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
++	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
++{
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
++#else
++	return proc_create_data(name, mode, parent, proc_fops, NULL);
++#endif
++}
++	
++
+ static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
+ 	mode_t mode, struct proc_dir_entry *base, 
+ 	read_proc_t *read_proc, void * data)
+diff -urNp linux-2.6.32.13/include/linux/random.h linux-2.6.32.13/include/linux/random.h
+--- linux-2.6.32.13/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/random.h	2010-05-15 13:21:17.950606770 -0400
+@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
+ u32 random32(void);
+ void srandom32(u32 seed);
+ 
++static inline unsigned long pax_get_random_long(void)
++{
++	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
++}
++
+ #endif /* __KERNEL___ */
+ 
+ #endif /* _LINUX_RANDOM_H */
+diff -urNp linux-2.6.32.13/include/linux/reiserfs_fs.h linux-2.6.32.13/include/linux/reiserfs_fs.h
+--- linux-2.6.32.13/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/reiserfs_fs.h	2010-05-15 13:21:17.950606770 -0400
+@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
+ #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
+ 
+ #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
+-#define get_generation(s) atomic_read (&fs_generation(s))
++#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
+ #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
+ #define __fs_changed(gen,s) (gen != get_generation (s))
+ #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
+@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
+ */
+ 
+ struct item_operations {
+-	int (*bytes_number) (struct item_head * ih, int block_size);
+-	void (*decrement_key) (struct cpu_key *);
+-	int (*is_left_mergeable) (struct reiserfs_key * ih,
++	int (* const bytes_number) (struct item_head * ih, int block_size);
++	void (* const decrement_key) (struct cpu_key *);
++	int (* const is_left_mergeable) (struct reiserfs_key * ih,
+ 				  unsigned long bsize);
+-	void (*print_item) (struct item_head *, char *item);
+-	void (*check_item) (struct item_head *, char *item);
++	void (* const print_item) (struct item_head *, char *item);
++	void (* const check_item) (struct item_head *, char *item);
+ 
+-	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
++	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
+ 			  int is_affected, int insert_size);
+-	int (*check_left) (struct virtual_item * vi, int free,
++	int (* const check_left) (struct virtual_item * vi, int free,
+ 			   int start_skip, int end_skip);
+-	int (*check_right) (struct virtual_item * vi, int free);
+-	int (*part_size) (struct virtual_item * vi, int from, int to);
+-	int (*unit_num) (struct virtual_item * vi);
+-	void (*print_vi) (struct virtual_item * vi);
++	int (* const check_right) (struct virtual_item * vi, int free);
++	int (* const part_size) (struct virtual_item * vi, int from, int to);
++	int (* const unit_num) (struct virtual_item * vi);
++	void (* const print_vi) (struct virtual_item * vi);
+ };
+ 
+-extern struct item_operations *item_ops[TYPE_ANY + 1];
++extern const struct item_operations * const item_ops[TYPE_ANY + 1];
+ 
+ #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
+ #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
+diff -urNp linux-2.6.32.13/include/linux/reiserfs_fs_sb.h linux-2.6.32.13/include/linux/reiserfs_fs_sb.h
+--- linux-2.6.32.13/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/reiserfs_fs_sb.h	2010-05-15 13:21:17.950606770 -0400
+@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
+ 	/* Comment? -Hans */
+ 	wait_queue_head_t s_wait;
+ 	/* To be obsoleted soon by per buffer seals.. -Hans */
+-	atomic_t s_generation_counter;	// increased by one every time the
++	atomic_unchecked_t s_generation_counter;	// increased by one every time the
+ 	// tree gets re-balanced
+ 	unsigned long s_properties;	/* File system properties. Currently holds
+ 					   on-disk FS format */
+diff -urNp linux-2.6.32.13/include/linux/sched.h linux-2.6.32.13/include/linux/sched.h
+--- linux-2.6.32.13/include/linux/sched.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/sched.h	2010-05-15 13:21:17.950606770 -0400
+@@ -101,6 +101,7 @@ struct bio;
+ struct fs_struct;
+ struct bts_context;
+ struct perf_event_context;
++struct linux_binprm;
+ 
+ /*
+  * List of flags we want to share for kernel threads,
+@@ -664,6 +665,15 @@ struct signal_struct {
+ 	struct tty_audit_buf *tty_audit_buf;
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++	u32 curr_ip;
++	u32 gr_saddr;
++	u32 gr_daddr;
++	u16 gr_sport;
++	u16 gr_dport;
++	u8 used_accept:1;
++#endif
++
+ 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
+ };
+ 
+@@ -1217,7 +1227,7 @@ struct rcu_node;
+ 
+ struct task_struct {
+ 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
+-	void *stack;
++	struct thread_info *stack;
+ 	atomic_t usage;
+ 	unsigned int flags;	/* per process flags, defined below */
+ 	unsigned int ptrace;
+@@ -1329,8 +1339,8 @@ struct task_struct {
+ 	struct list_head thread_group;
+ 
+ 	struct completion *vfork_done;		/* for vfork() */
+-	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
+-	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
++	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
++	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
+ 
+ 	cputime_t utime, stime, utimescaled, stimescaled;
+ 	cputime_t gtime;
+@@ -1344,16 +1354,6 @@ struct task_struct {
+ 	struct task_cputime cputime_expires;
+ 	struct list_head cpu_timers[3];
+ 
+-/* process credentials */
+-	const struct cred *real_cred;	/* objective and real subjective task
+-					 * credentials (COW) */
+-	const struct cred *cred;	/* effective (overridable) subjective task
+-					 * credentials (COW) */
+-	struct mutex cred_guard_mutex;	/* guard against foreign influences on
+-					 * credential calculations
+-					 * (notably. ptrace) */
+-	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
+-
+ 	char comm[TASK_COMM_LEN]; /* executable name excluding path
+ 				     - access with [gs]et_task_comm (which lock
+ 				       it with task_lock())
+@@ -1437,6 +1437,15 @@ struct task_struct {
+ 	int hardirq_context;
+ 	int softirq_context;
+ #endif
++
++/* process credentials */
++	const struct cred *real_cred;	/* objective and real subjective task
++					 * credentials (COW) */
++	struct mutex cred_guard_mutex;	/* guard against foreign influences on
++					 * credential calculations
++					 * (notably. ptrace) */
++	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
++
+ #ifdef CONFIG_LOCKDEP
+ # define MAX_LOCK_DEPTH 48UL
+ 	u64 curr_chain_key;
+@@ -1457,6 +1466,9 @@ struct task_struct {
+ 
+ 	struct backing_dev_info *backing_dev_info;
+ 
++	const struct cred *cred;	/* effective (overridable) subjective task
++					 * credentials (COW) */
++
+ 	struct io_context *io_context;
+ 
+ 	unsigned long ptrace_message;
+@@ -1520,6 +1532,19 @@ struct task_struct {
+ 	unsigned long default_timer_slack_ns;
+ 
+ 	struct list_head	*scm_work_list;
++
++#ifdef CONFIG_GRKERNSEC
++	/* grsecurity */
++	rwlock_t gr_fs_lock;
++	struct acl_subject_label *acl;
++	struct acl_role_label *role;
++	struct file *exec_file;
++	u16 acl_role_id;
++	u8 acl_sp_role;
++	u8 is_writable;
++	u8 brute;
++#endif
++
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ 	/* Index of current stored adress in ret_stack */
+ 	int curr_ret_stack;
+@@ -1544,6 +1569,52 @@ struct task_struct {
+ 	unsigned long stack_start;
+ };
+ 
++#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
++#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
++#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
++#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
++/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
++#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
++
++#ifdef CONFIG_PAX_SOFTMODE
++extern unsigned int pax_softmode;
++#endif
++
++extern int pax_check_flags(unsigned long *);
++
++/* if tsk != current then task_lock must be held on it */
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline unsigned long pax_get_flags(struct task_struct *tsk)
++{
++	if (likely(tsk->mm))
++		return tsk->mm->pax_flags;
++	else
++		return 0UL;
++}
++
++/* if tsk != current then task_lock must be held on it */
++static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
++{
++	if (likely(tsk->mm)) {
++		tsk->mm->pax_flags = flags;
++		return 0;
++	}
++	return -EINVAL;
++}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++extern void pax_set_initial_flags(struct linux_binprm *bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++#endif
++
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
++void pax_report_insns(void *pc, void *sp);
++void pax_report_refcount_overflow(struct pt_regs *regs);
++void pax_report_leak_to_user(const void *ptr, unsigned long len);
++void pax_report_overflow_from_user(const void *ptr, unsigned long len);
++
+ /* Future-safe accessor for struct task_struct's cpus_allowed. */
+ #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+ 
+@@ -2143,7 +2214,7 @@ extern void __cleanup_sighand(struct sig
+ extern void exit_itimers(struct signal_struct *);
+ extern void flush_itimer_signals(void);
+ 
+-extern NORET_TYPE void do_group_exit(int);
++extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
+ 
+ extern void daemonize(const char *, ...);
+ extern int allow_signal(int);
+@@ -2245,6 +2316,33 @@ static inline void task_unlock(struct ta
+ 	spin_unlock(&p->alloc_lock);
+ }
+ 
++/* grsec: protects only ->fs as task_lock is overkill and we can't
++   be using a spin_lock in interrupt context
++*/
++#ifdef CONFIG_GRKERNSEC
++#define gr_fs_write_lock_irqsave(x, y)				\
++	write_lock_irqsave(&x->gr_fs_lock, y)
++#define gr_fs_write_unlock_irqrestore(x, y) 			\
++	write_unlock_irqrestore(&x->gr_fs_lock, y)
++#else
++#define gr_fs_write_lock_irqsave(x, y)
++#define gr_fs_write_unlock_irqrestore(x, y)
++#endif
++
++static inline void gr_fs_read_lock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_lock(&p->gr_fs_lock);
++#endif
++}
++
++static inline void gr_fs_read_unlock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_unlock(&p->gr_fs_lock);
++#endif
++}
++
+ extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
+ 							unsigned long *flags);
+ 
+@@ -2256,8 +2354,8 @@ static inline void unlock_task_sighand(s
+ 
+ #ifndef __HAVE_THREAD_FUNCTIONS
+ 
+-#define task_thread_info(task)	((struct thread_info *)(task)->stack)
+-#define task_stack_page(task)	((task)->stack)
++#define task_thread_info(task)	((task)->stack)
++#define task_stack_page(task)	((void *)(task)->stack)
+ 
+ static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
+ {
+@@ -2272,13 +2370,31 @@ static inline unsigned long *end_of_stac
+ 
+ #endif
+ 
+-static inline int object_is_on_stack(void *obj)
++static inline int object_starts_on_stack(void *obj)
+ {
+-	void *stack = task_stack_page(current);
++	const void *stack = task_stack_page(current);
+ 
+ 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
+ }
+ 
++/* 0: not at all, 1: fully, -1: partially (implies an error) */
++static inline int object_is_on_stack(const void *obj, unsigned long len)
++{
++	const void *stack = task_stack_page(current);
++	const void *stackend = stack + THREAD_SIZE;
++
++	if (obj + len < obj)
++		return -1;
++
++	if (stack <= obj && obj + len <= stackend)
++		return 1;
++
++	if (obj + len <= stack || stackend <=  obj)
++		return 0;
++
++	return -1;
++}
++
+ extern void thread_info_cache_init(void);
+ 
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+diff -urNp linux-2.6.32.13/include/linux/screen_info.h linux-2.6.32.13/include/linux/screen_info.h
+--- linux-2.6.32.13/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/screen_info.h	2010-05-15 13:21:17.950606770 -0400
+@@ -42,7 +42,8 @@ struct screen_info {
+ 	__u16 pages;		/* 0x32 */
+ 	__u16 vesa_attributes;	/* 0x34 */
+ 	__u32 capabilities;     /* 0x36 */
+-	__u8  _reserved[6];	/* 0x3a */
++	__u16 vesapm_size;	/* 0x3a */
++	__u8  _reserved[4];	/* 0x3c */
+ } __attribute__((packed));
+ 
+ #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
+diff -urNp linux-2.6.32.13/include/linux/security.h linux-2.6.32.13/include/linux/security.h
+--- linux-2.6.32.13/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/security.h	2010-05-15 13:21:17.950606770 -0400
+@@ -34,6 +34,7 @@
+ #include <linux/key.h>
+ #include <linux/xfrm.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ #include <net/flow.h>
+ 
+ /* Maximum number of letters for an LSM name string */
+diff -urNp linux-2.6.32.13/include/linux/shm.h linux-2.6.32.13/include/linux/shm.h
+--- linux-2.6.32.13/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/shm.h	2010-05-15 13:21:17.950606770 -0400
+@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
+ 	pid_t			shm_cprid;
+ 	pid_t			shm_lprid;
+ 	struct user_struct	*mlock_user;
++#ifdef CONFIG_GRKERNSEC
++	time_t			shm_createtime;
++	pid_t			shm_lapid;
++#endif
+ };
+ 
+ /* shm_mode upper byte flags */
+diff -urNp linux-2.6.32.13/include/linux/slab.h linux-2.6.32.13/include/linux/slab.h
+--- linux-2.6.32.13/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/slab.h	2010-05-15 13:21:17.950606770 -0400
+@@ -11,6 +11,7 @@
+ 
+ #include <linux/gfp.h>
+ #include <linux/types.h>
++#include <linux/err.h>
+ 
+ /*
+  * Flags to pass to kmem_cache_create().
+@@ -82,10 +83,13 @@
+  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
+  * Both make kfree a no-op.
+  */
+-#define ZERO_SIZE_PTR ((void *)16)
++#define ZERO_SIZE_PTR				\
++({						\
++	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
++	(void *)(-MAX_ERRNO-1L);		\
++})
+ 
+-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
+-				(unsigned long)ZERO_SIZE_PTR)
++#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
+ 
+ /*
+  * struct kmem_cache related prototypes
+@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
+ void kfree(const void *);
+ void kzfree(const void *);
+ size_t ksize(const void *);
++void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ /*
+  * Allocator specific definitions. These are mainly used to establish optimized
+@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
+ 
+ void __init kmem_cache_init_late(void);
+ 
++#define kmalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kmalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
++#define kmalloc_node(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = kmalloc_node((size_t)___x, (y), (z));\
++	___retval;						\
++})
++
++#define kzalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kzalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
+ #endif	/* _LINUX_SLAB_H */
+diff -urNp linux-2.6.32.13/include/linux/slub_def.h linux-2.6.32.13/include/linux/slub_def.h
+--- linux-2.6.32.13/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/slub_def.h	2010-05-15 13:21:17.950606770 -0400
+@@ -86,7 +86,7 @@ struct kmem_cache {
+ 	struct kmem_cache_order_objects max;
+ 	struct kmem_cache_order_objects min;
+ 	gfp_t allocflags;	/* gfp flags to use on each alloc */
+-	int refcount;		/* Refcount for slab cache destroy */
++	atomic_t refcount;	/* Refcount for slab cache destroy */
+ 	void (*ctor)(void *);
+ 	int inuse;		/* Offset to metadata */
+ 	int align;		/* Alignment */
+diff -urNp linux-2.6.32.13/include/linux/sonet.h linux-2.6.32.13/include/linux/sonet.h
+--- linux-2.6.32.13/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/sonet.h	2010-05-15 13:21:17.950606770 -0400
+@@ -61,7 +61,7 @@ struct sonet_stats {
+ #include <asm/atomic.h>
+ 
+ struct k_sonet_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.13/include/linux/suspend.h linux-2.6.32.13/include/linux/suspend.h
+--- linux-2.6.32.13/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/suspend.h	2010-05-15 13:21:17.950606770 -0400
+@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
+  *	which require special recovery actions in that situation.
+  */
+ struct platform_suspend_ops {
+-	int (*valid)(suspend_state_t state);
+-	int (*begin)(suspend_state_t state);
+-	int (*prepare)(void);
+-	int (*prepare_late)(void);
+-	int (*enter)(suspend_state_t state);
+-	void (*wake)(void);
+-	void (*finish)(void);
+-	void (*end)(void);
+-	void (*recover)(void);
++	int (* const valid)(suspend_state_t state);
++	int (* const begin)(suspend_state_t state);
++	int (* const prepare)(void);
++	int (* const prepare_late)(void);
++	int (* const enter)(suspend_state_t state);
++	void (* const wake)(void);
++	void (* const finish)(void);
++	void (* const end)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_SUSPEND
+@@ -120,7 +120,7 @@ struct platform_suspend_ops {
+  * suspend_set_ops - set platform dependent suspend operations
+  * @ops: The new suspend operations to set.
+  */
+-extern void suspend_set_ops(struct platform_suspend_ops *ops);
++extern void suspend_set_ops(const struct platform_suspend_ops *ops);
+ extern int suspend_valid_only_mem(suspend_state_t state);
+ 
+ /**
+@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
+ #else /* !CONFIG_SUSPEND */
+ #define suspend_valid_only_mem	NULL
+ 
+-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
++static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
+ static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
+ #endif /* !CONFIG_SUSPEND */
+ 
+@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
+  *	platforms which require special recovery actions in that situation.
+  */
+ struct platform_hibernation_ops {
+-	int (*begin)(void);
+-	void (*end)(void);
+-	int (*pre_snapshot)(void);
+-	void (*finish)(void);
+-	int (*prepare)(void);
+-	int (*enter)(void);
+-	void (*leave)(void);
+-	int (*pre_restore)(void);
+-	void (*restore_cleanup)(void);
+-	void (*recover)(void);
++	int (* const begin)(void);
++	void (* const end)(void);
++	int (* const pre_snapshot)(void);
++	void (* const finish)(void);
++	int (* const prepare)(void);
++	int (* const enter)(void);
++	void (* const leave)(void);
++	int (* const pre_restore)(void);
++	void (* const restore_cleanup)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_HIBERNATION
+@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
+ extern void swsusp_unset_page_free(struct page *);
+ extern unsigned long get_safe_page(gfp_t gfp_mask);
+ 
+-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
++extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
+ extern int hibernate(void);
+ extern bool system_entering_hibernation(void);
+ #else /* CONFIG_HIBERNATION */
+@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
+ static inline void swsusp_set_page_free(struct page *p) {}
+ static inline void swsusp_unset_page_free(struct page *p) {}
+ 
+-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
++static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
+ static inline int hibernate(void) { return -ENOSYS; }
+ static inline bool system_entering_hibernation(void) { return false; }
+ #endif /* CONFIG_HIBERNATION */
+diff -urNp linux-2.6.32.13/include/linux/sysctl.h linux-2.6.32.13/include/linux/sysctl.h
+--- linux-2.6.32.13/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/sysctl.h	2010-05-15 13:21:17.950606770 -0400
+@@ -164,7 +164,11 @@ enum
+ 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
+ };
+ 
+-
++#ifdef CONFIG_PAX_SOFTMODE
++enum {
++	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
++};
++#endif
+ 
+ /* CTL_VM names: */
+ enum
+diff -urNp linux-2.6.32.13/include/linux/sysfs.h linux-2.6.32.13/include/linux/sysfs.h
+--- linux-2.6.32.13/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/sysfs.h	2010-05-15 13:21:17.950606770 -0400
+@@ -75,8 +75,8 @@ struct bin_attribute {
+ };
+ 
+ struct sysfs_ops {
+-	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
+-	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
++	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
++	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
+ };
+ 
+ struct sysfs_dirent;
+diff -urNp linux-2.6.32.13/include/linux/thread_info.h linux-2.6.32.13/include/linux/thread_info.h
+--- linux-2.6.32.13/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/thread_info.h	2010-05-15 13:21:17.950606770 -0400
+@@ -23,7 +23,7 @@ struct restart_block {
+ 		};
+ 		/* For futex_wait and futex_wait_requeue_pi */
+ 		struct {
+-			u32 *uaddr;
++			u32 __user *uaddr;
+ 			u32 val;
+ 			u32 flags;
+ 			u32 bitset;
+diff -urNp linux-2.6.32.13/include/linux/tty.h linux-2.6.32.13/include/linux/tty.h
+--- linux-2.6.32.13/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.13/include/linux/tty.h	2010-05-15 13:21:17.950606770 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/tty_ldisc.h>
+ #include <linux/mutex.h>
++#include <linux/poll.h>
+ 
+ #include <asm/system.h>
+ 
+@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
+ extern dev_t tty_devnum(struct tty_struct *tty);
+ extern void proc_clear_tty(struct task_struct *p);
+ extern struct tty_struct *get_current_tty(void);
+-extern void tty_default_fops(struct file_operations *fops);
+ extern struct tty_struct *alloc_tty_struct(void);
+ extern void free_tty_struct(struct tty_struct *tty);
+ extern void initialize_tty_struct(struct tty_struct *tty,
+@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
+ /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
+ extern void tty_ldisc_enable(struct tty_struct *tty);
+ 
++/* tty_io.c */
++extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
++extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
++extern unsigned int tty_poll(struct file *, poll_table *);
++#ifdef CONFIG_COMPAT
++extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
++				unsigned long arg);
++#else
++#define tty_compat_ioctl NULL
++#endif
++extern int tty_release(struct inode *, struct file *);
++extern int tty_fasync(int fd, struct file *filp, int on);
+ 
+ /* n_tty.c */
+ extern struct tty_ldisc_ops tty_ldisc_N_TTY;
+diff -urNp linux-2.6.32.13/include/linux/tty_ldisc.h linux-2.6.32.13/include/linux/tty_ldisc.h
+--- linux-2.6.32.13/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/tty_ldisc.h	2010-05-15 13:21:17.950606770 -0400
+@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
+ 
+ 	struct  module *owner;
+ 	
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ struct tty_ldisc {
+diff -urNp linux-2.6.32.13/include/linux/types.h linux-2.6.32.13/include/linux/types.h
+--- linux-2.6.32.13/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/types.h	2010-05-15 13:21:17.956129899 -0400
+@@ -191,10 +191,26 @@ typedef struct {
+ 	volatile int counter;
+ } atomic_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile int counter;
++} atomic_unchecked_t;
++#else
++typedef atomic_t atomic_unchecked_t;
++#endif
++
+ #ifdef CONFIG_64BIT
+ typedef struct {
+ 	volatile long counter;
+ } atomic64_t;
++
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile long counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
+ #endif
+ 
+ struct ustat {
+diff -urNp linux-2.6.32.13/include/linux/uaccess.h linux-2.6.32.13/include/linux/uaccess.h
+--- linux-2.6.32.13/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/uaccess.h	2010-05-15 13:21:17.956129899 -0400
+@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
+ 		long ret;				\
+ 		mm_segment_t old_fs = get_fs();		\
+ 							\
+-		set_fs(KERNEL_DS);			\
+ 		pagefault_disable();			\
++		set_fs(KERNEL_DS);			\
+ 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
+-		pagefault_enable();			\
+ 		set_fs(old_fs);				\
++		pagefault_enable();			\
+ 		ret;					\
+ 	})
+ 
+@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_read(void *dst, void *src, size_t size);
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
+ 
+ /*
+  * probe_kernel_write(): safely attempt to write to a location
+@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_write(void *dst, void *src, size_t size);
++extern long probe_kernel_write(void *dst, const void *src, size_t size);
+ 
+ #endif		/* __LINUX_UACCESS_H__ */
+diff -urNp linux-2.6.32.13/include/linux/vmalloc.h linux-2.6.32.13/include/linux/vmalloc.h
+--- linux-2.6.32.13/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/linux/vmalloc.h	2010-05-15 13:23:38.934774262 -0400
+@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
+ #define VM_MAP		0x00000004	/* vmap()ed pages */
+ #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
+ #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
++#endif
++
+ /* bits [20..32] reserved for arch specific ioremap internals */
+ 
+ /*
+@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
+ 
+ void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
+ 
++#define vmalloc(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define __vmalloc(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = __vmalloc((unsigned long)___x, (y), (z));\
++	___retval;						\
++})
++
++#define vmalloc_user(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_user((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_exec(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_exec((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_node(x, y)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_node((unsigned long)___x, (y));\
++	___retval;						\
++})
++
++#define vmalloc_32(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_32_user(x)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32_user((unsigned long)___x);\
++	___retval;						\
++})
++
+ #endif /* _LINUX_VMALLOC_H */
+diff -urNp linux-2.6.32.13/include/net/irda/ircomm_tty.h linux-2.6.32.13/include/net/irda/ircomm_tty.h
+--- linux-2.6.32.13/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/net/irda/ircomm_tty.h	2010-05-15 13:21:17.956129899 -0400
+@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
+         unsigned short    close_delay;
+         unsigned short    closing_wait; /* time to wait before closing */
+ 
+-	int  open_count;
+-	int  blocked_open;	/* # of blocked opens */
++	atomic_t open_count;
++	atomic_t blocked_open;	/* # of blocked opens */
+ 
+ 	/* Protect concurent access to :
+ 	 *	o self->open_count
+diff -urNp linux-2.6.32.13/include/net/neighbour.h linux-2.6.32.13/include/net/neighbour.h
+--- linux-2.6.32.13/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/net/neighbour.h	2010-05-15 13:21:17.956129899 -0400
+@@ -125,12 +125,12 @@ struct neighbour
+ struct neigh_ops
+ {
+ 	int			family;
+-	void			(*solicit)(struct neighbour *, struct sk_buff*);
+-	void			(*error_report)(struct neighbour *, struct sk_buff*);
+-	int			(*output)(struct sk_buff*);
+-	int			(*connected_output)(struct sk_buff*);
+-	int			(*hh_output)(struct sk_buff*);
+-	int			(*queue_xmit)(struct sk_buff*);
++	void			(* const solicit)(struct neighbour *, struct sk_buff*);
++	void			(* const error_report)(struct neighbour *, struct sk_buff*);
++	int			(* const output)(struct sk_buff*);
++	int			(* const connected_output)(struct sk_buff*);
++	int			(* const hh_output)(struct sk_buff*);
++	int			(* const queue_xmit)(struct sk_buff*);
+ };
+ 
+ struct pneigh_entry
+diff -urNp linux-2.6.32.13/include/net/sctp/sctp.h linux-2.6.32.13/include/net/sctp/sctp.h
+--- linux-2.6.32.13/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/net/sctp/sctp.h	2010-05-15 13:21:17.956129899 -0400
+@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
+ 
+ #else	/* SCTP_DEBUG */
+ 
+-#define SCTP_DEBUG_PRINTK(whatever...)
+-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
++#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
++#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
+ #define SCTP_ENABLE_DEBUG
+ #define SCTP_DISABLE_DEBUG
+ #define SCTP_ASSERT(expr, str, func)
+diff -urNp linux-2.6.32.13/include/net/tcp.h linux-2.6.32.13/include/net/tcp.h
+--- linux-2.6.32.13/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/net/tcp.h	2010-05-15 13:21:17.956129899 -0400
+@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
+ struct tcp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.13/include/net/udp.h linux-2.6.32.13/include/net/udp.h
+--- linux-2.6.32.13/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/net/udp.h	2010-05-15 13:21:17.956129899 -0400
+@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
+ 	struct udp_table	*udp_table;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.13/include/sound/ac97_codec.h linux-2.6.32.13/include/sound/ac97_codec.h
+--- linux-2.6.32.13/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/sound/ac97_codec.h	2010-05-15 13:21:17.956129899 -0400
+@@ -419,15 +419,15 @@
+ struct snd_ac97;
+ 
+ struct snd_ac97_build_ops {
+-	int (*build_3d) (struct snd_ac97 *ac97);
+-	int (*build_specific) (struct snd_ac97 *ac97);
+-	int (*build_spdif) (struct snd_ac97 *ac97);
+-	int (*build_post_spdif) (struct snd_ac97 *ac97);
++	int (* const build_3d) (struct snd_ac97 *ac97);
++	int (* const build_specific) (struct snd_ac97 *ac97);
++	int (* const build_spdif) (struct snd_ac97 *ac97);
++	int (* const build_post_spdif) (struct snd_ac97 *ac97);
+ #ifdef CONFIG_PM
+-	void (*suspend) (struct snd_ac97 *ac97);
+-	void (*resume) (struct snd_ac97 *ac97);
++	void (* const suspend) (struct snd_ac97 *ac97);
++	void (* const resume) (struct snd_ac97 *ac97);
+ #endif
+-	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
++	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
+ };
+ 
+ struct snd_ac97_bus_ops {
+@@ -477,7 +477,7 @@ struct snd_ac97_template {
+ 
+ struct snd_ac97 {
+ 	/* -- lowlevel (hardware) driver specific -- */
+-	struct snd_ac97_build_ops * build_ops;
++	const struct snd_ac97_build_ops * build_ops;
+ 	void *private_data;
+ 	void (*private_free) (struct snd_ac97 *ac97);
+ 	/* --- */
+diff -urNp linux-2.6.32.13/include/trace/events/irq.h linux-2.6.32.13/include/trace/events/irq.h
+--- linux-2.6.32.13/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/trace/events/irq.h	2010-05-15 13:21:17.956129899 -0400
+@@ -34,7 +34,7 @@
+  */
+ TRACE_EVENT(irq_handler_entry,
+ 
+-	TP_PROTO(int irq, struct irqaction *action),
++	TP_PROTO(int irq, const struct irqaction *action),
+ 
+ 	TP_ARGS(irq, action),
+ 
+@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
+  */
+ TRACE_EVENT(irq_handler_exit,
+ 
+-	TP_PROTO(int irq, struct irqaction *action, int ret),
++	TP_PROTO(int irq, const struct irqaction *action, int ret),
+ 
+ 	TP_ARGS(irq, action, ret),
+ 
+@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
+  */
+ TRACE_EVENT(softirq_entry,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
+  */
+ TRACE_EVENT(softirq_exit,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+diff -urNp linux-2.6.32.13/include/video/uvesafb.h linux-2.6.32.13/include/video/uvesafb.h
+--- linux-2.6.32.13/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/include/video/uvesafb.h	2010-05-15 13:21:17.956129899 -0400
+@@ -177,6 +177,7 @@ struct uvesafb_par {
+ 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
+ 	u8 pmi_setpal;			/* PMI for palette changes */
+ 	u16 *pmi_base;			/* protected mode interface location */
++	u8 *pmi_code;			/* protected mode code location */
+ 	void *pmi_start;
+ 	void *pmi_pal;
+ 	u8 *vbe_state_orig;		/*
+diff -urNp linux-2.6.32.13/init/do_mounts.c linux-2.6.32.13/init/do_mounts.c
+--- linux-2.6.32.13/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/do_mounts.c	2010-05-15 13:21:17.956129899 -0400
+@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
+ 
+ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
+ {
+-	int err = sys_mount(name, "/root", fs, flags, data);
++	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
+ 	if (err)
+ 		return err;
+ 
+-	sys_chdir("/root");
++	sys_chdir((__force char __user *)"/root");
+ 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
+ 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
+ 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
+@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
+ 	va_start(args, fmt);
+ 	vsprintf(buf, fmt, args);
+ 	va_end(args);
+-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, FDEJECT, 0);
+ 		sys_close(fd);
+ 	}
+ 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
+-	fd = sys_open("/dev/console", O_RDWR, 0);
++	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, TCGETS, (long)&termios);
+ 		termios.c_lflag &= ~ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+-		sys_read(fd, &c, 1);
++		sys_read(fd, (char __user *)&c, 1);
+ 		termios.c_lflag |= ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+ 		sys_close(fd);
+@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
+ 	mount_root();
+ out:
+ 	devtmpfs_mount("dev");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force char __user *)".");
+ }
+diff -urNp linux-2.6.32.13/init/do_mounts.h linux-2.6.32.13/init/do_mounts.h
+--- linux-2.6.32.13/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/do_mounts.h	2010-05-15 13:21:18.018620095 -0400
+@@ -15,15 +15,15 @@ extern int root_mountflags;
+ 
+ static inline int create_dev(char *name, dev_t dev)
+ {
+-	sys_unlink(name);
+-	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
++	sys_unlink((__force char __user *)name);
++	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
+ }
+ 
+ #if BITS_PER_LONG == 32
+ static inline u32 bstat(char *name)
+ {
+ 	struct stat64 stat;
+-	if (sys_stat64(name, &stat) != 0)
++	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
+ 		return 0;
+ 	if (!S_ISBLK(stat.st_mode))
+ 		return 0;
+diff -urNp linux-2.6.32.13/init/do_mounts_initrd.c linux-2.6.32.13/init/do_mounts_initrd.c
+--- linux-2.6.32.13/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/do_mounts_initrd.c	2010-05-15 13:21:18.018620095 -0400
+@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
+ 	sys_close(old_fd);sys_close(root_fd);
+ 	sys_close(0);sys_close(1);sys_close(2);
+ 	sys_setsid();
+-	(void) sys_open("/dev/console",O_RDWR,0);
++	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
+ 	(void) sys_dup(0);
+ 	(void) sys_dup(0);
+ 	return kernel_execve(shell, argv, envp_init);
+@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
+ 	create_dev("/dev/root.old", Root_RAM0);
+ 	/* mount initrd on rootfs' /root */
+ 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
+-	sys_mkdir("/old", 0700);
+-	root_fd = sys_open("/", 0, 0);
+-	old_fd = sys_open("/old", 0, 0);
++	sys_mkdir((__force const char __user *)"/old", 0700);
++	root_fd = sys_open((__force const char __user *)"/", 0, 0);
++	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
+ 	/* move initrd over / and chdir/chroot in initrd root */
+-	sys_chdir("/root");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_chdir((__force const char __user *)"/root");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force const char __user *)".");
+ 
+ 	/*
+ 	 * In case that a resume from disk is carried out by linuxrc or one of
+@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
+ 
+ 	/* move initrd to rootfs' /old */
+ 	sys_fchdir(old_fd);
+-	sys_mount("/", ".", NULL, MS_MOVE, NULL);
++	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
+ 	/* switch root and cwd back to / of rootfs */
+ 	sys_fchdir(root_fd);
+-	sys_chroot(".");
++	sys_chroot((__force const char __user *)".");
+ 	sys_close(old_fd);
+ 	sys_close(root_fd);
+ 
+ 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
+-		sys_chdir("/old");
++		sys_chdir((__force const char __user *)"/old");
+ 		return;
+ 	}
+ 
+@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
+ 	mount_root();
+ 
+ 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
+-	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
++	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
+ 	if (!error)
+ 		printk("okay\n");
+ 	else {
+-		int fd = sys_open("/dev/root.old", O_RDWR, 0);
++		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
+ 		if (error == -ENOENT)
+ 			printk("/initrd does not exist. Ignored.\n");
+ 		else
+ 			printk("failed\n");
+ 		printk(KERN_NOTICE "Unmounting old root\n");
+-		sys_umount("/old", MNT_DETACH);
++		sys_umount((__force char __user *)"/old", MNT_DETACH);
+ 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
+ 		if (fd < 0) {
+ 			error = fd;
+@@ -119,11 +119,11 @@ int __init initrd_load(void)
+ 		 * mounted in the normal path.
+ 		 */
+ 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
+-			sys_unlink("/initrd.image");
++			sys_unlink((__force const char __user *)"/initrd.image");
+ 			handle_initrd();
+ 			return 1;
+ 		}
+ 	}
+-	sys_unlink("/initrd.image");
++	sys_unlink((__force const char __user *)"/initrd.image");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/init/do_mounts_md.c linux-2.6.32.13/init/do_mounts_md.c
+--- linux-2.6.32.13/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/do_mounts_md.c	2010-05-15 13:21:18.018620095 -0400
+@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
+ 			partitioned ? "_d" : "", minor,
+ 			md_setup_args[ent].device_names);
+ 
+-		fd = sys_open(name, 0, 0);
++		fd = sys_open((__force char __user *)name, 0, 0);
+ 		if (fd < 0) {
+ 			printk(KERN_ERR "md: open failed - cannot start "
+ 					"array %s\n", name);
+@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
+ 			 * array without it
+ 			 */
+ 			sys_close(fd);
+-			fd = sys_open(name, 0, 0);
++			fd = sys_open((__force char __user *)name, 0, 0);
+ 			sys_ioctl(fd, BLKRRPART, 0);
+ 		}
+ 		sys_close(fd);
+@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
+ 
+ 	wait_for_device_probe();
+ 
+-	fd = sys_open("/dev/md0", 0, 0);
++	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
+ 		sys_close(fd);
+diff -urNp linux-2.6.32.13/init/initramfs.c linux-2.6.32.13/init/initramfs.c
+--- linux-2.6.32.13/init/initramfs.c	2010-05-15 13:20:19.362999772 -0400
++++ linux-2.6.32.13/init/initramfs.c	2010-05-15 13:21:18.018620095 -0400
+@@ -74,7 +74,7 @@ static void __init free_hash(void)
+ 	}
+ }
+ 
+-static long __init do_utime(char __user *filename, time_t mtime)
++static long __init do_utime(__force char __user *filename, time_t mtime)
+ {
+ 	struct timespec t[2];
+ 
+@@ -109,7 +109,7 @@ static void __init dir_utime(void)
+ 	struct dir_entry *de, *tmp;
+ 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
+ 		list_del(&de->list);
+-		do_utime(de->name, de->mtime);
++		do_utime((__force char __user *)de->name, de->mtime);
+ 		kfree(de->name);
+ 		kfree(de);
+ 	}
+@@ -271,7 +271,7 @@ static int __init maybe_link(void)
+ 	if (nlink >= 2) {
+ 		char *old = find_link(major, minor, ino, mode, collected);
+ 		if (old)
+-			return (sys_link(old, collected) < 0) ? -1 : 1;
++			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
+ 	}
+ 	return 0;
+ }
+@@ -280,11 +280,11 @@ static void __init clean_path(char *path
+ {
+ 	struct stat st;
+ 
+-	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
++	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
+ 		if (S_ISDIR(st.st_mode))
+-			sys_rmdir(path);
++			sys_rmdir((__force char __user *)path);
+ 		else
+-			sys_unlink(path);
++			sys_unlink((__force char __user *)path);
+ 	}
+ }
+ 
+@@ -305,7 +305,7 @@ static int __init do_name(void)
+ 			int openflags = O_WRONLY|O_CREAT;
+ 			if (ml != 1)
+ 				openflags |= O_TRUNC;
+-			wfd = sys_open(collected, openflags, mode);
++			wfd = sys_open((__force char __user *)collected, openflags, mode);
+ 
+ 			if (wfd >= 0) {
+ 				sys_fchown(wfd, uid, gid);
+@@ -317,17 +317,17 @@ static int __init do_name(void)
+ 			}
+ 		}
+ 	} else if (S_ISDIR(mode)) {
+-		sys_mkdir(collected, mode);
+-		sys_chown(collected, uid, gid);
+-		sys_chmod(collected, mode);
++		sys_mkdir((__force char __user *)collected, mode);
++		sys_chown((__force char __user *)collected, uid, gid);
++		sys_chmod((__force char __user *)collected, mode);
+ 		dir_add(collected, mtime);
+ 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
+ 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
+ 		if (maybe_link() == 0) {
+-			sys_mknod(collected, mode, rdev);
+-			sys_chown(collected, uid, gid);
+-			sys_chmod(collected, mode);
+-			do_utime(collected, mtime);
++			sys_mknod((__force char __user *)collected, mode, rdev);
++			sys_chown((__force char __user *)collected, uid, gid);
++			sys_chmod((__force char __user *)collected, mode);
++			do_utime((__force char __user *)collected, mtime);
+ 		}
+ 	}
+ 	return 0;
+@@ -336,15 +336,15 @@ static int __init do_name(void)
+ static int __init do_copy(void)
+ {
+ 	if (count >= body_len) {
+-		sys_write(wfd, victim, body_len);
++		sys_write(wfd, (__force char __user *)victim, body_len);
+ 		sys_close(wfd);
+-		do_utime(vcollected, mtime);
++		do_utime((__force char __user *)vcollected, mtime);
+ 		kfree(vcollected);
+ 		eat(body_len);
+ 		state = SkipIt;
+ 		return 0;
+ 	} else {
+-		sys_write(wfd, victim, count);
++		sys_write(wfd, (__force char __user *)victim, count);
+ 		body_len -= count;
+ 		eat(count);
+ 		return 1;
+@@ -355,9 +355,9 @@ static int __init do_symlink(void)
+ {
+ 	collected[N_ALIGN(name_len) + body_len] = '\0';
+ 	clean_path(collected, 0);
+-	sys_symlink(collected + N_ALIGN(name_len), collected);
+-	sys_lchown(collected, uid, gid);
+-	do_utime(collected, mtime);
++	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
++	sys_lchown((__force char __user *)collected, uid, gid);
++	do_utime((__force char __user *)collected, mtime);
+ 	state = SkipIt;
+ 	next_state = Reset;
+ 	return 0;
+diff -urNp linux-2.6.32.13/init/Kconfig linux-2.6.32.13/init/Kconfig
+--- linux-2.6.32.13/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/Kconfig	2010-05-15 13:21:18.034611512 -0400
+@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
+ 
+ config COMPAT_BRK
+ 	bool "Disable heap randomization"
+-	default y
++	default n
+ 	help
+ 	  Randomizing heap placement makes heap exploits harder, but it
+ 	  also breaks ancient binaries (including anything libc5 based).
+@@ -1116,9 +1116,9 @@ config HAVE_GENERIC_DMA_COHERENT
+ 
+ config SLABINFO
+ 	bool
+-	depends on PROC_FS
++	depends on PROC_FS && !GRKERNSEC_PROC_ADD
+ 	depends on SLAB || SLUB_DEBUG
+-	default y
++	default n
+ 
+ config RT_MUTEXES
+ 	boolean
+diff -urNp linux-2.6.32.13/init/main.c linux-2.6.32.13/init/main.c
+--- linux-2.6.32.13/init/main.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.13/init/main.c	2010-05-15 13:21:18.034611512 -0400
+@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
+ #ifdef CONFIG_TC
+ extern void tc_init(void);
+ #endif
++extern void grsecurity_init(void);
+ 
+ enum system_states system_state __read_mostly;
+ EXPORT_SYMBOL(system_state);
+@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
+ 
+ __setup("reset_devices", set_reset_devices);
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++extern void pax_enter_kernel_user(void);
++extern void pax_exit_kernel_user(void);
++extern pteval_t clone_pgd_mask;
++#endif
++
++#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++	unsigned int cpu;
++
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++	}
++	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++#else
++	char *p;
++	p = (char *)pax_enter_kernel_user;
++	*p = 0xc3;
++	p = (char *)pax_exit_kernel_user;
++	*p = 0xc3;
++	clone_pgd_mask = ~(pteval_t)0UL;
++#endif
++
++	return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++unsigned int pax_softmode;
++
++static int __init setup_pax_softmode(char *str)
++{
++	get_option(&str, &pax_softmode);
++	return 1;
++}
++__setup("pax_softmode=", setup_pax_softmode);
++#endif
++
+ static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
+ char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
+ static const char *panic_later, *panic_param;
+@@ -697,52 +742,53 @@ int initcall_debug;
+ core_param(initcall_debug, initcall_debug, bool, 0644);
+ 
+ static char msgbuf[64];
+-static struct boot_trace_call call;
+-static struct boot_trace_ret ret;
++static struct boot_trace_call trace_call;
++static struct boot_trace_ret trace_ret;
+ 
+ int do_one_initcall(initcall_t fn)
+ {
+ 	int count = preempt_count();
+ 	ktime_t calltime, delta, rettime;
++	const char *msg1 = "", *msg2 = "";
+ 
+ 	if (initcall_debug) {
+-		call.caller = task_pid_nr(current);
+-		printk("calling  %pF @ %i\n", fn, call.caller);
++		trace_call.caller = task_pid_nr(current);
++		printk("calling  %pF @ %i\n", fn, trace_call.caller);
+ 		calltime = ktime_get();
+-		trace_boot_call(&call, fn);
++		trace_boot_call(&trace_call, fn);
+ 		enable_boot_trace();
+ 	}
+ 
+-	ret.result = fn();
++	trace_ret.result = fn();
+ 
+ 	if (initcall_debug) {
+ 		disable_boot_trace();
+ 		rettime = ktime_get();
+ 		delta = ktime_sub(rettime, calltime);
+-		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
+-		trace_boot_ret(&ret, fn);
++		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
++		trace_boot_ret(&trace_ret, fn);
+ 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
+-			ret.result, ret.duration);
++			trace_ret.result, trace_ret.duration);
+ 	}
+ 
+ 	msgbuf[0] = 0;
+ 
+-	if (ret.result && ret.result != -ENODEV && initcall_debug)
+-		sprintf(msgbuf, "error code %d ", ret.result);
++	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
++		sprintf(msgbuf, "error code %d ", trace_ret.result);
+ 
+ 	if (preempt_count() != count) {
+-		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
++		msg1 = " preemption imbalance";
+ 		preempt_count() = count;
+ 	}
+ 	if (irqs_disabled()) {
+-		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
++		msg2 = " disabled interrupts";
+ 		local_irq_enable();
+ 	}
+-	if (msgbuf[0]) {
+-		printk("initcall %pF returned with %s\n", fn, msgbuf);
++	if (msgbuf[0] || *msg1 || *msg2) {
++		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
+ 	}
+ 
+-	return ret.result;
++	return trace_ret.result;
+ }
+ 
+ 
+@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
+ 	if (!ramdisk_execute_command)
+ 		ramdisk_execute_command = "/init";
+ 
+-	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
++	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
+ 		ramdisk_execute_command = NULL;
+ 		prepare_namespace();
+ 	}
+ 
++	grsecurity_init();
++
+ 	/*
+ 	 * Ok, we have completed the initial bootup, and
+ 	 * we're essentially up and running. Get rid of the
+diff -urNp linux-2.6.32.13/init/noinitramfs.c linux-2.6.32.13/init/noinitramfs.c
+--- linux-2.6.32.13/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/init/noinitramfs.c	2010-05-15 13:21:18.034611512 -0400
+@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
+ {
+ 	int err;
+ 
+-	err = sys_mkdir("/dev", 0755);
++	err = sys_mkdir((const char __user *)"/dev", 0755);
+ 	if (err < 0)
+ 		goto out;
+ 
+@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
+ 	if (err < 0)
+ 		goto out;
+ 
+-	err = sys_mkdir("/root", 0700);
++	err = sys_mkdir((const char __user *)"/root", 0700);
+ 	if (err < 0)
+ 		goto out;
+ 
+diff -urNp linux-2.6.32.13/ipc/ipc_sysctl.c linux-2.6.32.13/ipc/ipc_sysctl.c
+--- linux-2.6.32.13/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/ipc/ipc_sysctl.c	2010-05-15 13:21:18.060013842 -0400
+@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
+ 		.extra1		= &zero,
+ 		.extra2		= &one,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table ipc_root_table[] = {
+@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
+ 		.mode		= 0555,
+ 		.child		= ipc_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init ipc_sysctl_init(void)
+diff -urNp linux-2.6.32.13/ipc/mqueue.c linux-2.6.32.13/ipc/mqueue.c
+--- linux-2.6.32.13/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.13/ipc/mqueue.c	2010-05-15 13:21:18.060013842 -0400
+@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
+ 			mq_bytes = (mq_msg_tblsz +
+ 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
+ 
++			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
+ 			spin_lock(&mq_lock);
+ 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
+ 		 	    u->mq_bytes + mq_bytes >
+diff -urNp linux-2.6.32.13/ipc/shm.c linux-2.6.32.13/ipc/shm.c
+--- linux-2.6.32.13/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/ipc/shm.c	2010-05-15 13:21:18.060013842 -0400
+@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
+ static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime, const uid_t cuid,
++			   const int shmid);
++extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime);
++#endif
++
+ void shm_init_ns(struct ipc_namespace *ns)
+ {
+ 	ns->shm_ctlmax = SHMMAX;
+@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
+ 	shp->shm_lprid = 0;
+ 	shp->shm_atim = shp->shm_dtim = 0;
+ 	shp->shm_ctim = get_seconds();
++#ifdef CONFIG_GRKERNSEC
++	{
++		struct timespec timeval;
++		do_posix_clock_monotonic_gettime(&timeval);
++
++		shp->shm_createtime = timeval.tv_sec;
++	}
++#endif
+ 	shp->shm_segsz = size;
+ 	shp->shm_nattch = 0;
+ 	shp->shm_file = file;
+@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
+ 	if (err)
+ 		goto out_unlock;
+ 
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
++			     shp->shm_perm.cuid, shmid) ||
++	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
++		err = -EACCES;
++		goto out_unlock;
++	}
++#endif
++
+ 	path.dentry = dget(shp->shm_file->f_path.dentry);
+ 	path.mnt    = shp->shm_file->f_path.mnt;
+ 	shp->shm_nattch++;
++#ifdef CONFIG_GRKERNSEC
++	shp->shm_lapid = current->pid;
++#endif
+ 	size = i_size_read(path.dentry->d_inode);
+ 	shm_unlock(shp);
+ 
+diff -urNp linux-2.6.32.13/kernel/acct.c linux-2.6.32.13/kernel/acct.c
+--- linux-2.6.32.13/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/acct.c	2010-05-15 13:21:18.060013842 -0400
+@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
+ 	 */
+ 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
+-	file->f_op->write(file, (char *)&ac,
++	file->f_op->write(file, (__force char __user *)&ac,
+ 			       sizeof(acct_t), &file->f_pos);
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
+ 	set_fs(fs);
+diff -urNp linux-2.6.32.13/kernel/capability.c linux-2.6.32.13/kernel/capability.c
+--- linux-2.6.32.13/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/capability.c	2010-05-15 13:21:18.079122751 -0400
+@@ -306,10 +306,21 @@ int capable(int cap)
+ 		BUG();
+ 	}
+ 
+-	if (security_capable(cap) == 0) {
++	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
+ 		current->flags |= PF_SUPERPRIV;
+ 		return 1;
+ 	}
+ 	return 0;
+ }
++
++int capable_nolog(int cap)
++{
++	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
++		current->flags |= PF_SUPERPRIV;
++		return 1;
++	}
++	return 0;
++}
++
+ EXPORT_SYMBOL(capable);
++EXPORT_SYMBOL(capable_nolog);
+diff -urNp linux-2.6.32.13/kernel/configs.c linux-2.6.32.13/kernel/configs.c
+--- linux-2.6.32.13/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/configs.c	2010-05-15 13:21:18.079122751 -0400
+@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
+ 	struct proc_dir_entry *entry;
+ 
+ 	/* create the current config file */
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
++			    &ikconfig_file_ops);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
++			    &ikconfig_file_ops);
++#endif
++#else
+ 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+ 			    &ikconfig_file_ops);
++#endif
++
+ 	if (!entry)
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.13/kernel/cpu.c linux-2.6.32.13/kernel/cpu.c
+--- linux-2.6.32.13/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/cpu.c	2010-05-15 13:21:18.079122751 -0400
+@@ -19,7 +19,7 @@
+ /* Serializes the updates to cpu_online_mask, cpu_present_mask */
+ static DEFINE_MUTEX(cpu_add_remove_lock);
+ 
+-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
++static RAW_NOTIFIER_HEAD(cpu_chain);
+ 
+ /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
+  * Should always be manipulated under cpu_add_remove_lock
+diff -urNp linux-2.6.32.13/kernel/cred.c linux-2.6.32.13/kernel/cred.c
+--- linux-2.6.32.13/kernel/cred.c	2010-05-15 13:20:19.362999772 -0400
++++ linux-2.6.32.13/kernel/cred.c	2010-05-15 13:21:18.079122751 -0400
+@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
+ 
+ 	get_cred(new); /* we will require a ref for the subj creds too */
+ 
++	gr_set_role_label(task, new->uid, new->gid);
++
+ 	/* dumpability changes */
+ 	if (old->euid != new->euid ||
+ 	    old->egid != new->egid ||
+diff -urNp linux-2.6.32.13/kernel/exit.c linux-2.6.32.13/kernel/exit.c
+--- linux-2.6.32.13/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/exit.c	2010-05-15 13:21:18.103069718 -0400
+@@ -56,6 +56,10 @@
+ #include <asm/mmu_context.h>
+ #include "cred-internals.h"
+ 
++#ifdef CONFIG_GRKERNSEC
++extern rwlock_t grsec_exec_file_lock;
++#endif
++
+ static void exit_mm(struct task_struct * tsk);
+ 
+ static void __unhash_process(struct task_struct *p)
+@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
+ 	struct task_struct *leader;
+ 	int zap_leader;
+ repeat:
++	gr_del_task_from_ip_table(p);
++
+ 	tracehook_prepare_release_task(p);
+ 	/* don't need to get the RCU readlock here - the process is dead and
+ 	 * can't be modifying its own credentials */
+@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
+ {
+ 	write_lock_irq(&tasklist_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
+ 	ptrace_unlink(current);
+ 	/* Reparent to init */
+ 	current->real_parent = current->parent = kthreadd_task;
+ 	list_move_tail(&current->sibling, &current->real_parent->children);
+ 
++	gr_set_kernel_label(current);
++
+ 	/* Set the exit signal to SIGCHLD so we signal init on exit */
+ 	current->exit_signal = SIGCHLD;
+ 
+@@ -390,7 +407,7 @@ int allow_signal(int sig)
+ 	 * know it'll be handled, so that they don't get converted to
+ 	 * SIGKILL or just silently dropped.
+ 	 */
+-	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
++	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
+ 	recalc_sigpending();
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 	return 0;
+@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
+ 	vsnprintf(current->comm, sizeof(current->comm), name, args);
+ 	va_end(args);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
++	gr_set_kernel_label(current);
++
+ 	/*
+ 	 * If we were started as result of loading a module, close all of the
+ 	 * user space pages.  We don't need them, and if we didn't close them
+@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
+ 	tsk->exit_code = code;
+ 	taskstats_exit(tsk, group_dead);
+ 
++	gr_acl_handle_psacct(tsk, code);
++	gr_acl_handle_exit();
++
+ 	exit_mm(tsk);
+ 
+ 	if (group_dead)
+@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
+ 
+ 	if (unlikely(wo->wo_flags & WNOWAIT)) {
+ 		int exit_code = p->exit_code;
+-		int why, status;
++		int why;
+ 
+ 		get_task_struct(p);
+ 		read_unlock(&tasklist_lock);
+diff -urNp linux-2.6.32.13/kernel/fork.c linux-2.6.32.13/kernel/fork.c
+--- linux-2.6.32.13/kernel/fork.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/fork.c	2010-05-15 13:21:18.103069718 -0400
+@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
+ 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
+ 
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-	tsk->stack_canary = get_random_int();
++	tsk->stack_canary = pax_get_random_long();
+ #endif
+ 
+ 	/* One for us, one for whoever does the "release_task()" (usually parent) */
+@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
+ 	mm->locked_vm = 0;
+ 	mm->mmap = NULL;
+ 	mm->mmap_cache = NULL;
+-	mm->free_area_cache = oldmm->mmap_base;
+-	mm->cached_hole_size = ~0UL;
++	mm->free_area_cache = oldmm->free_area_cache;
++	mm->cached_hole_size = oldmm->cached_hole_size;
+ 	mm->map_count = 0;
+ 	cpumask_clear(mm_cpumask(mm));
+ 	mm->mm_rb = RB_ROOT;
+@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
+ 		tmp->vm_flags &= ~VM_LOCKED;
+ 		tmp->vm_mm = mm;
+ 		tmp->vm_next = NULL;
++		tmp->vm_mirror = NULL;
+ 		anon_vma_link(tmp);
+ 		file = tmp->vm_file;
+ 		if (file) {
+@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
+ 		if (retval)
+ 			goto out;
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
++		struct vm_area_struct *mpnt_m;
++
++		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
++			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
++
++			if (!mpnt->vm_mirror)
++				continue;
++
++			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
++				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
++				mpnt->vm_mirror = mpnt_m;
++			} else {
++				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
++				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
++				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
++				mpnt->vm_mirror->vm_mirror = mpnt;
++			}
++		}
++		BUG_ON(mpnt_m);
++	}
++#endif
++
+ 	/* a new mm has just been created */
+ 	arch_dup_mmap(oldmm, mm);
+ 	retval = 0;
+@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
+ 			write_unlock(&fs->lock);
+ 			return -EAGAIN;
+ 		}
+-		fs->users++;
++		atomic_inc(&fs->users);
+ 		write_unlock(&fs->lock);
+ 		return 0;
+ 	}
+@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
+ 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
+ #endif
+ 	retval = -EAGAIN;
++
++	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
++
+ 	if (atomic_read(&p->real_cred->user->processes) >=
+ 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+-		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
+-		    p->real_cred->user != INIT_USER)
++		if (p->real_cred->user != INIT_USER &&
++		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
+ 			goto bad_fork_free;
+ 	}
+ 
+@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
+ 	p->vfork_done = NULL;
+ 	spin_lock_init(&p->alloc_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	rwlock_init(&p->gr_fs_lock);
++#endif
++
+ 	init_sigpending(&p->pending);
+ 
+ 	p->utime = cputime_zero;
+@@ -1179,6 +1212,8 @@ static struct task_struct *copy_process(
+ 			goto bad_fork_free_pid;
+ 	}
+ 
++	gr_copy_label(p);
++
+ 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+ 	/*
+ 	 * Clear TID on mm_release()?
+@@ -1344,6 +1379,8 @@ bad_fork_cleanup_count:
+ bad_fork_free:
+ 	free_task(p);
+ fork_out:
++	gr_log_forkfail(retval);
++
+ 	return ERR_PTR(retval);
+ }
+ 
+@@ -1437,6 +1474,8 @@ long do_fork(unsigned long clone_flags,
+ 		if (clone_flags & CLONE_PARENT_SETTID)
+ 			put_user(nr, parent_tidptr);
+ 
++		gr_handle_brute_check();
++
+ 		if (clone_flags & CLONE_VFORK) {
+ 			p->vfork_done = &vfork;
+ 			init_completion(&vfork);
+@@ -1569,7 +1608,7 @@ static int unshare_fs(unsigned long unsh
+ 		return 0;
+ 
+ 	/* don't need lock here; in the worst case we'll do useless copy */
+-	if (fs->users == 1)
++	if (atomic_read(&fs->users) == 1)
+ 		return 0;
+ 
+ 	*new_fsp = copy_fs_struct(fs);
+@@ -1689,14 +1728,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
+ 		task_lock(current);
+ 
+ 		if (new_fs) {
++			unsigned long flags;
++
++			gr_fs_write_lock_irqsave(current, flags);
+ 			fs = current->fs;
+ 			write_lock(&fs->lock);
+ 			current->fs = new_fs;
+-			if (--fs->users)
++			if (atomic_dec_return(&fs->users))
+ 				new_fs = NULL;
+ 			else
+ 				new_fs = fs;
+ 			write_unlock(&fs->lock);
++			gr_fs_write_unlock_irqrestore(current, flags);
+ 		}
+ 
+ 		if (new_mm) {
+diff -urNp linux-2.6.32.13/kernel/futex.c linux-2.6.32.13/kernel/futex.c
+--- linux-2.6.32.13/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/futex.c	2010-05-15 13:21:18.106616956 -0400
+@@ -54,6 +54,7 @@
+ #include <linux/mount.h>
+ #include <linux/pagemap.h>
+ #include <linux/syscalls.h>
++#include <linux/ptrace.h>
+ #include <linux/signal.h>
+ #include <linux/module.h>
+ #include <linux/magic.h>
+@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
+ 	struct page *page;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
++		return -EFAULT;
++#endif
++
+ 	/*
+ 	 * The futex address must be "naturally" aligned.
+ 	 */
+@@ -1852,7 +1858,7 @@ retry:
+ 
+ 	restart = &current_thread_info()->restart_block;
+ 	restart->fn = futex_wait_restart;
+-	restart->futex.uaddr = (u32 *)uaddr;
++	restart->futex.uaddr = uaddr;
+ 	restart->futex.val = val;
+ 	restart->futex.time = abs_time->tv64;
+ 	restart->futex.bitset = bitset;
+@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ {
+ 	struct robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *cred = current_cred();
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->robust_list;
+ 		rcu_read_unlock();
+ 	}
+@@ -2467,7 +2481,7 @@ retry:
+  */
+ static inline int fetch_robust_entry(struct robust_list __user **entry,
+ 				     struct robust_list __user * __user *head,
+-				     int *pi)
++				     unsigned int *pi)
+ {
+ 	unsigned long uentry;
+ 
+diff -urNp linux-2.6.32.13/kernel/futex_compat.c linux-2.6.32.13/kernel/futex_compat.c
+--- linux-2.6.32.13/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/futex_compat.c	2010-05-15 13:21:18.106616956 -0400
+@@ -10,6 +10,7 @@
+ #include <linux/compat.h>
+ #include <linux/nsproxy.h>
+ #include <linux/futex.h>
++#include <linux/ptrace.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
+ {
+ 	struct compat_robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++	const struct cred *cred = current_cred();
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->compat_robust_list;
+ 		read_unlock(&tasklist_lock);
+ 	}
+diff -urNp linux-2.6.32.13/kernel/gcov/base.c linux-2.6.32.13/kernel/gcov/base.c
+--- linux-2.6.32.13/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/gcov/base.c	2010-05-15 13:21:18.106616956 -0400
+@@ -102,11 +102,6 @@ void gcov_enable_events(void)
+ }
+ 
+ #ifdef CONFIG_MODULES
+-static inline int within(void *addr, void *start, unsigned long size)
+-{
+-	return ((addr >= start) && (addr < start + size));
+-}
+-
+ /* Update list and generate events when modules are unloaded. */
+ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
+ 				void *data)
+@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
+ 	prev = NULL;
+ 	/* Remove entries located in module from linked list. */
+ 	for (info = gcov_info_head; info; info = info->next) {
+-		if (within(info, mod->module_core, mod->core_size)) {
++		if (within_module_core_rw((unsigned long)info, mod)) {
+ 			if (prev)
+ 				prev->next = info->next;
+ 			else
+diff -urNp linux-2.6.32.13/kernel/hrtimer.c linux-2.6.32.13/kernel/hrtimer.c
+--- linux-2.6.32.13/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
++++ linux-2.6.32.13/kernel/hrtimer.c	2010-05-15 13:21:18.118636223 -0400
+@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
+ 	local_irq_restore(flags);
+ }
+ 
+-static void run_hrtimer_softirq(struct softirq_action *h)
++static void run_hrtimer_softirq(void)
+ {
+ 	hrtimer_peek_ahead_timers();
+ }
+diff -urNp linux-2.6.32.13/kernel/kallsyms.c linux-2.6.32.13/kernel/kallsyms.c
+--- linux-2.6.32.13/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/kallsyms.c	2010-05-15 13:21:18.118636223 -0400
+@@ -11,6 +11,9 @@
+  *      Changed the compression method from stem compression to "table lookup"
+  *      compression (see scripts/kallsyms.c for a more complete description)
+  */
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++#define __INCLUDED_BY_HIDESYM 1
++#endif
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
+ 
+ static inline int is_kernel_inittext(unsigned long addr)
+ {
++	if (system_state != SYSTEM_BOOTING)
++		return 0;
++
+ 	if (addr >= (unsigned long)_sinittext
+ 	    && addr <= (unsigned long)_einittext)
+ 		return 1;
+@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
+ 
+ static inline int is_kernel(unsigned long addr)
+ {
++	if (is_kernel_inittext(addr))
++		return 1;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#ifdef CONFIG_MODULES
++	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
++		return 0;
++#endif
++
++	if (is_kernel_text(addr))
++		return 1;
++
++	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
++		return 1;
++
++	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
++		return 1;
++	return in_gate_area_no_task(addr);
++#endif
++
+ 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+ 		return 1;
+ 	return in_gate_area_no_task(addr);
+@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
+ 
+ static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
+ {
+-	iter->name[0] = '\0';
+ 	iter->nameoff = get_symbol_offset(new_pos);
+ 	iter->pos = new_pos;
+ }
+@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
+ {
+ 	struct kallsym_iter *iter = m->private;
+ 
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	if (current_uid())
++		return 0;
++#endif
++
+ 	/* Some debugging symbols have no name.  Ignore them. */
+ 	if (!iter->name[0])
+ 		return 0;
+@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
+ 	struct kallsym_iter *iter;
+ 	int ret;
+ 
+-	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
++	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 	if (!iter)
+ 		return -ENOMEM;
+ 	reset_iter(iter, 0);
+diff -urNp linux-2.6.32.13/kernel/kgdb.c linux-2.6.32.13/kernel/kgdb.c
+--- linux-2.6.32.13/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/kgdb.c	2010-05-15 13:21:18.118636223 -0400
+@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
+ /* Guard for recursive entry */
+ static int			exception_level;
+ 
+-static struct kgdb_io		*kgdb_io_ops;
++static const struct kgdb_io	*kgdb_io_ops;
+ static DEFINE_SPINLOCK(kgdb_registration_lock);
+ 
+ /* kgdb console driver is loaded */
+@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
+  *
+  *	Register it with the KGDB core.
+  */
+-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
++int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
+ {
+ 	int err;
+ 
+@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
+  *
+  *	Unregister it with the KGDB core.
+  */
+-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
++void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
+ {
+ 	BUG_ON(kgdb_connected);
+ 
+diff -urNp linux-2.6.32.13/kernel/kmod.c linux-2.6.32.13/kernel/kmod.c
+--- linux-2.6.32.13/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/kmod.c	2010-05-15 13:21:18.118636223 -0400
+@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
+ 	if (ret >= MODULE_NAME_LEN)
+ 		return -ENAMETOOLONG;
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	/* we could do a tighter check here, but some distros
++	   are taking it upon themselves to remove CAP_SYS_MODULE
++	   from even root-running apps which cause modules to be 
++	   auto-loaded
++	*/
++	if (current_uid()) {
++		gr_log_nonroot_mod_load(module_name);
++		return -EPERM;
++	}
++#endif
++
+ 	/* If modprobe needs a service that is in a module, we get a recursive
+ 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
+ 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
+diff -urNp linux-2.6.32.13/kernel/kprobes.c linux-2.6.32.13/kernel/kprobes.c
+--- linux-2.6.32.13/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/kprobes.c	2010-05-15 13:21:18.118636223 -0400
+@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
+ 	 * kernel image and loaded module images reside. This is required
+ 	 * so x86_64 can correctly handle the %rip-relative fixups.
+ 	 */
+-	kip->insns = module_alloc(PAGE_SIZE);
++	kip->insns = module_alloc_exec(PAGE_SIZE);
+ 	if (!kip->insns) {
+ 		kfree(kip);
+ 		return NULL;
+@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
+ 		 */
+ 		if (!list_is_singular(&kprobe_insn_pages)) {
+ 			list_del(&kip->list);
+-			module_free(NULL, kip->insns);
++			module_free_exec(NULL, kip->insns);
+ 			kfree(kip);
+ 		}
+ 		return 1;
+@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
+ {
+ 	int i, err = 0;
+ 	unsigned long offset = 0, size = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 	const char *symbol_name;
+ 	void *addr;
+ 	struct kprobe_blackpoint *kb;
+@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
+ 	const char *sym = NULL;
+ 	unsigned int i = *(loff_t *) v;
+ 	unsigned long offset = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 
+ 	head = &kprobe_table[i];
+ 	preempt_disable();
+diff -urNp linux-2.6.32.13/kernel/lockdep.c linux-2.6.32.13/kernel/lockdep.c
+--- linux-2.6.32.13/kernel/lockdep.c	2010-04-29 17:49:38.578001941 -0400
++++ linux-2.6.32.13/kernel/lockdep.c	2010-05-15 13:21:18.122615093 -0400
+@@ -577,6 +577,10 @@ static int static_obj(void *obj)
+ 	int i;
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	start = ktla_ktva(start);
++#endif
++
+ 	/*
+ 	 * static variable?
+ 	 */
+@@ -592,8 +596,7 @@ static int static_obj(void *obj)
+ 	 */
+ 	for_each_possible_cpu(i) {
+ 		start = (unsigned long) per_cpu_ptr(&__per_cpu_start, i);
+-		end   = (unsigned long) per_cpu_ptr(&__per_cpu_start, i)
+-					+ PERCPU_ENOUGH_ROOM;
++		end   = start + PERCPU_ENOUGH_ROOM;
+ 
+ 		if ((addr >= start) && (addr < end))
+ 			return 1;
+@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
+ 	if (!static_obj(lock->key)) {
+ 		debug_locks_off();
+ 		printk("INFO: trying to register non-static key.\n");
++		printk("lock:%pS key:%pS.\n", lock, lock->key);
+ 		printk("the code is fine but needs lockdep annotation.\n");
+ 		printk("turning off the locking correctness validator.\n");
+ 		dump_stack();
+diff -urNp linux-2.6.32.13/kernel/lockdep_proc.c linux-2.6.32.13/kernel/lockdep_proc.c
+--- linux-2.6.32.13/kernel/lockdep_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/lockdep_proc.c	2010-05-15 13:21:18.122615093 -0400
+@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
+ 
+ static void print_name(struct seq_file *m, struct lock_class *class)
+ {
+-	char str[128];
++	char str[KSYM_NAME_LEN];
+ 	const char *name = class->name;
+ 
+ 	if (!name) {
+diff -urNp linux-2.6.32.13/kernel/module.c linux-2.6.32.13/kernel/module.c
+--- linux-2.6.32.13/kernel/module.c	2010-04-29 17:49:38.586002480 -0400
++++ linux-2.6.32.13/kernel/module.c	2010-05-15 13:21:18.134612708 -0400
+@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
+ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
+ 
+ /* Bounds of module allocation, for speeding __module_address */
+-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
++static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
++static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
+ 
+ int register_module_notifier(struct notifier_block * nb)
+ {
+@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
+ 		return true;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list) {
+-		struct symsearch arr[] = {
++		struct symsearch modarr[] = {
+ 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ 			  NOT_GPL_ONLY, false },
+ 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
+@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
+ #endif
+ 		};
+ 
+-		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
++		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
+ 			return true;
+ 	}
+ 	return false;
+@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
+ 	void *ptr;
+ 	int cpu;
+ 
+-	if (align > PAGE_SIZE) {
++	if (align-1 >= PAGE_SIZE) {
+ 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
+ 		       name, align, PAGE_SIZE);
+ 		align = PAGE_SIZE;
+@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
+ 	destroy_params(mod->kp, mod->num_kp);
+ 
+ 	/* This may be NULL, but that's OK */
+-	module_free(mod, mod->module_init);
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
+ 	kfree(mod->args);
+ 	if (mod->percpu)
+ 		percpu_modfree(mod->percpu);
+@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
+ 		percpu_modfree(mod->refptr);
+ #endif
+ 	/* Free lock-classes: */
+-	lockdep_free_key_range(mod->module_core, mod->core_size);
++	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
++	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
+ 
+ 	/* Finally, free the core (containing the module structure) */
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_core_rx);
++	module_free(mod, mod->module_core_rw);
+ 
+ #ifdef CONFIG_MPU
+ 	update_protections(current->mm);
+@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 					      strtab + sym[i].st_name, mod);
+ 			/* Ok if resolved.  */
+ 			if (ksym) {
++				pax_open_kernel();
+ 				sym[i].st_value = ksym->value;
++				pax_close_kernel();
+ 				break;
+ 			}
+ 
+@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 				secbase = (unsigned long)mod->percpu;
+ 			else
+ 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
++			pax_open_kernel();
+ 			sym[i].st_value += secbase;
++			pax_close_kernel();
+ 			break;
+ 		}
+ 	}
+@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->core_text_size = mod->core_size;
+ 	}
+ 
+ 	DEBUGP("Init section allocation order:\n");
+@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || !strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
+-					 | INIT_OFFSET_MASK);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
++			s->sh_entsize |= INIT_OFFSET_MASK;
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->init_text_size = mod->init_size;
+ 	}
+ }
+ 
+@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
+ 
+ /* As per nm */
+ static char elf_type(const Elf_Sym *sym,
+-		     Elf_Shdr *sechdrs,
+-		     const char *secstrings,
+-		     struct module *mod)
++		     const Elf_Shdr *sechdrs,
++		     const char *secstrings)
+ {
+ 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
+@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
+ 
+ 	/* Put symbol section at end of init part of module. */
+ 	symsect->sh_flags |= SHF_ALLOC;
+-	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
++	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
+ 					 symindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
+ 
+@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
+ 		}
+ 
+ 	/* Append room for core symbols at end of core part. */
+-	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
+-	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
++	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
++	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
+ 
+ 	/* Put string table section at end of init part of module. */
+ 	strsect->sh_flags |= SHF_ALLOC;
+-	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
++	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
+ 					 strindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
+ 
+ 	/* Append room for core symbols' strings at end of core part. */
+-	*pstroffs = mod->core_size;
++	*pstroffs = mod->core_size_rx;
+ 	__set_bit(0, strmap);
+-	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
++	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
+ 
+ 	return symoffs;
+ }
+@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
+ 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+ 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
+ 
++	pax_open_kernel();
++
+ 	/* Set types up while we still have access to sections. */
+ 	for (i = 0; i < mod->num_symtab; i++)
+ 		mod->symtab[i].st_info
+-			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
++			= elf_type(&mod->symtab[i], sechdrs, secstrings);
+ 
+-	mod->core_symtab = dst = mod->module_core + symoffs;
++	mod->core_symtab = dst = mod->module_core_rx + symoffs;
+ 	src = mod->symtab;
+ 	*dst = *src;
+ 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
+ 	}
+ 	mod->core_num_syms = ndst;
+ 
+-	mod->core_strtab = s = mod->module_core + stroffs;
++	mod->core_strtab = s = mod->module_core_rx + stroffs;
+ 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
+ 		if (test_bit(i, strmap))
+ 			*++s = mod->strtab[i];
++
++	pax_close_kernel();
+ }
+ #else
+ static inline unsigned long layout_symtab(struct module *mod,
+@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
+ #endif
+ }
+ 
+-static void *module_alloc_update_bounds(unsigned long size)
++static void *module_alloc_update_bounds_rw(unsigned long size)
+ {
+ 	void *ret = module_alloc(size);
+ 
+ 	if (ret) {
+ 		/* Update module bounds. */
+-		if ((unsigned long)ret < module_addr_min)
+-			module_addr_min = (unsigned long)ret;
+-		if ((unsigned long)ret + size > module_addr_max)
+-			module_addr_max = (unsigned long)ret + size;
++		if ((unsigned long)ret < module_addr_min_rw)
++			module_addr_min_rw = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rw)
++			module_addr_max_rw = (unsigned long)ret + size;
++	}
++	return ret;
++}
++
++static void *module_alloc_update_bounds_rx(unsigned long size)
++{
++	void *ret = module_alloc_exec(size);
++
++	if (ret) {
++		/* Update module bounds. */
++		if ((unsigned long)ret < module_addr_min_rx)
++			module_addr_min_rx = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rx)
++			module_addr_max_rx = (unsigned long)ret + size;
+ 	}
+ 	return ret;
+ }
+@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
+ 	unsigned int i;
+ 
+ 	/* only scan the sections containing data */
+-	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
+-			   (unsigned long)mod->module_core,
++	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
++			   (unsigned long)mod->module_core_rw,
+ 			   sizeof(struct module), GFP_KERNEL);
+ 
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
+ 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
+ 			continue;
+ 
+-		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
+-				   (unsigned long)mod->module_core,
++		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
++				   (unsigned long)mod->module_core_rw,
+ 				   sechdrs[i].sh_size, GFP_KERNEL);
+ 	}
+ }
+@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
+ 				secstrings, &stroffs, strmap);
+ 
+ 	/* Do the allocs. */
+-	ptr = module_alloc_update_bounds(mod->core_size);
++	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. Just mark it as not being a
+@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
+ 		err = -ENOMEM;
+ 		goto free_percpu;
+ 	}
+-	memset(ptr, 0, mod->core_size);
+-	mod->module_core = ptr;
++	memset(ptr, 0, mod->core_size_rw);
++	mod->module_core_rw = ptr;
+ 
+-	ptr = module_alloc_update_bounds(mod->init_size);
++	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. This block doesn't need to be
+ 	 * scanned as it contains data and code that will be freed
+ 	 * after the module is initialized.
+ 	 */
+-	kmemleak_ignore(ptr);
+-	if (!ptr && mod->init_size) {
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rw) {
++		err = -ENOMEM;
++		goto free_core_rw;
++	}
++	memset(ptr, 0, mod->init_size_rw);
++	mod->module_init_rw = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr) {
+ 		err = -ENOMEM;
+-		goto free_core;
++		goto free_init_rw;
+ 	}
+-	memset(ptr, 0, mod->init_size);
+-	mod->module_init = ptr;
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->core_size_rx);
++	pax_close_kernel();
++	mod->module_core_rx = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rx) {
++		err = -ENOMEM;
++		goto free_core_rx;
++	}
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->init_size_rx);
++	pax_close_kernel();
++	mod->module_init_rx = ptr;
+ 
+ 	/* Transfer each section which specifies SHF_ALLOC */
+ 	DEBUGP("final section addresses:\n");
+@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
+ 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+ 			continue;
+ 
+-		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
+-			dest = mod->module_init
+-				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+-		else
+-			dest = mod->module_core + sechdrs[i].sh_entsize;
++		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_init_rw
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++			else
++				dest = mod->module_init_rx
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++		} else {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
++			else
++				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
++		}
++
++		if (sechdrs[i].sh_type != SHT_NOBITS) {
++
++#ifdef CONFIG_PAX_KERNEXEC
++			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
++				pax_open_kernel();
++				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++				pax_close_kernel();
++			} else
++#endif
+ 
+-		if (sechdrs[i].sh_type != SHT_NOBITS)
+-			memcpy(dest, (void *)sechdrs[i].sh_addr,
+-			       sechdrs[i].sh_size);
++			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++		}
+ 		/* Update sh_addr to point to copy in image. */
+-		sechdrs[i].sh_addr = (unsigned long)dest;
++
++#ifdef CONFIG_PAX_KERNEXEC
++		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
++			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
++		else
++#endif
++
++			sechdrs[i].sh_addr = (unsigned long)dest;
+ 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
+ 	}
+ 	/* Module has been moved. */
+@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
+ 				      mod->name);
+ 	if (!mod->refptr) {
+ 		err = -ENOMEM;
+-		goto free_init;
++		goto free_init_rx;
+ 	}
+ #endif
+ 	/* Now we've moved module, initialize linked lists, etc. */
+@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
+ 
+ 	/* Now do relocations. */
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+-		const char *strtab = (char *)sechdrs[strindex].sh_addr;
+ 		unsigned int info = sechdrs[i].sh_info;
++		strtab = (char *)sechdrs[strindex].sh_addr;
+ 
+ 		/* Not a valid relocation section? */
+ 		if (info >= hdr->e_shnum)
+@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
+ 	 * Do it before processing of module parameters, so the module
+ 	 * can provide parameter accessor functions of its own.
+ 	 */
+-	if (mod->module_init)
+-		flush_icache_range((unsigned long)mod->module_init,
+-				   (unsigned long)mod->module_init
+-				   + mod->init_size);
+-	flush_icache_range((unsigned long)mod->module_core,
+-			   (unsigned long)mod->module_core + mod->core_size);
++	if (mod->module_init_rx)
++		flush_icache_range((unsigned long)mod->module_init_rx,
++				   (unsigned long)mod->module_init_rx
++				   + mod->init_size_rx);
++	flush_icache_range((unsigned long)mod->module_core_rx,
++			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
+ 
+ 	set_fs(old_fs);
+ 
+@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
+  free_unload:
+ 	module_unload_free(mod);
+ #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
++ free_init_rx:
+ 	percpu_modfree(mod->refptr);
+- free_init:
+ #endif
+-	module_free(mod, mod->module_init);
+- free_core:
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_init_rx);
++ free_core_rx:
++	module_free_exec(mod, mod->module_core_rx);
++ free_init_rw:
++	module_free(mod, mod->module_init_rw);
++ free_core_rw:
++	module_free(mod, mod->module_core_rw);
+ 	/* mod will be freed with core. Don't access it beyond this line! */
+  free_percpu:
+ 	if (percpu)
+@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
+ 	mod->symtab = mod->core_symtab;
+ 	mod->strtab = mod->core_strtab;
+ #endif
+-	module_free(mod, mod->module_init);
+-	mod->module_init = NULL;
+-	mod->init_size = 0;
+-	mod->init_text_size = 0;
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
++	mod->module_init_rw = NULL;
++	mod->module_init_rx = NULL;
++	mod->init_size_rw = 0;
++	mod->init_size_rx = 0;
+ 	mutex_unlock(&module_mutex);
+ 
+ 	return 0;
+@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
+ 	unsigned long nextval;
+ 
+ 	/* At worse, next value is at end of module */
+-	if (within_module_init(addr, mod))
+-		nextval = (unsigned long)mod->module_init+mod->init_text_size;
++	if (within_module_init_rx(addr, mod))
++		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
++	else if (within_module_init_rw(addr, mod))
++		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
++	else if (within_module_core_rx(addr, mod))
++		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
++	else if (within_module_core_rw(addr, mod))
++		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
+ 	else
+-		nextval = (unsigned long)mod->module_core+mod->core_text_size;
++		return NULL;
+ 
+ 	/* Scan for closest preceeding symbol, and next symbol. (ELF
+ 	   starts real symbols at 1). */
+@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
+ 	char buf[8];
+ 
+ 	seq_printf(m, "%s %u",
+-		   mod->name, mod->init_size + mod->core_size);
++		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
+ 	print_unload_info(m, mod);
+ 
+ 	/* Informative for users. */
+@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
+ 		   mod->state == MODULE_STATE_COMING ? "Loading":
+ 		   "Live");
+ 	/* Used by oprofile and other similar tools. */
+-	seq_printf(m, " 0x%p", mod->module_core);
++	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
+ 
+ 	/* Taints info */
+ 	if (mod->taints)
+@@ -2979,7 +3066,17 @@ static const struct file_operations proc
+ 
+ static int __init proc_modules_init(void)
+ {
++#ifndef CONFIG_GRKERNSEC_HIDESYM
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
++#else
+ 	proc_create("modules", 0, NULL, &proc_modules_operations);
++#endif
++#else
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_modules_init);
+@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
+ {
+ 	struct module *mod;
+ 
+-	if (addr < module_addr_min || addr > module_addr_max)
++	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
++	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
+ 		return NULL;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list)
+-		if (within_module_core(addr, mod)
+-		    || within_module_init(addr, mod))
++		if (within_module_init(addr, mod) || within_module_core(addr, mod))
+ 			return mod;
+ 	return NULL;
+ }
+@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
+  */
+ struct module *__module_text_address(unsigned long addr)
+ {
+-	struct module *mod = __module_address(addr);
++	struct module *mod;
++
++#ifdef CONFIG_X86_32
++	addr = ktla_ktva(addr);
++#endif
++
++	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
++		return NULL;
++
++	mod = __module_address(addr);
++
+ 	if (mod) {
+ 		/* Make sure it's within the text section. */
+-		if (!within(addr, mod->module_init, mod->init_text_size)
+-		    && !within(addr, mod->module_core, mod->core_text_size))
++		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
+ 			mod = NULL;
+ 	}
+ 	return mod;
+diff -urNp linux-2.6.32.13/kernel/panic.c linux-2.6.32.13/kernel/panic.c
+--- linux-2.6.32.13/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/panic.c	2010-05-15 13:21:18.146612793 -0400
+@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
+  */
+ void __stack_chk_fail(void)
+ {
+-	panic("stack-protector: Kernel stack is corrupted in: %p\n",
++	dump_stack();
++	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
+ 		__builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+diff -urNp linux-2.6.32.13/kernel/params.c linux-2.6.32.13/kernel/params.c
+--- linux-2.6.32.13/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/params.c	2010-05-15 13:21:18.146612793 -0400
+@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops module_sysfs_ops = {
++static const struct sysfs_ops module_sysfs_ops = {
+ 	.show = module_attr_show,
+ 	.store = module_attr_store,
+ };
+@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops module_uevent_ops = {
++static const struct kset_uevent_ops module_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.13/kernel/pid.c linux-2.6.32.13/kernel/pid.c
+--- linux-2.6.32.13/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/pid.c	2010-05-15 13:21:18.154611186 -0400
+@@ -33,6 +33,7 @@
+ #include <linux/rculist.h>
+ #include <linux/bootmem.h>
+ #include <linux/hash.h>
++#include <linux/security.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/init_task.h>
+ #include <linux/syscalls.h>
+@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
+ 
+ int pid_max = PID_MAX_DEFAULT;
+ 
+-#define RESERVED_PIDS		300
++#define RESERVED_PIDS		500
+ 
+ int pid_max_min = RESERVED_PIDS + 1;
+ int pid_max_max = PID_MAX_LIMIT;
+@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
+  */
+ struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
+ {
+-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++	struct task_struct *task;
++	
++	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++
++	if (gr_pid_is_chrooted(task))
++		return NULL;
++
++	return task;
+ }
+ 
+ struct task_struct *find_task_by_vpid(pid_t vnr)
+diff -urNp linux-2.6.32.13/kernel/posix-cpu-timers.c linux-2.6.32.13/kernel/posix-cpu-timers.c
+--- linux-2.6.32.13/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/posix-cpu-timers.c	2010-05-15 13:21:18.158615271 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/posix-timers.h>
+ #include <linux/errno.h>
+ #include <linux/math64.h>
++#include <linux/security.h>
+ #include <asm/uaccess.h>
+ #include <linux/kernel_stat.h>
+ #include <trace/events/timer.h>
+@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
+ 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
+ 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+diff -urNp linux-2.6.32.13/kernel/power/hibernate.c linux-2.6.32.13/kernel/power/hibernate.c
+--- linux-2.6.32.13/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/power/hibernate.c	2010-05-15 13:21:18.158615271 -0400
+@@ -48,14 +48,14 @@ enum {
+ 
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+ 
+-static struct platform_hibernation_ops *hibernation_ops;
++static const struct platform_hibernation_ops *hibernation_ops;
+ 
+ /**
+  * hibernation_set_ops - set the global hibernate operations
+  * @ops: the hibernation operations to use in subsequent hibernation transitions
+  */
+ 
+-void hibernation_set_ops(struct platform_hibernation_ops *ops)
++void hibernation_set_ops(const struct platform_hibernation_ops *ops)
+ {
+ 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
+ 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
+diff -urNp linux-2.6.32.13/kernel/power/poweroff.c linux-2.6.32.13/kernel/power/poweroff.c
+--- linux-2.6.32.13/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/power/poweroff.c	2010-05-15 13:21:18.158615271 -0400
+@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
+ 	.enable_mask	= SYSRQ_ENABLE_BOOT,
+ };
+ 
+-static int pm_sysrq_init(void)
++static int __init pm_sysrq_init(void)
+ {
+ 	register_sysrq_key('o', &sysrq_poweroff_op);
+ 	return 0;
+diff -urNp linux-2.6.32.13/kernel/power/process.c linux-2.6.32.13/kernel/power/process.c
+--- linux-2.6.32.13/kernel/power/process.c	2010-04-29 17:49:38.590000225 -0400
++++ linux-2.6.32.13/kernel/power/process.c	2010-05-15 13:21:18.158615271 -0400
+@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
+ 	struct timeval start, end;
+ 	u64 elapsed_csecs64;
+ 	unsigned int elapsed_csecs;
++	bool timedout = false;
+ 
+ 	do_gettimeofday(&start);
+ 
+ 	end_time = jiffies + TIMEOUT;
+ 	do {
+ 		todo = 0;
++		if (time_after(jiffies, end_time))
++			timedout = true;
+ 		read_lock(&tasklist_lock);
+ 		do_each_thread(g, p) {
+ 			if (frozen(p) || !freezeable(p))
+@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
+ 			 * It is "frozen enough".  If the task does wake
+ 			 * up, it will immediately call try_to_freeze.
+ 			 */
+-			if (!task_is_stopped_or_traced(p) &&
+-			    !freezer_should_skip(p))
++			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
+ 				todo++;
++				if (timedout) {
++					printk(KERN_ERR "Task refusing to freeze:\n");
++					sched_show_task(p);
++				}
++			}
+ 		} while_each_thread(g, p);
+ 		read_unlock(&tasklist_lock);
+ 		yield();			/* Yield is okay here */
+-		if (time_after(jiffies, end_time))
+-			break;
+-	} while (todo);
++	} while (todo && !timedout);
+ 
+ 	do_gettimeofday(&end);
+ 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
+diff -urNp linux-2.6.32.13/kernel/power/suspend.c linux-2.6.32.13/kernel/power/suspend.c
+--- linux-2.6.32.13/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/power/suspend.c	2010-05-15 13:21:18.158615271 -0400
+@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
+ 	[PM_SUSPEND_MEM]	= "mem",
+ };
+ 
+-static struct platform_suspend_ops *suspend_ops;
++static const struct platform_suspend_ops *suspend_ops;
+ 
+ /**
+  *	suspend_set_ops - Set the global suspend method table.
+  *	@ops:	Pointer to ops structure.
+  */
+-void suspend_set_ops(struct platform_suspend_ops *ops)
++void suspend_set_ops(const struct platform_suspend_ops *ops)
+ {
+ 	mutex_lock(&pm_mutex);
+ 	suspend_ops = ops;
+diff -urNp linux-2.6.32.13/kernel/printk.c linux-2.6.32.13/kernel/printk.c
+--- linux-2.6.32.13/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/printk.c	2010-05-15 13:21:18.158615271 -0400
+@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
+ 	char c;
+ 	int error = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_DMESG
++	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
++		return -EPERM;
++#endif
++
+ 	error = security_syslog(type);
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.13/kernel/ptrace.c linux-2.6.32.13/kernel/ptrace.c
+--- linux-2.6.32.13/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/ptrace.c	2010-05-15 13:21:18.158615271 -0400
+@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
+ 	     cred->gid != tcred->egid ||
+ 	     cred->gid != tcred->sgid ||
+ 	     cred->gid != tcred->gid) &&
+-	    !capable(CAP_SYS_PTRACE)) {
++	    !capable_nolog(CAP_SYS_PTRACE)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
+ 	smp_rmb();
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+-	if (!dumpable && !capable(CAP_SYS_PTRACE))
++	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
+ 		return -EPERM;
+ 
+ 	return security_ptrace_access_check(task, mode);
+@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
+ 		goto unlock_tasklist;
+ 
+ 	task->ptrace = PT_PTRACED;
+-	if (capable(CAP_SYS_PTRACE))
++	if (capable_nolog(CAP_SYS_PTRACE))
+ 		task->ptrace |= PT_PTRACE_CAP;
+ 
+ 	__ptrace_link(task, current);
+@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
+ 		ret = ptrace_setoptions(child, data);
+ 		break;
+ 	case PTRACE_GETEVENTMSG:
+-		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
++		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
+ 		break;
+ 
+ 	case PTRACE_GETSIGINFO:
+ 		ret = ptrace_getsiginfo(child, &siginfo);
+ 		if (!ret)
+-			ret = copy_siginfo_to_user((siginfo_t __user *) data,
++			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
+ 						   &siginfo);
+ 		break;
+ 
+ 	case PTRACE_SETSIGINFO:
+-		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
++		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
+ 				   sizeof siginfo))
+ 			ret = -EFAULT;
+ 		else
+@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
+ 		goto out;
+ 	}
+ 
++	if (gr_handle_ptrace(child, request)) {
++		ret = -EPERM;
++		goto out_put_task_struct;
++	}
++
+ 	if (request == PTRACE_ATTACH) {
+ 		ret = ptrace_attach(child);
+ 		/*
+ 		 * Some architectures need to do book-keeping after
+ 		 * a ptrace attach.
+ 		 */
+-		if (!ret)
++		if (!ret) {
+ 			arch_ptrace_attach(child);
++			gr_audit_ptrace(child);
++		}
+ 		goto out_put_task_struct;
+ 	}
+ 
+@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
+ 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
+ 	if (copied != sizeof(tmp))
+ 		return -EIO;
+-	return put_user(tmp, (unsigned long __user *)data);
++	return put_user(tmp, (__force unsigned long __user *)data);
+ }
+ 
+ int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+diff -urNp linux-2.6.32.13/kernel/rcutree.c linux-2.6.32.13/kernel/rcutree.c
+--- linux-2.6.32.13/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/rcutree.c	2010-05-15 13:21:18.162587722 -0400
+@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
+ /*
+  * Do softirq processing for the current CPU.
+  */
+-static void rcu_process_callbacks(struct softirq_action *unused)
++static void rcu_process_callbacks(void)
+ {
+ 	/*
+ 	 * Memory references from any prior RCU read-side critical sections
+diff -urNp linux-2.6.32.13/kernel/relay.c linux-2.6.32.13/kernel/relay.c
+--- linux-2.6.32.13/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/relay.c	2010-05-15 13:21:18.162587722 -0400
+@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
+ 		return 0;
+ 
+ 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
+-	if (ret < 0 || ret < total_len)
++	if ((int)ret < 0 || ret < total_len)
+ 		return ret;
+ 
+         if (read_start + ret == nonpad_end)
+diff -urNp linux-2.6.32.13/kernel/resource.c linux-2.6.32.13/kernel/resource.c
+--- linux-2.6.32.13/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/resource.c	2010-05-15 13:21:18.162587722 -0400
+@@ -132,8 +132,18 @@ static const struct file_operations proc
+ 
+ static int __init ioresources_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
++#endif
++#else
+ 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
+ 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
++#endif
+ 	return 0;
+ }
+ __initcall(ioresources_init);
+diff -urNp linux-2.6.32.13/kernel/sched.c linux-2.6.32.13/kernel/sched.c
+--- linux-2.6.32.13/kernel/sched.c	2010-04-29 17:49:38.609495328 -0400
++++ linux-2.6.32.13/kernel/sched.c	2010-05-15 13:21:18.180350069 -0400
+@@ -4841,7 +4841,7 @@ out:
+  * In CONFIG_NO_HZ case, the idle load balance owner will do the
+  * rebalancing for all the cpus for whom scheduler ticks are stopped.
+  */
+-static void run_rebalance_domains(struct softirq_action *h)
++static void run_rebalance_domains(void)
+ {
+ 	int this_cpu = smp_processor_id();
+ 	struct rq *this_rq = cpu_rq(this_cpu);
+@@ -6110,6 +6110,8 @@ int can_nice(const struct task_struct *p
+ 	/* convert nice value [19,-20] to rlimit style value [1,40] */
+ 	int nice_rlim = 20 - nice;
+ 
++	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
++
+ 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+ 		capable(CAP_SYS_NICE));
+ }
+@@ -6143,7 +6145,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+ 	if (nice > 19)
+ 		nice = 19;
+ 
+-	if (increment < 0 && !can_nice(current, nice))
++	if (increment < 0 && (!can_nice(current, nice) ||
++			      gr_handle_chroot_nice()))
+ 		return -EPERM;
+ 
+ 	retval = security_task_setnice(current, nice);
+@@ -6293,6 +6296,8 @@ recheck:
+ 		if (rt_policy(policy)) {
+ 			unsigned long rlim_rtprio;
+ 
++			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
++
+ 			if (!lock_task_sighand(p, &flags))
+ 				return -ESRCH;
+ 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
+@@ -7452,7 +7457,7 @@ static struct ctl_table sd_ctl_dir[] = {
+ 		.procname	= "sched_domain",
+ 		.mode		= 0555,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table sd_ctl_root[] = {
+@@ -7462,7 +7467,7 @@ static struct ctl_table sd_ctl_root[] = 
+ 		.mode		= 0555,
+ 		.child		= sd_ctl_dir,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table *sd_alloc_ctl_entry(int n)
+diff -urNp linux-2.6.32.13/kernel/signal.c linux-2.6.32.13/kernel/signal.c
+--- linux-2.6.32.13/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/signal.c	2010-05-15 13:21:18.180350069 -0400
+@@ -41,12 +41,12 @@
+ 
+ static struct kmem_cache *sigqueue_cachep;
+ 
+-static void __user *sig_handler(struct task_struct *t, int sig)
++static __sighandler_t sig_handler(struct task_struct *t, int sig)
+ {
+ 	return t->sighand->action[sig - 1].sa.sa_handler;
+ }
+ 
+-static int sig_handler_ignored(void __user *handler, int sig)
++static int sig_handler_ignored(__sighandler_t handler, int sig)
+ {
+ 	/* Is it explicitly or implicitly ignored? */
+ 	return handler == SIG_IGN ||
+@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
+ static int sig_task_ignored(struct task_struct *t, int sig,
+ 		int from_ancestor_ns)
+ {
+-	void __user *handler;
++	__sighandler_t handler;
+ 
+ 	handler = sig_handler(t, sig);
+ 
+@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
+ 	 */
+ 	user = get_uid(__task_cred(t)->user);
+ 	atomic_inc(&user->sigpending);
++
++	if (!override_rlimit)
++		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
+ 	if (override_rlimit ||
+ 	    atomic_read(&user->sigpending) <=
+ 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
+ 
+ int unhandled_signal(struct task_struct *tsk, int sig)
+ {
+-	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
++	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
+ 	if (is_global_init(tsk))
+ 		return 1;
+ 	if (handler != SIG_IGN && handler != SIG_DFL)
+@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
+ 		}
+ 	}
+ 
++	if (gr_handle_signal(t, sig))
++		return -EPERM;
++
+ 	return security_task_kill(t, info, sig, 0);
+ }
+ 
+@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
+ 	return send_signal(sig, info, p, 1);
+ }
+ 
+-static int
++int
+ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ {
+ 	return send_signal(sig, info, t, 0);
+@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
+ 	ret = specific_send_sig_info(sig, info, t);
+ 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
+ 
++	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
++	gr_handle_crash(t, sig);
++
+ 	return ret;
+ }
+ 
+@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
+ {
+ 	int ret = check_kill_permission(sig, info, p);
+ 
+-	if (!ret && sig)
++	if (!ret && sig) {
+ 		ret = do_send_sig_info(sig, info, p, true);
++		if (!ret)
++			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
++	}
+ 
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.13/kernel/smp.c linux-2.6.32.13/kernel/smp.c
+--- linux-2.6.32.13/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/smp.c	2010-05-15 13:21:18.180350069 -0400
+@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
+ }
+ EXPORT_SYMBOL(smp_call_function);
+ 
+-void ipi_call_lock(void)
++void ipi_call_lock(void) __acquires(call_function.lock)
+ {
+ 	spin_lock(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock(void)
++void ipi_call_unlock(void) __releases(call_function.lock)
+ {
+ 	spin_unlock(&call_function.lock);
+ }
+ 
+-void ipi_call_lock_irq(void)
++void ipi_call_lock_irq(void) __acquires(call_function.lock)
+ {
+ 	spin_lock_irq(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock_irq(void)
++void ipi_call_unlock_irq(void) __releases(call_function.lock)
+ {
+ 	spin_unlock_irq(&call_function.lock);
+ }
+diff -urNp linux-2.6.32.13/kernel/softirq.c linux-2.6.32.13/kernel/softirq.c
+--- linux-2.6.32.13/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/softirq.c	2010-05-15 13:21:18.186622968 -0400
+@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
+ 
+ static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+ 
+-char *softirq_to_name[NR_SOFTIRQS] = {
++const char * const softirq_to_name[NR_SOFTIRQS] = {
+ 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
+ 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
+ };
+@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
+ asmlinkage void __do_softirq(void)
+ {
+-	struct softirq_action *h;
++	const struct softirq_action *h;
+ 	__u32 pending;
+ 	int max_restart = MAX_SOFTIRQ_RESTART;
+ 	int cpu;
+@@ -216,7 +216,7 @@ restart:
+ 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
+ 
+ 			trace_softirq_entry(h, softirq_vec);
+-			h->action(h);
++			h->action();
+ 			trace_softirq_exit(h, softirq_vec);
+ 			if (unlikely(prev_count != preempt_count())) {
+ 				printk(KERN_ERR "huh, entered softirq %td %s %p"
+@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
+ 	local_irq_restore(flags);
+ }
+ 
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void open_softirq(int nr, void (*action)(void))
+ {
+ 	softirq_vec[nr].action = action;
+ }
+@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
+ 
+ EXPORT_SYMBOL(__tasklet_hi_schedule_first);
+ 
+-static void tasklet_action(struct softirq_action *a)
++static void tasklet_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
+ 	}
+ }
+ 
+-static void tasklet_hi_action(struct softirq_action *a)
++static void tasklet_hi_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+diff -urNp linux-2.6.32.13/kernel/sys.c linux-2.6.32.13/kernel/sys.c
+--- linux-2.6.32.13/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/sys.c	2010-05-15 13:21:18.223438230 -0400
+@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
+ 		error = -EACCES;
+ 		goto out;
+ 	}
++
++	if (gr_handle_chroot_setpriority(p, niceval)) {
++		error = -EACCES;
++		goto out;
++	}
++
+ 	no_nice = security_task_setnice(p, niceval);
+ 	if (no_nice) {
+ 		error = no_nice;
+@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who)
+ 					error = set_one_prio(p, niceval, error);
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* For find_user() */
+ 			break;
+@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who) {
+ 					niceval = 20 - task_nice(p);
+ 					if (niceval > retval)
+ 						retval = niceval;
+ 				}
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* for find_user() */
+ 			break;
+@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(new->gid, new->egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1 ||
+ 	    (egid != (gid_t) -1 && egid != old->gid))
+ 		new->sgid = new->egid;
+@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_group_change(gid, gid, gid))
++		goto error;
++
+ 	if (capable(CAP_SETGID))
+ 		new->gid = new->egid = new->sgid = new->fsgid = gid;
+ 	else if (gid == old->gid || gid == old->sgid)
+@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(new->uid, new->euid, -1))
++		goto error;
++
+ 	if (new->uid != old->uid) {
+ 		retval = set_user(new);
+ 		if (retval < 0)
+@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_crash_uid(uid))
++		goto error;
++	if (gr_check_user_change(uid, uid, uid))
++		goto error;
++
+ 	if (capable(CAP_SETUID)) {
+ 		new->suid = new->uid = uid;
+ 		if (uid != old->uid) {
+@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(ruid, euid, -1))
++		goto error;
++
+ 	if (ruid != (uid_t) -1) {
+ 		new->uid = ruid;
+ 		if (ruid != old->uid) {
+@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(rgid, egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1)
+ 		new->gid = rgid;
+ 	if (egid != (gid_t) -1)
+@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+ 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
+ 		goto error;
+ 
++	if (gr_check_user_change(-1, -1, uid))
++		goto error;
++
+ 	if (uid == old->uid  || uid == old->euid  ||
+ 	    uid == old->suid || uid == old->fsuid ||
+ 	    capable(CAP_SETUID)) {
+@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+ 	if (gid == old->gid  || gid == old->egid  ||
+ 	    gid == old->sgid || gid == old->fsgid ||
+ 	    capable(CAP_SETGID)) {
++		if (gr_check_group_change(-1, -1, gid))
++			goto error;
++
+ 		if (gid != old_fsgid) {
+ 			new->fsgid = gid;
+ 			goto change_okay;
+@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
+ 			error = get_dumpable(me->mm);
+ 			break;
+ 		case PR_SET_DUMPABLE:
+-			if (arg2 < 0 || arg2 > 1) {
++			if (arg2 > 1) {
+ 				error = -EINVAL;
+ 				break;
+ 			}
+diff -urNp linux-2.6.32.13/kernel/sysctl.c linux-2.6.32.13/kernel/sysctl.c
+--- linux-2.6.32.13/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/sysctl.c	2010-05-15 13:21:18.258852946 -0400
+@@ -63,6 +63,13 @@
+ static int deprecated_sysctl_warning(struct __sysctl_args *args);
+ 
+ #if defined(CONFIG_SYSCTL)
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
++extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
++				const int op);
++extern int gr_handle_chroot_sysctl(const int op);
+ 
+ /* External variables not in a header file. */
+ extern int C_A_D;
+@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
+ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
++extern ctl_table grsecurity_table[];
+ 
+ static struct ctl_table root_table[];
+ static struct ctl_table_root sysctl_table_root;
+@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
+ int sysctl_legacy_va_layout;
+ #endif
+ 
++#ifdef CONFIG_PAX_SOFTMODE
++static ctl_table pax_table[] = {
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "softmode",
++		.data		= &pax_softmode,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++
++	{ .ctl_name = 0 }
++};
++#endif
++
+ extern int prove_locking;
+ extern int lock_stat;
+ 
+@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
+ #endif
+ 
+ static struct ctl_table kern_table[] = {
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsecurity",
++		.mode		= 0500,
++		.child		= grsecurity_table,
++	},
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "pax",
++		.mode		= 0500,
++		.child		= pax_table,
++	},
++#endif
++
+ 	{
+ 		.ctl_name	= CTL_UNNUMBERED,
+ 		.procname	= "sched_child_runs_first",
+@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
+ 	return 0;
+ }
+ 
++static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
++
+ static int parse_table(int __user *name, int nlen,
+ 		       void __user *oldval, size_t __user *oldlenp,
+ 		       void __user *newval, size_t newlen,
+@@ -1821,7 +1864,7 @@ repeat:
+ 		if (n == table->ctl_name) {
+ 			int error;
+ 			if (table->child) {
+-				if (sysctl_perm(root, table, MAY_EXEC))
++				if (sysctl_perm_nochk(root, table, MAY_EXEC))
+ 					return -EPERM;
+ 				name++;
+ 				nlen--;
+@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
+ 	int error;
+ 	int mode;
+ 
++	if (table->parent != NULL && table->parent->procname != NULL &&
++	   table->procname != NULL &&
++	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
++		return -EACCES;
++	if (gr_handle_chroot_sysctl(op))
++		return -EACCES;
++	error = gr_handle_sysctl(table, op);
++	if (error)
++		return error;
++
++	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
++	if (error)
++		return error;
++
++	if (root->permissions)
++		mode = root->permissions(root, current->nsproxy, table);
++	else
++		mode = table->mode;
++
++	return test_perm(mode, op);
++}
++
++int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
++{
++	int error;
++	int mode;
++
+ 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.13/kernel/taskstats.c linux-2.6.32.13/kernel/taskstats.c
+--- linux-2.6.32.13/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/taskstats.c	2010-05-15 13:21:18.258852946 -0400
+@@ -26,9 +26,12 @@
+ #include <linux/cgroup.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/grsecurity.h>
+ #include <net/genetlink.h>
+ #include <asm/atomic.h>
+ 
++extern int gr_is_taskstats_denied(int pid);
++
+ /*
+  * Maximum length of a cpumask that can be specified in
+  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
+@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
+ 	size_t size;
+ 	cpumask_var_t mask;
+ 
++	if (gr_is_taskstats_denied(current->pid))
++		return -EACCES;
++
+ 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.13/kernel/time/tick-broadcast.c linux-2.6.32.13/kernel/time/tick-broadcast.c
+--- linux-2.6.32.13/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/time/tick-broadcast.c	2010-05-15 13:21:18.258852946 -0400
+@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
+ 		 * then clear the broadcast bit.
+ 		 */
+ 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+-			int cpu = smp_processor_id();
++			cpu = smp_processor_id();
+ 
+ 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
+ 			tick_broadcast_clear_oneshot(cpu);
+diff -urNp linux-2.6.32.13/kernel/time.c linux-2.6.32.13/kernel/time.c
+--- linux-2.6.32.13/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/time.c	2010-05-15 13:21:18.262613670 -0400
+@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
+ 		return err;
+ 
+ 	do_settimeofday(&tv);
++
++	gr_log_timechange();
++
+ 	return 0;
+ }
+ 
+@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
+ 			return -EFAULT;
+ 	}
+ 
++	gr_log_timechange();
++
+ 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
+ }
+ 
+@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
+  * Avoid unnecessary multiplications/divisions in the
+  * two most common HZ cases:
+  */
+-unsigned int inline jiffies_to_msecs(const unsigned long j)
++inline unsigned int jiffies_to_msecs(const unsigned long j)
+ {
+ #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
+ 	return (MSEC_PER_SEC / HZ) * j;
+@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
+ }
+ EXPORT_SYMBOL(jiffies_to_msecs);
+ 
+-unsigned int inline jiffies_to_usecs(const unsigned long j)
++inline unsigned int jiffies_to_usecs(const unsigned long j)
+ {
+ #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
+ 	return (USEC_PER_SEC / HZ) * j;
+diff -urNp linux-2.6.32.13/kernel/timer.c linux-2.6.32.13/kernel/timer.c
+--- linux-2.6.32.13/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/timer.c	2010-05-15 13:21:18.262613670 -0400
+@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
+ /*
+  * This function runs timers and the timer-tq in bottom half context.
+  */
+-static void run_timer_softirq(struct softirq_action *h)
++static void run_timer_softirq(void)
+ {
+ 	struct tvec_base *base = __get_cpu_var(tvec_bases);
+ 
+diff -urNp linux-2.6.32.13/kernel/trace/ftrace.c linux-2.6.32.13/kernel/trace/ftrace.c
+--- linux-2.6.32.13/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
++++ linux-2.6.32.13/kernel/trace/ftrace.c	2010-05-15 13:21:18.274619950 -0400
+@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
+ 
+ 	ip = rec->ip;
+ 
++	ret = ftrace_arch_code_modify_prepare();
++	FTRACE_WARN_ON(ret);
++	if (ret)
++		return 0;
++
+ 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
++	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
+ 	if (ret) {
+ 		ftrace_bug(ret, ip);
+ 		rec->flags |= FTRACE_FL_FAILED;
+-		return 0;
+ 	}
+-	return 1;
++	return ret ? 0 : 1;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.13/kernel/trace/Kconfig linux-2.6.32.13/kernel/trace/Kconfig
+--- linux-2.6.32.13/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/trace/Kconfig	2010-05-15 13:21:18.278715003 -0400
+@@ -126,6 +126,7 @@ if FTRACE
+ config FUNCTION_TRACER
+ 	bool "Kernel Function Tracer"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FRAME_POINTER
+ 	select KALLSYMS
+ 	select GENERIC_TRACER
+@@ -343,6 +344,7 @@ config POWER_TRACER
+ config STACK_TRACER
+ 	bool "Trace max stack"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FUNCTION_TRACER
+ 	select STACKTRACE
+ 	select KALLSYMS
+diff -urNp linux-2.6.32.13/kernel/trace/ring_buffer.c linux-2.6.32.13/kernel/trace/ring_buffer.c
+--- linux-2.6.32.13/kernel/trace/ring_buffer.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.13/kernel/trace/ring_buffer.c	2010-05-15 13:21:18.278715003 -0400
+@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
+  * the reader page). But if the next page is a header page,
+  * its flags will be non zero.
+  */
+-static int inline
++static inline int
+ rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
+ 		struct buffer_page *page, struct list_head *list)
+ {
+diff -urNp linux-2.6.32.13/kernel/trace/trace.c linux-2.6.32.13/kernel/trace/trace.c
+--- linux-2.6.32.13/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.13/kernel/trace/trace.c	2010-05-15 13:21:18.278715003 -0400
+@@ -3808,10 +3808,9 @@ static const struct file_operations trac
+ };
+ #endif
+ 
+-static struct dentry *d_tracer;
+-
+ struct dentry *tracing_init_dentry(void)
+ {
++	static struct dentry *d_tracer;
+ 	static int once;
+ 
+ 	if (d_tracer)
+@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
+ 	return d_tracer;
+ }
+ 
+-static struct dentry *d_percpu;
+-
+ struct dentry *tracing_dentry_percpu(void)
+ {
++	static struct dentry *d_percpu;
+ 	static int once;
+ 	struct dentry *d_tracer;
+ 
+diff -urNp linux-2.6.32.13/kernel/trace/trace_events.c linux-2.6.32.13/kernel/trace/trace_events.c
+--- linux-2.6.32.13/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/trace/trace_events.c	2010-05-15 13:21:18.282652483 -0400
+@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
+  * Modules must own their file_operations to keep up with
+  * reference counting.
+  */
++
++/* cannot be const */
+ struct ftrace_module_file_ops {
+ 	struct list_head		list;
+ 	struct module			*mod;
+diff -urNp linux-2.6.32.13/kernel/trace/trace_output.c linux-2.6.32.13/kernel/trace/trace_output.c
+--- linux-2.6.32.13/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/trace/trace_output.c	2010-05-15 13:21:18.282652483 -0400
+@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
+ 		return 0;
+ 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
+ 	if (!IS_ERR(p)) {
+-		p = mangle_path(s->buffer + s->len, p, "\n");
++		p = mangle_path(s->buffer + s->len, p, "\n\\");
+ 		if (p) {
+ 			s->len = p - s->buffer;
+ 			return 1;
+diff -urNp linux-2.6.32.13/kernel/trace/trace_stack.c linux-2.6.32.13/kernel/trace/trace_stack.c
+--- linux-2.6.32.13/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/trace/trace_stack.c	2010-05-15 13:21:18.282652483 -0400
+@@ -50,7 +50,7 @@ static inline void check_stack(void)
+ 		return;
+ 
+ 	/* we do not handle interrupt stacks yet */
+-	if (!object_is_on_stack(&this_size))
++	if (!object_starts_on_stack(&this_size))
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.13/kernel/utsname_sysctl.c linux-2.6.32.13/kernel/utsname_sysctl.c
+--- linux-2.6.32.13/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/kernel/utsname_sysctl.c	2010-05-15 13:21:18.282652483 -0400
+@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
+ 		.proc_handler	= proc_do_uts_string,
+ 		.strategy	= sysctl_uts_string,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table uts_root_table[] = {
+@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
+ 		.mode		= 0555,
+ 		.child		= uts_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init utsname_sysctl_init(void)
+diff -urNp linux-2.6.32.13/lib/bug.c linux-2.6.32.13/lib/bug.c
+--- linux-2.6.32.13/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/bug.c	2010-05-15 13:21:18.282652483 -0400
+@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
+ 		return BUG_TRAP_TYPE_NONE;
+ 
+ 	bug = find_bug(bugaddr);
++	if (!bug)
++		return BUG_TRAP_TYPE_NONE;
+ 
+ 	printk(KERN_EMERG "------------[ cut here ]------------\n");
+ 
+diff -urNp linux-2.6.32.13/lib/debugobjects.c linux-2.6.32.13/lib/debugobjects.c
+--- linux-2.6.32.13/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/debugobjects.c	2010-05-15 13:21:18.298622839 -0400
+@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
+ 	if (limit > 4)
+ 		return;
+ 
+-	is_on_stack = object_is_on_stack(addr);
++	is_on_stack = object_starts_on_stack(addr);
+ 	if (is_on_stack == onstack)
+ 		return;
+ 
+diff -urNp linux-2.6.32.13/lib/dma-debug.c linux-2.6.32.13/lib/dma-debug.c
+--- linux-2.6.32.13/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/dma-debug.c	2010-05-15 13:21:18.322629085 -0400
+@@ -861,7 +861,7 @@ out:
+ 
+ static void check_for_stack(struct device *dev, void *addr)
+ {
+-	if (object_is_on_stack(addr))
++	if (object_starts_on_stack(addr))
+ 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
+ 				"stack [addr=%p]\n", addr);
+ }
+diff -urNp linux-2.6.32.13/lib/idr.c linux-2.6.32.13/lib/idr.c
+--- linux-2.6.32.13/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/idr.c	2010-05-15 13:21:18.327545957 -0400
+@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
+ 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
+ 
+ 			/* if already at the top layer, we need to grow */
+-			if (id >= 1 << (idp->layers * IDR_BITS)) {
++			if (id >= (1 << (idp->layers * IDR_BITS))) {
+ 				*starting_id = id;
+ 				return IDR_NEED_TO_GROW;
+ 			}
+diff -urNp linux-2.6.32.13/lib/inflate.c linux-2.6.32.13/lib/inflate.c
+--- linux-2.6.32.13/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/inflate.c	2010-05-15 13:21:18.327545957 -0400
+@@ -266,7 +266,7 @@ static void free(void *where)
+ 		malloc_ptr = free_mem_ptr;
+ }
+ #else
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ #endif
+ 
+diff -urNp linux-2.6.32.13/lib/Kconfig.debug linux-2.6.32.13/lib/Kconfig.debug
+--- linux-2.6.32.13/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/Kconfig.debug	2010-05-15 13:21:18.339667096 -0400
+@@ -905,7 +905,7 @@ config LATENCYTOP
+ 	select STACKTRACE
+ 	select SCHEDSTATS
+ 	select SCHED_DEBUG
+-	depends on HAVE_LATENCYTOP_SUPPORT
++	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
+ 	help
+ 	  Enable this option if you want to use the LatencyTOP tool
+ 	  to find out which userspace is blocking on what kernel operations.
+diff -urNp linux-2.6.32.13/lib/kobject.c linux-2.6.32.13/lib/kobject.c
+--- linux-2.6.32.13/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/kobject.c	2010-05-15 13:21:18.355221413 -0400
+@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
+ 	return ret;
+ }
+ 
+-struct sysfs_ops kobj_sysfs_ops = {
++const struct sysfs_ops kobj_sysfs_ops = {
+ 	.show	= kobj_attr_show,
+ 	.store	= kobj_attr_store,
+ };
+@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ static struct kset *kset_create(const char *name,
+-				struct kset_uevent_ops *uevent_ops,
++				const struct kset_uevent_ops *uevent_ops,
+ 				struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ struct kset *kset_create_and_add(const char *name,
+-				 struct kset_uevent_ops *uevent_ops,
++				 const struct kset_uevent_ops *uevent_ops,
+ 				 struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+diff -urNp linux-2.6.32.13/lib/kobject_uevent.c linux-2.6.32.13/lib/kobject_uevent.c
+--- linux-2.6.32.13/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/kobject_uevent.c	2010-05-15 13:21:18.355221413 -0400
+@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
+ 	const char *subsystem;
+ 	struct kobject *top_kobj;
+ 	struct kset *kset;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ 	u64 seq;
+ 	int i = 0;
+ 	int retval = 0;
+diff -urNp linux-2.6.32.13/lib/parser.c linux-2.6.32.13/lib/parser.c
+--- linux-2.6.32.13/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/parser.c	2010-05-15 13:21:18.358625413 -0400
+@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
+ 	char *buf;
+ 	int ret;
+ 
+-	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
++	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
+ 	if (!buf)
+ 		return -ENOMEM;
+ 	memcpy(buf, s->from, s->to - s->from);
+diff -urNp linux-2.6.32.13/lib/radix-tree.c linux-2.6.32.13/lib/radix-tree.c
+--- linux-2.6.32.13/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/radix-tree.c	2010-05-15 13:21:18.366643034 -0400
+@@ -81,7 +81,7 @@ struct radix_tree_preload {
+ 	int nr;
+ 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
+ };
+-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
++static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
+ 
+ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
+ {
+diff -urNp linux-2.6.32.13/lib/random32.c linux-2.6.32.13/lib/random32.c
+--- linux-2.6.32.13/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/lib/random32.c	2010-05-15 13:21:18.370623064 -0400
+@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
+  */
+ static inline u32 __seed(u32 x, u32 m)
+ {
+-	return (x < m) ? x + m : x;
++	return (x <= m) ? x + m + 1 : x;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.13/localversion-grsec linux-2.6.32.13/localversion-grsec
+--- linux-2.6.32.13/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.13/localversion-grsec	2010-05-15 13:21:18.370623064 -0400
+@@ -0,0 +1 @@
++-grsec
+diff -urNp linux-2.6.32.13/Makefile linux-2.6.32.13/Makefile
+--- linux-2.6.32.13/Makefile	2010-05-15 13:20:18.396226636 -0400
++++ linux-2.6.32.13/Makefile	2010-05-15 13:21:18.370623064 -0400
+@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
+ 
+ HOSTCC       = gcc
+ HOSTCXX      = g++
+-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
+-HOSTCXXFLAGS = -O2
++HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
++HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
+ 
+ # Decide whether to build built-in, modular, or both.
+ # Normally, just do built-in.
+@@ -644,7 +644,7 @@ export mod_strip_cmd
+ 
+ 
+ ifeq ($(KBUILD_EXTMOD),)
+-core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ 
+ vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
+ 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
+diff -urNp linux-2.6.32.13/mm/filemap.c linux-2.6.32.13/mm/filemap.c
+--- linux-2.6.32.13/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/filemap.c	2010-05-15 13:21:18.370623064 -0400
+@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
+ 	struct address_space *mapping = file->f_mapping;
+ 
+ 	if (!mapping->a_ops->readpage)
+-		return -ENOEXEC;
++		return -ENODEV;
+ 	file_accessed(file);
+ 	vma->vm_ops = &generic_file_vm_ops;
+ 	vma->vm_flags |= VM_CAN_NONLINEAR;
+@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
+                         *pos = i_size_read(inode);
+ 
+ 		if (limit != RLIM_INFINITY) {
++			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
+ 			if (*pos >= limit) {
+ 				send_sig(SIGXFSZ, current, 0);
+ 				return -EFBIG;
+diff -urNp linux-2.6.32.13/mm/fremap.c linux-2.6.32.13/mm/fremap.c
+--- linux-2.6.32.13/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/fremap.c	2010-05-15 13:21:18.370623064 -0400
+@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
+  retry:
+ 	vma = find_vma(mm, start);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
++		goto out;
++#endif
++
+ 	/*
+ 	 * Make sure the vma is shared, that it supports prefaulting,
+ 	 * and that the remapped range is valid and fully within
+diff -urNp linux-2.6.32.13/mm/highmem.c linux-2.6.32.13/mm/highmem.c
+--- linux-2.6.32.13/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/highmem.c	2010-05-15 13:21:18.370623064 -0400
+@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
+ 		 * So no dangers, even with speculative execution.
+ 		 */
+ 		page = pte_page(pkmap_page_table[i]);
++		pax_open_kernel();
+ 		pte_clear(&init_mm, (unsigned long)page_address(page),
+ 			  &pkmap_page_table[i]);
+-
++		pax_close_kernel();
+ 		set_page_address(page, NULL);
+ 		need_flush = 1;
+ 	}
+@@ -177,9 +178,11 @@ start:
+ 		}
+ 	}
+ 	vaddr = PKMAP_ADDR(last_pkmap_nr);
++
++	pax_open_kernel();
+ 	set_pte_at(&init_mm, vaddr,
+ 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
+-
++	pax_close_kernel();
+ 	pkmap_count[last_pkmap_nr] = 1;
+ 	set_page_address(page, (void *)vaddr);
+ 
+diff -urNp linux-2.6.32.13/mm/hugetlb.c linux-2.6.32.13/mm/hugetlb.c
+--- linux-2.6.32.13/mm/hugetlb.c	2010-05-15 13:20:19.411414284 -0400
++++ linux-2.6.32.13/mm/hugetlb.c	2010-05-15 13:21:18.370623064 -0400
+@@ -1925,6 +1925,26 @@ static int unmap_ref_private(struct mm_s
+ 	return 1;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	struct vm_area_struct *vma_m;
++	unsigned long address_m;
++	pte_t *ptep_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
++	get_page(page_m);
++	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
++}
++#endif
++
+ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			unsigned long address, pte_t *ptep, pte_t pte,
+ 			struct page *pagecache_page)
+@@ -1996,6 +2016,11 @@ retry_avoidcopy:
+ 		huge_ptep_clear_flush(vma, address, ptep);
+ 		set_huge_pte_at(mm, address, ptep,
+ 				make_huge_pte(vma, new_page, 1));
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_huge_pte(vma, address, new_page);
++#endif
++
+ 		/* Make the old page be freed below */
+ 		new_page = old_page;
+ 	}
+@@ -2127,6 +2152,10 @@ retry:
+ 				&& (vma->vm_flags & VM_SHARED)));
+ 	set_huge_pte_at(mm, address, ptep, new_pte);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_huge_pte(vma, address, page);
++#endif
++
+ 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
+ 		/* Optimization, do the COW without a second fault */
+ 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
+@@ -2155,6 +2184,28 @@ int hugetlb_fault(struct mm_struct *mm, 
+ 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
+ 	struct hstate *h = hstate_vma(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++			h = hstate_vma(vma);
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
++			return VM_FAULT_OOM;
++		address_m &= HPAGE_MASK;
++		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
++	}
++#endif
++
+ 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+ 	if (!ptep)
+ 		return VM_FAULT_OOM;
+diff -urNp linux-2.6.32.13/mm/Kconfig linux-2.6.32.13/mm/Kconfig
+--- linux-2.6.32.13/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/Kconfig	2010-05-15 13:21:18.370623064 -0400
+@@ -228,7 +228,7 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+         int "Low address space to protect from user allocation"
+ 	depends on MMU
+-        default 4096
++        default 65536
+         help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.13/mm/maccess.c linux-2.6.32.13/mm/maccess.c
+--- linux-2.6.32.13/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/maccess.c	2010-05-15 13:21:18.370623064 -0400
+@@ -14,7 +14,7 @@
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long probe_kernel_read(void *dst, void *src, size_t size)
++long probe_kernel_read(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
++long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+diff -urNp linux-2.6.32.13/mm/madvise.c linux-2.6.32.13/mm/madvise.c
+--- linux-2.6.32.13/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/madvise.c	2010-05-15 13:21:18.378626814 -0400
+@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
+ 	pgoff_t pgoff;
+ 	unsigned long new_flags = vma->vm_flags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	switch (behavior) {
+ 	case MADV_NORMAL:
+ 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
+@@ -103,6 +107,13 @@ success:
+ 	/*
+ 	 * vm_flags is protected by the mmap_sem held in write mode.
+ 	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m)
++		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
++#endif
++
+ 	vma->vm_flags = new_flags;
+ 
+ out:
+@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
+ 			     struct vm_area_struct ** prev,
+ 			     unsigned long start, unsigned long end)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	*prev = vma;
+ 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
+ 		return -EINVAL;
+@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
+ 		zap_page_range(vma, start, end - start, &details);
+ 	} else
+ 		zap_page_range(vma, start, end - start, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
++			struct zap_details details = {
++				.nonlinear_vma = vma_m,
++				.last_index = ULONG_MAX,
++			};
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++		} else
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
+ 	if (end < start)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			goto out;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		goto out;
++
+ 	error = 0;
+ 	if (end == start)
+ 		goto out;
+diff -urNp linux-2.6.32.13/mm/memory.c linux-2.6.32.13/mm/memory.c
+--- linux-2.6.32.13/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/memory.c	2010-05-15 13:21:18.394625565 -0400
+@@ -48,6 +48,7 @@
+ #include <linux/ksm.h>
+ #include <linux/rmap.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/delayacct.h>
+ #include <linux/init.h>
+ #include <linux/writeback.h>
+@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
+ 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
+ 	i = 0;
+ 
+-	do {
++	while (nr_pages) {
+ 		struct vm_area_struct *vma;
+ 
+-		vma = find_extend_vma(mm, start);
++		vma = find_vma(mm, start);
+ 		if (!vma && in_gate_area(tsk, start)) {
+ 			unsigned long pg = start & PAGE_MASK;
+ 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
+ 			continue;
+ 		}
+ 
+-		if (!vma ||
++		if (!vma || start < vma->vm_start ||
+ 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
+ 		    !(vm_flags & vma->vm_flags))
+ 			return i ? : -EFAULT;
+@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
+ 			start += PAGE_SIZE;
+ 			nr_pages--;
+ 		} while (nr_pages && start < vma->vm_end);
+-	} while (nr_pages);
++	}
+ 	return i;
+ }
+ 
+@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
+ 		copy_user_highpage(dst, src, va, vma);
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	spinlock_t *ptl;
++	pte_t *pte, entry;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	entry = *pte;
++	if (!pte_present(entry)) {
++		if (!pte_none(entry)) {
++			BUG_ON(pte_file(entry));
++			free_swap_and_cache(pte_to_swp_entry(entry));
++			pte_clear_not_present_full(mm, address, pte, 0);
++		}
++	} else {
++		struct page *page;
++
++		flush_cache_page(vma, address, pte_pfn(entry));
++		entry = ptep_clear_flush(vma, address, pte);
++		BUG_ON(pte_dirty(entry));
++		page = vm_normal_page(vma, address, entry);
++		if (page) {
++			update_hiwater_rss(mm);
++			if (PageAnon(page))
++				dec_mm_counter(mm, anon_rss);
++			else
++				dec_mm_counter(mm, file_rss);
++			page_remove_rmap(page);
++			page_cache_release(page);
++		}
++	}
++	pte_unmap_unlock(pte, ptl);
++}
++
++/* PaX: if vma is mirrored, synchronize the mirror's PTE
++ *
++ * the ptl of the lower mapped page is held on entry and is not released on exit
++ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
++ */
++static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || !PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(!PageLocked(page_m));
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_anon_rmap(page_m, vma_m, address_m);
++	inc_mm_counter(mm, anon_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++	unlock_page(page_m);
++}
++
++void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_file_rmap(page_m);
++	inc_mm_counter(mm, file_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
++{
++	struct page *page_m;
++	pte_t entry;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
++		goto out;
++
++	entry = *pte;
++	page_m  = vm_normal_page(vma, address, entry);
++	if (!page_m)
++		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
++	else if (PageAnon(page_m)) {
++		if (pax_find_mirror_vma(vma)) {
++			pte_unmap_unlock(pte, ptl);
++			lock_page(page_m);
++			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
++			if (pte_same(entry, *pte))
++				pax_mirror_anon_pte(vma, address, page_m, ptl);
++			else
++				unlock_page(page_m);
++		}
++	} else
++		pax_mirror_file_pte(vma, address, page_m, ptl);
++
++out:
++	pte_unmap_unlock(pte, ptl);
++}
++#endif
++
+ /*
+  * This routine handles present pages, when users try to write
+  * to a shared page. It is done by copying the page to a new address
+@@ -2146,6 +2327,12 @@ gotten:
+ 	 */
+ 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(new_page));
++#endif
++
+ 		if (old_page) {
+ 			if (!PageAnon(old_page)) {
+ 				dec_mm_counter(mm, file_rss);
+@@ -2197,6 +2384,10 @@ gotten:
+ 			page_remove_rmap(old_page);
+ 		}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_anon_pte(vma, address, new_page, ptl);
++#endif
++
+ 		/* Free the old page.. */
+ 		new_page = old_page;
+ 		ret |= VM_FAULT_WRITE;
+@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
+ 	swap_free(entry);
+ 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
+ 		try_to_free_swap(page);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
++#endif
++
+ 	unlock_page(page);
+ 
+ 	if (flags & FAULT_FLAG_WRITE) {
+@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, pte);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ out:
+@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
+ 		unsigned long address, pte_t *page_table, pmd_t *pmd,
+ 		unsigned int flags)
+ {
+-	struct page *page;
++	struct page *page = NULL;
+ 	spinlock_t *ptl;
+ 	pte_t entry;
+ 
+@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
+ 	if (!pte_none(*page_table))
+ 		goto release;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		BUG_ON(!trylock_page(page));
++#endif
++
+ 	inc_mm_counter(mm, anon_rss);
+ 	page_add_new_anon_rmap(page, vma, address);
+ setpte:
+@@ -2670,6 +2876,12 @@ setpte:
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (page)
++		pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ 	return 0;
+@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
+ 	 */
+ 	/* Only go through if we didn't race with anybody else... */
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon && pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(page));
++#endif
++
+ 		flush_icache_page(vma, page);
+ 		entry = mk_pte(page, vma->vm_page_prot);
+ 		if (flags & FAULT_FLAG_WRITE)
+@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
+ 
+ 		/* no need to invalidate: a not-present page won't be cached */
+ 		update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon)
++			pax_mirror_anon_pte(vma, address, page, ptl);
++		else
++			pax_mirror_file_pte(vma, address, page, ptl);
++#endif
++
+ 	} else {
+ 		if (charged)
+ 			mem_cgroup_uncharge_page(page);
+@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
+ 		if (flags & FAULT_FLAG_WRITE)
+ 			flush_tlb_page(vma, address);
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_pte(vma, address, pte, pmd, ptl);
++	return 0;
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(pte, ptl);
+ 	return 0;
+@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	__set_current_state(TASK_RUNNING);
+ 
+ 	count_vm_event(PGFAULT);
+@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
+ 	if (unlikely(is_vm_hugetlb_page(vma)))
+ 		return hugetlb_fault(mm, vma, address, flags);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++		pgd_t *pgd_m;
++		pud_t *pud_m;
++		pmd_t *pmd_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		pgd_m = pgd_offset(mm, address_m);
++		pud_m = pud_alloc(mm, pgd_m, address_m);
++		if (!pud_m)
++			return VM_FAULT_OOM;
++		pmd_m = pmd_alloc(mm, pud_m, address_m);
++		if (!pmd_m)
++			return VM_FAULT_OOM;
++		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
++			return VM_FAULT_OOM;
++		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
++	}
++#endif
++
+ 	pgd = pgd_offset(mm, address);
+ 	pud = pud_alloc(mm, pgd, address);
+ 	if (!pud)
+@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+diff -urNp linux-2.6.32.13/mm/memory-failure.c linux-2.6.32.13/mm/memory-failure.c
+--- linux-2.6.32.13/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/memory-failure.c	2010-05-15 13:21:18.394625565 -0400
+@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
+ 
+ int sysctl_memory_failure_recovery __read_mostly = 1;
+ 
+-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
++atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
+ 
+ /*
+  * Send all the processes who have the page mapped an ``action optional''
+@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
+ 		return 0;
+ 	}
+ 
+-	atomic_long_add(1, &mce_bad_pages);
++	atomic_long_add_unchecked(1, &mce_bad_pages);
+ 
+ 	/*
+ 	 * We need/can do nothing about count=0 pages.
+diff -urNp linux-2.6.32.13/mm/mempolicy.c linux-2.6.32.13/mm/mempolicy.c
+--- linux-2.6.32.13/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.13/mm/mempolicy.c	2010-05-15 13:21:18.411130134 -0400
+@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
+ 	struct vm_area_struct *next;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	err = 0;
+ 	for (; vma && vma->vm_start < end; vma = next) {
+ 		next = vma->vm_next;
+@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
+ 			err = policy_vma(vma, new);
+ 		if (err)
+ 			break;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		vma_m = pax_find_mirror_vma(vma);
++		if (vma_m) {
++			err = policy_vma(vma_m, new);
++			if (err)
++				break;
++		}
++#endif
++
+ 	}
+ 	return err;
+ }
+@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
+ 
+ 	if (end < start)
+ 		return -EINVAL;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (end == start)
+ 		return 0;
+ 
+@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
+ 
+ 	if (file) {
+ 		seq_printf(m, " file=");
+-		seq_path(m, &file->f_path, "\n\t= ");
++		seq_path(m, &file->f_path, "\n\t\\= ");
+ 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 		seq_printf(m, " heap");
+ 	} else if (vma->vm_start <= mm->start_stack &&
+diff -urNp linux-2.6.32.13/mm/migrate.c linux-2.6.32.13/mm/migrate.c
+--- linux-2.6.32.13/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/migrate.c	2010-05-15 13:21:18.411130134 -0400
+@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+diff -urNp linux-2.6.32.13/mm/mlock.c linux-2.6.32.13/mm/mlock.c
+--- linux-2.6.32.13/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/mlock.c	2010-05-15 13:21:18.411130134 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/pagemap.h>
+ #include <linux/mempolicy.h>
+ #include <linux/syscalls.h>
++#include <linux/security.h>
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ #include <linux/rmap.h>
+@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
+ 		return -EINVAL;
+ 	if (end == start)
+ 		return 0;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	vma = find_vma_prev(current->mm, start, &prev);
+ 	if (!vma || vma->vm_start > start)
+ 		return -ENOMEM;
+@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	/* check against resource limits */
++	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
+ 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
+ 		error = do_mlock(start, len, 1);
+ 	up_write(&current->mm->mmap_sem);
+@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
+ static int do_mlockall(int flags)
+ {
+ 	struct vm_area_struct * vma, * prev = NULL;
+-	unsigned int def_flags = 0;
++	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
+ 
+ 	if (flags & MCL_FUTURE)
+-		def_flags = VM_LOCKED;
++		def_flags |= VM_LOCKED;
+ 	current->mm->def_flags = def_flags;
+ 	if (flags == MCL_FUTURE)
+ 		goto out;
+@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
+ 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
+ 		unsigned int newflags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
++			break;
++#endif
++
++		BUG_ON(vma->vm_end > TASK_SIZE);
+ 		newflags = vma->vm_flags | VM_LOCKED;
+ 		if (!(flags & MCL_CURRENT))
+ 			newflags &= ~VM_LOCKED;
+@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	ret = -ENOMEM;
++	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
+ 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
+ 	    capable(CAP_IPC_LOCK))
+ 		ret = do_mlockall(flags);
+diff -urNp linux-2.6.32.13/mm/mmap.c linux-2.6.32.13/mm/mmap.c
+--- linux-2.6.32.13/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/mmap.c	2010-05-15 13:21:18.411130134 -0400
+@@ -45,6 +45,16 @@
+ #define arch_rebalance_pgtables(addr, len)		(addr)
+ #endif
+ 
++static inline void verify_mm_writelocked(struct mm_struct *mm)
++{
++#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
++	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++		up_read(&mm->mmap_sem);
++		BUG();
++	}
++#endif
++}
++
+ static void unmap_region(struct mm_struct *mm,
+ 		struct vm_area_struct *vma, struct vm_area_struct *prev,
+ 		unsigned long start, unsigned long end);
+@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
+  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
+  *
+  */
+-pgprot_t protection_map[16] = {
++pgprot_t protection_map[16] __read_only = {
+ 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+ 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
+ };
+ 
+ pgprot_t vm_get_page_prot(unsigned long vm_flags)
+ {
+-	return __pgprot(pgprot_val(protection_map[vm_flags &
++	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
+ 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
+ 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if (!nx_enabled &&
++	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
++	    (vm_flags & (VM_READ | VM_WRITE)))
++		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
++#endif
++
++	return prot;
+ }
+ EXPORT_SYMBOL(vm_get_page_prot);
+ 
+@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
+ 	struct vm_area_struct *next = vma->vm_next;
+ 
+ 	might_sleep();
++	BUG_ON(vma->vm_mirror);
+ 	if (vma->vm_ops && vma->vm_ops->close)
+ 		vma->vm_ops->close(vma);
+ 	if (vma->vm_file) {
+@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+ 	 * not page aligned -Ram Gupta
+ 	 */
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
++	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
+ 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
+ 			(mm->end_data - mm->start_data) > rlim)
+ 		goto out;
+@@ -694,6 +715,12 @@ static int
+ can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		if (vma->vm_pgoff == vm_pgoff)
+@@ -713,6 +740,12 @@ static int
+ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		pgoff_t vm_pglen;
+@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
+ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 			struct vm_area_struct *prev, unsigned long addr,
+ 			unsigned long end, unsigned long vm_flags,
+-		     	struct anon_vma *anon_vma, struct file *file,
++			struct anon_vma *anon_vma, struct file *file,
+ 			pgoff_t pgoff, struct mempolicy *policy)
+ {
+ 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
+ 	struct vm_area_struct *area, *next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
++	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
++
++	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
++#endif
++
+ 	/*
+ 	 * We later require that vma->vm_flags == vm_flags,
+ 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
+@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
+ 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
+ 		next = next->vm_next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (prev)
++		prev_m = pax_find_mirror_vma(prev);
++	if (area)
++		area_m = pax_find_mirror_vma(area);
++	if (next)
++		next_m = pax_find_mirror_vma(next);
++#endif
++
+ 	/*
+ 	 * Can it merge with the predecessor?
+ 	 */
+@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
+ 							/* cases 1, 6 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				next->vm_end, prev->vm_pgoff, NULL);
+-		} else					/* cases 2, 5, 7 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					next_m->vm_end, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 2, 5, 7 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				end, prev->vm_pgoff, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					end_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		}
+ 		return prev;
+ 	}
+ 
+@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
+  			mpol_equal(policy, vma_policy(next)) &&
+ 			can_vma_merge_before(next, vm_flags,
+ 					anon_vma, file, pgoff+pglen)) {
+-		if (prev && addr < prev->vm_end)	/* case 4 */
++		if (prev && addr < prev->vm_end) {	/* case 4 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				addr, prev->vm_pgoff, NULL);
+-		else					/* cases 3, 8 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					addr_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 3, 8 */
+ 			vma_adjust(area, addr, next->vm_end,
+ 				next->vm_pgoff - pglen, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (area_m)
++				vma_adjust(area_m, addr_m, next_m->vm_end,
++					next_m->vm_pgoff - pglen, NULL);
++#endif
++
++		}
+ 		return area;
+ 	}
+ 
+@@ -888,14 +967,11 @@ none:
+ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+ 						struct file *file, long pages)
+ {
+-	const unsigned long stack_flags
+-		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
+-
+ 	if (file) {
+ 		mm->shared_vm += pages;
+ 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
+ 			mm->exec_vm += pages;
+-	} else if (flags & stack_flags)
++	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
+ 		mm->stack_vm += pages;
+ 	if (flags & (VM_RESERVED|VM_IO))
+ 		mm->reserved_vm += pages;
+@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	 * (the exception is when the underlying filesystem is noexec
+ 	 *  mounted, in which case we dont add PROT_EXEC.)
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
+ 			prot |= PROT_EXEC;
+ 
+@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	/* Obtain the address to map to. we verify (or select) it and ensure
+ 	 * that it represents a valid section of the address space.
+ 	 */
+-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
++	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
+ 	if (addr & ~PAGE_MASK)
+ 		return addr;
+ 
+@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
+ 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
+ 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT) {
++			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
++				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++			else
++				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++		}
++#endif
++
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
++		vm_flags &= ~VM_PAGEEXEC;
++#endif
++
+ 	if (flags & MAP_LOCKED)
+ 		if (!can_do_mlock())
+ 			return -EPERM;
+@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
+ 			return -EAGAIN;
+ 	}
+@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
+ 	if (error)
+ 		return error;
+ 
++	if (!gr_acl_handle_mmap(file, prot))
++		return -EACCES;
++
+ 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
+ }
+ EXPORT_SYMBOL(do_mmap_pgoff);
+@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
+  */
+ int vma_wants_writenotify(struct vm_area_struct *vma)
+ {
+-	unsigned int vm_flags = vma->vm_flags;
++	unsigned long vm_flags = vma->vm_flags;
+ 
+ 	/* If it was private or non-writable, the write bit is already clear */
+-	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
++	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
+ 		return 0;
+ 
+ 	/* The backer wishes to know when pages are first written to? */
+@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
+ 	unsigned long charged = 0;
+ 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	/* Clear old maps */
+ 	error = -ENOMEM;
+-munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limit. */
+@@ -1163,6 +1273,16 @@ munmap_back:
+ 		goto unacct_error;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			error = -ENOMEM;
++			goto free_vma;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -1185,6 +1305,19 @@ munmap_back:
+ 		error = file->f_op->mmap(file, vma);
+ 		if (error)
+ 			goto unmap_and_free_vma;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma_m && (vm_flags & VM_EXECUTABLE))
++			added_exe_file_vma(mm);
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
++			vma->vm_flags |= VM_PAGEEXEC;
++			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++		}
++#endif
++
+ 		if (vm_flags & VM_EXECUTABLE)
+ 			added_exe_file_vma(mm);
+ 
+@@ -1208,6 +1341,11 @@ munmap_back:
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ 	file = vma->vm_file;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	/* Once vma denies write, undo our temporary denial count */
+ 	if (correct_wcount)
+ 		atomic_inc(&inode->i_writecount);
+@@ -1216,6 +1354,7 @@ out:
+ 
+ 	mm->total_vm += len >> PAGE_SHIFT;
+ 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
++	track_exec_limit(mm, addr, addr + len, vm_flags);
+ 	if (vm_flags & VM_LOCKED) {
+ 		/*
+ 		 * makes pages present; downgrades, drops, reacquires mmap_sem
+@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
+ 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
+ 	charged = 0;
+ free_vma:
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		kmem_cache_free(vm_area_cachep, vma_m);
++#endif
++
+ 	kmem_cache_free(vm_area_cachep, vma);
+ unacct_error:
+ 	if (charged)
+@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -1293,9 +1442,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				addr = TASK_UNMAPPED_BASE;
+-			        start_addr = addr;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -1317,10 +1465,16 @@ full_search:
+ 
+ void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the lowest possible address?
+ 	 */
+-	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
++	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
+ 		mm->free_area_cache = addr;
+ 		mm->cached_hole_size = ~0UL;
+ 	}
+@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -1404,13 +1562,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-  	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+@@ -1419,6 +1585,12 @@ bottomup:
+ 
+ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the highest possible address?
+ 	 */
+@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
+ 		mm->free_area_cache = addr;
+ 
+ 	/* dont allow allocations above current base */
+-	if (mm->free_area_cache > mm->mmap_base)
++	if (mm->free_area_cache > mm->mmap_base) {
+ 		mm->free_area_cache = mm->mmap_base;
++		mm->cached_hole_size = ~0UL;
++	}
+ }
+ 
+ unsigned long
+@@ -1535,6 +1709,27 @@ out:
+ 	return prev ? prev->vm_next : vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
++{
++	struct vm_area_struct *vma_m;
++
++	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
++		BUG_ON(vma->vm_mirror);
++		return NULL;
++	}
++	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
++	vma_m = vma->vm_mirror;
++	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
++	BUG_ON(vma->vm_file != vma_m->vm_file);
++	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
++	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
++	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
++	return vma_m;
++}
++#endif
++
+ /*
+  * Verify that the stack growth is acceptable and
+  * update accounting. This is shared with both the
+@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
+ 		return -ENOMEM;
+ 
+ 	/* Stack limit test */
++	gr_learn_resource(current, RLIMIT_STACK, size, 1);
+ 	if (size > rlim[RLIMIT_STACK].rlim_cur)
+ 		return -ENOMEM;
+ 
+@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
+ 		unsigned long limit;
+ 		locked = mm->locked_vm + grow;
+ 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > limit && !capable(CAP_IPC_LOCK))
+ 			return -ENOMEM;
+ 	}
+@@ -1595,35 +1792,40 @@ static
+ #endif
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+-	int error;
++	int error, locknext;
+ 
+ 	if (!(vma->vm_flags & VM_GROWSUP))
+ 		return -EFAULT;
+ 
++	/* Also guard against wrapping around to address 0. */
++	if (address < PAGE_ALIGN(address+1))
++		address = PAGE_ALIGN(address+1);
++	else
++		return -ENOMEM;
++
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+ 	 * so that the anon_vma locking is not a noop.
+ 	 */
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		return -ENOMEM;
++	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
++	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
++		return -ENOMEM;
+ 	anon_vma_lock(vma);
++	if (locknext)
++		anon_vma_lock(vma->vm_next);
+ 
+ 	/*
+ 	 * vma->vm_start/vm_end cannot change under us because the caller
+ 	 * is required to hold the mmap_sem in read mode.  We need the
+-	 * anon_vma lock to serialize against concurrent expand_stacks.
+-	 * Also guard against wrapping around to address 0.
++	 * anon_vma locks to serialize against concurrent expand_stacks
++	 * and expand_upwards.
+ 	 */
+-	if (address < PAGE_ALIGN(address+4))
+-		address = PAGE_ALIGN(address+4);
+-	else {
+-		anon_vma_unlock(vma);
+-		return -ENOMEM;
+-	}
+ 	error = 0;
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address > vma->vm_end) {
++	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
+ 		unsigned long size, grow;
+ 
+ 		size = address - vma->vm_start;
+@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
+ 		if (!error)
+ 			vma->vm_end = address;
+ 	}
++	if (locknext)
++		anon_vma_unlock(vma->vm_next);
+ 	anon_vma_unlock(vma);
+ 	return error;
+ }
+@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
+ static int expand_downwards(struct vm_area_struct *vma,
+ 				   unsigned long address)
+ {
+-	int error;
++	int error, lockprev = 0;
++	struct vm_area_struct *prev = NULL;
+ 
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
+ 	if (error)
+ 		return error;
+ 
++#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
++	find_vma_prev(vma->vm_mm, address, &prev);
++	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
++#endif
++	if (lockprev && unlikely(anon_vma_prepare(prev)))
++		return -ENOMEM;
++	if (lockprev)
++		anon_vma_lock(prev);
++
+ 	anon_vma_lock(vma);
+ 
+ 	/*
+@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
+ 	 */
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address < vma->vm_start) {
++	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
+ 		unsigned long size, grow;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++
++		vma_m = pax_find_mirror_vma(vma);
++#endif
++
+ 		size = vma->vm_end - address;
+ 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 
+@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
+ 		if (!error) {
+ 			vma->vm_start = address;
+ 			vma->vm_pgoff -= grow;
++			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (vma_m) {
++				vma_m->vm_start -= grow << PAGE_SHIFT;
++				vma_m->vm_pgoff -= grow;
++			}
++#endif
++
+ 		}
+ 	}
+ 	anon_vma_unlock(vma);
++	if (lockprev)
++		anon_vma_unlock(prev);
+ 	return error;
+ }
+ 
+@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
+ 	do {
+ 		long nrpages = vma_pages(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
++			vma = remove_vma(vma);
++			continue;
++		}
++#endif
++
+ 		mm->total_vm -= nrpages;
+ 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
+ 		vma = remove_vma(vma);
+@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
+ 
+ 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
+ 	do {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma->vm_mirror) {
++			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
++			vma->vm_mirror->vm_mirror = NULL;
++			vma->vm_mirror->vm_flags &= ~VM_EXEC;
++			vma->vm_mirror = NULL;
++		}
++#endif
++
+ 		rb_erase(&vma->vm_rb, &mm->mm_rb);
+ 		mm->map_count--;
+ 		tail_vma = vma;
+@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
+ 	struct mempolicy *pol;
+ 	struct vm_area_struct *new;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m, *new_m = NULL;
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (is_vm_hugetlb_page(vma) && (addr &
+ 					~(huge_page_mask(hstate_vma(vma)))))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
++		if (mm->map_count >= sysctl_max_map_count-1)
++			return -ENOMEM;
++	} else
++#endif
++
+ 	if (mm->map_count >= sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
+ 	if (!new)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++		if (!new_m) {
++			kmem_cache_free(vm_area_cachep, new);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	/* most fields are the same, copy all, and then fixup */
+ 	*new = *vma;
+ 
+@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
+ 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		*new_m = *vma_m;
++		new_m->vm_mirror = new;
++		new->vm_mirror = new_m;
++
++		if (new_below)
++			new_m->vm_end = addr_m;
++		else {
++			new_m->vm_start = addr_m;
++			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
++		}
++	}
++#endif
++
+ 	pol = mpol_dup(vma_policy(vma));
+ 	if (IS_ERR(pol)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (new_m)
++			kmem_cache_free(vm_area_cachep, new_m);
++#endif
++
+ 		kmem_cache_free(vm_area_cachep, new);
+ 		return PTR_ERR(pol);
+ 	}
+@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
+ 	else
+ 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		mpol_get(pol);
++		vma_set_policy(new_m, pol);
++
++		if (new_m->vm_file) {
++			get_file(new_m->vm_file);
++			if (vma_m->vm_flags & VM_EXECUTABLE)
++				added_exe_file_vma(mm);
++		}
++
++		if (new_m->vm_ops && new_m->vm_ops->open)
++			new_m->vm_ops->open(new_m);
++
++		if (new_below)
++			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
++				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
++		else
++			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
+  * work.  This now handles partial unmappings.
+  * Jeremy Fitzhardinge <jeremy@goop.org>
+  */
++#ifdef CONFIG_PAX_SEGMEXEC
+ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ {
++	int ret = __do_munmap(mm, start, len);
++	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
++		return ret;
++
++	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
++}
++
++int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#else
++int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#endif
++{
+ 	unsigned long end;
+ 	struct vm_area_struct *vma, *prev, *last;
+ 
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
+ 		return -EINVAL;
+ 
+@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
+ 	/* Fix up all other VM information */
+ 	remove_vma_list(mm, vma);
+ 
++	track_exec_limit(mm, start, end, 0UL);
++
+ 	return 0;
+ }
+ 
+@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
+ 
+ 	profile_munmap(addr);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
++	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
++		return -EINVAL;
++#endif
++
+ 	down_write(&mm->mmap_sem);
+ 	ret = do_munmap(mm, addr, len);
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+ 
+-static inline void verify_mm_writelocked(struct mm_struct *mm)
+-{
+-#ifdef CONFIG_DEBUG_VM
+-	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
+-		WARN_ON(1);
+-		up_read(&mm->mmap_sem);
+-	}
+-#endif
+-}
+-
+ /*
+  *  this is really a simplified "do_mmap".  it only handles
+  *  anonymous maps.  eventually we may be able to do some
+@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
+ 	struct rb_node ** rb_link, * rb_parent;
+ 	pgoff_t pgoff = addr >> PAGE_SHIFT;
+ 	int error;
++	unsigned long charged;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
+ 
+ 	len = PAGE_ALIGN(len);
+ 	if (!len)
+@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
+ 
+ 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
+ 	if (error & ~PAGE_MASK)
+ 		return error;
+ 
++	charged = len >> PAGE_SHIFT;
++
+ 	/*
+ 	 * mlock MCL_FUTURE?
+ 	 */
+ 	if (mm->def_flags & VM_LOCKED) {
+ 		unsigned long locked, lock_limit;
+-		locked = len >> PAGE_SHIFT;
++		locked = charged;
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
+@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
+ 	/*
+ 	 * Clear old maps.  this also does some error checking for us
+ 	 */
+- munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limits *after* clearing old maps... */
+-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
++	if (!may_expand_vm(mm, charged))
+ 		return -ENOMEM;
+ 
+ 	if (mm->map_count > sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+-	if (security_vm_enough_memory(len >> PAGE_SHIFT))
++	if (security_vm_enough_memory(charged))
+ 		return -ENOMEM;
+ 
+ 	/* Can we just expand an old private anonymous mapping? */
+@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
+ 	 */
+ 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+ 	if (!vma) {
+-		vm_unacct_memory(len >> PAGE_SHIFT);
++		vm_unacct_memory(charged);
+ 		return -ENOMEM;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			kmem_cache_free(vm_area_cachep, vma);
++			vm_unacct_memory(charged);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
+ 	vma->vm_page_prot = vm_get_page_prot(flags);
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ out:
+-	mm->total_vm += len >> PAGE_SHIFT;
++	mm->total_vm += charged;
+ 	if (flags & VM_LOCKED) {
+ 		if (!mlock_vma_pages_range(vma, addr, addr + len))
+-			mm->locked_vm += (len >> PAGE_SHIFT);
++			mm->locked_vm += charged;
+ 	}
++	track_exec_limit(mm, addr, addr + len, flags);
+ 	return addr;
+ }
+ 
+@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
+ 	 * Walk the list again, actually closing and freeing it,
+ 	 * with preemption enabled, without holding any MM locks.
+ 	 */
+-	while (vma)
++	while (vma) {
++		vma->vm_mirror = NULL;
+ 		vma = remove_vma(vma);
++	}
+ 
+ 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
+ }
+@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
+ 	struct vm_area_struct * __vma, * prev;
+ 	struct rb_node ** rb_link, * rb_parent;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
+ 	/*
+ 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
+ 	 * until its first write fault, when page's anon_vma and index
+@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
+ 	if ((vma->vm_flags & VM_ACCOUNT) &&
+ 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m)
++			return -ENOMEM;
++	}
++#endif
++
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
+ 	struct rb_node **rb_link, *rb_parent;
+ 	struct mempolicy *pol;
+ 
++	BUG_ON(vma->vm_mirror);
++
+ 	/*
+ 	 * If anonymous vma has not yet been faulted, update new pgoff
+ 	 * to match new location, to increase its chance of merging.
+@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
+ 	return new_vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
++{
++	struct vm_area_struct *prev_m;
++	struct rb_node **rb_link_m, *rb_parent_m;
++	struct mempolicy *pol_m;
++
++	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
++	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
++	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
++	*vma_m = *vma;
++	pol_m = vma_policy(vma_m);
++	mpol_get(pol_m);
++	vma_set_policy(vma_m, pol_m);
++	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
++	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
++	if (vma_m->vm_file)
++		get_file(vma_m->vm_file);
++	if (vma_m->vm_ops && vma_m->vm_ops->open)
++		vma_m->vm_ops->open(vma_m);
++	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
++	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
++	vma_m->vm_mirror = vma;
++	vma->vm_mirror = vma_m;
++}
++#endif
++
+ /*
+  * Return true if the calling process may expand its vm space by the passed
+  * number of pages
+@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
+ 	unsigned long lim;
+ 
+ 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+-
++	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
+ 	if (cur + npages > lim)
+ 		return 0;
+ 	return 1;
+@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->pax_flags & MF_PAX_MPROTECT) {
++		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
++			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++		else
++			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++	}
++#endif
++
+ 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 
+diff -urNp linux-2.6.32.13/mm/mprotect.c linux-2.6.32.13/mm/mprotect.c
+--- linux-2.6.32.13/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/mprotect.c	2010-05-15 13:21:18.411130134 -0400
+@@ -24,10 +24,16 @@
+ #include <linux/mmu_notifier.h>
+ #include <linux/migrate.h>
+ #include <linux/perf_event.h>
++
++#ifdef CONFIG_PAX_MPROTECT
++#include <linux/elf.h>
++#endif
++
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
++#include <asm/mmu_context.h>
+ 
+ #ifndef pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+@@ -132,6 +138,48 @@ static void change_protection(struct vm_
+ 	flush_tlb_range(vma, start, end);
+ }
+ 
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++/* called while holding the mmap semaphor for writing except stack expansion */
++void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
++{
++	unsigned long oldlimit, newlimit = 0UL;
++
++	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
++		return;
++
++	spin_lock(&mm->page_table_lock);
++	oldlimit = mm->context.user_cs_limit;
++	if ((prot & VM_EXEC) && oldlimit < end)
++		/* USER_CS limit moved up */
++		newlimit = end;
++	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
++		/* USER_CS limit moved down */
++		newlimit = start;
++
++	if (newlimit) {
++		mm->context.user_cs_limit = newlimit;
++
++#ifdef CONFIG_SMP
++		wmb();
++		cpus_clear(mm->context.cpu_user_cs_mask);
++		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
++#endif
++
++		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
++	}
++	spin_unlock(&mm->page_table_lock);
++	if (newlimit == end) {
++		struct vm_area_struct *vma = find_vma(mm, oldlimit);
++
++		for (; vma && vma->vm_start < end; vma = vma->vm_next)
++			if (is_vm_hugetlb_page(vma))
++				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
++			else
++				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
++	}
++}
++#endif
++
+ int
+ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ 	unsigned long start, unsigned long end, unsigned long newflags)
+@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
+ 	int error;
+ 	int dirty_accountable = 0;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++	unsigned long start_m, end_m;
++
++	start_m = start + SEGMEXEC_TASK_SIZE;
++	end_m = end + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (newflags == oldflags) {
+ 		*pprev = vma;
+ 		return 0;
+@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
++		if (start != vma->vm_start) {
++			error = split_vma(mm, vma, start, 1);
++			if (error)
++				goto fail;
++			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
++			*pprev = (*pprev)->vm_next;
++		}
++
++		if (end != vma->vm_end) {
++			error = split_vma(mm, vma, end, 0);
++			if (error)
++				goto fail;
++		}
++
++		if (pax_find_mirror_vma(vma)) {
++			error = __do_munmap(mm, start_m, end_m - start_m);
++			if (error)
++				goto fail;
++		} else {
++			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++			if (!vma_m) {
++				error = -ENOMEM;
++				goto fail;
++			}
++			vma->vm_flags = newflags;
++			pax_mirror_vma(vma_m, vma);
++		}
++	}
++#endif
++
+ 	/*
+ 	 * First try to merge with previous and/or next vma.
+ 	 */
+@@ -196,8 +284,14 @@ success:
+ 	 * held in write mode.
+ 	 */
+ 	vma->vm_flags = newflags;
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->binfmt && mm->binfmt->handle_mprotect)
++		mm->binfmt->handle_mprotect(vma, newflags);
++#endif
++
+ 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
+-					  vm_get_page_prot(newflags));
++					  vm_get_page_prot(vma->vm_flags));
+ 
+ 	if (vma_wants_writenotify(vma)) {
+ 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
+@@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	end = start + len;
+ 	if (end <= start)
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (!arch_validate_prot(prot))
+ 		return -EINVAL;
+ 
+@@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	/*
+ 	 * Does the application expect PROT_READ to imply PROT_EXEC:
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		prot |= PROT_EXEC;
+ 
+ 	vm_flags = calc_vm_prot_bits(prot);
+@@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	if (start > vma->vm_start)
+ 		prev = vma;
+ 
++	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
++		error = -EACCES;
++		goto out;
++	}
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
++		current->mm->binfmt->handle_mprotect(vma, vm_flags);
++#endif
++
+ 	for (nstart = start ; ; ) {
+ 		unsigned long newflags;
+ 
+@@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 		if (error)
+ 			goto out;
+ 		perf_event_mmap(vma);
++
++		track_exec_limit(current->mm, nstart, tmp, vm_flags);
++
+ 		nstart = tmp;
+ 
+ 		if (nstart < prev->vm_end)
+diff -urNp linux-2.6.32.13/mm/mremap.c linux-2.6.32.13/mm/mremap.c
+--- linux-2.6.32.13/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/mremap.c	2010-05-15 13:21:18.411130134 -0400
+@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
+ 			continue;
+ 		pte = ptep_clear_flush(vma, old_addr, old_pte);
+ 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
++			pte = pte_exprotect(pte);
++#endif
++
+ 		set_pte_at(mm, new_addr, new_pte, pte);
+ 	}
+ 
+@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
+ 	if (is_vm_hugetlb_page(vma))
+ 		goto Einval;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		goto Einval;
++#endif
++
+ 	/* We can't remap across vm area boundaries */
+ 	if (old_len > vma->vm_end - addr)
+ 		goto Efault;
+@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
+ 	unsigned long map_flags;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (new_addr & ~PAGE_MASK)
+ 		goto out;
+ 
+-	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
+ 		goto out;
+ 
+ 	/* Check if the location we're moving into overlaps the
+ 	 * old location at all, and fail if it does.
+ 	 */
+-	if ((new_addr <= addr) && (new_addr+new_len) > addr)
+-		goto out;
+-
+-	if ((addr <= new_addr) && (addr+old_len) > new_addr)
++	if (addr + old_len > new_addr && new_addr + new_len > addr)
+ 		goto out;
+ 
+ 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
+ 	struct vm_area_struct *vma;
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+ 		goto out;
+@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
+ 	if (!new_len)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
++	    old_len > pax_task_size || addr > pax_task_size-old_len)
++		goto out;
++
+ 	if (flags & MREMAP_FIXED) {
+ 		if (flags & MREMAP_MAYMOVE)
+ 			ret = mremap_to(addr, old_len, new_addr, new_len);
+@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
+ 						   addr + new_len);
+ 			}
+ 			ret = addr;
++			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
+ 			goto out;
+ 		}
+ 	}
+@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
+ 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+ 		if (ret)
+ 			goto out;
++
++		map_flags = vma->vm_flags;
+ 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
++		if (!(ret & ~PAGE_MASK)) {
++			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
++			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
++		}
+ 	}
+ out:
+ 	if (ret & ~PAGE_MASK)
+diff -urNp linux-2.6.32.13/mm/nommu.c linux-2.6.32.13/mm/nommu.c
+--- linux-2.6.32.13/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/nommu.c	2010-05-15 13:21:18.414629737 -0400
+@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
+ EXPORT_SYMBOL(find_vma);
+ 
+ /*
+- * find a VMA
+- * - we don't extend stack VMAs under NOMMU conditions
+- */
+-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
+-{
+-	return find_vma(mm, addr);
+-}
+-
+-/*
+  * expand a stack to a given address
+  * - not supported under NOMMU conditions
+  */
+diff -urNp linux-2.6.32.13/mm/page_alloc.c linux-2.6.32.13/mm/page_alloc.c
+--- linux-2.6.32.13/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/page_alloc.c	2010-05-15 13:21:18.414629737 -0400
+@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
+ 	int bad = 0;
+ 	int wasMlocked = __TestClearPageMlocked(page);
+ 
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	unsigned long index = 1UL << order;
++#endif
++
+ 	kmemcheck_free_shadow(page, order);
+ 
+ 	for (i = 0 ; i < (1 << order) ; ++i)
+@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
+ 		debug_check_no_obj_freed(page_address(page),
+ 					   PAGE_SIZE << order);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	for (; index; --index)
++		sanitize_highpage(page + index - 1);
++#endif
++
+ 	arch_free_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 0);
+ 
+@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
+ 	arch_alloc_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 1);
+ 
++#ifndef CONFIG_PAX_MEMORY_SANITIZE
+ 	if (gfp_flags & __GFP_ZERO)
+ 		prep_zero_page(page, order, gfp_flags);
++#endif
+ 
+ 	if (order && (gfp_flags & __GFP_COMP))
+ 		prep_compound_page(page, order);
+@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
+ 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
+ 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	sanitize_highpage(page);
++#endif
++
+ 	arch_free_page(page, 0);
+ 	kernel_map_pages(page, 1, 0);
+ 
+@@ -3723,7 +3740,7 @@ static void __init setup_usemap(struct p
+ 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
+ }
+ #else
+-static void inline setup_usemap(struct pglist_data *pgdat,
++static inline void setup_usemap(struct pglist_data *pgdat,
+ 				struct zone *zone, unsigned long zonesize) {}
+ #endif /* CONFIG_SPARSEMEM */
+ 
+diff -urNp linux-2.6.32.13/mm/percpu.c linux-2.6.32.13/mm/percpu.c
+--- linux-2.6.32.13/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/percpu.c	2010-05-15 13:21:18.450640661 -0400
+@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
+ static unsigned int pcpu_last_unit_cpu __read_mostly;
+ 
+ /* the address of the first chunk which starts with the kernel static area */
+-void *pcpu_base_addr __read_mostly;
++void *pcpu_base_addr __read_only;
+ EXPORT_SYMBOL_GPL(pcpu_base_addr);
+ 
+ static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
+diff -urNp linux-2.6.32.13/mm/rmap.c linux-2.6.32.13/mm/rmap.c
+--- linux-2.6.32.13/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/rmap.c	2010-05-15 13:21:18.454622314 -0400
+@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
+ 		struct mm_struct *mm = vma->vm_mm;
+ 		struct anon_vma *allocated;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++#endif
++
+ 		anon_vma = find_mergeable_anon_vma(vma);
+ 		allocated = NULL;
+ 		if (!anon_vma) {
+@@ -121,6 +125,15 @@ int anon_vma_prepare(struct vm_area_stru
+ 		/* page_table_lock to protect against threads */
+ 		spin_lock(&mm->page_table_lock);
+ 		if (likely(!vma->anon_vma)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			vma_m = pax_find_mirror_vma(vma);
++			if (vma_m) {
++				vma_m->anon_vma = anon_vma;
++				__anon_vma_link(vma_m);
++			}
++#endif
++
+ 			vma->anon_vma = anon_vma;
+ 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
+ 			allocated = NULL;
+diff -urNp linux-2.6.32.13/mm/shmem.c linux-2.6.32.13/mm/shmem.c
+--- linux-2.6.32.13/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/shmem.c	2010-05-15 13:21:18.454622314 -0400
+@@ -31,7 +31,7 @@
+ #include <linux/swap.h>
+ #include <linux/ima.h>
+ 
+-static struct vfsmount *shm_mnt;
++struct vfsmount *shm_mnt;
+ 
+ #ifdef CONFIG_SHMEM
+ /*
+diff -urNp linux-2.6.32.13/mm/slab.c linux-2.6.32.13/mm/slab.c
+--- linux-2.6.32.13/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/slab.c	2010-05-15 13:21:18.454622314 -0400
+@@ -308,7 +308,7 @@ struct kmem_list3 {
+  * Need this for bootstrapping a per node allocator.
+  */
+ #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
+-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
++struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
+ #define	CACHE_CACHE 0
+ #define	SIZE_AC MAX_NUMNODES
+ #define	SIZE_L3 (2 * MAX_NUMNODES)
+@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
+  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
+  */
+ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
+-					const struct slab *slab, void *obj)
++					const struct slab *slab, const void *obj)
+ {
+ 	u32 offset = (obj - slab->s_mem);
+ 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
+@@ -584,14 +584,14 @@ struct cache_names {
+ static struct cache_names __initdata cache_names[] = {
+ #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
+ #include <linux/kmalloc_sizes.h>
+-	{NULL,}
++	{NULL, NULL}
+ #undef CACHE
+ };
+ 
+ static struct arraycache_init initarray_cache __initdata =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ static struct arraycache_init initarray_generic =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ 
+ /* internal cache of cache description objs */
+ static struct kmem_cache cache_cache = {
+@@ -4082,7 +4082,7 @@ out:
+ 	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
+ }
+ 
+-#ifdef CONFIG_SLABINFO
++#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ 
+ static void print_slabinfo_header(struct seq_file *m)
+ {
+@@ -4480,6 +4480,51 @@ static int __init slab_proc_init(void)
+ module_init(slab_proc_init);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct kmem_cache *cachep;
++	struct slab *slabp;
++	struct page *page;
++	unsigned int objnr;
++	unsigned long offset;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = virt_to_head_page(ptr);
++
++	if (!PageSlab(page)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	cachep = page_get_cache(page);
++	slabp = page_get_slab(page);
++	objnr = obj_to_index(cachep, slabp, ptr);
++	BUG_ON(objnr >= cachep->num);
++	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
++	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /**
+  * ksize - get the actual amount of memory allocated for a given object
+  * @objp: Pointer to the object
+diff -urNp linux-2.6.32.13/mm/slob.c linux-2.6.32.13/mm/slob.c
+--- linux-2.6.32.13/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/slob.c	2010-05-15 13:21:18.454622314 -0400
+@@ -29,7 +29,7 @@
+  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
+  * alloc_pages() directly, allocating compound pages so the page order
+  * does not have to be separately tracked, and also stores the exact
+- * allocation size in page->private so that it can be used to accurately
++ * allocation size in slob_page->size so that it can be used to accurately
+  * provide ksize(). These objects are detected in kfree() because slob_page()
+  * is false for them.
+  *
+@@ -58,6 +58,7 @@
+  */
+ 
+ #include <linux/kernel.h>
++#include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+ #include <linux/swap.h> /* struct reclaim_state */
+@@ -100,7 +101,8 @@ struct slob_page {
+ 			unsigned long flags;	/* mandatory */
+ 			atomic_t _count;	/* mandatory */
+ 			slobidx_t units;	/* free units left in page */
+-			unsigned long pad[2];
++			unsigned long pad[1];
++			unsigned long size;	/* size when >=PAGE_SIZE */
+ 			slob_t *free;		/* first free slob_t in page */
+ 			struct list_head list;	/* linked list of free pages */
+ 		};
+@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
+  */
+ static inline int is_slob_page(struct slob_page *sp)
+ {
+-	return PageSlab((struct page *)sp);
++	return PageSlab((struct page *)sp) && !sp->size;
+ }
+ 
+ static inline void set_slob_page(struct slob_page *sp)
+@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
+ 
+ static inline struct slob_page *slob_page(const void *addr)
+ {
+-	return (struct slob_page *)virt_to_page(addr);
++	return (struct slob_page *)virt_to_head_page(addr);
+ }
+ 
+ /*
+@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
+ /*
+  * Return the size of a slob block.
+  */
+-static slobidx_t slob_units(slob_t *s)
++static slobidx_t slob_units(const slob_t *s)
+ {
+ 	if (s->units > 0)
+ 		return s->units;
+@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
+ /*
+  * Return the next free slob block pointer after this one.
+  */
+-static slob_t *slob_next(slob_t *s)
++static slob_t *slob_next(const slob_t *s)
+ {
+ 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
+ 	slobidx_t next;
+@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
+ /*
+  * Returns true if s is the last free block in its page.
+  */
+-static int slob_last(slob_t *s)
++static int slob_last(const slob_t *s)
+ {
+ 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
+ }
+@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
+ 	if (!page)
+ 		return NULL;
+ 
++	set_slob_page(page);
+ 	return page_address(page);
+ }
+ 
+@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
+ 		if (!b)
+ 			return NULL;
+ 		sp = slob_page(b);
+-		set_slob_page(sp);
+ 
+ 		spin_lock_irqsave(&slob_lock, flags);
+ 		sp->units = SLOB_UNITS(PAGE_SIZE);
+ 		sp->free = b;
++		sp->size = 0;
+ 		INIT_LIST_HEAD(&sp->list);
+ 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
+ 		set_slob_page_free(sp, slob_list);
+@@ -475,10 +478,9 @@ out:
+ #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
+ #endif
+ 
+-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
+ {
+-	unsigned int *m;
+-	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++	slob_t *m;
+ 	void *ret;
+ 
+ 	lockdep_trace_alloc(gfp);
+@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		if (!m)
+ 			return NULL;
+-		*m = size;
++		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
++		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
++		m[0].units = size;
++		m[1].units = align;
+ 		ret = (void *)m + align;
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
+ 		if (ret) {
+-			struct page *page;
+-			page = virt_to_page(ret);
+-			page->private = size;
++			struct slob_page *sp;
++			sp = slob_page(ret);
++			sp->size = size;
+ 		}
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 	kmemleak_alloc(ret, size, 1, gfp);
+ 	return ret;
+ }
++
++void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++{
++	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++
++	return __kmalloc_node_align(size, gfp, node, align);
++}
+ EXPORT_SYMBOL(__kmalloc_node);
+ 
+ void kfree(const void *block)
+@@ -528,13 +540,84 @@ void kfree(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		slob_free(m, *m + align);
+-	} else
++		slob_t *m = (slob_t *)(block - align);
++		slob_free(m, m[0].units + align);
++	} else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		put_page(&sp->page);
++	}
+ }
+ EXPORT_SYMBOL(kfree);
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct slob_page *sp;
++	const slob_t *free;
++	const void *base;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	sp = slob_page(ptr);
++	if (!PageSlab((struct page*)sp)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	if (sp->size) {
++		base = page_address(&sp->page);
++		if (base <= ptr && n <= sp->size - (ptr - base))
++			return;
++		goto report;
++	}
++
++	/* some tricky double walking to find the chunk */
++	base = (void *)((unsigned long)ptr & PAGE_MASK);
++	free = sp->free;
++
++	while (!slob_last(free) && (void *)free <= ptr) {
++		base = free + slob_units(free);
++		free = slob_next(free);
++	}
++
++	while (base < (void *)free) {
++		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
++		int size = SLOB_UNIT * SLOB_UNITS(m + align);
++		int offset;
++
++		if (ptr < base + align)
++			goto report;
++
++		offset = ptr - base - align;
++		if (offset < m) {
++			if (n <= m - offset)
++				return;
++			goto report;
++		}
++		base += size;
++	}
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
+ size_t ksize(const void *block)
+ {
+@@ -547,10 +630,10 @@ size_t ksize(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		return SLOB_UNITS(*m) * SLOB_UNIT;
++		slob_t *m = (slob_t *)(block - align);
++		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
+ 	} else
+-		return sp->page.private;
++		return sp->size;
+ }
+ EXPORT_SYMBOL(ksize);
+ 
+@@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
+ {
+ 	void *b;
+ 
++#ifdef CONFIG_PAX_USERCOPY
++	b = __kmalloc_node_align(c->size, flags, node, c->align);
++#else
+ 	if (c->size < PAGE_SIZE) {
+ 		b = slob_alloc(c->size, flags, c->align, node);
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    SLOB_UNITS(c->size) * SLOB_UNIT,
+ 					    flags, node);
+ 	} else {
++		struct slob_page *sp;
++
+ 		b = slob_new_pages(flags, get_order(c->size), node);
++		sp = slob_page(b);
++		sp->size = c->size;
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    PAGE_SIZE << get_order(c->size),
+ 					    flags, node);
+ 	}
++#endif
+ 
+ 	if (c->ctor)
+ 		c->ctor(b);
+@@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+ 
+ static void __kmem_cache_free(void *b, int size)
+ {
+-	if (size < PAGE_SIZE)
++	struct slob_page *sp = slob_page(b);
++
++	if (is_slob_page(sp))
+ 		slob_free(b, size);
+-	else
++	else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		slob_free_pages(b, get_order(size));
++	}
+ }
+ 
+ static void kmem_rcu_free(struct rcu_head *head)
+@@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
+ 
+ void kmem_cache_free(struct kmem_cache *c, void *b)
+ {
++	int size = c->size;
++
++#ifdef CONFIG_PAX_USERCOPY
++	if (size + c->align < PAGE_SIZE) {
++		size += c->align;
++		b -= c->align;
++	}
++#endif
++
+ 	kmemleak_free_recursive(b, c->flags);
+ 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
+ 		struct slob_rcu *slob_rcu;
+-		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
++		slob_rcu = b + (size - sizeof(struct slob_rcu));
+ 		INIT_RCU_HEAD(&slob_rcu->head);
+-		slob_rcu->size = c->size;
++		slob_rcu->size = size;
+ 		call_rcu(&slob_rcu->head, kmem_rcu_free);
+ 	} else {
+-		__kmem_cache_free(b, c->size);
++		__kmem_cache_free(b, size);
+ 	}
+ 
+ 	trace_kmem_cache_free(_RET_IP_, b);
+diff -urNp linux-2.6.32.13/mm/slub.c linux-2.6.32.13/mm/slub.c
+--- linux-2.6.32.13/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/slub.c	2010-05-15 13:21:18.454622314 -0400
+@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
+ 
+ 	page = virt_to_head_page(x);
+ 
++	BUG_ON(!PageSlab(page));
++
+ 	slab_free(s, page, x, _RET_IP_);
+ 
+ 	trace_kmem_cache_free(_RET_IP_, x);
+@@ -1937,7 +1939,7 @@ static int slub_min_objects;
+  * Merge control. If this is set then no merging of slab caches will occur.
+  * (Could be removed. This was introduced to pacify the merge skeptics.)
+  */
+-static int slub_nomerge;
++static int slub_nomerge = 1;
+ 
+ /*
+  * Calculate the order of allocation given an slab object size.
+@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
+ 	 * list to avoid pounding the page allocator excessively.
+ 	 */
+ 	set_min_partial(s, ilog2(s->size));
+-	s->refcount = 1;
++	atomic_set(&s->refcount, 1);
+ #ifdef CONFIG_NUMA
+ 	s->remote_node_defrag_ratio = 1000;
+ #endif
+@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
+ 	down_write(&slub_lock);
+-	s->refcount--;
+-	if (!s->refcount) {
++	if (atomic_dec_and_test(&s->refcount)) {
+ 		list_del(&s->list);
+ 		up_write(&slub_lock);
+ 		if (kmem_cache_close(s)) {
+@@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t 
+ EXPORT_SYMBOL(__kmalloc_node);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct page *page;
++	struct kmem_cache *s;
++	unsigned long offset;
++
++	if (!n)
++		return;
++
++	if (ZERO_OR_NULL_PTR(ptr))
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = get_object_page(ptr);
++
++	if (!page) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	s = page->slab;
++	offset = (ptr - page_address(page)) % s->size;
++	if (offset <= s->objsize && n <= s->objsize - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ size_t ksize(const void *object)
+ {
+ 	struct page *page;
+@@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
+ 	 */
+ 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
+ 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
+-	kmalloc_caches[0].refcount = -1;
++	atomic_set(&kmalloc_caches[0].refcount, -1);
+ 	caches++;
+ 
+ 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
+@@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
+ 	/*
+ 	 * We may have set a slab to be unmergeable during bootstrap.
+ 	 */
+-	if (s->refcount < 0)
++	if (atomic_read(&s->refcount) < 0)
+ 		return 1;
+ 
+ 	return 0;
+@@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
+ 	if (s) {
+ 		int cpu;
+ 
+-		s->refcount++;
++		atomic_inc(&s->refcount);
+ 		/*
+ 		 * Adjust the object sizes so that we clear
+ 		 * the complete object on kzalloc.
+@@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
+ 
+ 		if (sysfs_slab_alias(s, name)) {
+ 			down_write(&slub_lock);
+-			s->refcount--;
++			atomic_dec(&s->refcount);
+ 			up_write(&slub_lock);
+ 			goto err;
+ 		}
+@@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
+ 
+ static ssize_t aliases_show(struct kmem_cache *s, char *buf)
+ {
+-	return sprintf(buf, "%d\n", s->refcount - 1);
++	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
+ }
+ SLAB_ATTR_RO(aliases);
+ 
+@@ -4503,7 +4544,7 @@ static void kmem_cache_release(struct ko
+ 	kfree(s);
+ }
+ 
+-static struct sysfs_ops slab_sysfs_ops = {
++static const struct sysfs_ops slab_sysfs_ops = {
+ 	.show = slab_attr_show,
+ 	.store = slab_attr_store,
+ };
+@@ -4522,7 +4563,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops slab_uevent_ops = {
++static const struct kset_uevent_ops slab_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+@@ -4696,7 +4737,7 @@ __initcall(slab_sysfs_init);
+ /*
+  * The /proc/slabinfo ABI
+  */
+-#ifdef CONFIG_SLABINFO
++#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
+ static void print_slabinfo_header(struct seq_file *m)
+ {
+ 	seq_puts(m, "slabinfo - version: 2.1\n");
+diff -urNp linux-2.6.32.13/mm/util.c linux-2.6.32.13/mm/util.c
+--- linux-2.6.32.13/mm/util.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/util.c	2010-05-15 13:21:18.454622314 -0400
+@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 	mm->get_unmapped_area = arch_get_unmapped_area;
+ 	mm->unmap_area = arch_unmap_area;
+ }
+diff -urNp linux-2.6.32.13/mm/vmalloc.c linux-2.6.32.13/mm/vmalloc.c
+--- linux-2.6.32.13/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/mm/vmalloc.c	2010-05-15 13:23:38.946686210 -0400
+@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
+ 
+ 	pte = pte_offset_kernel(pmd, addr);
+ 	do {
+-		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
+-		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
++			BUG_ON(!pte_exec(*pte));
++			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
++			continue;
++		}
++#endif
++
++		{
++			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
++			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++		}
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+ }
+ 
+@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+ {
+ 	pte_t *pte;
++	int ret = -ENOMEM;
+ 
+ 	/*
+ 	 * nr is a running index into the array which helps higher level
+@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 	pte = pte_alloc_kernel(pmd, addr);
+ 	if (!pte)
+ 		return -ENOMEM;
++
++	pax_open_kernel();
+ 	do {
+ 		struct page *page = pages[*nr];
+ 
+-		if (WARN_ON(!pte_none(*pte)))
+-			return -EBUSY;
+-		if (WARN_ON(!page))
+-			return -ENOMEM;
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (pgprot_val(prot) & _PAGE_NX)
++#endif
++
++		if (WARN_ON(!pte_none(*pte))) {
++			ret = -EBUSY;
++			goto out;
++		}
++		if (WARN_ON(!page)) {
++			ret = -ENOMEM;
++			goto out;
++		}
+ 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
+ 		(*nr)++;
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+-	return 0;
++	ret = 0;
++out:
++	pax_close_kernel();
++	return ret;
+ }
+ 
+ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
+ 	 * and fall back on vmalloc() if that fails. Others
+ 	 * just put it in the vmalloc space.
+ 	 */
+-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
++#ifdef CONFIG_MODULES
++#ifdef MODULES_VADDR
+ 	unsigned long addr = (unsigned long)x;
+ 	if (addr >= MODULES_VADDR && addr < MODULES_END)
+ 		return 1;
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
++		return 1;
++#endif
++
++#endif
++
+ 	return is_vmalloc_addr(x);
+ }
+ 
+@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
+ 	struct rb_node *tmp;
+ 
+ 	while (*p) {
+-		struct vmap_area *tmp;
++		struct vmap_area *varea;
+ 
+ 		parent = *p;
+-		tmp = rb_entry(parent, struct vmap_area, rb_node);
+-		if (va->va_start < tmp->va_end)
++		varea = rb_entry(parent, struct vmap_area, rb_node);
++		if (va->va_start < varea->va_end)
+ 			p = &(*p)->rb_left;
+-		else if (va->va_end > tmp->va_start)
++		else if (va->va_end > varea->va_start)
+ 			p = &(*p)->rb_right;
+ 		else
+ 			BUG();
+@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
+ 	struct vm_struct *area;
+ 
+ 	BUG_ON(in_interrupt());
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (flags & VM_KERNEXEC) {
++		if (start != VMALLOC_START || end != VMALLOC_END)
++			return NULL;
++		start = (unsigned long)MODULES_EXEC_VADDR;
++		end = (unsigned long)MODULES_EXEC_END;
++	}
++#endif
++
+ 	if (flags & VM_IOREMAP) {
+ 		int bit = fls(size);
+ 
+@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
+ 	if (count > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		flags |= VM_KERNEXEC;
++#endif
++
+ 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
+ 					__builtin_return_address(0));
+ 	if (!area)
+@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
+ 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
++						node, gfp_mask, caller);
++	else
++#endif
++
+ 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
+ 				  VMALLOC_END, node, gfp_mask, caller);
+ 
+@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
+ 	return addr;
+ }
+ 
++#undef __vmalloc
+ void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
+ {
+ 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
+@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc
+ void *vmalloc(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
+  * The resulting memory area is zeroed so it can be mapped to userspace
+  * without leaking data.
+  */
++#undef vmalloc_user
+ void *vmalloc_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc_node
+ void *vmalloc_node(unsigned long size, int node)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
+-
++#undef vmalloc_exec
+ void *vmalloc_exec(unsigned long size)
+ {
+-	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
++	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
+ 			      -1, __builtin_return_address(0));
+ }
+ 
+@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
+  *	Allocate enough 32bit PA addressable pages to cover @size from the
+  *	page level allocator and map them into contiguous kernel virtual space.
+  */
++#undef vmalloc_32
+ void *vmalloc_32(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
+@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
+  * The resulting memory area is 32bit addressable and zeroed so it can be
+  * mapped to userspace without leaking data.
+  */
++#undef vmalloc_32_user
+ void *vmalloc_32_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+diff -urNp linux-2.6.32.13/net/8021q/vlan.c linux-2.6.32.13/net/8021q/vlan.c
+--- linux-2.6.32.13/net/8021q/vlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/8021q/vlan.c	2010-05-15 13:21:18.454622314 -0400
+@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
+ 		err = -EPERM;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			break;
+-		if ((args.u.name_type >= 0) &&
+-		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
++		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
+ 			struct vlan_net *vn;
+ 
+ 			vn = net_generic(net, vlan_net_id);
+diff -urNp linux-2.6.32.13/net/atm/atm_misc.c linux-2.6.32.13/net/atm/atm_misc.c
+--- linux-2.6.32.13/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/atm/atm_misc.c	2010-05-15 13:21:18.454622314 -0400
+@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
+ 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
+ 		return 1;
+ 	atm_return(vcc,truesize);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return 0;
+ }
+ 
+@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
+ 		}
+ 	}
+ 	atm_return(vcc,guess);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return NULL;
+ }
+ 
+@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
+ 
+ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
+ 
+ void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.13/net/atm/proc.c linux-2.6.32.13/net/atm/proc.c
+--- linux-2.6.32.13/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/atm/proc.c	2010-05-15 13:21:18.466625554 -0400
+@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
+   const struct k_atm_aal_stats *stats)
+ {
+ 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
+-	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
+-	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
+-	    atomic_read(&stats->rx_drop));
++	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
++	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
++	    atomic_read_unchecked(&stats->rx_drop));
+ }
+ 
+ static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
+diff -urNp linux-2.6.32.13/net/atm/resources.c linux-2.6.32.13/net/atm/resources.c
+--- linux-2.6.32.13/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/atm/resources.c	2010-05-15 13:21:18.466625554 -0400
+@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
+ static void copy_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
+ static void subtract_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.13/net/bridge/br_private.h linux-2.6.32.13/net/bridge/br_private.h
+--- linux-2.6.32.13/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/bridge/br_private.h	2010-05-15 13:21:18.499638693 -0400
+@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
+ 
+ #ifdef CONFIG_SYSFS
+ /* br_sysfs_if.c */
+-extern struct sysfs_ops brport_sysfs_ops;
++extern const struct sysfs_ops brport_sysfs_ops;
+ extern int br_sysfs_addif(struct net_bridge_port *p);
+ 
+ /* br_sysfs_br.c */
+diff -urNp linux-2.6.32.13/net/bridge/br_stp_if.c linux-2.6.32.13/net/bridge/br_stp_if.c
+--- linux-2.6.32.13/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/bridge/br_stp_if.c	2010-05-15 13:21:18.499638693 -0400
+@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
+ 	char *envp[] = { NULL };
+ 
+ 	if (br->stp_enabled == BR_USER_STP) {
+-		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
++		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+ 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
+ 			br->dev->name, r);
+ 
+diff -urNp linux-2.6.32.13/net/bridge/br_sysfs_if.c linux-2.6.32.13/net/bridge/br_sysfs_if.c
+--- linux-2.6.32.13/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/bridge/br_sysfs_if.c	2010-05-15 13:21:18.499638693 -0400
+@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
+ 	return ret;
+ }
+ 
+-struct sysfs_ops brport_sysfs_ops = {
++const struct sysfs_ops brport_sysfs_ops = {
+ 	.show = brport_show,
+ 	.store = brport_store,
+ };
+diff -urNp linux-2.6.32.13/net/core/dev.c linux-2.6.32.13/net/core/dev.c
+--- linux-2.6.32.13/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/core/dev.c	2010-05-15 13:21:18.499638693 -0400
+@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_ni);
+ 
+-static void net_tx_action(struct softirq_action *h)
++static void net_tx_action(void)
+ {
+ 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
+ 
+@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
+ EXPORT_SYMBOL(netif_napi_del);
+ 
+ 
+-static void net_rx_action(struct softirq_action *h)
++static void net_rx_action(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
+ 	unsigned long time_limit = jiffies + 2;
+diff -urNp linux-2.6.32.13/net/core/flow.c linux-2.6.32.13/net/core/flow.c
+--- linux-2.6.32.13/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/core/flow.c	2010-05-15 13:21:18.499638693 -0400
+@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
+ 
+ static u32 flow_hash_shift;
+ #define flow_hash_size	(1 << flow_hash_shift)
+-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
++static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
+ 
+ #define flow_table(cpu) (per_cpu(flow_tables, cpu))
+ 
+@@ -52,7 +52,7 @@ struct flow_percpu_info {
+ 	u32 hash_rnd;
+ 	int count;
+ };
+-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
++static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
+ 
+ #define flow_hash_rnd_recalc(cpu) \
+ 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
+@@ -69,7 +69,7 @@ struct flow_flush_info {
+ 	atomic_t cpuleft;
+ 	struct completion completion;
+ };
+-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
++static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
+ 
+ #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
+ 
+diff -urNp linux-2.6.32.13/net/dccp/ccids/ccid3.c linux-2.6.32.13/net/dccp/ccids/ccid3.c
+--- linux-2.6.32.13/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/dccp/ccids/ccid3.c	2010-05-15 13:21:18.502580406 -0400
+@@ -41,7 +41,7 @@
+ static int ccid3_debug;
+ #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
+ #else
+-#define ccid3_pr_debug(format, a...)
++#define ccid3_pr_debug(format, a...) do {} while (0)
+ #endif
+ 
+ /*
+diff -urNp linux-2.6.32.13/net/dccp/dccp.h linux-2.6.32.13/net/dccp/dccp.h
+--- linux-2.6.32.13/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/dccp/dccp.h	2010-05-15 13:21:18.502580406 -0400
+@@ -44,9 +44,9 @@ extern int dccp_debug;
+ #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+ 
+ extern struct inet_hashinfo dccp_hashinfo;
+diff -urNp linux-2.6.32.13/net/decnet/sysctl_net_decnet.c linux-2.6.32.13/net/decnet/sysctl_net_decnet.c
+--- linux-2.6.32.13/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/decnet/sysctl_net_decnet.c	2010-05-15 13:21:18.502580406 -0400
+@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, addr, len))
++	if (len > sizeof addr || copy_to_user(buffer, addr, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, devname, len))
++	if (len > sizeof devname || copy_to_user(buffer, devname, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+diff -urNp linux-2.6.32.13/net/ipv4/inet_hashtables.c linux-2.6.32.13/net/ipv4/inet_hashtables.c
+--- linux-2.6.32.13/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/inet_hashtables.c	2010-05-15 13:21:18.502580406 -0400
+@@ -18,11 +18,14 @@
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
++#include <linux/security.h>
+ 
+ #include <net/inet_connection_sock.h>
+ #include <net/inet_hashtables.h>
+ #include <net/ip.h>
+ 
++extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
++
+ /*
+  * Allocate and initialize a new local port bind bucket.
+  * The bindhash mutex for snum's hash chain must be held here.
+@@ -490,6 +493,8 @@ ok:
+ 		}
+ 		spin_unlock(&head->lock);
+ 
++		gr_update_task_in_ip_table(current, inet_sk(sk));
++
+ 		if (tw) {
+ 			inet_twsk_deschedule(tw, death_row);
+ 			inet_twsk_put(tw);
+diff -urNp linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-05-15 13:21:18.502580406 -0400
+@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
+ 
+ 	*len = 0;
+ 
+-	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
++	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
+ 	if (*octets == NULL) {
+ 		if (net_ratelimit())
+ 			printk("OOM in bsalg (%d)\n", __LINE__);
+diff -urNp linux-2.6.32.13/net/ipv4/tcp_ipv4.c linux-2.6.32.13/net/ipv4/tcp_ipv4.c
+--- linux-2.6.32.13/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/tcp_ipv4.c	2010-05-15 13:21:18.502580406 -0400
+@@ -84,6 +84,9 @@
+ int sysctl_tcp_tw_reuse __read_mostly;
+ int sysctl_tcp_low_latency __read_mostly;
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+ static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
+@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
+ 	TCP_SKB_CB(skb)->sacked	 = 0;
+ 
+ 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+-	if (!sk)
++	if (!sk) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 1;
++#endif
+ 		goto no_tcp_socket;
++	}
+ 
+ process:
+-	if (sk->sk_state == TCP_TIME_WAIT)
++	if (sk->sk_state == TCP_TIME_WAIT) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 2;
++#endif
+ 		goto do_time_wait;
++	}
+ 
+ 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+ 		goto discard_and_relse;
+@@ -1650,6 +1661,10 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (!grsec_enable_blackhole || (ret == 1 &&
++		    (skb->dev->flags & IFF_LOOPBACK)))
++#endif
+ 		tcp_v4_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.13/net/ipv4/tcp_minisocks.c linux-2.6.32.13/net/ipv4/tcp_minisocks.c
+--- linux-2.6.32.13/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/tcp_minisocks.c	2010-05-15 13:21:18.502580406 -0400
+@@ -26,6 +26,10 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ #ifdef CONFIG_SYSCTL
+ #define SYNC_INIT 0 /* let the user enable it */
+ #else
+@@ -672,6 +676,10 @@ listen_overflow:
+ 
+ embryonic_reset:
+ 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole)
++#endif
+ 	if (!(flg & TCP_FLAG_RST))
+ 		req->rsk_ops->send_reset(sk, skb);
+ 
+diff -urNp linux-2.6.32.13/net/ipv4/tcp_probe.c linux-2.6.32.13/net/ipv4/tcp_probe.c
+--- linux-2.6.32.13/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/tcp_probe.c	2010-05-15 13:21:18.502580406 -0400
+@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
+ 		if (cnt + width >= len)
+ 			break;
+ 
+-		if (copy_to_user(buf + cnt, tbuf, width))
++		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
+ 			return -EFAULT;
+ 		cnt += width;
+ 	}
+diff -urNp linux-2.6.32.13/net/ipv4/tcp_timer.c linux-2.6.32.13/net/ipv4/tcp_timer.c
+--- linux-2.6.32.13/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/tcp_timer.c	2010-05-15 13:21:18.502580406 -0400
+@@ -21,6 +21,10 @@
+ #include <linux/module.h>
+ #include <net/tcp.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_lastack_retries;
++#endif
++
+ int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
+ int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
+ int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
+@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
+ 		}
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if ((sk->sk_state == TCP_LAST_ACK) &&
++	    (grsec_lastack_retries > 0) &&
++	    (grsec_lastack_retries < retry_until))
++		retry_until = grsec_lastack_retries;
++#endif
++
+ 	if (retransmits_timed_out(sk, retry_until)) {
+ 		/* Has it gone just too far? */
+ 		tcp_write_err(sk);
+diff -urNp linux-2.6.32.13/net/ipv4/udp.c linux-2.6.32.13/net/ipv4/udp.c
+--- linux-2.6.32.13/net/ipv4/udp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv4/udp.c	2010-05-15 13:21:18.502580406 -0400
+@@ -86,6 +86,7 @@
+ #include <linux/types.h>
+ #include <linux/fcntl.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+ #include <linux/igmp.h>
+@@ -106,6 +107,10 @@
+ #include <net/xfrm.h>
+ #include "udp_impl.h"
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ struct udp_table udp_table;
+ EXPORT_SYMBOL(udp_table);
+ 
+@@ -371,6 +376,9 @@ found:
+ 	return s;
+ }
+ 
++extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
++
+ /*
+  * This routine is called by the ICMP module when it gets some
+  * sort of error condition.  If err < 0 then the socket should
+@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
+ 		dport = usin->sin_port;
+ 		if (dport == 0)
+ 			return -EINVAL;
++
++		err = gr_search_udp_sendmsg(sk, usin);
++		if (err)
++			return err;
+ 	} else {
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+ 			return -EDESTADDRREQ;
++
++		err = gr_search_udp_sendmsg(sk, NULL);
++		if (err)
++			return err;
++
+ 		daddr = inet->daddr;
+ 		dport = inet->dport;
+ 		/* Open fast path for connected socket.
+@@ -945,6 +962,10 @@ try_again:
+ 	if (!skb)
+ 		goto out;
+ 
++	err = gr_search_udp_recvmsg(sk, skb);
++	if (err)
++		goto out_free;
++
+ 	ulen = skb->len - sizeof(struct udphdr);
+ 	copied = len;
+ 	if (copied > ulen)
+@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
+ 		goto csum_error;
+ 
+ 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+ 
+ 	/*
+diff -urNp linux-2.6.32.13/net/ipv6/exthdrs.c linux-2.6.32.13/net/ipv6/exthdrs.c
+--- linux-2.6.32.13/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv6/exthdrs.c	2010-05-15 13:21:18.502580406 -0400
+@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
+ 		.type	= IPV6_TLV_JUMBO,
+ 		.func	= ipv6_hop_jumbo,
+ 	},
+-	{ -1, }
++	{ -1, NULL }
+ };
+ 
+ int ipv6_parse_hopopts(struct sk_buff *skb)
+diff -urNp linux-2.6.32.13/net/ipv6/raw.c linux-2.6.32.13/net/ipv6/raw.c
+--- linux-2.6.32.13/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv6/raw.c	2010-05-15 13:21:18.523941597 -0400
+@@ -600,7 +600,7 @@ out:
+ 	return err;
+ }
+ 
+-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
++static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
+ 			struct flowi *fl, struct rt6_info *rt,
+ 			unsigned int flags)
+ {
+diff -urNp linux-2.6.32.13/net/ipv6/tcp_ipv6.c linux-2.6.32.13/net/ipv6/tcp_ipv6.c
+--- linux-2.6.32.13/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv6/tcp_ipv6.c	2010-05-15 13:21:18.734776060 -0400
+@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
+ 	return 0;
+ 
+ reset:
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	tcp_v6_send_reset(sk, skb);
+ discard:
+ 	if (opt_skb)
+@@ -1700,6 +1703,9 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		tcp_v6_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.13/net/ipv6/udp.c linux-2.6.32.13/net/ipv6/udp.c
+--- linux-2.6.32.13/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/ipv6/udp.c	2010-05-15 13:21:18.734776060 -0400
+@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
+ 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+ 				proto == IPPROTO_UDPLITE);
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+ 
+ 		kfree_skb(skb);
+diff -urNp linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c
+--- linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c	2010-05-15 13:21:18.734776060 -0400
+@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
+ 	add_wait_queue(&self->open_wait, &wait);
+ 
+ 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count );
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 	/* As far as I can see, we protect open_count - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	if (!tty_hung_up_p(filp)) {
+ 		extra_count = 1;
+-		self->open_count--;
++		atomic_dec(&self->open_count);
+ 	}
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+-	self->blocked_open++;
++	atomic_inc(&self->blocked_open);
+ 
+ 	while (1) {
+ 		if (tty->termios->c_cflag & CBAUD) {
+@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
+ 		}
+ 
+ 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
+-		      __FILE__,__LINE__, tty->driver->name, self->open_count );
++		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 		schedule();
+ 	}
+@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
+ 	if (extra_count) {
+ 		/* ++ is not atomic, so this should be protected - Jean II */
+ 		spin_lock_irqsave(&self->spinlock, flags);
+-		self->open_count++;
++		atomic_inc(&self->open_count);
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 	}
+-	self->blocked_open--;
++	atomic_dec(&self->blocked_open);
+ 
+ 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count);
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
+ 
+ 	if (!retval)
+ 		self->flags |= ASYNC_NORMAL_ACTIVE;
+@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
+ 	}
+ 	/* ++ is not atomic, so this should be protected - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+-	self->open_count++;
++	atomic_inc(&self->open_count);
+ 
+ 	tty->driver_data = self;
+ 	self->tty = tty;
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
+-		   self->line, self->open_count);
++		   self->line, atomic_read(&self->open_count));
+ 
+ 	/* Not really used by us, but lets do it anyway */
+ 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
+ 		return;
+ 	}
+ 
+-	if ((tty->count == 1) && (self->open_count != 1)) {
++	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
+ 		/*
+ 		 * Uh, oh.  tty->count is 1, which means that the tty
+ 		 * structure will be freed.  state->count should always
+@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
+ 		 */
+ 		IRDA_DEBUG(0, "%s(), bad serial port count; "
+ 			   "tty->count is 1, state->count is %d\n", __func__ ,
+-			   self->open_count);
+-		self->open_count = 1;
++			   atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 1);
+ 	}
+ 
+-	if (--self->open_count < 0) {
++	if (atomic_dec_return(&self->open_count) < 0) {
+ 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
+-			   __func__, self->line, self->open_count);
+-		self->open_count = 0;
++			   __func__, self->line, atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 0);
+ 	}
+-	if (self->open_count) {
++	if (atomic_read(&self->open_count)) {
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
+@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
+ 	tty->closing = 0;
+ 	self->tty = NULL;
+ 
+-	if (self->blocked_open) {
++	if (atomic_read(&self->blocked_open)) {
+ 		if (self->close_delay)
+ 			schedule_timeout_interruptible(self->close_delay);
+ 		wake_up_interruptible(&self->open_wait);
+@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
+ 	self->tty = NULL;
+-	self->open_count = 0;
++	atomic_set(&self->open_count, 0);
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	wake_up_interruptible(&self->open_wait);
+@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
+ 	seq_putc(m, '\n');
+ 
+ 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
+-	seq_printf(m, "Open count: %d\n", self->open_count);
++	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
+ 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
+ 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
+ 
+diff -urNp linux-2.6.32.13/net/mac80211/ieee80211_i.h linux-2.6.32.13/net/mac80211/ieee80211_i.h
+--- linux-2.6.32.13/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.13/net/mac80211/ieee80211_i.h	2010-05-15 13:21:18.734776060 -0400
+@@ -635,7 +635,7 @@ struct ieee80211_local {
+ 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
+ 	spinlock_t queue_stop_reason_lock;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int monitors, cooked_mntrs;
+ 	/* number of interfaces with corresponding FIF_ flags */
+ 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
+diff -urNp linux-2.6.32.13/net/mac80211/iface.c linux-2.6.32.13/net/mac80211/iface.c
+--- linux-2.6.32.13/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/mac80211/iface.c	2010-05-15 13:21:18.734776060 -0400
+@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
+ 		break;
+ 	}
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		res = drv_start(local);
+ 		if (res)
+ 			goto err_del_bss;
+@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
+ 	 * Validate the MAC address for this device.
+ 	 */
+ 	if (!is_valid_ether_addr(dev->dev_addr)) {
+-		if (!local->open_count)
++		if (!atomic_read(&local->open_count))
+ 			drv_stop(local);
+ 		return -EADDRNOTAVAIL;
+ 	}
+@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
+ 
+ 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
+ 
+-	local->open_count++;
++	atomic_inc(&local->open_count);
+ 	if (hw_reconf_flags) {
+ 		ieee80211_hw_config(local, hw_reconf_flags);
+ 		/*
+@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
+  err_del_interface:
+ 	drv_remove_interface(local, &conf);
+  err_stop:
+-	if (!local->open_count)
++	if (!atomic_read(&local->open_count))
+ 		drv_stop(local);
+  err_del_bss:
+ 	sdata->bss = NULL;
+@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
+ 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
+ 	}
+ 
+-	local->open_count--;
++	atomic_dec(&local->open_count);
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
+ 
+ 	ieee80211_recalc_ps(local, -1);
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		ieee80211_clear_tx_pending(local);
+ 		ieee80211_stop_device(local);
+ 
+diff -urNp linux-2.6.32.13/net/mac80211/main.c linux-2.6.32.13/net/mac80211/main.c
+--- linux-2.6.32.13/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.13/net/mac80211/main.c	2010-05-15 13:21:18.734776060 -0400
+@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
+ 		local->hw.conf.power_level = power;
+ 	}
+ 
+-	if (changed && local->open_count) {
++	if (changed && atomic_read(&local->open_count)) {
+ 		ret = drv_config(local, changed);
+ 		/*
+ 		 * Goal:
+diff -urNp linux-2.6.32.13/net/mac80211/pm.c linux-2.6.32.13/net/mac80211/pm.c
+--- linux-2.6.32.13/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/mac80211/pm.c	2010-05-15 13:21:18.734776060 -0400
+@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
+ 	}
+ 
+ 	/* stop hardware - this must stop RX */
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		ieee80211_stop_device(local);
+ 
+ 	local->suspended = true;
+diff -urNp linux-2.6.32.13/net/mac80211/rate.c linux-2.6.32.13/net/mac80211/rate.c
+--- linux-2.6.32.13/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/mac80211/rate.c	2010-05-15 13:21:18.734776060 -0400
+@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
+ 	struct rate_control_ref *ref, *old;
+ 
+ 	ASSERT_RTNL();
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		return -EBUSY;
+ 
+ 	ref = rate_control_alloc(name, local);
+diff -urNp linux-2.6.32.13/net/mac80211/tx.c linux-2.6.32.13/net/mac80211/tx.c
+--- linux-2.6.32.13/net/mac80211/tx.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.13/net/mac80211/tx.c	2010-05-15 13:21:18.734776060 -0400
+@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
+ 	return cpu_to_le16(dur);
+ }
+ 
+-static int inline is_ieee80211_device(struct ieee80211_local *local,
++static inline int is_ieee80211_device(struct ieee80211_local *local,
+ 				      struct net_device *dev)
+ {
+ 	return local == wdev_priv(dev->ieee80211_ptr);
+diff -urNp linux-2.6.32.13/net/mac80211/util.c linux-2.6.32.13/net/mac80211/util.c
+--- linux-2.6.32.13/net/mac80211/util.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.13/net/mac80211/util.c	2010-05-15 13:21:18.734776060 -0400
+@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
+ 		local->resuming = true;
+ 
+ 	/* restart hardware */
+-	if (local->open_count) {
++	if (atomic_read(&local->open_count)) {
+ 		/*
+ 		 * Upon resume hardware can sometimes be goofy due to
+ 		 * various platform / driver / bus issues, so restarting
+ 		 * the device may at times not work immediately. Propagate
+ 		 * the error.
+ 		 */
+-		res = drv_start(local);
++                res = drv_start(local);
+ 		if (res) {
+ 			WARN(local->suspended, "Harware became unavailable "
+ 			     "upon resume. This is could be a software issue"
+diff -urNp linux-2.6.32.13/net/sctp/socket.c linux-2.6.32.13/net/sctp/socket.c
+--- linux-2.6.32.13/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/sctp/socket.c	2010-05-15 13:21:18.788974801 -0400
+@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
+ 	struct sctp_sndrcvinfo *sinfo;
+ 	struct sctp_initmsg *sinit;
+ 	sctp_assoc_t associd = 0;
+-	sctp_cmsgs_t cmsgs = { NULL };
++	sctp_cmsgs_t cmsgs = { NULL, NULL };
+ 	int err;
+ 	sctp_scope_t scope;
+ 	long timeo;
+@@ -5802,7 +5802,6 @@ pp_found:
+ 		 */
+ 		int reuse = sk->sk_reuse;
+ 		struct sock *sk2;
+-		struct hlist_node *node;
+ 
+ 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
+ 		if (pp->fastreuse && sk->sk_reuse &&
+diff -urNp linux-2.6.32.13/net/socket.c linux-2.6.32.13/net/socket.c
+--- linux-2.6.32.13/net/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/socket.c	2010-05-15 13:21:18.788974801 -0400
+@@ -87,6 +87,7 @@
+ #include <linux/wireless.h>
+ #include <linux/nsproxy.h>
+ #include <linux/magic.h>
++#include <linux/in.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/unistd.h>
+@@ -97,6 +98,21 @@
+ #include <net/sock.h>
+ #include <linux/netfilter.h>
+ 
++extern void gr_attach_curr_ip(const struct sock *sk);
++extern int gr_handle_sock_all(const int family, const int type,
++			      const int protocol);
++extern int gr_handle_sock_server(const struct sockaddr *sck);
++extern int gr_handle_sock_server_other(const struct socket *sck);
++extern int gr_handle_sock_client(const struct sockaddr *sck);
++extern int gr_search_connect(struct socket * sock,
++			     struct sockaddr_in * addr);
++extern int gr_search_bind(struct socket * sock,
++			  struct sockaddr_in * addr);
++extern int gr_search_listen(struct socket * sock);
++extern int gr_search_accept(struct socket * sock);
++extern int gr_search_socket(const int domain, const int type,
++			    const int protocol);
++
+ static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
+ static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ 			 unsigned long nr_segs, loff_t pos);
+@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
+ 			     mnt);
+ }
+ 
+-static struct vfsmount *sock_mnt __read_mostly;
++struct vfsmount *sock_mnt __read_mostly;
+ 
+ static struct file_system_type sock_fs_type = {
+ 	.name =		"sockfs",
+@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
+ 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+ 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
+ 
++	if(!gr_search_socket(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_handle_sock_all(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
+ 	retval = sock_create(family, type, protocol, &sock);
+ 	if (retval < 0)
+ 		goto out;
+@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 	if (sock) {
+ 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
+ 		if (err >= 0) {
++			if (gr_handle_sock_server((struct sockaddr *)&address)) {
++				err = -EACCES;
++				goto error;
++			}
++			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
++			if (err)
++				goto error;
++
+ 			err = security_socket_bind(sock,
+ 						   (struct sockaddr *)&address,
+ 						   addrlen);
+@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 						      (struct sockaddr *)
+ 						      &address, addrlen);
+ 		}
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
+ 		if ((unsigned)backlog > somaxconn)
+ 			backlog = somaxconn;
+ 
++		if (gr_handle_sock_server_other(sock)) {
++			err = -EPERM;
++			goto error;
++		}
++
++		err = gr_search_listen(sock);
++		if (err)
++			goto error;
++
+ 		err = security_socket_listen(sock, backlog);
+ 		if (!err)
+ 			err = sock->ops->listen(sock, backlog);
+ 
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	newsock->type = sock->type;
+ 	newsock->ops = sock->ops;
+ 
++	if (gr_handle_sock_server_other(sock)) {
++		err = -EPERM;
++		sock_release(newsock);
++		goto out_put;
++	}
++
++	err = gr_search_accept(sock);
++	if (err) {
++		sock_release(newsock);
++		goto out_put;
++	}
++
+ 	/*
+ 	 * We don't need try_module_get here, as the listening socket (sock)
+ 	 * has the protocol module (sock->ops->owner) held.
+@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	fd_install(newfd, newfile);
+ 	err = newfd;
+ 
++	gr_attach_curr_ip(newsock->sk);
++
+ out_put:
+ 	fput_light(sock->file, fput_needed);
+ out:
+@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 		int, addrlen)
+ {
+ 	struct socket *sock;
++	struct sockaddr *sck;
+ 	struct sockaddr_storage address;
+ 	int err, fput_needed;
+ 
+@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 	if (err < 0)
+ 		goto out_put;
+ 
++	sck = (struct sockaddr *)&address;
++
++	if (gr_handle_sock_client(sck)) {
++		err = -EACCES;
++		goto out_put;
++	}
++
++	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
++	if (err)
++		goto out_put;
++
+ 	err =
+ 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
+ 	if (err)
+diff -urNp linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c
+--- linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c	2010-05-15 13:21:18.790642809 -0400
+@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
+ 		len -= *ppos;
+ 		if (len > *lenp)
+ 			len = *lenp;
+-		if (len && copy_to_user(buffer, str_buf, len))
++		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
+ 			return -EFAULT;
+ 		*lenp = len;
+ 		*ppos += len;
+diff -urNp linux-2.6.32.13/net/sysctl_net.c linux-2.6.32.13/net/sysctl_net.c
+--- linux-2.6.32.13/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/sysctl_net.c	2010-05-15 13:21:18.790642809 -0400
+@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
+ 			       struct ctl_table *table)
+ {
+ 	/* Allow network administrator to have same access as root. */
+-	if (capable(CAP_NET_ADMIN)) {
++	if (capable_nolog(CAP_NET_ADMIN)) {
+ 		int mode = (table->mode >> 6) & 7;
+ 		return (mode << 6) | (mode << 3) | mode;
+ 	}
+diff -urNp linux-2.6.32.13/net/tipc/socket.c linux-2.6.32.13/net/tipc/socket.c
+--- linux-2.6.32.13/net/tipc/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/tipc/socket.c	2010-05-15 13:21:18.790642809 -0400
+@@ -1449,8 +1449,9 @@ static int connect(struct socket *sock, 
+ 	} else {
+ 		if (res == 0)
+ 			res = -ETIMEDOUT;
+-		else
+-			; /* leave "res" unchanged */
++		else {
++			/* leave "res" unchanged */
++		}
+ 		sock->state = SS_DISCONNECTING;
+ 	}
+ 
+diff -urNp linux-2.6.32.13/net/unix/af_unix.c linux-2.6.32.13/net/unix/af_unix.c
+--- linux-2.6.32.13/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/unix/af_unix.c	2010-05-15 13:21:18.790642809 -0400
+@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
+ 		err = -ECONNREFUSED;
+ 		if (!S_ISSOCK(inode->i_mode))
+ 			goto put_fail;
++
++		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
++			err = -EACCES;
++			goto put_fail;
++		}
++
+ 		u = unix_find_socket_byinode(net, inode);
+ 		if (!u)
+ 			goto put_fail;
+@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
+ 		if (u) {
+ 			struct dentry *dentry;
+ 			dentry = unix_sk(u)->dentry;
++
++			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
++				err = -EPERM;
++				sock_put(u);
++				goto fail;
++			}
++
+ 			if (dentry)
+ 				touch_atime(unix_sk(u)->mnt, dentry);
+ 		} else
+@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
+ 		err = security_path_mknod(&nd.path, dentry, mode, 0);
+ 		if (err)
+ 			goto out_mknod_drop_write;
++		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++			err = -EACCES;
++			goto out_mknod_drop_write;
++		}
+ 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
+ out_mknod_drop_write:
+ 		mnt_drop_write(nd.path.mnt);
+ 		if (err)
+ 			goto out_mknod_dput;
++
++		gr_handle_create(dentry, nd.path.mnt);
++
+ 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+ 		dput(nd.path.dentry);
+ 		nd.path.dentry = dentry;
+@@ -861,6 +881,10 @@ out_mknod_drop_write:
+ 			goto out_unlock;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++		sk->sk_peercred.pid = current->pid;
++#endif
++
+ 		list = &unix_socket_table[addr->hash];
+ 	} else {
+ 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
+diff -urNp linux-2.6.32.13/net/xfrm/xfrm_policy.c linux-2.6.32.13/net/xfrm/xfrm_policy.c
+--- linux-2.6.32.13/net/xfrm/xfrm_policy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/net/xfrm/xfrm_policy.c	2010-05-15 13:21:18.790642809 -0400
+@@ -1477,7 +1477,7 @@ free_dst:
+ 	goto out;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_alloc_copy(void **target, void *src, int size)
+ {
+ 	if (!*target) {
+@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void 
+ 	return 0;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry 
+ #endif
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+diff -urNp linux-2.6.32.13/samples/kobject/kset-example.c linux-2.6.32.13/samples/kobject/kset-example.c
+--- linux-2.6.32.13/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/samples/kobject/kset-example.c	2010-05-15 13:21:18.790642809 -0400
+@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
+ }
+ 
+ /* Our custom sysfs_ops that we will associate with our ktype later on */
+-static struct sysfs_ops foo_sysfs_ops = {
++static const struct sysfs_ops foo_sysfs_ops = {
+ 	.show = foo_attr_show,
+ 	.store = foo_attr_store,
+ };
+diff -urNp linux-2.6.32.13/scripts/basic/fixdep.c linux-2.6.32.13/scripts/basic/fixdep.c
+--- linux-2.6.32.13/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/basic/fixdep.c	2010-05-15 13:21:18.790642809 -0400
+@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
+ 
+ static void parse_config_file(char *map, size_t len)
+ {
+-	int *end = (int *) (map + len);
++	unsigned int *end = (unsigned int *) (map + len);
+ 	/* start at +1, so that p can never be < map */
+-	int *m   = (int *) map + 1;
++	unsigned int *m   = (unsigned int *) map + 1;
+ 	char *p, *q;
+ 
+ 	for (; m < end; m++) {
+@@ -371,7 +371,7 @@ static void print_deps(void)
+ static void traps(void)
+ {
+ 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
+-	int *p = (int *)test;
++	unsigned int *p = (unsigned int *)test;
+ 
+ 	if (*p != INT_CONF) {
+ 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
+diff -urNp linux-2.6.32.13/scripts/kallsyms.c linux-2.6.32.13/scripts/kallsyms.c
+--- linux-2.6.32.13/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/kallsyms.c	2010-05-15 13:21:18.790642809 -0400
+@@ -43,10 +43,10 @@ struct text_range {
+ 
+ static unsigned long long _text;
+ static struct text_range text_ranges[] = {
+-	{ "_stext",     "_etext"     },
+-	{ "_sinittext", "_einittext" },
+-	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
+-	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
++	{ "_stext",     "_etext",     0, 0 },
++	{ "_sinittext", "_einittext", 0, 0 },
++	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
++	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
+ };
+ #define text_range_text     (&text_ranges[0])
+ #define text_range_inittext (&text_ranges[1])
+diff -urNp linux-2.6.32.13/scripts/mod/file2alias.c linux-2.6.32.13/scripts/mod/file2alias.c
+--- linux-2.6.32.13/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/mod/file2alias.c	2010-05-15 13:21:18.790642809 -0400
+@@ -72,7 +72,7 @@ static void device_id_check(const char *
+ 			    unsigned long size, unsigned long id_size,
+ 			    void *symval)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	if (size % id_size || size < id_size) {
+ 		if (cross_build != 0)
+@@ -102,7 +102,7 @@ static void device_id_check(const char *
+ /* USB is special because the bcdDevice can be matched against a numeric range */
+ /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
+ static void do_usb_entry(struct usb_device_id *id,
+-			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
++			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
+ 			 unsigned char range_lo, unsigned char range_hi,
+ 			 struct module *mod)
+ {
+@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
+ 	for (i = 0; i < count; i++) {
+ 		const char *id = (char *)devs[i].id;
+ 		char acpi_id[sizeof(devs[0].id)];
+-		int j;
++		unsigned int j;
+ 
+ 		buf_printf(&mod->dev_table_buf,
+ 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
+ 
+ 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
+ 			const char *id = (char *)card->devs[j].id;
+-			int i2, j2;
++			unsigned int i2, j2;
+ 			int dup = 0;
+ 
+ 			if (!id[0])
+@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
+ 			/* add an individual alias for every device entry */
+ 			if (!dup) {
+ 				char acpi_id[sizeof(card->devs[0].id)];
+-				int k;
++				unsigned int k;
+ 
+ 				buf_printf(&mod->dev_table_buf,
+ 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
+ static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
+ 			char *alias)
+ {
+-	int i, j;
++	unsigned int i, j;
+ 
+ 	sprintf(alias, "dmi*");
+ 
+diff -urNp linux-2.6.32.13/scripts/mod/modpost.c linux-2.6.32.13/scripts/mod/modpost.c
+--- linux-2.6.32.13/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/mod/modpost.c	2010-05-15 13:21:18.814648703 -0400
+@@ -835,6 +835,7 @@ enum mismatch {
+ 	INIT_TO_EXIT,
+ 	EXIT_TO_INIT,
+ 	EXPORT_TO_INIT_EXIT,
++	DATA_TO_TEXT
+ };
+ 
+ struct sectioncheck {
+@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
+ 	.fromsec = { "__ksymtab*", NULL },
+ 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
+ 	.mismatch = EXPORT_TO_INIT_EXIT
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.tosec   = { TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+ 
+@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
+ 			continue;
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ 			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+ 		/* Find a symbol nearby - addr are maybe negative */
+ 		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+ 		if (d < 0)
+ 			d = addr - sym->st_value;
+ 		if (d < distance) {
+@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
+ 		"Fix this by removing the %sannotation of %s "
+ 		"or drop the export.\n",
+ 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
++	case DATA_TO_TEXT:
++/*
++		fprintf(stderr,
++		"The variable %s references\n"
++		"the %s %s%s%s\n",
++		fromsym, to, sec2annotation(tosec), tosym, to_p);
++*/
++		break;
+ 	case NO_MISMATCH:
+ 		/* To get warnings on missing members */
+ 		break;
+@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
+ 	va_end(ap);
+ }
+ 
+-void buf_write(struct buffer *buf, const char *s, int len)
++void buf_write(struct buffer *buf, const char *s, unsigned int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
+ 	if (fstat(fileno(file), &st) < 0)
+ 		goto close_write;
+ 
+-	if (st.st_size != b->pos)
++	if (st.st_size != (off_t)b->pos)
+ 		goto close_write;
+ 
+ 	tmp = NOFAIL(malloc(b->pos));
+diff -urNp linux-2.6.32.13/scripts/mod/modpost.h linux-2.6.32.13/scripts/mod/modpost.h
+--- linux-2.6.32.13/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/mod/modpost.h	2010-05-15 13:21:18.814648703 -0400
+@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
+ 
+ struct buffer {
+ 	char *p;
+-	int pos;
+-	int size;
++	unsigned int pos;
++	unsigned int size;
+ };
+ 
+ void __attribute__((format(printf, 2, 3)))
+ buf_printf(struct buffer *buf, const char *fmt, ...);
+ 
+ void
+-buf_write(struct buffer *buf, const char *s, int len);
++buf_write(struct buffer *buf, const char *s, unsigned int len);
+ 
+ struct module {
+ 	struct module *next;
+diff -urNp linux-2.6.32.13/scripts/mod/sumversion.c linux-2.6.32.13/scripts/mod/sumversion.c
+--- linux-2.6.32.13/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/mod/sumversion.c	2010-05-15 13:21:18.814648703 -0400
+@@ -455,7 +455,7 @@ static void write_version(const char *fi
+ 		goto out;
+ 	}
+ 
+-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
++	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
+ 		warn("writing sum in %s failed: %s\n",
+ 			filename, strerror(errno));
+ 		goto out;
+diff -urNp linux-2.6.32.13/scripts/pnmtologo.c linux-2.6.32.13/scripts/pnmtologo.c
+--- linux-2.6.32.13/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/scripts/pnmtologo.c	2010-05-15 13:21:18.814648703 -0400
+@@ -237,14 +237,14 @@ static void write_header(void)
+     fprintf(out, " *  Linux logo %s\n", logoname);
+     fputs(" */\n\n", out);
+     fputs("#include <linux/linux_logo.h>\n\n", out);
+-    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_data[] = {\n",
+ 	    logoname);
+ }
+ 
+ static void write_footer(void)
+ {
+     fputs("\n};\n\n", out);
+-    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
++    fprintf(out, "const struct linux_logo %s = {\n", logoname);
+     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
+     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
+     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
+@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
+     fputs("\n};\n\n", out);
+ 
+     /* write logo clut */
+-    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_clut[] = {\n",
+ 	    logoname);
+     write_hex_cnt = 0;
+     for (i = 0; i < logo_clutsize; i++) {
+diff -urNp linux-2.6.32.13/security/commoncap.c linux-2.6.32.13/security/commoncap.c
+--- linux-2.6.32.13/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/commoncap.c	2010-05-15 13:21:18.814648703 -0400
+@@ -27,7 +27,7 @@
+ #include <linux/sched.h>
+ #include <linux/prctl.h>
+ #include <linux/securebits.h>
+-
++#include <net/sock.h>
+ /*
+  * If a non-root user executes a setuid-root binary in
+  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
+@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
+ 	}
+ }
+ 
++extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
++
+ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
+ {
+-	NETLINK_CB(skb).eff_cap = current_cap();
++	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.13/security/integrity/ima/ima_api.c linux-2.6.32.13/security/integrity/ima/ima_api.c
+--- linux-2.6.32.13/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/integrity/ima/ima_api.c	2010-05-15 13:21:18.814648703 -0400
+@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
+ 	int result;
+ 
+ 	/* can overflow, only indicator */
+-	atomic_long_inc(&ima_htable.violations);
++	atomic_long_inc_unchecked(&ima_htable.violations);
+ 
+ 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ 	if (!entry) {
+diff -urNp linux-2.6.32.13/security/integrity/ima/ima_fs.c linux-2.6.32.13/security/integrity/ima/ima_fs.c
+--- linux-2.6.32.13/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/integrity/ima/ima_fs.c	2010-05-15 13:21:18.814648703 -0400
+@@ -27,12 +27,12 @@
+ static int valid_policy = 1;
+ #define TMPBUFLEN 12
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+-				     loff_t *ppos, atomic_long_t *val)
++				     loff_t *ppos, atomic_long_unchecked_t *val)
+ {
+ 	char tmpbuf[TMPBUFLEN];
+ 	ssize_t len;
+ 
+-	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
+ 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+ 
+diff -urNp linux-2.6.32.13/security/integrity/ima/ima.h linux-2.6.32.13/security/integrity/ima/ima.h
+--- linux-2.6.32.13/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/integrity/ima/ima.h	2010-05-15 13:21:18.814648703 -0400
+@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
+ extern spinlock_t ima_queue_lock;
+ 
+ struct ima_h_table {
+-	atomic_long_t len;	/* number of stored measurements in the list */
+-	atomic_long_t violations;
++	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
++	atomic_long_unchecked_t violations;
+ 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
+ };
+ extern struct ima_h_table ima_htable;
+diff -urNp linux-2.6.32.13/security/integrity/ima/ima_queue.c linux-2.6.32.13/security/integrity/ima/ima_queue.c
+--- linux-2.6.32.13/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/integrity/ima/ima_queue.c	2010-05-15 13:21:18.814648703 -0400
+@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
+ 	INIT_LIST_HEAD(&qe->later);
+ 	list_add_tail_rcu(&qe->later, &ima_measurements);
+ 
+-	atomic_long_inc(&ima_htable.len);
++	atomic_long_inc_unchecked(&ima_htable.len);
+ 	key = ima_hash_key(entry->digest);
+ 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+ 	return 0;
+diff -urNp linux-2.6.32.13/security/Kconfig linux-2.6.32.13/security/Kconfig
+--- linux-2.6.32.13/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/security/Kconfig	2010-05-15 13:37:07.058702111 -0400
+@@ -4,6 +4,499 @@
+ 
+ menu "Security options"
+ 
++source grsecurity/Kconfig
++
++menu "PaX"
++
++	config PAX_PER_CPU_PGD
++	bool
++
++	config TASK_SIZE_MAX_SHIFT
++	int
++	depends on X86_64
++	default 47 if !PAX_PER_CPU_PGD
++	default 42 if PAX_PER_CPU_PGD
++
++config PAX
++	bool "Enable various PaX features"
++	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
++	help
++	  This allows you to enable various PaX features.  PaX adds
++	  intrusion prevention mechanisms to the kernel that reduce
++	  the risks posed by exploitable memory corruption bugs.
++
++menu "PaX Control"
++	depends on PAX
++
++config PAX_SOFTMODE
++	bool 'Support soft mode'
++	select PAX_PT_PAX_FLAGS
++	help
++	  Enabling this option will allow you to run PaX in soft mode, that
++	  is, PaX features will not be enforced by default, only on executables
++	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
++	  is the only way to mark executables for soft mode use.
++
++	  Soft mode can be activated by using the "pax_softmode=1" kernel command
++	  line option on boot.  Furthermore you can control various PaX features
++	  at runtime via the entries in /proc/sys/kernel/pax.
++
++config PAX_EI_PAX
++	bool 'Use legacy ELF header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'chpax' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  an otherwise reserved part of the ELF header.  This marking has
++	  numerous drawbacks (no support for soft-mode, toolchain does not
++	  know about the non-standard use of the ELF header) therefore it
++	  has been deprecated in favour of PT_PAX_FLAGS support.
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable this option otherwise they
++	  will not get any protection.
++
++	  Note that if you enable PT_PAX_FLAGS marking support as well,
++	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
++
++config PAX_PT_PAX_FLAGS
++	bool 'Use ELF program header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'paxctl' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
++	  has the benefits of supporting both soft mode and being fully
++	  integrated into the toolchain (the binutils patch is available
++	  from http://pax.grsecurity.net).
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable the EI_PAX marking support
++	  otherwise they will not get any protection.
++
++	  Note that if you enable the legacy EI_PAX marking support as well,
++	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
++
++choice
++	prompt 'MAC system integration'
++	default PAX_HAVE_ACL_FLAGS
++	help
++	  Mandatory Access Control systems have the option of controlling
++	  PaX flags on a per executable basis, choose the method supported
++	  by your particular system.
++
++	  - "none": if your MAC system does not interact with PaX,
++	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
++	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
++
++	  NOTE: this option is for developers/integrators only.
++
++	config PAX_NO_ACL_FLAGS
++		bool 'none'
++
++	config PAX_HAVE_ACL_FLAGS
++		bool 'direct'
++
++	config PAX_HOOK_ACL_FLAGS
++		bool 'hook'
++endchoice
++
++endmenu
++
++menu "Non-executable pages"
++	depends on PAX
++
++config PAX_NOEXEC
++	bool "Enforce non-executable pages"
++	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
++	help
++	  By design some architectures do not allow for protecting memory
++	  pages against execution or even if they do, Linux does not make
++	  use of this feature.  In practice this means that if a page is
++	  readable (such as the stack or heap) it is also executable.
++
++	  There is a well known exploit technique that makes use of this
++	  fact and a common programming mistake where an attacker can
++	  introduce code of his choice somewhere in the attacked program's
++	  memory (typically the stack or the heap) and then execute it.
++
++	  If the attacked program was running with different (typically
++	  higher) privileges than that of the attacker, then he can elevate
++	  his own privilege level (e.g. get a root shell, write to files for
++	  which he does not have write access to, etc).
++
++	  Enabling this option will let you choose from various features
++	  that prevent the injection and execution of 'foreign' code in
++	  a program.
++
++	  This will also break programs that rely on the old behaviour and
++	  expect that dynamically allocated memory via the malloc() family
++	  of functions is executable (which it is not).  Notable examples
++	  are the XFree86 4.x server, the java runtime and wine.
++
++config PAX_PAGEEXEC
++	bool "Paging based non-executable pages"
++	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
++	select S390_SWITCH_AMODE if S390
++	select S390_EXEC_PROTECT if S390
++	help
++	  This implementation is based on the paging feature of the CPU.
++	  On i386 without hardware non-executable bit support there is a
++	  variable but usually low performance impact, however on Intel's
++	  P4 core based CPUs it is very high so you should not enable this
++	  for kernels meant to be used on such CPUs.
++
++	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
++	  with hardware non-executable bit support there is no performance
++	  impact, on ppc the impact is negligible.
++
++	  Note that several architectures require various emulations due to
++	  badly designed userland ABIs, this will cause a performance impact
++	  but will disappear as soon as userland is fixed. For example, ppc
++	  userland MUST have been built with secure-plt by a recent toolchain.
++
++config PAX_SEGMEXEC
++	bool "Segmentation based non-executable pages"
++	depends on PAX_NOEXEC && X86_32
++	help
++	  This implementation is based on the segmentation feature of the
++	  CPU and has a very small performance impact, however applications
++	  will be limited to a 1.5 GB address space instead of the normal
++	  3 GB.
++
++config PAX_EMUTRAMP
++	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
++	default y if PARISC
++	help
++	  There are some programs and libraries that for one reason or
++	  another attempt to execute special small code snippets from
++	  non-executable memory pages.  Most notable examples are the
++	  signal handler return code generated by the kernel itself and
++	  the GCC trampolines.
++
++	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
++	  such programs will no longer work under your kernel.
++
++	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
++	  utilities to enable trampoline emulation for the affected programs
++	  yet still have the protection provided by the non-executable pages.
++
++	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
++	  your system will not even boot.
++
++	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
++	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
++	  for the affected files.
++
++	  NOTE: enabling this feature *may* open up a loophole in the
++	  protection provided by non-executable pages that an attacker
++	  could abuse.  Therefore the best solution is to not have any
++	  files on your system that would require this option.  This can
++	  be achieved by not using libc5 (which relies on the kernel
++	  signal handler return code) and not using or rewriting programs
++	  that make use of the nested function implementation of GCC.
++	  Skilled users can just fix GCC itself so that it implements
++	  nested function calls in a way that does not interfere with PaX.
++
++config PAX_EMUSIGRT
++	bool "Automatically emulate sigreturn trampolines"
++	depends on PAX_EMUTRAMP && PARISC
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate signal return trampolines executing on the stack
++	  that would otherwise lead to task termination.
++
++	  This solution is intended as a temporary one for users with
++	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
++	  Modula-3 runtime, etc) or executables linked to such, basically
++	  everything that does not specify its own SA_RESTORER function in
++	  normal executable memory like glibc 2.1+ does.
++
++	  On parisc you MUST enable this option, otherwise your system will
++	  not even boot.
++
++	  NOTE: this feature cannot be disabled on a per executable basis
++	  and since it *does* open up a loophole in the protection provided
++	  by non-executable pages, the best solution is to not have any
++	  files on your system that would require this option.
++
++config PAX_MPROTECT
++	bool "Restrict mprotect()"
++	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
++	help
++	  Enabling this option will prevent programs from
++	   - changing the executable status of memory pages that were
++	     not originally created as executable,
++	   - making read-only executable pages writable again,
++	   - creating executable pages from anonymous memory.
++
++	  You should say Y here to complete the protection provided by
++	  the enforcement of non-executable pages.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_NOELFRELOCS
++	bool "Disallow ELF text relocations"
++	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
++	help
++	  Non-executable pages and mprotect() restrictions are effective
++	  in preventing the introduction of new executable code into an
++	  attacked task's address space.  There remain only two venues
++	  for this kind of attack: if the attacker can execute already
++	  existing code in the attacked task then he can either have it
++	  create and mmap() a file containing his code or have it mmap()
++	  an already existing ELF library that does not have position
++	  independent code in it and use mprotect() on it to make it
++	  writable and copy his code there.  While protecting against
++	  the former approach is beyond PaX, the latter can be prevented
++	  by having only PIC ELF libraries on one's system (which do not
++	  need to relocate their code).  If you are sure this is your case,
++	  then enable this option otherwise be careful as you may not even
++	  be able to boot or log on your system (for example, some PAM
++	  modules are erroneously compiled as non-PIC by default).
++
++	  NOTE: if you are using dynamic ELF executables (as suggested
++	  when using ASLR) then you must have made sure that you linked
++	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
++	  referenced there has already been updated to support this).
++
++config PAX_ETEXECRELOCS
++	bool "Allow ELF ET_EXEC text relocations"
++	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
++	default y
++	help
++	  On some architectures there are incorrectly created applications
++	  that require text relocations and would not work without enabling
++	  this option.  If you are an alpha, ia64 or parisc user, you should
++	  enable this option and disable it once you have made sure that
++	  none of your applications need it.
++
++config PAX_EMUPLT
++	bool "Automatically emulate ELF PLT"
++	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate the Procedure Linkage Table entries in ELF files.
++	  On some architectures such entries are in writable memory, and
++	  become non-executable leading to task termination.  Therefore
++	  it is mandatory that you enable this option on alpha, parisc,
++	  sparc and sparc64, otherwise your system would not even boot.
++
++	  NOTE: this feature *does* open up a loophole in the protection
++	  provided by the non-executable pages, therefore the proper
++	  solution is to modify the toolchain to produce a PLT that does
++	  not need to be writable.
++
++config PAX_DLRESOLVE
++	bool 'Emulate old glibc resolver stub'
++	depends on PAX_EMUPLT && SPARC
++	default n
++	help
++	  This option is needed if userland has an old glibc (before 2.4)
++	  that puts a 'save' instruction into the runtime generated resolver
++	  stub that needs special emulation.
++
++config PAX_KERNEXEC
++	bool "Enforce non-executable kernel pages"
++	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
++	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
++	help
++	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
++	  that is, enabling this option will make it harder to inject
++	  and execute 'foreign' code in kernel memory itself.
++
++config PAX_KERNEXEC_MODULE_TEXT
++	int "Minimum amount of memory reserved for module code"
++	default "4"
++	depends on PAX_KERNEXEC && X86_32 && MODULES
++	help
++	  Due to implementation details the kernel must reserve a fixed
++	  amount of memory for module code at compile time that cannot be
++	  changed at runtime.  Here you can specify the minimum amount
++	  in MB that will be reserved.  Due to the same implementation
++	  details this size will always be rounded up to the next 2/4 MB
++	  boundary (depends on PAE) so the actually available memory for
++	  module code will usually be more than this minimum.
++
++	  The default 4 MB should be enough for most users but if you have
++	  an excessive number of modules (e.g., most distribution configs
++	  compile many drivers as modules) or use huge modules such as
++	  nvidia's kernel driver, you will need to adjust this amount.
++	  A good rule of thumb is to look at your currently loaded kernel
++	  modules and add up their sizes.
++
++endmenu
++
++menu "Address Space Layout Randomization"
++	depends on PAX
++
++config PAX_ASLR
++	bool "Address Space Layout Randomization"
++	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
++	help
++	  Many if not most exploit techniques rely on the knowledge of
++	  certain addresses in the attacked program.  The following options
++	  will allow the kernel to apply a certain amount of randomization
++	  to specific parts of the program thereby forcing an attacker to
++	  guess them in most cases.  Any failed guess will most likely crash
++	  the attacked program which allows the kernel to detect such attempts
++	  and react on them.  PaX itself provides no reaction mechanisms,
++	  instead it is strongly encouraged that you make use of Nergal's
++	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
++	  (http://www.grsecurity.net/) built-in crash detection features or
++	  develop one yourself.
++
++	  By saying Y here you can choose to randomize the following areas:
++	   - top of the task's kernel stack
++	   - top of the task's userland stack
++	   - base address for mmap() requests that do not specify one
++	     (this includes all libraries)
++	   - base address of the main executable
++
++	  It is strongly recommended to say Y here as address space layout
++	  randomization has negligible impact on performance yet it provides
++	  a very effective protection.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_RANDKSTACK
++	bool "Randomize kernel stack base"
++	depends on PAX_ASLR && X86_TSC && X86_32
++	help
++	  By saying Y here the kernel will randomize every task's kernel
++	  stack on every system call.  This will not only force an attacker
++	  to guess it but also prevent him from making use of possible
++	  leaked information about it.
++
++	  Since the kernel stack is a rather scarce resource, randomization
++	  may cause unexpected stack overflows, therefore you should very
++	  carefully test your system.  Note that once enabled in the kernel
++	  configuration, this feature cannot be disabled on a per file basis.
++
++config PAX_RANDUSTACK
++	bool "Randomize user stack base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will randomize every task's userland
++	  stack.  The randomization is done in two steps where the second
++	  one may apply a big amount of shift to the top of the stack and
++	  cause problems for programs that want to use lots of memory (more
++	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
++	  For this reason the second step can be controlled by 'chpax' or
++	  'paxctl' on a per file basis.
++
++config PAX_RANDMMAP
++	bool "Randomize mmap() base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will use a randomized base address for
++	  mmap() requests that do not specify one themselves.  As a result
++	  all dynamically loaded libraries will appear at random addresses
++	  and therefore be harder to exploit by a technique where an attacker
++	  attempts to execute library code for his purposes (e.g. spawn a
++	  shell from an exploited program that is running at an elevated
++	  privilege level).
++
++	  Furthermore, if a program is relinked as a dynamic ELF file, its
++	  base address will be randomized as well, completing the full
++	  randomization of the address space layout.  Attacking such programs
++	  becomes a guess game.  You can find an example of doing this at
++	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
++	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
++	  feature on a per file basis.
++
++endmenu
++
++menu "Miscellaneous hardening features"
++
++config PAX_MEMORY_SANITIZE
++	bool "Sanitize all freed memory"
++	help
++	  By saying Y here the kernel will erase memory pages as soon as they
++	  are freed.  This in turn reduces the lifetime of data stored in the
++	  pages, making it less likely that sensitive information such as
++	  passwords, cryptographic secrets, etc stay in memory for too long.
++
++	  This is especially useful for programs whose runtime is short, long
++	  lived processes and the kernel itself benefit from this as long as
++	  they operate on whole memory pages and ensure timely freeing of pages
++	  that may hold sensitive information.
++
++	  The tradeoff is performance impact, on a single CPU system kernel
++	  compilation sees a 3% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
++
++	  Note that this feature does not protect data stored in live pages,
++	  e.g., process memory swapped to disk may stay there for a long time.
++
++config PAX_MEMORY_UDEREF
++	bool "Prevent invalid userland pointer dereference"
++	depends on X86 && !UML_X86 && !XEN
++	select PAX_PER_CPU_PGD if X86_64
++	help
++	  By saying Y here the kernel will be prevented from dereferencing
++	  userland pointers in contexts where the kernel expects only kernel
++	  pointers.  This is both a useful runtime debugging feature and a
++	  security measure that prevents exploiting a class of kernel bugs.
++
++	  The tradeoff is that some virtualization solutions may experience
++	  a huge slowdown and therefore you should not enable this feature
++	  for kernels meant to run in such environments.  Whether a given VM
++	  solution is affected or not is best determined by simply trying it
++	  out, the performance impact will be obvious right on boot as this
++	  mechanism engages from very early on.  A good rule of thumb is that
++	  VMs running on CPUs without hardware virtualization support (i.e.,
++	  the majority of IA-32 CPUs) will likely experience the slowdown.
++
++config PAX_REFCOUNT
++	bool "Prevent various kernel object reference counter overflows"
++	depends on GRKERNSEC && (X86 || SPARC64)
++	help
++	  By saying Y here the kernel will detect and prevent overflowing
++	  various (but not all) kinds of object reference counters.  Such
++	  overflows can normally occur due to bugs only and are often, if
++	  not always, exploitable.
++
++	  The tradeoff is that data structures protected by an overflowed
++	  refcount will never be freed and therefore will leak memory.  Note
++	  that this leak also happens even without this protection but in
++	  that case the overflow can eventually trigger the freeing of the
++	  data structure while it is still being used elsewhere, resulting
++	  in the exploitable situation that this feature prevents.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++
++config PAX_USERCOPY
++	bool "Bounds check heap object copies between kernel and userland"
++	depends on X86 || PPC || SPARC
++	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++	help
++	  By saying Y here the kernel will enforce the size of heap objects
++	  when they are copied in either direction between the kernel and
++	  userland, even if only a part of the heap object is copied.
++
++	  Specifically, this checking prevents information leaking from the
++	  kernel heap during kernel to userland copies (if the kernel heap
++	  object is otherwise fully initialized) and prevents kernel heap
++	  overflows during userland to kernel copies.
++
++	  Note that the current implementation provides the strictest checks
++	  for the SLUB allocator.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++endmenu
++
++endmenu
++
+ config KEYS
+ 	bool "Enable access key retention support"
+ 	help
+@@ -146,7 +639,7 @@ config INTEL_TXT
+ config LSM_MMAP_MIN_ADDR
+ 	int "Low address space for LSM to protect from user allocation"
+ 	depends on SECURITY && SECURITY_SELINUX
+-	default 65536
++	default 32768
+ 	help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.13/security/min_addr.c linux-2.6.32.13/security/min_addr.c
+--- linux-2.6.32.13/security/min_addr.c	2010-04-04 20:41:50.084493253 -0400
++++ linux-2.6.32.13/security/min_addr.c	2010-05-15 13:21:18.814648703 -0400
+@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
+  */
+ static void update_mmap_min_addr(void)
+ {
++#ifndef SPARC
+ #ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ 		mmap_min_addr = dac_mmap_min_addr;
+@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
+ #else
+ 	mmap_min_addr = dac_mmap_min_addr;
+ #endif
++#endif
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.13/sound/aoa/codecs/onyx.c linux-2.6.32.13/sound/aoa/codecs/onyx.c
+--- linux-2.6.32.13/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/aoa/codecs/onyx.c	2010-05-15 13:21:18.814648703 -0400
+@@ -53,7 +53,7 @@ struct onyx {
+ 				spdif_locked:1,
+ 				analog_locked:1,
+ 				original_mute:2;
+-	int			open_count;
++	atomic_t		open_count;
+ 	struct codec_info	*codec_info;
+ 
+ 	/* mutex serializes concurrent access to the device
+@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count++;
++	atomic_inc(&onyx->open_count);
+ 	mutex_unlock(&onyx->mutex);
+ 
+ 	return 0;
+@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count--;
+-	if (!onyx->open_count)
++	if (atomic_dec_and_test(&onyx->open_count))
+ 		onyx->spdif_locked = onyx->analog_locked = 0;
+ 	mutex_unlock(&onyx->mutex);
+ 
+diff -urNp linux-2.6.32.13/sound/core/oss/pcm_oss.c linux-2.6.32.13/sound/core/oss/pcm_oss.c
+--- linux-2.6.32.13/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/core/oss/pcm_oss.c	2010-05-15 13:21:18.814648703 -0400
+@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
+ 	}
+ }
+ #else /* !CONFIG_SND_VERBOSE_PROCFS */
+-#define snd_pcm_oss_proc_init(pcm)
+-#define snd_pcm_oss_proc_done(pcm)
++#define snd_pcm_oss_proc_init(pcm) do {} while (0)
++#define snd_pcm_oss_proc_done(pcm) do {} while (0)
+ #endif /* CONFIG_SND_VERBOSE_PROCFS */
+ 
+ /*
+diff -urNp linux-2.6.32.13/sound/core/seq/seq_lock.h linux-2.6.32.13/sound/core/seq/seq_lock.h
+--- linux-2.6.32.13/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/core/seq/seq_lock.h	2010-05-15 13:21:18.814648703 -0400
+@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
+ #else /* SMP || CONFIG_SND_DEBUG */
+ 
+ typedef spinlock_t snd_use_lock_t;	/* dummy */
+-#define snd_use_lock_init(lockp) /**/
+-#define snd_use_lock_use(lockp) /**/
+-#define snd_use_lock_free(lockp) /**/
+-#define snd_use_lock_sync(lockp) /**/
++#define snd_use_lock_init(lockp) do {} while (0)
++#define snd_use_lock_use(lockp) do {} while (0)
++#define snd_use_lock_free(lockp) do {} while (0)
++#define snd_use_lock_sync(lockp) do {} while (0)
+ 
+ #endif /* SMP || CONFIG_SND_DEBUG */
+ 
+diff -urNp linux-2.6.32.13/sound/drivers/mts64.c linux-2.6.32.13/sound/drivers/mts64.c
+--- linux-2.6.32.13/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/drivers/mts64.c	2010-05-15 13:21:18.814648703 -0400
+@@ -65,7 +65,7 @@ struct mts64 {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int current_midi_output_port;
+ 	int current_midi_input_port;
+ 	u8 mode[MTS64_NUM_INPUT_PORTS];
+@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
+ {
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 
+-	if (mts->open_count == 0) {
++	if (atomic_read(&mts->open_count) == 0) {
+ 		/* We don't need a spinlock here, because this is just called 
+ 		   if the device has not been opened before. 
+ 		   So there aren't any IRQs from the device */
+@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
+ 
+ 		msleep(50);
+ 	}
+-	++(mts->open_count);
++	atomic_inc(&mts->open_count);
+ 
+ 	return 0;
+ }
+@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 	unsigned long flags;
+ 
+-	--(mts->open_count);
+-	if (mts->open_count == 0) {
++	if (atomic_dec_return(&mts->open_count) == 0) {
+ 		/* We need the spinlock_irqsave here because we can still
+ 		   have IRQs at this point */
+ 		spin_lock_irqsave(&mts->lock, flags);
+@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
+ 
+ 		msleep(500);
+ 
+-	} else if (mts->open_count < 0)
+-		mts->open_count = 0;
++	} else if (atomic_read(&mts->open_count) < 0)
++		atomic_set(&mts->open_count, 0);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.13/sound/drivers/portman2x4.c linux-2.6.32.13/sound/drivers/portman2x4.c
+--- linux-2.6.32.13/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/drivers/portman2x4.c	2010-05-15 13:21:18.818605087 -0400
+@@ -83,7 +83,7 @@ struct portman {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int mode[PORTMAN_NUM_INPUT_PORTS];
+ 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
+ };
+diff -urNp linux-2.6.32.13/sound/oss/sb_audio.c linux-2.6.32.13/sound/oss/sb_audio.c
+--- linux-2.6.32.13/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/oss/sb_audio.c	2010-05-15 13:21:18.853427293 -0400
+@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
+ 		buf16 = (signed short *)(localbuf + localoffs);
+ 		while (c)
+ 		{
+-			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
++			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+ 			if (copy_from_user(lbuf8,
+ 					   userbuf+useroffs + p,
+ 					   locallen))
+diff -urNp linux-2.6.32.13/sound/pci/ac97/ac97_codec.c linux-2.6.32.13/sound/pci/ac97/ac97_codec.c
+--- linux-2.6.32.13/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/pci/ac97/ac97_codec.c	2010-05-15 13:21:18.897182507 -0400
+@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
+ }
+ 
+ /* build_ops to do nothing */
+-static struct snd_ac97_build_ops null_build_ops;
++static const struct snd_ac97_build_ops null_build_ops;
+ 
+ #ifdef CONFIG_SND_AC97_POWER_SAVE
+ static void do_update_power(struct work_struct *work)
+diff -urNp linux-2.6.32.13/sound/pci/ac97/ac97_patch.c linux-2.6.32.13/sound/pci/ac97/ac97_patch.c
+--- linux-2.6.32.13/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
++++ linux-2.6.32.13/sound/pci/ac97/ac97_patch.c	2010-05-15 13:21:18.938590352 -0400
+@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
+ 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ };
+@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
+ };
+@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
+ 	.build_specific = patch_wolfson_wm9703_specific,
+ };
+ 
+@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
+ 	.build_specific = patch_wolfson_wm9704_specific,
+ };
+ 
+@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
+ 	.build_specific = patch_wolfson_wm9705_specific,
+ };
+ 
+@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
+ 	.build_specific = patch_wolfson_wm9711_specific,
+ };
+ 
+@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
+ }
+ #endif
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
+ 	.build_specific = patch_wolfson_wm9713_specific,
+ 	.build_3d = patch_wolfson_wm9713_3d,
+ #ifdef CONFIG_PM	
+@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac97xx_specific
+ };
+@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
+ 	return patch_sigmatel_stac97xx_specific(ac97);
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
+ 	.build_3d	= patch_sigmatel_stac9708_3d,
+ 	.build_specific	= patch_sigmatel_stac9708_specific
+ };
+@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac9758_specific
+ };
+@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_cirrus_ops = {
++static const struct snd_ac97_build_ops patch_cirrus_ops = {
+ 	.build_spdif = patch_cirrus_build_spdif
+ };
+ 
+@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_conexant_ops = {
++static const struct snd_ac97_build_ops patch_conexant_ops = {
+ 	.build_spdif = patch_conexant_build_spdif
+ };
+ 
+@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
+ 	{ AC97_VIDEO, 0x9f1f },
+ 	{ AC97_AUX, 0x9f1f },
+ 	{ AC97_PCM, 0x9f1f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_ad1819(struct snd_ac97 * ac97)
+@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
+ 	}
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1881_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+ #endif
+@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1885_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
+ 	.build_specific = &patch_ad1885_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1886_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
+ 	.build_specific = &patch_ad1886_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981a_specific,
+ #ifdef CONFIG_PM
+@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981b_specific,
+ #ifdef CONFIG_PM
+@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1888_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1888_specific,
+ #ifdef CONFIG_PM
+@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
+ 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1980_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1980_specific,
+ #ifdef CONFIG_PM
+@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1985_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1985_specific,
+ #ifdef CONFIG_PM
+@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1986_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1986_specific,
+ #ifdef CONFIG_PM
+@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc650_ops = {
++static const struct snd_ac97_build_ops patch_alc650_ops = {
+ 	.build_specific	= patch_alc650_specific,
+ 	.update_jacks = alc650_update_jacks
+ };
+@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc655_ops = {
++static const struct snd_ac97_build_ops patch_alc655_ops = {
+ 	.build_specific	= patch_alc655_specific,
+ 	.update_jacks = alc655_update_jacks
+ };
+@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc850_ops = {
++static const struct snd_ac97_build_ops patch_alc850_ops = {
+ 	.build_specific	= patch_alc850_specific,
+ 	.update_jacks = alc850_update_jacks
+ };
+@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9738_ops = {
++static const struct snd_ac97_build_ops patch_cm9738_ops = {
+ 	.build_specific	= patch_cm9738_specific,
+ 	.update_jacks = cm9738_update_jacks
+ };
+@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
+ 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9739_ops = {
++static const struct snd_ac97_build_ops patch_cm9739_ops = {
+ 	.build_specific	= patch_cm9739_specific,
+ 	.build_post_spdif = patch_cm9739_post_spdif,
+ 	.update_jacks = cm9739_update_jacks
+@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9761_ops = {
++static const struct snd_ac97_build_ops patch_cm9761_ops = {
+ 	.build_specific	= patch_cm9761_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif,
+ 	.update_jacks = cm9761_update_jacks
+@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
+ 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9780_ops = {
++static const struct snd_ac97_build_ops patch_cm9780_ops = {
+ 	.build_specific	= patch_cm9780_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
+ };
+@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_vt1616_ops = {
++static const struct snd_ac97_build_ops patch_vt1616_ops = {
+ 	.build_specific	= patch_vt1616_specific
+ };
+ 
+@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_it2646_ops = {
++static const struct snd_ac97_build_ops patch_it2646_ops = {
+ 	.build_specific	= patch_it2646_specific,
+ 	.update_jacks = it2646_update_jacks
+ };
+@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_si3036_ops = {
++static const struct snd_ac97_build_ops patch_si3036_ops = {
+ 	.build_specific	= patch_si3036_specific,
+ };
+ 
+@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
+ 	{ AC97_AUX, 0x1f1f },
+ 	{ AC97_PCM, 0x1f1f },
+ 	{ AC97_REC_GAIN, 0x0f0f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_lm4550(struct snd_ac97 *ac97)
+@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ucb1400_ops = {
++static const struct snd_ac97_build_ops patch_ucb1400_ops = {
+ 	.build_specific	= patch_ucb1400_specific,
+ };
+ 
+diff -urNp linux-2.6.32.13/sound/pci/ens1370.c linux-2.6.32.13/sound/pci/ens1370.c
+--- linux-2.6.32.13/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/pci/ens1370.c	2010-05-15 13:21:18.938590352 -0400
+@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
+ 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
+ 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
+diff -urNp linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c
+--- linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c	2010-05-15 13:21:18.938590352 -0400
+@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
+ 		cp_ready);
+ 
+ 	/* TODO */
+-	if (cp_state)
+-		;
+-	if (cp_ready)
+-		;
++	if (cp_state) {
++	}
++	if (cp_ready) {
++	}
+ }
+ 
+ 
+diff -urNp linux-2.6.32.13/sound/pci/intel8x0.c linux-2.6.32.13/sound/pci/intel8x0.c
+--- linux-2.6.32.13/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/pci/intel8x0.c	2010-05-15 13:21:18.938590352 -0400
+@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
+@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
+ 		.type = AC97_TUNE_HP_ONLY
+ 	},
+ #endif
+-	{ } /* terminator */
++	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
+ };
+ 
+ static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
+diff -urNp linux-2.6.32.13/sound/pci/intel8x0m.c linux-2.6.32.13/sound/pci/intel8x0m.c
+--- linux-2.6.32.13/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/sound/pci/intel8x0m.c	2010-05-15 13:21:18.997275588 -0400
+@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
+@@ -1264,7 +1264,7 @@ static struct shortname_table {
+ 	{ 0x5455, "ALi M5455" },
+ 	{ 0x746d, "AMD AMD8111" },
+ #endif
+-	{ 0 },
++	{ 0, NULL },
+ };
+ 
+ static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
+diff -urNp linux-2.6.32.13/usr/gen_init_cpio.c linux-2.6.32.13/usr/gen_init_cpio.c
+--- linux-2.6.32.13/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.13/usr/gen_init_cpio.c	2010-05-15 13:21:18.997275588 -0400
+@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
+ 	int retval;
+ 	int rc = -1;
+ 	int namesize;
+-	int i;
++	unsigned int i;
+ 
+ 	mode |= S_IFREG;
+ 
+@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
+                        *env_var = *expanded = '\0';
+                        strncat(env_var, start + 2, end - start - 2);
+                        strncat(expanded, new_location, start - new_location);
+-                       strncat(expanded, getenv(env_var), PATH_MAX);
+-                       strncat(expanded, end + 1, PATH_MAX);
++                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
++                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
+                        strncpy(new_location, expanded, PATH_MAX);
++                       new_location[PATH_MAX] = 0;
+                } else
+                        break;
+        }
+diff -urNp linux-2.6.32.13/virt/kvm/kvm_main.c linux-2.6.32.13/virt/kvm/kvm_main.c
+--- linux-2.6.32.13/virt/kvm/kvm_main.c	2010-04-29 17:49:38.869035092 -0400
++++ linux-2.6.32.13/virt/kvm/kvm_main.c	2010-05-15 13:21:19.058665704 -0400
+@@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vcpu_fops = {
+ 	.release        = kvm_vcpu_release,
+ 	.unlocked_ioctl = kvm_vcpu_ioctl,
+@@ -2344,6 +2345,7 @@ static int kvm_vm_mmap(struct file *file
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vm_fops = {
+ 	.release        = kvm_vm_release,
+ 	.unlocked_ioctl = kvm_vm_ioctl,
+@@ -2431,6 +2433,7 @@ out:
+ 	return r;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_chardev_ops = {
+ 	.unlocked_ioctl = kvm_dev_ioctl,
+ 	.compat_ioctl   = kvm_dev_ioctl,
+@@ -2440,6 +2443,9 @@ static struct miscdevice kvm_dev = {
+ 	KVM_MINOR,
+ 	"kvm",
+ 	&kvm_chardev_ops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static void hardware_enable(void *junk)
+@@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
+ 	kvm_arch_vcpu_put(vcpu);
+ }
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module)
+ {
+ 	int r;
-- 
cgit v1.2.3


From d8e3f9b0e42bbecbc3620dd161817a791d708569 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 24 May 2010 13:02:30 +0000
Subject: main/util-vserver: upgrade to 0.30.216_pre2882

---
 main/util-vserver/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/util-vserver/APKBUILD b/main/util-vserver/APKBUILD
index 8e2a5307..5fed8f70 100644
--- a/main/util-vserver/APKBUILD
+++ b/main/util-vserver/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=util-vserver
 pkgver=0.30.216_pre2882
-_realver=0.30.216-pre2882
-pkgrel=8
+_realver=0.30.216-pre2883
+pkgrel=0
 pkgdesc="Linux-VServer admin utilities"
 url="http://www.nongnu.org/util-vserver/"
 license="GPL"
@@ -63,7 +63,7 @@ package() {
 	install -Dm755 ../setup-vs-guest "$pkgdir"/usr/sbin/setup-vs-guest
 }
 
-md5sums="ed974d112c9cf89943f1bc9be287621b  util-vserver-0.30.216-pre2882.tar.bz2
+md5sums="4f7a64b7295ea01673974394f4afd3ff  util-vserver-0.30.216-pre2883.tar.bz2
 62b7b9bbe5902b95f4614272af003dfd  busybox.patch
 73c7437dea6937a57cf38d166ef83c09  chmod.patch
 ff8f561f672524eb46fe633f584ef60e  ensc_pathprog.patch
-- 
cgit v1.2.3


From c22e2e6da94836209e9e5d34e7981ccae9b9ca58 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 24 May 2010 20:18:57 +0000
Subject: testing/nspr: new aport

Netscape Portable Runtime
http://www.mozilla.org/projects/nspr/
---
 testing/nspr/APKBUILD                          |  64 +++++++++++++
 testing/nspr/nspr-4.6.1-config-1.patch         |  11 +++
 testing/nspr/nspr-4.7.0-prtime.patch           |  26 +++++
 testing/nspr/nspr-4.8-config.patch             |  47 +++++++++
 testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch | 126 +++++++++++++++++++++++++
 5 files changed, 274 insertions(+)
 create mode 100644 testing/nspr/APKBUILD
 create mode 100644 testing/nspr/nspr-4.6.1-config-1.patch
 create mode 100644 testing/nspr/nspr-4.7.0-prtime.patch
 create mode 100644 testing/nspr/nspr-4.8-config.patch
 create mode 100644 testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch

diff --git a/testing/nspr/APKBUILD b/testing/nspr/APKBUILD
new file mode 100644
index 00000000..38f9d9c4
--- /dev/null
+++ b/testing/nspr/APKBUILD
@@ -0,0 +1,64 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=nspr
+pkgver=4.8.4
+pkgrel=0
+pkgdesc="Netscape Portable Runtime"
+url="http://www.mozilla.org/projects/nspr/"
+license="MPL-1.1 GPL-2 LGPL-2.1"
+depends=
+subpackages="$pkgname-dev"
+source="ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v$pkgver/src/nspr-$pkgver.tar.gz
+	nspr-4.6.1-config-1.patch
+	nspr-4.7.0-prtime.patch
+	nspr-4.8-config.patch
+	nspr-4.8-pkgconfig-gentoo-3.patch
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	mkdir build inst
+	for i in "$srcdir"/*.patch; do
+		msg "Applying $i"
+		patch -p1 -i "$i" || return 1
+	done
+	# respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) \$(OBJS)/\$(MKSHLIB) \$(LDFLAGS) \$(OBJS)/g' \
+		mozilla/nsprpub/config/rules.mk
+}
+
+build() {
+	cd "$_builddir"/build
+	../mozilla/nsprpub/configure --prefix=/usr \
+		|| return 1
+	make CC="${CC:-gcc}" CXX="${CXX:-g++}" || return 1
+}
+
+package() {
+	local file= minor_version=${pkgver#*.}
+	minor_version=${minor_version%.*}
+
+	cd "$_builddir"/build
+	make DESTDIR="$pkgdir" install || die "emake install failed"
+
+	cd "$pkgdir"/usr/lib
+	rm -f *.a
+	for file in *.so; do
+		mv ${file} ${file}.${minor_version} || return 1
+		ln -s ${file}.${minor_version} ${file} || return 1
+	done
+
+	cd "$_builddir"/build/config
+	install -Dm755 nspr-config "$pkgdir"/usr/bin/nspr-config || return 1
+	install -Dm644 nspr.pc "$pkgdir"/usr/lib/pkgconfig/nspr.pc || return 1
+	rm -rf "$pkgdir"/usr/bin/prerr.properties \
+		"$pkgdir"/usr/bin/compile-et.pl \
+		"$pkgdir"/usr/share/aclocal/nspr.m4 \
+		"$pkgdir"/usr/include/nspr/md
+}
+
+md5sums="a85bdbe1eb646aa32c785a37d8e3a2f5  nspr-4.8.4.tar.gz
+d204a641dd7cbf6751d14dc6b98835f1  nspr-4.6.1-config-1.patch
+c48e1f47799c1cff7e3bf46dc0e653f1  nspr-4.7.0-prtime.patch
+c790c638a7c9fd1d731272f464f065c6  nspr-4.8-config.patch
+5b67b4339be94d0dbc4337a55eabe73a  nspr-4.8-pkgconfig-gentoo-3.patch"
diff --git a/testing/nspr/nspr-4.6.1-config-1.patch b/testing/nspr/nspr-4.6.1-config-1.patch
new file mode 100644
index 00000000..b919c793
--- /dev/null
+++ b/testing/nspr/nspr-4.6.1-config-1.patch
@@ -0,0 +1,11 @@
+--- a/mozilla/nsprpub/configure.orig	2006-01-14 22:41:37.000000000 +0000
++++ b/mozilla/nsprpub/configure	2006-01-14 22:49:14.000000000 +0000
+@@ -3893,7 +3893,7 @@
+     PR_MD_CSRCS=linux.c
+     MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@'
+     DSO_CFLAGS=-fPIC
+-    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)'
++    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@).$(MOD_MINOR_VERSION)'
+     _OPTIMIZE_FLAGS=-O2
+     _DEBUG_FLAGS="-g -fno-inline"  # most people on linux use gcc/gdb, and that
+                                    # combo is not yet good at debugging inlined
diff --git a/testing/nspr/nspr-4.7.0-prtime.patch b/testing/nspr/nspr-4.7.0-prtime.patch
new file mode 100644
index 00000000..74d5534d
--- /dev/null
+++ b/testing/nspr/nspr-4.7.0-prtime.patch
@@ -0,0 +1,26 @@
+--- a/mozilla/nsprpub/pr/src/misc/prtime.c.orig	2007-09-14 19:41:08.000000000 +0200
++++ b/mozilla/nsprpub/pr/src/misc/prtime.c	2007-09-14 19:42:17.000000000 +0200
+@@ -1536,7 +1536,7 @@
+                 case TT_EET: zone_offset =  2 * 60; break;
+                 case TT_JST: zone_offset =  9 * 60; break;
+                 default:
+-                  PR_ASSERT (0);
++                  return PR_FAILURE;
+                   break;
+                 }
+         }
+@@ -1578,11 +1578,12 @@
+           struct tm localTime;
+           time_t secs;
+ 
+-          PR_ASSERT(result->tm_month > -1 &&
++          if (!(result->tm_month > -1 &&
+                     result->tm_mday > 0 &&
+                     result->tm_hour > -1 &&
+                     result->tm_min > -1 &&
+-                    result->tm_sec > -1);
++                    result->tm_sec > -1))
++		    return PR_FAILURE;
+ 
+             /*
+              * To obtain time_t from a tm structure representing the local
diff --git a/testing/nspr/nspr-4.8-config.patch b/testing/nspr/nspr-4.8-config.patch
new file mode 100644
index 00000000..4db2517e
--- /dev/null
+++ b/testing/nspr/nspr-4.8-config.patch
@@ -0,0 +1,47 @@
+--- a/mozilla/nsprpub/lib/libc/src/Makefile.in.orig	2005-06-01 14:28:26.000000000 +0000
++++ b/mozilla/nsprpub/lib/libc/src/Makefile.in	2006-01-15 02:50:39.000000000 +0000
+@@ -112,6 +112,10 @@
+ MKSHLIB += -R '$$ORIGIN'
+ endif
+ 
++ifeq ($(OS_ARCH), Linux)
++DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
++endif
++
+ ifeq ($(OS_ARCH),OS2)
+ MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
+ GARBAGE += $(MAPFILE)
+--- a/mozilla/nsprpub/lib/ds/Makefile.in.orig	2005-06-01 14:28:25.000000000 +0000
++++ b/mozilla/nsprpub/lib/ds/Makefile.in	2006-01-15 02:52:30.000000000 +0000
+@@ -102,6 +102,10 @@
+ MKSHLIB += -R '$$ORIGIN'
+ endif
+ 
++ifeq ($(OS_ARCH), Linux)
++DSO_LDOPTS += -Wl,-R,'$$ORIGIN'
++endif
++
+ ifeq ($(OS_ARCH),OS2)
+ MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
+ GARBAGE += $(MAPFILE)
+--- a/mozilla/nsprpub/pr/src/Makefile.in.orig	2005-06-01 14:28:27.000000000 +0000
++++ b/mozilla/nsprpub/pr/src/Makefile.in	2006-01-15 03:29:36.000000000 +0000
+@@ -168,6 +168,7 @@
+ else
+ OS_LIBS		= -ldl
+ endif
++DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
+ endif
+ 
+ ifeq ($(OS_ARCH),HP-UX)
+--- a/mozilla/nsprpub/config/nspr-config.in.orig	2005-05-11 00:53:41.000000000 +0000
++++ b/mozilla/nsprpub/config/nspr-config.in	2006-01-15 06:37:58.000000000 +0000
+@@ -122,7 +122,7 @@
+ fi
+ 
+ if test "$echo_libs" = "yes"; then
+-      libdirs=-L$libdir
++      libdirs="-Wl,-R$libdir -L$libdir"
+       if test -n "$lib_plds"; then
+ 	libdirs="$libdirs -lplds${major_version}"
+       fi
diff --git a/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch b/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
new file mode 100644
index 00000000..2525928d
--- /dev/null
+++ b/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
@@ -0,0 +1,126 @@
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/config.mk nspr-4.8/mozilla/nsprpub/config/config.mk
+--- nspr-4.8-orig/mozilla/nsprpub/config/config.mk	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/config/config.mk	2009-09-12 00:44:19.383381757 -0500
+@@ -162,3 +162,4 @@
+ RELEASE_INCLUDE_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/include
+ RELEASE_BIN_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/bin
+ RELEASE_LIB_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/lib
++RELEASE_PC_DIR = $(RELEASE_LIB_DIR)/pkgconfig
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in nspr-4.8/mozilla/nsprpub/config/Makefile.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:44:19.384379661 -0500
+@@ -52,9 +52,10 @@
+ 
+ # autoconf.mk must be deleted last (from the top-level directory)
+ # because it is included by every makefile.
+-DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config
++DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config nspr.pc
+ 
+ RELEASE_BINS	= nspr-config
++RELEASE_PC	= nspr.pc
+ 
+ include $(topsrcdir)/config/config.mk
+ 
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in nspr-4.8/mozilla/nsprpub/config/nspr-config.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:43:47.677356194 -0500
++++ nspr-4.8/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:45:53.723359547 -0500
+@@ -92,13 +92,13 @@
+ 
+ # Set variables that may be dependent upon other variables
+ if test -z "$exec_prefix"; then
+-    exec_prefix=@exec_prefix@
++    exec_prefix=`pkg-config --variable=exec_prefix nspr`
+ fi
+ if test -z "$includedir"; then
+-    includedir=@includedir@
++    includedir=`pkg-config --variable=includedir nspr`
+ fi
+ if test -z "$libdir"; then
+-    libdir=@libdir@
++    libdir=`pkg-config --variable=libdir nspr`
+ fi
+ 
+ if test "$echo_prefix" = "yes"; then
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in nspr-4.8/mozilla/nsprpub/config/nspr.pc.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in	1969-12-31 18:00:00.000000000 -0600
++++ nspr-4.8/mozilla/nsprpub/config/nspr.pc.in	2009-09-12 00:44:19.410432811 -0500
+@@ -0,0 +1,11 @@
++prefix=@prefix@
++exec_prefix=@exec_prefix@
++libdir=@libdir@
++includedir=@includedir@
++
++Name: NSPR
++Description: The Netscape Portable Runtime
++Version: @MOD_MAJOR_VERSION@.@MOD_MINOR_VERSION@.@MOD_PATCH_VERSION@
++Libs: -L${libdir} -lplds@MOD_MAJOR_VERSION@ -lplc@MOD_MAJOR_VERSION@ -lnspr@MOD_MAJOR_VERSION@ -lpthread -Wl,-R${libdir}
++Cflags: -I${includedir}
++
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/rules.mk nspr-4.8/mozilla/nsprpub/config/rules.mk
+--- nspr-4.8-orig/mozilla/nsprpub/config/rules.mk	2009-09-12 00:43:47.677356194 -0500
++++ nspr-4.8/mozilla/nsprpub/config/rules.mk	2009-09-12 00:44:19.435517111 -0500
+@@ -211,7 +211,7 @@
+ 	rm -rf $(wildcard *.OBJ *.OBJD) dist $(ALL_TRASH) $(DIST_GARBAGE)
+ 	+$(LOOP_OVER_DIRS)
+ 
+-install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS)
++install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS) $(RELEASE_PC)
+ ifdef RELEASE_BINS
+ 	$(NSINSTALL) -t -m 0755 $(RELEASE_BINS) $(DESTDIR)$(bindir)
+ endif
+@@ -221,6 +221,9 @@
+ ifdef RELEASE_LIBS
+ 	$(NSINSTALL) -t -m 0755 $(RELEASE_LIBS) $(DESTDIR)$(libdir)/$(lib_subdir)
+ endif
++ifdef RELEASE_PC
++	$(NSINSTALL) -t -m 0644 $(RELEASE_PC) $(DESTDIR)$(libdir)/pkgconfig/
++endif
+ 	+$(LOOP_OVER_DIRS)
+ 
+ release:: export
+@@ -272,6 +275,23 @@
+ 	fi
+ 	cp $(RELEASE_HEADERS) $(RELEASE_HEADERS_DEST)
+ endif
++ifdef RELEASE_PC
++	@echo "Copying pkg-config files to release directory"
++	@if test -z "$(BUILD_NUMBER)"; then \
++		echo "BUILD_NUMBER must be defined"; \
++		false; \
++	else \
++		true; \
++	fi
++	@if test ! -d $(RELEASE_PC_DEST); then \
++		rm -rf $(RELEASE_PC_DEST); \
++		$(NSINSTALL) -D $(RELEASE_PC_DEST);\
++	else \
++		true; \
++	fi
++	cp $(RELEASE_PC) $(RELEASE_PC_DEST)
++endif
++
+ 	+$(LOOP_OVER_DIRS)
+ 
+ alltags:
+diff -urN nspr-4.8-orig/mozilla/nsprpub/configure nspr-4.8/mozilla/nsprpub/configure
+--- nspr-4.8-orig/mozilla/nsprpub/configure	2009-09-12 00:43:47.600359058 -0500
++++ nspr-4.8/mozilla/nsprpub/configure	2009-09-12 00:44:19.444380569 -0500
+@@ -6037,6 +6037,7 @@
+ config/nsprincl.mk
+ config/nsprincl.sh
+ config/nspr-config
++config/nspr.pc
+ lib/Makefile 
+ lib/ds/Makefile 
+ lib/libc/Makefile 
+diff -urN nspr-4.8-orig/mozilla/nsprpub/configure.in nspr-4.8/mozilla/nsprpub/configure.in
+--- nspr-4.8-orig/mozilla/nsprpub/configure.in	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/configure.in	2009-09-12 00:44:19.451396074 -0500
+@@ -2871,6 +2871,7 @@
+ config/nsprincl.mk
+ config/nsprincl.sh
+ config/nspr-config
++config/nspr.pc
+ lib/Makefile 
+ lib/ds/Makefile 
+ lib/libc/Makefile 
-- 
cgit v1.2.3


From 99284dea5c50e0b954f1dbd9879aeb54d317e4bf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 24 May 2010 20:19:32 +0000
Subject: testing/nss: new aport

Mozilla Network Security Services
http://www.mozilla.org/projects/security/pki/nss/
---
 testing/nss/APKBUILD                           |  119 +++
 testing/nss/add_spi+cacert_ca_certs.patch      | 1168 ++++++++++++++++++++++++
 testing/nss/nss-config.in                      |  145 +++
 testing/nss/nss-no-rpath.patch                 |   14 +
 testing/nss/nss-nolocalsql.patch               |   52 ++
 testing/nss/nss.pc.in                          |   11 +
 testing/nss/ssl-renegotiate-transitional.patch |   21 +
 7 files changed, 1530 insertions(+)
 create mode 100644 testing/nss/APKBUILD
 create mode 100644 testing/nss/add_spi+cacert_ca_certs.patch
 create mode 100644 testing/nss/nss-config.in
 create mode 100644 testing/nss/nss-no-rpath.patch
 create mode 100644 testing/nss/nss-nolocalsql.patch
 create mode 100644 testing/nss/nss.pc.in
 create mode 100644 testing/nss/ssl-renegotiate-transitional.patch

diff --git a/testing/nss/APKBUILD b/testing/nss/APKBUILD
new file mode 100644
index 00000000..c795669e
--- /dev/null
+++ b/testing/nss/APKBUILD
@@ -0,0 +1,119 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=nss
+pkgver=3.12.6
+_ver=3_12_6
+pkgrel=0
+pkgdesc="Mozilla Network Security Services"
+url="http://www.mozilla.org/projects/security/pki/nss/"
+license="MPL GPL"
+depends=
+makedepends="nspr-dev sqlite-dev zlib-dev perl"
+subpackages="$pkgname-dev libnss"
+source="ftp://ftp.mozilla.org/pub/security/$pkgname/releases/NSS_${_ver}_RTM/src/$pkgname-$pkgver.tar.gz
+	nss-nolocalsql.patch
+	nss-no-rpath.patch
+	nss.pc.in
+	nss-config.in
+	add_spi+cacert_ca_certs.patch
+	ssl-renegotiate-transitional.patch"
+depends_dev="nspr-dev"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() { 
+	cd "$_builddir"
+	patch -Np1 -i ""$srcdir"/add_spi+cacert_ca_certs.patch" || return 1
+	patch -Np1 -i ""$srcdir"/ssl-renegotiate-transitional.patch" || return 1
+	patch -Np0 -i ""$srcdir"/nss-nolocalsql.patch" || return 1
+	patch -Np0 -i ""$srcdir"/nss-no-rpath.patch" || return 1
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' \
+		mozilla/security/coreconf/rules.mk
+
+}
+
+build() { 
+	cd "$_builddir"
+	unset CFLAGS
+	unset CXXFLAGS
+	export BUILD_OPT=1
+	export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
+	export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
+	export NSPR_INCLUDE_DIR=`pkg-config --cflags-only-I nspr | sed 's/-I//'`
+	export NSPR_LIB_DIR=`pkg-config --libs-only-L nspr | sed 's/-L.//'`
+	export XCFLAGS="${CFLAGS}"
+	make -j 1 -C mozilla/security/coreconf || return 1
+	make -j 1 -C mozilla/security/dbm || return 1
+	make -j 1 -C mozilla/security/nss || return 1
+}
+
+package() {
+	cd "$_builddir"
+	install -m755 -d "$pkgdir"/usr/lib/pkgconfig
+	install -m755 -d "$pkgdir"/usr/bin
+	install -m755 -d "$pkgdir"/usr/include/nss
+
+	NSS_VMAJOR=`awk '/#define.*NSS_VMAJOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h `
+	msg "DEBUG: $NSS_VMAJOR"
+	NSS_VMINOR=`awk '/#define.*NSS_VMINOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
+	NSS_VPATCH=`awk '/#define.*NSS_VPATCH"/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
+
+	# pkgconfig files
+	sed "$srcdir"/nss.pc.in \
+		-e "s,%libdir%,/usr/lib,g" \
+		-e "s,%prefix%,/usr,g" \
+		-e "s,%exec_prefix%,/usr/bin,g" \
+		-e "s,%includedir%,/usr/include/nss,g" \
+		-e "s,%NSPR_VERSION%,$pkgver,g" \
+		-e "s,%NSS_VERSION%,$pkgver,g" \
+		> "$pkgdir"/usr/lib/pkgconfig/nss.pc \
+		|| return 1
+	ln -sf nss.pc "$pkgdir"/usr/lib/pkgconfig/mozilla-nss.pc || return 1
+	chmod 644 "$pkgdir"/usr/lib/pkgconfig/*.pc || return 1
+
+	# nss-config
+	sed "$srcdir"/nss-config.in \
+		-e "s,@libdir@,/usr/lib,g" \
+		-e "s,@prefix@,/usr/bin,g" \
+		-e "s,@exec_prefix@,/usr/bin,g" \
+		-e "s,@includedir@,/usr/include/nss,g" \
+		-e "s,@MOD_MAJOR_VERSION@,${NSS_VMAJOR},g" \
+		-e "s,@MOD_MINOR_VERSION@,${NSS_VMINOR},g" \
+		-e "s,@MOD_PATCH_VERSION@,${NSS_VPATCH},g" \
+		> "$pkgdir"/usr/bin/nss-config || return 1
+	chmod 755 "$pkgdir"/usr/bin/nss-config || return 1
+	local minor=${pkgver#*.}
+	minor=${minor%.*}
+	for file in libsoftokn3.so libfreebl3.so libnss3.so libnssutil3.so \
+			libssl3.so libsmime3.so libnssckbi.so libnssdbm3.so; do
+		install -m755 mozilla/dist/*.OBJ/lib/${file} \
+			"$pkgdir"/usr/lib/${file}.$minor || return 1
+		ln -s $file.$minor "$pkgdir"/usr/lib/$file
+	done
+	install -m644 mozilla/dist/*.OBJ/lib/libcrmf.a "$pkgdir"/usr/lib/ \
+		|| return 1
+	install -m644 mozilla/dist/*.OBJ/lib/*.chk "$pkgdir"/usr/lib/ \
+		|| return 1
+	
+	for file in certutil cmsutil crlutil modutil pk12util shlibsign \
+			signtool signver ssltap; do
+		install -m755 mozilla/dist/*.OBJ/bin/${file} "$pkgdir"/usr/bin/\
+			|| return 1
+	done
+	install -m644 mozilla/dist/public/nss/*.h "$pkgdir"/usr/include/nss/ \
+		|| return 1
+}
+
+libnss() {
+	pkgdesc="Mozilla Network Security Service libraries"
+	mkdir -p "$subpkgdir"/usr/
+	mv "$pkgdir"/usr/lib "$subpkgdir"/usr
+}
+
+md5sums="da42596665f226de5eb3ecfc1ec57cd1  nss-3.12.6.tar.gz
+1d8305dc458d28c6f32746d9132b9873  nss-nolocalsql.patch
+e5c97db0c884d5f4cfda21e562dc9bba  nss-no-rpath.patch
+c547b030c57fe1ed8b77c73bf52b3ded  nss.pc.in
+46bee81908f1e5b26d6a7a2e14c64d9f  nss-config.in
+a744b499e7da252acd9ac8ff09af3d48  add_spi+cacert_ca_certs.patch
+d83c7b61abb7e9f8f7bcd157183d1ade  ssl-renegotiate-transitional.patch"
diff --git a/testing/nss/add_spi+cacert_ca_certs.patch b/testing/nss/add_spi+cacert_ca_certs.patch
new file mode 100644
index 00000000..a8969ee4
--- /dev/null
+++ b/testing/nss/add_spi+cacert_ca_certs.patch
@@ -0,0 +1,1168 @@
+## 95_add_spi+cacert_ca_certs.patch by martin f. krafft <madduck@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Adds the SPI Inc. and CAcert.org CA certificates
+
+diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.c b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
+index 2c6fdab..2fb754c 100644
+--- a/mozilla/security/nss/lib/ckfw/builtins/certdata.c
++++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
+@@ -35,7 +35,7 @@
+  *
+  * ***** END LICENSE BLOCK ***** */
+ #ifdef DEBUG
+-static const char CVS_ID[] = "@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $";
++static const char CVS_ID[] = "@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $";
+ #endif /* DEBUG */
+ 
+ #ifndef BUILTINS_H
+@@ -1020,6 +1020,24 @@ static const CK_ATTRIBUTE_TYPE nss_builtins_types_320 [] = {
+ static const CK_ATTRIBUTE_TYPE nss_builtins_types_321 [] = {
+  CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
+ };
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_322 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_323 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_324 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_325 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_326 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_327 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
+ #ifdef DEBUG
+ static const NSSItem nss_builtins_items_0 [] = {
+   { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },
+@@ -1028,7 +1046,7 @@ static const NSSItem nss_builtins_items_0 [] = {
+   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+   { (void *)"CVS ID", (PRUint32)7 },
+   { (void *)"NSS", (PRUint32)4 },
+-  { (void *)"@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $", (PRUint32)160 }
++  { (void *)"@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $", (PRUint32)160 }
+ };
+ #endif /* DEBUG */
+ static const NSSItem nss_builtins_items_1 [] = {
+@@ -21537,6 +21555,531 @@ static const NSSItem nss_builtins_items_321 [] = {
+   { (void *)&ckt_netscape_trust_unknown, (PRUint32)sizeof(CK_TRUST) },
+   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
+ };
++static const NSSItem nss_builtins_items_322 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\000"
++, (PRUint32)3 },
++  { (void *)"\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000"
++"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
++"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
++"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
++"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
++"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
++"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
++"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
++"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
++"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063"
++"\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060"
++"\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016"
++"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
++"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
++"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
++"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
++"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
++"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
++"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
++"\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
++"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
++"\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007"
++"\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002"
++"\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011"
++"\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315"
++"\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230"
++"\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272"
++"\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016"
++"\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052"
++"\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262"
++"\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140"
++"\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150"
++"\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273"
++"\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022"
++"\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234"
++"\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334"
++"\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070"
++"\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232"
++"\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044"
++"\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355"
++"\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252"
++"\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352"
++"\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276"
++"\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306"
++"\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320"
++"\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167"
++"\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335"
++"\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324"
++"\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246"
++"\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106"
++"\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272"
++"\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334"
++"\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304"
++"\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060"
++"\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265"
++"\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071"
++"\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230"
++"\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260"
++"\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016"
++"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
++"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
++"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
++"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
++"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
++"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
++"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
++"\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001"
++"\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037"
++"\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160"
++"\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157"
++"\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006"
++"\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164"
++"\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060"
++"\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045"
++"\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162"
++"\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077"
++"\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102"
++"\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165"
++"\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164"
++"\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040"
++"\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167"
++"\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006"
++"\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001"
++"\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201"
++"\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275"
++"\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234"
++"\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323"
++"\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073"
++"\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140"
++"\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353"
++"\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160"
++"\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334"
++"\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231"
++"\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116"
++"\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145"
++"\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031"
++"\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363"
++"\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330"
++"\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367"
++"\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260"
++"\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223"
++"\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335"
++"\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026"
++"\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005"
++"\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361"
++"\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371"
++"\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246"
++"\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206"
++"\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153"
++"\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344"
++"\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143"
++"\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362"
++"\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226"
++"\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175"
++"\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305"
++"\103"
++, (PRUint32)1857 }
++};
++static const NSSItem nss_builtins_items_323 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
++  { (void *)"\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106"
++"\166\316\217\063"
++, (PRUint32)20 },
++  { (void *)"\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153"
++, (PRUint32)16 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\000"
++, (PRUint32)3 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
++static const NSSItem nss_builtins_items_324 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143"
++"\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004"
++"\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101"
++"\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004"
++"\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040"
++"\063\040\122\157\157\164"
++, (PRUint32)86 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\001"
++, (PRUint32)3 },
++  { (void *)"\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001"
++"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
++"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
++"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
++"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
++"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
++"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
++"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
++"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
++"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065"
++"\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060"
++"\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022"
++"\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156"
++"\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164"
++"\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157"
++"\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143"
++"\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164"
++"\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001"
++"\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001"
++"\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335"
++"\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175"
++"\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163"
++"\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144"
++"\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001"
++"\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171"
++"\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313"
++"\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011"
++"\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353"
++"\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277"
++"\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331"
++"\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205"
++"\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073"
++"\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161"
++"\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371"
++"\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047"
++"\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252"
++"\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102"
++"\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064"
++"\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133"
++"\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242"
++"\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137"
++"\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325"
++"\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150"
++"\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230"
++"\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140"
++"\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347"
++"\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321"
++"\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206"
++"\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257"
++"\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164"
++"\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373"
++"\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003"
++"\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006"
++"\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006"
++"\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072"
++"\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162"
++"\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034"
++"\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162"
++"\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003"
++"\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001"
++"\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002"
++"\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101"
++"\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160"
++"\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206"
++"\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241"
++"\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072"
++"\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135"
++"\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253"
++"\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364"
++"\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172"
++"\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302"
++"\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214"
++"\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074"
++"\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154"
++"\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025"
++"\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352"
++"\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231"
++"\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213"
++"\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325"
++"\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242"
++"\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214"
++"\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027"
++"\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057"
++"\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224"
++"\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134"
++"\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356"
++"\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005"
++"\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355"
++"\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143"
++"\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123"
++"\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243"
++"\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005"
++"\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156"
++"\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317"
++"\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360"
++"\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101"
++"\322\156\245\033\231\047\200\347\013\251\250\000"
++, (PRUint32)1548 }
++};
++static const NSSItem nss_builtins_items_325 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
++  { (void *)"\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304"
++"\030\116\052\055"
++, (PRUint32)20 },
++  { (void *)"\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266"
++, (PRUint32)16 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\001"
++, (PRUint32)3 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
++static const NSSItem nss_builtins_items_326 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
++, (PRUint32)11 },
++  { (void *)"\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000"
++"\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206"
++"\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003"
++"\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010"
++"\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125"
++"\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163"
++"\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167"
++"\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151"
++"\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003"
++"\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061"
++"\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146"
++"\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061"
++"\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026"
++"\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151"
++"\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063"
++"\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060"
++"\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125"
++"\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023"
++"\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004"
++"\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061"
++"\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141"
++"\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143"
++"\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125"
++"\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036"
++"\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151"
++"\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045"
++"\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150"
++"\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156"
++"\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
++"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
++"\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051"
++"\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074"
++"\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271"
++"\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240"
++"\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321"
++"\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265"
++"\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175"
++"\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375"
++"\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161"
++"\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342"
++"\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172"
++"\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056"
++"\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247"
++"\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310"
++"\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361"
++"\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356"
++"\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110"
++"\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151"
++"\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316"
++"\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307"
++"\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320"
++"\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205"
++"\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123"
++"\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154"
++"\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275"
++"\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356"
++"\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250"
++"\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204"
++"\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147"
++"\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305"
++"\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057"
++"\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124"
++"\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060"
++"\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161"
++"\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122"
++"\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346"
++"\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102"
++"\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061"
++"\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016"
++"\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025"
++"\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141"
++"\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037"
++"\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040"
++"\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061"
++"\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141"
++"\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103"
++"\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157"
++"\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015"
++"\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100"
++"\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216"
++"\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377"
++"\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206"
++"\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035"
++"\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102"
++"\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151"
++"\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164"
++"\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102"
++"\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141"
++"\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055"
++"\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206"
++"\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057"
++"\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143"
++"\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125"
++"\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164"
++"\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016"
++"\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015"
++"\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002"
++"\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162"
++"\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030"
++"\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255"
++"\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065"
++"\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014"
++"\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306"
++"\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051"
++"\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017"
++"\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302"
++"\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213"
++"\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017"
++"\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162"
++"\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152"
++"\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357"
++"\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266"
++"\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104"
++"\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177"
++"\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253"
++"\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206"
++"\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217"
++"\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265"
++"\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225"
++"\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140"
++"\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207"
++"\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252"
++"\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340"
++"\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254"
++"\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275"
++"\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132"
++"\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151"
++"\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005"
++"\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004"
++"\243\140"
++, (PRUint32)2066 }
++};
++static const NSSItem nss_builtins_items_327 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
++  { (void *)"\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044"
++"\251\220\103\034"
++, (PRUint32)20 },
++  { (void *)"\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170"
++, (PRUint32)16 },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
++, (PRUint32)11 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
+ 
+ builtinsInternalObject
+ nss_builtins_data[] = {
+@@ -21863,11 +22406,17 @@ nss_builtins_data[] = {
+   { 11, nss_builtins_types_318, nss_builtins_items_318, {NULL} },
+   { 13, nss_builtins_types_319, nss_builtins_items_319, {NULL} },
+   { 11, nss_builtins_types_320, nss_builtins_items_320, {NULL} },
+-  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} }
++  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} },
++  { 11, nss_builtins_types_322, nss_builtins_items_322, {NULL} },
++  { 13, nss_builtins_types_323, nss_builtins_items_323, {NULL} },
++  { 11, nss_builtins_types_324, nss_builtins_items_324, {NULL} },
++  { 13, nss_builtins_types_325, nss_builtins_items_325, {NULL} },
++  { 11, nss_builtins_types_326, nss_builtins_items_326, {NULL} },
++  { 13, nss_builtins_types_327, nss_builtins_items_327, {NULL} }
+ };
+ const PRUint32
+ #ifdef DEBUG
+-  nss_builtins_nObjects = 321+1;
++  nss_builtins_nObjects = 327+1;
+ #else
+-  nss_builtins_nObjects = 321;
++  nss_builtins_nObjects = 327;
+ #endif /* DEBUG */
+diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
+index 22ed023..a8b94dd 100644
+--- a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
++++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
+@@ -22200,3 +22200,558 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "CAcert.org Class 1 Root CA"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\000
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000
++\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
++\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
++\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
++\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
++\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
++\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
++\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
++\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
++\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063
++\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060
++\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016
++\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
++\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
++\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
++\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
++\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
++\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
++\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
++\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
++\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
++\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007
++\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002
++\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011
++\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315
++\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230
++\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272
++\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016
++\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052
++\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262
++\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140
++\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150
++\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273
++\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022
++\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234
++\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334
++\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070
++\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232
++\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044
++\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355
++\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252
++\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352
++\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276
++\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306
++\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320
++\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167
++\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335
++\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324
++\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246
++\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106
++\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272
++\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334
++\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304
++\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060
++\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265
++\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071
++\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230
++\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260
++\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016
++\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
++\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
++\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
++\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
++\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
++\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
++\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
++\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001
++\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037
++\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160
++\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157
++\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006
++\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164
++\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060
++\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045
++\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162
++\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077
++\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102
++\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165
++\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164
++\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040
++\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167
++\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006
++\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001
++\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201
++\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275
++\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234
++\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323
++\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073
++\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140
++\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353
++\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160
++\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334
++\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231
++\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116
++\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145
++\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031
++\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363
++\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330
++\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367
++\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260
++\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223
++\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335
++\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026
++\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005
++\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361
++\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371
++\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246
++\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206
++\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153
++\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344
++\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143
++\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362
++\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226
++\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175
++\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305
++\103
++END
++
++# Trust for Certificate "CAcert.org Class 1 Root CA"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106
++\166\316\217\063
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\000
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "CAcert.org Class 3 Root CA"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143
++\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004
++\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101
++\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004
++\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040
++\063\040\122\157\157\164
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\001
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001
++\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
++\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
++\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
++\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
++\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
++\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
++\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
++\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
++\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065
++\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060
++\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022
++\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156
++\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164
++\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157
++\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143
++\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164
++\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001
++\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001
++\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335
++\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175
++\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163
++\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144
++\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001
++\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171
++\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313
++\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011
++\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353
++\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277
++\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331
++\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205
++\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073
++\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161
++\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371
++\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047
++\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252
++\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102
++\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064
++\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133
++\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242
++\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137
++\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325
++\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150
++\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230
++\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140
++\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347
++\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321
++\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206
++\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257
++\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164
++\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373
++\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003
++\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006
++\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006
++\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072
++\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162
++\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034
++\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162
++\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003
++\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001
++\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002
++\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101
++\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160
++\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206
++\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241
++\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072
++\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135
++\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253
++\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364
++\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172
++\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302
++\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214
++\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074
++\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154
++\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025
++\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352
++\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231
++\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213
++\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325
++\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242
++\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214
++\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027
++\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057
++\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224
++\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134
++\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356
++\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005
++\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355
++\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143
++\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123
++\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243
++\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005
++\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156
++\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317
++\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360
++\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101
++\322\156\245\033\231\047\200\347\013\251\250\000
++END
++
++# Trust for Certificate "CAcert.org Class 3 Root CA"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304
++\030\116\052\055
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\001
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "Software in the Public Interest, Inc. Root CA (2008)"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\011\000\350\216\266\311\370\052\024\050
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000
++\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206
++\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003
++\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010
++\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125
++\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163
++\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167
++\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151
++\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003
++\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061
++\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146
++\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061
++\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026
++\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151
++\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063
++\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060
++\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125
++\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023
++\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004
++\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061
++\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141
++\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143
++\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125
++\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036
++\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151
++\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045
++\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150
++\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156
++\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
++\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
++\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051
++\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074
++\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271
++\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240
++\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321
++\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265
++\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175
++\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375
++\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161
++\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342
++\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172
++\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056
++\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247
++\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310
++\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361
++\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356
++\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110
++\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151
++\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316
++\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307
++\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320
++\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205
++\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123
++\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154
++\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275
++\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356
++\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250
++\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204
++\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147
++\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305
++\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057
++\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124
++\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060
++\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161
++\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122
++\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346
++\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102
++\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061
++\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016
++\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025
++\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141
++\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037
++\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040
++\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061
++\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141
++\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103
++\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157
++\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015
++\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100
++\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216
++\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377
++\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206
++\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035
++\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102
++\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151
++\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164
++\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102
++\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141
++\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055
++\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206
++\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057
++\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143
++\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125
++\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164
++\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016
++\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015
++\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002
++\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162
++\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030
++\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255
++\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065
++\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014
++\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306
++\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051
++\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017
++\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302
++\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213
++\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017
++\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162
++\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152
++\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357
++\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266
++\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104
++\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177
++\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253
++\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206
++\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217
++\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265
++\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225
++\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140
++\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207
++\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252
++\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340
++\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254
++\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275
++\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132
++\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151
++\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005
++\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004
++\243\140
++END
++
++# Trust for Certificate "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044
++\251\220\103\034
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\011\000\350\216\266\311\370\052\024\050
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff --git a/testing/nss/nss-config.in b/testing/nss/nss-config.in
new file mode 100644
index 00000000..f8f893e7
--- /dev/null
+++ b/testing/nss/nss-config.in
@@ -0,0 +1,145 @@
+#!/bin/sh
+
+prefix=@prefix@
+
+major_version=@MOD_MAJOR_VERSION@
+minor_version=@MOD_MINOR_VERSION@
+patch_version=@MOD_PATCH_VERSION@
+
+usage()
+{
+	cat <<EOF
+Usage: nss-config [OPTIONS] [LIBRARIES]
+Options:
+	[--prefix[=DIR]]
+	[--exec-prefix[=DIR]]
+	[--includedir[=DIR]]
+	[--libdir[=DIR]]
+	[--version]
+	[--libs]
+	[--cflags]
+Dynamic Libraries:
+	nss
+	nssutil
+	ssl
+	smime
+EOF
+	exit $1
+}
+
+if test $# -eq 0; then
+	usage 1 1>&2
+fi
+
+lib_ssl=yes
+lib_smime=yes
+lib_nss=yes
+lib_nssutil=yes
+
+while test $# -gt 0; do
+  case "$1" in
+  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
+  *) optarg= ;;
+  esac
+
+  case $1 in
+    --prefix=*)
+      prefix=$optarg
+      ;;
+    --prefix)
+      echo_prefix=yes
+      ;;
+    --exec-prefix=*)
+      exec_prefix=$optarg
+      ;;
+    --exec-prefix)
+      echo_exec_prefix=yes
+      ;;
+    --includedir=*)
+      includedir=$optarg
+      ;;
+    --includedir)
+      echo_includedir=yes
+      ;;
+    --libdir=*)
+      libdir=$optarg
+      ;;
+    --libdir)
+      echo_libdir=yes
+      ;;
+    --version)
+      echo ${major_version}.${minor_version}.${patch_version}
+      ;;
+    --cflags)
+      echo_cflags=yes
+      ;;
+    --libs)
+      echo_libs=yes
+      ;;
+    ssl)
+      lib_ssl=yes
+      ;;
+    smime)
+      lib_smime=yes
+      ;;
+    nss)
+      lib_nss=yes
+      ;;
+    nssutil)
+      lib_nssutil=yes
+      ;;
+    *)
+      usage 1 1>&2
+      ;;
+  esac
+  shift
+done
+
+# Set variables that may be dependent upon other variables
+if test -z "$exec_prefix"; then
+    exec_prefix=`pkg-config --variable=exec_prefix nss`
+fi
+if test -z "$includedir"; then
+    includedir=`pkg-config --variable=includedir nss`
+fi
+if test -z "$libdir"; then
+    libdir=`pkg-config --variable=libdir nss`
+fi
+
+if test "$echo_prefix" = "yes"; then
+    echo $prefix
+fi
+
+if test "$echo_exec_prefix" = "yes"; then
+    echo $exec_prefix
+fi
+
+if test "$echo_includedir" = "yes"; then
+    echo $includedir
+fi
+
+if test "$echo_libdir" = "yes"; then
+    echo $libdir
+fi
+
+if test "$echo_cflags" = "yes"; then
+    echo -I$includedir
+fi
+
+if test "$echo_libs" = "yes"; then
+      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
+      if test -n "$lib_ssl"; then
+	libdirs="$libdirs -lssl${major_version}"
+      fi
+      if test -n "$lib_smime"; then
+	libdirs="$libdirs -lsmime${major_version}"
+      fi
+      if test -n "$lib_nss"; then
+	libdirs="$libdirs -lnss${major_version}"
+      fi
+      if test -n "$lib_nssutil"; then
+	libdirs="$libdirs -lnssutil${major_version}"
+      fi
+      echo $libdirs
+fi      
+
diff --git a/testing/nss/nss-no-rpath.patch b/testing/nss/nss-no-rpath.patch
new file mode 100644
index 00000000..35ea5731
--- /dev/null
+++ b/testing/nss/nss-no-rpath.patch
@@ -0,0 +1,14 @@
+--- ./mozilla/security/nss/cmd/platlibs.mk.withrpath	2007-02-19 07:17:06.000000000 +0100
++++ ./mozilla/security/nss/cmd/platlibs.mk	2007-02-19 07:18:07.000000000 +0100
+@@ -52,9 +52,9 @@
+ 
+ ifeq ($(OS_ARCH), Linux)
+ ifeq ($(USE_64), 1)
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
++#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
+ else
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
++#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
+ endif
+ endif
+ 
diff --git a/testing/nss/nss-nolocalsql.patch b/testing/nss/nss-nolocalsql.patch
new file mode 100644
index 00000000..dc75a223
--- /dev/null
+++ b/testing/nss/nss-nolocalsql.patch
@@ -0,0 +1,52 @@
+diff -up ./mozilla/security/nss/lib/Makefile.nolocalsql ./mozilla/security/nss/lib/Makefile
+--- ./mozilla/security/nss/lib/Makefile.nolocalsql	2010-02-27 16:40:25.891777537 -0800
++++ ./mozilla/security/nss/lib/Makefile	2010-02-27 16:41:59.175902327 -0800
+@@ -62,11 +62,11 @@ ifndef USE_SYSTEM_ZLIB
+ ZLIB_SRCDIR = zlib  # Add the zlib directory to DIRS.
+ endif
+ 
+-ifndef MOZILLA_CLIENT
+-ifndef NSS_USE_SYSTEM_SQLITE
+-SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
+-endif
+-endif
++#ifndef MOZILLA_CLIENT
++#ifndef NSS_USE_SYSTEM_SQLITE
++#SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
++#endif
++#endif
+ 
+ ifndef MOZILLA_CLIENT
+ ifeq ($(OS_ARCH),Linux)
+diff -up ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn
+--- ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql	2010-02-27 16:44:24.998777709 -0800
++++ ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn	2010-02-27 16:45:08.533803472 -0800
+@@ -46,9 +46,9 @@ MAPFILE = $(OBJDIR)/nssdbm.def
+ 
+ DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\"
+ 
+-ifdef MOZILLA_CLIENT
+-INCLUDES += -I$(DIST)/include/sqlite3
+-endif
++#ifdef MOZILLA_CLIENT
++#INCLUDES += -I$(DIST)/include/sqlite3
++#endif
+ 
+ CSRCS = \
+ 	dbmshim.c \
+diff -up ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/manifest.mn
+--- ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql	2010-02-27 16:42:52.213902231 -0800
++++ ./mozilla/security/nss/lib/softoken/manifest.mn	2010-02-27 16:43:34.040776788 -0800
+@@ -47,9 +47,9 @@ MAPFILE = $(OBJDIR)/softokn.def
+ 
+ DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
+ 
+-ifdef MOZILLA_CLIENT
+-INCLUDES += -I$(DIST)/include/sqlite3
+-endif
++#ifdef MOZILLA_CLIENT
++#INCLUDES += -I$(DIST)/include/sqlite3
++#endif
+ 
+ EXPORTS = \
+ 	secmodt.h \
diff --git a/testing/nss/nss.pc.in b/testing/nss/nss.pc.in
new file mode 100644
index 00000000..d47b9e14
--- /dev/null
+++ b/testing/nss/nss.pc.in
@@ -0,0 +1,11 @@
+prefix=%prefix%
+exec_prefix=%exec_prefix%
+libdir=%libdir%
+includedir=%includedir%
+
+Name: NSS
+Description: Network Security Services
+Version: %NSS_VERSION%
+Requires: nspr >= %NSPR_VERSION%
+Libs: -lssl3 -lsmime3 -lnss3 -lnssutil3
+Cflags: -I${includedir}
diff --git a/testing/nss/ssl-renegotiate-transitional.patch b/testing/nss/ssl-renegotiate-transitional.patch
new file mode 100644
index 00000000..f457c555
--- /dev/null
+++ b/testing/nss/ssl-renegotiate-transitional.patch
@@ -0,0 +1,21 @@
+Enable transitional scheme for ssl renegotiation:
+
+(from mozilla/security/nss/lib/ssl/ssl.h)
+Disallow unsafe renegotiation in server sockets only, but allow clients
+to continue to renegotiate with vulnerable servers.
+This value should only be used during the transition period when few
+servers have been upgraded.
+
+diff --git a/mozilla/security/nss/lib/ssl/sslsock.c b/mozilla/security/nss/lib/ssl/sslsock.c
+index f1d1921..c074360 100644
+--- a/mozilla/security/nss/lib/ssl/sslsock.c
++++ b/mozilla/security/nss/lib/ssl/sslsock.c
+@@ -181,7 +181,7 @@ static sslOptions ssl_defaults = {
+     PR_FALSE,   /* noLocks            */
+     PR_FALSE,   /* enableSessionTickets */
+     PR_FALSE,   /* enableDeflate      */
+-    2,          /* enableRenegotiation (default: requires extension) */
++    3,          /* enableRenegotiation (default: transitional) */
+     PR_FALSE,   /* requireSafeNegotiation */
+ };
+ 
-- 
cgit v1.2.3


From 8e434632d5e169d612afd4a6a86e5a6d15384a9a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 24 May 2010 20:24:23 +0000
Subject: testing/pidgin: enable nss

needed for msn, google talk etc
---
 testing/pidgin/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/testing/pidgin/APKBUILD b/testing/pidgin/APKBUILD
index a4db3e8b..bff483fc 100644
--- a/testing/pidgin/APKBUILD
+++ b/testing/pidgin/APKBUILD
@@ -1,14 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pidgin
 pkgver=2.7.0
-pkgrel=0
+pkgrel=1
 pkgdesc="graphical multi-protocol instant messaging client for X"
 url="http://pidgin.im/"
 license="GPL"
 depends=
 makedepends="gtk+-dev intltool libsm-dev startup-notification-dev gtkspell-dev
 	libxml2-dev gstreamer-dev libidn-dev dbus-glib-dev gnutls-dev
-	cyrus-sasl-dev ncurses-dev"
+	cyrus-sasl-dev ncurses-dev nss-dev"
 subpackages="$pkgname-dev $pkgname-doc finch libpurple"
 source="http://downloads.sourceforge.net/pidgin/$pkgver/pidgin-$pkgver.tar.bz2
 	msn_fix.patch"
@@ -28,13 +28,13 @@ build() {
 		--disable-gnutls \
 		--disable-meanwhile \
 		--disable-nm \
-		--disable-nss \
 		--disable-perl \
 		--disable-schemas-install \
 		--disable-screensaver \
 		--disable-tcl \
 		--disable-vv \
 		--enable-cyrus-sasl \
+		--enable-nss \
 		|| return 1
 	make || return 1
 }
-- 
cgit v1.2.3


From e14dd28447d272027ebd9bf045eb0a6bd428f0c2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 25 May 2010 06:08:54 +0000
Subject: main/quagga: upgrade to 0.99.16

---
 main/quagga/APKBUILD                         |  8 +--
 main/quagga/quagga-revert-confed-check.patch | 97 ----------------------------
 2 files changed, 3 insertions(+), 102 deletions(-)
 delete mode 100644 main/quagga/quagga-revert-confed-check.patch

diff --git a/main/quagga/APKBUILD b/main/quagga/APKBUILD
index 86d3656d..473322cf 100644
--- a/main/quagga/APKBUILD
+++ b/main/quagga/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=quagga
-pkgver=0.99.15
-pkgrel=4
+pkgver=0.99.16
+pkgrel=0
 pkgdesc="A free routing daemon replacing Zebra supporting RIP, OSPF and BGP."
 url="http://quagga.net/"
 license="GPL-2"
@@ -13,7 +13,6 @@ subpackages="$pkgname-dev $pkgname-doc"
 source="http://www.quagga.net/download/$pkgname-$pkgver.tar.gz
 	$pkgname-0.99.11-link-libcap.patch
 	$pkgname-0.99.11-del-routes.patch
-	quagga-revert-confed-check.patch
 	bgpd.initd
 	ospf6d.initd
 	ospfd.initd
@@ -67,10 +66,9 @@ package() {
 	done
 	install -Dm644 "$srcdir/zebra.confd" "$pkgdir"/etc/conf.d/zebra
 }
-md5sums="8975414c76a295f4855a417af0b5ddce  quagga-0.99.15.tar.gz
+md5sums="350fb150be526cdfc4d2b093cb4d69a7  quagga-0.99.16.tar.gz
 8f99d41a8ed79e51704e8f655d255f29  quagga-0.99.11-link-libcap.patch
 1cbcf60a637b2577dee4d6df711e1247  quagga-0.99.11-del-routes.patch
-9a9ad8ac543901f3eab6a6f2a914b69d  quagga-revert-confed-check.patch
 ec7ac8cc1103f023cf5b9482b26ece59  bgpd.initd
 92aba039c049050c48abf984c2db7e2b  ospf6d.initd
 878328ead225e6eb5f5f77f05ab39106  ospfd.initd
diff --git a/main/quagga/quagga-revert-confed-check.patch b/main/quagga/quagga-revert-confed-check.patch
deleted file mode 100644
index 3c76d1dd..00000000
--- a/main/quagga/quagga-revert-confed-check.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From b6c5e59e39e9513232c4e26faf30218e820f38a8 Mon Sep 17 00:00:00 2001
-From: Timo Teras <timo.teras@iki.fi>
-Date: Thu, 8 Oct 2009 21:46:28 +0300
-Subject: [PATCH] Revert "bgpd: Implement BGP confederation error handling (RFC5065, Par. 5)"
-
-This reverts commit ca87e1d37b3c30648e9bacb476a3c89729512f6d.
----
- bgpd/bgp_aspath.c |   36 ------------------------------------
- bgpd/bgp_aspath.h |    2 --
- bgpd/bgp_attr.c   |   11 -----------
- 3 files changed, 0 insertions(+), 49 deletions(-)
-
-diff --git a/bgpd/bgp_aspath.c b/bgpd/bgp_aspath.c
-index 440815b..e43d1f1 100644
---- a/bgpd/bgp_aspath.c
-+++ b/bgpd/bgp_aspath.c
-@@ -1122,42 +1122,6 @@ aspath_private_as_check (struct aspath *aspath)
-   return 1;
- }
- 
--/* AS path confed check.  If aspath contains confed set or sequence then return 1. */
--int
--aspath_confed_check (struct aspath *aspath)
--{
--  struct assegment *seg;
--
--  if ( !(aspath && aspath->segments) )
--    return 0;
--
--  seg = aspath->segments;
--
--  while (seg)
--    {
--      if (seg->type == AS_CONFED_SET || seg->type == AS_CONFED_SEQUENCE)
--	  return 1;
--      seg = seg->next;
--    }
--  return 0;
--}
--
--/* Leftmost AS path segment confed check.  If leftmost AS segment is of type
--  AS_CONFED_SEQUENCE or AS_CONFED_SET then return 1.  */
--int
--aspath_left_confed_check (struct aspath *aspath)
--{
--
--  if ( !(aspath && aspath->segments) )
--    return 0;
--
--  if ( (aspath->segments->type == AS_CONFED_SEQUENCE)
--      || (aspath->segments->type == AS_CONFED_SET) )
--    return 1;
--
--  return 0;
--}
--
- /* Merge as1 to as2.  as2 should be uninterned aspath. */
- static struct aspath *
- aspath_merge (struct aspath *as1, struct aspath *as2)
-diff --git a/bgpd/bgp_aspath.h b/bgpd/bgp_aspath.h
-index 9854d18..2b4625c 100644
---- a/bgpd/bgp_aspath.h
-+++ b/bgpd/bgp_aspath.h
-@@ -88,8 +88,6 @@ extern unsigned int aspath_key_make (void *);
- extern int aspath_loop_check (struct aspath *, as_t);
- extern int aspath_private_as_check (struct aspath *);
- extern int aspath_firstas_check (struct aspath *, as_t);
--extern int aspath_confed_check (struct aspath *);
--extern int aspath_left_confed_check (struct aspath *);
- extern unsigned long aspath_count (void);
- extern unsigned int aspath_count_hops (struct aspath *);
- extern unsigned int aspath_count_confeds (struct aspath *);
-diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
-index 5e7536a..0668e9a 100644
---- a/bgpd/bgp_attr.c
-+++ b/bgpd/bgp_attr.c
-@@ -872,17 +872,6 @@ static int bgp_attr_aspath_check( struct peer *peer,
- 
-   bgp = peer->bgp;
-     
--  /* Confederation sanity check. */
--  if ((peer_sort (peer) == BGP_PEER_CONFED && ! aspath_left_confed_check (attr->aspath)) ||
--     (peer_sort (peer) == BGP_PEER_EBGP && aspath_confed_check (attr->aspath)))
--    {
--      zlog (peer->log, LOG_ERR, "Malformed AS path from %s", peer->host);
--      bgp_notify_send (peer, 
--		       BGP_NOTIFY_UPDATE_ERR, 
--		       BGP_NOTIFY_UPDATE_MAL_AS_PATH);
--      return -1;
--    }
--
-   /* First AS check for EBGP. */
-   if (bgp != NULL && bgp_flag_check (bgp, BGP_FLAG_ENFORCE_FIRST_AS))
-     {
--- 
-1.6.0.4
-
-- 
cgit v1.2.3


From 8a19e364da407268b0338e1c76d92cfbd422b0c7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 25 May 2010 14:38:16 +0000
Subject: testing/xmlrpc-c: new aport

This library provides a modular implementation of XML-RPC for C and C++
http://xmlrpc-c.sourceforge.net/
---
 testing/xmlrpc-c/APKBUILD | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 testing/xmlrpc-c/APKBUILD

diff --git a/testing/xmlrpc-c/APKBUILD b/testing/xmlrpc-c/APKBUILD
new file mode 100644
index 00000000..86777e1b
--- /dev/null
+++ b/testing/xmlrpc-c/APKBUILD
@@ -0,0 +1,42 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=xmlrpc-c
+pkgver=1.06.40
+pkgrel=0
+pkgdesc="This library provides a modular implementation of XML-RPC for C and C++"
+url="http://xmlrpc-c.sourceforge.net/"
+license="custom:xmlrpc-c"
+depends=
+makedepends="libtool curl-dev libxml2-dev zlib-dev"
+subpackages="$pkgname-dev $pkgname-doc xmlrpc-c++:cxx"
+source="http://downloads.sourceforge.net/sourceforge/$pkgname/$pkgname-$pkgver.tgz"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--mandir=/usr/share/man \
+		--enable-libxml2-backend \
+		--disable-cgi-server \
+		--disable-abyss-server \
+		--disable-libwww-client \
+		--disable-wininet-client
+	# no parallel builds :-(
+	make -C include &&\
+	make -C lib &&\
+	make -j1 -C src &&\
+	make
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	install -m 644 -D doc/COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
+}
+
+cxx() {
+	pkgdesc="This library provides a modular implementation of XML-RPC for C++"
+	mkdir -p "$subpkgdir"/usr/lib
+	mv "$pkgdir"/usr/lib/*++* "$subpkgdir"/usr/lib/
+}
+
+md5sums="684fd8b9edda6da55a58d2a18e5056c5  xmlrpc-c-1.06.40.tgz"
-- 
cgit v1.2.3


From 5265583427de9887f6a8109c2494d17052b9674c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 25 May 2010 16:04:32 +0000
Subject: testing/kamailio: added xmlrpc module

fixes #352
---
 testing/kamailio/APKBUILD | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/testing/kamailio/APKBUILD b/testing/kamailio/APKBUILD
index d113912c..fff29082 100644
--- a/testing/kamailio/APKBUILD
+++ b/testing/kamailio/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=kamailio
 pkgver=3.0.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Open Source SIP Server"
 url="http://www.kamailio.org/"
 pkgusers="kamailio"
@@ -23,6 +23,7 @@ source="http://www.kamailio.org/pub/kamailio/$pkgver/src/kamailio-${pkgver}_src.
 	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
+_modules="db_postgres mediaproxy db_unixodbc carrierroute xmlrpc" 
 prepare() {
 	cd "$_builddir"
 	patch -p1 -i "$srcdir"/kamailio-3-backslash.patch || return 1
@@ -57,7 +58,7 @@ build() {
 		MODS_PRESENCE=yes \
 		MODS_RADIUS= \
 		TLS= \
-		include_modules="db_postgres mediaproxy db_unixodbc carrierroute" \
+		include_modules="$_modules" \
 		all || return 1
 }
 
@@ -70,7 +71,7 @@ package() {
 		MODS_PRESENCE=yes \
 		MODS_RADIUS= \
 		TLS= \
-		include_modules="db_postgres mediaproxy db_unixodbc carrierroute" \
+		include_modules="$_modules" \
 		basedir="$pkgdir" install || return 1
 
 	# move default config to -doc package and use our own default config
-- 
cgit v1.2.3


From cdd6e1dfa1cd5e59f95a5dbdf978c7c766eacd26 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 26 May 2010 13:02:00 +0000
Subject: testing/privoxy: new aport

A web proxy with advanced filtering capabilities
http://www.privoxy.org
---
 testing/privoxy/APKBUILD                    |  55 ++++++++++++++
 testing/privoxy/privoxy-3.0.16-gentoo.patch | 108 ++++++++++++++++++++++++++++
 testing/privoxy/privoxy.initd               |  32 +++++++++
 testing/privoxy/privoxy.logrotate           |   9 +++
 testing/privoxy/privoxy.pre-install         |   6 ++
 5 files changed, 210 insertions(+)
 create mode 100644 testing/privoxy/APKBUILD
 create mode 100644 testing/privoxy/privoxy-3.0.16-gentoo.patch
 create mode 100644 testing/privoxy/privoxy.initd
 create mode 100644 testing/privoxy/privoxy.logrotate
 create mode 100644 testing/privoxy/privoxy.pre-install

diff --git a/testing/privoxy/APKBUILD b/testing/privoxy/APKBUILD
new file mode 100644
index 00000000..3499e917
--- /dev/null
+++ b/testing/privoxy/APKBUILD
@@ -0,0 +1,55 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=privoxy
+pkgver=3.0.16
+pkgrel=0
+pkgdesc="A web proxy with advanced filtering capabilities"
+url="http://www.privoxy.org"
+license="GPL"
+pkgusers="privoxy"
+pkggroups="privoxy"
+depends=
+makedepends="autoconf automake pcre-dev zlib-dev coreutils"
+install="privoxy.pre-install"
+subpackages="$pkgname-doc"
+source="http://downloads.sourceforge.net/ijbswa/$pkgname-$pkgver-stable-src.tar.gz
+	$pkgname.initd
+	$pkgname.logrotate
+	privoxy-3.0.16-gentoo.patch
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver-stable
+prepare() {
+	cd "$_builddir"
+	patch -p1 -i "$srcdir"/privoxy-3.0.16-gentoo.patch || return 1
+	aclocal && autoheader && autoconf
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--localstatedir=/var/ \
+		--enable-zlib \
+		--enable-dynamic-pcre \
+		--with-user=privoxy \
+		--with-group=privoxy \
+		--sysconfdir=/etc/privoxy \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	rm $pkgdir/var/log/privoxy/*
+	install -D -m755 "$srcdir"/privoxy.initd "$pkgdir"/etc/init.d/privoxy
+	install -D -m644 "$srcdir"/privoxy.logrotate \
+		"$pkgdir"/etc/logrotate.d/privoxy
+	find "$pkgdir"/etc/privoxy/ -type d | xargs chmod 770
+	find "$pkgdir"/etc/privoxy/ -type f | xargs chmod 660
+	chown -R privoxy:privoxy "$pkgdir"/var/log/privoxy
+}
+
+md5sums="64d3ffcdf8307e04a375773bb4eb255e  privoxy-3.0.16-stable-src.tar.gz
+170d5679e4c3504f07ef1a4c9859e9b8  privoxy.initd
+f2b6a652dbfbc65e5b89024a8ea3da7e  privoxy.logrotate
+48cce19ecdcf8f17a021ac3aa8f837bc  privoxy-3.0.16-gentoo.patch"
diff --git a/testing/privoxy/privoxy-3.0.16-gentoo.patch b/testing/privoxy/privoxy-3.0.16-gentoo.patch
new file mode 100644
index 00000000..d445ec1b
--- /dev/null
+++ b/testing/privoxy/privoxy-3.0.16-gentoo.patch
@@ -0,0 +1,108 @@
+--- privoxy/GNUmakefile.in
++++ privoxy/GNUmakefile.in
+@@ -61,10 +61,10 @@
+ MAN_DIR      = @mandir@
+ MAN_DEST     = $(MAN_DIR)/man1
+ SHARE_DEST   = @datadir@
+-DOC_DEST     = $(SHARE_DEST)/doc/privoxy
++DOC_DEST     = @docdir@
+-VAR_DEST     = @localstatedir@
++VAR_DEST     = /var
+ LOGS_DEST    = $(VAR_DEST)/log/privoxy
+ PIDS_DEST    = $(VAR_DEST)/run
+ 
+ # if $prefix = /usr/local then the default CONFDEST change from 
+ # CONF_DEST = $(CONF_BASE) to CONF_DEST = $(CONF_BASE)/privoxy  
+@@ -901,34 +901,8 @@
+ 	fi ;\
+ 	$(ECHO) Installing configuration files to $(DESTDIR)$(CONF_DEST);\
+ 	for i in $(CONFIGS); do \
+-		if [ "$$i" = "default.action" ] || [ "$$i" = "default.filter" ] ; then \
+-			$(RM) $(DESTDIR)$(CONF_DEST)/$$i ;\
+-			$(ECHO) Installing fresh $$i;\
+ 			$(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST) || exit 1;\
+-		elif [ -s "$(CONF_DEST)/$$i" ]; then \
+-			$(ECHO) Installing $$i as $$i.new ;\
+-			$(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST)/$$i.new || exit 1;\
+-			NEW=1;\
+-		else \
+-			$(INSTALL) $$INSTALL_CONF $$i $(DESTDIR)$(CONF_DEST) || exit 1;\
+-		fi ;\
+ 	done ;\
+-	if [ -n "$$NEW" ]; then \
+-		$(CHMOD) $(RWD_MODE) $(DESTDIR)$(CONF_DEST)/*.new || exit 1 ;\
+-		$(ECHO) "Warning: Older config files are preserved. Check new versions for changes!" ;\
+-	fi ;\
+-	[ ! -f $(DESTDIR)$(LOG_DEST)/logfile ] && $(ECHO) Creating logfiles in $(DESTDIR)$(LOG_DEST) || \
+-		$(ECHO) Checking logfiles in $(DESTDIR)$(LOG_DEST) ;\
+-		$(TOUCH) $(DESTDIR)$(LOG_DEST)/logfile || exit 1 ;\
+-	if [ x$$USER != x ]; then \
+-		$(CHOWN) $$USER $(DESTDIR)$(LOG_DEST)/logfile || \
+-		$(ECHO) "** WARNING ** current install user different from configured user. Logging may fail!!" ;\
+-	fi ;\
+-	if [ x$$GROUP_T != x ]; then \
+-		$(CHGRP) $$GROUP_T $(DESTDIR)$(LOG_DEST)/logfile || \
+-		$(ECHO) "** WARNING ** current install user different from configured user. Logging may fail!!" ;\
+-	fi ;\
+-	$(CHMOD) $(RWD_MODE) $(DESTDIR)$(LOG_DEST)/logfile || exit 1 ;\
+ 	if [ "$(prefix)" = "/usr/local" ] || [ "$(prefix)" = "/usr" ]; then \
+ 		if [ -f /etc/slackware-version ] && [ -d /etc/rc.d/ ] && [ -w /etc/rc.d/ ] ; then \
+                $(SED) 's+%PROGRAM%+$(PROGRAM)+' slackware/rc.privoxy.orig | \
+--- privoxy/config
++++ privoxy/config
+@@ -267,7 +267,7 @@
+ #
+ #      No trailing "/", please.
+ #
+-confdir .
++confdir /etc/privoxy
+ #
+ #
+ #  2.2. templdir
+@@ -324,7 +324,7 @@
+ #
+ #      No trailing "/", please.
+ #
+-logdir .
++logdir /var/log/privoxy
+ #
+ #
+ #  2.4. actionsfile
+@@ -464,7 +464,7 @@
+ #      Any log files must be writable by whatever user Privoxy is
+ #      being run as (on Unix, default user id is "privoxy").
+ #
+-logfile logfile
++logfile privoxy.log
+ #
+ #
+ #  2.7. trustfile
+--- privoxy/default.action.master
++++ privoxy/default.action.master
+@@ -564,7 +564,7 @@
+ { \
+ +change-x-forwarded-for{block} \
+ +hide-from-header{block} \
+-+set-image-blocker{pattern} \
+++set-image-blocker{blank} \
+ }
+ standard.Cautious
+ 
+@@ -584,7 +584,7 @@
+ +hide-from-header{block} \
+ +hide-referrer{conditional-block} \
+ +session-cookies-only \
+-+set-image-blocker{pattern} \
+++set-image-blocker{blank} \
+ }
+ standard.Medium
+ 
+@@ -623,7 +623,7 @@
+ +hide-referrer{conditional-block} \
+ +limit-connect{,} \
+ +overwrite-last-modified{randomize} \
+-+set-image-blocker{pattern} \
+++set-image-blocker{blank} \
+ }
+ standard.Advanced
+ 
diff --git a/testing/privoxy/privoxy.initd b/testing/privoxy/privoxy.initd
new file mode 100644
index 00000000..ef984ea3
--- /dev/null
+++ b/testing/privoxy/privoxy.initd
@@ -0,0 +1,32 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-proxy/privoxy/files/privoxy.initd,v 1.2 2007/11/14 05:14:56 mrness Exp $
+
+CONFFILE=/etc/${SVCNAME}/config
+PIDFILE=/var/run/${SVCNAME}.pid
+
+depend() {
+	need net
+}
+
+start() {
+	if [ ! -f "${CONFFILE}" ]; then
+		eerror "Configuration file ${CONFFILE} not found!"
+		return 1
+	fi
+
+	ebegin "Starting privoxy"
+	start-stop-daemon --start --quiet --exec /usr/sbin/privoxy \
+		--pidfile "${PIDFILE}" \
+		-- \
+		--pidfile "${PIDFILE}" \
+		--user privoxy.privoxy "${CONFFILE}"
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping privoxy"
+	start-stop-daemon --stop --quiet --pidfile "${PIDFILE}"
+	eend $?
+}
diff --git a/testing/privoxy/privoxy.logrotate b/testing/privoxy/privoxy.logrotate
new file mode 100644
index 00000000..aa7463bd
--- /dev/null
+++ b/testing/privoxy/privoxy.logrotate
@@ -0,0 +1,9 @@
+/var/log/privoxy/privoxy.log /var/log/privoxy/jarfile {
+	missingok
+	notifempty
+	create 0640 privoxy privoxy
+	sharedscripts
+	postrotate
+		killall -HUP privoxy 2>/dev/null || true
+	endscript
+}
diff --git a/testing/privoxy/privoxy.pre-install b/testing/privoxy/privoxy.pre-install
new file mode 100644
index 00000000..38db0028
--- /dev/null
+++ b/testing/privoxy/privoxy.pre-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+addgroup privoxy 2>/dev/null
+adduser -S -G privoxy -h /var/log/privoxy -s /bin/false -D privoxy 2>/dev/null
+exit 0
+
-- 
cgit v1.2.3


From 85c7ebe3d5c03a151d18135ebcda83f7a57fdcd0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 26 May 2010 14:03:37 +0000
Subject: main/alpine-conf: bugfix for setup-disk

---
 main/alpine-conf/APKBUILD             | 13 ++++++++++---
 main/alpine-conf/setup-disk-fix.patch | 19 +++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 main/alpine-conf/setup-disk-fix.patch

diff --git a/main/alpine-conf/APKBUILD b/main/alpine-conf/APKBUILD
index 1f4bbf3f..239a9f6a 100644
--- a/main/alpine-conf/APKBUILD
+++ b/main/alpine-conf/APKBUILD
@@ -1,14 +1,20 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alpine-conf
 pkgver=2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Alpine configuration management scripts"
 url=http://git.alpinelinux.org/cgit/$pkgname
 depends="openrc"
-source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2"
+source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
+	setup-disk-fix.patch"
 license="GPL-2"
 
 _builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	patch -p1 -i "$srcdir"/setup-disk-fix.patch
+}
+
 build() {
 	cd "$_builddir"
 	make || return 1
@@ -21,4 +27,5 @@ package() {
 		ln -s lbu "$pkgdir"/sbin/lbu_$i
 	done
 }
-md5sums="9e7b7602a16fb64a10ded850c508d412  alpine-conf-2.3.tar.bz2"
+md5sums="9e7b7602a16fb64a10ded850c508d412  alpine-conf-2.3.tar.bz2
+27b009c1193e396ee145f59cd3844a2c  setup-disk-fix.patch"
diff --git a/main/alpine-conf/setup-disk-fix.patch b/main/alpine-conf/setup-disk-fix.patch
new file mode 100644
index 00000000..2fa7aec4
--- /dev/null
+++ b/main/alpine-conf/setup-disk-fix.patch
@@ -0,0 +1,19 @@
+commit e149170d4736017c76b09625fa9a4b6a90b5e3a3
+Author: Natanael Copa <ncopa@alpinelinux.org>
+Date:   Wed May 26 13:59:25 2010 +0000
+
+    setup-disk: fix typo in the option handling
+
+diff --git a/setup-disk.in b/setup-disk.in
+index 7a485b8..aa4a92f 100644
+--- a/setup-disk.in
++++ b/setup-disk.in
+@@ -401,7 +401,7 @@ while getopts "hk:o:r" opt; do
+ 		*) usage;;
+ 	esac
+ done
+-shift $(( OPTIND - 1))
++shift $(( $OPTIND - 1))
+ 
+ if [ -d "$1" ]; then
+ 	# install to given mounted root
-- 
cgit v1.2.3


From d5573f345d7ac1af52bf6c97018b110d4f53ad1a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 26 May 2010 14:08:36 +0000
Subject: main/apk-tools: fix fd leak

---
 ...01-package-don-t-leak-signing-key-file-fd.patch | 27 ++++++++++++++++++++++
 main/apk-tools/APKBUILD                            |  6 +++--
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch

diff --git a/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch b/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch
new file mode 100644
index 00000000..6ff88a31
--- /dev/null
+++ b/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch
@@ -0,0 +1,27 @@
+From fe55da70741621f7bac2cd943b64cc13e25f9427 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Wed, 26 May 2010 14:30:08 +0300
+Subject: [PATCH] package: don't leak signing key file fd
+
+openssl BIO does not close the fd unless we explicitly tell it to
+do so.
+---
+ src/package.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/src/package.c b/src/package.c
+index b265468..b97c412 100644
+--- a/src/package.c
++++ b/src/package.c
+@@ -441,7 +441,7 @@ int apk_sign_ctx_process_file(struct apk_sign_ctx *ctx,
+ 		if (fd < 0)
+ 			return 0;
+ 
+-		bio  = BIO_new_fp(fdopen(fd, "r"), 0);
++		bio = BIO_new_fp(fdopen(fd, "r"), BIO_CLOSE);
+ 		ctx->signature.pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
+ 		if (ctx->signature.pkey != NULL) {
+ 			if (fi->name[6] == 'R')
+-- 
+1.7.1
+
diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index 87d4d699..edf083e8 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,13 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=4
+pkgrel=5
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
 makedepends="zlib-dev openssl-dev pkgconfig"
 source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
 	info-segfault.patch
+	0001-package-don-t-leak-signing-key-file-fd.patch
 	"
 
 
@@ -45,4 +46,5 @@ static() {
 }
 
 md5sums="c87cb88f90eb8d7021d37e3b5386863d  apk-tools-2.0.2.tar.bz2
-aeab86a00119f9945edd6d3c3a8bb9c1  info-segfault.patch"
+aeab86a00119f9945edd6d3c3a8bb9c1  info-segfault.patch
+ac2ddef3f82f700c9eb536a54050cca6  0001-package-don-t-leak-signing-key-file-fd.patch"
-- 
cgit v1.2.3


From 4dc9bf2acd6573e4599a07be2f3fa1da418642ff Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 26 May 2010 14:47:44 +0000
Subject: main/linux-vserver: ugprade to 2.6.32.13-vs2.3.0.36.29.4

---
 main/linux-vserver/APKBUILD | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/main/linux-vserver/APKBUILD b/main/linux-vserver/APKBUILD
index 2663a0c0..57f7ec06 100644
--- a/main/linux-vserver/APKBUILD
+++ b/main/linux-vserver/APKBUILD
@@ -2,10 +2,10 @@
 
 _flavor=vserver
 pkgname=linux-${_flavor}
-pkgver=2.6.32.12
+pkgver=2.6.32.13
 
 _kernver=2.6.32
-pkgrel=1
+pkgrel=0
 pkgdesc="Linux kernel with vserver"
 url="http://linux-vserver.org/"
 depends="mkinitfs linux-firmware"
@@ -15,7 +15,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	http://vserver.13thfloor.at/Experimental/patch-2.6.32.12-vs2.3.0.36.29.4.diff
+	http://vserver.13thfloor.at/Experimental/patch-2.6.32.13-vs2.3.0.36.29.4.diff
 	kernelconfig.x86
 	"
 subpackages="$pkgname-dev"
@@ -115,6 +115,6 @@ dev() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-9d097d34648a1734b1a7f97c5d000f03  patch-2.6.32.12.bz2
-cbf358edd0f416b035d13114fdc34ccb  patch-2.6.32.12-vs2.3.0.36.29.4.diff
+ba6abb1ffee513a1d4f831599ddae490  patch-2.6.32.13.bz2
+ef893f851b25e3806f24f1460e11f9b5  patch-2.6.32.13-vs2.3.0.36.29.4.diff
 42ce36a36e7c71ee54761e56d59d17ed  kernelconfig.x86"
-- 
cgit v1.2.3


From f12146d5ba7a85010295e4142ca35d9ea1588fb2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Wed, 26 May 2010 15:12:15 +0000
Subject: main/apk-tools: backprt more patches from upstream

---
 ...erying-of-removed-but-referenced-packages.patch |  27 +++
 ...01-package-don-t-leak-signing-key-file-fd.patch |  27 ---
 ...et-versioned-deps-in-world-when-doing-upg.patch |  42 ++++
 ...-search-for-reverse-dependencies-in-index.patch | 221 +++++++++++++++++++++
 ...04-package-don-t-leak-signing-key-file-fd.patch |  27 +++
 .../0005-cache-display-more-than-one-error.patch   |  55 +++++
 main/apk-tools/APKBUILD                            |  16 +-
 main/apk-tools/info-segfault.patch                 |  22 --
 8 files changed, 383 insertions(+), 54 deletions(-)
 create mode 100644 main/apk-tools/0001-info-fix-querying-of-removed-but-referenced-packages.patch
 delete mode 100644 main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch
 create mode 100644 main/apk-tools/0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch
 create mode 100644 main/apk-tools/0003-search-add-search-for-reverse-dependencies-in-index.patch
 create mode 100644 main/apk-tools/0004-package-don-t-leak-signing-key-file-fd.patch
 create mode 100644 main/apk-tools/0005-cache-display-more-than-one-error.patch
 delete mode 100644 main/apk-tools/info-segfault.patch

diff --git a/main/apk-tools/0001-info-fix-querying-of-removed-but-referenced-packages.patch b/main/apk-tools/0001-info-fix-querying-of-removed-but-referenced-packages.patch
new file mode 100644
index 00000000..4df956bf
--- /dev/null
+++ b/main/apk-tools/0001-info-fix-querying-of-removed-but-referenced-packages.patch
@@ -0,0 +1,27 @@
+From 87420aaf295f58847332ba3aa89691a0259baace Mon Sep 17 00:00:00 2001
+From: Timo Teras <timo.teras@iki.fi>
+Date: Wed, 5 May 2010 08:56:06 +0300
+Subject: [PATCH 1/5] info: fix querying of removed, but referenced packages
+
+Check that package name has packages associated with it before
+dereferencing the pointer. Fixes #345.
+---
+ src/info.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/src/info.c b/src/info.c
+index 7ca486c..d944fca 100644
+--- a/src/info.c
++++ b/src/info.c
+@@ -283,7 +283,7 @@ static int info_package(struct info_ctx *ctx, struct apk_database *db,
+ 
+ 	for (i = 0; i < argc; i++) {
+ 		name = apk_db_query_name(db, APK_BLOB_STR(argv[i]));
+-		if (name == NULL) {
++		if (name == NULL || name->pkgs == NULL) {
+ 			apk_error("Not found: %s", argv[i]);
+ 			return 1;
+ 		}
+-- 
+1.7.1
+
diff --git a/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch b/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch
deleted file mode 100644
index 6ff88a31..00000000
--- a/main/apk-tools/0001-package-don-t-leak-signing-key-file-fd.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From fe55da70741621f7bac2cd943b64cc13e25f9427 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Wed, 26 May 2010 14:30:08 +0300
-Subject: [PATCH] package: don't leak signing key file fd
-
-openssl BIO does not close the fd unless we explicitly tell it to
-do so.
----
- src/package.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/src/package.c b/src/package.c
-index b265468..b97c412 100644
---- a/src/package.c
-+++ b/src/package.c
-@@ -441,7 +441,7 @@ int apk_sign_ctx_process_file(struct apk_sign_ctx *ctx,
- 		if (fd < 0)
- 			return 0;
- 
--		bio  = BIO_new_fp(fdopen(fd, "r"), 0);
-+		bio = BIO_new_fp(fdopen(fd, "r"), BIO_CLOSE);
- 		ctx->signature.pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
- 		if (ctx->signature.pkey != NULL) {
- 			if (fi->name[6] == 'R')
--- 
-1.7.1
-
diff --git a/main/apk-tools/0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch b/main/apk-tools/0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch
new file mode 100644
index 00000000..2e20152d
--- /dev/null
+++ b/main/apk-tools/0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch
@@ -0,0 +1,42 @@
+From 47bac8c29c9a3c3fbebfd20e907170f24f9d677c Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Tue, 11 May 2010 09:31:20 +0000
+Subject: [PATCH 2/5] upgrade: reset versioned deps in world when doing upgrade -a
+
+Doing "apk add file.apk" adds a versioned dependency to allow
+downgrading, and sticky version. Most often this is to install
+single packages from newer repository. So it would make sense
+to reset them to non-versioned if doing:
+
+ apk upgrade -a
+
+fixes #346
+---
+ src/upgrade.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/upgrade.c b/src/upgrade.c
+index f91e8cc..879e14c 100644
+--- a/src/upgrade.c
++++ b/src/upgrade.c
+@@ -41,10 +41,15 @@ static int upgrade_main(void *ctx, struct apk_database *db, int argc, char **arg
+ 		goto err;
+ 
+ 	for (i = 0; i < db->world->num; i++) {
+-		r = apk_state_lock_dependency(state, &db->world->item[i]);
++		struct apk_dependency *dep = &db->world->item[i];
++		if (dep->version && (apk_flags & APK_PREFER_AVAILABLE)) {
++			dep->result_mask = APK_VERSION_EQUAL | APK_VERSION_LESS | APK_VERSION_GREATER;
++			dep->version = NULL;
++		}
++		r = apk_state_lock_dependency(state, dep);
+ 		if (r != 0) {
+ 			apk_error("Unable to upgrade '%s'",
+-				  db->world->item[i].name->name);
++				  dep->name->name);
+ 			goto err;
+ 		}
+ 	}
+-- 
+1.7.1
+
diff --git a/main/apk-tools/0003-search-add-search-for-reverse-dependencies-in-index.patch b/main/apk-tools/0003-search-add-search-for-reverse-dependencies-in-index.patch
new file mode 100644
index 00000000..f2947c63
--- /dev/null
+++ b/main/apk-tools/0003-search-add-search-for-reverse-dependencies-in-index.patch
@@ -0,0 +1,221 @@
+From d9bf4aabff801164b4c54e51b38c5f6eab2da114 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Wed, 19 May 2010 16:48:40 +0300
+Subject: [PATCH 3/5] search: add search for reverse dependencies in index
+
+So it'll be easier to rebuild affected packages. Fixes #349.
+---
+ src/search.c |  148 +++++++++++++++++++++++++++++++++++----------------------
+ 1 files changed, 91 insertions(+), 57 deletions(-)
+
+diff --git a/src/search.c b/src/search.c
+index 91c2913..e5e5d55 100644
+--- a/src/search.c
++++ b/src/search.c
+@@ -18,18 +18,14 @@
+ #include "apk_state.h"
+ 
+ struct search_ctx {
+-	int (*action)(struct apk_database *db, int argc, char **argv);
++	int (*match)(struct apk_package *pkg, const char *str);
++	int (*print)(struct apk_package *pkg);
++	int argc;
++	char **argv;
+ };
+ 
+-struct search_query_ctx {
+-	struct apk_database *db;
+-	const char *query;
+-};
+-
+-static int search_list_print(apk_hash_item item, void *ctx)
++static int print_match(struct apk_package *pkg)
+ {
+-	struct apk_package *pkg = (struct apk_package *) item;
+-
+ 	printf("%s", pkg->name->name);
+ 	if (apk_verbosity > 0)
+ 		printf("-%s", pkg->version);
+@@ -41,61 +37,50 @@ static int search_list_print(apk_hash_item item, void *ctx)
+ 	return 0;
+ }
+ 
+-static int search_query_print(apk_hash_item item, void *ctx)
++static int print_rdepends(struct apk_package *pkg)
+ {
+-	struct search_query_ctx *ictx = (struct search_query_ctx *) ctx;
+-	struct apk_package *pkg = (struct apk_package *) item;
++	struct apk_name *name, *name0;
++	struct apk_package *pkg0;
++	struct apk_dependency *dep;
++	int i, j, k;
+ 
+-	if (fnmatch(ictx->query, pkg->name->name, 0) != 0)
++	name = pkg->name;
++	if (name->rdepends == NULL)
+ 		return 0;
+-	search_list_print(item, ictx->db);
+-
+-	return 0;
+-}
+-
+-static int search_list(struct apk_database *db, int argc, char **argv)
+-{
+-	int i;
+-	struct search_query_ctx ctx;
+-
+-	ctx.db = db;
+ 
+-	if (argc == 0)
+-		apk_hash_foreach(&db->available.packages, search_list_print, db);
+-	else
+-		for (i=0; i<argc; i++) {
+-			ctx.query = argv[i];
+-			apk_hash_foreach(&db->available.packages, search_query_print, &ctx);
++	printf("%s-%s:", pkg->name->name, pkg->version);
++	for (i = 0; i < name->rdepends->num; i++) {
++		name0 = name->rdepends->item[i];
++		if (name0->pkgs == NULL)
++			continue;
++		for (j = 0; j < name0->pkgs->num; j++) {
++			pkg0 = name0->pkgs->item[j];
++			if (pkg0->depends == NULL)
++				continue;
++			for (k = 0; k < pkg0->depends->num; k++) {
++				dep = &pkg0->depends->item[k];
++				if (name == dep->name &&
++				    (apk_version_compare(pkg->version, dep->version)
++				      & dep->result_mask)) {
++					printf(" %s-%s", pkg0->name->name, pkg0->version);
++				}
++			}
+ 		}
++	}
++	printf("\n");
+ 
+ 	return 0;
+ }
+ 
+-static int search_query_desc_print(apk_hash_item item, void *ctx)
++static int search_pkgname(struct apk_package *pkg, const char *str)
+ {
+-	struct search_query_ctx *ictx = (struct search_query_ctx *) ctx;
+-	struct apk_package *pkg = (struct apk_package *) item;
+-
+-	if( strstr(pkg->description, ictx->query) == NULL )
+-		return 0;
+-	search_list_print(item, ictx->db);
+-
+-	return 0;
++	return fnmatch(str, pkg->name->name, 0) == 0;
+ }
+ 
+-static int search_desc(struct apk_database *db, int argc, char **argv)
++static int search_desc(struct apk_package *pkg, const char *str)
+ {
+-	int i;
+-	struct search_query_ctx ctx;
+-
+-	ctx.db = db;
+-
+-	for (i=0; i<argc; i++) {
+-		ctx.query = argv[i];
+-		apk_hash_foreach(&db->available.packages, search_query_desc_print, &ctx);
+-	}
+-
+-	return 0;
++	return  strstr(pkg->name->name, str) != NULL ||
++		strstr(pkg->description, str) != NULL;
+ }
+ 
+ static int search_parse(void *ctx, struct apk_db_options *dbopts,
+@@ -105,7 +90,10 @@ static int search_parse(void *ctx, struct apk_db_options *dbopts,
+ 
+ 	switch (optch) {
+ 	case 'd':
+-		ictx->action = search_desc;
++		ictx->match = search_desc;
++		break;
++	case 'r':
++		ictx->print = print_rdepends;
+ 		break;
+ 	default:
+ 		return -1;
+@@ -113,23 +101,69 @@ static int search_parse(void *ctx, struct apk_db_options *dbopts,
+ 	return 0;
+ }
+ 
++static int match_packages(apk_hash_item item, void *ctx)
++{
++	struct search_ctx *ictx = (struct search_ctx *) ctx;
++	struct apk_package *pkg = (struct apk_package *) item;
++	int i;
++
++	for (i = 0; i < ictx->argc; i++)
++		if (ictx->match(pkg, ictx->argv[i]))
++			break;
++	if (ictx->argc == 0 || i < ictx->argc)
++		ictx->print(pkg);
++
++	return 0;
++}
++
+ static int search_main(void *ctx, struct apk_database *db, int argc, char **argv)
+ {
+ 	struct search_ctx *ictx = (struct search_ctx *) ctx;
++	struct apk_name *name;
++	int rc = 0, i, j, slow_search;
++
++	slow_search = ictx->match != NULL || argc == 0;
++	if (!slow_search) {
++		for (i = 0; i < argc; i++)
++			if (strcspn(argv[i], "*?[") != strlen(argv[i])) {
++				slow_search = 1;
++				break;
++			}
++	}
++
++	if (ictx->match == NULL)
++		ictx->match = search_pkgname;
++	if (ictx->print == NULL)
++		ictx->print = print_match;
++	else if (argc == 0)
++		return -1;
+ 
+-	if (ictx->action != NULL)
+-		return ictx->action(db, argc, argv);
++	if (slow_search) {
++		ictx->argc = argc;
++		ictx->argv = argv;
++		rc = apk_hash_foreach(&db->available.packages,
++				      match_packages, ictx);
++	} else {
++		for (i = 0; i < argc; i++) {
++			name = apk_db_query_name(db, APK_BLOB_STR(argv[i]));
++			if (name == NULL || name->pkgs == NULL)
++				continue;
++			for (j = 0; j < name->pkgs->num; j++)
++				ictx->print(name->pkgs->item[j]);
++		}
++	}
+ 
+-	return search_list(db, argc, argv);
++	return rc;
+ }
+ 
+ static struct apk_option search_options[] = {
+-	{ 'd', "description", "Search also package descriptions" },
++	{ 'd', "description",	"Search also package descriptions" },
++	{ 'r', "rdepends",	"Print reverse dependencies of package" },
+ };
+ 
+ static struct apk_applet apk_search = {
+ 	.name = "search",
+-	.help = "Search package names (and descriptions) by wildcard PATTERN.",
++	.help = "Search package by PATTERNs or by indexed dependencies.",
+ 	.arguments = "PATTERN",
+ 	.open_flags = APK_OPENF_READ | APK_OPENF_NO_STATE,
+ 	.context_size = sizeof(struct search_ctx),
+-- 
+1.7.1
+
diff --git a/main/apk-tools/0004-package-don-t-leak-signing-key-file-fd.patch b/main/apk-tools/0004-package-don-t-leak-signing-key-file-fd.patch
new file mode 100644
index 00000000..818eeb1e
--- /dev/null
+++ b/main/apk-tools/0004-package-don-t-leak-signing-key-file-fd.patch
@@ -0,0 +1,27 @@
+From fe55da70741621f7bac2cd943b64cc13e25f9427 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Wed, 26 May 2010 14:30:08 +0300
+Subject: [PATCH 4/5] package: don't leak signing key file fd
+
+openssl BIO does not close the fd unless we explicitly tell it to
+do so.
+---
+ src/package.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/src/package.c b/src/package.c
+index b265468..b97c412 100644
+--- a/src/package.c
++++ b/src/package.c
+@@ -441,7 +441,7 @@ int apk_sign_ctx_process_file(struct apk_sign_ctx *ctx,
+ 		if (fd < 0)
+ 			return 0;
+ 
+-		bio  = BIO_new_fp(fdopen(fd, "r"), 0);
++		bio = BIO_new_fp(fdopen(fd, "r"), BIO_CLOSE);
+ 		ctx->signature.pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
+ 		if (ctx->signature.pkey != NULL) {
+ 			if (fi->name[6] == 'R')
+-- 
+1.7.1
+
diff --git a/main/apk-tools/0005-cache-display-more-than-one-error.patch b/main/apk-tools/0005-cache-display-more-than-one-error.patch
new file mode 100644
index 00000000..6e85218b
--- /dev/null
+++ b/main/apk-tools/0005-cache-display-more-than-one-error.patch
@@ -0,0 +1,55 @@
+From d21303960544b5f11b7d69d0335f0903fb93d180 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 13 May 2010 09:26:19 +0000
+Subject: [PATCH 5/5] cache: display more than one error
+
+Display all packages that are bad in world rather than only first
+before exiting.
+---
+ src/cache.c |   15 ++++++++-------
+ 1 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/cache.c b/src/cache.c
+index 85d9777..49a71fa 100644
+--- a/src/cache.c
++++ b/src/cache.c
+@@ -30,7 +30,7 @@ static int cache_download(struct apk_database *db)
+ 	struct apk_package *pkg;
+ 	struct apk_repository *repo;
+ 	char item[PATH_MAX], cacheitem[PATH_MAX];
+-	int i, r = 0;
++	int i, r = 0, errors = 0;
+ 
+ 	if (db->world == NULL)
+ 		return 0;
+@@ -41,12 +41,13 @@ static int cache_download(struct apk_database *db)
+ 
+ 	for (i = 0; i < db->world->num; i++) {
+ 		r = apk_state_lock_dependency(state, &db->world->item[i]);
+-		if (r != 0) {
+-			apk_error("Unable to select version for '%s': %d",
+-				  db->world->item[i].name->name, r);
+-			goto err;
+-		}
++		errors += r;
++		if (r != 0)
++			apk_error("Unable to select version for '%s'",
++				  db->world->item[i].name->name);
+ 	}
++	if (errors)
++		goto err;
+ 
+ 	list_for_each_entry(change, &state->change_list_head, change_list) {
+ 		pkg = change->newpkg;
+@@ -67,7 +68,7 @@ static int cache_download(struct apk_database *db)
+ err:
+ 	if (state != NULL)
+ 		apk_state_unref(state);
+-	return r;
++	return errors;
+ }
+ 
+ static int cache_clean(struct apk_database *db)
+-- 
+1.7.1
+
diff --git a/main/apk-tools/APKBUILD b/main/apk-tools/APKBUILD
index edf083e8..07b602df 100644
--- a/main/apk-tools/APKBUILD
+++ b/main/apk-tools/APKBUILD
@@ -1,14 +1,17 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=apk-tools
 pkgver=2.0.2
-pkgrel=5
+pkgrel=6
 pkgdesc="Alpine Package Keeper - package manager for alpine"
 subpackages="$pkgname-static"
 depends=
 makedepends="zlib-dev openssl-dev pkgconfig"
 source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
-	info-segfault.patch
-	0001-package-don-t-leak-signing-key-file-fd.patch
+	0001-info-fix-querying-of-removed-but-referenced-packages.patch
+	0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch
+	0003-search-add-search-for-reverse-dependencies-in-index.patch
+	0004-package-don-t-leak-signing-key-file-fd.patch
+	0005-cache-display-more-than-one-error.patch
 	"
 
 
@@ -46,5 +49,8 @@ static() {
 }
 
 md5sums="c87cb88f90eb8d7021d37e3b5386863d  apk-tools-2.0.2.tar.bz2
-aeab86a00119f9945edd6d3c3a8bb9c1  info-segfault.patch
-ac2ddef3f82f700c9eb536a54050cca6  0001-package-don-t-leak-signing-key-file-fd.patch"
+c590e894c2580cbb092b150fca9af3cf  0001-info-fix-querying-of-removed-but-referenced-packages.patch
+5c53eaa29dd9722c25b6878cde392d05  0002-upgrade-reset-versioned-deps-in-world-when-doing-upg.patch
+6baca299fbf00b97f78fa8fbd0e82f5b  0003-search-add-search-for-reverse-dependencies-in-index.patch
+175470e6d5b2d20fe02d6fb61f8ec6d1  0004-package-don-t-leak-signing-key-file-fd.patch
+0ab64b75b09f37b4d265df3f7b5b7e83  0005-cache-display-more-than-one-error.patch"
diff --git a/main/apk-tools/info-segfault.patch b/main/apk-tools/info-segfault.patch
deleted file mode 100644
index 9479fade..00000000
--- a/main/apk-tools/info-segfault.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-commit 87420aaf295f58847332ba3aa89691a0259baace
-Author: Timo Teras <timo.teras@iki.fi>
-Date:   Wed May 5 08:56:06 2010 +0300
-
-    info: fix querying of removed, but referenced packages
-    
-    Check that package name has packages associated with it before
-    dereferencing the pointer. Fixes #345.
-
-diff --git a/src/info.c b/src/info.c
-index 7ca486c..d944fca 100644
---- a/src/info.c
-+++ b/src/info.c
-@@ -283,7 +283,7 @@ static int info_package(struct info_ctx *ctx, struct apk_database *db,
- 
- 	for (i = 0; i < argc; i++) {
- 		name = apk_db_query_name(db, APK_BLOB_STR(argv[i]));
--		if (name == NULL) {
-+		if (name == NULL || name->pkgs == NULL) {
- 			apk_error("Not found: %s", argv[i]);
- 			return 1;
- 		}
-- 
cgit v1.2.3


From 21405ea6a5c33114bb6ec07185e56d4c2704b989 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Thu, 27 May 2010 09:26:53 +0000
Subject: testing/[scst]: merge scst from experimental to master

---
 testing/iscsi-scst-svn/APKBUILD                    |   40 +
 testing/iscsi-scst-svn/iscsi-scst.initd            |   23 +
 testing/linux-scst/APKBUILD                        |  122 +
 testing/linux-scst/arp.patch                       |   14 +
 testing/linux-scst/kernelconfig.x86                | 4674 ++++++++++++++++++++
 testing/linux-scst/put_page_callback-2.6.34.patch  |  390 ++
 testing/linux-scst/scst_exec_req_fifo-2.6.34.patch |  529 +++
 testing/scst-svn-scst/APKBUILD                     |   82 +
 testing/scstadmin-svn/APKBUILD                     |   30 +
 9 files changed, 5904 insertions(+)
 create mode 100644 testing/iscsi-scst-svn/APKBUILD
 create mode 100644 testing/iscsi-scst-svn/iscsi-scst.initd
 create mode 100644 testing/linux-scst/APKBUILD
 create mode 100644 testing/linux-scst/arp.patch
 create mode 100644 testing/linux-scst/kernelconfig.x86
 create mode 100644 testing/linux-scst/put_page_callback-2.6.34.patch
 create mode 100644 testing/linux-scst/scst_exec_req_fifo-2.6.34.patch
 create mode 100644 testing/scst-svn-scst/APKBUILD
 create mode 100644 testing/scstadmin-svn/APKBUILD

diff --git a/testing/iscsi-scst-svn/APKBUILD b/testing/iscsi-scst-svn/APKBUILD
new file mode 100644
index 00000000..9b3ec420
--- /dev/null
+++ b/testing/iscsi-scst-svn/APKBUILD
@@ -0,0 +1,40 @@
+# Contributor: Carlo Landmeter
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+pkgname=iscsi-scst-svn
+pkgver=1713
+pkgrel=0
+pkgdesc="ISCSI target for SCST - userspace tools"
+url="http://iscsi-scst.sourceforge.net/"
+license="GPL-2"
+depends=
+install=
+makedepends="openssl-dev scst-svn-scst-dev"
+subpackages=
+source="http://alpine.nethq.org/clandmeter/src/$pkgname-$pkgver.tar.gz
+        iscsi-scst.initd
+        "
+
+_builddir="$srcdir"/iscsi-scst
+prepare() {
+        cd "$_builddir"
+        # we need the headre file. fix dependency in makefile
+        sed -i -e 's/^\(progs:.*\)/\1 include\/iscsi_scst_itf_ver.h/' Makefile
+}
+
+build() {
+	cd "$_builddir"
+        make progs \
+		SCST_INC_DIR=/usr/include/scst
+}
+
+package() {
+        cd "$_builddir"
+        # make install is broken
+        install -D usr/iscsi-scstd "$pkgdir"/usr/sbin/iscsi-scstd
+        install -D usr/iscsi-scst-adm "$pkgdir"/usr/sbin/iscsi-scst-adm
+        install -D -m 755 "$srcdir"/iscsi-scst.initd "$pkgdir"/etc/init.d/iscsi-scst
+}
+
+md5sums="cf046db4f7cd9cf969b054dc055922d6  iscsi-scst-svn-1713.tar.gz
+3132fae1ec2f9bcc72476d9e9f36d326  iscsi-scst.initd"
diff --git a/testing/iscsi-scst-svn/iscsi-scst.initd b/testing/iscsi-scst-svn/iscsi-scst.initd
new file mode 100644
index 00000000..4d4cd76b
--- /dev/null
+++ b/testing/iscsi-scst-svn/iscsi-scst.initd
@@ -0,0 +1,23 @@
+#!/sbin/runscript
+#
+# Start the iSCSI-SCST Target.
+#
+
+depend() {
+	need net
+	afer firewall
+}
+
+start() {
+	modprobe -q crc32c
+	modprobe -q iscsi-scst
+	ebegin "Starting iscsi-scstd"
+	start-stop-daemon --start --exec /usr/sbin/iscsi-scstd
+	eend 0
+}
+
+stop() {
+	ebegin "Stopping iscsi-scstd"
+	start-stop-daemon --stop --exec /usr/sbin/iscsi-scstd
+	eend 0
+}
diff --git a/testing/linux-scst/APKBUILD b/testing/linux-scst/APKBUILD
new file mode 100644
index 00000000..bbcd830c
--- /dev/null
+++ b/testing/linux-scst/APKBUILD
@@ -0,0 +1,122 @@
+_flavor=scst
+pkgname=linux-${_flavor}
+pkgver=2.6.34
+_kernver=$pkgver
+pkgrel=0
+pkgdesc="Linux kernel with scst"
+url="http://www.kernel.org"
+depends="mkinitfs linux-firmware"
+makedepends="perl installkernel"
+options="!strip"
+_config=${config:-kernelconfig.${CARCH:-x86}}
+install=
+source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$pkgver.tar.bz2
+        arp.patch
+        kernelconfig.x86
+        put_page_callback-2.6.34.patch
+        scst_exec_req_fifo-2.6.34.patch
+        "
+# no need to patch now
+#ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
+subpackages="$pkgname-dev"
+license="GPL-2"
+
+_abi_release=${pkgver}-${_flavor}
+
+prepare() {
+        cd "$srcdir"/linux-$_kernver
+        if [ "$_kernver" != "$pkgver" ]; then
+                bunzip2 -c < ../patch-$pkgver.bz2 | patch -p1 -N || return 1
+        fi
+
+        for i in ../*.diff ../*.patch; do
+                [ -f $i ] || continue
+                msg "Applying $i..."
+                patch -s -p1 -N < $i || return 1
+        done
+
+        mkdir -p "$srcdir"/build
+        cp "$srcdir"/$_config "$srcdir"/build/.config
+        echo "-${_flavor}" > "$srcdir"/linux-$_kernver/localversion-${_flavor}
+        make -C "$srcdir"/linux-$_kernver O="$srcdir"/build HOSTCC="$CC" \
+                silentoldconfig
+}
+
+# this is so we can do: 'abuild menuconfig' to reconfigure kernel
+menuconfig() {
+	cd "$srcdir"/build || return 1
+        make menuconfig
+        cp .config "$startdir"/$_config
+}
+
+build() {
+        cd "$srcdir"/build
+        make CC="$CC" || return 1
+}
+
+package() {
+        cd "$srcdir"/build
+        mkdir -p "$pkgdir"/boot "$pkgdir"/lib/modules
+        make modules_install install \
+                INSTALL_MOD_PATH="$pkgdir" \
+                INSTALL_PATH="$pkgdir"/boot
+
+        rm -f "$pkgdir"/lib/modules/${_abi_release}/build \
+                "$pkgdir"/lib/modules/${_abi_release}/source
+        rm -rf "$pkgdir"/lib/firmware
+
+        install -D include/config/kernel.release \
+                "$pkgdir"/usr/share/kernel/$_flavor/kernel.release
+}
+
+dev() {
+        # copy the only the parts that we really need for build 3rd party
+        # kernel modules and install those as /usr/src/linux-headers,
+        # simlar to what ubuntu does
+        #
+        # this way you dont need to install the 300-400 kernel sources to
+        # build a tiny kernel module
+        #
+        pkgdesc="Headers and script for third party modules for $pkgname kernel"
+        local dir="$subpkgdir"/usr/src/linux-headers-${_abi_release}
+
+        # first we import config, run prepare to set up for building
+        # external modules, and create the scripts
+        mkdir -p "$dir"
+        cp "$srcdir"/$_config "$dir"/.config
+        make -j1 -C "$srcdir"/linux-$_kernver O="$dir" HOSTCC="$CC" \
+                silentoldconfig prepare scripts
+
+        # remove the stuff that poits to real sources. we want 3rd party
+        # modules to believe this is the soruces
+        rm "$dir"/Makefile "$dir"/source
+
+        # copy the needed stuff from real sources
+        #
+        # this is taken from ubuntu kernel build script
+        # http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-jaunty.git;a=blob;f=debian/rules.d/3-binary-indep.mk;hb=HEAD
+        cd "$srcdir"/linux-$_kernver
+        find . -path './include/*' -prune -o -path './scripts/*' -prune \
+                -o -type f \( -name 'Makefile*' -o -name 'Kconfig*' \
+                -o -name 'Kbuild*' -o -name '*.sh' -o -name '*.pl' \
+                -o -name '*.lds' \) | cpio -pdm "$dir"
+        cp -a drivers/media/dvb/dvb-core/*.h "$dir"/drivers/media/dvb/dvb-core
+        cp -a drivers/media/video/*.h "$dir"/drivers/media/video
+        cp -a drivers/media/dvb/frontends/*.h "$dir"/drivers/media/dvb/frontends
+        cp -a scripts include "$dir"
+        find $(find arch -name include -type d -print) -type f \
+                | cpio -pdm "$dir"
+
+        install -Dm644 "$srcdir"/build/Module.symvers \
+                "$dir"/Module.symvers
+
+        mkdir -p "$subpkgdir"/lib/modules/${_abi_release}
+        ln -sf /usr/src/linux-headers-${_abi_release} \
+                "$subpkgdir"/lib/modules/${_abi_release}/build
+}
+
+md5sums="10eebcb0178fb4540e2165bfd7efc7ad  linux-2.6.34.tar.bz2
+4c39a161d918e7f274292ecfd168b891  arp.patch
+2a08789db4977397f529a2933bc7b787  kernelconfig.x86
+06e9b200ec4fe252dc1478b5f8137e9e  put_page_callback-2.6.34.patch
+f9ea26d08807c41407a7758ce53fc633  scst_exec_req_fifo-2.6.34.patch"
diff --git a/testing/linux-scst/arp.patch b/testing/linux-scst/arp.patch
new file mode 100644
index 00000000..d2682690
--- /dev/null
+++ b/testing/linux-scst/arp.patch
@@ -0,0 +1,14 @@
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index c95cd93..71ab56f 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -1200,6 +1200,9 @@ static int arp_netdev_event(struct notifier_block *this, unsigned long event, vo
+ 		neigh_changeaddr(&arp_tbl, dev);
+ 		rt_cache_flush(dev_net(dev), 0);
+ 		break;
++	case NETDEV_CHANGE:
++		neigh_changeaddr(&arp_tbl, dev);
++		break;
+ 	default:
+ 		break;
+ 	}
diff --git a/testing/linux-scst/kernelconfig.x86 b/testing/linux-scst/kernelconfig.x86
new file mode 100644
index 00000000..84aa9734
--- /dev/null
+++ b/testing/linux-scst/kernelconfig.x86
@@ -0,0 +1,4674 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.34
+# Tue May 25 13:28:42 2010
+#
+# CONFIG_64BIT is not set
+CONFIG_X86_32=y
+# CONFIG_X86_64 is not set
+CONFIG_X86=y
+CONFIG_OUTPUT_FORMAT="elf32-i386"
+CONFIG_ARCH_DEFCONFIG="arch/x86/configs/i386_defconfig"
+CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_MMU=y
+CONFIG_ZONE_DMA=y
+# CONFIG_NEED_DMA_MAP_STATE is not set
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_GPIO=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+# CONFIG_RWSEM_GENERIC_SPINLOCK is not set
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_TIME_VSYSCALL is not set
+CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_HAVE_SETUP_PER_CPU_AREA=y
+CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
+CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
+# CONFIG_HAVE_CPUMASK_OF_CPU_MAP is not set
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+# CONFIG_ZONE_DMA32 is not set
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+# CONFIG_AUDIT_ARCH is not set
+CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_HAVE_EARLY_RES=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
+CONFIG_X86_32_SMP=y
+CONFIG_X86_HT=y
+CONFIG_X86_TRAMPOLINE=y
+CONFIG_X86_32_LAZY_GS=y
+CONFIG_KTIME_SCALAR=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
+
+#
+# General setup
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_HAVE_KERNEL_GZIP=y
+CONFIG_HAVE_KERNEL_BZIP2=y
+CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KERNEL_LZO=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
+# CONFIG_KERNEL_LZO is not set
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+# CONFIG_POSIX_MQUEUE is not set
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_TREE_RCU=y
+# CONFIG_TREE_PREEMPT_RCU is not set
+# CONFIG_TINY_RCU is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RCU_FANOUT=32
+# CONFIG_RCU_FANOUT_EXACT is not set
+# CONFIG_RCU_FAST_NO_HZ is not set
+# CONFIG_TREE_RCU_TRACE is not set
+CONFIG_IKCONFIG=m
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
+# CONFIG_CGROUPS is not set
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+# CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_RD_GZIP=y
+CONFIG_RD_BZIP2=y
+CONFIG_RD_LZMA=y
+# CONFIG_RD_LZO is not set
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
+CONFIG_EMBEDDED=y
+CONFIG_UID16=y
+CONFIG_SYSCTL_SYSCALL=y
+# CONFIG_KALLSYMS is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_SHMEM=y
+CONFIG_AIO=y
+CONFIG_HAVE_PERF_EVENTS=y
+
+#
+# Kernel Performance Events And Counters
+#
+CONFIG_PERF_EVENTS=y
+CONFIG_PERF_COUNTERS=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_COMPAT_BRK is not set
+# CONFIG_SLAB is not set
+CONFIG_SLUB=y
+# CONFIG_SLOB is not set
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=m
+# CONFIG_OPROFILE_EVENT_MULTIPLEX is not set
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_USER_RETURN_NOTIFIER=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_OPTPROBES=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_HW_BREAKPOINT=y
+CONFIG_HAVE_USER_RETURN_NOTIFIER=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
+CONFIG_SLOW_WORK=y
+# CONFIG_SLOW_WORK_DEBUG is not set
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_RT_MUTEXES=y
+CONFIG_BASE_SMALL=0
+CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_MODVERSIONS=y
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_STOP_MACHINE=y
+CONFIG_BLOCK=y
+CONFIG_LBDAF=y
+CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_DEADLINE=m
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_PREEMPT_NOTIFIERS=y
+CONFIG_PADATA=y
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+CONFIG_INLINE_SPIN_UNLOCK=y
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_FREEZER=y
+
+#
+# Processor type and features
+#
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_SMP=y
+# CONFIG_SPARSE_IRQ is not set
+CONFIG_X86_MPPARSE=y
+# CONFIG_X86_BIGSMP is not set
+CONFIG_X86_EXTENDED_PLATFORM=y
+# CONFIG_X86_ELAN is not set
+# CONFIG_X86_MRST is not set
+# CONFIG_X86_RDC321X is not set
+# CONFIG_X86_32_NON_STANDARD is not set
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_XEN=y
+CONFIG_XEN_MAX_DOMAIN_MEMORY=8
+CONFIG_XEN_SAVE_RESTORE=y
+# CONFIG_XEN_DEBUG_FS is not set
+CONFIG_VMI=y
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_LGUEST_GUEST=y
+CONFIG_PARAVIRT=y
+# CONFIG_PARAVIRT_SPINLOCKS is not set
+CONFIG_PARAVIRT_CLOCK=y
+CONFIG_NO_BOOTMEM=y
+# CONFIG_MEMTEST is not set
+# CONFIG_M386 is not set
+# CONFIG_M486 is not set
+# CONFIG_M586 is not set
+CONFIG_M586TSC=y
+# CONFIG_M586MMX is not set
+# CONFIG_M686 is not set
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+# CONFIG_MPENTIUM4 is not set
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+# CONFIG_MCRUSOE is not set
+# CONFIG_MEFFICEON is not set
+# CONFIG_MWINCHIPC6 is not set
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MGEODEGX1 is not set
+# CONFIG_MGEODE_LX is not set
+# CONFIG_MCYRIXIII is not set
+# CONFIG_MVIAC3_2 is not set
+# CONFIG_MVIAC7 is not set
+# CONFIG_MPSC is not set
+# CONFIG_MCORE2 is not set
+# CONFIG_MATOM is not set
+# CONFIG_GENERIC_CPU is not set
+CONFIG_X86_GENERIC=y
+CONFIG_X86_CPU=y
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_XADD=y
+# CONFIG_X86_PPRO_FENCE is not set
+CONFIG_X86_F00F_BUG=y
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_X86_INVLPG=y
+CONFIG_X86_BSWAP=y
+CONFIG_X86_POPAD_OK=y
+CONFIG_X86_ALIGNMENT_16=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_TSC=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=5
+# CONFIG_PROCESSOR_SELECT is not set
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_CYRIX_32=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_TRANSMETA_32=y
+CONFIG_CPU_SUP_UMC_32=y
+CONFIG_HPET_TIMER=y
+CONFIG_HPET_EMULATE_RTC=y
+CONFIG_DMI=y
+# CONFIG_IOMMU_HELPER is not set
+# CONFIG_IOMMU_API is not set
+CONFIG_NR_CPUS=8
+CONFIG_SCHED_SMT=y
+CONFIG_SCHED_MC=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_IO_APIC=y
+# CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set
+# CONFIG_X86_MCE is not set
+CONFIG_VM86=y
+CONFIG_TOSHIBA=m
+CONFIG_I8K=m
+CONFIG_X86_REBOOTFIXUPS=y
+CONFIG_MICROCODE=m
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_AMD=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
+CONFIG_X86_MSR=m
+CONFIG_X86_CPUID=m
+# CONFIG_NOHIGHMEM is not set
+# CONFIG_HIGHMEM4G is not set
+CONFIG_HIGHMEM64G=y
+CONFIG_VMSPLIT_3G=y
+# CONFIG_VMSPLIT_3G_OPT is not set
+# CONFIG_VMSPLIT_2G is not set
+# CONFIG_VMSPLIT_2G_OPT is not set
+# CONFIG_VMSPLIT_1G is not set
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_HIGHMEM=y
+CONFIG_X86_PAE=y
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ILLEGAL_POINTER_VALUE=0
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+CONFIG_SPARSEMEM_STATIC=y
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_ZONE_DMA_FLAG=1
+CONFIG_BOUNCE=y
+CONFIG_VIRT_TO_BUS=y
+CONFIG_MMU_NOTIFIER=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+# CONFIG_HIGHPTE is not set
+# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set
+CONFIG_X86_RESERVE_LOW_64K=y
+CONFIG_MATH_EMULATION=y
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_X86_PAT=y
+CONFIG_ARCH_USES_PG_UNCACHED=y
+# CONFIG_EFI is not set
+# CONFIG_SECCOMP is not set
+# CONFIG_CC_STACKPROTECTOR is not set
+# CONFIG_HZ_100 is not set
+# CONFIG_HZ_250 is not set
+CONFIG_HZ_300=y
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=300
+CONFIG_SCHED_HRTICK=y
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+CONFIG_PHYSICAL_START=0x1000000
+# CONFIG_RELOCATABLE is not set
+CONFIG_PHYSICAL_ALIGN=0x1000000
+CONFIG_HOTPLUG_CPU=y
+CONFIG_COMPAT_VDSO=y
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+
+#
+# Power management and ACPI options
+#
+CONFIG_PM=y
+# CONFIG_PM_DEBUG is not set
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_SLEEP=y
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+# CONFIG_HIBERNATION is not set
+# CONFIG_PM_RUNTIME is not set
+CONFIG_PM_OPS=y
+CONFIG_ACPI=y
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_PROCFS_POWER=y
+# CONFIG_ACPI_POWER_METER is not set
+CONFIG_ACPI_SYSFS_POWER=y
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_AC=m
+CONFIG_ACPI_BATTERY=m
+CONFIG_ACPI_BUTTON=m
+CONFIG_ACPI_VIDEO=m
+CONFIG_ACPI_FAN=m
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_PROCESSOR=m
+CONFIG_ACPI_HOTPLUG_CPU=y
+# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
+CONFIG_ACPI_THERMAL=m
+# CONFIG_ACPI_CUSTOM_DSDT is not set
+CONFIG_ACPI_BLACKLIST_YEAR=2000
+# CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_PCI_SLOT=m
+CONFIG_X86_PM_TIMER=y
+CONFIG_ACPI_CONTAINER=m
+CONFIG_ACPI_SBS=m
+# CONFIG_SFI is not set
+# CONFIG_APM is not set
+
+#
+# CPU Frequency scaling
+#
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_TABLE=m
+# CONFIG_CPU_FREQ_DEBUG is not set
+CONFIG_CPU_FREQ_STAT=m
+# CONFIG_CPU_FREQ_STAT_DETAILS is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=m
+CONFIG_CPU_FREQ_GOV_USERSPACE=m
+CONFIG_CPU_FREQ_GOV_ONDEMAND=m
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
+
+#
+# CPUFreq processor drivers
+#
+# CONFIG_X86_PCC_CPUFREQ is not set
+CONFIG_X86_ACPI_CPUFREQ=m
+CONFIG_X86_POWERNOW_K6=m
+CONFIG_X86_POWERNOW_K7=m
+CONFIG_X86_POWERNOW_K7_ACPI=y
+CONFIG_X86_POWERNOW_K8=m
+CONFIG_X86_GX_SUSPMOD=m
+CONFIG_X86_SPEEDSTEP_CENTRINO=m
+CONFIG_X86_SPEEDSTEP_CENTRINO_TABLE=y
+CONFIG_X86_SPEEDSTEP_ICH=m
+CONFIG_X86_SPEEDSTEP_SMI=m
+CONFIG_X86_P4_CLOCKMOD=m
+CONFIG_X86_CPUFREQ_NFORCE2=m
+CONFIG_X86_LONGRUN=m
+CONFIG_X86_LONGHAUL=m
+CONFIG_X86_E_POWERSAVER=m
+
+#
+# shared options
+#
+CONFIG_X86_SPEEDSTEP_LIB=m
+CONFIG_X86_SPEEDSTEP_RELAXED_CAP_CHECK=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+
+#
+# Bus options (PCI etc.)
+#
+CONFIG_PCI=y
+# CONFIG_PCI_GOBIOS is not set
+# CONFIG_PCI_GOMMCONFIG is not set
+# CONFIG_PCI_GODIRECT is not set
+# CONFIG_PCI_GOOLPC is not set
+CONFIG_PCI_GOANY=y
+CONFIG_PCI_BIOS=y
+CONFIG_PCI_DIRECT=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_HOTPLUG_PCI_PCIE=m
+# CONFIG_PCIEAER is not set
+CONFIG_PCIEASPM=y
+# CONFIG_PCIEASPM_DEBUG is not set
+CONFIG_ARCH_SUPPORTS_MSI=y
+# CONFIG_PCI_MSI is not set
+CONFIG_PCI_STUB=m
+CONFIG_HT_IRQ=y
+# CONFIG_PCI_IOV is not set
+CONFIG_PCI_IOAPIC=y
+CONFIG_ISA_DMA_API=y
+CONFIG_ISA=y
+# CONFIG_EISA is not set
+# CONFIG_MCA is not set
+CONFIG_SCx200=m
+CONFIG_SCx200HR_TIMER=m
+# CONFIG_OLPC is not set
+CONFIG_K8_NB=y
+CONFIG_PCCARD=m
+CONFIG_PCMCIA=m
+CONFIG_PCMCIA_LOAD_CIS=y
+CONFIG_CARDBUS=y
+
+#
+# PC-card bridges
+#
+CONFIG_YENTA=m
+CONFIG_YENTA_O2=y
+CONFIG_YENTA_RICOH=y
+CONFIG_YENTA_TI=y
+CONFIG_YENTA_ENE_TUNE=y
+CONFIG_YENTA_TOSHIBA=y
+CONFIG_PD6729=m
+CONFIG_I82092=m
+CONFIG_I82365=m
+CONFIG_TCIC=m
+CONFIG_PCMCIA_PROBE=y
+CONFIG_PCCARD_NONSTATIC=m
+CONFIG_HOTPLUG_PCI=m
+CONFIG_HOTPLUG_PCI_FAKE=m
+CONFIG_HOTPLUG_PCI_COMPAQ=m
+# CONFIG_HOTPLUG_PCI_COMPAQ_NVRAM is not set
+CONFIG_HOTPLUG_PCI_IBM=m
+CONFIG_HOTPLUG_PCI_ACPI=m
+CONFIG_HOTPLUG_PCI_ACPI_IBM=m
+CONFIG_HOTPLUG_PCI_CPCI=y
+CONFIG_HOTPLUG_PCI_CPCI_ZT5550=m
+CONFIG_HOTPLUG_PCI_CPCI_GENERIC=m
+CONFIG_HOTPLUG_PCI_SHPC=m
+
+#
+# Executable file formats / Emulations
+#
+CONFIG_BINFMT_ELF=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_HAVE_AOUT=y
+CONFIG_BINFMT_AOUT=m
+CONFIG_BINFMT_MISC=m
+CONFIG_HAVE_ATOMIC_IOMAP=y
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=m
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+CONFIG_XFRM_USER=m
+CONFIG_XFRM_SUB_POLICY=y
+CONFIG_XFRM_MIGRATE=y
+# CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
+CONFIG_NET_KEY=m
+CONFIG_NET_KEY_MIGRATE=y
+CONFIG_INET=y
+CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_ASK_IP_FIB_HASH=y
+# CONFIG_IP_FIB_TRIE is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+# CONFIG_IP_PIMSM_V1 is not set
+CONFIG_IP_PIMSM_V2=y
+CONFIG_ARPD=y
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_TUNNEL=m
+CONFIG_INET_TUNNEL=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_LRO=y
+CONFIG_INET_DIAG=m
+CONFIG_INET_TCP_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BIC=m
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_TCP_CONG_WESTWOOD=m
+CONFIG_TCP_CONG_HTCP=m
+CONFIG_TCP_CONG_HSTCP=m
+CONFIG_TCP_CONG_HYBLA=m
+CONFIG_TCP_CONG_VEGAS=m
+CONFIG_TCP_CONG_SCALABLE=m
+CONFIG_TCP_CONG_LP=m
+CONFIG_TCP_CONG_VENO=m
+CONFIG_TCP_CONG_YEAH=m
+CONFIG_TCP_CONG_ILLINOIS=m
+# CONFIG_DEFAULT_BIC is not set
+CONFIG_DEFAULT_CUBIC=y
+# CONFIG_DEFAULT_HTCP is not set
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DEFAULT_WESTWOOD is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_TCP_CONG="cubic"
+CONFIG_TCP_MD5SIG=y
+CONFIG_IPV6=m
+CONFIG_IPV6_PRIVACY=y
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_MIP6=m
+CONFIG_INET6_XFRM_TUNNEL=m
+CONFIG_INET6_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
+CONFIG_IPV6_SIT=m
+# CONFIG_IPV6_SIT_6RD is not set
+CONFIG_IPV6_NDISC_NODETYPE=y
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETLABEL=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_NETFILTER_ADVANCED=y
+CONFIG_BRIDGE_NETFILTER=y
+
+#
+# Core Netfilter Configuration
+#
+CONFIG_NETFILTER_NETLINK=m
+CONFIG_NETFILTER_NETLINK_QUEUE=m
+CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CT_ACCT=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+# CONFIG_NF_CONNTRACK_ZONES is not set
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_DCCP=m
+CONFIG_NF_CT_PROTO_GRE=m
+CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NETFILTER_TPROXY=m
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
+CONFIG_NETFILTER_XT_TARGET_CT=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HL=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_RATEEST=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_SECMARK=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_HL=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+# CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_IPV6=y
+# CONFIG_IP_VS_DEBUG is not set
+CONFIG_IP_VS_TAB_BITS=12
+
+#
+# IPVS transport protocol load balancing support
+#
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_AH_ESP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+# CONFIG_IP_VS_PROTO_SCTP is not set
+
+#
+# IPVS scheduler
+#
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+
+#
+# IPVS application helper
+#
+CONFIG_IP_VS_FTP=m
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV4=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
+CONFIG_IP_NF_QUEUE=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_LOG=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_NF_NAT=m
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_NF_NAT_SNMP_BASIC=m
+CONFIG_NF_NAT_PROTO_DCCP=m
+CONFIG_NF_NAT_PROTO_GRE=m
+CONFIG_NF_NAT_PROTO_UDPLITE=m
+CONFIG_NF_NAT_PROTO_SCTP=m
+CONFIG_NF_NAT_FTP=m
+CONFIG_NF_NAT_IRC=m
+CONFIG_NF_NAT_TFTP=m
+CONFIG_NF_NAT_AMANDA=m
+CONFIG_NF_NAT_PPTP=m
+CONFIG_NF_NAT_H323=m
+CONFIG_NF_NAT_SIP=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+
+#
+# IPv6: Netfilter Configuration
+#
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_QUEUE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_TARGET_LOG=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_SECURITY=m
+
+#
+# DECnet: Netfilter Configuration
+#
+CONFIG_DECNET_NF_GRABULATOR=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_ULOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_IP_DCCP=m
+CONFIG_INET_DCCP_DIAG=m
+
+#
+# DCCP CCIDs Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP_CCID2_DEBUG is not set
+CONFIG_IP_DCCP_CCID3=y
+# CONFIG_IP_DCCP_CCID3_DEBUG is not set
+CONFIG_IP_DCCP_CCID3_RTO=100
+CONFIG_IP_DCCP_TFRC_LIB=y
+CONFIG_IP_SCTP=m
+# CONFIG_SCTP_DBG_MSG is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+# CONFIG_SCTP_HMAC_NONE is not set
+CONFIG_SCTP_HMAC_SHA1=y
+# CONFIG_SCTP_HMAC_MD5 is not set
+CONFIG_RDS=m
+# CONFIG_RDS_RDMA is not set
+# CONFIG_RDS_TCP is not set
+# CONFIG_RDS_DEBUG is not set
+CONFIG_TIPC=m
+# CONFIG_TIPC_ADVANCED is not set
+# CONFIG_TIPC_DEBUG is not set
+CONFIG_ATM=m
+CONFIG_ATM_CLIP=m
+# CONFIG_ATM_CLIP_NO_ICMP is not set
+CONFIG_ATM_LANE=m
+CONFIG_ATM_MPOA=m
+CONFIG_ATM_BR2684=m
+# CONFIG_ATM_BR2684_IPFILTER is not set
+CONFIG_STP=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+# CONFIG_NET_DSA is not set
+CONFIG_VLAN_8021Q=m
+# CONFIG_VLAN_8021Q_GVRP is not set
+CONFIG_DECNET=m
+CONFIG_DECNET_ROUTER=y
+CONFIG_LLC=m
+CONFIG_LLC2=m
+CONFIG_IPX=m
+# CONFIG_IPX_INTERN is not set
+CONFIG_ATALK=m
+CONFIG_DEV_APPLETALK=m
+CONFIG_LTPC=m
+CONFIG_COPS=m
+CONFIG_COPS_DAYNA=y
+CONFIG_COPS_TANGENT=y
+CONFIG_IPDDP=m
+CONFIG_IPDDP_ENCAP=y
+CONFIG_IPDDP_DECAP=y
+CONFIG_X25=m
+CONFIG_LAPB=m
+CONFIG_ECONET=m
+CONFIG_ECONET_AUNUDP=y
+CONFIG_ECONET_NATIVE=y
+CONFIG_WAN_ROUTER=m
+CONFIG_PHONET=m
+CONFIG_IEEE802154=m
+CONFIG_NET_SCHED=y
+
+#
+# Queueing/Scheduling
+#
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_INGRESS=m
+
+#
+# Classification
+#
+CONFIG_NET_CLS=y
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_ROUTE=y
+CONFIG_NET_CLS_FW=m
+CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_PERF=y
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_STACK=32
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+# CONFIG_NET_CLS_IND is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
+
+#
+# Network testing
+#
+CONFIG_NET_PKTGEN=m
+# CONFIG_HAMRADIO is not set
+CONFIG_CAN=m
+CONFIG_CAN_RAW=m
+CONFIG_CAN_BCM=m
+
+#
+# CAN Device Drivers
+#
+CONFIG_CAN_VCAN=m
+CONFIG_CAN_DEV=m
+# CONFIG_CAN_CALC_BITTIMING is not set
+CONFIG_CAN_MCP251X=m
+CONFIG_CAN_SJA1000=m
+# CONFIG_CAN_SJA1000_ISA is not set
+CONFIG_CAN_SJA1000_PLATFORM=m
+CONFIG_CAN_EMS_PCI=m
+CONFIG_CAN_KVASER_PCI=m
+CONFIG_CAN_PLX_PCI=m
+
+#
+# CAN USB interfaces
+#
+# CONFIG_CAN_EMS_USB is not set
+# CONFIG_CAN_DEBUG_DEVICES is not set
+CONFIG_IRDA=m
+
+#
+# IrDA protocols
+#
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA_ULTRA=y
+
+#
+# IrDA options
+#
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_FAST_RR=y
+# CONFIG_IRDA_DEBUG is not set
+
+#
+# Infrared-port device drivers
+#
+
+#
+# SIR device drivers
+#
+CONFIG_IRTTY_SIR=m
+
+#
+# Dongle support
+#
+CONFIG_DONGLE=y
+CONFIG_ESI_DONGLE=m
+CONFIG_ACTISYS_DONGLE=m
+CONFIG_TEKRAM_DONGLE=m
+CONFIG_TOIM3232_DONGLE=m
+CONFIG_LITELINK_DONGLE=m
+CONFIG_MA600_DONGLE=m
+CONFIG_GIRBIL_DONGLE=m
+CONFIG_MCP2120_DONGLE=m
+CONFIG_OLD_BELKIN_DONGLE=m
+CONFIG_ACT200L_DONGLE=m
+CONFIG_KINGSUN_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KS959_DONGLE=m
+
+#
+# FIR device drivers
+#
+CONFIG_USB_IRDA=m
+CONFIG_SIGMATEL_FIR=m
+CONFIG_NSC_FIR=m
+CONFIG_WINBOND_FIR=m
+CONFIG_TOSHIBA_FIR=m
+CONFIG_SMC_IRCC_FIR=m
+CONFIG_ALI_FIR=m
+CONFIG_VLSI_FIR=m
+CONFIG_VIA_FIR=m
+CONFIG_MCS_FIR=m
+CONFIG_BT=m
+CONFIG_BT_L2CAP=m
+CONFIG_BT_SCO=m
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_CMTP=m
+CONFIG_BT_HIDP=m
+
+#
+# Bluetooth device drivers
+#
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIBTSDIO=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_H4=y
+CONFIG_BT_HCIUART_BCSP=y
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIDTL1=m
+CONFIG_BT_HCIBT3C=m
+CONFIG_BT_HCIBLUECARD=m
+CONFIG_BT_HCIBTUART=m
+CONFIG_BT_HCIVHCI=m
+# CONFIG_BT_MRVL is not set
+CONFIG_BT_ATH3K=m
+CONFIG_AF_RXRPC=m
+# CONFIG_AF_RXRPC_DEBUG is not set
+CONFIG_RXKAD=m
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+CONFIG_WIRELESS_EXT=y
+CONFIG_WEXT_CORE=y
+CONFIG_WEXT_PROC=y
+CONFIG_WEXT_SPY=y
+CONFIG_WEXT_PRIV=y
+CONFIG_CFG80211=m
+# CONFIG_NL80211_TESTMODE is not set
+# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
+# CONFIG_CFG80211_REG_DEBUG is not set
+CONFIG_CFG80211_DEFAULT_PS=y
+# CONFIG_CFG80211_DEBUGFS is not set
+# CONFIG_CFG80211_INTERNAL_REGDB is not set
+CONFIG_CFG80211_WEXT=y
+CONFIG_WIRELESS_EXT_SYSFS=y
+CONFIG_LIB80211=m
+CONFIG_LIB80211_CRYPT_WEP=m
+CONFIG_LIB80211_CRYPT_CCMP=m
+CONFIG_LIB80211_CRYPT_TKIP=m
+# CONFIG_LIB80211_DEBUG is not set
+CONFIG_MAC80211=m
+CONFIG_MAC80211_RC_PID=y
+CONFIG_MAC80211_RC_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT_PID=y
+# CONFIG_MAC80211_RC_DEFAULT_MINSTREL is not set
+CONFIG_MAC80211_RC_DEFAULT="pid"
+# CONFIG_MAC80211_MESH is not set
+CONFIG_MAC80211_LEDS=y
+# CONFIG_MAC80211_DEBUGFS is not set
+# CONFIG_MAC80211_DEBUG_MENU is not set
+CONFIG_WIMAX=m
+CONFIG_WIMAX_DEBUG_LEVEL=8
+CONFIG_RFKILL=m
+CONFIG_RFKILL_LEDS=y
+# CONFIG_RFKILL_INPUT is not set
+CONFIG_NET_9P=m
+CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_9P_RDMA=m
+# CONFIG_NET_9P_DEBUG is not set
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_DEVTMPFS is not set
+CONFIG_STANDALONE=y
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_FW_LOADER=m
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
+CONFIG_SYS_HYPERVISOR=y
+CONFIG_CONNECTOR=m
+CONFIG_MTD=m
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_TESTS=m
+CONFIG_MTD_CONCAT=m
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_REDBOOT_PARTS=m
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+CONFIG_MTD_AR7_PARTS=m
+
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=m
+CONFIG_HAVE_MTD_OTP=y
+CONFIG_MTD_BLKDEVS=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_BLOCK_RO=m
+CONFIG_FTL=m
+CONFIG_NFTL=m
+CONFIG_NFTL_RW=y
+CONFIG_INFTL=m
+CONFIG_RFD_FTL=m
+CONFIG_SSFDC=m
+CONFIG_MTD_OOPS=m
+
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=m
+CONFIG_MTD_JEDECPROBE=m
+CONFIG_MTD_GEN_PROBE=m
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=m
+CONFIG_MTD_CFI_AMDSTD=m
+CONFIG_MTD_CFI_STAA=m
+CONFIG_MTD_CFI_UTIL=m
+CONFIG_MTD_RAM=m
+CONFIG_MTD_ROM=m
+CONFIG_MTD_ABSENT=m
+
+#
+# Mapping drivers for chip access
+#
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+CONFIG_MTD_PHYSMAP=m
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+CONFIG_MTD_SC520CDP=m
+CONFIG_MTD_NETSC520=m
+CONFIG_MTD_TS5500=m
+CONFIG_MTD_SBC_GXX=m
+CONFIG_MTD_SCx200_DOCFLASH=m
+CONFIG_MTD_AMD76XROM=m
+CONFIG_MTD_ICHXROM=m
+CONFIG_MTD_ESB2ROM=m
+CONFIG_MTD_CK804XROM=m
+CONFIG_MTD_SCB2_FLASH=m
+CONFIG_MTD_NETtel=m
+CONFIG_MTD_L440GX=m
+CONFIG_MTD_PCI=m
+# CONFIG_MTD_GPIO_ADDR is not set
+CONFIG_MTD_INTEL_VR_NOR=m
+CONFIG_MTD_PLATRAM=m
+
+#
+# Self-contained MTD device drivers
+#
+CONFIG_MTD_PMC551=m
+CONFIG_MTD_PMC551_BUGFIX=y
+# CONFIG_MTD_PMC551_DEBUG is not set
+CONFIG_MTD_DATAFLASH=m
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+# CONFIG_MTD_DATAFLASH_OTP is not set
+CONFIG_MTD_M25P80=m
+CONFIG_M25PXX_USE_FAST_READ=y
+# CONFIG_MTD_SST25L is not set
+CONFIG_MTD_SLRAM=m
+CONFIG_MTD_PHRAM=m
+CONFIG_MTD_MTDRAM=m
+CONFIG_MTDRAM_TOTAL_SIZE=4096
+CONFIG_MTDRAM_ERASE_SIZE=128
+CONFIG_MTD_BLOCK2MTD=m
+
+#
+# Disk-On-Chip Device Drivers
+#
+CONFIG_MTD_DOC2000=m
+CONFIG_MTD_DOC2001=m
+CONFIG_MTD_DOC2001PLUS=m
+CONFIG_MTD_DOCPROBE=m
+CONFIG_MTD_DOCECC=m
+CONFIG_MTD_DOCPROBE_ADVANCED=y
+CONFIG_MTD_DOCPROBE_ADDRESS=0x0000
+# CONFIG_MTD_DOCPROBE_HIGH is not set
+# CONFIG_MTD_DOCPROBE_55AA is not set
+CONFIG_MTD_NAND=m
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+CONFIG_MTD_NAND_ECC_SMC=y
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+CONFIG_MTD_NAND_IDS=m
+CONFIG_MTD_NAND_DISKONCHIP=m
+# CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADVANCED is not set
+CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS=0
+# CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE is not set
+CONFIG_MTD_NAND_CAFE=m
+CONFIG_MTD_NAND_CS553X=m
+CONFIG_MTD_NAND_NANDSIM=m
+CONFIG_MTD_NAND_PLATFORM=m
+CONFIG_MTD_ALAUDA=m
+CONFIG_MTD_ONENAND=m
+# CONFIG_MTD_ONENAND_VERIFY_WRITE is not set
+# CONFIG_MTD_ONENAND_GENERIC is not set
+CONFIG_MTD_ONENAND_OTP=y
+CONFIG_MTD_ONENAND_2X_PROGRAM=y
+CONFIG_MTD_ONENAND_SIM=m
+
+#
+# LPDDR flash memory drivers
+#
+CONFIG_MTD_LPDDR=m
+CONFIG_MTD_QINFO_PROBE=m
+
+#
+# UBI - Unsorted block images
+#
+CONFIG_MTD_UBI=m
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_GLUEBI is not set
+
+#
+# UBI debugging options
+#
+# CONFIG_MTD_UBI_DEBUG is not set
+CONFIG_PARPORT=m
+CONFIG_PARPORT_PC=m
+CONFIG_PARPORT_SERIAL=m
+# CONFIG_PARPORT_PC_FIFO is not set
+# CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_PC_PCMCIA=m
+# CONFIG_PARPORT_GSC is not set
+CONFIG_PARPORT_AX88796=m
+# CONFIG_PARPORT_1284 is not set
+CONFIG_PARPORT_NOT_PC=y
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG_MESSAGES is not set
+
+#
+# Protocols
+#
+CONFIG_ISAPNP=y
+CONFIG_PNPBIOS=y
+# CONFIG_PNPBIOS_PROC_FS is not set
+CONFIG_PNPACPI=y
+CONFIG_BLK_DEV=y
+CONFIG_BLK_DEV_FD=m
+CONFIG_BLK_DEV_XD=m
+# CONFIG_PARIDE is not set
+CONFIG_BLK_CPQ_DA=m
+CONFIG_BLK_CPQ_CISS_DA=m
+CONFIG_CISS_SCSI_TAPE=y
+CONFIG_BLK_DEV_DAC960=m
+CONFIG_BLK_DEV_UMEM=m
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
+# CONFIG_DRBD_FAULT_INJECTION is not set
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_OSD=m
+CONFIG_BLK_DEV_SX8=m
+CONFIG_BLK_DEV_UB=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+# CONFIG_BLK_DEV_XIP is not set
+CONFIG_CDROM_PKTCDVD=m
+CONFIG_CDROM_PKTCDVD_BUFFERS=8
+# CONFIG_CDROM_PKTCDVD_WCACHE is not set
+CONFIG_ATA_OVER_ETH=m
+CONFIG_XEN_BLKDEV_FRONTEND=y
+CONFIG_VIRTIO_BLK=m
+# CONFIG_BLK_DEV_HD is not set
+CONFIG_MISC_DEVICES=y
+CONFIG_AD525X_DPOT=m
+CONFIG_IBM_ASM=m
+CONFIG_PHANTOM=m
+CONFIG_SGI_IOC4=m
+CONFIG_TIFM_CORE=m
+CONFIG_TIFM_7XX1=m
+CONFIG_ICS932S401=m
+CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_CS5535_MFGPT=m
+CONFIG_CS5535_MFGPT_DEFAULT_IRQ=7
+CONFIG_CS5535_CLOCK_EVENT_SRC=m
+CONFIG_HP_ILO=m
+CONFIG_ISL29003=m
+CONFIG_SENSORS_TSL2550=m
+CONFIG_DS1682=m
+CONFIG_TI_DAC7512=m
+CONFIG_VMWARE_BALLOON=m
+CONFIG_C2PORT=m
+CONFIG_C2PORT_DURAMAR_2150=m
+
+#
+# EEPROM support
+#
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_EEPROM_LEGACY=m
+CONFIG_EEPROM_MAX6875=m
+CONFIG_EEPROM_93CX6=m
+CONFIG_CB710_CORE=m
+# CONFIG_CB710_DEBUG is not set
+CONFIG_CB710_DEBUG_ASSUMPTIONS=y
+CONFIG_IWMC3200TOP=m
+# CONFIG_IWMC3200TOP_DEBUG is not set
+# CONFIG_IWMC3200TOP_DEBUGFS is not set
+CONFIG_HAVE_IDE=y
+# CONFIG_IDE is not set
+
+#
+# SCSI device support
+#
+CONFIG_SCSI_MOD=m
+CONFIG_RAID_ATTRS=m
+CONFIG_SCSI=m
+CONFIG_SCSI_DMA=y
+CONFIG_SCSI_TGT=m
+CONFIG_SCSI_NETLINK=y
+CONFIG_SCSI_PROC_FS=y
+
+#
+# SCSI support type (disk, tape, CD-ROM)
+#
+CONFIG_BLK_DEV_SD=m
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
+CONFIG_BLK_DEV_SR_VENDOR=y
+CONFIG_CHR_DEV_SG=m
+CONFIG_CHR_DEV_SCH=m
+CONFIG_SCSI_ENCLOSURE=m
+CONFIG_SCSI_MULTI_LUN=y
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_LOGGING is not set
+CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_WAIT_SCAN=m
+
+#
+# SCSI Transports
+#
+CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_FC_ATTRS=m
+CONFIG_SCSI_FC_TGT_ATTRS=y
+CONFIG_SCSI_ISCSI_ATTRS=m
+CONFIG_SCSI_SAS_ATTRS=m
+CONFIG_SCSI_SAS_LIBSAS=m
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_SAS_HOST_SMP=y
+# CONFIG_SCSI_SAS_LIBSAS_DEBUG is not set
+CONFIG_SCSI_SRP_ATTRS=m
+CONFIG_SCSI_SRP_TGT_ATTRS=y
+CONFIG_SCSI_LOWLEVEL=y
+CONFIG_ISCSI_TCP=m
+CONFIG_SCSI_CXGB3_ISCSI=m
+CONFIG_SCSI_BNX2_ISCSI=m
+# CONFIG_BE2ISCSI is not set
+CONFIG_BLK_DEV_3W_XXXX_RAID=m
+CONFIG_SCSI_HPSA=m
+CONFIG_SCSI_3W_9XXX=m
+CONFIG_SCSI_3W_SAS=m
+CONFIG_SCSI_7000FASST=m
+CONFIG_SCSI_ACARD=m
+CONFIG_SCSI_AHA152X=m
+CONFIG_SCSI_AHA1542=m
+CONFIG_SCSI_AACRAID=m
+CONFIG_SCSI_AIC7XXX=m
+CONFIG_AIC7XXX_CMDS_PER_DEVICE=32
+CONFIG_AIC7XXX_RESET_DELAY_MS=15000
+# CONFIG_AIC7XXX_BUILD_FIRMWARE is not set
+CONFIG_AIC7XXX_DEBUG_ENABLE=y
+CONFIG_AIC7XXX_DEBUG_MASK=0
+CONFIG_AIC7XXX_REG_PRETTY_PRINT=y
+CONFIG_SCSI_AIC7XXX_OLD=m
+CONFIG_SCSI_AIC79XX=m
+CONFIG_AIC79XX_CMDS_PER_DEVICE=32
+CONFIG_AIC79XX_RESET_DELAY_MS=15000
+# CONFIG_AIC79XX_BUILD_FIRMWARE is not set
+CONFIG_AIC79XX_DEBUG_ENABLE=y
+CONFIG_AIC79XX_DEBUG_MASK=0
+CONFIG_AIC79XX_REG_PRETTY_PRINT=y
+CONFIG_SCSI_AIC94XX=m
+# CONFIG_AIC94XX_DEBUG is not set
+CONFIG_SCSI_MVSAS=m
+CONFIG_SCSI_MVSAS_DEBUG=y
+CONFIG_SCSI_DPT_I2O=m
+CONFIG_SCSI_ADVANSYS=m
+CONFIG_SCSI_IN2000=m
+CONFIG_SCSI_ARCMSR=m
+CONFIG_MEGARAID_NEWGEN=y
+CONFIG_MEGARAID_MM=m
+CONFIG_MEGARAID_MAILBOX=m
+CONFIG_MEGARAID_LEGACY=m
+CONFIG_MEGARAID_SAS=m
+CONFIG_SCSI_MPT2SAS=m
+CONFIG_SCSI_MPT2SAS_MAX_SGE=128
+# CONFIG_SCSI_MPT2SAS_LOGGING is not set
+CONFIG_SCSI_HPTIOP=m
+CONFIG_SCSI_BUSLOGIC=m
+CONFIG_SCSI_FLASHPOINT=y
+CONFIG_VMWARE_PVSCSI=m
+CONFIG_LIBFC=m
+CONFIG_LIBFCOE=m
+CONFIG_FCOE=m
+CONFIG_FCOE_FNIC=m
+CONFIG_SCSI_DMX3191D=m
+CONFIG_SCSI_DTC3280=m
+CONFIG_SCSI_EATA=m
+# CONFIG_SCSI_EATA_TAGGED_QUEUE is not set
+# CONFIG_SCSI_EATA_LINKED_COMMANDS is not set
+CONFIG_SCSI_EATA_MAX_TAGS=16
+CONFIG_SCSI_FUTURE_DOMAIN=m
+CONFIG_SCSI_GDTH=m
+CONFIG_SCSI_GENERIC_NCR5380=m
+CONFIG_SCSI_GENERIC_NCR5380_MMIO=m
+CONFIG_SCSI_GENERIC_NCR53C400=y
+CONFIG_SCSI_IPS=m
+CONFIG_SCSI_INITIO=m
+CONFIG_SCSI_INIA100=m
+CONFIG_SCSI_PPA=m
+CONFIG_SCSI_IMM=m
+# CONFIG_SCSI_IZIP_EPP16 is not set
+# CONFIG_SCSI_IZIP_SLOW_CTR is not set
+CONFIG_SCSI_NCR53C406A=m
+CONFIG_SCSI_STEX=m
+CONFIG_SCSI_SYM53C8XX_2=m
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
+CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
+CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
+CONFIG_SCSI_SYM53C8XX_MMIO=y
+CONFIG_SCSI_IPR=m
+CONFIG_SCSI_IPR_TRACE=y
+# CONFIG_SCSI_IPR_DUMP is not set
+CONFIG_SCSI_PAS16=m
+CONFIG_SCSI_QLOGIC_FAS=m
+CONFIG_SCSI_QLOGIC_1280=m
+CONFIG_SCSI_QLA_FC=m
+CONFIG_SCSI_QLA_ISCSI=m
+CONFIG_SCSI_LPFC=m
+# CONFIG_SCSI_LPFC_DEBUG_FS is not set
+CONFIG_SCSI_SYM53C416=m
+CONFIG_SCSI_DC395x=m
+CONFIG_SCSI_DC390T=m
+CONFIG_SCSI_T128=m
+CONFIG_SCSI_U14_34F=m
+# CONFIG_SCSI_U14_34F_TAGGED_QUEUE is not set
+# CONFIG_SCSI_U14_34F_LINKED_COMMANDS is not set
+CONFIG_SCSI_U14_34F_MAX_TAGS=8
+CONFIG_SCSI_ULTRASTOR=m
+CONFIG_SCSI_NSP32=m
+CONFIG_SCSI_DEBUG=m
+# CONFIG_SCSI_PMCRAID is not set
+CONFIG_SCSI_PM8001=m
+CONFIG_SCSI_SRP=m
+# CONFIG_SCSI_BFA_FC is not set
+CONFIG_SCSI_LOWLEVEL_PCMCIA=y
+CONFIG_PCMCIA_AHA152X=m
+CONFIG_PCMCIA_FDOMAIN=m
+CONFIG_PCMCIA_NINJA_SCSI=m
+CONFIG_PCMCIA_QLOGIC=m
+CONFIG_PCMCIA_SYM53C500=m
+CONFIG_SCSI_DH=m
+CONFIG_SCSI_DH_RDAC=m
+CONFIG_SCSI_DH_HP_SW=m
+CONFIG_SCSI_DH_EMC=m
+CONFIG_SCSI_DH_ALUA=m
+CONFIG_SCSI_OSD_INITIATOR=m
+CONFIG_SCSI_OSD_ULD=m
+CONFIG_SCSI_OSD_DPRINT_SENSE=1
+# CONFIG_SCSI_OSD_DEBUG is not set
+CONFIG_ATA=m
+# CONFIG_ATA_NONSTANDARD is not set
+CONFIG_ATA_VERBOSE_ERROR=y
+CONFIG_ATA_ACPI=y
+CONFIG_SATA_PMP=y
+CONFIG_SATA_AHCI=m
+CONFIG_SATA_SIL24=m
+CONFIG_ATA_SFF=y
+CONFIG_SATA_SVW=m
+CONFIG_ATA_PIIX=m
+CONFIG_SATA_MV=m
+CONFIG_SATA_NV=m
+CONFIG_PDC_ADMA=m
+CONFIG_SATA_QSTOR=m
+CONFIG_SATA_PROMISE=m
+CONFIG_SATA_SX4=m
+CONFIG_SATA_SIL=m
+CONFIG_SATA_SIS=m
+CONFIG_SATA_ULI=m
+CONFIG_SATA_VIA=m
+CONFIG_SATA_VITESSE=m
+CONFIG_SATA_INIC162X=m
+CONFIG_PATA_ACPI=m
+CONFIG_PATA_ALI=m
+CONFIG_PATA_AMD=m
+CONFIG_PATA_ARTOP=m
+CONFIG_PATA_ATP867X=m
+CONFIG_PATA_ATIIXP=m
+CONFIG_PATA_CMD640_PCI=m
+CONFIG_PATA_CMD64X=m
+CONFIG_PATA_CS5520=m
+CONFIG_PATA_CS5530=m
+CONFIG_PATA_CS5535=m
+CONFIG_PATA_CS5536=m
+CONFIG_PATA_CYPRESS=m
+CONFIG_PATA_EFAR=m
+CONFIG_ATA_GENERIC=m
+CONFIG_PATA_HPT366=m
+CONFIG_PATA_HPT37X=m
+CONFIG_PATA_HPT3X2N=m
+CONFIG_PATA_HPT3X3=m
+CONFIG_PATA_HPT3X3_DMA=y
+CONFIG_PATA_ISAPNP=m
+CONFIG_PATA_IT821X=m
+CONFIG_PATA_IT8213=m
+CONFIG_PATA_JMICRON=m
+CONFIG_PATA_LEGACY=m
+CONFIG_PATA_TRIFLEX=m
+CONFIG_PATA_MARVELL=m
+CONFIG_PATA_MPIIX=m
+CONFIG_PATA_OLDPIIX=m
+CONFIG_PATA_NETCELL=m
+CONFIG_PATA_NINJA32=m
+CONFIG_PATA_NS87410=m
+CONFIG_PATA_NS87415=m
+CONFIG_PATA_OPTI=m
+CONFIG_PATA_OPTIDMA=m
+CONFIG_PATA_PCMCIA=m
+CONFIG_PATA_PDC2027X=m
+CONFIG_PATA_PDC_OLD=m
+CONFIG_PATA_QDI=m
+CONFIG_PATA_RADISYS=m
+CONFIG_PATA_RDC=m
+CONFIG_PATA_RZ1000=m
+CONFIG_PATA_SC1200=m
+CONFIG_PATA_SERVERWORKS=m
+CONFIG_PATA_SIL680=m
+CONFIG_PATA_SIS=m
+CONFIG_PATA_TOSHIBA=m
+CONFIG_PATA_VIA=m
+CONFIG_PATA_WINBOND=m
+CONFIG_PATA_WINBOND_VLB=m
+CONFIG_PATA_PLATFORM=m
+CONFIG_PATA_SCH=m
+CONFIG_MD=y
+CONFIG_BLK_DEV_MD=y
+# CONFIG_MD_AUTODETECT is not set
+CONFIG_MD_LINEAR=m
+CONFIG_MD_RAID0=m
+CONFIG_MD_RAID1=m
+CONFIG_MD_RAID10=m
+CONFIG_MD_RAID456=m
+# CONFIG_MULTICORE_RAID456 is not set
+CONFIG_MD_RAID6_PQ=m
+# CONFIG_ASYNC_RAID6_TEST is not set
+CONFIG_MD_MULTIPATH=m
+CONFIG_MD_FAULTY=m
+CONFIG_BLK_DEV_DM=m
+# CONFIG_DM_DEBUG is not set
+CONFIG_DM_CRYPT=m
+CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_MIRROR=m
+CONFIG_DM_LOG_USERSPACE=m
+CONFIG_DM_ZERO=m
+CONFIG_DM_MULTIPATH=m
+CONFIG_DM_MULTIPATH_QL=m
+CONFIG_DM_MULTIPATH_ST=m
+CONFIG_DM_DELAY=m
+# CONFIG_DM_UEVENT is not set
+CONFIG_FUSION=y
+CONFIG_FUSION_SPI=m
+CONFIG_FUSION_FC=m
+CONFIG_FUSION_SAS=m
+CONFIG_FUSION_MAX_SGE=128
+CONFIG_FUSION_CTL=m
+# CONFIG_FUSION_LOGGING is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+
+#
+# You can enable one or both FireWire driver stacks.
+#
+
+#
+# The newer stack is recommended.
+#
+CONFIG_FIREWIRE=m
+CONFIG_FIREWIRE_OHCI=m
+CONFIG_FIREWIRE_OHCI_DEBUG=y
+CONFIG_FIREWIRE_SBP2=m
+CONFIG_FIREWIRE_NET=m
+CONFIG_IEEE1394=m
+CONFIG_IEEE1394_OHCI1394=m
+CONFIG_IEEE1394_PCILYNX=m
+CONFIG_IEEE1394_SBP2=m
+# CONFIG_IEEE1394_SBP2_PHYS_DMA is not set
+CONFIG_IEEE1394_ETH1394_ROM_ENTRY=y
+CONFIG_IEEE1394_ETH1394=m
+CONFIG_IEEE1394_RAWIO=m
+CONFIG_IEEE1394_VIDEO1394=m
+CONFIG_IEEE1394_DV1394=m
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+CONFIG_I2O=m
+CONFIG_I2O_LCT_NOTIFY_ON_CHANGES=y
+CONFIG_I2O_EXT_ADAPTEC=y
+CONFIG_I2O_EXT_ADAPTEC_DMA64=y
+CONFIG_I2O_CONFIG=m
+CONFIG_I2O_CONFIG_OLD_IOCTL=y
+CONFIG_I2O_BUS=m
+CONFIG_I2O_BLOCK=m
+CONFIG_I2O_SCSI=m
+CONFIG_I2O_PROC=m
+# CONFIG_MACINTOSH_DRIVERS is not set
+CONFIG_NETDEVICES=y
+CONFIG_IFB=m
+CONFIG_DUMMY=m
+CONFIG_BONDING=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_EQUALIZER=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_NET_SB1000=m
+CONFIG_ARCNET=m
+CONFIG_ARCNET_1201=m
+CONFIG_ARCNET_1051=m
+CONFIG_ARCNET_RAW=m
+CONFIG_ARCNET_CAP=m
+CONFIG_ARCNET_COM90xx=m
+CONFIG_ARCNET_COM90xxIO=m
+CONFIG_ARCNET_RIM_I=m
+CONFIG_ARCNET_COM20020=m
+CONFIG_ARCNET_COM20020_ISA=m
+CONFIG_ARCNET_COM20020_PCI=m
+CONFIG_PHYLIB=m
+
+#
+# MII PHY device drivers
+#
+CONFIG_MARVELL_PHY=m
+CONFIG_DAVICOM_PHY=m
+CONFIG_QSEMI_PHY=m
+CONFIG_LXT_PHY=m
+CONFIG_CICADA_PHY=m
+CONFIG_VITESSE_PHY=m
+CONFIG_SMSC_PHY=m
+CONFIG_BROADCOM_PHY=m
+CONFIG_ICPLUS_PHY=m
+CONFIG_REALTEK_PHY=m
+CONFIG_NATIONAL_PHY=m
+CONFIG_STE10XP=m
+CONFIG_LSI_ET1011C_PHY=m
+CONFIG_MICREL_PHY=m
+CONFIG_MDIO_BITBANG=m
+CONFIG_MDIO_GPIO=m
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=m
+CONFIG_HAPPYMEAL=m
+CONFIG_SUNGEM=m
+CONFIG_CASSINI=m
+CONFIG_NET_VENDOR_3COM=y
+CONFIG_EL1=m
+CONFIG_EL2=m
+CONFIG_ELPLUS=m
+CONFIG_EL16=m
+CONFIG_EL3=m
+CONFIG_3C515=m
+CONFIG_VORTEX=m
+CONFIG_TYPHOON=m
+CONFIG_LANCE=m
+CONFIG_NET_VENDOR_SMC=y
+CONFIG_WD80x3=m
+CONFIG_ULTRA=m
+CONFIG_SMC9194=m
+CONFIG_ENC28J60=m
+# CONFIG_ENC28J60_WRITEVERIFY is not set
+CONFIG_ETHOC=m
+CONFIG_NET_VENDOR_RACAL=y
+CONFIG_NI52=m
+CONFIG_NI65=m
+CONFIG_DNET=m
+CONFIG_NET_TULIP=y
+CONFIG_DE2104X=m
+CONFIG_DE2104X_DSL=0
+CONFIG_TULIP=m
+# CONFIG_TULIP_MWI is not set
+# CONFIG_TULIP_MMIO is not set
+# CONFIG_TULIP_NAPI is not set
+CONFIG_DE4X5=m
+CONFIG_WINBOND_840=m
+CONFIG_DM9102=m
+CONFIG_ULI526X=m
+CONFIG_PCMCIA_XIRCOM=m
+CONFIG_AT1700=m
+CONFIG_DEPCA=m
+CONFIG_HP100=m
+CONFIG_NET_ISA=y
+CONFIG_E2100=m
+CONFIG_EWRK3=m
+CONFIG_EEXPRESS=m
+CONFIG_EEXPRESS_PRO=m
+CONFIG_HPLAN_PLUS=m
+CONFIG_HPLAN=m
+CONFIG_LP486E=m
+CONFIG_ETH16I=m
+CONFIG_NE2000=m
+CONFIG_ZNET=m
+CONFIG_SEEQ8005=m
+# CONFIG_IBM_NEW_EMAC_ZMII is not set
+# CONFIG_IBM_NEW_EMAC_RGMII is not set
+# CONFIG_IBM_NEW_EMAC_TAH is not set
+# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
+CONFIG_NET_PCI=y
+CONFIG_PCNET32=m
+CONFIG_AMD8111_ETH=m
+CONFIG_ADAPTEC_STARFIRE=m
+CONFIG_AC3200=m
+CONFIG_KSZ884X_PCI=m
+CONFIG_APRICOT=m
+CONFIG_B44=m
+CONFIG_B44_PCI_AUTOSELECT=y
+CONFIG_B44_PCICORE_AUTOSELECT=y
+CONFIG_B44_PCI=y
+CONFIG_FORCEDETH=m
+# CONFIG_FORCEDETH_NAPI is not set
+CONFIG_CS89x0=m
+CONFIG_E100=m
+CONFIG_FEALNX=m
+CONFIG_NATSEMI=m
+CONFIG_NE2K_PCI=m
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+CONFIG_8139TOO_PIO=y
+# CONFIG_8139TOO_TUNE_TWISTER is not set
+# CONFIG_8139TOO_8129 is not set
+# CONFIG_8139_OLD_RX_RESET is not set
+CONFIG_R6040=m
+CONFIG_SIS900=m
+CONFIG_EPIC100=m
+CONFIG_SMSC9420=m
+CONFIG_SUNDANCE=m
+# CONFIG_SUNDANCE_MMIO is not set
+CONFIG_TLAN=m
+CONFIG_KS8842=m
+CONFIG_KS8851=m
+CONFIG_KS8851_MLL=m
+CONFIG_VIA_RHINE=m
+# CONFIG_VIA_RHINE_MMIO is not set
+CONFIG_SC92031=m
+CONFIG_NET_POCKET=y
+CONFIG_ATP=m
+CONFIG_DE600=m
+CONFIG_DE620=m
+CONFIG_ATL2=m
+CONFIG_NETDEV_1000=y
+CONFIG_ACENIC=m
+# CONFIG_ACENIC_OMIT_TIGON_I is not set
+CONFIG_DL2K=m
+CONFIG_E1000=m
+CONFIG_E1000E=m
+CONFIG_IP1000=m
+CONFIG_IGB=m
+CONFIG_IGB_DCA=y
+CONFIG_IGBVF=m
+CONFIG_NS83820=m
+CONFIG_HAMACHI=m
+CONFIG_YELLOWFIN=m
+CONFIG_R8169=m
+CONFIG_R8169_VLAN=y
+CONFIG_SIS190=m
+CONFIG_SKGE=m
+# CONFIG_SKGE_DEBUG is not set
+CONFIG_SKY2=m
+# CONFIG_SKY2_DEBUG is not set
+CONFIG_VIA_VELOCITY=m
+CONFIG_TIGON3=m
+CONFIG_BNX2=m
+CONFIG_CNIC=m
+CONFIG_QLA3XXX=m
+CONFIG_ATL1=m
+CONFIG_ATL1E=m
+CONFIG_ATL1C=m
+CONFIG_JME=m
+CONFIG_NETDEV_10000=y
+CONFIG_MDIO=m
+CONFIG_CHELSIO_T1=m
+CONFIG_CHELSIO_T1_1G=y
+CONFIG_CHELSIO_T3_DEPENDS=y
+CONFIG_CHELSIO_T3=m
+CONFIG_CHELSIO_T4_DEPENDS=y
+CONFIG_CHELSIO_T4=m
+CONFIG_ENIC=m
+CONFIG_IXGBE=m
+CONFIG_IXGBE_DCA=y
+CONFIG_IXGB=m
+CONFIG_S2IO=m
+CONFIG_VXGE=m
+# CONFIG_VXGE_DEBUG_TRACE_ALL is not set
+CONFIG_MYRI10GE=m
+CONFIG_MYRI10GE_DCA=y
+CONFIG_NETXEN_NIC=m
+CONFIG_NIU=m
+CONFIG_MLX4_EN=m
+CONFIG_MLX4_CORE=m
+CONFIG_MLX4_DEBUG=y
+CONFIG_TEHUTI=m
+CONFIG_BNX2X=m
+CONFIG_QLCNIC=m
+CONFIG_QLGE=m
+CONFIG_SFC=m
+CONFIG_SFC_MTD=y
+CONFIG_BE2NET=m
+# CONFIG_TR is not set
+CONFIG_WLAN=y
+CONFIG_PCMCIA_RAYCS=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_AIRO=m
+CONFIG_ATMEL=m
+CONFIG_PCI_ATMEL=m
+CONFIG_PCMCIA_ATMEL=m
+CONFIG_AT76C50X_USB=m
+CONFIG_AIRO_CS=m
+CONFIG_PCMCIA_WL3501=m
+CONFIG_PRISM54=m
+CONFIG_USB_ZD1201=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL8187_LEDS=y
+CONFIG_ADM8211=m
+CONFIG_MAC80211_HWSIM=m
+CONFIG_MWL8K=m
+CONFIG_ATH_COMMON=m
+# CONFIG_ATH_DEBUG is not set
+CONFIG_ATH5K=m
+# CONFIG_ATH5K_DEBUG is not set
+CONFIG_ATH9K_HW=m
+CONFIG_ATH9K_COMMON=m
+CONFIG_ATH9K=m
+# CONFIG_ATH9K_DEBUGFS is not set
+CONFIG_AR9170_USB=m
+CONFIG_AR9170_LEDS=y
+CONFIG_B43=m
+CONFIG_B43_PCI_AUTOSELECT=y
+CONFIG_B43_PCICORE_AUTOSELECT=y
+CONFIG_B43_PCMCIA=y
+CONFIG_B43_SDIO=y
+CONFIG_B43_PIO=y
+CONFIG_B43_PHY_LP=y
+CONFIG_B43_LEDS=y
+CONFIG_B43_HWRNG=y
+# CONFIG_B43_DEBUG is not set
+CONFIG_B43LEGACY=m
+CONFIG_B43LEGACY_PCI_AUTOSELECT=y
+CONFIG_B43LEGACY_PCICORE_AUTOSELECT=y
+CONFIG_B43LEGACY_LEDS=y
+CONFIG_B43LEGACY_HWRNG=y
+CONFIG_B43LEGACY_DEBUG=y
+CONFIG_B43LEGACY_DMA=y
+CONFIG_B43LEGACY_PIO=y
+CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
+# CONFIG_B43LEGACY_DMA_MODE is not set
+# CONFIG_B43LEGACY_PIO_MODE is not set
+CONFIG_HOSTAP=m
+CONFIG_HOSTAP_FIRMWARE=y
+CONFIG_HOSTAP_FIRMWARE_NVRAM=y
+CONFIG_HOSTAP_PLX=m
+CONFIG_HOSTAP_PCI=m
+CONFIG_HOSTAP_CS=m
+CONFIG_IPW2100=m
+CONFIG_IPW2100_MONITOR=y
+# CONFIG_IPW2100_DEBUG is not set
+CONFIG_IPW2200=m
+CONFIG_IPW2200_MONITOR=y
+CONFIG_IPW2200_RADIOTAP=y
+CONFIG_IPW2200_PROMISCUOUS=y
+CONFIG_IPW2200_QOS=y
+# CONFIG_IPW2200_DEBUG is not set
+CONFIG_LIBIPW=m
+# CONFIG_LIBIPW_DEBUG is not set
+CONFIG_IWLWIFI=m
+# CONFIG_IWLWIFI_DEBUG is not set
+CONFIG_IWLAGN=m
+CONFIG_IWL4965=y
+CONFIG_IWL5000=y
+CONFIG_IWL3945=m
+CONFIG_IWM=m
+# CONFIG_IWM_DEBUG is not set
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBERTAS_CS=m
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_SPI=m
+# CONFIG_LIBERTAS_DEBUG is not set
+# CONFIG_LIBERTAS_MESH is not set
+CONFIG_HERMES=m
+CONFIG_HERMES_CACHE_FW_ON_INIT=y
+CONFIG_PLX_HERMES=m
+CONFIG_TMD_HERMES=m
+CONFIG_NORTEL_HERMES=m
+CONFIG_PCI_HERMES=m
+CONFIG_PCMCIA_HERMES=m
+CONFIG_PCMCIA_SPECTRUM=m
+CONFIG_P54_COMMON=m
+CONFIG_P54_USB=m
+CONFIG_P54_PCI=m
+CONFIG_P54_SPI=m
+CONFIG_P54_LEDS=y
+CONFIG_RT2X00=m
+CONFIG_RT2400PCI=m
+CONFIG_RT2500PCI=m
+CONFIG_RT61PCI=m
+CONFIG_RT2800PCI_PCI=y
+CONFIG_RT2800PCI=m
+# CONFIG_RT2800PCI_RT30XX is not set
+# CONFIG_RT2800PCI_RT35XX is not set
+CONFIG_RT2500USB=m
+CONFIG_RT73USB=m
+CONFIG_RT2800USB=m
+# CONFIG_RT2800USB_RT30XX is not set
+# CONFIG_RT2800USB_RT35XX is not set
+# CONFIG_RT2800USB_UNKNOWN is not set
+CONFIG_RT2800_LIB=m
+CONFIG_RT2X00_LIB_PCI=m
+CONFIG_RT2X00_LIB_USB=m
+CONFIG_RT2X00_LIB=m
+CONFIG_RT2X00_LIB_HT=y
+CONFIG_RT2X00_LIB_FIRMWARE=y
+CONFIG_RT2X00_LIB_CRYPTO=y
+CONFIG_RT2X00_LIB_LEDS=y
+# CONFIG_RT2X00_DEBUG is not set
+CONFIG_WL12XX=m
+CONFIG_WL1251=m
+CONFIG_WL1251_SPI=m
+CONFIG_WL1251_SDIO=m
+CONFIG_WL1271=m
+CONFIG_ZD1211RW=m
+# CONFIG_ZD1211RW_DEBUG is not set
+
+#
+# WiMAX Wireless Broadband devices
+#
+CONFIG_WIMAX_I2400M=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_WIMAX_I2400M_SDIO=m
+# CONFIG_WIMAX_IWMC3200_SDIO is not set
+CONFIG_WIMAX_I2400M_DEBUG_LEVEL=8
+
+#
+# USB Network Adapters
+#
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_SMSC75XX=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_RNDIS_HOST=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+CONFIG_USB_BELKIN=y
+CONFIG_USB_ARMLINUX=y
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_KC2190=y
+CONFIG_USB_NET_ZAURUS=m
+CONFIG_USB_HSO=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_CDC_PHONET=m
+CONFIG_USB_IPHETH=m
+CONFIG_USB_SIERRA_NET=m
+CONFIG_NET_PCMCIA=y
+CONFIG_PCMCIA_3C589=m
+CONFIG_PCMCIA_3C574=m
+CONFIG_PCMCIA_FMVJ18X=m
+CONFIG_PCMCIA_PCNET=m
+CONFIG_PCMCIA_NMCLAN=m
+CONFIG_PCMCIA_SMC91C92=m
+CONFIG_PCMCIA_XIRC2PS=m
+CONFIG_PCMCIA_AXNET=m
+CONFIG_ARCNET_COM20020_CS=m
+CONFIG_WAN=y
+CONFIG_HOSTESS_SV11=m
+CONFIG_COSA=m
+CONFIG_LANMEDIA=m
+CONFIG_SEALEVEL_4021=m
+CONFIG_HDLC=m
+CONFIG_HDLC_RAW=m
+CONFIG_HDLC_RAW_ETH=m
+CONFIG_HDLC_CISCO=m
+CONFIG_HDLC_FR=m
+CONFIG_HDLC_PPP=m
+CONFIG_HDLC_X25=m
+CONFIG_PCI200SYN=m
+CONFIG_WANXL=m
+# CONFIG_WANXL_BUILD_FIRMWARE is not set
+CONFIG_PC300TOO=m
+CONFIG_N2=m
+CONFIG_C101=m
+CONFIG_FARSYNC=m
+CONFIG_DSCC4=m
+CONFIG_DSCC4_PCISYNC=y
+CONFIG_DSCC4_PCI_RST=y
+CONFIG_DLCI=m
+CONFIG_DLCI_MAX=8
+CONFIG_SDLA=m
+CONFIG_WAN_ROUTER_DRIVERS=m
+CONFIG_CYCLADES_SYNC=m
+CONFIG_CYCLOMX_X25=y
+CONFIG_LAPBETHER=m
+CONFIG_X25_ASY=m
+CONFIG_SBNI=m
+CONFIG_SBNI_MULTILINE=y
+CONFIG_ATM_DRIVERS=y
+CONFIG_ATM_DUMMY=m
+CONFIG_ATM_TCP=m
+CONFIG_ATM_LANAI=m
+CONFIG_ATM_ENI=m
+# CONFIG_ATM_ENI_DEBUG is not set
+# CONFIG_ATM_ENI_TUNE_BURST is not set
+CONFIG_ATM_FIRESTREAM=m
+CONFIG_ATM_ZATM=m
+# CONFIG_ATM_ZATM_DEBUG is not set
+CONFIG_ATM_NICSTAR=m
+CONFIG_ATM_NICSTAR_USE_SUNI=y
+CONFIG_ATM_NICSTAR_USE_IDT77105=y
+CONFIG_ATM_IDT77252=m
+# CONFIG_ATM_IDT77252_DEBUG is not set
+# CONFIG_ATM_IDT77252_RCV_ALL is not set
+CONFIG_ATM_IDT77252_USE_SUNI=y
+CONFIG_ATM_AMBASSADOR=m
+# CONFIG_ATM_AMBASSADOR_DEBUG is not set
+CONFIG_ATM_HORIZON=m
+# CONFIG_ATM_HORIZON_DEBUG is not set
+CONFIG_ATM_IA=m
+# CONFIG_ATM_IA_DEBUG is not set
+CONFIG_ATM_FORE200E=m
+CONFIG_ATM_FORE200E_USE_TASKLET=y
+CONFIG_ATM_FORE200E_TX_RETRY=16
+CONFIG_ATM_FORE200E_DEBUG=0
+CONFIG_ATM_HE=m
+CONFIG_ATM_HE_USE_SUNI=y
+CONFIG_ATM_SOLOS=m
+CONFIG_IEEE802154_DRIVERS=m
+CONFIG_IEEE802154_FAKEHARD=m
+CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_FDDI=y
+CONFIG_DEFXX=m
+# CONFIG_DEFXX_MMIO is not set
+CONFIG_SKFP=m
+CONFIG_HIPPI=y
+CONFIG_ROADRUNNER=m
+# CONFIG_ROADRUNNER_LARGE_RINGS is not set
+CONFIG_PLIP=m
+CONFIG_PPP=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_PPPOATM=m
+CONFIG_PPPOL2TP=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLHC=m
+CONFIG_SLIP_SMART=y
+CONFIG_SLIP_MODE_SLIP6=y
+# CONFIG_NET_FC is not set
+CONFIG_NETCONSOLE=m
+CONFIG_NETCONSOLE_DYNAMIC=y
+CONFIG_NETPOLL=y
+# CONFIG_NETPOLL_TRAP is not set
+CONFIG_NET_POLL_CONTROLLER=y
+CONFIG_VIRTIO_NET=m
+CONFIG_VMXNET3=m
+CONFIG_ISDN=y
+# CONFIG_ISDN_I4L is not set
+CONFIG_ISDN_CAPI=m
+# CONFIG_ISDN_DRV_AVMB1_VERBOSE_REASON is not set
+# CONFIG_CAPI_TRACE is not set
+CONFIG_ISDN_CAPI_MIDDLEWARE=y
+CONFIG_ISDN_CAPI_CAPI20=m
+CONFIG_ISDN_CAPI_CAPIFS_BOOL=y
+CONFIG_ISDN_CAPI_CAPIFS=m
+
+#
+# CAPI hardware drivers
+#
+CONFIG_CAPI_AVM=y
+CONFIG_ISDN_DRV_AVMB1_B1ISA=m
+CONFIG_ISDN_DRV_AVMB1_B1PCI=m
+CONFIG_ISDN_DRV_AVMB1_B1PCIV4=y
+CONFIG_ISDN_DRV_AVMB1_T1ISA=m
+CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=m
+CONFIG_ISDN_DRV_AVMB1_AVM_CS=m
+CONFIG_ISDN_DRV_AVMB1_T1PCI=m
+CONFIG_ISDN_DRV_AVMB1_C4=m
+CONFIG_CAPI_EICON=y
+CONFIG_ISDN_DIVAS=m
+CONFIG_ISDN_DIVAS_BRIPCI=y
+CONFIG_ISDN_DIVAS_PRIPCI=y
+CONFIG_ISDN_DIVAS_DIVACAPI=m
+CONFIG_ISDN_DIVAS_USERIDI=m
+CONFIG_ISDN_DIVAS_MAINT=m
+CONFIG_ISDN_DRV_GIGASET=m
+CONFIG_GIGASET_CAPI=y
+# CONFIG_GIGASET_DUMMYLL is not set
+CONFIG_GIGASET_BASE=m
+CONFIG_GIGASET_M105=m
+CONFIG_GIGASET_M101=m
+# CONFIG_GIGASET_DEBUG is not set
+CONFIG_HYSDN=m
+# CONFIG_HYSDN_CAPI is not set
+CONFIG_MISDN=m
+CONFIG_MISDN_DSP=m
+CONFIG_MISDN_L1OIP=m
+
+#
+# mISDN hardware drivers
+#
+CONFIG_MISDN_HFCPCI=m
+CONFIG_MISDN_HFCMULTI=m
+CONFIG_MISDN_HFCUSB=m
+CONFIG_MISDN_AVMFRITZ=m
+# CONFIG_MISDN_SPEEDFAX is not set
+# CONFIG_MISDN_INFINEON is not set
+# CONFIG_MISDN_W6692 is not set
+# CONFIG_MISDN_NETJET is not set
+CONFIG_MISDN_IPAC=m
+# CONFIG_PHONE is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+CONFIG_INPUT_FF_MEMLESS=m
+CONFIG_INPUT_POLLDEV=m
+CONFIG_INPUT_SPARSEKMAP=m
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=m
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_EVDEV=m
+CONFIG_INPUT_EVBUG=m
+CONFIG_XEN_KBDDEV_FRONTEND=m
+
+#
+# Input Device Drivers
+#
+CONFIG_INPUT_KEYBOARD=y
+# CONFIG_KEYBOARD_ADP5588 is not set
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_QT2160=m
+CONFIG_KEYBOARD_LKKBD=m
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_MATRIX=m
+CONFIG_KEYBOARD_LM8323=m
+# CONFIG_KEYBOARD_MAX7359 is not set
+CONFIG_KEYBOARD_NEWTON=m
+# CONFIG_KEYBOARD_OPENCORES is not set
+CONFIG_KEYBOARD_STOWAWAY=m
+CONFIG_KEYBOARD_SUNKBD=m
+CONFIG_KEYBOARD_XTKBD=m
+CONFIG_INPUT_MOUSE=y
+CONFIG_MOUSE_PS2=m
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
+# CONFIG_MOUSE_PS2_SENTELIC is not set
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_SERIAL=m
+CONFIG_MOUSE_APPLETOUCH=m
+CONFIG_MOUSE_BCM5974=m
+CONFIG_MOUSE_INPORT=m
+# CONFIG_MOUSE_ATIXL is not set
+CONFIG_MOUSE_LOGIBM=m
+CONFIG_MOUSE_PC110PAD=m
+CONFIG_MOUSE_VSXXXAA=m
+CONFIG_MOUSE_GPIO=m
+CONFIG_MOUSE_SYNAPTICS_I2C=m
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_AD7877=m
+CONFIG_TOUCHSCREEN_AD7879_I2C=m
+CONFIG_TOUCHSCREEN_AD7879=m
+CONFIG_TOUCHSCREEN_DYNAPRO=m
+CONFIG_TOUCHSCREEN_EETI=m
+CONFIG_TOUCHSCREEN_FUJITSU=m
+CONFIG_TOUCHSCREEN_GUNZE=m
+CONFIG_TOUCHSCREEN_ELO=m
+CONFIG_TOUCHSCREEN_WACOM_W8001=m
+# CONFIG_TOUCHSCREEN_MCS5000 is not set
+CONFIG_TOUCHSCREEN_MTOUCH=m
+CONFIG_TOUCHSCREEN_INEXIO=m
+CONFIG_TOUCHSCREEN_MK712=m
+CONFIG_TOUCHSCREEN_HTCPEN=m
+CONFIG_TOUCHSCREEN_PENMOUNT=m
+CONFIG_TOUCHSCREEN_TOUCHRIGHT=m
+CONFIG_TOUCHSCREEN_TOUCHWIN=m
+CONFIG_TOUCHSCREEN_UCB1400=m
+CONFIG_TOUCHSCREEN_WM97XX=m
+CONFIG_TOUCHSCREEN_WM9705=y
+CONFIG_TOUCHSCREEN_WM9712=y
+CONFIG_TOUCHSCREEN_WM9713=y
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_USB_EGALAX=y
+CONFIG_TOUCHSCREEN_USB_PANJIT=y
+CONFIG_TOUCHSCREEN_USB_3M=y
+CONFIG_TOUCHSCREEN_USB_ITM=y
+CONFIG_TOUCHSCREEN_USB_ETURBO=y
+CONFIG_TOUCHSCREEN_USB_GUNZE=y
+CONFIG_TOUCHSCREEN_USB_DMC_TSC10=y
+CONFIG_TOUCHSCREEN_USB_IRTOUCH=y
+CONFIG_TOUCHSCREEN_USB_IDEALTEK=y
+CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH=y
+CONFIG_TOUCHSCREEN_USB_GOTOP=y
+CONFIG_TOUCHSCREEN_USB_JASTEC=y
+CONFIG_TOUCHSCREEN_USB_E2I=y
+CONFIG_TOUCHSCREEN_USB_ZYTRONIC=y
+CONFIG_TOUCHSCREEN_USB_ETT_TC5UH=y
+CONFIG_TOUCHSCREEN_USB_NEXIO=y
+CONFIG_TOUCHSCREEN_TOUCHIT213=m
+CONFIG_TOUCHSCREEN_TSC2007=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_PCSPKR=m
+CONFIG_INPUT_APANEL=m
+CONFIG_INPUT_WISTRON_BTNS=m
+CONFIG_INPUT_ATLAS_BTNS=m
+CONFIG_INPUT_ATI_REMOTE=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_WINBOND_CIR=m
+CONFIG_INPUT_PCF50633_PMU=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_SERPORT=m
+CONFIG_SERIO_CT82C710=m
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_RAW=m
+CONFIG_SERIO_ALTERA_PS2=m
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+# CONFIG_DEVKMEM is not set
+CONFIG_SERIAL_NONSTANDARD=y
+CONFIG_COMPUTONE=m
+CONFIG_ROCKETPORT=m
+CONFIG_CYCLADES=m
+# CONFIG_CYZ_INTR is not set
+CONFIG_DIGIEPCA=m
+CONFIG_MOXA_INTELLIO=m
+CONFIG_MOXA_SMARTIO=m
+CONFIG_ISI=m
+CONFIG_SYNCLINK=m
+CONFIG_SYNCLINKMP=m
+CONFIG_SYNCLINK_GT=m
+CONFIG_N_HDLC=m
+CONFIG_RISCOM8=m
+CONFIG_SPECIALIX=m
+CONFIG_STALDRV=y
+CONFIG_STALLION=m
+CONFIG_ISTALLION=m
+CONFIG_NOZOMI=m
+
+#
+# Serial drivers
+#
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_8250_CS=m
+CONFIG_SERIAL_8250_NR_UARTS=16
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_FOURPORT=m
+CONFIG_SERIAL_8250_ACCENT=m
+CONFIG_SERIAL_8250_BOCA=m
+CONFIG_SERIAL_8250_EXAR_ST16C554=m
+CONFIG_SERIAL_8250_HUB6=m
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+# CONFIG_SERIAL_8250_DETECT_IRQ is not set
+CONFIG_SERIAL_8250_RSA=y
+
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_MAX3100=m
+CONFIG_SERIAL_UARTLITE=m
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_JSM=m
+CONFIG_SERIAL_TIMBERDALE=m
+CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_PRINTER=m
+# CONFIG_LP_CONSOLE is not set
+CONFIG_PPDEV=m
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_IPMI_HANDLER=m
+# CONFIG_IPMI_PANIC_EVENT is not set
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_SI=m
+CONFIG_IPMI_WATCHDOG=m
+CONFIG_IPMI_POWEROFF=m
+CONFIG_HW_RANDOM=m
+CONFIG_HW_RANDOM_TIMERIOMEM=m
+CONFIG_HW_RANDOM_INTEL=m
+CONFIG_HW_RANDOM_AMD=m
+CONFIG_HW_RANDOM_GEODE=m
+CONFIG_HW_RANDOM_VIA=m
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_NVRAM=m
+CONFIG_DTLK=m
+CONFIG_R3964=m
+CONFIG_APPLICOM=m
+CONFIG_SONYPI=m
+
+#
+# PCMCIA character devices
+#
+CONFIG_SYNCLINK_CS=m
+CONFIG_CARDMAN_4000=m
+CONFIG_CARDMAN_4040=m
+CONFIG_IPWIRELESS=m
+CONFIG_MWAVE=m
+CONFIG_SCx200_GPIO=m
+CONFIG_PC8736x_GPIO=m
+CONFIG_NSC_GPIO=m
+CONFIG_CS5535_GPIO=m
+CONFIG_RAW_DRIVER=m
+CONFIG_MAX_RAW_DEVS=256
+CONFIG_HPET=y
+CONFIG_HPET_MMAP=y
+CONFIG_HANGCHECK_TIMER=m
+CONFIG_TCG_TPM=m
+CONFIG_TCG_TIS=m
+CONFIG_TCG_NSC=m
+CONFIG_TCG_ATMEL=m
+CONFIG_TCG_INFINEON=m
+CONFIG_TELCLOCK=m
+CONFIG_DEVPORT=y
+CONFIG_I2C=m
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_SMBUS=m
+CONFIG_I2C_ALGOBIT=m
+CONFIG_I2C_ALGOPCA=m
+
+#
+# I2C Hardware Bus support
+#
+
+#
+# PC SMBus host controller drivers
+#
+CONFIG_I2C_ALI1535=m
+CONFIG_I2C_ALI1563=m
+CONFIG_I2C_ALI15X3=m
+CONFIG_I2C_AMD756=m
+CONFIG_I2C_AMD756_S4882=m
+CONFIG_I2C_AMD8111=m
+CONFIG_I2C_I801=m
+CONFIG_I2C_ISCH=m
+CONFIG_I2C_PIIX4=m
+CONFIG_I2C_NFORCE2=m
+CONFIG_I2C_NFORCE2_S4985=m
+CONFIG_I2C_SIS5595=m
+CONFIG_I2C_SIS630=m
+CONFIG_I2C_SIS96X=m
+CONFIG_I2C_VIA=m
+CONFIG_I2C_VIAPRO=m
+
+#
+# ACPI drivers
+#
+CONFIG_I2C_SCMI=m
+
+#
+# I2C system bus drivers (mostly embedded / system-on-chip)
+#
+CONFIG_I2C_GPIO=m
+CONFIG_I2C_OCORES=m
+CONFIG_I2C_SIMTEC=m
+CONFIG_I2C_XILINX=m
+
+#
+# External I2C/SMBus adapter drivers
+#
+CONFIG_I2C_PARPORT=m
+CONFIG_I2C_PARPORT_LIGHT=m
+CONFIG_I2C_TAOS_EVM=m
+CONFIG_I2C_TINY_USB=m
+
+#
+# Other I2C/SMBus bus drivers
+#
+CONFIG_I2C_PCA_ISA=m
+CONFIG_I2C_PCA_PLATFORM=m
+CONFIG_I2C_STUB=m
+CONFIG_SCx200_I2C=m
+CONFIG_SCx200_I2C_SCL=12
+CONFIG_SCx200_I2C_SDA=13
+CONFIG_SCx200_ACB=m
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+CONFIG_SPI=y
+CONFIG_SPI_MASTER=y
+
+#
+# SPI Master Controller Drivers
+#
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_BUTTERFLY=m
+CONFIG_SPI_GPIO=m
+CONFIG_SPI_LM70_LLP=m
+CONFIG_SPI_XILINX=m
+CONFIG_SPI_XILINX_PLTFM=m
+CONFIG_SPI_DESIGNWARE=m
+CONFIG_SPI_DW_PCI=m
+
+#
+# SPI Protocol Masters
+#
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_TLE62X0=m
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+CONFIG_GPIOLIB=y
+# CONFIG_GPIO_SYSFS is not set
+CONFIG_GPIO_MAX730X=m
+
+#
+# Memory mapped GPIO expanders:
+#
+CONFIG_GPIO_IT8761E=m
+CONFIG_GPIO_SCH=m
+
+#
+# I2C GPIO expanders:
+#
+CONFIG_GPIO_MAX7300=m
+CONFIG_GPIO_MAX732X=m
+CONFIG_GPIO_PCA953X=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_WM8994=m
+CONFIG_GPIO_ADP5588=m
+
+#
+# PCI GPIO expanders:
+#
+CONFIG_GPIO_CS5535=m
+# CONFIG_GPIO_LANGWELL is not set
+# CONFIG_GPIO_TIMBERDALE is not set
+
+#
+# SPI GPIO expanders:
+#
+CONFIG_GPIO_MAX7301=m
+CONFIG_GPIO_MCP23S08=m
+# CONFIG_GPIO_MC33880 is not set
+
+#
+# AC97 GPIO expanders:
+#
+# CONFIG_GPIO_UCB1400 is not set
+CONFIG_W1=m
+CONFIG_W1_CON=y
+
+#
+# 1-wire Bus Masters
+#
+CONFIG_W1_MASTER_MATROX=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_GPIO=m
+
+#
+# 1-wire Slaves
+#
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+# CONFIG_W1_SLAVE_DS2433_CRC is not set
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_BQ27000=m
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+CONFIG_PDA_POWER=m
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_DS2782=m
+CONFIG_BATTERY_BQ27x00=m
+CONFIG_BATTERY_MAX17040=m
+CONFIG_CHARGER_PCF50633=m
+CONFIG_HWMON=m
+CONFIG_HWMON_VID=m
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Native drivers
+#
+CONFIG_SENSORS_ABITUGURU=m
+CONFIG_SENSORS_ABITUGURU3=m
+CONFIG_SENSORS_AD7414=m
+CONFIG_SENSORS_AD7418=m
+CONFIG_SENSORS_ADCXX=m
+CONFIG_SENSORS_ADM1021=m
+CONFIG_SENSORS_ADM1025=m
+CONFIG_SENSORS_ADM1026=m
+CONFIG_SENSORS_ADM1029=m
+CONFIG_SENSORS_ADM1031=m
+CONFIG_SENSORS_ADM9240=m
+CONFIG_SENSORS_ADT7411=m
+CONFIG_SENSORS_ADT7462=m
+CONFIG_SENSORS_ADT7470=m
+CONFIG_SENSORS_ADT7475=m
+CONFIG_SENSORS_ASC7621=m
+CONFIG_SENSORS_K8TEMP=m
+CONFIG_SENSORS_K10TEMP=m
+CONFIG_SENSORS_ASB100=m
+CONFIG_SENSORS_ATXP1=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_I5K_AMB=m
+CONFIG_SENSORS_F71805F=m
+CONFIG_SENSORS_F71882FG=m
+CONFIG_SENSORS_F75375S=m
+CONFIG_SENSORS_FSCHMD=m
+CONFIG_SENSORS_G760A=m
+CONFIG_SENSORS_GL518SM=m
+CONFIG_SENSORS_GL520SM=m
+CONFIG_SENSORS_CORETEMP=m
+CONFIG_SENSORS_IBMAEM=m
+CONFIG_SENSORS_IBMPEX=m
+CONFIG_SENSORS_IT87=m
+CONFIG_SENSORS_LM63=m
+CONFIG_SENSORS_LM70=m
+CONFIG_SENSORS_LM73=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_LM77=m
+CONFIG_SENSORS_LM78=m
+CONFIG_SENSORS_LM80=m
+CONFIG_SENSORS_LM83=m
+CONFIG_SENSORS_LM85=m
+CONFIG_SENSORS_LM87=m
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_LM92=m
+CONFIG_SENSORS_LM93=m
+CONFIG_SENSORS_LTC4215=m
+CONFIG_SENSORS_LTC4245=m
+CONFIG_SENSORS_LM95241=m
+CONFIG_SENSORS_MAX1111=m
+CONFIG_SENSORS_MAX1619=m
+CONFIG_SENSORS_MAX6650=m
+CONFIG_SENSORS_PC87360=m
+CONFIG_SENSORS_PC87427=m
+CONFIG_SENSORS_PCF8591=m
+CONFIG_SENSORS_SHT15=m
+CONFIG_SENSORS_SIS5595=m
+CONFIG_SENSORS_DME1737=m
+CONFIG_SENSORS_SMSC47M1=m
+CONFIG_SENSORS_SMSC47M192=m
+CONFIG_SENSORS_SMSC47B397=m
+CONFIG_SENSORS_ADS7828=m
+CONFIG_SENSORS_AMC6821=m
+CONFIG_SENSORS_THMC50=m
+CONFIG_SENSORS_TMP401=m
+CONFIG_SENSORS_TMP421=m
+CONFIG_SENSORS_VIA_CPUTEMP=m
+CONFIG_SENSORS_VIA686A=m
+CONFIG_SENSORS_VT1211=m
+CONFIG_SENSORS_VT8231=m
+CONFIG_SENSORS_W83781D=m
+CONFIG_SENSORS_W83791D=m
+CONFIG_SENSORS_W83792D=m
+CONFIG_SENSORS_W83793=m
+CONFIG_SENSORS_W83L785TS=m
+CONFIG_SENSORS_W83L786NG=m
+CONFIG_SENSORS_W83627HF=m
+CONFIG_SENSORS_W83627EHF=m
+CONFIG_SENSORS_HDAPS=m
+CONFIG_SENSORS_LIS3_I2C=m
+CONFIG_SENSORS_APPLESMC=m
+
+#
+# ACPI drivers
+#
+CONFIG_SENSORS_ATK0110=m
+CONFIG_SENSORS_LIS3LV02D=m
+CONFIG_THERMAL=y
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+
+#
+# Watchdog Device Drivers
+#
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_ACQUIRE_WDT=m
+CONFIG_ADVANTECH_WDT=m
+CONFIG_ALIM1535_WDT=m
+CONFIG_ALIM7101_WDT=m
+CONFIG_GEODE_WDT=m
+CONFIG_SC520_WDT=m
+# CONFIG_SBC_FITPC2_WATCHDOG is not set
+CONFIG_EUROTECH_WDT=m
+CONFIG_IB700_WDT=m
+CONFIG_IBMASR=m
+CONFIG_WAFER_WDT=m
+CONFIG_I6300ESB_WDT=m
+CONFIG_ITCO_WDT=m
+CONFIG_ITCO_VENDOR_SUPPORT=y
+CONFIG_IT8712F_WDT=m
+CONFIG_IT87_WDT=m
+# CONFIG_HP_WATCHDOG is not set
+CONFIG_SC1200_WDT=m
+CONFIG_SCx200_WDT=m
+CONFIG_PC87413_WDT=m
+CONFIG_60XX_WDT=m
+CONFIG_SBC8360_WDT=m
+CONFIG_SBC7240_WDT=m
+CONFIG_CPU5_WDT=m
+CONFIG_SMSC_SCH311X_WDT=m
+CONFIG_SMSC37B787_WDT=m
+CONFIG_W83627HF_WDT=m
+CONFIG_W83697HF_WDT=m
+CONFIG_W83697UG_WDT=m
+CONFIG_W83877F_WDT=m
+CONFIG_W83977F_WDT=m
+CONFIG_MACHZ_WDT=m
+CONFIG_SBC_EPX_C3_WATCHDOG=m
+
+#
+# ISA-based Watchdog Cards
+#
+CONFIG_PCWATCHDOG=m
+CONFIG_MIXCOMWD=m
+CONFIG_WDT=m
+
+#
+# PCI-based Watchdog Cards
+#
+CONFIG_PCIPCWATCHDOG=m
+CONFIG_WDTPCI=m
+
+#
+# USB-based Watchdog Cards
+#
+CONFIG_USBPCWATCHDOG=m
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+CONFIG_SSB=m
+CONFIG_SSB_SPROM=y
+CONFIG_SSB_BLOCKIO=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_B43_PCI_BRIDGE=y
+CONFIG_SSB_PCMCIAHOST_POSSIBLE=y
+CONFIG_SSB_PCMCIAHOST=y
+CONFIG_SSB_SDIOHOST_POSSIBLE=y
+CONFIG_SSB_SDIOHOST=y
+# CONFIG_SSB_SILENT is not set
+# CONFIG_SSB_DEBUG is not set
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_DRIVER_PCICORE=y
+
+#
+# Multifunction device drivers
+#
+CONFIG_MFD_CORE=m
+CONFIG_MFD_SM501=m
+# CONFIG_MFD_SM501_GPIO is not set
+CONFIG_HTC_PASIC3=m
+CONFIG_UCB1400_CORE=m
+CONFIG_TPS65010=m
+# CONFIG_MFD_TMIO is not set
+CONFIG_MFD_WM8400=m
+CONFIG_MFD_WM8994=m
+CONFIG_MFD_PCF50633=m
+# CONFIG_MFD_MC13783 is not set
+CONFIG_PCF50633_ADC=m
+CONFIG_PCF50633_GPIO=m
+# CONFIG_EZX_PCAP is not set
+CONFIG_AB4500_CORE=m
+CONFIG_MFD_TIMBERDALE=m
+CONFIG_LPC_SCH=m
+CONFIG_REGULATOR=y
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_DUMMY is not set
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+CONFIG_REGULATOR_VIRTUAL_CONSUMER=m
+CONFIG_REGULATOR_USERSPACE_CONSUMER=m
+CONFIG_REGULATOR_BQ24022=m
+CONFIG_REGULATOR_MAX1586=m
+CONFIG_REGULATOR_MAX8649=m
+CONFIG_REGULATOR_MAX8660=m
+CONFIG_REGULATOR_WM8400=m
+CONFIG_REGULATOR_WM8994=m
+CONFIG_REGULATOR_PCF50633=m
+CONFIG_REGULATOR_LP3971=m
+# CONFIG_REGULATOR_TPS65023 is not set
+# CONFIG_REGULATOR_TPS6507X is not set
+CONFIG_MEDIA_SUPPORT=m
+
+#
+# Multimedia core support
+#
+CONFIG_VIDEO_DEV=m
+CONFIG_VIDEO_V4L2_COMMON=m
+# CONFIG_VIDEO_ALLOW_V4L1 is not set
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_DVB_CORE=m
+CONFIG_VIDEO_MEDIA=m
+
+#
+# Multimedia drivers
+#
+CONFIG_VIDEO_SAA7146=m
+CONFIG_VIDEO_SAA7146_VV=m
+CONFIG_IR_CORE=m
+CONFIG_VIDEO_IR=m
+# CONFIG_MEDIA_ATTACH is not set
+CONFIG_MEDIA_TUNER=m
+# CONFIG_MEDIA_TUNER_CUSTOMISE is not set
+CONFIG_MEDIA_TUNER_SIMPLE=m
+CONFIG_MEDIA_TUNER_TDA8290=m
+CONFIG_MEDIA_TUNER_TDA827X=m
+CONFIG_MEDIA_TUNER_TDA18271=m
+CONFIG_MEDIA_TUNER_TDA9887=m
+CONFIG_MEDIA_TUNER_TEA5761=m
+CONFIG_MEDIA_TUNER_TEA5767=m
+CONFIG_MEDIA_TUNER_MT20XX=m
+CONFIG_MEDIA_TUNER_MT2060=m
+CONFIG_MEDIA_TUNER_MT2266=m
+CONFIG_MEDIA_TUNER_MT2131=m
+CONFIG_MEDIA_TUNER_QT1010=m
+CONFIG_MEDIA_TUNER_XC2028=m
+CONFIG_MEDIA_TUNER_XC5000=m
+CONFIG_MEDIA_TUNER_MXL5005S=m
+CONFIG_MEDIA_TUNER_MXL5007T=m
+CONFIG_MEDIA_TUNER_MC44S803=m
+CONFIG_MEDIA_TUNER_MAX2165=m
+CONFIG_VIDEO_V4L2=m
+CONFIG_VIDEOBUF_GEN=m
+CONFIG_VIDEOBUF_DMA_SG=m
+CONFIG_VIDEOBUF_VMALLOC=m
+CONFIG_VIDEOBUF_DVB=m
+CONFIG_VIDEO_BTCX=m
+CONFIG_VIDEO_TVEEPROM=m
+CONFIG_VIDEO_TUNER=m
+CONFIG_VIDEO_CAPTURE_DRIVERS=y
+# CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+# CONFIG_VIDEO_HELPER_CHIPS_AUTO is not set
+CONFIG_VIDEO_IR_I2C=m
+
+#
+# Encoders/decoders and other helper chips
+#
+
+#
+# Audio decoders
+#
+CONFIG_VIDEO_TVAUDIO=m
+CONFIG_VIDEO_TDA7432=m
+CONFIG_VIDEO_TDA9840=m
+CONFIG_VIDEO_TDA9875=m
+CONFIG_VIDEO_TEA6415C=m
+CONFIG_VIDEO_TEA6420=m
+CONFIG_VIDEO_MSP3400=m
+CONFIG_VIDEO_CS5345=m
+CONFIG_VIDEO_CS53L32A=m
+CONFIG_VIDEO_M52790=m
+CONFIG_VIDEO_TLV320AIC23B=m
+CONFIG_VIDEO_WM8775=m
+CONFIG_VIDEO_WM8739=m
+CONFIG_VIDEO_VP27SMPX=m
+
+#
+# RDS decoders
+#
+CONFIG_VIDEO_SAA6588=m
+
+#
+# Video decoders
+#
+# CONFIG_VIDEO_ADV7180 is not set
+CONFIG_VIDEO_BT819=m
+CONFIG_VIDEO_BT856=m
+CONFIG_VIDEO_BT866=m
+CONFIG_VIDEO_KS0127=m
+CONFIG_VIDEO_OV7670=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_VIDEO_TCM825X=m
+CONFIG_VIDEO_SAA7110=m
+CONFIG_VIDEO_SAA711X=m
+CONFIG_VIDEO_SAA717X=m
+CONFIG_VIDEO_SAA7191=m
+CONFIG_VIDEO_TVP514X=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_TVP7002=m
+CONFIG_VIDEO_VPX3220=m
+
+#
+# Video and audio decoders
+#
+CONFIG_VIDEO_CX25840=m
+
+#
+# MPEG video encoders
+#
+CONFIG_VIDEO_CX2341X=m
+
+#
+# Video encoders
+#
+CONFIG_VIDEO_SAA7127=m
+CONFIG_VIDEO_SAA7185=m
+CONFIG_VIDEO_ADV7170=m
+CONFIG_VIDEO_ADV7175=m
+CONFIG_VIDEO_THS7303=m
+CONFIG_VIDEO_ADV7343=m
+
+#
+# Video improvement chips
+#
+CONFIG_VIDEO_UPD64031A=m
+CONFIG_VIDEO_UPD64083=m
+CONFIG_VIDEO_VIVI=m
+CONFIG_VIDEO_BT848=m
+CONFIG_VIDEO_BT848_DVB=y
+CONFIG_VIDEO_PMS=m
+CONFIG_VIDEO_SAA5246A=m
+CONFIG_VIDEO_SAA5249=m
+CONFIG_VIDEO_ZORAN=m
+CONFIG_VIDEO_ZORAN_DC30=m
+CONFIG_VIDEO_ZORAN_ZR36060=m
+CONFIG_VIDEO_ZORAN_BUZ=m
+CONFIG_VIDEO_ZORAN_DC10=m
+CONFIG_VIDEO_ZORAN_LML33=m
+CONFIG_VIDEO_ZORAN_LML33R10=m
+CONFIG_VIDEO_ZORAN_AVS6EYES=m
+CONFIG_VIDEO_SAA7134=m
+CONFIG_VIDEO_SAA7134_ALSA=m
+CONFIG_VIDEO_SAA7134_DVB=m
+CONFIG_VIDEO_MXB=m
+CONFIG_VIDEO_HEXIUM_ORION=m
+CONFIG_VIDEO_HEXIUM_GEMINI=m
+CONFIG_VIDEO_CX88=m
+CONFIG_VIDEO_CX88_ALSA=m
+CONFIG_VIDEO_CX88_BLACKBIRD=m
+CONFIG_VIDEO_CX88_DVB=m
+CONFIG_VIDEO_CX88_MPEG=m
+CONFIG_VIDEO_CX88_VP3054=m
+CONFIG_VIDEO_CX23885=m
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_IVTV=m
+CONFIG_VIDEO_FB_IVTV=m
+CONFIG_VIDEO_CX18=m
+CONFIG_VIDEO_CX18_ALSA=m
+CONFIG_VIDEO_SAA7164=m
+CONFIG_VIDEO_CAFE_CCIC=m
+CONFIG_SOC_CAMERA=m
+CONFIG_SOC_CAMERA_MT9M001=m
+CONFIG_SOC_CAMERA_MT9M111=m
+CONFIG_SOC_CAMERA_MT9T031=m
+CONFIG_SOC_CAMERA_MT9T112=m
+CONFIG_SOC_CAMERA_MT9V022=m
+CONFIG_SOC_CAMERA_RJ54N1=m
+CONFIG_SOC_CAMERA_TW9910=m
+CONFIG_SOC_CAMERA_PLATFORM=m
+CONFIG_SOC_CAMERA_OV772X=m
+CONFIG_SOC_CAMERA_OV9640=m
+CONFIG_V4L_USB_DRIVERS=y
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+CONFIG_USB_GSPCA=m
+CONFIG_USB_M5602=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_GL860=m
+CONFIG_USB_GSPCA_BENQ=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_CPIA1=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_JEILINJ=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_OV534_9=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7302=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SN9C2028=m
+CONFIG_USB_GSPCA_SN9C20X=m
+CONFIG_USB_GSPCA_SN9C20X_EVDEV=y
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_STV0680=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_VIDEO_PVRUSB2=m
+CONFIG_VIDEO_PVRUSB2_SYSFS=y
+CONFIG_VIDEO_PVRUSB2_DVB=y
+# CONFIG_VIDEO_PVRUSB2_DEBUGIFC is not set
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_VIDEO_TLG2300=m
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_USB_ET61X251=m
+CONFIG_USB_SN9C102=m
+CONFIG_USB_ZC0301=m
+CONFIG_USB_PWC_INPUT_EVDEV=y
+CONFIG_USB_ZR364XX=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_S2255=m
+CONFIG_RADIO_ADAPTERS=y
+CONFIG_RADIO_CADET=m
+CONFIG_RADIO_RTRACK=m
+CONFIG_RADIO_RTRACK2=m
+CONFIG_RADIO_AZTECH=m
+CONFIG_RADIO_GEMTEK=m
+CONFIG_RADIO_GEMTEK_PCI=m
+CONFIG_RADIO_MAXIRADIO=m
+CONFIG_RADIO_MAESTRO=m
+CONFIG_RADIO_MIROPCM20=m
+CONFIG_RADIO_SF16FMI=m
+CONFIG_RADIO_SF16FMR2=m
+CONFIG_RADIO_TERRATEC=m
+CONFIG_RADIO_TRUST=m
+CONFIG_RADIO_TYPHOON=m
+CONFIG_RADIO_ZOLTRIX=m
+# CONFIG_I2C_SI4713 is not set
+# CONFIG_RADIO_SI4713 is not set
+CONFIG_USB_DSBR=m
+# CONFIG_RADIO_SI470X is not set
+CONFIG_USB_MR800=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_SAA7706H=m
+CONFIG_RADIO_TEF6862=m
+CONFIG_RADIO_TIMBERDALE=m
+CONFIG_DVB_MAX_ADAPTERS=8
+# CONFIG_DVB_DYNAMIC_MINORS is not set
+CONFIG_DVB_CAPTURE_DRIVERS=y
+
+#
+# Supported SAA7146 based PCI Adapters
+#
+CONFIG_TTPCI_EEPROM=m
+CONFIG_DVB_AV7110=m
+CONFIG_DVB_AV7110_OSD=y
+CONFIG_DVB_BUDGET_CORE=m
+CONFIG_DVB_BUDGET=m
+CONFIG_DVB_BUDGET_CI=m
+CONFIG_DVB_BUDGET_AV=m
+CONFIG_DVB_BUDGET_PATCH=m
+
+#
+# Supported USB Adapters
+#
+CONFIG_DVB_USB=m
+# CONFIG_DVB_USB_DEBUG is not set
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+# CONFIG_DVB_USB_DIBUSB_MB_FAULTY is not set
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_CXUSB=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_CE6230=m
+# CONFIG_DVB_USB_FRIIO is not set
+CONFIG_DVB_USB_EC168=m
+CONFIG_DVB_USB_AZ6027=m
+CONFIG_DVB_TTUSB_BUDGET=m
+CONFIG_DVB_TTUSB_DEC=m
+CONFIG_SMS_SIANO_MDTV=m
+
+#
+# Siano module components
+#
+CONFIG_SMS_USB_DRV=m
+CONFIG_SMS_SDIO_DRV=m
+
+#
+# Supported FlexCopII (B2C2) Adapters
+#
+CONFIG_DVB_B2C2_FLEXCOP=m
+CONFIG_DVB_B2C2_FLEXCOP_PCI=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+# CONFIG_DVB_B2C2_FLEXCOP_DEBUG is not set
+
+#
+# Supported BT878 Adapters
+#
+CONFIG_DVB_BT8XX=m
+
+#
+# Supported Pluto2 Adapters
+#
+CONFIG_DVB_PLUTO2=m
+
+#
+# Supported SDMC DM1105 Adapters
+#
+CONFIG_DVB_DM1105=m
+
+#
+# Supported FireWire (IEEE 1394) Adapters
+#
+CONFIG_DVB_FIREDTV=m
+CONFIG_DVB_FIREDTV_FIREWIRE=y
+CONFIG_DVB_FIREDTV_IEEE1394=y
+CONFIG_DVB_FIREDTV_INPUT=y
+
+#
+# Supported Earthsoft PT1 Adapters
+#
+# CONFIG_DVB_PT1 is not set
+
+#
+# Supported Mantis Adapters
+#
+CONFIG_MANTIS_CORE=m
+CONFIG_DVB_MANTIS=m
+CONFIG_DVB_HOPPER=m
+
+#
+# Supported nGene Adapters
+#
+CONFIG_DVB_NGENE=m
+
+#
+# Supported DVB Frontends
+#
+# CONFIG_DVB_FE_CUSTOMISE is not set
+CONFIG_DVB_STB0899=m
+CONFIG_DVB_STB6100=m
+CONFIG_DVB_STV090x=m
+CONFIG_DVB_STV6110x=m
+CONFIG_DVB_CX24110=m
+CONFIG_DVB_CX24123=m
+CONFIG_DVB_MT312=m
+CONFIG_DVB_ZL10036=m
+CONFIG_DVB_ZL10039=m
+CONFIG_DVB_S5H1420=m
+CONFIG_DVB_STV0288=m
+CONFIG_DVB_STB6000=m
+CONFIG_DVB_STV0299=m
+CONFIG_DVB_STV6110=m
+CONFIG_DVB_STV0900=m
+CONFIG_DVB_TDA8083=m
+CONFIG_DVB_TDA10086=m
+CONFIG_DVB_TDA8261=m
+CONFIG_DVB_VES1X93=m
+CONFIG_DVB_TUNER_ITD1000=m
+CONFIG_DVB_TUNER_CX24113=m
+CONFIG_DVB_TDA826X=m
+CONFIG_DVB_TUA6100=m
+CONFIG_DVB_CX24116=m
+CONFIG_DVB_SI21XX=m
+CONFIG_DVB_DS3000=m
+CONFIG_DVB_MB86A16=m
+CONFIG_DVB_SP8870=m
+CONFIG_DVB_SP887X=m
+CONFIG_DVB_CX22700=m
+CONFIG_DVB_CX22702=m
+CONFIG_DVB_L64781=m
+CONFIG_DVB_TDA1004X=m
+CONFIG_DVB_NXT6000=m
+CONFIG_DVB_MT352=m
+CONFIG_DVB_ZL10353=m
+CONFIG_DVB_DIB3000MB=m
+CONFIG_DVB_DIB3000MC=m
+CONFIG_DVB_DIB7000M=m
+CONFIG_DVB_DIB7000P=m
+CONFIG_DVB_TDA10048=m
+CONFIG_DVB_AF9013=m
+CONFIG_DVB_EC100=m
+CONFIG_DVB_VES1820=m
+CONFIG_DVB_TDA10021=m
+CONFIG_DVB_TDA10023=m
+CONFIG_DVB_STV0297=m
+CONFIG_DVB_NXT200X=m
+CONFIG_DVB_OR51211=m
+CONFIG_DVB_OR51132=m
+CONFIG_DVB_BCM3510=m
+CONFIG_DVB_LGDT330X=m
+CONFIG_DVB_LGDT3305=m
+CONFIG_DVB_S5H1409=m
+CONFIG_DVB_AU8522=m
+CONFIG_DVB_S5H1411=m
+CONFIG_DVB_DIB8000=m
+CONFIG_DVB_PLL=m
+CONFIG_DVB_TUNER_DIB0070=m
+CONFIG_DVB_LNBP21=m
+CONFIG_DVB_ISL6405=m
+CONFIG_DVB_ISL6421=m
+CONFIG_DVB_LGS8GXX=m
+CONFIG_DVB_ATBM8830=m
+CONFIG_DAB=y
+CONFIG_USB_DABUSB=m
+
+#
+# Graphics support
+#
+CONFIG_AGP=m
+CONFIG_AGP_ALI=m
+CONFIG_AGP_ATI=m
+CONFIG_AGP_AMD=m
+CONFIG_AGP_AMD64=m
+CONFIG_AGP_INTEL=m
+CONFIG_AGP_NVIDIA=m
+CONFIG_AGP_SIS=m
+CONFIG_AGP_SWORKS=m
+CONFIG_AGP_VIA=m
+CONFIG_AGP_EFFICEON=m
+# CONFIG_VGA_ARB is not set
+# CONFIG_VGA_SWITCHEROO is not set
+CONFIG_DRM=m
+CONFIG_DRM_KMS_HELPER=m
+CONFIG_DRM_TTM=m
+CONFIG_DRM_TDFX=m
+CONFIG_DRM_R128=m
+CONFIG_DRM_RADEON=m
+# CONFIG_DRM_RADEON_KMS is not set
+CONFIG_DRM_I810=m
+CONFIG_DRM_I830=m
+CONFIG_DRM_I915=m
+# CONFIG_DRM_I915_KMS is not set
+CONFIG_DRM_MGA=m
+CONFIG_DRM_SIS=m
+CONFIG_DRM_VIA=m
+CONFIG_DRM_SAVAGE=m
+CONFIG_VGASTATE=m
+CONFIG_VIDEO_OUTPUT_CONTROL=m
+CONFIG_FB=m
+# CONFIG_FIRMWARE_EDID is not set
+CONFIG_FB_DDC=m
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
+CONFIG_FB_CFB_FILLRECT=m
+CONFIG_FB_CFB_COPYAREA=m
+CONFIG_FB_CFB_IMAGEBLIT=m
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+CONFIG_FB_SYS_FILLRECT=m
+CONFIG_FB_SYS_COPYAREA=m
+CONFIG_FB_SYS_IMAGEBLIT=m
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_SYS_FOPS=m
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_HECUBA=m
+CONFIG_FB_SVGALIB=m
+# CONFIG_FB_MACMODES is not set
+CONFIG_FB_BACKLIGHT=y
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
+
+#
+# Frame buffer hardware drivers
+#
+CONFIG_FB_CIRRUS=m
+CONFIG_FB_PM2=m
+CONFIG_FB_PM2_FIFO_DISCONNECT=y
+CONFIG_FB_CYBER2000=m
+CONFIG_FB_ARC=m
+CONFIG_FB_VGA16=m
+CONFIG_FB_UVESA=m
+CONFIG_FB_N411=m
+CONFIG_FB_HGA=m
+# CONFIG_FB_HGA_ACCEL is not set
+CONFIG_FB_S1D13XXX=m
+CONFIG_FB_NVIDIA=m
+CONFIG_FB_NVIDIA_I2C=y
+# CONFIG_FB_NVIDIA_DEBUG is not set
+CONFIG_FB_NVIDIA_BACKLIGHT=y
+CONFIG_FB_RIVA=m
+CONFIG_FB_RIVA_I2C=y
+# CONFIG_FB_RIVA_DEBUG is not set
+CONFIG_FB_RIVA_BACKLIGHT=y
+CONFIG_FB_I810=m
+CONFIG_FB_I810_GTF=y
+CONFIG_FB_I810_I2C=y
+CONFIG_FB_LE80578=m
+CONFIG_FB_CARILLO_RANCH=m
+CONFIG_FB_INTEL=m
+# CONFIG_FB_INTEL_DEBUG is not set
+CONFIG_FB_INTEL_I2C=y
+CONFIG_FB_MATROX=m
+CONFIG_FB_MATROX_MILLENIUM=y
+CONFIG_FB_MATROX_MYSTIQUE=y
+CONFIG_FB_MATROX_G=y
+CONFIG_FB_MATROX_I2C=m
+CONFIG_FB_MATROX_MAVEN=m
+CONFIG_FB_RADEON=m
+CONFIG_FB_RADEON_I2C=y
+CONFIG_FB_RADEON_BACKLIGHT=y
+# CONFIG_FB_RADEON_DEBUG is not set
+CONFIG_FB_ATY128=m
+CONFIG_FB_ATY128_BACKLIGHT=y
+CONFIG_FB_ATY=m
+CONFIG_FB_ATY_CT=y
+CONFIG_FB_ATY_GENERIC_LCD=y
+CONFIG_FB_ATY_GX=y
+CONFIG_FB_ATY_BACKLIGHT=y
+CONFIG_FB_S3=m
+CONFIG_FB_SAVAGE=m
+CONFIG_FB_SAVAGE_I2C=y
+CONFIG_FB_SAVAGE_ACCEL=y
+CONFIG_FB_SIS=m
+CONFIG_FB_SIS_300=y
+CONFIG_FB_SIS_315=y
+CONFIG_FB_VIA=m
+CONFIG_FB_NEOMAGIC=m
+CONFIG_FB_KYRO=m
+CONFIG_FB_3DFX=m
+CONFIG_FB_3DFX_ACCEL=y
+CONFIG_FB_3DFX_I2C=y
+CONFIG_FB_VOODOO1=m
+CONFIG_FB_VT8623=m
+CONFIG_FB_TRIDENT=m
+CONFIG_FB_ARK=m
+CONFIG_FB_PM3=m
+CONFIG_FB_CARMINE=m
+CONFIG_FB_CARMINE_DRAM_EVAL=y
+# CONFIG_CARMINE_DRAM_CUSTOM is not set
+CONFIG_FB_GEODE=y
+CONFIG_FB_GEODE_LX=m
+CONFIG_FB_GEODE_GX=m
+CONFIG_FB_GEODE_GX1=m
+CONFIG_FB_TMIO=m
+CONFIG_FB_TMIO_ACCELL=y
+CONFIG_FB_SM501=m
+# CONFIG_FB_VIRTUAL is not set
+CONFIG_XEN_FBDEV_FRONTEND=m
+CONFIG_FB_METRONOME=m
+CONFIG_FB_MB862XX=m
+# CONFIG_FB_MB862XX_PCI_GDC is not set
+CONFIG_FB_BROADSHEET=m
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+CONFIG_LCD_CLASS_DEVICE=m
+CONFIG_LCD_L4F00242T03=m
+CONFIG_LCD_LMS283GF05=m
+CONFIG_LCD_LTV350QV=m
+CONFIG_LCD_ILI9320=m
+CONFIG_LCD_TDO24M=m
+CONFIG_LCD_VGG2432A4=m
+CONFIG_LCD_PLATFORM=m
+CONFIG_BACKLIGHT_CLASS_DEVICE=m
+CONFIG_BACKLIGHT_GENERIC=m
+CONFIG_BACKLIGHT_PROGEAR=m
+CONFIG_BACKLIGHT_CARILLO_RANCH=m
+CONFIG_BACKLIGHT_MBP_NVIDIA=m
+CONFIG_BACKLIGHT_SAHARA=m
+
+#
+# Display device support
+#
+CONFIG_DISPLAY_SUPPORT=m
+
+#
+# Display hardware drivers
+#
+
+#
+# Console display driver support
+#
+CONFIG_VGA_CONSOLE=y
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
+CONFIG_MDA_CONSOLE=m
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE=m
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x8=y
+CONFIG_FONT_8x16=y
+# CONFIG_LOGO is not set
+CONFIG_SOUND=m
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SOUND_OSS_CORE_PRECLAIM=y
+CONFIG_SND=m
+CONFIG_SND_TIMER=m
+CONFIG_SND_PCM=m
+CONFIG_SND_HWDEP=m
+CONFIG_SND_RAWMIDI=m
+CONFIG_SND_JACK=y
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_PCM_OSS_PLUGINS=y
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
+CONFIG_SND_DYNAMIC_MINORS=y
+# CONFIG_SND_SUPPORT_OLD_API is not set
+# CONFIG_SND_VERBOSE_PROCFS is not set
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+CONFIG_SND_VMASTER=y
+CONFIG_SND_DMA_SGBUF=y
+CONFIG_SND_RAWMIDI_SEQ=m
+CONFIG_SND_OPL3_LIB_SEQ=m
+CONFIG_SND_OPL4_LIB_SEQ=m
+CONFIG_SND_SBAWE_SEQ=m
+CONFIG_SND_EMU10K1_SEQ=m
+CONFIG_SND_MPU401_UART=m
+CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_OPL4_LIB=m
+CONFIG_SND_VX_LIB=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_DRIVERS=y
+CONFIG_SND_PCSP=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_MTS64=m
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_PORTMAN2X4=m
+CONFIG_SND_AC97_POWER_SAVE=y
+CONFIG_SND_AC97_POWER_SAVE_DEFAULT=0
+CONFIG_SND_WSS_LIB=m
+CONFIG_SND_SB_COMMON=m
+CONFIG_SND_SB8_DSP=m
+CONFIG_SND_SB16_DSP=m
+CONFIG_SND_ISA=y
+CONFIG_SND_ADLIB=m
+CONFIG_SND_AD1816A=m
+CONFIG_SND_AD1848=m
+CONFIG_SND_ALS100=m
+CONFIG_SND_AZT2320=m
+CONFIG_SND_CMI8330=m
+CONFIG_SND_CS4231=m
+CONFIG_SND_CS4236=m
+CONFIG_SND_ES968=m
+CONFIG_SND_ES1688=m
+CONFIG_SND_ES18XX=m
+CONFIG_SND_SC6000=m
+CONFIG_SND_GUSCLASSIC=m
+CONFIG_SND_GUSEXTREME=m
+CONFIG_SND_GUSMAX=m
+CONFIG_SND_INTERWAVE=m
+CONFIG_SND_INTERWAVE_STB=m
+CONFIG_SND_JAZZ16=m
+CONFIG_SND_OPL3SA2=m
+CONFIG_SND_OPTI92X_AD1848=m
+CONFIG_SND_OPTI92X_CS4231=m
+CONFIG_SND_OPTI93X=m
+CONFIG_SND_MIRO=m
+CONFIG_SND_SB8=m
+CONFIG_SND_SB16=m
+CONFIG_SND_SBAWE=m
+CONFIG_SND_SB16_CSP=y
+CONFIG_SND_SGALAXY=m
+CONFIG_SND_SSCAPE=m
+CONFIG_SND_WAVEFRONT=m
+CONFIG_SND_MSND_PINNACLE=m
+CONFIG_SND_MSND_CLASSIC=m
+CONFIG_SND_PCI=y
+CONFIG_SND_AD1889=m
+CONFIG_SND_ALS300=m
+CONFIG_SND_ALS4000=m
+CONFIG_SND_ALI5451=m
+CONFIG_SND_ATIIXP=m
+CONFIG_SND_ATIIXP_MODEM=m
+CONFIG_SND_AU8810=m
+CONFIG_SND_AU8820=m
+CONFIG_SND_AU8830=m
+CONFIG_SND_AW2=m
+CONFIG_SND_AZT3328=m
+CONFIG_SND_BT87X=m
+# CONFIG_SND_BT87X_OVERCLOCK is not set
+CONFIG_SND_CA0106=m
+CONFIG_SND_CMIPCI=m
+CONFIG_SND_OXYGEN_LIB=m
+CONFIG_SND_OXYGEN=m
+CONFIG_SND_CS4281=m
+CONFIG_SND_CS46XX=m
+CONFIG_SND_CS46XX_NEW_DSP=y
+CONFIG_SND_CS5530=m
+CONFIG_SND_CS5535AUDIO=m
+CONFIG_SND_CTXFI=m
+CONFIG_SND_DARLA20=m
+CONFIG_SND_GINA20=m
+CONFIG_SND_LAYLA20=m
+CONFIG_SND_DARLA24=m
+CONFIG_SND_GINA24=m
+CONFIG_SND_LAYLA24=m
+CONFIG_SND_MONA=m
+CONFIG_SND_MIA=m
+CONFIG_SND_ECHO3G=m
+CONFIG_SND_INDIGO=m
+CONFIG_SND_INDIGOIO=m
+CONFIG_SND_INDIGODJ=m
+CONFIG_SND_INDIGOIOX=m
+CONFIG_SND_INDIGODJX=m
+CONFIG_SND_EMU10K1=m
+CONFIG_SND_EMU10K1X=m
+CONFIG_SND_ENS1370=m
+CONFIG_SND_ENS1371=m
+CONFIG_SND_ES1938=m
+CONFIG_SND_ES1968=m
+CONFIG_SND_FM801=m
+# CONFIG_SND_FM801_TEA575X_BOOL is not set
+CONFIG_SND_HDA_INTEL=m
+CONFIG_SND_HDA_HWDEP=y
+# CONFIG_SND_HDA_RECONFIG is not set
+CONFIG_SND_HDA_INPUT_BEEP=y
+CONFIG_SND_HDA_INPUT_BEEP_MODE=1
+CONFIG_SND_HDA_INPUT_JACK=y
+# CONFIG_SND_HDA_PATCH_LOADER is not set
+CONFIG_SND_HDA_CODEC_REALTEK=y
+CONFIG_SND_HDA_CODEC_ANALOG=y
+CONFIG_SND_HDA_CODEC_SIGMATEL=y
+CONFIG_SND_HDA_CODEC_VIA=y
+CONFIG_SND_HDA_CODEC_ATIHDMI=y
+CONFIG_SND_HDA_CODEC_NVHDMI=y
+CONFIG_SND_HDA_CODEC_INTELHDMI=y
+CONFIG_SND_HDA_ELD=y
+CONFIG_SND_HDA_CODEC_CIRRUS=y
+CONFIG_SND_HDA_CODEC_CONEXANT=y
+CONFIG_SND_HDA_CODEC_CA0110=y
+CONFIG_SND_HDA_CODEC_CMEDIA=y
+CONFIG_SND_HDA_CODEC_SI3054=y
+CONFIG_SND_HDA_GENERIC=y
+# CONFIG_SND_HDA_POWER_SAVE is not set
+CONFIG_SND_HDSP=m
+CONFIG_SND_HDSPM=m
+CONFIG_SND_HIFIER=m
+CONFIG_SND_ICE1712=m
+CONFIG_SND_ICE1724=m
+CONFIG_SND_INTEL8X0=m
+CONFIG_SND_INTEL8X0M=m
+CONFIG_SND_KORG1212=m
+CONFIG_SND_LX6464ES=m
+CONFIG_SND_MAESTRO3=m
+CONFIG_SND_MIXART=m
+CONFIG_SND_NM256=m
+CONFIG_SND_PCXHR=m
+CONFIG_SND_RIPTIDE=m
+CONFIG_SND_RME32=m
+CONFIG_SND_RME96=m
+CONFIG_SND_RME9652=m
+CONFIG_SND_SIS7019=m
+CONFIG_SND_SONICVIBES=m
+CONFIG_SND_TRIDENT=m
+CONFIG_SND_VIA82XX=m
+CONFIG_SND_VIA82XX_MODEM=m
+CONFIG_SND_VIRTUOSO=m
+CONFIG_SND_VX222=m
+CONFIG_SND_YMFPCI=m
+CONFIG_SND_SPI=y
+CONFIG_SND_USB=y
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_UA101=m
+CONFIG_SND_USB_USX2Y=m
+CONFIG_SND_USB_CAIAQ=m
+# CONFIG_SND_USB_CAIAQ_INPUT is not set
+CONFIG_SND_USB_US122L=m
+CONFIG_SND_PCMCIA=y
+CONFIG_SND_VXPOCKET=m
+CONFIG_SND_PDAUDIOCF=m
+CONFIG_SND_SOC=m
+CONFIG_SND_SOC_I2C_AND_SPI=m
+CONFIG_SND_SOC_ALL_CODECS=m
+CONFIG_SND_SOC_WM_HUBS=m
+CONFIG_SND_SOC_AD1836=m
+CONFIG_SND_SOC_AD1938=m
+CONFIG_SND_SOC_AD73311=m
+CONFIG_SND_SOC_ADS117X=m
+CONFIG_SND_SOC_AK4104=m
+CONFIG_SND_SOC_AK4535=m
+CONFIG_SND_SOC_AK4642=m
+CONFIG_SND_SOC_AK4671=m
+CONFIG_SND_SOC_CS4270=m
+CONFIG_SND_SOC_DA7210=m
+CONFIG_SND_SOC_L3=m
+CONFIG_SND_SOC_PCM3008=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_SSM2602=m
+CONFIG_SND_SOC_TLV320AIC23=m
+CONFIG_SND_SOC_TLV320AIC26=m
+CONFIG_SND_SOC_TLV320AIC3X=m
+CONFIG_SND_SOC_TLV320DAC33=m
+CONFIG_SND_SOC_UDA134X=m
+CONFIG_SND_SOC_UDA1380=m
+CONFIG_SND_SOC_WM8400=m
+CONFIG_SND_SOC_WM8510=m
+CONFIG_SND_SOC_WM8523=m
+CONFIG_SND_SOC_WM8580=m
+CONFIG_SND_SOC_WM8711=m
+CONFIG_SND_SOC_WM8727=m
+CONFIG_SND_SOC_WM8728=m
+CONFIG_SND_SOC_WM8731=m
+CONFIG_SND_SOC_WM8750=m
+CONFIG_SND_SOC_WM8753=m
+CONFIG_SND_SOC_WM8776=m
+CONFIG_SND_SOC_WM8900=m
+CONFIG_SND_SOC_WM8903=m
+CONFIG_SND_SOC_WM8904=m
+CONFIG_SND_SOC_WM8940=m
+CONFIG_SND_SOC_WM8955=m
+CONFIG_SND_SOC_WM8960=m
+CONFIG_SND_SOC_WM8961=m
+CONFIG_SND_SOC_WM8971=m
+CONFIG_SND_SOC_WM8974=m
+CONFIG_SND_SOC_WM8978=m
+CONFIG_SND_SOC_WM8988=m
+CONFIG_SND_SOC_WM8990=m
+CONFIG_SND_SOC_WM8993=m
+CONFIG_SND_SOC_WM8994=m
+CONFIG_SND_SOC_WM9081=m
+CONFIG_SND_SOC_MAX9877=m
+CONFIG_SND_SOC_TPA6130A2=m
+CONFIG_SND_SOC_WM2000=m
+# CONFIG_SOUND_PRIME is not set
+CONFIG_AC97_BUS=m
+CONFIG_HID_SUPPORT=y
+CONFIG_HID=m
+CONFIG_HIDRAW=y
+
+#
+# USB Input Devices
+#
+CONFIG_USB_HID=m
+# CONFIG_HID_PID is not set
+# CONFIG_USB_HIDDEV is not set
+
+#
+# USB HID Boot Protocol drivers
+#
+CONFIG_USB_KBD=m
+CONFIG_USB_MOUSE=m
+
+#
+# Special HID drivers
+#
+CONFIG_HID_3M_PCT=m
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_DRAGONRISE is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_KYE is not set
+# CONFIG_HID_GYRATION is not set
+# CONFIG_HID_TWINHAN is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LOGITECH is not set
+CONFIG_HID_MAGICMOUSE=m
+# CONFIG_HID_MICROSOFT is not set
+CONFIG_HID_MOSART=m
+# CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_NTRIG is not set
+CONFIG_HID_ORTEK=m
+# CONFIG_HID_PANTHERLORD is not set
+# CONFIG_HID_PETALYNX is not set
+CONFIG_HID_QUANTA=m
+# CONFIG_HID_SAMSUNG is not set
+# CONFIG_HID_SONY is not set
+CONFIG_HID_STANTUM=m
+# CONFIG_HID_SUNPLUS is not set
+# CONFIG_HID_GREENASIA is not set
+# CONFIG_HID_SMARTJOYPLUS is not set
+# CONFIG_HID_TOPSEED is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_WACOM is not set
+# CONFIG_HID_ZEROPLUS is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB=m
+# CONFIG_USB_DEBUG is not set
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+
+#
+# Miscellaneous USB options
+#
+CONFIG_USB_DEVICEFS=y
+CONFIG_USB_DEVICE_CLASS=y
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+CONFIG_USB_MON=m
+CONFIG_USB_WUSB=m
+CONFIG_USB_WUSB_CBAF=m
+# CONFIG_USB_WUSB_CBAF_DEBUG is not set
+
+#
+# USB Host Controller Drivers
+#
+CONFIG_USB_C67X00_HCD=m
+CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_HCD_DEBUGGING is not set
+CONFIG_USB_EHCI_HCD=m
+# CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
+CONFIG_USB_OXU210HP_HCD=m
+CONFIG_USB_ISP116X_HCD=m
+CONFIG_USB_ISP1760_HCD=m
+CONFIG_USB_ISP1362_HCD=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_SSB=y
+# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
+# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+CONFIG_USB_UHCI_HCD=m
+CONFIG_USB_U132_HCD=m
+CONFIG_USB_SL811_HCD=m
+CONFIG_USB_SL811_CS=m
+CONFIG_USB_R8A66597_HCD=m
+CONFIG_USB_WHCI_HCD=m
+CONFIG_USB_HWA_HCD=m
+
+#
+# Enable Host or Gadget support to see Inventra options
+#
+
+#
+# USB Device Class drivers
+#
+CONFIG_USB_ACM=m
+CONFIG_USB_PRINTER=m
+CONFIG_USB_WDM=m
+CONFIG_USB_TMC=m
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+
+#
+# also be needed; see USB_STORAGE Help for more info
+#
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+CONFIG_USB_STORAGE_DATAFAB=m
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_LIBUSUAL=y
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+
+#
+# USB port drivers
+#
+CONFIG_USB_USS720=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_EZUSB=y
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_FUNSOFT=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_MOTOROLA=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_QCAUX=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_HP4X=m
+CONFIG_USB_SERIAL_SAFE=m
+CONFIG_USB_SERIAL_SAFE_PADDED=y
+CONFIG_USB_SERIAL_SIEMENS_MPI=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_VIVOPAY_SERIAL=m
+CONFIG_USB_SERIAL_DEBUG=m
+
+#
+# USB Miscellaneous drivers
+#
+CONFIG_USB_EMI62=m
+CONFIG_USB_EMI26=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_RIO500=m
+# CONFIG_USB_LEGOTOWER is not set
+CONFIG_USB_LCD=m
+CONFIG_USB_LED=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_FTDI_ELAN=m
+# CONFIG_USB_APPLEDISPLAY is not set
+CONFIG_USB_SISUSBVGA=m
+CONFIG_USB_SISUSBVGA_CON=y
+CONFIG_USB_LD=m
+# CONFIG_USB_TRANCEVIBRATOR is not set
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_TEST=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_ATM=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_XUSBATM=m
+# CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+CONFIG_USB_OTG_UTILS=y
+CONFIG_USB_GPIO_VBUS=m
+CONFIG_NOP_USB_XCEIV=m
+CONFIG_UWB=m
+CONFIG_UWB_HWA=m
+CONFIG_UWB_WHCI=m
+CONFIG_UWB_WLP=m
+CONFIG_UWB_I1480U=m
+CONFIG_UWB_I1480U_WLP=m
+CONFIG_MMC=m
+# CONFIG_MMC_DEBUG is not set
+# CONFIG_MMC_UNSAFE_RESUME is not set
+
+#
+# MMC/SD/SDIO Card Drivers
+#
+CONFIG_MMC_BLOCK=m
+CONFIG_MMC_BLOCK_BOUNCE=y
+CONFIG_SDIO_UART=m
+CONFIG_MMC_TEST=m
+
+#
+# MMC/SD/SDIO Host Controller Drivers
+#
+CONFIG_MMC_SDHCI=m
+CONFIG_MMC_SDHCI_PCI=m
+# CONFIG_MMC_RICOH_MMC is not set
+CONFIG_MMC_SDHCI_PLTFM=m
+CONFIG_MMC_WBSD=m
+CONFIG_MMC_TIFM_SD=m
+CONFIG_MMC_SDRICOH_CS=m
+CONFIG_MMC_CB710=m
+CONFIG_MMC_VIA_SDMMC=m
+CONFIG_MEMSTICK=m
+# CONFIG_MEMSTICK_DEBUG is not set
+
+#
+# MemoryStick drivers
+#
+# CONFIG_MEMSTICK_UNSAFE_RESUME is not set
+CONFIG_MSPRO_BLOCK=m
+
+#
+# MemoryStick Host Controller Drivers
+#
+CONFIG_MEMSTICK_TIFM_MS=m
+CONFIG_MEMSTICK_JMICRON_38X=m
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=m
+
+#
+# LED drivers
+#
+CONFIG_LEDS_NET48XX=m
+CONFIG_LEDS_WRAP=m
+CONFIG_LEDS_ALIX2=m
+CONFIG_LEDS_PCA9532=m
+CONFIG_LEDS_GPIO=m
+CONFIG_LEDS_GPIO_PLATFORM=y
+CONFIG_LEDS_LP3944=m
+CONFIG_LEDS_CLEVO_MAIL=m
+CONFIG_LEDS_PCA955X=m
+CONFIG_LEDS_DAC124S085=m
+CONFIG_LEDS_REGULATOR=m
+CONFIG_LEDS_BD2802=m
+CONFIG_LEDS_INTEL_SS4200=m
+CONFIG_LEDS_LT3593=m
+CONFIG_LEDS_DELL_NETBOOKS=m
+CONFIG_LEDS_TRIGGERS=y
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGER_TIMER=m
+CONFIG_LEDS_TRIGGER_HEARTBEAT=m
+CONFIG_LEDS_TRIGGER_BACKLIGHT=m
+CONFIG_LEDS_TRIGGER_GPIO=m
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
+
+#
+# iptables trigger is under Netfilter config (LED target)
+#
+CONFIG_ACCESSIBILITY=y
+# CONFIG_A11Y_BRAILLE_CONSOLE is not set
+CONFIG_INFINIBAND=m
+CONFIG_INFINIBAND_USER_MAD=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_USER_MEM=y
+CONFIG_INFINIBAND_ADDR_TRANS=y
+CONFIG_INFINIBAND_MTHCA=m
+# CONFIG_INFINIBAND_MTHCA_DEBUG is not set
+CONFIG_INFINIBAND_AMSO1100=m
+# CONFIG_INFINIBAND_AMSO1100_DEBUG is not set
+CONFIG_INFINIBAND_CXGB3=m
+# CONFIG_INFINIBAND_CXGB3_DEBUG is not set
+CONFIG_MLX4_INFINIBAND=m
+CONFIG_INFINIBAND_NES=m
+# CONFIG_INFINIBAND_NES_DEBUG is not set
+CONFIG_INFINIBAND_IPOIB=m
+# CONFIG_INFINIBAND_IPOIB_CM is not set
+# CONFIG_INFINIBAND_IPOIB_DEBUG is not set
+CONFIG_INFINIBAND_SRP=m
+CONFIG_INFINIBAND_ISER=m
+# CONFIG_EDAC is not set
+CONFIG_RTC_LIB=m
+CONFIG_RTC_CLASS=m
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+CONFIG_RTC_INTF_DEV_UIE_EMUL=y
+CONFIG_RTC_DRV_TEST=m
+
+#
+# I2C RTC drivers
+#
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_M41T80_WDT=y
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+
+#
+# SPI RTC drivers
+#
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_DS3234=m
+CONFIG_RTC_DRV_PCF2123=m
+
+#
+# Platform RTC drivers
+#
+CONFIG_RTC_DRV_CMOS=m
+CONFIG_RTC_DRV_DS1286=m
+CONFIG_RTC_DRV_DS1511=m
+CONFIG_RTC_DRV_DS1553=m
+CONFIG_RTC_DRV_DS1742=m
+CONFIG_RTC_DRV_STK17TA8=m
+CONFIG_RTC_DRV_M48T86=m
+CONFIG_RTC_DRV_M48T35=m
+CONFIG_RTC_DRV_M48T59=m
+CONFIG_RTC_DRV_MSM6242=m
+CONFIG_RTC_DRV_BQ4802=m
+CONFIG_RTC_DRV_RP5C01=m
+CONFIG_RTC_DRV_V3020=m
+CONFIG_RTC_DRV_PCF50633=m
+
+#
+# on-CPU RTC drivers
+#
+CONFIG_DMADEVICES=y
+# CONFIG_DMADEVICES_DEBUG is not set
+
+#
+# DMA Devices
+#
+CONFIG_ASYNC_TX_DISABLE_CHANNEL_SWITCH=y
+CONFIG_INTEL_IOATDMA=m
+CONFIG_DMA_ENGINE=y
+
+#
+# DMA Clients
+#
+CONFIG_NET_DMA=y
+# CONFIG_ASYNC_TX_DMA is not set
+CONFIG_DMATEST=m
+CONFIG_DCA=m
+CONFIG_AUXDISPLAY=y
+CONFIG_KS0108=m
+CONFIG_KS0108_PORT=0x378
+CONFIG_KS0108_DELAY=2
+CONFIG_CFAG12864B=m
+CONFIG_CFAG12864B_RATE=20
+CONFIG_UIO=m
+CONFIG_UIO_CIF=m
+CONFIG_UIO_PDRV=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_UIO_AEC=m
+CONFIG_UIO_SERCOS3=m
+# CONFIG_UIO_PCI_GENERIC is not set
+CONFIG_UIO_NETX=m
+
+#
+# TI VLYNQ
+#
+
+#
+# Xen driver support
+#
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_SCRUB_PAGES=y
+CONFIG_XEN_DEV_EVTCHN=y
+CONFIG_XENFS=y
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_SYS_HYPERVISOR=y
+# CONFIG_STAGING is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+CONFIG_ACER_WMI=m
+CONFIG_ASUS_LAPTOP=m
+CONFIG_DELL_LAPTOP=m
+CONFIG_DELL_WMI=m
+CONFIG_FUJITSU_LAPTOP=m
+# CONFIG_FUJITSU_LAPTOP_DEBUG is not set
+CONFIG_TC1100_WMI=m
+CONFIG_HP_WMI=m
+CONFIG_MSI_LAPTOP=m
+CONFIG_PANASONIC_LAPTOP=m
+CONFIG_COMPAL_LAPTOP=m
+CONFIG_SONY_LAPTOP=m
+# CONFIG_SONYPI_COMPAT is not set
+CONFIG_THINKPAD_ACPI=m
+CONFIG_THINKPAD_ACPI_ALSA_SUPPORT=y
+# CONFIG_THINKPAD_ACPI_DEBUGFACILITIES is not set
+# CONFIG_THINKPAD_ACPI_DEBUG is not set
+# CONFIG_THINKPAD_ACPI_UNSAFE_LEDS is not set
+CONFIG_THINKPAD_ACPI_VIDEO=y
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL=y
+CONFIG_INTEL_MENLOW=m
+CONFIG_EEEPC_LAPTOP=m
+CONFIG_EEEPC_WMI=m
+CONFIG_ACPI_WMI=m
+CONFIG_MSI_WMI=m
+CONFIG_ACPI_ASUS=m
+# CONFIG_TOPSTAR_LAPTOP is not set
+CONFIG_ACPI_TOSHIBA=m
+CONFIG_TOSHIBA_BT_RFKILL=m
+CONFIG_ACPI_CMPC=m
+
+#
+# Firmware Drivers
+#
+CONFIG_EDD=m
+# CONFIG_EDD_OFF is not set
+CONFIG_FIRMWARE_MEMMAP=y
+CONFIG_DELL_RBU=m
+CONFIG_DCDBAS=m
+CONFIG_DMIID=y
+# CONFIG_ISCSI_IBFT_FIND is not set
+
+#
+# File systems
+#
+CONFIG_EXT2_FS=m
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT2_FS_XIP=y
+CONFIG_EXT3_FS=m
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT3_FS_XATTR=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS=m
+CONFIG_EXT4_FS_XATTR=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+# CONFIG_EXT4_DEBUG is not set
+CONFIG_FS_XIP=y
+CONFIG_JBD=m
+# CONFIG_JBD_DEBUG is not set
+CONFIG_JBD2=m
+# CONFIG_JBD2_DEBUG is not set
+CONFIG_FS_MBCACHE=m
+CONFIG_REISERFS_FS=m
+# CONFIG_REISERFS_CHECK is not set
+CONFIG_REISERFS_PROC_INFO=y
+CONFIG_REISERFS_FS_XATTR=y
+CONFIG_REISERFS_FS_POSIX_ACL=y
+# CONFIG_REISERFS_FS_SECURITY is not set
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+# CONFIG_JFS_DEBUG is not set
+CONFIG_JFS_STATISTICS=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_XFS_FS=m
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_RT=y
+# CONFIG_XFS_DEBUG is not set
+CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
+CONFIG_OCFS2_FS=m
+CONFIG_OCFS2_FS_O2CB=m
+CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+CONFIG_OCFS2_FS_STATS=y
+CONFIG_OCFS2_DEBUG_MASKLOG=y
+# CONFIG_OCFS2_DEBUG_FS is not set
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
+# CONFIG_DNOTIFY is not set
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
+CONFIG_QUOTA=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+# CONFIG_PRINT_QUOTA_WARNING is not set
+# CONFIG_QUOTA_DEBUG is not set
+CONFIG_QUOTA_TREE=m
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_QUOTACTL=y
+CONFIG_AUTOFS_FS=m
+CONFIG_AUTOFS4_FS=m
+CONFIG_FUSE_FS=m
+# CONFIG_CUSE is not set
+
+#
+# Caches
+#
+CONFIG_FSCACHE=m
+CONFIG_FSCACHE_STATS=y
+CONFIG_FSCACHE_HISTOGRAM=y
+# CONFIG_FSCACHE_DEBUG is not set
+# CONFIG_FSCACHE_OBJECT_LIST is not set
+CONFIG_CACHEFILES=m
+# CONFIG_CACHEFILES_DEBUG is not set
+# CONFIG_CACHEFILES_HISTOGRAM is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
+
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=m
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+CONFIG_NTFS_FS=m
+# CONFIG_NTFS_DEBUG is not set
+CONFIG_NTFS_RW=y
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+CONFIG_CONFIGFS_FS=m
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+CONFIG_ECRYPT_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HFSPLUS_FS=m
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+CONFIG_EFS_FS=m
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_SUMMARY=y
+CONFIG_JFFS2_FS_XATTR=y
+CONFIG_JFFS2_FS_POSIX_ACL=y
+CONFIG_JFFS2_FS_SECURITY=y
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_ZLIB=y
+CONFIG_JFFS2_LZO=y
+CONFIG_JFFS2_RTIME=y
+CONFIG_JFFS2_RUBIN=y
+# CONFIG_JFFS2_CMODE_NONE is not set
+CONFIG_JFFS2_CMODE_PRIORITY=y
+# CONFIG_JFFS2_CMODE_SIZE is not set
+# CONFIG_JFFS2_CMODE_FAVOURLZO is not set
+CONFIG_UBIFS_FS=m
+# CONFIG_UBIFS_FS_XATTR is not set
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_ZLIB=y
+# CONFIG_UBIFS_FS_DEBUG is not set
+CONFIG_LOGFS=m
+CONFIG_CRAMFS=m
+CONFIG_SQUASHFS=m
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+# CONFIG_VXFS_FS is not set
+CONFIG_MINIX_FS=m
+CONFIG_OMFS_FS=m
+CONFIG_HPFS_FS=m
+# CONFIG_QNX4FS_FS is not set
+CONFIG_ROMFS_FS=m
+CONFIG_ROMFS_BACKED_BY_BLOCK=y
+# CONFIG_ROMFS_BACKED_BY_MTD is not set
+# CONFIG_ROMFS_BACKED_BY_BOTH is not set
+CONFIG_ROMFS_ON_BLOCK=y
+CONFIG_SYSV_FS=m
+CONFIG_UFS_FS=m
+# CONFIG_UFS_FS_WRITE is not set
+# CONFIG_UFS_DEBUG is not set
+CONFIG_EXOFS_FS=m
+# CONFIG_EXOFS_DEBUG is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NFS_FS=m
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
+CONFIG_NFS_V4=y
+# CONFIG_NFS_V4_1 is not set
+# CONFIG_NFS_FSCACHE is not set
+CONFIG_NFSD=m
+CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
+CONFIG_NFSD_V4=y
+CONFIG_LOCKD=m
+CONFIG_LOCKD_V4=y
+CONFIG_EXPORTFS=m
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=m
+CONFIG_SUNRPC_GSS=m
+CONFIG_SUNRPC_XPRT_RDMA=m
+CONFIG_RPCSEC_GSS_KRB5=m
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
+# CONFIG_SMB_FS is not set
+CONFIG_CEPH_FS=m
+# CONFIG_CEPH_FS_PRETTYDEBUG is not set
+CONFIG_CIFS=m
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
+# CONFIG_CIFS_UPCALL is not set
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_DEBUG2 is not set
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_EXPERIMENTAL=y
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
+
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+CONFIG_NLS=m
+CONFIG_NLS_DEFAULT="iso8859-1"
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+CONFIG_DLM=m
+# CONFIG_DLM_DEBUG is not set
+
+#
+# Kernel hacking
+#
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_FRAME_WARN=1024
+# CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_DEBUG_KERNEL is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+# CONFIG_DEBUG_MEMORY_INIT is not set
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_FRAME_POINTER=y
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+CONFIG_LKDTM=m
+# CONFIG_LATENCYTOP is not set
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_RING_BUFFER=y
+CONFIG_RING_BUFFER_ALLOW_SWAP=y
+CONFIG_TRACING_SUPPORT=y
+# CONFIG_FTRACE is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+# CONFIG_FIREWIRE_OHCI_REMOTE_DMA is not set
+# CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_DMA_API_DEBUG is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_KMEMCHECK=y
+CONFIG_STRICT_DEVMEM=y
+# CONFIG_X86_VERBOSE_BOOTUP is not set
+# CONFIG_EARLY_PRINTK is not set
+# CONFIG_4KSTACKS is not set
+# CONFIG_DOUBLEFAULT is not set
+# CONFIG_IOMMU_STRESS is not set
+CONFIG_HAVE_MMIOTRACE_SUPPORT=y
+CONFIG_IO_DELAY_TYPE_0X80=0
+CONFIG_IO_DELAY_TYPE_0XED=1
+CONFIG_IO_DELAY_TYPE_UDELAY=2
+CONFIG_IO_DELAY_TYPE_NONE=3
+CONFIG_IO_DELAY_0X80=y
+# CONFIG_IO_DELAY_0XED is not set
+# CONFIG_IO_DELAY_UDELAY is not set
+# CONFIG_IO_DELAY_NONE is not set
+CONFIG_DEFAULT_IO_DELAY_TYPE=0
+# CONFIG_OPTIMIZE_INLINING is not set
+
+#
+# Security options
+#
+CONFIG_KEYS=y
+# CONFIG_KEYS_DEBUG_PROC_KEYS is not set
+CONFIG_SECURITY=y
+CONFIG_SECURITYFS=y
+# CONFIG_SECURITY_NETWORK is not set
+# CONFIG_SECURITY_PATH is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_IMA is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_XOR_BLOCKS=m
+CONFIG_ASYNC_CORE=m
+CONFIG_ASYNC_MEMCPY=m
+CONFIG_ASYNC_XOR=m
+CONFIG_ASYNC_PQ=m
+CONFIG_ASYNC_RAID6_RECOV=m
+CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA=y
+CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA=y
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_FIPS=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_MANAGER=m
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_GF128MUL=m
+CONFIG_CRYPTO_NULL=m
+CONFIG_CRYPTO_PCRYPT=m
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_AUTHENC=m
+CONFIG_CRYPTO_TEST=m
+
+#
+# Authenticated Encryption with Associated Data
+#
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_GCM=m
+CONFIG_CRYPTO_SEQIV=m
+
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CTR=m
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_LRW=m
+CONFIG_CRYPTO_PCBC=m
+CONFIG_CRYPTO_XTS=m
+
+#
+# Hash modes
+#
+CONFIG_CRYPTO_HMAC=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_VMAC=m
+
+#
+# Digest
+#
+CONFIG_CRYPTO_CRC32C=m
+CONFIG_CRYPTO_CRC32C_INTEL=m
+CONFIG_CRYPTO_GHASH=m
+CONFIG_CRYPTO_MD4=m
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
+CONFIG_CRYPTO_SHA1=m
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_WP512=m
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_AES_586=m
+CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_ARC4=m
+CONFIG_CRYPTO_BLOWFISH=m
+CONFIG_CRYPTO_CAMELLIA=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_CAST6=m
+CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_FCRYPT=m
+CONFIG_CRYPTO_KHAZAD=m
+CONFIG_CRYPTO_SALSA20=m
+CONFIG_CRYPTO_SALSA20_586=m
+CONFIG_CRYPTO_SEED=m
+CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_TEA=m
+CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_TWOFISH_COMMON=m
+CONFIG_CRYPTO_TWOFISH_586=m
+
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=m
+CONFIG_CRYPTO_ZLIB=m
+CONFIG_CRYPTO_LZO=m
+
+#
+# Random Number Generation
+#
+CONFIG_CRYPTO_ANSI_CPRNG=m
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_DEV_PADLOCK=m
+CONFIG_CRYPTO_DEV_PADLOCK_AES=m
+CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
+CONFIG_CRYPTO_DEV_GEODE=m
+CONFIG_CRYPTO_DEV_HIFN_795X=m
+CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y
+CONFIG_HAVE_KVM=y
+CONFIG_HAVE_KVM_IRQCHIP=y
+CONFIG_HAVE_KVM_EVENTFD=y
+CONFIG_KVM_APIC_ARCHITECTURE=y
+CONFIG_KVM_MMIO=y
+CONFIG_VIRTUALIZATION=y
+CONFIG_KVM=m
+CONFIG_KVM_INTEL=m
+CONFIG_KVM_AMD=m
+CONFIG_VHOST_NET=m
+CONFIG_LGUEST=m
+CONFIG_VIRTIO=y
+CONFIG_VIRTIO_RING=y
+CONFIG_VIRTIO_PCI=m
+CONFIG_VIRTIO_BALLOON=m
+# CONFIG_BINARY_PRINTF is not set
+
+#
+# Library routines
+#
+CONFIG_BITREVERSE=m
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
+CONFIG_CRC_CCITT=m
+CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=m
+CONFIG_CRC_ITU_T=m
+CONFIG_CRC32=m
+CONFIG_CRC7=m
+CONFIG_LIBCRC32C=m
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=m
+CONFIG_LZO_COMPRESS=m
+CONFIG_LZO_DECOMPRESS=m
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_LZMA=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_REED_SOLOMON=m
+CONFIG_REED_SOLOMON_DEC16=y
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_KMP=m
+CONFIG_TEXTSEARCH_BM=m
+CONFIG_TEXTSEARCH_FSM=m
+CONFIG_BTREE=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
+CONFIG_CHECK_SIGNATURE=y
+CONFIG_NLATTR=y
+CONFIG_LRU_CACHE=m
diff --git a/testing/linux-scst/put_page_callback-2.6.34.patch b/testing/linux-scst/put_page_callback-2.6.34.patch
new file mode 100644
index 00000000..97d6f7f0
--- /dev/null
+++ b/testing/linux-scst/put_page_callback-2.6.34.patch
@@ -0,0 +1,390 @@
+diff -upkr linux-2.6.34/include/linux/mm_types.h linux-2.6.34/include/linux/mm_types.h
+--- linux-2.6.34/include/linux/mm_types.h	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/include/linux/mm_types.h	2010-05-24 14:51:40.000000000 +0400
+@@ -100,6 +100,18 @@ struct page {
+ 	 */
+ 	void *shadow;
+ #endif
++
++#if defined(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION)
++	/*
++	 * Used to implement support for notification on zero-copy TCP transfer
++	 * completion. It might look as not good to have this field here and
++	 * it's better to have it in struct sk_buff, but it would make the code
++	 * much more complicated and fragile, since all skb then would have to
++	 * contain only pages with the same value in this field.
++	 */
++	 void *net_priv;
++#endif
++
+ };
+ 
+ /*
+diff -upkr linux-2.6.34/include/linux/net.h linux-2.6.34/include/linux/net.h
+--- linux-2.6.34/include/linux/net.h	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/include/linux/net.h	2010-05-24 14:51:40.000000000 +0400
+@@ -20,6 +20,7 @@
+ 
+ #include <linux/socket.h>
+ #include <asm/socket.h>
++#include <linux/mm.h>
+ 
+ #define NPROTO		AF_MAX
+ 
+@@ -288,5 +289,44 @@ extern int kernel_sock_shutdown(struct s
+ extern struct ratelimit_state net_ratelimit_state;
+ #endif
+ 
++#if defined(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION)
++/* Support for notification on zero-copy TCP transfer completion */
++typedef void (*net_get_page_callback_t)(struct page *page);
++typedef void (*net_put_page_callback_t)(struct page *page);
++
++extern net_get_page_callback_t net_get_page_callback;
++extern net_put_page_callback_t net_put_page_callback;
++
++extern int net_set_get_put_page_callbacks(
++	net_get_page_callback_t get_callback,
++	net_put_page_callback_t put_callback);
++
++/*
++ * See comment for net_set_get_put_page_callbacks() why those functions
++ * don't need any protection.
++ */
++static inline void net_get_page(struct page *page)
++{
++	if (page->net_priv != 0)
++		net_get_page_callback(page);
++	get_page(page);
++}
++static inline void net_put_page(struct page *page)
++{
++	if (page->net_priv != 0)
++		net_put_page_callback(page);
++	put_page(page);
++}
++#else
++static inline void net_get_page(struct page *page)
++{
++	get_page(page);
++}
++static inline void net_put_page(struct page *page)
++{
++	put_page(page);
++}
++#endif /* CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION */
++
+ #endif /* __KERNEL__ */
+ #endif	/* _LINUX_NET_H */
+diff -upkr linux-2.6.34/net/core/dev.c linux-2.6.34/net/core/dev.c
+--- linux-2.6.34/net/core/dev.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/core/dev.c	2010-05-24 14:51:40.000000000 +0400
+@@ -2732,7 +2732,7 @@ pull:
+ 		skb_shinfo(skb)->frags[0].size -= grow;
+ 
+ 		if (unlikely(!skb_shinfo(skb)->frags[0].size)) {
+-			put_page(skb_shinfo(skb)->frags[0].page);
++			net_put_page(skb_shinfo(skb)->frags[0].page);
+ 			memmove(skb_shinfo(skb)->frags,
+ 				skb_shinfo(skb)->frags + 1,
+ 				--skb_shinfo(skb)->nr_frags);
+diff -upkr linux-2.6.34/net/core/skbuff.c linux-2.6.34/net/core/skbuff.c
+--- linux-2.6.34/net/core/skbuff.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/core/skbuff.c	2010-05-24 14:51:40.000000000 +0400
+@@ -76,13 +76,13 @@ static struct kmem_cache *skbuff_fclone_
+ static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
+ 				  struct pipe_buffer *buf)
+ {
+-	put_page(buf->page);
++	net_put_page(buf->page);
+ }
+ 
+ static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
+ 				struct pipe_buffer *buf)
+ {
+-	get_page(buf->page);
++	net_get_page(buf->page);
+ }
+ 
+ static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
+@@ -344,7 +344,7 @@ static void skb_release_data(struct sk_b
+ 		if (skb_shinfo(skb)->nr_frags) {
+ 			int i;
+ 			for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+-				put_page(skb_shinfo(skb)->frags[i].page);
++				net_put_page(skb_shinfo(skb)->frags[i].page);
+ 		}
+ 
+ 		if (skb_has_frags(skb))
+@@ -765,7 +765,7 @@ struct sk_buff *pskb_copy(struct sk_buff
+ 
+ 		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 			skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
+-			get_page(skb_shinfo(n)->frags[i].page);
++			net_get_page(skb_shinfo(n)->frags[i].page);
+ 		}
+ 		skb_shinfo(n)->nr_frags = i;
+ 	}
+@@ -831,7 +831,7 @@ int pskb_expand_head(struct sk_buff *skb
+ 	       sizeof(struct skb_shared_info));
+ 
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+-		get_page(skb_shinfo(skb)->frags[i].page);
++		net_get_page(skb_shinfo(skb)->frags[i].page);
+ 
+ 	if (skb_has_frags(skb))
+ 		skb_clone_fraglist(skb);
+@@ -1105,7 +1105,7 @@ drop_pages:
+ 		skb_shinfo(skb)->nr_frags = i;
+ 
+ 		for (; i < nfrags; i++)
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 
+ 		if (skb_has_frags(skb))
+ 			skb_drop_fraglist(skb);
+@@ -1274,7 +1274,7 @@ pull_pages:
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 		if (skb_shinfo(skb)->frags[i].size <= eat) {
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 			eat -= skb_shinfo(skb)->frags[i].size;
+ 		} else {
+ 			skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+@@ -1375,7 +1375,7 @@ EXPORT_SYMBOL(skb_copy_bits);
+  */
+ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
+ {
+-	put_page(spd->pages[i]);
++	net_put_page(spd->pages[i]);
+ }
+ 
+ static inline struct page *linear_to_page(struct page *page, unsigned int *len,
+@@ -1399,7 +1399,7 @@ new_page:
+ 		off = sk->sk_sndmsg_off;
+ 		mlen = PAGE_SIZE - off;
+ 		if (mlen < 64 && mlen < *len) {
+-			put_page(p);
++			net_put_page(p);
+ 			goto new_page;
+ 		}
+ 
+@@ -1409,7 +1409,7 @@ new_page:
+ 	memcpy(page_address(p) + off, page_address(page) + *offset, *len);
+ 	sk->sk_sndmsg_off += *len;
+ 	*offset = off;
+-	get_page(p);
++	net_get_page(p);
+ 
+ 	return p;
+ }
+@@ -1430,7 +1430,7 @@ static inline int spd_fill_page(struct s
+ 		if (!page)
+ 			return 1;
+ 	} else
+-		get_page(page);
++		net_get_page(page);
+ 
+ 	spd->pages[spd->nr_pages] = page;
+ 	spd->partial[spd->nr_pages].len = *len;
+@@ -2060,7 +2060,7 @@ static inline void skb_split_no_header(s
+ 				 *    where splitting is expensive.
+ 				 * 2. Split is accurately. We make this.
+ 				 */
+-				get_page(skb_shinfo(skb)->frags[i].page);
++				net_get_page(skb_shinfo(skb)->frags[i].page);
+ 				skb_shinfo(skb1)->frags[0].page_offset += len - pos;
+ 				skb_shinfo(skb1)->frags[0].size -= len - pos;
+ 				skb_shinfo(skb)->frags[i].size	= len - pos;
+@@ -2182,7 +2182,7 @@ int skb_shift(struct sk_buff *tgt, struc
+ 			to++;
+ 
+ 		} else {
+-			get_page(fragfrom->page);
++			net_get_page(fragfrom->page);
+ 			fragto->page = fragfrom->page;
+ 			fragto->page_offset = fragfrom->page_offset;
+ 			fragto->size = todo;
+@@ -2204,7 +2204,7 @@ int skb_shift(struct sk_buff *tgt, struc
+ 		fragto = &skb_shinfo(tgt)->frags[merge];
+ 
+ 		fragto->size += fragfrom->size;
+-		put_page(fragfrom->page);
++		net_put_page(fragfrom->page);
+ 	}
+ 
+ 	/* Reposition in the original skb */
+@@ -2602,7 +2602,7 @@ struct sk_buff *skb_segment(struct sk_bu
+ 
+ 		while (pos < offset + len && i < nfrags) {
+ 			*frag = skb_shinfo(skb)->frags[i];
+-			get_page(frag->page);
++			net_get_page(frag->page);
+ 			size = frag->size;
+ 
+ 			if (pos < offset) {
+diff -upkr linux-2.6.34/net/ipv4/ip_output.c linux-2.6.34/net/ipv4/ip_output.c
+--- linux-2.6.34/net/ipv4/ip_output.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/ipv4/ip_output.c	2010-05-24 14:51:40.000000000 +0400
+@@ -1024,7 +1024,7 @@ alloc_new_skb:
+ 						err = -EMSGSIZE;
+ 						goto error;
+ 					}
+-					get_page(page);
++					net_get_page(page);
+ 					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+ 					frag = &skb_shinfo(skb)->frags[i];
+ 				}
+@@ -1182,7 +1182,7 @@ ssize_t	ip_append_page(struct sock *sk, 
+ 		if (skb_can_coalesce(skb, i, page, offset)) {
+ 			skb_shinfo(skb)->frags[i-1].size += len;
+ 		} else if (i < MAX_SKB_FRAGS) {
+-			get_page(page);
++			net_get_page(page);
+ 			skb_fill_page_desc(skb, i, page, offset, len);
+ 		} else {
+ 			err = -EMSGSIZE;
+diff -upkr linux-2.6.34/net/ipv4/Makefile linux-2.6.34/net/ipv4/Makefile
+--- linux-2.6.34/net/ipv4/Makefile	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/ipv4/Makefile	2010-05-24 14:51:40.000000000 +0400
+@@ -49,6 +49,7 @@ obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o
+ obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
+ obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
+ obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
++obj-$(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION) += tcp_zero_copy.o
+ 
+ obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
+ 		      xfrm4_output.o
+diff -upkr linux-2.6.34/net/ipv4/tcp.c linux-2.6.34/net/ipv4/tcp.c
+--- linux-2.6.34/net/ipv4/tcp.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/ipv4/tcp.c	2010-05-24 14:51:40.000000000 +0400
+@@ -800,7 +800,7 @@ new_segment:
+ 		if (can_coalesce) {
+ 			skb_shinfo(skb)->frags[i - 1].size += copy;
+ 		} else {
+-			get_page(page);
++			net_get_page(page);
+ 			skb_fill_page_desc(skb, i, page, offset, copy);
+ 		}
+ 
+@@ -1009,7 +1009,7 @@ new_segment:
+ 					goto new_segment;
+ 				} else if (page) {
+ 					if (off == PAGE_SIZE) {
+-						put_page(page);
++						net_put_page(page);
+ 						TCP_PAGE(sk) = page = NULL;
+ 						off = 0;
+ 					}
+@@ -1050,9 +1050,9 @@ new_segment:
+ 				} else {
+ 					skb_fill_page_desc(skb, i, page, off, copy);
+ 					if (TCP_PAGE(sk)) {
+-						get_page(page);
++						net_get_page(page);
+ 					} else if (off + copy < PAGE_SIZE) {
+-						get_page(page);
++						net_get_page(page);
+ 						TCP_PAGE(sk) = page;
+ 					}
+ 				}
+diff -upkr linux-2.6.34/net/ipv4/tcp_output.c linux-2.6.34/net/ipv4/tcp_output.c
+--- linux-2.6.34/net/ipv4/tcp_output.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/ipv4/tcp_output.c	2010-05-24 14:51:40.000000000 +0400
+@@ -1084,7 +1084,7 @@ static void __pskb_trim_head(struct sk_b
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 		if (skb_shinfo(skb)->frags[i].size <= eat) {
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 			eat -= skb_shinfo(skb)->frags[i].size;
+ 		} else {
+ 			skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+diff -upkr linux-2.6.34/net/ipv4/tcp_zero_copy.c linux-2.6.34/net/ipv4/tcp_zero_copy.c
+--- linux-2.6.34/net/ipv4/tcp_zero_copy.c	2010-03-01 17:30:31.000000000 +0300
++++ linux-2.6.34/net/ipv4/tcp_zero_copy.c	2010-05-24 14:51:40.000000000 +0400
+@@ -0,0 +1,49 @@
++/*
++ *	Support routines for TCP zero copy transmit
++ *
++ *	Created by Vladislav Bolkhovitin
++ *
++ *	This program is free software; you can redistribute it and/or
++ *      modify it under the terms of the GNU General Public License
++ *      version 2 as published by the Free Software Foundation.
++ */
++
++#include <linux/skbuff.h>
++
++net_get_page_callback_t net_get_page_callback __read_mostly;
++EXPORT_SYMBOL(net_get_page_callback);
++
++net_put_page_callback_t net_put_page_callback __read_mostly;
++EXPORT_SYMBOL(net_put_page_callback);
++
++/*
++ * Caller of this function must ensure that at the moment when it's called
++ * there are no pages in the system with net_priv field set to non-zero
++ * value. Hence, this function, as well as net_get_page() and net_put_page(),
++ * don't need any protection.
++ */
++int net_set_get_put_page_callbacks(
++	net_get_page_callback_t get_callback,
++	net_put_page_callback_t put_callback)
++{
++	int res = 0;
++
++	if ((net_get_page_callback != NULL) && (get_callback != NULL) &&
++	    (net_get_page_callback != get_callback)) {
++		res = -EBUSY;
++		goto out;
++	}
++
++	if ((net_put_page_callback != NULL) && (put_callback != NULL) &&
++	    (net_put_page_callback != put_callback)) {
++		res = -EBUSY;
++		goto out;
++	}
++
++	net_get_page_callback = get_callback;
++	net_put_page_callback = put_callback;
++
++out:
++	return res;
++}
++EXPORT_SYMBOL(net_set_get_put_page_callbacks);
+diff -upkr linux-2.6.34/net/ipv6/ip6_output.c linux-2.6.34/net/ipv6/ip6_output.c
+--- linux-2.6.34/net/ipv6/ip6_output.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/ipv6/ip6_output.c	2010-05-24 14:51:40.000000000 +0400
+@@ -1382,7 +1382,7 @@ alloc_new_skb:
+ 						err = -EMSGSIZE;
+ 						goto error;
+ 					}
+-					get_page(page);
++					net_get_page(page);
+ 					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+ 					frag = &skb_shinfo(skb)->frags[i];
+ 				}
+diff -upkr linux-2.6.34/net/Kconfig linux-2.6.34/net/Kconfig
+--- linux-2.6.34/net/Kconfig	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/net/Kconfig	2010-05-24 14:51:40.000000000 +0400
+@@ -72,6 +72,18 @@ config INET
+ 
+ 	  Short answer: say Y.
+ 
++config TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION
++	bool "TCP/IP zero-copy transfer completion notification"
++        depends on INET
++        default SCST_ISCSI
++	---help---
++	  Adds support for sending a notification upon completion of a
++          zero-copy TCP/IP transfer. This can speed up certain TCP/IP
++          software. Currently this is only used by the iSCSI target driver
++          iSCSI-SCST.
++
++          If unsure, say N.
++
+ if INET
+ source "net/ipv4/Kconfig"
+ source "net/ipv6/Kconfig"
diff --git a/testing/linux-scst/scst_exec_req_fifo-2.6.34.patch b/testing/linux-scst/scst_exec_req_fifo-2.6.34.patch
new file mode 100644
index 00000000..3a734bb6
--- /dev/null
+++ b/testing/linux-scst/scst_exec_req_fifo-2.6.34.patch
@@ -0,0 +1,529 @@
+diff -upkr linux-2.6.34/block/blk-map.c linux-2.6.34/block/blk-map.c
+--- linux-2.6.34/block/blk-map.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/block/blk-map.c	2010-05-24 15:19:49.000000000 +0400
+@@ -5,6 +5,8 @@
+ #include <linux/module.h>
+ #include <linux/bio.h>
+ #include <linux/blkdev.h>
++#include <linux/scatterlist.h>
++#include <linux/slab.h>
+ #include <scsi/sg.h>		/* for struct sg_iovec */
+ 
+ #include "blk.h"
+@@ -271,6 +273,336 @@ int blk_rq_unmap_user(struct bio *bio)
+ }
+ EXPORT_SYMBOL(blk_rq_unmap_user);
+ 
++struct blk_kern_sg_work {
++	atomic_t bios_inflight;
++	struct sg_table sg_table;
++	struct scatterlist *src_sgl;
++};
++
++static void blk_free_kern_sg_work(struct blk_kern_sg_work *bw)
++{
++	sg_free_table(&bw->sg_table);
++	kfree(bw);
++	return;
++}
++
++static void blk_bio_map_kern_endio(struct bio *bio, int err)
++{
++	struct blk_kern_sg_work *bw = bio->bi_private;
++
++	if (bw != NULL) {
++		/* Decrement the bios in processing and, if zero, free */
++		BUG_ON(atomic_read(&bw->bios_inflight) <= 0);
++		if (atomic_dec_and_test(&bw->bios_inflight)) {
++			if ((bio_data_dir(bio) == READ) && (err == 0)) {
++				unsigned long flags;
++
++				local_irq_save(flags);	/* to protect KMs */
++				sg_copy(bw->src_sgl, bw->sg_table.sgl, 0, 0,
++					KM_BIO_DST_IRQ, KM_BIO_SRC_IRQ);
++				local_irq_restore(flags);
++			}
++			blk_free_kern_sg_work(bw);
++		}
++	}
++
++	bio_put(bio);
++	return;
++}
++
++static int blk_rq_copy_kern_sg(struct request *rq, struct scatterlist *sgl,
++			       int nents, struct blk_kern_sg_work **pbw,
++			       gfp_t gfp, gfp_t page_gfp)
++{
++	int res = 0, i;
++	struct scatterlist *sg;
++	struct scatterlist *new_sgl;
++	int new_sgl_nents;
++	size_t len = 0, to_copy;
++	struct blk_kern_sg_work *bw;
++
++	bw = kzalloc(sizeof(*bw), gfp);
++	if (bw == NULL)
++		goto out;
++
++	bw->src_sgl = sgl;
++
++	for_each_sg(sgl, sg, nents, i)
++		len += sg->length;
++	to_copy = len;
++
++	new_sgl_nents = PFN_UP(len);
++
++	res = sg_alloc_table(&bw->sg_table, new_sgl_nents, gfp);
++	if (res != 0)
++		goto out_free_bw;
++
++	new_sgl = bw->sg_table.sgl;
++
++	for_each_sg(new_sgl, sg, new_sgl_nents, i) {
++		struct page *pg;
++
++		pg = alloc_page(page_gfp);
++		if (pg == NULL)
++			goto err_free_new_sgl;
++
++		sg_assign_page(sg, pg);
++		sg->length = min_t(size_t, PAGE_SIZE, len);
++
++		len -= PAGE_SIZE;
++	}
++
++	if (rq_data_dir(rq) == WRITE) {
++		/*
++		 * We need to limit amount of copied data to to_copy, because
++		 * sgl might have the last element in sgl not marked as last in
++		 * SG chaining.
++		 */
++		sg_copy(new_sgl, sgl, 0, to_copy,
++			KM_USER0, KM_USER1);
++	}
++
++	*pbw = bw;
++	/*
++	 * REQ_COPY_USER name is misleading. It should be something like
++	 * REQ_HAS_TAIL_SPACE_FOR_PADDING.
++	 */
++	rq->cmd_flags |= REQ_COPY_USER;
++
++out:
++	return res;
++
++err_free_new_sgl:
++	for_each_sg(new_sgl, sg, new_sgl_nents, i) {
++		struct page *pg = sg_page(sg);
++		if (pg == NULL)
++			break;
++		__free_page(pg);
++	}
++	sg_free_table(&bw->sg_table);
++
++out_free_bw:
++	kfree(bw);
++	res = -ENOMEM;
++	goto out;
++}
++
++static int __blk_rq_map_kern_sg(struct request *rq, struct scatterlist *sgl,
++	int nents, struct blk_kern_sg_work *bw, gfp_t gfp)
++{
++	int res;
++	struct request_queue *q = rq->q;
++	int rw = rq_data_dir(rq);
++	int max_nr_vecs, i;
++	size_t tot_len;
++	bool need_new_bio;
++	struct scatterlist *sg, *prev_sg = NULL;
++	struct bio *bio = NULL, *hbio = NULL, *tbio = NULL;
++	int bios;
++
++	if (unlikely((sgl == NULL) || (sgl->length == 0) || (nents <= 0))) {
++		WARN_ON(1);
++		res = -EINVAL;
++		goto out;
++	}
++
++	/*
++	 * Let's keep each bio allocation inside a single page to decrease
++	 * probability of failure.
++	 */
++	max_nr_vecs =  min_t(size_t,
++		((PAGE_SIZE - sizeof(struct bio)) / sizeof(struct bio_vec)),
++		BIO_MAX_PAGES);
++
++	need_new_bio = true;
++	tot_len = 0;
++	bios = 0;
++	for_each_sg(sgl, sg, nents, i) {
++		struct page *page = sg_page(sg);
++		void *page_addr = page_address(page);
++		size_t len = sg->length, l;
++		size_t offset = sg->offset;
++
++		tot_len += len;
++		prev_sg = sg;
++
++		/*
++		 * Each segment must be aligned on DMA boundary and
++		 * not on stack. The last one may have unaligned
++		 * length as long as the total length is aligned to
++		 * DMA padding alignment.
++		 */
++		if (i == nents - 1)
++			l = 0;
++		else
++			l = len;
++		if (((sg->offset | l) & queue_dma_alignment(q)) ||
++		    (page_addr && object_is_on_stack(page_addr + sg->offset))) {
++			res = -EINVAL;
++			goto out_free_bios;
++		}
++
++		while (len > 0) {
++			size_t bytes;
++			int rc;
++
++			if (need_new_bio) {
++				bio = bio_kmalloc(gfp, max_nr_vecs);
++				if (bio == NULL) {
++					res = -ENOMEM;
++					goto out_free_bios;
++				}
++
++				if (rw == WRITE)
++					bio->bi_rw |= 1 << BIO_RW;
++
++				bios++;
++				bio->bi_private = bw;
++				bio->bi_end_io = blk_bio_map_kern_endio;
++
++				if (hbio == NULL)
++					hbio = tbio = bio;
++				else
++					tbio = tbio->bi_next = bio;
++			}
++
++			bytes = min_t(size_t, len, PAGE_SIZE - offset);
++
++			rc = bio_add_pc_page(q, bio, page, bytes, offset);
++			if (rc < bytes) {
++				if (unlikely(need_new_bio || (rc < 0))) {
++					if (rc < 0)
++						res = rc;
++					else
++						res = -EIO;
++					goto out_free_bios;
++				} else {
++					need_new_bio = true;
++					len -= rc;
++					offset += rc;
++					continue;
++				}
++			}
++
++			need_new_bio = false;
++			offset = 0;
++			len -= bytes;
++			page = nth_page(page, 1);
++		}
++	}
++
++	if (hbio == NULL) {
++		res = -EINVAL;
++		goto out_free_bios;
++	}
++
++	/* Total length must be aligned on DMA padding alignment */
++	if ((tot_len & q->dma_pad_mask) &&
++	    !(rq->cmd_flags & REQ_COPY_USER)) {
++		res = -EINVAL;
++		goto out_free_bios;
++	}
++
++	if (bw != NULL)
++		atomic_set(&bw->bios_inflight, bios);
++
++	while (hbio != NULL) {
++		bio = hbio;
++		hbio = hbio->bi_next;
++		bio->bi_next = NULL;
++
++		blk_queue_bounce(q, &bio);
++
++		res = blk_rq_append_bio(q, rq, bio);
++		if (unlikely(res != 0)) {
++			bio->bi_next = hbio;
++			hbio = bio;
++			/* We can have one or more bios bounced */
++			goto out_unmap_bios;
++		}
++	}
++
++	rq->buffer = NULL;
++out:
++	return res;
++
++out_free_bios:
++	while (hbio != NULL) {
++		bio = hbio;
++		hbio = hbio->bi_next;
++		bio_put(bio);
++	}
++	goto out;
++
++out_unmap_bios:
++	blk_rq_unmap_kern_sg(rq, res);
++	goto out;
++}
++
++/**
++ * blk_rq_map_kern_sg - map kernel data to a request, for REQ_TYPE_BLOCK_PC
++ * @rq:		request to fill
++ * @sgl:	area to map
++ * @nents:	number of elements in @sgl
++ * @gfp:	memory allocation flags
++ *
++ * Description:
++ *    Data will be mapped directly if possible. Otherwise a bounce
++ *    buffer will be used.
++ */
++int blk_rq_map_kern_sg(struct request *rq, struct scatterlist *sgl,
++		       int nents, gfp_t gfp)
++{
++	int res;
++
++	res = __blk_rq_map_kern_sg(rq, sgl, nents, NULL, gfp);
++	if (unlikely(res != 0)) {
++		struct blk_kern_sg_work *bw = NULL;
++
++		res = blk_rq_copy_kern_sg(rq, sgl, nents, &bw,
++				gfp, rq->q->bounce_gfp | gfp);
++		if (unlikely(res != 0))
++			goto out;
++
++		res = __blk_rq_map_kern_sg(rq, bw->sg_table.sgl,
++				bw->sg_table.nents, bw, gfp);
++		if (res != 0) {
++			blk_free_kern_sg_work(bw);
++			goto out;
++		}
++	}
++
++	rq->buffer = NULL;
++
++out:
++	return res;
++}
++EXPORT_SYMBOL(blk_rq_map_kern_sg);
++
++/**
++ * blk_rq_unmap_kern_sg - unmap a request with kernel sg
++ * @rq:		request to unmap
++ * @err:	non-zero error code
++ *
++ * Description:
++ *    Unmap a rq previously mapped by blk_rq_map_kern_sg(). Must be called
++ *    only in case of an error!
++ */
++void blk_rq_unmap_kern_sg(struct request *rq, int err)
++{
++	struct bio *bio = rq->bio;
++
++	while (bio) {
++		struct bio *b = bio;
++		bio = bio->bi_next;
++		b->bi_end_io(b, err);
++	}
++	rq->bio = NULL;
++
++	return;
++}
++EXPORT_SYMBOL(blk_rq_unmap_kern_sg);
++
+ /**
+  * blk_rq_map_kern - map kernel data to a request, for REQ_TYPE_BLOCK_PC usage
+  * @q:		request queue where request should be inserted
+diff -upkr linux-2.6.34/include/linux/blkdev.h linux-2.6.34/include/linux/blkdev.h
+--- linux-2.6.34/include/linux/blkdev.h	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/include/linux/blkdev.h	2010-05-24 14:51:22.000000000 +0400
+@@ -713,6 +713,8 @@ extern unsigned long blk_max_low_pfn, bl
+ #define BLK_DEFAULT_SG_TIMEOUT	(60 * HZ)
+ #define BLK_MIN_SG_TIMEOUT	(7 * HZ)
+ 
++#define SCSI_EXEC_REQ_FIFO_DEFINED
++
+ #ifdef CONFIG_BOUNCE
+ extern int init_emergency_isa_pool(void);
+ extern void blk_queue_bounce(struct request_queue *q, struct bio **bio);
+@@ -828,6 +830,9 @@ extern int blk_rq_map_kern(struct reques
+ extern int blk_rq_map_user_iov(struct request_queue *, struct request *,
+ 			       struct rq_map_data *, struct sg_iovec *, int,
+ 			       unsigned int, gfp_t);
++extern int blk_rq_map_kern_sg(struct request *rq, struct scatterlist *sgl,
++			      int nents, gfp_t gfp);
++extern void blk_rq_unmap_kern_sg(struct request *rq, int err);
+ extern int blk_execute_rq(struct request_queue *, struct gendisk *,
+ 			  struct request *, int);
+ extern void blk_execute_rq_nowait(struct request_queue *, struct gendisk *,
+diff -upkr linux-2.6.34/include/linux/scatterlist.h linux-2.6.34/include/linux/scatterlist.h
+--- linux-2.6.34/include/linux/scatterlist.h	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/include/linux/scatterlist.h	2010-05-24 14:51:22.000000000 +0400
+@@ -3,6 +3,7 @@
+ 
+ #include <asm/types.h>
+ #include <asm/scatterlist.h>
++#include <asm/kmap_types.h>
+ #include <linux/mm.h>
+ #include <linux/string.h>
+ #include <asm/io.h>
+@@ -218,6 +219,10 @@ size_t sg_copy_from_buffer(struct scatte
+ size_t sg_copy_to_buffer(struct scatterlist *sgl, unsigned int nents,
+ 			 void *buf, size_t buflen);
+ 
++int sg_copy(struct scatterlist *dst_sg, struct scatterlist *src_sg,
++	    int nents_to_copy, size_t copy_len,
++	    enum km_type d_km_type, enum km_type s_km_type);
++
+ /*
+  * Maximum number of entries that will be allocated in one piece, if
+  * a list larger than this is required then chaining will be utilized.
+diff -upkr linux-2.6.34/lib/scatterlist.c linux-2.6.34/lib/scatterlist.c
+--- linux-2.6.34/lib/scatterlist.c	2010-05-17 01:17:36.000000000 +0400
++++ linux-2.6.34/lib/scatterlist.c	2010-05-24 14:51:22.000000000 +0400
+@@ -494,3 +494,132 @@ size_t sg_copy_to_buffer(struct scatterl
+ 	return sg_copy_buffer(sgl, nents, buf, buflen, 1);
+ }
+ EXPORT_SYMBOL(sg_copy_to_buffer);
++
++/*
++ * Can switch to the next dst_sg element, so, to copy to strictly only
++ * one dst_sg element, it must be either last in the chain, or
++ * copy_len == dst_sg->length.
++ */
++static int sg_copy_elem(struct scatterlist **pdst_sg, size_t *pdst_len,
++			size_t *pdst_offs, struct scatterlist *src_sg,
++			size_t copy_len,
++			enum km_type d_km_type, enum km_type s_km_type)
++{
++	int res = 0;
++	struct scatterlist *dst_sg;
++	size_t src_len, dst_len, src_offs, dst_offs;
++	struct page *src_page, *dst_page;
++
++	dst_sg = *pdst_sg;
++	dst_len = *pdst_len;
++	dst_offs = *pdst_offs;
++	dst_page = sg_page(dst_sg);
++
++	src_page = sg_page(src_sg);
++	src_len = src_sg->length;
++	src_offs = src_sg->offset;
++
++	do {
++		void *saddr, *daddr;
++		size_t n;
++
++		saddr = kmap_atomic(src_page +
++					 (src_offs >> PAGE_SHIFT), s_km_type) +
++				    (src_offs & ~PAGE_MASK);
++		daddr = kmap_atomic(dst_page +
++					(dst_offs >> PAGE_SHIFT), d_km_type) +
++				    (dst_offs & ~PAGE_MASK);
++
++		if (((src_offs & ~PAGE_MASK) == 0) &&
++		    ((dst_offs & ~PAGE_MASK) == 0) &&
++		    (src_len >= PAGE_SIZE) && (dst_len >= PAGE_SIZE) &&
++		    (copy_len >= PAGE_SIZE)) {
++			copy_page(daddr, saddr);
++			n = PAGE_SIZE;
++		} else {
++			n = min_t(size_t, PAGE_SIZE - (dst_offs & ~PAGE_MASK),
++					  PAGE_SIZE - (src_offs & ~PAGE_MASK));
++			n = min(n, src_len);
++			n = min(n, dst_len);
++			n = min_t(size_t, n, copy_len);
++			memcpy(daddr, saddr, n);
++		}
++		dst_offs += n;
++		src_offs += n;
++
++		kunmap_atomic(saddr, s_km_type);
++		kunmap_atomic(daddr, d_km_type);
++
++		res += n;
++		copy_len -= n;
++		if (copy_len == 0)
++			goto out;
++
++		src_len -= n;
++		dst_len -= n;
++		if (dst_len == 0) {
++			dst_sg = sg_next(dst_sg);
++			if (dst_sg == NULL)
++				goto out;
++			dst_page = sg_page(dst_sg);
++			dst_len = dst_sg->length;
++			dst_offs = dst_sg->offset;
++		}
++	} while (src_len > 0);
++
++out:
++	*pdst_sg = dst_sg;
++	*pdst_len = dst_len;
++	*pdst_offs = dst_offs;
++	return res;
++}
++
++/**
++ * sg_copy - copy one SG vector to another
++ * @dst_sg:	destination SG
++ * @src_sg:	source SG
++ * @nents_to_copy: maximum number of entries to copy
++ * @copy_len:	maximum amount of data to copy. If 0, then copy all.
++ * @d_km_type:	kmap_atomic type for the destination SG
++ * @s_km_type:	kmap_atomic type for the source SG
++ *
++ * Description:
++ *    Data from the source SG vector will be copied to the destination SG
++ *    vector. End of the vectors will be determined by sg_next() returning
++ *    NULL. Returns number of bytes copied.
++ */
++int sg_copy(struct scatterlist *dst_sg, struct scatterlist *src_sg,
++	    int nents_to_copy, size_t copy_len,
++	    enum km_type d_km_type, enum km_type s_km_type)
++{
++	int res = 0;
++	size_t dst_len, dst_offs;
++
++	if (copy_len == 0)
++		copy_len = 0x7FFFFFFF; /* copy all */
++
++	if (nents_to_copy == 0)
++		nents_to_copy = 0x7FFFFFFF; /* copy all */
++
++	dst_len = dst_sg->length;
++	dst_offs = dst_sg->offset;
++
++	do {
++		int copied = sg_copy_elem(&dst_sg, &dst_len, &dst_offs,
++				src_sg, copy_len, d_km_type, s_km_type);
++		copy_len -= copied;
++		res += copied;
++		if ((copy_len == 0) || (dst_sg == NULL))
++			goto out;
++
++		nents_to_copy--;
++		if (nents_to_copy == 0)
++			goto out;
++
++		src_sg = sg_next(src_sg);
++	} while (src_sg != NULL);
++
++out:
++	return res;
++}
++EXPORT_SYMBOL(sg_copy);
diff --git a/testing/scst-svn-scst/APKBUILD b/testing/scst-svn-scst/APKBUILD
new file mode 100644
index 00000000..b7cda1ad
--- /dev/null
+++ b/testing/scst-svn-scst/APKBUILD
@@ -0,0 +1,82 @@
+# Contributor: Carlo Landmeter
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+
+_flavor=${FLAVOR:-scst}
+_realname=scst-svn
+# source the kernel version
+if [ -f ../../testing/linux-$_flavor/APKBUILD ]; then
+	. ../../testing/linux-$_flavor/APKBUILD
+fi
+_kver=$pkgver
+_kernelver=$pkgver-r$pkgrel
+_abi_release=$pkgver-${_flavor}
+_kpkgrel=$pkgrel
+
+# We need to build iscsi together with scst because it needs some files from its builddir
+_iscsiname=iscsi-scst-svn
+_iscsidir="$srcdir"/iscsi-scst
+
+_realver=1713
+pkgname=${_realname}-${_flavor}
+pkgver=$_kver
+_mypkgrel=0
+pkgrel=$(($_kpkgrel + $_mypkgrel))
+pkgdesc="$_flavor kernel modules for SCST $_realver"
+url="http://scst.sourceforge.net/"
+license="GPL-2"
+depends="linux-${_flavor}=${_kernelver}"
+install=
+makedepends="linux-${_flavor}-dev=${_kernelver} sed bash"
+subpackages="$pkgname-dev $_iscsiname-scst:iscsi"
+source="http://alpine.nethq.org/clandmeter/src/$_realname-$_realver.tar.gz
+	http://alpine.nethq.org/clandmeter/src/$_iscsiname-$_realver.tar.gz"
+
+_ksrc=/usr/src/linux-headers-${_abi_release}
+
+_builddir="$srcdir"/scst
+
+prepare() {
+	# we are disabling proc and enabling sysfs control and disabling debug.
+	cd "$_builddir"
+	make disable_proc
+	make debug2release
+
+	cd "$_iscsidir"
+	make disable_proc
+	make debug2release
+	sed -i -e 's/^\(mods: .*\)/\1 include\/iscsi_scst_itf_ver.h/' Makefile
+}
+
+build() {
+	unset ARCH
+
+	cd "$_builddir"
+	make KDIR="$_ksrc" || return 1
+
+	cd "$_iscsidir"
+	make mods KDIR="$_ksrc" || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make KDIR="$_ksrc" \
+		INSTALL_MOD_PATH="$pkgdir" \
+		INSTALL_DIR_H="$pkgdir"/usr/include/scst \
+		install || return 1
+}
+
+# we sourced kernel apkbuild above so we need to override the dev() func
+dev() {
+	default_dev
+}
+
+iscsi() {
+	pkgdesc="SCST iscsi kernel module"
+	cd "$_iscsidir"
+	install -D -m 644 kernel/iscsi-scst.ko \
+		"$subpkgdir"/lib/modules/$_abi_release/extra/iscsi-scst.ko
+
+}
+
+md5sums="38424f48c9fd65624e316195186fb6a7  scst-svn-1713.tar.gz
+cf046db4f7cd9cf969b054dc055922d6  iscsi-scst-svn-1713.tar.gz"
diff --git a/testing/scstadmin-svn/APKBUILD b/testing/scstadmin-svn/APKBUILD
new file mode 100644
index 00000000..e20ad1cb
--- /dev/null
+++ b/testing/scstadmin-svn/APKBUILD
@@ -0,0 +1,30 @@
+# Contributor: 
+# Maintainer: 
+pkgname=scstadmin-svn
+pkgver=1713
+pkgrel=0
+pkgdesc="SCST administration tool written in perl"
+url="http://scst.sourceforge.net"
+license="GPL-2"
+depends="perl"
+makedepends="perl-dev"
+install=
+subpackages="$pkgname-doc"
+source="http://alpine.nethq.org/clandmeter/src/$pkgname-$pkgver.tar.gz"
+
+_builddir="$srcdir"/scstadmin
+
+prepare() {
+	cd "$_builddir"/scst-0.9.00
+	PERL_MM_USE_DEFAULT=1 perl Makefile.PL INSTALLDIRS=vendor || return 1
+}
+
+package() {
+	cd "$_builddir"/scst-0.9.00
+	make DESTDIR="$pkgdir" install || return 1
+	cd "$_builddir"
+	install -Dm755 scstadmin.sysfs "$pkgdir"/usr/sbin/scstadmin || return 1
+	install -Dm755 init.d/scst.gentoo "$pkgdir"/etc/init.d/scstadmin
+}
+
+md5sums="5c78c6d4d4079a8d2c2b55f3e3119105  scstadmin-svn-1713.tar.gz"
-- 
cgit v1.2.3


From c17f42bb70c2a0cc84124ab8b1798382b88ee6c2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 09:37:19 +0000
Subject: testing/asterisk-audio-konf: new aport

A fork of AppKonference focused entirely on audio conferencing
http://github.com/jthomerson/AsteriskAudioKonf/
---
 .../0001-create-install-dir.patch                  | 24 ++++++++
 testing/asterisk-audio-konf/APKBUILD               | 66 ++++++++++++++++++++++
 2 files changed, 90 insertions(+)
 create mode 100644 testing/asterisk-audio-konf/0001-create-install-dir.patch
 create mode 100644 testing/asterisk-audio-konf/APKBUILD

diff --git a/testing/asterisk-audio-konf/0001-create-install-dir.patch b/testing/asterisk-audio-konf/0001-create-install-dir.patch
new file mode 100644
index 00000000..9d2f548e
--- /dev/null
+++ b/testing/asterisk-audio-konf/0001-create-install-dir.patch
@@ -0,0 +1,24 @@
+From b44f99b7ab158f3e0cf3a2344fcc58d90982378c Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Thu, 27 May 2010 09:31:03 +0000
+Subject: [PATCH] create install dir
+
+---
+ konference/Makefile |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/konference/Makefile b/konference/Makefile
+index 9cc2201..e0901df 100644
+--- a/konference/Makefile
++++ b/konference/Makefile
+@@ -158,6 +158,7 @@ vad_test: vad_test.o libspeex/preprocess.o libspeex/misc.o libspeex/smallft.o
+ 	$(CC) $(PROFILE) -o $@ $^ -lm
+ 
+ install:
++	$(INSTALL) -d $(INSTALL_MODULES_DIR)
+ 	$(INSTALL) -m 755 $(TARGET) $(INSTALL_MODULES_DIR)
+ 
+ 
+-- 
+1.7.1
+
diff --git a/testing/asterisk-audio-konf/APKBUILD b/testing/asterisk-audio-konf/APKBUILD
new file mode 100644
index 00000000..d10dcbc9
--- /dev/null
+++ b/testing/asterisk-audio-konf/APKBUILD
@@ -0,0 +1,66 @@
+# Contributor: 
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=asterisk-audio-konf
+_basever=0
+_gitver=100527
+pkgver=${_basever}_git${_gitver}
+pkgrel=0
+pkgdesc="A fork of AppKonference focused entirely on audio conferencing"
+url="http://github.com/jthomerson/AsteriskAudioKonf/"
+license="GPL"
+depends=
+makedepends="asterisk-dev"
+install=
+subpackages=
+_snapfile="$pkgname-$pkgver.tar.bz2"
+source="http://build.alpinelinux.org:8010/distfiles/$_snapfile
+	0001-create-install-dir.patch
+	"
+
+_gitver=100527
+_giturl="git://github.com/jthomerson/AsteriskAudioKonf.git"
+
+
+_builddir="$srcdir"/$pkgname/konference
+
+
+snapshot() {
+	_gitver=$(date +%y%m%d)
+	pkgver=${_basever}_git$_gitver
+
+	if [ -d "$SRCDEST"/$pkgname ]; then
+		cd "$SRCDEST"/$pkgname
+		git pull --rebase || return 1
+	else
+		cd "$SRCDEST"
+		git clone $_giturl $pkgname
+	fi
+	cd "$SRCDEST"
+	tar -jcf $_snapfile $pkgname
+	
+	pkgrel=0
+	sed -i -e "s/^_gitver=.*/_gitver=${_gitver}/" \
+		-e "s/^pkgrel=.*/pkgrel=$pkgrel/" \
+		"$startdir"/APKBUILD
+	checksum
+}
+
+prepare() {
+	cd "$_builddir"/..
+	for i in "$srcdir"/*.patch; do
+		patch -p1 -i "$i" || return 1
+	done
+}
+
+build() {
+	cd "$_builddir"
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make INSTALL_PREFIX="$pkgdir" install
+}
+
+md5sums="4e81c731d4b4bd258cd426b5d5dfcdc0  asterisk-audio-konf-0_git100527.tar.bz2
+822df062f4f0890889e3be382ae90504  0001-create-install-dir.patch"
-- 
cgit v1.2.3


From f2fc6799765b3f34567eb069c3acf9ba95ca1b57 Mon Sep 17 00:00:00 2001
From: Carlo Landmeter <clandmeter@gmail.com>
Date: Thu, 27 May 2010 09:54:52 +0000
Subject: testing/iscsi-scst-svn: added missing bash to makedeps.

---
 testing/iscsi-scst-svn/APKBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/iscsi-scst-svn/APKBUILD b/testing/iscsi-scst-svn/APKBUILD
index 9b3ec420..f322407e 100644
--- a/testing/iscsi-scst-svn/APKBUILD
+++ b/testing/iscsi-scst-svn/APKBUILD
@@ -9,7 +9,7 @@ url="http://iscsi-scst.sourceforge.net/"
 license="GPL-2"
 depends=
 install=
-makedepends="openssl-dev scst-svn-scst-dev"
+makedepends="openssl-dev scst-svn-scst-dev bash"
 subpackages=
 source="http://alpine.nethq.org/clandmeter/src/$pkgname-$pkgver.tar.gz
         iscsi-scst.initd
-- 
cgit v1.2.3


From 1643d31d7ba5496f14af40a8564bccf355280e53 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:41:27 +0000
Subject: main/yasm: upgrade to 1.0.1

---
 main/yasm/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/yasm/APKBUILD b/main/yasm/APKBUILD
index f024570a..34e6e30e 100644
--- a/main/yasm/APKBUILD
+++ b/main/yasm/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=yasm
-pkgver=0.8.0
-pkgrel=1
+pkgver=1.0.1
+pkgrel=0
 pkgdesc="A rewrite of NASM to allow for multiple syntax supported (NASM, TASM, GAS, etc.)"
 url="http://www.tortall.net/projects/yasm/"
 license="custom"
@@ -22,4 +22,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="84a72204c9b452a00b39b1b00495163f  yasm-0.8.0.tar.gz"
+md5sums="2174fc3b6b74de07667f42d47514c336  yasm-1.0.1.tar.gz"
-- 
cgit v1.2.3


From 8c1bd797a435647d46eb8417969c22b10253c501 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:50:38 +0000
Subject: main/libxfce4util: upgrade to 4.6.2

---
 main/libxfce4util/APKBUILD | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/main/libxfce4util/APKBUILD b/main/libxfce4util/APKBUILD
index 401698b6..884378e5 100644
--- a/main/libxfce4util/APKBUILD
+++ b/main/libxfce4util/APKBUILD
@@ -1,14 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfce4util
-pkgver=4.6.1
-pkgrel=2
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="Basic utility non-GUI functions for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="pkgconfig glib-dev gettext-dev libiconv-dev"
-source="http://www.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2"
+makedepends="pkgconfig glib-dev gettext-dev libiconv-dev intltool"
+source="http://archive.xfce.org/src/xfce/$pkgname/4.6/$pkgname-$pkgver.tar.bz2"
 
 depends_dev="glib-dev"
 build() {
@@ -25,4 +25,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="eac51d58179cbcadc3f802450a8ec9cd  libxfce4util-4.6.1.tar.bz2"
+md5sums="9c3129d827d480f0906c575e7a13f1e9  libxfce4util-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From 84b327e3e1d3ba39a8cdd1da0e0e57cd671a8771 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:51:58 +0000
Subject: main/libxfcegui4: upgrade to 4.6.4

---
 main/libxfcegui4/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/libxfcegui4/APKBUILD b/main/libxfcegui4/APKBUILD
index 620ee6cd..ea099382 100644
--- a/main/libxfcegui4/APKBUILD
+++ b/main/libxfcegui4/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfcegui4
-pkgver=4.6.3
-pkgrel=1
+pkgver=4.6.4
+pkgrel=0
 pkgdesc="Basic GUI functions for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
@@ -28,4 +28,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="a647411a0b95d45bb701beff83636307  libxfcegui4-4.6.3.tar.bz2"
+md5sums="88de59b222cb9977f93a4c61011c1e1f  libxfcegui4-4.6.4.tar.bz2"
-- 
cgit v1.2.3


From bebfd0bcc95b35b557e29031cc89b6b096d2cf00 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:53:18 +0000
Subject: main/libxfce4menu: upgrade to 4.6.2

---
 main/libxfce4menu/APKBUILD | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/main/libxfce4menu/APKBUILD b/main/libxfce4menu/APKBUILD
index c07f8659..7ba2bd6d 100644
--- a/main/libxfce4menu/APKBUILD
+++ b/main/libxfce4menu/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfce4menu
-pkgver=4.6.1
-pkgrel=1
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="a freedesktop.org compliant menu implementation for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
@@ -11,8 +11,7 @@ makedepends="libxfce4util-dev intltool pkgconfig gtk+-dev gettext-dev
 	libiconv-dev"
 source="http://mocha.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2"
 
-build ()
-{
+build () {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
@@ -20,6 +19,10 @@ build ()
 		--localstatedir=/var \
 		--disable-static
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="5dc9343885c2c6f931318b2a1cdcc9db  libxfce4menu-4.6.1.tar.bz2"
+md5sums="ff10cacb76803ee37159e3a43345f0d1  libxfce4menu-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From 0efd23f45fb84939ba2590704ae32b2c400e904b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:56:35 +0000
Subject: main/xfce-utils: upgrade to 4.6.2

---
 main/xfce-utils/APKBUILD | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/main/xfce-utils/APKBUILD b/main/xfce-utils/APKBUILD
index 600ee7fb..00dee691 100644
--- a/main/xfce-utils/APKBUILD
+++ b/main/xfce-utils/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce-utils
-pkgver=4.6.1
-pkgrel=2
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="Utilities for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
@@ -10,10 +10,9 @@ depends="hicolor-icon-theme"
 makedepends="pkgconfig libxfcegui4-dev intltool gettext-dev libiconv-dev
 	libsm-dev expat-dev e2fsprogs-dev"
 install=
-source="http://www.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2"
+source="http://archive.xfce.org/src/xfce/$pkgname/4.6/$pkgname-$pkgver.tar.bz2"
 
-build () 
-{ 
+build () { 
 	cd "$srcdir"/$pkgname-$pkgver
 	sed -i -e "s/share\/xsessions/sessions/g" Makefile.in || return 1
 	./configure --prefix=/usr \
@@ -23,6 +22,10 @@ build ()
 		--disable-static \
 		--with-xsession-prefix=/etc/X11/
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="1aa2362b11e79e56d52ce0d265faf1b6  xfce-utils-4.6.1.tar.bz2"
+md5sums="5d23407700d7e8c9751e17a5bc955109  xfce-utils-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From 2d939e9acc2d9fbabd00aef69fd12f25b555f1f7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 17:58:01 +0000
Subject: main/xfce4-appfinder: upgrade to 4.6.2

---
 main/xfce4-appfinder/APKBUILD | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/main/xfce4-appfinder/APKBUILD b/main/xfce4-appfinder/APKBUILD
index 64238984..5787f36e 100644
--- a/main/xfce4-appfinder/APKBUILD
+++ b/main/xfce4-appfinder/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-appfinder
-pkgver=4.6.1
-pkgrel=1
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="Xfce application finder"
 url="http://www.xfce.org/"
 license="GPL-2"
@@ -10,11 +10,9 @@ makedepends="pkgconfig thunar-dev libxfce4menu-dev intltool gtk+-dev
 	libxfce4util-dev libxfcegui4-dev gettext-dev libiconv-dev
 	startup-notification-dev libsm-dev expat-dev e2fsprogs-dev"
 install="$pkgname.post-install $pkgname.post-upgrade $pkgname.post-deinstall"
-source="http://www.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2
-	$install"
+source="http://archive.xfce.org/src/xfce/$pkgname/4.6/$pkgname-$pkgver.tar.bz2"
 
-build ()
-{
+build () {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
@@ -22,9 +20,10 @@ build ()
 		--localstatedir=/var \
 		--disable-static || return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="a1bc7d88100cfd92714a300be531589b  xfce4-appfinder-4.6.1.tar.bz2
-db51db79681eadc47be4932355a77c25  xfce4-appfinder.post-install
-db51db79681eadc47be4932355a77c25  xfce4-appfinder.post-upgrade
-db51db79681eadc47be4932355a77c25  xfce4-appfinder.post-deinstall"
+md5sums="7752e43578b821e35010bcd3762da166  xfce4-appfinder-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From d399e412d7e986cb2488321c09ed5907351054ca Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:01:01 +0000
Subject: main/terminal: upgrade to 0.4.5

---
 main/terminal/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/terminal/APKBUILD b/main/terminal/APKBUILD
index 2f159f08..620d3535 100644
--- a/main/terminal/APKBUILD
+++ b/main/terminal/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=terminal
-pkgver=0.4.4
-pkgrel=1
+pkgver=0.4.5
+pkgrel=0
 pkgdesc="A modern terminal emulator primarly for the Xfce desktop environment"
 url="http://www.xfce.org/projects/terminal/"
 license="GPL-2"
@@ -28,4 +28,4 @@ package() {
 	cd "$srcdir"/Terminal-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="eba7da9acca699d168f4cc11ee9ed7a9  Terminal-0.4.4.tar.bz2"
+md5sums="3c707628e2e97c6d9566cd74d400036a  Terminal-0.4.5.tar.bz2"
-- 
cgit v1.2.3


From 7273323e8f6568c152523d1f27e78b7b46fe1bdf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:04:12 +0000
Subject: main/thunar: upgrade to 1.0.2

---
 main/thunar/APKBUILD         | 11 ++++-------
 main/thunar/libpng-1.4.patch | 12 ------------
 2 files changed, 4 insertions(+), 19 deletions(-)
 delete mode 100644 main/thunar/libpng-1.4.patch

diff --git a/main/thunar/APKBUILD b/main/thunar/APKBUILD
index 0c2db0a1..ff8e4e2f 100644
--- a/main/thunar/APKBUILD
+++ b/main/thunar/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=thunar
-pkgver=1.0.1
-pkgrel=7
+pkgver=1.0.2
+pkgrel=0
 pkgdesc="File manager for Xfce"
 url="http://thunar.xfce.org"
 license="GPL2 LGPL2"
@@ -11,15 +11,13 @@ makedepends="pkgconfig libexif-dev xfce4-panel-dev exo-dev pcre-dev
 	intltool gettext-dev libiconv-dev expat-dev startup-notification-dev
 	libsm-dev e2fsprogs-dev gamin-dev libexif-dev jpeg-dev"
 install=
-source="http://archive.xfce.org/src/xfce/thunar/${pkgver%.*}/Thunar-$pkgver.tar.bz2
-	libpng-1.4.patch"
+source="http://archive.xfce.org/src/xfce/thunar/${pkgver%.*}/Thunar-$pkgver.tar.bz2"
 
 depends_dev="exo-dev glib-dev gamin-dev jpeg-dev"
 _builddir="$srcdir"/Thunar-$pkgver
 
 prepare() {
 	cd "$_builddir"
-	patch -p1 -i "$srcdir"/libpng-1.4.patch
 }
 
 build() {
@@ -41,5 +39,4 @@ package() {
 	sed -i 's:x-directory/gnome-default-handler;::' "$pkgdir"/usr/share/applications/Thunar-folder-handler.desktop
 }
 
-md5sums="218373aa45d74b6ba8c69c4d5af3bb19  Thunar-1.0.1.tar.bz2
-ee998c20ba13d0cb18741da8b7d67328  libpng-1.4.patch"
+md5sums="c91073202d373a1f9951a1240083c36d  Thunar-1.0.2.tar.bz2"
diff --git a/main/thunar/libpng-1.4.patch b/main/thunar/libpng-1.4.patch
deleted file mode 100644
index 7f38165f..00000000
--- a/main/thunar/libpng-1.4.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur Thunar-1.0.1.orig/thunar-vfs/thunar-vfs-thumb.c Thunar-1.0.1/thunar-vfs/thunar-vfs-thumb.c
---- Thunar-1.0.1.orig/thunar-vfs/thunar-vfs-thumb.c	2010-01-20 21:31:35.000000000 -0500
-+++ Thunar-1.0.1/thunar-vfs/thunar-vfs-thumb.c	2010-01-20 21:34:51.000000000 -0500
-@@ -1169,7 +1169,7 @@
-     goto done0;
- 
-   /* verify the png signature */
--  if (G_LIKELY (png_check_sig ((png_bytep) signature, sizeof (signature))))
-+  if (G_LIKELY (!png_sig_cmp ((png_bytep) signature, 0, sizeof (signature))))
-     rewind (fp);
-   else
-     goto done0;
-- 
cgit v1.2.3


From 0818ab68cc3be61e86fd499b6032e123c4271dd0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:06:37 +0000
Subject: main/xfce4-panel: upgrade to 4.6.4

---
 main/xfce4-panel/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/xfce4-panel/APKBUILD b/main/xfce4-panel/APKBUILD
index deac0568..4094d48d 100644
--- a/main/xfce4-panel/APKBUILD
+++ b/main/xfce4-panel/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-panel
-pkgver=4.6.3
-pkgrel=2
+pkgver=4.6.4
+pkgrel=0
 pkgdesc="Panel for the Xfce desktop environment"
 url="http://www.xfce.org/"
 license="GPL-2"
@@ -29,4 +29,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="0b715abb929220f136483ccd7303ff62  xfce4-panel-4.6.3.tar.bz2"
+md5sums="82f10a42aefca4cc26a6633e7478cc65  xfce4-panel-4.6.4.tar.bz2"
-- 
cgit v1.2.3


From d611985d17114b1168939f4c7ee451f296df5516 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:08:06 +0000
Subject: main/xfce4-session: upgrade to 4.6.2

---
 main/xfce4-session/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/xfce4-session/APKBUILD b/main/xfce4-session/APKBUILD
index 8eb92efd..d5ddddeb 100644
--- a/main/xfce4-session/APKBUILD
+++ b/main/xfce4-session/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-session
-pkgver=4.6.1
-pkgrel=3
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="A session manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
@@ -11,7 +11,7 @@ makedepends="pkgconfig libxfcegui4-dev libwnck-dev libglade-dev intltool
 	e2fsprogs-dev zlib-dev"
 depends="hicolor-icon-theme"
 install=
-source="http://www.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2
+source="http://archive.xfce.org/src/xfce/$pkgname/4.6/$pkgname-$pkgver.tar.bz2
 	busybox-shutdown.patch"
 
 depends_dev="libxfcegui4-dev xfconf-dev"
@@ -41,5 +41,5 @@ package() {
 		"$pkgdir"/usr/bin/xfce4-tips
 }
 
-md5sums="7628be41ed3511a20cff5673d9d39858  xfce4-session-4.6.1.tar.bz2
+md5sums="9d9890130e45e0e9476591ed9ba2c9d5  xfce4-session-4.6.2.tar.bz2
 bfd9132f08f4a92efbe982fb911c511c  busybox-shutdown.patch"
-- 
cgit v1.2.3


From 3f4e726a98a5e6003f7b5fe2dbb7018f338cc79a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:09:38 +0000
Subject: main/exo: upgrade to 0.3.107

---
 main/exo/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/exo/APKBUILD b/main/exo/APKBUILD
index 897f279f..427aafd5 100644
--- a/main/exo/APKBUILD
+++ b/main/exo/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 # TODO: hal
 pkgname=exo
-pkgver=0.3.106
-pkgrel=2
+pkgver=0.3.107
+pkgrel=0
 pkgdesc="Extensions to Xfce by os-cillation"
 url="http://www.os-cillation.com/article.php?sid=40"
 license="GPL-2 LGPL-2"
@@ -31,4 +31,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="927905f89252fa397e50d7a4fbf3c9a7  exo-0.3.106.tar.bz2"
+md5sums="3a92cca0c99ee940db4410891c9e8498  exo-0.3.107.tar.bz2"
-- 
cgit v1.2.3


From f2a650eaac20bb0d4c0a5776cad5d9941c7f30fc Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:12:14 +0000
Subject: main/xfce4-settings: upgrade to 4.6.5

---
 main/xfce4-settings/APKBUILD | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/main/xfce4-settings/APKBUILD b/main/xfce4-settings/APKBUILD
index b6272802..e6bab01d 100644
--- a/main/xfce4-settings/APKBUILD
+++ b/main/xfce4-settings/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfce4-settings
-pkgver=4.6.4
-pkgrel=2
+pkgver=4.6.5
+pkgrel=0
 pkgdesc="Settings manager for xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
@@ -11,7 +11,6 @@ makedepends="exo-dev libnotify-dev libxfcegui4-dev libxklavier-dev libwnck-dev
 	libxi-dev libsm-dev e2fsprogs-dev libxkbfile-dev libxrandr-dev
 	autoconf automake libtool"
 source="http://archive.xfce.org/src/xfce/${pkgname}/${pkgver%.*}/${pkgname}-${pkgver}.tar.bz2
-	xfce4-settings-4.7.1-libxklavier.patch
 	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
@@ -49,5 +48,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="04985407e8e5b916c44780314a177e96  xfce4-settings-4.6.4.tar.bz2
-9a03696ed6200801d296c8adf6816a06  xfce4-settings-4.7.1-libxklavier.patch"
+md5sums="f988cb732913b5fbc115ad7105d2231e  xfce4-settings-4.6.5.tar.bz2"
-- 
cgit v1.2.3


From 4f33d651f4482fed985551996ed4c90f2787fca7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:18:51 +0000
Subject: main/xfconf: upgrade to 4.6.2

---
 main/xfconf/APKBUILD | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/main/xfconf/APKBUILD b/main/xfconf/APKBUILD
index c267f24d..704099fb 100644
--- a/main/xfconf/APKBUILD
+++ b/main/xfconf/APKBUILD
@@ -1,13 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfconf
-pkgver=4.6.1
-pkgrel=2
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="xfconf.. thingie"
 url="http://www.xfce.org/"
 license="GPL-2"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="pkgconfig dbus-glib-dev libxfce4util-dev gettext-dev libiconv-dev"
+makedepends="pkgconfig dbus-glib-dev libxfce4util-dev gettext-dev libiconv-dev
+	intltool"
 source="http://mocha.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2"
 
 depends_dev="glib-dev dbus-dev dbus-glib-dev"
@@ -27,4 +28,4 @@ package() {
 	cd "$_builddir"
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="d4d3018767ea9eb4b57cc57d4038023b  xfconf-4.6.1.tar.bz2"
+md5sums="5ff93c15077c6dbbcd38c437bc1ab2ef  xfconf-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From 80581f944efc9f1e4228f487be77bdbc22f302f6 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:25:02 +0000
Subject: main/xfdesktop: upgrade to 4.6.2

---
 main/xfdesktop/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/xfdesktop/APKBUILD b/main/xfdesktop/APKBUILD
index f0a66cc0..5374a447 100644
--- a/main/xfdesktop/APKBUILD
+++ b/main/xfdesktop/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xfdesktop
-pkgver=4.6.1
-pkgrel=3
+pkgver=4.6.2
+pkgrel=0
 pkgdesc="A desktop manager for Xfce"
 url="http://www.xfce.org/"
 license="GPL-2"
@@ -12,7 +12,7 @@ makedepends="pkgconfig libxfce4menu-dev thunar-dev intltool gettext-dev
 	libglade-dev xfce4-panel-dev libsm-dev libice-dev expat-dev
 	e2fsprogs-dev"
 install=
-source="http://www.xfce.org/archive/xfce-$pkgver/src/$pkgname-$pkgver.tar.bz2"
+source="http://archive.xfce.org/src/xfce/$pkgname/4.6/$pkgname-$pkgver.tar.bz2"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 build() {
@@ -30,4 +30,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="ae15cacc3e3834cca7238a8e1035c50d  xfdesktop-4.6.1.tar.bz2"
+md5sums="e800ea9fee7a5c5eaf2ae96e23a83e3a  xfdesktop-4.6.2.tar.bz2"
-- 
cgit v1.2.3


From 483c539abe88d7713d12d6ea6c60e2fa6f96355c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:45:52 +0000
Subject: main/pixman: upgrade to 0.18.2

---
 main/pixman/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/pixman/APKBUILD b/main/pixman/APKBUILD
index 629130de..ab6d7a90 100644
--- a/main/pixman/APKBUILD
+++ b/main/pixman/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=pixman
-pkgver=0.18.0
+pkgver=0.18.2
 pkgrel=0
 pkgdesc="Pixman library"
 url="http://xorg.freedesktop.org"
@@ -21,4 +21,4 @@ package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="a1b5a0a145cab653f5c1e8cf2f98f945  pixman-0.18.0.tar.bz2"
+md5sums="8f0c47bbb12a0d9c0d14242596bf6bf9  pixman-0.18.2.tar.bz2"
-- 
cgit v1.2.3


From 148036d8cb8bd36f04e8119ad43c9138a576bba2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:47:16 +0000
Subject: main/openssh: upgrade to 5.5_p1

---
 main/openssh/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/openssh/APKBUILD b/main/openssh/APKBUILD
index 3fc470ae..f34efa31 100644
--- a/main/openssh/APKBUILD
+++ b/main/openssh/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openssh
-pkgver=5.4_p1
+pkgver=5.5_p1
 _myver=${pkgver%_*}${pkgver#*_}
-pkgrel=2
+pkgrel=0
 pkgdesc="Port of OpenBSD's free SSH release"
 url="http://www.openssh.org/portable.html"
 license="as-is"
@@ -62,6 +62,6 @@ client() {
 		"$subpkgdir"/etc/ssh/
 }
 
-md5sums="da10af8a789fa2e83e3635f3a1b76f5e  openssh-5.4p1.tar.gz
+md5sums="88633408f4cb1eb11ec7e2ec58b519eb  openssh-5.5p1.tar.gz
 d993cc91e9fab6c6012390874c28af0a  sshd.initd
 b35e9f3829f4cfca07168fcba98749c7  sshd.confd"
-- 
cgit v1.2.3


From 1ccb41c60f45efc1e370f08ccb21a60f4dd84eb1 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 18:55:51 +0000
Subject: testing/gtksourceview: upgrade to 2.10.2

---
 testing/gtksourceview/APKBUILD | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/testing/gtksourceview/APKBUILD b/testing/gtksourceview/APKBUILD
index 78f48202..8e080b20 100644
--- a/testing/gtksourceview/APKBUILD
+++ b/testing/gtksourceview/APKBUILD
@@ -1,14 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtksourceview
-pkgver=2.8.2
-pkgrel=1
+pkgver=2.10.2
+pkgrel=0
 pkgdesc="A text widget adding syntax highlighting and more to GNOME"
 url="http://live.gnome.org/GtkSourceView"
 license="GPL"
 depends=
-makedepends="gtk+-dev intltool libxml2-dev"
+makedepends="gtk+-dev intltool libxml2-dev gobject-introspection"
 subpackages="$pkgname-dev $pkgname-doc"
-source="http://ftp.gnome.org/pub/gnome/sources/gtksourceview/2.8/gtksourceview-$pkgver.tar.bz2"
+source="http://ftp.gnome.org/pub/gnome/sources/gtksourceview/${pkgver%.*}/gtksourceview-$pkgver.tar.bz2"
 
 build() { 
 	cd "$srcdir"/gtksourceview-$pkgver
@@ -23,4 +23,4 @@ package() {
 	cd "$srcdir"/gtksourceview-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
-md5sums="5ce481d3aa7d639fe4508530b184158c  gtksourceview-2.8.2.tar.bz2"
+md5sums="56c849c0adea56228287abbabc7b70b9  gtksourceview-2.10.2.tar.bz2"
-- 
cgit v1.2.3


From 7660e8aee301a15885addc5b3db55e5386a169dd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 19:12:40 +0000
Subject: testing/gdl: new aport

Gnome Devtool Libraries
http://www.gnome.org/
---
 testing/gdl/APKBUILD | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 testing/gdl/APKBUILD

diff --git a/testing/gdl/APKBUILD b/testing/gdl/APKBUILD
new file mode 100644
index 00000000..71498854
--- /dev/null
+++ b/testing/gdl/APKBUILD
@@ -0,0 +1,26 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=gdl
+pkgver=2.30.0
+pkgrel=0
+pkgdesc="Gnome Devtool Libraries"
+url="http://www.gnome.org/"
+license="GPL"
+makedepends="gtk+-dev libxml2-dev intltool"
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://ftp.gnome.org/pub/GNOME/sources/$pkgname/2.30/$pkgname-$pkgver.tar.bz2"
+
+build() { 
+	cd "$srcdir"/$pkgname-$pkgver
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--disable-static \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="ce4eef03a36bf6abd9f8cbad4806d7b8  gdl-2.30.0.tar.bz2"
-- 
cgit v1.2.3


From e38ff76bf0f1d13d838453de28187d121607ab72 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Thu, 27 May 2010 19:13:16 +0000
Subject: testing/valide: new aport

Val(a)IDE is an Integrated Development Environment (IDE) for the Vala programming language
http://www.valaide.org/
---
 testing/valide/APKBUILD | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 testing/valide/APKBUILD

diff --git a/testing/valide/APKBUILD b/testing/valide/APKBUILD
new file mode 100644
index 00000000..d26afd2a
--- /dev/null
+++ b/testing/valide/APKBUILD
@@ -0,0 +1,38 @@
+# Contributor: 
+# Maintainer: 
+pkgname=valide
+pkgver=0.7.0
+pkgrel=0
+pkgdesc="Val(a)IDE is an Integrated Development Environment (IDE) for the Vala programming language"
+url="http://www.valaide.org/"
+license="GPL"
+depends="vala"
+makedepends="gtk+-dev intltool gtksourceview-dev libunique-dev python
+	libxml2-dev gdl-dev"
+install=
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://valide.googlecode.com/files/valide-$pkgver.tar.gz"
+
+# append extra dependencies to -dev subpackage
+# remove if not used.
+# depends_dev="somepackage-dev"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	# apply patches here
+}
+
+build() {
+	cd "$_builddir"
+	./waf -j ${JOBS:-2} configure --prefix=/usr || return 1
+	./waf -j ${JOBS:-2}
+}
+
+package() {
+	cd "$_builddir"
+	./waf -j ${JOBS:-2} --destdir="$pkgdir" install
+}
+
+md5sums="d9e7d36266af3bd4c3ca592a8955285e  valide-0.7.0.tar.gz"
-- 
cgit v1.2.3


From ed3fd090e194e33c856ace790a2e255fa0a2e3f2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 28 May 2010 07:03:05 +0000
Subject: testing/py-twisted: upgrade to 10.0.0

fixes #353
---
 testing/py-twisted/APKBUILD | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/testing/py-twisted/APKBUILD b/testing/py-twisted/APKBUILD
index bc21c236..04e8812c 100644
--- a/testing/py-twisted/APKBUILD
+++ b/testing/py-twisted/APKBUILD
@@ -1,16 +1,15 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=py-twisted
-pkgver=8.2.0
-pkgrel=2
+pkgver=10.0.0
+pkgrel=0
 pkgdesc="Asynchronous networking framework written in Python."
 url="http://twistedmatrix.com/"
 license="MIT"
 depends="python py-crypto py-zope-interface"
 makedepends="python-dev"
-source="http://tmrc.mit.edu/mirror/$pkgname/Twisted/8.2/Twisted-$pkgver.tar.bz2"
+source="http://tmrc.mit.edu/mirror/twisted/Twisted/${pkgver%.*}/Twisted-$pkgver.tar.bz2"
 
-build () 
-{ 
+build() {
 	cd "$srcdir"/Twisted-$pkgver
 	python setup.py build || return 1
 }
@@ -20,4 +19,4 @@ package() {
 	python setup.py install --prefix=/usr --root="$pkgdir" || return 1
 	install -D -m644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
 }
-md5sums="c85f151999df3ecf04c49a781b4438d2  Twisted-8.2.0.tar.bz2"
+md5sums="3b226af1a19b25e3b3e93cc6edf5e284  Twisted-10.0.0.tar.bz2"
-- 
cgit v1.2.3


From cd53af38950f1f9147729f4d1d38618e47c01d10 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 28 May 2010 08:09:32 +0000
Subject: main/iproute2: actually upgrade to 2.6.33

_realver pointed to 2.6.31 so we didnt really have the 2.6.33
---
 main/iproute2/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/iproute2/APKBUILD b/main/iproute2/APKBUILD
index 01cdcee6..6ca29991 100644
--- a/main/iproute2/APKBUILD
+++ b/main/iproute2/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=iproute2
 pkgver=2.6.33
-_realver=2.6.31
-pkgrel=0
+_realver=2.6.33
+pkgrel=1
 pkgdesc="IP Routing Utilities"
 url="http://www.linux-foundation.org/en/Net:Iproute2"
 license="GPL2"
@@ -31,4 +31,4 @@ package() {
 	make -j1 DESTDIR="$pkgdir" install
 }
 
-md5sums="230f35282a95451622f3e8394f9cd80a  iproute2-2.6.31.tar.bz2"
+md5sums="b371fca3fcb5e436e69a7c2111d84a3c  iproute2-2.6.33.tar.bz2"
-- 
cgit v1.2.3


From 4a8dfc4f8927c4b3672a7051f94ecccdcd6c1ac9 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 28 May 2010 10:03:14 +0000
Subject: testing/geh: new aport

a simple commandline image viewer written in C/Gtk+
https://projects.pekdon.net/projects/geh
---
 testing/geh/APKBUILD | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 testing/geh/APKBUILD

diff --git a/testing/geh/APKBUILD b/testing/geh/APKBUILD
new file mode 100644
index 00000000..4f768bda
--- /dev/null
+++ b/testing/geh/APKBUILD
@@ -0,0 +1,44 @@
+# Contributor: 
+# Maintainer: 
+pkgname=geh
+pkgver=0.2.0
+pkgrel=0
+pkgdesc="a simple commandline image viewer written in C/Gtk+"
+url="https://projects.pekdon.net/projects/geh"
+license="GPL"
+depends=
+makedepends="gtk+-dev intltool"
+install=
+subpackages="$pkgname-doc"
+source="http://projects.pekdon.net/projects/geh/files/geh-$pkgver.tar.gz"
+
+# append extra dependencies to -dev subpackage
+# remove if not used.
+# depends_dev="somepackage-dev"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	# apply patches here
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+
+	# remove the 2 lines below (and this) if there is no init.d script
+	# install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	# install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+}
+
+md5sums="2349b774e7f0c288061fcfc8c296f20d  geh-0.2.0.tar.gz"
-- 
cgit v1.2.3


From 044f13dd1aec86424a06e885c386626cb9421f2f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 28 May 2010 14:04:07 +0000
Subject: testing/pekwm: new aport

Fast & Light Window Manager
http://pekwm.org/projects/pekwm
---
 testing/pekwm/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/pekwm/APKBUILD

diff --git a/testing/pekwm/APKBUILD b/testing/pekwm/APKBUILD
new file mode 100644
index 00000000..dcdd920f
--- /dev/null
+++ b/testing/pekwm/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: 
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=pekwm
+pkgver=0.1.12
+pkgrel=0
+pkgdesc="Fast & Light Window Manager"
+url="http://pekwm.org/projects/pekwm"
+license="GPL"
+depends=
+makedepends="libiconv-dev libx11-dev"
+install=
+subpackages="$pkgname-doc"
+source="http://pekwm.org/projects/pekwm/files/pekwm-$pkgver.tar.gz"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	# apply patches here
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
+md5sums="1f7f9ed32cc03f565a3ad30fd6045c1f  pekwm-0.1.12.tar.gz"
-- 
cgit v1.2.3


From 429b7b015805ef948ae9e424836d7f5bc7b17737 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Fri, 28 May 2010 14:15:34 +0000
Subject: testing/osmo: add ical support

---
 testing/osmo/APKBUILD | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/testing/osmo/APKBUILD b/testing/osmo/APKBUILD
index 489874e3..14130968 100644
--- a/testing/osmo/APKBUILD
+++ b/testing/osmo/APKBUILD
@@ -1,11 +1,11 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=osmo
 pkgver=0.2.10
-pkgrel=0
+pkgrel=1
 pkgdesc="A handy personal organizer"
 url="http://clayo.org/osmo/"
 license="GPL"
-makedepends="gtk+-dev libnotify-dev libxml2-dev autoconf automake"
+makedepends="gtk+-dev libnotify-dev libical-dev libxml2-dev autoconf automake"
 install=
 subpackages="$pkgname-doc"
 source="http://downloads.sourceforge.net/$pkgname-pim/$pkgname-$pkgver.tar.gz
@@ -24,6 +24,7 @@ prepare() {
 
 build() {
 	cd "$_builddir"
+	CFLAGS="$CFLAGS -I/usr/include/libical"
 	./configure --prefix=/usr || return 1
 	make || return 1
 }
-- 
cgit v1.2.3


From 6027a731b10a4738d2e2cb732d95231c9c12206f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 12:44:59 +0000
Subject: main/libxfcegui4: dev packages should depend on libsm-dev

---
 main/libxfcegui4/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/libxfcegui4/APKBUILD b/main/libxfcegui4/APKBUILD
index ea099382..db84c195 100644
--- a/main/libxfcegui4/APKBUILD
+++ b/main/libxfcegui4/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxfcegui4
 pkgver=4.6.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Basic GUI functions for Xfce"
 url="http://www.xfce.org/"
 license="GPL2"
@@ -12,7 +12,7 @@ makedepends="pkgconfig intltool glib-dev gettext-dev libiconv-dev gtk+-dev
 	libxfce4util-dev expat-dev"
 source="http://archive.xfce.org/src/xfce/${pkgname}/4.6/${pkgname}-${pkgver}.tar.bz2"
 
-depends_dev="gtk+-dev libxfce4util-dev xfconf-dev"
+depends_dev="gtk+-dev libxfce4util-dev xfconf-dev libsm-dev"
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
-- 
cgit v1.2.3


From e689cd34cbf858a9ef67e61ca17cf111306a0f8b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 12:55:31 +0000
Subject: main/gtk+: added intltool to dev package

---
 main/gtk+/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/gtk+/APKBUILD b/main/gtk+/APKBUILD
index 1f5e4437..07fba13c 100644
--- a/main/gtk+/APKBUILD
+++ b/main/gtk+/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gtk+
 pkgver=2.20.1
-pkgrel=0
+pkgrel=1
 pkgdesc="The GTK+ Toolkit (v2)"
 url="http://www.gtk.org/"
 install="$pkgname.post-install $pkgname.post-upgrade $pkgname.post-deinstall"
@@ -34,7 +34,7 @@ makedepends="pkgconfig
 	zlib-dev"
 source="http://ftp.gnome.org/pub/gnome/sources/gtk+/${pkgver%.*}/gtk+-$pkgver.tar.bz2"
 
-depends_dev="atk-dev pango-dev cairo-dev glib-dev"
+depends_dev="atk-dev pango-dev cairo-dev glib-dev intltool"
 build() {
 	cd "$srcdir"/gtk+-$pkgver
 	./configure --prefix=/usr \
-- 
cgit v1.2.3


From 84c0d12c2c88d26659a209939f1316810a0b29ae Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 12:58:09 +0000
Subject: testing/xfce4-note-plugin: new aport

Notes plugin for the Xfce4 desktop
http://goodies.xfce.org/projects/panel-plugins/xfce4-notes-plugin
---
 testing/xfce4-notes-plugin/APKBUILD | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/xfce4-notes-plugin/APKBUILD

diff --git a/testing/xfce4-notes-plugin/APKBUILD b/testing/xfce4-notes-plugin/APKBUILD
new file mode 100644
index 00000000..42e7ccd1
--- /dev/null
+++ b/testing/xfce4-notes-plugin/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: 
+# Maintainer: 
+pkgname=xfce4-notes-plugin
+pkgver=1.7.2
+pkgrel=0
+pkgdesc="Notes plugin for the Xfce4 desktop"
+url="http://goodies.xfce.org/projects/panel-plugins/xfce4-notes-plugin"
+license="GPL"
+depends=
+makedepends="xfce4-panel-dev libunique-dev"
+install=
+subpackages=
+source="http://archive.xfce.org/src/panel-plugins/xfce4-notes-plugin/1.7/xfce4-notes-plugin-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	# apply patches here
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
+md5sums="054742ecc4bb83de6c1447b023938d3e  xfce4-notes-plugin-1.7.2.tar.bz2"
-- 
cgit v1.2.3


From 3acb14e008f0b7f56d5185eae23c452cf431e576 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 15:47:18 +0000
Subject: main/libunique: moved from testing

---
 main/libunique/APKBUILD    | 28 ++++++++++++++++++++++++++++
 testing/libunique/APKBUILD | 28 ----------------------------
 2 files changed, 28 insertions(+), 28 deletions(-)
 create mode 100644 main/libunique/APKBUILD
 delete mode 100644 testing/libunique/APKBUILD

diff --git a/main/libunique/APKBUILD b/main/libunique/APKBUILD
new file mode 100644
index 00000000..59bd4508
--- /dev/null
+++ b/main/libunique/APKBUILD
@@ -0,0 +1,28 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=libunique
+pkgver=1.1.6
+pkgrel=1
+pkgdesc="Library for writing single instance applications"
+url="http://live.gnome.org/LibUnique"
+license="LGPL"
+depends=
+makedepends="pkgconfig gtk+-dev dbus-glib-dev"
+subpackages="$pkgname-dev $pkgname-doc"
+source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/1.1/$pkgname-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--disable-static \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install || return 1
+}
+md5sums="7955769ef31f1bc4f83446dbb3625e6d  libunique-1.1.6.tar.bz2"
diff --git a/testing/libunique/APKBUILD b/testing/libunique/APKBUILD
deleted file mode 100644
index 59bd4508..00000000
--- a/testing/libunique/APKBUILD
+++ /dev/null
@@ -1,28 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=libunique
-pkgver=1.1.6
-pkgrel=1
-pkgdesc="Library for writing single instance applications"
-url="http://live.gnome.org/LibUnique"
-license="LGPL"
-depends=
-makedepends="pkgconfig gtk+-dev dbus-glib-dev"
-subpackages="$pkgname-dev $pkgname-doc"
-source="http://ftp.gnome.org/pub/gnome/sources/$pkgname/1.1/$pkgname-$pkgver.tar.bz2"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-build() {
-	cd "$_builddir"
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--localstatedir=/var \
-		--disable-static \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install || return 1
-}
-md5sums="7955769ef31f1bc4f83446dbb3625e6d  libunique-1.1.6.tar.bz2"
-- 
cgit v1.2.3


From 5c47b9f79cd17d97ba4f91eb665dd0df3014e840 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 15:47:47 +0000
Subject: main/xfce4-notes-plugin: moved from aports

---
 main/xfce4-notes-plugin/APKBUILD    | 36 ++++++++++++++++++++++++++++++++++++
 testing/xfce4-notes-plugin/APKBUILD | 36 ------------------------------------
 2 files changed, 36 insertions(+), 36 deletions(-)
 create mode 100644 main/xfce4-notes-plugin/APKBUILD
 delete mode 100644 testing/xfce4-notes-plugin/APKBUILD

diff --git a/main/xfce4-notes-plugin/APKBUILD b/main/xfce4-notes-plugin/APKBUILD
new file mode 100644
index 00000000..42e7ccd1
--- /dev/null
+++ b/main/xfce4-notes-plugin/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: 
+# Maintainer: 
+pkgname=xfce4-notes-plugin
+pkgver=1.7.2
+pkgrel=0
+pkgdesc="Notes plugin for the Xfce4 desktop"
+url="http://goodies.xfce.org/projects/panel-plugins/xfce4-notes-plugin"
+license="GPL"
+depends=
+makedepends="xfce4-panel-dev libunique-dev"
+install=
+subpackages=
+source="http://archive.xfce.org/src/panel-plugins/xfce4-notes-plugin/1.7/xfce4-notes-plugin-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+prepare() {
+	cd "$_builddir"
+	# apply patches here
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
+md5sums="054742ecc4bb83de6c1447b023938d3e  xfce4-notes-plugin-1.7.2.tar.bz2"
diff --git a/testing/xfce4-notes-plugin/APKBUILD b/testing/xfce4-notes-plugin/APKBUILD
deleted file mode 100644
index 42e7ccd1..00000000
--- a/testing/xfce4-notes-plugin/APKBUILD
+++ /dev/null
@@ -1,36 +0,0 @@
-# Contributor: 
-# Maintainer: 
-pkgname=xfce4-notes-plugin
-pkgver=1.7.2
-pkgrel=0
-pkgdesc="Notes plugin for the Xfce4 desktop"
-url="http://goodies.xfce.org/projects/panel-plugins/xfce4-notes-plugin"
-license="GPL"
-depends=
-makedepends="xfce4-panel-dev libunique-dev"
-install=
-subpackages=
-source="http://archive.xfce.org/src/panel-plugins/xfce4-notes-plugin/1.7/xfce4-notes-plugin-$pkgver.tar.bz2"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-
-prepare() {
-	cd "$_builddir"
-	# apply patches here
-}
-
-build() {
-	cd "$_builddir"
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--mandir=/usr/share/man \
-		--infodir=/usr/share/info
-	make || return 1
-}
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install
-}
-
-md5sums="054742ecc4bb83de6c1447b023938d3e  xfce4-notes-plugin-1.7.2.tar.bz2"
-- 
cgit v1.2.3


From e0486920d84228a5914ba731b6770f0af89e972c Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:09:20 +0000
Subject: main/startup-notification: fix dev depends

---
 main/startup-notification/APKBUILD | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/main/startup-notification/APKBUILD b/main/startup-notification/APKBUILD
index 94bc8f00..c9414d4e 100644
--- a/main/startup-notification/APKBUILD
+++ b/main/startup-notification/APKBUILD
@@ -1,23 +1,27 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=startup-notification
 pkgver=0.10
-pkgrel=1
+pkgrel=2
 pkgdesc="Monitor and display application startup"
 url="http://www.freedesktop.org"
 license="LGPL"
 subpackages="$pkgname-dev"
-depends="libx11 libsm xcb-util"
+depends=
 makedepends="libx11-dev libsm-dev xcb-util-dev"
 source="http://www.freedesktop.org/software/$pkgname/releases/$pkgname-$pkgver.tar.gz"
 
-build () 
-{ 
+depends_dev="libsm-dev xcb-util-dev"
+build() {
 	cd "$srcdir"/$pkgname-$pkgver
 	./configure --prefix=/usr \
 		--localstatedir=/var \
 		--sysconfdir=/etc \
 		|| return 1
 	make || return 1
+}
+
+package() {
+	cd "$srcdir"/$pkgname-$pkgver
 	make DESTDIR="$pkgdir" install || return 1
 }
 md5sums="bca0ed1c74bc4e483ea2ed12a5717354  startup-notification-0.10.tar.gz"
-- 
cgit v1.2.3


From 0652de5a797997bc087c9e0065184a127e7ddac2 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:18:02 +0000
Subject: testing/thunar-media-tags-plugin: new aport

Media tags plugin for Thunar file manager
http://thunar.xfce.org/pwiki/projects/thunar-media-tags-plugin
---
 testing/thunar-media-tags-plugin/APKBUILD | 36 +++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 testing/thunar-media-tags-plugin/APKBUILD

diff --git a/testing/thunar-media-tags-plugin/APKBUILD b/testing/thunar-media-tags-plugin/APKBUILD
new file mode 100644
index 00000000..cbcb46ac
--- /dev/null
+++ b/testing/thunar-media-tags-plugin/APKBUILD
@@ -0,0 +1,36 @@
+# Contributor: 
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=thunar-media-tags-plugin
+pkgver=0.1.2
+pkgrel=0
+pkgdesc="Media tags plugin for Thunar file manager"
+url="http://thunar.xfce.org/pwiki/projects/thunar-media-tags-plugin"
+license="GPL"
+depends=
+makedepends="thunar-dev taglib-dev"
+install=
+subpackages=
+source="http://mocha.xfce.org/archive/src/thunar-plugins/thunar-media-tags-plugin/${pkgver%.*}/thunar-media-tags-plugin-$pkgver.tar.bz2"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+}
+
+build() {
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--disable-static
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+	rm -r "$pkgdir"/usr/lib/*/*.la
+}
+
+md5sums="8a95f0ea4df6f757c1c94eb5442d2ff5  thunar-media-tags-plugin-0.1.2.tar.bz2"
-- 
cgit v1.2.3


From fd0cf32e80cc193c56fabc8639e91bf022bc8b06 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:23:02 +0000
Subject: testing/hardinfo: added support for alpine OS release

---
 testing/hardinfo/APKBUILD              | 11 +++++++----
 testing/hardinfo/hardinfo-alpine.patch | 10 ++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)
 create mode 100644 testing/hardinfo/hardinfo-alpine.patch

diff --git a/testing/hardinfo/APKBUILD b/testing/hardinfo/APKBUILD
index 30b57949..8b6db2bf 100644
--- a/testing/hardinfo/APKBUILD
+++ b/testing/hardinfo/APKBUILD
@@ -1,19 +1,21 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=hardinfo
 pkgver=0.5.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A system information and benchmark tool."
 url="http://hardinfo.berlios.de/wiki/index.php/Main_Page"
 license="GPL-2"
 makedepends="gtk+-dev libsoup-dev>=2.4.0 gnutls-dev>=2.4.1"
 depends=
 source="http://download.berlios.de/$pkgname/$pkgname-$pkgver.tar.bz2
-	fixsensors.patch"
+	fixsensors.patch
+	hardinfo-alpine.patch"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 < "$srcdir"/fixsensors.patch || return 1
+	patch -p1 -i "$srcdir"/fixsensors.patch || return 1
+	patch -p1 -i "$srcdir"/hardinfo-alpine.patch || return 1
 	# configure scrip says bash but bb ash works just fine
 	sed -i -e '1,1s/bash/sh/' configure
 }
@@ -31,4 +33,5 @@ package() {
 	echo "Alpine Linux" > "$pkgdir"/etc/hardinfo.distro
 }
 md5sums="6fb38992e140f2fab16518ae1f38e188  hardinfo-0.5.1.tar.bz2
-05c212db07b9f152cdea052ff7bb28fa  fixsensors.patch"
+05c212db07b9f152cdea052ff7bb28fa  fixsensors.patch
+ae8d38e5b35fb2c9c5f425dde3ba27cb  hardinfo-alpine.patch"
diff --git a/testing/hardinfo/hardinfo-alpine.patch b/testing/hardinfo/hardinfo-alpine.patch
new file mode 100644
index 00000000..279aa5d5
--- /dev/null
+++ b/testing/hardinfo/hardinfo-alpine.patch
@@ -0,0 +1,10 @@
+--- ./computer.h.orig
++++ ./computer.h
+@@ -23,6 +23,7 @@
+ static struct {
+     gchar *file, *codename;
+ } distro_db[] = {
++    { DB_PREFIX "alpine-version",	"al"  },
+     { DB_PREFIX "debian_version",	"deb"  },
+     { DB_PREFIX "slackware-version",	"slk"  },
+     { DB_PREFIX "mandrake-release",	"mdk"  },
-- 
cgit v1.2.3


From da02122bd4099394d80812b536071bf619e997b7 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:30:20 +0000
Subject: main/nspr: moved from testing

---
 main/nspr/APKBUILD                             |  64 +++++++++++++
 main/nspr/nspr-4.6.1-config-1.patch            |  11 +++
 main/nspr/nspr-4.7.0-prtime.patch              |  26 +++++
 main/nspr/nspr-4.8-config.patch                |  47 +++++++++
 main/nspr/nspr-4.8-pkgconfig-gentoo-3.patch    | 126 +++++++++++++++++++++++++
 testing/nspr/APKBUILD                          |  64 -------------
 testing/nspr/nspr-4.6.1-config-1.patch         |  11 ---
 testing/nspr/nspr-4.7.0-prtime.patch           |  26 -----
 testing/nspr/nspr-4.8-config.patch             |  47 ---------
 testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch | 126 -------------------------
 10 files changed, 274 insertions(+), 274 deletions(-)
 create mode 100644 main/nspr/APKBUILD
 create mode 100644 main/nspr/nspr-4.6.1-config-1.patch
 create mode 100644 main/nspr/nspr-4.7.0-prtime.patch
 create mode 100644 main/nspr/nspr-4.8-config.patch
 create mode 100644 main/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
 delete mode 100644 testing/nspr/APKBUILD
 delete mode 100644 testing/nspr/nspr-4.6.1-config-1.patch
 delete mode 100644 testing/nspr/nspr-4.7.0-prtime.patch
 delete mode 100644 testing/nspr/nspr-4.8-config.patch
 delete mode 100644 testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch

diff --git a/main/nspr/APKBUILD b/main/nspr/APKBUILD
new file mode 100644
index 00000000..38f9d9c4
--- /dev/null
+++ b/main/nspr/APKBUILD
@@ -0,0 +1,64 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=nspr
+pkgver=4.8.4
+pkgrel=0
+pkgdesc="Netscape Portable Runtime"
+url="http://www.mozilla.org/projects/nspr/"
+license="MPL-1.1 GPL-2 LGPL-2.1"
+depends=
+subpackages="$pkgname-dev"
+source="ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v$pkgver/src/nspr-$pkgver.tar.gz
+	nspr-4.6.1-config-1.patch
+	nspr-4.7.0-prtime.patch
+	nspr-4.8-config.patch
+	nspr-4.8-pkgconfig-gentoo-3.patch
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	mkdir build inst
+	for i in "$srcdir"/*.patch; do
+		msg "Applying $i"
+		patch -p1 -i "$i" || return 1
+	done
+	# respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) \$(OBJS)/\$(MKSHLIB) \$(LDFLAGS) \$(OBJS)/g' \
+		mozilla/nsprpub/config/rules.mk
+}
+
+build() {
+	cd "$_builddir"/build
+	../mozilla/nsprpub/configure --prefix=/usr \
+		|| return 1
+	make CC="${CC:-gcc}" CXX="${CXX:-g++}" || return 1
+}
+
+package() {
+	local file= minor_version=${pkgver#*.}
+	minor_version=${minor_version%.*}
+
+	cd "$_builddir"/build
+	make DESTDIR="$pkgdir" install || die "emake install failed"
+
+	cd "$pkgdir"/usr/lib
+	rm -f *.a
+	for file in *.so; do
+		mv ${file} ${file}.${minor_version} || return 1
+		ln -s ${file}.${minor_version} ${file} || return 1
+	done
+
+	cd "$_builddir"/build/config
+	install -Dm755 nspr-config "$pkgdir"/usr/bin/nspr-config || return 1
+	install -Dm644 nspr.pc "$pkgdir"/usr/lib/pkgconfig/nspr.pc || return 1
+	rm -rf "$pkgdir"/usr/bin/prerr.properties \
+		"$pkgdir"/usr/bin/compile-et.pl \
+		"$pkgdir"/usr/share/aclocal/nspr.m4 \
+		"$pkgdir"/usr/include/nspr/md
+}
+
+md5sums="a85bdbe1eb646aa32c785a37d8e3a2f5  nspr-4.8.4.tar.gz
+d204a641dd7cbf6751d14dc6b98835f1  nspr-4.6.1-config-1.patch
+c48e1f47799c1cff7e3bf46dc0e653f1  nspr-4.7.0-prtime.patch
+c790c638a7c9fd1d731272f464f065c6  nspr-4.8-config.patch
+5b67b4339be94d0dbc4337a55eabe73a  nspr-4.8-pkgconfig-gentoo-3.patch"
diff --git a/main/nspr/nspr-4.6.1-config-1.patch b/main/nspr/nspr-4.6.1-config-1.patch
new file mode 100644
index 00000000..b919c793
--- /dev/null
+++ b/main/nspr/nspr-4.6.1-config-1.patch
@@ -0,0 +1,11 @@
+--- a/mozilla/nsprpub/configure.orig	2006-01-14 22:41:37.000000000 +0000
++++ b/mozilla/nsprpub/configure	2006-01-14 22:49:14.000000000 +0000
+@@ -3893,7 +3893,7 @@
+     PR_MD_CSRCS=linux.c
+     MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@'
+     DSO_CFLAGS=-fPIC
+-    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)'
++    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@).$(MOD_MINOR_VERSION)'
+     _OPTIMIZE_FLAGS=-O2
+     _DEBUG_FLAGS="-g -fno-inline"  # most people on linux use gcc/gdb, and that
+                                    # combo is not yet good at debugging inlined
diff --git a/main/nspr/nspr-4.7.0-prtime.patch b/main/nspr/nspr-4.7.0-prtime.patch
new file mode 100644
index 00000000..74d5534d
--- /dev/null
+++ b/main/nspr/nspr-4.7.0-prtime.patch
@@ -0,0 +1,26 @@
+--- a/mozilla/nsprpub/pr/src/misc/prtime.c.orig	2007-09-14 19:41:08.000000000 +0200
++++ b/mozilla/nsprpub/pr/src/misc/prtime.c	2007-09-14 19:42:17.000000000 +0200
+@@ -1536,7 +1536,7 @@
+                 case TT_EET: zone_offset =  2 * 60; break;
+                 case TT_JST: zone_offset =  9 * 60; break;
+                 default:
+-                  PR_ASSERT (0);
++                  return PR_FAILURE;
+                   break;
+                 }
+         }
+@@ -1578,11 +1578,12 @@
+           struct tm localTime;
+           time_t secs;
+ 
+-          PR_ASSERT(result->tm_month > -1 &&
++          if (!(result->tm_month > -1 &&
+                     result->tm_mday > 0 &&
+                     result->tm_hour > -1 &&
+                     result->tm_min > -1 &&
+-                    result->tm_sec > -1);
++                    result->tm_sec > -1))
++		    return PR_FAILURE;
+ 
+             /*
+              * To obtain time_t from a tm structure representing the local
diff --git a/main/nspr/nspr-4.8-config.patch b/main/nspr/nspr-4.8-config.patch
new file mode 100644
index 00000000..4db2517e
--- /dev/null
+++ b/main/nspr/nspr-4.8-config.patch
@@ -0,0 +1,47 @@
+--- a/mozilla/nsprpub/lib/libc/src/Makefile.in.orig	2005-06-01 14:28:26.000000000 +0000
++++ b/mozilla/nsprpub/lib/libc/src/Makefile.in	2006-01-15 02:50:39.000000000 +0000
+@@ -112,6 +112,10 @@
+ MKSHLIB += -R '$$ORIGIN'
+ endif
+ 
++ifeq ($(OS_ARCH), Linux)
++DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
++endif
++
+ ifeq ($(OS_ARCH),OS2)
+ MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
+ GARBAGE += $(MAPFILE)
+--- a/mozilla/nsprpub/lib/ds/Makefile.in.orig	2005-06-01 14:28:25.000000000 +0000
++++ b/mozilla/nsprpub/lib/ds/Makefile.in	2006-01-15 02:52:30.000000000 +0000
+@@ -102,6 +102,10 @@
+ MKSHLIB += -R '$$ORIGIN'
+ endif
+ 
++ifeq ($(OS_ARCH), Linux)
++DSO_LDOPTS += -Wl,-R,'$$ORIGIN'
++endif
++
+ ifeq ($(OS_ARCH),OS2)
+ MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
+ GARBAGE += $(MAPFILE)
+--- a/mozilla/nsprpub/pr/src/Makefile.in.orig	2005-06-01 14:28:27.000000000 +0000
++++ b/mozilla/nsprpub/pr/src/Makefile.in	2006-01-15 03:29:36.000000000 +0000
+@@ -168,6 +168,7 @@
+ else
+ OS_LIBS		= -ldl
+ endif
++DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
+ endif
+ 
+ ifeq ($(OS_ARCH),HP-UX)
+--- a/mozilla/nsprpub/config/nspr-config.in.orig	2005-05-11 00:53:41.000000000 +0000
++++ b/mozilla/nsprpub/config/nspr-config.in	2006-01-15 06:37:58.000000000 +0000
+@@ -122,7 +122,7 @@
+ fi
+ 
+ if test "$echo_libs" = "yes"; then
+-      libdirs=-L$libdir
++      libdirs="-Wl,-R$libdir -L$libdir"
+       if test -n "$lib_plds"; then
+ 	libdirs="$libdirs -lplds${major_version}"
+       fi
diff --git a/main/nspr/nspr-4.8-pkgconfig-gentoo-3.patch b/main/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
new file mode 100644
index 00000000..2525928d
--- /dev/null
+++ b/main/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
@@ -0,0 +1,126 @@
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/config.mk nspr-4.8/mozilla/nsprpub/config/config.mk
+--- nspr-4.8-orig/mozilla/nsprpub/config/config.mk	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/config/config.mk	2009-09-12 00:44:19.383381757 -0500
+@@ -162,3 +162,4 @@
+ RELEASE_INCLUDE_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/include
+ RELEASE_BIN_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/bin
+ RELEASE_LIB_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/lib
++RELEASE_PC_DIR = $(RELEASE_LIB_DIR)/pkgconfig
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in nspr-4.8/mozilla/nsprpub/config/Makefile.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:44:19.384379661 -0500
+@@ -52,9 +52,10 @@
+ 
+ # autoconf.mk must be deleted last (from the top-level directory)
+ # because it is included by every makefile.
+-DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config
++DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config nspr.pc
+ 
+ RELEASE_BINS	= nspr-config
++RELEASE_PC	= nspr.pc
+ 
+ include $(topsrcdir)/config/config.mk
+ 
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in nspr-4.8/mozilla/nsprpub/config/nspr-config.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:43:47.677356194 -0500
++++ nspr-4.8/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:45:53.723359547 -0500
+@@ -92,13 +92,13 @@
+ 
+ # Set variables that may be dependent upon other variables
+ if test -z "$exec_prefix"; then
+-    exec_prefix=@exec_prefix@
++    exec_prefix=`pkg-config --variable=exec_prefix nspr`
+ fi
+ if test -z "$includedir"; then
+-    includedir=@includedir@
++    includedir=`pkg-config --variable=includedir nspr`
+ fi
+ if test -z "$libdir"; then
+-    libdir=@libdir@
++    libdir=`pkg-config --variable=libdir nspr`
+ fi
+ 
+ if test "$echo_prefix" = "yes"; then
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in nspr-4.8/mozilla/nsprpub/config/nspr.pc.in
+--- nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in	1969-12-31 18:00:00.000000000 -0600
++++ nspr-4.8/mozilla/nsprpub/config/nspr.pc.in	2009-09-12 00:44:19.410432811 -0500
+@@ -0,0 +1,11 @@
++prefix=@prefix@
++exec_prefix=@exec_prefix@
++libdir=@libdir@
++includedir=@includedir@
++
++Name: NSPR
++Description: The Netscape Portable Runtime
++Version: @MOD_MAJOR_VERSION@.@MOD_MINOR_VERSION@.@MOD_PATCH_VERSION@
++Libs: -L${libdir} -lplds@MOD_MAJOR_VERSION@ -lplc@MOD_MAJOR_VERSION@ -lnspr@MOD_MAJOR_VERSION@ -lpthread -Wl,-R${libdir}
++Cflags: -I${includedir}
++
+diff -urN nspr-4.8-orig/mozilla/nsprpub/config/rules.mk nspr-4.8/mozilla/nsprpub/config/rules.mk
+--- nspr-4.8-orig/mozilla/nsprpub/config/rules.mk	2009-09-12 00:43:47.677356194 -0500
++++ nspr-4.8/mozilla/nsprpub/config/rules.mk	2009-09-12 00:44:19.435517111 -0500
+@@ -211,7 +211,7 @@
+ 	rm -rf $(wildcard *.OBJ *.OBJD) dist $(ALL_TRASH) $(DIST_GARBAGE)
+ 	+$(LOOP_OVER_DIRS)
+ 
+-install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS)
++install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS) $(RELEASE_PC)
+ ifdef RELEASE_BINS
+ 	$(NSINSTALL) -t -m 0755 $(RELEASE_BINS) $(DESTDIR)$(bindir)
+ endif
+@@ -221,6 +221,9 @@
+ ifdef RELEASE_LIBS
+ 	$(NSINSTALL) -t -m 0755 $(RELEASE_LIBS) $(DESTDIR)$(libdir)/$(lib_subdir)
+ endif
++ifdef RELEASE_PC
++	$(NSINSTALL) -t -m 0644 $(RELEASE_PC) $(DESTDIR)$(libdir)/pkgconfig/
++endif
+ 	+$(LOOP_OVER_DIRS)
+ 
+ release:: export
+@@ -272,6 +275,23 @@
+ 	fi
+ 	cp $(RELEASE_HEADERS) $(RELEASE_HEADERS_DEST)
+ endif
++ifdef RELEASE_PC
++	@echo "Copying pkg-config files to release directory"
++	@if test -z "$(BUILD_NUMBER)"; then \
++		echo "BUILD_NUMBER must be defined"; \
++		false; \
++	else \
++		true; \
++	fi
++	@if test ! -d $(RELEASE_PC_DEST); then \
++		rm -rf $(RELEASE_PC_DEST); \
++		$(NSINSTALL) -D $(RELEASE_PC_DEST);\
++	else \
++		true; \
++	fi
++	cp $(RELEASE_PC) $(RELEASE_PC_DEST)
++endif
++
+ 	+$(LOOP_OVER_DIRS)
+ 
+ alltags:
+diff -urN nspr-4.8-orig/mozilla/nsprpub/configure nspr-4.8/mozilla/nsprpub/configure
+--- nspr-4.8-orig/mozilla/nsprpub/configure	2009-09-12 00:43:47.600359058 -0500
++++ nspr-4.8/mozilla/nsprpub/configure	2009-09-12 00:44:19.444380569 -0500
+@@ -6037,6 +6037,7 @@
+ config/nsprincl.mk
+ config/nsprincl.sh
+ config/nspr-config
++config/nspr.pc
+ lib/Makefile 
+ lib/ds/Makefile 
+ lib/libc/Makefile 
+diff -urN nspr-4.8-orig/mozilla/nsprpub/configure.in nspr-4.8/mozilla/nsprpub/configure.in
+--- nspr-4.8-orig/mozilla/nsprpub/configure.in	2009-09-12 00:43:47.678357452 -0500
++++ nspr-4.8/mozilla/nsprpub/configure.in	2009-09-12 00:44:19.451396074 -0500
+@@ -2871,6 +2871,7 @@
+ config/nsprincl.mk
+ config/nsprincl.sh
+ config/nspr-config
++config/nspr.pc
+ lib/Makefile 
+ lib/ds/Makefile 
+ lib/libc/Makefile 
diff --git a/testing/nspr/APKBUILD b/testing/nspr/APKBUILD
deleted file mode 100644
index 38f9d9c4..00000000
--- a/testing/nspr/APKBUILD
+++ /dev/null
@@ -1,64 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=nspr
-pkgver=4.8.4
-pkgrel=0
-pkgdesc="Netscape Portable Runtime"
-url="http://www.mozilla.org/projects/nspr/"
-license="MPL-1.1 GPL-2 LGPL-2.1"
-depends=
-subpackages="$pkgname-dev"
-source="ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v$pkgver/src/nspr-$pkgver.tar.gz
-	nspr-4.6.1-config-1.patch
-	nspr-4.7.0-prtime.patch
-	nspr-4.8-config.patch
-	nspr-4.8-pkgconfig-gentoo-3.patch
-	"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-prepare() {
-	cd "$_builddir"
-	mkdir build inst
-	for i in "$srcdir"/*.patch; do
-		msg "Applying $i"
-		patch -p1 -i "$i" || return 1
-	done
-	# respect LDFLAGS
-	sed -i -e 's/\$(MKSHLIB) \$(OBJS)/\$(MKSHLIB) \$(LDFLAGS) \$(OBJS)/g' \
-		mozilla/nsprpub/config/rules.mk
-}
-
-build() {
-	cd "$_builddir"/build
-	../mozilla/nsprpub/configure --prefix=/usr \
-		|| return 1
-	make CC="${CC:-gcc}" CXX="${CXX:-g++}" || return 1
-}
-
-package() {
-	local file= minor_version=${pkgver#*.}
-	minor_version=${minor_version%.*}
-
-	cd "$_builddir"/build
-	make DESTDIR="$pkgdir" install || die "emake install failed"
-
-	cd "$pkgdir"/usr/lib
-	rm -f *.a
-	for file in *.so; do
-		mv ${file} ${file}.${minor_version} || return 1
-		ln -s ${file}.${minor_version} ${file} || return 1
-	done
-
-	cd "$_builddir"/build/config
-	install -Dm755 nspr-config "$pkgdir"/usr/bin/nspr-config || return 1
-	install -Dm644 nspr.pc "$pkgdir"/usr/lib/pkgconfig/nspr.pc || return 1
-	rm -rf "$pkgdir"/usr/bin/prerr.properties \
-		"$pkgdir"/usr/bin/compile-et.pl \
-		"$pkgdir"/usr/share/aclocal/nspr.m4 \
-		"$pkgdir"/usr/include/nspr/md
-}
-
-md5sums="a85bdbe1eb646aa32c785a37d8e3a2f5  nspr-4.8.4.tar.gz
-d204a641dd7cbf6751d14dc6b98835f1  nspr-4.6.1-config-1.patch
-c48e1f47799c1cff7e3bf46dc0e653f1  nspr-4.7.0-prtime.patch
-c790c638a7c9fd1d731272f464f065c6  nspr-4.8-config.patch
-5b67b4339be94d0dbc4337a55eabe73a  nspr-4.8-pkgconfig-gentoo-3.patch"
diff --git a/testing/nspr/nspr-4.6.1-config-1.patch b/testing/nspr/nspr-4.6.1-config-1.patch
deleted file mode 100644
index b919c793..00000000
--- a/testing/nspr/nspr-4.6.1-config-1.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/mozilla/nsprpub/configure.orig	2006-01-14 22:41:37.000000000 +0000
-+++ b/mozilla/nsprpub/configure	2006-01-14 22:49:14.000000000 +0000
-@@ -3893,7 +3893,7 @@
-     PR_MD_CSRCS=linux.c
-     MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@'
-     DSO_CFLAGS=-fPIC
--    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)'
-+    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@).$(MOD_MINOR_VERSION)'
-     _OPTIMIZE_FLAGS=-O2
-     _DEBUG_FLAGS="-g -fno-inline"  # most people on linux use gcc/gdb, and that
-                                    # combo is not yet good at debugging inlined
diff --git a/testing/nspr/nspr-4.7.0-prtime.patch b/testing/nspr/nspr-4.7.0-prtime.patch
deleted file mode 100644
index 74d5534d..00000000
--- a/testing/nspr/nspr-4.7.0-prtime.patch
+++ /dev/null
@@ -1,26 +0,0 @@
---- a/mozilla/nsprpub/pr/src/misc/prtime.c.orig	2007-09-14 19:41:08.000000000 +0200
-+++ b/mozilla/nsprpub/pr/src/misc/prtime.c	2007-09-14 19:42:17.000000000 +0200
-@@ -1536,7 +1536,7 @@
-                 case TT_EET: zone_offset =  2 * 60; break;
-                 case TT_JST: zone_offset =  9 * 60; break;
-                 default:
--                  PR_ASSERT (0);
-+                  return PR_FAILURE;
-                   break;
-                 }
-         }
-@@ -1578,11 +1578,12 @@
-           struct tm localTime;
-           time_t secs;
- 
--          PR_ASSERT(result->tm_month > -1 &&
-+          if (!(result->tm_month > -1 &&
-                     result->tm_mday > 0 &&
-                     result->tm_hour > -1 &&
-                     result->tm_min > -1 &&
--                    result->tm_sec > -1);
-+                    result->tm_sec > -1))
-+		    return PR_FAILURE;
- 
-             /*
-              * To obtain time_t from a tm structure representing the local
diff --git a/testing/nspr/nspr-4.8-config.patch b/testing/nspr/nspr-4.8-config.patch
deleted file mode 100644
index 4db2517e..00000000
--- a/testing/nspr/nspr-4.8-config.patch
+++ /dev/null
@@ -1,47 +0,0 @@
---- a/mozilla/nsprpub/lib/libc/src/Makefile.in.orig	2005-06-01 14:28:26.000000000 +0000
-+++ b/mozilla/nsprpub/lib/libc/src/Makefile.in	2006-01-15 02:50:39.000000000 +0000
-@@ -112,6 +112,10 @@
- MKSHLIB += -R '$$ORIGIN'
- endif
- 
-+ifeq ($(OS_ARCH), Linux)
-+DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
-+endif
-+
- ifeq ($(OS_ARCH),OS2)
- MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
- GARBAGE += $(MAPFILE)
---- a/mozilla/nsprpub/lib/ds/Makefile.in.orig	2005-06-01 14:28:25.000000000 +0000
-+++ b/mozilla/nsprpub/lib/ds/Makefile.in	2006-01-15 02:52:30.000000000 +0000
-@@ -102,6 +102,10 @@
- MKSHLIB += -R '$$ORIGIN'
- endif
- 
-+ifeq ($(OS_ARCH), Linux)
-+DSO_LDOPTS += -Wl,-R,'$$ORIGIN'
-+endif
-+
- ifeq ($(OS_ARCH),OS2)
- MAPFILE = $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).def
- GARBAGE += $(MAPFILE)
---- a/mozilla/nsprpub/pr/src/Makefile.in.orig	2005-06-01 14:28:27.000000000 +0000
-+++ b/mozilla/nsprpub/pr/src/Makefile.in	2006-01-15 03:29:36.000000000 +0000
-@@ -168,6 +168,7 @@
- else
- OS_LIBS		= -ldl
- endif
-+DSO_LDOPTS +=-Wl,-R,'$$ORIGIN'
- endif
- 
- ifeq ($(OS_ARCH),HP-UX)
---- a/mozilla/nsprpub/config/nspr-config.in.orig	2005-05-11 00:53:41.000000000 +0000
-+++ b/mozilla/nsprpub/config/nspr-config.in	2006-01-15 06:37:58.000000000 +0000
-@@ -122,7 +122,7 @@
- fi
- 
- if test "$echo_libs" = "yes"; then
--      libdirs=-L$libdir
-+      libdirs="-Wl,-R$libdir -L$libdir"
-       if test -n "$lib_plds"; then
- 	libdirs="$libdirs -lplds${major_version}"
-       fi
diff --git a/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch b/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
deleted file mode 100644
index 2525928d..00000000
--- a/testing/nspr/nspr-4.8-pkgconfig-gentoo-3.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-diff -urN nspr-4.8-orig/mozilla/nsprpub/config/config.mk nspr-4.8/mozilla/nsprpub/config/config.mk
---- nspr-4.8-orig/mozilla/nsprpub/config/config.mk	2009-09-12 00:43:47.678357452 -0500
-+++ nspr-4.8/mozilla/nsprpub/config/config.mk	2009-09-12 00:44:19.383381757 -0500
-@@ -162,3 +162,4 @@
- RELEASE_INCLUDE_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/include
- RELEASE_BIN_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/bin
- RELEASE_LIB_DIR = $(RELEASE_DIR)/$(BUILD_NUMBER)/$(OBJDIR_NAME)/lib
-+RELEASE_PC_DIR = $(RELEASE_LIB_DIR)/pkgconfig
-diff -urN nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in nspr-4.8/mozilla/nsprpub/config/Makefile.in
---- nspr-4.8-orig/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:43:47.678357452 -0500
-+++ nspr-4.8/mozilla/nsprpub/config/Makefile.in	2009-09-12 00:44:19.384379661 -0500
-@@ -52,9 +52,10 @@
- 
- # autoconf.mk must be deleted last (from the top-level directory)
- # because it is included by every makefile.
--DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config
-+DIST_GARBAGE	= nsprincl.mk nsprincl.sh nspr-config nspr.pc
- 
- RELEASE_BINS	= nspr-config
-+RELEASE_PC	= nspr.pc
- 
- include $(topsrcdir)/config/config.mk
- 
-diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in nspr-4.8/mozilla/nsprpub/config/nspr-config.in
---- nspr-4.8-orig/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:43:47.677356194 -0500
-+++ nspr-4.8/mozilla/nsprpub/config/nspr-config.in	2009-09-12 00:45:53.723359547 -0500
-@@ -92,13 +92,13 @@
- 
- # Set variables that may be dependent upon other variables
- if test -z "$exec_prefix"; then
--    exec_prefix=@exec_prefix@
-+    exec_prefix=`pkg-config --variable=exec_prefix nspr`
- fi
- if test -z "$includedir"; then
--    includedir=@includedir@
-+    includedir=`pkg-config --variable=includedir nspr`
- fi
- if test -z "$libdir"; then
--    libdir=@libdir@
-+    libdir=`pkg-config --variable=libdir nspr`
- fi
- 
- if test "$echo_prefix" = "yes"; then
-diff -urN nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in nspr-4.8/mozilla/nsprpub/config/nspr.pc.in
---- nspr-4.8-orig/mozilla/nsprpub/config/nspr.pc.in	1969-12-31 18:00:00.000000000 -0600
-+++ nspr-4.8/mozilla/nsprpub/config/nspr.pc.in	2009-09-12 00:44:19.410432811 -0500
-@@ -0,0 +1,11 @@
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+libdir=@libdir@
-+includedir=@includedir@
-+
-+Name: NSPR
-+Description: The Netscape Portable Runtime
-+Version: @MOD_MAJOR_VERSION@.@MOD_MINOR_VERSION@.@MOD_PATCH_VERSION@
-+Libs: -L${libdir} -lplds@MOD_MAJOR_VERSION@ -lplc@MOD_MAJOR_VERSION@ -lnspr@MOD_MAJOR_VERSION@ -lpthread -Wl,-R${libdir}
-+Cflags: -I${includedir}
-+
-diff -urN nspr-4.8-orig/mozilla/nsprpub/config/rules.mk nspr-4.8/mozilla/nsprpub/config/rules.mk
---- nspr-4.8-orig/mozilla/nsprpub/config/rules.mk	2009-09-12 00:43:47.677356194 -0500
-+++ nspr-4.8/mozilla/nsprpub/config/rules.mk	2009-09-12 00:44:19.435517111 -0500
-@@ -211,7 +211,7 @@
- 	rm -rf $(wildcard *.OBJ *.OBJD) dist $(ALL_TRASH) $(DIST_GARBAGE)
- 	+$(LOOP_OVER_DIRS)
- 
--install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS)
-+install:: $(RELEASE_BINS) $(RELEASE_HEADERS) $(RELEASE_LIBS) $(RELEASE_PC)
- ifdef RELEASE_BINS
- 	$(NSINSTALL) -t -m 0755 $(RELEASE_BINS) $(DESTDIR)$(bindir)
- endif
-@@ -221,6 +221,9 @@
- ifdef RELEASE_LIBS
- 	$(NSINSTALL) -t -m 0755 $(RELEASE_LIBS) $(DESTDIR)$(libdir)/$(lib_subdir)
- endif
-+ifdef RELEASE_PC
-+	$(NSINSTALL) -t -m 0644 $(RELEASE_PC) $(DESTDIR)$(libdir)/pkgconfig/
-+endif
- 	+$(LOOP_OVER_DIRS)
- 
- release:: export
-@@ -272,6 +275,23 @@
- 	fi
- 	cp $(RELEASE_HEADERS) $(RELEASE_HEADERS_DEST)
- endif
-+ifdef RELEASE_PC
-+	@echo "Copying pkg-config files to release directory"
-+	@if test -z "$(BUILD_NUMBER)"; then \
-+		echo "BUILD_NUMBER must be defined"; \
-+		false; \
-+	else \
-+		true; \
-+	fi
-+	@if test ! -d $(RELEASE_PC_DEST); then \
-+		rm -rf $(RELEASE_PC_DEST); \
-+		$(NSINSTALL) -D $(RELEASE_PC_DEST);\
-+	else \
-+		true; \
-+	fi
-+	cp $(RELEASE_PC) $(RELEASE_PC_DEST)
-+endif
-+
- 	+$(LOOP_OVER_DIRS)
- 
- alltags:
-diff -urN nspr-4.8-orig/mozilla/nsprpub/configure nspr-4.8/mozilla/nsprpub/configure
---- nspr-4.8-orig/mozilla/nsprpub/configure	2009-09-12 00:43:47.600359058 -0500
-+++ nspr-4.8/mozilla/nsprpub/configure	2009-09-12 00:44:19.444380569 -0500
-@@ -6037,6 +6037,7 @@
- config/nsprincl.mk
- config/nsprincl.sh
- config/nspr-config
-+config/nspr.pc
- lib/Makefile 
- lib/ds/Makefile 
- lib/libc/Makefile 
-diff -urN nspr-4.8-orig/mozilla/nsprpub/configure.in nspr-4.8/mozilla/nsprpub/configure.in
---- nspr-4.8-orig/mozilla/nsprpub/configure.in	2009-09-12 00:43:47.678357452 -0500
-+++ nspr-4.8/mozilla/nsprpub/configure.in	2009-09-12 00:44:19.451396074 -0500
-@@ -2871,6 +2871,7 @@
- config/nsprincl.mk
- config/nsprincl.sh
- config/nspr-config
-+config/nspr.pc
- lib/Makefile 
- lib/ds/Makefile 
- lib/libc/Makefile 
-- 
cgit v1.2.3


From 9c0e50a29937432e6158b0ed64a54afff292cc7f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:30:37 +0000
Subject: main/nss: moved from testing

---
 main/nss/APKBUILD                              |  119 +++
 main/nss/add_spi+cacert_ca_certs.patch         | 1168 ++++++++++++++++++++++++
 main/nss/nss-config.in                         |  145 +++
 main/nss/nss-no-rpath.patch                    |   14 +
 main/nss/nss-nolocalsql.patch                  |   52 ++
 main/nss/nss.pc.in                             |   11 +
 main/nss/ssl-renegotiate-transitional.patch    |   21 +
 testing/nss/APKBUILD                           |  119 ---
 testing/nss/add_spi+cacert_ca_certs.patch      | 1168 ------------------------
 testing/nss/nss-config.in                      |  145 ---
 testing/nss/nss-no-rpath.patch                 |   14 -
 testing/nss/nss-nolocalsql.patch               |   52 --
 testing/nss/nss.pc.in                          |   11 -
 testing/nss/ssl-renegotiate-transitional.patch |   21 -
 14 files changed, 1530 insertions(+), 1530 deletions(-)
 create mode 100644 main/nss/APKBUILD
 create mode 100644 main/nss/add_spi+cacert_ca_certs.patch
 create mode 100644 main/nss/nss-config.in
 create mode 100644 main/nss/nss-no-rpath.patch
 create mode 100644 main/nss/nss-nolocalsql.patch
 create mode 100644 main/nss/nss.pc.in
 create mode 100644 main/nss/ssl-renegotiate-transitional.patch
 delete mode 100644 testing/nss/APKBUILD
 delete mode 100644 testing/nss/add_spi+cacert_ca_certs.patch
 delete mode 100644 testing/nss/nss-config.in
 delete mode 100644 testing/nss/nss-no-rpath.patch
 delete mode 100644 testing/nss/nss-nolocalsql.patch
 delete mode 100644 testing/nss/nss.pc.in
 delete mode 100644 testing/nss/ssl-renegotiate-transitional.patch

diff --git a/main/nss/APKBUILD b/main/nss/APKBUILD
new file mode 100644
index 00000000..c795669e
--- /dev/null
+++ b/main/nss/APKBUILD
@@ -0,0 +1,119 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=nss
+pkgver=3.12.6
+_ver=3_12_6
+pkgrel=0
+pkgdesc="Mozilla Network Security Services"
+url="http://www.mozilla.org/projects/security/pki/nss/"
+license="MPL GPL"
+depends=
+makedepends="nspr-dev sqlite-dev zlib-dev perl"
+subpackages="$pkgname-dev libnss"
+source="ftp://ftp.mozilla.org/pub/security/$pkgname/releases/NSS_${_ver}_RTM/src/$pkgname-$pkgver.tar.gz
+	nss-nolocalsql.patch
+	nss-no-rpath.patch
+	nss.pc.in
+	nss-config.in
+	add_spi+cacert_ca_certs.patch
+	ssl-renegotiate-transitional.patch"
+depends_dev="nspr-dev"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() { 
+	cd "$_builddir"
+	patch -Np1 -i ""$srcdir"/add_spi+cacert_ca_certs.patch" || return 1
+	patch -Np1 -i ""$srcdir"/ssl-renegotiate-transitional.patch" || return 1
+	patch -Np0 -i ""$srcdir"/nss-nolocalsql.patch" || return 1
+	patch -Np0 -i ""$srcdir"/nss-no-rpath.patch" || return 1
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' \
+		mozilla/security/coreconf/rules.mk
+
+}
+
+build() { 
+	cd "$_builddir"
+	unset CFLAGS
+	unset CXXFLAGS
+	export BUILD_OPT=1
+	export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
+	export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
+	export NSPR_INCLUDE_DIR=`pkg-config --cflags-only-I nspr | sed 's/-I//'`
+	export NSPR_LIB_DIR=`pkg-config --libs-only-L nspr | sed 's/-L.//'`
+	export XCFLAGS="${CFLAGS}"
+	make -j 1 -C mozilla/security/coreconf || return 1
+	make -j 1 -C mozilla/security/dbm || return 1
+	make -j 1 -C mozilla/security/nss || return 1
+}
+
+package() {
+	cd "$_builddir"
+	install -m755 -d "$pkgdir"/usr/lib/pkgconfig
+	install -m755 -d "$pkgdir"/usr/bin
+	install -m755 -d "$pkgdir"/usr/include/nss
+
+	NSS_VMAJOR=`awk '/#define.*NSS_VMAJOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h `
+	msg "DEBUG: $NSS_VMAJOR"
+	NSS_VMINOR=`awk '/#define.*NSS_VMINOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
+	NSS_VPATCH=`awk '/#define.*NSS_VPATCH"/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
+
+	# pkgconfig files
+	sed "$srcdir"/nss.pc.in \
+		-e "s,%libdir%,/usr/lib,g" \
+		-e "s,%prefix%,/usr,g" \
+		-e "s,%exec_prefix%,/usr/bin,g" \
+		-e "s,%includedir%,/usr/include/nss,g" \
+		-e "s,%NSPR_VERSION%,$pkgver,g" \
+		-e "s,%NSS_VERSION%,$pkgver,g" \
+		> "$pkgdir"/usr/lib/pkgconfig/nss.pc \
+		|| return 1
+	ln -sf nss.pc "$pkgdir"/usr/lib/pkgconfig/mozilla-nss.pc || return 1
+	chmod 644 "$pkgdir"/usr/lib/pkgconfig/*.pc || return 1
+
+	# nss-config
+	sed "$srcdir"/nss-config.in \
+		-e "s,@libdir@,/usr/lib,g" \
+		-e "s,@prefix@,/usr/bin,g" \
+		-e "s,@exec_prefix@,/usr/bin,g" \
+		-e "s,@includedir@,/usr/include/nss,g" \
+		-e "s,@MOD_MAJOR_VERSION@,${NSS_VMAJOR},g" \
+		-e "s,@MOD_MINOR_VERSION@,${NSS_VMINOR},g" \
+		-e "s,@MOD_PATCH_VERSION@,${NSS_VPATCH},g" \
+		> "$pkgdir"/usr/bin/nss-config || return 1
+	chmod 755 "$pkgdir"/usr/bin/nss-config || return 1
+	local minor=${pkgver#*.}
+	minor=${minor%.*}
+	for file in libsoftokn3.so libfreebl3.so libnss3.so libnssutil3.so \
+			libssl3.so libsmime3.so libnssckbi.so libnssdbm3.so; do
+		install -m755 mozilla/dist/*.OBJ/lib/${file} \
+			"$pkgdir"/usr/lib/${file}.$minor || return 1
+		ln -s $file.$minor "$pkgdir"/usr/lib/$file
+	done
+	install -m644 mozilla/dist/*.OBJ/lib/libcrmf.a "$pkgdir"/usr/lib/ \
+		|| return 1
+	install -m644 mozilla/dist/*.OBJ/lib/*.chk "$pkgdir"/usr/lib/ \
+		|| return 1
+	
+	for file in certutil cmsutil crlutil modutil pk12util shlibsign \
+			signtool signver ssltap; do
+		install -m755 mozilla/dist/*.OBJ/bin/${file} "$pkgdir"/usr/bin/\
+			|| return 1
+	done
+	install -m644 mozilla/dist/public/nss/*.h "$pkgdir"/usr/include/nss/ \
+		|| return 1
+}
+
+libnss() {
+	pkgdesc="Mozilla Network Security Service libraries"
+	mkdir -p "$subpkgdir"/usr/
+	mv "$pkgdir"/usr/lib "$subpkgdir"/usr
+}
+
+md5sums="da42596665f226de5eb3ecfc1ec57cd1  nss-3.12.6.tar.gz
+1d8305dc458d28c6f32746d9132b9873  nss-nolocalsql.patch
+e5c97db0c884d5f4cfda21e562dc9bba  nss-no-rpath.patch
+c547b030c57fe1ed8b77c73bf52b3ded  nss.pc.in
+46bee81908f1e5b26d6a7a2e14c64d9f  nss-config.in
+a744b499e7da252acd9ac8ff09af3d48  add_spi+cacert_ca_certs.patch
+d83c7b61abb7e9f8f7bcd157183d1ade  ssl-renegotiate-transitional.patch"
diff --git a/main/nss/add_spi+cacert_ca_certs.patch b/main/nss/add_spi+cacert_ca_certs.patch
new file mode 100644
index 00000000..a8969ee4
--- /dev/null
+++ b/main/nss/add_spi+cacert_ca_certs.patch
@@ -0,0 +1,1168 @@
+## 95_add_spi+cacert_ca_certs.patch by martin f. krafft <madduck@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Adds the SPI Inc. and CAcert.org CA certificates
+
+diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.c b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
+index 2c6fdab..2fb754c 100644
+--- a/mozilla/security/nss/lib/ckfw/builtins/certdata.c
++++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
+@@ -35,7 +35,7 @@
+  *
+  * ***** END LICENSE BLOCK ***** */
+ #ifdef DEBUG
+-static const char CVS_ID[] = "@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $";
++static const char CVS_ID[] = "@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $";
+ #endif /* DEBUG */
+ 
+ #ifndef BUILTINS_H
+@@ -1020,6 +1020,24 @@ static const CK_ATTRIBUTE_TYPE nss_builtins_types_320 [] = {
+ static const CK_ATTRIBUTE_TYPE nss_builtins_types_321 [] = {
+  CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
+ };
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_322 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_323 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_324 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_325 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_326 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
++};
++static const CK_ATTRIBUTE_TYPE nss_builtins_types_327 [] = {
++ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
++};
+ #ifdef DEBUG
+ static const NSSItem nss_builtins_items_0 [] = {
+   { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },
+@@ -1028,7 +1046,7 @@ static const NSSItem nss_builtins_items_0 [] = {
+   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+   { (void *)"CVS ID", (PRUint32)7 },
+   { (void *)"NSS", (PRUint32)4 },
+-  { (void *)"@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $", (PRUint32)160 }
++  { (void *)"@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $", (PRUint32)160 }
+ };
+ #endif /* DEBUG */
+ static const NSSItem nss_builtins_items_1 [] = {
+@@ -21537,6 +21555,531 @@ static const NSSItem nss_builtins_items_321 [] = {
+   { (void *)&ckt_netscape_trust_unknown, (PRUint32)sizeof(CK_TRUST) },
+   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
+ };
++static const NSSItem nss_builtins_items_322 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\000"
++, (PRUint32)3 },
++  { (void *)"\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000"
++"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
++"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
++"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
++"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
++"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
++"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
++"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
++"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
++"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063"
++"\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060"
++"\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016"
++"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
++"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
++"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
++"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
++"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
++"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
++"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
++"\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
++"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
++"\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007"
++"\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002"
++"\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011"
++"\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315"
++"\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230"
++"\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272"
++"\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016"
++"\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052"
++"\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262"
++"\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140"
++"\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150"
++"\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273"
++"\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022"
++"\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234"
++"\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334"
++"\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070"
++"\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232"
++"\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044"
++"\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355"
++"\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252"
++"\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352"
++"\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276"
++"\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306"
++"\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320"
++"\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167"
++"\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335"
++"\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324"
++"\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246"
++"\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106"
++"\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272"
++"\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334"
++"\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304"
++"\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060"
++"\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265"
++"\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071"
++"\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230"
++"\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260"
++"\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016"
++"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
++"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
++"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
++"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
++"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
++"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
++"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
++"\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001"
++"\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037"
++"\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160"
++"\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157"
++"\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006"
++"\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164"
++"\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060"
++"\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045"
++"\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162"
++"\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077"
++"\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102"
++"\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165"
++"\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164"
++"\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040"
++"\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167"
++"\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006"
++"\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001"
++"\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201"
++"\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275"
++"\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234"
++"\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323"
++"\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073"
++"\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140"
++"\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353"
++"\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160"
++"\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334"
++"\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231"
++"\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116"
++"\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145"
++"\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031"
++"\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363"
++"\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330"
++"\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367"
++"\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260"
++"\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223"
++"\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335"
++"\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026"
++"\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005"
++"\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361"
++"\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371"
++"\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246"
++"\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206"
++"\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153"
++"\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344"
++"\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143"
++"\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362"
++"\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226"
++"\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175"
++"\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305"
++"\103"
++, (PRUint32)1857 }
++};
++static const NSSItem nss_builtins_items_323 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
++  { (void *)"\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106"
++"\166\316\217\063"
++, (PRUint32)20 },
++  { (void *)"\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153"
++, (PRUint32)16 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\000"
++, (PRUint32)3 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
++static const NSSItem nss_builtins_items_324 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143"
++"\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004"
++"\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101"
++"\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004"
++"\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040"
++"\063\040\122\157\157\164"
++, (PRUint32)86 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\001"
++, (PRUint32)3 },
++  { (void *)"\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001"
++"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
++"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
++"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
++"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
++"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
++"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
++"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
++"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
++"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065"
++"\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060"
++"\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022"
++"\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156"
++"\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164"
++"\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157"
++"\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143"
++"\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164"
++"\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001"
++"\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001"
++"\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335"
++"\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175"
++"\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163"
++"\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144"
++"\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001"
++"\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171"
++"\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313"
++"\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011"
++"\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353"
++"\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277"
++"\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331"
++"\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205"
++"\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073"
++"\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161"
++"\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371"
++"\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047"
++"\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252"
++"\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102"
++"\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064"
++"\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133"
++"\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242"
++"\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137"
++"\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325"
++"\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150"
++"\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230"
++"\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140"
++"\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347"
++"\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321"
++"\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206"
++"\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257"
++"\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164"
++"\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373"
++"\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003"
++"\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006"
++"\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006"
++"\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072"
++"\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162"
++"\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034"
++"\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162"
++"\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003"
++"\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001"
++"\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002"
++"\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101"
++"\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160"
++"\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206"
++"\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241"
++"\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072"
++"\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135"
++"\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253"
++"\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364"
++"\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172"
++"\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302"
++"\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214"
++"\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074"
++"\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154"
++"\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025"
++"\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352"
++"\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231"
++"\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213"
++"\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325"
++"\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242"
++"\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214"
++"\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027"
++"\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057"
++"\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224"
++"\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134"
++"\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356"
++"\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005"
++"\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355"
++"\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143"
++"\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123"
++"\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243"
++"\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005"
++"\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156"
++"\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317"
++"\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360"
++"\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101"
++"\322\156\245\033\231\047\200\347\013\251\250\000"
++, (PRUint32)1548 }
++};
++static const NSSItem nss_builtins_items_325 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
++  { (void *)"\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304"
++"\030\116\052\055"
++, (PRUint32)20 },
++  { (void *)"\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266"
++, (PRUint32)16 },
++  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
++"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
++"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
++"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
++"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
++"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
++"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
++"\100\143\141\143\145\162\164\056\157\162\147"
++, (PRUint32)123 },
++  { (void *)"\002\001\001"
++, (PRUint32)3 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
++static const NSSItem nss_builtins_items_326 [] = {
++  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
++  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"0", (PRUint32)2 },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
++, (PRUint32)11 },
++  { (void *)"\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000"
++"\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206"
++"\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003"
++"\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010"
++"\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125"
++"\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163"
++"\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167"
++"\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151"
++"\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003"
++"\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061"
++"\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146"
++"\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061"
++"\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026"
++"\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151"
++"\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063"
++"\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060"
++"\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125"
++"\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023"
++"\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004"
++"\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061"
++"\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141"
++"\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143"
++"\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125"
++"\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036"
++"\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151"
++"\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045"
++"\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150"
++"\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156"
++"\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
++"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
++"\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051"
++"\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074"
++"\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271"
++"\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240"
++"\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321"
++"\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265"
++"\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175"
++"\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375"
++"\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161"
++"\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342"
++"\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172"
++"\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056"
++"\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247"
++"\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310"
++"\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361"
++"\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356"
++"\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110"
++"\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151"
++"\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316"
++"\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307"
++"\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320"
++"\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205"
++"\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123"
++"\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154"
++"\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275"
++"\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356"
++"\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250"
++"\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204"
++"\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147"
++"\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305"
++"\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057"
++"\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124"
++"\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060"
++"\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161"
++"\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122"
++"\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346"
++"\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102"
++"\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061"
++"\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016"
++"\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025"
++"\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141"
++"\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037"
++"\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040"
++"\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061"
++"\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141"
++"\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103"
++"\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157"
++"\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015"
++"\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100"
++"\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216"
++"\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377"
++"\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206"
++"\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035"
++"\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102"
++"\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151"
++"\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164"
++"\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102"
++"\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141"
++"\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055"
++"\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206"
++"\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057"
++"\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143"
++"\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125"
++"\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164"
++"\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016"
++"\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015"
++"\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002"
++"\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162"
++"\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030"
++"\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255"
++"\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065"
++"\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014"
++"\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306"
++"\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051"
++"\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017"
++"\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302"
++"\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213"
++"\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017"
++"\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162"
++"\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152"
++"\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357"
++"\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266"
++"\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104"
++"\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177"
++"\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253"
++"\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206"
++"\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217"
++"\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265"
++"\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225"
++"\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140"
++"\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207"
++"\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252"
++"\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340"
++"\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254"
++"\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275"
++"\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132"
++"\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151"
++"\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005"
++"\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004"
++"\243\140"
++, (PRUint32)2066 }
++};
++static const NSSItem nss_builtins_items_327 [] = {
++  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
++  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
++  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
++  { (void *)"\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044"
++"\251\220\103\034"
++, (PRUint32)20 },
++  { (void *)"\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170"
++, (PRUint32)16 },
++  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
++"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
++"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
++"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
++"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
++"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
++"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
++"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
++"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
++"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
++"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
++"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
++, (PRUint32)191 },
++  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
++, (PRUint32)11 },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
++  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
++};
+ 
+ builtinsInternalObject
+ nss_builtins_data[] = {
+@@ -21863,11 +22406,17 @@ nss_builtins_data[] = {
+   { 11, nss_builtins_types_318, nss_builtins_items_318, {NULL} },
+   { 13, nss_builtins_types_319, nss_builtins_items_319, {NULL} },
+   { 11, nss_builtins_types_320, nss_builtins_items_320, {NULL} },
+-  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} }
++  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} },
++  { 11, nss_builtins_types_322, nss_builtins_items_322, {NULL} },
++  { 13, nss_builtins_types_323, nss_builtins_items_323, {NULL} },
++  { 11, nss_builtins_types_324, nss_builtins_items_324, {NULL} },
++  { 13, nss_builtins_types_325, nss_builtins_items_325, {NULL} },
++  { 11, nss_builtins_types_326, nss_builtins_items_326, {NULL} },
++  { 13, nss_builtins_types_327, nss_builtins_items_327, {NULL} }
+ };
+ const PRUint32
+ #ifdef DEBUG
+-  nss_builtins_nObjects = 321+1;
++  nss_builtins_nObjects = 327+1;
+ #else
+-  nss_builtins_nObjects = 321;
++  nss_builtins_nObjects = 327;
+ #endif /* DEBUG */
+diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
+index 22ed023..a8b94dd 100644
+--- a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
++++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
+@@ -22200,3 +22200,558 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
+ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
+ CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
+ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "CAcert.org Class 1 Root CA"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\000
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000
++\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
++\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
++\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
++\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
++\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
++\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
++\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
++\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
++\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063
++\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060
++\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016
++\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
++\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
++\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
++\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
++\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
++\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
++\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
++\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
++\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
++\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007
++\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002
++\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011
++\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315
++\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230
++\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272
++\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016
++\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052
++\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262
++\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140
++\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150
++\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273
++\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022
++\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234
++\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334
++\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070
++\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232
++\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044
++\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355
++\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252
++\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352
++\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276
++\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306
++\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320
++\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167
++\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335
++\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324
++\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246
++\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106
++\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272
++\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334
++\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304
++\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060
++\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265
++\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071
++\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230
++\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260
++\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016
++\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
++\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
++\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
++\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
++\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
++\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
++\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
++\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001
++\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037
++\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160
++\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157
++\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006
++\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164
++\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060
++\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045
++\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162
++\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077
++\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102
++\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165
++\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164
++\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040
++\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167
++\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006
++\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001
++\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201
++\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275
++\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234
++\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323
++\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073
++\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140
++\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353
++\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160
++\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334
++\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231
++\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116
++\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145
++\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031
++\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363
++\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330
++\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367
++\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260
++\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223
++\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335
++\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026
++\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005
++\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361
++\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371
++\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246
++\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206
++\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153
++\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344
++\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143
++\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362
++\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226
++\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175
++\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305
++\103
++END
++
++# Trust for Certificate "CAcert.org Class 1 Root CA"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106
++\166\316\217\063
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\000
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "CAcert.org Class 3 Root CA"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143
++\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004
++\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101
++\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004
++\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040
++\063\040\122\157\157\164
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\001
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001
++\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
++\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
++\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
++\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
++\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
++\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
++\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
++\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
++\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065
++\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060
++\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022
++\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156
++\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164
++\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157
++\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143
++\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164
++\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001
++\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001
++\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335
++\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175
++\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163
++\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144
++\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001
++\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171
++\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313
++\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011
++\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353
++\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277
++\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331
++\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205
++\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073
++\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161
++\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371
++\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047
++\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252
++\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102
++\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064
++\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133
++\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242
++\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137
++\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325
++\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150
++\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230
++\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140
++\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347
++\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321
++\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206
++\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257
++\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164
++\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373
++\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003
++\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006
++\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006
++\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072
++\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162
++\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034
++\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162
++\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003
++\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001
++\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002
++\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101
++\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160
++\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206
++\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241
++\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072
++\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135
++\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253
++\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364
++\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172
++\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302
++\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214
++\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074
++\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154
++\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025
++\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352
++\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231
++\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213
++\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325
++\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242
++\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214
++\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027
++\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057
++\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224
++\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134
++\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356
++\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005
++\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355
++\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143
++\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123
++\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243
++\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005
++\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156
++\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317
++\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360
++\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101
++\322\156\245\033\231\047\200\347\013\251\250\000
++END
++
++# Trust for Certificate "CAcert.org Class 3 Root CA"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304
++\030\116\052\055
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
++\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
++\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
++\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
++\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
++\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
++\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
++\100\143\141\143\145\162\164\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\001\001
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
++
++#
++# Certificate "Software in the Public Interest, Inc. Root CA (2008)"
++#
++CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
++CKA_SUBJECT MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_ID UTF8 "0"
++CKA_ISSUER MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\011\000\350\216\266\311\370\052\024\050
++END
++CKA_VALUE MULTILINE_OCTAL
++\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000
++\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206
++\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003
++\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010
++\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125
++\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163
++\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167
++\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151
++\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003
++\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061
++\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146
++\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061
++\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026
++\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151
++\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063
++\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060
++\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125
++\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023
++\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004
++\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061
++\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141
++\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143
++\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125
++\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036
++\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151
++\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045
++\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150
++\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156
++\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
++\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
++\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051
++\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074
++\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271
++\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240
++\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321
++\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265
++\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175
++\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375
++\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161
++\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342
++\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172
++\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056
++\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247
++\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310
++\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361
++\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356
++\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110
++\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151
++\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316
++\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307
++\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320
++\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205
++\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123
++\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154
++\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275
++\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356
++\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250
++\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204
++\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147
++\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305
++\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057
++\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124
++\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060
++\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161
++\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122
++\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346
++\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102
++\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061
++\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016
++\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025
++\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141
++\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037
++\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040
++\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061
++\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141
++\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103
++\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157
++\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015
++\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100
++\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216
++\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377
++\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206
++\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035
++\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102
++\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151
++\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164
++\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102
++\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141
++\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055
++\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206
++\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057
++\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143
++\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125
++\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164
++\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016
++\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015
++\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002
++\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162
++\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030
++\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255
++\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065
++\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014
++\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306
++\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051
++\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017
++\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302
++\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213
++\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017
++\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162
++\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152
++\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357
++\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266
++\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104
++\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177
++\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253
++\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206
++\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217
++\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265
++\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225
++\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140
++\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207
++\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252
++\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340
++\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254
++\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275
++\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132
++\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151
++\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005
++\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004
++\243\140
++END
++
++# Trust for Certificate "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
++CKA_TOKEN CK_BBOOL CK_TRUE
++CKA_PRIVATE CK_BBOOL CK_FALSE
++CKA_MODIFIABLE CK_BBOOL CK_FALSE
++CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
++CKA_CERT_SHA1_HASH MULTILINE_OCTAL
++\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044
++\251\220\103\034
++END
++CKA_CERT_MD5_HASH MULTILINE_OCTAL
++\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170
++END
++CKA_ISSUER MULTILINE_OCTAL
++\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
++\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
++\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
++\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
++\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
++\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
++\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
++\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
++\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
++\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
++\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
++\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
++END
++CKA_SERIAL_NUMBER MULTILINE_OCTAL
++\002\011\000\350\216\266\311\370\052\024\050
++END
++CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
++CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff --git a/main/nss/nss-config.in b/main/nss/nss-config.in
new file mode 100644
index 00000000..f8f893e7
--- /dev/null
+++ b/main/nss/nss-config.in
@@ -0,0 +1,145 @@
+#!/bin/sh
+
+prefix=@prefix@
+
+major_version=@MOD_MAJOR_VERSION@
+minor_version=@MOD_MINOR_VERSION@
+patch_version=@MOD_PATCH_VERSION@
+
+usage()
+{
+	cat <<EOF
+Usage: nss-config [OPTIONS] [LIBRARIES]
+Options:
+	[--prefix[=DIR]]
+	[--exec-prefix[=DIR]]
+	[--includedir[=DIR]]
+	[--libdir[=DIR]]
+	[--version]
+	[--libs]
+	[--cflags]
+Dynamic Libraries:
+	nss
+	nssutil
+	ssl
+	smime
+EOF
+	exit $1
+}
+
+if test $# -eq 0; then
+	usage 1 1>&2
+fi
+
+lib_ssl=yes
+lib_smime=yes
+lib_nss=yes
+lib_nssutil=yes
+
+while test $# -gt 0; do
+  case "$1" in
+  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
+  *) optarg= ;;
+  esac
+
+  case $1 in
+    --prefix=*)
+      prefix=$optarg
+      ;;
+    --prefix)
+      echo_prefix=yes
+      ;;
+    --exec-prefix=*)
+      exec_prefix=$optarg
+      ;;
+    --exec-prefix)
+      echo_exec_prefix=yes
+      ;;
+    --includedir=*)
+      includedir=$optarg
+      ;;
+    --includedir)
+      echo_includedir=yes
+      ;;
+    --libdir=*)
+      libdir=$optarg
+      ;;
+    --libdir)
+      echo_libdir=yes
+      ;;
+    --version)
+      echo ${major_version}.${minor_version}.${patch_version}
+      ;;
+    --cflags)
+      echo_cflags=yes
+      ;;
+    --libs)
+      echo_libs=yes
+      ;;
+    ssl)
+      lib_ssl=yes
+      ;;
+    smime)
+      lib_smime=yes
+      ;;
+    nss)
+      lib_nss=yes
+      ;;
+    nssutil)
+      lib_nssutil=yes
+      ;;
+    *)
+      usage 1 1>&2
+      ;;
+  esac
+  shift
+done
+
+# Set variables that may be dependent upon other variables
+if test -z "$exec_prefix"; then
+    exec_prefix=`pkg-config --variable=exec_prefix nss`
+fi
+if test -z "$includedir"; then
+    includedir=`pkg-config --variable=includedir nss`
+fi
+if test -z "$libdir"; then
+    libdir=`pkg-config --variable=libdir nss`
+fi
+
+if test "$echo_prefix" = "yes"; then
+    echo $prefix
+fi
+
+if test "$echo_exec_prefix" = "yes"; then
+    echo $exec_prefix
+fi
+
+if test "$echo_includedir" = "yes"; then
+    echo $includedir
+fi
+
+if test "$echo_libdir" = "yes"; then
+    echo $libdir
+fi
+
+if test "$echo_cflags" = "yes"; then
+    echo -I$includedir
+fi
+
+if test "$echo_libs" = "yes"; then
+      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
+      if test -n "$lib_ssl"; then
+	libdirs="$libdirs -lssl${major_version}"
+      fi
+      if test -n "$lib_smime"; then
+	libdirs="$libdirs -lsmime${major_version}"
+      fi
+      if test -n "$lib_nss"; then
+	libdirs="$libdirs -lnss${major_version}"
+      fi
+      if test -n "$lib_nssutil"; then
+	libdirs="$libdirs -lnssutil${major_version}"
+      fi
+      echo $libdirs
+fi      
+
diff --git a/main/nss/nss-no-rpath.patch b/main/nss/nss-no-rpath.patch
new file mode 100644
index 00000000..35ea5731
--- /dev/null
+++ b/main/nss/nss-no-rpath.patch
@@ -0,0 +1,14 @@
+--- ./mozilla/security/nss/cmd/platlibs.mk.withrpath	2007-02-19 07:17:06.000000000 +0100
++++ ./mozilla/security/nss/cmd/platlibs.mk	2007-02-19 07:18:07.000000000 +0100
+@@ -52,9 +52,9 @@
+ 
+ ifeq ($(OS_ARCH), Linux)
+ ifeq ($(USE_64), 1)
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
++#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
+ else
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
++#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
+ endif
+ endif
+ 
diff --git a/main/nss/nss-nolocalsql.patch b/main/nss/nss-nolocalsql.patch
new file mode 100644
index 00000000..dc75a223
--- /dev/null
+++ b/main/nss/nss-nolocalsql.patch
@@ -0,0 +1,52 @@
+diff -up ./mozilla/security/nss/lib/Makefile.nolocalsql ./mozilla/security/nss/lib/Makefile
+--- ./mozilla/security/nss/lib/Makefile.nolocalsql	2010-02-27 16:40:25.891777537 -0800
++++ ./mozilla/security/nss/lib/Makefile	2010-02-27 16:41:59.175902327 -0800
+@@ -62,11 +62,11 @@ ifndef USE_SYSTEM_ZLIB
+ ZLIB_SRCDIR = zlib  # Add the zlib directory to DIRS.
+ endif
+ 
+-ifndef MOZILLA_CLIENT
+-ifndef NSS_USE_SYSTEM_SQLITE
+-SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
+-endif
+-endif
++#ifndef MOZILLA_CLIENT
++#ifndef NSS_USE_SYSTEM_SQLITE
++#SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
++#endif
++#endif
+ 
+ ifndef MOZILLA_CLIENT
+ ifeq ($(OS_ARCH),Linux)
+diff -up ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn
+--- ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql	2010-02-27 16:44:24.998777709 -0800
++++ ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn	2010-02-27 16:45:08.533803472 -0800
+@@ -46,9 +46,9 @@ MAPFILE = $(OBJDIR)/nssdbm.def
+ 
+ DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\"
+ 
+-ifdef MOZILLA_CLIENT
+-INCLUDES += -I$(DIST)/include/sqlite3
+-endif
++#ifdef MOZILLA_CLIENT
++#INCLUDES += -I$(DIST)/include/sqlite3
++#endif
+ 
+ CSRCS = \
+ 	dbmshim.c \
+diff -up ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/manifest.mn
+--- ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql	2010-02-27 16:42:52.213902231 -0800
++++ ./mozilla/security/nss/lib/softoken/manifest.mn	2010-02-27 16:43:34.040776788 -0800
+@@ -47,9 +47,9 @@ MAPFILE = $(OBJDIR)/softokn.def
+ 
+ DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
+ 
+-ifdef MOZILLA_CLIENT
+-INCLUDES += -I$(DIST)/include/sqlite3
+-endif
++#ifdef MOZILLA_CLIENT
++#INCLUDES += -I$(DIST)/include/sqlite3
++#endif
+ 
+ EXPORTS = \
+ 	secmodt.h \
diff --git a/main/nss/nss.pc.in b/main/nss/nss.pc.in
new file mode 100644
index 00000000..d47b9e14
--- /dev/null
+++ b/main/nss/nss.pc.in
@@ -0,0 +1,11 @@
+prefix=%prefix%
+exec_prefix=%exec_prefix%
+libdir=%libdir%
+includedir=%includedir%
+
+Name: NSS
+Description: Network Security Services
+Version: %NSS_VERSION%
+Requires: nspr >= %NSPR_VERSION%
+Libs: -lssl3 -lsmime3 -lnss3 -lnssutil3
+Cflags: -I${includedir}
diff --git a/main/nss/ssl-renegotiate-transitional.patch b/main/nss/ssl-renegotiate-transitional.patch
new file mode 100644
index 00000000..f457c555
--- /dev/null
+++ b/main/nss/ssl-renegotiate-transitional.patch
@@ -0,0 +1,21 @@
+Enable transitional scheme for ssl renegotiation:
+
+(from mozilla/security/nss/lib/ssl/ssl.h)
+Disallow unsafe renegotiation in server sockets only, but allow clients
+to continue to renegotiate with vulnerable servers.
+This value should only be used during the transition period when few
+servers have been upgraded.
+
+diff --git a/mozilla/security/nss/lib/ssl/sslsock.c b/mozilla/security/nss/lib/ssl/sslsock.c
+index f1d1921..c074360 100644
+--- a/mozilla/security/nss/lib/ssl/sslsock.c
++++ b/mozilla/security/nss/lib/ssl/sslsock.c
+@@ -181,7 +181,7 @@ static sslOptions ssl_defaults = {
+     PR_FALSE,   /* noLocks            */
+     PR_FALSE,   /* enableSessionTickets */
+     PR_FALSE,   /* enableDeflate      */
+-    2,          /* enableRenegotiation (default: requires extension) */
++    3,          /* enableRenegotiation (default: transitional) */
+     PR_FALSE,   /* requireSafeNegotiation */
+ };
+ 
diff --git a/testing/nss/APKBUILD b/testing/nss/APKBUILD
deleted file mode 100644
index c795669e..00000000
--- a/testing/nss/APKBUILD
+++ /dev/null
@@ -1,119 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=nss
-pkgver=3.12.6
-_ver=3_12_6
-pkgrel=0
-pkgdesc="Mozilla Network Security Services"
-url="http://www.mozilla.org/projects/security/pki/nss/"
-license="MPL GPL"
-depends=
-makedepends="nspr-dev sqlite-dev zlib-dev perl"
-subpackages="$pkgname-dev libnss"
-source="ftp://ftp.mozilla.org/pub/security/$pkgname/releases/NSS_${_ver}_RTM/src/$pkgname-$pkgver.tar.gz
-	nss-nolocalsql.patch
-	nss-no-rpath.patch
-	nss.pc.in
-	nss-config.in
-	add_spi+cacert_ca_certs.patch
-	ssl-renegotiate-transitional.patch"
-depends_dev="nspr-dev"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-prepare() { 
-	cd "$_builddir"
-	patch -Np1 -i ""$srcdir"/add_spi+cacert_ca_certs.patch" || return 1
-	patch -Np1 -i ""$srcdir"/ssl-renegotiate-transitional.patch" || return 1
-	patch -Np0 -i ""$srcdir"/nss-nolocalsql.patch" || return 1
-	patch -Np0 -i ""$srcdir"/nss-no-rpath.patch" || return 1
-
-	# Respect LDFLAGS
-	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' \
-		mozilla/security/coreconf/rules.mk
-
-}
-
-build() { 
-	cd "$_builddir"
-	unset CFLAGS
-	unset CXXFLAGS
-	export BUILD_OPT=1
-	export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
-	export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
-	export NSPR_INCLUDE_DIR=`pkg-config --cflags-only-I nspr | sed 's/-I//'`
-	export NSPR_LIB_DIR=`pkg-config --libs-only-L nspr | sed 's/-L.//'`
-	export XCFLAGS="${CFLAGS}"
-	make -j 1 -C mozilla/security/coreconf || return 1
-	make -j 1 -C mozilla/security/dbm || return 1
-	make -j 1 -C mozilla/security/nss || return 1
-}
-
-package() {
-	cd "$_builddir"
-	install -m755 -d "$pkgdir"/usr/lib/pkgconfig
-	install -m755 -d "$pkgdir"/usr/bin
-	install -m755 -d "$pkgdir"/usr/include/nss
-
-	NSS_VMAJOR=`awk '/#define.*NSS_VMAJOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h `
-	msg "DEBUG: $NSS_VMAJOR"
-	NSS_VMINOR=`awk '/#define.*NSS_VMINOR/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
-	NSS_VPATCH=`awk '/#define.*NSS_VPATCH"/ {print $3}' mozilla/security/nss/lib/nss/nss.h`
-
-	# pkgconfig files
-	sed "$srcdir"/nss.pc.in \
-		-e "s,%libdir%,/usr/lib,g" \
-		-e "s,%prefix%,/usr,g" \
-		-e "s,%exec_prefix%,/usr/bin,g" \
-		-e "s,%includedir%,/usr/include/nss,g" \
-		-e "s,%NSPR_VERSION%,$pkgver,g" \
-		-e "s,%NSS_VERSION%,$pkgver,g" \
-		> "$pkgdir"/usr/lib/pkgconfig/nss.pc \
-		|| return 1
-	ln -sf nss.pc "$pkgdir"/usr/lib/pkgconfig/mozilla-nss.pc || return 1
-	chmod 644 "$pkgdir"/usr/lib/pkgconfig/*.pc || return 1
-
-	# nss-config
-	sed "$srcdir"/nss-config.in \
-		-e "s,@libdir@,/usr/lib,g" \
-		-e "s,@prefix@,/usr/bin,g" \
-		-e "s,@exec_prefix@,/usr/bin,g" \
-		-e "s,@includedir@,/usr/include/nss,g" \
-		-e "s,@MOD_MAJOR_VERSION@,${NSS_VMAJOR},g" \
-		-e "s,@MOD_MINOR_VERSION@,${NSS_VMINOR},g" \
-		-e "s,@MOD_PATCH_VERSION@,${NSS_VPATCH},g" \
-		> "$pkgdir"/usr/bin/nss-config || return 1
-	chmod 755 "$pkgdir"/usr/bin/nss-config || return 1
-	local minor=${pkgver#*.}
-	minor=${minor%.*}
-	for file in libsoftokn3.so libfreebl3.so libnss3.so libnssutil3.so \
-			libssl3.so libsmime3.so libnssckbi.so libnssdbm3.so; do
-		install -m755 mozilla/dist/*.OBJ/lib/${file} \
-			"$pkgdir"/usr/lib/${file}.$minor || return 1
-		ln -s $file.$minor "$pkgdir"/usr/lib/$file
-	done
-	install -m644 mozilla/dist/*.OBJ/lib/libcrmf.a "$pkgdir"/usr/lib/ \
-		|| return 1
-	install -m644 mozilla/dist/*.OBJ/lib/*.chk "$pkgdir"/usr/lib/ \
-		|| return 1
-	
-	for file in certutil cmsutil crlutil modutil pk12util shlibsign \
-			signtool signver ssltap; do
-		install -m755 mozilla/dist/*.OBJ/bin/${file} "$pkgdir"/usr/bin/\
-			|| return 1
-	done
-	install -m644 mozilla/dist/public/nss/*.h "$pkgdir"/usr/include/nss/ \
-		|| return 1
-}
-
-libnss() {
-	pkgdesc="Mozilla Network Security Service libraries"
-	mkdir -p "$subpkgdir"/usr/
-	mv "$pkgdir"/usr/lib "$subpkgdir"/usr
-}
-
-md5sums="da42596665f226de5eb3ecfc1ec57cd1  nss-3.12.6.tar.gz
-1d8305dc458d28c6f32746d9132b9873  nss-nolocalsql.patch
-e5c97db0c884d5f4cfda21e562dc9bba  nss-no-rpath.patch
-c547b030c57fe1ed8b77c73bf52b3ded  nss.pc.in
-46bee81908f1e5b26d6a7a2e14c64d9f  nss-config.in
-a744b499e7da252acd9ac8ff09af3d48  add_spi+cacert_ca_certs.patch
-d83c7b61abb7e9f8f7bcd157183d1ade  ssl-renegotiate-transitional.patch"
diff --git a/testing/nss/add_spi+cacert_ca_certs.patch b/testing/nss/add_spi+cacert_ca_certs.patch
deleted file mode 100644
index a8969ee4..00000000
--- a/testing/nss/add_spi+cacert_ca_certs.patch
+++ /dev/null
@@ -1,1168 +0,0 @@
-## 95_add_spi+cacert_ca_certs.patch by martin f. krafft <madduck@debian.org>
-##
-## All lines beginning with `## DP:' are a description of the patch.
-## DP: Adds the SPI Inc. and CAcert.org CA certificates
-
-diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.c b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
-index 2c6fdab..2fb754c 100644
---- a/mozilla/security/nss/lib/ckfw/builtins/certdata.c
-+++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.c
-@@ -35,7 +35,7 @@
-  *
-  * ***** END LICENSE BLOCK ***** */
- #ifdef DEBUG
--static const char CVS_ID[] = "@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $";
-+static const char CVS_ID[] = "@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $";
- #endif /* DEBUG */
- 
- #ifndef BUILTINS_H
-@@ -1020,6 +1020,24 @@ static const CK_ATTRIBUTE_TYPE nss_builtins_types_320 [] = {
- static const CK_ATTRIBUTE_TYPE nss_builtins_types_321 [] = {
-  CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
- };
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_322 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
-+};
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_323 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
-+};
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_324 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
-+};
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_325 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
-+};
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_326 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERTIFICATE_TYPE,  CKA_SUBJECT,  CKA_ID,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_VALUE
-+};
-+static const CK_ATTRIBUTE_TYPE nss_builtins_types_327 [] = {
-+ CKA_CLASS,  CKA_TOKEN,  CKA_PRIVATE,  CKA_MODIFIABLE,  CKA_LABEL,  CKA_CERT_SHA1_HASH,  CKA_CERT_MD5_HASH,  CKA_ISSUER,  CKA_SERIAL_NUMBER,  CKA_TRUST_SERVER_AUTH,  CKA_TRUST_EMAIL_PROTECTION,  CKA_TRUST_CODE_SIGNING,  CKA_TRUST_STEP_UP_APPROVED
-+};
- #ifdef DEBUG
- static const NSSItem nss_builtins_items_0 [] = {
-   { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-@@ -1028,7 +1046,7 @@ static const NSSItem nss_builtins_items_0 [] = {
-   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-   { (void *)"CVS ID", (PRUint32)7 },
-   { (void *)"NSS", (PRUint32)4 },
--  { (void *)"@(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $""; @(#) $RCSfile: certdata.c,v $ $Revision: 1.59 $ $Date: 2010/02/16 22:14:34 $", (PRUint32)160 }
-+  { (void *)"@(#) $RCSfile: certdata.txt,v $ $Revision: 1.58 $ $Date: 2010/02/16 22:14:35 $""; @(#) $RCSfile: certdata.perl,v $ $Revision: 1.12 $ $Date: 2008/01/23 07:34:49 $", (PRUint32)160 }
- };
- #endif /* DEBUG */
- static const NSSItem nss_builtins_items_1 [] = {
-@@ -21537,6 +21555,531 @@ static const NSSItem nss_builtins_items_321 [] = {
-   { (void *)&ckt_netscape_trust_unknown, (PRUint32)sizeof(CK_TRUST) },
-   { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
- };
-+static const NSSItem nss_builtins_items_322 [] = {
-+  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
-+  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
-+  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
-+"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
-+"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
-+"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
-+"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
-+"\100\143\141\143\145\162\164\056\157\162\147"
-+, (PRUint32)123 },
-+  { (void *)"0", (PRUint32)2 },
-+  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
-+"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
-+"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
-+"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
-+"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
-+"\100\143\141\143\145\162\164\056\157\162\147"
-+, (PRUint32)123 },
-+  { (void *)"\002\001\000"
-+, (PRUint32)3 },
-+  { (void *)"\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000"
-+"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
-+"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
-+"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
-+"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
-+"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
-+"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
-+"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
-+"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
-+"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063"
-+"\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060"
-+"\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016"
-+"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
-+"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
-+"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
-+"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
-+"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
-+"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
-+"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
-+"\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
-+"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
-+"\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007"
-+"\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002"
-+"\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011"
-+"\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315"
-+"\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230"
-+"\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272"
-+"\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016"
-+"\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052"
-+"\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262"
-+"\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140"
-+"\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150"
-+"\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273"
-+"\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022"
-+"\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234"
-+"\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334"
-+"\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070"
-+"\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232"
-+"\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044"
-+"\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355"
-+"\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252"
-+"\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352"
-+"\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276"
-+"\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306"
-+"\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320"
-+"\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167"
-+"\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335"
-+"\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324"
-+"\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246"
-+"\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106"
-+"\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272"
-+"\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334"
-+"\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304"
-+"\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060"
-+"\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265"
-+"\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071"
-+"\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230"
-+"\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260"
-+"\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016"
-+"\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036"
-+"\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057"
-+"\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042"
-+"\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164"
-+"\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151"
-+"\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011"
-+"\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162"
-+"\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001"
-+"\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037"
-+"\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160"
-+"\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157"
-+"\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006"
-+"\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164"
-+"\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060"
-+"\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045"
-+"\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162"
-+"\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077"
-+"\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102"
-+"\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165"
-+"\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164"
-+"\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040"
-+"\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167"
-+"\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006"
-+"\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001"
-+"\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201"
-+"\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275"
-+"\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234"
-+"\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323"
-+"\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073"
-+"\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140"
-+"\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353"
-+"\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160"
-+"\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334"
-+"\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231"
-+"\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116"
-+"\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145"
-+"\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031"
-+"\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363"
-+"\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330"
-+"\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367"
-+"\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260"
-+"\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223"
-+"\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335"
-+"\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026"
-+"\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005"
-+"\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361"
-+"\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371"
-+"\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246"
-+"\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206"
-+"\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153"
-+"\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344"
-+"\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143"
-+"\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362"
-+"\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226"
-+"\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175"
-+"\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305"
-+"\103"
-+, (PRUint32)1857 }
-+};
-+static const NSSItem nss_builtins_items_323 [] = {
-+  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"CAcert.org Class 1 Root CA", (PRUint32)27 },
-+  { (void *)"\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106"
-+"\166\316\217\063"
-+, (PRUint32)20 },
-+  { (void *)"\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153"
-+, (PRUint32)16 },
-+  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
-+"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
-+"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
-+"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
-+"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
-+"\100\143\141\143\145\162\164\056\157\162\147"
-+, (PRUint32)123 },
-+  { (void *)"\002\001\000"
-+, (PRUint32)3 },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
-+};
-+static const NSSItem nss_builtins_items_324 [] = {
-+  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
-+  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
-+  { (void *)"\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143"
-+"\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004"
-+"\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101"
-+"\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004"
-+"\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040"
-+"\063\040\122\157\157\164"
-+, (PRUint32)86 },
-+  { (void *)"0", (PRUint32)2 },
-+  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
-+"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
-+"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
-+"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
-+"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
-+"\100\143\141\143\145\162\164\056\157\162\147"
-+, (PRUint32)123 },
-+  { (void *)"\002\001\001"
-+, (PRUint32)3 },
-+  { (void *)"\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001"
-+"\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060"
-+"\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164"
-+"\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164"
-+"\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056"
-+"\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101"
-+"\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165"
-+"\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110"
-+"\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100"
-+"\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065"
-+"\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060"
-+"\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022"
-+"\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156"
-+"\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164"
-+"\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157"
-+"\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143"
-+"\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164"
-+"\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001"
-+"\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001"
-+"\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335"
-+"\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175"
-+"\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163"
-+"\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144"
-+"\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001"
-+"\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171"
-+"\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313"
-+"\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011"
-+"\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353"
-+"\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277"
-+"\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331"
-+"\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205"
-+"\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073"
-+"\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161"
-+"\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371"
-+"\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047"
-+"\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252"
-+"\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102"
-+"\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064"
-+"\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133"
-+"\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242"
-+"\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137"
-+"\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325"
-+"\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150"
-+"\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230"
-+"\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140"
-+"\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347"
-+"\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321"
-+"\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206"
-+"\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257"
-+"\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164"
-+"\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373"
-+"\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003"
-+"\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006"
-+"\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006"
-+"\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072"
-+"\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162"
-+"\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034"
-+"\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162"
-+"\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003"
-+"\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001"
-+"\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002"
-+"\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101"
-+"\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160"
-+"\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206"
-+"\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241"
-+"\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072"
-+"\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135"
-+"\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253"
-+"\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364"
-+"\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172"
-+"\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302"
-+"\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214"
-+"\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074"
-+"\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154"
-+"\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025"
-+"\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352"
-+"\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231"
-+"\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213"
-+"\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325"
-+"\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242"
-+"\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214"
-+"\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027"
-+"\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057"
-+"\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224"
-+"\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134"
-+"\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356"
-+"\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005"
-+"\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355"
-+"\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143"
-+"\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123"
-+"\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243"
-+"\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005"
-+"\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156"
-+"\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317"
-+"\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360"
-+"\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101"
-+"\322\156\245\033\231\047\200\347\013\251\250\000"
-+, (PRUint32)1548 }
-+};
-+static const NSSItem nss_builtins_items_325 [] = {
-+  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"CAcert.org Class 3 Root CA", (PRUint32)27 },
-+  { (void *)"\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304"
-+"\030\116\052\055"
-+, (PRUint32)20 },
-+  { (void *)"\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266"
-+, (PRUint32)16 },
-+  { (void *)"\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157"
-+"\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150"
-+"\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164"
-+"\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103"
-+"\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101"
-+"\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164"
-+"\100\143\141\143\145\162\164\056\157\162\147"
-+, (PRUint32)123 },
-+  { (void *)"\002\001\001"
-+, (PRUint32)3 },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
-+};
-+static const NSSItem nss_builtins_items_326 [] = {
-+  { (void *)&cko_certificate, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
-+  { (void *)&ckc_x_509, (PRUint32)sizeof(CK_CERTIFICATE_TYPE) },
-+  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
-+"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
-+"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
-+"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
-+"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
-+"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
-+"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
-+"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
-+"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
-+"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
-+"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
-+, (PRUint32)191 },
-+  { (void *)"0", (PRUint32)2 },
-+  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
-+"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
-+"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
-+"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
-+"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
-+"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
-+"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
-+"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
-+"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
-+"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
-+"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
-+, (PRUint32)191 },
-+  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
-+, (PRUint32)11 },
-+  { (void *)"\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000"
-+"\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206"
-+"\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003"
-+"\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010"
-+"\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125"
-+"\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163"
-+"\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167"
-+"\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151"
-+"\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003"
-+"\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061"
-+"\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146"
-+"\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061"
-+"\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026"
-+"\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151"
-+"\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063"
-+"\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060"
-+"\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125"
-+"\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023"
-+"\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004"
-+"\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061"
-+"\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141"
-+"\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143"
-+"\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125"
-+"\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036"
-+"\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151"
-+"\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045"
-+"\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150"
-+"\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156"
-+"\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110"
-+"\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002"
-+"\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051"
-+"\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074"
-+"\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271"
-+"\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240"
-+"\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321"
-+"\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265"
-+"\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175"
-+"\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375"
-+"\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161"
-+"\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342"
-+"\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172"
-+"\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056"
-+"\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247"
-+"\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310"
-+"\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361"
-+"\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356"
-+"\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110"
-+"\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151"
-+"\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316"
-+"\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307"
-+"\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320"
-+"\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205"
-+"\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123"
-+"\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154"
-+"\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275"
-+"\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356"
-+"\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250"
-+"\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204"
-+"\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147"
-+"\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305"
-+"\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057"
-+"\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124"
-+"\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060"
-+"\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161"
-+"\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122"
-+"\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346"
-+"\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102"
-+"\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061"
-+"\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016"
-+"\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025"
-+"\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141"
-+"\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037"
-+"\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040"
-+"\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061"
-+"\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141"
-+"\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103"
-+"\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157"
-+"\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015"
-+"\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100"
-+"\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216"
-+"\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377"
-+"\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206"
-+"\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035"
-+"\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102"
-+"\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151"
-+"\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164"
-+"\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102"
-+"\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141"
-+"\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055"
-+"\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206"
-+"\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057"
-+"\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143"
-+"\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125"
-+"\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164"
-+"\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016"
-+"\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015"
-+"\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002"
-+"\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162"
-+"\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030"
-+"\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255"
-+"\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065"
-+"\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014"
-+"\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306"
-+"\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051"
-+"\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017"
-+"\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302"
-+"\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213"
-+"\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017"
-+"\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162"
-+"\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152"
-+"\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357"
-+"\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266"
-+"\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104"
-+"\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177"
-+"\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253"
-+"\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206"
-+"\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217"
-+"\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265"
-+"\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225"
-+"\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140"
-+"\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207"
-+"\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252"
-+"\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340"
-+"\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254"
-+"\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275"
-+"\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132"
-+"\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151"
-+"\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005"
-+"\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004"
-+"\243\140"
-+, (PRUint32)2066 }
-+};
-+static const NSSItem nss_builtins_items_327 [] = {
-+  { (void *)&cko_netscape_trust, (PRUint32)sizeof(CK_OBJECT_CLASS) },
-+  { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
-+  { (void *)"Software in the Public Interest, Inc. Root CA (2008)", (PRUint32)53 },
-+  { (void *)"\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044"
-+"\251\220\103\034"
-+, (PRUint32)20 },
-+  { (void *)"\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170"
-+, (PRUint32)16 },
-+  { (void *)"\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123"
-+"\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141"
-+"\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144"
-+"\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125"
-+"\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040"
-+"\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162"
-+"\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157"
-+"\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004"
-+"\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101"
-+"\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206"
-+"\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163"
-+"\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147"
-+, (PRUint32)191 },
-+  { (void *)"\002\011\000\350\216\266\311\370\052\024\050"
-+, (PRUint32)11 },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ckt_netscape_trusted_delegator, (PRUint32)sizeof(CK_TRUST) },
-+  { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) }
-+};
- 
- builtinsInternalObject
- nss_builtins_data[] = {
-@@ -21863,11 +22406,17 @@ nss_builtins_data[] = {
-   { 11, nss_builtins_types_318, nss_builtins_items_318, {NULL} },
-   { 13, nss_builtins_types_319, nss_builtins_items_319, {NULL} },
-   { 11, nss_builtins_types_320, nss_builtins_items_320, {NULL} },
--  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} }
-+  { 13, nss_builtins_types_321, nss_builtins_items_321, {NULL} },
-+  { 11, nss_builtins_types_322, nss_builtins_items_322, {NULL} },
-+  { 13, nss_builtins_types_323, nss_builtins_items_323, {NULL} },
-+  { 11, nss_builtins_types_324, nss_builtins_items_324, {NULL} },
-+  { 13, nss_builtins_types_325, nss_builtins_items_325, {NULL} },
-+  { 11, nss_builtins_types_326, nss_builtins_items_326, {NULL} },
-+  { 13, nss_builtins_types_327, nss_builtins_items_327, {NULL} }
- };
- const PRUint32
- #ifdef DEBUG
--  nss_builtins_nObjects = 321+1;
-+  nss_builtins_nObjects = 327+1;
- #else
--  nss_builtins_nObjects = 321;
-+  nss_builtins_nObjects = 327;
- #endif /* DEBUG */
-diff --git a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
-index 22ed023..a8b94dd 100644
---- a/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
-+++ b/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
-@@ -22200,3 +22200,558 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
- CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
- CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUST_UNKNOWN
- CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-+
-+#
-+# Certificate "CAcert.org Class 1 Root CA"
-+#
-+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
-+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-+CKA_SUBJECT MULTILINE_OCTAL
-+\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
-+\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
-+\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
-+\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
-+\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
-+\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
-+\100\143\141\143\145\162\164\056\157\162\147
-+END
-+CKA_ID UTF8 "0"
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
-+\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
-+\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
-+\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
-+\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
-+\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
-+\100\143\141\143\145\162\164\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\001\000
-+END
-+CKA_VALUE MULTILINE_OCTAL
-+\060\202\007\075\060\202\005\045\240\003\002\001\002\002\001\000
-+\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
-+\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
-+\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
-+\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
-+\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
-+\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
-+\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
-+\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
-+\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\063
-+\060\063\063\060\061\062\062\071\064\071\132\027\015\063\063\060
-+\063\062\071\061\062\062\071\064\071\132\060\171\061\020\060\016
-+\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
-+\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
-+\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
-+\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
-+\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
-+\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
-+\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
-+\164\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
-+\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
-+\012\002\202\002\001\000\316\042\300\342\106\175\354\066\050\007
-+\120\226\362\240\063\100\214\113\361\073\146\077\061\345\153\002
-+\066\333\326\174\366\361\210\217\116\167\066\005\101\225\371\011
-+\360\022\317\106\206\163\140\267\156\176\350\300\130\144\256\315
-+\260\255\105\027\014\143\372\147\012\350\326\322\277\076\347\230
-+\304\360\114\372\340\003\273\065\135\154\041\336\236\040\331\272
-+\315\146\062\067\162\372\367\010\365\307\315\130\311\216\347\016
-+\136\352\076\376\034\241\024\012\025\154\206\204\133\144\146\052
-+\172\251\113\123\171\365\210\242\173\356\057\012\141\053\215\262
-+\176\115\126\245\023\354\352\332\222\236\254\104\101\036\130\140
-+\145\005\146\370\300\104\275\313\224\367\102\176\013\367\145\150
-+\230\121\005\360\363\005\221\004\035\033\027\202\354\310\127\273
-+\303\153\172\210\361\260\162\314\045\133\040\221\354\026\002\022
-+\217\062\351\027\030\110\320\307\005\056\002\060\102\270\045\234
-+\005\153\077\252\072\247\353\123\110\367\350\322\266\007\230\334
-+\033\306\064\177\177\311\034\202\172\005\130\053\010\133\363\070
-+\242\253\027\135\146\311\230\327\236\020\213\242\322\335\164\232
-+\367\161\014\162\140\337\315\157\230\063\235\226\064\166\076\044
-+\172\222\260\016\225\036\157\346\240\105\070\107\252\327\101\355
-+\112\267\022\366\327\033\203\212\017\056\330\011\266\131\327\252
-+\004\377\322\223\175\150\056\335\213\113\253\130\272\057\215\352
-+\225\247\240\303\124\211\245\373\333\213\121\042\235\262\303\276
-+\021\276\054\221\206\213\226\170\255\040\323\212\057\032\077\306
-+\320\121\145\207\041\261\031\001\145\177\105\034\207\365\174\320
-+\101\114\117\051\230\041\375\063\037\165\014\004\121\372\031\167
-+\333\324\024\034\356\201\303\035\365\230\267\151\006\221\042\335
-+\000\120\314\201\061\254\022\007\173\070\332\150\133\346\053\324
-+\176\311\137\255\350\353\162\114\363\001\345\113\040\277\232\246
-+\127\312\221\000\001\213\241\165\041\067\265\143\015\147\076\106
-+\117\160\040\147\316\305\326\131\333\002\340\360\322\313\315\272
-+\142\267\220\101\350\335\040\344\051\274\144\051\102\310\042\334
-+\170\232\377\103\354\230\033\011\121\113\132\132\302\161\361\304
-+\313\163\251\345\241\013\002\003\001\000\001\243\202\001\316\060
-+\202\001\312\060\035\006\003\125\035\016\004\026\004\024\026\265
-+\062\033\324\307\363\340\346\216\363\275\322\260\072\356\262\071
-+\030\321\060\201\243\006\003\125\035\043\004\201\233\060\201\230
-+\200\024\026\265\062\033\324\307\363\340\346\216\363\275\322\260
-+\072\356\262\071\030\321\241\175\244\173\060\171\061\020\060\016
-+\006\003\125\004\012\023\007\122\157\157\164\040\103\101\061\036
-+\060\034\006\003\125\004\013\023\025\150\164\164\160\072\057\057
-+\167\167\167\056\143\141\143\145\162\164\056\157\162\147\061\042
-+\060\040\006\003\125\004\003\023\031\103\101\040\103\145\162\164
-+\040\123\151\147\156\151\156\147\040\101\165\164\150\157\162\151
-+\164\171\061\041\060\037\006\011\052\206\110\206\367\015\001\011
-+\001\026\022\163\165\160\160\157\162\164\100\143\141\143\145\162
-+\164\056\157\162\147\202\001\000\060\017\006\003\125\035\023\001
-+\001\377\004\005\060\003\001\001\377\060\062\006\003\125\035\037
-+\004\053\060\051\060\047\240\045\240\043\206\041\150\164\164\160
-+\163\072\057\057\167\167\167\056\143\141\143\145\162\164\056\157
-+\162\147\057\162\145\166\157\153\145\056\143\162\154\060\060\006
-+\011\140\206\110\001\206\370\102\001\004\004\043\026\041\150\164
-+\164\160\163\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\057\162\145\166\157\153\145\056\143\162\154\060
-+\064\006\011\140\206\110\001\206\370\102\001\010\004\047\026\045
-+\150\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162
-+\164\056\157\162\147\057\151\156\144\145\170\056\160\150\160\077
-+\151\144\075\061\060\060\126\006\011\140\206\110\001\206\370\102
-+\001\015\004\111\026\107\124\157\040\147\145\164\040\171\157\165
-+\162\040\157\167\156\040\143\145\162\164\151\146\151\143\141\164
-+\145\040\146\157\162\040\106\122\105\105\040\150\145\141\144\040
-+\157\166\145\162\040\164\157\040\150\164\164\160\072\057\057\167
-+\167\167\056\143\141\143\145\162\164\056\157\162\147\060\015\006
-+\011\052\206\110\206\367\015\001\001\004\005\000\003\202\002\001
-+\000\050\307\356\234\202\002\272\134\200\022\312\065\012\035\201
-+\157\211\152\231\314\362\150\017\177\247\341\215\130\225\076\275
-+\362\006\303\220\132\254\265\140\366\231\103\001\243\210\160\234
-+\235\142\235\244\207\257\147\130\015\060\066\073\346\255\110\323
-+\313\164\002\206\161\076\342\053\003\150\361\064\142\100\106\073
-+\123\352\050\364\254\373\146\225\123\212\115\135\375\073\331\140
-+\327\312\171\151\073\261\145\222\246\306\201\202\134\234\315\353
-+\115\001\212\245\337\021\125\252\025\312\037\067\300\202\230\160
-+\141\333\152\174\226\243\216\056\124\076\117\041\251\220\357\334
-+\202\277\334\350\105\255\115\220\163\010\074\224\145\260\004\231
-+\166\177\342\274\302\152\025\252\227\004\067\044\330\036\224\116
-+\155\016\121\276\326\304\217\312\226\155\367\103\337\350\060\145
-+\047\073\173\273\103\103\143\304\103\367\262\354\150\314\341\031
-+\216\042\373\230\341\173\132\076\001\067\073\213\010\260\242\363
-+\225\116\032\313\233\315\232\261\333\262\160\360\055\112\333\330
-+\260\343\157\105\110\063\022\377\376\074\062\052\124\367\304\367
-+\212\360\210\043\302\107\376\144\172\161\300\321\036\246\143\260
-+\007\176\244\057\323\001\217\334\237\053\266\306\010\251\017\223
-+\110\045\374\022\375\237\102\334\363\304\076\366\127\260\327\335
-+\151\321\006\167\064\012\113\322\312\240\377\034\306\214\311\026
-+\276\304\314\062\067\150\163\137\010\373\121\367\111\123\066\005
-+\012\225\002\114\362\171\032\020\366\330\072\165\234\363\035\361
-+\242\015\160\147\206\033\263\026\365\057\345\244\353\171\206\371
-+\075\013\302\163\013\245\231\254\157\374\147\270\345\057\013\246
-+\030\044\215\173\321\110\065\051\030\100\254\223\140\341\226\206
-+\120\264\172\131\330\217\041\013\237\317\202\221\306\073\277\153
-+\334\007\221\271\227\126\043\252\266\154\224\306\110\006\074\344
-+\316\116\252\344\366\057\011\334\123\157\056\374\164\353\072\143
-+\231\302\246\254\211\274\247\262\104\240\015\212\020\343\154\362
-+\044\313\372\233\237\160\107\056\336\024\213\324\262\040\011\226
-+\242\144\361\044\034\334\241\065\234\025\262\324\274\125\056\175
-+\006\365\234\016\125\364\132\326\223\332\166\255\045\163\114\305
-+\103
-+END
-+
-+# Trust for Certificate "CAcert.org Class 1 Root CA"
-+CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "CAcert.org Class 1 Root CA"
-+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-+\023\134\354\066\364\234\270\351\073\032\262\160\315\200\210\106
-+\166\316\217\063
-+END
-+CKA_CERT_MD5_HASH MULTILINE_OCTAL
-+\246\033\067\136\071\015\234\066\124\356\275\040\061\106\037\153
-+END
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
-+\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
-+\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
-+\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
-+\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
-+\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
-+\100\143\141\143\145\162\164\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\001\000
-+END
-+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-+
-+#
-+# Certificate "CAcert.org Class 3 Root CA"
-+#
-+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
-+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-+CKA_SUBJECT MULTILINE_OCTAL
-+\060\124\061\024\060\022\006\003\125\004\012\023\013\103\101\143
-+\145\162\164\040\111\156\143\056\061\036\060\034\006\003\125\004
-+\013\023\025\150\164\164\160\072\057\057\167\167\167\056\103\101
-+\143\145\162\164\056\157\162\147\061\034\060\032\006\003\125\004
-+\003\023\023\103\101\143\145\162\164\040\103\154\141\163\163\040
-+\063\040\122\157\157\164
-+END
-+CKA_ID UTF8 "0"
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
-+\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
-+\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
-+\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
-+\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
-+\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
-+\100\143\141\143\145\162\164\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\001\001
-+END
-+CKA_VALUE MULTILINE_OCTAL
-+\060\202\006\010\060\202\003\360\240\003\002\001\002\002\001\001
-+\060\015\006\011\052\206\110\206\367\015\001\001\004\005\000\060
-+\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157\164
-+\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150\164
-+\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164\056
-+\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103\101
-+\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101\165
-+\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206\110
-+\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164\100
-+\143\141\143\145\162\164\056\157\162\147\060\036\027\015\060\065
-+\061\060\061\064\060\067\063\066\065\065\132\027\015\063\063\060
-+\063\062\070\060\067\063\066\065\065\132\060\124\061\024\060\022
-+\006\003\125\004\012\023\013\103\101\143\145\162\164\040\111\156
-+\143\056\061\036\060\034\006\003\125\004\013\023\025\150\164\164
-+\160\072\057\057\167\167\167\056\103\101\143\145\162\164\056\157
-+\162\147\061\034\060\032\006\003\125\004\003\023\023\103\101\143
-+\145\162\164\040\103\154\141\163\163\040\063\040\122\157\157\164
-+\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001\001
-+\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002\001
-+\000\253\111\065\021\110\174\322\046\176\123\224\317\103\251\335
-+\050\327\102\052\213\363\207\170\031\130\174\017\236\332\211\175
-+\341\373\353\162\220\015\164\241\226\144\253\237\240\044\231\163
-+\332\342\125\166\307\027\173\365\004\254\106\270\303\276\177\144
-+\215\020\154\044\363\141\234\300\362\220\372\121\346\365\151\001
-+\143\303\017\126\342\112\102\317\342\104\214\045\050\250\305\171
-+\011\175\106\271\212\363\351\363\064\051\010\105\344\034\237\313
-+\224\004\034\201\250\024\263\230\145\304\103\354\116\202\215\011
-+\321\275\252\133\215\222\320\354\336\220\305\177\012\302\343\353
-+\346\061\132\136\164\076\227\063\131\350\303\003\075\140\063\277
-+\367\321\157\107\304\315\356\142\203\122\156\056\010\232\244\331
-+\025\030\221\246\205\222\107\260\256\110\353\155\267\041\354\205
-+\032\150\162\065\253\377\360\020\135\300\364\224\247\152\325\073
-+\222\176\114\220\005\176\223\301\054\213\244\216\142\164\025\161
-+\156\013\161\003\352\257\025\070\232\324\322\005\162\157\214\371
-+\053\353\132\162\045\371\071\106\343\162\033\076\004\303\144\047
-+\042\020\052\212\117\130\247\003\255\276\264\056\023\355\135\252
-+\110\327\325\175\324\052\173\134\372\106\004\120\344\314\016\102
-+\133\214\355\333\362\317\374\226\223\340\333\021\066\124\142\064
-+\070\217\014\140\233\073\227\126\070\255\363\322\133\213\240\133
-+\352\116\226\270\174\327\325\240\206\160\100\323\221\051\267\242
-+\074\255\365\214\273\317\032\222\212\344\064\173\300\330\154\137
-+\351\012\302\303\247\040\232\132\337\054\135\122\134\272\107\325
-+\233\357\044\050\160\070\040\057\325\177\051\300\262\101\003\150
-+\222\314\340\234\314\227\113\105\357\072\020\012\253\160\072\230
-+\225\160\255\065\261\352\205\053\244\034\200\041\061\251\256\140
-+\172\200\046\110\000\270\001\300\223\143\125\042\221\074\126\347
-+\257\333\072\045\363\217\061\124\352\046\213\201\131\371\241\321
-+\123\021\305\173\235\003\366\164\021\340\155\261\054\077\054\206
-+\221\231\161\232\246\167\213\064\140\321\024\264\054\254\235\257
-+\214\020\323\237\304\152\370\157\023\374\163\131\367\146\102\164
-+\036\212\343\370\334\322\157\230\234\313\107\230\225\100\005\373
-+\351\002\003\001\000\001\243\201\277\060\201\274\060\017\006\003
-+\125\035\023\001\001\377\004\005\060\003\001\001\377\060\135\006
-+\010\053\006\001\005\005\007\001\001\004\121\060\117\060\043\006
-+\010\053\006\001\005\005\007\060\001\206\027\150\164\164\160\072
-+\057\057\157\143\163\160\056\103\101\143\145\162\164\056\157\162
-+\147\057\060\050\006\010\053\006\001\005\005\007\060\002\206\034
-+\150\164\164\160\072\057\057\167\167\167\056\103\101\143\145\162
-+\164\056\157\162\147\057\143\141\056\143\162\164\060\112\006\003
-+\125\035\040\004\103\060\101\060\077\006\010\053\006\001\004\001
-+\201\220\112\060\063\060\061\006\010\053\006\001\005\005\007\002
-+\001\026\045\150\164\164\160\072\057\057\167\167\167\056\103\101
-+\143\145\162\164\056\157\162\147\057\151\156\144\145\170\056\160
-+\150\160\077\151\144\075\061\060\060\015\006\011\052\206\110\206
-+\367\015\001\001\004\005\000\003\202\002\001\000\177\010\210\241
-+\332\032\120\111\332\211\373\241\010\162\363\212\367\036\304\072
-+\264\171\133\040\060\261\105\336\302\135\323\145\151\361\302\135
-+\124\124\074\205\137\271\173\102\221\302\231\375\033\121\233\253
-+\106\245\241\020\123\236\155\210\254\163\156\054\063\246\360\364
-+\236\340\165\301\076\210\105\251\341\146\103\376\126\132\321\172
-+\101\170\367\100\332\112\072\361\013\133\245\273\026\006\346\302
-+\347\223\271\205\115\227\117\261\036\070\103\200\357\233\015\214
-+\357\270\247\140\000\207\127\175\036\104\034\313\043\357\233\074
-+\231\235\257\265\051\034\105\171\026\226\115\047\155\361\034\154
-+\303\302\125\144\263\274\024\342\363\244\037\036\062\374\047\025
-+\005\317\335\056\256\076\202\141\173\360\041\020\030\366\104\352
-+\123\071\371\334\320\232\040\340\306\273\340\273\132\117\304\231
-+\310\007\275\265\275\242\333\056\142\015\102\064\101\274\377\213
-+\212\365\121\042\252\210\060\000\342\260\324\274\276\145\272\325
-+\003\127\171\233\350\334\310\115\370\120\355\221\245\122\050\242
-+\254\373\066\130\076\351\224\053\221\120\207\033\326\136\326\214
-+\314\367\017\020\014\122\116\320\026\141\345\345\012\154\277\027
-+\307\162\106\127\234\230\365\154\140\143\172\157\136\271\116\057
-+\310\271\271\273\152\205\274\230\015\355\371\076\227\204\064\224
-+\256\000\257\241\345\347\222\156\116\275\363\342\331\024\213\134
-+\322\353\001\154\240\027\245\055\020\353\234\172\112\275\275\356
-+\316\375\355\042\100\253\160\070\210\365\012\207\152\302\253\005
-+\140\311\110\005\332\123\301\336\104\167\152\263\363\074\074\355
-+\200\274\246\070\112\051\044\137\376\131\073\233\045\172\126\143
-+\000\144\271\135\244\142\175\127\066\117\255\203\357\037\222\123
-+\240\216\167\127\335\345\141\021\075\043\000\220\114\074\372\243
-+\140\223\004\243\257\065\366\016\152\217\117\112\140\247\205\005
-+\154\106\241\217\364\307\166\343\241\131\127\367\161\262\304\156
-+\024\134\155\155\101\146\337\033\223\261\324\000\303\356\313\317
-+\074\075\041\200\251\137\143\145\374\335\340\137\244\364\053\360
-+\205\161\101\324\147\045\373\032\261\227\256\326\231\202\023\101
-+\322\156\245\033\231\047\200\347\013\251\250\000
-+END
-+
-+# Trust for Certificate "CAcert.org Class 3 Root CA"
-+CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "CAcert.org Class 3 Root CA"
-+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-+\333\114\102\151\007\077\351\302\243\175\211\012\134\033\030\304
-+\030\116\052\055
-+END
-+CKA_CERT_MD5_HASH MULTILINE_OCTAL
-+\163\077\065\124\035\104\311\351\132\112\357\121\255\003\006\266
-+END
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\171\061\020\060\016\006\003\125\004\012\023\007\122\157\157
-+\164\040\103\101\061\036\060\034\006\003\125\004\013\023\025\150
-+\164\164\160\072\057\057\167\167\167\056\143\141\143\145\162\164
-+\056\157\162\147\061\042\060\040\006\003\125\004\003\023\031\103
-+\101\040\103\145\162\164\040\123\151\147\156\151\156\147\040\101
-+\165\164\150\157\162\151\164\171\061\041\060\037\006\011\052\206
-+\110\206\367\015\001\011\001\026\022\163\165\160\160\157\162\164
-+\100\143\141\143\145\162\164\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\001\001
-+END
-+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-+
-+#
-+# Certificate "Software in the Public Interest, Inc. Root CA (2008)"
-+#
-+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
-+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-+CKA_SUBJECT MULTILINE_OCTAL
-+\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
-+\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
-+\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
-+\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
-+\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
-+\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
-+\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
-+\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
-+\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
-+\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
-+\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
-+\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
-+END
-+CKA_ID UTF8 "0"
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
-+\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
-+\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
-+\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
-+\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
-+\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
-+\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
-+\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
-+\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
-+\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
-+\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
-+\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\011\000\350\216\266\311\370\052\024\050
-+END
-+CKA_VALUE MULTILINE_OCTAL
-+\060\202\010\016\060\202\005\366\240\003\002\001\002\002\011\000
-+\350\216\266\311\370\052\024\050\060\015\006\011\052\206\110\206
-+\367\015\001\001\005\005\000\060\201\274\061\013\060\011\006\003
-+\125\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010
-+\023\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125
-+\004\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163
-+\061\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167
-+\141\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151
-+\143\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003
-+\125\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061
-+\036\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146
-+\151\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061
-+\045\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026
-+\150\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151
-+\156\143\056\157\162\147\060\036\027\015\060\070\060\065\061\063
-+\060\070\060\067\065\066\132\027\015\061\070\060\065\061\061\060
-+\070\060\067\065\066\132\060\201\274\061\013\060\011\006\003\125
-+\004\006\023\002\125\123\061\020\060\016\006\003\125\004\010\023
-+\007\111\156\144\151\141\156\141\061\025\060\023\006\003\125\004
-+\007\023\014\111\156\144\151\141\156\141\160\157\154\151\163\061
-+\050\060\046\006\003\125\004\012\023\037\123\157\146\164\167\141
-+\162\145\040\151\156\040\164\150\145\040\120\165\142\154\151\143
-+\040\111\156\164\145\162\145\163\164\061\023\060\021\006\003\125
-+\004\013\023\012\150\157\163\164\155\141\163\164\145\162\061\036
-+\060\034\006\003\125\004\003\023\025\103\145\162\164\151\146\151
-+\143\141\164\145\040\101\165\164\150\157\162\151\164\171\061\045
-+\060\043\006\011\052\206\110\206\367\015\001\011\001\026\026\150
-+\157\163\164\155\141\163\164\145\162\100\163\160\151\055\151\156
-+\143\056\157\162\147\060\202\002\042\060\015\006\011\052\206\110
-+\206\367\015\001\001\001\005\000\003\202\002\017\000\060\202\002
-+\012\002\202\002\001\000\334\066\346\107\102\302\304\121\165\051
-+\207\100\303\330\216\041\006\322\030\116\353\357\040\275\220\074
-+\205\020\023\214\051\133\224\143\366\364\055\361\006\102\221\271
-+\031\304\102\151\010\277\213\066\105\352\050\005\063\111\110\240
-+\047\103\223\065\212\101\330\170\263\360\357\263\156\055\335\321
-+\313\175\352\364\165\046\323\076\220\072\356\327\347\054\004\265
-+\174\341\365\174\305\116\357\167\275\134\242\223\063\222\316\175
-+\201\110\317\153\265\042\054\010\203\375\323\325\317\073\055\375
-+\265\111\220\133\366\255\115\023\312\336\323\246\235\123\121\161
-+\143\106\370\112\026\134\230\356\055\155\232\026\241\166\220\342
-+\140\103\231\326\211\326\154\056\172\230\262\013\003\054\343\172
-+\117\307\335\343\314\343\112\152\215\171\122\372\364\301\257\056
-+\217\052\010\313\033\051\202\222\162\103\274\316\210\251\252\247
-+\212\121\103\125\205\232\067\003\170\223\310\360\275\264\101\310
-+\007\102\232\313\065\227\172\212\201\145\336\035\124\010\001\361
-+\144\134\267\027\032\121\274\036\303\131\207\166\030\026\230\356
-+\277\366\147\201\213\006\065\305\113\155\131\031\307\322\306\110
-+\276\156\024\050\203\112\020\234\033\365\157\274\251\216\365\151
-+\376\262\301\125\314\347\024\311\371\133\024\123\121\007\352\316
-+\075\344\117\050\037\074\141\011\327\063\322\156\247\156\324\307
-+\023\011\157\153\135\024\356\235\211\033\245\152\362\366\370\320
-+\162\216\352\162\037\057\064\152\051\012\305\012\354\034\100\205
-+\022\367\246\245\323\117\255\300\205\214\114\174\163\040\314\123
-+\030\361\262\130\114\001\365\277\352\144\325\134\071\305\316\154
-+\314\123\132\126\272\101\017\045\337\153\120\266\307\212\240\275
-+\002\302\305\073\125\245\262\144\042\204\121\050\126\256\061\356
-+\136\373\013\026\115\106\005\221\200\104\355\254\155\360\127\250
-+\372\353\141\110\240\313\033\263\037\216\315\305\041\167\003\204
-+\036\374\254\243\103\010\143\214\355\371\047\357\264\260\135\147
-+\326\117\355\320\213\076\135\133\311\221\275\226\002\204\075\305
-+\115\274\102\077\164\375\074\135\254\134\110\066\136\207\061\057
-+\030\154\304\150\356\241\213\311\131\320\030\343\000\200\263\124
-+\047\056\231\360\025\123\002\003\001\000\001\243\202\002\017\060
-+\202\002\013\060\035\006\003\125\035\016\004\026\004\024\064\161
-+\321\070\327\025\066\203\107\153\327\067\144\102\073\216\215\122
-+\235\253\060\201\361\006\003\125\035\043\004\201\351\060\201\346
-+\200\024\064\161\321\070\327\025\066\203\107\153\327\067\144\102
-+\073\216\215\122\235\253\241\201\302\244\201\277\060\201\274\061
-+\013\060\011\006\003\125\004\006\023\002\125\123\061\020\060\016
-+\006\003\125\004\010\023\007\111\156\144\151\141\156\141\061\025
-+\060\023\006\003\125\004\007\023\014\111\156\144\151\141\156\141
-+\160\157\154\151\163\061\050\060\046\006\003\125\004\012\023\037
-+\123\157\146\164\167\141\162\145\040\151\156\040\164\150\145\040
-+\120\165\142\154\151\143\040\111\156\164\145\162\145\163\164\061
-+\023\060\021\006\003\125\004\013\023\012\150\157\163\164\155\141
-+\163\164\145\162\061\036\060\034\006\003\125\004\003\023\025\103
-+\145\162\164\151\146\151\143\141\164\145\040\101\165\164\150\157
-+\162\151\164\171\061\045\060\043\006\011\052\206\110\206\367\015
-+\001\011\001\026\026\150\157\163\164\155\141\163\164\145\162\100
-+\163\160\151\055\151\156\143\056\157\162\147\202\011\000\350\216
-+\266\311\370\052\024\050\060\017\006\003\125\035\023\001\001\377
-+\004\005\060\003\001\001\377\060\021\006\011\140\206\110\001\206
-+\370\102\001\001\004\004\003\002\000\007\060\011\006\003\125\035
-+\022\004\002\060\000\060\056\006\011\140\206\110\001\206\370\102
-+\001\015\004\041\026\037\123\157\146\164\167\141\162\145\040\151
-+\156\040\164\150\145\040\120\165\142\154\151\143\040\111\156\164
-+\145\162\145\163\164\060\060\006\011\140\206\110\001\206\370\102
-+\001\004\004\043\026\041\150\164\164\160\163\072\057\057\143\141
-+\056\163\160\151\055\151\156\143\056\157\162\147\057\143\141\055
-+\143\162\154\056\160\145\155\060\062\006\011\140\206\110\001\206
-+\370\102\001\003\004\045\026\043\150\164\164\160\163\072\057\057
-+\143\141\056\163\160\151\055\151\156\143\056\157\162\147\057\143
-+\145\162\164\055\143\162\154\056\160\145\155\060\041\006\003\125
-+\035\021\004\032\060\030\201\026\150\157\163\164\155\141\163\164
-+\145\162\100\163\160\151\055\151\156\143\056\157\162\147\060\016
-+\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060\015
-+\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\002
-+\001\000\264\315\275\340\271\352\262\003\053\176\062\351\336\162
-+\077\311\113\202\136\235\342\257\125\011\242\014\124\350\317\030
-+\074\050\040\035\251\273\003\002\057\122\071\042\371\027\317\255
-+\147\220\263\003\177\330\025\343\153\176\273\233\126\001\257\065
-+\324\332\271\307\147\027\233\324\325\016\067\263\040\101\056\014
-+\001\304\133\371\145\076\302\141\350\322\360\152\225\160\303\306
-+\157\325\065\244\254\131\162\341\211\337\241\240\235\044\275\051
-+\171\351\141\052\331\323\036\311\106\244\010\170\101\222\162\017
-+\253\024\165\355\011\360\242\360\134\357\303\012\142\040\267\302
-+\050\146\256\114\057\056\217\105\143\046\226\360\356\061\346\213
-+\125\233\252\072\371\202\071\035\210\074\342\007\165\032\341\017
-+\261\060\274\161\062\322\072\376\372\241\211\363\103\054\326\162
-+\304\171\247\025\110\005\300\330\055\162\002\343\313\075\026\152
-+\272\311\270\021\020\342\111\205\314\226\107\140\005\045\056\357
-+\165\131\063\365\107\031\026\357\332\154\137\007\310\246\120\266
-+\035\313\146\064\045\374\146\203\353\305\266\060\101\370\106\104
-+\142\250\301\014\124\346\352\114\132\050\346\256\306\267\376\177
-+\073\226\250\056\356\307\150\076\335\000\075\051\257\052\143\253
-+\137\356\111\052\055\305\334\373\321\306\323\321\227\126\122\206
-+\266\224\353\324\140\121\267\374\036\233\314\002\233\324\037\217
-+\371\112\217\266\056\050\073\027\314\305\246\005\343\322\323\265
-+\306\003\311\341\110\102\233\313\077\344\027\340\376\015\001\225
-+\011\272\270\015\161\344\011\160\167\102\330\115\341\102\251\140
-+\203\327\027\211\103\322\324\335\247\030\266\253\324\044\045\207
-+\265\324\342\374\056\042\151\275\255\150\054\377\162\265\230\252
-+\006\234\347\052\152\270\241\223\166\316\260\363\177\234\341\340
-+\117\270\330\206\106\245\063\002\054\045\141\067\052\222\310\254
-+\201\164\150\143\207\063\166\275\005\177\136\325\325\002\155\275
-+\257\377\052\132\252\111\354\230\171\107\123\221\366\016\064\132
-+\311\245\306\353\262\343\305\254\266\240\160\065\273\310\121\151
-+\320\362\265\242\062\156\274\077\240\067\071\174\161\066\246\005
-+\337\014\022\344\026\247\305\326\313\143\243\225\160\077\346\004
-+\243\140
-+END
-+
-+# Trust for Certificate "Software in the Public Interest, Inc. Root CA (2008)"
-+CKA_CLASS CK_OBJECT_CLASS CKO_NETSCAPE_TRUST
-+CKA_TOKEN CK_BBOOL CK_TRUE
-+CKA_PRIVATE CK_BBOOL CK_FALSE
-+CKA_MODIFIABLE CK_BBOOL CK_FALSE
-+CKA_LABEL UTF8 "Software in the Public Interest, Inc. Root CA (2008)"
-+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-+\257\160\210\103\203\202\002\025\315\141\306\274\354\375\067\044
-+\251\220\103\034
-+END
-+CKA_CERT_MD5_HASH MULTILINE_OCTAL
-+\052\107\237\140\273\203\164\157\001\003\327\013\015\366\015\170
-+END
-+CKA_ISSUER MULTILINE_OCTAL
-+\060\201\274\061\013\060\011\006\003\125\004\006\023\002\125\123
-+\061\020\060\016\006\003\125\004\010\023\007\111\156\144\151\141
-+\156\141\061\025\060\023\006\003\125\004\007\023\014\111\156\144
-+\151\141\156\141\160\157\154\151\163\061\050\060\046\006\003\125
-+\004\012\023\037\123\157\146\164\167\141\162\145\040\151\156\040
-+\164\150\145\040\120\165\142\154\151\143\040\111\156\164\145\162
-+\145\163\164\061\023\060\021\006\003\125\004\013\023\012\150\157
-+\163\164\155\141\163\164\145\162\061\036\060\034\006\003\125\004
-+\003\023\025\103\145\162\164\151\146\151\143\141\164\145\040\101
-+\165\164\150\157\162\151\164\171\061\045\060\043\006\011\052\206
-+\110\206\367\015\001\011\001\026\026\150\157\163\164\155\141\163
-+\164\145\162\100\163\160\151\055\151\156\143\056\157\162\147
-+END
-+CKA_SERIAL_NUMBER MULTILINE_OCTAL
-+\002\011\000\350\216\266\311\370\052\024\050
-+END
-+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NETSCAPE_TRUSTED_DELEGATOR
-+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff --git a/testing/nss/nss-config.in b/testing/nss/nss-config.in
deleted file mode 100644
index f8f893e7..00000000
--- a/testing/nss/nss-config.in
+++ /dev/null
@@ -1,145 +0,0 @@
-#!/bin/sh
-
-prefix=@prefix@
-
-major_version=@MOD_MAJOR_VERSION@
-minor_version=@MOD_MINOR_VERSION@
-patch_version=@MOD_PATCH_VERSION@
-
-usage()
-{
-	cat <<EOF
-Usage: nss-config [OPTIONS] [LIBRARIES]
-Options:
-	[--prefix[=DIR]]
-	[--exec-prefix[=DIR]]
-	[--includedir[=DIR]]
-	[--libdir[=DIR]]
-	[--version]
-	[--libs]
-	[--cflags]
-Dynamic Libraries:
-	nss
-	nssutil
-	ssl
-	smime
-EOF
-	exit $1
-}
-
-if test $# -eq 0; then
-	usage 1 1>&2
-fi
-
-lib_ssl=yes
-lib_smime=yes
-lib_nss=yes
-lib_nssutil=yes
-
-while test $# -gt 0; do
-  case "$1" in
-  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
-  *) optarg= ;;
-  esac
-
-  case $1 in
-    --prefix=*)
-      prefix=$optarg
-      ;;
-    --prefix)
-      echo_prefix=yes
-      ;;
-    --exec-prefix=*)
-      exec_prefix=$optarg
-      ;;
-    --exec-prefix)
-      echo_exec_prefix=yes
-      ;;
-    --includedir=*)
-      includedir=$optarg
-      ;;
-    --includedir)
-      echo_includedir=yes
-      ;;
-    --libdir=*)
-      libdir=$optarg
-      ;;
-    --libdir)
-      echo_libdir=yes
-      ;;
-    --version)
-      echo ${major_version}.${minor_version}.${patch_version}
-      ;;
-    --cflags)
-      echo_cflags=yes
-      ;;
-    --libs)
-      echo_libs=yes
-      ;;
-    ssl)
-      lib_ssl=yes
-      ;;
-    smime)
-      lib_smime=yes
-      ;;
-    nss)
-      lib_nss=yes
-      ;;
-    nssutil)
-      lib_nssutil=yes
-      ;;
-    *)
-      usage 1 1>&2
-      ;;
-  esac
-  shift
-done
-
-# Set variables that may be dependent upon other variables
-if test -z "$exec_prefix"; then
-    exec_prefix=`pkg-config --variable=exec_prefix nss`
-fi
-if test -z "$includedir"; then
-    includedir=`pkg-config --variable=includedir nss`
-fi
-if test -z "$libdir"; then
-    libdir=`pkg-config --variable=libdir nss`
-fi
-
-if test "$echo_prefix" = "yes"; then
-    echo $prefix
-fi
-
-if test "$echo_exec_prefix" = "yes"; then
-    echo $exec_prefix
-fi
-
-if test "$echo_includedir" = "yes"; then
-    echo $includedir
-fi
-
-if test "$echo_libdir" = "yes"; then
-    echo $libdir
-fi
-
-if test "$echo_cflags" = "yes"; then
-    echo -I$includedir
-fi
-
-if test "$echo_libs" = "yes"; then
-      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
-      if test -n "$lib_ssl"; then
-	libdirs="$libdirs -lssl${major_version}"
-      fi
-      if test -n "$lib_smime"; then
-	libdirs="$libdirs -lsmime${major_version}"
-      fi
-      if test -n "$lib_nss"; then
-	libdirs="$libdirs -lnss${major_version}"
-      fi
-      if test -n "$lib_nssutil"; then
-	libdirs="$libdirs -lnssutil${major_version}"
-      fi
-      echo $libdirs
-fi      
-
diff --git a/testing/nss/nss-no-rpath.patch b/testing/nss/nss-no-rpath.patch
deleted file mode 100644
index 35ea5731..00000000
--- a/testing/nss/nss-no-rpath.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- ./mozilla/security/nss/cmd/platlibs.mk.withrpath	2007-02-19 07:17:06.000000000 +0100
-+++ ./mozilla/security/nss/cmd/platlibs.mk	2007-02-19 07:18:07.000000000 +0100
-@@ -52,9 +52,9 @@
- 
- ifeq ($(OS_ARCH), Linux)
- ifeq ($(USE_64), 1)
--EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
-+#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
- else
--EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
-+#EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
- endif
- endif
- 
diff --git a/testing/nss/nss-nolocalsql.patch b/testing/nss/nss-nolocalsql.patch
deleted file mode 100644
index dc75a223..00000000
--- a/testing/nss/nss-nolocalsql.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff -up ./mozilla/security/nss/lib/Makefile.nolocalsql ./mozilla/security/nss/lib/Makefile
---- ./mozilla/security/nss/lib/Makefile.nolocalsql	2010-02-27 16:40:25.891777537 -0800
-+++ ./mozilla/security/nss/lib/Makefile	2010-02-27 16:41:59.175902327 -0800
-@@ -62,11 +62,11 @@ ifndef USE_SYSTEM_ZLIB
- ZLIB_SRCDIR = zlib  # Add the zlib directory to DIRS.
- endif
- 
--ifndef MOZILLA_CLIENT
--ifndef NSS_USE_SYSTEM_SQLITE
--SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
--endif
--endif
-+#ifndef MOZILLA_CLIENT
-+#ifndef NSS_USE_SYSTEM_SQLITE
-+#SQLITE_SRCDIR = sqlite  # Add the sqlite directory to DIRS.
-+#endif
-+#endif
- 
- ifndef MOZILLA_CLIENT
- ifeq ($(OS_ARCH),Linux)
-diff -up ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn
---- ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn.nolocalsql	2010-02-27 16:44:24.998777709 -0800
-+++ ./mozilla/security/nss/lib/softoken/legacydb/manifest.mn	2010-02-27 16:45:08.533803472 -0800
-@@ -46,9 +46,9 @@ MAPFILE = $(OBJDIR)/nssdbm.def
- 
- DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\"
- 
--ifdef MOZILLA_CLIENT
--INCLUDES += -I$(DIST)/include/sqlite3
--endif
-+#ifdef MOZILLA_CLIENT
-+#INCLUDES += -I$(DIST)/include/sqlite3
-+#endif
- 
- CSRCS = \
- 	dbmshim.c \
-diff -up ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql ./mozilla/security/nss/lib/softoken/manifest.mn
---- ./mozilla/security/nss/lib/softoken/manifest.mn.nolocalsql	2010-02-27 16:42:52.213902231 -0800
-+++ ./mozilla/security/nss/lib/softoken/manifest.mn	2010-02-27 16:43:34.040776788 -0800
-@@ -47,9 +47,9 @@ MAPFILE = $(OBJDIR)/softokn.def
- 
- DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
- 
--ifdef MOZILLA_CLIENT
--INCLUDES += -I$(DIST)/include/sqlite3
--endif
-+#ifdef MOZILLA_CLIENT
-+#INCLUDES += -I$(DIST)/include/sqlite3
-+#endif
- 
- EXPORTS = \
- 	secmodt.h \
diff --git a/testing/nss/nss.pc.in b/testing/nss/nss.pc.in
deleted file mode 100644
index d47b9e14..00000000
--- a/testing/nss/nss.pc.in
+++ /dev/null
@@ -1,11 +0,0 @@
-prefix=%prefix%
-exec_prefix=%exec_prefix%
-libdir=%libdir%
-includedir=%includedir%
-
-Name: NSS
-Description: Network Security Services
-Version: %NSS_VERSION%
-Requires: nspr >= %NSPR_VERSION%
-Libs: -lssl3 -lsmime3 -lnss3 -lnssutil3
-Cflags: -I${includedir}
diff --git a/testing/nss/ssl-renegotiate-transitional.patch b/testing/nss/ssl-renegotiate-transitional.patch
deleted file mode 100644
index f457c555..00000000
--- a/testing/nss/ssl-renegotiate-transitional.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Enable transitional scheme for ssl renegotiation:
-
-(from mozilla/security/nss/lib/ssl/ssl.h)
-Disallow unsafe renegotiation in server sockets only, but allow clients
-to continue to renegotiate with vulnerable servers.
-This value should only be used during the transition period when few
-servers have been upgraded.
-
-diff --git a/mozilla/security/nss/lib/ssl/sslsock.c b/mozilla/security/nss/lib/ssl/sslsock.c
-index f1d1921..c074360 100644
---- a/mozilla/security/nss/lib/ssl/sslsock.c
-+++ b/mozilla/security/nss/lib/ssl/sslsock.c
-@@ -181,7 +181,7 @@ static sslOptions ssl_defaults = {
-     PR_FALSE,   /* noLocks            */
-     PR_FALSE,   /* enableSessionTickets */
-     PR_FALSE,   /* enableDeflate      */
--    2,          /* enableRenegotiation (default: requires extension) */
-+    3,          /* enableRenegotiation (default: transitional) */
-     PR_FALSE,   /* requireSafeNegotiation */
- };
- 
-- 
cgit v1.2.3


From e26ad95a03e076ef2003647120b584f47313ca00 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:31:11 +0000
Subject: main/pidgin: moved form testing

---
 main/pidgin/APKBUILD         | 64 ++++++++++++++++++++++++++++++++++++++++++++
 main/pidgin/msn_fix.patch    | 28 +++++++++++++++++++
 testing/pidgin/APKBUILD      | 64 --------------------------------------------
 testing/pidgin/msn_fix.patch | 28 -------------------
 4 files changed, 92 insertions(+), 92 deletions(-)
 create mode 100644 main/pidgin/APKBUILD
 create mode 100644 main/pidgin/msn_fix.patch
 delete mode 100644 testing/pidgin/APKBUILD
 delete mode 100644 testing/pidgin/msn_fix.patch

diff --git a/main/pidgin/APKBUILD b/main/pidgin/APKBUILD
new file mode 100644
index 00000000..bff483fc
--- /dev/null
+++ b/main/pidgin/APKBUILD
@@ -0,0 +1,64 @@
+# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
+pkgname=pidgin
+pkgver=2.7.0
+pkgrel=1
+pkgdesc="graphical multi-protocol instant messaging client for X"
+url="http://pidgin.im/"
+license="GPL"
+depends=
+makedepends="gtk+-dev intltool libsm-dev startup-notification-dev gtkspell-dev
+	libxml2-dev gstreamer-dev libidn-dev dbus-glib-dev gnutls-dev
+	cyrus-sasl-dev ncurses-dev nss-dev"
+subpackages="$pkgname-dev $pkgname-doc finch libpurple"
+source="http://downloads.sourceforge.net/pidgin/$pkgver/pidgin-$pkgver.tar.bz2
+	msn_fix.patch"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	patch -Np0 -i ""$srcdir"/msn_fix.patch" || return 1
+}
+
+build() { 
+	cd "$_builddir"
+	./configure --prefix=/usr \
+		--sysconfdir=/etc \
+		--disable-avahi \
+		--disable-doxygen \
+		--disable-gnutls \
+		--disable-meanwhile \
+		--disable-nm \
+		--disable-perl \
+		--disable-schemas-install \
+		--disable-screensaver \
+		--disable-tcl \
+		--disable-vv \
+		--enable-cyrus-sasl \
+		--enable-nss \
+		|| return 1
+	make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR="$pkgdir" install
+}
+
+finch() {
+	pkgdesc="text-based multi-protocol instant messaging client"
+	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/lib/gnt "$pkgdir"/usr/lib/libgnt.so.* \
+		"$pkgdir"/usr/lib/finch \
+		"$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/bin/finch "$subpkgdir"/usr/bin/
+}
+
+libpurple() {
+	pkgdesc="multi-protocol instant messaging library"
+	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/share/sounds
+	mv "$pkgdir"/usr/lib/*purple* "$subpkgdir"/usr/lib/
+	mv "$pkgdir"/usr/share/purple "$pkgdir"/usr/share/sounds \
+		"$subpkgdir"/usr/share/
+}
+md5sums="63a36f91d29f5ac5a402ffd2d7dbbb72  pidgin-2.7.0.tar.bz2
+bbf9d6f6fc19342af7e059dc13432d27  msn_fix.patch"
diff --git a/main/pidgin/msn_fix.patch b/main/pidgin/msn_fix.patch
new file mode 100644
index 00000000..f93fef8a
--- /dev/null
+++ b/main/pidgin/msn_fix.patch
@@ -0,0 +1,28 @@
+#
+#
+# patch "libpurple/protocols/msn/slplink.c"
+#  from [a96a53635871463de0177e5a99fe4ebdc2c7d577]
+#    to [87ada76abf90c44e615679efc5f8128bb941bba1]
+#
+============================================================
+--- libpurple/protocols/msn/slplink.c	a96a53635871463de0177e5a99fe4ebdc2c7d577
++++ libpurple/protocols/msn/slplink.c	87ada76abf90c44e615679efc5f8128bb941bba1
+@@ -383,6 +383,7 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
+ msn_slplink_release_slpmsg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg)
+ {
+ 	MsnMessage *msg;
++	const char *passport;
+ 
+ 	slpmsg->msg = msg = msn_message_new_msnslp();
+ 
+@@ -421,7 +422,8 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
+ 
+ 	msg->msnslp_header.total_size = slpmsg->size;
+ 
+-	msn_message_set_attr(msg, "P2P-Dest", slplink->remote_user);
++	passport = purple_normalize(slplink->session->account, slplink->remote_user);
++	msn_message_set_attr(msg, "P2P-Dest", passport);
+ 
+ 	msg->ack_cb = msg_ack;
+ 	msg->nak_cb = msg_nak;
+
diff --git a/testing/pidgin/APKBUILD b/testing/pidgin/APKBUILD
deleted file mode 100644
index bff483fc..00000000
--- a/testing/pidgin/APKBUILD
+++ /dev/null
@@ -1,64 +0,0 @@
-# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
-pkgname=pidgin
-pkgver=2.7.0
-pkgrel=1
-pkgdesc="graphical multi-protocol instant messaging client for X"
-url="http://pidgin.im/"
-license="GPL"
-depends=
-makedepends="gtk+-dev intltool libsm-dev startup-notification-dev gtkspell-dev
-	libxml2-dev gstreamer-dev libidn-dev dbus-glib-dev gnutls-dev
-	cyrus-sasl-dev ncurses-dev nss-dev"
-subpackages="$pkgname-dev $pkgname-doc finch libpurple"
-source="http://downloads.sourceforge.net/pidgin/$pkgver/pidgin-$pkgver.tar.bz2
-	msn_fix.patch"
-
-_builddir="$srcdir"/$pkgname-$pkgver
-prepare() {
-	cd "$_builddir"
-	patch -Np0 -i ""$srcdir"/msn_fix.patch" || return 1
-}
-
-build() { 
-	cd "$_builddir"
-	./configure --prefix=/usr \
-		--sysconfdir=/etc \
-		--disable-avahi \
-		--disable-doxygen \
-		--disable-gnutls \
-		--disable-meanwhile \
-		--disable-nm \
-		--disable-perl \
-		--disable-schemas-install \
-		--disable-screensaver \
-		--disable-tcl \
-		--disable-vv \
-		--enable-cyrus-sasl \
-		--enable-nss \
-		|| return 1
-	make || return 1
-}
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install
-}
-
-finch() {
-	pkgdesc="text-based multi-protocol instant messaging client"
-	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/bin
-	mv "$pkgdir"/usr/lib/gnt "$pkgdir"/usr/lib/libgnt.so.* \
-		"$pkgdir"/usr/lib/finch \
-		"$subpkgdir"/usr/lib/
-	mv "$pkgdir"/usr/bin/finch "$subpkgdir"/usr/bin/
-}
-
-libpurple() {
-	pkgdesc="multi-protocol instant messaging library"
-	mkdir -p "$subpkgdir"/usr/lib "$subpkgdir"/usr/share/sounds
-	mv "$pkgdir"/usr/lib/*purple* "$subpkgdir"/usr/lib/
-	mv "$pkgdir"/usr/share/purple "$pkgdir"/usr/share/sounds \
-		"$subpkgdir"/usr/share/
-}
-md5sums="63a36f91d29f5ac5a402ffd2d7dbbb72  pidgin-2.7.0.tar.bz2
-bbf9d6f6fc19342af7e059dc13432d27  msn_fix.patch"
diff --git a/testing/pidgin/msn_fix.patch b/testing/pidgin/msn_fix.patch
deleted file mode 100644
index f93fef8a..00000000
--- a/testing/pidgin/msn_fix.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-#
-#
-# patch "libpurple/protocols/msn/slplink.c"
-#  from [a96a53635871463de0177e5a99fe4ebdc2c7d577]
-#    to [87ada76abf90c44e615679efc5f8128bb941bba1]
-#
-============================================================
---- libpurple/protocols/msn/slplink.c	a96a53635871463de0177e5a99fe4ebdc2c7d577
-+++ libpurple/protocols/msn/slplink.c	87ada76abf90c44e615679efc5f8128bb941bba1
-@@ -383,6 +383,7 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
- msn_slplink_release_slpmsg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg)
- {
- 	MsnMessage *msg;
-+	const char *passport;
- 
- 	slpmsg->msg = msg = msn_message_new_msnslp();
- 
-@@ -421,7 +422,8 @@ msn_slplink_release_slpmsg(MsnSlpLink *s
- 
- 	msg->msnslp_header.total_size = slpmsg->size;
- 
--	msn_message_set_attr(msg, "P2P-Dest", slplink->remote_user);
-+	passport = purple_normalize(slplink->session->account, slplink->remote_user);
-+	msn_message_set_attr(msg, "P2P-Dest", passport);
- 
- 	msg->ack_cb = msg_ack;
- 	msg->nak_cb = msg_nak;
-
-- 
cgit v1.2.3


From 87739f24f41be43cab03f89807a5fa160acd6243 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:43:01 +0000
Subject: main/thunar: add startup-notifications-dev to dev package

---
 main/thunar/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/thunar/APKBUILD b/main/thunar/APKBUILD
index ff8e4e2f..7dcc1b29 100644
--- a/main/thunar/APKBUILD
+++ b/main/thunar/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=thunar
 pkgver=1.0.2
-pkgrel=0
+pkgrel=1
 pkgdesc="File manager for Xfce"
 url="http://thunar.xfce.org"
 license="GPL2 LGPL2"
@@ -13,7 +13,7 @@ makedepends="pkgconfig libexif-dev xfce4-panel-dev exo-dev pcre-dev
 install=
 source="http://archive.xfce.org/src/xfce/thunar/${pkgver%.*}/Thunar-$pkgver.tar.bz2"
 
-depends_dev="exo-dev glib-dev gamin-dev jpeg-dev"
+depends_dev="exo-dev glib-dev gamin-dev jpeg-dev startup-notification-dev"
 _builddir="$srcdir"/Thunar-$pkgver
 
 prepare() {
-- 
cgit v1.2.3


From c2ed671426ae238bd3dca771b0fa5b588178aadc Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 16:59:33 +0000
Subject: main/dbus: added run dbus-uuidgen from post-install

---
 main/dbus/APKBUILD          | 4 ++--
 main/dbus/dbus.post-install | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 main/dbus/dbus.post-install

diff --git a/main/dbus/APKBUILD b/main/dbus/APKBUILD
index 12f946ea..a1f79850 100644
--- a/main/dbus/APKBUILD
+++ b/main/dbus/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dbus
 pkgver=1.2.24
-pkgrel=2
+pkgrel=3
 pkgdesc="Freedesktop.org message bus system"
 url="http://www.freedesktop.org/Software/dbus"
 pkggroups="messagebus"
@@ -10,7 +10,7 @@ subpackages="$pkgname-dev $pkgname-doc"
 depends=
 makedepends="expat-dev libx11-dev pkgconfig util-linux-ng-dev"
 depends_dev="util-linux-ng-dev"
-install="$pkgname.pre-install"
+install="$pkgname.pre-install $pkgname.post-install"
 source="http://$pkgname.freedesktop.org/releases/$pkgname/$pkgname-$pkgver.tar.gz
 	$pkgname.initd
 	"
diff --git a/main/dbus/dbus.post-install b/main/dbus/dbus.post-install
new file mode 100644
index 00000000..305297a4
--- /dev/null
+++ b/main/dbus/dbus.post-install
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec dbus-uuidgen --ensure
-- 
cgit v1.2.3


From ca57bb76053b9eccfe1dcad40dc9efa8fc9c399f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:04:29 +0000
Subject: main/xorg-server: upgrade to 1.7.7

set suid bit for Xorg
split out Xvfb in a subpackage
---
 main/xorg-server/APKBUILD | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/main/xorg-server/APKBUILD b/main/xorg-server/APKBUILD
index 1dbb5b18..2ae98aba 100644
--- a/main/xorg-server/APKBUILD
+++ b/main/xorg-server/APKBUILD
@@ -1,11 +1,11 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xorg-server
-pkgver=1.7.6
-pkgrel=2
+pkgver=1.7.7
+pkgrel=0
 pkgdesc="X.Org X servers"
 url="http://xorg.freedesktop.org"
 license="custom"
-subpackages="$pkgname-dev $pkgname-doc xfbdev"
+subpackages="$pkgname-dev $pkgname-doc xfbdev xvfb"
 depends="
 	font-misc-misc
 	font-cursor-misc
@@ -112,6 +112,7 @@ build() {
 package() {
 	cd "$srcdir"/$pkgname-$pkgver
 	make -j1 DESTDIR="$pkgdir" install || return 1
+	chmod u+s "$pkgdir"/usr/bin/Xorg
 
 	install -m755 -d "$pkgdir"/etc/X11 || return 1
 	install -m755 -d "$pkgdir"/var/lib/xkb || return 1
@@ -126,6 +127,12 @@ xfbdev() {
 	mv "$pkgdir"/usr/bin/Xfbdev "$subpkgdir"/usr/bin/
 }
 
+xvfb() {
+	pkgdesc="Virtual Framebuffer 'fake' X server"
+	mkdir -p "$subpkgdir"/usr/bin
+	mv "$pkgdir"/usr/bin/Xvfb "$subpkgdir"/usr/bin/
+}
+
 xephyr() {
 	pkgdesc="kdrive based X Server which targets a window on a host X Server as its framebuffer"
 	depends=
@@ -133,5 +140,5 @@ xephyr() {
 	mv "$pkgdir"/usr/bin/Xephyr "$subpkgdir"/usr/bin/
 }
 
-md5sums="178225f499ec10fa9d312d1c339e6a39  xorg-server-1.7.6.tar.bz2
+md5sums="8c0146330fb155c23d947ac37d431d4b  xorg-server-1.7.7.tar.bz2
 222de594206d1148a90eddfda4f7a11a  xorg-redhat-die-ugly-pattern-die-die-die.patch"
-- 
cgit v1.2.3


From e21b972236f1564338d9983ba17b741cfb55d769 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:46:01 +0000
Subject: main/gobject-introspection: upgrade to 0.6.12

---
 main/gobject-introspection/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/gobject-introspection/APKBUILD b/main/gobject-introspection/APKBUILD
index ebbefb1c..67404c54 100644
--- a/main/gobject-introspection/APKBUILD
+++ b/main/gobject-introspection/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=gobject-introspection
-pkgver=0.6.10
+pkgver=0.6.12
 pkgrel=0
 pkgdesc="Introspection system for GObject-based libraries"
 url="http://live.gnome.org/GObjectInstrospection"
@@ -33,4 +33,4 @@ libgirepository() {
 	mv "$pkgdir"/usr/lib/libgirepository*.so* "$subpkgdir"/usr/lib/
 }
 
-md5sums="cdf7af644a0407c3fd2d57ba2bb3549f  gobject-introspection-0.6.10.tar.bz2"
+md5sums="265e24520996820d39d6149ea10dc0df  gobject-introspection-0.6.12.tar.bz2"
-- 
cgit v1.2.3


From 01b07f473bef82d7c851591b3cc412ee9ac48d00 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:50:11 +0000
Subject: main/midori: upgrade to 0.2.6

---
 main/midori/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/midori/APKBUILD b/main/midori/APKBUILD
index 4b05196e..d67b1b88 100644
--- a/main/midori/APKBUILD
+++ b/main/midori/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=midori
-pkgver=0.2.5
+pkgver=0.2.6
 pkgrel=0
 pkgdesc="A lightweight web browser based on Gtk WebKit"
 url="http://www.twotoasts.de/index.php?/pages/midori_summary.html"
@@ -45,4 +45,4 @@ package() {
 	# PAX does not like the JIT
 	paxctl -c -m -p "$pkgdir"/usr/bin/midori
 }
-md5sums="3aeacd04d4d3e5c3bc16824696ff57b2  midori-0.2.5.tar.bz2"
+md5sums="249ddb3485d8246e0fda25dd735953f0  midori-0.2.6.tar.bz2"
-- 
cgit v1.2.3


From 1ac21cbdd63ef621aa05f50c458097c2a7b73bb5 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:57:25 +0000
Subject: main/imagemagick: upgrade to 6.6.2.0

---
 main/imagemagick/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/imagemagick/APKBUILD b/main/imagemagick/APKBUILD
index 3778adc9..60ecebbe 100644
--- a/main/imagemagick/APKBUILD
+++ b/main/imagemagick/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=imagemagick
-pkgver=6.6.1.5
+pkgver=6.6.2.0
 _pkgver=${pkgver%.*}-${pkgver##*.}
 pkgrel=0
 pkgdesc="A collection of tools and libraries for many image formats"
@@ -47,4 +47,4 @@ dev() {
 		"$pkgdir"/usr/lib/ImageMagick-$_v/modules-Q16/filters/
 }
 
-md5sums="ab2468747f3960bdc8d779e89b052860  ImageMagick-6.6.1-5.tar.gz"
+md5sums="d84ec4e436b0b4f79812ac89703777a6  ImageMagick-6.6.2-0.tar.gz"
-- 
cgit v1.2.3


From 173c66281b953252e54122a063d3b1386fa89c27 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:58:05 +0000
Subject: main/lame: upgrade to 3.98.4

---
 main/lame/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/lame/APKBUILD b/main/lame/APKBUILD
index 85a151c6..9ebd4ed6 100644
--- a/main/lame/APKBUILD
+++ b/main/lame/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lame
-pkgver=3.98.3
+pkgver=3.98.4
 _ver=398-2
-pkgrel=1
+pkgrel=0
 pkgdesc="An MP3 encoder and graphical frame analyzer"
 url="http://lame.sourceforge.net/"
 license="LGPL"
-- 
cgit v1.2.3


From c69cdfe7a11bc82e9b091fededec06add64d4a3a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 17:59:17 +0000
Subject: main/lvm2: upgrade to 2.02.66

---
 main/lvm2/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/lvm2/APKBUILD b/main/lvm2/APKBUILD
index fb136497..4be2a3f9 100644
--- a/main/lvm2/APKBUILD
+++ b/main/lvm2/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=lvm2
-pkgver=2.02.64
-pkgrel=1
+pkgver=2.02.66
+pkgrel=0
 pkgdesc="Logical Volume Manager 2 utilities"
 url="http://sourceware.org/lvm2/"
 license="GPL"
@@ -47,6 +47,6 @@ dm() {
 	mv "$pkgdir"/sbin/dm* "$subpkgdir"/sbin/
 }
 
-md5sums="59fc0f7f6703a8c7f12df6b7d2e509fb  LVM2.2.02.64.tgz
+md5sums="59766571610a4298f8bedf9f73839050  LVM2.2.02.66.tgz
 6f65f902cf19f144a42b8d6aceadf395  lvm.initd
 ec36d5fe4561220304e406c5c797e71f  lvm.confd"
-- 
cgit v1.2.3


From 778e28024848f552b08f61f3d652826cdcb1c252 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 18:06:03 +0000
Subject: main/mysql: upgrade to 5.1.47

---
 main/mysql/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/mysql/APKBUILD b/main/mysql/APKBUILD
index ff1776fd..49276790 100644
--- a/main/mysql/APKBUILD
+++ b/main/mysql/APKBUILD
@@ -1,8 +1,8 @@
 # Contributor: Carlo Landmeter <clandmeter@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mysql
-pkgver=5.1.46
-pkgrel=1
+pkgver=5.1.47
+pkgrel=0
 pkgdesc="A fast SQL database server"
 url="http://www.mysql.com/"
 license='GPL'
@@ -77,6 +77,6 @@ client() {
 	done
 }
 
-md5sums="04f7c1422199c73a88a3d408b9161b63  mysql-5.1.46.tar.gz
+md5sums="02b9964b3966832f3d6bc87524bfd73f  mysql-5.1.47.tar.gz
 25d08b02bff6aa379dc45859b7a3f28a  mysql.initd
 15a7e3ddd6a40bf5a1eb3a8c69d9c34c  mysql.mycnf"
-- 
cgit v1.2.3


From f8d0034ec248c4722a1d68132c2532a1fe6243db Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Sat, 29 May 2010 18:08:48 +0000
Subject: main/postgresql: upgrade to 8.4.4

---
 main/postgresql/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/postgresql/APKBUILD b/main/postgresql/APKBUILD
index ca034fae..69592378 100644
--- a/main/postgresql/APKBUILD
+++ b/main/postgresql/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postgresql
-pkgver=8.4.3
-pkgrel=3
+pkgver=8.4.4
+pkgrel=0
 pkgdesc="A sophisticated object-relational DBMS"
 url="http://www.postgresql.org/"
 license="BSD"
@@ -56,7 +56,7 @@ client() {
 }
 
 
-md5sums="7f70e7b140fb190f268837255582b07e  postgresql-8.4.3.tar.bz2
+md5sums="4bf2448ad965bca3940df648c02194df  postgresql-8.4.4.tar.bz2
 66c197b8186a6df0752fe2aed40c90c4  postgresql.initd
 12199d445bfa42aafc2a958012737107  postgresql.confd
 7f8de63848c51c8a30c39bec6b1b1606  pg-restore.initd
-- 
cgit v1.2.3


From 27147cbf12b05b974d14a3f0dc690782c8c3c2bd Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 11:16:27 +0000
Subject: main/linux-grsec: upgrade to 2.1.14-2.6.32.14-201005291720

and set KBUILD_BUILD_VERSION to pkgrel+1
---
 main/linux-grsec/APKBUILD                          |    12 +-
 .../grsecurity-2.1.14-2.6.32.13-201005151340.patch | 56087 ------------------
 .../grsecurity-2.1.14-2.6.32.14-201005291720.patch | 56104 +++++++++++++++++++
 3 files changed, 56111 insertions(+), 56092 deletions(-)
 delete mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch
 create mode 100644 main/linux-grsec/grsecurity-2.1.14-2.6.32.14-201005291720.patch

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 02edf0be..538324b8 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=2.6.32.13
+pkgver=2.6.32.14
 _kernver=2.6.32
 pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	grsecurity-2.1.14-2.6.32.13-201005151340.patch
+	grsecurity-2.1.14-2.6.32.14-201005291720.patch
 	0001-grsec-revert-conflicting-flow-cache-changes.patch
 	0002-gre-fix-hard-header-destination-address-checking.patch
 	0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
@@ -67,7 +67,9 @@ menuconfig() {
 
 build() {
 	cd "$srcdir"/build
-	make CC="${CC:--gcc}" || return 1
+	make CC="${CC:--gcc}" \
+		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine" \
+		|| return 1
 }
 
 package() {
@@ -137,8 +139,8 @@ firmware() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-ba6abb1ffee513a1d4f831599ddae490  patch-2.6.32.13.bz2
-00a61e28da8869669171ab12480513e1  grsecurity-2.1.14-2.6.32.13-201005151340.patch
+90f0ec928aff643f05a8b98fad54b10c  patch-2.6.32.14.bz2
+a9985ec4cf7a50beaa755b1ebde839c4  grsecurity-2.1.14-2.6.32.14-201005291720.patch
 1d247140abec49b96250aec9aa59b324  0001-grsec-revert-conflicting-flow-cache-changes.patch
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch
deleted file mode 100644
index 84b90626..00000000
--- a/main/linux-grsec/grsecurity-2.1.14-2.6.32.13-201005151340.patch
+++ /dev/null
@@ -1,56087 +0,0 @@
-diff -urNp linux-2.6.32.13/arch/alpha/include/asm/elf.h linux-2.6.32.13/arch/alpha/include/asm/elf.h
---- linux-2.6.32.13/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/alpha/include/asm/elf.h	2010-05-15 13:21:13.518878295 -0400
-@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- 
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
-+#endif
-+
- /* $0 is set by ld.so to a pointer to a function which might be 
-    registered using atexit.  This provides a mean for the dynamic
-    linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.32.13/arch/alpha/include/asm/pgtable.h linux-2.6.32.13/arch/alpha/include/asm/pgtable.h
---- linux-2.6.32.13/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/alpha/include/asm/pgtable.h	2010-05-15 13:21:13.518878295 -0400
-@@ -101,6 +101,17 @@ struct vm_area_struct;
- #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
- #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
- #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
- 
- #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.32.13/arch/alpha/kernel/module.c linux-2.6.32.13/arch/alpha/kernel/module.c
---- linux-2.6.32.13/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/alpha/kernel/module.c	2010-05-15 13:21:13.518878295 -0400
-@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
- 
- 	/* The small sections were sorted to the end of the segment.
- 	   The following should definitely cover them.  */
--	gp = (u64)me->module_core + me->core_size - 0x8000;
-+	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
- 	got = sechdrs[me->arch.gotsecindex].sh_addr;
- 
- 	for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.32.13/arch/alpha/kernel/osf_sys.c linux-2.6.32.13/arch/alpha/kernel/osf_sys.c
---- linux-2.6.32.13/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/alpha/kernel/osf_sys.c	2010-05-15 13:21:13.518878295 -0400
-@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
- 	   merely specific addresses, but regions of memory -- perhaps
- 	   this feature should be incorporated into all ports?  */
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
- 		if (addr != (unsigned long) -ENOMEM)
-@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
- 	}
- 
- 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
--	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
--					 len, limit);
-+	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
-+
- 	if (addr != (unsigned long) -ENOMEM)
- 		return addr;
- 
-diff -urNp linux-2.6.32.13/arch/alpha/mm/fault.c linux-2.6.32.13/arch/alpha/mm/fault.c
---- linux-2.6.32.13/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/alpha/mm/fault.c	2010-05-15 13:21:13.518878295 -0400
-@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
- 	__reload_thread(pcb);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int ldah, ldq, jmp;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
-+		    jmp == 0x6BFB0000U)
-+		{
-+			unsigned long r27, addr;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
-+
-+			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			err = get_user(r27, (unsigned long *)addr);
-+			if (err)
-+				break;
-+
-+			regs->r27 = r27;
-+			regs->pc = r27;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #2 */
-+		unsigned int ldah, lda, br;
-+
-+		err = get_user(ldah, (unsigned int *)regs->pc);
-+		err |= get_user(lda, (unsigned int *)(regs->pc+4));
-+		err |= get_user(br, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
-+		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
-+		    (br & 0xFFE00000U) == 0xC3E00000U)
-+		{
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
-+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
-+			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
-+
-+			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
-+			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int br;
-+
-+		err = get_user(br, (unsigned int *)regs->pc);
-+
-+		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
-+			unsigned int br2, ldq, nop, jmp;
-+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
-+
-+			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
-+			err = get_user(br2, (unsigned int *)addr);
-+			err |= get_user(ldq, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			err |= get_user(jmp, (unsigned int *)(addr+12));
-+			err |= get_user(resolver, (unsigned long *)(addr+16));
-+
-+			if (err)
-+				break;
-+
-+			if (br2 == 0xC3600000U &&
-+			    ldq == 0xA77B000CU &&
-+			    nop == 0x47FF041FU &&
-+			    jmp == 0x6B7B0000U)
-+			{
-+				regs->r28 = regs->pc+4;
-+				regs->r27 = addr+16;
-+				regs->pc = resolver;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
- 
- /*
-  * This routine handles page faults.  It determines the address,
-@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
-  good_area:
- 	si_code = SEGV_ACCERR;
- 	if (cause < 0) {
--		if (!(vma->vm_flags & VM_EXEC))
-+		if (!(vma->vm_flags & VM_EXEC)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
-+			do_group_exit(SIGKILL);
-+#else
- 			goto bad_area;
-+#endif
-+
-+		}
- 	} else if (!cause) {
- 		/* Allow reads even for write-only mappings */
- 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.32.13/arch/arm/include/asm/elf.h linux-2.6.32.13/arch/arm/include/asm/elf.h
---- linux-2.6.32.13/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/include/asm/elf.h	2010-05-15 13:21:13.518878295 -0400
-@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00008000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
-+#endif
- 
- /* When the program starts, a1 contains a pointer to a function to be 
-    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
-diff -urNp linux-2.6.32.13/arch/arm/include/asm/kmap_types.h linux-2.6.32.13/arch/arm/include/asm/kmap_types.h
---- linux-2.6.32.13/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/include/asm/kmap_types.h	2010-05-15 13:21:13.518878295 -0400
-@@ -19,6 +19,7 @@ enum km_type {
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
- 	KM_L2_CACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.13/arch/arm/include/asm/uaccess.h linux-2.6.32.13/arch/arm/include/asm/uaccess.h
---- linux-2.6.32.13/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/include/asm/uaccess.h	2010-05-15 13:21:13.518878295 -0400
-@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
- 
- static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else /* security hole - plug it */
-@@ -412,6 +415,9 @@ static inline unsigned long __must_check
- 
- static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-diff -urNp linux-2.6.32.13/arch/arm/kernel/kgdb.c linux-2.6.32.13/arch/arm/kernel/kgdb.c
---- linux-2.6.32.13/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/kernel/kgdb.c	2010-05-15 13:21:13.518878295 -0400
-@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
-  * and we handle the normal undef case within the do_undefinstr
-  * handler.
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- #ifndef __ARMEB__
- 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
- #else /* ! __ARMEB__ */
-diff -urNp linux-2.6.32.13/arch/arm/mach-at91/pm.c linux-2.6.32.13/arch/arm/mach-at91/pm.c
---- linux-2.6.32.13/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-at91/pm.c	2010-05-15 13:21:13.518878295 -0400
-@@ -348,7 +348,7 @@ static void at91_pm_end(void)
- }
- 
- 
--static struct platform_suspend_ops at91_pm_ops ={
-+static const struct platform_suspend_ops at91_pm_ops ={
- 	.valid	= at91_pm_valid_state,
- 	.begin	= at91_pm_begin,
- 	.enter	= at91_pm_enter,
-diff -urNp linux-2.6.32.13/arch/arm/mach-omap1/pm.c linux-2.6.32.13/arch/arm/mach-omap1/pm.c
---- linux-2.6.32.13/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-omap1/pm.c	2010-05-15 13:21:13.518878295 -0400
-@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
- 
- 
- 
--static struct platform_suspend_ops omap_pm_ops ={
-+static const struct platform_suspend_ops omap_pm_ops ={
- 	.prepare	= omap_pm_prepare,
- 	.enter		= omap_pm_enter,
- 	.finish		= omap_pm_finish,
-diff -urNp linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c
---- linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-omap2/pm24xx.c	2010-05-15 13:21:13.518878295 -0400
-@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
- 	enable_hlt();
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.prepare	= omap2_pm_prepare,
- 	.enter		= omap2_pm_enter,
- 	.finish		= omap2_pm_finish,
-diff -urNp linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c
---- linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-omap2/pm34xx.c	2010-05-15 13:21:13.518878295 -0400
-@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
- 	return;
- }
- 
--static struct platform_suspend_ops omap_pm_ops = {
-+static const struct platform_suspend_ops omap_pm_ops = {
- 	.begin		= omap3_pm_begin,
- 	.end		= omap3_pm_end,
- 	.prepare	= omap3_pm_prepare,
-diff -urNp linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c
---- linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-pnx4008/pm.c	2010-05-15 13:21:13.518878295 -0400
-@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
- 	       (state == PM_SUSPEND_MEM);
- }
- 
--static struct platform_suspend_ops pnx4008_pm_ops = {
-+static const struct platform_suspend_ops pnx4008_pm_ops = {
- 	.enter = pnx4008_pm_enter,
- 	.valid = pnx4008_pm_valid,
- };
-diff -urNp linux-2.6.32.13/arch/arm/mach-pxa/pm.c linux-2.6.32.13/arch/arm/mach-pxa/pm.c
---- linux-2.6.32.13/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-pxa/pm.c	2010-05-15 13:21:13.518878295 -0400
-@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
- 		pxa_cpu_pm_fns->finish();
- }
- 
--static struct platform_suspend_ops pxa_pm_ops = {
-+static const struct platform_suspend_ops pxa_pm_ops = {
- 	.valid		= pxa_pm_valid,
- 	.enter		= pxa_pm_enter,
- 	.prepare	= pxa_pm_prepare,
-diff -urNp linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c
---- linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-pxa/sharpsl_pm.c	2010-05-15 13:21:13.531870735 -0400
-@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
- }
- 
- #ifdef CONFIG_PM
--static struct platform_suspend_ops sharpsl_pm_ops = {
-+static const struct platform_suspend_ops sharpsl_pm_ops = {
- 	.prepare	= pxa_pm_prepare,
- 	.finish		= pxa_pm_finish,
- 	.enter		= corgi_pxa_pm_enter,
-diff -urNp linux-2.6.32.13/arch/arm/mach-sa1100/pm.c linux-2.6.32.13/arch/arm/mach-sa1100/pm.c
---- linux-2.6.32.13/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mach-sa1100/pm.c	2010-05-15 13:21:13.531870735 -0400
-@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
- 	return virt_to_phys(sp);
- }
- 
--static struct platform_suspend_ops sa11x0_pm_ops = {
-+static const struct platform_suspend_ops sa11x0_pm_ops = {
- 	.enter		= sa11x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.13/arch/arm/mm/fault.c linux-2.6.32.13/arch/arm/mm/fault.c
---- linux-2.6.32.13/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mm/fault.c	2010-05-15 13:21:13.542880278 -0400
-@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
- 	}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (fsr & FSR_LNX_PF) {
-+		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	tsk->thread.address = addr;
- 	tsk->thread.error_code = fsr;
- 	tsk->thread.trap_no = 14;
-@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
- }
- #endif					/* CONFIG_MMU */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-4: ");
-+	for (i = -1; i < 20; i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08lx ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * First Level Translation Fault Handler
-  *
-diff -urNp linux-2.6.32.13/arch/arm/mm/mmap.c linux-2.6.32.13/arch/arm/mm/mmap.c
---- linux-2.6.32.13/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/mm/mmap.c	2010-05-15 13:21:13.546915063 -0400
-@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (len > TASK_SIZE)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -94,8 +98,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-diff -urNp linux-2.6.32.13/arch/arm/plat-s3c/pm.c linux-2.6.32.13/arch/arm/plat-s3c/pm.c
---- linux-2.6.32.13/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/arm/plat-s3c/pm.c	2010-05-15 13:21:13.546915063 -0400
-@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
- 	s3c_pm_check_cleanup();
- }
- 
--static struct platform_suspend_ops s3c_pm_ops = {
-+static const struct platform_suspend_ops s3c_pm_ops = {
- 	.enter		= s3c_pm_enter,
- 	.prepare	= s3c_pm_prepare,
- 	.finish		= s3c_pm_finish,
-diff -urNp linux-2.6.32.13/arch/avr32/include/asm/elf.h linux-2.6.32.13/arch/avr32/include/asm/elf.h
---- linux-2.6.32.13/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/avr32/include/asm/elf.h	2010-05-15 13:21:13.546915063 -0400
-@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
-+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x00001000UL
-+
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-diff -urNp linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/avr32/include/asm/kmap_types.h	2010-05-15 13:21:13.546915063 -0400
-@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
- D(11)	KM_IRQ1,
- D(12)	KM_SOFTIRQ0,
- D(13)	KM_SOFTIRQ1,
--D(14)	KM_TYPE_NR
-+D(14)	KM_CLEARPAGE,
-+D(15)	KM_TYPE_NR
- };
- 
- #undef D
-diff -urNp linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c
---- linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/avr32/mach-at32ap/pm.c	2010-05-15 13:21:13.546915063 -0400
-@@ -176,7 +176,7 @@ out:
- 	return 0;
- }
- 
--static struct platform_suspend_ops avr32_pm_ops = {
-+static const struct platform_suspend_ops avr32_pm_ops = {
- 	.valid	= avr32_pm_valid_state,
- 	.enter	= avr32_pm_enter,
- };
-diff -urNp linux-2.6.32.13/arch/avr32/mm/fault.c linux-2.6.32.13/arch/avr32/mm/fault.c
---- linux-2.6.32.13/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/avr32/mm/fault.c	2010-05-15 13:21:13.546915063 -0400
-@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
- 
- int exception_trace = 1;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (unsigned char *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults. It determines the address and the
-  * problem, and then passes it off to one of the appropriate routines.
-@@ -157,6 +174,16 @@ bad_area:
- 	up_read(&mm->mmap_sem);
- 
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
-+				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		if (exception_trace && printk_ratelimit())
- 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
- 			       "sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.32.13/arch/blackfin/kernel/kgdb.c linux-2.6.32.13/arch/blackfin/kernel/kgdb.c
---- linux-2.6.32.13/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/blackfin/kernel/kgdb.c	2010-05-15 13:21:13.568389913 -0400
-@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;		/* this means that we do not want to exit from the handler */
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0xa1},
- #ifdef CONFIG_SMP
- 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.32.13/arch/blackfin/mach-common/pm.c linux-2.6.32.13/arch/blackfin/mach-common/pm.c
---- linux-2.6.32.13/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/blackfin/mach-common/pm.c	2010-05-15 13:21:13.568389913 -0400
-@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
- 	return 0;
- }
- 
--struct platform_suspend_ops bfin_pm_ops = {
-+const struct platform_suspend_ops bfin_pm_ops = {
- 	.enter = bfin_pm_enter,
- 	.valid	= bfin_pm_valid,
- };
-diff -urNp linux-2.6.32.13/arch/frv/include/asm/kmap_types.h linux-2.6.32.13/arch/frv/include/asm/kmap_types.h
---- linux-2.6.32.13/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/frv/include/asm/kmap_types.h	2010-05-15 13:21:13.568389913 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/hp/common/hwsw_iommu.c	2010-05-15 13:21:13.584352190 -0400
-@@ -17,7 +17,7 @@
- #include <linux/swiotlb.h>
- #include <asm/machvec.h>
- 
--extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
-+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
- 
- /* swiotlb declarations & definitions: */
- extern int swiotlb_late_init_with_default_size (size_t size);
-@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
- 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
- }
- 
--struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
-+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
- {
- 	if (use_swiotlb(dev))
- 		return &swiotlb_dma_ops;
-diff -urNp linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/hp/common/sba_iommu.c	2010-05-15 13:21:13.614291139 -0400
-@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
- 	},
- };
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static int __init
- sba_init(void)
-@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
- 
- __setup("sbapagesize=",sba_page_override);
- 
--struct dma_map_ops sba_dma_ops = {
-+const struct dma_map_ops sba_dma_ops = {
- 	.alloc_coherent		= sba_alloc_coherent,
- 	.free_coherent		= sba_free_coherent,
- 	.map_page		= sba_map_page,
-diff -urNp linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c
---- linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/ia32/binfmt_elf32.c	2010-05-15 13:21:13.614854679 -0400
-@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
- 
- #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- /* Ugly but avoids duplication */
- #include "../../../fs/binfmt_elf.c"
- 
-diff -urNp linux-2.6.32.13/arch/ia64/ia32/ia32priv.h linux-2.6.32.13/arch/ia64/ia32/ia32priv.h
---- linux-2.6.32.13/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/ia32/ia32priv.h	2010-05-15 13:21:13.614854679 -0400
-@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
- #define ELF_DATA	ELFDATA2LSB
- #define ELF_ARCH	EM_386
- 
--#define IA32_STACK_TOP		IA32_PAGE_OFFSET
-+#ifdef CONFIG_PAX_RANDUSTACK
-+#define __IA32_DELTA_STACK	(current->mm->delta_stack)
-+#else
-+#define __IA32_DELTA_STACK	0UL
-+#endif
-+
-+#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
-+
- #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
- #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
- 
-diff -urNp linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/include/asm/dma-mapping.h	2010-05-15 13:21:13.614854679 -0400
-@@ -12,7 +12,7 @@
- 
- #define ARCH_HAS_DMA_GET_REQUIRED_MASK
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- extern struct ia64_machine_vector ia64_mv;
- extern void set_iommu_machvec(void);
- 
-@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *daddr, gfp_t gfp)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	void *caddr;
- 
- 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
-@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *caddr, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	debug_dma_free_coherent(dev, size, caddr, daddr);
- 	ops->free_coherent(dev, size, caddr, daddr);
- }
-@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->mapping_error(dev, daddr);
- }
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = platform_dma_get_ops(dev);
-+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
- 	return ops->dma_supported(dev, mask);
- }
- 
-diff -urNp linux-2.6.32.13/arch/ia64/include/asm/elf.h linux-2.6.32.13/arch/ia64/include/asm/elf.h
---- linux-2.6.32.13/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/include/asm/elf.h	2010-05-15 13:21:13.614854679 -0400
-@@ -43,6 +43,13 @@
-  */
- #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
-+#endif
-+
- #define PT_IA_64_UNWIND		0x70000001
- 
- /* IA-64 relocations: */
-diff -urNp linux-2.6.32.13/arch/ia64/include/asm/machvec.h linux-2.6.32.13/arch/ia64/include/asm/machvec.h
---- linux-2.6.32.13/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/include/asm/machvec.h	2010-05-15 13:21:13.614854679 -0400
-@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
- /* DMA-mapping interface: */
- typedef void ia64_mv_dma_init (void);
- typedef u64 ia64_mv_dma_get_required_mask (struct device *);
--typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
-+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
- 
- /*
-  * WARNING: The legacy I/O space is _architected_.  Platforms are
-@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
- # endif /* CONFIG_IA64_GENERIC */
- 
- extern void swiotlb_dma_init(void);
--extern struct dma_map_ops *dma_get_ops(struct device *);
-+extern const struct dma_map_ops *dma_get_ops(struct device *);
- 
- /*
-  * Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.32.13/arch/ia64/include/asm/pgtable.h linux-2.6.32.13/arch/ia64/include/asm/pgtable.h
---- linux-2.6.32.13/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/include/asm/pgtable.h	2010-05-15 13:21:13.618628456 -0400
-@@ -143,6 +143,17 @@
- #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
- #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
-+# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+#endif
-+
- #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
- #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
- #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.32.13/arch/ia64/include/asm/uaccess.h linux-2.6.32.13/arch/ia64/include/asm/uaccess.h
---- linux-2.6.32.13/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/include/asm/uaccess.h	2010-05-15 13:21:13.626873619 -0400
-@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
- 	const void *__cu_from = (from);							\
- 	long __cu_len = (n);								\
- 											\
--	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
-+	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
- 	long __cu_len = (n);								\
- 											\
- 	__chk_user_ptr(__cu_from);							\
--	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
-+	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
- 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
- 	__cu_len;									\
- })
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/dma-mapping.c	2010-05-15 13:21:13.626873619 -0400
-@@ -3,7 +3,7 @@
- /* Set this to 1 if there is a HW IOMMU in the system */
- int iommu_detected __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-@@ -16,7 +16,7 @@ static int __init dma_init(void)
- }
- fs_initcall(dma_init);
- 
--struct dma_map_ops *dma_get_ops(struct device *dev)
-+const struct dma_map_ops *dma_get_ops(struct device *dev)
- {
- 	return dma_ops;
- }
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/module.c linux-2.6.32.13/arch/ia64/kernel/module.c
---- linux-2.6.32.13/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/module.c	2010-05-15 13:21:13.626873619 -0400
-@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
- void
- module_free (struct module *mod, void *module_region)
- {
--	if (mod && mod->arch.init_unw_table &&
--	    module_region == mod->module_init) {
-+	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
- 		unw_remove_unwind_table(mod->arch.init_unw_table);
- 		mod->arch.init_unw_table = NULL;
- 	}
-@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
- }
- 
- static inline int
-+in_init_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
-+}
-+
-+static inline int
-+in_init_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
-+}
-+
-+static inline int
- in_init (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_init < mod->init_size;
-+	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
-+}
-+
-+static inline int
-+in_core_rx (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
-+}
-+
-+static inline int
-+in_core_rw (const struct module *mod, uint64_t addr)
-+{
-+	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
- }
- 
- static inline int
- in_core (const struct module *mod, uint64_t addr)
- {
--	return addr - (uint64_t) mod->module_core < mod->core_size;
-+	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
- }
- 
- static inline int
-@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
- 		break;
- 
- 	      case RV_BDREL:
--		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
-+		if (in_init_rx(mod, val))
-+			val -= (uint64_t) mod->module_init_rx;
-+		else if (in_init_rw(mod, val))
-+			val -= (uint64_t) mod->module_init_rw;
-+		else if (in_core_rx(mod, val))
-+			val -= (uint64_t) mod->module_core_rx;
-+		else if (in_core_rw(mod, val))
-+			val -= (uint64_t) mod->module_core_rw;
- 		break;
- 
- 	      case RV_LTV:
-@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
- 		 *     addresses have been selected...
- 		 */
- 		uint64_t gp;
--		if (mod->core_size > MAX_LTOFF)
-+		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
- 			/*
- 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
- 			 * at the end of the module.
- 			 */
--			gp = mod->core_size - MAX_LTOFF / 2;
-+			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
- 		else
--			gp = mod->core_size / 2;
--		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
-+			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
-+		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
- 		mod->arch.gp = gp;
- 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
- 	}
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/pci-dma.c linux-2.6.32.13/arch/ia64/kernel/pci-dma.c
---- linux-2.6.32.13/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/pci-dma.c	2010-05-15 13:21:13.626873619 -0400
-@@ -43,7 +43,7 @@ struct device fallback_dev = {
- 	.dma_mask = &fallback_dev.coherent_dma_mask,
- };
- 
--extern struct dma_map_ops intel_dma_ops;
-+extern const struct dma_map_ops intel_dma_ops;
- 
- static int __init pci_iommu_init(void)
- {
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/pci-swiotlb.c	2010-05-15 13:21:13.626873619 -0400
-@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
- 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
- }
- 
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
- 	.map_page = swiotlb_map_page,
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/sys_ia64.c	2010-05-15 13:21:13.626873619 -0400
-@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
- 	if (REGION_NUMBER(addr) == RGN_HPAGE)
- 		addr = 0;
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		addr = mm->free_area_cache;
-+	else
-+#endif
-+
- 	if (!addr)
- 		addr = mm->free_area_cache;
- 
-@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
- 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
-+			if (start_addr != mm->mmap_base) {
- 				/* Start a new search --- just in case we missed some holes.  */
--				addr = TASK_UNMAPPED_BASE;
-+				addr = mm->mmap_base;
- 				goto full_search;
- 			}
- 			return -ENOMEM;
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/topology.c linux-2.6.32.13/arch/ia64/kernel/topology.c
---- linux-2.6.32.13/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/topology.c	2010-05-15 13:21:13.626873619 -0400
-@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
- 	return ret;
- }
- 
--static struct sysfs_ops cache_sysfs_ops = {
-+static const struct sysfs_ops cache_sysfs_ops = {
- 	.show   = cache_show
- };
- 
-diff -urNp linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/kernel/vmlinux.lds.S	2010-05-15 13:21:13.626873619 -0400
-@@ -190,7 +190,7 @@ SECTIONS
-   /* Per-cpu data: */
-   . = ALIGN(PERCPU_PAGE_SIZE);
-   PERCPU_VADDR(PERCPU_ADDR, :percpu)
--  __phys_per_cpu_start = __per_cpu_load;
-+  __phys_per_cpu_start = per_cpu_load;
-   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
-   						 * into percpu page size
- 						 */
-diff -urNp linux-2.6.32.13/arch/ia64/mm/fault.c linux-2.6.32.13/arch/ia64/mm/fault.c
---- linux-2.6.32.13/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/mm/fault.c	2010-05-15 13:21:13.626873619 -0400
-@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
- 	return pte_present(pte);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- void __kprobes
- ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
- {
-@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
- 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
- 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
- 
--	if ((vma->vm_flags & mask) != mask)
-+	if ((vma->vm_flags & mask) != mask) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
-+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
-+				goto bad_area;
-+
-+			up_read(&mm->mmap_sem);
-+			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
- 
-+	}
-+
-   survive:
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.13/arch/ia64/mm/init.c linux-2.6.32.13/arch/ia64/mm/init.c
---- linux-2.6.32.13/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/mm/init.c	2010-05-15 13:21:13.626873619 -0400
-@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
- 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
- 		vma->vm_end = vma->vm_start + PAGE_SIZE;
- 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
-+			vma->vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+			if (current->mm->pax_flags & MF_PAX_MPROTECT)
-+				vma->vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+		}
-+#endif
-+
- 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 		down_write(&current->mm->mmap_sem);
- 		if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/ia64/sn/pci/pci_dma.c	2010-05-15 13:21:13.626873619 -0400
-@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
- 	return ret;
- }
- 
--static struct dma_map_ops sn_dma_ops = {
-+static const struct dma_map_ops sn_dma_ops = {
- 	.alloc_coherent		= sn_dma_alloc_coherent,
- 	.free_coherent		= sn_dma_free_coherent,
- 	.map_page		= sn_dma_map_page,
-diff -urNp linux-2.6.32.13/arch/m32r/lib/usercopy.c linux-2.6.32.13/arch/m32r/lib/usercopy.c
---- linux-2.6.32.13/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/m32r/lib/usercopy.c	2010-05-15 13:21:13.630645180 -0400
-@@ -14,6 +14,9 @@
- unsigned long
- __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetch(from);
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		__copy_user(to,from,n);
-@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
- unsigned long
- __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	prefetchw(to);
- 	if (access_ok(VERIFY_READ, from, n))
- 		__copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c
---- linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/alchemy/devboards/pm.c	2010-05-15 13:21:13.630645180 -0400
-@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
- 
- }
- 
--static struct platform_suspend_ops db1x_pm_ops = {
-+static const struct platform_suspend_ops db1x_pm_ops = {
- 	.valid		= suspend_valid_only_mem,
- 	.begin		= db1x_pm_begin,
- 	.enter		= db1x_pm_enter,
-diff -urNp linux-2.6.32.13/arch/mips/include/asm/elf.h linux-2.6.32.13/arch/mips/include/asm/elf.h
---- linux-2.6.32.13/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/include/asm/elf.h	2010-05-15 13:21:13.630645180 -0400
-@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
- #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
- #endif
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.32.13/arch/mips/include/asm/page.h linux-2.6.32.13/arch/mips/include/asm/page.h
---- linux-2.6.32.13/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/include/asm/page.h	2010-05-15 13:21:13.630645180 -0400
-@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
-   #ifdef CONFIG_CPU_MIPS32
-     typedef struct { unsigned long pte_low, pte_high; } pte_t;
-     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
--    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
-+    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
-   #else
-      typedef struct { unsigned long long pte; } pte_t;
-      #define pte_val(x)	((x).pte)
-diff -urNp linux-2.6.32.13/arch/mips/include/asm/system.h linux-2.6.32.13/arch/mips/include/asm/system.h
---- linux-2.6.32.13/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/include/asm/system.h	2010-05-15 13:21:13.630645180 -0400
-@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
-  */
- #define __ARCH_WANT_UNLOCKED_CTXSW
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ALMASK)
- 
- #endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/kernel/binfmt_elfn32.c	2010-05-15 13:21:13.630645180 -0400
-@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- #include <linux/module.h>
- #include <linux/elfcore.h>
-diff -urNp linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/kernel/binfmt_elfo32.c	2010-05-15 13:21:13.630645180 -0400
-@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
- #undef ELF_ET_DYN_BASE
- #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#endif
-+
- #include <asm/processor.h>
- 
- /*
-diff -urNp linux-2.6.32.13/arch/mips/kernel/kgdb.c linux-2.6.32.13/arch/mips/kernel/kgdb.c
---- linux-2.6.32.13/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/kernel/kgdb.c	2010-05-15 13:21:13.630645180 -0400
-@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
- 	return -1;
- }
- 
-+/* cannot be const */
- struct kgdb_arch arch_kgdb_ops;
- 
- /*
-diff -urNp linux-2.6.32.13/arch/mips/kernel/process.c linux-2.6.32.13/arch/mips/kernel/process.c
---- linux-2.6.32.13/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/kernel/process.c	2010-05-15 13:21:13.630645180 -0400
-@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
- out:
- 	return pc;
- }
--
--/*
-- * Don't forget that the stack pointer must be aligned on a 8 bytes
-- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
-- */
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() & ~PAGE_MASK;
--
--	return sp & ALMASK;
--}
-diff -urNp linux-2.6.32.13/arch/mips/kernel/syscall.c linux-2.6.32.13/arch/mips/kernel/syscall.c
---- linux-2.6.32.13/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/kernel/syscall.c	2010-05-15 13:21:13.630645180 -0400
-@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
- 	do_color_align = 0;
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
- 		    (!vmm || addr + len <= vmm->vm_start))
- 			return addr;
- 	}
--	addr = TASK_UNMAPPED_BASE;
-+	addr = current->mm->mmap_base;
- 	if (do_color_align)
- 		addr = COLOUR_ALIGN(addr, pgoff);
- 	else
-diff -urNp linux-2.6.32.13/arch/mips/mm/fault.c linux-2.6.32.13/arch/mips/mm/fault.c
---- linux-2.6.32.13/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/mips/mm/fault.c	2010-05-15 13:21:13.630645180 -0400
-@@ -26,6 +26,23 @@
- #include <asm/ptrace.h>
- #include <asm/highmem.h>		/* For VMALLOC_END */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+void pax_report_insns(void *pc)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * This routine handles page faults.  It determines the address,
-  * and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.32.13/arch/parisc/include/asm/elf.h linux-2.6.32.13/arch/parisc/include/asm/elf.h
---- linux-2.6.32.13/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/include/asm/elf.h	2010-05-15 13:21:13.630645180 -0400
-@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-    but it's not easy, and we've already done it here.  */
-diff -urNp linux-2.6.32.13/arch/parisc/include/asm/pgtable.h linux-2.6.32.13/arch/parisc/include/asm/pgtable.h
---- linux-2.6.32.13/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/include/asm/pgtable.h	2010-05-15 13:21:13.630645180 -0400
-@@ -207,6 +207,17 @@
- #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
- #define PAGE_COPY       PAGE_EXECREAD
- #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
-+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
- #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
- #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.32.13/arch/parisc/kernel/module.c linux-2.6.32.13/arch/parisc/kernel/module.c
---- linux-2.6.32.13/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/kernel/module.c	2010-05-15 13:21:13.630645180 -0400
-@@ -95,16 +95,38 @@
- 
- /* three functions to determine where in the module core
-  * or init pieces the location is */
-+static inline int in_init_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rx &&
-+		loc < (me->module_init_rx + me->init_size_rx));
-+}
-+
-+static inline int in_init_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_init_rw &&
-+		loc < (me->module_init_rw + me->init_size_rw));
-+}
-+
- static inline int in_init(struct module *me, void *loc)
- {
--	return (loc >= me->module_init &&
--		loc <= (me->module_init + me->init_size));
-+	return in_init_rx(me, loc) || in_init_rw(me, loc);
-+}
-+
-+static inline int in_core_rx(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rx &&
-+		loc < (me->module_core_rx + me->core_size_rx));
-+}
-+
-+static inline int in_core_rw(struct module *me, void *loc)
-+{
-+	return (loc >= me->module_core_rw &&
-+		loc < (me->module_core_rw + me->core_size_rw));
- }
- 
- static inline int in_core(struct module *me, void *loc)
- {
--	return (loc >= me->module_core &&
--		loc <= (me->module_core + me->core_size));
-+	return in_core_rx(me, loc) || in_core_rw(me, loc);
- }
- 
- static inline int in_local(struct module *me, void *loc)
-@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
- 	}
- 
- 	/* align things a bit */
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.got_offset = me->core_size;
--	me->core_size += gots * sizeof(struct got_entry);
--
--	me->core_size = ALIGN(me->core_size, 16);
--	me->arch.fdesc_offset = me->core_size;
--	me->core_size += fdescs * sizeof(Elf_Fdesc);
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += gots * sizeof(struct got_entry);
-+
-+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
-+	me->arch.fdesc_offset = me->core_size_rw;
-+	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
- 
- 	me->arch.got_max = gots;
- 	me->arch.fdesc_max = fdescs;
-@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
- 
- 	BUG_ON(value == 0);
- 
--	got = me->module_core + me->arch.got_offset;
-+	got = me->module_core_rw + me->arch.got_offset;
- 	for (i = 0; got[i].addr; i++)
- 		if (got[i].addr == value)
- 			goto out;
-@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
- #ifdef CONFIG_64BIT
- static Elf_Addr get_fdesc(struct module *me, unsigned long value)
- {
--	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
-+	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
- 
- 	if (!value) {
- 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
-@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
- 
- 	/* Create new one */
- 	fdesc->addr = value;
--	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 	return (Elf_Addr)fdesc;
- }
- #endif /* CONFIG_64BIT */
-@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
- 
- 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
- 	end = table + sechdrs[me->arch.unwind_section].sh_size;
--	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
-+	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
- 
- 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
- 	       me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/kernel/sys_parisc.c	2010-05-15 13:21:13.630645180 -0400
-@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (flags & MAP_FIXED)
- 		return addr;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (filp) {
- 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.32.13/arch/parisc/kernel/traps.c linux-2.6.32.13/arch/parisc/kernel/traps.c
---- linux-2.6.32.13/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/kernel/traps.c	2010-05-15 13:21:13.630645180 -0400
-@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
- 
- 			down_read(&current->mm->mmap_sem);
- 			vma = find_vma(current->mm,regs->iaoq[0]);
--			if (vma && (regs->iaoq[0] >= vma->vm_start)
--				&& (vma->vm_flags & VM_EXEC)) {
--
-+			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
- 				fault_address = regs->iaoq[0];
- 				fault_space = regs->iasq[0];
- 
-diff -urNp linux-2.6.32.13/arch/parisc/mm/fault.c linux-2.6.32.13/arch/parisc/mm/fault.c
---- linux-2.6.32.13/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/parisc/mm/fault.c	2010-05-15 13:21:13.630645180 -0400
-@@ -15,6 +15,7 @@
- #include <linux/sched.h>
- #include <linux/interrupt.h>
- #include <linux/module.h>
-+#include <linux/unistd.h>
- 
- #include <asm/uaccess.h>
- #include <asm/traps.h>
-@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
- static unsigned long
- parisc_acctyp(unsigned long code, unsigned int inst)
- {
--	if (code == 6 || code == 16)
-+	if (code == 6 || code == 7 || code == 16)
- 	    return VM_EXEC;
- 
- 	switch (inst & 0xf0000000) {
-@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
- 			}
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when rt_sigreturn trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: unpatched PLT emulation */
-+		unsigned int bl, depwi;
-+
-+		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
-+
-+		if (err)
-+			break;
-+
-+		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
-+			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
-+
-+			err = get_user(ldw, (unsigned int *)addr);
-+			err |= get_user(bv, (unsigned int *)(addr+4));
-+			err |= get_user(ldw2, (unsigned int *)(addr+8));
-+
-+			if (err)
-+				break;
-+
-+			if (ldw == 0x0E801096U &&
-+			    bv == 0xEAC0C000U &&
-+			    ldw2 == 0x0E881095U)
-+			{
-+				unsigned int resolver, map;
-+
-+				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
-+				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
-+				if (err)
-+					break;
-+
-+				regs->gr[20] = instruction_pointer(regs)+8;
-+				regs->gr[21] = map;
-+				regs->gr[22] = resolver;
-+				regs->iaoq[0] = resolver | 3UL;
-+				regs->iaoq[1] = regs->iaoq[0] + 4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+
-+#ifndef CONFIG_PAX_EMUSIGRT
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+#endif
-+
-+	do { /* PaX: rt_sigreturn emulation */
-+		unsigned int ldi1, ldi2, bel, nop;
-+
-+		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
-+		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
-+		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
-+		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
-+		    ldi2 == 0x3414015AU &&
-+		    bel == 0xE4008200U &&
-+		    nop == 0x08000240U)
-+		{
-+			regs->gr[25] = (ldi1 & 2) >> 1;
-+			regs->gr[20] = __NR_rt_sigreturn;
-+			regs->gr[31] = regs->iaoq[1] + 16;
-+			regs->sr[0] = regs->iasq[1];
-+			regs->iaoq[0] = 0x100UL;
-+			regs->iaoq[1] = regs->iaoq[0] + 4;
-+			regs->iasq[0] = regs->sr[2];
-+			regs->iasq[1] = regs->sr[2];
-+			return 2;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fix;
-@@ -192,8 +303,33 @@ good_area:
- 
- 	acc_type = parisc_acctyp(code,regs->iir);
- 
--	if ((vma->vm_flags & acc_type) != acc_type)
-+	if ((vma->vm_flags & acc_type) != acc_type) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
-+		    (address & ~3UL) == instruction_pointer(regs))
-+		{
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 3:
-+				return;
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			case 2:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		goto bad_area;
-+	}
- 
- 	/*
- 	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/device.h linux-2.6.32.13/arch/powerpc/include/asm/device.h
---- linux-2.6.32.13/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/device.h	2010-05-15 13:21:13.630645180 -0400
-@@ -14,7 +14,7 @@ struct dev_archdata {
- 	struct device_node	*of_node;
- 
- 	/* DMA operations on that device */
--	struct dma_map_ops	*dma_ops;
-+	const struct dma_map_ops	*dma_ops;
- 
- 	/*
- 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/dma-mapping.h	2010-05-15 13:21:13.630645180 -0400
-@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
- #ifdef CONFIG_PPC64
- extern struct dma_map_ops dma_iommu_ops;
- #endif
--extern struct dma_map_ops dma_direct_ops;
-+extern const struct dma_map_ops dma_direct_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- 	/* We don't handle the NULL dev case for ISA for now. We could
- 	 * do it via an out of line call but it is not needed for now. The
-@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
- 	return dev->archdata.dma_ops;
- }
- 
--static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
-+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
- {
- 	dev->archdata.dma_ops = ops;
- }
-@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
- 
- static inline int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return 0;
-@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
- 
- static inline int dma_set_mask(struct device *dev, u64 dma_mask)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (unlikely(dma_ops == NULL))
- 		return -EIO;
-@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	BUG_ON(!dma_ops);
-@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	BUG_ON(!dma_ops);
- 
-@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
- 
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *dma_ops = get_dma_ops(dev);
-+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
- 
- 	if (dma_ops->mapping_error)
- 		return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/elf.h linux-2.6.32.13/arch/powerpc/include/asm/elf.h
---- linux-2.6.32.13/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/elf.h	2010-05-15 13:21:13.643322255 -0400
-@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
--extern unsigned long randomize_et_dyn(unsigned long base);
--#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
-+#define ELF_ET_DYN_BASE		(0x20000000)
-+
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
-+
-+#ifdef __powerpc64__
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
-+#else
-+#define PAX_DELTA_MMAP_LEN	15
-+#define PAX_DELTA_STACK_LEN	15
-+#endif
-+#endif
- 
- /*
-  * Our registers are always unsigned longs, whether we're a 32 bit
-@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
- 	(0x7ff >> (PAGE_SHIFT - 12)) : \
- 	(0x3ffff >> (PAGE_SHIFT - 12)))
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* __KERNEL__ */
- 
- /*
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/iommu.h linux-2.6.32.13/arch/powerpc/include/asm/iommu.h
---- linux-2.6.32.13/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/iommu.h	2010-05-15 13:21:13.643322255 -0400
-@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
- extern void iommu_init_early_dart(void);
- extern void iommu_init_early_pasemi(void);
- 
-+/* dma-iommu.c */
-+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
-+
- #ifdef CONFIG_PCI
- extern void pci_iommu_init(void);
- extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/kmap_types.h	2010-05-15 13:21:13.643322255 -0400
-@@ -26,6 +26,7 @@ enum km_type {
- 	KM_SOFTIRQ1,
- 	KM_PPC_SYNC_PAGE,
- 	KM_PPC_SYNC_ICACHE,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/page_64.h linux-2.6.32.13/arch/powerpc/include/asm/page_64.h
---- linux-2.6.32.13/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/page_64.h	2010-05-15 13:21:13.643322255 -0400
-@@ -180,15 +180,18 @@ do {						\
-  * stack by default, so in the absense of a PT_GNU_STACK program header
-  * we turn execute permission off.
-  */
--#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_STACK_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
-+#ifndef CONFIG_PAX_PAGEEXEC
- #define VM_STACK_DEFAULT_FLAGS \
- 	(test_thread_flag(TIF_32BIT) ? \
- 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
-+#endif
- 
- #include <asm-generic/getorder.h>
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/page.h linux-2.6.32.13/arch/powerpc/include/asm/page.h
---- linux-2.6.32.13/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/page.h	2010-05-15 13:21:13.643322255 -0400
-@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
-  * and needs to be executable.  This means the whole heap ends
-  * up being executable.
-  */
--#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
--				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-+#define VM_DATA_DEFAULT_FLAGS32 \
-+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
-+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
- 
- #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
- 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
- #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
- #endif
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- #ifndef __ASSEMBLY__
- 
- #undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/pci.h linux-2.6.32.13/arch/powerpc/include/asm/pci.h
---- linux-2.6.32.13/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/pci.h	2010-05-15 13:21:13.643322255 -0400
-@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
- }
- 
- #ifdef CONFIG_PCI
--extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
--extern struct dma_map_ops *get_pci_dma_ops(void);
-+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
-+extern const struct dma_map_ops *get_pci_dma_ops(void);
- #else	/* CONFIG_PCI */
- #define set_pci_dma_ops(d)
- #define get_pci_dma_ops()	NULL
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/pte-hash32.h	2010-05-15 13:21:13.643322255 -0400
-@@ -21,6 +21,7 @@
- #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
- #define _PAGE_USER	0x004	/* usermode access allowed */
- #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
-+#define _PAGE_EXEC	_PAGE_GUARDED
- #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
- #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
- #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/reg.h linux-2.6.32.13/arch/powerpc/include/asm/reg.h
---- linux-2.6.32.13/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/reg.h	2010-05-15 13:21:13.643322255 -0400
-@@ -191,6 +191,7 @@
- #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
- #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
- #define   DSISR_NOHPTE		0x40000000	/* no translation found */
-+#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
- #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
- #define   DSISR_ISSTORE		0x02000000	/* access was a store */
- #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/swiotlb.h	2010-05-15 13:21:13.643322255 -0400
-@@ -13,7 +13,7 @@
- 
- #include <linux/swiotlb.h>
- 
--extern struct dma_map_ops swiotlb_dma_ops;
-+extern const struct dma_map_ops swiotlb_dma_ops;
- 
- static inline void dma_mark_clean(void *addr, size_t size) {}
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/include/asm/uaccess.h	2010-05-15 13:21:13.643322255 -0400
-@@ -327,52 +327,6 @@ do {								\
- extern unsigned long __copy_tofrom_user(void __user *to,
- 		const void __user *from, unsigned long size);
- 
--#ifndef __powerpc64__
--
--static inline unsigned long copy_from_user(void *to,
--		const void __user *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_READ, from, n))
--		return __copy_tofrom_user((__force void __user *)to, from, n);
--	if ((unsigned long)from < TASK_SIZE) {
--		over = (unsigned long)from + n - TASK_SIZE;
--		return __copy_tofrom_user((__force void __user *)to, from,
--				n - over) + over;
--	}
--	return n;
--}
--
--static inline unsigned long copy_to_user(void __user *to,
--		const void *from, unsigned long n)
--{
--	unsigned long over;
--
--	if (access_ok(VERIFY_WRITE, to, n))
--		return __copy_tofrom_user(to, (__force void __user *)from, n);
--	if ((unsigned long)to < TASK_SIZE) {
--		over = (unsigned long)to + n - TASK_SIZE;
--		return __copy_tofrom_user(to, (__force void __user *)from,
--				n - over) + over;
--	}
--	return n;
--}
--
--#else /* __powerpc64__ */
--
--#define __copy_in_user(to, from, size) \
--	__copy_tofrom_user((to), (from), (size))
--
--extern unsigned long copy_from_user(void *to, const void __user *from,
--				    unsigned long n);
--extern unsigned long copy_to_user(void __user *to, const void *from,
--				  unsigned long n);
--extern unsigned long copy_in_user(void __user *to, const void __user *from,
--				  unsigned long n);
--
--#endif /* __powerpc64__ */
--
- static inline unsigned long __copy_from_user_inatomic(void *to,
- 		const void __user *from, unsigned long n)
- {
-@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
- 	return __copy_tofrom_user((__force void __user *)to, from, n);
- }
- 
-@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
- 		if (ret == 0)
- 			return 0;
- 	}
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
- }
- 
-@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
- 	return __copy_to_user_inatomic(to, from, size);
- }
- 
-+#ifndef __powerpc64__
-+
-+static inline unsigned long __must_check copy_from_user(void *to,
-+		const void __user *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_READ, from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		return __copy_tofrom_user((__force void __user *)to, from, n);
-+	}
-+	if ((unsigned long)from < TASK_SIZE) {
-+		over = (unsigned long)from + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n - over))
-+			check_object_size(to, n - over, false);
-+		return __copy_tofrom_user((__force void __user *)to, from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to,
-+		const void *from, unsigned long n)
-+{
-+	unsigned long over;
-+
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (access_ok(VERIFY_WRITE, to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from, n);
-+	}
-+	if ((unsigned long)to < TASK_SIZE) {
-+		over = (unsigned long)to + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n - over, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from,
-+				n - over) + over;
-+	}
-+	return n;
-+}
-+
-+#else /* __powerpc64__ */
-+
-+#define __copy_in_user(to, from, size) \
-+	__copy_tofrom_user((to), (from), (size))
-+
-+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
-+
-+	if (likely(access_ok(VERIFY_READ, from, n)))
-+		n = __copy_from_user(to, from, n);
-+	else
-+		memset(to, 0, n);
-+	return n;
-+}
-+
-+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if ((long)n < 0 || n > INT_MAX)
-+		return n;
-+
-+	if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		n = __copy_to_user(to, from, n);
-+	}
-+	return n;
-+}
-+
-+extern unsigned long copy_in_user(void __user *to, const void __user *from,
-+				  unsigned long n);
-+
-+#endif /* __powerpc64__ */
-+
- extern unsigned long __clear_user(void __user *addr, unsigned long size);
- 
- static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c
---- linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/cacheinfo.c	2010-05-15 13:21:13.643322255 -0400
-@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
- 	&cache_assoc_attr,
- };
- 
--static struct sysfs_ops cache_index_ops = {
-+static const struct sysfs_ops cache_index_ops = {
- 	.show = cache_index_show,
- };
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma.c linux-2.6.32.13/arch/powerpc/kernel/dma.c
---- linux-2.6.32.13/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/dma.c	2010-05-15 13:21:13.643322255 -0400
-@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
- }
- #endif
- 
--struct dma_map_ops dma_direct_ops = {
-+const struct dma_map_ops dma_direct_ops = {
- 	.alloc_coherent	= dma_direct_alloc_coherent,
- 	.free_coherent	= dma_direct_free_coherent,
- 	.map_sg		= dma_direct_map_sg,
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/dma-iommu.c	2010-05-15 13:21:13.643322255 -0400
-@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
- }
- 
- /* We support DMA to/from any memory page via the iommu */
--static int dma_iommu_dma_supported(struct device *dev, u64 mask)
-+int dma_iommu_dma_supported(struct device *dev, u64 mask)
- {
- 	struct iommu_table *tbl = get_iommu_table_base(dev);
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/dma-swiotlb.c	2010-05-15 13:21:13.646883281 -0400
-@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
-  * map_page, and unmap_page on highmem, use normal dma_ops
-  * for everything else.
-  */
--struct dma_map_ops swiotlb_dma_ops = {
-+const struct dma_map_ops swiotlb_dma_ops = {
- 	.alloc_coherent = dma_direct_alloc_coherent,
- 	.free_coherent = dma_direct_free_coherent,
- 	.map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/exceptions-64e.S	2010-05-15 13:21:13.646883281 -0400
-@@ -455,6 +455,7 @@ storage_fault_common:
- 	std	r14,_DAR(r1)
- 	std	r15,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	mr	r4,r14
- 	mr	r5,r15
- 	ld	r14,PACA_EXGEN+EX_R14(r13)
-@@ -464,8 +465,7 @@ storage_fault_common:
- 	cmpdi	r3,0
- 	bne-	1f
- 	b	.ret_from_except_lite
--1:	bl	.save_nvgprs
--	mr	r5,r3
-+1:	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	ld	r4,_DAR(r1)
- 	bl	.bad_page_fault
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/exceptions-64s.S	2010-05-15 13:21:13.646883281 -0400
-@@ -818,10 +818,10 @@ handle_page_fault:
- 11:	ld	r4,_DAR(r1)
- 	ld	r5,_DSISR(r1)
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
-+	bl	.save_nvgprs
- 	bl	.do_page_fault
- 	cmpdi	r3,0
- 	beq+	13f
--	bl	.save_nvgprs
- 	mr	r5,r3
- 	addi	r3,r1,STACK_FRAME_OVERHEAD
- 	lwz	r4,_DAR(r1)
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/ibmebus.c	2010-05-15 13:21:13.646883281 -0400
-@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
- 	return 1;
- }
- 
--static struct dma_map_ops ibmebus_dma_ops = {
-+static const struct dma_map_ops ibmebus_dma_ops = {
- 	.alloc_coherent = ibmebus_alloc_coherent,
- 	.free_coherent  = ibmebus_free_coherent,
- 	.map_sg         = ibmebus_map_sg,
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/kgdb.c linux-2.6.32.13/arch/powerpc/kernel/kgdb.c
---- linux-2.6.32.13/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/kgdb.c	2010-05-15 13:21:13.658890137 -0400
-@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
- 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
- 		return 0;
- 
--	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
-+	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
- 		regs->nip += 4;
- 
- 	return 1;
-@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
- /*
-  * Global data
-  */
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
- };
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/module_32.c linux-2.6.32.13/arch/powerpc/kernel/module_32.c
---- linux-2.6.32.13/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/module_32.c	2010-05-15 13:21:13.658890137 -0400
-@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
- 			me->arch.core_plt_section = i;
- 	}
- 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
--		printk("Module doesn't contain .plt or .init.plt sections.\n");
-+		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
- 		return -ENOEXEC;
- 	}
- 
-@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
- 
- 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
- 	/* Init, or core PLT? */
--	if (location >= mod->module_core
--	    && location < mod->module_core + mod->core_size)
-+	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
-+	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
- 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
--	else
-+	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
-+		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
- 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
-+	else {
-+		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
-+		return ~0UL;
-+	}
- 
- 	/* Find this entry, or if that fails, the next avail. entry */
- 	while (entry->jump[0]) {
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/module.c linux-2.6.32.13/arch/powerpc/kernel/module.c
---- linux-2.6.32.13/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/module.c	2010-05-15 13:21:13.658890137 -0400
-@@ -31,11 +31,24 @@
- 
- LIST_HEAD(module_bug_list);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
- void *module_alloc(unsigned long size)
- {
- 	if (size == 0)
- 		return NULL;
- 
-+	return vmalloc(size);
-+}
-+
-+void *module_alloc_exec(unsigned long size)
-+#else
-+void *module_alloc(unsigned long size)
-+#endif
-+
-+{
-+	if (size == 0)
-+		return NULL;
-+
- 	return vmalloc_exec(size);
- }
- 
-@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+#endif
-+
- static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
- 				    const Elf_Shdr *sechdrs,
- 				    const char *name)
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/pci-common.c linux-2.6.32.13/arch/powerpc/kernel/pci-common.c
---- linux-2.6.32.13/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/pci-common.c	2010-05-15 13:21:13.678895652 -0400
-@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
- unsigned int ppc_pci_flags = 0;
- 
- 
--static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
-+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
- 
--void set_pci_dma_ops(struct dma_map_ops *dma_ops)
-+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
- {
- 	pci_dma_ops = dma_ops;
- }
- 
--struct dma_map_ops *get_pci_dma_ops(void)
-+const struct dma_map_ops *get_pci_dma_ops(void)
- {
- 	return pci_dma_ops;
- }
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/process.c linux-2.6.32.13/arch/powerpc/kernel/process.c
---- linux-2.6.32.13/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/process.c	2010-05-15 13:21:13.678895652 -0400
-@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
- 		sp -= get_random_int() & ~PAGE_MASK;
- 	return sp & ~0xf;
- }
--
--static inline unsigned long brk_rnd(void)
--{
--        unsigned long rnd = 0;
--
--	/* 8MB for 32bit, 1GB for 64bit */
--	if (is_32bit_task())
--		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
--	else
--		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
--
--	return rnd << PAGE_SHIFT;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long base = mm->brk;
--	unsigned long ret;
--
--#ifdef CONFIG_PPC_STD_MMU_64
--	/*
--	 * If we are using 1TB segments and we are allowed to randomise
--	 * the heap, we can put it above 1TB so it is backed by a 1TB
--	 * segment. Otherwise the heap will be in the bottom 1TB
--	 * which always uses 256MB segments and this may result in a
--	 * performance penalty.
--	 */
--	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
--		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
--#endif
--
--	ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < mm->brk)
--		return mm->brk;
--
--	return ret;
--}
--
--unsigned long randomize_et_dyn(unsigned long base)
--{
--	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
--
--	if (ret < base)
--		return base;
--
--	return ret;
--}
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/signal_32.c linux-2.6.32.13/arch/powerpc/kernel/signal_32.c
---- linux-2.6.32.13/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/signal_32.c	2010-05-15 13:21:13.686885851 -0400
-@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
- 	/* Save user registers on the stack */
- 	frame = &rt_sf->uc.uc_mcontext;
- 	addr = frame;
--	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		if (save_user_regs(regs, frame, 0, 1))
- 			goto badframe;
- 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/signal_64.c linux-2.6.32.13/arch/powerpc/kernel/signal_64.c
---- linux-2.6.32.13/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/signal_64.c	2010-05-15 13:21:13.686885851 -0400
-@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
- 	current->thread.fpscr.val = 0;
- 
- 	/* Set up to return from userspace. */
--	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
-+	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
- 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
- 	} else {
- 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c
---- linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/sys_ppc32.c	2010-05-15 13:21:13.686885851 -0400
-@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
- 	if (oldlenp) {
- 		if (!error) {
- 			if (get_user(oldlen, oldlenp) ||
--			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
-+			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
-+			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
- 				error = -EFAULT;
- 		}
--		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
- 	}
- 	return error;
- }
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/vdso.c linux-2.6.32.13/arch/powerpc/kernel/vdso.c
---- linux-2.6.32.13/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/vdso.c	2010-05-15 13:21:13.686885851 -0400
-@@ -36,6 +36,7 @@
- #include <asm/firmware.h>
- #include <asm/vdso.h>
- #include <asm/vdso_datapage.h>
-+#include <asm/mman.h>
- 
- #include "setup.h"
- 
-@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = VDSO32_MBASE;
- #endif
- 
--	current->mm->context.vdso_base = 0;
-+	current->mm->context.vdso_base = ~0UL;
- 
- 	/* vDSO has a problem and was disabled, just don't "enable" it for the
- 	 * process
-@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
- 	vdso_base = get_unmapped_area(NULL, vdso_base,
- 				      (vdso_pages << PAGE_SHIFT) +
- 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
--				      0, 0);
-+				      0, MAP_PRIVATE | MAP_EXECUTABLE);
- 	if (IS_ERR_VALUE(vdso_base)) {
- 		rc = vdso_base;
- 		goto fail_mmapsem;
-diff -urNp linux-2.6.32.13/arch/powerpc/kernel/vio.c linux-2.6.32.13/arch/powerpc/kernel/vio.c
---- linux-2.6.32.13/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/kernel/vio.c	2010-05-15 13:21:13.690884467 -0400
-@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
- 	vio_cmo_dealloc(viodev, alloc_size);
- }
- 
--struct dma_map_ops vio_dma_mapping_ops = {
-+static const struct dma_map_ops vio_dma_mapping_ops = {
- 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
- 	.free_coherent  = vio_dma_iommu_free_coherent,
- 	.map_sg         = vio_dma_iommu_map_sg,
- 	.unmap_sg       = vio_dma_iommu_unmap_sg,
-+	.dma_supported  = dma_iommu_dma_supported,
- 	.map_page       = vio_dma_iommu_map_page,
- 	.unmap_page     = vio_dma_iommu_unmap_page,
- 
-@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
- 
- static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
- {
--	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
- 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
- }
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/lib/usercopy_64.c	2010-05-15 13:21:13.690884467 -0400
-@@ -9,22 +9,6 @@
- #include <linux/module.h>
- #include <asm/uaccess.h>
- 
--unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_READ, from, n)))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
--}
--
--unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
--{
--	if (likely(access_ok(VERIFY_WRITE, to, n)))
--		n = __copy_to_user(to, from, n);
--	return n;
--}
--
- unsigned long copy_in_user(void __user *to, const void __user *from,
- 			   unsigned long n)
- {
-@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
- 	return n;
- }
- 
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.13/arch/powerpc/mm/fault.c linux-2.6.32.13/arch/powerpc/mm/fault.c
---- linux-2.6.32.13/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/mm/fault.c	2010-05-15 13:21:13.690884467 -0400
-@@ -30,6 +30,10 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/perf_event.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
-+#include <linux/unistd.h>
- 
- #include <asm/firmware.h>
- #include <asm/page.h>
-@@ -40,6 +44,7 @@
- #include <asm/uaccess.h>
- #include <asm/tlbflush.h>
- #include <asm/siginfo.h>
-+#include <asm/ptrace.h>
- 
- 
- #ifdef CONFIG_KPROBES
-@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
- }
- #endif
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+/*
-+ * PaX: decide what to do with offenders (regs->nip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 5; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int __user *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- /*
-  * Check whether the instruction at regs->nip is a store using
-  * an update addressing form which will update r1.
-@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
- 	 * indicate errors in DSISR but can validly be set in SRR1.
- 	 */
- 	if (trap == 0x400)
--		error_code &= 0x48200000;
-+		error_code &= 0x58200000;
- 	else
- 		is_write = error_code & DSISR_ISSTORE;
- #else
-@@ -250,7 +282,7 @@ good_area:
-          * "undefined".  Of those that can be set, this is the only
-          * one which seems bad.
-          */
--	if (error_code & 0x10000000)
-+	if (error_code & DSISR_GUARDED)
-                 /* Guarded storage error. */
- 		goto bad_area;
- #endif /* CONFIG_8xx */
-@@ -265,7 +297,7 @@ good_area:
- 		 * processors use the same I/D cache coherency mechanism
- 		 * as embedded.
- 		 */
--		if (error_code & DSISR_PROTFAULT)
-+		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
- 			goto bad_area;
- #endif /* CONFIG_PPC_STD_MMU */
- 
-@@ -335,6 +367,23 @@ bad_area:
- bad_area_nosemaphore:
- 	/* User mode accesses cause a SIGSEGV */
- 	if (user_mode(regs)) {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
-+#ifdef CONFIG_PPC_STD_MMU
-+			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
-+#else
-+			if (is_exec && regs->nip == address) {
-+#endif
-+				switch (pax_handle_fetch_fault(regs)) {
-+				}
-+
-+				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
-+				do_group_exit(SIGKILL);
-+			}
-+		}
-+#endif
-+
- 		_exception(SIGSEGV, regs, code, address);
- 		return 0;
- 	}
-diff -urNp linux-2.6.32.13/arch/powerpc/mm/mmap_64.c linux-2.6.32.13/arch/powerpc/mm/mmap_64.c
---- linux-2.6.32.13/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/mm/mmap_64.c	2010-05-15 13:21:13.694737832 -0400
-@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.13/arch/powerpc/mm/slice.c linux-2.6.32.13/arch/powerpc/mm/slice.c
---- linux-2.6.32.13/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/mm/slice.c	2010-05-15 13:21:13.702894969 -0400
-@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
- 	if (fixed && addr > (mm->task_size - len))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
-+		addr = 0;
-+#endif
-+
- 	/* If hint, make sure it matches our alignment restrictions */
- 	if (!fixed && addr) {
- 		addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c
---- linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-05-15 13:21:13.702894969 -0400
-@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
- 	lite5200_pm_target_state = PM_SUSPEND_ON;
- }
- 
--static struct platform_suspend_ops lite5200_pm_ops = {
-+static const struct platform_suspend_ops lite5200_pm_ops = {
- 	.valid		= lite5200_pm_valid,
- 	.begin		= lite5200_pm_begin,
- 	.prepare	= lite5200_pm_prepare,
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c
---- linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-05-15 13:21:13.706882202 -0400
-@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
- 	iounmap(mbar);
- }
- 
--static struct platform_suspend_ops mpc52xx_pm_ops = {
-+static const struct platform_suspend_ops mpc52xx_pm_ops = {
- 	.valid		= mpc52xx_pm_valid,
- 	.prepare	= mpc52xx_pm_prepare,
- 	.enter		= mpc52xx_pm_enter,
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c
---- linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/83xx/suspend.c	2010-05-15 13:21:13.714896740 -0400
-@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
- 	return ret;
- }
- 
--static struct platform_suspend_ops mpc83xx_suspend_ops = {
-+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
- 	.valid = mpc83xx_suspend_valid,
- 	.begin = mpc83xx_suspend_begin,
- 	.enter = mpc83xx_suspend_enter,
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/cell/iommu.c	2010-05-15 13:21:13.726905139 -0400
-@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
- 
- static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
- 
--struct dma_map_ops dma_iommu_fixed_ops = {
-+const struct dma_map_ops dma_iommu_fixed_ops = {
- 	.alloc_coherent = dma_fixed_alloc_coherent,
- 	.free_coherent  = dma_fixed_free_coherent,
- 	.map_sg         = dma_fixed_map_sg,
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/ps3/system-bus.c	2010-05-15 13:21:13.726905139 -0400
-@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
- 	return mask >= DMA_BIT_MASK(32);
- }
- 
--static struct dma_map_ops ps3_sb_dma_ops = {
-+static const struct dma_map_ops ps3_sb_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_sb_map_sg,
-@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
- 	.unmap_page = ps3_unmap_page,
- };
- 
--static struct dma_map_ops ps3_ioc0_dma_ops = {
-+static const struct dma_map_ops ps3_ioc0_dma_ops = {
- 	.alloc_coherent = ps3_alloc_coherent,
- 	.free_coherent = ps3_free_coherent,
- 	.map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig
---- linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/powerpc/platforms/pseries/Kconfig	2010-05-15 13:21:13.726905139 -0400
-@@ -2,6 +2,8 @@ config PPC_PSERIES
- 	depends on PPC64 && PPC_BOOK3S
- 	bool "IBM pSeries & new (POWER5-based) iSeries"
- 	select MPIC
-+	select PCI_MSI
-+	select XICS
- 	select PPC_I8259
- 	select PPC_RTAS
- 	select RTAS_ERROR_LOGGING
-diff -urNp linux-2.6.32.13/arch/s390/include/asm/elf.h linux-2.6.32.13/arch/s390/include/asm/elf.h
---- linux-2.6.32.13/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/include/asm/elf.h	2010-05-15 13:21:13.745465180 -0400
-@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
-    that it will "exec", and that there is sufficient room for the brk.  */
- #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports. */
- 
-diff -urNp linux-2.6.32.13/arch/s390/include/asm/setup.h linux-2.6.32.13/arch/s390/include/asm/setup.h
---- linux-2.6.32.13/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/include/asm/setup.h	2010-05-15 13:21:13.746887701 -0400
-@@ -50,13 +50,13 @@ extern unsigned long memory_end;
- void detect_memory_layout(struct mem_chunk chunk[]);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--extern unsigned int switch_amode;
-+#define switch_amode	(1)
- #else
- #define switch_amode	(0)
- #endif
- 
- #ifdef CONFIG_S390_EXEC_PROTECT
--extern unsigned int s390_noexec;
-+#define s390_noexec	(1)
- #else
- #define s390_noexec	(0)
- #endif
-diff -urNp linux-2.6.32.13/arch/s390/include/asm/uaccess.h linux-2.6.32.13/arch/s390/include/asm/uaccess.h
---- linux-2.6.32.13/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/include/asm/uaccess.h	2010-05-15 13:21:13.746887701 -0400
-@@ -232,6 +232,10 @@ static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_WRITE, to, n))
- 		n = __copy_to_user(to, from, n);
- 	return n;
-@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
- static inline unsigned long __must_check
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n) && (n <= 256))
- 		return uaccess.copy_from_user_small(n, from, to);
- 	else
-@@ -283,6 +290,10 @@ static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (access_ok(VERIFY_READ, from, n))
- 		n = __copy_from_user(to, from, n);
- 	else
-diff -urNp linux-2.6.32.13/arch/s390/Kconfig linux-2.6.32.13/arch/s390/Kconfig
---- linux-2.6.32.13/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/Kconfig	2010-05-15 13:21:13.754899687 -0400
-@@ -194,28 +194,26 @@ config AUDIT_ARCH
- 
- config S390_SWITCH_AMODE
- 	bool "Switch kernel/user addressing modes"
-+	default y
- 	help
- 	  This option allows to switch the addressing modes of kernel and user
--	  space. The kernel parameter switch_amode=on will enable this feature,
--	  default is disabled. Enabling this (via kernel parameter) on machines
--	  earlier than IBM System z9-109 EC/BC will reduce system performance.
-+	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
-+	  will reduce system performance.
- 
- 	  Note that this option will also be selected by selecting the execute
--	  protection option below. Enabling the execute protection via the
--	  noexec kernel parameter will also switch the addressing modes,
--	  independent of the switch_amode kernel parameter.
-+	  protection option below. Enabling the execute protection will also
-+	  switch the addressing modes, independent of this option.
- 
- 
- config S390_EXEC_PROTECT
- 	bool "Data execute protection"
-+	default y
- 	select S390_SWITCH_AMODE
- 	help
- 	  This option allows to enable a buffer overflow protection for user
- 	  space programs and it also selects the addressing mode option above.
--	  The kernel parameter noexec=on will enable this feature and also
--	  switch the addressing modes, default is disabled. Enabling this (via
--	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
--	  will reduce system performance.
-+	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
-+	  reduce system performance.
- 
- comment "Code generation options"
- 
-diff -urNp linux-2.6.32.13/arch/s390/kernel/module.c linux-2.6.32.13/arch/s390/kernel/module.c
---- linux-2.6.32.13/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/kernel/module.c	2010-05-15 13:21:13.754899687 -0400
-@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
- 
- 	/* Increase core size by size of got & plt and set start
- 	   offsets for got and plt. */
--	me->core_size = ALIGN(me->core_size, 4);
--	me->arch.got_offset = me->core_size;
--	me->core_size += me->arch.got_size;
--	me->arch.plt_offset = me->core_size;
--	me->core_size += me->arch.plt_size;
-+	me->core_size_rw = ALIGN(me->core_size_rw, 4);
-+	me->arch.got_offset = me->core_size_rw;
-+	me->core_size_rw += me->arch.got_size;
-+	me->arch.plt_offset = me->core_size_rx;
-+	me->core_size_rx += me->arch.plt_size;
- 	return 0;
- }
- 
-@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		if (info->got_initialized == 0) {
- 			Elf_Addr *gotent;
- 
--			gotent = me->module_core + me->arch.got_offset +
-+			gotent = me->module_core_rw + me->arch.got_offset +
- 				info->got_offset;
- 			*gotent = val;
- 			info->got_initialized = 1;
-@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		else if (r_type == R_390_GOTENT ||
- 			 r_type == R_390_GOTPLTENT)
- 			*(unsigned int *) loc =
--				(val + (Elf_Addr) me->module_core - loc) >> 1;
-+				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
- 		else if (r_type == R_390_GOT64 ||
- 			 r_type == R_390_GOTPLT64)
- 			*(unsigned long *) loc = val;
-@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
- 		if (info->plt_initialized == 0) {
- 			unsigned int *ip;
--			ip = me->module_core + me->arch.plt_offset +
-+			ip = me->module_core_rx + me->arch.plt_offset +
- 				info->plt_offset;
- #ifndef CONFIG_64BIT
- 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
-@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
- 			      (r_type == R_390_PLT32DBL &&
- 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
--				val = (Elf_Addr) me->module_core +
-+				val = (Elf_Addr) me->module_core_rx +
- 					me->arch.plt_offset +
- 					info->plt_offset;
- 			val += rela->r_addend - loc;
-@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
- 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
- 		val = val + rela->r_addend -
--			((Elf_Addr) me->module_core + me->arch.got_offset);
-+			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
- 		if (r_type == R_390_GOTOFF16)
- 			*(unsigned short *) loc = val;
- 		else if (r_type == R_390_GOTOFF32)
-@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
- 		break;
- 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
- 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
--		val = (Elf_Addr) me->module_core + me->arch.got_offset +
-+		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
- 			rela->r_addend - loc;
- 		if (r_type == R_390_GOTPC)
- 			*(unsigned int *) loc = val;
-diff -urNp linux-2.6.32.13/arch/s390/kernel/setup.c linux-2.6.32.13/arch/s390/kernel/setup.c
---- linux-2.6.32.13/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/kernel/setup.c	2010-05-15 13:21:13.754899687 -0400
-@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
- early_param("mem", early_parse_mem);
- 
- #ifdef CONFIG_S390_SWITCH_AMODE
--unsigned int switch_amode = 0;
--EXPORT_SYMBOL_GPL(switch_amode);
--
- static int set_amode_and_uaccess(unsigned long user_amode,
- 				 unsigned long user32_amode)
- {
-@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
- 		return 0;
- 	}
- }
--
--/*
-- * Switch kernel/user addressing modes?
-- */
--static int __init early_parse_switch_amode(char *p)
--{
--	switch_amode = 1;
--	return 0;
--}
--early_param("switch_amode", early_parse_switch_amode);
--
- #else /* CONFIG_S390_SWITCH_AMODE */
- static inline int set_amode_and_uaccess(unsigned long user_amode,
- 					unsigned long user32_amode)
-@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
- }
- #endif /* CONFIG_S390_SWITCH_AMODE */
- 
--#ifdef CONFIG_S390_EXEC_PROTECT
--unsigned int s390_noexec = 0;
--EXPORT_SYMBOL_GPL(s390_noexec);
--
--/*
-- * Enable execute protection?
-- */
--static int __init early_parse_noexec(char *p)
--{
--	if (!strncmp(p, "off", 3))
--		return 0;
--	switch_amode = 1;
--	s390_noexec = 1;
--	return 0;
--}
--early_param("noexec", early_parse_noexec);
--#endif /* CONFIG_S390_EXEC_PROTECT */
--
- static void setup_addressing_mode(void)
- {
- 	if (s390_noexec) {
-diff -urNp linux-2.6.32.13/arch/s390/mm/mmap.c linux-2.6.32.13/arch/s390/mm/mmap.c
---- linux-2.6.32.13/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/s390/mm/mmap.c	2010-05-15 13:21:13.770895237 -0400
-@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
- 	 */
- 	if (mmap_is_legacy()) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
- 		mm->mmap_base = mmap_base();
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c
---- linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sh/boards/mach-hp6xx/pm.c	2010-05-15 13:21:13.770895237 -0400
-@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
- 	return 0;
- }
- 
--static struct platform_suspend_ops hp6x0_pm_ops = {
-+static const struct platform_suspend_ops hp6x0_pm_ops = {
- 	.enter		= hp6x0_pm_enter,
- 	.valid		= suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c
---- linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sh/kernel/cpu/sh4/sq.c	2010-05-15 13:21:13.782909212 -0400
-@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
- 	NULL,
- };
- 
--static struct sysfs_ops sq_sysfs_ops = {
-+static const struct sysfs_ops sq_sysfs_ops = {
- 	.show	= sq_sysfs_show,
- 	.store	= sq_sysfs_store,
- };
-diff -urNp linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c
---- linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sh/kernel/cpu/shmobile/pm.c	2010-05-15 13:21:13.782909212 -0400
-@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
- 	return 0;
- }
- 
--static struct platform_suspend_ops sh_pm_ops = {
-+static const struct platform_suspend_ops sh_pm_ops = {
- 	.enter          = sh_pm_enter,
- 	.valid          = suspend_valid_only_mem,
- };
-diff -urNp linux-2.6.32.13/arch/sh/kernel/kgdb.c linux-2.6.32.13/arch/sh/kernel/kgdb.c
---- linux-2.6.32.13/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sh/kernel/kgdb.c	2010-05-15 13:21:13.782909212 -0400
-@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: trapa #0x3c */
- #ifdef CONFIG_CPU_LITTLE_ENDIAN
- 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/atomic_64.h	2010-05-15 13:21:13.782909212 -0400
-@@ -14,18 +14,38 @@
- #define ATOMIC64_INIT(i)	{ (i) }
- 
- #define atomic_read(v)		((v)->counter)
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- #define atomic64_read(v)	((v)->counter)
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
- 
- #define atomic_set(v, i)	(((v)->counter) = i)
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
- #define atomic64_set(v, i)	(((v)->counter) = i)
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
- 
- extern void atomic_add(int, atomic_t *);
-+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_add(int, atomic64_t *);
-+extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
- extern void atomic_sub(int, atomic_t *);
-+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
- extern void atomic64_sub(int, atomic64_t *);
- 
- extern int atomic_add_ret(int, atomic_t *);
- extern int atomic64_add_ret(int, atomic64_t *);
-+extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
- extern int atomic_sub_ret(int, atomic_t *);
- extern int atomic64_sub_ret(int, atomic64_t *);
- 
-@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
- 
- #define atomic_inc_return(v) atomic_add_ret(1, v)
- #define atomic64_inc_return(v) atomic64_add_ret(1, v)
-+#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
- 
- #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
- #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
-@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
- #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
- 
- #define atomic_inc(v) atomic_add(1, v)
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	atomic_add_unchecked(1, v);
-+}
- #define atomic64_inc(v) atomic64_add(1, v)
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
-+	atomic64_add_unchecked(1, v);
-+}
- 
- #define atomic_dec(v) atomic_sub(1, v)
- #define atomic64_dec(v) atomic64_sub(1, v)
-@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
- 
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%icc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
- 
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addcc %2, %0, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "tvs %%xcc, 6\n"
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a)
-+			     : "cc");
-+
-+		old = atomic64_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/dma-mapping.h	2010-05-15 13:21:13.782909212 -0400
-@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
- #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
- #define dma_is_consistent(d, h)	(1)
- 
--extern struct dma_map_ops *dma_ops, pci32_dma_ops;
-+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
- extern struct bus_type pci_bus_type;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
- 	if (dev->bus == &pci_bus_type)
-@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
- static inline void *dma_alloc_coherent(struct device *dev, size_t size,
- 				       dma_addr_t *dma_handle, gfp_t flag)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *cpu_addr;
- 
- 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
-@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *cpu_addr, dma_addr_t dma_handle)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
- 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/elf_32.h linux-2.6.32.13/arch/sparc/include/asm/elf_32.h
---- linux-2.6.32.13/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/elf_32.h	2010-05-15 13:21:13.782909212 -0400
-@@ -116,6 +116,13 @@ typedef struct {
- 
- #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	0x10000UL
-+
-+#define PAX_DELTA_MMAP_LEN	16
-+#define PAX_DELTA_STACK_LEN	16
-+#endif
-+
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  This can NOT be done in userspace
-    on Sparc.  */
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/elf_64.h linux-2.6.32.13/arch/sparc/include/asm/elf_64.h
---- linux-2.6.32.13/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/elf_64.h	2010-05-15 13:21:13.788083684 -0400
-@@ -163,6 +163,12 @@ typedef struct {
- #define ELF_ET_DYN_BASE		0x0000010000000000UL
- #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
- 
-+#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
-+
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this cpu supports.  */
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/pgtable_32.h	2010-05-15 13:21:13.788083684 -0400
-@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
- BTFIXUPDEF_INT(page_none)
- BTFIXUPDEF_INT(page_copy)
- BTFIXUPDEF_INT(page_readonly)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+BTFIXUPDEF_INT(page_shared_noexec)
-+BTFIXUPDEF_INT(page_copy_noexec)
-+BTFIXUPDEF_INT(page_readonly_noexec)
-+#endif
-+
- BTFIXUPDEF_INT(page_kernel)
- 
- #define PMD_SHIFT		SUN4C_PMD_SHIFT
-@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
- #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
- #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+extern pgprot_t PAGE_SHARED_NOEXEC;
-+# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
-+# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
-+#else
-+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
-+# define PAGE_COPY_NOEXEC	PAGE_COPY
-+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
-+#endif
-+
- extern unsigned long page_kernel;
- 
- #ifdef MODULE
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/pgtsrmmu.h	2010-05-15 13:21:13.788083684 -0400
-@@ -115,6 +115,13 @@
- 				    SRMMU_EXEC | SRMMU_REF)
- #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
- 				    SRMMU_EXEC | SRMMU_REF)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
-+#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
-+#endif
-+
- #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
- 				    SRMMU_DIRTY | SRMMU_REF)
- 
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/spinlock_64.h	2010-05-15 13:21:13.798894063 -0400
-@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
- 	__asm__ __volatile__ (
- "1:	ldsw		[%2], %0\n"
- "	brlz,pn		%0, 2f\n"
--"4:	 add		%0, 1, %1\n"
-+"4:	 addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
- "	.previous"
- 	: "=&r" (tmp1), "=&r" (tmp2)
- 	: "r" (lock)
--	: "memory");
-+	: "memory", "cc");
- }
- 
- static int inline arch_read_trylock(raw_rwlock_t *lock)
-@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
- "1:	ldsw		[%2], %0\n"
- "	brlz,a,pn	%0, 2f\n"
- "	 mov		0, %0\n"
--"	add		%0, 1, %1\n"
-+"	addcc		%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs		%%icc, 6\n"
-+#endif
-+
- "	cas		[%2], %0, %1\n"
- "	cmp		%0, %1\n"
- "	bne,pn		%%icc, 1b\n"
-@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
- 
- 	__asm__ __volatile__(
- "1:	lduw	[%2], %0\n"
--"	sub	%0, 1, %1\n"
-+"	subcc	%0, 1, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+"	tvs	%%icc, 6\n"
-+#endif
-+
- "	cas	[%2], %0, %1\n"
- "	cmp	%0, %1\n"
- "	bne,pn	%%xcc, 1b\n"
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/uaccess_32.h	2010-05-15 13:21:13.798894063 -0400
-@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
- 
- static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) to, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
- 		return __copy_user(to, (__force void __user *) from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
-+
- 	return __copy_user(to, (__force void __user *) from, n);
- }
- 
- static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
- {
--	if (n && __access_ok((unsigned long) from, n))
-+	if ((long)n < 0)
-+		return n;
-+
-+	if (n && __access_ok((unsigned long) from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
- 		return __copy_user((__force void __user *) to, from, n);
--	else
-+	} else
- 		return n;
- }
- 
- static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	return __copy_user((__force void __user *) to, from, n);
- }
- 
-diff -urNp linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/include/asm/uaccess_64.h	2010-05-15 13:21:13.798894063 -0400
-@@ -9,6 +9,7 @@
- #include <linux/compiler.h>
- #include <linux/string.h>
- #include <linux/thread_info.h>
-+#include <linux/kernel.h>
- #include <asm/asi.h>
- #include <asm/system.h>
- #include <asm/spitfire.h>
-@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
-        : "=r" (x) : "r" (__m(addr)), "i" (retval))
- 
- extern int __get_user_bad(void);
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- extern unsigned long __must_check ___copy_from_user(void *to,
- 						    const void __user *from,
-@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
- static inline unsigned long __must_check
- copy_from_user(void *to, const void __user *from, unsigned long size)
- {
--	unsigned long ret = ___copy_from_user(to, from, size);
-+	unsigned long ret;
- 
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(to, size, false);
-+
-+	ret = ___copy_from_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_from_user_fixup(to, from, size);
- 	return ret;
-@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
- static inline unsigned long __must_check
- copy_to_user(void __user *to, const void *from, unsigned long size)
- {
--	unsigned long ret = ___copy_to_user(to, from, size);
-+	unsigned long ret;
-+
-+	if ((long)size < 0 || size > INT_MAX)
-+		return size;
-+
-+	if (!__builtin_constant_p(size))
-+		check_object_size(from, size, true);
- 
-+	ret = ___copy_to_user(to, from, size);
- 	if (unlikely(ret))
- 		ret = copy_to_user_fixup(to, from, size);
- 	return ret;
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/iommu.c linux-2.6.32.13/arch/sparc/kernel/iommu.c
---- linux-2.6.32.13/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/iommu.c	2010-05-15 13:21:13.798894063 -0400
-@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4u_dma_ops = {
-+static const struct dma_map_ops sun4u_dma_ops = {
- 	.alloc_coherent		= dma_4u_alloc_coherent,
- 	.free_coherent		= dma_4u_free_coherent,
- 	.map_page		= dma_4u_map_page,
-@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
- 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
- };
- 
--struct dma_map_ops *dma_ops = &sun4u_dma_ops;
-+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/ioport.c linux-2.6.32.13/arch/sparc/kernel/ioport.c
---- linux-2.6.32.13/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/ioport.c	2010-05-15 13:21:13.798894063 -0400
-@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
- 	BUG();
- }
- 
--struct dma_map_ops sbus_dma_ops = {
-+const struct dma_map_ops sbus_dma_ops = {
- 	.alloc_coherent		= sbus_alloc_coherent,
- 	.free_coherent		= sbus_free_coherent,
- 	.map_page		= sbus_map_page,
-@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
- 	.sync_sg_for_device	= sbus_sync_sg_for_device,
- };
- 
--struct dma_map_ops *dma_ops = &sbus_dma_ops;
-+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int __init sparc_register_ioport(void)
-@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
- 	}
- }
- 
--struct dma_map_ops pci32_dma_ops = {
-+const struct dma_map_ops pci32_dma_ops = {
- 	.alloc_coherent		= pci32_alloc_coherent,
- 	.free_coherent		= pci32_free_coherent,
- 	.map_page		= pci32_map_page,
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/kgdb_32.c	2010-05-15 13:21:13.810880669 -0400
-@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x7d */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
- };
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/kgdb_64.c	2010-05-15 13:21:13.810880669 -0400
-@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
- {
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: ta 0x72 */
- 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
- };
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/Makefile linux-2.6.32.13/arch/sparc/kernel/Makefile
---- linux-2.6.32.13/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/Makefile	2010-05-15 13:21:13.810880669 -0400
-@@ -3,7 +3,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- extra-y     := head_$(BITS).o
- extra-y     += init_task.o
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/pci_sun4v.c	2010-05-15 13:21:13.810880669 -0400
-@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
- 	spin_unlock_irqrestore(&iommu->lock, flags);
- }
- 
--static struct dma_map_ops sun4v_dma_ops = {
-+static const struct dma_map_ops sun4v_dma_ops = {
- 	.alloc_coherent			= dma_4v_alloc_coherent,
- 	.free_coherent			= dma_4v_free_coherent,
- 	.map_page			= dma_4v_map_page,
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/sys_sparc_32.c	2010-05-15 13:21:13.810880669 -0400
-@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
- 	if (ARCH_SUN4C && len > 0x20000000)
- 		return -ENOMEM;
- 	if (!addr)
--		addr = TASK_UNMAPPED_BASE;
-+		addr = current->mm->mmap_base;
- 
- 	if (flags & MAP_SHARED)
- 		addr = COLOUR_ALIGN(addr);
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/sys_sparc_64.c	2010-05-15 13:21:13.810880669 -0400
-@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
- 	if (filp || (flags & MAP_SHARED))
- 		do_color_align = 1;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		if (do_color_align)
- 			addr = COLOUR_ALIGN(addr, pgoff);
-@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
- 	}
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
-+		start_addr = addr = mm->mmap_base;
- 	        mm->cached_hole_size = 0;
- 	}
- 
-@@ -175,8 +179,8 @@ full_search:
- 			vma = find_vma(mm, VA_EXCLUDE_END);
- 		}
- 		if (unlikely(task_size < addr)) {
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
- 		/* We do not accept a shared mapping if it would violate
- 		 * cache aliasing constraints.
- 		 */
--		if ((flags & MAP_SHARED) &&
-+		if ((filp || (flags & MAP_SHARED)) &&
- 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
- 			return -EINVAL;
- 		return addr;
-@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
- 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
- 	    sysctl_legacy_va_layout) {
- 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
-@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
- 			gap = (task_size / 6 * 5);
- 
- 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.13/arch/sparc/kernel/traps_64.c linux-2.6.32.13/arch/sparc/kernel/traps_64.c
---- linux-2.6.32.13/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/kernel/traps_64.c	2010-05-15 13:21:13.836227385 -0400
-@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
- 
- 	lvl -= 0x100;
- 	if (regs->tstate & TSTATE_PRIV) {
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		if (lvl == 6)
-+			pax_report_refcount_overflow(regs);
-+#endif
-+
- 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
- 		die_if_kernel(buffer, regs);
- 	}
-@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
- void bad_trap_tl1(struct pt_regs *regs, long lvl)
- {
- 	char buffer[32];
--	
-+
- 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
- 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
- 		return;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (lvl == 6)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
- 
- 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
-diff -urNp linux-2.6.32.13/arch/sparc/lib/atomic_64.S linux-2.6.32.13/arch/sparc/lib/atomic_64.S
---- linux-2.6.32.13/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/lib/atomic_64.S	2010-05-15 13:21:13.836227385 -0400
-@@ -18,7 +18,12 @@
- atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_add, .-atomic_add
- 
-+	.globl	atomic_add_unchecked
-+	.type	atomic_add_unchecked,#function
-+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	add	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_add_unchecked, .-atomic_add_unchecked
-+
- 	.globl	atomic_sub
- 	.type	atomic_sub,#function
- atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic_sub, .-atomic_sub
- 
-+	.globl	atomic_sub_unchecked
-+	.type	atomic_sub_unchecked,#function
-+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	lduw	[%o1], %g1
-+	sub	%g1, %o0, %g7
-+	cas	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%icc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
-+
- 	.globl	atomic_add_ret
- 	.type	atomic_add_ret,#function
- atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
- atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	lduw	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%icc, 2f
-@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
- atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add, .-atomic64_add
- 
-+	.globl	atomic64_add_unchecked
-+	.type	atomic64_add_unchecked,#function
-+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 nop
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
-+
- 	.globl	atomic64_sub
- 	.type	atomic64_sub,#function
- atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
- atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	add	%g1, %o0, %g7
-+	addcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
- 2:	BACKOFF_SPIN(%o2, %o3, 1b)
- 	.size	atomic64_add_ret, .-atomic64_add_ret
- 
-+	.globl	atomic64_add_ret_unchecked
-+	.type	atomic64_add_ret_unchecked,#function
-+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
-+	BACKOFF_SETUP(%o2)
-+1:	ldx	[%o1], %g1
-+	addcc	%g1, %o0, %g7
-+	casx	[%o1], %g1, %g7
-+	cmp	%g1, %g7
-+	bne,pn	%xcc, 2f
-+	 add	%g7, %o0, %g7
-+	mov	%g7, %o0
-+	retl
-+	 nop
-+2:	BACKOFF_SPIN(%o2, %o3, 1b)
-+	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
-+
- 	.globl	atomic64_sub_ret
- 	.type	atomic64_sub_ret,#function
- atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
- 	BACKOFF_SETUP(%o2)
- 1:	ldx	[%o1], %g1
--	sub	%g1, %o0, %g7
-+	subcc	%g1, %o0, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%xcc, 6
-+#endif
-+
- 	casx	[%o1], %g1, %g7
- 	cmp	%g1, %g7
- 	bne,pn	%xcc, 2f
-diff -urNp linux-2.6.32.13/arch/sparc/lib/ksyms.c linux-2.6.32.13/arch/sparc/lib/ksyms.c
---- linux-2.6.32.13/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/lib/ksyms.c	2010-05-15 13:21:13.836227385 -0400
-@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
- 
- /* Atomic counter implementation. */
- EXPORT_SYMBOL(atomic_add);
-+EXPORT_SYMBOL(atomic_add_unchecked);
- EXPORT_SYMBOL(atomic_add_ret);
- EXPORT_SYMBOL(atomic_sub);
-+EXPORT_SYMBOL(atomic_sub_unchecked);
- EXPORT_SYMBOL(atomic_sub_ret);
- EXPORT_SYMBOL(atomic64_add);
- EXPORT_SYMBOL(atomic64_add_ret);
-diff -urNp linux-2.6.32.13/arch/sparc/lib/rwsem_64.S linux-2.6.32.13/arch/sparc/lib/rwsem_64.S
---- linux-2.6.32.13/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/lib/rwsem_64.S	2010-05-15 13:21:13.836227385 -0400
-@@ -11,7 +11,12 @@
- 	.globl		__down_read
- __down_read:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -33,7 +38,12 @@ __down_read:
- 	.globl		__down_read_trylock
- __down_read_trylock:
- 1:	lduw		[%o0], %g1
--	add		%g1, 1, %g7
-+	addcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cmp		%g7, 0
- 	bl,pn		%icc, 2f
- 	 mov		0, %o1
-@@ -51,7 +61,12 @@ __down_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -77,7 +92,12 @@ __down_write_trylock:
- 	cmp		%g3, 0
- 	bne,pn		%icc, 2f
- 	 mov		0, %o1
--	add		%g3, %g1, %g7
-+	addcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -90,7 +110,12 @@ __down_write_trylock:
- __up_read:
- 1:
- 	lduw		[%o0], %g1
--	sub		%g1, 1, %g7
-+	subcc		%g1, 1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g1, %g7
- 	cmp		%g1, %g7
- 	bne,pn		%icc, 1b
-@@ -118,7 +143,12 @@ __up_write:
- 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-@@ -143,7 +173,12 @@ __downgrade_write:
- 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
- 1:
- 	lduw		[%o0], %g3
--	sub		%g3, %g1, %g7
-+	subcc		%g3, %g1, %g7
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	tvs	%icc, 6
-+#endif
-+
- 	cas		[%o0], %g3, %g7
- 	cmp		%g3, %g7
- 	bne,pn		%icc, 1b
-diff -urNp linux-2.6.32.13/arch/sparc/Makefile linux-2.6.32.13/arch/sparc/Makefile
---- linux-2.6.32.13/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/Makefile	2010-05-15 13:21:13.836227385 -0400
-@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
- # Export what is needed by arch/sparc/boot/Makefile
- export VMLINUX_INIT VMLINUX_MAIN
- VMLINUX_INIT := $(head-y) $(init-y)
--VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
- VMLINUX_MAIN += $(drivers-y) $(net-y)
- 
-diff -urNp linux-2.6.32.13/arch/sparc/mm/fault_32.c linux-2.6.32.13/arch/sparc/mm/fault_32.c
---- linux-2.6.32.13/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/mm/fault_32.c	2010-05-15 13:21:13.836227385 -0400
-@@ -21,6 +21,9 @@
- #include <linux/interrupt.h>
- #include <linux/module.h>
- #include <linux/kdebug.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/system.h>
- #include <asm/page.h>
-@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
- 	return safe_compute_effective_address(regs, insn);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->pc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->pc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned int addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->pc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned int addr;
-+
-+			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+			regs->pc = addr;
-+			regs->npc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->pc);
-+		err |= get_user(ba, (unsigned int *)(regs->pc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int addr, save, call;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
-+			else
-+				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->pc = call_dl_resolve;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
-+				regs->pc = addr;
-+				regs->npc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->pc-4));
-+		err |= get_user(call, (unsigned int *)regs->pc);
-+		err |= get_user(nop, (unsigned int *)(regs->pc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
-+
-+			regs->u_regs[UREG_RETPC] = regs->pc;
-+			regs->pc = dl_resolve;
-+			regs->npc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
- 			       unsigned long address)
- {
-@@ -231,6 +495,24 @@ good_area:
- 		if(!(vma->vm_flags & VM_WRITE))
- 			goto bad_area;
- 	} else {
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
-+			up_read(&mm->mmap_sem);
-+			switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+			case 2:
-+			case 3:
-+				return;
-+#endif
-+
-+			}
-+			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
- 		/* Allow reads even for write-only mappings */
- 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
- 			goto bad_area;
-diff -urNp linux-2.6.32.13/arch/sparc/mm/fault_64.c linux-2.6.32.13/arch/sparc/mm/fault_64.c
---- linux-2.6.32.13/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/mm/fault_64.c	2010-05-15 13:21:13.842890995 -0400
-@@ -20,6 +20,9 @@
- #include <linux/kprobes.h>
- #include <linux/kdebug.h>
- #include <linux/percpu.h>
-+#include <linux/slab.h>
-+#include <linux/pagemap.h>
-+#include <linux/compiler.h>
- 
- #include <asm/page.h>
- #include <asm/pgtable.h>
-@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
- 	show_regs(regs);
- }
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#ifdef CONFIG_PAX_DLRESOLVE
-+static void pax_emuplt_close(struct vm_area_struct *vma)
-+{
-+	vma->vm_mm->call_dl_resolve = 0UL;
-+}
-+
-+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+{
-+	unsigned int *kaddr;
-+
-+	vmf->page = alloc_page(GFP_HIGHUSER);
-+	if (!vmf->page)
-+		return VM_FAULT_OOM;
-+
-+	kaddr = kmap(vmf->page);
-+	memset(kaddr, 0, PAGE_SIZE);
-+	kaddr[0] = 0x9DE3BFA8U; /* save */
-+	flush_dcache_page(vmf->page);
-+	kunmap(vmf->page);
-+	return VM_FAULT_MAJOR;
-+}
-+
-+static const struct vm_operations_struct pax_vm_ops = {
-+	.close = pax_emuplt_close,
-+	.fault = pax_emuplt_fault
-+};
-+
-+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
-+{
-+	int ret;
-+
-+	vma->vm_mm = current->mm;
-+	vma->vm_start = addr;
-+	vma->vm_end = addr + PAGE_SIZE;
-+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
-+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+	vma->vm_ops = &pax_vm_ops;
-+
-+	ret = insert_vm_struct(current->mm, vma);
-+	if (ret)
-+		return ret;
-+
-+	++current->mm->total_vm;
-+	return 0;
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->tpc = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when patched PLT trampoline was detected
-+ *         3 when unpatched PLT trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+	int err;
-+
-+	do { /* PaX: patched PLT emulation #1 */
-+		unsigned int sethi1, sethi2, jmpl;
-+
-+		err = get_user(sethi1, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
-+			addr = regs->u_regs[UREG_G1];
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	{ /* PaX: patched PLT emulation #2 */
-+		unsigned int ba;
-+
-+		err = get_user(ba, (unsigned int *)regs->tpc);
-+
-+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
-+			unsigned long addr;
-+
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	}
-+
-+	do { /* PaX: patched PLT emulation #3 */
-+		unsigned int sethi, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #4 */
-+		unsigned int sethi, mov1, call, mov2;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(call, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    mov1 == 0x8210000FU &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    mov2 == 0x9E100001U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
-+			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #5 */
-+		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    (or1 & 0xFFFFE000U) == 0x82106000U &&
-+		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+		    sllx == 0x83287020U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: patched PLT emulation #6 */
-+		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
-+		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
-+		err |= get_user(or, (unsigned int *)(regs->tpc+16));
-+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
-+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+		    sllx == 0x83287020U &&
-+		    (or & 0xFFFFE000U) == 0x8A116000U &&
-+		    jmpl == 0x81C04005U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] <<= 32;
-+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
-+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: unpatched PLT emulation step 1 */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+			unsigned int save, call;
-+			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
-+
-+			if ((ba & 0xFFC00000U) == 0x30800000U)
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
-+			else
-+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			err = get_user(save, (unsigned int *)addr);
-+			err |= get_user(call, (unsigned int *)(addr+4));
-+			err |= get_user(nop, (unsigned int *)(addr+8));
-+			if (err)
-+				break;
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+			if (save == 0x9DE3BFA8U &&
-+			    (call & 0xC0000000U) == 0x40000000U &&
-+			    nop == 0x01000000U)
-+			{
-+				struct vm_area_struct *vma;
-+				unsigned long call_dl_resolve;
-+
-+				down_read(&current->mm->mmap_sem);
-+				call_dl_resolve = current->mm->call_dl_resolve;
-+				up_read(&current->mm->mmap_sem);
-+				if (likely(call_dl_resolve))
-+					goto emulate;
-+
-+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+
-+				down_write(&current->mm->mmap_sem);
-+				if (current->mm->call_dl_resolve) {
-+					call_dl_resolve = current->mm->call_dl_resolve;
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					goto emulate;
-+				}
-+
-+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
-+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
-+					up_write(&current->mm->mmap_sem);
-+					if (vma)
-+						kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				if (pax_insert_vma(vma, call_dl_resolve)) {
-+					up_write(&current->mm->mmap_sem);
-+					kmem_cache_free(vm_area_cachep, vma);
-+					return 1;
-+				}
-+
-+				current->mm->call_dl_resolve = call_dl_resolve;
-+				up_write(&current->mm->mmap_sem);
-+
-+emulate:
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->tpc = call_dl_resolve;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+#endif
-+
-+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
-+			if ((save & 0xFFC00000U) == 0x05000000U &&
-+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G2] = addr + 4;
-+				addr = (save & 0x003FFFFFU) << 10;
-+				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
-+
-+				if (test_thread_flag(TIF_32BIT))
-+					addr &= 0xFFFFFFFFUL;
-+
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+
-+			/* PaX: 64-bit PLT stub */
-+			err = get_user(sethi1, (unsigned int *)addr);
-+			err |= get_user(sethi2, (unsigned int *)(addr+4));
-+			err |= get_user(or1, (unsigned int *)(addr+8));
-+			err |= get_user(or2, (unsigned int *)(addr+12));
-+			err |= get_user(sllx, (unsigned int *)(addr+16));
-+			err |= get_user(add, (unsigned int *)(addr+20));
-+			err |= get_user(jmpl, (unsigned int *)(addr+24));
-+			err |= get_user(nop, (unsigned int *)(addr+28));
-+			if (err)
-+				break;
-+
-+			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
-+			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
-+			    (or1 & 0xFFFFE000U) == 0x88112000U &&
-+			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
-+			    sllx == 0x89293020U &&
-+			    add == 0x8A010005U &&
-+			    jmpl == 0x89C14000U &&
-+			    nop == 0x01000000U)
-+			{
-+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
-+				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
-+				regs->u_regs[UREG_G4] <<= 32;
-+				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
-+				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
-+				regs->u_regs[UREG_G4] = addr + 24;
-+				addr = regs->u_regs[UREG_G5];
-+				regs->tpc = addr;
-+				regs->tnpc = addr+4;
-+				return 3;
-+			}
-+		}
-+	} while (0);
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	do { /* PaX: unpatched PLT emulation step 2 */
-+		unsigned int save, call, nop;
-+
-+		err = get_user(save, (unsigned int *)(regs->tpc-4));
-+		err |= get_user(call, (unsigned int *)regs->tpc);
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
-+		if (err)
-+			break;
-+
-+		if (save == 0x9DE3BFA8U &&
-+		    (call & 0xC0000000U) == 0x40000000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				dl_resolve &= 0xFFFFFFFFUL;
-+
-+			regs->u_regs[UREG_RETPC] = regs->tpc;
-+			regs->tpc = dl_resolve;
-+			regs->tnpc = dl_resolve+4;
-+			return 3;
-+		}
-+	} while (0);
-+#endif
-+
-+	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
-+		unsigned int sethi, ba, nop;
-+
-+		err = get_user(sethi, (unsigned int *)regs->tpc);
-+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
-+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
-+
-+		if (err)
-+			break;
-+
-+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
-+		    (ba & 0xFFF00000U) == 0x30600000U &&
-+		    nop == 0x01000000U)
-+		{
-+			unsigned long addr;
-+
-+			addr = (sethi & 0x003FFFFFU) << 10;
-+			regs->u_regs[UREG_G1] = addr;
-+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
-+
-+			if (test_thread_flag(TIF_32BIT))
-+				addr &= 0xFFFFFFFFUL;
-+
-+			regs->tpc = addr;
-+			regs->tnpc = addr+4;
-+			return 2;
-+		}
-+	} while (0);
-+
-+#endif
-+
-+	return 1;
-+}
-+
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	unsigned long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 8; i++) {
-+		unsigned int c;
-+		if (get_user(c, (unsigned int *)pc+i))
-+			printk(KERN_CONT "???????? ");
-+		else
-+			printk(KERN_CONT "%08x ", c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
- asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
- {
- 	struct mm_struct *mm = current->mm;
-@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
- 	if (!vma)
- 		goto bad_area;
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	/* PaX: detect ITLB misses on non-exec pages */
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
-+	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
-+	{
-+		if (address != regs->tpc)
-+			goto good_area;
-+
-+		up_read(&mm->mmap_sem);
-+		switch (pax_handle_fetch_fault(regs)) {
-+
-+#ifdef CONFIG_PAX_EMUPLT
-+		case 2:
-+		case 3:
-+			return;
-+#endif
-+
-+		}
-+		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
-+		do_group_exit(SIGKILL);
-+	}
-+#endif
-+
- 	/* Pure DTLB misses do not tell us whether the fault causing
- 	 * load/store/atomic was a write or not, it only says that there
- 	 * was no match.  So in such a case we (carefully) read the
-diff -urNp linux-2.6.32.13/arch/sparc/mm/init_32.c linux-2.6.32.13/arch/sparc/mm/init_32.c
---- linux-2.6.32.13/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/mm/init_32.c	2010-05-15 13:21:13.842890995 -0400
-@@ -317,6 +317,9 @@ extern void device_scan(void);
- pgprot_t PAGE_SHARED __read_mostly;
- EXPORT_SYMBOL(PAGE_SHARED);
- 
-+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
-+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
-+
- void __init paging_init(void)
- {
- 	switch(sparc_cpu_model) {
-@@ -345,17 +348,17 @@ void __init paging_init(void)
- 
- 	/* Initialize the protection map with non-constant, MMU dependent values. */
- 	protection_map[0] = PAGE_NONE;
--	protection_map[1] = PAGE_READONLY;
--	protection_map[2] = PAGE_COPY;
--	protection_map[3] = PAGE_COPY;
-+	protection_map[1] = PAGE_READONLY_NOEXEC;
-+	protection_map[2] = PAGE_COPY_NOEXEC;
-+	protection_map[3] = PAGE_COPY_NOEXEC;
- 	protection_map[4] = PAGE_READONLY;
- 	protection_map[5] = PAGE_READONLY;
- 	protection_map[6] = PAGE_COPY;
- 	protection_map[7] = PAGE_COPY;
- 	protection_map[8] = PAGE_NONE;
--	protection_map[9] = PAGE_READONLY;
--	protection_map[10] = PAGE_SHARED;
--	protection_map[11] = PAGE_SHARED;
-+	protection_map[9] = PAGE_READONLY_NOEXEC;
-+	protection_map[10] = PAGE_SHARED_NOEXEC;
-+	protection_map[11] = PAGE_SHARED_NOEXEC;
- 	protection_map[12] = PAGE_READONLY;
- 	protection_map[13] = PAGE_READONLY;
- 	protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.32.13/arch/sparc/mm/Makefile linux-2.6.32.13/arch/sparc/mm/Makefile
---- linux-2.6.32.13/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/mm/Makefile	2010-05-15 13:21:13.842890995 -0400
-@@ -2,7 +2,7 @@
- #
- 
- asflags-y := -ansi
--ccflags-y := -Werror
-+#ccflags-y := -Werror
- 
- obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
- obj-y                   += fault_$(BITS).o
-diff -urNp linux-2.6.32.13/arch/sparc/mm/srmmu.c linux-2.6.32.13/arch/sparc/mm/srmmu.c
---- linux-2.6.32.13/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/sparc/mm/srmmu.c	2010-05-15 13:21:13.854885513 -0400
-@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
- 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
- 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
- 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
-+	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
-+	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
-+#endif
-+
- 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
- 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
- 
-diff -urNp linux-2.6.32.13/arch/um/include/asm/kmap_types.h linux-2.6.32.13/arch/um/include/asm/kmap_types.h
---- linux-2.6.32.13/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/um/include/asm/kmap_types.h	2010-05-15 13:21:13.854885513 -0400
-@@ -23,6 +23,7 @@ enum km_type {
- 	KM_IRQ1,
- 	KM_SOFTIRQ0,
- 	KM_SOFTIRQ1,
-+	KM_CLEARPAGE,
- 	KM_TYPE_NR
- };
- 
-diff -urNp linux-2.6.32.13/arch/um/include/asm/page.h linux-2.6.32.13/arch/um/include/asm/page.h
---- linux-2.6.32.13/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/um/include/asm/page.h	2010-05-15 13:21:13.854885513 -0400
-@@ -14,6 +14,9 @@
- #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
- #define PAGE_MASK	(~(PAGE_SIZE-1))
- 
-+#define ktla_ktva(addr)			(addr)
-+#define ktva_ktla(addr)			(addr)
-+
- #ifndef __ASSEMBLY__
- 
- struct page;
-diff -urNp linux-2.6.32.13/arch/um/sys-i386/syscalls.c linux-2.6.32.13/arch/um/sys-i386/syscalls.c
---- linux-2.6.32.13/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/um/sys-i386/syscalls.c	2010-05-15 13:21:13.862896966 -0400
-@@ -11,6 +11,21 @@
- #include "asm/uaccess.h"
- #include "asm/unistd.h"
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-diff -urNp linux-2.6.32.13/arch/x86/boot/bitops.h linux-2.6.32.13/arch/x86/boot/bitops.h
---- linux-2.6.32.13/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/bitops.h	2010-05-15 13:21:13.862896966 -0400
-@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
- 	u8 v;
- 	const u32 *p = (const u32 *)addr;
- 
--	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
-+	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
- 	return v;
- }
- 
-@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
- 
- static inline void set_bit(int nr, void *addr)
- {
--	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
-+	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
- }
- 
- #endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.32.13/arch/x86/boot/boot.h linux-2.6.32.13/arch/x86/boot/boot.h
---- linux-2.6.32.13/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/boot.h	2010-05-15 13:21:13.862896966 -0400
-@@ -82,7 +82,7 @@ static inline void io_delay(void)
- static inline u16 ds(void)
- {
- 	u16 seg;
--	asm("movw %%ds,%0" : "=rm" (seg));
-+	asm volatile("movw %%ds,%0" : "=rm" (seg));
- 	return seg;
- }
- 
-@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
- static inline int memcmp(const void *s1, const void *s2, size_t len)
- {
- 	u8 diff;
--	asm("repe; cmpsb; setnz %0"
-+	asm volatile("repe; cmpsb; setnz %0"
- 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
- 	return diff;
- }
-diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/head_32.S linux-2.6.32.13/arch/x86/boot/compressed/head_32.S
---- linux-2.6.32.13/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/compressed/head_32.S	2010-05-15 13:21:13.862896966 -0400
-@@ -76,7 +76,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl    %eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -149,7 +149,7 @@ relocated:
-  * and where it was actually loaded.
-  */
- 	movl	%ebp, %ebx
--	subl	$LOAD_PHYSICAL_ADDR, %ebx
-+	subl	$____LOAD_PHYSICAL_ADDR, %ebx
- 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
- /*
-  * Process relocations.
-@@ -157,8 +157,7 @@ relocated:
- 
- 1:	subl	$4, %edi
- 	movl	(%edi), %ecx
--	testl	%ecx, %ecx
--	jz	2f
-+	jecxz	2f
- 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
- 	jmp	1b
- 2:
-diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/head_64.S linux-2.6.32.13/arch/x86/boot/compressed/head_64.S
---- linux-2.6.32.13/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/compressed/head_64.S	2010-05-15 13:21:13.862896966 -0400
-@@ -91,7 +91,7 @@ ENTRY(startup_32)
- 	notl	%eax
- 	andl	%eax, %ebx
- #else
--	movl	$LOAD_PHYSICAL_ADDR, %ebx
-+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
- #endif
- 
- 	/* Target address to relocate to for decompression */
-@@ -234,7 +234,7 @@ ENTRY(startup_64)
- 	notq	%rax
- 	andq	%rax, %rbp
- #else
--	movq	$LOAD_PHYSICAL_ADDR, %rbp
-+	movq	$____LOAD_PHYSICAL_ADDR, %rbp
- #endif
- 
- 	/* Target address to relocate to for decompression */
-diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/misc.c linux-2.6.32.13/arch/x86/boot/compressed/misc.c
---- linux-2.6.32.13/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/compressed/misc.c	2010-05-15 13:21:13.866567010 -0400
-@@ -288,7 +288,7 @@ static void parse_elf(void *output)
- 		case PT_LOAD:
- #ifdef CONFIG_RELOCATABLE
- 			dest = output;
--			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
-+			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
- #else
- 			dest = (void *)(phdr->p_paddr);
- #endif
-@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
- 		error("Destination address too large");
- #endif
- #ifndef CONFIG_RELOCATABLE
--	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
-+	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
- 		error("Wrong destination address");
- #endif
- 
-diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c
---- linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/compressed/mkpiggy.c	2010-05-15 13:21:13.866567010 -0400
-@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
- 
- 	offs = (olen > ilen) ? olen - ilen : 0;
- 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
--	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
-+	offs += 64*1024;	/* Add 64K bytes slack */
- 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
- 
- 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
-diff -urNp linux-2.6.32.13/arch/x86/boot/compressed/relocs.c linux-2.6.32.13/arch/x86/boot/compressed/relocs.c
---- linux-2.6.32.13/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/compressed/relocs.c	2010-05-15 13:21:13.866567010 -0400
-@@ -10,8 +10,11 @@
- #define USE_BSD
- #include <endian.h>
- 
-+#include "../../../../include/linux/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
- 
- static int is_safe_abs_reloc(const char* sym_name)
- {
--	int i;
-+	unsigned int i;
- 
- 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
- 		if (!strcmp(sym_name, safe_abs_relocs[i]))
-@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
- 			if (sym->st_shndx == SHN_ABS) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
- 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
- 				/*
- 				 * NONE can be ignored and and PC relative
-@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -634,6 +693,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
-diff -urNp linux-2.6.32.13/arch/x86/boot/cpucheck.c linux-2.6.32.13/arch/x86/boot/cpucheck.c
---- linux-2.6.32.13/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/cpucheck.c	2010-05-15 13:21:13.878594921 -0400
-@@ -74,7 +74,7 @@ static int has_fpu(void)
- 	u16 fcw = -1, fsw = -1;
- 	u32 cr0;
- 
--	asm("movl %%cr0,%0" : "=r" (cr0));
-+	asm volatile("movl %%cr0,%0" : "=r" (cr0));
- 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
- 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
- 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
-@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
- {
- 	u32 f0, f1;
- 
--	asm("pushfl ; "
-+	asm volatile("pushfl ; "
- 	    "pushfl ; "
- 	    "popl %0 ; "
- 	    "movl %0,%1 ; "
-@@ -115,7 +115,7 @@ static void get_flags(void)
- 		set_bit(X86_FEATURE_FPU, cpu.flags);
- 
- 	if (has_eflag(X86_EFLAGS_ID)) {
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_intel_level),
- 		      "=b" (cpu_vendor[0]),
- 		      "=d" (cpu_vendor[1]),
-@@ -124,7 +124,7 @@ static void get_flags(void)
- 
- 		if (max_intel_level >= 0x00000001 &&
- 		    max_intel_level <= 0x0000ffff) {
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "=a" (tfms),
- 			      "=c" (cpu.flags[4]),
- 			      "=d" (cpu.flags[0])
-@@ -136,7 +136,7 @@ static void get_flags(void)
- 				cpu.model += ((tfms >> 16) & 0xf) << 4;
- 		}
- 
--		asm("cpuid"
-+		asm volatile("cpuid"
- 		    : "=a" (max_amd_level)
- 		    : "a" (0x80000000)
- 		    : "ebx", "ecx", "edx");
-@@ -144,7 +144,7 @@ static void get_flags(void)
- 		if (max_amd_level >= 0x80000001 &&
- 		    max_amd_level <= 0x8000ffff) {
- 			u32 eax = 0x80000001;
--			asm("cpuid"
-+			asm volatile("cpuid"
- 			    : "+a" (eax),
- 			      "=c" (cpu.flags[6]),
- 			      "=d" (cpu.flags[1])
-@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_K7_HWCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax &= ~(1 << 15);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		get_flags();	/* Make sure it really did something */
- 		err = check_flags();
-@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 ecx = MSR_VIA_FCR;
- 		u32 eax, edx;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
- 		eax |= (1<<1)|(1<<7);
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		set_bit(X86_FEATURE_CX8, cpu.flags);
- 		err = check_flags();
-@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
- 		u32 eax, edx;
- 		u32 level = 1;
- 
--		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
--		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
--		asm("cpuid"
-+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-+		asm volatile("cpuid"
- 		    : "+a" (level), "=d" (cpu.flags[0])
- 		    : : "ecx", "ebx");
--		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
- 
- 		err = check_flags();
- 	}
-diff -urNp linux-2.6.32.13/arch/x86/boot/header.S linux-2.6.32.13/arch/x86/boot/header.S
---- linux-2.6.32.13/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/header.S	2010-05-15 13:21:13.878594921 -0400
-@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
- 						# single linked list of
- 						# struct setup_data
- 
--pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
-+pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
- 
- #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
- #define VO_INIT_SIZE	(VO__end - VO__text)
-diff -urNp linux-2.6.32.13/arch/x86/boot/memory.c linux-2.6.32.13/arch/x86/boot/memory.c
---- linux-2.6.32.13/arch/x86/boot/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/memory.c	2010-05-15 13:21:13.878594921 -0400
-@@ -19,7 +19,7 @@
- 
- static int detect_memory_e820(void)
- {
--	int count = 0;
-+	unsigned int count = 0;
- 	struct biosregs ireg, oreg;
- 	struct e820entry *desc = boot_params.e820_map;
- 	static struct e820entry buf; /* static so it is zeroed */
-diff -urNp linux-2.6.32.13/arch/x86/boot/video.c linux-2.6.32.13/arch/x86/boot/video.c
---- linux-2.6.32.13/arch/x86/boot/video.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/video.c	2010-05-15 13:21:13.878594921 -0400
-@@ -90,7 +90,7 @@ static void store_mode_params(void)
- static unsigned int get_entry(void)
- {
- 	char entry_buf[4];
--	int i, len = 0;
-+	unsigned int i, len = 0;
- 	int key;
- 	unsigned int v;
- 
-diff -urNp linux-2.6.32.13/arch/x86/boot/video-vesa.c linux-2.6.32.13/arch/x86/boot/video-vesa.c
---- linux-2.6.32.13/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/boot/video-vesa.c	2010-05-15 13:21:13.878594921 -0400
-@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
- 
- 	boot_params.screen_info.vesapm_seg = oreg.es;
- 	boot_params.screen_info.vesapm_off = oreg.di;
-+	boot_params.screen_info.vesapm_size = oreg.cx;
- }
- 
- /*
-diff -urNp linux-2.6.32.13/arch/x86/ia32/ia32entry.S linux-2.6.32.13/arch/x86/ia32/ia32entry.S
---- linux-2.6.32.13/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/ia32/ia32entry.S	2010-05-15 13:21:13.878594921 -0400
-@@ -13,6 +13,7 @@
- #include <asm/thread_info.h>	
- #include <asm/segment.h>
- #include <asm/irqflags.h>
-+#include <asm/pgtable.h>
- #include <linux/linkage.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
-@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
- 	SWAPGS_UNSAFE_STACK
- 	movq	PER_CPU_VAR(kernel_stack), %rsp
- 	addq	$(KERNEL_STACK_OFFSET),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs, here we enable it straight after entry:
-@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
- 	SAVE_ARGS 0,0,1
-  	/* no need to do an access_ok check here because rbp has been
-  	   32bit zero extended */ 
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%rbp
-+#endif
-+
- 1:	movl	(%rbp),%ebp
-  	.section __ex_table,"a"
-  	.quad 1b,ia32_badarg
-@@ -166,6 +178,11 @@ sysenter_dispatch:
- 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz	sysexit_audit
- sysexit_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl    $~TS_COMPAT,TI_status(%r10)
- 	/* clear IF, that popfq doesn't enable interrupts early */
- 	andl  $~0x200,EFLAGS-R11(%rsp) 
-@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
- 	movl	%esp,%r8d
- 	CFI_REGISTER	rsp,r8
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
- 	/* no need to do an access_ok check here because r8 has been
- 	   32bit zero extended */ 
- 	/* hardware stack frame is complete now */	
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%r10
-+	add %r10,%r8
-+#endif
-+
- 1:	movl	(%r8),%r9d
- 	.section __ex_table,"a"
- 	.quad 1b,ia32_badarg
-@@ -327,6 +355,11 @@ cstar_dispatch:
- 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
- 	jnz sysretl_audit
- sysretl_from_sys_call:
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	andl $~TS_COMPAT,TI_status(%r10)
- 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
- 	movl RIP-ARGOFFSET(%rsp),%ecx
-@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
- 	CFI_REL_OFFSET	rip,RIP-RIP
- 	PARAVIRT_ADJUST_EXCEPTION_FRAME
- 	SWAPGS
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs on/off section: the syscall
- 	 * disabled irqs and here we enable it straight after entry:
-diff -urNp linux-2.6.32.13/arch/x86/ia32/ia32_signal.c linux-2.6.32.13/arch/x86/ia32/ia32_signal.c
---- linux-2.6.32.13/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/ia32/ia32_signal.c	2010-05-15 13:21:13.878594921 -0400
-@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
- 	sp -= frame_size;
- 	/* Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- 	return (void __user *) sp;
- }
- 
-@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
- 		0xb8,
- 		__NR_ia32_rt_sigreturn,
- 		0x80cd,
--		0,
-+		0
- 	};
- 
- 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/alternative.h linux-2.6.32.13/arch/x86/include/asm/alternative.h
---- linux-2.6.32.13/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/alternative.h	2010-05-15 13:21:13.878594921 -0400
-@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
-       "	 .byte 662b-661b\n"			/* sourcelen       */	\
-       "	 .byte 664f-663f\n"			/* replacementlen  */	\
-       ".previous\n"							\
--      ".section .altinstr_replacement, \"ax\"\n"			\
-+      ".section .altinstr_replacement, \"a\"\n"			\
-       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
-       ".previous"
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/apm.h linux-2.6.32.13/arch/x86/include/asm/apm.h
---- linux-2.6.32.13/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/apm.h	2010-05-15 13:21:13.878594921 -0400
-@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%al\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
- 	__asm__ __volatile__(APM_DO_ZERO_SEGS
- 		"pushl %%edi\n\t"
- 		"pushl %%ebp\n\t"
--		"lcall *%%cs:apm_bios_entry\n\t"
-+		"lcall *%%ss:apm_bios_entry\n\t"
- 		"setc %%bl\n\t"
- 		"popl %%ebp\n\t"
- 		"popl %%edi\n\t"
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/atomic_32.h linux-2.6.32.13/arch/x86/include/asm/atomic_32.h
---- linux-2.6.32.13/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/atomic_32.h	2010-05-15 13:21:13.878594921 -0400
-@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+m" (v->counter)
-+		     : "ir" (i));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract integer from atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "+m" (v->counter)
- 		     : "ir" (i));
- }
-@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "+m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "+m" (v->counter));
- }
- 
-@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (v->counter));
- }
- 
-@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "into\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (v->counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "into\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+
-+#ifdef CONFIG_M386
-+no_xadd: /* Legacy 386 processor */
-+	local_irq_save(flags);
-+	__i = atomic_read(v);
-+	atomic_set(v, i + __i);
-+	local_irq_restore(flags);
-+	return i + __i;
-+#endif
-+}
-+
-+/**
-+ * atomic_add_return_unchecked - add integer and return
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: integer value to add
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	int __i;
-+#ifdef CONFIG_M386
-+	unsigned long flags;
-+	if (unlikely(boot_cpu_data.x86 <= 3))
-+		goto no_xadd;
-+#endif
-+	/* Modern 486+ processor */
-+	__i = i;
- 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
-@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "into\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
- 
- #define atomic_inc_return(v)  (atomic_add_return(1, v))
-+#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
- #define atomic_dec_return(v)  (atomic_sub_return(1, v))
- 
- /* These are x86-specific, used by some header files */
-@@ -266,6 +461,14 @@ typedef struct {
- 	u64 __aligned(8) counter;
- } atomic64_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	u64 __aligned(8) counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
-+
- #define ATOMIC64_INIT(val)	{ (val) }
- 
- extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/atomic_64.h linux-2.6.32.13/arch/x86/include/asm/atomic_64.h
---- linux-2.6.32.13/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/atomic_64.h	2010-05-15 13:21:13.878594921 -0400
-@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
- }
- 
- /**
-+ * atomic_read_unchecked - read atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ */
-+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic_set - set atomic variable
-  * @v: pointer of type atomic_t
-  * @i: required value
-@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
- }
- 
- /**
-+ * atomic_set_unchecked - set atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic_add - add integer to atomic variable
-  * @i: integer value to add
-  * @v: pointer of type atomic_t
-@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
-  */
- static inline void atomic_add(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "addl %1,%0"
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_add_unchecked - add integer to atomic variable
-+ * @i: integer value to add
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
-  */
- static inline void atomic_sub(int i, atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "subl %1,%0"
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "ir" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_sub_unchecked - subtract the atomic variable
-+ * @i: integer value to subtract
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically subtracts @i from @v.
-+ */
-+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
- 		     : "=m" (v->counter)
- 		     : "ir" (i), "m" (v->counter));
- }
-@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
-  */
- static inline void atomic_inc(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "incl %0"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic_inc_unchecked - increment atomic variable
-+ * @v: pointer of type atomic_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
-+{
-+	asm volatile(LOCK_PREFIX "incl %0\n"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
-  */
- static inline void atomic_dec(atomic_t *v)
- {
--	asm volatile(LOCK_PREFIX "decl %0"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incl %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subl %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "ir" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
- static inline int atomic_add_return(int i, atomic_t *v)
- {
- 	int __i = i;
--	asm volatile(LOCK_PREFIX "xaddl %0, %1"
-+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movl %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
- }
- 
- /**
-+ * atomic64_read_unchecked - read atomic64 variable
-+ * @v: pointer of type atomic64_unchecked_t
-+ *
-+ * Atomically reads the value of @v.
-+ * Doesn't imply a read memory barrier.
-+ */
-+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
-+{
-+	return v->counter;
-+}
-+
-+/**
-  * atomic64_set - set atomic64 variable
-  * @v: pointer to type atomic64_t
-  * @i: required value
-@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
- }
- 
- /**
-+ * atomic64_set_unchecked - set atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ * @i: required value
-+ *
-+ * Atomically sets the value of @v to @i.
-+ */
-+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
-+{
-+	v->counter = i;
-+}
-+
-+/**
-  * atomic64_add - add integer to atomic64 variable
-  * @i: integer value to add
-  * @v: pointer to type atomic64_t
-@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
-  */
- static inline void atomic64_add(long i, atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "addq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "er" (i), "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_add_unchecked - add integer to atomic64 variable
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v.
-+ */
-+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "addq %1,%0"
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
-@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
-  */
- static inline void atomic64_sub(long i, atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "subq %1,%0"
-+	asm volatile(LOCK_PREFIX "subq %1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %1,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "er" (i), "m" (v->counter));
- }
-@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
-+	asm volatile(LOCK_PREFIX "subq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "addq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
-  */
- static inline void atomic64_inc(atomic64_t *v)
- {
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     : "=m" (v->counter)
-+		     : "m" (v->counter));
-+}
-+
-+/**
-+ * atomic64_inc_unchecked - increment atomic64 variable
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically increments @v by 1.
-+ */
-+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
-+{
- 	asm volatile(LOCK_PREFIX "incq %0"
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
-@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
-  */
- static inline void atomic64_dec(atomic64_t *v)
- {
--	asm volatile(LOCK_PREFIX "decq %0"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "=m" (v->counter)
- 		     : "m" (v->counter));
- }
-@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "decq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "decq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "incq %0; sete %1"
-+	asm volatile(LOCK_PREFIX "incq %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
-+		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "m" (v->counter) : "memory");
- 	return c != 0;
-@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
- {
- 	unsigned char c;
- 
--	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
-+	asm volatile(LOCK_PREFIX "addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     LOCK_PREFIX "subq %2,%0\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "=m" (v->counter), "=qm" (c)
- 		     : "er" (i), "m" (v->counter) : "memory");
- 	return c;
-@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
- static inline long atomic64_add_return(long i, atomic64_t *v)
- {
- 	long __i = i;
--	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+		     "jno 0f\n"
-+		     "movq %0, %1\n"
-+		     "int $4\n0:\n"
-+		     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+		     : "+r" (i), "+m" (v->counter)
-+		     : : "memory");
-+	return i + __i;
-+}
-+
-+/**
-+ * atomic64_add_return_unchecked - add and return
-+ * @i: integer value to add
-+ * @v: pointer to type atomic64_unchecked_t
-+ *
-+ * Atomically adds @i to @v and returns @i + @v
-+ */
-+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
-+{
-+	long __i = i;
-+	asm volatile(LOCK_PREFIX "xaddq %0, %1"
- 		     : "+r" (i), "+m" (v->counter)
- 		     : : "memory");
- 	return i + __i;
-@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
- }
- 
- #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
-+#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
- #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
- 
- static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
-  */
- static inline int atomic_add_unless(atomic_t *v, int a, int u)
- {
--	int c, old;
-+	int c, old, new;
- 	c = atomic_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addl %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "ir" (a));
-+
-+		old = atomic_cmpxchg(v, c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
-  */
- static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
- {
--	long c, old;
-+	long c, old, new;
- 	c = atomic64_read(v);
- 	for (;;) {
--		if (unlikely(c == (u)))
-+		if (unlikely(c == u))
- 			break;
--		old = atomic64_cmpxchg((v), c, c + (a));
-+
-+		asm volatile("addq %2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+			     "jno 0f\n"
-+			     "int $4\n0:\n"
-+			     _ASM_EXTABLE(0b, 0b)
-+#endif
-+
-+			     : "=r" (new)
-+			     : "0" (c), "er" (a));
-+
-+		old = atomic64_cmpxchg((v), c, new);
- 		if (likely(old == c))
- 			break;
- 		c = old;
- 	}
--	return c != (u);
-+	return c != u;
- }
- 
- /**
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/boot.h linux-2.6.32.13/arch/x86/include/asm/boot.h
---- linux-2.6.32.13/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/boot.h	2010-05-15 13:21:13.878594921 -0400
-@@ -11,10 +11,15 @@
- #include <asm/pgtable_types.h>
- 
- /* Physical address where kernel should be loaded. */
--#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
-+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
- 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
- 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
- 
-+#ifndef __ASSEMBLY__
-+extern unsigned char __LOAD_PHYSICAL_ADDR[];
-+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
-+#endif
-+
- /* Minimum kernel alignment, as a power of two */
- #ifdef CONFIG_X86_64
- #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/cacheflush.h linux-2.6.32.13/arch/x86/include/asm/cacheflush.h
---- linux-2.6.32.13/arch/x86/include/asm/cacheflush.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/cacheflush.h	2010-05-15 13:21:13.878594921 -0400
-@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
- static inline unsigned long get_page_memtype(struct page *pg)
- {
- 	if (!PageUncached(pg) && !PageWC(pg))
--		return -1;
-+		return ~0UL;
- 	else if (!PageUncached(pg) && PageWC(pg))
- 		return _PAGE_CACHE_WC;
- 	else if (PageUncached(pg) && !PageWC(pg))
-@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
- 		SetPageWC(pg);
- 		break;
- 	default:
--	case -1:
-+	case ~0UL:
- 		ClearPageUncached(pg);
- 		ClearPageWC(pg);
- 		break;
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/cache.h linux-2.6.32.13/arch/x86/include/asm/cache.h
---- linux-2.6.32.13/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/cache.h	2010-05-15 13:21:13.878594921 -0400
-@@ -8,6 +8,7 @@
- #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
- 
- #define __read_mostly __attribute__((__section__(".data.read_mostly")))
-+#define __read_only __attribute__((__section__(".data.read_only")))
- 
- #ifdef CONFIG_X86_VSMP
- /* vSMP Internode cacheline shift */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/checksum_32.h linux-2.6.32.13/arch/x86/include/asm/checksum_32.h
---- linux-2.6.32.13/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/checksum_32.h	2010-05-15 13:21:13.878594921 -0400
-@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
- 					    int len, __wsum sum,
- 					    int *src_err_ptr, int *dst_err_ptr);
- 
-+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
-+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
-+						  int len, __wsum sum,
-+						  int *src_err_ptr, int *dst_err_ptr);
-+
- /*
-  *	Note: when you get a NULL pointer exception here this means someone
-  *	passed in an incorrect kernel address to one of these functions.
-@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
- 						 int *err_ptr)
- {
- 	might_sleep();
--	return csum_partial_copy_generic((__force void *)src, dst,
-+	return csum_partial_copy_generic_from_user((__force void *)src, dst,
- 					 len, sum, err_ptr, NULL);
- }
- 
-@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
- {
- 	might_sleep();
- 	if (access_ok(VERIFY_WRITE, dst, len))
--		return csum_partial_copy_generic(src, (__force void *)dst,
-+		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
- 						 len, sum, NULL, err_ptr);
- 
- 	if (len)
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/desc.h linux-2.6.32.13/arch/x86/include/asm/desc.h
---- linux-2.6.32.13/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/desc.h	2010-05-15 13:21:13.882891085 -0400
-@@ -4,6 +4,7 @@
- #include <asm/desc_defs.h>
- #include <asm/ldt.h>
- #include <asm/mmu.h>
-+#include <asm/pgtable.h>
- #include <linux/smp.h>
- 
- static inline void fill_ldt(struct desc_struct *desc,
-@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
- 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
- 	desc->type = (info->read_exec_only ^ 1) << 1;
- 	desc->type |= info->contents << 2;
-+	desc->type |= info->seg_not_present ^ 1;
- 	desc->s = 1;
- 	desc->dpl = 0x3;
- 	desc->p = info->seg_not_present ^ 1;
-@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
- }
- 
- extern struct desc_ptr idt_descr;
--extern gate_desc idt_table[];
--
--struct gdt_page {
--	struct desc_struct gdt[GDT_ENTRIES];
--} __attribute__((aligned(PAGE_SIZE)));
--DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
-+extern gate_desc idt_table[256];
- 
-+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
- static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
- {
--	return per_cpu(gdt_page, cpu).gdt;
-+	return cpu_gdt_table[cpu];
- }
- 
- #ifdef CONFIG_X86_64
-@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
- static inline void native_write_idt_entry(gate_desc *idt, int entry,
- 					  const gate_desc *gate)
- {
-+	pax_open_kernel();
- 	memcpy(&idt[entry], gate, sizeof(*gate));
-+	pax_close_kernel();
- }
- 
- static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
- 					  const void *desc)
- {
-+	pax_open_kernel();
- 	memcpy(&ldt[entry], desc, 8);
-+	pax_close_kernel();
- }
- 
- static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- 					  const void *desc, int type)
- {
- 	unsigned int size;
-+
- 	switch (type) {
- 	case DESC_TSS:
- 		size = sizeof(tss_desc);
-@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
- 		size = sizeof(struct desc_struct);
- 		break;
- 	}
-+
-+	pax_open_kernel();
- 	memcpy(&gdt[entry], desc, size);
-+	pax_close_kernel();
- }
- 
- static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
- 
- static inline void native_load_tr_desc(void)
- {
-+	pax_open_kernel();
- 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
-+	pax_close_kernel();
- }
- 
- static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
- 	unsigned int i;
- 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
- 
-+	pax_open_kernel();
- 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
- 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
-+	pax_close_kernel();
- }
- 
- #define _LDT_empty(info)				\
-@@ -309,7 +319,7 @@ static inline void set_desc_limit(struct
- 	desc->limit = (limit >> 16) & 0xf;
- }
- 
--static inline void _set_gate(int gate, unsigned type, void *addr,
-+static inline void _set_gate(int gate, unsigned type, const void *addr,
- 			     unsigned dpl, unsigned ist, unsigned seg)
- {
- 	gate_desc s;
-@@ -327,7 +337,7 @@ static inline void _set_gate(int gate, u
-  * Pentium F0 0F bugfix can have resulted in the mapped
-  * IDT being write-protected.
-  */
--static inline void set_intr_gate(unsigned int n, void *addr)
-+static inline void set_intr_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +366,19 @@ static inline void alloc_intr_gate(unsig
- /*
-  * This routine sets up an interrupt gate at directory privilege level 3.
-  */
--static inline void set_system_intr_gate(unsigned int n, void *addr)
-+static inline void set_system_intr_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
- }
- 
--static inline void set_system_trap_gate(unsigned int n, void *addr)
-+static inline void set_system_trap_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
- }
- 
--static inline void set_trap_gate(unsigned int n, void *addr)
-+static inline void set_trap_gate(unsigned int n, const void *addr)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +387,31 @@ static inline void set_trap_gate(unsigne
- static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
- {
- 	BUG_ON((unsigned)n > 0xFF);
--	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
-+	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
- }
- 
--static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
- }
- 
--static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
-+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
- {
- 	BUG_ON((unsigned)n > 0xFF);
- 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
- }
- 
-+#ifdef CONFIG_X86_32
-+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
-+{
-+	struct desc_struct d;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, base, limit, 0xFB, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
-+}
-+#endif
-+
- #endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/device.h linux-2.6.32.13/arch/x86/include/asm/device.h
---- linux-2.6.32.13/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/device.h	2010-05-15 13:21:13.882891085 -0400
-@@ -6,7 +6,7 @@ struct dev_archdata {
- 	void	*acpi_handle;
- #endif
- #ifdef CONFIG_X86_64
--struct dma_map_ops *dma_ops;
-+	const struct dma_map_ops *dma_ops;
- #endif
- #ifdef CONFIG_DMAR
- 	void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/dma-mapping.h	2010-05-15 13:21:13.882891085 -0400
-@@ -25,9 +25,9 @@ extern int iommu_merge;
- extern struct device x86_dma_fallback_dev;
- extern int panic_on_overflow;
- 
--extern struct dma_map_ops *dma_ops;
-+extern const struct dma_map_ops *dma_ops;
- 
--static inline struct dma_map_ops *get_dma_ops(struct device *dev)
-+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
- {
- #ifdef CONFIG_X86_32
- 	return dma_ops;
-@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
- /* Make sure we keep the same behaviour */
- static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	if (ops->mapping_error)
- 		return ops->mapping_error(dev, dma_addr);
- 
-@@ -122,7 +122,7 @@ static inline void *
- dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
- 		gfp_t gfp)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	void *memory;
- 
- 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
- static inline void dma_free_coherent(struct device *dev, size_t size,
- 				     void *vaddr, dma_addr_t bus)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	WARN_ON(irqs_disabled());       /* for portability */
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/e820.h linux-2.6.32.13/arch/x86/include/asm/e820.h
---- linux-2.6.32.13/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/e820.h	2010-05-15 13:21:13.882891085 -0400
-@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
- #define ISA_END_ADDRESS		0x100000
- #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
- 
--#define BIOS_BEGIN		0x000a0000
-+#define BIOS_BEGIN		0x000c0000
- #define BIOS_END		0x00100000
- 
- #ifdef __KERNEL__
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/elf.h linux-2.6.32.13/arch/x86/include/asm/elf.h
---- linux-2.6.32.13/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/elf.h	2010-05-15 13:21:13.882891085 -0400
-@@ -257,7 +257,25 @@ extern int force_personality32;
-    the loader.  We need to make sure that it is out of the way of the program
-    that it will "exec", and that there is sufficient room for the brk.  */
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
-+#else
- #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+#ifdef CONFIG_X86_32
-+#define PAX_ELF_ET_DYN_BASE	0x10000000UL
-+
-+#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
-+#else
-+#define PAX_ELF_ET_DYN_BASE	0x400000UL
-+
-+#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
-+#endif
-+#endif
- 
- /* This yields a mask that user programs can use to figure out what
-    instruction set this CPU supports.  This could be done in user space,
-@@ -311,8 +329,7 @@ do {									\
- #define ARCH_DLINFO							\
- do {									\
- 	if (vdso_enabled)						\
--		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
--			    (unsigned long)current->mm->context.vdso);	\
-+		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
- } while (0)
- 
- #define AT_SYSINFO		32
-@@ -323,7 +340,7 @@ do {									\
- 
- #endif /* !CONFIG_X86_32 */
- 
--#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
-+#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
- 
- #define VDSO_ENTRY							\
- 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
-@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
- extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
- #define compat_arch_setup_additional_pages	syscall32_setup_pages
- 
--extern unsigned long arch_randomize_brk(struct mm_struct *mm);
--#define arch_randomize_brk arch_randomize_brk
--
- #endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/futex.h linux-2.6.32.13/arch/x86/include/asm/futex.h
---- linux-2.6.32.13/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/futex.h	2010-05-15 13:21:13.882891085 -0400
-@@ -11,17 +11,54 @@
- #include <asm/processor.h>
- #include <asm/system.h>
- 
-+#ifdef CONFIG_X86_32
- #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile(						\
-+		     "movw\t%w6, %%ds\n"			\
-+		     "1:\t" insn "\n"				\
-+		     "2:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%ds\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "3:\tmov\t%3, %1\n"			\
-+		     "\tjmp\t2b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 3b)			\
-+		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
-+
-+#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	asm volatile("movw\t%w7, %%es\n"			\
-+		     "1:\tmovl\t%%es:%2, %0\n"			\
-+		     "\tmovl\t%0, %3\n"				\
-+		     "\t" insn "\n"				\
-+		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
-+		     "\tjnz\t1b\n"				\
-+		     "3:\tpushl\t%%ss\n"			\
-+		     "\tpopl\t%%es\n"				\
-+		     "\t.section .fixup,\"ax\"\n"		\
-+		     "4:\tmov\t%5, %1\n"			\
-+		     "\tjmp\t3b\n"				\
-+		     "\t.previous\n"				\
-+		     _ASM_EXTABLE(1b, 4b)			\
-+		     _ASM_EXTABLE(2b, 4b)			\
-+		     : "=&a" (oldval), "=&r" (ret),		\
-+		       "+m" (*uaddr), "=&r" (tem)		\
-+		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
-+#else
-+#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\t" insn "\n"				\
- 		     "2:\t.section .fixup,\"ax\"\n"		\
- 		     "3:\tmov\t%3, %1\n"			\
- 		     "\tjmp\t2b\n"				\
- 		     "\t.previous\n"				\
- 		     _ASM_EXTABLE(1b, 3b)			\
--		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "=r" (oldval), "=r" (ret),		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
- 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
- 
- #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
-+	typecheck(u32 *, uaddr);				\
- 	asm volatile("1:\tmovl	%2, %0\n"			\
- 		     "\tmovl\t%0, %3\n"				\
- 		     "\t" insn "\n"				\
-@@ -34,10 +71,12 @@
- 		     _ASM_EXTABLE(1b, 4b)			\
- 		     _ASM_EXTABLE(2b, 4b)			\
- 		     : "=&a" (oldval), "=&r" (ret),		\
--		       "+m" (*uaddr), "=&r" (tem)		\
-+		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
-+		       "=&r" (tem)				\
- 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
-+#endif
- 
--static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
-+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
- 
- 	switch (op) {
- 	case FUTEX_OP_SET:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
-+#else
- 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_ADD:
-+#ifdef CONFIG_X86_32
-+		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
-+				   uaddr, oparg);
-+#else
- 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
- 				   uaddr, oparg);
-+#endif
- 		break;
- 	case FUTEX_OP_OR:
- 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
-@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
- 	return ret;
- }
- 
--static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
-+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
- 						int newval)
- {
- 
-@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
- 		return -ENOSYS;
- #endif
- 
--	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
-+	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
- 		return -EFAULT;
- 
--	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
--		     "2:\t.section .fixup, \"ax\"\n"
-+	asm volatile(
-+#ifdef CONFIG_X86_32
-+		     "\tmovw %w5, %%ds\n"
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
-+		     "2:\tpushl   %%ss\n"
-+		     "\tpopl    %%ds\n"
-+#else
-+		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
-+		     "2:\n"
-+#endif
-+		     "\t.section .fixup, \"ax\"\n"
- 		     "3:\tmov     %2, %0\n"
- 		     "\tjmp     2b\n"
- 		     "\t.previous\n"
- 		     _ASM_EXTABLE(1b, 3b)
-+#ifdef CONFIG_X86_32
- 		     : "=a" (oldval), "+m" (*uaddr)
-+		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
-+#else
-+		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
- 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
-+#endif
- 		     : "memory"
- 	);
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/i387.h linux-2.6.32.13/arch/x86/include/asm/i387.h
---- linux-2.6.32.13/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/i387.h	2010-05-15 13:21:13.886644440 -0400
-@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
- {
- 	int err;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
-+		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
- 		     "2:\n"
- 		     ".section .fixup,\"ax\"\n"
-@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
- }
- 
- /* We need a safe address that is cheap to find and that is already
--   in L1 during context switch. The best choices are unfortunately
--   different for UP and SMP */
--#ifdef CONFIG_SMP
--#define safe_address (__per_cpu_offset[0])
--#else
--#define safe_address (kstat_cpu(0).cpustat.user)
--#endif
-+   in L1 during context switch. */
-+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
- 
- /*
-  * These must be called with preempt disabled
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/io_64.h linux-2.6.32.13/arch/x86/include/asm/io_64.h
---- linux-2.6.32.13/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/io_64.h	2010-05-15 13:21:13.886644440 -0400
-@@ -140,6 +140,17 @@ __OUTS(l)
- 
- #include <linux/vmalloc.h>
- 
-+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
-+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
-+{
-+	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
-+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
-+{
-+	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
-+}
-+
- #include <asm-generic/iomap.h>
- 
- void __memcpy_fromio(void *, unsigned long, unsigned);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/iommu.h linux-2.6.32.13/arch/x86/include/asm/iommu.h
---- linux-2.6.32.13/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/iommu.h	2010-05-15 13:21:13.886644440 -0400
-@@ -3,7 +3,7 @@
- 
- extern void pci_iommu_shutdown(void);
- extern void no_iommu_init(void);
--extern struct dma_map_ops nommu_dma_ops;
-+extern const struct dma_map_ops nommu_dma_ops;
- extern int force_iommu, no_iommu;
- extern int iommu_detected;
- extern int iommu_pass_through;
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/irqflags.h linux-2.6.32.13/arch/x86/include/asm/irqflags.h
---- linux-2.6.32.13/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/irqflags.h	2010-05-15 13:21:13.886644440 -0400
-@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
- 	sti;					\
- 	sysexit
- 
-+#define GET_CR0_INTO_RDI		mov %cr0, %rdi
-+#define SET_RDI_INTO_CR0		mov %rdi, %cr0
-+#define GET_CR3_INTO_RDI		mov %cr3, %rdi
-+#define SET_RDI_INTO_CR3		mov %rdi, %cr3
-+
- #else
- #define INTERRUPT_RETURN		iret
- #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/kvm_host.h linux-2.6.32.13/arch/x86/include/asm/kvm_host.h
---- linux-2.6.32.13/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:37.497949072 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/kvm_host.h	2010-05-15 13:21:13.886644440 -0400
-@@ -532,7 +532,7 @@ struct kvm_x86_ops {
- 	const struct trace_print_flags *exit_reasons_str;
- };
- 
--extern struct kvm_x86_ops *kvm_x86_ops;
-+extern const struct kvm_x86_ops *kvm_x86_ops;
- 
- int kvm_mmu_module_init(void);
- void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/local.h linux-2.6.32.13/arch/x86/include/asm/local.h
---- linux-2.6.32.13/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/local.h	2010-05-15 13:21:13.886644440 -0400
-@@ -18,26 +18,90 @@ typedef struct {
- 
- static inline void local_inc(local_t *l)
- {
--	asm volatile(_ASM_INC "%0"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_dec(local_t *l)
- {
--	asm volatile(_ASM_DEC "%0"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter));
- }
- 
- static inline void local_add(long i, local_t *l)
- {
--	asm volatile(_ASM_ADD "%1,%0"
-+	asm volatile(_ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
- 
- static inline void local_sub(long i, local_t *l)
- {
--	asm volatile(_ASM_SUB "%1,%0"
-+	asm volatile(_ASM_SUB "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (l->a.counter)
- 		     : "ir" (i));
- }
-@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_SUB "%2,%0; sete %1"
-+	asm volatile(_ASM_SUB "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_ADD "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_DEC "%0; sete %1"
-+	asm volatile(_ASM_DEC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_INC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_INC "%0; sete %1"
-+	asm volatile(_ASM_INC "%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_DEC "%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sete %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : : "memory");
- 	return c != 0;
-@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
- {
- 	unsigned char c;
- 
--	asm volatile(_ASM_ADD "%2,%0; sets %1"
-+	asm volatile(_ASM_ADD "%2,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_SUB "%2,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "sets %1\n"
- 		     : "+m" (l->a.counter), "=qm" (c)
- 		     : "ir" (i) : "memory");
- 	return c;
-@@ -133,7 +265,23 @@ static inline long local_add_return(long
- #endif
- 	/* Modern 486+ processor */
- 	__i = i;
--	asm volatile(_ASM_XADD "%0, %1;"
-+	asm volatile(_ASM_XADD "%0, %1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     _ASM_MOV "%0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (i), "+m" (l->a.counter)
- 		     : : "memory");
- 	return i + __i;
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h
---- linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/mc146818rtc.h	2010-05-15 13:21:13.886644440 -0400
-@@ -81,8 +81,8 @@ static inline unsigned char current_lock
- #else
- #define lock_cmos_prefix(reg) do {} while (0)
- #define lock_cmos_suffix(reg) do {} while (0)
--#define lock_cmos(reg)
--#define unlock_cmos()
-+#define lock_cmos(reg) do {} while (0)
-+#define unlock_cmos() do {} while (0)
- #define do_i_have_lock_cmos() 0
- #define current_lock_cmos_reg() 0
- #endif
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/microcode.h linux-2.6.32.13/arch/x86/include/asm/microcode.h
---- linux-2.6.32.13/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/microcode.h	2010-05-15 13:21:13.886644440 -0400
-@@ -12,13 +12,13 @@ struct device;
- enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
- 
- struct microcode_ops {
--	enum ucode_state (*request_microcode_user) (int cpu,
-+	enum ucode_state (* const request_microcode_user) (int cpu,
- 				const void __user *buf, size_t size);
- 
--	enum ucode_state (*request_microcode_fw) (int cpu,
-+	enum ucode_state (* const request_microcode_fw) (int cpu,
- 				struct device *device);
- 
--	void (*microcode_fini_cpu) (int cpu);
-+	void (* const microcode_fini_cpu) (int cpu);
- 
- 	/*
- 	 * The generic 'microcode_core' part guarantees that
-@@ -38,18 +38,18 @@ struct ucode_cpu_info {
- extern struct ucode_cpu_info ucode_cpu_info[];
- 
- #ifdef CONFIG_MICROCODE_INTEL
--extern struct microcode_ops * __init init_intel_microcode(void);
-+extern const struct microcode_ops * __init init_intel_microcode(void);
- #else
--static inline struct microcode_ops * __init init_intel_microcode(void)
-+static inline const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return NULL;
- }
- #endif /* CONFIG_MICROCODE_INTEL */
- 
- #ifdef CONFIG_MICROCODE_AMD
--extern struct microcode_ops * __init init_amd_microcode(void);
-+extern const struct microcode_ops * __init init_amd_microcode(void);
- #else
--static inline struct microcode_ops * __init init_amd_microcode(void)
-+static inline const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return NULL;
- }
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/mman.h linux-2.6.32.13/arch/x86/include/asm/mman.h
---- linux-2.6.32.13/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/mman.h	2010-05-15 13:21:13.886644440 -0400
-@@ -5,4 +5,14 @@
- 
- #include <asm-generic/mman.h>
- 
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#ifdef CONFIG_X86_32
-+#define arch_mmap_check	i386_mmap_check
-+int i386_mmap_check(unsigned long addr, unsigned long len,
-+		unsigned long flags);
-+#endif
-+#endif
-+#endif
-+
- #endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/mmu_context.h linux-2.6.32.13/arch/x86/include/asm/mmu_context.h
---- linux-2.6.32.13/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/mmu_context.h	2010-05-15 13:21:13.886644440 -0400
-@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
- 
- static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
- {
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	unsigned int i;
-+	pgd_t *pgd;
-+
-+	pax_open_kernel();
-+	pgd = get_cpu_pgd(smp_processor_id());
-+	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
-+		if (paravirt_enabled())
-+			set_pgd(pgd+i, native_make_pgd(0));
-+		else
-+			pgd[i] = native_make_pgd(0);
-+	pax_close_kernel();
-+#endif
-+
- #ifdef CONFIG_SMP
- 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
-@@ -34,27 +49,70 @@ static inline void switch_mm(struct mm_s
- 			     struct task_struct *tsk)
- {
- 	unsigned cpu = smp_processor_id();
-+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
-+	int tlbstate = TLBSTATE_OK;
-+#endif
- 
- 	if (likely(prev != next)) {
- 		/* stop flush ipis for the previous mm */
- 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
- #ifdef CONFIG_SMP
-+#ifdef CONFIG_X86_32
-+		tlbstate = percpu_read(cpu_tlbstate.state);
-+#endif
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		percpu_write(cpu_tlbstate.active_mm, next);
- #endif
- 		cpumask_set_cpu(cpu, mm_cpumask(next));
- 
- 		/* Re-load page tables */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#else
- 		load_cr3(next->pgd);
-+#endif
- 
- 		/*
- 		 * load the LDT, if the LDT is different:
- 		 */
- 		if (unlikely(prev->context.ldt != next->context.ldt))
- 			load_LDT_nolock(&next->context);
--	}
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		if (!nx_enabled) {
-+			smp_mb__before_clear_bit();
-+			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
-+			smp_mb__after_clear_bit();
-+			cpu_set(cpu, next->context.cpu_user_cs_mask);
-+		}
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
-+			     prev->context.user_cs_limit != next->context.user_cs_limit))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
- #ifdef CONFIG_SMP
-+		else if (unlikely(tlbstate != TLBSTATE_OK))
-+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+#endif
-+
-+	}
- 	else {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		pax_open_kernel();
-+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
-+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
-+		pax_close_kernel();
-+		load_cr3(get_cpu_pgd(cpu));
-+#endif
-+
-+#ifdef CONFIG_SMP
- 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
- 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
- 
-@@ -63,11 +121,28 @@ static inline void switch_mm(struct mm_s
- 			 * tlb flush IPI delivery. We must reload CR3
- 			 * to make sure to use no freed page tables.
- 			 */
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 			load_cr3(next->pgd);
-+#endif
-+
- 			load_LDT_nolock(&next->context);
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+			if (!nx_enabled)
-+				cpu_set(cpu, next->context.cpu_user_cs_mask);
-+#endif
-+
-+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
-+#ifdef CONFIG_PAX_PAGEEXEC
-+			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
-+#endif
-+				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
-+#endif
-+
- 		}
--	}
- #endif
-+	}
- }
- 
- #define activate_mm(prev, next)			\
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/mmu.h linux-2.6.32.13/arch/x86/include/asm/mmu.h
---- linux-2.6.32.13/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/mmu.h	2010-05-15 13:21:13.886644440 -0400
-@@ -9,10 +9,23 @@
-  * we put the segment information here.
-  */
- typedef struct {
--	void *ldt;
-+	struct desc_struct *ldt;
- 	int size;
- 	struct mutex lock;
--	void *vdso;
-+	unsigned long vdso;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	unsigned long user_cs_base;
-+	unsigned long user_cs_limit;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+	cpumask_t cpu_user_cs_mask;
-+#endif
-+
-+#endif
-+#endif
-+
- } mm_context_t;
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/module.h linux-2.6.32.13/arch/x86/include/asm/module.h
---- linux-2.6.32.13/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/module.h	2010-05-15 13:21:13.886644440 -0400
-@@ -59,13 +59,31 @@
- #error unknown processor family
- #endif
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define MODULE_PAX_UDEREF "UDEREF "
-+#else
-+#define MODULE_PAX_UDEREF ""
-+#endif
-+
- #ifdef CONFIG_X86_32
- # ifdef CONFIG_4KSTACKS
- #  define MODULE_STACKSIZE "4KSTACKS "
- # else
- #  define MODULE_STACKSIZE ""
- # endif
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
-+# ifdef CONFIG_PAX_KERNEXEC
-+#  define MODULE_PAX_KERNEXEC "KERNEXEC "
-+# else
-+#  define MODULE_PAX_KERNEXEC ""
-+# endif
-+# ifdef CONFIG_GRKERNSEC
-+#  define MODULE_GRSEC "GRSECURITY "
-+# else
-+#  define MODULE_GRSEC ""
-+# endif
-+# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
-+#else
-+# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
- #endif
- 
- #endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/page_32_types.h linux-2.6.32.13/arch/x86/include/asm/page_32_types.h
---- linux-2.6.32.13/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/page_32_types.h	2010-05-15 13:21:13.886644440 -0400
-@@ -15,6 +15,10 @@
-  */
- #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
-+#endif
-+
- #ifdef CONFIG_4KSTACKS
- #define THREAD_ORDER	0
- #else
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/page_64_types.h linux-2.6.32.13/arch/x86/include/asm/page_64_types.h
---- linux-2.6.32.13/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/page_64_types.h	2010-05-15 13:21:13.886644440 -0400
-@@ -39,6 +39,9 @@
- #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
- #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
- 
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+
- /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
- #define __PHYSICAL_MASK_SHIFT	46
- #define __VIRTUAL_MASK_SHIFT	47
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/paravirt.h linux-2.6.32.13/arch/x86/include/asm/paravirt.h
---- linux-2.6.32.13/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/paravirt.h	2010-05-15 13:21:13.886644440 -0400
-@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
- 	pv_mmu_ops.set_fixmap(idx, phys, flags);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long pax_open_kernel(void)
-+{
-+	return pv_mmu_ops.pax_open_kernel();
-+}
-+
-+static inline unsigned long pax_close_kernel(void)
-+{
-+	return pv_mmu_ops.pax_close_kernel();
-+}
-+#else
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
- 
- static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
-@@ -945,7 +960,7 @@ extern void default_banner(void);
- 
- #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
- #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
--#define PARA_INDIRECT(addr)	*%cs:addr
-+#define PARA_INDIRECT(addr)	*%ss:addr
- #endif
- 
- #define INTERRUPT_RETURN						\
-@@ -1022,6 +1037,21 @@ extern void default_banner(void);
- 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
- 		  CLBR_NONE,						\
- 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
-+
-+#define GET_CR0_INTO_RDI				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR0				\
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+
-+#define GET_CR3_INTO_RDI				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
-+	mov %rax,%rdi
-+
-+#define SET_RDI_INTO_CR3				\
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
-+
- #endif	/* CONFIG_X86_32 */
- 
- #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/paravirt_types.h	2010-05-15 13:21:13.902905019 -0400
-@@ -316,6 +316,12 @@ struct pv_mmu_ops {
- 	   an mfn.  We can tell which is which from the index. */
- 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
- 			   phys_addr_t phys, pgprot_t flags);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	unsigned long (*pax_open_kernel)(void);
-+	unsigned long (*pax_close_kernel)(void);
-+#endif
-+
- };
- 
- struct raw_spinlock;
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pci_x86.h linux-2.6.32.13/arch/x86/include/asm/pci_x86.h
---- linux-2.6.32.13/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pci_x86.h	2010-05-15 13:21:13.902905019 -0400
-@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
- extern void (*pcibios_disable_irq)(struct pci_dev *dev);
- 
- struct pci_raw_ops {
--	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val);
--	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
-+	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 val);
- };
- 
--extern struct pci_raw_ops *raw_pci_ops;
--extern struct pci_raw_ops *raw_pci_ext_ops;
-+extern const struct pci_raw_ops *raw_pci_ops;
-+extern const struct pci_raw_ops *raw_pci_ext_ops;
- 
--extern struct pci_raw_ops pci_direct_conf1;
-+extern const struct pci_raw_ops pci_direct_conf1;
- extern bool port_cf9_safe;
- 
- /* arch_initcall level */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgalloc.h linux-2.6.32.13/arch/x86/include/asm/pgalloc.h
---- linux-2.6.32.13/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgalloc.h	2010-05-15 13:21:13.902905019 -0400
-@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
- 				       pmd_t *pmd, pte_t *pte)
- {
- 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
-+	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
-+}
-+
-+static inline void pmd_populate_user(struct mm_struct *mm,
-+				       pmd_t *pmd, pte_t *pte)
-+{
-+	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
- 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
- }
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable-2level.h	2010-05-15 13:21:13.902905019 -0400
-@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable_32.h	2010-05-15 13:21:13.902905019 -0400
-@@ -26,8 +26,6 @@
- struct mm_struct;
- struct vm_area_struct;
- 
--extern pgd_t swapper_pg_dir[1024];
--
- static inline void pgtable_cache_init(void) { }
- static inline void check_pgt_cache(void) { }
- void paging_init(void);
-@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
- # include <asm/pgtable-2level.h>
- #endif
- 
-+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
-+#ifdef CONFIG_X86_PAE
-+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
-+#endif
-+
- #if defined(CONFIG_HIGHPTE)
- #define __KM_PTE			\
- 	(in_nmi() ? KM_NMI_PTE : 	\
-@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
- /* Clear a kernel PTE and flush it from the TLB */
- #define kpte_clear_flush(ptep, vaddr)		\
- do {						\
-+	pax_open_kernel();			\
- 	pte_clear(&init_mm, (vaddr), (ptep));	\
-+	pax_close_kernel();			\
- 	__flush_tlb_one((vaddr));		\
- } while (0)
- 
-@@ -84,6 +89,9 @@ do {						\
- 
- #endif /* !__ASSEMBLY__ */
- 
-+#define HAVE_ARCH_UNMAPPED_AREA
-+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
-+
- /*
-  * kern_addr_valid() is (1) for FLATMEM and (0) for
-  * SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable_32_types.h	2010-05-15 13:21:13.902905019 -0400
-@@ -8,7 +8,7 @@
-  */
- #ifdef CONFIG_X86_PAE
- # include <asm/pgtable-3level_types.h>
--# define PMD_SIZE	(1UL << PMD_SHIFT)
-+# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
- # define PMD_MASK	(~(PMD_SIZE - 1))
- #else
- # include <asm/pgtable-2level_types.h>
-@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
- # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifndef __ASSEMBLY__
-+extern unsigned char MODULES_EXEC_VADDR[];
-+extern unsigned char MODULES_EXEC_END[];
-+#endif
-+#include <asm/boot.h>
-+#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
-+#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
-+#else
-+#define ktla_ktva(addr)		(addr)
-+#define ktva_ktla(addr)		(addr)
-+#endif
-+
- #define MODULES_VADDR	VMALLOC_START
- #define MODULES_END	VMALLOC_END
- #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable-3level.h	2010-05-15 13:21:13.902905019 -0400
-@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
-+	pax_close_kernel();
- }
- 
- static inline void native_set_pud(pud_t *pudp, pud_t pud)
- {
-+	pax_open_kernel();
- 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
-+	pax_close_kernel();
- }
- 
- /*
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable_64.h	2010-05-15 13:21:13.906812769 -0400
-@@ -16,10 +16,13 @@
- 
- extern pud_t level3_kernel_pgt[512];
- extern pud_t level3_ident_pgt[512];
-+extern pud_t level3_vmalloc_pgt[512];
-+extern pud_t level3_vmemmap_pgt[512];
-+extern pud_t level2_vmemmap_pgt[512];
- extern pmd_t level2_kernel_pgt[512];
- extern pmd_t level2_fixmap_pgt[512];
--extern pmd_t level2_ident_pgt[512];
--extern pgd_t init_level4_pgt[];
-+extern pmd_t level2_ident_pgt[512*2];
-+extern pgd_t init_level4_pgt[512];
- 
- #define swapper_pg_dir init_level4_pgt
- 
-@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
- 
- static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
- {
-+	pax_open_kernel();
- 	*pmdp = pmd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pmd_clear(pmd_t *pmd)
-@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
- 
- static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
- {
-+	pax_open_kernel();
- 	*pgdp = pgd;
-+	pax_close_kernel();
- }
- 
- static inline void native_pgd_clear(pgd_t *pgd)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	native_set_pgd(pgd, native_make_pgd(0));
-+#endif
-+
- }
- 
- /*
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable_64_types.h	2010-05-15 13:23:38.946686210 -0400
-@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
- #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
- #define MODULES_END      _AC(0xffffffffff000000, UL)
- #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
-+#define MODULES_EXEC_VADDR MODULES_VADDR
-+#define MODULES_EXEC_END MODULES_END
- 
- #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable.h linux-2.6.32.13/arch/x86/include/asm/pgtable.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable.h	2010-05-15 13:21:13.906812769 -0400
-@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
- 
- #define arch_end_context_switch(prev)	do {} while(0)
- 
-+#define pax_open_kernel()	native_pax_open_kernel()
-+#define pax_close_kernel()	native_pax_close_kernel()
- #endif	/* CONFIG_PARAVIRT */
- 
-+#define  __HAVE_ARCH_PAX_OPEN_KERNEL
-+#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+static inline unsigned long native_pax_open_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	preempt_disable();
-+	barrier();
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(cr0 & X86_CR0_WP));
-+	write_cr0(cr0);
-+	return cr0 ^ X86_CR0_WP;
-+}
-+
-+static inline unsigned long native_pax_close_kernel(void)
-+{
-+	unsigned long cr0;
-+
-+	cr0 = read_cr0() ^ X86_CR0_WP;
-+	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
-+	write_cr0(cr0);
-+	barrier();
-+	preempt_enable_no_resched();
-+	return cr0 ^ X86_CR0_WP;
-+}
-+#else
-+static inline unsigned long native_pax_open_kernel(void) { return 0; }
-+static inline unsigned long native_pax_close_kernel(void) { return 0; }
-+#endif
-+
- /*
-  * The following only work if pte_present() is true.
-  * Undefined behaviour if not..
-  */
-+static inline int pte_user(pte_t pte)
-+{
-+	return pte_val(pte) & _PAGE_USER;
-+}
-+
- static inline int pte_dirty(pte_t pte)
- {
- 	return pte_flags(pte) & _PAGE_DIRTY;
-@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
- 	return pte_clear_flags(pte, _PAGE_RW);
- }
- 
-+static inline pte_t pte_mkread(pte_t pte)
-+{
-+	return __pte(pte_val(pte) | _PAGE_USER);
-+}
-+
- static inline pte_t pte_mkexec(pte_t pte)
- {
--	return pte_clear_flags(pte, _PAGE_NX);
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_clear_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_set_flags(pte, _PAGE_USER);
-+}
-+
-+static inline pte_t pte_exprotect(pte_t pte)
-+{
-+#ifdef CONFIG_X86_PAE
-+	if (__supported_pte_mask & _PAGE_NX)
-+		return pte_set_flags(pte, _PAGE_NX);
-+	else
-+#endif
-+		return pte_clear_flags(pte, _PAGE_USER);
- }
- 
- static inline pte_t pte_mkdirty(pte_t pte)
-@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
- #endif
- 
- #ifndef __ASSEMBLY__
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
-+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
-+{
-+	return cpu_pgd[cpu];
-+}
-+#endif
-+
- #include <linux/mm_types.h>
- 
- static inline int pte_none(pte_t pte)
-@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
- 
- static inline int pgd_bad(pgd_t pgd)
- {
--	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
-+	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
- }
- 
- static inline int pgd_none(pgd_t pgd)
-@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
-  * pgd_offset() returns a (pgd_t *)
-  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
-  */
--#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
-+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
-+#endif
-+
- /*
-  * a shortcut which implies the use of the kernel's pgd, instead
-  * of a process's
-@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
- #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
- #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
- 
-+#ifdef CONFIG_X86_32
-+#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
-+#else
-+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
-+#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
-+#else
-+#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
-+#endif
-+
-+#endif
-+
- #ifndef __ASSEMBLY__
- 
- extern int direct_gbpages;
-@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
-  * dst and src can be on the same page, but the range must not overlap,
-  * and must not cross a page boundary.
-  */
--static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
-+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
- {
--       memcpy(dst, src, count * sizeof(pgd_t));
-+	pax_open_kernel();
-+	while (count--)
-+		*dst++ = *src++;
-+	pax_close_kernel();
- }
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
-+#endif
- 
- #include <asm-generic/pgtable.h>
- #endif	/* __ASSEMBLY__ */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/pgtable_types.h	2010-05-15 13:21:13.906812769 -0400
-@@ -16,12 +16,11 @@
- #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
- #define _PAGE_BIT_PAT		7	/* on 4KB pages */
- #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
--#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
-+#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
- #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
- #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
- #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
--#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
--#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
-+#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
- #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
- 
- /* If _PAGE_BIT_PRESENT is clear, we use these: */
-@@ -39,7 +38,6 @@
- #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
- #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
- #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
--#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
- #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
- #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
- #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-@@ -55,8 +53,10 @@
- 
- #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
- #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
--#else
-+#elif defined(CONFIG_KMEMCHECK)
- #define _PAGE_NX	(_AT(pteval_t, 0))
-+#else
-+#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
- #endif
- 
- #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-@@ -93,6 +93,9 @@
- #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
- 					 _PAGE_ACCESSED)
- 
-+#define PAGE_READONLY_NOEXEC PAGE_READONLY
-+#define PAGE_SHARED_NOEXEC PAGE_SHARED
-+
- #define __PAGE_KERNEL_EXEC						\
- 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
- #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
-@@ -103,8 +106,8 @@
- #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
- #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
- #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
--#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
--#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-+#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
-+#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
- #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
- #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
-@@ -163,8 +166,8 @@
-  * bits are combined, this will alow user to access the high address mapped
-  * VDSO in the presence of CONFIG_COMPAT_VDSO
-  */
--#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
--#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
-+#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
-+#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
- #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
- #endif
- 
-@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
- 
- extern pteval_t __supported_pte_mask;
- extern void set_nx(void);
-+
-+#ifdef CONFIG_X86_32
-+#ifdef CONFIG_X86_PAE
- extern int nx_enabled;
-+#else
-+#define nx_enabled (0)
-+#endif
-+#else
-+#define nx_enabled (1)
-+#endif
- 
- #define pgprot_writecombine	pgprot_writecombine
- extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/processor.h linux-2.6.32.13/arch/x86/include/asm/processor.h
---- linux-2.6.32.13/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/processor.h	2010-05-15 13:21:13.906812769 -0400
-@@ -272,7 +272,7 @@ struct tss_struct {
- 
- } ____cacheline_aligned;
- 
--DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
-+extern struct tss_struct init_tss[NR_CPUS];
- 
- /*
-  * Save the original ist values for checking stack pointers during debugging
-@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
-  */
- #define TASK_SIZE		PAGE_OFFSET
- #define TASK_SIZE_MAX		TASK_SIZE
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
-+#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
-+#else
- #define STACK_TOP		TASK_SIZE
--#define STACK_TOP_MAX		STACK_TOP
-+#endif
-+
-+#define STACK_TOP_MAX		TASK_SIZE
- 
- #define INIT_THREAD  {							  \
- 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
-@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
-  */
- #define INIT_TSS  {							  \
- 	.x86_tss = {							  \
--		.sp0		= sizeof(init_stack) + (long)&init_stack, \
-+		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
- 		.ss0		= __KERNEL_DS,				  \
- 		.ss1		= __KERNEL_CS,				  \
- 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
-@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
- extern unsigned long thread_saved_pc(struct task_struct *tsk);
- 
- #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
--#define KSTK_TOP(info)                                                 \
--({                                                                     \
--       unsigned long *__ptr = (unsigned long *)(info);                 \
--       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
--})
-+#define KSTK_TOP(info)         ((info)->task.thread.sp0)
- 
- /*
-  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
-@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
- #define task_pt_regs(task)                                             \
- ({                                                                     \
-        struct pt_regs *__regs__;                                       \
--       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
-+       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
-        __regs__ - 1;                                                   \
- })
- 
-@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
- /*
-  * User space process size. 47bits minus one guard page.
-  */
--#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
-+#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
- 
- /* This decides where the kernel will search for a free chunk of vm
-  * space during mmap's.
-  */
- #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
--					0xc0000000 : 0xFFFFe000)
-+					0xc0000000 : 0xFFFFf000)
- 
- #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
- 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
-  */
- #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
-+#endif
-+
- #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
- 
- /* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/ptrace.h linux-2.6.32.13/arch/x86/include/asm/ptrace.h
---- linux-2.6.32.13/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/ptrace.h	2010-05-15 13:21:13.906812769 -0400
-@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
- }
- 
- /*
-- * user_mode_vm(regs) determines whether a register set came from user mode.
-+ * user_mode(regs) determines whether a register set came from user mode.
-  * This is true if V8086 mode was enabled OR if the register set was from
-  * protected mode with RPL-3 CS value.  This tricky test checks that with
-  * one comparison.  Many places in the kernel can bypass this full check
-- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
-+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
-+ * be used.
-  */
--static inline int user_mode(struct pt_regs *regs)
-+static inline int user_mode_novm(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
- #else
--	return !!(regs->cs & 3);
-+	return !!(regs->cs & SEGMENT_RPL_MASK);
- #endif
- }
- 
--static inline int user_mode_vm(struct pt_regs *regs)
-+static inline int user_mode(struct pt_regs *regs)
- {
- #ifdef CONFIG_X86_32
- 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
- 		USER_RPL;
- #else
--	return user_mode(regs);
-+	return user_mode_novm(regs);
- #endif
- }
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/reboot.h linux-2.6.32.13/arch/x86/include/asm/reboot.h
---- linux-2.6.32.13/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/reboot.h	2010-05-15 13:21:13.906812769 -0400
-@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
- 
- void native_machine_crash_shutdown(struct pt_regs *regs);
- void native_machine_shutdown(void);
--void machine_real_restart(const unsigned char *code, int length);
-+void machine_real_restart(const unsigned char *code, unsigned int length);
- 
- typedef void (*nmi_shootdown_cb)(int, struct die_args*);
- void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/rwsem.h linux-2.6.32.13/arch/x86/include/asm/rwsem.h
---- linux-2.6.32.13/arch/x86/include/asm/rwsem.h	2010-04-29 17:49:37.501451369 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/rwsem.h	2010-05-15 13:21:13.906812769 -0400
-@@ -118,10 +118,26 @@ static inline void __down_read(struct rw
- {
- 	asm volatile("# beginning down_read\n\t"
- 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* adds 0x00000001, returns the old value */
--		     "  jns        1f\n"
-+		     "  jns        2f\n"
- 		     "  call call_rwsem_down_read_failed\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending down_read\n\t"
- 		     : "+m" (sem->count)
- 		     : "a" (sem)
-@@ -136,13 +152,29 @@ static inline int __down_read_trylock(st
- 	rwsem_count_t result, tmp;
- 	asm volatile("# beginning __down_read_trylock\n\t"
- 		     "  mov          %0,%1\n\t"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "  mov          %1,%2\n\t"
- 		     "  add          %3,%2\n\t"
--		     "  jle	     2f\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "sub %3,%2\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "  jle	     3f\n\t"
- 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
--		     "  jnz	     1b\n\t"
--		     "2:\n\t"
-+		     "  jnz	     2b\n\t"
-+		     "3:\n\t"
- 		     "# ending __down_read_trylock\n\t"
- 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
- 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
-@@ -160,12 +192,28 @@ static inline void __down_write_nested(s
- 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
- 	asm volatile("# beginning down_write\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtract 0x0000ffff, returns the old value */
- 		     "  test      %1,%1\n\t"
- 		     /* was the count 0 before? */
--		     "  jz        1f\n"
-+		     "  jz        2f\n"
- 		     "  call call_rwsem_down_write_failed\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending down_write"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -198,10 +246,26 @@ static inline void __up_read(struct rw_s
- 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
- 	asm volatile("# beginning __up_read\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* subtracts 1, returns the old value */
--		     "  jns        1f\n\t"
-+		     "  jns        2f\n\t"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n"
-+		     "2:\n"
- 		     "# ending __up_read\n"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (tmp)
-@@ -216,11 +280,27 @@ static inline void __up_write(struct rw_
- 	rwsem_count_t tmp;
- 	asm volatile("# beginning __up_write\n\t"
- 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %1,(%2)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /* tries to transition
- 			0xffff0001 -> 0x00000000 */
--		     "  jz       1f\n"
-+		     "  jz       2f\n"
- 		     "  call call_rwsem_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __up_write\n"
- 		     : "+m" (sem->count), "=d" (tmp)
- 		     : "a" (sem), "1" (-RWSEM_ACTIVE_WRITE_BIAS)
-@@ -234,13 +314,29 @@ static inline void __downgrade_write(str
- {
- 	asm volatile("# beginning __downgrade_write\n\t"
- 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     /*
- 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
- 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
- 		      */
--		     "  jns       1f\n\t"
-+		     "  jns       2f\n\t"
- 		     "  call call_rwsem_downgrade_wake\n"
--		     "1:\n\t"
-+		     "2:\n\t"
- 		     "# ending __downgrade_write\n"
- 		     : "+m" (sem->count)
- 		     : "a" (sem), "er" (-RWSEM_WAITING_BIAS)
-@@ -253,7 +349,23 @@ static inline void __downgrade_write(str
- static inline void rwsem_atomic_add(rwsem_count_t delta,
- 				    struct rw_semaphore *sem)
- {
--	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
-+	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (sem->count)
- 		     : "er" (delta));
- }
-@@ -266,7 +378,23 @@ static inline rwsem_count_t rwsem_atomic
- {
- 	rwsem_count_t tmp = delta;
- 
--	asm volatile(LOCK_PREFIX "xadd %0,%1"
-+	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     "mov %0,%1\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+r" (tmp), "+m" (sem->count)
- 		     : : "memory");
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/segment.h linux-2.6.32.13/arch/x86/include/asm/segment.h
---- linux-2.6.32.13/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/segment.h	2010-05-15 13:21:13.906812769 -0400
-@@ -62,8 +62,8 @@
-  *  26 - ESPFIX small SS
-  *  27 - per-cpu			[ offset to per-cpu data area ]
-  *  28 - stack_canary-20		[ for stack protector ]
-- *  29 - unused
-- *  30 - unused
-+ *  29 - PCI BIOS CS
-+ *  30 - PCI BIOS DS
-  *  31 - TSS for double fault handler
-  */
- #define GDT_ENTRY_TLS_MIN	6
-@@ -77,6 +77,8 @@
- 
- #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
-+
- #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
- 
- #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
-@@ -88,7 +90,7 @@
- #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
- #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
- 
--#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
-+#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
- #ifdef CONFIG_SMP
- #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
- #else
-@@ -102,6 +104,12 @@
- #define __KERNEL_STACK_CANARY		0
- #endif
- 
-+#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
-+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
-+
-+#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
-+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
-+
- #define GDT_ENTRY_DOUBLEFAULT_TSS	31
- 
- /*
-@@ -139,7 +147,7 @@
-  */
- 
- /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
--#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
-+#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
- 
- 
- #else
-@@ -163,6 +171,8 @@
- #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
- #define __USER32_DS	__USER_DS
- 
-+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
-+
- #define GDT_ENTRY_TSS 8	/* needs two entries */
- #define GDT_ENTRY_LDT 10 /* needs two entries */
- #define GDT_ENTRY_TLS_MIN 12
-@@ -183,6 +193,7 @@
- #endif
- 
- #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
-+#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
- #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
- #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
- #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/spinlock.h linux-2.6.32.13/arch/x86/include/asm/spinlock.h
---- linux-2.6.32.13/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/spinlock.h	2010-05-15 13:21:13.906812769 -0400
-@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
- static inline void __raw_read_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
--		     "jns 1f\n"
--		     "call __read_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl $1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jns 2f\n"
-+		     "call __read_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw) : "memory");
- }
- 
- static inline void __raw_write_lock(raw_rwlock_t *rw)
- {
- 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
--		     "jz 1f\n"
--		     "call __write_lock_failed\n\t"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
- 		     "1:\n"
-+		     LOCK_PREFIX " addl %1,(%0)\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     "jz 2f\n"
-+		     "call __write_lock_failed\n\t"
-+		     "2:\n"
- 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
- 
- static inline void __raw_read_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
-+	asm volatile(LOCK_PREFIX "incl %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
-+		     :"+m" (rw->lock) : : "memory");
- }
- 
- static inline void __raw_write_unlock(raw_rwlock_t *rw)
- {
--	asm volatile(LOCK_PREFIX "addl %1, %0"
-+	asm volatile(LOCK_PREFIX "addl %1, %0\n"
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#ifdef CONFIG_X86_32
-+		     "into\n0:\n"
-+#else
-+		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+#endif
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
-+		     LOCK_PREFIX "subl %1,%0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
-+#endif
-+
- 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
- }
- 
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/system.h linux-2.6.32.13/arch/x86/include/asm/system.h
---- linux-2.6.32.13/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/system.h	2010-05-15 13:21:13.906812769 -0400
-@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
- {
- 	unsigned long __limit;
- 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
--	return __limit + 1;
-+	return __limit;
- }
- 
- static inline void native_clts(void)
-@@ -340,7 +340,7 @@ void enable_hlt(void);
- 
- void cpu_idle_wait(void);
- 
--extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ~0xfUL)
- extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
- 
- void default_idle(void);
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/uaccess_32.h	2010-05-15 13:21:13.906812769 -0400
-@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
- static __always_inline unsigned long __must_check
- __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
- 	return __copy_to_user_ll(to, from, n);
- }
- 
-@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
- static __always_inline unsigned long
- __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
- {
-+	if ((long)n < 0)
-+		return n;
-+
- 	/* Avoid zeroing the tail if the copy fails..
- 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
- 	 * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +146,10 @@ static __always_inline unsigned long
- __copy_from_user(void *to, const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
- 			return ret;
- 		}
- 	}
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
- 	return __copy_from_user_ll(to, from, n);
- }
- 
-@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
- 				const void __user *from, unsigned long n)
- {
- 	might_fault();
-+
-+	if ((long)n < 0)
-+		return n;
-+
- 	if (__builtin_constant_p(n)) {
- 		unsigned long ret;
- 
-@@ -182,14 +200,62 @@ static __always_inline unsigned long
- __copy_from_user_inatomic_nocache(void *to, const void __user *from,
- 				  unsigned long n)
- {
--       return __copy_from_user_ll_nocache_nozero(to, from, n);
-+	if ((long)n < 0)
-+		return n;
-+
-+	return __copy_from_user_ll_nocache_nozero(to, from, n);
-+}
-+
-+/**
-+ * copy_to_user: - Copy a block of data into user space.
-+ * @to:   Destination address, in user space.
-+ * @from: Source address, in kernel space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from kernel space to user space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_to_user(void __user *to, const void *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_WRITE, to, n))
-+		n = __copy_to_user(to, from, n);
-+	return n;
-+}
-+
-+/**
-+ * copy_from_user: - Copy a block of data from user space.
-+ * @to:   Destination address, in kernel space.
-+ * @from: Source address, in user space.
-+ * @n:    Number of bytes to copy.
-+ *
-+ * Context: User context only.  This function may sleep.
-+ *
-+ * Copy data from user space to kernel space.
-+ *
-+ * Returns number of bytes that could not be copied.
-+ * On success, this will be zero.
-+ *
-+ * If some data could not be copied, this function will pad the copied
-+ * data to the requested size using zero bytes.
-+ */
-+static __always_inline unsigned long __must_check
-+copy_from_user(void *to, const void __user *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_READ, from, n))
-+		n = __copy_from_user(to, from, n);
-+	else if ((long)n > 0) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		memset(to, 0, n);
-+	}
-+	return n;
- }
- 
--unsigned long __must_check copy_to_user(void __user *to,
--					const void *from, unsigned long n);
--unsigned long __must_check copy_from_user(void *to,
--					  const void __user *from,
--					  unsigned long n);
- long __must_check strncpy_from_user(char *dst, const char __user *src,
- 				    long count);
- long __must_check __strncpy_from_user(char *dst,
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/uaccess_64.h	2010-05-15 13:21:13.906812769 -0400
-@@ -9,6 +9,9 @@
- #include <linux/prefetch.h>
- #include <linux/lockdep.h>
- #include <asm/page.h>
-+#include <asm/pgtable.h>
-+
-+#define set_fs(x)	(current_thread_info()->addr_limit = (x))
- 
- /*
-  * Copy To/From Userspace
-@@ -19,20 +22,24 @@ __must_check unsigned long
- copy_user_generic(void *to, const void *from, unsigned len);
- 
- __must_check unsigned long
--copy_to_user(void __user *to, const void *from, unsigned len);
--__must_check unsigned long
--copy_from_user(void *to, const void __user *from, unsigned len);
--__must_check unsigned long
- copy_in_user(void __user *to, const void __user *from, unsigned len);
- 
- static __always_inline __must_check
--int __copy_from_user(void *dst, const void __user *src, unsigned size)
-+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(dst, size, false);
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
- 			      ret, "b", "b", "=q", 1);
-@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
- 			       ret, "q", "", "=r", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic(dst, (__force void *)src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_to_user(void __user *dst, const void *src, unsigned size)
-+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		check_object_size(src, size, true);
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
-+	}
- 	switch (size) {
- 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
- 			      ret, "b", "b", "iq", 1);
-@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
- 			       ret, "q", "", "er", 8);
- 		return ret;
- 	default:
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst, src, size);
- 	}
- }
- 
- static __always_inline __must_check
--int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
-+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
-+{
-+	if (access_ok(VERIFY_WRITE, to, len))
-+		len = __copy_to_user(to, from, len);
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
-+{
-+	if ((int)len < 0)
-+		return len;
-+
-+	if (access_ok(VERIFY_READ, from, len))
-+		len = __copy_from_user(to, from, len);
-+	else if ((int)len > 0) {
-+		if (!__builtin_constant_p(len))
-+			check_object_size(to, len, false);
-+		memset(to, 0, len);
-+	}
-+	return len;
-+}
-+
-+static __always_inline __must_check
-+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
- {
--	int ret = 0;
-+	unsigned ret = 0;
- 
- 	might_fault();
--	if (!__builtin_constant_p(size))
-+
-+	if ((int)size < 0)
-+		return size;
-+
-+	if (!__builtin_constant_p(size)) {
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
-+	}
- 	switch (size) {
- 	case 1: {
- 		u8 tmp;
-@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
- 		return ret;
- 	}
- 	default:
-+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+			src += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+			dst += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)dst,
- 					 (__force void *)src, size);
- 	}
-@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
- __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
- 					    unsigned size);
- 
--static __must_check __always_inline int
-+static __must_check __always_inline unsigned long
- __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return copy_user_generic((__force void *)dst, src, size);
- }
- 
--extern long __copy_user_nocache(void *dst, const void __user *src,
-+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
- 				unsigned size, int zerorest);
- 
--static inline int
--__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
-+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
- {
- 	might_sleep();
-+
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 1);
- }
- 
--static inline int
--__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
-+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
- 				  unsigned size)
- {
-+	if ((int)size < 0)
-+		return size;
-+
- 	return __copy_user_nocache(dst, src, size, 0);
- }
- 
--unsigned long
-+extern unsigned long
- copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
- 
- #endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/uaccess.h linux-2.6.32.13/arch/x86/include/asm/uaccess.h
---- linux-2.6.32.13/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/uaccess.h	2010-05-15 13:21:13.906812769 -0400
-@@ -8,8 +8,11 @@
- #include <linux/thread_info.h>
- #include <linux/prefetch.h>
- #include <linux/string.h>
-+#include <linux/sched.h>
-+#include <linux/slab.h>
- #include <asm/asm.h>
- #include <asm/page.h>
-+#include <asm/segment.h>
- 
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-@@ -29,7 +32,12 @@
- 
- #define get_ds()	(KERNEL_DS)
- #define get_fs()	(current_thread_info()->addr_limit)
-+#ifdef CONFIG_X86_32
-+void __set_fs(mm_segment_t x, int cpu);
-+void set_fs(mm_segment_t x);
-+#else
- #define set_fs(x)	(current_thread_info()->addr_limit = (x))
-+#endif
- 
- #define segment_eq(a, b)	((a).seg == (b).seg)
- 
-@@ -77,7 +85,33 @@
-  * checks that the pointer is in the user space range - after calling
-  * this function, memory access functions may still return -EFAULT.
-  */
--#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
-+#define access_ok(type, addr, size)					\
-+({									\
-+	long __size = size;						\
-+	unsigned long __addr = (unsigned long)addr;			\
-+	unsigned long __addr_ao = __addr & PAGE_MASK;			\
-+	unsigned long __end_ao = __addr + __size - 1;			\
-+	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
-+	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
-+		while(__addr_ao <= __end_ao) {				\
-+			char __c_ao;					\
-+			__addr_ao += PAGE_SIZE;				\
-+			if (__size > PAGE_SIZE)				\
-+				cond_resched();				\
-+			if (__get_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			if (type != VERIFY_WRITE) {			\
-+				__addr = __addr_ao;			\
-+				continue;				\
-+			}						\
-+			if (__put_user(__c_ao, (char __user *)__addr))	\
-+				break;					\
-+			__addr = __addr_ao;				\
-+		}							\
-+	}								\
-+	__ret_ao;							\
-+})
- 
- /*
-  * The exception table consists of pairs of addresses: the first is the
-@@ -183,13 +217,21 @@ extern int __get_user_bad(void);
- 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
- 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
- 
--
-+#ifdef CONFIG_X86_32
-+#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
-+#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
-+#else
-+#define _ASM_LOAD_USER_DS(ds)
-+#define _ASM_LOAD_KERNEL_DS
-+#endif
- 
- #ifdef CONFIG_X86_32
- #define __put_user_asm_u64(x, addr, err, errret)			\
--	asm volatile("1:	movl %%eax,0(%2)\n"			\
--		     "2:	movl %%edx,4(%2)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	movl %%eax,%%ds:0(%2)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%2)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "4:	movl %3,%0\n"				\
- 		     "	jmp 3b\n"					\
-@@ -197,15 +239,18 @@ extern int __get_user_bad(void);
- 		     _ASM_EXTABLE(1b, 4b)				\
- 		     _ASM_EXTABLE(2b, 4b)				\
- 		     : "=r" (err)					\
--		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
-+		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex_u64(x, addr)					\
--	asm volatile("1:	movl %%eax,0(%1)\n"			\
--		     "2:	movl %%edx,4(%1)\n"			\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	movl %%eax,%%ds:0(%1)\n"		\
-+		     "2:	movl %%edx,%%ds:4(%1)\n"		\
- 		     "3:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
- 		     _ASM_EXTABLE(2b, 3b - 2b)				\
--		     : : "A" (x), "r" (addr))
-+		     : : "A" (x), "r" (addr), "r"(__USER_DS))
- 
- #define __put_user_x8(x, ptr, __ret_pu)				\
- 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
-@@ -374,16 +419,18 @@ do {									\
- } while (0)
- 
- #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
--		     : "=r" (err), ltype(x)				\
--		     : "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : "=r" (err), ltype (x)				\
-+		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
- 
- #define __get_user_size_ex(x, ptr, size)				\
- do {									\
-@@ -407,10 +454,12 @@ do {									\
- } while (0)
- 
- #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : ltype(x) : "m" (__m(addr)))
-+		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
- 
- #define __put_user_nocheck(x, ptr, size)			\
- ({								\
-@@ -424,13 +473,24 @@ do {									\
- 	int __gu_err;							\
- 	unsigned long __gu_val;						\
- 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
--	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
-+	(x) = (__typeof__(*(ptr)))__gu_val;				\
- 	__gu_err;							\
- })
- 
- /* FIXME: this hack is definitely wrong -AK */
- struct __large_struct { unsigned long buf[100]; };
--#define __m(x) (*(struct __large_struct __user *)(x))
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#define ____m(x)					\
-+({							\
-+	unsigned long ____x = (unsigned long)(x);	\
-+	if (____x < PAX_USER_SHADOW_BASE)		\
-+		____x += PAX_USER_SHADOW_BASE;		\
-+	(void __user *)____x;				\
-+})
-+#else
-+#define ____m(x) (x)
-+#endif
-+#define __m(x) (*(struct __large_struct __user *)____m(x))
- 
- /*
-  * Tell gcc we read from memory instead of writing: this is because
-@@ -438,21 +498,26 @@ struct __large_struct { unsigned long bu
-  * aliasing issues.
-  */
- #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
--	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(5)				\
-+		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     ".section .fixup,\"ax\"\n"				\
- 		     "3:	mov %3,%0\n"				\
- 		     "	jmp 2b\n"					\
- 		     ".previous\n"					\
- 		     _ASM_EXTABLE(1b, 3b)				\
- 		     : "=r"(err)					\
--		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
-+		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
-+		       "r"(__USER_DS))
- 
- #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
--	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
-+	asm volatile(_ASM_LOAD_USER_DS(2)				\
-+		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
- 		     "2:\n"						\
-+		     _ASM_LOAD_KERNEL_DS				\
- 		     _ASM_EXTABLE(1b, 2b - 1b)				\
--		     : : ltype(x), "m" (__m(addr)))
-+		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
- 
- /*
-  * uaccess_try and catch
-@@ -530,7 +595,7 @@ struct __large_struct { unsigned long bu
- #define get_user_ex(x, ptr)	do {					\
- 	unsigned long __gue_val;					\
- 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
--	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
-+	(x) = (__typeof__(*(ptr)))__gue_val;				\
- } while (0)
- 
- #ifdef CONFIG_X86_WP_WORKS_OK
-@@ -567,6 +632,7 @@ extern struct movsl_mask {
- 
- #define ARCH_HAS_NOCACHE_UACCESS 1
- 
-+#define ARCH_HAS_SORT_EXTABLE
- #ifdef CONFIG_X86_32
- # include "uaccess_32.h"
- #else
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/vgtod.h linux-2.6.32.13/arch/x86/include/asm/vgtod.h
---- linux-2.6.32.13/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/vgtod.h	2010-05-15 13:21:13.906812769 -0400
-@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
- 	int		sysctl_enabled;
- 	struct timezone sys_tz;
- 	struct { /* extract of a clocksource struct */
-+		char	name[8];
- 		cycle_t (*vread)(void);
- 		cycle_t	cycle_last;
- 		cycle_t	mask;
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/vmi.h linux-2.6.32.13/arch/x86/include/asm/vmi.h
---- linux-2.6.32.13/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/vmi.h	2010-05-15 13:21:13.928275178 -0400
-@@ -191,6 +191,7 @@ struct vrom_header {
- 	u8      reserved[96];   /* Reserved for headers */
- 	char    vmi_init[8];    /* VMI_Init jump point */
- 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
-+	char    rom_data[8048];	/* rest of the option ROM */
- } __attribute__((packed));
- 
- struct pnp_header {
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/vsyscall.h linux-2.6.32.13/arch/x86/include/asm/vsyscall.h
---- linux-2.6.32.13/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/vsyscall.h	2010-05-15 13:21:13.928275178 -0400
-@@ -15,9 +15,10 @@ enum vsyscall_num {
- 
- #ifdef __KERNEL__
- #include <linux/seqlock.h>
-+#include <linux/getcpu.h>
-+#include <linux/time.h>
- 
- #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
--#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
- 
- /* Definitions for CONFIG_GENERIC_TIME definitions */
- #define __section_vsyscall_gtod_data __attribute__ \
-@@ -31,7 +32,6 @@ enum vsyscall_num {
- #define VGETCPU_LSL	2
- 
- extern int __vgetcpu_mode;
--extern volatile unsigned long __jiffies;
- 
- /* kernel space (writeable) */
- extern int vgetcpu_mode;
-@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
- 
- extern void map_vsyscall(void);
- 
-+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
-+extern time_t vtime(time_t *t);
-+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
- #endif /* __KERNEL__ */
- 
- #endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.32.13/arch/x86/include/asm/xsave.h linux-2.6.32.13/arch/x86/include/asm/xsave.h
---- linux-2.6.32.13/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/include/asm/xsave.h	2010-05-15 13:21:13.928275178 -0400
-@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
- static inline int xsave_user(struct xsave_struct __user *buf)
- {
- 	int err;
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
-+		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
- 	u32 lmask = mask;
- 	u32 hmask = mask >> 32;
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
-+		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
-+#endif
-+
- 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
- 			     "2:\n"
- 			     ".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.32.13/arch/x86/Kconfig linux-2.6.32.13/arch/x86/Kconfig
---- linux-2.6.32.13/arch/x86/Kconfig	2010-05-15 13:20:18.407099662 -0400
-+++ linux-2.6.32.13/arch/x86/Kconfig	2010-05-15 13:40:23.896554812 -0400
-@@ -531,6 +531,7 @@ source "arch/x86/lguest/Kconfig"
- 
- config PARAVIRT
- 	bool "Enable paravirtualization code"
-+	depends on !PAX_PER_CPU_PGD
- 	---help---
- 	  This changes the kernel so it can modify itself when it is run
- 	  under a hypervisor, potentially improving performance significantly
-@@ -1083,7 +1084,7 @@ config PAGE_OFFSET
- 	hex
- 	default 0xB0000000 if VMSPLIT_3G_OPT
- 	default 0x80000000 if VMSPLIT_2G
--	default 0x78000000 if VMSPLIT_2G_OPT
-+	default 0x70000000 if VMSPLIT_2G_OPT
- 	default 0x40000000 if VMSPLIT_1G
- 	default 0xC0000000
- 	depends on X86_32
-@@ -1414,7 +1415,7 @@ config ARCH_USES_PG_UNCACHED
- 
- config EFI
- 	bool "EFI runtime service support"
--	depends on ACPI
-+	depends on ACPI && !PAX_KERNEXEC
- 	---help---
- 	  This enables the kernel to use EFI runtime services that are
- 	  available (such as the EFI variable services).
-@@ -1501,6 +1502,7 @@ config KEXEC_JUMP
- config PHYSICAL_START
- 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
- 	default "0x1000000"
-+	range 0x400000 0x40000000
- 	---help---
- 	  This gives the physical address where the kernel is loaded.
- 
-@@ -1565,6 +1567,7 @@ config PHYSICAL_ALIGN
- 	hex
- 	prompt "Alignment value to which kernel should be aligned" if X86_32
- 	default "0x1000000"
-+	range 0x400000 0x1000000 if PAX_KERNEXEC
- 	range 0x2000 0x1000000
- 	---help---
- 	  This value puts the alignment restrictions on physical address
-@@ -1596,9 +1599,10 @@ config HOTPLUG_CPU
- 	  Say N if you want to disable CPU hotplug.
- 
- config COMPAT_VDSO
--	def_bool y
-+	def_bool n
- 	prompt "Compat VDSO support"
- 	depends on X86_32 || IA32_EMULATION
-+	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
- 	---help---
- 	  Map the 32-bit VDSO to the predictable old-style address too.
- 	---help---
-diff -urNp linux-2.6.32.13/arch/x86/Kconfig.cpu linux-2.6.32.13/arch/x86/Kconfig.cpu
---- linux-2.6.32.13/arch/x86/Kconfig.cpu	2010-04-29 17:49:37.481119841 -0400
-+++ linux-2.6.32.13/arch/x86/Kconfig.cpu	2010-05-15 13:21:13.930870481 -0400
-@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
- 
- config X86_F00F_BUG
- 	def_bool y
--	depends on M586MMX || M586TSC || M586 || M486 || M386
-+	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
- 
- config X86_WP_WORKS_OK
- 	def_bool y
-@@ -360,7 +360,7 @@ config X86_POPAD_OK
- 
- config X86_ALIGNMENT_16
- 	def_bool y
--	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
-+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
- 
- config X86_INTEL_USERCOPY
- 	def_bool y
-@@ -406,7 +406,7 @@ config X86_CMPXCHG64
- # generates cmov.
- config X86_CMOV
- 	def_bool y
--	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
-+	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
- 
- config X86_MINIMUM_CPU_FAMILY
- 	int
-diff -urNp linux-2.6.32.13/arch/x86/Kconfig.debug linux-2.6.32.13/arch/x86/Kconfig.debug
---- linux-2.6.32.13/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/Kconfig.debug	2010-05-15 13:21:13.942893840 -0400
-@@ -99,7 +99,7 @@ config X86_PTDUMP
- config DEBUG_RODATA
- 	bool "Write protect kernel read-only data structures"
- 	default y
--	depends on DEBUG_KERNEL
-+	depends on DEBUG_KERNEL && BROKEN
- 	---help---
- 	  Mark the kernel read-only data as write-protected in the pagetables,
- 	  in order to catch accidental (and incorrect) writes to such const
-diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/boot.c linux-2.6.32.13/arch/x86/kernel/acpi/boot.c
---- linux-2.6.32.13/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/acpi/boot.c	2010-05-15 13:21:13.954911113 -0400
-@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
- 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
- 		     },
- 	 },
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- /*
-diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S
---- linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/acpi/realmode/wakeup.S	2010-05-15 13:21:13.954911113 -0400
-@@ -104,7 +104,7 @@ _start:
- 	movl	%eax, %ecx
- 	orl	%edx, %ecx
- 	jz	1f
--	movl	$0xc0000080, %ecx
-+	mov	$MSR_EFER, %ecx
- 	wrmsr
- 1:
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c	2010-05-15 13:20:18.407099662 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/acpi/sleep.c	2010-05-15 13:21:13.954911113 -0400
-@@ -11,11 +11,12 @@
- #include <linux/cpumask.h>
- #include <asm/segment.h>
- #include <asm/desc.h>
-+#include <asm/e820.h>
- 
- #include "realmode/wakeup.h"
- #include "sleep.h"
- 
--unsigned long acpi_wakeup_address;
-+unsigned long acpi_wakeup_address = 0x2000;
- unsigned long acpi_realmode_flags;
- 
- /* address in low memory of the wakeup routine. */
-@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
- 	header->trampoline_segment = setup_trampoline() >> 4;
- #ifdef CONFIG_SMP
- 	stack_start.sp = temp_stack + sizeof(temp_stack);
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address =
- 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
-+	pax_close_kernel();
-+
- 	initial_gs = per_cpu_offset(smp_processor_id());
- #endif
- 	initial_code = (unsigned long)wakeup_long64;
-@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
- 		return;
- 	}
- 
--	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
--
--	if (!acpi_realmode) {
--		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
--		return;
--	}
--
--	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
-+	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
-+	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
- }
- 
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/acpi/wakeup_32.S	2010-05-15 13:21:13.954911113 -0400
-@@ -30,13 +30,11 @@ wakeup_pmode_return:
- 	# and restore the stack ... but you need gdt for this to work
- 	movl	saved_context_esp, %esp
- 
--	movl	%cs:saved_magic, %eax
--	cmpl	$0x12345678, %eax
-+	cmpl	$0x12345678, saved_magic
- 	jne	bogus_magic
- 
- 	# jump to place where we left off
--	movl	saved_eip, %eax
--	jmp	*%eax
-+	jmp	*(saved_eip)
- 
- bogus_magic:
- 	jmp	bogus_magic
-diff -urNp linux-2.6.32.13/arch/x86/kernel/alternative.c linux-2.6.32.13/arch/x86/kernel/alternative.c
---- linux-2.6.32.13/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/alternative.c	2010-05-15 13:21:13.962912884 -0400
-@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
- 
- 		BUG_ON(p->len > MAX_PATCH_LEN);
- 		/* prep the buffer with the original instructions */
--		memcpy(insnbuf, p->instr, p->len);
-+		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
- 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
- 					 (unsigned long)p->instr, p->len);
- 
-@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
-  * instructions. And on the local CPU you need to be protected again NMI or MCE
-  * handlers seeing an inconsistent instruction while you patch.
-  */
--static void *__init_or_module text_poke_early(void *addr, const void *opcode,
-+static void *__kprobes text_poke_early(void *addr, const void *opcode,
- 					      size_t len)
- {
- 	unsigned long flags;
- 	local_irq_save(flags);
--	memcpy(addr, opcode, len);
-+
-+	pax_open_kernel();
-+	memcpy(ktla_ktva(addr), opcode, len);
-+	pax_close_kernel();
-+
- 	sync_core();
- 	local_irq_restore(flags);
- 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
-@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
-  */
- void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
- {
--	unsigned long flags;
--	char *vaddr;
-+	unsigned char *vaddr = ktla_ktva(addr);
- 	struct page *pages[2];
--	int i;
-+	size_t i;
- 
- 	if (!core_kernel_text((unsigned long)addr)) {
--		pages[0] = vmalloc_to_page(addr);
--		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
-+		pages[0] = vmalloc_to_page(vaddr);
-+		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
- 	} else {
--		pages[0] = virt_to_page(addr);
-+		pages[0] = virt_to_page(vaddr);
- 		WARN_ON(!PageReserved(pages[0]));
--		pages[1] = virt_to_page(addr + PAGE_SIZE);
-+		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
- 	}
- 	BUG_ON(!pages[0]);
--	local_irq_save(flags);
--	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
--	if (pages[1])
--		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
--	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
--	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
--	clear_fixmap(FIX_TEXT_POKE0);
--	if (pages[1])
--		clear_fixmap(FIX_TEXT_POKE1);
--	local_flush_tlb();
--	sync_core();
--	/* Could also do a CLFLUSH here to speed up CPU recovery; but
--	   that causes hangs on some VIA CPUs. */
-+	text_poke_early(addr, opcode, len);
- 	for (i = 0; i < len; i++)
--		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
--	local_irq_restore(flags);
-+		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
- 	return addr;
- }
-diff -urNp linux-2.6.32.13/arch/x86/kernel/amd_iommu.c linux-2.6.32.13/arch/x86/kernel/amd_iommu.c
---- linux-2.6.32.13/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:37.521943068 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/amd_iommu.c	2010-05-15 13:21:13.968009761 -0400
-@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
- 	}
- }
- 
--static struct dma_map_ops amd_iommu_dma_ops = {
-+static const struct dma_map_ops amd_iommu_dma_ops = {
- 	.alloc_coherent = alloc_coherent,
- 	.free_coherent = free_coherent,
- 	.map_page = map_page,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/apic/io_apic.c	2010-05-15 13:21:13.979712258 -0400
-@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
- 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
- 				GFP_ATOMIC);
- 	if (!ioapic_entries)
--		return 0;
-+		return NULL;
- 
- 	for (apic = 0; apic < nr_ioapics; apic++) {
- 		ioapic_entries[apic] =
-@@ -728,7 +728,7 @@ nomem:
- 		kfree(ioapic_entries[apic]);
- 	kfree(ioapic_entries);
- 
--	return 0;
-+	return NULL;
- }
- 
- /*
-@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
- }
- EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
- 
--void lock_vector_lock(void)
-+void lock_vector_lock(void) __acquires(vector_lock)
- {
- 	/* Used to the online set of cpus does not change
- 	 * during assign_irq_vector.
-@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
- 	spin_lock(&vector_lock);
- }
- 
--void unlock_vector_lock(void)
-+void unlock_vector_lock(void) __releases(vector_lock)
- {
- 	spin_unlock(&vector_lock);
- }
-diff -urNp linux-2.6.32.13/arch/x86/kernel/apm_32.c linux-2.6.32.13/arch/x86/kernel/apm_32.c
---- linux-2.6.32.13/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/apm_32.c	2010-05-15 13:21:14.011066799 -0400
-@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
-  * This is for buggy BIOS's that refer to (real mode) segment 0x40
-  * even though they are called in protected mode.
-  */
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- static const char driver_version[] = "1.16ac";	/* no spaces */
-@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
- 			  &call->esi);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	return call->eax & 0xff;
-@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
- 	BUG_ON(cpu != 0);
- 	gdt = get_cpu_gdt_table(cpu);
- 	save_desc_40 = gdt[0x40 / 8];
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	apm_irq_save(flags);
- 	APM_DO_SAVE_SEGS;
-@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
- 					 &call->eax);
- 	APM_DO_RESTORE_SEGS;
- 	apm_irq_restore(flags);
-+
-+	pax_open_kernel();
- 	gdt[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 	return error;
- }
-@@ -975,7 +989,7 @@ recalc:
- 
- static void apm_power_off(void)
- {
--	unsigned char po_bios_call[] = {
-+	const unsigned char po_bios_call[] = {
- 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
- 		0x8e, 0xd0,		/* movw  ax,ss       */
- 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
-@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
- static struct miscdevice apm_device = {
- 	APM_MINOR_DEV,
- 	"apm_bios",
--	&apm_bios_fops
-+	&apm_bios_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- 
-@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
- 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
- 
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- /*
-@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
- 	 * code to that CPU.
- 	 */
- 	gdt = get_cpu_gdt_table(0);
-+
-+	pax_open_kernel();
- 	set_desc_base(&gdt[APM_CS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
- 	set_desc_base(&gdt[APM_CS_16 >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
- 	set_desc_base(&gdt[APM_DS >> 3],
- 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
-+	pax_close_kernel();
- 
- 	proc_create("apm", 0, NULL, &apm_file_ops);
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/asm-offsets_32.c	2010-05-15 13:21:14.011066799 -0400
-@@ -115,6 +115,11 @@ void foo(void)
- 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
- #endif
- 
- #ifdef CONFIG_XEN
-diff -urNp linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/asm-offsets_64.c	2010-05-15 13:21:14.011066799 -0400
-@@ -63,6 +63,18 @@ int main(void)
- 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
- 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
- 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
-+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
-+	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
-+	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
-+#endif
-+
- #endif
- 
- 
-@@ -115,6 +127,7 @@ int main(void)
- 	ENTRY(cr8);
- 	BLANK();
- #undef ENTRY
-+	DEFINE(TSS_size, sizeof(struct tss_struct));
- 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
- 	BLANK();
- 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/common.c linux-2.6.32.13/arch/x86/kernel/cpu/common.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/common.c	2010-05-15 13:21:14.011066799 -0400
-@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
- 
- static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
- 
--DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
--#ifdef CONFIG_X86_64
--	/*
--	 * We need valid kernel segments for data and code in long mode too
--	 * IRET will check the segment types  kkeil 2000/10/28
--	 * Also sysret mandates a special GDT layout
--	 *
--	 * TLS descriptors are currently at a different place compared to i386.
--	 * Hopefully nobody expects them at a fixed place (Wine?)
--	 */
--	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
--#else
--	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
--	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
--	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
--	/*
--	 * Segments used for calling PnP BIOS have byte granularity.
--	 * They code segments and data segments have fixed 64k limits,
--	 * the transfer segment sizes are set at run time.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/* 16-bit data */
--	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
--	/*
--	 * The APM segments have byte granularity and their bases
--	 * are set at run time.  All have 64k limits.
--	 */
--	/* 32-bit code */
--	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
--	/* 16-bit code */
--	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
--	/* data */
--	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
--
--	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
--	GDT_STACK_CANARY_INIT
--#endif
--} };
--EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
--
- static int __init x86_xsave_setup(char *s)
- {
- 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
- {
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
-+	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 	/* Reload the per-cpu base */
-@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
- 	/* Filter out anything that depends on CPUID levels we don't have */
- 	filter_cpuid_features(c, true);
- 
-+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
-+	setup_clear_cpu_cap(X86_FEATURE_SEP);
-+#endif
-+
- 	/* If the model name is still unset, do table lookup. */
- 	if (!c->x86_model_id[0]) {
- 		const char *p;
-@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
- 	int i;
- 
- 	cpu = stack_smp_processor_id();
--	t = &per_cpu(init_tss, cpu);
-+	t = init_tss + cpu;
- 	orig_ist = &per_cpu(orig_ist, cpu);
- 
- #ifdef CONFIG_NUMA
-@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
- 	switch_to_new_gdt(cpu);
- 	loadsegment(fs, 0);
- 
--	load_idt((const struct desc_ptr *)&idt_descr);
-+	load_idt(&idt_descr);
- 
- 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
- 	syscall_init();
-@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
- {
- 	int cpu = smp_processor_id();
- 	struct task_struct *curr = current;
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 	struct thread_struct *thread = &curr->thread;
- 
- 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-05-15 13:21:14.043267946 -0400
-@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
- 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-05-15 13:21:14.043267946 -0400
-@@ -225,7 +225,7 @@ static struct cpu_model models[] =
- 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
- 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
- 
--	{ NULL, }
-+	{ NULL, NULL, 0, NULL}
- };
- #undef _BANIAS
- #undef BANIAS
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/intel.c linux-2.6.32.13/arch/x86/kernel/cpu/intel.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/intel.c	2010-05-15 13:20:18.427075180 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/intel.c	2010-05-15 13:21:14.043267946 -0400
-@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
- 	 * Update the IDT descriptor and reload the IDT so that
- 	 * it uses the read-only mapped virtual address.
- 	 */
--	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
-+	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
- 	load_idt(&idt_descr);
- }
- #endif
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-15 13:20:18.427075180 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-15 13:21:14.043267946 -0400
-@@ -917,7 +917,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show   = show,
- 	.store  = store,
- };
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/Makefile linux-2.6.32.13/arch/x86/kernel/cpu/Makefile
---- linux-2.6.32.13/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/Makefile	2010-05-15 13:21:14.043267946 -0400
-@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
- CFLAGS_REMOVE_common.o = -pg
- endif
- 
--# Make sure load_percpu_segment has no stackprotector
--nostackp := $(call cc-option, -fno-stack-protector)
--CFLAGS_common.o		:= $(nostackp)
--
- obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
- obj-y			+= proc.o capflags.o powerflags.o common.o
- obj-y			+= vmware.o hypervisor.o sched.o
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-05-15 13:21:14.043267946 -0400
-@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
- 	return ret;
- }
- 
--static struct sysfs_ops threshold_ops = {
-+static const struct sysfs_ops threshold_ops = {
- 	.show			= show,
- 	.store			= store,
- };
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mcheck/mce.c	2010-05-15 13:21:14.043267946 -0400
-@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
- 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
- 				m->cs, m->ip);
- 
--		if (m->cs == __KERNEL_CS)
-+		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
- 			print_symbol("{%s}", m->ip);
- 		pr_cont("\n");
- 	}
-@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
-  */
- 
- static DEFINE_SPINLOCK(mce_state_lock);
--static int		open_count;		/* #times opened */
-+static atomic_t		open_count;		/* #times opened */
- static int		open_exclu;		/* already open exclusive? */
- 
- static int mce_open(struct inode *inode, struct file *file)
- {
- 	spin_lock(&mce_state_lock);
- 
--	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
- 		spin_unlock(&mce_state_lock);
- 
- 		return -EBUSY;
-@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
- 
- 	if (file->f_flags & O_EXCL)
- 		open_exclu = 1;
--	open_count++;
-+	atomic_inc(&open_count);
- 
- 	spin_unlock(&mce_state_lock);
- 
-@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
- {
- 	spin_lock(&mce_state_lock);
- 
--	open_count--;
-+	atomic_dec(&open_count);
- 	open_exclu = 0;
- 
- 	spin_unlock(&mce_state_lock);
-@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
- 	MISC_MCELOG_MINOR,
- 	"mcelog",
- 	&mce_chrdev_ops,
-+	{NULL, NULL}, NULL, NULL
- };
- 
- /*
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/amd.c	2010-05-15 13:21:14.043267946 -0400
-@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
- 	return 0;
- }
- 
--static struct mtrr_ops amd_mtrr_ops = {
-+static const struct mtrr_ops amd_mtrr_ops = {
- 	.vendor            = X86_VENDOR_AMD,
- 	.set               = amd_set_mtrr,
- 	.get               = amd_get_mtrr,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/centaur.c	2010-05-15 13:21:14.043267946 -0400
-@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
- 	return 0;
- }
- 
--static struct mtrr_ops centaur_mtrr_ops = {
-+static const struct mtrr_ops centaur_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CENTAUR,
- 	.set               = centaur_set_mcr,
- 	.get               = centaur_get_mcr,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-05-15 13:21:14.043267946 -0400
-@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
- 	post_set();
- }
- 
--static struct mtrr_ops cyrix_mtrr_ops = {
-+static const struct mtrr_ops cyrix_mtrr_ops = {
- 	.vendor            = X86_VENDOR_CYRIX,
- 	.set_all	   = cyrix_set_all,
- 	.set               = cyrix_set_arr,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/generic.c	2010-05-15 13:21:14.043267946 -0400
-@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
- 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
- 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
- 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
--	{}
-+	{ 0, 0 }
- };
- 
- static unsigned long smp_changes_mask;
-@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
- /*
-  * Generic structure...
-  */
--struct mtrr_ops generic_mtrr_ops = {
-+const struct mtrr_ops generic_mtrr_ops = {
- 	.use_intel_if		= 1,
- 	.set_all		= generic_set_all,
- 	.get			= generic_get_mtrr,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/main.c	2010-05-15 13:21:14.043267946 -0400
-@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
- u64 size_or_mask, size_and_mask;
- static bool mtrr_aps_delayed_init;
- 
--static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
-+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
- 
--struct mtrr_ops *mtrr_if;
-+const struct mtrr_ops *mtrr_if;
- 
- static void set_mtrr(unsigned int reg, unsigned long base,
- 		     unsigned long size, mtrr_type type);
- 
--void set_mtrr_ops(struct mtrr_ops *ops)
-+void set_mtrr_ops(const struct mtrr_ops *ops)
- {
- 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
- 		mtrr_ops[ops->vendor] = ops;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-05-15 13:21:14.043267946 -0400
-@@ -12,19 +12,19 @@
- extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
- 
- struct mtrr_ops {
--	u32	vendor;
--	u32	use_intel_if;
--	void	(*set)(unsigned int reg, unsigned long base,
-+	const u32	vendor;
-+	const u32	use_intel_if;
-+	void	(* const set)(unsigned int reg, unsigned long base,
- 		       unsigned long size, mtrr_type type);
--	void	(*set_all)(void);
-+	void	(* const set_all)(void);
- 
--	void	(*get)(unsigned int reg, unsigned long *base,
-+	void	(* const get)(unsigned int reg, unsigned long *base,
- 		       unsigned long *size, mtrr_type *type);
--	int	(*get_free_region)(unsigned long base, unsigned long size,
-+	int	(* const get_free_region)(unsigned long base, unsigned long size,
- 				   int replace_reg);
--	int	(*validate_add_page)(unsigned long base, unsigned long size,
-+	int	(* const validate_add_page)(unsigned long base, unsigned long size,
- 				     unsigned int type);
--	int	(*have_wrcomb)(void);
-+	int	(* const have_wrcomb)(void);
- };
- 
- extern int generic_get_free_region(unsigned long base, unsigned long size,
-@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
- extern int generic_validate_add_page(unsigned long base, unsigned long size,
- 				     unsigned int type);
- 
--extern struct mtrr_ops generic_mtrr_ops;
-+extern const struct mtrr_ops generic_mtrr_ops;
- 
- extern int positive_have_wrcomb(void);
- 
-@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
- 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
- void get_mtrr_state(void);
- 
--extern void set_mtrr_ops(struct mtrr_ops *ops);
-+extern void set_mtrr_ops(const struct mtrr_ops *ops);
- 
- extern u64 size_or_mask, size_and_mask;
--extern struct mtrr_ops *mtrr_if;
-+extern const struct mtrr_ops *mtrr_if;
- 
- #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
- #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-05-15 13:21:14.043267946 -0400
-@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
- 
- /* Interface defining a CPU specific perfctr watchdog */
- struct wd_ops {
--	int (*reserve)(void);
--	void (*unreserve)(void);
--	int (*setup)(unsigned nmi_hz);
--	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
--	void (*stop)(void);
-+	int (* const reserve)(void);
-+	void (* const unreserve)(void);
-+	int (* const setup)(unsigned nmi_hz);
-+	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-+	void (* const stop)(void);
- 	unsigned perfctr;
- 	unsigned evntsel;
- 	u64 checkbit;
-@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
- #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
- #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops;
- 
- static int setup_intel_arch_watchdog(unsigned nmi_hz)
-@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
- 	return 1;
- }
- 
-+/* cannot be const */
- static struct wd_ops intel_arch_wd_ops __read_mostly = {
- 	.reserve	= single_msr_reserve,
- 	.unreserve	= single_msr_unreserve,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/cpu/perf_event.c	2010-05-15 13:21:14.046723916 -0400
-@@ -2354,7 +2354,7 @@ perf_callchain_user(struct pt_regs *regs
- 			break;
- 
- 		callchain_store(entry, frame.return_address);
--		fp = frame.next_frame;
-+		fp = (__force const void __user *)frame.next_frame;
- 	}
- }
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/crash.c linux-2.6.32.13/arch/x86/kernel/crash.c
---- linux-2.6.32.13/arch/x86/kernel/crash.c	2010-04-29 17:49:37.537108997 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/crash.c	2010-05-15 13:21:14.046723916 -0400
-@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, 
- 	regs = args->regs;
- 
- #ifdef CONFIG_X86_32
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		crash_fixup_ss_esp(&fixed_regs, regs);
- 		regs = &fixed_regs;
- 	}
-diff -urNp linux-2.6.32.13/arch/x86/kernel/doublefault_32.c linux-2.6.32.13/arch/x86/kernel/doublefault_32.c
---- linux-2.6.32.13/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/doublefault_32.c	2010-05-15 13:21:14.046723916 -0400
-@@ -11,7 +11,7 @@
- 
- #define DOUBLEFAULT_STACKSIZE (1024)
- static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
--#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
-+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
- 
- #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
- 
-@@ -21,7 +21,7 @@ static void doublefault_fn(void)
- 	unsigned long gdt, tss;
- 
- 	store_gdt(&gdt_desc);
--	gdt = gdt_desc.address;
-+	gdt = (unsigned long)gdt_desc.address;
- 
- 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
- 
-@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
- 		/* 0x2 bit is always set */
- 		.flags		= X86_EFLAGS_SF | 0x2,
- 		.sp		= STACK_START,
--		.es		= __USER_DS,
-+		.es		= __KERNEL_DS,
- 		.cs		= __KERNEL_CS,
- 		.ss		= __KERNEL_DS,
--		.ds		= __USER_DS,
-+		.ds		= __KERNEL_DS,
- 		.fs		= __KERNEL_PERCPU,
- 
- 		.__cr3		= __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/dumpstack_32.c	2010-05-15 13:21:14.068544431 -0400
-@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
- 	 * When in-kernel, we also print out the stack and code at the
- 	 * time of the fault..
- 	 */
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned int code_prologue = code_bytes * 43 / 64;
- 		unsigned int code_len = code_bytes;
- 		unsigned char c;
- 		u8 *ip;
-+		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
- 
- 		printk(KERN_EMERG "Stack:\n");
- 		show_stack_log_lvl(NULL, regs, &regs->sp,
-@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
- 
- 		printk(KERN_EMERG "Code: ");
- 
--		ip = (u8 *)regs->ip - code_prologue;
-+		ip = (u8 *)regs->ip - code_prologue + cs_base;
- 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
- 			/* try starting at IP */
--			ip = (u8 *)regs->ip;
-+			ip = (u8 *)regs->ip + cs_base;
- 			code_len = code_len - code_prologue + 1;
- 		}
- 		for (i = 0; i < code_len; i++, ip++) {
-@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
- 				printk(" Bad EIP value.");
- 				break;
- 			}
--			if (ip == (u8 *)regs->ip)
-+			if (ip == (u8 *)regs->ip + cs_base)
- 				printk("<%02x> ", c);
- 			else
- 				printk("%02x ", c);
-@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
- {
- 	unsigned short ud2;
- 
-+	ip = ktla_ktva(ip);
- 	if (ip < PAGE_OFFSET)
- 		return 0;
- 	if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.32.13/arch/x86/kernel/dumpstack.c linux-2.6.32.13/arch/x86/kernel/dumpstack.c
---- linux-2.6.32.13/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/dumpstack.c	2010-05-15 13:21:14.068544431 -0400
-@@ -180,7 +180,7 @@ void dump_stack(void)
- #endif
- 
- 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version);
-@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
- 		panic("Fatal exception in interrupt");
- 	if (panic_on_oops)
- 		panic("Fatal exception");
--	do_exit(signr);
-+	do_group_exit(signr);
- }
- 
- int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
- 	unsigned long flags = oops_begin();
- 	int sig = SIGSEGV;
- 
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		report_bug(regs->ip, regs);
- 
- 	if (__die(str, regs, err))
-diff -urNp linux-2.6.32.13/arch/x86/kernel/e820.c linux-2.6.32.13/arch/x86/kernel/e820.c
---- linux-2.6.32.13/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/e820.c	2010-05-15 13:21:14.068544431 -0400
-@@ -733,7 +733,7 @@ struct early_res {
- };
- static struct early_res early_res[MAX_EARLY_RES] __initdata = {
- 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
--	{}
-+	{ 0, 0, {0}, 0 }
- };
- 
- static int __init find_overlapped_early(u64 start, u64 end)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/efi_32.c linux-2.6.32.13/arch/x86/kernel/efi_32.c
---- linux-2.6.32.13/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/efi_32.c	2010-05-15 13:21:14.068544431 -0400
-@@ -38,70 +38,38 @@
-  */
- 
- static unsigned long efi_rt_eflags;
--static pgd_t efi_bak_pg_dir_pointer[2];
-+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
- 
--void efi_call_phys_prelog(void)
-+void __init efi_call_phys_prelog(void)
- {
--	unsigned long cr4;
--	unsigned long temp;
- 	struct desc_ptr gdt_descr;
- 
- 	local_irq_save(efi_rt_eflags);
- 
--	/*
--	 * If I don't have PAE, I should just duplicate two entries in page
--	 * directory. If I have PAE, I just need to duplicate one entry in
--	 * page directory.
--	 */
--	cr4 = read_cr4_safe();
- 
--	if (cr4 & X86_CR4_PAE) {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		swapper_pg_dir[0].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--	} else {
--		efi_bak_pg_dir_pointer[0].pgd =
--		    swapper_pg_dir[pgd_index(0)].pgd;
--		efi_bak_pg_dir_pointer[1].pgd =
--		    swapper_pg_dir[pgd_index(0x400000)].pgd;
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
--		temp = PAGE_OFFSET + 0x400000;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    swapper_pg_dir[pgd_index(temp)].pgd;
--	}
-+	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
- 	 */
- 	__flush_tlb_all();
- 
--	gdt_descr.address = __pa(get_cpu_gdt_table(0));
-+	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- }
- 
--void efi_call_phys_epilog(void)
-+void __init efi_call_phys_epilog(void)
- {
--	unsigned long cr4;
- 	struct desc_ptr gdt_descr;
- 
--	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
-+	gdt_descr.address = get_cpu_gdt_table(0);
- 	gdt_descr.size = GDT_SIZE - 1;
- 	load_gdt(&gdt_descr);
- 
--	cr4 = read_cr4_safe();
--
--	if (cr4 & X86_CR4_PAE) {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--	} else {
--		swapper_pg_dir[pgd_index(0)].pgd =
--		    efi_bak_pg_dir_pointer[0].pgd;
--		swapper_pg_dir[pgd_index(0x400000)].pgd =
--		    efi_bak_pg_dir_pointer[1].pgd;
--	}
-+	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
- 
- 	/*
- 	 * After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S
---- linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/efi_stub_32.S	2010-05-15 13:21:14.068544431 -0400
-@@ -6,6 +6,7 @@
-  */
- 
- #include <linux/linkage.h>
-+#include <linux/init.h>
- #include <asm/page_types.h>
- 
- /*
-@@ -20,7 +21,7 @@
-  * service functions will comply with gcc calling convention, too.
-  */
- 
--.text
-+__INIT
- ENTRY(efi_call_phys)
- 	/*
- 	 * 0. The function can only be called in Linux kernel. So CS has been
-@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
- 	 * The mapping of lower virtual memory has been created in prelog and
- 	 * epilog.
- 	 */
--	movl	$1f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	jmp	*%edx
-+	jmp	1f-__PAGE_OFFSET
- 1:
- 
- 	/*
-@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
- 	 * parameter 2, ..., param n. To make things easy, we save the return
- 	 * address of efi_call_phys in a global variable.
- 	 */
--	popl	%edx
--	movl	%edx, saved_return_addr
--	/* get the function pointer into ECX*/
--	popl	%ecx
--	movl	%ecx, efi_rt_function_ptr
--	movl	$2f, %edx
--	subl	$__PAGE_OFFSET, %edx
--	pushl	%edx
-+	popl	(saved_return_addr)
-+	popl	(efi_rt_function_ptr)
- 
- 	/*
- 	 * 3. Clear PG bit in %CR0.
-@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
- 	/*
- 	 * 5. Call the physical function.
- 	 */
--	jmp	*%ecx
-+	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
- 
--2:
- 	/*
- 	 * 6. After EFI runtime service returns, control will return to
- 	 * following instruction. We'd better readjust stack pointer first.
-@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
- 	movl	%cr0, %edx
- 	orl	$0x80000000, %edx
- 	movl	%edx, %cr0
--	jmp	1f
--1:
-+
- 	/*
- 	 * 8. Now restore the virtual mode from flat mode by
- 	 * adding EIP with PAGE_OFFSET.
- 	 */
--	movl	$1f, %edx
--	jmp	*%edx
-+	jmp	1f+__PAGE_OFFSET
- 1:
- 
- 	/*
- 	 * 9. Balance the stack. And because EAX contain the return value,
- 	 * we'd better not clobber it.
- 	 */
--	leal	efi_rt_function_ptr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
-+	pushl	(efi_rt_function_ptr)
- 
- 	/*
--	 * 10. Push the saved return address onto the stack and return.
-+	 * 10. Return to the saved return address.
- 	 */
--	leal	saved_return_addr, %edx
--	movl	(%edx), %ecx
--	pushl	%ecx
--	ret
-+	jmpl	*(saved_return_addr)
- ENDPROC(efi_call_phys)
- .previous
- 
--.data
-+__INITDATA
- saved_return_addr:
- 	.long 0
- efi_rt_function_ptr:
-diff -urNp linux-2.6.32.13/arch/x86/kernel/entry_32.S linux-2.6.32.13/arch/x86/kernel/entry_32.S
---- linux-2.6.32.13/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/entry_32.S	2010-05-15 13:21:14.068544431 -0400
-@@ -191,7 +191,67 @@
- 
- #endif	/* CONFIG_X86_32_LAZY_GS */
- 
--.macro SAVE_ALL
-+.macro PAX_EXIT_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+#endif
-+	mov %cs, %esi
-+	cmp $__KERNEXEC_KERNEL_CS, %esi
-+	jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	btr $16, %esi
-+	ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+	mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro PAX_ENTER_KERNEL
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx;
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	bts $16, %esi
-+	jnc 1f
-+	mov %cs, %esi
-+	cmp $__KERNEL_CS, %esi
-+	jz 3f
-+	ljmp $__KERNEL_CS, $3f
-+1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
-+#else
-+	mov %esi, %cr0
-+#endif
-+3:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
-+#endif
-+#endif
-+.endm
-+
-+.macro __SAVE_ALL _DS
- 	cld
- 	PUSH_GS
- 	pushl %fs
-@@ -224,7 +284,7 @@
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
--	movl $(__USER_DS), %edx
-+	movl $\_DS, %edx
- 	movl %edx, %ds
- 	movl %edx, %es
- 	movl $(__KERNEL_PERCPU), %edx
-@@ -232,6 +292,15 @@
- 	SET_KERNEL_GS %edx
- .endm
- 
-+.macro SAVE_ALL
-+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
-+	__SAVE_ALL __KERNEL_DS
-+	PAX_ENTER_KERNEL
-+#else
-+	__SAVE_ALL __USER_DS
-+#endif
-+.endm
-+
- .macro RESTORE_INT_REGS
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
-@@ -352,7 +421,15 @@ check_userspace:
- 	movb PT_CS(%esp), %al
- 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
- 	cmpl $USER_RPL, %eax
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jae resume_userspace
-+
-+	PAX_EXIT_KERNEL
-+	jmp resume_kernel
-+#else
- 	jb resume_kernel		# not returning to v8086 or userspace
-+#endif
- 
- ENTRY(resume_userspace)
- 	LOCKDEP_SYS_EXIT
-@@ -414,10 +491,9 @@ sysenter_past_esp:
- 	/*CFI_REL_OFFSET cs, 0*/
- 	/*
- 	 * Push current_thread_info()->sysenter_return to the stack.
--	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
--	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
- 	 */
--	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
-+	GET_THREAD_INFO(%ebp)
-+	pushl TI_sysenter_return(%ebp)
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET eip, 0
- 
-@@ -430,9 +506,19 @@ sysenter_past_esp:
-  * Load the potential sixth argument from user stack.
-  * Careful about security.
-  */
-+	movl PT_OLDESP(%esp),%ebp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov PT_OLDSS(%esp),%ds
-+1:	movl %ds:(%ebp),%ebp
-+	push %ss
-+	pop %ds
-+#else
- 	cmpl $__PAGE_OFFSET-3,%ebp
- 	jae syscall_fault
- 1:	movl (%ebp),%ebp
-+#endif
-+
- 	movl %ebp,PT_EBP(%esp)
- .section __ex_table,"a"
- 	.align 4
-@@ -455,12 +541,23 @@ sysenter_do_call:
- 	testl $_TIF_ALLWORK_MASK, %ecx
- 	jne sysexit_audit
- sysenter_exit:
-+
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	pushl %eax
-+	CFI_ADJUST_CFA_OFFSET 4
-+	call pax_randomize_kstack
-+	popl %eax
-+	CFI_ADJUST_CFA_OFFSET -4
-+#endif
-+
- /* if something modifies registers it must also disable sysexit */
- 	movl PT_EIP(%esp), %edx
- 	movl PT_OLDESP(%esp), %ecx
- 	xorl %ebp,%ebp
- 	TRACE_IRQS_ON
- 1:	mov  PT_FS(%esp), %fs
-+2:	mov  PT_DS(%esp), %ds
-+3:	mov  PT_ES(%esp), %es
- 	PTGS_TO_GS
- 	ENABLE_INTERRUPTS_SYSEXIT
- 
-@@ -504,11 +601,17 @@ sysexit_audit:
- 
- 	CFI_ENDPROC
- .pushsection .fixup,"ax"
--2:	movl $0,PT_FS(%esp)
-+4:	movl $0,PT_FS(%esp)
-+	jmp 1b
-+5:	movl $0,PT_DS(%esp)
-+	jmp 1b
-+6:	movl $0,PT_ES(%esp)
- 	jmp 1b
- .section __ex_table,"a"
- 	.align 4
--	.long 1b,2b
-+	.long 1b,4b
-+	.long 2b,5b
-+	.long 3b,6b
- .popsection
- 	PTGS_TO_GS_EX
- ENDPROC(ia32_sysenter_target)
-@@ -538,6 +641,10 @@ syscall_exit:
- 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
- 	jne syscall_exit_work
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+	call pax_randomize_kstack
-+#endif
-+
- restore_all:
- 	TRACE_IRQS_IRET
- restore_all_notrace:
-@@ -602,7 +709,13 @@ ldt_ss:
- 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
- 	mov %dx, %ax			/* eax: new kernel esp */
- 	sub %eax, %edx			/* offset (low word is 0) */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	shr $16, %edx
- 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
- 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
-@@ -642,25 +755,19 @@ work_resched:
- 
- work_notifysig:				# deal with pending signals and
- 					# notify-resume requests
-+	movl %esp, %eax
- #ifdef CONFIG_VM86
- 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
--	movl %esp, %eax
--	jne work_notifysig_v86		# returning to kernel-space or
-+	jz 1f				# returning to kernel-space or
- 					# vm86-space
--	xorl %edx, %edx
--	call do_notify_resume
--	jmp resume_userspace_sig
- 
--	ALIGN
--work_notifysig_v86:
- 	pushl %ecx			# save ti_flags for do_notify_resume
- 	CFI_ADJUST_CFA_OFFSET 4
- 	call save_v86_state		# %eax contains pt_regs pointer
- 	popl %ecx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	movl %eax, %esp
--#else
--	movl %esp, %eax
-+1:
- #endif
- 	xorl %edx, %edx
- 	call do_notify_resume
-@@ -695,6 +802,10 @@ END(syscall_exit_work)
- 
- 	RING0_INT_FRAME			# can't unwind into user space anyway
- syscall_fault:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %ss
-+	pop %ds
-+#endif
- 	GET_THREAD_INFO(%ebp)
- 	movl $-EFAULT,PT_EAX(%esp)
- 	jmp resume_userspace
-@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
-  * normal stack and adjusts ESP with the matching offset.
-  */
- 	/* fixup the stack */
--	PER_CPU(gdt_page, %ebx)
-+#ifdef CONFIG_SMP
-+	movl PER_CPU_VAR(cpu_number), %ebx
-+	shll $PAGE_SHIFT_asm, %ebx
-+	addl $cpu_gdt_table, %ebx
-+#else
-+	movl $cpu_gdt_table, %ebx
-+#endif
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
- 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
- 	shl $16, %eax
-@@ -1198,7 +1315,6 @@ return_to_handler:
- 	ret
- #endif
- 
--.section .rodata,"a"
- #include "syscall_table_32.S"
- 
- syscall_table_size=(.-sys_call_table)
-@@ -1250,12 +1366,15 @@ error_code:
- 	movl %ecx, %fs
- 	UNWIND_ESPFIX_STACK
- 	GS_TO_REG %ecx
-+
-+	PAX_ENTER_KERNEL
-+
- 	movl PT_GS(%esp), %edi		# get the function address
- 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
- 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
- 	REG_TO_PTGS %ecx
- 	SET_KERNEL_GS %ecx
--	movl $(__USER_DS), %ecx
-+	movl $(__KERNEL_DS), %ecx
- 	movl %ecx, %ds
- 	movl %ecx, %es
- 	TRACE_IRQS_OFF
-@@ -1351,6 +1470,9 @@ nmi_stack_correct:
- 	xorl %edx,%edx		# zero error code
- 	movl %esp,%eax		# pt_regs pointer
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	jmp restore_all_notrace
- 	CFI_ENDPROC
- 
-@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
- 	FIXUP_ESPFIX_STACK		# %eax == %esp
- 	xorl %edx,%edx			# zero error code
- 	call do_nmi
-+
-+	PAX_EXIT_KERNEL
-+
- 	RESTORE_REGS
- 	lss 12+4(%esp), %esp		# back to espfix stack
- 	CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.32.13/arch/x86/kernel/entry_64.S linux-2.6.32.13/arch/x86/kernel/entry_64.S
---- linux-2.6.32.13/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/entry_64.S	2010-05-15 13:23:38.934774262 -0400
-@@ -53,6 +53,7 @@
- #include <asm/paravirt.h>
- #include <asm/ftrace.h>
- #include <asm/percpu.h>
-+#include <asm/pgtable.h>
- 
- /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
- #include <linux/elf-em.h>
-@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
- ENDPROC(native_usergs_sysret64)
- #endif /* CONFIG_PARAVIRT */
- 
-+	.macro ljmpq sel, off
-+#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
-+	.byte 0x48; ljmp *1234f(%rip)
-+	.pushsection .rodata
-+	.align 16
-+	1234: .quad \off; .word \sel
-+	.popsection
-+#else
-+	push $\sel
-+	push $\off
-+	lretq
-+#endif
-+	.endm
-+
-+ENTRY(pax_enter_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	jnc 1f
-+	mov %cs,%edi
-+	cmp $__KERNEL_CS,%edi
-+	jz 3f
-+	ljmpq __KERNEL_CS,3f
-+1:	ljmpq __KERNEXEC_KERNEL_CS,2f
-+2:	SET_RDI_INTO_CR0
-+3:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel)
-+
-+ENTRY(pax_exit_kernel)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	mov %cs,%rdi
-+	cmp $__KERNEXEC_KERNEL_CS,%edi
-+	jnz 2f
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	ljmpq __KERNEL_CS,1f
-+1:	SET_RDI_INTO_CR0
-+2:
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI);
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel)
-+
-+ENTRY(pax_enter_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+	push %rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	mov %rdi,%rbx
-+	add $__START_KERNEL_map,%rbx
-+	sub phys_base(%rip),%rbx
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rdi
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0,i*8(%rbx)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	pop %rdi
-+#endif
-+	SET_RDI_INTO_CR3
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	bts $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+#ifdef CONFIG_PARAVIRT
-+	PV_RESTORE_REGS(CLBR_RDI)
-+#endif
-+
-+	pop %rbx
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_enter_kernel_user)
-+
-+ENTRY(pax_exit_kernel_user)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	push %rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	push %rbx
-+	PV_SAVE_REGS(CLBR_RDI)
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	GET_CR0_INTO_RDI
-+	btr $16,%rdi
-+	SET_RDI_INTO_CR0
-+#endif
-+
-+	GET_CR3_INTO_RDI
-+	add $__START_KERNEL_map,%rdi
-+	sub phys_base(%rip),%rdi
-+
-+#ifdef CONFIG_PARAVIRT
-+	cmpl $0, pv_info+PARAVIRT_enabled
-+	jz 1f
-+	mov %rdi,%rbx
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	mov i*8(%rbx),%rsi
-+	mov $0x67,%sil
-+	lea i*8(%rbx),%rdi
-+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
-+	i = i + 1
-+	.endr
-+	jmp 2f
-+1:
-+#endif
-+
-+	i = 0
-+	.rept USER_PGD_PTRS
-+	movb $0x67,i*8(%rdi)
-+	i = i + 1
-+	.endr
-+
-+#ifdef CONFIG_PARAVIRT
-+2:	PV_RESTORE_REGS(CLBR_RDI)
-+	pop %rbx
-+#endif
-+
-+	pop %rdi
-+#endif
-+
-+	retq
-+ENDPROC(pax_exit_kernel_user)
- 
- .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
- #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -317,7 +501,7 @@ ENTRY(save_args)
- 	leaq -ARGOFFSET+16(%rsp),%rdi	/* arg1 for handler */
- 	movq_cfi rbp, 8		/* push %rbp */
- 	leaq 8(%rsp), %rbp		/* mov %rsp, %ebp */
--	testl $3, CS(%rdi)
-+	testb $3, CS(%rdi)
- 	je 1f
- 	SWAPGS
- 	/*
-@@ -409,7 +593,7 @@ ENTRY(ret_from_fork)
- 
- 	RESTORE_REST
- 
--	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
-+	testb $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
- 	je   int_ret_from_sys_call
- 
- 	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
- 
- 	movq	%rsp,PER_CPU_VAR(old_rsp)
- 	movq	PER_CPU_VAR(kernel_stack),%rsp
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_enter_kernel_user
-+#endif
-+
- 	/*
- 	 * No need to follow this irqs off/on section - it's straight
- 	 * and short:
-@@ -502,6 +691,11 @@ sysret_check:
- 	andl %edi,%edx
- 	jnz  sysret_careful
- 	CFI_REMEMBER_STATE
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	/*
- 	 * sysretq will re-enable interrupts:
- 	 */
-@@ -613,7 +807,7 @@ tracesys:
- GLOBAL(int_ret_from_sys_call)
- 	DISABLE_INTERRUPTS(CLBR_NONE)
- 	TRACE_IRQS_OFF
--	testl $3,CS-ARGOFFSET(%rsp)
-+	testb $3,CS-ARGOFFSET(%rsp)
- 	je retint_restore_args
- 	movl $_TIF_ALLWORK_MASK,%edi
- 	/* edi:	mask to check */
-@@ -800,6 +994,16 @@ END(interrupt)
- 	CFI_ADJUST_CFA_OFFSET 10*8
- 	call save_args
- 	PARTIAL_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rdi)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	call \func
- 	.endm
- 
-@@ -822,7 +1026,7 @@ ret_from_intr:
- 	CFI_ADJUST_CFA_OFFSET	-8
- exit_intr:
- 	GET_THREAD_INFO(%rcx)
--	testl $3,CS-ARGOFFSET(%rsp)
-+	testb $3,CS-ARGOFFSET(%rsp)
- 	je retint_kernel
- 
- 	/* Interrupt came from user space */
-@@ -844,12 +1048,18 @@ retint_swapgs:		/* return to user-space 
- 	 * The iretq could re-enable interrupts:
- 	 */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#endif
-+
- 	TRACE_IRQS_IRETQ
- 	SWAPGS
- 	jmp restore_args
- 
- retint_restore_args:	/* return to kernel space */
- 	DISABLE_INTERRUPTS(CLBR_ANY)
-+	call pax_exit_kernel
- 	/*
- 	 * The iretq could re-enable interrupts:
- 	 */
-@@ -1032,6 +1242,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
-@@ -1049,6 +1269,16 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
- 	call \do_sym
-@@ -1066,9 +1296,24 @@ ENTRY(\sym)
- 	subq $15*8, %rsp
- 	call save_paranoid
- 	TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	movq %rsp,%rdi		/* pt_regs pointer */
- 	xorl %esi,%esi		/* no error code */
--	PER_CPU(init_tss, %rbp)
-+#ifdef CONFIG_SMP
-+	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
-+	lea init_tss(%rbp), %rbp
-+#else
-+	lea init_tss(%rip), %rbp
-+#endif
- 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
- 	call \do_sym
- 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
-@@ -1085,6 +1330,16 @@ ENTRY(\sym)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call error_entry
- 	DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
-@@ -1104,6 +1359,16 @@ ENTRY(\sym)
- 	call save_paranoid
- 	DEFAULT_FRAME 0
- 	TRACE_IRQS_OFF
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	movq %rsp,%rdi			/* pt_regs pointer */
- 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
- 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
-@@ -1405,14 +1670,27 @@ ENTRY(paranoid_exit)
- 	TRACE_IRQS_OFF
- 	testl %ebx,%ebx				/* swapgs needed? */
- 	jnz paranoid_restore
--	testl $3,CS(%rsp)
-+	testb $3,CS(%rsp)
- 	jnz   paranoid_userspace
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel
-+	TRACE_IRQS_IRETQ 0
-+	SWAPGS_UNSAFE_STACK
-+	RESTORE_ALL 8
-+	jmp irq_return
-+#endif
- paranoid_swapgs:
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	call pax_exit_kernel_user
-+#else
-+	call pax_exit_kernel
-+#endif
- 	TRACE_IRQS_IRETQ 0
- 	SWAPGS_UNSAFE_STACK
- 	RESTORE_ALL 8
- 	jmp irq_return
- paranoid_restore:
-+	call pax_exit_kernel
- 	TRACE_IRQS_IRETQ 0
- 	RESTORE_ALL 8
- 	jmp irq_return
-@@ -1470,7 +1748,7 @@ ENTRY(error_entry)
- 	movq_cfi r14, R14+8
- 	movq_cfi r15, R15+8
- 	xorl %ebx,%ebx
--	testl $3,CS+8(%rsp)
-+	testb $3,CS+8(%rsp)
- 	je error_kernelspace
- error_swapgs:
- 	SWAPGS
-@@ -1529,6 +1807,16 @@ ENTRY(nmi)
- 	CFI_ADJUST_CFA_OFFSET 15*8
- 	call save_paranoid
- 	DEFAULT_FRAME 0
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	testb $3, CS(%rsp)
-+	jnz 1f
-+	call pax_enter_kernel
-+	jmp 2f
-+1:	call pax_enter_kernel_user
-+2:
-+#else
-+	call pax_enter_kernel
-+#endif
- 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
- 	movq %rsp,%rdi
- 	movq $-1,%rsi
-@@ -1539,11 +1827,12 @@ ENTRY(nmi)
- 	DISABLE_INTERRUPTS(CLBR_NONE)
- 	testl %ebx,%ebx				/* swapgs needed? */
- 	jnz nmi_restore
--	testl $3,CS(%rsp)
-+	testb $3,CS(%rsp)
- 	jnz nmi_userspace
- nmi_swapgs:
- 	SWAPGS_UNSAFE_STACK
- nmi_restore:
-+	call pax_exit_kernel
- 	RESTORE_ALL 8
- 	jmp irq_return
- nmi_userspace:
-diff -urNp linux-2.6.32.13/arch/x86/kernel/ftrace.c linux-2.6.32.13/arch/x86/kernel/ftrace.c
---- linux-2.6.32.13/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/ftrace.c	2010-05-15 13:21:14.070771689 -0400
-@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
- {
- 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
- 		smp_rmb();
-+		pax_open_kernel();
- 		ftrace_mod_code();
-+		pax_close_kernel();
- 		atomic_inc(&nmi_update_count);
- 	}
- 	/* Must have previous changes seen before executions */
-@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
- 
- 
- 
--static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
-+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
- 
- static unsigned char *ftrace_nop_replace(void)
- {
-@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
- {
- 	unsigned char replaced[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	/*
- 	 * Note: Due to modules and __init, code can
- 	 *  disappear and change, we need to protect against faulting
-@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
- 	unsigned char old[MCOUNT_INSN_SIZE], *new;
- 	int ret;
- 
--	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
-+	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
- 	new = ftrace_call_replace(ip, (unsigned long)func);
- 	ret = ftrace_modify_code(ip, old, new);
- 
-@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
- 	switch (faulted) {
- 	case 0:
- 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
--		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
- 		break;
- 	case 1:
- 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
--		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
- 		break;
- 	case 2:
- 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
--		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
-+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
- 		break;
- 	}
- 
-@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
- {
- 	unsigned char code[MCOUNT_INSN_SIZE];
- 
-+	ip = ktla_ktva(ip);
-+
- 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
- 		return -EFAULT;
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/head32.c linux-2.6.32.13/arch/x86/kernel/head32.c
---- linux-2.6.32.13/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/head32.c	2010-05-15 13:21:14.070771689 -0400
-@@ -16,6 +16,7 @@
- #include <asm/apic.h>
- #include <asm/io_apic.h>
- #include <asm/bios_ebda.h>
-+#include <asm/boot.h>
- 
- static void __init i386_default_early_setup(void)
- {
-@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
- {
- 	reserve_trampoline_memory();
- 
--	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
-+	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
- 
- #ifdef CONFIG_BLK_DEV_INITRD
- 	/* Reserve INITRD */
-diff -urNp linux-2.6.32.13/arch/x86/kernel/head_32.S linux-2.6.32.13/arch/x86/kernel/head_32.S
---- linux-2.6.32.13/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/head_32.S	2010-05-15 13:21:14.070771689 -0400
-@@ -19,10 +19,17 @@
- #include <asm/setup.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/msr-index.h>
- 
- /* Physical address */
- #define pa(X) ((X) - __PAGE_OFFSET)
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /*
-  * References to members of the new_cpu_data structure.
-  */
-@@ -52,11 +59,7 @@
-  * and small than max_low_pfn, otherwise will waste some page table entries
-  */
- 
--#if PTRS_PER_PMD > 1
--#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
--#else
--#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
--#endif
-+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
- 
- /* Enough space to fit pagetables for the low memory linear map */
- MAPPING_BEYOND_END = \
-@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
- RESERVE_BRK(pagetables, INIT_MAP_SIZE)
- 
- /*
-+ * Real beginning of normal "text" segment
-+ */
-+ENTRY(stext)
-+ENTRY(_stext)
-+
-+/*
-  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
-  * %esi points to the real-mode code as a 32-bit pointer.
-  * CS and DS must be 4 GB flat segments, but we don't depend on
-@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
-  * can.
-  */
- __HEAD
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	jmp startup_32
-+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
-+.fill PAGE_SIZE-5,1,0xcc
-+#endif
-+
- ENTRY(startup_32)
- 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
- 		us to not reload segments */
-@@ -97,6 +113,55 @@ ENTRY(startup_32)
- 	movl %eax,%gs
- 2:
- 
-+#ifdef CONFIG_SMP
-+	movl $pa(cpu_gdt_table),%edi
-+	movl $__per_cpu_load,%eax
-+	movw %ax,__KERNEL_PERCPU + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_PERCPU + 4(%edi)
-+	movb %ah,__KERNEL_PERCPU + 7(%edi)
-+	movl $__per_cpu_end - 1,%eax
-+	subl $__per_cpu_start,%eax
-+	movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+1:
-+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	movl $pa(boot_gdt),%edi
-+	movl $__LOAD_PHYSICAL_ADDR,%eax
-+	movw %ax,__BOOT_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__BOOT_CS + 4(%edi)
-+	movb %ah,__BOOT_CS + 7(%edi)
-+	rorl $16,%eax
-+
-+	ljmp $(__BOOT_CS),$1f
-+1:
-+
-+	movl $NR_CPUS,%ecx
-+	movl $pa(cpu_gdt_table),%edi
-+	addl $__PAGE_OFFSET,%eax
-+1:
-+	movw %ax,__KERNEL_CS + 2(%edi)
-+	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_CS + 4(%edi)
-+	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
-+	movb %ah,__KERNEL_CS + 7(%edi)
-+	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
-+	rorl $16,%eax
-+	addl $PAGE_SIZE_asm,%edi
-+	loop 1b
-+#endif
-+
- /*
-  * Clear BSS first so that there are no surprises...
-  */
-@@ -140,9 +205,7 @@ ENTRY(startup_32)
- 	cmpl $num_subarch_entries, %eax
- 	jae bad_subarch
- 
--	movl pa(subarch_entries)(,%eax,4), %eax
--	subl $__PAGE_OFFSET, %eax
--	jmp *%eax
-+	jmp *pa(subarch_entries)(,%eax,4)
- 
- bad_subarch:
- WEAK(lguest_entry)
-@@ -154,10 +217,10 @@ WEAK(xen_entry)
- 	__INITDATA
- 
- subarch_entries:
--	.long default_entry		/* normal x86/PC */
--	.long lguest_entry		/* lguest hypervisor */
--	.long xen_entry			/* Xen hypervisor */
--	.long default_entry		/* Moorestown MID */
-+	.long ta(default_entry)		/* normal x86/PC */
-+	.long ta(lguest_entry)		/* lguest hypervisor */
-+	.long ta(xen_entry)		/* Xen hypervisor */
-+	.long ta(default_entry)		/* Moorestown MID */
- num_subarch_entries = (. - subarch_entries) / 4
- .previous
- #endif /* CONFIG_PARAVIRT */
-@@ -218,8 +281,11 @@ default_entry:
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
-+#endif
- #else	/* Not PAE */
- 
- page_pde_offset = (__PAGE_OFFSET >> 20);
-@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
- 	movl %eax, pa(max_pfn_mapped)
- 
- 	/* Do early initialization of the fixmap area */
--	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
--	movl %eax,pa(swapper_pg_dir+0xffc)
-+#ifdef CONFIG_COMPAT_VDSO
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
-+#else
-+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
-+#endif
- #endif
- 	jmp 3f
- /*
-@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
- 	orl %edx,%eax
- 	movl %eax,%cr4
- 
-+#ifdef CONFIG_X86_PAE
- 	btl $5, %eax		# check if PAE is enabled
- 	jnc 6f
- 
-@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
- 	jnc 6f
- 
- 	/* Setup EFER (Extended Feature Enable Register) */
--	movl $0xc0000080, %ecx
-+	movl $MSR_EFER, %ecx
- 	rdmsr
- 
- 	btsl $11, %eax
- 	/* Make changes effective */
- 	wrmsr
- 
-+	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
-+	movl $1,pa(nx_enabled)
-+#endif
-+
- 6:
- 
- /*
-@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
- 
- #ifdef CONFIG_SMP
- 	cmpb $0, ready
--	jz  1f				/* Initial CPU cleans BSS */
--	jmp checkCPUtype
--1:
-+	jnz checkCPUtype		/* Initial CPU cleans BSS */
- #endif /* CONFIG_SMP */
- 
- /*
-@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
- 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
- 	movl %eax,%ss			# after changing gdt.
- 
--	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
-+#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
- 	movl %eax,%ds
- 	movl %eax,%es
- 
-@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
- 	 */
- 	cmpb $0,ready
- 	jne 1f
--	movl $per_cpu__gdt_page,%eax
-+	movl $cpu_gdt_table,%eax
- 	movl $per_cpu__stack_canary,%ecx
-+#ifdef CONFIG_SMP
-+	addl $__per_cpu_load,%ecx
-+#endif
- 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
- 	shrl $16, %ecx
- 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
-@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
- #ifdef CONFIG_SMP
- 	movb ready, %cl
- 	movb $1, ready
--	cmpb $0,%cl		# the first CPU calls start_kernel
--	je   1f
--	movl (stack_start), %esp
--1:
- #endif /* CONFIG_SMP */
- 	jmp *(initial_code)
- 
-@@ -546,22 +617,22 @@ early_page_fault:
- 	jmp early_fault
- 
- early_fault:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $1,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pusha
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	movl %cr2,%eax
- 	pushl %eax
- 	pushl %edx		/* trapno */
- 	pushl $fault_msg
- 	call printk
-+;	call dump_stack
- #endif
--	call dump_stack
- hlt_loop:
- 	hlt
- 	jmp hlt_loop
-@@ -569,8 +640,11 @@ hlt_loop:
- /* This is the default interrupt "handler" :-) */
- 	ALIGN
- ignore_int:
--	cld
- #ifdef CONFIG_PRINTK
-+	cmpl $2,%ss:early_recursion_flag
-+	je hlt_loop
-+	incl %ss:early_recursion_flag
-+	cld
- 	pushl %eax
- 	pushl %ecx
- 	pushl %edx
-@@ -579,9 +653,6 @@ ignore_int:
- 	movl $(__KERNEL_DS),%eax
- 	movl %eax,%ds
- 	movl %eax,%es
--	cmpl $2,early_recursion_flag
--	je hlt_loop
--	incl early_recursion_flag
- 	pushl 16(%esp)
- 	pushl 24(%esp)
- 	pushl 32(%esp)
-@@ -608,27 +679,45 @@ ENTRY(initial_code)
- /*
-  * BSS section
-  */
--__PAGE_ALIGNED_BSS
--	.align PAGE_SIZE_asm
- #ifdef CONFIG_X86_PAE
-+.section .swapper_pg_pmd,"a",@progbits
- swapper_pg_pmd:
- 	.fill 1024*KPMDS,4,0
- #else
-+.section .swapper_pg_dir,"a",@progbits
- ENTRY(swapper_pg_dir)
- 	.fill 1024,4,0
- #endif
-+
- swapper_pg_fixmap:
- 	.fill 1024,4,0
-+
-+.section .empty_zero_page,"a",@progbits
- ENTRY(empty_zero_page)
- 	.fill 4096,1,0
- 
- /*
-+ * The IDT has to be page-aligned to simplify the Pentium
-+ * F0 0F bug workaround.. We have a special link segment
-+ * for this.
-+ */
-+.section .idt,"a",@progbits
-+ENTRY(idt_table)
-+	.fill 256,8,0
-+
-+/*
-  * This starts the data section.
-  */
- #ifdef CONFIG_X86_PAE
--__PAGE_ALIGNED_DATA
--	/* Page-aligned for the benefit of paravirt? */
--	.align PAGE_SIZE_asm
-+.section .swapper_pg_dir,"a",@progbits
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+ENTRY(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- ENTRY(swapper_pg_dir)
- 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
- # if KPMDS == 3
-@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
- 
- .data
- ENTRY(stack_start)
--	.long init_thread_union+THREAD_SIZE
-+	.long init_thread_union+THREAD_SIZE-8
- 	.long __BOOT_DS
- 
- ready:	.byte 0
- 
-+.section .rodata,"a",@progbits
- early_recursion_flag:
- 	.long 0
- 
-@@ -691,7 +781,7 @@ fault_msg:
- 	.word 0				# 32 bit align gdt_desc.address
- boot_gdt_descr:
- 	.word __BOOT_DS+7
--	.long boot_gdt - __PAGE_OFFSET
-+	.long pa(boot_gdt)
- 
- 	.word 0				# 32-bit align idt_desc.address
- idt_descr:
-@@ -702,7 +792,7 @@ idt_descr:
- 	.word 0				# 32 bit align gdt_desc.address
- ENTRY(early_gdt_descr)
- 	.word GDT_ENTRIES*8-1
--	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
-+	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
- 
- /*
-  * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
- 	.align L1_CACHE_BYTES
- ENTRY(boot_gdt)
- 	.fill GDT_ENTRY_BOOT_CS,8,0
--	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
--	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
-+	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
-+
-+	.align PAGE_SIZE_asm
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad 0x0000000000000000	/* NULL descriptor */
-+	.quad 0x0000000000000000	/* 0x0b reserved */
-+	.quad 0x0000000000000000	/* 0x13 reserved */
-+	.quad 0x0000000000000000	/* 0x1b reserved */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
-+#else
-+	.quad 0x0000000000000000	/* 0x20 unused */
-+#endif
-+
-+	.quad 0x0000000000000000	/* 0x28 unused */
-+	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
-+	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
-+	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
-+	.quad 0x0000000000000000	/* 0x4b reserved */
-+	.quad 0x0000000000000000	/* 0x53 reserved */
-+	.quad 0x0000000000000000	/* 0x5b reserved */
-+
-+	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
-+	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
-+	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
-+	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
-+
-+	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
-+	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
-+
-+	/*
-+	 * Segments used for calling PnP BIOS have byte granularity.
-+	 * The code segments and data segments have fixed 64k limits,
-+	 * the transfer segment sizes are set at run time.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
-+	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
-+	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
-+	.quad 0x0000930000000000	/* 0xa8 16-bit data */
-+	.quad 0x0000930000000000	/* 0xb0 16-bit data */
-+
-+	/*
-+	 * The APM segments have byte granularity and their bases
-+	 * are set at run time.  All have 64k limits.
-+	 */
-+	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
-+	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
-+	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
-+
-+	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
-+	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
-+	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
-+	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
-+	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
-+	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
-+
-+	/* Be sure this is zeroed to avoid false validations in Xen */
-+	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
-+	.endr
-diff -urNp linux-2.6.32.13/arch/x86/kernel/head64.c linux-2.6.32.13/arch/x86/kernel/head64.c
---- linux-2.6.32.13/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/head64.c	2010-05-15 13:21:14.070771689 -0400
-@@ -29,7 +29,13 @@
- static void __init zap_identity_mappings(void)
- {
- 	pgd_t *pgd = pgd_offset_k(0UL);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	set_pgd(pgd, native_make_pgd(0));
-+#else
- 	pgd_clear(pgd);
-+#endif
-+
- 	__flush_tlb_all();
- }
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/head_64.S linux-2.6.32.13/arch/x86/kernel/head_64.S
---- linux-2.6.32.13/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/head_64.S	2010-05-15 13:21:14.070771689 -0400
-@@ -19,6 +19,7 @@
- #include <asm/cache.h>
- #include <asm/processor-flags.h>
- #include <asm/percpu.h>
-+#include <asm/cpufeature.h>
- 
- #ifdef CONFIG_PARAVIRT
- #include <asm/asm-offsets.h>
-@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
- L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
- L4_START_KERNEL = pgd_index(__START_KERNEL_map)
- L3_START_KERNEL = pud_index(__START_KERNEL_map)
-+L4_VMALLOC_START = pgd_index(VMALLOC_START)
-+L3_VMALLOC_START = pud_index(VMALLOC_START)
-+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
-+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
- 
- 	.text
- 	__HEAD
-@@ -85,35 +90,22 @@ startup_64:
- 	 */
- 	addq	%rbp, init_level4_pgt + 0(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
-+	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
- 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
- 
- 	addq	%rbp, level3_ident_pgt + 0(%rip)
-+#ifndef CONFIG_XEN
-+	addq	%rbp, level3_ident_pgt + 8(%rip)
-+#endif
- 
--	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
--	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
-+	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
- 
--	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
-+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
- 
--	/* Add an Identity mapping if I am above 1G */
--	leaq	_text(%rip), %rdi
--	andq	$PMD_PAGE_MASK, %rdi
--
--	movq	%rdi, %rax
--	shrq	$PUD_SHIFT, %rax
--	andq	$(PTRS_PER_PUD - 1), %rax
--	jz	ident_complete
--
--	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
--	leaq	level3_ident_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--
--	movq	%rdi, %rax
--	shrq	$PMD_SHIFT, %rax
--	andq	$(PTRS_PER_PMD - 1), %rax
--	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
--	leaq	level2_spare_pgt(%rip), %rbx
--	movq	%rdx, 0(%rbx, %rax, 8)
--ident_complete:
-+	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
-+	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
- 
- 	/*
- 	 * Fixup the kernel text+data virtual addresses. Note that
-@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
- 	 * after the boot processor executes this code.
- 	 */
- 
--	/* Enable PAE mode and PGE */
--	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
-+	/* Enable PAE mode and PSE/PGE */
-+	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
- 	movq	%rax, %cr4
- 
- 	/* Setup early boot stage 4 level pagetables. */
-@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
- 	movl	$MSR_EFER, %ecx
- 	rdmsr
- 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
--	btl	$20,%edi		/* No Execute supported? */
-+	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
- 	jnc     1f
- 	btsl	$_EFER_NX, %eax
-+	leaq	init_level4_pgt(%rip), %rdi
-+	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
-+	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
- 1:	wrmsr				/* Make changes effective */
- 
- 	/* Setup cr0 */
-@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
- 	.quad	x86_64_start_kernel
- 	ENTRY(initial_gs)
- 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
--	__FINITDATA
- 
- 	ENTRY(stack_start)
- 	.quad  init_thread_union+THREAD_SIZE-8
- 	.word  0
-+	__FINITDATA
- 
- bad_address:
- 	jmp bad_address
- 
--	.section ".init.text","ax"
-+	__INIT
- #ifdef CONFIG_EARLY_PRINTK
- 	.globl early_idt_handlers
- early_idt_handlers:
-@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
- #endif /* EARLY_PRINTK */
- 1:	hlt
- 	jmp 1b
-+	.previous
- 
- #ifdef CONFIG_EARLY_PRINTK
-+	__INITDATA
- early_recursion_flag:
- 	.long 0
-+	.previous
- 
-+	.section .rodata,"a",@progbits
- early_idt_msg:
- 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
- early_idt_ripmsg:
- 	.asciz "RIP %s\n"
--#endif /* CONFIG_EARLY_PRINTK */
- 	.previous
-+#endif /* CONFIG_EARLY_PRINTK */
- 
-+	.section .rodata,"a",@progbits
- #define NEXT_PAGE(name) \
- 	.balign	PAGE_SIZE; \
- ENTRY(name)
-@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
- 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
-+	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
-+	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
- 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
- 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+NEXT_PAGE(cpu_pgd)
-+	.rept NR_CPUS
-+	.fill	512,8,0
-+	.endr
-+#endif
-+
- NEXT_PAGE(level3_ident_pgt)
- 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
-+#ifdef CONFIG_XEN
- 	.fill	511,8,0
-+#else
-+	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
-+	.fill	510,8,0
-+#endif
-+
-+NEXT_PAGE(level3_vmalloc_pgt)
-+	.fill	512,8,0
-+
-+NEXT_PAGE(level3_vmemmap_pgt)
-+	.fill	L3_VMEMMAP_START,8,0
-+	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 
- NEXT_PAGE(level3_kernel_pgt)
- 	.fill	L3_START_KERNEL,8,0
-@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
- 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
- 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
- 
-+NEXT_PAGE(level2_vmemmap_pgt)
-+	.fill	512,8,0
-+
- NEXT_PAGE(level2_fixmap_pgt)
--	.fill	506,8,0
--	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
--	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
--	.fill	5,8,0
-+	.fill	507,8,0
-+	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
-+	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
-+	.fill	4,8,0
- 
--NEXT_PAGE(level1_fixmap_pgt)
-+NEXT_PAGE(level1_vsyscall_pgt)
- 	.fill	512,8,0
- 
--NEXT_PAGE(level2_ident_pgt)
--	/* Since I easily can, map the first 1G.
-+	/* Since I easily can, map the first 2G.
- 	 * Don't set NX because code runs from these pages.
- 	 */
--	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
-+NEXT_PAGE(level2_ident_pgt)
-+	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
- 
- NEXT_PAGE(level2_kernel_pgt)
- 	/*
-@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
- 	 *  If you want to increase this then increase MODULES_VADDR
- 	 *  too.)
- 	 */
--	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
--		KERNEL_IMAGE_SIZE/PMD_SIZE)
--
--NEXT_PAGE(level2_spare_pgt)
--	.fill   512, 8, 0
-+	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
- 
- #undef PMDS
- #undef NEXT_PAGE
- 
--	.data
-+	.align PAGE_SIZE
-+ENTRY(cpu_gdt_table)
-+	.rept NR_CPUS
-+	.quad	0x0000000000000000	/* NULL descriptor */
-+	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
-+	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
-+	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
-+	.quad	0x00cffb000000ffff	/* __USER32_CS */
-+	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
-+	.quad	0x00affb000000ffff	/* __USER_CS */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
-+#else
-+	.quad	0x0			/* unused */
-+#endif
-+
-+	.quad	0,0			/* TSS */
-+	.quad	0,0			/* LDT */
-+	.quad	0,0,0			/* three TLS descriptors */
-+	.quad	0x0000f40000000000	/* node/CPU stored in limit */
-+	/* asm/segment.h:GDT_ENTRIES must match this */
-+
-+	/* zero the remaining page */
-+	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
-+	.endr
-+
- 	.align 16
- 	.globl early_gdt_descr
- early_gdt_descr:
- 	.word	GDT_ENTRIES*8-1
- early_gdt_descr_base:
--	.quad	INIT_PER_CPU_VAR(gdt_page)
-+	.quad	cpu_gdt_table
- 
- ENTRY(phys_base)
- 	/* This must match the first entry in level2_kernel_pgt */
- 	.quad   0x0000000000000000
- 
- #include "../../x86/xen/xen-head.S"
--	
--	.section .bss, "aw", @nobits
-+
-+	.section .rodata,"a",@progbits
- 	.align L1_CACHE_BYTES
- ENTRY(idt_table)
--	.skip IDT_ENTRIES * 16
-+	.fill 512,8,0
- 
- 	__PAGE_ALIGNED_BSS
- 	.align PAGE_SIZE
-diff -urNp linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/i386_ksyms_32.c	2010-05-15 13:21:14.070771689 -0400
-@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
- EXPORT_SYMBOL(cmpxchg8b_emu);
- #endif
- 
-+EXPORT_SYMBOL_GPL(cpu_gdt_table);
-+
- /* Networking helper routines. */
- EXPORT_SYMBOL(csum_partial_copy_generic);
-+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
-+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
- 
- EXPORT_SYMBOL(__get_user_1);
- EXPORT_SYMBOL(__get_user_2);
-@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
- 
- EXPORT_SYMBOL(csum_partial);
- EXPORT_SYMBOL(empty_zero_page);
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
-+#endif
-diff -urNp linux-2.6.32.13/arch/x86/kernel/init_task.c linux-2.6.32.13/arch/x86/kernel/init_task.c
---- linux-2.6.32.13/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/init_task.c	2010-05-15 13:21:14.070771689 -0400
-@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
-  * section. Since TSS's are completely CPU-local, we want them
-  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
-  */
--DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
--
-+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
-+EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/ioport.c linux-2.6.32.13/arch/x86/kernel/ioport.c
---- linux-2.6.32.13/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/ioport.c	2010-05-15 13:21:14.070771689 -0400
-@@ -6,6 +6,7 @@
- #include <linux/sched.h>
- #include <linux/kernel.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/ioport.h>
-@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
- 
- 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
- 		return -EINVAL;
-+#ifdef CONFIG_GRKERNSEC_IO
-+	if (turn_on) {
-+		gr_handle_ioperm();
-+		return -EPERM;
-+	}
-+#endif
- 	if (turn_on && !capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 
-@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
- 	 * because the ->io_bitmap_max value must match the bitmap
- 	 * contents:
- 	 */
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 
- 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
- 
-@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
- 		return -EINVAL;
- 	/* Trying to gain more privileges? */
- 	if (level > old) {
-+#ifdef CONFIG_GRKERNSEC_IO
-+		gr_handle_iopl();
-+		return -EPERM;
-+#else
- 		if (!capable(CAP_SYS_RAWIO))
- 			return -EPERM;
-+#endif
- 	}
- 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/irq_32.c linux-2.6.32.13/arch/x86/kernel/irq_32.c
---- linux-2.6.32.13/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/irq_32.c	2010-05-15 13:21:14.070771689 -0400
-@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
- 		return 0;
- 
- 	/* build the stack frame on the IRQ stack */
--	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 	irqctx->tinfo.task = curctx->tinfo.task;
- 	irqctx->tinfo.previous_esp = current_stack_pointer;
- 
-@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
- 		irqctx->tinfo.previous_esp = current_stack_pointer;
- 
- 		/* build the stack frame on the softirq stack */
--		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-+		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 
- 		call_on_stack(__do_softirq, isp);
- 		/*
-diff -urNp linux-2.6.32.13/arch/x86/kernel/kgdb.c linux-2.6.32.13/arch/x86/kernel/kgdb.c
---- linux-2.6.32.13/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/kgdb.c	2010-05-15 13:21:14.070771689 -0400
-@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
- 	return instruction_pointer(regs);
- }
- 
--struct kgdb_arch arch_kgdb_ops = {
-+const struct kgdb_arch arch_kgdb_ops = {
- 	/* Breakpoint instruction: */
- 	.gdb_bpt_instr		= { 0xcc },
- 	.flags			= KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/kprobes.c linux-2.6.32.13/arch/x86/kernel/kprobes.c
---- linux-2.6.32.13/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/kprobes.c	2010-05-15 13:23:38.934774262 -0400
-@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
- 		char op;
- 		s32 raddr;
- 	} __attribute__((packed)) * jop;
--	jop = (struct __arch_jmp_op *)from;
-+
-+	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
-+
-+	pax_open_kernel();
- 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
- 	jop->op = RELATIVEJUMP_INSTRUCTION;
-+	pax_close_kernel();
- }
- 
- /*
-@@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct 
- 			disp = (u8 *) p->addr + *((s32 *) insn) -
- 			       (u8 *) p->ainsn.insn;
- 			BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
-+			pax_open_kernel();
- 			*(s32 *)insn = (s32) disp;
-+			pax_close_kernel();
- 		}
- 	}
- #endif
-@@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct 
- 
- static void __kprobes arch_copy_kprobe(struct kprobe *p)
- {
--	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_open_kernel();
-+	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-+	pax_close_kernel();
- 
- 	fix_riprel(p);
- 
--	if (can_boost(p->addr))
-+	if (can_boost(ktla_ktva(p->addr)))
- 		p->ainsn.boostable = 0;
- 	else
- 		p->ainsn.boostable = -1;
- 
--	p->opcode = *p->addr;
-+	p->opcode = *(ktla_ktva(p->addr));
- }
- 
- int __kprobes arch_prepare_kprobe(struct kprobe *p)
-@@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
- 	if (p->opcode == BREAKPOINT_INSTRUCTION)
- 		regs->ip = (unsigned long)p->addr;
- 	else
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- }
- 
- void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
-@@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
- 	if (p->ainsn.boostable == 1 && !p->post_handler) {
- 		/* Boost up -- we can execute copied instructions directly */
- 		reset_current_kprobe();
--		regs->ip = (unsigned long)p->ainsn.insn;
-+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 		preempt_enable_no_resched();
- 		return;
- 	}
-@@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
- 	struct kprobe_ctlblk *kcb;
- 
- 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
--	if (*addr != BREAKPOINT_INSTRUCTION) {
-+	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
- 		/*
- 		 * The breakpoint instruction was removed right
- 		 * after we hit it.  Another cpu has removed
-@@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
- 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
- {
- 	unsigned long *tos = stack_addr(regs);
--	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
-+	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
- 	unsigned long orig_ip = (unsigned long)p->addr;
- 	kprobe_opcode_t *insn = p->ainsn.insn;
- 
-@@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
- 	struct die_args *args = data;
- 	int ret = NOTIFY_DONE;
- 
--	if (args->regs && user_mode_vm(args->regs))
-+	if (args->regs && user_mode(args->regs))
- 		return ret;
- 
- 	switch (val) {
-diff -urNp linux-2.6.32.13/arch/x86/kernel/ldt.c linux-2.6.32.13/arch/x86/kernel/ldt.c
---- linux-2.6.32.13/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/ldt.c	2010-05-15 13:21:14.074681352 -0400
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
- 	if (reload) {
- #ifdef CONFIG_SMP
- 		preempt_disable();
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- 		if (!cpumask_equal(mm_cpumask(current->mm),
- 				   cpumask_of(smp_processor_id())))
- 			smp_call_function(flush_ldt, current->mm, 1);
- 		preempt_enable();
- #else
--		load_LDT(pc);
-+		load_LDT_nolock(pc);
- #endif
- 	}
- 	if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
- 		return err;
- 
- 	for (i = 0; i < old->size; i++)
--		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
-+		write_ldt_entry(new->ldt, i, old->ldt + i);
- 	return 0;
- }
- 
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
- 		retval = copy_ldt(&mm->context, &old_mm->context);
- 		mutex_unlock(&old_mm->context.lock);
- 	}
-+
-+	if (tsk == current) {
-+		mm->context.vdso = ~0UL;
-+
-+#ifdef CONFIG_X86_32
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		mm->context.user_cs_base = 0UL;
-+		mm->context.user_cs_limit = ~0UL;
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+#endif
-+
-+#endif
-+#endif
-+
-+	}
-+
- 	return retval;
- }
- 
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
-+		error = -EINVAL;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	fill_ldt(&ldt, &ldt_info);
- 	if (oldmode)
- 		ldt.avl = 0;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/machine_kexec_32.c	2010-05-15 13:21:14.082777933 -0400
-@@ -26,7 +26,7 @@
- #include <asm/system.h>
- #include <asm/cacheflush.h>
- 
--static void set_idt(void *newidt, __u16 limit)
-+static void set_idt(struct desc_struct *newidt, __u16 limit)
- {
- 	struct desc_ptr curidt;
- 
-@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
- }
- 
- 
--static void set_gdt(void *newgdt, __u16 limit)
-+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
- {
- 	struct desc_ptr curgdt;
- 
-@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
- 	}
- 
- 	control_page = page_address(image->control_code_page);
--	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
-+	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
- 
- 	relocate_kernel_ptr = control_page;
- 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c
---- linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/machine_kexec_64.c	2010-05-15 13:21:14.082777933 -0400
-@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
- 	}
- 	/* clear the unused entries */
- 	while (addr < end_addr) {
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		set_pgd(level4p++, native_make_pgd(0));
-+#else
- 		pgd_clear(level4p++);
-+#endif
-+
- 		addr += PGDIR_SIZE;
- 	}
- out:
-diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_amd.c linux-2.6.32.13/arch/x86/kernel/microcode_amd.c
---- linux-2.6.32.13/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/microcode_amd.c	2010-05-15 13:21:14.082777933 -0400
-@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_amd_ops = {
-+static const struct microcode_ops microcode_amd_ops = {
- 	.request_microcode_user           = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info_amd,
-@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
- 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
- };
- 
--struct microcode_ops * __init init_amd_microcode(void)
-+const struct microcode_ops * __init init_amd_microcode(void)
- {
- 	return &microcode_amd_ops;
- }
-diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_core.c linux-2.6.32.13/arch/x86/kernel/microcode_core.c
---- linux-2.6.32.13/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/microcode_core.c	2010-05-15 13:21:14.082777933 -0400
-@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
- 
- #define MICROCODE_VERSION	"2.00"
- 
--static struct microcode_ops	*microcode_ops;
-+static const struct microcode_ops	*microcode_ops;
- 
- /*
-  * Synchronization.
-diff -urNp linux-2.6.32.13/arch/x86/kernel/microcode_intel.c linux-2.6.32.13/arch/x86/kernel/microcode_intel.c
---- linux-2.6.32.13/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/microcode_intel.c	2010-05-15 13:21:14.082777933 -0400
-@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
- 
- static int get_ucode_user(void *to, const void *from, size_t n)
- {
--	return copy_from_user(to, from, n);
-+	return copy_from_user(to, (__force const void __user *)from, n);
- }
- 
- static enum ucode_state
- request_microcode_user(int cpu, const void __user *buf, size_t size)
- {
--	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
-+	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
- }
- 
- static void microcode_fini_cpu(int cpu)
-@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
- 	uci->mc = NULL;
- }
- 
--static struct microcode_ops microcode_intel_ops = {
-+static const struct microcode_ops microcode_intel_ops = {
- 	.request_microcode_user		  = request_microcode_user,
- 	.request_microcode_fw             = request_microcode_fw,
- 	.collect_cpu_info                 = collect_cpu_info,
-@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
- 	.microcode_fini_cpu               = microcode_fini_cpu,
- };
- 
--struct microcode_ops * __init init_intel_microcode(void)
-+const struct microcode_ops * __init init_intel_microcode(void)
- {
- 	return &microcode_intel_ops;
- }
-diff -urNp linux-2.6.32.13/arch/x86/kernel/module.c linux-2.6.32.13/arch/x86/kernel/module.c
---- linux-2.6.32.13/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/module.c	2010-05-15 13:21:14.082777933 -0400
-@@ -34,7 +34,7 @@
- #define DEBUGP(fmt...)
- #endif
- 
--void *module_alloc(unsigned long size)
-+static void *__module_alloc(unsigned long size, pgprot_t prot)
- {
- 	struct vm_struct *area;
- 
-@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
- 	if (!area)
- 		return NULL;
- 
--	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
--					PAGE_KERNEL_EXEC);
-+	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
-+}
-+
-+void *module_alloc(unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	return __module_alloc(size, PAGE_KERNEL);
-+#else
-+	return __module_alloc(size, PAGE_KERNEL_EXEC);
-+#endif
-+
- }
- 
- /* Free memory returned from module_alloc */
-@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
- 	vfree(module_region);
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_X86_32
-+void *module_alloc_exec(unsigned long size)
-+{
-+	struct vm_struct *area;
-+
-+	if (size == 0)
-+		return NULL;
-+
-+	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
-+	return area ? area->addr : NULL;
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	vunmap(module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+#else
-+void module_free_exec(struct module *mod, void *module_region)
-+{
-+	module_free(mod, module_region);
-+}
-+EXPORT_SYMBOL(module_free_exec);
-+
-+void *module_alloc_exec(unsigned long size)
-+{
-+	return __module_alloc(size, PAGE_KERNEL_RX);
-+}
-+EXPORT_SYMBOL(module_alloc_exec);
-+#endif
-+#endif
-+
- /* We don't need anything special. */
- int module_frob_arch_sections(Elf_Ehdr *hdr,
- 			      Elf_Shdr *sechdrs,
-@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 	unsigned int i;
- 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
- 	Elf32_Sym *sym;
--	uint32_t *location;
-+	uint32_t *plocation, location;
- 
- 	DEBUGP("Applying relocate section %u to %u\n", relsec,
- 	       sechdrs[relsec].sh_info);
- 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
- 		/* This is where to make the change */
--		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
--			+ rel[i].r_offset;
-+		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
-+		location = (uint32_t)plocation;
-+		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
-+			plocation = ktla_ktva((void *)plocation);
- 		/* This is the symbol it is referring to.  Note that all
- 		   undefined symbols have been resolved.  */
- 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
-@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
- 		switch (ELF32_R_TYPE(rel[i].r_info)) {
- 		case R_386_32:
- 			/* We add the value into the location given */
--			*location += sym->st_value;
-+			pax_open_kernel();
-+			*plocation += sym->st_value;
-+			pax_close_kernel();
- 			break;
- 		case R_386_PC32:
- 			/* Add the value, subtract its postition */
--			*location += sym->st_value - (uint32_t)location;
-+			pax_open_kernel();
-+			*plocation += sym->st_value - location;
-+			pax_close_kernel();
- 			break;
- 		default:
- 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
-@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
- 		case R_X86_64_NONE:
- 			break;
- 		case R_X86_64_64:
-+			pax_open_kernel();
- 			*(u64 *)loc = val;
-+			pax_close_kernel();
- 			break;
- 		case R_X86_64_32:
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
- 			if (val != *(u32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_32S:
-+			pax_open_kernel();
- 			*(s32 *)loc = val;
-+			pax_close_kernel();
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
- 			break;
- 		case R_X86_64_PC32:
- 			val -= (u64)loc;
-+			pax_open_kernel();
- 			*(u32 *)loc = val;
-+			pax_close_kernel();
-+
- #if 0
- 			if ((s64)val != *(s32 *)loc)
- 				goto overflow;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/paravirt.c linux-2.6.32.13/arch/x86/kernel/paravirt.c
---- linux-2.6.32.13/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/paravirt.c	2010-05-15 13:21:14.088032889 -0400
-@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
-  * corresponding structure. */
- static void *get_call_destination(u8 type)
- {
--	struct paravirt_patch_template tmpl = {
-+	const struct paravirt_patch_template tmpl = {
- 		.pv_init_ops = pv_init_ops,
- 		.pv_time_ops = pv_time_ops,
- 		.pv_cpu_ops = pv_cpu_ops,
-@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
- 	if (opfunc == NULL)
- 		/* If there's no function, patch it with a ud2a (BUG) */
- 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
--	else if (opfunc == _paravirt_nop)
-+	else if (opfunc == (void *)_paravirt_nop)
- 		/* If the operation is a nop, then nop the callsite */
- 		ret = paravirt_patch_nop();
- 
- 	/* identity functions just return their single argument */
--	else if (opfunc == _paravirt_ident_32)
-+	else if (opfunc == (void *)_paravirt_ident_32)
- 		ret = paravirt_patch_ident_32(insnbuf, len);
--	else if (opfunc == _paravirt_ident_64)
-+	else if (opfunc == (void *)_paravirt_ident_64)
- 		ret = paravirt_patch_ident_64(insnbuf, len);
- 
- 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
-@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
- 	if (insn_len > len || start == NULL)
- 		insn_len = len;
- 	else
--		memcpy(insnbuf, start, insn_len);
-+		memcpy(insnbuf, ktla_ktva(start), insn_len);
- 
- 	return insn_len;
- }
-@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
- 	preempt_enable();
- }
- 
--struct pv_info pv_info = {
-+struct pv_info pv_info __read_only = {
- 	.name = "bare hardware",
- 	.paravirt_enabled = 0,
- 	.kernel_rpl = 0,
- 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
- };
- 
--struct pv_init_ops pv_init_ops = {
-+struct pv_init_ops pv_init_ops __read_only = {
- 	.patch = native_patch,
- };
- 
--struct pv_time_ops pv_time_ops = {
-+struct pv_time_ops pv_time_ops __read_only = {
- 	.sched_clock = native_sched_clock,
- };
- 
--struct pv_irq_ops pv_irq_ops = {
-+struct pv_irq_ops pv_irq_ops __read_only = {
- 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
- 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
- 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
- #endif
- };
- 
--struct pv_cpu_ops pv_cpu_ops = {
-+struct pv_cpu_ops pv_cpu_ops __read_only = {
- 	.cpuid = native_cpuid,
- 	.get_debugreg = native_get_debugreg,
- 	.set_debugreg = native_set_debugreg,
-@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
- 	.end_context_switch = paravirt_nop,
- };
- 
--struct pv_apic_ops pv_apic_ops = {
-+struct pv_apic_ops pv_apic_ops __read_only = {
- #ifdef CONFIG_X86_LOCAL_APIC
- 	.startup_ipi_hook = paravirt_nop,
- #endif
-@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
- #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
- #endif
- 
--struct pv_mmu_ops pv_mmu_ops = {
-+struct pv_mmu_ops pv_mmu_ops __read_only = {
- 
- 	.read_cr2 = native_read_cr2,
- 	.write_cr2 = native_write_cr2,
-@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
- 	},
- 
- 	.set_fixmap = native_set_fixmap,
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	.pax_open_kernel = native_pax_open_kernel,
-+	.pax_close_kernel = native_pax_close_kernel,
-+#endif
-+
- };
- 
- EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/paravirt-spinlocks.c	2010-05-15 13:21:14.088032889 -0400
-@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
- 	__raw_spin_lock(lock);
- }
- 
--struct pv_lock_ops pv_lock_ops = {
-+struct pv_lock_ops pv_lock_ops __read_only = {
- #ifdef CONFIG_SMP
- 	.spin_is_locked = __ticket_spin_is_locked,
- 	.spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/pci-calgary_64.c	2010-05-15 13:21:14.095776197 -0400
-@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
- 	free_pages((unsigned long)vaddr, get_order(size));
- }
- 
--static struct dma_map_ops calgary_dma_ops = {
-+static const struct dma_map_ops calgary_dma_ops = {
- 	.alloc_coherent = calgary_alloc_coherent,
- 	.free_coherent = calgary_free_coherent,
- 	.map_sg = calgary_map_sg,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-dma.c linux-2.6.32.13/arch/x86/kernel/pci-dma.c
---- linux-2.6.32.13/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/pci-dma.c	2010-05-15 13:21:14.095776197 -0400
-@@ -14,7 +14,7 @@
- 
- static int forbid_dac __read_mostly;
- 
--struct dma_map_ops *dma_ops;
-+const struct dma_map_ops *dma_ops;
- EXPORT_SYMBOL(dma_ops);
- 
- static int iommu_sac_force __read_mostly;
-@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
- 
- int dma_supported(struct device *dev, u64 mask)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- #ifdef CONFIG_PCI
- 	if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c	2010-05-15 13:20:18.438563899 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/pci-gart_64.c	2010-05-15 13:21:14.095776197 -0400
-@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
- 	return -1;
- }
- 
--static struct dma_map_ops gart_dma_ops = {
-+static const struct dma_map_ops gart_dma_ops = {
- 	.map_sg				= gart_map_sg,
- 	.unmap_sg			= gart_unmap_sg,
- 	.map_page			= gart_map_page,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-nommu.c linux-2.6.32.13/arch/x86/kernel/pci-nommu.c
---- linux-2.6.32.13/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/pci-nommu.c	2010-05-15 13:21:14.095776197 -0400
-@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
- 	flush_write_buffers();
- }
- 
--struct dma_map_ops nommu_dma_ops = {
-+const struct dma_map_ops nommu_dma_ops = {
- 	.alloc_coherent		= dma_generic_alloc_coherent,
- 	.free_coherent		= nommu_free_coherent,
- 	.map_sg			= nommu_map_sg,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/pci-swiotlb.c	2010-05-15 13:21:14.095776197 -0400
-@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
- 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
- }
- 
--static struct dma_map_ops swiotlb_dma_ops = {
-+static const struct dma_map_ops swiotlb_dma_ops = {
- 	.mapping_error = swiotlb_dma_mapping_error,
- 	.alloc_coherent = x86_swiotlb_alloc_coherent,
- 	.free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/process_32.c linux-2.6.32.13/arch/x86/kernel/process_32.c
---- linux-2.6.32.13/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/process_32.c	2010-05-15 13:21:14.095776197 -0400
-@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
- unsigned long thread_saved_pc(struct task_struct *tsk)
- {
- 	return ((unsigned long *)tsk->thread.sp)[3];
-+//XXX	return tsk->thread.eip;
- }
- 
- #ifndef CONFIG_SMP
-@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
- 	unsigned short ss, gs;
- 	const char *board;
- 
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		sp = regs->sp;
- 		ss = regs->ss & 0xffff;
- 		gs = get_user_gs(regs);
-@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
- 	regs.bx = (unsigned long) fn;
- 	regs.dx = (unsigned long) arg;
- 
--	regs.ds = __USER_DS;
--	regs.es = __USER_DS;
-+	regs.ds = __KERNEL_DS;
-+	regs.es = __KERNEL_DS;
- 	regs.fs = __KERNEL_PERCPU;
- 	regs.gs = __KERNEL_STACK_CANARY;
- 	regs.orig_ax = -1;
-@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
- 	struct task_struct *tsk;
- 	int err;
- 
--	childregs = task_pt_regs(p);
-+	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
- 	*childregs = *regs;
- 	childregs->ax = 0;
- 	childregs->sp = sp;
-@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
- 	 * Set a new TLS for the child thread?
- 	 */
- 	if (clone_flags & CLONE_SETTLS)
-+//XXX needs set_fs()?
- 		err = do_set_thread_area(p, -1,
- 			(struct user_desc __user *)childregs->si, 0);
- 
-@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread,
- 				 *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	bool preload_fpu;
- 
- 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
- 	 */
- 	lazy_save_gs(prev->gs);
- 
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
-+		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
-+#endif
-+
- 	/*
- 	 * Load the per-thread Thread-Local Storage descriptor.
- 	 */
-@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
- 	return 0;
- }
- 
-+#ifdef CONFIG_PAX_RANDKSTACK
-+asmlinkage void pax_randomize_kstack(void)
-+{
-+	struct thread_struct *thread = &current->thread;
-+	unsigned long time;
-+
-+	if (!randomize_va_space)
-+		return;
-+
-+	rdtscl(time);
-+
-+	/* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+	time &= 0x1EUL;
-+	time <<= 2;
-+#else
-+	time &= 0xFUL;
-+	time <<= 3;
-+#endif
-+
-+	thread->sp0 ^= time;
-+	load_sp0(init_tss + smp_processor_id(), thread);
-+}
-+#endif
-diff -urNp linux-2.6.32.13/arch/x86/kernel/process_64.c linux-2.6.32.13/arch/x86/kernel/process_64.c
---- linux-2.6.32.13/arch/x86/kernel/process_64.c	2010-05-15 13:20:18.438563899 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/process_64.c	2010-05-15 13:21:14.095776197 -0400
-@@ -91,7 +91,7 @@ static void __exit_idle(void)
- void exit_idle(void)
- {
- 	/* idle loop has pid 0 */
--	if (current->pid)
-+	if (task_pid_nr(current))
- 		return;
- 	__exit_idle();
- }
-@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
- 	if (!board)
- 		board = "";
- 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
--		current->pid, current->comm, print_tainted(),
-+		task_pid_nr(current), current->comm, print_tainted(),
- 		init_utsname()->release,
- 		(int)strcspn(init_utsname()->version, " "),
- 		init_utsname()->version, board);
-@@ -380,7 +380,7 @@ __switch_to(struct task_struct *prev_p, 
- 	struct thread_struct *prev = &prev_p->thread;
- 	struct thread_struct *next = &next_p->thread;
- 	int cpu = smp_processor_id();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 	unsigned fsindex, gsindex;
- 	bool preload_fpu;
- 
-@@ -560,12 +560,11 @@ unsigned long get_wchan(struct task_stru
- 	if (!p || p == current || p->state == TASK_RUNNING)
- 		return 0;
- 	stack = (unsigned long)task_stack_page(p);
--	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
- 		return 0;
- 	fp = *(u64 *)(p->thread.sp);
- 	do {
--		if (fp < (unsigned long)stack ||
--		    fp >= (unsigned long)stack+THREAD_SIZE)
-+		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
- 			return 0;
- 		ip = *(u64 *)(fp+8);
- 		if (!in_sched_functions(ip))
-diff -urNp linux-2.6.32.13/arch/x86/kernel/process.c linux-2.6.32.13/arch/x86/kernel/process.c
---- linux-2.6.32.13/arch/x86/kernel/process.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/process.c	2010-05-15 13:21:14.095776197 -0400
-@@ -73,7 +73,7 @@ void exit_thread(void)
- 	unsigned long *bp = t->io_bitmap_ptr;
- 
- 	if (bp) {
--		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
-+		struct tss_struct *tss = init_tss + get_cpu();
- 
- 		t->io_bitmap_ptr = NULL;
- 		clear_thread_flag(TIF_IO_BITMAP);
-@@ -93,6 +93,9 @@ void flush_thread(void)
- 
- 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
- 
-+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
-+	loadsegment(gs, 0);
-+#endif
- 	tsk->thread.debugreg0 = 0;
- 	tsk->thread.debugreg1 = 0;
- 	tsk->thread.debugreg2 = 0;
-@@ -600,17 +603,3 @@ static int __init idle_setup(char *str)
- 	return 0;
- }
- early_param("idle", idle_setup);
--
--unsigned long arch_align_stack(unsigned long sp)
--{
--	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
--		sp -= get_random_int() % 8192;
--	return sp & ~0xf;
--}
--
--unsigned long arch_randomize_brk(struct mm_struct *mm)
--{
--	unsigned long range_end = mm->brk + 0x02000000;
--	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
--}
--
-diff -urNp linux-2.6.32.13/arch/x86/kernel/ptrace.c linux-2.6.32.13/arch/x86/kernel/ptrace.c
---- linux-2.6.32.13/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/ptrace.c	2010-05-15 13:21:14.110913724 -0400
-@@ -925,7 +925,7 @@ static const struct user_regset_view use
- long arch_ptrace(struct task_struct *child, long request, long addr, long data)
- {
- 	int ret;
--	unsigned long __user *datap = (unsigned long __user *)data;
-+	unsigned long __user *datap = (__force unsigned long __user *)data;
- 
- 	switch (request) {
- 	/* read the word at location addr in the USER area. */
-@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_get_thread_area(child, addr,
--					 (struct user_desc __user *) data);
-+					 (__force struct user_desc __user *) data);
- 		break;
- 
- 	case PTRACE_SET_THREAD_AREA:
- 		if (addr < 0)
- 			return -EIO;
- 		ret = do_set_thread_area(child, addr,
--					 (struct user_desc __user *) data, 0);
-+					 (__force struct user_desc __user *) data, 0);
- 		break;
- #endif
- 
-@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
- #ifdef CONFIG_X86_PTRACE_BTS
- 	case PTRACE_BTS_CONFIG:
- 		ret = ptrace_bts_config
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_STATUS:
- 		ret = ptrace_bts_status
--			(child, data, (struct ptrace_bts_config __user *)addr);
-+			(child, data, (__force struct ptrace_bts_config __user *)addr);
- 		break;
- 
- 	case PTRACE_BTS_SIZE:
-@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_GET:
- 		ret = ptrace_bts_read_record
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- 
- 	case PTRACE_BTS_CLEAR:
-@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
- 
- 	case PTRACE_BTS_DRAIN:
- 		ret = ptrace_bts_drain
--			(child, data, (struct bts_struct __user *) addr);
-+			(child, data, (__force struct bts_struct __user *) addr);
- 		break;
- #endif /* CONFIG_X86_PTRACE_BTS */
- 
-@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
- 	info.si_code = si_code;
- 
- 	/* User-mode ip? */
--	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
-+	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
- 
- 	/* Send us the fake SIGTRAP */
- 	force_sig_info(SIGTRAP, &info, tsk);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/reboot.c linux-2.6.32.13/arch/x86/kernel/reboot.c
---- linux-2.6.32.13/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/reboot.c	2010-05-15 13:21:14.110913724 -0400
-@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
- EXPORT_SYMBOL(pm_power_off);
- 
- static const struct desc_ptr no_idt = {};
--static int reboot_mode;
-+static unsigned short reboot_mode;
- enum reboot_type reboot_type = BOOT_KBD;
- int reboot_force;
- 
-@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
- 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static int __init reboot_init(void)
-@@ -292,12 +292,12 @@ core_initcall(reboot_init);
-    controller to pulse the CPU reset line, which is more thorough, but
-    doesn't work with at least one type of 486 motherboard.  It is easy
-    to stop this code working; hence the copious comments. */
--static const unsigned long long
--real_mode_gdt_entries [3] =
-+static struct desc_struct
-+real_mode_gdt_entries [3] __read_only =
- {
--	0x0000000000000000ULL,	/* Null descriptor */
--	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
--	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
-+	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
-+	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
-+	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
- };
- 
- static const struct desc_ptr
-@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
-  * specified by the code and length parameters.
-  * We assume that length will aways be less that 100!
-  */
--void machine_real_restart(const unsigned char *code, int length)
-+void machine_real_restart(const unsigned char *code, unsigned int length)
- {
- 	local_irq_disable();
- 
-@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
- 	/* Remap the kernel at virtual address zero, as well as offset zero
- 	   from the kernel segment.  This assumes the kernel segment starts at
- 	   virtual address PAGE_OFFSET. */
--	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
--		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
-+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
- 
- 	/*
- 	 * Use `swapper_pg_dir' as our page directory.
-@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
- 	   boot)".  This seems like a fairly standard thing that gets set by
- 	   REBOOT.COM programs, and the previous reset routine did this
- 	   too. */
--	*((unsigned short *)0x472) = reboot_mode;
-+	*(unsigned short *)(__va(0x472)) = reboot_mode;
- 
- 	/* For the switch to real mode, copy some code to low memory.  It has
- 	   to be in the first 64k because it is running in 16-bit mode, and it
- 	   has to have the same physical and virtual address, because it turns
- 	   off paging.  Copy it near the end of the first page, out of the way
- 	   of BIOS variables. */
--	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
--		real_mode_switch, sizeof (real_mode_switch));
--	memcpy((void *)(0x1000 - 100), code, length);
-+	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
-+	memcpy(__va(0x1000 - 100), code, length);
- 
- 	/* Set up the IDT for real mode. */
- 	load_idt(&real_mode_idt);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/setup.c linux-2.6.32.13/arch/x86/kernel/setup.c
---- linux-2.6.32.13/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/setup.c	2010-05-15 13:21:14.110913724 -0400
-@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
- 
- 	if (!boot_params.hdr.root_flags)
- 		root_mountflags &= ~MS_RDONLY;
--	init_mm.start_code = (unsigned long) _text;
--	init_mm.end_code = (unsigned long) _etext;
-+	init_mm.start_code = ktla_ktva((unsigned long) _text);
-+	init_mm.end_code = ktla_ktva((unsigned long) _etext);
- 	init_mm.end_data = (unsigned long) _edata;
- 	init_mm.brk = _brk_end;
- 
--	code_resource.start = virt_to_phys(_text);
--	code_resource.end = virt_to_phys(_etext)-1;
--	data_resource.start = virt_to_phys(_etext);
-+	code_resource.start = virt_to_phys(ktla_ktva(_text));
-+	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
-+	data_resource.start = virt_to_phys(_sdata);
- 	data_resource.end = virt_to_phys(_edata)-1;
- 	bss_resource.start = virt_to_phys(&__bss_start);
- 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/setup_percpu.c linux-2.6.32.13/arch/x86/kernel/setup_percpu.c
---- linux-2.6.32.13/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/setup_percpu.c	2010-05-15 13:21:14.119542394 -0400
-@@ -25,19 +25,17 @@
- # define DBG(x...)
- #endif
- 
-+#ifdef CONFIG_SMP
- DEFINE_PER_CPU(int, cpu_number);
- EXPORT_PER_CPU_SYMBOL(cpu_number);
-+#endif
- 
--#ifdef CONFIG_X86_64
- #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
--#else
--#define BOOT_PERCPU_OFFSET 0
--#endif
- 
- DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
- EXPORT_PER_CPU_SYMBOL(this_cpu_off);
- 
--unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
-+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
- 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
- };
- EXPORT_SYMBOL(__per_cpu_offset);
-@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
- {
- #ifdef CONFIG_X86_32
- 	struct desc_struct gdt;
-+	unsigned long base = per_cpu_offset(cpu);
- 
--	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
--			0x2 | DESCTYPE_S, 0x8);
--	gdt.s = 1;
-+	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
-+			0x83 | DESCTYPE_S, 0xC);
- 	write_gdt_entry(get_cpu_gdt_table(cpu),
- 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
- #endif
-@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
- 	/* alrighty, percpu areas up and running */
- 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
- 	for_each_possible_cpu(cpu) {
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		unsigned long canary = per_cpu(stack_canary, cpu);
-+#endif
-+#endif
- 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
- 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
- 		per_cpu(cpu_number, cpu) = cpu;
-@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
- 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
- #endif
- #endif
-+#ifdef CONFIG_CC_STACKPROTECTOR
-+#ifdef CONFIG_x86_32
-+		if (cpu == boot_cpu_id)
-+			per_cpu(stack_canary, cpu) = canary;
-+#endif
-+#endif
- 		/*
- 		 * Up to this point, the boot CPU has been using .data.init
- 		 * area.  Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.32.13/arch/x86/kernel/signal.c linux-2.6.32.13/arch/x86/kernel/signal.c
---- linux-2.6.32.13/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/signal.c	2010-05-15 13:21:14.119542394 -0400
-@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
- 	 * Align the stack pointer according to the i386 ABI,
- 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
- 	 */
--	sp = ((sp + 4) & -16ul) - 4;
-+	sp = ((sp - 12) & -16ul) - 4;
- #else /* !CONFIG_X86_32 */
- 	sp = round_down(sp, 16) - 8;
- #endif
-@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
- 	 * Return an always-bogus address instead so we will die with SIGSEGV.
- 	 */
- 	if (onsigstack && !likely(on_sig_stack(sp)))
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	/* save i387 state */
- 	if (used_math() && save_i387_xstate(*fpstate) < 0)
--		return (void __user *)-1L;
-+		return (__force void __user *)-1L;
- 
- 	return (void __user *)sp;
- }
-@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
- 	}
- 
- 	if (current->mm->context.vdso)
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
- 	else
--		restorer = &frame->retcode;
-+		restorer = (void __user *)&frame->retcode;
- 	if (ka->sa.sa_flags & SA_RESTORER)
- 		restorer = ka->sa.sa_restorer;
- 
-@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
- 	 * reasons and because gdb uses it as a signature to notice
- 	 * signal handler stack frames.
- 	 */
--	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
-+	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
- 
- 	if (err)
- 		return -EFAULT;
-@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
- 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
- 
- 		/* Set up to return from userspace.  */
--		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
- 		if (ka->sa.sa_flags & SA_RESTORER)
- 			restorer = ka->sa.sa_restorer;
- 		put_user_ex(restorer, &frame->pretcode);
-@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
- 		 * reasons and because gdb uses it as a signature to notice
- 		 * signal handler stack frames.
- 		 */
--		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
-+		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
- 	} put_user_catch(err);
- 
- 	if (err)
-@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
- 	 * X86_32: vm86 regs switched out by assembly code before reaching
- 	 * here, so testing against kernel CS suffices.
- 	 */
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		return;
- 
- 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/smpboot.c linux-2.6.32.13/arch/x86/kernel/smpboot.c
---- linux-2.6.32.13/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/smpboot.c	2010-05-15 13:21:14.130650342 -0400
-@@ -729,7 +729,11 @@ do_rest:
- 		(unsigned long)task_stack_page(c_idle.idle) -
- 		KERNEL_STACK_OFFSET + THREAD_SIZE;
- #endif
-+
-+	pax_open_kernel();
- 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
-+	pax_close_kernel();
-+
- 	initial_code = (unsigned long)start_secondary;
- 	stack_start.sp = (void *) c_idle.idle->thread.sp;
- 
-@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
- 
- 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_X86_32
- 	/* init low mem mapping */
- 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-diff -urNp linux-2.6.32.13/arch/x86/kernel/step.c linux-2.6.32.13/arch/x86/kernel/step.c
---- linux-2.6.32.13/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/step.c	2010-05-15 13:21:14.130650342 -0400
-@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
- 		struct desc_struct *desc;
- 		unsigned long base;
- 
--		seg &= ~7UL;
-+		seg >>= 3;
- 
- 		mutex_lock(&child->mm->context.lock);
--		if (unlikely((seg >> 3) >= child->mm->context.size))
-+		if (unlikely(seg >= child->mm->context.size))
- 			addr = -1L; /* bogus selector, access would fault */
- 		else {
- 			desc = child->mm->context.ldt + seg;
-@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
- 	unsigned char opcode[15];
- 	unsigned long addr = convert_ip_to_linear(child, regs);
- 
-+	if (addr == -EINVAL)
-+		return 0;
-+
- 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
- 	for (i = 0; i < copied; i++) {
- 		switch (opcode[i]) {
-@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
- 
- #ifdef CONFIG_X86_64
- 		case 0x40 ... 0x4f:
--			if (regs->cs != __USER_CS)
-+			if ((regs->cs & 0xffff) != __USER_CS)
- 				/* 32-bit mode: register increment */
- 				return 0;
- 			/* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/syscall_table_32.S	2010-05-15 13:21:14.130650342 -0400
-@@ -1,3 +1,4 @@
-+.section .rodata,"a",@progbits
- ENTRY(sys_call_table)
- 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
- 	.long sys_exit
-diff -urNp linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/sys_i386_32.c	2010-05-15 13:21:14.130650342 -0400
-@@ -24,6 +24,21 @@
- 
- #include <asm/syscalls.h>
- 
-+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
-+{
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size || addr > pax_task_size - len)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
- /*
-  * Perform the select(nd, in, out, ex, tv) and mmap() system
-  * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,205 @@ out:
- 	return err;
- }
- 
-+unsigned long
-+arch_get_unmapped_area(struct file *filp, unsigned long addr,
-+		unsigned long len, unsigned long pgoff, unsigned long flags)
-+{
-+	struct mm_struct *mm = current->mm;
-+	struct vm_area_struct *vma;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+		    (!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+	if (len > mm->cached_hole_size) {
-+		start_addr = addr = mm->free_area_cache;
-+	} else {
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
-+	}
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
-+		start_addr = 0x00110000UL;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			start_addr += mm->delta_mmap & 0x03FFF000UL;
-+#endif
-+
-+		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
-+			start_addr = addr = mm->mmap_base;
-+		else
-+			addr = start_addr;
-+	}
-+#endif
-+
-+full_search:
-+	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
-+		/* At this point:  (!vma || addr < vma->vm_end). */
-+		if (pax_task_size - len < addr) {
-+			/*
-+			 * Start a new search - just in case we missed
-+			 * some holes.
-+			 */
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
-+				mm->cached_hole_size = 0;
-+				goto full_search;
-+			}
-+			return -ENOMEM;
-+		}
-+		if (!vma || addr + len <= vma->vm_start) {
-+			/*
-+			 * Remember the place where we stopped the search:
-+			 */
-+			mm->free_area_cache = addr + len;
-+			return addr;
-+		}
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+		addr = vma->vm_end;
-+		if (mm->start_brk <= addr && addr < mm->mmap_base) {
-+			start_addr = addr = mm->mmap_base;
-+			mm->cached_hole_size = 0;
-+			goto full_search;
-+		}
-+	}
-+}
-+
-+unsigned long
-+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
-+			  const unsigned long len, const unsigned long pgoff,
-+			  const unsigned long flags)
-+{
-+	struct vm_area_struct *vma;
-+	struct mm_struct *mm = current->mm;
-+	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	/* requested length too big for entire address space */
-+	if (len > pax_task_size)
-+		return -ENOMEM;
-+
-+	if (flags & MAP_FIXED)
-+		return addr;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
-+		goto bottomup;
-+#endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
-+	/* requesting a specific address */
-+	if (addr) {
-+		addr = PAGE_ALIGN(addr);
-+		vma = find_vma(mm, addr);
-+		if (pax_task_size - len >= addr &&
-+				(!vma || addr + len <= vma->vm_start))
-+			return addr;
-+	}
-+
-+	/* check if free_area_cache is useful for us */
-+	if (len <= mm->cached_hole_size) {
-+		mm->cached_hole_size = 0;
-+		mm->free_area_cache = mm->mmap_base;
-+	}
-+
-+	/* either no address requested or can't fit in requested address hole */
-+	addr = mm->free_area_cache;
-+
-+	/* make sure it can fit in the remaining address space */
-+	if (addr > len) {
-+		vma = find_vma(mm, addr-len);
-+		if (!vma || addr <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr-len);
-+	}
-+
-+	if (mm->mmap_base < len)
-+		goto bottomup;
-+
-+	addr = mm->mmap_base-len;
-+
-+	do {
-+		/*
-+		 * Lookup failure means no vma is above this address,
-+		 * else if new region fits below vma->vm_start,
-+		 * return with success:
-+		 */
-+		vma = find_vma(mm, addr);
-+		if (!vma || addr+len <= vma->vm_start)
-+			/* remember the address as a hint for next time */
-+			return (mm->free_area_cache = addr);
-+
-+		/* remember the largest hole we saw so far */
-+		if (addr + mm->cached_hole_size < vma->vm_start)
-+			mm->cached_hole_size = vma->vm_start - addr;
-+
-+		/* try just below the current vma->vm_start */
-+		addr = vma->vm_start-len;
-+	} while (len < vma->vm_start);
-+
-+bottomup:
-+	/*
-+	 * A failed mmap() very likely causes application failure,
-+	 * so fall back to the bottom-up function here. This scenario
-+	 * can happen with large stack limits and large mmap()
-+	 * allocations.
-+	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
-+	mm->cached_hole_size = ~0UL;
-+	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
-+	/*
-+	 * Restore the topdown base:
-+	 */
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
-+	mm->cached_hole_size = ~0UL;
-+
-+	return addr;
-+}
- 
- struct sel_arg_struct {
- 	unsigned long n;
-@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
- 	case SEMTIMEDOP:
- 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
--					(const struct timespec __user *)fifth);
-+					(__force const struct timespec __user *)fifth);
- 
- 	case SEMGET:
- 		return sys_semget(first, second, third);
-@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
- 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
- 			if (ret)
- 				return ret;
--			return put_user(raddr, (ulong __user *) third);
-+			return put_user(raddr, (__force ulong __user *) third);
- 		}
- 		case 1:	/* iBCS2 emulator entry point */
- 			if (!segment_eq(get_fs(), get_ds()))
-diff -urNp linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/sys_x86_64.c	2010-05-15 13:21:14.130650342 -0400
-@@ -32,8 +32,8 @@ out:
- 	return error;
- }
- 
--static void find_start_end(unsigned long flags, unsigned long *begin,
--			   unsigned long *end)
-+static void find_start_end(struct mm_struct *mm, unsigned long flags,
-+			   unsigned long *begin, unsigned long *end)
- {
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
- 		unsigned long new_begin;
-@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
- 				*begin = new_begin;
- 		}
- 	} else {
--		*begin = TASK_UNMAPPED_BASE;
-+		*begin = mm->mmap_base;
- 		*end = TASK_SIZE;
- 	}
- }
-@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
--	find_start_end(flags, &begin, &end);
-+	find_start_end(mm, flags, &begin, &end);
- 
- 	if (len > end)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
- 		goto bottomup;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -198,13 +206,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/time.c linux-2.6.32.13/arch/x86/kernel/time.c
---- linux-2.6.32.13/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/time.c	2010-05-15 13:21:14.130650342 -0400
-@@ -26,17 +26,13 @@
- int timer_ack;
- #endif
- 
--#ifdef CONFIG_X86_64
--volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
--#endif
--
- unsigned long profile_pc(struct pt_regs *regs)
- {
- 	unsigned long pc = instruction_pointer(regs);
- 
--	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
-+	if (!user_mode(regs) && in_lock_functions(pc)) {
- #ifdef CONFIG_FRAME_POINTER
--		return *(unsigned long *)(regs->bp + sizeof(long));
-+		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
- #else
- 		unsigned long *sp =
- 			(unsigned long *)kernel_stack_pointer(regs);
-@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
- 		 * or above a saved flags. Eflags has bits 22-31 zero,
- 		 * kernel addresses don't.
- 		 */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		return ktla_ktva(sp[0]);
-+#else
- 		if (sp[0] >> 22)
- 			return sp[0];
- 		if (sp[1] >> 22)
- 			return sp[1];
- #endif
-+
-+#endif
- 	}
- 	return pc;
- }
-diff -urNp linux-2.6.32.13/arch/x86/kernel/tls.c linux-2.6.32.13/arch/x86/kernel/tls.c
---- linux-2.6.32.13/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/tls.c	2010-05-15 13:21:14.130650342 -0400
-@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
- 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
-+		return -EINVAL;
-+#endif
-+
- 	set_tls_desc(p, idx, &info, 1);
- 
- 	return 0;
-diff -urNp linux-2.6.32.13/arch/x86/kernel/trampoline_32.S linux-2.6.32.13/arch/x86/kernel/trampoline_32.S
---- linux-2.6.32.13/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/trampoline_32.S	2010-05-15 13:21:14.130650342 -0400
-@@ -32,6 +32,12 @@
- #include <asm/segment.h>
- #include <asm/page_types.h>
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+#define ta(X) (X)
-+#else
-+#define ta(X) ((X) - __PAGE_OFFSET)
-+#endif
-+
- /* We can free up trampoline after bootup if cpu hotplug is not supported. */
- __CPUINITRODATA
- .code16
-@@ -60,7 +66,7 @@ r_base = .
- 	inc	%ax		# protected mode (PE) bit
- 	lmsw	%ax		# into protected mode
- 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
--	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
-+	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
- 
- 	# These need to be in the same 64K segment as the above;
- 	# hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.32.13/arch/x86/kernel/traps.c linux-2.6.32.13/arch/x86/kernel/traps.c
---- linux-2.6.32.13/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/traps.c	2010-05-15 13:21:14.130650342 -0400
-@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
- 
- /* Do we ignore FPU interrupts ? */
- char ignore_fpu_irq;
--
--/*
-- * The IDT has to be page-aligned to simplify the Pentium
-- * F0 0F bug workaround.
-- */
--gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
- #endif
- 
- DECLARE_BITMAP(used_vectors, NR_VECTORS);
-@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
- static inline void
- die_if_kernel(const char *str, struct pt_regs *regs, long err)
- {
--	if (!user_mode_vm(regs))
-+	if (!user_mode(regs))
- 		die(str, regs, err);
- }
- #endif
- 
- static void __kprobes
--do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
-+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
- 	long error_code, siginfo_t *info)
- {
- 	struct task_struct *tsk = current;
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		/*
- 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
- 		 * On nmi (interrupt 2), do_trap should not be called.
-@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
- 	}
- #endif
- 
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto kernel_trap;
- 
- #ifdef CONFIG_X86_32
-@@ -158,7 +152,7 @@ trap_signal:
- 	    printk_ratelimit()) {
- 		printk(KERN_INFO
- 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
--		       tsk->comm, tsk->pid, str,
-+		       tsk->comm, task_pid_nr(tsk), str,
- 		       regs->ip, regs->sp, error_code);
- 		print_vma_addr(" in ", regs->ip);
- 		printk("\n");
-@@ -175,8 +169,20 @@ kernel_trap:
- 	if (!fixup_exception(regs)) {
- 		tsk->thread.error_code = error_code;
- 		tsk->thread.trap_no = trapnr;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
-+			str = "PAX: suspicious stack segment fault";
-+#endif
-+
- 		die(str, regs, error_code);
- 	}
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+	if (trapnr == 4)
-+		pax_report_refcount_overflow(regs);
-+#endif
-+
- 	return;
- 
- #ifdef CONFIG_X86_32
-@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
- 	conditional_sti(regs);
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto gp_in_vm86;
- #endif
- 
- 	tsk = current;
--	if (!user_mode(regs))
-+	if (!user_mode_novm(regs))
- 		goto gp_in_kernel;
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
-+		struct mm_struct *mm = tsk->mm;
-+		unsigned long limit;
-+
-+		down_write(&mm->mmap_sem);
-+		limit = mm->context.user_cs_limit;
-+		if (limit < TASK_SIZE) {
-+			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
-+			up_write(&mm->mmap_sem);
-+			return;
-+		}
-+		up_write(&mm->mmap_sem);
-+	}
-+#endif
-+
- 	tsk->thread.error_code = error_code;
- 	tsk->thread.trap_no = 13;
- 
-@@ -305,6 +327,13 @@ gp_in_kernel:
- 	if (notify_die(DIE_GPF, "general protection fault", regs,
- 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
- 		return;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
-+		die("PAX: suspicious general protection fault", regs, error_code);
-+	else
-+#endif
-+
- 	die("general protection fault", regs, error_code);
- }
- 
-@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
- 	}
- 
- #ifdef CONFIG_X86_32
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		goto debug_vm86;
- #endif
- 
-@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
- 	 * kernel space (but re-enable TF when returning to user mode).
- 	 */
- 	if (condition & DR_STEP) {
--		if (!user_mode(regs))
-+		if (!user_mode_novm(regs))
- 			goto clear_TF_reenable;
- 	}
- 
-@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
- 	 * Handle strange cache flush from user space exception
- 	 * in all other cases.  This is undocumented behaviour.
- 	 */
--	if (regs->flags & X86_VM_MASK) {
-+	if (v8086_mode(regs)) {
- 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
- 		return;
- 	}
-diff -urNp linux-2.6.32.13/arch/x86/kernel/tsc.c linux-2.6.32.13/arch/x86/kernel/tsc.c
---- linux-2.6.32.13/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/tsc.c	2010-05-15 13:21:14.134912019 -0400
-@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
- 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static void __init check_system_tsc_reliable(void)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/vm86_32.c linux-2.6.32.13/arch/x86/kernel/vm86_32.c
---- linux-2.6.32.13/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/vm86_32.c	2010-05-15 13:21:14.142909281 -0400
-@@ -41,6 +41,7 @@
- #include <linux/ptrace.h>
- #include <linux/audit.h>
- #include <linux/stddef.h>
-+#include <linux/grsecurity.h>
- 
- #include <asm/uaccess.h>
- #include <asm/io.h>
-@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
- 		do_exit(SIGSEGV);
- 	}
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	current->thread.sp0 = current->thread.saved_sp0;
- 	current->thread.sysenter_cs = __KERNEL_CS;
- 	load_sp0(tss, &current->thread);
-@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
- 	struct task_struct *tsk;
- 	int tmp, ret = -EPERM;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	if (tsk->thread.saved_sp0)
- 		goto out;
-@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
- 	int tmp, ret;
- 	struct vm86plus_struct __user *v86;
- 
-+#ifdef CONFIG_GRKERNSEC_VM86
-+	if (!capable(CAP_SYS_RAWIO)) {
-+		gr_handle_vm86();
-+		ret = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	tsk = current;
- 	switch (regs->bx) {
- 	case VM86_REQUEST_IRQ:
-@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
- 	tsk->thread.saved_fs = info->regs32->fs;
- 	tsk->thread.saved_gs = get_user_gs(info->regs32);
- 
--	tss = &per_cpu(init_tss, get_cpu());
-+	tss = init_tss + get_cpu();
- 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
- 	if (cpu_has_sep)
- 		tsk->thread.sysenter_cs = 0;
-@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
- 		goto cannot_handle;
- 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
- 		goto cannot_handle;
--	intr_ptr = (unsigned long __user *) (i << 2);
-+	intr_ptr = (__force unsigned long __user *) (i << 2);
- 	if (get_user(segoffs, intr_ptr))
- 		goto cannot_handle;
- 	if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.32.13/arch/x86/kernel/vmi_32.c linux-2.6.32.13/arch/x86/kernel/vmi_32.c
---- linux-2.6.32.13/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/vmi_32.c	2010-05-15 13:21:14.150906044 -0400
-@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
- typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
- 
- #define call_vrom_func(rom,func) \
--   (((VROMFUNC *)(rom->func))())
-+   (((VROMFUNC *)(ktva_ktla(rom.func)))())
- 
- #define call_vrom_long_func(rom,func,arg) \
--   (((VROMLONGFUNC *)(rom->func)) (arg))
-+({\
-+	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
-+	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
-+	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
-+	__reloc;\
-+})
- 
--static struct vrom_header *vmi_rom;
-+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
- static int disable_pge;
- static int disable_pse;
- static int disable_sep;
-@@ -76,10 +81,10 @@ static struct {
- 	void (*set_initial_ap_state)(int, int);
- 	void (*halt)(void);
-   	void (*set_lazy_mode)(int mode);
--} vmi_ops;
-+} vmi_ops __read_only;
- 
- /* Cached VMI operations */
--struct vmi_timer_ops vmi_timer_ops;
-+struct vmi_timer_ops vmi_timer_ops __read_only;
- 
- /*
-  * VMI patching routines.
-@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
- static inline void patch_offset(void *insnbuf,
- 				unsigned long ip, unsigned long dest)
- {
--        *(unsigned long *)(insnbuf+1) = dest-ip-5;
-+	*(unsigned long *)(insnbuf+1) = dest-ip-5;
- }
- 
- static unsigned patch_internal(int call, unsigned len, void *insnbuf,
-@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
- {
- 	u64 reloc;
- 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
-+
- 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
- 	switch(rel->type) {
- 		case VMI_RELOCATION_CALL_REL:
-@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
- 
- static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
- }
- 
- static void vmi_pmd_clear(pmd_t *pmd)
- {
--	const pte_t pte = { .pte = 0 };
-+	const pte_t pte = __pte(0ULL);
- 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
- }
- #endif
-@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
- 	ap.ss = __KERNEL_DS;
- 	ap.esp = (unsigned long) start_esp;
- 
--	ap.ds = __USER_DS;
--	ap.es = __USER_DS;
-+	ap.ds = __KERNEL_DS;
-+	ap.es = __KERNEL_DS;
- 	ap.fs = __KERNEL_PERCPU;
- 	ap.gs = __KERNEL_STACK_CANARY;
- 
-@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
- 	paravirt_leave_lazy_mmu();
- }
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+static unsigned long vmi_pax_open_kernel(void)
-+{
-+	return 0;
-+}
-+
-+static unsigned long vmi_pax_close_kernel(void)
-+{
-+	return 0;
-+}
-+#endif
-+
- static inline int __init check_vmi_rom(struct vrom_header *rom)
- {
- 	struct pci_header *pci;
-@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
- 		return 0;
- 	if (rom->vrom_signature != VMI_SIGNATURE)
- 		return 0;
-+	if (rom->rom_length * 512 > sizeof(*rom)) {
-+		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
-+		return 0;
-+	}
- 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
- 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
- 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
-@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
- 		struct vrom_header *romstart;
- 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
- 		if (check_vmi_rom(romstart)) {
--			vmi_rom = romstart;
-+			vmi_rom = *romstart;
- 			return 1;
- 		}
- 	}
-@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
- 
- 	para_fill(pv_irq_ops.safe_halt, Halt);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
-+	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
-+#endif
-+
- 	/*
- 	 * Alternative instruction rewriting doesn't happen soon enough
- 	 * to convert VMI_IRET to a call instead of a jump; so we have
-@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
- 
- void __init vmi_init(void)
- {
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		probe_vmi_rom();
- 	else
--		check_vmi_rom(vmi_rom);
-+		check_vmi_rom(&vmi_rom);
- 
- 	/* In case probing for or validating the ROM failed, basil */
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
--	reserve_top_address(-vmi_rom->virtual_top);
-+	reserve_top_address(-vmi_rom.virtual_top);
- 
- #ifdef CONFIG_X86_IO_APIC
- 	/* This is virtual hardware; timer routing is wired correctly */
-@@ -874,7 +901,7 @@ void __init vmi_activate(void)
- {
- 	unsigned long flags;
- 
--	if (!vmi_rom)
-+	if (!vmi_rom.rom_signature)
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/vmlinux.lds.S	2010-05-15 13:21:14.162641857 -0400
-@@ -26,6 +26,22 @@
- #include <asm/page_types.h>
- #include <asm/cache.h>
- #include <asm/boot.h>
-+#include <asm/segment.h>
-+
-+#undef PMD_SIZE
-+#undef PMD_SHIFT
-+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-+#define PMD_SHIFT 21
-+#else
-+#define PMD_SHIFT 22
-+#endif
-+#define PMD_SIZE (1 << PMD_SHIFT)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
-+#else
-+#define __KERNEL_TEXT_OFFSET	0
-+#endif
- 
- #undef i386     /* in case the preprocessor is a 32bit one */
- 
-@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
- #ifdef CONFIG_X86_32
- OUTPUT_ARCH(i386)
- ENTRY(phys_startup_32)
--jiffies = jiffies_64;
- #else
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(phys_startup_64)
--jiffies_64 = jiffies;
- #endif
- 
-+jiffies = jiffies_64;
-+
- PHDRS {
- 	text PT_LOAD FLAGS(5);          /* R_E */
--	data PT_LOAD FLAGS(7);          /* RWE */
-+#ifdef CONFIG_XEN
-+	rodata PT_LOAD FLAGS(5);        /* R_E */
-+#else
-+	rodata PT_LOAD FLAGS(4);        /* R__ */
-+#endif
-+#ifdef CONFIG_X86_32
-+	module PT_LOAD FLAGS(5);        /* R_E */
-+#endif
-+	data PT_LOAD FLAGS(6);          /* RW_ */
- #ifdef CONFIG_X86_64
- 	user PT_LOAD FLAGS(5);          /* R_E */
-+#endif
-+	init.begin PT_LOAD FLAGS(6);    /* RW_ */
- #ifdef CONFIG_SMP
- 	percpu PT_LOAD FLAGS(6);        /* RW_ */
- #endif
-+	text.init PT_LOAD FLAGS(5);     /* R_E */
-+	text.exit PT_LOAD FLAGS(5);     /* R_E */
- 	init PT_LOAD FLAGS(7);          /* RWE */
--#endif
- 	note PT_NOTE FLAGS(0);          /* ___ */
- }
- 
- SECTIONS
- {
- #ifdef CONFIG_X86_32
--        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
--        phys_startup_32 = startup_32 - LOAD_OFFSET;
-+	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
- #else
--        . = __START_KERNEL;
--        phys_startup_64 = startup_64 - LOAD_OFFSET;
-+	. = __START_KERNEL;
- #endif
- 
- 	/* Text and read-only data */
--	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
--		_text = .;
-+	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
- 		/* bootstrapping code */
-+#ifdef CONFIG_X86_32
-+		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#else
-+		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+#endif
-+		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
-+		_text = .;
- 		HEAD_TEXT
- #ifdef CONFIG_X86_32
- 		. = ALIGN(PAGE_SIZE);
-@@ -82,28 +113,64 @@ SECTIONS
- 		IRQENTRY_TEXT
- 		*(.fixup)
- 		*(.gnu.warning)
--		/* End of text section */
--		_etext = .;
- 	} :text = 0x9090
- 
--	NOTES :text :note
-+	. += __KERNEL_TEXT_OFFSET;
-+
-+	. = ALIGN(PAGE_SIZE);
-+	NOTES :rodata :note
- 
--	EXCEPTION_TABLE(16) :text = 0x9090
-+	EXCEPTION_TABLE(16) :rodata
- 
- 	RO_DATA(PAGE_SIZE)
- 
-+#ifdef CONFIG_X86_32
-+	. = ALIGN(PAGE_SIZE);
-+	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
-+		*(.idt)
-+		. = ALIGN(PAGE_SIZE);
-+		*(.empty_zero_page)
-+		*(.swapper_pg_pmd)
-+		*(.swapper_pg_dir)
-+	}
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
-+		*(.vmi.rom)
-+	} :module
-+
-+	. = ALIGN(PAGE_SIZE);
-+	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
-+		MODULES_EXEC_VADDR = .;
-+		BYTE(0)
-+		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
-+		. = ALIGN(PMD_SIZE);
-+		MODULES_EXEC_END = . - 1;
-+#endif
-+
-+	} :module
-+#endif
-+
- 	/* Data */
- 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
-+		/* End of text section */
-+		_etext = . - __KERNEL_TEXT_OFFSET;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	. = ALIGN(PMD_SIZE);
-+#else
-+	. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		/* Start of data section */
- 		_sdata = .;
- 
- 		/* init_task */
- 		INIT_TASK_DATA(THREAD_SIZE)
- 
--#ifdef CONFIG_X86_32
--		/* 32 bit has nosave before _edata */
- 		NOSAVE_DATA
--#endif
- 
- 		PAGE_ALIGNED_DATA(PAGE_SIZE)
- 
-@@ -166,12 +233,6 @@ SECTIONS
- 	}
- 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
- 
--	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
--	.jiffies : AT(VLOAD(.jiffies)) {
--		*(.jiffies)
--	}
--	jiffies = VVIRT(.jiffies);
--
- 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
- 		*(.vsyscall_3)
- 	}
-@@ -187,12 +248,19 @@ SECTIONS
- #endif /* CONFIG_X86_64 */
- 
- 	/* Init code and data - will be freed after init */
--	. = ALIGN(PAGE_SIZE);
- 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
-+		BYTE(0)
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		. = ALIGN(PMD_SIZE);
-+#else
-+		. = ALIGN(PAGE_SIZE);
-+#endif
-+
- 		__init_begin = .; /* paired with __init_end */
--	}
-+	} :init.begin
- 
--#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-+#ifdef CONFIG_SMP
- 	/*
- 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
- 	 * output PHDR, so the next output section - .init.text - should
-@@ -201,12 +269,27 @@ SECTIONS
- 	PERCPU_VADDR(0, :percpu)
- #endif
- 
--	INIT_TEXT_SECTION(PAGE_SIZE)
--#ifdef CONFIG_X86_64
--	:init
--#endif
-+	. = ALIGN(PAGE_SIZE);
-+	init_begin = .;
-+	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
-+		VMLINUX_SYMBOL(_sinittext) = .;
-+		INIT_TEXT
-+		VMLINUX_SYMBOL(_einittext) = .;
-+		. = ALIGN(PAGE_SIZE);
-+	} :text.init
-+
-+	/*
-+	 * .exit.text is discard at runtime, not link time, to deal with
-+	 *  references from .altinstructions and .eh_frame
-+	 */
-+	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-+		EXIT_TEXT
-+		. = ALIGN(16);
-+	} :text.exit
-+	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
- 
--	INIT_DATA_SECTION(16)
-+	. = ALIGN(PAGE_SIZE);
-+	INIT_DATA_SECTION(16) :init
- 
- 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
- 		__x86_cpu_dev_start = .;
-@@ -232,19 +315,11 @@ SECTIONS
- 		*(.altinstr_replacement)
- 	}
- 
--	/*
--	 * .exit.text is discard at runtime, not link time, to deal with
--	 *  references from .altinstructions and .eh_frame
--	 */
--	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
--		EXIT_TEXT
--	}
--
- 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
- 		EXIT_DATA
- 	}
- 
--#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
-+#ifndef CONFIG_SMP
- 	PERCPU(PAGE_SIZE)
- #endif
- 
-@@ -267,12 +342,6 @@ SECTIONS
- 		. = ALIGN(PAGE_SIZE);
- 	}
- 
--#ifdef CONFIG_X86_64
--	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
--		NOSAVE_DATA
--	}
--#endif
--
- 	/* BSS */
- 	. = ALIGN(PAGE_SIZE);
- 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
-@@ -288,6 +357,7 @@ SECTIONS
- 		__brk_base = .;
- 		. += 64 * 1024;		/* 64k alignment slop space */
- 		*(.brk_reservation)	/* areas brk users have reserved */
-+		. = ALIGN(PMD_SIZE);
- 		__brk_limit = .;
- 	}
- 
-@@ -316,13 +386,12 @@ SECTIONS
-  * for the boot processor.
-  */
- #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
--INIT_PER_CPU(gdt_page);
- INIT_PER_CPU(irq_stack_union);
- 
- /*
-  * Build-time check on the image size:
-  */
--. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
-+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
- 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
- 
- #ifdef CONFIG_SMP
-diff -urNp linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/vsyscall_64.c	2010-05-15 13:21:14.162641857 -0400
-@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
- 
- 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
- 	/* copy vsyscall data */
-+	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
- 	vsyscall_gtod_data.clock.vread = clock->vread;
- 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
- 	vsyscall_gtod_data.clock.mask = clock->mask;
-@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
- 	   We do this here because otherwise user space would do it on
- 	   its own in a likely inferior way (no access to jiffies).
- 	   If you don't like it pass NULL. */
--	if (tcache && tcache->blob[0] == (j = __jiffies)) {
-+	if (tcache && tcache->blob[0] == (j = jiffies)) {
- 		p = tcache->blob[1];
- 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
- 		/* Load per CPU data from RDTSCP */
-@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
- 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
- 	  .mode = 0644,
- 	  .proc_handler = proc_dointvec },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table kernel_root_table2[] = {
- 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
- 	  .child = kernel_table2 },
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/x8664_ksyms_64.c	2010-05-15 13:21:14.162641857 -0400
-@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
- 
- EXPORT_SYMBOL(copy_user_generic);
- EXPORT_SYMBOL(__copy_user_nocache);
--EXPORT_SYMBOL(copy_from_user);
--EXPORT_SYMBOL(copy_to_user);
- EXPORT_SYMBOL(__copy_from_user_inatomic);
- 
- EXPORT_SYMBOL(copy_page);
-diff -urNp linux-2.6.32.13/arch/x86/kernel/xsave.c linux-2.6.32.13/arch/x86/kernel/xsave.c
---- linux-2.6.32.13/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kernel/xsave.c	2010-05-15 13:21:14.162641857 -0400
-@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
- 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
- 		return -1;
- 
--	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
-+	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
- 					    fx_sw_user->extended_size -
- 					    FP_XSTATE_MAGIC2_SIZE));
- 	/*
-@@ -196,7 +196,7 @@ fx_only:
- 	 * the other extended state.
- 	 */
- 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
--	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
-+	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
- }
- 
- /*
-@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
- 	if (task_thread_info(tsk)->status & TS_XSAVE)
- 		err = restore_user_xstate(buf);
- 	else
--		err = fxrstor_checking((__force struct i387_fxsave_struct *)
-+		err = fxrstor_checking((struct i387_fxsave_struct __user *)
- 				       buf);
- 	if (unlikely(err)) {
- 		/*
-diff -urNp linux-2.6.32.13/arch/x86/kvm/emulate.c linux-2.6.32.13/arch/x86/kvm/emulate.c
---- linux-2.6.32.13/arch/x86/kvm/emulate.c	2010-04-29 17:49:37.541027029 -0400
-+++ linux-2.6.32.13/arch/x86/kvm/emulate.c	2010-05-15 13:21:14.178920275 -0400
-@@ -81,8 +81,8 @@
- #define Src2CL      (1<<29)
- #define Src2ImmByte (2<<29)
- #define Src2One     (3<<29)
--#define Src2Imm16   (4<<29)
--#define Src2Mask    (7<<29)
-+#define Src2Imm16   (4U<<29)
-+#define Src2Mask    (7U<<29)
- 
- enum {
- 	Group1_80, Group1_81, Group1_82, Group1_83,
-@@ -411,6 +411,7 @@ static u32 group2_table[] = {
- 
- #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
- 	do {								\
-+		unsigned long _tmp;					\
- 		__asm__ __volatile__ (					\
- 			_PRE_EFLAGS("0", "4", "2")			\
- 			_op _suffix " %"_x"3,%1; "			\
-@@ -424,8 +425,6 @@ static u32 group2_table[] = {
- /* Raw emulation: instruction has two explicit operands. */
- #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								\
--		unsigned long _tmp;					\
--									\
- 		switch ((_dst).bytes) {					\
- 		case 2:							\
- 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
-@@ -441,7 +440,6 @@ static u32 group2_table[] = {
- 
- #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
- 	do {								     \
--		unsigned long _tmp;					     \
- 		switch ((_dst).bytes) {				             \
- 		case 1:							     \
- 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
-diff -urNp linux-2.6.32.13/arch/x86/kvm/lapic.c linux-2.6.32.13/arch/x86/kvm/lapic.c
---- linux-2.6.32.13/arch/x86/kvm/lapic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/kvm/lapic.c	2010-05-15 13:21:14.186649754 -0400
-@@ -52,7 +52,7 @@
- #define APIC_BUS_CYCLE_NS 1
- 
- /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
--#define apic_debug(fmt, arg...)
-+#define apic_debug(fmt, arg...) do {} while (0)
- 
- #define APIC_LVT_NUM			6
- /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff -urNp linux-2.6.32.13/arch/x86/kvm/svm.c linux-2.6.32.13/arch/x86/kvm/svm.c
---- linux-2.6.32.13/arch/x86/kvm/svm.c	2010-04-29 17:49:37.601044544 -0400
-+++ linux-2.6.32.13/arch/x86/kvm/svm.c	2010-05-15 13:21:14.206681110 -0400
-@@ -2395,9 +2395,12 @@ static int handle_exit(struct kvm_run *k
- static void reload_tss(struct kvm_vcpu *vcpu)
- {
- 	int cpu = raw_smp_processor_id();
--
- 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
-+
-+	pax_open_kernel();
- 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -2845,7 +2848,7 @@ static bool svm_gb_page_enable(void)
- 	return true;
- }
- 
--static struct kvm_x86_ops svm_x86_ops = {
-+static const struct kvm_x86_ops svm_x86_ops = {
- 	.cpu_has_kvm_support = has_svm,
- 	.disabled_by_bios = is_disabled,
- 	.hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.32.13/arch/x86/kvm/vmx.c linux-2.6.32.13/arch/x86/kvm/vmx.c
---- linux-2.6.32.13/arch/x86/kvm/vmx.c	2010-04-29 17:49:37.601044544 -0400
-+++ linux-2.6.32.13/arch/x86/kvm/vmx.c	2010-05-15 13:23:38.934774262 -0400
-@@ -568,7 +568,11 @@ static void reload_tss(void)
- 
- 	kvm_get_gdt(&gdt);
- 	descs = (void *)gdt.base;
-+
-+	pax_open_kernel();
- 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
-+	pax_close_kernel();
-+
- 	load_TR_desc();
- }
- 
-@@ -1395,8 +1399,11 @@ static __init int hardware_setup(void)
- 	if (!cpu_has_vmx_flexpriority())
- 		flexpriority_enabled = 0;
- 
--	if (!cpu_has_vmx_tpr_shadow())
--		kvm_x86_ops->update_cr8_intercept = NULL;
-+	if (!cpu_has_vmx_tpr_shadow()) {
-+		pax_open_kernel();
-+		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
-+		pax_close_kernel();
-+	}
- 
- 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
- 		kvm_disable_largepages();
-@@ -2347,7 +2354,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
- 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
- 
- 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
--	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
-+	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
- 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
- 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
- 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
-@@ -3703,6 +3710,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		"jmp .Lkvm_vmx_return \n\t"
- 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
- 		".Lkvm_vmx_return: "
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
-+		".Lkvm_vmx_return2: "
-+#endif
-+
- 		/* Save guest registers, load host registers, keep flags */
- 		"xchg %0,     (%%"R"sp) \n\t"
- 		"mov %%"R"ax, %c[rax](%0) \n\t"
-@@ -3749,8 +3762,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
- #endif
- 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		,[cs]"i"(__KERNEL_CS)
-+#endif
-+
- 	      : "cc", "memory"
--		, R"bx", R"di", R"si"
-+		, R"ax", R"bx", R"di", R"si"
- #ifdef CONFIG_X86_64
- 		, "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
- #endif
-@@ -3767,7 +3785,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
- 	if (vmx->rmode.irq.pending)
- 		fixup_rmode_irq(vmx);
- 
--	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
-+	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
- 	vmx->launched = 1;
- 
- 	vmx_complete_interrupts(vmx);
-@@ -3942,7 +3960,7 @@ static bool vmx_gb_page_enable(void)
- 	return false;
- }
- 
--static struct kvm_x86_ops vmx_x86_ops = {
-+static const struct kvm_x86_ops vmx_x86_ops = {
- 	.cpu_has_kvm_support = cpu_has_kvm_support,
- 	.disabled_by_bios = vmx_disabled_by_bios,
- 	.hardware_setup = hardware_setup,
-diff -urNp linux-2.6.32.13/arch/x86/kvm/x86.c linux-2.6.32.13/arch/x86/kvm/x86.c
---- linux-2.6.32.13/arch/x86/kvm/x86.c	2010-05-15 13:20:18.454567530 -0400
-+++ linux-2.6.32.13/arch/x86/kvm/x86.c	2010-05-15 13:21:14.230911822 -0400
-@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
- static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
- 				    struct kvm_cpuid_entry2 __user *entries);
- 
--struct kvm_x86_ops *kvm_x86_ops;
-+const struct kvm_x86_ops *kvm_x86_ops;
- EXPORT_SYMBOL_GPL(kvm_x86_ops);
- 
- int ignore_msrs = 0;
- module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
- 
- struct kvm_stats_debugfs_item debugfs_entries[] = {
--	{ "pf_fixed", VCPU_STAT(pf_fixed) },
--	{ "pf_guest", VCPU_STAT(pf_guest) },
--	{ "tlb_flush", VCPU_STAT(tlb_flush) },
--	{ "invlpg", VCPU_STAT(invlpg) },
--	{ "exits", VCPU_STAT(exits) },
--	{ "io_exits", VCPU_STAT(io_exits) },
--	{ "mmio_exits", VCPU_STAT(mmio_exits) },
--	{ "signal_exits", VCPU_STAT(signal_exits) },
--	{ "irq_window", VCPU_STAT(irq_window_exits) },
--	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
--	{ "halt_exits", VCPU_STAT(halt_exits) },
--	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
--	{ "hypercalls", VCPU_STAT(hypercalls) },
--	{ "request_irq", VCPU_STAT(request_irq_exits) },
--	{ "irq_exits", VCPU_STAT(irq_exits) },
--	{ "host_state_reload", VCPU_STAT(host_state_reload) },
--	{ "efer_reload", VCPU_STAT(efer_reload) },
--	{ "fpu_reload", VCPU_STAT(fpu_reload) },
--	{ "insn_emulation", VCPU_STAT(insn_emulation) },
--	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
--	{ "irq_injections", VCPU_STAT(irq_injections) },
--	{ "nmi_injections", VCPU_STAT(nmi_injections) },
--	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
--	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
--	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
--	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
--	{ "mmu_flooded", VM_STAT(mmu_flooded) },
--	{ "mmu_recycled", VM_STAT(mmu_recycled) },
--	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
--	{ "mmu_unsync", VM_STAT(mmu_unsync) },
--	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
--	{ "largepages", VM_STAT(lpages) },
-+	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
-+	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
-+	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
-+	{ "invlpg", VCPU_STAT(invlpg), NULL },
-+	{ "exits", VCPU_STAT(exits), NULL },
-+	{ "io_exits", VCPU_STAT(io_exits), NULL },
-+	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
-+	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
-+	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
-+	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
-+	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
-+	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
-+	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
-+	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
-+	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
-+	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
-+	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
-+	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
-+	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
-+	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
-+	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
-+	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
-+	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
-+	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
-+	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
-+	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
-+	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
-+	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
-+	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
-+	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
-+	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
-+	{ "largepages", VM_STAT(lpages), NULL },
- 	{ NULL }
- };
- 
-@@ -1635,7 +1635,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
- static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
- 				    struct kvm_interrupt *irq)
- {
--	if (irq->irq < 0 || irq->irq >= 256)
-+	if (irq->irq >= 256)
- 		return -EINVAL;
- 	if (irqchip_in_kernel(vcpu->kvm))
- 		return -ENXIO;
-@@ -3205,10 +3205,10 @@ static struct notifier_block kvmclock_cp
-         .notifier_call  = kvmclock_cpufreq_notifier
- };
- 
--int kvm_arch_init(void *opaque)
-+int kvm_arch_init(const void *opaque)
- {
- 	int r, cpu;
--	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-+	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
- 
- 	if (kvm_x86_ops) {
- 		printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.32.13/arch/x86/lib/checksum_32.S linux-2.6.32.13/arch/x86/lib/checksum_32.S
---- linux-2.6.32.13/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/checksum_32.S	2010-05-15 13:21:14.230911822 -0400
-@@ -28,7 +28,8 @@
- #include <linux/linkage.h>
- #include <asm/dwarf2.h>
- #include <asm/errno.h>
--				
-+#include <asm/segment.h>
-+
- /*
-  * computes a partial checksum, e.g. for TCP/UDP fragments
-  */
-@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
- 
- #define ARGBASE 16		
- #define FP		12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	subl  $4,%esp	
- 	CFI_ADJUST_CFA_OFFSET 4
- 	pushl %edi
-@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
- 	jmp 4f
- SRC(1:	movw (%esi), %bx	)
- 	addl $2, %esi
--DST(	movw %bx, (%edi)	)
-+DST(	movw %bx, %es:(%edi)	)
- 	addl $2, %edi
- 	addw %bx, %ax	
- 	adcl $0, %eax
-@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
- SRC(1:	movl (%esi), %ebx	)
- SRC(	movl 4(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 4(%edi)	)
-+DST(	movl %edx, %es:4(%edi)	)
- 
- SRC(	movl 8(%esi), %ebx	)
- SRC(	movl 12(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 8(%edi)	)
-+DST(	movl %ebx, %es:8(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 12(%edi)	)
-+DST(	movl %edx, %es:12(%edi)	)
- 
- SRC(	movl 16(%esi), %ebx 	)
- SRC(	movl 20(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 16(%edi)	)
-+DST(	movl %ebx, %es:16(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 20(%edi)	)
-+DST(	movl %edx, %es:20(%edi)	)
- 
- SRC(	movl 24(%esi), %ebx	)
- SRC(	movl 28(%esi), %edx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, 24(%edi)	)
-+DST(	movl %ebx, %es:24(%edi)	)
- 	adcl %edx, %eax
--DST(	movl %edx, 28(%edi)	)
-+DST(	movl %edx, %es:28(%edi)	)
- 
- 	lea 32(%esi), %esi
- 	lea 32(%edi), %edi
-@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
- 	shrl $2, %edx			# This clears CF
- SRC(3:	movl (%esi), %ebx	)
- 	adcl %ebx, %eax
--DST(	movl %ebx, (%edi)	)
-+DST(	movl %ebx, %es:(%edi)	)
- 	lea 4(%esi), %esi
- 	lea 4(%edi), %edi
- 	dec %edx
-@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
- 	jb 5f
- SRC(	movw (%esi), %cx	)
- 	leal 2(%esi), %esi
--DST(	movw %cx, (%edi)	)
-+DST(	movw %cx, %es:(%edi)	)
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%ecx
- SRC(5:	movb (%esi), %cl	)
--DST(	movb %cl, (%edi)	)
-+DST(	movb %cl, %es:(%edi)	)
- 6:	addl %ecx, %eax
- 	adcl $0, %eax
- 7:
-@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
- 
- 6001:
- 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 
- 	# zero the complete destination - computing the rest
- 	# is too much work 
-@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
- 
- 6002:
- 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT,(%ebx)
-+	movl $-EFAULT,%ss:(%ebx)
- 	jmp 5000b
- 
- .previous
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %ebx
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE ebx
-@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
- 	CFI_ADJUST_CFA_OFFSET -4
- 	ret	
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 
- #else
- 
- /* Version for PentiumII/PPro */
- 
- #define ROUND1(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	addl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	; 
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ROUND(x) \
-+	nop; nop; nop;				\
- 	SRC(movl x(%esi), %ebx	)	;	\
- 	adcl %ebx, %eax			;	\
--	DST(movl %ebx, x(%edi)	)	;
-+	DST(movl %ebx, %es:x(%edi))	;
- 
- #define ARGBASE 12
--		
--ENTRY(csum_partial_copy_generic)
-+
-+ENTRY(csum_partial_copy_generic_to_user)
- 	CFI_STARTPROC
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
-+	jmp csum_partial_copy_generic
-+
-+ENTRY(csum_partial_copy_generic_from_user)
-+	pushl $(__USER_DS)
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+
-+ENTRY(csum_partial_copy_generic)
- 	pushl %ebx
- 	CFI_ADJUST_CFA_OFFSET 4
- 	CFI_REL_OFFSET ebx, 0
-@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
- 	subl %ebx, %edi  
- 	lea  -1(%esi),%edx
- 	andl $-32,%edx
--	lea 3f(%ebx,%ebx), %ebx
-+	lea 3f(%ebx,%ebx,2), %ebx
- 	testl %esi, %esi 
- 	jmp *%ebx
- 1:	addl $64,%esi
-@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
- 	jb 5f
- SRC(	movw (%esi), %dx         )
- 	leal 2(%esi), %esi
--DST(	movw %dx, (%edi)         )
-+DST(	movw %dx, %es:(%edi)     )
- 	leal 2(%edi), %edi
- 	je 6f
- 	shll $16,%edx
- 5:
- SRC(	movb (%esi), %dl         )
--DST(	movb %dl, (%edi)         )
-+DST(	movb %dl, %es:(%edi)     )
- 6:	addl %edx, %eax
- 	adcl $0, %eax
- 7:
- .section .fixup, "ax"
- 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	# zero the complete destination (computing the rest is too much work)
- 	movl ARGBASE+8(%esp),%edi	# dst
- 	movl ARGBASE+12(%esp),%ecx	# len
-@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
- 	rep; stosb
- 	jmp 7b
- 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
--	movl $-EFAULT, (%ebx)
-+	movl $-EFAULT, %ss:(%ebx)
- 	jmp  7b			
- .previous				
- 
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %ds
-+	CFI_ADJUST_CFA_OFFSET -4
-+	pushl %ss
-+	CFI_ADJUST_CFA_OFFSET 4
-+	popl %es
-+	CFI_ADJUST_CFA_OFFSET -4
- 	popl %esi
- 	CFI_ADJUST_CFA_OFFSET -4
- 	CFI_RESTORE esi
-@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
- 	CFI_RESTORE ebx
- 	ret
- 	CFI_ENDPROC
--ENDPROC(csum_partial_copy_generic)
-+ENDPROC(csum_partial_copy_generic_to_user)
- 				
- #undef ROUND
- #undef ROUND1		
-diff -urNp linux-2.6.32.13/arch/x86/lib/clear_page_64.S linux-2.6.32.13/arch/x86/lib/clear_page_64.S
---- linux-2.6.32.13/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/clear_page_64.S	2010-05-15 13:21:14.230911822 -0400
-@@ -43,7 +43,7 @@ ENDPROC(clear_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.13/arch/x86/lib/copy_page_64.S linux-2.6.32.13/arch/x86/lib/copy_page_64.S
---- linux-2.6.32.13/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/copy_page_64.S	2010-05-15 13:21:14.230911822 -0400
-@@ -104,7 +104,7 @@ ENDPROC(copy_page)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb					/* jmp <disp8> */
- 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.13/arch/x86/lib/copy_user_64.S linux-2.6.32.13/arch/x86/lib/copy_user_64.S
---- linux-2.6.32.13/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/copy_user_64.S	2010-05-15 13:21:14.234766826 -0400
-@@ -15,13 +15,14 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/cpufeature.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALTERNATIVE_JUMP feature,orig,alt
- 0:
- 	.byte 0xe9	/* 32bit jump */
- 	.long \orig-1f	/* by default jump to orig */
- 1:
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 2:	.byte 0xe9			/* near jump with 32bit immediate */
- 	.long \alt-1b /* offset */   /* or alternatively to alt */
- 	.previous
-@@ -64,32 +65,6 @@
- #endif
- 	.endm
- 
--/* Standard copy_to_user with segment limit checking */
--ENTRY(copy_to_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rdi,%rcx
--	addq %rdx,%rcx
--	jc bad_to_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_to_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_to_user)
--
--/* Standard copy_from_user with segment limit checking */
--ENTRY(copy_from_user)
--	CFI_STARTPROC
--	GET_THREAD_INFO(%rax)
--	movq %rsi,%rcx
--	addq %rdx,%rcx
--	jc bad_from_user
--	cmpq TI_addr_limit(%rax),%rcx
--	jae bad_from_user
--	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
--	CFI_ENDPROC
--ENDPROC(copy_from_user)
--
- ENTRY(copy_user_generic)
- 	CFI_STARTPROC
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
- 
- ENTRY(__copy_from_user_inatomic)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
- 	CFI_ENDPROC
- ENDPROC(__copy_from_user_inatomic)
-@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
- ENTRY(bad_from_user)
- bad_from_user:
- 	CFI_STARTPROC
-+	testl %edx,%edx
-+	js bad_to_user
- 	movl %edx,%ecx
- 	xorl %eax,%eax
- 	rep
-diff -urNp linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/copy_user_nocache_64.S	2010-05-15 13:21:14.234766826 -0400
-@@ -14,6 +14,7 @@
- #include <asm/current.h>
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
-+#include <asm/pgtable.h>
- 
- 	.macro ALIGN_DESTINATION
- #ifdef FIX_ALIGNMENT
-@@ -50,6 +51,15 @@
-  */
- ENTRY(__copy_user_nocache)
- 	CFI_STARTPROC
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%rcx
-+	cmp %rcx,%rsi
-+	jae 1f
-+	add %rcx,%rsi
-+1:
-+#endif
-+
- 	cmpl $8,%edx
- 	jb 20f		/* less then 8 bytes, go to byte copy loop */
- 	ALIGN_DESTINATION
-diff -urNp linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/csum-wrappers_64.c	2010-05-15 13:21:14.234766826 -0400
-@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
- 			len -= 2;
- 		}
- 	}
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	isum = csum_partial_copy_generic((__force const void *)src,
- 				dst, len, isum, errp, NULL);
- 	if (unlikely(*errp))
-@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
- 	}
- 
- 	*errp = 0;
-+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
-+		dst += PAX_USER_SHADOW_BASE;
- 	return csum_partial_copy_generic(src, (void __force *)dst,
- 					 len, isum, NULL, errp);
- }
-diff -urNp linux-2.6.32.13/arch/x86/lib/getuser.S linux-2.6.32.13/arch/x86/lib/getuser.S
---- linux-2.6.32.13/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/getuser.S	2010-05-15 13:21:14.234766826 -0400
-@@ -33,14 +33,38 @@
- #include <asm/asm-offsets.h>
- #include <asm/thread_info.h>
- #include <asm/asm.h>
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- 	.text
- ENTRY(__get_user_1)
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movzb (%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
- ENTRY(__get_user_2)
- 	CFI_STARTPROC
- 	add $1,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movzwl -1(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
- ENTRY(__get_user_4)
- 	CFI_STARTPROC
- 	add $3,%_ASM_AX
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
- 	jc bad_get_user
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae bad_get_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	mov -3(%_ASM_AX),%edx
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %eax,%eax
- 	ret
- 	CFI_ENDPROC
-@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
- 	GET_THREAD_INFO(%_ASM_DX)
- 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
- 	jae	bad_get_user
-+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
-+	cmp %_ASM_DX,%_ASM_AX
-+	jae 1234f
-+	add %_ASM_DX,%_ASM_AX
-+1234:
-+#endif
-+
- 4:	movq -7(%_ASM_AX),%_ASM_DX
- 	xor %eax,%eax
- 	ret
-@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
- 
- bad_get_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	pop %ds
-+#endif
-+
- 	xor %edx,%edx
- 	mov $(-EFAULT),%_ASM_AX
- 	ret
-diff -urNp linux-2.6.32.13/arch/x86/lib/memcpy_64.S linux-2.6.32.13/arch/x86/lib/memcpy_64.S
---- linux-2.6.32.13/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/memcpy_64.S	2010-05-15 13:21:14.234766826 -0400
-@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
- 	 * It is also a lot simpler. Use this when possible:
- 	 */
- 
--	.section .altinstr_replacement, "ax"
-+	.section .altinstr_replacement, "a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.13/arch/x86/lib/memset_64.S linux-2.6.32.13/arch/x86/lib/memset_64.S
---- linux-2.6.32.13/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/memset_64.S	2010-05-15 13:21:14.234766826 -0400
-@@ -118,7 +118,7 @@ ENDPROC(__memset)
- 
- #include <asm/cpufeature.h>
- 
--	.section .altinstr_replacement,"ax"
-+	.section .altinstr_replacement,"a"
- 1:	.byte 0xeb				/* jmp <disp8> */
- 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
- 2:
-diff -urNp linux-2.6.32.13/arch/x86/lib/mmx_32.c linux-2.6.32.13/arch/x86/lib/mmx_32.c
---- linux-2.6.32.13/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/mmx_32.c	2010-05-15 13:21:14.234766826 -0400
-@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
- {
- 	void *p;
- 	int i;
-+	unsigned long cr0;
- 
- 	if (unlikely(in_interrupt()))
- 		return __memcpy(to, from, len);
-@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"		/* This set is 28 bytes */
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"		/* This set is 28 bytes */
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from));
-+			: "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for ( ; i > 5; i--) {
- 		__asm__ __volatile__ (
--		"1:  prefetch 320(%0)\n"
--		"2:  movq (%0), %%mm0\n"
--		"  movq 8(%0), %%mm1\n"
--		"  movq 16(%0), %%mm2\n"
--		"  movq 24(%0), %%mm3\n"
--		"  movq %%mm0, (%1)\n"
--		"  movq %%mm1, 8(%1)\n"
--		"  movq %%mm2, 16(%1)\n"
--		"  movq %%mm3, 24(%1)\n"
--		"  movq 32(%0), %%mm0\n"
--		"  movq 40(%0), %%mm1\n"
--		"  movq 48(%0), %%mm2\n"
--		"  movq 56(%0), %%mm3\n"
--		"  movq %%mm0, 32(%1)\n"
--		"  movq %%mm1, 40(%1)\n"
--		"  movq %%mm2, 48(%1)\n"
--		"  movq %%mm3, 56(%1)\n"
-+		"1:  prefetch 320(%1)\n"
-+		"2:  movq (%1), %%mm0\n"
-+		"  movq 8(%1), %%mm1\n"
-+		"  movq 16(%1), %%mm2\n"
-+		"  movq 24(%1), %%mm3\n"
-+		"  movq %%mm0, (%2)\n"
-+		"  movq %%mm1, 8(%2)\n"
-+		"  movq %%mm2, 16(%2)\n"
-+		"  movq %%mm3, 24(%2)\n"
-+		"  movq 32(%1), %%mm0\n"
-+		"  movq 40(%1), %%mm1\n"
-+		"  movq 48(%1), %%mm2\n"
-+		"  movq 56(%1), %%mm3\n"
-+		"  movq %%mm0, 32(%2)\n"
-+		"  movq %%mm1, 40(%2)\n"
-+		"  movq %%mm2, 48(%2)\n"
-+		"  movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
-@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
- 	 * but that is for later. -AV
- 	 */
- 	__asm__ __volatile__(
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < (4096-320)/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movntq %%mm0, (%1)\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movntq %%mm1, 8(%1)\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movntq %%mm2, 16(%1)\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movntq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm4\n"
--		"   movntq %%mm4, 32(%1)\n"
--		"   movq 40(%0), %%mm5\n"
--		"   movntq %%mm5, 40(%1)\n"
--		"   movq 48(%0), %%mm6\n"
--		"   movntq %%mm6, 48(%1)\n"
--		"   movq 56(%0), %%mm7\n"
--		"   movntq %%mm7, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movntq %%mm0, (%2)\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movntq %%mm1, 8(%2)\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movntq %%mm2, 16(%2)\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movntq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm4\n"
-+		"   movntq %%mm4, 32(%2)\n"
-+		"   movq 40(%1), %%mm5\n"
-+		"   movntq %%mm5, 40(%2)\n"
-+		"   movq 48(%1), %%mm6\n"
-+		"   movntq %%mm6, 48(%2)\n"
-+		"   movq 56(%1), %%mm7\n"
-+		"   movntq %%mm7, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
-+		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
- static void fast_copy_page(void *to, void *from)
- {
- 	int i;
-+	unsigned long cr0;
- 
- 	kernel_fpu_begin();
- 
- 	__asm__ __volatile__ (
--		"1: prefetch (%0)\n"
--		"   prefetch 64(%0)\n"
--		"   prefetch 128(%0)\n"
--		"   prefetch 192(%0)\n"
--		"   prefetch 256(%0)\n"
-+		"1: prefetch (%1)\n"
-+		"   prefetch 64(%1)\n"
-+		"   prefetch 128(%1)\n"
-+		"   prefetch 192(%1)\n"
-+		"   prefetch 256(%1)\n"
- 		"2:  \n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+		"3:  \n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
--			_ASM_EXTABLE(1b, 3b) : : "r" (from));
-+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
- 
- 	for (i = 0; i < 4096/64; i++) {
- 		__asm__ __volatile__ (
--		"1: prefetch 320(%0)\n"
--		"2: movq (%0), %%mm0\n"
--		"   movq 8(%0), %%mm1\n"
--		"   movq 16(%0), %%mm2\n"
--		"   movq 24(%0), %%mm3\n"
--		"   movq %%mm0, (%1)\n"
--		"   movq %%mm1, 8(%1)\n"
--		"   movq %%mm2, 16(%1)\n"
--		"   movq %%mm3, 24(%1)\n"
--		"   movq 32(%0), %%mm0\n"
--		"   movq 40(%0), %%mm1\n"
--		"   movq 48(%0), %%mm2\n"
--		"   movq 56(%0), %%mm3\n"
--		"   movq %%mm0, 32(%1)\n"
--		"   movq %%mm1, 40(%1)\n"
--		"   movq %%mm2, 48(%1)\n"
--		"   movq %%mm3, 56(%1)\n"
-+		"1: prefetch 320(%1)\n"
-+		"2: movq (%1), %%mm0\n"
-+		"   movq 8(%1), %%mm1\n"
-+		"   movq 16(%1), %%mm2\n"
-+		"   movq 24(%1), %%mm3\n"
-+		"   movq %%mm0, (%2)\n"
-+		"   movq %%mm1, 8(%2)\n"
-+		"   movq %%mm2, 16(%2)\n"
-+		"   movq %%mm3, 24(%2)\n"
-+		"   movq 32(%1), %%mm0\n"
-+		"   movq 40(%1), %%mm1\n"
-+		"   movq 48(%1), %%mm2\n"
-+		"   movq 56(%1), %%mm3\n"
-+		"   movq %%mm0, 32(%2)\n"
-+		"   movq %%mm1, 40(%2)\n"
-+		"   movq %%mm2, 48(%2)\n"
-+		"   movq %%mm3, 56(%2)\n"
- 		".section .fixup, \"ax\"\n"
--		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+		"3:\n"
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %%cr0, %0\n"
-+		"   movl %0, %%eax\n"
-+		"   andl $0xFFFEFFFF, %%eax\n"
-+		"   movl %%eax, %%cr0\n"
-+#endif
-+
-+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		"   movl %0, %%cr0\n"
-+#endif
-+
- 		"   jmp 2b\n"
- 		".previous\n"
- 			_ASM_EXTABLE(1b, 3b)
--			: : "r" (from), "r" (to) : "memory");
-+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
- 
- 		from += 64;
- 		to += 64;
-diff -urNp linux-2.6.32.13/arch/x86/lib/putuser.S linux-2.6.32.13/arch/x86/lib/putuser.S
---- linux-2.6.32.13/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/putuser.S	2010-05-15 13:21:14.234766826 -0400
-@@ -15,7 +15,8 @@
- #include <asm/thread_info.h>
- #include <asm/errno.h>
- #include <asm/asm.h>
--
-+#include <asm/segment.h>
-+#include <asm/pgtable.h>
- 
- /*
-  * __put_user_X
-@@ -29,59 +30,156 @@
-  * as they get called from within inline assembly.
-  */
- 
--#define ENTER	CFI_STARTPROC ; \
--		GET_THREAD_INFO(%_ASM_BX)
-+#define ENTER	CFI_STARTPROC
- #define EXIT	ret ; \
- 		CFI_ENDPROC
- 
- .text
- ENTRY(__put_user_1)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 1:	movb %al,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_1)
- 
- ENTRY(__put_user_2)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $1,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 2:	movw %ax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_2)
- 
- ENTRY(__put_user_4)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $3,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 3:	movl %eax,(%_ASM_CX)
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_4)
- 
- ENTRY(__put_user_8)
- 	ENTER
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl $(__USER_DS)
-+	popl %ds
-+#else
-+	GET_THREAD_INFO(%_ASM_BX)
- 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
- 	sub $7,%_ASM_BX
- 	cmp %_ASM_BX,%_ASM_CX
- 	jae bad_put_user
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
-+	cmp %_ASM_BX,%_ASM_CX
-+	jae 1234f
-+	add %_ASM_BX,%_ASM_CX
-+1234:
-+#endif
-+
-+#endif
-+
- 4:	mov %_ASM_AX,(%_ASM_CX)
- #ifdef CONFIG_X86_32
- 5:	movl %edx,4(%_ASM_CX)
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	xor %eax,%eax
- 	EXIT
- ENDPROC(__put_user_8)
- 
- bad_put_user:
- 	CFI_STARTPROC
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	pushl %ss
-+	popl %ds
-+#endif
-+
- 	movl $-EFAULT,%eax
- 	EXIT
- END(bad_put_user)
-diff -urNp linux-2.6.32.13/arch/x86/lib/usercopy_32.c linux-2.6.32.13/arch/x86/lib/usercopy_32.c
---- linux-2.6.32.13/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/usercopy_32.c	2010-05-15 13:21:14.234766826 -0400
-@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
-  * Copy a null terminated string from userspace.
-  */
- 
--#define __do_strncpy_from_user(dst, src, count, res)			   \
--do {									   \
--	int __d0, __d1, __d2;						   \
--	might_fault();							   \
--	__asm__ __volatile__(						   \
--		"	testl %1,%1\n"					   \
--		"	jz 2f\n"					   \
--		"0:	lodsb\n"					   \
--		"	stosb\n"					   \
--		"	testb %%al,%%al\n"				   \
--		"	jz 1f\n"					   \
--		"	decl %1\n"					   \
--		"	jnz 0b\n"					   \
--		"1:	subl %1,%0\n"					   \
--		"2:\n"							   \
--		".section .fixup,\"ax\"\n"				   \
--		"3:	movl %5,%0\n"					   \
--		"	jmp 2b\n"					   \
--		".previous\n"						   \
--		_ASM_EXTABLE(0b,3b)					   \
--		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
--		  "=&D" (__d2)						   \
--		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
--		: "memory");						   \
--} while (0)
-+static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
-+{
-+	int __d0, __d1, __d2;
-+	long res = -EFAULT;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w10,%%ds\n"
-+		"	testl %1,%1\n"
-+		"	jz 2f\n"
-+		"0:	lodsb\n"
-+		"	stosb\n"
-+		"	testb %%al,%%al\n"
-+		"	jz 1f\n"
-+		"	decl %1\n"
-+		"	jnz 0b\n"
-+		"1:	subl %1,%0\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	movl %5,%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
-+		  "=&D" (__d2)
-+		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
-+		  "r"(__USER_DS)
-+		: "memory");
-+	return res;
-+}
- 
- /**
-  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
-@@ -85,9 +92,7 @@ do {									   \
- long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
--	long res;
--	__do_strncpy_from_user(dst, src, count, res);
--	return res;
-+	return __do_strncpy_from_user(dst, src, count);
- }
- EXPORT_SYMBOL(__strncpy_from_user);
- 
-@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
--		__do_strncpy_from_user(dst, src, count, res);
-+		res = __do_strncpy_from_user(dst, src, count);
- 	return res;
- }
- EXPORT_SYMBOL(strncpy_from_user);
-@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
-  * Zero Userspace
-  */
- 
--#define __do_clear_user(addr,size)					\
--do {									\
--	int __d0;							\
--	might_fault();							\
--	__asm__ __volatile__(						\
--		"0:	rep; stosl\n"					\
--		"	movl %2,%0\n"					\
--		"1:	rep; stosb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"3:	lea 0(%2,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		_ASM_EXTABLE(0b,3b)					\
--		_ASM_EXTABLE(1b,2b)					\
--		: "=&c"(size), "=&D" (__d0)				\
--		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
--} while (0)
-+static unsigned long __do_clear_user(void __user *addr, unsigned long size)
-+{
-+	int __d0;
-+
-+	might_fault();
-+	__asm__ __volatile__(
-+		"	movw %w6,%%es\n"
-+		"0:	rep; stosl\n"
-+		"	movl %2,%0\n"
-+		"1:	rep; stosb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"3:	lea 0(%2,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		_ASM_EXTABLE(0b,3b)
-+		_ASM_EXTABLE(1b,2b)
-+		: "=&c"(size), "=&D" (__d0)
-+		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
-+		  "r"(__USER_DS));
-+	return size;
-+}
- 
- /**
-  * clear_user: - Zero a block of memory in user space.
-@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
- {
- 	might_fault();
- 	if (access_ok(VERIFY_WRITE, to, n))
--		__do_clear_user(to, n);
-+		n = __do_clear_user(to, n);
- 	return n;
- }
- EXPORT_SYMBOL(clear_user);
-@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
- unsigned long
- __clear_user(void __user *to, unsigned long n)
- {
--	__do_clear_user(to, n);
--	return n;
-+	return __do_clear_user(to, n);
- }
- EXPORT_SYMBOL(__clear_user);
- 
-@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
- 	might_fault();
- 
- 	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
- 		"	testl %0, %0\n"
- 		"	jz 3f\n"
--		"	andl %0,%%ecx\n"
-+		"	movl %0,%%ecx\n"
- 		"0:	repne; scasb\n"
- 		"	setne %%al\n"
- 		"	subl %%ecx,%0\n"
- 		"	addl %0,%%eax\n"
- 		"1:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
- 		".section .fixup,\"ax\"\n"
- 		"2:	xorl %%eax,%%eax\n"
- 		"	jmp 1b\n"
-@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
- 		"	.long 0b,2b\n"
- 		".previous"
- 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
--		:"0" (n), "1" (s), "2" (0), "3" (mask)
-+		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
- 		:"cc");
- 	return res & mask;
- }
-@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
- 
- #ifdef CONFIG_X86_INTEL_USERCOPY
- static unsigned long
--__copy_user_intel(void __user *to, const void *from, unsigned long size)
-+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "       movw %w6, %%es\n"
- 		       "       .align 2,0x90\n"
- 		       "1:     movl 32(%4), %%eax\n"
- 		       "       cmpl $67, %0\n"
-@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
- 		       "       .align 2,0x90\n"
- 		       "3:     movl 0(%4), %%eax\n"
- 		       "4:     movl 4(%4), %%edx\n"
--		       "5:     movl %%eax, 0(%3)\n"
--		       "6:     movl %%edx, 4(%3)\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
- 		       "7:     movl 8(%4), %%eax\n"
- 		       "8:     movl 12(%4),%%edx\n"
--		       "9:     movl %%eax, 8(%3)\n"
--		       "10:    movl %%edx, 12(%3)\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
- 		       "11:    movl 16(%4), %%eax\n"
- 		       "12:    movl 20(%4), %%edx\n"
--		       "13:    movl %%eax, 16(%3)\n"
--		       "14:    movl %%edx, 20(%3)\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
- 		       "15:    movl 24(%4), %%eax\n"
- 		       "16:    movl 28(%4), %%edx\n"
--		       "17:    movl %%eax, 24(%3)\n"
--		       "18:    movl %%edx, 28(%3)\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
- 		       "19:    movl 32(%4), %%eax\n"
- 		       "20:    movl 36(%4), %%edx\n"
--		       "21:    movl %%eax, 32(%3)\n"
--		       "22:    movl %%edx, 36(%3)\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
- 		       "23:    movl 40(%4), %%eax\n"
- 		       "24:    movl 44(%4), %%edx\n"
--		       "25:    movl %%eax, 40(%3)\n"
--		       "26:    movl %%edx, 44(%3)\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
- 		       "27:    movl 48(%4), %%eax\n"
- 		       "28:    movl 52(%4), %%edx\n"
--		       "29:    movl %%eax, 48(%3)\n"
--		       "30:    movl %%edx, 52(%3)\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
- 		       "31:    movl 56(%4), %%eax\n"
- 		       "32:    movl 60(%4), %%edx\n"
--		       "33:    movl %%eax, 56(%3)\n"
--		       "34:    movl %%edx, 60(%3)\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
- 		       "       addl $-64, %0\n"
- 		       "       addl $64, %4\n"
- 		       "       addl $64, %3\n"
-@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
- 		       "36:    movl %%eax, %0\n"
- 		       "37:    rep; movsb\n"
- 		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%es\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "101:   lea 0(%%eax,%0,4),%0\n"
- 		       "       jmp 100b\n"
-@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
- 		       "       .long 99b,101b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
-+		       : "eax", "edx", "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
-+{
-+	int d0, d1;
-+	__asm__ __volatile__(
-+		       "       movw %w6, %%ds\n"
-+		       "       .align 2,0x90\n"
-+		       "1:     movl 32(%4), %%eax\n"
-+		       "       cmpl $67, %0\n"
-+		       "       jbe 3f\n"
-+		       "2:     movl 64(%4), %%eax\n"
-+		       "       .align 2,0x90\n"
-+		       "3:     movl 0(%4), %%eax\n"
-+		       "4:     movl 4(%4), %%edx\n"
-+		       "5:     movl %%eax, %%es:0(%3)\n"
-+		       "6:     movl %%edx, %%es:4(%3)\n"
-+		       "7:     movl 8(%4), %%eax\n"
-+		       "8:     movl 12(%4),%%edx\n"
-+		       "9:     movl %%eax, %%es:8(%3)\n"
-+		       "10:    movl %%edx, %%es:12(%3)\n"
-+		       "11:    movl 16(%4), %%eax\n"
-+		       "12:    movl 20(%4), %%edx\n"
-+		       "13:    movl %%eax, %%es:16(%3)\n"
-+		       "14:    movl %%edx, %%es:20(%3)\n"
-+		       "15:    movl 24(%4), %%eax\n"
-+		       "16:    movl 28(%4), %%edx\n"
-+		       "17:    movl %%eax, %%es:24(%3)\n"
-+		       "18:    movl %%edx, %%es:28(%3)\n"
-+		       "19:    movl 32(%4), %%eax\n"
-+		       "20:    movl 36(%4), %%edx\n"
-+		       "21:    movl %%eax, %%es:32(%3)\n"
-+		       "22:    movl %%edx, %%es:36(%3)\n"
-+		       "23:    movl 40(%4), %%eax\n"
-+		       "24:    movl 44(%4), %%edx\n"
-+		       "25:    movl %%eax, %%es:40(%3)\n"
-+		       "26:    movl %%edx, %%es:44(%3)\n"
-+		       "27:    movl 48(%4), %%eax\n"
-+		       "28:    movl 52(%4), %%edx\n"
-+		       "29:    movl %%eax, %%es:48(%3)\n"
-+		       "30:    movl %%edx, %%es:52(%3)\n"
-+		       "31:    movl 56(%4), %%eax\n"
-+		       "32:    movl 60(%4), %%edx\n"
-+		       "33:    movl %%eax, %%es:56(%3)\n"
-+		       "34:    movl %%edx, %%es:60(%3)\n"
-+		       "       addl $-64, %0\n"
-+		       "       addl $64, %4\n"
-+		       "       addl $64, %3\n"
-+		       "       cmpl $63, %0\n"
-+		       "       ja  1b\n"
-+		       "35:    movl  %0, %%eax\n"
-+		       "       shrl  $2, %0\n"
-+		       "       andl  $3, %%eax\n"
-+		       "       cld\n"
-+		       "99:    rep; movsl\n"
-+		       "36:    movl %%eax, %0\n"
-+		       "37:    rep; movsb\n"
-+		       "100:\n"
-+		       "       pushl %%ss\n"
-+		       "       popl %%ds\n"
-+		       ".section .fixup,\"ax\"\n"
-+		       "101:   lea 0(%%eax,%0,4),%0\n"
-+		       "       jmp 100b\n"
-+		       ".previous\n"
-+		       ".section __ex_table,\"a\"\n"
-+		       "       .align 4\n"
-+		       "       .long 1b,100b\n"
-+		       "       .long 2b,100b\n"
-+		       "       .long 3b,100b\n"
-+		       "       .long 4b,100b\n"
-+		       "       .long 5b,100b\n"
-+		       "       .long 6b,100b\n"
-+		       "       .long 7b,100b\n"
-+		       "       .long 8b,100b\n"
-+		       "       .long 9b,100b\n"
-+		       "       .long 10b,100b\n"
-+		       "       .long 11b,100b\n"
-+		       "       .long 12b,100b\n"
-+		       "       .long 13b,100b\n"
-+		       "       .long 14b,100b\n"
-+		       "       .long 15b,100b\n"
-+		       "       .long 16b,100b\n"
-+		       "       .long 17b,100b\n"
-+		       "       .long 18b,100b\n"
-+		       "       .long 19b,100b\n"
-+		       "       .long 20b,100b\n"
-+		       "       .long 21b,100b\n"
-+		       "       .long 22b,100b\n"
-+		       "       .long 23b,100b\n"
-+		       "       .long 24b,100b\n"
-+		       "       .long 25b,100b\n"
-+		       "       .long 26b,100b\n"
-+		       "       .long 27b,100b\n"
-+		       "       .long 28b,100b\n"
-+		       "       .long 29b,100b\n"
-+		       "       .long 30b,100b\n"
-+		       "       .long 31b,100b\n"
-+		       "       .long 32b,100b\n"
-+		       "       .long 33b,100b\n"
-+		       "       .long 34b,100b\n"
-+		       "       .long 35b,100b\n"
-+		       "       .long 36b,100b\n"
-+		       "       .long 37b,100b\n"
-+		       "       .long 99b,101b\n"
-+		       ".previous"
-+		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
- {
- 	int d0, d1;
- 	__asm__ __volatile__(
-+		       "        movw %w6, %%ds\n"
- 		       "        .align 2,0x90\n"
- 		       "0:      movl 32(%4), %%eax\n"
- 		       "        cmpl $67, %0\n"
-@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .align 2,0x90\n"
- 		       "2:      movl 0(%4), %%eax\n"
- 		       "21:     movl 4(%4), %%edx\n"
--		       "        movl %%eax, 0(%3)\n"
--		       "        movl %%edx, 4(%3)\n"
-+		       "        movl %%eax, %%es:0(%3)\n"
-+		       "        movl %%edx, %%es:4(%3)\n"
- 		       "3:      movl 8(%4), %%eax\n"
- 		       "31:     movl 12(%4),%%edx\n"
--		       "        movl %%eax, 8(%3)\n"
--		       "        movl %%edx, 12(%3)\n"
-+		       "        movl %%eax, %%es:8(%3)\n"
-+		       "        movl %%edx, %%es:12(%3)\n"
- 		       "4:      movl 16(%4), %%eax\n"
- 		       "41:     movl 20(%4), %%edx\n"
--		       "        movl %%eax, 16(%3)\n"
--		       "        movl %%edx, 20(%3)\n"
-+		       "        movl %%eax, %%es:16(%3)\n"
-+		       "        movl %%edx, %%es:20(%3)\n"
- 		       "10:     movl 24(%4), %%eax\n"
- 		       "51:     movl 28(%4), %%edx\n"
--		       "        movl %%eax, 24(%3)\n"
--		       "        movl %%edx, 28(%3)\n"
-+		       "        movl %%eax, %%es:24(%3)\n"
-+		       "        movl %%edx, %%es:28(%3)\n"
- 		       "11:     movl 32(%4), %%eax\n"
- 		       "61:     movl 36(%4), %%edx\n"
--		       "        movl %%eax, 32(%3)\n"
--		       "        movl %%edx, 36(%3)\n"
-+		       "        movl %%eax, %%es:32(%3)\n"
-+		       "        movl %%edx, %%es:36(%3)\n"
- 		       "12:     movl 40(%4), %%eax\n"
- 		       "71:     movl 44(%4), %%edx\n"
--		       "        movl %%eax, 40(%3)\n"
--		       "        movl %%edx, 44(%3)\n"
-+		       "        movl %%eax, %%es:40(%3)\n"
-+		       "        movl %%edx, %%es:44(%3)\n"
- 		       "13:     movl 48(%4), %%eax\n"
- 		       "81:     movl 52(%4), %%edx\n"
--		       "        movl %%eax, 48(%3)\n"
--		       "        movl %%edx, 52(%3)\n"
-+		       "        movl %%eax, %%es:48(%3)\n"
-+		       "        movl %%edx, %%es:52(%3)\n"
- 		       "14:     movl 56(%4), %%eax\n"
- 		       "91:     movl 60(%4), %%edx\n"
--		       "        movl %%eax, 56(%3)\n"
--		       "        movl %%edx, 60(%3)\n"
-+		       "        movl %%eax, %%es:56(%3)\n"
-+		       "        movl %%edx, %%es:60(%3)\n"
- 		       "        addl $-64, %0\n"
- 		       "        addl $64, %4\n"
- 		       "        addl $64, %3\n"
-@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        movl %%eax,%0\n"
- 		       "7:      rep; movsb\n"
- 		       "8:\n"
-+		       "        pushl %%ss\n"
-+		       "        popl %%ds\n"
- 		       ".section .fixup,\"ax\"\n"
- 		       "9:      lea 0(%%eax,%0,4),%0\n"
- 		       "16:     pushl %0\n"
-@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
- 		       "        .long 7b,16b\n"
- 		       ".previous"
- 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--		       :  "1"(to), "2"(from), "0"(size)
-+		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 		       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     pushl %0\n"
-@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
- 	int d0, d1;
- 
- 	__asm__ __volatile__(
-+	       "        movw %w6, %%ds\n"
- 	       "        .align 2,0x90\n"
- 	       "0:      movl 32(%4), %%eax\n"
- 	       "        cmpl $67, %0\n"
-@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
- 	       "        .align 2,0x90\n"
- 	       "2:      movl 0(%4), %%eax\n"
- 	       "21:     movl 4(%4), %%edx\n"
--	       "        movnti %%eax, 0(%3)\n"
--	       "        movnti %%edx, 4(%3)\n"
-+	       "        movnti %%eax, %%es:0(%3)\n"
-+	       "        movnti %%edx, %%es:4(%3)\n"
- 	       "3:      movl 8(%4), %%eax\n"
- 	       "31:     movl 12(%4),%%edx\n"
--	       "        movnti %%eax, 8(%3)\n"
--	       "        movnti %%edx, 12(%3)\n"
-+	       "        movnti %%eax, %%es:8(%3)\n"
-+	       "        movnti %%edx, %%es:12(%3)\n"
- 	       "4:      movl 16(%4), %%eax\n"
- 	       "41:     movl 20(%4), %%edx\n"
--	       "        movnti %%eax, 16(%3)\n"
--	       "        movnti %%edx, 20(%3)\n"
-+	       "        movnti %%eax, %%es:16(%3)\n"
-+	       "        movnti %%edx, %%es:20(%3)\n"
- 	       "10:     movl 24(%4), %%eax\n"
- 	       "51:     movl 28(%4), %%edx\n"
--	       "        movnti %%eax, 24(%3)\n"
--	       "        movnti %%edx, 28(%3)\n"
-+	       "        movnti %%eax, %%es:24(%3)\n"
-+	       "        movnti %%edx, %%es:28(%3)\n"
- 	       "11:     movl 32(%4), %%eax\n"
- 	       "61:     movl 36(%4), %%edx\n"
--	       "        movnti %%eax, 32(%3)\n"
--	       "        movnti %%edx, 36(%3)\n"
-+	       "        movnti %%eax, %%es:32(%3)\n"
-+	       "        movnti %%edx, %%es:36(%3)\n"
- 	       "12:     movl 40(%4), %%eax\n"
- 	       "71:     movl 44(%4), %%edx\n"
--	       "        movnti %%eax, 40(%3)\n"
--	       "        movnti %%edx, 44(%3)\n"
-+	       "        movnti %%eax, %%es:40(%3)\n"
-+	       "        movnti %%edx, %%es:44(%3)\n"
- 	       "13:     movl 48(%4), %%eax\n"
- 	       "81:     movl 52(%4), %%edx\n"
--	       "        movnti %%eax, 48(%3)\n"
--	       "        movnti %%edx, 52(%3)\n"
-+	       "        movnti %%eax, %%es:48(%3)\n"
-+	       "        movnti %%edx, %%es:52(%3)\n"
- 	       "14:     movl 56(%4), %%eax\n"
- 	       "91:     movl 60(%4), %%edx\n"
--	       "        movnti %%eax, 56(%3)\n"
--	       "        movnti %%edx, 60(%3)\n"
-+	       "        movnti %%eax, %%es:56(%3)\n"
-+	       "        movnti %%edx, %%es:60(%3)\n"
- 	       "        addl $-64, %0\n"
- 	       "        addl $64, %4\n"
- 	       "        addl $64, %3\n"
-@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
- 	       "        movl %%eax,%0\n"
- 	       "7:      rep; movsb\n"
- 	       "8:\n"
-+	       "        pushl %%ss\n"
-+	       "        popl %%ds\n"
- 	       ".section .fixup,\"ax\"\n"
- 	       "9:      lea 0(%%eax,%0,4),%0\n"
- 	       "16:     jmp 8b\n"
-@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
- 	       "        .long 7b,16b\n"
- 	       ".previous"
- 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
--	       :  "1"(to), "2"(from), "0"(size)
-+	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
- 	       : "eax", "edx", "memory");
- 	return size;
- }
-@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
-  */
- unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
- 					unsigned long size);
--unsigned long __copy_user_intel(void __user *to, const void *from,
-+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
-+					unsigned long size);
-+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
- 					unsigned long size);
- unsigned long __copy_user_zeroing_intel_nocache(void *to,
- 				const void __user *from, unsigned long size);
- #endif /* CONFIG_X86_INTEL_USERCOPY */
- 
- /* Generic arbitrary sized copy.  */
--#define __copy_user(to, from, size)					\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 2b\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,2b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
--
--#define __copy_user_zeroing(to, from, size)				\
--do {									\
--	int __d0, __d1, __d2;						\
--	__asm__ __volatile__(						\
--		"	cmp  $7,%0\n"					\
--		"	jbe  1f\n"					\
--		"	movl %1,%0\n"					\
--		"	negl %0\n"					\
--		"	andl $7,%0\n"					\
--		"	subl %0,%3\n"					\
--		"4:	rep; movsb\n"					\
--		"	movl %3,%0\n"					\
--		"	shrl $2,%0\n"					\
--		"	andl $3,%3\n"					\
--		"	.align 2,0x90\n"				\
--		"0:	rep; movsl\n"					\
--		"	movl %3,%0\n"					\
--		"1:	rep; movsb\n"					\
--		"2:\n"							\
--		".section .fixup,\"ax\"\n"				\
--		"5:	addl %3,%0\n"					\
--		"	jmp 6f\n"					\
--		"3:	lea 0(%3,%0,4),%0\n"				\
--		"6:	pushl %0\n"					\
--		"	pushl %%eax\n"					\
--		"	xorl %%eax,%%eax\n"				\
--		"	rep; stosb\n"					\
--		"	popl %%eax\n"					\
--		"	popl %0\n"					\
--		"	jmp 2b\n"					\
--		".previous\n"						\
--		".section __ex_table,\"a\"\n"				\
--		"	.align 4\n"					\
--		"	.long 4b,5b\n"					\
--		"	.long 0b,3b\n"					\
--		"	.long 1b,6b\n"					\
--		".previous"						\
--		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
--		: "3"(size), "0"(size), "1"(to), "2"(from)		\
--		: "memory");						\
--} while (0)
-+static unsigned long
-+__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%es\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%es\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 2b\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,2b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
-+
-+static unsigned long
-+__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
-+{
-+	int __d0, __d1, __d2;
-+
-+	__asm__ __volatile__(
-+		"	movw %w8,%%ds\n"
-+		"	cmp  $7,%0\n"
-+		"	jbe  1f\n"
-+		"	movl %1,%0\n"
-+		"	negl %0\n"
-+		"	andl $7,%0\n"
-+		"	subl %0,%3\n"
-+		"4:	rep; movsb\n"
-+		"	movl %3,%0\n"
-+		"	shrl $2,%0\n"
-+		"	andl $3,%3\n"
-+		"	.align 2,0x90\n"
-+		"0:	rep; movsl\n"
-+		"	movl %3,%0\n"
-+		"1:	rep; movsb\n"
-+		"2:\n"
-+		"	pushl %%ss\n"
-+		"	popl %%ds\n"
-+		".section .fixup,\"ax\"\n"
-+		"5:	addl %3,%0\n"
-+		"	jmp 6f\n"
-+		"3:	lea 0(%3,%0,4),%0\n"
-+		"6:	pushl %0\n"
-+		"	pushl %%eax\n"
-+		"	xorl %%eax,%%eax\n"
-+		"	rep; stosb\n"
-+		"	popl %%eax\n"
-+		"	popl %0\n"
-+		"	jmp 2b\n"
-+		".previous\n"
-+		".section __ex_table,\"a\"\n"
-+		"	.align 4\n"
-+		"	.long 4b,5b\n"
-+		"	.long 0b,3b\n"
-+		"	.long 1b,6b\n"
-+		".previous"
-+		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
-+		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
-+		: "memory");
-+	return size;
-+}
- 
- unsigned long __copy_to_user_ll(void __user *to, const void *from,
- 				unsigned long n)
-@@ -775,9 +966,9 @@ survive:
- 	}
- #endif
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_to_user(to, from, n);
- 	else
--		n = __copy_user_intel(to, from, n);
-+		n = __generic_copy_to_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_to_user_ll);
-@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
- 					unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- 	else
- 		n = __copy_user_zeroing_intel(to, from, n);
- 	return n;
-@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
- 					 unsigned long n)
- {
- 	if (movsl_is_ok(to, from, n))
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- 	else
--		n = __copy_user_intel((void __user *)to,
--				      (const void *)from, n);
-+		n = __generic_copy_from_user_intel(to, from, n);
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_zeroing_intel_nocache(to, from, n);
- 	else
--		__copy_user_zeroing(to, from, n);
-+		n = __copy_user_zeroing(to, from, n);
- #else
--	__copy_user_zeroing(to, from, n);
-+	n = __copy_user_zeroing(to, from, n);
- #endif
- 	return n;
- }
-@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
- 	if (n > 64 && cpu_has_xmm2)
- 		n = __copy_user_intel_nocache(to, from, n);
- 	else
--		__copy_user(to, from, n);
-+		n = __generic_copy_from_user(to, from, n);
- #else
--	__copy_user(to, from, n);
-+	n = __generic_copy_from_user(to, from, n);
- #endif
- 	return n;
- }
- EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
- 
--/**
-- * copy_to_user: - Copy a block of data into user space.
-- * @to:   Destination address, in user space.
-- * @from: Source address, in kernel space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from kernel space to user space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- */
--unsigned long
--copy_to_user(void __user *to, const void *from, unsigned long n)
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+void __set_fs(mm_segment_t x, int cpu)
- {
--	if (access_ok(VERIFY_WRITE, to, n))
--		n = __copy_to_user(to, from, n);
--	return n;
-+	unsigned long limit = x.seg;
-+	struct desc_struct d;
-+
-+	current_thread_info()->addr_limit = x;
-+	if (unlikely(paravirt_enabled()))
-+		return;
-+
-+	if (likely(limit))
-+		limit = (limit - 1UL) >> PAGE_SHIFT;
-+	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
-+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
- }
--EXPORT_SYMBOL(copy_to_user);
- 
--/**
-- * copy_from_user: - Copy a block of data from user space.
-- * @to:   Destination address, in kernel space.
-- * @from: Source address, in user space.
-- * @n:    Number of bytes to copy.
-- *
-- * Context: User context only.  This function may sleep.
-- *
-- * Copy data from user space to kernel space.
-- *
-- * Returns number of bytes that could not be copied.
-- * On success, this will be zero.
-- *
-- * If some data could not be copied, this function will pad the copied
-- * data to the requested size using zero bytes.
-- */
--unsigned long
--copy_from_user(void *to, const void __user *from, unsigned long n)
-+void set_fs(mm_segment_t x)
- {
--	if (access_ok(VERIFY_READ, from, n))
--		n = __copy_from_user(to, from, n);
--	else
--		memset(to, 0, n);
--	return n;
-+	__set_fs(x, get_cpu());
-+	put_cpu();
- }
--EXPORT_SYMBOL(copy_from_user);
-+#else
-+void set_fs(mm_segment_t x)
-+{
-+	current_thread_info()->addr_limit = x;
-+}
-+#endif
-+
-+EXPORT_SYMBOL(set_fs);
-diff -urNp linux-2.6.32.13/arch/x86/lib/usercopy_64.c linux-2.6.32.13/arch/x86/lib/usercopy_64.c
---- linux-2.6.32.13/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/lib/usercopy_64.c	2010-05-15 13:21:14.234766826 -0400
-@@ -42,6 +42,8 @@ long
- __strncpy_from_user(char *dst, const char __user *src, long count)
- {
- 	long res;
-+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
-+		src += PAX_USER_SHADOW_BASE;
- 	__do_strncpy_from_user(dst, src, count, res);
- 	return res;
- }
-@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
- {
- 	long __d0;
- 	might_fault();
-+	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
-+		addr += PAX_USER_SHADOW_BASE;
- 	/* no memory constraint because it doesn't change any memory gcc knows
- 	   about */
- 	asm volatile(
-@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
- 
- unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
- {
--	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
-+	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
-+		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
-+			to += PAX_USER_SHADOW_BASE;
-+		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
-+			from += PAX_USER_SHADOW_BASE;
- 		return copy_user_generic((__force void *)to, (__force void *)from, len);
--	} 
--	return len;		
-+	}
-+	return len;
- }
- EXPORT_SYMBOL(copy_in_user);
- 
-diff -urNp linux-2.6.32.13/arch/x86/Makefile linux-2.6.32.13/arch/x86/Makefile
---- linux-2.6.32.13/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/Makefile	2010-05-15 13:21:14.234766826 -0400
-@@ -189,3 +189,12 @@ define archhelp
-   echo  '                  FDARGS="..."  arguments for the booted kernel'
-   echo  '                  FDINITRD=file initrd for the booted kernel'
- endef
-+
-+define OLD_LD
-+
-+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
-+*** Please upgrade your binutils to 2.18 or newer
-+endef
-+
-+archprepare:
-+	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.32.13/arch/x86/mm/extable.c linux-2.6.32.13/arch/x86/mm/extable.c
---- linux-2.6.32.13/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/extable.c	2010-05-15 13:21:14.234766826 -0400
-@@ -1,14 +1,71 @@
- #include <linux/module.h>
- #include <linux/spinlock.h>
-+#include <linux/sort.h>
- #include <asm/uaccess.h>
-+#include <asm/pgtable.h>
- 
-+/*
-+ * The exception table needs to be sorted so that the binary
-+ * search that we use to find entries in it works properly.
-+ * This is used both for the kernel exception table and for
-+ * the exception tables of modules that get loaded.
-+ */
-+static int cmp_ex(const void *a, const void *b)
-+{
-+	const struct exception_table_entry *x = a, *y = b;
-+
-+	/* avoid overflow */
-+	if (x->insn > y->insn)
-+		return 1;
-+	if (x->insn < y->insn)
-+		return -1;
-+	return 0;
-+}
-+
-+static void swap_ex(void *a, void *b, int size)
-+{
-+	struct exception_table_entry t, *x = a, *y = b;
-+
-+	t = *x;
-+
-+	pax_open_kernel();
-+	*x = *y;
-+	*y = t;
-+	pax_close_kernel();
-+}
-+
-+void sort_extable(struct exception_table_entry *start,
-+		  struct exception_table_entry *finish)
-+{
-+	sort(start, finish - start, sizeof(struct exception_table_entry),
-+	     cmp_ex, swap_ex);
-+}
-+
-+#ifdef CONFIG_MODULES
-+/*
-+ * If the exception table is sorted, any referring to the module init
-+ * will be at the beginning or the end.
-+ */
-+void trim_init_extable(struct module *m)
-+{
-+	/*trim the beginning*/
-+	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
-+		m->extable++;
-+		m->num_exentries--;
-+	}
-+	/*trim the end*/
-+	while (m->num_exentries &&
-+		within_module_init(m->extable[m->num_exentries-1].insn, m))
-+		m->num_exentries--;
-+}
-+#endif /* CONFIG_MODULES */
- 
- int fixup_exception(struct pt_regs *regs)
- {
- 	const struct exception_table_entry *fixup;
- 
- #ifdef CONFIG_PNPBIOS
--	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
-+	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
- 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
- 		extern u32 pnp_bios_is_utter_crap;
- 		pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.32.13/arch/x86/mm/fault.c linux-2.6.32.13/arch/x86/mm/fault.c
---- linux-2.6.32.13/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/fault.c	2010-05-15 13:23:38.934774262 -0400
-@@ -11,10 +11,19 @@
- #include <linux/kprobes.h>		/* __kprobes, ...		*/
- #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
- #include <linux/perf_event.h>		/* perf_sw_event		*/
-+#include <linux/unistd.h>
-+#include <linux/compiler.h>
- 
- #include <asm/traps.h>			/* dotraplinkage, ...		*/
- #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
- #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
-+#include <asm/vsyscall.h>
-+#include <asm/tlbflush.h>
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+#include <asm/stacktrace.h>
-+#include "../kernel/dumpstack.h"
-+#endif
- 
- /*
-  * Page fault error code bits:
-@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
- 	int ret = 0;
- 
- 	/* kprobe_running() needs smp_processor_id() */
--	if (kprobes_built_in() && !user_mode_vm(regs)) {
-+	if (kprobes_built_in() && !user_mode(regs)) {
- 		preempt_disable();
- 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
- 			ret = 1;
-@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
- 	force_sig_info(si_signo, &info, tsk);
- }
- 
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault(struct pt_regs *regs);
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
-+{
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+	pgd = pgd_offset(mm, address);
-+	if (!pgd_present(*pgd))
-+		return NULL;
-+	pud = pud_offset(pgd, address);
-+	if (!pud_present(*pud))
-+		return NULL;
-+	pmd = pmd_offset(pud, address);
-+	if (!pmd_present(*pmd))
-+		return NULL;
-+	return pmd;
-+}
-+#endif
-+
- DEFINE_SPINLOCK(pgd_lock);
- LIST_HEAD(pgd_list);
- 
-@@ -224,11 +257,24 @@ void vmalloc_sync_all(void)
- 	     address += PMD_SIZE) {
- 
- 		unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		unsigned long cpu;
-+#else
- 		struct page *page;
-+#endif
- 
- 		spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+			pgd_t *pgd = get_cpu_pgd(cpu);
-+#else
- 		list_for_each_entry(page, &pgd_list, lru) {
--			if (!vmalloc_sync_one(page_address(page), address))
-+			pgd_t *pgd = page_address(page);
-+#endif
-+
-+			if (!vmalloc_sync_one(pgd, address))
- 				break;
- 		}
- 		spin_unlock_irqrestore(&pgd_lock, flags);
-@@ -257,6 +303,9 @@ static noinline int vmalloc_fault(unsign
- 	 * Do _not_ use "current" here. We might be inside
- 	 * an interrupt in the middle of a task switch..
- 	 */
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+#endif
- 	pgd_paddr = read_cr3();
- 	pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
- 	if (!pmd_k)
-@@ -332,15 +381,27 @@ void vmalloc_sync_all(void)
- 
- 		const pgd_t *pgd_ref = pgd_offset_k(address);
- 		unsigned long flags;
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		unsigned long cpu;
-+#else
- 		struct page *page;
-+#endif
- 
- 		if (pgd_none(*pgd_ref))
- 			continue;
- 
- 		spin_lock_irqsave(&pgd_lock, flags);
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
-+			pgd_t *pgd = pgd_offset_cpu(cpu, address);
-+#else
- 		list_for_each_entry(page, &pgd_list, lru) {
- 			pgd_t *pgd;
- 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
-+#endif
-+
- 			if (pgd_none(*pgd))
- 				set_pgd(pgd, *pgd_ref);
- 			else
-@@ -373,7 +434,14 @@ static noinline int vmalloc_fault(unsign
- 	 * happen within a race in page table update. In the later
- 	 * case just flush:
- 	 */
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
-+	pgd = pgd_offset_cpu(smp_processor_id(), address);
-+#else
- 	pgd = pgd_offset(current->active_mm, address);
-+#endif
-+
- 	pgd_ref = pgd_offset_k(address);
- 	if (pgd_none(*pgd_ref))
- 		return -1;
-@@ -535,7 +603,7 @@ static int is_errata93(struct pt_regs *r
- static int is_errata100(struct pt_regs *regs, unsigned long address)
- {
- #ifdef CONFIG_X86_64
--	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
-+	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
- 		return 1;
- #endif
- 	return 0;
-@@ -562,7 +630,7 @@ static int is_f00f_bug(struct pt_regs *r
- }
- 
- static const char nx_warning[] = KERN_CRIT
--"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
-+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
- 
- static void
- show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -571,15 +639,26 @@ show_fault_oops(struct pt_regs *regs, un
- 	if (!oops_may_print())
- 		return;
- 
--	if (error_code & PF_INSTR) {
-+	if (nx_enabled && (error_code & PF_INSTR)) {
- 		unsigned int level;
- 
- 		pte_t *pte = lookup_address(address, &level);
- 
- 		if (pte && pte_present(*pte) && !pte_exec(*pte))
--			printk(nx_warning, current_uid());
-+			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
- 	}
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (init_mm.start_code <= address && address < init_mm.end_code) {
-+		if (current->signal->curr_ip)
-+			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+		else
-+			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
-+					 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	}
-+#endif
-+
- 	printk(KERN_ALERT "BUG: unable to handle kernel ");
- 	if (address < PAGE_SIZE)
- 		printk(KERN_CONT "NULL pointer dereference");
-@@ -704,6 +783,68 @@ __bad_area_nosemaphore(struct pt_regs *r
- 		       unsigned long address, int si_code)
- {
- 	struct task_struct *tsk = current;
-+	struct mm_struct *mm = tsk->mm;
-+
-+#ifdef CONFIG_X86_64
-+	if (mm && (error_code & PF_INSTR)) {
-+		if (regs->ip == (unsigned long)vgettimeofday) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
-+			return;
-+		} else if (regs->ip == (unsigned long)vtime) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
-+			return;
-+		} else if (regs->ip == (unsigned long)vgetcpu) {
-+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
-+			return;
-+		}
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm && (error_code & PF_USER)) {
-+		unsigned long ip = regs->ip;
-+
-+		if (v8086_mode(regs))
-+			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
-+
-+		/*
-+		 * It's possible to have interrupts off here:
-+		 */
-+		local_irq_enable();
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
-+		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+			switch (pax_handle_fetch_fault(regs)) {
-+			case 2:
-+				return;
-+			}
-+#endif
-+
-+			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+			do_group_exit(SIGKILL);
-+		}
-+#endif
-+
-+	}
-+#endif
- 
- 	/* User mode accesses just cause a SIGSEGV */
- 	if (error_code & PF_USER) {
-@@ -848,6 +989,106 @@ static int spurious_fault_check(unsigned
- 	return 1;
- }
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
-+{
-+	pte_t *pte;
-+	pmd_t *pmd;
-+	spinlock_t *ptl;
-+	unsigned char pte_mask;
-+
-+	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
-+	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
-+		return 0;
-+
-+	/* PaX: it's our fault, let's handle it if we can */
-+
-+	/* PaX: take a look at read faults before acquiring any locks */
-+	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
-+		/* instruction fetch attempt from a protected page in user mode */
-+		up_read(&mm->mmap_sem);
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		switch (pax_handle_fetch_fault(regs)) {
-+		case 2:
-+			return 1;
-+		}
-+#endif
-+
-+		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
-+		do_group_exit(SIGKILL);
-+	}
-+
-+	pmd = pax_get_pmd(mm, address);
-+	if (unlikely(!pmd))
-+		return 0;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
-+		/* write attempt to a protected page in user mode */
-+		pte_unmap_unlock(pte, ptl);
-+		return 0;
-+	}
-+
-+#ifdef CONFIG_SMP
-+	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
-+#else
-+	if (likely(address > get_limit(regs->cs)))
-+#endif
-+	{
-+		set_pte(pte, pte_mkread(*pte));
-+		__flush_tlb_one(address);
-+		pte_unmap_unlock(pte, ptl);
-+		up_read(&mm->mmap_sem);
-+		return 1;
-+	}
-+
-+	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
-+
-+	/*
-+	 * PaX: fill DTLB with user rights and retry
-+	 */
-+	__asm__ __volatile__ (
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"movw %w4,%%es\n"
-+#endif
-+		"orb %2,(%1)\n"
-+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
-+/*
-+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
-+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
-+ * page fault when examined during a TLB load attempt. this is true not only
-+ * for PTEs holding a non-present entry but also present entries that will
-+ * raise a page fault (such as those set up by PaX, or the copy-on-write
-+ * mechanism). in effect it means that we do *not* need to flush the TLBs
-+ * for our target pages since their PTEs are simply not in the TLBs at all.
-+
-+ * the best thing in omitting it is that we gain around 15-20% speed in the
-+ * fast path of the page fault handler and can get rid of tracing since we
-+ * can no longer flush unintended entries.
-+ */
-+		"invlpg (%0)\n"
-+#endif
-+		"testb $0,%%es:(%0)\n"
-+		"xorb %3,(%1)\n"
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		"pushl %%ss\n"
-+		"popl %%es\n"
-+#endif
-+		:
-+		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
-+		: "memory", "cc");
-+	pte_unmap_unlock(pte, ptl);
-+	up_read(&mm->mmap_sem);
-+	return 1;
-+}
-+#endif
-+
- /*
-  * Handle a spurious fault caused by a stale TLB entry.
-  *
-@@ -914,6 +1155,9 @@ int show_unhandled_signals = 1;
- static inline int
- access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
- {
-+	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
-+		return 1;
-+
- 	if (write) {
- 		/* write, present and write, not present: */
- 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -947,17 +1191,31 @@ do_page_fault(struct pt_regs *regs, unsi
- {
- 	struct vm_area_struct *vma;
- 	struct task_struct *tsk;
--	unsigned long address;
- 	struct mm_struct *mm;
- 	int write;
- 	int fault;
- 
-+	/* Get the faulting address: */
-+	unsigned long address = read_cr2();
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
-+		if (!search_exception_tables(regs->ip)) {
-+			bad_area_nosemaphore(regs, error_code, address);
-+			return;
-+		}
-+		if (address < PAX_USER_SHADOW_BASE) {
-+			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
-+			printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
-+			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
-+		} else
-+			address -= PAX_USER_SHADOW_BASE;
-+	}
-+#endif
-+
- 	tsk = current;
- 	mm = tsk->mm;
- 
--	/* Get the faulting address: */
--	address = read_cr2();
--
- 	/*
- 	 * Detect and handle instructions that would cause a page fault for
- 	 * both a tracked kernel page and a userspace page.
-@@ -1017,7 +1275,7 @@ do_page_fault(struct pt_regs *regs, unsi
- 	 * User-mode registers count as a user access even for any
- 	 * potential system fault or CPU buglet:
- 	 */
--	if (user_mode_vm(regs)) {
-+	if (user_mode(regs)) {
- 		local_irq_enable();
- 		error_code |= PF_USER;
- 	} else {
-@@ -1071,6 +1329,11 @@ do_page_fault(struct pt_regs *regs, unsi
- 		might_sleep();
- 	}
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
-+	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
-+		return;
-+#endif
-+
- 	vma = find_vma(mm, address);
- 	if (unlikely(!vma)) {
- 		bad_area(regs, error_code, address);
-@@ -1082,18 +1345,24 @@ do_page_fault(struct pt_regs *regs, unsi
- 		bad_area(regs, error_code, address);
- 		return;
- 	}
--	if (error_code & PF_USER) {
--		/*
--		 * Accessing the stack below %sp is always a bug.
--		 * The large cushion allows instructions like enter
--		 * and pusha to work. ("enter $65535, $31" pushes
--		 * 32 pointers and then decrements %sp by 65535.)
--		 */
--		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
--			bad_area(regs, error_code, address);
--			return;
--		}
-+	/*
-+	 * Accessing the stack below %sp is always a bug.
-+	 * The large cushion allows instructions like enter
-+	 * and pusha to work. ("enter $65535, $31" pushes
-+	 * 32 pointers and then decrements %sp by 65535.)
-+	 */
-+	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
-+		bad_area(regs, error_code, address);
-+		return;
-+	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
-+		bad_area(regs, error_code, address);
-+		return;
- 	}
-+#endif
-+
- 	if (unlikely(expand_stack(vma, address))) {
- 		bad_area(regs, error_code, address);
- 		return;
-@@ -1137,3 +1406,199 @@ good_area:
- 
- 	up_read(&mm->mmap_sem);
- }
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned char mov1, mov2;
-+		unsigned short jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 11) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov1, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
-+			regs->cx = addr1;
-+			regs->ax = addr2;
-+			regs->ip = addr2;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned char mov, jmp;
-+		unsigned int addr1, addr2;
-+
-+#ifdef CONFIG_X86_64
-+		if ((regs->ip + 9) >> 32)
-+			break;
-+#endif
-+
-+		err = get_user(mov, (unsigned char __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
-+		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
-+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
-+
-+		if (err)
-+			break;
-+
-+		if (mov == 0xB9 && jmp == 0xE9) {
-+			regs->cx = addr1;
-+			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+
-+#ifdef CONFIG_X86_64
-+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
-+{
-+	int err;
-+
-+	do { /* PaX: gcc trampoline emulation #1 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned int addr1;
-+		unsigned long addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	do { /* PaX: gcc trampoline emulation #2 */
-+		unsigned short mov1, mov2, jmp1;
-+		unsigned char jmp2;
-+		unsigned long addr1, addr2;
-+
-+		err = get_user(mov1, (unsigned short __user *)regs->ip);
-+		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
-+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
-+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
-+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
-+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
-+
-+		if (err)
-+			break;
-+
-+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
-+			regs->r11 = addr1;
-+			regs->r10 = addr2;
-+			regs->ip = addr1;
-+			return 2;
-+		}
-+	} while (0);
-+
-+	return 1; /* PaX in action */
-+}
-+#endif
-+
-+/*
-+ * PaX: decide what to do with offenders (regs->ip = fault address)
-+ *
-+ * returns 1 when task should be killed
-+ *         2 when gcc trampoline was detected
-+ */
-+static int pax_handle_fetch_fault(struct pt_regs *regs)
-+{
-+	if (v8086_mode(regs))
-+		return 1;
-+
-+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
-+		return 1;
-+
-+#ifdef CONFIG_X86_32
-+	return pax_handle_fetch_fault_32(regs);
-+#else
-+	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
-+		return pax_handle_fetch_fault_32(regs);
-+	else
-+		return pax_handle_fetch_fault_64(regs);
-+#endif
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_insns(void *pc, void *sp)
-+{
-+	long i;
-+
-+	printk(KERN_ERR "PAX: bytes at PC: ");
-+	for (i = 0; i < 20; i++) {
-+		unsigned char c;
-+		if (get_user(c, (__force unsigned char __user *)pc+i))
-+			printk(KERN_CONT "?? ");
-+		else
-+			printk(KERN_CONT "%02x ", c);
-+	}
-+	printk("\n");
-+
-+	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
-+	for (i = -1; i < 80 / (long)sizeof(long); i++) {
-+		unsigned long c;
-+		if (get_user(c, (__force unsigned long __user *)sp+i))
-+#ifdef CONFIG_X86_32
-+			printk(KERN_CONT "???????? ");
-+#else
-+			printk(KERN_CONT "???????????????? ");
-+#endif
-+		else
-+			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
-+	}
-+	printk("\n");
-+}
-+#endif
-+
-+/**
-+ * probe_kernel_write(): safely attempt to write to a location
-+ * @dst: address to write to
-+ * @src: pointer to the data that shall be written
-+ * @size: size of the data chunk
-+ *
-+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
-+ * happens, handle that and return -EFAULT.
-+ */
-+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
-+{
-+	long ret;
-+	mm_segment_t old_fs = get_fs();
-+
-+	set_fs(KERNEL_DS);
-+	pagefault_disable();
-+	pax_open_kernel();
-+	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
-+	pax_close_kernel();
-+	pagefault_enable();
-+	set_fs(old_fs);
-+
-+	return ret ? -EFAULT : 0;
-+}
-diff -urNp linux-2.6.32.13/arch/x86/mm/gup.c linux-2.6.32.13/arch/x86/mm/gup.c
---- linux-2.6.32.13/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/gup.c	2010-05-15 13:21:14.234766826 -0400
-@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
- 	addr = start;
- 	len = (unsigned long) nr_pages << PAGE_SHIFT;
- 	end = start + len;
--	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
-+	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
- 					(void __user *)start, len)))
- 		return 0;
- 
-diff -urNp linux-2.6.32.13/arch/x86/mm/highmem_32.c linux-2.6.32.13/arch/x86/mm/highmem_32.c
---- linux-2.6.32.13/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/highmem_32.c	2010-05-15 13:21:14.238617110 -0400
-@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
- 	idx = type + KM_TYPE_NR*smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
- 	BUG_ON(!pte_none(*(kmap_pte-idx)));
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte-idx, mk_pte(page, prot));
-+	pax_close_kernel();
- 
- 	return (void *)vaddr;
- }
-diff -urNp linux-2.6.32.13/arch/x86/mm/hugetlbpage.c linux-2.6.32.13/arch/x86/mm/hugetlbpage.c
---- linux-2.6.32.13/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/hugetlbpage.c	2010-05-15 13:21:14.238617110 -0400
-@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
--	unsigned long start_addr;
-+	unsigned long start_addr, pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (len > mm->cached_hole_size) {
--	        start_addr = mm->free_area_cache;
-+		start_addr = mm->free_area_cache;
- 	} else {
--	        start_addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -281,13 +286,13 @@ full_search:
- 
- 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
- 		/* At this point:  (!vma || addr < vma->vm_end). */
--		if (TASK_SIZE - len < addr) {
-+		if (pax_task_size - len < addr) {
- 			/*
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				start_addr = TASK_UNMAPPED_BASE;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma, *prev_vma;
--	unsigned long base = mm->mmap_base, addr = addr0;
-+	unsigned long base = mm->mmap_base, addr;
- 	unsigned long largest_hole = mm->cached_hole_size;
--	int first_time = 1;
- 
- 	/* don't allow allocations above current base */
- 	if (mm->free_area_cache > base)
-@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
- 	        largest_hole = 0;
- 		mm->free_area_cache  = base;
- 	}
--try_again:
-+
- 	/* make sure it can fit in the remaining address space */
- 	if (mm->free_area_cache < len)
- 		goto fail;
-@@ -364,22 +368,26 @@ try_again:
- 
- fail:
- 	/*
--	 * if hint left us with no space for the requested
--	 * mapping then try again:
--	 */
--	if (first_time) {
--		mm->free_area_cache = base;
--		largest_hole = 0;
--		first_time = 0;
--		goto try_again;
--	}
--	/*
- 	 * A failed mmap() very likely causes application failure,
- 	 * so fall back to the bottom-up function here. This scenario
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
--	mm->free_area_cache = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
-+	else
-+#endif
-+
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
- 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
- 			len, pgoff, flags);
-@@ -387,6 +395,7 @@ fail:
- 	/*
- 	 * Restore the topdown base:
- 	 */
-+	mm->mmap_base = base;
- 	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
-@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
- 	struct hstate *h = hstate_file(file);
- 	struct mm_struct *mm = current->mm;
- 	struct vm_area_struct *vma;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (len & ~huge_page_mask(h))
- 		return -EINVAL;
--	if (len > TASK_SIZE)
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (len > pax_task_size)
- 		return -ENOMEM;
- 
- 	if (flags & MAP_FIXED) {
-@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
- 	if (addr) {
- 		addr = ALIGN(addr, huge_page_size(h));
- 		vma = find_vma(mm, addr);
--		if (TASK_SIZE - len >= addr &&
-+		if (pax_task_size - len >= addr &&
- 		    (!vma || addr + len <= vma->vm_start))
- 			return addr;
- 	}
-diff -urNp linux-2.6.32.13/arch/x86/mm/init_32.c linux-2.6.32.13/arch/x86/mm/init_32.c
---- linux-2.6.32.13/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/init_32.c	2010-05-15 13:21:14.238617110 -0400
-@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
- }
- 
- /*
-- * Creates a middle page table and puts a pointer to it in the
-- * given global directory entry. This only returns the gd entry
-- * in non-PAE compilation mode, since the middle layer is folded.
-- */
--static pmd_t * __init one_md_table_init(pgd_t *pgd)
--{
--	pud_t *pud;
--	pmd_t *pmd_table;
--
--#ifdef CONFIG_X86_PAE
--	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
--		if (after_bootmem)
--			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
--		else
--			pmd_table = (pmd_t *)alloc_low_page();
--		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
--		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
--		pud = pud_offset(pgd, 0);
--		BUG_ON(pmd_table != pmd_offset(pud, 0));
--
--		return pmd_table;
--	}
--#endif
--	pud = pud_offset(pgd, 0);
--	pmd_table = pmd_offset(pud, 0);
--
--	return pmd_table;
--}
--
--/*
-  * Create a page table and place a pointer to it in a middle page
-  * directory entry:
-  */
-@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
- 			page_table = (pte_t *)alloc_low_page();
- 
- 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
-+#else
- 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
-+#endif
- 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
- 	}
- 
- 	return pte_offset_kernel(pmd, 0);
- }
- 
-+static pmd_t * __init one_md_table_init(pgd_t *pgd)
-+{
-+	pud_t *pud;
-+	pmd_t *pmd_table;
-+
-+	pud = pud_offset(pgd, 0);
-+	pmd_table = pmd_offset(pud, 0);
-+
-+	return pmd_table;
-+}
-+
- pmd_t * __init populate_extra_pmd(unsigned long vaddr)
- {
- 	int pgd_idx = pgd_index(vaddr);
-@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
- 	int pgd_idx, pmd_idx;
- 	unsigned long vaddr;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte = NULL;
- 
-@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
- 	pgd = pgd_base + pgd_idx;
- 
- 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
--		pmd = pmd + pmd_index(vaddr);
-+		pud = pud_offset(pgd, vaddr);
-+		pmd = pmd_offset(pud, vaddr);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
-+
- 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
- 							pmd++, pmd_idx++) {
- 			pte = page_table_kmap_check(one_page_table_init(pmd),
-@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
- 	}
- }
- 
--static inline int is_kernel_text(unsigned long addr)
-+static inline int is_kernel_text(unsigned long start, unsigned long end)
- {
--	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
--		return 1;
--	return 0;
-+	if ((start > ktla_ktva((unsigned long)_etext) ||
-+	     end <= ktla_ktva((unsigned long)_stext)) &&
-+	    (start > ktla_ktva((unsigned long)_einittext) ||
-+	     end <= ktla_ktva((unsigned long)_sinittext)) &&
-+
-+#ifdef CONFIG_ACPI_SLEEP
-+	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
-+#endif
-+
-+	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
-+		return 0;
-+	return 1;
- }
- 
- /*
-@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
- 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
- 	unsigned long start_pfn, end_pfn;
- 	pgd_t *pgd_base = swapper_pg_dir;
--	int pgd_idx, pmd_idx, pte_ofs;
-+	unsigned int pgd_idx, pmd_idx, pte_ofs;
- 	unsigned long pfn;
- 	pgd_t *pgd;
-+	pud_t *pud;
- 	pmd_t *pmd;
- 	pte_t *pte;
- 	unsigned pages_2m, pages_4k;
-@@ -278,8 +279,13 @@ repeat:
- 	pfn = start_pfn;
- 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 	pgd = pgd_base + pgd_idx;
--	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
--		pmd = one_md_table_init(pgd);
-+	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
-+		pud = pud_offset(pgd, 0);
-+		pmd = pmd_offset(pud, 0);
-+
-+#ifdef CONFIG_X86_PAE
-+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
-+#endif
- 
- 		if (pfn >= end_pfn)
- 			continue;
-@@ -291,14 +297,13 @@ repeat:
- #endif
- 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
- 		     pmd++, pmd_idx++) {
--			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
-+			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
- 
- 			/*
- 			 * Map with big pages if possible, otherwise
- 			 * create normal page tables:
- 			 */
- 			if (use_pse) {
--				unsigned int addr2;
- 				pgprot_t prot = PAGE_KERNEL_LARGE;
- 				/*
- 				 * first pass will use the same initial
-@@ -308,11 +313,7 @@ repeat:
- 					__pgprot(PTE_IDENT_ATTR |
- 						 _PAGE_PSE);
- 
--				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
--					PAGE_OFFSET + PAGE_SIZE-1;
--
--				if (is_kernel_text(addr) ||
--				    is_kernel_text(addr2))
-+				if (is_kernel_text(address, address + PMD_SIZE))
- 					prot = PAGE_KERNEL_LARGE_EXEC;
- 
- 				pages_2m++;
-@@ -329,7 +330,7 @@ repeat:
- 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
- 			pte += pte_ofs;
- 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
--			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
-+			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
- 				pgprot_t prot = PAGE_KERNEL;
- 				/*
- 				 * first pass will use the same initial
-@@ -337,7 +338,7 @@ repeat:
- 				 */
- 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
- 
--				if (is_kernel_text(addr))
-+				if (is_kernel_text(address, address + PAGE_SIZE))
- 					prot = PAGE_KERNEL_EXEC;
- 
- 				pages_4k++;
-@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
- 
- 		pud = pud_offset(pgd, va);
- 		pmd = pmd_offset(pud, va);
--		if (!pmd_present(*pmd))
-+		if (!pmd_present(*pmd) || pmd_huge(*pmd))
- 			break;
- 
- 		pte = pte_offset_kernel(pmd, va);
-@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
- 
- static void __init pagetable_init(void)
- {
--	pgd_t *pgd_base = swapper_pg_dir;
--
--	permanent_kmaps_init(pgd_base);
-+	permanent_kmaps_init(swapper_pg_dir);
- }
- 
- #ifdef CONFIG_ACPI_SLEEP
-@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
-  * ACPI suspend needs this for resume, because things like the intel-agp
-  * driver might have split up a kernel 4MB mapping.
-  */
--char swsusp_pg_dir[PAGE_SIZE]
-+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
- 	__attribute__ ((aligned(PAGE_SIZE)));
- 
- static inline void save_pg_dir(void)
- {
--	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
-+	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
- }
- #else /* !CONFIG_ACPI_SLEEP */
- static inline void save_pg_dir(void)
-@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
- 		flush_tlb_all();
- }
- 
--pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
-+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
- EXPORT_SYMBOL_GPL(__supported_pte_mask);
- 
- /* user-defined highmem size */
-@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
- 	 * Initialize the boot-time allocator (with low memory only):
- 	 */
- 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
--	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
-+	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
- 				 PAGE_SIZE);
- 	if (bootmap == -1L)
- 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
-@@ -864,6 +863,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- #ifdef CONFIG_FLATMEM
- 	BUG_ON(!mem_map);
- #endif
-@@ -881,7 +886,7 @@ void __init mem_init(void)
- 	set_highmem_pages_init();
- 
- 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
--	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
-+	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
- 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
- 
- 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
-@@ -923,10 +928,10 @@ void __init mem_init(void)
- 		((unsigned long)&__init_end -
- 		 (unsigned long)&__init_begin) >> 10,
- 
--		(unsigned long)&_etext, (unsigned long)&_edata,
--		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
-+		(unsigned long)&_sdata, (unsigned long)&_edata,
-+		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
- 
--		(unsigned long)&_text, (unsigned long)&_etext,
-+		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
- 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
- 
- 	/*
-@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read write\n",
- 		 start, start+size);
- 
-@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
- 	if (!kernel_set_to_readonly)
- 		return;
- 
-+	start = ktla_ktva(start);
- 	pr_debug("Set kernel text: %lx - %lx for read only\n",
- 		 start, start+size);
- 
-@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
- 	unsigned long start = PFN_ALIGN(_text);
- 	unsigned long size = PFN_ALIGN(_etext) - start;
- 
-+	start = ktla_ktva(start);
- 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
- 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
- 		size >> 10);
-diff -urNp linux-2.6.32.13/arch/x86/mm/init_64.c linux-2.6.32.13/arch/x86/mm/init_64.c
---- linux-2.6.32.13/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/init_64.c	2010-05-15 13:21:14.238617110 -0400
-@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
- 	pmd = fill_pmd(pud, vaddr);
- 	pte = fill_pte(pmd, vaddr);
- 
-+	pax_open_kernel();
- 	set_pte(pte, new_pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
- 		pgd = pgd_offset_k((unsigned long)__va(phys));
- 		if (pgd_none(*pgd)) {
- 			pud = (pud_t *) spp_getpage();
--			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
- 		}
- 		pud = pud_offset(pgd, (unsigned long)__va(phys));
- 		if (pud_none(*pud)) {
- 			pmd = (pmd_t *) spp_getpage();
--			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
--						_PAGE_USER));
-+			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
- 		}
- 		pmd = pmd_offset(pud, phys);
- 		BUG_ON(!pmd_none(*pmd));
-@@ -656,6 +656,12 @@ void __init mem_init(void)
- 
- 	pci_iommu_alloc();
- 
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
-+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-+			KERNEL_PGD_PTRS);
-+#endif
-+
- 	/* clear_bss() already clear the empty_zero_page */
- 
- 	reservedpages = 0;
-@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
- static struct vm_area_struct gate_vma = {
- 	.vm_start	= VSYSCALL_START,
- 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
--	.vm_page_prot	= PAGE_READONLY_EXEC,
--	.vm_flags	= VM_READ | VM_EXEC
-+	.vm_page_prot	= PAGE_READONLY,
-+	.vm_flags	= VM_READ
- };
- 
- struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
- 	if (vma == &gate_vma)
- 		return "[vsyscall]";
-diff -urNp linux-2.6.32.13/arch/x86/mm/init.c linux-2.6.32.13/arch/x86/mm/init.c
---- linux-2.6.32.13/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/init.c	2010-05-15 13:21:14.238617110 -0400
-@@ -69,11 +69,7 @@ static void __init find_early_table_spac
- 	 * cause a hotspot and fill up ZONE_DMA. The page tables
- 	 * need roughly 0.5KB per GB.
- 	 */
--#ifdef CONFIG_X86_32
--	start = 0x7000;
--#else
--	start = 0x8000;
--#endif
-+	start = 0x100000;
- 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
- 					tables, PAGE_SIZE);
- 	if (e820_table_start == -1UL)
-@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
-  */
- int devmem_is_allowed(unsigned long pagenr)
- {
--	if (pagenr <= 256)
-+	if (!pagenr)
-+		return 1;
-+#ifdef CONFIG_VM86
-+	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
-+		return 1;
-+#endif
-+	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 1;
- 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
- 		return 0;
-@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
- 
- void free_initmem(void)
- {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+
-+#ifdef CONFIG_X86_32
-+	/* PaX: limit KERNEL_CS to actual size */
-+	unsigned long addr, limit;
-+	struct desc_struct d;
-+	int cpu;
-+
-+	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
-+	limit = (limit - 1UL) >> PAGE_SHIFT;
-+
-+	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
-+		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
-+	}
-+
-+	/* PaX: make KERNEL_CS read-only */
-+	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
-+	if (!paravirt_enabled())
-+		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
-+/*
-+		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
-+			pgd = pgd_offset_k(addr);
-+			pud = pud_offset(pgd, addr);
-+			pmd = pmd_offset(pud, addr);
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		}
-+*/
-+#ifdef CONFIG_X86_PAE
-+	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
-+	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+#ifdef CONFIG_MODULES
-+	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
-+#endif
-+
-+#else
-+	unsigned long addr, end;
-+
-+	/* PaX: make kernel code/rodata read-only, rest non-executable */
-+	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+
-+	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
-+	end = addr + KERNEL_IMAGE_SIZE;
-+	for (; addr < end; addr += PMD_SIZE) {
-+		pgd = pgd_offset_k(addr);
-+		pud = pud_offset(pgd, addr);
-+		pmd = pmd_offset(pud, addr);
-+		if (!pmd_present(*pmd))
-+			continue;
-+		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
-+		else
-+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
-+	}
-+#endif
-+
-+	flush_tlb_all();
-+#endif
-+
- 	free_init_pages("unused kernel memory",
- 			(unsigned long)(&__init_begin),
- 			(unsigned long)(&__init_end));
-diff -urNp linux-2.6.32.13/arch/x86/mm/iomap_32.c linux-2.6.32.13/arch/x86/mm/iomap_32.c
---- linux-2.6.32.13/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/iomap_32.c	2010-05-15 13:21:14.238617110 -0400
-@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
- 	debug_kmap_atomic(type);
- 	idx = type + KM_TYPE_NR * smp_processor_id();
- 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-+
-+	pax_open_kernel();
- 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
-+	pax_close_kernel();
-+
- 	arch_flush_lazy_mmu_mode();
- 
- 	return (void *)vaddr;
-diff -urNp linux-2.6.32.13/arch/x86/mm/ioremap.c linux-2.6.32.13/arch/x86/mm/ioremap.c
---- linux-2.6.32.13/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/ioremap.c	2010-05-15 13:21:14.238617110 -0400
-@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
- 	 * Second special case: Some BIOSen report the PC BIOS
- 	 * area (640->1Mb) as ram even though it is not.
- 	 */
--	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
--		    pagenr < (BIOS_END >> PAGE_SHIFT))
-+	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
-+		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
- 		return 0;
- 
- 	for (i = 0; i < e820.nr_map; i++) {
-@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
- 	/*
- 	 * Don't allow anybody to remap normal RAM that we're using..
- 	 */
--	for (pfn = phys_addr >> PAGE_SHIFT;
--				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
--				pfn++) {
--
-+	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
- 		int is_ram = page_is_ram(pfn);
- 
--		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
-+		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
- 			return NULL;
- 		WARN_ON_ONCE(is_ram);
- 	}
-@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
- early_param("early_ioremap_debug", early_ioremap_debug_setup);
- 
- static __initdata int after_paging_init;
--static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
-+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
- 
- static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
- {
-@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
- 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
- 
- 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
--	memset(bm_pte, 0, sizeof(bm_pte));
--	pmd_populate_kernel(&init_mm, pmd, bm_pte);
-+	pmd_populate_user(&init_mm, pmd, bm_pte);
- 
- 	/*
- 	 * The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/kmemcheck/kmemcheck.c	2010-05-15 13:21:14.238617110 -0400
-@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
- 	 * memory (e.g. tracked pages)? For now, we need this to avoid
- 	 * invoking kmemcheck for PnP BIOS calls.
- 	 */
--	if (regs->flags & X86_VM_MASK)
-+	if (v8086_mode(regs))
- 		return false;
--	if (regs->cs != __KERNEL_CS)
-+	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
- 		return false;
- 
- 	pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.32.13/arch/x86/mm/mmap.c linux-2.6.32.13/arch/x86/mm/mmap.c
---- linux-2.6.32.13/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/mmap.c	2010-05-15 13:21:14.238617110 -0400
-@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
-  * Leave an at least ~128 MB hole with possible stack randomization.
-  */
- #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
--#define MAX_GAP (TASK_SIZE/6*5)
-+#define MAX_GAP (pax_task_size/6*5)
- 
- /*
-  * True on X86_32 or when emulating IA32 on X86_64
-@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
- 	return rnd << PAGE_SHIFT;
- }
- 
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(struct mm_struct *mm)
- {
- 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
-+	unsigned long pax_task_size = TASK_SIZE;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
- 
- 	if (gap < MIN_GAP)
- 		gap = MIN_GAP;
- 	else if (gap > MAX_GAP)
- 		gap = MAX_GAP;
- 
--	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
- }
- 
- /*
-  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
-  * does, but not when emulating X86_32
-  */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(struct mm_struct *mm)
- {
--	if (mmap_is_ia32())
-+	if (mmap_is_ia32()) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+			return SEGMEXEC_TASK_UNMAPPED_BASE;
-+		else
-+#endif
-+
- 		return TASK_UNMAPPED_BASE;
--	else
-+	} else
- 		return TASK_UNMAPPED_BASE + mmap_rnd();
- }
- 
-@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	if (mmap_is_legacy()) {
--		mm->mmap_base = mmap_legacy_base();
-+		mm->mmap_base = mmap_legacy_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area;
- 		mm->unmap_area = arch_unmap_area;
- 	} else {
--		mm->mmap_base = mmap_base();
-+		mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+		if (mm->pax_flags & MF_PAX_RANDMMAP)
-+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
-+#endif
-+
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 		mm->unmap_area = arch_unmap_area_topdown;
- 	}
-diff -urNp linux-2.6.32.13/arch/x86/mm/numa_32.c linux-2.6.32.13/arch/x86/mm/numa_32.c
---- linux-2.6.32.13/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/numa_32.c	2010-05-15 13:21:14.238617110 -0400
-@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
- }
- #endif
- 
--extern unsigned long find_max_low_pfn(void);
- extern unsigned long highend_pfn, highstart_pfn;
- 
- #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.32.13/arch/x86/mm/pageattr.c linux-2.6.32.13/arch/x86/mm/pageattr.c
---- linux-2.6.32.13/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/pageattr.c	2010-05-15 13:21:14.238617110 -0400
-@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
- 	 * Does not cover __inittext since that is gone later on. On
- 	 * 64bit we do not enforce !NX on the low mapping
- 	 */
--	if (within(address, (unsigned long)_text, (unsigned long)_etext))
-+	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
- 		pgprot_val(forbidden) |= _PAGE_NX;
- 
-+#ifdef CONFIG_DEBUG_RODATA
- 	/*
- 	 * The .rodata section needs to be read-only. Using the pfn
- 	 * catches all aliases.
-@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
- 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
- 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
- 		pgprot_val(forbidden) |= _PAGE_RW;
-+#endif
- 
- 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
- 
-@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
- static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
- {
- 	/* change init_mm */
-+	pax_open_kernel();
- 	set_pte_atomic(kpte, pte);
-+	pax_close_kernel();
-+
- #ifdef CONFIG_X86_32
- 	if (!SHARED_KERNEL_PMD) {
- 		struct page *page;
-diff -urNp linux-2.6.32.13/arch/x86/mm/pageattr-test.c linux-2.6.32.13/arch/x86/mm/pageattr-test.c
---- linux-2.6.32.13/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/pageattr-test.c	2010-05-15 13:21:14.238617110 -0400
-@@ -36,7 +36,7 @@ enum {
- 
- static int pte_testbit(pte_t pte)
- {
--	return pte_flags(pte) & _PAGE_UNUSED1;
-+	return pte_flags(pte) & _PAGE_CPA_TEST;
- }
- 
- struct split_state {
-diff -urNp linux-2.6.32.13/arch/x86/mm/pat.c linux-2.6.32.13/arch/x86/mm/pat.c
---- linux-2.6.32.13/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/pat.c	2010-05-15 13:21:14.258921790 -0400
-@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
- 
-  conflict:
- 	printk(KERN_INFO "%s:%d conflicting memory types "
--	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
-+	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
- 	       new->end, cattr_name(new->type), cattr_name(entry->type));
- 	return -EBUSY;
- }
-@@ -559,7 +559,7 @@ unlock_ret:
- 
- 	if (err) {
- 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
--			current->comm, current->pid, start, end);
-+			current->comm, task_pid_nr(current), start, end);
- 	}
- 
- 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
-@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
- 		printk(KERN_INFO
- 			"%s:%d ioremap_change_attr failed %s "
- 			"for %Lx-%Lx\n",
--			current->comm, current->pid,
-+			current->comm, task_pid_nr(current),
- 			cattr_name(flags),
- 			base, (unsigned long long)(base + size));
- 		return -EINVAL;
-@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
- 			free_memtype(paddr, paddr + size);
- 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
- 				" for %Lx-%Lx, got %s\n",
--				current->comm, current->pid,
-+				current->comm, task_pid_nr(current),
- 				cattr_name(want_flags),
- 				(unsigned long long)paddr,
- 				(unsigned long long)(paddr + size),
-diff -urNp linux-2.6.32.13/arch/x86/mm/pgtable_32.c linux-2.6.32.13/arch/x86/mm/pgtable_32.c
---- linux-2.6.32.13/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/pgtable_32.c	2010-05-15 13:21:14.258921790 -0400
-@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
- 		return;
- 	}
- 	pte = pte_offset_kernel(pmd, vaddr);
-+
-+	pax_open_kernel();
- 	if (pte_val(pteval))
- 		set_pte_at(&init_mm, vaddr, pte, pteval);
- 	else
- 		pte_clear(&init_mm, vaddr, pte);
-+	pax_close_kernel();
- 
- 	/*
- 	 * It's enough to flush this one mapping.
-diff -urNp linux-2.6.32.13/arch/x86/mm/pgtable.c linux-2.6.32.13/arch/x86/mm/pgtable.c
---- linux-2.6.32.13/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/pgtable.c	2010-05-15 13:21:14.258921790 -0400
-@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
- #if PAGETABLE_LEVELS > 3
- void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
- {
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
- 	tlb_remove_page(tlb, virt_to_page(pud));
-+#endif
-+
- }
- #endif	/* PAGETABLE_LEVELS > 3 */
- #endif	/* PAGETABLE_LEVELS > 2 */
-@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
- 	list_del(&page->lru);
- }
- 
--#define UNSHARED_PTRS_PER_PGD				\
--	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+	while (count--)
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
-+#else
-+		*dst++ = *src++;
-+#endif
-+
-+}
-+
-+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
-+{
-+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	while (count--)
-+		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
-+#endif
-+
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
-+#ifdef CONFIG_X86_64
-+#define pxd_t				pud_t
-+#define pyd_t				pgd_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
-+#define pxd_free(mm, pud)		pud_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
-+#define PYD_SIZE			PGDIR_SIZE
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pud)		pmd_free((mm), (pud))
-+#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
-+#endif
-+#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
-+#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
- 
- static void pgd_ctor(pgd_t *pgd)
- {
-@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
- 	pgd_list_del(pgd);
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- }
-+#endif
- 
- /*
-  * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * -- wli
-  */
- 
--#ifdef CONFIG_X86_PAE
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- /*
-  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
-  * updating the top-level pagetable entries to guarantee the
-@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
-  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
-  * and initialize the kernel pmds here.
-  */
--#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
-+#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
- 
- void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
- {
-@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
- 	if (mm == current->active_mm)
- 		write_cr3(read_cr3());
- }
-+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
-+#define PREALLOCATED_PXDS	USER_PGD_PTRS
- #else  /* !CONFIG_X86_PAE */
- 
- /* No need to prepopulate any pagetable entries in non-PAE modes. */
--#define PREALLOCATED_PMDS	0
-+#define PREALLOCATED_PXDS	0
- 
- #endif	/* CONFIG_X86_PAE */
- 
--static void free_pmds(pmd_t *pmds[])
-+static void free_pxds(pxd_t *pxds[])
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++)
--		if (pmds[i])
--			free_page((unsigned long)pmds[i]);
-+	for(i = 0; i < PREALLOCATED_PXDS; i++)
-+		if (pxds[i])
-+			free_page((unsigned long)pxds[i]);
- }
- 
--static int preallocate_pmds(pmd_t *pmds[])
-+static int preallocate_pxds(pxd_t *pxds[])
- {
- 	int i;
- 	bool failed = false;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
--		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
--		if (pmd == NULL)
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
-+		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
-+		if (pxd == NULL)
- 			failed = true;
--		pmds[i] = pmd;
-+		pxds[i] = pxd;
- 	}
- 
- 	if (failed) {
--		free_pmds(pmds);
-+		free_pxds(pxds);
- 		return -ENOMEM;
- 	}
- 
-@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
-  * preallocate which never got a corresponding vma will need to be
-  * freed manually.
-  */
--static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
-+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
- {
- 	int i;
- 
--	for(i = 0; i < PREALLOCATED_PMDS; i++) {
-+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
- 		pgd_t pgd = pgdp[i];
- 
- 		if (pgd_val(pgd) != 0) {
--			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
-+			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
- 
--			pgdp[i] = native_make_pgd(0);
-+			set_pgd(pgdp + i, native_make_pgd(0));
- 
--			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
--			pmd_free(mm, pmd);
-+			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
-+			pxd_free(mm, pxd);
- 		}
- 	}
- }
- 
--static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
-+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
- {
--	pud_t *pud;
-+	pyd_t *pyd;
- 	unsigned long addr;
- 	int i;
- 
--	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
-+	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
- 		return;
- 
--	pud = pud_offset(pgd, 0);
-+#ifdef CONFIG_X86_64
-+	pyd = pyd_offset(mm, 0L);
-+#else
-+	pyd = pyd_offset(pgd, 0L);
-+#endif
- 
-- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
--	     i++, pud++, addr += PUD_SIZE) {
--		pmd_t *pmd = pmds[i];
-+ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
-+	     i++, pyd++, addr += PYD_SIZE) {
-+		pxd_t *pxd = pxds[i];
- 
- 		if (i >= KERNEL_PGD_BOUNDARY)
--			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
--			       sizeof(pmd_t) * PTRS_PER_PMD);
-+			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-+			       sizeof(pxd_t) * PTRS_PER_PMD);
- 
--		pud_populate(mm, pud, pmd);
-+		pyd_populate(mm, pyd, pxd);
- 	}
- }
- 
- pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- 	pgd_t *pgd;
--	pmd_t *pmds[PREALLOCATED_PMDS];
-+	pxd_t *pxds[PREALLOCATED_PXDS];
-+
- 	unsigned long flags;
- 
- 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
-@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 
- 	mm->pgd = pgd;
- 
--	if (preallocate_pmds(pmds) != 0)
-+	if (preallocate_pxds(pxds) != 0)
- 		goto out_free_pgd;
- 
- 	if (paravirt_pgd_alloc(mm) != 0)
--		goto out_free_pmds;
-+		goto out_free_pxds;
- 
- 	/*
- 	 * Make sure that pre-populating the pmds is atomic with
-@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
- 	spin_lock_irqsave(&pgd_lock, flags);
- 
- 	pgd_ctor(pgd);
--	pgd_prepopulate_pmd(mm, pgd, pmds);
-+	pgd_prepopulate_pxd(mm, pgd, pxds);
- 
- 	spin_unlock_irqrestore(&pgd_lock, flags);
- 
- 	return pgd;
- 
--out_free_pmds:
--	free_pmds(pmds);
-+out_free_pxds:
-+	free_pxds(pxds);
- out_free_pgd:
- 	free_page((unsigned long)pgd);
- out:
-@@ -288,7 +354,7 @@ out:
- 
- void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- {
--	pgd_mop_up_pmds(mm, pgd);
-+	pgd_mop_up_pxds(mm, pgd);
- 	pgd_dtor(pgd);
- 	paravirt_pgd_free(mm, pgd);
- 	free_page((unsigned long)pgd);
-diff -urNp linux-2.6.32.13/arch/x86/mm/setup_nx.c linux-2.6.32.13/arch/x86/mm/setup_nx.c
---- linux-2.6.32.13/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/setup_nx.c	2010-05-15 13:21:14.258921790 -0400
-@@ -4,11 +4,10 @@
- 
- #include <asm/pgtable.h>
- 
-+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
- int nx_enabled;
- 
--#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
--static int disable_nx __cpuinitdata;
--
-+#ifndef CONFIG_PAX_PAGEEXEC
- /*
-  * noexec = on|off
-  *
-@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
- 	if (!str)
- 		return -EINVAL;
- 	if (!strncmp(str, "on", 2)) {
--		__supported_pte_mask |= _PAGE_NX;
--		disable_nx = 0;
-+		nx_enabled = 1;
- 	} else if (!strncmp(str, "off", 3)) {
--		disable_nx = 1;
--		__supported_pte_mask &= ~_PAGE_NX;
-+		nx_enabled = 0;
- 	}
- 	return 0;
- }
- early_param("noexec", noexec_setup);
- #endif
-+#endif
- 
- #ifdef CONFIG_X86_PAE
- void __init set_nx(void)
- {
--	unsigned int v[4], l, h;
-+	if (!nx_enabled && cpu_has_nx) {
-+		unsigned l, h;
- 
--	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
--		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
--
--		if ((v[3] & (1 << 20)) && !disable_nx) {
--			rdmsr(MSR_EFER, l, h);
--			l |= EFER_NX;
--			wrmsr(MSR_EFER, l, h);
--			nx_enabled = 1;
--			__supported_pte_mask |= _PAGE_NX;
--		}
-+		__supported_pte_mask &= ~_PAGE_NX;
-+		rdmsr(MSR_EFER, l, h);
-+		l &= ~EFER_NX;
-+		wrmsr(MSR_EFER, l, h);
- 	}
- }
- #else
-@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
- 	unsigned long efer;
- 
- 	rdmsrl(MSR_EFER, efer);
--	if (!(efer & EFER_NX) || disable_nx)
-+	if (!(efer & EFER_NX) || !nx_enabled)
- 		__supported_pte_mask &= ~_PAGE_NX;
- }
- #endif
-diff -urNp linux-2.6.32.13/arch/x86/mm/tlb.c linux-2.6.32.13/arch/x86/mm/tlb.c
---- linux-2.6.32.13/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/mm/tlb.c	2010-05-15 13:21:14.258921790 -0400
-@@ -12,7 +12,7 @@
- #include <asm/uv/uv.h>
- 
- DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
--			= { &init_mm, 0, };
-+			= { &init_mm, 0 };
- 
- /*
-  *	Smarter SMP flushing macros.
-@@ -61,7 +61,11 @@ void leave_mm(int cpu)
- 		BUG();
- 	cpumask_clear_cpu(cpu,
- 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
-+
-+#ifndef CONFIG_PAX_PER_CPU_PGD
- 	load_cr3(swapper_pg_dir);
-+#endif
-+
- }
- EXPORT_SYMBOL_GPL(leave_mm);
- 
-diff -urNp linux-2.6.32.13/arch/x86/oprofile/backtrace.c linux-2.6.32.13/arch/x86/oprofile/backtrace.c
---- linux-2.6.32.13/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/oprofile/backtrace.c	2010-05-15 13:21:14.258921790 -0400
-@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
- 	struct frame_head bufhead[2];
- 
- 	/* Also check accessibility of one struct frame_head beyond */
--	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
-+	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
- 		return NULL;
- 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
- 		return NULL;
-@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
- {
- 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
- 
--	if (!user_mode_vm(regs)) {
-+	if (!user_mode(regs)) {
- 		unsigned long stack = kernel_stack_pointer(regs);
- 		if (depth)
- 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
-diff -urNp linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/oprofile/op_model_p4.c	2010-05-15 13:21:14.270940782 -0400
-@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
- #endif
- }
- 
--static int inline addr_increment(void)
-+static inline int addr_increment(void)
- {
- #ifdef CONFIG_SMP
- 	return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.32.13/arch/x86/pci/common.c linux-2.6.32.13/arch/x86/pci/common.c
---- linux-2.6.32.13/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/common.c	2010-05-15 13:21:14.270940782 -0400
-@@ -31,8 +31,8 @@ int noioapicreroute = 1;
- int pcibios_last_bus = -1;
- unsigned long pirq_table_addr;
- struct pci_bus *pci_root_bus;
--struct pci_raw_ops *raw_pci_ops;
--struct pci_raw_ops *raw_pci_ext_ops;
-+const struct pci_raw_ops *raw_pci_ops;
-+const struct pci_raw_ops *raw_pci_ext_ops;
- 
- int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
- 						int reg, int len, u32 *val)
-@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- void __init dmi_check_pciprobe(void)
-diff -urNp linux-2.6.32.13/arch/x86/pci/direct.c linux-2.6.32.13/arch/x86/pci/direct.c
---- linux-2.6.32.13/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/direct.c	2010-05-15 13:21:14.270940782 -0400
-@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
- 
- #undef PCI_CONF1_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf1 = {
-+const struct pci_raw_ops pci_direct_conf1 = {
- 	.read =		pci_conf1_read,
- 	.write =	pci_conf1_write,
- };
-@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
- 
- #undef PCI_CONF2_ADDRESS
- 
--struct pci_raw_ops pci_direct_conf2 = {
-+const struct pci_raw_ops pci_direct_conf2 = {
- 	.read =		pci_conf2_read,
- 	.write =	pci_conf2_write,
- };
-@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
-  * This should be close to trivial, but it isn't, because there are buggy
-  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
-  */
--static int __init pci_sanity_check(struct pci_raw_ops *o)
-+static int __init pci_sanity_check(const struct pci_raw_ops *o)
- {
- 	u32 x = 0;
- 	int year, devfn;
-diff -urNp linux-2.6.32.13/arch/x86/pci/fixup.c linux-2.6.32.13/arch/x86/pci/fixup.c
---- linux-2.6.32.13/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/fixup.c	2010-05-15 13:21:14.270940782 -0400
-@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
-diff -urNp linux-2.6.32.13/arch/x86/pci/irq.c linux-2.6.32.13/arch/x86/pci/irq.c
---- linux-2.6.32.13/arch/x86/pci/irq.c	2010-04-29 17:49:37.625451376 -0400
-+++ linux-2.6.32.13/arch/x86/pci/irq.c	2010-05-15 13:21:14.270940782 -0400
-@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
- 	static struct pci_device_id __initdata pirq_440gx[] = {
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
--		{ },
-+		{ PCI_DEVICE(0, 0) }
- 	};
- 
- 	/* 440GX has a proprietary PIRQ router -- don't use it */
-@@ -1109,7 +1109,7 @@ static struct dmi_system_id __initdata p
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- int __init pcibios_irq_init(void)
-diff -urNp linux-2.6.32.13/arch/x86/pci/mmconfig_32.c linux-2.6.32.13/arch/x86/pci/mmconfig_32.c
---- linux-2.6.32.13/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/mmconfig_32.c	2010-05-15 13:21:14.270940782 -0400
-@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.13/arch/x86/pci/mmconfig_64.c linux-2.6.32.13/arch/x86/pci/mmconfig_64.c
---- linux-2.6.32.13/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/mmconfig_64.c	2010-05-15 13:21:14.270940782 -0400
-@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_mmcfg = {
-+static const struct pci_raw_ops pci_mmcfg = {
- 	.read =		pci_mmcfg_read,
- 	.write =	pci_mmcfg_write,
- };
-diff -urNp linux-2.6.32.13/arch/x86/pci/numaq_32.c linux-2.6.32.13/arch/x86/pci/numaq_32.c
---- linux-2.6.32.13/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/numaq_32.c	2010-05-15 13:21:14.270940782 -0400
-@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
- 
- #undef PCI_CONF1_MQ_ADDRESS
- 
--static struct pci_raw_ops pci_direct_conf1_mq = {
-+static const struct pci_raw_ops pci_direct_conf1_mq = {
- 	.read	= pci_conf1_mq_read,
- 	.write	= pci_conf1_mq_write
- };
-diff -urNp linux-2.6.32.13/arch/x86/pci/olpc.c linux-2.6.32.13/arch/x86/pci/olpc.c
---- linux-2.6.32.13/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/olpc.c	2010-05-15 13:21:14.270940782 -0400
-@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
- 	return 0;
- }
- 
--static struct pci_raw_ops pci_olpc_conf = {
-+static const struct pci_raw_ops pci_olpc_conf = {
- 	.read =	pci_olpc_read,
- 	.write = pci_olpc_write,
- };
-diff -urNp linux-2.6.32.13/arch/x86/pci/pcbios.c linux-2.6.32.13/arch/x86/pci/pcbios.c
---- linux-2.6.32.13/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/pci/pcbios.c	2010-05-15 13:21:14.274578804 -0400
-@@ -56,50 +56,93 @@ union bios32 {
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} bios32_indirect = { 0, __KERNEL_CS };
-+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
- 
- /*
-  * Returns the entry point for the given service, NULL on error
-  */
- 
--static unsigned long bios32_service(unsigned long service)
-+static unsigned long __devinit bios32_service(unsigned long service)
- {
- 	unsigned char return_code;	/* %al */
- 	unsigned long address;		/* %ebx */
- 	unsigned long length;		/* %ecx */
- 	unsigned long entry;		/* %edx */
- 	unsigned long flags;
-+	struct desc_struct d, *gdt;
- 
- 	local_irq_save(flags);
--	__asm__("lcall *(%%edi); cld"
-+
-+	gdt = get_cpu_gdt_table(smp_processor_id());
-+
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
-+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+
-+	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
- 		: "=a" (return_code),
- 		  "=b" (address),
- 		  "=c" (length),
- 		  "=d" (entry)
- 		: "0" (service),
- 		  "1" (0),
--		  "D" (&bios32_indirect));
-+		  "D" (&bios32_indirect),
-+		  "r"(__PCIBIOS_DS)
-+		: "memory");
-+
-+	pax_open_kernel();
-+	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
-+	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
-+	pax_close_kernel();
-+
- 	local_irq_restore(flags);
- 
- 	switch (return_code) {
--		case 0:
--			return address + entry;
--		case 0x80:	/* Not present */
--			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
--			return 0;
--		default: /* Shouldn't happen */
--			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
--				service, return_code);
-+	case 0: {
-+		int cpu;
-+		unsigned char flags;
-+
-+		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
-+		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
-+			printk(KERN_WARNING "bios32_service: not valid\n");
- 			return 0;
-+		}
-+		address = address + PAGE_OFFSET;
-+		length += 16UL; /* some BIOSs underreport this... */
-+		flags = 4;
-+		if (length >= 64*1024*1024) {
-+			length >>= PAGE_SHIFT;
-+			flags |= 8;
-+		}
-+
-+		for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+			gdt = get_cpu_gdt_table(cpu);
-+			pack_descriptor(&d, address, length, 0x9b, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
-+			pack_descriptor(&d, address, length, 0x93, flags);
-+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
-+		}
-+		return entry;
-+	}
-+	case 0x80:	/* Not present */
-+		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-+		return 0;
-+	default: /* Shouldn't happen */
-+		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-+			service, return_code);
-+		return 0;
- 	}
- }
- 
- static struct {
- 	unsigned long address;
- 	unsigned short segment;
--} pci_indirect = { 0, __KERNEL_CS };
-+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
- 
--static int pci_bios_present;
-+static int pci_bios_present __read_only;
- 
- static int __devinit check_pcibios(void)
- {
-@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
- 	unsigned long flags, pcibios_entry;
- 
- 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
--		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
-+		pci_indirect.address = pcibios_entry;
- 
- 		local_irq_save(flags);
--		__asm__(
--			"lcall *(%%edi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%edi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
- 			  "=b" (ebx),
- 			  "=c" (ecx)
- 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
--			  "D" (&pci_indirect)
-+			  "D" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS)
- 			: "memory");
- 		local_irq_restore(flags);
- 
-@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 8 bits, do not trust the
- 		 * BIOS having done it:
-@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xff;
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_WORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		/*
- 		 * Zero-extend the result beyond 16 bits, do not trust the
- 		 * BIOS having done it:
-@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
- 		*value &= 0xffff;
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
- 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
- 
- 	switch (len) {
- 	case 1:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 2:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	case 4:
--		__asm__("lcall *(%%esi); cld\n\t"
-+		__asm__("movw %w6, %%ds\n\t"
-+			"lcall *%%ss:(%%esi); cld\n\t"
-+			"push %%ss\n\t"
-+			"pop %%ds\n\t"
- 			"jc 1f\n\t"
- 			"xor %%ah, %%ah\n"
- 			"1:"
-@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
- 			  "c" (value),
- 			  "b" (bx),
- 			  "D" ((long)reg),
--			  "S" (&pci_indirect));
-+			  "S" (&pci_indirect),
-+			  "r" (__PCIBIOS_DS));
- 		break;
- 	}
- 
-@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
-  * Function table for BIOS32 access
-  */
- 
--static struct pci_raw_ops pci_bios_access = {
-+static const struct pci_raw_ops pci_bios_access = {
- 	.read =		pci_bios_read,
- 	.write =	pci_bios_write
- };
-@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
-  * Try to find PCI BIOS.
-  */
- 
--static struct pci_raw_ops * __devinit pci_find_bios(void)
-+static const struct pci_raw_ops * __devinit pci_find_bios(void)
- {
- 	union bios32 *check;
- 	unsigned char sum;
-@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
- 
- 	DBG("PCI: Fetching IRQ routing table... ");
- 	__asm__("push %%es\n\t"
-+		"movw %w8, %%ds\n\t"
- 		"push %%ds\n\t"
- 		"pop  %%es\n\t"
--		"lcall *(%%esi); cld\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
- 		"pop %%es\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
- 		  "1" (0),
- 		  "D" ((long) &opt),
- 		  "S" (&pci_indirect),
--		  "m" (opt)
-+		  "m" (opt),
-+		  "r" (__PCIBIOS_DS)
- 		: "memory");
- 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
- 	if (ret & 0xff00)
-@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
- {
- 	int ret;
- 
--	__asm__("lcall *(%%esi); cld\n\t"
-+	__asm__("movw %w5, %%ds\n\t"
-+		"lcall *%%ss:(%%esi); cld\n\t"
-+		"push %%ss\n\t"
-+		"pop %%ds\n"
- 		"jc 1f\n\t"
- 		"xor %%ah, %%ah\n"
- 		"1:"
-@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
- 		: "0" (PCIBIOS_SET_PCI_HW_INT),
- 		  "b" ((dev->bus->number << 8) | dev->devfn),
- 		  "c" ((irq << 8) | (pin + 10)),
--		  "S" (&pci_indirect));
-+		  "S" (&pci_indirect),
-+		  "r" (__PCIBIOS_DS));
- 	return !(ret & 0xff00);
- }
- EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.32.13/arch/x86/power/cpu.c linux-2.6.32.13/arch/x86/power/cpu.c
---- linux-2.6.32.13/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/power/cpu.c	2010-05-15 13:21:14.274578804 -0400
-@@ -126,7 +126,7 @@ static void do_fpu_end(void)
- static void fix_processor_context(void)
- {
- 	int cpu = smp_processor_id();
--	struct tss_struct *t = &per_cpu(init_tss, cpu);
-+	struct tss_struct *t = init_tss + cpu;
- 
- 	set_tss_desc(cpu, t);	/*
- 				 * This just modifies memory; should not be
-@@ -136,7 +136,9 @@ static void fix_processor_context(void)
- 				 */
- 
- #ifdef CONFIG_X86_64
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
-+	pax_close_kernel();
- 
- 	syscall_init();				/* This sets MSR_*STAR and related */
- #endif
-diff -urNp linux-2.6.32.13/arch/x86/vdso/Makefile linux-2.6.32.13/arch/x86/vdso/Makefile
---- linux-2.6.32.13/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/Makefile	2010-05-15 13:21:14.274578804 -0400
-@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
- 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
- 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
- 
--VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- GCOV_PROFILE := n
- 
- #
-diff -urNp linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/vclock_gettime.c	2010-05-15 13:21:14.274578804 -0400
-@@ -22,24 +22,48 @@
- #include <asm/hpet.h>
- #include <asm/unistd.h>
- #include <asm/io.h>
-+#include <asm/fixmap.h>
- #include "vextern.h"
- 
- #define gtod vdso_vsyscall_gtod_data
- 
-+notrace noinline long __vdso_fallback_time(long *t)
-+{
-+	long secs;
-+	asm volatile("syscall"
-+		: "=a" (secs)
-+		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
-+	return secs;
-+}
-+
- notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
- {
- 	long ret;
- 	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
-+	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
- 	return ret;
- }
- 
-+notrace static inline cycle_t __vdso_vread_hpet(void)
-+{
-+	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
-+}
-+
-+notrace static inline cycle_t __vdso_vread_tsc(void)
-+{
-+	cycle_t ret = (cycle_t)vget_cycles();
-+
-+	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
-+}
-+
- notrace static inline long vgetns(void)
- {
- 	long v;
--	cycles_t (*vread)(void);
--	vread = gtod->clock.vread;
--	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
-+	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
-+		v = __vdso_vread_tsc();
-+	else
-+		v = __vdso_vread_hpet();
-+	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
- 	return (v * gtod->clock.mult) >> gtod->clock.shift;
- }
- 
-@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
- 
- notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
- {
--	if (likely(gtod->sysctl_enabled))
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
- 		switch (clock) {
- 		case CLOCK_REALTIME:
- 			if (likely(gtod->clock.vread))
-@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
- int clock_gettime(clockid_t, struct timespec *)
- 	__attribute__((weak, alias("__vdso_clock_gettime")));
- 
--notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
- {
- 	long ret;
--	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
-+	asm("syscall" : "=a" (ret) :
-+	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
-+	return ret;
-+}
-+
-+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
-+{
-+	if (likely(gtod->sysctl_enabled &&
-+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
-+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
-+	{
- 		if (likely(tv != NULL)) {
- 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
- 				     offsetof(struct timespec, tv_nsec) ||
-@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
- 		}
- 		return 0;
- 	}
--	asm("syscall" : "=a" (ret) :
--	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
--	return ret;
-+	return __vdso_fallback_gettimeofday(tv, tz);
- }
- int gettimeofday(struct timeval *, struct timezone *)
- 	__attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/vdso32-setup.c	2010-05-15 13:21:14.274578804 -0400
-@@ -25,6 +25,7 @@
- #include <asm/tlbflush.h>
- #include <asm/vdso.h>
- #include <asm/proto.h>
-+#include <asm/mman.h>
- 
- enum {
- 	VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
- void enable_sep_cpu(void)
- {
- 	int cpu = get_cpu();
--	struct tss_struct *tss = &per_cpu(init_tss, cpu);
-+	struct tss_struct *tss = init_tss + cpu;
- 
- 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
- 		put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
- 	if (compat)
- 		addr = VDSO_HIGH_BASE;
- 	else {
--		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
-+		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
- 		if (IS_ERR_VALUE(addr)) {
- 			ret = addr;
- 			goto up_fail;
- 		}
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	if (compat_uses_vma || !compat) {
- 		/*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
- 	}
- 
- 	current_thread_info()->sysenter_return =
--		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
-+		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
- 
-   up_fail:
- 	if (ret)
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 
- 	up_write(&mm->mmap_sem);
- 
-@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static ctl_table abi_root_table2[] = {
-@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
- 		.mode = 0555,
- 		.child = abi_table2
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static __init int ia32_binfmt_init(void)
-@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
- 
- const char *arch_vma_name(struct vm_area_struct *vma)
- {
--	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
-+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
- 		return "[vdso]";
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
-+		return "[vdso]";
-+#endif
-+
- 	return NULL;
- }
- 
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
- 	struct mm_struct *mm = tsk->mm;
- 
- 	/* Check to see if this task was created in compat vdso mode */
--	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
-+	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
- 		return &gate_vma;
- 	return NULL;
- }
-diff -urNp linux-2.6.32.13/arch/x86/vdso/vdso.lds.S linux-2.6.32.13/arch/x86/vdso/vdso.lds.S
---- linux-2.6.32.13/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/vdso.lds.S	2010-05-15 13:21:14.274578804 -0400
-@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
- #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
- #include "vextern.h"
- #undef	VEXTERN
-+
-+#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
-+VEXTERN(fallback_gettimeofday)
-+VEXTERN(fallback_time)
-+VEXTERN(getcpu)
-+#undef	VEXTERN
-diff -urNp linux-2.6.32.13/arch/x86/vdso/vextern.h linux-2.6.32.13/arch/x86/vdso/vextern.h
---- linux-2.6.32.13/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/vextern.h	2010-05-15 13:21:14.274578804 -0400
-@@ -11,6 +11,5 @@
-    put into vextern.h and be referenced as a pointer with vdso prefix.
-    The main kernel later fills in the values.   */
- 
--VEXTERN(jiffies)
- VEXTERN(vgetcpu_mode)
- VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.32.13/arch/x86/vdso/vma.c linux-2.6.32.13/arch/x86/vdso/vma.c
---- linux-2.6.32.13/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/vdso/vma.c	2010-05-15 13:21:14.274578804 -0400
-@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
- 	if (!vbase)
- 		goto oom;
- 
--	if (memcmp(vbase, "\177ELF", 4)) {
-+	if (memcmp(vbase, ELFMAG, SELFMAG)) {
- 		printk("VDSO: I'm broken; not ELF\n");
- 		vdso_enabled = 0;
- 	}
-@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
- 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
- #include "vextern.h"
- #undef VEXTERN
-+	vunmap(vbase);
- 	return 0;
- 
-  oom:
-@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
- 		goto up_fail;
- 	}
- 
--	current->mm->context.vdso = (void *)addr;
-+	current->mm->context.vdso = addr;
- 
- 	ret = install_special_mapping(mm, addr, vdso_size,
- 				      VM_READ|VM_EXEC|
-@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
- 				      VM_ALWAYSDUMP,
- 				      vdso_pages);
- 	if (ret) {
--		current->mm->context.vdso = NULL;
-+		current->mm->context.vdso = 0;
- 		goto up_fail;
- 	}
- 
-@@ -132,10 +133,3 @@ up_fail:
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
--
--static __init int vdso_setup(char *s)
--{
--	vdso_enabled = simple_strtoul(s, NULL, 0);
--	return 0;
--}
--__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.32.13/arch/x86/xen/enlighten.c linux-2.6.32.13/arch/x86/xen/enlighten.c
---- linux-2.6.32.13/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/xen/enlighten.c	2010-05-15 13:23:38.934774262 -0400
-@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
- 
- struct shared_info xen_dummy_shared_info;
- 
--void *xen_initial_gdt;
--
- /*
-  * Point at some empty memory to start with. We map the real shared_info
-  * page as soon as fixmap is up and running.
-@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
- 
- 	preempt_disable();
- 
--	start = __get_cpu_var(idt_desc).address;
-+	start = (unsigned long)__get_cpu_var(idt_desc).address;
- 	end = start + __get_cpu_var(idt_desc).size + 1;
- 
- 	xen_mc_flush();
-@@ -1102,6 +1100,16 @@ asmlinkage void __init xen_start_kernel(
- #ifdef CONFIG_X86_64
- 	/* Work out if we support NX */
- 	check_efer();
-+#elif defined(CONFIG_X86_PAE)
-+	if (cpu_has_nx) {
-+		unsigned l, h;
-+
-+		nx_enabled = 1;
-+		__supported_pte_mask |= _PAGE_NX;
-+		rdmsr(MSR_EFER, l, h);
-+		l |= EFER_NX;
-+		wrmsr(MSR_EFER, l, h);
-+	}
- #endif
- 
- 	xen_setup_features();
-@@ -1133,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(
- 
- 	machine_ops = xen_machine_ops;
- 
--	/*
--	 * The only reliable way to retain the initial address of the
--	 * percpu gdt_page is to remember it here, so we can go and
--	 * mark it RW later, when the initial percpu area is freed.
--	 */
--	xen_initial_gdt = &per_cpu(gdt_page, 0);
--
- 	xen_smp_init();
- 
- 	pgd = (pgd_t *)xen_start_info->pt_base;
-diff -urNp linux-2.6.32.13/arch/x86/xen/mmu.c linux-2.6.32.13/arch/x86/xen/mmu.c
---- linux-2.6.32.13/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/xen/mmu.c	2010-05-15 13:21:14.282910849 -0400
-@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	convert_pfn_mfn(init_level4_pgt);
- 	convert_pfn_mfn(level3_ident_pgt);
- 	convert_pfn_mfn(level3_kernel_pgt);
-+	convert_pfn_mfn(level3_vmalloc_pgt);
-+	convert_pfn_mfn(level3_vmemmap_pgt);
- 
- 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
- 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
- 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
-+	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-+	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
- 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
- 
-diff -urNp linux-2.6.32.13/arch/x86/xen/smp.c linux-2.6.32.13/arch/x86/xen/smp.c
---- linux-2.6.32.13/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/xen/smp.c	2010-05-15 13:21:14.282910849 -0400
-@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
- {
- 	BUG_ON(smp_processor_id() != 0);
- 	native_smp_prepare_boot_cpu();
--
--	/* We've switched to the "real" per-cpu gdt, so make sure the
--	   old memory can be recycled */
--	make_lowmem_page_readwrite(xen_initial_gdt);
--
- 	xen_setup_vcpu_info_placement();
- }
- 
-@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
- 	gdt = get_cpu_gdt_table(cpu);
- 
- 	ctxt->flags = VGCF_IN_KERNEL;
--	ctxt->user_regs.ds = __USER_DS;
--	ctxt->user_regs.es = __USER_DS;
-+	ctxt->user_regs.ds = __KERNEL_DS;
-+	ctxt->user_regs.es = __KERNEL_DS;
- 	ctxt->user_regs.ss = __KERNEL_DS;
- #ifdef CONFIG_X86_32
- 	ctxt->user_regs.fs = __KERNEL_PERCPU;
-diff -urNp linux-2.6.32.13/arch/x86/xen/xen-head.S linux-2.6.32.13/arch/x86/xen/xen-head.S
---- linux-2.6.32.13/arch/x86/xen/xen-head.S	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/xen/xen-head.S	2010-05-15 13:21:14.282910849 -0400
-@@ -19,6 +19,17 @@ ENTRY(startup_xen)
- #ifdef CONFIG_X86_32
- 	mov %esi,xen_start_info
- 	mov $init_thread_union+THREAD_SIZE,%esp
-+#ifdef CONFIG_SMP
-+	movl $cpu_gdt_table,%edi
-+	movl $__per_cpu_load,%eax
-+	movw %ax,__KERNEL_PERCPU + 2(%edi)
-+	rorl $16,%eax
-+	movb %al,__KERNEL_PERCPU + 4(%edi)
-+	movb %ah,__KERNEL_PERCPU + 7(%edi)
-+	movl $__per_cpu_end - 1,%eax
-+	subl $__per_cpu_start,%eax
-+	movw %ax,__KERNEL_PERCPU + 0(%edi)
-+#endif
- #else
- 	mov %rsi,xen_start_info
- 	mov $init_thread_union+THREAD_SIZE,%rsp
-diff -urNp linux-2.6.32.13/arch/x86/xen/xen-ops.h linux-2.6.32.13/arch/x86/xen/xen-ops.h
---- linux-2.6.32.13/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/arch/x86/xen/xen-ops.h	2010-05-15 13:21:14.282910849 -0400
-@@ -10,8 +10,6 @@
- extern const char xen_hypervisor_callback[];
- extern const char xen_failsafe_callback[];
- 
--extern void *xen_initial_gdt;
--
- struct trap_info;
- void xen_copy_trap_info(struct trap_info *traps);
- 
-diff -urNp linux-2.6.32.13/block/blk-integrity.c linux-2.6.32.13/block/blk-integrity.c
---- linux-2.6.32.13/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/blk-integrity.c	2010-05-15 13:21:14.282910849 -0400
-@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
- 	NULL,
- };
- 
--static struct sysfs_ops integrity_ops = {
-+static const struct sysfs_ops integrity_ops = {
- 	.show	= &integrity_attr_show,
- 	.store	= &integrity_attr_store,
- };
-diff -urNp linux-2.6.32.13/block/blk-iopoll.c linux-2.6.32.13/block/blk-iopoll.c
---- linux-2.6.32.13/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/blk-iopoll.c	2010-05-15 13:21:14.282910849 -0400
-@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
- }
- EXPORT_SYMBOL(blk_iopoll_complete);
- 
--static void blk_iopoll_softirq(struct softirq_action *h)
-+static void blk_iopoll_softirq(void)
- {
- 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
- 	int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.32.13/block/blk-map.c linux-2.6.32.13/block/blk-map.c
---- linux-2.6.32.13/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/blk-map.c	2010-05-15 13:21:14.282910849 -0400
-@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
- 	 * direct dma. else, set up kernel bounce buffers
- 	 */
- 	uaddr = (unsigned long) ubuf;
--	if (blk_rq_aligned(q, ubuf, len) && !map_data)
-+	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
- 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
- 	else
- 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
-@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
- 	if (!len || !kbuf)
- 		return -EINVAL;
- 
--	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
-+	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
- 	if (do_copy)
- 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
- 	else
-diff -urNp linux-2.6.32.13/block/blk-softirq.c linux-2.6.32.13/block/blk-softirq.c
---- linux-2.6.32.13/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/blk-softirq.c	2010-05-15 13:21:14.282910849 -0400
-@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
-  * Softirq action handler - move entries to local list and loop over them
-  * while passing them to the queue registered handler.
-  */
--static void blk_done_softirq(struct softirq_action *h)
-+static void blk_done_softirq(void)
- {
- 	struct list_head *cpu_list, local_list;
- 
-diff -urNp linux-2.6.32.13/block/blk-sysfs.c linux-2.6.32.13/block/blk-sysfs.c
---- linux-2.6.32.13/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/blk-sysfs.c	2010-05-15 13:21:14.282910849 -0400
-@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
- 	kmem_cache_free(blk_requestq_cachep, q);
- }
- 
--static struct sysfs_ops queue_sysfs_ops = {
-+static const struct sysfs_ops queue_sysfs_ops = {
- 	.show	= queue_attr_show,
- 	.store	= queue_attr_store,
- };
-diff -urNp linux-2.6.32.13/block/elevator.c linux-2.6.32.13/block/elevator.c
---- linux-2.6.32.13/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/block/elevator.c	2010-05-15 13:21:14.282910849 -0400
-@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
- 	return error;
- }
- 
--static struct sysfs_ops elv_sysfs_ops = {
-+static const struct sysfs_ops elv_sysfs_ops = {
- 	.show	= elv_attr_show,
- 	.store	= elv_attr_store,
- };
-diff -urNp linux-2.6.32.13/crypto/lrw.c linux-2.6.32.13/crypto/lrw.c
---- linux-2.6.32.13/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/crypto/lrw.c	2010-05-15 13:21:14.282910849 -0400
-@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
- 	struct priv *ctx = crypto_tfm_ctx(parent);
- 	struct crypto_cipher *child = ctx->child;
- 	int err, i;
--	be128 tmp = { 0 };
-+	be128 tmp = { 0, 0 };
- 	int bsize = crypto_cipher_blocksize(child);
- 
- 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
-diff -urNp linux-2.6.32.13/Documentation/dontdiff linux-2.6.32.13/Documentation/dontdiff
---- linux-2.6.32.13/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/Documentation/dontdiff	2010-05-15 13:21:14.282910849 -0400
-@@ -3,6 +3,7 @@
- *.bin
- *.cpio
- *.csp
-+*.dbg
- *.dsp
- *.dvi
- *.elf
-@@ -40,6 +41,7 @@
- *.ver
- *.xml
- *_MODULES
-+*_reg_safe.h
- *_vga16.c
- *~
- *.9
-@@ -49,11 +51,16 @@
- 53c700_d.h
- CVS
- ChangeSet
-+GPATH
-+GRTAGS
-+GSYMS
-+GTAGS
- Image
- Kerntypes
- Module.markers
- Module.symvers
- PENDING
-+PERF*
- SCCS
- System.map*
- TAGS
-@@ -76,7 +83,10 @@ btfixupprep
- build
- bvmlinux
- bzImage*
-+capflags.c
- classlist.h*
-+clut_vga16.c
-+common-cmds.h
- comp*.log
- compile.h*
- conf
-@@ -103,13 +113,14 @@ gen_crc32table
- gen_init_cpio
- genksyms
- *_gray256.c
-+hash
- ihex2fw
- ikconfig.h*
- initramfs_data.cpio
-+initramfs_data.cpio.bz2
- initramfs_data.cpio.gz
- initramfs_list
- kallsyms
--kconfig
- keywords.c
- ksym.c*
- ksym.h*
-@@ -133,7 +144,9 @@ mkboot
- mkbugboot
- mkcpustr
- mkdep
-+mkpiggy
- mkprep
-+mkregtable
- mktables
- mktree
- modpost
-@@ -149,6 +162,7 @@ patches*
- pca200e.bin
- pca200e_ecd.bin2
- piggy.gz
-+piggy.S
- piggyback
- pnmtologo
- ppc_defs.h*
-@@ -163,6 +177,7 @@ setup
- setup.bin
- setup.elf
- sImage
-+slabinfo
- sm_tbl*
- split-include
- syscalltab.h
-@@ -186,14 +201,20 @@ version.h*
- vmlinux
- vmlinux-*
- vmlinux.aout
-+vmlinux.bin.all
-+vmlinux.bin.bz2
- vmlinux.lds
-+vmlinux.relocs
-+voffset.h
- vsyscall.lds
- vsyscall_32.lds
- wanxlfw.inc
- uImage
- unifdef
-+utsrelease.h
- wakeup.bin
- wakeup.elf
- wakeup.lds
- zImage*
- zconf.hash.c
-+zoffset.h
-diff -urNp linux-2.6.32.13/Documentation/kernel-parameters.txt linux-2.6.32.13/Documentation/kernel-parameters.txt
---- linux-2.6.32.13/Documentation/kernel-parameters.txt	2010-05-15 13:20:18.374565913 -0400
-+++ linux-2.6.32.13/Documentation/kernel-parameters.txt	2010-05-15 13:21:14.282910849 -0400
-@@ -1836,6 +1836,12 @@ and is between 256 and 4096 characters. 
- 			the specified number of seconds.  This is to be used if
- 			your oopses keep scrolling off the screen.
- 
-+	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
-+			virtualization environments that don't cope well with the
-+			expand down segment used by UDEREF on X86-32.
-+
-+	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
-+
- 	pcbit=		[HW,ISDN]
- 
- 	pcd.		[PARIDE]
-diff -urNp linux-2.6.32.13/drivers/acpi/battery.c linux-2.6.32.13/drivers/acpi/battery.c
---- linux-2.6.32.13/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/battery.c	2010-05-15 13:21:14.282910849 -0400
-@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
- 	}
- 
- static struct battery_file {
--	struct file_operations ops;
-+	const struct file_operations ops;
- 	mode_t mode;
- 	const char *name;
- } acpi_battery_file[] = {
-diff -urNp linux-2.6.32.13/drivers/acpi/blacklist.c linux-2.6.32.13/drivers/acpi/blacklist.c
---- linux-2.6.32.13/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/blacklist.c	2010-05-15 13:21:14.295422110 -0400
-@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
- 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
- 	 "Incorrect _ADR", 1},
- 
--	{""}
-+	{"", "", 0, NULL, all_versions, NULL, 0}
- };
- 
- #if	CONFIG_ACPI_BLACKLIST_YEAR
-diff -urNp linux-2.6.32.13/drivers/acpi/dock.c linux-2.6.32.13/drivers/acpi/dock.c
---- linux-2.6.32.13/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/dock.c	2010-05-15 13:21:14.298962418 -0400
-@@ -77,7 +77,7 @@ struct dock_dependent_device {
- 	struct list_head list;
- 	struct list_head hotplug_list;
- 	acpi_handle handle;
--	struct acpi_dock_ops *ops;
-+	const struct acpi_dock_ops *ops;
- 	void *context;
- };
- 
-@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
-  * the dock driver after _DCK is executed.
-  */
- int
--register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
-+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
- 			     void *context)
- {
- 	struct dock_dependent_device *dd;
-diff -urNp linux-2.6.32.13/drivers/acpi/osl.c linux-2.6.32.13/drivers/acpi/osl.c
---- linux-2.6.32.13/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/osl.c	2010-05-15 13:21:14.298962418 -0400
-@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 	if (!value)
- 		value = &dummy;
- 
-@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
- 	void __iomem *virt_addr;
- 
- 	virt_addr = ioremap(phys_addr, width);
-+	if (!virt_addr)
-+		return AE_NO_MEMORY;
- 
- 	switch (width) {
- 	case 8:
-diff -urNp linux-2.6.32.13/drivers/acpi/power_meter.c linux-2.6.32.13/drivers/acpi/power_meter.c
---- linux-2.6.32.13/drivers/acpi/power_meter.c	2010-05-15 13:20:18.454567530 -0400
-+++ linux-2.6.32.13/drivers/acpi/power_meter.c	2010-05-15 13:21:14.298962418 -0400
-@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
- 		return res;
- 
- 	temp /= 1000;
--	if (temp < 0)
--		return -EINVAL;
- 
- 	mutex_lock(&resource->lock);
- 	resource->trip[attr->index - 7] = temp;
-diff -urNp linux-2.6.32.13/drivers/acpi/proc.c linux-2.6.32.13/drivers/acpi/proc.c
---- linux-2.6.32.13/drivers/acpi/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/proc.c	2010-05-15 13:21:14.307002164 -0400
-@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
- 				size_t count, loff_t * ppos)
- {
- 	struct list_head *node, *next;
--	char strbuf[5];
--	char str[5] = "";
--	unsigned int len = count;
-+	char strbuf[5] = {0};
- 	struct acpi_device *found_dev = NULL;
- 
--	if (len > 4)
--		len = 4;
--	if (len < 0)
--		return -EFAULT;
-+	if (count > 4)
-+		count = 4;
- 
--	if (copy_from_user(strbuf, buffer, len))
-+	if (copy_from_user(strbuf, buffer, count))
- 		return -EFAULT;
--	strbuf[len] = '\0';
--	sscanf(strbuf, "%s", str);
-+	strbuf[count] = '\0';
- 
- 	mutex_lock(&acpi_device_lock);
- 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
-@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
- 		if (!dev->wakeup.flags.valid)
- 			continue;
- 
--		if (!strncmp(dev->pnp.bus_id, str, 4)) {
-+		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
- 			dev->wakeup.state.enabled =
- 			    dev->wakeup.state.enabled ? 0 : 1;
- 			found_dev = dev;
-diff -urNp linux-2.6.32.13/drivers/acpi/processor_core.c linux-2.6.32.13/drivers/acpi/processor_core.c
---- linux-2.6.32.13/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/processor_core.c	2010-05-15 13:21:14.307002164 -0400
-@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
- 		return 0;
- 	}
- 
--	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
-+	BUG_ON(pr->id >= nr_cpu_ids);
- 
- 	/*
- 	 * Buggy BIOS check
-diff -urNp linux-2.6.32.13/drivers/acpi/processor_idle.c linux-2.6.32.13/drivers/acpi/processor_idle.c
---- linux-2.6.32.13/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/processor_idle.c	2010-05-15 13:21:14.330926828 -0400
-@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
- 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
- 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
- 	 (void *)1},
--	{},
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
- };
- 
- 
-diff -urNp linux-2.6.32.13/drivers/acpi/sleep.c linux-2.6.32.13/drivers/acpi/sleep.c
---- linux-2.6.32.13/drivers/acpi/sleep.c	2010-05-15 13:20:18.454567530 -0400
-+++ linux-2.6.32.13/drivers/acpi/sleep.c	2010-05-15 13:21:14.330926828 -0400
-@@ -302,7 +302,7 @@ static int acpi_suspend_state_valid(susp
- 	}
- }
- 
--static struct platform_suspend_ops acpi_suspend_ops = {
-+static const struct platform_suspend_ops acpi_suspend_ops = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin,
- 	.prepare_late = acpi_pm_prepare,
-@@ -330,7 +330,7 @@ static int acpi_suspend_begin_old(suspen
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_suspend_ops acpi_suspend_ops_old = {
-+static const struct platform_suspend_ops acpi_suspend_ops_old = {
- 	.valid = acpi_suspend_state_valid,
- 	.begin = acpi_suspend_begin_old,
- 	.prepare_late = acpi_pm_disable_gpes,
-@@ -701,7 +701,7 @@ static void acpi_pm_enable_gpes(void)
- 	acpi_enable_all_runtime_gpes();
- }
- 
--static struct platform_hibernation_ops acpi_hibernation_ops = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops = {
- 	.begin = acpi_hibernation_begin,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot,
-@@ -754,7 +754,7 @@ static int acpi_hibernation_pre_snapshot
-  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
-  * been requested.
-  */
--static struct platform_hibernation_ops acpi_hibernation_ops_old = {
-+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
- 	.begin = acpi_hibernation_begin_old,
- 	.end = acpi_pm_end,
- 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
-diff -urNp linux-2.6.32.13/drivers/acpi/video.c linux-2.6.32.13/drivers/acpi/video.c
---- linux-2.6.32.13/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/acpi/video.c	2010-05-15 13:21:14.330926828 -0400
-@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
- 				vd->brightness->levels[request_level]);
- }
- 
--static struct backlight_ops acpi_backlight_ops = {
-+static const struct backlight_ops acpi_backlight_ops = {
- 	.get_brightness = acpi_video_get_brightness,
- 	.update_status  = acpi_video_set_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/ahci.c linux-2.6.32.13/drivers/ata/ahci.c
---- linux-2.6.32.13/drivers/ata/ahci.c	2010-04-29 17:49:37.661448235 -0400
-+++ linux-2.6.32.13/drivers/ata/ahci.c	2010-05-15 13:21:14.374114367 -0400
-@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
- 	.sdev_attrs		= ahci_sdev_attrs,
- };
- 
--static struct ata_port_operations ahci_ops = {
-+static const struct ata_port_operations ahci_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
-@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
- 	.port_stop		= ahci_port_stop,
- };
- 
--static struct ata_port_operations ahci_vt8251_ops = {
-+static const struct ata_port_operations ahci_vt8251_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_vt8251_hardreset,
- };
- 
--static struct ata_port_operations ahci_p5wdh_ops = {
-+static const struct ata_port_operations ahci_p5wdh_ops = {
- 	.inherits		= &ahci_ops,
- 	.hardreset		= ahci_p5wdh_hardreset,
- };
- 
--static struct ata_port_operations ahci_sb600_ops = {
-+static const struct ata_port_operations ahci_sb600_ops = {
- 	.inherits		= &ahci_ops,
- 	.softreset		= ahci_sb600_softreset,
- 	.pmp_softreset		= ahci_sb600_softreset,
-@@ -687,7 +687,7 @@ static const struct pci_device_id ahci_p
- 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
- 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
- 
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- 
-diff -urNp linux-2.6.32.13/drivers/ata/ata_generic.c linux-2.6.32.13/drivers/ata/ata_generic.c
---- linux-2.6.32.13/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/ata_generic.c	2010-05-15 13:21:14.387424242 -0400
-@@ -95,7 +95,7 @@ static struct scsi_host_template generic
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations generic_port_ops = {
-+static const struct ata_port_operations generic_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_mode	= generic_set_mode,
-diff -urNp linux-2.6.32.13/drivers/ata/ata_piix.c linux-2.6.32.13/drivers/ata/ata_piix.c
---- linux-2.6.32.13/drivers/ata/ata_piix.c	2010-04-29 17:49:37.669446700 -0400
-+++ linux-2.6.32.13/drivers/ata/ata_piix.c	2010-05-15 13:21:14.387424242 -0400
-@@ -299,7 +299,7 @@ static const struct pci_device_id piix_p
- 	{ 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
- 	/* SATA Controller IDE (CPT) */
- 	{ 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- static struct pci_driver piix_pci_driver = {
-@@ -317,7 +317,7 @@ static struct scsi_host_template piix_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations piix_pata_ops = {
-+static const struct ata_port_operations piix_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= piix_set_piomode,
-@@ -325,22 +325,22 @@ static struct ata_port_operations piix_p
- 	.prereset		= piix_pata_prereset,
- };
- 
--static struct ata_port_operations piix_vmw_ops = {
-+static const struct ata_port_operations piix_vmw_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.bmdma_status		= piix_vmw_bmdma_status,
- };
- 
--static struct ata_port_operations ich_pata_ops = {
-+static const struct ata_port_operations ich_pata_ops = {
- 	.inherits		= &piix_pata_ops,
- 	.cable_detect		= ich_pata_cable_detect,
- 	.set_dmamode		= ich_set_dmamode,
- };
- 
--static struct ata_port_operations piix_sata_ops = {
-+static const struct ata_port_operations piix_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- };
- 
--static struct ata_port_operations piix_sidpr_sata_ops = {
-+static const struct ata_port_operations piix_sidpr_sata_ops = {
- 	.inherits		= &piix_sata_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= piix_sidpr_scr_read,
-@@ -616,7 +616,7 @@ static const struct ich_laptop ich_lapto
- 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
- 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
- 	/* end marker */
--	{ 0, }
-+	{ 0, 0, 0 }
- };
- 
- /**
-@@ -1094,7 +1094,7 @@ static int piix_broken_suspend(void)
- 			},
- 		},
- 
--		{ }	/* terminate list */
-+		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
- 	};
- 	static const char *oemstrs[] = {
- 		"Tecra M3,",
-diff -urNp linux-2.6.32.13/drivers/ata/libata-acpi.c linux-2.6.32.13/drivers/ata/libata-acpi.c
---- linux-2.6.32.13/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/libata-acpi.c	2010-05-15 13:21:14.387424242 -0400
-@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
- 	ata_acpi_uevent(dev->link->ap, dev, event);
- }
- 
--static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
- 	.handler = ata_acpi_dev_notify_dock,
- 	.uevent = ata_acpi_dev_uevent,
- };
- 
--static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
-+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
- 	.handler = ata_acpi_ap_notify_dock,
- 	.uevent = ata_acpi_ap_uevent,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/libata-core.c linux-2.6.32.13/drivers/ata/libata-core.c
---- linux-2.6.32.13/drivers/ata/libata-core.c	2010-04-29 17:49:37.689144697 -0400
-+++ linux-2.6.32.13/drivers/ata/libata-core.c	2010-05-15 13:21:14.390775531 -0400
-@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
- 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
- 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
- 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
--	{ -1, },
-+	{ -1, 0, 0 }
- };
- 
- /**
-@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
- 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
- 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
- 
--	{ 0xFF }
-+	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
-@@ -4388,7 +4388,7 @@ static const struct ata_blacklist_entry 
- 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
- 
- 	/* End Marker */
--	{ }
-+	{ NULL, NULL, 0 }
- };
- 
- static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
-@@ -5964,7 +5964,7 @@ static void ata_host_stop(struct device 
-  *	LOCKING:
-  *	None.
-  */
--static void ata_finalize_port_ops(struct ata_port_operations *ops)
-+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
- {
- 	static DEFINE_SPINLOCK(lock);
- 	const struct ata_port_operations *cur;
-@@ -5976,6 +5976,7 @@ static void ata_finalize_port_ops(struct
- 		return;
- 
- 	spin_lock(&lock);
-+	pax_open_kernel();
- 
- 	for (cur = ops->inherits; cur; cur = cur->inherits) {
- 		void **inherit = (void **)cur;
-@@ -5989,8 +5990,9 @@ static void ata_finalize_port_ops(struct
- 		if (IS_ERR(*pp))
- 			*pp = NULL;
- 
--	ops->inherits = NULL;
-+	((struct ata_port_operations *)ops)->inherits = NULL;
- 
-+	pax_close_kernel();
- 	spin_unlock(&lock);
- }
- 
-@@ -6087,7 +6089,7 @@ int ata_host_start(struct ata_host *host
-  */
- /* KILLME - the only user left is ipr */
- void ata_host_init(struct ata_host *host, struct device *dev,
--		   unsigned long flags, struct ata_port_operations *ops)
-+		   unsigned long flags, const struct ata_port_operations *ops)
- {
- 	spin_lock_init(&host->lock);
- 	host->dev = dev;
-@@ -6750,7 +6752,7 @@ static void ata_dummy_error_handler(stru
- 	/* truly dummy */
- }
- 
--struct ata_port_operations ata_dummy_port_ops = {
-+const struct ata_port_operations ata_dummy_port_ops = {
- 	.qc_prep		= ata_noop_qc_prep,
- 	.qc_issue		= ata_dummy_qc_issue,
- 	.error_handler		= ata_dummy_error_handler,
-diff -urNp linux-2.6.32.13/drivers/ata/libata-eh.c linux-2.6.32.13/drivers/ata/libata-eh.c
---- linux-2.6.32.13/drivers/ata/libata-eh.c	2010-05-15 13:20:18.462978524 -0400
-+++ linux-2.6.32.13/drivers/ata/libata-eh.c	2010-05-15 13:21:14.390775531 -0400
-@@ -3586,7 +3586,7 @@ void ata_do_eh(struct ata_port *ap, ata_
-  */
- void ata_std_error_handler(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	ata_reset_fn_t hardreset = ops->hardreset;
- 
- 	/* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.32.13/drivers/ata/libata-pmp.c linux-2.6.32.13/drivers/ata/libata-pmp.c
---- linux-2.6.32.13/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/libata-pmp.c	2010-05-15 13:21:14.390775531 -0400
-@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
-  */
- static int sata_pmp_eh_recover(struct ata_port *ap)
- {
--	struct ata_port_operations *ops = ap->ops;
-+	const struct ata_port_operations *ops = ap->ops;
- 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
- 	struct ata_link *pmp_link = &ap->link;
- 	struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.32.13/drivers/ata/pata_acpi.c linux-2.6.32.13/drivers/ata/pata_acpi.c
---- linux-2.6.32.13/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_acpi.c	2010-05-15 13:21:14.390775531 -0400
-@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pacpi_ops = {
-+static const struct ata_port_operations pacpi_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= pacpi_qc_issue,
- 	.cable_detect		= pacpi_cable_detect,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_ali.c linux-2.6.32.13/drivers/ata/pata_ali.c
---- linux-2.6.32.13/drivers/ata/pata_ali.c	2010-04-29 17:49:37.689144697 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_ali.c	2010-05-15 13:21:14.402931362 -0400
-@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
-  *	Port operations for PIO only ALi
-  */
- 
--static struct ata_port_operations ali_early_port_ops = {
-+static const struct ata_port_operations ali_early_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= ali_set_piomode,
-@@ -382,7 +382,7 @@ static const struct ata_port_operations 
-  *	Port operations for DMA capable ALi without cable
-  *	detect
-  */
--static struct ata_port_operations ali_20_port_ops = {
-+static const struct ata_port_operations ali_20_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.mode_filter	= ali_20_filter,
-@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c2_port_ops = {
-+static const struct ata_port_operations ali_c2_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
- /*
-  *	Port operations for DMA capable ALi with cable detect
-  */
--static struct ata_port_operations ali_c4_port_ops = {
-+static const struct ata_port_operations ali_c4_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.cable_detect	= ali_c2_cable_detect,
-@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
- /*
-  *	Port operations for DMA capable ALi with cable detect and LBA48
-  */
--static struct ata_port_operations ali_c5_port_ops = {
-+static const struct ata_port_operations ali_c5_port_ops = {
- 	.inherits	= &ali_dma_base_ops,
- 	.check_atapi_dma = ali_check_atapi_dma,
- 	.dev_config	= ali_warn_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_amd.c linux-2.6.32.13/drivers/ata/pata_amd.c
---- linux-2.6.32.13/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_amd.c	2010-05-15 13:21:14.402931362 -0400
-@@ -397,28 +397,28 @@ static const struct ata_port_operations 
- 	.prereset	= amd_pre_reset,
- };
- 
--static struct ata_port_operations amd33_port_ops = {
-+static const struct ata_port_operations amd33_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= amd33_set_piomode,
- 	.set_dmamode	= amd33_set_dmamode,
- };
- 
--static struct ata_port_operations amd66_port_ops = {
-+static const struct ata_port_operations amd66_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd66_set_piomode,
- 	.set_dmamode	= amd66_set_dmamode,
- };
- 
--static struct ata_port_operations amd100_port_ops = {
-+static const struct ata_port_operations amd100_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= ata_cable_unknown,
- 	.set_piomode	= amd100_set_piomode,
- 	.set_dmamode	= amd100_set_dmamode,
- };
- 
--static struct ata_port_operations amd133_port_ops = {
-+static const struct ata_port_operations amd133_port_ops = {
- 	.inherits	= &amd_base_port_ops,
- 	.cable_detect	= amd_cable_detect,
- 	.set_piomode	= amd133_set_piomode,
-@@ -433,13 +433,13 @@ static const struct ata_port_operations 
- 	.host_stop	= nv_host_stop,
- };
- 
--static struct ata_port_operations nv100_port_ops = {
-+static const struct ata_port_operations nv100_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv100_set_piomode,
- 	.set_dmamode	= nv100_set_dmamode,
- };
- 
--static struct ata_port_operations nv133_port_ops = {
-+static const struct ata_port_operations nv133_port_ops = {
- 	.inherits	= &nv_base_port_ops,
- 	.set_piomode	= nv133_set_piomode,
- 	.set_dmamode	= nv133_set_dmamode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_artop.c linux-2.6.32.13/drivers/ata/pata_artop.c
---- linux-2.6.32.13/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_artop.c	2010-05-15 13:21:14.402931362 -0400
-@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations artop6210_ops = {
-+static const struct ata_port_operations artop6210_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= artop6210_set_piomode,
-@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
- 	.qc_defer		= artop6210_qc_defer,
- };
- 
--static struct ata_port_operations artop6260_ops = {
-+static const struct ata_port_operations artop6260_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= artop6260_cable_detect,
- 	.set_piomode		= artop6260_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_at32.c linux-2.6.32.13/drivers/ata/pata_at32.c
---- linux-2.6.32.13/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_at32.c	2010-05-15 13:21:14.402931362 -0400
-@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations at32_port_ops = {
-+static const struct ata_port_operations at32_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.cable_detect		= ata_cable_40wire,
- 	.set_piomode		= pata_at32_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_at91.c linux-2.6.32.13/drivers/ata/pata_at91.c
---- linux-2.6.32.13/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_at91.c	2010-05-15 13:21:14.402931362 -0400
-@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_at91_port_ops = {
-+static const struct ata_port_operations pata_at91_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 
- 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_atiixp.c linux-2.6.32.13/drivers/ata/pata_atiixp.c
---- linux-2.6.32.13/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_atiixp.c	2010-05-15 13:21:14.444201793 -0400
-@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations atiixp_port_ops = {
-+static const struct ata_port_operations atiixp_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_atp867x.c linux-2.6.32.13/drivers/ata/pata_atp867x.c
---- linux-2.6.32.13/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_atp867x.c	2010-05-15 13:21:14.451300458 -0400
-@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations atp867x_ops = {
-+static const struct ata_port_operations atp867x_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= atp867x_cable_detect,
- 	.set_piomode		= atp867x_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_bf54x.c linux-2.6.32.13/drivers/ata/pata_bf54x.c
---- linux-2.6.32.13/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_bf54x.c	2010-05-15 13:21:14.451300458 -0400
-@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations bfin_pata_ops = {
-+static const struct ata_port_operations bfin_pata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.set_piomode		= bfin_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cmd640.c linux-2.6.32.13/drivers/ata/pata_cmd640.c
---- linux-2.6.32.13/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cmd640.c	2010-05-15 13:21:14.451300458 -0400
-@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cmd640_port_ops = {
-+static const struct ata_port_operations cmd640_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cmd64x.c linux-2.6.32.13/drivers/ata/pata_cmd64x.c
---- linux-2.6.32.13/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cmd64x.c	2010-05-15 13:21:14.451300458 -0400
-@@ -275,18 +275,18 @@ static const struct ata_port_operations 
- 	.set_dmamode	= cmd64x_set_dmamode,
- };
- 
--static struct ata_port_operations cmd64x_port_ops = {
-+static const struct ata_port_operations cmd64x_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd646r1_port_ops = {
-+static const struct ata_port_operations cmd646r1_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd646r1_bmdma_stop,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations cmd648_port_ops = {
-+static const struct ata_port_operations cmd648_port_ops = {
- 	.inherits	= &cmd64x_base_ops,
- 	.bmdma_stop	= cmd648_bmdma_stop,
- 	.cable_detect	= cmd648_cable_detect,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5520.c linux-2.6.32.13/drivers/ata/pata_cs5520.c
---- linux-2.6.32.13/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cs5520.c	2010-05-15 13:21:14.475033843 -0400
-@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
- 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5520_port_ops = {
-+static const struct ata_port_operations cs5520_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_prep		= ata_sff_dumb_qc_prep,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5530.c linux-2.6.32.13/drivers/ata/pata_cs5530.c
---- linux-2.6.32.13/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cs5530.c	2010-05-15 13:21:14.487977689 -0400
-@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations cs5530_port_ops = {
-+static const struct ata_port_operations cs5530_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5535.c linux-2.6.32.13/drivers/ata/pata_cs5535.c
---- linux-2.6.32.13/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cs5535.c	2010-05-15 13:21:14.487977689 -0400
-@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5535_port_ops = {
-+static const struct ata_port_operations cs5535_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= cs5535_cable_detect,
- 	.set_piomode	= cs5535_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cs5536.c linux-2.6.32.13/drivers/ata/pata_cs5536.c
---- linux-2.6.32.13/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cs5536.c	2010-05-15 13:21:14.487977689 -0400
-@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cs5536_port_ops = {
-+static const struct ata_port_operations cs5536_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= cs5536_cable_detect,
- 	.set_piomode		= cs5536_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_cypress.c linux-2.6.32.13/drivers/ata/pata_cypress.c
---- linux-2.6.32.13/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_cypress.c	2010-05-15 13:21:14.487977689 -0400
-@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations cy82c693_port_ops = {
-+static const struct ata_port_operations cy82c693_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= cy82c693_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_efar.c linux-2.6.32.13/drivers/ata/pata_efar.c
---- linux-2.6.32.13/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_efar.c	2010-05-15 13:21:14.487977689 -0400
-@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations efar_ops = {
-+static const struct ata_port_operations efar_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= efar_cable_detect,
- 	.set_piomode		= efar_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt366.c linux-2.6.32.13/drivers/ata/pata_hpt366.c
---- linux-2.6.32.13/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_hpt366.c	2010-05-15 13:21:14.487977689 -0400
-@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
-  *	Configuration for HPT366/68
-  */
- 
--static struct ata_port_operations hpt366_port_ops = {
-+static const struct ata_port_operations hpt366_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= hpt36x_cable_detect,
- 	.mode_filter	= hpt366_filter,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt37x.c linux-2.6.32.13/drivers/ata/pata_hpt37x.c
---- linux-2.6.32.13/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_hpt37x.c	2010-05-15 13:21:14.490951596 -0400
-@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
-  *	Configuration for HPT370
-  */
- 
--static struct ata_port_operations hpt370_port_ops = {
-+static const struct ata_port_operations hpt370_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt370_bmdma_stop,
-@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
-  *	Configuration for HPT370A. Close to 370 but less filters
-  */
- 
--static struct ata_port_operations hpt370a_port_ops = {
-+static const struct ata_port_operations hpt370a_port_ops = {
- 	.inherits	= &hpt370_port_ops,
- 	.mode_filter	= hpt370a_filter,
- };
-@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
-  *	and DMA mode setting functionality.
-  */
- 
--static struct ata_port_operations hpt372_port_ops = {
-+static const struct ata_port_operations hpt372_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt37x_bmdma_stop,
-@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
-  *	but we have a different cable detection procedure for function 1.
-  */
- 
--static struct ata_port_operations hpt374_fn1_port_ops = {
-+static const struct ata_port_operations hpt374_fn1_port_ops = {
- 	.inherits	= &hpt372_port_ops,
- 	.prereset	= hpt374_fn1_pre_reset,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_hpt3x2n.c	2010-05-15 13:21:14.498954899 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
-  *	Configuration for HPT3x2n.
-  */
- 
--static struct ata_port_operations hpt3x2n_port_ops = {
-+static const struct ata_port_operations hpt3x2n_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.bmdma_stop	= hpt3x2n_bmdma_stop,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_hpt3x3.c linux-2.6.32.13/drivers/ata/pata_hpt3x3.c
---- linux-2.6.32.13/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_hpt3x3.c	2010-05-15 13:21:14.498954899 -0400
-@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations hpt3x3_port_ops = {
-+static const struct ata_port_operations hpt3x3_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= hpt3x3_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_icside.c linux-2.6.32.13/drivers/ata/pata_icside.c
---- linux-2.6.32.13/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_icside.c	2010-05-15 13:21:14.498954899 -0400
-@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
- 	}
- }
- 
--static struct ata_port_operations pata_icside_port_ops = {
-+static const struct ata_port_operations pata_icside_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	/* no need to build any PRD tables for DMA */
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_isapnp.c linux-2.6.32.13/drivers/ata/pata_isapnp.c
---- linux-2.6.32.13/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_isapnp.c	2010-05-15 13:21:14.498954899 -0400
-@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations isapnp_port_ops = {
-+static const struct ata_port_operations isapnp_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- };
- 
--static struct ata_port_operations isapnp_noalt_port_ops = {
-+static const struct ata_port_operations isapnp_noalt_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	/* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.32.13/drivers/ata/pata_it8213.c linux-2.6.32.13/drivers/ata/pata_it8213.c
---- linux-2.6.32.13/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_it8213.c	2010-05-15 13:21:14.498954899 -0400
-@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
- };
- 
- 
--static struct ata_port_operations it8213_ops = {
-+static const struct ata_port_operations it8213_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= it8213_cable_detect,
- 	.set_piomode		= it8213_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_it821x.c linux-2.6.32.13/drivers/ata/pata_it821x.c
---- linux-2.6.32.13/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_it821x.c	2010-05-15 13:21:14.498954899 -0400
-@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations it821x_smart_port_ops = {
-+static const struct ata_port_operations it821x_smart_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_passthru_port_ops = {
-+static const struct ata_port_operations it821x_passthru_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
- 	.port_start	= it821x_port_start,
- };
- 
--static struct ata_port_operations it821x_rdc_port_ops = {
-+static const struct ata_port_operations it821x_rdc_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_ixp4xx_cf.c	2010-05-15 13:21:14.498954899 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ixp4xx_port_ops = {
-+static const struct ata_port_operations ixp4xx_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_jmicron.c linux-2.6.32.13/drivers/ata/pata_jmicron.c
---- linux-2.6.32.13/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_jmicron.c	2010-05-15 13:21:14.502920623 -0400
-@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations jmicron_ops = {
-+static const struct ata_port_operations jmicron_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= jmicron_pre_reset,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_legacy.c linux-2.6.32.13/drivers/ata/pata_legacy.c
---- linux-2.6.32.13/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_legacy.c	2010-05-15 13:21:14.502920623 -0400
-@@ -106,7 +106,7 @@ struct legacy_probe {
- 
- struct legacy_controller {
- 	const char *name;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned int pio_mask;
- 	unsigned int flags;
- 	unsigned int pflags;
-@@ -223,12 +223,12 @@ static const struct ata_port_operations 
-  *	pio_mask as well.
-  */
- 
--static struct ata_port_operations simple_port_ops = {
-+static const struct ata_port_operations simple_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
- 
--static struct ata_port_operations legacy_port_ops = {
-+static const struct ata_port_operations legacy_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.set_mode	= legacy_set_mode,
-@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
- 	return buflen;
- }
- 
--static struct ata_port_operations pdc20230_port_ops = {
-+static const struct ata_port_operations pdc20230_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= pdc20230_set_piomode,
- 	.sff_data_xfer	= pdc_data_xfer_vlb,
-@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560a_port_ops = {
-+static const struct ata_port_operations ht6560a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560a_set_piomode,
- };
-@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
- 	ioread8(ap->ioaddr.status_addr);
- }
- 
--static struct ata_port_operations ht6560b_port_ops = {
-+static const struct ata_port_operations ht6560b_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= ht6560b_set_piomode,
- };
-@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
- }
- 
- 
--static struct ata_port_operations opti82c611a_port_ops = {
-+static const struct ata_port_operations opti82c611a_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c611a_set_piomode,
- };
-@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
- 	return ata_sff_qc_issue(qc);
- }
- 
--static struct ata_port_operations opti82c46x_port_ops = {
-+static const struct ata_port_operations opti82c46x_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= opti82c46x_set_piomode,
- 	.qc_issue	= opti82c46x_qc_issue,
-@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
- 	return 0;
- }
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6500_set_piomode,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
- };
- 
--static struct ata_port_operations qdi6580dp_port_ops = {
-+static const struct ata_port_operations qdi6580dp_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= qdi6580dp_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
- 	return 0;
- }
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &legacy_base_port_ops,
- 	.set_piomode	= winbond_set_piomode,
- 	.sff_data_xfer	= vlb32_data_xfer,
-@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
- 	int pio_modes = controller->pio_mask;
- 	unsigned long io = probe->port;
- 	u32 mask = (1 << probe->slot);
--	struct ata_port_operations *ops = controller->ops;
-+	const struct ata_port_operations *ops = controller->ops;
- 	struct legacy_data *ld = &legacy_data[probe->slot];
- 	struct ata_host *host = NULL;
- 	struct ata_port *ap;
-diff -urNp linux-2.6.32.13/drivers/ata/pata_marvell.c linux-2.6.32.13/drivers/ata/pata_marvell.c
---- linux-2.6.32.13/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_marvell.c	2010-05-15 13:21:14.502920623 -0400
-@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations marvell_ops = {
-+static const struct ata_port_operations marvell_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= marvell_cable_detect,
- 	.prereset		= marvell_pre_reset,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_mpc52xx.c linux-2.6.32.13/drivers/ata/pata_mpc52xx.c
---- linux-2.6.32.13/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_mpc52xx.c	2010-05-15 13:21:14.515739682 -0400
-@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpc52xx_ata_port_ops = {
-+static const struct ata_port_operations mpc52xx_ata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_dev_select		= mpc52xx_ata_dev_select,
- 	.set_piomode		= mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_mpiix.c linux-2.6.32.13/drivers/ata/pata_mpiix.c
---- linux-2.6.32.13/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_mpiix.c	2010-05-15 13:21:14.515739682 -0400
-@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations mpiix_port_ops = {
-+static const struct ata_port_operations mpiix_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= mpiix_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_netcell.c linux-2.6.32.13/drivers/ata/pata_netcell.c
---- linux-2.6.32.13/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_netcell.c	2010-05-15 13:21:14.515739682 -0400
-@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations netcell_ops = {
-+static const struct ata_port_operations netcell_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_80wire,
- 	.read_id	= netcell_read_id,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_ninja32.c linux-2.6.32.13/drivers/ata/pata_ninja32.c
---- linux-2.6.32.13/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_ninja32.c	2010-05-15 13:21:14.515739682 -0400
-@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ninja32_port_ops = {
-+static const struct ata_port_operations ninja32_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.sff_dev_select = ninja32_dev_select,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_ns87410.c linux-2.6.32.13/drivers/ata/pata_ns87410.c
---- linux-2.6.32.13/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_ns87410.c	2010-05-15 13:21:14.515739682 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations ns87410_port_ops = {
-+static const struct ata_port_operations ns87410_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= ns87410_qc_issue,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_ns87415.c linux-2.6.32.13/drivers/ata/pata_ns87415.c
---- linux-2.6.32.13/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_ns87415.c	2010-05-15 13:21:14.515739682 -0400
-@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
- }
- #endif		/* 87560 SuperIO Support */
- 
--static struct ata_port_operations ns87415_pata_ops = {
-+static const struct ata_port_operations ns87415_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.check_atapi_dma	= ns87415_check_atapi_dma,
-@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
- };
- 
- #if defined(CONFIG_SUPERIO)
--static struct ata_port_operations ns87560_pata_ops = {
-+static const struct ata_port_operations ns87560_pata_ops = {
- 	.inherits		= &ns87415_pata_ops,
- 	.sff_tf_read		= ns87560_tf_read,
- 	.sff_check_status	= ns87560_check_status,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_octeon_cf.c linux-2.6.32.13/drivers/ata/pata_octeon_cf.c
---- linux-2.6.32.13/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_octeon_cf.c	2010-05-15 13:21:14.515739682 -0400
-@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct ata_port_operations octeon_cf_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_oldpiix.c linux-2.6.32.13/drivers/ata/pata_oldpiix.c
---- linux-2.6.32.13/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_oldpiix.c	2010-05-15 13:21:14.515739682 -0400
-@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations oldpiix_pata_ops = {
-+static const struct ata_port_operations oldpiix_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= oldpiix_qc_issue,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_opti.c linux-2.6.32.13/drivers/ata/pata_opti.c
---- linux-2.6.32.13/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_opti.c	2010-05-15 13:21:14.515739682 -0400
-@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations opti_port_ops = {
-+static const struct ata_port_operations opti_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= opti_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_optidma.c linux-2.6.32.13/drivers/ata/pata_optidma.c
---- linux-2.6.32.13/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_optidma.c	2010-05-15 13:21:14.518593102 -0400
-@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations optidma_port_ops = {
-+static const struct ata_port_operations optidma_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_piomode	= optidma_set_pio_mode,
-@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
- 	.prereset	= optidma_pre_reset,
- };
- 
--static struct ata_port_operations optiplus_port_ops = {
-+static const struct ata_port_operations optiplus_port_ops = {
- 	.inherits	= &optidma_port_ops,
- 	.set_piomode	= optiplus_set_pio_mode,
- 	.set_dmamode	= optiplus_set_dma_mode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_palmld.c linux-2.6.32.13/drivers/ata/pata_palmld.c
---- linux-2.6.32.13/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_palmld.c	2010-05-15 13:21:14.518593102 -0400
-@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations palmld_port_ops = {
-+static const struct ata_port_operations palmld_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_pcmcia.c linux-2.6.32.13/drivers/ata/pata_pcmcia.c
---- linux-2.6.32.13/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_pcmcia.c	2010-05-15 13:21:14.522920519 -0400
-@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pcmcia_port_ops = {
-+static const struct ata_port_operations pcmcia_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= pcmcia_set_mode,
- };
- 
--static struct ata_port_operations pcmcia_8bit_port_ops = {
-+static const struct ata_port_operations pcmcia_8bit_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= ata_data_xfer_8bit,
- 	.cable_detect	= ata_cable_40wire,
-@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
- 	unsigned long io_base, ctl_base;
- 	void __iomem *io_addr, *ctl_addr;
- 	int n_ports = 1;
--	struct ata_port_operations *ops = &pcmcia_port_ops;
-+	const struct ata_port_operations *ops = &pcmcia_port_ops;
- 
- 	info = kzalloc(sizeof(*info), GFP_KERNEL);
- 	if (info == NULL)
-diff -urNp linux-2.6.32.13/drivers/ata/pata_pdc2027x.c linux-2.6.32.13/drivers/ata/pata_pdc2027x.c
---- linux-2.6.32.13/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_pdc2027x.c	2010-05-15 13:21:14.522920519 -0400
-@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2027x_pata100_ops = {
-+static const struct ata_port_operations pdc2027x_pata100_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
- 	.cable_detect		= pdc2027x_cable_detect,
- 	.prereset		= pdc2027x_prereset,
- };
- 
--static struct ata_port_operations pdc2027x_pata133_ops = {
-+static const struct ata_port_operations pdc2027x_pata133_ops = {
- 	.inherits		= &pdc2027x_pata100_ops,
- 	.mode_filter		= pdc2027x_mode_filter,
- 	.set_piomode		= pdc2027x_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_pdc202xx_old.c	2010-05-15 13:21:14.522920519 -0400
-@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pdc2024x_port_ops = {
-+static const struct ata_port_operations pdc2024x_port_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.cable_detect		= ata_cable_40wire,
-@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
- 	.set_dmamode		= pdc202xx_set_dmamode,
- };
- 
--static struct ata_port_operations pdc2026x_port_ops = {
-+static const struct ata_port_operations pdc2026x_port_ops = {
- 	.inherits		= &pdc2024x_port_ops,
- 
- 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_platform.c linux-2.6.32.13/drivers/ata/pata_platform.c
---- linux-2.6.32.13/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_platform.c	2010-05-15 13:21:14.522920519 -0400
-@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations pata_platform_port_ops = {
-+static const struct ata_port_operations pata_platform_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_qdi.c linux-2.6.32.13/drivers/ata/pata_qdi.c
---- linux-2.6.32.13/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_qdi.c	2010-05-15 13:21:14.526754945 -0400
-@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations qdi6500_port_ops = {
-+static const struct ata_port_operations qdi6500_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.qc_issue	= qdi_qc_issue,
- 	.sff_data_xfer	= qdi_data_xfer,
-@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
- 	.set_piomode	= qdi6500_set_piomode,
- };
- 
--static struct ata_port_operations qdi6580_port_ops = {
-+static const struct ata_port_operations qdi6580_port_ops = {
- 	.inherits	= &qdi6500_port_ops,
- 	.set_piomode	= qdi6580_set_piomode,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_radisys.c linux-2.6.32.13/drivers/ata/pata_radisys.c
---- linux-2.6.32.13/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_radisys.c	2010-05-15 13:21:14.526754945 -0400
-@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations radisys_pata_ops = {
-+static const struct ata_port_operations radisys_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.qc_issue		= radisys_qc_issue,
- 	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_rb532_cf.c linux-2.6.32.13/drivers/ata/pata_rb532_cf.c
---- linux-2.6.32.13/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_rb532_cf.c	2010-05-15 13:21:14.526754945 -0400
-@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
- 	return IRQ_HANDLED;
- }
- 
--static struct ata_port_operations rb532_pata_port_ops = {
-+static const struct ata_port_operations rb532_pata_port_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 	.sff_data_xfer		= ata_sff_data_xfer32,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_rdc.c linux-2.6.32.13/drivers/ata/pata_rdc.c
---- linux-2.6.32.13/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_rdc.c	2010-05-15 13:21:14.530928469 -0400
-@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
- 	pci_write_config_byte(dev, 0x48, udma_enable);
- }
- 
--static struct ata_port_operations rdc_pata_ops = {
-+static const struct ata_port_operations rdc_pata_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.cable_detect		= rdc_pata_cable_detect,
- 	.set_piomode		= rdc_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_rz1000.c linux-2.6.32.13/drivers/ata/pata_rz1000.c
---- linux-2.6.32.13/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_rz1000.c	2010-05-15 13:21:14.530928469 -0400
-@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations rz1000_port_ops = {
-+static const struct ata_port_operations rz1000_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.cable_detect	= ata_cable_40wire,
- 	.set_mode	= rz1000_set_mode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_sc1200.c linux-2.6.32.13/drivers/ata/pata_sc1200.c
---- linux-2.6.32.13/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_sc1200.c	2010-05-15 13:21:14.530928469 -0400
-@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
- 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
- };
- 
--static struct ata_port_operations sc1200_port_ops = {
-+static const struct ata_port_operations sc1200_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_prep 	= ata_sff_dumb_qc_prep,
- 	.qc_issue	= sc1200_qc_issue,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_scc.c linux-2.6.32.13/drivers/ata/pata_scc.c
---- linux-2.6.32.13/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_scc.c	2010-05-15 13:21:14.530928469 -0400
-@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations scc_pata_ops = {
-+static const struct ata_port_operations scc_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 
- 	.set_piomode		= scc_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_sch.c linux-2.6.32.13/drivers/ata/pata_sch.c
---- linux-2.6.32.13/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_sch.c	2010-05-15 13:21:14.534836180 -0400
-@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sch_pata_ops = {
-+static const struct ata_port_operations sch_pata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.cable_detect		= ata_cable_unknown,
- 	.set_piomode		= sch_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_serverworks.c linux-2.6.32.13/drivers/ata/pata_serverworks.c
---- linux-2.6.32.13/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_serverworks.c	2010-05-15 13:21:14.534836180 -0400
-@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations serverworks_osb4_port_ops = {
-+static const struct ata_port_operations serverworks_osb4_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= serverworks_cable_detect,
- 	.mode_filter	= serverworks_osb4_filter,
-@@ -307,7 +307,7 @@ static struct ata_port_operations server
- 	.set_dmamode	= serverworks_set_dmamode,
- };
- 
--static struct ata_port_operations serverworks_csb_port_ops = {
-+static const struct ata_port_operations serverworks_csb_port_ops = {
- 	.inherits	= &serverworks_osb4_port_ops,
- 	.mode_filter	= serverworks_csb_filter,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_sil680.c linux-2.6.32.13/drivers/ata/pata_sil680.c
---- linux-2.6.32.13/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_sil680.c	2010-05-15 13:21:14.538682329 -0400
-@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sil680_port_ops = {
-+static const struct ata_port_operations sil680_port_ops = {
- 	.inherits	= &ata_bmdma32_port_ops,
- 	.cable_detect	= sil680_cable_detect,
- 	.set_piomode	= sil680_set_piomode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_sis.c linux-2.6.32.13/drivers/ata/pata_sis.c
---- linux-2.6.32.13/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_sis.c	2010-05-15 13:21:14.538682329 -0400
-@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_133_for_sata_ops = {
-+static const struct ata_port_operations sis_133_for_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_base_ops = {
-+static const struct ata_port_operations sis_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= sis_pre_reset,
- };
- 
--static struct ata_port_operations sis_133_ops = {
-+static const struct ata_port_operations sis_133_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_133_set_piomode,
- 	.set_dmamode		= sis_133_set_dmamode,
- 	.cable_detect		= sis_133_cable_detect,
- };
- 
--static struct ata_port_operations sis_133_early_ops = {
-+static const struct ata_port_operations sis_133_early_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_133_early_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_100_ops = {
-+static const struct ata_port_operations sis_100_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_100_set_piomode,
- 	.set_dmamode		= sis_100_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_66_ops = {
-+static const struct ata_port_operations sis_66_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_66_set_dmamode,
- 	.cable_detect		= sis_66_cable_detect,
- };
- 
--static struct ata_port_operations sis_old_ops = {
-+static const struct ata_port_operations sis_old_ops = {
- 	.inherits		= &sis_base_ops,
- 	.set_piomode		= sis_old_set_piomode,
- 	.set_dmamode		= sis_old_set_dmamode,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_sl82c105.c linux-2.6.32.13/drivers/ata/pata_sl82c105.c
---- linux-2.6.32.13/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_sl82c105.c	2010-05-15 13:21:14.538682329 -0400
-@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sl82c105_port_ops = {
-+static const struct ata_port_operations sl82c105_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.qc_defer	= sl82c105_qc_defer,
- 	.bmdma_start 	= sl82c105_bmdma_start,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_triflex.c linux-2.6.32.13/drivers/ata/pata_triflex.c
---- linux-2.6.32.13/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_triflex.c	2010-05-15 13:21:14.538682329 -0400
-@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations triflex_port_ops = {
-+static const struct ata_port_operations triflex_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.bmdma_start 	= triflex_bmdma_start,
- 	.bmdma_stop	= triflex_bmdma_stop,
-diff -urNp linux-2.6.32.13/drivers/ata/pata_via.c linux-2.6.32.13/drivers/ata/pata_via.c
---- linux-2.6.32.13/drivers/ata/pata_via.c	2010-04-29 17:49:37.709698369 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_via.c	2010-05-15 13:21:14.538682329 -0400
-@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations via_port_ops = {
-+static const struct ata_port_operations via_port_ops = {
- 	.inherits	= &ata_bmdma_port_ops,
- 	.cable_detect	= via_cable_detect,
- 	.set_piomode	= via_set_piomode,
-@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
- 	.port_start	= via_port_start,
- };
- 
--static struct ata_port_operations via_port_ops_noirq = {
-+static const struct ata_port_operations via_port_ops_noirq = {
- 	.inherits	= &via_port_ops,
- 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
- };
-diff -urNp linux-2.6.32.13/drivers/ata/pata_winbond.c linux-2.6.32.13/drivers/ata/pata_winbond.c
---- linux-2.6.32.13/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pata_winbond.c	2010-05-15 13:21:14.538682329 -0400
-@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
- 	ATA_PIO_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations winbond_port_ops = {
-+static const struct ata_port_operations winbond_port_ops = {
- 	.inherits	= &ata_sff_port_ops,
- 	.sff_data_xfer	= winbond_data_xfer,
- 	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.32.13/drivers/ata/pdc_adma.c linux-2.6.32.13/drivers/ata/pdc_adma.c
---- linux-2.6.32.13/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/pdc_adma.c	2010-05-15 13:21:14.538682329 -0400
-@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
- 	.dma_boundary		= ADMA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations adma_ata_ops = {
-+static const struct ata_port_operations adma_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_fsl.c linux-2.6.32.13/drivers/ata/sata_fsl.c
---- linux-2.6.32.13/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_fsl.c	2010-05-15 13:21:14.542941562 -0400
-@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
- 	.dma_boundary = ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sata_fsl_ops = {
-+static const struct ata_port_operations sata_fsl_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_inic162x.c linux-2.6.32.13/drivers/ata/sata_inic162x.c
---- linux-2.6.32.13/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_inic162x.c	2010-05-15 13:21:14.542941562 -0400
-@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
- 	return 0;
- }
- 
--static struct ata_port_operations inic_port_ops = {
-+static const struct ata_port_operations inic_port_ops = {
- 	.inherits		= &sata_port_ops,
- 
- 	.check_atapi_dma	= inic_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_mv.c linux-2.6.32.13/drivers/ata/sata_mv.c
---- linux-2.6.32.13/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_mv.c	2010-05-15 13:21:14.567430978 -0400
-@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
- 	.dma_boundary		= MV_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations mv5_ops = {
-+static const struct ata_port_operations mv5_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.lost_interrupt		= ATA_OP_NULL,
-@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
- 	.port_stop		= mv_port_stop,
- };
- 
--static struct ata_port_operations mv6_ops = {
-+static const struct ata_port_operations mv6_ops = {
- 	.inherits		= &mv5_ops,
- 	.dev_config             = mv6_dev_config,
- 	.scr_read		= mv_scr_read,
-@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
- 	.bmdma_status		= mv_bmdma_status,
- };
- 
--static struct ata_port_operations mv_iie_ops = {
-+static const struct ata_port_operations mv_iie_ops = {
- 	.inherits		= &mv6_ops,
- 	.dev_config		= ATA_OP_NULL,
- 	.qc_prep		= mv_qc_prep_iie,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_nv.c linux-2.6.32.13/drivers/ata/sata_nv.c
---- linux-2.6.32.13/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_nv.c	2010-05-15 13:21:14.570612236 -0400
-@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
-  * cases.  Define nv_hardreset() which only kicks in for post-boot
-  * probing and use it for all variants.
-  */
--static struct ata_port_operations nv_generic_ops = {
-+static const struct ata_port_operations nv_generic_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.lost_interrupt		= ATA_OP_NULL,
- 	.scr_read		= nv_scr_read,
-@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
- 	.hardreset		= nv_hardreset,
- };
- 
--static struct ata_port_operations nv_nf2_ops = {
-+static const struct ata_port_operations nv_nf2_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_nf2_freeze,
- 	.thaw			= nv_nf2_thaw,
- };
- 
--static struct ata_port_operations nv_ck804_ops = {
-+static const struct ata_port_operations nv_ck804_ops = {
- 	.inherits		= &nv_generic_ops,
- 	.freeze			= nv_ck804_freeze,
- 	.thaw			= nv_ck804_thaw,
- 	.host_stop		= nv_ck804_host_stop,
- };
- 
--static struct ata_port_operations nv_adma_ops = {
-+static const struct ata_port_operations nv_adma_ops = {
- 	.inherits		= &nv_ck804_ops,
- 
- 	.check_atapi_dma	= nv_adma_check_atapi_dma,
-@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
- 	.host_stop		= nv_adma_host_stop,
- };
- 
--static struct ata_port_operations nv_swncq_ops = {
-+static const struct ata_port_operations nv_swncq_ops = {
- 	.inherits		= &nv_generic_ops,
- 
- 	.qc_defer		= ata_std_qc_defer,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_promise.c linux-2.6.32.13/drivers/ata/sata_promise.c
---- linux-2.6.32.13/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_promise.c	2010-05-15 13:21:14.570612236 -0400
-@@ -195,7 +195,7 @@ static const struct ata_port_operations 
- 	.error_handler		= pdc_error_handler,
- };
- 
--static struct ata_port_operations pdc_sata_ops = {
-+static const struct ata_port_operations pdc_sata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_sata_cable_detect,
- 	.freeze			= pdc_sata_freeze,
-@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
- 
- /* First-generation chips need a more restrictive ->check_atapi_dma op,
-    and ->freeze/thaw that ignore the hotplug controls. */
--static struct ata_port_operations pdc_old_sata_ops = {
-+static const struct ata_port_operations pdc_old_sata_ops = {
- 	.inherits		= &pdc_sata_ops,
- 	.freeze			= pdc_freeze,
- 	.thaw			= pdc_thaw,
- 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
- };
- 
--static struct ata_port_operations pdc_pata_ops = {
-+static const struct ata_port_operations pdc_pata_ops = {
- 	.inherits		= &pdc_common_ops,
- 	.cable_detect		= pdc_pata_cable_detect,
- 	.freeze			= pdc_freeze,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_qstor.c linux-2.6.32.13/drivers/ata/sata_qstor.c
---- linux-2.6.32.13/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_qstor.c	2010-05-15 13:21:14.570612236 -0400
-@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
- 	.dma_boundary		= QS_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations qs_ata_ops = {
-+static const struct ata_port_operations qs_ata_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= qs_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_sil24.c linux-2.6.32.13/drivers/ata/sata_sil24.c
---- linux-2.6.32.13/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_sil24.c	2010-05-15 13:21:14.570612236 -0400
-@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
- 	.dma_boundary		= ATA_DMA_BOUNDARY,
- };
- 
--static struct ata_port_operations sil24_ops = {
-+static const struct ata_port_operations sil24_ops = {
- 	.inherits		= &sata_pmp_port_ops,
- 
- 	.qc_defer		= sil24_qc_defer,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_sil.c linux-2.6.32.13/drivers/ata/sata_sil.c
---- linux-2.6.32.13/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_sil.c	2010-05-15 13:21:14.570612236 -0400
-@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
- 	.sg_tablesize		= ATA_MAX_PRD
- };
- 
--static struct ata_port_operations sil_ops = {
-+static const struct ata_port_operations sil_ops = {
- 	.inherits		= &ata_bmdma32_port_ops,
- 	.dev_config		= sil_dev_config,
- 	.set_mode		= sil_set_mode,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_sis.c linux-2.6.32.13/drivers/ata/sata_sis.c
---- linux-2.6.32.13/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_sis.c	2010-05-15 13:21:14.578938263 -0400
-@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations sis_ops = {
-+static const struct ata_port_operations sis_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= sis_scr_read,
- 	.scr_write		= sis_scr_write,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_svw.c linux-2.6.32.13/drivers/ata/sata_svw.c
---- linux-2.6.32.13/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_svw.c	2010-05-15 13:21:14.578938263 -0400
-@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
- };
- 
- 
--static struct ata_port_operations k2_sata_ops = {
-+static const struct ata_port_operations k2_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= k2_sata_tf_load,
- 	.sff_tf_read		= k2_sata_tf_read,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_sx4.c linux-2.6.32.13/drivers/ata/sata_sx4.c
---- linux-2.6.32.13/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_sx4.c	2010-05-15 13:21:14.594941059 -0400
-@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
- };
- 
- /* TODO: inherit from base port_ops after converting to new EH */
--static struct ata_port_operations pdc_20621_ops = {
-+static const struct ata_port_operations pdc_20621_ops = {
- 	.inherits		= &ata_sff_port_ops,
- 
- 	.check_atapi_dma	= pdc_check_atapi_dma,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_uli.c linux-2.6.32.13/drivers/ata/sata_uli.c
---- linux-2.6.32.13/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_uli.c	2010-05-15 13:21:14.594941059 -0400
-@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations uli_ops = {
-+static const struct ata_port_operations uli_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.scr_read		= uli_scr_read,
- 	.scr_write		= uli_scr_write,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_via.c linux-2.6.32.13/drivers/ata/sata_via.c
---- linux-2.6.32.13/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_via.c	2010-05-15 13:21:14.599908388 -0400
-@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations svia_base_ops = {
-+static const struct ata_port_operations svia_base_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.sff_tf_load		= svia_tf_load,
- };
- 
--static struct ata_port_operations vt6420_sata_ops = {
-+static const struct ata_port_operations vt6420_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.freeze			= svia_noop_freeze,
- 	.prereset		= vt6420_prereset,
- };
- 
--static struct ata_port_operations vt6421_pata_ops = {
-+static const struct ata_port_operations vt6421_pata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.cable_detect		= vt6421_pata_cable_detect,
- 	.set_piomode		= vt6421_set_pio_mode,
- 	.set_dmamode		= vt6421_set_dma_mode,
- };
- 
--static struct ata_port_operations vt6421_sata_ops = {
-+static const struct ata_port_operations vt6421_sata_ops = {
- 	.inherits		= &svia_base_ops,
- 	.scr_read		= svia_scr_read,
- 	.scr_write		= svia_scr_write,
- };
- 
--static struct ata_port_operations vt8251_ops = {
-+static const struct ata_port_operations vt8251_ops = {
- 	.inherits		= &svia_base_ops,
- 	.hardreset		= sata_std_hardreset,
- 	.scr_read		= vt8251_scr_read,
-diff -urNp linux-2.6.32.13/drivers/ata/sata_vsc.c linux-2.6.32.13/drivers/ata/sata_vsc.c
---- linux-2.6.32.13/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ata/sata_vsc.c	2010-05-15 13:21:14.606569540 -0400
-@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
- };
- 
- 
--static struct ata_port_operations vsc_sata_ops = {
-+static const struct ata_port_operations vsc_sata_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	/* The IRQ handling is not quite standard SFF behaviour so we
- 	   cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.32.13/drivers/atm/adummy.c linux-2.6.32.13/drivers/atm/adummy.c
---- linux-2.6.32.13/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/adummy.c	2010-05-15 13:21:14.606569540 -0400
-@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
- 		vcc->pop(vcc, skb);
- 	else
- 		dev_kfree_skb_any(skb);
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/drivers/atm/ambassador.c linux-2.6.32.13/drivers/atm/ambassador.c
---- linux-2.6.32.13/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/ambassador.c	2010-05-15 13:21:14.622930740 -0400
-@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
-   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
-   
-   // VC layer stats
--  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
-   
-   // free the descriptor
-   kfree (tx_descr);
-@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
- 	  dump_skb ("<<<", vc, skb);
- 	  
- 	  // VC layer stats
--	  atomic_inc(&atm_vcc->stats->rx);
-+	  atomic_inc_unchecked(&atm_vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  atm_vcc->push (atm_vcc, skb);
-@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
-       } else {
-       	PRINTK (KERN_INFO, "dropped over-size frame");
- 	// should we count this?
--	atomic_inc(&atm_vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
-       }
-       
-     } else {
-@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
-   }
-   
-   if (check_area (skb->data, skb->len)) {
--    atomic_inc(&atm_vcc->stats->tx_err);
-+    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
-     return -ENOMEM; // ?
-   }
-   
-diff -urNp linux-2.6.32.13/drivers/atm/atmtcp.c linux-2.6.32.13/drivers/atm/atmtcp.c
---- linux-2.6.32.13/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/atmtcp.c	2010-05-15 13:21:14.626657707 -0400
-@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
- 		if (dev_data) return 0;
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOLINK;
- 	}
- 	size = skb->len+sizeof(struct atmtcp_hdr);
-@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (!new_skb) {
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOBUFS;
- 	}
- 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
-@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- 	return 0;
- }
- 
-@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
- 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
- 	read_unlock(&vcc_sklist_lock);
- 	if (!out_vcc) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		goto done;
- 	}
- 	skb_pull(skb,sizeof(struct atmtcp_hdr));
-@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
- 	__net_timestamp(new_skb);
- 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
- 	out_vcc->push(out_vcc,new_skb);
--	atomic_inc(&vcc->stats->tx);
--	atomic_inc(&out_vcc->stats->rx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
-+	atomic_inc_unchecked(&out_vcc->stats->rx);
- done:
- 	if (vcc->pop) vcc->pop(vcc,skb);
- 	else dev_kfree_skb(skb);
-diff -urNp linux-2.6.32.13/drivers/atm/eni.c linux-2.6.32.13/drivers/atm/eni.c
---- linux-2.6.32.13/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/eni.c	2010-05-15 13:21:14.634928336 -0400
-@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
- 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
- 		    vcc->dev->number);
- 		length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		length = ATM_CELL_SIZE-1; /* no HEC */
-@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    size);
- 		}
- 		eff = length = 0;
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	}
- 	else {
- 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
-@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
- 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
- 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
- 			length = eff = 0;
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 		}
- 	}
- 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
-@@ -770,7 +770,7 @@ rx_dequeued++;
- 			vcc->push(vcc,skb);
- 			pushed++;
- 		}
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	wake_up(&eni_dev->rx_wait);
- }
-@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
- 		    PCI_DMA_TODEVICE);
- 		if (vcc->pop) vcc->pop(vcc,skb);
- 		else dev_kfree_skb_irq(skb);
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 		wake_up(&eni_dev->tx_wait);
- dma_complete++;
- 	}
-diff -urNp linux-2.6.32.13/drivers/atm/firestream.c linux-2.6.32.13/drivers/atm/firestream.c
---- linux-2.6.32.13/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/firestream.c	2010-05-15 13:21:14.647057643 -0400
-@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
- 				}
- 			}
- 
--			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 
- 			fs_dprintk (FS_DEBUG_TXMEM, "i");
- 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
-@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
- #endif
- 				skb_put (skb, qe->p1 & 0xffff); 
- 				ATM_SKB(skb)->vcc = atm_vcc;
--				atomic_inc(&atm_vcc->stats->rx);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx);
- 				__net_timestamp(skb);
- 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
- 				atm_vcc->push (atm_vcc, skb);
-@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
- 				kfree (pe);
- 			}
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		case 0x1f: /*  Reassembly abort: no buffers. */
- 			/* Silently increment error counter. */
- 			if (atm_vcc)
--				atomic_inc(&atm_vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
- 			break;
- 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
- 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
-diff -urNp linux-2.6.32.13/drivers/atm/fore200e.c linux-2.6.32.13/drivers/atm/fore200e.c
---- linux-2.6.32.13/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/fore200e.c	2010-05-15 13:21:14.676169638 -0400
-@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
- #endif
- 		/* check error condition */
- 		if (*entry->status & STATUS_ERROR)
--		    atomic_inc(&vcc->stats->tx_err);
-+		    atomic_inc_unchecked(&vcc->stats->tx_err);
- 		else
--		    atomic_inc(&vcc->stats->tx);
-+		    atomic_inc_unchecked(&vcc->stats->tx);
- 	    }
- 	}
- 
-@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
-     if (skb == NULL) {
- 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     } 
- 
-@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
- 
- 	dev_kfree_skb_any(skb);
- 
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return -ENOMEM;
-     }
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-     vcc->push(vcc, skb);
--    atomic_inc(&vcc->stats->rx);
-+    atomic_inc_unchecked(&vcc->stats->rx);
- 
-     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
- 
-@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
- 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
- 			fore200e->atm_dev->number,
- 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 	    }
- 	}
- 
-@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
- 		goto retry_here;
- 	    }
- 
--	    atomic_inc(&vcc->stats->tx_err);
-+	    atomic_inc_unchecked(&vcc->stats->tx_err);
- 
- 	    fore200e->tx_sat++;
- 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.32.13/drivers/atm/he.c linux-2.6.32.13/drivers/atm/he.c
---- linux-2.6.32.13/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/he.c	2010-05-15 13:21:14.691446990 -0400
-@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 
- 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
- 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
--				atomic_inc(&vcc->stats->rx_drop);
-+				atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 				RBRQ_LEN_ERR(he_dev->rbrq_head)
- 							? "LEN_ERR" : "",
- 							vcc->vpi, vcc->vci);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto return_host_buffers;
- 		}
- 
-@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
- 		vcc->push(vcc, skb);
- 		spin_lock(&he_dev->global_lock);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- return_host_buffers:
- 		++pdus_assembled;
-@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
- 					tpd->vcc->pop(tpd->vcc, tpd->skb);
- 				else
- 					dev_kfree_skb_any(tpd->skb);
--				atomic_inc(&tpd->vcc->stats->tx_err);
-+				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
- 			}
- 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
- 			return;
-@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- 
-@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -EINVAL;
- 	}
- #endif
-@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 			vcc->pop(vcc, skb);
- 		else
- 			dev_kfree_skb_any(skb);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 		return -ENOMEM;
- 	}
-@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 					vcc->pop(vcc, skb);
- 				else
- 					dev_kfree_skb_any(skb);
--				atomic_inc(&vcc->stats->tx_err);
-+				atomic_inc_unchecked(&vcc->stats->tx_err);
- 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 				return -ENOMEM;
- 			}
-@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
- 	__enqueue_tpd(he_dev, tpd, cid);
- 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
- 
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/drivers/atm/horizon.c linux-2.6.32.13/drivers/atm/horizon.c
---- linux-2.6.32.13/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/horizon.c	2010-05-15 13:21:14.706969618 -0400
-@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
- 	{
- 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
- 	  // VC layer stats
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
- 	  __net_timestamp(skb);
- 	  // end of our responsability
- 	  vcc->push (vcc, skb);
-@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
- 	dev->tx_iovec = NULL;
- 	
- 	// VC layer stats
--	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
-+	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
- 	
- 	// free the skb
- 	hrz_kfree_skb (skb);
-diff -urNp linux-2.6.32.13/drivers/atm/idt77252.c linux-2.6.32.13/drivers/atm/idt77252.c
---- linux-2.6.32.13/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/idt77252.c	2010-05-15 13:21:14.706969618 -0400
-@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
- 		else
- 			dev_kfree_skb(skb);
- 
--		atomic_inc(&vcc->stats->tx);
-+		atomic_inc_unchecked(&vcc->stats->tx);
- 	}
- 
- 	atomic_dec(&scq->used);
-@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			if ((sb = dev_alloc_skb(64)) == NULL) {
- 				printk("%s: Can't allocate buffers for aal0.\n",
- 				       card->name);
--				atomic_add(i, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i, &vcc->stats->rx_drop);
- 				break;
- 			}
- 			if (!atm_charge(vcc, sb->truesize)) {
- 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
- 					 card->name);
--				atomic_add(i - 1, &vcc->stats->rx_drop);
-+				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
- 				dev_kfree_skb(sb);
- 				break;
- 			}
-@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			ATM_SKB(sb)->vcc = vcc;
- 			__net_timestamp(sb);
- 			vcc->push(vcc, sb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			cell += ATM_CELL_PAYLOAD;
- 		}
-@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
- 			         "(CDC: %08x)\n",
- 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (stat & SAR_RSQE_CRC) {
- 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
- 			recycle_rx_pool_skb(card, rpp);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			return;
- 		}
- 		if (skb_queue_len(&rpp->queue) > 1) {
-@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 				RXPRINTK("%s: Can't alloc RX skb.\n",
- 					 card->name);
- 				recycle_rx_pool_skb(card, rpp);
--				atomic_inc(&vcc->stats->rx_err);
-+				atomic_inc_unchecked(&vcc->stats->rx_err);
- 				return;
- 			}
- 			if (!atm_charge(vcc, skb->truesize)) {
-@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 			__net_timestamp(skb);
- 
- 			vcc->push(vcc, skb);
--			atomic_inc(&vcc->stats->rx);
-+			atomic_inc_unchecked(&vcc->stats->rx);
- 
- 			return;
- 		}
-@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
- 		__net_timestamp(skb);
- 
- 		vcc->push(vcc, skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- 		if (skb->truesize > SAR_FB_SIZE_3)
- 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
-@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		if (vcc->qos.aal != ATM_AAL0) {
- 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
- 				card->name, vpi, vci);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto drop;
- 		}
- 	
- 		if ((sb = dev_alloc_skb(64)) == NULL) {
- 			printk("%s: Can't allocate buffers for AAL0.\n",
- 			       card->name);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto drop;
- 		}
- 
-@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
- 		ATM_SKB(sb)->vcc = vcc;
- 		__net_timestamp(sb);
- 		vcc->push(vcc, sb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 
- drop:
- 		skb_pull(queue, 64);
-@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	if (vc == NULL) {
- 		printk("%s: NULL connection in send().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 	if (!test_bit(VCF_TX, &vc->flags)) {
- 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 		break;
- 	default:
- 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
- 
- 	if (skb_shinfo(skb)->nr_frags != 0) {
- 		printk("%s: No scatter-gather yet.\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return -EINVAL;
- 	}
-@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
- 
- 	err = queue_skb(card, vc, skb, oam);
- 	if (err) {
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		dev_kfree_skb(skb);
- 		return err;
- 	}
-@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
- 	skb = dev_alloc_skb(64);
- 	if (!skb) {
- 		printk("%s: Out of memory in send_oam().\n", card->name);
--		atomic_inc(&vcc->stats->tx_err);
-+		atomic_inc_unchecked(&vcc->stats->tx_err);
- 		return -ENOMEM;
- 	}
- 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.32.13/drivers/atm/iphase.c linux-2.6.32.13/drivers/atm/iphase.c
---- linux-2.6.32.13/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/iphase.c	2010-05-15 13:21:14.750617431 -0400
-@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	status = (u_short) (buf_desc_ptr->desc_mode);  
- 	if (status & (RX_CER | RX_PTE | RX_OFL))  
- 	{  
--                atomic_inc(&vcc->stats->rx_err);
-+                atomic_inc_unchecked(&vcc->stats->rx_err);
- 		IF_ERR(printk("IA: bad packet, dropping it");)  
-                 if (status & RX_CER) { 
-                     IF_ERR(printk(" cause: packet CRC error\n");)
-@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
- 	len = dma_addr - buf_addr;  
-         if (len > iadev->rx_buf_sz) {
-            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
--           atomic_inc(&vcc->stats->rx_err);
-+           atomic_inc_unchecked(&vcc->stats->rx_err);
- 	   goto out_free_desc;
-         }
- 		  
-@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
-           ia_vcc = INPH_IA_VCC(vcc);
-           if (ia_vcc == NULL)
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              dev_kfree_skb_any(skb);
-              atm_return(vcc, atm_guess_pdu2truesize(len));
-              goto INCR_DLE;
-@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
-           if ((length > iadev->rx_buf_sz) || (length > 
-                               (skb->len - sizeof(struct cpcs_trailer))))
-           {
--             atomic_inc(&vcc->stats->rx_err);
-+             atomic_inc_unchecked(&vcc->stats->rx_err);
-              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
-                                                             length, skb->len);)
-              dev_kfree_skb_any(skb);
-@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
- 
- 	  IF_RX(printk("rx_dle_intr: skb push");)  
- 	  vcc->push(vcc,skb);  
--	  atomic_inc(&vcc->stats->rx);
-+	  atomic_inc_unchecked(&vcc->stats->rx);
-           iadev->rx_pkt_cnt++;
-       }  
- INCR_DLE:
-@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
-          {
-              struct k_sonet_stats *stats;
-              stats = &PRIV(_ia_dev[board])->sonet_stats;
--             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
--             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
--             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
--             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
--             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
--             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
--             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
--             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
--             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
-+             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
-+             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
-+             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
-+             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
-+             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
-+             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
-+             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
-+             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
-+             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
-          }
-             ia_cmds.status = 0;
-             break;
-@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
- 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
- 	{  
- 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
--                atomic_inc(&vcc->stats->tx);
-+                atomic_inc_unchecked(&vcc->stats->tx);
- 		if (vcc->pop)   
- 		    vcc->pop(vcc, skb);   
- 		else  
-@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
-         ATM_DESC(skb) = vcc->vci;
-         skb_queue_tail(&iadev->tx_dma_q, skb);
- 
--        atomic_inc(&vcc->stats->tx);
-+        atomic_inc_unchecked(&vcc->stats->tx);
-         iadev->tx_pkt_cnt++;
- 	/* Increment transaction counter */  
- 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
-         
- #if 0        
-         /* add flow control logic */ 
--        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
-+        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
-           if (iavcc->vc_desc_cnt > 10) {
-              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
-             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.32.13/drivers/atm/lanai.c linux-2.6.32.13/drivers/atm/lanai.c
---- linux-2.6.32.13/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/lanai.c	2010-05-15 13:21:14.750617431 -0400
-@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
- 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
- 	lanai_endtx(lanai, lvcc);
- 	lanai_free_skb(lvcc->tx.atmvcc, skb);
--	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
-+	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
- }
- 
- /* Try to fill the buffer - don't call unless there is backlog */
-@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
- 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
- 	__net_timestamp(skb);
- 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
-     out:
- 	lvcc->rx.buf.ptr = end;
- 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
-@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
- 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
- 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
- 		lanai->stats.service_rxnotaal5++;
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		return 0;
- 	}
- 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
-@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
- 		int bytes;
- 		read_unlock(&vcc_sklist_lock);
- 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_trash++;
- 		bytes = (SERVICE_GET_END(s) * 16) -
- 		    (((unsigned long) lvcc->rx.buf.ptr) -
-@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
- 	}
- 	if (s & SERVICE_STREAM) {
- 		read_unlock(&vcc_sklist_lock);
--		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 		lvcc->stats.x.aal5.service_stream++;
- 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
- 		    "PDU on VCI %d!\n", lanai->number, vci);
-@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
- 		return 0;
- 	}
- 	DPRINTK("got rx crc error on vci %d\n", vci);
--	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
-+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
- 	lvcc->stats.x.aal5.service_rxcrc++;
- 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
- 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.32.13/drivers/atm/nicstar.c linux-2.6.32.13/drivers/atm/nicstar.c
---- linux-2.6.32.13/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/nicstar.c	2010-05-15 13:21:14.787751803 -0400
-@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if ((vc = (vc_map *) vcc->dev_data) == NULL)
-    {
-       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (!vc->tx)
-    {
-       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
-    {
-       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
-    if (skb_shinfo(skb)->nr_frags != 0)
-    {
-       printk("nicstar%d: No scatter-gather yet.\n", card->index);
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EINVAL;
-    }
-@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
- 
-    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
-    {
--      atomic_inc(&vcc->stats->tx_err);
-+      atomic_inc_unchecked(&vcc->stats->tx_err);
-       dev_kfree_skb_any(skb);
-       return -EIO;
-    }
--   atomic_inc(&vcc->stats->tx);
-+   atomic_inc_unchecked(&vcc->stats->tx);
- 
-    return 0;
- }
-@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
-          {
-             printk("nicstar%d: Can't allocate buffers for aal0.\n",
-                    card->index);
--            atomic_add(i,&vcc->stats->rx_drop);
-+            atomic_add_unchecked(i,&vcc->stats->rx_drop);
-             break;
-          }
-          if (!atm_charge(vcc, sb->truesize))
-          {
-             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
-                      card->index);
--            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-+            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
-             dev_kfree_skb_any(sb);
-             break;
-          }
-@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          ATM_SKB(sb)->vcc = vcc;
- 	 __net_timestamp(sb);
-          vcc->push(vcc, sb);
--         atomic_inc(&vcc->stats->rx);
-+         atomic_inc_unchecked(&vcc->stats->rx);
-          cell += ATM_CELL_PAYLOAD;
-       }
- 
-@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
- 	 if (iovb == NULL)
- 	 {
- 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-             recycle_rx_buf(card, skb);
-             return;
- 	 }
-@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
-    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
-    {
-       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
--      atomic_inc(&vcc->stats->rx_err);
-+      atomic_inc_unchecked(&vcc->stats->rx_err);
-       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
-       NS_SKB(iovb)->iovcnt = 0;
-       iovb->len = 0;
-@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_rx_buf(card, skb);
-          vc->rx_iov = NULL;
-          recycle_iov_buf(card, iovb);
-@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
- 	        card->index);
-          which_list(card, skb);
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                       NS_SKB(iovb)->iovcnt);
-          vc->rx_iov = NULL;
-@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             printk(" - PDU size mismatch.\n");
-          else
-             printk(".\n");
--         atomic_inc(&vcc->stats->rx_err);
-+         atomic_inc_unchecked(&vcc->stats->rx_err);
-          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	   NS_SKB(iovb)->iovcnt);
- 	 vc->rx_iov = NULL;
-@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
-          if (!atm_charge(vcc, skb->truesize))
-          {
-             push_rxbufs(card, skb);
--            atomic_inc(&vcc->stats->rx_drop);
-+            atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             ATM_SKB(skb)->vcc = vcc;
- 	    __net_timestamp(skb);
-             vcc->push(vcc, skb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
-       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
-@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, sb->truesize))
-             {
-                push_rxbufs(card, sb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
- 	    {
-@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(sb)->vcc = vcc;
- 	       __net_timestamp(sb);
-                vcc->push(vcc, sb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, skb);
-@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (!atm_charge(vcc, skb->truesize))
-             {
-                push_rxbufs(card, skb);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-             }
-             else
-             {
-@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
-                ATM_SKB(skb)->vcc = vcc;
- 	       __net_timestamp(skb);
-                vcc->push(vcc, skb);
--               atomic_inc(&vcc->stats->rx);
-+               atomic_inc_unchecked(&vcc->stats->rx);
-             }
- 
-             push_rxbufs(card, sb);
-@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             if (hb == NULL)
-             {
-                printk("nicstar%d: Out of huge buffers.\n", card->index);
--               atomic_inc(&vcc->stats->rx_drop);
-+               atomic_inc_unchecked(&vcc->stats->rx_drop);
-                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
- 	                             NS_SKB(iovb)->iovcnt);
-                vc->rx_iov = NULL;
-@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
-             }
- 	    else
- 	       dev_kfree_skb_any(hb);
--	    atomic_inc(&vcc->stats->rx_drop);
-+	    atomic_inc_unchecked(&vcc->stats->rx_drop);
-          }
-          else
- 	 {
-@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
- #endif /* NS_USE_DESTRUCTORS */
- 	    __net_timestamp(hb);
-             vcc->push(vcc, hb);
--            atomic_inc(&vcc->stats->rx);
-+            atomic_inc_unchecked(&vcc->stats->rx);
-          }
-       }
- 
-diff -urNp linux-2.6.32.13/drivers/atm/solos-pci.c linux-2.6.32.13/drivers/atm/solos-pci.c
---- linux-2.6.32.13/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/solos-pci.c	2010-05-15 13:21:14.815606670 -0400
-@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
- 				}
- 				atm_charge(vcc, skb->truesize);
- 				vcc->push(vcc, skb);
--				atomic_inc(&vcc->stats->rx);
-+				atomic_inc_unchecked(&vcc->stats->rx);
- 				break;
- 
- 			case PKT_STATUS:
-@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
- 			vcc = SKB_CB(oldskb)->vcc;
- 
- 			if (vcc) {
--				atomic_inc(&vcc->stats->tx);
-+				atomic_inc_unchecked(&vcc->stats->tx);
- 				solos_pop(vcc, oldskb);
- 			} else
- 				dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.32.13/drivers/atm/suni.c linux-2.6.32.13/drivers/atm/suni.c
---- linux-2.6.32.13/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/suni.c	2010-05-15 13:21:14.815606670 -0400
-@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
- 
- 
- #define ADD_LIMITED(s,v) \
--    atomic_add((v),&stats->s); \
--    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
-+    atomic_add_unchecked((v),&stats->s); \
-+    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
- 
- 
- static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.32.13/drivers/atm/uPD98402.c linux-2.6.32.13/drivers/atm/uPD98402.c
---- linux-2.6.32.13/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/uPD98402.c	2010-05-15 13:21:14.815606670 -0400
-@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
- 	struct sonet_stats tmp;
-  	int error = 0;
- 
--	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
-+	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
- 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
- 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
- 	if (zero && !error) {
-@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
- 
- 
- #define ADD_LIMITED(s,v) \
--    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
--    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
--	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
-+    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
-+    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
- 
- 
- static void stat_event(struct atm_dev *dev)
-@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
- 		if (reason & uPD98402_INT_PFM) stat_event(dev);
- 		if (reason & uPD98402_INT_PCO) {
- 			(void) GET(PCOCR); /* clear interrupt cause */
--			atomic_add(GET(HECCT),
-+			atomic_add_unchecked(GET(HECCT),
- 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
- 		}
- 		if ((reason & uPD98402_INT_RFO) && 
-@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
- 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
- 	  uPD98402_INT_LOS),PIMR); /* enable them */
- 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
--	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
--	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
-+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.13/drivers/atm/zatm.c linux-2.6.32.13/drivers/atm/zatm.c
---- linux-2.6.32.13/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/atm/zatm.c	2010-05-15 13:21:14.815606670 -0400
-@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		}
- 		if (!size) {
- 			dev_kfree_skb_irq(skb);
--			if (vcc) atomic_inc(&vcc->stats->rx_err);
-+			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
- 			continue;
- 		}
- 		if (!atm_charge(vcc,skb->truesize)) {
-@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
- 		skb->len = size;
- 		ATM_SKB(skb)->vcc = vcc;
- 		vcc->push(vcc,skb);
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	}
- 	zout(pos & 0xffff,MTA(mbx));
- #if 0 /* probably a stupid idea */
-@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
- 			skb_queue_head(&zatm_vcc->backlog,skb);
- 			break;
- 		}
--	atomic_inc(&vcc->stats->tx);
-+	atomic_inc_unchecked(&vcc->stats->tx);
- 	wake_up(&zatm_vcc->tx_wait);
- }
- 
-diff -urNp linux-2.6.32.13/drivers/base/bus.c linux-2.6.32.13/drivers/base/bus.c
---- linux-2.6.32.13/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/base/bus.c	2010-05-15 13:21:14.831148567 -0400
-@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops driver_sysfs_ops = {
-+static const struct sysfs_ops driver_sysfs_ops = {
- 	.show	= drv_attr_show,
- 	.store	= drv_attr_store,
- };
-@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops bus_sysfs_ops = {
-+static const struct sysfs_ops bus_sysfs_ops = {
- 	.show	= bus_attr_show,
- 	.store	= bus_attr_store,
- };
-@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops bus_uevent_ops = {
-+static const struct kset_uevent_ops bus_uevent_ops = {
- 	.filter = bus_uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/base/class.c linux-2.6.32.13/drivers/base/class.c
---- linux-2.6.32.13/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/base/class.c	2010-05-15 13:21:14.874164060 -0400
-@@ -63,7 +63,7 @@ static void class_release(struct kobject
- 	kfree(cp);
- }
- 
--static struct sysfs_ops class_sysfs_ops = {
-+static const struct sysfs_ops class_sysfs_ops = {
- 	.show	= class_attr_show,
- 	.store	= class_attr_store,
- };
-diff -urNp linux-2.6.32.13/drivers/base/core.c linux-2.6.32.13/drivers/base/core.c
---- linux-2.6.32.13/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/base/core.c	2010-05-15 13:21:14.878954723 -0400
-@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
- 	return ret;
- }
- 
--static struct sysfs_ops dev_sysfs_ops = {
-+static const struct sysfs_ops dev_sysfs_ops = {
- 	.show	= dev_attr_show,
- 	.store	= dev_attr_store,
- };
-@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
- 	return retval;
- }
- 
--static struct kset_uevent_ops device_uevent_ops = {
-+static const struct kset_uevent_ops device_uevent_ops = {
- 	.filter =	dev_uevent_filter,
- 	.name =		dev_uevent_name,
- 	.uevent =	dev_uevent,
-diff -urNp linux-2.6.32.13/drivers/base/memory.c linux-2.6.32.13/drivers/base/memory.c
---- linux-2.6.32.13/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/base/memory.c	2010-05-15 13:21:14.882954278 -0400
-@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
- 	return retval;
- }
- 
--static struct kset_uevent_ops memory_uevent_ops = {
-+static const struct kset_uevent_ops memory_uevent_ops = {
- 	.name		= memory_uevent_name,
- 	.uevent		= memory_uevent,
- };
-diff -urNp linux-2.6.32.13/drivers/base/sys.c linux-2.6.32.13/drivers/base/sys.c
---- linux-2.6.32.13/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/base/sys.c	2010-05-15 13:21:14.890945998 -0400
-@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= sysdev_show,
- 	.store	= sysdev_store,
- };
-@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops sysfs_class_ops = {
-+static const struct sysfs_ops sysfs_class_ops = {
- 	.show	= sysdev_class_show,
- 	.store	= sysdev_class_store,
- };
-diff -urNp linux-2.6.32.13/drivers/block/pktcdvd.c linux-2.6.32.13/drivers/block/pktcdvd.c
---- linux-2.6.32.13/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/block/pktcdvd.c	2010-05-15 13:21:14.919938646 -0400
-@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
- 	return len;
- }
- 
--static struct sysfs_ops kobj_pkt_ops = {
-+static const struct sysfs_ops kobj_pkt_ops = {
- 	.show = kobj_pkt_show,
- 	.store = kobj_pkt_store
- };
-diff -urNp linux-2.6.32.13/drivers/char/agp/frontend.c linux-2.6.32.13/drivers/char/agp/frontend.c
---- linux-2.6.32.13/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/agp/frontend.c	2010-05-15 13:21:14.919938646 -0400
-@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
- 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
- 		return -EFAULT;
- 
--	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
-+	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
- 		return -EFAULT;
- 
- 	client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.32.13/drivers/char/agp/intel-agp.c linux-2.6.32.13/drivers/char/agp/intel-agp.c
---- linux-2.6.32.13/drivers/char/agp/intel-agp.c	2010-04-29 17:49:37.777981896 -0400
-+++ linux-2.6.32.13/drivers/char/agp/intel-agp.c	2010-05-15 13:21:14.919938646 -0400
-@@ -2564,7 +2564,7 @@ static struct pci_device_id agp_intel_pc
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
- 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
-diff -urNp linux-2.6.32.13/drivers/char/hpet.c linux-2.6.32.13/drivers/char/hpet.c
---- linux-2.6.32.13/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hpet.c	2010-05-15 13:21:14.922737516 -0400
-@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
- 	return 0;
- }
- 
--static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
-+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
- 
- static int
- hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-@@ -550,7 +550,7 @@ static inline unsigned long hpet_time_di
- }
- 
- static int
--hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
-+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
- {
- 	struct hpet_timer __iomem *timer;
- 	struct hpet __iomem *hpet;
-@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
- 		},
- };
- 
--static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
-+static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
- 
- static int __init hpet_init(void)
- {
-diff -urNp linux-2.6.32.13/drivers/char/hvc_beat.c linux-2.6.32.13/drivers/char/hvc_beat.c
---- linux-2.6.32.13/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_beat.c	2010-05-15 13:21:14.922737516 -0400
-@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
- 	return cnt;
- }
- 
--static struct hv_ops hvc_beat_get_put_ops = {
-+static const struct hv_ops hvc_beat_get_put_ops = {
- 	.get_chars = hvc_beat_get_chars,
- 	.put_chars = hvc_beat_put_chars,
- };
-diff -urNp linux-2.6.32.13/drivers/char/hvc_console.c linux-2.6.32.13/drivers/char/hvc_console.c
---- linux-2.6.32.13/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_console.c	2010-05-15 13:21:14.922737516 -0400
-@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
-  * console interfaces but can still be used as a tty device.  This has to be
-  * static because kmalloc will not work during early console init.
-  */
--static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
-+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
- static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
- 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
- 
-@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
-  * vty adapters do NOT get an hvc_instantiate() callback since they
-  * appear after early console init.
-  */
--int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
-+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
- {
- 	struct hvc_struct *hp;
- 
-@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
- };
- 
- struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
--					struct hv_ops *ops, int outbuf_size)
-+					const struct hv_ops *ops, int outbuf_size)
- {
- 	struct hvc_struct *hp;
- 	int i;
-diff -urNp linux-2.6.32.13/drivers/char/hvc_console.h linux-2.6.32.13/drivers/char/hvc_console.h
---- linux-2.6.32.13/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_console.h	2010-05-15 13:21:14.922737516 -0400
-@@ -55,7 +55,7 @@ struct hvc_struct {
- 	int outbuf_size;
- 	int n_outbuf;
- 	uint32_t vtermno;
--	struct hv_ops *ops;
-+	const struct hv_ops *ops;
- 	int irq_requested;
- 	int data;
- 	struct winsize ws;
-@@ -76,11 +76,11 @@ struct hv_ops {
- };
- 
- /* Register a vterm and a slot index for use as a console (console_init) */
--extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
-+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
- 
- /* register a vterm for hvc tty operation (module_init or hotplug add) */
- extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
--				struct hv_ops *ops, int outbuf_size);
-+				const struct hv_ops *ops, int outbuf_size);
- /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
- extern int hvc_remove(struct hvc_struct *hp);
- 
-diff -urNp linux-2.6.32.13/drivers/char/hvc_iseries.c linux-2.6.32.13/drivers/char/hvc_iseries.c
---- linux-2.6.32.13/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_iseries.c	2010-05-15 13:21:14.922737516 -0400
-@@ -197,7 +197,7 @@ done:
- 	return sent;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = get_chars,
- 	.put_chars = put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.13/drivers/char/hvc_iucv.c linux-2.6.32.13/drivers/char/hvc_iucv.c
---- linux-2.6.32.13/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_iucv.c	2010-05-15 13:21:14.922737516 -0400
-@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
- 
- 
- /* HVC operations */
--static struct hv_ops hvc_iucv_ops = {
-+static const struct hv_ops hvc_iucv_ops = {
- 	.get_chars = hvc_iucv_get_chars,
- 	.put_chars = hvc_iucv_put_chars,
- 	.notifier_add = hvc_iucv_notifier_add,
-diff -urNp linux-2.6.32.13/drivers/char/hvc_rtas.c linux-2.6.32.13/drivers/char/hvc_rtas.c
---- linux-2.6.32.13/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_rtas.c	2010-05-15 13:21:14.922737516 -0400
-@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
- 	return i;
- }
- 
--static struct hv_ops hvc_rtas_get_put_ops = {
-+static const struct hv_ops hvc_rtas_get_put_ops = {
- 	.get_chars = hvc_rtas_read_console,
- 	.put_chars = hvc_rtas_write_console,
- };
-diff -urNp linux-2.6.32.13/drivers/char/hvcs.c linux-2.6.32.13/drivers/char/hvcs.c
---- linux-2.6.32.13/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvcs.c	2010-05-15 13:21:14.967285135 -0400
-@@ -269,7 +269,7 @@ struct hvcs_struct {
- 	unsigned int index;
- 
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 
- 	/*
- 	 * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 
--	if (hvcsd->open_count > 0) {
-+	if (atomic_read(&hvcsd->open_count) > 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
- 				"The hvcs device node is still in use.\n");
-@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
- 		if ((retval = hvcs_partner_connect(hvcsd)))
- 			goto error_release;
- 
--	hvcsd->open_count = 1;
-+	atomic_set(&hvcsd->open_count, 1);
- 	hvcsd->tty = tty;
- 	tty->driver_data = hvcsd;
- 
-@@ -1169,7 +1169,7 @@ fast_open:
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	kref_get(&hvcsd->kref);
--	hvcsd->open_count++;
-+	atomic_inc(&hvcsd->open_count);
- 	hvcsd->todo_mask |= HVCS_SCHED_READ;
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
- 
-@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
- 	hvcsd = tty->driver_data;
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
--	if (--hvcsd->open_count == 0) {
-+	if (atomic_dec_and_test(&hvcsd->open_count)) {
- 
- 		vio_disable_interrupts(hvcsd->vdev);
- 
-@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
- 		free_irq(irq, hvcsd);
- 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
- 		return;
--	} else if (hvcsd->open_count < 0) {
-+	} else if (atomic_read(&hvcsd->open_count) < 0) {
- 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
- 				" is missmanaged.\n",
--		hvcsd->vdev->unit_address, hvcsd->open_count);
-+		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
- 	}
- 
- 	spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
- 
- 	spin_lock_irqsave(&hvcsd->lock, flags);
- 	/* Preserve this so that we know how many kref refs to put */
--	temp_open_count = hvcsd->open_count;
-+	temp_open_count = atomic_read(&hvcsd->open_count);
- 
- 	/*
- 	 * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
- 	hvcsd->tty->driver_data = NULL;
- 	hvcsd->tty = NULL;
- 
--	hvcsd->open_count = 0;
-+	atomic_set(&hvcsd->open_count, 0);
- 
- 	/* This will drop any buffered data on the floor which is OK in a hangup
- 	 * scenario. */
-@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
- 	 * the middle of a write operation?  This is a crummy place to do this
- 	 * but we want to keep it all in the spinlock.
- 	 */
--	if (hvcsd->open_count <= 0) {
-+	if (atomic_read(&hvcsd->open_count) <= 0) {
- 		spin_unlock_irqrestore(&hvcsd->lock, flags);
- 		return -ENODEV;
- 	}
-@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
- {
- 	struct hvcs_struct *hvcsd = tty->driver_data;
- 
--	if (!hvcsd || hvcsd->open_count <= 0)
-+	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
- 		return 0;
- 
- 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.32.13/drivers/char/hvc_udbg.c linux-2.6.32.13/drivers/char/hvc_udbg.c
---- linux-2.6.32.13/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_udbg.c	2010-05-15 13:21:14.967285135 -0400
-@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
- 	return i;
- }
- 
--static struct hv_ops hvc_udbg_ops = {
-+static const struct hv_ops hvc_udbg_ops = {
- 	.get_chars = hvc_udbg_get,
- 	.put_chars = hvc_udbg_put,
- };
-diff -urNp linux-2.6.32.13/drivers/char/hvc_vio.c linux-2.6.32.13/drivers/char/hvc_vio.c
---- linux-2.6.32.13/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_vio.c	2010-05-15 13:21:14.967285135 -0400
-@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
- 	return got;
- }
- 
--static struct hv_ops hvc_get_put_ops = {
-+static const struct hv_ops hvc_get_put_ops = {
- 	.get_chars = filtered_get_chars,
- 	.put_chars = hvc_put_chars,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.13/drivers/char/hvc_xen.c linux-2.6.32.13/drivers/char/hvc_xen.c
---- linux-2.6.32.13/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/hvc_xen.c	2010-05-15 13:21:14.967285135 -0400
-@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
- 	return recv;
- }
- 
--static struct hv_ops hvc_ops = {
-+static const struct hv_ops hvc_ops = {
- 	.get_chars = read_console,
- 	.put_chars = write_console,
- 	.notifier_add = notifier_add_irq,
-diff -urNp linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/ipmi/ipmi_msghandler.c	2010-05-15 13:21:15.002974818 -0400
-@@ -414,7 +414,7 @@ struct ipmi_smi {
- 	struct proc_dir_entry *proc_dir;
- 	char                  proc_dir_name[10];
- 
--	atomic_t stats[IPMI_NUM_STATS];
-+	atomic_unchecked_t stats[IPMI_NUM_STATS];
- 
- 	/*
- 	 * run_to_completion duplicate of smb_info, smi_info
-@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
- 
- 
- #define ipmi_inc_stat(intf, stat) \
--	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
- #define ipmi_get_stat(intf, stat) \
--	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
- 
- static int is_lan_addr(struct ipmi_addr *addr)
- {
-@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
- 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
- 	init_waitqueue_head(&intf->waitq);
- 	for (i = 0; i < IPMI_NUM_STATS; i++)
--		atomic_set(&intf->stats[i], 0);
-+		atomic_set_unchecked(&intf->stats[i], 0);
- 
- 	intf->proc_dir = NULL;
- 
-diff -urNp linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/ipmi/ipmi_si_intf.c	2010-05-15 13:21:15.014624441 -0400
-@@ -277,7 +277,7 @@ struct smi_info {
- 	unsigned char slave_addr;
- 
- 	/* Counters and things for the proc filesystem. */
--	atomic_t stats[SI_NUM_STATS];
-+	atomic_unchecked_t stats[SI_NUM_STATS];
- 
- 	struct task_struct *thread;
- 
-@@ -285,9 +285,9 @@ struct smi_info {
- };
- 
- #define smi_inc_stat(smi, stat) \
--	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
-+	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
- #define smi_get_stat(smi, stat) \
--	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
-+	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
- 
- #define SI_MAX_PARMS 4
- 
-@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
- 	atomic_set(&new_smi->req_events, 0);
- 	new_smi->run_to_completion = 0;
- 	for (i = 0; i < SI_NUM_STATS; i++)
--		atomic_set(&new_smi->stats[i], 0);
-+		atomic_set_unchecked(&new_smi->stats[i], 0);
- 
- 	new_smi->interrupt_disabled = 0;
- 	atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.32.13/drivers/char/keyboard.c linux-2.6.32.13/drivers/char/keyboard.c
---- linux-2.6.32.13/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/keyboard.c	2010-05-15 13:21:15.018564312 -0400
-@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
- 	     kbd->kbdmode == VC_MEDIUMRAW) &&
- 	     value != KVAL(K_SAK))
- 		return;		/* SAK is allowed even in raw mode */
-+
-+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
-+	{
-+		void *func = fn_handler[value];
-+		if (func == fn_show_state || func == fn_show_ptregs ||
-+		    func == fn_show_mem)
-+			return;
-+	}
-+#endif
-+
- 	fn_handler[value](vc);
- }
- 
-@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
-                 .evbit = { BIT_MASK(EV_SND) },
-         },
- 
--	{ },    /* Terminating entry */
-+	{ 0 },    /* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.32.13/drivers/char/mem.c linux-2.6.32.13/drivers/char/mem.c
---- linux-2.6.32.13/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/mem.c	2010-05-15 13:21:15.018564312 -0400
-@@ -18,6 +18,7 @@
- #include <linux/raw.h>
- #include <linux/tty.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/ptrace.h>
- #include <linux/device.h>
- #include <linux/highmem.h>
-@@ -35,6 +36,10 @@
- # include <linux/efi.h>
- #endif
- 
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+extern struct file_operations grsec_fops;
-+#endif
-+
- static inline unsigned long size_inside_page(unsigned long start,
- 					     unsigned long size)
- {
-@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
- 	if (!valid_phys_addr_range(p, count))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_mem_write();
-+	return -EPERM;
-+#endif
-+
- 	written = 0;
- 
- #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
-@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
- 						&vma->vm_page_prot))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
-+		return -EPERM;
-+#endif
-+
- 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
- 						 size,
- 						 vma->vm_page_prot);
-@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
- 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
- 	int err = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_kmem_write();
-+	return -EPERM;
-+#endif
-+
- 	if (p < (unsigned long) high_memory) {
- 
- 		wrote = count;
-@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
- 
- static int open_port(struct inode * inode, struct file * filp)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_open_port();
-+	return -EPERM;
-+#endif
-+
-+	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
-+}
-+
-+static int open_mem(struct inode * inode, struct file * filp)
-+{
- 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
- }
- 
-@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
- #define full_lseek      null_lseek
- #define write_zero	write_null
- #define read_full       read_zero
--#define open_mem	open_port
- #define open_kmem	open_mem
- #define open_oldmem	open_mem
- 
-@@ -888,6 +917,9 @@ static const struct memdev {
- #ifdef CONFIG_CRASH_DUMP
- 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
- #endif
-+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
-+	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
-+#endif
- };
- 
- static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.32.13/drivers/char/nvram.c linux-2.6.32.13/drivers/char/nvram.c
---- linux-2.6.32.13/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/nvram.c	2010-05-15 13:21:15.018564312 -0400
-@@ -429,7 +429,10 @@ static const struct file_operations nvra
- static struct miscdevice nvram_dev = {
- 	NVRAM_MINOR,
- 	"nvram",
--	&nvram_fops
-+	&nvram_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static int __init nvram_init(void)
-diff -urNp linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/pcmcia/ipwireless/tty.c	2010-05-15 13:21:15.018564312 -0400
-@@ -51,7 +51,7 @@ struct ipw_tty {
- 	int tty_type;
- 	struct ipw_network *network;
- 	struct tty_struct *linux_tty;
--	int open_count;
-+	atomic_t open_count;
- 	unsigned int control_lines;
- 	struct mutex ipw_tty_mutex;
- 	int tx_bytes_queued;
-@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -ENODEV;
- 	}
--	if (tty->open_count == 0)
-+	if (atomic_read(&tty->open_count) == 0)
- 		tty->tx_bytes_queued = 0;
- 
--	tty->open_count++;
-+	atomic_inc(&tty->open_count);
- 
- 	tty->linux_tty = linux_tty;
- 	linux_tty->driver_data = tty;
-@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
- 
- static void do_ipw_close(struct ipw_tty *tty)
- {
--	tty->open_count--;
--
--	if (tty->open_count == 0) {
-+	if (atomic_dec_return(&tty->open_count) == 0) {
- 		struct tty_struct *linux_tty = tty->linux_tty;
- 
- 		if (linux_tty != NULL) {
-@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
- 		return;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (tty->open_count == 0) {
-+	if (atomic_read(&tty->open_count) == 0) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
- 		return;
- 	}
- 
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return;
- 	}
-@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
- 		return -ENODEV;
- 
- 	mutex_lock(&tty->ipw_tty_mutex);
--	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
- 		mutex_unlock(&tty->ipw_tty_mutex);
- 		return -EINVAL;
- 	}
-@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
- 	if (!tty)
- 		return 0;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return 0;
- 
- 	return tty->tx_bytes_queued;
-@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return get_control_lines(tty);
-@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	return set_control_lines(tty, set, clear);
-@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
- 	if (!tty)
- 		return -ENODEV;
- 
--	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
- 		return -EINVAL;
- 
- 	/* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
- 				   against a parallel ioctl etc */
- 				mutex_lock(&ttyj->ipw_tty_mutex);
- 			}
--			while (ttyj->open_count)
-+			while (atomic_read(&ttyj->open_count))
- 				do_ipw_close(ttyj);
- 			ipwireless_disassociate_network_ttys(network,
- 							     ttyj->channel_idx);
-diff -urNp linux-2.6.32.13/drivers/char/pty.c linux-2.6.32.13/drivers/char/pty.c
---- linux-2.6.32.13/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/pty.c	2010-05-15 13:21:15.035728941 -0400
-@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
- 	return ret;
- }
- 
--static struct file_operations ptmx_fops;
-+static const struct file_operations ptmx_fops = {
-+	.llseek		= no_llseek,
-+	.read		= tty_read,
-+	.write		= tty_write,
-+	.poll		= tty_poll,
-+	.unlocked_ioctl	= tty_ioctl,
-+	.compat_ioctl	= tty_compat_ioctl,
-+	.open		= ptmx_open,
-+	.release	= tty_release,
-+	.fasync		= tty_fasync,
-+};
-+
- 
- static void __init unix98_pty_init(void)
- {
-@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
- 	register_sysctl_table(pty_root_table);
- 
- 	/* Now create the /dev/ptmx special device */
--	tty_default_fops(&ptmx_fops);
--	ptmx_fops.open = ptmx_open;
--
- 	cdev_init(&ptmx_cdev, &ptmx_fops);
- 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
- 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
-diff -urNp linux-2.6.32.13/drivers/char/random.c linux-2.6.32.13/drivers/char/random.c
---- linux-2.6.32.13/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/random.c	2010-05-15 13:21:15.038954680 -0400
-@@ -254,8 +254,13 @@
- /*
-  * Configuration information
-  */
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+#define INPUT_POOL_WORDS 512
-+#define OUTPUT_POOL_WORDS 128
-+#else
- #define INPUT_POOL_WORDS 128
- #define OUTPUT_POOL_WORDS 32
-+#endif
- #define SEC_XFER_SIZE 512
- 
- /*
-@@ -292,10 +297,17 @@ static struct poolinfo {
- 	int poolwords;
- 	int tap1, tap2, tap3, tap4, tap5;
- } poolinfo_table[] = {
-+#ifdef CONFIG_GRKERNSEC_RANDNET
-+	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
-+	{ 512,	411,	308,	208,	104,	1 },
-+	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
-+	{ 128,	103,	76,	51,	25,	1 },
-+#else
- 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
- 	{ 128,	103,	76,	51,	25,	1 },
- 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
- 	{ 32,	26,	20,	14,	7,	1 },
-+#endif
- #if 0
- 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
- 	{ 2048,	1638,	1231,	819,	411,	1 },
-@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
- #include <linux/sysctl.h>
- 
- static int min_read_thresh = 8, min_write_thresh;
--static int max_read_thresh = INPUT_POOL_WORDS * 32;
-+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
- static int max_write_thresh = INPUT_POOL_WORDS * 32;
- static char sysctl_bootid[16];
- 
-diff -urNp linux-2.6.32.13/drivers/char/sonypi.c linux-2.6.32.13/drivers/char/sonypi.c
---- linux-2.6.32.13/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/sonypi.c	2010-05-15 13:21:15.038954680 -0400
-@@ -491,7 +491,7 @@ static struct sonypi_device {
- 	spinlock_t fifo_lock;
- 	wait_queue_head_t fifo_proc_list;
- 	struct fasync_struct *fifo_async;
--	int open_count;
-+	atomic_t open_count;
- 	int model;
- 	struct input_dev *input_jog_dev;
- 	struct input_dev *input_key_dev;
-@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
- static int sonypi_misc_release(struct inode *inode, struct file *file)
- {
- 	mutex_lock(&sonypi_device.lock);
--	sonypi_device.open_count--;
-+	atomic_dec(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	return 0;
- }
-@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
- 	lock_kernel();
- 	mutex_lock(&sonypi_device.lock);
- 	/* Flush input queue on first open */
--	if (!sonypi_device.open_count)
-+	if (!atomic_read(&sonypi_device.open_count))
- 		kfifo_reset(sonypi_device.fifo);
--	sonypi_device.open_count++;
-+	atomic_inc(&sonypi_device.open_count);
- 	mutex_unlock(&sonypi_device.lock);
- 	unlock_kernel();
- 	return 0;
-diff -urNp linux-2.6.32.13/drivers/char/tpm/tpm_bios.c linux-2.6.32.13/drivers/char/tpm/tpm_bios.c
---- linux-2.6.32.13/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/tpm/tpm_bios.c	2010-05-15 13:21:15.042644897 -0400
-@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
- 	event = addr;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	return addr;
-@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
- 		return NULL;
- 
- 	if ((event->event_type == 0 && event->event_size == 0) ||
--	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
-+	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
- 		return NULL;
- 
- 	(*pos)++;
-@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
- 	int i;
- 
- 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
--		seq_putc(m, data[i]);
-+		if (!seq_putc(m, data[i]))
-+			return -EFAULT;
- 
- 	return 0;
- }
-@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
- 	log->bios_event_log_end = log->bios_event_log + len;
- 
- 	virt = acpi_os_map_memory(start, len);
-+	if (!virt) {
-+		kfree(log->bios_event_log);
-+		log->bios_event_log = NULL;
-+		return -EFAULT;
-+	}
- 
- 	memcpy(log->bios_event_log, virt, len);
- 
-diff -urNp linux-2.6.32.13/drivers/char/tty_io.c linux-2.6.32.13/drivers/char/tty_io.c
---- linux-2.6.32.13/drivers/char/tty_io.c	2010-04-29 17:49:37.826084348 -0400
-+++ linux-2.6.32.13/drivers/char/tty_io.c	2010-05-15 13:21:15.058626500 -0400
-@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
- DEFINE_MUTEX(tty_mutex);
- EXPORT_SYMBOL(tty_mutex);
- 
--static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
--static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
- ssize_t redirected_tty_write(struct file *, const char __user *,
- 							size_t, loff_t *);
--static unsigned int tty_poll(struct file *, poll_table *);
- static int tty_open(struct inode *, struct file *);
--static int tty_release(struct inode *, struct file *);
- long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
--#ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
--				unsigned long arg);
--#else
--#define tty_compat_ioctl NULL
--#endif
--static int tty_fasync(int fd, struct file *filp, int on);
- static void release_tty(struct tty_struct *tty, int idx);
- static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
- static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
-@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
-  *	read calls may be outstanding in parallel.
-  */
- 
--static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
-+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
- 			loff_t *ppos)
- {
- 	int i;
-@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
- 	return i;
- }
- 
-+EXPORT_SYMBOL(tty_read);
-+
- void tty_write_unlock(struct tty_struct *tty)
- {
- 	mutex_unlock(&tty->atomic_write_lock);
-@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
-  *	write method will not be invoked in parallel for each device.
-  */
- 
--static ssize_t tty_write(struct file *file, const char __user *buf,
-+ssize_t tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
- 	struct tty_struct *tty;
-@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
- 	return ret;
- }
- 
-+EXPORT_SYMBOL(tty_write);
-+
- ssize_t redirected_tty_write(struct file *file, const char __user *buf,
- 						size_t count, loff_t *ppos)
- {
-@@ -1867,7 +1860,7 @@ static int tty_open(struct inode *inode,
-  *		Takes bkl. See tty_release_dev
-  */
- 
--static int tty_release(struct inode *inode, struct file *filp)
-+int tty_release(struct inode *inode, struct file *filp)
- {
- 	lock_kernel();
- 	tty_release_dev(filp);
-@@ -1875,6 +1868,8 @@ static int tty_release(struct inode *ino
- 	return 0;
- }
- 
-+EXPORT_SYMBOL(tty_release);
-+
- /**
-  *	tty_poll	-	check tty status
-  *	@filp: file being polled
-@@ -1887,7 +1882,7 @@ static int tty_release(struct inode *ino
-  *	may be re-entered freely by other callers.
-  */
- 
--static unsigned int tty_poll(struct file *filp, poll_table *wait)
-+unsigned int tty_poll(struct file *filp, poll_table *wait)
- {
- 	struct tty_struct *tty;
- 	struct tty_ldisc *ld;
-@@ -1904,7 +1899,9 @@ static unsigned int tty_poll(struct file
- 	return ret;
- }
- 
--static int tty_fasync(int fd, struct file *filp, int on)
-+EXPORT_SYMBOL(tty_poll);
-+
-+int tty_fasync(int fd, struct file *filp, int on)
- {
- 	struct tty_struct *tty;
- 	unsigned long flags;
-@@ -1948,6 +1945,8 @@ out:
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_fasync);
-+
- /**
-  *	tiocsti			-	fake input character
-  *	@tty: tty to fake input into
-@@ -2582,8 +2581,10 @@ long tty_ioctl(struct file *file, unsign
- 	return retval;
- }
- 
-+EXPORT_SYMBOL(tty_ioctl);
-+
- #ifdef CONFIG_COMPAT
--static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+long tty_compat_ioctl(struct file *file, unsigned int cmd,
- 				unsigned long arg)
- {
- 	struct inode *inode = file->f_dentry->d_inode;
-@@ -2607,6 +2608,8 @@ static long tty_compat_ioctl(struct file
- 
- 	return retval;
- }
-+
-+EXPORT_SYMBOL(tty_compat_ioctl);
- #endif
- 
- /*
-@@ -3050,11 +3053,6 @@ struct tty_struct *get_current_tty(void)
- }
- EXPORT_SYMBOL_GPL(get_current_tty);
- 
--void tty_default_fops(struct file_operations *fops)
--{
--	*fops = tty_fops;
--}
--
- /*
-  * Initialize the console device. This is called *early*, so
-  * we can't necessarily depend on lots of kernel help here.
-diff -urNp linux-2.6.32.13/drivers/char/tty_ldisc.c linux-2.6.32.13/drivers/char/tty_ldisc.c
---- linux-2.6.32.13/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/tty_ldisc.c	2010-05-15 13:21:15.058626500 -0400
-@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
- 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
- 		struct tty_ldisc_ops *ldo = ld->ops;
- 
--		ldo->refcount--;
-+		atomic_dec(&ldo->refcount);
- 		module_put(ldo->owner);
- 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
-@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
- 	tty_ldiscs[disc] = new_ldisc;
- 	new_ldisc->num = disc;
--	new_ldisc->refcount = 0;
-+	atomic_set(&new_ldisc->refcount, 0);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- 
- 	return ret;
-@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
- 		return -EINVAL;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	if (tty_ldiscs[disc]->refcount)
-+	if (atomic_read(&tty_ldiscs[disc]->refcount))
- 		ret = -EBUSY;
- 	else
- 		tty_ldiscs[disc] = NULL;
-@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
- 	if (ldops) {
- 		ret = ERR_PTR(-EAGAIN);
- 		if (try_module_get(ldops->owner)) {
--			ldops->refcount++;
-+			atomic_inc(&ldops->refcount);
- 			ret = ldops;
- 		}
- 	}
-@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&tty_ldisc_lock, flags);
--	ldops->refcount--;
-+	atomic_dec(&ldops->refcount);
- 	module_put(ldops->owner);
- 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
- }
-diff -urNp linux-2.6.32.13/drivers/char/virtio_console.c linux-2.6.32.13/drivers/char/virtio_console.c
---- linux-2.6.32.13/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/virtio_console.c	2010-05-15 13:21:15.058626500 -0400
-@@ -44,6 +44,7 @@ static unsigned int in_len;
- static char *in, *inbuf;
- 
- /* The operations for our console. */
-+/* cannot be const */
- static struct hv_ops virtio_cons;
- 
- /* The hvc device */
-diff -urNp linux-2.6.32.13/drivers/char/vt_ioctl.c linux-2.6.32.13/drivers/char/vt_ioctl.c
---- linux-2.6.32.13/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/char/vt_ioctl.c	2010-05-15 13:21:15.062960555 -0400
-@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
- 	case KDSKBENT:
- 		if (!perm)
- 			return -EPERM;
-+
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG))
-+			return -EPERM;
-+#endif
-+
- 		if (!i && v == K_NOSUCHMAP) {
- 			/* deallocate map */
- 			key_map = key_maps[s];
-@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
- 			goto reterr;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC
-+		if (!capable(CAP_SYS_TTY_CONFIG)) {
-+			ret = -EPERM;
-+			goto reterr;
-+		}
-+#endif
-+
- 		q = func_table[i];
- 		first_free = funcbufptr + (funcbufsize - funcbufleft);
- 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
-diff -urNp linux-2.6.32.13/drivers/cpufreq/cpufreq.c linux-2.6.32.13/drivers/cpufreq/cpufreq.c
---- linux-2.6.32.13/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/cpufreq/cpufreq.c	2010-05-15 13:21:15.062960555 -0400
-@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
- 	complete(&policy->kobj_unregister);
- }
- 
--static struct sysfs_ops sysfs_ops = {
-+static const struct sysfs_ops sysfs_ops = {
- 	.show	= show,
- 	.store	= store,
- };
-diff -urNp linux-2.6.32.13/drivers/cpuidle/sysfs.c linux-2.6.32.13/drivers/cpuidle/sysfs.c
---- linux-2.6.32.13/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/cpuidle/sysfs.c	2010-05-15 13:21:15.062960555 -0400
-@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_sysfs_ops = {
- 	.show = cpuidle_show,
- 	.store = cpuidle_store,
- };
-@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
- 	return ret;
- }
- 
--static struct sysfs_ops cpuidle_state_sysfs_ops = {
-+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
- 	.show = cpuidle_state_show,
- };
- 
-@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
- 	.release = cpuidle_state_sysfs_release,
- };
- 
--static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
-+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
- {
- 	kobject_put(&device->kobjs[i]->kobj);
- 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff -urNp linux-2.6.32.13/drivers/dma/ioat/dma.c linux-2.6.32.13/drivers/dma/ioat/dma.c
---- linux-2.6.32.13/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/dma/ioat/dma.c	2010-05-15 13:21:15.074651091 -0400
-@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
- 	return entry->show(&chan->common, page);
- }
- 
--struct sysfs_ops ioat_sysfs_ops = {
-+const struct sysfs_ops ioat_sysfs_ops = {
- 	.show	= ioat_attr_show,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/dma/ioat/dma.h linux-2.6.32.13/drivers/dma/ioat/dma.h
---- linux-2.6.32.13/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/dma/ioat/dma.h	2010-05-15 13:21:15.090639890 -0400
-@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
- 			   unsigned long *phys_complete);
- void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
- void ioat_kobject_del(struct ioatdma_device *device);
--extern struct sysfs_ops ioat_sysfs_ops;
-+extern const struct sysfs_ops ioat_sysfs_ops;
- extern struct ioat_sysfs_entry ioat_version_attr;
- extern struct ioat_sysfs_entry ioat_cap_attr;
- #endif /* IOATDMA_H */
-diff -urNp linux-2.6.32.13/drivers/edac/edac_core.h linux-2.6.32.13/drivers/edac/edac_core.h
---- linux-2.6.32.13/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/edac/edac_core.h	2010-05-15 13:21:15.090639890 -0400
-@@ -99,11 +99,11 @@ extern int edac_debug_level;
- 
- #else				/* !CONFIG_EDAC_DEBUG */
- 
--#define debugf0( ... )
--#define debugf1( ... )
--#define debugf2( ... )
--#define debugf3( ... )
--#define debugf4( ... )
-+#define debugf0( ... ) do {} while (0)
-+#define debugf1( ... ) do {} while (0)
-+#define debugf2( ... ) do {} while (0)
-+#define debugf3( ... ) do {} while (0)
-+#define debugf4( ... ) do {} while (0)
- 
- #endif				/* !CONFIG_EDAC_DEBUG */
- 
-diff -urNp linux-2.6.32.13/drivers/edac/edac_device_sysfs.c linux-2.6.32.13/drivers/edac/edac_device_sysfs.c
---- linux-2.6.32.13/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/edac/edac_device_sysfs.c	2010-05-15 13:21:15.090639890 -0400
-@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
- }
- 
- /* edac_dev file operations for an 'ctl_info' */
--static struct sysfs_ops device_ctl_info_ops = {
-+static const struct sysfs_ops device_ctl_info_ops = {
- 	.show = edac_dev_ctl_info_show,
- 	.store = edac_dev_ctl_info_store
- };
-@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
- }
- 
- /* edac_dev file operations for an 'instance' */
--static struct sysfs_ops device_instance_ops = {
-+static const struct sysfs_ops device_instance_ops = {
- 	.show = edac_dev_instance_show,
- 	.store = edac_dev_instance_store
- };
-@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
- }
- 
- /* edac_dev file operations for a 'block' */
--static struct sysfs_ops device_block_ops = {
-+static const struct sysfs_ops device_block_ops = {
- 	.show = edac_dev_block_show,
- 	.store = edac_dev_block_store
- };
-diff -urNp linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/edac/edac_mc_sysfs.c	2010-05-15 13:21:15.090639890 -0400
-@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
- 	return -EIO;
- }
- 
--static struct sysfs_ops csrowfs_ops = {
-+static const struct sysfs_ops csrowfs_ops = {
- 	.show = csrowdev_show,
- 	.store = csrowdev_store
- };
-@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
- }
- 
- /* Intermediate show/store table */
--static struct sysfs_ops mci_ops = {
-+static const struct sysfs_ops mci_ops = {
- 	.show = mcidev_show,
- 	.store = mcidev_store
- };
-diff -urNp linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c
---- linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/edac/edac_pci_sysfs.c	2010-05-15 13:21:15.090639890 -0400
-@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
- }
- 
- /* fs_ops table */
--static struct sysfs_ops pci_instance_ops = {
-+static const struct sysfs_ops pci_instance_ops = {
- 	.show = edac_pci_instance_show,
- 	.store = edac_pci_instance_store
- };
-@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
- 	return -EIO;
- }
- 
--static struct sysfs_ops edac_pci_sysfs_ops = {
-+static const struct sysfs_ops edac_pci_sysfs_ops = {
- 	.show = edac_pci_dev_show,
- 	.store = edac_pci_dev_store
- };
-diff -urNp linux-2.6.32.13/drivers/firewire/core-cdev.c linux-2.6.32.13/drivers/firewire/core-cdev.c
---- linux-2.6.32.13/drivers/firewire/core-cdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firewire/core-cdev.c	2010-05-15 13:21:15.094957471 -0400
-@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
- 	int ret;
- 
- 	if ((request->channels == 0 && request->bandwidth == 0) ||
--	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
--	    request->bandwidth < 0)
-+	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
- 		return -EINVAL;
- 
- 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
-diff -urNp linux-2.6.32.13/drivers/firmware/dmi_scan.c linux-2.6.32.13/drivers/firmware/dmi_scan.c
---- linux-2.6.32.13/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firmware/dmi_scan.c	2010-05-15 13:21:15.094957471 -0400
-@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
- 		}
- 	}
- 	else {
--		/*
--		 * no iounmap() for that ioremap(); it would be a no-op, but
--		 * it's so early in setup that sucker gets confused into doing
--		 * what it shouldn't if we actually call it.
--		 */
- 		p = dmi_ioremap(0xF0000, 0x10000);
- 		if (p == NULL)
- 			goto error;
-diff -urNp linux-2.6.32.13/drivers/firmware/edd.c linux-2.6.32.13/drivers/firmware/edd.c
---- linux-2.6.32.13/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firmware/edd.c	2010-05-15 13:21:15.094957471 -0400
-@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
- 	return ret;
- }
- 
--static struct sysfs_ops edd_attr_ops = {
-+static const struct sysfs_ops edd_attr_ops = {
- 	.show = edd_attr_show,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/firmware/efivars.c linux-2.6.32.13/drivers/firmware/efivars.c
---- linux-2.6.32.13/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firmware/efivars.c	2010-05-15 13:21:15.102953838 -0400
-@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops efivar_attr_ops = {
-+static const struct sysfs_ops efivar_attr_ops = {
- 	.show = efivar_attr_show,
- 	.store = efivar_attr_store,
- };
-diff -urNp linux-2.6.32.13/drivers/firmware/iscsi_ibft.c linux-2.6.32.13/drivers/firmware/iscsi_ibft.c
---- linux-2.6.32.13/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firmware/iscsi_ibft.c	2010-05-15 13:21:15.102953838 -0400
-@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
- 	return ret;
- }
- 
--static struct sysfs_ops ibft_attr_ops = {
-+static const struct sysfs_ops ibft_attr_ops = {
- 	.show = ibft_show_attribute,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/firmware/memmap.c linux-2.6.32.13/drivers/firmware/memmap.c
---- linux-2.6.32.13/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/firmware/memmap.c	2010-05-15 13:21:15.102953838 -0400
-@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
- 	NULL
- };
- 
--static struct sysfs_ops memmap_attr_ops = {
-+static const struct sysfs_ops memmap_attr_ops = {
- 	.show = memmap_attr_show,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_drv.c linux-2.6.32.13/drivers/gpu/drm/drm_drv.c
---- linux-2.6.32.13/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/drm_drv.c	2010-05-15 13:21:15.118645498 -0400
-@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
- 	char *kdata = NULL;
- 
- 	atomic_inc(&dev->ioctl_count);
--	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
- 	++file_priv->ioctl_count;
- 
- 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_fops.c linux-2.6.32.13/drivers/gpu/drm/drm_fops.c
---- linux-2.6.32.13/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:37.845185844 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/drm_fops.c	2010-05-15 13:21:15.130631389 -0400
-@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
- 	}
- 
- 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
--		atomic_set(&dev->counts[i], 0);
-+		atomic_set_unchecked(&dev->counts[i], 0);
- 
- 	dev->sigdata.lock = NULL;
- 
-@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
- 
- 	retcode = drm_open_helper(inode, filp, dev);
- 	if (!retcode) {
--		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
-+		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
- 		spin_lock(&dev->count_lock);
--		if (!dev->open_count++) {
-+		if (atomic_inc_return(&dev->open_count) == 1) {
- 			spin_unlock(&dev->count_lock);
- 			retcode = drm_setup(dev);
- 			goto out;
-@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
- 
- 	lock_kernel();
- 
--	DRM_DEBUG("open_count = %d\n", dev->open_count);
-+	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
- 
- 	if (dev->driver->preclose)
- 		dev->driver->preclose(dev, file_priv);
-@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
- 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
- 		  task_pid_nr(current),
- 		  (long)old_encode_dev(file_priv->minor->device),
--		  dev->open_count);
-+		  atomic_read(&dev->open_count));
- 
- 	/* if the master has gone away we can't do anything with the lock */
- 	if (file_priv->minor->master)
-@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
- 	 * End inline drm_release
- 	 */
- 
--	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
- 	spin_lock(&dev->count_lock);
--	if (!--dev->open_count) {
-+	if (atomic_dec_and_test(&dev->open_count)) {
- 		if (atomic_read(&dev->ioctl_count)) {
- 			DRM_ERROR("Device busy: %d\n",
- 				  atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/drm_ioctl.c	2010-05-15 13:21:15.138734335 -0400
-@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
- 			stats->data[i].value =
- 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
- 		else
--			stats->data[i].value = atomic_read(&dev->counts[i]);
-+			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
- 		stats->data[i].type = dev->types[i];
- 	}
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/drm_lock.c linux-2.6.32.13/drivers/gpu/drm/drm_lock.c
---- linux-2.6.32.13/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/drm_lock.c	2010-05-15 13:21:15.138734335 -0400
-@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
- 		if (drm_lock_take(&master->lock, lock->context)) {
- 			master->lock.file_priv = file_priv;
- 			master->lock.lock_time = jiffies;
--			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
-+			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
- 			break;	/* Got lock */
- 		}
- 
-@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
- 		return -EINVAL;
- 	}
- 
--	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
- 
- 	/* kernel_context_switch isn't used by any of the x86 drm
- 	 * modules but is required by the Sparc driver.
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i810/i810_dma.c	2010-05-15 13:21:15.158669145 -0400
-@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
- 				 dma->buflist[vertex->idx],
- 				 vertex->discard, vertex->used);
- 
--	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
- 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
- 			     mc->last_render);
- 
--	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
--	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
-+	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
- 	sarea_priv->last_enqueue = dev_priv->counter - 1;
- 	sarea_priv->last_dispatch = (int)hw_status[5];
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7017.c	2010-05-15 13:21:15.175041309 -0400
-@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7017_ops = {
-+const struct intel_dvo_dev_ops ch7017_ops = {
- 	.init = ch7017_init,
- 	.detect = ch7017_detect,
- 	.mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-05-15 13:21:15.175041309 -0400
-@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops ch7xxx_ops = {
-+const struct intel_dvo_dev_ops ch7xxx_ops = {
- 	.init = ch7xxx_init,
- 	.detect = ch7xxx_detect,
- 	.mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo.h	2010-05-15 13:21:15.175041309 -0400
-@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
- 	 *
- 	 * \return singly-linked list of modes or NULL if no modes found.
- 	 */
--	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
-+	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Clean up driver-specific bits of the output
- 	 */
--	void (*destroy) (struct intel_dvo_device *dvo);
-+	void (* const destroy) (struct intel_dvo_device *dvo);
- 
- 	/**
- 	 * Debugging hook to dump device registers to log file
- 	 */
--	void (*dump_regs)(struct intel_dvo_device *dvo);
-+	void (* const dump_regs)(struct intel_dvo_device *dvo);
- };
- 
--extern struct intel_dvo_dev_ops sil164_ops;
--extern struct intel_dvo_dev_ops ch7xxx_ops;
--extern struct intel_dvo_dev_ops ivch_ops;
--extern struct intel_dvo_dev_ops tfp410_ops;
--extern struct intel_dvo_dev_ops ch7017_ops;
-+extern const struct intel_dvo_dev_ops sil164_ops;
-+extern const struct intel_dvo_dev_ops ch7xxx_ops;
-+extern const struct intel_dvo_dev_ops ivch_ops;
-+extern const struct intel_dvo_dev_ops tfp410_ops;
-+extern const struct intel_dvo_dev_ops ch7017_ops;
- 
- #endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_ivch.c	2010-05-15 13:21:15.175041309 -0400
-@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
- 	}
- }
- 
--struct intel_dvo_dev_ops ivch_ops= {
-+const struct intel_dvo_dev_ops ivch_ops= {
- 	.init = ivch_init,
- 	.dpms = ivch_dpms,
- 	.save = ivch_save,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_sil164.c	2010-05-15 13:21:15.175041309 -0400
-@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops sil164_ops = {
-+const struct intel_dvo_dev_ops sil164_ops = {
- 	.init = sil164_init,
- 	.detect = sil164_detect,
- 	.mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/dvo_tfp410.c	2010-05-15 13:21:15.178966455 -0400
-@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
- 	}
- }
- 
--struct intel_dvo_dev_ops tfp410_ops = {
-+const struct intel_dvo_dev_ops tfp410_ops = {
- 	.init = tfp410_init,
- 	.detect = tfp410_detect,
- 	.mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/i915/i915_drv.c	2010-05-15 13:21:15.178966455 -0400
-@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
- 	return i915_resume(dev);
- }
- 
--static struct vm_operations_struct i915_gem_vm_ops = {
-+static const struct vm_operations_struct i915_gem_vm_ops = {
- 	.fault = i915_gem_fault,
- 	.open = drm_gem_vm_open,
- 	.close = drm_gem_vm_close,
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/radeon/mkregtable.c	2010-05-15 13:21:15.190982657 -0400
-@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
- 	regex_t mask_rex;
- 	regmatch_t match[4];
- 	char buf[1024];
--	size_t end;
-+	long end;
- 	int len;
- 	int done = 0;
- 	int r;
- 	unsigned o;
- 	struct offset *offset;
- 	char last_reg_s[10];
--	int last_reg;
-+	unsigned long last_reg;
- 
- 	if (regcomp
- 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c
---- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_atombios.c	2010-05-15 13:21:15.194751236 -0400
-@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
- 	}
- }
- 
--struct bios_connector {
-+static struct bios_connector {
- 	bool valid;
- 	uint16_t line_mux;
- 	uint16_t devices;
- 	int connector_type;
- 	struct radeon_i2c_bus_rec ddc_bus;
--};
-+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- bool radeon_get_atom_connector_info_from_supported_devices_table(struct
- 								 drm_device
-@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
- 	uint8_t dac;
- 	union atom_supported_devices *supported_devices;
- 	int i, j;
--	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
- 
- 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c
---- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_display.c	2010-05-15 13:21:15.198961996 -0400
-@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
- 
- 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
- 						error = freq - current_freq;
--						error = error < 0 ? 0xffffffff : error;
-+						error = (int32_t)error < 0 ? 0xffffffff : error;
- 					} else
- 						error = abs(current_freq - freq);
- 					vco_diff = abs(vco - best_vco);
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_state.c	2010-05-15 13:21:15.206905040 -0400
-@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
- {
- 	drm_radeon_private_t *dev_priv = dev->dev_private;
- 	drm_radeon_getparam_t *param = data;
--	int value;
-+	int value = 0;
- 
- 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/radeon/radeon_ttm.c	2010-05-15 13:21:15.206905040 -0400
-@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
- 	DRM_INFO("radeon: ttm finalized\n");
- }
- 
--static struct vm_operations_struct radeon_ttm_vm_ops;
--static const struct vm_operations_struct *ttm_vm_ops = NULL;
--
--static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
--{
--	struct ttm_buffer_object *bo;
--	int r;
--
--	bo = (struct ttm_buffer_object *)vma->vm_private_data;
--	if (bo == NULL) {
--		return VM_FAULT_NOPAGE;
--	}
--	r = ttm_vm_ops->fault(vma, vmf);
--	return r;
--}
--
- int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
- {
- 	struct drm_file *file_priv;
- 	struct radeon_device *rdev;
--	int r;
- 
- 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
- 		return drm_mmap(filp, vma);
-@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
- 
- 	file_priv = (struct drm_file *)filp->private_data;
- 	rdev = file_priv->minor->dev->dev_private;
--	if (rdev == NULL) {
-+	if (!rdev)
- 		return -EINVAL;
--	}
--	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
--	if (unlikely(r != 0)) {
--		return r;
--	}
--	if (unlikely(ttm_vm_ops == NULL)) {
--		ttm_vm_ops = vma->vm_ops;
--		radeon_ttm_vm_ops = *ttm_vm_ops;
--		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
--	}
--	vma->vm_ops = &radeon_ttm_vm_ops;
--	return 0;
-+	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
- }
- 
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo.c	2010-05-15 13:21:15.206905040 -0400
-@@ -39,7 +39,7 @@
- #include <linux/module.h>
- 
- #define TTM_ASSERT_LOCKED(param)
--#define TTM_DEBUG(fmt, arg...)
-+#define TTM_DEBUG(fmt, arg...) do {} while (0)
- #define TTM_BO_HASH_ORDER 13
- 
- static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
-@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
- 	NULL
- };
- 
--static struct sysfs_ops ttm_bo_global_ops = {
-+static const struct sysfs_ops ttm_bo_global_ops = {
- 	.show = &ttm_bo_global_show
- };
- 
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-05-15 13:21:15.206905040 -0400
-@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
- {
- 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
- 	    vma->vm_private_data;
--	struct ttm_bo_device *bdev = bo->bdev;
-+	struct ttm_bo_device *bdev;
- 	unsigned long bus_base;
- 	unsigned long bus_offset;
- 	unsigned long bus_size;
-@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
- 	unsigned long address = (unsigned long)vmf->virtual_address;
- 	int retval = VM_FAULT_NOPAGE;
- 
-+	if (!bo)
-+		return VM_FAULT_NOPAGE;
-+	bdev = bo->bdev;
-+
- 	/*
- 	 * Work around locking order reversal in fault / nopfn
- 	 * between mmap_sem and bo_reserve: Perform a trylock operation
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c
---- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_global.c	2010-05-15 13:21:15.206905040 -0400
-@@ -36,7 +36,7 @@
- struct ttm_global_item {
- 	struct mutex mutex;
- 	void *object;
--	int refcount;
-+	atomic_t refcount;
- };
- 
- static struct ttm_global_item glob[TTM_GLOBAL_NUM];
-@@ -49,7 +49,7 @@ void ttm_global_init(void)
- 		struct ttm_global_item *item = &glob[i];
- 		mutex_init(&item->mutex);
- 		item->object = NULL;
--		item->refcount = 0;
-+		atomic_set(&item->refcount, 0);
- 	}
- }
- 
-@@ -59,7 +59,7 @@ void ttm_global_release(void)
- 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
- 		struct ttm_global_item *item = &glob[i];
- 		BUG_ON(item->object != NULL);
--		BUG_ON(item->refcount != 0);
-+		BUG_ON(atomic_read(&item->refcount) != 0);
- 	}
- }
- 
-@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
- 	void *object;
- 
- 	mutex_lock(&item->mutex);
--	if (item->refcount == 0) {
-+	if (atomic_read(&item->refcount) == 0) {
- 		item->object = kzalloc(ref->size, GFP_KERNEL);
- 		if (unlikely(item->object == NULL)) {
- 			ret = -ENOMEM;
-@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
- 			goto out_err;
- 
- 	}
--	++item->refcount;
-+	atomic_inc(&item->refcount);
- 	ref->object = item->object;
- 	object = item->object;
- 	mutex_unlock(&item->mutex);
-@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
- 	struct ttm_global_item *item = &glob[ref->global_type];
- 
- 	mutex_lock(&item->mutex);
--	BUG_ON(item->refcount == 0);
-+	BUG_ON(atomic_read(&item->refcount) == 0);
- 	BUG_ON(ref->object != item->object);
--	if (--item->refcount == 0) {
-+	if (atomic_dec_and_test(&item->refcount)) {
- 		ref->release(ref);
- 		item->object = NULL;
- 	}
-diff -urNp linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c
---- linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/gpu/drm/ttm/ttm_memory.c	2010-05-15 13:21:15.206905040 -0400
-@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
- 	NULL
- };
- 
--static struct sysfs_ops ttm_mem_zone_ops = {
-+static const struct sysfs_ops ttm_mem_zone_ops = {
- 	.show = &ttm_mem_zone_show,
- 	.store = &ttm_mem_zone_store
- };
-diff -urNp linux-2.6.32.13/drivers/hid/usbhid/hiddev.c linux-2.6.32.13/drivers/hid/usbhid/hiddev.c
---- linux-2.6.32.13/drivers/hid/usbhid/hiddev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hid/usbhid/hiddev.c	2010-05-15 13:21:15.206905040 -0400
-@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
- 		return put_user(HID_VERSION, (int __user *)arg);
- 
- 	case HIDIOCAPPLICATION:
--		if (arg < 0 || arg >= hid->maxapplication)
-+		if (arg >= hid->maxapplication)
- 			return -EINVAL;
- 
- 		for (i = 0; i < hid->maxcollection; i++)
-diff -urNp linux-2.6.32.13/drivers/hwmon/k8temp.c linux-2.6.32.13/drivers/hwmon/k8temp.c
---- linux-2.6.32.13/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hwmon/k8temp.c	2010-05-15 13:21:15.206905040 -0400
-@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
- 
- static struct pci_device_id k8temp_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, k8temp_ids);
-diff -urNp linux-2.6.32.13/drivers/hwmon/sis5595.c linux-2.6.32.13/drivers/hwmon/sis5595.c
---- linux-2.6.32.13/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hwmon/sis5595.c	2010-05-15 13:21:15.222963784 -0400
-@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
- 
- static struct pci_device_id sis5595_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
-diff -urNp linux-2.6.32.13/drivers/hwmon/via686a.c linux-2.6.32.13/drivers/hwmon/via686a.c
---- linux-2.6.32.13/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hwmon/via686a.c	2010-05-15 13:21:15.230602217 -0400
-@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
- 
- static struct pci_device_id via686a_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
-diff -urNp linux-2.6.32.13/drivers/hwmon/vt8231.c linux-2.6.32.13/drivers/hwmon/vt8231.c
---- linux-2.6.32.13/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hwmon/vt8231.c	2010-05-15 13:21:15.230602217 -0400
-@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
- 
- static struct pci_device_id vt8231_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
-diff -urNp linux-2.6.32.13/drivers/hwmon/w83791d.c linux-2.6.32.13/drivers/hwmon/w83791d.c
---- linux-2.6.32.13/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/hwmon/w83791d.c	2010-05-15 13:21:15.234719424 -0400
-@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
- 			  struct i2c_board_info *info);
- static int w83791d_remove(struct i2c_client *client);
- 
--static int w83791d_read(struct i2c_client *client, u8 register);
--static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
-+static int w83791d_read(struct i2c_client *client, u8 reg);
-+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
- static struct w83791d_data *w83791d_update_device(struct device *dev);
- 
- #ifdef DEBUG
-diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c
---- linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c	2010-04-29 17:49:37.945518391 -0400
-+++ linux-2.6.32.13/drivers/i2c/busses/i2c-i801.c	2010-05-15 13:21:15.234719424 -0400
-@@ -582,7 +582,7 @@ static struct pci_device_id i801_ids[] =
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CPT_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, i801_ids);
-diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c
---- linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/i2c/busses/i2c-piix4.c	2010-05-15 13:21:15.234719424 -0400
-@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
- 		.ident = "IBM",
- 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
--	{ },
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
-@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, piix4_ids);
-diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c
---- linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/i2c/busses/i2c-sis630.c	2010-05-15 13:21:15.234719424 -0400
-@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
- static struct pci_device_id sis630_ids[] __devinitdata = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis630_ids);
-diff -urNp linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c
---- linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/i2c/busses/i2c-sis96x.c	2010-05-15 13:21:15.234719424 -0400
-@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
- 
- static struct pci_device_id sis96x_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis96x_ids);
-diff -urNp linux-2.6.32.13/drivers/ide/ide-cd.c linux-2.6.32.13/drivers/ide/ide-cd.c
---- linux-2.6.32.13/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ide/ide-cd.c	2010-05-15 13:21:15.234719424 -0400
-@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
- 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
- 		if ((unsigned long)buf & alignment
- 		    || blk_rq_bytes(rq) & q->dma_pad_mask
--		    || object_is_on_stack(buf))
-+		    || object_starts_on_stack(buf))
- 			drive->dma = 0;
- 	}
- }
-diff -urNp linux-2.6.32.13/drivers/ieee1394/dv1394.c linux-2.6.32.13/drivers/ieee1394/dv1394.c
---- linux-2.6.32.13/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/dv1394.c	2010-05-15 13:21:15.234719424 -0400
-@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
- 	based upon DIF section and sequence
- */
- 
--static void inline
-+static inline void
- frame_put_packet (struct frame *f, struct packet *p)
- {
- 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
-@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
- 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
- 	},
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
-diff -urNp linux-2.6.32.13/drivers/ieee1394/eth1394.c linux-2.6.32.13/drivers/ieee1394/eth1394.c
---- linux-2.6.32.13/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/eth1394.c	2010-05-15 13:21:15.250965621 -0400
-@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
- 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
- 		.version = ETHER1394_GASP_VERSION,
- 	},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
-diff -urNp linux-2.6.32.13/drivers/ieee1394/hosts.c linux-2.6.32.13/drivers/ieee1394/hosts.c
---- linux-2.6.32.13/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/hosts.c	2010-05-15 13:21:15.250965621 -0400
-@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
- }
- 
- static struct hpsb_host_driver dummy_driver = {
-+	.name =		   "dummy",
- 	.transmit_packet = dummy_transmit_packet,
- 	.devctl =	   dummy_devctl,
- 	.isoctl =	   dummy_isoctl
-diff -urNp linux-2.6.32.13/drivers/ieee1394/ohci1394.c linux-2.6.32.13/drivers/ieee1394/ohci1394.c
---- linux-2.6.32.13/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/ohci1394.c	2010-05-15 13:21:15.283282671 -0400
-@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
- printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
- 
- /* Module Parameters */
--static int phys_dma = 1;
-+static int phys_dma;
- module_param(phys_dma, int, 0444);
--MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
-+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
- 
- static void dma_trm_tasklet(unsigned long data);
- static void dma_trm_reset(struct dma_trm_ctx *d);
-@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
- 		.subvendor =	PCI_ANY_ID,
- 		.subdevice =	PCI_ANY_ID,
- 	},
--	{ 0, },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
-diff -urNp linux-2.6.32.13/drivers/ieee1394/raw1394.c linux-2.6.32.13/drivers/ieee1394/raw1394.c
---- linux-2.6.32.13/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/raw1394.c	2010-05-15 13:21:15.340016183 -0400
-@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
- 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
-diff -urNp linux-2.6.32.13/drivers/ieee1394/sbp2.c linux-2.6.32.13/drivers/ieee1394/sbp2.c
---- linux-2.6.32.13/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/sbp2.c	2010-05-15 13:21:15.374974502 -0400
-@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
- 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
- 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
- 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
--	{}
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
- 
-@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
- MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
- MODULE_LICENSE("GPL");
- 
--static int sbp2_module_init(void)
-+static int __init sbp2_module_init(void)
- {
- 	int ret;
- 
-diff -urNp linux-2.6.32.13/drivers/ieee1394/video1394.c linux-2.6.32.13/drivers/ieee1394/video1394.c
---- linux-2.6.32.13/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/ieee1394/video1394.c	2010-05-15 13:21:15.379405032 -0400
-@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
-                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
-                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
-         },
--	{ }
-+	{ 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
-diff -urNp linux-2.6.32.13/drivers/infiniband/core/cm.c linux-2.6.32.13/drivers/infiniband/core/cm.c
---- linux-2.6.32.13/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/infiniband/core/cm.c	2010-05-15 13:21:15.390974340 -0400
-@@ -112,7 +112,7 @@ static char const counter_group_names[CM
- 
- struct cm_counter_group {
- 	struct kobject obj;
--	atomic_long_t counter[CM_ATTR_COUNT];
-+	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
- };
- 
- struct cm_counter_attribute {
-@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
- 	struct ib_mad_send_buf *msg = NULL;
- 	int ret;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REQ_COUNTER]);
- 
- 	/* Quick state check to discard duplicate REQs. */
-@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
- 	if (!cm_id_priv)
- 		return;
- 
--	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 			counter[CM_REP_COUNTER]);
- 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
- 	if (ret)
-@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
- 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
- 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
- 		spin_unlock_irq(&cm_id_priv->lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_RTU_COUNTER]);
- 		goto out;
- 	}
-@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
- 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
- 				   dreq_msg->local_comm_id);
- 	if (!cm_id_priv) {
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		cm_issue_drep(work->port, work->mad_recv_wc);
- 		return -EINVAL;
-@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
- 	case IB_CM_MRA_REP_RCVD:
- 		break;
- 	case IB_CM_TIMEWAIT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_DREQ_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_DREQ_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
- 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
- 				  cm_id_priv->msg, timeout)) {
- 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
--				atomic_long_inc(&work->port->
-+				atomic_long_inc_unchecked(&work->port->
- 						counter_group[CM_RECV_DUPLICATES].
- 						counter[CM_MRA_COUNTER]);
- 			goto out;
-@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
- 		break;
- 	case IB_CM_MRA_REQ_RCVD:
- 	case IB_CM_MRA_REP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_MRA_COUNTER]);
- 		/* fall through */
- 	default:
-@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
- 	case IB_CM_LAP_IDLE:
- 		break;
- 	case IB_CM_MRA_LAP_SENT:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
- 			goto unlock;
-@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
- 			cm_free_msg(msg);
- 		goto deref;
- 	case IB_CM_LAP_RCVD:
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_LAP_COUNTER]);
- 		goto unlock;
- 	default:
-@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
- 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
- 	if (cur_cm_id_priv) {
- 		spin_unlock_irq(&cm.lock);
--		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
-+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
- 				counter[CM_SIDR_REQ_COUNTER]);
- 		goto out; /* Duplicate message. */
- 	}
-@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
- 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
- 		msg->retries = 1;
- 
--	atomic_long_add(1 + msg->retries,
-+	atomic_long_add_unchecked(1 + msg->retries,
- 			&port->counter_group[CM_XMIT].counter[attr_index]);
- 	if (msg->retries)
--		atomic_long_add(msg->retries,
-+		atomic_long_add_unchecked(msg->retries,
- 				&port->counter_group[CM_XMIT_RETRIES].
- 				counter[attr_index]);
- 
-@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
- 	}
- 
- 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
--	atomic_long_inc(&port->counter_group[CM_RECV].
-+	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
- 			counter[attr_id - CM_ATTR_ID_OFFSET]);
- 
- 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
-@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
- 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
- 
- 	return sprintf(buf, "%ld\n",
--		       atomic_long_read(&group->counter[cm_attr->index]));
-+		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
- }
- 
--static struct sysfs_ops cm_counter_ops = {
-+static const struct sysfs_ops cm_counter_ops = {
- 	.show = cm_show_counter
- };
- 
-diff -urNp linux-2.6.32.13/drivers/infiniband/core/sysfs.c linux-2.6.32.13/drivers/infiniband/core/sysfs.c
---- linux-2.6.32.13/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/infiniband/core/sysfs.c	2010-05-15 13:21:15.420653417 -0400
-@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
- 	return port_attr->show(p, port_attr, buf);
- }
- 
--static struct sysfs_ops port_sysfs_ops = {
-+static const struct sysfs_ops port_sysfs_ops = {
- 	.show = port_attr_show
- };
- 
-diff -urNp linux-2.6.32.13/drivers/input/keyboard/atkbd.c linux-2.6.32.13/drivers/input/keyboard/atkbd.c
---- linux-2.6.32.13/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/keyboard/atkbd.c	2010-05-15 13:21:15.420653417 -0400
-@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
-diff -urNp linux-2.6.32.13/drivers/input/mouse/lifebook.c linux-2.6.32.13/drivers/input/mouse/lifebook.c
---- linux-2.6.32.13/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/mouse/lifebook.c	2010-05-15 13:21:15.420653417 -0400
-@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
- 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
-diff -urNp linux-2.6.32.13/drivers/input/mouse/psmouse-base.c linux-2.6.32.13/drivers/input/mouse/psmouse-base.c
---- linux-2.6.32.13/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/mouse/psmouse-base.c	2010-05-15 13:21:15.430620618 -0400
-@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
-diff -urNp linux-2.6.32.13/drivers/input/mouse/synaptics.c linux-2.6.32.13/drivers/input/mouse/synaptics.c
---- linux-2.6.32.13/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/mouse/synaptics.c	2010-05-15 13:21:15.430620618 -0400
-@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
- 				break;
- 			case 2:
- 				if (SYN_MODEL_PEN(priv->model_id))
--					;   /* Nothing, treat a pen as a single finger */
-+					break;   /* Nothing, treat a pen as a single finger */
- 				break;
- 			case 4 ... 15:
- 				if (SYN_CAP_PALMDETECT(priv->capabilities))
-@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
- 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
- 		},
--
- 	},
- 	{
- 		.ident = "Toshiba Portege M300",
-@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
- 		},
--
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-diff -urNp linux-2.6.32.13/drivers/input/mousedev.c linux-2.6.32.13/drivers/input/mousedev.c
---- linux-2.6.32.13/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/mousedev.c	2010-05-15 13:21:15.435182881 -0400
-@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
- 
- #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
- static struct miscdevice psaux_mouse = {
--	PSMOUSE_MINOR, "psaux", &mousedev_fops
-+	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
- };
- static int psaux_registered;
- #endif
-diff -urNp linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h
---- linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.13/drivers/input/serio/i8042-x86ia64io.h	2010-05-15 13:21:15.435182881 -0400
-@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
-@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #ifdef CONFIG_PNP
-@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
-@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #endif /* CONFIG_X86 */
-diff -urNp linux-2.6.32.13/drivers/input/serio/serio_raw.c linux-2.6.32.13/drivers/input/serio/serio_raw.c
---- linux-2.6.32.13/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/input/serio/serio_raw.c	2010-05-15 13:21:15.435182881 -0400
-@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
-diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/common.c linux-2.6.32.13/drivers/isdn/gigaset/common.c
---- linux-2.6.32.13/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/isdn/gigaset/common.c	2010-05-15 13:21:15.435182881 -0400
-@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
- 	cs->commands_pending = 0;
- 	cs->cur_at_seq = 0;
- 	cs->gotfwver = -1;
--	cs->open_count = 0;
-+	atomic_set(&cs->open_count, 0);
- 	cs->dev = NULL;
- 	cs->tty = NULL;
- 	cs->tty_dev = NULL;
-diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/isdn/gigaset/gigaset.h	2010-05-15 13:21:15.435182881 -0400
-@@ -446,7 +446,7 @@ struct cardstate {
- 	spinlock_t cmdlock;
- 	unsigned curlen, cmdbytes;
- 
--	unsigned open_count;
-+	atomic_t open_count;
- 	struct tty_struct *tty;
- 	struct tasklet_struct if_wake_tasklet;
- 	unsigned control_state;
-diff -urNp linux-2.6.32.13/drivers/isdn/gigaset/interface.c linux-2.6.32.13/drivers/isdn/gigaset/interface.c
---- linux-2.6.32.13/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.13/drivers/isdn/gigaset/interface.c	2010-05-15 13:21:15.462977265 -0400
-@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
- 		return -ERESTARTSYS; // FIXME -EINTR?
- 	tty->driver_data = cs;
- 
--	++cs->open_count;
--
--	if (cs->open_count == 1) {
-+	if (atomic_inc_return(&cs->open_count) == 1) {
- 		spin_lock_irqsave(&cs->lock, flags);
- 		cs->tty = tty;
- 		spin_unlock_irqrestore(&cs->lock, flags);
-@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
--		if (!--cs->open_count) {
-+		if (!atomic_dec_return(&cs->open_count)) {
- 			spin_lock_irqsave(&cs->lock, flags);
- 			cs->tty = NULL;
- 			spin_unlock_irqrestore(&cs->lock, flags);
-@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		retval = 0;
-@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
- 	if (!cs->connected) {
- 		gig_dbg(DEBUG_IF, "not connected");
- 		retval = -ENODEV;
--	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED) {
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else if (cs->mstate != MS_LOCKED)
- 		dev_warn(cs->dev, "can't write to unlocked device\n");
-@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
- 
- 	if (!cs->connected)
- 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
--	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 	else {
- 		//FIXME
-@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
- 		goto out;
- 	}
- 
--	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
- 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
- 		goto out;
- 	}
-diff -urNp linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/isdn/hardware/avm/b1.c	2010-05-15 13:21:15.462977265 -0400
-@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (t4file->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
- 	}
- 	if (left) {
- 		if (config->user) {
--			if (copy_from_user(buf, dp, left))
-+			if (left > sizeof buf || copy_from_user(buf, dp, left))
- 				return -EFAULT;
- 		} else {
- 			memcpy(buf, dp, left);
-diff -urNp linux-2.6.32.13/drivers/isdn/icn/icn.c linux-2.6.32.13/drivers/isdn/icn/icn.c
---- linux-2.6.32.13/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/isdn/icn/icn.c	2010-05-15 13:21:15.462977265 -0400
-@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
- 		if (count > len)
- 			count = len;
- 		if (user) {
--			if (copy_from_user(msg, buf, count))
-+			if (count > sizeof msg || copy_from_user(msg, buf, count))
- 				return -EFAULT;
- 		} else
- 			memcpy(msg, buf, count);
-diff -urNp linux-2.6.32.13/drivers/lguest/core.c linux-2.6.32.13/drivers/lguest/core.c
---- linux-2.6.32.13/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/lguest/core.c	2010-05-15 13:21:15.466573931 -0400
-@@ -91,9 +91,17 @@ static __init int map_switcher(void)
- 	 * it's worked so far.  The end address needs +1 because __get_vm_area
- 	 * allocates an extra guard page, so we need space for that.
- 	 */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
-+				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
-+				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#else
- 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
- 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
- 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
-+#endif
-+
- 	if (!switcher_vma) {
- 		err = -ENOMEM;
- 		printk("lguest: could not map switcher pages high\n");
-diff -urNp linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c
---- linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/macintosh/via-pmu-backlight.c	2010-05-15 13:21:15.466573931 -0400
-@@ -15,7 +15,7 @@
- 
- #define MAX_PMU_LEVEL 0xFF
- 
--static struct backlight_ops pmu_backlight_data;
-+static const struct backlight_ops pmu_backlight_data;
- static DEFINE_SPINLOCK(pmu_backlight_lock);
- static int sleeping, uses_pmu_bl;
- static u8 bl_curve[FB_BACKLIGHT_LEVELS];
-@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops pmu_backlight_data = {
-+static const struct backlight_ops pmu_backlight_data = {
- 	.get_brightness	= pmu_backlight_get_brightness,
- 	.update_status	= pmu_backlight_update_status,
- 
-diff -urNp linux-2.6.32.13/drivers/macintosh/via-pmu.c linux-2.6.32.13/drivers/macintosh/via-pmu.c
---- linux-2.6.32.13/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/macintosh/via-pmu.c	2010-05-15 13:21:15.488292870 -0400
-@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
- 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
- }
- 
--static struct platform_suspend_ops pmu_pm_ops = {
-+static const struct platform_suspend_ops pmu_pm_ops = {
- 	.enter = powerbook_sleep,
- 	.valid = pmu_sleep_valid,
- };
-diff -urNp linux-2.6.32.13/drivers/md/bitmap.c linux-2.6.32.13/drivers/md/bitmap.c
---- linux-2.6.32.13/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/md/bitmap.c	2010-05-15 13:21:15.498921900 -0400
-@@ -58,7 +58,7 @@
- #  if DEBUG > 0
- #    define PRINTK(x...) printk(KERN_DEBUG x)
- #  else
--#    define PRINTK(x...)
-+#    define PRINTK(x...) do {} while (0)
- #  endif
- #endif
- 
-diff -urNp linux-2.6.32.13/drivers/md/dm-sysfs.c linux-2.6.32.13/drivers/md/dm-sysfs.c
---- linux-2.6.32.13/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/md/dm-sysfs.c	2010-05-15 13:21:15.498921900 -0400
-@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
- 	NULL,
- };
- 
--static struct sysfs_ops dm_sysfs_ops = {
-+static const struct sysfs_ops dm_sysfs_ops = {
- 	.show	= dm_attr_show,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/md/dm-table.c linux-2.6.32.13/drivers/md/dm-table.c
---- linux-2.6.32.13/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/md/dm-table.c	2010-05-15 13:21:15.498921900 -0400
-@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
- 	if (!dev_size)
- 		return 0;
- 
--	if ((start >= dev_size) || (start + len > dev_size)) {
-+	if ((start >= dev_size) || (len > dev_size - start)) {
- 		DMWARN("%s: %s too small for target: "
- 		       "start=%llu, len=%llu, dev_size=%llu",
- 		       dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.32.13/drivers/md/md.c linux-2.6.32.13/drivers/md/md.c
---- linux-2.6.32.13/drivers/md/md.c	2010-05-15 13:20:18.542567696 -0400
-+++ linux-2.6.32.13/drivers/md/md.c	2010-05-15 13:21:15.498921900 -0400
-@@ -2514,7 +2514,7 @@ static void rdev_free(struct kobject *ko
- 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
- 	kfree(rdev);
- }
--static struct sysfs_ops rdev_sysfs_ops = {
-+static const struct sysfs_ops rdev_sysfs_ops = {
- 	.show		= rdev_attr_show,
- 	.store		= rdev_attr_store,
- };
-@@ -3884,7 +3884,7 @@ static void md_free(struct kobject *ko)
- 	kfree(mddev);
- }
- 
--static struct sysfs_ops md_sysfs_ops = {
-+static const struct sysfs_ops md_sysfs_ops = {
- 	.show	= md_attr_show,
- 	.store	= md_attr_store,
- };
-@@ -6010,7 +6010,7 @@ static int md_seq_show(struct seq_file *
- 				chunk_kb ? "KB" : "B");
- 			if (bitmap->file) {
- 				seq_printf(seq, ", file: ");
--				seq_path(seq, &bitmap->file->f_path, " \t\n");
-+				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
- 			}
- 
- 			seq_printf(seq, "\n");
-@@ -6104,7 +6104,7 @@ static int is_mddev_idle(mddev_t *mddev,
- 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
- 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
- 			      (int)part_stat_read(&disk->part0, sectors[1]) -
--			      atomic_read(&disk->sync_io);
-+			      atomic_read_unchecked(&disk->sync_io);
- 		/* sync IO will cause sync_io to increase before the disk_stats
- 		 * as sync_io is counted when a request starts, and
- 		 * disk_stats is counted when it completes.
-diff -urNp linux-2.6.32.13/drivers/md/md.h linux-2.6.32.13/drivers/md/md.h
---- linux-2.6.32.13/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/md/md.h	2010-05-15 13:21:15.507356136 -0400
-@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
- 
- static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
- {
--        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
-+	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
- }
- 
- struct mdk_personality
-diff -urNp linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/media/dvb/dvb-core/dvbdev.c	2010-05-15 13:21:15.510998118 -0400
-@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
- 			const struct dvb_device *template, void *priv, int type)
- {
- 	struct dvb_device *dvbdev;
-+	/* cannot be const */
- 	struct file_operations *dvbdevfops;
- 	struct device *clsdev;
- 	int minor;
-diff -urNp linux-2.6.32.13/drivers/media/radio/radio-cadet.c linux-2.6.32.13/drivers/media/radio/radio-cadet.c
---- linux-2.6.32.13/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/media/radio/radio-cadet.c	2010-05-15 13:21:15.510998118 -0400
-@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
- 	while (i < count && dev->rdsin != dev->rdsout)
- 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
- 
--	if (copy_to_user(data, readbuf, i))
-+	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
- 		return -EFAULT;
- 	return i;
- }
-diff -urNp linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c
---- linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/media/video/usbvideo/konicawc.c	2010-05-15 13:21:15.526921305 -0400
-@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c
---- linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/media/video/usbvideo/quickcam_messenger.c	2010-05-15 13:21:15.526921305 -0400
-@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
- 	int error;
- 
- 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
--	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
-+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
- 
- 	cam->input = input_dev = input_allocate_device();
- 	if (!input_dev) {
-diff -urNp linux-2.6.32.13/drivers/message/fusion/mptdebug.h linux-2.6.32.13/drivers/message/fusion/mptdebug.h
---- linux-2.6.32.13/drivers/message/fusion/mptdebug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/message/fusion/mptdebug.h	2010-05-15 13:21:15.526921305 -0400
-@@ -71,7 +71,7 @@
- 		CMD;						\
- }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif
- 
- 
-diff -urNp linux-2.6.32.13/drivers/message/fusion/mptsas.c linux-2.6.32.13/drivers/message/fusion/mptsas.c
---- linux-2.6.32.13/drivers/message/fusion/mptsas.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/message/fusion/mptsas.c	2010-05-15 13:21:15.526921305 -0400
-@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
- 		return 0;
- }
- 
-+static inline void
-+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-+{
-+	if (phy_info->port_details) {
-+		phy_info->port_details->rphy = rphy;
-+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-+		    ioc->name, rphy));
-+	}
-+
-+	if (rphy) {
-+		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-+		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-+		    ioc->name, rphy, rphy->dev.release));
-+	}
-+}
-+
- /* no mutex */
- static void
- mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
-@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
- 		return NULL;
- }
- 
--static inline void
--mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
--{
--	if (phy_info->port_details) {
--		phy_info->port_details->rphy = rphy;
--		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
--		    ioc->name, rphy));
--	}
--
--	if (rphy) {
--		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
--		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
--		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
--		    ioc->name, rphy, rphy->dev.release));
--	}
--}
--
- static inline struct sas_port *
- mptsas_get_port(struct mptsas_phyinfo *phy_info)
- {
-diff -urNp linux-2.6.32.13/drivers/message/i2o/i2o_proc.c linux-2.6.32.13/drivers/message/i2o/i2o_proc.c
---- linux-2.6.32.13/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/message/i2o/i2o_proc.c	2010-05-15 13:21:15.526921305 -0400
-@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
- 	"Array Controller Device"
- };
- 
--static char *chtostr(u8 * chars, int n)
--{
--	char tmp[256];
--	tmp[0] = 0;
--	return strncat(tmp, (char *)chars, n);
--}
--
- static int i2o_report_query_status(struct seq_file *seq, int block_status,
- 				   char *group)
- {
-@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
- 
- 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", ddm_table.module_id);
--		seq_printf(seq, "%-29s",
--			   chtostr(ddm_table.module_name_version, 28));
-+		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
- 		seq_printf(seq, "%9d  ", ddm_table.data_size);
- 		seq_printf(seq, "%8d", ddm_table.code_size);
- 
-@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
- 
- 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
- 		seq_printf(seq, "%-#8x", dst->module_id);
--		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
--		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
-+		seq_printf(seq, "%-.28s", dst->module_name_version);
-+		seq_printf(seq, "%-.8s", dst->date);
- 		seq_printf(seq, "%8d ", dst->module_size);
- 		seq_printf(seq, "%8d ", dst->mpb_size);
- 		seq_printf(seq, "0x%04x", dst->module_flags);
-@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
- 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
- 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
- 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
--	seq_printf(seq, "Vendor info   : %s\n",
--		   chtostr((u8 *) (work32 + 2), 16));
--	seq_printf(seq, "Product info  : %s\n",
--		   chtostr((u8 *) (work32 + 6), 16));
--	seq_printf(seq, "Description   : %s\n",
--		   chtostr((u8 *) (work32 + 10), 16));
--	seq_printf(seq, "Product rev.  : %s\n",
--		   chtostr((u8 *) (work32 + 14), 8));
-+	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
-+	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
-+	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
-+	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
- 
- 	seq_printf(seq, "Serial number : ");
- 	print_serial_number(seq, (u8 *) (work32 + 16),
-@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
- 	}
- 
- 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
--	seq_printf(seq, "Module name         : %s\n",
--		   chtostr(result.module_name, 24));
--	seq_printf(seq, "Module revision     : %s\n",
--		   chtostr(result.module_rev, 8));
-+	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
-+	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
- 
- 	seq_printf(seq, "Serial number       : ");
- 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
-@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
- 		return 0;
- 	}
- 
--	seq_printf(seq, "Device name     : %s\n",
--		   chtostr(result.device_name, 64));
--	seq_printf(seq, "Service name    : %s\n",
--		   chtostr(result.service_name, 64));
--	seq_printf(seq, "Physical name   : %s\n",
--		   chtostr(result.physical_location, 64));
--	seq_printf(seq, "Instance number : %s\n",
--		   chtostr(result.instance_number, 4));
-+	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
-+	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
-+	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
-+	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/drivers/misc/kgdbts.c linux-2.6.32.13/drivers/misc/kgdbts.c
---- linux-2.6.32.13/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/misc/kgdbts.c	2010-05-15 13:21:15.554995461 -0400
-@@ -118,7 +118,7 @@
- 	} while (0)
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io kgdbts_io_ops;
-+static const struct kgdb_io kgdbts_io_ops;
- static char get_buf[BUFMAX];
- static int get_buf_cnt;
- static char put_buf[BUFMAX];
-@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdbts_io_ops = {
-+static const struct kgdb_io kgdbts_io_ops = {
- 	.name			= "kgdbts",
- 	.read_char		= kgdbts_get_char,
- 	.write_char		= kgdbts_put_char,
-diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/misc/sgi-gru/gruhandles.c	2010-05-15 13:21:15.554995461 -0400
-@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
- 
- static void update_mcs_stats(enum mcs_op op, unsigned long clks)
- {
--	atomic_long_inc(&mcs_op_statistics[op].count);
--	atomic_long_add(clks, &mcs_op_statistics[op].total);
-+	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
-+	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
- 	if (mcs_op_statistics[op].max < clks)
- 		mcs_op_statistics[op].max = clks;
- }
-diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/misc/sgi-gru/gruprocfs.c	2010-05-15 13:21:15.554995461 -0400
-@@ -32,9 +32,9 @@
- 
- #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
- 
--static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
-+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
- {
--	unsigned long val = atomic_long_read(v);
-+	unsigned long val = atomic_long_read_unchecked(v);
- 
- 	if (val)
- 		seq_printf(s, "%16lu %s\n", val, id);
-@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
- 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
- 
- 	for (op = 0; op < mcsop_last; op++) {
--		count = atomic_long_read(&mcs_op_statistics[op].count);
--		total = atomic_long_read(&mcs_op_statistics[op].total);
-+		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
-+		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
- 		max = mcs_op_statistics[op].max;
- 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
- 			   count ? total / count : 0, max);
-diff -urNp linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/misc/sgi-gru/grutables.h	2010-05-15 13:21:15.554995461 -0400
-@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
-  * GRU statistics.
-  */
- struct gru_stats_s {
--	atomic_long_t vdata_alloc;
--	atomic_long_t vdata_free;
--	atomic_long_t gts_alloc;
--	atomic_long_t gts_free;
--	atomic_long_t vdata_double_alloc;
--	atomic_long_t gts_double_allocate;
--	atomic_long_t assign_context;
--	atomic_long_t assign_context_failed;
--	atomic_long_t free_context;
--	atomic_long_t load_user_context;
--	atomic_long_t load_kernel_context;
--	atomic_long_t lock_kernel_context;
--	atomic_long_t unlock_kernel_context;
--	atomic_long_t steal_user_context;
--	atomic_long_t steal_kernel_context;
--	atomic_long_t steal_context_failed;
--	atomic_long_t nopfn;
--	atomic_long_t break_cow;
--	atomic_long_t asid_new;
--	atomic_long_t asid_next;
--	atomic_long_t asid_wrap;
--	atomic_long_t asid_reuse;
--	atomic_long_t intr;
--	atomic_long_t intr_mm_lock_failed;
--	atomic_long_t call_os;
--	atomic_long_t call_os_offnode_reference;
--	atomic_long_t call_os_check_for_bug;
--	atomic_long_t call_os_wait_queue;
--	atomic_long_t user_flush_tlb;
--	atomic_long_t user_unload_context;
--	atomic_long_t user_exception;
--	atomic_long_t set_context_option;
--	atomic_long_t migrate_check;
--	atomic_long_t migrated_retarget;
--	atomic_long_t migrated_unload;
--	atomic_long_t migrated_unload_delay;
--	atomic_long_t migrated_nopfn_retarget;
--	atomic_long_t migrated_nopfn_unload;
--	atomic_long_t tlb_dropin;
--	atomic_long_t tlb_dropin_fail_no_asid;
--	atomic_long_t tlb_dropin_fail_upm;
--	atomic_long_t tlb_dropin_fail_invalid;
--	atomic_long_t tlb_dropin_fail_range_active;
--	atomic_long_t tlb_dropin_fail_idle;
--	atomic_long_t tlb_dropin_fail_fmm;
--	atomic_long_t tlb_dropin_fail_no_exception;
--	atomic_long_t tlb_dropin_fail_no_exception_war;
--	atomic_long_t tfh_stale_on_fault;
--	atomic_long_t mmu_invalidate_range;
--	atomic_long_t mmu_invalidate_page;
--	atomic_long_t mmu_clear_flush_young;
--	atomic_long_t flush_tlb;
--	atomic_long_t flush_tlb_gru;
--	atomic_long_t flush_tlb_gru_tgh;
--	atomic_long_t flush_tlb_gru_zero_asid;
--
--	atomic_long_t copy_gpa;
--
--	atomic_long_t mesq_receive;
--	atomic_long_t mesq_receive_none;
--	atomic_long_t mesq_send;
--	atomic_long_t mesq_send_failed;
--	atomic_long_t mesq_noop;
--	atomic_long_t mesq_send_unexpected_error;
--	atomic_long_t mesq_send_lb_overflow;
--	atomic_long_t mesq_send_qlimit_reached;
--	atomic_long_t mesq_send_amo_nacked;
--	atomic_long_t mesq_send_put_nacked;
--	atomic_long_t mesq_qf_not_full;
--	atomic_long_t mesq_qf_locked;
--	atomic_long_t mesq_qf_noop_not_full;
--	atomic_long_t mesq_qf_switch_head_failed;
--	atomic_long_t mesq_qf_unexpected_error;
--	atomic_long_t mesq_noop_unexpected_error;
--	atomic_long_t mesq_noop_lb_overflow;
--	atomic_long_t mesq_noop_qlimit_reached;
--	atomic_long_t mesq_noop_amo_nacked;
--	atomic_long_t mesq_noop_put_nacked;
-+	atomic_long_unchecked_t vdata_alloc;
-+	atomic_long_unchecked_t vdata_free;
-+	atomic_long_unchecked_t gts_alloc;
-+	atomic_long_unchecked_t gts_free;
-+	atomic_long_unchecked_t vdata_double_alloc;
-+	atomic_long_unchecked_t gts_double_allocate;
-+	atomic_long_unchecked_t assign_context;
-+	atomic_long_unchecked_t assign_context_failed;
-+	atomic_long_unchecked_t free_context;
-+	atomic_long_unchecked_t load_user_context;
-+	atomic_long_unchecked_t load_kernel_context;
-+	atomic_long_unchecked_t lock_kernel_context;
-+	atomic_long_unchecked_t unlock_kernel_context;
-+	atomic_long_unchecked_t steal_user_context;
-+	atomic_long_unchecked_t steal_kernel_context;
-+	atomic_long_unchecked_t steal_context_failed;
-+	atomic_long_unchecked_t nopfn;
-+	atomic_long_unchecked_t break_cow;
-+	atomic_long_unchecked_t asid_new;
-+	atomic_long_unchecked_t asid_next;
-+	atomic_long_unchecked_t asid_wrap;
-+	atomic_long_unchecked_t asid_reuse;
-+	atomic_long_unchecked_t intr;
-+	atomic_long_unchecked_t intr_mm_lock_failed;
-+	atomic_long_unchecked_t call_os;
-+	atomic_long_unchecked_t call_os_offnode_reference;
-+	atomic_long_unchecked_t call_os_check_for_bug;
-+	atomic_long_unchecked_t call_os_wait_queue;
-+	atomic_long_unchecked_t user_flush_tlb;
-+	atomic_long_unchecked_t user_unload_context;
-+	atomic_long_unchecked_t user_exception;
-+	atomic_long_unchecked_t set_context_option;
-+	atomic_long_unchecked_t migrate_check;
-+	atomic_long_unchecked_t migrated_retarget;
-+	atomic_long_unchecked_t migrated_unload;
-+	atomic_long_unchecked_t migrated_unload_delay;
-+	atomic_long_unchecked_t migrated_nopfn_retarget;
-+	atomic_long_unchecked_t migrated_nopfn_unload;
-+	atomic_long_unchecked_t tlb_dropin;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
-+	atomic_long_unchecked_t tlb_dropin_fail_upm;
-+	atomic_long_unchecked_t tlb_dropin_fail_invalid;
-+	atomic_long_unchecked_t tlb_dropin_fail_range_active;
-+	atomic_long_unchecked_t tlb_dropin_fail_idle;
-+	atomic_long_unchecked_t tlb_dropin_fail_fmm;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
-+	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
-+	atomic_long_unchecked_t tfh_stale_on_fault;
-+	atomic_long_unchecked_t mmu_invalidate_range;
-+	atomic_long_unchecked_t mmu_invalidate_page;
-+	atomic_long_unchecked_t mmu_clear_flush_young;
-+	atomic_long_unchecked_t flush_tlb;
-+	atomic_long_unchecked_t flush_tlb_gru;
-+	atomic_long_unchecked_t flush_tlb_gru_tgh;
-+	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
-+
-+	atomic_long_unchecked_t copy_gpa;
-+
-+	atomic_long_unchecked_t mesq_receive;
-+	atomic_long_unchecked_t mesq_receive_none;
-+	atomic_long_unchecked_t mesq_send;
-+	atomic_long_unchecked_t mesq_send_failed;
-+	atomic_long_unchecked_t mesq_noop;
-+	atomic_long_unchecked_t mesq_send_unexpected_error;
-+	atomic_long_unchecked_t mesq_send_lb_overflow;
-+	atomic_long_unchecked_t mesq_send_qlimit_reached;
-+	atomic_long_unchecked_t mesq_send_amo_nacked;
-+	atomic_long_unchecked_t mesq_send_put_nacked;
-+	atomic_long_unchecked_t mesq_qf_not_full;
-+	atomic_long_unchecked_t mesq_qf_locked;
-+	atomic_long_unchecked_t mesq_qf_noop_not_full;
-+	atomic_long_unchecked_t mesq_qf_switch_head_failed;
-+	atomic_long_unchecked_t mesq_qf_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_unexpected_error;
-+	atomic_long_unchecked_t mesq_noop_lb_overflow;
-+	atomic_long_unchecked_t mesq_noop_qlimit_reached;
-+	atomic_long_unchecked_t mesq_noop_amo_nacked;
-+	atomic_long_unchecked_t mesq_noop_put_nacked;
- 
- };
- 
-@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
- 	cchop_deallocate, tghop_invalidate, mcsop_last};
- 
- struct mcs_op_statistic {
--	atomic_long_t	count;
--	atomic_long_t	total;
-+	atomic_long_unchecked_t	count;
-+	atomic_long_unchecked_t	total;
- 	unsigned long	max;
- };
- 
-@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
- 
- #define STAT(id)	do {						\
- 				if (gru_options & OPT_STATS)		\
--					atomic_long_inc(&gru_stats.id);	\
-+					atomic_long_inc_unchecked(&gru_stats.id);	\
- 			} while (0)
- 
- #ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.32.13/drivers/mtd/devices/doc2000.c linux-2.6.32.13/drivers/mtd/devices/doc2000.c
---- linux-2.6.32.13/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/mtd/devices/doc2000.c	2010-05-15 13:21:15.563050037 -0400
-@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
- 
- 		/* The ECC will not be calculated correctly if less than 512 is written */
- /* DBB-
--		if (len != 0x200 && eccbuf)
-+		if (len != 0x200)
- 			printk(KERN_WARNING
- 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
- 			       (long) to, (long) len);
-diff -urNp linux-2.6.32.13/drivers/mtd/devices/doc2001.c linux-2.6.32.13/drivers/mtd/devices/doc2001.c
---- linux-2.6.32.13/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/mtd/devices/doc2001.c	2010-05-15 13:21:15.563050037 -0400
-@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
- 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
- 
- 	/* Don't allow read past end of device */
--	if (from >= this->totlen)
-+	if (from >= this->totlen || !len)
- 		return -EINVAL;
- 
- 	/* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.32.13/drivers/mtd/ubi/build.c linux-2.6.32.13/drivers/mtd/ubi/build.c
---- linux-2.6.32.13/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/mtd/ubi/build.c	2010-05-15 13:21:15.566632432 -0400
-@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
- static int __init bytes_str_to_int(const char *str)
- {
- 	char *endp;
--	unsigned long result;
-+	unsigned long result, scale = 1;
- 
- 	result = simple_strtoul(str, &endp, 0);
- 	if (str == endp || result >= INT_MAX) {
-@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
- 
- 	switch (*endp) {
- 	case 'G':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'M':
--		result *= 1024;
-+		scale *= 1024;
- 	case 'K':
--		result *= 1024;
-+		scale *= 1024;
- 		if (endp[1] == 'i' && endp[2] == 'B')
- 			endp += 2;
- 	case '\0':
-@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
- 		return -EINVAL;
- 	}
- 
--	return result;
-+	if ((intoverflow_t)result*scale >= INT_MAX) {
-+		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
-+		       str);
-+		return -EINVAL;
-+	}
-+
-+	return result*scale;
- }
- 
- /**
-diff -urNp linux-2.6.32.13/drivers/net/e1000e/82571.c linux-2.6.32.13/drivers/net/e1000e/82571.c
---- linux-2.6.32.13/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/e1000e/82571.c	2010-05-15 13:21:15.586662276 -0400
-@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 	u32 swsm = 0;
- 	u32 swsm2 = 0;
-@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations e82571_mac_ops = {
-+static const struct e1000_mac_operations e82571_mac_ops = {
- 	/* .check_mng_mode: mac type dependent */
- 	/* .check_for_link: media type dependent */
- 	.id_led_init		= e1000e_id_led_init,
-@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_igp = {
-+static const struct e1000_phy_operations e82_phy_ops_igp = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= NULL,
-@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_m88 = {
-+static const struct e1000_phy_operations e82_phy_ops_m88 = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_phy_operations e82_phy_ops_bm = {
-+static const struct e1000_phy_operations e82_phy_ops_bm = {
- 	.acquire_phy		= e1000_get_hw_semaphore_82571,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy		= e1000e_phy_sw_reset,
-@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
- 	.cfg_on_link_up      	= NULL,
- };
- 
--static struct e1000_nvm_operations e82571_nvm_ops = {
-+static const struct e1000_nvm_operations e82571_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_82571,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_82571,
-diff -urNp linux-2.6.32.13/drivers/net/e1000e/e1000.h linux-2.6.32.13/drivers/net/e1000e/e1000.h
---- linux-2.6.32.13/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/e1000e/e1000.h	2010-05-15 13:21:15.586662276 -0400
-@@ -375,9 +375,9 @@ struct e1000_info {
- 	u32			pba;
- 	u32			max_hw_frame_size;
- 	s32			(*get_variants)(struct e1000_adapter *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- /* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.32.13/drivers/net/e1000e/es2lan.c linux-2.6.32.13/drivers/net/e1000e/es2lan.c
---- linux-2.6.32.13/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/e1000e/es2lan.c	2010-05-15 13:21:15.611440944 -0400
-@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
- {
- 	struct e1000_hw *hw = &adapter->hw;
- 	struct e1000_mac_info *mac = &hw->mac;
-+	/* cannot be const */
- 	struct e1000_mac_operations *func = &mac->ops;
- 
- 	/* Set media type */
-@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
- 	temp = er32(ICRXDMTC);
- }
- 
--static struct e1000_mac_operations es2_mac_ops = {
-+static const struct e1000_mac_operations es2_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000e_check_mng_mode_generic,
- 	/* check_for_link dependent on media type */
-@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
- 	.setup_led		= e1000e_setup_led_generic,
- };
- 
--static struct e1000_phy_operations es2_phy_ops = {
-+static const struct e1000_phy_operations es2_phy_ops = {
- 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
- 	.check_reset_block	= e1000e_check_reset_block_generic,
- 	.commit_phy	 	= e1000e_phy_sw_reset,
-@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
- 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
- };
- 
--static struct e1000_nvm_operations es2_nvm_ops = {
-+static const struct e1000_nvm_operations es2_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
- 	.read_nvm		= e1000e_read_nvm_eerd,
- 	.release_nvm		= e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.32.13/drivers/net/e1000e/hw.h linux-2.6.32.13/drivers/net/e1000e/hw.h
---- linux-2.6.32.13/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
-+++ linux-2.6.32.13/drivers/net/e1000e/hw.h	2010-05-15 13:21:15.627454440 -0400
-@@ -756,34 +756,34 @@ struct e1000_mac_operations {
- 
- /* Function pointers for the PHY. */
- struct e1000_phy_operations {
--	s32  (*acquire_phy)(struct e1000_hw *);
--	s32  (*check_polarity)(struct e1000_hw *);
--	s32  (*check_reset_block)(struct e1000_hw *);
--	s32  (*commit_phy)(struct e1000_hw *);
--	s32  (*force_speed_duplex)(struct e1000_hw *);
--	s32  (*get_cfg_done)(struct e1000_hw *hw);
--	s32  (*get_cable_length)(struct e1000_hw *);
--	s32  (*get_phy_info)(struct e1000_hw *);
--	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
--	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
--	void (*release_phy)(struct e1000_hw *);
--	s32  (*reset_phy)(struct e1000_hw *);
--	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
--	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
--	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
--	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
--	s32  (*cfg_on_link_up)(struct e1000_hw *);
-+	s32  (* acquire_phy)(struct e1000_hw *);
-+	s32  (* check_polarity)(struct e1000_hw *);
-+	s32  (* check_reset_block)(struct e1000_hw *);
-+	s32  (* commit_phy)(struct e1000_hw *);
-+	s32  (* force_speed_duplex)(struct e1000_hw *);
-+	s32  (* get_cfg_done)(struct e1000_hw *hw);
-+	s32  (* get_cable_length)(struct e1000_hw *);
-+	s32  (* get_phy_info)(struct e1000_hw *);
-+	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
-+	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-+	void (* release_phy)(struct e1000_hw *);
-+	s32  (* reset_phy)(struct e1000_hw *);
-+	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
-+	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
-+	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-+	s32  (* cfg_on_link_up)(struct e1000_hw *);
- };
- 
- /* Function pointers for the NVM. */
- struct e1000_nvm_operations {
--	s32  (*acquire_nvm)(struct e1000_hw *);
--	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release_nvm)(struct e1000_hw *);
--	s32  (*update_nvm)(struct e1000_hw *);
--	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
--	s32  (*validate_nvm)(struct e1000_hw *);
--	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire_nvm)(struct e1000_hw *);
-+	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release_nvm)(struct e1000_hw *);
-+	s32  (* const update_nvm)(struct e1000_hw *);
-+	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
-+	s32  (* const validate_nvm)(struct e1000_hw *);
-+	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_mac_info {
-diff -urNp linux-2.6.32.13/drivers/net/e1000e/ich8lan.c linux-2.6.32.13/drivers/net/e1000e/ich8lan.c
---- linux-2.6.32.13/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
-+++ linux-2.6.32.13/drivers/net/e1000e/ich8lan.c	2010-05-15 13:21:15.627454440 -0400
-@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
- 	}
- }
- 
--static struct e1000_mac_operations ich8_mac_ops = {
-+static const struct e1000_mac_operations ich8_mac_ops = {
- 	.id_led_init		= e1000e_id_led_init,
- 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
- 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
-@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
- 	/* id_led_init dependent on mac type */
- };
- 
--static struct e1000_phy_operations ich8_phy_ops = {
-+static const struct e1000_phy_operations ich8_phy_ops = {
- 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
- 	.check_reset_block	= e1000_check_reset_block_ich8lan,
- 	.commit_phy		= NULL,
-@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
- 	.write_phy_reg		= e1000e_write_phy_reg_igp,
- };
- 
--static struct e1000_nvm_operations ich8_nvm_ops = {
-+static const struct e1000_nvm_operations ich8_nvm_ops = {
- 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
- 	.read_nvm	 	= e1000_read_nvm_ich8lan,
- 	.release_nvm		= e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.32.13/drivers/net/ibmveth.c linux-2.6.32.13/drivers/net/ibmveth.c
---- linux-2.6.32.13/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/ibmveth.c	2010-05-15 13:21:15.630621605 -0400
-@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
- 	NULL,
- };
- 
--static struct sysfs_ops veth_pool_ops = {
-+static const struct sysfs_ops veth_pool_ops = {
- 	.show   = veth_pool_show,
- 	.store  = veth_pool_store,
- };
-diff -urNp linux-2.6.32.13/drivers/net/igb/e1000_82575.c linux-2.6.32.13/drivers/net/igb/e1000_82575.c
---- linux-2.6.32.13/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:38.085476187 -0400
-+++ linux-2.6.32.13/drivers/net/igb/e1000_82575.c	2010-05-15 13:21:15.646981498 -0400
-@@ -1401,7 +1401,7 @@ void igb_vmdq_set_replication_pf(struct 
- 	wr32(E1000_VT_CTL, vt_ctl);
- }
- 
--static struct e1000_mac_operations e1000_mac_ops_82575 = {
-+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
- 	.reset_hw             = igb_reset_hw_82575,
- 	.init_hw              = igb_init_hw_82575,
- 	.check_for_link       = igb_check_for_link_82575,
-@@ -1410,13 +1410,13 @@ static struct e1000_mac_operations e1000
- 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
- };
- 
--static struct e1000_phy_operations e1000_phy_ops_82575 = {
-+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
- 	.acquire              = igb_acquire_phy_82575,
- 	.get_cfg_done         = igb_get_cfg_done_82575,
- 	.release              = igb_release_phy_82575,
- };
- 
--static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
-+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
- 	.acquire              = igb_acquire_nvm_82575,
- 	.read                 = igb_read_nvm_eerd,
- 	.release              = igb_release_nvm_82575,
-diff -urNp linux-2.6.32.13/drivers/net/igb/e1000_hw.h linux-2.6.32.13/drivers/net/igb/e1000_hw.h
---- linux-2.6.32.13/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:38.085476187 -0400
-+++ linux-2.6.32.13/drivers/net/igb/e1000_hw.h	2010-05-15 13:21:15.646981498 -0400
-@@ -303,17 +303,17 @@ struct e1000_phy_operations {
- };
- 
- struct e1000_nvm_operations {
--	s32  (*acquire)(struct e1000_hw *);
--	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
--	void (*release)(struct e1000_hw *);
--	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
-+	s32  (* const acquire)(struct e1000_hw *);
-+	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
-+	void (* const release)(struct e1000_hw *);
-+	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
- };
- 
- struct e1000_info {
- 	s32 (*get_invariants)(struct e1000_hw *);
--	struct e1000_mac_operations *mac_ops;
--	struct e1000_phy_operations *phy_ops;
--	struct e1000_nvm_operations *nvm_ops;
-+	const struct e1000_mac_operations *mac_ops;
-+	const struct e1000_phy_operations *phy_ops;
-+	const struct e1000_nvm_operations *nvm_ops;
- };
- 
- extern const struct e1000_info e1000_82575_info;
-diff -urNp linux-2.6.32.13/drivers/net/irda/vlsi_ir.c linux-2.6.32.13/drivers/net/irda/vlsi_ir.c
---- linux-2.6.32.13/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/irda/vlsi_ir.c	2010-05-15 13:21:15.650979196 -0400
-@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
- 			/* no race - tx-ring already empty */
- 			vlsi_set_baud(idev, iobase);
- 			netif_wake_queue(ndev);
--		}
--		else
--			;
-+		} else {
- 			/* keep the speed change pending like it would
- 			 * for any len>0 packet. tx completion interrupt
- 			 * will apply it when the tx ring becomes empty.
- 			 */
-+		}
- 		spin_unlock_irqrestore(&idev->lock, flags);
- 		dev_kfree_skb_any(skb);
- 		return NETDEV_TX_OK;
-diff -urNp linux-2.6.32.13/drivers/net/iseries_veth.c linux-2.6.32.13/drivers/net/iseries_veth.c
---- linux-2.6.32.13/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/iseries_veth.c	2010-05-15 13:21:15.675080517 -0400
-@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
- 	NULL
- };
- 
--static struct sysfs_ops veth_cnx_sysfs_ops = {
-+static const struct sysfs_ops veth_cnx_sysfs_ops = {
- 		.show = veth_cnx_attribute_show
- };
- 
-@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
- 	NULL
- };
- 
--static struct sysfs_ops veth_port_sysfs_ops = {
-+static const struct sysfs_ops veth_port_sysfs_ops = {
- 	.show = veth_port_attribute_show
- };
- 
-diff -urNp linux-2.6.32.13/drivers/net/pcnet32.c linux-2.6.32.13/drivers/net/pcnet32.c
---- linux-2.6.32.13/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/pcnet32.c	2010-05-15 13:21:15.695242570 -0400
-@@ -79,7 +79,7 @@ static int cards_found;
- /*
-  * VLB I/O addresses
-  */
--static unsigned int pcnet32_portlist[] __initdata =
-+static unsigned int pcnet32_portlist[] __devinitdata =
-     { 0x300, 0x320, 0x340, 0x360, 0 };
- 
- static int pcnet32_debug = 0;
-diff -urNp linux-2.6.32.13/drivers/net/tg3.h linux-2.6.32.13/drivers/net/tg3.h
---- linux-2.6.32.13/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
-+++ linux-2.6.32.13/drivers/net/tg3.h	2010-05-15 13:21:15.715816686 -0400
-@@ -95,6 +95,7 @@
- #define  CHIPREV_ID_5750_A0		 0x4000
- #define  CHIPREV_ID_5750_A1		 0x4001
- #define  CHIPREV_ID_5750_A3		 0x4003
-+#define  CHIPREV_ID_5750_C1		 0x4201
- #define  CHIPREV_ID_5750_C2		 0x4202
- #define  CHIPREV_ID_5752_A0_HW		 0x5000
- #define  CHIPREV_ID_5752_A0		 0x6000
-diff -urNp linux-2.6.32.13/drivers/net/tulip/de4x5.c linux-2.6.32.13/drivers/net/tulip/de4x5.c
---- linux-2.6.32.13/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/tulip/de4x5.c	2010-05-15 13:21:15.731971640 -0400
-@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	for (i=0; i<ETH_ALEN; i++) {
- 	    tmp.addr[i] = dev->dev_addr[i];
- 	}
--	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
-+	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
- 	break;
- 
-     case DE4X5_SET_HWADDR:           /* Set the hardware address */
-@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
- 	spin_lock_irqsave(&lp->lock, flags);
- 	memcpy(&statbuf, &lp->pktStats, ioc->len);
- 	spin_unlock_irqrestore(&lp->lock, flags);
--	if (copy_to_user(ioc->data, &statbuf, ioc->len))
-+	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
- 		return -EFAULT;
- 	break;
-     }
-diff -urNp linux-2.6.32.13/drivers/net/usb/hso.c linux-2.6.32.13/drivers/net/usb/hso.c
---- linux-2.6.32.13/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/usb/hso.c	2010-05-15 13:21:15.731971640 -0400
-@@ -258,7 +258,7 @@ struct hso_serial {
- 
- 	/* from usb_serial_port */
- 	struct tty_struct *tty;
--	int open_count;
-+	atomic_t open_count;
- 	spinlock_t serial_lock;
- 
- 	int (*write_data) (struct hso_serial *serial);
-@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
- 	struct urb *urb;
- 
- 	urb = serial->rx_urb[0];
--	if (serial->open_count > 0) {
-+	if (atomic_read(&serial->open_count) > 0) {
- 		count = put_rxbuf_data(urb, serial);
- 		if (count == -1)
- 			return;
-@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
- 	DUMP1(urb->transfer_buffer, urb->actual_length);
- 
- 	/* Anyone listening? */
--	if (serial->open_count == 0)
-+	if (atomic_read(&serial->open_count) == 0)
- 		return;
- 
- 	if (status == 0) {
-@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
- 	spin_unlock_irq(&serial->serial_lock);
- 
- 	/* check for port already opened, if not set the termios */
--	serial->open_count++;
--	if (serial->open_count == 1) {
-+	if (atomic_inc_return(&serial->open_count) == 1) {
- 		tty->low_latency = 1;
- 		serial->rx_state = RX_IDLE;
- 		/* Force default termio settings */
-@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
- 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
- 		if (result) {
- 			hso_stop_serial_device(serial->parent);
--			serial->open_count--;
-+			atomic_dec(&serial->open_count);
- 			kref_put(&serial->parent->ref, hso_serial_ref_free);
- 		}
- 	} else {
-@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
- 
- 	/* reset the rts and dtr */
- 	/* do the actual close */
--	serial->open_count--;
-+	atomic_dec(&serial->open_count);
- 
--	if (serial->open_count <= 0) {
--		serial->open_count = 0;
-+	if (atomic_read(&serial->open_count) <= 0) {
-+		atomic_set(&serial->open_count,  0);
- 		spin_lock_irq(&serial->serial_lock);
- 		if (serial->tty == tty) {
- 			serial->tty->driver_data = NULL;
-@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
- 
- 	/* the actual setup */
- 	spin_lock_irqsave(&serial->serial_lock, flags);
--	if (serial->open_count)
-+	if (atomic_read(&serial->open_count))
- 		_hso_serial_set_termios(tty, old);
- 	else
- 		tty->termios = old;
-@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
- 	/* Start all serial ports */
- 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
- 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
--			if (dev2ser(serial_table[i])->open_count) {
-+			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
- 				result =
- 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
- 				hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/b43/debugfs.c	2010-05-15 13:21:15.742991879 -0400
-@@ -43,7 +43,7 @@ static struct dentry *rootdir;
- struct b43_debugfs_fops {
- 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
- 	size_t file_struct_offset;
- };
-diff -urNp linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/b43legacy/debugfs.c	2010-05-15 13:21:15.742991879 -0400
-@@ -44,7 +44,7 @@ static struct dentry *rootdir;
- struct b43legacy_debugfs_fops {
- 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
- 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
--	struct file_operations fops;
-+	const struct file_operations fops;
- 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
- 	size_t file_struct_offset;
- 	/* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-05-15 13:21:15.746908676 -0400
-@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
- 	 },
- };
- 
--static struct iwl_ops iwl1000_ops = {
-+static const struct iwl_ops iwl1000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl1000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-05-15 13:21:15.777121582 -0400
-@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
- 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
- };
- 
--static struct iwl_ops iwl3945_ops = {
-+static const struct iwl_ops iwl3945_ops = {
- 	.ucode = &iwl3945_ucode,
- 	.lib = &iwl3945_lib,
- 	.hcmd = &iwl3945_hcmd,
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-04-29 17:49:38.221487644 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-05-15 13:21:15.803555313 -0400
-@@ -2340,7 +2340,7 @@ static struct iwl_lib_ops iwl4965_lib = 
- 	},
- };
- 
--static struct iwl_ops iwl4965_ops = {
-+static const struct iwl_ops iwl4965_ops = {
- 	.ucode = &iwl4965_ucode,
- 	.lib = &iwl4965_lib,
- 	.hcmd = &iwl4965_hcmd,
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-04-29 17:49:38.221487644 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-05-15 13:21:15.810712850 -0400
-@@ -1628,14 +1628,14 @@ static struct iwl_lib_ops iwl5150_lib = 
- 	 },
- };
- 
--struct iwl_ops iwl5000_ops = {
-+const struct iwl_ops iwl5000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5000_lib,
- 	.hcmd = &iwl5000_hcmd,
- 	.utils = &iwl5000_hcmd_utils,
- };
- 
--static struct iwl_ops iwl5150_ops = {
-+static const struct iwl_ops iwl5150_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl5150_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-05-15 13:21:15.810712850 -0400
-@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
- 	.calc_rssi = iwl5000_calc_rssi,
- };
- 
--static struct iwl_ops iwl6000_ops = {
-+static const struct iwl_ops iwl6000_ops = {
- 	.ucode = &iwl5000_ucode,
- 	.lib = &iwl6000_lib,
- 	.hcmd = &iwl5000_hcmd,
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-05-15 13:21:15.810712850 -0400
-@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
- #endif
- 
- #else
--#define IWL_DEBUG(__priv, level, fmt, args...)
--#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
-+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
- static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
- 				      void *p, u32 len)
- {}
-diff -urNp linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h
---- linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-05-15 13:21:15.810712850 -0400
-@@ -67,7 +67,7 @@ struct iwl_tx_queue;
- 
- /* shared structures from iwl-5000.c */
- extern struct iwl_mod_params iwl50_mod_params;
--extern struct iwl_ops iwl5000_ops;
-+extern const struct iwl_ops iwl5000_ops;
- extern struct iwl_ucode_ops iwl5000_ucode;
- extern struct iwl_lib_ops iwl5000_lib;
- extern struct iwl_hcmd_ops iwl5000_hcmd;
-diff -urNp linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/libertas/debugfs.c	2010-05-15 13:21:15.810712850 -0400
-@@ -708,7 +708,7 @@ out_unlock:
- struct lbs_debugfs_files {
- 	const char *name;
- 	int perm;
--	struct file_operations fops;
-+	const struct file_operations fops;
- };
- 
- static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/net/wireless/rndis_wlan.c	2010-05-15 13:21:15.822985498 -0400
-@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
- 
- 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
- 
--	if (rts_threshold < 0 || rts_threshold > 2347)
-+	if (rts_threshold > 2347)
- 		rts_threshold = 2347;
- 
- 	tmp = cpu_to_le32(rts_threshold);
-diff -urNp linux-2.6.32.13/drivers/oprofile/buffer_sync.c linux-2.6.32.13/drivers/oprofile/buffer_sync.c
---- linux-2.6.32.13/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/buffer_sync.c	2010-05-15 13:21:15.822985498 -0400
-@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
- 		if (cookie == NO_COOKIE)
- 			offset = pc;
- 		if (cookie == INVALID_COOKIE) {
--			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 			offset = pc;
- 		}
- 		if (cookie != last_cookie) {
-@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
- 	/* add userspace sample */
- 
- 	if (!mm) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mm);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
- 		return 0;
- 	}
- 
- 	cookie = lookup_dcookie(mm, s->eip, &offset);
- 
- 	if (cookie == INVALID_COOKIE) {
--		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
-+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
- 		return 0;
- 	}
- 
-@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
- 		/* ignore backtraces if failed to add a sample */
- 		if (state == sb_bt_start) {
- 			state = sb_bt_ignore;
--			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
-+			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
- 		}
- 	}
- 	release_mm(mm);
-diff -urNp linux-2.6.32.13/drivers/oprofile/event_buffer.c linux-2.6.32.13/drivers/oprofile/event_buffer.c
---- linux-2.6.32.13/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/event_buffer.c	2010-05-15 13:21:15.822985498 -0400
-@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
- 	}
- 
- 	if (buffer_pos == buffer_size) {
--		atomic_inc(&oprofile_stats.event_lost_overflow);
-+		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
- 		return;
- 	}
- 
-diff -urNp linux-2.6.32.13/drivers/oprofile/oprof.c linux-2.6.32.13/drivers/oprofile/oprof.c
---- linux-2.6.32.13/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/oprof.c	2010-05-15 13:21:15.822985498 -0400
-@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
- 	if (oprofile_ops.switch_events())
- 		return;
- 
--	atomic_inc(&oprofile_stats.multiplex_counter);
-+	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
- 	start_switch_worker();
- }
- 
-diff -urNp linux-2.6.32.13/drivers/oprofile/oprofilefs.c linux-2.6.32.13/drivers/oprofile/oprofilefs.c
---- linux-2.6.32.13/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/oprofilefs.c	2010-05-15 13:21:15.822985498 -0400
-@@ -187,7 +187,7 @@ static const struct file_operations atom
- 
- 
- int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
--	char const *name, atomic_t *val)
-+	char const *name, atomic_unchecked_t *val)
- {
- 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
- 						     &atomic_ro_fops, 0444);
-diff -urNp linux-2.6.32.13/drivers/oprofile/oprofile_stats.c linux-2.6.32.13/drivers/oprofile/oprofile_stats.c
---- linux-2.6.32.13/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/oprofile_stats.c	2010-05-15 13:21:15.822985498 -0400
-@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
- 		cpu_buf->sample_invalid_eip = 0;
- 	}
- 
--	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
--	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.event_lost_overflow, 0);
--	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
--	atomic_set(&oprofile_stats.multiplex_counter, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
-+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
-+	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
-+	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
- }
- 
- 
-diff -urNp linux-2.6.32.13/drivers/oprofile/oprofile_stats.h linux-2.6.32.13/drivers/oprofile/oprofile_stats.h
---- linux-2.6.32.13/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/oprofile/oprofile_stats.h	2010-05-15 13:21:15.822985498 -0400
-@@ -13,11 +13,11 @@
- #include <asm/atomic.h>
- 
- struct oprofile_stat_struct {
--	atomic_t sample_lost_no_mm;
--	atomic_t sample_lost_no_mapping;
--	atomic_t bt_lost_no_mapping;
--	atomic_t event_lost_overflow;
--	atomic_t multiplex_counter;
-+	atomic_unchecked_t sample_lost_no_mm;
-+	atomic_unchecked_t sample_lost_no_mapping;
-+	atomic_unchecked_t bt_lost_no_mapping;
-+	atomic_unchecked_t event_lost_overflow;
-+	atomic_unchecked_t multiplex_counter;
- };
- 
- extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.32.13/drivers/parisc/pdc_stable.c linux-2.6.32.13/drivers/parisc/pdc_stable.c
---- linux-2.6.32.13/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/parisc/pdc_stable.c	2010-05-15 13:21:15.822985498 -0400
-@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
- 	return ret;
- }
- 
--static struct sysfs_ops pdcspath_attr_ops = {
-+static const struct sysfs_ops pdcspath_attr_ops = {
- 	.show = pdcspath_attr_show,
- 	.store = pdcspath_attr_store,
- };
-diff -urNp linux-2.6.32.13/drivers/parport/procfs.c linux-2.6.32.13/drivers/parport/procfs.c
---- linux-2.6.32.13/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/parport/procfs.c	2010-05-15 13:21:15.822985498 -0400
-@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
- 
- 	*ppos += len;
- 
--	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
- }
- 
- #ifdef CONFIG_PARPORT_1284
-@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
- 
- 	*ppos += len;
- 
--	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
-+	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
- }
- #endif /* IEEE1284.3 support. */
- 
-diff -urNp linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/hotplug/acpiphp_glue.c	2010-05-15 13:21:15.842765021 -0400
-@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
- }
- 
- 
--static struct acpi_dock_ops acpiphp_dock_ops = {
-+static const struct acpi_dock_ops acpiphp_dock_ops = {
- 	.handler = handle_hotplug_event_func,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/hotplug/cpqphp_nvram.c	2010-05-15 13:21:15.842765021 -0400
-@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
- 
- void compaq_nvram_init (void __iomem *rom_start)
- {
-+
-+#ifndef CONFIG_PAX_KERNEXEC
- 	if (rom_start) {
- 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
- 	}
-+#endif
-+
- 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
- 
- 	/* initialize our int15 lock */
-diff -urNp linux-2.6.32.13/drivers/pci/hotplug/fakephp.c linux-2.6.32.13/drivers/pci/hotplug/fakephp.c
---- linux-2.6.32.13/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/hotplug/fakephp.c	2010-05-15 13:21:15.847000534 -0400
-@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
- }
- 
- static struct kobj_type legacy_ktype = {
--	.sysfs_ops = &(struct sysfs_ops){
-+	.sysfs_ops = &(const struct sysfs_ops){
- 		.store = legacy_store, .show = legacy_show
- 	},
- 	.release = &legacy_release,
-diff -urNp linux-2.6.32.13/drivers/pci/intel-iommu.c linux-2.6.32.13/drivers/pci/intel-iommu.c
---- linux-2.6.32.13/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/intel-iommu.c	2010-05-15 13:21:15.847000534 -0400
-@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
- 	return !dma_addr;
- }
- 
--struct dma_map_ops intel_dma_ops = {
-+const struct dma_map_ops intel_dma_ops = {
- 	.alloc_coherent = intel_alloc_coherent,
- 	.free_coherent = intel_free_coherent,
- 	.map_sg = intel_map_sg,
-diff -urNp linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c
---- linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/pcie/portdrv_pci.c	2010-05-15 13:21:15.867469095 -0400
-@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
- static const struct pci_device_id port_pci_ids[] = { {
- 	/* handle any PCI-Express port */
- 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, port_pci_ids);
- 
-diff -urNp linux-2.6.32.13/drivers/pci/probe.c linux-2.6.32.13/drivers/pci/probe.c
---- linux-2.6.32.13/drivers/pci/probe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/probe.c	2010-05-15 13:21:15.867469095 -0400
-@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
- 	return ret;
- }
- 
--static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
- 					struct device_attribute *attr,
- 					char *buf)
- {
- 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
- }
- 
--static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
-+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
- 					struct device_attribute *attr,
- 					char *buf)
- {
-diff -urNp linux-2.6.32.13/drivers/pci/proc.c linux-2.6.32.13/drivers/pci/proc.c
---- linux-2.6.32.13/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/proc.c	2010-05-15 13:21:15.867469095 -0400
-@@ -480,7 +480,16 @@ static const struct file_operations proc
- static int __init pci_proc_init(void)
- {
- 	struct pci_dev *dev = NULL;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
-+#endif
- 	proc_create("devices", 0, proc_bus_pci_dir,
- 		    &proc_bus_pci_dev_operations);
- 	proc_initialized = 1;
-diff -urNp linux-2.6.32.13/drivers/pci/slot.c linux-2.6.32.13/drivers/pci/slot.c
---- linux-2.6.32.13/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pci/slot.c	2010-05-15 13:21:15.895764457 -0400
-@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
- 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
- }
- 
--static struct sysfs_ops pci_slot_sysfs_ops = {
-+static const struct sysfs_ops pci_slot_sysfs_ops = {
- 	.show = pci_slot_attr_show,
- 	.store = pci_slot_attr_store,
- };
-diff -urNp linux-2.6.32.13/drivers/pcmcia/ti113x.h linux-2.6.32.13/drivers/pcmcia/ti113x.h
---- linux-2.6.32.13/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pcmcia/ti113x.h	2010-05-15 13:21:15.895764457 -0400
-@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
- 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
- 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
- 
--	{}
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
-diff -urNp linux-2.6.32.13/drivers/pcmcia/yenta_socket.c linux-2.6.32.13/drivers/pcmcia/yenta_socket.c
---- linux-2.6.32.13/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pcmcia/yenta_socket.c	2010-05-15 13:21:15.911499692 -0400
-@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
- 
- 	/* match any cardbus bridge */
- 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
--	{ /* all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, yenta_table);
- 
-diff -urNp linux-2.6.32.13/drivers/platform/x86/acer-wmi.c linux-2.6.32.13/drivers/platform/x86/acer-wmi.c
---- linux-2.6.32.13/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/acer-wmi.c	2010-05-15 13:21:15.911499692 -0400
-@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
- 	return 0;
- }
- 
--static struct backlight_ops acer_bl_ops = {
-+static const struct backlight_ops acer_bl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/asus_acpi.c linux-2.6.32.13/drivers/platform/x86/asus_acpi.c
---- linux-2.6.32.13/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/asus_acpi.c	2010-05-15 13:21:15.911499692 -0400
-@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
- 	return 0;
- }
- 
--static struct backlight_ops asus_backlight_data = {
-+static const struct backlight_ops asus_backlight_data = {
- 	.get_brightness = read_brightness,
- 	.update_status  = set_brightness_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/asus-laptop.c linux-2.6.32.13/drivers/platform/x86/asus-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/asus-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops asusbl_ops = {
-+static const struct backlight_ops asusbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/compal-laptop.c linux-2.6.32.13/drivers/platform/x86/compal-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/compal-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops compalbl_ops = {
-+static const struct backlight_ops compalbl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status	= bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/dell-laptop.c linux-2.6.32.13/drivers/platform/x86/dell-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/dell-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
- 	return buffer.output[1];
- }
- 
--static struct backlight_ops dell_ops = {
-+static const struct backlight_ops dell_ops = {
- 	.get_brightness = dell_get_intensity,
- 	.update_status  = dell_send_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:38.317493070 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/eeepc-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
-  */
- static int read_brightness(struct backlight_device *bd);
- static int update_bl_status(struct backlight_device *bd);
--static struct backlight_ops eeepcbl_ops = {
-+static const struct backlight_ops eeepcbl_ops = {
- 	.get_brightness = read_brightness,
- 	.update_status = update_bl_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/fujitsu-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
- 	return ret;
- }
- 
--static struct backlight_ops fujitsubl_ops = {
-+static const struct backlight_ops fujitsubl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status = bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/msi-laptop.c linux-2.6.32.13/drivers/platform/x86/msi-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/msi-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
- 	return set_lcd_level(b->props.brightness);
- }
- 
--static struct backlight_ops msibl_ops = {
-+static const struct backlight_ops msibl_ops = {
- 	.get_brightness = bl_get_brightness,
- 	.update_status  = bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/panasonic-laptop.c	2010-05-15 13:21:15.911499692 -0400
-@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
- 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
- }
- 
--static struct backlight_ops pcc_backlight_ops = {
-+static const struct backlight_ops pcc_backlight_ops = {
- 	.get_brightness	= bl_get,
- 	.update_status	= bl_set_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/sony-laptop.c linux-2.6.32.13/drivers/platform/x86/sony-laptop.c
---- linux-2.6.32.13/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/sony-laptop.c	2010-05-15 13:21:15.914756904 -0400
-@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
- }
- 
- static struct backlight_device *sony_backlight_device;
--static struct backlight_ops sony_backlight_ops = {
-+static const struct backlight_ops sony_backlight_ops = {
- 	.update_status = sony_backlight_update_status,
- 	.get_brightness = sony_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c
---- linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 17:49:38.333363657 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/thinkpad_acpi.c	2010-05-15 13:21:15.914756904 -0400
-@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
- 			       BACKLIGHT_UPDATE_HOTKEY);
- }
- 
--static struct backlight_ops ibm_backlight_data = {
-+static const struct backlight_ops ibm_backlight_data = {
- 	.get_brightness = brightness_get,
- 	.update_status  = brightness_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c
---- linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/platform/x86/toshiba_acpi.c	2010-05-15 13:21:15.914756904 -0400
-@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
- 	return AE_OK;
- }
- 
--static struct backlight_ops toshiba_backlight_data = {
-+static const struct backlight_ops toshiba_backlight_data = {
-         .get_brightness = get_lcd,
-         .update_status  = set_lcd_status,
- };
-diff -urNp linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pnp/pnpbios/bioscalls.c	2010-05-15 13:21:15.914756904 -0400
-@@ -60,7 +60,7 @@ do { \
- 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
- } while(0)
- 
--static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
-+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
- 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
- 
- /*
-@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
- 
- 	cpu = get_cpu();
- 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
-+
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
-+	pax_close_kernel();
- 
- 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
- 	spin_lock_irqsave(&pnp_bios_lock, flags);
-@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
- 			     :"memory");
- 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
- 
-+	pax_open_kernel();
- 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
-+	pax_close_kernel();
-+
- 	put_cpu();
- 
- 	/* If we get here and this is set then the PnP BIOS faulted on us. */
-@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
- 	return status;
- }
- 
--void pnpbios_calls_init(union pnp_bios_install_struct *header)
-+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
- {
- 	int i;
- 
-@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
- 	pnp_bios_callpoint.offset = header->fields.pm16offset;
- 	pnp_bios_callpoint.segment = PNP_CS16;
- 
-+	pax_open_kernel();
-+
- 	for_each_possible_cpu(i) {
- 		struct desc_struct *gdt = get_cpu_gdt_table(i);
- 		if (!gdt)
-@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
- 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
- 			 (unsigned long)__va(header->fields.pm16dseg));
- 	}
-+
-+	pax_close_kernel();
- }
-diff -urNp linux-2.6.32.13/drivers/pnp/quirks.c linux-2.6.32.13/drivers/pnp/quirks.c
---- linux-2.6.32.13/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pnp/quirks.c	2010-05-15 13:21:15.914756904 -0400
-@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
- 	/* PnP resources that might overlap PCI BARs */
- 	{"PNP0c01", quirk_system_pci_resources},
- 	{"PNP0c02", quirk_system_pci_resources},
--	{""}
-+	{"", NULL}
- };
- 
- void pnp_fixup_device(struct pnp_dev *dev)
-diff -urNp linux-2.6.32.13/drivers/pnp/resource.c linux-2.6.32.13/drivers/pnp/resource.c
---- linux-2.6.32.13/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/pnp/resource.c	2010-05-15 13:21:15.914756904 -0400
-@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*irq < 0 || *irq > 15)
-+	if (*irq > 15)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
- 		return 1;
- 
- 	/* check if the resource is valid */
--	if (*dma < 0 || *dma == 4 || *dma > 7)
-+	if (*dma == 4 || *dma > 7)
- 		return 0;
- 
- 	/* check if the resource is reserved */
-diff -urNp linux-2.6.32.13/drivers/s390/cio/qdio_perf.c linux-2.6.32.13/drivers/s390/cio/qdio_perf.c
---- linux-2.6.32.13/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/s390/cio/qdio_perf.c	2010-05-15 13:21:15.914756904 -0400
-@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
- static int qdio_perf_proc_show(struct seq_file *m, void *v)
- {
- 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.qdio_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
- 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.pci_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
- 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thin_int));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
- 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
- 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
--		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
-+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
- 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound),
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_in));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
- 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_out));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
- 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.siga_sync));
-+		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.inbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
- 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_handler));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
- 	seq_printf(m, "\n");
- 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.fast_requeue));
-+		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
- 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.outbound_target_full));
-+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
- 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
- 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
- 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
--		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
- 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
- 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
--		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
-+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
- 	seq_printf(m, "\n");
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/drivers/s390/cio/qdio_perf.h linux-2.6.32.13/drivers/s390/cio/qdio_perf.h
---- linux-2.6.32.13/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/s390/cio/qdio_perf.h	2010-05-15 13:21:15.927411554 -0400
-@@ -13,46 +13,46 @@
- 
- struct qdio_perf_stats {
- 	/* interrupt handler calls */
--	atomic_long_t qdio_int;
--	atomic_long_t pci_int;
--	atomic_long_t thin_int;
-+	atomic_long_unchecked_t qdio_int;
-+	atomic_long_unchecked_t pci_int;
-+	atomic_long_unchecked_t thin_int;
- 
- 	/* tasklet runs */
--	atomic_long_t tasklet_inbound;
--	atomic_long_t tasklet_outbound;
--	atomic_long_t tasklet_thinint;
--	atomic_long_t tasklet_thinint_loop;
--	atomic_long_t thinint_inbound;
--	atomic_long_t thinint_inbound_loop;
--	atomic_long_t thinint_inbound_loop2;
-+	atomic_long_unchecked_t tasklet_inbound;
-+	atomic_long_unchecked_t tasklet_outbound;
-+	atomic_long_unchecked_t tasklet_thinint;
-+	atomic_long_unchecked_t tasklet_thinint_loop;
-+	atomic_long_unchecked_t thinint_inbound;
-+	atomic_long_unchecked_t thinint_inbound_loop;
-+	atomic_long_unchecked_t thinint_inbound_loop2;
- 
- 	/* signal adapter calls */
--	atomic_long_t siga_out;
--	atomic_long_t siga_in;
--	atomic_long_t siga_sync;
-+	atomic_long_unchecked_t siga_out;
-+	atomic_long_unchecked_t siga_in;
-+	atomic_long_unchecked_t siga_sync;
- 
- 	/* misc */
--	atomic_long_t inbound_handler;
--	atomic_long_t outbound_handler;
--	atomic_long_t fast_requeue;
--	atomic_long_t outbound_target_full;
-+	atomic_long_unchecked_t inbound_handler;
-+	atomic_long_unchecked_t outbound_handler;
-+	atomic_long_unchecked_t fast_requeue;
-+	atomic_long_unchecked_t outbound_target_full;
- 
- 	/* for debugging */
--	atomic_long_t debug_tl_out_timer;
--	atomic_long_t debug_stop_polling;
--	atomic_long_t debug_eqbs_all;
--	atomic_long_t debug_eqbs_incomplete;
--	atomic_long_t debug_sqbs_all;
--	atomic_long_t debug_sqbs_incomplete;
-+	atomic_long_unchecked_t debug_tl_out_timer;
-+	atomic_long_unchecked_t debug_stop_polling;
-+	atomic_long_unchecked_t debug_eqbs_all;
-+	atomic_long_unchecked_t debug_eqbs_incomplete;
-+	atomic_long_unchecked_t debug_sqbs_all;
-+	atomic_long_unchecked_t debug_sqbs_incomplete;
- };
- 
- extern struct qdio_perf_stats perf_stats;
- extern int qdio_performance_stats;
- 
--static inline void qdio_perf_stat_inc(atomic_long_t *count)
-+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
- {
- 	if (qdio_performance_stats)
--		atomic_long_inc(count);
-+		atomic_long_inc_unchecked(count);
- }
- 
- int qdio_setup_perf_stats(void);
-diff -urNp linux-2.6.32.13/drivers/scsi/ipr.c linux-2.6.32.13/drivers/scsi/ipr.c
---- linux-2.6.32.13/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/scsi/ipr.c	2010-05-15 13:21:15.970703897 -0400
-@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
- 	return true;
- }
- 
--static struct ata_port_operations ipr_sata_ops = {
-+static const struct ata_port_operations ipr_sata_ops = {
- 	.phy_reset = ipr_ata_phy_reset,
- 	.hardreset = ipr_sata_reset,
- 	.post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/scsi/libfc/fc_exch.c	2010-05-15 13:21:15.970703897 -0400
-@@ -86,12 +86,12 @@ struct fc_exch_mgr {
- 	 * all together if not used XXX
- 	 */
- 	struct {
--		atomic_t no_free_exch;
--		atomic_t no_free_exch_xid;
--		atomic_t xid_not_found;
--		atomic_t xid_busy;
--		atomic_t seq_not_found;
--		atomic_t non_bls_resp;
-+		atomic_unchecked_t no_free_exch;
-+		atomic_unchecked_t no_free_exch_xid;
-+		atomic_unchecked_t xid_not_found;
-+		atomic_unchecked_t xid_busy;
-+		atomic_unchecked_t seq_not_found;
-+		atomic_unchecked_t non_bls_resp;
- 	} stats;
- };
- #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
-@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
- 	/* allocate memory for exchange */
- 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
- 	if (!ep) {
--		atomic_inc(&mp->stats.no_free_exch);
-+		atomic_inc_unchecked(&mp->stats.no_free_exch);
- 		goto out;
- 	}
- 	memset(ep, 0, sizeof(*ep));
-@@ -557,7 +557,7 @@ out:
- 	return ep;
- err:
- 	spin_unlock_bh(&pool->lock);
--	atomic_inc(&mp->stats.no_free_exch_xid);
-+	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
- 	mempool_free(ep, mp->ep_pool);
- 	return NULL;
- }
-@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
- 		ep = fc_exch_find(mp, xid);
- 		if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_OX_ID;
- 			goto out;
- 		}
-@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 		ep = fc_exch_find(mp, xid);
- 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
- 			if (ep) {
--				atomic_inc(&mp->stats.xid_busy);
-+				atomic_inc_unchecked(&mp->stats.xid_busy);
- 				reject = FC_RJT_RX_ID;
- 				goto rel;
- 			}
-@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 			}
- 			xid = ep->xid;	/* get our XID */
- 		} else if (!ep) {
--			atomic_inc(&mp->stats.xid_not_found);
-+			atomic_inc_unchecked(&mp->stats.xid_not_found);
- 			reject = FC_RJT_RX_ID;	/* XID not found */
- 			goto out;
- 		}
-@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
- 			goto rel;
- 		}
-@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
- 
- 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
- 	if (!ep) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->esb_stat & ESB_ST_COMPLETE) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto out;
- 	}
- 	if (ep->rxid == FC_XID_UNKNOWN)
- 		ep->rxid = ntohs(fh->fh_rx_id);
- 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	if (ep->did != ntoh24(fh->fh_s_id) &&
- 	    ep->did != FC_FID_FLOGI) {
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 		goto rel;
- 	}
- 	sof = fr_sof(fp);
-@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
- 	} else {
- 		sp = &ep->seq;
- 		if (sp->id != fh->fh_seq_id) {
--			atomic_inc(&mp->stats.seq_not_found);
-+			atomic_inc_unchecked(&mp->stats.seq_not_found);
- 			goto rel;
- 		}
- 	}
-@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
- 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
- 
- 	if (!sp)
--		atomic_inc(&mp->stats.xid_not_found);
-+		atomic_inc_unchecked(&mp->stats.xid_not_found);
- 	else
--		atomic_inc(&mp->stats.non_bls_resp);
-+		atomic_inc_unchecked(&mp->stats.non_bls_resp);
- 
- 	fc_frame_free(fp);
- }
-diff -urNp linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c	2010-05-15 13:20:18.878584179 -0400
-+++ linux-2.6.32.13/drivers/scsi/libsas/sas_ata.c	2010-05-15 13:21:15.970703897 -0400
-@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
- 	}
- }
- 
--static struct ata_port_operations sas_sata_ops = {
-+static const struct ata_port_operations sas_sata_ops = {
- 	.phy_reset		= sas_ata_phy_reset,
- 	.post_internal_cmd	= sas_ata_post_internal,
- 	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h
---- linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-05-15 13:21:15.991412669 -0400
-@@ -79,7 +79,7 @@
- 		CMD;						\
- }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
- 
- 
-diff -urNp linux-2.6.32.13/drivers/scsi/scsi_logging.h linux-2.6.32.13/drivers/scsi/scsi_logging.h
---- linux-2.6.32.13/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/scsi/scsi_logging.h	2010-05-15 13:21:15.991412669 -0400
-@@ -51,7 +51,7 @@ do {								\
- 		} while (0);					\
- } while (0)
- #else
--#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
-+#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
- #endif /* CONFIG_SCSI_LOGGING */
- 
- /*
-diff -urNp linux-2.6.32.13/drivers/scsi/sg.c linux-2.6.32.13/drivers/scsi/sg.c
---- linux-2.6.32.13/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/scsi/sg.c	2010-05-15 13:21:15.991412669 -0400
-@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
- 	const struct file_operations * fops;
- };
- 
--static struct sg_proc_leaf sg_proc_leaf_arr[] = {
-+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
- 	{"allow_dio", &adio_fops},
- 	{"debug", &debug_fops},
- 	{"def_reserved_size", &dressz_fops},
-@@ -2307,7 +2307,7 @@ sg_proc_init(void)
- {
- 	int k, mask;
- 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
--	struct sg_proc_leaf * leaf;
-+	const struct sg_proc_leaf * leaf;
- 
- 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
- 	if (!sg_proc_sgp)
-diff -urNp linux-2.6.32.13/drivers/serial/8250_pci.c linux-2.6.32.13/drivers/serial/8250_pci.c
---- linux-2.6.32.13/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/serial/8250_pci.c	2010-05-15 13:21:16.030795257 -0400
-@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
- 		PCI_ANY_ID, PCI_ANY_ID,
- 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
- 		0xffff00, pbn_default },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static struct pci_driver serial_pci_driver = {
-diff -urNp linux-2.6.32.13/drivers/serial/kgdboc.c linux-2.6.32.13/drivers/serial/kgdboc.c
---- linux-2.6.32.13/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/serial/kgdboc.c	2010-05-15 13:21:16.030795257 -0400
-@@ -18,7 +18,7 @@
- 
- #define MAX_CONFIG_LEN		40
- 
--static struct kgdb_io		kgdboc_io_ops;
-+static const struct kgdb_io	kgdboc_io_ops;
- 
- /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
- static int configured		= -1;
-@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
- 		module_put(THIS_MODULE);
- }
- 
--static struct kgdb_io kgdboc_io_ops = {
-+static const struct kgdb_io kgdboc_io_ops = {
- 	.name			= "kgdboc",
- 	.read_char		= kgdboc_get_char,
- 	.write_char		= kgdboc_put_char,
-diff -urNp linux-2.6.32.13/drivers/staging/android/binder.c linux-2.6.32.13/drivers/staging/android/binder.c
---- linux-2.6.32.13/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/android/binder.c	2010-05-15 13:21:16.072777583 -0400
-@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
- 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
- }
- 
--static struct vm_operations_struct binder_vm_ops = {
-+static const struct vm_operations_struct binder_vm_ops = {
- 	.open = binder_vma_open,
- 	.close = binder_vma_close,
- };
-diff -urNp linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c
---- linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/b3dfg/b3dfg.c	2010-05-15 13:21:16.111132239 -0400
-@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
- 	return VM_FAULT_NOPAGE;
- }
- 
--static struct vm_operations_struct b3dfg_vm_ops = {
-+static const struct vm_operations_struct b3dfg_vm_ops = {
- 	.fault = b3dfg_vma_fault,
- };
- 
-@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
- 	return r;
- }
- 
--static struct file_operations b3dfg_fops = {
-+static const struct file_operations b3dfg_fops = {
- 	.owner = THIS_MODULE,
- 	.open = b3dfg_open,
- 	.release = b3dfg_release,
-diff -urNp linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/comedi/comedi_fops.c	2010-05-15 13:21:16.111132239 -0400
-@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
- 	mutex_unlock(&dev->mutex);
- }
- 
--static struct vm_operations_struct comedi_vm_ops = {
-+static const struct vm_operations_struct comedi_vm_ops = {
- 	.close = comedi_unmap,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/adsp_driver.c	2010-05-15 13:21:16.111132239 -0400
-@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
- static dev_t adsp_devno;
- static struct class *adsp_class;
- 
--static struct file_operations adsp_fops = {
-+static const struct file_operations adsp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = adsp_open,
- 	.unlocked_ioctl = adsp_ioctl,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_aac.c	2010-05-15 13:21:16.127017061 -0400
-@@ -1022,7 +1022,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_aac_fops = {
-+static const struct file_operations audio_aac_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audio_open,
- 	.release = audio_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-05-15 13:21:16.139031435 -0400
-@@ -833,7 +833,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_amrnb_fops = {
-+static const struct file_operations audio_amrnb_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audamrnb_open,
- 	.release = audamrnb_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_evrc.c	2010-05-15 13:21:16.151007392 -0400
-@@ -805,7 +805,7 @@ dma_fail:
- 	return rc;
- }
- 
--static struct file_operations audio_evrc_fops = {
-+static const struct file_operations audio_evrc_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audevrc_open,
- 	.release = audevrc_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_in.c	2010-05-15 13:21:16.155145249 -0400
-@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_in_open,
- 	.release	= audio_in_release,
-@@ -922,7 +922,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_in_ioctl,
- };
- 
--static struct file_operations audpre_fops = {
-+static const struct file_operations audpre_fops = {
- 	.owner          = THIS_MODULE,
- 	.open           = audpre_open,
- 	.unlocked_ioctl = audpre_ioctl,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_mp3.c	2010-05-15 13:21:16.171026730 -0400
-@@ -941,7 +941,7 @@ done:
- 	return rc;
- }
- 
--static struct file_operations audio_mp3_fops = {
-+static const struct file_operations audio_mp3_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_out.c	2010-05-15 13:21:16.175016772 -0400
-@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations audio_fops = {
-+static const struct file_operations audio_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audio_open,
- 	.release	= audio_release,
-@@ -819,7 +819,7 @@ static struct file_operations audio_fops
- 	.unlocked_ioctl	= audio_ioctl,
- };
- 
--static struct file_operations audpp_fops = {
-+static const struct file_operations audpp_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= audpp_open,
- 	.unlocked_ioctl	= audpp_ioctl,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-05-15 13:21:16.183014216 -0400
-@@ -816,7 +816,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations audio_qcelp_fops = {
-+static const struct file_operations audio_qcelp_fops = {
- 	.owner = THIS_MODULE,
- 	.open = audqcelp_open,
- 	.release = audqcelp_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c
---- linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/qdsp5/snd.c	2010-05-15 13:21:16.187015266 -0400
-@@ -242,7 +242,7 @@ err:
- 	return rc;
- }
- 
--static struct file_operations snd_fops = {
-+static const struct file_operations snd_fops = {
- 	.owner		= THIS_MODULE,
- 	.open		= snd_open,
- 	.release	= snd_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c
---- linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/smd/smd_qmi.c	2010-05-15 13:21:16.190693177 -0400
-@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
- 	return 0;
- }
- 
--static struct file_operations qmi_fops = {
-+static const struct file_operations qmi_fops = {
- 	.owner = THIS_MODULE,
- 	.read = qmi_read,
- 	.write = qmi_write,
-diff -urNp linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c
---- linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-05-15 13:21:16.190693177 -0400
-@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
- 	return rc;
- }
- 
--static struct file_operations rpcrouter_server_fops = {
-+static const struct file_operations rpcrouter_server_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
- 	.unlocked_ioctl	 = rpcrouter_ioctl,
- };
- 
--static struct file_operations rpcrouter_router_fops = {
-+static const struct file_operations rpcrouter_router_fops = {
- 	.owner	 = THIS_MODULE,
- 	.open	 = rpcrouter_open,
- 	.release = rpcrouter_release,
-diff -urNp linux-2.6.32.13/drivers/staging/dst/dcore.c linux-2.6.32.13/drivers/staging/dst/dcore.c
---- linux-2.6.32.13/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dst/dcore.c	2010-05-15 13:21:16.190693177 -0400
-@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
- 	return 0;
- }
- 
--static struct block_device_operations dst_blk_ops = {
-+static const struct block_device_operations dst_blk_ops = {
- 	.open		= dst_bdev_open,
- 	.release	= dst_bdev_release,
- 	.owner		= THIS_MODULE,
-@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
- 	n->size = ctl->size;
- 
- 	atomic_set(&n->refcnt, 1);
--	atomic_long_set(&n->gen, 0);
-+	atomic_long_set_unchecked(&n->gen, 0);
- 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
- 
- 	err = dst_node_sysfs_init(n);
-diff -urNp linux-2.6.32.13/drivers/staging/dst/trans.c linux-2.6.32.13/drivers/staging/dst/trans.c
---- linux-2.6.32.13/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/dst/trans.c	2010-05-15 13:21:16.211066896 -0400
-@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
- 	t->error = 0;
- 	t->retries = 0;
- 	atomic_set(&t->refcnt, 1);
--	t->gen = atomic_long_inc_return(&n->gen);
-+	t->gen = atomic_long_inc_return_unchecked(&n->gen);
- 
- 	t->enc = bio_data_dir(bio);
- 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-diff -urNp linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/go7007/go7007-v4l2.c	2010-05-15 13:21:16.231838911 -0400
-@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
- 	return 0;
- }
- 
--static struct vm_operations_struct go7007_vm_ops = {
-+static const struct vm_operations_struct go7007_vm_ops = {
- 	.open	= go7007_vm_open,
- 	.close	= go7007_vm_close,
- 	.fault	= go7007_vm_fault,
-diff -urNp linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c
---- linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/hv/blkvsc_drv.c	2010-05-15 13:21:16.231838911 -0400
-@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
- /* The one and only one */
- static struct blkvsc_driver_context g_blkvsc_drv;
- 
--static struct block_device_operations block_ops = {
-+static const struct block_device_operations block_ops = {
- 	.owner = THIS_MODULE,
- 	.open = blkvsc_open,
- 	.release = blkvsc_release,
-diff -urNp linux-2.6.32.13/drivers/staging/panel/panel.c linux-2.6.32.13/drivers/staging/panel/panel.c
---- linux-2.6.32.13/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/panel/panel.c	2010-05-15 13:21:16.231838911 -0400
-@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
- 	return 0;
- }
- 
--static struct file_operations lcd_fops = {
-+static const struct file_operations lcd_fops = {
- 	.write   = lcd_write,
- 	.open    = lcd_open,
- 	.release = lcd_release,
-@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
- 	return 0;
- }
- 
--static struct file_operations keypad_fops = {
-+static const struct file_operations keypad_fops = {
- 	.read    = keypad_read,		/* read */
- 	.open    = keypad_open,		/* open */
- 	.release = keypad_release,	/* close */
-diff -urNp linux-2.6.32.13/drivers/staging/phison/phison.c linux-2.6.32.13/drivers/staging/phison/phison.c
---- linux-2.6.32.13/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/phison/phison.c	2010-05-15 13:21:16.242656725 -0400
-@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
- 	ATA_BMDMA_SHT(DRV_NAME),
- };
- 
--static struct ata_port_operations phison_ops = {
-+static const struct ata_port_operations phison_ops = {
- 	.inherits		= &ata_bmdma_port_ops,
- 	.prereset		= phison_pre_reset,
- };
-diff -urNp linux-2.6.32.13/drivers/staging/poch/poch.c linux-2.6.32.13/drivers/staging/poch/poch.c
---- linux-2.6.32.13/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/poch/poch.c	2010-05-15 13:21:16.268445393 -0400
-@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
- 	return 0;
- }
- 
--static struct file_operations poch_fops = {
-+static const struct file_operations poch_fops = {
- 	.owner = THIS_MODULE,
- 	.open = poch_open,
- 	.release = poch_release,
-diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/inode.c linux-2.6.32.13/drivers/staging/pohmelfs/inode.c
---- linux-2.6.32.13/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/pohmelfs/inode.c	2010-05-15 13:21:16.285190860 -0400
-@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
- 	mutex_init(&psb->mcache_lock);
- 	psb->mcache_root = RB_ROOT;
- 	psb->mcache_timeout = msecs_to_jiffies(5000);
--	atomic_long_set(&psb->mcache_gen, 0);
-+	atomic_long_set_unchecked(&psb->mcache_gen, 0);
- 
- 	psb->trans_max_pages = 100;
- 
-diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/pohmelfs/mcache.c	2010-05-15 13:21:16.291030028 -0400
-@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
- 	m->data = data;
- 	m->start = start;
- 	m->size = size;
--	m->gen = atomic_long_inc_return(&psb->mcache_gen);
-+	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
- 
- 	mutex_lock(&psb->mcache_lock);
- 	err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/pohmelfs/netfs.h	2010-05-15 13:21:16.307023663 -0400
-@@ -570,7 +570,7 @@ struct pohmelfs_config;
- struct pohmelfs_sb {
- 	struct rb_root		mcache_root;
- 	struct mutex		mcache_lock;
--	atomic_long_t		mcache_gen;
-+	atomic_long_unchecked_t	mcache_gen;
- 	unsigned long		mcache_timeout;
- 
- 	unsigned int		idx;
-diff -urNp linux-2.6.32.13/drivers/staging/sep/sep_driver.c linux-2.6.32.13/drivers/staging/sep/sep_driver.c
---- linux-2.6.32.13/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/sep/sep_driver.c	2010-05-15 13:21:16.365819296 -0400
-@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
- static dev_t sep_devno;
- 
- /* the files operations structure of the driver */
--static struct file_operations sep_file_operations = {
-+static const struct file_operations sep_file_operations = {
- 	.owner = THIS_MODULE,
- 	.ioctl = sep_ioctl,
- 	.poll = sep_poll,
-diff -urNp linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/staging/vme/devices/vme_user.c	2010-05-15 13:21:16.387343522 -0400
-@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
- static int __init vme_user_probe(struct device *, int, int);
- static int __exit vme_user_remove(struct device *, int, int);
- 
--static struct file_operations vme_user_fops = {
-+static const struct file_operations vme_user_fops = {
-         .open = vme_user_open,
-         .release = vme_user_release,
-         .read = vme_user_read,
-diff -urNp linux-2.6.32.13/drivers/uio/uio.c linux-2.6.32.13/drivers/uio/uio.c
---- linux-2.6.32.13/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/uio/uio.c	2010-05-15 13:21:16.387343522 -0400
-@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
- 	return entry->show(mem, buf);
- }
- 
--static struct sysfs_ops map_sysfs_ops = {
-+static const struct sysfs_ops map_sysfs_ops = {
- 	.show = map_type_show,
- };
- 
-@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
- 	return entry->show(port, buf);
- }
- 
--static struct sysfs_ops portio_sysfs_ops = {
-+static const struct sysfs_ops portio_sysfs_ops = {
- 	.show = portio_type_show,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/usb/atm/usbatm.c linux-2.6.32.13/drivers/usb/atm/usbatm.c
---- linux-2.6.32.13/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/atm/usbatm.c	2010-05-15 13:21:16.394585811 -0400
-@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
- 		if (printk_ratelimit())
- 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
- 				__func__, vpi, vci);
--		atomic_inc(&vcc->stats->rx_err);
-+		atomic_inc_unchecked(&vcc->stats->rx_err);
- 		return;
- 	}
- 
-@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
- 		if (length > ATM_MAX_AAL5_PDU) {
- 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
- 				  __func__, length, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
- 		if (sarb->len < pdu_length) {
- 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
- 				  __func__, pdu_length, sarb->len, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
- 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
- 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
- 				  __func__, vcc);
--			atomic_inc(&vcc->stats->rx_err);
-+			atomic_inc_unchecked(&vcc->stats->rx_err);
- 			goto out;
- 		}
- 
-@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
- 			if (printk_ratelimit())
- 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
- 					__func__, length);
--			atomic_inc(&vcc->stats->rx_drop);
-+			atomic_inc_unchecked(&vcc->stats->rx_drop);
- 			goto out;
- 		}
- 
-@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
- 
- 		vcc->push(vcc, skb);
- 
--		atomic_inc(&vcc->stats->rx);
-+		atomic_inc_unchecked(&vcc->stats->rx);
- 	out:
- 		skb_trim(sarb, 0);
- 	}
-@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
- 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
- 
- 			usbatm_pop(vcc, skb);
--			atomic_inc(&vcc->stats->tx);
-+			atomic_inc_unchecked(&vcc->stats->tx);
- 
- 			skb = skb_dequeue(&instance->sndqueue);
- 		}
-@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
- 	if (!left--)
- 		return sprintf(page,
- 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
--			       atomic_read(&atm_dev->stats.aal5.tx),
--			       atomic_read(&atm_dev->stats.aal5.tx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx),
--			       atomic_read(&atm_dev->stats.aal5.rx_err),
--			       atomic_read(&atm_dev->stats.aal5.rx_drop));
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
-+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
- 
- 	if (!left--) {
- 		if (instance->disconnected)
-diff -urNp linux-2.6.32.13/drivers/usb/class/cdc-acm.c linux-2.6.32.13/drivers/usb/class/cdc-acm.c
---- linux-2.6.32.13/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:38.389083173 -0400
-+++ linux-2.6.32.13/drivers/usb/class/cdc-acm.c	2010-05-15 13:21:16.402576854 -0400
-@@ -1535,7 +1535,7 @@ static struct usb_device_id acm_ids[] = 
- 		USB_CDC_ACM_PROTO_AT_CDMA) },
- 
- 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(usb, acm_ids);
-diff -urNp linux-2.6.32.13/drivers/usb/class/usblp.c linux-2.6.32.13/drivers/usb/class/usblp.c
---- linux-2.6.32.13/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/class/usblp.c	2010-05-15 13:21:16.423521533 -0400
-@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
- 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
- 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
- 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
--	{ 0, 0 }
-+	{ 0, 0, 0 }
- };
- 
- static int usblp_wwait(struct usblp *usblp, int nonblock);
-@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
- 	{ USB_INTERFACE_INFO(7, 1, 2) },
- 	{ USB_INTERFACE_INFO(7, 1, 3) },
- 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
--	{ }						/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, usblp_ids);
-diff -urNp linux-2.6.32.13/drivers/usb/core/hcd.c linux-2.6.32.13/drivers/usb/core/hcd.c
---- linux-2.6.32.13/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/core/hcd.c	2010-05-15 13:21:16.445526992 -0400
-@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
- 
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
--struct usb_mon_operations *mon_ops;
-+const struct usb_mon_operations *mon_ops;
- 
- /*
-  * The registration is unlocked.
-@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
-  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
-  */
-  
--int usb_mon_register (struct usb_mon_operations *ops)
-+int usb_mon_register (const struct usb_mon_operations *ops)
- {
- 
- 	if (mon_ops)
-diff -urNp linux-2.6.32.13/drivers/usb/core/hcd.h linux-2.6.32.13/drivers/usb/core/hcd.h
---- linux-2.6.32.13/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/core/hcd.h	2010-05-15 13:21:16.447026425 -0400
-@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
- #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
- 
- struct usb_mon_operations {
--	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
--	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
--	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
-+	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
-+	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-+	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
- 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
- };
- 
--extern struct usb_mon_operations *mon_ops;
-+extern const struct usb_mon_operations *mon_ops;
- 
- static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
- {
-@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
- 		(*mon_ops->urb_complete)(bus, urb, status);
- }
- 
--int usb_mon_register(struct usb_mon_operations *ops);
-+int usb_mon_register(const struct usb_mon_operations *ops);
- void usb_mon_deregister(void);
- 
- #else
-diff -urNp linux-2.6.32.13/drivers/usb/core/hub.c linux-2.6.32.13/drivers/usb/core/hub.c
---- linux-2.6.32.13/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/core/hub.c	2010-05-15 13:21:16.479087397 -0400
-@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
-       .bDeviceClass = USB_CLASS_HUB},
-     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
-       .bInterfaceClass = USB_CLASS_HUB},
--    { }						/* Terminating entry */
-+    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, hub_id_table);
-diff -urNp linux-2.6.32.13/drivers/usb/core/message.c linux-2.6.32.13/drivers/usb/core/message.c
---- linux-2.6.32.13/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/core/message.c	2010-05-15 13:21:16.479087397 -0400
-@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
- 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
- 	if (buf) {
- 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
--		if (len > 0) {
--			smallbuf = kmalloc(++len, GFP_NOIO);
-+		if (len++ > 0) {
-+			smallbuf = kmalloc(len, GFP_NOIO);
- 			if (!smallbuf)
- 				return buf;
- 			memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.32.13/drivers/usb/host/ehci-pci.c linux-2.6.32.13/drivers/usb/host/ehci-pci.c
---- linux-2.6.32.13/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/host/ehci-pci.c	2010-05-15 13:21:16.495431959 -0400
-@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
- 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
- 	},
--	{ /* end: all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, pci_ids);
- 
-diff -urNp linux-2.6.32.13/drivers/usb/host/uhci-hcd.c linux-2.6.32.13/drivers/usb/host/uhci-hcd.c
---- linux-2.6.32.13/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/host/uhci-hcd.c	2010-05-15 13:21:16.495431959 -0400
-@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
- 	/* handle any USB UHCI controller */
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
- 	.driver_data =	(unsigned long) &uhci_driver,
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
-diff -urNp linux-2.6.32.13/drivers/usb/misc/appledisplay.c linux-2.6.32.13/drivers/usb/misc/appledisplay.c
---- linux-2.6.32.13/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/misc/appledisplay.c	2010-05-15 13:21:16.495431959 -0400
-@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
- 		return pdata->msgdata[1];
- }
- 
--static struct backlight_ops appledisplay_bl_data = {
-+static const struct backlight_ops appledisplay_bl_data = {
- 	.get_brightness	= appledisplay_bl_get_brightness,
- 	.update_status	= appledisplay_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/usb/mon/mon_main.c linux-2.6.32.13/drivers/usb/mon/mon_main.c
---- linux-2.6.32.13/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/mon/mon_main.c	2010-05-15 13:21:16.504078790 -0400
-@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
- /*
-  * Ops
-  */
--static struct usb_mon_operations mon_ops_0 = {
-+static const struct usb_mon_operations mon_ops_0 = {
- 	.urb_submit =	mon_submit,
- 	.urb_submit_error = mon_submit_error,
- 	.urb_complete =	mon_complete,
-diff -urNp linux-2.6.32.13/drivers/usb/storage/debug.h linux-2.6.32.13/drivers/usb/storage/debug.h
---- linux-2.6.32.13/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/storage/debug.h	2010-05-15 13:21:16.521852812 -0400
-@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
- #define US_DEBUGPX(x...) printk( x )
- #define US_DEBUG(x) x 
- #else
--#define US_DEBUGP(x...)
--#define US_DEBUGPX(x...)
--#define US_DEBUG(x)
-+#define US_DEBUGP(x...) do {} while (0)
-+#define US_DEBUGPX(x...) do {} while (0)
-+#define US_DEBUG(x) do {} while (0)
- #endif
- 
- #endif
-diff -urNp linux-2.6.32.13/drivers/usb/storage/usb.c linux-2.6.32.13/drivers/usb/storage/usb.c
---- linux-2.6.32.13/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/storage/usb.c	2010-05-15 13:21:16.547749964 -0400
-@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
- 
- static struct us_unusual_dev us_unusual_dev_list[] = {
- #	include "unusual_devs.h" 
--	{ }		/* Terminating entry */
-+	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
- };
- 
- #undef UNUSUAL_DEV
-diff -urNp linux-2.6.32.13/drivers/usb/storage/usual-tables.c linux-2.6.32.13/drivers/usb/storage/usual-tables.c
---- linux-2.6.32.13/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/usb/storage/usual-tables.c	2010-05-15 13:21:16.559032137 -0400
-@@ -48,7 +48,7 @@
- 
- struct usb_device_id usb_storage_usb_ids[] = {
- #	include "unusual_devs.h"
--	{ }		/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
- 
-diff -urNp linux-2.6.32.13/drivers/uwb/wlp/messages.c linux-2.6.32.13/drivers/uwb/wlp/messages.c
---- linux-2.6.32.13/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/uwb/wlp/messages.c	2010-05-15 13:21:16.584920944 -0400
-@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
- 	size_t len = skb->len;
- 	size_t used;
- 	ssize_t result;
--	struct wlp_nonce enonce, rnonce;
-+	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
- 	enum wlp_assc_error assc_err;
- 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
- 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
-diff -urNp linux-2.6.32.13/drivers/uwb/wlp/sysfs.c linux-2.6.32.13/drivers/uwb/wlp/sysfs.c
---- linux-2.6.32.13/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/uwb/wlp/sysfs.c	2010-05-15 13:21:16.587027337 -0400
-@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
- 	return ret;
- }
- 
--static
--struct sysfs_ops wss_sysfs_ops = {
-+static const struct sysfs_ops wss_sysfs_ops = {
- 	.show	= wlp_wss_attr_show,
- 	.store	= wlp_wss_attr_store,
- };
-diff -urNp linux-2.6.32.13/drivers/video/atmel_lcdfb.c linux-2.6.32.13/drivers/video/atmel_lcdfb.c
---- linux-2.6.32.13/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/atmel_lcdfb.c	2010-05-15 13:21:16.587027337 -0400
-@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
- 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
- }
- 
--static struct backlight_ops atmel_lcdc_bl_ops = {
-+static const struct backlight_ops atmel_lcdc_bl_ops = {
- 	.update_status = atmel_bl_update_status,
- 	.get_brightness = atmel_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/video/aty/aty128fb.c linux-2.6.32.13/drivers/video/aty/aty128fb.c
---- linux-2.6.32.13/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/aty/aty128fb.c	2010-05-15 13:21:16.599120806 -0400
-@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty128_bl_data = {
-+static const struct backlight_ops aty128_bl_data = {
- 	.get_brightness	= aty128_bl_get_brightness,
- 	.update_status	= aty128_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/aty/atyfb_base.c linux-2.6.32.13/drivers/video/aty/atyfb_base.c
---- linux-2.6.32.13/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/aty/atyfb_base.c	2010-05-15 13:21:16.611030004 -0400
-@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops aty_bl_data = {
-+static const struct backlight_ops aty_bl_data = {
- 	.get_brightness = aty_bl_get_brightness,
- 	.update_status	= aty_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/aty/radeon_backlight.c linux-2.6.32.13/drivers/video/aty/radeon_backlight.c
---- linux-2.6.32.13/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/aty/radeon_backlight.c	2010-05-15 13:21:16.611030004 -0400
-@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops radeon_bl_data = {
-+static const struct backlight_ops radeon_bl_data = {
- 	.get_brightness = radeon_bl_get_brightness,
- 	.update_status	= radeon_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c
---- linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/adp5520_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
- 	return error ? data->current_brightness : reg_val;
- }
- 
--static struct backlight_ops adp5520_bl_ops = {
-+static const struct backlight_ops adp5520_bl_ops = {
- 	.update_status	= adp5520_bl_update_status,
- 	.get_brightness	= adp5520_bl_get_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/adx_bl.c linux-2.6.32.13/drivers/video/backlight/adx_bl.c
---- linux-2.6.32.13/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/adx_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
- 	return 1;
- }
- 
--static struct backlight_ops adx_backlight_ops = {
-+static const struct backlight_ops adx_backlight_ops = {
- 	.options = 0,
- 	.update_status = adx_backlight_update_status,
- 	.get_brightness = adx_backlight_get_brightness,
-diff -urNp linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c
---- linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/atmel-pwm-bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
- 	return pwm_channel_enable(&pwmbl->pwmc);
- }
- 
--static struct backlight_ops atmel_pwm_bl_ops = {
-+static const struct backlight_ops atmel_pwm_bl_ops = {
- 	.get_brightness = atmel_pwm_bl_get_intensity,
- 	.update_status  = atmel_pwm_bl_set_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/backlight.c linux-2.6.32.13/drivers/video/backlight/backlight.c
---- linux-2.6.32.13/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/backlight.c	2010-05-15 13:21:16.611030004 -0400
-@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
-  * ERR_PTR() or a pointer to the newly allocated device.
-  */
- struct backlight_device *backlight_device_register(const char *name,
--		struct device *parent, void *devdata, struct backlight_ops *ops)
-+		struct device *parent, void *devdata, const struct backlight_ops *ops)
- {
- 	struct backlight_device *new_bd;
- 	int rc;
-diff -urNp linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c
---- linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/corgi_lcd.c	2010-05-15 13:21:16.611030004 -0400
-@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
- }
- EXPORT_SYMBOL(corgi_lcd_limit_intensity);
- 
--static struct backlight_ops corgi_bl_ops = {
-+static const struct backlight_ops corgi_bl_ops = {
- 	.get_brightness	= corgi_bl_get_intensity,
- 	.update_status  = corgi_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c
---- linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/cr_bllcd.c	2010-05-15 13:21:16.611030004 -0400
-@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
- 	return intensity;
- }
- 
--static struct backlight_ops cr_backlight_ops = {
-+static const struct backlight_ops cr_backlight_ops = {
- 	.get_brightness = cr_backlight_get_intensity,
- 	.update_status = cr_backlight_set_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/da903x_bl.c linux-2.6.32.13/drivers/video/backlight/da903x_bl.c
---- linux-2.6.32.13/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/da903x_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops da903x_backlight_ops = {
-+static const struct backlight_ops da903x_backlight_ops = {
- 	.update_status	= da903x_backlight_update_status,
- 	.get_brightness	= da903x_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/generic_bl.c linux-2.6.32.13/drivers/video/backlight/generic_bl.c
---- linux-2.6.32.13/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/generic_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
- }
- EXPORT_SYMBOL(corgibl_limit_intensity);
- 
--static struct backlight_ops genericbl_ops = {
-+static const struct backlight_ops genericbl_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.get_brightness = genericbl_get_intensity,
- 	.update_status  = genericbl_send_intensity,
-diff -urNp linux-2.6.32.13/drivers/video/backlight/hp680_bl.c linux-2.6.32.13/drivers/video/backlight/hp680_bl.c
---- linux-2.6.32.13/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/hp680_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
- 	return current_intensity;
- }
- 
--static struct backlight_ops hp680bl_ops = {
-+static const struct backlight_ops hp680bl_ops = {
- 	.get_brightness = hp680bl_get_intensity,
- 	.update_status  = hp680bl_set_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c
---- linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/jornada720_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -93,7 +93,7 @@ out:
- 	return ret;
- }
- 
--static struct backlight_ops jornada_bl_ops = {
-+static const struct backlight_ops jornada_bl_ops = {
- 	.get_brightness = jornada_bl_get_brightness,
- 	.update_status = jornada_bl_update_status,
- 	.options = BL_CORE_SUSPENDRESUME,
-diff -urNp linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c
---- linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/kb3886_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
- 	return kb3886bl_intensity;
- }
- 
--static struct backlight_ops kb3886bl_ops = {
-+static const struct backlight_ops kb3886bl_ops = {
- 	.get_brightness = kb3886bl_get_intensity,
- 	.update_status  = kb3886bl_send_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/locomolcd.c linux-2.6.32.13/drivers/video/backlight/locomolcd.c
---- linux-2.6.32.13/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/locomolcd.c	2010-05-15 13:21:16.611030004 -0400
-@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
- 	return current_intensity;
- }
- 
--static struct backlight_ops locomobl_data = {
-+static const struct backlight_ops locomobl_data = {
- 	.get_brightness = locomolcd_get_intensity,
- 	.update_status  = locomolcd_set_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c
---- linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:38.397382140 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/mbp_nvidia_bl.c	2010-05-15 13:21:16.611030004 -0400
-@@ -33,7 +33,7 @@ struct dmi_match_data {
- 	unsigned long iostart;
- 	unsigned long iolen;
- 	/* Backlight operations structure. */
--	struct backlight_ops backlight_ops;
-+	const struct backlight_ops backlight_ops;
- };
- 
- /* Module parameters. */
-diff -urNp linux-2.6.32.13/drivers/video/backlight/omap1_bl.c linux-2.6.32.13/drivers/video/backlight/omap1_bl.c
---- linux-2.6.32.13/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/omap1_bl.c	2010-05-15 13:21:16.647199475 -0400
-@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
- 	return bl->current_intensity;
- }
- 
--static struct backlight_ops omapbl_ops = {
-+static const struct backlight_ops omapbl_ops = {
- 	.get_brightness = omapbl_get_intensity,
- 	.update_status  = omapbl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/progear_bl.c linux-2.6.32.13/drivers/video/backlight/progear_bl.c
---- linux-2.6.32.13/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/progear_bl.c	2010-05-15 13:21:16.647199475 -0400
-@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
- 	return intensity - HW_LEVEL_MIN;
- }
- 
--static struct backlight_ops progearbl_ops = {
-+static const struct backlight_ops progearbl_ops = {
- 	.get_brightness = progearbl_get_intensity,
- 	.update_status = progearbl_set_intensity,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/pwm_bl.c linux-2.6.32.13/drivers/video/backlight/pwm_bl.c
---- linux-2.6.32.13/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/pwm_bl.c	2010-05-15 13:21:16.647199475 -0400
-@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
- 	return bl->props.brightness;
- }
- 
--static struct backlight_ops pwm_backlight_ops = {
-+static const struct backlight_ops pwm_backlight_ops = {
- 	.update_status	= pwm_backlight_update_status,
- 	.get_brightness	= pwm_backlight_get_brightness,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/tosa_bl.c linux-2.6.32.13/drivers/video/backlight/tosa_bl.c
---- linux-2.6.32.13/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/tosa_bl.c	2010-05-15 13:21:16.647199475 -0400
-@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
- 	return props->brightness;
- }
- 
--static struct backlight_ops bl_ops = {
-+static const struct backlight_ops bl_ops = {
- 	.get_brightness		= tosa_bl_get_brightness,
- 	.update_status		= tosa_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c
---- linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/backlight/wm831x_bl.c	2010-05-15 13:21:16.647199475 -0400
-@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
- 	return data->current_brightness;
- }
- 
--static struct backlight_ops wm831x_backlight_ops = {
-+static const struct backlight_ops wm831x_backlight_ops = {
- 	.options = BL_CORE_SUSPENDRESUME,
- 	.update_status	= wm831x_backlight_update_status,
- 	.get_brightness	= wm831x_backlight_get_brightness,
-diff -urNp linux-2.6.32.13/drivers/video/bf54x-lq043fb.c linux-2.6.32.13/drivers/video/bf54x-lq043fb.c
---- linux-2.6.32.13/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/bf54x-lq043fb.c	2010-05-15 13:21:16.647199475 -0400
-@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c
---- linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/bfin-t350mcqb-fb.c	2010-05-15 13:21:16.647199475 -0400
-@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
- 	return 0;
- }
- 
--static struct backlight_ops bfin_lq043fb_bl_ops = {
-+static const struct backlight_ops bfin_lq043fb_bl_ops = {
- 	.get_brightness = bl_get_brightness,
- };
- 
-diff -urNp linux-2.6.32.13/drivers/video/fbcmap.c linux-2.6.32.13/drivers/video/fbcmap.c
---- linux-2.6.32.13/drivers/video/fbcmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/fbcmap.c	2010-05-15 13:21:16.647199475 -0400
-@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
- 		rc = -ENODEV;
- 		goto out;
- 	}
--	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
--				!info->fbops->fb_setcmap)) {
-+	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
- 		rc = -EINVAL;
- 		goto out1;
- 	}
-diff -urNp linux-2.6.32.13/drivers/video/fbmem.c linux-2.6.32.13/drivers/video/fbmem.c
---- linux-2.6.32.13/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/fbmem.c	2010-05-15 13:21:16.659032956 -0400
-@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dx += image->width + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_UD) {
--		for (x = 0; x < num && image->dx >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dx -= image->width + 8;
- 		}
-@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
- 			image->dy += image->height + 8;
- 		}
- 	} else if (rotate == FB_ROTATE_CCW) {
--		for (x = 0; x < num && image->dy >= 0; x++) {
-+		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
- 			info->fbops->fb_imageblit(info, image);
- 			image->dy -= image->height + 8;
- 		}
-@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
- 			return -EFAULT;
- 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
- 			return -EINVAL;
--		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
-+		if (con2fb.framebuffer >= FB_MAX)
- 			return -EINVAL;
- 		if (!registered_fb[con2fb.framebuffer])
- 			request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.32.13/drivers/video/fbmon.c linux-2.6.32.13/drivers/video/fbmon.c
---- linux-2.6.32.13/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/fbmon.c	2010-05-15 13:21:16.667905259 -0400
-@@ -45,7 +45,7 @@
- #ifdef DEBUG
- #define DPRINTK(fmt, args...) printk(fmt,## args)
- #else
--#define DPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
- #endif
- 
- #define FBMON_FIX_HEADER  1
-diff -urNp linux-2.6.32.13/drivers/video/i810/i810_accel.c linux-2.6.32.13/drivers/video/i810/i810_accel.c
---- linux-2.6.32.13/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/i810/i810_accel.c	2010-05-15 13:21:16.667905259 -0400
-@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
- 		}
- 	}
- 	printk("ringbuffer lockup!!!\n");
-+	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
- 	i810_report_error(mmio); 
- 	par->dev_flags |= LOCKUP;
- 	info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.32.13/drivers/video/i810/i810_main.c linux-2.6.32.13/drivers/video/i810/i810_main.c
---- linux-2.6.32.13/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/i810/i810_main.c	2010-05-15 13:21:16.675089243 -0400
-@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
- 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- static struct pci_driver i810fb_driver = {
-diff -urNp linux-2.6.32.13/drivers/video/modedb.c linux-2.6.32.13/drivers/video/modedb.c
---- linux-2.6.32.13/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/modedb.c	2010-05-15 13:21:16.691535841 -0400
-@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
-     {
- 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
- 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
- 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
- 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
- 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
- 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
--	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
- 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
- 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
- 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
- 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
- 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
- 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
- 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
- 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
- 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
--	0, FB_VMODE_INTERLACED
-+	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
- 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
- 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
- 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
- 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
- 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
--	0, FB_VMODE_NONINTERLACED   	
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
- 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
-         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
- 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
- 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
- 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
- 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
- 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
- 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
- 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
- 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
- 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
- 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
- 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
- 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
- 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
- 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
- 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
- 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
- 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
- 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
- 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
- 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
- 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
- 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
- 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
- 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
- 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
- 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
- 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
--	0, FB_VMODE_DOUBLE
-+	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
- 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
- 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--	FB_VMODE_NONINTERLACED
-+	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
- 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
--	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-+	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
- 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
- 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-    }, {
- 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
- 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
--	0, FB_VMODE_NONINTERLACED
-+	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     }, {
-        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
-        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
--       0, FB_VMODE_INTERLACED
-+       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
-     },
- };
- 
-diff -urNp linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c
---- linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/nvidia/nv_backlight.c	2010-05-15 13:21:16.691535841 -0400
-@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops nvidia_bl_ops = {
-+static const struct backlight_ops nvidia_bl_ops = {
- 	.get_brightness = nvidia_bl_get_brightness,
- 	.update_status	= nvidia_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/riva/fbdev.c linux-2.6.32.13/drivers/video/riva/fbdev.c
---- linux-2.6.32.13/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/riva/fbdev.c	2010-05-15 13:21:16.695039791 -0400
-@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
- 	return bd->props.brightness;
- }
- 
--static struct backlight_ops riva_bl_ops = {
-+static const struct backlight_ops riva_bl_ops = {
- 	.get_brightness = riva_bl_get_brightness,
- 	.update_status	= riva_bl_update_status,
- };
-diff -urNp linux-2.6.32.13/drivers/video/uvesafb.c linux-2.6.32.13/drivers/video/uvesafb.c
---- linux-2.6.32.13/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/uvesafb.c	2010-05-15 13:21:16.714782153 -0400
-@@ -18,6 +18,7 @@
- #include <linux/fb.h>
- #include <linux/io.h>
- #include <linux/mutex.h>
-+#include <linux/moduleloader.h>
- #include <video/edid.h>
- #include <video/uvesafb.h>
- #ifdef CONFIG_X86
-@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
- 		NULL,
- 	};
- 
--	return call_usermodehelper(v86d_path, argv, envp, 1);
-+	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
- }
- 
- /*
-@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
- 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
- 		par->pmi_setpal = par->ypan = 0;
- 	} else {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_MODULES
-+		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
-+#endif
-+		if (!par->pmi_code) {
-+			par->pmi_setpal = par->ypan = 0;
-+			return 0;
-+		}
-+#endif
-+
- 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
- 						+ task->t.regs.edi);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
-+		pax_close_kernel();
-+
-+		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
-+		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
-+#else
- 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
- 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
-+#endif
-+
- 		printk(KERN_INFO "uvesafb: protected mode interface info at "
- 				 "%04x:%04x\n",
- 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
-@@ -1799,6 +1822,11 @@ out:
- 	if (par->vbe_modes)
- 		kfree(par->vbe_modes);
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	if (par->pmi_code)
-+		module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 	framebuffer_release(info);
- 	return err;
- }
-@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
- 				kfree(par->vbe_state_orig);
- 			if (par->vbe_state_saved)
- 				kfree(par->vbe_state_saved);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+			if (par->pmi_code)
-+				module_free_exec(NULL, par->pmi_code);
-+#endif
-+
- 		}
- 
- 		framebuffer_release(info);
-diff -urNp linux-2.6.32.13/drivers/video/vesafb.c linux-2.6.32.13/drivers/video/vesafb.c
---- linux-2.6.32.13/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/video/vesafb.c	2010-05-15 13:21:16.727737170 -0400
-@@ -9,6 +9,7 @@
-  */
- 
- #include <linux/module.h>
-+#include <linux/moduleloader.h>
- #include <linux/kernel.h>
- #include <linux/errno.h>
- #include <linux/string.h>
-@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
- static int   vram_total __initdata;		/* Set total amount of memory */
- static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
- static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
--static void  (*pmi_start)(void) __read_mostly;
--static void  (*pmi_pal)  (void) __read_mostly;
-+static void  (*pmi_start)(void) __read_only;
-+static void  (*pmi_pal)  (void) __read_only;
- static int   depth      __read_mostly;
- static int   vga_compat __read_mostly;
- /* --------------------------------------------------------------------- */
-@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
- 	unsigned int size_vmode;
- 	unsigned int size_remap;
- 	unsigned int size_total;
-+	void *pmi_code = NULL;
- 
- 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
- 		return -ENODEV;
-@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
- 		size_remap = size_total;
- 	vesafb_fix.smem_len = size_remap;
- 
--#ifndef __i386__
--	screen_info.vesapm_seg = 0;
--#endif
--
- 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
- 		printk(KERN_WARNING
- 		       "vesafb: cannot reserve video memory at 0x%lx\n",
-@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
- 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
- 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
- 
-+#ifdef __i386__
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	pmi_code = module_alloc_exec(screen_info.vesapm_size);
-+	if (!pmi_code)
-+#elif !defined(CONFIG_PAX_KERNEXEC)
-+	if (0)
-+#endif
-+
-+#endif
-+	screen_info.vesapm_seg = 0;
-+
- 	if (screen_info.vesapm_seg) {
--		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
--		       screen_info.vesapm_seg,screen_info.vesapm_off);
-+		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
-+		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
- 	}
- 
- 	if (screen_info.vesapm_seg < 0xc000)
-@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
- 
- 	if (ypan || pmi_setpal) {
- 		unsigned short *pmi_base;
--		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
--		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
--		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
-+
-+		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pax_open_kernel();
-+		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
-+#else
-+		pmi_code = pmi_base;
-+#endif
-+
-+		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
-+		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+		pmi_start = ktva_ktla(pmi_start);
-+		pmi_pal = ktva_ktla(pmi_pal);
-+		pax_close_kernel();
-+#endif
-+
- 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
- 		if (pmi_base[3]) {
- 			printk(KERN_INFO "vesafb: pmi: ports = ");
-@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
- 	       info->node, info->fix.id);
- 	return 0;
- err:
-+
-+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
-+	module_free_exec(NULL, pmi_code);
-+#endif
-+
- 	if (info->screen_base)
- 		iounmap(info->screen_base);
- 	framebuffer_release(info);
-diff -urNp linux-2.6.32.13/drivers/xen/sys-hypervisor.c linux-2.6.32.13/drivers/xen/sys-hypervisor.c
---- linux-2.6.32.13/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/drivers/xen/sys-hypervisor.c	2010-05-15 13:21:16.727737170 -0400
-@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
- 	return 0;
- }
- 
--static struct sysfs_ops hyp_sysfs_ops = {
-+static const struct sysfs_ops hyp_sysfs_ops = {
- 	.show = hyp_sysfs_show,
- 	.store = hyp_sysfs_store,
- };
-diff -urNp linux-2.6.32.13/fs/9p/vfs_inode.c linux-2.6.32.13/fs/9p/vfs_inode.c
---- linux-2.6.32.13/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/9p/vfs_inode.c	2010-05-15 13:21:16.735266886 -0400
-@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
- static void
- v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 
- 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
- 		IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.32.13/fs/aio.c linux-2.6.32.13/fs/aio.c
---- linux-2.6.32.13/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/aio.c	2010-05-15 13:21:16.759050469 -0400
-@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
- 	size += sizeof(struct io_event) * nr_events;
- 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
- 
--	if (nr_pages < 0)
-+	if (nr_pages <= 0)
- 		return -EINVAL;
- 
- 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-diff -urNp linux-2.6.32.13/fs/attr.c linux-2.6.32.13/fs/attr.c
---- linux-2.6.32.13/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/attr.c	2010-05-15 13:21:16.767048242 -0400
-@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
- 		unsigned long limit;
- 
- 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
-+		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
- 		if (limit != RLIM_INFINITY && offset > limit)
- 			goto out_sig;
- 		if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.32.13/fs/autofs/root.c linux-2.6.32.13/fs/autofs/root.c
---- linux-2.6.32.13/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/autofs/root.c	2010-05-15 13:21:16.770726483 -0400
-@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
- 	set_bit(n,sbi->symlink_bitmap);
- 	sl = &sbi->symlink[n];
- 	sl->len = strlen(symname);
--	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
-+	slsize = sl->len+1;
-+	sl->data = kmalloc(slsize, GFP_KERNEL);
- 	if (!sl->data) {
- 		clear_bit(n,sbi->symlink_bitmap);
- 		unlock_kernel();
-diff -urNp linux-2.6.32.13/fs/autofs4/symlink.c linux-2.6.32.13/fs/autofs4/symlink.c
---- linux-2.6.32.13/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/autofs4/symlink.c	2010-05-15 13:21:16.786757439 -0400
-@@ -15,7 +15,7 @@
- static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
- {
- 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
--	nd_set_link(nd, (char *)ino->u.symlink);
-+	nd_set_link(nd, ino->u.symlink);
- 	return NULL;
- }
- 
-diff -urNp linux-2.6.32.13/fs/befs/linuxvfs.c linux-2.6.32.13/fs/befs/linuxvfs.c
---- linux-2.6.32.13/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/befs/linuxvfs.c	2010-05-15 13:21:16.795284033 -0400
-@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
- {
- 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
- 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
--		char *link = nd_get_link(nd);
-+		const char *link = nd_get_link(nd);
- 		if (!IS_ERR(link))
- 			kfree(link);
- 	}
-diff -urNp linux-2.6.32.13/fs/binfmt_aout.c linux-2.6.32.13/fs/binfmt_aout.c
---- linux-2.6.32.13/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/binfmt_aout.c	2010-05-15 13:21:16.799043518 -0400
-@@ -16,6 +16,7 @@
- #include <linux/string.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/stat.h>
- #include <linux/fcntl.h>
- #include <linux/ptrace.h>
-@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
- 
- /* If the size of the dump file exceeds the rlimit, then see what would happen
-    if we wrote the stack, but not the data area.  */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
- 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
- 		dump.u_dsize = 0;
- 
- /* Make sure we have enough room to write the stack and data areas. */
-+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
- 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
- 		dump.u_ssize = 0;
- 
-@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
- 	if (rlim >= RLIM_INFINITY)
- 		rlim = ~0;
-+
-+	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
- 	if (ex.a_data + ex.a_bss > rlim)
- 		return -ENOMEM;
- 
-@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
- 	install_exec_creds(bprm);
-  	current->flags &= ~PF_FORKNOEXEC;
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
-+		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
-+			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
-+			current->mm->pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+	}
-+#endif
-+
- 	if (N_MAGIC(ex) == OMAGIC) {
- 		unsigned long text_addr, map_size;
- 		loff_t pos;
-@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
- 
- 		down_write(&current->mm->mmap_sem);
-  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
--				PROT_READ | PROT_WRITE | PROT_EXEC,
-+				PROT_READ | PROT_WRITE,
- 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
- 				fd_offset + ex.a_text);
- 		up_write(&current->mm->mmap_sem);
-diff -urNp linux-2.6.32.13/fs/binfmt_elf.c linux-2.6.32.13/fs/binfmt_elf.c
---- linux-2.6.32.13/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/binfmt_elf.c	2010-05-15 13:21:16.818718975 -0400
-@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
- #define elf_core_dump	NULL
- #endif
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
-+#endif
-+
- #if ELF_EXEC_PAGESIZE > PAGE_SIZE
- #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
- #else
-@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
- 		.load_binary	= load_elf_binary,
- 		.load_shlib	= load_elf_library,
- 		.core_dump	= elf_core_dump,
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		.handle_mprotect= elf_handle_mprotect,
-+#endif
-+
- 		.min_coredump	= ELF_EXEC_PAGESIZE,
- 		.hasvdso	= 1
- };
-@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
- 
- static int set_brk(unsigned long start, unsigned long end)
- {
-+	unsigned long e = end;
-+
- 	start = ELF_PAGEALIGN(start);
- 	end = ELF_PAGEALIGN(end);
- 	if (end > start) {
-@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
- 		if (BAD_ADDR(addr))
- 			return addr;
- 	}
--	current->mm->start_brk = current->mm->brk = end;
-+	current->mm->start_brk = current->mm->brk = e;
- 	return 0;
- }
- 
-@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
- 	elf_addr_t __user *u_rand_bytes;
- 	const char *k_platform = ELF_PLATFORM;
- 	const char *k_base_platform = ELF_BASE_PLATFORM;
--	unsigned char k_rand_bytes[16];
-+	u32 k_rand_bytes[4];
- 	int items;
- 	elf_addr_t *elf_info;
- 	int ei_index = 0;
-@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
- 	 * Generate 16 random bytes for userspace PRNG seeding.
- 	 */
- 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
--	u_rand_bytes = (elf_addr_t __user *)
--		       STACK_ALLOC(p, sizeof(k_rand_bytes));
-+	srandom32(k_rand_bytes[0] ^ random32());
-+	srandom32(k_rand_bytes[1] ^ random32());
-+	srandom32(k_rand_bytes[2] ^ random32());
-+	srandom32(k_rand_bytes[3] ^ random32());
-+	p = STACK_ROUND(p, sizeof(k_rand_bytes));
-+	u_rand_bytes = (elf_addr_t __user *) p;
- 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
- 		return -EFAULT;
- 
-@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
- {
- 	struct elf_phdr *elf_phdata;
- 	struct elf_phdr *eppnt;
--	unsigned long load_addr = 0;
-+	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
- 	int load_addr_set = 0;
- 	unsigned long last_bss = 0, elf_bss = 0;
--	unsigned long error = ~0UL;
-+	unsigned long error = -EINVAL;
- 	unsigned long total_size;
- 	int retval, i, size;
- 
-@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
- 		goto out_close;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	eppnt = elf_phdata;
- 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
- 		if (eppnt->p_type == PT_LOAD) {
-@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
- 			k = load_addr + eppnt->p_vaddr;
- 			if (BAD_ADDR(k) ||
- 			    eppnt->p_filesz > eppnt->p_memsz ||
--			    eppnt->p_memsz > TASK_SIZE ||
--			    TASK_SIZE - eppnt->p_memsz < k) {
-+			    eppnt->p_memsz > pax_task_size ||
-+			    pax_task_size - eppnt->p_memsz < k) {
- 				error = -ENOMEM;
- 				goto out_close;
- 			}
-@@ -532,6 +552,177 @@ out:
- 	return error;
- }
- 
-+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
-+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (elf_phdata->p_flags & PF_PAGEEXEC)
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (elf_phdata->p_flags & PF_SEGMEXEC)
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (elf_phdata->p_flags & PF_EMUTRAMP)
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (elf_phdata->p_flags & PF_MPROTECT)
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
-+	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
-+		pax_flags |= MF_PAX_PAGEEXEC;
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
-+		pax_flags |= MF_PAX_SEGMEXEC;
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		if (nx_enabled)
-+			pax_flags &= ~MF_PAX_SEGMEXEC;
-+		else
-+			pax_flags &= ~MF_PAX_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
-+		pax_flags |= MF_PAX_EMUTRAMP;
-+#endif
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
-+		pax_flags |= MF_PAX_MPROTECT;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
-+		pax_flags |= MF_PAX_RANDMMAP;
-+#endif
-+
-+	return pax_flags;
-+}
-+#endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
-+{
-+	unsigned long pax_flags = 0UL;
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	unsigned long i;
-+#endif
-+
-+#ifdef CONFIG_PAX_EI_PAX
-+	pax_flags = pax_parse_ei_pax(elf_ex);
-+#endif
-+
-+#ifdef CONFIG_PAX_PT_PAX_FLAGS
-+	for (i = 0UL; i < elf_ex->e_phnum; i++)
-+		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
-+			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
-+			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
-+			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
-+			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
-+				return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+			if (pax_softmode)
-+				pax_flags = pax_parse_softmode(&elf_phdata[i]);
-+			else
-+#endif
-+
-+				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
-+			break;
-+		}
-+#endif
-+
-+	if (0 > pax_check_flags(&pax_flags))
-+		return -EINVAL;
-+
-+	current->mm->pax_flags = pax_flags;
-+	return 0;
-+}
-+#endif
-+
- /*
-  * These are the functions used to load ELF style executables and shared
-  * libraries.  There is no binary dependent code anywhere else.
-@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
- {
- 	unsigned int random_variable = 0;
- 
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		return stack_top - current->mm->delta_stack;
-+#endif
-+
- 	if ((current->flags & PF_RANDOMIZE) &&
- 		!(current->personality & ADDR_NO_RANDOMIZE)) {
- 		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
-  	unsigned long load_addr = 0, load_bias = 0;
- 	int load_addr_set = 0;
- 	char * elf_interpreter = NULL;
--	unsigned long error;
-+	unsigned long error = 0;
- 	struct elf_phdr *elf_ppnt, *elf_phdata;
- 	unsigned long elf_bss, elf_brk;
- 	int retval, i;
-@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
- 	unsigned long start_code, end_code, start_data, end_data;
- 	unsigned long reloc_func_desc = 0;
- 	int executable_stack = EXSTACK_DEFAULT;
--	unsigned long def_flags = 0;
- 	struct {
- 		struct elfhdr elf_ex;
- 		struct elfhdr interp_elf_ex;
- 	} *loc;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
- 	if (!loc) {
-@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
- 
- 	/* OK, This is the point of no return */
- 	current->flags &= ~PF_FORKNOEXEC;
--	current->mm->def_flags = def_flags;
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	current->mm->pax_flags = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	current->mm->call_dl_resolve = 0UL;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	current->mm->call_syscall = 0UL;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	current->mm->delta_mmap = 0UL;
-+	current->mm->delta_stack = 0UL;
-+#endif
-+
-+	current->mm->def_flags = 0;
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
-+	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
-+		send_sig(SIGKILL, current, 0);
-+		goto out_free_dentry;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+	pax_set_initial_flags(bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+	if (pax_set_initial_flags_func)
-+		(pax_set_initial_flags_func)(bprm);
-+#endif
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
-+		current->mm->context.user_cs_limit = PAGE_SIZE;
-+		current->mm->def_flags |= VM_PAGEEXEC;
-+	}
-+#endif
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
-+		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+	}
-+#endif
-+
-+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
-+		put_cpu();
-+	}
-+#endif
- 
- 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
- 	   may depend on the personality.  */
- 	SET_PERSONALITY(loc->elf_ex);
-+
-+#ifdef CONFIG_PAX_ASLR
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
-+		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
-+		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		executable_stack = EXSTACK_DISABLE_X;
-+		current->personality &= ~READ_IMPLIES_EXEC;
-+	} else
-+#endif
-+
- 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
- 		current->personality |= READ_IMPLIES_EXEC;
- 
-@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
- #else
- 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
- #endif
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+			/* PaX: randomize base address at the default exe base if requested */
-+			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
-+#ifdef CONFIG_SPARC64
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
-+#else
-+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
-+#endif
-+				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
-+				elf_flags |= MAP_FIXED;
-+			}
-+#endif
-+
- 		}
- 
- 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
- 		 * allowed task size. Note that p_filesz must always be
- 		 * <= p_memsz so it is only necessary to check p_memsz.
- 		 */
--		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
--		    elf_ppnt->p_memsz > TASK_SIZE ||
--		    TASK_SIZE - elf_ppnt->p_memsz < k) {
-+		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-+		    elf_ppnt->p_memsz > pax_task_size ||
-+		    pax_task_size - elf_ppnt->p_memsz < k) {
- 			/* set_brk can never work. Avoid overflows. */
- 			send_sig(SIGKILL, current, 0);
- 			retval = -EINVAL;
-@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
- 	start_data += load_bias;
- 	end_data += load_bias;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
-+		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
-+#endif
-+
- 	/* Calling set_brk effectively mmaps the pages that we need
- 	 * for the bss and break sections.  We must do this before
- 	 * mapping in the interpreter, to make sure it doesn't wind
-@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
- 		goto out_free_dentry;
- 	}
- 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
--		send_sig(SIGSEGV, current, 0);
--		retval = -EFAULT; /* Nobody gets to see this, but.. */
--		goto out_free_dentry;
-+		/*
-+		 * This bss-zeroing can fail if the ELF
-+		 * file specifies odd protections. So
-+		 * we don't check the return value
-+		 */
- 	}
- 
- 	if (elf_interpreter) {
-@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
- 			unsigned long n = off;
- 			if (n > PAGE_SIZE)
- 				n = PAGE_SIZE;
--			if (!dump_write(file, buf, n))
-+			if (!dump_write(file, buf, n)) {
-+				free_page((unsigned long)buf);
- 				return 0;
-+			}
- 			off -= n;
- 		}
- 		free_page((unsigned long)buf);
-@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
-  * Decide what to dump of a segment, part, all or none.
-  */
- static unsigned long vma_dump_size(struct vm_area_struct *vma,
--				   unsigned long mm_flags)
-+				   unsigned long mm_flags, long signr)
- {
- #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
- 
-@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
- 	if (vma->vm_file == NULL)
- 		return 0;
- 
--	if (FILTER(MAPPED_PRIVATE))
-+	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
- 		goto whole;
- 
- 	/*
-@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
- #undef DUMP_WRITE
- 
- #define DUMP_WRITE(addr, nr)	\
-+	do { \
-+	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
- 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
--		goto end_coredump;
-+		goto end_coredump; \
-+	} while (0);
- 
- static void fill_elf_header(struct elfhdr *elf, int segs,
- 			    u16 machine, u32 flags, u8 osabi)
-@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
- {
- 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
- 	int i = 0;
--	do
-+	do {
- 		i += 2;
--	while (auxv[i - 2] != AT_NULL);
-+	} while (auxv[i - 2] != AT_NULL);
- 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
- }
- 
-@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
- 		phdr.p_offset = offset;
- 		phdr.p_vaddr = vma->vm_start;
- 		phdr.p_paddr = 0;
--		phdr.p_filesz = vma_dump_size(vma, mm_flags);
-+		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
- 		phdr.p_memsz = vma->vm_end - vma->vm_start;
- 		offset += phdr.p_filesz;
- 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
- 		unsigned long addr;
- 		unsigned long end;
- 
--		end = vma->vm_start + vma_dump_size(vma, mm_flags);
-+		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
- 
- 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
- 			struct page *page;
-@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
- 			page = get_dump_page(addr);
- 			if (page) {
- 				void *kaddr = kmap(page);
-+				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
- 				stop = ((size += PAGE_SIZE) > limit) ||
- 					!dump_write(file, kaddr, PAGE_SIZE);
- 				kunmap(page);
-@@ -2042,6 +2334,97 @@ out:
- 
- #endif		/* USE_ELF_CORE_DUMP */
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+/* PaX: non-PIC ELF libraries need relocations on their executable segments
-+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
-+ * we'll remove VM_MAYWRITE for good on RELRO segments.
-+ *
-+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
-+ * basis because we want to allow the common case and not the special ones.
-+ */
-+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
-+{
-+	struct elfhdr elf_h;
-+	struct elf_phdr elf_p;
-+	unsigned long i;
-+	unsigned long oldflags;
-+	bool is_textrel_rw, is_textrel_rx, is_relro;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
-+		return;
-+
-+	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
-+	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
-+
-+#ifdef CONFIG_PAX_NOELFRELOCS
-+	is_textrel_rw = false;
-+	is_textrel_rx = false;
-+#else
-+	/* possible TEXTREL */
-+	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
-+	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
-+#endif
-+
-+	/* possible RELRO */
-+	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
-+
-+	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
-+		return;
-+
-+	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
-+	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
-+
-+#ifdef CONFIG_PAX_ETEXECRELOCS
-+	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+#else
-+	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
-+#endif
-+
-+	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
-+	    !elf_check_arch(&elf_h) ||
-+	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
-+	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
-+		return;
-+
-+	for (i = 0UL; i < elf_h.e_phnum; i++) {
-+		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
-+			return;
-+		switch (elf_p.p_type) {
-+		case PT_DYNAMIC:
-+			if (!is_textrel_rw && !is_textrel_rx)
-+				continue;
-+			i = 0UL;
-+			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
-+				elf_dyn dyn;
-+
-+				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
-+					return;
-+				if (dyn.d_tag == DT_NULL)
-+					return;
-+				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
-+					gr_log_textrel(vma);
-+					if (is_textrel_rw)
-+						vma->vm_flags |= VM_MAYWRITE;
-+					else
-+						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
-+						vma->vm_flags &= ~VM_MAYWRITE;
-+					return;
-+				}
-+				i++;
-+			}
-+			return;
-+
-+		case PT_GNU_RELRO:
-+			if (!is_relro)
-+				continue;
-+			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
-+				vma->vm_flags &= ~VM_MAYWRITE;
-+			return;
-+		}
-+	}
-+}
-+#endif
-+
- static int __init init_elf_binfmt(void)
- {
- 	return register_binfmt(&elf_format);
-diff -urNp linux-2.6.32.13/fs/binfmt_flat.c linux-2.6.32.13/fs/binfmt_flat.c
---- linux-2.6.32.13/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/binfmt_flat.c	2010-05-15 13:21:16.818718975 -0400
-@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
- 				realdatastart = (unsigned long) -ENOMEM;
- 			printk("Unable to allocate RAM for process data, errno %d\n",
- 					(int)-realdatastart);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
-+			up_write(&current->mm->mmap_sem);
- 			ret = realdatastart;
- 			goto err;
- 		}
-@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read data+bss, errno %d\n", (int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len);
- 			do_munmap(current->mm, realdatastart, data_len + extra);
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
- 		}
- 		if (IS_ERR_VALUE(result)) {
- 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
-+			down_write(&current->mm->mmap_sem);
- 			do_munmap(current->mm, textpos, text_len + data_len + extra +
- 				MAX_SHARED_LIBS * sizeof(unsigned long));
-+			up_write(&current->mm->mmap_sem);
- 			ret = result;
- 			goto err;
- 		}
-diff -urNp linux-2.6.32.13/fs/binfmt_misc.c linux-2.6.32.13/fs/binfmt_misc.c
---- linux-2.6.32.13/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/binfmt_misc.c	2010-05-15 13:21:16.827094561 -0400
-@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
- 	static struct tree_descr bm_files[] = {
- 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
- 		[3] = {"register", &bm_register_operations, S_IWUSR},
--		/* last one */ {""}
-+		/* last one */ {"", NULL, 0}
- 	};
- 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
- 	if (!err)
-diff -urNp linux-2.6.32.13/fs/bio.c linux-2.6.32.13/fs/bio.c
---- linux-2.6.32.13/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/bio.c	2010-05-15 13:21:16.827094561 -0400
-@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
- 
- 	i = 0;
- 	while (i < bio_slab_nr) {
--		struct bio_slab *bslab = &bio_slabs[i];
-+		bslab = &bio_slabs[i];
- 
- 		if (!bslab->slab && entry == -1)
- 			entry = i;
-@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
- 	const int read = bio_data_dir(bio) == READ;
- 	struct bio_map_data *bmd = bio->bi_private;
- 	int i;
--	char *p = bmd->sgvecs[0].iov_base;
-+	char *p = (__force char *)bmd->sgvecs[0].iov_base;
- 
- 	__bio_for_each_segment(bvec, bio, i, 0) {
- 		char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.32.13/fs/block_dev.c linux-2.6.32.13/fs/block_dev.c
---- linux-2.6.32.13/fs/block_dev.c	2010-04-29 17:49:38.421500081 -0400
-+++ linux-2.6.32.13/fs/block_dev.c	2010-05-15 13:21:16.839060742 -0400
-@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, 
- 	else if (bdev->bd_contains == bdev)
- 		res = 0;  	 /* is a whole device which isn't held */
- 
--	else if (bdev->bd_contains->bd_holder == bd_claim)
-+	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
- 		res = 0; 	 /* is a partition of a device that is being partitioned */
- 	else if (bdev->bd_contains->bd_holder != NULL)
- 		res = -EBUSY;	 /* is a partition of a held device */
-diff -urNp linux-2.6.32.13/fs/btrfs/ctree.c linux-2.6.32.13/fs/btrfs/ctree.c
---- linux-2.6.32.13/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/ctree.c	2010-05-15 13:21:16.884750763 -0400
-@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
- 
- 	ret = 0;
- 	if (slot == 0) {
--		struct btrfs_disk_key disk_key;
- 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
- 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
- 	}
-diff -urNp linux-2.6.32.13/fs/btrfs/disk-io.c linux-2.6.32.13/fs/btrfs/disk-io.c
---- linux-2.6.32.13/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/disk-io.c	2010-05-15 13:21:16.884750763 -0400
-@@ -39,7 +39,7 @@
- #include "tree-log.h"
- #include "free-space-cache.h"
- 
--static struct extent_io_ops btree_extent_io_ops;
-+static const struct extent_io_ops btree_extent_io_ops;
- static void end_workqueue_fn(struct btrfs_work *work);
- static void free_fs_root(struct btrfs_root *root);
- 
-@@ -2585,7 +2585,7 @@ out:
- 	return 0;
- }
- 
--static struct extent_io_ops btree_extent_io_ops = {
-+static const struct extent_io_ops btree_extent_io_ops = {
- 	.write_cache_pages_lock_hook = btree_lock_page_hook,
- 	.readpage_end_io_hook = btree_readpage_end_io_hook,
- 	.submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.32.13/fs/btrfs/extent_io.h linux-2.6.32.13/fs/btrfs/extent_io.h
---- linux-2.6.32.13/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/extent_io.h	2010-05-15 13:21:16.911563863 -0400
-@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
- 				       struct bio *bio, int mirror_num,
- 				       unsigned long bio_flags);
- struct extent_io_ops {
--	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
-+	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
- 			     u64 start, u64 end, int *page_started,
- 			     unsigned long *nr_written);
--	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
--	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
-+	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
- 	extent_submit_bio_hook_t *submit_bio_hook;
--	int (*merge_bio_hook)(struct page *page, unsigned long offset,
-+	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
- 			      size_t size, struct bio *bio,
- 			      unsigned long bio_flags);
--	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
--	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
-+	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
- 				       u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
-+	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
- 					u64 start, u64 end,
- 				       struct extent_state *state);
--	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				    struct extent_state *state);
--	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
-+	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
- 				      struct extent_state *state, int uptodate);
--	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
-+	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
- 			    unsigned long old, unsigned long bits);
--	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
-+	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
- 			      unsigned long bits);
--	int (*merge_extent_hook)(struct inode *inode,
-+	int (* const merge_extent_hook)(struct inode *inode,
- 				 struct extent_state *new,
- 				 struct extent_state *other);
--	int (*split_extent_hook)(struct inode *inode,
-+	int (* const split_extent_hook)(struct inode *inode,
- 				 struct extent_state *orig, u64 split);
--	int (*write_cache_pages_lock_hook)(struct page *page);
-+	int (* const write_cache_pages_lock_hook)(struct page *page);
- };
- 
- struct extent_io_tree {
-@@ -88,7 +88,7 @@ struct extent_io_tree {
- 	u64 dirty_bytes;
- 	spinlock_t lock;
- 	spinlock_t buffer_lock;
--	struct extent_io_ops *ops;
-+	const struct extent_io_ops *ops;
- };
- 
- struct extent_state {
-diff -urNp linux-2.6.32.13/fs/btrfs/free-space-cache.c linux-2.6.32.13/fs/btrfs/free-space-cache.c
---- linux-2.6.32.13/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/free-space-cache.c	2010-05-15 13:21:16.918599051 -0400
-@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
- 
- 	while(1) {
- 		if (entry->bytes < bytes || entry->offset < min_start) {
--			struct rb_node *node;
--
- 			node = rb_next(&entry->offset_index);
- 			if (!node)
- 				break;
-@@ -1226,7 +1224,7 @@ again:
- 	 */
- 	while (entry->bitmap || found_bitmap ||
- 	       (!entry->bitmap && entry->bytes < min_bytes)) {
--		struct rb_node *node = rb_next(&entry->offset_index);
-+		node = rb_next(&entry->offset_index);
- 
- 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
- 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.32.13/fs/btrfs/inode.c linux-2.6.32.13/fs/btrfs/inode.c
---- linux-2.6.32.13/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/inode.c	2010-05-15 13:21:16.951236359 -0400
-@@ -63,7 +63,7 @@ static const struct inode_operations btr
- static const struct address_space_operations btrfs_aops;
- static const struct address_space_operations btrfs_symlink_aops;
- static const struct file_operations btrfs_dir_file_operations;
--static struct extent_io_ops btrfs_extent_io_ops;
-+static const struct extent_io_ops btrfs_extent_io_ops;
- 
- static struct kmem_cache *btrfs_inode_cachep;
- struct kmem_cache *btrfs_trans_handle_cachep;
-@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
- 	.fsync		= btrfs_sync_file,
- };
- 
--static struct extent_io_ops btrfs_extent_io_ops = {
-+static const struct extent_io_ops btrfs_extent_io_ops = {
- 	.fill_delalloc = run_delalloc_range,
- 	.submit_bio_hook = btrfs_submit_bio_hook,
- 	.merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.32.13/fs/btrfs/sysfs.c linux-2.6.32.13/fs/btrfs/sysfs.c
---- linux-2.6.32.13/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/btrfs/sysfs.c	2010-05-15 13:21:16.956074066 -0400
-@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
- 	complete(&root->kobj_unregister);
- }
- 
--static struct sysfs_ops btrfs_super_attr_ops = {
-+static const struct sysfs_ops btrfs_super_attr_ops = {
- 	.show	= btrfs_super_attr_show,
- 	.store	= btrfs_super_attr_store,
- };
- 
--static struct sysfs_ops btrfs_root_attr_ops = {
-+static const struct sysfs_ops btrfs_root_attr_ops = {
- 	.show	= btrfs_root_attr_show,
- 	.store	= btrfs_root_attr_store,
- };
-diff -urNp linux-2.6.32.13/fs/buffer.c linux-2.6.32.13/fs/buffer.c
---- linux-2.6.32.13/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/buffer.c	2010-05-15 13:21:16.978563593 -0400
-@@ -25,6 +25,7 @@
- #include <linux/percpu.h>
- #include <linux/slab.h>
- #include <linux/capability.h>
-+#include <linux/security.h>
- #include <linux/blkdev.h>
- #include <linux/file.h>
- #include <linux/quotaops.h>
-diff -urNp linux-2.6.32.13/fs/cachefiles/bind.c linux-2.6.32.13/fs/cachefiles/bind.c
---- linux-2.6.32.13/fs/cachefiles/bind.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/cachefiles/bind.c	2010-05-15 13:21:16.978563593 -0400
-@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
- 	       args);
- 
- 	/* start by checking things over */
--	ASSERT(cache->fstop_percent >= 0 &&
--	       cache->fstop_percent < cache->fcull_percent &&
-+	ASSERT(cache->fstop_percent < cache->fcull_percent &&
- 	       cache->fcull_percent < cache->frun_percent &&
- 	       cache->frun_percent  < 100);
- 
--	ASSERT(cache->bstop_percent >= 0 &&
--	       cache->bstop_percent < cache->bcull_percent &&
-+	ASSERT(cache->bstop_percent < cache->bcull_percent &&
- 	       cache->bcull_percent < cache->brun_percent &&
- 	       cache->brun_percent  < 100);
- 
-diff -urNp linux-2.6.32.13/fs/cachefiles/daemon.c linux-2.6.32.13/fs/cachefiles/daemon.c
---- linux-2.6.32.13/fs/cachefiles/daemon.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/cachefiles/daemon.c	2010-05-15 13:21:16.995071409 -0400
-@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
- 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
- 		return -EIO;
- 
--	if (datalen < 0 || datalen > PAGE_SIZE - 1)
-+	if (datalen > PAGE_SIZE - 1)
- 		return -EOPNOTSUPP;
- 
- 	/* drag the command string into the kernel so we can parse it */
-@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
- 	if (args[0] != '%' || args[1] != '\0')
- 		return -EINVAL;
- 
--	if (fstop < 0 || fstop >= cache->fcull_percent)
-+	if (fstop >= cache->fcull_percent)
- 		return cachefiles_daemon_range_error(cache, args);
- 
- 	cache->fstop_percent = fstop;
-@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
- 	if (args[0] != '%' || args[1] != '\0')
- 		return -EINVAL;
- 
--	if (bstop < 0 || bstop >= cache->bcull_percent)
-+	if (bstop >= cache->bcull_percent)
- 		return cachefiles_daemon_range_error(cache, args);
- 
- 	cache->bstop_percent = bstop;
-diff -urNp linux-2.6.32.13/fs/cachefiles/rdwr.c linux-2.6.32.13/fs/cachefiles/rdwr.c
---- linux-2.6.32.13/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/cachefiles/rdwr.c	2010-05-15 13:21:16.995071409 -0400
-@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
- 			old_fs = get_fs();
- 			set_fs(KERNEL_DS);
- 			ret = file->f_op->write(
--				file, (const void __user *) data, len, &pos);
-+				file, (__force const void __user *) data, len, &pos);
- 			set_fs(old_fs);
- 			kunmap(page);
- 			if (ret != len)
-diff -urNp linux-2.6.32.13/fs/cifs/cifs_uniupr.h linux-2.6.32.13/fs/cifs/cifs_uniupr.h
---- linux-2.6.32.13/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/cifs/cifs_uniupr.h	2010-05-15 13:21:16.995071409 -0400
-@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
- 	{0x0490, 0x04cc, UniCaseRangeU0490},
- 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
- 	{0xff40, 0xff5a, UniCaseRangeUff40},
--	{0}
-+	{0, 0, NULL}
- };
- #endif
- 
-diff -urNp linux-2.6.32.13/fs/cifs/link.c linux-2.6.32.13/fs/cifs/link.c
---- linux-2.6.32.13/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/cifs/link.c	2010-05-15 13:21:16.995071409 -0400
-@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
- 
- void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
- {
--	char *p = nd_get_link(nd);
-+	const char *p = nd_get_link(nd);
- 	if (!IS_ERR(p))
- 		kfree(p);
- }
-diff -urNp linux-2.6.32.13/fs/compat_binfmt_elf.c linux-2.6.32.13/fs/compat_binfmt_elf.c
---- linux-2.6.32.13/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/compat_binfmt_elf.c	2010-05-15 13:21:16.995071409 -0400
-@@ -29,10 +29,12 @@
- #undef	elfhdr
- #undef	elf_phdr
- #undef	elf_note
-+#undef	elf_dyn
- #undef	elf_addr_t
- #define elfhdr		elf32_hdr
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
-+#define elf_dyn		Elf32_Dyn
- #define elf_addr_t	Elf32_Addr
- 
- /*
-diff -urNp linux-2.6.32.13/fs/compat.c linux-2.6.32.13/fs/compat.c
---- linux-2.6.32.13/fs/compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/compat.c	2010-05-15 13:21:17.027084488 -0400
-@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
- 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
- 				struct page *page;
- 
--#ifdef CONFIG_STACK_GROWSUP
- 				ret = expand_stack_downwards(bprm->vma, pos);
- 				if (ret < 0) {
- 					/* We've exceed the stack rlimit. */
- 					ret = -E2BIG;
- 					goto out;
- 				}
--#endif
- 				ret = get_user_pages(current, bprm->mm, pos,
- 						     1, 1, 1, &page, NULL);
- 				if (ret <= 0) {
-@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
- 	compat_uptr_t __user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+	retval = -EAGAIN;
-+	if (gr_handle_nproc())
-+		goto out_file;
-+	retval = -EACCES;
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
-+		goto out_file;
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, (char __user * __user *)argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	retval = search_binary_handler(bprm, regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1543,6 +1585,14 @@ int compat_do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput(bprm->mm);
-diff -urNp linux-2.6.32.13/fs/compat_ioctl.c linux-2.6.32.13/fs/compat_ioctl.c
---- linux-2.6.32.13/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/compat_ioctl.c	2010-05-15 13:21:17.050796208 -0400
-@@ -1827,15 +1827,15 @@ struct ioctl_trans {
- };
- 
- #define HANDLE_IOCTL(cmd,handler) \
--	{ (cmd), (ioctl_trans_handler_t)(handler) },
-+	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
- 
- /* pointer to compatible structure or no argument */
- #define COMPATIBLE_IOCTL(cmd) \
--	{ (cmd), do_ioctl32_pointer },
-+	{ (cmd), do_ioctl32_pointer, NULL },
- 
- /* argument is an unsigned long integer, not a pointer */
- #define ULONG_IOCTL(cmd) \
--	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
-+	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
- 
- /* ioctl should not be warned about even if it's not implemented.
-    Valid reasons to use this:
-diff -urNp linux-2.6.32.13/fs/debugfs/inode.c linux-2.6.32.13/fs/debugfs/inode.c
---- linux-2.6.32.13/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/debugfs/inode.c	2010-05-15 13:21:17.062663383 -0400
-@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
- 
- static int debug_fill_super(struct super_block *sb, void *data, int silent)
- {
--	static struct tree_descr debug_files[] = {{""}};
-+	static struct tree_descr debug_files[] = {{"", NULL, 0}};
- 
- 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
- }
-diff -urNp linux-2.6.32.13/fs/dlm/lockspace.c linux-2.6.32.13/fs/dlm/lockspace.c
---- linux-2.6.32.13/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/dlm/lockspace.c	2010-05-15 13:21:17.082686362 -0400
-@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
- 	kfree(ls);
- }
- 
--static struct sysfs_ops dlm_attr_ops = {
-+static const struct sysfs_ops dlm_attr_ops = {
- 	.show  = dlm_attr_show,
- 	.store = dlm_attr_store,
- };
-diff -urNp linux-2.6.32.13/fs/ecryptfs/inode.c linux-2.6.32.13/fs/ecryptfs/inode.c
---- linux-2.6.32.13/fs/ecryptfs/inode.c	2010-04-29 17:49:38.429034237 -0400
-+++ linux-2.6.32.13/fs/ecryptfs/inode.c	2010-05-15 13:21:17.090658956 -0400
-@@ -655,7 +655,7 @@ static int ecryptfs_readlink_lower(struc
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
--						   (char __user *)lower_buf,
-+						   (__force char __user *)lower_buf,
- 						   lower_bufsiz);
- 	set_fs(old_fs);
- 	if (rc < 0)
-@@ -701,7 +701,7 @@ static void *ecryptfs_follow_link(struct
- 	}
- 	old_fs = get_fs();
- 	set_fs(get_ds());
--	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
-+	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
- 	set_fs(old_fs);
- 	if (rc < 0)
- 		goto out_free;
-diff -urNp linux-2.6.32.13/fs/exec.c linux-2.6.32.13/fs/exec.c
---- linux-2.6.32.13/fs/exec.c	2010-04-04 20:41:50.037938751 -0400
-+++ linux-2.6.32.13/fs/exec.c	2010-05-15 13:21:17.114657511 -0400
-@@ -56,12 +56,24 @@
- #include <linux/fsnotify.h>
- #include <linux/fs_struct.h>
- #include <linux/pipe_fs_i.h>
-+#include <linux/random.h>
-+#include <linux/seq_file.h>
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+#include <linux/kallsyms.h>
-+#include <linux/kdebug.h>
-+#endif
- 
- #include <asm/uaccess.h>
- #include <asm/mmu_context.h>
- #include <asm/tlb.h>
- #include "internal.h"
- 
-+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
-+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+EXPORT_SYMBOL(pax_set_initial_flags_func);
-+#endif
-+
- int core_uses_pid;
- char core_pattern[CORENAME_MAX_SIZE] = "core";
- unsigned int core_pipe_limit;
-@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
- 		goto out;
- 
- 	file = do_filp_open(AT_FDCWD, tmp,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_READ | MAY_EXEC | MAY_OPEN);
- 	putname(tmp);
- 	error = PTR_ERR(file);
-@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
- 		int write)
- {
- 	struct page *page;
--	int ret;
- 
--#ifdef CONFIG_STACK_GROWSUP
--	if (write) {
--		ret = expand_stack_downwards(bprm->vma, pos);
--		if (ret < 0)
--			return NULL;
--	}
--#endif
--	ret = get_user_pages(current, bprm->mm, pos,
--			1, write, 1, &page, NULL);
--	if (ret <= 0)
-+	if (0 > expand_stack_downwards(bprm->vma, pos))
-+		return NULL;
-+	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
- 		return NULL;
- 
- 	if (write) {
-@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
- 	vma->vm_end = STACK_TOP_MAX;
- 	vma->vm_start = vma->vm_end - PAGE_SIZE;
- 	vma->vm_flags = VM_STACK_FLAGS;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+#endif
-+
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 	err = insert_vm_struct(mm, vma);
- 	if (err)
-@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
- 	mm->stack_vm = mm->total_vm = 1;
- 	up_write(&mm->mmap_sem);
- 	bprm->p = vma->vm_end - sizeof(void *);
-+
-+#ifdef CONFIG_PAX_RANDUSTACK
-+	if (randomize_va_space)
-+		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
-+#endif
-+
- 	return 0;
- err:
- 	up_write(&mm->mmap_sem);
-@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
- 	int r;
- 	mm_segment_t oldfs = get_fs();
- 	set_fs(KERNEL_DS);
--	r = copy_strings(argc, (char __user * __user *)argv, bprm);
-+	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
- 	set_fs(oldfs);
- 	return r;
- }
-@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
- 	unsigned long new_end = old_end - shift;
- 	struct mmu_gather *tlb;
- 
--	BUG_ON(new_start > new_end);
-+	if (new_start >= new_end || new_start < mmap_min_addr)
-+		return -EFAULT;
- 
- 	/*
- 	 * ensure there are no vmas between where we want to go
-@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
- 	if (vma != find_vma(mm, new_start))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	BUG_ON(pax_find_mirror_vma(vma));
-+#endif
-+
- 	/*
- 	 * cover the whole range: [new_start, old_end)
- 	 */
-@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
- 	bprm->exec -= stack_shift;
- 
- 	down_write(&mm->mmap_sem);
-+
-+	/* Move stack pages down in memory. */
-+	if (stack_shift) {
-+		ret = shift_arg_pages(vma, stack_shift);
-+		if (ret)
-+			goto out_unlock;
-+	}
-+
- 	vm_flags = VM_STACK_FLAGS;
- 
- 	/*
-@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
- 		vm_flags &= ~VM_EXEC;
- 	vm_flags |= mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		vm_flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			vm_flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
- 			vm_flags);
- 	if (ret)
- 		goto out_unlock;
- 	BUG_ON(prev != vma);
- 
--	/* Move stack pages down in memory. */
--	if (stack_shift) {
--		ret = shift_arg_pages(vma, stack_shift);
--		if (ret)
--			goto out_unlock;
--	}
--
- 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
- 	stack_size = vma->vm_end - vma->vm_start;
- 	/*
-@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
- 	int err;
- 
- 	file = do_filp_open(AT_FDCWD, name,
--				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
-+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
- 				MAY_EXEC | MAY_OPEN);
- 	if (IS_ERR(file))
- 		goto out;
-@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	result = vfs_read(file, (void __user *)addr, count, &pos);
-+	result = vfs_read(file, (__force void __user *)addr, count, &pos);
- 	set_fs(old_fs);
- 	return result;
- }
-@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
- 	}
- 	rcu_read_unlock();
- 
--	if (p->fs->users > n_fs) {
-+	if (atomic_read(&p->fs->users) > n_fs) {
- 		bprm->unsafe |= LSM_UNSAFE_SHARE;
- 	} else {
- 		res = -EAGAIN;
-@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
- 	char __user *__user *envp,
- 	struct pt_regs * regs)
- {
-+#ifdef CONFIG_GRKERNSEC
-+	struct file *old_exec_file;
-+	struct acl_subject_label *old_acl;
-+	struct rlimit old_rlim[RLIM_NLIMITS];
-+#endif
- 	struct linux_binprm *bprm;
- 	struct file *file;
- 	struct files_struct *displaced;
-@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
- 	bprm->filename = filename;
- 	bprm->interp = filename;
- 
-+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
-+
-+	if (gr_handle_nproc()) {
-+		retval = -EAGAIN;
-+		goto out_file;
-+	}
-+
-+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
-+		retval = -EACCES;
-+		goto out_file;
-+	}
-+
- 	retval = bprm_mm_init(bprm);
- 	if (retval)
- 		goto out_file;
-@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
- 	if (retval < 0)
- 		goto out;
- 
-+	if (!gr_tpe_allow(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_check_crash_exec(file)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
-+
-+	gr_handle_exec_args(bprm, argv);
-+
-+#ifdef CONFIG_GRKERNSEC
-+	old_acl = current->acl;
-+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
-+	old_exec_file = current->exec_file;
-+	get_file(file);
-+	current->exec_file = file;
-+#endif
-+
-+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
-+				   bprm->unsafe & LSM_UNSAFE_SHARE);
-+	if (retval < 0)
-+		goto out_fail;
-+
- 	current->flags &= ~PF_KTHREAD;
- 	retval = search_binary_handler(bprm,regs);
- 	if (retval < 0)
--		goto out;
-+		goto out_fail;
-+#ifdef CONFIG_GRKERNSEC
-+	if (old_exec_file)
-+		fput(old_exec_file);
-+#endif
- 
- 	current->stack_start = current->mm->start_stack;
- 
-@@ -1390,6 +1471,14 @@ int do_execve(char * filename,
- 		put_files_struct(displaced);
- 	return retval;
- 
-+out_fail:
-+#ifdef CONFIG_GRKERNSEC
-+	current->acl = old_acl;
-+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
-+	fput(current->exec_file);
-+	current->exec_file = old_exec_file;
-+#endif
-+
- out:
- 	if (bprm->mm)
- 		mmput (bprm->mm);
-@@ -1553,6 +1642,169 @@ out:
- 	return ispipe;
- }
- 
-+int pax_check_flags(unsigned long *flags)
-+{
-+	int retval = 0;
-+
-+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
-+	if (*flags & MF_PAX_SEGMEXEC)
-+	{
-+		*flags &= ~MF_PAX_SEGMEXEC;
-+		retval = -EINVAL;
-+	}
-+#endif
-+
-+	if ((*flags & MF_PAX_PAGEEXEC)
-+
-+#ifdef CONFIG_PAX_PAGEEXEC
-+	    &&  (*flags & MF_PAX_SEGMEXEC)
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_PAGEEXEC;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_MPROTECT)
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_MPROTECT;
-+		retval = -EINVAL;
-+	}
-+
-+	if ((*flags & MF_PAX_EMUTRAMP)
-+
-+#ifdef CONFIG_PAX_EMUTRAMP
-+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
-+#endif
-+
-+	   )
-+	{
-+		*flags &= ~MF_PAX_EMUTRAMP;
-+		retval = -EINVAL;
-+	}
-+
-+	return retval;
-+}
-+
-+EXPORT_SYMBOL(pax_check_flags);
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
-+{
-+	struct task_struct *tsk = current;
-+	struct mm_struct *mm = current->mm;
-+	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
-+	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
-+	char *path_exec = NULL;
-+	char *path_fault = NULL;
-+	unsigned long start = 0UL, end = 0UL, offset = 0UL;
-+
-+	if (buffer_exec && buffer_fault) {
-+		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
-+
-+		down_read(&mm->mmap_sem);
-+		vma = mm->mmap;
-+		while (vma && (!vma_exec || !vma_fault)) {
-+			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
-+				vma_exec = vma;
-+			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
-+				vma_fault = vma;
-+			vma = vma->vm_next;
-+		}
-+		if (vma_exec) {
-+			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
-+			if (IS_ERR(path_exec))
-+				path_exec = "<path too long>";
-+			else {
-+				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
-+				if (path_exec) {
-+					*path_exec = 0;
-+					path_exec = buffer_exec;
-+				} else
-+					path_exec = "<path too long>";
-+			}
-+		}
-+		if (vma_fault) {
-+			start = vma_fault->vm_start;
-+			end = vma_fault->vm_end;
-+			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
-+			if (vma_fault->vm_file) {
-+				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
-+				if (IS_ERR(path_fault))
-+					path_fault = "<path too long>";
-+				else {
-+					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
-+					if (path_fault) {
-+						*path_fault = 0;
-+						path_fault = buffer_fault;
-+					} else
-+						path_fault = "<path too long>";
-+				}
-+			} else
-+				path_fault = "<anonymous mapping>";
-+		}
-+		up_read(&mm->mmap_sem);
-+	}
-+	if (tsk->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
-+	else
-+		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
-+	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
-+			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
-+			task_uid(tsk), task_euid(tsk), pc, sp);
-+	free_page((unsigned long)buffer_exec);
-+	free_page((unsigned long)buffer_fault);
-+	pax_report_insns(pc, sp);
-+	do_coredump(SIGKILL, SIGKILL, regs);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+void pax_report_refcount_overflow(struct pt_regs *regs)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	else
-+		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
-+				 current->comm, task_pid_nr(current), current_uid(), current_euid());
-+	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
-+	show_regs(regs);
-+	force_sig_specific(SIGKILL, current);
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+void pax_report_leak_to_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+#endif
-+
- static int zap_process(struct task_struct *start)
- {
- 	struct task_struct *t;
-@@ -1755,17 +2007,17 @@ static void wait_for_dump_helpers(struct
- 	pipe = file->f_path.dentry->d_inode->i_pipe;
- 
- 	pipe_lock(pipe);
--	pipe->readers++;
--	pipe->writers--;
-+	atomic_inc(&pipe->readers);
-+	atomic_dec(&pipe->writers);
- 
--	while ((pipe->readers > 1) && (!signal_pending(current))) {
-+	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
- 		wake_up_interruptible_sync(&pipe->wait);
- 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 		pipe_wait(pipe);
- 	}
- 
--	pipe->readers--;
--	pipe->writers++;
-+	atomic_dec(&pipe->readers);
-+	atomic_inc(&pipe->writers);
- 	pipe_unlock(pipe);
- 
- }
-@@ -1836,6 +2088,10 @@ void do_coredump(long signr, int exit_co
- 	 */
- 	clear_thread_flag(TIF_SIGPENDING);
- 
-+	if (signr == SIGKILL || signr == SIGILL)
-+		gr_handle_brute_attach(current);
-+	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
-+
- 	/*
- 	 * lock_kernel() because format_corename() is controlled by sysctl, which
- 	 * uses lock_kernel()
-diff -urNp linux-2.6.32.13/fs/ext2/balloc.c linux-2.6.32.13/fs/ext2/balloc.c
---- linux-2.6.32.13/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext2/balloc.c	2010-05-15 13:21:17.118672646 -0400
-@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.13/fs/ext2/xattr.c linux-2.6.32.13/fs/ext2/xattr.c
---- linux-2.6.32.13/fs/ext2/xattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext2/xattr.c	2010-05-15 13:21:17.122783817 -0400
-@@ -85,8 +85,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static int ext2_xattr_set2(struct inode *, struct buffer_head *,
-diff -urNp linux-2.6.32.13/fs/ext3/balloc.c linux-2.6.32.13/fs/ext3/balloc.c
---- linux-2.6.32.13/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext3/balloc.c	2010-05-15 13:21:17.135016428 -0400
-@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
- 
- 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
- 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
--	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
-+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
- 		sbi->s_resuid != current_fsuid() &&
- 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
- 		return 0;
-diff -urNp linux-2.6.32.13/fs/ext3/namei.c linux-2.6.32.13/fs/ext3/namei.c
---- linux-2.6.32.13/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext3/namei.c	2010-05-15 13:21:17.155157464 -0400
-@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext3_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext3_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.13/fs/ext3/xattr.c linux-2.6.32.13/fs/ext3/xattr.c
---- linux-2.6.32.13/fs/ext3/xattr.c	2010-04-29 17:49:38.429034237 -0400
-+++ linux-2.6.32.13/fs/ext3/xattr.c	2010-05-15 13:21:17.158583972 -0400
-@@ -89,8 +89,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(f...) do {} while (0)
-+# define ea_bdebug(f...) do {} while (0)
- #endif
- 
- static void ext3_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.32.13/fs/ext4/balloc.c linux-2.6.32.13/fs/ext4/balloc.c
---- linux-2.6.32.13/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext4/balloc.c	2010-05-15 13:21:17.158583972 -0400
-@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
- 	/* Hm, nope.  Are (enough) root reserved blocks available? */
- 	if (sbi->s_resuid == current_fsuid() ||
- 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
--	    capable(CAP_SYS_RESOURCE)) {
-+	    capable_nolog(CAP_SYS_RESOURCE)) {
- 		if (free_blocks >= (nblocks + dirty_blocks))
- 			return 1;
- 	}
-diff -urNp linux-2.6.32.13/fs/ext4/ioctl.c linux-2.6.32.13/fs/ext4/ioctl.c
---- linux-2.6.32.13/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext4/ioctl.c	2010-05-15 13:21:17.158583972 -0400
-@@ -221,6 +221,9 @@ setversion_out:
- 		struct file *donor_filp;
- 		int err;
- 
-+		/* temporary workaround for bugs in here */
-+		return -EOPNOTSUPP;
-+
- 		if (!(filp->f_mode & FMODE_READ) ||
- 		    !(filp->f_mode & FMODE_WRITE))
- 			return -EBADF;
-diff -urNp linux-2.6.32.13/fs/ext4/namei.c linux-2.6.32.13/fs/ext4/namei.c
---- linux-2.6.32.13/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext4/namei.c	2010-05-15 13:21:17.183216444 -0400
-@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext4_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext4_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.32.13/fs/ext4/super.c linux-2.6.32.13/fs/ext4/super.c
---- linux-2.6.32.13/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext4/super.c	2010-05-15 13:21:17.215811745 -0400
-@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
- }
- 
- 
--static struct sysfs_ops ext4_attr_ops = {
-+static const struct sysfs_ops ext4_attr_ops = {
- 	.show	= ext4_attr_show,
- 	.store	= ext4_attr_store,
- };
-diff -urNp linux-2.6.32.13/fs/ext4/xattr.c linux-2.6.32.13/fs/ext4/xattr.c
---- linux-2.6.32.13/fs/ext4/xattr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ext4/xattr.c	2010-05-15 13:21:17.227060881 -0400
-@@ -82,8 +82,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static void ext4_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.32.13/fs/fcntl.c linux-2.6.32.13/fs/fcntl.c
---- linux-2.6.32.13/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fcntl.c	2010-05-15 13:21:17.227060881 -0400
-@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
- 	switch (cmd) {
- 	case F_DUPFD:
- 	case F_DUPFD_CLOEXEC:
-+		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
- 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 			break;
- 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
-@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
- 	ret = ((fown->euid == 0 ||
- 		fown->euid == cred->suid || fown->euid == cred->uid ||
- 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
--	       !security_file_send_sigiotask(p, fown, sig));
-+	       !security_file_send_sigiotask(p, fown, sig) &&
-+	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
- 	rcu_read_unlock();
- 	return ret;
- }
-diff -urNp linux-2.6.32.13/fs/fifo.c linux-2.6.32.13/fs/fifo.c
---- linux-2.6.32.13/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fifo.c	2010-05-15 13:21:17.252844788 -0400
-@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &read_pipefifo_fops;
- 		pipe->r_counter++;
--		if (pipe->readers++ == 0)
-+		if (atomic_inc_return(&pipe->readers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->writers) {
-+		if (!atomic_read(&pipe->writers)) {
- 			if ((filp->f_flags & O_NONBLOCK)) {
- 				/* suppress POLLHUP until we have
- 				 * seen a writer */
-@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
- 	 *  errno=ENXIO when there is no process reading the FIFO.
- 	 */
- 		ret = -ENXIO;
--		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
-+		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
- 			goto err;
- 
- 		filp->f_op = &write_pipefifo_fops;
- 		pipe->w_counter++;
--		if (!pipe->writers++)
-+		if (atomic_inc_return(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			wait_for_partner(inode, &pipe->r_counter);
- 			if (signal_pending(current))
- 				goto err_wr;
-@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
- 	 */
- 		filp->f_op = &rdwr_pipefifo_fops;
- 
--		pipe->readers++;
--		pipe->writers++;
-+		atomic_inc(&pipe->readers);
-+		atomic_inc(&pipe->writers);
- 		pipe->r_counter++;
- 		pipe->w_counter++;
--		if (pipe->readers == 1 || pipe->writers == 1)
-+		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
- 			wake_up_partner(inode);
- 		break;
- 
-@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
- 	return 0;
- 
- err_rd:
--	if (!--pipe->readers)
-+	if (atomic_dec_and_test(&pipe->readers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err_wr:
--	if (!--pipe->writers)
-+	if (atomic_dec_and_test(&pipe->writers))
- 		wake_up_interruptible(&pipe->wait);
- 	ret = -ERESTARTSYS;
- 	goto err;
- 
- err:
--	if (!pipe->readers && !pipe->writers)
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
- 		free_pipe_info(inode);
- 
- err_nocleanup:
-diff -urNp linux-2.6.32.13/fs/file.c linux-2.6.32.13/fs/file.c
---- linux-2.6.32.13/fs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/file.c	2010-05-15 13:21:17.256078508 -0400
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/vmalloc.h>
- #include <linux/file.h>
-+#include <linux/security.h>
- #include <linux/fdtable.h>
- #include <linux/bitops.h>
- #include <linux/interrupt.h>
-@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
- 	 * N.B. For clone tasks sharing a files structure, this test
- 	 * will limit the total number of files that can be opened.
- 	 */
-+
-+	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
- 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EMFILE;
- 
-diff -urNp linux-2.6.32.13/fs/fs_struct.c linux-2.6.32.13/fs/fs_struct.c
---- linux-2.6.32.13/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fs_struct.c	2010-05-15 13:21:17.256078508 -0400
-@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
- 	struct task_struct *g, *p;
- 	struct fs_struct *fs;
- 	int count = 0;
-+	unsigned long flags;
- 
- 	read_lock(&tasklist_lock);
- 	do_each_thread(g, p) {
- 		task_lock(p);
-+		gr_fs_write_lock_irqsave(p, flags);
- 		fs = p->fs;
- 		if (fs) {
- 			write_lock(&fs->lock);
-@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
- 			}
- 			write_unlock(&fs->lock);
- 		}
-+		gr_fs_write_unlock_irqrestore(p, flags);
- 		task_unlock(p);
- 	} while_each_thread(g, p);
- 	read_unlock(&tasklist_lock);
-@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
- void exit_fs(struct task_struct *tsk)
- {
- 	struct fs_struct *fs = tsk->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
- 		task_lock(tsk);
-+		gr_fs_write_lock_irqsave(tsk, flags);
- 		write_lock(&fs->lock);
- 		tsk->fs = NULL;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(tsk, flags);
- 		task_unlock(tsk);
- 		if (kill)
- 			free_fs_struct(fs);
-@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
- 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
- 	/* We don't need to lock fs - think why ;-) */
- 	if (fs) {
--		fs->users = 1;
-+		atomic_set(&fs->users, 1);
- 		fs->in_exec = 0;
- 		rwlock_init(&fs->lock);
- 		fs->umask = old->umask;
-@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
- 	struct fs_struct *fs = current->fs;
- 	struct fs_struct *new_fs = copy_fs_struct(fs);
- 	int kill;
-+	unsigned long flags;
- 
- 	if (!new_fs)
- 		return -ENOMEM;
- 
- 	task_lock(current);
-+	gr_fs_write_lock_irqsave(current, flags);
- 	write_lock(&fs->lock);
--	kill = !--fs->users;
-+	kill = !atomic_dec_return(&fs->users);
- 	current->fs = new_fs;
- 	write_unlock(&fs->lock);
-+	gr_fs_write_unlock_irqrestore(current, flags);
- 	task_unlock(current);
- 
- 	if (kill)
-@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
- 
- /* to be mentioned only in INIT_TASK */
- struct fs_struct init_fs = {
--	.users		= 1,
-+	.users		= ATOMIC_INIT(1),
- 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
- 	.umask		= 0022,
- };
-@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
- void daemonize_fs_struct(void)
- {
- 	struct fs_struct *fs = current->fs;
-+	unsigned long flags;
- 
- 	if (fs) {
- 		int kill;
-@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
- 		task_lock(current);
- 
- 		write_lock(&init_fs.lock);
--		init_fs.users++;
-+		atomic_inc(&init_fs.users);
- 		write_unlock(&init_fs.lock);
- 
-+		gr_fs_write_lock_irqsave(current, flags);
- 		write_lock(&fs->lock);
- 		current->fs = &init_fs;
--		kill = !--fs->users;
-+		kill = !atomic_dec_return(&fs->users);
- 		write_unlock(&fs->lock);
-+		gr_fs_write_unlock_irqrestore(current, flags);
- 
- 		task_unlock(current);
- 		if (kill)
-diff -urNp linux-2.6.32.13/fs/fuse/control.c linux-2.6.32.13/fs/fuse/control.c
---- linux-2.6.32.13/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fuse/control.c	2010-05-15 13:21:17.271074520 -0400
-@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
- 
- static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
- {
--	struct tree_descr empty_descr = {""};
-+	struct tree_descr empty_descr = {"", NULL, 0};
- 	struct fuse_conn *fc;
- 	int err;
- 
-diff -urNp linux-2.6.32.13/fs/fuse/cuse.c linux-2.6.32.13/fs/fuse/cuse.c
---- linux-2.6.32.13/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fuse/cuse.c	2010-05-15 13:21:17.289230785 -0400
-@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
- 	return rc;
- }
- 
--static struct file_operations cuse_channel_fops; /* initialized during init */
--
-+static const struct file_operations cuse_channel_fops = { /* initialized during init */
-+	.owner		= THIS_MODULE,
-+	.llseek		= no_llseek,
-+	.read		= do_sync_read,
-+	.aio_read	= fuse_dev_read,
-+	.write		= do_sync_write,
-+	.aio_write	= fuse_dev_write,
-+	.poll		= fuse_dev_poll,
-+	.open		= cuse_channel_open,
-+	.release	= cuse_channel_release,
-+	.fasync		= fuse_dev_fasync,
-+};
- 
- /**************************************************************************
-  * Misc stuff and module initializatiion
-@@ -575,12 +585,6 @@ static int __init cuse_init(void)
- 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
- 		INIT_LIST_HEAD(&cuse_conntbl[i]);
- 
--	/* inherit and extend fuse_dev_operations */
--	cuse_channel_fops		= fuse_dev_operations;
--	cuse_channel_fops.owner		= THIS_MODULE;
--	cuse_channel_fops.open		= cuse_channel_open;
--	cuse_channel_fops.release	= cuse_channel_release;
--
- 	cuse_class = class_create(THIS_MODULE, "cuse");
- 	if (IS_ERR(cuse_class))
- 		return PTR_ERR(cuse_class);
-diff -urNp linux-2.6.32.13/fs/fuse/dev.c linux-2.6.32.13/fs/fuse/dev.c
---- linux-2.6.32.13/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fuse/dev.c	2010-05-15 13:21:17.290606220 -0400
-@@ -745,7 +745,7 @@ __releases(&fc->lock)
-  * request_end().  Otherwise add it to the processing list, and set
-  * the 'sent' flag.
-  */
--static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
- 			      unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
- 	spin_unlock(&fc->lock);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_read);
- 
- static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
- 			    struct fuse_copy_state *cs)
-@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
- {
- 	struct fuse_notify_inval_entry_out outarg;
- 	int err = -EINVAL;
--	char buf[FUSE_NAME_MAX+1];
-+	char *buf = NULL;
- 	struct qstr name;
- 
- 	if (size < sizeof(outarg))
-@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
- 	if (outarg.namelen > FUSE_NAME_MAX)
- 		goto err;
- 
-+	err = -ENOMEM;
-+	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
-+	if (!buf)
-+		goto err;
-+
- 	name.name = buf;
- 	name.len = outarg.namelen;
- 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
-@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
- 
- 	down_read(&fc->killsb);
- 	err = -ENOENT;
--	if (!fc->sb)
--		goto err_unlock;
--
--	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
--
--err_unlock:
-+	if (fc->sb)
-+		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
- 	up_read(&fc->killsb);
-+	kfree(buf);
- 	return err;
- 
- err:
- 	fuse_copy_finish(cs);
-+	kfree(buf);
- 	return err;
- }
- 
-@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
-  * it from the list and copy the rest of the buffer to the request.
-  * The request is finished by calling request_end()
-  */
--static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
- 			       unsigned long nr_segs, loff_t pos)
- {
- 	int err;
-@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
- 	fuse_copy_finish(&cs);
- 	return err;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_write);
- 
--static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
-+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
- {
- 	unsigned mask = POLLOUT | POLLWRNORM;
- 	struct fuse_conn *fc = fuse_get_conn(file);
-@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
- 
- 	return mask;
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_poll);
- 
- /*
-  * Abort all requests on the given list (pending or processing)
-@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
- }
- EXPORT_SYMBOL_GPL(fuse_dev_release);
- 
--static int fuse_dev_fasync(int fd, struct file *file, int on)
-+int fuse_dev_fasync(int fd, struct file *file, int on)
- {
- 	struct fuse_conn *fc = fuse_get_conn(file);
- 	if (!fc)
-@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
- 	/* No locking - fasync_helper does its own locking */
- 	return fasync_helper(fd, file, on, &fc->fasync);
- }
-+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
- 
- const struct file_operations fuse_dev_operations = {
- 	.owner		= THIS_MODULE,
-diff -urNp linux-2.6.32.13/fs/fuse/dir.c linux-2.6.32.13/fs/fuse/dir.c
---- linux-2.6.32.13/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fuse/dir.c	2010-05-15 13:21:17.295063654 -0400
-@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
- 	return link;
- }
- 
--static void free_link(char *link)
-+static void free_link(const char *link)
- {
- 	if (!IS_ERR(link))
- 		free_page((unsigned long) link);
-diff -urNp linux-2.6.32.13/fs/fuse/fuse_i.h linux-2.6.32.13/fs/fuse/fuse_i.h
---- linux-2.6.32.13/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/fuse/fuse_i.h	2010-05-15 13:21:17.298596794 -0400
-@@ -521,6 +521,16 @@ extern const struct file_operations fuse
- 
- extern const struct dentry_operations fuse_dentry_operations;
- 
-+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
-+			      unsigned long nr_segs, loff_t pos);
-+
-+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
-+			       unsigned long nr_segs, loff_t pos);
-+
-+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
-+
-+extern int fuse_dev_fasync(int fd, struct file *file, int on);
-+
- /**
-  * Inode to nodeid comparison.
-  */
-diff -urNp linux-2.6.32.13/fs/gfs2/sys.c linux-2.6.32.13/fs/gfs2/sys.c
---- linux-2.6.32.13/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/gfs2/sys.c	2010-05-15 13:21:17.323073000 -0400
-@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
- 	return a->store ? a->store(sdp, buf, len) : len;
- }
- 
--static struct sysfs_ops gfs2_attr_ops = {
-+static const struct sysfs_ops gfs2_attr_ops = {
- 	.show  = gfs2_attr_show,
- 	.store = gfs2_attr_store,
- };
-@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
- 	return 0;
- }
- 
--static struct kset_uevent_ops gfs2_uevent_ops = {
-+static const struct kset_uevent_ops gfs2_uevent_ops = {
- 	.uevent = gfs2_uevent,
- };
- 
-diff -urNp linux-2.6.32.13/fs/hfs/inode.c linux-2.6.32.13/fs/hfs/inode.c
---- linux-2.6.32.13/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/hfs/inode.c	2010-05-15 13:21:17.331804288 -0400
-@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
- 
- 	if (S_ISDIR(main_inode->i_mode)) {
- 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_dir));
- 		if (rec.type != HFS_CDR_DIR ||
-@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
- 				sizeof(struct hfs_cat_file));
- 	} else {
- 		if (fd.entrylength < sizeof(struct hfs_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_file));
- 		if (rec.type != HFS_CDR_FIL ||
-diff -urNp linux-2.6.32.13/fs/hfsplus/inode.c linux-2.6.32.13/fs/hfsplus/inode.c
---- linux-2.6.32.13/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/hfsplus/inode.c	2010-05-15 13:21:17.338586981 -0400
-@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		hfsplus_get_perms(inode, &folder->permissions, 1);
-@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 
-@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		/* simple node checks? */
-@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 		hfsplus_inode_write_fork(inode, &file->data_fork);
-diff -urNp linux-2.6.32.13/fs/hugetlbfs/inode.c linux-2.6.32.13/fs/hugetlbfs/inode.c
---- linux-2.6.32.13/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/hugetlbfs/inode.c	2010-05-15 13:21:17.367723130 -0400
-@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
- 	.kill_sb	= kill_litter_super,
- };
- 
--static struct vfsmount *hugetlbfs_vfsmount;
-+struct vfsmount *hugetlbfs_vfsmount;
- 
- static int can_do_hugetlb_shm(void)
- {
-diff -urNp linux-2.6.32.13/fs/ioctl.c linux-2.6.32.13/fs/ioctl.c
---- linux-2.6.32.13/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ioctl.c	2010-05-15 13:21:17.367723130 -0400
-@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
- 			    u64 phys, u64 len, u32 flags)
- {
- 	struct fiemap_extent extent;
--	struct fiemap_extent *dest = fieinfo->fi_extents_start;
-+	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
- 
- 	/* only count the extents */
- 	if (fieinfo->fi_extents_max == 0) {
-@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
- 
- 	fieinfo.fi_flags = fiemap.fm_flags;
- 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
--	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
-+	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
- 
- 	if (fiemap.fm_extent_count != 0 &&
- 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
-@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
- 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
- 	fiemap.fm_flags = fieinfo.fi_flags;
- 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
--	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
-+	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
- 		error = -EFAULT;
- 
- 	return error;
-diff -urNp linux-2.6.32.13/fs/jffs2/debug.h linux-2.6.32.13/fs/jffs2/debug.h
---- linux-2.6.32.13/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/jffs2/debug.h	2010-05-15 13:21:17.378571837 -0400
-@@ -52,13 +52,13 @@
- #if CONFIG_JFFS2_FS_DEBUG > 0
- #define D1(x) x
- #else
--#define D1(x)
-+#define D1(x) do {} while (0);
- #endif
- 
- #if CONFIG_JFFS2_FS_DEBUG > 1
- #define D2(x) x
- #else
--#define D2(x)
-+#define D2(x) do {} while (0);
- #endif
- 
- /* The prefixes of JFFS2 messages */
-@@ -114,73 +114,73 @@
- #ifdef JFFS2_DBG_READINODE_MESSAGES
- #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode(fmt, ...)
-+#define dbg_readinode(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_READINODE2_MESSAGES
- #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode2(fmt, ...)
-+#define dbg_readinode2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Fragtree build debugging messages */
- #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
- #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree(fmt, ...)
-+#define dbg_fragtree(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
- #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree2(fmt, ...)
-+#define dbg_fragtree2(fmt, ...)	do {} while (0)
- #endif
- 
- /* Directory entry list manilulation debugging messages */
- #ifdef JFFS2_DBG_DENTLIST_MESSAGES
- #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_dentlist(fmt, ...)
-+#define dbg_dentlist(fmt, ...)	do {} while (0)
- #endif
- 
- /* Print the messages about manipulating node_refs */
- #ifdef JFFS2_DBG_NODEREF_MESSAGES
- #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_noderef(fmt, ...)
-+#define dbg_noderef(fmt, ...)	do {} while (0)
- #endif
- 
- /* Manipulations with the list of inodes (JFFS2 inocache) */
- #ifdef JFFS2_DBG_INOCACHE_MESSAGES
- #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_inocache(fmt, ...)
-+#define dbg_inocache(fmt, ...)	do {} while (0)
- #endif
- 
- /* Summary debugging messages */
- #ifdef JFFS2_DBG_SUMMARY_MESSAGES
- #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_summary(fmt, ...)
-+#define dbg_summary(fmt, ...)	do {} while (0)
- #endif
- 
- /* File system build messages */
- #ifdef JFFS2_DBG_FSBUILD_MESSAGES
- #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fsbuild(fmt, ...)
-+#define dbg_fsbuild(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the object allocations */
- #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
- #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_memalloc(fmt, ...)
-+#define dbg_memalloc(fmt, ...)	do {} while (0)
- #endif
- 
- /* Watch the XATTR subsystem */
- #ifdef JFFS2_DBG_XATTR_MESSAGES
- #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_xattr(fmt, ...)
-+#define dbg_xattr(fmt, ...)	do {} while (0)
- #endif 
- 
- /* "Sanity" checks */
-diff -urNp linux-2.6.32.13/fs/jffs2/erase.c linux-2.6.32.13/fs/jffs2/erase.c
---- linux-2.6.32.13/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/jffs2/erase.c	2010-05-15 13:21:17.386577527 -0400
-@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
- 		struct jffs2_unknown_node marker = {
- 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--			.totlen =	cpu_to_je32(c->cleanmarker_size)
-+			.totlen =	cpu_to_je32(c->cleanmarker_size),
-+			.hdr_crc =	cpu_to_je32(0)
- 		};
- 
- 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.32.13/fs/jffs2/summary.h linux-2.6.32.13/fs/jffs2/summary.h
---- linux-2.6.32.13/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/jffs2/summary.h	2010-05-15 13:21:17.386577527 -0400
-@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
- 
- #define jffs2_sum_active() (0)
- #define jffs2_sum_init(a) (0)
--#define jffs2_sum_exit(a)
--#define jffs2_sum_disable_collecting(a)
-+#define jffs2_sum_exit(a) do {} while (0)
-+#define jffs2_sum_disable_collecting(a) do {} while (0)
- #define jffs2_sum_is_disabled(a) (0)
--#define jffs2_sum_reset_collected(a)
-+#define jffs2_sum_reset_collected(a) do {} while (0)
- #define jffs2_sum_add_kvec(a,b,c,d) (0)
--#define jffs2_sum_move_collected(a,b)
-+#define jffs2_sum_move_collected(a,b) do {} while (0)
- #define jffs2_sum_write_sumnode(a) (0)
--#define jffs2_sum_add_padding_mem(a,b)
--#define jffs2_sum_add_inode_mem(a,b,c)
--#define jffs2_sum_add_dirent_mem(a,b,c)
--#define jffs2_sum_add_xattr_mem(a,b,c)
--#define jffs2_sum_add_xref_mem(a,b,c)
-+#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
-+#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
- #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
- 
- #endif /* CONFIG_JFFS2_SUMMARY */
-diff -urNp linux-2.6.32.13/fs/jffs2/wbuf.c linux-2.6.32.13/fs/jffs2/wbuf.c
---- linux-2.6.32.13/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/jffs2/wbuf.c	2010-05-15 13:21:17.386577527 -0400
-@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
- {
- 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
- 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
--	.totlen = constant_cpu_to_je32(8)
-+	.totlen = constant_cpu_to_je32(8),
-+	.hdr_crc = constant_cpu_to_je32(0)
- };
- 
- /*
-diff -urNp linux-2.6.32.13/fs/lockd/svc.c linux-2.6.32.13/fs/lockd/svc.c
---- linux-2.6.32.13/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/lockd/svc.c	2010-05-15 13:21:17.394616660 -0400
-@@ -43,7 +43,7 @@
- 
- static struct svc_program	nlmsvc_program;
- 
--struct nlmsvc_binding *		nlmsvc_ops;
-+const struct nlmsvc_binding *	nlmsvc_ops;
- EXPORT_SYMBOL_GPL(nlmsvc_ops);
- 
- static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.32.13/fs/locks.c linux-2.6.32.13/fs/locks.c
---- linux-2.6.32.13/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/locks.c	2010-05-15 13:21:17.398591192 -0400
-@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
- 		return;
- 
- 	if (filp->f_op && filp->f_op->flock) {
--		struct file_lock fl = {
-+		struct file_lock flock = {
- 			.fl_pid = current->tgid,
- 			.fl_file = filp,
- 			.fl_flags = FL_FLOCK,
- 			.fl_type = F_UNLCK,
- 			.fl_end = OFFSET_MAX,
- 		};
--		filp->f_op->flock(filp, F_SETLKW, &fl);
--		if (fl.fl_ops && fl.fl_ops->fl_release_private)
--			fl.fl_ops->fl_release_private(&fl);
-+		filp->f_op->flock(filp, F_SETLKW, &flock);
-+		if (flock.fl_ops && flock.fl_ops->fl_release_private)
-+			flock.fl_ops->fl_release_private(&flock);
- 	}
- 
- 	lock_kernel();
-diff -urNp linux-2.6.32.13/fs/namei.c linux-2.6.32.13/fs/namei.c
---- linux-2.6.32.13/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/namei.c	2010-05-15 13:21:17.402570795 -0400
-@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
- 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
- 	error = PTR_ERR(cookie);
- 	if (!IS_ERR(cookie)) {
--		char *s = nd_get_link(nd);
-+		const char *s = nd_get_link(nd);
- 		error = 0;
- 		if (s)
- 			error = __vfs_follow_link(nd, s);
-@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
- 	err = security_inode_follow_link(path->dentry, nd);
- 	if (err)
- 		goto loop;
-+
-+	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
-+				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
-+		err = -EACCES;
-+		goto loop;
-+	}
-+
- 	current->link_count++;
- 	current->total_link_count++;
- 	nd->depth++;
-@@ -1016,11 +1023,18 @@ return_reval:
- 				break;
- 		}
- return_base:
-+		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
-+			path_put(&nd->path);
-+			return -ENOENT;
-+		}
- 		return 0;
- out_dput:
- 		path_put_conditional(&next, nd);
- 		break;
- 	}
-+	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
-+		err = -ENOENT;
-+
- 	path_put(&nd->path);
- return_err:
- 	return err;
-@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
- 	int error;
- 	struct dentry *dir = nd->path.dentry;
- 
-+	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
-+		error = -EACCES;
-+		goto out_unlock;
-+	}
-+
- 	if (!IS_POSIXACL(dir->d_inode))
- 		mode &= ~current_umask();
- 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
- 	if (error)
- 		goto out_unlock;
- 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
-+	if (!error)
-+		gr_handle_create(path->dentry, nd->path.mnt);
- out_unlock:
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	dput(nd->path.dentry);
-@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
- 					 &nd, flag);
- 		if (error)
- 			return ERR_PTR(error);
-+
-+		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
-+			error = -EPERM;
-+			goto exit;
-+		}
-+
-+		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
-+			error = -EACCES;
-+			goto exit;
-+		}
-+
- 		goto ok;
- 	}
- 
-@@ -1795,6 +1832,24 @@ do_last:
- 	/*
- 	 * It already exists.
- 	 */
-+
-+	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_rawio(path.dentry->d_inode)) {
-+		error = -EPERM;
-+		goto exit_mutex_unlock;
-+	}
-+	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
-+		error = -EACCES;
-+		goto exit_mutex_unlock;
-+	}
-+
- 	mutex_unlock(&dir->d_inode->i_mutex);
- 	audit_inode(pathname, path.dentry);
- 
-@@ -1887,6 +1942,13 @@ do_link:
- 	error = security_inode_follow_link(path.dentry, &nd);
- 	if (error)
- 		goto exit_dput;
-+
-+	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
-+				  path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto exit_dput;
-+	}
-+
- 	error = __do_follow_link(&path, &nd);
- 	if (error) {
- 		/* Does someone understand code flow here? Or it is only
-@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	error = may_mknod(mode);
- 	if (error)
- 		goto out_dput;
-+
-+	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
-+		error = -EPERM;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
- 	}
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
- 		mode &= ~current_umask();
- 	error = mnt_want_write(nd.path.mnt);
-@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
- 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
-+
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- out_dput:
- 	dput(dentry);
- out_unlock:
-@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
- 	char * name;
- 	struct dentry *dentry;
- 	struct nameidata nd;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
- 	error = PTR_ERR(dentry);
- 	if (IS_ERR(dentry))
- 		goto exit2;
-+
-+	if (dentry->d_inode != NULL) {
-+		if (dentry->d_inode->i_nlink <= 1) {
-+			saved_ino = dentry->d_inode->i_ino;
-+			saved_dev = dentry->d_inode->i_sb->s_dev;
-+		}
-+
-+		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
-+			error = -EACCES;
-+			goto exit3;
-+		}
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto exit3;
-@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
- 	if (error)
- 		goto exit4;
- 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-+	if (!error && (saved_dev || saved_ino))
-+		gr_handle_delete(saved_ino, saved_dev);
- exit4:
- 	mnt_drop_write(nd.path.mnt);
- exit3:
-@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
- 	struct dentry *dentry;
- 	struct nameidata nd;
- 	struct inode *inode = NULL;
-+	ino_t saved_ino = 0;
-+	dev_t saved_dev = 0;
- 
- 	error = user_path_parent(dfd, pathname, &nd, &name);
- 	if (error)
-@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
- 		if (nd.last.name[nd.last.len])
- 			goto slashes;
- 		inode = dentry->d_inode;
--		if (inode)
-+		if (inode) {
-+			if (inode->i_nlink <= 1) {
-+				saved_ino = inode->i_ino;
-+				saved_dev = inode->i_sb->s_dev;
-+			}
-+
- 			atomic_inc(&inode->i_count);
-+
-+			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
-+				error = -EACCES;
-+				goto exit2;
-+			}
-+		}
- 		error = mnt_want_write(nd.path.mnt);
- 		if (error)
- 			goto exit2;
-@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
- 		if (error)
- 			goto exit3;
- 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
-+		if (!error && (saved_ino || saved_dev))
-+			gr_handle_delete(saved_ino, saved_dev);
- exit3:
- 		mnt_drop_write(nd.path.mnt);
- 	exit2:
-@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (IS_ERR(dentry))
- 		goto out_unlock;
- 
-+	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
-+	if (!error)
-+		gr_handle_create(dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	error = PTR_ERR(new_dentry);
- 	if (IS_ERR(new_dentry))
- 		goto out_unlock;
-+
-+	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
-+			       old_path.dentry->d_inode,
-+			       old_path.dentry->d_inode->i_mode, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
-+	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
-+				old_path.dentry, old_path.mnt, to)) {
-+		error = -EACCES;
-+		goto out_dput;
-+	}
-+
- 	error = mnt_want_write(nd.path.mnt);
- 	if (error)
- 		goto out_dput;
-@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
- 	if (error)
- 		goto out_drop_write;
- 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_create(new_dentry, nd.path.mnt);
- out_drop_write:
- 	mnt_drop_write(nd.path.mnt);
- out_dput:
-@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 	if (new_dentry == trap)
- 		goto exit5;
- 
-+	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
-+				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
-+				     to);
-+	if (error)
-+		goto exit5;
-+
- 	error = mnt_want_write(oldnd.path.mnt);
- 	if (error)
- 		goto exit5;
-@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
- 		goto exit6;
- 	error = vfs_rename(old_dir->d_inode, old_dentry,
- 				   new_dir->d_inode, new_dentry);
-+	if (!error)
-+		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
-+				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
- exit6:
- 	mnt_drop_write(oldnd.path.mnt);
- exit5:
-diff -urNp linux-2.6.32.13/fs/namespace.c linux-2.6.32.13/fs/namespace.c
---- linux-2.6.32.13/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/namespace.c	2010-05-15 13:21:17.430740691 -0400
-@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
- 		if (!(sb->s_flags & MS_RDONLY))
- 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
- 		up_write(&sb->s_umount);
-+
-+		gr_log_remount(mnt->mnt_devname, retval);
-+
- 		return retval;
- 	}
- 
-@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
- 		security_sb_umount_busy(mnt);
- 	up_write(&namespace_sem);
- 	release_mounts(&umount_list);
-+
-+	gr_log_unmount(mnt->mnt_devname, retval);
-+
- 	return retval;
- }
- 
-@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
- 	if (retval)
- 		goto dput_out;
- 
-+	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
-+	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
-+		retval = -EPERM;
-+		goto dput_out;
-+	}
-+
- 	if (flags & MS_REMOUNT)
- 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
- 				    data_page);
-@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
- 				      dev_name, data_page);
- dput_out:
- 	path_put(&path);
-+
-+	gr_log_mount(dev_name, dir_name, retval);
-+
- 	return retval;
- }
- 
-@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
- 		goto out1;
- 	}
- 
-+	if (gr_handle_chroot_pivot()) {
-+		error = -EPERM;
-+		path_put(&old);
-+		goto out1;
-+	}
-+
- 	read_lock(&current->fs->lock);
- 	root = current->fs->root;
- 	path_get(&current->fs->root);
-diff -urNp linux-2.6.32.13/fs/nfs/inode.c linux-2.6.32.13/fs/nfs/inode.c
---- linux-2.6.32.13/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
-+++ linux-2.6.32.13/fs/nfs/inode.c	2010-05-15 13:21:17.459288785 -0400
-@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
- 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
- }
- 
--static atomic_long_t nfs_attr_generation_counter;
-+static atomic_long_unchecked_t nfs_attr_generation_counter;
- 
- static unsigned long nfs_read_attr_generation_counter(void)
- {
--	return atomic_long_read(&nfs_attr_generation_counter);
-+	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
- }
- 
- unsigned long nfs_inc_attr_generation_counter(void)
- {
--	return atomic_long_inc_return(&nfs_attr_generation_counter);
-+	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
- }
- 
- void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.32.13/fs/nfs/nfs4proc.c linux-2.6.32.13/fs/nfs/nfs4proc.c
---- linux-2.6.32.13/fs/nfs/nfs4proc.c	2010-04-29 17:49:38.445067399 -0400
-+++ linux-2.6.32.13/fs/nfs/nfs4proc.c	2010-05-15 13:21:17.510781468 -0400
-@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
- static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_do_open_reclaim(ctx, state);
-@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
- 
- int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs_server *server = NFS_SERVER(state->inode);
- 	int err;
- 	do {
-@@ -1493,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs
- static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -1593,7 +1593,7 @@ out_err:
- 
- static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs4_state *res;
- 	int status;
- 
-@@ -1684,7 +1684,7 @@ static int nfs4_do_setattr(struct inode 
- 			   struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2050,7 +2050,7 @@ static int _nfs4_server_capabilities(str
- 
- int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2084,7 +2084,7 @@ static int _nfs4_lookup_root(struct nfs_
- static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_fsinfo *info)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2173,7 +2173,7 @@ static int _nfs4_proc_getattr(struct nfs
- 
- static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2261,7 +2261,7 @@ static int nfs4_proc_lookupfh(struct nfs
- 			      struct qstr *name, struct nfs_fh *fhandle,
- 			      struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
-@@ -2290,7 +2290,7 @@ static int _nfs4_proc_lookup(struct inod
- 
- static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2354,7 +2354,7 @@ static int _nfs4_proc_access(struct inod
- 
- static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2410,7 +2410,7 @@ static int _nfs4_proc_readlink(struct in
- static int nfs4_proc_readlink(struct inode *inode, struct page *page,
- 		unsigned int pgbase, unsigned int pglen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2508,7 +2508,7 @@ static int _nfs4_proc_remove(struct inod
- 
- static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2582,7 +2582,7 @@ static int _nfs4_proc_rename(struct inod
- static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
- 		struct inode *new_dir, struct qstr *new_name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
-@@ -2629,7 +2629,7 @@ static int _nfs4_proc_link(struct inode 
- 
- static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2721,7 +2721,7 @@ out:
- static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
- 		struct page *page, unsigned int len, struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2752,7 +2752,7 @@ out:
- static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2801,7 +2801,7 @@ static int _nfs4_proc_readdir(struct den
- static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
-                   u64 cookie, struct page *page, unsigned int count, int plus)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
-@@ -2849,7 +2849,7 @@ out:
- static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr, dev_t rdev)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2881,7 +2881,7 @@ static int _nfs4_proc_statfs(struct nfs_
- 
- static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2912,7 +2912,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
- 
- static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -2958,7 +2958,7 @@ static int _nfs4_proc_pathconf(struct nf
- static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_pathconf *pathconf)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -3257,7 +3257,7 @@ out_free:
- 
- static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	ssize_t ret;
- 	do {
- 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
-@@ -3313,7 +3313,7 @@ static int __nfs4_proc_set_acl(struct in
- 
- static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -3578,7 +3578,7 @@ out:
- int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
-@@ -3651,7 +3651,7 @@ out:
- 
- static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4044,7 +4044,7 @@ static int _nfs4_do_setlk(struct nfs4_st
- static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4062,7 +4062,7 @@ static int nfs4_lock_reclaim(struct nfs4
- static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, request);
-@@ -4120,7 +4120,7 @@ out:
- 
- static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4180,7 +4180,7 @@ nfs4_proc_lock(struct file *filp, int cm
- int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, fl);
-diff -urNp linux-2.6.32.13/fs/nfsd/lockd.c linux-2.6.32.13/fs/nfsd/lockd.c
---- linux-2.6.32.13/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/nfsd/lockd.c	2010-05-15 13:21:17.510781468 -0400
-@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
- 	fput(filp);
- }
- 
--static struct nlmsvc_binding	nfsd_nlm_ops = {
-+static const struct nlmsvc_binding	nfsd_nlm_ops = {
- 	.fopen		= nlm_fopen,		/* open file for locking */
- 	.fclose		= nlm_fclose,		/* close file */
- };
-diff -urNp linux-2.6.32.13/fs/nfsd/vfs.c linux-2.6.32.13/fs/nfsd/vfs.c
---- linux-2.6.32.13/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/nfsd/vfs.c	2010-05-15 13:21:17.539124101 -0400
-@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
- 	} else {
- 		oldfs = get_fs();
- 		set_fs(KERNEL_DS);
--		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
-+		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
- 		set_fs(oldfs);
- 	}
- 
-@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
- 
- 	/* Write the data. */
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
- 	set_fs(oldfs);
- 	if (host_err < 0)
- 		goto out_nfserr;
-@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
- 	 */
- 
- 	oldfs = get_fs(); set_fs(KERNEL_DS);
--	host_err = inode->i_op->readlink(dentry, buf, *lenp);
-+	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
- 	set_fs(oldfs);
- 
- 	if (host_err < 0)
-diff -urNp linux-2.6.32.13/fs/nls/nls_base.c linux-2.6.32.13/fs/nls/nls_base.c
---- linux-2.6.32.13/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/nls/nls_base.c	2010-05-15 13:21:17.550577951 -0400
-@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
-     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
-     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
-     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
--    {0,						       /* end of table    */}
-+    {0, 0, 0, 0, 0,				       /* end of table    */}
- };
- 
- #define UNICODE_MAX	0x0010ffff
-diff -urNp linux-2.6.32.13/fs/ntfs/file.c linux-2.6.32.13/fs/ntfs/file.c
---- linux-2.6.32.13/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ntfs/file.c	2010-05-15 13:21:17.582652999 -0400
-@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
- #endif /* NTFS_RW */
- };
- 
--const struct file_operations ntfs_empty_file_ops = {};
-+const struct file_operations ntfs_empty_file_ops __read_only;
- 
--const struct inode_operations ntfs_empty_inode_ops = {};
-+const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.32.13/fs/ocfs2/cluster/masklog.c linux-2.6.32.13/fs/ocfs2/cluster/masklog.c
---- linux-2.6.32.13/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ocfs2/cluster/masklog.c	2010-05-15 13:21:17.582652999 -0400
-@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
- 	return mlog_mask_store(mlog_attr->mask, buf, count);
- }
- 
--static struct sysfs_ops mlog_attr_ops = {
-+static const struct sysfs_ops mlog_attr_ops = {
- 	.show  = mlog_show,
- 	.store = mlog_store,
- };
-diff -urNp linux-2.6.32.13/fs/ocfs2/localalloc.c linux-2.6.32.13/fs/ocfs2/localalloc.c
---- linux-2.6.32.13/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ocfs2/localalloc.c	2010-05-15 13:21:17.587704007 -0400
-@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
- 		goto bail;
- 	}
- 
--	atomic_inc(&osb->alloc_stats.moves);
-+	atomic_inc_unchecked(&osb->alloc_stats.moves);
- 
- 	status = 0;
- bail:
-diff -urNp linux-2.6.32.13/fs/ocfs2/ocfs2.h linux-2.6.32.13/fs/ocfs2/ocfs2.h
---- linux-2.6.32.13/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ocfs2/ocfs2.h	2010-05-15 13:21:17.612604736 -0400
-@@ -217,11 +217,11 @@ enum ocfs2_vol_state
- 
- struct ocfs2_alloc_stats
- {
--	atomic_t moves;
--	atomic_t local_data;
--	atomic_t bitmap_data;
--	atomic_t bg_allocs;
--	atomic_t bg_extends;
-+	atomic_unchecked_t moves;
-+	atomic_unchecked_t local_data;
-+	atomic_unchecked_t bitmap_data;
-+	atomic_unchecked_t bg_allocs;
-+	atomic_unchecked_t bg_extends;
- };
- 
- enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.32.13/fs/ocfs2/suballoc.c linux-2.6.32.13/fs/ocfs2/suballoc.c
---- linux-2.6.32.13/fs/ocfs2/suballoc.c	2010-04-29 17:49:38.449086403 -0400
-+++ linux-2.6.32.13/fs/ocfs2/suballoc.c	2010-05-15 13:21:17.655985201 -0400
-@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
- 				mlog_errno(status);
- 			goto bail;
- 		}
--		atomic_inc(&osb->alloc_stats.bg_extends);
-+		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
- 
- 		/* You should never ask for this much metadata */
- 		BUG_ON(bits_wanted >
-@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
- 	ac->ac_bits_given += (*num_bits);
-@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
- 		mlog_errno(status);
- 		goto bail;
- 	}
--	atomic_inc(&osb->alloc_stats.bg_allocs);
-+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
- 
- 	BUG_ON(num_bits != 1);
- 
-@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 						      cluster_start,
- 						      num_clusters);
- 		if (!status)
--			atomic_inc(&osb->alloc_stats.local_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.local_data);
- 	} else {
- 		if (min_clusters > (osb->bitmap_cpg - 1)) {
- 			/* The only paths asking for contiguousness
-@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
- 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
- 								 bg_blkno,
- 								 bg_bit_off);
--			atomic_inc(&osb->alloc_stats.bitmap_data);
-+			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
- 		}
- 	}
- 	if (status < 0) {
-diff -urNp linux-2.6.32.13/fs/ocfs2/super.c linux-2.6.32.13/fs/ocfs2/super.c
---- linux-2.6.32.13/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/ocfs2/super.c	2010-05-15 13:21:17.677940986 -0400
-@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
- 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
- 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
- 			"Stats",
--			atomic_read(&osb->alloc_stats.bitmap_data),
--			atomic_read(&osb->alloc_stats.local_data),
--			atomic_read(&osb->alloc_stats.bg_allocs),
--			atomic_read(&osb->alloc_stats.moves),
--			atomic_read(&osb->alloc_stats.bg_extends));
-+			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
-+			atomic_read_unchecked(&osb->alloc_stats.local_data),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
-+			atomic_read_unchecked(&osb->alloc_stats.moves),
-+			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
- 
- 	out += snprintf(buf + out, len - out,
- 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
-@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
- 	spin_lock_init(&osb->osb_xattr_lock);
- 	ocfs2_init_inode_steal_slot(osb);
- 
--	atomic_set(&osb->alloc_stats.moves, 0);
--	atomic_set(&osb->alloc_stats.local_data, 0);
--	atomic_set(&osb->alloc_stats.bitmap_data, 0);
--	atomic_set(&osb->alloc_stats.bg_allocs, 0);
--	atomic_set(&osb->alloc_stats.bg_extends, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
-+	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
- 
- 	/* Copy the blockcheck stats from the superblock probe */
- 	osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.32.13/fs/open.c linux-2.6.32.13/fs/open.c
---- linux-2.6.32.13/fs/open.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/open.c	2010-05-15 13:21:17.687346474 -0400
-@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
- 	if (length < 0)
- 		return -EINVAL;
- 
-+	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_size = length;
- 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
- 	if (filp) {
-@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
- 	if (__mnt_is_readonly(path.mnt))
- 		res = -EROFS;
- 
-+	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
-+		res = -EACCES;
-+
- out_path_release:
- 	path_put(&path);
- out:
-@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
- 	if (error)
- 		goto dput_and_out;
- 
-+	gr_log_chdir(path.dentry, path.mnt);
-+
- 	set_fs_pwd(current->fs, &path);
- 
- dput_and_out:
-@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
- 		goto out_putf;
- 
- 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
-+
-+	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
-+		error = -EPERM;
-+
-+	if (!error)
-+		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
-+
- 	if (!error)
- 		set_fs_pwd(current->fs, &file->f_path);
- out_putf:
-@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
- 	if (!capable(CAP_SYS_CHROOT))
- 		goto dput_and_out;
- 
-+	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
-+		goto dput_and_out;
-+
-+	if (gr_handle_chroot_caps(&path)) {
-+		error = -ENOMEM;
-+		goto dput_and_out;
-+	}
-+
- 	set_fs_root(current->fs, &path);
-+
-+	gr_handle_chroot_chdir(&path);
-+
- 	error = 0;
- dput_and_out:
- 	path_put(&path);
-@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
- 	err = mnt_want_write_file(file);
- 	if (err)
- 		goto out_putf;
-+
-+	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
-+		err = -EPERM;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	err = notify_change(dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(file->f_path.mnt);
- out_putf:
- 	fput(file);
-@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto dput_and_out;
-+
-+	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		goto out_drop_write;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	if (mode == (mode_t) -1)
- 		mode = inode->i_mode;
-+
-+	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
-+		error = -EACCES;
-+		mutex_unlock(&inode->i_mutex);
-+		goto out_drop_write;
-+	}
-+
- 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
- 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
- 	error = notify_change(path.dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-+
-+out_drop_write:
- 	mnt_drop_write(path.mnt);
- dput_and_out:
- 	path_put(&path);
-@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
- 	return sys_fchmodat(AT_FDCWD, filename, mode);
- }
- 
--static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
-+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
- {
- 	struct inode *inode = dentry->d_inode;
- 	int error;
- 	struct iattr newattrs;
- 
-+	if (!gr_acl_handle_chown(dentry, mnt))
-+		return -EACCES;
-+
- 	newattrs.ia_valid =  ATTR_CTIME;
- 	if (user != (uid_t) -1) {
- 		newattrs.ia_valid |= ATTR_UID;
-@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
- 	error = mnt_want_write(path.mnt);
- 	if (error)
- 		goto out_release;
--	error = chown_common(path.dentry, user, group);
-+	error = chown_common(path.dentry, user, group, path.mnt);
- 	mnt_drop_write(path.mnt);
- out_release:
- 	path_put(&path);
-@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
- 		goto out_fput;
- 	dentry = file->f_path.dentry;
- 	audit_inode(NULL, dentry);
--	error = chown_common(dentry, user, group);
-+	error = chown_common(dentry, user, group, file->f_path.mnt);
- 	mnt_drop_write(file->f_path.mnt);
- out_fput:
- 	fput(file);
-diff -urNp linux-2.6.32.13/fs/pipe.c linux-2.6.32.13/fs/pipe.c
---- linux-2.6.32.13/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/pipe.c	2010-05-15 13:21:17.687346474 -0400
-@@ -401,9 +401,9 @@ redo:
- 		}
- 		if (bufs)	/* More to do? */
- 			continue;
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			/* syscall merging: Usually we must not sleep
- 			 * if O_NONBLOCK is set, or if we got some data.
- 			 * But if a writer sleeps in kernel space, then
-@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
- 
--	if (!pipe->readers) {
-+	if (!atomic_read(&pipe->readers)) {
- 		send_sig(SIGPIPE, current, 0);
- 		ret = -EPIPE;
- 		goto out;
-@@ -511,7 +511,7 @@ redo1:
- 	for (;;) {
- 		int bufs;
- 
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -597,9 +597,9 @@ redo2:
- 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
- 			do_wakeup = 0;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- out:
- 	mutex_unlock(&inode->i_mutex);
-@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
- 	mask = 0;
- 	if (filp->f_mode & FMODE_READ) {
- 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
--		if (!pipe->writers && filp->f_version != pipe->w_counter)
-+		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
- 			mask |= POLLHUP;
- 	}
- 
-@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
- 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
- 		 * behave exactly like pipes for poll().
- 		 */
--		if (!pipe->readers)
-+		if (!atomic_read(&pipe->readers))
- 			mask |= POLLERR;
- 	}
- 
-@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
- 
- 	mutex_lock(&inode->i_mutex);
- 	pipe = inode->i_pipe;
--	pipe->readers -= decr;
--	pipe->writers -= decw;
-+	atomic_sub(decr, &pipe->readers);
-+	atomic_sub(decw, &pipe->writers);
- 
--	if (!pipe->readers && !pipe->writers) {
-+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
- 		free_pipe_info(inode);
- 	} else {
- 		wake_up_interruptible_sync(&pipe->wait);
-@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->readers++;
-+		atomic_inc(&inode->i_pipe->readers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
- 
- 	if (inode->i_pipe) {
- 		ret = 0;
--		inode->i_pipe->writers++;
-+		atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
- 	if (inode->i_pipe) {
- 		ret = 0;
- 		if (filp->f_mode & FMODE_READ)
--			inode->i_pipe->readers++;
-+			atomic_inc(&inode->i_pipe->readers);
- 		if (filp->f_mode & FMODE_WRITE)
--			inode->i_pipe->writers++;
-+			atomic_inc(&inode->i_pipe->writers);
- 	}
- 
- 	mutex_unlock(&inode->i_mutex);
-@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
- 	inode->i_pipe = NULL;
- }
- 
--static struct vfsmount *pipe_mnt __read_mostly;
-+struct vfsmount *pipe_mnt __read_mostly;
- static int pipefs_delete_dentry(struct dentry *dentry)
- {
- 	/*
-@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
- 		goto fail_iput;
- 	inode->i_pipe = pipe;
- 
--	pipe->readers = pipe->writers = 1;
-+	atomic_set(&pipe->readers, 1);
-+	atomic_set(&pipe->writers, 1);
- 	inode->i_fop = &rdwr_pipefifo_fops;
- 
- 	/*
-diff -urNp linux-2.6.32.13/fs/proc/array.c linux-2.6.32.13/fs/proc/array.c
---- linux-2.6.32.13/fs/proc/array.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/array.c	2010-05-15 13:21:17.690587811 -0400
-@@ -410,6 +410,21 @@ static void task_show_stack_usage(struct
- }
- #endif		/* CONFIG_MMU */
- 
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline void task_pax(struct seq_file *m, struct task_struct *p)
-+{
-+	if (p->mm)
-+		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
-+			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
-+			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
-+			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
-+			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
-+			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
-+	else
-+		seq_printf(m, "PaX:\t-----\n");
-+}
-+#endif
-+
- int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task)
- {
-@@ -430,9 +445,20 @@ int proc_pid_status(struct seq_file *m, 
- #endif
- 	task_context_switch_counts(m, task);
- 	task_show_stack_usage(m, task);
-+
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	task_pax(m, task);
-+#endif
-+
- 	return 0;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
- 			struct pid *pid, struct task_struct *task, int whole)
- {
-@@ -529,6 +555,19 @@ static int do_task_stat(struct seq_file 
- 		gtime = task_gtime(task);
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (PAX_RAND_FLAGS(mm)) {
-+		eip = 0;
-+		esp = 0;
-+		wchan = 0;
-+	}
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	wchan = 0;
-+	eip =0;
-+	esp =0;
-+#endif
-+
- 	/* scale priority and nice values from timeslices to -20..20 */
- 	/* to make it look like a "normal" Unix priority/nice value  */
- 	priority = task_prio(task);
-@@ -569,9 +608,15 @@ static int do_task_stat(struct seq_file 
- 		vsize,
- 		mm ? get_mm_rss(mm) : 0,
- 		rsslim,
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
-+		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
-+#else
- 		mm ? mm->start_code : 0,
- 		mm ? mm->end_code : 0,
- 		(permitted && mm) ? task->stack_start : 0,
-+#endif
- 		esp,
- 		eip,
- 		/* The signal information here is obsolete.
-@@ -624,3 +669,10 @@ int proc_pid_statm(struct seq_file *m, s
- 
- 	return 0;
- }
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
-+{
-+	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
-+}
-+#endif
-diff -urNp linux-2.6.32.13/fs/proc/base.c linux-2.6.32.13/fs/proc/base.c
---- linux-2.6.32.13/fs/proc/base.c	2010-05-15 13:20:19.242597763 -0400
-+++ linux-2.6.32.13/fs/proc/base.c	2010-05-15 13:21:17.690587811 -0400
-@@ -102,6 +102,22 @@ struct pid_entry {
- 	union proc_op op;
- };
- 
-+struct getdents_callback {
-+	struct linux_dirent __user * current_dir;
-+	struct linux_dirent __user * previous;
-+	struct file * file;
-+	int count;
-+	int error;
-+};
-+
-+static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
-+			   loff_t offset, u64 ino, unsigned int d_type)
-+{
-+	struct getdents_callback * buf = (struct getdents_callback *) __buf;
-+	buf->error = -EINVAL;
-+	return 0;
-+}
-+
- #define NOD(NAME, MODE, IOP, FOP, OP) {			\
- 	.name = (NAME),					\
- 	.len  = sizeof(NAME) - 1,			\
-@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
- 	if (task == current)
- 		return 0;
- 
-+	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
-+		return -EPERM;
-+
- 	/*
- 	 * If current is actively ptrace'ing, and would also be
- 	 * permitted to freshly attach with ptrace now, permit it.
-@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
- 	if (!mm->arg_end)
- 		goto out_mm;	/* Shh! No looking before we're done */
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out_mm;
-+
-  	len = mm->arg_end - mm->arg_start;
-  
- 	if (len > PAGE_SIZE)
-@@ -287,12 +309,26 @@ out:
- 	return res;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static int proc_pid_auxv(struct task_struct *task, char *buffer)
- {
- 	int res = 0;
- 	struct mm_struct *mm = get_task_mm(task);
- 	if (mm) {
- 		unsigned int nwords = 0;
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (PAX_RAND_FLAGS(mm)) {
-+			mmput(mm);
-+			return res;
-+		}
-+#endif
-+
- 		do {
- 			nwords += 2;
- 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
-@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
- }
- #endif /* CONFIG_KALLSYMS */
- 
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 
- #define MAX_STACK_TRACE_DEPTH	64
- 
-@@ -522,7 +558,7 @@ static int proc_pid_limits(struct task_s
- 	return count;
- }
- 
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- static int proc_pid_syscall(struct task_struct *task, char *buffer)
- {
- 	long nr;
-@@ -936,6 +972,9 @@ static ssize_t environ_read(struct file 
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_acl_handle_procpidmem(task))
-+		goto out;
-+
- 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
- 		goto out;
- 
-@@ -1456,7 +1495,11 @@ static struct inode *proc_pid_make_inode
- 		rcu_read_lock();
- 		cred = __task_cred(task);
- 		inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 		inode->i_gid = cred->egid;
-+#endif
- 		rcu_read_unlock();
- 	}
- 	security_task_to_inode(task, inode);
-@@ -1474,6 +1517,9 @@ static int pid_getattr(struct vfsmount *
- 	struct inode *inode = dentry->d_inode;
- 	struct task_struct *task;
- 	const struct cred *cred;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+#endif
- 
- 	generic_fillattr(inode, stat);
- 
-@@ -1481,12 +1527,34 @@ static int pid_getattr(struct vfsmount *
- 	stat->uid = 0;
- 	stat->gid = 0;
- 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
-+
-+	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
-+		rcu_read_unlock();
-+		return -ENOENT;
-+	}
-+
- 	if (task) {
-+		cred = __task_cred(task);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+		)
-+#endif
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
--			cred = __task_cred(task);
- 			stat->uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			stat->gid = cred->egid;
-+#endif
- 		}
- 	}
- 	rcu_read_unlock();
-@@ -1518,11 +1586,20 @@ static int pid_revalidate(struct dentry 
- 
- 	if (task) {
- 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
-+#endif
- 		    task_dumpable(task)) {
- 			rcu_read_lock();
- 			cred = __task_cred(task);
- 			inode->i_uid = cred->euid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = cred->egid;
-+#endif
- 			rcu_read_unlock();
- 		} else {
- 			inode->i_uid = 0;
-@@ -1643,7 +1720,8 @@ static int proc_fd_info(struct inode *in
- 	int fd = proc_fd(inode);
- 
- 	if (task) {
--		files = get_files_struct(task);
-+		if (!gr_acl_handle_procpidmem(task))
-+			files = get_files_struct(task);
- 		put_task_struct(task);
- 	}
- 	if (files) {
-@@ -1895,12 +1973,22 @@ static const struct file_operations proc
- static int proc_fd_permission(struct inode *inode, int mask)
- {
- 	int rv;
-+	struct task_struct *task;
- 
- 	rv = generic_permission(inode, mask, NULL);
--	if (rv == 0)
--		return 0;
-+
- 	if (task_pid(current) == proc_pid(inode))
- 		rv = 0;
-+
-+	task = get_proc_task(inode);
-+	if (task == NULL)
-+		return rv;
-+
-+	if (gr_acl_handle_procpidmem(task))
-+		rv = -EACCES;
-+
-+	put_task_struct(task);
-+
- 	return rv;
- }
- 
-@@ -2009,6 +2097,9 @@ static struct dentry *proc_pident_lookup
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	/*
- 	 * Yes, it does not scale. And it should not. Don't add
- 	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2053,6 +2144,9 @@ static int proc_pident_readdir(struct fi
- 	if (!task)
- 		goto out_no_task;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	ret = 0;
- 	i = filp->f_pos;
- 	switch (i) {
-@@ -2320,7 +2414,7 @@ static void *proc_self_follow_link(struc
- static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
- 				void *cookie)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-@@ -2433,6 +2527,9 @@ static struct dentry *proc_base_lookup(s
- 	if (p > last)
- 		goto out;
- 
-+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
-+		goto out;
-+
- 	error = proc_base_instantiate(dir, dentry, task, p);
- 
- out:
-@@ -2519,7 +2616,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",    S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
-@@ -2547,7 +2644,7 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",      S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-@@ -2577,6 +2674,9 @@ static const struct pid_entry tgid_base_
- #ifdef CONFIG_TASK_IO_ACCOUNTING
- 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
-+#endif
- };
- 
- static int proc_tgid_base_readdir(struct file * filp,
-@@ -2701,7 +2801,14 @@ static struct dentry *proc_pid_instantia
- 	if (!inode)
- 		goto out;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
-+#else
- 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
-+#endif
- 	inode->i_op = &proc_tgid_base_inode_operations;
- 	inode->i_fop = &proc_tgid_base_operations;
- 	inode->i_flags|=S_IMMUTABLE;
-@@ -2743,7 +2850,11 @@ struct dentry *proc_pid_lookup(struct in
- 	if (!task)
- 		goto out;
- 
-+	if (gr_check_hidden_task(task))
-+		goto out_put_task;
-+
- 	result = proc_pid_instantiate(dir, dentry, task, NULL);
-+out_put_task:
- 	put_task_struct(task);
- out:
- 	return result;
-@@ -2808,6 +2919,11 @@ int proc_pid_readdir(struct file * filp,
- {
- 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *tmpcred = current_cred();
-+	const struct cred *itercred;
-+#endif
-+	filldir_t __filldir = filldir;
- 	struct tgid_iter iter;
- 	struct pid_namespace *ns;
- 
-@@ -2826,8 +2942,27 @@ int proc_pid_readdir(struct file * filp,
- 	for (iter = next_tgid(ns, iter);
- 	     iter.task;
- 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		rcu_read_lock();
-+		itercred = __task_cred(iter.task);
-+#endif
-+		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
-+#endif
-+			)
-+#endif
-+		)
-+			__filldir = &gr_fake_filldir;
-+		else
-+			__filldir = filldir;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	rcu_read_unlock();
-+#endif
- 		filp->f_pos = iter.tgid + TGID_OFFSET;
--		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
-+		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
- 			put_task_struct(iter.task);
- 			goto out;
- 		}
-@@ -2853,7 +2988,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_SCHED_DEBUG
- 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
- #endif
--#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
-+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
- 	INF("syscall",   S_IRUSR, proc_pid_syscall),
- #endif
- 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -2880,7 +3015,7 @@ static const struct pid_entry tid_base_s
- #ifdef CONFIG_KALLSYMS
- 	INF("wchan",     S_IRUGO, proc_pid_wchan),
- #endif
--#ifdef CONFIG_STACKTRACE
-+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- 	ONE("stack",      S_IRUSR, proc_pid_stack),
- #endif
- #ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.32.13/fs/proc/cmdline.c linux-2.6.32.13/fs/proc/cmdline.c
---- linux-2.6.32.13/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/cmdline.c	2010-05-15 13:21:17.694581759 -0400
-@@ -23,7 +23,11 @@ static const struct file_operations cmdl
- 
- static int __init proc_cmdline_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
-+#else
- 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
-+#endif
- 	return 0;
- }
- module_init(proc_cmdline_init);
-diff -urNp linux-2.6.32.13/fs/proc/devices.c linux-2.6.32.13/fs/proc/devices.c
---- linux-2.6.32.13/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/devices.c	2010-05-15 13:21:17.706647417 -0400
-@@ -64,7 +64,11 @@ static const struct file_operations proc
- 
- static int __init proc_devices_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
-+#else
- 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_devices_init);
-diff -urNp linux-2.6.32.13/fs/proc/inode.c linux-2.6.32.13/fs/proc/inode.c
---- linux-2.6.32.13/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/inode.c	2010-05-15 13:21:17.710596393 -0400
-@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
- 		if (de->mode) {
- 			inode->i_mode = de->mode;
- 			inode->i_uid = de->uid;
-+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
-+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
-+#else
- 			inode->i_gid = de->gid;
-+#endif
- 		}
- 		if (de->size)
- 			inode->i_size = de->size;
-diff -urNp linux-2.6.32.13/fs/proc/internal.h linux-2.6.32.13/fs/proc/internal.h
---- linux-2.6.32.13/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/internal.h	2010-05-15 13:21:17.714628011 -0400
-@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
- 				struct pid *pid, struct task_struct *task);
- extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
- 				struct pid *pid, struct task_struct *task);
-+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
-+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
-+#endif
- extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
- 
- extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.32.13/fs/proc/Kconfig linux-2.6.32.13/fs/proc/Kconfig
---- linux-2.6.32.13/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/Kconfig	2010-05-15 13:21:17.722605604 -0400
-@@ -30,12 +30,12 @@ config PROC_FS
- 
- config PROC_KCORE
- 	bool "/proc/kcore support" if !ARM
--	depends on PROC_FS && MMU
-+	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
- 
- config PROC_VMCORE
-         bool "/proc/vmcore support (EXPERIMENTAL)"
--        depends on PROC_FS && CRASH_DUMP
--	default y
-+        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
-+	default n
-         help
-         Exports the dump image of crashed kernel in ELF format.
- 
-@@ -59,8 +59,8 @@ config PROC_SYSCTL
- 	  limited in memory.
- 
- config PROC_PAGE_MONITOR
-- 	default y
--	depends on PROC_FS && MMU
-+ 	default n
-+	depends on PROC_FS && MMU && !GRKERNSEC
- 	bool "Enable /proc page monitoring" if EMBEDDED
-  	help
- 	  Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.32.13/fs/proc/kcore.c linux-2.6.32.13/fs/proc/kcore.c
---- linux-2.6.32.13/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/kcore.c	2010-05-15 13:21:17.730660780 -0400
-@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
- 
- static int open_kcore(struct inode *inode, struct file *filp)
- {
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	return -EPERM;
-+#endif
- 	if (!capable(CAP_SYS_RAWIO))
- 		return -EPERM;
- 	if (kcore_need_update)
-diff -urNp linux-2.6.32.13/fs/proc/meminfo.c linux-2.6.32.13/fs/proc/meminfo.c
---- linux-2.6.32.13/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/meminfo.c	2010-05-15 13:21:17.734637714 -0400
-@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
- 		vmi.used >> 10,
- 		vmi.largest_chunk >> 10
- #ifdef CONFIG_MEMORY_FAILURE
--		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
-+		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
- #endif
- 		);
- 
-diff -urNp linux-2.6.32.13/fs/proc/nommu.c linux-2.6.32.13/fs/proc/nommu.c
---- linux-2.6.32.13/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/nommu.c	2010-05-15 13:21:17.738599356 -0400
-@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.13/fs/proc/proc_net.c linux-2.6.32.13/fs/proc/proc_net.c
---- linux-2.6.32.13/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/proc_net.c	2010-05-15 13:21:17.742599005 -0400
-@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
- 	struct task_struct *task;
- 	struct nsproxy *ns;
- 	struct net *net = NULL;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred = current_cred();
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	if (cred->fsuid)
-+		return net;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
-+		return net;
-+#endif
- 
- 	rcu_read_lock();
- 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.32.13/fs/proc/proc_sysctl.c linux-2.6.32.13/fs/proc/proc_sysctl.c
---- linux-2.6.32.13/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/proc_sysctl.c	2010-05-15 13:21:17.746588317 -0400
-@@ -7,6 +7,8 @@
- #include <linux/security.h>
- #include "internal.h"
- 
-+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
-+
- static const struct dentry_operations proc_sys_dentry_operations;
- static const struct file_operations proc_sys_file_operations;
- static const struct inode_operations proc_sys_inode_operations;
-@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
- 	if (!p)
- 		goto out;
- 
-+	if (gr_handle_sysctl(p, MAY_EXEC))
-+		goto out;
-+
- 	err = ERR_PTR(-ENOMEM);
- 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
- 	if (h)
-@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
- 		if (*pos < file->f_pos)
- 			continue;
- 
-+		if (gr_handle_sysctl(table, 0))
-+			continue;
-+
- 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
- 		if (res)
- 			return res;
-@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
- 	if (IS_ERR(head))
- 		return PTR_ERR(head);
- 
-+	if (table && gr_handle_sysctl(table, MAY_EXEC))
-+		return -ENOENT;
-+
- 	generic_fillattr(inode, stat);
- 	if (table)
- 		stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.32.13/fs/proc/root.c linux-2.6.32.13/fs/proc/root.c
---- linux-2.6.32.13/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/root.c	2010-05-15 13:21:17.750584298 -0400
-@@ -134,7 +134,15 @@ void __init proc_root_init(void)
- #ifdef CONFIG_PROC_DEVICETREE
- 	proc_device_tree_init();
- #endif
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
-+#endif
-+#else
- 	proc_mkdir("bus", NULL);
-+#endif
- 	proc_sys_init();
- }
- 
-diff -urNp linux-2.6.32.13/fs/proc/task_mmu.c linux-2.6.32.13/fs/proc/task_mmu.c
---- linux-2.6.32.13/fs/proc/task_mmu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/task_mmu.c	2010-05-15 13:21:17.758934117 -0400
-@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
- 		"VmStk:\t%8lu kB\n"
- 		"VmExe:\t%8lu kB\n"
- 		"VmLib:\t%8lu kB\n"
--		"VmPTE:\t%8lu kB\n",
--		hiwater_vm << (PAGE_SHIFT-10),
-+		"VmPTE:\t%8lu kB\n"
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
-+#endif
-+
-+		,hiwater_vm << (PAGE_SHIFT-10),
- 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
- 		mm->locked_vm << (PAGE_SHIFT-10),
- 		hiwater_rss << (PAGE_SHIFT-10),
- 		total_rss << (PAGE_SHIFT-10),
- 		data << (PAGE_SHIFT-10),
- 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
--		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
-+		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		, mm->context.user_cs_base, mm->context.user_cs_limit
-+#endif
-+
-+	);
- }
- 
- unsigned long task_vsize(struct mm_struct *mm)
-@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
- 	return ret;
- }
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
-+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
-+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
-+#endif
-+
- static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
- {
- 	struct mm_struct *mm = vma->vm_mm;
-@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
- 	}
- 
- 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
-+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
-+#else
- 			vma->vm_start,
- 			vma->vm_end,
-+#endif
- 			flags & VM_READ ? 'r' : '-',
- 			flags & VM_WRITE ? 'w' : '-',
- 			flags & VM_EXEC ? 'x' : '-',
- 			flags & VM_MAYSHARE ? 's' : 'p',
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
-+#else
- 			pgoff,
-+#endif
- 			MAJOR(dev), MINOR(dev), ino, &len);
- 
- 	/*
-@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
- 	 */
- 	if (file) {
- 		pad_len_spaces(m, len);
--		seq_path(m, &file->f_path, "\n");
-+		seq_path(m, &file->f_path, "\n\\");
- 	} else {
- 		const char *name = arch_vma_name(vma);
- 		if (!name) {
- 			if (mm) {
--				if (vma->vm_start <= mm->start_brk &&
--						vma->vm_end >= mm->brk) {
-+				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 					name = "[heap]";
--				} else if (vma->vm_start <= mm->start_stack &&
--					   vma->vm_end >= mm->start_stack) {
-+				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
-+					   (vma->vm_start <= mm->start_stack &&
-+					    vma->vm_end >= mm->start_stack)) {
- 					name = "[stack]";
- 				} else {
- 					unsigned long stack_start;
-@@ -403,9 +429,16 @@ static int show_smap(struct seq_file *m,
- 	};
- 
- 	memset(&mss, 0, sizeof mss);
--	mss.vma = vma;
--	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
--		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
-+#endif
-+		mss.vma = vma;
-+		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-+			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	}
-+#endif
- 
- 	show_map_vma(m, vma);
- 
-@@ -421,7 +454,11 @@ static int show_smap(struct seq_file *m,
- 		   "Swap:           %8lu kB\n"
- 		   "KernelPageSize: %8lu kB\n"
- 		   "MMUPageSize:    %8lu kB\n",
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
-+#else
- 		   (vma->vm_end - vma->vm_start) >> 10,
-+#endif
- 		   mss.resident >> 10,
- 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
- 		   mss.shared_clean  >> 10,
-diff -urNp linux-2.6.32.13/fs/proc/task_nommu.c linux-2.6.32.13/fs/proc/task_nommu.c
---- linux-2.6.32.13/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/proc/task_nommu.c	2010-05-15 13:21:17.758934117 -0400
-@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
- 	else
- 		bytes += kobjsize(mm);
- 	
--	if (current->fs && current->fs->users > 1)
-+	if (current->fs && atomic_read(&current->fs->users) > 1)
- 		sbytes += kobjsize(current->fs);
- 	else
- 		bytes += kobjsize(current->fs);
-@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
- 		if (len < 1)
- 			len = 1;
- 		seq_printf(m, "%*c", len, ' ');
--		seq_path(m, &file->f_path, "");
-+		seq_path(m, &file->f_path, "\n\\");
- 	}
- 
- 	seq_putc(m, '\n');
-diff -urNp linux-2.6.32.13/fs/readdir.c linux-2.6.32.13/fs/readdir.c
---- linux-2.6.32.13/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/readdir.c	2010-05-15 13:21:17.778956743 -0400
-@@ -16,6 +16,7 @@
- #include <linux/security.h>
- #include <linux/syscalls.h>
- #include <linux/unistd.h>
-+#include <linux/namei.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -67,6 +68,7 @@ struct old_linux_dirent {
- 
- struct readdir_callback {
- 	struct old_linux_dirent __user * dirent;
-+	struct file * file;
- 	int result;
- };
- 
-@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
- 		buf->result = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	buf->result++;
- 	dirent = buf->dirent;
- 	if (!access_ok(VERIFY_WRITE, dirent,
-@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
- 
- 	buf.result = 0;
- 	buf.dirent = dirent;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, fillonedir, &buf);
- 	if (buf.result)
-@@ -142,6 +149,7 @@ struct linux_dirent {
- struct getdents_callback {
- 	struct linux_dirent __user * current_dir;
- 	struct linux_dirent __user * previous;
-+	struct file * file;
- 	int count;
- 	int error;
- };
-@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
- 		buf->error = -EOVERFLOW;
- 		return -EOVERFLOW;
- 	}
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
- 	buf.previous = NULL;
- 	buf.count = count;
- 	buf.error = 0;
-+	buf.file = file;
- 
- 	error = vfs_readdir(file, filldir, &buf);
- 	if (error >= 0)
-@@ -228,6 +241,7 @@ out:
- struct getdents_callback64 {
- 	struct linux_dirent64 __user * current_dir;
- 	struct linux_dirent64 __user * previous;
-+	struct file *file;
- 	int count;
- 	int error;
- };
-@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
- 	buf->error = -EINVAL;	/* only used if we fail.. */
- 	if (reclen > buf->count)
- 		return -EINVAL;
-+
-+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
-+		return 0;
-+
- 	dirent = buf->previous;
- 	if (dirent) {
- 		if (__put_user(offset, &dirent->d_off))
-@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
- 
- 	buf.current_dir = dirent;
- 	buf.previous = NULL;
-+	buf.file = file;
- 	buf.count = count;
- 	buf.error = 0;
- 
-diff -urNp linux-2.6.32.13/fs/reiserfs/do_balan.c linux-2.6.32.13/fs/reiserfs/do_balan.c
---- linux-2.6.32.13/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/reiserfs/do_balan.c	2010-05-15 13:21:17.786600991 -0400
-@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
- 		return;
- 	}
- 
--	atomic_inc(&(fs_generation(tb->tb_sb)));
-+	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
- 	do_balance_starts(tb);
- 
- 	/* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.32.13/fs/reiserfs/item_ops.c linux-2.6.32.13/fs/reiserfs/item_ops.c
---- linux-2.6.32.13/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/reiserfs/item_ops.c	2010-05-15 13:21:17.794567981 -0400
-@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations stat_data_ops = {
-+static const struct item_operations stat_data_ops = {
- 	.bytes_number = sd_bytes_number,
- 	.decrement_key = sd_decrement_key,
- 	.is_left_mergeable = sd_is_left_mergeable,
-@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations direct_ops = {
-+static const struct item_operations direct_ops = {
- 	.bytes_number = direct_bytes_number,
- 	.decrement_key = direct_decrement_key,
- 	.is_left_mergeable = direct_is_left_mergeable,
-@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
- 			 vi->vi_index, vi->vi_type, vi->vi_ih);
- }
- 
--static struct item_operations indirect_ops = {
-+static const struct item_operations indirect_ops = {
- 	.bytes_number = indirect_bytes_number,
- 	.decrement_key = indirect_decrement_key,
- 	.is_left_mergeable = indirect_is_left_mergeable,
-@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
- 	printk("\n");
- }
- 
--static struct item_operations direntry_ops = {
-+static const struct item_operations direntry_ops = {
- 	.bytes_number = direntry_bytes_number,
- 	.decrement_key = direntry_decrement_key,
- 	.is_left_mergeable = direntry_is_left_mergeable,
-@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
- 			 "Invalid item type observed, run fsck ASAP");
- }
- 
--static struct item_operations errcatch_ops = {
-+static const struct item_operations errcatch_ops = {
- 	errcatch_bytes_number,
- 	errcatch_decrement_key,
- 	errcatch_is_left_mergeable,
-@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
- #error Item types must use disk-format assigned values.
- #endif
- 
--struct item_operations *item_ops[TYPE_ANY + 1] = {
-+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
- 	&stat_data_ops,
- 	&indirect_ops,
- 	&direct_ops,
-diff -urNp linux-2.6.32.13/fs/reiserfs/procfs.c linux-2.6.32.13/fs/reiserfs/procfs.c
---- linux-2.6.32.13/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/reiserfs/procfs.c	2010-05-15 13:21:17.802593961 -0400
-@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
- 		   "SMALL_TAILS " : "NO_TAILS ",
- 		   replay_only(sb) ? "REPLAY_ONLY " : "",
- 		   convert_reiserfs(sb) ? "CONV " : "",
--		   atomic_read(&r->s_generation_counter),
-+		   atomic_read_unchecked(&r->s_generation_counter),
- 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
- 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
- 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
-diff -urNp linux-2.6.32.13/fs/select.c linux-2.6.32.13/fs/select.c
---- linux-2.6.32.13/fs/select.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/select.c	2010-05-15 13:21:17.806683634 -0400
-@@ -20,6 +20,7 @@
- #include <linux/module.h>
- #include <linux/slab.h>
- #include <linux/poll.h>
-+#include <linux/security.h>
- #include <linux/personality.h> /* for STICKY_TIMEOUTS */
- #include <linux/file.h>
- #include <linux/fdtable.h>
-@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
-  	struct poll_list *walk = head;
-  	unsigned long todo = nfds;
- 
-+	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
- 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
- 		return -EINVAL;
- 
-diff -urNp linux-2.6.32.13/fs/seq_file.c linux-2.6.32.13/fs/seq_file.c
---- linux-2.6.32.13/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/seq_file.c	2010-05-15 13:21:17.810601731 -0400
-@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
- 		return 0;
- 	}
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			return -ENOMEM;
- 	}
-@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
- Eoverflow:
- 	m->op->stop(m, p);
- 	kfree(m->buf);
--	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+	m->size <<= 1;
-+	m->buf = kmalloc(m->size, GFP_KERNEL);
- 	return !m->buf ? -ENOMEM : -EAGAIN;
- }
- 
-@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
- 	m->version = file->f_version;
- 	/* grab buffer if we didn't have one */
- 	if (!m->buf) {
--		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-+		m->size = PAGE_SIZE;
-+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 	}
-@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
- 			goto Fill;
- 		m->op->stop(m, p);
- 		kfree(m->buf);
--		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-+		m->size <<= 1;
-+		m->buf = kmalloc(m->size, GFP_KERNEL);
- 		if (!m->buf)
- 			goto Enomem;
- 		m->count = 0;
-diff -urNp linux-2.6.32.13/fs/smbfs/symlink.c linux-2.6.32.13/fs/smbfs/symlink.c
---- linux-2.6.32.13/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/smbfs/symlink.c	2010-05-15 13:21:17.810601731 -0400
-@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
- 
- static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
- {
--	char *s = nd_get_link(nd);
-+	const char *s = nd_get_link(nd);
- 	if (!IS_ERR(s))
- 		__putname(s);
- }
-diff -urNp linux-2.6.32.13/fs/splice.c linux-2.6.32.13/fs/splice.c
---- linux-2.6.32.13/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/splice.c	2010-05-15 13:21:17.818603295 -0400
-@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
- 	pipe_lock(pipe);
- 
- 	for (;;) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
- 			do_wakeup = 0;
- 		}
- 
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
-+	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
- 	old_fs = get_fs();
- 	set_fs(get_ds());
- 	/* The cast to a user pointer is valid due to the set_fs() */
--	res = vfs_write(file, (const char __user *)buf, count, &pos);
-+	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
- 	set_fs(old_fs);
- 
- 	return res;
-@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
- 			goto err;
- 
- 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
--		vec[i].iov_base = (void __user *) page_address(page);
-+		vec[i].iov_base = (__force void __user *) page_address(page);
- 		vec[i].iov_len = this_len;
- 		pages[i] = page;
- 		spd.nr_pages++;
-@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
- int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
- {
- 	while (!pipe->nrbufs) {
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			return 0;
- 
--		if (!pipe->waiting_writers && sd->num_spliced)
-+		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
- 			return 0;
- 
- 		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
- 		 * out of the pipe right after the splice_to_pipe(). So set
- 		 * PIPE_READERS appropriately.
- 		 */
--		pipe->readers = 1;
-+		atomic_set(&pipe->readers, 1);
- 
- 		current->splice_pipe = pipe;
- 	}
-@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		if (!pipe->writers)
-+		if (!atomic_read(&pipe->writers))
- 			break;
--		if (!pipe->waiting_writers) {
-+		if (!atomic_read(&pipe->waiting_writers)) {
- 			if (flags & SPLICE_F_NONBLOCK) {
- 				ret = -EAGAIN;
- 				break;
-@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
- 	pipe_lock(pipe);
- 
- 	while (pipe->nrbufs >= PIPE_BUFFERS) {
--		if (!pipe->readers) {
-+		if (!atomic_read(&pipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			ret = -EPIPE;
- 			break;
-@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
- 			ret = -ERESTARTSYS;
- 			break;
- 		}
--		pipe->waiting_writers++;
-+		atomic_inc(&pipe->waiting_writers);
- 		pipe_wait(pipe);
--		pipe->waiting_writers--;
-+		atomic_dec(&pipe->waiting_writers);
- 	}
- 
- 	pipe_unlock(pipe);
-@@ -1789,14 +1789,14 @@ retry:
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
- 			break;
- 		}
- 
--		if (!ipipe->nrbufs && !ipipe->writers)
-+		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
- 			break;
- 
- 		/*
-@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
- 	pipe_double_lock(ipipe, opipe);
- 
- 	do {
--		if (!opipe->readers) {
-+		if (!atomic_read(&opipe->readers)) {
- 			send_sig(SIGPIPE, current, 0);
- 			if (!ret)
- 				ret = -EPIPE;
-@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
- 	 * return EAGAIN if we have the potential of some data in the
- 	 * future, otherwise just return 0
- 	 */
--	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
-+	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
- 		ret = -EAGAIN;
- 
- 	pipe_unlock(ipipe);
-diff -urNp linux-2.6.32.13/fs/sysfs/file.c linux-2.6.32.13/fs/sysfs/file.c
---- linux-2.6.32.13/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/sysfs/file.c	2010-05-15 13:21:17.818603295 -0400
-@@ -53,7 +53,7 @@ struct sysfs_buffer {
- 	size_t			count;
- 	loff_t			pos;
- 	char			* page;
--	struct sysfs_ops	* ops;
-+	const struct sysfs_ops	* ops;
- 	struct mutex		mutex;
- 	int			needs_read_fill;
- 	int			event;
-@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int ret = 0;
- 	ssize_t count;
- 
-@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
- {
- 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
--	struct sysfs_ops * ops = buffer->ops;
-+	const struct sysfs_ops * ops = buffer->ops;
- 	int rc;
- 
- 	/* need attr_sd for attr and ops, its parent for kobj */
-@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
- 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
- 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
- 	struct sysfs_buffer *buffer;
--	struct sysfs_ops *ops;
-+	const struct sysfs_ops *ops;
- 	int error = -EACCES;
- 	char *p;
- 
-diff -urNp linux-2.6.32.13/fs/sysfs/symlink.c linux-2.6.32.13/fs/sysfs/symlink.c
---- linux-2.6.32.13/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/sysfs/symlink.c	2010-05-15 13:21:17.822590321 -0400
-@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
- 
- static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
- {
--	char *page = nd_get_link(nd);
-+	const char *page = nd_get_link(nd);
- 	if (!IS_ERR(page))
- 		free_page((unsigned long)page);
- }
-diff -urNp linux-2.6.32.13/fs/udf/balloc.c linux-2.6.32.13/fs/udf/balloc.c
---- linux-2.6.32.13/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/udf/balloc.c	2010-05-15 13:21:17.834616935 -0400
-@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
- 			  count, partmap->s_partition_len);
-@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
- 
- 	mutex_lock(&sbi->s_alloc_mutex);
- 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
--	if (bloc->logicalBlockNum < 0 ||
--	    (bloc->logicalBlockNum + count) >
--		partmap->s_partition_len) {
-+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
- 		udf_debug("%d < %d || %d + %d > %d\n",
- 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
- 			  partmap->s_partition_len);
-diff -urNp linux-2.6.32.13/fs/udf/misc.c linux-2.6.32.13/fs/udf/misc.c
---- linux-2.6.32.13/fs/udf/misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/udf/misc.c	2010-05-15 13:21:17.834616935 -0400
-@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
- 		iinfo->i_lenEAttr += size;
- 		return (struct genericFormat *)&ea[offset];
- 	}
--	if (loc & 0x02)
--		;
-+	if (loc & 0x02) {
-+	}
- 
- 	return NULL;
- }
-diff -urNp linux-2.6.32.13/fs/udf/udfdecl.h linux-2.6.32.13/fs/udf/udfdecl.h
---- linux-2.6.32.13/fs/udf/udfdecl.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/udf/udfdecl.h	2010-05-15 13:21:17.859848219 -0400
-@@ -26,7 +26,7 @@ do { \
- 	printk(f, ##a); \
- } while (0)
- #else
--#define udf_debug(f, a...) /**/
-+#define udf_debug(f, a...) do {} while (0)
- #endif
- 
- #define udf_info(f, a...) \
-diff -urNp linux-2.6.32.13/fs/utimes.c linux-2.6.32.13/fs/utimes.c
---- linux-2.6.32.13/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/utimes.c	2010-05-15 13:21:17.859848219 -0400
-@@ -1,6 +1,7 @@
- #include <linux/compiler.h>
- #include <linux/file.h>
- #include <linux/fs.h>
-+#include <linux/security.h>
- #include <linux/linkage.h>
- #include <linux/mount.h>
- #include <linux/namei.h>
-@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
- 				goto mnt_drop_write_and_out;
- 		}
- 	}
-+
-+	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
-+		error = -EACCES;
-+		goto mnt_drop_write_and_out;
-+	}
-+
- 	mutex_lock(&inode->i_mutex);
- 	error = notify_change(path->dentry, &newattrs);
- 	mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/xfs/linux-2.6/xfs_ioctl.c	2010-05-15 13:21:17.862604779 -0400
-@@ -134,7 +134,7 @@ xfs_find_handle(
- 	}
- 
- 	error = -EFAULT;
--	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
-+	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
- 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
- 		goto out_put;
- 
-diff -urNp linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:38.453075413 -0400
-+++ linux-2.6.32.13/fs/xfs/linux-2.6/xfs_iops.c	2010-05-15 13:21:17.866593235 -0400
-@@ -468,7 +468,7 @@ xfs_vn_put_link(
- 	struct nameidata *nd,
- 	void		*p)
- {
--	char		*s = nd_get_link(nd);
-+	const char	*s = nd_get_link(nd);
- 
- 	if (!IS_ERR(s))
- 		kfree(s);
-diff -urNp linux-2.6.32.13/fs/xfs/xfs_bmap.c linux-2.6.32.13/fs/xfs/xfs_bmap.c
---- linux-2.6.32.13/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/fs/xfs/xfs_bmap.c	2010-05-15 13:21:17.902607196 -0400
-@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
- 	int			nmap,
- 	int			ret_nmap);
- #else
--#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
-+#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
- #endif /* DEBUG */
- 
- #if defined(XFS_RW_TRACE)
-diff -urNp linux-2.6.32.13/grsecurity/gracl_alloc.c linux-2.6.32.13/grsecurity/gracl_alloc.c
---- linux-2.6.32.13/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_alloc.c	2010-05-15 13:21:17.902607196 -0400
-@@ -0,0 +1,105 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+
-+static unsigned long alloc_stack_next = 1;
-+static unsigned long alloc_stack_size = 1;
-+static void **alloc_stack;
-+
-+static __inline__ int
-+alloc_pop(void)
-+{
-+	if (alloc_stack_next == 1)
-+		return 0;
-+
-+	kfree(alloc_stack[alloc_stack_next - 2]);
-+
-+	alloc_stack_next--;
-+
-+	return 1;
-+}
-+
-+static __inline__ int
-+alloc_push(void *buf)
-+{
-+	if (alloc_stack_next >= alloc_stack_size)
-+		return 1;
-+
-+	alloc_stack[alloc_stack_next - 1] = buf;
-+
-+	alloc_stack_next++;
-+
-+	return 0;
-+}
-+
-+void *
-+acl_alloc(unsigned long len)
-+{
-+	void *ret = NULL;
-+
-+	if (!len || len > PAGE_SIZE)
-+		goto out;
-+
-+	ret = kmalloc(len, GFP_KERNEL);
-+
-+	if (ret) {
-+		if (alloc_push(ret)) {
-+			kfree(ret);
-+			ret = NULL;
-+		}
-+	}
-+
-+out:
-+	return ret;
-+}
-+
-+void *
-+acl_alloc_num(unsigned long num, unsigned long len)
-+{
-+	if (!len || (num > (PAGE_SIZE / len)))
-+		return NULL;
-+
-+	return acl_alloc(num * len);
-+}
-+
-+void
-+acl_free_all(void)
-+{
-+	if (gr_acl_is_enabled() || !alloc_stack)
-+		return;
-+
-+	while (alloc_pop()) ;
-+
-+	if (alloc_stack) {
-+		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
-+			kfree(alloc_stack);
-+		else
-+			vfree(alloc_stack);
-+	}
-+
-+	alloc_stack = NULL;
-+	alloc_stack_size = 1;
-+	alloc_stack_next = 1;
-+
-+	return;
-+}
-+
-+int
-+acl_alloc_stack_init(unsigned long size)
-+{
-+	if ((size * sizeof (void *)) <= PAGE_SIZE)
-+		alloc_stack =
-+		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
-+	else
-+		alloc_stack = (void **) vmalloc(size * sizeof (void *));
-+
-+	alloc_stack_size = size;
-+
-+	if (!alloc_stack)
-+		return 0;
-+	else
-+		return 1;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/gracl.c linux-2.6.32.13/grsecurity/gracl.c
---- linux-2.6.32.13/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,3897 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/namei.h>
-+#include <linux/mount.h>
-+#include <linux/tty.h>
-+#include <linux/proc_fs.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/types.h>
-+#include <linux/sysctl.h>
-+#include <linux/netdevice.h>
-+#include <linux/ptrace.h>
-+#include <linux/gracl.h>
-+#include <linux/gralloc.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/fdtable.h>
-+#include <linux/percpu.h>
-+
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+
-+static struct acl_role_db acl_role_set;
-+static struct name_db name_set;
-+static struct inodev_db inodev_set;
-+
-+/* for keeping track of userspace pointers used for subjects, so we
-+   can share references in the kernel as well
-+*/
-+
-+static struct dentry *real_root;
-+static struct vfsmount *real_root_mnt;
-+
-+static struct acl_subj_map_db subj_map_set;
-+
-+static struct acl_role_label *default_role;
-+
-+static struct acl_role_label *role_list;
-+
-+static u16 acl_sp_role_value;
-+
-+extern char *gr_shared_page[4];
-+static DECLARE_MUTEX(gr_dev_sem);
-+DEFINE_RWLOCK(gr_inode_lock);
-+
-+struct gr_arg *gr_usermode;
-+
-+static unsigned int gr_status __read_only = GR_STATUS_INIT;
-+
-+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
-+extern void gr_clear_learn_entries(void);
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+extern void gr_log_resource(const struct task_struct *task,
-+			    const int res, const unsigned long wanted, const int gt);
-+#endif
-+
-+unsigned char *gr_system_salt;
-+unsigned char *gr_system_sum;
-+
-+static struct sprole_pw **acl_special_roles = NULL;
-+static __u16 num_sprole_pws = 0;
-+
-+static struct acl_role_label *kernel_role = NULL;
-+
-+static unsigned int gr_auth_attempts = 0;
-+static unsigned long gr_auth_expires = 0UL;
-+
-+extern struct vfsmount *sock_mnt;
-+extern struct vfsmount *pipe_mnt;
-+extern struct vfsmount *shm_mnt;
-+#ifdef CONFIG_HUGETLBFS
-+extern struct vfsmount *hugetlbfs_vfsmount;
-+#endif
-+
-+static struct acl_object_label *fakefs_obj;
-+
-+extern int gr_init_uidset(void);
-+extern void gr_free_uidset(void);
-+extern void gr_remove_uid(uid_t uid);
-+extern int gr_find_uid(uid_t uid);
-+
-+__inline__ int
-+gr_acl_is_enabled(void)
-+{
-+	return (gr_status & GR_READY);
-+}
-+
-+char gr_roletype_to_char(void)
-+{
-+	switch (current->role->roletype &
-+		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
-+		 GR_ROLE_SPECIAL)) {
-+	case GR_ROLE_DEFAULT:
-+		return 'D';
-+	case GR_ROLE_USER:
-+		return 'U';
-+	case GR_ROLE_GROUP:
-+		return 'G';
-+	case GR_ROLE_SPECIAL:
-+		return 'S';
-+	}
-+
-+	return 'X';
-+}
-+
-+__inline__ int
-+gr_acl_tpe_check(void)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+	if (current->role->roletype & GR_ROLE_TPE)
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (inode && S_ISBLK(inode->i_mode) &&
-+	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
-+	    !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+static int
-+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
-+{
-+	if (likely(lena != lenb))
-+		return 0;
-+
-+	return !memcmp(a, b, lena);
-+}
-+
-+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+	                   struct dentry *root, struct vfsmount *rootmnt,
-+			   char *buffer, int buflen)
-+{
-+	char * end = buffer+buflen;
-+	char * retval;
-+	int namelen;
-+
-+	*--end = '\0';
-+	buflen--;
-+
-+	if (buflen < 1)
-+		goto Elong;
-+	/* Get '/' right */
-+	retval = end-1;
-+	*retval = '/';
-+
-+	for (;;) {
-+		struct dentry * parent;
-+
-+		if (dentry == root && vfsmnt == rootmnt)
-+			break;
-+		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
-+			/* Global root? */
-+			spin_lock(&vfsmount_lock);
-+			if (vfsmnt->mnt_parent == vfsmnt) {
-+				spin_unlock(&vfsmount_lock);
-+				goto global_root;
-+			}
-+			dentry = vfsmnt->mnt_mountpoint;
-+			vfsmnt = vfsmnt->mnt_parent;
-+			spin_unlock(&vfsmount_lock);
-+			continue;
-+		}
-+		parent = dentry->d_parent;
-+		prefetch(parent);
-+		namelen = dentry->d_name.len;
-+		buflen -= namelen + 1;
-+		if (buflen < 0)
-+			goto Elong;
-+		end -= namelen;
-+		memcpy(end, dentry->d_name.name, namelen);
-+		*--end = '/';
-+		retval = end;
-+		dentry = parent;
-+	}
-+
-+	return retval;
-+
-+global_root:
-+	namelen = dentry->d_name.len;
-+	buflen -= namelen;
-+	if (buflen < 0)
-+		goto Elong;
-+	retval -= namelen-1;	/* hit the slash */
-+	memcpy(retval, dentry->d_name.name, namelen);
-+	return retval;
-+Elong:
-+	return ERR_PTR(-ENAMETOOLONG);
-+}
-+
-+static char *
-+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
-+              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
-+{
-+	char *retval;
-+
-+	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
-+	if (unlikely(IS_ERR(retval)))
-+		retval = strcpy(buf, "<path too long>");
-+	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
-+		retval[1] = '\0';
-+
-+	return retval;
-+}
-+
-+static char *
-+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+		char *buf, int buflen)
-+{
-+	char *res;
-+
-+	/* we can use real_root, real_root_mnt, because this is only called
-+	   by the RBAC system */
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
-+
-+	return res;
-+}
-+
-+static char *
-+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
-+	    char *buf, int buflen)
-+{
-+	char *res;
-+	struct dentry *root;
-+	struct vfsmount *rootmnt;
-+	struct task_struct *reaper = &init_task;
-+
-+	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
-+	read_lock(&reaper->fs->lock);
-+	root = dget(reaper->fs->root.dentry);
-+	rootmnt = mntget(reaper->fs->root.mnt);
-+	read_unlock(&reaper->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
-+	spin_unlock(&dcache_lock);
-+
-+	dput(root);
-+	mntput(rootmnt);
-+	return res;
-+}
-+
-+static char *
-+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	char *ret;
-+	spin_lock(&dcache_lock);
-+	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+	spin_unlock(&dcache_lock);
-+	return ret;
-+}
-+
-+char *
-+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
-+			     PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+char *
-+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
-+			   PAGE_SIZE);
-+}
-+
-+__inline__ __u32
-+to_gr_audit(const __u32 reqmode)
-+{
-+	/* masks off auditable permission flags, then shifts them to create
-+	   auditing flags, and adds the special case of append auditing if
-+	   we're requesting write */
-+	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
-+}
-+
-+struct acl_subject_label *
-+lookup_subject_map(const struct acl_subject_label *userp)
-+{
-+	unsigned int index = shash(userp, subj_map_set.s_size);
-+	struct subject_map *match;
-+
-+	match = subj_map_set.s_hash[index];
-+
-+	while (match && match->user != userp)
-+		match = match->next;
-+
-+	if (match != NULL)
-+		return match->kernel;
-+	else
-+		return NULL;
-+}
-+
-+static void
-+insert_subj_map_entry(struct subject_map *subjmap)
-+{
-+	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
-+	struct subject_map **curr;
-+
-+	subjmap->prev = NULL;
-+
-+	curr = &subj_map_set.s_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = subjmap;
-+
-+	subjmap->next = *curr;
-+	*curr = subjmap;
-+
-+	return;
-+}
-+
-+static struct acl_role_label *
-+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
-+		      const gid_t gid)
-+{
-+	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
-+	struct acl_role_label *match;
-+	struct role_allowed_ip *ipp;
-+	unsigned int x;
-+
-+	match = acl_role_set.r_hash[index];
-+
-+	while (match) {
-+		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
-+			for (x = 0; x < match->domain_child_num; x++) {
-+				if (match->domain_children[x] == uid)
-+					goto found;
-+			}
-+		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
-+			break;
-+		match = match->next;
-+	}
-+found:
-+	if (match == NULL) {
-+	      try_group:
-+		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
-+		match = acl_role_set.r_hash[index];
-+
-+		while (match) {
-+			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
-+				for (x = 0; x < match->domain_child_num; x++) {
-+					if (match->domain_children[x] == gid)
-+						goto found2;
-+				}
-+			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
-+				break;
-+			match = match->next;
-+		}
-+found2:
-+		if (match == NULL)
-+			match = default_role;
-+		if (match->allowed_ips == NULL)
-+			return match;
-+		else {
-+			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+				if (likely
-+				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+				     (ntohl(ipp->addr) & ipp->netmask)))
-+					return match;
-+			}
-+			match = default_role;
-+		}
-+	} else if (match->allowed_ips == NULL) {
-+		return match;
-+	} else {
-+		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
-+			if (likely
-+			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
-+			     (ntohl(ipp->addr) & ipp->netmask)))
-+				return match;
-+		}
-+		goto try_group;
-+	}
-+
-+	return match;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
-+		      const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+struct acl_subject_label *
-+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
-+			  const struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct acl_object_label *
-+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
-+		     const struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       !(match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && (match->mode & GR_DELETED))
-+		return match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != ino || match->device != dev ||
-+	       (match->mode & GR_DELETED))) {
-+		match = match->next;
-+	}
-+
-+	if (match && !(match->mode & GR_DELETED))
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static struct name_entry *
-+lookup_name_entry_create(const char *name)
-+{
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+	struct name_entry *match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 !match->deleted))
-+		match = match->next;
-+
-+	if (match && match->deleted)
-+		return match;
-+
-+	match = name_set.n_hash[index];
-+
-+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
-+			 match->deleted))
-+		match = match->next;
-+
-+	if (match && !match->deleted)
-+		return match;
-+	else
-+		return NULL;
-+}
-+
-+static struct inodev_entry *
-+lookup_inodev_entry(const ino_t ino, const dev_t dev)
-+{
-+	unsigned int index = fhash(ino, dev, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
-+		match = match->next;
-+
-+	return match;
-+}
-+
-+static void
-+insert_inodev_entry(struct inodev_entry *entry)
-+{
-+	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
-+				    inodev_set.i_size);
-+	struct inodev_entry **curr;
-+
-+	entry->prev = NULL;
-+
-+	curr = &inodev_set.i_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = entry;
-+	
-+	entry->next = *curr;
-+	*curr = entry;
-+
-+	return;
-+}
-+
-+static void
-+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
-+{
-+	unsigned int index =
-+	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
-+	struct acl_role_label **curr;
-+	struct acl_role_label *tmp;
-+
-+	curr = &acl_role_set.r_hash[index];
-+
-+	/* if role was already inserted due to domains and already has
-+	   a role in the same bucket as it attached, then we need to
-+	   combine these two buckets
-+	*/
-+	if (role->next) {
-+		tmp = role->next;
-+		while (tmp->next)
-+			tmp = tmp->next;
-+		tmp->next = *curr;
-+	} else
-+		role->next = *curr;
-+	*curr = role;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_role_label(struct acl_role_label *role)
-+{
-+	int i;
-+
-+	if (role_list == NULL) {
-+		role_list = role;
-+		role->prev = NULL;
-+	} else {
-+		role->prev = role_list;
-+		role_list = role;
-+	}
-+	
-+	/* used for hash chains */
-+	role->next = NULL;
-+
-+	if (role->roletype & GR_ROLE_DOMAIN) {
-+		for (i = 0; i < role->domain_child_num; i++)
-+			__insert_acl_role_label(role, role->domain_children[i]);
-+	} else
-+		__insert_acl_role_label(role, role->uidgid);
-+}
-+					
-+static int
-+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
-+{
-+	struct name_entry **curr, *nentry;
-+	struct inodev_entry *ientry;
-+	unsigned int len = strlen(name);
-+	unsigned int key = full_name_hash(name, len);
-+	unsigned int index = key % name_set.n_size;
-+
-+	curr = &name_set.n_hash[index];
-+
-+	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
-+		curr = &((*curr)->next);
-+
-+	if (*curr != NULL)
-+		return 1;
-+
-+	nentry = acl_alloc(sizeof (struct name_entry));
-+	if (nentry == NULL)
-+		return 0;
-+	ientry = acl_alloc(sizeof (struct inodev_entry));
-+	if (ientry == NULL)
-+		return 0;
-+	ientry->nentry = nentry;
-+
-+	nentry->key = key;
-+	nentry->name = name;
-+	nentry->inode = inode;
-+	nentry->device = device;
-+	nentry->len = len;
-+	nentry->deleted = deleted;
-+
-+	nentry->prev = NULL;
-+	curr = &name_set.n_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = nentry;
-+	nentry->next = *curr;
-+	*curr = nentry;
-+
-+	/* insert us into the table searchable by inode/dev */
-+	insert_inodev_entry(ientry);
-+
-+	return 1;
-+}
-+
-+static void
-+insert_acl_obj_label(struct acl_object_label *obj,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index =
-+	    fhash(obj->inode, obj->device, subj->obj_hash_size);
-+	struct acl_object_label **curr;
-+
-+	
-+	obj->prev = NULL;
-+
-+	curr = &subj->obj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+static void
-+insert_acl_subj_label(struct acl_subject_label *obj,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
-+	struct acl_subject_label **curr;
-+
-+	obj->prev = NULL;
-+
-+	curr = &role->subj_hash[index];
-+	if (*curr != NULL)
-+		(*curr)->prev = obj;
-+
-+	obj->next = *curr;
-+	*curr = obj;
-+
-+	return;
-+}
-+
-+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
-+
-+static void *
-+create_table(__u32 * len, int elementsize)
-+{
-+	unsigned int table_sizes[] = {
-+		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
-+		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
-+		4194301, 8388593, 16777213, 33554393, 67108859
-+	};
-+	void *newtable = NULL;
-+	unsigned int pwr = 0;
-+
-+	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
-+	       table_sizes[pwr] <= *len)
-+		pwr++;
-+
-+	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
-+		return newtable;
-+
-+	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
-+		newtable =
-+		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
-+	else
-+		newtable = vmalloc(table_sizes[pwr] * elementsize);
-+
-+	*len = table_sizes[pwr];
-+
-+	return newtable;
-+}
-+
-+static int
-+init_variables(const struct gr_arg *arg)
-+{
-+	struct task_struct *reaper = &init_task;
-+	unsigned int stacksize;
-+
-+	subj_map_set.s_size = arg->role_db.num_subjects;
-+	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
-+	name_set.n_size = arg->role_db.num_objects;
-+	inodev_set.i_size = arg->role_db.num_objects;
-+
-+	if (!subj_map_set.s_size || !acl_role_set.r_size ||
-+	    !name_set.n_size || !inodev_set.i_size)
-+		return 1;
-+
-+	if (!gr_init_uidset())
-+		return 1;
-+
-+	/* set up the stack that holds allocation info */
-+
-+	stacksize = arg->role_db.num_pointers + 5;
-+
-+	if (!acl_alloc_stack_init(stacksize))
-+		return 1;
-+
-+	/* grab reference for the real root dentry and vfsmount */
-+	read_lock(&reaper->fs->lock);
-+	real_root_mnt = mntget(reaper->fs->root.mnt);
-+	real_root = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+	
-+	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
-+	if (fakefs_obj == NULL)
-+		return 1;
-+	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
-+
-+	subj_map_set.s_hash =
-+	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
-+	acl_role_set.r_hash =
-+	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
-+	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
-+	inodev_set.i_hash =
-+	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
-+
-+	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
-+	    !name_set.n_hash || !inodev_set.i_hash)
-+		return 1;
-+
-+	memset(subj_map_set.s_hash, 0,
-+	       sizeof(struct subject_map *) * subj_map_set.s_size);
-+	memset(acl_role_set.r_hash, 0,
-+	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
-+	memset(name_set.n_hash, 0,
-+	       sizeof (struct name_entry *) * name_set.n_size);
-+	memset(inodev_set.i_hash, 0,
-+	       sizeof (struct inodev_entry *) * inodev_set.i_size);
-+
-+	return 0;
-+}
-+
-+/* free information not needed after startup
-+   currently contains user->kernel pointer mappings for subjects
-+*/
-+
-+static void
-+free_init_variables(void)
-+{
-+	__u32 i;
-+
-+	if (subj_map_set.s_hash) {
-+		for (i = 0; i < subj_map_set.s_size; i++) {
-+			if (subj_map_set.s_hash[i]) {
-+				kfree(subj_map_set.s_hash[i]);
-+				subj_map_set.s_hash[i] = NULL;
-+			}
-+		}
-+
-+		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
-+		    PAGE_SIZE)
-+			kfree(subj_map_set.s_hash);
-+		else
-+			vfree(subj_map_set.s_hash);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+free_variables(void)
-+{
-+	struct acl_subject_label *s;
-+	struct acl_role_label *r;
-+	struct task_struct *task, *task2;
-+	unsigned int x;
-+
-+	gr_clear_learn_entries();
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(task2, task) {
-+		task->acl_sp_role = 0;
-+		task->acl_role_id = 0;
-+		task->acl = NULL;
-+		task->role = NULL;
-+	} while_each_thread(task2, task);
-+	read_unlock(&tasklist_lock);
-+
-+	/* release the reference to the real root dentry and vfsmount */
-+	if (real_root)
-+		dput(real_root);
-+	real_root = NULL;
-+	if (real_root_mnt)
-+		mntput(real_root_mnt);
-+	real_root_mnt = NULL;
-+
-+	/* free all object hash tables */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (r->subj_hash == NULL)
-+			goto next_role;
-+		FOR_EACH_SUBJECT_START(r, s, x)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_SUBJECT_END(s, x)
-+		FOR_EACH_NESTED_SUBJECT_START(r, s)
-+			if (s->obj_hash == NULL)
-+				break;
-+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
-+				kfree(s->obj_hash);
-+			else
-+				vfree(s->obj_hash);
-+		FOR_EACH_NESTED_SUBJECT_END(s)
-+		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
-+			kfree(r->subj_hash);
-+		else
-+			vfree(r->subj_hash);
-+		r->subj_hash = NULL;
-+next_role:
-+	FOR_EACH_ROLE_END(r)
-+
-+	acl_free_all();
-+
-+	if (acl_role_set.r_hash) {
-+		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
-+		    PAGE_SIZE)
-+			kfree(acl_role_set.r_hash);
-+		else
-+			vfree(acl_role_set.r_hash);
-+	}
-+	if (name_set.n_hash) {
-+		if ((name_set.n_size * sizeof (struct name_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(name_set.n_hash);
-+		else
-+			vfree(name_set.n_hash);
-+	}
-+
-+	if (inodev_set.i_hash) {
-+		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
-+		    PAGE_SIZE)
-+			kfree(inodev_set.i_hash);
-+		else
-+			vfree(inodev_set.i_hash);
-+	}
-+
-+	gr_free_uidset();
-+
-+	memset(&name_set, 0, sizeof (struct name_db));
-+	memset(&inodev_set, 0, sizeof (struct inodev_db));
-+	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
-+	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
-+
-+	default_role = NULL;
-+	role_list = NULL;
-+
-+	return;
-+}
-+
-+static __u32
-+count_user_objs(struct acl_object_label *userp)
-+{
-+	struct acl_object_label o_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			break;
-+
-+		userp = o_tmp.prev;
-+		num++;
-+	}
-+
-+	return num;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
-+
-+static int
-+copy_user_glob(struct acl_object_label *obj)
-+{
-+	struct acl_object_label *g_tmp, **guser;
-+	unsigned int len;
-+	char *tmp;
-+
-+	if (obj->globbed == NULL)
-+		return 0;
-+
-+	guser = &obj->globbed;
-+	while (*guser) {
-+		g_tmp = (struct acl_object_label *)
-+			acl_alloc(sizeof (struct acl_object_label));
-+		if (g_tmp == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(g_tmp, *guser,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		len = strnlen_user(g_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, g_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		g_tmp->filename = tmp;
-+
-+		*guser = g_tmp;
-+		guser = &(g_tmp->next);
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
-+	       struct acl_role_label *role)
-+{
-+	struct acl_object_label *o_tmp;
-+	unsigned int len;
-+	int ret;
-+	char *tmp;
-+
-+	while (userp) {
-+		if ((o_tmp = (struct acl_object_label *)
-+		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(o_tmp, userp,
-+				   sizeof (struct acl_object_label)))
-+			return -EFAULT;
-+
-+		userp = o_tmp->prev;
-+
-+		len = strnlen_user(o_tmp->filename, PATH_MAX);
-+
-+		if (!len || len >= PATH_MAX)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, o_tmp->filename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		o_tmp->filename = tmp;
-+
-+		insert_acl_obj_label(o_tmp, subj);
-+		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
-+				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
-+			return -ENOMEM;
-+
-+		ret = copy_user_glob(o_tmp);
-+		if (ret)
-+			return ret;
-+
-+		if (o_tmp->nested) {
-+			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
-+			if (IS_ERR(o_tmp->nested))
-+				return PTR_ERR(o_tmp->nested);
-+
-+			/* insert into nested subject list */
-+			o_tmp->nested->next = role->hash->first;
-+			role->hash->first = o_tmp->nested;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static __u32
-+count_user_subjs(struct acl_subject_label *userp)
-+{
-+	struct acl_subject_label s_tmp;
-+	__u32 num = 0;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_tmp, userp,
-+				   sizeof (struct acl_subject_label)))
-+			break;
-+
-+		userp = s_tmp.prev;
-+		/* do not count nested subjects against this count, since
-+		   they are not included in the hash table, but are
-+		   attached to objects.  We have already counted
-+		   the subjects in userspace for the allocation 
-+		   stack
-+		*/
-+		if (!(s_tmp.mode & GR_NESTED))
-+			num++;
-+	}
-+
-+	return num;
-+}
-+
-+static int
-+copy_user_allowedips(struct acl_role_label *rolep)
-+{
-+	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
-+
-+	ruserip = rolep->allowed_ips;
-+
-+	while (ruserip) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_allowed_ip *)
-+		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, ruserip,
-+				   sizeof (struct role_allowed_ip)))
-+			return -EFAULT;
-+
-+		ruserip = rtmp->prev;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->allowed_ips = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!ruserip)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_transitions(struct acl_role_label *rolep)
-+{
-+	struct role_transition *rusertp, *rtmp = NULL, *rlast;
-+	
-+	unsigned int len;
-+	char *tmp;
-+
-+	rusertp = rolep->transitions;
-+
-+	while (rusertp) {
-+		rlast = rtmp;
-+
-+		if ((rtmp = (struct role_transition *)
-+		     acl_alloc(sizeof (struct role_transition))) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(rtmp, rusertp,
-+				   sizeof (struct role_transition)))
-+			return -EFAULT;
-+
-+		rusertp = rtmp->prev;
-+
-+		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN)
-+			return -EINVAL;
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL)
-+			return -ENOMEM;
-+
-+		if (copy_from_user(tmp, rtmp->rolename, len))
-+			return -EFAULT;
-+		tmp[len-1] = '\0';
-+		rtmp->rolename = tmp;
-+
-+		if (!rlast) {
-+			rtmp->prev = NULL;
-+			rolep->transitions = rtmp;
-+		} else {
-+			rlast->next = rtmp;
-+			rtmp->prev = rlast;
-+		}
-+
-+		if (!rusertp)
-+			rtmp->next = NULL;
-+	}
-+
-+	return 0;
-+}
-+
-+static struct acl_subject_label *
-+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
-+	unsigned int len;
-+	char *tmp;
-+	__u32 num_objs;
-+	struct acl_ip_label **i_tmp, *i_utmp2;
-+	struct gr_hash_struct ghash;
-+	struct subject_map *subjmap;
-+	unsigned int i_num;
-+	int err;
-+
-+	s_tmp = lookup_subject_map(userp);
-+
-+	/* we've already copied this subject into the kernel, just return
-+	   the reference to it, and don't copy it over again
-+	*/
-+	if (s_tmp)
-+		return(s_tmp);
-+
-+	if ((s_tmp = (struct acl_subject_label *)
-+	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
-+	if (subjmap == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	subjmap->user = userp;
-+	subjmap->kernel = s_tmp;
-+	insert_subj_map_entry(subjmap);
-+
-+	if (copy_from_user(s_tmp, userp,
-+			   sizeof (struct acl_subject_label)))
-+		return ERR_PTR(-EFAULT);
-+
-+	len = strnlen_user(s_tmp->filename, PATH_MAX);
-+
-+	if (!len || len >= PATH_MAX)
-+		return ERR_PTR(-EINVAL);
-+
-+	if ((tmp = (char *) acl_alloc(len)) == NULL)
-+		return ERR_PTR(-ENOMEM);
-+
-+	if (copy_from_user(tmp, s_tmp->filename, len))
-+		return ERR_PTR(-EFAULT);
-+	tmp[len-1] = '\0';
-+	s_tmp->filename = tmp;
-+
-+	if (!strcmp(s_tmp->filename, "/"))
-+		role->root_label = s_tmp;
-+
-+	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
-+		return ERR_PTR(-EFAULT);
-+
-+	/* copy user and group transition tables */
-+
-+	if (s_tmp->user_trans_num) {
-+		uid_t *uidlist;
-+
-+		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
-+		if (uidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->user_transitions = uidlist;
-+	}
-+
-+	if (s_tmp->group_trans_num) {
-+		gid_t *gidlist;
-+
-+		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
-+		if (gidlist == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
-+			return ERR_PTR(-EFAULT);
-+
-+		s_tmp->group_transitions = gidlist;
-+	}
-+
-+	/* set up object hash table */
-+	num_objs = count_user_objs(ghash.first);
-+
-+	s_tmp->obj_hash_size = num_objs;
-+	s_tmp->obj_hash =
-+	    (struct acl_object_label **)
-+	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
-+
-+	if (!s_tmp->obj_hash)
-+		return ERR_PTR(-ENOMEM);
-+
-+	memset(s_tmp->obj_hash, 0,
-+	       s_tmp->obj_hash_size *
-+	       sizeof (struct acl_object_label *));
-+
-+	/* add in objects */
-+	err = copy_user_objs(ghash.first, s_tmp, role);
-+
-+	if (err)
-+		return ERR_PTR(err);
-+
-+	/* set pointer for parent subject */
-+	if (s_tmp->parent_subject) {
-+		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
-+
-+		if (IS_ERR(s_tmp2))
-+			return s_tmp2;
-+
-+		s_tmp->parent_subject = s_tmp2;
-+	}
-+
-+	/* add in ip acls */
-+
-+	if (!s_tmp->ip_num) {
-+		s_tmp->ips = NULL;
-+		goto insert;
-+	}
-+
-+	i_tmp =
-+	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
-+					       sizeof (struct acl_ip_label *));
-+
-+	if (!i_tmp)
-+		return ERR_PTR(-ENOMEM);
-+
-+	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
-+		*(i_tmp + i_num) =
-+		    (struct acl_ip_label *)
-+		    acl_alloc(sizeof (struct acl_ip_label));
-+		if (!*(i_tmp + i_num))
-+			return ERR_PTR(-ENOMEM);
-+
-+		if (copy_from_user
-+		    (&i_utmp2, s_tmp->ips + i_num,
-+		     sizeof (struct acl_ip_label *)))
-+			return ERR_PTR(-EFAULT);
-+
-+		if (copy_from_user
-+		    (*(i_tmp + i_num), i_utmp2,
-+		     sizeof (struct acl_ip_label)))
-+			return ERR_PTR(-EFAULT);
-+		
-+		if ((*(i_tmp + i_num))->iface == NULL)
-+			continue;
-+
-+		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
-+		if (!len || len >= IFNAMSIZ)
-+			return ERR_PTR(-EINVAL);
-+		tmp = acl_alloc(len);
-+		if (tmp == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
-+			return ERR_PTR(-EFAULT);
-+		(*(i_tmp + i_num))->iface = tmp;
-+	}
-+
-+	s_tmp->ips = i_tmp;
-+
-+insert:
-+	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
-+			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
-+		return ERR_PTR(-ENOMEM);
-+
-+	return s_tmp;
-+}
-+
-+static int
-+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
-+{
-+	struct acl_subject_label s_pre;
-+	struct acl_subject_label * ret;
-+	int err;
-+
-+	while (userp) {
-+		if (copy_from_user(&s_pre, userp,
-+				   sizeof (struct acl_subject_label)))
-+			return -EFAULT;
-+		
-+		/* do not add nested subjects here, add
-+		   while parsing objects
-+		*/
-+
-+		if (s_pre.mode & GR_NESTED) {
-+			userp = s_pre.prev;
-+			continue;
-+		}
-+
-+		ret = do_copy_user_subj(userp, role);
-+
-+		err = PTR_ERR(ret);
-+		if (IS_ERR(ret))
-+			return err;
-+
-+		insert_acl_subj_label(ret, role);
-+
-+		userp = s_pre.prev;
-+	}
-+
-+	return 0;
-+}
-+
-+static int
-+copy_user_acl(struct gr_arg *arg)
-+{
-+	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
-+	struct sprole_pw *sptmp;
-+	struct gr_hash_struct *ghash;
-+	uid_t *domainlist;
-+	unsigned int r_num;
-+	unsigned int len;
-+	char *tmp;
-+	int err = 0;
-+	__u16 i;
-+	__u32 num_subjs;
-+
-+	/* we need a default and kernel role */
-+	if (arg->role_db.num_roles < 2)
-+		return -EINVAL;
-+
-+	/* copy special role authentication info from userspace */
-+
-+	num_sprole_pws = arg->num_sprole_pws;
-+	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
-+
-+	if (!acl_special_roles) {
-+		err = -ENOMEM;
-+		goto cleanup;
-+	}
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
-+		if (!sptmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(sptmp, arg->sprole_pws + i,
-+				   sizeof (struct sprole_pw))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len =
-+		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= GR_SPROLE_LEN) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(tmp, sptmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+		printk(KERN_ALERT "Copying special role %s\n", tmp);
-+#endif
-+		sptmp->rolename = tmp;
-+		acl_special_roles[i] = sptmp;
-+	}
-+
-+	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
-+
-+	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
-+		r_tmp = acl_alloc(sizeof (struct acl_role_label));
-+
-+		if (!r_tmp) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(&r_utmp2, r_utmp + r_num,
-+				   sizeof (struct acl_role_label *))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		if (copy_from_user(r_tmp, r_utmp2,
-+				   sizeof (struct acl_role_label))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
-+
-+		if (!len || len >= PATH_MAX) {
-+			err = -EINVAL;
-+			goto cleanup;
-+		}
-+
-+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(tmp, r_tmp->rolename, len)) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+		tmp[len-1] = '\0';
-+		r_tmp->rolename = tmp;
-+
-+		if (!strcmp(r_tmp->rolename, "default")
-+		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
-+			default_role = r_tmp;
-+		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
-+			kernel_role = r_tmp;
-+		}
-+
-+		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
-+			err = -EFAULT;
-+			goto cleanup;
-+		}
-+
-+		r_tmp->hash = ghash;
-+
-+		num_subjs = count_user_subjs(r_tmp->hash->first);
-+
-+		r_tmp->subj_hash_size = num_subjs;
-+		r_tmp->subj_hash =
-+		    (struct acl_subject_label **)
-+		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
-+
-+		if (!r_tmp->subj_hash) {
-+			err = -ENOMEM;
-+			goto cleanup;
-+		}
-+
-+		err = copy_user_allowedips(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		/* copy domain info */
-+		if (r_tmp->domain_children != NULL) {
-+			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
-+			if (domainlist == NULL) {
-+				err = -ENOMEM;
-+				goto cleanup;
-+			}
-+			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
-+				err = -EFAULT;
-+				goto cleanup;
-+			}
-+			r_tmp->domain_children = domainlist;
-+		}
-+
-+		err = copy_user_transitions(r_tmp);
-+		if (err)
-+			goto cleanup;
-+
-+		memset(r_tmp->subj_hash, 0,
-+		       r_tmp->subj_hash_size *
-+		       sizeof (struct acl_subject_label *));
-+
-+		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
-+
-+		if (err)
-+			goto cleanup;
-+
-+		/* set nested subject list to null */
-+		r_tmp->hash->first = NULL;
-+
-+		insert_acl_role_label(r_tmp);
-+	}
-+
-+	goto return_err;
-+      cleanup:
-+	free_variables();
-+      return_err:
-+	return err;
-+
-+}
-+
-+static int
-+gracl_init(struct gr_arg *args)
-+{
-+	int error = 0;
-+
-+	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
-+	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
-+
-+	if (init_variables(args)) {
-+		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
-+		error = -ENOMEM;
-+		free_variables();
-+		goto out;
-+	}
-+
-+	error = copy_user_acl(args);
-+	free_init_variables();
-+	if (error) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	if ((error = gr_set_acls(0))) {
-+		free_variables();
-+		goto out;
-+	}
-+
-+	pax_open_kernel();
-+	gr_status |= GR_READY;
-+	pax_close_kernel();
-+
-+      out:
-+	return error;
-+}
-+
-+/* derived from glibc fnmatch() 0: match, 1: no match*/
-+
-+static int
-+glob_match(const char *p, const char *n)
-+{
-+	char c;
-+
-+	while ((c = *p++) != '\0') {
-+	switch (c) {
-+		case '?':
-+			if (*n == '\0')
-+				return 1;
-+			else if (*n == '/')
-+				return 1;
-+			break;
-+		case '\\':
-+			if (*n != c)
-+				return 1;
-+			break;
-+		case '*':
-+			for (c = *p++; c == '?' || c == '*'; c = *p++) {
-+				if (*n == '/')
-+					return 1;
-+				else if (c == '?') {
-+					if (*n == '\0')
-+						return 1;
-+					else
-+						++n;
-+				}
-+			}
-+			if (c == '\0') {
-+				return 0;
-+			} else {
-+				const char *endp;
-+
-+				if ((endp = strchr(n, '/')) == NULL)
-+					endp = n + strlen(n);
-+
-+				if (c == '[') {
-+					for (--p; n < endp; ++n)
-+						if (!glob_match(p, n))
-+							return 0;
-+				} else if (c == '/') {
-+					while (*n != '\0' && *n != '/')
-+						++n;
-+					if (*n == '/' && !glob_match(p, n + 1))
-+						return 0;
-+				} else {
-+					for (--p; n < endp; ++n)
-+						if (*n == c && !glob_match(p, n))
-+							return 0;
-+				}
-+
-+				return 1;
-+			}
-+		case '[':
-+			{
-+			int not;
-+			char cold;
-+
-+			if (*n == '\0' || *n == '/')
-+				return 1;
-+
-+			not = (*p == '!' || *p == '^');
-+			if (not)
-+				++p;
-+
-+			c = *p++;
-+			for (;;) {
-+				unsigned char fn = (unsigned char)*n;
-+
-+				if (c == '\0')
-+					return 1;
-+				else {
-+					if (c == fn)
-+						goto matched;
-+					cold = c;
-+					c = *p++;
-+
-+					if (c == '-' && *p != ']') {
-+						unsigned char cend = *p++;
-+
-+						if (cend == '\0')
-+							return 1;
-+
-+						if (cold <= fn && fn <= cend)
-+							goto matched;
-+
-+						c = *p++;
-+					}
-+				}
-+
-+				if (c == ']')
-+					break;
-+			}
-+			if (!not)
-+				return 1;
-+			break;
-+		matched:
-+			while (c != ']') {
-+				if (c == '\0')
-+					return 1;
-+
-+				c = *p++;
-+			}
-+			if (not)
-+				return 1;
-+		}
-+		break;
-+	default:
-+		if (c != *n)
-+			return 1;
-+	}
-+
-+	++n;
-+	}
-+
-+	if (*n == '\0')
-+		return 0;
-+
-+	if (*n == '/')
-+		return 0;
-+
-+	return 1;
-+}
-+
-+static struct acl_object_label *
-+chk_glob_label(struct acl_object_label *globbed,
-+	struct dentry *dentry, struct vfsmount *mnt, char **path)
-+{
-+	struct acl_object_label *tmp;
-+
-+	if (*path == NULL)
-+		*path = gr_to_filename_nolock(dentry, mnt);
-+
-+	tmp = globbed;
-+
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, *path))
-+			return tmp;
-+		tmp = tmp->next;
-+	}
-+
-+	return NULL;
-+}
-+
-+static struct acl_object_label *
-+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const ino_t curr_ino, const dev_t curr_dev,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	struct acl_subject_label *tmpsubj;
-+	struct acl_object_label *retval;
-+	struct acl_object_label *retval2;
-+
-+	tmpsubj = (struct acl_subject_label *) subj;
-+	read_lock(&gr_inode_lock);
-+	do {
-+		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
-+		if (retval) {
-+			if (checkglob && retval->globbed) {
-+				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
-+						(struct vfsmount *)orig_mnt, path);
-+				if (retval2)
-+					retval = retval2;
-+			}
-+			break;
-+		}
-+	} while ((tmpsubj = tmpsubj->parent_subject));
-+	read_unlock(&gr_inode_lock);
-+
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
-+	    const struct dentry *curr_dentry,
-+	    const struct acl_subject_label *subj, char **path, const int checkglob)
-+{
-+	return __full_lookup(orig_dentry, orig_mnt,
-+			     curr_dentry->d_inode->i_ino, 
-+			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
-+}
-+
-+static struct acl_object_label *
-+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj, char *path, const int checkglob)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_object_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
-+#ifdef CONFIG_HUGETLBFS
-+	    mnt == hugetlbfs_vfsmount ||
-+#endif
-+		/* ignore Eric Biederman */
-+	    IS_PRIVATE(l_dentry->d_inode))) {
-+		retval = fakefs_obj;
-+		goto out;
-+	}
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
-+
-+	if (retval == NULL)
-+		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
-+out:
-+	spin_unlock(&dcache_lock);
-+	return retval;
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	      const struct acl_subject_label *subj)
-+{
-+	char *path = NULL;
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
-+}
-+
-+static __inline__ struct acl_object_label *
-+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+		     const struct acl_subject_label *subj, char *path)
-+{
-+	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
-+}
-+
-+static struct acl_subject_label *
-+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
-+	       const struct acl_role_label *role)
-+{
-+	struct dentry *dentry = (struct dentry *) l_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
-+	struct acl_subject_label *retval;
-+
-+	spin_lock(&dcache_lock);
-+
-+	for (;;) {
-+		if (dentry == real_root && mnt == real_root_mnt)
-+			break;
-+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+
-+			read_lock(&gr_inode_lock);
-+			retval =
-+				lookup_acl_subj_label(dentry->d_inode->i_ino,
-+						dentry->d_inode->i_sb->s_dev, role);
-+			read_unlock(&gr_inode_lock);
-+			if (retval != NULL)
-+				goto out;
-+
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+					  dentry->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+		if (retval != NULL)
-+			goto out;
-+
-+		dentry = dentry->d_parent;
-+	}
-+
-+	read_lock(&gr_inode_lock);
-+	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
-+				  dentry->d_inode->i_sb->s_dev, role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (unlikely(retval == NULL)) {
-+		read_lock(&gr_inode_lock);
-+		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
-+					  real_root->d_inode->i_sb->s_dev, role);
-+		read_unlock(&gr_inode_lock);
-+	}
-+out:
-+	spin_unlock(&dcache_lock);
-+
-+	return retval;
-+}
-+
-+static void
-+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_sysctl(const char *path, const __u32 mode)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+static void
-+gr_log_learn_id_change(const char type, const unsigned int real, 
-+		       const unsigned int effective, const unsigned int fs)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+
-+	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
-+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
-+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
-+		       type, real, effective, fs, &task->signal->curr_ip);
-+
-+	return;
-+}
-+
-+__u32
-+gr_check_link(const struct dentry * new_dentry,
-+	      const struct dentry * parent_dentry,
-+	      const struct vfsmount * parent_mnt,
-+	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
-+{
-+	struct acl_object_label *obj;
-+	__u32 oldmode, newmode;
-+	__u32 needmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (GR_CREATE | GR_LINK);
-+
-+	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
-+	oldmode = obj->mode;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		oldmode |= (GR_CREATE | GR_LINK);
-+
-+	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID | GR_AUDIT_SETID;
-+
-+	newmode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    oldmode | needmode);
-+
-+	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
-+			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
-+			      GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
-+		goto bad;
-+
-+	if ((oldmode & needmode) != needmode)
-+		goto bad;
-+
-+	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
-+	if ((newmode & needmode) != needmode)
-+		goto bad;
-+
-+	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
-+		return newmode;
-+bad:
-+	needmode = oldmode;
-+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
-+		needmode |= GR_SETID;
-+	
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		gr_log_learn(old_dentry, old_mnt, needmode);
-+		return (GR_CREATE | GR_LINK);
-+	} else if (newmode & GR_SUPPRESS)
-+		return GR_SUPPRESS;
-+	else
-+		return 0;
-+}
-+
-+__u32
-+gr_search_file(const struct dentry * dentry, const __u32 mode,
-+	       const struct vfsmount * mnt)
-+{
-+	__u32 retval = mode;
-+	struct acl_subject_label *curracl;
-+	struct acl_object_label *currobj;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	curracl = current->acl;
-+
-+	currobj = chk_obj_label(dentry, mnt, curracl);
-+	retval = currobj->mode & mode;
-+
-+	if (unlikely
-+	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
-+	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		retval = new_mode;
-+
-+		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
-+			new_mode |= GR_INHERIT;
-+
-+		if (!(mode & GR_NOLEARN))
-+			gr_log_learn(dentry, mnt, new_mode);
-+	}
-+
-+	return retval;
-+}
-+
-+__u32
-+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
-+		const struct vfsmount * mnt, const __u32 mode)
-+{
-+	struct name_entry *match;
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *curracl;
-+	char *path;
-+	__u32 retval;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return (mode & ~GR_AUDITS);
-+
-+	preempt_disable();
-+	path = gr_to_filename_rbac(new_dentry, mnt);
-+	match = lookup_name_entry_create(path);
-+
-+	if (!match)
-+		goto check_parent;
-+
-+	curracl = current->acl;
-+
-+	read_lock(&gr_inode_lock);
-+	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (matchpo) {
-+		if ((matchpo->mode & mode) !=
-+		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
-+		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+			__u32 new_mode = mode;
-+
-+			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+			gr_log_learn(new_dentry, mnt, new_mode);
-+
-+			preempt_enable();
-+			return new_mode;
-+		}
-+		preempt_enable();
-+		return (matchpo->mode & mode);
-+	}
-+
-+      check_parent:
-+	curracl = current->acl;
-+
-+	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
-+	retval = matchpo->mode & mode;
-+
-+	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
-+	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		gr_log_learn(new_dentry, mnt, new_mode);
-+		preempt_enable();
-+		return new_mode;
-+	}
-+
-+	preempt_enable();
-+	return retval;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	if (unlikely(!(gr_status & GR_READY) || !task))
-+		return 0;
-+
-+	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
-+	    task->acl != current->acl)
-+		return 1;
-+
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	tsk->signal->used_accept = 0;
-+	tsk->acl_sp_role = 0;
-+	tsk->acl_role_id = current->acl_role_id;
-+	tsk->acl = current->acl;
-+	tsk->role = current->role;
-+	tsk->signal->curr_ip = current->signal->curr_ip;
-+	if (current->exec_file)
-+		get_file(current->exec_file);
-+	tsk->exec_file = current->exec_file;
-+	tsk->is_writable = current->is_writable;
-+	if (unlikely(current->signal->used_accept))
-+		current->signal->curr_ip = 0;
-+
-+	return;
-+}
-+
-+static void
-+gr_set_proc_res(struct task_struct *task)
-+{
-+	struct acl_subject_label *proc;
-+	unsigned short i;
-+
-+	proc = task->acl;
-+
-+	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return;
-+
-+	for (i = 0; i < RLIM_NLIMITS; i++) {
-+		if (!(proc->resmask & (1 << i)))
-+			continue;
-+
-+		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
-+		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	uid_t *uidlist;
-+	int curuid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('u', real, effective, fs);
-+
-+	num = current->acl->user_trans_num;
-+	uidlist = current->acl->user_transitions;
-+
-+	if (uidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->user_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				realok = 1;
-+			if (effective == curuid)
-+				effectiveok = 1;
-+			if (fs == curuid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->user_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curuid = (int)uidlist[i];
-+			if (real == curuid)
-+				break;
-+			if (effective == curuid)
-+				break;
-+			if (fs == curuid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	unsigned int i;
-+	__u16 num;
-+	gid_t *gidlist;
-+	int curgid;
-+	int realok = 0;
-+	int effectiveok = 0;
-+	int fsok = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		gr_log_learn_id_change('g', real, effective, fs);
-+
-+	num = current->acl->group_trans_num;
-+	gidlist = current->acl->group_transitions;
-+
-+	if (gidlist == NULL)
-+		return 0;
-+
-+	if (real == -1)
-+		realok = 1;
-+	if (effective == -1)
-+		effectiveok = 1;
-+	if (fs == -1)
-+		fsok = 1;
-+
-+	if (current->acl->group_trans_type & GR_ID_ALLOW) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				realok = 1;
-+			if (effective == curgid)
-+				effectiveok = 1;
-+			if (fs == curgid)
-+				fsok = 1;
-+		}
-+	} else if (current->acl->group_trans_type & GR_ID_DENY) {
-+		for (i = 0; i < num; i++) {
-+			curgid = (int)gidlist[i];
-+			if (real == curgid)
-+				break;
-+			if (effective == curgid)
-+				break;
-+			if (fs == curgid)
-+				break;
-+		}
-+		/* not in deny list */
-+		if (i == num) {
-+			realok = 1;
-+			effectiveok = 1;
-+			fsok = 1;
-+		}
-+	}
-+
-+	if (realok && effectiveok && fsok)
-+		return 0;
-+	else {
-+		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
-+		return 1;
-+	}
-+}
-+
-+void
-+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
-+{
-+	struct acl_role_label *role = task->role;
-+	struct acl_subject_label *subj = NULL;
-+	struct acl_object_label *obj;
-+	struct file *filp;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	filp = task->exec_file;
-+
-+	/* kernel process, we'll give them the kernel role */
-+	if (unlikely(!filp)) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+		return;
-+	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
-+		role = lookup_acl_role_label(task, uid, gid);
-+
-+	/* perform subject lookup in possibly new role
-+	   we can use this result below in the case where role == task->role
-+	*/
-+	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
-+
-+	/* if we changed uid/gid, but result in the same role
-+	   and are using inheritance, don't lose the inherited subject
-+	   if current subject is other than what normal lookup
-+	   would result in, we arrived via inheritance, don't
-+	   lose subject
-+	*/
-+	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
-+				   (subj == task->acl)))
-+		task->acl = subj;
-+
-+	task->role = role;
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+
-+	gr_set_proc_res(task);
-+
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	struct task_struct *task = current;
-+	struct acl_subject_label *newacl;
-+	struct acl_object_label *obj;
-+	__u32 retmode;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	newacl = chk_subj_label(dentry, mnt, task->role);
-+
-+	task_lock(task);
-+	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
-+	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
-+	     !(task->role->roletype & GR_ROLE_GOD) &&
-+	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
-+	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
-+                task_unlock(task);
-+		if (unsafe_share)
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
-+		else
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
-+		return -EACCES;
-+	}
-+	task_unlock(task);
-+
-+	obj = chk_obj_label(dentry, mnt, task->acl);
-+	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
-+
-+	if (!(task->acl->mode & GR_INHERITLEARN) &&
-+	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
-+		if (obj->nested)
-+			task->acl = obj->nested;
-+		else
-+			task->acl = newacl;
-+	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
-+		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
-+
-+	task->is_writable = 0;
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(dentry, mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+	obj = chk_obj_label(dentry, mnt, task->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		task->is_writable = 1;
-+
-+	gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+	return 0;
-+}
-+
-+/* always called with valid inodev ptr */
-+static void
-+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
-+{
-+	struct acl_object_label *matchpo;
-+	struct acl_subject_label *matchps;
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+
-+	FOR_EACH_ROLE_START(role)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
-+				matchpo->mode |= GR_DELETED;
-+		FOR_EACH_SUBJECT_END(subj,x)
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if (subj->inode == ino && subj->device == dev)
-+				subj->mode |= GR_DELETED;
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
-+			matchps->mode |= GR_DELETED;
-+	FOR_EACH_ROLE_END(role)
-+
-+	inodev->nentry->deleted = 1;
-+
-+	return;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	struct inodev_entry *inodev;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	write_lock(&gr_inode_lock);
-+	inodev = lookup_inodev_entry(ino, dev);
-+	if (inodev != NULL)
-+		do_handle_delete(inodev, ino, dev);
-+	write_unlock(&gr_inode_lock);
-+
-+	return;
-+}
-+
-+static void
-+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
-+		     const ino_t newinode, const dev_t newdevice,
-+		     struct acl_subject_label *subj)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
-+	struct acl_object_label *match;
-+
-+	match = subj->obj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			subj->obj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_obj_label(match, subj);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
-+		      const ino_t newinode, const dev_t newdevice,
-+		      struct acl_role_label *role)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
-+	struct acl_subject_label *match;
-+
-+	match = role->subj_hash[index];
-+
-+	while (match && (match->inode != oldinode ||
-+	       match->device != olddevice ||
-+	       !(match->mode & GR_DELETED)))
-+		match = match->next;
-+
-+	if (match && (match->inode == oldinode)
-+	    && (match->device == olddevice)
-+	    && (match->mode & GR_DELETED)) {
-+		if (match->prev == NULL) {
-+			role->subj_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->inode = newinode;
-+		match->device = newdevice;
-+		match->mode &= ~GR_DELETED;
-+
-+		insert_acl_subj_label(match, role);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
-+		    const ino_t newinode, const dev_t newdevice)
-+{
-+	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
-+	struct inodev_entry *match;
-+
-+	match = inodev_set.i_hash[index];
-+
-+	while (match && (match->nentry->inode != oldinode ||
-+	       match->nentry->device != olddevice || !match->nentry->deleted))
-+		match = match->next;
-+
-+	if (match && (match->nentry->inode == oldinode)
-+	    && (match->nentry->device == olddevice) &&
-+	    match->nentry->deleted) {
-+		if (match->prev == NULL) {
-+			inodev_set.i_hash[index] = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = NULL;
-+		} else {
-+			match->prev->next = match->next;
-+			if (match->next != NULL)
-+				match->next->prev = match->prev;
-+		}
-+		match->prev = NULL;
-+		match->next = NULL;
-+		match->nentry->inode = newinode;
-+		match->nentry->device = newdevice;
-+		match->nentry->deleted = 0;
-+
-+		insert_inodev_entry(match);
-+	}
-+
-+	return;
-+}
-+
-+static void
-+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
-+		 const struct vfsmount *mnt)
-+{
-+	struct acl_subject_label *subj;
-+	struct acl_role_label *role;
-+	unsigned int x;
-+	
-+	FOR_EACH_ROLE_START(role)
-+		update_acl_subj_label(matchn->inode, matchn->device,
-+				      dentry->d_inode->i_ino,
-+				      dentry->d_inode->i_sb->s_dev, role);
-+
-+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
-+			if ((subj->inode == dentry->d_inode->i_ino) &&
-+			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
-+				subj->inode = dentry->d_inode->i_ino;
-+				subj->device = dentry->d_inode->i_sb->s_dev;
-+			}
-+		FOR_EACH_NESTED_SUBJECT_END(subj)
-+		FOR_EACH_SUBJECT_START(role, subj, x)
-+			update_acl_obj_label(matchn->inode, matchn->device,
-+					     dentry->d_inode->i_ino,
-+					     dentry->d_inode->i_sb->s_dev, subj);
-+		FOR_EACH_SUBJECT_END(subj,x)
-+	FOR_EACH_ROLE_END(role)
-+
-+	update_inodev_entry(matchn->inode, matchn->device,
-+			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
-+
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	struct name_entry *matchn;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
-+
-+	if (unlikely((unsigned long)matchn)) {
-+		write_lock(&gr_inode_lock);
-+		do_handle_create(matchn, dentry, mnt);
-+		write_unlock(&gr_inode_lock);
-+	}
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	struct name_entry *matchn;
-+	struct inodev_entry *inodev;
-+
-+	/* vfs_rename swaps the name and parent link for old_dentry and
-+	   new_dentry
-+	   at this point, old_dentry has the new name, parent link, and inode
-+	   for the renamed file
-+	   if a file is being replaced by a rename, new_dentry has the inode
-+	   and name for the replaced file
-+	*/
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return;
-+
-+	preempt_disable();
-+	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
-+
-+	/* we wouldn't have to check d_inode if it weren't for
-+	   NFS silly-renaming
-+	 */
-+
-+	write_lock(&gr_inode_lock);
-+	if (unlikely(replace && new_dentry->d_inode)) {
-+		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
-+					     new_dentry->d_inode->i_sb->s_dev);
-+		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
-+			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
-+					 new_dentry->d_inode->i_sb->s_dev);
-+	}
-+
-+	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
-+				     old_dentry->d_inode->i_sb->s_dev);
-+	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
-+		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
-+				 old_dentry->d_inode->i_sb->s_dev);
-+
-+	if (unlikely((unsigned long)matchn))
-+		do_handle_create(matchn, old_dentry, mnt);
-+
-+	write_unlock(&gr_inode_lock);
-+	preempt_enable();
-+
-+	return;
-+}
-+
-+static int
-+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
-+			 unsigned char **sum)
-+{
-+	struct acl_role_label *r;
-+	struct role_allowed_ip *ipp;
-+	struct role_transition *trans;
-+	unsigned int i;
-+	int found = 0;
-+
-+	/* check transition table */
-+
-+	for (trans = current->role->transitions; trans; trans = trans->next) {
-+		if (!strcmp(rolename, trans->rolename)) {
-+			found = 1;
-+			break;
-+		}
-+	}
-+
-+	if (!found)
-+		return 0;
-+
-+	/* handle special roles that do not require authentication
-+	   and check ip */
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			found = 0;
-+			if (r->allowed_ips != NULL) {
-+				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
-+					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
-+					     (ntohl(ipp->addr) & ipp->netmask))
-+						found = 1;
-+				}
-+			} else
-+				found = 2;
-+			if (!found)
-+				return 0;
-+
-+			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
-+			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
-+				*salt = NULL;
-+				*sum = NULL;
-+				return 1;
-+			}
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	for (i = 0; i < num_sprole_pws; i++) {
-+		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
-+			*salt = acl_special_roles[i]->salt;
-+			*sum = acl_special_roles[i]->sum;
-+			return 1;
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+static void
-+assign_special_role(char *rolename)
-+{
-+	struct acl_object_label *obj;
-+	struct acl_role_label *r;
-+	struct acl_role_label *assigned = NULL;
-+	struct task_struct *tsk;
-+	struct file *filp;
-+
-+	FOR_EACH_ROLE_START(r)
-+		if (!strcmp(rolename, r->rolename) &&
-+		    (r->roletype & GR_ROLE_SPECIAL)) {
-+			assigned = r;
-+			break;
-+		}
-+	FOR_EACH_ROLE_END(r)
-+
-+	if (!assigned)
-+		return;
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+
-+	tsk = current->parent;
-+	if (tsk == NULL)
-+		goto out_unlock;
-+
-+	filp = tsk->exec_file;
-+	if (filp == NULL)
-+		goto out_unlock;
-+
-+	tsk->is_writable = 0;
-+
-+	tsk->acl_sp_role = 1;
-+	tsk->acl_role_id = ++acl_sp_role_value;
-+	tsk->role = assigned;
-+	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
-+
-+	/* ignore additional mmap checks for processes that are writable 
-+	   by the default ACL */
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
-+	if (unlikely(obj->mode & GR_WRITE))
-+		tsk->is_writable = 1;
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
-+#endif
-+
-+out_unlock:
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	return;
-+}
-+
-+int gr_check_secure_terminal(struct task_struct *task)
-+{
-+	struct task_struct *p, *p2, *p3;
-+	struct files_struct *files;
-+	struct fdtable *fdt;
-+	struct file *our_file = NULL, *file;
-+	int i;
-+
-+	if (task->signal->tty == NULL)
-+		return 1;
-+
-+	files = get_files_struct(task);
-+	if (files != NULL) {
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
-+				get_file(file);
-+				our_file = file;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	}
-+
-+	if (our_file == NULL)
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+	do_each_thread(p2, p) {
-+		files = get_files_struct(p);
-+		if (files == NULL ||
-+		    (p->signal && p->signal->tty == task->signal->tty)) {
-+			if (files != NULL)
-+				put_files_struct(files);
-+			continue;
-+		}
-+		rcu_read_lock();
-+		fdt = files_fdtable(files);
-+		for (i=0; i < fdt->max_fds; i++) {
-+			file = fcheck_files(files, i);
-+			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
-+			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
-+				p3 = task;
-+				while (p3->pid > 0) {
-+					if (p3 == p)
-+						break;
-+					p3 = p3->parent;
-+				}
-+				if (p3 == p)
-+					break;
-+				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
-+				gr_handle_alertkill(p);
-+				rcu_read_unlock();
-+				put_files_struct(files);
-+				read_unlock(&tasklist_lock);
-+				fput(our_file);
-+				return 0;
-+			}
-+		}
-+		rcu_read_unlock();
-+		put_files_struct(files);
-+	} while_each_thread(p2, p);
-+	read_unlock(&tasklist_lock);
-+
-+	fput(our_file);
-+	return 1;
-+}
-+
-+ssize_t
-+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
-+{
-+	struct gr_arg_wrapper uwrap;
-+	unsigned char *sprole_salt = NULL;
-+	unsigned char *sprole_sum = NULL;
-+	int error = sizeof (struct gr_arg_wrapper);
-+	int error2 = 0;
-+
-+	down(&gr_dev_sem);
-+
-+	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	if (count != sizeof (struct gr_arg_wrapper)) {
-+		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	
-+	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
-+		gr_auth_expires = 0;
-+		gr_auth_attempts = 0;
-+	}
-+
-+	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
-+		error = -EINVAL;
-+		goto out;
-+	}
-+
-+	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
-+		error = -EFAULT;
-+		goto out;
-+	}
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+	    time_after(gr_auth_expires, get_seconds())) {
-+		error = -EBUSY;
-+		goto out;
-+	}
-+
-+	/* if non-root trying to do anything other than use a special role,
-+	   do not attempt authentication, do not count towards authentication
-+	   locking
-+	 */
-+
-+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
-+	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
-+	    current_uid()) {
-+		error = -EPERM;
-+		goto out;
-+	}
-+
-+	/* ensure pw and special role name are null terminated */
-+
-+	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
-+	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
-+
-+	/* Okay. 
-+	 * We have our enough of the argument structure..(we have yet
-+	 * to copy_from_user the tables themselves) . Copy the tables
-+	 * only if we need them, i.e. for loading operations. */
-+
-+	switch (gr_usermode->mode) {
-+	case GR_STATUS:
-+			if (gr_status & GR_READY) {
-+				error = 1;
-+				if (!gr_check_secure_terminal(current))
-+					error = 3;
-+			} else
-+				error = 2;
-+			goto out;
-+	case GR_SHUTDOWN:
-+		if ((gr_status & GR_READY)
-+		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
-+			free_variables();
-+			memset(gr_usermode, 0, sizeof (struct gr_arg));
-+			memset(gr_system_salt, 0, GR_SALT_LEN);
-+			memset(gr_system_sum, 0, GR_SHA_LEN);
-+		} else if (gr_status & GR_READY) {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
-+			error = -EPERM;
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
-+			error = -EAGAIN;
-+		}
-+		break;
-+	case GR_ENABLE:
-+		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
-+		else {
-+			if (gr_status & GR_READY)
-+				error = -EAGAIN;
-+			else
-+				error = error2;
-+			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
-+		}
-+		break;
-+	case GR_RELOAD:
-+		if (!(gr_status & GR_READY)) {
-+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
-+			error = -EAGAIN;
-+		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			lock_kernel();
-+
-+			pax_open_kernel();
-+			gr_status &= ~GR_READY;
-+			pax_close_kernel();
-+
-+			free_variables();
-+			if (!(error2 = gracl_init(gr_usermode))) {
-+				unlock_kernel();
-+				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
-+			} else {
-+				unlock_kernel();
-+				error = error2;
-+				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			}
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SEGVMOD:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
-+			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
-+				struct acl_subject_label *segvacl;
-+				segvacl =
-+				    lookup_acl_subj_label(gr_usermode->segv_inode,
-+							  gr_usermode->segv_device,
-+							  current->role);
-+				if (segvacl) {
-+					segvacl->crashes = 0;
-+					segvacl->expires = 0;
-+				}
-+			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
-+				gr_remove_uid(gr_usermode->segv_uid);
-+			}
-+		} else {
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
-+			error = -EPERM;
-+		}
-+		break;
-+	case GR_SPROLE:
-+	case GR_SPROLEPAM:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
-+			current->role->expires = 0;
-+			current->role->auth_attempts = 0;
-+		}
-+
-+		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
-+		    time_after(current->role->expires, get_seconds())) {
-+			error = -EBUSY;
-+			goto out;
-+		}
-+
-+		if (lookup_special_role_auth
-+		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
-+		    && ((!sprole_salt && !sprole_sum)
-+			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
-+			char *p = "";
-+			assign_special_role(gr_usermode->sp_role);
-+			read_lock(&tasklist_lock);
-+			if (current->parent)
-+				p = current->parent->role->rolename;
-+			read_unlock(&tasklist_lock);
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
-+					p, acl_sp_role_value);
-+		} else {
-+			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
-+			error = -EPERM;
-+			if(!(current->role->auth_attempts++))
-+				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+			goto out;
-+		}
-+		break;
-+	case GR_UNSPROLE:
-+		if (unlikely(!(gr_status & GR_READY))) {
-+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
-+			error = -EAGAIN;
-+			break;
-+		}
-+
-+		if (current->role->roletype & GR_ROLE_SPECIAL) {
-+			char *p = "";
-+			int i = 0;
-+
-+			read_lock(&tasklist_lock);
-+			if (current->parent) {
-+				p = current->parent->role->rolename;
-+				i = current->parent->acl_role_id;
-+			}
-+			read_unlock(&tasklist_lock);
-+
-+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
-+			gr_set_acls(1);
-+		} else {
-+			error = -EPERM;
-+			goto out;
-+		}
-+		break;
-+	default:
-+		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
-+		error = -EINVAL;
-+		break;
-+	}
-+
-+	if (error != -EPERM)
-+		goto out;
-+
-+	if(!(gr_auth_attempts++))
-+		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
-+
-+      out:
-+	up(&gr_dev_sem);
-+	return error;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	struct acl_object_label *obj;
-+	struct task_struct *task, *task2;
-+	struct file *filp;
-+	struct acl_role_label *role = current->role;
-+	__u16 acl_role_id = current->acl_role_id;
-+	const struct cred *cred;
-+	char *tmpname;
-+	struct name_entry *nmatch;
-+	struct acl_subject_label *tmpsubj;
-+
-+	rcu_read_lock();
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	do_each_thread(task2, task) {
-+		/* check to see if we're called from the exit handler,
-+		   if so, only replace ACLs that have inherited the admin
-+		   ACL */
-+
-+		if (type && (task->role != role ||
-+			     task->acl_role_id != acl_role_id))
-+			continue;
-+
-+		task->acl_role_id = 0;
-+		task->acl_sp_role = 0;
-+
-+		if ((filp = task->exec_file)) {
-+			cred = __task_cred(task);
-+			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
-+
-+			/* the following is to apply the correct subject 
-+			   on binaries running when the RBAC system 
-+			   is enabled, when the binaries have been 
-+			   replaced or deleted since their execution
-+			   -----
-+			   when the RBAC system starts, the inode/dev
-+			   from exec_file will be one the RBAC system
-+			   is unaware of.  It only knows the inode/dev
-+			   of the present file on disk, or the absence
-+			   of it.
-+			*/
-+			preempt_disable();
-+			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
-+			
-+			nmatch = lookup_name_entry(tmpname);
-+			preempt_enable();
-+			tmpsubj = NULL;
-+			if (nmatch) {
-+				if (nmatch->deleted)
-+					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
-+				else
-+					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
-+				if (tmpsubj != NULL)
-+					task->acl = tmpsubj;
-+			}
-+			if (tmpsubj == NULL)
-+				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
-+							   task->role);
-+			if (task->acl) {
-+				struct acl_subject_label *curr;
-+				curr = task->acl;
-+
-+				task->is_writable = 0;
-+				/* ignore additional mmap checks for processes that are writable 
-+				   by the default ACL */
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
-+				if (unlikely(obj->mode & GR_WRITE))
-+					task->is_writable = 1;
-+
-+				gr_set_proc_res(task);
-+
-+#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
-+				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
-+#endif
-+			} else {
-+				read_unlock(&grsec_exec_file_lock);
-+				read_unlock(&tasklist_lock);
-+				rcu_read_unlock();
-+				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
-+				return 1;
-+			}
-+		} else {
-+			// it's a kernel process
-+			task->role = kernel_role;
-+			task->acl = kernel_role->root_label;
-+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
-+			task->acl->mode &= ~GR_PROCFIND;
-+#endif
-+		}
-+	} while_each_thread(task2, task);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+	rcu_read_unlock();
-+
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	struct acl_subject_label *acl;
-+	const struct cred *cred;
-+
-+	if (unlikely((gr_status & GR_READY) &&
-+		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
-+		goto skip_reslog;
-+
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	gr_log_resource(task, res, wanted, gt);
-+#endif
-+      skip_reslog:
-+
-+	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
-+		return;
-+
-+	acl = task->acl;
-+
-+	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+		   !(acl->resmask & (1 << (unsigned short) res))))
-+		return;
-+
-+	if (wanted >= acl->res[res].rlim_cur) {
-+		unsigned long res_add;
-+
-+		res_add = wanted;
-+		switch (res) {
-+		case RLIMIT_CPU:
-+			res_add += GR_RLIM_CPU_BUMP;
-+			break;
-+		case RLIMIT_FSIZE:
-+			res_add += GR_RLIM_FSIZE_BUMP;
-+			break;
-+		case RLIMIT_DATA:
-+			res_add += GR_RLIM_DATA_BUMP;
-+			break;
-+		case RLIMIT_STACK:
-+			res_add += GR_RLIM_STACK_BUMP;
-+			break;
-+		case RLIMIT_CORE:
-+			res_add += GR_RLIM_CORE_BUMP;
-+			break;
-+		case RLIMIT_RSS:
-+			res_add += GR_RLIM_RSS_BUMP;
-+			break;
-+		case RLIMIT_NPROC:
-+			res_add += GR_RLIM_NPROC_BUMP;
-+			break;
-+		case RLIMIT_NOFILE:
-+			res_add += GR_RLIM_NOFILE_BUMP;
-+			break;
-+		case RLIMIT_MEMLOCK:
-+			res_add += GR_RLIM_MEMLOCK_BUMP;
-+			break;
-+		case RLIMIT_AS:
-+			res_add += GR_RLIM_AS_BUMP;
-+			break;
-+		case RLIMIT_LOCKS:
-+			res_add += GR_RLIM_LOCKS_BUMP;
-+			break;
-+		case RLIMIT_SIGPENDING:
-+			res_add += GR_RLIM_SIGPENDING_BUMP;
-+			break;
-+		case RLIMIT_MSGQUEUE:
-+			res_add += GR_RLIM_MSGQUEUE_BUMP;
-+			break;
-+		case RLIMIT_NICE:
-+			res_add += GR_RLIM_NICE_BUMP;
-+			break;
-+		case RLIMIT_RTPRIO:
-+			res_add += GR_RLIM_RTPRIO_BUMP;
-+			break;
-+		case RLIMIT_RTTIME:
-+			res_add += GR_RLIM_RTTIME_BUMP;
-+			break;
-+		}
-+
-+		acl->res[res].rlim_cur = res_add;
-+
-+		if (wanted > acl->res[res].rlim_max)
-+			acl->res[res].rlim_max = res_add;
-+
-+		/* only log the subject filename, since resource logging is supported for
-+		   single-subject learning only */
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid, cred->gid, acl->filename,
-+			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
-+			       "", (unsigned long) res, &task->signal->curr_ip);
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	struct task_struct *task = current;
-+        struct acl_subject_label *proc;
-+	unsigned long flags;
-+
-+        if (unlikely(!(gr_status & GR_READY)))
-+                return;
-+
-+	flags = pax_get_flags(task);
-+
-+        proc = task->acl;
-+
-+	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
-+		flags &= ~MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
-+		flags &= ~MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
-+		flags &= ~MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
-+		flags &= ~MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
-+		flags &= ~MF_PAX_MPROTECT;
-+
-+	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
-+		flags |= MF_PAX_PAGEEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
-+		flags |= MF_PAX_SEGMEXEC;
-+	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
-+		flags |= MF_PAX_RANDMMAP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
-+		flags |= MF_PAX_EMUTRAMP;
-+	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
-+		flags |= MF_PAX_MPROTECT;
-+
-+	pax_set_flags(task, flags);
-+
-+        return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+/* Eric Biederman likes breaking userland ABI and every inode-based security
-+   system to save 35kb of memory */
-+
-+/* we modify the passed in filename, but adjust it back before returning */
-+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
-+{
-+	struct name_entry *nmatch;
-+	char *p, *lastp = NULL;
-+	struct acl_object_label *obj = NULL, *tmp;
-+	struct acl_subject_label *tmpsubj;
-+	char c = '\0';
-+
-+	read_lock(&gr_inode_lock);
-+
-+	p = name + len - 1;
-+	do {
-+		nmatch = lookup_name_entry(name);
-+		if (lastp != NULL)
-+			*lastp = c;
-+
-+		if (nmatch == NULL)
-+			goto next_component;
-+		tmpsubj = current->acl;
-+		do {
-+			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
-+			if (obj != NULL) {
-+				tmp = obj->globbed;
-+				while (tmp) {
-+					if (!glob_match(tmp->filename, name)) {
-+						obj = tmp;
-+						goto found_obj;
-+					}
-+					tmp = tmp->next;
-+				}
-+				goto found_obj;
-+			}
-+		} while ((tmpsubj = tmpsubj->parent_subject));
-+next_component:
-+		/* end case */
-+		if (p == name)
-+			break;
-+
-+		while (*p != '/')
-+			p--;
-+		if (p == name)
-+			lastp = p + 1;
-+		else {
-+			lastp = p;
-+			p--;
-+		}
-+		c = *lastp;
-+		*lastp = '\0';
-+	} while (1);
-+found_obj:
-+	read_unlock(&gr_inode_lock);
-+	/* obj returned will always be non-null */
-+	return obj;
-+}
-+
-+/* returns 0 when allowing, non-zero on error
-+   op of 0 is used for readdir, so we don't log the names of hidden files
-+*/
-+__u32
-+gr_handle_sysctl(const struct ctl_table *table, const int op)
-+{
-+	ctl_table *tmp;
-+	const char *proc_sys = "/proc/sys";
-+	char *path;
-+	struct acl_object_label *obj;
-+	unsigned short len = 0, pos = 0, depth = 0, i;
-+	__u32 err = 0;
-+	__u32 mode = 0;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+
-+	/* for now, ignore operations on non-sysctl entries if it's not a
-+	   readdir*/
-+	if (table->child != NULL && op != 0)
-+		return 0;
-+
-+	mode |= GR_FIND;
-+	/* it's only a read if it's an entry, read on dirs is for readdir */
-+	if (op & MAY_READ)
-+		mode |= GR_READ;
-+	if (op & MAY_WRITE)
-+		mode |= GR_WRITE;
-+
-+	preempt_disable();
-+
-+	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
-+
-+	/* it's only a read/write if it's an actual entry, not a dir
-+	   (which are opened for readdir)
-+	*/
-+
-+	/* convert the requested sysctl entry into a pathname */
-+
-+	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+		len += strlen(tmp->procname);
-+		len++;
-+		depth++;
-+	}
-+
-+	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
-+		/* deny */
-+		goto out;
-+	}
-+
-+	memset(path, 0, PAGE_SIZE);
-+
-+	memcpy(path, proc_sys, strlen(proc_sys));
-+
-+	pos += strlen(proc_sys);
-+
-+	for (; depth > 0; depth--) {
-+		path[pos] = '/';
-+		pos++;
-+		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
-+			if (depth == i) {
-+				memcpy(path + pos, tmp->procname,
-+				       strlen(tmp->procname));
-+				pos += strlen(tmp->procname);
-+			}
-+			i++;
-+		}
-+	}
-+
-+	obj = gr_lookup_by_name(path, pos);
-+	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
-+
-+	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
-+		     ((err & mode) != mode))) {
-+		__u32 new_mode = mode;
-+
-+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
-+
-+		err = 0;
-+		gr_log_learn_sysctl(path, new_mode);
-+	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
-+		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
-+		err = -ENOENT;
-+	} else if (!(err & GR_FIND)) {
-+		err = -ENOENT;
-+	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
-+		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = -EACCES;
-+	} else if ((err & mode) != mode) {
-+		err = -EACCES;
-+	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
-+		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
-+			       path, (mode & GR_READ) ? " reading" : "",
-+			       (mode & GR_WRITE) ? " writing" : "");
-+		err = 0;
-+	} else
-+		err = 0;
-+
-+      out:
-+	preempt_enable();
-+
-+	return err;
-+}
-+#endif
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	struct file *filp;
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	filp = task->exec_file;
-+
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 1;
-+	}
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		read_unlock(&tasklist_lock);
-+		return 0;
-+	}
-+#endif
-+
-+	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+
-+	if (retmode & GR_NOPTRACE)
-+		return 1;
-+
-+	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
-+	    && (current->acl != task->acl || (current->acl != current->role->root_label
-+	    && current->pid != task->pid)))
-+		return 1;
-+
-+	return 0;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	struct task_struct *tmp = task;
-+	struct task_struct *curtemp = current;
-+	__u32 retmode;
-+
-+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 0;
-+#endif
-+
-+	read_lock(&tasklist_lock);
-+	while (tmp->pid > 0) {
-+		if (tmp == curtemp)
-+			break;
-+		tmp = tmp->parent;
-+	}
-+
-+	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
-+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	if (!(gr_status & GR_READY))
-+		return 0;
-+#endif
-+
-+	read_lock(&grsec_exec_file_lock);
-+	if (unlikely(!task->exec_file)) {
-+		read_unlock(&grsec_exec_file_lock);
-+		return 0;
-+	}
-+
-+	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
-+	read_unlock(&grsec_exec_file_lock);
-+
-+	if (retmode & GR_NOPTRACE) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+		
-+	if (retmode & GR_PTRACERD) {
-+		switch (request) {
-+		case PTRACE_POKETEXT:
-+		case PTRACE_POKEDATA:
-+		case PTRACE_POKEUSR:
-+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
-+		case PTRACE_SETREGS:
-+		case PTRACE_SETFPREGS:
-+#endif
-+#ifdef CONFIG_X86
-+		case PTRACE_SETFPXREGS:
-+#endif
-+#ifdef CONFIG_ALTIVEC
-+		case PTRACE_SETVRREGS:
-+#endif
-+			return 1;
-+		default:
-+			return 0;
-+		}
-+	} else if (!(current->acl->mode & GR_POVERRIDE) &&
-+		   !(current->role->roletype & GR_ROLE_GOD) &&
-+		   (current->acl != task->acl)) {
-+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+static int is_writable_mmap(const struct file *filp)
-+{
-+	struct task_struct *task = current;
-+	struct acl_object_label *obj, *obj2;
-+
-+	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
-+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
-+		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
-+				     task->role->root_label);
-+		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
-+			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
-+			return 1;
-+		}
-+	}
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!file || !(prot & PROT_EXEC)))
-+		return 1;
-+
-+	if (is_writable_mmap(file))
-+		return 0;
-+
-+	mode =
-+	    gr_search_file(file->f_path.dentry,
-+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
-+			   file->f_path.mnt);
-+
-+	if (!gr_tpe_allow(file))
-+		return 0;
-+
-+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_EXEC))) {
-+		return 0;
-+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 1;
-+	}
-+
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	unsigned long runtime;
-+	unsigned long cputime;
-+	unsigned int wday, cday;
-+	__u8 whr, chr;
-+	__u8 wmin, cmin;
-+	__u8 wsec, csec;
-+	struct timespec timeval;
-+
-+	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
-+		     !(task->acl->mode & GR_PROCACCT)))
-+		return;
-+
-+	do_posix_clock_monotonic_gettime(&timeval);
-+	runtime = timeval.tv_sec - task->start_time.tv_sec;
-+	wday = runtime / (3600 * 24);
-+	runtime -= wday * (3600 * 24);
-+	whr = runtime / 3600;
-+	runtime -= whr * 3600;
-+	wmin = runtime / 60;
-+	runtime -= wmin * 60;
-+	wsec = runtime;
-+
-+	cputime = (task->utime + task->stime) / HZ;
-+	cday = cputime / (3600 * 24);
-+	cputime -= cday * (3600 * 24);
-+	chr = cputime / 3600;
-+	cputime -= chr * 3600;
-+	cmin = cputime / 60;
-+	cputime -= cmin * 60;
-+	csec = cputime;
-+
-+	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
-+
-+	return;
-+}
-+
-+void gr_set_kernel_label(struct task_struct *task)
-+{
-+	if (gr_status & GR_READY) {
-+		task->role = kernel_role;
-+		task->acl = kernel_role->root_label;
-+	}
-+	return;
-+}
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	struct task_struct *task;
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	const struct cred *cred;
-+#endif
-+	int ret = 0;
-+
-+	/* restrict taskstats viewing to un-chrooted root users
-+	   who have the 'view' subject flag if the RBAC system is enabled
-+	*/
-+
-+	read_lock(&tasklist_lock);
-+	task = find_task_by_vpid(pid);
-+	if (task) {
-+		gr_fs_read_lock(task);
-+#ifdef CONFIG_GRKERNSEC_CHROOT
-+		if (proc_is_chrooted(task))
-+			ret = -EACCES;
-+#endif
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		cred = __task_cred(task);
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+		if (cred->uid != 0)
-+			ret = -EACCES;
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
-+			ret = -EACCES;
-+#endif
-+#endif
-+		if (gr_status & GR_READY) {
-+			if (!(task->acl->mode & GR_VIEW))
-+				ret = -EACCES;
-+		}
-+		
-+		gr_fs_read_unlock(task);
-+	} else
-+		ret = -ENOENT;
-+
-+	read_unlock(&tasklist_lock);
-+
-+	return ret;
-+}
-+#endif
-+
-+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
-+{
-+	struct task_struct *task = current;
-+	struct dentry *dentry = file->f_path.dentry;
-+	struct vfsmount *mnt = file->f_path.mnt;
-+	struct acl_object_label *obj, *tmp;
-+	struct acl_subject_label *subj;
-+	unsigned int bufsize;
-+	int is_not_root;
-+	char *path;
-+
-+	if (unlikely(!(gr_status & GR_READY)))
-+		return 1;
-+
-+	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
-+		return 1;
-+
-+	/* ignore Eric Biederman */
-+	if (IS_PRIVATE(dentry->d_inode))
-+		return 1;
-+
-+	subj = task->acl;
-+	do {
-+		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
-+		if (obj != NULL)
-+			return (obj->mode & GR_FIND) ? 1 : 0;
-+	} while ((subj = subj->parent_subject));
-+	
-+	/* this is purely an optimization since we're looking for an object
-+	   for the directory we're doing a readdir on
-+	   if it's possible for any globbed object to match the entry we're
-+	   filling into the directory, then the object we find here will be
-+	   an anchor point with attached globbed objects
-+	*/
-+	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
-+	if (obj->globbed == NULL)
-+		return (obj->mode & GR_FIND) ? 1 : 0;
-+
-+	is_not_root = ((obj->filename[0] == '/') &&
-+		   (obj->filename[1] == '\0')) ? 0 : 1;
-+	bufsize = PAGE_SIZE - namelen - is_not_root;
-+
-+	/* check bufsize > PAGE_SIZE || bufsize == 0 */
-+	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
-+		return 1;
-+
-+	preempt_disable();
-+	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
-+			   bufsize);
-+
-+	bufsize = strlen(path);
-+
-+	/* if base is "/", don't append an additional slash */
-+	if (is_not_root)
-+		*(path + bufsize) = '/';
-+	memcpy(path + bufsize + is_not_root, name, namelen);
-+	*(path + bufsize + namelen + is_not_root) = '\0';
-+
-+	tmp = obj->globbed;
-+	while (tmp) {
-+		if (!glob_match(tmp->filename, path)) {
-+			preempt_enable();
-+			return (tmp->mode & GR_FIND) ? 1 : 0;
-+		}
-+		tmp = tmp->next;
-+	}
-+	preempt_enable();
-+	return (obj->mode & GR_FIND) ? 1 : 0;
-+}
-+
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-+
-diff -urNp linux-2.6.32.13/grsecurity/gracl_cap.c linux-2.6.32.13/grsecurity/gracl_cap.c
---- linux-2.6.32.13/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_cap.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,131 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static const char *captab_log[] = {
-+	"CAP_CHOWN",
-+	"CAP_DAC_OVERRIDE",
-+	"CAP_DAC_READ_SEARCH",
-+	"CAP_FOWNER",
-+	"CAP_FSETID",
-+	"CAP_KILL",
-+	"CAP_SETGID",
-+	"CAP_SETUID",
-+	"CAP_SETPCAP",
-+	"CAP_LINUX_IMMUTABLE",
-+	"CAP_NET_BIND_SERVICE",
-+	"CAP_NET_BROADCAST",
-+	"CAP_NET_ADMIN",
-+	"CAP_NET_RAW",
-+	"CAP_IPC_LOCK",
-+	"CAP_IPC_OWNER",
-+	"CAP_SYS_MODULE",
-+	"CAP_SYS_RAWIO",
-+	"CAP_SYS_CHROOT",
-+	"CAP_SYS_PTRACE",
-+	"CAP_SYS_PACCT",
-+	"CAP_SYS_ADMIN",
-+	"CAP_SYS_BOOT",
-+	"CAP_SYS_NICE",
-+	"CAP_SYS_RESOURCE",
-+	"CAP_SYS_TIME",
-+	"CAP_SYS_TTY_CONFIG",
-+	"CAP_MKNOD",
-+	"CAP_LEASE",
-+	"CAP_AUDIT_WRITE",
-+	"CAP_AUDIT_CONTROL",
-+	"CAP_SETFCAP",
-+	"CAP_MAC_OVERRIDE",
-+	"CAP_MAC_ADMIN"
-+};
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	struct task_struct *task = current;
-+	const struct cred *cred = current_cred();
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	curracl = task->acl;
-+
-+	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
-+	    && cap_raised(cred->cap_effective, cap)) {
-+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
-+			       task->role->roletype, cred->uid,
-+			       cred->gid, task->exec_file ?
-+			       gr_to_filename(task->exec_file->f_path.dentry,
-+			       task->exec_file->f_path.mnt) : curracl->filename,
-+			       curracl->filename, 0UL,
-+			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
-+		return 1;
-+	}
-+
-+	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
-+		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
-+	return 0;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	struct acl_subject_label *curracl;
-+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	curracl = current->acl;
-+
-+	cap_drop = curracl->cap_lower;
-+	cap_mask = curracl->cap_mask;
-+
-+	while ((curracl = curracl->parent_subject)) {
-+		/* if the cap isn't specified in the current computed mask but is specified in the
-+		   current level subject, and is lowered in the current level subject, then add
-+		   it to the set of dropped capabilities
-+		   otherwise, add the current level subject's mask to the current computed mask
-+		 */
-+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
-+			cap_raise(cap_mask, cap);
-+			if (cap_raised(curracl->cap_lower, cap))
-+				cap_raise(cap_drop, cap);
-+		}
-+	}
-+
-+	if (!cap_raised(cap_drop, cap))
-+		return 1;
-+
-+	return 0;
-+}
-+
-diff -urNp linux-2.6.32.13/grsecurity/gracl_fs.c linux-2.6.32.13/grsecurity/gracl_fs.c
---- linux-2.6.32.13/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_fs.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,424 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/types.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/stat.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return GR_FIND;
-+
-+	mode =
-+	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return mode;
-+	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
-+		return 0;
-+	} else if (unlikely(!(mode & GR_FIND)))
-+		return 0;
-+
-+	return GR_FIND;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	__u32 reqmode = GR_FIND;
-+	__u32 mode;
-+
-+	if (unlikely(!dentry->d_inode))
-+		return reqmode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	else if (unlikely(fmode & FMODE_WRITE))
-+		reqmode |= GR_WRITE;
-+	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
-+		reqmode &= ~GR_READ;
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	if (unlikely(fmode & O_APPEND))
-+		reqmode |= GR_APPEND;
-+	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
-+		reqmode |= GR_READ;
-+	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
-+		reqmode |= GR_SETID;
-+
-+	mode =
-+	    gr_check_create(dentry, p_dentry, p_mnt,
-+			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : reqmode &
-+			       GR_APPEND ? " appending" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     const int fmode)
-+{
-+	__u32 mode, reqmode = GR_FIND;
-+
-+	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
-+		reqmode |= GR_EXEC;
-+	if (fmode & S_IWOTH)
-+		reqmode |= GR_WRITE;
-+	if (fmode & S_IROTH)
-+		reqmode |= GR_READ;
-+
-+	mode =
-+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
-+			   mnt);
-+
-+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return reqmode;
-+	} else
-+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
-+	{
-+		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
-+			       reqmode & GR_READ ? " reading" : "",
-+			       reqmode & GR_WRITE ? " writing" : "",
-+			       reqmode & GR_EXEC ? " executing" : "");
-+		return 0;
-+	} else if (unlikely((mode & reqmode) != reqmode))
-+		return 0;
-+
-+	return reqmode;
-+}
-+
-+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		     mode_t mode)
-+{
-+	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
-+		return 1;
-+
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_FCHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
-+		    mode_t mode)
-+{
-+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
-+				   GR_CHMOD_ACL_MSG);
-+	} else {
-+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
-+	}
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
-+			   GR_UNIXCONNECT_ACL_MSG);
-+}
-+
-+/* hardlinks require at minimum create permission,
-+   any additional privilege required is based on the
-+   privilege of the file being linked to
-+*/
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	__u32 mode;
-+	__u32 needmode = GR_CREATE | GR_LINK;
-+	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
-+
-+	mode =
-+	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
-+			  old_mnt);
-+
-+	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	__u32 needmode = GR_WRITE | GR_CREATE;
-+	__u32 mode;
-+
-+	mode =
-+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+			    GR_CREATE | GR_AUDIT_CREATE |
-+			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
-+
-+	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
-+		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & needmode) != needmode))
-+		return 0;
-+
-+	return (GR_WRITE | GR_CREATE);
-+}
-+
-+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
-+{
-+	__u32 mode;
-+
-+	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
-+
-+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
-+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
-+		return mode;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
-+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
-+		return 0;
-+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
-+		return 0;
-+
-+	return (reqmode);
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	__u32 reqmode = GR_WRITE | GR_CREATE;
-+	if (unlikely(mode & (S_ISUID | S_ISGID)))
-+		reqmode |= GR_SETID;
-+
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  reqmode, GR_MKNOD_ACL_MSG);
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+		    const struct dentry *parent_dentry,
-+		    const struct vfsmount *parent_mnt)
-+{
-+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
-+				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
-+}
-+
-+#define RENAME_CHECK_SUCCESS(old, new) \
-+	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
-+	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
-+
-+int
-+gr_acl_handle_rename(struct dentry *new_dentry,
-+		     struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     struct dentry *old_dentry,
-+		     struct inode *old_parent_inode,
-+		     struct vfsmount *old_mnt, const char *newname)
-+{
-+	__u32 comp1, comp2;
-+	int error = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (!new_dentry->d_inode) {
-+		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
-+					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
-+					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
-+		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
-+				       GR_DELETE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, old_mnt);
-+	} else {
-+		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
-+				       GR_CREATE | GR_DELETE |
-+				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
-+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
-+				       GR_SUPPRESS, parent_mnt);
-+		comp2 =
-+		    gr_search_file(old_dentry,
-+				   GR_READ | GR_WRITE | GR_AUDIT_READ |
-+				   GR_DELETE | GR_AUDIT_DELETE |
-+				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
-+	}
-+
-+	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
-+	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
-+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
-+		 && !(comp2 & GR_SUPPRESS)) {
-+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
-+		error = -EACCES;
-+	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
-+		error = -EACCES;
-+
-+	return error;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	u16 id;
-+	char *rolename;
-+	struct file *exec_file;
-+
-+	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
-+		id = current->acl_role_id;
-+		rolename = current->role->rolename;
-+		gr_set_acls(1);
-+		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
-+	}
-+
-+	write_lock(&grsec_exec_file_lock);
-+	exec_file = current->exec_file;
-+	current->exec_file = NULL;
-+	write_unlock(&grsec_exec_file_lock);
-+
-+	if (exec_file)
-+		fput(exec_file);
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	if (task != current && task->acl->mode & GR_PROTPROCFD)
-+		return -EACCES;
-+
-+	return 0;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/gracl_ip.c linux-2.6.32.13/grsecurity/gracl_ip.c
---- linux-2.6.32.13/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_ip.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,339 @@
-+#include <linux/kernel.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/skbuff.h>
-+#include <linux/ip.h>
-+#include <linux/udp.h>
-+#include <linux/smp_lock.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/netdevice.h>
-+#include <linux/inetdevice.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+#define GR_BIND			0x01
-+#define GR_CONNECT		0x02
-+#define GR_INVERT		0x04
-+#define GR_BINDOVERRIDE		0x08
-+#define GR_CONNECTOVERRIDE	0x10
-+
-+static const char * gr_protocols[256] = {
-+	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
-+	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
-+	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
-+	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
-+	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
-+	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
-+	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
-+	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
-+	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
-+	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
-+	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
-+	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
-+	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
-+	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
-+	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
-+	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
-+	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
-+	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
-+	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
-+	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
-+	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
-+	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
-+	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
-+	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
-+	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
-+	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
-+	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
-+	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
-+	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
-+	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
-+	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
-+	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
-+	};
-+
-+static const char * gr_socktypes[11] = {
-+	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
-+	"unknown:7", "unknown:8", "unknown:9", "packet"
-+	};
-+
-+const char *
-+gr_proto_to_name(unsigned char proto)
-+{
-+	return gr_protocols[proto];
-+}
-+
-+const char *
-+gr_socktype_to_name(unsigned char type)
-+{
-+	return gr_socktypes[type];
-+}
-+
-+int
-+gr_search_socket(const int domain, const int type, const int protocol)
-+{
-+	struct acl_subject_label *curr;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		goto exit;
-+
-+	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
-+	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
-+		goto exit;	// let the kernel handle it
-+
-+	curr = current->acl;
-+
-+	if (!curr->ips)
-+		goto exit;
-+
-+	if ((curr->ip_type & (1 << type)) &&
-+	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
-+		goto exit;
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		/* we don't place acls on raw sockets , and sometimes
-+		   dgram/ip sockets are opened for ioctl and not
-+		   bind/connect, so we'll fake a bind learn log */
-+		if (type == SOCK_RAW || type == SOCK_PACKET) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_CONNECT, &current->signal->curr_ip);
-+		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
-+			__u32 fakeip = 0;
-+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+				       current->role->roletype, cred->uid,
-+				       cred->gid, current->exec_file ?
-+				       gr_to_filename(current->exec_file->f_path.dentry,
-+				       current->exec_file->f_path.mnt) :
-+				       curr->filename, curr->filename,
-+				       &fakeip, 0, type,
-+				       protocol, GR_BIND, &current->signal->curr_ip);
-+		}
-+		/* we'll log when they use connect or bind */
-+		goto exit;
-+	}
-+
-+	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
-+		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+
-+	return 0;
-+      exit:
-+	return 1;
-+}
-+
-+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
-+{
-+	if ((ip->mode & mode) &&
-+	    (ip_port >= ip->low) &&
-+	    (ip_port <= ip->high) &&
-+	    ((ntohl(ip_addr) & our_netmask) ==
-+	     (ntohl(our_addr) & our_netmask))
-+	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+	    && (ip->type & (1 << type))) {
-+		if (ip->mode & GR_INVERT)
-+			return 2; // specifically denied
-+		else
-+			return 1; // allowed
-+	}
-+
-+	return 0; // not specifically allowed, may continue parsing
-+}
-+
-+static int
-+gr_search_connectbind(const int full_mode, struct sock *sk,
-+		      struct sockaddr_in *addr, const int type)
-+{
-+	char iface[IFNAMSIZ] = {0};
-+	struct acl_subject_label *curr;
-+	struct acl_ip_label *ip;
-+	struct inet_sock *isk;
-+	struct net_device *dev;
-+	struct in_device *idev;
-+	unsigned long i;
-+	int ret;
-+	int mode = full_mode & (GR_BIND | GR_CONNECT);
-+	__u32 ip_addr = 0;
-+	__u32 our_addr;
-+	__u32 our_netmask;
-+	char *p;
-+	__u16 ip_port = 0;
-+	const struct cred *cred = current_cred();
-+
-+	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
-+		return 0;
-+
-+	curr = current->acl;
-+	isk = inet_sk(sk);
-+
-+	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
-+	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
-+		addr->sin_addr.s_addr = curr->inaddr_any_override;
-+	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
-+		struct sockaddr_in saddr;
-+		int err;
-+
-+		saddr.sin_family = AF_INET;
-+		saddr.sin_addr.s_addr = curr->inaddr_any_override;
-+		saddr.sin_port = isk->sport;
-+
-+		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+
-+		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
-+		if (err)
-+			return err;
-+	}
-+
-+	if (!curr->ips)
-+		return 0;
-+
-+	ip_addr = addr->sin_addr.s_addr;
-+	ip_port = ntohs(addr->sin_port);
-+
-+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
-+		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
-+			       current->role->roletype, cred->uid,
-+			       cred->gid, current->exec_file ?
-+			       gr_to_filename(current->exec_file->f_path.dentry,
-+			       current->exec_file->f_path.mnt) :
-+			       curr->filename, curr->filename,
-+			       &ip_addr, ip_port, type,
-+			       sk->sk_protocol, mode, &current->signal->curr_ip);
-+		return 0;
-+	}
-+
-+	for (i = 0; i < curr->ip_num; i++) {
-+		ip = *(curr->ips + i);
-+		if (ip->iface != NULL) {
-+			strncpy(iface, ip->iface, IFNAMSIZ - 1);
-+			p = strchr(iface, ':');
-+			if (p != NULL)
-+				*p = '\0';
-+			dev = dev_get_by_name(sock_net(sk), iface);
-+			if (dev == NULL)
-+				continue;
-+			idev = in_dev_get(dev);
-+			if (idev == NULL) {
-+				dev_put(dev);
-+				continue;
-+			}
-+			rcu_read_lock();
-+			for_ifa(idev) {
-+				if (!strcmp(ip->iface, ifa->ifa_label)) {
-+					our_addr = ifa->ifa_address;
-+					our_netmask = 0xffffffff;
-+					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+					if (ret == 1) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						return 0;
-+					} else if (ret == 2) {
-+						rcu_read_unlock();
-+						in_dev_put(idev);
-+						dev_put(dev);
-+						goto denied;
-+					}
-+				}
-+			} endfor_ifa(idev);
-+			rcu_read_unlock();
-+			in_dev_put(idev);
-+			dev_put(dev);
-+		} else {
-+			our_addr = ip->addr;
-+			our_netmask = ip->netmask;
-+			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
-+			if (ret == 1)
-+				return 0;
-+			else if (ret == 2)
-+				goto denied;
-+		}
-+	}
-+
-+denied:
-+	if (mode == GR_BIND)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+	else if (mode == GR_CONNECT)
-+		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
-+
-+	return -EACCES;
-+}
-+
-+int
-+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int
-+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
-+{
-+	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
-+}
-+
-+int gr_search_listen(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int gr_search_accept(struct socket *sock)
-+{
-+	struct sock *sk = sock->sk;
-+	struct sockaddr_in addr;
-+
-+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
-+	addr.sin_port = inet_sk(sk)->sport;
-+
-+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
-+}
-+
-+int
-+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
-+{
-+	if (addr)
-+		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
-+	else {
-+		struct sockaddr_in sin;
-+		const struct inet_sock *inet = inet_sk(sk);
-+
-+		sin.sin_addr.s_addr = inet->daddr;
-+		sin.sin_port = inet->dport;
-+
-+		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+	}
-+}
-+
-+int
-+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
-+{
-+	struct sockaddr_in sin;
-+
-+	if (unlikely(skb->len < sizeof (struct udphdr)))
-+		return 0;	// skip this packet
-+
-+	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
-+	sin.sin_port = udp_hdr(skb)->source;
-+
-+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
-+}
-diff -urNp linux-2.6.32.13/grsecurity/gracl_learn.c linux-2.6.32.13/grsecurity/gracl_learn.c
---- linux-2.6.32.13/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_learn.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,211 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/poll.h>
-+#include <linux/smp_lock.h>
-+#include <linux/string.h>
-+#include <linux/file.h>
-+#include <linux/types.h>
-+#include <linux/vmalloc.h>
-+#include <linux/grinternal.h>
-+
-+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
-+				   size_t count, loff_t *ppos);
-+extern int gr_acl_is_enabled(void);
-+
-+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
-+static int gr_learn_attached;
-+
-+/* use a 512k buffer */
-+#define LEARN_BUFFER_SIZE (512 * 1024)
-+
-+static DEFINE_SPINLOCK(gr_learn_lock);
-+static DECLARE_MUTEX(gr_learn_user_sem);
-+
-+/* we need to maintain two buffers, so that the kernel context of grlearn
-+   uses a semaphore around the userspace copying, and the other kernel contexts
-+   use a spinlock when copying into the buffer, since they cannot sleep
-+*/
-+static char *learn_buffer;
-+static char *learn_buffer_user;
-+static int learn_buffer_len;
-+static int learn_buffer_user_len;
-+
-+static ssize_t
-+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
-+{
-+	DECLARE_WAITQUEUE(wait, current);
-+	ssize_t retval = 0;
-+
-+	add_wait_queue(&learn_wait, &wait);
-+	set_current_state(TASK_INTERRUPTIBLE);
-+	do {
-+		down(&gr_learn_user_sem);
-+		spin_lock(&gr_learn_lock);
-+		if (learn_buffer_len)
-+			break;
-+		spin_unlock(&gr_learn_lock);
-+		up(&gr_learn_user_sem);
-+		if (file->f_flags & O_NONBLOCK) {
-+			retval = -EAGAIN;
-+			goto out;
-+		}
-+		if (signal_pending(current)) {
-+			retval = -ERESTARTSYS;
-+			goto out;
-+		}
-+
-+		schedule();
-+	} while (1);
-+
-+	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
-+	learn_buffer_user_len = learn_buffer_len;
-+	retval = learn_buffer_len;
-+	learn_buffer_len = 0;
-+
-+	spin_unlock(&gr_learn_lock);
-+
-+	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
-+		retval = -EFAULT;
-+
-+	up(&gr_learn_user_sem);
-+out:
-+	set_current_state(TASK_RUNNING);
-+	remove_wait_queue(&learn_wait, &wait);
-+	return retval;
-+}
-+
-+static unsigned int
-+poll_learn(struct file * file, poll_table * wait)
-+{
-+	poll_wait(file, &learn_wait, wait);
-+
-+	if (learn_buffer_len)
-+		return (POLLIN | POLLRDNORM);
-+
-+	return 0;
-+}
-+
-+void
-+gr_clear_learn_entries(void)
-+{
-+	char *tmp;
-+
-+	down(&gr_learn_user_sem);
-+	if (learn_buffer != NULL) {
-+		spin_lock(&gr_learn_lock);
-+		tmp = learn_buffer;
-+		learn_buffer = NULL;
-+		spin_unlock(&gr_learn_lock);
-+		vfree(learn_buffer);
-+	}
-+	if (learn_buffer_user != NULL) {
-+		vfree(learn_buffer_user);
-+		learn_buffer_user = NULL;
-+	}
-+	learn_buffer_len = 0;
-+	up(&gr_learn_user_sem);
-+
-+	return;
-+}
-+
-+void
-+gr_add_learn_entry(const char *fmt, ...)
-+{
-+	va_list args;
-+	unsigned int len;
-+
-+	if (!gr_learn_attached)
-+		return;
-+
-+	spin_lock(&gr_learn_lock);
-+
-+	/* leave a gap at the end so we know when it's "full" but don't have to
-+	   compute the exact length of the string we're trying to append
-+	*/
-+	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
-+		spin_unlock(&gr_learn_lock);
-+		wake_up_interruptible(&learn_wait);
-+		return;
-+	}
-+	if (learn_buffer == NULL) {
-+		spin_unlock(&gr_learn_lock);
-+		return;
-+	}
-+
-+	va_start(args, fmt);
-+	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
-+	va_end(args);
-+
-+	learn_buffer_len += len + 1;
-+
-+	spin_unlock(&gr_learn_lock);
-+	wake_up_interruptible(&learn_wait);
-+
-+	return;
-+}
-+
-+static int
-+open_learn(struct inode *inode, struct file *file)
-+{
-+	if (file->f_mode & FMODE_READ && gr_learn_attached)
-+		return -EBUSY;
-+	if (file->f_mode & FMODE_READ) {
-+		int retval = 0;
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer == NULL)
-+			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer_user == NULL)
-+			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
-+		if (learn_buffer == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		if (learn_buffer_user == NULL) {
-+			retval = -ENOMEM;
-+			goto out_error;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 1;
-+out_error:
-+		up(&gr_learn_user_sem);
-+		return retval;
-+	}
-+	return 0;
-+}
-+
-+static int
-+close_learn(struct inode *inode, struct file *file)
-+{
-+	char *tmp;
-+
-+	if (file->f_mode & FMODE_READ) {
-+		down(&gr_learn_user_sem);
-+		if (learn_buffer != NULL) {
-+			spin_lock(&gr_learn_lock);
-+			tmp = learn_buffer;
-+			learn_buffer = NULL;
-+			spin_unlock(&gr_learn_lock);
-+			vfree(tmp);
-+		}
-+		if (learn_buffer_user != NULL) {
-+			vfree(learn_buffer_user);
-+			learn_buffer_user = NULL;
-+		}
-+		learn_buffer_len = 0;
-+		learn_buffer_user_len = 0;
-+		gr_learn_attached = 0;
-+		up(&gr_learn_user_sem);
-+	}
-+
-+	return 0;
-+}
-+		
-+const struct file_operations grsec_fops = {
-+	.read		= read_learn,
-+	.write		= write_grsec_handler,
-+	.open		= open_learn,
-+	.release	= close_learn,
-+	.poll		= poll_learn,
-+};
-diff -urNp linux-2.6.32.13/grsecurity/gracl_res.c linux-2.6.32.13/grsecurity/gracl_res.c
---- linux-2.6.32.13/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_res.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/gracl.h>
-+#include <linux/grinternal.h>
-+
-+static const char *restab_log[] = {
-+	[RLIMIT_CPU] = "RLIMIT_CPU",
-+	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
-+	[RLIMIT_DATA] = "RLIMIT_DATA",
-+	[RLIMIT_STACK] = "RLIMIT_STACK",
-+	[RLIMIT_CORE] = "RLIMIT_CORE",
-+	[RLIMIT_RSS] = "RLIMIT_RSS",
-+	[RLIMIT_NPROC] = "RLIMIT_NPROC",
-+	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
-+	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
-+	[RLIMIT_AS] = "RLIMIT_AS",
-+	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
-+	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
-+	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
-+	[RLIMIT_NICE] = "RLIMIT_NICE",
-+	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
-+	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
-+	[GR_CRASH_RES] = "RLIMIT_CRASH"
-+};
-+
-+void
-+gr_log_resource(const struct task_struct *task,
-+		const int res, const unsigned long wanted, const int gt)
-+{
-+	const struct cred *cred;
-+
-+	if (!gr_acl_is_enabled() && !grsec_resource_logging)
-+		return;
-+
-+	// not yet supported resource
-+	if (!restab_log[res])
-+		return;
-+
-+	rcu_read_lock();
-+	cred = __task_cred(task);
-+
-+	if (res == RLIMIT_NPROC && 
-+	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
-+	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_MEMLOCK &&
-+		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
-+		goto out_rcu_unlock;
-+	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
-+		goto out_rcu_unlock;
-+	rcu_read_unlock();
-+
-+	preempt_disable();
-+
-+	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
-+		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
-+		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
-+		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
-+	preempt_enable_no_resched();
-+
-+	return;
-+out_rcu_unlock:
-+	rcu_read_unlock();
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/gracl_segv.c linux-2.6.32.13/grsecurity/gracl_segv.c
---- linux-2.6.32.13/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_segv.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,310 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <asm/uaccess.h>
-+#include <asm/errno.h>
-+#include <asm/mman.h>
-+#include <net/sock.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/smp_lock.h>
-+#include <linux/slab.h>
-+#include <linux/types.h>
-+#include <linux/sched.h>
-+#include <linux/timer.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+static struct crash_uid *uid_set;
-+static unsigned short uid_used;
-+static DEFINE_SPINLOCK(gr_uid_lock);
-+extern rwlock_t gr_inode_lock;
-+extern struct acl_subject_label *
-+	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
-+			      struct acl_role_label *role);
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
-+int
-+gr_init_uidset(void)
-+{
-+	uid_set =
-+	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
-+	uid_used = 0;
-+
-+	return uid_set ? 1 : 0;
-+}
-+
-+void
-+gr_free_uidset(void)
-+{
-+	if (uid_set)
-+		kfree(uid_set);
-+
-+	return;
-+}
-+
-+int
-+gr_find_uid(const uid_t uid)
-+{
-+	struct crash_uid *tmp = uid_set;
-+	uid_t buid;
-+	int low = 0, high = uid_used - 1, mid;
-+
-+	while (high >= low) {
-+		mid = (low + high) >> 1;
-+		buid = tmp[mid].uid;
-+		if (buid == uid)
-+			return mid;
-+		if (buid > uid)
-+			high = mid - 1;
-+		if (buid < uid)
-+			low = mid + 1;
-+	}
-+
-+	return -1;
-+}
-+
-+static __inline__ void
-+gr_insertsort(void)
-+{
-+	unsigned short i, j;
-+	struct crash_uid index;
-+
-+	for (i = 1; i < uid_used; i++) {
-+		index = uid_set[i];
-+		j = i;
-+		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
-+			uid_set[j] = uid_set[j - 1];
-+			j--;
-+		}
-+		uid_set[j] = index;
-+	}
-+
-+	return;
-+}
-+
-+static __inline__ void
-+gr_insert_uid(const uid_t uid, const unsigned long expires)
-+{
-+	int loc;
-+
-+	if (uid_used == GR_UIDTABLE_MAX)
-+		return;
-+
-+	loc = gr_find_uid(uid);
-+
-+	if (loc >= 0) {
-+		uid_set[loc].expires = expires;
-+		return;
-+	}
-+
-+	uid_set[uid_used].uid = uid;
-+	uid_set[uid_used].expires = expires;
-+	uid_used++;
-+
-+	gr_insertsort();
-+
-+	return;
-+}
-+
-+void
-+gr_remove_uid(const unsigned short loc)
-+{
-+	unsigned short i;
-+
-+	for (i = loc + 1; i < uid_used; i++)
-+		uid_set[i - 1] = uid_set[i];
-+
-+	uid_used--;
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	int loc;
-+	int ret = 0;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	spin_lock(&gr_uid_lock);
-+	loc = gr_find_uid(uid);
-+
-+	if (loc < 0)
-+		goto out_unlock;
-+
-+	if (time_before_eq(uid_set[loc].expires, get_seconds()))
-+		gr_remove_uid(loc);
-+	else
-+		ret = 1;
-+
-+out_unlock:
-+	spin_unlock(&gr_uid_lock);
-+	return ret;
-+}
-+
-+static __inline__ int
-+proc_is_setxid(const struct cred *cred)
-+{
-+	if (cred->uid != cred->euid || cred->uid != cred->suid ||
-+	    cred->uid != cred->fsuid)
-+		return 1;
-+	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
-+	    cred->gid != cred->fsgid)
-+		return 1;
-+
-+	return 0;
-+}
-+static __inline__ int
-+gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+	unsigned long int flags;
-+	int ret, blocked, ignored;
-+	struct k_sigaction *action;
-+
-+	spin_lock_irqsave(&t->sighand->siglock, flags);
-+	action = &t->sighand->action[sig-1];
-+	ignored = action->sa.sa_handler == SIG_IGN;
-+	blocked = sigismember(&t->blocked, sig);
-+	if (blocked || ignored) {
-+		action->sa.sa_handler = SIG_DFL;
-+		if (blocked) {
-+			sigdelset(&t->blocked, sig);
-+			recalc_sigpending_and_wake(t);
-+		}
-+	}
-+	if (action->sa.sa_handler == SIG_DFL)
-+		t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+	spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+	return ret;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	struct acl_subject_label *curr;
-+	struct acl_subject_label *curr2;
-+	struct task_struct *tsk, *tsk2;
-+	const struct cred *cred;
-+	const struct cred *cred2;
-+
-+	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
-+		return;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curr = task->acl;
-+
-+	if (!(curr->resmask & (1 << GR_CRASH_RES)))
-+		return;
-+
-+	if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->expires = 0;
-+		curr->crashes = 0;
-+	}
-+
-+	curr->crashes++;
-+
-+	if (!curr->expires)
-+		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds())) {
-+		rcu_read_lock();
-+		cred = __task_cred(task);
-+		if (cred->uid && proc_is_setxid(cred)) {
-+			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			spin_lock(&gr_uid_lock);
-+			gr_insert_uid(cred->uid, curr->expires);
-+			spin_unlock(&gr_uid_lock);
-+			curr->expires = 0;
-+			curr->crashes = 0;
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				cred2 = __task_cred(tsk);
-+				if (tsk != task && cred2->uid == cred->uid)
-+					gr_fake_force_sig(SIGKILL, tsk);
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		} else {
-+			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
-+			read_lock(&tasklist_lock);
-+			do_each_thread(tsk2, tsk) {
-+				if (likely(tsk != task)) {
-+					curr2 = tsk->acl;
-+
-+					if (curr2->device == curr->device &&
-+					    curr2->inode == curr->inode)
-+						gr_fake_force_sig(SIGKILL, tsk);
-+				}
-+			} while_each_thread(tsk2, tsk);
-+			read_unlock(&tasklist_lock);
-+		}
-+		rcu_read_unlock();
-+	}
-+
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	struct acl_subject_label *curr;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return 0;
-+
-+	read_lock(&gr_inode_lock);
-+	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
-+				     filp->f_path.dentry->d_inode->i_sb->s_dev,
-+				     current->role);
-+	read_unlock(&gr_inode_lock);
-+
-+	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
-+	    (!curr->crashes && !curr->expires))
-+		return 0;
-+
-+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
-+	    time_after(curr->expires, get_seconds()))
-+		return 1;
-+	else if (time_before_eq(curr->expires, get_seconds())) {
-+		curr->crashes = 0;
-+		curr->expires = 0;
-+	}
-+
-+	return 0;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	struct acl_subject_label *curracl;
-+	__u32 curr_ip;
-+	struct task_struct *p, *p2;
-+
-+	if (unlikely(!gr_acl_is_enabled()))
-+		return;
-+
-+	curracl = task->acl;
-+	curr_ip = task->signal->curr_ip;
-+
-+	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
-+		read_lock(&tasklist_lock);
-+		do_each_thread(p2, p) {
-+			if (p->signal->curr_ip == curr_ip)
-+				gr_fake_force_sig(SIGKILL, p);
-+		} while_each_thread(p2, p);
-+		read_unlock(&tasklist_lock);
-+	} else if (curracl->mode & GR_KILLPROC)
-+		gr_fake_force_sig(SIGKILL, task);
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/gracl_shm.c linux-2.6.32.13/grsecurity/gracl_shm.c
---- linux-2.6.32.13/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/gracl_shm.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,37 @@
-+#include <linux/kernel.h>
-+#include <linux/mm.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/ipc.h>
-+#include <linux/gracl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	struct task_struct *task;
-+
-+	if (!gr_acl_is_enabled())
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	task = find_task_by_vpid(shm_cprid);
-+
-+	if (unlikely(!task))
-+		task = find_task_by_vpid(shm_lapid);
-+
-+	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
-+			      (task->pid == shm_lapid)) &&
-+		     (task->acl->mode & GR_PROTSHM) &&
-+		     (task->acl != current->acl))) {
-+		read_unlock(&tasklist_lock);
-+		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
-+		return 0;
-+	}
-+	read_unlock(&tasklist_lock);
-+
-+	return 1;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_chdir.c linux-2.6.32.13/grsecurity/grsec_chdir.c
---- linux-2.6.32.13/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_chdir.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,19 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	if ((grsec_enable_chdir && grsec_enable_group &&
-+	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
-+					      !grsec_enable_group)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
-+	}
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_chroot.c linux-2.6.32.13/grsecurity/grsec_chroot.c
---- linux-2.6.32.13/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_chroot.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,348 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/mount.h>
-+#include <linux/types.h>
-+#include <linux/pid_namespace.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_chroot_unix(const pid_t pid)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	struct pid *spid = NULL;
-+
-+	if (unlikely(!grsec_enable_chroot_unix))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	spid = find_vpid(pid);
-+	if (spid) {
-+		struct task_struct *p;
-+		p = pid_task(spid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		if (unlikely(!have_same_root(current, p))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	}
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_handle_chroot_nice(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
-+			&& proc_is_chrooted(current)) {
-+		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_rawio(const struct inode *inode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
-+	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
-+		return 1;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_pid_is_chrooted(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
-+		return 0;
-+
-+	gr_fs_read_lock(p);
-+	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
-+	    !have_same_root(current, p)) {
-+		gr_fs_read_unlock(p);
-+		return 1;
-+	}
-+	gr_fs_read_unlock(p);
-+#endif
-+	return 0;
-+}
-+
-+EXPORT_SYMBOL(gr_pid_is_chrooted);
-+
-+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
-+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
-+{
-+	struct dentry *dentry = (struct dentry *)u_dentry;
-+	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
-+	struct dentry *realroot;
-+	struct vfsmount *realrootmnt;
-+	struct dentry *currentroot;
-+	struct vfsmount *currentmnt;
-+	struct task_struct *reaper = &init_task;
-+	int ret = 1;
-+
-+	read_lock(&reaper->fs->lock);
-+	realrootmnt = mntget(reaper->fs->root.mnt);
-+	realroot = dget(reaper->fs->root.dentry);
-+	read_unlock(&reaper->fs->lock);
-+
-+	read_lock(&current->fs->lock);
-+	currentmnt = mntget(current->fs->root.mnt);
-+	currentroot = dget(current->fs->root.dentry);
-+	read_unlock(&current->fs->lock);
-+
-+	spin_lock(&dcache_lock);
-+	for (;;) {
-+		if (unlikely((dentry == realroot && mnt == realrootmnt)
-+		     || (dentry == currentroot && mnt == currentmnt)))
-+			break;
-+		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
-+			if (mnt->mnt_parent == mnt)
-+				break;
-+			dentry = mnt->mnt_mountpoint;
-+			mnt = mnt->mnt_parent;
-+			continue;
-+		}
-+		dentry = dentry->d_parent;
-+	}
-+	spin_unlock(&dcache_lock);
-+
-+	dput(currentroot);
-+	mntput(currentmnt);
-+
-+	/* access is outside of chroot */
-+	if (dentry == realroot && mnt == realrootmnt)
-+		ret = 0;
-+
-+	dput(realroot);
-+	mntput(realrootmnt);
-+	return ret;
-+}
-+#endif
-+
-+int
-+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	if (!grsec_enable_chroot_fchdir)
-+		return 1;
-+
-+	if (!proc_is_chrooted(current))
-+		return 1;
-+	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
-+		return 0;
-+	}
-+#endif
-+	return 1;
-+}
-+
-+int
-+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	struct pid *pid = NULL;
-+	time_t starttime;
-+
-+	if (unlikely(!grsec_enable_chroot_shmat))
-+		return 1;
-+
-+	if (likely(!proc_is_chrooted(current)))
-+		return 1;
-+
-+	read_lock(&tasklist_lock);
-+
-+	pid = find_vpid(shm_cprid);
-+	if (pid) {
-+		struct task_struct *p;
-+		p = pid_task(pid, PIDTYPE_PID);
-+		gr_fs_read_lock(p);
-+		starttime = p->start_time.tv_sec;
-+		if (unlikely(!have_same_root(current, p) &&
-+			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
-+			gr_fs_read_unlock(p);
-+			read_unlock(&tasklist_lock);
-+			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+			return 0;
-+		}
-+		gr_fs_read_unlock(p);
-+	} else {
-+		pid = find_vpid(shm_lapid);
-+		if (pid) {
-+			struct task_struct *p;
-+			p = pid_task(pid, PIDTYPE_PID);
-+			gr_fs_read_lock(p);
-+			if (unlikely(!have_same_root(current, p))) {
-+				gr_fs_read_unlock(p);
-+				read_unlock(&tasklist_lock);
-+				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
-+				return 0;
-+			}
-+			gr_fs_read_unlock(p);
-+		}
-+	}
-+
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return 1;
-+}
-+
-+void
-+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_mknod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_mount(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const char *dev_name)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
-+		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_pivot(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
-+	    !gr_is_outside_chroot(dentry, mnt)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_caps(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
-+		(init_task.fs->root.dentry != path->dentry) &&
-+		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
-+
-+		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
-+		const struct cred *old = current_cred();
-+		struct cred *new = prepare_creds();
-+		if (new == NULL)
-+			return 1;
-+
-+		new->cap_permitted = cap_drop(old->cap_permitted, 
-+					      chroot_caps);
-+		new->cap_inheritable = cap_drop(old->cap_inheritable, 
-+						chroot_caps);
-+		new->cap_effective = cap_drop(old->cap_effective,
-+					      chroot_caps);
-+
-+		commit_creds(new);
-+
-+		return 0;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_chroot_sysctl(const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
-+	    && (op & MAY_WRITE))
-+		return -EACCES;
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_chroot_chdir(struct path *path)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	if (grsec_enable_chroot_chdir)
-+		set_fs_pwd(current->fs, path);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_chroot_chmod(const struct dentry *dentry,
-+		       const struct vfsmount *mnt, const int mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	if (grsec_enable_chroot_chmod &&
-+	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
-+	    proc_is_chrooted(current)) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_handle_chroot_caps);
-+#endif
-diff -urNp linux-2.6.32.13/grsecurity/grsec_disabled.c linux-2.6.32.13/grsecurity/grsec_disabled.c
---- linux-2.6.32.13/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_disabled.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,426 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/kdev_t.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <linux/skbuff.h>
-+#include <linux/sysctl.h>
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+void
-+pax_set_initial_flags(struct linux_binprm *bprm)
-+{
-+	return;
-+}
-+#endif
-+
-+#ifdef CONFIG_SYSCTL
-+__u32
-+gr_handle_sysctl(const struct ctl_table * table, const int op)
-+{
-+	return 0;
-+}
-+#endif
-+
-+#ifdef CONFIG_TASKSTATS
-+int gr_is_taskstats_denied(int pid)
-+{
-+	return 0;
-+}
-+#endif
-+
-+int
-+gr_acl_is_enabled(void)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_rawio(const struct inode *inode)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_acl_handle_psacct(struct task_struct *task, const long code)
-+{
-+	return;
-+}
-+
-+int
-+gr_handle_ptrace(struct task_struct *task, const long request)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_handle_proc_ptrace(struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_learn_resource(const struct task_struct *task,
-+		  const int res, const unsigned long wanted, const int gt)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_acls(const int type)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_hidden_task(const struct task_struct *tsk)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_protected_task(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_copy_label(struct task_struct *tsk)
-+{
-+	return;
-+}
-+
-+void
-+gr_set_pax_flags(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
-+		  const int unsafe_share)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_delete(const ino_t ino, const dev_t dev)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+	return;
-+}
-+
-+void
-+gr_handle_crash(struct task_struct *task, const int sig)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_crash_exec(const struct file *filp)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_crash_uid(const uid_t uid)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+		 struct dentry *old_dentry,
-+		 struct dentry *new_dentry,
-+		 struct vfsmount *mnt, const __u8 replace)
-+{
-+	return;
-+}
-+
-+int
-+gr_search_socket(const int family, const int type, const int protocol)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_connectbind(const int mode, const struct socket *sock,
-+		      const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_is_capable(const int cap)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_is_capable_nolog(const int cap)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_handle_alertkill(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_hidden_file(const struct dentry * dentry,
-+			  const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
-+		   const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
-+		   unsigned int *vm_flags)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_truncate(const struct dentry * dentry,
-+		       const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_access(const struct dentry * dentry,
-+		     const struct vfsmount * mnt, const int fmode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		     mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
-+		    mode_t mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+void
-+grsecurity_init(void)
-+{
-+	return;
-+}
-+
-+__u32
-+gr_acl_handle_mknod(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt,
-+		    const int mode)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_mkdir(const struct dentry * new_dentry,
-+		    const struct dentry * parent_dentry,
-+		    const struct vfsmount * parent_mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_symlink(const struct dentry * new_dentry,
-+		      const struct dentry * parent_dentry,
-+		      const struct vfsmount * parent_mnt, const char *from)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_link(const struct dentry * new_dentry,
-+		   const struct dentry * parent_dentry,
-+		   const struct vfsmount * parent_mnt,
-+		   const struct dentry * old_dentry,
-+		   const struct vfsmount * old_mnt, const char *to)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_acl_handle_rename(const struct dentry *new_dentry,
-+		     const struct dentry *parent_dentry,
-+		     const struct vfsmount *parent_mnt,
-+		     const struct dentry *old_dentry,
-+		     const struct inode *old_parent_inode,
-+		     const struct vfsmount *old_mnt, const char *newname)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_acl_handle_filldir(const struct file *file, const char *name,
-+		      const int namelen, const ino_t ino)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+		const time_t shm_createtime, const uid_t cuid, const int shmid)
-+{
-+	return 1;
-+}
-+
-+int
-+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_accept(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_listen(const struct socket *sock)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+__u32
-+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
-+{
-+	return 1;
-+}
-+
-+__u32
-+gr_acl_handle_creat(const struct dentry * dentry,
-+		    const struct dentry * p_dentry,
-+		    const struct vfsmount * p_mnt, const int fmode,
-+		    const int imode)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_acl_handle_exit(void)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
-+{
-+	return 1;
-+}
-+
-+void
-+gr_set_role_label(const uid_t uid, const gid_t gid)
-+{
-+	return;
-+}
-+
-+int
-+gr_acl_handle_procpidmem(const struct task_struct *task)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
-+{
-+	return 0;
-+}
-+
-+void
-+gr_set_kernel_label(struct task_struct *task)
-+{
-+	return;
-+}
-+
-+int
-+gr_check_user_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+int
-+gr_check_group_change(int real, int effective, int fs)
-+{
-+	return 0;
-+}
-+
-+
-+EXPORT_SYMBOL(gr_is_capable);
-+EXPORT_SYMBOL(gr_is_capable_nolog);
-+EXPORT_SYMBOL(gr_learn_resource);
-+EXPORT_SYMBOL(gr_set_kernel_label);
-+#ifdef CONFIG_SECURITY
-+EXPORT_SYMBOL(gr_check_user_change);
-+EXPORT_SYMBOL(gr_check_group_change);
-+#endif
-diff -urNp linux-2.6.32.13/grsecurity/grsec_exec.c linux-2.6.32.13/grsecurity/grsec_exec.c
---- linux-2.6.32.13/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_exec.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,89 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/binfmts.h>
-+#include <linux/smp_lock.h>
-+#include <linux/fs.h>
-+#include <linux/types.h>
-+#include <linux/grdefs.h>
-+#include <linux/grinternal.h>
-+#include <linux/capability.h>
-+
-+#include <asm/uaccess.h>
-+
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+static char gr_exec_arg_buf[132];
-+static DECLARE_MUTEX(gr_exec_arg_sem);
-+#endif
-+
-+int
-+gr_handle_nproc(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	const struct cred *cred = current_cred();
-+	if (grsec_enable_execve && cred->user &&
-+	    (atomic_read(&cred->user->processes) >
-+	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
-+	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
-+		return -EAGAIN;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void
-+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
-+{
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	char *grarg = gr_exec_arg_buf;
-+	unsigned int i, x, execlen = 0;
-+	char c;
-+
-+	if (!((grsec_enable_execlog && grsec_enable_group &&
-+	       in_group_p(grsec_audit_gid))
-+	      || (grsec_enable_execlog && !grsec_enable_group)))
-+		return;
-+
-+	down(&gr_exec_arg_sem);
-+	memset(grarg, 0, sizeof(gr_exec_arg_buf));
-+
-+	if (unlikely(argv == NULL))
-+		goto log;
-+
-+	for (i = 0; i < bprm->argc && execlen < 128; i++) {
-+		const char __user *p;
-+		unsigned int len;
-+
-+		if (copy_from_user(&p, argv + i, sizeof(p)))
-+			goto log;
-+		if (!p)
-+			goto log;
-+		len = strnlen_user(p, 128 - execlen);
-+		if (len > 128 - execlen)
-+			len = 128 - execlen;
-+		else if (len > 0)
-+			len--;
-+		if (copy_from_user(grarg + execlen, p, len))
-+			goto log;
-+
-+		/* rewrite unprintable characters */
-+		for (x = 0; x < len; x++) {
-+			c = *(grarg + execlen + x);
-+			if (c < 32 || c > 126)
-+				*(grarg + execlen + x) = ' ';
-+		}
-+
-+		execlen += len;
-+		*(grarg + execlen) = ' ';
-+		*(grarg + execlen + 1) = '\0';
-+		execlen++;
-+	}
-+
-+      log:
-+	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
-+			bprm->file->f_path.mnt, grarg);
-+	up(&gr_exec_arg_sem);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_fifo.c linux-2.6.32.13/grsecurity/grsec_fifo.c
---- linux-2.6.32.13/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_fifo.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,24 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
-+	       const struct dentry *dir, const int flag, const int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
-+	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
-+	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
-+	    (cred->fsuid != dentry->d_inode->i_uid)) {
-+		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
-+			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_fork.c linux-2.6.32.13/grsecurity/grsec_fork.c
---- linux-2.6.32.13/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_fork.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,15 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/errno.h>
-+
-+void
-+gr_log_forkfail(const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
-+		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_init.c linux-2.6.32.13/grsecurity/grsec_init.c
---- linux-2.6.32.13/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_init.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,241 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/smp_lock.h>
-+#include <linux/gracl.h>
-+#include <linux/slab.h>
-+#include <linux/vmalloc.h>
-+#include <linux/percpu.h>
-+
-+int grsec_enable_link;
-+int grsec_enable_dmesg;
-+int grsec_enable_harden_ptrace;
-+int grsec_enable_fifo;
-+int grsec_enable_execve;
-+int grsec_enable_execlog;
-+int grsec_enable_signal;
-+int grsec_enable_forkfail;
-+int grsec_enable_audit_ptrace;
-+int grsec_enable_time;
-+int grsec_enable_audit_textrel;
-+int grsec_enable_group;
-+int grsec_audit_gid;
-+int grsec_enable_chdir;
-+int grsec_enable_mount;
-+int grsec_enable_rofs;
-+int grsec_enable_chroot_findtask;
-+int grsec_enable_chroot_mount;
-+int grsec_enable_chroot_shmat;
-+int grsec_enable_chroot_fchdir;
-+int grsec_enable_chroot_double;
-+int grsec_enable_chroot_pivot;
-+int grsec_enable_chroot_chdir;
-+int grsec_enable_chroot_chmod;
-+int grsec_enable_chroot_mknod;
-+int grsec_enable_chroot_nice;
-+int grsec_enable_chroot_execlog;
-+int grsec_enable_chroot_caps;
-+int grsec_enable_chroot_sysctl;
-+int grsec_enable_chroot_unix;
-+int grsec_enable_tpe;
-+int grsec_tpe_gid;
-+int grsec_enable_blackhole;
-+int grsec_lastack_retries;
-+int grsec_enable_tpe_all;
-+int grsec_enable_socket_all;
-+int grsec_socket_all_gid;
-+int grsec_enable_socket_client;
-+int grsec_socket_client_gid;
-+int grsec_enable_socket_server;
-+int grsec_socket_server_gid;
-+int grsec_resource_logging;
-+int grsec_lock;
-+
-+DEFINE_SPINLOCK(grsec_alert_lock);
-+unsigned long grsec_alert_wtime = 0;
-+unsigned long grsec_alert_fyet = 0;
-+
-+DEFINE_SPINLOCK(grsec_audit_lock);
-+
-+DEFINE_RWLOCK(grsec_exec_file_lock);
-+
-+char *gr_shared_page[4];
-+
-+char *gr_alert_log_fmt;
-+char *gr_audit_log_fmt;
-+char *gr_alert_log_buf;
-+char *gr_audit_log_buf;
-+
-+extern struct gr_arg *gr_usermode;
-+extern unsigned char *gr_system_salt;
-+extern unsigned char *gr_system_sum;
-+
-+void __init
-+grsecurity_init(void)
-+{
-+	int j;
-+	/* create the per-cpu shared pages */
-+
-+#ifdef CONFIG_X86
-+	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
-+#endif
-+
-+	for (j = 0; j < 4; j++) {
-+		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
-+		if (gr_shared_page[j] == NULL) {
-+			panic("Unable to allocate grsecurity shared page");
-+			return;
-+		}
-+	}
-+
-+	/* allocate log buffers */
-+	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_alert_log_fmt) {
-+		panic("Unable to allocate grsecurity alert log format buffer");
-+		return;
-+	}
-+	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
-+	if (!gr_audit_log_fmt) {
-+		panic("Unable to allocate grsecurity audit log format buffer");
-+		return;
-+	}
-+	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_alert_log_buf) {
-+		panic("Unable to allocate grsecurity alert log buffer");
-+		return;
-+	}
-+	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
-+	if (!gr_audit_log_buf) {
-+		panic("Unable to allocate grsecurity audit log buffer");
-+		return;
-+	}
-+
-+	/* allocate memory for authentication structure */
-+	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
-+	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
-+	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
-+
-+	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
-+		panic("Unable to allocate grsecurity authentication structure");
-+		return;
-+	}
-+
-+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
-+#ifndef CONFIG_GRKERNSEC_SYSCTL
-+	grsec_lock = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	grsec_enable_audit_textrel = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	grsec_enable_group = 1;
-+	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	grsec_enable_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	grsec_enable_harden_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	grsec_enable_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	grsec_enable_link = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	grsec_enable_dmesg = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	grsec_enable_blackhole = 1;
-+	grsec_lastack_retries = 4;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	grsec_enable_fifo = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	grsec_enable_execve = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	grsec_enable_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	grsec_enable_signal = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	grsec_enable_forkfail = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	grsec_enable_time = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	grsec_resource_logging = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	grsec_enable_chroot_findtask = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	grsec_enable_chroot_unix = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	grsec_enable_chroot_mount = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	grsec_enable_chroot_fchdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	grsec_enable_chroot_shmat = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	grsec_enable_audit_ptrace = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	grsec_enable_chroot_double = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	grsec_enable_chroot_pivot = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	grsec_enable_chroot_chdir = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	grsec_enable_chroot_chmod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	grsec_enable_chroot_mknod = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	grsec_enable_chroot_nice = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	grsec_enable_chroot_execlog = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	grsec_enable_chroot_caps = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	grsec_enable_chroot_sysctl = 1;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	grsec_enable_tpe = 1;
-+	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	grsec_enable_tpe_all = 1;
-+#endif
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	grsec_enable_socket_all = 1;
-+	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	grsec_enable_socket_client = 1;
-+	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	grsec_enable_socket_server = 1;
-+	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
-+#endif
-+#endif
-+
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_link.c linux-2.6.32.13/grsecurity/grsec_link.c
---- linux-2.6.32.13/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_link.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,43 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/fs.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_follow_link(const struct inode *parent,
-+		      const struct inode *inode,
-+		      const struct dentry *dentry, const struct vfsmount *mnt)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
-+	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
-+	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
-+		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_hardlink(const struct dentry *dentry,
-+		   const struct vfsmount *mnt,
-+		   struct inode *inode, const int mode, const char *to)
-+{
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	const struct cred *cred = current_cred();
-+
-+	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
-+	    (!S_ISREG(mode) || (mode & S_ISUID) ||
-+	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
-+	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
-+	    !capable(CAP_FOWNER) && cred->uid) {
-+		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_log.c linux-2.6.32.13/grsecurity/grsec_log.c
---- linux-2.6.32.13/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_log.c	2010-05-15 13:21:17.906582737 -0400
-@@ -0,0 +1,296 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/tty.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+#define BEGIN_LOCKS(x) \
-+	rcu_read_lock(); \
-+	read_lock(&tasklist_lock); \
-+	read_lock(&grsec_exec_file_lock); \
-+	if (x != GR_DO_AUDIT) \
-+		spin_lock(&grsec_alert_lock); \
-+	else \
-+		spin_lock(&grsec_audit_lock)
-+
-+#define END_LOCKS(x) \
-+	if (x != GR_DO_AUDIT) \
-+		spin_unlock(&grsec_alert_lock); \
-+	else \
-+		spin_unlock(&grsec_audit_lock); \
-+	read_unlock(&grsec_exec_file_lock); \
-+	read_unlock(&tasklist_lock); \
-+	rcu_read_unlock(); \
-+	if (x == GR_DONT_AUDIT) \
-+		gr_handle_alertkill(current)
-+
-+enum {
-+	FLOODING,
-+	NO_FLOODING
-+};
-+
-+extern char *gr_alert_log_fmt;
-+extern char *gr_audit_log_fmt;
-+extern char *gr_alert_log_buf;
-+extern char *gr_audit_log_buf;
-+
-+static int gr_log_start(int audit)
-+{
-+	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
-+	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+
-+	if (audit == GR_DO_AUDIT)
-+		goto set_fmt;
-+
-+	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet = 0;
-+	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
-+		grsec_alert_fyet++;
-+	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
-+		grsec_alert_wtime = jiffies;
-+		grsec_alert_fyet++;
-+		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
-+		return FLOODING;
-+	} else return FLOODING;
-+
-+set_fmt:
-+	memset(buf, 0, PAGE_SIZE);
-+	if (current->signal->curr_ip && gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else if (current->signal->curr_ip) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
-+	} else if (gr_acl_is_enabled()) {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
-+		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
-+	} else {
-+		sprintf(fmt, "%s%s", loglevel, "grsec: ");
-+		strcpy(buf, fmt);
-+	}
-+
-+	return NO_FLOODING;
-+}
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+	__attribute__ ((format (printf, 2, 0)));
-+
-+static void gr_log_middle(int audit, const char *msg, va_list ap)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+
-+	return;
-+}
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+	__attribute__ ((format (printf, 2, 3)));
-+
-+static void gr_log_middle_varargs(int audit, const char *msg, ...)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+	va_list ap;
-+
-+	va_start(ap, msg);
-+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
-+	va_end(ap);
-+
-+	return;
-+}
-+
-+static void gr_log_end(int audit)
-+{
-+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
-+	unsigned int len = strlen(buf);
-+
-+	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
-+	printk("%s\n", buf);
-+
-+	return;
-+}
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
-+{
-+	int logtype;
-+	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+	char *str1, *str2, *str3;
-+	void *voidptr;
-+	int num1, num2;
-+	unsigned long ulong1, ulong2;
-+	struct dentry *dentry;
-+	struct vfsmount *mnt;
-+	struct file *file;
-+	struct task_struct *task;
-+	const struct cred *cred, *pcred;
-+	va_list ap;
-+
-+	BEGIN_LOCKS(audit);
-+	logtype = gr_log_start(audit);
-+	if (logtype == FLOODING) {
-+		END_LOCKS(audit);
-+		return;
-+	}
-+	va_start(ap, argtypes);
-+	switch (argtypes) {
-+	case GR_TTYSNIFF:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
-+		break;
-+	case GR_SYSCTL_HIDDEN:
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, str1);
-+		break;
-+	case GR_RBAC:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_STR_RBAC:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_RBAC_MODE2:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
-+		break;
-+	case GR_RBAC_MODE3:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		str2 = va_arg(ap, char *);
-+		str3 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
-+		break;
-+	case GR_FILENAME:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_STR_FILENAME:
-+		str1 = va_arg(ap, char *);
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
-+		break;
-+	case GR_FILENAME_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
-+		break;
-+	case GR_FILENAME_TWO_INT:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
-+		break;
-+	case GR_FILENAME_TWO_INT_STR:
-+		dentry = va_arg(ap, struct dentry *);
-+		mnt = va_arg(ap, struct vfsmount *);
-+		num1 = va_arg(ap, int);
-+		num2 = va_arg(ap, int);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
-+		break;
-+	case GR_TEXTREL:
-+		file = va_arg(ap, struct file *);
-+		ulong1 = va_arg(ap, unsigned long);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
-+		break;
-+	case GR_PTRACE:
-+		task = va_arg(ap, struct task_struct *);
-+		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
-+		break;
-+	case GR_RESOURCE:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		str1 = va_arg(ap, char *);
-+		ulong2 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CAP:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		str1 = va_arg(ap, char *);
-+		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_SIG:
-+		str1 = va_arg(ap, char *);
-+		voidptr = va_arg(ap, void *);
-+		gr_log_middle_varargs(audit, msg, str1, voidptr);
-+		break;
-+	case GR_SIG2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		num1 = va_arg(ap, int);
-+		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		break;
-+	case GR_CRASH1:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
-+		break;
-+	case GR_CRASH2:
-+		task = va_arg(ap, struct task_struct *);
-+		cred = __task_cred(task);
-+		pcred = __task_cred(task->parent);
-+		ulong1 = va_arg(ap, unsigned long);
-+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
-+		break;
-+	case GR_PSACCT:
-+		{
-+			unsigned int wday, cday;
-+			__u8 whr, chr;
-+			__u8 wmin, cmin;
-+			__u8 wsec, csec;
-+			char cur_tty[64] = { 0 };
-+			char parent_tty[64] = { 0 };
-+
-+			task = va_arg(ap, struct task_struct *);
-+			wday = va_arg(ap, unsigned int);
-+			cday = va_arg(ap, unsigned int);
-+			whr = va_arg(ap, int);
-+			chr = va_arg(ap, int);
-+			wmin = va_arg(ap, int);
-+			cmin = va_arg(ap, int);
-+			wsec = va_arg(ap, int);
-+			csec = va_arg(ap, int);
-+			ulong1 = va_arg(ap, unsigned long);
-+			cred = __task_cred(task);
-+			pcred = __task_cred(task->parent);
-+
-+			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
-+		}
-+		break;
-+	default:
-+		gr_log_middle(audit, msg, ap);
-+	}
-+	va_end(ap);
-+	gr_log_end(audit);
-+	END_LOCKS(audit);
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_mem.c linux-2.6.32.13/grsecurity/grsec_mem.c
---- linux-2.6.32.13/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_mem.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,85 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/mman.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_handle_ioperm(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_iopl(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_mem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_kmem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_open_port(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
-+	return;
-+}
-+
-+int
-+gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
-+{
-+	unsigned long start, end;
-+
-+	start = offset;
-+	end = start + vma->vm_end - vma->vm_start;
-+
-+	if (start > end) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	}
-+
-+	/* allowed ranges : ISA I/O BIOS */
-+	if ((start >= __pa(high_memory))
-+#if defined(CONFIG_X86) || defined(CONFIG_PPC)
-+	    || (start >= 0x000a0000 && end <= 0x00100000)
-+	    || (start >= 0x00000000 && end <= 0x00001000)
-+#endif
-+	)
-+		return 0;
-+
-+	if (vma->vm_flags & VM_WRITE) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	} else
-+		vma->vm_flags &= ~VM_MAYWRITE;
-+
-+	return 0;
-+}
-+
-+void
-+gr_log_nonroot_mod_load(const char *modname)
-+{
-+        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
-+        return;
-+}
-+
-+void
-+gr_handle_vm86(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_mount.c linux-2.6.32.13/grsecurity/grsec_mount.c
---- linux-2.6.32.13/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_mount.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,62 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mount.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_remount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_unmount(const char *devname, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
-+#endif
-+	return;
-+}
-+
-+void
-+gr_log_mount(const char *from, const char *to, const int retval)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	if (grsec_enable_mount && (retval >= 0))
-+		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
-+{
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
-+	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
-+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
-+		return -EPERM;
-+	} else
-+		return 0;
-+#endif
-+	return 0;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_ptrace.c linux-2.6.32.13/grsecurity/grsec_ptrace.c
---- linux-2.6.32.13/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_ptrace.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,14 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_audit_ptrace(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	if (grsec_enable_audit_ptrace)
-+		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_sig.c linux-2.6.32.13/grsecurity/grsec_sig.c
---- linux-2.6.32.13/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_sig.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,65 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/delay.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+char *signames[] = {
-+	[SIGSEGV] = "Segmentation fault",
-+	[SIGILL] = "Illegal instruction",
-+	[SIGABRT] = "Abort",
-+	[SIGBUS] = "Invalid alignment/Bus error"
-+};
-+
-+void
-+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
-+{
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
-+				    (sig == SIGABRT) || (sig == SIGBUS))) {
-+		if (t->pid == current->pid) {
-+			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
-+		} else {
-+			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
-+		}
-+	}
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_signal(const struct task_struct *p, const int sig)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (current->pid > 1 && gr_check_protected_task(p)) {
-+		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
-+		return -EPERM;
-+	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
-+		return -EPERM;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+void gr_handle_brute_attach(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	read_lock(&tasklist_lock);
-+	read_lock(&grsec_exec_file_lock);
-+	if (p->parent && p->parent->exec_file == p->exec_file)
-+		p->parent->brute = 1;
-+	read_unlock(&grsec_exec_file_lock);
-+	read_unlock(&tasklist_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_handle_brute_check(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_BRUTE
-+	if (current->brute)
-+		msleep(30 * 1000);
-+#endif
-+	return;
-+}
-+
-diff -urNp linux-2.6.32.13/grsecurity/grsec_sock.c linux-2.6.32.13/grsecurity/grsec_sock.c
---- linux-2.6.32.13/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_sock.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,271 @@
-+#include <linux/kernel.h>
-+#include <linux/module.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/net.h>
-+#include <linux/in.h>
-+#include <linux/ip.h>
-+#include <net/sock.h>
-+#include <net/inet_sock.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+#include <linux/gracl.h>
-+
-+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
-+EXPORT_SYMBOL(gr_cap_rtnetlink);
-+
-+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
-+
-+EXPORT_SYMBOL(gr_search_udp_recvmsg);
-+EXPORT_SYMBOL(gr_search_udp_sendmsg);
-+
-+#ifdef CONFIG_UNIX_MODULE
-+EXPORT_SYMBOL(gr_acl_handle_unix);
-+EXPORT_SYMBOL(gr_acl_handle_mknod);
-+EXPORT_SYMBOL(gr_handle_chroot_unix);
-+EXPORT_SYMBOL(gr_handle_create);
-+#endif
-+
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_conn_table_size 32749
-+struct conn_table_entry {
-+	struct conn_table_entry *next;
-+	struct signal_struct *sig;
-+};
-+
-+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
-+DEFINE_SPINLOCK(gr_conn_table_lock);
-+
-+extern const char * gr_socktype_to_name(unsigned char type);
-+extern const char * gr_proto_to_name(unsigned char proto);
-+
-+static __inline__ int 
-+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
-+{
-+	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
-+}
-+
-+static __inline__ int
-+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
-+	   __u16 sport, __u16 dport)
-+{
-+	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
-+		     sig->gr_sport == sport && sig->gr_dport == dport))
-+		return 1;
-+	else
-+		return 0;
-+}
-+
-+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
-+{
-+	struct conn_table_entry **match;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	newent->sig = sig;
-+	
-+	match = &gr_conn_table[index];
-+	newent->next = *match;
-+	*match = newent;
-+
-+	return;
-+}
-+
-+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
-+{
-+	struct conn_table_entry *match, *last = NULL;
-+	unsigned int index;
-+
-+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
-+			  sig->gr_sport, sig->gr_dport, 
-+			  gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, 
-+		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
-+		sig->gr_dport)) {
-+		last = match;
-+		match = match->next;
-+	}
-+
-+	if (match) {
-+		if (last)
-+			last->next = match->next;
-+		else
-+			gr_conn_table[index] = NULL;
-+		kfree(match);
-+	}
-+
-+	return;
-+}
-+
-+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
-+					     __u16 sport, __u16 dport)
-+{
-+	struct conn_table_entry *match;
-+	unsigned int index;
-+
-+	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
-+
-+	match = gr_conn_table[index];
-+	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
-+		match = match->next;
-+
-+	if (match)
-+		return match->sig;
-+	else
-+		return NULL;
-+}
-+
-+#endif
-+
-+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *sig = task->signal;
-+	struct conn_table_entry *newent;
-+
-+	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
-+	if (newent == NULL)
-+		return;
-+	/* no bh lock needed since we are called with bh disabled */
-+	spin_lock(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(sig);
-+	sig->gr_saddr = inet->rcv_saddr;
-+	sig->gr_daddr = inet->daddr;
-+	sig->gr_sport = inet->sport;
-+	sig->gr_dport = inet->dport;
-+	gr_add_to_task_ip_table_nolock(sig, newent);
-+	spin_unlock(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void gr_del_task_from_ip_table(struct task_struct *task)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	spin_lock_bh(&gr_conn_table_lock);
-+	gr_del_task_from_ip_table_nolock(task->signal);
-+	spin_unlock_bh(&gr_conn_table_lock);
-+#endif
-+	return;
-+}
-+
-+void
-+gr_attach_curr_ip(const struct sock *sk)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct signal_struct *p, *set;
-+	const struct inet_sock *inet = inet_sk(sk);	
-+
-+	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
-+		return;
-+
-+	set = current->signal;
-+
-+	spin_lock_bh(&gr_conn_table_lock);
-+	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
-+				    inet->dport, inet->sport);
-+	if (unlikely(p != NULL)) {
-+		set->curr_ip = p->curr_ip;
-+		set->used_accept = 1;
-+		gr_del_task_from_ip_table_nolock(p);
-+		spin_unlock_bh(&gr_conn_table_lock);
-+		return;
-+	}
-+	spin_unlock_bh(&gr_conn_table_lock);
-+
-+	set->curr_ip = inet->daddr;
-+	set->used_accept = 1;
-+#endif
-+	return;
-+}
-+
-+int
-+gr_handle_sock_all(const int family, const int type, const int protocol)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
-+	    (family != AF_UNIX) && (family != AF_LOCAL)) {
-+		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_server_other(const struct sock *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	if (grsec_enable_socket_server &&
-+	    in_group_p(grsec_socket_server_gid) &&
-+	    sck && (sck->sk_family != AF_UNIX) &&
-+	    (sck->sk_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+int
-+gr_handle_sock_client(const struct sockaddr *sck)
-+{
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
-+	    sck && (sck->sa_family != AF_UNIX) &&
-+	    (sck->sa_family != AF_LOCAL)) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+kernel_cap_t
-+gr_cap_rtnetlink(struct sock *sock)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_acl_is_enabled())
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_ISCSI &&
-+		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
-+		 gr_is_capable(CAP_SYS_ADMIN))
-+		return current_cap();
-+	else if (sock->sk_protocol == NETLINK_AUDIT &&
-+		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
-+		 gr_is_capable(CAP_AUDIT_WRITE) &&
-+		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
-+		 gr_is_capable(CAP_AUDIT_CONTROL))
-+		return current_cap();
-+	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
-+		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
-+		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
-+		  gr_is_capable(CAP_NET_ADMIN)))
-+		return current_cap();
-+	else
-+		return __cap_empty_set;
-+#else
-+	return current_cap();
-+#endif
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_sysctl.c linux-2.6.32.13/grsecurity/grsec_sysctl.c
---- linux-2.6.32.13/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_sysctl.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,447 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/sysctl.h>
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+int
-+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
-+{
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
-+		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
-+		return -EACCES;
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+static int __maybe_unused one = 1;
-+#endif
-+
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+ctl_table grsecurity_table[] = {
-+#ifdef CONFIG_GRKERNSEC_SYSCTL
-+#ifdef CONFIG_GRKERNSEC_LINK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "linking_restrictions",
-+		.data		= &grsec_enable_link,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FIFO
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "fifo_restrictions",
-+		.data		= &grsec_enable_fifo,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECVE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "execve_limiting",
-+		.data		= &grsec_enable_execve,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "ip_blackhole",
-+		.data		= &grsec_enable_blackhole,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "lastack_retries",
-+		.data		= &grsec_lastack_retries,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "exec_logging",
-+		.data		= &grsec_enable_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SIGNAL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "signal_logging",
-+		.data		= &grsec_enable_signal,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_FORKFAIL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "forkfail_logging",
-+		.data		= &grsec_enable_forkfail,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "timechange_logging",
-+		.data		= &grsec_enable_time,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_shmat",
-+		.data		= &grsec_enable_chroot_shmat,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_unix",
-+		.data		= &grsec_enable_chroot_unix,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mount",
-+		.data		= &grsec_enable_chroot_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_fchdir",
-+		.data		= &grsec_enable_chroot_fchdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chroot",
-+		.data		= &grsec_enable_chroot_double,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_pivot",
-+		.data		= &grsec_enable_chroot_pivot,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_enforce_chdir",
-+		.data		= &grsec_enable_chroot_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_chmod",
-+		.data		= &grsec_enable_chroot_chmod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_mknod",
-+		.data		= &grsec_enable_chroot_mknod,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_restrict_nice",
-+		.data		= &grsec_enable_chroot_nice,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_execlog",
-+		.data		= &grsec_enable_chroot_execlog,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_caps",
-+		.data		= &grsec_enable_chroot_caps,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_deny_sysctl",
-+		.data		= &grsec_enable_chroot_sysctl,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe",
-+		.data		= &grsec_enable_tpe,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_gid",
-+		.data		= &grsec_tpe_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "tpe_restrict_all",
-+		.data		= &grsec_enable_tpe_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all",
-+		.data		= &grsec_enable_socket_all,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_all_gid",
-+		.data		= &grsec_socket_all_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client",
-+		.data		= &grsec_enable_socket_client,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_client_gid",
-+		.data		= &grsec_socket_client_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server",
-+		.data		= &grsec_enable_socket_server,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "socket_server_gid",
-+		.data		= &grsec_socket_server_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_group",
-+		.data		= &grsec_enable_group,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_gid",
-+		.data		= &grsec_audit_gid,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_chdir",
-+		.data		= &grsec_enable_chdir,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_mount",
-+		.data		= &grsec_enable_mount,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_textrel",
-+		.data		= &grsec_enable_audit_textrel,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "dmesg",
-+		.data		= &grsec_enable_dmesg,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "chroot_findtask",
-+		.data		= &grsec_enable_chroot_findtask,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_RESLOG
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "resource_logging",
-+		.data		= &grsec_resource_logging,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "audit_ptrace",
-+		.data		= &grsec_enable_audit_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "harden_ptrace",
-+		.data		= &grsec_enable_harden_ptrace,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsec_lock",
-+		.data		= &grsec_lock,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+#endif
-+#ifdef CONFIG_GRKERNSEC_ROFS
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "romount_protect",
-+		.data		= &grsec_enable_rofs,
-+		.maxlen		= sizeof(int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec_minmax,
-+		.extra1		= &one,
-+		.extra2		= &one,
-+	},
-+#endif
-+	{ .ctl_name = 0 }
-+};
-+#endif
-diff -urNp linux-2.6.32.13/grsecurity/grsec_textrel.c linux-2.6.32.13/grsecurity/grsec_textrel.c
---- linux-2.6.32.13/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_textrel.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,16 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/file.h>
-+#include <linux/grinternal.h>
-+#include <linux/grsecurity.h>
-+
-+void
-+gr_log_textrel(struct vm_area_struct * vma)
-+{
-+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
-+	if (grsec_enable_audit_textrel)
-+		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_time.c linux-2.6.32.13/grsecurity/grsec_time.c
---- linux-2.6.32.13/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_time.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,13 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/grinternal.h>
-+
-+void
-+gr_log_timechange(void)
-+{
-+#ifdef CONFIG_GRKERNSEC_TIME
-+	if (grsec_enable_time)
-+		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
-+#endif
-+	return;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsec_tpe.c linux-2.6.32.13/grsecurity/grsec_tpe.c
---- linux-2.6.32.13/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsec_tpe.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,38 @@
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/file.h>
-+#include <linux/fs.h>
-+#include <linux/grinternal.h>
-+
-+extern int gr_acl_tpe_check(void);
-+
-+int
-+gr_tpe_allow(const struct file *file)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
-+	const struct cred *cred = current_cred();
-+
-+	if (cred->uid && ((grsec_enable_tpe &&
-+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
-+	    !in_group_p(grsec_tpe_gid)
-+#else
-+	    in_group_p(grsec_tpe_gid)
-+#endif
-+	    ) || gr_acl_tpe_check()) &&
-+	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
-+						(inode->i_mode & S_IWOTH))))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#ifdef CONFIG_GRKERNSEC_TPE_ALL
-+	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
-+	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
-+	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
-+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
-+		return 0;
-+	}
-+#endif
-+#endif
-+	return 1;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/grsum.c linux-2.6.32.13/grsecurity/grsum.c
---- linux-2.6.32.13/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/grsum.c	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,59 @@
-+#include <linux/err.h>
-+#include <linux/kernel.h>
-+#include <linux/sched.h>
-+#include <linux/mm.h>
-+#include <linux/scatterlist.h>
-+#include <linux/crypto.h>
-+#include <linux/gracl.h>
-+
-+
-+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
-+#error "crypto and sha256 must be built into the kernel"
-+#endif
-+
-+int
-+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
-+{
-+	char *p;
-+	struct crypto_hash *tfm;
-+	struct hash_desc desc;
-+	struct scatterlist sg;
-+	unsigned char temp_sum[GR_SHA_LEN];
-+	volatile int retval = 0;
-+	volatile int dummy = 0;
-+	unsigned int i;
-+
-+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
-+	if (IS_ERR(tfm)) {
-+		/* should never happen, since sha256 should be built in */
-+		return 1;
-+	}
-+
-+	desc.tfm = tfm;
-+	desc.flags = 0;
-+
-+	crypto_hash_init(&desc);
-+
-+	p = salt;
-+	sg_set_buf(&sg, p, GR_SALT_LEN);
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	p = entry->pw;
-+	sg_set_buf(&sg, p, strlen(p));
-+	
-+	crypto_hash_update(&desc, &sg, sg.length);
-+
-+	crypto_hash_final(&desc, temp_sum);
-+
-+	memset(entry->pw, 0, GR_PW_LEN);
-+
-+	for (i = 0; i < GR_SHA_LEN; i++)
-+		if (sum[i] != temp_sum[i])
-+			retval = 1;
-+		else
-+			dummy = 1;	// waste a cycle
-+
-+	crypto_free_hash(tfm);
-+
-+	return retval;
-+}
-diff -urNp linux-2.6.32.13/grsecurity/Kconfig linux-2.6.32.13/grsecurity/Kconfig
---- linux-2.6.32.13/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/Kconfig	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,965 @@
-+#
-+# grecurity configuration
-+#
-+
-+menu "Grsecurity"
-+
-+config GRKERNSEC
-+	bool "Grsecurity"
-+	select CRYPTO
-+	select CRYPTO_SHA256
-+	help
-+	  If you say Y here, you will be able to configure many features
-+	  that will enhance the security of your system.  It is highly
-+	  recommended that you say Y here and read through the help
-+	  for each option so that you fully understand the features and
-+	  can evaluate their usefulness for your machine.
-+
-+choice
-+	prompt "Security Level"
-+	depends on GRKERNSEC
-+	default GRKERNSEC_CUSTOM
-+
-+config GRKERNSEC_LOW
-+	bool "Low"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_CHDIR
-+
-+	help
-+	  If you choose this option, several of the grsecurity options will
-+	  be enabled that will give you greater protection against a number
-+	  of attacks, while assuring that none of your software will have any
-+	  conflicts with the additional security measures.  If you run a lot
-+	  of unusual software, or you are having problems with the higher
-+	  security levels, you should say Y here.  With this option, the
-+	  following features are enabled:
-+
-+	  - Linking restrictions
-+	  - FIFO restrictions
-+	  - Enforcing RLIMIT_NPROC on execve
-+	  - Restricted dmesg
-+	  - Enforced chdir("/") on chroot
-+	  - Runtime module disabling
-+
-+config GRKERNSEC_MEDIUM
-+	bool "Medium"
-+	select PAX
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_USERGROUP
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
-+
-+	help
-+	  If you say Y here, several features in addition to those included
-+	  in the low additional security level will be enabled.  These
-+	  features provide even more security to your system, though in rare
-+	  cases they may be incompatible with very old or poorly written
-+	  software.  If you enable this option, make sure that your auth
-+	  service (identd) is running as gid 1001.  With this option, 
-+	  the following features (in addition to those provided in the 
-+	  low additional security level) will be enabled:
-+
-+	  - Failed fork logging
-+	  - Time change logging
-+	  - Signal logging
-+	  - Deny mounts in chroot
-+	  - Deny double chrooting
-+	  - Deny sysctl writes in chroot
-+	  - Deny mknod in chroot
-+	  - Deny access to abstract AF_UNIX sockets out of chroot
-+	  - Deny pivot_root in chroot
-+	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
-+	  - /proc restrictions with special GID set to 10 (usually wheel)
-+	  - Address Space Layout Randomization (ASLR)
-+	  - Prevent exploitation of most refcount overflows
-+	  - Bounds checking of copying between the kernel and userland
-+
-+config GRKERNSEC_HIGH
-+	bool "High"
-+	select GRKERNSEC_LINK
-+	select GRKERNSEC_FIFO
-+	select GRKERNSEC_EXECVE
-+	select GRKERNSEC_DMESG
-+	select GRKERNSEC_FORKFAIL
-+	select GRKERNSEC_TIME
-+	select GRKERNSEC_SIGNAL
-+	select GRKERNSEC_CHROOT
-+	select GRKERNSEC_CHROOT_SHMAT
-+	select GRKERNSEC_CHROOT_UNIX
-+	select GRKERNSEC_CHROOT_MOUNT
-+	select GRKERNSEC_CHROOT_FCHDIR
-+	select GRKERNSEC_CHROOT_PIVOT
-+	select GRKERNSEC_CHROOT_DOUBLE
-+	select GRKERNSEC_CHROOT_CHDIR
-+	select GRKERNSEC_CHROOT_MKNOD
-+	select GRKERNSEC_CHROOT_CAPS
-+	select GRKERNSEC_CHROOT_SYSCTL
-+	select GRKERNSEC_CHROOT_FINDTASK
-+	select GRKERNSEC_PROC
-+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
-+	select GRKERNSEC_HIDESYM
-+	select GRKERNSEC_BRUTE
-+	select GRKERNSEC_PROC_USERGROUP
-+	select GRKERNSEC_KMEM
-+	select GRKERNSEC_RESLOG
-+	select GRKERNSEC_RANDNET
-+	select GRKERNSEC_PROC_ADD
-+	select GRKERNSEC_CHROOT_CHMOD
-+	select GRKERNSEC_CHROOT_NICE
-+	select GRKERNSEC_AUDIT_MOUNT
-+	select GRKERNSEC_MODHARDEN if (MODULES)
-+	select GRKERNSEC_HARDEN_PTRACE
-+	select GRKERNSEC_VM86 if (X86_32)
-+	select PAX
-+	select PAX_RANDUSTACK
-+	select PAX_ASLR
-+	select PAX_RANDMMAP
-+	select PAX_NOEXEC
-+	select PAX_MPROTECT
-+	select PAX_EI_PAX
-+	select PAX_PT_PAX_FLAGS
-+	select PAX_HAVE_ACL_FLAGS
-+	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
-+	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
-+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
-+	select PAX_SEGMEXEC if (X86_32)
-+	select PAX_PAGEEXEC
-+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
-+	select PAX_EMUTRAMP if (PARISC)
-+	select PAX_EMUSIGRT if (PARISC)
-+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
-+	select PAX_REFCOUNT if (X86 || SPARC64)
-+	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
-+	help
-+	  If you say Y here, many of the features of grsecurity will be
-+	  enabled, which will protect you against many kinds of attacks
-+	  against your system.  The heightened security comes at a cost
-+	  of an increased chance of incompatibilities with rare software
-+	  on your machine.  Since this security level enables PaX, you should
-+	  view <http://pax.grsecurity.net> and read about the PaX
-+	  project.  While you are there, download chpax and run it on
-+	  binaries that cause problems with PaX.  Also remember that
-+	  since the /proc restrictions are enabled, you must run your
-+	  identd as gid 1001.  This security level enables the following 
-+	  features in addition to those listed in the low and medium 
-+	  security levels:
-+
-+	  - Additional /proc restrictions
-+	  - Chmod restrictions in chroot
-+	  - No signals, ptrace, or viewing of processes outside of chroot
-+	  - Capability restrictions in chroot
-+	  - Deny fchdir out of chroot
-+	  - Priority restrictions in chroot
-+	  - Segmentation-based implementation of PaX
-+	  - Mprotect restrictions
-+	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
-+	  - Kernel stack randomization
-+	  - Mount/unmount/remount logging
-+	  - Kernel symbol hiding
-+	  - Prevention of memory exhaustion-based exploits
-+	  - Hardening of module auto-loading
-+	  - Ptrace restrictions
-+	  - Restricted vm86 mode
-+
-+config GRKERNSEC_CUSTOM
-+	bool "Custom"
-+	help
-+	  If you say Y here, you will be able to configure every grsecurity
-+	  option, which allows you to enable many more features that aren't
-+	  covered in the basic security levels.  These additional features
-+	  include TPE, socket restrictions, and the sysctl system for
-+	  grsecurity.  It is advised that you read through the help for
-+	  each option to determine its usefulness in your situation.
-+
-+endchoice
-+
-+menu "Address Space Protection"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_KMEM
-+	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
-+	help
-+	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
-+	  be written to via mmap or otherwise to modify the running kernel.
-+	  /dev/port will also not be allowed to be opened. If you have module
-+	  support disabled, enabling this will close up four ways that are
-+	  currently used  to insert malicious code into the running kernel.
-+	  Even with all these features enabled, we still highly recommend that
-+	  you use the RBAC system, as it is still possible for an attacker to
-+	  modify the running kernel through privileged I/O granted by ioperm/iopl.
-+	  If you are not using XFree86, you may be able to stop this additional
-+	  case by enabling the 'Disable privileged I/O' option. Though nothing
-+	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
-+	  but only to video memory, which is the only writing we allow in this
-+	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
-+	  not be allowed to mprotect it with PROT_WRITE later.
-+	  It is highly recommended that you say Y here if you meet all the
-+	  conditions above.
-+
-+config GRKERNSEC_VM86
-+	bool "Restrict VM86 mode"
-+	depends on X86_32
-+
-+	help
-+	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
-+	  make use of a special execution mode on 32bit x86 processors called
-+	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
-+	  video cards and will still work with this option enabled.  The purpose
-+	  of the option is to prevent exploitation of emulation errors in
-+	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
-+	  Nearly all users should be able to enable this option.
-+
-+config GRKERNSEC_IO
-+	bool "Disable privileged I/O"
-+	depends on X86
-+	select RTC_CLASS
-+	select RTC_INTF_DEV
-+	select RTC_DRV_CMOS
-+
-+	help
-+	  If you say Y here, all ioperm and iopl calls will return an error.
-+	  Ioperm and iopl can be used to modify the running kernel.
-+	  Unfortunately, some programs need this access to operate properly,
-+	  the most notable of which are XFree86 and hwclock.  hwclock can be
-+	  remedied by having RTC support in the kernel, so real-time 
-+	  clock support is enabled if this option is enabled, to ensure 
-+	  that hwclock operates correctly.  XFree86 still will not 
-+	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
-+	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
-+	  protect your kernel against modification, use the RBAC system.
-+
-+config GRKERNSEC_PROC_MEMMAP
-+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
-+	default y if (PAX_NOEXEC || PAX_ASLR)
-+	depends on PAX_NOEXEC || PAX_ASLR
-+	help
-+	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
-+	  give no information about the addresses of its mappings if
-+	  PaX features that rely on random addresses are enabled on the task.
-+	  If you use PaX it is greatly recommended that you say Y here as it
-+	  closes up a hole that makes the full ASLR useless for suid
-+	  binaries.
-+
-+config GRKERNSEC_BRUTE
-+	bool "Deter exploit bruteforcing"
-+	help
-+	  If you say Y here, attempts to bruteforce exploits against forking
-+	  daemons such as apache or sshd will be deterred.  When a child of a
-+	  forking daemon is killed by PaX or crashes due to an illegal
-+	  instruction, the parent process will be delayed 30 seconds upon every
-+	  subsequent fork until the administrator is able to assess the
-+	  situation and restart the daemon.  It is recommended that you also
-+	  enable signal logging in the auditing section so that logs are
-+	  generated when a process performs an illegal instruction.
-+
-+config GRKERNSEC_MODHARDEN
-+	bool "Harden module auto-loading"
-+	depends on MODULES
-+	help
-+	  If you say Y here, module auto-loading in response to use of some
-+	  feature implemented by an unloaded module will be restricted to
-+	  root users.  Enabling this option helps defend against attacks 
-+	  by unprivileged users who abuse the auto-loading behavior to 
-+	  cause a vulnerable module to load that is then exploited.
-+
-+	  If this option prevents a legitimate use of auto-loading for a 
-+	  non-root user, the administrator can execute modprobe manually 
-+	  with the exact name of the module mentioned in the alert log.
-+	  Alternatively, the administrator can add the module to the list
-+	  of modules loaded at boot by modifying init scripts.
-+
-+	  Modification of init scripts will most likely be needed on 
-+	  Ubuntu servers with encrypted home directory support enabled,
-+	  as the first non-root user logging in will cause the ecb(aes),
-+	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
-+
-+config GRKERNSEC_HIDESYM
-+	bool "Hide kernel symbols"
-+	help
-+	  If you say Y here, getting information on loaded modules, and
-+	  displaying all kernel symbols through a syscall will be restricted
-+	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
-+	  /proc/kallsyms will be restricted to the root user.  The RBAC
-+	  system can hide that entry even from root.  Note that this option
-+	  is only effective provided the following conditions are met:
-+	  1) The kernel using grsecurity is not precompiled by some distribution
-+	  2) You are using the RBAC system and hiding other files such as your
-+	     kernel image and System.map.  Alternatively, enabling this option
-+	     causes the permissions on /boot, /lib/modules, and the kernel
-+	     source directory to change at compile time to prevent 
-+	     reading by non-root users.
-+	  If the above conditions are met, this option will aid in providing a
-+	  useful protection against local kernel exploitation of overflows
-+	  and arbitrary read/write vulnerabilities.
-+
-+endmenu
-+menu "Role Based Access Control Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_NO_RBAC
-+	bool "Disable RBAC system"
-+	help
-+	  If you say Y here, the /dev/grsec device will be removed from the kernel,
-+	  preventing the RBAC system from being enabled.  You should only say Y
-+	  here if you have no intention of using the RBAC system, so as to prevent
-+	  an attacker with root access from misusing the RBAC system to hide files
-+	  and processes when loadable module support and /dev/[k]mem have been
-+	  locked down.
-+
-+config GRKERNSEC_ACL_HIDEKERN
-+	bool "Hide kernel processes"
-+	help
-+	  If you say Y here, all kernel threads will be hidden to all
-+	  processes but those whose subject has the "view hidden processes"
-+	  flag.
-+
-+config GRKERNSEC_ACL_MAXTRIES
-+	int "Maximum tries before password lockout"
-+	default 3
-+	help
-+	  This option enforces the maximum number of times a user can attempt
-+	  to authorize themselves with the grsecurity RBAC system before being
-+	  denied the ability to attempt authorization again for a specified time.
-+	  The lower the number, the harder it will be to brute-force a password.
-+
-+config GRKERNSEC_ACL_TIMEOUT
-+	int "Time to wait after max password tries, in seconds"
-+	default 30
-+	help
-+	  This option specifies the time the user must wait after attempting to
-+	  authorize to the RBAC system with the maximum number of invalid
-+	  passwords.  The higher the number, the harder it will be to brute-force
-+	  a password.
-+
-+endmenu
-+menu "Filesystem Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_PROC
-+	bool "Proc restrictions"
-+	help
-+	  If you say Y here, the permissions of the /proc filesystem
-+	  will be altered to enhance system security and privacy.  You MUST
-+  	  choose either a user only restriction or a user and group restriction.
-+	  Depending upon the option you choose, you can either restrict users to
-+	  see only the processes they themselves run, or choose a group that can
-+	  view all processes and files normally restricted to root if you choose
-+	  the "restrict to user only" option.  NOTE: If you're running identd as
-+	  a non-root user, you will have to run it as the group you specify here.
-+
-+config GRKERNSEC_PROC_USER
-+	bool "Restrict /proc to user only"
-+	depends on GRKERNSEC_PROC
-+	help
-+	  If you say Y here, non-root users will only be able to view their own
-+	  processes, and restricts them from viewing network-related information,
-+	  and viewing kernel symbol and module information.
-+
-+config GRKERNSEC_PROC_USERGROUP
-+	bool "Allow special group"
-+	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
-+	help
-+	  If you say Y here, you will be able to select a group that will be
-+	  able to view all processes, network-related information, and
-+	  kernel and symbol information.  This option is useful if you want
-+	  to run identd as a non-root user.
-+
-+config GRKERNSEC_PROC_GID
-+	int "GID for special group"
-+	depends on GRKERNSEC_PROC_USERGROUP
-+	default 1001
-+
-+config GRKERNSEC_PROC_ADD
-+	bool "Additional restrictions"
-+	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
-+	help
-+	  If you say Y here, additional restrictions will be placed on
-+	  /proc that keep normal users from viewing device information and 
-+	  slabinfo information that could be useful for exploits.
-+
-+config GRKERNSEC_LINK
-+	bool "Linking restrictions"
-+	help
-+	  If you say Y here, /tmp race exploits will be prevented, since users
-+	  will no longer be able to follow symlinks owned by other users in
-+	  world-writable +t directories (i.e. /tmp), unless the owner of the
-+	  symlink is the owner of the directory. users will also not be
-+	  able to hardlink to files they do not own.  If the sysctl option is
-+	  enabled, a sysctl option with name "linking_restrictions" is created.
-+
-+config GRKERNSEC_FIFO
-+	bool "FIFO restrictions"
-+	help
-+	  If you say Y here, users will not be able to write to FIFOs they don't
-+	  own in world-writable +t directories (i.e. /tmp), unless the owner of
-+	  the FIFO is the same owner of the directory it's held in.  If the sysctl
-+	  option is enabled, a sysctl option with name "fifo_restrictions" is
-+	  created.
-+
-+config GRKERNSEC_ROFS
-+	bool "Runtime read-only mount protection"
-+	help
-+	  If you say Y here, a sysctl option with name "romount_protect" will
-+	  be created.  By setting this option to 1 at runtime, filesystems
-+	  will be protected in the following ways:
-+	  * No new writable mounts will be allowed
-+	  * Existing read-only mounts won't be able to be remounted read/write
-+	  * Write operations will be denied on all block devices
-+	  This option acts independently of grsec_lock: once it is set to 1,
-+	  it cannot be turned off.  Therefore, please be mindful of the resulting
-+	  behavior if this option is enabled in an init script on a read-only
-+	  filesystem.  This feature is mainly intended for secure embedded systems.
-+
-+config GRKERNSEC_CHROOT
-+	bool "Chroot jail restrictions"
-+	help
-+	  If you say Y here, you will be able to choose several options that will
-+	  make breaking out of a chrooted jail much more difficult.  If you
-+	  encounter no software incompatibilities with the following options, it
-+	  is recommended that you enable each one.
-+
-+config GRKERNSEC_CHROOT_MOUNT
-+	bool "Deny mounts"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  mount or remount filesystems.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_deny_mount" is created.
-+
-+config GRKERNSEC_CHROOT_DOUBLE
-+	bool "Deny double-chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chroot
-+	  again outside the chroot.  This is a widely used method of breaking
-+	  out of a chroot jail and should not be allowed.  If the sysctl 
-+	  option is enabled, a sysctl option with name 
-+	  "chroot_deny_chroot" is created.
-+
-+config GRKERNSEC_CHROOT_PIVOT
-+	bool "Deny pivot_root in chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to use
-+	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
-+	  works similar to chroot in that it changes the root filesystem.  This
-+	  function could be misused in a chrooted process to attempt to break out
-+	  of the chroot, and therefore should not be allowed.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_CHDIR
-+	bool "Enforce chdir(\"/\") on all chroots"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the current working directory of all newly-chrooted
-+	  applications will be set to the the root directory of the chroot.
-+	  The man page on chroot(2) states:
-+	  Note that this call does not change  the  current  working
-+	  directory,  so  that `.' can be outside the tree rooted at
-+	  `/'.  In particular, the  super-user  can  escape  from  a
-+	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
-+
-+	  It is recommended that you say Y here, since it's not known to break
-+	  any software.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_enforce_chdir" is created.
-+
-+config GRKERNSEC_CHROOT_CHMOD
-+	bool "Deny (f)chmod +s"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to chmod
-+	  or fchmod files to make them have suid or sgid bits.  This protects
-+	  against another published method of breaking a chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_FCHDIR
-+	bool "Deny fchdir out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
-+	  to a file descriptor of the chrooting process that points to a directory
-+	  outside the filesystem will be stopped.  If the sysctl option
-+	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
-+
-+config GRKERNSEC_CHROOT_MKNOD
-+	bool "Deny mknod"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be allowed to
-+	  mknod.  The problem with using mknod inside a chroot is that it
-+	  would allow an attacker to create a device entry that is the same
-+	  as one on the physical root of your system, which could range from
-+	  anything from the console device to a device for your harddrive (which
-+	  they could then use to wipe the drive or steal data).  It is recommended
-+	  that you say Y here, unless you run into software incompatibilities.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_mknod" is created.
-+
-+config GRKERNSEC_CHROOT_SHMAT
-+	bool "Deny shmat() out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to attach
-+	  to shared memory segments that were created outside of the chroot jail.
-+	  It is recommended that you say Y here.  If the sysctl option is enabled,
-+	  a sysctl option with name "chroot_deny_shmat" is created.
-+
-+config GRKERNSEC_CHROOT_UNIX
-+	bool "Deny access to abstract AF_UNIX sockets out of chroot"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  connect to abstract (meaning not belonging to a filesystem) Unix
-+	  domain sockets that were bound outside of a chroot.  It is recommended
-+	  that you say Y here.  If the sysctl option is enabled, a sysctl option
-+	  with name "chroot_deny_unix" is created.
-+
-+config GRKERNSEC_CHROOT_FINDTASK
-+	bool "Protect outside processes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to
-+	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
-+	  getsid, or view any process outside of the chroot.  If the sysctl
-+	  option is enabled, a sysctl option with name "chroot_findtask" is
-+	  created.
-+
-+config GRKERNSEC_CHROOT_NICE
-+	bool "Restrict priority changes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, processes inside a chroot will not be able to raise
-+	  the priority of processes in the chroot, or alter the priority of
-+	  processes outside the chroot.  This provides more security than simply
-+	  removing CAP_SYS_NICE from the process' capability set.  If the
-+	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
-+	  is created.
-+
-+config GRKERNSEC_CHROOT_SYSCTL
-+	bool "Deny sysctl writes"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, an attacker in a chroot will not be able to
-+	  write to sysctl entries, either by sysctl(2) or through a /proc
-+	  interface.  It is strongly recommended that you say Y here. If the
-+	  sysctl option is enabled, a sysctl option with name
-+	  "chroot_deny_sysctl" is created.
-+
-+config GRKERNSEC_CHROOT_CAPS
-+	bool "Capability restrictions"
-+	depends on GRKERNSEC_CHROOT
-+	help
-+	  If you say Y here, the capabilities on all root processes within a
-+	  chroot jail will be lowered to stop module insertion, raw i/o,
-+	  system and net admin tasks, rebooting the system, modifying immutable
-+	  files, modifying IPC owned by another, and changing the system time.
-+	  This is left an option because it can break some apps.  Disable this
-+	  if your chrooted apps are having problems performing those kinds of
-+	  tasks.  If the sysctl option is enabled, a sysctl option with
-+	  name "chroot_caps" is created.
-+
-+endmenu
-+menu "Kernel Auditing"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_AUDIT_GROUP
-+	bool "Single group for auditing"
-+	help
-+	  If you say Y here, the exec, chdir, and (un)mount logging features
-+	  will only operate on a group you specify.  This option is recommended
-+	  if you only want to watch certain users instead of having a large
-+	  amount of logs from the entire system.  If the sysctl option is enabled,
-+	  a sysctl option with name "audit_group" is created.
-+
-+config GRKERNSEC_AUDIT_GID
-+	int "GID for auditing"
-+	depends on GRKERNSEC_AUDIT_GROUP
-+	default 1007
-+
-+config GRKERNSEC_EXECLOG
-+	bool "Exec logging"
-+	help
-+	  If you say Y here, all execve() calls will be logged (since the
-+	  other exec*() calls are frontends to execve(), all execution
-+	  will be logged).  Useful for shell-servers that like to keep track
-+	  of their users.  If the sysctl option is enabled, a sysctl option with
-+	  name "exec_logging" is created.
-+	  WARNING: This option when enabled will produce a LOT of logs, especially
-+	  on an active system.
-+
-+config GRKERNSEC_RESLOG
-+	bool "Resource logging"
-+	help
-+	  If you say Y here, all attempts to overstep resource limits will
-+	  be logged with the resource name, the requested size, and the current
-+	  limit.  It is highly recommended that you say Y here.  If the sysctl
-+	  option is enabled, a sysctl option with name "resource_logging" is
-+	  created.  If the RBAC system is enabled, the sysctl value is ignored.
-+
-+config GRKERNSEC_CHROOT_EXECLOG
-+	bool "Log execs within chroot"
-+	help
-+	  If you say Y here, all executions inside a chroot jail will be logged
-+	  to syslog.  This can cause a large amount of logs if certain
-+	  applications (eg. djb's daemontools) are installed on the system, and
-+	  is therefore left as an option.  If the sysctl option is enabled, a
-+	  sysctl option with name "chroot_execlog" is created.
-+
-+config GRKERNSEC_AUDIT_PTRACE
-+	bool "Ptrace logging"
-+	help
-+	  If you say Y here, all attempts to attach to a process via ptrace
-+	  will be logged.  If the sysctl option is enabled, a sysctl option
-+	  with name "audit_ptrace" is created.
-+
-+config GRKERNSEC_AUDIT_CHDIR
-+	bool "Chdir logging"
-+	help
-+	  If you say Y here, all chdir() calls will be logged.  If the sysctl
-+ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
-+
-+config GRKERNSEC_AUDIT_MOUNT
-+	bool "(Un)Mount logging"
-+	help
-+	  If you say Y here, all mounts and unmounts will be logged.  If the
-+	  sysctl option is enabled, a sysctl option with name "audit_mount" is
-+	  created.
-+
-+config GRKERNSEC_SIGNAL
-+	bool "Signal logging"
-+	help
-+	  If you say Y here, certain important signals will be logged, such as
-+	  SIGSEGV, which will as a result inform you of when a error in a program
-+	  occurred, which in some cases could mean a possible exploit attempt.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "signal_logging" is created.
-+
-+config GRKERNSEC_FORKFAIL
-+	bool "Fork failure logging"
-+	help
-+	  If you say Y here, all failed fork() attempts will be logged.
-+	  This could suggest a fork bomb, or someone attempting to overstep
-+	  their process limit.  If the sysctl option is enabled, a sysctl option
-+	  with name "forkfail_logging" is created.
-+
-+config GRKERNSEC_TIME
-+	bool "Time change logging"
-+	help
-+	  If you say Y here, any changes of the system clock will be logged.
-+	  If the sysctl option is enabled, a sysctl option with name
-+	  "timechange_logging" is created.
-+
-+config GRKERNSEC_PROC_IPADDR
-+	bool "/proc/<pid>/ipaddr support"
-+	help
-+	  If you say Y here, a new entry will be added to each /proc/<pid>
-+	  directory that contains the IP address of the person using the task.
-+	  The IP is carried across local TCP and AF_UNIX stream sockets.
-+	  This information can be useful for IDS/IPSes to perform remote response
-+	  to a local attack.  The entry is readable by only the owner of the
-+	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
-+	  the RBAC system), and thus does not create privacy concerns.
-+
-+config GRKERNSEC_AUDIT_TEXTREL
-+	bool 'ELF text relocations logging (READ HELP)'
-+	depends on PAX_MPROTECT
-+	help
-+	  If you say Y here, text relocations will be logged with the filename
-+	  of the offending library or binary.  The purpose of the feature is
-+	  to help Linux distribution developers get rid of libraries and
-+	  binaries that need text relocations which hinder the future progress
-+	  of PaX.  Only Linux distribution developers should say Y here, and
-+	  never on a production machine, as this option creates an information
-+	  leak that could aid an attacker in defeating the randomization of
-+	  a single memory region.  If the sysctl option is enabled, a sysctl
-+	  option with name "audit_textrel" is created.
-+
-+endmenu
-+
-+menu "Executable Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_EXECVE
-+	bool "Enforce RLIMIT_NPROC on execs"
-+	help
-+	  If you say Y here, users with a resource limit on processes will
-+	  have the value checked during execve() calls.  The current system
-+	  only checks the system limit during fork() calls.  If the sysctl option
-+	  is enabled, a sysctl option with name "execve_limiting" is created.
-+
-+config GRKERNSEC_DMESG
-+	bool "Dmesg(8) restriction"
-+	help
-+	  If you say Y here, non-root users will not be able to use dmesg(8)
-+	  to view up to the last 4kb of messages in the kernel's log buffer.
-+	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
-+	  created.
-+
-+config GRKERNSEC_HARDEN_PTRACE
-+	bool "Deter ptrace-based process snooping"
-+	help
-+	  If you say Y here, TTY sniffers and other malicious monitoring
-+	  programs implemented through ptrace will be defeated.  If you
-+	  have been using the RBAC system, this option has already been
-+	  enabled for several years for all users, with the ability to make
-+	  fine-grained exceptions.
-+
-+	  This option only affects the ability of non-root users to ptrace
-+	  processes that are not a descendent of the ptracing process.
-+	  This means that strace ./binary and gdb ./binary will still work,
-+	  but attaching to arbitrary processes will not.  If the sysctl
-+	  option is enabled, a sysctl option with name "harden_ptrace" is
-+	  created.
-+
-+config GRKERNSEC_TPE
-+	bool "Trusted Path Execution (TPE)"
-+	help
-+	  If you say Y here, you will be able to choose a gid to add to the
-+	  supplementary groups of users you want to mark as "untrusted."
-+	  These users will not be able to execute any files that are not in
-+	  root-owned directories writable only by root.  If the sysctl option
-+	  is enabled, a sysctl option with name "tpe" is created.
-+
-+config GRKERNSEC_TPE_ALL
-+	bool "Partially restrict non-root users"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, All non-root users other than the ones in the
-+	  group specified in the main TPE option will only be allowed to
-+	  execute files in directories they own that are not group or
-+	  world-writable, or in directories owned by root and writable only by
-+	  root.  If the sysctl option is enabled, a sysctl option with name
-+	  "tpe_restrict_all" is created.
-+
-+config GRKERNSEC_TPE_INVERT
-+	bool "Invert GID option"
-+	depends on GRKERNSEC_TPE
-+	help
-+	  If you say Y here, the group you specify in the TPE configuration will
-+	  decide what group TPE restrictions will be *disabled* for.  This
-+	  option is useful if you want TPE restrictions to be applied to most
-+	  users on the system.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for untrusted users"
-+	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+config GRKERNSEC_TPE_GID
-+	int "GID for trusted users"
-+	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
-+	default 1005
-+	help
-+	  If you have selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *disabled* for.
-+	  If you have not selected the "Invert GID option" above, setting this
-+	  GID determines what group TPE restrictions will be *enabled* for.
-+	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
-+	  is created.
-+
-+endmenu
-+menu "Network Protections"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_RANDNET
-+	bool "Larger entropy pools"
-+	help
-+	  If you say Y here, the entropy pools used for many features of Linux
-+	  and grsecurity will be doubled in size.  Since several grsecurity
-+	  features use additional randomness, it is recommended that you say Y
-+	  here.  Saying Y here has a similar effect as modifying
-+	  /proc/sys/kernel/random/poolsize.
-+
-+config GRKERNSEC_BLACKHOLE
-+	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
-+	help
-+	  If you say Y here, neither TCP resets nor ICMP
-+	  destination-unreachable packets will be sent in response to packets
-+	  send to ports for which no associated listening process exists.
-+	  This feature supports both IPV4 and IPV6 and exempts the 
-+	  loopback interface from blackholing.  Enabling this feature 
-+	  makes a host more resilient to DoS attacks and reduces network
-+	  visibility against scanners.
-+
-+	  The blackhole feature as-implemented is equivalent to the FreeBSD
-+	  blackhole feature, as prevents RST responses to all packets, not
-+	  just SYNs.  Under most application behavior this causes no
-+	  problems, but applications (like haproxy) may not close certain
-+	  connections in a way that cleanly terminates them on the remote
-+	  end, leaving the remote host in LAST_ACK state.  Because of this
-+	  side-effect and to prevent intentional LAST_ACK DoSes, this
-+	  feature also adds automatic mitigation against such attacks.
-+	  The mitigation drastically reduces the amount of time a socket
-+	  can spend in LAST_ACK state.  If you're using haproxy and not
-+	  all servers it connects to have this option enabled, consider
-+	  disabling this feature on the haproxy host.
-+
-+	  If this option is enabled, two sysctl options with names
-+	  "ip_blackhole" and "lastack_retries" will be created.
-+	  While "ip_blackhole" takes the standard zero/non-zero on/off
-+	  toggle, "lastack_retries" uses the same kinds of values as
-+	  "tcp_retries1" and "tcp_retries2".  The default value of 4
-+	  prevents a socket from lasting more than 45 seconds in LAST_ACK
-+	  state.
-+
-+config GRKERNSEC_SOCKET
-+	bool "Socket restrictions"
-+	help
-+	  If you say Y here, you will be able to choose from several options.
-+	  If you assign a GID on your system and add it to the supplementary
-+	  groups of users you want to restrict socket access to, this patch
-+	  will perform up to three things, based on the option(s) you choose.
-+
-+config GRKERNSEC_SOCKET_ALL
-+	bool "Deny any sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine or run server
-+	  applications from your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_all" is created.
-+
-+config GRKERNSEC_SOCKET_ALL_GID
-+	int "GID to deny all sockets for"
-+	depends on GRKERNSEC_SOCKET_ALL
-+	default 1004
-+	help
-+	  Here you can choose the GID to disable socket access for. Remember to
-+	  add the users you want socket access disabled for to the GID
-+	  specified here.  If the sysctl option is enabled, a sysctl option
-+	  with name "socket_all_gid" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT
-+	bool "Deny client sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to connect to other hosts from your machine, but will be
-+	  able to run servers.  If this option is enabled, all users in the group
-+	  you specify will have to use passive mode when initiating ftp transfers
-+	  from the shell on your machine.  If the sysctl option is enabled, a
-+	  sysctl option with name "socket_client" is created.
-+
-+config GRKERNSEC_SOCKET_CLIENT_GID
-+	int "GID to deny client sockets for"
-+	depends on GRKERNSEC_SOCKET_CLIENT
-+	default 1003
-+	help
-+	  Here you can choose the GID to disable client socket access for.
-+	  Remember to add the users you want client socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_client_gid" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER
-+	bool "Deny server sockets to group"
-+	depends on GRKERNSEC_SOCKET
-+	help
-+	  If you say Y here, you will be able to choose a GID of whose users will
-+	  be unable to run server applications from your machine.  If the sysctl
-+	  option is enabled, a sysctl option with name "socket_server" is created.
-+
-+config GRKERNSEC_SOCKET_SERVER_GID
-+	int "GID to deny server sockets for"
-+	depends on GRKERNSEC_SOCKET_SERVER
-+	default 1002
-+	help
-+	  Here you can choose the GID to disable server socket access for.
-+	  Remember to add the users you want server socket access disabled for to
-+	  the GID specified here.  If the sysctl option is enabled, a sysctl
-+	  option with name "socket_server_gid" is created.
-+
-+endmenu
-+menu "Sysctl support"
-+depends on GRKERNSEC && SYSCTL
-+
-+config GRKERNSEC_SYSCTL
-+	bool "Sysctl support"
-+	help
-+	  If you say Y here, you will be able to change the options that
-+	  grsecurity runs with at bootup, without having to recompile your
-+	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
-+	  to enable (1) or disable (0) various features.  All the sysctl entries
-+	  are mutable until the "grsec_lock" entry is set to a non-zero value.
-+	  All features enabled in the kernel configuration are disabled at boot
-+	  if you do not say Y to the "Turn on features by default" option.
-+	  All options should be set at startup, and the grsec_lock entry should
-+	  be set to a non-zero value after all the options are set.
-+	  *THIS IS EXTREMELY IMPORTANT*
-+
-+config GRKERNSEC_SYSCTL_ON
-+	bool "Turn on features by default"
-+	depends on GRKERNSEC_SYSCTL
-+	help
-+	  If you say Y here, instead of having all features enabled in the
-+	  kernel configuration disabled at boot time, the features will be
-+	  enabled at boot time.  It is recommended you say Y here unless
-+	  there is some reason you would want all sysctl-tunable features to
-+	  be disabled by default.  As mentioned elsewhere, it is important
-+	  to enable the grsec_lock entry once you have finished modifying
-+	  the sysctl entries.
-+
-+endmenu
-+menu "Logging Options"
-+depends on GRKERNSEC
-+
-+config GRKERNSEC_FLOODTIME
-+	int "Seconds in between log messages (minimum)"
-+	default 10
-+	help
-+	  This option allows you to enforce the number of seconds between
-+	  grsecurity log messages.  The default should be suitable for most
-+	  people, however, if you choose to change it, choose a value small enough
-+	  to allow informative logs to be produced, but large enough to
-+	  prevent flooding.
-+
-+config GRKERNSEC_FLOODBURST
-+	int "Number of messages in a burst (maximum)"
-+	default 4
-+	help
-+	  This option allows you to choose the maximum number of messages allowed
-+	  within the flood time interval you chose in a separate option.  The
-+	  default should be suitable for most people, however if you find that
-+	  many of your logs are being interpreted as flooding, you may want to
-+	  raise this value.
-+
-+endmenu
-+
-+endmenu
-diff -urNp linux-2.6.32.13/grsecurity/Makefile linux-2.6.32.13/grsecurity/Makefile
---- linux-2.6.32.13/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/grsecurity/Makefile	2010-05-15 13:21:17.910594530 -0400
-@@ -0,0 +1,29 @@
-+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
-+# during 2001-2009 it has been completely redesigned by Brad Spengler
-+# into an RBAC system
-+#
-+# All code in this directory and various hooks inserted throughout the kernel
-+# are copyright Brad Spengler - Open Source Security, Inc., and released 
-+# under the GPL v2 or higher
-+
-+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
-+	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
-+	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
-+
-+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
-+	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
-+	gracl_learn.o grsec_log.o
-+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
-+
-+ifndef CONFIG_GRKERNSEC
-+obj-y += grsec_disabled.o
-+endif
-+
-+ifdef CONFIG_GRKERNSEC_HIDESYM
-+extra-y := grsec_hidesym.o
-+$(obj)/grsec_hidesym.o:
-+	@-chmod -f 500 /boot
-+	@-chmod -f 500 /lib/modules
-+	@-chmod -f 700 .
-+	@echo '  grsec: protected kernel image paths'
-+endif
-diff -urNp linux-2.6.32.13/include/acpi/acoutput.h linux-2.6.32.13/include/acpi/acoutput.h
---- linux-2.6.32.13/include/acpi/acoutput.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/acpi/acoutput.h	2010-05-15 13:21:17.910594530 -0400
-@@ -264,8 +264,8 @@
-  * leaving no executable debug code!
-  */
- #define ACPI_FUNCTION_NAME(a)
--#define ACPI_DEBUG_PRINT(pl)
--#define ACPI_DEBUG_PRINT_RAW(pl)
-+#define ACPI_DEBUG_PRINT(pl) do {} while (0)
-+#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
- 
- #endif				/* ACPI_DEBUG_OUTPUT */
- 
-diff -urNp linux-2.6.32.13/include/acpi/acpi_drivers.h linux-2.6.32.13/include/acpi/acpi_drivers.h
---- linux-2.6.32.13/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/acpi/acpi_drivers.h	2010-05-15 13:21:17.910594530 -0400
-@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
-                                   Dock Station
-   -------------------------------------------------------------------------- */
- struct acpi_dock_ops {
--	acpi_notify_handler handler;
--	acpi_notify_handler uevent;
-+	const acpi_notify_handler handler;
-+	const acpi_notify_handler uevent;
- };
- 
- #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
-@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
- extern int register_dock_notifier(struct notifier_block *nb);
- extern void unregister_dock_notifier(struct notifier_block *nb);
- extern int register_hotplug_dock_device(acpi_handle handle,
--					struct acpi_dock_ops *ops,
-+					const struct acpi_dock_ops *ops,
- 					void *context);
- extern void unregister_hotplug_dock_device(acpi_handle handle);
- #else
-@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
- {
- }
- static inline int register_hotplug_dock_device(acpi_handle handle,
--					       struct acpi_dock_ops *ops,
-+					       const struct acpi_dock_ops *ops,
- 					       void *context)
- {
- 	return -ENODEV;
-diff -urNp linux-2.6.32.13/include/asm-generic/atomic-long.h linux-2.6.32.13/include/asm-generic/atomic-long.h
---- linux-2.6.32.13/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/atomic-long.h	2010-05-15 13:21:17.910594530 -0400
-@@ -22,6 +22,12 @@
- 
- typedef atomic64_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic64_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic64_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
- 
- static inline long atomic_long_read(atomic_long_t *l)
-@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic64_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
- 	atomic64_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
- 	atomic64_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
- 	atomic64_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	atomic64_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic64_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
-+
-+	return (long)atomic64_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic64_t *v = (atomic64_t *)l;
-@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
- 
- typedef atomic_t atomic_long_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef atomic_unchecked_t atomic_long_unchecked_t;
-+#else
-+typedef atomic_t atomic_long_unchecked_t;
-+#endif
-+
- #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
- static inline long atomic_long_read(atomic_long_t *l)
- {
-@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
- 	return (long)atomic_read(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_read_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_set(atomic_long_t *l, long i)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
- 	atomic_set(v, i);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_set_unchecked(v, i);
-+}
-+#endif
-+
- static inline void atomic_long_inc(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
- 	atomic_inc(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_inc_unchecked(v);
-+}
-+#endif
-+
- static inline void atomic_long_dec(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
- 	atomic_add(i, v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	atomic_add_unchecked(i, v);
-+}
-+#endif
-+
- static inline void atomic_long_sub(long i, atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
- 	return (long)atomic_inc_return(v);
- }
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
-+{
-+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
-+
-+	return (long)atomic_inc_return_unchecked(v);
-+}
-+#endif
-+
- static inline long atomic_long_dec_return(atomic_long_t *l)
- {
- 	atomic_t *v = (atomic_t *)l;
-@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
- 
- #endif  /*  BITS_PER_LONG == 64  */
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+static inline void pax_refcount_needs_these_functions(void)
-+{
-+	atomic_read_unchecked((atomic_unchecked_t *)NULL);
-+	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
-+	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
-+	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
-+
-+	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
-+	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
-+	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
-+}
-+#else
-+#define atomic_read_unchecked(v) atomic_read(v)
-+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
-+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
-+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
-+#define atomic_inc_unchecked(v) atomic_inc(v)
-+
-+#define atomic_long_read_unchecked(v) atomic_long_read(v)
-+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
-+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
-+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
-+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
-+#endif
-+
- #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
-diff -urNp linux-2.6.32.13/include/asm-generic/dma-mapping-common.h linux-2.6.32.13/include/asm-generic/dma-mapping-common.h
---- linux-2.6.32.13/include/asm-generic/dma-mapping-common.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/dma-mapping-common.h	2010-05-15 13:21:17.910594530 -0400
-@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
- 					      enum dma_data_direction dir,
- 					      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(ptr, size);
-@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
- 					  enum dma_data_direction dir,
- 					  struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
- 				   int nents, enum dma_data_direction dir,
- 				   struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	int i, ents;
- 	struct scatterlist *s;
- 
-@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
- 				      int nents, enum dma_data_direction dir,
- 				      struct dma_attrs *attrs)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	debug_dma_unmap_sg(dev, sg, nents, dir);
-@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
- 				      size_t offset, size_t size,
- 				      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 	dma_addr_t addr;
- 
- 	kmemcheck_mark_initialized(page_address(page) + offset, size);
-@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
- static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
- 				  size_t size, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->unmap_page)
-@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
- 					   size_t size,
- 					   enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_cpu)
-@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
- 					      dma_addr_t addr, size_t size,
- 					      enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_for_device)
-@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
- 						 size_t size,
- 						 enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_cpu) {
-@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
- 						    size_t size,
- 						    enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_single_range_for_device) {
-@@ -155,7 +155,7 @@ static inline void
- dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
- 		    int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_cpu)
-@@ -167,7 +167,7 @@ static inline void
- dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
- 		       int nelems, enum dma_data_direction dir)
- {
--	struct dma_map_ops *ops = get_dma_ops(dev);
-+	const struct dma_map_ops *ops = get_dma_ops(dev);
- 
- 	BUG_ON(!valid_dma_direction(dir));
- 	if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.32.13/include/asm-generic/futex.h linux-2.6.32.13/include/asm-generic/futex.h
---- linux-2.6.32.13/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/futex.h	2010-05-15 13:21:17.910594530 -0400
-@@ -6,7 +6,7 @@
- #include <asm/errno.h>
- 
- static inline int
--futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
-+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
- {
- 	int op = (encoded_op >> 28) & 7;
- 	int cmp = (encoded_op >> 24) & 15;
-@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
- }
- 
- static inline int
--futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
-+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
- {
- 	return -ENOSYS;
- }
-diff -urNp linux-2.6.32.13/include/asm-generic/int-l64.h linux-2.6.32.13/include/asm-generic/int-l64.h
---- linux-2.6.32.13/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/int-l64.h	2010-05-15 13:21:17.910594530 -0400
-@@ -46,6 +46,8 @@ typedef unsigned int u32;
- typedef signed long s64;
- typedef unsigned long u64;
- 
-+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.13/include/asm-generic/int-ll64.h linux-2.6.32.13/include/asm-generic/int-ll64.h
---- linux-2.6.32.13/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/int-ll64.h	2010-05-15 13:21:17.910594530 -0400
-@@ -51,6 +51,8 @@ typedef unsigned int u32;
- typedef signed long long s64;
- typedef unsigned long long u64;
- 
-+typedef unsigned long long intoverflow_t;
-+
- #define S8_C(x)  x
- #define U8_C(x)  x ## U
- #define S16_C(x) x
-diff -urNp linux-2.6.32.13/include/asm-generic/kmap_types.h linux-2.6.32.13/include/asm-generic/kmap_types.h
---- linux-2.6.32.13/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/kmap_types.h	2010-05-15 13:21:17.910594530 -0400
-@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
- KMAP_D(16)	KM_IRQ_PTE,
- KMAP_D(17)	KM_NMI,
- KMAP_D(18)	KM_NMI_PTE,
--KMAP_D(19)	KM_TYPE_NR
-+KMAP_D(19)	KM_CLEARPAGE,
-+KMAP_D(20)	KM_TYPE_NR
- };
- 
- #undef KMAP_D
-diff -urNp linux-2.6.32.13/include/asm-generic/pgtable.h linux-2.6.32.13/include/asm-generic/pgtable.h
---- linux-2.6.32.13/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/pgtable.h	2010-05-15 13:21:17.910594530 -0400
-@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
- 				unsigned long size);
- #endif
- 
-+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
-+static inline unsigned long pax_open_kernel(void) { return 0; }
-+#endif
-+
-+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
-+static inline unsigned long pax_close_kernel(void) { return 0; }
-+#endif
-+
- #endif /* !__ASSEMBLY__ */
- 
- #endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.32.13/include/asm-generic/vmlinux.lds.h linux-2.6.32.13/include/asm-generic/vmlinux.lds.h
---- linux-2.6.32.13/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/asm-generic/vmlinux.lds.h	2010-05-15 13:21:17.910594530 -0400
-@@ -199,6 +199,7 @@
- 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
- 		VMLINUX_SYMBOL(__start_rodata) = .;			\
- 		*(.rodata) *(.rodata.*)					\
-+		*(.data.read_only)					\
- 		*(__vermagic)		/* Kernel version magic */	\
- 		*(__markers_strings)	/* Markers: strings */		\
- 		*(__tracepoints_strings)/* Tracepoints: strings */	\
-@@ -656,22 +657,24 @@
-  * section in the linker script will go there too.  @phdr should have
-  * a leading colon.
-  *
-- * Note that this macros defines __per_cpu_load as an absolute symbol.
-+ * Note that this macros defines per_cpu_load as an absolute symbol.
-  * If there is no need to put the percpu section at a predetermined
-  * address, use PERCPU().
-  */
- #define PERCPU_VADDR(vaddr, phdr)					\
--	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
--	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
-+	per_cpu_load = .;						\
-+	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
- 				- LOAD_OFFSET) {			\
-+		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
- 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
- 		*(.data.percpu.first)					\
--		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu)						\
-+		. = ALIGN(PAGE_SIZE);					\
-+		*(.data.percpu.page_aligned)				\
- 		*(.data.percpu.shared_aligned)				\
- 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
- 	} phdr								\
--	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
-+	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
- 
- /**
-  * PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.32.13/include/drm/drm_pciids.h linux-2.6.32.13/include/drm/drm_pciids.h
---- linux-2.6.32.13/include/drm/drm_pciids.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.13/include/drm/drm_pciids.h	2010-05-15 13:21:17.910594530 -0400
-@@ -377,7 +377,7 @@
- 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define r128_PCI_IDS \
- 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -417,14 +417,14 @@
- 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mga_PCI_IDS \
- 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
- 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mach64_PCI_IDS \
- 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -447,7 +447,7 @@
- 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define sisdrv_PCI_IDS \
- 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -458,7 +458,7 @@
- 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
- 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define tdfx_PCI_IDS \
- 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -467,7 +467,7 @@
- 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define viadrv_PCI_IDS \
- 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -479,14 +479,14 @@
- 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
- 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i810_PCI_IDS \
- 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i830_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -494,11 +494,11 @@
- 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define gamma_PCI_IDS \
- 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define savage_PCI_IDS \
- 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-@@ -524,10 +524,10 @@
- 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
- 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
- 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define ffb_PCI_IDS \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i915_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
-@@ -560,4 +560,4 @@
- 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
-diff -urNp linux-2.6.32.13/include/drm/drmP.h linux-2.6.32.13/include/drm/drmP.h
---- linux-2.6.32.13/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/drm/drmP.h	2010-05-15 13:21:17.910594530 -0400
-@@ -814,7 +814,7 @@ struct drm_driver {
- 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
- 
- 	/* Driver private ops for this object */
--	struct vm_operations_struct *gem_vm_ops;
-+	const struct vm_operations_struct *gem_vm_ops;
- 
- 	int major;
- 	int minor;
-@@ -917,7 +917,7 @@ struct drm_device {
- 
- 	/** \name Usage Counters */
- 	/*@{ */
--	int open_count;			/**< Outstanding files open */
-+	atomic_t open_count;		/**< Outstanding files open */
- 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
- 	atomic_t vma_count;		/**< Outstanding vma areas open */
- 	int buf_use;			/**< Buffers in use -- cannot alloc */
-@@ -928,7 +928,7 @@ struct drm_device {
- 	/*@{ */
- 	unsigned long counters;
- 	enum drm_stat_type types[15];
--	atomic_t counts[15];
-+	atomic_unchecked_t counts[15];
- 	/*@} */
- 
- 	struct list_head filelist;
-diff -urNp linux-2.6.32.13/include/linux/a.out.h linux-2.6.32.13/include/linux/a.out.h
---- linux-2.6.32.13/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/a.out.h	2010-05-15 13:21:17.914599996 -0400
-@@ -39,6 +39,14 @@ enum machine_type {
-   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
- };
- 
-+/* Constants for the N_FLAGS field */
-+#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
-+#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
-+#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
-+#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
-+/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
-+#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
-+
- #if !defined (N_MAGIC)
- #define N_MAGIC(exec) ((exec).a_info & 0xffff)
- #endif
-diff -urNp linux-2.6.32.13/include/linux/atmdev.h linux-2.6.32.13/include/linux/atmdev.h
---- linux-2.6.32.13/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/atmdev.h	2010-05-15 13:21:17.914599996 -0400
-@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
- #endif
- 
- struct k_atm_aal_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.13/include/linux/backlight.h linux-2.6.32.13/include/linux/backlight.h
---- linux-2.6.32.13/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/backlight.h	2010-05-15 13:21:17.914599996 -0400
-@@ -36,18 +36,18 @@ struct backlight_device;
- struct fb_info;
- 
- struct backlight_ops {
--	unsigned int options;
-+	const unsigned int options;
- 
- #define BL_CORE_SUSPENDRESUME	(1 << 0)
- 
- 	/* Notify the backlight driver some property has changed */
--	int (*update_status)(struct backlight_device *);
-+	int (* const update_status)(struct backlight_device *);
- 	/* Return the current backlight brightness (accounting for power,
- 	   fb_blank etc.) */
--	int (*get_brightness)(struct backlight_device *);
-+	int (* const get_brightness)(struct backlight_device *);
- 	/* Check if given framebuffer device is the one bound to this backlight;
- 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
--	int (*check_fb)(struct fb_info *);
-+	int (* const check_fb)(struct fb_info *);
- };
- 
- /* This structure defines all the properties of a backlight */
-@@ -86,7 +86,7 @@ struct backlight_device {
- 	   registered this device has been unloaded, and if class_get_devdata()
- 	   points to something in the body of that driver, it is also invalid. */
- 	struct mutex ops_lock;
--	struct backlight_ops *ops;
-+	const struct backlight_ops *ops;
- 
- 	/* The framebuffer notifier block */
- 	struct notifier_block fb_notif;
-@@ -103,7 +103,7 @@ static inline void backlight_update_stat
- }
- 
- extern struct backlight_device *backlight_device_register(const char *name,
--	struct device *dev, void *devdata, struct backlight_ops *ops);
-+	struct device *dev, void *devdata, const struct backlight_ops *ops);
- extern void backlight_device_unregister(struct backlight_device *bd);
- extern void backlight_force_update(struct backlight_device *bd,
- 				   enum backlight_update_reason reason);
-diff -urNp linux-2.6.32.13/include/linux/binfmts.h linux-2.6.32.13/include/linux/binfmts.h
---- linux-2.6.32.13/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/binfmts.h	2010-05-15 13:21:17.934614916 -0400
-@@ -78,6 +78,7 @@ struct linux_binfmt {
- 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
- 	int (*load_shlib)(struct file *);
- 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
-+	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
- 	unsigned long min_coredump;	/* minimal dump size */
- 	int hasvdso;
- };
-diff -urNp linux-2.6.32.13/include/linux/blkdev.h linux-2.6.32.13/include/linux/blkdev.h
---- linux-2.6.32.13/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/blkdev.h	2010-05-15 13:21:17.934614916 -0400
-@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
- #endif /* CONFIG_BLK_DEV_INTEGRITY */
- 
- struct block_device_operations {
--	int (*open) (struct block_device *, fmode_t);
--	int (*release) (struct gendisk *, fmode_t);
--	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
--	int (*direct_access) (struct block_device *, sector_t,
-+	int (* const open) (struct block_device *, fmode_t);
-+	int (* const release) (struct gendisk *, fmode_t);
-+	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-+	int (* const direct_access) (struct block_device *, sector_t,
- 						void **, unsigned long *);
--	int (*media_changed) (struct gendisk *);
--	unsigned long long (*set_capacity) (struct gendisk *,
-+	int (* const media_changed) (struct gendisk *);
-+	unsigned long long (* const set_capacity) (struct gendisk *,
- 						unsigned long long);
--	int (*revalidate_disk) (struct gendisk *);
--	int (*getgeo)(struct block_device *, struct hd_geometry *);
--	struct module *owner;
-+	int (* const revalidate_disk) (struct gendisk *);
-+	int (*const getgeo)(struct block_device *, struct hd_geometry *);
-+	struct module * const owner;
- };
- 
- extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.32.13/include/linux/cache.h linux-2.6.32.13/include/linux/cache.h
---- linux-2.6.32.13/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/cache.h	2010-05-15 13:21:17.934614916 -0400
-@@ -16,6 +16,10 @@
- #define __read_mostly
- #endif
- 
-+#ifndef __read_only
-+#define __read_only __read_mostly
-+#endif
-+
- #ifndef ____cacheline_aligned
- #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
- #endif
-diff -urNp linux-2.6.32.13/include/linux/capability.h linux-2.6.32.13/include/linux/capability.h
---- linux-2.6.32.13/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/capability.h	2010-05-15 13:21:17.934614916 -0400
-@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
- 	(security_real_capable_noaudit((t), (cap)) == 0)
- 
- extern int capable(int cap);
-+int capable_nolog(int cap);
- 
- /* audit system wants to get cap info from files as well */
- struct dentry;
-diff -urNp linux-2.6.32.13/include/linux/compiler-gcc4.h linux-2.6.32.13/include/linux/compiler-gcc4.h
---- linux-2.6.32.13/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/compiler-gcc4.h	2010-05-15 13:21:17.934614916 -0400
-@@ -36,4 +36,8 @@
-    the kernel context */
- #define __cold			__attribute__((__cold__))
- 
-+#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
-+#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
-+#define __bos0(ptr)		__bos((ptr), 0)
-+#define __bos1(ptr)		__bos((ptr), 1)
- #endif
-diff -urNp linux-2.6.32.13/include/linux/compiler.h linux-2.6.32.13/include/linux/compiler.h
---- linux-2.6.32.13/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/compiler.h	2010-05-15 13:21:17.934614916 -0400
-@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
- #define __cold
- #endif
- 
-+#ifndef __alloc_size
-+#define __alloc_size
-+#endif
-+
-+#ifndef __bos
-+#define __bos
-+#endif
-+
-+#ifndef __bos0
-+#define __bos0
-+#endif
-+
-+#ifndef __bos1
-+#define __bos1
-+#endif
-+
- /* Simple shorthand for a section definition */
- #ifndef __section
- # define __section(S) __attribute__ ((__section__(#S)))
-diff -urNp linux-2.6.32.13/include/linux/decompress/mm.h linux-2.6.32.13/include/linux/decompress/mm.h
---- linux-2.6.32.13/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
-+++ linux-2.6.32.13/include/linux/decompress/mm.h	2010-05-15 13:21:17.938584561 -0400
-@@ -78,7 +78,7 @@ static void free(void *where)
-  * warnings when not needed (indeed large_malloc / large_free are not
-  * needed by inflate */
- 
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- 
- #define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.32.13/include/linux/dma-mapping.h linux-2.6.32.13/include/linux/dma-mapping.h
---- linux-2.6.32.13/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/dma-mapping.h	2010-05-15 13:21:17.938584561 -0400
-@@ -16,50 +16,50 @@ enum dma_data_direction {
- };
- 
- struct dma_map_ops {
--	void* (*alloc_coherent)(struct device *dev, size_t size,
-+	void* (* const alloc_coherent)(struct device *dev, size_t size,
- 				dma_addr_t *dma_handle, gfp_t gfp);
--	void (*free_coherent)(struct device *dev, size_t size,
-+	void (* const free_coherent)(struct device *dev, size_t size,
- 			      void *vaddr, dma_addr_t dma_handle);
--	dma_addr_t (*map_page)(struct device *dev, struct page *page,
-+	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
- 			       unsigned long offset, size_t size,
- 			       enum dma_data_direction dir,
- 			       struct dma_attrs *attrs);
--	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
-+	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
- 			   size_t size, enum dma_data_direction dir,
- 			   struct dma_attrs *attrs);
--	int (*map_sg)(struct device *dev, struct scatterlist *sg,
-+	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
- 		      int nents, enum dma_data_direction dir,
- 		      struct dma_attrs *attrs);
--	void (*unmap_sg)(struct device *dev,
-+	void (* const unmap_sg)(struct device *dev,
- 			 struct scatterlist *sg, int nents,
- 			 enum dma_data_direction dir,
- 			 struct dma_attrs *attrs);
--	void (*sync_single_for_cpu)(struct device *dev,
-+	void (* const sync_single_for_cpu)(struct device *dev,
- 				    dma_addr_t dma_handle, size_t size,
- 				    enum dma_data_direction dir);
--	void (*sync_single_for_device)(struct device *dev,
-+	void (* const sync_single_for_device)(struct device *dev,
- 				       dma_addr_t dma_handle, size_t size,
- 				       enum dma_data_direction dir);
--	void (*sync_single_range_for_cpu)(struct device *dev,
-+	void (* const sync_single_range_for_cpu)(struct device *dev,
- 					  dma_addr_t dma_handle,
- 					  unsigned long offset,
- 					  size_t size,
- 					  enum dma_data_direction dir);
--	void (*sync_single_range_for_device)(struct device *dev,
-+	void (* const sync_single_range_for_device)(struct device *dev,
- 					     dma_addr_t dma_handle,
- 					     unsigned long offset,
- 					     size_t size,
- 					     enum dma_data_direction dir);
--	void (*sync_sg_for_cpu)(struct device *dev,
-+	void (* const sync_sg_for_cpu)(struct device *dev,
- 				struct scatterlist *sg, int nents,
- 				enum dma_data_direction dir);
--	void (*sync_sg_for_device)(struct device *dev,
-+	void (* const sync_sg_for_device)(struct device *dev,
- 				   struct scatterlist *sg, int nents,
- 				   enum dma_data_direction dir);
--	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
--	int (*dma_supported)(struct device *dev, u64 mask);
-+	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
-+	int (* const dma_supported)(struct device *dev, u64 mask);
- 	int (*set_dma_mask)(struct device *dev, u64 mask);
--	int is_phys;
-+	const int is_phys;
- };
- 
- #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.32.13/include/linux/dst.h linux-2.6.32.13/include/linux/dst.h
---- linux-2.6.32.13/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/dst.h	2010-05-15 13:21:17.938584561 -0400
-@@ -380,7 +380,7 @@ struct dst_node
- 	struct thread_pool	*pool;
- 
- 	/* Transaction IDs live here */
--	atomic_long_t		gen;
-+	atomic_long_unchecked_t	gen;
- 
- 	/*
- 	 * How frequently and how many times transaction
-diff -urNp linux-2.6.32.13/include/linux/elf.h linux-2.6.32.13/include/linux/elf.h
---- linux-2.6.32.13/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/elf.h	2010-05-15 13:21:17.938584561 -0400
-@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
- #define PT_GNU_EH_FRAME		0x6474e550
- 
- #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
-+#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
-+
-+#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
-+
-+/* Constants for the e_flags field */
-+#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
-+#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
-+#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
-+#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
-+/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
-+#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
- 
- /* These constants define the different elf file types */
- #define ET_NONE   0
-@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
- #define DT_DEBUG	21
- #define DT_TEXTREL	22
- #define DT_JMPREL	23
-+#define DT_FLAGS	30
-+  #define DF_TEXTREL  0x00000004
- #define DT_ENCODING	32
- #define OLD_DT_LOOS	0x60000000
- #define DT_LOOS		0x6000000d
-@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
- #define PF_W		0x2
- #define PF_X		0x1
- 
-+#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
-+#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
-+#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
-+#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
-+#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
-+#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
-+/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
-+/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
-+#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
-+#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
-+#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
-+#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
-+
- typedef struct elf32_phdr{
-   Elf32_Word	p_type;
-   Elf32_Off	p_offset;
-@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
- #define	EI_OSABI	7
- #define	EI_PAD		8
- 
-+#define	EI_PAX		14
-+
- #define	ELFMAG0		0x7f		/* EI_MAG */
- #define	ELFMAG1		'E'
- #define	ELFMAG2		'L'
-@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
- #define elf_phdr	elf32_phdr
- #define elf_note	elf32_note
- #define elf_addr_t	Elf32_Off
-+#define elf_dyn		Elf32_Dyn
- 
- #else
- 
-@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
- #define elf_phdr	elf64_phdr
- #define elf_note	elf64_note
- #define elf_addr_t	Elf64_Off
-+#define elf_dyn		Elf64_Dyn
- 
- #endif
- 
-diff -urNp linux-2.6.32.13/include/linux/fs.h linux-2.6.32.13/include/linux/fs.h
---- linux-2.6.32.13/include/linux/fs.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.13/include/linux/fs.h	2010-05-15 13:21:17.938584561 -0400
-@@ -90,6 +90,11 @@ struct inodes_stat_t {
- /* Expect random access pattern */
- #define FMODE_RANDOM		((__force fmode_t)4096)
- 
-+/* Hack for grsec so as not to require read permission simply to execute
-+ * a binary
-+ */
-+#define FMODE_GREXEC		((__force fmode_t)8192)
-+
- /*
-  * The below are the various read and write types that we support. Some of
-  * them include behavioral modifiers that send information down to the
-@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
- 		unsigned long, unsigned long);
- 
- struct address_space_operations {
--	int (*writepage)(struct page *page, struct writeback_control *wbc);
--	int (*readpage)(struct file *, struct page *);
--	void (*sync_page)(struct page *);
-+	int (* const writepage)(struct page *page, struct writeback_control *wbc);
-+	int (* const readpage)(struct file *, struct page *);
-+	void (* const sync_page)(struct page *);
- 
- 	/* Write back some dirty pages from this mapping. */
--	int (*writepages)(struct address_space *, struct writeback_control *);
-+	int (* const writepages)(struct address_space *, struct writeback_control *);
- 
- 	/* Set a page dirty.  Return true if this dirtied it */
--	int (*set_page_dirty)(struct page *page);
-+	int (* const set_page_dirty)(struct page *page);
- 
--	int (*readpages)(struct file *filp, struct address_space *mapping,
-+	int (* const readpages)(struct file *filp, struct address_space *mapping,
- 			struct list_head *pages, unsigned nr_pages);
- 
--	int (*write_begin)(struct file *, struct address_space *mapping,
-+	int (* const write_begin)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned flags,
- 				struct page **pagep, void **fsdata);
--	int (*write_end)(struct file *, struct address_space *mapping,
-+	int (* const write_end)(struct file *, struct address_space *mapping,
- 				loff_t pos, unsigned len, unsigned copied,
- 				struct page *page, void *fsdata);
- 
- 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
--	sector_t (*bmap)(struct address_space *, sector_t);
--	void (*invalidatepage) (struct page *, unsigned long);
--	int (*releasepage) (struct page *, gfp_t);
--	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
-+	sector_t (* const bmap)(struct address_space *, sector_t);
-+	void (* const invalidatepage) (struct page *, unsigned long);
-+	int (* const releasepage) (struct page *, gfp_t);
-+	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
- 			loff_t offset, unsigned long nr_segs);
--	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
-+	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
- 						void **, unsigned long *);
- 	/* migrate the contents of a page to the specified target */
--	int (*migratepage) (struct address_space *,
-+	int (* const migratepage) (struct address_space *,
- 			struct page *, struct page *);
--	int (*launder_page) (struct page *);
--	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
-+	int (* const launder_page) (struct page *);
-+	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
- 					unsigned long);
--	int (*error_remove_page)(struct address_space *, struct page *);
-+	int (* const error_remove_page)(struct address_space *, struct page *);
- };
- 
- /*
-@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
- typedef struct files_struct *fl_owner_t;
- 
- struct file_lock_operations {
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
- };
- 
- struct lock_manager_operations {
--	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
--	void (*fl_notify)(struct file_lock *);	/* unblock callback */
--	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
--	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
--	void (*fl_release_private)(struct file_lock *);
--	void (*fl_break)(struct file_lock *);
--	int (*fl_mylease)(struct file_lock *, struct file_lock *);
--	int (*fl_change)(struct file_lock **, int);
-+	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
-+	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
-+	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
-+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
-+	void (* const fl_release_private)(struct file_lock *);
-+	void (* const fl_break)(struct file_lock *);
-+	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
-+	int (* const fl_change)(struct file_lock **, int);
- };
- 
- struct lock_manager {
-@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
- 	unsigned int fi_flags;		/* Flags as passed from user */
- 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
- 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
--	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
-+	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
- 						 * array */
- };
- int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
-@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
- 		unsigned long, loff_t *);
- 
- struct super_operations {
--   	struct inode *(*alloc_inode)(struct super_block *sb);
--	void (*destroy_inode)(struct inode *);
-+   	struct inode *(* const alloc_inode)(struct super_block *sb);
-+	void (* const destroy_inode)(struct inode *);
- 
--   	void (*dirty_inode) (struct inode *);
--	int (*write_inode) (struct inode *, int);
--	void (*drop_inode) (struct inode *);
--	void (*delete_inode) (struct inode *);
--	void (*put_super) (struct super_block *);
--	void (*write_super) (struct super_block *);
--	int (*sync_fs)(struct super_block *sb, int wait);
--	int (*freeze_fs) (struct super_block *);
--	int (*unfreeze_fs) (struct super_block *);
--	int (*statfs) (struct dentry *, struct kstatfs *);
--	int (*remount_fs) (struct super_block *, int *, char *);
--	void (*clear_inode) (struct inode *);
--	void (*umount_begin) (struct super_block *);
-+   	void (* const dirty_inode) (struct inode *);
-+	int (* const write_inode) (struct inode *, int);
-+	void (* const drop_inode) (struct inode *);
-+	void (* const delete_inode) (struct inode *);
-+	void (* const put_super) (struct super_block *);
-+	void (* const write_super) (struct super_block *);
-+	int (* const sync_fs)(struct super_block *sb, int wait);
-+	int (* const freeze_fs) (struct super_block *);
-+	int (* const unfreeze_fs) (struct super_block *);
-+	int (* const statfs) (struct dentry *, struct kstatfs *);
-+	int (* const remount_fs) (struct super_block *, int *, char *);
-+	void (* const clear_inode) (struct inode *);
-+	void (* const umount_begin) (struct super_block *);
- 
--	int (*show_options)(struct seq_file *, struct vfsmount *);
--	int (*show_stats)(struct seq_file *, struct vfsmount *);
-+	int (* const show_options)(struct seq_file *, struct vfsmount *);
-+	int (* const show_stats)(struct seq_file *, struct vfsmount *);
- #ifdef CONFIG_QUOTA
--	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
--	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
-+	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
-+	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
- #endif
--	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
-+	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
- };
- 
- /*
-diff -urNp linux-2.6.32.13/include/linux/fs_struct.h linux-2.6.32.13/include/linux/fs_struct.h
---- linux-2.6.32.13/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/fs_struct.h	2010-05-15 13:21:17.938584561 -0400
-@@ -4,7 +4,7 @@
- #include <linux/path.h>
- 
- struct fs_struct {
--	int users;
-+	atomic_t users;
- 	rwlock_t lock;
- 	int umask;
- 	int in_exec;
-diff -urNp linux-2.6.32.13/include/linux/genhd.h linux-2.6.32.13/include/linux/genhd.h
---- linux-2.6.32.13/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/genhd.h	2010-05-15 13:21:17.938584561 -0400
-@@ -161,7 +161,7 @@ struct gendisk {
- 
- 	struct timer_rand_state *random;
- 
--	atomic_t sync_io;		/* RAID */
-+	atomic_unchecked_t sync_io;	/* RAID */
- 	struct work_struct async_notify;
- #ifdef  CONFIG_BLK_DEV_INTEGRITY
- 	struct blk_integrity *integrity;
-diff -urNp linux-2.6.32.13/include/linux/gracl.h linux-2.6.32.13/include/linux/gracl.h
---- linux-2.6.32.13/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/gracl.h	2010-05-15 13:21:17.938584561 -0400
-@@ -0,0 +1,309 @@
-+#ifndef GR_ACL_H
-+#define GR_ACL_H
-+
-+#include <linux/grdefs.h>
-+#include <linux/resource.h>
-+#include <linux/capability.h>
-+#include <linux/dcache.h>
-+#include <asm/resource.h>
-+
-+/* Major status information */
-+
-+#define GR_VERSION  "grsecurity 2.1.14"
-+#define GRSECURITY_VERSION 0x2114
-+
-+enum {
-+	GR_SHUTDOWN = 0,
-+	GR_ENABLE = 1,
-+	GR_SPROLE = 2,
-+	GR_RELOAD = 3,
-+	GR_SEGVMOD = 4,
-+	GR_STATUS = 5,
-+	GR_UNSPROLE = 6,
-+	GR_PASSSET = 7,
-+	GR_SPROLEPAM = 8,
-+};
-+
-+/* Password setup definitions
-+ * kernel/grhash.c */
-+enum {
-+	GR_PW_LEN = 128,
-+	GR_SALT_LEN = 16,
-+	GR_SHA_LEN = 32,
-+};
-+
-+enum {
-+	GR_SPROLE_LEN = 64,
-+};
-+
-+#define GR_NLIMITS 32
-+
-+/* Begin Data Structures */
-+
-+struct sprole_pw {
-+	unsigned char *rolename;
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
-+};
-+
-+struct name_entry {
-+	__u32 key;
-+	ino_t inode;
-+	dev_t device;
-+	char *name;
-+	__u16 len;
-+	__u8 deleted;
-+	struct name_entry *prev;
-+	struct name_entry *next;
-+};
-+
-+struct inodev_entry {
-+	struct name_entry *nentry;
-+	struct inodev_entry *prev;
-+	struct inodev_entry *next;
-+};
-+
-+struct acl_role_db {
-+	struct acl_role_label **r_hash;
-+	__u32 r_size;
-+};
-+
-+struct inodev_db {
-+	struct inodev_entry **i_hash;
-+	__u32 i_size;
-+};
-+
-+struct name_db {
-+	struct name_entry **n_hash;
-+	__u32 n_size;
-+};
-+
-+struct crash_uid {
-+	uid_t uid;
-+	unsigned long expires;
-+};
-+
-+struct gr_hash_struct {
-+	void **table;
-+	void **nametable;
-+	void *first;
-+	__u32 table_size;
-+	__u32 used_size;
-+	int type;
-+};
-+
-+/* Userspace Grsecurity ACL data structures */
-+
-+struct acl_subject_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+	kernel_cap_t cap_mask;
-+	kernel_cap_t cap_lower;
-+
-+	struct rlimit res[GR_NLIMITS];
-+	__u32 resmask;
-+
-+	__u8 user_trans_type;
-+	__u8 group_trans_type;
-+	uid_t *user_transitions;
-+	gid_t *group_transitions;
-+	__u16 user_trans_num;
-+	__u16 group_trans_num;
-+
-+	__u32 ip_proto[8];
-+	__u32 ip_type;
-+	struct acl_ip_label **ips;
-+	__u32 ip_num;
-+	__u32 inaddr_any_override;
-+
-+	__u32 crashes;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *parent_subject;
-+	struct gr_hash_struct *hash;
-+	struct acl_subject_label *prev;
-+	struct acl_subject_label *next;
-+
-+	struct acl_object_label **obj_hash;
-+	__u32 obj_hash_size;
-+	__u16 pax_flags;
-+};
-+
-+struct role_allowed_ip {
-+	__u32 addr;
-+	__u32 netmask;
-+
-+	struct role_allowed_ip *prev;
-+	struct role_allowed_ip *next;
-+};
-+
-+struct role_transition {
-+	char *rolename;
-+
-+	struct role_transition *prev;
-+	struct role_transition *next;
-+};
-+
-+struct acl_role_label {
-+	char *rolename;
-+	uid_t uidgid;
-+	__u16 roletype;
-+
-+	__u16 auth_attempts;
-+	unsigned long expires;
-+
-+	struct acl_subject_label *root_label;
-+	struct gr_hash_struct *hash;
-+
-+	struct acl_role_label *prev;
-+	struct acl_role_label *next;
-+
-+	struct role_transition *transitions;
-+	struct role_allowed_ip *allowed_ips;
-+	uid_t *domain_children;
-+	__u16 domain_child_num;
-+
-+	struct acl_subject_label **subj_hash;
-+	__u32 subj_hash_size;
-+};
-+
-+struct user_acl_role_db {
-+	struct acl_role_label **r_table;
-+	__u32 num_pointers;		/* Number of allocations to track */
-+	__u32 num_roles;		/* Number of roles */
-+	__u32 num_domain_children;	/* Number of domain children */
-+	__u32 num_subjects;		/* Number of subjects */
-+	__u32 num_objects;		/* Number of objects */
-+};
-+
-+struct acl_object_label {
-+	char *filename;
-+	ino_t inode;
-+	dev_t device;
-+	__u32 mode;
-+
-+	struct acl_subject_label *nested;
-+	struct acl_object_label *globbed;
-+
-+	/* next two structures not used */
-+
-+	struct acl_object_label *prev;
-+	struct acl_object_label *next;
-+};
-+
-+struct acl_ip_label {
-+	char *iface;
-+	__u32 addr;
-+	__u32 netmask;
-+	__u16 low, high;
-+	__u8 mode;
-+	__u32 type;
-+	__u32 proto[8];
-+
-+	/* next two structures not used */
-+
-+	struct acl_ip_label *prev;
-+	struct acl_ip_label *next;
-+};
-+
-+struct gr_arg {
-+	struct user_acl_role_db role_db;
-+	unsigned char pw[GR_PW_LEN];
-+	unsigned char salt[GR_SALT_LEN];
-+	unsigned char sum[GR_SHA_LEN];
-+	unsigned char sp_role[GR_SPROLE_LEN];
-+	struct sprole_pw *sprole_pws;
-+	dev_t segv_device;
-+	ino_t segv_inode;
-+	uid_t segv_uid;
-+	__u16 num_sprole_pws;
-+	__u16 mode;
-+};
-+
-+struct gr_arg_wrapper {
-+	struct gr_arg *arg;
-+	__u32 version;
-+	__u32 size;
-+};
-+
-+struct subject_map {
-+	struct acl_subject_label *user;
-+	struct acl_subject_label *kernel;
-+	struct subject_map *prev;
-+	struct subject_map *next;
-+};
-+
-+struct acl_subj_map_db {
-+	struct subject_map **s_hash;
-+	__u32 s_size;
-+};
-+
-+/* End Data Structures Section */
-+
-+/* Hash functions generated by empirical testing by Brad Spengler
-+   Makes good use of the low bits of the inode.  Generally 0-1 times
-+   in loop for successful match.  0-3 for unsuccessful match.
-+   Shift/add algorithm with modulus of table size and an XOR*/
-+
-+static __inline__ unsigned int
-+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
-+{
-+	return ((((uid + type) << (16 + type)) ^ uid) % sz);
-+}
-+
-+ static __inline__ unsigned int
-+shash(const struct acl_subject_label *userp, const unsigned int sz)
-+{
-+	return ((const unsigned long)userp % sz);
-+}
-+
-+static __inline__ unsigned int
-+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
-+{
-+	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
-+}
-+
-+static __inline__ unsigned int
-+nhash(const char *name, const __u16 len, const unsigned int sz)
-+{
-+	return full_name_hash((const unsigned char *)name, len) % sz;
-+}
-+
-+#define FOR_EACH_ROLE_START(role) \
-+	role = role_list; \
-+	while (role) {
-+
-+#define FOR_EACH_ROLE_END(role) \
-+		role = role->prev; \
-+	}
-+
-+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
-+	subj = NULL; \
-+	iter = 0; \
-+	while (iter < role->subj_hash_size) { \
-+		if (subj == NULL) \
-+			subj = role->subj_hash[iter]; \
-+		if (subj == NULL) { \
-+			iter++; \
-+			continue; \
-+		}
-+
-+#define FOR_EACH_SUBJECT_END(subj,iter) \
-+		subj = subj->next; \
-+		if (subj == NULL) \
-+			iter++; \
-+	}
-+
-+
-+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
-+	subj = role->hash->first; \
-+	while (subj != NULL) {
-+
-+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
-+		subj = subj->next; \
-+	}
-+
-+#endif
-+
-diff -urNp linux-2.6.32.13/include/linux/gralloc.h linux-2.6.32.13/include/linux/gralloc.h
---- linux-2.6.32.13/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/gralloc.h	2010-05-15 13:21:17.938584561 -0400
-@@ -0,0 +1,9 @@
-+#ifndef __GRALLOC_H
-+#define __GRALLOC_H
-+
-+void acl_free_all(void);
-+int acl_alloc_stack_init(unsigned long size);
-+void *acl_alloc(unsigned long len);
-+void *acl_alloc_num(unsigned long num, unsigned long len);
-+
-+#endif
-diff -urNp linux-2.6.32.13/include/linux/grdefs.h linux-2.6.32.13/include/linux/grdefs.h
---- linux-2.6.32.13/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/grdefs.h	2010-05-15 13:21:17.938584561 -0400
-@@ -0,0 +1,136 @@
-+#ifndef GRDEFS_H
-+#define GRDEFS_H
-+
-+/* Begin grsecurity status declarations */
-+
-+enum {
-+	GR_READY = 0x01,
-+	GR_STATUS_INIT = 0x00	// disabled state
-+};
-+
-+/* Begin  ACL declarations */
-+
-+/* Role flags */
-+
-+enum {
-+	GR_ROLE_USER = 0x0001,
-+	GR_ROLE_GROUP = 0x0002,
-+	GR_ROLE_DEFAULT = 0x0004,
-+	GR_ROLE_SPECIAL = 0x0008,
-+	GR_ROLE_AUTH = 0x0010,
-+	GR_ROLE_NOPW = 0x0020,
-+	GR_ROLE_GOD = 0x0040,
-+	GR_ROLE_LEARN = 0x0080,
-+	GR_ROLE_TPE = 0x0100,
-+	GR_ROLE_DOMAIN = 0x0200,
-+	GR_ROLE_PAM = 0x0400
-+};
-+
-+/* ACL Subject and Object mode flags */
-+enum {
-+	GR_DELETED = 0x80000000
-+};
-+
-+/* ACL Object-only mode flags */
-+enum {
-+	GR_READ 	= 0x00000001,
-+	GR_APPEND 	= 0x00000002,
-+	GR_WRITE 	= 0x00000004,
-+	GR_EXEC 	= 0x00000008,
-+	GR_FIND 	= 0x00000010,
-+	GR_INHERIT 	= 0x00000020,
-+	GR_SETID 	= 0x00000040,
-+	GR_CREATE 	= 0x00000080,
-+	GR_DELETE 	= 0x00000100,
-+	GR_LINK		= 0x00000200,
-+	GR_AUDIT_READ 	= 0x00000400,
-+	GR_AUDIT_APPEND = 0x00000800,
-+	GR_AUDIT_WRITE 	= 0x00001000,
-+	GR_AUDIT_EXEC 	= 0x00002000,
-+	GR_AUDIT_FIND 	= 0x00004000,
-+	GR_AUDIT_INHERIT= 0x00008000,
-+	GR_AUDIT_SETID 	= 0x00010000,
-+	GR_AUDIT_CREATE = 0x00020000,
-+	GR_AUDIT_DELETE = 0x00040000,
-+	GR_AUDIT_LINK	= 0x00080000,
-+	GR_PTRACERD 	= 0x00100000,
-+	GR_NOPTRACE	= 0x00200000,
-+	GR_SUPPRESS 	= 0x00400000,
-+	GR_NOLEARN 	= 0x00800000
-+};
-+
-+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
-+		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
-+		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
-+
-+/* ACL subject-only mode flags */
-+enum {
-+	GR_KILL 	= 0x00000001,
-+	GR_VIEW 	= 0x00000002,
-+	GR_PROTECTED 	= 0x00000004,
-+	GR_LEARN 	= 0x00000008,
-+	GR_OVERRIDE 	= 0x00000010,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_DUMMY 	= 0x00000020,
-+	GR_PROTSHM	= 0x00000040,
-+	GR_KILLPROC	= 0x00000080,
-+	GR_KILLIPPROC	= 0x00000100,
-+	/* just a placeholder, this mode is only used in userspace */
-+	GR_NOTROJAN	= 0x00000200,
-+	GR_PROTPROCFD	= 0x00000400,
-+	GR_PROCACCT	= 0x00000800,
-+	GR_RELAXPTRACE	= 0x00001000,
-+	GR_NESTED	= 0x00002000,
-+	GR_INHERITLEARN	= 0x00004000,
-+	GR_PROCFIND	= 0x00008000,
-+	GR_POVERRIDE	= 0x00010000,
-+	GR_KERNELAUTH	= 0x00020000,
-+};
-+
-+enum {
-+	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
-+	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
-+	GR_PAX_ENABLE_MPROTECT	= 0x0004,
-+	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
-+	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
-+	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
-+	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
-+	GR_PAX_DISABLE_MPROTECT	= 0x0400,
-+	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
-+	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
-+};
-+
-+enum {
-+	GR_ID_USER	= 0x01,
-+	GR_ID_GROUP	= 0x02,
-+};
-+
-+enum {
-+	GR_ID_ALLOW	= 0x01,
-+	GR_ID_DENY	= 0x02,
-+};
-+
-+#define GR_CRASH_RES	31
-+#define GR_UIDTABLE_MAX 500
-+
-+/* begin resource learning section */
-+enum {
-+	GR_RLIM_CPU_BUMP = 60,
-+	GR_RLIM_FSIZE_BUMP = 50000,
-+	GR_RLIM_DATA_BUMP = 10000,
-+	GR_RLIM_STACK_BUMP = 1000,
-+	GR_RLIM_CORE_BUMP = 10000,
-+	GR_RLIM_RSS_BUMP = 500000,
-+	GR_RLIM_NPROC_BUMP = 1,
-+	GR_RLIM_NOFILE_BUMP = 5,
-+	GR_RLIM_MEMLOCK_BUMP = 50000,
-+	GR_RLIM_AS_BUMP = 500000,
-+	GR_RLIM_LOCKS_BUMP = 2,
-+	GR_RLIM_SIGPENDING_BUMP = 5,
-+	GR_RLIM_MSGQUEUE_BUMP = 10000,
-+	GR_RLIM_NICE_BUMP = 1,
-+	GR_RLIM_RTPRIO_BUMP = 1,
-+	GR_RLIM_RTTIME_BUMP = 1000000
-+};
-+
-+#endif
-diff -urNp linux-2.6.32.13/include/linux/grinternal.h linux-2.6.32.13/include/linux/grinternal.h
---- linux-2.6.32.13/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/grinternal.h	2010-05-15 13:21:17.938584561 -0400
-@@ -0,0 +1,215 @@
-+#ifndef __GRINTERNAL_H
-+#define __GRINTERNAL_H
-+
-+#ifdef CONFIG_GRKERNSEC
-+
-+#include <linux/fs.h>
-+#include <linux/mnt_namespace.h>
-+#include <linux/nsproxy.h>
-+#include <linux/gracl.h>
-+#include <linux/grdefs.h>
-+#include <linux/grmsg.h>
-+
-+void gr_add_learn_entry(const char *fmt, ...)
-+	__attribute__ ((format (printf, 1, 2)));
-+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
-+			    const struct vfsmount *mnt);
-+__u32 gr_check_create(const struct dentry *new_dentry,
-+			     const struct dentry *parent,
-+			     const struct vfsmount *mnt, const __u32 mode);
-+int gr_check_protected_task(const struct task_struct *task);
-+__u32 to_gr_audit(const __u32 reqmode);
-+int gr_set_acls(const int type);
-+
-+int gr_acl_is_enabled(void);
-+char gr_roletype_to_char(void);
-+
-+void gr_handle_alertkill(struct task_struct *task);
-+char *gr_to_filename(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename1(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename2(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+char *gr_to_filename3(const struct dentry *dentry,
-+			    const struct vfsmount *mnt);
-+
-+extern int grsec_enable_harden_ptrace;
-+extern int grsec_enable_link;
-+extern int grsec_enable_fifo;
-+extern int grsec_enable_execve;
-+extern int grsec_enable_shm;
-+extern int grsec_enable_execlog;
-+extern int grsec_enable_signal;
-+extern int grsec_enable_audit_ptrace;
-+extern int grsec_enable_forkfail;
-+extern int grsec_enable_time;
-+extern int grsec_enable_rofs;
-+extern int grsec_enable_chroot_shmat;
-+extern int grsec_enable_chroot_findtask;
-+extern int grsec_enable_chroot_mount;
-+extern int grsec_enable_chroot_double;
-+extern int grsec_enable_chroot_pivot;
-+extern int grsec_enable_chroot_chdir;
-+extern int grsec_enable_chroot_chmod;
-+extern int grsec_enable_chroot_mknod;
-+extern int grsec_enable_chroot_fchdir;
-+extern int grsec_enable_chroot_nice;
-+extern int grsec_enable_chroot_execlog;
-+extern int grsec_enable_chroot_caps;
-+extern int grsec_enable_chroot_sysctl;
-+extern int grsec_enable_chroot_unix;
-+extern int grsec_enable_tpe;
-+extern int grsec_tpe_gid;
-+extern int grsec_enable_tpe_all;
-+extern int grsec_enable_sidcaps;
-+extern int grsec_enable_socket_all;
-+extern int grsec_socket_all_gid;
-+extern int grsec_enable_socket_client;
-+extern int grsec_socket_client_gid;
-+extern int grsec_enable_socket_server;
-+extern int grsec_socket_server_gid;
-+extern int grsec_audit_gid;
-+extern int grsec_enable_group;
-+extern int grsec_enable_audit_textrel;
-+extern int grsec_enable_mount;
-+extern int grsec_enable_chdir;
-+extern int grsec_resource_logging;
-+extern int grsec_enable_blackhole;
-+extern int grsec_lastack_retries;
-+extern int grsec_lock;
-+
-+extern spinlock_t grsec_alert_lock;
-+extern unsigned long grsec_alert_wtime;
-+extern unsigned long grsec_alert_fyet;
-+
-+extern spinlock_t grsec_audit_lock;
-+
-+extern rwlock_t grsec_exec_file_lock;
-+
-+#define gr_task_fullpath(tsk) (tsk->exec_file ? \
-+			gr_to_filename2(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
-+			gr_to_filename(tsk->exec_file->f_path.dentry, \
-+			tsk->exec_file->f_vfsmnt) : "/")
-+
-+#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
-+			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
-+			tsk->parent->exec_file->f_vfsmnt) : "/")
-+
-+#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
-+			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
-+			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
-+			    tsk_a->fs->root.dentry)))
-+
-+#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
-+			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
-+
-+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
-+		       task->pid, cred->uid, \
-+		       cred->euid, cred->gid, cred->egid, \
-+		       gr_parent_task_fullpath(task), \
-+		       task->parent->comm, task->parent->pid, \
-+		       pcred->uid, pcred->euid, \
-+		       pcred->gid, pcred->egid
-+
-+#define GR_CHROOT_CAPS {{ \
-+	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
-+	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
-+	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
-+	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
-+	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
-+
-+#define security_learn(normal_msg,args...) \
-+({ \
-+	read_lock(&grsec_exec_file_lock); \
-+	gr_add_learn_entry(normal_msg "\n", ## args); \
-+	read_unlock(&grsec_exec_file_lock); \
-+})
-+
-+enum {
-+	GR_DO_AUDIT,
-+	GR_DONT_AUDIT,
-+	GR_DONT_AUDIT_GOOD
-+};
-+
-+enum {
-+	GR_TTYSNIFF,
-+	GR_RBAC,
-+	GR_RBAC_STR,
-+	GR_STR_RBAC,
-+	GR_RBAC_MODE2,
-+	GR_RBAC_MODE3,
-+	GR_FILENAME,
-+	GR_SYSCTL_HIDDEN,
-+	GR_NOARGS,
-+	GR_ONE_INT,
-+	GR_ONE_INT_TWO_STR,
-+	GR_ONE_STR,
-+	GR_STR_INT,
-+	GR_TWO_INT,
-+	GR_THREE_INT,
-+	GR_FIVE_INT_TWO_STR,
-+	GR_TWO_STR,
-+	GR_THREE_STR,
-+	GR_FOUR_STR,
-+	GR_STR_FILENAME,
-+	GR_FILENAME_STR,
-+	GR_FILENAME_TWO_INT,
-+	GR_FILENAME_TWO_INT_STR,
-+	GR_TEXTREL,
-+	GR_PTRACE,
-+	GR_RESOURCE,
-+	GR_CAP,
-+	GR_SIG,
-+	GR_SIG2,
-+	GR_CRASH1,
-+	GR_CRASH2,
-+	GR_PSACCT
-+};
-+
-+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
-+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
-+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
-+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
-+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
-+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
-+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
-+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
-+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
-+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
-+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
-+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
-+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
-+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
-+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
-+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
-+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
-+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
-+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
-+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
-+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
-+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
-+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
-+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
-+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
-+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
-+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
-+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
-+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
-+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
-+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
-+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
-+
-+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
-+
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.13/include/linux/grmsg.h linux-2.6.32.13/include/linux/grmsg.h
---- linux-2.6.32.13/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/grmsg.h	2010-05-15 13:21:17.938584561 -0400
-@@ -0,0 +1,107 @@
-+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
-+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
-+#define GR_STOPMOD_MSG "denied modification of module state by "
-+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
-+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
-+#define GR_IOPERM_MSG "denied use of ioperm() by "
-+#define GR_IOPL_MSG "denied use of iopl() by "
-+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
-+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
-+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_KMEM_MSG "denied write of /dev/kmem by "
-+#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
-+#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
-+#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
-+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
-+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
-+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
-+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
-+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
-+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
-+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
-+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
-+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
-+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
-+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
-+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
-+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
-+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
-+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
-+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
-+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
-+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
-+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
-+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
-+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
-+#define GR_NPROC_MSG "denied overstep of process limit by "
-+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
-+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
-+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
-+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
-+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
-+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
-+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
-+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
-+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
-+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
-+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
-+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
-+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
-+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
-+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
-+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
-+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
-+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
-+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
-+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
-+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
-+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
-+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
-+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
-+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
-+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
-+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
-+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
-+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
-+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
-+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
-+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
-+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
-+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
-+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
-+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
-+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
-+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
-+#define GR_FAILFORK_MSG "failed fork with errno %d by "
-+#define GR_NICE_CHROOT_MSG "denied priority change by "
-+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
-+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
-+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
-+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
-+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
-+#define GR_TIME_MSG "time set by "
-+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
-+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
-+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
-+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
-+#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
-+#define GR_BIND_MSG "denied bind() by "
-+#define GR_CONNECT_MSG "denied connect() by "
-+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
-+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
-+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
-+#define GR_CAP_ACL_MSG "use of %s denied for "
-+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
-+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
-+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
-+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
-+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
-+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
-+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
-+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
-+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
-+#define GR_VM86_MSG "denied use of vm86 by "
-+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
-diff -urNp linux-2.6.32.13/include/linux/grsecurity.h linux-2.6.32.13/include/linux/grsecurity.h
---- linux-2.6.32.13/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/include/linux/grsecurity.h	2010-05-15 13:21:17.942979526 -0400
-@@ -0,0 +1,199 @@
-+#ifndef GR_SECURITY_H
-+#define GR_SECURITY_H
-+#include <linux/fs.h>
-+#include <linux/fs_struct.h>
-+#include <linux/binfmts.h>
-+#include <linux/gracl.h>
-+
-+/* notify of brain-dead configs */
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
-+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
-+#endif
-+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
-+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
-+#endif
-+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
-+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
-+#endif
-+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
-+#error "CONFIG_PAX enabled, but no PaX options are enabled."
-+#endif
-+
-+void gr_handle_brute_attach(struct task_struct *p);
-+void gr_handle_brute_check(void);
-+
-+char gr_roletype_to_char(void);
-+
-+int gr_check_user_change(int real, int effective, int fs);
-+int gr_check_group_change(int real, int effective, int fs);
-+
-+void gr_del_task_from_ip_table(struct task_struct *p);
-+
-+int gr_pid_is_chrooted(struct task_struct *p);
-+int gr_handle_chroot_nice(void);
-+int gr_handle_chroot_sysctl(const int op);
-+int gr_handle_chroot_setpriority(struct task_struct *p,
-+					const int niceval);
-+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
-+int gr_handle_chroot_chroot(const struct dentry *dentry,
-+				   const struct vfsmount *mnt);
-+int gr_handle_chroot_caps(struct path *path);
-+void gr_handle_chroot_chdir(struct path *path);
-+int gr_handle_chroot_chmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mknod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int mode);
-+int gr_handle_chroot_mount(const struct dentry *dentry,
-+				  const struct vfsmount *mnt,
-+				  const char *dev_name);
-+int gr_handle_chroot_pivot(void);
-+int gr_handle_chroot_unix(const pid_t pid);
-+
-+int gr_handle_rawio(const struct inode *inode);
-+int gr_handle_nproc(void);
-+
-+void gr_handle_ioperm(void);
-+void gr_handle_iopl(void);
-+
-+int gr_tpe_allow(const struct file *file);
-+
-+int gr_random_pid(void);
-+
-+void gr_log_forkfail(const int retval);
-+void gr_log_timechange(void);
-+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
-+void gr_log_chdir(const struct dentry *dentry,
-+			 const struct vfsmount *mnt);
-+void gr_log_chroot_exec(const struct dentry *dentry,
-+			       const struct vfsmount *mnt);
-+void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
-+void gr_log_remount(const char *devname, const int retval);
-+void gr_log_unmount(const char *devname, const int retval);
-+void gr_log_mount(const char *from, const char *to, const int retval);
-+void gr_log_textrel(struct vm_area_struct *vma);
-+
-+int gr_handle_follow_link(const struct inode *parent,
-+				 const struct inode *inode,
-+				 const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_fifo(const struct dentry *dentry,
-+			  const struct vfsmount *mnt,
-+			  const struct dentry *dir, const int flag,
-+			  const int acc_mode);
-+int gr_handle_hardlink(const struct dentry *dentry,
-+			      const struct vfsmount *mnt,
-+			      struct inode *inode,
-+			      const int mode, const char *to);
-+
-+int gr_is_capable(const int cap);
-+int gr_is_capable_nolog(const int cap);
-+void gr_learn_resource(const struct task_struct *task, const int limit,
-+			      const unsigned long wanted, const int gt);
-+void gr_copy_label(struct task_struct *tsk);
-+void gr_handle_crash(struct task_struct *task, const int sig);
-+int gr_handle_signal(const struct task_struct *p, const int sig);
-+int gr_check_crash_uid(const uid_t uid);
-+int gr_check_protected_task(const struct task_struct *task);
-+int gr_acl_handle_mmap(const struct file *file,
-+			      const unsigned long prot);
-+int gr_acl_handle_mprotect(const struct file *file,
-+				  const unsigned long prot);
-+int gr_check_hidden_task(const struct task_struct *tsk);
-+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
-+				    const struct vfsmount *mnt);
-+__u32 gr_acl_handle_utime(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+__u32 gr_acl_handle_access(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
-+				  const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
-+				 const struct vfsmount *mnt, mode_t mode);
-+__u32 gr_acl_handle_chown(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+int gr_handle_ptrace(struct task_struct *task, const long request);
-+int gr_handle_proc_ptrace(struct task_struct *task);
-+__u32 gr_acl_handle_execve(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+int gr_check_crash_exec(const struct file *filp);
-+int gr_acl_is_enabled(void);
-+void gr_set_kernel_label(struct task_struct *task);
-+void gr_set_role_label(struct task_struct *task, const uid_t uid,
-+			      const gid_t gid);
-+int gr_set_proc_label(const struct dentry *dentry,
-+			const struct vfsmount *mnt,
-+			const int unsafe_share);
-+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+__u32 gr_acl_handle_open(const struct dentry *dentry,
-+				const struct vfsmount *mnt, const int fmode);
-+__u32 gr_acl_handle_creat(const struct dentry *dentry,
-+				 const struct dentry *p_dentry,
-+				 const struct vfsmount *p_mnt, const int fmode,
-+				 const int imode);
-+void gr_handle_create(const struct dentry *dentry,
-+			     const struct vfsmount *mnt);
-+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt,
-+				 const int mode);
-+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
-+				 const struct dentry *parent_dentry,
-+				 const struct vfsmount *parent_mnt);
-+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
-+				 const struct vfsmount *mnt);
-+void gr_handle_delete(const ino_t ino, const dev_t dev);
-+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
-+				  const struct vfsmount *mnt);
-+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
-+				   const struct dentry *parent_dentry,
-+				   const struct vfsmount *parent_mnt,
-+				   const char *from);
-+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
-+				const struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				const struct dentry *old_dentry,
-+				const struct vfsmount *old_mnt, const char *to);
-+int gr_acl_handle_rename(struct dentry *new_dentry,
-+				struct dentry *parent_dentry,
-+				const struct vfsmount *parent_mnt,
-+				struct dentry *old_dentry,
-+				struct inode *old_parent_inode,
-+				struct vfsmount *old_mnt, const char *newname);
-+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
-+				struct dentry *old_dentry,
-+				struct dentry *new_dentry,
-+				struct vfsmount *mnt, const __u8 replace);
-+__u32 gr_check_link(const struct dentry *new_dentry,
-+			   const struct dentry *parent_dentry,
-+			   const struct vfsmount *parent_mnt,
-+			   const struct dentry *old_dentry,
-+			   const struct vfsmount *old_mnt);
-+int gr_acl_handle_filldir(const struct file *file, const char *name,
-+				 const unsigned int namelen, const ino_t ino);
-+
-+__u32 gr_acl_handle_unix(const struct dentry *dentry,
-+				const struct vfsmount *mnt);
-+void gr_acl_handle_exit(void);
-+void gr_acl_handle_psacct(struct task_struct *task, const long code);
-+int gr_acl_handle_procpidmem(const struct task_struct *task);
-+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
-+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
-+void gr_audit_ptrace(struct task_struct *task);
-+
-+#ifdef CONFIG_GRKERNSEC
-+void gr_log_nonroot_mod_load(const char *modname);
-+void gr_handle_vm86(void);
-+void gr_handle_mem_write(void);
-+void gr_handle_kmem_write(void);
-+void gr_handle_open_port(void);
-+int gr_handle_mem_mmap(const unsigned long offset,
-+			      struct vm_area_struct *vma);
-+
-+extern int grsec_enable_dmesg;
-+#endif
-+
-+#endif
-diff -urNp linux-2.6.32.13/include/linux/hdpu_features.h linux-2.6.32.13/include/linux/hdpu_features.h
---- linux-2.6.32.13/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/hdpu_features.h	2010-05-15 13:21:17.942979526 -0400
-@@ -3,7 +3,7 @@
- struct cpustate_t {
- 	spinlock_t lock;
- 	int excl;
--        int open_count;
-+	atomic_t open_count;
- 	unsigned char cached_val;
- 	int inited;
- 	unsigned long *set_addr;
-diff -urNp linux-2.6.32.13/include/linux/highmem.h linux-2.6.32.13/include/linux/highmem.h
---- linux-2.6.32.13/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/highmem.h	2010-05-15 13:21:17.942979526 -0400
-@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
- 	kunmap_atomic(kaddr, KM_USER0);
- }
- 
-+static inline void sanitize_highpage(struct page *page)
-+{
-+	void *kaddr;
-+	unsigned long flags;
-+
-+	local_irq_save(flags);
-+	kaddr = kmap_atomic(page, KM_CLEARPAGE);
-+	clear_page(kaddr);
-+	kunmap_atomic(kaddr, KM_CLEARPAGE);
-+	local_irq_restore(flags);
-+}
-+
- static inline void zero_user_segments(struct page *page,
- 	unsigned start1, unsigned end1,
- 	unsigned start2, unsigned end2)
-diff -urNp linux-2.6.32.13/include/linux/init_task.h linux-2.6.32.13/include/linux/init_task.h
---- linux-2.6.32.13/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/init_task.h	2010-05-15 13:21:17.942979526 -0400
-@@ -115,6 +115,13 @@ extern struct cred init_cred;
- # define INIT_PERF_EVENTS(tsk)
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+# define INIT_GR_FS_LOCK					\
-+	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
-+#else
-+# define INIT_GR_FS_LOCK
-+#endif
-+
- /*
-  *  INIT_TASK is used to set up the first task table, touch at
-  * your own risk!. Base=0, limit=0x1fffff (=2MB)
-@@ -184,6 +191,7 @@ extern struct cred init_cred;
- 	INIT_FTRACE_GRAPH						\
- 	INIT_TRACE_RECURSION						\
- 	INIT_TASK_RCU_PREEMPT(tsk)					\
-+	INIT_GR_FS_LOCK							\
- }
- 
- 
-diff -urNp linux-2.6.32.13/include/linux/interrupt.h linux-2.6.32.13/include/linux/interrupt.h
---- linux-2.6.32.13/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/interrupt.h	2010-05-15 13:21:17.942979526 -0400
-@@ -357,7 +357,7 @@ enum
- /* map softirq index to softirq name. update 'softirq_to_name' in
-  * kernel/softirq.c when adding a new softirq.
-  */
--extern char *softirq_to_name[NR_SOFTIRQS];
-+extern const char * const softirq_to_name[NR_SOFTIRQS];
- 
- /* softirq mask and active fields moved to irq_cpustat_t in
-  * asm/hardirq.h to get better cache usage.  KAO
-@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
- 
- struct softirq_action
- {
--	void	(*action)(struct softirq_action *);
-+	void	(*action)(void);
- };
- 
- asmlinkage void do_softirq(void);
- asmlinkage void __do_softirq(void);
--extern void open_softirq(int nr, void (*action)(struct softirq_action *));
-+extern void open_softirq(int nr, void (*action)(void));
- extern void softirq_init(void);
- #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
- extern void raise_softirq_irqoff(unsigned int nr);
-diff -urNp linux-2.6.32.13/include/linux/jbd2.h linux-2.6.32.13/include/linux/jbd2.h
---- linux-2.6.32.13/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/jbd2.h	2010-05-15 13:21:17.942979526 -0400
-@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd2_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.13/include/linux/jbd.h linux-2.6.32.13/include/linux/jbd.h
---- linux-2.6.32.13/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/jbd.h	2010-05-15 13:21:17.942979526 -0400
-@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.32.13/include/linux/kallsyms.h linux-2.6.32.13/include/linux/kallsyms.h
---- linux-2.6.32.13/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/kallsyms.h	2010-05-15 13:21:17.942979526 -0400
-@@ -15,7 +15,8 @@
- 
- struct module;
- 
--#ifdef CONFIG_KALLSYMS
-+#ifndef __INCLUDED_BY_HIDESYM
-+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
- /* Lookup the address for a symbol. Returns 0 if not found. */
- unsigned long kallsyms_lookup_name(const char *name);
- 
-@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
- /* Stupid that this does nothing, but I didn't create this mess. */
- #define __print_symbol(fmt, addr)
- #endif /*CONFIG_KALLSYMS*/
-+#else /* when included by kallsyms.c, with HIDESYM enabled */
-+extern void __print_symbol(const char *fmt, unsigned long address);
-+#endif
- 
- /* This macro allows us to keep printk typechecking */
- static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.32.13/include/linux/kgdb.h linux-2.6.32.13/include/linux/kgdb.h
---- linux-2.6.32.13/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/kgdb.h	2010-05-15 13:21:17.942979526 -0400
-@@ -251,20 +251,20 @@ struct kgdb_arch {
-  */
- struct kgdb_io {
- 	const char		*name;
--	int			(*read_char) (void);
--	void			(*write_char) (u8);
--	void			(*flush) (void);
--	int			(*init) (void);
--	void			(*pre_exception) (void);
--	void			(*post_exception) (void);
-+	int			(* const read_char) (void);
-+	void			(* const write_char) (u8);
-+	void			(* const flush) (void);
-+	int			(* const init) (void);
-+	void			(* const pre_exception) (void);
-+	void			(* const post_exception) (void);
- };
- 
--extern struct kgdb_arch		arch_kgdb_ops;
-+extern const struct kgdb_arch arch_kgdb_ops;
- 
- extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
- 
--extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
--extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
-+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
-+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
- 
- extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
- extern int kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.32.13/include/linux/kobject.h linux-2.6.32.13/include/linux/kobject.h
---- linux-2.6.32.13/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/kobject.h	2010-05-15 13:21:17.942979526 -0400
-@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
- 
- struct kobj_type {
- 	void (*release)(struct kobject *kobj);
--	struct sysfs_ops *sysfs_ops;
-+	const struct sysfs_ops *sysfs_ops;
- 	struct attribute **default_attrs;
- };
- 
-@@ -118,9 +118,9 @@ struct kobj_uevent_env {
- };
- 
- struct kset_uevent_ops {
--	int (*filter)(struct kset *kset, struct kobject *kobj);
--	const char *(*name)(struct kset *kset, struct kobject *kobj);
--	int (*uevent)(struct kset *kset, struct kobject *kobj,
-+	int (* const filter)(struct kset *kset, struct kobject *kobj);
-+	const char *(* const name)(struct kset *kset, struct kobject *kobj);
-+	int (* const uevent)(struct kset *kset, struct kobject *kobj,
- 		      struct kobj_uevent_env *env);
- };
- 
-@@ -132,7 +132,7 @@ struct kobj_attribute {
- 			 const char *buf, size_t count);
- };
- 
--extern struct sysfs_ops kobj_sysfs_ops;
-+extern const struct sysfs_ops kobj_sysfs_ops;
- 
- /**
-  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
-@@ -155,14 +155,14 @@ struct kset {
- 	struct list_head list;
- 	spinlock_t list_lock;
- 	struct kobject kobj;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- };
- 
- extern void kset_init(struct kset *kset);
- extern int __must_check kset_register(struct kset *kset);
- extern void kset_unregister(struct kset *kset);
- extern struct kset * __must_check kset_create_and_add(const char *name,
--						struct kset_uevent_ops *u,
-+						const struct kset_uevent_ops *u,
- 						struct kobject *parent_kobj);
- 
- static inline struct kset *to_kset(struct kobject *kobj)
-diff -urNp linux-2.6.32.13/include/linux/kvm_host.h linux-2.6.32.13/include/linux/kvm_host.h
---- linux-2.6.32.13/include/linux/kvm_host.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.13/include/linux/kvm_host.h	2010-05-15 13:21:17.942979526 -0400
-@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
- void vcpu_load(struct kvm_vcpu *vcpu);
- void vcpu_put(struct kvm_vcpu *vcpu);
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module);
- void kvm_exit(void);
- 
-@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
- 					struct kvm_guest_debug *dbg);
- int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
- 
--int kvm_arch_init(void *opaque);
-+int kvm_arch_init(const void *opaque);
- void kvm_arch_exit(void);
- 
- int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.32.13/include/linux/libata.h linux-2.6.32.13/include/linux/libata.h
---- linux-2.6.32.13/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/libata.h	2010-05-15 13:21:17.942979526 -0400
-@@ -64,11 +64,11 @@
- #ifdef ATA_VERBOSE_DEBUG
- #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
- #else
--#define VPRINTK(fmt, args...)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_VERBOSE_DEBUG */
- #else
--#define DPRINTK(fmt, args...)
--#define VPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_DEBUG */
- 
- #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
-@@ -524,11 +524,11 @@ struct ata_ioports {
- 
- struct ata_host {
- 	spinlock_t		lock;
--	struct device 		*dev;
-+	struct device		*dev;
- 	void __iomem * const	*iomap;
- 	unsigned int		n_ports;
- 	void			*private_data;
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	unsigned long		flags;
- #ifdef CONFIG_ATA_ACPI
- 	acpi_handle		acpi_handle;
-@@ -709,7 +709,7 @@ struct ata_link {
- 
- struct ata_port {
- 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
--	struct ata_port_operations *ops;
-+	const struct ata_port_operations *ops;
- 	spinlock_t		*lock;
- 	/* Flags owned by the EH context. Only EH should touch these once the
- 	   port is active */
-@@ -891,7 +891,7 @@ struct ata_port_info {
- 	unsigned long		pio_mask;
- 	unsigned long		mwdma_mask;
- 	unsigned long		udma_mask;
--	struct ata_port_operations *port_ops;
-+	const struct ata_port_operations *port_ops;
- 	void 			*private_data;
- };
- 
-@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
- extern const unsigned long sata_deb_timing_hotplug[];
- extern const unsigned long sata_deb_timing_long[];
- 
--extern struct ata_port_operations ata_dummy_port_ops;
-+extern const struct ata_port_operations ata_dummy_port_ops;
- extern const struct ata_port_info ata_dummy_port_info;
- 
- static inline const unsigned long *
-@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
- 			     struct scsi_host_template *sht);
- extern void ata_host_detach(struct ata_host *host);
- extern void ata_host_init(struct ata_host *, struct device *,
--			  unsigned long, struct ata_port_operations *);
-+			  unsigned long, const struct ata_port_operations *);
- extern int ata_scsi_detect(struct scsi_host_template *sht);
- extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
- extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-diff -urNp linux-2.6.32.13/include/linux/lockd/bind.h linux-2.6.32.13/include/linux/lockd/bind.h
---- linux-2.6.32.13/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/lockd/bind.h	2010-05-15 13:21:17.942979526 -0400
-@@ -23,13 +23,13 @@ struct svc_rqst;
-  * This is the set of functions for lockd->nfsd communication
-  */
- struct nlmsvc_binding {
--	__be32			(*fopen)(struct svc_rqst *,
-+	__be32			(* const fopen)(struct svc_rqst *,
- 						struct nfs_fh *,
- 						struct file **);
--	void			(*fclose)(struct file *);
-+	void			(* const fclose)(struct file *);
- };
- 
--extern struct nlmsvc_binding *	nlmsvc_ops;
-+extern const struct nlmsvc_binding *	nlmsvc_ops;
- 
- /*
-  * Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.32.13/include/linux/mm.h linux-2.6.32.13/include/linux/mm.h
---- linux-2.6.32.13/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/mm.h	2010-05-15 13:21:17.946623351 -0400
-@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
- #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
- #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
- 
-+#ifdef CONFIG_PAX_PAGEEXEC
-+#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
-+#endif
-+
- #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
- #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
- #endif
-@@ -880,6 +884,8 @@ struct shrinker {
- extern void register_shrinker(struct shrinker *);
- extern void unregister_shrinker(struct shrinker *);
- 
-+pgprot_t vm_get_page_prot(unsigned long vm_flags);
-+
- int vma_wants_writenotify(struct vm_area_struct *vma);
- 
- extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
-@@ -1152,6 +1158,7 @@ out:
- }
- 
- extern int do_munmap(struct mm_struct *, unsigned long, size_t);
-+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
- 
- extern unsigned long do_brk(unsigned long, unsigned long);
- 
-@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
- extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
- 					     struct vm_area_struct **pprev);
- 
-+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
-+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
-+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
-+
- /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
-    NULL if none.  Assume start_addr < end_addr. */
- static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
- 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
- }
- 
--pgprot_t vm_get_page_prot(unsigned long vm_flags);
- struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
- int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
- 			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
- extern int __memory_failure(unsigned long pfn, int trapno, int ref);
- extern int sysctl_memory_failure_early_kill;
- extern int sysctl_memory_failure_recovery;
--extern atomic_long_t mce_bad_pages;
-+extern atomic_long_unchecked_t mce_bad_pages;
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
-+#else
-+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
-+#endif
- 
- #endif /* __KERNEL__ */
- #endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.32.13/include/linux/mm_types.h linux-2.6.32.13/include/linux/mm_types.h
---- linux-2.6.32.13/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/mm_types.h	2010-05-15 13:21:17.946623351 -0400
-@@ -186,6 +186,8 @@ struct vm_area_struct {
- #ifdef CONFIG_NUMA
- 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
- #endif
-+
-+	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
- };
- 
- struct core_thread {
-@@ -287,6 +289,24 @@ struct mm_struct {
- #ifdef CONFIG_MMU_NOTIFIER
- 	struct mmu_notifier_mm *mmu_notifier_mm;
- #endif
-+
-+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+	unsigned long pax_flags;
-+#endif
-+
-+#ifdef CONFIG_PAX_DLRESOLVE
-+	unsigned long call_dl_resolve;
-+#endif
-+
-+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
-+	unsigned long call_syscall;
-+#endif
-+
-+#ifdef CONFIG_PAX_ASLR
-+	unsigned long delta_mmap;		/* randomized offset */
-+	unsigned long delta_stack;		/* randomized offset */
-+#endif
-+
- };
- 
- /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.32.13/include/linux/mmu_notifier.h linux-2.6.32.13/include/linux/mmu_notifier.h
---- linux-2.6.32.13/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/mmu_notifier.h	2010-05-15 13:21:17.946623351 -0400
-@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
-  */
- #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
- ({									\
--	pte_t __pte;							\
-+	pte_t ___pte;							\
- 	struct vm_area_struct *___vma = __vma;				\
- 	unsigned long ___address = __address;				\
--	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
-+	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
- 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
--	__pte;								\
-+	___pte;								\
- })
- 
- #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
-diff -urNp linux-2.6.32.13/include/linux/mod_devicetable.h linux-2.6.32.13/include/linux/mod_devicetable.h
---- linux-2.6.32.13/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/mod_devicetable.h	2010-05-15 13:21:17.946623351 -0400
-@@ -12,7 +12,7 @@
- typedef unsigned long kernel_ulong_t;
- #endif
- 
--#define PCI_ANY_ID (~0)
-+#define PCI_ANY_ID ((__u16)~0)
- 
- struct pci_device_id {
- 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
-@@ -131,7 +131,7 @@ struct usb_device_id {
- #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
- #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
- 
--#define HID_ANY_ID				(~0)
-+#define HID_ANY_ID				(~0U)
- 
- struct hid_device_id {
- 	__u16 bus;
-diff -urNp linux-2.6.32.13/include/linux/module.h linux-2.6.32.13/include/linux/module.h
---- linux-2.6.32.13/include/linux/module.h	2010-04-29 17:49:38.529851956 -0400
-+++ linux-2.6.32.13/include/linux/module.h	2010-05-15 13:21:17.946623351 -0400
-@@ -287,16 +287,16 @@ struct module
- 	int (*init)(void);
- 
- 	/* If this is non-NULL, vfree after init() returns */
--	void *module_init;
-+	void *module_init_rx, *module_init_rw;
- 
- 	/* Here is the actual code + data, vfree'd on unload. */
--	void *module_core;
-+	void *module_core_rx, *module_core_rw;
- 
- 	/* Here are the sizes of the init and core sections */
--	unsigned int init_size, core_size;
-+	unsigned int init_size_rw, core_size_rw;
- 
- 	/* The size of the executable code in each section.  */
--	unsigned int init_text_size, core_text_size;
-+	unsigned int init_size_rx, core_size_rx;
- 
- 	/* Arch-specific module values */
- 	struct mod_arch_specific arch;
-@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
- bool is_module_address(unsigned long addr);
- bool is_module_text_address(unsigned long addr);
- 
-+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
-+{
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+	if (ktla_ktva(addr) >= (unsigned long)start &&
-+	    ktla_ktva(addr) < (unsigned long)start + size)
-+		return 1;
-+#endif
-+
-+	return ((void *)addr >= start && (void *)addr < start + size);
-+}
-+
-+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
-+}
-+
-+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
-+}
-+
-+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
-+}
-+
-+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
-+{
-+	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
-+}
-+
- static inline int within_module_core(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_core <= addr &&
--	       addr < (unsigned long)mod->module_core + mod->core_size;
-+	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
- }
- 
- static inline int within_module_init(unsigned long addr, struct module *mod)
- {
--	return (unsigned long)mod->module_init <= addr &&
--	       addr < (unsigned long)mod->module_init + mod->init_size;
-+	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
- }
- 
- /* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.32.13/include/linux/moduleloader.h linux-2.6.32.13/include/linux/moduleloader.h
---- linux-2.6.32.13/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/moduleloader.h	2010-05-15 13:21:17.946623351 -0400
-@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
-    sections.  Returns NULL on failure. */
- void *module_alloc(unsigned long size);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void *module_alloc_exec(unsigned long size);
-+#else
-+#define module_alloc_exec(x) module_alloc(x)
-+#endif
-+
- /* Free memory returned from module_alloc. */
- void module_free(struct module *mod, void *module_region);
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+void module_free_exec(struct module *mod, void *module_region);
-+#else
-+#define module_free_exec(x, y) module_free((x), (y))
-+#endif
-+
- /* Apply the given relocation to the (simplified) ELF.  Return -error
-    or 0. */
- int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.32.13/include/linux/namei.h linux-2.6.32.13/include/linux/namei.h
---- linux-2.6.32.13/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/namei.h	2010-05-15 13:21:17.946623351 -0400
-@@ -22,7 +22,7 @@ struct nameidata {
- 	unsigned int	flags;
- 	int		last_type;
- 	unsigned	depth;
--	char *saved_names[MAX_NESTED_LINKS + 1];
-+	const char *saved_names[MAX_NESTED_LINKS + 1];
- 
- 	/* Intent data */
- 	union {
-@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
- extern struct dentry *lock_rename(struct dentry *, struct dentry *);
- extern void unlock_rename(struct dentry *, struct dentry *);
- 
--static inline void nd_set_link(struct nameidata *nd, char *path)
-+static inline void nd_set_link(struct nameidata *nd, const char *path)
- {
- 	nd->saved_names[nd->depth] = path;
- }
- 
--static inline char *nd_get_link(struct nameidata *nd)
-+static inline const char *nd_get_link(const struct nameidata *nd)
- {
- 	return nd->saved_names[nd->depth];
- }
-diff -urNp linux-2.6.32.13/include/linux/nodemask.h linux-2.6.32.13/include/linux/nodemask.h
---- linux-2.6.32.13/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/nodemask.h	2010-05-15 13:21:17.946623351 -0400
-@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
- 
- #define any_online_node(mask)			\
- ({						\
--	int node;				\
--	for_each_node_mask(node, (mask))	\
--		if (node_online(node))		\
-+	int __node;				\
-+	for_each_node_mask(__node, (mask))	\
-+		if (node_online(__node))	\
- 			break;			\
--	node;					\
-+	__node;					\
- })
- 
- #define num_online_nodes()	num_node_state(N_ONLINE)
-diff -urNp linux-2.6.32.13/include/linux/oprofile.h linux-2.6.32.13/include/linux/oprofile.h
---- linux-2.6.32.13/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/oprofile.h	2010-05-15 13:21:17.946623351 -0400
-@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
- int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
- 	char const * name, ulong * val);
-  
--/** Create a file for read-only access to an atomic_t. */
-+/** Create a file for read-only access to an atomic_unchecked_t. */
- int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
--	char const * name, atomic_t * val);
-+	char const * name, atomic_unchecked_t * val);
-  
- /** create a directory */
- struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.32.13/include/linux/pipe_fs_i.h linux-2.6.32.13/include/linux/pipe_fs_i.h
---- linux-2.6.32.13/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/pipe_fs_i.h	2010-05-15 13:21:17.946623351 -0400
-@@ -46,9 +46,9 @@ struct pipe_inode_info {
- 	wait_queue_head_t wait;
- 	unsigned int nrbufs, curbuf;
- 	struct page *tmp_page;
--	unsigned int readers;
--	unsigned int writers;
--	unsigned int waiting_writers;
-+	atomic_t readers;
-+	atomic_t writers;
-+	atomic_t waiting_writers;
- 	unsigned int r_counter;
- 	unsigned int w_counter;
- 	struct fasync_struct *fasync_readers;
-diff -urNp linux-2.6.32.13/include/linux/poison.h linux-2.6.32.13/include/linux/poison.h
---- linux-2.6.32.13/include/linux/poison.h	2010-05-15 13:20:19.331913169 -0400
-+++ linux-2.6.32.13/include/linux/poison.h	2010-05-15 13:23:00.179313143 -0400
-@@ -19,8 +19,8 @@
-  * under normal circumstances, used to verify that nobody uses
-  * non-initialized list entries.
-  */
--#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
--#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
-+#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
-+#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
- 
- /********** include/linux/timer.h **********/
- /*
-diff -urNp linux-2.6.32.13/include/linux/proc_fs.h linux-2.6.32.13/include/linux/proc_fs.h
---- linux-2.6.32.13/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/proc_fs.h	2010-05-15 13:21:17.946623351 -0400
-@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
- 	return proc_create_data(name, mode, parent, proc_fops, NULL);
- }
- 
-+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
-+	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
-+{
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
-+#else
-+	return proc_create_data(name, mode, parent, proc_fops, NULL);
-+#endif
-+}
-+	
-+
- static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
- 	mode_t mode, struct proc_dir_entry *base, 
- 	read_proc_t *read_proc, void * data)
-diff -urNp linux-2.6.32.13/include/linux/random.h linux-2.6.32.13/include/linux/random.h
---- linux-2.6.32.13/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/random.h	2010-05-15 13:21:17.950606770 -0400
-@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
- u32 random32(void);
- void srandom32(u32 seed);
- 
-+static inline unsigned long pax_get_random_long(void)
-+{
-+	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
-+}
-+
- #endif /* __KERNEL___ */
- 
- #endif /* _LINUX_RANDOM_H */
-diff -urNp linux-2.6.32.13/include/linux/reiserfs_fs.h linux-2.6.32.13/include/linux/reiserfs_fs.h
---- linux-2.6.32.13/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/reiserfs_fs.h	2010-05-15 13:21:17.950606770 -0400
-@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
- #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
- 
- #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
--#define get_generation(s) atomic_read (&fs_generation(s))
-+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
- #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
- #define __fs_changed(gen,s) (gen != get_generation (s))
- #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
-@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
- */
- 
- struct item_operations {
--	int (*bytes_number) (struct item_head * ih, int block_size);
--	void (*decrement_key) (struct cpu_key *);
--	int (*is_left_mergeable) (struct reiserfs_key * ih,
-+	int (* const bytes_number) (struct item_head * ih, int block_size);
-+	void (* const decrement_key) (struct cpu_key *);
-+	int (* const is_left_mergeable) (struct reiserfs_key * ih,
- 				  unsigned long bsize);
--	void (*print_item) (struct item_head *, char *item);
--	void (*check_item) (struct item_head *, char *item);
-+	void (* const print_item) (struct item_head *, char *item);
-+	void (* const check_item) (struct item_head *, char *item);
- 
--	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
-+	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
- 			  int is_affected, int insert_size);
--	int (*check_left) (struct virtual_item * vi, int free,
-+	int (* const check_left) (struct virtual_item * vi, int free,
- 			   int start_skip, int end_skip);
--	int (*check_right) (struct virtual_item * vi, int free);
--	int (*part_size) (struct virtual_item * vi, int from, int to);
--	int (*unit_num) (struct virtual_item * vi);
--	void (*print_vi) (struct virtual_item * vi);
-+	int (* const check_right) (struct virtual_item * vi, int free);
-+	int (* const part_size) (struct virtual_item * vi, int from, int to);
-+	int (* const unit_num) (struct virtual_item * vi);
-+	void (* const print_vi) (struct virtual_item * vi);
- };
- 
--extern struct item_operations *item_ops[TYPE_ANY + 1];
-+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
- 
- #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
- #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.32.13/include/linux/reiserfs_fs_sb.h linux-2.6.32.13/include/linux/reiserfs_fs_sb.h
---- linux-2.6.32.13/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/reiserfs_fs_sb.h	2010-05-15 13:21:17.950606770 -0400
-@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
- 	/* Comment? -Hans */
- 	wait_queue_head_t s_wait;
- 	/* To be obsoleted soon by per buffer seals.. -Hans */
--	atomic_t s_generation_counter;	// increased by one every time the
-+	atomic_unchecked_t s_generation_counter;	// increased by one every time the
- 	// tree gets re-balanced
- 	unsigned long s_properties;	/* File system properties. Currently holds
- 					   on-disk FS format */
-diff -urNp linux-2.6.32.13/include/linux/sched.h linux-2.6.32.13/include/linux/sched.h
---- linux-2.6.32.13/include/linux/sched.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/sched.h	2010-05-15 13:21:17.950606770 -0400
-@@ -101,6 +101,7 @@ struct bio;
- struct fs_struct;
- struct bts_context;
- struct perf_event_context;
-+struct linux_binprm;
- 
- /*
-  * List of flags we want to share for kernel threads,
-@@ -664,6 +665,15 @@ struct signal_struct {
- 	struct tty_audit_buf *tty_audit_buf;
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+	u32 curr_ip;
-+	u32 gr_saddr;
-+	u32 gr_daddr;
-+	u16 gr_sport;
-+	u16 gr_dport;
-+	u8 used_accept:1;
-+#endif
-+
- 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
- };
- 
-@@ -1217,7 +1227,7 @@ struct rcu_node;
- 
- struct task_struct {
- 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
--	void *stack;
-+	struct thread_info *stack;
- 	atomic_t usage;
- 	unsigned int flags;	/* per process flags, defined below */
- 	unsigned int ptrace;
-@@ -1329,8 +1339,8 @@ struct task_struct {
- 	struct list_head thread_group;
- 
- 	struct completion *vfork_done;		/* for vfork() */
--	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
--	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
-+	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
-+	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
- 
- 	cputime_t utime, stime, utimescaled, stimescaled;
- 	cputime_t gtime;
-@@ -1344,16 +1354,6 @@ struct task_struct {
- 	struct task_cputime cputime_expires;
- 	struct list_head cpu_timers[3];
- 
--/* process credentials */
--	const struct cred *real_cred;	/* objective and real subjective task
--					 * credentials (COW) */
--	const struct cred *cred;	/* effective (overridable) subjective task
--					 * credentials (COW) */
--	struct mutex cred_guard_mutex;	/* guard against foreign influences on
--					 * credential calculations
--					 * (notably. ptrace) */
--	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
--
- 	char comm[TASK_COMM_LEN]; /* executable name excluding path
- 				     - access with [gs]et_task_comm (which lock
- 				       it with task_lock())
-@@ -1437,6 +1437,15 @@ struct task_struct {
- 	int hardirq_context;
- 	int softirq_context;
- #endif
-+
-+/* process credentials */
-+	const struct cred *real_cred;	/* objective and real subjective task
-+					 * credentials (COW) */
-+	struct mutex cred_guard_mutex;	/* guard against foreign influences on
-+					 * credential calculations
-+					 * (notably. ptrace) */
-+	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-+
- #ifdef CONFIG_LOCKDEP
- # define MAX_LOCK_DEPTH 48UL
- 	u64 curr_chain_key;
-@@ -1457,6 +1466,9 @@ struct task_struct {
- 
- 	struct backing_dev_info *backing_dev_info;
- 
-+	const struct cred *cred;	/* effective (overridable) subjective task
-+					 * credentials (COW) */
-+
- 	struct io_context *io_context;
- 
- 	unsigned long ptrace_message;
-@@ -1520,6 +1532,19 @@ struct task_struct {
- 	unsigned long default_timer_slack_ns;
- 
- 	struct list_head	*scm_work_list;
-+
-+#ifdef CONFIG_GRKERNSEC
-+	/* grsecurity */
-+	rwlock_t gr_fs_lock;
-+	struct acl_subject_label *acl;
-+	struct acl_role_label *role;
-+	struct file *exec_file;
-+	u16 acl_role_id;
-+	u8 acl_sp_role;
-+	u8 is_writable;
-+	u8 brute;
-+#endif
-+
- #ifdef CONFIG_FUNCTION_GRAPH_TRACER
- 	/* Index of current stored adress in ret_stack */
- 	int curr_ret_stack;
-@@ -1544,6 +1569,52 @@ struct task_struct {
- 	unsigned long stack_start;
- };
- 
-+#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
-+#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
-+#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
-+#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
-+/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
-+#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+extern unsigned int pax_softmode;
-+#endif
-+
-+extern int pax_check_flags(unsigned long *);
-+
-+/* if tsk != current then task_lock must be held on it */
-+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
-+static inline unsigned long pax_get_flags(struct task_struct *tsk)
-+{
-+	if (likely(tsk->mm))
-+		return tsk->mm->pax_flags;
-+	else
-+		return 0UL;
-+}
-+
-+/* if tsk != current then task_lock must be held on it */
-+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
-+{
-+	if (likely(tsk->mm)) {
-+		tsk->mm->pax_flags = flags;
-+		return 0;
-+	}
-+	return -EINVAL;
-+}
-+#endif
-+
-+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
-+extern void pax_set_initial_flags(struct linux_binprm *bprm);
-+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
-+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
-+#endif
-+
-+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
-+void pax_report_insns(void *pc, void *sp);
-+void pax_report_refcount_overflow(struct pt_regs *regs);
-+void pax_report_leak_to_user(const void *ptr, unsigned long len);
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len);
-+
- /* Future-safe accessor for struct task_struct's cpus_allowed. */
- #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
- 
-@@ -2143,7 +2214,7 @@ extern void __cleanup_sighand(struct sig
- extern void exit_itimers(struct signal_struct *);
- extern void flush_itimer_signals(void);
- 
--extern NORET_TYPE void do_group_exit(int);
-+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
- 
- extern void daemonize(const char *, ...);
- extern int allow_signal(int);
-@@ -2245,6 +2316,33 @@ static inline void task_unlock(struct ta
- 	spin_unlock(&p->alloc_lock);
- }
- 
-+/* grsec: protects only ->fs as task_lock is overkill and we can't
-+   be using a spin_lock in interrupt context
-+*/
-+#ifdef CONFIG_GRKERNSEC
-+#define gr_fs_write_lock_irqsave(x, y)				\
-+	write_lock_irqsave(&x->gr_fs_lock, y)
-+#define gr_fs_write_unlock_irqrestore(x, y) 			\
-+	write_unlock_irqrestore(&x->gr_fs_lock, y)
-+#else
-+#define gr_fs_write_lock_irqsave(x, y)
-+#define gr_fs_write_unlock_irqrestore(x, y)
-+#endif
-+
-+static inline void gr_fs_read_lock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_lock(&p->gr_fs_lock);
-+#endif
-+}
-+
-+static inline void gr_fs_read_unlock(struct task_struct *p)
-+{
-+#ifdef CONFIG_GRKERNSEC
-+	read_unlock(&p->gr_fs_lock);
-+#endif
-+}
-+
- extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
- 							unsigned long *flags);
- 
-@@ -2256,8 +2354,8 @@ static inline void unlock_task_sighand(s
- 
- #ifndef __HAVE_THREAD_FUNCTIONS
- 
--#define task_thread_info(task)	((struct thread_info *)(task)->stack)
--#define task_stack_page(task)	((task)->stack)
-+#define task_thread_info(task)	((task)->stack)
-+#define task_stack_page(task)	((void *)(task)->stack)
- 
- static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
- {
-@@ -2272,13 +2370,31 @@ static inline unsigned long *end_of_stac
- 
- #endif
- 
--static inline int object_is_on_stack(void *obj)
-+static inline int object_starts_on_stack(void *obj)
- {
--	void *stack = task_stack_page(current);
-+	const void *stack = task_stack_page(current);
- 
- 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
- }
- 
-+/* 0: not at all, 1: fully, -1: partially (implies an error) */
-+static inline int object_is_on_stack(const void *obj, unsigned long len)
-+{
-+	const void *stack = task_stack_page(current);
-+	const void *stackend = stack + THREAD_SIZE;
-+
-+	if (obj + len < obj)
-+		return -1;
-+
-+	if (stack <= obj && obj + len <= stackend)
-+		return 1;
-+
-+	if (obj + len <= stack || stackend <=  obj)
-+		return 0;
-+
-+	return -1;
-+}
-+
- extern void thread_info_cache_init(void);
- 
- #ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.32.13/include/linux/screen_info.h linux-2.6.32.13/include/linux/screen_info.h
---- linux-2.6.32.13/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/screen_info.h	2010-05-15 13:21:17.950606770 -0400
-@@ -42,7 +42,8 @@ struct screen_info {
- 	__u16 pages;		/* 0x32 */
- 	__u16 vesa_attributes;	/* 0x34 */
- 	__u32 capabilities;     /* 0x36 */
--	__u8  _reserved[6];	/* 0x3a */
-+	__u16 vesapm_size;	/* 0x3a */
-+	__u8  _reserved[4];	/* 0x3c */
- } __attribute__((packed));
- 
- #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
-diff -urNp linux-2.6.32.13/include/linux/security.h linux-2.6.32.13/include/linux/security.h
---- linux-2.6.32.13/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/security.h	2010-05-15 13:21:17.950606770 -0400
-@@ -34,6 +34,7 @@
- #include <linux/key.h>
- #include <linux/xfrm.h>
- #include <linux/gfp.h>
-+#include <linux/grsecurity.h>
- #include <net/flow.h>
- 
- /* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.32.13/include/linux/shm.h linux-2.6.32.13/include/linux/shm.h
---- linux-2.6.32.13/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/shm.h	2010-05-15 13:21:17.950606770 -0400
-@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
- 	pid_t			shm_cprid;
- 	pid_t			shm_lprid;
- 	struct user_struct	*mlock_user;
-+#ifdef CONFIG_GRKERNSEC
-+	time_t			shm_createtime;
-+	pid_t			shm_lapid;
-+#endif
- };
- 
- /* shm_mode upper byte flags */
-diff -urNp linux-2.6.32.13/include/linux/slab.h linux-2.6.32.13/include/linux/slab.h
---- linux-2.6.32.13/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/slab.h	2010-05-15 13:21:17.950606770 -0400
-@@ -11,6 +11,7 @@
- 
- #include <linux/gfp.h>
- #include <linux/types.h>
-+#include <linux/err.h>
- 
- /*
-  * Flags to pass to kmem_cache_create().
-@@ -82,10 +83,13 @@
-  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
-  * Both make kfree a no-op.
-  */
--#define ZERO_SIZE_PTR ((void *)16)
-+#define ZERO_SIZE_PTR				\
-+({						\
-+	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
-+	(void *)(-MAX_ERRNO-1L);		\
-+})
- 
--#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
--				(unsigned long)ZERO_SIZE_PTR)
-+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
- 
- /*
-  * struct kmem_cache related prototypes
-@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
- void kfree(const void *);
- void kzfree(const void *);
- size_t ksize(const void *);
-+void check_object_size(const void *ptr, unsigned long n, bool to);
- 
- /*
-  * Allocator specific definitions. These are mainly used to establish optimized
-@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
- 
- void __init kmem_cache_init_late(void);
- 
-+#define kmalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kmalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
-+#define kmalloc_node(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = kmalloc_node((size_t)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define kzalloc(x, y)					\
-+({							\
-+	void *___retval;				\
-+	intoverflow_t ___x = (intoverflow_t)x;		\
-+	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
-+		___retval = NULL;			\
-+	else						\
-+		___retval = kzalloc((size_t)___x, (y));	\
-+	___retval;					\
-+})
-+
- #endif	/* _LINUX_SLAB_H */
-diff -urNp linux-2.6.32.13/include/linux/slub_def.h linux-2.6.32.13/include/linux/slub_def.h
---- linux-2.6.32.13/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/slub_def.h	2010-05-15 13:21:17.950606770 -0400
-@@ -86,7 +86,7 @@ struct kmem_cache {
- 	struct kmem_cache_order_objects max;
- 	struct kmem_cache_order_objects min;
- 	gfp_t allocflags;	/* gfp flags to use on each alloc */
--	int refcount;		/* Refcount for slab cache destroy */
-+	atomic_t refcount;	/* Refcount for slab cache destroy */
- 	void (*ctor)(void *);
- 	int inuse;		/* Offset to metadata */
- 	int align;		/* Alignment */
-diff -urNp linux-2.6.32.13/include/linux/sonet.h linux-2.6.32.13/include/linux/sonet.h
---- linux-2.6.32.13/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/sonet.h	2010-05-15 13:21:17.950606770 -0400
-@@ -61,7 +61,7 @@ struct sonet_stats {
- #include <asm/atomic.h>
- 
- struct k_sonet_stats {
--#define __HANDLE_ITEM(i) atomic_t i
-+#define __HANDLE_ITEM(i) atomic_unchecked_t i
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- };
-diff -urNp linux-2.6.32.13/include/linux/suspend.h linux-2.6.32.13/include/linux/suspend.h
---- linux-2.6.32.13/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/suspend.h	2010-05-15 13:21:17.950606770 -0400
-@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
-  *	which require special recovery actions in that situation.
-  */
- struct platform_suspend_ops {
--	int (*valid)(suspend_state_t state);
--	int (*begin)(suspend_state_t state);
--	int (*prepare)(void);
--	int (*prepare_late)(void);
--	int (*enter)(suspend_state_t state);
--	void (*wake)(void);
--	void (*finish)(void);
--	void (*end)(void);
--	void (*recover)(void);
-+	int (* const valid)(suspend_state_t state);
-+	int (* const begin)(suspend_state_t state);
-+	int (* const prepare)(void);
-+	int (* const prepare_late)(void);
-+	int (* const enter)(suspend_state_t state);
-+	void (* const wake)(void);
-+	void (* const finish)(void);
-+	void (* const end)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_SUSPEND
-@@ -120,7 +120,7 @@ struct platform_suspend_ops {
-  * suspend_set_ops - set platform dependent suspend operations
-  * @ops: The new suspend operations to set.
-  */
--extern void suspend_set_ops(struct platform_suspend_ops *ops);
-+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
- extern int suspend_valid_only_mem(suspend_state_t state);
- 
- /**
-@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
- #else /* !CONFIG_SUSPEND */
- #define suspend_valid_only_mem	NULL
- 
--static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
-+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
- static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
- #endif /* !CONFIG_SUSPEND */
- 
-@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
-  *	platforms which require special recovery actions in that situation.
-  */
- struct platform_hibernation_ops {
--	int (*begin)(void);
--	void (*end)(void);
--	int (*pre_snapshot)(void);
--	void (*finish)(void);
--	int (*prepare)(void);
--	int (*enter)(void);
--	void (*leave)(void);
--	int (*pre_restore)(void);
--	void (*restore_cleanup)(void);
--	void (*recover)(void);
-+	int (* const begin)(void);
-+	void (* const end)(void);
-+	int (* const pre_snapshot)(void);
-+	void (* const finish)(void);
-+	int (* const prepare)(void);
-+	int (* const enter)(void);
-+	void (* const leave)(void);
-+	int (* const pre_restore)(void);
-+	void (* const restore_cleanup)(void);
-+	void (* const recover)(void);
- };
- 
- #ifdef CONFIG_HIBERNATION
-@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
- extern void swsusp_unset_page_free(struct page *);
- extern unsigned long get_safe_page(gfp_t gfp_mask);
- 
--extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
-+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
- extern int hibernate(void);
- extern bool system_entering_hibernation(void);
- #else /* CONFIG_HIBERNATION */
-@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
- static inline void swsusp_set_page_free(struct page *p) {}
- static inline void swsusp_unset_page_free(struct page *p) {}
- 
--static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
-+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
- static inline int hibernate(void) { return -ENOSYS; }
- static inline bool system_entering_hibernation(void) { return false; }
- #endif /* CONFIG_HIBERNATION */
-diff -urNp linux-2.6.32.13/include/linux/sysctl.h linux-2.6.32.13/include/linux/sysctl.h
---- linux-2.6.32.13/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/sysctl.h	2010-05-15 13:21:17.950606770 -0400
-@@ -164,7 +164,11 @@ enum
- 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
- };
- 
--
-+#ifdef CONFIG_PAX_SOFTMODE
-+enum {
-+	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
-+};
-+#endif
- 
- /* CTL_VM names: */
- enum
-diff -urNp linux-2.6.32.13/include/linux/sysfs.h linux-2.6.32.13/include/linux/sysfs.h
---- linux-2.6.32.13/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/sysfs.h	2010-05-15 13:21:17.950606770 -0400
-@@ -75,8 +75,8 @@ struct bin_attribute {
- };
- 
- struct sysfs_ops {
--	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
--	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
-+	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
-+	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
- };
- 
- struct sysfs_dirent;
-diff -urNp linux-2.6.32.13/include/linux/thread_info.h linux-2.6.32.13/include/linux/thread_info.h
---- linux-2.6.32.13/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/thread_info.h	2010-05-15 13:21:17.950606770 -0400
-@@ -23,7 +23,7 @@ struct restart_block {
- 		};
- 		/* For futex_wait and futex_wait_requeue_pi */
- 		struct {
--			u32 *uaddr;
-+			u32 __user *uaddr;
- 			u32 val;
- 			u32 flags;
- 			u32 bitset;
-diff -urNp linux-2.6.32.13/include/linux/tty.h linux-2.6.32.13/include/linux/tty.h
---- linux-2.6.32.13/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.13/include/linux/tty.h	2010-05-15 13:21:17.950606770 -0400
-@@ -13,6 +13,7 @@
- #include <linux/tty_driver.h>
- #include <linux/tty_ldisc.h>
- #include <linux/mutex.h>
-+#include <linux/poll.h>
- 
- #include <asm/system.h>
- 
-@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
- extern dev_t tty_devnum(struct tty_struct *tty);
- extern void proc_clear_tty(struct task_struct *p);
- extern struct tty_struct *get_current_tty(void);
--extern void tty_default_fops(struct file_operations *fops);
- extern struct tty_struct *alloc_tty_struct(void);
- extern void free_tty_struct(struct tty_struct *tty);
- extern void initialize_tty_struct(struct tty_struct *tty,
-@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
- /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
- extern void tty_ldisc_enable(struct tty_struct *tty);
- 
-+/* tty_io.c */
-+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
-+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
-+extern unsigned int tty_poll(struct file *, poll_table *);
-+#ifdef CONFIG_COMPAT
-+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
-+				unsigned long arg);
-+#else
-+#define tty_compat_ioctl NULL
-+#endif
-+extern int tty_release(struct inode *, struct file *);
-+extern int tty_fasync(int fd, struct file *filp, int on);
- 
- /* n_tty.c */
- extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-diff -urNp linux-2.6.32.13/include/linux/tty_ldisc.h linux-2.6.32.13/include/linux/tty_ldisc.h
---- linux-2.6.32.13/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/tty_ldisc.h	2010-05-15 13:21:17.950606770 -0400
-@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
- 
- 	struct  module *owner;
- 	
--	int refcount;
-+	atomic_t refcount;
- };
- 
- struct tty_ldisc {
-diff -urNp linux-2.6.32.13/include/linux/types.h linux-2.6.32.13/include/linux/types.h
---- linux-2.6.32.13/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/types.h	2010-05-15 13:21:17.956129899 -0400
-@@ -191,10 +191,26 @@ typedef struct {
- 	volatile int counter;
- } atomic_t;
- 
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile int counter;
-+} atomic_unchecked_t;
-+#else
-+typedef atomic_t atomic_unchecked_t;
-+#endif
-+
- #ifdef CONFIG_64BIT
- typedef struct {
- 	volatile long counter;
- } atomic64_t;
-+
-+#ifdef CONFIG_PAX_REFCOUNT
-+typedef struct {
-+	volatile long counter;
-+} atomic64_unchecked_t;
-+#else
-+typedef atomic64_t atomic64_unchecked_t;
-+#endif
- #endif
- 
- struct ustat {
-diff -urNp linux-2.6.32.13/include/linux/uaccess.h linux-2.6.32.13/include/linux/uaccess.h
---- linux-2.6.32.13/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/uaccess.h	2010-05-15 13:21:17.956129899 -0400
-@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
- 		long ret;				\
- 		mm_segment_t old_fs = get_fs();		\
- 							\
--		set_fs(KERNEL_DS);			\
- 		pagefault_disable();			\
-+		set_fs(KERNEL_DS);			\
- 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
--		pagefault_enable();			\
- 		set_fs(old_fs);				\
-+		pagefault_enable();			\
- 		ret;					\
- 	})
- 
-@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_read(void *dst, void *src, size_t size);
-+extern long probe_kernel_read(void *dst, const void *src, size_t size);
- 
- /*
-  * probe_kernel_write(): safely attempt to write to a location
-@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--extern long probe_kernel_write(void *dst, void *src, size_t size);
-+extern long probe_kernel_write(void *dst, const void *src, size_t size);
- 
- #endif		/* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.32.13/include/linux/vmalloc.h linux-2.6.32.13/include/linux/vmalloc.h
---- linux-2.6.32.13/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/linux/vmalloc.h	2010-05-15 13:23:38.934774262 -0400
-@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
- #define VM_MAP		0x00000004	/* vmap()ed pages */
- #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
- #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
-+#endif
-+
- /* bits [20..32] reserved for arch specific ioremap internals */
- 
- /*
-@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
- 
- void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
- 
-+#define vmalloc(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define __vmalloc(x, y, z)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = __vmalloc((unsigned long)___x, (y), (z));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_user(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_user((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_exec(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_exec((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_node(x, y)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_node((unsigned long)___x, (y));\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32(x)						\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32((unsigned long)___x);	\
-+	___retval;						\
-+})
-+
-+#define vmalloc_32_user(x)					\
-+({								\
-+	void *___retval;					\
-+	intoverflow_t ___x = (intoverflow_t)x;			\
-+	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
-+		___retval = NULL;				\
-+	else							\
-+		___retval = vmalloc_32_user((unsigned long)___x);\
-+	___retval;						\
-+})
-+
- #endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.32.13/include/net/irda/ircomm_tty.h linux-2.6.32.13/include/net/irda/ircomm_tty.h
---- linux-2.6.32.13/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/net/irda/ircomm_tty.h	2010-05-15 13:21:17.956129899 -0400
-@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
-         unsigned short    close_delay;
-         unsigned short    closing_wait; /* time to wait before closing */
- 
--	int  open_count;
--	int  blocked_open;	/* # of blocked opens */
-+	atomic_t open_count;
-+	atomic_t blocked_open;	/* # of blocked opens */
- 
- 	/* Protect concurent access to :
- 	 *	o self->open_count
-diff -urNp linux-2.6.32.13/include/net/neighbour.h linux-2.6.32.13/include/net/neighbour.h
---- linux-2.6.32.13/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/net/neighbour.h	2010-05-15 13:21:17.956129899 -0400
-@@ -125,12 +125,12 @@ struct neighbour
- struct neigh_ops
- {
- 	int			family;
--	void			(*solicit)(struct neighbour *, struct sk_buff*);
--	void			(*error_report)(struct neighbour *, struct sk_buff*);
--	int			(*output)(struct sk_buff*);
--	int			(*connected_output)(struct sk_buff*);
--	int			(*hh_output)(struct sk_buff*);
--	int			(*queue_xmit)(struct sk_buff*);
-+	void			(* const solicit)(struct neighbour *, struct sk_buff*);
-+	void			(* const error_report)(struct neighbour *, struct sk_buff*);
-+	int			(* const output)(struct sk_buff*);
-+	int			(* const connected_output)(struct sk_buff*);
-+	int			(* const hh_output)(struct sk_buff*);
-+	int			(* const queue_xmit)(struct sk_buff*);
- };
- 
- struct pneigh_entry
-diff -urNp linux-2.6.32.13/include/net/sctp/sctp.h linux-2.6.32.13/include/net/sctp/sctp.h
---- linux-2.6.32.13/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/net/sctp/sctp.h	2010-05-15 13:21:17.956129899 -0400
-@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
- 
- #else	/* SCTP_DEBUG */
- 
--#define SCTP_DEBUG_PRINTK(whatever...)
--#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
-+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
-+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
- #define SCTP_ENABLE_DEBUG
- #define SCTP_DISABLE_DEBUG
- #define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.32.13/include/net/tcp.h linux-2.6.32.13/include/net/tcp.h
---- linux-2.6.32.13/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/net/tcp.h	2010-05-15 13:21:17.956129899 -0400
-@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
- struct tcp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.13/include/net/udp.h linux-2.6.32.13/include/net/udp.h
---- linux-2.6.32.13/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/net/udp.h	2010-05-15 13:21:17.956129899 -0400
-@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
- 	char			*name;
- 	sa_family_t		family;
- 	struct udp_table	*udp_table;
-+	/* cannot be const */
- 	struct file_operations	seq_fops;
- 	struct seq_operations	seq_ops;
- };
-diff -urNp linux-2.6.32.13/include/sound/ac97_codec.h linux-2.6.32.13/include/sound/ac97_codec.h
---- linux-2.6.32.13/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/sound/ac97_codec.h	2010-05-15 13:21:17.956129899 -0400
-@@ -419,15 +419,15 @@
- struct snd_ac97;
- 
- struct snd_ac97_build_ops {
--	int (*build_3d) (struct snd_ac97 *ac97);
--	int (*build_specific) (struct snd_ac97 *ac97);
--	int (*build_spdif) (struct snd_ac97 *ac97);
--	int (*build_post_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_3d) (struct snd_ac97 *ac97);
-+	int (* const build_specific) (struct snd_ac97 *ac97);
-+	int (* const build_spdif) (struct snd_ac97 *ac97);
-+	int (* const build_post_spdif) (struct snd_ac97 *ac97);
- #ifdef CONFIG_PM
--	void (*suspend) (struct snd_ac97 *ac97);
--	void (*resume) (struct snd_ac97 *ac97);
-+	void (* const suspend) (struct snd_ac97 *ac97);
-+	void (* const resume) (struct snd_ac97 *ac97);
- #endif
--	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
-+	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
- };
- 
- struct snd_ac97_bus_ops {
-@@ -477,7 +477,7 @@ struct snd_ac97_template {
- 
- struct snd_ac97 {
- 	/* -- lowlevel (hardware) driver specific -- */
--	struct snd_ac97_build_ops * build_ops;
-+	const struct snd_ac97_build_ops * build_ops;
- 	void *private_data;
- 	void (*private_free) (struct snd_ac97 *ac97);
- 	/* --- */
-diff -urNp linux-2.6.32.13/include/trace/events/irq.h linux-2.6.32.13/include/trace/events/irq.h
---- linux-2.6.32.13/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/trace/events/irq.h	2010-05-15 13:21:17.956129899 -0400
-@@ -34,7 +34,7 @@
-  */
- TRACE_EVENT(irq_handler_entry,
- 
--	TP_PROTO(int irq, struct irqaction *action),
-+	TP_PROTO(int irq, const struct irqaction *action),
- 
- 	TP_ARGS(irq, action),
- 
-@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
-  */
- TRACE_EVENT(irq_handler_exit,
- 
--	TP_PROTO(int irq, struct irqaction *action, int ret),
-+	TP_PROTO(int irq, const struct irqaction *action, int ret),
- 
- 	TP_ARGS(irq, action, ret),
- 
-@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
-  */
- TRACE_EVENT(softirq_entry,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
-  */
- TRACE_EVENT(softirq_exit,
- 
--	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
-+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
- 
- 	TP_ARGS(h, vec),
- 
-diff -urNp linux-2.6.32.13/include/video/uvesafb.h linux-2.6.32.13/include/video/uvesafb.h
---- linux-2.6.32.13/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/include/video/uvesafb.h	2010-05-15 13:21:17.956129899 -0400
-@@ -177,6 +177,7 @@ struct uvesafb_par {
- 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
- 	u8 pmi_setpal;			/* PMI for palette changes */
- 	u16 *pmi_base;			/* protected mode interface location */
-+	u8 *pmi_code;			/* protected mode code location */
- 	void *pmi_start;
- 	void *pmi_pal;
- 	u8 *vbe_state_orig;		/*
-diff -urNp linux-2.6.32.13/init/do_mounts.c linux-2.6.32.13/init/do_mounts.c
---- linux-2.6.32.13/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/do_mounts.c	2010-05-15 13:21:17.956129899 -0400
-@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
- 
- static int __init do_mount_root(char *name, char *fs, int flags, void *data)
- {
--	int err = sys_mount(name, "/root", fs, flags, data);
-+	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
- 	if (err)
- 		return err;
- 
--	sys_chdir("/root");
-+	sys_chdir((__force char __user *)"/root");
- 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
- 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
- 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
-@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
- 	va_start(args, fmt);
- 	vsprintf(buf, fmt, args);
- 	va_end(args);
--	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
-+	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, FDEJECT, 0);
- 		sys_close(fd);
- 	}
- 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
--	fd = sys_open("/dev/console", O_RDWR, 0);
-+	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, TCGETS, (long)&termios);
- 		termios.c_lflag &= ~ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
--		sys_read(fd, &c, 1);
-+		sys_read(fd, (char __user *)&c, 1);
- 		termios.c_lflag |= ICANON;
- 		sys_ioctl(fd, TCSETSF, (long)&termios);
- 		sys_close(fd);
-@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
- 	mount_root();
- out:
- 	devtmpfs_mount("dev");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force char __user *)".");
- }
-diff -urNp linux-2.6.32.13/init/do_mounts.h linux-2.6.32.13/init/do_mounts.h
---- linux-2.6.32.13/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/do_mounts.h	2010-05-15 13:21:18.018620095 -0400
-@@ -15,15 +15,15 @@ extern int root_mountflags;
- 
- static inline int create_dev(char *name, dev_t dev)
- {
--	sys_unlink(name);
--	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
-+	sys_unlink((__force char __user *)name);
-+	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
- }
- 
- #if BITS_PER_LONG == 32
- static inline u32 bstat(char *name)
- {
- 	struct stat64 stat;
--	if (sys_stat64(name, &stat) != 0)
-+	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
- 		return 0;
- 	if (!S_ISBLK(stat.st_mode))
- 		return 0;
-diff -urNp linux-2.6.32.13/init/do_mounts_initrd.c linux-2.6.32.13/init/do_mounts_initrd.c
---- linux-2.6.32.13/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/do_mounts_initrd.c	2010-05-15 13:21:18.018620095 -0400
-@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
- 	sys_close(old_fd);sys_close(root_fd);
- 	sys_close(0);sys_close(1);sys_close(2);
- 	sys_setsid();
--	(void) sys_open("/dev/console",O_RDWR,0);
-+	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
- 	(void) sys_dup(0);
- 	(void) sys_dup(0);
- 	return kernel_execve(shell, argv, envp_init);
-@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
- 	create_dev("/dev/root.old", Root_RAM0);
- 	/* mount initrd on rootfs' /root */
- 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
--	sys_mkdir("/old", 0700);
--	root_fd = sys_open("/", 0, 0);
--	old_fd = sys_open("/old", 0, 0);
-+	sys_mkdir((__force const char __user *)"/old", 0700);
-+	root_fd = sys_open((__force const char __user *)"/", 0, 0);
-+	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
- 	/* move initrd over / and chdir/chroot in initrd root */
--	sys_chdir("/root");
--	sys_mount(".", "/", NULL, MS_MOVE, NULL);
--	sys_chroot(".");
-+	sys_chdir((__force const char __user *)"/root");
-+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
-+	sys_chroot((__force const char __user *)".");
- 
- 	/*
- 	 * In case that a resume from disk is carried out by linuxrc or one of
-@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
- 
- 	/* move initrd to rootfs' /old */
- 	sys_fchdir(old_fd);
--	sys_mount("/", ".", NULL, MS_MOVE, NULL);
-+	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
- 	/* switch root and cwd back to / of rootfs */
- 	sys_fchdir(root_fd);
--	sys_chroot(".");
-+	sys_chroot((__force const char __user *)".");
- 	sys_close(old_fd);
- 	sys_close(root_fd);
- 
- 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
--		sys_chdir("/old");
-+		sys_chdir((__force const char __user *)"/old");
- 		return;
- 	}
- 
-@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
- 	mount_root();
- 
- 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
--	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
-+	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
- 	if (!error)
- 		printk("okay\n");
- 	else {
--		int fd = sys_open("/dev/root.old", O_RDWR, 0);
-+		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
- 		if (error == -ENOENT)
- 			printk("/initrd does not exist. Ignored.\n");
- 		else
- 			printk("failed\n");
- 		printk(KERN_NOTICE "Unmounting old root\n");
--		sys_umount("/old", MNT_DETACH);
-+		sys_umount((__force char __user *)"/old", MNT_DETACH);
- 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
- 		if (fd < 0) {
- 			error = fd;
-@@ -119,11 +119,11 @@ int __init initrd_load(void)
- 		 * mounted in the normal path.
- 		 */
- 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
--			sys_unlink("/initrd.image");
-+			sys_unlink((__force const char __user *)"/initrd.image");
- 			handle_initrd();
- 			return 1;
- 		}
- 	}
--	sys_unlink("/initrd.image");
-+	sys_unlink((__force const char __user *)"/initrd.image");
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/init/do_mounts_md.c linux-2.6.32.13/init/do_mounts_md.c
---- linux-2.6.32.13/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/do_mounts_md.c	2010-05-15 13:21:18.018620095 -0400
-@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
- 			partitioned ? "_d" : "", minor,
- 			md_setup_args[ent].device_names);
- 
--		fd = sys_open(name, 0, 0);
-+		fd = sys_open((__force char __user *)name, 0, 0);
- 		if (fd < 0) {
- 			printk(KERN_ERR "md: open failed - cannot start "
- 					"array %s\n", name);
-@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
- 			 * array without it
- 			 */
- 			sys_close(fd);
--			fd = sys_open(name, 0, 0);
-+			fd = sys_open((__force char __user *)name, 0, 0);
- 			sys_ioctl(fd, BLKRRPART, 0);
- 		}
- 		sys_close(fd);
-@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
- 
- 	wait_for_device_probe();
- 
--	fd = sys_open("/dev/md0", 0, 0);
-+	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
- 	if (fd >= 0) {
- 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
- 		sys_close(fd);
-diff -urNp linux-2.6.32.13/init/initramfs.c linux-2.6.32.13/init/initramfs.c
---- linux-2.6.32.13/init/initramfs.c	2010-05-15 13:20:19.362999772 -0400
-+++ linux-2.6.32.13/init/initramfs.c	2010-05-15 13:21:18.018620095 -0400
-@@ -74,7 +74,7 @@ static void __init free_hash(void)
- 	}
- }
- 
--static long __init do_utime(char __user *filename, time_t mtime)
-+static long __init do_utime(__force char __user *filename, time_t mtime)
- {
- 	struct timespec t[2];
- 
-@@ -109,7 +109,7 @@ static void __init dir_utime(void)
- 	struct dir_entry *de, *tmp;
- 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
- 		list_del(&de->list);
--		do_utime(de->name, de->mtime);
-+		do_utime((__force char __user *)de->name, de->mtime);
- 		kfree(de->name);
- 		kfree(de);
- 	}
-@@ -271,7 +271,7 @@ static int __init maybe_link(void)
- 	if (nlink >= 2) {
- 		char *old = find_link(major, minor, ino, mode, collected);
- 		if (old)
--			return (sys_link(old, collected) < 0) ? -1 : 1;
-+			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
- 	}
- 	return 0;
- }
-@@ -280,11 +280,11 @@ static void __init clean_path(char *path
- {
- 	struct stat st;
- 
--	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
-+	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
- 		if (S_ISDIR(st.st_mode))
--			sys_rmdir(path);
-+			sys_rmdir((__force char __user *)path);
- 		else
--			sys_unlink(path);
-+			sys_unlink((__force char __user *)path);
- 	}
- }
- 
-@@ -305,7 +305,7 @@ static int __init do_name(void)
- 			int openflags = O_WRONLY|O_CREAT;
- 			if (ml != 1)
- 				openflags |= O_TRUNC;
--			wfd = sys_open(collected, openflags, mode);
-+			wfd = sys_open((__force char __user *)collected, openflags, mode);
- 
- 			if (wfd >= 0) {
- 				sys_fchown(wfd, uid, gid);
-@@ -317,17 +317,17 @@ static int __init do_name(void)
- 			}
- 		}
- 	} else if (S_ISDIR(mode)) {
--		sys_mkdir(collected, mode);
--		sys_chown(collected, uid, gid);
--		sys_chmod(collected, mode);
-+		sys_mkdir((__force char __user *)collected, mode);
-+		sys_chown((__force char __user *)collected, uid, gid);
-+		sys_chmod((__force char __user *)collected, mode);
- 		dir_add(collected, mtime);
- 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
- 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
- 		if (maybe_link() == 0) {
--			sys_mknod(collected, mode, rdev);
--			sys_chown(collected, uid, gid);
--			sys_chmod(collected, mode);
--			do_utime(collected, mtime);
-+			sys_mknod((__force char __user *)collected, mode, rdev);
-+			sys_chown((__force char __user *)collected, uid, gid);
-+			sys_chmod((__force char __user *)collected, mode);
-+			do_utime((__force char __user *)collected, mtime);
- 		}
- 	}
- 	return 0;
-@@ -336,15 +336,15 @@ static int __init do_name(void)
- static int __init do_copy(void)
- {
- 	if (count >= body_len) {
--		sys_write(wfd, victim, body_len);
-+		sys_write(wfd, (__force char __user *)victim, body_len);
- 		sys_close(wfd);
--		do_utime(vcollected, mtime);
-+		do_utime((__force char __user *)vcollected, mtime);
- 		kfree(vcollected);
- 		eat(body_len);
- 		state = SkipIt;
- 		return 0;
- 	} else {
--		sys_write(wfd, victim, count);
-+		sys_write(wfd, (__force char __user *)victim, count);
- 		body_len -= count;
- 		eat(count);
- 		return 1;
-@@ -355,9 +355,9 @@ static int __init do_symlink(void)
- {
- 	collected[N_ALIGN(name_len) + body_len] = '\0';
- 	clean_path(collected, 0);
--	sys_symlink(collected + N_ALIGN(name_len), collected);
--	sys_lchown(collected, uid, gid);
--	do_utime(collected, mtime);
-+	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
-+	sys_lchown((__force char __user *)collected, uid, gid);
-+	do_utime((__force char __user *)collected, mtime);
- 	state = SkipIt;
- 	next_state = Reset;
- 	return 0;
-diff -urNp linux-2.6.32.13/init/Kconfig linux-2.6.32.13/init/Kconfig
---- linux-2.6.32.13/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/Kconfig	2010-05-15 13:21:18.034611512 -0400
-@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
- 
- config COMPAT_BRK
- 	bool "Disable heap randomization"
--	default y
-+	default n
- 	help
- 	  Randomizing heap placement makes heap exploits harder, but it
- 	  also breaks ancient binaries (including anything libc5 based).
-@@ -1116,9 +1116,9 @@ config HAVE_GENERIC_DMA_COHERENT
- 
- config SLABINFO
- 	bool
--	depends on PROC_FS
-+	depends on PROC_FS && !GRKERNSEC_PROC_ADD
- 	depends on SLAB || SLUB_DEBUG
--	default y
-+	default n
- 
- config RT_MUTEXES
- 	boolean
-diff -urNp linux-2.6.32.13/init/main.c linux-2.6.32.13/init/main.c
---- linux-2.6.32.13/init/main.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.13/init/main.c	2010-05-15 13:21:18.034611512 -0400
-@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
- #ifdef CONFIG_TC
- extern void tc_init(void);
- #endif
-+extern void grsecurity_init(void);
- 
- enum system_states system_state __read_mostly;
- EXPORT_SYMBOL(system_state);
-@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
- 
- __setup("reset_devices", set_reset_devices);
- 
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+extern void pax_enter_kernel_user(void);
-+extern void pax_exit_kernel_user(void);
-+extern pteval_t clone_pgd_mask;
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+	unsigned int cpu;
-+
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+	}
-+	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
-+	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
-+#else
-+	char *p;
-+	p = (char *)pax_enter_kernel_user;
-+	*p = 0xc3;
-+	p = (char *)pax_exit_kernel_user;
-+	*p = 0xc3;
-+	clone_pgd_mask = ~(pteval_t)0UL;
-+#endif
-+
-+	return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+unsigned int pax_softmode;
-+
-+static int __init setup_pax_softmode(char *str)
-+{
-+	get_option(&str, &pax_softmode);
-+	return 1;
-+}
-+__setup("pax_softmode=", setup_pax_softmode);
-+#endif
-+
- static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
- char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
- static const char *panic_later, *panic_param;
-@@ -697,52 +742,53 @@ int initcall_debug;
- core_param(initcall_debug, initcall_debug, bool, 0644);
- 
- static char msgbuf[64];
--static struct boot_trace_call call;
--static struct boot_trace_ret ret;
-+static struct boot_trace_call trace_call;
-+static struct boot_trace_ret trace_ret;
- 
- int do_one_initcall(initcall_t fn)
- {
- 	int count = preempt_count();
- 	ktime_t calltime, delta, rettime;
-+	const char *msg1 = "", *msg2 = "";
- 
- 	if (initcall_debug) {
--		call.caller = task_pid_nr(current);
--		printk("calling  %pF @ %i\n", fn, call.caller);
-+		trace_call.caller = task_pid_nr(current);
-+		printk("calling  %pF @ %i\n", fn, trace_call.caller);
- 		calltime = ktime_get();
--		trace_boot_call(&call, fn);
-+		trace_boot_call(&trace_call, fn);
- 		enable_boot_trace();
- 	}
- 
--	ret.result = fn();
-+	trace_ret.result = fn();
- 
- 	if (initcall_debug) {
- 		disable_boot_trace();
- 		rettime = ktime_get();
- 		delta = ktime_sub(rettime, calltime);
--		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
--		trace_boot_ret(&ret, fn);
-+		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-+		trace_boot_ret(&trace_ret, fn);
- 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
--			ret.result, ret.duration);
-+			trace_ret.result, trace_ret.duration);
- 	}
- 
- 	msgbuf[0] = 0;
- 
--	if (ret.result && ret.result != -ENODEV && initcall_debug)
--		sprintf(msgbuf, "error code %d ", ret.result);
-+	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
-+		sprintf(msgbuf, "error code %d ", trace_ret.result);
- 
- 	if (preempt_count() != count) {
--		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
-+		msg1 = " preemption imbalance";
- 		preempt_count() = count;
- 	}
- 	if (irqs_disabled()) {
--		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
-+		msg2 = " disabled interrupts";
- 		local_irq_enable();
- 	}
--	if (msgbuf[0]) {
--		printk("initcall %pF returned with %s\n", fn, msgbuf);
-+	if (msgbuf[0] || *msg1 || *msg2) {
-+		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
- 	}
- 
--	return ret.result;
-+	return trace_ret.result;
- }
- 
- 
-@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
- 	if (!ramdisk_execute_command)
- 		ramdisk_execute_command = "/init";
- 
--	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
-+	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
- 		ramdisk_execute_command = NULL;
- 		prepare_namespace();
- 	}
- 
-+	grsecurity_init();
-+
- 	/*
- 	 * Ok, we have completed the initial bootup, and
- 	 * we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.32.13/init/noinitramfs.c linux-2.6.32.13/init/noinitramfs.c
---- linux-2.6.32.13/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/init/noinitramfs.c	2010-05-15 13:21:18.034611512 -0400
-@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
- {
- 	int err;
- 
--	err = sys_mkdir("/dev", 0755);
-+	err = sys_mkdir((const char __user *)"/dev", 0755);
- 	if (err < 0)
- 		goto out;
- 
-@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
- 	if (err < 0)
- 		goto out;
- 
--	err = sys_mkdir("/root", 0700);
-+	err = sys_mkdir((const char __user *)"/root", 0700);
- 	if (err < 0)
- 		goto out;
- 
-diff -urNp linux-2.6.32.13/ipc/ipc_sysctl.c linux-2.6.32.13/ipc/ipc_sysctl.c
---- linux-2.6.32.13/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/ipc/ipc_sysctl.c	2010-05-15 13:21:18.060013842 -0400
-@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
- 		.extra1		= &zero,
- 		.extra2		= &one,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table ipc_root_table[] = {
-@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
- 		.mode		= 0555,
- 		.child		= ipc_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init ipc_sysctl_init(void)
-diff -urNp linux-2.6.32.13/ipc/mqueue.c linux-2.6.32.13/ipc/mqueue.c
---- linux-2.6.32.13/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
-+++ linux-2.6.32.13/ipc/mqueue.c	2010-05-15 13:21:18.060013842 -0400
-@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
- 			mq_bytes = (mq_msg_tblsz +
- 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
- 
-+			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
- 			spin_lock(&mq_lock);
- 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
- 		 	    u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.32.13/ipc/shm.c linux-2.6.32.13/ipc/shm.c
---- linux-2.6.32.13/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/ipc/shm.c	2010-05-15 13:21:18.060013842 -0400
-@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
- static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
- #endif
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime, const uid_t cuid,
-+			   const int shmid);
-+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
-+			   const time_t shm_createtime);
-+#endif
-+
- void shm_init_ns(struct ipc_namespace *ns)
- {
- 	ns->shm_ctlmax = SHMMAX;
-@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
- 	shp->shm_lprid = 0;
- 	shp->shm_atim = shp->shm_dtim = 0;
- 	shp->shm_ctim = get_seconds();
-+#ifdef CONFIG_GRKERNSEC
-+	{
-+		struct timespec timeval;
-+		do_posix_clock_monotonic_gettime(&timeval);
-+
-+		shp->shm_createtime = timeval.tv_sec;
-+	}
-+#endif
- 	shp->shm_segsz = size;
- 	shp->shm_nattch = 0;
- 	shp->shm_file = file;
-@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
- 	if (err)
- 		goto out_unlock;
- 
-+#ifdef CONFIG_GRKERNSEC
-+	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
-+			     shp->shm_perm.cuid, shmid) ||
-+	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
-+		err = -EACCES;
-+		goto out_unlock;
-+	}
-+#endif
-+
- 	path.dentry = dget(shp->shm_file->f_path.dentry);
- 	path.mnt    = shp->shm_file->f_path.mnt;
- 	shp->shm_nattch++;
-+#ifdef CONFIG_GRKERNSEC
-+	shp->shm_lapid = current->pid;
-+#endif
- 	size = i_size_read(path.dentry->d_inode);
- 	shm_unlock(shp);
- 
-diff -urNp linux-2.6.32.13/kernel/acct.c linux-2.6.32.13/kernel/acct.c
---- linux-2.6.32.13/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/acct.c	2010-05-15 13:21:18.060013842 -0400
-@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
- 	 */
- 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
--	file->f_op->write(file, (char *)&ac,
-+	file->f_op->write(file, (__force char __user *)&ac,
- 			       sizeof(acct_t), &file->f_pos);
- 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
- 	set_fs(fs);
-diff -urNp linux-2.6.32.13/kernel/capability.c linux-2.6.32.13/kernel/capability.c
---- linux-2.6.32.13/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/capability.c	2010-05-15 13:21:18.079122751 -0400
-@@ -306,10 +306,21 @@ int capable(int cap)
- 		BUG();
- 	}
- 
--	if (security_capable(cap) == 0) {
-+	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
- 		current->flags |= PF_SUPERPRIV;
- 		return 1;
- 	}
- 	return 0;
- }
-+
-+int capable_nolog(int cap)
-+{
-+	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
-+		current->flags |= PF_SUPERPRIV;
-+		return 1;
-+	}
-+	return 0;
-+}
-+
- EXPORT_SYMBOL(capable);
-+EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.32.13/kernel/configs.c linux-2.6.32.13/kernel/configs.c
---- linux-2.6.32.13/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/configs.c	2010-05-15 13:21:18.079122751 -0400
-@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
- 	struct proc_dir_entry *entry;
- 
- 	/* create the current config file */
-+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
-+			    &ikconfig_file_ops);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
-+			    &ikconfig_file_ops);
-+#endif
-+#else
- 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
- 			    &ikconfig_file_ops);
-+#endif
-+
- 	if (!entry)
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.13/kernel/cpu.c linux-2.6.32.13/kernel/cpu.c
---- linux-2.6.32.13/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/cpu.c	2010-05-15 13:21:18.079122751 -0400
-@@ -19,7 +19,7 @@
- /* Serializes the updates to cpu_online_mask, cpu_present_mask */
- static DEFINE_MUTEX(cpu_add_remove_lock);
- 
--static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
-+static RAW_NOTIFIER_HEAD(cpu_chain);
- 
- /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
-  * Should always be manipulated under cpu_add_remove_lock
-diff -urNp linux-2.6.32.13/kernel/cred.c linux-2.6.32.13/kernel/cred.c
---- linux-2.6.32.13/kernel/cred.c	2010-05-15 13:20:19.362999772 -0400
-+++ linux-2.6.32.13/kernel/cred.c	2010-05-15 13:21:18.079122751 -0400
-@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
- 
- 	get_cred(new); /* we will require a ref for the subj creds too */
- 
-+	gr_set_role_label(task, new->uid, new->gid);
-+
- 	/* dumpability changes */
- 	if (old->euid != new->euid ||
- 	    old->egid != new->egid ||
-diff -urNp linux-2.6.32.13/kernel/exit.c linux-2.6.32.13/kernel/exit.c
---- linux-2.6.32.13/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/exit.c	2010-05-15 13:21:18.103069718 -0400
-@@ -56,6 +56,10 @@
- #include <asm/mmu_context.h>
- #include "cred-internals.h"
- 
-+#ifdef CONFIG_GRKERNSEC
-+extern rwlock_t grsec_exec_file_lock;
-+#endif
-+
- static void exit_mm(struct task_struct * tsk);
- 
- static void __unhash_process(struct task_struct *p)
-@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
- 	struct task_struct *leader;
- 	int zap_leader;
- repeat:
-+	gr_del_task_from_ip_table(p);
-+
- 	tracehook_prepare_release_task(p);
- 	/* don't need to get the RCU readlock here - the process is dead and
- 	 * can't be modifying its own credentials */
-@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
- {
- 	write_lock_irq(&tasklist_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
- 	ptrace_unlink(current);
- 	/* Reparent to init */
- 	current->real_parent = current->parent = kthreadd_task;
- 	list_move_tail(&current->sibling, &current->real_parent->children);
- 
-+	gr_set_kernel_label(current);
-+
- 	/* Set the exit signal to SIGCHLD so we signal init on exit */
- 	current->exit_signal = SIGCHLD;
- 
-@@ -390,7 +407,7 @@ int allow_signal(int sig)
- 	 * know it'll be handled, so that they don't get converted to
- 	 * SIGKILL or just silently dropped.
- 	 */
--	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
-+	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
- 	recalc_sigpending();
- 	spin_unlock_irq(&current->sighand->siglock);
- 	return 0;
-@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
- 	vsnprintf(current->comm, sizeof(current->comm), name, args);
- 	va_end(args);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	write_lock(&grsec_exec_file_lock);
-+	if (current->exec_file) {
-+		fput(current->exec_file);
-+		current->exec_file = NULL;
-+	}
-+	write_unlock(&grsec_exec_file_lock);
-+#endif
-+
-+	gr_set_kernel_label(current);
-+
- 	/*
- 	 * If we were started as result of loading a module, close all of the
- 	 * user space pages.  We don't need them, and if we didn't close them
-@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
- 	tsk->exit_code = code;
- 	taskstats_exit(tsk, group_dead);
- 
-+	gr_acl_handle_psacct(tsk, code);
-+	gr_acl_handle_exit();
-+
- 	exit_mm(tsk);
- 
- 	if (group_dead)
-@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
- 
- 	if (unlikely(wo->wo_flags & WNOWAIT)) {
- 		int exit_code = p->exit_code;
--		int why, status;
-+		int why;
- 
- 		get_task_struct(p);
- 		read_unlock(&tasklist_lock);
-diff -urNp linux-2.6.32.13/kernel/fork.c linux-2.6.32.13/kernel/fork.c
---- linux-2.6.32.13/kernel/fork.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/fork.c	2010-05-15 13:21:18.103069718 -0400
-@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
- 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
- 
- #ifdef CONFIG_CC_STACKPROTECTOR
--	tsk->stack_canary = get_random_int();
-+	tsk->stack_canary = pax_get_random_long();
- #endif
- 
- 	/* One for us, one for whoever does the "release_task()" (usually parent) */
-@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
- 	mm->locked_vm = 0;
- 	mm->mmap = NULL;
- 	mm->mmap_cache = NULL;
--	mm->free_area_cache = oldmm->mmap_base;
--	mm->cached_hole_size = ~0UL;
-+	mm->free_area_cache = oldmm->free_area_cache;
-+	mm->cached_hole_size = oldmm->cached_hole_size;
- 	mm->map_count = 0;
- 	cpumask_clear(mm_cpumask(mm));
- 	mm->mm_rb = RB_ROOT;
-@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
- 		tmp->vm_flags &= ~VM_LOCKED;
- 		tmp->vm_mm = mm;
- 		tmp->vm_next = NULL;
-+		tmp->vm_mirror = NULL;
- 		anon_vma_link(tmp);
- 		file = tmp->vm_file;
- 		if (file) {
-@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
- 		if (retval)
- 			goto out;
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
-+		struct vm_area_struct *mpnt_m;
-+
-+		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
-+			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
-+
-+			if (!mpnt->vm_mirror)
-+				continue;
-+
-+			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
-+				mpnt->vm_mirror = mpnt_m;
-+			} else {
-+				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
-+				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
-+				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
-+				mpnt->vm_mirror->vm_mirror = mpnt;
-+			}
-+		}
-+		BUG_ON(mpnt_m);
-+	}
-+#endif
-+
- 	/* a new mm has just been created */
- 	arch_dup_mmap(oldmm, mm);
- 	retval = 0;
-@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
- 			write_unlock(&fs->lock);
- 			return -EAGAIN;
- 		}
--		fs->users++;
-+		atomic_inc(&fs->users);
- 		write_unlock(&fs->lock);
- 		return 0;
- 	}
-@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
- 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
- #endif
- 	retval = -EAGAIN;
-+
-+	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
-+
- 	if (atomic_read(&p->real_cred->user->processes) >=
- 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
--		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
--		    p->real_cred->user != INIT_USER)
-+		if (p->real_cred->user != INIT_USER &&
-+		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
- 			goto bad_fork_free;
- 	}
- 
-@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
- 	p->vfork_done = NULL;
- 	spin_lock_init(&p->alloc_lock);
- 
-+#ifdef CONFIG_GRKERNSEC
-+	rwlock_init(&p->gr_fs_lock);
-+#endif
-+
- 	init_sigpending(&p->pending);
- 
- 	p->utime = cputime_zero;
-@@ -1179,6 +1212,8 @@ static struct task_struct *copy_process(
- 			goto bad_fork_free_pid;
- 	}
- 
-+	gr_copy_label(p);
-+
- 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
- 	/*
- 	 * Clear TID on mm_release()?
-@@ -1344,6 +1379,8 @@ bad_fork_cleanup_count:
- bad_fork_free:
- 	free_task(p);
- fork_out:
-+	gr_log_forkfail(retval);
-+
- 	return ERR_PTR(retval);
- }
- 
-@@ -1437,6 +1474,8 @@ long do_fork(unsigned long clone_flags,
- 		if (clone_flags & CLONE_PARENT_SETTID)
- 			put_user(nr, parent_tidptr);
- 
-+		gr_handle_brute_check();
-+
- 		if (clone_flags & CLONE_VFORK) {
- 			p->vfork_done = &vfork;
- 			init_completion(&vfork);
-@@ -1569,7 +1608,7 @@ static int unshare_fs(unsigned long unsh
- 		return 0;
- 
- 	/* don't need lock here; in the worst case we'll do useless copy */
--	if (fs->users == 1)
-+	if (atomic_read(&fs->users) == 1)
- 		return 0;
- 
- 	*new_fsp = copy_fs_struct(fs);
-@@ -1689,14 +1728,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
- 		task_lock(current);
- 
- 		if (new_fs) {
-+			unsigned long flags;
-+
-+			gr_fs_write_lock_irqsave(current, flags);
- 			fs = current->fs;
- 			write_lock(&fs->lock);
- 			current->fs = new_fs;
--			if (--fs->users)
-+			if (atomic_dec_return(&fs->users))
- 				new_fs = NULL;
- 			else
- 				new_fs = fs;
- 			write_unlock(&fs->lock);
-+			gr_fs_write_unlock_irqrestore(current, flags);
- 		}
- 
- 		if (new_mm) {
-diff -urNp linux-2.6.32.13/kernel/futex.c linux-2.6.32.13/kernel/futex.c
---- linux-2.6.32.13/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/futex.c	2010-05-15 13:21:18.106616956 -0400
-@@ -54,6 +54,7 @@
- #include <linux/mount.h>
- #include <linux/pagemap.h>
- #include <linux/syscalls.h>
-+#include <linux/ptrace.h>
- #include <linux/signal.h>
- #include <linux/module.h>
- #include <linux/magic.h>
-@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
- 	struct page *page;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
-+		return -EFAULT;
-+#endif
-+
- 	/*
- 	 * The futex address must be "naturally" aligned.
- 	 */
-@@ -1852,7 +1858,7 @@ retry:
- 
- 	restart = &current_thread_info()->restart_block;
- 	restart->fn = futex_wait_restart;
--	restart->futex.uaddr = (u32 *)uaddr;
-+	restart->futex.uaddr = uaddr;
- 	restart->futex.val = val;
- 	restart->futex.time = abs_time->tv64;
- 	restart->futex.bitset = bitset;
-@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- {
- 	struct robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *cred = current_cred();
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->robust_list;
- 		rcu_read_unlock();
- 	}
-@@ -2467,7 +2481,7 @@ retry:
-  */
- static inline int fetch_robust_entry(struct robust_list __user **entry,
- 				     struct robust_list __user * __user *head,
--				     int *pi)
-+				     unsigned int *pi)
- {
- 	unsigned long uentry;
- 
-diff -urNp linux-2.6.32.13/kernel/futex_compat.c linux-2.6.32.13/kernel/futex_compat.c
---- linux-2.6.32.13/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/futex_compat.c	2010-05-15 13:21:18.106616956 -0400
-@@ -10,6 +10,7 @@
- #include <linux/compat.h>
- #include <linux/nsproxy.h>
- #include <linux/futex.h>
-+#include <linux/ptrace.h>
- 
- #include <asm/uaccess.h>
- 
-@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
- {
- 	struct compat_robust_list_head __user *head;
- 	unsigned long ret;
--	const struct cred *cred = current_cred(), *pcred;
-+	const struct cred *cred = current_cred();
-+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	const struct cred *pcred;
-+#endif
- 
- 	if (!futex_cmpxchg_enabled)
- 		return -ENOSYS;
-@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
- 		if (!p)
- 			goto err_unlock;
- 		ret = -EPERM;
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
-+			goto err_unlock;
-+#else
- 		pcred = __task_cred(p);
- 		if (cred->euid != pcred->euid &&
- 		    cred->euid != pcred->uid &&
- 		    !capable(CAP_SYS_PTRACE))
- 			goto err_unlock;
-+#endif
- 		head = p->compat_robust_list;
- 		read_unlock(&tasklist_lock);
- 	}
-diff -urNp linux-2.6.32.13/kernel/gcov/base.c linux-2.6.32.13/kernel/gcov/base.c
---- linux-2.6.32.13/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/gcov/base.c	2010-05-15 13:21:18.106616956 -0400
-@@ -102,11 +102,6 @@ void gcov_enable_events(void)
- }
- 
- #ifdef CONFIG_MODULES
--static inline int within(void *addr, void *start, unsigned long size)
--{
--	return ((addr >= start) && (addr < start + size));
--}
--
- /* Update list and generate events when modules are unloaded. */
- static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
- 				void *data)
-@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
- 	prev = NULL;
- 	/* Remove entries located in module from linked list. */
- 	for (info = gcov_info_head; info; info = info->next) {
--		if (within(info, mod->module_core, mod->core_size)) {
-+		if (within_module_core_rw((unsigned long)info, mod)) {
- 			if (prev)
- 				prev->next = info->next;
- 			else
-diff -urNp linux-2.6.32.13/kernel/hrtimer.c linux-2.6.32.13/kernel/hrtimer.c
---- linux-2.6.32.13/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
-+++ linux-2.6.32.13/kernel/hrtimer.c	2010-05-15 13:21:18.118636223 -0400
-@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
- 	local_irq_restore(flags);
- }
- 
--static void run_hrtimer_softirq(struct softirq_action *h)
-+static void run_hrtimer_softirq(void)
- {
- 	hrtimer_peek_ahead_timers();
- }
-diff -urNp linux-2.6.32.13/kernel/kallsyms.c linux-2.6.32.13/kernel/kallsyms.c
---- linux-2.6.32.13/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/kallsyms.c	2010-05-15 13:21:18.118636223 -0400
-@@ -11,6 +11,9 @@
-  *      Changed the compression method from stem compression to "table lookup"
-  *      compression (see scripts/kallsyms.c for a more complete description)
-  */
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+#define __INCLUDED_BY_HIDESYM 1
-+#endif
- #include <linux/kallsyms.h>
- #include <linux/module.h>
- #include <linux/init.h>
-@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
- 
- static inline int is_kernel_inittext(unsigned long addr)
- {
-+	if (system_state != SYSTEM_BOOTING)
-+		return 0;
-+
- 	if (addr >= (unsigned long)_sinittext
- 	    && addr <= (unsigned long)_einittext)
- 		return 1;
-@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
- 
- static inline int is_kernel(unsigned long addr)
- {
-+	if (is_kernel_inittext(addr))
-+		return 1;
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+#ifdef CONFIG_MODULES
-+	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
-+		return 0;
-+#endif
-+
-+	if (is_kernel_text(addr))
-+		return 1;
-+
-+	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
-+		return 1;
-+
-+	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
-+		return 1;
-+	return in_gate_area_no_task(addr);
-+#endif
-+
- 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
- 		return 1;
- 	return in_gate_area_no_task(addr);
-@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
- 
- static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
- {
--	iter->name[0] = '\0';
- 	iter->nameoff = get_symbol_offset(new_pos);
- 	iter->pos = new_pos;
- }
-@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
- {
- 	struct kallsym_iter *iter = m->private;
- 
-+#ifdef CONFIG_GRKERNSEC_HIDESYM
-+	if (current_uid())
-+		return 0;
-+#endif
-+
- 	/* Some debugging symbols have no name.  Ignore them. */
- 	if (!iter->name[0])
- 		return 0;
-@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
- 	struct kallsym_iter *iter;
- 	int ret;
- 
--	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
-+	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
- 	if (!iter)
- 		return -ENOMEM;
- 	reset_iter(iter, 0);
-diff -urNp linux-2.6.32.13/kernel/kgdb.c linux-2.6.32.13/kernel/kgdb.c
---- linux-2.6.32.13/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/kgdb.c	2010-05-15 13:21:18.118636223 -0400
-@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
- /* Guard for recursive entry */
- static int			exception_level;
- 
--static struct kgdb_io		*kgdb_io_ops;
-+static const struct kgdb_io	*kgdb_io_ops;
- static DEFINE_SPINLOCK(kgdb_registration_lock);
- 
- /* kgdb console driver is loaded */
-@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
-  *
-  *	Register it with the KGDB core.
-  */
--int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
-+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
- {
- 	int err;
- 
-@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
-  *
-  *	Unregister it with the KGDB core.
-  */
--void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
-+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
- {
- 	BUG_ON(kgdb_connected);
- 
-diff -urNp linux-2.6.32.13/kernel/kmod.c linux-2.6.32.13/kernel/kmod.c
---- linux-2.6.32.13/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/kmod.c	2010-05-15 13:21:18.118636223 -0400
-@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
- 	if (ret >= MODULE_NAME_LEN)
- 		return -ENAMETOOLONG;
- 
-+#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+	/* we could do a tighter check here, but some distros
-+	   are taking it upon themselves to remove CAP_SYS_MODULE
-+	   from even root-running apps which cause modules to be 
-+	   auto-loaded
-+	*/
-+	if (current_uid()) {
-+		gr_log_nonroot_mod_load(module_name);
-+		return -EPERM;
-+	}
-+#endif
-+
- 	/* If modprobe needs a service that is in a module, we get a recursive
- 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
- 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
-diff -urNp linux-2.6.32.13/kernel/kprobes.c linux-2.6.32.13/kernel/kprobes.c
---- linux-2.6.32.13/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/kprobes.c	2010-05-15 13:21:18.118636223 -0400
-@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
- 	 * kernel image and loaded module images reside. This is required
- 	 * so x86_64 can correctly handle the %rip-relative fixups.
- 	 */
--	kip->insns = module_alloc(PAGE_SIZE);
-+	kip->insns = module_alloc_exec(PAGE_SIZE);
- 	if (!kip->insns) {
- 		kfree(kip);
- 		return NULL;
-@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
- 		 */
- 		if (!list_is_singular(&kprobe_insn_pages)) {
- 			list_del(&kip->list);
--			module_free(NULL, kip->insns);
-+			module_free_exec(NULL, kip->insns);
- 			kfree(kip);
- 		}
- 		return 1;
-@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
- {
- 	int i, err = 0;
- 	unsigned long offset = 0, size = 0;
--	char *modname, namebuf[128];
-+	char *modname, namebuf[KSYM_NAME_LEN];
- 	const char *symbol_name;
- 	void *addr;
- 	struct kprobe_blackpoint *kb;
-@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
- 	const char *sym = NULL;
- 	unsigned int i = *(loff_t *) v;
- 	unsigned long offset = 0;
--	char *modname, namebuf[128];
-+	char *modname, namebuf[KSYM_NAME_LEN];
- 
- 	head = &kprobe_table[i];
- 	preempt_disable();
-diff -urNp linux-2.6.32.13/kernel/lockdep.c linux-2.6.32.13/kernel/lockdep.c
---- linux-2.6.32.13/kernel/lockdep.c	2010-04-29 17:49:38.578001941 -0400
-+++ linux-2.6.32.13/kernel/lockdep.c	2010-05-15 13:21:18.122615093 -0400
-@@ -577,6 +577,10 @@ static int static_obj(void *obj)
- 	int i;
- #endif
- 
-+#ifdef CONFIG_PAX_KERNEXEC
-+	start = ktla_ktva(start);
-+#endif
-+
- 	/*
- 	 * static variable?
- 	 */
-@@ -592,8 +596,7 @@ static int static_obj(void *obj)
- 	 */
- 	for_each_possible_cpu(i) {
- 		start = (unsigned long) per_cpu_ptr(&__per_cpu_start, i);
--		end   = (unsigned long) per_cpu_ptr(&__per_cpu_start, i)
--					+ PERCPU_ENOUGH_ROOM;
-+		end   = start + PERCPU_ENOUGH_ROOM;
- 
- 		if ((addr >= start) && (addr < end))
- 			return 1;
-@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
- 	if (!static_obj(lock->key)) {
- 		debug_locks_off();
- 		printk("INFO: trying to register non-static key.\n");
-+		printk("lock:%pS key:%pS.\n", lock, lock->key);
- 		printk("the code is fine but needs lockdep annotation.\n");
- 		printk("turning off the locking correctness validator.\n");
- 		dump_stack();
-diff -urNp linux-2.6.32.13/kernel/lockdep_proc.c linux-2.6.32.13/kernel/lockdep_proc.c
---- linux-2.6.32.13/kernel/lockdep_proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/lockdep_proc.c	2010-05-15 13:21:18.122615093 -0400
-@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
- 
- static void print_name(struct seq_file *m, struct lock_class *class)
- {
--	char str[128];
-+	char str[KSYM_NAME_LEN];
- 	const char *name = class->name;
- 
- 	if (!name) {
-diff -urNp linux-2.6.32.13/kernel/module.c linux-2.6.32.13/kernel/module.c
---- linux-2.6.32.13/kernel/module.c	2010-04-29 17:49:38.586002480 -0400
-+++ linux-2.6.32.13/kernel/module.c	2010-05-15 13:21:18.134612708 -0400
-@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
- static BLOCKING_NOTIFIER_HEAD(module_notify_list);
- 
- /* Bounds of module allocation, for speeding __module_address */
--static unsigned long module_addr_min = -1UL, module_addr_max = 0;
-+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
-+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
- 
- int register_module_notifier(struct notifier_block * nb)
- {
-@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
- 		return true;
- 
- 	list_for_each_entry_rcu(mod, &modules, list) {
--		struct symsearch arr[] = {
-+		struct symsearch modarr[] = {
- 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
- 			  NOT_GPL_ONLY, false },
- 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
- #endif
- 		};
- 
--		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
-+		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
- 			return true;
- 	}
- 	return false;
-@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
- 	void *ptr;
- 	int cpu;
- 
--	if (align > PAGE_SIZE) {
-+	if (align-1 >= PAGE_SIZE) {
- 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
- 		       name, align, PAGE_SIZE);
- 		align = PAGE_SIZE;
-@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
- 	destroy_params(mod->kp, mod->num_kp);
- 
- 	/* This may be NULL, but that's OK */
--	module_free(mod, mod->module_init);
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
- 	kfree(mod->args);
- 	if (mod->percpu)
- 		percpu_modfree(mod->percpu);
-@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
- 		percpu_modfree(mod->refptr);
- #endif
- 	/* Free lock-classes: */
--	lockdep_free_key_range(mod->module_core, mod->core_size);
-+	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
-+	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
- 
- 	/* Finally, free the core (containing the module structure) */
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_core_rx);
-+	module_free(mod, mod->module_core_rw);
- 
- #ifdef CONFIG_MPU
- 	update_protections(current->mm);
-@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
- 					      strtab + sym[i].st_name, mod);
- 			/* Ok if resolved.  */
- 			if (ksym) {
-+				pax_open_kernel();
- 				sym[i].st_value = ksym->value;
-+				pax_close_kernel();
- 				break;
- 			}
- 
-@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
- 				secbase = (unsigned long)mod->percpu;
- 			else
- 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
-+			pax_open_kernel();
- 			sym[i].st_value += secbase;
-+			pax_close_kernel();
- 			break;
- 		}
- 	}
-@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->core_text_size = mod->core_size;
- 	}
- 
- 	DEBUGP("Init section allocation order:\n");
-@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
- 			    || s->sh_entsize != ~0UL
- 			    || !strstarts(secstrings + s->sh_name, ".init"))
- 				continue;
--			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
--					 | INIT_OFFSET_MASK);
-+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
-+			else
-+				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
-+			s->sh_entsize |= INIT_OFFSET_MASK;
- 			DEBUGP("\t%s\n", secstrings + s->sh_name);
- 		}
--		if (m == 0)
--			mod->init_text_size = mod->init_size;
- 	}
- }
- 
-@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
- 
- /* As per nm */
- static char elf_type(const Elf_Sym *sym,
--		     Elf_Shdr *sechdrs,
--		     const char *secstrings,
--		     struct module *mod)
-+		     const Elf_Shdr *sechdrs,
-+		     const char *secstrings)
- {
- 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
- 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
-@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
- 
- 	/* Put symbol section at end of init part of module. */
- 	symsect->sh_flags |= SHF_ALLOC;
--	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
-+	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
- 					 symindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
- 
-@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
- 		}
- 
- 	/* Append room for core symbols at end of core part. */
--	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
--	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
-+	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
-+	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
- 
- 	/* Put string table section at end of init part of module. */
- 	strsect->sh_flags |= SHF_ALLOC;
--	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
-+	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
- 					 strindex) | INIT_OFFSET_MASK;
- 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
- 
- 	/* Append room for core symbols' strings at end of core part. */
--	*pstroffs = mod->core_size;
-+	*pstroffs = mod->core_size_rx;
- 	__set_bit(0, strmap);
--	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
-+	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
- 
- 	return symoffs;
- }
-@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
- 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
- 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
- 
-+	pax_open_kernel();
-+
- 	/* Set types up while we still have access to sections. */
- 	for (i = 0; i < mod->num_symtab; i++)
- 		mod->symtab[i].st_info
--			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
-+			= elf_type(&mod->symtab[i], sechdrs, secstrings);
- 
--	mod->core_symtab = dst = mod->module_core + symoffs;
-+	mod->core_symtab = dst = mod->module_core_rx + symoffs;
- 	src = mod->symtab;
- 	*dst = *src;
- 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
- 	}
- 	mod->core_num_syms = ndst;
- 
--	mod->core_strtab = s = mod->module_core + stroffs;
-+	mod->core_strtab = s = mod->module_core_rx + stroffs;
- 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
- 		if (test_bit(i, strmap))
- 			*++s = mod->strtab[i];
-+
-+	pax_close_kernel();
- }
- #else
- static inline unsigned long layout_symtab(struct module *mod,
-@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
- #endif
- }
- 
--static void *module_alloc_update_bounds(unsigned long size)
-+static void *module_alloc_update_bounds_rw(unsigned long size)
- {
- 	void *ret = module_alloc(size);
- 
- 	if (ret) {
- 		/* Update module bounds. */
--		if ((unsigned long)ret < module_addr_min)
--			module_addr_min = (unsigned long)ret;
--		if ((unsigned long)ret + size > module_addr_max)
--			module_addr_max = (unsigned long)ret + size;
-+		if ((unsigned long)ret < module_addr_min_rw)
-+			module_addr_min_rw = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rw)
-+			module_addr_max_rw = (unsigned long)ret + size;
-+	}
-+	return ret;
-+}
-+
-+static void *module_alloc_update_bounds_rx(unsigned long size)
-+{
-+	void *ret = module_alloc_exec(size);
-+
-+	if (ret) {
-+		/* Update module bounds. */
-+		if ((unsigned long)ret < module_addr_min_rx)
-+			module_addr_min_rx = (unsigned long)ret;
-+		if ((unsigned long)ret + size > module_addr_max_rx)
-+			module_addr_max_rx = (unsigned long)ret + size;
- 	}
- 	return ret;
- }
-@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
- 	unsigned int i;
- 
- 	/* only scan the sections containing data */
--	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
--			   (unsigned long)mod->module_core,
-+	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
-+			   (unsigned long)mod->module_core_rw,
- 			   sizeof(struct module), GFP_KERNEL);
- 
- 	for (i = 1; i < hdr->e_shnum; i++) {
-@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
- 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
- 			continue;
- 
--		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
--				   (unsigned long)mod->module_core,
-+		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
-+				   (unsigned long)mod->module_core_rw,
- 				   sechdrs[i].sh_size, GFP_KERNEL);
- 	}
- }
-@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
- 				secstrings, &stroffs, strmap);
- 
- 	/* Do the allocs. */
--	ptr = module_alloc_update_bounds(mod->core_size);
-+	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. Just mark it as not being a
-@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
- 		err = -ENOMEM;
- 		goto free_percpu;
- 	}
--	memset(ptr, 0, mod->core_size);
--	mod->module_core = ptr;
-+	memset(ptr, 0, mod->core_size_rw);
-+	mod->module_core_rw = ptr;
- 
--	ptr = module_alloc_update_bounds(mod->init_size);
-+	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
- 	/*
- 	 * The pointer to this block is stored in the module structure
- 	 * which is inside the block. This block doesn't need to be
- 	 * scanned as it contains data and code that will be freed
- 	 * after the module is initialized.
- 	 */
--	kmemleak_ignore(ptr);
--	if (!ptr && mod->init_size) {
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rw) {
-+		err = -ENOMEM;
-+		goto free_core_rw;
-+	}
-+	memset(ptr, 0, mod->init_size_rw);
-+	mod->module_init_rw = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr) {
- 		err = -ENOMEM;
--		goto free_core;
-+		goto free_init_rw;
- 	}
--	memset(ptr, 0, mod->init_size);
--	mod->module_init = ptr;
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->core_size_rx);
-+	pax_close_kernel();
-+	mod->module_core_rx = ptr;
-+
-+	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
-+	kmemleak_not_leak(ptr);
-+	if (!ptr && mod->init_size_rx) {
-+		err = -ENOMEM;
-+		goto free_core_rx;
-+	}
-+
-+	pax_open_kernel();
-+	memset(ptr, 0, mod->init_size_rx);
-+	pax_close_kernel();
-+	mod->module_init_rx = ptr;
- 
- 	/* Transfer each section which specifies SHF_ALLOC */
- 	DEBUGP("final section addresses:\n");
-@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
- 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
- 			continue;
- 
--		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
--			dest = mod->module_init
--				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
--		else
--			dest = mod->module_core + sechdrs[i].sh_entsize;
-+		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_init_rw
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+			else
-+				dest = mod->module_init_rx
-+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-+		} else {
-+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
-+				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
-+			else
-+				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
-+		}
-+
-+		if (sechdrs[i].sh_type != SHT_NOBITS) {
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
-+				pax_open_kernel();
-+				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+				pax_close_kernel();
-+			} else
-+#endif
- 
--		if (sechdrs[i].sh_type != SHT_NOBITS)
--			memcpy(dest, (void *)sechdrs[i].sh_addr,
--			       sechdrs[i].sh_size);
-+			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
-+		}
- 		/* Update sh_addr to point to copy in image. */
--		sechdrs[i].sh_addr = (unsigned long)dest;
-+
-+#ifdef CONFIG_PAX_KERNEXEC
-+		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
-+			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
-+		else
-+#endif
-+
-+			sechdrs[i].sh_addr = (unsigned long)dest;
- 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
- 	}
- 	/* Module has been moved. */
-@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
- 				      mod->name);
- 	if (!mod->refptr) {
- 		err = -ENOMEM;
--		goto free_init;
-+		goto free_init_rx;
- 	}
- #endif
- 	/* Now we've moved module, initialize linked lists, etc. */
-@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
- 
- 	/* Now do relocations. */
- 	for (i = 1; i < hdr->e_shnum; i++) {
--		const char *strtab = (char *)sechdrs[strindex].sh_addr;
- 		unsigned int info = sechdrs[i].sh_info;
-+		strtab = (char *)sechdrs[strindex].sh_addr;
- 
- 		/* Not a valid relocation section? */
- 		if (info >= hdr->e_shnum)
-@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
- 	 * Do it before processing of module parameters, so the module
- 	 * can provide parameter accessor functions of its own.
- 	 */
--	if (mod->module_init)
--		flush_icache_range((unsigned long)mod->module_init,
--				   (unsigned long)mod->module_init
--				   + mod->init_size);
--	flush_icache_range((unsigned long)mod->module_core,
--			   (unsigned long)mod->module_core + mod->core_size);
-+	if (mod->module_init_rx)
-+		flush_icache_range((unsigned long)mod->module_init_rx,
-+				   (unsigned long)mod->module_init_rx
-+				   + mod->init_size_rx);
-+	flush_icache_range((unsigned long)mod->module_core_rx,
-+			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
- 
- 	set_fs(old_fs);
- 
-@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
-  free_unload:
- 	module_unload_free(mod);
- #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
-+ free_init_rx:
- 	percpu_modfree(mod->refptr);
-- free_init:
- #endif
--	module_free(mod, mod->module_init);
-- free_core:
--	module_free(mod, mod->module_core);
-+	module_free_exec(mod, mod->module_init_rx);
-+ free_core_rx:
-+	module_free_exec(mod, mod->module_core_rx);
-+ free_init_rw:
-+	module_free(mod, mod->module_init_rw);
-+ free_core_rw:
-+	module_free(mod, mod->module_core_rw);
- 	/* mod will be freed with core. Don't access it beyond this line! */
-  free_percpu:
- 	if (percpu)
-@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
- 	mod->symtab = mod->core_symtab;
- 	mod->strtab = mod->core_strtab;
- #endif
--	module_free(mod, mod->module_init);
--	mod->module_init = NULL;
--	mod->init_size = 0;
--	mod->init_text_size = 0;
-+	module_free(mod, mod->module_init_rw);
-+	module_free_exec(mod, mod->module_init_rx);
-+	mod->module_init_rw = NULL;
-+	mod->module_init_rx = NULL;
-+	mod->init_size_rw = 0;
-+	mod->init_size_rx = 0;
- 	mutex_unlock(&module_mutex);
- 
- 	return 0;
-@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
- 	unsigned long nextval;
- 
- 	/* At worse, next value is at end of module */
--	if (within_module_init(addr, mod))
--		nextval = (unsigned long)mod->module_init+mod->init_text_size;
-+	if (within_module_init_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
-+	else if (within_module_init_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
-+	else if (within_module_core_rx(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
-+	else if (within_module_core_rw(addr, mod))
-+		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
- 	else
--		nextval = (unsigned long)mod->module_core+mod->core_text_size;
-+		return NULL;
- 
- 	/* Scan for closest preceeding symbol, and next symbol. (ELF
- 	   starts real symbols at 1). */
-@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
- 	char buf[8];
- 
- 	seq_printf(m, "%s %u",
--		   mod->name, mod->init_size + mod->core_size);
-+		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
- 	print_unload_info(m, mod);
- 
- 	/* Informative for users. */
-@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
- 		   mod->state == MODULE_STATE_COMING ? "Loading":
- 		   "Live");
- 	/* Used by oprofile and other similar tools. */
--	seq_printf(m, " 0x%p", mod->module_core);
-+	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
- 
- 	/* Taints info */
- 	if (mod->taints)
-@@ -2979,7 +3066,17 @@ static const struct file_operations proc
- 
- static int __init proc_modules_init(void)
- {
-+#ifndef CONFIG_GRKERNSEC_HIDESYM
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
-+#else
- 	proc_create("modules", 0, NULL, &proc_modules_operations);
-+#endif
-+#else
-+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
-+#endif
- 	return 0;
- }
- module_init(proc_modules_init);
-@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
- {
- 	struct module *mod;
- 
--	if (addr < module_addr_min || addr > module_addr_max)
-+	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
-+	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
- 		return NULL;
- 
- 	list_for_each_entry_rcu(mod, &modules, list)
--		if (within_module_core(addr, mod)
--		    || within_module_init(addr, mod))
-+		if (within_module_init(addr, mod) || within_module_core(addr, mod))
- 			return mod;
- 	return NULL;
- }
-@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
-  */
- struct module *__module_text_address(unsigned long addr)
- {
--	struct module *mod = __module_address(addr);
-+	struct module *mod;
-+
-+#ifdef CONFIG_X86_32
-+	addr = ktla_ktva(addr);
-+#endif
-+
-+	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
-+		return NULL;
-+
-+	mod = __module_address(addr);
-+
- 	if (mod) {
- 		/* Make sure it's within the text section. */
--		if (!within(addr, mod->module_init, mod->init_text_size)
--		    && !within(addr, mod->module_core, mod->core_text_size))
-+		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
- 			mod = NULL;
- 	}
- 	return mod;
-diff -urNp linux-2.6.32.13/kernel/panic.c linux-2.6.32.13/kernel/panic.c
---- linux-2.6.32.13/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/panic.c	2010-05-15 13:21:18.146612793 -0400
-@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
-  */
- void __stack_chk_fail(void)
- {
--	panic("stack-protector: Kernel stack is corrupted in: %p\n",
-+	dump_stack();
-+	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
- 		__builtin_return_address(0));
- }
- EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.32.13/kernel/params.c linux-2.6.32.13/kernel/params.c
---- linux-2.6.32.13/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/params.c	2010-05-15 13:21:18.146612793 -0400
-@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
- 	return ret;
- }
- 
--static struct sysfs_ops module_sysfs_ops = {
-+static const struct sysfs_ops module_sysfs_ops = {
- 	.show = module_attr_show,
- 	.store = module_attr_store,
- };
-@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops module_uevent_ops = {
-+static const struct kset_uevent_ops module_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-diff -urNp linux-2.6.32.13/kernel/pid.c linux-2.6.32.13/kernel/pid.c
---- linux-2.6.32.13/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/pid.c	2010-05-15 13:21:18.154611186 -0400
-@@ -33,6 +33,7 @@
- #include <linux/rculist.h>
- #include <linux/bootmem.h>
- #include <linux/hash.h>
-+#include <linux/security.h>
- #include <linux/pid_namespace.h>
- #include <linux/init_task.h>
- #include <linux/syscalls.h>
-@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
- 
- int pid_max = PID_MAX_DEFAULT;
- 
--#define RESERVED_PIDS		300
-+#define RESERVED_PIDS		500
- 
- int pid_max_min = RESERVED_PIDS + 1;
- int pid_max_max = PID_MAX_LIMIT;
-@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
-  */
- struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
- {
--	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+	struct task_struct *task;
-+	
-+	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
-+
-+	if (gr_pid_is_chrooted(task))
-+		return NULL;
-+
-+	return task;
- }
- 
- struct task_struct *find_task_by_vpid(pid_t vnr)
-diff -urNp linux-2.6.32.13/kernel/posix-cpu-timers.c linux-2.6.32.13/kernel/posix-cpu-timers.c
---- linux-2.6.32.13/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/posix-cpu-timers.c	2010-05-15 13:21:18.158615271 -0400
-@@ -6,6 +6,7 @@
- #include <linux/posix-timers.h>
- #include <linux/errno.h>
- #include <linux/math64.h>
-+#include <linux/security.h>
- #include <asm/uaccess.h>
- #include <linux/kernel_stat.h>
- #include <trace/events/timer.h>
-@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
- 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
- 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
- 			return;
- 		}
-+		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
- 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
- 			/*
- 			 * At the soft limit, send a SIGXCPU every second.
-diff -urNp linux-2.6.32.13/kernel/power/hibernate.c linux-2.6.32.13/kernel/power/hibernate.c
---- linux-2.6.32.13/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/power/hibernate.c	2010-05-15 13:21:18.158615271 -0400
-@@ -48,14 +48,14 @@ enum {
- 
- static int hibernation_mode = HIBERNATION_SHUTDOWN;
- 
--static struct platform_hibernation_ops *hibernation_ops;
-+static const struct platform_hibernation_ops *hibernation_ops;
- 
- /**
-  * hibernation_set_ops - set the global hibernate operations
-  * @ops: the hibernation operations to use in subsequent hibernation transitions
-  */
- 
--void hibernation_set_ops(struct platform_hibernation_ops *ops)
-+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
- {
- 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
- 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
-diff -urNp linux-2.6.32.13/kernel/power/poweroff.c linux-2.6.32.13/kernel/power/poweroff.c
---- linux-2.6.32.13/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/power/poweroff.c	2010-05-15 13:21:18.158615271 -0400
-@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
- 	.enable_mask	= SYSRQ_ENABLE_BOOT,
- };
- 
--static int pm_sysrq_init(void)
-+static int __init pm_sysrq_init(void)
- {
- 	register_sysrq_key('o', &sysrq_poweroff_op);
- 	return 0;
-diff -urNp linux-2.6.32.13/kernel/power/process.c linux-2.6.32.13/kernel/power/process.c
---- linux-2.6.32.13/kernel/power/process.c	2010-04-29 17:49:38.590000225 -0400
-+++ linux-2.6.32.13/kernel/power/process.c	2010-05-15 13:21:18.158615271 -0400
-@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
- 	struct timeval start, end;
- 	u64 elapsed_csecs64;
- 	unsigned int elapsed_csecs;
-+	bool timedout = false;
- 
- 	do_gettimeofday(&start);
- 
- 	end_time = jiffies + TIMEOUT;
- 	do {
- 		todo = 0;
-+		if (time_after(jiffies, end_time))
-+			timedout = true;
- 		read_lock(&tasklist_lock);
- 		do_each_thread(g, p) {
- 			if (frozen(p) || !freezeable(p))
-@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
- 			 * It is "frozen enough".  If the task does wake
- 			 * up, it will immediately call try_to_freeze.
- 			 */
--			if (!task_is_stopped_or_traced(p) &&
--			    !freezer_should_skip(p))
-+			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
- 				todo++;
-+				if (timedout) {
-+					printk(KERN_ERR "Task refusing to freeze:\n");
-+					sched_show_task(p);
-+				}
-+			}
- 		} while_each_thread(g, p);
- 		read_unlock(&tasklist_lock);
- 		yield();			/* Yield is okay here */
--		if (time_after(jiffies, end_time))
--			break;
--	} while (todo);
-+	} while (todo && !timedout);
- 
- 	do_gettimeofday(&end);
- 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
-diff -urNp linux-2.6.32.13/kernel/power/suspend.c linux-2.6.32.13/kernel/power/suspend.c
---- linux-2.6.32.13/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/power/suspend.c	2010-05-15 13:21:18.158615271 -0400
-@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
- 	[PM_SUSPEND_MEM]	= "mem",
- };
- 
--static struct platform_suspend_ops *suspend_ops;
-+static const struct platform_suspend_ops *suspend_ops;
- 
- /**
-  *	suspend_set_ops - Set the global suspend method table.
-  *	@ops:	Pointer to ops structure.
-  */
--void suspend_set_ops(struct platform_suspend_ops *ops)
-+void suspend_set_ops(const struct platform_suspend_ops *ops)
- {
- 	mutex_lock(&pm_mutex);
- 	suspend_ops = ops;
-diff -urNp linux-2.6.32.13/kernel/printk.c linux-2.6.32.13/kernel/printk.c
---- linux-2.6.32.13/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/printk.c	2010-05-15 13:21:18.158615271 -0400
-@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
- 	char c;
- 	int error = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_DMESG
-+	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
-+		return -EPERM;
-+#endif
-+
- 	error = security_syslog(type);
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.13/kernel/ptrace.c linux-2.6.32.13/kernel/ptrace.c
---- linux-2.6.32.13/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/ptrace.c	2010-05-15 13:21:18.158615271 -0400
-@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
- 	     cred->gid != tcred->egid ||
- 	     cred->gid != tcred->sgid ||
- 	     cred->gid != tcred->gid) &&
--	    !capable(CAP_SYS_PTRACE)) {
-+	    !capable_nolog(CAP_SYS_PTRACE)) {
- 		rcu_read_unlock();
- 		return -EPERM;
- 	}
-@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
- 	smp_rmb();
- 	if (task->mm)
- 		dumpable = get_dumpable(task->mm);
--	if (!dumpable && !capable(CAP_SYS_PTRACE))
-+	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
- 		return -EPERM;
- 
- 	return security_ptrace_access_check(task, mode);
-@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
- 		goto unlock_tasklist;
- 
- 	task->ptrace = PT_PTRACED;
--	if (capable(CAP_SYS_PTRACE))
-+	if (capable_nolog(CAP_SYS_PTRACE))
- 		task->ptrace |= PT_PTRACE_CAP;
- 
- 	__ptrace_link(task, current);
-@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
- 		ret = ptrace_setoptions(child, data);
- 		break;
- 	case PTRACE_GETEVENTMSG:
--		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
-+		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
- 		break;
- 
- 	case PTRACE_GETSIGINFO:
- 		ret = ptrace_getsiginfo(child, &siginfo);
- 		if (!ret)
--			ret = copy_siginfo_to_user((siginfo_t __user *) data,
-+			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
- 						   &siginfo);
- 		break;
- 
- 	case PTRACE_SETSIGINFO:
--		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
-+		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
- 				   sizeof siginfo))
- 			ret = -EFAULT;
- 		else
-@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
- 		goto out;
- 	}
- 
-+	if (gr_handle_ptrace(child, request)) {
-+		ret = -EPERM;
-+		goto out_put_task_struct;
-+	}
-+
- 	if (request == PTRACE_ATTACH) {
- 		ret = ptrace_attach(child);
- 		/*
- 		 * Some architectures need to do book-keeping after
- 		 * a ptrace attach.
- 		 */
--		if (!ret)
-+		if (!ret) {
- 			arch_ptrace_attach(child);
-+			gr_audit_ptrace(child);
-+		}
- 		goto out_put_task_struct;
- 	}
- 
-@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
- 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
- 	if (copied != sizeof(tmp))
- 		return -EIO;
--	return put_user(tmp, (unsigned long __user *)data);
-+	return put_user(tmp, (__force unsigned long __user *)data);
- }
- 
- int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
-diff -urNp linux-2.6.32.13/kernel/rcutree.c linux-2.6.32.13/kernel/rcutree.c
---- linux-2.6.32.13/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/rcutree.c	2010-05-15 13:21:18.162587722 -0400
-@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
- /*
-  * Do softirq processing for the current CPU.
-  */
--static void rcu_process_callbacks(struct softirq_action *unused)
-+static void rcu_process_callbacks(void)
- {
- 	/*
- 	 * Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.32.13/kernel/relay.c linux-2.6.32.13/kernel/relay.c
---- linux-2.6.32.13/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/relay.c	2010-05-15 13:21:18.162587722 -0400
-@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
- 		return 0;
- 
- 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
--	if (ret < 0 || ret < total_len)
-+	if ((int)ret < 0 || ret < total_len)
- 		return ret;
- 
-         if (read_start + ret == nonpad_end)
-diff -urNp linux-2.6.32.13/kernel/resource.c linux-2.6.32.13/kernel/resource.c
---- linux-2.6.32.13/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/resource.c	2010-05-15 13:21:18.162587722 -0400
-@@ -132,8 +132,18 @@ static const struct file_operations proc
- 
- static int __init ioresources_init(void)
- {
-+#ifdef CONFIG_GRKERNSEC_PROC_ADD
-+#ifdef CONFIG_GRKERNSEC_PROC_USER
-+	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
-+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
-+	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
-+	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
-+#endif
-+#else
- 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
- 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
-+#endif
- 	return 0;
- }
- __initcall(ioresources_init);
-diff -urNp linux-2.6.32.13/kernel/sched.c linux-2.6.32.13/kernel/sched.c
---- linux-2.6.32.13/kernel/sched.c	2010-04-29 17:49:38.609495328 -0400
-+++ linux-2.6.32.13/kernel/sched.c	2010-05-15 13:21:18.180350069 -0400
-@@ -4841,7 +4841,7 @@ out:
-  * In CONFIG_NO_HZ case, the idle load balance owner will do the
-  * rebalancing for all the cpus for whom scheduler ticks are stopped.
-  */
--static void run_rebalance_domains(struct softirq_action *h)
-+static void run_rebalance_domains(void)
- {
- 	int this_cpu = smp_processor_id();
- 	struct rq *this_rq = cpu_rq(this_cpu);
-@@ -6110,6 +6110,8 @@ int can_nice(const struct task_struct *p
- 	/* convert nice value [19,-20] to rlimit style value [1,40] */
- 	int nice_rlim = 20 - nice;
- 
-+	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
-+
- 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
- 		capable(CAP_SYS_NICE));
- }
-@@ -6143,7 +6145,8 @@ SYSCALL_DEFINE1(nice, int, increment)
- 	if (nice > 19)
- 		nice = 19;
- 
--	if (increment < 0 && !can_nice(current, nice))
-+	if (increment < 0 && (!can_nice(current, nice) ||
-+			      gr_handle_chroot_nice()))
- 		return -EPERM;
- 
- 	retval = security_task_setnice(current, nice);
-@@ -6293,6 +6296,8 @@ recheck:
- 		if (rt_policy(policy)) {
- 			unsigned long rlim_rtprio;
- 
-+			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
-+
- 			if (!lock_task_sighand(p, &flags))
- 				return -ESRCH;
- 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
-@@ -7452,7 +7457,7 @@ static struct ctl_table sd_ctl_dir[] = {
- 		.procname	= "sched_domain",
- 		.mode		= 0555,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table sd_ctl_root[] = {
-@@ -7462,7 +7467,7 @@ static struct ctl_table sd_ctl_root[] = 
- 		.mode		= 0555,
- 		.child		= sd_ctl_dir,
- 	},
--	{0, },
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table *sd_alloc_ctl_entry(int n)
-diff -urNp linux-2.6.32.13/kernel/signal.c linux-2.6.32.13/kernel/signal.c
---- linux-2.6.32.13/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/signal.c	2010-05-15 13:21:18.180350069 -0400
-@@ -41,12 +41,12 @@
- 
- static struct kmem_cache *sigqueue_cachep;
- 
--static void __user *sig_handler(struct task_struct *t, int sig)
-+static __sighandler_t sig_handler(struct task_struct *t, int sig)
- {
- 	return t->sighand->action[sig - 1].sa.sa_handler;
- }
- 
--static int sig_handler_ignored(void __user *handler, int sig)
-+static int sig_handler_ignored(__sighandler_t handler, int sig)
- {
- 	/* Is it explicitly or implicitly ignored? */
- 	return handler == SIG_IGN ||
-@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
- static int sig_task_ignored(struct task_struct *t, int sig,
- 		int from_ancestor_ns)
- {
--	void __user *handler;
-+	__sighandler_t handler;
- 
- 	handler = sig_handler(t, sig);
- 
-@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
- 	 */
- 	user = get_uid(__task_cred(t)->user);
- 	atomic_inc(&user->sigpending);
-+
-+	if (!override_rlimit)
-+		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
- 	if (override_rlimit ||
- 	    atomic_read(&user->sigpending) <=
- 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
-@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
- 
- int unhandled_signal(struct task_struct *tsk, int sig)
- {
--	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
-+	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
- 	if (is_global_init(tsk))
- 		return 1;
- 	if (handler != SIG_IGN && handler != SIG_DFL)
-@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
- 		}
- 	}
- 
-+	if (gr_handle_signal(t, sig))
-+		return -EPERM;
-+
- 	return security_task_kill(t, info, sig, 0);
- }
- 
-@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
- 	return send_signal(sig, info, p, 1);
- }
- 
--static int
-+int
- specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
- {
- 	return send_signal(sig, info, t, 0);
-@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
- 	ret = specific_send_sig_info(sig, info, t);
- 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
- 
-+	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
-+	gr_handle_crash(t, sig);
-+
- 	return ret;
- }
- 
-@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
- {
- 	int ret = check_kill_permission(sig, info, p);
- 
--	if (!ret && sig)
-+	if (!ret && sig) {
- 		ret = do_send_sig_info(sig, info, p, true);
-+		if (!ret)
-+			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
-+	}
- 
- 	return ret;
- }
-diff -urNp linux-2.6.32.13/kernel/smp.c linux-2.6.32.13/kernel/smp.c
---- linux-2.6.32.13/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/smp.c	2010-05-15 13:21:18.180350069 -0400
-@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
- }
- EXPORT_SYMBOL(smp_call_function);
- 
--void ipi_call_lock(void)
-+void ipi_call_lock(void) __acquires(call_function.lock)
- {
- 	spin_lock(&call_function.lock);
- }
- 
--void ipi_call_unlock(void)
-+void ipi_call_unlock(void) __releases(call_function.lock)
- {
- 	spin_unlock(&call_function.lock);
- }
- 
--void ipi_call_lock_irq(void)
-+void ipi_call_lock_irq(void) __acquires(call_function.lock)
- {
- 	spin_lock_irq(&call_function.lock);
- }
- 
--void ipi_call_unlock_irq(void)
-+void ipi_call_unlock_irq(void) __releases(call_function.lock)
- {
- 	spin_unlock_irq(&call_function.lock);
- }
-diff -urNp linux-2.6.32.13/kernel/softirq.c linux-2.6.32.13/kernel/softirq.c
---- linux-2.6.32.13/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/softirq.c	2010-05-15 13:21:18.186622968 -0400
-@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
- 
- static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
- 
--char *softirq_to_name[NR_SOFTIRQS] = {
-+const char * const softirq_to_name[NR_SOFTIRQS] = {
- 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
- 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
- };
-@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
- 
- asmlinkage void __do_softirq(void)
- {
--	struct softirq_action *h;
-+	const struct softirq_action *h;
- 	__u32 pending;
- 	int max_restart = MAX_SOFTIRQ_RESTART;
- 	int cpu;
-@@ -216,7 +216,7 @@ restart:
- 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
- 
- 			trace_softirq_entry(h, softirq_vec);
--			h->action(h);
-+			h->action();
- 			trace_softirq_exit(h, softirq_vec);
- 			if (unlikely(prev_count != preempt_count())) {
- 				printk(KERN_ERR "huh, entered softirq %td %s %p"
-@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
- 	local_irq_restore(flags);
- }
- 
--void open_softirq(int nr, void (*action)(struct softirq_action *))
-+void open_softirq(int nr, void (*action)(void))
- {
- 	softirq_vec[nr].action = action;
- }
-@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
- 
- EXPORT_SYMBOL(__tasklet_hi_schedule_first);
- 
--static void tasklet_action(struct softirq_action *a)
-+static void tasklet_action(void)
- {
- 	struct tasklet_struct *list;
- 
-@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
- 	}
- }
- 
--static void tasklet_hi_action(struct softirq_action *a)
-+static void tasklet_hi_action(void)
- {
- 	struct tasklet_struct *list;
- 
-diff -urNp linux-2.6.32.13/kernel/sys.c linux-2.6.32.13/kernel/sys.c
---- linux-2.6.32.13/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/sys.c	2010-05-15 13:21:18.223438230 -0400
-@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
- 		error = -EACCES;
- 		goto out;
- 	}
-+
-+	if (gr_handle_chroot_setpriority(p, niceval)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
- 	no_nice = security_task_setnice(p, niceval);
- 	if (no_nice) {
- 		error = no_nice;
-@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who)
- 					error = set_one_prio(p, niceval, error);
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* For find_user() */
- 			break;
-@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
- 				 !(user = find_user(who)))
- 				goto out_unlock;	/* No processes for this user */
- 
--			do_each_thread(g, p)
-+			do_each_thread(g, p) {
- 				if (__task_cred(p)->uid == who) {
- 					niceval = 20 - task_nice(p);
- 					if (niceval > retval)
- 						retval = niceval;
- 				}
--			while_each_thread(g, p);
-+			} while_each_thread(g, p);
- 			if (who != cred->uid)
- 				free_uid(user);		/* for find_user() */
- 			break;
-@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(new->gid, new->egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1 ||
- 	    (egid != (gid_t) -1 && egid != old->gid))
- 		new->sgid = new->egid;
-@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_group_change(gid, gid, gid))
-+		goto error;
-+
- 	if (capable(CAP_SETGID))
- 		new->gid = new->egid = new->sgid = new->fsgid = gid;
- 	else if (gid == old->gid || gid == old->sgid)
-@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(new->uid, new->euid, -1))
-+		goto error;
-+
- 	if (new->uid != old->uid) {
- 		retval = set_user(new);
- 		if (retval < 0)
-@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
- 		goto error;
- 
- 	retval = -EPERM;
-+
-+	if (gr_check_crash_uid(uid))
-+		goto error;
-+	if (gr_check_user_change(uid, uid, uid))
-+		goto error;
-+
- 	if (capable(CAP_SETUID)) {
- 		new->suid = new->uid = uid;
- 		if (uid != old->uid) {
-@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_user_change(ruid, euid, -1))
-+		goto error;
-+
- 	if (ruid != (uid_t) -1) {
- 		new->uid = ruid;
- 		if (ruid != old->uid) {
-@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
- 			goto error;
- 	}
- 
-+	if (gr_check_group_change(rgid, egid, -1))
-+		goto error;
-+
- 	if (rgid != (gid_t) -1)
- 		new->gid = rgid;
- 	if (egid != (gid_t) -1)
-@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
- 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
- 		goto error;
- 
-+	if (gr_check_user_change(-1, -1, uid))
-+		goto error;
-+
- 	if (uid == old->uid  || uid == old->euid  ||
- 	    uid == old->suid || uid == old->fsuid ||
- 	    capable(CAP_SETUID)) {
-@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
- 	if (gid == old->gid  || gid == old->egid  ||
- 	    gid == old->sgid || gid == old->fsgid ||
- 	    capable(CAP_SETGID)) {
-+		if (gr_check_group_change(-1, -1, gid))
-+			goto error;
-+
- 		if (gid != old_fsgid) {
- 			new->fsgid = gid;
- 			goto change_okay;
-@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
- 			error = get_dumpable(me->mm);
- 			break;
- 		case PR_SET_DUMPABLE:
--			if (arg2 < 0 || arg2 > 1) {
-+			if (arg2 > 1) {
- 				error = -EINVAL;
- 				break;
- 			}
-diff -urNp linux-2.6.32.13/kernel/sysctl.c linux-2.6.32.13/kernel/sysctl.c
---- linux-2.6.32.13/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/sysctl.c	2010-05-15 13:21:18.258852946 -0400
-@@ -63,6 +63,13 @@
- static int deprecated_sysctl_warning(struct __sysctl_args *args);
- 
- #if defined(CONFIG_SYSCTL)
-+#include <linux/grsecurity.h>
-+#include <linux/grinternal.h>
-+
-+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
-+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
-+				const int op);
-+extern int gr_handle_chroot_sysctl(const int op);
- 
- /* External variables not in a header file. */
- extern int C_A_D;
-@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
- static int proc_taint(struct ctl_table *table, int write,
- 			       void __user *buffer, size_t *lenp, loff_t *ppos);
- #endif
-+extern ctl_table grsecurity_table[];
- 
- static struct ctl_table root_table[];
- static struct ctl_table_root sysctl_table_root;
-@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
- int sysctl_legacy_va_layout;
- #endif
- 
-+#ifdef CONFIG_PAX_SOFTMODE
-+static ctl_table pax_table[] = {
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "softmode",
-+		.data		= &pax_softmode,
-+		.maxlen		= sizeof(unsigned int),
-+		.mode		= 0600,
-+		.proc_handler	= &proc_dointvec,
-+	},
-+
-+	{ .ctl_name = 0 }
-+};
-+#endif
-+
- extern int prove_locking;
- extern int lock_stat;
- 
-@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
- #endif
- 
- static struct ctl_table kern_table[] = {
-+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "grsecurity",
-+		.mode		= 0500,
-+		.child		= grsecurity_table,
-+	},
-+#endif
-+
-+#ifdef CONFIG_PAX_SOFTMODE
-+	{
-+		.ctl_name	= CTL_UNNUMBERED,
-+		.procname	= "pax",
-+		.mode		= 0500,
-+		.child		= pax_table,
-+	},
-+#endif
-+
- 	{
- 		.ctl_name	= CTL_UNNUMBERED,
- 		.procname	= "sched_child_runs_first",
-@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
- 	return 0;
- }
- 
-+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
-+
- static int parse_table(int __user *name, int nlen,
- 		       void __user *oldval, size_t __user *oldlenp,
- 		       void __user *newval, size_t newlen,
-@@ -1821,7 +1864,7 @@ repeat:
- 		if (n == table->ctl_name) {
- 			int error;
- 			if (table->child) {
--				if (sysctl_perm(root, table, MAY_EXEC))
-+				if (sysctl_perm_nochk(root, table, MAY_EXEC))
- 					return -EPERM;
- 				name++;
- 				nlen--;
-@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
- 	int error;
- 	int mode;
- 
-+	if (table->parent != NULL && table->parent->procname != NULL &&
-+	   table->procname != NULL &&
-+	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
-+		return -EACCES;
-+	if (gr_handle_chroot_sysctl(op))
-+		return -EACCES;
-+	error = gr_handle_sysctl(table, op);
-+	if (error)
-+		return error;
-+
-+	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
-+	if (error)
-+		return error;
-+
-+	if (root->permissions)
-+		mode = root->permissions(root, current->nsproxy, table);
-+	else
-+		mode = table->mode;
-+
-+	return test_perm(mode, op);
-+}
-+
-+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
-+{
-+	int error;
-+	int mode;
-+
- 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
- 	if (error)
- 		return error;
-diff -urNp linux-2.6.32.13/kernel/taskstats.c linux-2.6.32.13/kernel/taskstats.c
---- linux-2.6.32.13/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/taskstats.c	2010-05-15 13:21:18.258852946 -0400
-@@ -26,9 +26,12 @@
- #include <linux/cgroup.h>
- #include <linux/fs.h>
- #include <linux/file.h>
-+#include <linux/grsecurity.h>
- #include <net/genetlink.h>
- #include <asm/atomic.h>
- 
-+extern int gr_is_taskstats_denied(int pid);
-+
- /*
-  * Maximum length of a cpumask that can be specified in
-  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
-@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
- 	size_t size;
- 	cpumask_var_t mask;
- 
-+	if (gr_is_taskstats_denied(current->pid))
-+		return -EACCES;
-+
- 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
- 		return -ENOMEM;
- 
-diff -urNp linux-2.6.32.13/kernel/time/tick-broadcast.c linux-2.6.32.13/kernel/time/tick-broadcast.c
---- linux-2.6.32.13/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/time/tick-broadcast.c	2010-05-15 13:21:18.258852946 -0400
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
- 		 * then clear the broadcast bit.
- 		 */
- 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
--			int cpu = smp_processor_id();
-+			cpu = smp_processor_id();
- 
- 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
- 			tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.32.13/kernel/time.c linux-2.6.32.13/kernel/time.c
---- linux-2.6.32.13/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/time.c	2010-05-15 13:21:18.262613670 -0400
-@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
- 		return err;
- 
- 	do_settimeofday(&tv);
-+
-+	gr_log_timechange();
-+
- 	return 0;
- }
- 
-@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
- 			return -EFAULT;
- 	}
- 
-+	gr_log_timechange();
-+
- 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
- }
- 
-@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
-  * Avoid unnecessary multiplications/divisions in the
-  * two most common HZ cases:
-  */
--unsigned int inline jiffies_to_msecs(const unsigned long j)
-+inline unsigned int jiffies_to_msecs(const unsigned long j)
- {
- #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
- 	return (MSEC_PER_SEC / HZ) * j;
-@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
- }
- EXPORT_SYMBOL(jiffies_to_msecs);
- 
--unsigned int inline jiffies_to_usecs(const unsigned long j)
-+inline unsigned int jiffies_to_usecs(const unsigned long j)
- {
- #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
- 	return (USEC_PER_SEC / HZ) * j;
-diff -urNp linux-2.6.32.13/kernel/timer.c linux-2.6.32.13/kernel/timer.c
---- linux-2.6.32.13/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/timer.c	2010-05-15 13:21:18.262613670 -0400
-@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
- /*
-  * This function runs timers and the timer-tq in bottom half context.
-  */
--static void run_timer_softirq(struct softirq_action *h)
-+static void run_timer_softirq(void)
- {
- 	struct tvec_base *base = __get_cpu_var(tvec_bases);
- 
-diff -urNp linux-2.6.32.13/kernel/trace/ftrace.c linux-2.6.32.13/kernel/trace/ftrace.c
---- linux-2.6.32.13/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
-+++ linux-2.6.32.13/kernel/trace/ftrace.c	2010-05-15 13:21:18.274619950 -0400
-@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
- 
- 	ip = rec->ip;
- 
-+	ret = ftrace_arch_code_modify_prepare();
-+	FTRACE_WARN_ON(ret);
-+	if (ret)
-+		return 0;
-+
- 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
-+	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
- 	if (ret) {
- 		ftrace_bug(ret, ip);
- 		rec->flags |= FTRACE_FL_FAILED;
--		return 0;
- 	}
--	return 1;
-+	return ret ? 0 : 1;
- }
- 
- /*
-diff -urNp linux-2.6.32.13/kernel/trace/Kconfig linux-2.6.32.13/kernel/trace/Kconfig
---- linux-2.6.32.13/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/trace/Kconfig	2010-05-15 13:21:18.278715003 -0400
-@@ -126,6 +126,7 @@ if FTRACE
- config FUNCTION_TRACER
- 	bool "Kernel Function Tracer"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FRAME_POINTER
- 	select KALLSYMS
- 	select GENERIC_TRACER
-@@ -343,6 +344,7 @@ config POWER_TRACER
- config STACK_TRACER
- 	bool "Trace max stack"
- 	depends on HAVE_FUNCTION_TRACER
-+	depends on !PAX_KERNEXEC
- 	select FUNCTION_TRACER
- 	select STACKTRACE
- 	select KALLSYMS
-diff -urNp linux-2.6.32.13/kernel/trace/ring_buffer.c linux-2.6.32.13/kernel/trace/ring_buffer.c
---- linux-2.6.32.13/kernel/trace/ring_buffer.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.13/kernel/trace/ring_buffer.c	2010-05-15 13:21:18.278715003 -0400
-@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
-  * the reader page). But if the next page is a header page,
-  * its flags will be non zero.
-  */
--static int inline
-+static inline int
- rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
- 		struct buffer_page *page, struct list_head *list)
- {
-diff -urNp linux-2.6.32.13/kernel/trace/trace.c linux-2.6.32.13/kernel/trace/trace.c
---- linux-2.6.32.13/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.13/kernel/trace/trace.c	2010-05-15 13:21:18.278715003 -0400
-@@ -3808,10 +3808,9 @@ static const struct file_operations trac
- };
- #endif
- 
--static struct dentry *d_tracer;
--
- struct dentry *tracing_init_dentry(void)
- {
-+	static struct dentry *d_tracer;
- 	static int once;
- 
- 	if (d_tracer)
-@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
- 	return d_tracer;
- }
- 
--static struct dentry *d_percpu;
--
- struct dentry *tracing_dentry_percpu(void)
- {
-+	static struct dentry *d_percpu;
- 	static int once;
- 	struct dentry *d_tracer;
- 
-diff -urNp linux-2.6.32.13/kernel/trace/trace_events.c linux-2.6.32.13/kernel/trace/trace_events.c
---- linux-2.6.32.13/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/trace/trace_events.c	2010-05-15 13:21:18.282652483 -0400
-@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
-  * Modules must own their file_operations to keep up with
-  * reference counting.
-  */
-+
-+/* cannot be const */
- struct ftrace_module_file_ops {
- 	struct list_head		list;
- 	struct module			*mod;
-diff -urNp linux-2.6.32.13/kernel/trace/trace_output.c linux-2.6.32.13/kernel/trace/trace_output.c
---- linux-2.6.32.13/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/trace/trace_output.c	2010-05-15 13:21:18.282652483 -0400
-@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
- 		return 0;
- 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
- 	if (!IS_ERR(p)) {
--		p = mangle_path(s->buffer + s->len, p, "\n");
-+		p = mangle_path(s->buffer + s->len, p, "\n\\");
- 		if (p) {
- 			s->len = p - s->buffer;
- 			return 1;
-diff -urNp linux-2.6.32.13/kernel/trace/trace_stack.c linux-2.6.32.13/kernel/trace/trace_stack.c
---- linux-2.6.32.13/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/trace/trace_stack.c	2010-05-15 13:21:18.282652483 -0400
-@@ -50,7 +50,7 @@ static inline void check_stack(void)
- 		return;
- 
- 	/* we do not handle interrupt stacks yet */
--	if (!object_is_on_stack(&this_size))
-+	if (!object_starts_on_stack(&this_size))
- 		return;
- 
- 	local_irq_save(flags);
-diff -urNp linux-2.6.32.13/kernel/utsname_sysctl.c linux-2.6.32.13/kernel/utsname_sysctl.c
---- linux-2.6.32.13/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/kernel/utsname_sysctl.c	2010-05-15 13:21:18.282652483 -0400
-@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
- 		.proc_handler	= proc_do_uts_string,
- 		.strategy	= sysctl_uts_string,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static struct ctl_table uts_root_table[] = {
-@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
- 		.mode		= 0555,
- 		.child		= uts_kern_table,
- 	},
--	{}
-+	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
- };
- 
- static int __init utsname_sysctl_init(void)
-diff -urNp linux-2.6.32.13/lib/bug.c linux-2.6.32.13/lib/bug.c
---- linux-2.6.32.13/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/bug.c	2010-05-15 13:21:18.282652483 -0400
-@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
- 		return BUG_TRAP_TYPE_NONE;
- 
- 	bug = find_bug(bugaddr);
-+	if (!bug)
-+		return BUG_TRAP_TYPE_NONE;
- 
- 	printk(KERN_EMERG "------------[ cut here ]------------\n");
- 
-diff -urNp linux-2.6.32.13/lib/debugobjects.c linux-2.6.32.13/lib/debugobjects.c
---- linux-2.6.32.13/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/debugobjects.c	2010-05-15 13:21:18.298622839 -0400
-@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
- 	if (limit > 4)
- 		return;
- 
--	is_on_stack = object_is_on_stack(addr);
-+	is_on_stack = object_starts_on_stack(addr);
- 	if (is_on_stack == onstack)
- 		return;
- 
-diff -urNp linux-2.6.32.13/lib/dma-debug.c linux-2.6.32.13/lib/dma-debug.c
---- linux-2.6.32.13/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/dma-debug.c	2010-05-15 13:21:18.322629085 -0400
-@@ -861,7 +861,7 @@ out:
- 
- static void check_for_stack(struct device *dev, void *addr)
- {
--	if (object_is_on_stack(addr))
-+	if (object_starts_on_stack(addr))
- 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
- 				"stack [addr=%p]\n", addr);
- }
-diff -urNp linux-2.6.32.13/lib/idr.c linux-2.6.32.13/lib/idr.c
---- linux-2.6.32.13/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/idr.c	2010-05-15 13:21:18.327545957 -0400
-@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
- 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
- 
- 			/* if already at the top layer, we need to grow */
--			if (id >= 1 << (idp->layers * IDR_BITS)) {
-+			if (id >= (1 << (idp->layers * IDR_BITS))) {
- 				*starting_id = id;
- 				return IDR_NEED_TO_GROW;
- 			}
-diff -urNp linux-2.6.32.13/lib/inflate.c linux-2.6.32.13/lib/inflate.c
---- linux-2.6.32.13/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/inflate.c	2010-05-15 13:21:18.327545957 -0400
-@@ -266,7 +266,7 @@ static void free(void *where)
- 		malloc_ptr = free_mem_ptr;
- }
- #else
--#define malloc(a) kmalloc(a, GFP_KERNEL)
-+#define malloc(a) kmalloc((a), GFP_KERNEL)
- #define free(a) kfree(a)
- #endif
- 
-diff -urNp linux-2.6.32.13/lib/Kconfig.debug linux-2.6.32.13/lib/Kconfig.debug
---- linux-2.6.32.13/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/Kconfig.debug	2010-05-15 13:21:18.339667096 -0400
-@@ -905,7 +905,7 @@ config LATENCYTOP
- 	select STACKTRACE
- 	select SCHEDSTATS
- 	select SCHED_DEBUG
--	depends on HAVE_LATENCYTOP_SUPPORT
-+	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
- 	help
- 	  Enable this option if you want to use the LatencyTOP tool
- 	  to find out which userspace is blocking on what kernel operations.
-diff -urNp linux-2.6.32.13/lib/kobject.c linux-2.6.32.13/lib/kobject.c
---- linux-2.6.32.13/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/kobject.c	2010-05-15 13:21:18.355221413 -0400
-@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
- 	return ret;
- }
- 
--struct sysfs_ops kobj_sysfs_ops = {
-+const struct sysfs_ops kobj_sysfs_ops = {
- 	.show	= kobj_attr_show,
- 	.store	= kobj_attr_store,
- };
-@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
-  * If the kset was not able to be created, NULL will be returned.
-  */
- static struct kset *kset_create(const char *name,
--				struct kset_uevent_ops *uevent_ops,
-+				const struct kset_uevent_ops *uevent_ops,
- 				struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
-  * If the kset was not able to be created, NULL will be returned.
-  */
- struct kset *kset_create_and_add(const char *name,
--				 struct kset_uevent_ops *uevent_ops,
-+				 const struct kset_uevent_ops *uevent_ops,
- 				 struct kobject *parent_kobj)
- {
- 	struct kset *kset;
-diff -urNp linux-2.6.32.13/lib/kobject_uevent.c linux-2.6.32.13/lib/kobject_uevent.c
---- linux-2.6.32.13/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/kobject_uevent.c	2010-05-15 13:21:18.355221413 -0400
-@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
- 	const char *subsystem;
- 	struct kobject *top_kobj;
- 	struct kset *kset;
--	struct kset_uevent_ops *uevent_ops;
-+	const struct kset_uevent_ops *uevent_ops;
- 	u64 seq;
- 	int i = 0;
- 	int retval = 0;
-diff -urNp linux-2.6.32.13/lib/parser.c linux-2.6.32.13/lib/parser.c
---- linux-2.6.32.13/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/parser.c	2010-05-15 13:21:18.358625413 -0400
-@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
- 	char *buf;
- 	int ret;
- 
--	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
-+	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
- 	if (!buf)
- 		return -ENOMEM;
- 	memcpy(buf, s->from, s->to - s->from);
-diff -urNp linux-2.6.32.13/lib/radix-tree.c linux-2.6.32.13/lib/radix-tree.c
---- linux-2.6.32.13/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/radix-tree.c	2010-05-15 13:21:18.366643034 -0400
-@@ -81,7 +81,7 @@ struct radix_tree_preload {
- 	int nr;
- 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
- };
--static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
-+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
- 
- static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
- {
-diff -urNp linux-2.6.32.13/lib/random32.c linux-2.6.32.13/lib/random32.c
---- linux-2.6.32.13/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/lib/random32.c	2010-05-15 13:21:18.370623064 -0400
-@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
-  */
- static inline u32 __seed(u32 x, u32 m)
- {
--	return (x < m) ? x + m : x;
-+	return (x <= m) ? x + m + 1 : x;
- }
- 
- /**
-diff -urNp linux-2.6.32.13/localversion-grsec linux-2.6.32.13/localversion-grsec
---- linux-2.6.32.13/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.32.13/localversion-grsec	2010-05-15 13:21:18.370623064 -0400
-@@ -0,0 +1 @@
-+-grsec
-diff -urNp linux-2.6.32.13/Makefile linux-2.6.32.13/Makefile
---- linux-2.6.32.13/Makefile	2010-05-15 13:20:18.396226636 -0400
-+++ linux-2.6.32.13/Makefile	2010-05-15 13:21:18.370623064 -0400
-@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
- 
- HOSTCC       = gcc
- HOSTCXX      = g++
--HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
--HOSTCXXFLAGS = -O2
-+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
- 
- # Decide whether to build built-in, modular, or both.
- # Normally, just do built-in.
-@@ -644,7 +644,7 @@ export mod_strip_cmd
- 
- 
- ifeq ($(KBUILD_EXTMOD),)
--core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
-+core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
- 
- vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
- 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-diff -urNp linux-2.6.32.13/mm/filemap.c linux-2.6.32.13/mm/filemap.c
---- linux-2.6.32.13/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/filemap.c	2010-05-15 13:21:18.370623064 -0400
-@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
- 	struct address_space *mapping = file->f_mapping;
- 
- 	if (!mapping->a_ops->readpage)
--		return -ENOEXEC;
-+		return -ENODEV;
- 	file_accessed(file);
- 	vma->vm_ops = &generic_file_vm_ops;
- 	vma->vm_flags |= VM_CAN_NONLINEAR;
-@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
-                         *pos = i_size_read(inode);
- 
- 		if (limit != RLIM_INFINITY) {
-+			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
- 			if (*pos >= limit) {
- 				send_sig(SIGXFSZ, current, 0);
- 				return -EFBIG;
-diff -urNp linux-2.6.32.13/mm/fremap.c linux-2.6.32.13/mm/fremap.c
---- linux-2.6.32.13/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/fremap.c	2010-05-15 13:21:18.370623064 -0400
-@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
-  retry:
- 	vma = find_vma(mm, start);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
-+		goto out;
-+#endif
-+
- 	/*
- 	 * Make sure the vma is shared, that it supports prefaulting,
- 	 * and that the remapped range is valid and fully within
-diff -urNp linux-2.6.32.13/mm/highmem.c linux-2.6.32.13/mm/highmem.c
---- linux-2.6.32.13/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/highmem.c	2010-05-15 13:21:18.370623064 -0400
-@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
- 		 * So no dangers, even with speculative execution.
- 		 */
- 		page = pte_page(pkmap_page_table[i]);
-+		pax_open_kernel();
- 		pte_clear(&init_mm, (unsigned long)page_address(page),
- 			  &pkmap_page_table[i]);
--
-+		pax_close_kernel();
- 		set_page_address(page, NULL);
- 		need_flush = 1;
- 	}
-@@ -177,9 +178,11 @@ start:
- 		}
- 	}
- 	vaddr = PKMAP_ADDR(last_pkmap_nr);
-+
-+	pax_open_kernel();
- 	set_pte_at(&init_mm, vaddr,
- 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
--
-+	pax_close_kernel();
- 	pkmap_count[last_pkmap_nr] = 1;
- 	set_page_address(page, (void *)vaddr);
- 
-diff -urNp linux-2.6.32.13/mm/hugetlb.c linux-2.6.32.13/mm/hugetlb.c
---- linux-2.6.32.13/mm/hugetlb.c	2010-05-15 13:20:19.411414284 -0400
-+++ linux-2.6.32.13/mm/hugetlb.c	2010-05-15 13:21:18.370623064 -0400
-@@ -1925,6 +1925,26 @@ static int unmap_ref_private(struct mm_s
- 	return 1;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	struct vm_area_struct *vma_m;
-+	unsigned long address_m;
-+	pte_t *ptep_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
-+	get_page(page_m);
-+	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
-+}
-+#endif
-+
- static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
- 			unsigned long address, pte_t *ptep, pte_t pte,
- 			struct page *pagecache_page)
-@@ -1996,6 +2016,11 @@ retry_avoidcopy:
- 		huge_ptep_clear_flush(vma, address, ptep);
- 		set_huge_pte_at(mm, address, ptep,
- 				make_huge_pte(vma, new_page, 1));
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_huge_pte(vma, address, new_page);
-+#endif
-+
- 		/* Make the old page be freed below */
- 		new_page = old_page;
- 	}
-@@ -2127,6 +2152,10 @@ retry:
- 				&& (vma->vm_flags & VM_SHARED)));
- 	set_huge_pte_at(mm, address, ptep, new_pte);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_huge_pte(vma, address, page);
-+#endif
-+
- 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
- 		/* Optimization, do the COW without a second fault */
- 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2155,6 +2184,28 @@ int hugetlb_fault(struct mm_struct *mm, 
- 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
- 	struct hstate *h = hstate_vma(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+			h = hstate_vma(vma);
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
-+			return VM_FAULT_OOM;
-+		address_m &= HPAGE_MASK;
-+		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
-+	}
-+#endif
-+
- 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
- 	if (!ptep)
- 		return VM_FAULT_OOM;
-diff -urNp linux-2.6.32.13/mm/Kconfig linux-2.6.32.13/mm/Kconfig
---- linux-2.6.32.13/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/Kconfig	2010-05-15 13:21:18.370623064 -0400
-@@ -228,7 +228,7 @@ config KSM
- config DEFAULT_MMAP_MIN_ADDR
-         int "Low address space to protect from user allocation"
- 	depends on MMU
--        default 4096
-+        default 65536
-         help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.13/mm/maccess.c linux-2.6.32.13/mm/maccess.c
---- linux-2.6.32.13/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/maccess.c	2010-05-15 13:21:18.370623064 -0400
-@@ -14,7 +14,7 @@
-  * Safely read from address @src to the buffer at @dst.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long probe_kernel_read(void *dst, void *src, size_t size)
-+long probe_kernel_read(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
-  * Safely write to address @dst from the buffer at @src.  If a kernel fault
-  * happens, handle that and return -EFAULT.
-  */
--long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
-+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
- {
- 	long ret;
- 	mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.32.13/mm/madvise.c linux-2.6.32.13/mm/madvise.c
---- linux-2.6.32.13/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/madvise.c	2010-05-15 13:21:18.378626814 -0400
-@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
- 	pgoff_t pgoff;
- 	unsigned long new_flags = vma->vm_flags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	switch (behavior) {
- 	case MADV_NORMAL:
- 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
-@@ -103,6 +107,13 @@ success:
- 	/*
- 	 * vm_flags is protected by the mmap_sem held in write mode.
- 	 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m)
-+		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
-+#endif
-+
- 	vma->vm_flags = new_flags;
- 
- out:
-@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
- 			     struct vm_area_struct ** prev,
- 			     unsigned long start, unsigned long end)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	*prev = vma;
- 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
- 		return -EINVAL;
-@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
- 		zap_page_range(vma, start, end - start, &details);
- 	} else
- 		zap_page_range(vma, start, end - start, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
-+			struct zap_details details = {
-+				.nonlinear_vma = vma_m,
-+				.last_index = ULONG_MAX,
-+			};
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
-+		} else
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
- 	if (end < start)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			goto out;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		goto out;
-+
- 	error = 0;
- 	if (end == start)
- 		goto out;
-diff -urNp linux-2.6.32.13/mm/memory.c linux-2.6.32.13/mm/memory.c
---- linux-2.6.32.13/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/memory.c	2010-05-15 13:21:18.394625565 -0400
-@@ -48,6 +48,7 @@
- #include <linux/ksm.h>
- #include <linux/rmap.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/delayacct.h>
- #include <linux/init.h>
- #include <linux/writeback.h>
-@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
- 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
- 	i = 0;
- 
--	do {
-+	while (nr_pages) {
- 		struct vm_area_struct *vma;
- 
--		vma = find_extend_vma(mm, start);
-+		vma = find_vma(mm, start);
- 		if (!vma && in_gate_area(tsk, start)) {
- 			unsigned long pg = start & PAGE_MASK;
- 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
- 			continue;
- 		}
- 
--		if (!vma ||
-+		if (!vma || start < vma->vm_start ||
- 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
- 		    !(vm_flags & vma->vm_flags))
- 			return i ? : -EFAULT;
-@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
- 			start += PAGE_SIZE;
- 			nr_pages--;
- 		} while (nr_pages && start < vma->vm_end);
--	} while (nr_pages);
-+	}
- 	return i;
- }
- 
-@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
- 		copy_user_highpage(dst, src, va, vma);
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	spinlock_t *ptl;
-+	pte_t *pte, entry;
-+
-+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-+	entry = *pte;
-+	if (!pte_present(entry)) {
-+		if (!pte_none(entry)) {
-+			BUG_ON(pte_file(entry));
-+			free_swap_and_cache(pte_to_swp_entry(entry));
-+			pte_clear_not_present_full(mm, address, pte, 0);
-+		}
-+	} else {
-+		struct page *page;
-+
-+		flush_cache_page(vma, address, pte_pfn(entry));
-+		entry = ptep_clear_flush(vma, address, pte);
-+		BUG_ON(pte_dirty(entry));
-+		page = vm_normal_page(vma, address, entry);
-+		if (page) {
-+			update_hiwater_rss(mm);
-+			if (PageAnon(page))
-+				dec_mm_counter(mm, anon_rss);
-+			else
-+				dec_mm_counter(mm, file_rss);
-+			page_remove_rmap(page);
-+			page_cache_release(page);
-+		}
-+	}
-+	pte_unmap_unlock(pte, ptl);
-+}
-+
-+/* PaX: if vma is mirrored, synchronize the mirror's PTE
-+ *
-+ * the ptl of the lower mapped page is held on entry and is not released on exit
-+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
-+ */
-+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || !PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(!PageLocked(page_m));
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_anon_rmap(page_m, vma_m, address_m);
-+	inc_mm_counter(mm, anon_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+	unlock_page(page_m);
-+}
-+
-+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	BUG_ON(!page_m || PageAnon(page_m));
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
-+	page_cache_get(page_m);
-+	page_add_file_rmap(page_m);
-+	inc_mm_counter(mm, file_rss);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+	update_mmu_cache(vma_m, address_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
-+{
-+	struct mm_struct *mm = vma->vm_mm;
-+	unsigned long address_m;
-+	spinlock_t *ptl_m;
-+	struct vm_area_struct *vma_m;
-+	pmd_t *pmd_m;
-+	pte_t *pte_m, entry_m;
-+
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (!vma_m)
-+		return;
-+
-+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
-+	address_m = address + SEGMEXEC_TASK_SIZE;
-+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
-+	pte_m = pte_offset_map_nested(pmd_m, address_m);
-+	ptl_m = pte_lockptr(mm, pmd_m);
-+	if (ptl != ptl_m) {
-+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
-+		if (!pte_none(*pte_m))
-+			goto out;
-+	}
-+
-+	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
-+	set_pte_at(mm, address_m, pte_m, entry_m);
-+out:
-+	if (ptl != ptl_m)
-+		spin_unlock(ptl_m);
-+	pte_unmap_nested(pte_m);
-+}
-+
-+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
-+{
-+	struct page *page_m;
-+	pte_t entry;
-+
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
-+		goto out;
-+
-+	entry = *pte;
-+	page_m  = vm_normal_page(vma, address, entry);
-+	if (!page_m)
-+		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
-+	else if (PageAnon(page_m)) {
-+		if (pax_find_mirror_vma(vma)) {
-+			pte_unmap_unlock(pte, ptl);
-+			lock_page(page_m);
-+			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
-+			if (pte_same(entry, *pte))
-+				pax_mirror_anon_pte(vma, address, page_m, ptl);
-+			else
-+				unlock_page(page_m);
-+		}
-+	} else
-+		pax_mirror_file_pte(vma, address, page_m, ptl);
-+
-+out:
-+	pte_unmap_unlock(pte, ptl);
-+}
-+#endif
-+
- /*
-  * This routine handles present pages, when users try to write
-  * to a shared page. It is done by copying the page to a new address
-@@ -2146,6 +2327,12 @@ gotten:
- 	 */
- 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(new_page));
-+#endif
-+
- 		if (old_page) {
- 			if (!PageAnon(old_page)) {
- 				dec_mm_counter(mm, file_rss);
-@@ -2197,6 +2384,10 @@ gotten:
- 			page_remove_rmap(old_page);
- 		}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		pax_mirror_anon_pte(vma, address, new_page, ptl);
-+#endif
-+
- 		/* Free the old page.. */
- 		new_page = old_page;
- 		ret |= VM_FAULT_WRITE;
-@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
- 	swap_free(entry);
- 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
- 		try_to_free_swap(page);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
-+#endif
-+
- 	unlock_page(page);
- 
- 	if (flags & FAULT_FLAG_WRITE) {
-@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, pte);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- out:
-@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
- 		unsigned long address, pte_t *page_table, pmd_t *pmd,
- 		unsigned int flags)
- {
--	struct page *page;
-+	struct page *page = NULL;
- 	spinlock_t *ptl;
- 	pte_t entry;
- 
-@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
- 	if (!pte_none(*page_table))
- 		goto release;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		BUG_ON(!trylock_page(page));
-+#endif
-+
- 	inc_mm_counter(mm, anon_rss);
- 	page_add_new_anon_rmap(page, vma, address);
- setpte:
-@@ -2670,6 +2876,12 @@ setpte:
- 
- 	/* No need to invalidate - it was non-present before */
- 	update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (page)
-+		pax_mirror_anon_pte(vma, address, page, ptl);
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(page_table, ptl);
- 	return 0;
-@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
- 	 */
- 	/* Only go through if we didn't race with anybody else... */
- 	if (likely(pte_same(*page_table, orig_pte))) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon && pax_find_mirror_vma(vma))
-+			BUG_ON(!trylock_page(page));
-+#endif
-+
- 		flush_icache_page(vma, page);
- 		entry = mk_pte(page, vma->vm_page_prot);
- 		if (flags & FAULT_FLAG_WRITE)
-@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
- 
- 		/* no need to invalidate: a not-present page won't be cached */
- 		update_mmu_cache(vma, address, entry);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (anon)
-+			pax_mirror_anon_pte(vma, address, page, ptl);
-+		else
-+			pax_mirror_file_pte(vma, address, page, ptl);
-+#endif
-+
- 	} else {
- 		if (charged)
- 			mem_cgroup_uncharge_page(page);
-@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
- 		if (flags & FAULT_FLAG_WRITE)
- 			flush_tlb_page(vma, address);
- 	}
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	pax_mirror_pte(vma, address, pte, pmd, ptl);
-+	return 0;
-+#endif
-+
- unlock:
- 	pte_unmap_unlock(pte, ptl);
- 	return 0;
-@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
- 	pmd_t *pmd;
- 	pte_t *pte;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	__set_current_state(TASK_RUNNING);
- 
- 	count_vm_event(PGFAULT);
-@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
- 	if (unlikely(is_vm_hugetlb_page(vma)))
- 		return hugetlb_fault(mm, vma, address, flags);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+	if (vma_m) {
-+		unsigned long address_m;
-+		pgd_t *pgd_m;
-+		pud_t *pud_m;
-+		pmd_t *pmd_m;
-+
-+		if (vma->vm_start > vma_m->vm_start) {
-+			address_m = address;
-+			address -= SEGMEXEC_TASK_SIZE;
-+			vma = vma_m;
-+		} else
-+			address_m = address + SEGMEXEC_TASK_SIZE;
-+
-+		pgd_m = pgd_offset(mm, address_m);
-+		pud_m = pud_alloc(mm, pgd_m, address_m);
-+		if (!pud_m)
-+			return VM_FAULT_OOM;
-+		pmd_m = pmd_alloc(mm, pud_m, address_m);
-+		if (!pmd_m)
-+			return VM_FAULT_OOM;
-+		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
-+			return VM_FAULT_OOM;
-+		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
-+	}
-+#endif
-+
- 	pgd = pgd_offset(mm, address);
- 	pud = pud_alloc(mm, pgd, address);
- 	if (!pud)
-@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
- 	gate_vma.vm_start = FIXADDR_USER_START;
- 	gate_vma.vm_end = FIXADDR_USER_END;
- 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
--	gate_vma.vm_page_prot = __P101;
-+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
- 	/*
- 	 * Make sure the vDSO gets into every core dump.
- 	 * Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.32.13/mm/memory-failure.c linux-2.6.32.13/mm/memory-failure.c
---- linux-2.6.32.13/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/memory-failure.c	2010-05-15 13:21:18.394625565 -0400
-@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
- 
- int sysctl_memory_failure_recovery __read_mostly = 1;
- 
--atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
-+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
- 
- /*
-  * Send all the processes who have the page mapped an ``action optional''
-@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
- 		return 0;
- 	}
- 
--	atomic_long_add(1, &mce_bad_pages);
-+	atomic_long_add_unchecked(1, &mce_bad_pages);
- 
- 	/*
- 	 * We need/can do nothing about count=0 pages.
-diff -urNp linux-2.6.32.13/mm/mempolicy.c linux-2.6.32.13/mm/mempolicy.c
---- linux-2.6.32.13/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
-+++ linux-2.6.32.13/mm/mempolicy.c	2010-05-15 13:21:18.411130134 -0400
-@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
- 	struct vm_area_struct *next;
- 	int err;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m;
-+#endif
-+
- 	err = 0;
- 	for (; vma && vma->vm_start < end; vma = next) {
- 		next = vma->vm_next;
-@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
- 			err = policy_vma(vma, new);
- 		if (err)
- 			break;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		vma_m = pax_find_mirror_vma(vma);
-+		if (vma_m) {
-+			err = policy_vma(vma_m, new);
-+			if (err)
-+				break;
-+		}
-+#endif
-+
- 	}
- 	return err;
- }
-@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
- 
- 	if (end < start)
- 		return -EINVAL;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (end == start)
- 		return 0;
- 
-@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
- 
- 	if (file) {
- 		seq_printf(m, " file=");
--		seq_path(m, &file->f_path, "\n\t= ");
-+		seq_path(m, &file->f_path, "\n\t\\= ");
- 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
- 		seq_printf(m, " heap");
- 	} else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.32.13/mm/migrate.c linux-2.6.32.13/mm/migrate.c
---- linux-2.6.32.13/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/migrate.c	2010-05-15 13:21:18.411130134 -0400
-@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	if (!mm)
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
-+	if (mm != current->mm &&
-+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
-+		err = -EPERM;
-+		goto out;
-+	}
-+#endif
-+
- 	/*
- 	 * Check if this process has the right to modify the specified
- 	 * process. The right exists if the process has administrative
-@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
- 	rcu_read_lock();
- 	tcred = __task_cred(task);
- 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
--	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
--	    !capable(CAP_SYS_NICE)) {
-+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
- 		rcu_read_unlock();
- 		err = -EPERM;
- 		goto out;
-diff -urNp linux-2.6.32.13/mm/mlock.c linux-2.6.32.13/mm/mlock.c
---- linux-2.6.32.13/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/mlock.c	2010-05-15 13:21:18.411130134 -0400
-@@ -13,6 +13,7 @@
- #include <linux/pagemap.h>
- #include <linux/mempolicy.h>
- #include <linux/syscalls.h>
-+#include <linux/security.h>
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/rmap.h>
-@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
- 		return -EINVAL;
- 	if (end == start)
- 		return 0;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	vma = find_vma_prev(current->mm, start, &prev);
- 	if (!vma || vma->vm_start > start)
- 		return -ENOMEM;
-@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	/* check against resource limits */
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
- 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
- 		error = do_mlock(start, len, 1);
- 	up_write(&current->mm->mmap_sem);
-@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
- static int do_mlockall(int flags)
- {
- 	struct vm_area_struct * vma, * prev = NULL;
--	unsigned int def_flags = 0;
-+	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
- 
- 	if (flags & MCL_FUTURE)
--		def_flags = VM_LOCKED;
-+		def_flags |= VM_LOCKED;
- 	current->mm->def_flags = def_flags;
- 	if (flags == MCL_FUTURE)
- 		goto out;
-@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
- 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
- 		unsigned int newflags;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
-+			break;
-+#endif
-+
-+		BUG_ON(vma->vm_end > TASK_SIZE);
- 		newflags = vma->vm_flags | VM_LOCKED;
- 		if (!(flags & MCL_CURRENT))
- 			newflags &= ~VM_LOCKED;
-@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
- 	lock_limit >>= PAGE_SHIFT;
- 
- 	ret = -ENOMEM;
-+	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
- 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
- 	    capable(CAP_IPC_LOCK))
- 		ret = do_mlockall(flags);
-diff -urNp linux-2.6.32.13/mm/mmap.c linux-2.6.32.13/mm/mmap.c
---- linux-2.6.32.13/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/mmap.c	2010-05-15 13:21:18.411130134 -0400
-@@ -45,6 +45,16 @@
- #define arch_rebalance_pgtables(addr, len)		(addr)
- #endif
- 
-+static inline void verify_mm_writelocked(struct mm_struct *mm)
-+{
-+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
-+	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-+		up_read(&mm->mmap_sem);
-+		BUG();
-+	}
-+#endif
-+}
-+
- static void unmap_region(struct mm_struct *mm,
- 		struct vm_area_struct *vma, struct vm_area_struct *prev,
- 		unsigned long start, unsigned long end);
-@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
-  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
-  *
-  */
--pgprot_t protection_map[16] = {
-+pgprot_t protection_map[16] __read_only = {
- 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
- 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
- };
- 
- pgprot_t vm_get_page_prot(unsigned long vm_flags)
- {
--	return __pgprot(pgprot_val(protection_map[vm_flags &
-+	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
- 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
- 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if (!nx_enabled &&
-+	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
-+	    (vm_flags & (VM_READ | VM_WRITE)))
-+		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
-+#endif
-+
-+	return prot;
- }
- EXPORT_SYMBOL(vm_get_page_prot);
- 
-@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
- 	struct vm_area_struct *next = vma->vm_next;
- 
- 	might_sleep();
-+	BUG_ON(vma->vm_mirror);
- 	if (vma->vm_ops && vma->vm_ops->close)
- 		vma->vm_ops->close(vma);
- 	if (vma->vm_file) {
-@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
- 	 * not page aligned -Ram Gupta
- 	 */
- 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-+	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
- 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
- 			(mm->end_data - mm->start_data) > rlim)
- 		goto out;
-@@ -694,6 +715,12 @@ static int
- can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		if (vma->vm_pgoff == vm_pgoff)
-@@ -713,6 +740,12 @@ static int
- can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
- 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
-+		return 0;
-+#endif
-+
- 	if (is_mergeable_vma(vma, file, vm_flags) &&
- 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
- 		pgoff_t vm_pglen;
-@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
- struct vm_area_struct *vma_merge(struct mm_struct *mm,
- 			struct vm_area_struct *prev, unsigned long addr,
- 			unsigned long end, unsigned long vm_flags,
--		     	struct anon_vma *anon_vma, struct file *file,
-+			struct anon_vma *anon_vma, struct file *file,
- 			pgoff_t pgoff, struct mempolicy *policy)
- {
- 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
- 	struct vm_area_struct *area, *next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
-+	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
-+
-+	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
-+#endif
-+
- 	/*
- 	 * We later require that vma->vm_flags == vm_flags,
- 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
- 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
- 		next = next->vm_next;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (prev)
-+		prev_m = pax_find_mirror_vma(prev);
-+	if (area)
-+		area_m = pax_find_mirror_vma(area);
-+	if (next)
-+		next_m = pax_find_mirror_vma(next);
-+#endif
-+
- 	/*
- 	 * Can it merge with the predecessor?
- 	 */
-@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
- 							/* cases 1, 6 */
- 			vma_adjust(prev, prev->vm_start,
- 				next->vm_end, prev->vm_pgoff, NULL);
--		} else					/* cases 2, 5, 7 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					next_m->vm_end, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 2, 5, 7 */
- 			vma_adjust(prev, prev->vm_start,
- 				end, prev->vm_pgoff, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					end_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		}
- 		return prev;
- 	}
- 
-@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
-  			mpol_equal(policy, vma_policy(next)) &&
- 			can_vma_merge_before(next, vm_flags,
- 					anon_vma, file, pgoff+pglen)) {
--		if (prev && addr < prev->vm_end)	/* case 4 */
-+		if (prev && addr < prev->vm_end) {	/* case 4 */
- 			vma_adjust(prev, prev->vm_start,
- 				addr, prev->vm_pgoff, NULL);
--		else					/* cases 3, 8 */
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (prev_m)
-+				vma_adjust(prev_m, prev_m->vm_start,
-+					addr_m, prev_m->vm_pgoff, NULL);
-+#endif
-+
-+		} else {				/* cases 3, 8 */
- 			vma_adjust(area, addr, next->vm_end,
- 				next->vm_pgoff - pglen, NULL);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (area_m)
-+				vma_adjust(area_m, addr_m, next_m->vm_end,
-+					next_m->vm_pgoff - pglen, NULL);
-+#endif
-+
-+		}
- 		return area;
- 	}
- 
-@@ -888,14 +967,11 @@ none:
- void vm_stat_account(struct mm_struct *mm, unsigned long flags,
- 						struct file *file, long pages)
- {
--	const unsigned long stack_flags
--		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
--
- 	if (file) {
- 		mm->shared_vm += pages;
- 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
- 			mm->exec_vm += pages;
--	} else if (flags & stack_flags)
-+	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
- 		mm->stack_vm += pages;
- 	if (flags & (VM_RESERVED|VM_IO))
- 		mm->reserved_vm += pages;
-@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	 * (the exception is when the underlying filesystem is noexec
- 	 *  mounted, in which case we dont add PROT_EXEC.)
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
- 			prot |= PROT_EXEC;
- 
-@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
- 	/* Obtain the address to map to. we verify (or select) it and ensure
- 	 * that it represents a valid section of the address space.
- 	 */
--	addr = get_unmapped_area(file, addr, len, pgoff, flags);
-+	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
- 	if (addr & ~PAGE_MASK)
- 		return addr;
- 
-@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
- 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
- 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT) {
-+			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
-+				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+			else
-+				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+		}
-+#endif
-+
-+	}
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
-+		vm_flags &= ~VM_PAGEEXEC;
-+#endif
-+
- 	if (flags & MAP_LOCKED)
- 		if (!can_do_mlock())
- 			return -EPERM;
-@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
- 			return -EAGAIN;
- 	}
-@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
- 	if (error)
- 		return error;
- 
-+	if (!gr_acl_handle_mmap(file, prot))
-+		return -EACCES;
-+
- 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
- }
- EXPORT_SYMBOL(do_mmap_pgoff);
-@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
-  */
- int vma_wants_writenotify(struct vm_area_struct *vma)
- {
--	unsigned int vm_flags = vma->vm_flags;
-+	unsigned long vm_flags = vma->vm_flags;
- 
- 	/* If it was private or non-writable, the write bit is already clear */
--	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
-+	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
- 		return 0;
- 
- 	/* The backer wishes to know when pages are first written to? */
-@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
- 	unsigned long charged = 0;
- 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	/* Clear old maps */
- 	error = -ENOMEM;
--munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limit. */
-@@ -1163,6 +1273,16 @@ munmap_back:
- 		goto unacct_error;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			error = -ENOMEM;
-+			goto free_vma;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -1185,6 +1305,19 @@ munmap_back:
- 		error = file->f_op->mmap(file, vma);
- 		if (error)
- 			goto unmap_and_free_vma;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma_m && (vm_flags & VM_EXECUTABLE))
-+			added_exe_file_vma(mm);
-+#endif
-+
-+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
-+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
-+			vma->vm_flags |= VM_PAGEEXEC;
-+			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
-+		}
-+#endif
-+
- 		if (vm_flags & VM_EXECUTABLE)
- 			added_exe_file_vma(mm);
- 
-@@ -1208,6 +1341,11 @@ munmap_back:
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- 	file = vma->vm_file;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	/* Once vma denies write, undo our temporary denial count */
- 	if (correct_wcount)
- 		atomic_inc(&inode->i_writecount);
-@@ -1216,6 +1354,7 @@ out:
- 
- 	mm->total_vm += len >> PAGE_SHIFT;
- 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
-+	track_exec_limit(mm, addr, addr + len, vm_flags);
- 	if (vm_flags & VM_LOCKED) {
- 		/*
- 		 * makes pages present; downgrades, drops, reacquires mmap_sem
-@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
- 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
- 	charged = 0;
- free_vma:
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		kmem_cache_free(vm_area_cachep, vma_m);
-+#endif
-+
- 	kmem_cache_free(vm_area_cachep, vma);
- unacct_error:
- 	if (charged)
-@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
- 		vma = find_vma(mm, addr);
-@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
- 			return addr;
- 	}
- 	if (len > mm->cached_hole_size) {
--	        start_addr = addr = mm->free_area_cache;
-+		start_addr = addr = mm->free_area_cache;
- 	} else {
--	        start_addr = addr = TASK_UNMAPPED_BASE;
--	        mm->cached_hole_size = 0;
-+		start_addr = addr = mm->mmap_base;
-+		mm->cached_hole_size = 0;
- 	}
- 
- full_search:
-@@ -1293,9 +1442,8 @@ full_search:
- 			 * Start a new search - just in case we missed
- 			 * some holes.
- 			 */
--			if (start_addr != TASK_UNMAPPED_BASE) {
--				addr = TASK_UNMAPPED_BASE;
--			        start_addr = addr;
-+			if (start_addr != mm->mmap_base) {
-+				start_addr = addr = mm->mmap_base;
- 				mm->cached_hole_size = 0;
- 				goto full_search;
- 			}
-@@ -1317,10 +1465,16 @@ full_search:
- 
- void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the lowest possible address?
- 	 */
--	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
-+	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
- 		mm->free_area_cache = addr;
- 		mm->cached_hole_size = ~0UL;
- 	}
-@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
- {
- 	struct vm_area_struct *vma;
- 	struct mm_struct *mm = current->mm;
--	unsigned long addr = addr0;
-+	unsigned long base = mm->mmap_base, addr = addr0;
- 
- 	/* requested length too big for entire address space */
- 	if (len > TASK_SIZE)
-@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
- 	if (flags & MAP_FIXED)
- 		return addr;
- 
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
-+#endif
-+
- 	/* requesting a specific address */
- 	if (addr) {
- 		addr = PAGE_ALIGN(addr);
-@@ -1404,13 +1562,21 @@ bottomup:
- 	 * can happen with large stack limits and large mmap()
- 	 * allocations.
- 	 */
-+	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
-+	mm->free_area_cache = mm->mmap_base;
- 	mm->cached_hole_size = ~0UL;
--  	mm->free_area_cache = TASK_UNMAPPED_BASE;
- 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
- 	/*
- 	 * Restore the topdown base:
- 	 */
--	mm->free_area_cache = mm->mmap_base;
-+	mm->mmap_base = base;
-+	mm->free_area_cache = base;
- 	mm->cached_hole_size = ~0UL;
- 
- 	return addr;
-@@ -1419,6 +1585,12 @@ bottomup:
- 
- void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
- {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
-+		return;
-+#endif
-+
- 	/*
- 	 * Is this a new hole at the highest possible address?
- 	 */
-@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
- 		mm->free_area_cache = addr;
- 
- 	/* dont allow allocations above current base */
--	if (mm->free_area_cache > mm->mmap_base)
-+	if (mm->free_area_cache > mm->mmap_base) {
- 		mm->free_area_cache = mm->mmap_base;
-+		mm->cached_hole_size = ~0UL;
-+	}
- }
- 
- unsigned long
-@@ -1535,6 +1709,27 @@ out:
- 	return prev ? prev->vm_next : vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *vma_m;
-+
-+	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
-+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
-+		BUG_ON(vma->vm_mirror);
-+		return NULL;
-+	}
-+	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
-+	vma_m = vma->vm_mirror;
-+	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
-+	BUG_ON(vma->vm_file != vma_m->vm_file);
-+	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
-+	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
-+	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
-+	return vma_m;
-+}
-+#endif
-+
- /*
-  * Verify that the stack growth is acceptable and
-  * update accounting. This is shared with both the
-@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
- 		return -ENOMEM;
- 
- 	/* Stack limit test */
-+	gr_learn_resource(current, RLIMIT_STACK, size, 1);
- 	if (size > rlim[RLIMIT_STACK].rlim_cur)
- 		return -ENOMEM;
- 
-@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
- 		unsigned long limit;
- 		locked = mm->locked_vm + grow;
- 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
- 		if (locked > limit && !capable(CAP_IPC_LOCK))
- 			return -ENOMEM;
- 	}
-@@ -1595,35 +1792,40 @@ static
- #endif
- int expand_upwards(struct vm_area_struct *vma, unsigned long address)
- {
--	int error;
-+	int error, locknext;
- 
- 	if (!(vma->vm_flags & VM_GROWSUP))
- 		return -EFAULT;
- 
-+	/* Also guard against wrapping around to address 0. */
-+	if (address < PAGE_ALIGN(address+1))
-+		address = PAGE_ALIGN(address+1);
-+	else
-+		return -ENOMEM;
-+
- 	/*
- 	 * We must make sure the anon_vma is allocated
- 	 * so that the anon_vma locking is not a noop.
- 	 */
- 	if (unlikely(anon_vma_prepare(vma)))
- 		return -ENOMEM;
-+	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
-+	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
-+		return -ENOMEM;
- 	anon_vma_lock(vma);
-+	if (locknext)
-+		anon_vma_lock(vma->vm_next);
- 
- 	/*
- 	 * vma->vm_start/vm_end cannot change under us because the caller
- 	 * is required to hold the mmap_sem in read mode.  We need the
--	 * anon_vma lock to serialize against concurrent expand_stacks.
--	 * Also guard against wrapping around to address 0.
-+	 * anon_vma locks to serialize against concurrent expand_stacks
-+	 * and expand_upwards.
- 	 */
--	if (address < PAGE_ALIGN(address+4))
--		address = PAGE_ALIGN(address+4);
--	else {
--		anon_vma_unlock(vma);
--		return -ENOMEM;
--	}
- 	error = 0;
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address > vma->vm_end) {
-+	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
- 		unsigned long size, grow;
- 
- 		size = address - vma->vm_start;
-@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
- 		if (!error)
- 			vma->vm_end = address;
- 	}
-+	if (locknext)
-+		anon_vma_unlock(vma->vm_next);
- 	anon_vma_unlock(vma);
- 	return error;
- }
-@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
- static int expand_downwards(struct vm_area_struct *vma,
- 				   unsigned long address)
- {
--	int error;
-+	int error, lockprev = 0;
-+	struct vm_area_struct *prev = NULL;
- 
- 	/*
- 	 * We must make sure the anon_vma is allocated
-@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
- 	if (error)
- 		return error;
- 
-+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
-+	find_vma_prev(vma->vm_mm, address, &prev);
-+	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
-+#endif
-+	if (lockprev && unlikely(anon_vma_prepare(prev)))
-+		return -ENOMEM;
-+	if (lockprev)
-+		anon_vma_lock(prev);
-+
- 	anon_vma_lock(vma);
- 
- 	/*
-@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
- 	 */
- 
- 	/* Somebody else might have raced and expanded it already */
--	if (address < vma->vm_start) {
-+	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
- 		unsigned long size, grow;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+
-+		vma_m = pax_find_mirror_vma(vma);
-+#endif
-+
- 		size = vma->vm_end - address;
- 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
- 
-@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
- 		if (!error) {
- 			vma->vm_start = address;
- 			vma->vm_pgoff -= grow;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			if (vma_m) {
-+				vma_m->vm_start -= grow << PAGE_SHIFT;
-+				vma_m->vm_pgoff -= grow;
-+			}
-+#endif
-+
- 		}
- 	}
- 	anon_vma_unlock(vma);
-+	if (lockprev)
-+		anon_vma_unlock(prev);
- 	return error;
- }
- 
-@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
- 	do {
- 		long nrpages = vma_pages(vma);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
-+			vma = remove_vma(vma);
-+			continue;
-+		}
-+#endif
-+
- 		mm->total_vm -= nrpages;
- 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
- 		vma = remove_vma(vma);
-@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
- 
- 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
- 	do {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (vma->vm_mirror) {
-+			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
-+			vma->vm_mirror->vm_mirror = NULL;
-+			vma->vm_mirror->vm_flags &= ~VM_EXEC;
-+			vma->vm_mirror = NULL;
-+		}
-+#endif
-+
- 		rb_erase(&vma->vm_rb, &mm->mm_rb);
- 		mm->map_count--;
- 		tail_vma = vma;
-@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
- 	struct mempolicy *pol;
- 	struct vm_area_struct *new;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m, *new_m = NULL;
-+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (is_vm_hugetlb_page(vma) && (addr &
- 					~(huge_page_mask(hstate_vma(vma)))))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	vma_m = pax_find_mirror_vma(vma);
-+
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
-+		if (mm->map_count >= sysctl_max_map_count-1)
-+			return -ENOMEM;
-+	} else
-+#endif
-+
- 	if (mm->map_count >= sysctl_max_map_count)
- 		return -ENOMEM;
- 
-@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
- 	if (!new)
- 		return -ENOMEM;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
-+		if (!new_m) {
-+			kmem_cache_free(vm_area_cachep, new);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	/* most fields are the same, copy all, and then fixup */
- 	*new = *vma;
- 
-@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
- 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		*new_m = *vma_m;
-+		new_m->vm_mirror = new;
-+		new->vm_mirror = new_m;
-+
-+		if (new_below)
-+			new_m->vm_end = addr_m;
-+		else {
-+			new_m->vm_start = addr_m;
-+			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
-+		}
-+	}
-+#endif
-+
- 	pol = mpol_dup(vma_policy(vma));
- 	if (IS_ERR(pol)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		if (new_m)
-+			kmem_cache_free(vm_area_cachep, new_m);
-+#endif
-+
- 		kmem_cache_free(vm_area_cachep, new);
- 		return PTR_ERR(pol);
- 	}
-@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
- 	else
- 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m) {
-+		mpol_get(pol);
-+		vma_set_policy(new_m, pol);
-+
-+		if (new_m->vm_file) {
-+			get_file(new_m->vm_file);
-+			if (vma_m->vm_flags & VM_EXECUTABLE)
-+				added_exe_file_vma(mm);
-+		}
-+
-+		if (new_m->vm_ops && new_m->vm_ops->open)
-+			new_m->vm_ops->open(new_m);
-+
-+		if (new_below)
-+			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
-+				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
-+		else
-+			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
-+	}
-+#endif
-+
- 	return 0;
- }
- 
-@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
-  * work.  This now handles partial unmappings.
-  * Jeremy Fitzhardinge <jeremy@goop.org>
-  */
-+#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
-+	int ret = __do_munmap(mm, start, len);
-+	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
-+		return ret;
-+
-+	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
-+}
-+
-+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
-+#endif
-+{
- 	unsigned long end;
- 	struct vm_area_struct *vma, *prev, *last;
- 
-+	/*
-+	 * mm->mmap_sem is required to protect against another thread
-+	 * changing the mappings in case we sleep.
-+	 */
-+	verify_mm_writelocked(mm);
-+
- 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
- 		return -EINVAL;
- 
-@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
- 	/* Fix up all other VM information */
- 	remove_vma_list(mm, vma);
- 
-+	track_exec_limit(mm, start, end, 0UL);
-+
- 	return 0;
- }
- 
-@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
- 
- 	profile_munmap(addr);
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
-+	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
-+		return -EINVAL;
-+#endif
-+
- 	down_write(&mm->mmap_sem);
- 	ret = do_munmap(mm, addr, len);
- 	up_write(&mm->mmap_sem);
- 	return ret;
- }
- 
--static inline void verify_mm_writelocked(struct mm_struct *mm)
--{
--#ifdef CONFIG_DEBUG_VM
--	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
--		WARN_ON(1);
--		up_read(&mm->mmap_sem);
--	}
--#endif
--}
--
- /*
-  *  this is really a simplified "do_mmap".  it only handles
-  *  anonymous maps.  eventually we may be able to do some
-@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
- 	struct rb_node ** rb_link, * rb_parent;
- 	pgoff_t pgoff = addr >> PAGE_SHIFT;
- 	int error;
-+	unsigned long charged;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
- 
- 	len = PAGE_ALIGN(len);
- 	if (!len)
-@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
- 
- 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
- 
-+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
-+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
-+		flags &= ~VM_EXEC;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+		if (mm->pax_flags & MF_PAX_MPROTECT)
-+			flags &= ~VM_MAYEXEC;
-+#endif
-+
-+	}
-+#endif
-+
- 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
- 	if (error & ~PAGE_MASK)
- 		return error;
- 
-+	charged = len >> PAGE_SHIFT;
-+
- 	/*
- 	 * mlock MCL_FUTURE?
- 	 */
- 	if (mm->def_flags & VM_LOCKED) {
- 		unsigned long locked, lock_limit;
--		locked = len >> PAGE_SHIFT;
-+		locked = charged;
- 		locked += mm->locked_vm;
- 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
- 		lock_limit >>= PAGE_SHIFT;
-@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
- 	/*
- 	 * Clear old maps.  this also does some error checking for us
- 	 */
-- munmap_back:
- 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
- 	if (vma && vma->vm_start < addr + len) {
- 		if (do_munmap(mm, addr, len))
- 			return -ENOMEM;
--		goto munmap_back;
-+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
-+		BUG_ON(vma && vma->vm_start < addr + len);
- 	}
- 
- 	/* Check against address space limits *after* clearing old maps... */
--	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
-+	if (!may_expand_vm(mm, charged))
- 		return -ENOMEM;
- 
- 	if (mm->map_count > sysctl_max_map_count)
- 		return -ENOMEM;
- 
--	if (security_vm_enough_memory(len >> PAGE_SHIFT))
-+	if (security_vm_enough_memory(charged))
- 		return -ENOMEM;
- 
- 	/* Can we just expand an old private anonymous mapping? */
-@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
- 	 */
- 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
- 	if (!vma) {
--		vm_unacct_memory(len >> PAGE_SHIFT);
-+		vm_unacct_memory(charged);
- 		return -ENOMEM;
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m) {
-+			kmem_cache_free(vm_area_cachep, vma);
-+			vm_unacct_memory(charged);
-+			return -ENOMEM;
-+		}
-+	}
-+#endif
-+
- 	vma->vm_mm = mm;
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
-@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
- 	vma->vm_page_prot = vm_get_page_prot(flags);
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
- out:
--	mm->total_vm += len >> PAGE_SHIFT;
-+	mm->total_vm += charged;
- 	if (flags & VM_LOCKED) {
- 		if (!mlock_vma_pages_range(vma, addr, addr + len))
--			mm->locked_vm += (len >> PAGE_SHIFT);
-+			mm->locked_vm += charged;
- 	}
-+	track_exec_limit(mm, addr, addr + len, flags);
- 	return addr;
- }
- 
-@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
- 	 * Walk the list again, actually closing and freeing it,
- 	 * with preemption enabled, without holding any MM locks.
- 	 */
--	while (vma)
-+	while (vma) {
-+		vma->vm_mirror = NULL;
- 		vma = remove_vma(vma);
-+	}
- 
- 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
- }
-@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
- 	struct vm_area_struct * __vma, * prev;
- 	struct rb_node ** rb_link, * rb_parent;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+#endif
-+
- 	/*
- 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
- 	 * until its first write fault, when page's anon_vma and index
-@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
- 	if ((vma->vm_flags & VM_ACCOUNT) &&
- 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
-+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+		if (!vma_m)
-+			return -ENOMEM;
-+	}
-+#endif
-+
- 	vma_link(mm, vma, prev, rb_link, rb_parent);
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (vma_m)
-+		pax_mirror_vma(vma_m, vma);
-+#endif
-+
- 	return 0;
- }
- 
-@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
- 	struct rb_node **rb_link, *rb_parent;
- 	struct mempolicy *pol;
- 
-+	BUG_ON(vma->vm_mirror);
-+
- 	/*
- 	 * If anonymous vma has not yet been faulted, update new pgoff
- 	 * to match new location, to increase its chance of merging.
-@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
- 	return new_vma;
- }
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
-+{
-+	struct vm_area_struct *prev_m;
-+	struct rb_node **rb_link_m, *rb_parent_m;
-+	struct mempolicy *pol_m;
-+
-+	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
-+	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
-+	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
-+	*vma_m = *vma;
-+	pol_m = vma_policy(vma_m);
-+	mpol_get(pol_m);
-+	vma_set_policy(vma_m, pol_m);
-+	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
-+	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
-+	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
-+	if (vma_m->vm_file)
-+		get_file(vma_m->vm_file);
-+	if (vma_m->vm_ops && vma_m->vm_ops->open)
-+		vma_m->vm_ops->open(vma_m);
-+	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
-+	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
-+	vma_m->vm_mirror = vma;
-+	vma->vm_mirror = vma_m;
-+}
-+#endif
-+
- /*
-  * Return true if the calling process may expand its vm space by the passed
-  * number of pages
-@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
- 	unsigned long lim;
- 
- 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
--
-+	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
- 	if (cur + npages > lim)
- 		return 0;
- 	return 1;
-@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
- 	vma->vm_start = addr;
- 	vma->vm_end = addr + len;
- 
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->pax_flags & MF_PAX_MPROTECT) {
-+		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
-+			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
-+		else
-+			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
-+	}
-+#endif
-+
- 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
- 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
- 
-diff -urNp linux-2.6.32.13/mm/mprotect.c linux-2.6.32.13/mm/mprotect.c
---- linux-2.6.32.13/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/mprotect.c	2010-05-15 13:21:18.411130134 -0400
-@@ -24,10 +24,16 @@
- #include <linux/mmu_notifier.h>
- #include <linux/migrate.h>
- #include <linux/perf_event.h>
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+#include <linux/elf.h>
-+#endif
-+
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- #include <asm/cacheflush.h>
- #include <asm/tlbflush.h>
-+#include <asm/mmu_context.h>
- 
- #ifndef pgprot_modify
- static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
-@@ -132,6 +138,48 @@ static void change_protection(struct vm_
- 	flush_tlb_range(vma, start, end);
- }
- 
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+/* called while holding the mmap semaphor for writing except stack expansion */
-+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
-+{
-+	unsigned long oldlimit, newlimit = 0UL;
-+
-+	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
-+		return;
-+
-+	spin_lock(&mm->page_table_lock);
-+	oldlimit = mm->context.user_cs_limit;
-+	if ((prot & VM_EXEC) && oldlimit < end)
-+		/* USER_CS limit moved up */
-+		newlimit = end;
-+	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
-+		/* USER_CS limit moved down */
-+		newlimit = start;
-+
-+	if (newlimit) {
-+		mm->context.user_cs_limit = newlimit;
-+
-+#ifdef CONFIG_SMP
-+		wmb();
-+		cpus_clear(mm->context.cpu_user_cs_mask);
-+		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
-+#endif
-+
-+		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
-+	}
-+	spin_unlock(&mm->page_table_lock);
-+	if (newlimit == end) {
-+		struct vm_area_struct *vma = find_vma(mm, oldlimit);
-+
-+		for (; vma && vma->vm_start < end; vma = vma->vm_next)
-+			if (is_vm_hugetlb_page(vma))
-+				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
-+			else
-+				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
-+	}
-+}
-+#endif
-+
- int
- mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
- 	unsigned long start, unsigned long end, unsigned long newflags)
-@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
- 	int error;
- 	int dirty_accountable = 0;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	struct vm_area_struct *vma_m = NULL;
-+	unsigned long start_m, end_m;
-+
-+	start_m = start + SEGMEXEC_TASK_SIZE;
-+	end_m = end + SEGMEXEC_TASK_SIZE;
-+#endif
-+
- 	if (newflags == oldflags) {
- 		*pprev = vma;
- 		return 0;
-@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
- 		}
- 	}
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
-+		if (start != vma->vm_start) {
-+			error = split_vma(mm, vma, start, 1);
-+			if (error)
-+				goto fail;
-+			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
-+			*pprev = (*pprev)->vm_next;
-+		}
-+
-+		if (end != vma->vm_end) {
-+			error = split_vma(mm, vma, end, 0);
-+			if (error)
-+				goto fail;
-+		}
-+
-+		if (pax_find_mirror_vma(vma)) {
-+			error = __do_munmap(mm, start_m, end_m - start_m);
-+			if (error)
-+				goto fail;
-+		} else {
-+			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
-+			if (!vma_m) {
-+				error = -ENOMEM;
-+				goto fail;
-+			}
-+			vma->vm_flags = newflags;
-+			pax_mirror_vma(vma_m, vma);
-+		}
-+	}
-+#endif
-+
- 	/*
- 	 * First try to merge with previous and/or next vma.
- 	 */
-@@ -196,8 +284,14 @@ success:
- 	 * held in write mode.
- 	 */
- 	vma->vm_flags = newflags;
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (mm->binfmt && mm->binfmt->handle_mprotect)
-+		mm->binfmt->handle_mprotect(vma, newflags);
-+#endif
-+
- 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
--					  vm_get_page_prot(newflags));
-+					  vm_get_page_prot(vma->vm_flags));
- 
- 	if (vma_wants_writenotify(vma)) {
- 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
-@@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	end = start + len;
- 	if (end <= start)
- 		return -ENOMEM;
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
-+		if (end > SEGMEXEC_TASK_SIZE)
-+			return -EINVAL;
-+	} else
-+#endif
-+
-+	if (end > TASK_SIZE)
-+		return -EINVAL;
-+
- 	if (!arch_validate_prot(prot))
- 		return -EINVAL;
- 
-@@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	/*
- 	 * Does the application expect PROT_READ to imply PROT_EXEC:
- 	 */
--	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
- 		prot |= PROT_EXEC;
- 
- 	vm_flags = calc_vm_prot_bits(prot);
-@@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 	if (start > vma->vm_start)
- 		prev = vma;
- 
-+	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
-+		error = -EACCES;
-+		goto out;
-+	}
-+
-+#ifdef CONFIG_PAX_MPROTECT
-+	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
-+		current->mm->binfmt->handle_mprotect(vma, vm_flags);
-+#endif
-+
- 	for (nstart = start ; ; ) {
- 		unsigned long newflags;
- 
-@@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
- 		if (error)
- 			goto out;
- 		perf_event_mmap(vma);
-+
-+		track_exec_limit(current->mm, nstart, tmp, vm_flags);
-+
- 		nstart = tmp;
- 
- 		if (nstart < prev->vm_end)
-diff -urNp linux-2.6.32.13/mm/mremap.c linux-2.6.32.13/mm/mremap.c
---- linux-2.6.32.13/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/mremap.c	2010-05-15 13:21:18.411130134 -0400
-@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
- 			continue;
- 		pte = ptep_clear_flush(vma, old_addr, old_pte);
- 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
-+
-+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
-+		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
-+			pte = pte_exprotect(pte);
-+#endif
-+
- 		set_pte_at(mm, new_addr, new_pte, pte);
- 	}
- 
-@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
- 	if (is_vm_hugetlb_page(vma))
- 		goto Einval;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (pax_find_mirror_vma(vma))
-+		goto Einval;
-+#endif
-+
- 	/* We can't remap across vm area boundaries */
- 	if (old_len > vma->vm_end - addr)
- 		goto Efault;
-@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
- 	unsigned long map_flags;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (new_addr & ~PAGE_MASK)
- 		goto out;
- 
--	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
- 		goto out;
- 
- 	/* Check if the location we're moving into overlaps the
- 	 * old location at all, and fail if it does.
- 	 */
--	if ((new_addr <= addr) && (new_addr+new_len) > addr)
--		goto out;
--
--	if ((addr <= new_addr) && (addr+old_len) > new_addr)
-+	if (addr + old_len > new_addr && new_addr + new_len > addr)
- 		goto out;
- 
- 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
- 	struct vm_area_struct *vma;
- 	unsigned long ret = -EINVAL;
- 	unsigned long charged = 0;
-+	unsigned long pax_task_size = TASK_SIZE;
- 
- 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
- 		goto out;
-@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
- 	if (!new_len)
- 		goto out;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
-+		pax_task_size = SEGMEXEC_TASK_SIZE;
-+#endif
-+
-+	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
-+	    old_len > pax_task_size || addr > pax_task_size-old_len)
-+		goto out;
-+
- 	if (flags & MREMAP_FIXED) {
- 		if (flags & MREMAP_MAYMOVE)
- 			ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
- 						   addr + new_len);
- 			}
- 			ret = addr;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
- 			goto out;
- 		}
- 	}
-@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
- 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
- 		if (ret)
- 			goto out;
-+
-+		map_flags = vma->vm_flags;
- 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
-+		if (!(ret & ~PAGE_MASK)) {
-+			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
-+			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
-+		}
- 	}
- out:
- 	if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.32.13/mm/nommu.c linux-2.6.32.13/mm/nommu.c
---- linux-2.6.32.13/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/nommu.c	2010-05-15 13:21:18.414629737 -0400
-@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
- EXPORT_SYMBOL(find_vma);
- 
- /*
-- * find a VMA
-- * - we don't extend stack VMAs under NOMMU conditions
-- */
--struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
--{
--	return find_vma(mm, addr);
--}
--
--/*
-  * expand a stack to a given address
-  * - not supported under NOMMU conditions
-  */
-diff -urNp linux-2.6.32.13/mm/page_alloc.c linux-2.6.32.13/mm/page_alloc.c
---- linux-2.6.32.13/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/page_alloc.c	2010-05-15 13:21:18.414629737 -0400
-@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
- 	int bad = 0;
- 	int wasMlocked = __TestClearPageMlocked(page);
- 
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	unsigned long index = 1UL << order;
-+#endif
-+
- 	kmemcheck_free_shadow(page, order);
- 
- 	for (i = 0 ; i < (1 << order) ; ++i)
-@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
- 		debug_check_no_obj_freed(page_address(page),
- 					   PAGE_SIZE << order);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	for (; index; --index)
-+		sanitize_highpage(page + index - 1);
-+#endif
-+
- 	arch_free_page(page, order);
- 	kernel_map_pages(page, 1 << order, 0);
- 
-@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
- 	arch_alloc_page(page, order);
- 	kernel_map_pages(page, 1 << order, 1);
- 
-+#ifndef CONFIG_PAX_MEMORY_SANITIZE
- 	if (gfp_flags & __GFP_ZERO)
- 		prep_zero_page(page, order, gfp_flags);
-+#endif
- 
- 	if (order && (gfp_flags & __GFP_COMP))
- 		prep_compound_page(page, order);
-@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
- 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
- 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
- 	}
-+
-+#ifdef CONFIG_PAX_MEMORY_SANITIZE
-+	sanitize_highpage(page);
-+#endif
-+
- 	arch_free_page(page, 0);
- 	kernel_map_pages(page, 1, 0);
- 
-@@ -3723,7 +3740,7 @@ static void __init setup_usemap(struct p
- 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
- }
- #else
--static void inline setup_usemap(struct pglist_data *pgdat,
-+static inline void setup_usemap(struct pglist_data *pgdat,
- 				struct zone *zone, unsigned long zonesize) {}
- #endif /* CONFIG_SPARSEMEM */
- 
-diff -urNp linux-2.6.32.13/mm/percpu.c linux-2.6.32.13/mm/percpu.c
---- linux-2.6.32.13/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/percpu.c	2010-05-15 13:21:18.450640661 -0400
-@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
- static unsigned int pcpu_last_unit_cpu __read_mostly;
- 
- /* the address of the first chunk which starts with the kernel static area */
--void *pcpu_base_addr __read_mostly;
-+void *pcpu_base_addr __read_only;
- EXPORT_SYMBOL_GPL(pcpu_base_addr);
- 
- static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
-diff -urNp linux-2.6.32.13/mm/rmap.c linux-2.6.32.13/mm/rmap.c
---- linux-2.6.32.13/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/rmap.c	2010-05-15 13:21:18.454622314 -0400
-@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
- 		struct mm_struct *mm = vma->vm_mm;
- 		struct anon_vma *allocated;
- 
-+#ifdef CONFIG_PAX_SEGMEXEC
-+		struct vm_area_struct *vma_m;
-+#endif
-+
- 		anon_vma = find_mergeable_anon_vma(vma);
- 		allocated = NULL;
- 		if (!anon_vma) {
-@@ -121,6 +125,15 @@ int anon_vma_prepare(struct vm_area_stru
- 		/* page_table_lock to protect against threads */
- 		spin_lock(&mm->page_table_lock);
- 		if (likely(!vma->anon_vma)) {
-+
-+#ifdef CONFIG_PAX_SEGMEXEC
-+			vma_m = pax_find_mirror_vma(vma);
-+			if (vma_m) {
-+				vma_m->anon_vma = anon_vma;
-+				__anon_vma_link(vma_m);
-+			}
-+#endif
-+
- 			vma->anon_vma = anon_vma;
- 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
- 			allocated = NULL;
-diff -urNp linux-2.6.32.13/mm/shmem.c linux-2.6.32.13/mm/shmem.c
---- linux-2.6.32.13/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/shmem.c	2010-05-15 13:21:18.454622314 -0400
-@@ -31,7 +31,7 @@
- #include <linux/swap.h>
- #include <linux/ima.h>
- 
--static struct vfsmount *shm_mnt;
-+struct vfsmount *shm_mnt;
- 
- #ifdef CONFIG_SHMEM
- /*
-diff -urNp linux-2.6.32.13/mm/slab.c linux-2.6.32.13/mm/slab.c
---- linux-2.6.32.13/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/slab.c	2010-05-15 13:21:18.454622314 -0400
-@@ -308,7 +308,7 @@ struct kmem_list3 {
-  * Need this for bootstrapping a per node allocator.
-  */
- #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
--struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
-+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
- #define	CACHE_CACHE 0
- #define	SIZE_AC MAX_NUMNODES
- #define	SIZE_L3 (2 * MAX_NUMNODES)
-@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
-  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
-  */
- static inline unsigned int obj_to_index(const struct kmem_cache *cache,
--					const struct slab *slab, void *obj)
-+					const struct slab *slab, const void *obj)
- {
- 	u32 offset = (obj - slab->s_mem);
- 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -584,14 +584,14 @@ struct cache_names {
- static struct cache_names __initdata cache_names[] = {
- #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
- #include <linux/kmalloc_sizes.h>
--	{NULL,}
-+	{NULL, NULL}
- #undef CACHE
- };
- 
- static struct arraycache_init initarray_cache __initdata =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- static struct arraycache_init initarray_generic =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- 
- /* internal cache of cache description objs */
- static struct kmem_cache cache_cache = {
-@@ -4082,7 +4082,7 @@ out:
- 	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
- }
- 
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- 
- static void print_slabinfo_header(struct seq_file *m)
- {
-@@ -4480,6 +4480,51 @@ static int __init slab_proc_init(void)
- module_init(slab_proc_init);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct kmem_cache *cachep;
-+	struct slab *slabp;
-+	struct page *page;
-+	unsigned int objnr;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = virt_to_head_page(ptr);
-+
-+	if (!PageSlab(page)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	cachep = page_get_cache(page);
-+	slabp = page_get_slab(page);
-+	objnr = obj_to_index(cachep, slabp, ptr);
-+	BUG_ON(objnr >= cachep->num);
-+	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
-+	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /**
-  * ksize - get the actual amount of memory allocated for a given object
-  * @objp: Pointer to the object
-diff -urNp linux-2.6.32.13/mm/slob.c linux-2.6.32.13/mm/slob.c
---- linux-2.6.32.13/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/slob.c	2010-05-15 13:21:18.454622314 -0400
-@@ -29,7 +29,7 @@
-  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
-  * alloc_pages() directly, allocating compound pages so the page order
-  * does not have to be separately tracked, and also stores the exact
-- * allocation size in page->private so that it can be used to accurately
-+ * allocation size in slob_page->size so that it can be used to accurately
-  * provide ksize(). These objects are detected in kfree() because slob_page()
-  * is false for them.
-  *
-@@ -58,6 +58,7 @@
-  */
- 
- #include <linux/kernel.h>
-+#include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/mm.h>
- #include <linux/swap.h> /* struct reclaim_state */
-@@ -100,7 +101,8 @@ struct slob_page {
- 			unsigned long flags;	/* mandatory */
- 			atomic_t _count;	/* mandatory */
- 			slobidx_t units;	/* free units left in page */
--			unsigned long pad[2];
-+			unsigned long pad[1];
-+			unsigned long size;	/* size when >=PAGE_SIZE */
- 			slob_t *free;		/* first free slob_t in page */
- 			struct list_head list;	/* linked list of free pages */
- 		};
-@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
-  */
- static inline int is_slob_page(struct slob_page *sp)
- {
--	return PageSlab((struct page *)sp);
-+	return PageSlab((struct page *)sp) && !sp->size;
- }
- 
- static inline void set_slob_page(struct slob_page *sp)
-@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
- 
- static inline struct slob_page *slob_page(const void *addr)
- {
--	return (struct slob_page *)virt_to_page(addr);
-+	return (struct slob_page *)virt_to_head_page(addr);
- }
- 
- /*
-@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
- /*
-  * Return the size of a slob block.
-  */
--static slobidx_t slob_units(slob_t *s)
-+static slobidx_t slob_units(const slob_t *s)
- {
- 	if (s->units > 0)
- 		return s->units;
-@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
- /*
-  * Return the next free slob block pointer after this one.
-  */
--static slob_t *slob_next(slob_t *s)
-+static slob_t *slob_next(const slob_t *s)
- {
- 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
- 	slobidx_t next;
-@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
- /*
-  * Returns true if s is the last free block in its page.
-  */
--static int slob_last(slob_t *s)
-+static int slob_last(const slob_t *s)
- {
- 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
- }
-@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
- 	if (!page)
- 		return NULL;
- 
-+	set_slob_page(page);
- 	return page_address(page);
- }
- 
-@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
- 		if (!b)
- 			return NULL;
- 		sp = slob_page(b);
--		set_slob_page(sp);
- 
- 		spin_lock_irqsave(&slob_lock, flags);
- 		sp->units = SLOB_UNITS(PAGE_SIZE);
- 		sp->free = b;
-+		sp->size = 0;
- 		INIT_LIST_HEAD(&sp->list);
- 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
- 		set_slob_page_free(sp, slob_list);
-@@ -475,10 +478,9 @@ out:
- #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
- #endif
- 
--void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
- {
--	unsigned int *m;
--	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+	slob_t *m;
- 	void *ret;
- 
- 	lockdep_trace_alloc(gfp);
-@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		if (!m)
- 			return NULL;
--		*m = size;
-+		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
-+		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
-+		m[0].units = size;
-+		m[1].units = align;
- 		ret = (void *)m + align;
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
- 
- 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
- 		if (ret) {
--			struct page *page;
--			page = virt_to_page(ret);
--			page->private = size;
-+			struct slob_page *sp;
-+			sp = slob_page(ret);
-+			sp->size = size;
- 		}
- 
- 		trace_kmalloc_node(_RET_IP_, ret,
-@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
- 	kmemleak_alloc(ret, size, 1, gfp);
- 	return ret;
- }
-+
-+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
-+{
-+	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-+
-+	return __kmalloc_node_align(size, gfp, node, align);
-+}
- EXPORT_SYMBOL(__kmalloc_node);
- 
- void kfree(const void *block)
-@@ -528,13 +540,84 @@ void kfree(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		slob_free(m, *m + align);
--	} else
-+		slob_t *m = (slob_t *)(block - align);
-+		slob_free(m, m[0].units + align);
-+	} else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		put_page(&sp->page);
-+	}
- }
- EXPORT_SYMBOL(kfree);
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct slob_page *sp;
-+	const slob_t *free;
-+	const void *base;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	sp = slob_page(ptr);
-+	if (!PageSlab((struct page*)sp)) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	if (sp->size) {
-+		base = page_address(&sp->page);
-+		if (base <= ptr && n <= sp->size - (ptr - base))
-+			return;
-+		goto report;
-+	}
-+
-+	/* some tricky double walking to find the chunk */
-+	base = (void *)((unsigned long)ptr & PAGE_MASK);
-+	free = sp->free;
-+
-+	while (!slob_last(free) && (void *)free <= ptr) {
-+		base = free + slob_units(free);
-+		free = slob_next(free);
-+	}
-+
-+	while (base < (void *)free) {
-+		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
-+		int size = SLOB_UNIT * SLOB_UNITS(m + align);
-+		int offset;
-+
-+		if (ptr < base + align)
-+			goto report;
-+
-+		offset = ptr - base - align;
-+		if (offset < m) {
-+			if (n <= m - offset)
-+				return;
-+			goto report;
-+		}
-+		base += size;
-+	}
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
- size_t ksize(const void *block)
- {
-@@ -547,10 +630,10 @@ size_t ksize(const void *block)
- 	sp = slob_page(block);
- 	if (is_slob_page(sp)) {
- 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
--		unsigned int *m = (unsigned int *)(block - align);
--		return SLOB_UNITS(*m) * SLOB_UNIT;
-+		slob_t *m = (slob_t *)(block - align);
-+		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
- 	} else
--		return sp->page.private;
-+		return sp->size;
- }
- EXPORT_SYMBOL(ksize);
- 
-@@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
- {
- 	void *b;
- 
-+#ifdef CONFIG_PAX_USERCOPY
-+	b = __kmalloc_node_align(c->size, flags, node, c->align);
-+#else
- 	if (c->size < PAGE_SIZE) {
- 		b = slob_alloc(c->size, flags, c->align, node);
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    SLOB_UNITS(c->size) * SLOB_UNIT,
- 					    flags, node);
- 	} else {
-+		struct slob_page *sp;
-+
- 		b = slob_new_pages(flags, get_order(c->size), node);
-+		sp = slob_page(b);
-+		sp->size = c->size;
- 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
- 					    PAGE_SIZE << get_order(c->size),
- 					    flags, node);
- 	}
-+#endif
- 
- 	if (c->ctor)
- 		c->ctor(b);
-@@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
- 
- static void __kmem_cache_free(void *b, int size)
- {
--	if (size < PAGE_SIZE)
-+	struct slob_page *sp = slob_page(b);
-+
-+	if (is_slob_page(sp))
- 		slob_free(b, size);
--	else
-+	else {
-+		clear_slob_page(sp);
-+		free_slob_page(sp);
-+		sp->size = 0;
- 		slob_free_pages(b, get_order(size));
-+	}
- }
- 
- static void kmem_rcu_free(struct rcu_head *head)
-@@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
- 
- void kmem_cache_free(struct kmem_cache *c, void *b)
- {
-+	int size = c->size;
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	if (size + c->align < PAGE_SIZE) {
-+		size += c->align;
-+		b -= c->align;
-+	}
-+#endif
-+
- 	kmemleak_free_recursive(b, c->flags);
- 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
- 		struct slob_rcu *slob_rcu;
--		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
-+		slob_rcu = b + (size - sizeof(struct slob_rcu));
- 		INIT_RCU_HEAD(&slob_rcu->head);
--		slob_rcu->size = c->size;
-+		slob_rcu->size = size;
- 		call_rcu(&slob_rcu->head, kmem_rcu_free);
- 	} else {
--		__kmem_cache_free(b, c->size);
-+		__kmem_cache_free(b, size);
- 	}
- 
- 	trace_kmem_cache_free(_RET_IP_, b);
-diff -urNp linux-2.6.32.13/mm/slub.c linux-2.6.32.13/mm/slub.c
---- linux-2.6.32.13/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/slub.c	2010-05-15 13:21:18.454622314 -0400
-@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
- 
- 	page = virt_to_head_page(x);
- 
-+	BUG_ON(!PageSlab(page));
-+
- 	slab_free(s, page, x, _RET_IP_);
- 
- 	trace_kmem_cache_free(_RET_IP_, x);
-@@ -1937,7 +1939,7 @@ static int slub_min_objects;
-  * Merge control. If this is set then no merging of slab caches will occur.
-  * (Could be removed. This was introduced to pacify the merge skeptics.)
-  */
--static int slub_nomerge;
-+static int slub_nomerge = 1;
- 
- /*
-  * Calculate the order of allocation given an slab object size.
-@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
- 	 * list to avoid pounding the page allocator excessively.
- 	 */
- 	set_min_partial(s, ilog2(s->size));
--	s->refcount = 1;
-+	atomic_set(&s->refcount, 1);
- #ifdef CONFIG_NUMA
- 	s->remote_node_defrag_ratio = 1000;
- #endif
-@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
- void kmem_cache_destroy(struct kmem_cache *s)
- {
- 	down_write(&slub_lock);
--	s->refcount--;
--	if (!s->refcount) {
-+	if (atomic_dec_and_test(&s->refcount)) {
- 		list_del(&s->list);
- 		up_write(&slub_lock);
- 		if (kmem_cache_close(s)) {
-@@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t 
- EXPORT_SYMBOL(__kmalloc_node);
- #endif
- 
-+void check_object_size(const void *ptr, unsigned long n, bool to)
-+{
-+
-+#ifdef CONFIG_PAX_USERCOPY
-+	struct page *page;
-+	struct kmem_cache *s;
-+	unsigned long offset;
-+
-+	if (!n)
-+		return;
-+
-+	if (ZERO_OR_NULL_PTR(ptr))
-+		goto report;
-+
-+	if (!virt_addr_valid(ptr))
-+		return;
-+
-+	page = get_object_page(ptr);
-+
-+	if (!page) {
-+		if (object_is_on_stack(ptr, n) == -1)
-+			goto report;
-+		return;
-+	}
-+
-+	s = page->slab;
-+	offset = (ptr - page_address(page)) % s->size;
-+	if (offset <= s->objsize && n <= s->objsize - offset)
-+		return;
-+
-+report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
-+#endif
-+
-+}
-+EXPORT_SYMBOL(check_object_size);
-+
- size_t ksize(const void *object)
- {
- 	struct page *page;
-@@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
- 	 */
- 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
- 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
--	kmalloc_caches[0].refcount = -1;
-+	atomic_set(&kmalloc_caches[0].refcount, -1);
- 	caches++;
- 
- 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
-@@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
- 	/*
- 	 * We may have set a slab to be unmergeable during bootstrap.
- 	 */
--	if (s->refcount < 0)
-+	if (atomic_read(&s->refcount) < 0)
- 		return 1;
- 
- 	return 0;
-@@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
- 	if (s) {
- 		int cpu;
- 
--		s->refcount++;
-+		atomic_inc(&s->refcount);
- 		/*
- 		 * Adjust the object sizes so that we clear
- 		 * the complete object on kzalloc.
-@@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
- 
- 		if (sysfs_slab_alias(s, name)) {
- 			down_write(&slub_lock);
--			s->refcount--;
-+			atomic_dec(&s->refcount);
- 			up_write(&slub_lock);
- 			goto err;
- 		}
-@@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
- 
- static ssize_t aliases_show(struct kmem_cache *s, char *buf)
- {
--	return sprintf(buf, "%d\n", s->refcount - 1);
-+	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
- }
- SLAB_ATTR_RO(aliases);
- 
-@@ -4503,7 +4544,7 @@ static void kmem_cache_release(struct ko
- 	kfree(s);
- }
- 
--static struct sysfs_ops slab_sysfs_ops = {
-+static const struct sysfs_ops slab_sysfs_ops = {
- 	.show = slab_attr_show,
- 	.store = slab_attr_store,
- };
-@@ -4522,7 +4563,7 @@ static int uevent_filter(struct kset *ks
- 	return 0;
- }
- 
--static struct kset_uevent_ops slab_uevent_ops = {
-+static const struct kset_uevent_ops slab_uevent_ops = {
- 	.filter = uevent_filter,
- };
- 
-@@ -4696,7 +4737,7 @@ __initcall(slab_sysfs_init);
- /*
-  * The /proc/slabinfo ABI
-  */
--#ifdef CONFIG_SLABINFO
-+#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
- static void print_slabinfo_header(struct seq_file *m)
- {
- 	seq_puts(m, "slabinfo - version: 2.1\n");
-diff -urNp linux-2.6.32.13/mm/util.c linux-2.6.32.13/mm/util.c
---- linux-2.6.32.13/mm/util.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/util.c	2010-05-15 13:21:18.454622314 -0400
-@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
- 	mm->mmap_base = TASK_UNMAPPED_BASE;
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+	if (mm->pax_flags & MF_PAX_RANDMMAP)
-+		mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- 	mm->get_unmapped_area = arch_get_unmapped_area;
- 	mm->unmap_area = arch_unmap_area;
- }
-diff -urNp linux-2.6.32.13/mm/vmalloc.c linux-2.6.32.13/mm/vmalloc.c
---- linux-2.6.32.13/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/mm/vmalloc.c	2010-05-15 13:23:38.946686210 -0400
-@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
- 
- 	pte = pte_offset_kernel(pmd, addr);
- 	do {
--		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
--		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
-+			BUG_ON(!pte_exec(*pte));
-+			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
-+			continue;
-+		}
-+#endif
-+
-+		{
-+			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-+			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
-+		}
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
- }
- 
-@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
- 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
- {
- 	pte_t *pte;
-+	int ret = -ENOMEM;
- 
- 	/*
- 	 * nr is a running index into the array which helps higher level
-@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
- 	pte = pte_alloc_kernel(pmd, addr);
- 	if (!pte)
- 		return -ENOMEM;
-+
-+	pax_open_kernel();
- 	do {
- 		struct page *page = pages[*nr];
- 
--		if (WARN_ON(!pte_none(*pte)))
--			return -EBUSY;
--		if (WARN_ON(!page))
--			return -ENOMEM;
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+		if (pgprot_val(prot) & _PAGE_NX)
-+#endif
-+
-+		if (WARN_ON(!pte_none(*pte))) {
-+			ret = -EBUSY;
-+			goto out;
-+		}
-+		if (WARN_ON(!page)) {
-+			ret = -ENOMEM;
-+			goto out;
-+		}
- 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
- 		(*nr)++;
- 	} while (pte++, addr += PAGE_SIZE, addr != end);
--	return 0;
-+	ret = 0;
-+out:
-+	pax_close_kernel();
-+	return ret;
- }
- 
- static int vmap_pmd_range(pud_t *pud, unsigned long addr,
-@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
- 	 * and fall back on vmalloc() if that fails. Others
- 	 * just put it in the vmalloc space.
- 	 */
--#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
-+#ifdef CONFIG_MODULES
-+#ifdef MODULES_VADDR
- 	unsigned long addr = (unsigned long)x;
- 	if (addr >= MODULES_VADDR && addr < MODULES_END)
- 		return 1;
- #endif
-+
-+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
-+	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
-+		return 1;
-+#endif
-+
-+#endif
-+
- 	return is_vmalloc_addr(x);
- }
- 
-@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
- 	struct rb_node *tmp;
- 
- 	while (*p) {
--		struct vmap_area *tmp;
-+		struct vmap_area *varea;
- 
- 		parent = *p;
--		tmp = rb_entry(parent, struct vmap_area, rb_node);
--		if (va->va_start < tmp->va_end)
-+		varea = rb_entry(parent, struct vmap_area, rb_node);
-+		if (va->va_start < varea->va_end)
- 			p = &(*p)->rb_left;
--		else if (va->va_end > tmp->va_start)
-+		else if (va->va_end > varea->va_start)
- 			p = &(*p)->rb_right;
- 		else
- 			BUG();
-@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
- 	struct vm_struct *area;
- 
- 	BUG_ON(in_interrupt());
-+
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+	if (flags & VM_KERNEXEC) {
-+		if (start != VMALLOC_START || end != VMALLOC_END)
-+			return NULL;
-+		start = (unsigned long)MODULES_EXEC_VADDR;
-+		end = (unsigned long)MODULES_EXEC_END;
-+	}
-+#endif
-+
- 	if (flags & VM_IOREMAP) {
- 		int bit = fls(size);
- 
-@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
- 	if (count > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		flags |= VM_KERNEXEC;
-+#endif
-+
- 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
- 					__builtin_return_address(0));
- 	if (!area)
-@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
- 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
- 		return NULL;
- 
-+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
-+	if (!(pgprot_val(prot) & _PAGE_NX))
-+		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
-+						node, gfp_mask, caller);
-+	else
-+#endif
-+
- 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
- 				  VMALLOC_END, node, gfp_mask, caller);
- 
-@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
- 	return addr;
- }
- 
-+#undef __vmalloc
- void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
- {
- 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
-@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc
- void *vmalloc(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
-  * The resulting memory area is zeroed so it can be mapped to userspace
-  * without leaking data.
-  */
-+#undef vmalloc_user
- void *vmalloc_user(unsigned long size)
- {
- 	struct vm_struct *area;
-@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
-+#undef vmalloc_node
- void *vmalloc_node(unsigned long size, int node)
- {
- 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
-@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
-  *	For tight control over page level allocator and protection flags
-  *	use __vmalloc() instead.
-  */
--
-+#undef vmalloc_exec
- void *vmalloc_exec(unsigned long size)
- {
--	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
-+	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
- 			      -1, __builtin_return_address(0));
- }
- 
-@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
-  *	Allocate enough 32bit PA addressable pages to cover @size from the
-  *	page level allocator and map them into contiguous kernel virtual space.
-  */
-+#undef vmalloc_32
- void *vmalloc_32(unsigned long size)
- {
- 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
-@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
-  * The resulting memory area is 32bit addressable and zeroed so it can be
-  * mapped to userspace without leaking data.
-  */
-+#undef vmalloc_32_user
- void *vmalloc_32_user(unsigned long size)
- {
- 	struct vm_struct *area;
-diff -urNp linux-2.6.32.13/net/8021q/vlan.c linux-2.6.32.13/net/8021q/vlan.c
---- linux-2.6.32.13/net/8021q/vlan.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/8021q/vlan.c	2010-05-15 13:21:18.454622314 -0400
-@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
- 		err = -EPERM;
- 		if (!capable(CAP_NET_ADMIN))
- 			break;
--		if ((args.u.name_type >= 0) &&
--		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
-+		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
- 			struct vlan_net *vn;
- 
- 			vn = net_generic(net, vlan_net_id);
-diff -urNp linux-2.6.32.13/net/atm/atm_misc.c linux-2.6.32.13/net/atm/atm_misc.c
---- linux-2.6.32.13/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/atm/atm_misc.c	2010-05-15 13:21:18.454622314 -0400
-@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
- 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
- 		return 1;
- 	atm_return(vcc,truesize);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return 0;
- }
- 
-@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
- 		}
- 	}
- 	atm_return(vcc,guess);
--	atomic_inc(&vcc->stats->rx_drop);
-+	atomic_inc_unchecked(&vcc->stats->rx_drop);
- 	return NULL;
- }
- 
-@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
- 
- void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
- 
- void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
- 	__SONET_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.13/net/atm/proc.c linux-2.6.32.13/net/atm/proc.c
---- linux-2.6.32.13/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/atm/proc.c	2010-05-15 13:21:18.466625554 -0400
-@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
-   const struct k_atm_aal_stats *stats)
- {
- 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
--	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
--	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
--	    atomic_read(&stats->rx_drop));
-+	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
-+	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
-+	    atomic_read_unchecked(&stats->rx_drop));
- }
- 
- static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
-diff -urNp linux-2.6.32.13/net/atm/resources.c linux-2.6.32.13/net/atm/resources.c
---- linux-2.6.32.13/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/atm/resources.c	2010-05-15 13:21:18.466625554 -0400
-@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
- static void copy_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
-+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
- static void subtract_aal_stats(struct k_atm_aal_stats *from,
-     struct atm_aal_stats *to)
- {
--#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
-+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
- 	__AAL_STAT_ITEMS
- #undef __HANDLE_ITEM
- }
-diff -urNp linux-2.6.32.13/net/bridge/br_private.h linux-2.6.32.13/net/bridge/br_private.h
---- linux-2.6.32.13/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/bridge/br_private.h	2010-05-15 13:21:18.499638693 -0400
-@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
- 
- #ifdef CONFIG_SYSFS
- /* br_sysfs_if.c */
--extern struct sysfs_ops brport_sysfs_ops;
-+extern const struct sysfs_ops brport_sysfs_ops;
- extern int br_sysfs_addif(struct net_bridge_port *p);
- 
- /* br_sysfs_br.c */
-diff -urNp linux-2.6.32.13/net/bridge/br_stp_if.c linux-2.6.32.13/net/bridge/br_stp_if.c
---- linux-2.6.32.13/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/bridge/br_stp_if.c	2010-05-15 13:21:18.499638693 -0400
-@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
- 	char *envp[] = { NULL };
- 
- 	if (br->stp_enabled == BR_USER_STP) {
--		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
-+		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
- 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
- 			br->dev->name, r);
- 
-diff -urNp linux-2.6.32.13/net/bridge/br_sysfs_if.c linux-2.6.32.13/net/bridge/br_sysfs_if.c
---- linux-2.6.32.13/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/bridge/br_sysfs_if.c	2010-05-15 13:21:18.499638693 -0400
-@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
- 	return ret;
- }
- 
--struct sysfs_ops brport_sysfs_ops = {
-+const struct sysfs_ops brport_sysfs_ops = {
- 	.show = brport_show,
- 	.store = brport_store,
- };
-diff -urNp linux-2.6.32.13/net/core/dev.c linux-2.6.32.13/net/core/dev.c
---- linux-2.6.32.13/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/core/dev.c	2010-05-15 13:21:18.499638693 -0400
-@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
- }
- EXPORT_SYMBOL(netif_rx_ni);
- 
--static void net_tx_action(struct softirq_action *h)
-+static void net_tx_action(void)
- {
- 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
- 
-@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
- EXPORT_SYMBOL(netif_napi_del);
- 
- 
--static void net_rx_action(struct softirq_action *h)
-+static void net_rx_action(void)
- {
- 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
- 	unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.32.13/net/core/flow.c linux-2.6.32.13/net/core/flow.c
---- linux-2.6.32.13/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/core/flow.c	2010-05-15 13:21:18.499638693 -0400
-@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
- 
- static u32 flow_hash_shift;
- #define flow_hash_size	(1 << flow_hash_shift)
--static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
-+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
- 
- #define flow_table(cpu) (per_cpu(flow_tables, cpu))
- 
-@@ -52,7 +52,7 @@ struct flow_percpu_info {
- 	u32 hash_rnd;
- 	int count;
- };
--static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
-+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
- 
- #define flow_hash_rnd_recalc(cpu) \
- 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
-@@ -69,7 +69,7 @@ struct flow_flush_info {
- 	atomic_t cpuleft;
- 	struct completion completion;
- };
--static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
-+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
- 
- #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
- 
-diff -urNp linux-2.6.32.13/net/dccp/ccids/ccid3.c linux-2.6.32.13/net/dccp/ccids/ccid3.c
---- linux-2.6.32.13/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/dccp/ccids/ccid3.c	2010-05-15 13:21:18.502580406 -0400
-@@ -41,7 +41,7 @@
- static int ccid3_debug;
- #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
- #else
--#define ccid3_pr_debug(format, a...)
-+#define ccid3_pr_debug(format, a...) do {} while (0)
- #endif
- 
- /*
-diff -urNp linux-2.6.32.13/net/dccp/dccp.h linux-2.6.32.13/net/dccp/dccp.h
---- linux-2.6.32.13/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/dccp/dccp.h	2010-05-15 13:21:18.502580406 -0400
-@@ -44,9 +44,9 @@ extern int dccp_debug;
- #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
- #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
- #else
--#define dccp_pr_debug(format, a...)
--#define dccp_pr_debug_cat(format, a...)
--#define dccp_debug(format, a...)
-+#define dccp_pr_debug(format, a...) do {} while (0)
-+#define dccp_pr_debug_cat(format, a...) do {} while (0)
-+#define dccp_debug(format, a...) do {} while (0)
- #endif
- 
- extern struct inet_hashinfo dccp_hashinfo;
-diff -urNp linux-2.6.32.13/net/decnet/sysctl_net_decnet.c linux-2.6.32.13/net/decnet/sysctl_net_decnet.c
---- linux-2.6.32.13/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/decnet/sysctl_net_decnet.c	2010-05-15 13:21:18.502580406 -0400
-@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, addr, len))
-+	if (len > sizeof addr || copy_to_user(buffer, addr, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
- 
- 	if (len > *lenp) len = *lenp;
- 
--	if (copy_to_user(buffer, devname, len))
-+	if (len > sizeof devname || copy_to_user(buffer, devname, len))
- 		return -EFAULT;
- 
- 	*lenp = len;
-diff -urNp linux-2.6.32.13/net/ipv4/inet_hashtables.c linux-2.6.32.13/net/ipv4/inet_hashtables.c
---- linux-2.6.32.13/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/inet_hashtables.c	2010-05-15 13:21:18.502580406 -0400
-@@ -18,11 +18,14 @@
- #include <linux/sched.h>
- #include <linux/slab.h>
- #include <linux/wait.h>
-+#include <linux/security.h>
- 
- #include <net/inet_connection_sock.h>
- #include <net/inet_hashtables.h>
- #include <net/ip.h>
- 
-+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
-+
- /*
-  * Allocate and initialize a new local port bind bucket.
-  * The bindhash mutex for snum's hash chain must be held here.
-@@ -490,6 +493,8 @@ ok:
- 		}
- 		spin_unlock(&head->lock);
- 
-+		gr_update_task_in_ip_table(current, inet_sk(sk));
-+
- 		if (tw) {
- 			inet_twsk_deschedule(tw, death_row);
- 			inet_twsk_put(tw);
-diff -urNp linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-05-15 13:21:18.502580406 -0400
-@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
- 
- 	*len = 0;
- 
--	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
-+	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
- 	if (*octets == NULL) {
- 		if (net_ratelimit())
- 			printk("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.32.13/net/ipv4/tcp_ipv4.c linux-2.6.32.13/net/ipv4/tcp_ipv4.c
---- linux-2.6.32.13/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/tcp_ipv4.c	2010-05-15 13:21:18.502580406 -0400
-@@ -84,6 +84,9 @@
- int sysctl_tcp_tw_reuse __read_mostly;
- int sysctl_tcp_low_latency __read_mostly;
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
- 
- #ifdef CONFIG_TCP_MD5SIG
- static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
-@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
- 	TCP_SKB_CB(skb)->sacked	 = 0;
- 
- 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
--	if (!sk)
-+	if (!sk) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 1;
-+#endif
- 		goto no_tcp_socket;
-+	}
- 
- process:
--	if (sk->sk_state == TCP_TIME_WAIT)
-+	if (sk->sk_state == TCP_TIME_WAIT) {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		ret = 2;
-+#endif
- 		goto do_time_wait;
-+	}
- 
- 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
- 		goto discard_and_relse;
-@@ -1650,6 +1661,10 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (!grsec_enable_blackhole || (ret == 1 &&
-+		    (skb->dev->flags & IFF_LOOPBACK)))
-+#endif
- 		tcp_v4_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.13/net/ipv4/tcp_minisocks.c linux-2.6.32.13/net/ipv4/tcp_minisocks.c
---- linux-2.6.32.13/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/tcp_minisocks.c	2010-05-15 13:21:18.502580406 -0400
-@@ -26,6 +26,10 @@
- #include <net/inet_common.h>
- #include <net/xfrm.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- #ifdef CONFIG_SYSCTL
- #define SYNC_INIT 0 /* let the user enable it */
- #else
-@@ -672,6 +676,10 @@ listen_overflow:
- 
- embryonic_reset:
- 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-+
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole)
-+#endif
- 	if (!(flg & TCP_FLAG_RST))
- 		req->rsk_ops->send_reset(sk, skb);
- 
-diff -urNp linux-2.6.32.13/net/ipv4/tcp_probe.c linux-2.6.32.13/net/ipv4/tcp_probe.c
---- linux-2.6.32.13/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/tcp_probe.c	2010-05-15 13:21:18.502580406 -0400
-@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
- 		if (cnt + width >= len)
- 			break;
- 
--		if (copy_to_user(buf + cnt, tbuf, width))
-+		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
- 			return -EFAULT;
- 		cnt += width;
- 	}
-diff -urNp linux-2.6.32.13/net/ipv4/tcp_timer.c linux-2.6.32.13/net/ipv4/tcp_timer.c
---- linux-2.6.32.13/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/tcp_timer.c	2010-05-15 13:21:18.502580406 -0400
-@@ -21,6 +21,10 @@
- #include <linux/module.h>
- #include <net/tcp.h>
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_lastack_retries;
-+#endif
-+
- int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
- int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
- int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
-@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
- 		}
- 	}
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if ((sk->sk_state == TCP_LAST_ACK) &&
-+	    (grsec_lastack_retries > 0) &&
-+	    (grsec_lastack_retries < retry_until))
-+		retry_until = grsec_lastack_retries;
-+#endif
-+
- 	if (retransmits_timed_out(sk, retry_until)) {
- 		/* Has it gone just too far? */
- 		tcp_write_err(sk);
-diff -urNp linux-2.6.32.13/net/ipv4/udp.c linux-2.6.32.13/net/ipv4/udp.c
---- linux-2.6.32.13/net/ipv4/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv4/udp.c	2010-05-15 13:21:18.502580406 -0400
-@@ -86,6 +86,7 @@
- #include <linux/types.h>
- #include <linux/fcntl.h>
- #include <linux/module.h>
-+#include <linux/security.h>
- #include <linux/socket.h>
- #include <linux/sockios.h>
- #include <linux/igmp.h>
-@@ -106,6 +107,10 @@
- #include <net/xfrm.h>
- #include "udp_impl.h"
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+extern int grsec_enable_blackhole;
-+#endif
-+
- struct udp_table udp_table;
- EXPORT_SYMBOL(udp_table);
- 
-@@ -371,6 +376,9 @@ found:
- 	return s;
- }
- 
-+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
-+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
-+
- /*
-  * This routine is called by the ICMP module when it gets some
-  * sort of error condition.  If err < 0 then the socket should
-@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
- 		dport = usin->sin_port;
- 		if (dport == 0)
- 			return -EINVAL;
-+
-+		err = gr_search_udp_sendmsg(sk, usin);
-+		if (err)
-+			return err;
- 	} else {
- 		if (sk->sk_state != TCP_ESTABLISHED)
- 			return -EDESTADDRREQ;
-+
-+		err = gr_search_udp_sendmsg(sk, NULL);
-+		if (err)
-+			return err;
-+
- 		daddr = inet->daddr;
- 		dport = inet->dport;
- 		/* Open fast path for connected socket.
-@@ -945,6 +962,10 @@ try_again:
- 	if (!skb)
- 		goto out;
- 
-+	err = gr_search_udp_recvmsg(sk, skb);
-+	if (err)
-+		goto out_free;
-+
- 	ulen = skb->len - sizeof(struct udphdr);
- 	copied = len;
- 	if (copied > ulen)
-@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
- 		goto csum_error;
- 
- 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
- 
- 	/*
-diff -urNp linux-2.6.32.13/net/ipv6/exthdrs.c linux-2.6.32.13/net/ipv6/exthdrs.c
---- linux-2.6.32.13/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv6/exthdrs.c	2010-05-15 13:21:18.502580406 -0400
-@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
- 		.type	= IPV6_TLV_JUMBO,
- 		.func	= ipv6_hop_jumbo,
- 	},
--	{ -1, }
-+	{ -1, NULL }
- };
- 
- int ipv6_parse_hopopts(struct sk_buff *skb)
-diff -urNp linux-2.6.32.13/net/ipv6/raw.c linux-2.6.32.13/net/ipv6/raw.c
---- linux-2.6.32.13/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv6/raw.c	2010-05-15 13:21:18.523941597 -0400
-@@ -600,7 +600,7 @@ out:
- 	return err;
- }
- 
--static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
- 			struct flowi *fl, struct rt6_info *rt,
- 			unsigned int flags)
- {
-diff -urNp linux-2.6.32.13/net/ipv6/tcp_ipv6.c linux-2.6.32.13/net/ipv6/tcp_ipv6.c
---- linux-2.6.32.13/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv6/tcp_ipv6.c	2010-05-15 13:21:18.734776060 -0400
-@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
- 	return 0;
- 
- reset:
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
-+#endif
- 	tcp_v6_send_reset(sk, skb);
- discard:
- 	if (opt_skb)
-@@ -1700,6 +1703,9 @@ no_tcp_socket:
- bad_packet:
- 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
- 	} else {
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		tcp_v6_send_reset(NULL, skb);
- 	}
- 
-diff -urNp linux-2.6.32.13/net/ipv6/udp.c linux-2.6.32.13/net/ipv6/udp.c
---- linux-2.6.32.13/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/ipv6/udp.c	2010-05-15 13:21:18.734776060 -0400
-@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
- 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
- 				proto == IPPROTO_UDPLITE);
- 
-+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
-+		if (skb->dev->flags & IFF_LOOPBACK)
-+#endif
- 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
- 
- 		kfree_skb(skb);
-diff -urNp linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/irda/ircomm/ircomm_tty.c	2010-05-15 13:21:18.734776060 -0400
-@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
- 	add_wait_queue(&self->open_wait, &wait);
- 
- 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 	/* As far as I can see, we protect open_count - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	if (!tty_hung_up_p(filp)) {
- 		extra_count = 1;
--		self->open_count--;
-+		atomic_dec(&self->open_count);
- 	}
- 	spin_unlock_irqrestore(&self->spinlock, flags);
--	self->blocked_open++;
-+	atomic_inc(&self->blocked_open);
- 
- 	while (1) {
- 		if (tty->termios->c_cflag & CBAUD) {
-@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
- 		}
- 
- 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
--		      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
- 
- 		schedule();
- 	}
-@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
- 	if (extra_count) {
- 		/* ++ is not atomic, so this should be protected - Jean II */
- 		spin_lock_irqsave(&self->spinlock, flags);
--		self->open_count++;
-+		atomic_inc(&self->open_count);
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 	}
--	self->blocked_open--;
-+	atomic_dec(&self->blocked_open);
- 
- 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
--	      __FILE__,__LINE__, tty->driver->name, self->open_count);
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
- 
- 	if (!retval)
- 		self->flags |= ASYNC_NORMAL_ACTIVE;
-@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
- 	}
- 	/* ++ is not atomic, so this should be protected - Jean II */
- 	spin_lock_irqsave(&self->spinlock, flags);
--	self->open_count++;
-+	atomic_inc(&self->open_count);
- 
- 	tty->driver_data = self;
- 	self->tty = tty;
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
--		   self->line, self->open_count);
-+		   self->line, atomic_read(&self->open_count));
- 
- 	/* Not really used by us, but lets do it anyway */
- 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
- 		return;
- 	}
- 
--	if ((tty->count == 1) && (self->open_count != 1)) {
-+	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
- 		/*
- 		 * Uh, oh.  tty->count is 1, which means that the tty
- 		 * structure will be freed.  state->count should always
-@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
- 		 */
- 		IRDA_DEBUG(0, "%s(), bad serial port count; "
- 			   "tty->count is 1, state->count is %d\n", __func__ ,
--			   self->open_count);
--		self->open_count = 1;
-+			   atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 1);
- 	}
- 
--	if (--self->open_count < 0) {
-+	if (atomic_dec_return(&self->open_count) < 0) {
- 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
--			   __func__, self->line, self->open_count);
--		self->open_count = 0;
-+			   __func__, self->line, atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 0);
- 	}
--	if (self->open_count) {
-+	if (atomic_read(&self->open_count)) {
- 		spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
-@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
- 	tty->closing = 0;
- 	self->tty = NULL;
- 
--	if (self->blocked_open) {
-+	if (atomic_read(&self->blocked_open)) {
- 		if (self->close_delay)
- 			schedule_timeout_interruptible(self->close_delay);
- 		wake_up_interruptible(&self->open_wait);
-@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
- 	spin_lock_irqsave(&self->spinlock, flags);
- 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
- 	self->tty = NULL;
--	self->open_count = 0;
-+	atomic_set(&self->open_count, 0);
- 	spin_unlock_irqrestore(&self->spinlock, flags);
- 
- 	wake_up_interruptible(&self->open_wait);
-@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
- 	seq_putc(m, '\n');
- 
- 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
--	seq_printf(m, "Open count: %d\n", self->open_count);
-+	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
- 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
- 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
- 
-diff -urNp linux-2.6.32.13/net/mac80211/ieee80211_i.h linux-2.6.32.13/net/mac80211/ieee80211_i.h
---- linux-2.6.32.13/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.13/net/mac80211/ieee80211_i.h	2010-05-15 13:21:18.734776060 -0400
-@@ -635,7 +635,7 @@ struct ieee80211_local {
- 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
- 	spinlock_t queue_stop_reason_lock;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int monitors, cooked_mntrs;
- 	/* number of interfaces with corresponding FIF_ flags */
- 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
-diff -urNp linux-2.6.32.13/net/mac80211/iface.c linux-2.6.32.13/net/mac80211/iface.c
---- linux-2.6.32.13/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/mac80211/iface.c	2010-05-15 13:21:18.734776060 -0400
-@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
- 		break;
- 	}
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		res = drv_start(local);
- 		if (res)
- 			goto err_del_bss;
-@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
- 	 * Validate the MAC address for this device.
- 	 */
- 	if (!is_valid_ether_addr(dev->dev_addr)) {
--		if (!local->open_count)
-+		if (!atomic_read(&local->open_count))
- 			drv_stop(local);
- 		return -EADDRNOTAVAIL;
- 	}
-@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
- 
- 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
- 
--	local->open_count++;
-+	atomic_inc(&local->open_count);
- 	if (hw_reconf_flags) {
- 		ieee80211_hw_config(local, hw_reconf_flags);
- 		/*
-@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
-  err_del_interface:
- 	drv_remove_interface(local, &conf);
-  err_stop:
--	if (!local->open_count)
-+	if (!atomic_read(&local->open_count))
- 		drv_stop(local);
-  err_del_bss:
- 	sdata->bss = NULL;
-@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
- 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
- 	}
- 
--	local->open_count--;
-+	atomic_dec(&local->open_count);
- 
- 	switch (sdata->vif.type) {
- 	case NL80211_IFTYPE_AP_VLAN:
-@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
- 
- 	ieee80211_recalc_ps(local, -1);
- 
--	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
- 		ieee80211_clear_tx_pending(local);
- 		ieee80211_stop_device(local);
- 
-diff -urNp linux-2.6.32.13/net/mac80211/main.c linux-2.6.32.13/net/mac80211/main.c
---- linux-2.6.32.13/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
-+++ linux-2.6.32.13/net/mac80211/main.c	2010-05-15 13:21:18.734776060 -0400
-@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
- 		local->hw.conf.power_level = power;
- 	}
- 
--	if (changed && local->open_count) {
-+	if (changed && atomic_read(&local->open_count)) {
- 		ret = drv_config(local, changed);
- 		/*
- 		 * Goal:
-diff -urNp linux-2.6.32.13/net/mac80211/pm.c linux-2.6.32.13/net/mac80211/pm.c
---- linux-2.6.32.13/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/mac80211/pm.c	2010-05-15 13:21:18.734776060 -0400
-@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
- 	}
- 
- 	/* stop hardware - this must stop RX */
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		ieee80211_stop_device(local);
- 
- 	local->suspended = true;
-diff -urNp linux-2.6.32.13/net/mac80211/rate.c linux-2.6.32.13/net/mac80211/rate.c
---- linux-2.6.32.13/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/mac80211/rate.c	2010-05-15 13:21:18.734776060 -0400
-@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
- 	struct rate_control_ref *ref, *old;
- 
- 	ASSERT_RTNL();
--	if (local->open_count)
-+	if (atomic_read(&local->open_count))
- 		return -EBUSY;
- 
- 	ref = rate_control_alloc(name, local);
-diff -urNp linux-2.6.32.13/net/mac80211/tx.c linux-2.6.32.13/net/mac80211/tx.c
---- linux-2.6.32.13/net/mac80211/tx.c	2010-04-29 17:49:38.690617032 -0400
-+++ linux-2.6.32.13/net/mac80211/tx.c	2010-05-15 13:21:18.734776060 -0400
-@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
- 	return cpu_to_le16(dur);
- }
- 
--static int inline is_ieee80211_device(struct ieee80211_local *local,
-+static inline int is_ieee80211_device(struct ieee80211_local *local,
- 				      struct net_device *dev)
- {
- 	return local == wdev_priv(dev->ieee80211_ptr);
-diff -urNp linux-2.6.32.13/net/mac80211/util.c linux-2.6.32.13/net/mac80211/util.c
---- linux-2.6.32.13/net/mac80211/util.c	2010-04-29 17:49:38.690617032 -0400
-+++ linux-2.6.32.13/net/mac80211/util.c	2010-05-15 13:21:18.734776060 -0400
-@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
- 		local->resuming = true;
- 
- 	/* restart hardware */
--	if (local->open_count) {
-+	if (atomic_read(&local->open_count)) {
- 		/*
- 		 * Upon resume hardware can sometimes be goofy due to
- 		 * various platform / driver / bus issues, so restarting
- 		 * the device may at times not work immediately. Propagate
- 		 * the error.
- 		 */
--		res = drv_start(local);
-+                res = drv_start(local);
- 		if (res) {
- 			WARN(local->suspended, "Harware became unavailable "
- 			     "upon resume. This is could be a software issue"
-diff -urNp linux-2.6.32.13/net/sctp/socket.c linux-2.6.32.13/net/sctp/socket.c
---- linux-2.6.32.13/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/sctp/socket.c	2010-05-15 13:21:18.788974801 -0400
-@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
- 	struct sctp_sndrcvinfo *sinfo;
- 	struct sctp_initmsg *sinit;
- 	sctp_assoc_t associd = 0;
--	sctp_cmsgs_t cmsgs = { NULL };
-+	sctp_cmsgs_t cmsgs = { NULL, NULL };
- 	int err;
- 	sctp_scope_t scope;
- 	long timeo;
-@@ -5802,7 +5802,6 @@ pp_found:
- 		 */
- 		int reuse = sk->sk_reuse;
- 		struct sock *sk2;
--		struct hlist_node *node;
- 
- 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
- 		if (pp->fastreuse && sk->sk_reuse &&
-diff -urNp linux-2.6.32.13/net/socket.c linux-2.6.32.13/net/socket.c
---- linux-2.6.32.13/net/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/socket.c	2010-05-15 13:21:18.788974801 -0400
-@@ -87,6 +87,7 @@
- #include <linux/wireless.h>
- #include <linux/nsproxy.h>
- #include <linux/magic.h>
-+#include <linux/in.h>
- 
- #include <asm/uaccess.h>
- #include <asm/unistd.h>
-@@ -97,6 +98,21 @@
- #include <net/sock.h>
- #include <linux/netfilter.h>
- 
-+extern void gr_attach_curr_ip(const struct sock *sk);
-+extern int gr_handle_sock_all(const int family, const int type,
-+			      const int protocol);
-+extern int gr_handle_sock_server(const struct sockaddr *sck);
-+extern int gr_handle_sock_server_other(const struct socket *sck);
-+extern int gr_handle_sock_client(const struct sockaddr *sck);
-+extern int gr_search_connect(struct socket * sock,
-+			     struct sockaddr_in * addr);
-+extern int gr_search_bind(struct socket * sock,
-+			  struct sockaddr_in * addr);
-+extern int gr_search_listen(struct socket * sock);
-+extern int gr_search_accept(struct socket * sock);
-+extern int gr_search_socket(const int domain, const int type,
-+			    const int protocol);
-+
- static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
- static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
- 			 unsigned long nr_segs, loff_t pos);
-@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
- 			     mnt);
- }
- 
--static struct vfsmount *sock_mnt __read_mostly;
-+struct vfsmount *sock_mnt __read_mostly;
- 
- static struct file_system_type sock_fs_type = {
- 	.name =		"sockfs",
-@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
- 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
- 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
- 
-+	if(!gr_search_socket(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
-+	if (gr_handle_sock_all(family, type, protocol)) {
-+		retval = -EACCES;
-+		goto out;
-+	}
-+
- 	retval = sock_create(family, type, protocol, &sock);
- 	if (retval < 0)
- 		goto out;
-@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 	if (sock) {
- 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
- 		if (err >= 0) {
-+			if (gr_handle_sock_server((struct sockaddr *)&address)) {
-+				err = -EACCES;
-+				goto error;
-+			}
-+			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
-+			if (err)
-+				goto error;
-+
- 			err = security_socket_bind(sock,
- 						   (struct sockaddr *)&address,
- 						   addrlen);
-@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
- 						      (struct sockaddr *)
- 						      &address, addrlen);
- 		}
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
- 		if ((unsigned)backlog > somaxconn)
- 			backlog = somaxconn;
- 
-+		if (gr_handle_sock_server_other(sock)) {
-+			err = -EPERM;
-+			goto error;
-+		}
-+
-+		err = gr_search_listen(sock);
-+		if (err)
-+			goto error;
-+
- 		err = security_socket_listen(sock, backlog);
- 		if (!err)
- 			err = sock->ops->listen(sock, backlog);
- 
-+error:
- 		fput_light(sock->file, fput_needed);
- 	}
- 	return err;
-@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	newsock->type = sock->type;
- 	newsock->ops = sock->ops;
- 
-+	if (gr_handle_sock_server_other(sock)) {
-+		err = -EPERM;
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
-+	err = gr_search_accept(sock);
-+	if (err) {
-+		sock_release(newsock);
-+		goto out_put;
-+	}
-+
- 	/*
- 	 * We don't need try_module_get here, as the listening socket (sock)
- 	 * has the protocol module (sock->ops->owner) held.
-@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
- 	fd_install(newfd, newfile);
- 	err = newfd;
- 
-+	gr_attach_curr_ip(newsock->sk);
-+
- out_put:
- 	fput_light(sock->file, fput_needed);
- out:
-@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 		int, addrlen)
- {
- 	struct socket *sock;
-+	struct sockaddr *sck;
- 	struct sockaddr_storage address;
- 	int err, fput_needed;
- 
-@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
- 	if (err < 0)
- 		goto out_put;
- 
-+	sck = (struct sockaddr *)&address;
-+
-+	if (gr_handle_sock_client(sck)) {
-+		err = -EACCES;
-+		goto out_put;
-+	}
-+
-+	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
-+	if (err)
-+		goto out_put;
-+
- 	err =
- 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
- 	if (err)
-diff -urNp linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/sunrpc/xprtrdma/svc_rdma.c	2010-05-15 13:21:18.790642809 -0400
-@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
- 		len -= *ppos;
- 		if (len > *lenp)
- 			len = *lenp;
--		if (len && copy_to_user(buffer, str_buf, len))
-+		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
- 			return -EFAULT;
- 		*lenp = len;
- 		*ppos += len;
-diff -urNp linux-2.6.32.13/net/sysctl_net.c linux-2.6.32.13/net/sysctl_net.c
---- linux-2.6.32.13/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/sysctl_net.c	2010-05-15 13:21:18.790642809 -0400
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
- 			       struct ctl_table *table)
- {
- 	/* Allow network administrator to have same access as root. */
--	if (capable(CAP_NET_ADMIN)) {
-+	if (capable_nolog(CAP_NET_ADMIN)) {
- 		int mode = (table->mode >> 6) & 7;
- 		return (mode << 6) | (mode << 3) | mode;
- 	}
-diff -urNp linux-2.6.32.13/net/tipc/socket.c linux-2.6.32.13/net/tipc/socket.c
---- linux-2.6.32.13/net/tipc/socket.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/tipc/socket.c	2010-05-15 13:21:18.790642809 -0400
-@@ -1449,8 +1449,9 @@ static int connect(struct socket *sock, 
- 	} else {
- 		if (res == 0)
- 			res = -ETIMEDOUT;
--		else
--			; /* leave "res" unchanged */
-+		else {
-+			/* leave "res" unchanged */
-+		}
- 		sock->state = SS_DISCONNECTING;
- 	}
- 
-diff -urNp linux-2.6.32.13/net/unix/af_unix.c linux-2.6.32.13/net/unix/af_unix.c
---- linux-2.6.32.13/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/unix/af_unix.c	2010-05-15 13:21:18.790642809 -0400
-@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
- 		err = -ECONNREFUSED;
- 		if (!S_ISSOCK(inode->i_mode))
- 			goto put_fail;
-+
-+		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
-+			err = -EACCES;
-+			goto put_fail;
-+		}
-+
- 		u = unix_find_socket_byinode(net, inode);
- 		if (!u)
- 			goto put_fail;
-@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
- 		if (u) {
- 			struct dentry *dentry;
- 			dentry = unix_sk(u)->dentry;
-+
-+			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
-+				err = -EPERM;
-+				sock_put(u);
-+				goto fail;
-+			}
-+
- 			if (dentry)
- 				touch_atime(unix_sk(u)->mnt, dentry);
- 		} else
-@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
- 		err = security_path_mknod(&nd.path, dentry, mode, 0);
- 		if (err)
- 			goto out_mknod_drop_write;
-+		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
-+			err = -EACCES;
-+			goto out_mknod_drop_write;
-+		}
- 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
- out_mknod_drop_write:
- 		mnt_drop_write(nd.path.mnt);
- 		if (err)
- 			goto out_mknod_dput;
-+
-+		gr_handle_create(dentry, nd.path.mnt);
-+
- 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
- 		dput(nd.path.dentry);
- 		nd.path.dentry = dentry;
-@@ -861,6 +881,10 @@ out_mknod_drop_write:
- 			goto out_unlock;
- 		}
- 
-+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
-+		sk->sk_peercred.pid = current->pid;
-+#endif
-+
- 		list = &unix_socket_table[addr->hash];
- 	} else {
- 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
-diff -urNp linux-2.6.32.13/net/xfrm/xfrm_policy.c linux-2.6.32.13/net/xfrm/xfrm_policy.c
---- linux-2.6.32.13/net/xfrm/xfrm_policy.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/net/xfrm/xfrm_policy.c	2010-05-15 13:21:18.790642809 -0400
-@@ -1477,7 +1477,7 @@ free_dst:
- 	goto out;
- }
- 
--static int inline
-+static inline int
- xfrm_dst_alloc_copy(void **target, void *src, int size)
- {
- 	if (!*target) {
-@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void 
- 	return 0;
- }
- 
--static int inline
-+static inline int
- xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry 
- #endif
- }
- 
--static int inline
-+static inline int
- xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
- {
- #ifdef CONFIG_XFRM_SUB_POLICY
-diff -urNp linux-2.6.32.13/samples/kobject/kset-example.c linux-2.6.32.13/samples/kobject/kset-example.c
---- linux-2.6.32.13/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/samples/kobject/kset-example.c	2010-05-15 13:21:18.790642809 -0400
-@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
- }
- 
- /* Our custom sysfs_ops that we will associate with our ktype later on */
--static struct sysfs_ops foo_sysfs_ops = {
-+static const struct sysfs_ops foo_sysfs_ops = {
- 	.show = foo_attr_show,
- 	.store = foo_attr_store,
- };
-diff -urNp linux-2.6.32.13/scripts/basic/fixdep.c linux-2.6.32.13/scripts/basic/fixdep.c
---- linux-2.6.32.13/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/basic/fixdep.c	2010-05-15 13:21:18.790642809 -0400
-@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
- 
- static void parse_config_file(char *map, size_t len)
- {
--	int *end = (int *) (map + len);
-+	unsigned int *end = (unsigned int *) (map + len);
- 	/* start at +1, so that p can never be < map */
--	int *m   = (int *) map + 1;
-+	unsigned int *m   = (unsigned int *) map + 1;
- 	char *p, *q;
- 
- 	for (; m < end; m++) {
-@@ -371,7 +371,7 @@ static void print_deps(void)
- static void traps(void)
- {
- 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
--	int *p = (int *)test;
-+	unsigned int *p = (unsigned int *)test;
- 
- 	if (*p != INT_CONF) {
- 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.32.13/scripts/kallsyms.c linux-2.6.32.13/scripts/kallsyms.c
---- linux-2.6.32.13/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/kallsyms.c	2010-05-15 13:21:18.790642809 -0400
-@@ -43,10 +43,10 @@ struct text_range {
- 
- static unsigned long long _text;
- static struct text_range text_ranges[] = {
--	{ "_stext",     "_etext"     },
--	{ "_sinittext", "_einittext" },
--	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
--	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
-+	{ "_stext",     "_etext",     0, 0 },
-+	{ "_sinittext", "_einittext", 0, 0 },
-+	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
-+	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
- };
- #define text_range_text     (&text_ranges[0])
- #define text_range_inittext (&text_ranges[1])
-diff -urNp linux-2.6.32.13/scripts/mod/file2alias.c linux-2.6.32.13/scripts/mod/file2alias.c
---- linux-2.6.32.13/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/mod/file2alias.c	2010-05-15 13:21:18.790642809 -0400
-@@ -72,7 +72,7 @@ static void device_id_check(const char *
- 			    unsigned long size, unsigned long id_size,
- 			    void *symval)
- {
--	int i;
-+	unsigned int i;
- 
- 	if (size % id_size || size < id_size) {
- 		if (cross_build != 0)
-@@ -102,7 +102,7 @@ static void device_id_check(const char *
- /* USB is special because the bcdDevice can be matched against a numeric range */
- /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
- static void do_usb_entry(struct usb_device_id *id,
--			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
-+			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
- 			 unsigned char range_lo, unsigned char range_hi,
- 			 struct module *mod)
- {
-@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
- 	for (i = 0; i < count; i++) {
- 		const char *id = (char *)devs[i].id;
- 		char acpi_id[sizeof(devs[0].id)];
--		int j;
-+		unsigned int j;
- 
- 		buf_printf(&mod->dev_table_buf,
- 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
- 
- 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
- 			const char *id = (char *)card->devs[j].id;
--			int i2, j2;
-+			unsigned int i2, j2;
- 			int dup = 0;
- 
- 			if (!id[0])
-@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
- 			/* add an individual alias for every device entry */
- 			if (!dup) {
- 				char acpi_id[sizeof(card->devs[0].id)];
--				int k;
-+				unsigned int k;
- 
- 				buf_printf(&mod->dev_table_buf,
- 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
-@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
- static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
- 			char *alias)
- {
--	int i, j;
-+	unsigned int i, j;
- 
- 	sprintf(alias, "dmi*");
- 
-diff -urNp linux-2.6.32.13/scripts/mod/modpost.c linux-2.6.32.13/scripts/mod/modpost.c
---- linux-2.6.32.13/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/mod/modpost.c	2010-05-15 13:21:18.814648703 -0400
-@@ -835,6 +835,7 @@ enum mismatch {
- 	INIT_TO_EXIT,
- 	EXIT_TO_INIT,
- 	EXPORT_TO_INIT_EXIT,
-+	DATA_TO_TEXT
- };
- 
- struct sectioncheck {
-@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
- 	.fromsec = { "__ksymtab*", NULL },
- 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
- 	.mismatch = EXPORT_TO_INIT_EXIT
-+},
-+/* Do not reference code from writable data */
-+{
-+	.fromsec = { DATA_SECTIONS, NULL },
-+	.tosec   = { TEXT_SECTIONS, NULL },
-+	.mismatch = DATA_TO_TEXT
- }
- };
- 
-@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
- 			continue;
- 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
- 			continue;
--		if (sym->st_value == addr)
--			return sym;
- 		/* Find a symbol nearby - addr are maybe negative */
- 		d = sym->st_value - addr;
-+		if (d == 0)
-+			return sym;
- 		if (d < 0)
- 			d = addr - sym->st_value;
- 		if (d < distance) {
-@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
- 		"Fix this by removing the %sannotation of %s "
- 		"or drop the export.\n",
- 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
-+	case DATA_TO_TEXT:
-+/*
-+		fprintf(stderr,
-+		"The variable %s references\n"
-+		"the %s %s%s%s\n",
-+		fromsym, to, sec2annotation(tosec), tosym, to_p);
-+*/
-+		break;
- 	case NO_MISMATCH:
- 		/* To get warnings on missing members */
- 		break;
-@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
- 	va_end(ap);
- }
- 
--void buf_write(struct buffer *buf, const char *s, int len)
-+void buf_write(struct buffer *buf, const char *s, unsigned int len)
- {
- 	if (buf->size - buf->pos < len) {
- 		buf->size += len + SZ;
-@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
- 	if (fstat(fileno(file), &st) < 0)
- 		goto close_write;
- 
--	if (st.st_size != b->pos)
-+	if (st.st_size != (off_t)b->pos)
- 		goto close_write;
- 
- 	tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.32.13/scripts/mod/modpost.h linux-2.6.32.13/scripts/mod/modpost.h
---- linux-2.6.32.13/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/mod/modpost.h	2010-05-15 13:21:18.814648703 -0400
-@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
- 
- struct buffer {
- 	char *p;
--	int pos;
--	int size;
-+	unsigned int pos;
-+	unsigned int size;
- };
- 
- void __attribute__((format(printf, 2, 3)))
- buf_printf(struct buffer *buf, const char *fmt, ...);
- 
- void
--buf_write(struct buffer *buf, const char *s, int len);
-+buf_write(struct buffer *buf, const char *s, unsigned int len);
- 
- struct module {
- 	struct module *next;
-diff -urNp linux-2.6.32.13/scripts/mod/sumversion.c linux-2.6.32.13/scripts/mod/sumversion.c
---- linux-2.6.32.13/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/mod/sumversion.c	2010-05-15 13:21:18.814648703 -0400
-@@ -455,7 +455,7 @@ static void write_version(const char *fi
- 		goto out;
- 	}
- 
--	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-+	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
- 		warn("writing sum in %s failed: %s\n",
- 			filename, strerror(errno));
- 		goto out;
-diff -urNp linux-2.6.32.13/scripts/pnmtologo.c linux-2.6.32.13/scripts/pnmtologo.c
---- linux-2.6.32.13/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/scripts/pnmtologo.c	2010-05-15 13:21:18.814648703 -0400
-@@ -237,14 +237,14 @@ static void write_header(void)
-     fprintf(out, " *  Linux logo %s\n", logoname);
-     fputs(" */\n\n", out);
-     fputs("#include <linux/linux_logo.h>\n\n", out);
--    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_data[] = {\n",
- 	    logoname);
- }
- 
- static void write_footer(void)
- {
-     fputs("\n};\n\n", out);
--    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
-+    fprintf(out, "const struct linux_logo %s = {\n", logoname);
-     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
-     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
-     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
-@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
-     fputs("\n};\n\n", out);
- 
-     /* write logo clut */
--    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
-+    fprintf(out, "static unsigned char %s_clut[] = {\n",
- 	    logoname);
-     write_hex_cnt = 0;
-     for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.32.13/security/commoncap.c linux-2.6.32.13/security/commoncap.c
---- linux-2.6.32.13/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/commoncap.c	2010-05-15 13:21:18.814648703 -0400
-@@ -27,7 +27,7 @@
- #include <linux/sched.h>
- #include <linux/prctl.h>
- #include <linux/securebits.h>
--
-+#include <net/sock.h>
- /*
-  * If a non-root user executes a setuid-root binary in
-  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
-@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
- 	}
- }
- 
-+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
-+
- int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
- {
--	NETLINK_CB(skb).eff_cap = current_cap();
-+	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
- 	return 0;
- }
- 
-diff -urNp linux-2.6.32.13/security/integrity/ima/ima_api.c linux-2.6.32.13/security/integrity/ima/ima_api.c
---- linux-2.6.32.13/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/integrity/ima/ima_api.c	2010-05-15 13:21:18.814648703 -0400
-@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
- 	int result;
- 
- 	/* can overflow, only indicator */
--	atomic_long_inc(&ima_htable.violations);
-+	atomic_long_inc_unchecked(&ima_htable.violations);
- 
- 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
- 	if (!entry) {
-diff -urNp linux-2.6.32.13/security/integrity/ima/ima_fs.c linux-2.6.32.13/security/integrity/ima/ima_fs.c
---- linux-2.6.32.13/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/integrity/ima/ima_fs.c	2010-05-15 13:21:18.814648703 -0400
-@@ -27,12 +27,12 @@
- static int valid_policy = 1;
- #define TMPBUFLEN 12
- static ssize_t ima_show_htable_value(char __user *buf, size_t count,
--				     loff_t *ppos, atomic_long_t *val)
-+				     loff_t *ppos, atomic_long_unchecked_t *val)
- {
- 	char tmpbuf[TMPBUFLEN];
- 	ssize_t len;
- 
--	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
-+	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
- 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
- }
- 
-diff -urNp linux-2.6.32.13/security/integrity/ima/ima.h linux-2.6.32.13/security/integrity/ima/ima.h
---- linux-2.6.32.13/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/integrity/ima/ima.h	2010-05-15 13:21:18.814648703 -0400
-@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
- extern spinlock_t ima_queue_lock;
- 
- struct ima_h_table {
--	atomic_long_t len;	/* number of stored measurements in the list */
--	atomic_long_t violations;
-+	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
-+	atomic_long_unchecked_t violations;
- 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
- };
- extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.32.13/security/integrity/ima/ima_queue.c linux-2.6.32.13/security/integrity/ima/ima_queue.c
---- linux-2.6.32.13/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/integrity/ima/ima_queue.c	2010-05-15 13:21:18.814648703 -0400
-@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
- 	INIT_LIST_HEAD(&qe->later);
- 	list_add_tail_rcu(&qe->later, &ima_measurements);
- 
--	atomic_long_inc(&ima_htable.len);
-+	atomic_long_inc_unchecked(&ima_htable.len);
- 	key = ima_hash_key(entry->digest);
- 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
- 	return 0;
-diff -urNp linux-2.6.32.13/security/Kconfig linux-2.6.32.13/security/Kconfig
---- linux-2.6.32.13/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/security/Kconfig	2010-05-15 13:37:07.058702111 -0400
-@@ -4,6 +4,499 @@
- 
- menu "Security options"
- 
-+source grsecurity/Kconfig
-+
-+menu "PaX"
-+
-+	config PAX_PER_CPU_PGD
-+	bool
-+
-+	config TASK_SIZE_MAX_SHIFT
-+	int
-+	depends on X86_64
-+	default 47 if !PAX_PER_CPU_PGD
-+	default 42 if PAX_PER_CPU_PGD
-+
-+config PAX
-+	bool "Enable various PaX features"
-+	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
-+	help
-+	  This allows you to enable various PaX features.  PaX adds
-+	  intrusion prevention mechanisms to the kernel that reduce
-+	  the risks posed by exploitable memory corruption bugs.
-+
-+menu "PaX Control"
-+	depends on PAX
-+
-+config PAX_SOFTMODE
-+	bool 'Support soft mode'
-+	select PAX_PT_PAX_FLAGS
-+	help
-+	  Enabling this option will allow you to run PaX in soft mode, that
-+	  is, PaX features will not be enforced by default, only on executables
-+	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
-+	  is the only way to mark executables for soft mode use.
-+
-+	  Soft mode can be activated by using the "pax_softmode=1" kernel command
-+	  line option on boot.  Furthermore you can control various PaX features
-+	  at runtime via the entries in /proc/sys/kernel/pax.
-+
-+config PAX_EI_PAX
-+	bool 'Use legacy ELF header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'chpax' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  an otherwise reserved part of the ELF header.  This marking has
-+	  numerous drawbacks (no support for soft-mode, toolchain does not
-+	  know about the non-standard use of the ELF header) therefore it
-+	  has been deprecated in favour of PT_PAX_FLAGS support.
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable this option otherwise they
-+	  will not get any protection.
-+
-+	  Note that if you enable PT_PAX_FLAGS marking support as well,
-+	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
-+
-+config PAX_PT_PAX_FLAGS
-+	bool 'Use ELF program header marking'
-+	help
-+	  Enabling this option will allow you to control PaX features on
-+	  a per executable basis via the 'paxctl' utility available at
-+	  http://pax.grsecurity.net/.  The control flags will be read from
-+	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
-+	  has the benefits of supporting both soft mode and being fully
-+	  integrated into the toolchain (the binutils patch is available
-+	  from http://pax.grsecurity.net).
-+
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable the EI_PAX marking support
-+	  otherwise they will not get any protection.
-+
-+	  Note that if you enable the legacy EI_PAX marking support as well,
-+	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
-+
-+choice
-+	prompt 'MAC system integration'
-+	default PAX_HAVE_ACL_FLAGS
-+	help
-+	  Mandatory Access Control systems have the option of controlling
-+	  PaX flags on a per executable basis, choose the method supported
-+	  by your particular system.
-+
-+	  - "none": if your MAC system does not interact with PaX,
-+	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
-+	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
-+
-+	  NOTE: this option is for developers/integrators only.
-+
-+	config PAX_NO_ACL_FLAGS
-+		bool 'none'
-+
-+	config PAX_HAVE_ACL_FLAGS
-+		bool 'direct'
-+
-+	config PAX_HOOK_ACL_FLAGS
-+		bool 'hook'
-+endchoice
-+
-+endmenu
-+
-+menu "Non-executable pages"
-+	depends on PAX
-+
-+config PAX_NOEXEC
-+	bool "Enforce non-executable pages"
-+	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
-+	help
-+	  By design some architectures do not allow for protecting memory
-+	  pages against execution or even if they do, Linux does not make
-+	  use of this feature.  In practice this means that if a page is
-+	  readable (such as the stack or heap) it is also executable.
-+
-+	  There is a well known exploit technique that makes use of this
-+	  fact and a common programming mistake where an attacker can
-+	  introduce code of his choice somewhere in the attacked program's
-+	  memory (typically the stack or the heap) and then execute it.
-+
-+	  If the attacked program was running with different (typically
-+	  higher) privileges than that of the attacker, then he can elevate
-+	  his own privilege level (e.g. get a root shell, write to files for
-+	  which he does not have write access to, etc).
-+
-+	  Enabling this option will let you choose from various features
-+	  that prevent the injection and execution of 'foreign' code in
-+	  a program.
-+
-+	  This will also break programs that rely on the old behaviour and
-+	  expect that dynamically allocated memory via the malloc() family
-+	  of functions is executable (which it is not).  Notable examples
-+	  are the XFree86 4.x server, the java runtime and wine.
-+
-+config PAX_PAGEEXEC
-+	bool "Paging based non-executable pages"
-+	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
-+	select S390_SWITCH_AMODE if S390
-+	select S390_EXEC_PROTECT if S390
-+	help
-+	  This implementation is based on the paging feature of the CPU.
-+	  On i386 without hardware non-executable bit support there is a
-+	  variable but usually low performance impact, however on Intel's
-+	  P4 core based CPUs it is very high so you should not enable this
-+	  for kernels meant to be used on such CPUs.
-+
-+	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
-+	  with hardware non-executable bit support there is no performance
-+	  impact, on ppc the impact is negligible.
-+
-+	  Note that several architectures require various emulations due to
-+	  badly designed userland ABIs, this will cause a performance impact
-+	  but will disappear as soon as userland is fixed. For example, ppc
-+	  userland MUST have been built with secure-plt by a recent toolchain.
-+
-+config PAX_SEGMEXEC
-+	bool "Segmentation based non-executable pages"
-+	depends on PAX_NOEXEC && X86_32
-+	help
-+	  This implementation is based on the segmentation feature of the
-+	  CPU and has a very small performance impact, however applications
-+	  will be limited to a 1.5 GB address space instead of the normal
-+	  3 GB.
-+
-+config PAX_EMUTRAMP
-+	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
-+	default y if PARISC
-+	help
-+	  There are some programs and libraries that for one reason or
-+	  another attempt to execute special small code snippets from
-+	  non-executable memory pages.  Most notable examples are the
-+	  signal handler return code generated by the kernel itself and
-+	  the GCC trampolines.
-+
-+	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
-+	  such programs will no longer work under your kernel.
-+
-+	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
-+	  utilities to enable trampoline emulation for the affected programs
-+	  yet still have the protection provided by the non-executable pages.
-+
-+	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
-+	  your system will not even boot.
-+
-+	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
-+	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
-+	  for the affected files.
-+
-+	  NOTE: enabling this feature *may* open up a loophole in the
-+	  protection provided by non-executable pages that an attacker
-+	  could abuse.  Therefore the best solution is to not have any
-+	  files on your system that would require this option.  This can
-+	  be achieved by not using libc5 (which relies on the kernel
-+	  signal handler return code) and not using or rewriting programs
-+	  that make use of the nested function implementation of GCC.
-+	  Skilled users can just fix GCC itself so that it implements
-+	  nested function calls in a way that does not interfere with PaX.
-+
-+config PAX_EMUSIGRT
-+	bool "Automatically emulate sigreturn trampolines"
-+	depends on PAX_EMUTRAMP && PARISC
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate signal return trampolines executing on the stack
-+	  that would otherwise lead to task termination.
-+
-+	  This solution is intended as a temporary one for users with
-+	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
-+	  Modula-3 runtime, etc) or executables linked to such, basically
-+	  everything that does not specify its own SA_RESTORER function in
-+	  normal executable memory like glibc 2.1+ does.
-+
-+	  On parisc you MUST enable this option, otherwise your system will
-+	  not even boot.
-+
-+	  NOTE: this feature cannot be disabled on a per executable basis
-+	  and since it *does* open up a loophole in the protection provided
-+	  by non-executable pages, the best solution is to not have any
-+	  files on your system that would require this option.
-+
-+config PAX_MPROTECT
-+	bool "Restrict mprotect()"
-+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
-+	help
-+	  Enabling this option will prevent programs from
-+	   - changing the executable status of memory pages that were
-+	     not originally created as executable,
-+	   - making read-only executable pages writable again,
-+	   - creating executable pages from anonymous memory.
-+
-+	  You should say Y here to complete the protection provided by
-+	  the enforcement of non-executable pages.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_NOELFRELOCS
-+	bool "Disallow ELF text relocations"
-+	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
-+	help
-+	  Non-executable pages and mprotect() restrictions are effective
-+	  in preventing the introduction of new executable code into an
-+	  attacked task's address space.  There remain only two venues
-+	  for this kind of attack: if the attacker can execute already
-+	  existing code in the attacked task then he can either have it
-+	  create and mmap() a file containing his code or have it mmap()
-+	  an already existing ELF library that does not have position
-+	  independent code in it and use mprotect() on it to make it
-+	  writable and copy his code there.  While protecting against
-+	  the former approach is beyond PaX, the latter can be prevented
-+	  by having only PIC ELF libraries on one's system (which do not
-+	  need to relocate their code).  If you are sure this is your case,
-+	  then enable this option otherwise be careful as you may not even
-+	  be able to boot or log on your system (for example, some PAM
-+	  modules are erroneously compiled as non-PIC by default).
-+
-+	  NOTE: if you are using dynamic ELF executables (as suggested
-+	  when using ASLR) then you must have made sure that you linked
-+	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
-+	  referenced there has already been updated to support this).
-+
-+config PAX_ETEXECRELOCS
-+	bool "Allow ELF ET_EXEC text relocations"
-+	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
-+	default y
-+	help
-+	  On some architectures there are incorrectly created applications
-+	  that require text relocations and would not work without enabling
-+	  this option.  If you are an alpha, ia64 or parisc user, you should
-+	  enable this option and disable it once you have made sure that
-+	  none of your applications need it.
-+
-+config PAX_EMUPLT
-+	bool "Automatically emulate ELF PLT"
-+	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
-+	default y
-+	help
-+	  Enabling this option will have the kernel automatically detect
-+	  and emulate the Procedure Linkage Table entries in ELF files.
-+	  On some architectures such entries are in writable memory, and
-+	  become non-executable leading to task termination.  Therefore
-+	  it is mandatory that you enable this option on alpha, parisc,
-+	  sparc and sparc64, otherwise your system would not even boot.
-+
-+	  NOTE: this feature *does* open up a loophole in the protection
-+	  provided by the non-executable pages, therefore the proper
-+	  solution is to modify the toolchain to produce a PLT that does
-+	  not need to be writable.
-+
-+config PAX_DLRESOLVE
-+	bool 'Emulate old glibc resolver stub'
-+	depends on PAX_EMUPLT && SPARC
-+	default n
-+	help
-+	  This option is needed if userland has an old glibc (before 2.4)
-+	  that puts a 'save' instruction into the runtime generated resolver
-+	  stub that needs special emulation.
-+
-+config PAX_KERNEXEC
-+	bool "Enforce non-executable kernel pages"
-+	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
-+	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
-+	help
-+	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
-+	  that is, enabling this option will make it harder to inject
-+	  and execute 'foreign' code in kernel memory itself.
-+
-+config PAX_KERNEXEC_MODULE_TEXT
-+	int "Minimum amount of memory reserved for module code"
-+	default "4"
-+	depends on PAX_KERNEXEC && X86_32 && MODULES
-+	help
-+	  Due to implementation details the kernel must reserve a fixed
-+	  amount of memory for module code at compile time that cannot be
-+	  changed at runtime.  Here you can specify the minimum amount
-+	  in MB that will be reserved.  Due to the same implementation
-+	  details this size will always be rounded up to the next 2/4 MB
-+	  boundary (depends on PAE) so the actually available memory for
-+	  module code will usually be more than this minimum.
-+
-+	  The default 4 MB should be enough for most users but if you have
-+	  an excessive number of modules (e.g., most distribution configs
-+	  compile many drivers as modules) or use huge modules such as
-+	  nvidia's kernel driver, you will need to adjust this amount.
-+	  A good rule of thumb is to look at your currently loaded kernel
-+	  modules and add up their sizes.
-+
-+endmenu
-+
-+menu "Address Space Layout Randomization"
-+	depends on PAX
-+
-+config PAX_ASLR
-+	bool "Address Space Layout Randomization"
-+	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
-+	help
-+	  Many if not most exploit techniques rely on the knowledge of
-+	  certain addresses in the attacked program.  The following options
-+	  will allow the kernel to apply a certain amount of randomization
-+	  to specific parts of the program thereby forcing an attacker to
-+	  guess them in most cases.  Any failed guess will most likely crash
-+	  the attacked program which allows the kernel to detect such attempts
-+	  and react on them.  PaX itself provides no reaction mechanisms,
-+	  instead it is strongly encouraged that you make use of Nergal's
-+	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
-+	  (http://www.grsecurity.net/) built-in crash detection features or
-+	  develop one yourself.
-+
-+	  By saying Y here you can choose to randomize the following areas:
-+	   - top of the task's kernel stack
-+	   - top of the task's userland stack
-+	   - base address for mmap() requests that do not specify one
-+	     (this includes all libraries)
-+	   - base address of the main executable
-+
-+	  It is strongly recommended to say Y here as address space layout
-+	  randomization has negligible impact on performance yet it provides
-+	  a very effective protection.
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
-+	  this feature on a per file basis.
-+
-+config PAX_RANDKSTACK
-+	bool "Randomize kernel stack base"
-+	depends on PAX_ASLR && X86_TSC && X86_32
-+	help
-+	  By saying Y here the kernel will randomize every task's kernel
-+	  stack on every system call.  This will not only force an attacker
-+	  to guess it but also prevent him from making use of possible
-+	  leaked information about it.
-+
-+	  Since the kernel stack is a rather scarce resource, randomization
-+	  may cause unexpected stack overflows, therefore you should very
-+	  carefully test your system.  Note that once enabled in the kernel
-+	  configuration, this feature cannot be disabled on a per file basis.
-+
-+config PAX_RANDUSTACK
-+	bool "Randomize user stack base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will randomize every task's userland
-+	  stack.  The randomization is done in two steps where the second
-+	  one may apply a big amount of shift to the top of the stack and
-+	  cause problems for programs that want to use lots of memory (more
-+	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
-+	  For this reason the second step can be controlled by 'chpax' or
-+	  'paxctl' on a per file basis.
-+
-+config PAX_RANDMMAP
-+	bool "Randomize mmap() base"
-+	depends on PAX_ASLR
-+	help
-+	  By saying Y here the kernel will use a randomized base address for
-+	  mmap() requests that do not specify one themselves.  As a result
-+	  all dynamically loaded libraries will appear at random addresses
-+	  and therefore be harder to exploit by a technique where an attacker
-+	  attempts to execute library code for his purposes (e.g. spawn a
-+	  shell from an exploited program that is running at an elevated
-+	  privilege level).
-+
-+	  Furthermore, if a program is relinked as a dynamic ELF file, its
-+	  base address will be randomized as well, completing the full
-+	  randomization of the address space layout.  Attacking such programs
-+	  becomes a guess game.  You can find an example of doing this at
-+	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
-+	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
-+
-+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
-+	  feature on a per file basis.
-+
-+endmenu
-+
-+menu "Miscellaneous hardening features"
-+
-+config PAX_MEMORY_SANITIZE
-+	bool "Sanitize all freed memory"
-+	help
-+	  By saying Y here the kernel will erase memory pages as soon as they
-+	  are freed.  This in turn reduces the lifetime of data stored in the
-+	  pages, making it less likely that sensitive information such as
-+	  passwords, cryptographic secrets, etc stay in memory for too long.
-+
-+	  This is especially useful for programs whose runtime is short, long
-+	  lived processes and the kernel itself benefit from this as long as
-+	  they operate on whole memory pages and ensure timely freeing of pages
-+	  that may hold sensitive information.
-+
-+	  The tradeoff is performance impact, on a single CPU system kernel
-+	  compilation sees a 3% slowdown, other systems and workloads may vary
-+	  and you are advised to test this feature on your expected workload
-+	  before deploying it.
-+
-+	  Note that this feature does not protect data stored in live pages,
-+	  e.g., process memory swapped to disk may stay there for a long time.
-+
-+config PAX_MEMORY_UDEREF
-+	bool "Prevent invalid userland pointer dereference"
-+	depends on X86 && !UML_X86 && !XEN
-+	select PAX_PER_CPU_PGD if X86_64
-+	help
-+	  By saying Y here the kernel will be prevented from dereferencing
-+	  userland pointers in contexts where the kernel expects only kernel
-+	  pointers.  This is both a useful runtime debugging feature and a
-+	  security measure that prevents exploiting a class of kernel bugs.
-+
-+	  The tradeoff is that some virtualization solutions may experience
-+	  a huge slowdown and therefore you should not enable this feature
-+	  for kernels meant to run in such environments.  Whether a given VM
-+	  solution is affected or not is best determined by simply trying it
-+	  out, the performance impact will be obvious right on boot as this
-+	  mechanism engages from very early on.  A good rule of thumb is that
-+	  VMs running on CPUs without hardware virtualization support (i.e.,
-+	  the majority of IA-32 CPUs) will likely experience the slowdown.
-+
-+config PAX_REFCOUNT
-+	bool "Prevent various kernel object reference counter overflows"
-+	depends on GRKERNSEC && (X86 || SPARC64)
-+	help
-+	  By saying Y here the kernel will detect and prevent overflowing
-+	  various (but not all) kinds of object reference counters.  Such
-+	  overflows can normally occur due to bugs only and are often, if
-+	  not always, exploitable.
-+
-+	  The tradeoff is that data structures protected by an overflowed
-+	  refcount will never be freed and therefore will leak memory.  Note
-+	  that this leak also happens even without this protection but in
-+	  that case the overflow can eventually trigger the freeing of the
-+	  data structure while it is still being used elsewhere, resulting
-+	  in the exploitable situation that this feature prevents.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+
-+config PAX_USERCOPY
-+	bool "Bounds check heap object copies between kernel and userland"
-+	depends on X86 || PPC || SPARC
-+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
-+	help
-+	  By saying Y here the kernel will enforce the size of heap objects
-+	  when they are copied in either direction between the kernel and
-+	  userland, even if only a part of the heap object is copied.
-+
-+	  Specifically, this checking prevents information leaking from the
-+	  kernel heap during kernel to userland copies (if the kernel heap
-+	  object is otherwise fully initialized) and prevents kernel heap
-+	  overflows during userland to kernel copies.
-+
-+	  Note that the current implementation provides the strictest checks
-+	  for the SLUB allocator.
-+
-+	  Since this has a negligible performance impact, you should enable
-+	  this feature.
-+endmenu
-+
-+endmenu
-+
- config KEYS
- 	bool "Enable access key retention support"
- 	help
-@@ -146,7 +639,7 @@ config INTEL_TXT
- config LSM_MMAP_MIN_ADDR
- 	int "Low address space for LSM to protect from user allocation"
- 	depends on SECURITY && SECURITY_SELINUX
--	default 65536
-+	default 32768
- 	help
- 	  This is the portion of low virtual memory which should be protected
- 	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.32.13/security/min_addr.c linux-2.6.32.13/security/min_addr.c
---- linux-2.6.32.13/security/min_addr.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.13/security/min_addr.c	2010-05-15 13:21:18.814648703 -0400
-@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
-  */
- static void update_mmap_min_addr(void)
- {
-+#ifndef SPARC
- #ifdef CONFIG_LSM_MMAP_MIN_ADDR
- 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
- 		mmap_min_addr = dac_mmap_min_addr;
-@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
- #else
- 	mmap_min_addr = dac_mmap_min_addr;
- #endif
-+#endif
- }
- 
- /*
-diff -urNp linux-2.6.32.13/sound/aoa/codecs/onyx.c linux-2.6.32.13/sound/aoa/codecs/onyx.c
---- linux-2.6.32.13/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/aoa/codecs/onyx.c	2010-05-15 13:21:18.814648703 -0400
-@@ -53,7 +53,7 @@ struct onyx {
- 				spdif_locked:1,
- 				analog_locked:1,
- 				original_mute:2;
--	int			open_count;
-+	atomic_t		open_count;
- 	struct codec_info	*codec_info;
- 
- 	/* mutex serializes concurrent access to the device
-@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count++;
-+	atomic_inc(&onyx->open_count);
- 	mutex_unlock(&onyx->mutex);
- 
- 	return 0;
-@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
- 	struct onyx *onyx = cii->codec_data;
- 
- 	mutex_lock(&onyx->mutex);
--	onyx->open_count--;
--	if (!onyx->open_count)
-+	if (atomic_dec_and_test(&onyx->open_count))
- 		onyx->spdif_locked = onyx->analog_locked = 0;
- 	mutex_unlock(&onyx->mutex);
- 
-diff -urNp linux-2.6.32.13/sound/core/oss/pcm_oss.c linux-2.6.32.13/sound/core/oss/pcm_oss.c
---- linux-2.6.32.13/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/core/oss/pcm_oss.c	2010-05-15 13:21:18.814648703 -0400
-@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
- 	}
- }
- #else /* !CONFIG_SND_VERBOSE_PROCFS */
--#define snd_pcm_oss_proc_init(pcm)
--#define snd_pcm_oss_proc_done(pcm)
-+#define snd_pcm_oss_proc_init(pcm) do {} while (0)
-+#define snd_pcm_oss_proc_done(pcm) do {} while (0)
- #endif /* CONFIG_SND_VERBOSE_PROCFS */
- 
- /*
-diff -urNp linux-2.6.32.13/sound/core/seq/seq_lock.h linux-2.6.32.13/sound/core/seq/seq_lock.h
---- linux-2.6.32.13/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/core/seq/seq_lock.h	2010-05-15 13:21:18.814648703 -0400
-@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
- #else /* SMP || CONFIG_SND_DEBUG */
- 
- typedef spinlock_t snd_use_lock_t;	/* dummy */
--#define snd_use_lock_init(lockp) /**/
--#define snd_use_lock_use(lockp) /**/
--#define snd_use_lock_free(lockp) /**/
--#define snd_use_lock_sync(lockp) /**/
-+#define snd_use_lock_init(lockp) do {} while (0)
-+#define snd_use_lock_use(lockp) do {} while (0)
-+#define snd_use_lock_free(lockp) do {} while (0)
-+#define snd_use_lock_sync(lockp) do {} while (0)
- 
- #endif /* SMP || CONFIG_SND_DEBUG */
- 
-diff -urNp linux-2.6.32.13/sound/drivers/mts64.c linux-2.6.32.13/sound/drivers/mts64.c
---- linux-2.6.32.13/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/drivers/mts64.c	2010-05-15 13:21:18.814648703 -0400
-@@ -65,7 +65,7 @@ struct mts64 {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int current_midi_output_port;
- 	int current_midi_input_port;
- 	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
- {
- 	struct mts64 *mts = substream->rmidi->private_data;
- 
--	if (mts->open_count == 0) {
-+	if (atomic_read(&mts->open_count) == 0) {
- 		/* We don't need a spinlock here, because this is just called 
- 		   if the device has not been opened before. 
- 		   So there aren't any IRQs from the device */
-@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
- 
- 		msleep(50);
- 	}
--	++(mts->open_count);
-+	atomic_inc(&mts->open_count);
- 
- 	return 0;
- }
-@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
- 	struct mts64 *mts = substream->rmidi->private_data;
- 	unsigned long flags;
- 
--	--(mts->open_count);
--	if (mts->open_count == 0) {
-+	if (atomic_dec_return(&mts->open_count) == 0) {
- 		/* We need the spinlock_irqsave here because we can still
- 		   have IRQs at this point */
- 		spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
- 
- 		msleep(500);
- 
--	} else if (mts->open_count < 0)
--		mts->open_count = 0;
-+	} else if (atomic_read(&mts->open_count) < 0)
-+		atomic_set(&mts->open_count, 0);
- 
- 	return 0;
- }
-diff -urNp linux-2.6.32.13/sound/drivers/portman2x4.c linux-2.6.32.13/sound/drivers/portman2x4.c
---- linux-2.6.32.13/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/drivers/portman2x4.c	2010-05-15 13:21:18.818605087 -0400
-@@ -83,7 +83,7 @@ struct portman {
- 	struct pardevice *pardev;
- 	int pardev_claimed;
- 
--	int open_count;
-+	atomic_t open_count;
- 	int mode[PORTMAN_NUM_INPUT_PORTS];
- 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
- };
-diff -urNp linux-2.6.32.13/sound/oss/sb_audio.c linux-2.6.32.13/sound/oss/sb_audio.c
---- linux-2.6.32.13/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/oss/sb_audio.c	2010-05-15 13:21:18.853427293 -0400
-@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
- 		buf16 = (signed short *)(localbuf + localoffs);
- 		while (c)
- 		{
--			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
-+			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
- 			if (copy_from_user(lbuf8,
- 					   userbuf+useroffs + p,
- 					   locallen))
-diff -urNp linux-2.6.32.13/sound/pci/ac97/ac97_codec.c linux-2.6.32.13/sound/pci/ac97/ac97_codec.c
---- linux-2.6.32.13/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/pci/ac97/ac97_codec.c	2010-05-15 13:21:18.897182507 -0400
-@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
- }
- 
- /* build_ops to do nothing */
--static struct snd_ac97_build_ops null_build_ops;
-+static const struct snd_ac97_build_ops null_build_ops;
- 
- #ifdef CONFIG_SND_AC97_POWER_SAVE
- static void do_update_power(struct work_struct *work)
-diff -urNp linux-2.6.32.13/sound/pci/ac97/ac97_patch.c linux-2.6.32.13/sound/pci/ac97/ac97_patch.c
---- linux-2.6.32.13/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
-+++ linux-2.6.32.13/sound/pci/ac97/ac97_patch.c	2010-05-15 13:21:18.938590352 -0400
-@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
- 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- };
-@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
-+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
- 	.build_3d	= patch_yamaha_ymf7x3_3d,
- 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
- };
-@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
- 	.build_specific = patch_wolfson_wm9703_specific,
- };
- 
-@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
- 	.build_specific = patch_wolfson_wm9704_specific,
- };
- 
-@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
- 	.build_specific = patch_wolfson_wm9705_specific,
- };
- 
-@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
- 	.build_specific = patch_wolfson_wm9711_specific,
- };
- 
-@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
- }
- #endif
- 
--static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
-+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
- 	.build_specific = patch_wolfson_wm9713_specific,
- 	.build_3d = patch_wolfson_wm9713_3d,
- #ifdef CONFIG_PM	
-@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac97xx_specific
- };
-@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
- 	return patch_sigmatel_stac97xx_specific(ac97);
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
- 	.build_3d	= patch_sigmatel_stac9708_3d,
- 	.build_specific	= patch_sigmatel_stac9708_specific
- };
-@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
-+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
- 	.build_3d	= patch_sigmatel_stac9700_3d,
- 	.build_specific	= patch_sigmatel_stac9758_specific
- };
-@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_cirrus_ops = {
-+static const struct snd_ac97_build_ops patch_cirrus_ops = {
- 	.build_spdif = patch_cirrus_build_spdif
- };
- 
-@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_conexant_ops = {
-+static const struct snd_ac97_build_ops patch_conexant_ops = {
- 	.build_spdif = patch_conexant_build_spdif
- };
- 
-@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
- 	{ AC97_VIDEO, 0x9f1f },
- 	{ AC97_AUX, 0x9f1f },
- 	{ AC97_PCM, 0x9f1f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_ad1819(struct snd_ac97 * ac97)
-@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
- 	}
- }
- 
--static struct snd_ac97_build_ops patch_ad1881_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
- #endif
-@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1885_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
- 	.build_specific = &patch_ad1885_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ad1886_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
- 	.build_specific = &patch_ad1886_specific,
- #ifdef CONFIG_PM
- 	.resume = ad18xx_resume
-@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981a_specific,
- #ifdef CONFIG_PM
-@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
- 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
- }
- 
--static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1981b_specific,
- #ifdef CONFIG_PM
-@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1888_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1888_specific,
- #ifdef CONFIG_PM
-@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
- 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
- }
- 
--static struct snd_ac97_build_ops patch_ad1980_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1980_specific,
- #ifdef CONFIG_PM
-@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1985_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1985_specific,
- #ifdef CONFIG_PM
-@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
- 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
- }
- 
--static struct snd_ac97_build_ops patch_ad1986_build_ops = {
-+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
- 	.build_post_spdif = patch_ad198x_post_spdif,
- 	.build_specific = patch_ad1986_specific,
- #ifdef CONFIG_PM
-@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc650_ops = {
-+static const struct snd_ac97_build_ops patch_alc650_ops = {
- 	.build_specific	= patch_alc650_specific,
- 	.update_jacks = alc650_update_jacks
- };
-@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc655_ops = {
-+static const struct snd_ac97_build_ops patch_alc655_ops = {
- 	.build_specific	= patch_alc655_specific,
- 	.update_jacks = alc655_update_jacks
- };
-@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_alc850_ops = {
-+static const struct snd_ac97_build_ops patch_alc850_ops = {
- 	.build_specific	= patch_alc850_specific,
- 	.update_jacks = alc850_update_jacks
- };
-@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9738_ops = {
-+static const struct snd_ac97_build_ops patch_cm9738_ops = {
- 	.build_specific	= patch_cm9738_specific,
- 	.update_jacks = cm9738_update_jacks
- };
-@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
- 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
- }
- 
--static struct snd_ac97_build_ops patch_cm9739_ops = {
-+static const struct snd_ac97_build_ops patch_cm9739_ops = {
- 	.build_specific	= patch_cm9739_specific,
- 	.build_post_spdif = patch_cm9739_post_spdif,
- 	.update_jacks = cm9739_update_jacks
-@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
- 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9761_ops = {
-+static const struct snd_ac97_build_ops patch_cm9761_ops = {
- 	.build_specific	= patch_cm9761_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif,
- 	.update_jacks = cm9761_update_jacks
-@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
- 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
- }
- 
--static struct snd_ac97_build_ops patch_cm9780_ops = {
-+static const struct snd_ac97_build_ops patch_cm9780_ops = {
- 	.build_specific	= patch_cm9780_specific,
- 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
- };
-@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_vt1616_ops = {
-+static const struct snd_ac97_build_ops patch_vt1616_ops = {
- 	.build_specific	= patch_vt1616_specific
- };
- 
-@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_it2646_ops = {
-+static const struct snd_ac97_build_ops patch_it2646_ops = {
- 	.build_specific	= patch_it2646_specific,
- 	.update_jacks = it2646_update_jacks
- };
-@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_si3036_ops = {
-+static const struct snd_ac97_build_ops patch_si3036_ops = {
- 	.build_specific	= patch_si3036_specific,
- };
- 
-@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
- 	{ AC97_AUX, 0x1f1f },
- 	{ AC97_PCM, 0x1f1f },
- 	{ AC97_REC_GAIN, 0x0f0f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_lm4550(struct snd_ac97 *ac97)
-@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
- 	return 0;
- }
- 
--static struct snd_ac97_build_ops patch_ucb1400_ops = {
-+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
- 	.build_specific	= patch_ucb1400_specific,
- };
- 
-diff -urNp linux-2.6.32.13/sound/pci/ens1370.c linux-2.6.32.13/sound/pci/ens1370.c
---- linux-2.6.32.13/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/pci/ens1370.c	2010-05-15 13:21:18.938590352 -0400
-@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
- 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
- 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
-diff -urNp linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c
---- linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/pci/hda/patch_intelhdmi.c	2010-05-15 13:21:18.938590352 -0400
-@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
- 		cp_ready);
- 
- 	/* TODO */
--	if (cp_state)
--		;
--	if (cp_ready)
--		;
-+	if (cp_state) {
-+	}
-+	if (cp_ready) {
-+	}
- }
- 
- 
-diff -urNp linux-2.6.32.13/sound/pci/intel8x0.c linux-2.6.32.13/sound/pci/intel8x0.c
---- linux-2.6.32.13/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/pci/intel8x0.c	2010-05-15 13:21:18.938590352 -0400
-@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
-@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
- 		.type = AC97_TUNE_HP_ONLY
- 	},
- #endif
--	{ } /* terminator */
-+	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
- };
- 
- static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
-diff -urNp linux-2.6.32.13/sound/pci/intel8x0m.c linux-2.6.32.13/sound/pci/intel8x0m.c
---- linux-2.6.32.13/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/sound/pci/intel8x0m.c	2010-05-15 13:21:18.997275588 -0400
-@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
-@@ -1264,7 +1264,7 @@ static struct shortname_table {
- 	{ 0x5455, "ALi M5455" },
- 	{ 0x746d, "AMD AMD8111" },
- #endif
--	{ 0 },
-+	{ 0, NULL },
- };
- 
- static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.32.13/usr/gen_init_cpio.c linux-2.6.32.13/usr/gen_init_cpio.c
---- linux-2.6.32.13/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
-+++ linux-2.6.32.13/usr/gen_init_cpio.c	2010-05-15 13:21:18.997275588 -0400
-@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
- 	int retval;
- 	int rc = -1;
- 	int namesize;
--	int i;
-+	unsigned int i;
- 
- 	mode |= S_IFREG;
- 
-@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
-                        *env_var = *expanded = '\0';
-                        strncat(env_var, start + 2, end - start - 2);
-                        strncat(expanded, new_location, start - new_location);
--                       strncat(expanded, getenv(env_var), PATH_MAX);
--                       strncat(expanded, end + 1, PATH_MAX);
-+                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
-+                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
-                        strncpy(new_location, expanded, PATH_MAX);
-+                       new_location[PATH_MAX] = 0;
-                } else
-                        break;
-        }
-diff -urNp linux-2.6.32.13/virt/kvm/kvm_main.c linux-2.6.32.13/virt/kvm/kvm_main.c
---- linux-2.6.32.13/virt/kvm/kvm_main.c	2010-04-29 17:49:38.869035092 -0400
-+++ linux-2.6.32.13/virt/kvm/kvm_main.c	2010-05-15 13:21:19.058665704 -0400
-@@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vcpu_fops = {
- 	.release        = kvm_vcpu_release,
- 	.unlocked_ioctl = kvm_vcpu_ioctl,
-@@ -2344,6 +2345,7 @@ static int kvm_vm_mmap(struct file *file
- 	return 0;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_vm_fops = {
- 	.release        = kvm_vm_release,
- 	.unlocked_ioctl = kvm_vm_ioctl,
-@@ -2431,6 +2433,7 @@ out:
- 	return r;
- }
- 
-+/* cannot be const */
- static struct file_operations kvm_chardev_ops = {
- 	.unlocked_ioctl = kvm_dev_ioctl,
- 	.compat_ioctl   = kvm_dev_ioctl,
-@@ -2440,6 +2443,9 @@ static struct miscdevice kvm_dev = {
- 	KVM_MINOR,
- 	"kvm",
- 	&kvm_chardev_ops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static void hardware_enable(void *junk)
-@@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
- 	kvm_arch_vcpu_put(vcpu);
- }
- 
--int kvm_init(void *opaque, unsigned int vcpu_size,
-+int kvm_init(const void *opaque, unsigned int vcpu_size,
- 		  struct module *module)
- {
- 	int r;
diff --git a/main/linux-grsec/grsecurity-2.1.14-2.6.32.14-201005291720.patch b/main/linux-grsec/grsecurity-2.1.14-2.6.32.14-201005291720.patch
new file mode 100644
index 00000000..3e14e9ee
--- /dev/null
+++ b/main/linux-grsec/grsecurity-2.1.14-2.6.32.14-201005291720.patch
@@ -0,0 +1,56104 @@
+diff -urNp linux-2.6.32.14/arch/alpha/include/asm/elf.h linux-2.6.32.14/arch/alpha/include/asm/elf.h
+--- linux-2.6.32.14/arch/alpha/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/alpha/include/asm/elf.h	2010-05-28 21:27:14.402915497 -0400
+@@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ 
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
++#endif
++
+ /* $0 is set by ld.so to a pointer to a function which might be 
+    registered using atexit.  This provides a mean for the dynamic
+    linker to call DT_FINI functions for shared libraries that have
+diff -urNp linux-2.6.32.14/arch/alpha/include/asm/pgtable.h linux-2.6.32.14/arch/alpha/include/asm/pgtable.h
+--- linux-2.6.32.14/arch/alpha/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/alpha/include/asm/pgtable.h	2010-05-28 21:27:14.420270024 -0400
+@@ -101,6 +101,17 @@ struct vm_area_struct;
+ #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
+ #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
+ #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
+ 
+ #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
+diff -urNp linux-2.6.32.14/arch/alpha/kernel/module.c linux-2.6.32.14/arch/alpha/kernel/module.c
+--- linux-2.6.32.14/arch/alpha/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/alpha/kernel/module.c	2010-05-28 21:27:14.523207400 -0400
+@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
+ 
+ 	/* The small sections were sorted to the end of the segment.
+ 	   The following should definitely cover them.  */
+-	gp = (u64)me->module_core + me->core_size - 0x8000;
++	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
+ 	got = sechdrs[me->arch.gotsecindex].sh_addr;
+ 
+ 	for (i = 0; i < n; i++) {
+diff -urNp linux-2.6.32.14/arch/alpha/kernel/osf_sys.c linux-2.6.32.14/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.32.14/arch/alpha/kernel/osf_sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/alpha/kernel/osf_sys.c	2010-05-28 21:27:14.523207400 -0400
+@@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
+ 	   merely specific addresses, but regions of memory -- perhaps
+ 	   this feature should be incorporated into all ports?  */
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
+ 		if (addr != (unsigned long) -ENOMEM)
+@@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
+ 	}
+ 
+ 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
+-	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
+-					 len, limit);
++	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
++
+ 	if (addr != (unsigned long) -ENOMEM)
+ 		return addr;
+ 
+diff -urNp linux-2.6.32.14/arch/alpha/mm/fault.c linux-2.6.32.14/arch/alpha/mm/fault.c
+--- linux-2.6.32.14/arch/alpha/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/alpha/mm/fault.c	2010-05-28 21:27:14.523207400 -0400
+@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
+ 	__reload_thread(pcb);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int ldah, ldq, jmp;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
++		    jmp == 0x6BFB0000U)
++		{
++			unsigned long r27, addr;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
++
++			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			err = get_user(r27, (unsigned long *)addr);
++			if (err)
++				break;
++
++			regs->r27 = r27;
++			regs->pc = r27;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #2 */
++		unsigned int ldah, lda, br;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(lda, (unsigned int *)(regs->pc+4));
++		err |= get_user(br, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
++		    (br & 0xFFE00000U) == 0xC3E00000U)
++		{
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
++
++			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int br;
++
++		err = get_user(br, (unsigned int *)regs->pc);
++
++		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
++			unsigned int br2, ldq, nop, jmp;
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
++
++			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			err = get_user(br2, (unsigned int *)addr);
++			err |= get_user(ldq, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			err |= get_user(jmp, (unsigned int *)(addr+12));
++			err |= get_user(resolver, (unsigned long *)(addr+16));
++
++			if (err)
++				break;
++
++			if (br2 == 0xC3600000U &&
++			    ldq == 0xA77B000CU &&
++			    nop == 0x47FF041FU &&
++			    jmp == 0x6B7B0000U)
++			{
++				regs->r28 = regs->pc+4;
++				regs->r27 = addr+16;
++				regs->pc = resolver;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
+ 
+ /*
+  * This routine handles page faults.  It determines the address,
+@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
+  good_area:
+ 	si_code = SEGV_ACCERR;
+ 	if (cause < 0) {
+-		if (!(vma->vm_flags & VM_EXEC))
++		if (!(vma->vm_flags & VM_EXEC)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
++			do_group_exit(SIGKILL);
++#else
+ 			goto bad_area;
++#endif
++
++		}
+ 	} else if (!cause) {
+ 		/* Allow reads even for write-only mappings */
+ 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
+diff -urNp linux-2.6.32.14/arch/arm/include/asm/elf.h linux-2.6.32.14/arch/arm/include/asm/elf.h
+--- linux-2.6.32.14/arch/arm/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/include/asm/elf.h	2010-05-28 21:27:14.523207400 -0400
+@@ -109,7 +109,14 @@ int dump_task_regs(struct task_struct *t
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00008000UL
++
++#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
++#endif
+ 
+ /* When the program starts, a1 contains a pointer to a function to be 
+    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
+diff -urNp linux-2.6.32.14/arch/arm/include/asm/kmap_types.h linux-2.6.32.14/arch/arm/include/asm/kmap_types.h
+--- linux-2.6.32.14/arch/arm/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/include/asm/kmap_types.h	2010-05-28 21:27:14.523207400 -0400
+@@ -19,6 +19,7 @@ enum km_type {
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
+ 	KM_L2_CACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/arm/include/asm/uaccess.h linux-2.6.32.14/arch/arm/include/asm/uaccess.h
+--- linux-2.6.32.14/arch/arm/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/include/asm/uaccess.h	2010-05-28 21:27:14.539151073 -0400
+@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
+ 
+ static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else /* security hole - plug it */
+@@ -412,6 +415,9 @@ static inline unsigned long __must_check
+ 
+ static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+diff -urNp linux-2.6.32.14/arch/arm/kernel/kgdb.c linux-2.6.32.14/arch/arm/kernel/kgdb.c
+--- linux-2.6.32.14/arch/arm/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/kernel/kgdb.c	2010-05-28 21:27:14.539151073 -0400
+@@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
+  * and we handle the normal undef case within the do_undefinstr
+  * handler.
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ #ifndef __ARMEB__
+ 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
+ #else /* ! __ARMEB__ */
+diff -urNp linux-2.6.32.14/arch/arm/mach-at91/pm.c linux-2.6.32.14/arch/arm/mach-at91/pm.c
+--- linux-2.6.32.14/arch/arm/mach-at91/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-at91/pm.c	2010-05-28 21:27:14.600189804 -0400
+@@ -348,7 +348,7 @@ static void at91_pm_end(void)
+ }
+ 
+ 
+-static struct platform_suspend_ops at91_pm_ops ={
++static const struct platform_suspend_ops at91_pm_ops ={
+ 	.valid	= at91_pm_valid_state,
+ 	.begin	= at91_pm_begin,
+ 	.enter	= at91_pm_enter,
+diff -urNp linux-2.6.32.14/arch/arm/mach-omap1/pm.c linux-2.6.32.14/arch/arm/mach-omap1/pm.c
+--- linux-2.6.32.14/arch/arm/mach-omap1/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-omap1/pm.c	2010-05-28 21:27:14.600189804 -0400
+@@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq 
+ 
+ 
+ 
+-static struct platform_suspend_ops omap_pm_ops ={
++static const struct platform_suspend_ops omap_pm_ops ={
+ 	.prepare	= omap_pm_prepare,
+ 	.enter		= omap_pm_enter,
+ 	.finish		= omap_pm_finish,
+diff -urNp linux-2.6.32.14/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.14/arch/arm/mach-omap2/pm24xx.c
+--- linux-2.6.32.14/arch/arm/mach-omap2/pm24xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-omap2/pm24xx.c	2010-05-28 21:27:14.650418612 -0400
+@@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
+ 	enable_hlt();
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.prepare	= omap2_pm_prepare,
+ 	.enter		= omap2_pm_enter,
+ 	.finish		= omap2_pm_finish,
+diff -urNp linux-2.6.32.14/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.14/arch/arm/mach-omap2/pm34xx.c
+--- linux-2.6.32.14/arch/arm/mach-omap2/pm34xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-omap2/pm34xx.c	2010-05-28 21:27:14.651073283 -0400
+@@ -401,7 +401,7 @@ static void omap3_pm_end(void)
+ 	return;
+ }
+ 
+-static struct platform_suspend_ops omap_pm_ops = {
++static const struct platform_suspend_ops omap_pm_ops = {
+ 	.begin		= omap3_pm_begin,
+ 	.end		= omap3_pm_end,
+ 	.prepare	= omap3_pm_prepare,
+diff -urNp linux-2.6.32.14/arch/arm/mach-pnx4008/pm.c linux-2.6.32.14/arch/arm/mach-pnx4008/pm.c
+--- linux-2.6.32.14/arch/arm/mach-pnx4008/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-pnx4008/pm.c	2010-05-28 21:27:14.651073283 -0400
+@@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
+ 	       (state == PM_SUSPEND_MEM);
+ }
+ 
+-static struct platform_suspend_ops pnx4008_pm_ops = {
++static const struct platform_suspend_ops pnx4008_pm_ops = {
+ 	.enter = pnx4008_pm_enter,
+ 	.valid = pnx4008_pm_valid,
+ };
+diff -urNp linux-2.6.32.14/arch/arm/mach-pxa/pm.c linux-2.6.32.14/arch/arm/mach-pxa/pm.c
+--- linux-2.6.32.14/arch/arm/mach-pxa/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-pxa/pm.c	2010-05-28 21:27:14.651073283 -0400
+@@ -95,7 +95,7 @@ void pxa_pm_finish(void)
+ 		pxa_cpu_pm_fns->finish();
+ }
+ 
+-static struct platform_suspend_ops pxa_pm_ops = {
++static const struct platform_suspend_ops pxa_pm_ops = {
+ 	.valid		= pxa_pm_valid,
+ 	.enter		= pxa_pm_enter,
+ 	.prepare	= pxa_pm_prepare,
+diff -urNp linux-2.6.32.14/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.14/arch/arm/mach-pxa/sharpsl_pm.c
+--- linux-2.6.32.14/arch/arm/mach-pxa/sharpsl_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-pxa/sharpsl_pm.c	2010-05-28 21:27:14.674954367 -0400
+@@ -891,7 +891,7 @@ static void sharpsl_apm_get_power_status
+ }
+ 
+ #ifdef CONFIG_PM
+-static struct platform_suspend_ops sharpsl_pm_ops = {
++static const struct platform_suspend_ops sharpsl_pm_ops = {
+ 	.prepare	= pxa_pm_prepare,
+ 	.finish		= pxa_pm_finish,
+ 	.enter		= corgi_pxa_pm_enter,
+diff -urNp linux-2.6.32.14/arch/arm/mach-sa1100/pm.c linux-2.6.32.14/arch/arm/mach-sa1100/pm.c
+--- linux-2.6.32.14/arch/arm/mach-sa1100/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mach-sa1100/pm.c	2010-05-28 21:27:14.674954367 -0400
+@@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
+ 	return virt_to_phys(sp);
+ }
+ 
+-static struct platform_suspend_ops sa11x0_pm_ops = {
++static const struct platform_suspend_ops sa11x0_pm_ops = {
+ 	.enter		= sa11x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.14/arch/arm/mm/fault.c linux-2.6.32.14/arch/arm/mm/fault.c
+--- linux-2.6.32.14/arch/arm/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mm/fault.c	2010-05-28 21:27:14.683127211 -0400
+@@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
+ 	}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (fsr & FSR_LNX_PF) {
++		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	tsk->thread.address = addr;
+ 	tsk->thread.error_code = fsr;
+ 	tsk->thread.trap_no = 14;
+@@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
+ }
+ #endif					/* CONFIG_MMU */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-4: ");
++	for (i = -1; i < 20; i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08lx ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * First Level Translation Fault Handler
+  *
+diff -urNp linux-2.6.32.14/arch/arm/mm/mmap.c linux-2.6.32.14/arch/arm/mm/mmap.c
+--- linux-2.6.32.14/arch/arm/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/mm/mmap.c	2010-05-28 21:27:14.704140649 -0400
+@@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (len > TASK_SIZE)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -94,8 +98,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+diff -urNp linux-2.6.32.14/arch/arm/plat-s3c/pm.c linux-2.6.32.14/arch/arm/plat-s3c/pm.c
+--- linux-2.6.32.14/arch/arm/plat-s3c/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/arm/plat-s3c/pm.c	2010-05-28 21:27:14.704140649 -0400
+@@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
+ 	s3c_pm_check_cleanup();
+ }
+ 
+-static struct platform_suspend_ops s3c_pm_ops = {
++static const struct platform_suspend_ops s3c_pm_ops = {
+ 	.enter		= s3c_pm_enter,
+ 	.prepare	= s3c_pm_prepare,
+ 	.finish		= s3c_pm_finish,
+diff -urNp linux-2.6.32.14/arch/avr32/include/asm/elf.h linux-2.6.32.14/arch/avr32/include/asm/elf.h
+--- linux-2.6.32.14/arch/avr32/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/avr32/include/asm/elf.h	2010-05-28 21:27:14.704140649 -0400
+@@ -85,8 +85,14 @@ typedef struct user_fpu_struct elf_fpreg
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x00001000UL
++
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+diff -urNp linux-2.6.32.14/arch/avr32/include/asm/kmap_types.h linux-2.6.32.14/arch/avr32/include/asm/kmap_types.h
+--- linux-2.6.32.14/arch/avr32/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/avr32/include/asm/kmap_types.h	2010-05-28 21:27:14.706951400 -0400
+@@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
+ D(11)	KM_IRQ1,
+ D(12)	KM_SOFTIRQ0,
+ D(13)	KM_SOFTIRQ1,
+-D(14)	KM_TYPE_NR
++D(14)	KM_CLEARPAGE,
++D(15)	KM_TYPE_NR
+ };
+ 
+ #undef D
+diff -urNp linux-2.6.32.14/arch/avr32/mach-at32ap/pm.c linux-2.6.32.14/arch/avr32/mach-at32ap/pm.c
+--- linux-2.6.32.14/arch/avr32/mach-at32ap/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/avr32/mach-at32ap/pm.c	2010-05-28 21:27:14.706951400 -0400
+@@ -176,7 +176,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops avr32_pm_ops = {
++static const struct platform_suspend_ops avr32_pm_ops = {
+ 	.valid	= avr32_pm_valid_state,
+ 	.enter	= avr32_pm_enter,
+ };
+diff -urNp linux-2.6.32.14/arch/avr32/mm/fault.c linux-2.6.32.14/arch/avr32/mm/fault.c
+--- linux-2.6.32.14/arch/avr32/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/avr32/mm/fault.c	2010-05-28 21:27:14.706951400 -0400
+@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
+ 
+ int exception_trace = 1;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (unsigned char *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults. It determines the address and the
+  * problem, and then passes it off to one of the appropriate routines.
+@@ -157,6 +174,16 @@ bad_area:
+ 	up_read(&mm->mmap_sem);
+ 
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
++				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		if (exception_trace && printk_ratelimit())
+ 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
+ 			       "sp %08lx ecr %lu\n",
+diff -urNp linux-2.6.32.14/arch/blackfin/kernel/kgdb.c linux-2.6.32.14/arch/blackfin/kernel/kgdb.c
+--- linux-2.6.32.14/arch/blackfin/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/blackfin/kernel/kgdb.c	2010-05-28 21:27:14.706951400 -0400
+@@ -428,7 +428,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;		/* this means that we do not want to exit from the handler */
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0xa1},
+ #ifdef CONFIG_SMP
+ 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
+diff -urNp linux-2.6.32.14/arch/blackfin/mach-common/pm.c linux-2.6.32.14/arch/blackfin/mach-common/pm.c
+--- linux-2.6.32.14/arch/blackfin/mach-common/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/blackfin/mach-common/pm.c	2010-05-28 21:27:14.706951400 -0400
+@@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
+ 	return 0;
+ }
+ 
+-struct platform_suspend_ops bfin_pm_ops = {
++const struct platform_suspend_ops bfin_pm_ops = {
+ 	.enter = bfin_pm_enter,
+ 	.valid	= bfin_pm_valid,
+ };
+diff -urNp linux-2.6.32.14/arch/frv/include/asm/kmap_types.h linux-2.6.32.14/arch/frv/include/asm/kmap_types.h
+--- linux-2.6.32.14/arch/frv/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/frv/include/asm/kmap_types.h	2010-05-28 21:27:14.706951400 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.14/arch/ia64/hp/common/hwsw_iommu.c
+--- linux-2.6.32.14/arch/ia64/hp/common/hwsw_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/hp/common/hwsw_iommu.c	2010-05-28 21:27:14.706951400 -0400
+@@ -17,7 +17,7 @@
+ #include <linux/swiotlb.h>
+ #include <asm/machvec.h>
+ 
+-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
++extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
+ 
+ /* swiotlb declarations & definitions: */
+ extern int swiotlb_late_init_with_default_size (size_t size);
+@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
+ 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
+ }
+ 
+-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
++const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
+ {
+ 	if (use_swiotlb(dev))
+ 		return &swiotlb_dma_ops;
+diff -urNp linux-2.6.32.14/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.14/arch/ia64/hp/common/sba_iommu.c
+--- linux-2.6.32.14/arch/ia64/hp/common/sba_iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/hp/common/sba_iommu.c	2010-05-28 21:27:14.706951400 -0400
+@@ -2077,7 +2077,7 @@ static struct acpi_driver acpi_sba_ioc_d
+ 	},
+ };
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static int __init
+ sba_init(void)
+@@ -2191,7 +2191,7 @@ sba_page_override(char *str)
+ 
+ __setup("sbapagesize=",sba_page_override);
+ 
+-struct dma_map_ops sba_dma_ops = {
++const struct dma_map_ops sba_dma_ops = {
+ 	.alloc_coherent		= sba_alloc_coherent,
+ 	.free_coherent		= sba_free_coherent,
+ 	.map_page		= sba_map_page,
+diff -urNp linux-2.6.32.14/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.14/arch/ia64/ia32/binfmt_elf32.c
+--- linux-2.6.32.14/arch/ia64/ia32/binfmt_elf32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/ia32/binfmt_elf32.c	2010-05-28 21:27:14.706951400 -0400
+@@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
+ 
+ #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ /* Ugly but avoids duplication */
+ #include "../../../fs/binfmt_elf.c"
+ 
+diff -urNp linux-2.6.32.14/arch/ia64/ia32/ia32priv.h linux-2.6.32.14/arch/ia64/ia32/ia32priv.h
+--- linux-2.6.32.14/arch/ia64/ia32/ia32priv.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/ia32/ia32priv.h	2010-05-28 21:27:14.716122970 -0400
+@@ -296,7 +296,14 @@ typedef struct compat_siginfo {
+ #define ELF_DATA	ELFDATA2LSB
+ #define ELF_ARCH	EM_386
+ 
+-#define IA32_STACK_TOP		IA32_PAGE_OFFSET
++#ifdef CONFIG_PAX_RANDUSTACK
++#define __IA32_DELTA_STACK	(current->mm->delta_stack)
++#else
++#define __IA32_DELTA_STACK	0UL
++#endif
++
++#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
++
+ #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
+ #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
+ 
+diff -urNp linux-2.6.32.14/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.14/arch/ia64/include/asm/dma-mapping.h
+--- linux-2.6.32.14/arch/ia64/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/include/asm/dma-mapping.h	2010-05-28 21:27:14.716122970 -0400
+@@ -12,7 +12,7 @@
+ 
+ #define ARCH_HAS_DMA_GET_REQUIRED_MASK
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ extern struct ia64_machine_vector ia64_mv;
+ extern void set_iommu_machvec(void);
+ 
+@@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *daddr, gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	void *caddr;
+ 
+ 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
+@@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *caddr, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	debug_dma_free_coherent(dev, size, caddr, daddr);
+ 	ops->free_coherent(dev, size, caddr, daddr);
+ }
+@@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->mapping_error(dev, daddr);
+ }
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
++	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
+ 	return ops->dma_supported(dev, mask);
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/ia64/include/asm/elf.h linux-2.6.32.14/arch/ia64/include/asm/elf.h
+--- linux-2.6.32.14/arch/ia64/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/include/asm/elf.h	2010-05-28 21:27:14.716122970 -0400
+@@ -43,6 +43,13 @@
+  */
+ #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
++#endif
++
+ #define PT_IA_64_UNWIND		0x70000001
+ 
+ /* IA-64 relocations: */
+diff -urNp linux-2.6.32.14/arch/ia64/include/asm/machvec.h linux-2.6.32.14/arch/ia64/include/asm/machvec.h
+--- linux-2.6.32.14/arch/ia64/include/asm/machvec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/include/asm/machvec.h	2010-05-28 21:27:14.716122970 -0400
+@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
+ /* DMA-mapping interface: */
+ typedef void ia64_mv_dma_init (void);
+ typedef u64 ia64_mv_dma_get_required_mask (struct device *);
+-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
++typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
+ 
+ /*
+  * WARNING: The legacy I/O space is _architected_.  Platforms are
+@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
+ # endif /* CONFIG_IA64_GENERIC */
+ 
+ extern void swiotlb_dma_init(void);
+-extern struct dma_map_ops *dma_get_ops(struct device *);
++extern const struct dma_map_ops *dma_get_ops(struct device *);
+ 
+ /*
+  * Define default versions so we can extend machvec for new platforms without having
+diff -urNp linux-2.6.32.14/arch/ia64/include/asm/pgtable.h linux-2.6.32.14/arch/ia64/include/asm/pgtable.h
+--- linux-2.6.32.14/arch/ia64/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/include/asm/pgtable.h	2010-05-28 21:27:14.716122970 -0400
+@@ -143,6 +143,17 @@
+ #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+ #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
++# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++#endif
++
+ #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
+ #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
+ #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
+diff -urNp linux-2.6.32.14/arch/ia64/include/asm/uaccess.h linux-2.6.32.14/arch/ia64/include/asm/uaccess.h
+--- linux-2.6.32.14/arch/ia64/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/include/asm/uaccess.h	2010-05-28 21:27:14.728159079 -0400
+@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
+ 	const void *__cu_from = (from);							\
+ 	long __cu_len = (n);								\
+ 											\
+-	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
++	if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
+ 	long __cu_len = (n);								\
+ 											\
+ 	__chk_user_ptr(__cu_from);							\
+-	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
++	if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))			\
+ 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
+ 	__cu_len;									\
+ })
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/dma-mapping.c linux-2.6.32.14/arch/ia64/kernel/dma-mapping.c
+--- linux-2.6.32.14/arch/ia64/kernel/dma-mapping.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/dma-mapping.c	2010-05-28 21:27:14.731127928 -0400
+@@ -3,7 +3,7 @@
+ /* Set this to 1 if there is a HW IOMMU in the system */
+ int iommu_detected __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
+@@ -16,7 +16,7 @@ static int __init dma_init(void)
+ }
+ fs_initcall(dma_init);
+ 
+-struct dma_map_ops *dma_get_ops(struct device *dev)
++const struct dma_map_ops *dma_get_ops(struct device *dev)
+ {
+ 	return dma_ops;
+ }
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/module.c linux-2.6.32.14/arch/ia64/kernel/module.c
+--- linux-2.6.32.14/arch/ia64/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/module.c	2010-05-28 21:27:14.734962469 -0400
+@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
+ void
+ module_free (struct module *mod, void *module_region)
+ {
+-	if (mod && mod->arch.init_unw_table &&
+-	    module_region == mod->module_init) {
++	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
+ 		unw_remove_unwind_table(mod->arch.init_unw_table);
+ 		mod->arch.init_unw_table = NULL;
+ 	}
+@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
+ }
+ 
+ static inline int
++in_init_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
++}
++
++static inline int
++in_init_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
++}
++
++static inline int
+ in_init (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_init < mod->init_size;
++	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
++}
++
++static inline int
++in_core_rx (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
++}
++
++static inline int
++in_core_rw (const struct module *mod, uint64_t addr)
++{
++	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
+ }
+ 
+ static inline int
+ in_core (const struct module *mod, uint64_t addr)
+ {
+-	return addr - (uint64_t) mod->module_core < mod->core_size;
++	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
+ }
+ 
+ static inline int
+@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
+ 		break;
+ 
+ 	      case RV_BDREL:
+-		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
++		if (in_init_rx(mod, val))
++			val -= (uint64_t) mod->module_init_rx;
++		else if (in_init_rw(mod, val))
++			val -= (uint64_t) mod->module_init_rw;
++		else if (in_core_rx(mod, val))
++			val -= (uint64_t) mod->module_core_rx;
++		else if (in_core_rw(mod, val))
++			val -= (uint64_t) mod->module_core_rw;
+ 		break;
+ 
+ 	      case RV_LTV:
+@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
+ 		 *     addresses have been selected...
+ 		 */
+ 		uint64_t gp;
+-		if (mod->core_size > MAX_LTOFF)
++		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
+ 			/*
+ 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
+ 			 * at the end of the module.
+ 			 */
+-			gp = mod->core_size - MAX_LTOFF / 2;
++			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
+ 		else
+-			gp = mod->core_size / 2;
+-		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
++			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
++		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
+ 		mod->arch.gp = gp;
+ 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
+ 	}
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/pci-dma.c linux-2.6.32.14/arch/ia64/kernel/pci-dma.c
+--- linux-2.6.32.14/arch/ia64/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/pci-dma.c	2010-05-28 21:27:14.734962469 -0400
+@@ -43,7 +43,7 @@ struct device fallback_dev = {
+ 	.dma_mask = &fallback_dev.coherent_dma_mask,
+ };
+ 
+-extern struct dma_map_ops intel_dma_ops;
++extern const struct dma_map_ops intel_dma_ops;
+ 
+ static int __init pci_iommu_init(void)
+ {
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.14/arch/ia64/kernel/pci-swiotlb.c
+--- linux-2.6.32.14/arch/ia64/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/pci-swiotlb.c	2010-05-28 21:27:14.734962469 -0400
+@@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
+ 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
+ }
+ 
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+ 	.map_page = swiotlb_map_page,
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/sys_ia64.c linux-2.6.32.14/arch/ia64/kernel/sys_ia64.c
+--- linux-2.6.32.14/arch/ia64/kernel/sys_ia64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/sys_ia64.c	2010-05-28 21:27:14.734962469 -0400
+@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
+ 	if (REGION_NUMBER(addr) == RGN_HPAGE)
+ 		addr = 0;
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		addr = mm->free_area_cache;
++	else
++#endif
++
+ 	if (!addr)
+ 		addr = mm->free_area_cache;
+ 
+@@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+ 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
++			if (start_addr != mm->mmap_base) {
+ 				/* Start a new search --- just in case we missed some holes.  */
+-				addr = TASK_UNMAPPED_BASE;
++				addr = mm->mmap_base;
+ 				goto full_search;
+ 			}
+ 			return -ENOMEM;
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/topology.c linux-2.6.32.14/arch/ia64/kernel/topology.c
+--- linux-2.6.32.14/arch/ia64/kernel/topology.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/topology.c	2010-05-28 21:27:14.743147071 -0400
+@@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cache_sysfs_ops = {
++static const struct sysfs_ops cache_sysfs_ops = {
+ 	.show   = cache_show
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.14/arch/ia64/kernel/vmlinux.lds.S
+--- linux-2.6.32.14/arch/ia64/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/kernel/vmlinux.lds.S	2010-05-28 21:27:14.743147071 -0400
+@@ -190,7 +190,7 @@ SECTIONS
+   /* Per-cpu data: */
+   . = ALIGN(PERCPU_PAGE_SIZE);
+   PERCPU_VADDR(PERCPU_ADDR, :percpu)
+-  __phys_per_cpu_start = __per_cpu_load;
++  __phys_per_cpu_start = per_cpu_load;
+   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
+   						 * into percpu page size
+ 						 */
+diff -urNp linux-2.6.32.14/arch/ia64/mm/fault.c linux-2.6.32.14/arch/ia64/mm/fault.c
+--- linux-2.6.32.14/arch/ia64/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/mm/fault.c	2010-05-28 21:27:14.743147071 -0400
+@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
+ 	return pte_present(pte);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ void __kprobes
+ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
+ {
+@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
+ 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
+ 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
+ 
+-	if ((vma->vm_flags & mask) != mask)
++	if ((vma->vm_flags & mask) != mask) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
+ 
++	}
++
+   survive:
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.14/arch/ia64/mm/init.c linux-2.6.32.14/arch/ia64/mm/init.c
+--- linux-2.6.32.14/arch/ia64/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/mm/init.c	2010-05-28 21:27:14.755165915 -0400
+@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
+ 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
+ 		vma->vm_end = vma->vm_start + PAGE_SIZE;
+ 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
++			vma->vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++			if (current->mm->pax_flags & MF_PAX_MPROTECT)
++				vma->vm_flags &= ~VM_MAYEXEC;
++#endif
++
++		}
++#endif
++
+ 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 		down_write(&current->mm->mmap_sem);
+ 		if (insert_vm_struct(current->mm, vma)) {
+diff -urNp linux-2.6.32.14/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.14/arch/ia64/sn/pci/pci_dma.c
+--- linux-2.6.32.14/arch/ia64/sn/pci/pci_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/ia64/sn/pci/pci_dma.c	2010-05-28 21:27:14.755165915 -0400
+@@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
+ 	return ret;
+ }
+ 
+-static struct dma_map_ops sn_dma_ops = {
++static const struct dma_map_ops sn_dma_ops = {
+ 	.alloc_coherent		= sn_dma_alloc_coherent,
+ 	.free_coherent		= sn_dma_free_coherent,
+ 	.map_page		= sn_dma_map_page,
+diff -urNp linux-2.6.32.14/arch/m32r/lib/usercopy.c linux-2.6.32.14/arch/m32r/lib/usercopy.c
+--- linux-2.6.32.14/arch/m32r/lib/usercopy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/m32r/lib/usercopy.c	2010-05-28 21:27:14.755165915 -0400
+@@ -14,6 +14,9 @@
+ unsigned long
+ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetch(from);
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		__copy_user(to,from,n);
+@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, 
+ unsigned long
+ __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	prefetchw(to);
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		__copy_user_zeroing(to,from,n);
+diff -urNp linux-2.6.32.14/arch/mips/alchemy/devboards/pm.c linux-2.6.32.14/arch/mips/alchemy/devboards/pm.c
+--- linux-2.6.32.14/arch/mips/alchemy/devboards/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/alchemy/devboards/pm.c	2010-05-28 21:27:14.755165915 -0400
+@@ -78,7 +78,7 @@ static void db1x_pm_end(void)
+ 
+ }
+ 
+-static struct platform_suspend_ops db1x_pm_ops = {
++static const struct platform_suspend_ops db1x_pm_ops = {
+ 	.valid		= suspend_valid_only_mem,
+ 	.begin		= db1x_pm_begin,
+ 	.enter		= db1x_pm_enter,
+diff -urNp linux-2.6.32.14/arch/mips/include/asm/elf.h linux-2.6.32.14/arch/mips/include/asm/elf.h
+--- linux-2.6.32.14/arch/mips/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/include/asm/elf.h	2010-05-28 21:27:14.755165915 -0400
+@@ -368,4 +368,11 @@ extern int dump_task_fpu(struct task_str
+ #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
+ #endif
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #endif /* _ASM_ELF_H */
+diff -urNp linux-2.6.32.14/arch/mips/include/asm/page.h linux-2.6.32.14/arch/mips/include/asm/page.h
+--- linux-2.6.32.14/arch/mips/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/include/asm/page.h	2010-05-28 21:27:14.755165915 -0400
+@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
+   #ifdef CONFIG_CPU_MIPS32
+     typedef struct { unsigned long pte_low, pte_high; } pte_t;
+     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
+-    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
++    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
+   #else
+      typedef struct { unsigned long long pte; } pte_t;
+      #define pte_val(x)	((x).pte)
+diff -urNp linux-2.6.32.14/arch/mips/include/asm/system.h linux-2.6.32.14/arch/mips/include/asm/system.h
+--- linux-2.6.32.14/arch/mips/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/include/asm/system.h	2010-05-28 21:27:14.755165915 -0400
+@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
+  */
+ #define __ARCH_WANT_UNLOCKED_CTXSW
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ALMASK)
+ 
+ #endif /* _ASM_SYSTEM_H */
+diff -urNp linux-2.6.32.14/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.14/arch/mips/kernel/binfmt_elfn32.c
+--- linux-2.6.32.14/arch/mips/kernel/binfmt_elfn32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/kernel/binfmt_elfn32.c	2010-05-28 21:27:14.755165915 -0400
+@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ #include <linux/module.h>
+ #include <linux/elfcore.h>
+diff -urNp linux-2.6.32.14/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.14/arch/mips/kernel/binfmt_elfo32.c
+--- linux-2.6.32.14/arch/mips/kernel/binfmt_elfo32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/kernel/binfmt_elfo32.c	2010-05-28 21:27:14.755165915 -0400
+@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
+ #undef ELF_ET_DYN_BASE
+ #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#endif
++
+ #include <asm/processor.h>
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/mips/kernel/kgdb.c linux-2.6.32.14/arch/mips/kernel/kgdb.c
+--- linux-2.6.32.14/arch/mips/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/kernel/kgdb.c	2010-05-28 21:27:14.771146775 -0400
+@@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
+ 	return -1;
+ }
+ 
++/* cannot be const */
+ struct kgdb_arch arch_kgdb_ops;
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/mips/kernel/process.c linux-2.6.32.14/arch/mips/kernel/process.c
+--- linux-2.6.32.14/arch/mips/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/kernel/process.c	2010-05-28 21:27:14.796819534 -0400
+@@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
+ out:
+ 	return pc;
+ }
+-
+-/*
+- * Don't forget that the stack pointer must be aligned on a 8 bytes
+- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
+- */
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() & ~PAGE_MASK;
+-
+-	return sp & ALMASK;
+-}
+diff -urNp linux-2.6.32.14/arch/mips/kernel/syscall.c linux-2.6.32.14/arch/mips/kernel/syscall.c
+--- linux-2.6.32.14/arch/mips/kernel/syscall.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/kernel/syscall.c	2010-05-28 21:27:14.796819534 -0400
+@@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
+ 	do_color_align = 0;
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
+ 		    (!vmm || addr + len <= vmm->vm_start))
+ 			return addr;
+ 	}
+-	addr = TASK_UNMAPPED_BASE;
++	addr = current->mm->mmap_base;
+ 	if (do_color_align)
+ 		addr = COLOUR_ALIGN(addr, pgoff);
+ 	else
+diff -urNp linux-2.6.32.14/arch/mips/mm/fault.c linux-2.6.32.14/arch/mips/mm/fault.c
+--- linux-2.6.32.14/arch/mips/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/mips/mm/fault.c	2010-05-28 21:27:14.796819534 -0400
+@@ -26,6 +26,23 @@
+ #include <asm/ptrace.h>
+ #include <asm/highmem.h>		/* For VMALLOC_END */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults.  It determines the address,
+  * and the problem, and then passes it off to one of the appropriate
+diff -urNp linux-2.6.32.14/arch/parisc/include/asm/elf.h linux-2.6.32.14/arch/parisc/include/asm/elf.h
+--- linux-2.6.32.14/arch/parisc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/include/asm/elf.h	2010-05-28 21:27:14.796819534 -0400
+@@ -343,6 +343,13 @@ struct pt_regs;	/* forward declaration..
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+    but it's not easy, and we've already done it here.  */
+diff -urNp linux-2.6.32.14/arch/parisc/include/asm/pgtable.h linux-2.6.32.14/arch/parisc/include/asm/pgtable.h
+--- linux-2.6.32.14/arch/parisc/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/include/asm/pgtable.h	2010-05-28 21:27:14.796819534 -0400
+@@ -207,6 +207,17 @@
+ #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
+ #define PAGE_COPY       PAGE_EXECREAD
+ #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
++# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
+ #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
+ #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
+diff -urNp linux-2.6.32.14/arch/parisc/kernel/module.c linux-2.6.32.14/arch/parisc/kernel/module.c
+--- linux-2.6.32.14/arch/parisc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/kernel/module.c	2010-05-28 21:27:14.796819534 -0400
+@@ -95,16 +95,38 @@
+ 
+ /* three functions to determine where in the module core
+  * or init pieces the location is */
++static inline int in_init_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rx &&
++		loc < (me->module_init_rx + me->init_size_rx));
++}
++
++static inline int in_init_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_init_rw &&
++		loc < (me->module_init_rw + me->init_size_rw));
++}
++
+ static inline int in_init(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_init &&
+-		loc <= (me->module_init + me->init_size));
++	return in_init_rx(me, loc) || in_init_rw(me, loc);
++}
++
++static inline int in_core_rx(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rx &&
++		loc < (me->module_core_rx + me->core_size_rx));
++}
++
++static inline int in_core_rw(struct module *me, void *loc)
++{
++	return (loc >= me->module_core_rw &&
++		loc < (me->module_core_rw + me->core_size_rw));
+ }
+ 
+ static inline int in_core(struct module *me, void *loc)
+ {
+-	return (loc >= me->module_core &&
+-		loc <= (me->module_core + me->core_size));
++	return in_core_rx(me, loc) || in_core_rw(me, loc);
+ }
+ 
+ static inline int in_local(struct module *me, void *loc)
+@@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
+ 	}
+ 
+ 	/* align things a bit */
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += gots * sizeof(struct got_entry);
+-
+-	me->core_size = ALIGN(me->core_size, 16);
+-	me->arch.fdesc_offset = me->core_size;
+-	me->core_size += fdescs * sizeof(Elf_Fdesc);
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += gots * sizeof(struct got_entry);
++
++	me->core_size_rw = ALIGN(me->core_size_rw, 16);
++	me->arch.fdesc_offset = me->core_size_rw;
++	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
+ 
+ 	me->arch.got_max = gots;
+ 	me->arch.fdesc_max = fdescs;
+@@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module 
+ 
+ 	BUG_ON(value == 0);
+ 
+-	got = me->module_core + me->arch.got_offset;
++	got = me->module_core_rw + me->arch.got_offset;
+ 	for (i = 0; got[i].addr; i++)
+ 		if (got[i].addr == value)
+ 			goto out;
+@@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module 
+ #ifdef CONFIG_64BIT
+ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
+ {
+-	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
++	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
+ 
+ 	if (!value) {
+ 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
+@@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module 
+ 
+ 	/* Create new one */
+ 	fdesc->addr = value;
+-	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 	return (Elf_Addr)fdesc;
+ }
+ #endif /* CONFIG_64BIT */
+@@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
+ 
+ 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
+ 	end = table + sechdrs[me->arch.unwind_section].sh_size;
+-	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
++	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
+ 
+ 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
+ 	       me->arch.unwind_section, table, end, gp);
+diff -urNp linux-2.6.32.14/arch/parisc/kernel/sys_parisc.c linux-2.6.32.14/arch/parisc/kernel/sys_parisc.c
+--- linux-2.6.32.14/arch/parisc/kernel/sys_parisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/kernel/sys_parisc.c	2010-05-28 21:27:14.796819534 -0400
+@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (filp) {
+ 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
+diff -urNp linux-2.6.32.14/arch/parisc/kernel/traps.c linux-2.6.32.14/arch/parisc/kernel/traps.c
+--- linux-2.6.32.14/arch/parisc/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/kernel/traps.c	2010-05-28 21:27:14.796819534 -0400
+@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
+ 
+ 			down_read(&current->mm->mmap_sem);
+ 			vma = find_vma(current->mm,regs->iaoq[0]);
+-			if (vma && (regs->iaoq[0] >= vma->vm_start)
+-				&& (vma->vm_flags & VM_EXEC)) {
+-
++			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
+ 				fault_address = regs->iaoq[0];
+ 				fault_space = regs->iasq[0];
+ 
+diff -urNp linux-2.6.32.14/arch/parisc/mm/fault.c linux-2.6.32.14/arch/parisc/mm/fault.c
+--- linux-2.6.32.14/arch/parisc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/parisc/mm/fault.c	2010-05-28 21:27:14.796819534 -0400
+@@ -15,6 +15,7 @@
+ #include <linux/sched.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
+ static unsigned long
+ parisc_acctyp(unsigned long code, unsigned int inst)
+ {
+-	if (code == 6 || code == 16)
++	if (code == 6 || code == 7 || code == 16)
+ 	    return VM_EXEC;
+ 
+ 	switch (inst & 0xf0000000) {
+@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
+ 			}
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when rt_sigreturn trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int bl, depwi;
++
++		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
++
++		if (err)
++			break;
++
++		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
++			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
++
++			err = get_user(ldw, (unsigned int *)addr);
++			err |= get_user(bv, (unsigned int *)(addr+4));
++			err |= get_user(ldw2, (unsigned int *)(addr+8));
++
++			if (err)
++				break;
++
++			if (ldw == 0x0E801096U &&
++			    bv == 0xEAC0C000U &&
++			    ldw2 == 0x0E881095U)
++			{
++				unsigned int resolver, map;
++
++				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
++				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
++				if (err)
++					break;
++
++				regs->gr[20] = instruction_pointer(regs)+8;
++				regs->gr[21] = map;
++				regs->gr[22] = resolver;
++				regs->iaoq[0] = resolver | 3UL;
++				regs->iaoq[1] = regs->iaoq[0] + 4;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++
++#ifndef CONFIG_PAX_EMUSIGRT
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++#endif
++
++	do { /* PaX: rt_sigreturn emulation */
++		unsigned int ldi1, ldi2, bel, nop;
++
++		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
++		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
++		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
++		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
++
++		if (err)
++			break;
++
++		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
++		    ldi2 == 0x3414015AU &&
++		    bel == 0xE4008200U &&
++		    nop == 0x08000240U)
++		{
++			regs->gr[25] = (ldi1 & 2) >> 1;
++			regs->gr[20] = __NR_rt_sigreturn;
++			regs->gr[31] = regs->iaoq[1] + 16;
++			regs->sr[0] = regs->iasq[1];
++			regs->iaoq[0] = 0x100UL;
++			regs->iaoq[1] = regs->iaoq[0] + 4;
++			regs->iasq[0] = regs->sr[2];
++			regs->iasq[1] = regs->sr[2];
++			return 2;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fix;
+@@ -192,8 +303,33 @@ good_area:
+ 
+ 	acc_type = parisc_acctyp(code,regs->iir);
+ 
+-	if ((vma->vm_flags & acc_type) != acc_type)
++	if ((vma->vm_flags & acc_type) != acc_type) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
++		    (address & ~3UL) == instruction_pointer(regs))
++		{
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 3:
++				return;
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			case 2:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		goto bad_area;
++	}
+ 
+ 	/*
+ 	 * If for any reason at all we couldn't handle the fault, make
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/device.h linux-2.6.32.14/arch/powerpc/include/asm/device.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/device.h	2010-05-28 21:27:14.796819534 -0400
+@@ -14,7 +14,7 @@ struct dev_archdata {
+ 	struct device_node	*of_node;
+ 
+ 	/* DMA operations on that device */
+-	struct dma_map_ops	*dma_ops;
++	const struct dma_map_ops	*dma_ops;
+ 
+ 	/*
+ 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.14/arch/powerpc/include/asm/dma-mapping.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/dma-mapping.h	2010-05-28 21:27:14.796819534 -0400
+@@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
+ #ifdef CONFIG_PPC64
+ extern struct dma_map_ops dma_iommu_ops;
+ #endif
+-extern struct dma_map_ops dma_direct_ops;
++extern const struct dma_map_ops dma_direct_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ 	/* We don't handle the NULL dev case for ISA for now. We could
+ 	 * do it via an out of line call but it is not needed for now. The
+@@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
+ 	return dev->archdata.dma_ops;
+ }
+ 
+-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
++static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
+ {
+ 	dev->archdata.dma_ops = ops;
+ }
+@@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
+ 
+ static inline int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return 0;
+@@ -132,7 +132,7 @@ static inline int dma_supported(struct d
+ 
+ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (unlikely(dma_ops == NULL))
+ 		return -EIO;
+@@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	BUG_ON(!dma_ops);
+@@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!dma_ops);
+ 
+@@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
+ 
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
++	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
+ 
+ 	if (dma_ops->mapping_error)
+ 		return dma_ops->mapping_error(dev, dma_addr);
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/elf.h linux-2.6.32.14/arch/powerpc/include/asm/elf.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/elf.h	2010-05-28 21:27:14.799129463 -0400
+@@ -179,8 +179,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-extern unsigned long randomize_et_dyn(unsigned long base);
+-#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
++#define ELF_ET_DYN_BASE		(0x20000000)
++
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
++
++#ifdef __powerpc64__
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
++#else
++#define PAX_DELTA_MMAP_LEN	15
++#define PAX_DELTA_STACK_LEN	15
++#endif
++#endif
+ 
+ /*
+  * Our registers are always unsigned longs, whether we're a 32 bit
+@@ -275,9 +286,6 @@ extern int arch_setup_additional_pages(s
+ 	(0x7ff >> (PAGE_SHIFT - 12)) : \
+ 	(0x3ffff >> (PAGE_SHIFT - 12)))
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* __KERNEL__ */
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/iommu.h linux-2.6.32.14/arch/powerpc/include/asm/iommu.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/iommu.h	2010-05-28 21:27:14.799129463 -0400
+@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
+ extern void iommu_init_early_dart(void);
+ extern void iommu_init_early_pasemi(void);
+ 
++/* dma-iommu.c */
++extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
++
+ #ifdef CONFIG_PCI
+ extern void pci_iommu_init(void);
+ extern void pci_direct_iommu_init(void);
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.14/arch/powerpc/include/asm/kmap_types.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/kmap_types.h	2010-05-28 21:27:14.799129463 -0400
+@@ -26,6 +26,7 @@ enum km_type {
+ 	KM_SOFTIRQ1,
+ 	KM_PPC_SYNC_PAGE,
+ 	KM_PPC_SYNC_ICACHE,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/page_64.h linux-2.6.32.14/arch/powerpc/include/asm/page_64.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/page_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/page_64.h	2010-05-28 21:27:14.799129463 -0400
+@@ -180,15 +180,18 @@ do {						\
+  * stack by default, so in the absense of a PT_GNU_STACK program header
+  * we turn execute permission off.
+  */
+-#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_STACK_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
++#ifndef CONFIG_PAX_PAGEEXEC
+ #define VM_STACK_DEFAULT_FLAGS \
+ 	(test_thread_flag(TIF_32BIT) ? \
+ 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
++#endif
+ 
+ #include <asm-generic/getorder.h>
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/page.h linux-2.6.32.14/arch/powerpc/include/asm/page.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/page.h	2010-05-28 21:27:14.799129463 -0400
+@@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
+  * and needs to be executable.  This means the whole heap ends
+  * up being executable.
+  */
+-#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
+-				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
++#define VM_DATA_DEFAULT_FLAGS32 \
++	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
++	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+ 
+ #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
+ 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+@@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
+ #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
+ #endif
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ #undef STRICT_MM_TYPECHECKS
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/pci.h linux-2.6.32.14/arch/powerpc/include/asm/pci.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/pci.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/pci.h	2010-05-28 21:27:14.803145185 -0400
+@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
+ }
+ 
+ #ifdef CONFIG_PCI
+-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
+-extern struct dma_map_ops *get_pci_dma_ops(void);
++extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
++extern const struct dma_map_ops *get_pci_dma_ops(void);
+ #else	/* CONFIG_PCI */
+ #define set_pci_dma_ops(d)
+ #define get_pci_dma_ops()	NULL
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.14/arch/powerpc/include/asm/pte-hash32.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/pte-hash32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/pte-hash32.h	2010-05-28 21:27:14.803145185 -0400
+@@ -21,6 +21,7 @@
+ #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
+ #define _PAGE_USER	0x004	/* usermode access allowed */
+ #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
++#define _PAGE_EXEC	_PAGE_GUARDED
+ #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
+ #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
+ #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/reg.h linux-2.6.32.14/arch/powerpc/include/asm/reg.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/reg.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/reg.h	2010-05-28 21:27:14.803145185 -0400
+@@ -191,6 +191,7 @@
+ #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
+ #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
+ #define   DSISR_NOHPTE		0x40000000	/* no translation found */
++#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
+ #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
+ #define   DSISR_ISSTORE		0x02000000	/* access was a store */
+ #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.14/arch/powerpc/include/asm/swiotlb.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/swiotlb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/swiotlb.h	2010-05-28 21:27:14.803145185 -0400
+@@ -13,7 +13,7 @@
+ 
+ #include <linux/swiotlb.h>
+ 
+-extern struct dma_map_ops swiotlb_dma_ops;
++extern const struct dma_map_ops swiotlb_dma_ops;
+ 
+ static inline void dma_mark_clean(void *addr, size_t size) {}
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/include/asm/uaccess.h linux-2.6.32.14/arch/powerpc/include/asm/uaccess.h
+--- linux-2.6.32.14/arch/powerpc/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/include/asm/uaccess.h	2010-05-28 21:27:14.803145185 -0400
+@@ -327,52 +327,6 @@ do {								\
+ extern unsigned long __copy_tofrom_user(void __user *to,
+ 		const void __user *from, unsigned long size);
+ 
+-#ifndef __powerpc64__
+-
+-static inline unsigned long copy_from_user(void *to,
+-		const void __user *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_READ, from, n))
+-		return __copy_tofrom_user((__force void __user *)to, from, n);
+-	if ((unsigned long)from < TASK_SIZE) {
+-		over = (unsigned long)from + n - TASK_SIZE;
+-		return __copy_tofrom_user((__force void __user *)to, from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-static inline unsigned long copy_to_user(void __user *to,
+-		const void *from, unsigned long n)
+-{
+-	unsigned long over;
+-
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		return __copy_tofrom_user(to, (__force void __user *)from, n);
+-	if ((unsigned long)to < TASK_SIZE) {
+-		over = (unsigned long)to + n - TASK_SIZE;
+-		return __copy_tofrom_user(to, (__force void __user *)from,
+-				n - over) + over;
+-	}
+-	return n;
+-}
+-
+-#else /* __powerpc64__ */
+-
+-#define __copy_in_user(to, from, size) \
+-	__copy_tofrom_user((to), (from), (size))
+-
+-extern unsigned long copy_from_user(void *to, const void __user *from,
+-				    unsigned long n);
+-extern unsigned long copy_to_user(void __user *to, const void *from,
+-				  unsigned long n);
+-extern unsigned long copy_in_user(void __user *to, const void __user *from,
+-				  unsigned long n);
+-
+-#endif /* __powerpc64__ */
+-
+ static inline unsigned long __copy_from_user_inatomic(void *to,
+ 		const void __user *from, unsigned long n)
+ {
+@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
+ 	return __copy_tofrom_user((__force void __user *)to, from, n);
+ }
+ 
+@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
+ 		if (ret == 0)
+ 			return 0;
+ 	}
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
+ }
+ 
+@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
+ 	return __copy_to_user_inatomic(to, from, size);
+ }
+ 
++#ifndef __powerpc64__
++
++static inline unsigned long __must_check copy_from_user(void *to,
++		const void __user *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_READ, from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		return __copy_tofrom_user((__force void __user *)to, from, n);
++	}
++	if ((unsigned long)from < TASK_SIZE) {
++		over = (unsigned long)from + n - TASK_SIZE;
++		if (!__builtin_constant_p(n - over))
++			check_object_size(to, n - over, false);
++		return __copy_tofrom_user((__force void __user *)to, from,
++				n - over) + over;
++	}
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to,
++		const void *from, unsigned long n)
++{
++	unsigned long over;
++
++	if ((long)n < 0)
++		return n;
++
++	if (access_ok(VERIFY_WRITE, to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		return __copy_tofrom_user(to, (__force void __user *)from, n);
++	}
++	if ((unsigned long)to < TASK_SIZE) {
++		over = (unsigned long)to + n - TASK_SIZE;
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n - over, true);
++		return __copy_tofrom_user(to, (__force void __user *)from,
++				n - over) + over;
++	}
++	return n;
++}
++
++#else /* __powerpc64__ */
++
++#define __copy_in_user(to, from, size) \
++	__copy_tofrom_user((to), (from), (size))
++
++static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
++
++	if (likely(access_ok(VERIFY_READ, from, n)))
++		n = __copy_from_user(to, from, n);
++	else
++		memset(to, 0, n);
++	return n;
++}
++
++static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if ((long)n < 0 || n > INT_MAX)
++		return n;
++
++	if (likely(access_ok(VERIFY_WRITE, to, n))) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
++		n = __copy_to_user(to, from, n);
++	}
++	return n;
++}
++
++extern unsigned long copy_in_user(void __user *to, const void __user *from,
++				  unsigned long n);
++
++#endif /* __powerpc64__ */
++
+ extern unsigned long __clear_user(void __user *addr, unsigned long size);
+ 
+ static inline unsigned long clear_user(void __user *addr, unsigned long size)
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.14/arch/powerpc/kernel/cacheinfo.c
+--- linux-2.6.32.14/arch/powerpc/kernel/cacheinfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/cacheinfo.c	2010-05-28 21:27:14.807143556 -0400
+@@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
+ 	&cache_assoc_attr,
+ };
+ 
+-static struct sysfs_ops cache_index_ops = {
++static const struct sysfs_ops cache_index_ops = {
+ 	.show = cache_index_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/dma.c linux-2.6.32.14/arch/powerpc/kernel/dma.c
+--- linux-2.6.32.14/arch/powerpc/kernel/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/dma.c	2010-05-28 21:27:14.807143556 -0400
+@@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
+ }
+ #endif
+ 
+-struct dma_map_ops dma_direct_ops = {
++const struct dma_map_ops dma_direct_ops = {
+ 	.alloc_coherent	= dma_direct_alloc_coherent,
+ 	.free_coherent	= dma_direct_free_coherent,
+ 	.map_sg		= dma_direct_map_sg,
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.14/arch/powerpc/kernel/dma-iommu.c
+--- linux-2.6.32.14/arch/powerpc/kernel/dma-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/dma-iommu.c	2010-05-28 21:27:14.807143556 -0400
+@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
+ }
+ 
+ /* We support DMA to/from any memory page via the iommu */
+-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
++int dma_iommu_dma_supported(struct device *dev, u64 mask)
+ {
+ 	struct iommu_table *tbl = get_iommu_table_base(dev);
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.14/arch/powerpc/kernel/dma-swiotlb.c
+--- linux-2.6.32.14/arch/powerpc/kernel/dma-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/dma-swiotlb.c	2010-05-28 21:27:14.807143556 -0400
+@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
+  * map_page, and unmap_page on highmem, use normal dma_ops
+  * for everything else.
+  */
+-struct dma_map_ops swiotlb_dma_ops = {
++const struct dma_map_ops swiotlb_dma_ops = {
+ 	.alloc_coherent = dma_direct_alloc_coherent,
+ 	.free_coherent = dma_direct_free_coherent,
+ 	.map_sg = swiotlb_map_sg_attrs,
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.14/arch/powerpc/kernel/exceptions-64e.S
+--- linux-2.6.32.14/arch/powerpc/kernel/exceptions-64e.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/exceptions-64e.S	2010-05-28 21:27:14.823138187 -0400
+@@ -455,6 +455,7 @@ storage_fault_common:
+ 	std	r14,_DAR(r1)
+ 	std	r15,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	mr	r4,r14
+ 	mr	r5,r15
+ 	ld	r14,PACA_EXGEN+EX_R14(r13)
+@@ -464,8 +465,7 @@ storage_fault_common:
+ 	cmpdi	r3,0
+ 	bne-	1f
+ 	b	.ret_from_except_lite
+-1:	bl	.save_nvgprs
+-	mr	r5,r3
++1:	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	ld	r4,_DAR(r1)
+ 	bl	.bad_page_fault
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.14/arch/powerpc/kernel/exceptions-64s.S
+--- linux-2.6.32.14/arch/powerpc/kernel/exceptions-64s.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/exceptions-64s.S	2010-05-28 21:27:14.834966791 -0400
+@@ -818,10 +818,10 @@ handle_page_fault:
+ 11:	ld	r4,_DAR(r1)
+ 	ld	r5,_DSISR(r1)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
++	bl	.save_nvgprs
+ 	bl	.do_page_fault
+ 	cmpdi	r3,0
+ 	beq+	13f
+-	bl	.save_nvgprs
+ 	mr	r5,r3
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	lwz	r4,_DAR(r1)
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/ibmebus.c linux-2.6.32.14/arch/powerpc/kernel/ibmebus.c
+--- linux-2.6.32.14/arch/powerpc/kernel/ibmebus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/ibmebus.c	2010-05-28 21:27:14.834966791 -0400
+@@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct 
+ 	return 1;
+ }
+ 
+-static struct dma_map_ops ibmebus_dma_ops = {
++static const struct dma_map_ops ibmebus_dma_ops = {
+ 	.alloc_coherent = ibmebus_alloc_coherent,
+ 	.free_coherent  = ibmebus_free_coherent,
+ 	.map_sg         = ibmebus_map_sg,
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/kgdb.c linux-2.6.32.14/arch/powerpc/kernel/kgdb.c
+--- linux-2.6.32.14/arch/powerpc/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/kgdb.c	2010-05-28 21:27:14.834966791 -0400
+@@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
+ 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
+ 		return 0;
+ 
+-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+ 		regs->nip += 4;
+ 
+ 	return 1;
+@@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
+ /*
+  * Global data
+  */
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/module_32.c linux-2.6.32.14/arch/powerpc/kernel/module_32.c
+--- linux-2.6.32.14/arch/powerpc/kernel/module_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/module_32.c	2010-05-28 21:27:14.841132469 -0400
+@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
+ 			me->arch.core_plt_section = i;
+ 	}
+ 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
+-		printk("Module doesn't contain .plt or .init.plt sections.\n");
++		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
+ 		return -ENOEXEC;
+ 	}
+ 
+@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
+ 
+ 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
+ 	/* Init, or core PLT? */
+-	if (location >= mod->module_core
+-	    && location < mod->module_core + mod->core_size)
++	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
++	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
+-	else
++	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
++		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
+ 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
++	else {
++		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
++		return ~0UL;
++	}
+ 
+ 	/* Find this entry, or if that fails, the next avail. entry */
+ 	while (entry->jump[0]) {
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/module.c linux-2.6.32.14/arch/powerpc/kernel/module.c
+--- linux-2.6.32.14/arch/powerpc/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/module.c	2010-05-28 21:27:14.841132469 -0400
+@@ -31,11 +31,24 @@
+ 
+ LIST_HEAD(module_bug_list);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
+ void *module_alloc(unsigned long size)
+ {
+ 	if (size == 0)
+ 		return NULL;
+ 
++	return vmalloc(size);
++}
++
++void *module_alloc_exec(unsigned long size)
++#else
++void *module_alloc(unsigned long size)
++#endif
++
++{
++	if (size == 0)
++		return NULL;
++
+ 	return vmalloc_exec(size);
+ }
+ 
+@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++#endif
++
+ static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
+ 				    const Elf_Shdr *sechdrs,
+ 				    const char *name)
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/pci-common.c linux-2.6.32.14/arch/powerpc/kernel/pci-common.c
+--- linux-2.6.32.14/arch/powerpc/kernel/pci-common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/pci-common.c	2010-05-28 21:27:14.841132469 -0400
+@@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
+ unsigned int ppc_pci_flags = 0;
+ 
+ 
+-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
++static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
+ 
+-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
++void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
+ {
+ 	pci_dma_ops = dma_ops;
+ }
+ 
+-struct dma_map_ops *get_pci_dma_ops(void)
++const struct dma_map_ops *get_pci_dma_ops(void)
+ {
+ 	return pci_dma_ops;
+ }
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/process.c linux-2.6.32.14/arch/powerpc/kernel/process.c
+--- linux-2.6.32.14/arch/powerpc/kernel/process.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/process.c	2010-05-28 21:27:14.843133123 -0400
+@@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned 
+ 		sp -= get_random_int() & ~PAGE_MASK;
+ 	return sp & ~0xf;
+ }
+-
+-static inline unsigned long brk_rnd(void)
+-{
+-        unsigned long rnd = 0;
+-
+-	/* 8MB for 32bit, 1GB for 64bit */
+-	if (is_32bit_task())
+-		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+-	else
+-		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+-
+-	return rnd << PAGE_SHIFT;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long base = mm->brk;
+-	unsigned long ret;
+-
+-#ifdef CONFIG_PPC_STD_MMU_64
+-	/*
+-	 * If we are using 1TB segments and we are allowed to randomise
+-	 * the heap, we can put it above 1TB so it is backed by a 1TB
+-	 * segment. Otherwise the heap will be in the bottom 1TB
+-	 * which always uses 256MB segments and this may result in a
+-	 * performance penalty.
+-	 */
+-	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
+-		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
+-#endif
+-
+-	ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < mm->brk)
+-		return mm->brk;
+-
+-	return ret;
+-}
+-
+-unsigned long randomize_et_dyn(unsigned long base)
+-{
+-	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
+-
+-	if (ret < base)
+-		return base;
+-
+-	return ret;
+-}
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/signal_32.c linux-2.6.32.14/arch/powerpc/kernel/signal_32.c
+--- linux-2.6.32.14/arch/powerpc/kernel/signal_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/signal_32.c	2010-05-28 21:27:14.843133123 -0400
+@@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
+ 	/* Save user registers on the stack */
+ 	frame = &rt_sf->uc.uc_mcontext;
+ 	addr = frame;
+-	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		if (save_user_regs(regs, frame, 0, 1))
+ 			goto badframe;
+ 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/signal_64.c linux-2.6.32.14/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.32.14/arch/powerpc/kernel/signal_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/signal_64.c	2010-05-28 21:27:14.843133123 -0400
+@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
+ 	current->thread.fpscr.val = 0;
+ 
+ 	/* Set up to return from userspace. */
+-	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
++	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
+ 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
+ 	} else {
+ 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.14/arch/powerpc/kernel/sys_ppc32.c
+--- linux-2.6.32.14/arch/powerpc/kernel/sys_ppc32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/sys_ppc32.c	2010-05-28 21:27:14.843133123 -0400
+@@ -563,10 +563,10 @@ asmlinkage long compat_sys_sysctl(struct
+ 	if (oldlenp) {
+ 		if (!error) {
+ 			if (get_user(oldlen, oldlenp) ||
+-			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
++			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
++			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
+ 				error = -EFAULT;
+ 		}
+-		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
+ 	}
+ 	return error;
+ }
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/vdso.c linux-2.6.32.14/arch/powerpc/kernel/vdso.c
+--- linux-2.6.32.14/arch/powerpc/kernel/vdso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/vdso.c	2010-05-28 21:27:14.843133123 -0400
+@@ -36,6 +36,7 @@
+ #include <asm/firmware.h>
+ #include <asm/vdso.h>
+ #include <asm/vdso_datapage.h>
++#include <asm/mman.h>
+ 
+ #include "setup.h"
+ 
+@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = VDSO32_MBASE;
+ #endif
+ 
+-	current->mm->context.vdso_base = 0;
++	current->mm->context.vdso_base = ~0UL;
+ 
+ 	/* vDSO has a problem and was disabled, just don't "enable" it for the
+ 	 * process
+@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
+ 	vdso_base = get_unmapped_area(NULL, vdso_base,
+ 				      (vdso_pages << PAGE_SHIFT) +
+ 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
+-				      0, 0);
++				      0, MAP_PRIVATE | MAP_EXECUTABLE);
+ 	if (IS_ERR_VALUE(vdso_base)) {
+ 		rc = vdso_base;
+ 		goto fail_mmapsem;
+diff -urNp linux-2.6.32.14/arch/powerpc/kernel/vio.c linux-2.6.32.14/arch/powerpc/kernel/vio.c
+--- linux-2.6.32.14/arch/powerpc/kernel/vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/kernel/vio.c	2010-05-28 21:27:14.843133123 -0400
+@@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
+ 	vio_cmo_dealloc(viodev, alloc_size);
+ }
+ 
+-struct dma_map_ops vio_dma_mapping_ops = {
++static const struct dma_map_ops vio_dma_mapping_ops = {
+ 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
+ 	.free_coherent  = vio_dma_iommu_free_coherent,
+ 	.map_sg         = vio_dma_iommu_map_sg,
+ 	.unmap_sg       = vio_dma_iommu_unmap_sg,
++	.dma_supported  = dma_iommu_dma_supported,
+ 	.map_page       = vio_dma_iommu_map_page,
+ 	.unmap_page     = vio_dma_iommu_unmap_page,
+ 
+@@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
+ 
+ static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
+ {
+-	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
+ 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/lib/usercopy_64.c linux-2.6.32.14/arch/powerpc/lib/usercopy_64.c
+--- linux-2.6.32.14/arch/powerpc/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/lib/usercopy_64.c	2010-05-28 21:27:14.843133123 -0400
+@@ -9,22 +9,6 @@
+ #include <linux/module.h>
+ #include <asm/uaccess.h>
+ 
+-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_READ, from, n)))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
+-}
+-
+-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+-{
+-	if (likely(access_ok(VERIFY_WRITE, to, n)))
+-		n = __copy_to_user(to, from, n);
+-	return n;
+-}
+-
+ unsigned long copy_in_user(void __user *to, const void __user *from,
+ 			   unsigned long n)
+ {
+@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
+ 	return n;
+ }
+ 
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.14/arch/powerpc/mm/fault.c linux-2.6.32.14/arch/powerpc/mm/fault.c
+--- linux-2.6.32.14/arch/powerpc/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/mm/fault.c	2010-05-28 21:27:14.843133123 -0400
+@@ -30,6 +30,10 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/perf_event.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
++#include <linux/unistd.h>
+ 
+ #include <asm/firmware.h>
+ #include <asm/page.h>
+@@ -40,6 +44,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/tlbflush.h>
+ #include <asm/siginfo.h>
++#include <asm/ptrace.h>
+ 
+ 
+ #ifdef CONFIG_KPROBES
+@@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
+ }
+ #endif
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->nip = fault address)
++ *
++ * returns 1 when task should be killed
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int __user *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * Check whether the instruction at regs->nip is a store using
+  * an update addressing form which will update r1.
+@@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
+ 	 * indicate errors in DSISR but can validly be set in SRR1.
+ 	 */
+ 	if (trap == 0x400)
+-		error_code &= 0x48200000;
++		error_code &= 0x58200000;
+ 	else
+ 		is_write = error_code & DSISR_ISSTORE;
+ #else
+@@ -250,7 +282,7 @@ good_area:
+          * "undefined".  Of those that can be set, this is the only
+          * one which seems bad.
+          */
+-	if (error_code & 0x10000000)
++	if (error_code & DSISR_GUARDED)
+                 /* Guarded storage error. */
+ 		goto bad_area;
+ #endif /* CONFIG_8xx */
+@@ -265,7 +297,7 @@ good_area:
+ 		 * processors use the same I/D cache coherency mechanism
+ 		 * as embedded.
+ 		 */
+-		if (error_code & DSISR_PROTFAULT)
++		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
+ 			goto bad_area;
+ #endif /* CONFIG_PPC_STD_MMU */
+ 
+@@ -335,6 +367,23 @@ bad_area:
+ bad_area_nosemaphore:
+ 	/* User mode accesses cause a SIGSEGV */
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++#ifdef CONFIG_PPC_STD_MMU
++			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
++#else
++			if (is_exec && regs->nip == address) {
++#endif
++				switch (pax_handle_fetch_fault(regs)) {
++				}
++
++				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
++				do_group_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		_exception(SIGSEGV, regs, code, address);
+ 		return 0;
+ 	}
+diff -urNp linux-2.6.32.14/arch/powerpc/mm/mmap_64.c linux-2.6.32.14/arch/powerpc/mm/mmap_64.c
+--- linux-2.6.32.14/arch/powerpc/mm/mmap_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/mm/mmap_64.c	2010-05-28 21:27:14.843133123 -0400
+@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.14/arch/powerpc/mm/slice.c linux-2.6.32.14/arch/powerpc/mm/slice.c
+--- linux-2.6.32.14/arch/powerpc/mm/slice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/mm/slice.c	2010-05-28 21:27:14.843133123 -0400
+@@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
+ 	if (fixed && addr > (mm->task_size - len))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
++		addr = 0;
++#endif
++
+ 	/* If hint, make sure it matches our alignment restrictions */
+ 	if (!fixed && addr) {
+ 		addr = _ALIGN_UP(addr, 1ul << pshift);
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.14/arch/powerpc/platforms/52xx/lite5200_pm.c
+--- linux-2.6.32.14/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/52xx/lite5200_pm.c	2010-05-28 21:27:14.843133123 -0400
+@@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
+ 	lite5200_pm_target_state = PM_SUSPEND_ON;
+ }
+ 
+-static struct platform_suspend_ops lite5200_pm_ops = {
++static const struct platform_suspend_ops lite5200_pm_ops = {
+ 	.valid		= lite5200_pm_valid,
+ 	.begin		= lite5200_pm_begin,
+ 	.prepare	= lite5200_pm_prepare,
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.14/arch/powerpc/platforms/52xx/mpc52xx_pm.c
+--- linux-2.6.32.14/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2010-05-28 21:27:14.843133123 -0400
+@@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
+ 	iounmap(mbar);
+ }
+ 
+-static struct platform_suspend_ops mpc52xx_pm_ops = {
++static const struct platform_suspend_ops mpc52xx_pm_ops = {
+ 	.valid		= mpc52xx_pm_valid,
+ 	.prepare	= mpc52xx_pm_prepare,
+ 	.enter		= mpc52xx_pm_enter,
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.14/arch/powerpc/platforms/83xx/suspend.c
+--- linux-2.6.32.14/arch/powerpc/platforms/83xx/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/83xx/suspend.c	2010-05-28 21:27:14.843133123 -0400
+@@ -273,7 +273,7 @@ static int mpc83xx_is_pci_agent(void)
+ 	return ret;
+ }
+ 
+-static struct platform_suspend_ops mpc83xx_suspend_ops = {
++static const struct platform_suspend_ops mpc83xx_suspend_ops = {
+ 	.valid = mpc83xx_suspend_valid,
+ 	.begin = mpc83xx_suspend_begin,
+ 	.enter = mpc83xx_suspend_enter,
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.14/arch/powerpc/platforms/cell/iommu.c
+--- linux-2.6.32.14/arch/powerpc/platforms/cell/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/cell/iommu.c	2010-05-28 21:27:14.864087018 -0400
+@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
+ 
+ static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
+ 
+-struct dma_map_ops dma_iommu_fixed_ops = {
++const struct dma_map_ops dma_iommu_fixed_ops = {
+ 	.alloc_coherent = dma_fixed_alloc_coherent,
+ 	.free_coherent  = dma_fixed_free_coherent,
+ 	.map_sg         = dma_fixed_map_sg,
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.14/arch/powerpc/platforms/ps3/system-bus.c
+--- linux-2.6.32.14/arch/powerpc/platforms/ps3/system-bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/ps3/system-bus.c	2010-05-28 21:27:14.867153288 -0400
+@@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
+ 	return mask >= DMA_BIT_MASK(32);
+ }
+ 
+-static struct dma_map_ops ps3_sb_dma_ops = {
++static const struct dma_map_ops ps3_sb_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_sb_map_sg,
+@@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
+ 	.unmap_page = ps3_unmap_page,
+ };
+ 
+-static struct dma_map_ops ps3_ioc0_dma_ops = {
++static const struct dma_map_ops ps3_ioc0_dma_ops = {
+ 	.alloc_coherent = ps3_alloc_coherent,
+ 	.free_coherent = ps3_free_coherent,
+ 	.map_sg = ps3_ioc0_map_sg,
+diff -urNp linux-2.6.32.14/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.14/arch/powerpc/platforms/pseries/Kconfig
+--- linux-2.6.32.14/arch/powerpc/platforms/pseries/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/powerpc/platforms/pseries/Kconfig	2010-05-28 21:27:14.867153288 -0400
+@@ -2,6 +2,8 @@ config PPC_PSERIES
+ 	depends on PPC64 && PPC_BOOK3S
+ 	bool "IBM pSeries & new (POWER5-based) iSeries"
+ 	select MPIC
++	select PCI_MSI
++	select XICS
+ 	select PPC_I8259
+ 	select PPC_RTAS
+ 	select RTAS_ERROR_LOGGING
+diff -urNp linux-2.6.32.14/arch/s390/include/asm/elf.h linux-2.6.32.14/arch/s390/include/asm/elf.h
+--- linux-2.6.32.14/arch/s390/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/include/asm/elf.h	2010-05-28 21:27:14.871031796 -0400
+@@ -164,6 +164,13 @@ extern unsigned int vdso_enabled;
+    that it will "exec", and that there is sufficient room for the brk.  */
+ #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports. */
+ 
+diff -urNp linux-2.6.32.14/arch/s390/include/asm/setup.h linux-2.6.32.14/arch/s390/include/asm/setup.h
+--- linux-2.6.32.14/arch/s390/include/asm/setup.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/include/asm/setup.h	2010-05-28 21:27:14.871031796 -0400
+@@ -50,13 +50,13 @@ extern unsigned long memory_end;
+ void detect_memory_layout(struct mem_chunk chunk[]);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-extern unsigned int switch_amode;
++#define switch_amode	(1)
+ #else
+ #define switch_amode	(0)
+ #endif
+ 
+ #ifdef CONFIG_S390_EXEC_PROTECT
+-extern unsigned int s390_noexec;
++#define s390_noexec	(1)
+ #else
+ #define s390_noexec	(0)
+ #endif
+diff -urNp linux-2.6.32.14/arch/s390/include/asm/uaccess.h linux-2.6.32.14/arch/s390/include/asm/uaccess.h
+--- linux-2.6.32.14/arch/s390/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/include/asm/uaccess.h	2010-05-28 21:27:14.871031796 -0400
+@@ -232,6 +232,10 @@ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_WRITE, to, n))
+ 		n = __copy_to_user(to, from, n);
+ 	return n;
+@@ -257,6 +261,9 @@ copy_to_user(void __user *to, const void
+ static inline unsigned long __must_check
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n) && (n <= 256))
+ 		return uaccess.copy_from_user_small(n, from, to);
+ 	else
+@@ -283,6 +290,10 @@ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (access_ok(VERIFY_READ, from, n))
+ 		n = __copy_from_user(to, from, n);
+ 	else
+diff -urNp linux-2.6.32.14/arch/s390/Kconfig linux-2.6.32.14/arch/s390/Kconfig
+--- linux-2.6.32.14/arch/s390/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/Kconfig	2010-05-28 21:27:14.871031796 -0400
+@@ -194,28 +194,26 @@ config AUDIT_ARCH
+ 
+ config S390_SWITCH_AMODE
+ 	bool "Switch kernel/user addressing modes"
++	default y
+ 	help
+ 	  This option allows to switch the addressing modes of kernel and user
+-	  space. The kernel parameter switch_amode=on will enable this feature,
+-	  default is disabled. Enabling this (via kernel parameter) on machines
+-	  earlier than IBM System z9-109 EC/BC will reduce system performance.
++	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
++	  will reduce system performance.
+ 
+ 	  Note that this option will also be selected by selecting the execute
+-	  protection option below. Enabling the execute protection via the
+-	  noexec kernel parameter will also switch the addressing modes,
+-	  independent of the switch_amode kernel parameter.
++	  protection option below. Enabling the execute protection will also
++	  switch the addressing modes, independent of this option.
+ 
+ 
+ config S390_EXEC_PROTECT
+ 	bool "Data execute protection"
++	default y
+ 	select S390_SWITCH_AMODE
+ 	help
+ 	  This option allows to enable a buffer overflow protection for user
+ 	  space programs and it also selects the addressing mode option above.
+-	  The kernel parameter noexec=on will enable this feature and also
+-	  switch the addressing modes, default is disabled. Enabling this (via
+-	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
+-	  will reduce system performance.
++	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
++	  reduce system performance.
+ 
+ comment "Code generation options"
+ 
+diff -urNp linux-2.6.32.14/arch/s390/kernel/module.c linux-2.6.32.14/arch/s390/kernel/module.c
+--- linux-2.6.32.14/arch/s390/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/kernel/module.c	2010-05-28 21:27:14.871031796 -0400
+@@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
+ 
+ 	/* Increase core size by size of got & plt and set start
+ 	   offsets for got and plt. */
+-	me->core_size = ALIGN(me->core_size, 4);
+-	me->arch.got_offset = me->core_size;
+-	me->core_size += me->arch.got_size;
+-	me->arch.plt_offset = me->core_size;
+-	me->core_size += me->arch.plt_size;
++	me->core_size_rw = ALIGN(me->core_size_rw, 4);
++	me->arch.got_offset = me->core_size_rw;
++	me->core_size_rw += me->arch.got_size;
++	me->arch.plt_offset = me->core_size_rx;
++	me->core_size_rx += me->arch.plt_size;
+ 	return 0;
+ }
+ 
+@@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		if (info->got_initialized == 0) {
+ 			Elf_Addr *gotent;
+ 
+-			gotent = me->module_core + me->arch.got_offset +
++			gotent = me->module_core_rw + me->arch.got_offset +
+ 				info->got_offset;
+ 			*gotent = val;
+ 			info->got_initialized = 1;
+@@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		else if (r_type == R_390_GOTENT ||
+ 			 r_type == R_390_GOTPLTENT)
+ 			*(unsigned int *) loc =
+-				(val + (Elf_Addr) me->module_core - loc) >> 1;
++				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
+ 		else if (r_type == R_390_GOT64 ||
+ 			 r_type == R_390_GOTPLT64)
+ 			*(unsigned long *) loc = val;
+@@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
+ 		if (info->plt_initialized == 0) {
+ 			unsigned int *ip;
+-			ip = me->module_core + me->arch.plt_offset +
++			ip = me->module_core_rx + me->arch.plt_offset +
+ 				info->plt_offset;
+ #ifndef CONFIG_64BIT
+ 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
+@@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
+ 			      (r_type == R_390_PLT32DBL &&
+ 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
+-				val = (Elf_Addr) me->module_core +
++				val = (Elf_Addr) me->module_core_rx +
+ 					me->arch.plt_offset +
+ 					info->plt_offset;
+ 			val += rela->r_addend - loc;
+@@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
+ 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
+ 		val = val + rela->r_addend -
+-			((Elf_Addr) me->module_core + me->arch.got_offset);
++			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
+ 		if (r_type == R_390_GOTOFF16)
+ 			*(unsigned short *) loc = val;
+ 		else if (r_type == R_390_GOTOFF32)
+@@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
+ 		break;
+ 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
+ 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
+-		val = (Elf_Addr) me->module_core + me->arch.got_offset +
++		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
+ 			rela->r_addend - loc;
+ 		if (r_type == R_390_GOTPC)
+ 			*(unsigned int *) loc = val;
+diff -urNp linux-2.6.32.14/arch/s390/kernel/setup.c linux-2.6.32.14/arch/s390/kernel/setup.c
+--- linux-2.6.32.14/arch/s390/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/kernel/setup.c	2010-05-28 21:27:14.871031796 -0400
+@@ -306,9 +306,6 @@ static int __init early_parse_mem(char *
+ early_param("mem", early_parse_mem);
+ 
+ #ifdef CONFIG_S390_SWITCH_AMODE
+-unsigned int switch_amode = 0;
+-EXPORT_SYMBOL_GPL(switch_amode);
+-
+ static int set_amode_and_uaccess(unsigned long user_amode,
+ 				 unsigned long user32_amode)
+ {
+@@ -334,17 +331,6 @@ static int set_amode_and_uaccess(unsigne
+ 		return 0;
+ 	}
+ }
+-
+-/*
+- * Switch kernel/user addressing modes?
+- */
+-static int __init early_parse_switch_amode(char *p)
+-{
+-	switch_amode = 1;
+-	return 0;
+-}
+-early_param("switch_amode", early_parse_switch_amode);
+-
+ #else /* CONFIG_S390_SWITCH_AMODE */
+ static inline int set_amode_and_uaccess(unsigned long user_amode,
+ 					unsigned long user32_amode)
+@@ -353,24 +339,6 @@ static inline int set_amode_and_uaccess(
+ }
+ #endif /* CONFIG_S390_SWITCH_AMODE */
+ 
+-#ifdef CONFIG_S390_EXEC_PROTECT
+-unsigned int s390_noexec = 0;
+-EXPORT_SYMBOL_GPL(s390_noexec);
+-
+-/*
+- * Enable execute protection?
+- */
+-static int __init early_parse_noexec(char *p)
+-{
+-	if (!strncmp(p, "off", 3))
+-		return 0;
+-	switch_amode = 1;
+-	s390_noexec = 1;
+-	return 0;
+-}
+-early_param("noexec", early_parse_noexec);
+-#endif /* CONFIG_S390_EXEC_PROTECT */
+-
+ static void setup_addressing_mode(void)
+ {
+ 	if (s390_noexec) {
+diff -urNp linux-2.6.32.14/arch/s390/mm/mmap.c linux-2.6.32.14/arch/s390/mm/mmap.c
+--- linux-2.6.32.14/arch/s390/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/s390/mm/mmap.c	2010-05-28 21:27:14.871031796 -0400
+@@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+@@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
+ 	 */
+ 	if (mmap_is_legacy()) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+ 		mm->mmap_base = mmap_base();
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.14/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.14/arch/sh/boards/mach-hp6xx/pm.c
+--- linux-2.6.32.14/arch/sh/boards/mach-hp6xx/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sh/boards/mach-hp6xx/pm.c	2010-05-28 21:27:14.871031796 -0400
+@@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops hp6x0_pm_ops = {
++static const struct platform_suspend_ops hp6x0_pm_ops = {
+ 	.enter		= hp6x0_pm_enter,
+ 	.valid		= suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.14/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.14/arch/sh/kernel/cpu/sh4/sq.c
+--- linux-2.6.32.14/arch/sh/kernel/cpu/sh4/sq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sh/kernel/cpu/sh4/sq.c	2010-05-28 21:27:14.871031796 -0400
+@@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops sq_sysfs_ops = {
++static const struct sysfs_ops sq_sysfs_ops = {
+ 	.show	= sq_sysfs_show,
+ 	.store	= sq_sysfs_store,
+ };
+diff -urNp linux-2.6.32.14/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.14/arch/sh/kernel/cpu/shmobile/pm.c
+--- linux-2.6.32.14/arch/sh/kernel/cpu/shmobile/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sh/kernel/cpu/shmobile/pm.c	2010-05-28 21:27:14.871031796 -0400
+@@ -58,7 +58,7 @@ static int sh_pm_enter(suspend_state_t s
+ 	return 0;
+ }
+ 
+-static struct platform_suspend_ops sh_pm_ops = {
++static const struct platform_suspend_ops sh_pm_ops = {
+ 	.enter          = sh_pm_enter,
+ 	.valid          = suspend_valid_only_mem,
+ };
+diff -urNp linux-2.6.32.14/arch/sh/kernel/kgdb.c linux-2.6.32.14/arch/sh/kernel/kgdb.c
+--- linux-2.6.32.14/arch/sh/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sh/kernel/kgdb.c	2010-05-28 21:27:14.871031796 -0400
+@@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: trapa #0x3c */
+ #ifdef CONFIG_CPU_LITTLE_ENDIAN
+ 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/atomic_64.h linux-2.6.32.14/arch/sparc/include/asm/atomic_64.h
+--- linux-2.6.32.14/arch/sparc/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/atomic_64.h	2010-05-28 21:27:14.871031796 -0400
+@@ -14,18 +14,38 @@
+ #define ATOMIC64_INIT(i)	{ (i) }
+ 
+ #define atomic_read(v)		((v)->counter)
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
+ #define atomic64_read(v)	((v)->counter)
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
+ 
+ #define atomic_set(v, i)	(((v)->counter) = i)
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
+ #define atomic64_set(v, i)	(((v)->counter) = i)
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
+ 
+ extern void atomic_add(int, atomic_t *);
++extern void atomic_add_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_add(int, atomic64_t *);
++extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
+ extern void atomic_sub(int, atomic_t *);
++extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
+ extern void atomic64_sub(int, atomic64_t *);
+ 
+ extern int atomic_add_ret(int, atomic_t *);
+ extern int atomic64_add_ret(int, atomic64_t *);
++extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
+ extern int atomic_sub_ret(int, atomic_t *);
+ extern int atomic64_sub_ret(int, atomic64_t *);
+ 
+@@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ #define atomic_inc_return(v) atomic_add_ret(1, v)
+ #define atomic64_inc_return(v) atomic64_add_ret(1, v)
++#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
+ 
+ #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
+ #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
+@@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
+ #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
+ 
+ #define atomic_inc(v) atomic_add(1, v)
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	atomic_add_unchecked(1, v);
++}
+ #define atomic64_inc(v) atomic64_add(1, v)
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
++	atomic64_add_unchecked(1, v);
++}
+ 
+ #define atomic_dec(v) atomic_sub(1, v)
+ #define atomic64_dec(v) atomic64_sub(1, v)
+@@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
+ 
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%icc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
+ 
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addcc %2, %0, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "tvs %%xcc, 6\n"
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a)
++			     : "cc");
++
++		old = atomic64_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.14/arch/sparc/include/asm/dma-mapping.h
+--- linux-2.6.32.14/arch/sparc/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/dma-mapping.h	2010-05-28 21:27:14.871031796 -0400
+@@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
+ #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+ #define dma_is_consistent(d, h)	(1)
+ 
+-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
++extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
+ extern struct bus_type pci_bus_type;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
+ 	if (dev->bus == &pci_bus_type)
+@@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
+ static inline void *dma_alloc_coherent(struct device *dev, size_t size,
+ 				       dma_addr_t *dma_handle, gfp_t flag)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *cpu_addr;
+ 
+ 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
+@@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *cpu_addr, dma_addr_t dma_handle)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
+ 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/elf_32.h linux-2.6.32.14/arch/sparc/include/asm/elf_32.h
+--- linux-2.6.32.14/arch/sparc/include/asm/elf_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/elf_32.h	2010-05-28 21:27:14.871031796 -0400
+@@ -116,6 +116,13 @@ typedef struct {
+ 
+ #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	0x10000UL
++
++#define PAX_DELTA_MMAP_LEN	16
++#define PAX_DELTA_STACK_LEN	16
++#endif
++
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  This can NOT be done in userspace
+    on Sparc.  */
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/elf_64.h linux-2.6.32.14/arch/sparc/include/asm/elf_64.h
+--- linux-2.6.32.14/arch/sparc/include/asm/elf_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/elf_64.h	2010-05-28 21:27:14.871031796 -0400
+@@ -163,6 +163,12 @@ typedef struct {
+ #define ELF_ET_DYN_BASE		0x0000010000000000UL
+ #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
+ 
++#ifdef CONFIG_PAX_ASLR
++#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
++
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this cpu supports.  */
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.14/arch/sparc/include/asm/pgtable_32.h
+--- linux-2.6.32.14/arch/sparc/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/pgtable_32.h	2010-05-28 21:27:14.871031796 -0400
+@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
+ BTFIXUPDEF_INT(page_none)
+ BTFIXUPDEF_INT(page_copy)
+ BTFIXUPDEF_INT(page_readonly)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++BTFIXUPDEF_INT(page_shared_noexec)
++BTFIXUPDEF_INT(page_copy_noexec)
++BTFIXUPDEF_INT(page_readonly_noexec)
++#endif
++
+ BTFIXUPDEF_INT(page_kernel)
+ 
+ #define PMD_SHIFT		SUN4C_PMD_SHIFT
+@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
+ #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
+ #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++extern pgprot_t PAGE_SHARED_NOEXEC;
++# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
++# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
++#else
++# define PAGE_SHARED_NOEXEC	PAGE_SHARED
++# define PAGE_COPY_NOEXEC	PAGE_COPY
++# define PAGE_READONLY_NOEXEC	PAGE_READONLY
++#endif
++
+ extern unsigned long page_kernel;
+ 
+ #ifdef MODULE
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.14/arch/sparc/include/asm/pgtsrmmu.h
+--- linux-2.6.32.14/arch/sparc/include/asm/pgtsrmmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/pgtsrmmu.h	2010-05-28 21:27:14.871031796 -0400
+@@ -115,6 +115,13 @@
+ 				    SRMMU_EXEC | SRMMU_REF)
+ #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
+ 				    SRMMU_EXEC | SRMMU_REF)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
++#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
++#endif
++
+ #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
+ 				    SRMMU_DIRTY | SRMMU_REF)
+ 
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.14/arch/sparc/include/asm/spinlock_64.h
+--- linux-2.6.32.14/arch/sparc/include/asm/spinlock_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/spinlock_64.h	2010-05-28 21:27:14.871031796 -0400
+@@ -99,7 +99,12 @@ static void inline arch_read_lock(raw_rw
+ 	__asm__ __volatile__ (
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,pn		%0, 2f\n"
+-"4:	 add		%0, 1, %1\n"
++"4:	 addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -112,7 +117,7 @@ static void inline arch_read_lock(raw_rw
+ "	.previous"
+ 	: "=&r" (tmp1), "=&r" (tmp2)
+ 	: "r" (lock)
+-	: "memory");
++	: "memory", "cc");
+ }
+ 
+ static int inline arch_read_trylock(raw_rwlock_t *lock)
+@@ -123,7 +128,12 @@ static int inline arch_read_trylock(raw_
+ "1:	ldsw		[%2], %0\n"
+ "	brlz,a,pn	%0, 2f\n"
+ "	 mov		0, %0\n"
+-"	add		%0, 1, %1\n"
++"	addcc		%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs		%%icc, 6\n"
++#endif
++
+ "	cas		[%2], %0, %1\n"
+ "	cmp		%0, %1\n"
+ "	bne,pn		%%icc, 1b\n"
+@@ -142,7 +152,12 @@ static void inline arch_read_unlock(raw_
+ 
+ 	__asm__ __volatile__(
+ "1:	lduw	[%2], %0\n"
+-"	sub	%0, 1, %1\n"
++"	subcc	%0, 1, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++"	tvs	%%icc, 6\n"
++#endif
++
+ "	cas	[%2], %0, %1\n"
+ "	cmp	%0, %1\n"
+ "	bne,pn	%%xcc, 1b\n"
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.14/arch/sparc/include/asm/uaccess_32.h
+--- linux-2.6.32.14/arch/sparc/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/uaccess_32.h	2010-05-28 21:27:14.871031796 -0400
+@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
+ 
+ static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) to, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) to, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(from, n, true);
+ 		return __copy_user(to, (__force void __user *) from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
++
+ 	return __copy_user(to, (__force void __user *) from, n);
+ }
+ 
+ static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (n && __access_ok((unsigned long) from, n))
++	if ((long)n < 0)
++		return n;
++
++	if (n && __access_ok((unsigned long) from, n)) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
+ 		return __copy_user((__force void __user *) to, from, n);
+-	else
++	} else
+ 		return n;
+ }
+ 
+ static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	return __copy_user((__force void __user *) to, from, n);
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.14/arch/sparc/include/asm/uaccess_64.h
+--- linux-2.6.32.14/arch/sparc/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/include/asm/uaccess_64.h	2010-05-28 21:27:14.871031796 -0400
+@@ -9,6 +9,7 @@
+ #include <linux/compiler.h>
+ #include <linux/string.h>
+ #include <linux/thread_info.h>
++#include <linux/kernel.h>
+ #include <asm/asi.h>
+ #include <asm/system.h>
+ #include <asm/spitfire.h>
+@@ -203,6 +204,7 @@ __asm__ __volatile__(							\
+        : "=r" (x) : "r" (__m(addr)), "i" (retval))
+ 
+ extern int __get_user_bad(void);
++extern void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ extern unsigned long __must_check ___copy_from_user(void *to,
+ 						    const void __user *from,
+@@ -212,8 +214,15 @@ extern unsigned long copy_from_user_fixu
+ static inline unsigned long __must_check
+ copy_from_user(void *to, const void __user *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_from_user(to, from, size);
++	unsigned long ret;
+ 
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(to, size, false);
++
++	ret = ___copy_from_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_from_user_fixup(to, from, size);
+ 	return ret;
+@@ -228,8 +237,15 @@ extern unsigned long copy_to_user_fixup(
+ static inline unsigned long __must_check
+ copy_to_user(void __user *to, const void *from, unsigned long size)
+ {
+-	unsigned long ret = ___copy_to_user(to, from, size);
++	unsigned long ret;
++
++	if ((long)size < 0 || size > INT_MAX)
++		return size;
++
++	if (!__builtin_constant_p(size))
++		check_object_size(from, size, true);
+ 
++	ret = ___copy_to_user(to, from, size);
+ 	if (unlikely(ret))
+ 		ret = copy_to_user_fixup(to, from, size);
+ 	return ret;
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/iommu.c linux-2.6.32.14/arch/sparc/kernel/iommu.c
+--- linux-2.6.32.14/arch/sparc/kernel/iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/iommu.c	2010-05-28 21:27:14.874960218 -0400
+@@ -826,7 +826,7 @@ static void dma_4u_sync_sg_for_cpu(struc
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4u_dma_ops = {
++static const struct dma_map_ops sun4u_dma_ops = {
+ 	.alloc_coherent		= dma_4u_alloc_coherent,
+ 	.free_coherent		= dma_4u_free_coherent,
+ 	.map_page		= dma_4u_map_page,
+@@ -837,7 +837,7 @@ static struct dma_map_ops sun4u_dma_ops 
+ 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
++const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/ioport.c linux-2.6.32.14/arch/sparc/kernel/ioport.c
+--- linux-2.6.32.14/arch/sparc/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/ioport.c	2010-05-28 21:27:14.874960218 -0400
+@@ -392,7 +392,7 @@ static void sbus_sync_sg_for_device(stru
+ 	BUG();
+ }
+ 
+-struct dma_map_ops sbus_dma_ops = {
++const struct dma_map_ops sbus_dma_ops = {
+ 	.alloc_coherent		= sbus_alloc_coherent,
+ 	.free_coherent		= sbus_free_coherent,
+ 	.map_page		= sbus_map_page,
+@@ -403,7 +403,7 @@ struct dma_map_ops sbus_dma_ops = {
+ 	.sync_sg_for_device	= sbus_sync_sg_for_device,
+ };
+ 
+-struct dma_map_ops *dma_ops = &sbus_dma_ops;
++const struct dma_map_ops *dma_ops = &sbus_dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int __init sparc_register_ioport(void)
+@@ -640,7 +640,7 @@ static void pci32_sync_sg_for_device(str
+ 	}
+ }
+ 
+-struct dma_map_ops pci32_dma_ops = {
++const struct dma_map_ops pci32_dma_ops = {
+ 	.alloc_coherent		= pci32_alloc_coherent,
+ 	.free_coherent		= pci32_free_coherent,
+ 	.map_page		= pci32_map_page,
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/kgdb_32.c linux-2.6.32.14/arch/sparc/kernel/kgdb_32.c
+--- linux-2.6.32.14/arch/sparc/kernel/kgdb_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/kgdb_32.c	2010-05-28 21:27:14.874960218 -0400
+@@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x7d */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
+ };
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/kgdb_64.c linux-2.6.32.14/arch/sparc/kernel/kgdb_64.c
+--- linux-2.6.32.14/arch/sparc/kernel/kgdb_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/kgdb_64.c	2010-05-28 21:27:14.874960218 -0400
+@@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
+ {
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: ta 0x72 */
+ 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
+ };
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/Makefile linux-2.6.32.14/arch/sparc/kernel/Makefile
+--- linux-2.6.32.14/arch/sparc/kernel/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/Makefile	2010-05-28 21:27:14.874960218 -0400
+@@ -3,7 +3,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ extra-y     := head_$(BITS).o
+ extra-y     += init_task.o
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.14/arch/sparc/kernel/pci_sun4v.c
+--- linux-2.6.32.14/arch/sparc/kernel/pci_sun4v.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/pci_sun4v.c	2010-05-28 21:27:14.874960218 -0400
+@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
+ 	spin_unlock_irqrestore(&iommu->lock, flags);
+ }
+ 
+-static struct dma_map_ops sun4v_dma_ops = {
++static const struct dma_map_ops sun4v_dma_ops = {
+ 	.alloc_coherent			= dma_4v_alloc_coherent,
+ 	.free_coherent			= dma_4v_free_coherent,
+ 	.map_page			= dma_4v_map_page,
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.14/arch/sparc/kernel/sys_sparc_32.c
+--- linux-2.6.32.14/arch/sparc/kernel/sys_sparc_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/sys_sparc_32.c	2010-05-28 21:27:14.874960218 -0400
+@@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
+ 	if (ARCH_SUN4C && len > 0x20000000)
+ 		return -ENOMEM;
+ 	if (!addr)
+-		addr = TASK_UNMAPPED_BASE;
++		addr = current->mm->mmap_base;
+ 
+ 	if (flags & MAP_SHARED)
+ 		addr = COLOUR_ALIGN(addr);
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.14/arch/sparc/kernel/sys_sparc_64.c
+--- linux-2.6.32.14/arch/sparc/kernel/sys_sparc_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/sys_sparc_64.c	2010-05-28 21:27:14.874960218 -0400
+@@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
+ 	if (filp || (flags & MAP_SHARED))
+ 		do_color_align = 1;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		if (do_color_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
+ 	}
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
++		start_addr = addr = mm->mmap_base;
+ 	        mm->cached_hole_size = 0;
+ 	}
+ 
+@@ -175,8 +179,8 @@ full_search:
+ 			vma = find_vma(mm, VA_EXCLUDE_END);
+ 		}
+ 		if (unlikely(task_size < addr)) {
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
+ 		/* We do not accept a shared mapping if it would violate
+ 		 * cache aliasing constraints.
+ 		 */
+-		if ((flags & MAP_SHARED) &&
++		if ((filp || (flags & MAP_SHARED)) &&
+ 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
+ 			return -EINVAL;
+ 		return addr;
+@@ -384,6 +388,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
+ 	    sysctl_legacy_va_layout) {
+ 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+@@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
+ 			gap = (task_size / 6 * 5);
+ 
+ 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.14/arch/sparc/kernel/traps_64.c linux-2.6.32.14/arch/sparc/kernel/traps_64.c
+--- linux-2.6.32.14/arch/sparc/kernel/traps_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/kernel/traps_64.c	2010-05-28 21:27:14.874960218 -0400
+@@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
+ 
+ 	lvl -= 0x100;
+ 	if (regs->tstate & TSTATE_PRIV) {
++
++#ifdef CONFIG_PAX_REFCOUNT
++		if (lvl == 6)
++			pax_report_refcount_overflow(regs);
++#endif
++
+ 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
+ 		die_if_kernel(buffer, regs);
+ 	}
+@@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
+ void bad_trap_tl1(struct pt_regs *regs, long lvl)
+ {
+ 	char buffer[32];
+-	
++
+ 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
+ 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
+ 		return;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++	if (lvl == 6)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
+ 
+ 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
+diff -urNp linux-2.6.32.14/arch/sparc/lib/atomic_64.S linux-2.6.32.14/arch/sparc/lib/atomic_64.S
+--- linux-2.6.32.14/arch/sparc/lib/atomic_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/lib/atomic_64.S	2010-05-28 21:27:14.874960218 -0400
+@@ -18,7 +18,12 @@
+ atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_add, .-atomic_add
+ 
++	.globl	atomic_add_unchecked
++	.type	atomic_add_unchecked,#function
++atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	add	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_add_unchecked, .-atomic_add_unchecked
++
+ 	.globl	atomic_sub
+ 	.type	atomic_sub,#function
+ atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic_sub, .-atomic_sub
+ 
++	.globl	atomic_sub_unchecked
++	.type	atomic_sub_unchecked,#function
++atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	lduw	[%o1], %g1
++	sub	%g1, %o0, %g7
++	cas	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%icc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
++
+ 	.globl	atomic_add_ret
+ 	.type	atomic_add_ret,#function
+ atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1 
+ atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	lduw	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%icc, 2f
+@@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1 
+ atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 = 
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add, .-atomic64_add
+ 
++	.globl	atomic64_add_unchecked
++	.type	atomic64_add_unchecked,#function
++atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 nop
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
++
+ 	.globl	atomic64_sub
+ 	.type	atomic64_sub,#function
+ atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 = 
+ atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	add	%g1, %o0, %g7
++	addcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+@@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
+ 2:	BACKOFF_SPIN(%o2, %o3, 1b)
+ 	.size	atomic64_add_ret, .-atomic64_add_ret
+ 
++	.globl	atomic64_add_ret_unchecked
++	.type	atomic64_add_ret_unchecked,#function
++atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
++	BACKOFF_SETUP(%o2)
++1:	ldx	[%o1], %g1
++	addcc	%g1, %o0, %g7
++	casx	[%o1], %g1, %g7
++	cmp	%g1, %g7
++	bne,pn	%xcc, 2f
++	 add	%g7, %o0, %g7
++	mov	%g7, %o0
++	retl
++	 nop
++2:	BACKOFF_SPIN(%o2, %o3, 1b)
++	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
++
+ 	.globl	atomic64_sub_ret
+ 	.type	atomic64_sub_ret,#function
+ atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
+ 	BACKOFF_SETUP(%o2)
+ 1:	ldx	[%o1], %g1
+-	sub	%g1, %o0, %g7
++	subcc	%g1, %o0, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%xcc, 6
++#endif
++
+ 	casx	[%o1], %g1, %g7
+ 	cmp	%g1, %g7
+ 	bne,pn	%xcc, 2f
+diff -urNp linux-2.6.32.14/arch/sparc/lib/ksyms.c linux-2.6.32.14/arch/sparc/lib/ksyms.c
+--- linux-2.6.32.14/arch/sparc/lib/ksyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/lib/ksyms.c	2010-05-28 21:27:14.874960218 -0400
+@@ -144,8 +144,10 @@ EXPORT_SYMBOL(__downgrade_write);
+ 
+ /* Atomic counter implementation. */
+ EXPORT_SYMBOL(atomic_add);
++EXPORT_SYMBOL(atomic_add_unchecked);
+ EXPORT_SYMBOL(atomic_add_ret);
+ EXPORT_SYMBOL(atomic_sub);
++EXPORT_SYMBOL(atomic_sub_unchecked);
+ EXPORT_SYMBOL(atomic_sub_ret);
+ EXPORT_SYMBOL(atomic64_add);
+ EXPORT_SYMBOL(atomic64_add_ret);
+diff -urNp linux-2.6.32.14/arch/sparc/lib/rwsem_64.S linux-2.6.32.14/arch/sparc/lib/rwsem_64.S
+--- linux-2.6.32.14/arch/sparc/lib/rwsem_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/lib/rwsem_64.S	2010-05-28 21:27:14.874960218 -0400
+@@ -11,7 +11,12 @@
+ 	.globl		__down_read
+ __down_read:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -33,7 +38,12 @@ __down_read:
+ 	.globl		__down_read_trylock
+ __down_read_trylock:
+ 1:	lduw		[%o0], %g1
+-	add		%g1, 1, %g7
++	addcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cmp		%g7, 0
+ 	bl,pn		%icc, 2f
+ 	 mov		0, %o1
+@@ -51,7 +61,12 @@ __down_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -77,7 +92,12 @@ __down_write_trylock:
+ 	cmp		%g3, 0
+ 	bne,pn		%icc, 2f
+ 	 mov		0, %o1
+-	add		%g3, %g1, %g7
++	addcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -90,7 +110,12 @@ __down_write_trylock:
+ __up_read:
+ 1:
+ 	lduw		[%o0], %g1
+-	sub		%g1, 1, %g7
++	subcc		%g1, 1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g1, %g7
+ 	cmp		%g1, %g7
+ 	bne,pn		%icc, 1b
+@@ -118,7 +143,12 @@ __up_write:
+ 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+@@ -143,7 +173,12 @@ __downgrade_write:
+ 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
+ 1:
+ 	lduw		[%o0], %g3
+-	sub		%g3, %g1, %g7
++	subcc		%g3, %g1, %g7
++
++#ifdef CONFIG_PAX_REFCOUNT
++	tvs	%icc, 6
++#endif
++
+ 	cas		[%o0], %g3, %g7
+ 	cmp		%g3, %g7
+ 	bne,pn		%icc, 1b
+diff -urNp linux-2.6.32.14/arch/sparc/Makefile linux-2.6.32.14/arch/sparc/Makefile
+--- linux-2.6.32.14/arch/sparc/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/Makefile	2010-05-28 21:27:14.874960218 -0400
+@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
+ # Export what is needed by arch/sparc/boot/Makefile
+ export VMLINUX_INIT VMLINUX_MAIN
+ VMLINUX_INIT := $(head-y) $(init-y)
+-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
+ VMLINUX_MAIN += $(drivers-y) $(net-y)
+ 
+diff -urNp linux-2.6.32.14/arch/sparc/mm/fault_32.c linux-2.6.32.14/arch/sparc/mm/fault_32.c
+--- linux-2.6.32.14/arch/sparc/mm/fault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/mm/fault_32.c	2010-05-28 21:27:14.874960218 -0400
+@@ -21,6 +21,9 @@
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+ #include <linux/kdebug.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/system.h>
+ #include <asm/page.h>
+@@ -167,6 +170,267 @@ static unsigned long compute_si_addr(str
+ 	return safe_compute_effective_address(regs, insn);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->pc);
++		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned int addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->pc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned int addr;
++
++			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++			regs->pc = addr;
++			regs->npc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->pc);
++		err |= get_user(ba, (unsigned int *)(regs->pc+4));
++		err |= get_user(nop, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned int addr, save, call;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
++			else
++				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->pc = call_dl_resolve;
++				regs->npc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
++				regs->pc = addr;
++				regs->npc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->pc-4));
++		err |= get_user(call, (unsigned int *)regs->pc);
++		err |= get_user(nop, (unsigned int *)(regs->pc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
++
++			regs->u_regs[UREG_RETPC] = regs->pc;
++			regs->pc = dl_resolve;
++			regs->npc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
+ 			       unsigned long address)
+ {
+@@ -231,6 +495,24 @@ good_area:
+ 		if(!(vma->vm_flags & VM_WRITE))
+ 			goto bad_area;
+ 	} else {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
+ 		/* Allow reads even for write-only mappings */
+ 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
+ 			goto bad_area;
+diff -urNp linux-2.6.32.14/arch/sparc/mm/fault_64.c linux-2.6.32.14/arch/sparc/mm/fault_64.c
+--- linux-2.6.32.14/arch/sparc/mm/fault_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/mm/fault_64.c	2010-05-28 21:27:14.878908357 -0400
+@@ -20,6 +20,9 @@
+ #include <linux/kprobes.h>
+ #include <linux/kdebug.h>
+ #include <linux/percpu.h>
++#include <linux/slab.h>
++#include <linux/pagemap.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+@@ -249,6 +252,456 @@ static void noinline bogus_32bit_fault_a
+ 	show_regs(regs);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#ifdef CONFIG_PAX_DLRESOLVE
++static void pax_emuplt_close(struct vm_area_struct *vma)
++{
++	vma->vm_mm->call_dl_resolve = 0UL;
++}
++
++static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++	unsigned int *kaddr;
++
++	vmf->page = alloc_page(GFP_HIGHUSER);
++	if (!vmf->page)
++		return VM_FAULT_OOM;
++
++	kaddr = kmap(vmf->page);
++	memset(kaddr, 0, PAGE_SIZE);
++	kaddr[0] = 0x9DE3BFA8U; /* save */
++	flush_dcache_page(vmf->page);
++	kunmap(vmf->page);
++	return VM_FAULT_MAJOR;
++}
++
++static const struct vm_operations_struct pax_vm_ops = {
++	.close = pax_emuplt_close,
++	.fault = pax_emuplt_fault
++};
++
++static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
++{
++	int ret;
++
++	vma->vm_mm = current->mm;
++	vma->vm_start = addr;
++	vma->vm_end = addr + PAGE_SIZE;
++	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++	vma->vm_ops = &pax_vm_ops;
++
++	ret = insert_vm_struct(current->mm, vma);
++	if (ret)
++		return ret;
++
++	++current->mm->total_vm;
++	return 0;
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->tpc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int sethi1, sethi2, jmpl;
++
++		err = get_user(sethi1, (unsigned int *)regs->tpc);
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
++			addr = regs->u_regs[UREG_G1];
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	{ /* PaX: patched PLT emulation #2 */
++		unsigned int ba;
++
++		err = get_user(ba, (unsigned int *)regs->tpc);
++
++		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
++			unsigned long addr;
++
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	}
++
++	do { /* PaX: patched PLT emulation #3 */
++		unsigned int sethi, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #4 */
++		unsigned int sethi, mov1, call, mov2;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(call, (unsigned int *)(regs->tpc+8));
++		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    mov1 == 0x8210000FU &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    mov2 == 0x9E100001U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
++			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #5 */
++		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    (or1 & 0xFFFFE000U) == 0x82106000U &&
++		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++		    sllx == 0x83287020U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #6 */
++		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
++		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
++		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
++		err |= get_user(or, (unsigned int *)(regs->tpc+16));
++		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
++		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++		    sllx == 0x83287020U &&
++		    (or & 0xFFFFE000U) == 0x8A116000U &&
++		    jmpl == 0x81C04005U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] <<= 32;
++			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
++			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation step 1 */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++			unsigned int save, call;
++			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
++
++			if ((ba & 0xFFC00000U) == 0x30800000U)
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
++			else
++				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			err = get_user(save, (unsigned int *)addr);
++			err |= get_user(call, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			if (err)
++				break;
++
++#ifdef CONFIG_PAX_DLRESOLVE
++			if (save == 0x9DE3BFA8U &&
++			    (call & 0xC0000000U) == 0x40000000U &&
++			    nop == 0x01000000U)
++			{
++				struct vm_area_struct *vma;
++				unsigned long call_dl_resolve;
++
++				down_read(&current->mm->mmap_sem);
++				call_dl_resolve = current->mm->call_dl_resolve;
++				up_read(&current->mm->mmap_sem);
++				if (likely(call_dl_resolve))
++					goto emulate;
++
++				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++
++				down_write(&current->mm->mmap_sem);
++				if (current->mm->call_dl_resolve) {
++					call_dl_resolve = current->mm->call_dl_resolve;
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					goto emulate;
++				}
++
++				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
++				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
++					up_write(&current->mm->mmap_sem);
++					if (vma)
++						kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				if (pax_insert_vma(vma, call_dl_resolve)) {
++					up_write(&current->mm->mmap_sem);
++					kmem_cache_free(vm_area_cachep, vma);
++					return 1;
++				}
++
++				current->mm->call_dl_resolve = call_dl_resolve;
++				up_write(&current->mm->mmap_sem);
++
++emulate:
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->tpc = call_dl_resolve;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++#endif
++
++			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
++			if ((save & 0xFFC00000U) == 0x05000000U &&
++			    (call & 0xFFFFE000U) == 0x85C0A000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G2] = addr + 4;
++				addr = (save & 0x003FFFFFU) << 10;
++				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
++
++				if (test_thread_flag(TIF_32BIT))
++					addr &= 0xFFFFFFFFUL;
++
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++
++			/* PaX: 64-bit PLT stub */
++			err = get_user(sethi1, (unsigned int *)addr);
++			err |= get_user(sethi2, (unsigned int *)(addr+4));
++			err |= get_user(or1, (unsigned int *)(addr+8));
++			err |= get_user(or2, (unsigned int *)(addr+12));
++			err |= get_user(sllx, (unsigned int *)(addr+16));
++			err |= get_user(add, (unsigned int *)(addr+20));
++			err |= get_user(jmpl, (unsigned int *)(addr+24));
++			err |= get_user(nop, (unsigned int *)(addr+28));
++			if (err)
++				break;
++
++			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
++			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
++			    (or1 & 0xFFFFE000U) == 0x88112000U &&
++			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
++			    sllx == 0x89293020U &&
++			    add == 0x8A010005U &&
++			    jmpl == 0x89C14000U &&
++			    nop == 0x01000000U)
++			{
++				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
++				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
++				regs->u_regs[UREG_G4] <<= 32;
++				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
++				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
++				regs->u_regs[UREG_G4] = addr + 24;
++				addr = regs->u_regs[UREG_G5];
++				regs->tpc = addr;
++				regs->tnpc = addr+4;
++				return 3;
++			}
++		}
++	} while (0);
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	do { /* PaX: unpatched PLT emulation step 2 */
++		unsigned int save, call, nop;
++
++		err = get_user(save, (unsigned int *)(regs->tpc-4));
++		err |= get_user(call, (unsigned int *)regs->tpc);
++		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
++		if (err)
++			break;
++
++		if (save == 0x9DE3BFA8U &&
++		    (call & 0xC0000000U) == 0x40000000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				dl_resolve &= 0xFFFFFFFFUL;
++
++			regs->u_regs[UREG_RETPC] = regs->tpc;
++			regs->tpc = dl_resolve;
++			regs->tnpc = dl_resolve+4;
++			return 3;
++		}
++	} while (0);
++#endif
++
++	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
++		unsigned int sethi, ba, nop;
++
++		err = get_user(sethi, (unsigned int *)regs->tpc);
++		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
++		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
++
++		if (err)
++			break;
++
++		if ((sethi & 0xFFC00000U) == 0x03000000U &&
++		    (ba & 0xFFF00000U) == 0x30600000U &&
++		    nop == 0x01000000U)
++		{
++			unsigned long addr;
++
++			addr = (sethi & 0x003FFFFFU) << 10;
++			regs->u_regs[UREG_G1] = addr;
++			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
++
++			if (test_thread_flag(TIF_32BIT))
++				addr &= 0xFFFFFFFFUL;
++
++			regs->tpc = addr;
++			regs->tnpc = addr+4;
++			return 2;
++		}
++	} while (0);
++
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 8; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk(KERN_CONT "???????? ");
++		else
++			printk(KERN_CONT "%08x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ 	struct mm_struct *mm = current->mm;
+@@ -315,6 +768,29 @@ asmlinkage void __kprobes do_sparc64_fau
+ 	if (!vma)
+ 		goto bad_area;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++	/* PaX: detect ITLB misses on non-exec pages */
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
++	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
++	{
++		if (address != regs->tpc)
++			goto good_area;
++
++		up_read(&mm->mmap_sem);
++		switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++		case 2:
++		case 3:
++			return;
++#endif
++
++		}
++		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
++		do_group_exit(SIGKILL);
++	}
++#endif
++
+ 	/* Pure DTLB misses do not tell us whether the fault causing
+ 	 * load/store/atomic was a write or not, it only says that there
+ 	 * was no match.  So in such a case we (carefully) read the
+diff -urNp linux-2.6.32.14/arch/sparc/mm/init_32.c linux-2.6.32.14/arch/sparc/mm/init_32.c
+--- linux-2.6.32.14/arch/sparc/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/mm/init_32.c	2010-05-28 21:27:14.878908357 -0400
+@@ -317,6 +317,9 @@ extern void device_scan(void);
+ pgprot_t PAGE_SHARED __read_mostly;
+ EXPORT_SYMBOL(PAGE_SHARED);
+ 
++pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
++EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
++
+ void __init paging_init(void)
+ {
+ 	switch(sparc_cpu_model) {
+@@ -345,17 +348,17 @@ void __init paging_init(void)
+ 
+ 	/* Initialize the protection map with non-constant, MMU dependent values. */
+ 	protection_map[0] = PAGE_NONE;
+-	protection_map[1] = PAGE_READONLY;
+-	protection_map[2] = PAGE_COPY;
+-	protection_map[3] = PAGE_COPY;
++	protection_map[1] = PAGE_READONLY_NOEXEC;
++	protection_map[2] = PAGE_COPY_NOEXEC;
++	protection_map[3] = PAGE_COPY_NOEXEC;
+ 	protection_map[4] = PAGE_READONLY;
+ 	protection_map[5] = PAGE_READONLY;
+ 	protection_map[6] = PAGE_COPY;
+ 	protection_map[7] = PAGE_COPY;
+ 	protection_map[8] = PAGE_NONE;
+-	protection_map[9] = PAGE_READONLY;
+-	protection_map[10] = PAGE_SHARED;
+-	protection_map[11] = PAGE_SHARED;
++	protection_map[9] = PAGE_READONLY_NOEXEC;
++	protection_map[10] = PAGE_SHARED_NOEXEC;
++	protection_map[11] = PAGE_SHARED_NOEXEC;
+ 	protection_map[12] = PAGE_READONLY;
+ 	protection_map[13] = PAGE_READONLY;
+ 	protection_map[14] = PAGE_SHARED;
+diff -urNp linux-2.6.32.14/arch/sparc/mm/Makefile linux-2.6.32.14/arch/sparc/mm/Makefile
+--- linux-2.6.32.14/arch/sparc/mm/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/mm/Makefile	2010-05-28 21:27:14.878908357 -0400
+@@ -2,7 +2,7 @@
+ #
+ 
+ asflags-y := -ansi
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
+ obj-y                   += fault_$(BITS).o
+diff -urNp linux-2.6.32.14/arch/sparc/mm/srmmu.c linux-2.6.32.14/arch/sparc/mm/srmmu.c
+--- linux-2.6.32.14/arch/sparc/mm/srmmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/sparc/mm/srmmu.c	2010-05-28 21:27:14.878908357 -0400
+@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
+ 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
+ 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
+ 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
++	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
++	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
++#endif
++
+ 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
+ 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
+ 
+diff -urNp linux-2.6.32.14/arch/um/include/asm/kmap_types.h linux-2.6.32.14/arch/um/include/asm/kmap_types.h
+--- linux-2.6.32.14/arch/um/include/asm/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/um/include/asm/kmap_types.h	2010-05-28 21:27:14.883145356 -0400
+@@ -23,6 +23,7 @@ enum km_type {
+ 	KM_IRQ1,
+ 	KM_SOFTIRQ0,
+ 	KM_SOFTIRQ1,
++	KM_CLEARPAGE,
+ 	KM_TYPE_NR
+ };
+ 
+diff -urNp linux-2.6.32.14/arch/um/include/asm/page.h linux-2.6.32.14/arch/um/include/asm/page.h
+--- linux-2.6.32.14/arch/um/include/asm/page.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/um/include/asm/page.h	2010-05-28 21:27:14.883145356 -0400
+@@ -14,6 +14,9 @@
+ #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
+ #define PAGE_MASK	(~(PAGE_SIZE-1))
+ 
++#define ktla_ktva(addr)			(addr)
++#define ktva_ktla(addr)			(addr)
++
+ #ifndef __ASSEMBLY__
+ 
+ struct page;
+diff -urNp linux-2.6.32.14/arch/um/sys-i386/syscalls.c linux-2.6.32.14/arch/um/sys-i386/syscalls.c
+--- linux-2.6.32.14/arch/um/sys-i386/syscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/um/sys-i386/syscalls.c	2010-05-28 21:27:14.883145356 -0400
+@@ -11,6 +11,21 @@
+ #include "asm/uaccess.h"
+ #include "asm/unistd.h"
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+diff -urNp linux-2.6.32.14/arch/x86/boot/bitops.h linux-2.6.32.14/arch/x86/boot/bitops.h
+--- linux-2.6.32.14/arch/x86/boot/bitops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/bitops.h	2010-05-28 21:27:14.891136655 -0400
+@@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
+ 	u8 v;
+ 	const u32 *p = (const u32 *)addr;
+ 
+-	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
++	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+ 	return v;
+ }
+ 
+@@ -37,7 +37,7 @@ static inline int variable_test_bit(int 
+ 
+ static inline void set_bit(int nr, void *addr)
+ {
+-	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
++	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
+ }
+ 
+ #endif /* BOOT_BITOPS_H */
+diff -urNp linux-2.6.32.14/arch/x86/boot/boot.h linux-2.6.32.14/arch/x86/boot/boot.h
+--- linux-2.6.32.14/arch/x86/boot/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/boot.h	2010-05-28 21:27:14.891136655 -0400
+@@ -82,7 +82,7 @@ static inline void io_delay(void)
+ static inline u16 ds(void)
+ {
+ 	u16 seg;
+-	asm("movw %%ds,%0" : "=rm" (seg));
++	asm volatile("movw %%ds,%0" : "=rm" (seg));
+ 	return seg;
+ }
+ 
+@@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t 
+ static inline int memcmp(const void *s1, const void *s2, size_t len)
+ {
+ 	u8 diff;
+-	asm("repe; cmpsb; setnz %0"
++	asm volatile("repe; cmpsb; setnz %0"
+ 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
+ 	return diff;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/boot/compressed/head_32.S linux-2.6.32.14/arch/x86/boot/compressed/head_32.S
+--- linux-2.6.32.14/arch/x86/boot/compressed/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/compressed/head_32.S	2010-05-28 21:27:14.891136655 -0400
+@@ -76,7 +76,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl    %eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -149,7 +149,7 @@ relocated:
+  * and where it was actually loaded.
+  */
+ 	movl	%ebp, %ebx
+-	subl	$LOAD_PHYSICAL_ADDR, %ebx
++	subl	$____LOAD_PHYSICAL_ADDR, %ebx
+ 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
+ /*
+  * Process relocations.
+@@ -157,8 +157,7 @@ relocated:
+ 
+ 1:	subl	$4, %edi
+ 	movl	(%edi), %ecx
+-	testl	%ecx, %ecx
+-	jz	2f
++	jecxz	2f
+ 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
+ 	jmp	1b
+ 2:
+diff -urNp linux-2.6.32.14/arch/x86/boot/compressed/head_64.S linux-2.6.32.14/arch/x86/boot/compressed/head_64.S
+--- linux-2.6.32.14/arch/x86/boot/compressed/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/compressed/head_64.S	2010-05-28 21:27:14.891136655 -0400
+@@ -91,7 +91,7 @@ ENTRY(startup_32)
+ 	notl	%eax
+ 	andl	%eax, %ebx
+ #else
+-	movl	$LOAD_PHYSICAL_ADDR, %ebx
++	movl	$____LOAD_PHYSICAL_ADDR, %ebx
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+@@ -234,7 +234,7 @@ ENTRY(startup_64)
+ 	notq	%rax
+ 	andq	%rax, %rbp
+ #else
+-	movq	$LOAD_PHYSICAL_ADDR, %rbp
++	movq	$____LOAD_PHYSICAL_ADDR, %rbp
+ #endif
+ 
+ 	/* Target address to relocate to for decompression */
+diff -urNp linux-2.6.32.14/arch/x86/boot/compressed/misc.c linux-2.6.32.14/arch/x86/boot/compressed/misc.c
+--- linux-2.6.32.14/arch/x86/boot/compressed/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/compressed/misc.c	2010-05-28 21:27:14.895019280 -0400
+@@ -288,7 +288,7 @@ static void parse_elf(void *output)
+ 		case PT_LOAD:
+ #ifdef CONFIG_RELOCATABLE
+ 			dest = output;
+-			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
++			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
+ #else
+ 			dest = (void *)(phdr->p_paddr);
+ #endif
+@@ -335,7 +335,7 @@ asmlinkage void decompress_kernel(void *
+ 		error("Destination address too large");
+ #endif
+ #ifndef CONFIG_RELOCATABLE
+-	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
++	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
+ 		error("Wrong destination address");
+ #endif
+ 
+diff -urNp linux-2.6.32.14/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.14/arch/x86/boot/compressed/mkpiggy.c
+--- linux-2.6.32.14/arch/x86/boot/compressed/mkpiggy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/compressed/mkpiggy.c	2010-05-28 21:27:14.895019280 -0400
+@@ -74,7 +74,7 @@ int main(int argc, char *argv[])
+ 
+ 	offs = (olen > ilen) ? olen - ilen : 0;
+ 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
+-	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
++	offs += 64*1024;	/* Add 64K bytes slack */
+ 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
+ 
+ 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
+diff -urNp linux-2.6.32.14/arch/x86/boot/compressed/relocs.c linux-2.6.32.14/arch/x86/boot/compressed/relocs.c
+--- linux-2.6.32.14/arch/x86/boot/compressed/relocs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/compressed/relocs.c	2010-05-28 21:27:14.895019280 -0400
+@@ -10,8 +10,11 @@
+ #define USE_BSD
+ #include <endian.h>
+ 
++#include "../../../../include/linux/autoconf.h"
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ 
+@@ -37,7 +40,7 @@ static const char* safe_abs_relocs[] = {
+ 
+ static int is_safe_abs_reloc(const char* sym_name)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
+ 		if (!strcmp(sym_name, safe_abs_relocs[i]))
+@@ -245,9 +248,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -282,7 +315,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -307,7 +340,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -340,7 +373,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -360,9 +395,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -371,14 +415,14 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -406,14 +450,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -474,13 +518,13 @@ static void print_absolute_relocs(void)
+ 
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -504,6 +548,21 @@ static void walk_relocs(void (*visit)(El
+ 			if (sym->st_shndx == SHN_ABS) {
+ 				continue;
+ 			}
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
+ 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
+ 				/*
+ 				 * NONE can be ignored and and PC relative
+@@ -541,7 +600,7 @@ static int cmp_relocs(const void *va, co
+ 
+ static void emit_relocs(int as_text)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc);
+@@ -634,6 +693,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
+diff -urNp linux-2.6.32.14/arch/x86/boot/cpucheck.c linux-2.6.32.14/arch/x86/boot/cpucheck.c
+--- linux-2.6.32.14/arch/x86/boot/cpucheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/cpucheck.c	2010-05-28 21:27:14.895019280 -0400
+@@ -74,7 +74,7 @@ static int has_fpu(void)
+ 	u16 fcw = -1, fsw = -1;
+ 	u32 cr0;
+ 
+-	asm("movl %%cr0,%0" : "=r" (cr0));
++	asm volatile("movl %%cr0,%0" : "=r" (cr0));
+ 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
+ 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
+ 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
+@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
+ {
+ 	u32 f0, f1;
+ 
+-	asm("pushfl ; "
++	asm volatile("pushfl ; "
+ 	    "pushfl ; "
+ 	    "popl %0 ; "
+ 	    "movl %0,%1 ; "
+@@ -115,7 +115,7 @@ static void get_flags(void)
+ 		set_bit(X86_FEATURE_FPU, cpu.flags);
+ 
+ 	if (has_eflag(X86_EFLAGS_ID)) {
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_intel_level),
+ 		      "=b" (cpu_vendor[0]),
+ 		      "=d" (cpu_vendor[1]),
+@@ -124,7 +124,7 @@ static void get_flags(void)
+ 
+ 		if (max_intel_level >= 0x00000001 &&
+ 		    max_intel_level <= 0x0000ffff) {
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "=a" (tfms),
+ 			      "=c" (cpu.flags[4]),
+ 			      "=d" (cpu.flags[0])
+@@ -136,7 +136,7 @@ static void get_flags(void)
+ 				cpu.model += ((tfms >> 16) & 0xf) << 4;
+ 		}
+ 
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_amd_level)
+ 		    : "a" (0x80000000)
+ 		    : "ebx", "ecx", "edx");
+@@ -144,7 +144,7 @@ static void get_flags(void)
+ 		if (max_amd_level >= 0x80000001 &&
+ 		    max_amd_level <= 0x8000ffff) {
+ 			u32 eax = 0x80000001;
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "+a" (eax),
+ 			      "=c" (cpu.flags[6]),
+ 			      "=d" (cpu.flags[1])
+@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_K7_HWCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax &= ~(1 << 15);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		get_flags();	/* Make sure it really did something */
+ 		err = check_flags();
+@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_VIA_FCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax |= (1<<1)|(1<<7);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		set_bit(X86_FEATURE_CX8, cpu.flags);
+ 		err = check_flags();
+@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 eax, edx;
+ 		u32 level = 1;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+-		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
+-		asm("cpuid"
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
++		asm volatile("cpuid"
+ 		    : "+a" (level), "=d" (cpu.flags[0])
+ 		    : : "ecx", "ebx");
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		err = check_flags();
+ 	}
+diff -urNp linux-2.6.32.14/arch/x86/boot/header.S linux-2.6.32.14/arch/x86/boot/header.S
+--- linux-2.6.32.14/arch/x86/boot/header.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/header.S	2010-05-28 21:27:14.895019280 -0400
+@@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
+ 						# single linked list of
+ 						# struct setup_data
+ 
+-pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
++pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
+ 
+ #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
+ #define VO_INIT_SIZE	(VO__end - VO__text)
+diff -urNp linux-2.6.32.14/arch/x86/boot/memory.c linux-2.6.32.14/arch/x86/boot/memory.c
+--- linux-2.6.32.14/arch/x86/boot/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/memory.c	2010-05-28 21:27:14.895019280 -0400
+@@ -19,7 +19,7 @@
+ 
+ static int detect_memory_e820(void)
+ {
+-	int count = 0;
++	unsigned int count = 0;
+ 	struct biosregs ireg, oreg;
+ 	struct e820entry *desc = boot_params.e820_map;
+ 	static struct e820entry buf; /* static so it is zeroed */
+diff -urNp linux-2.6.32.14/arch/x86/boot/video.c linux-2.6.32.14/arch/x86/boot/video.c
+--- linux-2.6.32.14/arch/x86/boot/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/video.c	2010-05-28 21:27:14.895019280 -0400
+@@ -90,7 +90,7 @@ static void store_mode_params(void)
+ static unsigned int get_entry(void)
+ {
+ 	char entry_buf[4];
+-	int i, len = 0;
++	unsigned int i, len = 0;
+ 	int key;
+ 	unsigned int v;
+ 
+diff -urNp linux-2.6.32.14/arch/x86/boot/video-vesa.c linux-2.6.32.14/arch/x86/boot/video-vesa.c
+--- linux-2.6.32.14/arch/x86/boot/video-vesa.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/boot/video-vesa.c	2010-05-28 21:27:14.895019280 -0400
+@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
+ 
+ 	boot_params.screen_info.vesapm_seg = oreg.es;
+ 	boot_params.screen_info.vesapm_off = oreg.di;
++	boot_params.screen_info.vesapm_size = oreg.cx;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/x86/ia32/ia32entry.S linux-2.6.32.14/arch/x86/ia32/ia32entry.S
+--- linux-2.6.32.14/arch/x86/ia32/ia32entry.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/ia32/ia32entry.S	2010-05-28 21:27:14.895019280 -0400
+@@ -13,6 +13,7 @@
+ #include <asm/thread_info.h>	
+ #include <asm/segment.h>
+ #include <asm/irqflags.h>
++#include <asm/pgtable.h>
+ #include <linux/linkage.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+@@ -114,6 +115,11 @@ ENTRY(ia32_sysenter_target)
+ 	SWAPGS_UNSAFE_STACK
+ 	movq	PER_CPU_VAR(kernel_stack), %rsp
+ 	addq	$(KERNEL_STACK_OFFSET),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs, here we enable it straight after entry:
+@@ -144,6 +150,12 @@ ENTRY(ia32_sysenter_target)
+ 	SAVE_ARGS 0,0,1
+  	/* no need to do an access_ok check here because rbp has been
+  	   32bit zero extended */ 
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%rbp
++#endif
++
+ 1:	movl	(%rbp),%ebp
+  	.section __ex_table,"a"
+  	.quad 1b,ia32_badarg
+@@ -166,6 +178,11 @@ sysenter_dispatch:
+ 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz	sysexit_audit
+ sysexit_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl    $~TS_COMPAT,TI_status(%r10)
+ 	/* clear IF, that popfq doesn't enable interrupts early */
+ 	andl  $~0x200,EFLAGS-R11(%rsp) 
+@@ -284,6 +301,11 @@ ENTRY(ia32_cstar_target)
+ 	movl	%esp,%r8d
+ 	CFI_REGISTER	rsp,r8
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+@@ -305,6 +327,12 @@ ENTRY(ia32_cstar_target)
+ 	/* no need to do an access_ok check here because r8 has been
+ 	   32bit zero extended */ 
+ 	/* hardware stack frame is complete now */	
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%r10
++	add %r10,%r8
++#endif
++
+ 1:	movl	(%r8),%r9d
+ 	.section __ex_table,"a"
+ 	.quad 1b,ia32_badarg
+@@ -327,6 +355,11 @@ cstar_dispatch:
+ 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
+ 	jnz sysretl_audit
+ sysretl_from_sys_call:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	andl $~TS_COMPAT,TI_status(%r10)
+ 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
+ 	movl RIP-ARGOFFSET(%rsp),%ecx
+@@ -409,6 +442,11 @@ ENTRY(ia32_syscall)
+ 	CFI_REL_OFFSET	rip,RIP-RIP
+ 	PARAVIRT_ADJUST_EXCEPTION_FRAME
+ 	SWAPGS
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs on/off section: the syscall
+ 	 * disabled irqs and here we enable it straight after entry:
+diff -urNp linux-2.6.32.14/arch/x86/ia32/ia32_signal.c linux-2.6.32.14/arch/x86/ia32/ia32_signal.c
+--- linux-2.6.32.14/arch/x86/ia32/ia32_signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/ia32/ia32_signal.c	2010-05-28 21:27:14.895019280 -0400
+@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
+ 	sp -= frame_size;
+ 	/* Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ 	return (void __user *) sp;
+ }
+ 
+@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct 
+ 		0xb8,
+ 		__NR_ia32_rt_sigreturn,
+ 		0x80cd,
+-		0,
++		0
+ 	};
+ 
+ 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/alternative.h linux-2.6.32.14/arch/x86/include/asm/alternative.h
+--- linux-2.6.32.14/arch/x86/include/asm/alternative.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/alternative.h	2010-05-28 21:27:14.895019280 -0400
+@@ -85,7 +85,7 @@ static inline void alternatives_smp_swit
+       "	 .byte 662b-661b\n"			/* sourcelen       */	\
+       "	 .byte 664f-663f\n"			/* replacementlen  */	\
+       ".previous\n"							\
+-      ".section .altinstr_replacement, \"ax\"\n"			\
++      ".section .altinstr_replacement, \"a\"\n"			\
+       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
+       ".previous"
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/apm.h linux-2.6.32.14/arch/x86/include/asm/apm.h
+--- linux-2.6.32.14/arch/x86/include/asm/apm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/apm.h	2010-05-28 21:27:14.903156603 -0400
+@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%al\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
+ 	__asm__ __volatile__(APM_DO_ZERO_SEGS
+ 		"pushl %%edi\n\t"
+ 		"pushl %%ebp\n\t"
+-		"lcall *%%cs:apm_bios_entry\n\t"
++		"lcall *%%ss:apm_bios_entry\n\t"
+ 		"setc %%bl\n\t"
+ 		"popl %%ebp\n\t"
+ 		"popl %%edi\n\t"
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/atomic_32.h linux-2.6.32.14/arch/x86/include/asm/atomic_32.h
+--- linux-2.6.32.14/arch/x86/include/asm/atomic_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/atomic_32.h	2010-05-28 21:27:14.903156603 -0400
+@@ -25,6 +25,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+m" (v->counter)
++		     : "ir" (i));
++}
++
++/**
++ * atomic_sub_unchecked - subtract integer from atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "+m" (v->counter)
+ 		     : "ir" (i));
+ }
+@@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "+m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (v->counter));
+ }
+ 
+@@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "into\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (v->counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -179,6 +322,46 @@ static inline int atomic_add_return(int 
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "into\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++
++#ifdef CONFIG_M386
++no_xadd: /* Legacy 386 processor */
++	local_irq_save(flags);
++	__i = atomic_read(v);
++	atomic_set(v, i + __i);
++	local_irq_restore(flags);
++	return i + __i;
++#endif
++}
++
++/**
++ * atomic_add_return_unchecked - add integer and return
++ * @v: pointer of type atomic_unchecked_t
++ * @i: integer value to add
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
++{
++	int __i;
++#ifdef CONFIG_M386
++	unsigned long flags;
++	if (unlikely(boot_cpu_data.x86 <= 3))
++		goto no_xadd;
++#endif
++	/* Modern 486+ processor */
++	__i = i;
+ 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+@@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "into\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+ 
+ #define atomic_inc_return(v)  (atomic_add_return(1, v))
++#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
+ #define atomic_dec_return(v)  (atomic_sub_return(1, v))
+ 
+ /* These are x86-specific, used by some header files */
+@@ -266,6 +461,14 @@ typedef struct {
+ 	u64 __aligned(8) counter;
+ } atomic64_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	u64 __aligned(8) counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
++
+ #define ATOMIC64_INIT(val)	{ (val) }
+ 
+ extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/atomic_64.h linux-2.6.32.14/arch/x86/include/asm/atomic_64.h
+--- linux-2.6.32.14/arch/x86/include/asm/atomic_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/atomic_64.h	2010-05-28 21:27:14.906924566 -0400
+@@ -24,6 +24,17 @@ static inline int atomic_read(const atom
+ }
+ 
+ /**
++ * atomic_read_unchecked - read atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ */
++static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic_set - set atomic variable
+  * @v: pointer of type atomic_t
+  * @i: required value
+@@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
+ }
+ 
+ /**
++ * atomic_set_unchecked - set atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic_add - add integer to atomic variable
+  * @i: integer value to add
+  * @v: pointer of type atomic_t
+@@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
+  */
+ static inline void atomic_add(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1,%0"
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_add_unchecked - add integer to atomic variable
++ * @i: integer value to add
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
+  */
+ static inline void atomic_sub(int i, atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subl %1,%0"
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "ir" (i), "m" (v->counter));
++}
++
++/**
++ * atomic_sub_unchecked - subtract the atomic variable
++ * @i: integer value to subtract
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically subtracts @i from @v.
++ */
++static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+ 		     : "=m" (v->counter)
+ 		     : "ir" (i), "m" (v->counter));
+ }
+@@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
+  */
+ static inline void atomic_inc(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic_inc_unchecked - increment atomic variable
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
++{
++	asm volatile(LOCK_PREFIX "incl %0\n"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
+  */
+ static inline void atomic_dec(atomic_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decl %0"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
++	asm volatile(LOCK_PREFIX "decl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subl %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "ir" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
+ static inline int atomic_add_return(int i, atomic_t *v)
+ {
+ 	int __i = i;
+-	asm volatile(LOCK_PREFIX "xaddl %0, %1"
++	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movl %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -204,6 +360,18 @@ static inline long atomic64_read(const a
+ }
+ 
+ /**
++ * atomic64_read_unchecked - read atomic64 variable
++ * @v: pointer of type atomic64_unchecked_t
++ *
++ * Atomically reads the value of @v.
++ * Doesn't imply a read memory barrier.
++ */
++static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
++{
++	return v->counter;
++}
++
++/**
+  * atomic64_set - set atomic64 variable
+  * @v: pointer to type atomic64_t
+  * @i: required value
+@@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
+ }
+ 
+ /**
++ * atomic64_set_unchecked - set atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ * @i: required value
++ *
++ * Atomically sets the value of @v to @i.
++ */
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
++{
++	v->counter = i;
++}
++
++/**
+  * atomic64_add - add integer to atomic64 variable
+  * @i: integer value to add
+  * @v: pointer to type atomic64_t
+@@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
+  */
+ static inline void atomic64_add(long i, atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "addq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "er" (i), "m" (v->counter));
++}
++
++/**
++ * atomic64_add_unchecked - add integer to atomic64 variable
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "addq %1,%0"
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+@@ -238,7 +440,15 @@ static inline void atomic64_add(long i, 
+  */
+ static inline void atomic64_sub(long i, atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "subq %1,%0"
++	asm volatile(LOCK_PREFIX "subq %1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %1,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "er" (i), "m" (v->counter));
+ }
+@@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
++	asm volatile(LOCK_PREFIX "subq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "addq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
+  */
+ static inline void atomic64_inc(atomic64_t *v)
+ {
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     : "=m" (v->counter)
++		     : "m" (v->counter));
++}
++
++/**
++ * atomic64_inc_unchecked - increment atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically increments @v by 1.
++ */
++static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
++{
+ 	asm volatile(LOCK_PREFIX "incq %0"
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+@@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
+  */
+ static inline void atomic64_dec(atomic64_t *v)
+ {
+-	asm volatile(LOCK_PREFIX "decq %0"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "=m" (v->counter)
+ 		     : "m" (v->counter));
+ }
+@@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "decq %0; sete %1"
++	asm volatile(LOCK_PREFIX "decq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "incq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "incq %0; sete %1"
++	asm volatile(LOCK_PREFIX "incq %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1: \n"
++		     LOCK_PREFIX "decq %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "m" (v->counter) : "memory");
+ 	return c != 0;
+@@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
++	asm volatile(LOCK_PREFIX "addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     LOCK_PREFIX "subq %2,%0\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     "sets %1\n"
+ 		     : "=m" (v->counter), "=qm" (c)
+ 		     : "er" (i), "m" (v->counter) : "memory");
+ 	return c;
+@@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
+ static inline long atomic64_add_return(long i, atomic64_t *v)
+ {
+ 	long __i = i;
+-	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
++	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++		     "jno 0f\n"
++		     "movq %0, %1\n"
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
++#endif
++
++		     : "+r" (i), "+m" (v->counter)
++		     : : "memory");
++	return i + __i;
++}
++
++/**
++ * atomic64_add_return_unchecked - add and return
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v and returns @i + @v
++ */
++static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
++{
++	long __i = i;
++	asm volatile(LOCK_PREFIX "xaddq %0, %1"
+ 		     : "+r" (i), "+m" (v->counter)
+ 		     : : "memory");
+ 	return i + __i;
+@@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
+ }
+ 
+ #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
++#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
+ #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
+ 
+ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
+@@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t 
+  */
+ static inline int atomic_add_unless(atomic_t *v, int a, int u)
+ {
+-	int c, old;
++	int c, old, new;
+ 	c = atomic_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic_cmpxchg((v), c, c + (a));
++
++		asm volatile("addl %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "ir" (a));
++
++		old = atomic_cmpxchg(v, c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+@@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
+  */
+ static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+-	long c, old;
++	long c, old, new;
+ 	c = atomic64_read(v);
+ 	for (;;) {
+-		if (unlikely(c == (u)))
++		if (unlikely(c == u))
+ 			break;
+-		old = atomic64_cmpxchg((v), c, c + (a));
++
++		asm volatile("addq %2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "int $4\n0:\n"
++			     _ASM_EXTABLE(0b, 0b)
++#endif
++
++			     : "=r" (new)
++			     : "0" (c), "er" (a));
++
++		old = atomic64_cmpxchg((v), c, new);
+ 		if (likely(old == c))
+ 			break;
+ 		c = old;
+ 	}
+-	return c != (u);
++	return c != u;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/boot.h linux-2.6.32.14/arch/x86/include/asm/boot.h
+--- linux-2.6.32.14/arch/x86/include/asm/boot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/boot.h	2010-05-28 21:27:14.906924566 -0400
+@@ -11,10 +11,15 @@
+ #include <asm/pgtable_types.h>
+ 
+ /* Physical address where kernel should be loaded. */
+-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
++#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
+ 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
+ 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
+ 
++#ifndef __ASSEMBLY__
++extern unsigned char __LOAD_PHYSICAL_ADDR[];
++#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
++#endif
++
+ /* Minimum kernel alignment, as a power of two */
+ #ifdef CONFIG_X86_64
+ #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/cacheflush.h linux-2.6.32.14/arch/x86/include/asm/cacheflush.h
+--- linux-2.6.32.14/arch/x86/include/asm/cacheflush.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/cacheflush.h	2010-05-28 21:27:14.906924566 -0400
+@@ -60,7 +60,7 @@ PAGEFLAG(WC, WC)
+ static inline unsigned long get_page_memtype(struct page *pg)
+ {
+ 	if (!PageUncached(pg) && !PageWC(pg))
+-		return -1;
++		return ~0UL;
+ 	else if (!PageUncached(pg) && PageWC(pg))
+ 		return _PAGE_CACHE_WC;
+ 	else if (PageUncached(pg) && !PageWC(pg))
+@@ -85,7 +85,7 @@ static inline void set_page_memtype(stru
+ 		SetPageWC(pg);
+ 		break;
+ 	default:
+-	case -1:
++	case ~0UL:
+ 		ClearPageUncached(pg);
+ 		ClearPageWC(pg);
+ 		break;
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/cache.h linux-2.6.32.14/arch/x86/include/asm/cache.h
+--- linux-2.6.32.14/arch/x86/include/asm/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/cache.h	2010-05-28 21:27:14.906924566 -0400
+@@ -8,6 +8,7 @@
+ #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+ 
+ #define __read_mostly __attribute__((__section__(".data.read_mostly")))
++#define __read_only __attribute__((__section__(".data.read_only")))
+ 
+ #ifdef CONFIG_X86_VSMP
+ /* vSMP Internode cacheline shift */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/checksum_32.h linux-2.6.32.14/arch/x86/include/asm/checksum_32.h
+--- linux-2.6.32.14/arch/x86/include/asm/checksum_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/checksum_32.h	2010-05-28 21:27:14.906924566 -0400
+@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
+ 					    int len, __wsum sum,
+ 					    int *src_err_ptr, int *dst_err_ptr);
+ 
++asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
++asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
++						  int len, __wsum sum,
++						  int *src_err_ptr, int *dst_err_ptr);
++
+ /*
+  *	Note: when you get a NULL pointer exception here this means someone
+  *	passed in an incorrect kernel address to one of these functions.
+@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
+ 						 int *err_ptr)
+ {
+ 	might_sleep();
+-	return csum_partial_copy_generic((__force void *)src, dst,
++	return csum_partial_copy_generic_from_user((__force void *)src, dst,
+ 					 len, sum, err_ptr, NULL);
+ }
+ 
+@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
+ {
+ 	might_sleep();
+ 	if (access_ok(VERIFY_WRITE, dst, len))
+-		return csum_partial_copy_generic(src, (__force void *)dst,
++		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
+ 						 len, sum, NULL, err_ptr);
+ 
+ 	if (len)
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/desc.h linux-2.6.32.14/arch/x86/include/asm/desc.h
+--- linux-2.6.32.14/arch/x86/include/asm/desc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/desc.h	2010-05-28 21:27:14.906924566 -0400
+@@ -4,6 +4,7 @@
+ #include <asm/desc_defs.h>
+ #include <asm/ldt.h>
+ #include <asm/mmu.h>
++#include <asm/pgtable.h>
+ #include <linux/smp.h>
+ 
+ static inline void fill_ldt(struct desc_struct *desc,
+@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
+ 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
+ 	desc->type = (info->read_exec_only ^ 1) << 1;
+ 	desc->type |= info->contents << 2;
++	desc->type |= info->seg_not_present ^ 1;
+ 	desc->s = 1;
+ 	desc->dpl = 0x3;
+ 	desc->p = info->seg_not_present ^ 1;
+@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
+ }
+ 
+ extern struct desc_ptr idt_descr;
+-extern gate_desc idt_table[];
+-
+-struct gdt_page {
+-	struct desc_struct gdt[GDT_ENTRIES];
+-} __attribute__((aligned(PAGE_SIZE)));
+-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
++extern gate_desc idt_table[256];
+ 
++extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
+ static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
+ {
+-	return per_cpu(gdt_page, cpu).gdt;
++	return cpu_gdt_table[cpu];
+ }
+ 
+ #ifdef CONFIG_X86_64
+@@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
+ static inline void native_write_idt_entry(gate_desc *idt, int entry,
+ 					  const gate_desc *gate)
+ {
++	pax_open_kernel();
+ 	memcpy(&idt[entry], gate, sizeof(*gate));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
+ 					  const void *desc)
+ {
++	pax_open_kernel();
+ 	memcpy(&ldt[entry], desc, 8);
++	pax_close_kernel();
+ }
+ 
+ static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
+ 					  const void *desc, int type)
+ {
+ 	unsigned int size;
++
+ 	switch (type) {
+ 	case DESC_TSS:
+ 		size = sizeof(tss_desc);
+@@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
+ 		size = sizeof(struct desc_struct);
+ 		break;
+ 	}
++
++	pax_open_kernel();
+ 	memcpy(&gdt[entry], desc, size);
++	pax_close_kernel();
+ }
+ 
+ static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
+@@ -211,7 +217,9 @@ static inline void native_set_ldt(const 
+ 
+ static inline void native_load_tr_desc(void)
+ {
++	pax_open_kernel();
+ 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_load_gdt(const struct desc_ptr *dtr)
+@@ -246,8 +254,10 @@ static inline void native_load_tls(struc
+ 	unsigned int i;
+ 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+ 
++	pax_open_kernel();
+ 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
+ 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
++	pax_close_kernel();
+ }
+ 
+ #define _LDT_empty(info)				\
+@@ -309,7 +319,7 @@ static inline void set_desc_limit(struct
+ 	desc->limit = (limit >> 16) & 0xf;
+ }
+ 
+-static inline void _set_gate(int gate, unsigned type, void *addr,
++static inline void _set_gate(int gate, unsigned type, const void *addr,
+ 			     unsigned dpl, unsigned ist, unsigned seg)
+ {
+ 	gate_desc s;
+@@ -327,7 +337,7 @@ static inline void _set_gate(int gate, u
+  * Pentium F0 0F bugfix can have resulted in the mapped
+  * IDT being write-protected.
+  */
+-static inline void set_intr_gate(unsigned int n, void *addr)
++static inline void set_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
+@@ -356,19 +366,19 @@ static inline void alloc_intr_gate(unsig
+ /*
+  * This routine sets up an interrupt gate at directory privilege level 3.
+  */
+-static inline void set_system_intr_gate(unsigned int n, void *addr)
++static inline void set_system_intr_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_trap_gate(unsigned int n, void *addr)
++static inline void set_system_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
+ }
+ 
+-static inline void set_trap_gate(unsigned int n, void *addr)
++static inline void set_trap_gate(unsigned int n, const void *addr)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
+@@ -377,19 +387,31 @@ static inline void set_trap_gate(unsigne
+ static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+-	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
++	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
+ }
+ 
+-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
+ }
+ 
+-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
++static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
+ {
+ 	BUG_ON((unsigned)n > 0xFF);
+ 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
+ }
+ 
++#ifdef CONFIG_X86_32
++static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
++{
++	struct desc_struct d;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, base, limit, 0xFB, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
++}
++#endif
++
+ #endif /* _ASM_X86_DESC_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/device.h linux-2.6.32.14/arch/x86/include/asm/device.h
+--- linux-2.6.32.14/arch/x86/include/asm/device.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/device.h	2010-05-28 21:27:14.911025615 -0400
+@@ -6,7 +6,7 @@ struct dev_archdata {
+ 	void	*acpi_handle;
+ #endif
+ #ifdef CONFIG_X86_64
+-struct dma_map_ops *dma_ops;
++	const struct dma_map_ops *dma_ops;
+ #endif
+ #ifdef CONFIG_DMAR
+ 	void *iommu; /* hook for IOMMU specific extension */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/dma-mapping.h linux-2.6.32.14/arch/x86/include/asm/dma-mapping.h
+--- linux-2.6.32.14/arch/x86/include/asm/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/dma-mapping.h	2010-05-28 21:27:14.911025615 -0400
+@@ -25,9 +25,9 @@ extern int iommu_merge;
+ extern struct device x86_dma_fallback_dev;
+ extern int panic_on_overflow;
+ 
+-extern struct dma_map_ops *dma_ops;
++extern const struct dma_map_ops *dma_ops;
+ 
+-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
++static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
+ {
+ #ifdef CONFIG_X86_32
+ 	return dma_ops;
+@@ -44,7 +44,7 @@ static inline struct dma_map_ops *get_dm
+ /* Make sure we keep the same behaviour */
+ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	if (ops->mapping_error)
+ 		return ops->mapping_error(dev, dma_addr);
+ 
+@@ -122,7 +122,7 @@ static inline void *
+ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
+ 		gfp_t gfp)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	void *memory;
+ 
+ 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+@@ -149,7 +149,7 @@ dma_alloc_coherent(struct device *dev, s
+ static inline void dma_free_coherent(struct device *dev, size_t size,
+ 				     void *vaddr, dma_addr_t bus)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	WARN_ON(irqs_disabled());       /* for portability */
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/e820.h linux-2.6.32.14/arch/x86/include/asm/e820.h
+--- linux-2.6.32.14/arch/x86/include/asm/e820.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/e820.h	2010-05-28 21:27:14.911025615 -0400
+@@ -133,7 +133,7 @@ extern char *default_machine_specific_me
+ #define ISA_END_ADDRESS		0x100000
+ #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
+ 
+-#define BIOS_BEGIN		0x000a0000
++#define BIOS_BEGIN		0x000c0000
+ #define BIOS_END		0x00100000
+ 
+ #ifdef __KERNEL__
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/elf.h linux-2.6.32.14/arch/x86/include/asm/elf.h
+--- linux-2.6.32.14/arch/x86/include/asm/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/elf.h	2010-05-28 21:27:14.911025615 -0400
+@@ -257,7 +257,25 @@ extern int force_personality32;
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
++#else
+ #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++#ifdef CONFIG_X86_32
++#define PAX_ELF_ET_DYN_BASE	0x10000000UL
++
++#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
++#else
++#define PAX_ELF_ET_DYN_BASE	0x400000UL
++
++#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
++#endif
++#endif
+ 
+ /* This yields a mask that user programs can use to figure out what
+    instruction set this CPU supports.  This could be done in user space,
+@@ -311,8 +329,7 @@ do {									\
+ #define ARCH_DLINFO							\
+ do {									\
+ 	if (vdso_enabled)						\
+-		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
+-			    (unsigned long)current->mm->context.vdso);	\
++		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
+ } while (0)
+ 
+ #define AT_SYSINFO		32
+@@ -323,7 +340,7 @@ do {									\
+ 
+ #endif /* !CONFIG_X86_32 */
+ 
+-#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
++#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
+ 
+ #define VDSO_ENTRY							\
+ 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
+@@ -337,7 +354,4 @@ extern int arch_setup_additional_pages(s
+ extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
+ #define compat_arch_setup_additional_pages	syscall32_setup_pages
+ 
+-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
+-#define arch_randomize_brk arch_randomize_brk
+-
+ #endif /* _ASM_X86_ELF_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/futex.h linux-2.6.32.14/arch/x86/include/asm/futex.h
+--- linux-2.6.32.14/arch/x86/include/asm/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/futex.h	2010-05-28 21:27:14.911025615 -0400
+@@ -11,17 +11,54 @@
+ #include <asm/processor.h>
+ #include <asm/system.h>
+ 
++#ifdef CONFIG_X86_32
+ #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile(						\
++		     "movw\t%w6, %%ds\n"			\
++		     "1:\t" insn "\n"				\
++		     "2:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%ds\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "3:\tmov\t%3, %1\n"			\
++		     "\tjmp\t2b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 3b)			\
++		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
++
++#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	asm volatile("movw\t%w7, %%es\n"			\
++		     "1:\tmovl\t%%es:%2, %0\n"			\
++		     "\tmovl\t%0, %3\n"				\
++		     "\t" insn "\n"				\
++		     "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
++		     "\tjnz\t1b\n"				\
++		     "3:\tpushl\t%%ss\n"			\
++		     "\tpopl\t%%es\n"				\
++		     "\t.section .fixup,\"ax\"\n"		\
++		     "4:\tmov\t%5, %1\n"			\
++		     "\tjmp\t3b\n"				\
++		     "\t.previous\n"				\
++		     _ASM_EXTABLE(1b, 4b)			\
++		     _ASM_EXTABLE(2b, 4b)			\
++		     : "=&a" (oldval), "=&r" (ret),		\
++		       "+m" (*uaddr), "=&r" (tem)		\
++		     : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
++#else
++#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\t" insn "\n"				\
+ 		     "2:\t.section .fixup,\"ax\"\n"		\
+ 		     "3:\tmov\t%3, %1\n"			\
+ 		     "\tjmp\t2b\n"				\
+ 		     "\t.previous\n"				\
+ 		     _ASM_EXTABLE(1b, 3b)			\
+-		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
++		     : "=r" (oldval), "=r" (ret),		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))\
+ 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
+ 
+ #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
++	typecheck(u32 *, uaddr);				\
+ 	asm volatile("1:\tmovl	%2, %0\n"			\
+ 		     "\tmovl\t%0, %3\n"				\
+ 		     "\t" insn "\n"				\
+@@ -34,10 +71,12 @@
+ 		     _ASM_EXTABLE(1b, 4b)			\
+ 		     _ASM_EXTABLE(2b, 4b)			\
+ 		     : "=&a" (oldval), "=&r" (ret),		\
+-		       "+m" (*uaddr), "=&r" (tem)		\
++		       "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4)),\
++		       "=&r" (tem)				\
+ 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
++#endif
+ 
+-static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
++static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -61,11 +100,20 @@ static inline int futex_atomic_op_inuser
+ 
+ 	switch (op) {
+ 	case FUTEX_OP_SET:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
++#else
+ 		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_ADD:
++#ifdef CONFIG_X86_32
++		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
++				   uaddr, oparg);
++#else
+ 		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
+ 				   uaddr, oparg);
++#endif
+ 		break;
+ 	case FUTEX_OP_OR:
+ 		__futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
+@@ -109,7 +157,7 @@ static inline int futex_atomic_op_inuser
+ 	return ret;
+ }
+ 
+-static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
++static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
+ 						int newval)
+ {
+ 
+@@ -119,17 +167,31 @@ static inline int futex_atomic_cmpxchg_i
+ 		return -ENOSYS;
+ #endif
+ 
+-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
++	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ 		return -EFAULT;
+ 
+-	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
+-		     "2:\t.section .fixup, \"ax\"\n"
++	asm volatile(
++#ifdef CONFIG_X86_32
++		     "\tmovw %w5, %%ds\n"
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %%ds:%1\n"
++		     "2:\tpushl   %%ss\n"
++		     "\tpopl    %%ds\n"
++#else
++		     "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
++		     "2:\n"
++#endif
++		     "\t.section .fixup, \"ax\"\n"
+ 		     "3:\tmov     %2, %0\n"
+ 		     "\tjmp     2b\n"
+ 		     "\t.previous\n"
+ 		     _ASM_EXTABLE(1b, 3b)
++#ifdef CONFIG_X86_32
+ 		     : "=a" (oldval), "+m" (*uaddr)
++		     : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
++#else
++		     : "=a" (oldval), "+m" (*(uaddr + PAX_USER_SHADOW_BASE / 4))
+ 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
++#endif
+ 		     : "memory"
+ 	);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/i387.h linux-2.6.32.14/arch/x86/include/asm/i387.h
+--- linux-2.6.32.14/arch/x86/include/asm/i387.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/i387.h	2010-05-28 21:27:14.911025615 -0400
+@@ -60,6 +60,11 @@ static inline int fxrstor_checking(struc
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -105,6 +110,11 @@ static inline int fxsave_user(struct i38
+ {
+ 	int err;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
++		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
+ 		     "2:\n"
+ 		     ".section .fixup,\"ax\"\n"
+@@ -195,13 +205,8 @@ static inline int fxrstor_checking(struc
+ }
+ 
+ /* We need a safe address that is cheap to find and that is already
+-   in L1 during context switch. The best choices are unfortunately
+-   different for UP and SMP */
+-#ifdef CONFIG_SMP
+-#define safe_address (__per_cpu_offset[0])
+-#else
+-#define safe_address (kstat_cpu(0).cpustat.user)
+-#endif
++   in L1 during context switch. */
++#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
+ 
+ /*
+  * These must be called with preempt disabled
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/io_64.h linux-2.6.32.14/arch/x86/include/asm/io_64.h
+--- linux-2.6.32.14/arch/x86/include/asm/io_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/io_64.h	2010-05-28 21:27:14.911025615 -0400
+@@ -140,6 +140,17 @@ __OUTS(l)
+ 
+ #include <linux/vmalloc.h>
+ 
++#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
++static inline int valid_phys_addr_range(unsigned long addr, size_t count)
++{
++	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
++static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
++{
++	return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
++}
++
+ #include <asm-generic/iomap.h>
+ 
+ void __memcpy_fromio(void *, unsigned long, unsigned);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/iommu.h linux-2.6.32.14/arch/x86/include/asm/iommu.h
+--- linux-2.6.32.14/arch/x86/include/asm/iommu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/iommu.h	2010-05-28 21:27:14.911025615 -0400
+@@ -3,7 +3,7 @@
+ 
+ extern void pci_iommu_shutdown(void);
+ extern void no_iommu_init(void);
+-extern struct dma_map_ops nommu_dma_ops;
++extern const struct dma_map_ops nommu_dma_ops;
+ extern int force_iommu, no_iommu;
+ extern int iommu_detected;
+ extern int iommu_pass_through;
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/irqflags.h linux-2.6.32.14/arch/x86/include/asm/irqflags.h
+--- linux-2.6.32.14/arch/x86/include/asm/irqflags.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/irqflags.h	2010-05-28 21:27:14.911025615 -0400
+@@ -142,6 +142,11 @@ static inline unsigned long __raw_local_
+ 	sti;					\
+ 	sysexit
+ 
++#define GET_CR0_INTO_RDI		mov %cr0, %rdi
++#define SET_RDI_INTO_CR0		mov %rdi, %cr0
++#define GET_CR3_INTO_RDI		mov %cr3, %rdi
++#define SET_RDI_INTO_CR3		mov %rdi, %cr3
++
+ #else
+ #define INTERRUPT_RETURN		iret
+ #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/kvm_host.h linux-2.6.32.14/arch/x86/include/asm/kvm_host.h
+--- linux-2.6.32.14/arch/x86/include/asm/kvm_host.h	2010-04-29 17:49:37.497949072 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/kvm_host.h	2010-05-28 21:27:14.911025615 -0400
+@@ -532,7 +532,7 @@ struct kvm_x86_ops {
+ 	const struct trace_print_flags *exit_reasons_str;
+ };
+ 
+-extern struct kvm_x86_ops *kvm_x86_ops;
++extern const struct kvm_x86_ops *kvm_x86_ops;
+ 
+ int kvm_mmu_module_init(void);
+ void kvm_mmu_module_exit(void);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/local.h linux-2.6.32.14/arch/x86/include/asm/local.h
+--- linux-2.6.32.14/arch/x86/include/asm/local.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/local.h	2010-05-28 21:27:14.911025615 -0400
+@@ -18,26 +18,90 @@ typedef struct {
+ 
+ static inline void local_inc(local_t *l)
+ {
+-	asm volatile(_ASM_INC "%0"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_dec(local_t *l)
+ {
+-	asm volatile(_ASM_DEC "%0"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter));
+ }
+ 
+ static inline void local_add(long i, local_t *l)
+ {
+-	asm volatile(_ASM_ADD "%1,%0"
++	asm volatile(_ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+ 
+ static inline void local_sub(long i, local_t *l)
+ {
+-	asm volatile(_ASM_SUB "%1,%0"
++	asm volatile(_ASM_SUB "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (l->a.counter)
+ 		     : "ir" (i));
+ }
+@@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_SUB "%2,%0; sete %1"
++	asm volatile(_ASM_SUB "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_ADD "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_DEC "%0; sete %1"
++	asm volatile(_ASM_DEC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_INC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_INC "%0; sete %1"
++	asm volatile(_ASM_INC "%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_DEC "%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sete %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : : "memory");
+ 	return c != 0;
+@@ -110,7 +225,24 @@ static inline int local_add_negative(lon
+ {
+ 	unsigned char c;
+ 
+-	asm volatile(_ASM_ADD "%2,%0; sets %1"
++	asm volatile(_ASM_ADD "%2,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_SUB "%2,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "sets %1\n"
+ 		     : "+m" (l->a.counter), "=qm" (c)
+ 		     : "ir" (i) : "memory");
+ 	return c;
+@@ -133,7 +265,23 @@ static inline long local_add_return(long
+ #endif
+ 	/* Modern 486+ processor */
+ 	__i = i;
+-	asm volatile(_ASM_XADD "%0, %1;"
++	asm volatile(_ASM_XADD "%0, %1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     _ASM_MOV "%0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (i), "+m" (l->a.counter)
+ 		     : : "memory");
+ 	return i + __i;
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/mc146818rtc.h linux-2.6.32.14/arch/x86/include/asm/mc146818rtc.h
+--- linux-2.6.32.14/arch/x86/include/asm/mc146818rtc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/mc146818rtc.h	2010-05-28 21:27:14.911025615 -0400
+@@ -81,8 +81,8 @@ static inline unsigned char current_lock
+ #else
+ #define lock_cmos_prefix(reg) do {} while (0)
+ #define lock_cmos_suffix(reg) do {} while (0)
+-#define lock_cmos(reg)
+-#define unlock_cmos()
++#define lock_cmos(reg) do {} while (0)
++#define unlock_cmos() do {} while (0)
+ #define do_i_have_lock_cmos() 0
+ #define current_lock_cmos_reg() 0
+ #endif
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/microcode.h linux-2.6.32.14/arch/x86/include/asm/microcode.h
+--- linux-2.6.32.14/arch/x86/include/asm/microcode.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/microcode.h	2010-05-28 21:27:14.911025615 -0400
+@@ -12,13 +12,13 @@ struct device;
+ enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
+ 
+ struct microcode_ops {
+-	enum ucode_state (*request_microcode_user) (int cpu,
++	enum ucode_state (* const request_microcode_user) (int cpu,
+ 				const void __user *buf, size_t size);
+ 
+-	enum ucode_state (*request_microcode_fw) (int cpu,
++	enum ucode_state (* const request_microcode_fw) (int cpu,
+ 				struct device *device);
+ 
+-	void (*microcode_fini_cpu) (int cpu);
++	void (* const microcode_fini_cpu) (int cpu);
+ 
+ 	/*
+ 	 * The generic 'microcode_core' part guarantees that
+@@ -38,18 +38,18 @@ struct ucode_cpu_info {
+ extern struct ucode_cpu_info ucode_cpu_info[];
+ 
+ #ifdef CONFIG_MICROCODE_INTEL
+-extern struct microcode_ops * __init init_intel_microcode(void);
++extern const struct microcode_ops * __init init_intel_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_intel_microcode(void)
++static inline const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return NULL;
+ }
+ #endif /* CONFIG_MICROCODE_INTEL */
+ 
+ #ifdef CONFIG_MICROCODE_AMD
+-extern struct microcode_ops * __init init_amd_microcode(void);
++extern const struct microcode_ops * __init init_amd_microcode(void);
+ #else
+-static inline struct microcode_ops * __init init_amd_microcode(void)
++static inline const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/mman.h linux-2.6.32.14/arch/x86/include/asm/mman.h
+--- linux-2.6.32.14/arch/x86/include/asm/mman.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/mman.h	2010-05-28 21:27:14.911025615 -0400
+@@ -5,4 +5,14 @@
+ 
+ #include <asm-generic/mman.h>
+ 
++#ifdef __KERNEL__
++#ifndef __ASSEMBLY__
++#ifdef CONFIG_X86_32
++#define arch_mmap_check	i386_mmap_check
++int i386_mmap_check(unsigned long addr, unsigned long len,
++		unsigned long flags);
++#endif
++#endif
++#endif
++
+ #endif /* _ASM_X86_MMAN_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/mmu_context.h linux-2.6.32.14/arch/x86/include/asm/mmu_context.h
+--- linux-2.6.32.14/arch/x86/include/asm/mmu_context.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/mmu_context.h	2010-05-28 21:27:14.915041226 -0400
+@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
+ 
+ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+ {
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	unsigned int i;
++	pgd_t *pgd;
++
++	pax_open_kernel();
++	pgd = get_cpu_pgd(smp_processor_id());
++	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
++		if (paravirt_enabled())
++			set_pgd(pgd+i, native_make_pgd(0));
++		else
++			pgd[i] = native_make_pgd(0);
++	pax_close_kernel();
++#endif
++
+ #ifdef CONFIG_SMP
+ 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
+@@ -34,27 +49,70 @@ static inline void switch_mm(struct mm_s
+ 			     struct task_struct *tsk)
+ {
+ 	unsigned cpu = smp_processor_id();
++#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
++	int tlbstate = TLBSTATE_OK;
++#endif
+ 
+ 	if (likely(prev != next)) {
+ 		/* stop flush ipis for the previous mm */
+ 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ #ifdef CONFIG_SMP
++#ifdef CONFIG_X86_32
++		tlbstate = percpu_read(cpu_tlbstate.state);
++#endif
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		percpu_write(cpu_tlbstate.active_mm, next);
+ #endif
+ 		cpumask_set_cpu(cpu, mm_cpumask(next));
+ 
+ 		/* Re-load page tables */
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#else
+ 		load_cr3(next->pgd);
++#endif
+ 
+ 		/*
+ 		 * load the LDT, if the LDT is different:
+ 		 */
+ 		if (unlikely(prev->context.ldt != next->context.ldt))
+ 			load_LDT_nolock(&next->context);
+-	}
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		if (!nx_enabled) {
++			smp_mb__before_clear_bit();
++			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
++			smp_mb__after_clear_bit();
++			cpu_set(cpu, next->context.cpu_user_cs_mask);
++		}
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
++			     prev->context.user_cs_limit != next->context.user_cs_limit))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
+ #ifdef CONFIG_SMP
++		else if (unlikely(tlbstate != TLBSTATE_OK))
++			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++#endif
++
++	}
+ 	else {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		pax_open_kernel();
++		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
++		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
++		pax_close_kernel();
++		load_cr3(get_cpu_pgd(cpu));
++#endif
++
++#ifdef CONFIG_SMP
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
+ 
+@@ -63,11 +121,28 @@ static inline void switch_mm(struct mm_s
+ 			 * tlb flush IPI delivery. We must reload CR3
+ 			 * to make sure to use no freed page tables.
+ 			 */
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 			load_cr3(next->pgd);
++#endif
++
+ 			load_LDT_nolock(&next->context);
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++			if (!nx_enabled)
++				cpu_set(cpu, next->context.cpu_user_cs_mask);
++#endif
++
++#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
++#endif
++				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
++#endif
++
+ 		}
+-	}
+ #endif
++	}
+ }
+ 
+ #define activate_mm(prev, next)			\
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/mmu.h linux-2.6.32.14/arch/x86/include/asm/mmu.h
+--- linux-2.6.32.14/arch/x86/include/asm/mmu.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/mmu.h	2010-05-28 21:27:14.915041226 -0400
+@@ -9,10 +9,23 @@
+  * we put the segment information here.
+  */
+ typedef struct {
+-	void *ldt;
++	struct desc_struct *ldt;
+ 	int size;
+ 	struct mutex lock;
+-	void *vdso;
++	unsigned long vdso;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	unsigned long user_cs_base;
++	unsigned long user_cs_limit;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++	cpumask_t cpu_user_cs_mask;
++#endif
++
++#endif
++#endif
++
+ } mm_context_t;
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/module.h linux-2.6.32.14/arch/x86/include/asm/module.h
+--- linux-2.6.32.14/arch/x86/include/asm/module.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/module.h	2010-05-28 21:27:14.915041226 -0400
+@@ -59,13 +59,31 @@
+ #error unknown processor family
+ #endif
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define MODULE_PAX_UDEREF "UDEREF "
++#else
++#define MODULE_PAX_UDEREF ""
++#endif
++
+ #ifdef CONFIG_X86_32
+ # ifdef CONFIG_4KSTACKS
+ #  define MODULE_STACKSIZE "4KSTACKS "
+ # else
+ #  define MODULE_STACKSIZE ""
+ # endif
+-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
++# ifdef CONFIG_PAX_KERNEXEC
++#  define MODULE_PAX_KERNEXEC "KERNEXEC "
++# else
++#  define MODULE_PAX_KERNEXEC ""
++# endif
++# ifdef CONFIG_GRKERNSEC
++#  define MODULE_GRSEC "GRSECURITY "
++# else
++#  define MODULE_GRSEC ""
++# endif
++# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
++#else
++# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
+ #endif
+ 
+ #endif /* _ASM_X86_MODULE_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/page_32_types.h linux-2.6.32.14/arch/x86/include/asm/page_32_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/page_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/page_32_types.h	2010-05-28 21:27:14.915041226 -0400
+@@ -15,6 +15,10 @@
+  */
+ #define __PAGE_OFFSET		_AC(CONFIG_PAGE_OFFSET, UL)
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
++#endif
++
+ #ifdef CONFIG_4KSTACKS
+ #define THREAD_ORDER	0
+ #else
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/page_64_types.h linux-2.6.32.14/arch/x86/include/asm/page_64_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/page_64_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/page_64_types.h	2010-05-28 21:27:14.915041226 -0400
+@@ -39,6 +39,9 @@
+ #define __START_KERNEL		(__START_KERNEL_map + __PHYSICAL_START)
+ #define __START_KERNEL_map	_AC(0xffffffff80000000, UL)
+ 
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++
+ /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
+ #define __PHYSICAL_MASK_SHIFT	46
+ #define __VIRTUAL_MASK_SHIFT	47
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/paravirt.h linux-2.6.32.14/arch/x86/include/asm/paravirt.h
+--- linux-2.6.32.14/arch/x86/include/asm/paravirt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/paravirt.h	2010-05-28 21:27:14.915041226 -0400
+@@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
+ 	pv_mmu_ops.set_fixmap(idx, phys, flags);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long pax_open_kernel(void)
++{
++	return pv_mmu_ops.pax_open_kernel();
++}
++
++static inline unsigned long pax_close_kernel(void)
++{
++	return pv_mmu_ops.pax_close_kernel();
++}
++#else
++static inline unsigned long pax_open_kernel(void) { return 0; }
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
+ 
+ static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
+@@ -945,7 +960,7 @@ extern void default_banner(void);
+ 
+ #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
+ #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
+-#define PARA_INDIRECT(addr)	*%cs:addr
++#define PARA_INDIRECT(addr)	*%ss:addr
+ #endif
+ 
+ #define INTERRUPT_RETURN						\
+@@ -1022,6 +1037,21 @@ extern void default_banner(void);
+ 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
+ 		  CLBR_NONE,						\
+ 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
++
++#define GET_CR0_INTO_RDI				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR0				\
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++
++#define GET_CR3_INTO_RDI				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
++	mov %rax,%rdi
++
++#define SET_RDI_INTO_CR3				\
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
++
+ #endif	/* CONFIG_X86_32 */
+ 
+ #endif /* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/paravirt_types.h linux-2.6.32.14/arch/x86/include/asm/paravirt_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/paravirt_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/paravirt_types.h	2010-05-28 21:27:14.915041226 -0400
+@@ -316,6 +316,12 @@ struct pv_mmu_ops {
+ 	   an mfn.  We can tell which is which from the index. */
+ 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
+ 			   phys_addr_t phys, pgprot_t flags);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long (*pax_open_kernel)(void);
++	unsigned long (*pax_close_kernel)(void);
++#endif
++
+ };
+ 
+ struct raw_spinlock;
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pci_x86.h linux-2.6.32.14/arch/x86/include/asm/pci_x86.h
+--- linux-2.6.32.14/arch/x86/include/asm/pci_x86.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pci_x86.h	2010-05-28 21:27:14.915041226 -0400
+@@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct 
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+ 
+ struct pci_raw_ops {
+-	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val);
+-	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
++	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 val);
+ };
+ 
+-extern struct pci_raw_ops *raw_pci_ops;
+-extern struct pci_raw_ops *raw_pci_ext_ops;
++extern const struct pci_raw_ops *raw_pci_ops;
++extern const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+-extern struct pci_raw_ops pci_direct_conf1;
++extern const struct pci_raw_ops pci_direct_conf1;
+ extern bool port_cf9_safe;
+ 
+ /* arch_initcall level */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgalloc.h linux-2.6.32.14/arch/x86/include/asm/pgalloc.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgalloc.h	2010-05-28 21:27:14.915041226 -0400
+@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
+ 				       pmd_t *pmd, pte_t *pte)
+ {
+ 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
++	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
++}
++
++static inline void pmd_populate_user(struct mm_struct *mm,
++				       pmd_t *pmd, pte_t *pte)
++{
++	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
+ 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.14/arch/x86/include/asm/pgtable-2level.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable-2level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable-2level.h	2010-05-28 21:27:14.915041226 -0400
+@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable_32.h linux-2.6.32.14/arch/x86/include/asm/pgtable_32.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable_32.h	2010-05-28 21:27:14.915041226 -0400
+@@ -26,8 +26,6 @@
+ struct mm_struct;
+ struct vm_area_struct;
+ 
+-extern pgd_t swapper_pg_dir[1024];
+-
+ static inline void pgtable_cache_init(void) { }
+ static inline void check_pgt_cache(void) { }
+ void paging_init(void);
+@@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
+ # include <asm/pgtable-2level.h>
+ #endif
+ 
++extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
++#ifdef CONFIG_X86_PAE
++extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
++#endif
++
+ #if defined(CONFIG_HIGHPTE)
+ #define __KM_PTE			\
+ 	(in_nmi() ? KM_NMI_PTE : 	\
+@@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
+ /* Clear a kernel PTE and flush it from the TLB */
+ #define kpte_clear_flush(ptep, vaddr)		\
+ do {						\
++	pax_open_kernel();			\
+ 	pte_clear(&init_mm, (vaddr), (ptep));	\
++	pax_close_kernel();			\
+ 	__flush_tlb_one((vaddr));		\
+ } while (0)
+ 
+@@ -84,6 +89,9 @@ do {						\
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
++#define HAVE_ARCH_UNMAPPED_AREA
++#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
++
+ /*
+  * kern_addr_valid() is (1) for FLATMEM and (0) for
+  * SPARSEMEM and DISCONTIGMEM
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.14/arch/x86/include/asm/pgtable_32_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable_32_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable_32_types.h	2010-05-28 21:27:14.915041226 -0400
+@@ -8,7 +8,7 @@
+  */
+ #ifdef CONFIG_X86_PAE
+ # include <asm/pgtable-3level_types.h>
+-# define PMD_SIZE	(1UL << PMD_SHIFT)
++# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
+ # define PMD_MASK	(~(PMD_SIZE - 1))
+ #else
+ # include <asm/pgtable-2level_types.h>
+@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set 
+ # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifndef __ASSEMBLY__
++extern unsigned char MODULES_EXEC_VADDR[];
++extern unsigned char MODULES_EXEC_END[];
++#endif
++#include <asm/boot.h>
++#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
++#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
++#else
++#define ktla_ktva(addr)		(addr)
++#define ktva_ktla(addr)		(addr)
++#endif
++
+ #define MODULES_VADDR	VMALLOC_START
+ #define MODULES_END	VMALLOC_END
+ #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.14/arch/x86/include/asm/pgtable-3level.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable-3level.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable-3level.h	2010-05-28 21:27:14.915041226 -0400
+@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
++	pax_close_kernel();
+ }
+ 
+ static inline void native_set_pud(pud_t *pudp, pud_t pud)
+ {
++	pax_open_kernel();
+ 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
++	pax_close_kernel();
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable_64.h linux-2.6.32.14/arch/x86/include/asm/pgtable_64.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable_64.h	2010-05-28 21:27:14.915041226 -0400
+@@ -16,10 +16,13 @@
+ 
+ extern pud_t level3_kernel_pgt[512];
+ extern pud_t level3_ident_pgt[512];
++extern pud_t level3_vmalloc_pgt[512];
++extern pud_t level3_vmemmap_pgt[512];
++extern pud_t level2_vmemmap_pgt[512];
+ extern pmd_t level2_kernel_pgt[512];
+ extern pmd_t level2_fixmap_pgt[512];
+-extern pmd_t level2_ident_pgt[512];
+-extern pgd_t init_level4_pgt[];
++extern pmd_t level2_ident_pgt[512*2];
++extern pgd_t init_level4_pgt[512];
+ 
+ #define swapper_pg_dir init_level4_pgt
+ 
+@@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
+ 
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
++	pax_open_kernel();
+ 	*pmdp = pmd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pmd_clear(pmd_t *pmd)
+@@ -94,12 +99,18 @@ static inline void native_pud_clear(pud_
+ 
+ static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
++	pax_open_kernel();
+ 	*pgdp = pgd;
++	pax_close_kernel();
+ }
+ 
+ static inline void native_pgd_clear(pgd_t *pgd)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	native_set_pgd(pgd, native_make_pgd(0));
++#endif
++
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.14/arch/x86/include/asm/pgtable_64_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable_64_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable_64_types.h	2010-05-28 21:27:14.915041226 -0400
+@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
+ #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
+ #define MODULES_END      _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
++#define MODULES_EXEC_VADDR MODULES_VADDR
++#define MODULES_EXEC_END MODULES_END
+ 
+ #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable.h linux-2.6.32.14/arch/x86/include/asm/pgtable.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable.h	2010-05-28 21:27:14.918896182 -0400
+@@ -74,12 +74,51 @@ extern struct list_head pgd_list;
+ 
+ #define arch_end_context_switch(prev)	do {} while(0)
+ 
++#define pax_open_kernel()	native_pax_open_kernel()
++#define pax_close_kernel()	native_pax_close_kernel()
+ #endif	/* CONFIG_PARAVIRT */
+ 
++#define  __HAVE_ARCH_PAX_OPEN_KERNEL
++#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
++
++#ifdef CONFIG_PAX_KERNEXEC
++static inline unsigned long native_pax_open_kernel(void)
++{
++	unsigned long cr0;
++
++	preempt_disable();
++	barrier();
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(cr0 & X86_CR0_WP));
++	write_cr0(cr0);
++	return cr0 ^ X86_CR0_WP;
++}
++
++static inline unsigned long native_pax_close_kernel(void)
++{
++	unsigned long cr0;
++
++	cr0 = read_cr0() ^ X86_CR0_WP;
++	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
++	write_cr0(cr0);
++	barrier();
++	preempt_enable_no_resched();
++	return cr0 ^ X86_CR0_WP;
++}
++#else
++static inline unsigned long native_pax_open_kernel(void) { return 0; }
++static inline unsigned long native_pax_close_kernel(void) { return 0; }
++#endif
++
+ /*
+  * The following only work if pte_present() is true.
+  * Undefined behaviour if not..
+  */
++static inline int pte_user(pte_t pte)
++{
++	return pte_val(pte) & _PAGE_USER;
++}
++
+ static inline int pte_dirty(pte_t pte)
+ {
+ 	return pte_flags(pte) & _PAGE_DIRTY;
+@@ -167,9 +206,29 @@ static inline pte_t pte_wrprotect(pte_t 
+ 	return pte_clear_flags(pte, _PAGE_RW);
+ }
+ 
++static inline pte_t pte_mkread(pte_t pte)
++{
++	return __pte(pte_val(pte) | _PAGE_USER);
++}
++
+ static inline pte_t pte_mkexec(pte_t pte)
+ {
+-	return pte_clear_flags(pte, _PAGE_NX);
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_clear_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_set_flags(pte, _PAGE_USER);
++}
++
++static inline pte_t pte_exprotect(pte_t pte)
++{
++#ifdef CONFIG_X86_PAE
++	if (__supported_pte_mask & _PAGE_NX)
++		return pte_set_flags(pte, _PAGE_NX);
++	else
++#endif
++		return pte_clear_flags(pte, _PAGE_USER);
+ }
+ 
+ static inline pte_t pte_mkdirty(pte_t pte)
+@@ -302,6 +361,15 @@ pte_t *populate_extra_pte(unsigned long 
+ #endif
+ 
+ #ifndef __ASSEMBLY__
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
++static inline pgd_t *get_cpu_pgd(unsigned int cpu)
++{
++	return cpu_pgd[cpu];
++}
++#endif
++
+ #include <linux/mm_types.h>
+ 
+ static inline int pte_none(pte_t pte)
+@@ -472,7 +540,7 @@ static inline pud_t *pud_offset(pgd_t *p
+ 
+ static inline int pgd_bad(pgd_t pgd)
+ {
+-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
++	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
+ }
+ 
+ static inline int pgd_none(pgd_t pgd)
+@@ -495,7 +563,12 @@ static inline int pgd_none(pgd_t pgd)
+  * pgd_offset() returns a (pgd_t *)
+  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
+  */
+-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
++#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
++#endif
++
+ /*
+  * a shortcut which implies the use of the kernel's pgd, instead
+  * of a process's
+@@ -506,6 +579,20 @@ static inline int pgd_none(pgd_t pgd)
+ #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
+ #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
+ 
++#ifdef CONFIG_X86_32
++#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
++#else
++#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
++#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
++#else
++#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
++#endif
++
++#endif
++
+ #ifndef __ASSEMBLY__
+ 
+ extern int direct_gbpages;
+@@ -611,11 +698,18 @@ static inline void ptep_set_wrprotect(st
+  * dst and src can be on the same page, but the range must not overlap,
+  * and must not cross a page boundary.
+  */
+-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
++static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
+ {
+-       memcpy(dst, src, count * sizeof(pgd_t));
++	pax_open_kernel();
++	while (count--)
++		*dst++ = *src++;
++	pax_close_kernel();
+ }
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
++#endif
+ 
+ #include <asm-generic/pgtable.h>
+ #endif	/* __ASSEMBLY__ */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/pgtable_types.h linux-2.6.32.14/arch/x86/include/asm/pgtable_types.h
+--- linux-2.6.32.14/arch/x86/include/asm/pgtable_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/pgtable_types.h	2010-05-28 21:27:14.918896182 -0400
+@@ -16,12 +16,11 @@
+ #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
+ #define _PAGE_BIT_PAT		7	/* on 4KB pages */
+ #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
+-#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
++#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
+ #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
+ #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
+ #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
+-#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
+-#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
++#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
+ #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
+ 
+ /* If _PAGE_BIT_PRESENT is clear, we use these: */
+@@ -39,7 +38,6 @@
+ #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
+ #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
+ #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
+-#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
+ #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
+ #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
+ #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
+@@ -55,8 +53,10 @@
+ 
+ #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+ #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
+-#else
++#elif defined(CONFIG_KMEMCHECK)
+ #define _PAGE_NX	(_AT(pteval_t, 0))
++#else
++#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
+ #endif
+ 
+ #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
+@@ -93,6 +93,9 @@
+ #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
+ 					 _PAGE_ACCESSED)
+ 
++#define PAGE_READONLY_NOEXEC PAGE_READONLY
++#define PAGE_SHARED_NOEXEC PAGE_SHARED
++
+ #define __PAGE_KERNEL_EXEC						\
+ 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
+ #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
+@@ -103,8 +106,8 @@
+ #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
+ #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
+ #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
+-#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
+-#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
++#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
++#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
+ #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
+ #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
+@@ -163,8 +166,8 @@
+  * bits are combined, this will alow user to access the high address mapped
+  * VDSO in the presence of CONFIG_COMPAT_VDSO
+  */
+-#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
+-#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
++#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
++#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
+ #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
+ #endif
+ 
+@@ -278,7 +281,16 @@ typedef struct page *pgtable_t;
+ 
+ extern pteval_t __supported_pte_mask;
+ extern void set_nx(void);
++
++#ifdef CONFIG_X86_32
++#ifdef CONFIG_X86_PAE
+ extern int nx_enabled;
++#else
++#define nx_enabled (0)
++#endif
++#else
++#define nx_enabled (1)
++#endif
+ 
+ #define pgprot_writecombine	pgprot_writecombine
+ extern pgprot_t pgprot_writecombine(pgprot_t prot);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/processor.h linux-2.6.32.14/arch/x86/include/asm/processor.h
+--- linux-2.6.32.14/arch/x86/include/asm/processor.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/processor.h	2010-05-28 21:27:14.918896182 -0400
+@@ -272,7 +272,7 @@ struct tss_struct {
+ 
+ } ____cacheline_aligned;
+ 
+-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
++extern struct tss_struct init_tss[NR_CPUS];
+ 
+ /*
+  * Save the original ist values for checking stack pointers during debugging
+@@ -911,8 +911,15 @@ static inline void spin_lock_prefetch(co
+  */
+ #define TASK_SIZE		PAGE_OFFSET
+ #define TASK_SIZE_MAX		TASK_SIZE
++
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
++#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
++#else
+ #define STACK_TOP		TASK_SIZE
+-#define STACK_TOP_MAX		STACK_TOP
++#endif
++
++#define STACK_TOP_MAX		TASK_SIZE
+ 
+ #define INIT_THREAD  {							  \
+ 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
+@@ -929,7 +936,7 @@ static inline void spin_lock_prefetch(co
+  */
+ #define INIT_TSS  {							  \
+ 	.x86_tss = {							  \
+-		.sp0		= sizeof(init_stack) + (long)&init_stack, \
++		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
+ 		.ss0		= __KERNEL_DS,				  \
+ 		.ss1		= __KERNEL_CS,				  \
+ 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
+@@ -940,11 +947,7 @@ static inline void spin_lock_prefetch(co
+ extern unsigned long thread_saved_pc(struct task_struct *tsk);
+ 
+ #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
+-#define KSTK_TOP(info)                                                 \
+-({                                                                     \
+-       unsigned long *__ptr = (unsigned long *)(info);                 \
+-       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
+-})
++#define KSTK_TOP(info)         ((info)->task.thread.sp0)
+ 
+ /*
+  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
+@@ -959,7 +962,7 @@ extern unsigned long thread_saved_pc(str
+ #define task_pt_regs(task)                                             \
+ ({                                                                     \
+        struct pt_regs *__regs__;                                       \
+-       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
++       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
+        __regs__ - 1;                                                   \
+ })
+ 
+@@ -969,13 +972,13 @@ extern unsigned long thread_saved_pc(str
+ /*
+  * User space process size. 47bits minus one guard page.
+  */
+-#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
++#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
+ 
+ /* This decides where the kernel will search for a free chunk of vm
+  * space during mmap's.
+  */
+ #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
+-					0xc0000000 : 0xFFFFe000)
++					0xc0000000 : 0xFFFFf000)
+ 
+ #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
+ 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
+@@ -1012,6 +1015,10 @@ extern void start_thread(struct pt_regs 
+  */
+ #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
++#endif
++
+ #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
+ 
+ /* Get/set a process' ability to use the timestamp counter instruction */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/ptrace.h linux-2.6.32.14/arch/x86/include/asm/ptrace.h
+--- linux-2.6.32.14/arch/x86/include/asm/ptrace.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/ptrace.h	2010-05-28 21:27:14.918896182 -0400
+@@ -151,28 +151,29 @@ static inline unsigned long regs_return_
+ }
+ 
+ /*
+- * user_mode_vm(regs) determines whether a register set came from user mode.
++ * user_mode(regs) determines whether a register set came from user mode.
+  * This is true if V8086 mode was enabled OR if the register set was from
+  * protected mode with RPL-3 CS value.  This tricky test checks that with
+  * one comparison.  Many places in the kernel can bypass this full check
+- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
++ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
++ * be used.
+  */
+-static inline int user_mode(struct pt_regs *regs)
++static inline int user_mode_novm(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
+ #else
+-	return !!(regs->cs & 3);
++	return !!(regs->cs & SEGMENT_RPL_MASK);
+ #endif
+ }
+ 
+-static inline int user_mode_vm(struct pt_regs *regs)
++static inline int user_mode(struct pt_regs *regs)
+ {
+ #ifdef CONFIG_X86_32
+ 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
+ 		USER_RPL;
+ #else
+-	return user_mode(regs);
++	return user_mode_novm(regs);
+ #endif
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/reboot.h linux-2.6.32.14/arch/x86/include/asm/reboot.h
+--- linux-2.6.32.14/arch/x86/include/asm/reboot.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/reboot.h	2010-05-28 21:27:14.918896182 -0400
+@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
+ 
+ void native_machine_crash_shutdown(struct pt_regs *regs);
+ void native_machine_shutdown(void);
+-void machine_real_restart(const unsigned char *code, int length);
++void machine_real_restart(const unsigned char *code, unsigned int length);
+ 
+ typedef void (*nmi_shootdown_cb)(int, struct die_args*);
+ void nmi_shootdown_cpus(nmi_shootdown_cb callback);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/rwsem.h linux-2.6.32.14/arch/x86/include/asm/rwsem.h
+--- linux-2.6.32.14/arch/x86/include/asm/rwsem.h	2010-04-29 17:49:37.501451369 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/rwsem.h	2010-05-28 21:27:14.918896182 -0400
+@@ -118,10 +118,26 @@ static inline void __down_read(struct rw
+ {
+ 	asm volatile("# beginning down_read\n\t"
+ 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* adds 0x00000001, returns the old value */
+-		     "  jns        1f\n"
++		     "  jns        2f\n"
+ 		     "  call call_rwsem_down_read_failed\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending down_read\n\t"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem)
+@@ -136,13 +152,29 @@ static inline int __down_read_trylock(st
+ 	rwsem_count_t result, tmp;
+ 	asm volatile("# beginning __down_read_trylock\n\t"
+ 		     "  mov          %0,%1\n\t"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "  mov          %1,%2\n\t"
+ 		     "  add          %3,%2\n\t"
+-		     "  jle	     2f\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "sub %3,%2\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "  jle	     3f\n\t"
+ 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
+-		     "  jnz	     1b\n\t"
+-		     "2:\n\t"
++		     "  jnz	     2b\n\t"
++		     "3:\n\t"
+ 		     "# ending __down_read_trylock\n\t"
+ 		     : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
+ 		     : "i" (RWSEM_ACTIVE_READ_BIAS)
+@@ -160,12 +192,28 @@ static inline void __down_write_nested(s
+ 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
+ 	asm volatile("# beginning down_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtract 0x0000ffff, returns the old value */
+ 		     "  test      %1,%1\n\t"
+ 		     /* was the count 0 before? */
+-		     "  jz        1f\n"
++		     "  jz        2f\n"
+ 		     "  call call_rwsem_down_write_failed\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending down_write"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -198,10 +246,26 @@ static inline void __up_read(struct rw_s
+ 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
+ 	asm volatile("# beginning __up_read\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* subtracts 1, returns the old value */
+-		     "  jns        1f\n\t"
++		     "  jns        2f\n\t"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n"
++		     "2:\n"
+ 		     "# ending __up_read\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (tmp)
+@@ -216,11 +280,27 @@ static inline void __up_write(struct rw_
+ 	rwsem_count_t tmp;
+ 	asm volatile("# beginning __up_write\n\t"
+ 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %1,(%2)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /* tries to transition
+ 			0xffff0001 -> 0x00000000 */
+-		     "  jz       1f\n"
++		     "  jz       2f\n"
+ 		     "  call call_rwsem_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __up_write\n"
+ 		     : "+m" (sem->count), "=d" (tmp)
+ 		     : "a" (sem), "1" (-RWSEM_ACTIVE_WRITE_BIAS)
+@@ -234,13 +314,29 @@ static inline void __downgrade_write(str
+ {
+ 	asm volatile("# beginning __downgrade_write\n\t"
+ 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     /*
+ 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
+ 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
+ 		      */
+-		     "  jns       1f\n\t"
++		     "  jns       2f\n\t"
+ 		     "  call call_rwsem_downgrade_wake\n"
+-		     "1:\n\t"
++		     "2:\n\t"
+ 		     "# ending __downgrade_write\n"
+ 		     : "+m" (sem->count)
+ 		     : "a" (sem), "er" (-RWSEM_WAITING_BIAS)
+@@ -253,7 +349,23 @@ static inline void __downgrade_write(str
+ static inline void rwsem_atomic_add(rwsem_count_t delta,
+ 				    struct rw_semaphore *sem)
+ {
+-	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
++	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (sem->count)
+ 		     : "er" (delta));
+ }
+@@ -266,7 +378,23 @@ static inline rwsem_count_t rwsem_atomic
+ {
+ 	rwsem_count_t tmp = delta;
+ 
+-	asm volatile(LOCK_PREFIX "xadd %0,%1"
++	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     "mov %0,%1\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+r" (tmp), "+m" (sem->count)
+ 		     : : "memory");
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/segment.h linux-2.6.32.14/arch/x86/include/asm/segment.h
+--- linux-2.6.32.14/arch/x86/include/asm/segment.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/segment.h	2010-05-28 21:27:14.918896182 -0400
+@@ -62,8 +62,8 @@
+  *  26 - ESPFIX small SS
+  *  27 - per-cpu			[ offset to per-cpu data area ]
+  *  28 - stack_canary-20		[ for stack protector ]
+- *  29 - unused
+- *  30 - unused
++ *  29 - PCI BIOS CS
++ *  30 - PCI BIOS DS
+  *  31 - TSS for double fault handler
+  */
+ #define GDT_ENTRY_TLS_MIN	6
+@@ -77,6 +77,8 @@
+ 
+ #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
++
+ #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
+ 
+ #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
+@@ -88,7 +90,7 @@
+ #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
+ #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
+ 
+-#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
++#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
+ #ifdef CONFIG_SMP
+ #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
+ #else
+@@ -102,6 +104,12 @@
+ #define __KERNEL_STACK_CANARY		0
+ #endif
+ 
++#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
++#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
++
++#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
++#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
++
+ #define GDT_ENTRY_DOUBLEFAULT_TSS	31
+ 
+ /*
+@@ -139,7 +147,7 @@
+  */
+ 
+ /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
+-#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
++#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
+ 
+ 
+ #else
+@@ -163,6 +171,8 @@
+ #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
+ #define __USER32_DS	__USER_DS
+ 
++#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
++
+ #define GDT_ENTRY_TSS 8	/* needs two entries */
+ #define GDT_ENTRY_LDT 10 /* needs two entries */
+ #define GDT_ENTRY_TLS_MIN 12
+@@ -183,6 +193,7 @@
+ #endif
+ 
+ #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
++#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
+ #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
+ #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
+ #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/spinlock.h linux-2.6.32.14/arch/x86/include/asm/spinlock.h
+--- linux-2.6.32.14/arch/x86/include/asm/spinlock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/spinlock.h	2010-05-28 21:27:14.918896182 -0400
+@@ -249,18 +249,50 @@ static inline int __raw_write_can_lock(r
+ static inline void __raw_read_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
+-		     "jns 1f\n"
+-		     "call __read_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl $1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jns 2f\n"
++		     "call __read_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw) : "memory");
+ }
+ 
+ static inline void __raw_write_lock(raw_rwlock_t *rw)
+ {
+ 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
+-		     "jz 1f\n"
+-		     "call __write_lock_failed\n\t"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
+ 		     "1:\n"
++		     LOCK_PREFIX " addl %1,(%0)\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     "jz 2f\n"
++		     "call __write_lock_failed\n\t"
++		     "2:\n"
+ 		     ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+@@ -286,12 +318,45 @@ static inline int __raw_write_trylock(ra
+ 
+ static inline void __raw_read_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
++	asm volatile(LOCK_PREFIX "incl %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "decl %0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
++		     :"+m" (rw->lock) : : "memory");
+ }
+ 
+ static inline void __raw_write_unlock(raw_rwlock_t *rw)
+ {
+-	asm volatile(LOCK_PREFIX "addl %1, %0"
++	asm volatile(LOCK_PREFIX "addl %1, %0\n"
++
++#ifdef CONFIG_PAX_REFCOUNT
++#ifdef CONFIG_X86_32
++		     "into\n0:\n"
++#else
++		     "jno 0f\n"
++		     "int $4\n0:\n"
++#endif
++		     ".pushsection .fixup,\"ax\"\n"
++		     "1:\n"
++		     LOCK_PREFIX "subl %1,%0\n"
++		     "jmp 0b\n"
++		     ".popsection\n"
++		     _ASM_EXTABLE(0b, 1b)
++#endif
++
+ 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/system.h linux-2.6.32.14/arch/x86/include/asm/system.h
+--- linux-2.6.32.14/arch/x86/include/asm/system.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/system.h	2010-05-28 21:27:14.922894828 -0400
+@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
+ {
+ 	unsigned long __limit;
+ 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
+-	return __limit + 1;
++	return __limit;
+ }
+ 
+ static inline void native_clts(void)
+@@ -340,7 +340,7 @@ void enable_hlt(void);
+ 
+ void cpu_idle_wait(void);
+ 
+-extern unsigned long arch_align_stack(unsigned long sp);
++#define arch_align_stack(x) ((x) & ~0xfUL)
+ extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
+ 
+ void default_idle(void);
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/uaccess_32.h linux-2.6.32.14/arch/x86/include/asm/uaccess_32.h
+--- linux-2.6.32.14/arch/x86/include/asm/uaccess_32.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/uaccess_32.h	2010-05-28 21:27:14.922894828 -0400
+@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
+ static __always_inline unsigned long __must_check
+ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(from, n, true);
+ 	return __copy_to_user_ll(to, from, n);
+ }
+ 
+@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
+ static __always_inline unsigned long
+ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+ {
++	if ((long)n < 0)
++		return n;
++
+ 	/* Avoid zeroing the tail if the copy fails..
+ 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
+ 	 * but as the zeroing behaviour is only significant when n is not
+@@ -138,6 +146,10 @@ static __always_inline unsigned long
+ __copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
+ 			return ret;
+ 		}
+ 	}
++	if (!__builtin_constant_p(n))
++		check_object_size(to, n, false);
+ 	return __copy_from_user_ll(to, from, n);
+ }
+ 
+@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
+ 				const void __user *from, unsigned long n)
+ {
+ 	might_fault();
++
++	if ((long)n < 0)
++		return n;
++
+ 	if (__builtin_constant_p(n)) {
+ 		unsigned long ret;
+ 
+@@ -182,14 +200,62 @@ static __always_inline unsigned long
+ __copy_from_user_inatomic_nocache(void *to, const void __user *from,
+ 				  unsigned long n)
+ {
+-       return __copy_from_user_ll_nocache_nozero(to, from, n);
++	if ((long)n < 0)
++		return n;
++
++	return __copy_from_user_ll_nocache_nozero(to, from, n);
++}
++
++/**
++ * copy_to_user: - Copy a block of data into user space.
++ * @to:   Destination address, in user space.
++ * @from: Source address, in kernel space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from kernel space to user space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ */
++static __always_inline unsigned long __must_check
++copy_to_user(void __user *to, const void *from, unsigned long n)
++{
++	if (access_ok(VERIFY_WRITE, to, n))
++		n = __copy_to_user(to, from, n);
++	return n;
++}
++
++/**
++ * copy_from_user: - Copy a block of data from user space.
++ * @to:   Destination address, in kernel space.
++ * @from: Source address, in user space.
++ * @n:    Number of bytes to copy.
++ *
++ * Context: User context only.  This function may sleep.
++ *
++ * Copy data from user space to kernel space.
++ *
++ * Returns number of bytes that could not be copied.
++ * On success, this will be zero.
++ *
++ * If some data could not be copied, this function will pad the copied
++ * data to the requested size using zero bytes.
++ */
++static __always_inline unsigned long __must_check
++copy_from_user(void *to, const void __user *from, unsigned long n)
++{
++	if (access_ok(VERIFY_READ, from, n))
++		n = __copy_from_user(to, from, n);
++	else if ((long)n > 0) {
++		if (!__builtin_constant_p(n))
++			check_object_size(to, n, false);
++		memset(to, 0, n);
++	}
++	return n;
+ }
+ 
+-unsigned long __must_check copy_to_user(void __user *to,
+-					const void *from, unsigned long n);
+-unsigned long __must_check copy_from_user(void *to,
+-					  const void __user *from,
+-					  unsigned long n);
+ long __must_check strncpy_from_user(char *dst, const char __user *src,
+ 				    long count);
+ long __must_check __strncpy_from_user(char *dst,
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/uaccess_64.h linux-2.6.32.14/arch/x86/include/asm/uaccess_64.h
+--- linux-2.6.32.14/arch/x86/include/asm/uaccess_64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/uaccess_64.h	2010-05-28 21:27:14.922894828 -0400
+@@ -9,6 +9,9 @@
+ #include <linux/prefetch.h>
+ #include <linux/lockdep.h>
+ #include <asm/page.h>
++#include <asm/pgtable.h>
++
++#define set_fs(x)	(current_thread_info()->addr_limit = (x))
+ 
+ /*
+  * Copy To/From Userspace
+@@ -19,20 +22,24 @@ __must_check unsigned long
+ copy_user_generic(void *to, const void *from, unsigned len);
+ 
+ __must_check unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned len);
+-__must_check unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned len);
+-__must_check unsigned long
+ copy_in_user(void __user *to, const void __user *from, unsigned len);
+ 
+ static __always_inline __must_check
+-int __copy_from_user(void *dst, const void __user *src, unsigned size)
++unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(dst, size, false);
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
+ 			      ret, "b", "b", "=q", 1);
+@@ -65,18 +72,28 @@ int __copy_from_user(void *dst, const vo
+ 			       ret, "q", "", "=r", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic(dst, (__force void *)src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_to_user(void __user *dst, const void *src, unsigned size)
++unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		check_object_size(src, size, true);
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
++	}
+ 	switch (size) {
+ 	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
+ 			      ret, "b", "b", "iq", 1);
+@@ -109,19 +126,54 @@ int __copy_to_user(void __user *dst, con
+ 			       ret, "q", "", "er", 8);
+ 		return ret;
+ 	default:
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst, src, size);
+ 	}
+ }
+ 
+ static __always_inline __must_check
+-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
++unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
++{
++	if (access_ok(VERIFY_WRITE, to, len))
++		len = __copy_to_user(to, from, len);
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
++{
++	if ((int)len < 0)
++		return len;
++
++	if (access_ok(VERIFY_READ, from, len))
++		len = __copy_from_user(to, from, len);
++	else if ((int)len > 0) {
++		if (!__builtin_constant_p(len))
++			check_object_size(to, len, false);
++		memset(to, 0, len);
++	}
++	return len;
++}
++
++static __always_inline __must_check
++unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+ {
+-	int ret = 0;
++	unsigned ret = 0;
+ 
+ 	might_fault();
+-	if (!__builtin_constant_p(size))
++
++	if ((int)size < 0)
++		return size;
++
++	if (!__builtin_constant_p(size)) {
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
++	}
+ 	switch (size) {
+ 	case 1: {
+ 		u8 tmp;
+@@ -161,6 +213,10 @@ int __copy_in_user(void __user *dst, con
+ 		return ret;
+ 	}
+ 	default:
++		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++			src += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++			dst += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)dst,
+ 					 (__force void *)src, size);
+ 	}
+@@ -179,30 +235,40 @@ __must_check unsigned long __clear_user(
+ __must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
+ 					    unsigned size);
+ 
+-static __must_check __always_inline int
++static __must_check __always_inline unsigned long
+ __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return copy_user_generic((__force void *)dst, src, size);
+ }
+ 
+-extern long __copy_user_nocache(void *dst, const void __user *src,
++extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
+ 				unsigned size, int zerorest);
+ 
+-static inline int
+-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
++static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
+ {
+ 	might_sleep();
++
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 1);
+ }
+ 
+-static inline int
+-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
++static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
+ 				  unsigned size)
+ {
++	if ((int)size < 0)
++		return size;
++
+ 	return __copy_user_nocache(dst, src, size, 0);
+ }
+ 
+-unsigned long
++extern unsigned long
+ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
+ 
+ #endif /* _ASM_X86_UACCESS_64_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/uaccess.h linux-2.6.32.14/arch/x86/include/asm/uaccess.h
+--- linux-2.6.32.14/arch/x86/include/asm/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/uaccess.h	2010-05-28 21:27:14.922894828 -0400
+@@ -8,6 +8,8 @@
+ #include <linux/thread_info.h>
+ #include <linux/prefetch.h>
+ #include <linux/string.h>
++#include <linux/sched.h>
++#include <linux/slab.h>
+ #include <asm/asm.h>
+ #include <asm/page.h>
+ 
+@@ -29,7 +31,12 @@
+ 
+ #define get_ds()	(KERNEL_DS)
+ #define get_fs()	(current_thread_info()->addr_limit)
++#ifdef CONFIG_X86_32
++void __set_fs(mm_segment_t x, int cpu);
++void set_fs(mm_segment_t x);
++#else
+ #define set_fs(x)	(current_thread_info()->addr_limit = (x))
++#endif
+ 
+ #define segment_eq(a, b)	((a).seg == (b).seg)
+ 
+@@ -77,7 +84,33 @@
+  * checks that the pointer is in the user space range - after calling
+  * this function, memory access functions may still return -EFAULT.
+  */
+-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
++#define access_ok(type, addr, size)					\
++({									\
++	long __size = size;						\
++	unsigned long __addr = (unsigned long)addr;			\
++	unsigned long __addr_ao = __addr & PAGE_MASK;			\
++	unsigned long __end_ao = __addr + __size - 1;			\
++	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
++	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
++		while(__addr_ao <= __end_ao) {				\
++			char __c_ao;					\
++			__addr_ao += PAGE_SIZE;				\
++			if (__size > PAGE_SIZE)				\
++				cond_resched();				\
++			if (__get_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			if (type != VERIFY_WRITE) {			\
++				__addr = __addr_ao;			\
++				continue;				\
++			}						\
++			if (__put_user(__c_ao, (char __user *)__addr))	\
++				break;					\
++			__addr = __addr_ao;				\
++		}							\
++	}								\
++	__ret_ao;							\
++})
+ 
+ /*
+  * The exception table consists of pairs of addresses: the first is the
+@@ -183,13 +216,21 @@ extern int __get_user_bad(void);
+ 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
+ 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
+ 
+-
++#ifdef CONFIG_X86_32
++#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
++#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
++#else
++#define _ASM_LOAD_USER_DS(ds)
++#define _ASM_LOAD_KERNEL_DS
++#endif
+ 
+ #ifdef CONFIG_X86_32
+ #define __put_user_asm_u64(x, addr, err, errret)			\
+-	asm volatile("1:	movl %%eax,0(%2)\n"			\
+-		     "2:	movl %%edx,4(%2)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	movl %%eax,%%ds:0(%2)\n"		\
++		     "2:	movl %%edx,%%ds:4(%2)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "4:	movl %3,%0\n"				\
+ 		     "	jmp 3b\n"					\
+@@ -197,15 +238,18 @@ extern int __get_user_bad(void);
+ 		     _ASM_EXTABLE(1b, 4b)				\
+ 		     _ASM_EXTABLE(2b, 4b)				\
+ 		     : "=r" (err)					\
+-		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
++		     : "A" (x), "r" (addr), "i" (errret), "0" (err),	\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex_u64(x, addr)					\
+-	asm volatile("1:	movl %%eax,0(%1)\n"			\
+-		     "2:	movl %%edx,4(%1)\n"			\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	movl %%eax,%%ds:0(%1)\n"		\
++		     "2:	movl %%edx,%%ds:4(%1)\n"		\
+ 		     "3:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+ 		     _ASM_EXTABLE(2b, 3b - 2b)				\
+-		     : : "A" (x), "r" (addr))
++		     : : "A" (x), "r" (addr), "r"(__USER_DS))
+ 
+ #define __put_user_x8(x, ptr, __ret_pu)				\
+ 	asm volatile("call __put_user_8" : "=a" (__ret_pu)	\
+@@ -374,16 +418,18 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %%ds:%2,%"rtype"1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	xor"itype" %"rtype"1,%"rtype"1\n"		\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+-		     : "=r" (err), ltype(x)				\
+-		     : "m" (__m(addr)), "i" (errret), "0" (err))
++		     : "=r" (err), ltype (x)				\
++		     : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
+ 
+ #define __get_user_size_ex(x, ptr, size)				\
+ do {									\
+@@ -407,10 +453,12 @@ do {									\
+ } while (0)
+ 
+ #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %%ds:%1,%"rtype"0\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : ltype(x) : "m" (__m(addr)))
++		     : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
+ 
+ #define __put_user_nocheck(x, ptr, size)			\
+ ({								\
+@@ -424,13 +472,24 @@ do {									\
+ 	int __gu_err;							\
+ 	unsigned long __gu_val;						\
+ 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
+-	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
++	(x) = (__typeof__(*(ptr)))__gu_val;				\
+ 	__gu_err;							\
+ })
+ 
+ /* FIXME: this hack is definitely wrong -AK */
+ struct __large_struct { unsigned long buf[100]; };
+-#define __m(x) (*(struct __large_struct __user *)(x))
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#define ____m(x)					\
++({							\
++	unsigned long ____x = (unsigned long)(x);	\
++	if (____x < PAX_USER_SHADOW_BASE)		\
++		____x += PAX_USER_SHADOW_BASE;		\
++	(void __user *)____x;				\
++})
++#else
++#define ____m(x) (x)
++#endif
++#define __m(x) (*(struct __large_struct __user *)____m(x))
+ 
+ /*
+  * Tell gcc we read from memory instead of writing: this is because
+@@ -438,21 +497,26 @@ struct __large_struct { unsigned long bu
+  * aliasing issues.
+  */
+ #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
+-	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(5)				\
++		     "1:	mov"itype" %"rtype"1,%%ds:%2\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     ".section .fixup,\"ax\"\n"				\
+ 		     "3:	mov %3,%0\n"				\
+ 		     "	jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE(1b, 3b)				\
+ 		     : "=r"(err)					\
+-		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
++		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
++		       "r"(__USER_DS))
+ 
+ #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
+-	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
++	asm volatile(_ASM_LOAD_USER_DS(2)				\
++		     "1:	mov"itype" %"rtype"0,%%ds:%1\n"		\
+ 		     "2:\n"						\
++		     _ASM_LOAD_KERNEL_DS				\
+ 		     _ASM_EXTABLE(1b, 2b - 1b)				\
+-		     : : ltype(x), "m" (__m(addr)))
++		     : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
+ 
+ /*
+  * uaccess_try and catch
+@@ -530,7 +594,7 @@ struct __large_struct { unsigned long bu
+ #define get_user_ex(x, ptr)	do {					\
+ 	unsigned long __gue_val;					\
+ 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
+-	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
++	(x) = (__typeof__(*(ptr)))__gue_val;				\
+ } while (0)
+ 
+ #ifdef CONFIG_X86_WP_WORKS_OK
+@@ -567,6 +631,7 @@ extern struct movsl_mask {
+ 
+ #define ARCH_HAS_NOCACHE_UACCESS 1
+ 
++#define ARCH_HAS_SORT_EXTABLE
+ #ifdef CONFIG_X86_32
+ # include "uaccess_32.h"
+ #else
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/vgtod.h linux-2.6.32.14/arch/x86/include/asm/vgtod.h
+--- linux-2.6.32.14/arch/x86/include/asm/vgtod.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/vgtod.h	2010-05-28 21:27:14.922894828 -0400
+@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
+ 	int		sysctl_enabled;
+ 	struct timezone sys_tz;
+ 	struct { /* extract of a clocksource struct */
++		char	name[8];
+ 		cycle_t (*vread)(void);
+ 		cycle_t	cycle_last;
+ 		cycle_t	mask;
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/vmi.h linux-2.6.32.14/arch/x86/include/asm/vmi.h
+--- linux-2.6.32.14/arch/x86/include/asm/vmi.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/vmi.h	2010-05-28 21:27:14.922894828 -0400
+@@ -191,6 +191,7 @@ struct vrom_header {
+ 	u8      reserved[96];   /* Reserved for headers */
+ 	char    vmi_init[8];    /* VMI_Init jump point */
+ 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
++	char    rom_data[8048];	/* rest of the option ROM */
+ } __attribute__((packed));
+ 
+ struct pnp_header {
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/vsyscall.h linux-2.6.32.14/arch/x86/include/asm/vsyscall.h
+--- linux-2.6.32.14/arch/x86/include/asm/vsyscall.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/vsyscall.h	2010-05-28 21:27:14.922894828 -0400
+@@ -15,9 +15,10 @@ enum vsyscall_num {
+ 
+ #ifdef __KERNEL__
+ #include <linux/seqlock.h>
++#include <linux/getcpu.h>
++#include <linux/time.h>
+ 
+ #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
+-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
+ 
+ /* Definitions for CONFIG_GENERIC_TIME definitions */
+ #define __section_vsyscall_gtod_data __attribute__ \
+@@ -31,7 +32,6 @@ enum vsyscall_num {
+ #define VGETCPU_LSL	2
+ 
+ extern int __vgetcpu_mode;
+-extern volatile unsigned long __jiffies;
+ 
+ /* kernel space (writeable) */
+ extern int vgetcpu_mode;
+@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
+ 
+ extern void map_vsyscall(void);
+ 
++extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
++extern time_t vtime(time_t *t);
++extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
+ #endif /* __KERNEL__ */
+ 
+ #endif /* _ASM_X86_VSYSCALL_H */
+diff -urNp linux-2.6.32.14/arch/x86/include/asm/xsave.h linux-2.6.32.14/arch/x86/include/asm/xsave.h
+--- linux-2.6.32.14/arch/x86/include/asm/xsave.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/include/asm/xsave.h	2010-05-28 21:27:14.922894828 -0400
+@@ -56,6 +56,12 @@ static inline int xrstor_checking(struct
+ static inline int xsave_user(struct xsave_struct __user *buf)
+ {
+ 	int err;
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
++		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x
+ 	u32 lmask = mask;
+ 	u32 hmask = mask >> 32;
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
++		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
++#endif
++
+ 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
+ 			     "2:\n"
+ 			     ".section .fixup,\"ax\"\n"
+diff -urNp linux-2.6.32.14/arch/x86/Kconfig linux-2.6.32.14/arch/x86/Kconfig
+--- linux-2.6.32.14/arch/x86/Kconfig	2010-05-15 13:20:18.407099662 -0400
++++ linux-2.6.32.14/arch/x86/Kconfig	2010-05-28 21:27:14.922894828 -0400
+@@ -531,6 +531,7 @@ source "arch/x86/lguest/Kconfig"
+ 
+ config PARAVIRT
+ 	bool "Enable paravirtualization code"
++	depends on !PAX_PER_CPU_PGD
+ 	---help---
+ 	  This changes the kernel so it can modify itself when it is run
+ 	  under a hypervisor, potentially improving performance significantly
+@@ -1083,7 +1084,7 @@ config PAGE_OFFSET
+ 	hex
+ 	default 0xB0000000 if VMSPLIT_3G_OPT
+ 	default 0x80000000 if VMSPLIT_2G
+-	default 0x78000000 if VMSPLIT_2G_OPT
++	default 0x70000000 if VMSPLIT_2G_OPT
+ 	default 0x40000000 if VMSPLIT_1G
+ 	default 0xC0000000
+ 	depends on X86_32
+@@ -1414,7 +1415,7 @@ config ARCH_USES_PG_UNCACHED
+ 
+ config EFI
+ 	bool "EFI runtime service support"
+-	depends on ACPI
++	depends on ACPI && !PAX_KERNEXEC
+ 	---help---
+ 	  This enables the kernel to use EFI runtime services that are
+ 	  available (such as the EFI variable services).
+@@ -1501,6 +1502,7 @@ config KEXEC_JUMP
+ config PHYSICAL_START
+ 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
+ 	default "0x1000000"
++	range 0x400000 0x40000000
+ 	---help---
+ 	  This gives the physical address where the kernel is loaded.
+ 
+@@ -1565,6 +1567,7 @@ config PHYSICAL_ALIGN
+ 	hex
+ 	prompt "Alignment value to which kernel should be aligned" if X86_32
+ 	default "0x1000000"
++	range 0x400000 0x1000000 if PAX_KERNEXEC
+ 	range 0x2000 0x1000000
+ 	---help---
+ 	  This value puts the alignment restrictions on physical address
+@@ -1596,9 +1599,10 @@ config HOTPLUG_CPU
+ 	  Say N if you want to disable CPU hotplug.
+ 
+ config COMPAT_VDSO
+-	def_bool y
++	def_bool n
+ 	prompt "Compat VDSO support"
+ 	depends on X86_32 || IA32_EMULATION
++	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
+ 	---help---
+ 	  Map the 32-bit VDSO to the predictable old-style address too.
+ 	---help---
+diff -urNp linux-2.6.32.14/arch/x86/Kconfig.cpu linux-2.6.32.14/arch/x86/Kconfig.cpu
+--- linux-2.6.32.14/arch/x86/Kconfig.cpu	2010-04-29 17:49:37.481119841 -0400
++++ linux-2.6.32.14/arch/x86/Kconfig.cpu	2010-05-28 21:27:14.922894828 -0400
+@@ -340,7 +340,7 @@ config X86_PPRO_FENCE
+ 
+ config X86_F00F_BUG
+ 	def_bool y
+-	depends on M586MMX || M586TSC || M586 || M486 || M386
++	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
+ 
+ config X86_WP_WORKS_OK
+ 	def_bool y
+@@ -360,7 +360,7 @@ config X86_POPAD_OK
+ 
+ config X86_ALIGNMENT_16
+ 	def_bool y
+-	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
++	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+ 
+ config X86_INTEL_USERCOPY
+ 	def_bool y
+@@ -406,7 +406,7 @@ config X86_CMPXCHG64
+ # generates cmov.
+ config X86_CMOV
+ 	def_bool y
+-	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
++	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
+ 
+ config X86_MINIMUM_CPU_FAMILY
+ 	int
+diff -urNp linux-2.6.32.14/arch/x86/Kconfig.debug linux-2.6.32.14/arch/x86/Kconfig.debug
+--- linux-2.6.32.14/arch/x86/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/Kconfig.debug	2010-05-28 21:27:14.926914091 -0400
+@@ -99,7 +99,7 @@ config X86_PTDUMP
+ config DEBUG_RODATA
+ 	bool "Write protect kernel read-only data structures"
+ 	default y
+-	depends on DEBUG_KERNEL
++	depends on DEBUG_KERNEL && BROKEN
+ 	---help---
+ 	  Mark the kernel read-only data as write-protected in the pagetables,
+ 	  in order to catch accidental (and incorrect) writes to such const
+diff -urNp linux-2.6.32.14/arch/x86/kernel/acpi/boot.c linux-2.6.32.14/arch/x86/kernel/acpi/boot.c
+--- linux-2.6.32.14/arch/x86/kernel/acpi/boot.c	2010-04-04 20:41:49.916475305 -0400
++++ linux-2.6.32.14/arch/x86/kernel/acpi/boot.c	2010-05-28 21:27:14.939148318 -0400
+@@ -1502,7 +1502,7 @@ static struct dmi_system_id __initdata a
+ 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
+ 		     },
+ 	 },
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.14/arch/x86/kernel/acpi/realmode/wakeup.S
+--- linux-2.6.32.14/arch/x86/kernel/acpi/realmode/wakeup.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/acpi/realmode/wakeup.S	2010-05-28 21:27:14.939148318 -0400
+@@ -104,7 +104,7 @@ _start:
+ 	movl	%eax, %ecx
+ 	orl	%edx, %ecx
+ 	jz	1f
+-	movl	$0xc0000080, %ecx
++	mov	$MSR_EFER, %ecx
+ 	wrmsr
+ 1:
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/acpi/sleep.c linux-2.6.32.14/arch/x86/kernel/acpi/sleep.c
+--- linux-2.6.32.14/arch/x86/kernel/acpi/sleep.c	2010-05-15 13:20:18.407099662 -0400
++++ linux-2.6.32.14/arch/x86/kernel/acpi/sleep.c	2010-05-28 21:27:14.943027635 -0400
+@@ -11,11 +11,12 @@
+ #include <linux/cpumask.h>
+ #include <asm/segment.h>
+ #include <asm/desc.h>
++#include <asm/e820.h>
+ 
+ #include "realmode/wakeup.h"
+ #include "sleep.h"
+ 
+-unsigned long acpi_wakeup_address;
++unsigned long acpi_wakeup_address = 0x2000;
+ unsigned long acpi_realmode_flags;
+ 
+ /* address in low memory of the wakeup routine. */
+@@ -99,8 +100,12 @@ int acpi_save_state_mem(void)
+ 	header->trampoline_segment = setup_trampoline() >> 4;
+ #ifdef CONFIG_SMP
+ 	stack_start.sp = temp_stack + sizeof(temp_stack);
++
++	pax_open_kernel();
+ 	early_gdt_descr.address =
+ 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
++	pax_close_kernel();
++
+ 	initial_gs = per_cpu_offset(smp_processor_id());
+ #endif
+ 	initial_code = (unsigned long)wakeup_long64;
+@@ -134,14 +139,8 @@ void __init acpi_reserve_bootmem(void)
+ 		return;
+ 	}
+ 
+-	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
+-
+-	if (!acpi_realmode) {
+-		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
+-		return;
+-	}
+-
+-	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
++	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
++	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
+ }
+ 
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.14/arch/x86/kernel/acpi/wakeup_32.S
+--- linux-2.6.32.14/arch/x86/kernel/acpi/wakeup_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/acpi/wakeup_32.S	2010-05-28 21:27:14.943027635 -0400
+@@ -30,13 +30,11 @@ wakeup_pmode_return:
+ 	# and restore the stack ... but you need gdt for this to work
+ 	movl	saved_context_esp, %esp
+ 
+-	movl	%cs:saved_magic, %eax
+-	cmpl	$0x12345678, %eax
++	cmpl	$0x12345678, saved_magic
+ 	jne	bogus_magic
+ 
+ 	# jump to place where we left off
+-	movl	saved_eip, %eax
+-	jmp	*%eax
++	jmp	*(saved_eip)
+ 
+ bogus_magic:
+ 	jmp	bogus_magic
+diff -urNp linux-2.6.32.14/arch/x86/kernel/alternative.c linux-2.6.32.14/arch/x86/kernel/alternative.c
+--- linux-2.6.32.14/arch/x86/kernel/alternative.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/alternative.c	2010-05-28 21:27:14.943027635 -0400
+@@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
+ 
+ 		BUG_ON(p->len > MAX_PATCH_LEN);
+ 		/* prep the buffer with the original instructions */
+-		memcpy(insnbuf, p->instr, p->len);
++		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
+ 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
+ 					 (unsigned long)p->instr, p->len);
+ 
+@@ -492,12 +492,16 @@ void __init alternative_instructions(voi
+  * instructions. And on the local CPU you need to be protected again NMI or MCE
+  * handlers seeing an inconsistent instruction while you patch.
+  */
+-static void *__init_or_module text_poke_early(void *addr, const void *opcode,
++static void *__kprobes text_poke_early(void *addr, const void *opcode,
+ 					      size_t len)
+ {
+ 	unsigned long flags;
+ 	local_irq_save(flags);
+-	memcpy(addr, opcode, len);
++
++	pax_open_kernel();
++	memcpy(ktla_ktva(addr), opcode, len);
++	pax_close_kernel();
++
+ 	sync_core();
+ 	local_irq_restore(flags);
+ 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+@@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
+  */
+ void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
+ {
+-	unsigned long flags;
+-	char *vaddr;
++	unsigned char *vaddr = ktla_ktva(addr);
+ 	struct page *pages[2];
+-	int i;
++	size_t i;
+ 
+ 	if (!core_kernel_text((unsigned long)addr)) {
+-		pages[0] = vmalloc_to_page(addr);
+-		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
++		pages[0] = vmalloc_to_page(vaddr);
++		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
+ 	} else {
+-		pages[0] = virt_to_page(addr);
++		pages[0] = virt_to_page(vaddr);
+ 		WARN_ON(!PageReserved(pages[0]));
+-		pages[1] = virt_to_page(addr + PAGE_SIZE);
++		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
+ 	}
+ 	BUG_ON(!pages[0]);
+-	local_irq_save(flags);
+-	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
+-	if (pages[1])
+-		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
+-	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
+-	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
+-	clear_fixmap(FIX_TEXT_POKE0);
+-	if (pages[1])
+-		clear_fixmap(FIX_TEXT_POKE1);
+-	local_flush_tlb();
+-	sync_core();
+-	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+-	   that causes hangs on some VIA CPUs. */
++	text_poke_early(addr, opcode, len);
+ 	for (i = 0; i < len; i++)
+-		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
+-	local_irq_restore(flags);
++		BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
+ 	return addr;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/kernel/amd_iommu.c linux-2.6.32.14/arch/x86/kernel/amd_iommu.c
+--- linux-2.6.32.14/arch/x86/kernel/amd_iommu.c	2010-04-29 17:49:37.521943068 -0400
++++ linux-2.6.32.14/arch/x86/kernel/amd_iommu.c	2010-05-28 21:27:14.959145751 -0400
+@@ -2074,7 +2074,7 @@ static void prealloc_protection_domains(
+ 	}
+ }
+ 
+-static struct dma_map_ops amd_iommu_dma_ops = {
++static const struct dma_map_ops amd_iommu_dma_ops = {
+ 	.alloc_coherent = alloc_coherent,
+ 	.free_coherent = free_coherent,
+ 	.map_page = map_page,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/apic/io_apic.c linux-2.6.32.14/arch/x86/kernel/apic/io_apic.c
+--- linux-2.6.32.14/arch/x86/kernel/apic/io_apic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/apic/io_apic.c	2010-05-28 21:27:14.967145332 -0400
+@@ -711,7 +711,7 @@ struct IO_APIC_route_entry **alloc_ioapi
+ 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
+ 				GFP_ATOMIC);
+ 	if (!ioapic_entries)
+-		return 0;
++		return NULL;
+ 
+ 	for (apic = 0; apic < nr_ioapics; apic++) {
+ 		ioapic_entries[apic] =
+@@ -728,7 +728,7 @@ nomem:
+ 		kfree(ioapic_entries[apic]);
+ 	kfree(ioapic_entries);
+ 
+-	return 0;
++	return NULL;
+ }
+ 
+ /*
+@@ -1145,7 +1145,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, 
+ }
+ EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
+ 
+-void lock_vector_lock(void)
++void lock_vector_lock(void) __acquires(vector_lock)
+ {
+ 	/* Used to the online set of cpus does not change
+ 	 * during assign_irq_vector.
+@@ -1153,7 +1153,7 @@ void lock_vector_lock(void)
+ 	spin_lock(&vector_lock);
+ }
+ 
+-void unlock_vector_lock(void)
++void unlock_vector_lock(void) __releases(vector_lock)
+ {
+ 	spin_unlock(&vector_lock);
+ }
+diff -urNp linux-2.6.32.14/arch/x86/kernel/apm_32.c linux-2.6.32.14/arch/x86/kernel/apm_32.c
+--- linux-2.6.32.14/arch/x86/kernel/apm_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/apm_32.c	2010-05-28 21:27:14.975148965 -0400
+@@ -410,7 +410,7 @@ static DEFINE_SPINLOCK(user_list_lock);
+  * This is for buggy BIOS's that refer to (real mode) segment 0x40
+  * even though they are called in protected mode.
+  */
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ static const char driver_version[] = "1.16ac";	/* no spaces */
+@@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
+ 			  &call->esi);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	return call->eax & 0xff;
+@@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void 
+ 	BUG_ON(cpu != 0);
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+@@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void 
+ 					 &call->eax);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++	pax_open_kernel();
+ 	gdt[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 	return error;
+ }
+@@ -975,7 +989,7 @@ recalc:
+ 
+ static void apm_power_off(void)
+ {
+-	unsigned char po_bios_call[] = {
++	const unsigned char po_bios_call[] = {
+ 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
+ 		0x8e, 0xd0,		/* movw  ax,ss       */
+ 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
+@@ -1933,7 +1947,10 @@ static const struct file_operations apm_
+ static struct miscdevice apm_device = {
+ 	APM_MINOR_DEV,
+ 	"apm_bios",
+-	&apm_bios_fops
++	&apm_bios_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ 
+@@ -2254,7 +2271,7 @@ static struct dmi_system_id __initdata a
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+ 
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ /*
+@@ -2357,12 +2374,15 @@ static int __init apm_init(void)
+ 	 * code to that CPU.
+ 	 */
+ 	gdt = get_cpu_gdt_table(0);
++
++	pax_open_kernel();
+ 	set_desc_base(&gdt[APM_CS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
+ 	set_desc_base(&gdt[APM_CS_16 >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
+ 	set_desc_base(&gdt[APM_DS >> 3],
+ 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
++	pax_close_kernel();
+ 
+ 	proc_create("apm", 0, NULL, &apm_file_ops);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.14/arch/x86/kernel/asm-offsets_32.c
+--- linux-2.6.32.14/arch/x86/kernel/asm-offsets_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/asm-offsets_32.c	2010-05-28 21:27:14.975148965 -0400
+@@ -115,6 +115,11 @@ void foo(void)
+ 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
+ #endif
+ 
+ #ifdef CONFIG_XEN
+diff -urNp linux-2.6.32.14/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.14/arch/x86/kernel/asm-offsets_64.c
+--- linux-2.6.32.14/arch/x86/kernel/asm-offsets_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/asm-offsets_64.c	2010-05-28 21:27:14.975148965 -0400
+@@ -63,6 +63,18 @@ int main(void)
+ 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
+ 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
+ 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
++	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
++	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
++	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
++#endif
++
+ #endif
+ 
+ 
+@@ -115,6 +127,7 @@ int main(void)
+ 	ENTRY(cr8);
+ 	BLANK();
+ #undef ENTRY
++	DEFINE(TSS_size, sizeof(struct tss_struct));
+ 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
+ 	BLANK();
+ 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/common.c linux-2.6.32.14/arch/x86/kernel/cpu/common.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/common.c	2010-05-28 21:27:14.975148965 -0400
+@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
+ 
+ static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
+ 
+-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
+-#ifdef CONFIG_X86_64
+-	/*
+-	 * We need valid kernel segments for data and code in long mode too
+-	 * IRET will check the segment types  kkeil 2000/10/28
+-	 * Also sysret mandates a special GDT layout
+-	 *
+-	 * TLS descriptors are currently at a different place compared to i386.
+-	 * Hopefully nobody expects them at a fixed place (Wine?)
+-	 */
+-	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
+-#else
+-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
+-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
+-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
+-	/*
+-	 * Segments used for calling PnP BIOS have byte granularity.
+-	 * They code segments and data segments have fixed 64k limits,
+-	 * the transfer segment sizes are set at run time.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
+-	/*
+-	 * The APM segments have byte granularity and their bases
+-	 * are set at run time.  All have 64k limits.
+-	 */
+-	/* 32-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
+-	/* 16-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
+-	/* data */
+-	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
+-
+-	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
+-	GDT_STACK_CANARY_INIT
+-#endif
+-} };
+-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+-
+ static int __init x86_xsave_setup(char *s)
+ {
+ 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
+@@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
+ {
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
++	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 	/* Reload the per-cpu base */
+@@ -798,6 +744,10 @@ static void __cpuinit identify_cpu(struc
+ 	/* Filter out anything that depends on CPUID levels we don't have */
+ 	filter_cpuid_features(c, true);
+ 
++#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
++	setup_clear_cpu_cap(X86_FEATURE_SEP);
++#endif
++
+ 	/* If the model name is still unset, do table lookup. */
+ 	if (!c->x86_model_id[0]) {
+ 		const char *p;
+@@ -1101,7 +1051,7 @@ void __cpuinit cpu_init(void)
+ 	int i;
+ 
+ 	cpu = stack_smp_processor_id();
+-	t = &per_cpu(init_tss, cpu);
++	t = init_tss + cpu;
+ 	orig_ist = &per_cpu(orig_ist, cpu);
+ 
+ #ifdef CONFIG_NUMA
+@@ -1127,7 +1077,7 @@ void __cpuinit cpu_init(void)
+ 	switch_to_new_gdt(cpu);
+ 	loadsegment(fs, 0);
+ 
+-	load_idt((const struct desc_ptr *)&idt_descr);
++	load_idt(&idt_descr);
+ 
+ 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
+ 	syscall_init();
+@@ -1199,7 +1149,7 @@ void __cpuinit cpu_init(void)
+ {
+ 	int cpu = smp_processor_id();
+ 	struct task_struct *curr = current;
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 	struct thread_struct *thread = &curr->thread;
+ 
+ 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-05-28 21:27:14.975148965 -0400
+@@ -521,7 +521,7 @@ static const struct dmi_system_id sw_any
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2010-05-28 21:27:14.975148965 -0400
+@@ -225,7 +225,7 @@ static struct cpu_model models[] =
+ 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
+ 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
+ 
+-	{ NULL, }
++	{ NULL, NULL, 0, NULL}
+ };
+ #undef _BANIAS
+ #undef BANIAS
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/intel.c linux-2.6.32.14/arch/x86/kernel/cpu/intel.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/intel.c	2010-05-15 13:20:18.427075180 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/intel.c	2010-05-28 21:27:14.975148965 -0400
+@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
+ 	 * Update the IDT descriptor and reload the IDT so that
+ 	 * it uses the read-only mapped virtual address.
+ 	 */
+-	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
++	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
+ 	load_idt(&idt_descr);
+ }
+ #endif
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.14/arch/x86/kernel/cpu/intel_cacheinfo.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-28 20:16:44.430924650 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/intel_cacheinfo.c	2010-05-28 21:27:14.987166265 -0400
+@@ -921,7 +921,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show   = show,
+ 	.store  = store,
+ };
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/Makefile linux-2.6.32.14/arch/x86/kernel/cpu/Makefile
+--- linux-2.6.32.14/arch/x86/kernel/cpu/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/Makefile	2010-05-28 21:27:14.987166265 -0400
+@@ -7,10 +7,6 @@ ifdef CONFIG_FUNCTION_TRACER
+ CFLAGS_REMOVE_common.o = -pg
+ endif
+ 
+-# Make sure load_percpu_segment has no stackprotector
+-nostackp := $(call cc-option, -fno-stack-protector)
+-CFLAGS_common.o		:= $(nostackp)
+-
+ obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
+ obj-y			+= proc.o capflags.o powerflags.o common.o
+ obj-y			+= vmware.o hypervisor.o sched.o
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce_amd.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce_amd.c	2010-05-28 21:27:14.995163789 -0400
+@@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops threshold_ops = {
++static const struct sysfs_ops threshold_ops = {
+ 	.show			= show,
+ 	.store			= store,
+ };
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mcheck/mce.c	2010-05-28 21:27:15.011149672 -0400
+@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
+ 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
+ 				m->cs, m->ip);
+ 
+-		if (m->cs == __KERNEL_CS)
++		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
+ 			print_symbol("{%s}", m->ip);
+ 		pr_cont("\n");
+ 	}
+@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
+  */
+ 
+ static DEFINE_SPINLOCK(mce_state_lock);
+-static int		open_count;		/* #times opened */
++static atomic_t		open_count;		/* #times opened */
+ static int		open_exclu;		/* already open exclusive? */
+ 
+ static int mce_open(struct inode *inode, struct file *file)
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
++	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
+ 		spin_unlock(&mce_state_lock);
+ 
+ 		return -EBUSY;
+@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
+ 
+ 	if (file->f_flags & O_EXCL)
+ 		open_exclu = 1;
+-	open_count++;
++	atomic_inc(&open_count);
+ 
+ 	spin_unlock(&mce_state_lock);
+ 
+@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
+ {
+ 	spin_lock(&mce_state_lock);
+ 
+-	open_count--;
++	atomic_dec(&open_count);
+ 	open_exclu = 0;
+ 
+ 	spin_unlock(&mce_state_lock);
+@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
+ 	MISC_MCELOG_MINOR,
+ 	"mcelog",
+ 	&mce_chrdev_ops,
++	{NULL, NULL}, NULL, NULL
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/amd.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/amd.c	2010-05-28 21:27:15.011149672 -0400
+@@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops amd_mtrr_ops = {
++static const struct mtrr_ops amd_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_AMD,
+ 	.set               = amd_set_mtrr,
+ 	.get               = amd_get_mtrr,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/centaur.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/centaur.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/centaur.c	2010-05-28 21:27:15.011149672 -0400
+@@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long 
+ 	return 0;
+ }
+ 
+-static struct mtrr_ops centaur_mtrr_ops = {
++static const struct mtrr_ops centaur_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CENTAUR,
+ 	.set               = centaur_set_mcr,
+ 	.get               = centaur_get_mcr,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/cyrix.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/cyrix.c	2010-05-28 21:27:15.011149672 -0400
+@@ -265,7 +265,7 @@ static void cyrix_set_all(void)
+ 	post_set();
+ }
+ 
+-static struct mtrr_ops cyrix_mtrr_ops = {
++static const struct mtrr_ops cyrix_mtrr_ops = {
+ 	.vendor            = X86_VENDOR_CYRIX,
+ 	.set_all	   = cyrix_set_all,
+ 	.set               = cyrix_set_arr,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/generic.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/generic.c	2010-05-28 21:27:15.011149672 -0400
+@@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
+ 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
+ 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
+ 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
+-	{}
++	{ 0, 0 }
+ };
+ 
+ static unsigned long smp_changes_mask;
+@@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
+ /*
+  * Generic structure...
+  */
+-struct mtrr_ops generic_mtrr_ops = {
++const struct mtrr_ops generic_mtrr_ops = {
+ 	.use_intel_if		= 1,
+ 	.set_all		= generic_set_all,
+ 	.get			= generic_get_mtrr,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/main.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/main.c	2010-05-28 21:27:15.011149672 -0400
+@@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
+ u64 size_or_mask, size_and_mask;
+ static bool mtrr_aps_delayed_init;
+ 
+-static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
++static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
+ 
+-struct mtrr_ops *mtrr_if;
++const struct mtrr_ops *mtrr_if;
+ 
+ static void set_mtrr(unsigned int reg, unsigned long base,
+ 		     unsigned long size, mtrr_type type);
+ 
+-void set_mtrr_ops(struct mtrr_ops *ops)
++void set_mtrr_ops(const struct mtrr_ops *ops)
+ {
+ 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
+ 		mtrr_ops[ops->vendor] = ops;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/mtrr.h
+--- linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/mtrr/mtrr.h	2010-05-28 21:27:15.011149672 -0400
+@@ -12,19 +12,19 @@
+ extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
+ 
+ struct mtrr_ops {
+-	u32	vendor;
+-	u32	use_intel_if;
+-	void	(*set)(unsigned int reg, unsigned long base,
++	const u32	vendor;
++	const u32	use_intel_if;
++	void	(* const set)(unsigned int reg, unsigned long base,
+ 		       unsigned long size, mtrr_type type);
+-	void	(*set_all)(void);
++	void	(* const set_all)(void);
+ 
+-	void	(*get)(unsigned int reg, unsigned long *base,
++	void	(* const get)(unsigned int reg, unsigned long *base,
+ 		       unsigned long *size, mtrr_type *type);
+-	int	(*get_free_region)(unsigned long base, unsigned long size,
++	int	(* const get_free_region)(unsigned long base, unsigned long size,
+ 				   int replace_reg);
+-	int	(*validate_add_page)(unsigned long base, unsigned long size,
++	int	(* const validate_add_page)(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+-	int	(*have_wrcomb)(void);
++	int	(* const have_wrcomb)(void);
+ };
+ 
+ extern int generic_get_free_region(unsigned long base, unsigned long size,
+@@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
+ extern int generic_validate_add_page(unsigned long base, unsigned long size,
+ 				     unsigned int type);
+ 
+-extern struct mtrr_ops generic_mtrr_ops;
++extern const struct mtrr_ops generic_mtrr_ops;
+ 
+ extern int positive_have_wrcomb(void);
+ 
+@@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
+ 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
+ void get_mtrr_state(void);
+ 
+-extern void set_mtrr_ops(struct mtrr_ops *ops);
++extern void set_mtrr_ops(const struct mtrr_ops *ops);
+ 
+ extern u64 size_or_mask, size_and_mask;
+-extern struct mtrr_ops *mtrr_if;
++extern const struct mtrr_ops *mtrr_if;
+ 
+ #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
+ #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.14/arch/x86/kernel/cpu/perfctr-watchdog.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/perfctr-watchdog.c	2010-05-28 21:27:15.011149672 -0400
+@@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
+ 
+ /* Interface defining a CPU specific perfctr watchdog */
+ struct wd_ops {
+-	int (*reserve)(void);
+-	void (*unreserve)(void);
+-	int (*setup)(unsigned nmi_hz);
+-	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
+-	void (*stop)(void);
++	int (* const reserve)(void);
++	void (* const unreserve)(void);
++	int (* const setup)(unsigned nmi_hz);
++	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
++	void (* const stop)(void);
+ 	unsigned perfctr;
+ 	unsigned evntsel;
+ 	u64 checkbit;
+@@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
+ #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
+ #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops;
+ 
+ static int setup_intel_arch_watchdog(unsigned nmi_hz)
+@@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
+ 	return 1;
+ }
+ 
++/* cannot be const */
+ static struct wd_ops intel_arch_wd_ops __read_mostly = {
+ 	.reserve	= single_msr_reserve,
+ 	.unreserve	= single_msr_unreserve,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.14/arch/x86/kernel/cpu/perf_event.c
+--- linux-2.6.32.14/arch/x86/kernel/cpu/perf_event.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.14/arch/x86/kernel/cpu/perf_event.c	2010-05-28 21:27:15.015028232 -0400
+@@ -2354,7 +2354,7 @@ perf_callchain_user(struct pt_regs *regs
+ 			break;
+ 
+ 		callchain_store(entry, frame.return_address);
+-		fp = frame.next_frame;
++		fp = (__force const void __user *)frame.next_frame;
+ 	}
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/crash.c linux-2.6.32.14/arch/x86/kernel/crash.c
+--- linux-2.6.32.14/arch/x86/kernel/crash.c	2010-04-29 17:49:37.537108997 -0400
++++ linux-2.6.32.14/arch/x86/kernel/crash.c	2010-05-28 21:27:15.015028232 -0400
+@@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu, 
+ 	regs = args->regs;
+ 
+ #ifdef CONFIG_X86_32
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		crash_fixup_ss_esp(&fixed_regs, regs);
+ 		regs = &fixed_regs;
+ 	}
+diff -urNp linux-2.6.32.14/arch/x86/kernel/doublefault_32.c linux-2.6.32.14/arch/x86/kernel/doublefault_32.c
+--- linux-2.6.32.14/arch/x86/kernel/doublefault_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/doublefault_32.c	2010-05-28 21:27:15.015028232 -0400
+@@ -11,7 +11,7 @@
+ 
+ #define DOUBLEFAULT_STACKSIZE (1024)
+ static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
+-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
++#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
+ 
+ #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
+ 
+@@ -21,7 +21,7 @@ static void doublefault_fn(void)
+ 	unsigned long gdt, tss;
+ 
+ 	store_gdt(&gdt_desc);
+-	gdt = gdt_desc.address;
++	gdt = (unsigned long)gdt_desc.address;
+ 
+ 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+ 
+@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
+ 		/* 0x2 bit is always set */
+ 		.flags		= X86_EFLAGS_SF | 0x2,
+ 		.sp		= STACK_START,
+-		.es		= __USER_DS,
++		.es		= __KERNEL_DS,
+ 		.cs		= __KERNEL_CS,
+ 		.ss		= __KERNEL_DS,
+-		.ds		= __USER_DS,
++		.ds		= __KERNEL_DS,
+ 		.fs		= __KERNEL_PERCPU,
+ 
+ 		.__cr3		= __pa_nodebug(swapper_pg_dir),
+diff -urNp linux-2.6.32.14/arch/x86/kernel/dumpstack_32.c linux-2.6.32.14/arch/x86/kernel/dumpstack_32.c
+--- linux-2.6.32.14/arch/x86/kernel/dumpstack_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/dumpstack_32.c	2010-05-28 21:27:15.015028232 -0400
+@@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
+ 	 * When in-kernel, we also print out the stack and code at the
+ 	 * time of the fault..
+ 	 */
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned int code_prologue = code_bytes * 43 / 64;
+ 		unsigned int code_len = code_bytes;
+ 		unsigned char c;
+ 		u8 *ip;
++		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
+ 
+ 		printk(KERN_EMERG "Stack:\n");
+ 		show_stack_log_lvl(NULL, regs, &regs->sp,
+@@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
+ 
+ 		printk(KERN_EMERG "Code: ");
+ 
+-		ip = (u8 *)regs->ip - code_prologue;
++		ip = (u8 *)regs->ip - code_prologue + cs_base;
+ 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
+ 			/* try starting at IP */
+-			ip = (u8 *)regs->ip;
++			ip = (u8 *)regs->ip + cs_base;
+ 			code_len = code_len - code_prologue + 1;
+ 		}
+ 		for (i = 0; i < code_len; i++, ip++) {
+@@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
+ 				printk(" Bad EIP value.");
+ 				break;
+ 			}
+-			if (ip == (u8 *)regs->ip)
++			if (ip == (u8 *)regs->ip + cs_base)
+ 				printk("<%02x> ", c);
+ 			else
+ 				printk("%02x ", c);
+@@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
+ {
+ 	unsigned short ud2;
+ 
++	ip = ktla_ktva(ip);
+ 	if (ip < PAGE_OFFSET)
+ 		return 0;
+ 	if (probe_kernel_address((unsigned short *)ip, ud2))
+diff -urNp linux-2.6.32.14/arch/x86/kernel/dumpstack.c linux-2.6.32.14/arch/x86/kernel/dumpstack.c
+--- linux-2.6.32.14/arch/x86/kernel/dumpstack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/dumpstack.c	2010-05-28 21:27:15.023156603 -0400
+@@ -180,7 +180,7 @@ void dump_stack(void)
+ #endif
+ 
+ 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version);
+@@ -241,7 +241,7 @@ void __kprobes oops_end(unsigned long fl
+ 		panic("Fatal exception in interrupt");
+ 	if (panic_on_oops)
+ 		panic("Fatal exception");
+-	do_exit(signr);
++	do_group_exit(signr);
+ }
+ 
+ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
+@@ -295,7 +295,7 @@ void die(const char *str, struct pt_regs
+ 	unsigned long flags = oops_begin();
+ 	int sig = SIGSEGV;
+ 
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		report_bug(regs->ip, regs);
+ 
+ 	if (__die(str, regs, err))
+diff -urNp linux-2.6.32.14/arch/x86/kernel/e820.c linux-2.6.32.14/arch/x86/kernel/e820.c
+--- linux-2.6.32.14/arch/x86/kernel/e820.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/e820.c	2010-05-28 21:27:15.023156603 -0400
+@@ -733,7 +733,7 @@ struct early_res {
+ };
+ static struct early_res early_res[MAX_EARLY_RES] __initdata = {
+ 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
+-	{}
++	{ 0, 0, {0}, 0 }
+ };
+ 
+ static int __init find_overlapped_early(u64 start, u64 end)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/efi_32.c linux-2.6.32.14/arch/x86/kernel/efi_32.c
+--- linux-2.6.32.14/arch/x86/kernel/efi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/efi_32.c	2010-05-28 21:27:15.023156603 -0400
+@@ -38,70 +38,38 @@
+  */
+ 
+ static unsigned long efi_rt_eflags;
+-static pgd_t efi_bak_pg_dir_pointer[2];
++static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
+ 
+-void efi_call_phys_prelog(void)
++void __init efi_call_phys_prelog(void)
+ {
+-	unsigned long cr4;
+-	unsigned long temp;
+ 	struct desc_ptr gdt_descr;
+ 
+ 	local_irq_save(efi_rt_eflags);
+ 
+-	/*
+-	 * If I don't have PAE, I should just duplicate two entries in page
+-	 * directory. If I have PAE, I just need to duplicate one entry in
+-	 * page directory.
+-	 */
+-	cr4 = read_cr4_safe();
+ 
+-	if (cr4 & X86_CR4_PAE) {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		swapper_pg_dir[0].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-	} else {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		efi_bak_pg_dir_pointer[1].pgd =
+-		    swapper_pg_dir[pgd_index(0x400000)].pgd;
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-		temp = PAGE_OFFSET + 0x400000;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    swapper_pg_dir[pgd_index(temp)].pgd;
+-	}
++	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+ 	 */
+ 	__flush_tlb_all();
+ 
+-	gdt_descr.address = __pa(get_cpu_gdt_table(0));
++	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ }
+ 
+-void efi_call_phys_epilog(void)
++void __init efi_call_phys_epilog(void)
+ {
+-	unsigned long cr4;
+ 	struct desc_ptr gdt_descr;
+ 
+-	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
++	gdt_descr.address = get_cpu_gdt_table(0);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 
+-	cr4 = read_cr4_safe();
+-
+-	if (cr4 & X86_CR4_PAE) {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-	} else {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    efi_bak_pg_dir_pointer[1].pgd;
+-	}
++	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+diff -urNp linux-2.6.32.14/arch/x86/kernel/efi_stub_32.S linux-2.6.32.14/arch/x86/kernel/efi_stub_32.S
+--- linux-2.6.32.14/arch/x86/kernel/efi_stub_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/efi_stub_32.S	2010-05-28 21:27:15.031137412 -0400
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <linux/linkage.h>
++#include <linux/init.h>
+ #include <asm/page_types.h>
+ 
+ /*
+@@ -20,7 +21,7 @@
+  * service functions will comply with gcc calling convention, too.
+  */
+ 
+-.text
++__INIT
+ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 0. The function can only be called in Linux kernel. So CS has been
+@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
+ 	 * The mapping of lower virtual memory has been created in prelog and
+ 	 * epilog.
+ 	 */
+-	movl	$1f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	jmp	*%edx
++	jmp	1f-__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
+ 	 * parameter 2, ..., param n. To make things easy, we save the return
+ 	 * address of efi_call_phys in a global variable.
+ 	 */
+-	popl	%edx
+-	movl	%edx, saved_return_addr
+-	/* get the function pointer into ECX*/
+-	popl	%ecx
+-	movl	%ecx, efi_rt_function_ptr
+-	movl	$2f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	pushl	%edx
++	popl	(saved_return_addr)
++	popl	(efi_rt_function_ptr)
+ 
+ 	/*
+ 	 * 3. Clear PG bit in %CR0.
+@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 5. Call the physical function.
+ 	 */
+-	jmp	*%ecx
++	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
+ 
+-2:
+ 	/*
+ 	 * 6. After EFI runtime service returns, control will return to
+ 	 * following instruction. We'd better readjust stack pointer first.
+@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
+ 	movl	%cr0, %edx
+ 	orl	$0x80000000, %edx
+ 	movl	%edx, %cr0
+-	jmp	1f
+-1:
++
+ 	/*
+ 	 * 8. Now restore the virtual mode from flat mode by
+ 	 * adding EIP with PAGE_OFFSET.
+ 	 */
+-	movl	$1f, %edx
+-	jmp	*%edx
++	jmp	1f+__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+ 	 * 9. Balance the stack. And because EAX contain the return value,
+ 	 * we'd better not clobber it.
+ 	 */
+-	leal	efi_rt_function_ptr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
++	pushl	(efi_rt_function_ptr)
+ 
+ 	/*
+-	 * 10. Push the saved return address onto the stack and return.
++	 * 10. Return to the saved return address.
+ 	 */
+-	leal	saved_return_addr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
+-	ret
++	jmpl	*(saved_return_addr)
+ ENDPROC(efi_call_phys)
+ .previous
+ 
+-.data
++__INITDATA
+ saved_return_addr:
+ 	.long 0
+ efi_rt_function_ptr:
+diff -urNp linux-2.6.32.14/arch/x86/kernel/entry_32.S linux-2.6.32.14/arch/x86/kernel/entry_32.S
+--- linux-2.6.32.14/arch/x86/kernel/entry_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/entry_32.S	2010-05-28 21:27:15.031137412 -0400
+@@ -191,7 +191,67 @@
+ 
+ #endif	/* CONFIG_X86_32_LAZY_GS */
+ 
+-.macro SAVE_ALL
++.macro PAX_EXIT_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++#endif
++	mov %cs, %esi
++	cmp $__KERNEXEC_KERNEL_CS, %esi
++	jnz 2f
++#ifdef CONFIG_PARAVIRT
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	btr $16, %esi
++	ljmp $__KERNEL_CS, $1f
++1:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
++#else
++	mov %esi, %cr0
++#endif
++2:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro PAX_ENTER_KERNEL
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_PARAVIRT
++	push %eax; push %ecx;
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	bts $16, %esi
++	jnc 1f
++	mov %cs, %esi
++	cmp $__KERNEL_CS, %esi
++	jz 3f
++	ljmp $__KERNEL_CS, $3f
++1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
++2:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
++#else
++	mov %esi, %cr0
++#endif
++3:
++#ifdef CONFIG_PARAVIRT
++	pop %ecx; pop %eax
++#endif
++#endif
++.endm
++
++.macro __SAVE_ALL _DS
+ 	cld
+ 	PUSH_GS
+ 	pushl %fs
+@@ -224,7 +284,7 @@
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+-	movl $(__USER_DS), %edx
++	movl $\_DS, %edx
+ 	movl %edx, %ds
+ 	movl %edx, %es
+ 	movl $(__KERNEL_PERCPU), %edx
+@@ -232,6 +292,15 @@
+ 	SET_KERNEL_GS %edx
+ .endm
+ 
++.macro SAVE_ALL
++#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
++	__SAVE_ALL __KERNEL_DS
++	PAX_ENTER_KERNEL
++#else
++	__SAVE_ALL __USER_DS
++#endif
++.endm
++
+ .macro RESTORE_INT_REGS
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+@@ -352,7 +421,15 @@ check_userspace:
+ 	movb PT_CS(%esp), %al
+ 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
+ 	cmpl $USER_RPL, %eax
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jae resume_userspace
++
++	PAX_EXIT_KERNEL
++	jmp resume_kernel
++#else
+ 	jb resume_kernel		# not returning to v8086 or userspace
++#endif
+ 
+ ENTRY(resume_userspace)
+ 	LOCKDEP_SYS_EXIT
+@@ -414,10 +491,9 @@ sysenter_past_esp:
+ 	/*CFI_REL_OFFSET cs, 0*/
+ 	/*
+ 	 * Push current_thread_info()->sysenter_return to the stack.
+-	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
+-	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
+ 	 */
+-	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
++	GET_THREAD_INFO(%ebp)
++	pushl TI_sysenter_return(%ebp)
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET eip, 0
+ 
+@@ -430,9 +506,19 @@ sysenter_past_esp:
+  * Load the potential sixth argument from user stack.
+  * Careful about security.
+  */
++	movl PT_OLDESP(%esp),%ebp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov PT_OLDSS(%esp),%ds
++1:	movl %ds:(%ebp),%ebp
++	push %ss
++	pop %ds
++#else
+ 	cmpl $__PAGE_OFFSET-3,%ebp
+ 	jae syscall_fault
+ 1:	movl (%ebp),%ebp
++#endif
++
+ 	movl %ebp,PT_EBP(%esp)
+ .section __ex_table,"a"
+ 	.align 4
+@@ -455,12 +541,23 @@ sysenter_do_call:
+ 	testl $_TIF_ALLWORK_MASK, %ecx
+ 	jne sysexit_audit
+ sysenter_exit:
++
++#ifdef CONFIG_PAX_RANDKSTACK
++	pushl %eax
++	CFI_ADJUST_CFA_OFFSET 4
++	call pax_randomize_kstack
++	popl %eax
++	CFI_ADJUST_CFA_OFFSET -4
++#endif
++
+ /* if something modifies registers it must also disable sysexit */
+ 	movl PT_EIP(%esp), %edx
+ 	movl PT_OLDESP(%esp), %ecx
+ 	xorl %ebp,%ebp
+ 	TRACE_IRQS_ON
+ 1:	mov  PT_FS(%esp), %fs
++2:	mov  PT_DS(%esp), %ds
++3:	mov  PT_ES(%esp), %es
+ 	PTGS_TO_GS
+ 	ENABLE_INTERRUPTS_SYSEXIT
+ 
+@@ -504,11 +601,17 @@ sysexit_audit:
+ 
+ 	CFI_ENDPROC
+ .pushsection .fixup,"ax"
+-2:	movl $0,PT_FS(%esp)
++4:	movl $0,PT_FS(%esp)
++	jmp 1b
++5:	movl $0,PT_DS(%esp)
++	jmp 1b
++6:	movl $0,PT_ES(%esp)
+ 	jmp 1b
+ .section __ex_table,"a"
+ 	.align 4
+-	.long 1b,2b
++	.long 1b,4b
++	.long 2b,5b
++	.long 3b,6b
+ .popsection
+ 	PTGS_TO_GS_EX
+ ENDPROC(ia32_sysenter_target)
+@@ -538,6 +641,10 @@ syscall_exit:
+ 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
+ 	jne syscall_exit_work
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++	call pax_randomize_kstack
++#endif
++
+ restore_all:
+ 	TRACE_IRQS_IRET
+ restore_all_notrace:
+@@ -602,7 +709,13 @@ ldt_ss:
+ 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
+ 	mov %dx, %ax			/* eax: new kernel esp */
+ 	sub %eax, %edx			/* offset (low word is 0) */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	shr $16, %edx
+ 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
+ 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
+@@ -642,25 +755,19 @@ work_resched:
+ 
+ work_notifysig:				# deal with pending signals and
+ 					# notify-resume requests
++	movl %esp, %eax
+ #ifdef CONFIG_VM86
+ 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
+-	movl %esp, %eax
+-	jne work_notifysig_v86		# returning to kernel-space or
++	jz 1f				# returning to kernel-space or
+ 					# vm86-space
+-	xorl %edx, %edx
+-	call do_notify_resume
+-	jmp resume_userspace_sig
+ 
+-	ALIGN
+-work_notifysig_v86:
+ 	pushl %ecx			# save ti_flags for do_notify_resume
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	call save_v86_state		# %eax contains pt_regs pointer
+ 	popl %ecx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	movl %eax, %esp
+-#else
+-	movl %esp, %eax
++1:
+ #endif
+ 	xorl %edx, %edx
+ 	call do_notify_resume
+@@ -695,6 +802,10 @@ END(syscall_exit_work)
+ 
+ 	RING0_INT_FRAME			# can't unwind into user space anyway
+ syscall_fault:
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %ss
++	pop %ds
++#endif
+ 	GET_THREAD_INFO(%ebp)
+ 	movl $-EFAULT,PT_EAX(%esp)
+ 	jmp resume_userspace
+@@ -735,7 +846,13 @@ PTREGSCALL(vm86old)
+  * normal stack and adjusts ESP with the matching offset.
+  */
+ 	/* fixup the stack */
+-	PER_CPU(gdt_page, %ebx)
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx
++	shll $PAGE_SHIFT_asm, %ebx
++	addl $cpu_gdt_table, %ebx
++#else
++	movl $cpu_gdt_table, %ebx
++#endif
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
+ 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
+ 	shl $16, %eax
+@@ -1198,7 +1315,6 @@ return_to_handler:
+ 	ret
+ #endif
+ 
+-.section .rodata,"a"
+ #include "syscall_table_32.S"
+ 
+ syscall_table_size=(.-sys_call_table)
+@@ -1250,12 +1366,15 @@ error_code:
+ 	movl %ecx, %fs
+ 	UNWIND_ESPFIX_STACK
+ 	GS_TO_REG %ecx
++
++	PAX_ENTER_KERNEL
++
+ 	movl PT_GS(%esp), %edi		# get the function address
+ 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
+ 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
+ 	REG_TO_PTGS %ecx
+ 	SET_KERNEL_GS %ecx
+-	movl $(__USER_DS), %ecx
++	movl $(__KERNEL_DS), %ecx
+ 	movl %ecx, %ds
+ 	movl %ecx, %es
+ 	TRACE_IRQS_OFF
+@@ -1351,6 +1470,9 @@ nmi_stack_correct:
+ 	xorl %edx,%edx		# zero error code
+ 	movl %esp,%eax		# pt_regs pointer
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	jmp restore_all_notrace
+ 	CFI_ENDPROC
+ 
+@@ -1391,6 +1513,9 @@ nmi_espfix_stack:
+ 	FIXUP_ESPFIX_STACK		# %eax == %esp
+ 	xorl %edx,%edx			# zero error code
+ 	call do_nmi
++
++	PAX_EXIT_KERNEL
++
+ 	RESTORE_REGS
+ 	lss 12+4(%esp), %esp		# back to espfix stack
+ 	CFI_ADJUST_CFA_OFFSET -24
+diff -urNp linux-2.6.32.14/arch/x86/kernel/entry_64.S linux-2.6.32.14/arch/x86/kernel/entry_64.S
+--- linux-2.6.32.14/arch/x86/kernel/entry_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/entry_64.S	2010-05-28 21:27:15.031137412 -0400
+@@ -53,6 +53,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+ #include <linux/elf-em.h>
+@@ -174,6 +175,189 @@ ENTRY(native_usergs_sysret64)
+ ENDPROC(native_usergs_sysret64)
+ #endif /* CONFIG_PARAVIRT */
+ 
++	.macro ljmpq sel, off
++#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
++	.byte 0x48; ljmp *1234f(%rip)
++	.pushsection .rodata
++	.align 16
++	1234: .quad \off; .word \sel
++	.popsection
++#else
++	push $\sel
++	push $\off
++	lretq
++#endif
++	.endm
++
++ENTRY(pax_enter_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	jnc 1f
++	mov %cs,%edi
++	cmp $__KERNEL_CS,%edi
++	jz 3f
++	ljmpq __KERNEL_CS,3f
++1:	ljmpq __KERNEXEC_KERNEL_CS,2f
++2:	SET_RDI_INTO_CR0
++3:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel)
++
++ENTRY(pax_exit_kernel)
++
++#ifdef CONFIG_PAX_KERNEXEC
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	mov %cs,%rdi
++	cmp $__KERNEXEC_KERNEL_CS,%edi
++	jnz 2f
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	ljmpq __KERNEL_CS,1f
++1:	SET_RDI_INTO_CR0
++2:
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI);
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel)
++
++ENTRY(pax_enter_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++	push %rbx
++
++#ifdef CONFIG_PARAVIRT
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++	GET_CR3_INTO_RDI
++	mov %rdi,%rbx
++	add $__START_KERNEL_map,%rbx
++	sub phys_base(%rip),%rbx
++
++#ifdef CONFIG_PARAVIRT
++	push %rdi
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0,i*8(%rbx)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	pop %rdi
++#endif
++	SET_RDI_INTO_CR3
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	bts $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++#ifdef CONFIG_PARAVIRT
++	PV_RESTORE_REGS(CLBR_RDI)
++#endif
++
++	pop %rbx
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_enter_kernel_user)
++
++ENTRY(pax_exit_kernel_user)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	push %rdi
++
++#ifdef CONFIG_PARAVIRT
++	push %rbx
++	PV_SAVE_REGS(CLBR_RDI)
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_RDI
++	btr $16,%rdi
++	SET_RDI_INTO_CR0
++#endif
++
++	GET_CR3_INTO_RDI
++	add $__START_KERNEL_map,%rdi
++	sub phys_base(%rip),%rdi
++
++#ifdef CONFIG_PARAVIRT
++	cmpl $0, pv_info+PARAVIRT_enabled
++	jz 1f
++	mov %rdi,%rbx
++	i = 0
++	.rept USER_PGD_PTRS
++	mov i*8(%rbx),%rsi
++	mov $0x67,%sil
++	lea i*8(%rbx),%rdi
++	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
++	i = i + 1
++	.endr
++	jmp 2f
++1:
++#endif
++
++	i = 0
++	.rept USER_PGD_PTRS
++	movb $0x67,i*8(%rdi)
++	i = i + 1
++	.endr
++
++#ifdef CONFIG_PARAVIRT
++2:	PV_RESTORE_REGS(CLBR_RDI)
++	pop %rbx
++#endif
++
++	pop %rdi
++#endif
++
++	retq
++ENDPROC(pax_exit_kernel_user)
+ 
+ .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
+ #ifdef CONFIG_TRACE_IRQFLAGS
+@@ -317,7 +501,7 @@ ENTRY(save_args)
+ 	leaq -ARGOFFSET+16(%rsp),%rdi	/* arg1 for handler */
+ 	movq_cfi rbp, 8		/* push %rbp */
+ 	leaq 8(%rsp), %rbp		/* mov %rsp, %ebp */
+-	testl $3, CS(%rdi)
++	testb $3, CS(%rdi)
+ 	je 1f
+ 	SWAPGS
+ 	/*
+@@ -409,7 +593,7 @@ ENTRY(ret_from_fork)
+ 
+ 	RESTORE_REST
+ 
+-	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
++	testb $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
+ 	je   int_ret_from_sys_call
+ 
+ 	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
+@@ -468,6 +652,11 @@ ENTRY(system_call_after_swapgs)
+ 
+ 	movq	%rsp,PER_CPU_VAR(old_rsp)
+ 	movq	PER_CPU_VAR(kernel_stack),%rsp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_enter_kernel_user
++#endif
++
+ 	/*
+ 	 * No need to follow this irqs off/on section - it's straight
+ 	 * and short:
+@@ -502,6 +691,11 @@ sysret_check:
+ 	andl %edi,%edx
+ 	jnz  sysret_careful
+ 	CFI_REMEMBER_STATE
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	/*
+ 	 * sysretq will re-enable interrupts:
+ 	 */
+@@ -613,7 +807,7 @@ tracesys:
+ GLOBAL(int_ret_from_sys_call)
+ 	DISABLE_INTERRUPTS(CLBR_NONE)
+ 	TRACE_IRQS_OFF
+-	testl $3,CS-ARGOFFSET(%rsp)
++	testb $3,CS-ARGOFFSET(%rsp)
+ 	je retint_restore_args
+ 	movl $_TIF_ALLWORK_MASK,%edi
+ 	/* edi:	mask to check */
+@@ -800,6 +994,16 @@ END(interrupt)
+ 	CFI_ADJUST_CFA_OFFSET 10*8
+ 	call save_args
+ 	PARTIAL_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rdi)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	call \func
+ 	.endm
+ 
+@@ -822,7 +1026,7 @@ ret_from_intr:
+ 	CFI_ADJUST_CFA_OFFSET	-8
+ exit_intr:
+ 	GET_THREAD_INFO(%rcx)
+-	testl $3,CS-ARGOFFSET(%rsp)
++	testb $3,CS-ARGOFFSET(%rsp)
+ 	je retint_kernel
+ 
+ 	/* Interrupt came from user space */
+@@ -844,12 +1048,18 @@ retint_swapgs:		/* return to user-space 
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#endif
++
+ 	TRACE_IRQS_IRETQ
+ 	SWAPGS
+ 	jmp restore_args
+ 
+ retint_restore_args:	/* return to kernel space */
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
++	call pax_exit_kernel
+ 	/*
+ 	 * The iretq could re-enable interrupts:
+ 	 */
+@@ -1032,6 +1242,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+@@ -1049,6 +1269,16 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+ 	call \do_sym
+@@ -1066,9 +1296,24 @@ ENTRY(\sym)
+ 	subq $15*8, %rsp
+ 	call save_paranoid
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi		/* pt_regs pointer */
+ 	xorl %esi,%esi		/* no error code */
+-	PER_CPU(init_tss, %rbp)
++#ifdef CONFIG_SMP
++	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
++	lea init_tss(%rbp), %rbp
++#else
++	lea init_tss(%rip), %rbp
++#endif
+ 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+ 	call \do_sym
+ 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
+@@ -1085,6 +1330,16 @@ ENTRY(\sym)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call error_entry
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+@@ -1104,6 +1359,16 @@ ENTRY(\sym)
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
+ 	TRACE_IRQS_OFF
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	movq %rsp,%rdi			/* pt_regs pointer */
+ 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
+ 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
+@@ -1405,14 +1670,27 @@ ENTRY(paranoid_exit)
+ 	TRACE_IRQS_OFF
+ 	testl %ebx,%ebx				/* swapgs needed? */
+ 	jnz paranoid_restore
+-	testl $3,CS(%rsp)
++	testb $3,CS(%rsp)
+ 	jnz   paranoid_userspace
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel
++	TRACE_IRQS_IRETQ 0
++	SWAPGS_UNSAFE_STACK
++	RESTORE_ALL 8
++	jmp irq_return
++#endif
+ paranoid_swapgs:
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	call pax_exit_kernel_user
++#else
++	call pax_exit_kernel
++#endif
+ 	TRACE_IRQS_IRETQ 0
+ 	SWAPGS_UNSAFE_STACK
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ paranoid_restore:
++	call pax_exit_kernel
+ 	TRACE_IRQS_IRETQ 0
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+@@ -1470,7 +1748,7 @@ ENTRY(error_entry)
+ 	movq_cfi r14, R14+8
+ 	movq_cfi r15, R15+8
+ 	xorl %ebx,%ebx
+-	testl $3,CS+8(%rsp)
++	testb $3,CS+8(%rsp)
+ 	je error_kernelspace
+ error_swapgs:
+ 	SWAPGS
+@@ -1529,6 +1807,16 @@ ENTRY(nmi)
+ 	CFI_ADJUST_CFA_OFFSET 15*8
+ 	call save_paranoid
+ 	DEFAULT_FRAME 0
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	testb $3, CS(%rsp)
++	jnz 1f
++	call pax_enter_kernel
++	jmp 2f
++1:	call pax_enter_kernel_user
++2:
++#else
++	call pax_enter_kernel
++#endif
+ 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
+ 	movq %rsp,%rdi
+ 	movq $-1,%rsi
+@@ -1539,11 +1827,12 @@ ENTRY(nmi)
+ 	DISABLE_INTERRUPTS(CLBR_NONE)
+ 	testl %ebx,%ebx				/* swapgs needed? */
+ 	jnz nmi_restore
+-	testl $3,CS(%rsp)
++	testb $3,CS(%rsp)
+ 	jnz nmi_userspace
+ nmi_swapgs:
+ 	SWAPGS_UNSAFE_STACK
+ nmi_restore:
++	call pax_exit_kernel
+ 	RESTORE_ALL 8
+ 	jmp irq_return
+ nmi_userspace:
+diff -urNp linux-2.6.32.14/arch/x86/kernel/ftrace.c linux-2.6.32.14/arch/x86/kernel/ftrace.c
+--- linux-2.6.32.14/arch/x86/kernel/ftrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/ftrace.c	2010-05-28 21:27:15.031137412 -0400
+@@ -149,7 +149,9 @@ void ftrace_nmi_enter(void)
+ {
+ 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
+ 		smp_rmb();
++		pax_open_kernel();
+ 		ftrace_mod_code();
++		pax_close_kernel();
+ 		atomic_inc(&nmi_update_count);
+ 	}
+ 	/* Must have previous changes seen before executions */
+@@ -215,7 +217,7 @@ do_ftrace_mod_code(unsigned long ip, voi
+ 
+ 
+ 
+-static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
++static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
+ 
+ static unsigned char *ftrace_nop_replace(void)
+ {
+@@ -228,6 +230,8 @@ ftrace_modify_code(unsigned long ip, uns
+ {
+ 	unsigned char replaced[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	/*
+ 	 * Note: Due to modules and __init, code can
+ 	 *  disappear and change, we need to protect against faulting
+@@ -284,7 +288,7 @@ int ftrace_update_ftrace_func(ftrace_fun
+ 	unsigned char old[MCOUNT_INSN_SIZE], *new;
+ 	int ret;
+ 
+-	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
++	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
+ 	new = ftrace_call_replace(ip, (unsigned long)func);
+ 	ret = ftrace_modify_code(ip, old, new);
+ 
+@@ -337,15 +341,15 @@ int __init ftrace_dyn_arch_init(void *da
+ 	switch (faulted) {
+ 	case 0:
+ 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
+-		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 1:
+ 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
+-		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
+ 		break;
+ 	case 2:
+ 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
+-		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
++		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
+ 		break;
+ 	}
+ 
+@@ -366,6 +370,8 @@ static int ftrace_mod_jmp(unsigned long 
+ {
+ 	unsigned char code[MCOUNT_INSN_SIZE];
+ 
++	ip = ktla_ktva(ip);
++
+ 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/head32.c linux-2.6.32.14/arch/x86/kernel/head32.c
+--- linux-2.6.32.14/arch/x86/kernel/head32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/head32.c	2010-05-28 21:27:15.031137412 -0400
+@@ -16,6 +16,7 @@
+ #include <asm/apic.h>
+ #include <asm/io_apic.h>
+ #include <asm/bios_ebda.h>
++#include <asm/boot.h>
+ 
+ static void __init i386_default_early_setup(void)
+ {
+@@ -31,7 +32,7 @@ void __init i386_start_kernel(void)
+ {
+ 	reserve_trampoline_memory();
+ 
+-	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
++	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
+ 
+ #ifdef CONFIG_BLK_DEV_INITRD
+ 	/* Reserve INITRD */
+diff -urNp linux-2.6.32.14/arch/x86/kernel/head_32.S linux-2.6.32.14/arch/x86/kernel/head_32.S
+--- linux-2.6.32.14/arch/x86/kernel/head_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/head_32.S	2010-05-28 21:27:15.039159907 -0400
+@@ -19,10 +19,17 @@
+ #include <asm/setup.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/msr-index.h>
+ 
+ /* Physical address */
+ #define pa(X) ((X) - __PAGE_OFFSET)
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /*
+  * References to members of the new_cpu_data structure.
+  */
+@@ -52,11 +59,7 @@
+  * and small than max_low_pfn, otherwise will waste some page table entries
+  */
+ 
+-#if PTRS_PER_PMD > 1
+-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
+-#else
+-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
+-#endif
++#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
+ 
+ /* Enough space to fit pagetables for the low memory linear map */
+ MAPPING_BEYOND_END = \
+@@ -73,6 +76,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
+ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+ 
+ /*
++ * Real beginning of normal "text" segment
++ */
++ENTRY(stext)
++ENTRY(_stext)
++
++/*
+  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
+  * %esi points to the real-mode code as a 32-bit pointer.
+  * CS and DS must be 4 GB flat segments, but we don't depend on
+@@ -80,6 +89,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
+  * can.
+  */
+ __HEAD
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jmp startup_32
++/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
++.fill PAGE_SIZE-5,1,0xcc
++#endif
++
+ ENTRY(startup_32)
+ 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
+ 		us to not reload segments */
+@@ -97,6 +113,55 @@ ENTRY(startup_32)
+ 	movl %eax,%gs
+ 2:
+ 
++#ifdef CONFIG_SMP
++	movl $pa(cpu_gdt_table),%edi
++	movl $__per_cpu_load,%eax
++	movw %ax,__KERNEL_PERCPU + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_PERCPU + 4(%edi)
++	movb %ah,__KERNEL_PERCPU + 7(%edi)
++	movl $__per_cpu_end - 1,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,__KERNEL_PERCPU + 0(%edi)
++#endif
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++1:
++	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	movl $pa(boot_gdt),%edi
++	movl $__LOAD_PHYSICAL_ADDR,%eax
++	movw %ax,__BOOT_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__BOOT_CS + 4(%edi)
++	movb %ah,__BOOT_CS + 7(%edi)
++	rorl $16,%eax
++
++	ljmp $(__BOOT_CS),$1f
++1:
++
++	movl $NR_CPUS,%ecx
++	movl $pa(cpu_gdt_table),%edi
++	addl $__PAGE_OFFSET,%eax
++1:
++	movw %ax,__KERNEL_CS + 2(%edi)
++	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_CS + 4(%edi)
++	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
++	movb %ah,__KERNEL_CS + 7(%edi)
++	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
++	rorl $16,%eax
++	addl $PAGE_SIZE_asm,%edi
++	loop 1b
++#endif
++
+ /*
+  * Clear BSS first so that there are no surprises...
+  */
+@@ -140,9 +205,7 @@ ENTRY(startup_32)
+ 	cmpl $num_subarch_entries, %eax
+ 	jae bad_subarch
+ 
+-	movl pa(subarch_entries)(,%eax,4), %eax
+-	subl $__PAGE_OFFSET, %eax
+-	jmp *%eax
++	jmp *pa(subarch_entries)(,%eax,4)
+ 
+ bad_subarch:
+ WEAK(lguest_entry)
+@@ -154,10 +217,10 @@ WEAK(xen_entry)
+ 	__INITDATA
+ 
+ subarch_entries:
+-	.long default_entry		/* normal x86/PC */
+-	.long lguest_entry		/* lguest hypervisor */
+-	.long xen_entry			/* Xen hypervisor */
+-	.long default_entry		/* Moorestown MID */
++	.long ta(default_entry)		/* normal x86/PC */
++	.long ta(lguest_entry)		/* lguest hypervisor */
++	.long ta(xen_entry)		/* Xen hypervisor */
++	.long ta(default_entry)		/* Moorestown MID */
+ num_subarch_entries = (. - subarch_entries) / 4
+ .previous
+ #endif /* CONFIG_PARAVIRT */
+@@ -218,8 +281,11 @@ default_entry:
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
++#endif
+ #else	/* Not PAE */
+ 
+ page_pde_offset = (__PAGE_OFFSET >> 20);
+@@ -249,8 +315,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
+ 	movl %eax, pa(max_pfn_mapped)
+ 
+ 	/* Do early initialization of the fixmap area */
+-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
+-	movl %eax,pa(swapper_pg_dir+0xffc)
++#ifdef CONFIG_COMPAT_VDSO
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
++#else
++	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
++#endif
+ #endif
+ 	jmp 3f
+ /*
+@@ -297,6 +366,7 @@ ENTRY(startup_32_smp)
+ 	orl %edx,%eax
+ 	movl %eax,%cr4
+ 
++#ifdef CONFIG_X86_PAE
+ 	btl $5, %eax		# check if PAE is enabled
+ 	jnc 6f
+ 
+@@ -312,13 +382,17 @@ ENTRY(startup_32_smp)
+ 	jnc 6f
+ 
+ 	/* Setup EFER (Extended Feature Enable Register) */
+-	movl $0xc0000080, %ecx
++	movl $MSR_EFER, %ecx
+ 	rdmsr
+ 
+ 	btsl $11, %eax
+ 	/* Make changes effective */
+ 	wrmsr
+ 
++	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
++	movl $1,pa(nx_enabled)
++#endif
++
+ 6:
+ 
+ /*
+@@ -344,9 +418,7 @@ ENTRY(startup_32_smp)
+ 
+ #ifdef CONFIG_SMP
+ 	cmpb $0, ready
+-	jz  1f				/* Initial CPU cleans BSS */
+-	jmp checkCPUtype
+-1:
++	jnz checkCPUtype		/* Initial CPU cleans BSS */
+ #endif /* CONFIG_SMP */
+ 
+ /*
+@@ -424,7 +496,7 @@ is386:	movl $2,%ecx		# set MP
+ 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
+ 	movl %eax,%ss			# after changing gdt.
+ 
+-	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
++#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
+ 	movl %eax,%ds
+ 	movl %eax,%es
+ 
+@@ -438,8 +510,11 @@ is386:	movl $2,%ecx		# set MP
+ 	 */
+ 	cmpb $0,ready
+ 	jne 1f
+-	movl $per_cpu__gdt_page,%eax
++	movl $cpu_gdt_table,%eax
+ 	movl $per_cpu__stack_canary,%ecx
++#ifdef CONFIG_SMP
++	addl $__per_cpu_load,%ecx
++#endif
+ 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+ 	shrl $16, %ecx
+ 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+@@ -457,10 +532,6 @@ is386:	movl $2,%ecx		# set MP
+ #ifdef CONFIG_SMP
+ 	movb ready, %cl
+ 	movb $1, ready
+-	cmpb $0,%cl		# the first CPU calls start_kernel
+-	je   1f
+-	movl (stack_start), %esp
+-1:
+ #endif /* CONFIG_SMP */
+ 	jmp *(initial_code)
+ 
+@@ -546,22 +617,22 @@ early_page_fault:
+ 	jmp early_fault
+ 
+ early_fault:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $1,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pusha
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	movl %cr2,%eax
+ 	pushl %eax
+ 	pushl %edx		/* trapno */
+ 	pushl $fault_msg
+ 	call printk
++;	call dump_stack
+ #endif
+-	call dump_stack
+ hlt_loop:
+ 	hlt
+ 	jmp hlt_loop
+@@ -569,8 +640,11 @@ hlt_loop:
+ /* This is the default interrupt "handler" :-) */
+ 	ALIGN
+ ignore_int:
+-	cld
+ #ifdef CONFIG_PRINTK
++	cmpl $2,%ss:early_recursion_flag
++	je hlt_loop
++	incl %ss:early_recursion_flag
++	cld
+ 	pushl %eax
+ 	pushl %ecx
+ 	pushl %edx
+@@ -579,9 +653,6 @@ ignore_int:
+ 	movl $(__KERNEL_DS),%eax
+ 	movl %eax,%ds
+ 	movl %eax,%es
+-	cmpl $2,early_recursion_flag
+-	je hlt_loop
+-	incl early_recursion_flag
+ 	pushl 16(%esp)
+ 	pushl 24(%esp)
+ 	pushl 32(%esp)
+@@ -608,27 +679,45 @@ ENTRY(initial_code)
+ /*
+  * BSS section
+  */
+-__PAGE_ALIGNED_BSS
+-	.align PAGE_SIZE_asm
+ #ifdef CONFIG_X86_PAE
++.section .swapper_pg_pmd,"a",@progbits
+ swapper_pg_pmd:
+ 	.fill 1024*KPMDS,4,0
+ #else
++.section .swapper_pg_dir,"a",@progbits
+ ENTRY(swapper_pg_dir)
+ 	.fill 1024,4,0
+ #endif
++
+ swapper_pg_fixmap:
+ 	.fill 1024,4,0
++
++.section .empty_zero_page,"a",@progbits
+ ENTRY(empty_zero_page)
+ 	.fill 4096,1,0
+ 
+ /*
++ * The IDT has to be page-aligned to simplify the Pentium
++ * F0 0F bug workaround.. We have a special link segment
++ * for this.
++ */
++.section .idt,"a",@progbits
++ENTRY(idt_table)
++	.fill 256,8,0
++
++/*
+  * This starts the data section.
+  */
+ #ifdef CONFIG_X86_PAE
+-__PAGE_ALIGNED_DATA
+-	/* Page-aligned for the benefit of paravirt? */
+-	.align PAGE_SIZE_asm
++.section .swapper_pg_dir,"a",@progbits
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++ENTRY(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ ENTRY(swapper_pg_dir)
+ 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
+ # if KPMDS == 3
+@@ -651,11 +740,12 @@ ENTRY(swapper_pg_dir)
+ 
+ .data
+ ENTRY(stack_start)
+-	.long init_thread_union+THREAD_SIZE
++	.long init_thread_union+THREAD_SIZE-8
+ 	.long __BOOT_DS
+ 
+ ready:	.byte 0
+ 
++.section .rodata,"a",@progbits
+ early_recursion_flag:
+ 	.long 0
+ 
+@@ -691,7 +781,7 @@ fault_msg:
+ 	.word 0				# 32 bit align gdt_desc.address
+ boot_gdt_descr:
+ 	.word __BOOT_DS+7
+-	.long boot_gdt - __PAGE_OFFSET
++	.long pa(boot_gdt)
+ 
+ 	.word 0				# 32-bit align idt_desc.address
+ idt_descr:
+@@ -702,7 +792,7 @@ idt_descr:
+ 	.word 0				# 32 bit align gdt_desc.address
+ ENTRY(early_gdt_descr)
+ 	.word GDT_ENTRIES*8-1
+-	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
++	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
+ 
+ /*
+  * The boot_gdt must mirror the equivalent in setup.S and is
+@@ -711,5 +801,65 @@ ENTRY(early_gdt_descr)
+ 	.align L1_CACHE_BYTES
+ ENTRY(boot_gdt)
+ 	.fill GDT_ENTRY_BOOT_CS,8,0
+-	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
+-	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
++	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
++
++	.align PAGE_SIZE_asm
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad 0x0000000000000000	/* NULL descriptor */
++	.quad 0x0000000000000000	/* 0x0b reserved */
++	.quad 0x0000000000000000	/* 0x13 reserved */
++	.quad 0x0000000000000000	/* 0x1b reserved */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
++#else
++	.quad 0x0000000000000000	/* 0x20 unused */
++#endif
++
++	.quad 0x0000000000000000	/* 0x28 unused */
++	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
++	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
++	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
++	.quad 0x0000000000000000	/* 0x4b reserved */
++	.quad 0x0000000000000000	/* 0x53 reserved */
++	.quad 0x0000000000000000	/* 0x5b reserved */
++
++	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
++	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
++	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
++	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
++
++	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
++	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
++
++	/*
++	 * Segments used for calling PnP BIOS have byte granularity.
++	 * The code segments and data segments have fixed 64k limits,
++	 * the transfer segment sizes are set at run time.
++	 */
++	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
++	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
++	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
++	.quad 0x0000930000000000	/* 0xa8 16-bit data */
++	.quad 0x0000930000000000	/* 0xb0 16-bit data */
++
++	/*
++	 * The APM segments have byte granularity and their bases
++	 * are set at run time.  All have 64k limits.
++	 */
++	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
++	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
++	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
++
++	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
++	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
++	.quad 0x0040910000000018	/* 0xe0 - STACK_CANARY */
++	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
++	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
++	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
++
++	/* Be sure this is zeroed to avoid false validations in Xen */
++	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
++	.endr
+diff -urNp linux-2.6.32.14/arch/x86/kernel/head64.c linux-2.6.32.14/arch/x86/kernel/head64.c
+--- linux-2.6.32.14/arch/x86/kernel/head64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/head64.c	2010-05-28 21:27:15.039159907 -0400
+@@ -29,7 +29,13 @@
+ static void __init zap_identity_mappings(void)
+ {
+ 	pgd_t *pgd = pgd_offset_k(0UL);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	set_pgd(pgd, native_make_pgd(0));
++#else
+ 	pgd_clear(pgd);
++#endif
++
+ 	__flush_tlb_all();
+ }
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/head_64.S linux-2.6.32.14/arch/x86/kernel/head_64.S
+--- linux-2.6.32.14/arch/x86/kernel/head_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/head_64.S	2010-05-28 21:27:15.039159907 -0400
+@@ -19,6 +19,7 @@
+ #include <asm/cache.h>
+ #include <asm/processor-flags.h>
+ #include <asm/percpu.h>
++#include <asm/cpufeature.h>
+ 
+ #ifdef CONFIG_PARAVIRT
+ #include <asm/asm-offsets.h>
+@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
+ L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
+ L4_START_KERNEL = pgd_index(__START_KERNEL_map)
+ L3_START_KERNEL = pud_index(__START_KERNEL_map)
++L4_VMALLOC_START = pgd_index(VMALLOC_START)
++L3_VMALLOC_START = pud_index(VMALLOC_START)
++L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
++L3_VMEMMAP_START = pud_index(VMEMMAP_START)
+ 
+ 	.text
+ 	__HEAD
+@@ -85,35 +90,22 @@ startup_64:
+ 	 */
+ 	addq	%rbp, init_level4_pgt + 0(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
++	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
+ 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
+ 
+ 	addq	%rbp, level3_ident_pgt + 0(%rip)
++#ifndef CONFIG_XEN
++	addq	%rbp, level3_ident_pgt + 8(%rip)
++#endif
+ 
+-	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
+-	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
++	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
+ 
+-	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
++	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
+ 
+-	/* Add an Identity mapping if I am above 1G */
+-	leaq	_text(%rip), %rdi
+-	andq	$PMD_PAGE_MASK, %rdi
+-
+-	movq	%rdi, %rax
+-	shrq	$PUD_SHIFT, %rax
+-	andq	$(PTRS_PER_PUD - 1), %rax
+-	jz	ident_complete
+-
+-	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
+-	leaq	level3_ident_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-
+-	movq	%rdi, %rax
+-	shrq	$PMD_SHIFT, %rax
+-	andq	$(PTRS_PER_PMD - 1), %rax
+-	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
+-	leaq	level2_spare_pgt(%rip), %rbx
+-	movq	%rdx, 0(%rbx, %rax, 8)
+-ident_complete:
++	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
++	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
+ 
+ 	/*
+ 	 * Fixup the kernel text+data virtual addresses. Note that
+@@ -161,8 +153,8 @@ ENTRY(secondary_startup_64)
+ 	 * after the boot processor executes this code.
+ 	 */
+ 
+-	/* Enable PAE mode and PGE */
+-	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
++	/* Enable PAE mode and PSE/PGE */
++	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
+ 	movq	%rax, %cr4
+ 
+ 	/* Setup early boot stage 4 level pagetables. */
+@@ -184,9 +176,13 @@ ENTRY(secondary_startup_64)
+ 	movl	$MSR_EFER, %ecx
+ 	rdmsr
+ 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
+-	btl	$20,%edi		/* No Execute supported? */
++	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
+ 	jnc     1f
+ 	btsl	$_EFER_NX, %eax
++	leaq	init_level4_pgt(%rip), %rdi
++	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
++	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
+ 1:	wrmsr				/* Make changes effective */
+ 
+ 	/* Setup cr0 */
+@@ -262,16 +258,16 @@ ENTRY(secondary_startup_64)
+ 	.quad	x86_64_start_kernel
+ 	ENTRY(initial_gs)
+ 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
+-	__FINITDATA
+ 
+ 	ENTRY(stack_start)
+ 	.quad  init_thread_union+THREAD_SIZE-8
+ 	.word  0
++	__FINITDATA
+ 
+ bad_address:
+ 	jmp bad_address
+ 
+-	.section ".init.text","ax"
++	__INIT
+ #ifdef CONFIG_EARLY_PRINTK
+ 	.globl early_idt_handlers
+ early_idt_handlers:
+@@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
+ #endif /* EARLY_PRINTK */
+ 1:	hlt
+ 	jmp 1b
++	.previous
+ 
+ #ifdef CONFIG_EARLY_PRINTK
++	__INITDATA
+ early_recursion_flag:
+ 	.long 0
++	.previous
+ 
++	.section .rodata,"a",@progbits
+ early_idt_msg:
+ 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
+ early_idt_ripmsg:
+ 	.asciz "RIP %s\n"
+-#endif /* CONFIG_EARLY_PRINTK */
+ 	.previous
++#endif /* CONFIG_EARLY_PRINTK */
+ 
++	.section .rodata,"a",@progbits
+ #define NEXT_PAGE(name) \
+ 	.balign	PAGE_SIZE; \
+ ENTRY(name)
+@@ -350,13 +351,36 @@ NEXT_PAGE(init_level4_pgt)
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
+ 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
++	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
++	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
++	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
+ 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
+ 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++NEXT_PAGE(cpu_pgd)
++	.rept NR_CPUS
++	.fill	512,8,0
++	.endr
++#endif
++
+ NEXT_PAGE(level3_ident_pgt)
+ 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
++#ifdef CONFIG_XEN
+ 	.fill	511,8,0
++#else
++	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
++	.fill	510,8,0
++#endif
++
++NEXT_PAGE(level3_vmalloc_pgt)
++	.fill	512,8,0
++
++NEXT_PAGE(level3_vmemmap_pgt)
++	.fill	L3_VMEMMAP_START,8,0
++	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 
+ NEXT_PAGE(level3_kernel_pgt)
+ 	.fill	L3_START_KERNEL,8,0
+@@ -364,20 +388,23 @@ NEXT_PAGE(level3_kernel_pgt)
+ 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
+ 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+ 
++NEXT_PAGE(level2_vmemmap_pgt)
++	.fill	512,8,0
++
+ NEXT_PAGE(level2_fixmap_pgt)
+-	.fill	506,8,0
+-	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+-	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
+-	.fill	5,8,0
++	.fill	507,8,0
++	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
++	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
++	.fill	4,8,0
+ 
+-NEXT_PAGE(level1_fixmap_pgt)
++NEXT_PAGE(level1_vsyscall_pgt)
+ 	.fill	512,8,0
+ 
+-NEXT_PAGE(level2_ident_pgt)
+-	/* Since I easily can, map the first 1G.
++	/* Since I easily can, map the first 2G.
+ 	 * Don't set NX because code runs from these pages.
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
++NEXT_PAGE(level2_ident_pgt)
++	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
+ 
+ NEXT_PAGE(level2_kernel_pgt)
+ 	/*
+@@ -390,33 +417,55 @@ NEXT_PAGE(level2_kernel_pgt)
+ 	 *  If you want to increase this then increase MODULES_VADDR
+ 	 *  too.)
+ 	 */
+-	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
+-		KERNEL_IMAGE_SIZE/PMD_SIZE)
+-
+-NEXT_PAGE(level2_spare_pgt)
+-	.fill   512, 8, 0
++	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
+ 
+ #undef PMDS
+ #undef NEXT_PAGE
+ 
+-	.data
++	.align PAGE_SIZE
++ENTRY(cpu_gdt_table)
++	.rept NR_CPUS
++	.quad	0x0000000000000000	/* NULL descriptor */
++	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
++	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
++	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
++	.quad	0x00cffb000000ffff	/* __USER32_CS */
++	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
++	.quad	0x00affb000000ffff	/* __USER_CS */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
++#else
++	.quad	0x0			/* unused */
++#endif
++
++	.quad	0,0			/* TSS */
++	.quad	0,0			/* LDT */
++	.quad	0,0,0			/* three TLS descriptors */
++	.quad	0x0000f40000000000	/* node/CPU stored in limit */
++	/* asm/segment.h:GDT_ENTRIES must match this */
++
++	/* zero the remaining page */
++	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
++	.endr
++
+ 	.align 16
+ 	.globl early_gdt_descr
+ early_gdt_descr:
+ 	.word	GDT_ENTRIES*8-1
+ early_gdt_descr_base:
+-	.quad	INIT_PER_CPU_VAR(gdt_page)
++	.quad	cpu_gdt_table
+ 
+ ENTRY(phys_base)
+ 	/* This must match the first entry in level2_kernel_pgt */
+ 	.quad   0x0000000000000000
+ 
+ #include "../../x86/xen/xen-head.S"
+-	
+-	.section .bss, "aw", @nobits
++
++	.section .rodata,"a",@progbits
+ 	.align L1_CACHE_BYTES
+ ENTRY(idt_table)
+-	.skip IDT_ENTRIES * 16
++	.fill 512,8,0
+ 
+ 	__PAGE_ALIGNED_BSS
+ 	.align PAGE_SIZE
+diff -urNp linux-2.6.32.14/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.14/arch/x86/kernel/i386_ksyms_32.c
+--- linux-2.6.32.14/arch/x86/kernel/i386_ksyms_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/i386_ksyms_32.c	2010-05-28 21:27:15.039159907 -0400
+@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
+ EXPORT_SYMBOL(cmpxchg8b_emu);
+ #endif
+ 
++EXPORT_SYMBOL_GPL(cpu_gdt_table);
++
+ /* Networking helper routines. */
+ EXPORT_SYMBOL(csum_partial_copy_generic);
++EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
++EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
+ 
+ EXPORT_SYMBOL(__get_user_1);
+ EXPORT_SYMBOL(__get_user_2);
+@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
+ 
+ EXPORT_SYMBOL(csum_partial);
+ EXPORT_SYMBOL(empty_zero_page);
++
++#ifdef CONFIG_PAX_KERNEXEC
++EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
++#endif
+diff -urNp linux-2.6.32.14/arch/x86/kernel/init_task.c linux-2.6.32.14/arch/x86/kernel/init_task.c
+--- linux-2.6.32.14/arch/x86/kernel/init_task.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/init_task.c	2010-05-28 21:27:15.039159907 -0400
+@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
+  * section. Since TSS's are completely CPU-local, we want them
+  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
+  */
+-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
+-
++struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
++EXPORT_SYMBOL(init_tss);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/ioport.c linux-2.6.32.14/arch/x86/kernel/ioport.c
+--- linux-2.6.32.14/arch/x86/kernel/ioport.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/ioport.c	2010-05-28 21:27:15.039159907 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/sched.h>
+ #include <linux/kernel.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/ioport.h>
+@@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
+ 
+ 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
+ 		return -EINVAL;
++#ifdef CONFIG_GRKERNSEC_IO
++	if (turn_on) {
++		gr_handle_ioperm();
++		return -EPERM;
++	}
++#endif
+ 	if (turn_on && !capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 
+@@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
+ 	 * because the ->io_bitmap_max value must match the bitmap
+ 	 * contents:
+ 	 */
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 
+ 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
+ 
+@@ -111,8 +118,13 @@ static int do_iopl(unsigned int level, s
+ 		return -EINVAL;
+ 	/* Trying to gain more privileges? */
+ 	if (level > old) {
++#ifdef CONFIG_GRKERNSEC_IO
++		gr_handle_iopl();
++		return -EPERM;
++#else
+ 		if (!capable(CAP_SYS_RAWIO))
+ 			return -EPERM;
++#endif
+ 	}
+ 	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/irq_32.c linux-2.6.32.14/arch/x86/kernel/irq_32.c
+--- linux-2.6.32.14/arch/x86/kernel/irq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/irq_32.c	2010-05-28 21:27:15.039159907 -0400
+@@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
+ 		return 0;
+ 
+ 	/* build the stack frame on the IRQ stack */
+-	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 	irqctx->tinfo.task = curctx->tinfo.task;
+ 	irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+@@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
+ 		irqctx->tinfo.previous_esp = current_stack_pointer;
+ 
+ 		/* build the stack frame on the softirq stack */
+-		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
++		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+ 
+ 		call_on_stack(__do_softirq, isp);
+ 		/*
+diff -urNp linux-2.6.32.14/arch/x86/kernel/kgdb.c linux-2.6.32.14/arch/x86/kernel/kgdb.c
+--- linux-2.6.32.14/arch/x86/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/kgdb.c	2010-05-28 21:27:15.039159907 -0400
+@@ -573,7 +573,7 @@ unsigned long kgdb_arch_pc(int exception
+ 	return instruction_pointer(regs);
+ }
+ 
+-struct kgdb_arch arch_kgdb_ops = {
++const struct kgdb_arch arch_kgdb_ops = {
+ 	/* Breakpoint instruction: */
+ 	.gdb_bpt_instr		= { 0xcc },
+ 	.flags			= KGDB_HW_BREAKPOINT,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/kprobes.c linux-2.6.32.14/arch/x86/kernel/kprobes.c
+--- linux-2.6.32.14/arch/x86/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/kprobes.c	2010-05-28 21:27:15.039159907 -0400
+@@ -166,9 +166,13 @@ static void __kprobes set_jmp_op(void *f
+ 		char op;
+ 		s32 raddr;
+ 	} __attribute__((packed)) * jop;
+-	jop = (struct __arch_jmp_op *)from;
++
++	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
++
++	pax_open_kernel();
+ 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
+ 	jop->op = RELATIVEJUMP_INSTRUCTION;
++	pax_close_kernel();
+ }
+ 
+ /*
+@@ -337,7 +341,9 @@ static void __kprobes fix_riprel(struct 
+ 			disp = (u8 *) p->addr + *((s32 *) insn) -
+ 			       (u8 *) p->ainsn.insn;
+ 			BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
++			pax_open_kernel();
+ 			*(s32 *)insn = (s32) disp;
++			pax_close_kernel();
+ 		}
+ 	}
+ #endif
+@@ -345,16 +351,18 @@ static void __kprobes fix_riprel(struct 
+ 
+ static void __kprobes arch_copy_kprobe(struct kprobe *p)
+ {
+-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_open_kernel();
++	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
++	pax_close_kernel();
+ 
+ 	fix_riprel(p);
+ 
+-	if (can_boost(p->addr))
++	if (can_boost(ktla_ktva(p->addr)))
+ 		p->ainsn.boostable = 0;
+ 	else
+ 		p->ainsn.boostable = -1;
+ 
+-	p->opcode = *p->addr;
++	p->opcode = *(ktla_ktva(p->addr));
+ }
+ 
+ int __kprobes arch_prepare_kprobe(struct kprobe *p)
+@@ -432,7 +440,7 @@ static void __kprobes prepare_singlestep
+ 	if (p->opcode == BREAKPOINT_INSTRUCTION)
+ 		regs->ip = (unsigned long)p->addr;
+ 	else
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ }
+ 
+ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
+@@ -453,7 +461,7 @@ static void __kprobes setup_singlestep(s
+ 	if (p->ainsn.boostable == 1 && !p->post_handler) {
+ 		/* Boost up -- we can execute copied instructions directly */
+ 		reset_current_kprobe();
+-		regs->ip = (unsigned long)p->ainsn.insn;
++		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 		preempt_enable_no_resched();
+ 		return;
+ 	}
+@@ -523,7 +531,7 @@ static int __kprobes kprobe_handler(stru
+ 	struct kprobe_ctlblk *kcb;
+ 
+ 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
+-	if (*addr != BREAKPOINT_INSTRUCTION) {
++	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
+ 		/*
+ 		 * The breakpoint instruction was removed right
+ 		 * after we hit it.  Another cpu has removed
+@@ -775,7 +783,7 @@ static void __kprobes resume_execution(s
+ 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
+ {
+ 	unsigned long *tos = stack_addr(regs);
+-	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
++	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
+ 	unsigned long orig_ip = (unsigned long)p->addr;
+ 	kprobe_opcode_t *insn = p->ainsn.insn;
+ 
+@@ -958,7 +966,7 @@ int __kprobes kprobe_exceptions_notify(s
+ 	struct die_args *args = data;
+ 	int ret = NOTIFY_DONE;
+ 
+-	if (args->regs && user_mode_vm(args->regs))
++	if (args->regs && user_mode(args->regs))
+ 		return ret;
+ 
+ 	switch (val) {
+diff -urNp linux-2.6.32.14/arch/x86/kernel/ldt.c linux-2.6.32.14/arch/x86/kernel/ldt.c
+--- linux-2.6.32.14/arch/x86/kernel/ldt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/ldt.c	2010-05-28 21:27:15.039159907 -0400
+@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
+ 	if (reload) {
+ #ifdef CONFIG_SMP
+ 		preempt_disable();
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ 		if (!cpumask_equal(mm_cpumask(current->mm),
+ 				   cpumask_of(smp_processor_id())))
+ 			smp_call_function(flush_ldt, current->mm, 1);
+ 		preempt_enable();
+ #else
+-		load_LDT(pc);
++		load_LDT_nolock(pc);
+ #endif
+ 	}
+ 	if (oldsize) {
+@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t 
+ 		return err;
+ 
+ 	for (i = 0; i < old->size; i++)
+-		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
++		write_ldt_entry(new->ldt, i, old->ldt + i);
+ 	return 0;
+ }
+ 
+@@ -115,6 +115,24 @@ int init_new_context(struct task_struct 
+ 		retval = copy_ldt(&mm->context, &old_mm->context);
+ 		mutex_unlock(&old_mm->context.lock);
+ 	}
++
++	if (tsk == current) {
++		mm->context.vdso = ~0UL;
++
++#ifdef CONFIG_X86_32
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		mm->context.user_cs_base = 0UL;
++		mm->context.user_cs_limit = ~0UL;
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
++		cpus_clear(mm->context.cpu_user_cs_mask);
++#endif
++
++#endif
++#endif
++
++	}
++
+ 	return retval;
+ }
+ 
+@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
++		error = -EINVAL;
++		goto out_unlock;
++	}
++#endif
++
+ 	fill_ldt(&ldt, &ldt_info);
+ 	if (oldmode)
+ 		ldt.avl = 0;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.14/arch/x86/kernel/machine_kexec_32.c
+--- linux-2.6.32.14/arch/x86/kernel/machine_kexec_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/machine_kexec_32.c	2010-05-28 21:27:15.043064911 -0400
+@@ -26,7 +26,7 @@
+ #include <asm/system.h>
+ #include <asm/cacheflush.h>
+ 
+-static void set_idt(void *newidt, __u16 limit)
++static void set_idt(struct desc_struct *newidt, __u16 limit)
+ {
+ 	struct desc_ptr curidt;
+ 
+@@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 
+ }
+ 
+ 
+-static void set_gdt(void *newgdt, __u16 limit)
++static void set_gdt(struct desc_struct *newgdt, __u16 limit)
+ {
+ 	struct desc_ptr curgdt;
+ 
+@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
+ 	}
+ 
+ 	control_page = page_address(image->control_code_page);
+-	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
++	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
+ 
+ 	relocate_kernel_ptr = control_page;
+ 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/machine_kexec_64.c linux-2.6.32.14/arch/x86/kernel/machine_kexec_64.c
+--- linux-2.6.32.14/arch/x86/kernel/machine_kexec_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/machine_kexec_64.c	2010-05-28 21:27:15.043064911 -0400
+@@ -126,7 +126,13 @@ static int init_level4_page(struct kimag
+ 	}
+ 	/* clear the unused entries */
+ 	while (addr < end_addr) {
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		set_pgd(level4p++, native_make_pgd(0));
++#else
+ 		pgd_clear(level4p++);
++#endif
++
+ 		addr += PGDIR_SIZE;
+ 	}
+ out:
+diff -urNp linux-2.6.32.14/arch/x86/kernel/microcode_amd.c linux-2.6.32.14/arch/x86/kernel/microcode_amd.c
+--- linux-2.6.32.14/arch/x86/kernel/microcode_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/microcode_amd.c	2010-05-28 21:27:15.043064911 -0400
+@@ -346,7 +346,7 @@ static void microcode_fini_cpu_amd(int c
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_amd_ops = {
++static const struct microcode_ops microcode_amd_ops = {
+ 	.request_microcode_user           = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info_amd,
+@@ -354,7 +354,7 @@ static struct microcode_ops microcode_am
+ 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
+ };
+ 
+-struct microcode_ops * __init init_amd_microcode(void)
++const struct microcode_ops * __init init_amd_microcode(void)
+ {
+ 	return &microcode_amd_ops;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/kernel/microcode_core.c linux-2.6.32.14/arch/x86/kernel/microcode_core.c
+--- linux-2.6.32.14/arch/x86/kernel/microcode_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/microcode_core.c	2010-05-28 21:27:15.043064911 -0400
+@@ -90,7 +90,7 @@ MODULE_LICENSE("GPL");
+ 
+ #define MICROCODE_VERSION	"2.00"
+ 
+-static struct microcode_ops	*microcode_ops;
++static const struct microcode_ops	*microcode_ops;
+ 
+ /*
+  * Synchronization.
+diff -urNp linux-2.6.32.14/arch/x86/kernel/microcode_intel.c linux-2.6.32.14/arch/x86/kernel/microcode_intel.c
+--- linux-2.6.32.14/arch/x86/kernel/microcode_intel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/microcode_intel.c	2010-05-28 21:27:15.043064911 -0400
+@@ -443,13 +443,13 @@ static enum ucode_state request_microcod
+ 
+ static int get_ucode_user(void *to, const void *from, size_t n)
+ {
+-	return copy_from_user(to, from, n);
++	return copy_from_user(to, (__force const void __user *)from, n);
+ }
+ 
+ static enum ucode_state
+ request_microcode_user(int cpu, const void __user *buf, size_t size)
+ {
+-	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
++	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
+ }
+ 
+ static void microcode_fini_cpu(int cpu)
+@@ -460,7 +460,7 @@ static void microcode_fini_cpu(int cpu)
+ 	uci->mc = NULL;
+ }
+ 
+-static struct microcode_ops microcode_intel_ops = {
++static const struct microcode_ops microcode_intel_ops = {
+ 	.request_microcode_user		  = request_microcode_user,
+ 	.request_microcode_fw             = request_microcode_fw,
+ 	.collect_cpu_info                 = collect_cpu_info,
+@@ -468,7 +468,7 @@ static struct microcode_ops microcode_in
+ 	.microcode_fini_cpu               = microcode_fini_cpu,
+ };
+ 
+-struct microcode_ops * __init init_intel_microcode(void)
++const struct microcode_ops * __init init_intel_microcode(void)
+ {
+ 	return &microcode_intel_ops;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/kernel/module.c linux-2.6.32.14/arch/x86/kernel/module.c
+--- linux-2.6.32.14/arch/x86/kernel/module.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/module.c	2010-05-28 21:27:15.043064911 -0400
+@@ -34,7 +34,7 @@
+ #define DEBUGP(fmt...)
+ #endif
+ 
+-void *module_alloc(unsigned long size)
++static void *__module_alloc(unsigned long size, pgprot_t prot)
+ {
+ 	struct vm_struct *area;
+ 
+@@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
+ 	if (!area)
+ 		return NULL;
+ 
+-	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
+-					PAGE_KERNEL_EXEC);
++	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
++}
++
++void *module_alloc(unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	return __module_alloc(size, PAGE_KERNEL);
++#else
++	return __module_alloc(size, PAGE_KERNEL_EXEC);
++#endif
++
+ }
+ 
+ /* Free memory returned from module_alloc */
+@@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
+ 	vfree(module_region);
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_X86_32
++void *module_alloc_exec(unsigned long size)
++{
++	struct vm_struct *area;
++
++	if (size == 0)
++		return NULL;
++
++	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
++	return area ? area->addr : NULL;
++}
++EXPORT_SYMBOL(module_alloc_exec);
++
++void module_free_exec(struct module *mod, void *module_region)
++{
++	vunmap(module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++#else
++void module_free_exec(struct module *mod, void *module_region)
++{
++	module_free(mod, module_region);
++}
++EXPORT_SYMBOL(module_free_exec);
++
++void *module_alloc_exec(unsigned long size)
++{
++	return __module_alloc(size, PAGE_KERNEL_RX);
++}
++EXPORT_SYMBOL(module_alloc_exec);
++#endif
++#endif
++
+ /* We don't need anything special. */
+ int module_frob_arch_sections(Elf_Ehdr *hdr,
+ 			      Elf_Shdr *sechdrs,
+@@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 	unsigned int i;
+ 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
+ 	Elf32_Sym *sym;
+-	uint32_t *location;
++	uint32_t *plocation, location;
+ 
+ 	DEBUGP("Applying relocate section %u to %u\n", relsec,
+ 	       sechdrs[relsec].sh_info);
+ 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+ 		/* This is where to make the change */
+-		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
+-			+ rel[i].r_offset;
++		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
++		location = (uint32_t)plocation;
++		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
++			plocation = ktla_ktva((void *)plocation);
+ 		/* This is the symbol it is referring to.  Note that all
+ 		   undefined symbols have been resolved.  */
+ 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
+@@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ 		switch (ELF32_R_TYPE(rel[i].r_info)) {
+ 		case R_386_32:
+ 			/* We add the value into the location given */
+-			*location += sym->st_value;
++			pax_open_kernel();
++			*plocation += sym->st_value;
++			pax_close_kernel();
+ 			break;
+ 		case R_386_PC32:
+ 			/* Add the value, subtract its postition */
+-			*location += sym->st_value - (uint32_t)location;
++			pax_open_kernel();
++			*plocation += sym->st_value - location;
++			pax_close_kernel();
+ 			break;
+ 		default:
+ 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
+@@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
+ 		case R_X86_64_NONE:
+ 			break;
+ 		case R_X86_64_64:
++			pax_open_kernel();
+ 			*(u64 *)loc = val;
++			pax_close_kernel();
+ 			break;
+ 		case R_X86_64_32:
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
+ 			if (val != *(u32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_32S:
++			pax_open_kernel();
+ 			*(s32 *)loc = val;
++			pax_close_kernel();
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+ 			break;
+ 		case R_X86_64_PC32:
+ 			val -= (u64)loc;
++			pax_open_kernel();
+ 			*(u32 *)loc = val;
++			pax_close_kernel();
++
+ #if 0
+ 			if ((s64)val != *(s32 *)loc)
+ 				goto overflow;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/paravirt.c linux-2.6.32.14/arch/x86/kernel/paravirt.c
+--- linux-2.6.32.14/arch/x86/kernel/paravirt.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/paravirt.c	2010-05-28 21:27:15.043064911 -0400
+@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
+  * corresponding structure. */
+ static void *get_call_destination(u8 type)
+ {
+-	struct paravirt_patch_template tmpl = {
++	const struct paravirt_patch_template tmpl = {
+ 		.pv_init_ops = pv_init_ops,
+ 		.pv_time_ops = pv_time_ops,
+ 		.pv_cpu_ops = pv_cpu_ops,
+@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
+ 	if (opfunc == NULL)
+ 		/* If there's no function, patch it with a ud2a (BUG) */
+ 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
+-	else if (opfunc == _paravirt_nop)
++	else if (opfunc == (void *)_paravirt_nop)
+ 		/* If the operation is a nop, then nop the callsite */
+ 		ret = paravirt_patch_nop();
+ 
+ 	/* identity functions just return their single argument */
+-	else if (opfunc == _paravirt_ident_32)
++	else if (opfunc == (void *)_paravirt_ident_32)
+ 		ret = paravirt_patch_ident_32(insnbuf, len);
+-	else if (opfunc == _paravirt_ident_64)
++	else if (opfunc == (void *)_paravirt_ident_64)
+ 		ret = paravirt_patch_ident_64(insnbuf, len);
+ 
+ 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
+@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
+ 	if (insn_len > len || start == NULL)
+ 		insn_len = len;
+ 	else
+-		memcpy(insnbuf, start, insn_len);
++		memcpy(insnbuf, ktla_ktva(start), insn_len);
+ 
+ 	return insn_len;
+ }
+@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
+ 	preempt_enable();
+ }
+ 
+-struct pv_info pv_info = {
++struct pv_info pv_info __read_only = {
+ 	.name = "bare hardware",
+ 	.paravirt_enabled = 0,
+ 	.kernel_rpl = 0,
+ 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
+ };
+ 
+-struct pv_init_ops pv_init_ops = {
++struct pv_init_ops pv_init_ops __read_only = {
+ 	.patch = native_patch,
+ };
+ 
+-struct pv_time_ops pv_time_ops = {
++struct pv_time_ops pv_time_ops __read_only = {
+ 	.sched_clock = native_sched_clock,
+ };
+ 
+-struct pv_irq_ops pv_irq_ops = {
++struct pv_irq_ops pv_irq_ops __read_only = {
+ 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
+ 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
+ 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
+@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
+ #endif
+ };
+ 
+-struct pv_cpu_ops pv_cpu_ops = {
++struct pv_cpu_ops pv_cpu_ops __read_only = {
+ 	.cpuid = native_cpuid,
+ 	.get_debugreg = native_get_debugreg,
+ 	.set_debugreg = native_set_debugreg,
+@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
+ 	.end_context_switch = paravirt_nop,
+ };
+ 
+-struct pv_apic_ops pv_apic_ops = {
++struct pv_apic_ops pv_apic_ops __read_only = {
+ #ifdef CONFIG_X86_LOCAL_APIC
+ 	.startup_ipi_hook = paravirt_nop,
+ #endif
+@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
+ #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
+ #endif
+ 
+-struct pv_mmu_ops pv_mmu_ops = {
++struct pv_mmu_ops pv_mmu_ops __read_only = {
+ 
+ 	.read_cr2 = native_read_cr2,
+ 	.write_cr2 = native_write_cr2,
+@@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+ 	},
+ 
+ 	.set_fixmap = native_set_fixmap,
++
++#ifdef CONFIG_PAX_KERNEXEC
++	.pax_open_kernel = native_pax_open_kernel,
++	.pax_close_kernel = native_pax_close_kernel,
++#endif
++
+ };
+ 
+ EXPORT_SYMBOL_GPL(pv_time_ops);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.14/arch/x86/kernel/paravirt-spinlocks.c
+--- linux-2.6.32.14/arch/x86/kernel/paravirt-spinlocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/paravirt-spinlocks.c	2010-05-28 21:27:15.043064911 -0400
+@@ -13,7 +13,7 @@ default_spin_lock_flags(raw_spinlock_t *
+ 	__raw_spin_lock(lock);
+ }
+ 
+-struct pv_lock_ops pv_lock_ops = {
++struct pv_lock_ops pv_lock_ops __read_only = {
+ #ifdef CONFIG_SMP
+ 	.spin_is_locked = __ticket_spin_is_locked,
+ 	.spin_is_contended = __ticket_spin_is_contended,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.14/arch/x86/kernel/pci-calgary_64.c
+--- linux-2.6.32.14/arch/x86/kernel/pci-calgary_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/pci-calgary_64.c	2010-05-28 21:27:15.043064911 -0400
+@@ -472,7 +472,7 @@ static void calgary_free_coherent(struct
+ 	free_pages((unsigned long)vaddr, get_order(size));
+ }
+ 
+-static struct dma_map_ops calgary_dma_ops = {
++static const struct dma_map_ops calgary_dma_ops = {
+ 	.alloc_coherent = calgary_alloc_coherent,
+ 	.free_coherent = calgary_free_coherent,
+ 	.map_sg = calgary_map_sg,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/pci-dma.c linux-2.6.32.14/arch/x86/kernel/pci-dma.c
+--- linux-2.6.32.14/arch/x86/kernel/pci-dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/pci-dma.c	2010-05-28 21:27:15.043064911 -0400
+@@ -14,7 +14,7 @@
+ 
+ static int forbid_dac __read_mostly;
+ 
+-struct dma_map_ops *dma_ops;
++const struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+ 
+ static int iommu_sac_force __read_mostly;
+@@ -243,7 +243,7 @@ early_param("iommu", iommu_setup);
+ 
+ int dma_supported(struct device *dev, u64 mask)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ #ifdef CONFIG_PCI
+ 	if (mask > 0xffffffff && forbid_dac > 0) {
+diff -urNp linux-2.6.32.14/arch/x86/kernel/pci-gart_64.c linux-2.6.32.14/arch/x86/kernel/pci-gart_64.c
+--- linux-2.6.32.14/arch/x86/kernel/pci-gart_64.c	2010-05-15 13:20:18.438563899 -0400
++++ linux-2.6.32.14/arch/x86/kernel/pci-gart_64.c	2010-05-28 21:27:15.047155410 -0400
+@@ -682,7 +682,7 @@ static __init int init_k8_gatt(struct ag
+ 	return -1;
+ }
+ 
+-static struct dma_map_ops gart_dma_ops = {
++static const struct dma_map_ops gart_dma_ops = {
+ 	.map_sg				= gart_map_sg,
+ 	.unmap_sg			= gart_unmap_sg,
+ 	.map_page			= gart_map_page,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/pci-nommu.c linux-2.6.32.14/arch/x86/kernel/pci-nommu.c
+--- linux-2.6.32.14/arch/x86/kernel/pci-nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/pci-nommu.c	2010-05-28 21:27:15.047155410 -0400
+@@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
+ 	flush_write_buffers();
+ }
+ 
+-struct dma_map_ops nommu_dma_ops = {
++const struct dma_map_ops nommu_dma_ops = {
+ 	.alloc_coherent		= dma_generic_alloc_coherent,
+ 	.free_coherent		= nommu_free_coherent,
+ 	.map_sg			= nommu_map_sg,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.14/arch/x86/kernel/pci-swiotlb.c
+--- linux-2.6.32.14/arch/x86/kernel/pci-swiotlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/pci-swiotlb.c	2010-05-28 21:27:15.047155410 -0400
+@@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
+ 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
+ }
+ 
+-static struct dma_map_ops swiotlb_dma_ops = {
++static const struct dma_map_ops swiotlb_dma_ops = {
+ 	.mapping_error = swiotlb_dma_mapping_error,
+ 	.alloc_coherent = x86_swiotlb_alloc_coherent,
+ 	.free_coherent = swiotlb_free_coherent,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/process_32.c linux-2.6.32.14/arch/x86/kernel/process_32.c
+--- linux-2.6.32.14/arch/x86/kernel/process_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/process_32.c	2010-05-28 21:27:15.047155410 -0400
+@@ -67,6 +67,7 @@ asmlinkage void ret_from_fork(void) __as
+ unsigned long thread_saved_pc(struct task_struct *tsk)
+ {
+ 	return ((unsigned long *)tsk->thread.sp)[3];
++//XXX	return tsk->thread.eip;
+ }
+ 
+ #ifndef CONFIG_SMP
+@@ -129,7 +130,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	unsigned short ss, gs;
+ 	const char *board;
+ 
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		sp = regs->sp;
+ 		ss = regs->ss & 0xffff;
+ 		gs = get_user_gs(regs);
+@@ -210,8 +211,8 @@ int kernel_thread(int (*fn)(void *), voi
+ 	regs.bx = (unsigned long) fn;
+ 	regs.dx = (unsigned long) arg;
+ 
+-	regs.ds = __USER_DS;
+-	regs.es = __USER_DS;
++	regs.ds = __KERNEL_DS;
++	regs.es = __KERNEL_DS;
+ 	regs.fs = __KERNEL_PERCPU;
+ 	regs.gs = __KERNEL_STACK_CANARY;
+ 	regs.orig_ax = -1;
+@@ -247,7 +248,7 @@ int copy_thread(unsigned long clone_flag
+ 	struct task_struct *tsk;
+ 	int err;
+ 
+-	childregs = task_pt_regs(p);
++	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
+ 	*childregs = *regs;
+ 	childregs->ax = 0;
+ 	childregs->sp = sp;
+@@ -276,6 +277,7 @@ int copy_thread(unsigned long clone_flag
+ 	 * Set a new TLS for the child thread?
+ 	 */
+ 	if (clone_flags & CLONE_SETTLS)
++//XXX needs set_fs()?
+ 		err = do_set_thread_area(p, -1,
+ 			(struct user_desc __user *)childregs->si, 0);
+ 
+@@ -346,7 +348,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread,
+ 				 *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	bool preload_fpu;
+ 
+ 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
+@@ -381,6 +383,11 @@ __switch_to(struct task_struct *prev_p, 
+ 	 */
+ 	lazy_save_gs(prev->gs);
+ 
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
++		__set_fs(task_thread_info(next_p)->addr_limit, cpu);
++#endif
++
+ 	/*
+ 	 * Load the per-thread Thread-Local Storage descriptor.
+ 	 */
+@@ -497,3 +504,27 @@ unsigned long get_wchan(struct task_stru
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++asmlinkage void pax_randomize_kstack(void)
++{
++	struct thread_struct *thread = &current->thread;
++	unsigned long time;
++
++	if (!randomize_va_space)
++		return;
++
++	rdtscl(time);
++
++	/* P4 seems to return a 0 LSB, ignore it */
++#ifdef CONFIG_MPENTIUM4
++	time &= 0x1EUL;
++	time <<= 2;
++#else
++	time &= 0xFUL;
++	time <<= 3;
++#endif
++
++	thread->sp0 ^= time;
++	load_sp0(init_tss + smp_processor_id(), thread);
++}
++#endif
+diff -urNp linux-2.6.32.14/arch/x86/kernel/process_64.c linux-2.6.32.14/arch/x86/kernel/process_64.c
+--- linux-2.6.32.14/arch/x86/kernel/process_64.c	2010-05-15 13:20:18.438563899 -0400
++++ linux-2.6.32.14/arch/x86/kernel/process_64.c	2010-05-28 21:27:15.047155410 -0400
+@@ -91,7 +91,7 @@ static void __exit_idle(void)
+ void exit_idle(void)
+ {
+ 	/* idle loop has pid 0 */
+-	if (current->pid)
++	if (task_pid_nr(current))
+ 		return;
+ 	__exit_idle();
+ }
+@@ -170,7 +170,7 @@ void __show_regs(struct pt_regs *regs, i
+ 	if (!board)
+ 		board = "";
+ 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
+-		current->pid, current->comm, print_tainted(),
++		task_pid_nr(current), current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+ 		init_utsname()->version, board);
+@@ -380,7 +380,7 @@ __switch_to(struct task_struct *prev_p, 
+ 	struct thread_struct *prev = &prev_p->thread;
+ 	struct thread_struct *next = &next_p->thread;
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 	unsigned fsindex, gsindex;
+ 	bool preload_fpu;
+ 
+@@ -560,12 +560,11 @@ unsigned long get_wchan(struct task_stru
+ 	if (!p || p == current || p->state == TASK_RUNNING)
+ 		return 0;
+ 	stack = (unsigned long)task_stack_page(p);
+-	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
++	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
+ 		return 0;
+ 	fp = *(u64 *)(p->thread.sp);
+ 	do {
+-		if (fp < (unsigned long)stack ||
+-		    fp >= (unsigned long)stack+THREAD_SIZE)
++		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
+ 			return 0;
+ 		ip = *(u64 *)(fp+8);
+ 		if (!in_sched_functions(ip))
+diff -urNp linux-2.6.32.14/arch/x86/kernel/process.c linux-2.6.32.14/arch/x86/kernel/process.c
+--- linux-2.6.32.14/arch/x86/kernel/process.c	2010-05-28 20:16:44.430924650 -0400
++++ linux-2.6.32.14/arch/x86/kernel/process.c	2010-05-28 21:27:15.047155410 -0400
+@@ -73,7 +73,7 @@ void exit_thread(void)
+ 	unsigned long *bp = t->io_bitmap_ptr;
+ 
+ 	if (bp) {
+-		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
++		struct tss_struct *tss = init_tss + get_cpu();
+ 
+ 		t->io_bitmap_ptr = NULL;
+ 		clear_thread_flag(TIF_IO_BITMAP);
+@@ -93,6 +93,9 @@ void flush_thread(void)
+ 
+ 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
+ 
++#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
++	loadsegment(gs, 0);
++#endif
+ 	tsk->thread.debugreg0 = 0;
+ 	tsk->thread.debugreg1 = 0;
+ 	tsk->thread.debugreg2 = 0;
+@@ -602,17 +605,3 @@ static int __init idle_setup(char *str)
+ 	return 0;
+ }
+ early_param("idle", idle_setup);
+-
+-unsigned long arch_align_stack(unsigned long sp)
+-{
+-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
+-		sp -= get_random_int() % 8192;
+-	return sp & ~0xf;
+-}
+-
+-unsigned long arch_randomize_brk(struct mm_struct *mm)
+-{
+-	unsigned long range_end = mm->brk + 0x02000000;
+-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+-}
+-
+diff -urNp linux-2.6.32.14/arch/x86/kernel/ptrace.c linux-2.6.32.14/arch/x86/kernel/ptrace.c
+--- linux-2.6.32.14/arch/x86/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/ptrace.c	2010-05-28 21:27:15.047155410 -0400
+@@ -925,7 +925,7 @@ static const struct user_regset_view use
+ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
+ {
+ 	int ret;
+-	unsigned long __user *datap = (unsigned long __user *)data;
++	unsigned long __user *datap = (__force unsigned long __user *)data;
+ 
+ 	switch (request) {
+ 	/* read the word at location addr in the USER area. */
+@@ -1012,14 +1012,14 @@ long arch_ptrace(struct task_struct *chi
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_get_thread_area(child, addr,
+-					 (struct user_desc __user *) data);
++					 (__force struct user_desc __user *) data);
+ 		break;
+ 
+ 	case PTRACE_SET_THREAD_AREA:
+ 		if (addr < 0)
+ 			return -EIO;
+ 		ret = do_set_thread_area(child, addr,
+-					 (struct user_desc __user *) data, 0);
++					 (__force struct user_desc __user *) data, 0);
+ 		break;
+ #endif
+ 
+@@ -1038,12 +1038,12 @@ long arch_ptrace(struct task_struct *chi
+ #ifdef CONFIG_X86_PTRACE_BTS
+ 	case PTRACE_BTS_CONFIG:
+ 		ret = ptrace_bts_config
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_STATUS:
+ 		ret = ptrace_bts_status
+-			(child, data, (struct ptrace_bts_config __user *)addr);
++			(child, data, (__force struct ptrace_bts_config __user *)addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_SIZE:
+@@ -1052,7 +1052,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_GET:
+ 		ret = ptrace_bts_read_record
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ 
+ 	case PTRACE_BTS_CLEAR:
+@@ -1061,7 +1061,7 @@ long arch_ptrace(struct task_struct *chi
+ 
+ 	case PTRACE_BTS_DRAIN:
+ 		ret = ptrace_bts_drain
+-			(child, data, (struct bts_struct __user *) addr);
++			(child, data, (__force struct bts_struct __user *) addr);
+ 		break;
+ #endif /* CONFIG_X86_PTRACE_BTS */
+ 
+@@ -1450,7 +1450,7 @@ void send_sigtrap(struct task_struct *ts
+ 	info.si_code = si_code;
+ 
+ 	/* User-mode ip? */
+-	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
++	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
+ 
+ 	/* Send us the fake SIGTRAP */
+ 	force_sig_info(SIGTRAP, &info, tsk);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/reboot.c linux-2.6.32.14/arch/x86/kernel/reboot.c
+--- linux-2.6.32.14/arch/x86/kernel/reboot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/reboot.c	2010-05-28 21:27:15.050883545 -0400
+@@ -33,7 +33,7 @@ void (*pm_power_off)(void);
+ EXPORT_SYMBOL(pm_power_off);
+ 
+ static const struct desc_ptr no_idt = {};
+-static int reboot_mode;
++static unsigned short reboot_mode;
+ enum reboot_type reboot_type = BOOT_KBD;
+ int reboot_force;
+ 
+@@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
+ 			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static int __init reboot_init(void)
+@@ -292,12 +292,12 @@ core_initcall(reboot_init);
+    controller to pulse the CPU reset line, which is more thorough, but
+    doesn't work with at least one type of 486 motherboard.  It is easy
+    to stop this code working; hence the copious comments. */
+-static const unsigned long long
+-real_mode_gdt_entries [3] =
++static struct desc_struct
++real_mode_gdt_entries [3] __read_only =
+ {
+-	0x0000000000000000ULL,	/* Null descriptor */
+-	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
+-	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
++	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
++	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
++	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
+ };
+ 
+ static const struct desc_ptr
+@@ -346,7 +346,7 @@ static const unsigned char jump_to_bios 
+  * specified by the code and length parameters.
+  * We assume that length will aways be less that 100!
+  */
+-void machine_real_restart(const unsigned char *code, int length)
++void machine_real_restart(const unsigned char *code, unsigned int length)
+ {
+ 	local_irq_disable();
+ 
+@@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
+ 	/* Remap the kernel at virtual address zero, as well as offset zero
+ 	   from the kernel segment.  This assumes the kernel segment starts at
+ 	   virtual address PAGE_OFFSET. */
+-	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+-		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
+ 
+ 	/*
+ 	 * Use `swapper_pg_dir' as our page directory.
+@@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
+ 	   boot)".  This seems like a fairly standard thing that gets set by
+ 	   REBOOT.COM programs, and the previous reset routine did this
+ 	   too. */
+-	*((unsigned short *)0x472) = reboot_mode;
++	*(unsigned short *)(__va(0x472)) = reboot_mode;
+ 
+ 	/* For the switch to real mode, copy some code to low memory.  It has
+ 	   to be in the first 64k because it is running in 16-bit mode, and it
+ 	   has to have the same physical and virtual address, because it turns
+ 	   off paging.  Copy it near the end of the first page, out of the way
+ 	   of BIOS variables. */
+-	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
+-		real_mode_switch, sizeof (real_mode_switch));
+-	memcpy((void *)(0x1000 - 100), code, length);
++	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
++	memcpy(__va(0x1000 - 100), code, length);
+ 
+ 	/* Set up the IDT for real mode. */
+ 	load_idt(&real_mode_idt);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/setup.c linux-2.6.32.14/arch/x86/kernel/setup.c
+--- linux-2.6.32.14/arch/x86/kernel/setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/setup.c	2010-05-28 21:27:15.062911922 -0400
+@@ -771,14 +771,14 @@ void __init setup_arch(char **cmdline_p)
+ 
+ 	if (!boot_params.hdr.root_flags)
+ 		root_mountflags &= ~MS_RDONLY;
+-	init_mm.start_code = (unsigned long) _text;
+-	init_mm.end_code = (unsigned long) _etext;
++	init_mm.start_code = ktla_ktva((unsigned long) _text);
++	init_mm.end_code = ktla_ktva((unsigned long) _etext);
+ 	init_mm.end_data = (unsigned long) _edata;
+ 	init_mm.brk = _brk_end;
+ 
+-	code_resource.start = virt_to_phys(_text);
+-	code_resource.end = virt_to_phys(_etext)-1;
+-	data_resource.start = virt_to_phys(_etext);
++	code_resource.start = virt_to_phys(ktla_ktva(_text));
++	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
++	data_resource.start = virt_to_phys(_sdata);
+ 	data_resource.end = virt_to_phys(_edata)-1;
+ 	bss_resource.start = virt_to_phys(&__bss_start);
+ 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/setup_percpu.c linux-2.6.32.14/arch/x86/kernel/setup_percpu.c
+--- linux-2.6.32.14/arch/x86/kernel/setup_percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/setup_percpu.c	2010-05-28 21:27:15.062911922 -0400
+@@ -25,19 +25,17 @@
+ # define DBG(x...)
+ #endif
+ 
++#ifdef CONFIG_SMP
+ DEFINE_PER_CPU(int, cpu_number);
+ EXPORT_PER_CPU_SYMBOL(cpu_number);
++#endif
+ 
+-#ifdef CONFIG_X86_64
+ #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
+-#else
+-#define BOOT_PERCPU_OFFSET 0
+-#endif
+ 
+ DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
+ EXPORT_PER_CPU_SYMBOL(this_cpu_off);
+ 
+-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
++unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
+ 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
+ };
+ EXPORT_SYMBOL(__per_cpu_offset);
+@@ -159,10 +157,10 @@ static inline void setup_percpu_segment(
+ {
+ #ifdef CONFIG_X86_32
+ 	struct desc_struct gdt;
++	unsigned long base = per_cpu_offset(cpu);
+ 
+-	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
+-			0x2 | DESCTYPE_S, 0x8);
+-	gdt.s = 1;
++	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
++			0x83 | DESCTYPE_S, 0xC);
+ 	write_gdt_entry(get_cpu_gdt_table(cpu),
+ 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
+ #endif
+@@ -212,6 +210,11 @@ void __init setup_per_cpu_areas(void)
+ 	/* alrighty, percpu areas up and running */
+ 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
+ 	for_each_possible_cpu(cpu) {
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		unsigned long canary = per_cpu(stack_canary, cpu);
++#endif
++#endif
+ 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
+ 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
+ 		per_cpu(cpu_number, cpu) = cpu;
+@@ -239,6 +242,12 @@ void __init setup_per_cpu_areas(void)
+ 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
+ #endif
+ #endif
++#ifdef CONFIG_CC_STACKPROTECTOR
++#ifdef CONFIG_x86_32
++		if (cpu == boot_cpu_id)
++			per_cpu(stack_canary, cpu) = canary;
++#endif
++#endif
+ 		/*
+ 		 * Up to this point, the boot CPU has been using .data.init
+ 		 * area.  Reload any changed state for the boot CPU.
+diff -urNp linux-2.6.32.14/arch/x86/kernel/signal.c linux-2.6.32.14/arch/x86/kernel/signal.c
+--- linux-2.6.32.14/arch/x86/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/signal.c	2010-05-28 21:27:15.062911922 -0400
+@@ -197,7 +197,7 @@ static unsigned long align_sigframe(unsi
+ 	 * Align the stack pointer according to the i386 ABI,
+ 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
+ 	 */
+-	sp = ((sp + 4) & -16ul) - 4;
++	sp = ((sp - 12) & -16ul) - 4;
+ #else /* !CONFIG_X86_32 */
+ 	sp = round_down(sp, 16) - 8;
+ #endif
+@@ -248,11 +248,11 @@ get_sigframe(struct k_sigaction *ka, str
+ 	 * Return an always-bogus address instead so we will die with SIGSEGV.
+ 	 */
+ 	if (onsigstack && !likely(on_sig_stack(sp)))
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	/* save i387 state */
+ 	if (used_math() && save_i387_xstate(*fpstate) < 0)
+-		return (void __user *)-1L;
++		return (__force void __user *)-1L;
+ 
+ 	return (void __user *)sp;
+ }
+@@ -307,9 +307,9 @@ __setup_frame(int sig, struct k_sigactio
+ 	}
+ 
+ 	if (current->mm->context.vdso)
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
+ 	else
+-		restorer = &frame->retcode;
++		restorer = (void __user *)&frame->retcode;
+ 	if (ka->sa.sa_flags & SA_RESTORER)
+ 		restorer = ka->sa.sa_restorer;
+ 
+@@ -323,7 +323,7 @@ __setup_frame(int sig, struct k_sigactio
+ 	 * reasons and because gdb uses it as a signature to notice
+ 	 * signal handler stack frames.
+ 	 */
+-	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
++	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
+ 
+ 	if (err)
+ 		return -EFAULT;
+@@ -377,7 +377,7 @@ static int __setup_rt_frame(int sig, str
+ 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+ 
+ 		/* Set up to return from userspace.  */
+-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
++		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+ 		if (ka->sa.sa_flags & SA_RESTORER)
+ 			restorer = ka->sa.sa_restorer;
+ 		put_user_ex(restorer, &frame->pretcode);
+@@ -389,7 +389,7 @@ static int __setup_rt_frame(int sig, str
+ 		 * reasons and because gdb uses it as a signature to notice
+ 		 * signal handler stack frames.
+ 		 */
+-		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
++		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
+ 	} put_user_catch(err);
+ 
+ 	if (err)
+@@ -789,7 +789,7 @@ static void do_signal(struct pt_regs *re
+ 	 * X86_32: vm86 regs switched out by assembly code before reaching
+ 	 * here, so testing against kernel CS suffices.
+ 	 */
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		return;
+ 
+ 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/smpboot.c linux-2.6.32.14/arch/x86/kernel/smpboot.c
+--- linux-2.6.32.14/arch/x86/kernel/smpboot.c	2010-04-04 20:41:49.920655481 -0400
++++ linux-2.6.32.14/arch/x86/kernel/smpboot.c	2010-05-28 21:27:15.062911922 -0400
+@@ -729,7 +729,11 @@ do_rest:
+ 		(unsigned long)task_stack_page(c_idle.idle) -
+ 		KERNEL_STACK_OFFSET + THREAD_SIZE;
+ #endif
++
++	pax_open_kernel();
+ 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
++	pax_close_kernel();
++
+ 	initial_code = (unsigned long)start_secondary;
+ 	stack_start.sp = (void *) c_idle.idle->thread.sp;
+ 
+@@ -866,6 +870,12 @@ int __cpuinit native_cpu_up(unsigned int
+ 
+ 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_X86_32
+ 	/* init low mem mapping */
+ 	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+diff -urNp linux-2.6.32.14/arch/x86/kernel/step.c linux-2.6.32.14/arch/x86/kernel/step.c
+--- linux-2.6.32.14/arch/x86/kernel/step.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/step.c	2010-05-28 21:27:15.062911922 -0400
+@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
+ 		struct desc_struct *desc;
+ 		unsigned long base;
+ 
+-		seg &= ~7UL;
++		seg >>= 3;
+ 
+ 		mutex_lock(&child->mm->context.lock);
+-		if (unlikely((seg >> 3) >= child->mm->context.size))
++		if (unlikely(seg >= child->mm->context.size))
+ 			addr = -1L; /* bogus selector, access would fault */
+ 		else {
+ 			desc = child->mm->context.ldt + seg;
+@@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
+ 	unsigned char opcode[15];
+ 	unsigned long addr = convert_ip_to_linear(child, regs);
+ 
++	if (addr == -EINVAL)
++		return 0;
++
+ 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
+ 	for (i = 0; i < copied; i++) {
+ 		switch (opcode[i]) {
+@@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
+ 
+ #ifdef CONFIG_X86_64
+ 		case 0x40 ... 0x4f:
+-			if (regs->cs != __USER_CS)
++			if ((regs->cs & 0xffff) != __USER_CS)
+ 				/* 32-bit mode: register increment */
+ 				return 0;
+ 			/* 64-bit mode: REX prefix */
+diff -urNp linux-2.6.32.14/arch/x86/kernel/syscall_table_32.S linux-2.6.32.14/arch/x86/kernel/syscall_table_32.S
+--- linux-2.6.32.14/arch/x86/kernel/syscall_table_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/syscall_table_32.S	2010-05-28 21:27:15.062911922 -0400
+@@ -1,3 +1,4 @@
++.section .rodata,"a",@progbits
+ ENTRY(sys_call_table)
+ 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
+ 	.long sys_exit
+diff -urNp linux-2.6.32.14/arch/x86/kernel/sys_i386_32.c linux-2.6.32.14/arch/x86/kernel/sys_i386_32.c
+--- linux-2.6.32.14/arch/x86/kernel/sys_i386_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/sys_i386_32.c	2010-05-28 21:27:15.062911922 -0400
+@@ -24,6 +24,21 @@
+ 
+ #include <asm/syscalls.h>
+ 
++int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
++{
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size || addr > pax_task_size - len)
++		return -EINVAL;
++
++	return 0;
++}
++
+ /*
+  * Perform the select(nd, in, out, ex, tv) and mmap() system
+  * calls. Linux/i386 didn't use to be able to handle more than
+@@ -58,6 +73,205 @@ out:
+ 	return err;
+ }
+ 
++unsigned long
++arch_get_unmapped_area(struct file *filp, unsigned long addr,
++		unsigned long len, unsigned long pgoff, unsigned long flags)
++{
++	struct mm_struct *mm = current->mm;
++	struct vm_area_struct *vma;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++		    (!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++	if (len > mm->cached_hole_size) {
++		start_addr = addr = mm->free_area_cache;
++	} else {
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
++	}
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
++		start_addr = 0x00110000UL;
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			start_addr += mm->delta_mmap & 0x03FFF000UL;
++#endif
++
++		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
++			start_addr = addr = mm->mmap_base;
++		else
++			addr = start_addr;
++	}
++#endif
++
++full_search:
++	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
++		/* At this point:  (!vma || addr < vma->vm_end). */
++		if (pax_task_size - len < addr) {
++			/*
++			 * Start a new search - just in case we missed
++			 * some holes.
++			 */
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
++				mm->cached_hole_size = 0;
++				goto full_search;
++			}
++			return -ENOMEM;
++		}
++		if (!vma || addr + len <= vma->vm_start) {
++			/*
++			 * Remember the place where we stopped the search:
++			 */
++			mm->free_area_cache = addr + len;
++			return addr;
++		}
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++		addr = vma->vm_end;
++		if (mm->start_brk <= addr && addr < mm->mmap_base) {
++			start_addr = addr = mm->mmap_base;
++			mm->cached_hole_size = 0;
++			goto full_search;
++		}
++	}
++}
++
++unsigned long
++arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
++			  const unsigned long len, const unsigned long pgoff,
++			  const unsigned long flags)
++{
++	struct vm_area_struct *vma;
++	struct mm_struct *mm = current->mm;
++	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	/* requested length too big for entire address space */
++	if (len > pax_task_size)
++		return -ENOMEM;
++
++	if (flags & MAP_FIXED)
++		return addr;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
++		goto bottomup;
++#endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
++	/* requesting a specific address */
++	if (addr) {
++		addr = PAGE_ALIGN(addr);
++		vma = find_vma(mm, addr);
++		if (pax_task_size - len >= addr &&
++				(!vma || addr + len <= vma->vm_start))
++			return addr;
++	}
++
++	/* check if free_area_cache is useful for us */
++	if (len <= mm->cached_hole_size) {
++		mm->cached_hole_size = 0;
++		mm->free_area_cache = mm->mmap_base;
++	}
++
++	/* either no address requested or can't fit in requested address hole */
++	addr = mm->free_area_cache;
++
++	/* make sure it can fit in the remaining address space */
++	if (addr > len) {
++		vma = find_vma(mm, addr-len);
++		if (!vma || addr <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr-len);
++	}
++
++	if (mm->mmap_base < len)
++		goto bottomup;
++
++	addr = mm->mmap_base-len;
++
++	do {
++		/*
++		 * Lookup failure means no vma is above this address,
++		 * else if new region fits below vma->vm_start,
++		 * return with success:
++		 */
++		vma = find_vma(mm, addr);
++		if (!vma || addr+len <= vma->vm_start)
++			/* remember the address as a hint for next time */
++			return (mm->free_area_cache = addr);
++
++		/* remember the largest hole we saw so far */
++		if (addr + mm->cached_hole_size < vma->vm_start)
++			mm->cached_hole_size = vma->vm_start - addr;
++
++		/* try just below the current vma->vm_start */
++		addr = vma->vm_start-len;
++	} while (len < vma->vm_start);
++
++bottomup:
++	/*
++	 * A failed mmap() very likely causes application failure,
++	 * so fall back to the bottom-up function here. This scenario
++	 * can happen with large stack limits and large mmap()
++	 * allocations.
++	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
++	mm->cached_hole_size = ~0UL;
++	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
++	/*
++	 * Restore the topdown base:
++	 */
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
++	mm->cached_hole_size = ~0UL;
++
++	return addr;
++}
+ 
+ struct sel_arg_struct {
+ 	unsigned long n;
+@@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
+ 	case SEMTIMEDOP:
+ 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
+-					(const struct timespec __user *)fifth);
++					(__force const struct timespec __user *)fifth);
+ 
+ 	case SEMGET:
+ 		return sys_semget(first, second, third);
+@@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
+ 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
+ 			if (ret)
+ 				return ret;
+-			return put_user(raddr, (ulong __user *) third);
++			return put_user(raddr, (__force ulong __user *) third);
+ 		}
+ 		case 1:	/* iBCS2 emulator entry point */
+ 			if (!segment_eq(get_fs(), get_ds()))
+diff -urNp linux-2.6.32.14/arch/x86/kernel/sys_x86_64.c linux-2.6.32.14/arch/x86/kernel/sys_x86_64.c
+--- linux-2.6.32.14/arch/x86/kernel/sys_x86_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/sys_x86_64.c	2010-05-28 21:27:15.062911922 -0400
+@@ -32,8 +32,8 @@ out:
+ 	return error;
+ }
+ 
+-static void find_start_end(unsigned long flags, unsigned long *begin,
+-			   unsigned long *end)
++static void find_start_end(struct mm_struct *mm, unsigned long flags,
++			   unsigned long *begin, unsigned long *end)
+ {
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
+ 		unsigned long new_begin;
+@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
+ 				*begin = new_begin;
+ 		}
+ 	} else {
+-		*begin = TASK_UNMAPPED_BASE;
++		*begin = mm->mmap_base;
+ 		*end = TASK_SIZE;
+ 	}
+ }
+@@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
+-	find_start_end(flags, &begin, &end);
++	find_start_end(mm, flags, &begin, &end);
+ 
+ 	if (len > end)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
+ 		goto bottomup;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -198,13 +206,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/time.c linux-2.6.32.14/arch/x86/kernel/time.c
+--- linux-2.6.32.14/arch/x86/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/time.c	2010-05-28 21:27:15.062911922 -0400
+@@ -26,17 +26,13 @@
+ int timer_ack;
+ #endif
+ 
+-#ifdef CONFIG_X86_64
+-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
+-#endif
+-
+ unsigned long profile_pc(struct pt_regs *regs)
+ {
+ 	unsigned long pc = instruction_pointer(regs);
+ 
+-	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
++	if (!user_mode(regs) && in_lock_functions(pc)) {
+ #ifdef CONFIG_FRAME_POINTER
+-		return *(unsigned long *)(regs->bp + sizeof(long));
++		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
+ #else
+ 		unsigned long *sp =
+ 			(unsigned long *)kernel_stack_pointer(regs);
+@@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs 
+ 		 * or above a saved flags. Eflags has bits 22-31 zero,
+ 		 * kernel addresses don't.
+ 		 */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		return ktla_ktva(sp[0]);
++#else
+ 		if (sp[0] >> 22)
+ 			return sp[0];
+ 		if (sp[1] >> 22)
+ 			return sp[1];
+ #endif
++
++#endif
+ 	}
+ 	return pc;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/kernel/tls.c linux-2.6.32.14/arch/x86/kernel/tls.c
+--- linux-2.6.32.14/arch/x86/kernel/tls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/tls.c	2010-05-28 21:27:15.062911922 -0400
+@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
+ 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
++		return -EINVAL;
++#endif
++
+ 	set_tls_desc(p, idx, &info, 1);
+ 
+ 	return 0;
+diff -urNp linux-2.6.32.14/arch/x86/kernel/trampoline_32.S linux-2.6.32.14/arch/x86/kernel/trampoline_32.S
+--- linux-2.6.32.14/arch/x86/kernel/trampoline_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/trampoline_32.S	2010-05-28 21:27:15.062911922 -0400
+@@ -32,6 +32,12 @@
+ #include <asm/segment.h>
+ #include <asm/page_types.h>
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define ta(X) (X)
++#else
++#define ta(X) ((X) - __PAGE_OFFSET)
++#endif
++
+ /* We can free up trampoline after bootup if cpu hotplug is not supported. */
+ __CPUINITRODATA
+ .code16
+@@ -60,7 +66,7 @@ r_base = .
+ 	inc	%ax		# protected mode (PE) bit
+ 	lmsw	%ax		# into protected mode
+ 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
+-	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
++	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
+ 
+ 	# These need to be in the same 64K segment as the above;
+ 	# hence we don't use the boot_gdt_descr defined in head.S
+diff -urNp linux-2.6.32.14/arch/x86/kernel/traps.c linux-2.6.32.14/arch/x86/kernel/traps.c
+--- linux-2.6.32.14/arch/x86/kernel/traps.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/traps.c	2010-05-28 21:27:15.067055592 -0400
+@@ -69,12 +69,6 @@ asmlinkage int system_call(void);
+ 
+ /* Do we ignore FPU interrupts ? */
+ char ignore_fpu_irq;
+-
+-/*
+- * The IDT has to be page-aligned to simplify the Pentium
+- * F0 0F bug workaround.
+- */
+-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
+ #endif
+ 
+ DECLARE_BITMAP(used_vectors, NR_VECTORS);
+@@ -112,19 +106,19 @@ static inline void preempt_conditional_c
+ static inline void
+ die_if_kernel(const char *str, struct pt_regs *regs, long err)
+ {
+-	if (!user_mode_vm(regs))
++	if (!user_mode(regs))
+ 		die(str, regs, err);
+ }
+ #endif
+ 
+ static void __kprobes
+-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
++do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
+ 	long error_code, siginfo_t *info)
+ {
+ 	struct task_struct *tsk = current;
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		/*
+ 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
+ 		 * On nmi (interrupt 2), do_trap should not be called.
+@@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
+ 	}
+ #endif
+ 
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto kernel_trap;
+ 
+ #ifdef CONFIG_X86_32
+@@ -158,7 +152,7 @@ trap_signal:
+ 	    printk_ratelimit()) {
+ 		printk(KERN_INFO
+ 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
+-		       tsk->comm, tsk->pid, str,
++		       tsk->comm, task_pid_nr(tsk), str,
+ 		       regs->ip, regs->sp, error_code);
+ 		print_vma_addr(" in ", regs->ip);
+ 		printk("\n");
+@@ -175,8 +169,20 @@ kernel_trap:
+ 	if (!fixup_exception(regs)) {
+ 		tsk->thread.error_code = error_code;
+ 		tsk->thread.trap_no = trapnr;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
++			str = "PAX: suspicious stack segment fault";
++#endif
++
+ 		die(str, regs, error_code);
+ 	}
++
++#ifdef CONFIG_PAX_REFCOUNT
++	if (trapnr == 4)
++		pax_report_refcount_overflow(regs);
++#endif
++
+ 	return;
+ 
+ #ifdef CONFIG_X86_32
+@@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
+ 	conditional_sti(regs);
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto gp_in_vm86;
+ #endif
+ 
+ 	tsk = current;
+-	if (!user_mode(regs))
++	if (!user_mode_novm(regs))
+ 		goto gp_in_kernel;
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
++		struct mm_struct *mm = tsk->mm;
++		unsigned long limit;
++
++		down_write(&mm->mmap_sem);
++		limit = mm->context.user_cs_limit;
++		if (limit < TASK_SIZE) {
++			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
++			up_write(&mm->mmap_sem);
++			return;
++		}
++		up_write(&mm->mmap_sem);
++	}
++#endif
++
+ 	tsk->thread.error_code = error_code;
+ 	tsk->thread.trap_no = 13;
+ 
+@@ -305,6 +327,13 @@ gp_in_kernel:
+ 	if (notify_die(DIE_GPF, "general protection fault", regs,
+ 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
+ 		return;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
++		die("PAX: suspicious general protection fault", regs, error_code);
++	else
++#endif
++
+ 	die("general protection fault", regs, error_code);
+ }
+ 
+@@ -558,7 +587,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	}
+ 
+ #ifdef CONFIG_X86_32
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		goto debug_vm86;
+ #endif
+ 
+@@ -570,7 +599,7 @@ dotraplinkage void __kprobes do_debug(st
+ 	 * kernel space (but re-enable TF when returning to user mode).
+ 	 */
+ 	if (condition & DR_STEP) {
+-		if (!user_mode(regs))
++		if (!user_mode_novm(regs))
+ 			goto clear_TF_reenable;
+ 	}
+ 
+@@ -757,7 +786,7 @@ do_simd_coprocessor_error(struct pt_regs
+ 	 * Handle strange cache flush from user space exception
+ 	 * in all other cases.  This is undocumented behaviour.
+ 	 */
+-	if (regs->flags & X86_VM_MASK) {
++	if (v8086_mode(regs)) {
+ 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
+ 		return;
+ 	}
+diff -urNp linux-2.6.32.14/arch/x86/kernel/tsc.c linux-2.6.32.14/arch/x86/kernel/tsc.c
+--- linux-2.6.32.14/arch/x86/kernel/tsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/tsc.c	2010-05-28 21:27:15.067055592 -0400
+@@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
+ 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {{0, {0}}}, NULL}
+ };
+ 
+ static void __init check_system_tsc_reliable(void)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/vm86_32.c linux-2.6.32.14/arch/x86/kernel/vm86_32.c
+--- linux-2.6.32.14/arch/x86/kernel/vm86_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/vm86_32.c	2010-05-28 21:27:15.067055592 -0400
+@@ -41,6 +41,7 @@
+ #include <linux/ptrace.h>
+ #include <linux/audit.h>
+ #include <linux/stddef.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
+ 		do_exit(SIGSEGV);
+ 	}
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	current->thread.sp0 = current->thread.saved_sp0;
+ 	current->thread.sysenter_cs = __KERNEL_CS;
+ 	load_sp0(tss, &current->thread);
+@@ -208,6 +209,13 @@ int sys_vm86old(struct pt_regs *regs)
+ 	struct task_struct *tsk;
+ 	int tmp, ret = -EPERM;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	if (tsk->thread.saved_sp0)
+ 		goto out;
+@@ -238,6 +246,14 @@ int sys_vm86(struct pt_regs *regs)
+ 	int tmp, ret;
+ 	struct vm86plus_struct __user *v86;
+ 
++#ifdef CONFIG_GRKERNSEC_VM86
++	if (!capable(CAP_SYS_RAWIO)) {
++		gr_handle_vm86();
++		ret = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	tsk = current;
+ 	switch (regs->bx) {
+ 	case VM86_REQUEST_IRQ:
+@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
+ 	tsk->thread.saved_fs = info->regs32->fs;
+ 	tsk->thread.saved_gs = get_user_gs(info->regs32);
+ 
+-	tss = &per_cpu(init_tss, get_cpu());
++	tss = init_tss + get_cpu();
+ 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
+ 	if (cpu_has_sep)
+ 		tsk->thread.sysenter_cs = 0;
+@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
+ 		goto cannot_handle;
+ 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
+ 		goto cannot_handle;
+-	intr_ptr = (unsigned long __user *) (i << 2);
++	intr_ptr = (__force unsigned long __user *) (i << 2);
+ 	if (get_user(segoffs, intr_ptr))
+ 		goto cannot_handle;
+ 	if ((segoffs >> 16) == BIOSSEG)
+diff -urNp linux-2.6.32.14/arch/x86/kernel/vmi_32.c linux-2.6.32.14/arch/x86/kernel/vmi_32.c
+--- linux-2.6.32.14/arch/x86/kernel/vmi_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/vmi_32.c	2010-05-28 21:27:15.067055592 -0400
+@@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1))) 
+ typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
+ 
+ #define call_vrom_func(rom,func) \
+-   (((VROMFUNC *)(rom->func))())
++   (((VROMFUNC *)(ktva_ktla(rom.func)))())
+ 
+ #define call_vrom_long_func(rom,func,arg) \
+-   (((VROMLONGFUNC *)(rom->func)) (arg))
++({\
++	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
++	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
++	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
++	__reloc;\
++})
+ 
+-static struct vrom_header *vmi_rom;
++static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
+ static int disable_pge;
+ static int disable_pse;
+ static int disable_sep;
+@@ -76,10 +81,10 @@ static struct {
+ 	void (*set_initial_ap_state)(int, int);
+ 	void (*halt)(void);
+   	void (*set_lazy_mode)(int mode);
+-} vmi_ops;
++} vmi_ops __read_only;
+ 
+ /* Cached VMI operations */
+-struct vmi_timer_ops vmi_timer_ops;
++struct vmi_timer_ops vmi_timer_ops __read_only;
+ 
+ /*
+  * VMI patching routines.
+@@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
+ static inline void patch_offset(void *insnbuf,
+ 				unsigned long ip, unsigned long dest)
+ {
+-        *(unsigned long *)(insnbuf+1) = dest-ip-5;
++	*(unsigned long *)(insnbuf+1) = dest-ip-5;
+ }
+ 
+ static unsigned patch_internal(int call, unsigned len, void *insnbuf,
+@@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
+ {
+ 	u64 reloc;
+ 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
++
+ 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
+ 	switch(rel->type) {
+ 		case VMI_RELOCATION_CALL_REL:
+@@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
+ 
+ static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
+ }
+ 
+ static void vmi_pmd_clear(pmd_t *pmd)
+ {
+-	const pte_t pte = { .pte = 0 };
++	const pte_t pte = __pte(0ULL);
+ 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
+ }
+ #endif
+@@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
+ 	ap.ss = __KERNEL_DS;
+ 	ap.esp = (unsigned long) start_esp;
+ 
+-	ap.ds = __USER_DS;
+-	ap.es = __USER_DS;
++	ap.ds = __KERNEL_DS;
++	ap.es = __KERNEL_DS;
+ 	ap.fs = __KERNEL_PERCPU;
+ 	ap.gs = __KERNEL_STACK_CANARY;
+ 
+@@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
+ 	paravirt_leave_lazy_mmu();
+ }
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++static unsigned long vmi_pax_open_kernel(void)
++{
++	return 0;
++}
++
++static unsigned long vmi_pax_close_kernel(void)
++{
++	return 0;
++}
++#endif
++
+ static inline int __init check_vmi_rom(struct vrom_header *rom)
+ {
+ 	struct pci_header *pci;
+@@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
+ 		return 0;
+ 	if (rom->vrom_signature != VMI_SIGNATURE)
+ 		return 0;
++	if (rom->rom_length * 512 > sizeof(*rom)) {
++		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
++		return 0;
++	}
+ 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
+ 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
+ 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
+@@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
+ 		struct vrom_header *romstart;
+ 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
+ 		if (check_vmi_rom(romstart)) {
+-			vmi_rom = romstart;
++			vmi_rom = *romstart;
+ 			return 1;
+ 		}
+ 	}
+@@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
+ 
+ 	para_fill(pv_irq_ops.safe_halt, Halt);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
++	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
++#endif
++
+ 	/*
+ 	 * Alternative instruction rewriting doesn't happen soon enough
+ 	 * to convert VMI_IRET to a call instead of a jump; so we have
+@@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
+ 
+ void __init vmi_init(void)
+ {
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		probe_vmi_rom();
+ 	else
+-		check_vmi_rom(vmi_rom);
++		check_vmi_rom(&vmi_rom);
+ 
+ 	/* In case probing for or validating the ROM failed, basil */
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+-	reserve_top_address(-vmi_rom->virtual_top);
++	reserve_top_address(-vmi_rom.virtual_top);
+ 
+ #ifdef CONFIG_X86_IO_APIC
+ 	/* This is virtual hardware; timer routing is wired correctly */
+@@ -874,7 +901,7 @@ void __init vmi_activate(void)
+ {
+ 	unsigned long flags;
+ 
+-	if (!vmi_rom)
++	if (!vmi_rom.rom_signature)
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.14/arch/x86/kernel/vmlinux.lds.S
+--- linux-2.6.32.14/arch/x86/kernel/vmlinux.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/vmlinux.lds.S	2010-05-28 21:27:15.067055592 -0400
+@@ -26,6 +26,22 @@
+ #include <asm/page_types.h>
+ #include <asm/cache.h>
+ #include <asm/boot.h>
++#include <asm/segment.h>
++
++#undef PMD_SIZE
++#undef PMD_SHIFT
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
++#define PMD_SHIFT 21
++#else
++#define PMD_SHIFT 22
++#endif
++#define PMD_SIZE (1 << PMD_SHIFT)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
++#else
++#define __KERNEL_TEXT_OFFSET	0
++#endif
+ 
+ #undef i386     /* in case the preprocessor is a 32bit one */
+ 
+@@ -34,40 +50,55 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
+ #ifdef CONFIG_X86_32
+ OUTPUT_ARCH(i386)
+ ENTRY(phys_startup_32)
+-jiffies = jiffies_64;
+ #else
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(phys_startup_64)
+-jiffies_64 = jiffies;
+ #endif
+ 
++jiffies = jiffies_64;
++
+ PHDRS {
+ 	text PT_LOAD FLAGS(5);          /* R_E */
+-	data PT_LOAD FLAGS(7);          /* RWE */
++#ifdef CONFIG_XEN
++	rodata PT_LOAD FLAGS(5);        /* R_E */
++#else
++	rodata PT_LOAD FLAGS(4);        /* R__ */
++#endif
++#ifdef CONFIG_X86_32
++	module PT_LOAD FLAGS(5);        /* R_E */
++#endif
++	data PT_LOAD FLAGS(6);          /* RW_ */
+ #ifdef CONFIG_X86_64
+ 	user PT_LOAD FLAGS(5);          /* R_E */
++#endif
++	init.begin PT_LOAD FLAGS(6);    /* RW_ */
+ #ifdef CONFIG_SMP
+ 	percpu PT_LOAD FLAGS(6);        /* RW_ */
+ #endif
++	text.init PT_LOAD FLAGS(5);     /* R_E */
++	text.exit PT_LOAD FLAGS(5);     /* R_E */
+ 	init PT_LOAD FLAGS(7);          /* RWE */
+-#endif
+ 	note PT_NOTE FLAGS(0);          /* ___ */
+ }
+ 
+ SECTIONS
+ {
+ #ifdef CONFIG_X86_32
+-        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
+-        phys_startup_32 = startup_32 - LOAD_OFFSET;
++	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
+ #else
+-        . = __START_KERNEL;
+-        phys_startup_64 = startup_64 - LOAD_OFFSET;
++	. = __START_KERNEL;
+ #endif
+ 
+ 	/* Text and read-only data */
+-	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
+-		_text = .;
++	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
+ 		/* bootstrapping code */
++#ifdef CONFIG_X86_32
++		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#else
++		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++#endif
++		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
++		_text = .;
+ 		HEAD_TEXT
+ #ifdef CONFIG_X86_32
+ 		. = ALIGN(PAGE_SIZE);
+@@ -82,28 +113,64 @@ SECTIONS
+ 		IRQENTRY_TEXT
+ 		*(.fixup)
+ 		*(.gnu.warning)
+-		/* End of text section */
+-		_etext = .;
+ 	} :text = 0x9090
+ 
+-	NOTES :text :note
++	. += __KERNEL_TEXT_OFFSET;
++
++	. = ALIGN(PAGE_SIZE);
++	NOTES :rodata :note
+ 
+-	EXCEPTION_TABLE(16) :text = 0x9090
++	EXCEPTION_TABLE(16) :rodata
+ 
+ 	RO_DATA(PAGE_SIZE)
+ 
++#ifdef CONFIG_X86_32
++	. = ALIGN(PAGE_SIZE);
++	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
++		*(.idt)
++		. = ALIGN(PAGE_SIZE);
++		*(.empty_zero_page)
++		*(.swapper_pg_pmd)
++		*(.swapper_pg_dir)
++	}
++
++	. = ALIGN(PAGE_SIZE);
++	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
++		*(.vmi.rom)
++	} :module
++
++	. = ALIGN(PAGE_SIZE);
++	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
++		MODULES_EXEC_VADDR = .;
++		BYTE(0)
++		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
++		. = ALIGN(PMD_SIZE);
++		MODULES_EXEC_END = . - 1;
++#endif
++
++	} :module
++#endif
++
+ 	/* Data */
+ 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
++		/* End of text section */
++		_etext = . - __KERNEL_TEXT_OFFSET;
++
++#ifdef CONFIG_PAX_KERNEXEC
++	. = ALIGN(PMD_SIZE);
++#else
++	. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		/* Start of data section */
+ 		_sdata = .;
+ 
+ 		/* init_task */
+ 		INIT_TASK_DATA(THREAD_SIZE)
+ 
+-#ifdef CONFIG_X86_32
+-		/* 32 bit has nosave before _edata */
+ 		NOSAVE_DATA
+-#endif
+ 
+ 		PAGE_ALIGNED_DATA(PAGE_SIZE)
+ 
+@@ -166,12 +233,6 @@ SECTIONS
+ 	}
+ 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
+ 
+-	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
+-	.jiffies : AT(VLOAD(.jiffies)) {
+-		*(.jiffies)
+-	}
+-	jiffies = VVIRT(.jiffies);
+-
+ 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
+ 		*(.vsyscall_3)
+ 	}
+@@ -187,12 +248,19 @@ SECTIONS
+ #endif /* CONFIG_X86_64 */
+ 
+ 	/* Init code and data - will be freed after init */
+-	. = ALIGN(PAGE_SIZE);
+ 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
++		BYTE(0)
++
++#ifdef CONFIG_PAX_KERNEXEC
++		. = ALIGN(PMD_SIZE);
++#else
++		. = ALIGN(PAGE_SIZE);
++#endif
++
+ 		__init_begin = .; /* paired with __init_end */
+-	}
++	} :init.begin
+ 
+-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
++#ifdef CONFIG_SMP
+ 	/*
+ 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
+ 	 * output PHDR, so the next output section - .init.text - should
+@@ -201,12 +269,27 @@ SECTIONS
+ 	PERCPU_VADDR(0, :percpu)
+ #endif
+ 
+-	INIT_TEXT_SECTION(PAGE_SIZE)
+-#ifdef CONFIG_X86_64
+-	:init
+-#endif
++	. = ALIGN(PAGE_SIZE);
++	init_begin = .;
++	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
++		VMLINUX_SYMBOL(_sinittext) = .;
++		INIT_TEXT
++		VMLINUX_SYMBOL(_einittext) = .;
++		. = ALIGN(PAGE_SIZE);
++	} :text.init
++
++	/*
++	 * .exit.text is discard at runtime, not link time, to deal with
++	 *  references from .altinstructions and .eh_frame
++	 */
++	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
++		EXIT_TEXT
++		. = ALIGN(16);
++	} :text.exit
++	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
+ 
+-	INIT_DATA_SECTION(16)
++	. = ALIGN(PAGE_SIZE);
++	INIT_DATA_SECTION(16) :init
+ 
+ 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
+ 		__x86_cpu_dev_start = .;
+@@ -232,19 +315,11 @@ SECTIONS
+ 		*(.altinstr_replacement)
+ 	}
+ 
+-	/*
+-	 * .exit.text is discard at runtime, not link time, to deal with
+-	 *  references from .altinstructions and .eh_frame
+-	 */
+-	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
+-		EXIT_TEXT
+-	}
+-
+ 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
+ 		EXIT_DATA
+ 	}
+ 
+-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
++#ifndef CONFIG_SMP
+ 	PERCPU(PAGE_SIZE)
+ #endif
+ 
+@@ -267,12 +342,6 @@ SECTIONS
+ 		. = ALIGN(PAGE_SIZE);
+ 	}
+ 
+-#ifdef CONFIG_X86_64
+-	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
+-		NOSAVE_DATA
+-	}
+-#endif
+-
+ 	/* BSS */
+ 	. = ALIGN(PAGE_SIZE);
+ 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
+@@ -288,6 +357,7 @@ SECTIONS
+ 		__brk_base = .;
+ 		. += 64 * 1024;		/* 64k alignment slop space */
+ 		*(.brk_reservation)	/* areas brk users have reserved */
++		. = ALIGN(PMD_SIZE);
+ 		__brk_limit = .;
+ 	}
+ 
+@@ -316,13 +386,12 @@ SECTIONS
+  * for the boot processor.
+  */
+ #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
+-INIT_PER_CPU(gdt_page);
+ INIT_PER_CPU(irq_stack_union);
+ 
+ /*
+  * Build-time check on the image size:
+  */
+-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
++. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
+ 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
+ 
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.32.14/arch/x86/kernel/vsyscall_64.c linux-2.6.32.14/arch/x86/kernel/vsyscall_64.c
+--- linux-2.6.32.14/arch/x86/kernel/vsyscall_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/vsyscall_64.c	2010-05-28 21:27:15.067055592 -0400
+@@ -79,6 +79,7 @@ void update_vsyscall(struct timespec *wa
+ 
+ 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
+ 	/* copy vsyscall data */
++	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
+ 	vsyscall_gtod_data.clock.vread = clock->vread;
+ 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
+ 	vsyscall_gtod_data.clock.mask = clock->mask;
+@@ -202,7 +203,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
+ 	   We do this here because otherwise user space would do it on
+ 	   its own in a likely inferior way (no access to jiffies).
+ 	   If you don't like it pass NULL. */
+-	if (tcache && tcache->blob[0] == (j = __jiffies)) {
++	if (tcache && tcache->blob[0] == (j = jiffies)) {
+ 		p = tcache->blob[1];
+ 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
+ 		/* Load per CPU data from RDTSCP */
+@@ -233,13 +234,13 @@ static ctl_table kernel_table2[] = {
+ 	  .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
+ 	  .mode = 0644,
+ 	  .proc_handler = proc_dointvec },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table kernel_root_table2[] = {
+ 	{ .ctl_name = CTL_KERN, .procname = "kernel", .mode = 0555,
+ 	  .child = kernel_table2 },
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.14/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.14/arch/x86/kernel/x8664_ksyms_64.c
+--- linux-2.6.32.14/arch/x86/kernel/x8664_ksyms_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/x8664_ksyms_64.c	2010-05-28 21:27:15.067055592 -0400
+@@ -30,8 +30,6 @@ EXPORT_SYMBOL(__put_user_8);
+ 
+ EXPORT_SYMBOL(copy_user_generic);
+ EXPORT_SYMBOL(__copy_user_nocache);
+-EXPORT_SYMBOL(copy_from_user);
+-EXPORT_SYMBOL(copy_to_user);
+ EXPORT_SYMBOL(__copy_from_user_inatomic);
+ 
+ EXPORT_SYMBOL(copy_page);
+diff -urNp linux-2.6.32.14/arch/x86/kernel/xsave.c linux-2.6.32.14/arch/x86/kernel/xsave.c
+--- linux-2.6.32.14/arch/x86/kernel/xsave.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kernel/xsave.c	2010-05-28 21:27:15.067055592 -0400
+@@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
+ 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
+ 		return -1;
+ 
+-	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
++	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
+ 					    fx_sw_user->extended_size -
+ 					    FP_XSTATE_MAGIC2_SIZE));
+ 	/*
+@@ -196,7 +196,7 @@ fx_only:
+ 	 * the other extended state.
+ 	 */
+ 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
+-	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
++	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
+ }
+ 
+ /*
+@@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
+ 	if (task_thread_info(tsk)->status & TS_XSAVE)
+ 		err = restore_user_xstate(buf);
+ 	else
+-		err = fxrstor_checking((__force struct i387_fxsave_struct *)
++		err = fxrstor_checking((struct i387_fxsave_struct __user *)
+ 				       buf);
+ 	if (unlikely(err)) {
+ 		/*
+diff -urNp linux-2.6.32.14/arch/x86/kvm/emulate.c linux-2.6.32.14/arch/x86/kvm/emulate.c
+--- linux-2.6.32.14/arch/x86/kvm/emulate.c	2010-04-29 17:49:37.541027029 -0400
++++ linux-2.6.32.14/arch/x86/kvm/emulate.c	2010-05-28 21:27:15.086896808 -0400
+@@ -81,8 +81,8 @@
+ #define Src2CL      (1<<29)
+ #define Src2ImmByte (2<<29)
+ #define Src2One     (3<<29)
+-#define Src2Imm16   (4<<29)
+-#define Src2Mask    (7<<29)
++#define Src2Imm16   (4U<<29)
++#define Src2Mask    (7U<<29)
+ 
+ enum {
+ 	Group1_80, Group1_81, Group1_82, Group1_83,
+@@ -411,6 +411,7 @@ static u32 group2_table[] = {
+ 
+ #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
+ 	do {								\
++		unsigned long _tmp;					\
+ 		__asm__ __volatile__ (					\
+ 			_PRE_EFLAGS("0", "4", "2")			\
+ 			_op _suffix " %"_x"3,%1; "			\
+@@ -424,8 +425,6 @@ static u32 group2_table[] = {
+ /* Raw emulation: instruction has two explicit operands. */
+ #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								\
+-		unsigned long _tmp;					\
+-									\
+ 		switch ((_dst).bytes) {					\
+ 		case 2:							\
+ 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
+@@ -441,7 +440,6 @@ static u32 group2_table[] = {
+ 
+ #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
+ 	do {								     \
+-		unsigned long _tmp;					     \
+ 		switch ((_dst).bytes) {				             \
+ 		case 1:							     \
+ 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
+diff -urNp linux-2.6.32.14/arch/x86/kvm/lapic.c linux-2.6.32.14/arch/x86/kvm/lapic.c
+--- linux-2.6.32.14/arch/x86/kvm/lapic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/kvm/lapic.c	2010-05-28 21:27:15.086896808 -0400
+@@ -52,7 +52,7 @@
+ #define APIC_BUS_CYCLE_NS 1
+ 
+ /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
+-#define apic_debug(fmt, arg...)
++#define apic_debug(fmt, arg...) do {} while (0)
+ 
+ #define APIC_LVT_NUM			6
+ /* 14 is the version for Xeon and Pentium 8.4.8*/
+diff -urNp linux-2.6.32.14/arch/x86/kvm/svm.c linux-2.6.32.14/arch/x86/kvm/svm.c
+--- linux-2.6.32.14/arch/x86/kvm/svm.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.14/arch/x86/kvm/svm.c	2010-05-28 21:27:15.086896808 -0400
+@@ -2395,9 +2395,12 @@ static int handle_exit(struct kvm_run *k
+ static void reload_tss(struct kvm_vcpu *vcpu)
+ {
+ 	int cpu = raw_smp_processor_id();
+-
+ 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
++
++	pax_open_kernel();
+ 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -2845,7 +2848,7 @@ static bool svm_gb_page_enable(void)
+ 	return true;
+ }
+ 
+-static struct kvm_x86_ops svm_x86_ops = {
++static const struct kvm_x86_ops svm_x86_ops = {
+ 	.cpu_has_kvm_support = has_svm,
+ 	.disabled_by_bios = is_disabled,
+ 	.hardware_setup = svm_hardware_setup,
+diff -urNp linux-2.6.32.14/arch/x86/kvm/vmx.c linux-2.6.32.14/arch/x86/kvm/vmx.c
+--- linux-2.6.32.14/arch/x86/kvm/vmx.c	2010-04-29 17:49:37.601044544 -0400
++++ linux-2.6.32.14/arch/x86/kvm/vmx.c	2010-05-28 21:27:15.091170095 -0400
+@@ -568,7 +568,11 @@ static void reload_tss(void)
+ 
+ 	kvm_get_gdt(&gdt);
+ 	descs = (void *)gdt.base;
++
++	pax_open_kernel();
+ 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
++	pax_close_kernel();
++
+ 	load_TR_desc();
+ }
+ 
+@@ -1395,8 +1399,11 @@ static __init int hardware_setup(void)
+ 	if (!cpu_has_vmx_flexpriority())
+ 		flexpriority_enabled = 0;
+ 
+-	if (!cpu_has_vmx_tpr_shadow())
+-		kvm_x86_ops->update_cr8_intercept = NULL;
++	if (!cpu_has_vmx_tpr_shadow()) {
++		pax_open_kernel();
++		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
++		pax_close_kernel();
++	}
+ 
+ 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
+ 		kvm_disable_largepages();
+@@ -2347,7 +2354,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
+ 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
+ 
+ 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
+-	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
++	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
+ 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
+ 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
+ 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
+@@ -3703,6 +3710,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		"jmp .Lkvm_vmx_return \n\t"
+ 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
+ 		".Lkvm_vmx_return: "
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
++		".Lkvm_vmx_return2: "
++#endif
++
+ 		/* Save guest registers, load host registers, keep flags */
+ 		"xchg %0,     (%%"R"sp) \n\t"
+ 		"mov %%"R"ax, %c[rax](%0) \n\t"
+@@ -3749,8 +3762,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
+ #endif
+ 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		,[cs]"i"(__KERNEL_CS)
++#endif
++
+ 	      : "cc", "memory"
+-		, R"bx", R"di", R"si"
++		, R"ax", R"bx", R"di", R"si"
+ #ifdef CONFIG_X86_64
+ 		, "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
+ #endif
+@@ -3767,7 +3785,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
+ 	if (vmx->rmode.irq.pending)
+ 		fixup_rmode_irq(vmx);
+ 
+-	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
++	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
+ 	vmx->launched = 1;
+ 
+ 	vmx_complete_interrupts(vmx);
+@@ -3942,7 +3960,7 @@ static bool vmx_gb_page_enable(void)
+ 	return false;
+ }
+ 
+-static struct kvm_x86_ops vmx_x86_ops = {
++static const struct kvm_x86_ops vmx_x86_ops = {
+ 	.cpu_has_kvm_support = cpu_has_kvm_support,
+ 	.disabled_by_bios = vmx_disabled_by_bios,
+ 	.hardware_setup = hardware_setup,
+diff -urNp linux-2.6.32.14/arch/x86/kvm/x86.c linux-2.6.32.14/arch/x86/kvm/x86.c
+--- linux-2.6.32.14/arch/x86/kvm/x86.c	2010-05-15 13:20:18.454567530 -0400
++++ linux-2.6.32.14/arch/x86/kvm/x86.c	2010-05-28 21:27:15.095006556 -0400
+@@ -81,45 +81,45 @@ static void update_cr8_intercept(struct 
+ static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
+ 				    struct kvm_cpuid_entry2 __user *entries);
+ 
+-struct kvm_x86_ops *kvm_x86_ops;
++const struct kvm_x86_ops *kvm_x86_ops;
+ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ 
+ int ignore_msrs = 0;
+ module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
+ struct kvm_stats_debugfs_item debugfs_entries[] = {
+-	{ "pf_fixed", VCPU_STAT(pf_fixed) },
+-	{ "pf_guest", VCPU_STAT(pf_guest) },
+-	{ "tlb_flush", VCPU_STAT(tlb_flush) },
+-	{ "invlpg", VCPU_STAT(invlpg) },
+-	{ "exits", VCPU_STAT(exits) },
+-	{ "io_exits", VCPU_STAT(io_exits) },
+-	{ "mmio_exits", VCPU_STAT(mmio_exits) },
+-	{ "signal_exits", VCPU_STAT(signal_exits) },
+-	{ "irq_window", VCPU_STAT(irq_window_exits) },
+-	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
+-	{ "halt_exits", VCPU_STAT(halt_exits) },
+-	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
+-	{ "hypercalls", VCPU_STAT(hypercalls) },
+-	{ "request_irq", VCPU_STAT(request_irq_exits) },
+-	{ "irq_exits", VCPU_STAT(irq_exits) },
+-	{ "host_state_reload", VCPU_STAT(host_state_reload) },
+-	{ "efer_reload", VCPU_STAT(efer_reload) },
+-	{ "fpu_reload", VCPU_STAT(fpu_reload) },
+-	{ "insn_emulation", VCPU_STAT(insn_emulation) },
+-	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
+-	{ "irq_injections", VCPU_STAT(irq_injections) },
+-	{ "nmi_injections", VCPU_STAT(nmi_injections) },
+-	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
+-	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
+-	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
+-	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
+-	{ "mmu_flooded", VM_STAT(mmu_flooded) },
+-	{ "mmu_recycled", VM_STAT(mmu_recycled) },
+-	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
+-	{ "mmu_unsync", VM_STAT(mmu_unsync) },
+-	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
+-	{ "largepages", VM_STAT(lpages) },
++	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
++	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
++	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
++	{ "invlpg", VCPU_STAT(invlpg), NULL },
++	{ "exits", VCPU_STAT(exits), NULL },
++	{ "io_exits", VCPU_STAT(io_exits), NULL },
++	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
++	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
++	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
++	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
++	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
++	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
++	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
++	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
++	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
++	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
++	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
++	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
++	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
++	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
++	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
++	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
++	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
++	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
++	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
++	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
++	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
++	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
++	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
++	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
++	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
++	{ "largepages", VM_STAT(lpages), NULL },
+ 	{ NULL }
+ };
+ 
+@@ -1635,7 +1635,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
+ static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
+ 				    struct kvm_interrupt *irq)
+ {
+-	if (irq->irq < 0 || irq->irq >= 256)
++	if (irq->irq >= 256)
+ 		return -EINVAL;
+ 	if (irqchip_in_kernel(vcpu->kvm))
+ 		return -ENXIO;
+@@ -3205,10 +3205,10 @@ static struct notifier_block kvmclock_cp
+         .notifier_call  = kvmclock_cpufreq_notifier
+ };
+ 
+-int kvm_arch_init(void *opaque)
++int kvm_arch_init(const void *opaque)
+ {
+ 	int r, cpu;
+-	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
++	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
+ 
+ 	if (kvm_x86_ops) {
+ 		printk(KERN_ERR "kvm: already loaded the other module\n");
+diff -urNp linux-2.6.32.14/arch/x86/lib/checksum_32.S linux-2.6.32.14/arch/x86/lib/checksum_32.S
+--- linux-2.6.32.14/arch/x86/lib/checksum_32.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/checksum_32.S	2010-05-28 21:27:15.095006556 -0400
+@@ -28,7 +28,8 @@
+ #include <linux/linkage.h>
+ #include <asm/dwarf2.h>
+ #include <asm/errno.h>
+-				
++#include <asm/segment.h>
++
+ /*
+  * computes a partial checksum, e.g. for TCP/UDP fragments
+  */
+@@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
+ 
+ #define ARGBASE 16		
+ #define FP		12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	subl  $4,%esp	
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	pushl %edi
+@@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
+ 	jmp 4f
+ SRC(1:	movw (%esi), %bx	)
+ 	addl $2, %esi
+-DST(	movw %bx, (%edi)	)
++DST(	movw %bx, %es:(%edi)	)
+ 	addl $2, %edi
+ 	addw %bx, %ax	
+ 	adcl $0, %eax
+@@ -343,30 +357,30 @@ DST(	movw %bx, (%edi)	)
+ SRC(1:	movl (%esi), %ebx	)
+ SRC(	movl 4(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 4(%edi)	)
++DST(	movl %edx, %es:4(%edi)	)
+ 
+ SRC(	movl 8(%esi), %ebx	)
+ SRC(	movl 12(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 8(%edi)	)
++DST(	movl %ebx, %es:8(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 12(%edi)	)
++DST(	movl %edx, %es:12(%edi)	)
+ 
+ SRC(	movl 16(%esi), %ebx 	)
+ SRC(	movl 20(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 16(%edi)	)
++DST(	movl %ebx, %es:16(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 20(%edi)	)
++DST(	movl %edx, %es:20(%edi)	)
+ 
+ SRC(	movl 24(%esi), %ebx	)
+ SRC(	movl 28(%esi), %edx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, 24(%edi)	)
++DST(	movl %ebx, %es:24(%edi)	)
+ 	adcl %edx, %eax
+-DST(	movl %edx, 28(%edi)	)
++DST(	movl %edx, %es:28(%edi)	)
+ 
+ 	lea 32(%esi), %esi
+ 	lea 32(%edi), %edi
+@@ -380,7 +394,7 @@ DST(	movl %edx, 28(%edi)	)
+ 	shrl $2, %edx			# This clears CF
+ SRC(3:	movl (%esi), %ebx	)
+ 	adcl %ebx, %eax
+-DST(	movl %ebx, (%edi)	)
++DST(	movl %ebx, %es:(%edi)	)
+ 	lea 4(%esi), %esi
+ 	lea 4(%edi), %edi
+ 	dec %edx
+@@ -392,12 +406,12 @@ DST(	movl %ebx, (%edi)	)
+ 	jb 5f
+ SRC(	movw (%esi), %cx	)
+ 	leal 2(%esi), %esi
+-DST(	movw %cx, (%edi)	)
++DST(	movw %cx, %es:(%edi)	)
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%ecx
+ SRC(5:	movb (%esi), %cl	)
+-DST(	movb %cl, (%edi)	)
++DST(	movb %cl, %es:(%edi)	)
+ 6:	addl %ecx, %eax
+ 	adcl $0, %eax
+ 7:
+@@ -408,7 +422,7 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6001:
+ 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 
+ 	# zero the complete destination - computing the rest
+ 	# is too much work 
+@@ -421,11 +435,19 @@ DST(	movb %cl, (%edi)	)
+ 
+ 6002:
+ 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT,(%ebx)
++	movl $-EFAULT,%ss:(%ebx)
+ 	jmp 5000b
+ 
+ .previous
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %ebx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE ebx
+@@ -439,26 +461,41 @@ DST(	movb %cl, (%edi)	)
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	ret	
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 
+ #else
+ 
+ /* Version for PentiumII/PPro */
+ 
+ #define ROUND1(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	addl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	; 
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ROUND(x) \
++	nop; nop; nop;				\
+ 	SRC(movl x(%esi), %ebx	)	;	\
+ 	adcl %ebx, %eax			;	\
+-	DST(movl %ebx, x(%edi)	)	;
++	DST(movl %ebx, %es:x(%edi))	;
+ 
+ #define ARGBASE 12
+-		
+-ENTRY(csum_partial_copy_generic)
++
++ENTRY(csum_partial_copy_generic_to_user)
+ 	CFI_STARTPROC
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
++	jmp csum_partial_copy_generic
++
++ENTRY(csum_partial_copy_generic_from_user)
++	pushl $(__USER_DS)
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++
++ENTRY(csum_partial_copy_generic)
+ 	pushl %ebx
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET ebx, 0
+@@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
+ 	subl %ebx, %edi  
+ 	lea  -1(%esi),%edx
+ 	andl $-32,%edx
+-	lea 3f(%ebx,%ebx), %ebx
++	lea 3f(%ebx,%ebx,2), %ebx
+ 	testl %esi, %esi 
+ 	jmp *%ebx
+ 1:	addl $64,%esi
+@@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
+ 	jb 5f
+ SRC(	movw (%esi), %dx         )
+ 	leal 2(%esi), %esi
+-DST(	movw %dx, (%edi)         )
++DST(	movw %dx, %es:(%edi)     )
+ 	leal 2(%edi), %edi
+ 	je 6f
+ 	shll $16,%edx
+ 5:
+ SRC(	movb (%esi), %dl         )
+-DST(	movb %dl, (%edi)         )
++DST(	movb %dl, %es:(%edi)     )
+ 6:	addl %edx, %eax
+ 	adcl $0, %eax
+ 7:
+ .section .fixup, "ax"
+ 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	# zero the complete destination (computing the rest is too much work)
+ 	movl ARGBASE+8(%esp),%edi	# dst
+ 	movl ARGBASE+12(%esp),%ecx	# len
+@@ -523,10 +560,18 @@ DST(	movb %dl, (%edi)         )
+ 	rep; stosb
+ 	jmp 7b
+ 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
+-	movl $-EFAULT, (%ebx)
++	movl $-EFAULT, %ss:(%ebx)
+ 	jmp  7b			
+ .previous				
+ 
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %ds
++	CFI_ADJUST_CFA_OFFSET -4
++	pushl %ss
++	CFI_ADJUST_CFA_OFFSET 4
++	popl %es
++	CFI_ADJUST_CFA_OFFSET -4
+ 	popl %esi
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	CFI_RESTORE esi
+@@ -538,7 +583,7 @@ DST(	movb %dl, (%edi)         )
+ 	CFI_RESTORE ebx
+ 	ret
+ 	CFI_ENDPROC
+-ENDPROC(csum_partial_copy_generic)
++ENDPROC(csum_partial_copy_generic_to_user)
+ 				
+ #undef ROUND
+ #undef ROUND1		
+diff -urNp linux-2.6.32.14/arch/x86/lib/clear_page_64.S linux-2.6.32.14/arch/x86/lib/clear_page_64.S
+--- linux-2.6.32.14/arch/x86/lib/clear_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/clear_page_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -43,7 +43,7 @@ ENDPROC(clear_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.14/arch/x86/lib/copy_page_64.S linux-2.6.32.14/arch/x86/lib/copy_page_64.S
+--- linux-2.6.32.14/arch/x86/lib/copy_page_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/copy_page_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -104,7 +104,7 @@ ENDPROC(copy_page)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb					/* jmp <disp8> */
+ 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.14/arch/x86/lib/copy_user_64.S linux-2.6.32.14/arch/x86/lib/copy_user_64.S
+--- linux-2.6.32.14/arch/x86/lib/copy_user_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/copy_user_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -15,13 +15,14 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/cpufeature.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALTERNATIVE_JUMP feature,orig,alt
+ 0:
+ 	.byte 0xe9	/* 32bit jump */
+ 	.long \orig-1f	/* by default jump to orig */
+ 1:
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 2:	.byte 0xe9			/* near jump with 32bit immediate */
+ 	.long \alt-1b /* offset */   /* or alternatively to alt */
+ 	.previous
+@@ -64,32 +65,6 @@
+ #endif
+ 	.endm
+ 
+-/* Standard copy_to_user with segment limit checking */
+-ENTRY(copy_to_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rdi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_to_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_to_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_to_user)
+-
+-/* Standard copy_from_user with segment limit checking */
+-ENTRY(copy_from_user)
+-	CFI_STARTPROC
+-	GET_THREAD_INFO(%rax)
+-	movq %rsi,%rcx
+-	addq %rdx,%rcx
+-	jc bad_from_user
+-	cmpq TI_addr_limit(%rax),%rcx
+-	jae bad_from_user
+-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+-	CFI_ENDPROC
+-ENDPROC(copy_from_user)
+-
+ ENTRY(copy_user_generic)
+ 	CFI_STARTPROC
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+@@ -98,6 +73,15 @@ ENDPROC(copy_user_generic)
+ 
+ ENTRY(__copy_from_user_inatomic)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
+ 	CFI_ENDPROC
+ ENDPROC(__copy_from_user_inatomic)
+@@ -107,6 +91,8 @@ ENDPROC(__copy_from_user_inatomic)
+ ENTRY(bad_from_user)
+ bad_from_user:
+ 	CFI_STARTPROC
++	testl %edx,%edx
++	js bad_to_user
+ 	movl %edx,%ecx
+ 	xorl %eax,%eax
+ 	rep
+diff -urNp linux-2.6.32.14/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.14/arch/x86/lib/copy_user_nocache_64.S
+--- linux-2.6.32.14/arch/x86/lib/copy_user_nocache_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/copy_user_nocache_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -14,6 +14,7 @@
+ #include <asm/current.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/pgtable.h>
+ 
+ 	.macro ALIGN_DESTINATION
+ #ifdef FIX_ALIGNMENT
+@@ -50,6 +51,15 @@
+  */
+ ENTRY(__copy_user_nocache)
+ 	CFI_STARTPROC
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%rcx
++	cmp %rcx,%rsi
++	jae 1f
++	add %rcx,%rsi
++1:
++#endif
++
+ 	cmpl $8,%edx
+ 	jb 20f		/* less then 8 bytes, go to byte copy loop */
+ 	ALIGN_DESTINATION
+diff -urNp linux-2.6.32.14/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.14/arch/x86/lib/csum-wrappers_64.c
+--- linux-2.6.32.14/arch/x86/lib/csum-wrappers_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/csum-wrappers_64.c	2010-05-28 21:27:15.095006556 -0400
+@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
+ 			len -= 2;
+ 		}
+ 	}
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	isum = csum_partial_copy_generic((__force const void *)src,
+ 				dst, len, isum, errp, NULL);
+ 	if (unlikely(*errp))
+@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
+ 	}
+ 
+ 	*errp = 0;
++	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
++		dst += PAX_USER_SHADOW_BASE;
+ 	return csum_partial_copy_generic(src, (void __force *)dst,
+ 					 len, isum, NULL, errp);
+ }
+diff -urNp linux-2.6.32.14/arch/x86/lib/getuser.S linux-2.6.32.14/arch/x86/lib/getuser.S
+--- linux-2.6.32.14/arch/x86/lib/getuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/getuser.S	2010-05-28 21:27:15.095006556 -0400
+@@ -33,14 +33,38 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
+ #include <asm/asm.h>
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ 	.text
+ ENTRY(__get_user_1)
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 1:	movzb (%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -49,11 +73,33 @@ ENDPROC(__get_user_1)
+ ENTRY(__get_user_2)
+ 	CFI_STARTPROC
+ 	add $1,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 2:	movzwl -1(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -62,11 +108,33 @@ ENDPROC(__get_user_2)
+ ENTRY(__get_user_4)
+ 	CFI_STARTPROC
+ 	add $3,%_ASM_AX
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
+ 	jc bad_get_user
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae bad_get_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
++#endif
++
+ 3:	mov -3(%_ASM_AX),%edx
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %eax,%eax
+ 	ret
+ 	CFI_ENDPROC
+@@ -80,6 +148,15 @@ ENTRY(__get_user_8)
+ 	GET_THREAD_INFO(%_ASM_DX)
+ 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
+ 	jae	bad_get_user
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
++	cmp %_ASM_DX,%_ASM_AX
++	jae 1234f
++	add %_ASM_DX,%_ASM_AX
++1234:
++#endif
++
+ 4:	movq -7(%_ASM_AX),%_ASM_DX
+ 	xor %eax,%eax
+ 	ret
+@@ -89,6 +166,12 @@ ENDPROC(__get_user_8)
+ 
+ bad_get_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	pop %ds
++#endif
++
+ 	xor %edx,%edx
+ 	mov $(-EFAULT),%_ASM_AX
+ 	ret
+diff -urNp linux-2.6.32.14/arch/x86/lib/memcpy_64.S linux-2.6.32.14/arch/x86/lib/memcpy_64.S
+--- linux-2.6.32.14/arch/x86/lib/memcpy_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/memcpy_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -128,7 +128,7 @@ ENDPROC(__memcpy)
+ 	 * It is also a lot simpler. Use this when possible:
+ 	 */
+ 
+-	.section .altinstr_replacement, "ax"
++	.section .altinstr_replacement, "a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.14/arch/x86/lib/memset_64.S linux-2.6.32.14/arch/x86/lib/memset_64.S
+--- linux-2.6.32.14/arch/x86/lib/memset_64.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/memset_64.S	2010-05-28 21:27:15.095006556 -0400
+@@ -118,7 +118,7 @@ ENDPROC(__memset)
+ 
+ #include <asm/cpufeature.h>
+ 
+-	.section .altinstr_replacement,"ax"
++	.section .altinstr_replacement,"a"
+ 1:	.byte 0xeb				/* jmp <disp8> */
+ 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
+ 2:
+diff -urNp linux-2.6.32.14/arch/x86/lib/mmx_32.c linux-2.6.32.14/arch/x86/lib/mmx_32.c
+--- linux-2.6.32.14/arch/x86/lib/mmx_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/mmx_32.c	2010-05-28 21:27:15.095006556 -0400
+@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
+ {
+ 	void *p;
+ 	int i;
++	unsigned long cr0;
+ 
+ 	if (unlikely(in_interrupt()))
+ 		return __memcpy(to, from, len);
+@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"		/* This set is 28 bytes */
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"		/* This set is 28 bytes */
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from));
++			: "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for ( ; i > 5; i--) {
+ 		__asm__ __volatile__ (
+-		"1:  prefetch 320(%0)\n"
+-		"2:  movq (%0), %%mm0\n"
+-		"  movq 8(%0), %%mm1\n"
+-		"  movq 16(%0), %%mm2\n"
+-		"  movq 24(%0), %%mm3\n"
+-		"  movq %%mm0, (%1)\n"
+-		"  movq %%mm1, 8(%1)\n"
+-		"  movq %%mm2, 16(%1)\n"
+-		"  movq %%mm3, 24(%1)\n"
+-		"  movq 32(%0), %%mm0\n"
+-		"  movq 40(%0), %%mm1\n"
+-		"  movq 48(%0), %%mm2\n"
+-		"  movq 56(%0), %%mm3\n"
+-		"  movq %%mm0, 32(%1)\n"
+-		"  movq %%mm1, 40(%1)\n"
+-		"  movq %%mm2, 48(%1)\n"
+-		"  movq %%mm3, 56(%1)\n"
++		"1:  prefetch 320(%1)\n"
++		"2:  movq (%1), %%mm0\n"
++		"  movq 8(%1), %%mm1\n"
++		"  movq 16(%1), %%mm2\n"
++		"  movq 24(%1), %%mm3\n"
++		"  movq %%mm0, (%2)\n"
++		"  movq %%mm1, 8(%2)\n"
++		"  movq %%mm2, 16(%2)\n"
++		"  movq %%mm3, 24(%2)\n"
++		"  movq 32(%1), %%mm0\n"
++		"  movq 40(%1), %%mm1\n"
++		"  movq 48(%1), %%mm2\n"
++		"  movq 56(%1), %%mm3\n"
++		"  movq %%mm0, 32(%2)\n"
++		"  movq %%mm1, 40(%2)\n"
++		"  movq %%mm2, 48(%2)\n"
++		"  movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
+ 	 * but that is for later. -AV
+ 	 */
+ 	__asm__ __volatile__(
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < (4096-320)/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movntq %%mm0, (%1)\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movntq %%mm1, 8(%1)\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movntq %%mm2, 16(%1)\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movntq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm4\n"
+-		"   movntq %%mm4, 32(%1)\n"
+-		"   movq 40(%0), %%mm5\n"
+-		"   movntq %%mm5, 40(%1)\n"
+-		"   movq 48(%0), %%mm6\n"
+-		"   movntq %%mm6, 48(%1)\n"
+-		"   movq 56(%0), %%mm7\n"
+-		"   movntq %%mm7, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movntq %%mm0, (%2)\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movntq %%mm1, 8(%2)\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movntq %%mm2, 16(%2)\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movntq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm4\n"
++		"   movntq %%mm4, 32(%2)\n"
++		"   movq 40(%1), %%mm5\n"
++		"   movntq %%mm5, 40(%2)\n"
++		"   movq 48(%1), %%mm6\n"
++		"   movntq %%mm6, 48(%2)\n"
++		"   movq 56(%1), %%mm7\n"
++		"   movntq %%mm7, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
++		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
+ static void fast_copy_page(void *to, void *from)
+ {
+ 	int i;
++	unsigned long cr0;
+ 
+ 	kernel_fpu_begin();
+ 
+ 	__asm__ __volatile__ (
+-		"1: prefetch (%0)\n"
+-		"   prefetch 64(%0)\n"
+-		"   prefetch 128(%0)\n"
+-		"   prefetch 192(%0)\n"
+-		"   prefetch 256(%0)\n"
++		"1: prefetch (%1)\n"
++		"   prefetch 64(%1)\n"
++		"   prefetch 128(%1)\n"
++		"   prefetch 192(%1)\n"
++		"   prefetch 256(%1)\n"
+ 		"2:  \n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++		"3:  \n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
++			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
+ 
+ 	for (i = 0; i < 4096/64; i++) {
+ 		__asm__ __volatile__ (
+-		"1: prefetch 320(%0)\n"
+-		"2: movq (%0), %%mm0\n"
+-		"   movq 8(%0), %%mm1\n"
+-		"   movq 16(%0), %%mm2\n"
+-		"   movq 24(%0), %%mm3\n"
+-		"   movq %%mm0, (%1)\n"
+-		"   movq %%mm1, 8(%1)\n"
+-		"   movq %%mm2, 16(%1)\n"
+-		"   movq %%mm3, 24(%1)\n"
+-		"   movq 32(%0), %%mm0\n"
+-		"   movq 40(%0), %%mm1\n"
+-		"   movq 48(%0), %%mm2\n"
+-		"   movq 56(%0), %%mm3\n"
+-		"   movq %%mm0, 32(%1)\n"
+-		"   movq %%mm1, 40(%1)\n"
+-		"   movq %%mm2, 48(%1)\n"
+-		"   movq %%mm3, 56(%1)\n"
++		"1: prefetch 320(%1)\n"
++		"2: movq (%1), %%mm0\n"
++		"   movq 8(%1), %%mm1\n"
++		"   movq 16(%1), %%mm2\n"
++		"   movq 24(%1), %%mm3\n"
++		"   movq %%mm0, (%2)\n"
++		"   movq %%mm1, 8(%2)\n"
++		"   movq %%mm2, 16(%2)\n"
++		"   movq %%mm3, 24(%2)\n"
++		"   movq 32(%1), %%mm0\n"
++		"   movq 40(%1), %%mm1\n"
++		"   movq 48(%1), %%mm2\n"
++		"   movq 56(%1), %%mm3\n"
++		"   movq %%mm0, 32(%2)\n"
++		"   movq %%mm1, 40(%2)\n"
++		"   movq %%mm2, 48(%2)\n"
++		"   movq %%mm3, 56(%2)\n"
+ 		".section .fixup, \"ax\"\n"
+-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++		"3:\n"
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %%cr0, %0\n"
++		"   movl %0, %%eax\n"
++		"   andl $0xFFFEFFFF, %%eax\n"
++		"   movl %%eax, %%cr0\n"
++#endif
++
++		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
++
++#ifdef CONFIG_PAX_KERNEXEC
++		"   movl %0, %%cr0\n"
++#endif
++
+ 		"   jmp 2b\n"
+ 		".previous\n"
+ 			_ASM_EXTABLE(1b, 3b)
+-			: : "r" (from), "r" (to) : "memory");
++			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
+ 
+ 		from += 64;
+ 		to += 64;
+diff -urNp linux-2.6.32.14/arch/x86/lib/putuser.S linux-2.6.32.14/arch/x86/lib/putuser.S
+--- linux-2.6.32.14/arch/x86/lib/putuser.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/putuser.S	2010-05-28 21:27:15.095006556 -0400
+@@ -15,7 +15,8 @@
+ #include <asm/thread_info.h>
+ #include <asm/errno.h>
+ #include <asm/asm.h>
+-
++#include <asm/segment.h>
++#include <asm/pgtable.h>
+ 
+ /*
+  * __put_user_X
+@@ -29,59 +30,156 @@
+  * as they get called from within inline assembly.
+  */
+ 
+-#define ENTER	CFI_STARTPROC ; \
+-		GET_THREAD_INFO(%_ASM_BX)
++#define ENTER	CFI_STARTPROC
+ #define EXIT	ret ; \
+ 		CFI_ENDPROC
+ 
+ .text
+ ENTRY(__put_user_1)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 1:	movb %al,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_1)
+ 
+ ENTRY(__put_user_2)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $1,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 2:	movw %ax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_2)
+ 
+ ENTRY(__put_user_4)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $3,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 3:	movl %eax,(%_ASM_CX)
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_4)
+ 
+ ENTRY(__put_user_8)
+ 	ENTER
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl $(__USER_DS)
++	popl %ds
++#else
++	GET_THREAD_INFO(%_ASM_BX)
+ 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
+ 	sub $7,%_ASM_BX
+ 	cmp %_ASM_BX,%_ASM_CX
+ 	jae bad_put_user
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
++	cmp %_ASM_BX,%_ASM_CX
++	jae 1234f
++	add %_ASM_BX,%_ASM_CX
++1234:
++#endif
++
++#endif
++
+ 4:	mov %_ASM_AX,(%_ASM_CX)
+ #ifdef CONFIG_X86_32
+ 5:	movl %edx,4(%_ASM_CX)
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	xor %eax,%eax
+ 	EXIT
+ ENDPROC(__put_user_8)
+ 
+ bad_put_user:
+ 	CFI_STARTPROC
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	pushl %ss
++	popl %ds
++#endif
++
+ 	movl $-EFAULT,%eax
+ 	EXIT
+ END(bad_put_user)
+diff -urNp linux-2.6.32.14/arch/x86/lib/usercopy_32.c linux-2.6.32.14/arch/x86/lib/usercopy_32.c
+--- linux-2.6.32.14/arch/x86/lib/usercopy_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/usercopy_32.c	2010-05-28 21:27:15.107152206 -0400
+@@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
+  * Copy a null terminated string from userspace.
+  */
+ 
+-#define __do_strncpy_from_user(dst, src, count, res)			   \
+-do {									   \
+-	int __d0, __d1, __d2;						   \
+-	might_fault();							   \
+-	__asm__ __volatile__(						   \
+-		"	testl %1,%1\n"					   \
+-		"	jz 2f\n"					   \
+-		"0:	lodsb\n"					   \
+-		"	stosb\n"					   \
+-		"	testb %%al,%%al\n"				   \
+-		"	jz 1f\n"					   \
+-		"	decl %1\n"					   \
+-		"	jnz 0b\n"					   \
+-		"1:	subl %1,%0\n"					   \
+-		"2:\n"							   \
+-		".section .fixup,\"ax\"\n"				   \
+-		"3:	movl %5,%0\n"					   \
+-		"	jmp 2b\n"					   \
+-		".previous\n"						   \
+-		_ASM_EXTABLE(0b,3b)					   \
+-		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),	   \
+-		  "=&D" (__d2)						   \
+-		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
+-		: "memory");						   \
+-} while (0)
++static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
++{
++	int __d0, __d1, __d2;
++	long res = -EFAULT;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w10,%%ds\n"
++		"	testl %1,%1\n"
++		"	jz 2f\n"
++		"0:	lodsb\n"
++		"	stosb\n"
++		"	testb %%al,%%al\n"
++		"	jz 1f\n"
++		"	decl %1\n"
++		"	jnz 0b\n"
++		"1:	subl %1,%0\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"3:	movl %5,%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		: "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
++		  "=&D" (__d2)
++		: "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
++		  "r"(__USER_DS)
++		: "memory");
++	return res;
++}
+ 
+ /**
+  * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
+@@ -85,9 +92,7 @@ do {									   \
+ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+-	long res;
+-	__do_strncpy_from_user(dst, src, count, res);
+-	return res;
++	return __do_strncpy_from_user(dst, src, count);
+ }
+ EXPORT_SYMBOL(__strncpy_from_user);
+ 
+@@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char 
+ {
+ 	long res = -EFAULT;
+ 	if (access_ok(VERIFY_READ, src, 1))
+-		__do_strncpy_from_user(dst, src, count, res);
++		res = __do_strncpy_from_user(dst, src, count);
+ 	return res;
+ }
+ EXPORT_SYMBOL(strncpy_from_user);
+@@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
+  * Zero Userspace
+  */
+ 
+-#define __do_clear_user(addr,size)					\
+-do {									\
+-	int __d0;							\
+-	might_fault();							\
+-	__asm__ __volatile__(						\
+-		"0:	rep; stosl\n"					\
+-		"	movl %2,%0\n"					\
+-		"1:	rep; stosb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"3:	lea 0(%2,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		_ASM_EXTABLE(0b,3b)					\
+-		_ASM_EXTABLE(1b,2b)					\
+-		: "=&c"(size), "=&D" (__d0)				\
+-		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));	\
+-} while (0)
++static unsigned long __do_clear_user(void __user *addr, unsigned long size)
++{
++	int __d0;
++
++	might_fault();
++	__asm__ __volatile__(
++		"	movw %w6,%%es\n"
++		"0:	rep; stosl\n"
++		"	movl %2,%0\n"
++		"1:	rep; stosb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"3:	lea 0(%2,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		_ASM_EXTABLE(0b,3b)
++		_ASM_EXTABLE(1b,2b)
++		: "=&c"(size), "=&D" (__d0)
++		: "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
++		  "r"(__USER_DS));
++	return size;
++}
+ 
+ /**
+  * clear_user: - Zero a block of memory in user space.
+@@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
+ {
+ 	might_fault();
+ 	if (access_ok(VERIFY_WRITE, to, n))
+-		__do_clear_user(to, n);
++		n = __do_clear_user(to, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(clear_user);
+@@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
+ unsigned long
+ __clear_user(void __user *to, unsigned long n)
+ {
+-	__do_clear_user(to, n);
+-	return n;
++	return __do_clear_user(to, n);
+ }
+ EXPORT_SYMBOL(__clear_user);
+ 
+@@ -200,14 +210,17 @@ long strnlen_user(const char __user *s, 
+ 	might_fault();
+ 
+ 	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
+ 		"	testl %0, %0\n"
+ 		"	jz 3f\n"
+-		"	andl %0,%%ecx\n"
++		"	movl %0,%%ecx\n"
+ 		"0:	repne; scasb\n"
+ 		"	setne %%al\n"
+ 		"	subl %%ecx,%0\n"
+ 		"	addl %0,%%eax\n"
+ 		"1:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
+ 		".section .fixup,\"ax\"\n"
+ 		"2:	xorl %%eax,%%eax\n"
+ 		"	jmp 1b\n"
+@@ -219,7 +232,7 @@ long strnlen_user(const char __user *s, 
+ 		"	.long 0b,2b\n"
+ 		".previous"
+ 		:"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
+-		:"0" (n), "1" (s), "2" (0), "3" (mask)
++		:"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
+ 		:"cc");
+ 	return res & mask;
+ }
+@@ -227,10 +240,11 @@ EXPORT_SYMBOL(strnlen_user);
+ 
+ #ifdef CONFIG_X86_INTEL_USERCOPY
+ static unsigned long
+-__copy_user_intel(void __user *to, const void *from, unsigned long size)
++__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "       movw %w6, %%es\n"
+ 		       "       .align 2,0x90\n"
+ 		       "1:     movl 32(%4), %%eax\n"
+ 		       "       cmpl $67, %0\n"
+@@ -239,36 +253,36 @@ __copy_user_intel(void __user *to, const
+ 		       "       .align 2,0x90\n"
+ 		       "3:     movl 0(%4), %%eax\n"
+ 		       "4:     movl 4(%4), %%edx\n"
+-		       "5:     movl %%eax, 0(%3)\n"
+-		       "6:     movl %%edx, 4(%3)\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
+ 		       "7:     movl 8(%4), %%eax\n"
+ 		       "8:     movl 12(%4),%%edx\n"
+-		       "9:     movl %%eax, 8(%3)\n"
+-		       "10:    movl %%edx, 12(%3)\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
+ 		       "11:    movl 16(%4), %%eax\n"
+ 		       "12:    movl 20(%4), %%edx\n"
+-		       "13:    movl %%eax, 16(%3)\n"
+-		       "14:    movl %%edx, 20(%3)\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
+ 		       "15:    movl 24(%4), %%eax\n"
+ 		       "16:    movl 28(%4), %%edx\n"
+-		       "17:    movl %%eax, 24(%3)\n"
+-		       "18:    movl %%edx, 28(%3)\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
+ 		       "19:    movl 32(%4), %%eax\n"
+ 		       "20:    movl 36(%4), %%edx\n"
+-		       "21:    movl %%eax, 32(%3)\n"
+-		       "22:    movl %%edx, 36(%3)\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
+ 		       "23:    movl 40(%4), %%eax\n"
+ 		       "24:    movl 44(%4), %%edx\n"
+-		       "25:    movl %%eax, 40(%3)\n"
+-		       "26:    movl %%edx, 44(%3)\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
+ 		       "27:    movl 48(%4), %%eax\n"
+ 		       "28:    movl 52(%4), %%edx\n"
+-		       "29:    movl %%eax, 48(%3)\n"
+-		       "30:    movl %%edx, 52(%3)\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
+ 		       "31:    movl 56(%4), %%eax\n"
+ 		       "32:    movl 60(%4), %%edx\n"
+-		       "33:    movl %%eax, 56(%3)\n"
+-		       "34:    movl %%edx, 60(%3)\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
+ 		       "       addl $-64, %0\n"
+ 		       "       addl $64, %4\n"
+ 		       "       addl $64, %3\n"
+@@ -282,6 +296,8 @@ __copy_user_intel(void __user *to, const
+ 		       "36:    movl %%eax, %0\n"
+ 		       "37:    rep; movsb\n"
+ 		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%es\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "101:   lea 0(%%eax,%0,4),%0\n"
+ 		       "       jmp 100b\n"
+@@ -328,7 +344,117 @@ __copy_user_intel(void __user *to, const
+ 		       "       .long 99b,101b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
++		       : "eax", "edx", "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
++{
++	int d0, d1;
++	__asm__ __volatile__(
++		       "       movw %w6, %%ds\n"
++		       "       .align 2,0x90\n"
++		       "1:     movl 32(%4), %%eax\n"
++		       "       cmpl $67, %0\n"
++		       "       jbe 3f\n"
++		       "2:     movl 64(%4), %%eax\n"
++		       "       .align 2,0x90\n"
++		       "3:     movl 0(%4), %%eax\n"
++		       "4:     movl 4(%4), %%edx\n"
++		       "5:     movl %%eax, %%es:0(%3)\n"
++		       "6:     movl %%edx, %%es:4(%3)\n"
++		       "7:     movl 8(%4), %%eax\n"
++		       "8:     movl 12(%4),%%edx\n"
++		       "9:     movl %%eax, %%es:8(%3)\n"
++		       "10:    movl %%edx, %%es:12(%3)\n"
++		       "11:    movl 16(%4), %%eax\n"
++		       "12:    movl 20(%4), %%edx\n"
++		       "13:    movl %%eax, %%es:16(%3)\n"
++		       "14:    movl %%edx, %%es:20(%3)\n"
++		       "15:    movl 24(%4), %%eax\n"
++		       "16:    movl 28(%4), %%edx\n"
++		       "17:    movl %%eax, %%es:24(%3)\n"
++		       "18:    movl %%edx, %%es:28(%3)\n"
++		       "19:    movl 32(%4), %%eax\n"
++		       "20:    movl 36(%4), %%edx\n"
++		       "21:    movl %%eax, %%es:32(%3)\n"
++		       "22:    movl %%edx, %%es:36(%3)\n"
++		       "23:    movl 40(%4), %%eax\n"
++		       "24:    movl 44(%4), %%edx\n"
++		       "25:    movl %%eax, %%es:40(%3)\n"
++		       "26:    movl %%edx, %%es:44(%3)\n"
++		       "27:    movl 48(%4), %%eax\n"
++		       "28:    movl 52(%4), %%edx\n"
++		       "29:    movl %%eax, %%es:48(%3)\n"
++		       "30:    movl %%edx, %%es:52(%3)\n"
++		       "31:    movl 56(%4), %%eax\n"
++		       "32:    movl 60(%4), %%edx\n"
++		       "33:    movl %%eax, %%es:56(%3)\n"
++		       "34:    movl %%edx, %%es:60(%3)\n"
++		       "       addl $-64, %0\n"
++		       "       addl $64, %4\n"
++		       "       addl $64, %3\n"
++		       "       cmpl $63, %0\n"
++		       "       ja  1b\n"
++		       "35:    movl  %0, %%eax\n"
++		       "       shrl  $2, %0\n"
++		       "       andl  $3, %%eax\n"
++		       "       cld\n"
++		       "99:    rep; movsl\n"
++		       "36:    movl %%eax, %0\n"
++		       "37:    rep; movsb\n"
++		       "100:\n"
++		       "       pushl %%ss\n"
++		       "       popl %%ds\n"
++		       ".section .fixup,\"ax\"\n"
++		       "101:   lea 0(%%eax,%0,4),%0\n"
++		       "       jmp 100b\n"
++		       ".previous\n"
++		       ".section __ex_table,\"a\"\n"
++		       "       .align 4\n"
++		       "       .long 1b,100b\n"
++		       "       .long 2b,100b\n"
++		       "       .long 3b,100b\n"
++		       "       .long 4b,100b\n"
++		       "       .long 5b,100b\n"
++		       "       .long 6b,100b\n"
++		       "       .long 7b,100b\n"
++		       "       .long 8b,100b\n"
++		       "       .long 9b,100b\n"
++		       "       .long 10b,100b\n"
++		       "       .long 11b,100b\n"
++		       "       .long 12b,100b\n"
++		       "       .long 13b,100b\n"
++		       "       .long 14b,100b\n"
++		       "       .long 15b,100b\n"
++		       "       .long 16b,100b\n"
++		       "       .long 17b,100b\n"
++		       "       .long 18b,100b\n"
++		       "       .long 19b,100b\n"
++		       "       .long 20b,100b\n"
++		       "       .long 21b,100b\n"
++		       "       .long 22b,100b\n"
++		       "       .long 23b,100b\n"
++		       "       .long 24b,100b\n"
++		       "       .long 25b,100b\n"
++		       "       .long 26b,100b\n"
++		       "       .long 27b,100b\n"
++		       "       .long 28b,100b\n"
++		       "       .long 29b,100b\n"
++		       "       .long 30b,100b\n"
++		       "       .long 31b,100b\n"
++		       "       .long 32b,100b\n"
++		       "       .long 33b,100b\n"
++		       "       .long 34b,100b\n"
++		       "       .long 35b,100b\n"
++		       "       .long 36b,100b\n"
++		       "       .long 37b,100b\n"
++		       "       .long 99b,101b\n"
++		       ".previous"
++		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
+ {
+ 	int d0, d1;
+ 	__asm__ __volatile__(
++		       "        movw %w6, %%ds\n"
+ 		       "        .align 2,0x90\n"
+ 		       "0:      movl 32(%4), %%eax\n"
+ 		       "        cmpl $67, %0\n"
+@@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .align 2,0x90\n"
+ 		       "2:      movl 0(%4), %%eax\n"
+ 		       "21:     movl 4(%4), %%edx\n"
+-		       "        movl %%eax, 0(%3)\n"
+-		       "        movl %%edx, 4(%3)\n"
++		       "        movl %%eax, %%es:0(%3)\n"
++		       "        movl %%edx, %%es:4(%3)\n"
+ 		       "3:      movl 8(%4), %%eax\n"
+ 		       "31:     movl 12(%4),%%edx\n"
+-		       "        movl %%eax, 8(%3)\n"
+-		       "        movl %%edx, 12(%3)\n"
++		       "        movl %%eax, %%es:8(%3)\n"
++		       "        movl %%edx, %%es:12(%3)\n"
+ 		       "4:      movl 16(%4), %%eax\n"
+ 		       "41:     movl 20(%4), %%edx\n"
+-		       "        movl %%eax, 16(%3)\n"
+-		       "        movl %%edx, 20(%3)\n"
++		       "        movl %%eax, %%es:16(%3)\n"
++		       "        movl %%edx, %%es:20(%3)\n"
+ 		       "10:     movl 24(%4), %%eax\n"
+ 		       "51:     movl 28(%4), %%edx\n"
+-		       "        movl %%eax, 24(%3)\n"
+-		       "        movl %%edx, 28(%3)\n"
++		       "        movl %%eax, %%es:24(%3)\n"
++		       "        movl %%edx, %%es:28(%3)\n"
+ 		       "11:     movl 32(%4), %%eax\n"
+ 		       "61:     movl 36(%4), %%edx\n"
+-		       "        movl %%eax, 32(%3)\n"
+-		       "        movl %%edx, 36(%3)\n"
++		       "        movl %%eax, %%es:32(%3)\n"
++		       "        movl %%edx, %%es:36(%3)\n"
+ 		       "12:     movl 40(%4), %%eax\n"
+ 		       "71:     movl 44(%4), %%edx\n"
+-		       "        movl %%eax, 40(%3)\n"
+-		       "        movl %%edx, 44(%3)\n"
++		       "        movl %%eax, %%es:40(%3)\n"
++		       "        movl %%edx, %%es:44(%3)\n"
+ 		       "13:     movl 48(%4), %%eax\n"
+ 		       "81:     movl 52(%4), %%edx\n"
+-		       "        movl %%eax, 48(%3)\n"
+-		       "        movl %%edx, 52(%3)\n"
++		       "        movl %%eax, %%es:48(%3)\n"
++		       "        movl %%edx, %%es:52(%3)\n"
+ 		       "14:     movl 56(%4), %%eax\n"
+ 		       "91:     movl 60(%4), %%edx\n"
+-		       "        movl %%eax, 56(%3)\n"
+-		       "        movl %%edx, 60(%3)\n"
++		       "        movl %%eax, %%es:56(%3)\n"
++		       "        movl %%edx, %%es:60(%3)\n"
+ 		       "        addl $-64, %0\n"
+ 		       "        addl $64, %4\n"
+ 		       "        addl $64, %3\n"
+@@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        movl %%eax,%0\n"
+ 		       "7:      rep; movsb\n"
+ 		       "8:\n"
++		       "        pushl %%ss\n"
++		       "        popl %%ds\n"
+ 		       ".section .fixup,\"ax\"\n"
+ 		       "9:      lea 0(%%eax,%0,4),%0\n"
+ 		       "16:     pushl %0\n"
+@@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
+ 		       "        .long 7b,16b\n"
+ 		       ".previous"
+ 		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-		       :  "1"(to), "2"(from), "0"(size)
++		       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 		       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     pushl %0\n"
+@@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
+ 	int d0, d1;
+ 
+ 	__asm__ __volatile__(
++	       "        movw %w6, %%ds\n"
+ 	       "        .align 2,0x90\n"
+ 	       "0:      movl 32(%4), %%eax\n"
+ 	       "        cmpl $67, %0\n"
+@@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
+ 	       "        .align 2,0x90\n"
+ 	       "2:      movl 0(%4), %%eax\n"
+ 	       "21:     movl 4(%4), %%edx\n"
+-	       "        movnti %%eax, 0(%3)\n"
+-	       "        movnti %%edx, 4(%3)\n"
++	       "        movnti %%eax, %%es:0(%3)\n"
++	       "        movnti %%edx, %%es:4(%3)\n"
+ 	       "3:      movl 8(%4), %%eax\n"
+ 	       "31:     movl 12(%4),%%edx\n"
+-	       "        movnti %%eax, 8(%3)\n"
+-	       "        movnti %%edx, 12(%3)\n"
++	       "        movnti %%eax, %%es:8(%3)\n"
++	       "        movnti %%edx, %%es:12(%3)\n"
+ 	       "4:      movl 16(%4), %%eax\n"
+ 	       "41:     movl 20(%4), %%edx\n"
+-	       "        movnti %%eax, 16(%3)\n"
+-	       "        movnti %%edx, 20(%3)\n"
++	       "        movnti %%eax, %%es:16(%3)\n"
++	       "        movnti %%edx, %%es:20(%3)\n"
+ 	       "10:     movl 24(%4), %%eax\n"
+ 	       "51:     movl 28(%4), %%edx\n"
+-	       "        movnti %%eax, 24(%3)\n"
+-	       "        movnti %%edx, 28(%3)\n"
++	       "        movnti %%eax, %%es:24(%3)\n"
++	       "        movnti %%edx, %%es:28(%3)\n"
+ 	       "11:     movl 32(%4), %%eax\n"
+ 	       "61:     movl 36(%4), %%edx\n"
+-	       "        movnti %%eax, 32(%3)\n"
+-	       "        movnti %%edx, 36(%3)\n"
++	       "        movnti %%eax, %%es:32(%3)\n"
++	       "        movnti %%edx, %%es:36(%3)\n"
+ 	       "12:     movl 40(%4), %%eax\n"
+ 	       "71:     movl 44(%4), %%edx\n"
+-	       "        movnti %%eax, 40(%3)\n"
+-	       "        movnti %%edx, 44(%3)\n"
++	       "        movnti %%eax, %%es:40(%3)\n"
++	       "        movnti %%edx, %%es:44(%3)\n"
+ 	       "13:     movl 48(%4), %%eax\n"
+ 	       "81:     movl 52(%4), %%edx\n"
+-	       "        movnti %%eax, 48(%3)\n"
+-	       "        movnti %%edx, 52(%3)\n"
++	       "        movnti %%eax, %%es:48(%3)\n"
++	       "        movnti %%edx, %%es:52(%3)\n"
+ 	       "14:     movl 56(%4), %%eax\n"
+ 	       "91:     movl 60(%4), %%edx\n"
+-	       "        movnti %%eax, 56(%3)\n"
+-	       "        movnti %%edx, 60(%3)\n"
++	       "        movnti %%eax, %%es:56(%3)\n"
++	       "        movnti %%edx, %%es:60(%3)\n"
+ 	       "        addl $-64, %0\n"
+ 	       "        addl $64, %4\n"
+ 	       "        addl $64, %3\n"
+@@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
+ 	       "        movl %%eax,%0\n"
+ 	       "7:      rep; movsb\n"
+ 	       "8:\n"
++	       "        pushl %%ss\n"
++	       "        popl %%ds\n"
+ 	       ".section .fixup,\"ax\"\n"
+ 	       "9:      lea 0(%%eax,%0,4),%0\n"
+ 	       "16:     jmp 8b\n"
+@@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
+ 	       "        .long 7b,16b\n"
+ 	       ".previous"
+ 	       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+-	       :  "1"(to), "2"(from), "0"(size)
++	       :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
+ 	       : "eax", "edx", "memory");
+ 	return size;
+ }
+@@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
+  */
+ unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
+ 					unsigned long size);
+-unsigned long __copy_user_intel(void __user *to, const void *from,
++unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
++					unsigned long size);
++unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
+ 					unsigned long size);
+ unsigned long __copy_user_zeroing_intel_nocache(void *to,
+ 				const void __user *from, unsigned long size);
+ #endif /* CONFIG_X86_INTEL_USERCOPY */
+ 
+ /* Generic arbitrary sized copy.  */
+-#define __copy_user(to, from, size)					\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 2b\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,2b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
+-
+-#define __copy_user_zeroing(to, from, size)				\
+-do {									\
+-	int __d0, __d1, __d2;						\
+-	__asm__ __volatile__(						\
+-		"	cmp  $7,%0\n"					\
+-		"	jbe  1f\n"					\
+-		"	movl %1,%0\n"					\
+-		"	negl %0\n"					\
+-		"	andl $7,%0\n"					\
+-		"	subl %0,%3\n"					\
+-		"4:	rep; movsb\n"					\
+-		"	movl %3,%0\n"					\
+-		"	shrl $2,%0\n"					\
+-		"	andl $3,%3\n"					\
+-		"	.align 2,0x90\n"				\
+-		"0:	rep; movsl\n"					\
+-		"	movl %3,%0\n"					\
+-		"1:	rep; movsb\n"					\
+-		"2:\n"							\
+-		".section .fixup,\"ax\"\n"				\
+-		"5:	addl %3,%0\n"					\
+-		"	jmp 6f\n"					\
+-		"3:	lea 0(%3,%0,4),%0\n"				\
+-		"6:	pushl %0\n"					\
+-		"	pushl %%eax\n"					\
+-		"	xorl %%eax,%%eax\n"				\
+-		"	rep; stosb\n"					\
+-		"	popl %%eax\n"					\
+-		"	popl %0\n"					\
+-		"	jmp 2b\n"					\
+-		".previous\n"						\
+-		".section __ex_table,\"a\"\n"				\
+-		"	.align 4\n"					\
+-		"	.long 4b,5b\n"					\
+-		"	.long 0b,3b\n"					\
+-		"	.long 1b,6b\n"					\
+-		".previous"						\
+-		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)	\
+-		: "3"(size), "0"(size), "1"(to), "2"(from)		\
+-		: "memory");						\
+-} while (0)
++static unsigned long
++__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%es\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%es\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 2b\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,2b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
++
++static unsigned long
++__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
++{
++	int __d0, __d1, __d2;
++
++	__asm__ __volatile__(
++		"	movw %w8,%%ds\n"
++		"	cmp  $7,%0\n"
++		"	jbe  1f\n"
++		"	movl %1,%0\n"
++		"	negl %0\n"
++		"	andl $7,%0\n"
++		"	subl %0,%3\n"
++		"4:	rep; movsb\n"
++		"	movl %3,%0\n"
++		"	shrl $2,%0\n"
++		"	andl $3,%3\n"
++		"	.align 2,0x90\n"
++		"0:	rep; movsl\n"
++		"	movl %3,%0\n"
++		"1:	rep; movsb\n"
++		"2:\n"
++		"	pushl %%ss\n"
++		"	popl %%ds\n"
++		".section .fixup,\"ax\"\n"
++		"5:	addl %3,%0\n"
++		"	jmp 6f\n"
++		"3:	lea 0(%3,%0,4),%0\n"
++		"6:	pushl %0\n"
++		"	pushl %%eax\n"
++		"	xorl %%eax,%%eax\n"
++		"	rep; stosb\n"
++		"	popl %%eax\n"
++		"	popl %0\n"
++		"	jmp 2b\n"
++		".previous\n"
++		".section __ex_table,\"a\"\n"
++		"	.align 4\n"
++		"	.long 4b,5b\n"
++		"	.long 0b,3b\n"
++		"	.long 1b,6b\n"
++		".previous"
++		: "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
++		: "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
++		: "memory");
++	return size;
++}
+ 
+ unsigned long __copy_to_user_ll(void __user *to, const void *from,
+ 				unsigned long n)
+@@ -775,9 +966,9 @@ survive:
+ 	}
+ #endif
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_to_user(to, from, n);
+ 	else
+-		n = __copy_user_intel(to, from, n);
++		n = __generic_copy_to_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_to_user_ll);
+@@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
+ 					unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ 	else
+ 		n = __copy_user_zeroing_intel(to, from, n);
+ 	return n;
+@@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
+ 					 unsigned long n)
+ {
+ 	if (movsl_is_ok(to, from, n))
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ 	else
+-		n = __copy_user_intel((void __user *)to,
+-				      (const void *)from, n);
++		n = __generic_copy_from_user_intel(to, from, n);
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nozero);
+@@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_zeroing_intel_nocache(to, from, n);
+ 	else
+-		__copy_user_zeroing(to, from, n);
++		n = __copy_user_zeroing(to, from, n);
+ #else
+-	__copy_user_zeroing(to, from, n);
++	n = __copy_user_zeroing(to, from, n);
+ #endif
+ 	return n;
+ }
+@@ -827,59 +1017,40 @@ unsigned long __copy_from_user_ll_nocach
+ 	if (n > 64 && cpu_has_xmm2)
+ 		n = __copy_user_intel_nocache(to, from, n);
+ 	else
+-		__copy_user(to, from, n);
++		n = __generic_copy_from_user(to, from, n);
+ #else
+-	__copy_user(to, from, n);
++	n = __generic_copy_from_user(to, from, n);
+ #endif
+ 	return n;
+ }
+ EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
+ 
+-/**
+- * copy_to_user: - Copy a block of data into user space.
+- * @to:   Destination address, in user space.
+- * @from: Source address, in kernel space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from kernel space to user space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- */
+-unsigned long
+-copy_to_user(void __user *to, const void *from, unsigned long n)
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++void __set_fs(mm_segment_t x, int cpu)
+ {
+-	if (access_ok(VERIFY_WRITE, to, n))
+-		n = __copy_to_user(to, from, n);
+-	return n;
++	unsigned long limit = x.seg;
++	struct desc_struct d;
++
++	current_thread_info()->addr_limit = x;
++	if (unlikely(paravirt_enabled()))
++		return;
++
++	if (likely(limit))
++		limit = (limit - 1UL) >> PAGE_SHIFT;
++	pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
++	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
+ }
+-EXPORT_SYMBOL(copy_to_user);
+ 
+-/**
+- * copy_from_user: - Copy a block of data from user space.
+- * @to:   Destination address, in kernel space.
+- * @from: Source address, in user space.
+- * @n:    Number of bytes to copy.
+- *
+- * Context: User context only.  This function may sleep.
+- *
+- * Copy data from user space to kernel space.
+- *
+- * Returns number of bytes that could not be copied.
+- * On success, this will be zero.
+- *
+- * If some data could not be copied, this function will pad the copied
+- * data to the requested size using zero bytes.
+- */
+-unsigned long
+-copy_from_user(void *to, const void __user *from, unsigned long n)
++void set_fs(mm_segment_t x)
+ {
+-	if (access_ok(VERIFY_READ, from, n))
+-		n = __copy_from_user(to, from, n);
+-	else
+-		memset(to, 0, n);
+-	return n;
++	__set_fs(x, get_cpu());
++	put_cpu();
+ }
+-EXPORT_SYMBOL(copy_from_user);
++#else
++void set_fs(mm_segment_t x)
++{
++	current_thread_info()->addr_limit = x;
++}
++#endif
++
++EXPORT_SYMBOL(set_fs);
+diff -urNp linux-2.6.32.14/arch/x86/lib/usercopy_64.c linux-2.6.32.14/arch/x86/lib/usercopy_64.c
+--- linux-2.6.32.14/arch/x86/lib/usercopy_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/lib/usercopy_64.c	2010-05-28 21:27:15.107152206 -0400
+@@ -42,6 +42,8 @@ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
+ {
+ 	long res;
++	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
++		src += PAX_USER_SHADOW_BASE;
+ 	__do_strncpy_from_user(dst, src, count, res);
+ 	return res;
+ }
+@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
+ {
+ 	long __d0;
+ 	might_fault();
++	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
++		addr += PAX_USER_SHADOW_BASE;
+ 	/* no memory constraint because it doesn't change any memory gcc knows
+ 	   about */
+ 	asm volatile(
+@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
+ 
+ unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
+ {
+-	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
++	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
++		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
++			to += PAX_USER_SHADOW_BASE;
++		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
++			from += PAX_USER_SHADOW_BASE;
+ 		return copy_user_generic((__force void *)to, (__force void *)from, len);
+-	} 
+-	return len;		
++	}
++	return len;
+ }
+ EXPORT_SYMBOL(copy_in_user);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/Makefile linux-2.6.32.14/arch/x86/Makefile
+--- linux-2.6.32.14/arch/x86/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/Makefile	2010-05-28 21:27:15.107152206 -0400
+@@ -189,3 +189,12 @@ define archhelp
+   echo  '                  FDARGS="..."  arguments for the booted kernel'
+   echo  '                  FDINITRD=file initrd for the booted kernel'
+ endef
++
++define OLD_LD
++
++*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
++*** Please upgrade your binutils to 2.18 or newer
++endef
++
++archprepare:
++	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
+diff -urNp linux-2.6.32.14/arch/x86/mm/extable.c linux-2.6.32.14/arch/x86/mm/extable.c
+--- linux-2.6.32.14/arch/x86/mm/extable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/extable.c	2010-05-28 21:27:15.107152206 -0400
+@@ -1,14 +1,71 @@
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
++#include <linux/sort.h>
+ #include <asm/uaccess.h>
++#include <asm/pgtable.h>
+ 
++/*
++ * The exception table needs to be sorted so that the binary
++ * search that we use to find entries in it works properly.
++ * This is used both for the kernel exception table and for
++ * the exception tables of modules that get loaded.
++ */
++static int cmp_ex(const void *a, const void *b)
++{
++	const struct exception_table_entry *x = a, *y = b;
++
++	/* avoid overflow */
++	if (x->insn > y->insn)
++		return 1;
++	if (x->insn < y->insn)
++		return -1;
++	return 0;
++}
++
++static void swap_ex(void *a, void *b, int size)
++{
++	struct exception_table_entry t, *x = a, *y = b;
++
++	t = *x;
++
++	pax_open_kernel();
++	*x = *y;
++	*y = t;
++	pax_close_kernel();
++}
++
++void sort_extable(struct exception_table_entry *start,
++		  struct exception_table_entry *finish)
++{
++	sort(start, finish - start, sizeof(struct exception_table_entry),
++	     cmp_ex, swap_ex);
++}
++
++#ifdef CONFIG_MODULES
++/*
++ * If the exception table is sorted, any referring to the module init
++ * will be at the beginning or the end.
++ */
++void trim_init_extable(struct module *m)
++{
++	/*trim the beginning*/
++	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
++		m->extable++;
++		m->num_exentries--;
++	}
++	/*trim the end*/
++	while (m->num_exentries &&
++		within_module_init(m->extable[m->num_exentries-1].insn, m))
++		m->num_exentries--;
++}
++#endif /* CONFIG_MODULES */
+ 
+ int fixup_exception(struct pt_regs *regs)
+ {
+ 	const struct exception_table_entry *fixup;
+ 
+ #ifdef CONFIG_PNPBIOS
+-	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
++	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
+ 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
+ 		extern u32 pnp_bios_is_utter_crap;
+ 		pnp_bios_is_utter_crap = 1;
+diff -urNp linux-2.6.32.14/arch/x86/mm/fault.c linux-2.6.32.14/arch/x86/mm/fault.c
+--- linux-2.6.32.14/arch/x86/mm/fault.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/fault.c	2010-05-28 21:27:15.107152206 -0400
+@@ -11,10 +11,19 @@
+ #include <linux/kprobes.h>		/* __kprobes, ...		*/
+ #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
+ #include <linux/perf_event.h>		/* perf_sw_event		*/
++#include <linux/unistd.h>
++#include <linux/compiler.h>
+ 
+ #include <asm/traps.h>			/* dotraplinkage, ...		*/
+ #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
+ #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
++#include <asm/vsyscall.h>
++#include <asm/tlbflush.h>
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++#include <asm/stacktrace.h>
++#include "../kernel/dumpstack.h"
++#endif
+ 
+ /*
+  * Page fault error code bits:
+@@ -51,7 +60,7 @@ static inline int notify_page_fault(stru
+ 	int ret = 0;
+ 
+ 	/* kprobe_running() needs smp_processor_id() */
+-	if (kprobes_built_in() && !user_mode_vm(regs)) {
++	if (kprobes_built_in() && !user_mode(regs)) {
+ 		preempt_disable();
+ 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
+ 			ret = 1;
+@@ -172,6 +181,30 @@ force_sig_info_fault(int si_signo, int s
+ 	force_sig_info(si_signo, &info, tsk);
+ }
+ 
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault(struct pt_regs *regs);
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
++{
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++	pgd = pgd_offset(mm, address);
++	if (!pgd_present(*pgd))
++		return NULL;
++	pud = pud_offset(pgd, address);
++	if (!pud_present(*pud))
++		return NULL;
++	pmd = pmd_offset(pud, address);
++	if (!pmd_present(*pmd))
++		return NULL;
++	return pmd;
++}
++#endif
++
+ DEFINE_SPINLOCK(pgd_lock);
+ LIST_HEAD(pgd_list);
+ 
+@@ -224,11 +257,24 @@ void vmalloc_sync_all(void)
+ 	     address += PMD_SIZE) {
+ 
+ 		unsigned long flags;
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		unsigned long cpu;
++#else
+ 		struct page *page;
++#endif
+ 
+ 		spin_lock_irqsave(&pgd_lock, flags);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++			pgd_t *pgd = get_cpu_pgd(cpu);
++#else
+ 		list_for_each_entry(page, &pgd_list, lru) {
+-			if (!vmalloc_sync_one(page_address(page), address))
++			pgd_t *pgd = page_address(page);
++#endif
++
++			if (!vmalloc_sync_one(pgd, address))
+ 				break;
+ 		}
+ 		spin_unlock_irqrestore(&pgd_lock, flags);
+@@ -257,6 +303,9 @@ static noinline int vmalloc_fault(unsign
+ 	 * Do _not_ use "current" here. We might be inside
+ 	 * an interrupt in the middle of a task switch..
+ 	 */
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
++#endif
+ 	pgd_paddr = read_cr3();
+ 	pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
+ 	if (!pmd_k)
+@@ -332,15 +381,27 @@ void vmalloc_sync_all(void)
+ 
+ 		const pgd_t *pgd_ref = pgd_offset_k(address);
+ 		unsigned long flags;
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		unsigned long cpu;
++#else
+ 		struct page *page;
++#endif
+ 
+ 		if (pgd_none(*pgd_ref))
+ 			continue;
+ 
+ 		spin_lock_irqsave(&pgd_lock, flags);
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++			pgd_t *pgd = pgd_offset_cpu(cpu, address);
++#else
+ 		list_for_each_entry(page, &pgd_list, lru) {
+ 			pgd_t *pgd;
+ 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
++#endif
++
+ 			if (pgd_none(*pgd))
+ 				set_pgd(pgd, *pgd_ref);
+ 			else
+@@ -373,7 +434,14 @@ static noinline int vmalloc_fault(unsign
+ 	 * happen within a race in page table update. In the later
+ 	 * case just flush:
+ 	 */
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
++	pgd = pgd_offset_cpu(smp_processor_id(), address);
++#else
+ 	pgd = pgd_offset(current->active_mm, address);
++#endif
++
+ 	pgd_ref = pgd_offset_k(address);
+ 	if (pgd_none(*pgd_ref))
+ 		return -1;
+@@ -535,7 +603,7 @@ static int is_errata93(struct pt_regs *r
+ static int is_errata100(struct pt_regs *regs, unsigned long address)
+ {
+ #ifdef CONFIG_X86_64
+-	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
++	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
+ 		return 1;
+ #endif
+ 	return 0;
+@@ -562,7 +630,7 @@ static int is_f00f_bug(struct pt_regs *r
+ }
+ 
+ static const char nx_warning[] = KERN_CRIT
+-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
++"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
+ 
+ static void
+ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -571,15 +639,26 @@ show_fault_oops(struct pt_regs *regs, un
+ 	if (!oops_may_print())
+ 		return;
+ 
+-	if (error_code & PF_INSTR) {
++	if (nx_enabled && (error_code & PF_INSTR)) {
+ 		unsigned int level;
+ 
+ 		pte_t *pte = lookup_address(address, &level);
+ 
+ 		if (pte && pte_present(*pte) && !pte_exec(*pte))
+-			printk(nx_warning, current_uid());
++			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
+ 	}
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	if (init_mm.start_code <= address && address < init_mm.end_code) {
++		if (current->signal->curr_ip)
++			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++		else
++			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
++					 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	}
++#endif
++
+ 	printk(KERN_ALERT "BUG: unable to handle kernel ");
+ 	if (address < PAGE_SIZE)
+ 		printk(KERN_CONT "NULL pointer dereference");
+@@ -704,6 +783,68 @@ __bad_area_nosemaphore(struct pt_regs *r
+ 		       unsigned long address, int si_code)
+ {
+ 	struct task_struct *tsk = current;
++	struct mm_struct *mm = tsk->mm;
++
++#ifdef CONFIG_X86_64
++	if (mm && (error_code & PF_INSTR)) {
++		if (regs->ip == (unsigned long)vgettimeofday) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
++			return;
++		} else if (regs->ip == (unsigned long)vtime) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
++			return;
++		} else if (regs->ip == (unsigned long)vgetcpu) {
++			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
++			return;
++		}
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm && (error_code & PF_USER)) {
++		unsigned long ip = regs->ip;
++
++		if (v8086_mode(regs))
++			ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
++
++		/*
++		 * It's possible to have interrupts off here:
++		 */
++		local_irq_enable();
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
++		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
++
++#ifdef CONFIG_PAX_EMUTRAMP
++			switch (pax_handle_fetch_fault(regs)) {
++			case 2:
++				return;
++			}
++#endif
++
++			pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++			do_group_exit(SIGKILL);
++		}
++#endif
++
++	}
++#endif
+ 
+ 	/* User mode accesses just cause a SIGSEGV */
+ 	if (error_code & PF_USER) {
+@@ -848,6 +989,106 @@ static int spurious_fault_check(unsigned
+ 	return 1;
+ }
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
++{
++	pte_t *pte;
++	pmd_t *pmd;
++	spinlock_t *ptl;
++	unsigned char pte_mask;
++
++	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
++	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
++		return 0;
++
++	/* PaX: it's our fault, let's handle it if we can */
++
++	/* PaX: take a look at read faults before acquiring any locks */
++	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
++		/* instruction fetch attempt from a protected page in user mode */
++		up_read(&mm->mmap_sem);
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		switch (pax_handle_fetch_fault(regs)) {
++		case 2:
++			return 1;
++		}
++#endif
++
++		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
++		do_group_exit(SIGKILL);
++	}
++
++	pmd = pax_get_pmd(mm, address);
++	if (unlikely(!pmd))
++		return 0;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
++		/* write attempt to a protected page in user mode */
++		pte_unmap_unlock(pte, ptl);
++		return 0;
++	}
++
++#ifdef CONFIG_SMP
++	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
++#else
++	if (likely(address > get_limit(regs->cs)))
++#endif
++	{
++		set_pte(pte, pte_mkread(*pte));
++		__flush_tlb_one(address);
++		pte_unmap_unlock(pte, ptl);
++		up_read(&mm->mmap_sem);
++		return 1;
++	}
++
++	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
++
++	/*
++	 * PaX: fill DTLB with user rights and retry
++	 */
++	__asm__ __volatile__ (
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"movw %w4,%%es\n"
++#endif
++		"orb %2,(%1)\n"
++#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
++/*
++ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
++ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
++ * page fault when examined during a TLB load attempt. this is true not only
++ * for PTEs holding a non-present entry but also present entries that will
++ * raise a page fault (such as those set up by PaX, or the copy-on-write
++ * mechanism). in effect it means that we do *not* need to flush the TLBs
++ * for our target pages since their PTEs are simply not in the TLBs at all.
++
++ * the best thing in omitting it is that we gain around 15-20% speed in the
++ * fast path of the page fault handler and can get rid of tracing since we
++ * can no longer flush unintended entries.
++ */
++		"invlpg (%0)\n"
++#endif
++		"testb $0,%%es:(%0)\n"
++		"xorb %3,(%1)\n"
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++		"pushl %%ss\n"
++		"popl %%es\n"
++#endif
++		:
++		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
++		: "memory", "cc");
++	pte_unmap_unlock(pte, ptl);
++	up_read(&mm->mmap_sem);
++	return 1;
++}
++#endif
++
+ /*
+  * Handle a spurious fault caused by a stale TLB entry.
+  *
+@@ -914,6 +1155,9 @@ int show_unhandled_signals = 1;
+ static inline int
+ access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
+ {
++	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
++		return 1;
++
+ 	if (write) {
+ 		/* write, present and write, not present: */
+ 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
+@@ -947,17 +1191,31 @@ do_page_fault(struct pt_regs *regs, unsi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct task_struct *tsk;
+-	unsigned long address;
+ 	struct mm_struct *mm;
+ 	int write;
+ 	int fault;
+ 
++	/* Get the faulting address: */
++	unsigned long address = read_cr2();
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
++		if (!search_exception_tables(regs->ip)) {
++			bad_area_nosemaphore(regs, error_code, address);
++			return;
++		}
++		if (address < PAX_USER_SHADOW_BASE) {
++			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
++			printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
++			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
++		} else
++			address -= PAX_USER_SHADOW_BASE;
++	}
++#endif
++
+ 	tsk = current;
+ 	mm = tsk->mm;
+ 
+-	/* Get the faulting address: */
+-	address = read_cr2();
+-
+ 	/*
+ 	 * Detect and handle instructions that would cause a page fault for
+ 	 * both a tracked kernel page and a userspace page.
+@@ -1017,7 +1275,7 @@ do_page_fault(struct pt_regs *regs, unsi
+ 	 * User-mode registers count as a user access even for any
+ 	 * potential system fault or CPU buglet:
+ 	 */
+-	if (user_mode_vm(regs)) {
++	if (user_mode(regs)) {
+ 		local_irq_enable();
+ 		error_code |= PF_USER;
+ 	} else {
+@@ -1071,6 +1329,11 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		might_sleep();
+ 	}
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
++	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
++		return;
++#endif
++
+ 	vma = find_vma(mm, address);
+ 	if (unlikely(!vma)) {
+ 		bad_area(regs, error_code, address);
+@@ -1082,18 +1345,24 @@ do_page_fault(struct pt_regs *regs, unsi
+ 		bad_area(regs, error_code, address);
+ 		return;
+ 	}
+-	if (error_code & PF_USER) {
+-		/*
+-		 * Accessing the stack below %sp is always a bug.
+-		 * The large cushion allows instructions like enter
+-		 * and pusha to work. ("enter $65535, $31" pushes
+-		 * 32 pointers and then decrements %sp by 65535.)
+-		 */
+-		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
+-			bad_area(regs, error_code, address);
+-			return;
+-		}
++	/*
++	 * Accessing the stack below %sp is always a bug.
++	 * The large cushion allows instructions like enter
++	 * and pusha to work. ("enter $65535, $31" pushes
++	 * 32 pointers and then decrements %sp by 65535.)
++	 */
++	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
++		bad_area(regs, error_code, address);
++		return;
++	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
++		bad_area(regs, error_code, address);
++		return;
+ 	}
++#endif
++
+ 	if (unlikely(expand_stack(vma, address))) {
+ 		bad_area(regs, error_code, address);
+ 		return;
+@@ -1137,3 +1406,199 @@ good_area:
+ 
+ 	up_read(&mm->mmap_sem);
+ }
++
++#ifdef CONFIG_PAX_EMUTRAMP
++static int pax_handle_fetch_fault_32(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned char mov1, mov2;
++		unsigned short jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 11) >> 32)
++			break;
++#endif
++
++		err = get_user(mov1, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
++			regs->cx = addr1;
++			regs->ax = addr2;
++			regs->ip = addr2;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned char mov, jmp;
++		unsigned int addr1, addr2;
++
++#ifdef CONFIG_X86_64
++		if ((regs->ip + 9) >> 32)
++			break;
++#endif
++
++		err = get_user(mov, (unsigned char __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
++		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
++		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
++
++		if (err)
++			break;
++
++		if (mov == 0xB9 && jmp == 0xE9) {
++			regs->cx = addr1;
++			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++
++#ifdef CONFIG_X86_64
++static int pax_handle_fetch_fault_64(struct pt_regs *regs)
++{
++	int err;
++
++	do { /* PaX: gcc trampoline emulation #1 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned int addr1;
++		unsigned long addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: gcc trampoline emulation #2 */
++		unsigned short mov1, mov2, jmp1;
++		unsigned char jmp2;
++		unsigned long addr1, addr2;
++
++		err = get_user(mov1, (unsigned short __user *)regs->ip);
++		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
++		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
++		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
++		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
++		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
++
++		if (err)
++			break;
++
++		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
++			regs->r11 = addr1;
++			regs->r10 = addr2;
++			regs->ip = addr1;
++			return 2;
++		}
++	} while (0);
++
++	return 1; /* PaX in action */
++}
++#endif
++
++/*
++ * PaX: decide what to do with offenders (regs->ip = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when gcc trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++	if (v8086_mode(regs))
++		return 1;
++
++	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
++		return 1;
++
++#ifdef CONFIG_X86_32
++	return pax_handle_fetch_fault_32(regs);
++#else
++	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
++		return pax_handle_fetch_fault_32(regs);
++	else
++		return pax_handle_fetch_fault_64(regs);
++#endif
++}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_insns(void *pc, void *sp)
++{
++	long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (__force unsigned char __user *)pc+i))
++			printk(KERN_CONT "?? ");
++		else
++			printk(KERN_CONT "%02x ", c);
++	}
++	printk("\n");
++
++	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
++	for (i = -1; i < 80 / (long)sizeof(long); i++) {
++		unsigned long c;
++		if (get_user(c, (__force unsigned long __user *)sp+i))
++#ifdef CONFIG_X86_32
++			printk(KERN_CONT "???????? ");
++#else
++			printk(KERN_CONT "???????????????? ");
++#endif
++		else
++			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
++	}
++	printk("\n");
++}
++#endif
++
++/**
++ * probe_kernel_write(): safely attempt to write to a location
++ * @dst: address to write to
++ * @src: pointer to the data that shall be written
++ * @size: size of the data chunk
++ *
++ * Safely write to address @dst from the buffer at @src.  If a kernel fault
++ * happens, handle that and return -EFAULT.
++ */
++long notrace probe_kernel_write(void *dst, const void *src, size_t size)
++{
++	long ret;
++	mm_segment_t old_fs = get_fs();
++
++	set_fs(KERNEL_DS);
++	pagefault_disable();
++	pax_open_kernel();
++	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
++	pax_close_kernel();
++	pagefault_enable();
++	set_fs(old_fs);
++
++	return ret ? -EFAULT : 0;
++}
+diff -urNp linux-2.6.32.14/arch/x86/mm/gup.c linux-2.6.32.14/arch/x86/mm/gup.c
+--- linux-2.6.32.14/arch/x86/mm/gup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/gup.c	2010-05-28 21:27:15.107152206 -0400
+@@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long 
+ 	addr = start;
+ 	len = (unsigned long) nr_pages << PAGE_SHIFT;
+ 	end = start + len;
+-	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
++	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+ 					(void __user *)start, len)))
+ 		return 0;
+ 
+diff -urNp linux-2.6.32.14/arch/x86/mm/highmem_32.c linux-2.6.32.14/arch/x86/mm/highmem_32.c
+--- linux-2.6.32.14/arch/x86/mm/highmem_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/highmem_32.c	2010-05-28 21:27:15.107152206 -0400
+@@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
+ 	idx = type + KM_TYPE_NR*smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+ 	BUG_ON(!pte_none(*(kmap_pte-idx)));
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte-idx, mk_pte(page, prot));
++	pax_close_kernel();
+ 
+ 	return (void *)vaddr;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/mm/hugetlbpage.c linux-2.6.32.14/arch/x86/mm/hugetlbpage.c
+--- linux-2.6.32.14/arch/x86/mm/hugetlbpage.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/hugetlbpage.c	2010-05-28 21:27:15.107152206 -0400
+@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
+-	unsigned long start_addr;
++	unsigned long start_addr, pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = mm->free_area_cache;
++		start_addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -281,13 +286,13 @@ full_search:
+ 
+ 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+ 		/* At this point:  (!vma || addr < vma->vm_end). */
+-		if (TASK_SIZE - len < addr) {
++		if (pax_task_size - len < addr) {
+ 			/*
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma, *prev_vma;
+-	unsigned long base = mm->mmap_base, addr = addr0;
++	unsigned long base = mm->mmap_base, addr;
+ 	unsigned long largest_hole = mm->cached_hole_size;
+-	int first_time = 1;
+ 
+ 	/* don't allow allocations above current base */
+ 	if (mm->free_area_cache > base)
+@@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
+ 	        largest_hole = 0;
+ 		mm->free_area_cache  = base;
+ 	}
+-try_again:
++
+ 	/* make sure it can fit in the remaining address space */
+ 	if (mm->free_area_cache < len)
+ 		goto fail;
+@@ -364,22 +368,26 @@ try_again:
+ 
+ fail:
+ 	/*
+-	 * if hint left us with no space for the requested
+-	 * mapping then try again:
+-	 */
+-	if (first_time) {
+-		mm->free_area_cache = base;
+-		largest_hole = 0;
+-		first_time = 0;
+-		goto try_again;
+-	}
+-	/*
+ 	 * A failed mmap() very likely causes application failure,
+ 	 * so fall back to the bottom-up function here. This scenario
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
+-	mm->free_area_cache = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
++	else
++#endif
++
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+ 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
+ 			len, pgoff, flags);
+@@ -387,6 +395,7 @@ fail:
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
++	mm->mmap_base = base;
+ 	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+@@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
+ 	struct hstate *h = hstate_file(file);
+ 	struct mm_struct *mm = current->mm;
+ 	struct vm_area_struct *vma;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (len & ~huge_page_mask(h))
+ 		return -EINVAL;
+-	if (len > TASK_SIZE)
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (len > pax_task_size)
+ 		return -ENOMEM;
+ 
+ 	if (flags & MAP_FIXED) {
+@@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
+ 	if (addr) {
+ 		addr = ALIGN(addr, huge_page_size(h));
+ 		vma = find_vma(mm, addr);
+-		if (TASK_SIZE - len >= addr &&
++		if (pax_task_size - len >= addr &&
+ 		    (!vma || addr + len <= vma->vm_start))
+ 			return addr;
+ 	}
+diff -urNp linux-2.6.32.14/arch/x86/mm/init_32.c linux-2.6.32.14/arch/x86/mm/init_32.c
+--- linux-2.6.32.14/arch/x86/mm/init_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/init_32.c	2010-05-28 21:27:15.114903294 -0400
+@@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
+ }
+ 
+ /*
+- * Creates a middle page table and puts a pointer to it in the
+- * given global directory entry. This only returns the gd entry
+- * in non-PAE compilation mode, since the middle layer is folded.
+- */
+-static pmd_t * __init one_md_table_init(pgd_t *pgd)
+-{
+-	pud_t *pud;
+-	pmd_t *pmd_table;
+-
+-#ifdef CONFIG_X86_PAE
+-	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
+-		if (after_bootmem)
+-			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
+-		else
+-			pmd_table = (pmd_t *)alloc_low_page();
+-		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
+-		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
+-		pud = pud_offset(pgd, 0);
+-		BUG_ON(pmd_table != pmd_offset(pud, 0));
+-
+-		return pmd_table;
+-	}
+-#endif
+-	pud = pud_offset(pgd, 0);
+-	pmd_table = pmd_offset(pud, 0);
+-
+-	return pmd_table;
+-}
+-
+-/*
+  * Create a page table and place a pointer to it in a middle page
+  * directory entry:
+  */
+@@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
+ 			page_table = (pte_t *)alloc_low_page();
+ 
+ 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
++#else
+ 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
++#endif
+ 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
+ 	}
+ 
+ 	return pte_offset_kernel(pmd, 0);
+ }
+ 
++static pmd_t * __init one_md_table_init(pgd_t *pgd)
++{
++	pud_t *pud;
++	pmd_t *pmd_table;
++
++	pud = pud_offset(pgd, 0);
++	pmd_table = pmd_offset(pud, 0);
++
++	return pmd_table;
++}
++
+ pmd_t * __init populate_extra_pmd(unsigned long vaddr)
+ {
+ 	int pgd_idx = pgd_index(vaddr);
+@@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
+ 	int pgd_idx, pmd_idx;
+ 	unsigned long vaddr;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte = NULL;
+ 
+@@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
+ 	pgd = pgd_base + pgd_idx;
+ 
+ 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
+-		pmd = pmd + pmd_index(vaddr);
++		pud = pud_offset(pgd, vaddr);
++		pmd = pmd_offset(pud, vaddr);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
++
+ 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
+ 							pmd++, pmd_idx++) {
+ 			pte = page_table_kmap_check(one_page_table_init(pmd),
+@@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
+ 	}
+ }
+ 
+-static inline int is_kernel_text(unsigned long addr)
++static inline int is_kernel_text(unsigned long start, unsigned long end)
+ {
+-	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
+-		return 1;
+-	return 0;
++	if ((start > ktla_ktva((unsigned long)_etext) ||
++	     end <= ktla_ktva((unsigned long)_stext)) &&
++	    (start > ktla_ktva((unsigned long)_einittext) ||
++	     end <= ktla_ktva((unsigned long)_sinittext)) &&
++
++#ifdef CONFIG_ACPI_SLEEP
++	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
++#endif
++
++	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
++		return 0;
++	return 1;
+ }
+ 
+ /*
+@@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
+ 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
+ 	unsigned long start_pfn, end_pfn;
+ 	pgd_t *pgd_base = swapper_pg_dir;
+-	int pgd_idx, pmd_idx, pte_ofs;
++	unsigned int pgd_idx, pmd_idx, pte_ofs;
+ 	unsigned long pfn;
+ 	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 	unsigned pages_2m, pages_4k;
+@@ -278,8 +279,13 @@ repeat:
+ 	pfn = start_pfn;
+ 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 	pgd = pgd_base + pgd_idx;
+-	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
+-		pmd = one_md_table_init(pgd);
++	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
++		pud = pud_offset(pgd, 0);
++		pmd = pmd_offset(pud, 0);
++
++#ifdef CONFIG_X86_PAE
++		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
++#endif
+ 
+ 		if (pfn >= end_pfn)
+ 			continue;
+@@ -291,14 +297,13 @@ repeat:
+ #endif
+ 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
+ 		     pmd++, pmd_idx++) {
+-			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
++			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
+ 
+ 			/*
+ 			 * Map with big pages if possible, otherwise
+ 			 * create normal page tables:
+ 			 */
+ 			if (use_pse) {
+-				unsigned int addr2;
+ 				pgprot_t prot = PAGE_KERNEL_LARGE;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -308,11 +313,7 @@ repeat:
+ 					__pgprot(PTE_IDENT_ATTR |
+ 						 _PAGE_PSE);
+ 
+-				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
+-					PAGE_OFFSET + PAGE_SIZE-1;
+-
+-				if (is_kernel_text(addr) ||
+-				    is_kernel_text(addr2))
++				if (is_kernel_text(address, address + PMD_SIZE))
+ 					prot = PAGE_KERNEL_LARGE_EXEC;
+ 
+ 				pages_2m++;
+@@ -329,7 +330,7 @@ repeat:
+ 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
+ 			pte += pte_ofs;
+ 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
+-			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
++			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
+ 				pgprot_t prot = PAGE_KERNEL;
+ 				/*
+ 				 * first pass will use the same initial
+@@ -337,7 +338,7 @@ repeat:
+ 				 */
+ 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
+ 
+-				if (is_kernel_text(addr))
++				if (is_kernel_text(address, address + PAGE_SIZE))
+ 					prot = PAGE_KERNEL_EXEC;
+ 
+ 				pages_4k++;
+@@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
+ 
+ 		pud = pud_offset(pgd, va);
+ 		pmd = pmd_offset(pud, va);
+-		if (!pmd_present(*pmd))
++		if (!pmd_present(*pmd) || pmd_huge(*pmd))
+ 			break;
+ 
+ 		pte = pte_offset_kernel(pmd, va);
+@@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
+ 
+ static void __init pagetable_init(void)
+ {
+-	pgd_t *pgd_base = swapper_pg_dir;
+-
+-	permanent_kmaps_init(pgd_base);
++	permanent_kmaps_init(swapper_pg_dir);
+ }
+ 
+ #ifdef CONFIG_ACPI_SLEEP
+@@ -551,12 +550,12 @@ static void __init pagetable_init(void)
+  * ACPI suspend needs this for resume, because things like the intel-agp
+  * driver might have split up a kernel 4MB mapping.
+  */
+-char swsusp_pg_dir[PAGE_SIZE]
++pgd_t swsusp_pg_dir[PTRS_PER_PGD]
+ 	__attribute__ ((aligned(PAGE_SIZE)));
+ 
+ static inline void save_pg_dir(void)
+ {
+-	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
++	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
+ }
+ #else /* !CONFIG_ACPI_SLEEP */
+ static inline void save_pg_dir(void)
+@@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
+ 		flush_tlb_all();
+ }
+ 
+-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
++pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
+ EXPORT_SYMBOL_GPL(__supported_pte_mask);
+ 
+ /* user-defined highmem size */
+@@ -777,7 +776,7 @@ void __init setup_bootmem_allocator(void
+ 	 * Initialize the boot-time allocator (with low memory only):
+ 	 */
+ 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
+-	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
++	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
+ 				 PAGE_SIZE);
+ 	if (bootmap == -1L)
+ 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
+@@ -864,6 +863,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ #ifdef CONFIG_FLATMEM
+ 	BUG_ON(!mem_map);
+ #endif
+@@ -881,7 +886,7 @@ void __init mem_init(void)
+ 	set_highmem_pages_init();
+ 
+ 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
+-	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
++	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
+ 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
+ 
+ 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
+@@ -923,10 +928,10 @@ void __init mem_init(void)
+ 		((unsigned long)&__init_end -
+ 		 (unsigned long)&__init_begin) >> 10,
+ 
+-		(unsigned long)&_etext, (unsigned long)&_edata,
+-		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
++		(unsigned long)&_sdata, (unsigned long)&_edata,
++		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
+ 
+-		(unsigned long)&_text, (unsigned long)&_etext,
++		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
+ 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
+ 
+ 	/*
+@@ -1007,6 +1012,7 @@ void set_kernel_text_rw(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read write\n",
+ 		 start, start+size);
+ 
+@@ -1021,6 +1027,7 @@ void set_kernel_text_ro(void)
+ 	if (!kernel_set_to_readonly)
+ 		return;
+ 
++	start = ktla_ktva(start);
+ 	pr_debug("Set kernel text: %lx - %lx for read only\n",
+ 		 start, start+size);
+ 
+@@ -1032,6 +1039,7 @@ void mark_rodata_ro(void)
+ 	unsigned long start = PFN_ALIGN(_text);
+ 	unsigned long size = PFN_ALIGN(_etext) - start;
+ 
++	start = ktla_ktva(start);
+ 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
+ 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
+ 		size >> 10);
+diff -urNp linux-2.6.32.14/arch/x86/mm/init_64.c linux-2.6.32.14/arch/x86/mm/init_64.c
+--- linux-2.6.32.14/arch/x86/mm/init_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/init_64.c	2010-05-28 21:27:15.114903294 -0400
+@@ -163,7 +163,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
+ 	pmd = fill_pmd(pud, vaddr);
+ 	pte = fill_pte(pmd, vaddr);
+ 
++	pax_open_kernel();
+ 	set_pte(pte, new_pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+@@ -222,14 +224,12 @@ static void __init __init_extra_mapping(
+ 		pgd = pgd_offset_k((unsigned long)__va(phys));
+ 		if (pgd_none(*pgd)) {
+ 			pud = (pud_t *) spp_getpage();
+-			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
+ 		}
+ 		pud = pud_offset(pgd, (unsigned long)__va(phys));
+ 		if (pud_none(*pud)) {
+ 			pmd = (pmd_t *) spp_getpage();
+-			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
+-						_PAGE_USER));
++			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
+ 		}
+ 		pmd = pmd_offset(pud, phys);
+ 		BUG_ON(!pmd_none(*pmd));
+@@ -656,6 +656,12 @@ void __init mem_init(void)
+ 
+ 	pci_iommu_alloc();
+ 
++#ifdef CONFIG_PAX_PER_CPU_PGD
++	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
++			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
++			KERNEL_PGD_PTRS);
++#endif
++
+ 	/* clear_bss() already clear the empty_zero_page */
+ 
+ 	reservedpages = 0;
+@@ -842,8 +848,8 @@ int kern_addr_valid(unsigned long addr)
+ static struct vm_area_struct gate_vma = {
+ 	.vm_start	= VSYSCALL_START,
+ 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
+-	.vm_page_prot	= PAGE_READONLY_EXEC,
+-	.vm_flags	= VM_READ | VM_EXEC
++	.vm_page_prot	= PAGE_READONLY,
++	.vm_flags	= VM_READ
+ };
+ 
+ struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
+@@ -877,7 +883,7 @@ int in_gate_area_no_task(unsigned long a
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
+ 	if (vma == &gate_vma)
+ 		return "[vsyscall]";
+diff -urNp linux-2.6.32.14/arch/x86/mm/init.c linux-2.6.32.14/arch/x86/mm/init.c
+--- linux-2.6.32.14/arch/x86/mm/init.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/init.c	2010-05-28 21:27:15.114903294 -0400
+@@ -69,11 +69,7 @@ static void __init find_early_table_spac
+ 	 * cause a hotspot and fill up ZONE_DMA. The page tables
+ 	 * need roughly 0.5KB per GB.
+ 	 */
+-#ifdef CONFIG_X86_32
+-	start = 0x7000;
+-#else
+-	start = 0x8000;
+-#endif
++	start = 0x100000;
+ 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
+ 					tables, PAGE_SIZE);
+ 	if (e820_table_start == -1UL)
+@@ -331,7 +327,13 @@ unsigned long __init_refok init_memory_m
+  */
+ int devmem_is_allowed(unsigned long pagenr)
+ {
+-	if (pagenr <= 256)
++	if (!pagenr)
++		return 1;
++#ifdef CONFIG_VM86
++	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
++		return 1;
++#endif
++	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 1;
+ 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+ 		return 0;
+@@ -379,6 +381,87 @@ void free_init_pages(char *what, unsigne
+ 
+ void free_initmem(void)
+ {
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pgd_t *pgd;
++	pud_t *pud;
++	pmd_t *pmd;
++
++#ifdef CONFIG_X86_32
++	/* PaX: limit KERNEL_CS to actual size */
++	unsigned long addr, limit;
++	struct desc_struct d;
++	int cpu;
++
++	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
++	limit = (limit - 1UL) >> PAGE_SHIFT;
++
++	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
++		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
++	}
++
++	/* PaX: make KERNEL_CS read-only */
++	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
++	if (!paravirt_enabled())
++		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
++/*
++		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
++			pgd = pgd_offset_k(addr);
++			pud = pud_offset(pgd, addr);
++			pmd = pmd_offset(pud, addr);
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		}
++*/
++#ifdef CONFIG_X86_PAE
++	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
++	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++#ifdef CONFIG_MODULES
++	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
++#endif
++
++#else
++	unsigned long addr, end;
++
++	/* PaX: make kernel code/rodata read-only, rest non-executable */
++	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++
++	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
++	end = addr + KERNEL_IMAGE_SIZE;
++	for (; addr < end; addr += PMD_SIZE) {
++		pgd = pgd_offset_k(addr);
++		pud = pud_offset(pgd, addr);
++		pmd = pmd_offset(pud, addr);
++		if (!pmd_present(*pmd))
++			continue;
++		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
++			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
++		else
++			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
++	}
++#endif
++
++	flush_tlb_all();
++#endif
++
+ 	free_init_pages("unused kernel memory",
+ 			(unsigned long)(&__init_begin),
+ 			(unsigned long)(&__init_end));
+diff -urNp linux-2.6.32.14/arch/x86/mm/iomap_32.c linux-2.6.32.14/arch/x86/mm/iomap_32.c
+--- linux-2.6.32.14/arch/x86/mm/iomap_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/iomap_32.c	2010-05-28 21:27:15.114903294 -0400
+@@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
+ 	debug_kmap_atomic(type);
+ 	idx = type + KM_TYPE_NR * smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
++
++	pax_open_kernel();
+ 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
++	pax_close_kernel();
++
+ 	arch_flush_lazy_mmu_mode();
+ 
+ 	return (void *)vaddr;
+diff -urNp linux-2.6.32.14/arch/x86/mm/ioremap.c linux-2.6.32.14/arch/x86/mm/ioremap.c
+--- linux-2.6.32.14/arch/x86/mm/ioremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/ioremap.c	2010-05-28 21:27:15.114903294 -0400
+@@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
+ 	 * Second special case: Some BIOSen report the PC BIOS
+ 	 * area (640->1Mb) as ram even though it is not.
+ 	 */
+-	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
+-		    pagenr < (BIOS_END >> PAGE_SHIFT))
++	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
++		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+ 		return 0;
+ 
+ 	for (i = 0; i < e820.nr_map; i++) {
+@@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
+ 	/*
+ 	 * Don't allow anybody to remap normal RAM that we're using..
+ 	 */
+-	for (pfn = phys_addr >> PAGE_SHIFT;
+-				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
+-				pfn++) {
+-
++	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
+ 		int is_ram = page_is_ram(pfn);
+ 
+-		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
++		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
+ 			return NULL;
+ 		WARN_ON_ONCE(is_ram);
+ 	}
+@@ -407,7 +404,7 @@ static int __init early_ioremap_debug_se
+ early_param("early_ioremap_debug", early_ioremap_debug_setup);
+ 
+ static __initdata int after_paging_init;
+-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
++static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
+ 
+ static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
+ {
+@@ -439,8 +436,7 @@ void __init early_ioremap_init(void)
+ 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
+ 
+ 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
+-	memset(bm_pte, 0, sizeof(bm_pte));
+-	pmd_populate_kernel(&init_mm, pmd, bm_pte);
++	pmd_populate_user(&init_mm, pmd, bm_pte);
+ 
+ 	/*
+ 	 * The boot-ioremap range spans multiple pmds, for which
+diff -urNp linux-2.6.32.14/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.14/arch/x86/mm/kmemcheck/kmemcheck.c
+--- linux-2.6.32.14/arch/x86/mm/kmemcheck/kmemcheck.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/kmemcheck/kmemcheck.c	2010-05-28 21:27:15.114903294 -0400
+@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
+ 	 * memory (e.g. tracked pages)? For now, we need this to avoid
+ 	 * invoking kmemcheck for PnP BIOS calls.
+ 	 */
+-	if (regs->flags & X86_VM_MASK)
++	if (v8086_mode(regs))
+ 		return false;
+-	if (regs->cs != __KERNEL_CS)
++	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
+ 		return false;
+ 
+ 	pte = kmemcheck_pte_lookup(address);
+diff -urNp linux-2.6.32.14/arch/x86/mm/mmap.c linux-2.6.32.14/arch/x86/mm/mmap.c
+--- linux-2.6.32.14/arch/x86/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/mmap.c	2010-05-28 21:27:15.114903294 -0400
+@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
+  * Leave an at least ~128 MB hole with possible stack randomization.
+  */
+ #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
+-#define MAX_GAP (TASK_SIZE/6*5)
++#define MAX_GAP (pax_task_size/6*5)
+ 
+ /*
+  * True on X86_32 or when emulating IA32 on X86_64
+@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
+ 	return rnd << PAGE_SHIFT;
+ }
+ 
+-static unsigned long mmap_base(void)
++static unsigned long mmap_base(struct mm_struct *mm)
+ {
+ 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
++	unsigned long pax_task_size = TASK_SIZE;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
+ 
+ 	if (gap < MIN_GAP)
+ 		gap = MIN_GAP;
+ 	else if (gap > MAX_GAP)
+ 		gap = MAX_GAP;
+ 
+-	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
++	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
+ }
+ 
+ /*
+  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
+  * does, but not when emulating X86_32
+  */
+-static unsigned long mmap_legacy_base(void)
++static unsigned long mmap_legacy_base(struct mm_struct *mm)
+ {
+-	if (mmap_is_ia32())
++	if (mmap_is_ia32()) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (mm->pax_flags & MF_PAX_SEGMEXEC)
++			return SEGMEXEC_TASK_UNMAPPED_BASE;
++		else
++#endif
++
+ 		return TASK_UNMAPPED_BASE;
+-	else
++	} else
+ 		return TASK_UNMAPPED_BASE + mmap_rnd();
+ }
+ 
+@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	if (mmap_is_legacy()) {
+-		mm->mmap_base = mmap_legacy_base();
++		mm->mmap_base = mmap_legacy_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area;
+ 		mm->unmap_area = arch_unmap_area;
+ 	} else {
+-		mm->mmap_base = mmap_base();
++		mm->mmap_base = mmap_base(mm);
++
++#ifdef CONFIG_PAX_RANDMMAP
++		if (mm->pax_flags & MF_PAX_RANDMMAP)
++			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++#endif
++
+ 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ 		mm->unmap_area = arch_unmap_area_topdown;
+ 	}
+diff -urNp linux-2.6.32.14/arch/x86/mm/numa_32.c linux-2.6.32.14/arch/x86/mm/numa_32.c
+--- linux-2.6.32.14/arch/x86/mm/numa_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/numa_32.c	2010-05-28 21:27:15.118897735 -0400
+@@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
+ }
+ #endif
+ 
+-extern unsigned long find_max_low_pfn(void);
+ extern unsigned long highend_pfn, highstart_pfn;
+ 
+ #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
+diff -urNp linux-2.6.32.14/arch/x86/mm/pageattr.c linux-2.6.32.14/arch/x86/mm/pageattr.c
+--- linux-2.6.32.14/arch/x86/mm/pageattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/pageattr.c	2010-05-28 21:27:15.118897735 -0400
+@@ -268,9 +268,10 @@ static inline pgprot_t static_protection
+ 	 * Does not cover __inittext since that is gone later on. On
+ 	 * 64bit we do not enforce !NX on the low mapping
+ 	 */
+-	if (within(address, (unsigned long)_text, (unsigned long)_etext))
++	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
+ 		pgprot_val(forbidden) |= _PAGE_NX;
+ 
++#ifdef CONFIG_DEBUG_RODATA
+ 	/*
+ 	 * The .rodata section needs to be read-only. Using the pfn
+ 	 * catches all aliases.
+@@ -278,6 +279,7 @@ static inline pgprot_t static_protection
+ 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
+ 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
+ 		pgprot_val(forbidden) |= _PAGE_RW;
++#endif
+ 
+ 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
+ 
+@@ -331,7 +333,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
+ static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
+ {
+ 	/* change init_mm */
++	pax_open_kernel();
+ 	set_pte_atomic(kpte, pte);
++	pax_close_kernel();
++
+ #ifdef CONFIG_X86_32
+ 	if (!SHARED_KERNEL_PMD) {
+ 		struct page *page;
+diff -urNp linux-2.6.32.14/arch/x86/mm/pageattr-test.c linux-2.6.32.14/arch/x86/mm/pageattr-test.c
+--- linux-2.6.32.14/arch/x86/mm/pageattr-test.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/pageattr-test.c	2010-05-28 21:27:15.118897735 -0400
+@@ -36,7 +36,7 @@ enum {
+ 
+ static int pte_testbit(pte_t pte)
+ {
+-	return pte_flags(pte) & _PAGE_UNUSED1;
++	return pte_flags(pte) & _PAGE_CPA_TEST;
+ }
+ 
+ struct split_state {
+diff -urNp linux-2.6.32.14/arch/x86/mm/pat.c linux-2.6.32.14/arch/x86/mm/pat.c
+--- linux-2.6.32.14/arch/x86/mm/pat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/pat.c	2010-05-28 21:27:15.118897735 -0400
+@@ -258,7 +258,7 @@ chk_conflict(struct memtype *new, struct
+ 
+  conflict:
+ 	printk(KERN_INFO "%s:%d conflicting memory types "
+-	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
++	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
+ 	       new->end, cattr_name(new->type), cattr_name(entry->type));
+ 	return -EBUSY;
+ }
+@@ -559,7 +559,7 @@ unlock_ret:
+ 
+ 	if (err) {
+ 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
+-			current->comm, current->pid, start, end);
++			current->comm, task_pid_nr(current), start, end);
+ 	}
+ 
+ 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
+@@ -755,7 +755,7 @@ int kernel_map_sync_memtype(u64 base, un
+ 		printk(KERN_INFO
+ 			"%s:%d ioremap_change_attr failed %s "
+ 			"for %Lx-%Lx\n",
+-			current->comm, current->pid,
++			current->comm, task_pid_nr(current),
+ 			cattr_name(flags),
+ 			base, (unsigned long long)(base + size));
+ 		return -EINVAL;
+@@ -813,7 +813,7 @@ static int reserve_pfn_range(u64 paddr, 
+ 			free_memtype(paddr, paddr + size);
+ 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
+ 				" for %Lx-%Lx, got %s\n",
+-				current->comm, current->pid,
++				current->comm, task_pid_nr(current),
+ 				cattr_name(want_flags),
+ 				(unsigned long long)paddr,
+ 				(unsigned long long)(paddr + size),
+diff -urNp linux-2.6.32.14/arch/x86/mm/pgtable_32.c linux-2.6.32.14/arch/x86/mm/pgtable_32.c
+--- linux-2.6.32.14/arch/x86/mm/pgtable_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/pgtable_32.c	2010-05-28 21:27:15.118897735 -0400
+@@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr, 
+ 		return;
+ 	}
+ 	pte = pte_offset_kernel(pmd, vaddr);
++
++	pax_open_kernel();
+ 	if (pte_val(pteval))
+ 		set_pte_at(&init_mm, vaddr, pte, pteval);
+ 	else
+ 		pte_clear(&init_mm, vaddr, pte);
++	pax_close_kernel();
+ 
+ 	/*
+ 	 * It's enough to flush this one mapping.
+diff -urNp linux-2.6.32.14/arch/x86/mm/pgtable.c linux-2.6.32.14/arch/x86/mm/pgtable.c
+--- linux-2.6.32.14/arch/x86/mm/pgtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/pgtable.c	2010-05-28 21:27:15.118897735 -0400
+@@ -63,8 +63,12 @@ void ___pmd_free_tlb(struct mmu_gather *
+ #if PAGETABLE_LEVELS > 3
+ void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
+ {
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
+ 	tlb_remove_page(tlb, virt_to_page(pud));
++#endif
++
+ }
+ #endif	/* PAGETABLE_LEVELS > 3 */
+ #endif	/* PAGETABLE_LEVELS > 2 */
+@@ -83,8 +87,62 @@ static inline void pgd_list_del(pgd_t *p
+ 	list_del(&page->lru);
+ }
+ 
+-#define UNSHARED_PTRS_PER_PGD				\
+-	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++pteval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++	while (count--)
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
++#else
++		*dst++ = *src++;
++#endif
++
++}
++
++void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
++{
++
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	while (count--)
++		*dst++ = __pgd((pgd_val(*src++) | _PAGE_NX) & ~_PAGE_USER);
++#endif
++
++}
++#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++static inline void pgd_ctor(pgd_t *pgd) {}
++static inline void pgd_dtor(pgd_t *pgd) {}
++#ifdef CONFIG_X86_64
++#define pxd_t				pud_t
++#define pyd_t				pgd_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
++#define pxd_free(mm, pud)		pud_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
++#define PYD_SIZE			PGDIR_SIZE
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pud)		pmd_free((mm), (pud))
++#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
++#endif
++#else
++#define pxd_t				pmd_t
++#define pyd_t				pud_t
++#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
++#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
++#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
++#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define PYD_SIZE			PUD_SIZE
+ 
+ static void pgd_ctor(pgd_t *pgd)
+ {
+@@ -119,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
+ 	pgd_list_del(pgd);
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ }
++#endif
+ 
+ /*
+  * List of all pgd's needed for non-PAE so it can invalidate entries
+@@ -131,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * -- wli
+  */
+ 
+-#ifdef CONFIG_X86_PAE
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ /*
+  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
+  * updating the top-level pagetable entries to guarantee the
+@@ -143,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
+  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
+  * and initialize the kernel pmds here.
+  */
+-#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
++#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+ 
+ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
+ {
+@@ -162,36 +221,38 @@ void pud_populate(struct mm_struct *mm, 
+ 	if (mm == current->active_mm)
+ 		write_cr3(read_cr3());
+ }
++#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
++#define PREALLOCATED_PXDS	USER_PGD_PTRS
+ #else  /* !CONFIG_X86_PAE */
+ 
+ /* No need to prepopulate any pagetable entries in non-PAE modes. */
+-#define PREALLOCATED_PMDS	0
++#define PREALLOCATED_PXDS	0
+ 
+ #endif	/* CONFIG_X86_PAE */
+ 
+-static void free_pmds(pmd_t *pmds[])
++static void free_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++)
+-		if (pmds[i])
+-			free_page((unsigned long)pmds[i]);
++	for(i = 0; i < PREALLOCATED_PXDS; i++)
++		if (pxds[i])
++			free_page((unsigned long)pxds[i]);
+ }
+ 
+-static int preallocate_pmds(pmd_t *pmds[])
++static int preallocate_pxds(pxd_t *pxds[])
+ {
+ 	int i;
+ 	bool failed = false;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
+-		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
+-		if (pmd == NULL)
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
++		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
++		if (pxd == NULL)
+ 			failed = true;
+-		pmds[i] = pmd;
++		pxds[i] = pxd;
+ 	}
+ 
+ 	if (failed) {
+-		free_pmds(pmds);
++		free_pxds(pxds);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -204,51 +265,56 @@ static int preallocate_pmds(pmd_t *pmds[
+  * preallocate which never got a corresponding vma will need to be
+  * freed manually.
+  */
+-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
++static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
+ {
+ 	int i;
+ 
+-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
++	for(i = 0; i < PREALLOCATED_PXDS; i++) {
+ 		pgd_t pgd = pgdp[i];
+ 
+ 		if (pgd_val(pgd) != 0) {
+-			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
++			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
+ 
+-			pgdp[i] = native_make_pgd(0);
++			set_pgd(pgdp + i, native_make_pgd(0));
+ 
+-			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
+-			pmd_free(mm, pmd);
++			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
++			pxd_free(mm, pxd);
+ 		}
+ 	}
+ }
+ 
+-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
++static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
+ {
+-	pud_t *pud;
++	pyd_t *pyd;
+ 	unsigned long addr;
+ 	int i;
+ 
+-	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
++	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
+ 		return;
+ 
+-	pud = pud_offset(pgd, 0);
++#ifdef CONFIG_X86_64
++	pyd = pyd_offset(mm, 0L);
++#else
++	pyd = pyd_offset(pgd, 0L);
++#endif
+ 
+- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
+-	     i++, pud++, addr += PUD_SIZE) {
+-		pmd_t *pmd = pmds[i];
++ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
++	     i++, pyd++, addr += PYD_SIZE) {
++		pxd_t *pxd = pxds[i];
+ 
+ 		if (i >= KERNEL_PGD_BOUNDARY)
+-			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
+-			       sizeof(pmd_t) * PTRS_PER_PMD);
++			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
++			       sizeof(pxd_t) * PTRS_PER_PMD);
+ 
+-		pud_populate(mm, pud, pmd);
++		pyd_populate(mm, pyd, pxd);
+ 	}
+ }
+ 
+ pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+ 	pgd_t *pgd;
+-	pmd_t *pmds[PREALLOCATED_PMDS];
++	pxd_t *pxds[PREALLOCATED_PXDS];
++
+ 	unsigned long flags;
+ 
+ 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
+@@ -258,11 +324,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 
+ 	mm->pgd = pgd;
+ 
+-	if (preallocate_pmds(pmds) != 0)
++	if (preallocate_pxds(pxds) != 0)
+ 		goto out_free_pgd;
+ 
+ 	if (paravirt_pgd_alloc(mm) != 0)
+-		goto out_free_pmds;
++		goto out_free_pxds;
+ 
+ 	/*
+ 	 * Make sure that pre-populating the pmds is atomic with
+@@ -272,14 +338,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ 	spin_lock_irqsave(&pgd_lock, flags);
+ 
+ 	pgd_ctor(pgd);
+-	pgd_prepopulate_pmd(mm, pgd, pmds);
++	pgd_prepopulate_pxd(mm, pgd, pxds);
+ 
+ 	spin_unlock_irqrestore(&pgd_lock, flags);
+ 
+ 	return pgd;
+ 
+-out_free_pmds:
+-	free_pmds(pmds);
++out_free_pxds:
++	free_pxds(pxds);
+ out_free_pgd:
+ 	free_page((unsigned long)pgd);
+ out:
+@@ -288,7 +354,7 @@ out:
+ 
+ void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ {
+-	pgd_mop_up_pmds(mm, pgd);
++	pgd_mop_up_pxds(mm, pgd);
+ 	pgd_dtor(pgd);
+ 	paravirt_pgd_free(mm, pgd);
+ 	free_page((unsigned long)pgd);
+diff -urNp linux-2.6.32.14/arch/x86/mm/setup_nx.c linux-2.6.32.14/arch/x86/mm/setup_nx.c
+--- linux-2.6.32.14/arch/x86/mm/setup_nx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/setup_nx.c	2010-05-28 21:27:15.118897735 -0400
+@@ -4,11 +4,10 @@
+ 
+ #include <asm/pgtable.h>
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
+ int nx_enabled;
+ 
+-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+-static int disable_nx __cpuinitdata;
+-
++#ifndef CONFIG_PAX_PAGEEXEC
+ /*
+  * noexec = on|off
+  *
+@@ -22,32 +21,26 @@ static int __init noexec_setup(char *str
+ 	if (!str)
+ 		return -EINVAL;
+ 	if (!strncmp(str, "on", 2)) {
+-		__supported_pte_mask |= _PAGE_NX;
+-		disable_nx = 0;
++		nx_enabled = 1;
+ 	} else if (!strncmp(str, "off", 3)) {
+-		disable_nx = 1;
+-		__supported_pte_mask &= ~_PAGE_NX;
++		nx_enabled = 0;
+ 	}
+ 	return 0;
+ }
+ early_param("noexec", noexec_setup);
+ #endif
++#endif
+ 
+ #ifdef CONFIG_X86_PAE
+ void __init set_nx(void)
+ {
+-	unsigned int v[4], l, h;
++	if (!nx_enabled && cpu_has_nx) {
++		unsigned l, h;
+ 
+-	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
+-		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
+-
+-		if ((v[3] & (1 << 20)) && !disable_nx) {
+-			rdmsr(MSR_EFER, l, h);
+-			l |= EFER_NX;
+-			wrmsr(MSR_EFER, l, h);
+-			nx_enabled = 1;
+-			__supported_pte_mask |= _PAGE_NX;
+-		}
++		__supported_pte_mask &= ~_PAGE_NX;
++		rdmsr(MSR_EFER, l, h);
++		l &= ~EFER_NX;
++		wrmsr(MSR_EFER, l, h);
+ 	}
+ }
+ #else
+@@ -62,7 +55,7 @@ void __cpuinit check_efer(void)
+ 	unsigned long efer;
+ 
+ 	rdmsrl(MSR_EFER, efer);
+-	if (!(efer & EFER_NX) || disable_nx)
++	if (!(efer & EFER_NX) || !nx_enabled)
+ 		__supported_pte_mask &= ~_PAGE_NX;
+ }
+ #endif
+diff -urNp linux-2.6.32.14/arch/x86/mm/tlb.c linux-2.6.32.14/arch/x86/mm/tlb.c
+--- linux-2.6.32.14/arch/x86/mm/tlb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/mm/tlb.c	2010-05-28 21:27:15.118897735 -0400
+@@ -12,7 +12,7 @@
+ #include <asm/uv/uv.h>
+ 
+ DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
+-			= { &init_mm, 0, };
++			= { &init_mm, 0 };
+ 
+ /*
+  *	Smarter SMP flushing macros.
+@@ -61,7 +61,11 @@ void leave_mm(int cpu)
+ 		BUG();
+ 	cpumask_clear_cpu(cpu,
+ 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
++
++#ifndef CONFIG_PAX_PER_CPU_PGD
+ 	load_cr3(swapper_pg_dir);
++#endif
++
+ }
+ EXPORT_SYMBOL_GPL(leave_mm);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/oprofile/backtrace.c linux-2.6.32.14/arch/x86/oprofile/backtrace.c
+--- linux-2.6.32.14/arch/x86/oprofile/backtrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/oprofile/backtrace.c	2010-05-28 21:27:15.118897735 -0400
+@@ -57,7 +57,7 @@ static struct frame_head *dump_user_back
+ 	struct frame_head bufhead[2];
+ 
+ 	/* Also check accessibility of one struct frame_head beyond */
+-	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
++	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
+ 		return NULL;
+ 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
+ 		return NULL;
+@@ -77,7 +77,7 @@ x86_backtrace(struct pt_regs * const reg
+ {
+ 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
+ 
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		unsigned long stack = kernel_stack_pointer(regs);
+ 		if (depth)
+ 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
+diff -urNp linux-2.6.32.14/arch/x86/oprofile/op_model_p4.c linux-2.6.32.14/arch/x86/oprofile/op_model_p4.c
+--- linux-2.6.32.14/arch/x86/oprofile/op_model_p4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/oprofile/op_model_p4.c	2010-05-28 21:27:15.118897735 -0400
+@@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
+ #endif
+ }
+ 
+-static int inline addr_increment(void)
++static inline int addr_increment(void)
+ {
+ #ifdef CONFIG_SMP
+ 	return smp_num_siblings == 2 ? 2 : 1;
+diff -urNp linux-2.6.32.14/arch/x86/pci/common.c linux-2.6.32.14/arch/x86/pci/common.c
+--- linux-2.6.32.14/arch/x86/pci/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/common.c	2010-05-28 21:27:15.118897735 -0400
+@@ -31,8 +31,8 @@ int noioapicreroute = 1;
+ int pcibios_last_bus = -1;
+ unsigned long pirq_table_addr;
+ struct pci_bus *pci_root_bus;
+-struct pci_raw_ops *raw_pci_ops;
+-struct pci_raw_ops *raw_pci_ext_ops;
++const struct pci_raw_ops *raw_pci_ops;
++const struct pci_raw_ops *raw_pci_ext_ops;
+ 
+ int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val)
+@@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ void __init dmi_check_pciprobe(void)
+diff -urNp linux-2.6.32.14/arch/x86/pci/direct.c linux-2.6.32.14/arch/x86/pci/direct.c
+--- linux-2.6.32.14/arch/x86/pci/direct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/direct.c	2010-05-28 21:27:15.118897735 -0400
+@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
+ 
+ #undef PCI_CONF1_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf1 = {
++const struct pci_raw_ops pci_direct_conf1 = {
+ 	.read =		pci_conf1_read,
+ 	.write =	pci_conf1_write,
+ };
+@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int 
+ 
+ #undef PCI_CONF2_ADDRESS
+ 
+-struct pci_raw_ops pci_direct_conf2 = {
++const struct pci_raw_ops pci_direct_conf2 = {
+ 	.read =		pci_conf2_read,
+ 	.write =	pci_conf2_write,
+ };
+@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
+  * This should be close to trivial, but it isn't, because there are buggy
+  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
+  */
+-static int __init pci_sanity_check(struct pci_raw_ops *o)
++static int __init pci_sanity_check(const struct pci_raw_ops *o)
+ {
+ 	u32 x = 0;
+ 	int year, devfn;
+diff -urNp linux-2.6.32.14/arch/x86/pci/fixup.c linux-2.6.32.14/arch/x86/pci/fixup.c
+--- linux-2.6.32.14/arch/x86/pci/fixup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/fixup.c	2010-05-28 21:27:15.118897735 -0400
+@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
+ 		},
+ 	},
+-	{}
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
+diff -urNp linux-2.6.32.14/arch/x86/pci/irq.c linux-2.6.32.14/arch/x86/pci/irq.c
+--- linux-2.6.32.14/arch/x86/pci/irq.c	2010-04-29 17:49:37.625451376 -0400
++++ linux-2.6.32.14/arch/x86/pci/irq.c	2010-05-28 21:27:15.118897735 -0400
+@@ -543,7 +543,7 @@ static __init int intel_router_probe(str
+ 	static struct pci_device_id __initdata pirq_440gx[] = {
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
+ 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
+-		{ },
++		{ PCI_DEVICE(0, 0) }
+ 	};
+ 
+ 	/* 440GX has a proprietary PIRQ router -- don't use it */
+@@ -1109,7 +1109,7 @@ static struct dmi_system_id __initdata p
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ int __init pcibios_irq_init(void)
+diff -urNp linux-2.6.32.14/arch/x86/pci/mmconfig_32.c linux-2.6.32.14/arch/x86/pci/mmconfig_32.c
+--- linux-2.6.32.14/arch/x86/pci/mmconfig_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/mmconfig_32.c	2010-05-28 21:27:15.118897735 -0400
+@@ -125,7 +125,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.14/arch/x86/pci/mmconfig_64.c linux-2.6.32.14/arch/x86/pci/mmconfig_64.c
+--- linux-2.6.32.14/arch/x86/pci/mmconfig_64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/mmconfig_64.c	2010-05-28 21:27:15.118897735 -0400
+@@ -104,7 +104,7 @@ static int pci_mmcfg_write(unsigned int 
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_mmcfg = {
++static const struct pci_raw_ops pci_mmcfg = {
+ 	.read =		pci_mmcfg_read,
+ 	.write =	pci_mmcfg_write,
+ };
+diff -urNp linux-2.6.32.14/arch/x86/pci/numaq_32.c linux-2.6.32.14/arch/x86/pci/numaq_32.c
+--- linux-2.6.32.14/arch/x86/pci/numaq_32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/numaq_32.c	2010-05-28 21:27:15.118897735 -0400
+@@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
+ 
+ #undef PCI_CONF1_MQ_ADDRESS
+ 
+-static struct pci_raw_ops pci_direct_conf1_mq = {
++static const struct pci_raw_ops pci_direct_conf1_mq = {
+ 	.read	= pci_conf1_mq_read,
+ 	.write	= pci_conf1_mq_write
+ };
+diff -urNp linux-2.6.32.14/arch/x86/pci/olpc.c linux-2.6.32.14/arch/x86/pci/olpc.c
+--- linux-2.6.32.14/arch/x86/pci/olpc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/olpc.c	2010-05-28 21:27:15.118897735 -0400
+@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
+ 	return 0;
+ }
+ 
+-static struct pci_raw_ops pci_olpc_conf = {
++static const struct pci_raw_ops pci_olpc_conf = {
+ 	.read =	pci_olpc_read,
+ 	.write = pci_olpc_write,
+ };
+diff -urNp linux-2.6.32.14/arch/x86/pci/pcbios.c linux-2.6.32.14/arch/x86/pci/pcbios.c
+--- linux-2.6.32.14/arch/x86/pci/pcbios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/pci/pcbios.c	2010-05-28 21:27:15.135148926 -0400
+@@ -56,50 +56,93 @@ union bios32 {
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} bios32_indirect = { 0, __KERNEL_CS };
++} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+ /*
+  * Returns the entry point for the given service, NULL on error
+  */
+ 
+-static unsigned long bios32_service(unsigned long service)
++static unsigned long __devinit bios32_service(unsigned long service)
+ {
+ 	unsigned char return_code;	/* %al */
+ 	unsigned long address;		/* %ebx */
+ 	unsigned long length;		/* %ecx */
+ 	unsigned long entry;		/* %edx */
+ 	unsigned long flags;
++	struct desc_struct d, *gdt;
+ 
+ 	local_irq_save(flags);
+-	__asm__("lcall *(%%edi); cld"
++
++	gdt = get_cpu_gdt_table(smp_processor_id());
++
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
++	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++
++	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
+ 		: "=a" (return_code),
+ 		  "=b" (address),
+ 		  "=c" (length),
+ 		  "=d" (entry)
+ 		: "0" (service),
+ 		  "1" (0),
+-		  "D" (&bios32_indirect));
++		  "D" (&bios32_indirect),
++		  "r"(__PCIBIOS_DS)
++		: "memory");
++
++	pax_open_kernel();
++	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
++	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
++	pax_close_kernel();
++
+ 	local_irq_restore(flags);
+ 
+ 	switch (return_code) {
+-		case 0:
+-			return address + entry;
+-		case 0x80:	/* Not present */
+-			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
+-			return 0;
+-		default: /* Shouldn't happen */
+-			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
+-				service, return_code);
++	case 0: {
++		int cpu;
++		unsigned char flags;
++
++		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
++		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
++			printk(KERN_WARNING "bios32_service: not valid\n");
+ 			return 0;
++		}
++		address = address + PAGE_OFFSET;
++		length += 16UL; /* some BIOSs underreport this... */
++		flags = 4;
++		if (length >= 64*1024*1024) {
++			length >>= PAGE_SHIFT;
++			flags |= 8;
++		}
++
++		for (cpu = 0; cpu < NR_CPUS; cpu++) {
++			gdt = get_cpu_gdt_table(cpu);
++			pack_descriptor(&d, address, length, 0x9b, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
++			pack_descriptor(&d, address, length, 0x93, flags);
++			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
++		}
++		return entry;
++	}
++	case 0x80:	/* Not present */
++		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
++		return 0;
++	default: /* Shouldn't happen */
++		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
++			service, return_code);
++		return 0;
+ 	}
+ }
+ 
+ static struct {
+ 	unsigned long address;
+ 	unsigned short segment;
+-} pci_indirect = { 0, __KERNEL_CS };
++} pci_indirect __read_only = { 0, __PCIBIOS_CS };
+ 
+-static int pci_bios_present;
++static int pci_bios_present __read_only;
+ 
+ static int __devinit check_pcibios(void)
+ {
+@@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
+ 	unsigned long flags, pcibios_entry;
+ 
+ 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
+-		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
++		pci_indirect.address = pcibios_entry;
+ 
+ 		local_irq_save(flags);
+-		__asm__(
+-			"lcall *(%%edi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%edi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
+ 			  "=b" (ebx),
+ 			  "=c" (ecx)
+ 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
+-			  "D" (&pci_indirect)
++			  "D" (&pci_indirect),
++			  "r" (__PCIBIOS_DS)
+ 			: "memory");
+ 		local_irq_restore(flags);
+ 
+@@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 8 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xff;
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_WORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		/*
+ 		 * Zero-extend the result beyond 16 bits, do not trust the
+ 		 * BIOS having done it:
+@@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
+ 		*value &= 0xffff;
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
+ 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
+ 
+ 	switch (len) {
+ 	case 1:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 2:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	case 4:
+-		__asm__("lcall *(%%esi); cld\n\t"
++		__asm__("movw %w6, %%ds\n\t"
++			"lcall *%%ss:(%%esi); cld\n\t"
++			"push %%ss\n\t"
++			"pop %%ds\n\t"
+ 			"jc 1f\n\t"
+ 			"xor %%ah, %%ah\n"
+ 			"1:"
+@@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
+ 			  "c" (value),
+ 			  "b" (bx),
+ 			  "D" ((long)reg),
+-			  "S" (&pci_indirect));
++			  "S" (&pci_indirect),
++			  "r" (__PCIBIOS_DS));
+ 		break;
+ 	}
+ 
+@@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
+  * Function table for BIOS32 access
+  */
+ 
+-static struct pci_raw_ops pci_bios_access = {
++static const struct pci_raw_ops pci_bios_access = {
+ 	.read =		pci_bios_read,
+ 	.write =	pci_bios_write
+ };
+@@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
+  * Try to find PCI BIOS.
+  */
+ 
+-static struct pci_raw_ops * __devinit pci_find_bios(void)
++static const struct pci_raw_ops * __devinit pci_find_bios(void)
+ {
+ 	union bios32 *check;
+ 	unsigned char sum;
+@@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
+ 
+ 	DBG("PCI: Fetching IRQ routing table... ");
+ 	__asm__("push %%es\n\t"
++		"movw %w8, %%ds\n\t"
+ 		"push %%ds\n\t"
+ 		"pop  %%es\n\t"
+-		"lcall *(%%esi); cld\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
+ 		"pop %%es\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
+ 		  "1" (0),
+ 		  "D" ((long) &opt),
+ 		  "S" (&pci_indirect),
+-		  "m" (opt)
++		  "m" (opt),
++		  "r" (__PCIBIOS_DS)
+ 		: "memory");
+ 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
+ 	if (ret & 0xff00)
+@@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
+ {
+ 	int ret;
+ 
+-	__asm__("lcall *(%%esi); cld\n\t"
++	__asm__("movw %w5, %%ds\n\t"
++		"lcall *%%ss:(%%esi); cld\n\t"
++		"push %%ss\n\t"
++		"pop %%ds\n"
+ 		"jc 1f\n\t"
+ 		"xor %%ah, %%ah\n"
+ 		"1:"
+@@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
+ 		: "0" (PCIBIOS_SET_PCI_HW_INT),
+ 		  "b" ((dev->bus->number << 8) | dev->devfn),
+ 		  "c" ((irq << 8) | (pin + 10)),
+-		  "S" (&pci_indirect));
++		  "S" (&pci_indirect),
++		  "r" (__PCIBIOS_DS));
+ 	return !(ret & 0xff00);
+ }
+ EXPORT_SYMBOL(pcibios_set_irq_routing);
+diff -urNp linux-2.6.32.14/arch/x86/power/cpu.c linux-2.6.32.14/arch/x86/power/cpu.c
+--- linux-2.6.32.14/arch/x86/power/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/power/cpu.c	2010-05-28 21:27:15.135148926 -0400
+@@ -126,7 +126,7 @@ static void do_fpu_end(void)
+ static void fix_processor_context(void)
+ {
+ 	int cpu = smp_processor_id();
+-	struct tss_struct *t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 
+ 	set_tss_desc(cpu, t);	/*
+ 				 * This just modifies memory; should not be
+@@ -136,7 +136,9 @@ static void fix_processor_context(void)
+ 				 */
+ 
+ #ifdef CONFIG_X86_64
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
++	pax_close_kernel();
+ 
+ 	syscall_init();				/* This sets MSR_*STAR and related */
+ #endif
+diff -urNp linux-2.6.32.14/arch/x86/vdso/Makefile linux-2.6.32.14/arch/x86/vdso/Makefile
+--- linux-2.6.32.14/arch/x86/vdso/Makefile	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/Makefile	2010-05-28 21:27:15.135148926 -0400
+@@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
+ 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
+ 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
+ 
+-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+ GCOV_PROFILE := n
+ 
+ #
+diff -urNp linux-2.6.32.14/arch/x86/vdso/vclock_gettime.c linux-2.6.32.14/arch/x86/vdso/vclock_gettime.c
+--- linux-2.6.32.14/arch/x86/vdso/vclock_gettime.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/vclock_gettime.c	2010-05-28 21:27:15.151704467 -0400
+@@ -22,24 +22,48 @@
+ #include <asm/hpet.h>
+ #include <asm/unistd.h>
+ #include <asm/io.h>
++#include <asm/fixmap.h>
+ #include "vextern.h"
+ 
+ #define gtod vdso_vsyscall_gtod_data
+ 
++notrace noinline long __vdso_fallback_time(long *t)
++{
++	long secs;
++	asm volatile("syscall"
++		: "=a" (secs)
++		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
++	return secs;
++}
++
+ notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+ {
+ 	long ret;
+ 	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
++	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
+ 	return ret;
+ }
+ 
++notrace static inline cycle_t __vdso_vread_hpet(void)
++{
++	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
++}
++
++notrace static inline cycle_t __vdso_vread_tsc(void)
++{
++	cycle_t ret = (cycle_t)vget_cycles();
++
++	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
++}
++
+ notrace static inline long vgetns(void)
+ {
+ 	long v;
+-	cycles_t (*vread)(void);
+-	vread = gtod->clock.vread;
+-	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
++	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
++		v = __vdso_vread_tsc();
++	else
++		v = __vdso_vread_hpet();
++	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
+ 	return (v * gtod->clock.mult) >> gtod->clock.shift;
+ }
+ 
+@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
+ 
+ notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
+ {
+-	if (likely(gtod->sysctl_enabled))
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
+ 		switch (clock) {
+ 		case CLOCK_REALTIME:
+ 			if (likely(gtod->clock.vread))
+@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
+ int clock_gettime(clockid_t, struct timespec *)
+ 	__attribute__((weak, alias("__vdso_clock_gettime")));
+ 
+-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
+ {
+ 	long ret;
+-	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
++	asm("syscall" : "=a" (ret) :
++	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
++	return ret;
++}
++
++notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
++{
++	if (likely(gtod->sysctl_enabled &&
++		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
++		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
++	{
+ 		if (likely(tv != NULL)) {
+ 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
+ 				     offsetof(struct timespec, tv_nsec) ||
+@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
+ 		}
+ 		return 0;
+ 	}
+-	asm("syscall" : "=a" (ret) :
+-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
+-	return ret;
++	return __vdso_fallback_gettimeofday(tv, tz);
+ }
+ int gettimeofday(struct timeval *, struct timezone *)
+ 	__attribute__((weak, alias("__vdso_gettimeofday")));
+diff -urNp linux-2.6.32.14/arch/x86/vdso/vdso32-setup.c linux-2.6.32.14/arch/x86/vdso/vdso32-setup.c
+--- linux-2.6.32.14/arch/x86/vdso/vdso32-setup.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/vdso32-setup.c	2010-05-28 21:27:15.151704467 -0400
+@@ -25,6 +25,7 @@
+ #include <asm/tlbflush.h>
+ #include <asm/vdso.h>
+ #include <asm/proto.h>
++#include <asm/mman.h>
+ 
+ enum {
+ 	VDSO_DISABLED = 0,
+@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
+ void enable_sep_cpu(void)
+ {
+ 	int cpu = get_cpu();
+-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
++	struct tss_struct *tss = init_tss + cpu;
+ 
+ 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
+ 		put_cpu();
+@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
+ 	if (compat)
+ 		addr = VDSO_HIGH_BASE;
+ 	else {
+-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
++		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
+ 		if (IS_ERR_VALUE(addr)) {
+ 			ret = addr;
+ 			goto up_fail;
+ 		}
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	if (compat_uses_vma || !compat) {
+ 		/*
+@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
+ 	}
+ 
+ 	current_thread_info()->sysenter_return =
+-		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
++		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
+ 
+   up_fail:
+ 	if (ret)
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 
+ 	up_write(&mm->mmap_sem);
+ 
+@@ -388,7 +389,7 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static ctl_table abi_root_table2[] = {
+@@ -398,7 +399,7 @@ static ctl_table abi_root_table2[] = {
+ 		.mode = 0555,
+ 		.child = abi_table2
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static __init int ia32_binfmt_init(void)
+@@ -413,8 +414,14 @@ __initcall(ia32_binfmt_init);
+ 
+ const char *arch_vma_name(struct vm_area_struct *vma)
+ {
+-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
++	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
+ 		return "[vdso]";
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
++		return "[vdso]";
++#endif
++
+ 	return NULL;
+ }
+ 
+@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
+ 	struct mm_struct *mm = tsk->mm;
+ 
+ 	/* Check to see if this task was created in compat vdso mode */
+-	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
++	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
+ 		return &gate_vma;
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.14/arch/x86/vdso/vdso.lds.S linux-2.6.32.14/arch/x86/vdso/vdso.lds.S
+--- linux-2.6.32.14/arch/x86/vdso/vdso.lds.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/vdso.lds.S	2010-05-28 21:27:15.151704467 -0400
+@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
+ #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
+ #include "vextern.h"
+ #undef	VEXTERN
++
++#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
++VEXTERN(fallback_gettimeofday)
++VEXTERN(fallback_time)
++VEXTERN(getcpu)
++#undef	VEXTERN
+diff -urNp linux-2.6.32.14/arch/x86/vdso/vextern.h linux-2.6.32.14/arch/x86/vdso/vextern.h
+--- linux-2.6.32.14/arch/x86/vdso/vextern.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/vextern.h	2010-05-28 21:27:15.151704467 -0400
+@@ -11,6 +11,5 @@
+    put into vextern.h and be referenced as a pointer with vdso prefix.
+    The main kernel later fills in the values.   */
+ 
+-VEXTERN(jiffies)
+ VEXTERN(vgetcpu_mode)
+ VEXTERN(vsyscall_gtod_data)
+diff -urNp linux-2.6.32.14/arch/x86/vdso/vma.c linux-2.6.32.14/arch/x86/vdso/vma.c
+--- linux-2.6.32.14/arch/x86/vdso/vma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/vdso/vma.c	2010-05-28 21:27:15.151704467 -0400
+@@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
+ 	if (!vbase)
+ 		goto oom;
+ 
+-	if (memcmp(vbase, "\177ELF", 4)) {
++	if (memcmp(vbase, ELFMAG, SELFMAG)) {
+ 		printk("VDSO: I'm broken; not ELF\n");
+ 		vdso_enabled = 0;
+ 	}
+@@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
+ 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
+ #include "vextern.h"
+ #undef VEXTERN
++	vunmap(vbase);
+ 	return 0;
+ 
+  oom:
+@@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
+ 		goto up_fail;
+ 	}
+ 
+-	current->mm->context.vdso = (void *)addr;
++	current->mm->context.vdso = addr;
+ 
+ 	ret = install_special_mapping(mm, addr, vdso_size,
+ 				      VM_READ|VM_EXEC|
+@@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
+ 				      VM_ALWAYSDUMP,
+ 				      vdso_pages);
+ 	if (ret) {
+-		current->mm->context.vdso = NULL;
++		current->mm->context.vdso = 0;
+ 		goto up_fail;
+ 	}
+ 
+@@ -132,10 +133,3 @@ up_fail:
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+-
+-static __init int vdso_setup(char *s)
+-{
+-	vdso_enabled = simple_strtoul(s, NULL, 0);
+-	return 0;
+-}
+-__setup("vdso=", vdso_setup);
+diff -urNp linux-2.6.32.14/arch/x86/xen/enlighten.c linux-2.6.32.14/arch/x86/xen/enlighten.c
+--- linux-2.6.32.14/arch/x86/xen/enlighten.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/xen/enlighten.c	2010-05-29 16:33:34.251291763 -0400
+@@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
+ 
+ struct shared_info xen_dummy_shared_info;
+ 
+-void *xen_initial_gdt;
+-
+ /*
+  * Point at some empty memory to start with. We map the real shared_info
+  * page as soon as fixmap is up and running.
+@@ -548,7 +546,7 @@ static void xen_write_idt_entry(gate_des
+ 
+ 	preempt_disable();
+ 
+-	start = __get_cpu_var(idt_desc).address;
++	start = (unsigned long)__get_cpu_var(idt_desc).address;
+ 	end = start + __get_cpu_var(idt_desc).size + 1;
+ 
+ 	xen_mc_flush();
+@@ -1099,9 +1097,20 @@ asmlinkage void __init xen_start_kernel(
+ 	 */
+ 	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
+ 
+-#ifdef CONFIG_X86_64
+ 	/* Work out if we support NX */
+-	check_efer();
++#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
++	if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
++	    (cpuid_edx(0x80000001) & (1 << (X86_FEATURE_NX & 31)))) {
++		unsigned l, h;
++
++#if defined(CONFIG_X86_32)
++		nx_enabled = 1;
++#endif
++		__supported_pte_mask |= _PAGE_NX;
++		rdmsr(MSR_EFER, l, h);
++		l |= EFER_NX;
++		wrmsr(MSR_EFER, l, h);
++	}
+ #endif
+ 
+ 	xen_setup_features();
+@@ -1133,13 +1142,6 @@ asmlinkage void __init xen_start_kernel(
+ 
+ 	machine_ops = xen_machine_ops;
+ 
+-	/*
+-	 * The only reliable way to retain the initial address of the
+-	 * percpu gdt_page is to remember it here, so we can go and
+-	 * mark it RW later, when the initial percpu area is freed.
+-	 */
+-	xen_initial_gdt = &per_cpu(gdt_page, 0);
+-
+ 	xen_smp_init();
+ 
+ 	pgd = (pgd_t *)xen_start_info->pt_base;
+diff -urNp linux-2.6.32.14/arch/x86/xen/mmu.c linux-2.6.32.14/arch/x86/xen/mmu.c
+--- linux-2.6.32.14/arch/x86/xen/mmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/xen/mmu.c	2010-05-28 21:27:15.151704467 -0400
+@@ -1711,6 +1711,8 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	convert_pfn_mfn(init_level4_pgt);
+ 	convert_pfn_mfn(level3_ident_pgt);
+ 	convert_pfn_mfn(level3_kernel_pgt);
++	convert_pfn_mfn(level3_vmalloc_pgt);
++	convert_pfn_mfn(level3_vmemmap_pgt);
+ 
+ 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+ 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+@@ -1729,7 +1731,10 @@ __init pgd_t *xen_setup_kernel_pagetable
+ 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
++	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
++	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+ 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+ 
+diff -urNp linux-2.6.32.14/arch/x86/xen/smp.c linux-2.6.32.14/arch/x86/xen/smp.c
+--- linux-2.6.32.14/arch/x86/xen/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/xen/smp.c	2010-05-28 21:27:15.155009648 -0400
+@@ -167,11 +167,6 @@ static void __init xen_smp_prepare_boot_
+ {
+ 	BUG_ON(smp_processor_id() != 0);
+ 	native_smp_prepare_boot_cpu();
+-
+-	/* We've switched to the "real" per-cpu gdt, so make sure the
+-	   old memory can be recycled */
+-	make_lowmem_page_readwrite(xen_initial_gdt);
+-
+ 	xen_setup_vcpu_info_placement();
+ }
+ 
+@@ -231,8 +226,8 @@ cpu_initialize_context(unsigned int cpu,
+ 	gdt = get_cpu_gdt_table(cpu);
+ 
+ 	ctxt->flags = VGCF_IN_KERNEL;
+-	ctxt->user_regs.ds = __USER_DS;
+-	ctxt->user_regs.es = __USER_DS;
++	ctxt->user_regs.ds = __KERNEL_DS;
++	ctxt->user_regs.es = __KERNEL_DS;
+ 	ctxt->user_regs.ss = __KERNEL_DS;
+ #ifdef CONFIG_X86_32
+ 	ctxt->user_regs.fs = __KERNEL_PERCPU;
+diff -urNp linux-2.6.32.14/arch/x86/xen/xen-head.S linux-2.6.32.14/arch/x86/xen/xen-head.S
+--- linux-2.6.32.14/arch/x86/xen/xen-head.S	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/xen/xen-head.S	2010-05-28 21:27:15.155009648 -0400
+@@ -19,6 +19,17 @@ ENTRY(startup_xen)
+ #ifdef CONFIG_X86_32
+ 	mov %esi,xen_start_info
+ 	mov $init_thread_union+THREAD_SIZE,%esp
++#ifdef CONFIG_SMP
++	movl $cpu_gdt_table,%edi
++	movl $__per_cpu_load,%eax
++	movw %ax,__KERNEL_PERCPU + 2(%edi)
++	rorl $16,%eax
++	movb %al,__KERNEL_PERCPU + 4(%edi)
++	movb %ah,__KERNEL_PERCPU + 7(%edi)
++	movl $__per_cpu_end - 1,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,__KERNEL_PERCPU + 0(%edi)
++#endif
+ #else
+ 	mov %rsi,xen_start_info
+ 	mov $init_thread_union+THREAD_SIZE,%rsp
+diff -urNp linux-2.6.32.14/arch/x86/xen/xen-ops.h linux-2.6.32.14/arch/x86/xen/xen-ops.h
+--- linux-2.6.32.14/arch/x86/xen/xen-ops.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/arch/x86/xen/xen-ops.h	2010-05-28 21:27:15.155009648 -0400
+@@ -10,8 +10,6 @@
+ extern const char xen_hypervisor_callback[];
+ extern const char xen_failsafe_callback[];
+ 
+-extern void *xen_initial_gdt;
+-
+ struct trap_info;
+ void xen_copy_trap_info(struct trap_info *traps);
+ 
+diff -urNp linux-2.6.32.14/block/blk-integrity.c linux-2.6.32.14/block/blk-integrity.c
+--- linux-2.6.32.14/block/blk-integrity.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/blk-integrity.c	2010-05-28 21:27:15.167161810 -0400
+@@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops integrity_ops = {
++static const struct sysfs_ops integrity_ops = {
+ 	.show	= &integrity_attr_show,
+ 	.store	= &integrity_attr_store,
+ };
+diff -urNp linux-2.6.32.14/block/blk-iopoll.c linux-2.6.32.14/block/blk-iopoll.c
+--- linux-2.6.32.14/block/blk-iopoll.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/blk-iopoll.c	2010-05-28 21:27:15.167161810 -0400
+@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
+ }
+ EXPORT_SYMBOL(blk_iopoll_complete);
+ 
+-static void blk_iopoll_softirq(struct softirq_action *h)
++static void blk_iopoll_softirq(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
+ 	int rearm = 0, budget = blk_iopoll_budget;
+diff -urNp linux-2.6.32.14/block/blk-map.c linux-2.6.32.14/block/blk-map.c
+--- linux-2.6.32.14/block/blk-map.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/blk-map.c	2010-05-28 21:27:15.167161810 -0400
+@@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
+ 	 * direct dma. else, set up kernel bounce buffers
+ 	 */
+ 	uaddr = (unsigned long) ubuf;
+-	if (blk_rq_aligned(q, ubuf, len) && !map_data)
++	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
+ 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
+ 	else
+ 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
+@@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
+ 	if (!len || !kbuf)
+ 		return -EINVAL;
+ 
+-	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
++	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
+ 	if (do_copy)
+ 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
+ 	else
+diff -urNp linux-2.6.32.14/block/blk-softirq.c linux-2.6.32.14/block/blk-softirq.c
+--- linux-2.6.32.14/block/blk-softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/blk-softirq.c	2010-05-28 21:27:15.179152446 -0400
+@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
+  * Softirq action handler - move entries to local list and loop over them
+  * while passing them to the queue registered handler.
+  */
+-static void blk_done_softirq(struct softirq_action *h)
++static void blk_done_softirq(void)
+ {
+ 	struct list_head *cpu_list, local_list;
+ 
+diff -urNp linux-2.6.32.14/block/blk-sysfs.c linux-2.6.32.14/block/blk-sysfs.c
+--- linux-2.6.32.14/block/blk-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/blk-sysfs.c	2010-05-28 21:27:15.179152446 -0400
+@@ -414,7 +414,7 @@ static void blk_release_queue(struct kob
+ 	kmem_cache_free(blk_requestq_cachep, q);
+ }
+ 
+-static struct sysfs_ops queue_sysfs_ops = {
++static const struct sysfs_ops queue_sysfs_ops = {
+ 	.show	= queue_attr_show,
+ 	.store	= queue_attr_store,
+ };
+diff -urNp linux-2.6.32.14/block/elevator.c linux-2.6.32.14/block/elevator.c
+--- linux-2.6.32.14/block/elevator.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/block/elevator.c	2010-05-28 21:27:15.179152446 -0400
+@@ -889,7 +889,7 @@ elv_attr_store(struct kobject *kobj, str
+ 	return error;
+ }
+ 
+-static struct sysfs_ops elv_sysfs_ops = {
++static const struct sysfs_ops elv_sysfs_ops = {
+ 	.show	= elv_attr_show,
+ 	.store	= elv_attr_store,
+ };
+diff -urNp linux-2.6.32.14/crypto/lrw.c linux-2.6.32.14/crypto/lrw.c
+--- linux-2.6.32.14/crypto/lrw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/crypto/lrw.c	2010-05-28 21:27:15.179152446 -0400
+@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
+ 	struct priv *ctx = crypto_tfm_ctx(parent);
+ 	struct crypto_cipher *child = ctx->child;
+ 	int err, i;
+-	be128 tmp = { 0 };
++	be128 tmp = { 0, 0 };
+ 	int bsize = crypto_cipher_blocksize(child);
+ 
+ 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
+diff -urNp linux-2.6.32.14/Documentation/dontdiff linux-2.6.32.14/Documentation/dontdiff
+--- linux-2.6.32.14/Documentation/dontdiff	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/Documentation/dontdiff	2010-05-28 21:27:15.179152446 -0400
+@@ -3,6 +3,7 @@
+ *.bin
+ *.cpio
+ *.csp
++*.dbg
+ *.dsp
+ *.dvi
+ *.elf
+@@ -40,6 +41,7 @@
+ *.ver
+ *.xml
+ *_MODULES
++*_reg_safe.h
+ *_vga16.c
+ *~
+ *.9
+@@ -49,11 +51,16 @@
+ 53c700_d.h
+ CVS
+ ChangeSet
++GPATH
++GRTAGS
++GSYMS
++GTAGS
+ Image
+ Kerntypes
+ Module.markers
+ Module.symvers
+ PENDING
++PERF*
+ SCCS
+ System.map*
+ TAGS
+@@ -76,7 +83,10 @@ btfixupprep
+ build
+ bvmlinux
+ bzImage*
++capflags.c
+ classlist.h*
++clut_vga16.c
++common-cmds.h
+ comp*.log
+ compile.h*
+ conf
+@@ -103,13 +113,14 @@ gen_crc32table
+ gen_init_cpio
+ genksyms
+ *_gray256.c
++hash
+ ihex2fw
+ ikconfig.h*
+ initramfs_data.cpio
++initramfs_data.cpio.bz2
+ initramfs_data.cpio.gz
+ initramfs_list
+ kallsyms
+-kconfig
+ keywords.c
+ ksym.c*
+ ksym.h*
+@@ -133,7 +144,9 @@ mkboot
+ mkbugboot
+ mkcpustr
+ mkdep
++mkpiggy
+ mkprep
++mkregtable
+ mktables
+ mktree
+ modpost
+@@ -149,6 +162,7 @@ patches*
+ pca200e.bin
+ pca200e_ecd.bin2
+ piggy.gz
++piggy.S
+ piggyback
+ pnmtologo
+ ppc_defs.h*
+@@ -163,6 +177,7 @@ setup
+ setup.bin
+ setup.elf
+ sImage
++slabinfo
+ sm_tbl*
+ split-include
+ syscalltab.h
+@@ -186,14 +201,20 @@ version.h*
+ vmlinux
+ vmlinux-*
+ vmlinux.aout
++vmlinux.bin.all
++vmlinux.bin.bz2
+ vmlinux.lds
++vmlinux.relocs
++voffset.h
+ vsyscall.lds
+ vsyscall_32.lds
+ wanxlfw.inc
+ uImage
+ unifdef
++utsrelease.h
+ wakeup.bin
+ wakeup.elf
+ wakeup.lds
+ zImage*
+ zconf.hash.c
++zoffset.h
+diff -urNp linux-2.6.32.14/Documentation/kernel-parameters.txt linux-2.6.32.14/Documentation/kernel-parameters.txt
+--- linux-2.6.32.14/Documentation/kernel-parameters.txt	2010-05-15 13:20:18.374565913 -0400
++++ linux-2.6.32.14/Documentation/kernel-parameters.txt	2010-05-28 21:27:15.179152446 -0400
+@@ -1836,6 +1836,12 @@ and is between 256 and 4096 characters. 
+ 			the specified number of seconds.  This is to be used if
+ 			your oopses keep scrolling off the screen.
+ 
++	pax_nouderef	[X86-32] disables UDEREF.  Most likely needed under certain
++			virtualization environments that don't cope well with the
++			expand down segment used by UDEREF on X86-32.
++
++	pax_softmode=	[X86-32] 0/1 to disable/enable PaX softmode on boot already.
++
+ 	pcbit=		[HW,ISDN]
+ 
+ 	pcd.		[PARIDE]
+diff -urNp linux-2.6.32.14/drivers/acpi/battery.c linux-2.6.32.14/drivers/acpi/battery.c
+--- linux-2.6.32.14/drivers/acpi/battery.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/battery.c	2010-05-28 21:27:15.179152446 -0400
+@@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
+ 	}
+ 
+ static struct battery_file {
+-	struct file_operations ops;
++	const struct file_operations ops;
+ 	mode_t mode;
+ 	const char *name;
+ } acpi_battery_file[] = {
+diff -urNp linux-2.6.32.14/drivers/acpi/blacklist.c linux-2.6.32.14/drivers/acpi/blacklist.c
+--- linux-2.6.32.14/drivers/acpi/blacklist.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/blacklist.c	2010-05-28 21:27:15.179152446 -0400
+@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
+ 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
+ 	 "Incorrect _ADR", 1},
+ 
+-	{""}
++	{"", "", 0, NULL, all_versions, NULL, 0}
+ };
+ 
+ #if	CONFIG_ACPI_BLACKLIST_YEAR
+diff -urNp linux-2.6.32.14/drivers/acpi/dock.c linux-2.6.32.14/drivers/acpi/dock.c
+--- linux-2.6.32.14/drivers/acpi/dock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/dock.c	2010-05-28 21:27:15.179152446 -0400
+@@ -77,7 +77,7 @@ struct dock_dependent_device {
+ 	struct list_head list;
+ 	struct list_head hotplug_list;
+ 	acpi_handle handle;
+-	struct acpi_dock_ops *ops;
++	const struct acpi_dock_ops *ops;
+ 	void *context;
+ };
+ 
+@@ -605,7 +605,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
+  * the dock driver after _DCK is executed.
+  */
+ int
+-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
++register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
+ 			     void *context)
+ {
+ 	struct dock_dependent_device *dd;
+diff -urNp linux-2.6.32.14/drivers/acpi/osl.c linux-2.6.32.14/drivers/acpi/osl.c
+--- linux-2.6.32.14/drivers/acpi/osl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/osl.c	2010-05-28 21:27:15.183173771 -0400
+@@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 	if (!value)
+ 		value = &dummy;
+ 
+@@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
+ 	void __iomem *virt_addr;
+ 
+ 	virt_addr = ioremap(phys_addr, width);
++	if (!virt_addr)
++		return AE_NO_MEMORY;
+ 
+ 	switch (width) {
+ 	case 8:
+diff -urNp linux-2.6.32.14/drivers/acpi/power_meter.c linux-2.6.32.14/drivers/acpi/power_meter.c
+--- linux-2.6.32.14/drivers/acpi/power_meter.c	2010-05-15 13:20:18.454567530 -0400
++++ linux-2.6.32.14/drivers/acpi/power_meter.c	2010-05-28 21:27:15.191153765 -0400
+@@ -315,8 +315,6 @@ static ssize_t set_trip(struct device *d
+ 		return res;
+ 
+ 	temp /= 1000;
+-	if (temp < 0)
+-		return -EINVAL;
+ 
+ 	mutex_lock(&resource->lock);
+ 	resource->trip[attr->index - 7] = temp;
+diff -urNp linux-2.6.32.14/drivers/acpi/proc.c linux-2.6.32.14/drivers/acpi/proc.c
+--- linux-2.6.32.14/drivers/acpi/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/proc.c	2010-05-28 21:27:15.191153765 -0400
+@@ -391,20 +391,15 @@ acpi_system_write_wakeup_device(struct f
+ 				size_t count, loff_t * ppos)
+ {
+ 	struct list_head *node, *next;
+-	char strbuf[5];
+-	char str[5] = "";
+-	unsigned int len = count;
++	char strbuf[5] = {0};
+ 	struct acpi_device *found_dev = NULL;
+ 
+-	if (len > 4)
+-		len = 4;
+-	if (len < 0)
+-		return -EFAULT;
++	if (count > 4)
++		count = 4;
+ 
+-	if (copy_from_user(strbuf, buffer, len))
++	if (copy_from_user(strbuf, buffer, count))
+ 		return -EFAULT;
+-	strbuf[len] = '\0';
+-	sscanf(strbuf, "%s", str);
++	strbuf[count] = '\0';
+ 
+ 	mutex_lock(&acpi_device_lock);
+ 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
+@@ -413,7 +408,7 @@ acpi_system_write_wakeup_device(struct f
+ 		if (!dev->wakeup.flags.valid)
+ 			continue;
+ 
+-		if (!strncmp(dev->pnp.bus_id, str, 4)) {
++		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
+ 			dev->wakeup.state.enabled =
+ 			    dev->wakeup.state.enabled ? 0 : 1;
+ 			found_dev = dev;
+diff -urNp linux-2.6.32.14/drivers/acpi/processor_core.c linux-2.6.32.14/drivers/acpi/processor_core.c
+--- linux-2.6.32.14/drivers/acpi/processor_core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/processor_core.c	2010-05-28 21:27:15.191153765 -0400
+@@ -796,7 +796,7 @@ static int __cpuinit acpi_processor_add(
+ 		return 0;
+ 	}
+ 
+-	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
++	BUG_ON(pr->id >= nr_cpu_ids);
+ 
+ 	/*
+ 	 * Buggy BIOS check
+diff -urNp linux-2.6.32.14/drivers/acpi/processor_idle.c linux-2.6.32.14/drivers/acpi/processor_idle.c
+--- linux-2.6.32.14/drivers/acpi/processor_idle.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/processor_idle.c	2010-05-28 21:27:15.191153765 -0400
+@@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
+ 	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+ 	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
+ 	 (void *)1},
+-	{},
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
+ };
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/acpi/sleep.c linux-2.6.32.14/drivers/acpi/sleep.c
+--- linux-2.6.32.14/drivers/acpi/sleep.c	2010-05-28 20:16:44.438931092 -0400
++++ linux-2.6.32.14/drivers/acpi/sleep.c	2010-05-28 21:27:15.191153765 -0400
+@@ -302,7 +302,7 @@ static int acpi_suspend_state_valid(susp
+ 	}
+ }
+ 
+-static struct platform_suspend_ops acpi_suspend_ops = {
++static const struct platform_suspend_ops acpi_suspend_ops = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin,
+ 	.prepare_late = acpi_pm_prepare,
+@@ -330,7 +330,7 @@ static int acpi_suspend_begin_old(suspen
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_suspend_ops acpi_suspend_ops_old = {
++static const struct platform_suspend_ops acpi_suspend_ops_old = {
+ 	.valid = acpi_suspend_state_valid,
+ 	.begin = acpi_suspend_begin_old,
+ 	.prepare_late = acpi_pm_disable_gpes,
+@@ -613,7 +613,7 @@ static void acpi_pm_enable_gpes(void)
+ 	acpi_enable_all_runtime_gpes();
+ }
+ 
+-static struct platform_hibernation_ops acpi_hibernation_ops = {
++static const struct platform_hibernation_ops acpi_hibernation_ops = {
+ 	.begin = acpi_hibernation_begin,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot,
+@@ -666,7 +666,7 @@ static int acpi_hibernation_pre_snapshot
+  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
+  * been requested.
+  */
+-static struct platform_hibernation_ops acpi_hibernation_ops_old = {
++static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
+ 	.begin = acpi_hibernation_begin_old,
+ 	.end = acpi_pm_end,
+ 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
+diff -urNp linux-2.6.32.14/drivers/acpi/video.c linux-2.6.32.14/drivers/acpi/video.c
+--- linux-2.6.32.14/drivers/acpi/video.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/acpi/video.c	2010-05-28 21:27:15.203165017 -0400
+@@ -359,7 +359,7 @@ static int acpi_video_set_brightness(str
+ 				vd->brightness->levels[request_level]);
+ }
+ 
+-static struct backlight_ops acpi_backlight_ops = {
++static const struct backlight_ops acpi_backlight_ops = {
+ 	.get_brightness = acpi_video_get_brightness,
+ 	.update_status  = acpi_video_set_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/ahci.c linux-2.6.32.14/drivers/ata/ahci.c
+--- linux-2.6.32.14/drivers/ata/ahci.c	2010-04-29 17:49:37.661448235 -0400
++++ linux-2.6.32.14/drivers/ata/ahci.c	2010-05-28 21:27:15.203165017 -0400
+@@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
+ 	.sdev_attrs		= ahci_sdev_attrs,
+ };
+ 
+-static struct ata_port_operations ahci_ops = {
++static const struct ata_port_operations ahci_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
+@@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
+ 	.port_stop		= ahci_port_stop,
+ };
+ 
+-static struct ata_port_operations ahci_vt8251_ops = {
++static const struct ata_port_operations ahci_vt8251_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_vt8251_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_p5wdh_ops = {
++static const struct ata_port_operations ahci_p5wdh_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.hardreset		= ahci_p5wdh_hardreset,
+ };
+ 
+-static struct ata_port_operations ahci_sb600_ops = {
++static const struct ata_port_operations ahci_sb600_ops = {
+ 	.inherits		= &ahci_ops,
+ 	.softreset		= ahci_sb600_softreset,
+ 	.pmp_softreset		= ahci_sb600_softreset,
+@@ -687,7 +687,7 @@ static const struct pci_device_id ahci_p
+ 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
+ 
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/ata/ata_generic.c linux-2.6.32.14/drivers/ata/ata_generic.c
+--- linux-2.6.32.14/drivers/ata/ata_generic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/ata_generic.c	2010-05-28 21:27:15.203165017 -0400
+@@ -95,7 +95,7 @@ static struct scsi_host_template generic
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations generic_port_ops = {
++static const struct ata_port_operations generic_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_mode	= generic_set_mode,
+diff -urNp linux-2.6.32.14/drivers/ata/ata_piix.c linux-2.6.32.14/drivers/ata/ata_piix.c
+--- linux-2.6.32.14/drivers/ata/ata_piix.c	2010-04-29 17:49:37.669446700 -0400
++++ linux-2.6.32.14/drivers/ata/ata_piix.c	2010-05-28 21:27:15.203165017 -0400
+@@ -299,7 +299,7 @@ static const struct pci_device_id piix_p
+ 	{ 0x8086, 0x1c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (CPT) */
+ 	{ 0x8086, 0x1c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+-	{ }	/* terminate list */
++	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
+ };
+ 
+ static struct pci_driver piix_pci_driver = {
+@@ -317,7 +317,7 @@ static struct scsi_host_template piix_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations piix_pata_ops = {
++static const struct ata_port_operations piix_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= piix_set_piomode,
+@@ -325,22 +325,22 @@ static struct ata_port_operations piix_p
+ 	.prereset		= piix_pata_prereset,
+ };
+ 
+-static struct ata_port_operations piix_vmw_ops = {
++static const struct ata_port_operations piix_vmw_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.bmdma_status		= piix_vmw_bmdma_status,
+ };
+ 
+-static struct ata_port_operations ich_pata_ops = {
++static const struct ata_port_operations ich_pata_ops = {
+ 	.inherits		= &piix_pata_ops,
+ 	.cable_detect		= ich_pata_cable_detect,
+ 	.set_dmamode		= ich_set_dmamode,
+ };
+ 
+-static struct ata_port_operations piix_sata_ops = {
++static const struct ata_port_operations piix_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ };
+ 
+-static struct ata_port_operations piix_sidpr_sata_ops = {
++static const struct ata_port_operations piix_sidpr_sata_ops = {
+ 	.inherits		= &piix_sata_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= piix_sidpr_scr_read,
+@@ -616,7 +616,7 @@ static const struct ich_laptop ich_lapto
+ 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
+ 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
+ 	/* end marker */
+-	{ 0, }
++	{ 0, 0, 0 }
+ };
+ 
+ /**
+@@ -1094,7 +1094,7 @@ static int piix_broken_suspend(void)
+ 			},
+ 		},
+ 
+-		{ }	/* terminate list */
++		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
+ 	};
+ 	static const char *oemstrs[] = {
+ 		"Tecra M3,",
+diff -urNp linux-2.6.32.14/drivers/ata/libata-acpi.c linux-2.6.32.14/drivers/ata/libata-acpi.c
+--- linux-2.6.32.14/drivers/ata/libata-acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/libata-acpi.c	2010-05-28 21:27:15.203165017 -0400
+@@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
+ 	ata_acpi_uevent(dev->link->ap, dev, event);
+ }
+ 
+-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
+ 	.handler = ata_acpi_dev_notify_dock,
+ 	.uevent = ata_acpi_dev_uevent,
+ };
+ 
+-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
++static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
+ 	.handler = ata_acpi_ap_notify_dock,
+ 	.uevent = ata_acpi_ap_uevent,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/libata-core.c linux-2.6.32.14/drivers/ata/libata-core.c
+--- linux-2.6.32.14/drivers/ata/libata-core.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.14/drivers/ata/libata-core.c	2010-05-28 21:27:15.207155482 -0400
+@@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
+ 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
+ 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
+ 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
+-	{ -1, },
++	{ -1, 0, 0 }
+ };
+ 
+ /**
+@@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
+ 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
+ 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
+ 
+-	{ 0xFF }
++	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
+@@ -4388,7 +4388,7 @@ static const struct ata_blacklist_entry 
+ 	{ "PIONEER DVD-RW  DVRTD08",	"1.00",	ATA_HORKAGE_NOSETXFER },
+ 
+ 	/* End Marker */
+-	{ }
++	{ NULL, NULL, 0 }
+ };
+ 
+ static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
+@@ -5964,7 +5964,7 @@ static void ata_host_stop(struct device 
+  *	LOCKING:
+  *	None.
+  */
+-static void ata_finalize_port_ops(struct ata_port_operations *ops)
++static void ata_finalize_port_ops(const struct ata_port_operations *ops)
+ {
+ 	static DEFINE_SPINLOCK(lock);
+ 	const struct ata_port_operations *cur;
+@@ -5976,6 +5976,7 @@ static void ata_finalize_port_ops(struct
+ 		return;
+ 
+ 	spin_lock(&lock);
++	pax_open_kernel();
+ 
+ 	for (cur = ops->inherits; cur; cur = cur->inherits) {
+ 		void **inherit = (void **)cur;
+@@ -5989,8 +5990,9 @@ static void ata_finalize_port_ops(struct
+ 		if (IS_ERR(*pp))
+ 			*pp = NULL;
+ 
+-	ops->inherits = NULL;
++	((struct ata_port_operations *)ops)->inherits = NULL;
+ 
++	pax_close_kernel();
+ 	spin_unlock(&lock);
+ }
+ 
+@@ -6087,7 +6089,7 @@ int ata_host_start(struct ata_host *host
+  */
+ /* KILLME - the only user left is ipr */
+ void ata_host_init(struct ata_host *host, struct device *dev,
+-		   unsigned long flags, struct ata_port_operations *ops)
++		   unsigned long flags, const struct ata_port_operations *ops)
+ {
+ 	spin_lock_init(&host->lock);
+ 	host->dev = dev;
+@@ -6750,7 +6752,7 @@ static void ata_dummy_error_handler(stru
+ 	/* truly dummy */
+ }
+ 
+-struct ata_port_operations ata_dummy_port_ops = {
++const struct ata_port_operations ata_dummy_port_ops = {
+ 	.qc_prep		= ata_noop_qc_prep,
+ 	.qc_issue		= ata_dummy_qc_issue,
+ 	.error_handler		= ata_dummy_error_handler,
+diff -urNp linux-2.6.32.14/drivers/ata/libata-eh.c linux-2.6.32.14/drivers/ata/libata-eh.c
+--- linux-2.6.32.14/drivers/ata/libata-eh.c	2010-05-15 13:20:18.462978524 -0400
++++ linux-2.6.32.14/drivers/ata/libata-eh.c	2010-05-28 21:27:15.215165530 -0400
+@@ -3586,7 +3586,7 @@ void ata_do_eh(struct ata_port *ap, ata_
+  */
+ void ata_std_error_handler(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	ata_reset_fn_t hardreset = ops->hardreset;
+ 
+ 	/* ignore built-in hardreset if SCR access is not available */
+diff -urNp linux-2.6.32.14/drivers/ata/libata-pmp.c linux-2.6.32.14/drivers/ata/libata-pmp.c
+--- linux-2.6.32.14/drivers/ata/libata-pmp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/libata-pmp.c	2010-05-28 21:27:15.215165530 -0400
+@@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
+  */
+ static int sata_pmp_eh_recover(struct ata_port *ap)
+ {
+-	struct ata_port_operations *ops = ap->ops;
++	const struct ata_port_operations *ops = ap->ops;
+ 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
+ 	struct ata_link *pmp_link = &ap->link;
+ 	struct ata_device *pmp_dev = pmp_link->device;
+diff -urNp linux-2.6.32.14/drivers/ata/pata_acpi.c linux-2.6.32.14/drivers/ata/pata_acpi.c
+--- linux-2.6.32.14/drivers/ata/pata_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_acpi.c	2010-05-28 21:27:15.215165530 -0400
+@@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pacpi_ops = {
++static const struct ata_port_operations pacpi_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= pacpi_qc_issue,
+ 	.cable_detect		= pacpi_cable_detect,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_ali.c linux-2.6.32.14/drivers/ata/pata_ali.c
+--- linux-2.6.32.14/drivers/ata/pata_ali.c	2010-04-29 17:49:37.689144697 -0400
++++ linux-2.6.32.14/drivers/ata/pata_ali.c	2010-05-28 21:27:15.215165530 -0400
+@@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
+  *	Port operations for PIO only ALi
+  */
+ 
+-static struct ata_port_operations ali_early_port_ops = {
++static const struct ata_port_operations ali_early_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= ali_set_piomode,
+@@ -382,7 +382,7 @@ static const struct ata_port_operations 
+  *	Port operations for DMA capable ALi without cable
+  *	detect
+  */
+-static struct ata_port_operations ali_20_port_ops = {
++static const struct ata_port_operations ali_20_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.mode_filter	= ali_20_filter,
+@@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c2_port_ops = {
++static const struct ata_port_operations ali_c2_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
+ /*
+  *	Port operations for DMA capable ALi with cable detect
+  */
+-static struct ata_port_operations ali_c4_port_ops = {
++static const struct ata_port_operations ali_c4_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.cable_detect	= ali_c2_cable_detect,
+@@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
+ /*
+  *	Port operations for DMA capable ALi with cable detect and LBA48
+  */
+-static struct ata_port_operations ali_c5_port_ops = {
++static const struct ata_port_operations ali_c5_port_ops = {
+ 	.inherits	= &ali_dma_base_ops,
+ 	.check_atapi_dma = ali_check_atapi_dma,
+ 	.dev_config	= ali_warn_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_amd.c linux-2.6.32.14/drivers/ata/pata_amd.c
+--- linux-2.6.32.14/drivers/ata/pata_amd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_amd.c	2010-05-28 21:27:15.215165530 -0400
+@@ -397,28 +397,28 @@ static const struct ata_port_operations 
+ 	.prereset	= amd_pre_reset,
+ };
+ 
+-static struct ata_port_operations amd33_port_ops = {
++static const struct ata_port_operations amd33_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= amd33_set_piomode,
+ 	.set_dmamode	= amd33_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd66_port_ops = {
++static const struct ata_port_operations amd66_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd66_set_piomode,
+ 	.set_dmamode	= amd66_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd100_port_ops = {
++static const struct ata_port_operations amd100_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= ata_cable_unknown,
+ 	.set_piomode	= amd100_set_piomode,
+ 	.set_dmamode	= amd100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations amd133_port_ops = {
++static const struct ata_port_operations amd133_port_ops = {
+ 	.inherits	= &amd_base_port_ops,
+ 	.cable_detect	= amd_cable_detect,
+ 	.set_piomode	= amd133_set_piomode,
+@@ -433,13 +433,13 @@ static const struct ata_port_operations 
+ 	.host_stop	= nv_host_stop,
+ };
+ 
+-static struct ata_port_operations nv100_port_ops = {
++static const struct ata_port_operations nv100_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv100_set_piomode,
+ 	.set_dmamode	= nv100_set_dmamode,
+ };
+ 
+-static struct ata_port_operations nv133_port_ops = {
++static const struct ata_port_operations nv133_port_ops = {
+ 	.inherits	= &nv_base_port_ops,
+ 	.set_piomode	= nv133_set_piomode,
+ 	.set_dmamode	= nv133_set_dmamode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_artop.c linux-2.6.32.14/drivers/ata/pata_artop.c
+--- linux-2.6.32.14/drivers/ata/pata_artop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_artop.c	2010-05-28 21:27:15.215165530 -0400
+@@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations artop6210_ops = {
++static const struct ata_port_operations artop6210_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= artop6210_set_piomode,
+@@ -320,7 +320,7 @@ static struct ata_port_operations artop6
+ 	.qc_defer		= artop6210_qc_defer,
+ };
+ 
+-static struct ata_port_operations artop6260_ops = {
++static const struct ata_port_operations artop6260_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= artop6260_cable_detect,
+ 	.set_piomode		= artop6260_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_at32.c linux-2.6.32.14/drivers/ata/pata_at32.c
+--- linux-2.6.32.14/drivers/ata/pata_at32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_at32.c	2010-05-28 21:27:15.215165530 -0400
+@@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations at32_port_ops = {
++static const struct ata_port_operations at32_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.cable_detect		= ata_cable_40wire,
+ 	.set_piomode		= pata_at32_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_at91.c linux-2.6.32.14/drivers/ata/pata_at91.c
+--- linux-2.6.32.14/drivers/ata/pata_at91.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_at91.c	2010-05-28 21:27:15.227169983 -0400
+@@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_at91_port_ops = {
++static const struct ata_port_operations pata_at91_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 
+ 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_atiixp.c linux-2.6.32.14/drivers/ata/pata_atiixp.c
+--- linux-2.6.32.14/drivers/ata/pata_atiixp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_atiixp.c	2010-05-28 21:27:15.227169983 -0400
+@@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations atiixp_port_ops = {
++static const struct ata_port_operations atiixp_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_atp867x.c linux-2.6.32.14/drivers/ata/pata_atp867x.c
+--- linux-2.6.32.14/drivers/ata/pata_atp867x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_atp867x.c	2010-05-28 21:27:15.227169983 -0400
+@@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations atp867x_ops = {
++static const struct ata_port_operations atp867x_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= atp867x_cable_detect,
+ 	.set_piomode		= atp867x_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_bf54x.c linux-2.6.32.14/drivers/ata/pata_bf54x.c
+--- linux-2.6.32.14/drivers/ata/pata_bf54x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_bf54x.c	2010-05-28 21:27:15.235166526 -0400
+@@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations bfin_pata_ops = {
++static const struct ata_port_operations bfin_pata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.set_piomode		= bfin_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cmd640.c linux-2.6.32.14/drivers/ata/pata_cmd640.c
+--- linux-2.6.32.14/drivers/ata/pata_cmd640.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cmd640.c	2010-05-28 21:27:15.235166526 -0400
+@@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cmd640_port_ops = {
++static const struct ata_port_operations cmd640_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cmd64x.c linux-2.6.32.14/drivers/ata/pata_cmd64x.c
+--- linux-2.6.32.14/drivers/ata/pata_cmd64x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cmd64x.c	2010-05-28 21:27:15.235166526 -0400
+@@ -275,18 +275,18 @@ static const struct ata_port_operations 
+ 	.set_dmamode	= cmd64x_set_dmamode,
+ };
+ 
+-static struct ata_port_operations cmd64x_port_ops = {
++static const struct ata_port_operations cmd64x_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd646r1_port_ops = {
++static const struct ata_port_operations cmd646r1_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd646r1_bmdma_stop,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations cmd648_port_ops = {
++static const struct ata_port_operations cmd648_port_ops = {
+ 	.inherits	= &cmd64x_base_ops,
+ 	.bmdma_stop	= cmd648_bmdma_stop,
+ 	.cable_detect	= cmd648_cable_detect,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cs5520.c linux-2.6.32.14/drivers/ata/pata_cs5520.c
+--- linux-2.6.32.14/drivers/ata/pata_cs5520.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cs5520.c	2010-05-28 21:27:15.239154462 -0400
+@@ -144,7 +144,7 @@ static struct scsi_host_template cs5520_
+ 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5520_port_ops = {
++static const struct ata_port_operations cs5520_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_prep		= ata_sff_dumb_qc_prep,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cs5530.c linux-2.6.32.14/drivers/ata/pata_cs5530.c
+--- linux-2.6.32.14/drivers/ata/pata_cs5530.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cs5530.c	2010-05-28 21:27:15.239154462 -0400
+@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations cs5530_port_ops = {
++static const struct ata_port_operations cs5530_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cs5535.c linux-2.6.32.14/drivers/ata/pata_cs5535.c
+--- linux-2.6.32.14/drivers/ata/pata_cs5535.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cs5535.c	2010-05-28 21:27:15.239154462 -0400
+@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5535_port_ops = {
++static const struct ata_port_operations cs5535_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= cs5535_cable_detect,
+ 	.set_piomode	= cs5535_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cs5536.c linux-2.6.32.14/drivers/ata/pata_cs5536.c
+--- linux-2.6.32.14/drivers/ata/pata_cs5536.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cs5536.c	2010-05-28 21:27:15.239154462 -0400
+@@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cs5536_port_ops = {
++static const struct ata_port_operations cs5536_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= cs5536_cable_detect,
+ 	.set_piomode		= cs5536_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_cypress.c linux-2.6.32.14/drivers/ata/pata_cypress.c
+--- linux-2.6.32.14/drivers/ata/pata_cypress.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_cypress.c	2010-05-28 21:27:15.243179627 -0400
+@@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations cy82c693_port_ops = {
++static const struct ata_port_operations cy82c693_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= cy82c693_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_efar.c linux-2.6.32.14/drivers/ata/pata_efar.c
+--- linux-2.6.32.14/drivers/ata/pata_efar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_efar.c	2010-05-28 21:27:15.243179627 -0400
+@@ -222,7 +222,7 @@ static struct scsi_host_template efar_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations efar_ops = {
++static const struct ata_port_operations efar_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= efar_cable_detect,
+ 	.set_piomode		= efar_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_hpt366.c linux-2.6.32.14/drivers/ata/pata_hpt366.c
+--- linux-2.6.32.14/drivers/ata/pata_hpt366.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_hpt366.c	2010-05-28 21:27:15.243179627 -0400
+@@ -282,7 +282,7 @@ static struct scsi_host_template hpt36x_
+  *	Configuration for HPT366/68
+  */
+ 
+-static struct ata_port_operations hpt366_port_ops = {
++static const struct ata_port_operations hpt366_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= hpt36x_cable_detect,
+ 	.mode_filter	= hpt366_filter,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_hpt37x.c linux-2.6.32.14/drivers/ata/pata_hpt37x.c
+--- linux-2.6.32.14/drivers/ata/pata_hpt37x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_hpt37x.c	2010-05-28 21:27:15.247200461 -0400
+@@ -576,7 +576,7 @@ static struct scsi_host_template hpt37x_
+  *	Configuration for HPT370
+  */
+ 
+-static struct ata_port_operations hpt370_port_ops = {
++static const struct ata_port_operations hpt370_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt370_bmdma_stop,
+@@ -591,7 +591,7 @@ static struct ata_port_operations hpt370
+  *	Configuration for HPT370A. Close to 370 but less filters
+  */
+ 
+-static struct ata_port_operations hpt370a_port_ops = {
++static const struct ata_port_operations hpt370a_port_ops = {
+ 	.inherits	= &hpt370_port_ops,
+ 	.mode_filter	= hpt370a_filter,
+ };
+@@ -601,7 +601,7 @@ static struct ata_port_operations hpt370
+  *	and DMA mode setting functionality.
+  */
+ 
+-static struct ata_port_operations hpt372_port_ops = {
++static const struct ata_port_operations hpt372_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt37x_bmdma_stop,
+@@ -616,7 +616,7 @@ static struct ata_port_operations hpt372
+  *	but we have a different cable detection procedure for function 1.
+  */
+ 
+-static struct ata_port_operations hpt374_fn1_port_ops = {
++static const struct ata_port_operations hpt374_fn1_port_ops = {
+ 	.inherits	= &hpt372_port_ops,
+ 	.prereset	= hpt374_fn1_pre_reset,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_hpt3x2n.c linux-2.6.32.14/drivers/ata/pata_hpt3x2n.c
+--- linux-2.6.32.14/drivers/ata/pata_hpt3x2n.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_hpt3x2n.c	2010-05-28 21:27:15.247200461 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template hpt3x2n
+  *	Configuration for HPT3x2n.
+  */
+ 
+-static struct ata_port_operations hpt3x2n_port_ops = {
++static const struct ata_port_operations hpt3x2n_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt3x2n_bmdma_stop,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_hpt3x3.c linux-2.6.32.14/drivers/ata/pata_hpt3x3.c
+--- linux-2.6.32.14/drivers/ata/pata_hpt3x3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_hpt3x3.c	2010-05-28 21:27:15.247200461 -0400
+@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations hpt3x3_port_ops = {
++static const struct ata_port_operations hpt3x3_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= hpt3x3_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_icside.c linux-2.6.32.14/drivers/ata/pata_icside.c
+--- linux-2.6.32.14/drivers/ata/pata_icside.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_icside.c	2010-05-28 21:27:15.251151122 -0400
+@@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
+ 	}
+ }
+ 
+-static struct ata_port_operations pata_icside_port_ops = {
++static const struct ata_port_operations pata_icside_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	/* no need to build any PRD tables for DMA */
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_isapnp.c linux-2.6.32.14/drivers/ata/pata_isapnp.c
+--- linux-2.6.32.14/drivers/ata/pata_isapnp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_isapnp.c	2010-05-28 21:27:15.251151122 -0400
+@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations isapnp_port_ops = {
++static const struct ata_port_operations isapnp_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ };
+ 
+-static struct ata_port_operations isapnp_noalt_port_ops = {
++static const struct ata_port_operations isapnp_noalt_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	/* No altstatus so we don't want to use the lost interrupt poll */
+diff -urNp linux-2.6.32.14/drivers/ata/pata_it8213.c linux-2.6.32.14/drivers/ata/pata_it8213.c
+--- linux-2.6.32.14/drivers/ata/pata_it8213.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_it8213.c	2010-05-28 21:27:15.251151122 -0400
+@@ -234,7 +234,7 @@ static struct scsi_host_template it8213_
+ };
+ 
+ 
+-static struct ata_port_operations it8213_ops = {
++static const struct ata_port_operations it8213_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= it8213_cable_detect,
+ 	.set_piomode		= it8213_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_it821x.c linux-2.6.32.14/drivers/ata/pata_it821x.c
+--- linux-2.6.32.14/drivers/ata/pata_it821x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_it821x.c	2010-05-28 21:27:15.251151122 -0400
+@@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations it821x_smart_port_ops = {
++static const struct ata_port_operations it821x_smart_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -814,7 +814,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_passthru_port_ops = {
++static const struct ata_port_operations it821x_passthru_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+@@ -830,7 +830,7 @@ static struct ata_port_operations it821x
+ 	.port_start	= it821x_port_start,
+ };
+ 
+-static struct ata_port_operations it821x_rdc_port_ops = {
++static const struct ata_port_operations it821x_rdc_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma= it821x_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.14/drivers/ata/pata_ixp4xx_cf.c
+--- linux-2.6.32.14/drivers/ata/pata_ixp4xx_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_ixp4xx_cf.c	2010-05-28 21:27:15.251151122 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ixp4xx_port_ops = {
++static const struct ata_port_operations ixp4xx_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_jmicron.c linux-2.6.32.14/drivers/ata/pata_jmicron.c
+--- linux-2.6.32.14/drivers/ata/pata_jmicron.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_jmicron.c	2010-05-28 21:27:15.251151122 -0400
+@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations jmicron_ops = {
++static const struct ata_port_operations jmicron_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= jmicron_pre_reset,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_legacy.c linux-2.6.32.14/drivers/ata/pata_legacy.c
+--- linux-2.6.32.14/drivers/ata/pata_legacy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_legacy.c	2010-05-28 21:27:15.251151122 -0400
+@@ -106,7 +106,7 @@ struct legacy_probe {
+ 
+ struct legacy_controller {
+ 	const char *name;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned int pio_mask;
+ 	unsigned int flags;
+ 	unsigned int pflags;
+@@ -223,12 +223,12 @@ static const struct ata_port_operations 
+  *	pio_mask as well.
+  */
+ 
+-static struct ata_port_operations simple_port_ops = {
++static const struct ata_port_operations simple_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+ 
+-static struct ata_port_operations legacy_port_ops = {
++static const struct ata_port_operations legacy_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.set_mode	= legacy_set_mode,
+@@ -324,7 +324,7 @@ static unsigned int pdc_data_xfer_vlb(st
+ 	return buflen;
+ }
+ 
+-static struct ata_port_operations pdc20230_port_ops = {
++static const struct ata_port_operations pdc20230_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= pdc20230_set_piomode,
+ 	.sff_data_xfer	= pdc_data_xfer_vlb,
+@@ -357,7 +357,7 @@ static void ht6560a_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560a_port_ops = {
++static const struct ata_port_operations ht6560a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560a_set_piomode,
+ };
+@@ -400,7 +400,7 @@ static void ht6560b_set_piomode(struct a
+ 	ioread8(ap->ioaddr.status_addr);
+ }
+ 
+-static struct ata_port_operations ht6560b_port_ops = {
++static const struct ata_port_operations ht6560b_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= ht6560b_set_piomode,
+ };
+@@ -499,7 +499,7 @@ static void opti82c611a_set_piomode(stru
+ }
+ 
+ 
+-static struct ata_port_operations opti82c611a_port_ops = {
++static const struct ata_port_operations opti82c611a_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c611a_set_piomode,
+ };
+@@ -609,7 +609,7 @@ static unsigned int opti82c46x_qc_issue(
+ 	return ata_sff_qc_issue(qc);
+ }
+ 
+-static struct ata_port_operations opti82c46x_port_ops = {
++static const struct ata_port_operations opti82c46x_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= opti82c46x_set_piomode,
+ 	.qc_issue	= opti82c46x_qc_issue,
+@@ -771,20 +771,20 @@ static int qdi_port(struct platform_devi
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6500_set_piomode,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+ };
+ 
+-static struct ata_port_operations qdi6580dp_port_ops = {
++static const struct ata_port_operations qdi6580dp_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= qdi6580dp_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -855,7 +855,7 @@ static int winbond_port(struct platform_
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &legacy_base_port_ops,
+ 	.set_piomode	= winbond_set_piomode,
+ 	.sff_data_xfer	= vlb32_data_xfer,
+@@ -978,7 +978,7 @@ static __init int legacy_init_one(struct
+ 	int pio_modes = controller->pio_mask;
+ 	unsigned long io = probe->port;
+ 	u32 mask = (1 << probe->slot);
+-	struct ata_port_operations *ops = controller->ops;
++	const struct ata_port_operations *ops = controller->ops;
+ 	struct legacy_data *ld = &legacy_data[probe->slot];
+ 	struct ata_host *host = NULL;
+ 	struct ata_port *ap;
+diff -urNp linux-2.6.32.14/drivers/ata/pata_marvell.c linux-2.6.32.14/drivers/ata/pata_marvell.c
+--- linux-2.6.32.14/drivers/ata/pata_marvell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_marvell.c	2010-05-28 21:27:15.251151122 -0400
+@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations marvell_ops = {
++static const struct ata_port_operations marvell_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= marvell_cable_detect,
+ 	.prereset		= marvell_pre_reset,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_mpc52xx.c linux-2.6.32.14/drivers/ata/pata_mpc52xx.c
+--- linux-2.6.32.14/drivers/ata/pata_mpc52xx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_mpc52xx.c	2010-05-28 21:27:15.251151122 -0400
+@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpc52xx_ata_port_ops = {
++static const struct ata_port_operations mpc52xx_ata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_dev_select		= mpc52xx_ata_dev_select,
+ 	.set_piomode		= mpc52xx_ata_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_mpiix.c linux-2.6.32.14/drivers/ata/pata_mpiix.c
+--- linux-2.6.32.14/drivers/ata/pata_mpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_mpiix.c	2010-05-28 21:27:15.251151122 -0400
+@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations mpiix_port_ops = {
++static const struct ata_port_operations mpiix_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= mpiix_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_netcell.c linux-2.6.32.14/drivers/ata/pata_netcell.c
+--- linux-2.6.32.14/drivers/ata/pata_netcell.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_netcell.c	2010-05-28 21:27:15.251151122 -0400
+@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations netcell_ops = {
++static const struct ata_port_operations netcell_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_80wire,
+ 	.read_id	= netcell_read_id,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_ninja32.c linux-2.6.32.14/drivers/ata/pata_ninja32.c
+--- linux-2.6.32.14/drivers/ata/pata_ninja32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_ninja32.c	2010-05-28 21:27:15.251151122 -0400
+@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ninja32_port_ops = {
++static const struct ata_port_operations ninja32_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.sff_dev_select = ninja32_dev_select,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_ns87410.c linux-2.6.32.14/drivers/ata/pata_ns87410.c
+--- linux-2.6.32.14/drivers/ata/pata_ns87410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_ns87410.c	2010-05-28 21:27:15.251151122 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations ns87410_port_ops = {
++static const struct ata_port_operations ns87410_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= ns87410_qc_issue,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_ns87415.c linux-2.6.32.14/drivers/ata/pata_ns87415.c
+--- linux-2.6.32.14/drivers/ata/pata_ns87415.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_ns87415.c	2010-05-28 21:27:15.251151122 -0400
+@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
+ }
+ #endif		/* 87560 SuperIO Support */
+ 
+-static struct ata_port_operations ns87415_pata_ops = {
++static const struct ata_port_operations ns87415_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.check_atapi_dma	= ns87415_check_atapi_dma,
+@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
+ };
+ 
+ #if defined(CONFIG_SUPERIO)
+-static struct ata_port_operations ns87560_pata_ops = {
++static const struct ata_port_operations ns87560_pata_ops = {
+ 	.inherits		= &ns87415_pata_ops,
+ 	.sff_tf_read		= ns87560_tf_read,
+ 	.sff_check_status	= ns87560_check_status,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_octeon_cf.c linux-2.6.32.14/drivers/ata/pata_octeon_cf.c
+--- linux-2.6.32.14/drivers/ata/pata_octeon_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_octeon_cf.c	2010-05-28 21:27:15.251151122 -0400
+@@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct ata_port_operations octeon_cf_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_oldpiix.c linux-2.6.32.14/drivers/ata/pata_oldpiix.c
+--- linux-2.6.32.14/drivers/ata/pata_oldpiix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_oldpiix.c	2010-05-28 21:27:15.251151122 -0400
+@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations oldpiix_pata_ops = {
++static const struct ata_port_operations oldpiix_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= oldpiix_qc_issue,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_opti.c linux-2.6.32.14/drivers/ata/pata_opti.c
+--- linux-2.6.32.14/drivers/ata/pata_opti.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_opti.c	2010-05-28 21:27:15.263188611 -0400
+@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations opti_port_ops = {
++static const struct ata_port_operations opti_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= opti_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_optidma.c linux-2.6.32.14/drivers/ata/pata_optidma.c
+--- linux-2.6.32.14/drivers/ata/pata_optidma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_optidma.c	2010-05-28 21:27:15.263188611 -0400
+@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations optidma_port_ops = {
++static const struct ata_port_operations optidma_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_piomode	= optidma_set_pio_mode,
+@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
+ 	.prereset	= optidma_pre_reset,
+ };
+ 
+-static struct ata_port_operations optiplus_port_ops = {
++static const struct ata_port_operations optiplus_port_ops = {
+ 	.inherits	= &optidma_port_ops,
+ 	.set_piomode	= optiplus_set_pio_mode,
+ 	.set_dmamode	= optiplus_set_dma_mode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_palmld.c linux-2.6.32.14/drivers/ata/pata_palmld.c
+--- linux-2.6.32.14/drivers/ata/pata_palmld.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_palmld.c	2010-05-28 21:27:15.263188611 -0400
+@@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations palmld_port_ops = {
++static const struct ata_port_operations palmld_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_pcmcia.c linux-2.6.32.14/drivers/ata/pata_pcmcia.c
+--- linux-2.6.32.14/drivers/ata/pata_pcmcia.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_pcmcia.c	2010-05-28 21:27:15.263188611 -0400
+@@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pcmcia_port_ops = {
++static const struct ata_port_operations pcmcia_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= pcmcia_set_mode,
+ };
+ 
+-static struct ata_port_operations pcmcia_8bit_port_ops = {
++static const struct ata_port_operations pcmcia_8bit_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= ata_data_xfer_8bit,
+ 	.cable_detect	= ata_cable_40wire,
+@@ -256,7 +256,7 @@ static int pcmcia_init_one(struct pcmcia
+ 	unsigned long io_base, ctl_base;
+ 	void __iomem *io_addr, *ctl_addr;
+ 	int n_ports = 1;
+-	struct ata_port_operations *ops = &pcmcia_port_ops;
++	const struct ata_port_operations *ops = &pcmcia_port_ops;
+ 
+ 	info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 	if (info == NULL)
+diff -urNp linux-2.6.32.14/drivers/ata/pata_pdc2027x.c linux-2.6.32.14/drivers/ata/pata_pdc2027x.c
+--- linux-2.6.32.14/drivers/ata/pata_pdc2027x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_pdc2027x.c	2010-05-28 21:27:15.263188611 -0400
+@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata100_ops = {
++static const struct ata_port_operations pdc2027x_pata100_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
+ 	.cable_detect		= pdc2027x_cable_detect,
+ 	.prereset		= pdc2027x_prereset,
+ };
+ 
+-static struct ata_port_operations pdc2027x_pata133_ops = {
++static const struct ata_port_operations pdc2027x_pata133_ops = {
+ 	.inherits		= &pdc2027x_pata100_ops,
+ 	.mode_filter		= pdc2027x_mode_filter,
+ 	.set_piomode		= pdc2027x_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.14/drivers/ata/pata_pdc202xx_old.c
+--- linux-2.6.32.14/drivers/ata/pata_pdc202xx_old.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_pdc202xx_old.c	2010-05-28 21:27:15.263188611 -0400
+@@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pdc2024x_port_ops = {
++static const struct ata_port_operations pdc2024x_port_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.cable_detect		= ata_cable_40wire,
+@@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
+ 	.set_dmamode		= pdc202xx_set_dmamode,
+ };
+ 
+-static struct ata_port_operations pdc2026x_port_ops = {
++static const struct ata_port_operations pdc2026x_port_ops = {
+ 	.inherits		= &pdc2024x_port_ops,
+ 
+ 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_platform.c linux-2.6.32.14/drivers/ata/pata_platform.c
+--- linux-2.6.32.14/drivers/ata/pata_platform.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_platform.c	2010-05-28 21:27:15.263188611 -0400
+@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations pata_platform_port_ops = {
++static const struct ata_port_operations pata_platform_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_qdi.c linux-2.6.32.14/drivers/ata/pata_qdi.c
+--- linux-2.6.32.14/drivers/ata/pata_qdi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_qdi.c	2010-05-28 21:27:15.263188611 -0400
+@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations qdi6500_port_ops = {
++static const struct ata_port_operations qdi6500_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.qc_issue	= qdi_qc_issue,
+ 	.sff_data_xfer	= qdi_data_xfer,
+@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
+ 	.set_piomode	= qdi6500_set_piomode,
+ };
+ 
+-static struct ata_port_operations qdi6580_port_ops = {
++static const struct ata_port_operations qdi6580_port_ops = {
+ 	.inherits	= &qdi6500_port_ops,
+ 	.set_piomode	= qdi6580_set_piomode,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_radisys.c linux-2.6.32.14/drivers/ata/pata_radisys.c
+--- linux-2.6.32.14/drivers/ata/pata_radisys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_radisys.c	2010-05-28 21:27:15.267180677 -0400
+@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations radisys_pata_ops = {
++static const struct ata_port_operations radisys_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.qc_issue		= radisys_qc_issue,
+ 	.cable_detect		= ata_cable_unknown,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_rb532_cf.c linux-2.6.32.14/drivers/ata/pata_rb532_cf.c
+--- linux-2.6.32.14/drivers/ata/pata_rb532_cf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_rb532_cf.c	2010-05-28 21:27:15.267180677 -0400
+@@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
+ 	return IRQ_HANDLED;
+ }
+ 
+-static struct ata_port_operations rb532_pata_port_ops = {
++static const struct ata_port_operations rb532_pata_port_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 	.sff_data_xfer		= ata_sff_data_xfer32,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_rdc.c linux-2.6.32.14/drivers/ata/pata_rdc.c
+--- linux-2.6.32.14/drivers/ata/pata_rdc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_rdc.c	2010-05-28 21:27:15.267180677 -0400
+@@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
+ 	pci_write_config_byte(dev, 0x48, udma_enable);
+ }
+ 
+-static struct ata_port_operations rdc_pata_ops = {
++static const struct ata_port_operations rdc_pata_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.cable_detect		= rdc_pata_cable_detect,
+ 	.set_piomode		= rdc_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_rz1000.c linux-2.6.32.14/drivers/ata/pata_rz1000.c
+--- linux-2.6.32.14/drivers/ata/pata_rz1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_rz1000.c	2010-05-28 21:27:15.267180677 -0400
+@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations rz1000_port_ops = {
++static const struct ata_port_operations rz1000_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.cable_detect	= ata_cable_40wire,
+ 	.set_mode	= rz1000_set_mode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_sc1200.c linux-2.6.32.14/drivers/ata/pata_sc1200.c
+--- linux-2.6.32.14/drivers/ata/pata_sc1200.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_sc1200.c	2010-05-28 21:27:15.267180677 -0400
+@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
+ 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
+ };
+ 
+-static struct ata_port_operations sc1200_port_ops = {
++static const struct ata_port_operations sc1200_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_prep 	= ata_sff_dumb_qc_prep,
+ 	.qc_issue	= sc1200_qc_issue,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_scc.c linux-2.6.32.14/drivers/ata/pata_scc.c
+--- linux-2.6.32.14/drivers/ata/pata_scc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_scc.c	2010-05-28 21:27:15.267180677 -0400
+@@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations scc_pata_ops = {
++static const struct ata_port_operations scc_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 
+ 	.set_piomode		= scc_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_sch.c linux-2.6.32.14/drivers/ata/pata_sch.c
+--- linux-2.6.32.14/drivers/ata/pata_sch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_sch.c	2010-05-28 21:27:15.267180677 -0400
+@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sch_pata_ops = {
++static const struct ata_port_operations sch_pata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.cable_detect		= ata_cable_unknown,
+ 	.set_piomode		= sch_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_serverworks.c linux-2.6.32.14/drivers/ata/pata_serverworks.c
+--- linux-2.6.32.14/drivers/ata/pata_serverworks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_serverworks.c	2010-05-28 21:27:15.267180677 -0400
+@@ -299,7 +299,7 @@ static struct scsi_host_template serverw
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations serverworks_osb4_port_ops = {
++static const struct ata_port_operations serverworks_osb4_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= serverworks_cable_detect,
+ 	.mode_filter	= serverworks_osb4_filter,
+@@ -307,7 +307,7 @@ static struct ata_port_operations server
+ 	.set_dmamode	= serverworks_set_dmamode,
+ };
+ 
+-static struct ata_port_operations serverworks_csb_port_ops = {
++static const struct ata_port_operations serverworks_csb_port_ops = {
+ 	.inherits	= &serverworks_osb4_port_ops,
+ 	.mode_filter	= serverworks_csb_filter,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_sil680.c linux-2.6.32.14/drivers/ata/pata_sil680.c
+--- linux-2.6.32.14/drivers/ata/pata_sil680.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_sil680.c	2010-05-28 21:27:15.267180677 -0400
+@@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sil680_port_ops = {
++static const struct ata_port_operations sil680_port_ops = {
+ 	.inherits	= &ata_bmdma32_port_ops,
+ 	.cable_detect	= sil680_cable_detect,
+ 	.set_piomode	= sil680_set_piomode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_sis.c linux-2.6.32.14/drivers/ata/pata_sis.c
+--- linux-2.6.32.14/drivers/ata/pata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_sis.c	2010-05-28 21:27:15.267180677 -0400
+@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_133_for_sata_ops = {
++static const struct ata_port_operations sis_133_for_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_base_ops = {
++static const struct ata_port_operations sis_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= sis_pre_reset,
+ };
+ 
+-static struct ata_port_operations sis_133_ops = {
++static const struct ata_port_operations sis_133_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_133_set_piomode,
+ 	.set_dmamode		= sis_133_set_dmamode,
+ 	.cable_detect		= sis_133_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_133_early_ops = {
++static const struct ata_port_operations sis_133_early_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_133_early_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_100_ops = {
++static const struct ata_port_operations sis_100_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_100_set_piomode,
+ 	.set_dmamode		= sis_100_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_66_ops = {
++static const struct ata_port_operations sis_66_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_66_set_dmamode,
+ 	.cable_detect		= sis_66_cable_detect,
+ };
+ 
+-static struct ata_port_operations sis_old_ops = {
++static const struct ata_port_operations sis_old_ops = {
+ 	.inherits		= &sis_base_ops,
+ 	.set_piomode		= sis_old_set_piomode,
+ 	.set_dmamode		= sis_old_set_dmamode,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_sl82c105.c linux-2.6.32.14/drivers/ata/pata_sl82c105.c
+--- linux-2.6.32.14/drivers/ata/pata_sl82c105.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_sl82c105.c	2010-05-28 21:27:15.267180677 -0400
+@@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sl82c105_port_ops = {
++static const struct ata_port_operations sl82c105_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.qc_defer	= sl82c105_qc_defer,
+ 	.bmdma_start 	= sl82c105_bmdma_start,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_triflex.c linux-2.6.32.14/drivers/ata/pata_triflex.c
+--- linux-2.6.32.14/drivers/ata/pata_triflex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_triflex.c	2010-05-28 21:27:15.267180677 -0400
+@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations triflex_port_ops = {
++static const struct ata_port_operations triflex_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.bmdma_start 	= triflex_bmdma_start,
+ 	.bmdma_stop	= triflex_bmdma_stop,
+diff -urNp linux-2.6.32.14/drivers/ata/pata_via.c linux-2.6.32.14/drivers/ata/pata_via.c
+--- linux-2.6.32.14/drivers/ata/pata_via.c	2010-04-29 17:49:37.709698369 -0400
++++ linux-2.6.32.14/drivers/ata/pata_via.c	2010-05-28 21:27:15.267180677 -0400
+@@ -419,7 +419,7 @@ static struct scsi_host_template via_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations via_port_ops = {
++static const struct ata_port_operations via_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 	.cable_detect	= via_cable_detect,
+ 	.set_piomode	= via_set_piomode,
+@@ -429,7 +429,7 @@ static struct ata_port_operations via_po
+ 	.port_start	= via_port_start,
+ };
+ 
+-static struct ata_port_operations via_port_ops_noirq = {
++static const struct ata_port_operations via_port_ops_noirq = {
+ 	.inherits	= &via_port_ops,
+ 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
+ };
+diff -urNp linux-2.6.32.14/drivers/ata/pata_winbond.c linux-2.6.32.14/drivers/ata/pata_winbond.c
+--- linux-2.6.32.14/drivers/ata/pata_winbond.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pata_winbond.c	2010-05-28 21:27:15.267180677 -0400
+@@ -125,7 +125,7 @@ static struct scsi_host_template winbond
+ 	ATA_PIO_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations winbond_port_ops = {
++static const struct ata_port_operations winbond_port_ops = {
+ 	.inherits	= &ata_sff_port_ops,
+ 	.sff_data_xfer	= winbond_data_xfer,
+ 	.cable_detect	= ata_cable_40wire,
+diff -urNp linux-2.6.32.14/drivers/ata/pdc_adma.c linux-2.6.32.14/drivers/ata/pdc_adma.c
+--- linux-2.6.32.14/drivers/ata/pdc_adma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/pdc_adma.c	2010-05-28 21:27:15.267180677 -0400
+@@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
+ 	.dma_boundary		= ADMA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations adma_ata_ops = {
++static const struct ata_port_operations adma_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_fsl.c linux-2.6.32.14/drivers/ata/sata_fsl.c
+--- linux-2.6.32.14/drivers/ata/sata_fsl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_fsl.c	2010-05-28 21:27:15.270965204 -0400
+@@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
+ 	.dma_boundary = ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sata_fsl_ops = {
++static const struct ata_port_operations sata_fsl_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer = ata_std_qc_defer,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_inic162x.c linux-2.6.32.14/drivers/ata/sata_inic162x.c
+--- linux-2.6.32.14/drivers/ata/sata_inic162x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_inic162x.c	2010-05-28 21:27:15.270965204 -0400
+@@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
+ 	return 0;
+ }
+ 
+-static struct ata_port_operations inic_port_ops = {
++static const struct ata_port_operations inic_port_ops = {
+ 	.inherits		= &sata_port_ops,
+ 
+ 	.check_atapi_dma	= inic_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_mv.c linux-2.6.32.14/drivers/ata/sata_mv.c
+--- linux-2.6.32.14/drivers/ata/sata_mv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_mv.c	2010-05-28 21:27:15.270965204 -0400
+@@ -656,7 +656,7 @@ static struct scsi_host_template mv6_sht
+ 	.dma_boundary		= MV_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations mv5_ops = {
++static const struct ata_port_operations mv5_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.lost_interrupt		= ATA_OP_NULL,
+@@ -678,7 +678,7 @@ static struct ata_port_operations mv5_op
+ 	.port_stop		= mv_port_stop,
+ };
+ 
+-static struct ata_port_operations mv6_ops = {
++static const struct ata_port_operations mv6_ops = {
+ 	.inherits		= &mv5_ops,
+ 	.dev_config             = mv6_dev_config,
+ 	.scr_read		= mv_scr_read,
+@@ -698,7 +698,7 @@ static struct ata_port_operations mv6_op
+ 	.bmdma_status		= mv_bmdma_status,
+ };
+ 
+-static struct ata_port_operations mv_iie_ops = {
++static const struct ata_port_operations mv_iie_ops = {
+ 	.inherits		= &mv6_ops,
+ 	.dev_config		= ATA_OP_NULL,
+ 	.qc_prep		= mv_qc_prep_iie,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_nv.c linux-2.6.32.14/drivers/ata/sata_nv.c
+--- linux-2.6.32.14/drivers/ata/sata_nv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_nv.c	2010-05-28 21:27:15.275100842 -0400
+@@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
+  * cases.  Define nv_hardreset() which only kicks in for post-boot
+  * probing and use it for all variants.
+  */
+-static struct ata_port_operations nv_generic_ops = {
++static const struct ata_port_operations nv_generic_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.lost_interrupt		= ATA_OP_NULL,
+ 	.scr_read		= nv_scr_read,
+@@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
+ 	.hardreset		= nv_hardreset,
+ };
+ 
+-static struct ata_port_operations nv_nf2_ops = {
++static const struct ata_port_operations nv_nf2_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_nf2_freeze,
+ 	.thaw			= nv_nf2_thaw,
+ };
+ 
+-static struct ata_port_operations nv_ck804_ops = {
++static const struct ata_port_operations nv_ck804_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 	.freeze			= nv_ck804_freeze,
+ 	.thaw			= nv_ck804_thaw,
+ 	.host_stop		= nv_ck804_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_adma_ops = {
++static const struct ata_port_operations nv_adma_ops = {
+ 	.inherits		= &nv_ck804_ops,
+ 
+ 	.check_atapi_dma	= nv_adma_check_atapi_dma,
+@@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
+ 	.host_stop		= nv_adma_host_stop,
+ };
+ 
+-static struct ata_port_operations nv_swncq_ops = {
++static const struct ata_port_operations nv_swncq_ops = {
+ 	.inherits		= &nv_generic_ops,
+ 
+ 	.qc_defer		= ata_std_qc_defer,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_promise.c linux-2.6.32.14/drivers/ata/sata_promise.c
+--- linux-2.6.32.14/drivers/ata/sata_promise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_promise.c	2010-05-28 21:27:15.275100842 -0400
+@@ -195,7 +195,7 @@ static const struct ata_port_operations 
+ 	.error_handler		= pdc_error_handler,
+ };
+ 
+-static struct ata_port_operations pdc_sata_ops = {
++static const struct ata_port_operations pdc_sata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_sata_cable_detect,
+ 	.freeze			= pdc_sata_freeze,
+@@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
+ 
+ /* First-generation chips need a more restrictive ->check_atapi_dma op,
+    and ->freeze/thaw that ignore the hotplug controls. */
+-static struct ata_port_operations pdc_old_sata_ops = {
++static const struct ata_port_operations pdc_old_sata_ops = {
+ 	.inherits		= &pdc_sata_ops,
+ 	.freeze			= pdc_freeze,
+ 	.thaw			= pdc_thaw,
+ 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
+ };
+ 
+-static struct ata_port_operations pdc_pata_ops = {
++static const struct ata_port_operations pdc_pata_ops = {
+ 	.inherits		= &pdc_common_ops,
+ 	.cable_detect		= pdc_pata_cable_detect,
+ 	.freeze			= pdc_freeze,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_qstor.c linux-2.6.32.14/drivers/ata/sata_qstor.c
+--- linux-2.6.32.14/drivers/ata/sata_qstor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_qstor.c	2010-05-28 21:27:15.275100842 -0400
+@@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
+ 	.dma_boundary		= QS_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations qs_ata_ops = {
++static const struct ata_port_operations qs_ata_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= qs_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_sil24.c linux-2.6.32.14/drivers/ata/sata_sil24.c
+--- linux-2.6.32.14/drivers/ata/sata_sil24.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_sil24.c	2010-05-28 21:27:15.275100842 -0400
+@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
+ 	.dma_boundary		= ATA_DMA_BOUNDARY,
+ };
+ 
+-static struct ata_port_operations sil24_ops = {
++static const struct ata_port_operations sil24_ops = {
+ 	.inherits		= &sata_pmp_port_ops,
+ 
+ 	.qc_defer		= sil24_qc_defer,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_sil.c linux-2.6.32.14/drivers/ata/sata_sil.c
+--- linux-2.6.32.14/drivers/ata/sata_sil.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_sil.c	2010-05-28 21:27:15.275100842 -0400
+@@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
+ 	.sg_tablesize		= ATA_MAX_PRD
+ };
+ 
+-static struct ata_port_operations sil_ops = {
++static const struct ata_port_operations sil_ops = {
+ 	.inherits		= &ata_bmdma32_port_ops,
+ 	.dev_config		= sil_dev_config,
+ 	.set_mode		= sil_set_mode,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_sis.c linux-2.6.32.14/drivers/ata/sata_sis.c
+--- linux-2.6.32.14/drivers/ata/sata_sis.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_sis.c	2010-05-28 21:27:15.275100842 -0400
+@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations sis_ops = {
++static const struct ata_port_operations sis_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= sis_scr_read,
+ 	.scr_write		= sis_scr_write,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_svw.c linux-2.6.32.14/drivers/ata/sata_svw.c
+--- linux-2.6.32.14/drivers/ata/sata_svw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_svw.c	2010-05-28 21:27:15.275100842 -0400
+@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
+ };
+ 
+ 
+-static struct ata_port_operations k2_sata_ops = {
++static const struct ata_port_operations k2_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= k2_sata_tf_load,
+ 	.sff_tf_read		= k2_sata_tf_read,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_sx4.c linux-2.6.32.14/drivers/ata/sata_sx4.c
+--- linux-2.6.32.14/drivers/ata/sata_sx4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_sx4.c	2010-05-28 21:27:15.275100842 -0400
+@@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
+ };
+ 
+ /* TODO: inherit from base port_ops after converting to new EH */
+-static struct ata_port_operations pdc_20621_ops = {
++static const struct ata_port_operations pdc_20621_ops = {
+ 	.inherits		= &ata_sff_port_ops,
+ 
+ 	.check_atapi_dma	= pdc_check_atapi_dma,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_uli.c linux-2.6.32.14/drivers/ata/sata_uli.c
+--- linux-2.6.32.14/drivers/ata/sata_uli.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_uli.c	2010-05-28 21:27:15.275100842 -0400
+@@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations uli_ops = {
++static const struct ata_port_operations uli_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.scr_read		= uli_scr_read,
+ 	.scr_write		= uli_scr_write,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_via.c linux-2.6.32.14/drivers/ata/sata_via.c
+--- linux-2.6.32.14/drivers/ata/sata_via.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_via.c	2010-05-28 21:27:15.275100842 -0400
+@@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations svia_base_ops = {
++static const struct ata_port_operations svia_base_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_tf_load		= svia_tf_load,
+ };
+ 
+-static struct ata_port_operations vt6420_sata_ops = {
++static const struct ata_port_operations vt6420_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.freeze			= svia_noop_freeze,
+ 	.prereset		= vt6420_prereset,
+ };
+ 
+-static struct ata_port_operations vt6421_pata_ops = {
++static const struct ata_port_operations vt6421_pata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.cable_detect		= vt6421_pata_cable_detect,
+ 	.set_piomode		= vt6421_set_pio_mode,
+ 	.set_dmamode		= vt6421_set_dma_mode,
+ };
+ 
+-static struct ata_port_operations vt6421_sata_ops = {
++static const struct ata_port_operations vt6421_sata_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.scr_read		= svia_scr_read,
+ 	.scr_write		= svia_scr_write,
+ };
+ 
+-static struct ata_port_operations vt8251_ops = {
++static const struct ata_port_operations vt8251_ops = {
+ 	.inherits		= &svia_base_ops,
+ 	.hardreset		= sata_std_hardreset,
+ 	.scr_read		= vt8251_scr_read,
+diff -urNp linux-2.6.32.14/drivers/ata/sata_vsc.c linux-2.6.32.14/drivers/ata/sata_vsc.c
+--- linux-2.6.32.14/drivers/ata/sata_vsc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ata/sata_vsc.c	2010-05-28 21:27:15.275100842 -0400
+@@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
+ };
+ 
+ 
+-static struct ata_port_operations vsc_sata_ops = {
++static const struct ata_port_operations vsc_sata_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	/* The IRQ handling is not quite standard SFF behaviour so we
+ 	   cannot use the default lost interrupt handler */
+diff -urNp linux-2.6.32.14/drivers/atm/adummy.c linux-2.6.32.14/drivers/atm/adummy.c
+--- linux-2.6.32.14/drivers/atm/adummy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/adummy.c	2010-05-28 21:27:15.275100842 -0400
+@@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct 
+ 		vcc->pop(vcc, skb);
+ 	else
+ 		dev_kfree_skb_any(skb);
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/drivers/atm/ambassador.c linux-2.6.32.14/drivers/atm/ambassador.c
+--- linux-2.6.32.14/drivers/atm/ambassador.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/ambassador.c	2010-05-28 21:27:15.283225651 -0400
+@@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev, 
+   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
+   
+   // VC layer stats
+-  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+   
+   // free the descriptor
+   kfree (tx_descr);
+@@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev, 
+ 	  dump_skb ("<<<", vc, skb);
+ 	  
+ 	  // VC layer stats
+-	  atomic_inc(&atm_vcc->stats->rx);
++	  atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  atm_vcc->push (atm_vcc, skb);
+@@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev, 
+       } else {
+       	PRINTK (KERN_INFO, "dropped over-size frame");
+ 	// should we count this?
+-	atomic_inc(&atm_vcc->stats->rx_drop);
++	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+       }
+       
+     } else {
+@@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
+   }
+   
+   if (check_area (skb->data, skb->len)) {
+-    atomic_inc(&atm_vcc->stats->tx_err);
++    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
+     return -ENOMEM; // ?
+   }
+   
+diff -urNp linux-2.6.32.14/drivers/atm/atmtcp.c linux-2.6.32.14/drivers/atm/atmtcp.c
+--- linux-2.6.32.14/drivers/atm/atmtcp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/atmtcp.c	2010-05-28 21:27:15.287736634 -0400
+@@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+ 		if (dev_data) return 0;
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOLINK;
+ 	}
+ 	size = skb->len+sizeof(struct atmtcp_hdr);
+@@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (!new_skb) {
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOBUFS;
+ 	}
+ 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
+@@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc 
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ 	return 0;
+ }
+ 
+@@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
+ 	read_unlock(&vcc_sklist_lock);
+ 	if (!out_vcc) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		goto done;
+ 	}
+ 	skb_pull(skb,sizeof(struct atmtcp_hdr));
+@@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc 
+ 	__net_timestamp(new_skb);
+ 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
+ 	out_vcc->push(out_vcc,new_skb);
+-	atomic_inc(&vcc->stats->tx);
+-	atomic_inc(&out_vcc->stats->rx);
++	atomic_inc_unchecked(&vcc->stats->tx);
++	atomic_inc_unchecked(&out_vcc->stats->rx);
+ done:
+ 	if (vcc->pop) vcc->pop(vcc,skb);
+ 	else dev_kfree_skb(skb);
+diff -urNp linux-2.6.32.14/drivers/atm/eni.c linux-2.6.32.14/drivers/atm/eni.c
+--- linux-2.6.32.14/drivers/atm/eni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/eni.c	2010-05-28 21:27:15.299117902 -0400
+@@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
+ 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
+ 		    vcc->dev->number);
+ 		length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		length = ATM_CELL_SIZE-1; /* no HEC */
+@@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    size);
+ 		}
+ 		eff = length = 0;
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	}
+ 	else {
+ 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
+@@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
+ 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
+ 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
+ 			length = eff = 0;
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		}
+ 	}
+ 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
+@@ -770,7 +770,7 @@ rx_dequeued++;
+ 			vcc->push(vcc,skb);
+ 			pushed++;
+ 		}
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	wake_up(&eni_dev->rx_wait);
+ }
+@@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
+ 		    PCI_DMA_TODEVICE);
+ 		if (vcc->pop) vcc->pop(vcc,skb);
+ 		else dev_kfree_skb_irq(skb);
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 		wake_up(&eni_dev->tx_wait);
+ dma_complete++;
+ 	}
+diff -urNp linux-2.6.32.14/drivers/atm/firestream.c linux-2.6.32.14/drivers/atm/firestream.c
+--- linux-2.6.32.14/drivers/atm/firestream.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/firestream.c	2010-05-28 21:27:15.303175631 -0400
+@@ -748,7 +748,7 @@ static void process_txdone_queue (struct
+ 				}
+ 			}
+ 
+-			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 
+ 			fs_dprintk (FS_DEBUG_TXMEM, "i");
+ 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
+@@ -815,7 +815,7 @@ static void process_incoming (struct fs_
+ #endif
+ 				skb_put (skb, qe->p1 & 0xffff); 
+ 				ATM_SKB(skb)->vcc = atm_vcc;
+-				atomic_inc(&atm_vcc->stats->rx);
++				atomic_inc_unchecked(&atm_vcc->stats->rx);
+ 				__net_timestamp(skb);
+ 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
+ 				atm_vcc->push (atm_vcc, skb);
+@@ -836,12 +836,12 @@ static void process_incoming (struct fs_
+ 				kfree (pe);
+ 			}
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		case 0x1f: /*  Reassembly abort: no buffers. */
+ 			/* Silently increment error counter. */
+ 			if (atm_vcc)
+-				atomic_inc(&atm_vcc->stats->rx_drop);
++				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
+ 			break;
+ 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
+ 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
+diff -urNp linux-2.6.32.14/drivers/atm/fore200e.c linux-2.6.32.14/drivers/atm/fore200e.c
+--- linux-2.6.32.14/drivers/atm/fore200e.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/fore200e.c	2010-05-28 21:27:15.311169155 -0400
+@@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
+ #endif
+ 		/* check error condition */
+ 		if (*entry->status & STATUS_ERROR)
+-		    atomic_inc(&vcc->stats->tx_err);
++		    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		else
+-		    atomic_inc(&vcc->stats->tx);
++		    atomic_inc_unchecked(&vcc->stats->tx);
+ 	    }
+ 	}
+ 
+@@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
+     if (skb == NULL) {
+ 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     } 
+ 
+@@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
+ 
+ 	dev_kfree_skb_any(skb);
+ 
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return -ENOMEM;
+     }
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+     vcc->push(vcc, skb);
+-    atomic_inc(&vcc->stats->rx);
++    atomic_inc_unchecked(&vcc->stats->rx);
+ 
+     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
+ 
+@@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
+ 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
+ 			fore200e->atm_dev->number,
+ 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	    }
+ 	}
+ 
+@@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
+ 		goto retry_here;
+ 	    }
+ 
+-	    atomic_inc(&vcc->stats->tx_err);
++	    atomic_inc_unchecked(&vcc->stats->tx_err);
+ 
+ 	    fore200e->tx_sat++;
+ 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
+diff -urNp linux-2.6.32.14/drivers/atm/he.c linux-2.6.32.14/drivers/atm/he.c
+--- linux-2.6.32.14/drivers/atm/he.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/he.c	2010-05-28 21:27:15.311169155 -0400
+@@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 
+ 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
+ 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
+-				atomic_inc(&vcc->stats->rx_drop);
++				atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 				RBRQ_LEN_ERR(he_dev->rbrq_head)
+ 							? "LEN_ERR" : "",
+ 							vcc->vpi, vcc->vci);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto return_host_buffers;
+ 		}
+ 
+@@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
+ 		vcc->push(vcc, skb);
+ 		spin_lock(&he_dev->global_lock);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ return_host_buffers:
+ 		++pdus_assembled;
+@@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
+ 					tpd->vcc->pop(tpd->vcc, tpd->skb);
+ 				else
+ 					dev_kfree_skb_any(tpd->skb);
+-				atomic_inc(&tpd->vcc->stats->tx_err);
++				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
+ 			}
+ 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
+ 			return;
+@@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -EINVAL;
+ 	}
+ #endif
+@@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 			vcc->pop(vcc, skb);
+ 		else
+ 			dev_kfree_skb_any(skb);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 		return -ENOMEM;
+ 	}
+@@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 					vcc->pop(vcc, skb);
+ 				else
+ 					dev_kfree_skb_any(skb);
+-				atomic_inc(&vcc->stats->tx_err);
++				atomic_inc_unchecked(&vcc->stats->tx_err);
+ 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 				return -ENOMEM;
+ 			}
+@@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
+ 	__enqueue_tpd(he_dev, tpd, cid);
+ 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
+ 
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/drivers/atm/horizon.c linux-2.6.32.14/drivers/atm/horizon.c
+--- linux-2.6.32.14/drivers/atm/horizon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/horizon.c	2010-05-28 21:27:15.311169155 -0400
+@@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev, 
+ 	{
+ 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
+ 	  // VC layer stats
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+ 	  __net_timestamp(skb);
+ 	  // end of our responsability
+ 	  vcc->push (vcc, skb);
+@@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
+ 	dev->tx_iovec = NULL;
+ 	
+ 	// VC layer stats
+-	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
++	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
+ 	
+ 	// free the skb
+ 	hrz_kfree_skb (skb);
+diff -urNp linux-2.6.32.14/drivers/atm/idt77252.c linux-2.6.32.14/drivers/atm/idt77252.c
+--- linux-2.6.32.14/drivers/atm/idt77252.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/idt77252.c	2010-05-28 21:27:15.326952874 -0400
+@@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
+ 		else
+ 			dev_kfree_skb(skb);
+ 
+-		atomic_inc(&vcc->stats->tx);
++		atomic_inc_unchecked(&vcc->stats->tx);
+ 	}
+ 
+ 	atomic_dec(&scq->used);
+@@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			if ((sb = dev_alloc_skb(64)) == NULL) {
+ 				printk("%s: Can't allocate buffers for aal0.\n",
+ 				       card->name);
+-				atomic_add(i, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i, &vcc->stats->rx_drop);
+ 				break;
+ 			}
+ 			if (!atm_charge(vcc, sb->truesize)) {
+ 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
+ 					 card->name);
+-				atomic_add(i - 1, &vcc->stats->rx_drop);
++				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
+ 				dev_kfree_skb(sb);
+ 				break;
+ 			}
+@@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			ATM_SKB(sb)->vcc = vcc;
+ 			__net_timestamp(sb);
+ 			vcc->push(vcc, sb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			cell += ATM_CELL_PAYLOAD;
+ 		}
+@@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			         "(CDC: %08x)\n",
+ 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (stat & SAR_RSQE_CRC) {
+ 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
+ 			recycle_rx_pool_skb(card, rpp);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			return;
+ 		}
+ 		if (skb_queue_len(&rpp->queue) > 1) {
+@@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 				RXPRINTK("%s: Can't alloc RX skb.\n",
+ 					 card->name);
+ 				recycle_rx_pool_skb(card, rpp);
+-				atomic_inc(&vcc->stats->rx_err);
++				atomic_inc_unchecked(&vcc->stats->rx_err);
+ 				return;
+ 			}
+ 			if (!atm_charge(vcc, skb->truesize)) {
+@@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 			__net_timestamp(skb);
+ 
+ 			vcc->push(vcc, skb);
+-			atomic_inc(&vcc->stats->rx);
++			atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 			return;
+ 		}
+@@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
+ 		__net_timestamp(skb);
+ 
+ 		vcc->push(vcc, skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ 		if (skb->truesize > SAR_FB_SIZE_3)
+ 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
+@@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		if (vcc->qos.aal != ATM_AAL0) {
+ 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
+ 				card->name, vpi, vci);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto drop;
+ 		}
+ 	
+ 		if ((sb = dev_alloc_skb(64)) == NULL) {
+ 			printk("%s: Can't allocate buffers for AAL0.\n",
+ 			       card->name);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto drop;
+ 		}
+ 
+@@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
+ 		ATM_SKB(sb)->vcc = vcc;
+ 		__net_timestamp(sb);
+ 		vcc->push(vcc, sb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 
+ drop:
+ 		skb_pull(queue, 64);
+@@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	if (vc == NULL) {
+ 		printk("%s: NULL connection in send().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 	if (!test_bit(VCF_TX, &vc->flags)) {
+ 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 		break;
+ 	default:
+ 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+ 
+ 	if (skb_shinfo(skb)->nr_frags != 0) {
+ 		printk("%s: No scatter-gather yet.\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return -EINVAL;
+ 	}
+@@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
+ 
+ 	err = queue_skb(card, vc, skb, oam);
+ 	if (err) {
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		dev_kfree_skb(skb);
+ 		return err;
+ 	}
+@@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
+ 	skb = dev_alloc_skb(64);
+ 	if (!skb) {
+ 		printk("%s: Out of memory in send_oam().\n", card->name);
+-		atomic_inc(&vcc->stats->tx_err);
++		atomic_inc_unchecked(&vcc->stats->tx_err);
+ 		return -ENOMEM;
+ 	}
+ 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+diff -urNp linux-2.6.32.14/drivers/atm/iphase.c linux-2.6.32.14/drivers/atm/iphase.c
+--- linux-2.6.32.14/drivers/atm/iphase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/iphase.c	2010-05-28 21:27:15.326952874 -0400
+@@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	status = (u_short) (buf_desc_ptr->desc_mode);  
+ 	if (status & (RX_CER | RX_PTE | RX_OFL))  
+ 	{  
+-                atomic_inc(&vcc->stats->rx_err);
++                atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		IF_ERR(printk("IA: bad packet, dropping it");)  
+                 if (status & RX_CER) { 
+                     IF_ERR(printk(" cause: packet CRC error\n");)
+@@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)  
+ 	len = dma_addr - buf_addr;  
+         if (len > iadev->rx_buf_sz) {
+            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
+-           atomic_inc(&vcc->stats->rx_err);
++           atomic_inc_unchecked(&vcc->stats->rx_err);
+ 	   goto out_free_desc;
+         }
+ 		  
+@@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
+           ia_vcc = INPH_IA_VCC(vcc);
+           if (ia_vcc == NULL)
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              dev_kfree_skb_any(skb);
+              atm_return(vcc, atm_guess_pdu2truesize(len));
+              goto INCR_DLE;
+@@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
+           if ((length > iadev->rx_buf_sz) || (length > 
+                               (skb->len - sizeof(struct cpcs_trailer))))
+           {
+-             atomic_inc(&vcc->stats->rx_err);
++             atomic_inc_unchecked(&vcc->stats->rx_err);
+              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
+                                                             length, skb->len);)
+              dev_kfree_skb_any(skb);
+@@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
+ 
+ 	  IF_RX(printk("rx_dle_intr: skb push");)  
+ 	  vcc->push(vcc,skb);  
+-	  atomic_inc(&vcc->stats->rx);
++	  atomic_inc_unchecked(&vcc->stats->rx);
+           iadev->rx_pkt_cnt++;
+       }  
+ INCR_DLE:
+@@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
+          {
+              struct k_sonet_stats *stats;
+              stats = &PRIV(_ia_dev[board])->sonet_stats;
+-             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
+-             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
+-             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
+-             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
+-             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
+-             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
+-             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
+-             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
+-             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
++             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
++             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
++             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
++             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
++             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
++             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
++             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
++             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
++             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
+          }
+             ia_cmds.status = 0;
+             break;
+@@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
+ 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
+ 	{  
+ 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
+-                atomic_inc(&vcc->stats->tx);
++                atomic_inc_unchecked(&vcc->stats->tx);
+ 		if (vcc->pop)   
+ 		    vcc->pop(vcc, skb);   
+ 		else  
+@@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
+         ATM_DESC(skb) = vcc->vci;
+         skb_queue_tail(&iadev->tx_dma_q, skb);
+ 
+-        atomic_inc(&vcc->stats->tx);
++        atomic_inc_unchecked(&vcc->stats->tx);
+         iadev->tx_pkt_cnt++;
+ 	/* Increment transaction counter */  
+ 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
+         
+ #if 0        
+         /* add flow control logic */ 
+-        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
++        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
+           if (iavcc->vc_desc_cnt > 10) {
+              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
+             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
+diff -urNp linux-2.6.32.14/drivers/atm/lanai.c linux-2.6.32.14/drivers/atm/lanai.c
+--- linux-2.6.32.14/drivers/atm/lanai.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/lanai.c	2010-05-28 21:27:15.331218290 -0400
+@@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
+ 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
+ 	lanai_endtx(lanai, lvcc);
+ 	lanai_free_skb(lvcc->tx.atmvcc, skb);
+-	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
++	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
+ }
+ 
+ /* Try to fill the buffer - don't call unless there is backlog */
+@@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
+ 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
+ 	__net_timestamp(skb);
+ 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
+     out:
+ 	lvcc->rx.buf.ptr = end;
+ 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
+@@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
+ 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
+ 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
+ 		lanai->stats.service_rxnotaal5++;
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		return 0;
+ 	}
+ 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
+@@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
+ 		int bytes;
+ 		read_unlock(&vcc_sklist_lock);
+ 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_trash++;
+ 		bytes = (SERVICE_GET_END(s) * 16) -
+ 		    (((unsigned long) lvcc->rx.buf.ptr) -
+@@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
+ 	}
+ 	if (s & SERVICE_STREAM) {
+ 		read_unlock(&vcc_sklist_lock);
+-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 		lvcc->stats.x.aal5.service_stream++;
+ 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
+ 		    "PDU on VCI %d!\n", lanai->number, vci);
+@@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
+ 		return 0;
+ 	}
+ 	DPRINTK("got rx crc error on vci %d\n", vci);
+-	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
++	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
+ 	lvcc->stats.x.aal5.service_rxcrc++;
+ 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
+ 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
+diff -urNp linux-2.6.32.14/drivers/atm/nicstar.c linux-2.6.32.14/drivers/atm/nicstar.c
+--- linux-2.6.32.14/drivers/atm/nicstar.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/nicstar.c	2010-05-28 21:27:15.368039837 -0400
+@@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if ((vc = (vc_map *) vcc->dev_data) == NULL)
+    {
+       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (!vc->tx)
+    {
+       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
+    {
+       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc, 
+    if (skb_shinfo(skb)->nr_frags != 0)
+    {
+       printk("nicstar%d: No scatter-gather yet.\n", card->index);
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EINVAL;
+    }
+@@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc, 
+ 
+    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
+    {
+-      atomic_inc(&vcc->stats->tx_err);
++      atomic_inc_unchecked(&vcc->stats->tx_err);
+       dev_kfree_skb_any(skb);
+       return -EIO;
+    }
+-   atomic_inc(&vcc->stats->tx);
++   atomic_inc_unchecked(&vcc->stats->tx);
+ 
+    return 0;
+ }
+@@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
+          {
+             printk("nicstar%d: Can't allocate buffers for aal0.\n",
+                    card->index);
+-            atomic_add(i,&vcc->stats->rx_drop);
++            atomic_add_unchecked(i,&vcc->stats->rx_drop);
+             break;
+          }
+          if (!atm_charge(vcc, sb->truesize))
+          {
+             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
+                      card->index);
+-            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
++            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
+             dev_kfree_skb_any(sb);
+             break;
+          }
+@@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          ATM_SKB(sb)->vcc = vcc;
+ 	 __net_timestamp(sb);
+          vcc->push(vcc, sb);
+-         atomic_inc(&vcc->stats->rx);
++         atomic_inc_unchecked(&vcc->stats->rx);
+          cell += ATM_CELL_PAYLOAD;
+       }
+ 
+@@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ 	 if (iovb == NULL)
+ 	 {
+ 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+             recycle_rx_buf(card, skb);
+             return;
+ 	 }
+@@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
+    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
+    {
+       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
+-      atomic_inc(&vcc->stats->rx_err);
++      atomic_inc_unchecked(&vcc->stats->rx_err);
+       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
+       NS_SKB(iovb)->iovcnt = 0;
+       iovb->len = 0;
+@@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_rx_buf(card, skb);
+          vc->rx_iov = NULL;
+          recycle_iov_buf(card, iovb);
+@@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
+ 	        card->index);
+          which_list(card, skb);
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                       NS_SKB(iovb)->iovcnt);
+          vc->rx_iov = NULL;
+@@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             printk(" - PDU size mismatch.\n");
+          else
+             printk(".\n");
+-         atomic_inc(&vcc->stats->rx_err);
++         atomic_inc_unchecked(&vcc->stats->rx_err);
+          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	   NS_SKB(iovb)->iovcnt);
+ 	 vc->rx_iov = NULL;
+@@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
+          if (!atm_charge(vcc, skb->truesize))
+          {
+             push_rxbufs(card, skb);
+-            atomic_inc(&vcc->stats->rx_drop);
++            atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             ATM_SKB(skb)->vcc = vcc;
+ 	    __net_timestamp(skb);
+             vcc->push(vcc, skb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
+@@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, sb->truesize))
+             {
+                push_rxbufs(card, sb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+ 	    {
+@@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(sb)->vcc = vcc;
+ 	       __net_timestamp(sb);
+                vcc->push(vcc, sb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, skb);
+@@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (!atm_charge(vcc, skb->truesize))
+             {
+                push_rxbufs(card, skb);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+             }
+             else
+             {
+@@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
+                ATM_SKB(skb)->vcc = vcc;
+ 	       __net_timestamp(skb);
+                vcc->push(vcc, skb);
+-               atomic_inc(&vcc->stats->rx);
++               atomic_inc_unchecked(&vcc->stats->rx);
+             }
+ 
+             push_rxbufs(card, sb);
+@@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             if (hb == NULL)
+             {
+                printk("nicstar%d: Out of huge buffers.\n", card->index);
+-               atomic_inc(&vcc->stats->rx_drop);
++               atomic_inc_unchecked(&vcc->stats->rx_drop);
+                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
+ 	                             NS_SKB(iovb)->iovcnt);
+                vc->rx_iov = NULL;
+@@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
+             }
+ 	    else
+ 	       dev_kfree_skb_any(hb);
+-	    atomic_inc(&vcc->stats->rx_drop);
++	    atomic_inc_unchecked(&vcc->stats->rx_drop);
+          }
+          else
+ 	 {
+@@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
+ #endif /* NS_USE_DESTRUCTORS */
+ 	    __net_timestamp(hb);
+             vcc->push(vcc, hb);
+-            atomic_inc(&vcc->stats->rx);
++            atomic_inc_unchecked(&vcc->stats->rx);
+          }
+       }
+ 
+diff -urNp linux-2.6.32.14/drivers/atm/solos-pci.c linux-2.6.32.14/drivers/atm/solos-pci.c
+--- linux-2.6.32.14/drivers/atm/solos-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/solos-pci.c	2010-05-28 21:27:15.368039837 -0400
+@@ -708,7 +708,7 @@ void solos_bh(unsigned long card_arg)
+ 				}
+ 				atm_charge(vcc, skb->truesize);
+ 				vcc->push(vcc, skb);
+-				atomic_inc(&vcc->stats->rx);
++				atomic_inc_unchecked(&vcc->stats->rx);
+ 				break;
+ 
+ 			case PKT_STATUS:
+@@ -1011,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
+ 			vcc = SKB_CB(oldskb)->vcc;
+ 
+ 			if (vcc) {
+-				atomic_inc(&vcc->stats->tx);
++				atomic_inc_unchecked(&vcc->stats->tx);
+ 				solos_pop(vcc, oldskb);
+ 			} else
+ 				dev_kfree_skb_irq(oldskb);
+diff -urNp linux-2.6.32.14/drivers/atm/suni.c linux-2.6.32.14/drivers/atm/suni.c
+--- linux-2.6.32.14/drivers/atm/suni.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/suni.c	2010-05-28 21:27:15.368039837 -0400
+@@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    atomic_add((v),&stats->s); \
+-    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
++    atomic_add_unchecked((v),&stats->s); \
++    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
+ 
+ 
+ static void suni_hz(unsigned long from_timer)
+diff -urNp linux-2.6.32.14/drivers/atm/uPD98402.c linux-2.6.32.14/drivers/atm/uPD98402.c
+--- linux-2.6.32.14/drivers/atm/uPD98402.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/uPD98402.c	2010-05-28 21:27:15.368039837 -0400
+@@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
+ 	struct sonet_stats tmp;
+  	int error = 0;
+ 
+-	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
++	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
+ 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
+ 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
+ 	if (zero && !error) {
+@@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
+ 
+ 
+ #define ADD_LIMITED(s,v) \
+-    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
+-    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
+-	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
++    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
++    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
+ 
+ 
+ static void stat_event(struct atm_dev *dev)
+@@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev 
+ 		if (reason & uPD98402_INT_PFM) stat_event(dev);
+ 		if (reason & uPD98402_INT_PCO) {
+ 			(void) GET(PCOCR); /* clear interrupt cause */
+-			atomic_add(GET(HECCT),
++			atomic_add_unchecked(GET(HECCT),
+ 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
+ 		}
+ 		if ((reason & uPD98402_INT_RFO) && 
+@@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
+ 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
+ 	  uPD98402_INT_LOS),PIMR); /* enable them */
+ 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
+-	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
+-	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
++	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.14/drivers/atm/zatm.c linux-2.6.32.14/drivers/atm/zatm.c
+--- linux-2.6.32.14/drivers/atm/zatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/atm/zatm.c	2010-05-28 21:27:15.375178174 -0400
+@@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		}
+ 		if (!size) {
+ 			dev_kfree_skb_irq(skb);
+-			if (vcc) atomic_inc(&vcc->stats->rx_err);
++			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			continue;
+ 		}
+ 		if (!atm_charge(vcc,skb->truesize)) {
+@@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
+ 		skb->len = size;
+ 		ATM_SKB(skb)->vcc = vcc;
+ 		vcc->push(vcc,skb);
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	}
+ 	zout(pos & 0xffff,MTA(mbx));
+ #if 0 /* probably a stupid idea */
+@@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
+ 			skb_queue_head(&zatm_vcc->backlog,skb);
+ 			break;
+ 		}
+-	atomic_inc(&vcc->stats->tx);
++	atomic_inc_unchecked(&vcc->stats->tx);
+ 	wake_up(&zatm_vcc->tx_wait);
+ }
+ 
+diff -urNp linux-2.6.32.14/drivers/base/bus.c linux-2.6.32.14/drivers/base/bus.c
+--- linux-2.6.32.14/drivers/base/bus.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/base/bus.c	2010-05-28 21:27:15.383215309 -0400
+@@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops driver_sysfs_ops = {
++static const struct sysfs_ops driver_sysfs_ops = {
+ 	.show	= drv_attr_show,
+ 	.store	= drv_attr_store,
+ };
+@@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops bus_sysfs_ops = {
++static const struct sysfs_ops bus_sysfs_ops = {
+ 	.show	= bus_attr_show,
+ 	.store	= bus_attr_store,
+ };
+@@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops bus_uevent_ops = {
++static const struct kset_uevent_ops bus_uevent_ops = {
+ 	.filter = bus_uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/base/class.c linux-2.6.32.14/drivers/base/class.c
+--- linux-2.6.32.14/drivers/base/class.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/base/class.c	2010-05-28 21:27:15.383215309 -0400
+@@ -63,7 +63,7 @@ static void class_release(struct kobject
+ 	kfree(cp);
+ }
+ 
+-static struct sysfs_ops class_sysfs_ops = {
++static const struct sysfs_ops class_sysfs_ops = {
+ 	.show	= class_attr_show,
+ 	.store	= class_attr_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/base/core.c linux-2.6.32.14/drivers/base/core.c
+--- linux-2.6.32.14/drivers/base/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/base/core.c	2010-05-28 21:27:15.386909095 -0400
+@@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops dev_sysfs_ops = {
++static const struct sysfs_ops dev_sysfs_ops = {
+ 	.show	= dev_attr_show,
+ 	.store	= dev_attr_store,
+ };
+@@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops device_uevent_ops = {
++static const struct kset_uevent_ops device_uevent_ops = {
+ 	.filter =	dev_uevent_filter,
+ 	.name =		dev_uevent_name,
+ 	.uevent =	dev_uevent,
+diff -urNp linux-2.6.32.14/drivers/base/memory.c linux-2.6.32.14/drivers/base/memory.c
+--- linux-2.6.32.14/drivers/base/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/base/memory.c	2010-05-28 21:27:15.386909095 -0400
+@@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
+ 	return retval;
+ }
+ 
+-static struct kset_uevent_ops memory_uevent_ops = {
++static const struct kset_uevent_ops memory_uevent_ops = {
+ 	.name		= memory_uevent_name,
+ 	.uevent		= memory_uevent,
+ };
+diff -urNp linux-2.6.32.14/drivers/base/sys.c linux-2.6.32.14/drivers/base/sys.c
+--- linux-2.6.32.14/drivers/base/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/base/sys.c	2010-05-28 21:27:15.395045412 -0400
+@@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= sysdev_show,
+ 	.store	= sysdev_store,
+ };
+@@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops sysfs_class_ops = {
++static const struct sysfs_ops sysfs_class_ops = {
+ 	.show	= sysdev_class_show,
+ 	.store	= sysdev_class_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/block/pktcdvd.c linux-2.6.32.14/drivers/block/pktcdvd.c
+--- linux-2.6.32.14/drivers/block/pktcdvd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/block/pktcdvd.c	2010-05-28 21:27:15.403194679 -0400
+@@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
+ 	return len;
+ }
+ 
+-static struct sysfs_ops kobj_pkt_ops = {
++static const struct sysfs_ops kobj_pkt_ops = {
+ 	.show = kobj_pkt_show,
+ 	.store = kobj_pkt_store
+ };
+diff -urNp linux-2.6.32.14/drivers/char/agp/frontend.c linux-2.6.32.14/drivers/char/agp/frontend.c
+--- linux-2.6.32.14/drivers/char/agp/frontend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/agp/frontend.c	2010-05-28 21:27:15.403194679 -0400
+@@ -824,7 +824,7 @@ static int agpioc_reserve_wrap(struct ag
+ 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
+ 		return -EFAULT;
+ 
+-	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
++	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
+ 		return -EFAULT;
+ 
+ 	client = agp_find_client_by_pid(reserve.pid);
+diff -urNp linux-2.6.32.14/drivers/char/agp/intel-agp.c linux-2.6.32.14/drivers/char/agp/intel-agp.c
+--- linux-2.6.32.14/drivers/char/agp/intel-agp.c	2010-04-29 17:49:37.777981896 -0400
++++ linux-2.6.32.14/drivers/char/agp/intel-agp.c	2010-05-28 21:27:15.403194679 -0400
+@@ -2564,7 +2564,7 @@ static struct pci_device_id agp_intel_pc
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+ 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
+diff -urNp linux-2.6.32.14/drivers/char/hpet.c linux-2.6.32.14/drivers/char/hpet.c
+--- linux-2.6.32.14/drivers/char/hpet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hpet.c	2010-05-28 21:27:15.403194679 -0400
+@@ -430,7 +430,7 @@ static int hpet_release(struct inode *in
+ 	return 0;
+ }
+ 
+-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
++static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
+ 
+ static int
+ hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+@@ -550,7 +550,7 @@ static inline unsigned long hpet_time_di
+ }
+ 
+ static int
+-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
++hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
+ {
+ 	struct hpet_timer __iomem *timer;
+ 	struct hpet __iomem *hpet;
+@@ -998,7 +998,7 @@ static struct acpi_driver hpet_acpi_driv
+ 		},
+ };
+ 
+-static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
++static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
+ 
+ static int __init hpet_init(void)
+ {
+diff -urNp linux-2.6.32.14/drivers/char/hvc_beat.c linux-2.6.32.14/drivers/char/hvc_beat.c
+--- linux-2.6.32.14/drivers/char/hvc_beat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_beat.c	2010-05-28 21:27:15.403194679 -0400
+@@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
+ 	return cnt;
+ }
+ 
+-static struct hv_ops hvc_beat_get_put_ops = {
++static const struct hv_ops hvc_beat_get_put_ops = {
+ 	.get_chars = hvc_beat_get_chars,
+ 	.put_chars = hvc_beat_put_chars,
+ };
+diff -urNp linux-2.6.32.14/drivers/char/hvc_console.c linux-2.6.32.14/drivers/char/hvc_console.c
+--- linux-2.6.32.14/drivers/char/hvc_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_console.c	2010-05-28 21:27:15.403194679 -0400
+@@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
+  * console interfaces but can still be used as a tty device.  This has to be
+  * static because kmalloc will not work during early console init.
+  */
+-static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
++static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
+ static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
+ 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
+ 
+@@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
+  * vty adapters do NOT get an hvc_instantiate() callback since they
+  * appear after early console init.
+  */
+-int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
++int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
+ {
+ 	struct hvc_struct *hp;
+ 
+@@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
+ };
+ 
+ struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
+-					struct hv_ops *ops, int outbuf_size)
++					const struct hv_ops *ops, int outbuf_size)
+ {
+ 	struct hvc_struct *hp;
+ 	int i;
+diff -urNp linux-2.6.32.14/drivers/char/hvc_console.h linux-2.6.32.14/drivers/char/hvc_console.h
+--- linux-2.6.32.14/drivers/char/hvc_console.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_console.h	2010-05-28 21:27:15.403194679 -0400
+@@ -55,7 +55,7 @@ struct hvc_struct {
+ 	int outbuf_size;
+ 	int n_outbuf;
+ 	uint32_t vtermno;
+-	struct hv_ops *ops;
++	const struct hv_ops *ops;
+ 	int irq_requested;
+ 	int data;
+ 	struct winsize ws;
+@@ -76,11 +76,11 @@ struct hv_ops {
+ };
+ 
+ /* Register a vterm and a slot index for use as a console (console_init) */
+-extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
++extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
+ 
+ /* register a vterm for hvc tty operation (module_init or hotplug add) */
+ extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
+-				struct hv_ops *ops, int outbuf_size);
++				const struct hv_ops *ops, int outbuf_size);
+ /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
+ extern int hvc_remove(struct hvc_struct *hp);
+ 
+diff -urNp linux-2.6.32.14/drivers/char/hvc_iseries.c linux-2.6.32.14/drivers/char/hvc_iseries.c
+--- linux-2.6.32.14/drivers/char/hvc_iseries.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_iseries.c	2010-05-28 21:27:15.403194679 -0400
+@@ -197,7 +197,7 @@ done:
+ 	return sent;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = get_chars,
+ 	.put_chars = put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.14/drivers/char/hvc_iucv.c linux-2.6.32.14/drivers/char/hvc_iucv.c
+--- linux-2.6.32.14/drivers/char/hvc_iucv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_iucv.c	2010-05-28 21:27:15.403194679 -0400
+@@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
+ 
+ 
+ /* HVC operations */
+-static struct hv_ops hvc_iucv_ops = {
++static const struct hv_ops hvc_iucv_ops = {
+ 	.get_chars = hvc_iucv_get_chars,
+ 	.put_chars = hvc_iucv_put_chars,
+ 	.notifier_add = hvc_iucv_notifier_add,
+diff -urNp linux-2.6.32.14/drivers/char/hvc_rtas.c linux-2.6.32.14/drivers/char/hvc_rtas.c
+--- linux-2.6.32.14/drivers/char/hvc_rtas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_rtas.c	2010-05-28 21:27:15.407096871 -0400
+@@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_rtas_get_put_ops = {
++static const struct hv_ops hvc_rtas_get_put_ops = {
+ 	.get_chars = hvc_rtas_read_console,
+ 	.put_chars = hvc_rtas_write_console,
+ };
+diff -urNp linux-2.6.32.14/drivers/char/hvcs.c linux-2.6.32.14/drivers/char/hvcs.c
+--- linux-2.6.32.14/drivers/char/hvcs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvcs.c	2010-05-28 21:27:15.407096871 -0400
+@@ -269,7 +269,7 @@ struct hvcs_struct {
+ 	unsigned int index;
+ 
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 
+ 	/*
+ 	 * Used to tell the driver kernel_thread what operations need to take
+@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 
+-	if (hvcsd->open_count > 0) {
++	if (atomic_read(&hvcsd->open_count) > 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
+ 				"The hvcs device node is still in use.\n");
+@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
+ 		if ((retval = hvcs_partner_connect(hvcsd)))
+ 			goto error_release;
+ 
+-	hvcsd->open_count = 1;
++	atomic_set(&hvcsd->open_count, 1);
+ 	hvcsd->tty = tty;
+ 	tty->driver_data = hvcsd;
+ 
+@@ -1169,7 +1169,7 @@ fast_open:
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	kref_get(&hvcsd->kref);
+-	hvcsd->open_count++;
++	atomic_inc(&hvcsd->open_count);
+ 	hvcsd->todo_mask |= HVCS_SCHED_READ;
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 
+@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
+ 	hvcsd = tty->driver_data;
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+-	if (--hvcsd->open_count == 0) {
++	if (atomic_dec_and_test(&hvcsd->open_count)) {
+ 
+ 		vio_disable_interrupts(hvcsd->vdev);
+ 
+@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
+ 		free_irq(irq, hvcsd);
+ 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
+ 		return;
+-	} else if (hvcsd->open_count < 0) {
++	} else if (atomic_read(&hvcsd->open_count) < 0) {
+ 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
+ 				" is missmanaged.\n",
+-		hvcsd->vdev->unit_address, hvcsd->open_count);
++		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
+ 	}
+ 
+ 	spin_unlock_irqrestore(&hvcsd->lock, flags);
+@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
+ 
+ 	spin_lock_irqsave(&hvcsd->lock, flags);
+ 	/* Preserve this so that we know how many kref refs to put */
+-	temp_open_count = hvcsd->open_count;
++	temp_open_count = atomic_read(&hvcsd->open_count);
+ 
+ 	/*
+ 	 * Don't kref put inside the spinlock because the destruction
+@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
+ 	hvcsd->tty->driver_data = NULL;
+ 	hvcsd->tty = NULL;
+ 
+-	hvcsd->open_count = 0;
++	atomic_set(&hvcsd->open_count, 0);
+ 
+ 	/* This will drop any buffered data on the floor which is OK in a hangup
+ 	 * scenario. */
+@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
+ 	 * the middle of a write operation?  This is a crummy place to do this
+ 	 * but we want to keep it all in the spinlock.
+ 	 */
+-	if (hvcsd->open_count <= 0) {
++	if (atomic_read(&hvcsd->open_count) <= 0) {
+ 		spin_unlock_irqrestore(&hvcsd->lock, flags);
+ 		return -ENODEV;
+ 	}
+@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
+ {
+ 	struct hvcs_struct *hvcsd = tty->driver_data;
+ 
+-	if (!hvcsd || hvcsd->open_count <= 0)
++	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
+ 		return 0;
+ 
+ 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
+diff -urNp linux-2.6.32.14/drivers/char/hvc_udbg.c linux-2.6.32.14/drivers/char/hvc_udbg.c
+--- linux-2.6.32.14/drivers/char/hvc_udbg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_udbg.c	2010-05-28 21:27:15.407096871 -0400
+@@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
+ 	return i;
+ }
+ 
+-static struct hv_ops hvc_udbg_ops = {
++static const struct hv_ops hvc_udbg_ops = {
+ 	.get_chars = hvc_udbg_get,
+ 	.put_chars = hvc_udbg_put,
+ };
+diff -urNp linux-2.6.32.14/drivers/char/hvc_vio.c linux-2.6.32.14/drivers/char/hvc_vio.c
+--- linux-2.6.32.14/drivers/char/hvc_vio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_vio.c	2010-05-28 21:27:15.407096871 -0400
+@@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
+ 	return got;
+ }
+ 
+-static struct hv_ops hvc_get_put_ops = {
++static const struct hv_ops hvc_get_put_ops = {
+ 	.get_chars = filtered_get_chars,
+ 	.put_chars = hvc_put_chars,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.14/drivers/char/hvc_xen.c linux-2.6.32.14/drivers/char/hvc_xen.c
+--- linux-2.6.32.14/drivers/char/hvc_xen.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/hvc_xen.c	2010-05-28 21:27:15.407096871 -0400
+@@ -120,7 +120,7 @@ static int read_console(uint32_t vtermno
+ 	return recv;
+ }
+ 
+-static struct hv_ops hvc_ops = {
++static const struct hv_ops hvc_ops = {
+ 	.get_chars = read_console,
+ 	.put_chars = write_console,
+ 	.notifier_add = notifier_add_irq,
+diff -urNp linux-2.6.32.14/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.14/drivers/char/ipmi/ipmi_msghandler.c
+--- linux-2.6.32.14/drivers/char/ipmi/ipmi_msghandler.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/ipmi/ipmi_msghandler.c	2010-05-28 21:27:15.407096871 -0400
+@@ -414,7 +414,7 @@ struct ipmi_smi {
+ 	struct proc_dir_entry *proc_dir;
+ 	char                  proc_dir_name[10];
+ 
+-	atomic_t stats[IPMI_NUM_STATS];
++	atomic_unchecked_t stats[IPMI_NUM_STATS];
+ 
+ 	/*
+ 	 * run_to_completion duplicate of smb_info, smi_info
+@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
+ 
+ 
+ #define ipmi_inc_stat(intf, stat) \
+-	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
++	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
+ #define ipmi_get_stat(intf, stat) \
+-	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
+ 
+ static int is_lan_addr(struct ipmi_addr *addr)
+ {
+@@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
+ 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
+ 	init_waitqueue_head(&intf->waitq);
+ 	for (i = 0; i < IPMI_NUM_STATS; i++)
+-		atomic_set(&intf->stats[i], 0);
++		atomic_set_unchecked(&intf->stats[i], 0);
+ 
+ 	intf->proc_dir = NULL;
+ 
+diff -urNp linux-2.6.32.14/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.14/drivers/char/ipmi/ipmi_si_intf.c
+--- linux-2.6.32.14/drivers/char/ipmi/ipmi_si_intf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/ipmi/ipmi_si_intf.c	2010-05-28 21:27:15.407096871 -0400
+@@ -277,7 +277,7 @@ struct smi_info {
+ 	unsigned char slave_addr;
+ 
+ 	/* Counters and things for the proc filesystem. */
+-	atomic_t stats[SI_NUM_STATS];
++	atomic_unchecked_t stats[SI_NUM_STATS];
+ 
+ 	struct task_struct *thread;
+ 
+@@ -285,9 +285,9 @@ struct smi_info {
+ };
+ 
+ #define smi_inc_stat(smi, stat) \
+-	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
++	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
+ #define smi_get_stat(smi, stat) \
+-	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
++	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
+ 
+ #define SI_MAX_PARMS 4
+ 
+@@ -2926,7 +2926,7 @@ static int try_smi_init(struct smi_info 
+ 	atomic_set(&new_smi->req_events, 0);
+ 	new_smi->run_to_completion = 0;
+ 	for (i = 0; i < SI_NUM_STATS; i++)
+-		atomic_set(&new_smi->stats[i], 0);
++		atomic_set_unchecked(&new_smi->stats[i], 0);
+ 
+ 	new_smi->interrupt_disabled = 0;
+ 	atomic_set(&new_smi->stop_operation, 0);
+diff -urNp linux-2.6.32.14/drivers/char/keyboard.c linux-2.6.32.14/drivers/char/keyboard.c
+--- linux-2.6.32.14/drivers/char/keyboard.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/keyboard.c	2010-05-28 21:27:15.407096871 -0400
+@@ -635,6 +635,16 @@ static void k_spec(struct vc_data *vc, u
+ 	     kbd->kbdmode == VC_MEDIUMRAW) &&
+ 	     value != KVAL(K_SAK))
+ 		return;		/* SAK is allowed even in raw mode */
++
++#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
++	{
++		void *func = fn_handler[value];
++		if (func == fn_show_state || func == fn_show_ptregs ||
++		    func == fn_show_mem)
++			return;
++	}
++#endif
++
+ 	fn_handler[value](vc);
+ }
+ 
+@@ -1386,7 +1396,7 @@ static const struct input_device_id kbd_
+                 .evbit = { BIT_MASK(EV_SND) },
+         },
+ 
+-	{ },    /* Terminating entry */
++	{ 0 },    /* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE(input, kbd_ids);
+diff -urNp linux-2.6.32.14/drivers/char/mem.c linux-2.6.32.14/drivers/char/mem.c
+--- linux-2.6.32.14/drivers/char/mem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/mem.c	2010-05-28 21:27:15.407096871 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/raw.h>
+ #include <linux/tty.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/ptrace.h>
+ #include <linux/device.h>
+ #include <linux/highmem.h>
+@@ -35,6 +36,10 @@
+ # include <linux/efi.h>
+ #endif
+ 
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++extern struct file_operations grsec_fops;
++#endif
++
+ static inline unsigned long size_inside_page(unsigned long start,
+ 					     unsigned long size)
+ {
+@@ -205,6 +210,11 @@ static ssize_t write_mem(struct file * f
+ 	if (!valid_phys_addr_range(p, count))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_mem_write();
++	return -EPERM;
++#endif
++
+ 	written = 0;
+ 
+ #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
+@@ -337,6 +347,11 @@ static int mmap_mem(struct file * file, 
+ 						&vma->vm_page_prot))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
++		return -EPERM;
++#endif
++
+ 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
+ 						 size,
+ 						 vma->vm_page_prot);
+@@ -560,6 +575,11 @@ static ssize_t write_kmem(struct file * 
+ 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+ 	int err = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_kmem_write();
++	return -EPERM;
++#endif
++
+ 	if (p < (unsigned long) high_memory) {
+ 
+ 		wrote = count;
+@@ -765,6 +785,16 @@ static loff_t memory_lseek(struct file *
+ 
+ static int open_port(struct inode * inode, struct file * filp)
+ {
++#ifdef CONFIG_GRKERNSEC_KMEM
++	gr_handle_open_port();
++	return -EPERM;
++#endif
++
++	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
++}
++
++static int open_mem(struct inode * inode, struct file * filp)
++{
+ 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
+ }
+ 
+@@ -772,7 +802,6 @@ static int open_port(struct inode * inod
+ #define full_lseek      null_lseek
+ #define write_zero	write_null
+ #define read_full       read_zero
+-#define open_mem	open_port
+ #define open_kmem	open_mem
+ #define open_oldmem	open_mem
+ 
+@@ -888,6 +917,9 @@ static const struct memdev {
+ #ifdef CONFIG_CRASH_DUMP
+ 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
+ #endif
++#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
++	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
++#endif
+ };
+ 
+ static int memory_open(struct inode *inode, struct file *filp)
+diff -urNp linux-2.6.32.14/drivers/char/nvram.c linux-2.6.32.14/drivers/char/nvram.c
+--- linux-2.6.32.14/drivers/char/nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/nvram.c	2010-05-28 21:27:15.407096871 -0400
+@@ -429,7 +429,10 @@ static const struct file_operations nvra
+ static struct miscdevice nvram_dev = {
+ 	NVRAM_MINOR,
+ 	"nvram",
+-	&nvram_fops
++	&nvram_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static int __init nvram_init(void)
+diff -urNp linux-2.6.32.14/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.14/drivers/char/pcmcia/ipwireless/tty.c
+--- linux-2.6.32.14/drivers/char/pcmcia/ipwireless/tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/pcmcia/ipwireless/tty.c	2010-05-28 21:27:15.407096871 -0400
+@@ -51,7 +51,7 @@ struct ipw_tty {
+ 	int tty_type;
+ 	struct ipw_network *network;
+ 	struct tty_struct *linux_tty;
+-	int open_count;
++	atomic_t open_count;
+ 	unsigned int control_lines;
+ 	struct mutex ipw_tty_mutex;
+ 	int tx_bytes_queued;
+@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -ENODEV;
+ 	}
+-	if (tty->open_count == 0)
++	if (atomic_read(&tty->open_count) == 0)
+ 		tty->tx_bytes_queued = 0;
+ 
+-	tty->open_count++;
++	atomic_inc(&tty->open_count);
+ 
+ 	tty->linux_tty = linux_tty;
+ 	linux_tty->driver_data = tty;
+@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
+ 
+ static void do_ipw_close(struct ipw_tty *tty)
+ {
+-	tty->open_count--;
+-
+-	if (tty->open_count == 0) {
++	if (atomic_dec_return(&tty->open_count) == 0) {
+ 		struct tty_struct *linux_tty = tty->linux_tty;
+ 
+ 		if (linux_tty != NULL) {
+@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
+ 		return;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (tty->open_count == 0) {
++	if (atomic_read(&tty->open_count) == 0) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
+ 		return;
+ 	}
+ 
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return;
+ 	}
+@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
+ 		return -ENODEV;
+ 
+ 	mutex_lock(&tty->ipw_tty_mutex);
+-	if (!tty->open_count) {
++	if (!atomic_read(&tty->open_count)) {
+ 		mutex_unlock(&tty->ipw_tty_mutex);
+ 		return -EINVAL;
+ 	}
+@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
+@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
+ 	if (!tty)
+ 		return 0;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return 0;
+ 
+ 	return tty->tx_bytes_queued;
+@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return get_control_lines(tty);
+@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	return set_control_lines(tty, set, clear);
+@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
+ 	if (!tty)
+ 		return -ENODEV;
+ 
+-	if (!tty->open_count)
++	if (!atomic_read(&tty->open_count))
+ 		return -EINVAL;
+ 
+ 	/* FIXME: Exactly how is the tty object locked here .. */
+@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
+ 				   against a parallel ioctl etc */
+ 				mutex_lock(&ttyj->ipw_tty_mutex);
+ 			}
+-			while (ttyj->open_count)
++			while (atomic_read(&ttyj->open_count))
+ 				do_ipw_close(ttyj);
+ 			ipwireless_disassociate_network_ttys(network,
+ 							     ttyj->channel_idx);
+diff -urNp linux-2.6.32.14/drivers/char/pty.c linux-2.6.32.14/drivers/char/pty.c
+--- linux-2.6.32.14/drivers/char/pty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/pty.c	2010-05-28 21:27:15.411167470 -0400
+@@ -682,7 +682,18 @@ static int ptmx_open(struct inode *inode
+ 	return ret;
+ }
+ 
+-static struct file_operations ptmx_fops;
++static const struct file_operations ptmx_fops = {
++	.llseek		= no_llseek,
++	.read		= tty_read,
++	.write		= tty_write,
++	.poll		= tty_poll,
++	.unlocked_ioctl	= tty_ioctl,
++	.compat_ioctl	= tty_compat_ioctl,
++	.open		= ptmx_open,
++	.release	= tty_release,
++	.fasync		= tty_fasync,
++};
++
+ 
+ static void __init unix98_pty_init(void)
+ {
+@@ -736,9 +747,6 @@ static void __init unix98_pty_init(void)
+ 	register_sysctl_table(pty_root_table);
+ 
+ 	/* Now create the /dev/ptmx special device */
+-	tty_default_fops(&ptmx_fops);
+-	ptmx_fops.open = ptmx_open;
+-
+ 	cdev_init(&ptmx_cdev, &ptmx_fops);
+ 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
+ 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
+diff -urNp linux-2.6.32.14/drivers/char/random.c linux-2.6.32.14/drivers/char/random.c
+--- linux-2.6.32.14/drivers/char/random.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/random.c	2010-05-28 21:27:15.411167470 -0400
+@@ -254,8 +254,13 @@
+ /*
+  * Configuration information
+  */
++#ifdef CONFIG_GRKERNSEC_RANDNET
++#define INPUT_POOL_WORDS 512
++#define OUTPUT_POOL_WORDS 128
++#else
+ #define INPUT_POOL_WORDS 128
+ #define OUTPUT_POOL_WORDS 32
++#endif
+ #define SEC_XFER_SIZE 512
+ 
+ /*
+@@ -292,10 +297,17 @@ static struct poolinfo {
+ 	int poolwords;
+ 	int tap1, tap2, tap3, tap4, tap5;
+ } poolinfo_table[] = {
++#ifdef CONFIG_GRKERNSEC_RANDNET
++	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
++	{ 512,	411,	308,	208,	104,	1 },
++	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
++	{ 128,	103,	76,	51,	25,	1 },
++#else
+ 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
+ 	{ 128,	103,	76,	51,	25,	1 },
+ 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
+ 	{ 32,	26,	20,	14,	7,	1 },
++#endif
+ #if 0
+ 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
+ 	{ 2048,	1638,	1231,	819,	411,	1 },
+@@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
+ #include <linux/sysctl.h>
+ 
+ static int min_read_thresh = 8, min_write_thresh;
+-static int max_read_thresh = INPUT_POOL_WORDS * 32;
++static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
+ static int max_write_thresh = INPUT_POOL_WORDS * 32;
+ static char sysctl_bootid[16];
+ 
+diff -urNp linux-2.6.32.14/drivers/char/sonypi.c linux-2.6.32.14/drivers/char/sonypi.c
+--- linux-2.6.32.14/drivers/char/sonypi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/sonypi.c	2010-05-28 21:27:15.411167470 -0400
+@@ -491,7 +491,7 @@ static struct sonypi_device {
+ 	spinlock_t fifo_lock;
+ 	wait_queue_head_t fifo_proc_list;
+ 	struct fasync_struct *fifo_async;
+-	int open_count;
++	atomic_t open_count;
+ 	int model;
+ 	struct input_dev *input_jog_dev;
+ 	struct input_dev *input_key_dev;
+@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
+ static int sonypi_misc_release(struct inode *inode, struct file *file)
+ {
+ 	mutex_lock(&sonypi_device.lock);
+-	sonypi_device.open_count--;
++	atomic_dec(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	return 0;
+ }
+@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
+ 	lock_kernel();
+ 	mutex_lock(&sonypi_device.lock);
+ 	/* Flush input queue on first open */
+-	if (!sonypi_device.open_count)
++	if (!atomic_read(&sonypi_device.open_count))
+ 		kfifo_reset(sonypi_device.fifo);
+-	sonypi_device.open_count++;
++	atomic_inc(&sonypi_device.open_count);
+ 	mutex_unlock(&sonypi_device.lock);
+ 	unlock_kernel();
+ 	return 0;
+diff -urNp linux-2.6.32.14/drivers/char/tpm/tpm_bios.c linux-2.6.32.14/drivers/char/tpm/tpm_bios.c
+--- linux-2.6.32.14/drivers/char/tpm/tpm_bios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/tpm/tpm_bios.c	2010-05-28 21:27:15.411167470 -0400
+@@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
+ 	event = addr;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	return addr;
+@@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
+ 		return NULL;
+ 
+ 	if ((event->event_type == 0 && event->event_size == 0) ||
+-	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
++	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
+ 		return NULL;
+ 
+ 	(*pos)++;
+@@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
+ 	int i;
+ 
+ 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
+-		seq_putc(m, data[i]);
++		if (!seq_putc(m, data[i]))
++			return -EFAULT;
+ 
+ 	return 0;
+ }
+@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log 
+ 	log->bios_event_log_end = log->bios_event_log + len;
+ 
+ 	virt = acpi_os_map_memory(start, len);
++	if (!virt) {
++		kfree(log->bios_event_log);
++		log->bios_event_log = NULL;
++		return -EFAULT;
++	}
+ 
+ 	memcpy(log->bios_event_log, virt, len);
+ 
+diff -urNp linux-2.6.32.14/drivers/char/tty_io.c linux-2.6.32.14/drivers/char/tty_io.c
+--- linux-2.6.32.14/drivers/char/tty_io.c	2010-04-29 17:49:37.826084348 -0400
++++ linux-2.6.32.14/drivers/char/tty_io.c	2010-05-28 21:27:15.411167470 -0400
+@@ -136,21 +136,10 @@ LIST_HEAD(tty_drivers);			/* linked list
+ DEFINE_MUTEX(tty_mutex);
+ EXPORT_SYMBOL(tty_mutex);
+ 
+-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
+-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
+ ssize_t redirected_tty_write(struct file *, const char __user *,
+ 							size_t, loff_t *);
+-static unsigned int tty_poll(struct file *, poll_table *);
+ static int tty_open(struct inode *, struct file *);
+-static int tty_release(struct inode *, struct file *);
+ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+-#ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+-				unsigned long arg);
+-#else
+-#define tty_compat_ioctl NULL
+-#endif
+-static int tty_fasync(int fd, struct file *filp, int on);
+ static void release_tty(struct tty_struct *tty, int idx);
+ static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+ static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
+@@ -870,7 +859,7 @@ EXPORT_SYMBOL(start_tty);
+  *	read calls may be outstanding in parallel.
+  */
+ 
+-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
++ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 			loff_t *ppos)
+ {
+ 	int i;
+@@ -898,6 +887,8 @@ static ssize_t tty_read(struct file *fil
+ 	return i;
+ }
+ 
++EXPORT_SYMBOL(tty_read);
++
+ void tty_write_unlock(struct tty_struct *tty)
+ {
+ 	mutex_unlock(&tty->atomic_write_lock);
+@@ -1045,7 +1036,7 @@ void tty_write_message(struct tty_struct
+  *	write method will not be invoked in parallel for each device.
+  */
+ 
+-static ssize_t tty_write(struct file *file, const char __user *buf,
++ssize_t tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+ 	struct tty_struct *tty;
+@@ -1072,6 +1063,8 @@ static ssize_t tty_write(struct file *fi
+ 	return ret;
+ }
+ 
++EXPORT_SYMBOL(tty_write);
++
+ ssize_t redirected_tty_write(struct file *file, const char __user *buf,
+ 						size_t count, loff_t *ppos)
+ {
+@@ -1867,7 +1860,7 @@ static int tty_open(struct inode *inode,
+  *		Takes bkl. See tty_release_dev
+  */
+ 
+-static int tty_release(struct inode *inode, struct file *filp)
++int tty_release(struct inode *inode, struct file *filp)
+ {
+ 	lock_kernel();
+ 	tty_release_dev(filp);
+@@ -1875,6 +1868,8 @@ static int tty_release(struct inode *ino
+ 	return 0;
+ }
+ 
++EXPORT_SYMBOL(tty_release);
++
+ /**
+  *	tty_poll	-	check tty status
+  *	@filp: file being polled
+@@ -1887,7 +1882,7 @@ static int tty_release(struct inode *ino
+  *	may be re-entered freely by other callers.
+  */
+ 
+-static unsigned int tty_poll(struct file *filp, poll_table *wait)
++unsigned int tty_poll(struct file *filp, poll_table *wait)
+ {
+ 	struct tty_struct *tty;
+ 	struct tty_ldisc *ld;
+@@ -1904,7 +1899,9 @@ static unsigned int tty_poll(struct file
+ 	return ret;
+ }
+ 
+-static int tty_fasync(int fd, struct file *filp, int on)
++EXPORT_SYMBOL(tty_poll);
++
++int tty_fasync(int fd, struct file *filp, int on)
+ {
+ 	struct tty_struct *tty;
+ 	unsigned long flags;
+@@ -1948,6 +1945,8 @@ out:
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_fasync);
++
+ /**
+  *	tiocsti			-	fake input character
+  *	@tty: tty to fake input into
+@@ -2582,8 +2581,10 @@ long tty_ioctl(struct file *file, unsign
+ 	return retval;
+ }
+ 
++EXPORT_SYMBOL(tty_ioctl);
++
+ #ifdef CONFIG_COMPAT
+-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
++long tty_compat_ioctl(struct file *file, unsigned int cmd,
+ 				unsigned long arg)
+ {
+ 	struct inode *inode = file->f_dentry->d_inode;
+@@ -2607,6 +2608,8 @@ static long tty_compat_ioctl(struct file
+ 
+ 	return retval;
+ }
++
++EXPORT_SYMBOL(tty_compat_ioctl);
+ #endif
+ 
+ /*
+@@ -3050,11 +3053,6 @@ struct tty_struct *get_current_tty(void)
+ }
+ EXPORT_SYMBOL_GPL(get_current_tty);
+ 
+-void tty_default_fops(struct file_operations *fops)
+-{
+-	*fops = tty_fops;
+-}
+-
+ /*
+  * Initialize the console device. This is called *early*, so
+  * we can't necessarily depend on lots of kernel help here.
+diff -urNp linux-2.6.32.14/drivers/char/tty_ldisc.c linux-2.6.32.14/drivers/char/tty_ldisc.c
+--- linux-2.6.32.14/drivers/char/tty_ldisc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/tty_ldisc.c	2010-05-28 21:27:15.411167470 -0400
+@@ -73,7 +73,7 @@ static void put_ldisc(struct tty_ldisc *
+ 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+ 		struct tty_ldisc_ops *ldo = ld->ops;
+ 
+-		ldo->refcount--;
++		atomic_dec(&ldo->refcount);
+ 		module_put(ldo->owner);
+ 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+@@ -107,7 +107,7 @@ int tty_register_ldisc(int disc, struct 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+ 	tty_ldiscs[disc] = new_ldisc;
+ 	new_ldisc->num = disc;
+-	new_ldisc->refcount = 0;
++	atomic_set(&new_ldisc->refcount, 0);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ 
+ 	return ret;
+@@ -135,7 +135,7 @@ int tty_unregister_ldisc(int disc)
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	if (tty_ldiscs[disc]->refcount)
++	if (atomic_read(&tty_ldiscs[disc]->refcount))
+ 		ret = -EBUSY;
+ 	else
+ 		tty_ldiscs[disc] = NULL;
+@@ -156,7 +156,7 @@ static struct tty_ldisc_ops *get_ldops(i
+ 	if (ldops) {
+ 		ret = ERR_PTR(-EAGAIN);
+ 		if (try_module_get(ldops->owner)) {
+-			ldops->refcount++;
++			atomic_inc(&ldops->refcount);
+ 			ret = ldops;
+ 		}
+ 	}
+@@ -169,7 +169,7 @@ static void put_ldops(struct tty_ldisc_o
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&tty_ldisc_lock, flags);
+-	ldops->refcount--;
++	atomic_dec(&ldops->refcount);
+ 	module_put(ldops->owner);
+ 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
+ }
+diff -urNp linux-2.6.32.14/drivers/char/virtio_console.c linux-2.6.32.14/drivers/char/virtio_console.c
+--- linux-2.6.32.14/drivers/char/virtio_console.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/virtio_console.c	2010-05-28 21:27:15.411167470 -0400
+@@ -44,6 +44,7 @@ static unsigned int in_len;
+ static char *in, *inbuf;
+ 
+ /* The operations for our console. */
++/* cannot be const */
+ static struct hv_ops virtio_cons;
+ 
+ /* The hvc device */
+diff -urNp linux-2.6.32.14/drivers/char/vt_ioctl.c linux-2.6.32.14/drivers/char/vt_ioctl.c
+--- linux-2.6.32.14/drivers/char/vt_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/char/vt_ioctl.c	2010-05-28 21:27:15.414917676 -0400
+@@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
+ 	case KDSKBENT:
+ 		if (!perm)
+ 			return -EPERM;
++
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG))
++			return -EPERM;
++#endif
++
+ 		if (!i && v == K_NOSUCHMAP) {
+ 			/* deallocate map */
+ 			key_map = key_maps[s];
+@@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry 
+ 			goto reterr;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC
++		if (!capable(CAP_SYS_TTY_CONFIG)) {
++			ret = -EPERM;
++			goto reterr;
++		}
++#endif
++
+ 		q = func_table[i];
+ 		first_free = funcbufptr + (funcbufsize - funcbufleft);
+ 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++) 
+diff -urNp linux-2.6.32.14/drivers/cpufreq/cpufreq.c linux-2.6.32.14/drivers/cpufreq/cpufreq.c
+--- linux-2.6.32.14/drivers/cpufreq/cpufreq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/cpufreq/cpufreq.c	2010-05-28 21:27:15.418968453 -0400
+@@ -750,7 +750,7 @@ static void cpufreq_sysfs_release(struct
+ 	complete(&policy->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops sysfs_ops = {
++static const struct sysfs_ops sysfs_ops = {
+ 	.show	= show,
+ 	.store	= store,
+ };
+diff -urNp linux-2.6.32.14/drivers/cpuidle/sysfs.c linux-2.6.32.14/drivers/cpuidle/sysfs.c
+--- linux-2.6.32.14/drivers/cpuidle/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/cpuidle/sysfs.c	2010-05-28 21:27:15.418968453 -0400
+@@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_sysfs_ops = {
++static const struct sysfs_ops cpuidle_sysfs_ops = {
+ 	.show = cpuidle_show,
+ 	.store = cpuidle_store,
+ };
+@@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops cpuidle_state_sysfs_ops = {
++static const struct sysfs_ops cpuidle_state_sysfs_ops = {
+ 	.show = cpuidle_state_show,
+ };
+ 
+@@ -294,7 +294,7 @@ static struct kobj_type ktype_state_cpui
+ 	.release = cpuidle_state_sysfs_release,
+ };
+ 
+-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
++static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
+ {
+ 	kobject_put(&device->kobjs[i]->kobj);
+ 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
+diff -urNp linux-2.6.32.14/drivers/dma/ioat/dma.c linux-2.6.32.14/drivers/dma/ioat/dma.c
+--- linux-2.6.32.14/drivers/dma/ioat/dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/dma/ioat/dma.c	2010-05-28 21:27:15.418968453 -0400
+@@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
+ 	return entry->show(&chan->common, page);
+ }
+ 
+-struct sysfs_ops ioat_sysfs_ops = {
++const struct sysfs_ops ioat_sysfs_ops = {
+ 	.show	= ioat_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/dma/ioat/dma.h linux-2.6.32.14/drivers/dma/ioat/dma.h
+--- linux-2.6.32.14/drivers/dma/ioat/dma.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/dma/ioat/dma.h	2010-05-28 21:27:15.418968453 -0400
+@@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
+ 			   unsigned long *phys_complete);
+ void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
+ void ioat_kobject_del(struct ioatdma_device *device);
+-extern struct sysfs_ops ioat_sysfs_ops;
++extern const struct sysfs_ops ioat_sysfs_ops;
+ extern struct ioat_sysfs_entry ioat_version_attr;
+ extern struct ioat_sysfs_entry ioat_cap_attr;
+ #endif /* IOATDMA_H */
+diff -urNp linux-2.6.32.14/drivers/edac/edac_core.h linux-2.6.32.14/drivers/edac/edac_core.h
+--- linux-2.6.32.14/drivers/edac/edac_core.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/edac/edac_core.h	2010-05-28 21:27:15.418968453 -0400
+@@ -99,11 +99,11 @@ extern int edac_debug_level;
+ 
+ #else				/* !CONFIG_EDAC_DEBUG */
+ 
+-#define debugf0( ... )
+-#define debugf1( ... )
+-#define debugf2( ... )
+-#define debugf3( ... )
+-#define debugf4( ... )
++#define debugf0( ... ) do {} while (0)
++#define debugf1( ... ) do {} while (0)
++#define debugf2( ... ) do {} while (0)
++#define debugf3( ... ) do {} while (0)
++#define debugf4( ... ) do {} while (0)
+ 
+ #endif				/* !CONFIG_EDAC_DEBUG */
+ 
+diff -urNp linux-2.6.32.14/drivers/edac/edac_device_sysfs.c linux-2.6.32.14/drivers/edac/edac_device_sysfs.c
+--- linux-2.6.32.14/drivers/edac/edac_device_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/edac/edac_device_sysfs.c	2010-05-28 21:27:15.418968453 -0400
+@@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
+ }
+ 
+ /* edac_dev file operations for an 'ctl_info' */
+-static struct sysfs_ops device_ctl_info_ops = {
++static const struct sysfs_ops device_ctl_info_ops = {
+ 	.show = edac_dev_ctl_info_show,
+ 	.store = edac_dev_ctl_info_store
+ };
+@@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
+ }
+ 
+ /* edac_dev file operations for an 'instance' */
+-static struct sysfs_ops device_instance_ops = {
++static const struct sysfs_ops device_instance_ops = {
+ 	.show = edac_dev_instance_show,
+ 	.store = edac_dev_instance_store
+ };
+@@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
+ }
+ 
+ /* edac_dev file operations for a 'block' */
+-static struct sysfs_ops device_block_ops = {
++static const struct sysfs_ops device_block_ops = {
+ 	.show = edac_dev_block_show,
+ 	.store = edac_dev_block_store
+ };
+diff -urNp linux-2.6.32.14/drivers/edac/edac_mc_sysfs.c linux-2.6.32.14/drivers/edac/edac_mc_sysfs.c
+--- linux-2.6.32.14/drivers/edac/edac_mc_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/edac/edac_mc_sysfs.c	2010-05-28 21:27:15.418968453 -0400
+@@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops csrowfs_ops = {
++static const struct sysfs_ops csrowfs_ops = {
+ 	.show = csrowdev_show,
+ 	.store = csrowdev_store
+ };
+@@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
+ }
+ 
+ /* Intermediate show/store table */
+-static struct sysfs_ops mci_ops = {
++static const struct sysfs_ops mci_ops = {
+ 	.show = mcidev_show,
+ 	.store = mcidev_store
+ };
+diff -urNp linux-2.6.32.14/drivers/edac/edac_pci_sysfs.c linux-2.6.32.14/drivers/edac/edac_pci_sysfs.c
+--- linux-2.6.32.14/drivers/edac/edac_pci_sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/edac/edac_pci_sysfs.c	2010-05-28 21:27:15.418968453 -0400
+@@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
+ }
+ 
+ /* fs_ops table */
+-static struct sysfs_ops pci_instance_ops = {
++static const struct sysfs_ops pci_instance_ops = {
+ 	.show = edac_pci_instance_show,
+ 	.store = edac_pci_instance_store
+ };
+@@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
+ 	return -EIO;
+ }
+ 
+-static struct sysfs_ops edac_pci_sysfs_ops = {
++static const struct sysfs_ops edac_pci_sysfs_ops = {
+ 	.show = edac_pci_dev_show,
+ 	.store = edac_pci_dev_store
+ };
+diff -urNp linux-2.6.32.14/drivers/firewire/core-cdev.c linux-2.6.32.14/drivers/firewire/core-cdev.c
+--- linux-2.6.32.14/drivers/firewire/core-cdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firewire/core-cdev.c	2010-05-28 21:27:15.422980793 -0400
+@@ -1141,8 +1141,7 @@ static int init_iso_resource(struct clie
+ 	int ret;
+ 
+ 	if ((request->channels == 0 && request->bandwidth == 0) ||
+-	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
+-	    request->bandwidth < 0)
++	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
+ 		return -EINVAL;
+ 
+ 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
+diff -urNp linux-2.6.32.14/drivers/firmware/dmi_scan.c linux-2.6.32.14/drivers/firmware/dmi_scan.c
+--- linux-2.6.32.14/drivers/firmware/dmi_scan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firmware/dmi_scan.c	2010-05-28 21:27:15.422980793 -0400
+@@ -391,11 +391,6 @@ void __init dmi_scan_machine(void)
+ 		}
+ 	}
+ 	else {
+-		/*
+-		 * no iounmap() for that ioremap(); it would be a no-op, but
+-		 * it's so early in setup that sucker gets confused into doing
+-		 * what it shouldn't if we actually call it.
+-		 */
+ 		p = dmi_ioremap(0xF0000, 0x10000);
+ 		if (p == NULL)
+ 			goto error;
+diff -urNp linux-2.6.32.14/drivers/firmware/edd.c linux-2.6.32.14/drivers/firmware/edd.c
+--- linux-2.6.32.14/drivers/firmware/edd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firmware/edd.c	2010-05-28 21:27:15.422980793 -0400
+@@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops edd_attr_ops = {
++static const struct sysfs_ops edd_attr_ops = {
+ 	.show = edd_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/firmware/efivars.c linux-2.6.32.14/drivers/firmware/efivars.c
+--- linux-2.6.32.14/drivers/firmware/efivars.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firmware/efivars.c	2010-05-28 21:27:15.422980793 -0400
+@@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops efivar_attr_ops = {
++static const struct sysfs_ops efivar_attr_ops = {
+ 	.show = efivar_attr_show,
+ 	.store = efivar_attr_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/firmware/iscsi_ibft.c linux-2.6.32.14/drivers/firmware/iscsi_ibft.c
+--- linux-2.6.32.14/drivers/firmware/iscsi_ibft.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firmware/iscsi_ibft.c	2010-05-28 21:27:15.431186849 -0400
+@@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops ibft_attr_ops = {
++static const struct sysfs_ops ibft_attr_ops = {
+ 	.show = ibft_show_attribute,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/firmware/memmap.c linux-2.6.32.14/drivers/firmware/memmap.c
+--- linux-2.6.32.14/drivers/firmware/memmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/firmware/memmap.c	2010-05-28 21:27:15.446919696 -0400
+@@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
+ 	NULL
+ };
+ 
+-static struct sysfs_ops memmap_attr_ops = {
++static const struct sysfs_ops memmap_attr_ops = {
+ 	.show = memmap_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/drm_drv.c linux-2.6.32.14/drivers/gpu/drm/drm_drv.c
+--- linux-2.6.32.14/drivers/gpu/drm/drm_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/drm_drv.c	2010-05-28 21:27:15.446919696 -0400
+@@ -417,7 +417,7 @@ int drm_ioctl(struct inode *inode, struc
+ 	char *kdata = NULL;
+ 
+ 	atomic_inc(&dev->ioctl_count);
+-	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
+ 	++file_priv->ioctl_count;
+ 
+ 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/drm_fops.c linux-2.6.32.14/drivers/gpu/drm/drm_fops.c
+--- linux-2.6.32.14/drivers/gpu/drm/drm_fops.c	2010-04-29 17:49:37.845185844 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/drm_fops.c	2010-05-28 21:27:15.451193295 -0400
+@@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
+ 	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
+-		atomic_set(&dev->counts[i], 0);
++		atomic_set_unchecked(&dev->counts[i], 0);
+ 
+ 	dev->sigdata.lock = NULL;
+ 
+@@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
+ 
+ 	retcode = drm_open_helper(inode, filp, dev);
+ 	if (!retcode) {
+-		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
++		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
+ 		spin_lock(&dev->count_lock);
+-		if (!dev->open_count++) {
++		if (atomic_inc_return(&dev->open_count) == 1) {
+ 			spin_unlock(&dev->count_lock);
+ 			retcode = drm_setup(dev);
+ 			goto out;
+@@ -435,7 +435,7 @@ int drm_release(struct inode *inode, str
+ 
+ 	lock_kernel();
+ 
+-	DRM_DEBUG("open_count = %d\n", dev->open_count);
++	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
+ 
+ 	if (dev->driver->preclose)
+ 		dev->driver->preclose(dev, file_priv);
+@@ -447,7 +447,7 @@ int drm_release(struct inode *inode, str
+ 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
+ 		  task_pid_nr(current),
+ 		  (long)old_encode_dev(file_priv->minor->device),
+-		  dev->open_count);
++		  atomic_read(&dev->open_count));
+ 
+ 	/* if the master has gone away we can't do anything with the lock */
+ 	if (file_priv->minor->master)
+@@ -524,9 +524,9 @@ int drm_release(struct inode *inode, str
+ 	 * End inline drm_release
+ 	 */
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
+ 	spin_lock(&dev->count_lock);
+-	if (!--dev->open_count) {
++	if (atomic_dec_and_test(&dev->open_count)) {
+ 		if (atomic_read(&dev->ioctl_count)) {
+ 			DRM_ERROR("Device busy: %d\n",
+ 				  atomic_read(&dev->ioctl_count));
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.14/drivers/gpu/drm/drm_ioctl.c
+--- linux-2.6.32.14/drivers/gpu/drm/drm_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/drm_ioctl.c	2010-05-28 21:27:15.451193295 -0400
+@@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
+ 			stats->data[i].value =
+ 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
+ 		else
+-			stats->data[i].value = atomic_read(&dev->counts[i]);
++			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
+ 		stats->data[i].type = dev->types[i];
+ 	}
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/drm_lock.c linux-2.6.32.14/drivers/gpu/drm/drm_lock.c
+--- linux-2.6.32.14/drivers/gpu/drm/drm_lock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/drm_lock.c	2010-05-28 21:27:15.451193295 -0400
+@@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
+ 		if (drm_lock_take(&master->lock, lock->context)) {
+ 			master->lock.file_priv = file_priv;
+ 			master->lock.lock_time = jiffies;
+-			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
++			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
+ 			break;	/* Got lock */
+ 		}
+ 
+@@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
+ 		return -EINVAL;
+ 	}
+ 
+-	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
+ 
+ 	/* kernel_context_switch isn't used by any of the x86 drm
+ 	 * modules but is required by the Sparc driver.
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.14/drivers/gpu/drm/i810/i810_dma.c
+--- linux-2.6.32.14/drivers/gpu/drm/i810/i810_dma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i810/i810_dma.c	2010-05-28 21:27:15.455180050 -0400
+@@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
+ 				 dma->buflist[vertex->idx],
+ 				 vertex->discard, vertex->used);
+ 
+-	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+@@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
+ 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
+ 			     mc->last_render);
+ 
+-	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
+-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
++	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
++	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
+ 	sarea_priv->last_enqueue = dev_priv->counter - 1;
+ 	sarea_priv->last_dispatch = (int)hw_status[5];
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7017.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7017.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7017.c	2010-05-28 21:27:15.455180050 -0400
+@@ -443,7 +443,7 @@ static void ch7017_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7017_ops = {
++const struct intel_dvo_dev_ops ch7017_ops = {
+ 	.init = ch7017_init,
+ 	.detect = ch7017_detect,
+ 	.mode_valid = ch7017_mode_valid,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7xxx.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ch7xxx.c	2010-05-28 21:27:15.459183485 -0400
+@@ -356,7 +356,7 @@ static void ch7xxx_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ch7xxx_ops = {
++const struct intel_dvo_dev_ops ch7xxx_ops = {
+ 	.init = ch7xxx_init,
+ 	.detect = ch7xxx_detect,
+ 	.mode_valid = ch7xxx_mode_valid,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo.h linux-2.6.32.14/drivers/gpu/drm/i915/dvo.h
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo.h	2010-05-28 21:27:15.463172433 -0400
+@@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
+ 	 *
+ 	 * \return singly-linked list of modes or NULL if no modes found.
+ 	 */
+-	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
++	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Clean up driver-specific bits of the output
+ 	 */
+-	void (*destroy) (struct intel_dvo_device *dvo);
++	void (* const destroy) (struct intel_dvo_device *dvo);
+ 
+ 	/**
+ 	 * Debugging hook to dump device registers to log file
+ 	 */
+-	void (*dump_regs)(struct intel_dvo_device *dvo);
++	void (* const dump_regs)(struct intel_dvo_device *dvo);
+ };
+ 
+-extern struct intel_dvo_dev_ops sil164_ops;
+-extern struct intel_dvo_dev_ops ch7xxx_ops;
+-extern struct intel_dvo_dev_ops ivch_ops;
+-extern struct intel_dvo_dev_ops tfp410_ops;
+-extern struct intel_dvo_dev_ops ch7017_ops;
++extern const struct intel_dvo_dev_ops sil164_ops;
++extern const struct intel_dvo_dev_ops ch7xxx_ops;
++extern const struct intel_dvo_dev_ops ivch_ops;
++extern const struct intel_dvo_dev_ops tfp410_ops;
++extern const struct intel_dvo_dev_ops ch7017_ops;
+ 
+ #endif /* _INTEL_DVO_H */
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ivch.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ivch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo_ivch.c	2010-05-28 21:27:15.463172433 -0400
+@@ -430,7 +430,7 @@ static void ivch_destroy(struct intel_dv
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops ivch_ops= {
++const struct intel_dvo_dev_ops ivch_ops= {
+ 	.init = ivch_init,
+ 	.dpms = ivch_dpms,
+ 	.save = ivch_save,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.14/drivers/gpu/drm/i915/dvo_sil164.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo_sil164.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo_sil164.c	2010-05-28 21:27:15.463172433 -0400
+@@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops sil164_ops = {
++const struct intel_dvo_dev_ops sil164_ops = {
+ 	.init = sil164_init,
+ 	.detect = sil164_detect,
+ 	.mode_valid = sil164_mode_valid,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.14/drivers/gpu/drm/i915/dvo_tfp410.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/dvo_tfp410.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/dvo_tfp410.c	2010-05-28 21:27:15.463172433 -0400
+@@ -323,7 +323,7 @@ static void tfp410_destroy(struct intel_
+ 	}
+ }
+ 
+-struct intel_dvo_dev_ops tfp410_ops = {
++const struct intel_dvo_dev_ops tfp410_ops = {
+ 	.init = tfp410_init,
+ 	.detect = tfp410_detect,
+ 	.mode_valid = tfp410_mode_valid,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.14/drivers/gpu/drm/i915/i915_drv.c
+--- linux-2.6.32.14/drivers/gpu/drm/i915/i915_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/i915/i915_drv.c	2010-05-28 21:27:15.463172433 -0400
+@@ -284,7 +284,7 @@ i915_pci_resume(struct pci_dev *pdev)
+ 	return i915_resume(dev);
+ }
+ 
+-static struct vm_operations_struct i915_gem_vm_ops = {
++static const struct vm_operations_struct i915_gem_vm_ops = {
+ 	.fault = i915_gem_fault,
+ 	.open = drm_gem_vm_open,
+ 	.close = drm_gem_vm_close,
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.14/drivers/gpu/drm/radeon/mkregtable.c
+--- linux-2.6.32.14/drivers/gpu/drm/radeon/mkregtable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/radeon/mkregtable.c	2010-05-28 21:27:15.467181648 -0400
+@@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
+ 	regex_t mask_rex;
+ 	regmatch_t match[4];
+ 	char buf[1024];
+-	size_t end;
++	long end;
+ 	int len;
+ 	int done = 0;
+ 	int r;
+ 	unsigned o;
+ 	struct offset *offset;
+ 	char last_reg_s[10];
+-	int last_reg;
++	unsigned long last_reg;
+ 
+ 	if (regcomp
+ 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_atombios.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_atombios.c	2010-05-28 21:27:15.467181648 -0400
+@@ -504,13 +504,13 @@ static uint16_t atombios_get_connector_o
+ 	}
+ }
+ 
+-struct bios_connector {
++static struct bios_connector {
+ 	bool valid;
+ 	uint16_t line_mux;
+ 	uint16_t devices;
+ 	int connector_type;
+ 	struct radeon_i2c_bus_rec ddc_bus;
+-};
++} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
+ 								 drm_device
+@@ -526,7 +526,6 @@ bool radeon_get_atom_connector_info_from
+ 	uint8_t dac;
+ 	union atom_supported_devices *supported_devices;
+ 	int i, j;
+-	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
+ 
+ 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_display.c
+--- linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_display.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_display.c	2010-05-28 21:27:15.467181648 -0400
+@@ -482,7 +482,7 @@ void radeon_compute_pll(struct radeon_pl
+ 
+ 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
+ 						error = freq - current_freq;
+-						error = error < 0 ? 0xffffffff : error;
++						error = (int32_t)error < 0 ? 0xffffffff : error;
+ 					} else
+ 						error = abs(current_freq - freq);
+ 					vco_diff = abs(vco - best_vco);
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_state.c
+--- linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_state.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_state.c	2010-05-28 21:27:15.475020618 -0400
+@@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
+ {
+ 	drm_radeon_private_t *dev_priv = dev->dev_private;
+ 	drm_radeon_getparam_t *param = data;
+-	int value;
++	int value = 0;
+ 
+ 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_ttm.c
+--- linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_ttm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/radeon/radeon_ttm.c	2010-05-28 21:27:15.475020618 -0400
+@@ -535,27 +535,10 @@ void radeon_ttm_fini(struct radeon_devic
+ 	DRM_INFO("radeon: ttm finalized\n");
+ }
+ 
+-static struct vm_operations_struct radeon_ttm_vm_ops;
+-static const struct vm_operations_struct *ttm_vm_ops = NULL;
+-
+-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+-{
+-	struct ttm_buffer_object *bo;
+-	int r;
+-
+-	bo = (struct ttm_buffer_object *)vma->vm_private_data;
+-	if (bo == NULL) {
+-		return VM_FAULT_NOPAGE;
+-	}
+-	r = ttm_vm_ops->fault(vma, vmf);
+-	return r;
+-}
+-
+ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ 	struct drm_file *file_priv;
+ 	struct radeon_device *rdev;
+-	int r;
+ 
+ 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
+ 		return drm_mmap(filp, vma);
+@@ -563,20 +546,9 @@ int radeon_mmap(struct file *filp, struc
+ 
+ 	file_priv = (struct drm_file *)filp->private_data;
+ 	rdev = file_priv->minor->dev->dev_private;
+-	if (rdev == NULL) {
++	if (!rdev)
+ 		return -EINVAL;
+-	}
+-	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+-	if (unlikely(r != 0)) {
+-		return r;
+-	}
+-	if (unlikely(ttm_vm_ops == NULL)) {
+-		ttm_vm_ops = vma->vm_ops;
+-		radeon_ttm_vm_ops = *ttm_vm_ops;
+-		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
+-	}
+-	vma->vm_ops = &radeon_ttm_vm_ops;
+-	return 0;
++	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo.c
+--- linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo.c	2010-05-28 21:27:15.483213986 -0400
+@@ -39,7 +39,7 @@
+ #include <linux/module.h>
+ 
+ #define TTM_ASSERT_LOCKED(param)
+-#define TTM_DEBUG(fmt, arg...)
++#define TTM_DEBUG(fmt, arg...) do {} while (0)
+ #define TTM_BO_HASH_ORDER 13
+ 
+ static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
+@@ -67,7 +67,7 @@ static struct attribute *ttm_bo_global_a
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_bo_global_ops = {
++static const struct sysfs_ops ttm_bo_global_ops = {
+ 	.show = &ttm_bo_global_show
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo_vm.c
+--- linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_bo_vm.c	2010-05-28 21:27:15.483213986 -0400
+@@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
+ {
+ 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
+ 	    vma->vm_private_data;
+-	struct ttm_bo_device *bdev = bo->bdev;
++	struct ttm_bo_device *bdev;
+ 	unsigned long bus_base;
+ 	unsigned long bus_offset;
+ 	unsigned long bus_size;
+@@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
+ 	unsigned long address = (unsigned long)vmf->virtual_address;
+ 	int retval = VM_FAULT_NOPAGE;
+ 
++	if (!bo)
++		return VM_FAULT_NOPAGE;
++	bdev = bo->bdev;
++
+ 	/*
+ 	 * Work around locking order reversal in fault / nopfn
+ 	 * between mmap_sem and bo_reserve: Perform a trylock operation
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_global.c
+--- linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_global.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_global.c	2010-05-28 21:27:15.487089783 -0400
+@@ -36,7 +36,7 @@
+ struct ttm_global_item {
+ 	struct mutex mutex;
+ 	void *object;
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ static struct ttm_global_item glob[TTM_GLOBAL_NUM];
+@@ -49,7 +49,7 @@ void ttm_global_init(void)
+ 		struct ttm_global_item *item = &glob[i];
+ 		mutex_init(&item->mutex);
+ 		item->object = NULL;
+-		item->refcount = 0;
++		atomic_set(&item->refcount, 0);
+ 	}
+ }
+ 
+@@ -59,7 +59,7 @@ void ttm_global_release(void)
+ 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
+ 		struct ttm_global_item *item = &glob[i];
+ 		BUG_ON(item->object != NULL);
+-		BUG_ON(item->refcount != 0);
++		BUG_ON(atomic_read(&item->refcount) != 0);
+ 	}
+ }
+ 
+@@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 	void *object;
+ 
+ 	mutex_lock(&item->mutex);
+-	if (item->refcount == 0) {
++	if (atomic_read(&item->refcount) == 0) {
+ 		item->object = kzalloc(ref->size, GFP_KERNEL);
+ 		if (unlikely(item->object == NULL)) {
+ 			ret = -ENOMEM;
+@@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
+ 			goto out_err;
+ 
+ 	}
+-	++item->refcount;
++	atomic_inc(&item->refcount);
+ 	ref->object = item->object;
+ 	object = item->object;
+ 	mutex_unlock(&item->mutex);
+@@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
+ 	struct ttm_global_item *item = &glob[ref->global_type];
+ 
+ 	mutex_lock(&item->mutex);
+-	BUG_ON(item->refcount == 0);
++	BUG_ON(atomic_read(&item->refcount) == 0);
+ 	BUG_ON(ref->object != item->object);
+-	if (--item->refcount == 0) {
++	if (atomic_dec_and_test(&item->refcount)) {
+ 		ref->release(ref);
+ 		item->object = NULL;
+ 	}
+diff -urNp linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_memory.c
+--- linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/gpu/drm/ttm/ttm_memory.c	2010-05-28 21:27:15.487089783 -0400
+@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
+ 	NULL
+ };
+ 
+-static struct sysfs_ops ttm_mem_zone_ops = {
++static const struct sysfs_ops ttm_mem_zone_ops = {
+ 	.show = &ttm_mem_zone_show,
+ 	.store = &ttm_mem_zone_store
+ };
+diff -urNp linux-2.6.32.14/drivers/hid/usbhid/hiddev.c linux-2.6.32.14/drivers/hid/usbhid/hiddev.c
+--- linux-2.6.32.14/drivers/hid/usbhid/hiddev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hid/usbhid/hiddev.c	2010-05-28 21:27:15.487089783 -0400
+@@ -617,7 +617,7 @@ static long hiddev_ioctl(struct file *fi
+ 		return put_user(HID_VERSION, (int __user *)arg);
+ 
+ 	case HIDIOCAPPLICATION:
+-		if (arg < 0 || arg >= hid->maxapplication)
++		if (arg >= hid->maxapplication)
+ 			return -EINVAL;
+ 
+ 		for (i = 0; i < hid->maxcollection; i++)
+diff -urNp linux-2.6.32.14/drivers/hwmon/k8temp.c linux-2.6.32.14/drivers/hwmon/k8temp.c
+--- linux-2.6.32.14/drivers/hwmon/k8temp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hwmon/k8temp.c	2010-05-28 21:27:15.487089783 -0400
+@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
+ 
+ static struct pci_device_id k8temp_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, k8temp_ids);
+diff -urNp linux-2.6.32.14/drivers/hwmon/sis5595.c linux-2.6.32.14/drivers/hwmon/sis5595.c
+--- linux-2.6.32.14/drivers/hwmon/sis5595.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hwmon/sis5595.c	2010-05-28 21:27:15.495189257 -0400
+@@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
+ 
+ static struct pci_device_id sis5595_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
+diff -urNp linux-2.6.32.14/drivers/hwmon/via686a.c linux-2.6.32.14/drivers/hwmon/via686a.c
+--- linux-2.6.32.14/drivers/hwmon/via686a.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hwmon/via686a.c	2010-05-28 21:27:15.495189257 -0400
+@@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
+ 
+ static struct pci_device_id via686a_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
+diff -urNp linux-2.6.32.14/drivers/hwmon/vt8231.c linux-2.6.32.14/drivers/hwmon/vt8231.c
+--- linux-2.6.32.14/drivers/hwmon/vt8231.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hwmon/vt8231.c	2010-05-28 21:27:15.507004721 -0400
+@@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
+ 
+ static struct pci_device_id vt8231_pci_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
+diff -urNp linux-2.6.32.14/drivers/hwmon/w83791d.c linux-2.6.32.14/drivers/hwmon/w83791d.c
+--- linux-2.6.32.14/drivers/hwmon/w83791d.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/hwmon/w83791d.c	2010-05-28 21:27:15.507004721 -0400
+@@ -330,8 +330,8 @@ static int w83791d_detect(struct i2c_cli
+ 			  struct i2c_board_info *info);
+ static int w83791d_remove(struct i2c_client *client);
+ 
+-static int w83791d_read(struct i2c_client *client, u8 register);
+-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
++static int w83791d_read(struct i2c_client *client, u8 reg);
++static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
+ static struct w83791d_data *w83791d_update_device(struct device *dev);
+ 
+ #ifdef DEBUG
+diff -urNp linux-2.6.32.14/drivers/i2c/busses/i2c-i801.c linux-2.6.32.14/drivers/i2c/busses/i2c-i801.c
+--- linux-2.6.32.14/drivers/i2c/busses/i2c-i801.c	2010-04-29 17:49:37.945518391 -0400
++++ linux-2.6.32.14/drivers/i2c/busses/i2c-i801.c	2010-05-28 21:27:15.507004721 -0400
+@@ -582,7 +582,7 @@ static struct pci_device_id i801_ids[] =
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CPT_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, i801_ids);
+diff -urNp linux-2.6.32.14/drivers/i2c/busses/i2c-piix4.c linux-2.6.32.14/drivers/i2c/busses/i2c-piix4.c
+--- linux-2.6.32.14/drivers/i2c/busses/i2c-piix4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/i2c/busses/i2c-piix4.c	2010-05-28 21:27:15.507004721 -0400
+@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
+ 		.ident = "IBM",
+ 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
+ 	},
+-	{ },
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
+@@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[] 
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
+ 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, piix4_ids);
+diff -urNp linux-2.6.32.14/drivers/i2c/busses/i2c-sis630.c linux-2.6.32.14/drivers/i2c/busses/i2c-sis630.c
+--- linux-2.6.32.14/drivers/i2c/busses/i2c-sis630.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/i2c/busses/i2c-sis630.c	2010-05-28 21:27:15.507004721 -0400
+@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
+ static struct pci_device_id sis630_ids[] __devinitdata = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis630_ids);
+diff -urNp linux-2.6.32.14/drivers/i2c/busses/i2c-sis96x.c linux-2.6.32.14/drivers/i2c/busses/i2c-sis96x.c
+--- linux-2.6.32.14/drivers/i2c/busses/i2c-sis96x.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/i2c/busses/i2c-sis96x.c	2010-05-28 21:27:15.507004721 -0400
+@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
+ 
+ static struct pci_device_id sis96x_ids[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE (pci, sis96x_ids);
+diff -urNp linux-2.6.32.14/drivers/ide/ide-cd.c linux-2.6.32.14/drivers/ide/ide-cd.c
+--- linux-2.6.32.14/drivers/ide/ide-cd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ide/ide-cd.c	2010-05-28 21:27:15.510961438 -0400
+@@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
+ 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
+ 		if ((unsigned long)buf & alignment
+ 		    || blk_rq_bytes(rq) & q->dma_pad_mask
+-		    || object_is_on_stack(buf))
++		    || object_starts_on_stack(buf))
+ 			drive->dma = 0;
+ 	}
+ }
+diff -urNp linux-2.6.32.14/drivers/ieee1394/dv1394.c linux-2.6.32.14/drivers/ieee1394/dv1394.c
+--- linux-2.6.32.14/drivers/ieee1394/dv1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/dv1394.c	2010-05-28 21:27:15.527187024 -0400
+@@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
+ 	based upon DIF section and sequence
+ */
+ 
+-static void inline
++static inline void
+ frame_put_packet (struct frame *f, struct packet *p)
+ {
+ 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
+@@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
+ 		.specifier_id	= AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 		.version	= AVC_SW_VERSION_ENTRY & 0xffffff
+ 	},
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
+diff -urNp linux-2.6.32.14/drivers/ieee1394/eth1394.c linux-2.6.32.14/drivers/ieee1394/eth1394.c
+--- linux-2.6.32.14/drivers/ieee1394/eth1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/eth1394.c	2010-05-28 21:27:15.544607394 -0400
+@@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
+ 		.specifier_id =	ETHER1394_GASP_SPECIFIER_ID,
+ 		.version = ETHER1394_GASP_VERSION,
+ 	},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
+diff -urNp linux-2.6.32.14/drivers/ieee1394/hosts.c linux-2.6.32.14/drivers/ieee1394/hosts.c
+--- linux-2.6.32.14/drivers/ieee1394/hosts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/hosts.c	2010-05-28 21:27:15.544607394 -0400
+@@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso 
+ }
+ 
+ static struct hpsb_host_driver dummy_driver = {
++	.name =		   "dummy",
+ 	.transmit_packet = dummy_transmit_packet,
+ 	.devctl =	   dummy_devctl,
+ 	.isoctl =	   dummy_isoctl
+diff -urNp linux-2.6.32.14/drivers/ieee1394/ohci1394.c linux-2.6.32.14/drivers/ieee1394/ohci1394.c
+--- linux-2.6.32.14/drivers/ieee1394/ohci1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/ohci1394.c	2010-05-28 21:27:15.555018453 -0400
+@@ -147,9 +147,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
+ printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
+ 
+ /* Module Parameters */
+-static int phys_dma = 1;
++static int phys_dma;
+ module_param(phys_dma, int, 0444);
+-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
++MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
+ 
+ static void dma_trm_tasklet(unsigned long data);
+ static void dma_trm_reset(struct dma_trm_ctx *d);
+@@ -3449,7 +3449,7 @@ static struct pci_device_id ohci1394_pci
+ 		.subvendor =	PCI_ANY_ID,
+ 		.subdevice =	PCI_ANY_ID,
+ 	},
+-	{ 0, },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
+diff -urNp linux-2.6.32.14/drivers/ieee1394/raw1394.c linux-2.6.32.14/drivers/ieee1394/raw1394.c
+--- linux-2.6.32.14/drivers/ieee1394/raw1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/raw1394.c	2010-05-28 21:27:15.555018453 -0400
+@@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
+ 	 .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
+diff -urNp linux-2.6.32.14/drivers/ieee1394/sbp2.c linux-2.6.32.14/drivers/ieee1394/sbp2.c
+--- linux-2.6.32.14/drivers/ieee1394/sbp2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/sbp2.c	2010-05-28 21:27:15.555018453 -0400
+@@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
+ 	 .match_flags	= IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
+ 	 .specifier_id	= SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
+ 	 .version	= SBP2_SW_VERSION_ENTRY & 0xffffff},
+-	{}
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
+ 
+@@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
+ MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
+ MODULE_LICENSE("GPL");
+ 
+-static int sbp2_module_init(void)
++static int __init sbp2_module_init(void)
+ {
+ 	int ret;
+ 
+diff -urNp linux-2.6.32.14/drivers/ieee1394/video1394.c linux-2.6.32.14/drivers/ieee1394/video1394.c
+--- linux-2.6.32.14/drivers/ieee1394/video1394.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/ieee1394/video1394.c	2010-05-28 21:27:15.559201489 -0400
+@@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
+                 .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
+                 .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
+         },
+-	{ }
++	{ 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
+diff -urNp linux-2.6.32.14/drivers/infiniband/core/cm.c linux-2.6.32.14/drivers/infiniband/core/cm.c
+--- linux-2.6.32.14/drivers/infiniband/core/cm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/infiniband/core/cm.c	2010-05-28 21:27:15.559201489 -0400
+@@ -112,7 +112,7 @@ static char const counter_group_names[CM
+ 
+ struct cm_counter_group {
+ 	struct kobject obj;
+-	atomic_long_t counter[CM_ATTR_COUNT];
++	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
+ };
+ 
+ struct cm_counter_attribute {
+@@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
+ 	struct ib_mad_send_buf *msg = NULL;
+ 	int ret;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REQ_COUNTER]);
+ 
+ 	/* Quick state check to discard duplicate REQs. */
+@@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
+ 	if (!cm_id_priv)
+ 		return;
+ 
+-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 			counter[CM_REP_COUNTER]);
+ 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+ 	if (ret)
+@@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
+ 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
+ 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
+ 		spin_unlock_irq(&cm_id_priv->lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_RTU_COUNTER]);
+ 		goto out;
+ 	}
+@@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
+ 				   dreq_msg->local_comm_id);
+ 	if (!cm_id_priv) {
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		cm_issue_drep(work->port, work->mad_recv_wc);
+ 		return -EINVAL;
+@@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
+ 	case IB_CM_MRA_REP_RCVD:
+ 		break;
+ 	case IB_CM_TIMEWAIT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_DREQ_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_DREQ_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
+ 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+ 				  cm_id_priv->msg, timeout)) {
+ 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
+-				atomic_long_inc(&work->port->
++				atomic_long_inc_unchecked(&work->port->
+ 						counter_group[CM_RECV_DUPLICATES].
+ 						counter[CM_MRA_COUNTER]);
+ 			goto out;
+@@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
+ 		break;
+ 	case IB_CM_MRA_REQ_RCVD:
+ 	case IB_CM_MRA_REP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_MRA_COUNTER]);
+ 		/* fall through */
+ 	default:
+@@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
+ 	case IB_CM_LAP_IDLE:
+ 		break;
+ 	case IB_CM_MRA_LAP_SENT:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+ 			goto unlock;
+@@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
+ 			cm_free_msg(msg);
+ 		goto deref;
+ 	case IB_CM_LAP_RCVD:
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_LAP_COUNTER]);
+ 		goto unlock;
+ 	default:
+@@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
+ 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
+ 	if (cur_cm_id_priv) {
+ 		spin_unlock_irq(&cm.lock);
+-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
++		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
+ 				counter[CM_SIDR_REQ_COUNTER]);
+ 		goto out; /* Duplicate message. */
+ 	}
+@@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
+ 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
+ 		msg->retries = 1;
+ 
+-	atomic_long_add(1 + msg->retries,
++	atomic_long_add_unchecked(1 + msg->retries,
+ 			&port->counter_group[CM_XMIT].counter[attr_index]);
+ 	if (msg->retries)
+-		atomic_long_add(msg->retries,
++		atomic_long_add_unchecked(msg->retries,
+ 				&port->counter_group[CM_XMIT_RETRIES].
+ 				counter[attr_index]);
+ 
+@@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
+ 	}
+ 
+ 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
+-	atomic_long_inc(&port->counter_group[CM_RECV].
++	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
+ 			counter[attr_id - CM_ATTR_ID_OFFSET]);
+ 
+ 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
+@@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
+ 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
+ 
+ 	return sprintf(buf, "%ld\n",
+-		       atomic_long_read(&group->counter[cm_attr->index]));
++		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
+ }
+ 
+-static struct sysfs_ops cm_counter_ops = {
++static const struct sysfs_ops cm_counter_ops = {
+ 	.show = cm_show_counter
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/infiniband/core/sysfs.c linux-2.6.32.14/drivers/infiniband/core/sysfs.c
+--- linux-2.6.32.14/drivers/infiniband/core/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/infiniband/core/sysfs.c	2010-05-28 21:27:15.563689341 -0400
+@@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
+ 	return port_attr->show(p, port_attr, buf);
+ }
+ 
+-static struct sysfs_ops port_sysfs_ops = {
++static const struct sysfs_ops port_sysfs_ops = {
+ 	.show = port_attr_show
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/input/keyboard/atkbd.c linux-2.6.32.14/drivers/input/keyboard/atkbd.c
+--- linux-2.6.32.14/drivers/input/keyboard/atkbd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/keyboard/atkbd.c	2010-05-28 21:27:15.568704406 -0400
+@@ -1212,7 +1212,7 @@ static struct serio_device_id atkbd_seri
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
+diff -urNp linux-2.6.32.14/drivers/input/mouse/lifebook.c linux-2.6.32.14/drivers/input/mouse/lifebook.c
+--- linux-2.6.32.14/drivers/input/mouse/lifebook.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/mouse/lifebook.c	2010-05-28 21:27:15.572693057 -0400
+@@ -115,7 +115,7 @@ static const struct dmi_system_id lifebo
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
+ };
+ 
+ static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
+diff -urNp linux-2.6.32.14/drivers/input/mouse/psmouse-base.c linux-2.6.32.14/drivers/input/mouse/psmouse-base.c
+--- linux-2.6.32.14/drivers/input/mouse/psmouse-base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/mouse/psmouse-base.c	2010-05-28 21:27:15.580689971 -0400
+@@ -1409,7 +1409,7 @@ static struct serio_device_id psmouse_se
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
+diff -urNp linux-2.6.32.14/drivers/input/mouse/synaptics.c linux-2.6.32.14/drivers/input/mouse/synaptics.c
+--- linux-2.6.32.14/drivers/input/mouse/synaptics.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/mouse/synaptics.c	2010-05-28 21:27:15.587725031 -0400
+@@ -437,7 +437,7 @@ static void synaptics_process_packet(str
+ 				break;
+ 			case 2:
+ 				if (SYN_MODEL_PEN(priv->model_id))
+-					;   /* Nothing, treat a pen as a single finger */
++					break;   /* Nothing, treat a pen as a single finger */
+ 				break;
+ 			case 4 ... 15:
+ 				if (SYN_CAP_PALMDETECT(priv->capabilities))
+@@ -652,7 +652,6 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
+ 		},
+-
+ 	},
+ 	{
+ 		.ident = "Toshiba Portege M300",
+@@ -661,9 +660,8 @@ static const struct dmi_system_id toshib
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
+ 		},
+-
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.14/drivers/input/mousedev.c linux-2.6.32.14/drivers/input/mousedev.c
+--- linux-2.6.32.14/drivers/input/mousedev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/mousedev.c	2010-05-28 21:27:15.592694173 -0400
+@@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
+ 
+ #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
+ static struct miscdevice psaux_mouse = {
+-	PSMOUSE_MINOR, "psaux", &mousedev_fops
++	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
+ };
+ static int psaux_registered;
+ #endif
+diff -urNp linux-2.6.32.14/drivers/input/serio/i8042-x86ia64io.h linux-2.6.32.14/drivers/input/serio/i8042-x86ia64io.h
+--- linux-2.6.32.14/drivers/input/serio/i8042-x86ia64io.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.14/drivers/input/serio/i8042-x86ia64io.h	2010-05-28 21:27:15.592694173 -0400
+@@ -172,7 +172,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ /*
+@@ -402,7 +402,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+@@ -476,7 +476,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #ifdef CONFIG_PNP
+@@ -495,7 +495,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
+@@ -519,7 +519,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ #endif
+ 
+@@ -593,7 +593,7 @@ static const struct dmi_system_id __init
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
+ };
+ 
+ #endif /* CONFIG_X86 */
+diff -urNp linux-2.6.32.14/drivers/input/serio/serio_raw.c linux-2.6.32.14/drivers/input/serio/serio_raw.c
+--- linux-2.6.32.14/drivers/input/serio/serio_raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/input/serio/serio_raw.c	2010-05-28 21:27:15.596690001 -0400
+@@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
+ 		.id	= SERIO_ANY,
+ 		.extra	= SERIO_ANY,
+ 	},
+-	{ 0 }
++	{ 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
+diff -urNp linux-2.6.32.14/drivers/isdn/gigaset/common.c linux-2.6.32.14/drivers/isdn/gigaset/common.c
+--- linux-2.6.32.14/drivers/isdn/gigaset/common.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/isdn/gigaset/common.c	2010-05-28 21:27:15.600680043 -0400
+@@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
+ 	cs->commands_pending = 0;
+ 	cs->cur_at_seq = 0;
+ 	cs->gotfwver = -1;
+-	cs->open_count = 0;
++	atomic_set(&cs->open_count, 0);
+ 	cs->dev = NULL;
+ 	cs->tty = NULL;
+ 	cs->tty_dev = NULL;
+diff -urNp linux-2.6.32.14/drivers/isdn/gigaset/gigaset.h linux-2.6.32.14/drivers/isdn/gigaset/gigaset.h
+--- linux-2.6.32.14/drivers/isdn/gigaset/gigaset.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/isdn/gigaset/gigaset.h	2010-05-28 21:27:15.600680043 -0400
+@@ -446,7 +446,7 @@ struct cardstate {
+ 	spinlock_t cmdlock;
+ 	unsigned curlen, cmdbytes;
+ 
+-	unsigned open_count;
++	atomic_t open_count;
+ 	struct tty_struct *tty;
+ 	struct tasklet_struct if_wake_tasklet;
+ 	unsigned control_state;
+diff -urNp linux-2.6.32.14/drivers/isdn/gigaset/interface.c linux-2.6.32.14/drivers/isdn/gigaset/interface.c
+--- linux-2.6.32.14/drivers/isdn/gigaset/interface.c	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.14/drivers/isdn/gigaset/interface.c	2010-05-28 21:27:15.600680043 -0400
+@@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
+ 		return -ERESTARTSYS; // FIXME -EINTR?
+ 	tty->driver_data = cs;
+ 
+-	++cs->open_count;
+-
+-	if (cs->open_count == 1) {
++	if (atomic_inc_return(&cs->open_count) == 1) {
+ 		spin_lock_irqsave(&cs->lock, flags);
+ 		cs->tty = tty;
+ 		spin_unlock_irqrestore(&cs->lock, flags);
+@@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+-		if (!--cs->open_count) {
++		if (!atomic_dec_return(&cs->open_count)) {
+ 			spin_lock_irqsave(&cs->lock, flags);
+ 			cs->tty = NULL;
+ 			spin_unlock_irqrestore(&cs->lock, flags);
+@@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		retval = 0;
+@@ -361,7 +359,7 @@ static int if_write(struct tty_struct *t
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -395,7 +393,7 @@ static int if_write_room(struct tty_stru
+ 	if (!cs->connected) {
+ 		gig_dbg(DEBUG_IF, "not connected");
+ 		retval = -ENODEV;
+-	} else if (!cs->open_count)
++	} else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED) {
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -425,7 +423,7 @@ static int if_chars_in_buffer(struct tty
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else if (cs->mstate != MS_LOCKED)
+ 		dev_warn(cs->dev, "can't write to unlocked device\n");
+@@ -453,7 +451,7 @@ static void if_throttle(struct tty_struc
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -478,7 +476,7 @@ static void if_unthrottle(struct tty_str
+ 
+ 	if (!cs->connected)
+ 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
+-	else if (!cs->open_count)
++	else if (!atomic_read(&cs->open_count))
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 	else {
+ 		//FIXME
+@@ -510,7 +508,7 @@ static void if_set_termios(struct tty_st
+ 		goto out;
+ 	}
+ 
+-	if (!cs->open_count) {
++	if (!atomic_read(&cs->open_count)) {
+ 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
+ 		goto out;
+ 	}
+diff -urNp linux-2.6.32.14/drivers/isdn/hardware/avm/b1.c linux-2.6.32.14/drivers/isdn/hardware/avm/b1.c
+--- linux-2.6.32.14/drivers/isdn/hardware/avm/b1.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/isdn/hardware/avm/b1.c	2010-05-28 21:27:15.600680043 -0400
+@@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (t4file->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+@@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
+ 	}
+ 	if (left) {
+ 		if (config->user) {
+-			if (copy_from_user(buf, dp, left))
++			if (left > sizeof buf || copy_from_user(buf, dp, left))
+ 				return -EFAULT;
+ 		} else {
+ 			memcpy(buf, dp, left);
+diff -urNp linux-2.6.32.14/drivers/isdn/icn/icn.c linux-2.6.32.14/drivers/isdn/icn/icn.c
+--- linux-2.6.32.14/drivers/isdn/icn/icn.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/isdn/icn/icn.c	2010-05-28 21:27:15.600680043 -0400
+@@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
+ 		if (count > len)
+ 			count = len;
+ 		if (user) {
+-			if (copy_from_user(msg, buf, count))
++			if (count > sizeof msg || copy_from_user(msg, buf, count))
+ 				return -EFAULT;
+ 		} else
+ 			memcpy(msg, buf, count);
+diff -urNp linux-2.6.32.14/drivers/lguest/core.c linux-2.6.32.14/drivers/lguest/core.c
+--- linux-2.6.32.14/drivers/lguest/core.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/lguest/core.c	2010-05-28 21:27:15.600680043 -0400
+@@ -91,9 +91,17 @@ static __init int map_switcher(void)
+ 	 * it's worked so far.  The end address needs +1 because __get_vm_area
+ 	 * allocates an extra guard page, so we need space for that.
+ 	 */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
++				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
++				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#else
+ 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+ 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
+ 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
++#endif
++
+ 	if (!switcher_vma) {
+ 		err = -ENOMEM;
+ 		printk("lguest: could not map switcher pages high\n");
+diff -urNp linux-2.6.32.14/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.14/drivers/macintosh/via-pmu-backlight.c
+--- linux-2.6.32.14/drivers/macintosh/via-pmu-backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/macintosh/via-pmu-backlight.c	2010-05-28 21:27:15.600680043 -0400
+@@ -15,7 +15,7 @@
+ 
+ #define MAX_PMU_LEVEL 0xFF
+ 
+-static struct backlight_ops pmu_backlight_data;
++static const struct backlight_ops pmu_backlight_data;
+ static DEFINE_SPINLOCK(pmu_backlight_lock);
+ static int sleeping, uses_pmu_bl;
+ static u8 bl_curve[FB_BACKLIGHT_LEVELS];
+@@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops pmu_backlight_data = {
++static const struct backlight_ops pmu_backlight_data = {
+ 	.get_brightness	= pmu_backlight_get_brightness,
+ 	.update_status	= pmu_backlight_update_status,
+ 
+diff -urNp linux-2.6.32.14/drivers/macintosh/via-pmu.c linux-2.6.32.14/drivers/macintosh/via-pmu.c
+--- linux-2.6.32.14/drivers/macintosh/via-pmu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/macintosh/via-pmu.c	2010-05-28 21:27:15.608683910 -0400
+@@ -2232,7 +2232,7 @@ static int pmu_sleep_valid(suspend_state
+ 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
+ }
+ 
+-static struct platform_suspend_ops pmu_pm_ops = {
++static const struct platform_suspend_ops pmu_pm_ops = {
+ 	.enter = powerbook_sleep,
+ 	.valid = pmu_sleep_valid,
+ };
+diff -urNp linux-2.6.32.14/drivers/md/bitmap.c linux-2.6.32.14/drivers/md/bitmap.c
+--- linux-2.6.32.14/drivers/md/bitmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/md/bitmap.c	2010-05-28 21:27:15.608683910 -0400
+@@ -58,7 +58,7 @@
+ #  if DEBUG > 0
+ #    define PRINTK(x...) printk(KERN_DEBUG x)
+ #  else
+-#    define PRINTK(x...)
++#    define PRINTK(x...) do {} while (0)
+ #  endif
+ #endif
+ 
+diff -urNp linux-2.6.32.14/drivers/md/dm-sysfs.c linux-2.6.32.14/drivers/md/dm-sysfs.c
+--- linux-2.6.32.14/drivers/md/dm-sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/md/dm-sysfs.c	2010-05-28 21:27:15.608683910 -0400
+@@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops dm_sysfs_ops = {
++static const struct sysfs_ops dm_sysfs_ops = {
+ 	.show	= dm_attr_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/md/dm-table.c linux-2.6.32.14/drivers/md/dm-table.c
+--- linux-2.6.32.14/drivers/md/dm-table.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/md/dm-table.c	2010-05-28 21:27:15.608683910 -0400
+@@ -359,7 +359,7 @@ static int device_area_is_invalid(struct
+ 	if (!dev_size)
+ 		return 0;
+ 
+-	if ((start >= dev_size) || (start + len > dev_size)) {
++	if ((start >= dev_size) || (len > dev_size - start)) {
+ 		DMWARN("%s: %s too small for target: "
+ 		       "start=%llu, len=%llu, dev_size=%llu",
+ 		       dm_device_name(ti->table->md), bdevname(bdev, b),
+diff -urNp linux-2.6.32.14/drivers/md/md.c linux-2.6.32.14/drivers/md/md.c
+--- linux-2.6.32.14/drivers/md/md.c	2010-05-15 13:20:18.542567696 -0400
++++ linux-2.6.32.14/drivers/md/md.c	2010-05-28 21:27:15.608683910 -0400
+@@ -2514,7 +2514,7 @@ static void rdev_free(struct kobject *ko
+ 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
+ 	kfree(rdev);
+ }
+-static struct sysfs_ops rdev_sysfs_ops = {
++static const struct sysfs_ops rdev_sysfs_ops = {
+ 	.show		= rdev_attr_show,
+ 	.store		= rdev_attr_store,
+ };
+@@ -3884,7 +3884,7 @@ static void md_free(struct kobject *ko)
+ 	kfree(mddev);
+ }
+ 
+-static struct sysfs_ops md_sysfs_ops = {
++static const struct sysfs_ops md_sysfs_ops = {
+ 	.show	= md_attr_show,
+ 	.store	= md_attr_store,
+ };
+@@ -6010,7 +6010,7 @@ static int md_seq_show(struct seq_file *
+ 				chunk_kb ? "KB" : "B");
+ 			if (bitmap->file) {
+ 				seq_printf(seq, ", file: ");
+-				seq_path(seq, &bitmap->file->f_path, " \t\n");
++				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
+ 			}
+ 
+ 			seq_printf(seq, "\n");
+@@ -6104,7 +6104,7 @@ static int is_mddev_idle(mddev_t *mddev,
+ 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
+ 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
+ 			      (int)part_stat_read(&disk->part0, sectors[1]) -
+-			      atomic_read(&disk->sync_io);
++			      atomic_read_unchecked(&disk->sync_io);
+ 		/* sync IO will cause sync_io to increase before the disk_stats
+ 		 * as sync_io is counted when a request starts, and
+ 		 * disk_stats is counted when it completes.
+diff -urNp linux-2.6.32.14/drivers/md/md.h linux-2.6.32.14/drivers/md/md.h
+--- linux-2.6.32.14/drivers/md/md.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/md/md.h	2010-05-28 21:27:15.608683910 -0400
+@@ -304,7 +304,7 @@ static inline void rdev_dec_pending(mdk_
+ 
+ static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
+ {
+-        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
++	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
+ }
+ 
+ struct mdk_personality
+diff -urNp linux-2.6.32.14/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.14/drivers/media/dvb/dvb-core/dvbdev.c
+--- linux-2.6.32.14/drivers/media/dvb/dvb-core/dvbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/media/dvb/dvb-core/dvbdev.c	2010-05-28 21:27:15.616695200 -0400
+@@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
+ 			const struct dvb_device *template, void *priv, int type)
+ {
+ 	struct dvb_device *dvbdev;
++	/* cannot be const */
+ 	struct file_operations *dvbdevfops;
+ 	struct device *clsdev;
+ 	int minor;
+diff -urNp linux-2.6.32.14/drivers/media/radio/radio-cadet.c linux-2.6.32.14/drivers/media/radio/radio-cadet.c
+--- linux-2.6.32.14/drivers/media/radio/radio-cadet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/media/radio/radio-cadet.c	2010-05-28 21:27:15.616695200 -0400
+@@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
+ 	while (i < count && dev->rdsin != dev->rdsout)
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
+diff -urNp linux-2.6.32.14/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.14/drivers/media/video/usbvideo/konicawc.c
+--- linux-2.6.32.14/drivers/media/video/usbvideo/konicawc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/media/video/usbvideo/konicawc.c	2010-05-28 21:27:15.628727154 -0400
+@@ -225,7 +225,7 @@ static void konicawc_register_input(stru
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.14/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.14/drivers/media/video/usbvideo/quickcam_messenger.c
+--- linux-2.6.32.14/drivers/media/video/usbvideo/quickcam_messenger.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/media/video/usbvideo/quickcam_messenger.c	2010-05-28 21:27:15.630929247 -0400
+@@ -89,7 +89,7 @@ static void qcm_register_input(struct qc
+ 	int error;
+ 
+ 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
+-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
++	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+ 
+ 	cam->input = input_dev = input_allocate_device();
+ 	if (!input_dev) {
+diff -urNp linux-2.6.32.14/drivers/message/fusion/mptdebug.h linux-2.6.32.14/drivers/message/fusion/mptdebug.h
+--- linux-2.6.32.14/drivers/message/fusion/mptdebug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/message/fusion/mptdebug.h	2010-05-28 21:27:15.630929247 -0400
+@@ -71,7 +71,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/message/fusion/mptsas.c linux-2.6.32.14/drivers/message/fusion/mptsas.c
+--- linux-2.6.32.14/drivers/message/fusion/mptsas.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/message/fusion/mptsas.c	2010-05-28 21:27:15.639064560 -0400
+@@ -436,6 +436,23 @@ mptsas_is_end_device(struct mptsas_devin
+ 		return 0;
+ }
+ 
++static inline void
++mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
++{
++	if (phy_info->port_details) {
++		phy_info->port_details->rphy = rphy;
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
++		    ioc->name, rphy));
++	}
++
++	if (rphy) {
++		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
++		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
++		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
++		    ioc->name, rphy, rphy->dev.release));
++	}
++}
++
+ /* no mutex */
+ static void
+ mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
+@@ -474,23 +491,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
+ 		return NULL;
+ }
+ 
+-static inline void
+-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+-{
+-	if (phy_info->port_details) {
+-		phy_info->port_details->rphy = rphy;
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
+-		    ioc->name, rphy));
+-	}
+-
+-	if (rphy) {
+-		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
+-		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
+-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
+-		    ioc->name, rphy, rphy->dev.release));
+-	}
+-}
+-
+ static inline struct sas_port *
+ mptsas_get_port(struct mptsas_phyinfo *phy_info)
+ {
+diff -urNp linux-2.6.32.14/drivers/message/i2o/i2o_proc.c linux-2.6.32.14/drivers/message/i2o/i2o_proc.c
+--- linux-2.6.32.14/drivers/message/i2o/i2o_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/message/i2o/i2o_proc.c	2010-05-28 21:27:15.639064560 -0400
+@@ -259,13 +259,6 @@ static char *scsi_devices[] = {
+ 	"Array Controller Device"
+ };
+ 
+-static char *chtostr(u8 * chars, int n)
+-{
+-	char tmp[256];
+-	tmp[0] = 0;
+-	return strncat(tmp, (char *)chars, n);
+-}
+-
+ static int i2o_report_query_status(struct seq_file *seq, int block_status,
+ 				   char *group)
+ {
+@@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
+ 
+ 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", ddm_table.module_id);
+-		seq_printf(seq, "%-29s",
+-			   chtostr(ddm_table.module_name_version, 28));
++		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
+ 		seq_printf(seq, "%9d  ", ddm_table.data_size);
+ 		seq_printf(seq, "%8d", ddm_table.code_size);
+ 
+@@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
+ 
+ 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
+ 		seq_printf(seq, "%-#8x", dst->module_id);
+-		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
+-		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
++		seq_printf(seq, "%-.28s", dst->module_name_version);
++		seq_printf(seq, "%-.8s", dst->date);
+ 		seq_printf(seq, "%8d ", dst->module_size);
+ 		seq_printf(seq, "%8d ", dst->mpb_size);
+ 		seq_printf(seq, "0x%04x", dst->module_flags);
+@@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
+ 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
+ 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
+ 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
+-	seq_printf(seq, "Vendor info   : %s\n",
+-		   chtostr((u8 *) (work32 + 2), 16));
+-	seq_printf(seq, "Product info  : %s\n",
+-		   chtostr((u8 *) (work32 + 6), 16));
+-	seq_printf(seq, "Description   : %s\n",
+-		   chtostr((u8 *) (work32 + 10), 16));
+-	seq_printf(seq, "Product rev.  : %s\n",
+-		   chtostr((u8 *) (work32 + 14), 8));
++	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
++	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
++	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
++	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
+ 
+ 	seq_printf(seq, "Serial number : ");
+ 	print_serial_number(seq, (u8 *) (work32 + 16),
+@@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
+ 	}
+ 
+ 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
+-	seq_printf(seq, "Module name         : %s\n",
+-		   chtostr(result.module_name, 24));
+-	seq_printf(seq, "Module revision     : %s\n",
+-		   chtostr(result.module_rev, 8));
++	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
++	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
+ 
+ 	seq_printf(seq, "Serial number       : ");
+ 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
+@@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
+ 		return 0;
+ 	}
+ 
+-	seq_printf(seq, "Device name     : %s\n",
+-		   chtostr(result.device_name, 64));
+-	seq_printf(seq, "Service name    : %s\n",
+-		   chtostr(result.service_name, 64));
+-	seq_printf(seq, "Physical name   : %s\n",
+-		   chtostr(result.physical_location, 64));
+-	seq_printf(seq, "Instance number : %s\n",
+-		   chtostr(result.instance_number, 4));
++	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
++	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
++	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
++	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/drivers/misc/kgdbts.c linux-2.6.32.14/drivers/misc/kgdbts.c
+--- linux-2.6.32.14/drivers/misc/kgdbts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/misc/kgdbts.c	2010-05-28 21:27:15.650946222 -0400
+@@ -118,7 +118,7 @@
+ 	} while (0)
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io kgdbts_io_ops;
++static const struct kgdb_io kgdbts_io_ops;
+ static char get_buf[BUFMAX];
+ static int get_buf_cnt;
+ static char put_buf[BUFMAX];
+@@ -1102,7 +1102,7 @@ static void kgdbts_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdbts_io_ops = {
++static const struct kgdb_io kgdbts_io_ops = {
+ 	.name			= "kgdbts",
+ 	.read_char		= kgdbts_get_char,
+ 	.write_char		= kgdbts_put_char,
+diff -urNp linux-2.6.32.14/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.14/drivers/misc/sgi-gru/gruhandles.c
+--- linux-2.6.32.14/drivers/misc/sgi-gru/gruhandles.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/misc/sgi-gru/gruhandles.c	2010-05-28 21:27:15.650946222 -0400
+@@ -39,8 +39,8 @@ struct mcs_op_statistic mcs_op_statistic
+ 
+ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
+ {
+-	atomic_long_inc(&mcs_op_statistics[op].count);
+-	atomic_long_add(clks, &mcs_op_statistics[op].total);
++	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
++	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
+ 	if (mcs_op_statistics[op].max < clks)
+ 		mcs_op_statistics[op].max = clks;
+ }
+diff -urNp linux-2.6.32.14/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.14/drivers/misc/sgi-gru/gruprocfs.c
+--- linux-2.6.32.14/drivers/misc/sgi-gru/gruprocfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/misc/sgi-gru/gruprocfs.c	2010-05-28 21:27:15.650946222 -0400
+@@ -32,9 +32,9 @@
+ 
+ #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
+ 
+-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
++static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
+ {
+-	unsigned long val = atomic_long_read(v);
++	unsigned long val = atomic_long_read_unchecked(v);
+ 
+ 	if (val)
+ 		seq_printf(s, "%16lu %s\n", val, id);
+@@ -136,8 +136,8 @@ static int mcs_statistics_show(struct se
+ 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+ 
+ 	for (op = 0; op < mcsop_last; op++) {
+-		count = atomic_long_read(&mcs_op_statistics[op].count);
+-		total = atomic_long_read(&mcs_op_statistics[op].total);
++		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
++		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
+ 		max = mcs_op_statistics[op].max;
+ 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
+ 			   count ? total / count : 0, max);
+diff -urNp linux-2.6.32.14/drivers/misc/sgi-gru/grutables.h linux-2.6.32.14/drivers/misc/sgi-gru/grutables.h
+--- linux-2.6.32.14/drivers/misc/sgi-gru/grutables.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/misc/sgi-gru/grutables.h	2010-05-28 21:27:15.650946222 -0400
+@@ -167,84 +167,84 @@ extern unsigned int gru_max_gids;
+  * GRU statistics.
+  */
+ struct gru_stats_s {
+-	atomic_long_t vdata_alloc;
+-	atomic_long_t vdata_free;
+-	atomic_long_t gts_alloc;
+-	atomic_long_t gts_free;
+-	atomic_long_t vdata_double_alloc;
+-	atomic_long_t gts_double_allocate;
+-	atomic_long_t assign_context;
+-	atomic_long_t assign_context_failed;
+-	atomic_long_t free_context;
+-	atomic_long_t load_user_context;
+-	atomic_long_t load_kernel_context;
+-	atomic_long_t lock_kernel_context;
+-	atomic_long_t unlock_kernel_context;
+-	atomic_long_t steal_user_context;
+-	atomic_long_t steal_kernel_context;
+-	atomic_long_t steal_context_failed;
+-	atomic_long_t nopfn;
+-	atomic_long_t break_cow;
+-	atomic_long_t asid_new;
+-	atomic_long_t asid_next;
+-	atomic_long_t asid_wrap;
+-	atomic_long_t asid_reuse;
+-	atomic_long_t intr;
+-	atomic_long_t intr_mm_lock_failed;
+-	atomic_long_t call_os;
+-	atomic_long_t call_os_offnode_reference;
+-	atomic_long_t call_os_check_for_bug;
+-	atomic_long_t call_os_wait_queue;
+-	atomic_long_t user_flush_tlb;
+-	atomic_long_t user_unload_context;
+-	atomic_long_t user_exception;
+-	atomic_long_t set_context_option;
+-	atomic_long_t migrate_check;
+-	atomic_long_t migrated_retarget;
+-	atomic_long_t migrated_unload;
+-	atomic_long_t migrated_unload_delay;
+-	atomic_long_t migrated_nopfn_retarget;
+-	atomic_long_t migrated_nopfn_unload;
+-	atomic_long_t tlb_dropin;
+-	atomic_long_t tlb_dropin_fail_no_asid;
+-	atomic_long_t tlb_dropin_fail_upm;
+-	atomic_long_t tlb_dropin_fail_invalid;
+-	atomic_long_t tlb_dropin_fail_range_active;
+-	atomic_long_t tlb_dropin_fail_idle;
+-	atomic_long_t tlb_dropin_fail_fmm;
+-	atomic_long_t tlb_dropin_fail_no_exception;
+-	atomic_long_t tlb_dropin_fail_no_exception_war;
+-	atomic_long_t tfh_stale_on_fault;
+-	atomic_long_t mmu_invalidate_range;
+-	atomic_long_t mmu_invalidate_page;
+-	atomic_long_t mmu_clear_flush_young;
+-	atomic_long_t flush_tlb;
+-	atomic_long_t flush_tlb_gru;
+-	atomic_long_t flush_tlb_gru_tgh;
+-	atomic_long_t flush_tlb_gru_zero_asid;
+-
+-	atomic_long_t copy_gpa;
+-
+-	atomic_long_t mesq_receive;
+-	atomic_long_t mesq_receive_none;
+-	atomic_long_t mesq_send;
+-	atomic_long_t mesq_send_failed;
+-	atomic_long_t mesq_noop;
+-	atomic_long_t mesq_send_unexpected_error;
+-	atomic_long_t mesq_send_lb_overflow;
+-	atomic_long_t mesq_send_qlimit_reached;
+-	atomic_long_t mesq_send_amo_nacked;
+-	atomic_long_t mesq_send_put_nacked;
+-	atomic_long_t mesq_qf_not_full;
+-	atomic_long_t mesq_qf_locked;
+-	atomic_long_t mesq_qf_noop_not_full;
+-	atomic_long_t mesq_qf_switch_head_failed;
+-	atomic_long_t mesq_qf_unexpected_error;
+-	atomic_long_t mesq_noop_unexpected_error;
+-	atomic_long_t mesq_noop_lb_overflow;
+-	atomic_long_t mesq_noop_qlimit_reached;
+-	atomic_long_t mesq_noop_amo_nacked;
+-	atomic_long_t mesq_noop_put_nacked;
++	atomic_long_unchecked_t vdata_alloc;
++	atomic_long_unchecked_t vdata_free;
++	atomic_long_unchecked_t gts_alloc;
++	atomic_long_unchecked_t gts_free;
++	atomic_long_unchecked_t vdata_double_alloc;
++	atomic_long_unchecked_t gts_double_allocate;
++	atomic_long_unchecked_t assign_context;
++	atomic_long_unchecked_t assign_context_failed;
++	atomic_long_unchecked_t free_context;
++	atomic_long_unchecked_t load_user_context;
++	atomic_long_unchecked_t load_kernel_context;
++	atomic_long_unchecked_t lock_kernel_context;
++	atomic_long_unchecked_t unlock_kernel_context;
++	atomic_long_unchecked_t steal_user_context;
++	atomic_long_unchecked_t steal_kernel_context;
++	atomic_long_unchecked_t steal_context_failed;
++	atomic_long_unchecked_t nopfn;
++	atomic_long_unchecked_t break_cow;
++	atomic_long_unchecked_t asid_new;
++	atomic_long_unchecked_t asid_next;
++	atomic_long_unchecked_t asid_wrap;
++	atomic_long_unchecked_t asid_reuse;
++	atomic_long_unchecked_t intr;
++	atomic_long_unchecked_t intr_mm_lock_failed;
++	atomic_long_unchecked_t call_os;
++	atomic_long_unchecked_t call_os_offnode_reference;
++	atomic_long_unchecked_t call_os_check_for_bug;
++	atomic_long_unchecked_t call_os_wait_queue;
++	atomic_long_unchecked_t user_flush_tlb;
++	atomic_long_unchecked_t user_unload_context;
++	atomic_long_unchecked_t user_exception;
++	atomic_long_unchecked_t set_context_option;
++	atomic_long_unchecked_t migrate_check;
++	atomic_long_unchecked_t migrated_retarget;
++	atomic_long_unchecked_t migrated_unload;
++	atomic_long_unchecked_t migrated_unload_delay;
++	atomic_long_unchecked_t migrated_nopfn_retarget;
++	atomic_long_unchecked_t migrated_nopfn_unload;
++	atomic_long_unchecked_t tlb_dropin;
++	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
++	atomic_long_unchecked_t tlb_dropin_fail_upm;
++	atomic_long_unchecked_t tlb_dropin_fail_invalid;
++	atomic_long_unchecked_t tlb_dropin_fail_range_active;
++	atomic_long_unchecked_t tlb_dropin_fail_idle;
++	atomic_long_unchecked_t tlb_dropin_fail_fmm;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
++	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
++	atomic_long_unchecked_t tfh_stale_on_fault;
++	atomic_long_unchecked_t mmu_invalidate_range;
++	atomic_long_unchecked_t mmu_invalidate_page;
++	atomic_long_unchecked_t mmu_clear_flush_young;
++	atomic_long_unchecked_t flush_tlb;
++	atomic_long_unchecked_t flush_tlb_gru;
++	atomic_long_unchecked_t flush_tlb_gru_tgh;
++	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
++
++	atomic_long_unchecked_t copy_gpa;
++
++	atomic_long_unchecked_t mesq_receive;
++	atomic_long_unchecked_t mesq_receive_none;
++	atomic_long_unchecked_t mesq_send;
++	atomic_long_unchecked_t mesq_send_failed;
++	atomic_long_unchecked_t mesq_noop;
++	atomic_long_unchecked_t mesq_send_unexpected_error;
++	atomic_long_unchecked_t mesq_send_lb_overflow;
++	atomic_long_unchecked_t mesq_send_qlimit_reached;
++	atomic_long_unchecked_t mesq_send_amo_nacked;
++	atomic_long_unchecked_t mesq_send_put_nacked;
++	atomic_long_unchecked_t mesq_qf_not_full;
++	atomic_long_unchecked_t mesq_qf_locked;
++	atomic_long_unchecked_t mesq_qf_noop_not_full;
++	atomic_long_unchecked_t mesq_qf_switch_head_failed;
++	atomic_long_unchecked_t mesq_qf_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_unexpected_error;
++	atomic_long_unchecked_t mesq_noop_lb_overflow;
++	atomic_long_unchecked_t mesq_noop_qlimit_reached;
++	atomic_long_unchecked_t mesq_noop_amo_nacked;
++	atomic_long_unchecked_t mesq_noop_put_nacked;
+ 
+ };
+ 
+@@ -252,8 +252,8 @@ enum mcs_op {cchop_allocate, cchop_start
+ 	cchop_deallocate, tghop_invalidate, mcsop_last};
+ 
+ struct mcs_op_statistic {
+-	atomic_long_t	count;
+-	atomic_long_t	total;
++	atomic_long_unchecked_t	count;
++	atomic_long_unchecked_t	total;
+ 	unsigned long	max;
+ };
+ 
+@@ -276,7 +276,7 @@ extern struct mcs_op_statistic mcs_op_st
+ 
+ #define STAT(id)	do {						\
+ 				if (gru_options & OPT_STATS)		\
+-					atomic_long_inc(&gru_stats.id);	\
++					atomic_long_inc_unchecked(&gru_stats.id);	\
+ 			} while (0)
+ 
+ #ifdef CONFIG_SGI_GRU_DEBUG
+diff -urNp linux-2.6.32.14/drivers/mtd/devices/doc2000.c linux-2.6.32.14/drivers/mtd/devices/doc2000.c
+--- linux-2.6.32.14/drivers/mtd/devices/doc2000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/mtd/devices/doc2000.c	2010-05-28 21:27:15.650946222 -0400
+@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
+ 
+ 		/* The ECC will not be calculated correctly if less than 512 is written */
+ /* DBB-
+-		if (len != 0x200 && eccbuf)
++		if (len != 0x200)
+ 			printk(KERN_WARNING
+ 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
+ 			       (long) to, (long) len);
+diff -urNp linux-2.6.32.14/drivers/mtd/devices/doc2001.c linux-2.6.32.14/drivers/mtd/devices/doc2001.c
+--- linux-2.6.32.14/drivers/mtd/devices/doc2001.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/mtd/devices/doc2001.c	2010-05-28 21:27:15.650946222 -0400
+@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
+ 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
+ 
+ 	/* Don't allow read past end of device */
+-	if (from >= this->totlen)
++	if (from >= this->totlen || !len)
+ 		return -EINVAL;
+ 
+ 	/* Don't allow a single read to cross a 512-byte block boundary */
+diff -urNp linux-2.6.32.14/drivers/mtd/ubi/build.c linux-2.6.32.14/drivers/mtd/ubi/build.c
+--- linux-2.6.32.14/drivers/mtd/ubi/build.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/mtd/ubi/build.c	2010-05-28 21:27:15.650946222 -0400
+@@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
+ static int __init bytes_str_to_int(const char *str)
+ {
+ 	char *endp;
+-	unsigned long result;
++	unsigned long result, scale = 1;
+ 
+ 	result = simple_strtoul(str, &endp, 0);
+ 	if (str == endp || result >= INT_MAX) {
+@@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
+ 
+ 	switch (*endp) {
+ 	case 'G':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'M':
+-		result *= 1024;
++		scale *= 1024;
+ 	case 'K':
+-		result *= 1024;
++		scale *= 1024;
+ 		if (endp[1] == 'i' && endp[2] == 'B')
+ 			endp += 2;
+ 	case '\0':
+@@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
+ 		return -EINVAL;
+ 	}
+ 
+-	return result;
++	if ((intoverflow_t)result*scale >= INT_MAX) {
++		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
++		       str);
++		return -EINVAL;
++	}
++
++	return result*scale;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.14/drivers/net/e1000e/82571.c linux-2.6.32.14/drivers/net/e1000e/82571.c
+--- linux-2.6.32.14/drivers/net/e1000e/82571.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/e1000e/82571.c	2010-05-28 21:27:15.655178202 -0400
+@@ -212,6 +212,7 @@ static s32 e1000_init_mac_params_82571(s
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 	u32 swsm = 0;
+ 	u32 swsm2 = 0;
+@@ -1656,7 +1657,7 @@ static void e1000_clear_hw_cntrs_82571(s
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations e82571_mac_ops = {
++static const struct e1000_mac_operations e82571_mac_ops = {
+ 	/* .check_mng_mode: mac type dependent */
+ 	/* .check_for_link: media type dependent */
+ 	.id_led_init		= e1000e_id_led_init,
+@@ -1674,7 +1675,7 @@ static struct e1000_mac_operations e8257
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_igp = {
++static const struct e1000_phy_operations e82_phy_ops_igp = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= NULL,
+@@ -1691,7 +1692,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_m88 = {
++static const struct e1000_phy_operations e82_phy_ops_m88 = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1708,7 +1709,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_phy_operations e82_phy_ops_bm = {
++static const struct e1000_phy_operations e82_phy_ops_bm = {
+ 	.acquire_phy		= e1000_get_hw_semaphore_82571,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy		= e1000e_phy_sw_reset,
+@@ -1725,7 +1726,7 @@ static struct e1000_phy_operations e82_p
+ 	.cfg_on_link_up      	= NULL,
+ };
+ 
+-static struct e1000_nvm_operations e82571_nvm_ops = {
++static const struct e1000_nvm_operations e82571_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_82571,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_82571,
+diff -urNp linux-2.6.32.14/drivers/net/e1000e/e1000.h linux-2.6.32.14/drivers/net/e1000e/e1000.h
+--- linux-2.6.32.14/drivers/net/e1000e/e1000.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/e1000e/e1000.h	2010-05-28 21:27:15.655178202 -0400
+@@ -375,9 +375,9 @@ struct e1000_info {
+ 	u32			pba;
+ 	u32			max_hw_frame_size;
+ 	s32			(*get_variants)(struct e1000_adapter *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ /* hardware capability, feature, and workaround flags */
+diff -urNp linux-2.6.32.14/drivers/net/e1000e/es2lan.c linux-2.6.32.14/drivers/net/e1000e/es2lan.c
+--- linux-2.6.32.14/drivers/net/e1000e/es2lan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/e1000e/es2lan.c	2010-05-28 21:27:15.655178202 -0400
+@@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_80003es
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	struct e1000_mac_info *mac = &hw->mac;
++	/* cannot be const */
+ 	struct e1000_mac_operations *func = &mac->ops;
+ 
+ 	/* Set media type */
+@@ -1365,7 +1366,7 @@ static void e1000_clear_hw_cntrs_80003es
+ 	temp = er32(ICRXDMTC);
+ }
+ 
+-static struct e1000_mac_operations es2_mac_ops = {
++static const struct e1000_mac_operations es2_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000e_check_mng_mode_generic,
+ 	/* check_for_link dependent on media type */
+@@ -1383,7 +1384,7 @@ static struct e1000_mac_operations es2_m
+ 	.setup_led		= e1000e_setup_led_generic,
+ };
+ 
+-static struct e1000_phy_operations es2_phy_ops = {
++static const struct e1000_phy_operations es2_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
+ 	.check_reset_block	= e1000e_check_reset_block_generic,
+ 	.commit_phy	 	= e1000e_phy_sw_reset,
+@@ -1400,7 +1401,7 @@ static struct e1000_phy_operations es2_p
+ 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
+ };
+ 
+-static struct e1000_nvm_operations es2_nvm_ops = {
++static const struct e1000_nvm_operations es2_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
+ 	.read_nvm		= e1000e_read_nvm_eerd,
+ 	.release_nvm		= e1000_release_nvm_80003es2lan,
+diff -urNp linux-2.6.32.14/drivers/net/e1000e/hw.h linux-2.6.32.14/drivers/net/e1000e/hw.h
+--- linux-2.6.32.14/drivers/net/e1000e/hw.h	2010-04-04 20:41:49.956500002 -0400
++++ linux-2.6.32.14/drivers/net/e1000e/hw.h	2010-05-28 21:27:15.659202304 -0400
+@@ -756,34 +756,34 @@ struct e1000_mac_operations {
+ 
+ /* Function pointers for the PHY. */
+ struct e1000_phy_operations {
+-	s32  (*acquire_phy)(struct e1000_hw *);
+-	s32  (*check_polarity)(struct e1000_hw *);
+-	s32  (*check_reset_block)(struct e1000_hw *);
+-	s32  (*commit_phy)(struct e1000_hw *);
+-	s32  (*force_speed_duplex)(struct e1000_hw *);
+-	s32  (*get_cfg_done)(struct e1000_hw *hw);
+-	s32  (*get_cable_length)(struct e1000_hw *);
+-	s32  (*get_phy_info)(struct e1000_hw *);
+-	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
+-	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
+-	void (*release_phy)(struct e1000_hw *);
+-	s32  (*reset_phy)(struct e1000_hw *);
+-	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
+-	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
+-	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
+-	s32  (*cfg_on_link_up)(struct e1000_hw *);
++	s32  (* acquire_phy)(struct e1000_hw *);
++	s32  (* check_polarity)(struct e1000_hw *);
++	s32  (* check_reset_block)(struct e1000_hw *);
++	s32  (* commit_phy)(struct e1000_hw *);
++	s32  (* force_speed_duplex)(struct e1000_hw *);
++	s32  (* get_cfg_done)(struct e1000_hw *hw);
++	s32  (* get_cable_length)(struct e1000_hw *);
++	s32  (* get_phy_info)(struct e1000_hw *);
++	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
++	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
++	void (* release_phy)(struct e1000_hw *);
++	s32  (* reset_phy)(struct e1000_hw *);
++	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
++	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
++	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
++	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
++	s32  (* cfg_on_link_up)(struct e1000_hw *);
+ };
+ 
+ /* Function pointers for the NVM. */
+ struct e1000_nvm_operations {
+-	s32  (*acquire_nvm)(struct e1000_hw *);
+-	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release_nvm)(struct e1000_hw *);
+-	s32  (*update_nvm)(struct e1000_hw *);
+-	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
+-	s32  (*validate_nvm)(struct e1000_hw *);
+-	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire_nvm)(struct e1000_hw *);
++	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release_nvm)(struct e1000_hw *);
++	s32  (* const update_nvm)(struct e1000_hw *);
++	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
++	s32  (* const validate_nvm)(struct e1000_hw *);
++	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_mac_info {
+diff -urNp linux-2.6.32.14/drivers/net/e1000e/ich8lan.c linux-2.6.32.14/drivers/net/e1000e/ich8lan.c
+--- linux-2.6.32.14/drivers/net/e1000e/ich8lan.c	2010-04-04 20:41:49.960543003 -0400
++++ linux-2.6.32.14/drivers/net/e1000e/ich8lan.c	2010-05-28 21:27:15.659202304 -0400
+@@ -3452,7 +3452,7 @@ static void e1000_clear_hw_cntrs_ich8lan
+ 	}
+ }
+ 
+-static struct e1000_mac_operations ich8_mac_ops = {
++static const struct e1000_mac_operations ich8_mac_ops = {
+ 	.id_led_init		= e1000e_id_led_init,
+ 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
+ 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
+@@ -3470,7 +3470,7 @@ static struct e1000_mac_operations ich8_
+ 	/* id_led_init dependent on mac type */
+ };
+ 
+-static struct e1000_phy_operations ich8_phy_ops = {
++static const struct e1000_phy_operations ich8_phy_ops = {
+ 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
+ 	.check_reset_block	= e1000_check_reset_block_ich8lan,
+ 	.commit_phy		= NULL,
+@@ -3486,7 +3486,7 @@ static struct e1000_phy_operations ich8_
+ 	.write_phy_reg		= e1000e_write_phy_reg_igp,
+ };
+ 
+-static struct e1000_nvm_operations ich8_nvm_ops = {
++static const struct e1000_nvm_operations ich8_nvm_ops = {
+ 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
+ 	.read_nvm	 	= e1000_read_nvm_ich8lan,
+ 	.release_nvm		= e1000_release_nvm_ich8lan,
+diff -urNp linux-2.6.32.14/drivers/net/ibmveth.c linux-2.6.32.14/drivers/net/ibmveth.c
+--- linux-2.6.32.14/drivers/net/ibmveth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/ibmveth.c	2010-05-28 21:27:15.659202304 -0400
+@@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
+ 	NULL,
+ };
+ 
+-static struct sysfs_ops veth_pool_ops = {
++static const struct sysfs_ops veth_pool_ops = {
+ 	.show   = veth_pool_show,
+ 	.store  = veth_pool_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/net/igb/e1000_82575.c linux-2.6.32.14/drivers/net/igb/e1000_82575.c
+--- linux-2.6.32.14/drivers/net/igb/e1000_82575.c	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.14/drivers/net/igb/e1000_82575.c	2010-05-28 21:27:15.659202304 -0400
+@@ -1401,7 +1401,7 @@ void igb_vmdq_set_replication_pf(struct 
+ 	wr32(E1000_VT_CTL, vt_ctl);
+ }
+ 
+-static struct e1000_mac_operations e1000_mac_ops_82575 = {
++static const struct e1000_mac_operations e1000_mac_ops_82575 = {
+ 	.reset_hw             = igb_reset_hw_82575,
+ 	.init_hw              = igb_init_hw_82575,
+ 	.check_for_link       = igb_check_for_link_82575,
+@@ -1410,13 +1410,13 @@ static struct e1000_mac_operations e1000
+ 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
+ };
+ 
+-static struct e1000_phy_operations e1000_phy_ops_82575 = {
++static const struct e1000_phy_operations e1000_phy_ops_82575 = {
+ 	.acquire              = igb_acquire_phy_82575,
+ 	.get_cfg_done         = igb_get_cfg_done_82575,
+ 	.release              = igb_release_phy_82575,
+ };
+ 
+-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
++static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
+ 	.acquire              = igb_acquire_nvm_82575,
+ 	.read                 = igb_read_nvm_eerd,
+ 	.release              = igb_release_nvm_82575,
+diff -urNp linux-2.6.32.14/drivers/net/igb/e1000_hw.h linux-2.6.32.14/drivers/net/igb/e1000_hw.h
+--- linux-2.6.32.14/drivers/net/igb/e1000_hw.h	2010-04-29 17:49:38.085476187 -0400
++++ linux-2.6.32.14/drivers/net/igb/e1000_hw.h	2010-05-28 21:27:15.659202304 -0400
+@@ -303,17 +303,17 @@ struct e1000_phy_operations {
+ };
+ 
+ struct e1000_nvm_operations {
+-	s32  (*acquire)(struct e1000_hw *);
+-	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
+-	void (*release)(struct e1000_hw *);
+-	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
++	s32  (* const acquire)(struct e1000_hw *);
++	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
++	void (* const release)(struct e1000_hw *);
++	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
+ };
+ 
+ struct e1000_info {
+ 	s32 (*get_invariants)(struct e1000_hw *);
+-	struct e1000_mac_operations *mac_ops;
+-	struct e1000_phy_operations *phy_ops;
+-	struct e1000_nvm_operations *nvm_ops;
++	const struct e1000_mac_operations *mac_ops;
++	const struct e1000_phy_operations *phy_ops;
++	const struct e1000_nvm_operations *nvm_ops;
+ };
+ 
+ extern const struct e1000_info e1000_82575_info;
+diff -urNp linux-2.6.32.14/drivers/net/irda/vlsi_ir.c linux-2.6.32.14/drivers/net/irda/vlsi_ir.c
+--- linux-2.6.32.14/drivers/net/irda/vlsi_ir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/irda/vlsi_ir.c	2010-05-28 21:27:15.662946876 -0400
+@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
+ 			/* no race - tx-ring already empty */
+ 			vlsi_set_baud(idev, iobase);
+ 			netif_wake_queue(ndev);
+-		}
+-		else
+-			;
++		} else {
+ 			/* keep the speed change pending like it would
+ 			 * for any len>0 packet. tx completion interrupt
+ 			 * will apply it when the tx ring becomes empty.
+ 			 */
++		}
+ 		spin_unlock_irqrestore(&idev->lock, flags);
+ 		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+diff -urNp linux-2.6.32.14/drivers/net/iseries_veth.c linux-2.6.32.14/drivers/net/iseries_veth.c
+--- linux-2.6.32.14/drivers/net/iseries_veth.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/iseries_veth.c	2010-05-28 21:27:15.662946876 -0400
+@@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_cnx_sysfs_ops = {
++static const struct sysfs_ops veth_cnx_sysfs_ops = {
+ 		.show = veth_cnx_attribute_show
+ };
+ 
+@@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
+ 	NULL
+ };
+ 
+-static struct sysfs_ops veth_port_sysfs_ops = {
++static const struct sysfs_ops veth_port_sysfs_ops = {
+ 	.show = veth_port_attribute_show
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/net/pcnet32.c linux-2.6.32.14/drivers/net/pcnet32.c
+--- linux-2.6.32.14/drivers/net/pcnet32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/pcnet32.c	2010-05-28 21:27:15.662946876 -0400
+@@ -79,7 +79,7 @@ static int cards_found;
+ /*
+  * VLB I/O addresses
+  */
+-static unsigned int pcnet32_portlist[] __initdata =
++static unsigned int pcnet32_portlist[] __devinitdata =
+     { 0x300, 0x320, 0x340, 0x360, 0 };
+ 
+ static int pcnet32_debug = 0;
+diff -urNp linux-2.6.32.14/drivers/net/tg3.h linux-2.6.32.14/drivers/net/tg3.h
+--- linux-2.6.32.14/drivers/net/tg3.h	2010-04-04 20:41:49.968494922 -0400
++++ linux-2.6.32.14/drivers/net/tg3.h	2010-05-28 21:27:15.662946876 -0400
+@@ -95,6 +95,7 @@
+ #define  CHIPREV_ID_5750_A0		 0x4000
+ #define  CHIPREV_ID_5750_A1		 0x4001
+ #define  CHIPREV_ID_5750_A3		 0x4003
++#define  CHIPREV_ID_5750_C1		 0x4201
+ #define  CHIPREV_ID_5750_C2		 0x4202
+ #define  CHIPREV_ID_5752_A0_HW		 0x5000
+ #define  CHIPREV_ID_5752_A0		 0x6000
+diff -urNp linux-2.6.32.14/drivers/net/tulip/de4x5.c linux-2.6.32.14/drivers/net/tulip/de4x5.c
+--- linux-2.6.32.14/drivers/net/tulip/de4x5.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/tulip/de4x5.c	2010-05-28 21:27:15.696210343 -0400
+@@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	for (i=0; i<ETH_ALEN; i++) {
+ 	    tmp.addr[i] = dev->dev_addr[i];
+ 	}
+-	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
++	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+ 	break;
+ 
+     case DE4X5_SET_HWADDR:           /* Set the hardware address */
+@@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
+ 	spin_lock_irqsave(&lp->lock, flags);
+ 	memcpy(&statbuf, &lp->pktStats, ioc->len);
+ 	spin_unlock_irqrestore(&lp->lock, flags);
+-	if (copy_to_user(ioc->data, &statbuf, ioc->len))
++	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
+ 		return -EFAULT;
+ 	break;
+     }
+diff -urNp linux-2.6.32.14/drivers/net/usb/hso.c linux-2.6.32.14/drivers/net/usb/hso.c
+--- linux-2.6.32.14/drivers/net/usb/hso.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/usb/hso.c	2010-05-28 21:27:15.699197955 -0400
+@@ -258,7 +258,7 @@ struct hso_serial {
+ 
+ 	/* from usb_serial_port */
+ 	struct tty_struct *tty;
+-	int open_count;
++	atomic_t open_count;
+ 	spinlock_t serial_lock;
+ 
+ 	int (*write_data) (struct hso_serial *serial);
+@@ -1180,7 +1180,7 @@ static void put_rxbuf_data_and_resubmit_
+ 	struct urb *urb;
+ 
+ 	urb = serial->rx_urb[0];
+-	if (serial->open_count > 0) {
++	if (atomic_read(&serial->open_count) > 0) {
+ 		count = put_rxbuf_data(urb, serial);
+ 		if (count == -1)
+ 			return;
+@@ -1216,7 +1216,7 @@ static void hso_std_serial_read_bulk_cal
+ 	DUMP1(urb->transfer_buffer, urb->actual_length);
+ 
+ 	/* Anyone listening? */
+-	if (serial->open_count == 0)
++	if (atomic_read(&serial->open_count) == 0)
+ 		return;
+ 
+ 	if (status == 0) {
+@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
+ 	spin_unlock_irq(&serial->serial_lock);
+ 
+ 	/* check for port already opened, if not set the termios */
+-	serial->open_count++;
+-	if (serial->open_count == 1) {
++	if (atomic_inc_return(&serial->open_count) == 1) {
+ 		tty->low_latency = 1;
+ 		serial->rx_state = RX_IDLE;
+ 		/* Force default termio settings */
+@@ -1325,7 +1324,7 @@ static int hso_serial_open(struct tty_st
+ 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
+ 		if (result) {
+ 			hso_stop_serial_device(serial->parent);
+-			serial->open_count--;
++			atomic_dec(&serial->open_count);
+ 			kref_put(&serial->parent->ref, hso_serial_ref_free);
+ 		}
+ 	} else {
+@@ -1362,10 +1361,10 @@ static void hso_serial_close(struct tty_
+ 
+ 	/* reset the rts and dtr */
+ 	/* do the actual close */
+-	serial->open_count--;
++	atomic_dec(&serial->open_count);
+ 
+-	if (serial->open_count <= 0) {
+-		serial->open_count = 0;
++	if (atomic_read(&serial->open_count) <= 0) {
++		atomic_set(&serial->open_count,  0);
+ 		spin_lock_irq(&serial->serial_lock);
+ 		if (serial->tty == tty) {
+ 			serial->tty->driver_data = NULL;
+@@ -1447,7 +1446,7 @@ static void hso_serial_set_termios(struc
+ 
+ 	/* the actual setup */
+ 	spin_lock_irqsave(&serial->serial_lock, flags);
+-	if (serial->open_count)
++	if (atomic_read(&serial->open_count))
+ 		_hso_serial_set_termios(tty, old);
+ 	else
+ 		tty->termios = old;
+@@ -3095,7 +3094,7 @@ static int hso_resume(struct usb_interfa
+ 	/* Start all serial ports */
+ 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
+ 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
+-			if (dev2ser(serial_table[i])->open_count) {
++			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
+ 				result =
+ 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
+ 				hso_kick_transmit(dev2ser(serial_table[i]));
+diff -urNp linux-2.6.32.14/drivers/net/wireless/b43/debugfs.c linux-2.6.32.14/drivers/net/wireless/b43/debugfs.c
+--- linux-2.6.32.14/drivers/net/wireless/b43/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/b43/debugfs.c	2010-05-28 21:27:15.699197955 -0400
+@@ -43,7 +43,7 @@ static struct dentry *rootdir;
+ struct b43_debugfs_fops {
+ 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
+ 	size_t file_struct_offset;
+ };
+diff -urNp linux-2.6.32.14/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.14/drivers/net/wireless/b43legacy/debugfs.c
+--- linux-2.6.32.14/drivers/net/wireless/b43legacy/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/b43legacy/debugfs.c	2010-05-28 21:27:15.699197955 -0400
+@@ -44,7 +44,7 @@ static struct dentry *rootdir;
+ struct b43legacy_debugfs_fops {
+ 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
+ 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
+-	struct file_operations fops;
++	const struct file_operations fops;
+ 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
+ 	size_t file_struct_offset;
+ 	/* Take wl->irq_lock before calling read/write? */
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-1000.c
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-1000.c	2010-05-28 21:27:15.699197955 -0400
+@@ -137,7 +137,7 @@ static struct iwl_lib_ops iwl1000_lib = 
+ 	 },
+ };
+ 
+-static struct iwl_ops iwl1000_ops = {
++static const struct iwl_ops iwl1000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl1000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-3945.c
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-04-04 20:41:49.972919715 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-3945.c	2010-05-28 21:27:15.707206768 -0400
+@@ -2874,7 +2874,7 @@ static struct iwl_hcmd_utils_ops iwl3945
+ 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+ };
+ 
+-static struct iwl_ops iwl3945_ops = {
++static const struct iwl_ops iwl3945_ops = {
+ 	.ucode = &iwl3945_ucode,
+ 	.lib = &iwl3945_lib,
+ 	.hcmd = &iwl3945_hcmd,
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-4965.c
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-05-28 20:16:44.442935997 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-4965.c	2010-05-28 21:27:15.707206768 -0400
+@@ -2345,7 +2345,7 @@ static struct iwl_lib_ops iwl4965_lib = 
+ 	},
+ };
+ 
+-static struct iwl_ops iwl4965_ops = {
++static const struct iwl_ops iwl4965_ops = {
+ 	.ucode = &iwl4965_ucode,
+ 	.lib = &iwl4965_lib,
+ 	.hcmd = &iwl4965_hcmd,
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-5000.c
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-05-28 20:16:44.446927415 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-5000.c	2010-05-28 21:27:15.707206768 -0400
+@@ -1633,14 +1633,14 @@ static struct iwl_lib_ops iwl5150_lib = 
+ 	 },
+ };
+ 
+-struct iwl_ops iwl5000_ops = {
++const struct iwl_ops iwl5000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+ 	.utils = &iwl5000_hcmd_utils,
+ };
+ 
+-static struct iwl_ops iwl5150_ops = {
++static const struct iwl_ops iwl5150_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl5150_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-6000.c
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-6000.c	2010-05-28 21:27:15.707206768 -0400
+@@ -146,7 +146,7 @@ static struct iwl_hcmd_utils_ops iwl6000
+ 	.calc_rssi = iwl5000_calc_rssi,
+ };
+ 
+-static struct iwl_ops iwl6000_ops = {
++static const struct iwl_ops iwl6000_ops = {
+ 	.ucode = &iwl5000_ucode,
+ 	.lib = &iwl6000_lib,
+ 	.hcmd = &iwl5000_hcmd,
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-debug.h	2010-05-28 21:27:15.707206768 -0400
+@@ -118,8 +118,8 @@ void iwl_dbgfs_unregister(struct iwl_pri
+ #endif
+ 
+ #else
+-#define IWL_DEBUG(__priv, level, fmt, args...)
+-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
++#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
++#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
+ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
+ 				      void *p, u32 len)
+ {}
+diff -urNp linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-dev.h
+--- linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/iwlwifi/iwl-dev.h	2010-05-28 21:27:15.707206768 -0400
+@@ -67,7 +67,7 @@ struct iwl_tx_queue;
+ 
+ /* shared structures from iwl-5000.c */
+ extern struct iwl_mod_params iwl50_mod_params;
+-extern struct iwl_ops iwl5000_ops;
++extern const struct iwl_ops iwl5000_ops;
+ extern struct iwl_ucode_ops iwl5000_ucode;
+ extern struct iwl_lib_ops iwl5000_lib;
+ extern struct iwl_hcmd_ops iwl5000_hcmd;
+diff -urNp linux-2.6.32.14/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.14/drivers/net/wireless/libertas/debugfs.c
+--- linux-2.6.32.14/drivers/net/wireless/libertas/debugfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/libertas/debugfs.c	2010-05-28 21:27:15.715208538 -0400
+@@ -708,7 +708,7 @@ out_unlock:
+ struct lbs_debugfs_files {
+ 	const char *name;
+ 	int perm;
+-	struct file_operations fops;
++	const struct file_operations fops;
+ };
+ 
+ static const struct lbs_debugfs_files debugfs_files[] = {
+diff -urNp linux-2.6.32.14/drivers/net/wireless/rndis_wlan.c linux-2.6.32.14/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.32.14/drivers/net/wireless/rndis_wlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/net/wireless/rndis_wlan.c	2010-05-28 21:27:15.715208538 -0400
+@@ -1176,7 +1176,7 @@ static int set_rts_threshold(struct usbn
+ 
+ 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
+ 
+-	if (rts_threshold < 0 || rts_threshold > 2347)
++	if (rts_threshold > 2347)
+ 		rts_threshold = 2347;
+ 
+ 	tmp = cpu_to_le32(rts_threshold);
+diff -urNp linux-2.6.32.14/drivers/oprofile/buffer_sync.c linux-2.6.32.14/drivers/oprofile/buffer_sync.c
+--- linux-2.6.32.14/drivers/oprofile/buffer_sync.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/buffer_sync.c	2010-05-28 21:27:15.718942362 -0400
+@@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
+ 		if (cookie == NO_COOKIE)
+ 			offset = pc;
+ 		if (cookie == INVALID_COOKIE) {
+-			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 			offset = pc;
+ 		}
+ 		if (cookie != last_cookie) {
+@@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct 
+ 	/* add userspace sample */
+ 
+ 	if (!mm) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mm);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
+ 		return 0;
+ 	}
+ 
+ 	cookie = lookup_dcookie(mm, s->eip, &offset);
+ 
+ 	if (cookie == INVALID_COOKIE) {
+-		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
++		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
+ 		return 0;
+ 	}
+ 
+@@ -560,7 +560,7 @@ void sync_buffer(int cpu)
+ 		/* ignore backtraces if failed to add a sample */
+ 		if (state == sb_bt_start) {
+ 			state = sb_bt_ignore;
+-			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
++			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
+ 		}
+ 	}
+ 	release_mm(mm);
+diff -urNp linux-2.6.32.14/drivers/oprofile/event_buffer.c linux-2.6.32.14/drivers/oprofile/event_buffer.c
+--- linux-2.6.32.14/drivers/oprofile/event_buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/event_buffer.c	2010-05-28 21:27:15.718942362 -0400
+@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
+ 	}
+ 
+ 	if (buffer_pos == buffer_size) {
+-		atomic_inc(&oprofile_stats.event_lost_overflow);
++		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
+ 		return;
+ 	}
+ 
+diff -urNp linux-2.6.32.14/drivers/oprofile/oprof.c linux-2.6.32.14/drivers/oprofile/oprof.c
+--- linux-2.6.32.14/drivers/oprofile/oprof.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/oprof.c	2010-05-28 21:27:15.718942362 -0400
+@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
+ 	if (oprofile_ops.switch_events())
+ 		return;
+ 
+-	atomic_inc(&oprofile_stats.multiplex_counter);
++	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
+ 	start_switch_worker();
+ }
+ 
+diff -urNp linux-2.6.32.14/drivers/oprofile/oprofilefs.c linux-2.6.32.14/drivers/oprofile/oprofilefs.c
+--- linux-2.6.32.14/drivers/oprofile/oprofilefs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/oprofilefs.c	2010-05-28 21:27:15.718942362 -0400
+@@ -187,7 +187,7 @@ static const struct file_operations atom
+ 
+ 
+ int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
+-	char const *name, atomic_t *val)
++	char const *name, atomic_unchecked_t *val)
+ {
+ 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
+ 						     &atomic_ro_fops, 0444);
+diff -urNp linux-2.6.32.14/drivers/oprofile/oprofile_stats.c linux-2.6.32.14/drivers/oprofile/oprofile_stats.c
+--- linux-2.6.32.14/drivers/oprofile/oprofile_stats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/oprofile_stats.c	2010-05-28 21:27:15.718942362 -0400
+@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
+ 		cpu_buf->sample_invalid_eip = 0;
+ 	}
+ 
+-	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
+-	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.event_lost_overflow, 0);
+-	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
+-	atomic_set(&oprofile_stats.multiplex_counter, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
++	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
++	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
++	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
+ }
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/oprofile/oprofile_stats.h linux-2.6.32.14/drivers/oprofile/oprofile_stats.h
+--- linux-2.6.32.14/drivers/oprofile/oprofile_stats.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/oprofile/oprofile_stats.h	2010-05-28 21:27:15.718942362 -0400
+@@ -13,11 +13,11 @@
+ #include <asm/atomic.h>
+ 
+ struct oprofile_stat_struct {
+-	atomic_t sample_lost_no_mm;
+-	atomic_t sample_lost_no_mapping;
+-	atomic_t bt_lost_no_mapping;
+-	atomic_t event_lost_overflow;
+-	atomic_t multiplex_counter;
++	atomic_unchecked_t sample_lost_no_mm;
++	atomic_unchecked_t sample_lost_no_mapping;
++	atomic_unchecked_t bt_lost_no_mapping;
++	atomic_unchecked_t event_lost_overflow;
++	atomic_unchecked_t multiplex_counter;
+ };
+ 
+ extern struct oprofile_stat_struct oprofile_stats;
+diff -urNp linux-2.6.32.14/drivers/parisc/pdc_stable.c linux-2.6.32.14/drivers/parisc/pdc_stable.c
+--- linux-2.6.32.14/drivers/parisc/pdc_stable.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/parisc/pdc_stable.c	2010-05-28 21:27:15.727198333 -0400
+@@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops pdcspath_attr_ops = {
++static const struct sysfs_ops pdcspath_attr_ops = {
+ 	.show = pdcspath_attr_show,
+ 	.store = pdcspath_attr_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/parport/procfs.c linux-2.6.32.14/drivers/parport/procfs.c
+--- linux-2.6.32.14/drivers/parport/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/parport/procfs.c	2010-05-28 21:27:15.727198333 -0400
+@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
+ }
+ 
+ #ifdef CONFIG_PARPORT_1284
+@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
+ 
+ 	*ppos += len;
+ 
+-	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
++	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
+ }
+ #endif /* IEEE1284.3 support. */
+ 
+diff -urNp linux-2.6.32.14/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.14/drivers/pci/hotplug/acpiphp_glue.c
+--- linux-2.6.32.14/drivers/pci/hotplug/acpiphp_glue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/hotplug/acpiphp_glue.c	2010-05-28 21:27:15.727198333 -0400
+@@ -111,7 +111,7 @@ static int post_dock_fixups(struct notif
+ }
+ 
+ 
+-static struct acpi_dock_ops acpiphp_dock_ops = {
++static const struct acpi_dock_ops acpiphp_dock_ops = {
+ 	.handler = handle_hotplug_event_func,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.14/drivers/pci/hotplug/cpqphp_nvram.c
+--- linux-2.6.32.14/drivers/pci/hotplug/cpqphp_nvram.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/hotplug/cpqphp_nvram.c	2010-05-28 21:27:15.727198333 -0400
+@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
+ 
+ void compaq_nvram_init (void __iomem *rom_start)
+ {
++
++#ifndef CONFIG_PAX_KERNEXEC
+ 	if (rom_start) {
+ 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
+ 	}
++#endif
++
+ 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
+ 
+ 	/* initialize our int15 lock */
+diff -urNp linux-2.6.32.14/drivers/pci/hotplug/fakephp.c linux-2.6.32.14/drivers/pci/hotplug/fakephp.c
+--- linux-2.6.32.14/drivers/pci/hotplug/fakephp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/hotplug/fakephp.c	2010-05-28 21:27:15.727198333 -0400
+@@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
+ }
+ 
+ static struct kobj_type legacy_ktype = {
+-	.sysfs_ops = &(struct sysfs_ops){
++	.sysfs_ops = &(const struct sysfs_ops){
+ 		.store = legacy_store, .show = legacy_show
+ 	},
+ 	.release = &legacy_release,
+diff -urNp linux-2.6.32.14/drivers/pci/intel-iommu.c linux-2.6.32.14/drivers/pci/intel-iommu.c
+--- linux-2.6.32.14/drivers/pci/intel-iommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/intel-iommu.c	2010-05-28 21:27:15.730990089 -0400
+@@ -2950,7 +2950,7 @@ static int intel_mapping_error(struct de
+ 	return !dma_addr;
+ }
+ 
+-struct dma_map_ops intel_dma_ops = {
++const struct dma_map_ops intel_dma_ops = {
+ 	.alloc_coherent = intel_alloc_coherent,
+ 	.free_coherent = intel_free_coherent,
+ 	.map_sg = intel_map_sg,
+diff -urNp linux-2.6.32.14/drivers/pci/pcie/portdrv_pci.c linux-2.6.32.14/drivers/pci/pcie/portdrv_pci.c
+--- linux-2.6.32.14/drivers/pci/pcie/portdrv_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/pcie/portdrv_pci.c	2010-05-28 21:27:15.730990089 -0400
+@@ -249,7 +249,7 @@ static void pcie_portdrv_err_resume(stru
+ static const struct pci_device_id port_pci_ids[] = { {
+ 	/* handle any PCI-Express port */
+ 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, port_pci_ids);
+ 
+diff -urNp linux-2.6.32.14/drivers/pci/probe.c linux-2.6.32.14/drivers/pci/probe.c
+--- linux-2.6.32.14/drivers/pci/probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/probe.c	2010-05-28 21:27:15.739209869 -0400
+@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
+ 	return ret;
+ }
+ 
+-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+ 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
+ }
+ 
+-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
++static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
+ 					struct device_attribute *attr,
+ 					char *buf)
+ {
+diff -urNp linux-2.6.32.14/drivers/pci/proc.c linux-2.6.32.14/drivers/pci/proc.c
+--- linux-2.6.32.14/drivers/pci/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/proc.c	2010-05-28 21:27:15.739209869 -0400
+@@ -480,7 +480,16 @@ static const struct file_operations proc
+ static int __init pci_proc_init(void)
+ {
+ 	struct pci_dev *dev = NULL;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
++#endif
+ 	proc_create("devices", 0, proc_bus_pci_dir,
+ 		    &proc_bus_pci_dev_operations);
+ 	proc_initialized = 1;
+diff -urNp linux-2.6.32.14/drivers/pci/slot.c linux-2.6.32.14/drivers/pci/slot.c
+--- linux-2.6.32.14/drivers/pci/slot.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pci/slot.c	2010-05-28 21:27:15.739209869 -0400
+@@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
+ 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
+ }
+ 
+-static struct sysfs_ops pci_slot_sysfs_ops = {
++static const struct sysfs_ops pci_slot_sysfs_ops = {
+ 	.show = pci_slot_attr_show,
+ 	.store = pci_slot_attr_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/pcmcia/ti113x.h linux-2.6.32.14/drivers/pcmcia/ti113x.h
+--- linux-2.6.32.14/drivers/pcmcia/ti113x.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pcmcia/ti113x.h	2010-05-28 21:27:15.743188935 -0400
+@@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
+ 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
+ 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
+ 
+-	{}
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
+diff -urNp linux-2.6.32.14/drivers/pcmcia/yenta_socket.c linux-2.6.32.14/drivers/pcmcia/yenta_socket.c
+--- linux-2.6.32.14/drivers/pcmcia/yenta_socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pcmcia/yenta_socket.c	2010-05-28 21:27:15.751196243 -0400
+@@ -1387,7 +1387,7 @@ static struct pci_device_id yenta_table 
+ 
+ 	/* match any cardbus bridge */
+ 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
+-	{ /* all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, yenta_table);
+ 
+diff -urNp linux-2.6.32.14/drivers/platform/x86/acer-wmi.c linux-2.6.32.14/drivers/platform/x86/acer-wmi.c
+--- linux-2.6.32.14/drivers/platform/x86/acer-wmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/acer-wmi.c	2010-05-28 21:27:15.759196972 -0400
+@@ -918,7 +918,7 @@ static int update_bl_status(struct backl
+ 	return 0;
+ }
+ 
+-static struct backlight_ops acer_bl_ops = {
++static const struct backlight_ops acer_bl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/asus_acpi.c linux-2.6.32.14/drivers/platform/x86/asus_acpi.c
+--- linux-2.6.32.14/drivers/platform/x86/asus_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/asus_acpi.c	2010-05-28 21:27:15.759196972 -0400
+@@ -1402,7 +1402,7 @@ static int asus_hotk_remove(struct acpi_
+ 	return 0;
+ }
+ 
+-static struct backlight_ops asus_backlight_data = {
++static const struct backlight_ops asus_backlight_data = {
+ 	.get_brightness = read_brightness,
+ 	.update_status  = set_brightness_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/asus-laptop.c linux-2.6.32.14/drivers/platform/x86/asus-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/asus-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/asus-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -250,7 +250,7 @@ static struct backlight_device *asus_bac
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops asusbl_ops = {
++static const struct backlight_ops asusbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/compal-laptop.c linux-2.6.32.14/drivers/platform/x86/compal-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/compal-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/compal-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -163,7 +163,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops compalbl_ops = {
++static const struct backlight_ops compalbl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status	= bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/dell-laptop.c linux-2.6.32.14/drivers/platform/x86/dell-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/dell-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/dell-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -305,7 +305,7 @@ static int dell_get_intensity(struct bac
+ 	return buffer.output[1];
+ }
+ 
+-static struct backlight_ops dell_ops = {
++static const struct backlight_ops dell_ops = {
+ 	.get_brightness = dell_get_intensity,
+ 	.update_status  = dell_send_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.14/drivers/platform/x86/eeepc-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/eeepc-laptop.c	2010-04-29 17:49:38.317493070 -0400
++++ linux-2.6.32.14/drivers/platform/x86/eeepc-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -245,7 +245,7 @@ static struct device *eeepc_hwmon_device
+  */
+ static int read_brightness(struct backlight_device *bd);
+ static int update_bl_status(struct backlight_device *bd);
+-static struct backlight_ops eeepcbl_ops = {
++static const struct backlight_ops eeepcbl_ops = {
+ 	.get_brightness = read_brightness,
+ 	.update_status = update_bl_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.14/drivers/platform/x86/fujitsu-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/fujitsu-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/fujitsu-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -436,7 +436,7 @@ static int bl_update_status(struct backl
+ 	return ret;
+ }
+ 
+-static struct backlight_ops fujitsubl_ops = {
++static const struct backlight_ops fujitsubl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status = bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/msi-laptop.c linux-2.6.32.14/drivers/platform/x86/msi-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/msi-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/msi-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -161,7 +161,7 @@ static int bl_update_status(struct backl
+ 	return set_lcd_level(b->props.brightness);
+ }
+ 
+-static struct backlight_ops msibl_ops = {
++static const struct backlight_ops msibl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ 	.update_status  = bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.14/drivers/platform/x86/panasonic-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/panasonic-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/panasonic-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
+ 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
+ }
+ 
+-static struct backlight_ops pcc_backlight_ops = {
++static const struct backlight_ops pcc_backlight_ops = {
+ 	.get_brightness	= bl_get,
+ 	.update_status	= bl_set_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/sony-laptop.c linux-2.6.32.14/drivers/platform/x86/sony-laptop.c
+--- linux-2.6.32.14/drivers/platform/x86/sony-laptop.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/sony-laptop.c	2010-05-28 21:27:15.759196972 -0400
+@@ -850,7 +850,7 @@ static int sony_backlight_get_brightness
+ }
+ 
+ static struct backlight_device *sony_backlight_device;
+-static struct backlight_ops sony_backlight_ops = {
++static const struct backlight_ops sony_backlight_ops = {
+ 	.update_status = sony_backlight_update_status,
+ 	.get_brightness = sony_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.14/drivers/platform/x86/thinkpad_acpi.c
+--- linux-2.6.32.14/drivers/platform/x86/thinkpad_acpi.c	2010-04-29 17:49:38.333363657 -0400
++++ linux-2.6.32.14/drivers/platform/x86/thinkpad_acpi.c	2010-05-28 21:27:15.763212426 -0400
+@@ -6122,7 +6122,7 @@ static void tpacpi_brightness_notify_cha
+ 			       BACKLIGHT_UPDATE_HOTKEY);
+ }
+ 
+-static struct backlight_ops ibm_backlight_data = {
++static const struct backlight_ops ibm_backlight_data = {
+ 	.get_brightness = brightness_get,
+ 	.update_status  = brightness_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.14/drivers/platform/x86/toshiba_acpi.c
+--- linux-2.6.32.14/drivers/platform/x86/toshiba_acpi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/platform/x86/toshiba_acpi.c	2010-05-28 21:27:15.763212426 -0400
+@@ -671,7 +671,7 @@ static acpi_status remove_device(void)
+ 	return AE_OK;
+ }
+ 
+-static struct backlight_ops toshiba_backlight_data = {
++static const struct backlight_ops toshiba_backlight_data = {
+         .get_brightness = get_lcd,
+         .update_status  = set_lcd_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.14/drivers/pnp/pnpbios/bioscalls.c
+--- linux-2.6.32.14/drivers/pnp/pnpbios/bioscalls.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pnp/pnpbios/bioscalls.c	2010-05-28 21:27:15.763212426 -0400
+@@ -60,7 +60,7 @@ do { \
+ 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
+ } while(0)
+ 
+-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
++static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
+ 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
+ 
+ /*
+@@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
+ 
+ 	cpu = get_cpu();
+ 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
++
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
++	pax_close_kernel();
+ 
+ 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
+ 	spin_lock_irqsave(&pnp_bios_lock, flags);
+@@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
+ 			     :"memory");
+ 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
+ 
++	pax_open_kernel();
+ 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
++	pax_close_kernel();
++
+ 	put_cpu();
+ 
+ 	/* If we get here and this is set then the PnP BIOS faulted on us. */
+@@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
+ 	return status;
+ }
+ 
+-void pnpbios_calls_init(union pnp_bios_install_struct *header)
++void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
+ {
+ 	int i;
+ 
+@@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
+ 	pnp_bios_callpoint.offset = header->fields.pm16offset;
+ 	pnp_bios_callpoint.segment = PNP_CS16;
+ 
++	pax_open_kernel();
++
+ 	for_each_possible_cpu(i) {
+ 		struct desc_struct *gdt = get_cpu_gdt_table(i);
+ 		if (!gdt)
+@@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
+ 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
+ 			 (unsigned long)__va(header->fields.pm16dseg));
+ 	}
++
++	pax_close_kernel();
+ }
+diff -urNp linux-2.6.32.14/drivers/pnp/quirks.c linux-2.6.32.14/drivers/pnp/quirks.c
+--- linux-2.6.32.14/drivers/pnp/quirks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pnp/quirks.c	2010-05-28 21:27:15.763212426 -0400
+@@ -327,7 +327,7 @@ static struct pnp_fixup pnp_fixups[] = {
+ 	/* PnP resources that might overlap PCI BARs */
+ 	{"PNP0c01", quirk_system_pci_resources},
+ 	{"PNP0c02", quirk_system_pci_resources},
+-	{""}
++	{"", NULL}
+ };
+ 
+ void pnp_fixup_device(struct pnp_dev *dev)
+diff -urNp linux-2.6.32.14/drivers/pnp/resource.c linux-2.6.32.14/drivers/pnp/resource.c
+--- linux-2.6.32.14/drivers/pnp/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/pnp/resource.c	2010-05-28 21:27:15.763212426 -0400
+@@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*irq < 0 || *irq > 15)
++	if (*irq > 15)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+@@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
+ 		return 1;
+ 
+ 	/* check if the resource is valid */
+-	if (*dma < 0 || *dma == 4 || *dma > 7)
++	if (*dma == 4 || *dma > 7)
+ 		return 0;
+ 
+ 	/* check if the resource is reserved */
+diff -urNp linux-2.6.32.14/drivers/s390/cio/qdio_perf.c linux-2.6.32.14/drivers/s390/cio/qdio_perf.c
+--- linux-2.6.32.14/drivers/s390/cio/qdio_perf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/s390/cio/qdio_perf.c	2010-05-28 21:27:15.763212426 -0400
+@@ -31,51 +31,51 @@ static struct proc_dir_entry *qdio_perf_
+ static int qdio_perf_proc_show(struct seq_file *m, void *v)
+ {
+ 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.qdio_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
+ 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.pci_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
+ 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thin_int));
++		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
+ 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
+ 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
+-		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
++		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
+ 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound),
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_in));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
+ 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_out));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
+ 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.siga_sync));
++		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.inbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
+ 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_handler));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
+ 	seq_printf(m, "\n");
+ 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.fast_requeue));
++		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
+ 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.outbound_target_full));
++		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
+ 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
+ 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
+ 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
+-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
++		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
+ 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
+ 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
+-		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
++		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
+ 	seq_printf(m, "\n");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/drivers/s390/cio/qdio_perf.h linux-2.6.32.14/drivers/s390/cio/qdio_perf.h
+--- linux-2.6.32.14/drivers/s390/cio/qdio_perf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/s390/cio/qdio_perf.h	2010-05-28 21:27:15.763212426 -0400
+@@ -13,46 +13,46 @@
+ 
+ struct qdio_perf_stats {
+ 	/* interrupt handler calls */
+-	atomic_long_t qdio_int;
+-	atomic_long_t pci_int;
+-	atomic_long_t thin_int;
++	atomic_long_unchecked_t qdio_int;
++	atomic_long_unchecked_t pci_int;
++	atomic_long_unchecked_t thin_int;
+ 
+ 	/* tasklet runs */
+-	atomic_long_t tasklet_inbound;
+-	atomic_long_t tasklet_outbound;
+-	atomic_long_t tasklet_thinint;
+-	atomic_long_t tasklet_thinint_loop;
+-	atomic_long_t thinint_inbound;
+-	atomic_long_t thinint_inbound_loop;
+-	atomic_long_t thinint_inbound_loop2;
++	atomic_long_unchecked_t tasklet_inbound;
++	atomic_long_unchecked_t tasklet_outbound;
++	atomic_long_unchecked_t tasklet_thinint;
++	atomic_long_unchecked_t tasklet_thinint_loop;
++	atomic_long_unchecked_t thinint_inbound;
++	atomic_long_unchecked_t thinint_inbound_loop;
++	atomic_long_unchecked_t thinint_inbound_loop2;
+ 
+ 	/* signal adapter calls */
+-	atomic_long_t siga_out;
+-	atomic_long_t siga_in;
+-	atomic_long_t siga_sync;
++	atomic_long_unchecked_t siga_out;
++	atomic_long_unchecked_t siga_in;
++	atomic_long_unchecked_t siga_sync;
+ 
+ 	/* misc */
+-	atomic_long_t inbound_handler;
+-	atomic_long_t outbound_handler;
+-	atomic_long_t fast_requeue;
+-	atomic_long_t outbound_target_full;
++	atomic_long_unchecked_t inbound_handler;
++	atomic_long_unchecked_t outbound_handler;
++	atomic_long_unchecked_t fast_requeue;
++	atomic_long_unchecked_t outbound_target_full;
+ 
+ 	/* for debugging */
+-	atomic_long_t debug_tl_out_timer;
+-	atomic_long_t debug_stop_polling;
+-	atomic_long_t debug_eqbs_all;
+-	atomic_long_t debug_eqbs_incomplete;
+-	atomic_long_t debug_sqbs_all;
+-	atomic_long_t debug_sqbs_incomplete;
++	atomic_long_unchecked_t debug_tl_out_timer;
++	atomic_long_unchecked_t debug_stop_polling;
++	atomic_long_unchecked_t debug_eqbs_all;
++	atomic_long_unchecked_t debug_eqbs_incomplete;
++	atomic_long_unchecked_t debug_sqbs_all;
++	atomic_long_unchecked_t debug_sqbs_incomplete;
+ };
+ 
+ extern struct qdio_perf_stats perf_stats;
+ extern int qdio_performance_stats;
+ 
+-static inline void qdio_perf_stat_inc(atomic_long_t *count)
++static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
+ {
+ 	if (qdio_performance_stats)
+-		atomic_long_inc(count);
++		atomic_long_inc_unchecked(count);
+ }
+ 
+ int qdio_setup_perf_stats(void);
+diff -urNp linux-2.6.32.14/drivers/scsi/ipr.c linux-2.6.32.14/drivers/scsi/ipr.c
+--- linux-2.6.32.14/drivers/scsi/ipr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/scsi/ipr.c	2010-05-28 21:27:15.787650200 -0400
+@@ -5286,7 +5286,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
+ 	return true;
+ }
+ 
+-static struct ata_port_operations ipr_sata_ops = {
++static const struct ata_port_operations ipr_sata_ops = {
+ 	.phy_reset = ipr_ata_phy_reset,
+ 	.hardreset = ipr_sata_reset,
+ 	.post_internal_cmd = ipr_ata_post_internal,
+diff -urNp linux-2.6.32.14/drivers/scsi/libfc/fc_exch.c linux-2.6.32.14/drivers/scsi/libfc/fc_exch.c
+--- linux-2.6.32.14/drivers/scsi/libfc/fc_exch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/scsi/libfc/fc_exch.c	2010-05-28 21:27:15.795200668 -0400
+@@ -86,12 +86,12 @@ struct fc_exch_mgr {
+ 	 * all together if not used XXX
+ 	 */
+ 	struct {
+-		atomic_t no_free_exch;
+-		atomic_t no_free_exch_xid;
+-		atomic_t xid_not_found;
+-		atomic_t xid_busy;
+-		atomic_t seq_not_found;
+-		atomic_t non_bls_resp;
++		atomic_unchecked_t no_free_exch;
++		atomic_unchecked_t no_free_exch_xid;
++		atomic_unchecked_t xid_not_found;
++		atomic_unchecked_t xid_busy;
++		atomic_unchecked_t seq_not_found;
++		atomic_unchecked_t non_bls_resp;
+ 	} stats;
+ };
+ #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
+@@ -510,7 +510,7 @@ static struct fc_exch *fc_exch_em_alloc(
+ 	/* allocate memory for exchange */
+ 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.no_free_exch);
++		atomic_inc_unchecked(&mp->stats.no_free_exch);
+ 		goto out;
+ 	}
+ 	memset(ep, 0, sizeof(*ep));
+@@ -557,7 +557,7 @@ out:
+ 	return ep;
+ err:
+ 	spin_unlock_bh(&pool->lock);
+-	atomic_inc(&mp->stats.no_free_exch_xid);
++	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
+ 	mempool_free(ep, mp->ep_pool);
+ 	return NULL;
+ }
+@@ -690,7 +690,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
+ 		ep = fc_exch_find(mp, xid);
+ 		if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_OX_ID;
+ 			goto out;
+ 		}
+@@ -720,7 +720,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 		ep = fc_exch_find(mp, xid);
+ 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
+ 			if (ep) {
+-				atomic_inc(&mp->stats.xid_busy);
++				atomic_inc_unchecked(&mp->stats.xid_busy);
+ 				reject = FC_RJT_RX_ID;
+ 				goto rel;
+ 			}
+@@ -731,7 +731,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 			}
+ 			xid = ep->xid;	/* get our XID */
+ 		} else if (!ep) {
+-			atomic_inc(&mp->stats.xid_not_found);
++			atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 			reject = FC_RJT_RX_ID;	/* XID not found */
+ 			goto out;
+ 		}
+@@ -752,7 +752,7 @@ static enum fc_pf_rjt_reason fc_seq_look
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
+ 			goto rel;
+ 		}
+@@ -1163,22 +1163,22 @@ static void fc_exch_recv_seq_resp(struct
+ 
+ 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
+ 	if (!ep) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->esb_stat & ESB_ST_COMPLETE) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto out;
+ 	}
+ 	if (ep->rxid == FC_XID_UNKNOWN)
+ 		ep->rxid = ntohs(fh->fh_rx_id);
+ 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	if (ep->did != ntoh24(fh->fh_s_id) &&
+ 	    ep->did != FC_FID_FLOGI) {
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 		goto rel;
+ 	}
+ 	sof = fr_sof(fp);
+@@ -1189,7 +1189,7 @@ static void fc_exch_recv_seq_resp(struct
+ 	} else {
+ 		sp = &ep->seq;
+ 		if (sp->id != fh->fh_seq_id) {
+-			atomic_inc(&mp->stats.seq_not_found);
++			atomic_inc_unchecked(&mp->stats.seq_not_found);
+ 			goto rel;
+ 		}
+ 	}
+@@ -1249,9 +1249,9 @@ static void fc_exch_recv_resp(struct fc_
+ 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
+ 
+ 	if (!sp)
+-		atomic_inc(&mp->stats.xid_not_found);
++		atomic_inc_unchecked(&mp->stats.xid_not_found);
+ 	else
+-		atomic_inc(&mp->stats.non_bls_resp);
++		atomic_inc_unchecked(&mp->stats.non_bls_resp);
+ 
+ 	fc_frame_free(fp);
+ }
+diff -urNp linux-2.6.32.14/drivers/scsi/libsas/sas_ata.c linux-2.6.32.14/drivers/scsi/libsas/sas_ata.c
+--- linux-2.6.32.14/drivers/scsi/libsas/sas_ata.c	2010-05-15 13:20:18.878584179 -0400
++++ linux-2.6.32.14/drivers/scsi/libsas/sas_ata.c	2010-05-28 21:27:15.803426462 -0400
+@@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
+ 	}
+ }
+ 
+-static struct ata_port_operations sas_sata_ops = {
++static const struct ata_port_operations sas_sata_ops = {
+ 	.phy_reset		= sas_ata_phy_reset,
+ 	.post_internal_cmd	= sas_ata_post_internal,
+ 	.qc_prep		= ata_noop_qc_prep,
+diff -urNp linux-2.6.32.14/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.32.14/drivers/scsi/mpt2sas/mpt2sas_debug.h
+--- linux-2.6.32.14/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/scsi/mpt2sas/mpt2sas_debug.h	2010-05-28 21:27:15.803426462 -0400
+@@ -79,7 +79,7 @@
+ 		CMD;						\
+ }
+ #else
+-#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
++#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
+ #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
+ 
+ 
+diff -urNp linux-2.6.32.14/drivers/scsi/scsi_logging.h linux-2.6.32.14/drivers/scsi/scsi_logging.h
+--- linux-2.6.32.14/drivers/scsi/scsi_logging.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/scsi/scsi_logging.h	2010-05-28 21:27:15.803426462 -0400
+@@ -51,7 +51,7 @@ do {								\
+ 		} while (0);					\
+ } while (0)
+ #else
+-#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
++#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
+ #endif /* CONFIG_SCSI_LOGGING */
+ 
+ /*
+diff -urNp linux-2.6.32.14/drivers/scsi/sg.c linux-2.6.32.14/drivers/scsi/sg.c
+--- linux-2.6.32.14/drivers/scsi/sg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/scsi/sg.c	2010-05-28 21:27:15.803426462 -0400
+@@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
+ 	const struct file_operations * fops;
+ };
+ 
+-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
++static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
+ 	{"allow_dio", &adio_fops},
+ 	{"debug", &debug_fops},
+ 	{"def_reserved_size", &dressz_fops},
+@@ -2307,7 +2307,7 @@ sg_proc_init(void)
+ {
+ 	int k, mask;
+ 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
+-	struct sg_proc_leaf * leaf;
++	const struct sg_proc_leaf * leaf;
+ 
+ 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
+ 	if (!sg_proc_sgp)
+diff -urNp linux-2.6.32.14/drivers/serial/8250_pci.c linux-2.6.32.14/drivers/serial/8250_pci.c
+--- linux-2.6.32.14/drivers/serial/8250_pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/serial/8250_pci.c	2010-05-28 21:27:15.803426462 -0400
+@@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
+ 		PCI_ANY_ID, PCI_ANY_ID,
+ 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
+ 		0xffff00, pbn_default },
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ static struct pci_driver serial_pci_driver = {
+diff -urNp linux-2.6.32.14/drivers/serial/kgdboc.c linux-2.6.32.14/drivers/serial/kgdboc.c
+--- linux-2.6.32.14/drivers/serial/kgdboc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/serial/kgdboc.c	2010-05-28 21:27:15.803426462 -0400
+@@ -18,7 +18,7 @@
+ 
+ #define MAX_CONFIG_LEN		40
+ 
+-static struct kgdb_io		kgdboc_io_ops;
++static const struct kgdb_io	kgdboc_io_ops;
+ 
+ /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
+ static int configured		= -1;
+@@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
+ 		module_put(THIS_MODULE);
+ }
+ 
+-static struct kgdb_io kgdboc_io_ops = {
++static const struct kgdb_io kgdboc_io_ops = {
+ 	.name			= "kgdboc",
+ 	.read_char		= kgdboc_get_char,
+ 	.write_char		= kgdboc_put_char,
+diff -urNp linux-2.6.32.14/drivers/staging/android/binder.c linux-2.6.32.14/drivers/staging/android/binder.c
+--- linux-2.6.32.14/drivers/staging/android/binder.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/android/binder.c	2010-05-28 21:27:15.815152627 -0400
+@@ -2756,7 +2756,7 @@ static void binder_vma_close(struct vm_a
+ 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
+ }
+ 
+-static struct vm_operations_struct binder_vm_ops = {
++static const struct vm_operations_struct binder_vm_ops = {
+ 	.open = binder_vma_open,
+ 	.close = binder_vma_close,
+ };
+diff -urNp linux-2.6.32.14/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.14/drivers/staging/b3dfg/b3dfg.c
+--- linux-2.6.32.14/drivers/staging/b3dfg/b3dfg.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/b3dfg/b3dfg.c	2010-05-28 21:27:15.815152627 -0400
+@@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
+ 	return VM_FAULT_NOPAGE;
+ }
+ 
+-static struct vm_operations_struct b3dfg_vm_ops = {
++static const struct vm_operations_struct b3dfg_vm_ops = {
+ 	.fault = b3dfg_vma_fault,
+ };
+ 
+@@ -848,7 +848,7 @@ static int b3dfg_mmap(struct file *filp,
+ 	return r;
+ }
+ 
+-static struct file_operations b3dfg_fops = {
++static const struct file_operations b3dfg_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = b3dfg_open,
+ 	.release = b3dfg_release,
+diff -urNp linux-2.6.32.14/drivers/staging/comedi/comedi_fops.c linux-2.6.32.14/drivers/staging/comedi/comedi_fops.c
+--- linux-2.6.32.14/drivers/staging/comedi/comedi_fops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/comedi/comedi_fops.c	2010-05-28 21:27:15.815152627 -0400
+@@ -1389,7 +1389,7 @@ void comedi_unmap(struct vm_area_struct 
+ 	mutex_unlock(&dev->mutex);
+ }
+ 
+-static struct vm_operations_struct comedi_vm_ops = {
++static const struct vm_operations_struct comedi_vm_ops = {
+ 	.close = comedi_unmap,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.14/drivers/staging/dream/qdsp5/adsp_driver.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/adsp_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/adsp_driver.c	2010-05-28 21:27:15.815152627 -0400
+@@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
+ static dev_t adsp_devno;
+ static struct class *adsp_class;
+ 
+-static struct file_operations adsp_fops = {
++static const struct file_operations adsp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = adsp_open,
+ 	.unlocked_ioctl = adsp_ioctl,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_aac.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_aac.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_aac.c	2010-05-28 21:27:15.819209681 -0400
+@@ -1022,7 +1022,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_aac_fops = {
++static const struct file_operations audio_aac_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audio_open,
+ 	.release = audio_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_amrnb.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_amrnb.c	2010-05-28 21:27:15.823076824 -0400
+@@ -833,7 +833,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_amrnb_fops = {
++static const struct file_operations audio_amrnb_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audamrnb_open,
+ 	.release = audamrnb_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_evrc.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_evrc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_evrc.c	2010-05-28 21:27:15.823076824 -0400
+@@ -805,7 +805,7 @@ dma_fail:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_evrc_fops = {
++static const struct file_operations audio_evrc_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audevrc_open,
+ 	.release = audevrc_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_in.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_in.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_in.c	2010-05-28 21:27:15.823076824 -0400
+@@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_in_open,
+ 	.release	= audio_in_release,
+@@ -922,7 +922,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_in_ioctl,
+ };
+ 
+-static struct file_operations audpre_fops = {
++static const struct file_operations audpre_fops = {
+ 	.owner          = THIS_MODULE,
+ 	.open           = audpre_open,
+ 	.unlocked_ioctl = audpre_ioctl,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_mp3.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_mp3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_mp3.c	2010-05-28 21:27:15.823076824 -0400
+@@ -941,7 +941,7 @@ done:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_mp3_fops = {
++static const struct file_operations audio_mp3_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_out.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_out.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_out.c	2010-05-28 21:27:15.823076824 -0400
+@@ -810,7 +810,7 @@ static int audpp_open(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations audio_fops = {
++static const struct file_operations audio_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audio_open,
+ 	.release	= audio_release,
+@@ -819,7 +819,7 @@ static struct file_operations audio_fops
+ 	.unlocked_ioctl	= audio_ioctl,
+ };
+ 
+-static struct file_operations audpp_fops = {
++static const struct file_operations audpp_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= audpp_open,
+ 	.unlocked_ioctl	= audpp_ioctl,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_qcelp.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/audio_qcelp.c	2010-05-28 21:27:15.841738212 -0400
+@@ -816,7 +816,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations audio_qcelp_fops = {
++static const struct file_operations audio_qcelp_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = audqcelp_open,
+ 	.release = audqcelp_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.14/drivers/staging/dream/qdsp5/snd.c
+--- linux-2.6.32.14/drivers/staging/dream/qdsp5/snd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/qdsp5/snd.c	2010-05-28 21:27:15.841738212 -0400
+@@ -242,7 +242,7 @@ err:
+ 	return rc;
+ }
+ 
+-static struct file_operations snd_fops = {
++static const struct file_operations snd_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.open		= snd_open,
+ 	.release	= snd_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.14/drivers/staging/dream/smd/smd_qmi.c
+--- linux-2.6.32.14/drivers/staging/dream/smd/smd_qmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/smd/smd_qmi.c	2010-05-28 21:27:15.841738212 -0400
+@@ -793,7 +793,7 @@ static int qmi_release(struct inode *ip,
+ 	return 0;
+ }
+ 
+-static struct file_operations qmi_fops = {
++static const struct file_operations qmi_fops = {
+ 	.owner = THIS_MODULE,
+ 	.read = qmi_read,
+ 	.write = qmi_write,
+diff -urNp linux-2.6.32.14/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.14/drivers/staging/dream/smd/smd_rpcrouter_device.c
+--- linux-2.6.32.14/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dream/smd/smd_rpcrouter_device.c	2010-05-28 21:27:15.841738212 -0400
+@@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file 
+ 	return rc;
+ }
+ 
+-static struct file_operations rpcrouter_server_fops = {
++static const struct file_operations rpcrouter_server_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+@@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
+ 	.unlocked_ioctl	 = rpcrouter_ioctl,
+ };
+ 
+-static struct file_operations rpcrouter_router_fops = {
++static const struct file_operations rpcrouter_router_fops = {
+ 	.owner	 = THIS_MODULE,
+ 	.open	 = rpcrouter_open,
+ 	.release = rpcrouter_release,
+diff -urNp linux-2.6.32.14/drivers/staging/dst/dcore.c linux-2.6.32.14/drivers/staging/dst/dcore.c
+--- linux-2.6.32.14/drivers/staging/dst/dcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dst/dcore.c	2010-05-28 21:27:15.841738212 -0400
+@@ -149,7 +149,7 @@ static int dst_bdev_release(struct gendi
+ 	return 0;
+ }
+ 
+-static struct block_device_operations dst_blk_ops = {
++static const struct block_device_operations dst_blk_ops = {
+ 	.open		= dst_bdev_open,
+ 	.release	= dst_bdev_release,
+ 	.owner		= THIS_MODULE,
+@@ -588,7 +588,7 @@ static struct dst_node *dst_alloc_node(s
+ 	n->size = ctl->size;
+ 
+ 	atomic_set(&n->refcnt, 1);
+-	atomic_long_set(&n->gen, 0);
++	atomic_long_set_unchecked(&n->gen, 0);
+ 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
+ 
+ 	err = dst_node_sysfs_init(n);
+diff -urNp linux-2.6.32.14/drivers/staging/dst/trans.c linux-2.6.32.14/drivers/staging/dst/trans.c
+--- linux-2.6.32.14/drivers/staging/dst/trans.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/dst/trans.c	2010-05-28 21:27:15.842942312 -0400
+@@ -169,7 +169,7 @@ int dst_process_bio(struct dst_node *n, 
+ 	t->error = 0;
+ 	t->retries = 0;
+ 	atomic_set(&t->refcnt, 1);
+-	t->gen = atomic_long_inc_return(&n->gen);
++	t->gen = atomic_long_inc_return_unchecked(&n->gen);
+ 
+ 	t->enc = bio_data_dir(bio);
+ 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
+diff -urNp linux-2.6.32.14/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.14/drivers/staging/go7007/go7007-v4l2.c
+--- linux-2.6.32.14/drivers/staging/go7007/go7007-v4l2.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/go7007/go7007-v4l2.c	2010-05-28 21:27:15.842942312 -0400
+@@ -1700,7 +1700,7 @@ static int go7007_vm_fault(struct vm_are
+ 	return 0;
+ }
+ 
+-static struct vm_operations_struct go7007_vm_ops = {
++static const struct vm_operations_struct go7007_vm_ops = {
+ 	.open	= go7007_vm_open,
+ 	.close	= go7007_vm_close,
+ 	.fault	= go7007_vm_fault,
+diff -urNp linux-2.6.32.14/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.14/drivers/staging/hv/blkvsc_drv.c
+--- linux-2.6.32.14/drivers/staging/hv/blkvsc_drv.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/hv/blkvsc_drv.c	2010-05-28 21:27:15.842942312 -0400
+@@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
+ /* The one and only one */
+ static struct blkvsc_driver_context g_blkvsc_drv;
+ 
+-static struct block_device_operations block_ops = {
++static const struct block_device_operations block_ops = {
+ 	.owner = THIS_MODULE,
+ 	.open = blkvsc_open,
+ 	.release = blkvsc_release,
+diff -urNp linux-2.6.32.14/drivers/staging/panel/panel.c linux-2.6.32.14/drivers/staging/panel/panel.c
+--- linux-2.6.32.14/drivers/staging/panel/panel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/panel/panel.c	2010-05-28 21:27:15.842942312 -0400
+@@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
+ 	return 0;
+ }
+ 
+-static struct file_operations lcd_fops = {
++static const struct file_operations lcd_fops = {
+ 	.write   = lcd_write,
+ 	.open    = lcd_open,
+ 	.release = lcd_release,
+@@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
+ 	return 0;
+ }
+ 
+-static struct file_operations keypad_fops = {
++static const struct file_operations keypad_fops = {
+ 	.read    = keypad_read,		/* read */
+ 	.open    = keypad_open,		/* open */
+ 	.release = keypad_release,	/* close */
+diff -urNp linux-2.6.32.14/drivers/staging/phison/phison.c linux-2.6.32.14/drivers/staging/phison/phison.c
+--- linux-2.6.32.14/drivers/staging/phison/phison.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/phison/phison.c	2010-05-28 21:27:15.842942312 -0400
+@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
+ 	ATA_BMDMA_SHT(DRV_NAME),
+ };
+ 
+-static struct ata_port_operations phison_ops = {
++static const struct ata_port_operations phison_ops = {
+ 	.inherits		= &ata_bmdma_port_ops,
+ 	.prereset		= phison_pre_reset,
+ };
+diff -urNp linux-2.6.32.14/drivers/staging/poch/poch.c linux-2.6.32.14/drivers/staging/poch/poch.c
+--- linux-2.6.32.14/drivers/staging/poch/poch.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/poch/poch.c	2010-05-28 21:27:15.842942312 -0400
+@@ -1057,7 +1057,7 @@ static int poch_ioctl(struct inode *inod
+ 	return 0;
+ }
+ 
+-static struct file_operations poch_fops = {
++static const struct file_operations poch_fops = {
+ 	.owner = THIS_MODULE,
+ 	.open = poch_open,
+ 	.release = poch_release,
+diff -urNp linux-2.6.32.14/drivers/staging/pohmelfs/inode.c linux-2.6.32.14/drivers/staging/pohmelfs/inode.c
+--- linux-2.6.32.14/drivers/staging/pohmelfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/pohmelfs/inode.c	2010-05-28 21:27:15.842942312 -0400
+@@ -1850,7 +1850,7 @@ static int pohmelfs_fill_super(struct su
+ 	mutex_init(&psb->mcache_lock);
+ 	psb->mcache_root = RB_ROOT;
+ 	psb->mcache_timeout = msecs_to_jiffies(5000);
+-	atomic_long_set(&psb->mcache_gen, 0);
++	atomic_long_set_unchecked(&psb->mcache_gen, 0);
+ 
+ 	psb->trans_max_pages = 100;
+ 
+diff -urNp linux-2.6.32.14/drivers/staging/pohmelfs/mcache.c linux-2.6.32.14/drivers/staging/pohmelfs/mcache.c
+--- linux-2.6.32.14/drivers/staging/pohmelfs/mcache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/pohmelfs/mcache.c	2010-05-28 21:27:15.842942312 -0400
+@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
+ 	m->data = data;
+ 	m->start = start;
+ 	m->size = size;
+-	m->gen = atomic_long_inc_return(&psb->mcache_gen);
++	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
+ 
+ 	mutex_lock(&psb->mcache_lock);
+ 	err = pohmelfs_mcache_insert(psb, m);
+diff -urNp linux-2.6.32.14/drivers/staging/pohmelfs/netfs.h linux-2.6.32.14/drivers/staging/pohmelfs/netfs.h
+--- linux-2.6.32.14/drivers/staging/pohmelfs/netfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/pohmelfs/netfs.h	2010-05-28 21:27:15.846971345 -0400
+@@ -570,7 +570,7 @@ struct pohmelfs_config;
+ struct pohmelfs_sb {
+ 	struct rb_root		mcache_root;
+ 	struct mutex		mcache_lock;
+-	atomic_long_t		mcache_gen;
++	atomic_long_unchecked_t	mcache_gen;
+ 	unsigned long		mcache_timeout;
+ 
+ 	unsigned int		idx;
+diff -urNp linux-2.6.32.14/drivers/staging/sep/sep_driver.c linux-2.6.32.14/drivers/staging/sep/sep_driver.c
+--- linux-2.6.32.14/drivers/staging/sep/sep_driver.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/sep/sep_driver.c	2010-05-28 21:27:15.859198868 -0400
+@@ -2603,7 +2603,7 @@ static struct pci_driver sep_pci_driver 
+ static dev_t sep_devno;
+ 
+ /* the files operations structure of the driver */
+-static struct file_operations sep_file_operations = {
++static const struct file_operations sep_file_operations = {
+ 	.owner = THIS_MODULE,
+ 	.ioctl = sep_ioctl,
+ 	.poll = sep_poll,
+diff -urNp linux-2.6.32.14/drivers/staging/vme/devices/vme_user.c linux-2.6.32.14/drivers/staging/vme/devices/vme_user.c
+--- linux-2.6.32.14/drivers/staging/vme/devices/vme_user.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/staging/vme/devices/vme_user.c	2010-05-28 21:27:15.859198868 -0400
+@@ -136,7 +136,7 @@ static int vme_user_ioctl(struct inode *
+ static int __init vme_user_probe(struct device *, int, int);
+ static int __exit vme_user_remove(struct device *, int, int);
+ 
+-static struct file_operations vme_user_fops = {
++static const struct file_operations vme_user_fops = {
+         .open = vme_user_open,
+         .release = vme_user_release,
+         .read = vme_user_read,
+diff -urNp linux-2.6.32.14/drivers/uio/uio.c linux-2.6.32.14/drivers/uio/uio.c
+--- linux-2.6.32.14/drivers/uio/uio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/uio/uio.c	2010-05-28 21:27:15.859198868 -0400
+@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
+ 	return entry->show(mem, buf);
+ }
+ 
+-static struct sysfs_ops map_sysfs_ops = {
++static const struct sysfs_ops map_sysfs_ops = {
+ 	.show = map_type_show,
+ };
+ 
+@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
+ 	return entry->show(port, buf);
+ }
+ 
+-static struct sysfs_ops portio_sysfs_ops = {
++static const struct sysfs_ops portio_sysfs_ops = {
+ 	.show = portio_type_show,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/usb/atm/usbatm.c linux-2.6.32.14/drivers/usb/atm/usbatm.c
+--- linux-2.6.32.14/drivers/usb/atm/usbatm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/atm/usbatm.c	2010-05-28 21:27:15.859198868 -0400
+@@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (printk_ratelimit())
+ 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
+ 				__func__, vpi, vci);
+-		atomic_inc(&vcc->stats->rx_err);
++		atomic_inc_unchecked(&vcc->stats->rx_err);
+ 		return;
+ 	}
+ 
+@@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
+ 		if (length > ATM_MAX_AAL5_PDU) {
+ 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
+ 				  __func__, length, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
+ 		if (sarb->len < pdu_length) {
+ 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
+ 				  __func__, pdu_length, sarb->len, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+ 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
+ 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
+ 				  __func__, vcc);
+-			atomic_inc(&vcc->stats->rx_err);
++			atomic_inc_unchecked(&vcc->stats->rx_err);
+ 			goto out;
+ 		}
+ 
+@@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
+ 			if (printk_ratelimit())
+ 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
+ 					__func__, length);
+-			atomic_inc(&vcc->stats->rx_drop);
++			atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 			goto out;
+ 		}
+ 
+@@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
+ 
+ 		vcc->push(vcc, skb);
+ 
+-		atomic_inc(&vcc->stats->rx);
++		atomic_inc_unchecked(&vcc->stats->rx);
+ 	out:
+ 		skb_trim(sarb, 0);
+ 	}
+@@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
+ 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
+ 
+ 			usbatm_pop(vcc, skb);
+-			atomic_inc(&vcc->stats->tx);
++			atomic_inc_unchecked(&vcc->stats->tx);
+ 
+ 			skb = skb_dequeue(&instance->sndqueue);
+ 		}
+@@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
+ 	if (!left--)
+ 		return sprintf(page,
+ 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
+-			       atomic_read(&atm_dev->stats.aal5.tx),
+-			       atomic_read(&atm_dev->stats.aal5.tx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx),
+-			       atomic_read(&atm_dev->stats.aal5.rx_err),
+-			       atomic_read(&atm_dev->stats.aal5.rx_drop));
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
++			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
+ 
+ 	if (!left--) {
+ 		if (instance->disconnected)
+diff -urNp linux-2.6.32.14/drivers/usb/class/cdc-acm.c linux-2.6.32.14/drivers/usb/class/cdc-acm.c
+--- linux-2.6.32.14/drivers/usb/class/cdc-acm.c	2010-04-29 17:49:38.389083173 -0400
++++ linux-2.6.32.14/drivers/usb/class/cdc-acm.c	2010-05-28 21:27:15.867210979 -0400
+@@ -1535,7 +1535,7 @@ static struct usb_device_id acm_ids[] = 
+ 		USB_CDC_ACM_PROTO_AT_CDMA) },
+ 
+ 	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
+-	{ }
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(usb, acm_ids);
+diff -urNp linux-2.6.32.14/drivers/usb/class/usblp.c linux-2.6.32.14/drivers/usb/class/usblp.c
+--- linux-2.6.32.14/drivers/usb/class/usblp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/class/usblp.c	2010-05-28 21:27:15.875212570 -0400
+@@ -228,7 +228,7 @@ static const struct quirk_printer_struct
+ 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
+ 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
+ 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
+-	{ 0, 0 }
++	{ 0, 0, 0 }
+ };
+ 
+ static int usblp_wwait(struct usblp *usblp, int nonblock);
+@@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
+ 	{ USB_INTERFACE_INFO(7, 1, 2) },
+ 	{ USB_INTERFACE_INFO(7, 1, 3) },
+ 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
+-	{ }						/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, usblp_ids);
+diff -urNp linux-2.6.32.14/drivers/usb/core/hcd.c linux-2.6.32.14/drivers/usb/core/hcd.c
+--- linux-2.6.32.14/drivers/usb/core/hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/core/hcd.c	2010-05-28 21:27:15.887216714 -0400
+@@ -2216,7 +2216,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
+ 
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+-struct usb_mon_operations *mon_ops;
++const struct usb_mon_operations *mon_ops;
+ 
+ /*
+  * The registration is unlocked.
+@@ -2226,7 +2226,7 @@ struct usb_mon_operations *mon_ops;
+  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
+  */
+  
+-int usb_mon_register (struct usb_mon_operations *ops)
++int usb_mon_register (const struct usb_mon_operations *ops)
+ {
+ 
+ 	if (mon_ops)
+diff -urNp linux-2.6.32.14/drivers/usb/core/hcd.h linux-2.6.32.14/drivers/usb/core/hcd.h
+--- linux-2.6.32.14/drivers/usb/core/hcd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/core/hcd.h	2010-05-28 21:27:15.887216714 -0400
+@@ -486,13 +486,13 @@ static inline void usbfs_cleanup(void) {
+ #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
+ 
+ struct usb_mon_operations {
+-	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
+-	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
+-	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
++	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
++	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
++	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
+ 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
+ };
+ 
+-extern struct usb_mon_operations *mon_ops;
++extern const struct usb_mon_operations *mon_ops;
+ 
+ static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
+ {
+@@ -514,7 +514,7 @@ static inline void usbmon_urb_complete(s
+ 		(*mon_ops->urb_complete)(bus, urb, status);
+ }
+ 
+-int usb_mon_register(struct usb_mon_operations *ops);
++int usb_mon_register(const struct usb_mon_operations *ops);
+ void usb_mon_deregister(void);
+ 
+ #else
+diff -urNp linux-2.6.32.14/drivers/usb/core/hub.c linux-2.6.32.14/drivers/usb/core/hub.c
+--- linux-2.6.32.14/drivers/usb/core/hub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/core/hub.c	2010-05-28 21:27:15.887216714 -0400
+@@ -3397,7 +3397,7 @@ static struct usb_device_id hub_id_table
+       .bDeviceClass = USB_CLASS_HUB},
+     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
+       .bInterfaceClass = USB_CLASS_HUB},
+-    { }						/* Terminating entry */
++    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
+ };
+ 
+ MODULE_DEVICE_TABLE (usb, hub_id_table);
+diff -urNp linux-2.6.32.14/drivers/usb/core/message.c linux-2.6.32.14/drivers/usb/core/message.c
+--- linux-2.6.32.14/drivers/usb/core/message.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/core/message.c	2010-05-28 21:27:15.898958902 -0400
+@@ -914,8 +914,8 @@ char *usb_cache_string(struct usb_device
+ 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
+ 	if (buf) {
+ 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
+-		if (len > 0) {
+-			smallbuf = kmalloc(++len, GFP_NOIO);
++		if (len++ > 0) {
++			smallbuf = kmalloc(len, GFP_NOIO);
+ 			if (!smallbuf)
+ 				return buf;
+ 			memcpy(smallbuf, buf, len);
+diff -urNp linux-2.6.32.14/drivers/usb/host/ehci-pci.c linux-2.6.32.14/drivers/usb/host/ehci-pci.c
+--- linux-2.6.32.14/drivers/usb/host/ehci-pci.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/host/ehci-pci.c	2010-05-28 21:27:15.898958902 -0400
+@@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
+ 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
+ 	},
+-	{ /* end: all zeroes */ }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ MODULE_DEVICE_TABLE(pci, pci_ids);
+ 
+diff -urNp linux-2.6.32.14/drivers/usb/host/uhci-hcd.c linux-2.6.32.14/drivers/usb/host/uhci-hcd.c
+--- linux-2.6.32.14/drivers/usb/host/uhci-hcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/host/uhci-hcd.c	2010-05-28 21:27:15.903225521 -0400
+@@ -941,7 +941,7 @@ static const struct pci_device_id uhci_p
+ 	/* handle any USB UHCI controller */
+ 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
+ 	.driver_data =	(unsigned long) &uhci_driver,
+-	}, { /* end: all zeroes */ }
++	}, { 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
+diff -urNp linux-2.6.32.14/drivers/usb/misc/appledisplay.c linux-2.6.32.14/drivers/usb/misc/appledisplay.c
+--- linux-2.6.32.14/drivers/usb/misc/appledisplay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/misc/appledisplay.c	2010-05-28 21:27:15.903225521 -0400
+@@ -178,7 +178,7 @@ static int appledisplay_bl_get_brightnes
+ 		return pdata->msgdata[1];
+ }
+ 
+-static struct backlight_ops appledisplay_bl_data = {
++static const struct backlight_ops appledisplay_bl_data = {
+ 	.get_brightness	= appledisplay_bl_get_brightness,
+ 	.update_status	= appledisplay_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/usb/mon/mon_main.c linux-2.6.32.14/drivers/usb/mon/mon_main.c
+--- linux-2.6.32.14/drivers/usb/mon/mon_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/mon/mon_main.c	2010-05-28 21:27:15.903225521 -0400
+@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
+ /*
+  * Ops
+  */
+-static struct usb_mon_operations mon_ops_0 = {
++static const struct usb_mon_operations mon_ops_0 = {
+ 	.urb_submit =	mon_submit,
+ 	.urb_submit_error = mon_submit_error,
+ 	.urb_complete =	mon_complete,
+diff -urNp linux-2.6.32.14/drivers/usb/storage/debug.h linux-2.6.32.14/drivers/usb/storage/debug.h
+--- linux-2.6.32.14/drivers/usb/storage/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/storage/debug.h	2010-05-28 21:27:15.903225521 -0400
+@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
+ #define US_DEBUGPX(x...) printk( x )
+ #define US_DEBUG(x) x 
+ #else
+-#define US_DEBUGP(x...)
+-#define US_DEBUGPX(x...)
+-#define US_DEBUG(x)
++#define US_DEBUGP(x...) do {} while (0)
++#define US_DEBUGPX(x...) do {} while (0)
++#define US_DEBUG(x) do {} while (0)
+ #endif
+ 
+ #endif
+diff -urNp linux-2.6.32.14/drivers/usb/storage/usb.c linux-2.6.32.14/drivers/usb/storage/usb.c
+--- linux-2.6.32.14/drivers/usb/storage/usb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/storage/usb.c	2010-05-28 21:27:15.915209208 -0400
+@@ -118,7 +118,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
+ 
+ static struct us_unusual_dev us_unusual_dev_list[] = {
+ #	include "unusual_devs.h" 
+-	{ }		/* Terminating entry */
++	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
+ };
+ 
+ #undef UNUSUAL_DEV
+diff -urNp linux-2.6.32.14/drivers/usb/storage/usual-tables.c linux-2.6.32.14/drivers/usb/storage/usual-tables.c
+--- linux-2.6.32.14/drivers/usb/storage/usual-tables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/usb/storage/usual-tables.c	2010-05-28 21:27:15.915209208 -0400
+@@ -48,7 +48,7 @@
+ 
+ struct usb_device_id usb_storage_usb_ids[] = {
+ #	include "unusual_devs.h"
+-	{ }		/* Terminating entry */
++	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
+ };
+ EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
+ 
+diff -urNp linux-2.6.32.14/drivers/uwb/wlp/messages.c linux-2.6.32.14/drivers/uwb/wlp/messages.c
+--- linux-2.6.32.14/drivers/uwb/wlp/messages.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/uwb/wlp/messages.c	2010-05-28 21:27:15.915209208 -0400
+@@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
+ 	size_t len = skb->len;
+ 	size_t used;
+ 	ssize_t result;
+-	struct wlp_nonce enonce, rnonce;
++	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
+ 	enum wlp_assc_error assc_err;
+ 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
+ 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
+diff -urNp linux-2.6.32.14/drivers/uwb/wlp/sysfs.c linux-2.6.32.14/drivers/uwb/wlp/sysfs.c
+--- linux-2.6.32.14/drivers/uwb/wlp/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/uwb/wlp/sysfs.c	2010-05-28 21:27:15.915209208 -0400
+@@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
+ 	return ret;
+ }
+ 
+-static
+-struct sysfs_ops wss_sysfs_ops = {
++static const struct sysfs_ops wss_sysfs_ops = {
+ 	.show	= wlp_wss_attr_show,
+ 	.store	= wlp_wss_attr_store,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/atmel_lcdfb.c linux-2.6.32.14/drivers/video/atmel_lcdfb.c
+--- linux-2.6.32.14/drivers/video/atmel_lcdfb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/atmel_lcdfb.c	2010-05-28 21:27:15.915209208 -0400
+@@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
+ 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
+ }
+ 
+-static struct backlight_ops atmel_lcdc_bl_ops = {
++static const struct backlight_ops atmel_lcdc_bl_ops = {
+ 	.update_status = atmel_bl_update_status,
+ 	.get_brightness = atmel_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/aty/aty128fb.c linux-2.6.32.14/drivers/video/aty/aty128fb.c
+--- linux-2.6.32.14/drivers/video/aty/aty128fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/aty/aty128fb.c	2010-05-28 21:27:15.931199110 -0400
+@@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty128_bl_data = {
++static const struct backlight_ops aty128_bl_data = {
+ 	.get_brightness	= aty128_bl_get_brightness,
+ 	.update_status	= aty128_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/aty/atyfb_base.c linux-2.6.32.14/drivers/video/aty/atyfb_base.c
+--- linux-2.6.32.14/drivers/video/aty/atyfb_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/aty/atyfb_base.c	2010-05-28 21:27:15.939052461 -0400
+@@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct 
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops aty_bl_data = {
++static const struct backlight_ops aty_bl_data = {
+ 	.get_brightness = aty_bl_get_brightness,
+ 	.update_status	= aty_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/aty/radeon_backlight.c linux-2.6.32.14/drivers/video/aty/radeon_backlight.c
+--- linux-2.6.32.14/drivers/video/aty/radeon_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/aty/radeon_backlight.c	2010-05-28 21:27:15.939052461 -0400
+@@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops radeon_bl_data = {
++static const struct backlight_ops radeon_bl_data = {
+ 	.get_brightness = radeon_bl_get_brightness,
+ 	.update_status	= radeon_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/adp5520_bl.c linux-2.6.32.14/drivers/video/backlight/adp5520_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/adp5520_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/adp5520_bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -84,7 +84,7 @@ static int adp5520_bl_get_brightness(str
+ 	return error ? data->current_brightness : reg_val;
+ }
+ 
+-static struct backlight_ops adp5520_bl_ops = {
++static const struct backlight_ops adp5520_bl_ops = {
+ 	.update_status	= adp5520_bl_update_status,
+ 	.get_brightness	= adp5520_bl_get_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/adx_bl.c linux-2.6.32.14/drivers/video/backlight/adx_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/adx_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/adx_bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct
+ 	return 1;
+ }
+ 
+-static struct backlight_ops adx_backlight_ops = {
++static const struct backlight_ops adx_backlight_ops = {
+ 	.options = 0,
+ 	.update_status = adx_backlight_update_status,
+ 	.get_brightness = adx_backlight_get_brightness,
+diff -urNp linux-2.6.32.14/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.14/drivers/video/backlight/atmel-pwm-bl.c
+--- linux-2.6.32.14/drivers/video/backlight/atmel-pwm-bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/atmel-pwm-bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct 
+ 	return pwm_channel_enable(&pwmbl->pwmc);
+ }
+ 
+-static struct backlight_ops atmel_pwm_bl_ops = {
++static const struct backlight_ops atmel_pwm_bl_ops = {
+ 	.get_brightness = atmel_pwm_bl_get_intensity,
+ 	.update_status  = atmel_pwm_bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/backlight.c linux-2.6.32.14/drivers/video/backlight/backlight.c
+--- linux-2.6.32.14/drivers/video/backlight/backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/backlight.c	2010-05-28 21:27:15.939052461 -0400
+@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
+  * ERR_PTR() or a pointer to the newly allocated device.
+  */
+ struct backlight_device *backlight_device_register(const char *name,
+-		struct device *parent, void *devdata, struct backlight_ops *ops)
++		struct device *parent, void *devdata, const struct backlight_ops *ops)
+ {
+ 	struct backlight_device *new_bd;
+ 	int rc;
+diff -urNp linux-2.6.32.14/drivers/video/backlight/corgi_lcd.c linux-2.6.32.14/drivers/video/backlight/corgi_lcd.c
+--- linux-2.6.32.14/drivers/video/backlight/corgi_lcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/corgi_lcd.c	2010-05-28 21:27:15.939052461 -0400
+@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit
+ }
+ EXPORT_SYMBOL(corgi_lcd_limit_intensity);
+ 
+-static struct backlight_ops corgi_bl_ops = {
++static const struct backlight_ops corgi_bl_ops = {
+ 	.get_brightness	= corgi_bl_get_intensity,
+ 	.update_status  = corgi_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/cr_bllcd.c linux-2.6.32.14/drivers/video/backlight/cr_bllcd.c
+--- linux-2.6.32.14/drivers/video/backlight/cr_bllcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/cr_bllcd.c	2010-05-28 21:27:15.939052461 -0400
+@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(st
+ 	return intensity;
+ }
+ 
+-static struct backlight_ops cr_backlight_ops = {
++static const struct backlight_ops cr_backlight_ops = {
+ 	.get_brightness = cr_backlight_get_intensity,
+ 	.update_status = cr_backlight_set_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/da903x_bl.c linux-2.6.32.14/drivers/video/backlight/da903x_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/da903x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/da903x_bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -94,7 +94,7 @@ static int da903x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops da903x_backlight_ops = {
++static const struct backlight_ops da903x_backlight_ops = {
+ 	.update_status	= da903x_backlight_update_status,
+ 	.get_brightness	= da903x_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/generic_bl.c linux-2.6.32.14/drivers/video/backlight/generic_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/generic_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/generic_bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
+ }
+ EXPORT_SYMBOL(corgibl_limit_intensity);
+ 
+-static struct backlight_ops genericbl_ops = {
++static const struct backlight_ops genericbl_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.get_brightness = genericbl_get_intensity,
+ 	.update_status  = genericbl_send_intensity,
+diff -urNp linux-2.6.32.14/drivers/video/backlight/hp680_bl.c linux-2.6.32.14/drivers/video/backlight/hp680_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/hp680_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/hp680_bl.c	2010-05-28 21:27:15.939052461 -0400
+@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct 
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops hp680bl_ops = {
++static const struct backlight_ops hp680bl_ops = {
+ 	.get_brightness = hp680bl_get_intensity,
+ 	.update_status  = hp680bl_set_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/jornada720_bl.c linux-2.6.32.14/drivers/video/backlight/jornada720_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/jornada720_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/jornada720_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -93,7 +93,7 @@ out:
+ 	return ret;
+ }
+ 
+-static struct backlight_ops jornada_bl_ops = {
++static const struct backlight_ops jornada_bl_ops = {
+ 	.get_brightness = jornada_bl_get_brightness,
+ 	.update_status = jornada_bl_update_status,
+ 	.options = BL_CORE_SUSPENDRESUME,
+diff -urNp linux-2.6.32.14/drivers/video/backlight/kb3886_bl.c linux-2.6.32.14/drivers/video/backlight/kb3886_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/kb3886_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/kb3886_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct
+ 	return kb3886bl_intensity;
+ }
+ 
+-static struct backlight_ops kb3886bl_ops = {
++static const struct backlight_ops kb3886bl_ops = {
+ 	.get_brightness = kb3886bl_get_intensity,
+ 	.update_status  = kb3886bl_send_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/locomolcd.c linux-2.6.32.14/drivers/video/backlight/locomolcd.c
+--- linux-2.6.32.14/drivers/video/backlight/locomolcd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/locomolcd.c	2010-05-28 21:27:15.943207359 -0400
+@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struc
+ 	return current_intensity;
+ }
+ 
+-static struct backlight_ops locomobl_data = {
++static const struct backlight_ops locomobl_data = {
+ 	.get_brightness = locomolcd_get_intensity,
+ 	.update_status  = locomolcd_set_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.14/drivers/video/backlight/mbp_nvidia_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/mbp_nvidia_bl.c	2010-04-29 17:49:38.397382140 -0400
++++ linux-2.6.32.14/drivers/video/backlight/mbp_nvidia_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -33,7 +33,7 @@ struct dmi_match_data {
+ 	unsigned long iostart;
+ 	unsigned long iolen;
+ 	/* Backlight operations structure. */
+-	struct backlight_ops backlight_ops;
++	const struct backlight_ops backlight_ops;
+ };
+ 
+ /* Module parameters. */
+diff -urNp linux-2.6.32.14/drivers/video/backlight/omap1_bl.c linux-2.6.32.14/drivers/video/backlight/omap1_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/omap1_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/omap1_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct b
+ 	return bl->current_intensity;
+ }
+ 
+-static struct backlight_ops omapbl_ops = {
++static const struct backlight_ops omapbl_ops = {
+ 	.get_brightness = omapbl_get_intensity,
+ 	.update_status  = omapbl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/progear_bl.c linux-2.6.32.14/drivers/video/backlight/progear_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/progear_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/progear_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struc
+ 	return intensity - HW_LEVEL_MIN;
+ }
+ 
+-static struct backlight_ops progearbl_ops = {
++static const struct backlight_ops progearbl_ops = {
+ 	.get_brightness = progearbl_get_intensity,
+ 	.update_status = progearbl_set_intensity,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/pwm_bl.c linux-2.6.32.14/drivers/video/backlight/pwm_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/pwm_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/pwm_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -56,7 +56,7 @@ static int pwm_backlight_get_brightness(
+ 	return bl->props.brightness;
+ }
+ 
+-static struct backlight_ops pwm_backlight_ops = {
++static const struct backlight_ops pwm_backlight_ops = {
+ 	.update_status	= pwm_backlight_update_status,
+ 	.get_brightness	= pwm_backlight_get_brightness,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/tosa_bl.c linux-2.6.32.14/drivers/video/backlight/tosa_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/tosa_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/tosa_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct
+ 	return props->brightness;
+ }
+ 
+-static struct backlight_ops bl_ops = {
++static const struct backlight_ops bl_ops = {
+ 	.get_brightness		= tosa_bl_get_brightness,
+ 	.update_status		= tosa_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/backlight/wm831x_bl.c linux-2.6.32.14/drivers/video/backlight/wm831x_bl.c
+--- linux-2.6.32.14/drivers/video/backlight/wm831x_bl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/backlight/wm831x_bl.c	2010-05-28 21:27:15.943207359 -0400
+@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightne
+ 	return data->current_brightness;
+ }
+ 
+-static struct backlight_ops wm831x_backlight_ops = {
++static const struct backlight_ops wm831x_backlight_ops = {
+ 	.options = BL_CORE_SUSPENDRESUME,
+ 	.update_status	= wm831x_backlight_update_status,
+ 	.get_brightness	= wm831x_backlight_get_brightness,
+diff -urNp linux-2.6.32.14/drivers/video/bf54x-lq043fb.c linux-2.6.32.14/drivers/video/bf54x-lq043fb.c
+--- linux-2.6.32.14/drivers/video/bf54x-lq043fb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/bf54x-lq043fb.c	2010-05-28 21:27:15.943207359 -0400
+@@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.14/drivers/video/bfin-t350mcqb-fb.c
+--- linux-2.6.32.14/drivers/video/bfin-t350mcqb-fb.c	2010-05-28 20:16:44.454934408 -0400
++++ linux-2.6.32.14/drivers/video/bfin-t350mcqb-fb.c	2010-05-28 21:27:15.943207359 -0400
+@@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
+ 	return 0;
+ }
+ 
+-static struct backlight_ops bfin_lq043fb_bl_ops = {
++static const struct backlight_ops bfin_lq043fb_bl_ops = {
+ 	.get_brightness = bl_get_brightness,
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/video/fbcmap.c linux-2.6.32.14/drivers/video/fbcmap.c
+--- linux-2.6.32.14/drivers/video/fbcmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/fbcmap.c	2010-05-28 21:27:15.943207359 -0400
+@@ -266,8 +266,7 @@ int fb_set_user_cmap(struct fb_cmap_user
+ 		rc = -ENODEV;
+ 		goto out;
+ 	}
+-	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+-				!info->fbops->fb_setcmap)) {
++	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
+ 		rc = -EINVAL;
+ 		goto out1;
+ 	}
+diff -urNp linux-2.6.32.14/drivers/video/fbmem.c linux-2.6.32.14/drivers/video/fbmem.c
+--- linux-2.6.32.14/drivers/video/fbmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/fbmem.c	2010-05-28 21:27:15.947209363 -0400
+@@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dx += image->width + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_UD) {
+-		for (x = 0; x < num && image->dx >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dx -= image->width + 8;
+ 		}
+@@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
+ 			image->dy += image->height + 8;
+ 		}
+ 	} else if (rotate == FB_ROTATE_CCW) {
+-		for (x = 0; x < num && image->dy >= 0; x++) {
++		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
+ 			info->fbops->fb_imageblit(info, image);
+ 			image->dy -= image->height + 8;
+ 		}
+@@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
+ 			return -EFAULT;
+ 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+ 			return -EINVAL;
+-		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
++		if (con2fb.framebuffer >= FB_MAX)
+ 			return -EINVAL;
+ 		if (!registered_fb[con2fb.framebuffer])
+ 			request_module("fb%d", con2fb.framebuffer);
+diff -urNp linux-2.6.32.14/drivers/video/fbmon.c linux-2.6.32.14/drivers/video/fbmon.c
+--- linux-2.6.32.14/drivers/video/fbmon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/fbmon.c	2010-05-28 21:27:15.947209363 -0400
+@@ -45,7 +45,7 @@
+ #ifdef DEBUG
+ #define DPRINTK(fmt, args...) printk(fmt,## args)
+ #else
+-#define DPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
+ #endif
+ 
+ #define FBMON_FIX_HEADER  1
+diff -urNp linux-2.6.32.14/drivers/video/i810/i810_accel.c linux-2.6.32.14/drivers/video/i810/i810_accel.c
+--- linux-2.6.32.14/drivers/video/i810/i810_accel.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/i810/i810_accel.c	2010-05-28 21:27:15.947209363 -0400
+@@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
+ 		}
+ 	}
+ 	printk("ringbuffer lockup!!!\n");
++	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
+ 	i810_report_error(mmio); 
+ 	par->dev_flags |= LOCKUP;
+ 	info->pixmap.scan_align = 1;
+diff -urNp linux-2.6.32.14/drivers/video/i810/i810_main.c linux-2.6.32.14/drivers/video/i810/i810_main.c
+--- linux-2.6.32.14/drivers/video/i810/i810_main.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/i810/i810_main.c	2010-05-28 21:27:15.987994154 -0400
+@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
+ 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
+-	{ 0 },
++	{ 0, 0, 0, 0, 0, 0, 0 },
+ };
+ 
+ static struct pci_driver i810fb_driver = {
+diff -urNp linux-2.6.32.14/drivers/video/modedb.c linux-2.6.32.14/drivers/video/modedb.c
+--- linux-2.6.32.14/drivers/video/modedb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/modedb.c	2010-05-28 21:27:15.987994154 -0400
+@@ -38,240 +38,240 @@ static const struct fb_videomode modedb[
+     {
+ 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
+ 	NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
+ 	NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
+ 	NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
+ 	NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
+ 	NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
+-	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
+ 	NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
+ 	NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
+ 	NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
+ 	NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
+ 	NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
+ 	NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
+ 	NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
+ 	NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
+ 	NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
+-	0, FB_VMODE_INTERLACED
++	0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
+ 	NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
+ 	NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
+ 	NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
+ 	NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
+ 	NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
+-	0, FB_VMODE_NONINTERLACED   	
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
+ 	NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
+         NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
+ 	NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
+ 	NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
+ 	NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
+ 	NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
+ 	NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
+ 	NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
+ 	NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
+ 	NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
+ 	NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
+ 	NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
+ 	NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
+ 	NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
+ 	NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
+ 	NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
+ 	NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
+ 	NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
+ 	NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
+ 	NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
+ 	NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
+ 	NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
+ 	NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
+ 	NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
+ 	NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
+ 	NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
+ 	NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
+-	0, FB_VMODE_DOUBLE
++	0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+ 	NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+ 	FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+-	FB_VMODE_NONINTERLACED
++	FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
+ 	NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
+-	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
++	FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+ 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
+ 	NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+    }, {
+ 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
+ 	NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
+-	0, FB_VMODE_NONINTERLACED
++	0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     }, {
+        /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
+        NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
+-       0, FB_VMODE_INTERLACED
++       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
+     },
+ };
+ 
+diff -urNp linux-2.6.32.14/drivers/video/nvidia/nv_backlight.c linux-2.6.32.14/drivers/video/nvidia/nv_backlight.c
+--- linux-2.6.32.14/drivers/video/nvidia/nv_backlight.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/nvidia/nv_backlight.c	2010-05-28 21:27:15.987994154 -0400
+@@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops nvidia_bl_ops = {
++static const struct backlight_ops nvidia_bl_ops = {
+ 	.get_brightness = nvidia_bl_get_brightness,
+ 	.update_status	= nvidia_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/riva/fbdev.c linux-2.6.32.14/drivers/video/riva/fbdev.c
+--- linux-2.6.32.14/drivers/video/riva/fbdev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/riva/fbdev.c	2010-05-28 21:27:15.987994154 -0400
+@@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
+ 	return bd->props.brightness;
+ }
+ 
+-static struct backlight_ops riva_bl_ops = {
++static const struct backlight_ops riva_bl_ops = {
+ 	.get_brightness = riva_bl_get_brightness,
+ 	.update_status	= riva_bl_update_status,
+ };
+diff -urNp linux-2.6.32.14/drivers/video/uvesafb.c linux-2.6.32.14/drivers/video/uvesafb.c
+--- linux-2.6.32.14/drivers/video/uvesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/uvesafb.c	2010-05-28 21:27:15.987994154 -0400
+@@ -18,6 +18,7 @@
+ #include <linux/fb.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
++#include <linux/moduleloader.h>
+ #include <video/edid.h>
+ #include <video/uvesafb.h>
+ #ifdef CONFIG_X86
+@@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
+ 		NULL,
+ 	};
+ 
+-	return call_usermodehelper(v86d_path, argv, envp, 1);
++	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
+ }
+ 
+ /*
+@@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
+ 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
+ 		par->pmi_setpal = par->ypan = 0;
+ 	} else {
++
++#ifdef CONFIG_PAX_KERNEXEC
++#ifdef CONFIG_MODULES
++		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
++#endif
++		if (!par->pmi_code) {
++			par->pmi_setpal = par->ypan = 0;
++			return 0;
++		}
++#endif
++
+ 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
+ 						+ task->t.regs.edi);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
++		pax_close_kernel();
++
++		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
++		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
++#else
+ 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
+ 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
++#endif
++
+ 		printk(KERN_INFO "uvesafb: protected mode interface info at "
+ 				 "%04x:%04x\n",
+ 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
+@@ -1799,6 +1822,11 @@ out:
+ 	if (par->vbe_modes)
+ 		kfree(par->vbe_modes);
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	if (par->pmi_code)
++		module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 	framebuffer_release(info);
+ 	return err;
+ }
+@@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
+ 				kfree(par->vbe_state_orig);
+ 			if (par->vbe_state_saved)
+ 				kfree(par->vbe_state_saved);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++			if (par->pmi_code)
++				module_free_exec(NULL, par->pmi_code);
++#endif
++
+ 		}
+ 
+ 		framebuffer_release(info);
+diff -urNp linux-2.6.32.14/drivers/video/vesafb.c linux-2.6.32.14/drivers/video/vesafb.c
+--- linux-2.6.32.14/drivers/video/vesafb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/video/vesafb.c	2010-05-28 21:27:15.987994154 -0400
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/module.h>
++#include <linux/moduleloader.h>
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/string.h>
+@@ -53,8 +54,8 @@ static int   vram_remap __initdata;		/* 
+ static int   vram_total __initdata;		/* Set total amount of memory */
+ static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
+ static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
+-static void  (*pmi_start)(void) __read_mostly;
+-static void  (*pmi_pal)  (void) __read_mostly;
++static void  (*pmi_start)(void) __read_only;
++static void  (*pmi_pal)  (void) __read_only;
+ static int   depth      __read_mostly;
+ static int   vga_compat __read_mostly;
+ /* --------------------------------------------------------------------- */
+@@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
+ 	unsigned int size_vmode;
+ 	unsigned int size_remap;
+ 	unsigned int size_total;
++	void *pmi_code = NULL;
+ 
+ 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
+ 		return -ENODEV;
+@@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
+ 		size_remap = size_total;
+ 	vesafb_fix.smem_len = size_remap;
+ 
+-#ifndef __i386__
+-	screen_info.vesapm_seg = 0;
+-#endif
+-
+ 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
+ 		printk(KERN_WARNING
+ 		       "vesafb: cannot reserve video memory at 0x%lx\n",
+@@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
+ 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
+ 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
+ 
++#ifdef __i386__
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	pmi_code = module_alloc_exec(screen_info.vesapm_size);
++	if (!pmi_code)
++#elif !defined(CONFIG_PAX_KERNEXEC)
++	if (0)
++#endif
++
++#endif
++	screen_info.vesapm_seg = 0;
++
+ 	if (screen_info.vesapm_seg) {
+-		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
+-		       screen_info.vesapm_seg,screen_info.vesapm_off);
++		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
++		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
+ 	}
+ 
+ 	if (screen_info.vesapm_seg < 0xc000)
+@@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
+ 
+ 	if (ypan || pmi_setpal) {
+ 		unsigned short *pmi_base;
+-		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+-		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
+-		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
++
++		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pax_open_kernel();
++		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
++#else
++		pmi_code = pmi_base;
++#endif
++
++		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
++		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++		pmi_start = ktva_ktla(pmi_start);
++		pmi_pal = ktva_ktla(pmi_pal);
++		pax_close_kernel();
++#endif
++
+ 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
+ 		if (pmi_base[3]) {
+ 			printk(KERN_INFO "vesafb: pmi: ports = ");
+@@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
+ 	       info->node, info->fix.id);
+ 	return 0;
+ err:
++
++#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
++	module_free_exec(NULL, pmi_code);
++#endif
++
+ 	if (info->screen_base)
+ 		iounmap(info->screen_base);
+ 	framebuffer_release(info);
+diff -urNp linux-2.6.32.14/drivers/xen/sys-hypervisor.c linux-2.6.32.14/drivers/xen/sys-hypervisor.c
+--- linux-2.6.32.14/drivers/xen/sys-hypervisor.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/drivers/xen/sys-hypervisor.c	2010-05-28 21:27:15.987994154 -0400
+@@ -425,7 +425,7 @@ static ssize_t hyp_sysfs_store(struct ko
+ 	return 0;
+ }
+ 
+-static struct sysfs_ops hyp_sysfs_ops = {
++static const struct sysfs_ops hyp_sysfs_ops = {
+ 	.show = hyp_sysfs_show,
+ 	.store = hyp_sysfs_store,
+ };
+diff -urNp linux-2.6.32.14/fs/9p/vfs_inode.c linux-2.6.32.14/fs/9p/vfs_inode.c
+--- linux-2.6.32.14/fs/9p/vfs_inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/9p/vfs_inode.c	2010-05-28 21:27:15.987994154 -0400
+@@ -1079,7 +1079,7 @@ static void *v9fs_vfs_follow_link(struct
+ static void
+ v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 
+ 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
+ 		IS_ERR(s) ? "<error>" : s);
+diff -urNp linux-2.6.32.14/fs/aio.c linux-2.6.32.14/fs/aio.c
+--- linux-2.6.32.14/fs/aio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/aio.c	2010-05-28 21:27:15.995209124 -0400
+@@ -115,7 +115,7 @@ static int aio_setup_ring(struct kioctx 
+ 	size += sizeof(struct io_event) * nr_events;
+ 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
+ 
+-	if (nr_pages < 0)
++	if (nr_pages <= 0)
+ 		return -EINVAL;
+ 
+ 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+diff -urNp linux-2.6.32.14/fs/attr.c linux-2.6.32.14/fs/attr.c
+--- linux-2.6.32.14/fs/attr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/attr.c	2010-05-28 21:27:15.995209124 -0400
+@@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode 
+ 		unsigned long limit;
+ 
+ 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
++		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
+ 		if (limit != RLIM_INFINITY && offset > limit)
+ 			goto out_sig;
+ 		if (offset > inode->i_sb->s_maxbytes)
+diff -urNp linux-2.6.32.14/fs/autofs/root.c linux-2.6.32.14/fs/autofs/root.c
+--- linux-2.6.32.14/fs/autofs/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/autofs/root.c	2010-05-28 21:27:15.995209124 -0400
+@@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
+ 	set_bit(n,sbi->symlink_bitmap);
+ 	sl = &sbi->symlink[n];
+ 	sl->len = strlen(symname);
+-	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
++	slsize = sl->len+1;
++	sl->data = kmalloc(slsize, GFP_KERNEL);
+ 	if (!sl->data) {
+ 		clear_bit(n,sbi->symlink_bitmap);
+ 		unlock_kernel();
+diff -urNp linux-2.6.32.14/fs/autofs4/symlink.c linux-2.6.32.14/fs/autofs4/symlink.c
+--- linux-2.6.32.14/fs/autofs4/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/autofs4/symlink.c	2010-05-28 21:27:15.995209124 -0400
+@@ -15,7 +15,7 @@
+ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
+ {
+ 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
+-	nd_set_link(nd, (char *)ino->u.symlink);
++	nd_set_link(nd, ino->u.symlink);
+ 	return NULL;
+ }
+ 
+diff -urNp linux-2.6.32.14/fs/befs/linuxvfs.c linux-2.6.32.14/fs/befs/linuxvfs.c
+--- linux-2.6.32.14/fs/befs/linuxvfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/befs/linuxvfs.c	2010-05-28 21:27:16.011217374 -0400
+@@ -493,7 +493,7 @@ static void befs_put_link(struct dentry 
+ {
+ 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
+ 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
+-		char *link = nd_get_link(nd);
++		const char *link = nd_get_link(nd);
+ 		if (!IS_ERR(link))
+ 			kfree(link);
+ 	}
+diff -urNp linux-2.6.32.14/fs/binfmt_aout.c linux-2.6.32.14/fs/binfmt_aout.c
+--- linux-2.6.32.14/fs/binfmt_aout.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/binfmt_aout.c	2010-05-28 21:27:16.011217374 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/string.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #include <linux/ptrace.h>
+@@ -113,10 +114,12 @@ static int aout_core_dump(long signr, st
+ 
+ /* If the size of the dump file exceeds the rlimit, then see what would happen
+    if we wrote the stack, but not the data area.  */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
+ 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
+ 		dump.u_dsize = 0;
+ 
+ /* Make sure we have enough room to write the stack and data areas. */
++	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
+ 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
+ 		dump.u_ssize = 0;
+ 
+@@ -249,6 +252,8 @@ static int load_aout_binary(struct linux
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+ 	if (rlim >= RLIM_INFINITY)
+ 		rlim = ~0;
++
++	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
+ 	if (ex.a_data + ex.a_bss > rlim)
+ 		return -ENOMEM;
+ 
+@@ -277,6 +282,27 @@ static int load_aout_binary(struct linux
+ 	install_exec_creds(bprm);
+  	current->flags &= ~PF_FORKNOEXEC;
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
++		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
++
++#ifdef CONFIG_PAX_EMUTRAMP
++		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
++			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
++			current->mm->pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++	}
++#endif
++
+ 	if (N_MAGIC(ex) == OMAGIC) {
+ 		unsigned long text_addr, map_size;
+ 		loff_t pos;
+@@ -349,7 +375,7 @@ static int load_aout_binary(struct linux
+ 
+ 		down_write(&current->mm->mmap_sem);
+  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
+-				PROT_READ | PROT_WRITE | PROT_EXEC,
++				PROT_READ | PROT_WRITE,
+ 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
+ 				fd_offset + ex.a_text);
+ 		up_write(&current->mm->mmap_sem);
+diff -urNp linux-2.6.32.14/fs/binfmt_elf.c linux-2.6.32.14/fs/binfmt_elf.c
+--- linux-2.6.32.14/fs/binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/binfmt_elf.c	2010-05-28 21:27:16.011217374 -0400
+@@ -50,6 +50,10 @@ static int elf_core_dump(long signr, str
+ #define elf_core_dump	NULL
+ #endif
+ 
++#ifdef CONFIG_PAX_MPROTECT
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
++#endif
++
+ #if ELF_EXEC_PAGESIZE > PAGE_SIZE
+ #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
+ #else
+@@ -69,6 +73,11 @@ static struct linux_binfmt elf_format = 
+ 		.load_binary	= load_elf_binary,
+ 		.load_shlib	= load_elf_library,
+ 		.core_dump	= elf_core_dump,
++
++#ifdef CONFIG_PAX_MPROTECT
++		.handle_mprotect= elf_handle_mprotect,
++#endif
++
+ 		.min_coredump	= ELF_EXEC_PAGESIZE,
+ 		.hasvdso	= 1
+ };
+@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format = 
+ 
+ static int set_brk(unsigned long start, unsigned long end)
+ {
++	unsigned long e = end;
++
+ 	start = ELF_PAGEALIGN(start);
+ 	end = ELF_PAGEALIGN(end);
+ 	if (end > start) {
+@@ -87,7 +98,7 @@ static int set_brk(unsigned long start, 
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+-	current->mm->start_brk = current->mm->brk = end;
++	current->mm->start_brk = current->mm->brk = e;
+ 	return 0;
+ }
+ 
+@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
+ 	elf_addr_t __user *u_rand_bytes;
+ 	const char *k_platform = ELF_PLATFORM;
+ 	const char *k_base_platform = ELF_BASE_PLATFORM;
+-	unsigned char k_rand_bytes[16];
++	u32 k_rand_bytes[4];
+ 	int items;
+ 	elf_addr_t *elf_info;
+ 	int ei_index = 0;
+@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
+ 	 * Generate 16 random bytes for userspace PRNG seeding.
+ 	 */
+ 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
+-	u_rand_bytes = (elf_addr_t __user *)
+-		       STACK_ALLOC(p, sizeof(k_rand_bytes));
++	srandom32(k_rand_bytes[0] ^ random32());
++	srandom32(k_rand_bytes[1] ^ random32());
++	srandom32(k_rand_bytes[2] ^ random32());
++	srandom32(k_rand_bytes[3] ^ random32());
++	p = STACK_ROUND(p, sizeof(k_rand_bytes));
++	u_rand_bytes = (elf_addr_t __user *) p;
+ 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
+ 		return -EFAULT;
+ 
+@@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
+ {
+ 	struct elf_phdr *elf_phdata;
+ 	struct elf_phdr *eppnt;
+-	unsigned long load_addr = 0;
++	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
+ 	int load_addr_set = 0;
+ 	unsigned long last_bss = 0, elf_bss = 0;
+-	unsigned long error = ~0UL;
++	unsigned long error = -EINVAL;
+ 	unsigned long total_size;
+ 	int retval, i, size;
+ 
+@@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
+ 		goto out_close;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	eppnt = elf_phdata;
+ 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
+ 		if (eppnt->p_type == PT_LOAD) {
+@@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
+ 			k = load_addr + eppnt->p_vaddr;
+ 			if (BAD_ADDR(k) ||
+ 			    eppnt->p_filesz > eppnt->p_memsz ||
+-			    eppnt->p_memsz > TASK_SIZE ||
+-			    TASK_SIZE - eppnt->p_memsz < k) {
++			    eppnt->p_memsz > pax_task_size ||
++			    pax_task_size - eppnt->p_memsz < k) {
+ 				error = -ENOMEM;
+ 				goto out_close;
+ 			}
+@@ -532,6 +552,177 @@ out:
+ 	return error;
+ }
+ 
++#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
++static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (elf_phdata->p_flags & PF_PAGEEXEC)
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (elf_phdata->p_flags & PF_SEGMEXEC)
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (elf_phdata->p_flags & PF_EMUTRAMP)
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (elf_phdata->p_flags & PF_MPROTECT)
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
++	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
++		pax_flags |= MF_PAX_PAGEEXEC;
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
++		pax_flags |= MF_PAX_SEGMEXEC;
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		if (nx_enabled)
++			pax_flags &= ~MF_PAX_SEGMEXEC;
++		else
++			pax_flags &= ~MF_PAX_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
++		pax_flags |= MF_PAX_EMUTRAMP;
++#endif
++
++#ifdef CONFIG_PAX_MPROTECT
++	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
++		pax_flags |= MF_PAX_MPROTECT;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
++		pax_flags |= MF_PAX_RANDMMAP;
++#endif
++
++	return pax_flags;
++}
++#endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
++{
++	unsigned long pax_flags = 0UL;
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	unsigned long i;
++#endif
++
++#ifdef CONFIG_PAX_EI_PAX
++	pax_flags = pax_parse_ei_pax(elf_ex);
++#endif
++
++#ifdef CONFIG_PAX_PT_PAX_FLAGS
++	for (i = 0UL; i < elf_ex->e_phnum; i++)
++		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
++			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
++			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
++			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
++			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
++				return -EINVAL;
++
++#ifdef CONFIG_PAX_SOFTMODE
++			if (pax_softmode)
++				pax_flags = pax_parse_softmode(&elf_phdata[i]);
++			else
++#endif
++
++				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
++			break;
++		}
++#endif
++
++	if (0 > pax_check_flags(&pax_flags))
++		return -EINVAL;
++
++	current->mm->pax_flags = pax_flags;
++	return 0;
++}
++#endif
++
+ /*
+  * These are the functions used to load ELF style executables and shared
+  * libraries.  There is no binary dependent code anywhere else.
+@@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
+ {
+ 	unsigned int random_variable = 0;
+ 
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		return stack_top - current->mm->delta_stack;
++#endif
++
+ 	if ((current->flags & PF_RANDOMIZE) &&
+ 		!(current->personality & ADDR_NO_RANDOMIZE)) {
+ 		random_variable = get_random_int() & STACK_RND_MASK;
+@@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
+  	unsigned long load_addr = 0, load_bias = 0;
+ 	int load_addr_set = 0;
+ 	char * elf_interpreter = NULL;
+-	unsigned long error;
++	unsigned long error = 0;
+ 	struct elf_phdr *elf_ppnt, *elf_phdata;
+ 	unsigned long elf_bss, elf_brk;
+ 	int retval, i;
+@@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
+ 	unsigned long start_code, end_code, start_data, end_data;
+ 	unsigned long reloc_func_desc = 0;
+ 	int executable_stack = EXSTACK_DEFAULT;
+-	unsigned long def_flags = 0;
+ 	struct {
+ 		struct elfhdr elf_ex;
+ 		struct elfhdr interp_elf_ex;
+ 	} *loc;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
+ 	if (!loc) {
+@@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
+ 
+ 	/* OK, This is the point of no return */
+ 	current->flags &= ~PF_FORKNOEXEC;
+-	current->mm->def_flags = def_flags;
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	current->mm->pax_flags = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	current->mm->call_dl_resolve = 0UL;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	current->mm->call_syscall = 0UL;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	current->mm->delta_mmap = 0UL;
++	current->mm->delta_stack = 0UL;
++#endif
++
++	current->mm->def_flags = 0;
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
++	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
++		send_sig(SIGKILL, current, 0);
++		goto out_free_dentry;
++	}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++	pax_set_initial_flags(bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++	if (pax_set_initial_flags_func)
++		(pax_set_initial_flags_func)(bprm);
++#endif
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
++		current->mm->context.user_cs_limit = PAGE_SIZE;
++		current->mm->def_flags |= VM_PAGEEXEC;
++	}
++#endif
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
++		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++	}
++#endif
++
++#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
++		put_cpu();
++	}
++#endif
+ 
+ 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
+ 	   may depend on the personality.  */
+ 	SET_PERSONALITY(loc->elf_ex);
++
++#ifdef CONFIG_PAX_ASLR
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
++		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
++		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		executable_stack = EXSTACK_DISABLE_X;
++		current->personality &= ~READ_IMPLIES_EXEC;
++	} else
++#endif
++
+ 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
+ 		current->personality |= READ_IMPLIES_EXEC;
+ 
+@@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++
++#ifdef CONFIG_PAX_RANDMMAP
++			/* PaX: randomize base address at the default exe base if requested */
++			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
++#ifdef CONFIG_SPARC64
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
++#else
++				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
++#endif
++				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
++				elf_flags |= MAP_FIXED;
++			}
++#endif
++
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+@@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
+ 		 * allowed task size. Note that p_filesz must always be
+ 		 * <= p_memsz so it is only necessary to check p_memsz.
+ 		 */
+-		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
+-		    elf_ppnt->p_memsz > TASK_SIZE ||
+-		    TASK_SIZE - elf_ppnt->p_memsz < k) {
++		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
++		    elf_ppnt->p_memsz > pax_task_size ||
++		    pax_task_size - elf_ppnt->p_memsz < k) {
+ 			/* set_brk can never work. Avoid overflows. */
+ 			send_sig(SIGKILL, current, 0);
+ 			retval = -EINVAL;
+@@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
+ 	start_data += load_bias;
+ 	end_data += load_bias;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
++		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
++#endif
++
+ 	/* Calling set_brk effectively mmaps the pages that we need
+ 	 * for the bss and break sections.  We must do this before
+ 	 * mapping in the interpreter, to make sure it doesn't wind
+@@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
+ 		goto out_free_dentry;
+ 	}
+ 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
+-		send_sig(SIGSEGV, current, 0);
+-		retval = -EFAULT; /* Nobody gets to see this, but.. */
+-		goto out_free_dentry;
++		/*
++		 * This bss-zeroing can fail if the ELF
++		 * file specifies odd protections. So
++		 * we don't check the return value
++		 */
+ 	}
+ 
+ 	if (elf_interpreter) {
+@@ -1112,8 +1398,10 @@ static int dump_seek(struct file *file, 
+ 			unsigned long n = off;
+ 			if (n > PAGE_SIZE)
+ 				n = PAGE_SIZE;
+-			if (!dump_write(file, buf, n))
++			if (!dump_write(file, buf, n)) {
++				free_page((unsigned long)buf);
+ 				return 0;
++			}
+ 			off -= n;
+ 		}
+ 		free_page((unsigned long)buf);
+@@ -1125,7 +1413,7 @@ static int dump_seek(struct file *file, 
+  * Decide what to dump of a segment, part, all or none.
+  */
+ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+-				   unsigned long mm_flags)
++				   unsigned long mm_flags, long signr)
+ {
+ #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
+ 
+@@ -1159,7 +1447,7 @@ static unsigned long vma_dump_size(struc
+ 	if (vma->vm_file == NULL)
+ 		return 0;
+ 
+-	if (FILTER(MAPPED_PRIVATE))
++	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
+ 		goto whole;
+ 
+ 	/*
+@@ -1255,8 +1543,11 @@ static int writenote(struct memelfnote *
+ #undef DUMP_WRITE
+ 
+ #define DUMP_WRITE(addr, nr)	\
++	do { \
++	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
+ 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
+-		goto end_coredump;
++		goto end_coredump; \
++	} while (0);
+ 
+ static void fill_elf_header(struct elfhdr *elf, int segs,
+ 			    u16 machine, u32 flags, u8 osabi)
+@@ -1385,9 +1676,9 @@ static void fill_auxv_note(struct memelf
+ {
+ 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
+ 	int i = 0;
+-	do
++	do {
+ 		i += 2;
+-	while (auxv[i - 2] != AT_NULL);
++	} while (auxv[i - 2] != AT_NULL);
+ 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
+ }
+ 
+@@ -1973,7 +2264,7 @@ static int elf_core_dump(long signr, str
+ 		phdr.p_offset = offset;
+ 		phdr.p_vaddr = vma->vm_start;
+ 		phdr.p_paddr = 0;
+-		phdr.p_filesz = vma_dump_size(vma, mm_flags);
++		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
+ 		phdr.p_memsz = vma->vm_end - vma->vm_start;
+ 		offset += phdr.p_filesz;
+ 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
+@@ -2006,7 +2297,7 @@ static int elf_core_dump(long signr, str
+ 		unsigned long addr;
+ 		unsigned long end;
+ 
+-		end = vma->vm_start + vma_dump_size(vma, mm_flags);
++		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
+ 
+ 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
+ 			struct page *page;
+@@ -2015,6 +2306,7 @@ static int elf_core_dump(long signr, str
+ 			page = get_dump_page(addr);
+ 			if (page) {
+ 				void *kaddr = kmap(page);
++				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
+ 				stop = ((size += PAGE_SIZE) > limit) ||
+ 					!dump_write(file, kaddr, PAGE_SIZE);
+ 				kunmap(page);
+@@ -2042,6 +2334,97 @@ out:
+ 
+ #endif		/* USE_ELF_CORE_DUMP */
+ 
++#ifdef CONFIG_PAX_MPROTECT
++/* PaX: non-PIC ELF libraries need relocations on their executable segments
++ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
++ * we'll remove VM_MAYWRITE for good on RELRO segments.
++ *
++ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
++ * basis because we want to allow the common case and not the special ones.
++ */
++static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
++{
++	struct elfhdr elf_h;
++	struct elf_phdr elf_p;
++	unsigned long i;
++	unsigned long oldflags;
++	bool is_textrel_rw, is_textrel_rx, is_relro;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
++		return;
++
++	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
++	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
++
++#ifdef CONFIG_PAX_NOELFRELOCS
++	is_textrel_rw = false;
++	is_textrel_rx = false;
++#else
++	/* possible TEXTREL */
++	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
++	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
++#endif
++
++	/* possible RELRO */
++	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
++
++	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
++		return;
++
++	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
++	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
++
++#ifdef CONFIG_PAX_ETEXECRELOCS
++	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++#else
++	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
++#endif
++
++	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
++	    !elf_check_arch(&elf_h) ||
++	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
++	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
++		return;
++
++	for (i = 0UL; i < elf_h.e_phnum; i++) {
++		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
++			return;
++		switch (elf_p.p_type) {
++		case PT_DYNAMIC:
++			if (!is_textrel_rw && !is_textrel_rx)
++				continue;
++			i = 0UL;
++			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
++				elf_dyn dyn;
++
++				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
++					return;
++				if (dyn.d_tag == DT_NULL)
++					return;
++				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
++					gr_log_textrel(vma);
++					if (is_textrel_rw)
++						vma->vm_flags |= VM_MAYWRITE;
++					else
++						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
++						vma->vm_flags &= ~VM_MAYWRITE;
++					return;
++				}
++				i++;
++			}
++			return;
++
++		case PT_GNU_RELRO:
++			if (!is_relro)
++				continue;
++			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
++				vma->vm_flags &= ~VM_MAYWRITE;
++			return;
++		}
++	}
++}
++#endif
++
+ static int __init init_elf_binfmt(void)
+ {
+ 	return register_binfmt(&elf_format);
+diff -urNp linux-2.6.32.14/fs/binfmt_flat.c linux-2.6.32.14/fs/binfmt_flat.c
+--- linux-2.6.32.14/fs/binfmt_flat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/binfmt_flat.c	2010-05-28 21:27:16.018905555 -0400
+@@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
+ 				realdatastart = (unsigned long) -ENOMEM;
+ 			printk("Unable to allocate RAM for process data, errno %d\n",
+ 					(int)-realdatastart);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
++			up_write(&current->mm->mmap_sem);
+ 			ret = realdatastart;
+ 			goto err;
+ 		}
+@@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read data+bss, errno %d\n", (int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len);
+ 			do_munmap(current->mm, realdatastart, data_len + extra);
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+@@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
+ 		}
+ 		if (IS_ERR_VALUE(result)) {
+ 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
++			down_write(&current->mm->mmap_sem);
+ 			do_munmap(current->mm, textpos, text_len + data_len + extra +
+ 				MAX_SHARED_LIBS * sizeof(unsigned long));
++			up_write(&current->mm->mmap_sem);
+ 			ret = result;
+ 			goto err;
+ 		}
+diff -urNp linux-2.6.32.14/fs/binfmt_misc.c linux-2.6.32.14/fs/binfmt_misc.c
+--- linux-2.6.32.14/fs/binfmt_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/binfmt_misc.c	2010-05-28 21:27:16.018905555 -0400
+@@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
+ 	static struct tree_descr bm_files[] = {
+ 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
+ 		[3] = {"register", &bm_register_operations, S_IWUSR},
+-		/* last one */ {""}
++		/* last one */ {"", NULL, 0}
+ 	};
+ 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
+ 	if (!err)
+diff -urNp linux-2.6.32.14/fs/bio.c linux-2.6.32.14/fs/bio.c
+--- linux-2.6.32.14/fs/bio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/bio.c	2010-05-28 21:27:16.018905555 -0400
+@@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr
+ 
+ 	i = 0;
+ 	while (i < bio_slab_nr) {
+-		struct bio_slab *bslab = &bio_slabs[i];
++		bslab = &bio_slabs[i];
+ 
+ 		if (!bslab->slab && entry == -1)
+ 			entry = i;
+@@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
+ 	const int read = bio_data_dir(bio) == READ;
+ 	struct bio_map_data *bmd = bio->bi_private;
+ 	int i;
+-	char *p = bmd->sgvecs[0].iov_base;
++	char *p = (__force char *)bmd->sgvecs[0].iov_base;
+ 
+ 	__bio_for_each_segment(bvec, bio, i, 0) {
+ 		char *addr = page_address(bvec->bv_page);
+diff -urNp linux-2.6.32.14/fs/block_dev.c linux-2.6.32.14/fs/block_dev.c
+--- linux-2.6.32.14/fs/block_dev.c	2010-04-29 17:49:38.421500081 -0400
++++ linux-2.6.32.14/fs/block_dev.c	2010-05-28 21:27:16.030907926 -0400
+@@ -664,7 +664,7 @@ int bd_claim(struct block_device *bdev, 
+ 	else if (bdev->bd_contains == bdev)
+ 		res = 0;  	 /* is a whole device which isn't held */
+ 
+-	else if (bdev->bd_contains->bd_holder == bd_claim)
++	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
+ 		res = 0; 	 /* is a partition of a device that is being partitioned */
+ 	else if (bdev->bd_contains->bd_holder != NULL)
+ 		res = -EBUSY;	 /* is a partition of a held device */
+diff -urNp linux-2.6.32.14/fs/btrfs/ctree.c linux-2.6.32.14/fs/btrfs/ctree.c
+--- linux-2.6.32.14/fs/btrfs/ctree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/ctree.c	2010-05-28 21:27:16.047217370 -0400
+@@ -3568,7 +3568,6 @@ setup_items_for_insert(struct btrfs_tran
+ 
+ 	ret = 0;
+ 	if (slot == 0) {
+-		struct btrfs_disk_key disk_key;
+ 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
+ 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
+ 	}
+diff -urNp linux-2.6.32.14/fs/btrfs/disk-io.c linux-2.6.32.14/fs/btrfs/disk-io.c
+--- linux-2.6.32.14/fs/btrfs/disk-io.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/disk-io.c	2010-05-28 21:27:16.055226050 -0400
+@@ -39,7 +39,7 @@
+ #include "tree-log.h"
+ #include "free-space-cache.h"
+ 
+-static struct extent_io_ops btree_extent_io_ops;
++static const struct extent_io_ops btree_extent_io_ops;
+ static void end_workqueue_fn(struct btrfs_work *work);
+ static void free_fs_root(struct btrfs_root *root);
+ 
+@@ -2585,7 +2585,7 @@ out:
+ 	return 0;
+ }
+ 
+-static struct extent_io_ops btree_extent_io_ops = {
++static const struct extent_io_ops btree_extent_io_ops = {
+ 	.write_cache_pages_lock_hook = btree_lock_page_hook,
+ 	.readpage_end_io_hook = btree_readpage_end_io_hook,
+ 	.submit_bio_hook = btree_submit_bio_hook,
+diff -urNp linux-2.6.32.14/fs/btrfs/extent_io.h linux-2.6.32.14/fs/btrfs/extent_io.h
+--- linux-2.6.32.14/fs/btrfs/extent_io.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/extent_io.h	2010-05-28 21:27:16.055226050 -0400
+@@ -49,36 +49,36 @@ typedef	int (extent_submit_bio_hook_t)(s
+ 				       struct bio *bio, int mirror_num,
+ 				       unsigned long bio_flags);
+ struct extent_io_ops {
+-	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
++	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
+ 			     u64 start, u64 end, int *page_started,
+ 			     unsigned long *nr_written);
+-	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+-	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
++	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
+ 	extent_submit_bio_hook_t *submit_bio_hook;
+-	int (*merge_bio_hook)(struct page *page, unsigned long offset,
++	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
+ 			      size_t size, struct bio *bio,
+ 			      unsigned long bio_flags);
+-	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
+-	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
++	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
+ 				       u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
++	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
+ 					u64 start, u64 end,
+ 				       struct extent_state *state);
+-	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				    struct extent_state *state);
+-	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
++	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ 				      struct extent_state *state, int uptodate);
+-	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
++	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
+ 			    unsigned long old, unsigned long bits);
+-	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
++	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
+ 			      unsigned long bits);
+-	int (*merge_extent_hook)(struct inode *inode,
++	int (* const merge_extent_hook)(struct inode *inode,
+ 				 struct extent_state *new,
+ 				 struct extent_state *other);
+-	int (*split_extent_hook)(struct inode *inode,
++	int (* const split_extent_hook)(struct inode *inode,
+ 				 struct extent_state *orig, u64 split);
+-	int (*write_cache_pages_lock_hook)(struct page *page);
++	int (* const write_cache_pages_lock_hook)(struct page *page);
+ };
+ 
+ struct extent_io_tree {
+@@ -88,7 +88,7 @@ struct extent_io_tree {
+ 	u64 dirty_bytes;
+ 	spinlock_t lock;
+ 	spinlock_t buffer_lock;
+-	struct extent_io_ops *ops;
++	const struct extent_io_ops *ops;
+ };
+ 
+ struct extent_state {
+diff -urNp linux-2.6.32.14/fs/btrfs/free-space-cache.c linux-2.6.32.14/fs/btrfs/free-space-cache.c
+--- linux-2.6.32.14/fs/btrfs/free-space-cache.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/free-space-cache.c	2010-05-28 21:27:16.067008196 -0400
+@@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
+ 
+ 	while(1) {
+ 		if (entry->bytes < bytes || entry->offset < min_start) {
+-			struct rb_node *node;
+-
+ 			node = rb_next(&entry->offset_index);
+ 			if (!node)
+ 				break;
+@@ -1226,7 +1224,7 @@ again:
+ 	 */
+ 	while (entry->bitmap || found_bitmap ||
+ 	       (!entry->bitmap && entry->bytes < min_bytes)) {
+-		struct rb_node *node = rb_next(&entry->offset_index);
++		node = rb_next(&entry->offset_index);
+ 
+ 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
+ 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
+diff -urNp linux-2.6.32.14/fs/btrfs/inode.c linux-2.6.32.14/fs/btrfs/inode.c
+--- linux-2.6.32.14/fs/btrfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/inode.c	2010-05-28 21:27:16.071504594 -0400
+@@ -63,7 +63,7 @@ static const struct inode_operations btr
+ static const struct address_space_operations btrfs_aops;
+ static const struct address_space_operations btrfs_symlink_aops;
+ static const struct file_operations btrfs_dir_file_operations;
+-static struct extent_io_ops btrfs_extent_io_ops;
++static const struct extent_io_ops btrfs_extent_io_ops;
+ 
+ static struct kmem_cache *btrfs_inode_cachep;
+ struct kmem_cache *btrfs_trans_handle_cachep;
+@@ -5854,7 +5854,7 @@ static const struct file_operations btrf
+ 	.fsync		= btrfs_sync_file,
+ };
+ 
+-static struct extent_io_ops btrfs_extent_io_ops = {
++static const struct extent_io_ops btrfs_extent_io_ops = {
+ 	.fill_delalloc = run_delalloc_range,
+ 	.submit_bio_hook = btrfs_submit_bio_hook,
+ 	.merge_bio_hook = btrfs_merge_bio_hook,
+diff -urNp linux-2.6.32.14/fs/btrfs/sysfs.c linux-2.6.32.14/fs/btrfs/sysfs.c
+--- linux-2.6.32.14/fs/btrfs/sysfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/btrfs/sysfs.c	2010-05-28 21:27:16.071504594 -0400
+@@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
+ 	complete(&root->kobj_unregister);
+ }
+ 
+-static struct sysfs_ops btrfs_super_attr_ops = {
++static const struct sysfs_ops btrfs_super_attr_ops = {
+ 	.show	= btrfs_super_attr_show,
+ 	.store	= btrfs_super_attr_store,
+ };
+ 
+-static struct sysfs_ops btrfs_root_attr_ops = {
++static const struct sysfs_ops btrfs_root_attr_ops = {
+ 	.show	= btrfs_root_attr_show,
+ 	.store	= btrfs_root_attr_store,
+ };
+diff -urNp linux-2.6.32.14/fs/buffer.c linux-2.6.32.14/fs/buffer.c
+--- linux-2.6.32.14/fs/buffer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/buffer.c	2010-05-28 21:27:16.083222448 -0400
+@@ -25,6 +25,7 @@
+ #include <linux/percpu.h>
+ #include <linux/slab.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/blkdev.h>
+ #include <linux/file.h>
+ #include <linux/quotaops.h>
+diff -urNp linux-2.6.32.14/fs/cachefiles/bind.c linux-2.6.32.14/fs/cachefiles/bind.c
+--- linux-2.6.32.14/fs/cachefiles/bind.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/cachefiles/bind.c	2010-05-28 21:27:16.083222448 -0400
+@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
+ 	       args);
+ 
+ 	/* start by checking things over */
+-	ASSERT(cache->fstop_percent >= 0 &&
+-	       cache->fstop_percent < cache->fcull_percent &&
++	ASSERT(cache->fstop_percent < cache->fcull_percent &&
+ 	       cache->fcull_percent < cache->frun_percent &&
+ 	       cache->frun_percent  < 100);
+ 
+-	ASSERT(cache->bstop_percent >= 0 &&
+-	       cache->bstop_percent < cache->bcull_percent &&
++	ASSERT(cache->bstop_percent < cache->bcull_percent &&
+ 	       cache->bcull_percent < cache->brun_percent &&
+ 	       cache->brun_percent  < 100);
+ 
+diff -urNp linux-2.6.32.14/fs/cachefiles/daemon.c linux-2.6.32.14/fs/cachefiles/daemon.c
+--- linux-2.6.32.14/fs/cachefiles/daemon.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/cachefiles/daemon.c	2010-05-28 21:27:16.091216728 -0400
+@@ -220,7 +220,7 @@ static ssize_t cachefiles_daemon_write(s
+ 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
+ 		return -EIO;
+ 
+-	if (datalen < 0 || datalen > PAGE_SIZE - 1)
++	if (datalen > PAGE_SIZE - 1)
+ 		return -EOPNOTSUPP;
+ 
+ 	/* drag the command string into the kernel so we can parse it */
+@@ -385,7 +385,7 @@ static int cachefiles_daemon_fstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (fstop < 0 || fstop >= cache->fcull_percent)
++	if (fstop >= cache->fcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->fstop_percent = fstop;
+@@ -457,7 +457,7 @@ static int cachefiles_daemon_bstop(struc
+ 	if (args[0] != '%' || args[1] != '\0')
+ 		return -EINVAL;
+ 
+-	if (bstop < 0 || bstop >= cache->bcull_percent)
++	if (bstop >= cache->bcull_percent)
+ 		return cachefiles_daemon_range_error(cache, args);
+ 
+ 	cache->bstop_percent = bstop;
+diff -urNp linux-2.6.32.14/fs/cachefiles/rdwr.c linux-2.6.32.14/fs/cachefiles/rdwr.c
+--- linux-2.6.32.14/fs/cachefiles/rdwr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/cachefiles/rdwr.c	2010-05-28 21:27:16.091216728 -0400
+@@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache
+ 			old_fs = get_fs();
+ 			set_fs(KERNEL_DS);
+ 			ret = file->f_op->write(
+-				file, (const void __user *) data, len, &pos);
++				file, (__force const void __user *) data, len, &pos);
+ 			set_fs(old_fs);
+ 			kunmap(page);
+ 			if (ret != len)
+diff -urNp linux-2.6.32.14/fs/cifs/cifs_uniupr.h linux-2.6.32.14/fs/cifs/cifs_uniupr.h
+--- linux-2.6.32.14/fs/cifs/cifs_uniupr.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/cifs/cifs_uniupr.h	2010-05-28 21:27:16.091216728 -0400
+@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
+ 	{0x0490, 0x04cc, UniCaseRangeU0490},
+ 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
+ 	{0xff40, 0xff5a, UniCaseRangeUff40},
+-	{0}
++	{0, 0, NULL}
+ };
+ #endif
+ 
+diff -urNp linux-2.6.32.14/fs/cifs/link.c linux-2.6.32.14/fs/cifs/link.c
+--- linux-2.6.32.14/fs/cifs/link.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/cifs/link.c	2010-05-28 21:27:16.091216728 -0400
+@@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
+ 
+ void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
+ {
+-	char *p = nd_get_link(nd);
++	const char *p = nd_get_link(nd);
+ 	if (!IS_ERR(p))
+ 		kfree(p);
+ }
+diff -urNp linux-2.6.32.14/fs/compat_binfmt_elf.c linux-2.6.32.14/fs/compat_binfmt_elf.c
+--- linux-2.6.32.14/fs/compat_binfmt_elf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/compat_binfmt_elf.c	2010-05-28 21:27:16.091216728 -0400
+@@ -29,10 +29,12 @@
+ #undef	elfhdr
+ #undef	elf_phdr
+ #undef	elf_note
++#undef	elf_dyn
+ #undef	elf_addr_t
+ #define elfhdr		elf32_hdr
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
++#define elf_dyn		Elf32_Dyn
+ #define elf_addr_t	Elf32_Addr
+ 
+ /*
+diff -urNp linux-2.6.32.14/fs/compat.c linux-2.6.32.14/fs/compat.c
+--- linux-2.6.32.14/fs/compat.c	2010-05-28 20:16:44.454934408 -0400
++++ linux-2.6.32.14/fs/compat.c	2010-05-28 21:27:16.095276039 -0400
+@@ -1410,14 +1410,12 @@ static int compat_copy_strings(int argc,
+ 			if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
+ 				struct page *page;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+ 				ret = expand_stack_downwards(bprm->vma, pos);
+ 				if (ret < 0) {
+ 					/* We've exceed the stack rlimit. */
+ 					ret = -E2BIG;
+ 					goto out;
+ 				}
+-#endif
+ 				ret = get_user_pages(current, bprm->mm, pos,
+ 						     1, 1, 1, &page, NULL);
+ 				if (ret <= 0) {
+@@ -1463,6 +1461,11 @@ int compat_do_execve(char * filename,
+ 	compat_uptr_t __user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1499,6 +1502,14 @@ int compat_do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++	retval = -EAGAIN;
++	if (gr_handle_nproc())
++		goto out_file;
++	retval = -EACCES;
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
++		goto out_file;
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1528,9 +1539,40 @@ int compat_do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, (char __user * __user *)argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	retval = search_binary_handler(bprm, regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	/* execve succeeded */
+ 	current->fs->in_exec = 0;
+@@ -1541,6 +1583,14 @@ int compat_do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput(bprm->mm);
+diff -urNp linux-2.6.32.14/fs/compat_ioctl.c linux-2.6.32.14/fs/compat_ioctl.c
+--- linux-2.6.32.14/fs/compat_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/compat_ioctl.c	2010-05-28 21:27:16.111229439 -0400
+@@ -1827,15 +1827,15 @@ struct ioctl_trans {
+ };
+ 
+ #define HANDLE_IOCTL(cmd,handler) \
+-	{ (cmd), (ioctl_trans_handler_t)(handler) },
++	{ (cmd), (ioctl_trans_handler_t)(handler), NULL },
+ 
+ /* pointer to compatible structure or no argument */
+ #define COMPATIBLE_IOCTL(cmd) \
+-	{ (cmd), do_ioctl32_pointer },
++	{ (cmd), do_ioctl32_pointer, NULL },
+ 
+ /* argument is an unsigned long integer, not a pointer */
+ #define ULONG_IOCTL(cmd) \
+-	{ (cmd), (ioctl_trans_handler_t)sys_ioctl },
++	{ (cmd), (ioctl_trans_handler_t)sys_ioctl, NULL },
+ 
+ /* ioctl should not be warned about even if it's not implemented.
+    Valid reasons to use this:
+diff -urNp linux-2.6.32.14/fs/debugfs/inode.c linux-2.6.32.14/fs/debugfs/inode.c
+--- linux-2.6.32.14/fs/debugfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/debugfs/inode.c	2010-05-28 21:27:16.111229439 -0400
+@@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	static struct tree_descr debug_files[] = {{""}};
++	static struct tree_descr debug_files[] = {{"", NULL, 0}};
+ 
+ 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
+ }
+diff -urNp linux-2.6.32.14/fs/dlm/lockspace.c linux-2.6.32.14/fs/dlm/lockspace.c
+--- linux-2.6.32.14/fs/dlm/lockspace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/dlm/lockspace.c	2010-05-28 21:27:16.111229439 -0400
+@@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
+ 	kfree(ls);
+ }
+ 
+-static struct sysfs_ops dlm_attr_ops = {
++static const struct sysfs_ops dlm_attr_ops = {
+ 	.show  = dlm_attr_show,
+ 	.store = dlm_attr_store,
+ };
+diff -urNp linux-2.6.32.14/fs/ecryptfs/inode.c linux-2.6.32.14/fs/ecryptfs/inode.c
+--- linux-2.6.32.14/fs/ecryptfs/inode.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.14/fs/ecryptfs/inode.c	2010-05-28 21:27:16.111229439 -0400
+@@ -655,7 +655,7 @@ static int ecryptfs_readlink_lower(struc
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
+-						   (char __user *)lower_buf,
++						   (__force char __user *)lower_buf,
+ 						   lower_bufsiz);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+@@ -701,7 +701,7 @@ static void *ecryptfs_follow_link(struct
+ 	}
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+-	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
++	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
+ 	set_fs(old_fs);
+ 	if (rc < 0)
+ 		goto out_free;
+diff -urNp linux-2.6.32.14/fs/exec.c linux-2.6.32.14/fs/exec.c
+--- linux-2.6.32.14/fs/exec.c	2010-05-28 20:16:44.454934408 -0400
++++ linux-2.6.32.14/fs/exec.c	2010-05-28 21:27:16.119217721 -0400
+@@ -56,12 +56,24 @@
+ #include <linux/fsnotify.h>
+ #include <linux/fs_struct.h>
+ #include <linux/pipe_fs_i.h>
++#include <linux/random.h>
++#include <linux/seq_file.h>
++
++#ifdef CONFIG_PAX_REFCOUNT
++#include <linux/kallsyms.h>
++#include <linux/kdebug.h>
++#endif
+ 
+ #include <asm/uaccess.h>
+ #include <asm/mmu_context.h>
+ #include <asm/tlb.h>
+ #include "internal.h"
+ 
++#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
++void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++EXPORT_SYMBOL(pax_set_initial_flags_func);
++#endif
++
+ int core_uses_pid;
+ char core_pattern[CORENAME_MAX_SIZE] = "core";
+ unsigned int core_pipe_limit;
+@@ -115,7 +127,7 @@ SYSCALL_DEFINE1(uselib, const char __use
+ 		goto out;
+ 
+ 	file = do_filp_open(AT_FDCWD, tmp,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_READ | MAY_EXEC | MAY_OPEN);
+ 	putname(tmp);
+ 	error = PTR_ERR(file);
+@@ -163,18 +175,10 @@ static struct page *get_arg_page(struct 
+ 		int write)
+ {
+ 	struct page *page;
+-	int ret;
+ 
+-#ifdef CONFIG_STACK_GROWSUP
+-	if (write) {
+-		ret = expand_stack_downwards(bprm->vma, pos);
+-		if (ret < 0)
+-			return NULL;
+-	}
+-#endif
+-	ret = get_user_pages(current, bprm->mm, pos,
+-			1, write, 1, &page, NULL);
+-	if (ret <= 0)
++	if (0 > expand_stack_downwards(bprm->vma, pos))
++		return NULL;
++	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
+ 		return NULL;
+ 
+ 	if (write) {
+@@ -246,6 +250,11 @@ static int __bprm_mm_init(struct linux_b
+ 	vma->vm_end = STACK_TOP_MAX;
+ 	vma->vm_start = vma->vm_end - PAGE_SIZE;
+ 	vma->vm_flags = VM_STACK_FLAGS;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++#endif
++
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 	err = insert_vm_struct(mm, vma);
+ 	if (err)
+@@ -254,6 +263,12 @@ static int __bprm_mm_init(struct linux_b
+ 	mm->stack_vm = mm->total_vm = 1;
+ 	up_write(&mm->mmap_sem);
+ 	bprm->p = vma->vm_end - sizeof(void *);
++
++#ifdef CONFIG_PAX_RANDUSTACK
++	if (randomize_va_space)
++		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
++#endif
++
+ 	return 0;
+ err:
+ 	up_write(&mm->mmap_sem);
+@@ -475,7 +490,7 @@ int copy_strings_kernel(int argc,char **
+ 	int r;
+ 	mm_segment_t oldfs = get_fs();
+ 	set_fs(KERNEL_DS);
+-	r = copy_strings(argc, (char __user * __user *)argv, bprm);
++	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
+ 	set_fs(oldfs);
+ 	return r;
+ }
+@@ -505,7 +520,8 @@ static int shift_arg_pages(struct vm_are
+ 	unsigned long new_end = old_end - shift;
+ 	struct mmu_gather *tlb;
+ 
+-	BUG_ON(new_start > new_end);
++	if (new_start >= new_end || new_start < mmap_min_addr)
++		return -EFAULT;
+ 
+ 	/*
+ 	 * ensure there are no vmas between where we want to go
+@@ -514,6 +530,10 @@ static int shift_arg_pages(struct vm_are
+ 	if (vma != find_vma(mm, new_start))
+ 		return -EFAULT;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	BUG_ON(pax_find_mirror_vma(vma));
++#endif
++
+ 	/*
+ 	 * cover the whole range: [new_start, old_end)
+ 	 */
+@@ -605,6 +625,14 @@ int setup_arg_pages(struct linux_binprm 
+ 	bprm->exec -= stack_shift;
+ 
+ 	down_write(&mm->mmap_sem);
++
++	/* Move stack pages down in memory. */
++	if (stack_shift) {
++		ret = shift_arg_pages(vma, stack_shift);
++		if (ret)
++			goto out_unlock;
++	}
++
+ 	vm_flags = VM_STACK_FLAGS;
+ 
+ 	/*
+@@ -618,19 +646,24 @@ int setup_arg_pages(struct linux_binprm 
+ 		vm_flags &= ~VM_EXEC;
+ 	vm_flags |= mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		vm_flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			vm_flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
+ 			vm_flags);
+ 	if (ret)
+ 		goto out_unlock;
+ 	BUG_ON(prev != vma);
+ 
+-	/* Move stack pages down in memory. */
+-	if (stack_shift) {
+-		ret = shift_arg_pages(vma, stack_shift);
+-		if (ret)
+-			goto out_unlock;
+-	}
+-
+ 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+ 	stack_size = vma->vm_end - vma->vm_start;
+ 	/*
+@@ -667,7 +700,7 @@ struct file *open_exec(const char *name)
+ 	int err;
+ 
+ 	file = do_filp_open(AT_FDCWD, name,
+-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
++				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
+ 				MAY_EXEC | MAY_OPEN);
+ 	if (IS_ERR(file))
+ 		goto out;
+@@ -704,7 +737,7 @@ int kernel_read(struct file *file, loff_
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	result = vfs_read(file, (void __user *)addr, count, &pos);
++	result = vfs_read(file, (__force void __user *)addr, count, &pos);
+ 	set_fs(old_fs);
+ 	return result;
+ }
+@@ -1110,7 +1143,7 @@ int check_unsafe_exec(struct linux_binpr
+ 	}
+ 	rcu_read_unlock();
+ 
+-	if (p->fs->users > n_fs) {
++	if (atomic_read(&p->fs->users) > n_fs) {
+ 		bprm->unsafe |= LSM_UNSAFE_SHARE;
+ 	} else {
+ 		res = -EAGAIN;
+@@ -1309,6 +1342,11 @@ int do_execve(char * filename,
+ 	char __user *__user *envp,
+ 	struct pt_regs * regs)
+ {
++#ifdef CONFIG_GRKERNSEC
++	struct file *old_exec_file;
++	struct acl_subject_label *old_acl;
++	struct rlimit old_rlim[RLIM_NLIMITS];
++#endif
+ 	struct linux_binprm *bprm;
+ 	struct file *file;
+ 	struct files_struct *displaced;
+@@ -1345,6 +1383,18 @@ int do_execve(char * filename,
+ 	bprm->filename = filename;
+ 	bprm->interp = filename;
+ 
++	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
++
++	if (gr_handle_nproc()) {
++		retval = -EAGAIN;
++		goto out_file;
++	}
++
++	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
++		retval = -EACCES;
++		goto out_file;
++	}
++
+ 	retval = bprm_mm_init(bprm);
+ 	if (retval)
+ 		goto out_file;
+@@ -1374,10 +1424,41 @@ int do_execve(char * filename,
+ 	if (retval < 0)
+ 		goto out;
+ 
++	if (!gr_tpe_allow(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_check_crash_exec(file)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
++
++	gr_handle_exec_args(bprm, argv);
++
++#ifdef CONFIG_GRKERNSEC
++	old_acl = current->acl;
++	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
++	old_exec_file = current->exec_file;
++	get_file(file);
++	current->exec_file = file;
++#endif
++
++	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
++				   bprm->unsafe & LSM_UNSAFE_SHARE);
++	if (retval < 0)
++		goto out_fail;
++
+ 	current->flags &= ~PF_KTHREAD;
+ 	retval = search_binary_handler(bprm,regs);
+ 	if (retval < 0)
+-		goto out;
++		goto out_fail;
++#ifdef CONFIG_GRKERNSEC
++	if (old_exec_file)
++		fput(old_exec_file);
++#endif
+ 
+ 	/* execve succeeded */
+ 	current->fs->in_exec = 0;
+@@ -1388,6 +1469,14 @@ int do_execve(char * filename,
+ 		put_files_struct(displaced);
+ 	return retval;
+ 
++out_fail:
++#ifdef CONFIG_GRKERNSEC
++	current->acl = old_acl;
++	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
++	fput(current->exec_file);
++	current->exec_file = old_exec_file;
++#endif
++
+ out:
+ 	if (bprm->mm)
+ 		mmput (bprm->mm);
+@@ -1551,6 +1640,169 @@ out:
+ 	return ispipe;
+ }
+ 
++int pax_check_flags(unsigned long *flags)
++{
++	int retval = 0;
++
++#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
++	if (*flags & MF_PAX_SEGMEXEC)
++	{
++		*flags &= ~MF_PAX_SEGMEXEC;
++		retval = -EINVAL;
++	}
++#endif
++
++	if ((*flags & MF_PAX_PAGEEXEC)
++
++#ifdef CONFIG_PAX_PAGEEXEC
++	    &&  (*flags & MF_PAX_SEGMEXEC)
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_PAGEEXEC;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_MPROTECT)
++
++#ifdef CONFIG_PAX_MPROTECT
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_MPROTECT;
++		retval = -EINVAL;
++	}
++
++	if ((*flags & MF_PAX_EMUTRAMP)
++
++#ifdef CONFIG_PAX_EMUTRAMP
++	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
++#endif
++
++	   )
++	{
++		*flags &= ~MF_PAX_EMUTRAMP;
++		retval = -EINVAL;
++	}
++
++	return retval;
++}
++
++EXPORT_SYMBOL(pax_check_flags);
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
++{
++	struct task_struct *tsk = current;
++	struct mm_struct *mm = current->mm;
++	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
++	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
++	char *path_exec = NULL;
++	char *path_fault = NULL;
++	unsigned long start = 0UL, end = 0UL, offset = 0UL;
++
++	if (buffer_exec && buffer_fault) {
++		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
++
++		down_read(&mm->mmap_sem);
++		vma = mm->mmap;
++		while (vma && (!vma_exec || !vma_fault)) {
++			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
++				vma_exec = vma;
++			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
++				vma_fault = vma;
++			vma = vma->vm_next;
++		}
++		if (vma_exec) {
++			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
++			if (IS_ERR(path_exec))
++				path_exec = "<path too long>";
++			else {
++				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
++				if (path_exec) {
++					*path_exec = 0;
++					path_exec = buffer_exec;
++				} else
++					path_exec = "<path too long>";
++			}
++		}
++		if (vma_fault) {
++			start = vma_fault->vm_start;
++			end = vma_fault->vm_end;
++			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
++			if (vma_fault->vm_file) {
++				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
++				if (IS_ERR(path_fault))
++					path_fault = "<path too long>";
++				else {
++					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
++					if (path_fault) {
++						*path_fault = 0;
++						path_fault = buffer_fault;
++					} else
++						path_fault = "<path too long>";
++				}
++			} else
++				path_fault = "<anonymous mapping>";
++		}
++		up_read(&mm->mmap_sem);
++	}
++	if (tsk->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
++	else
++		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
++	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
++			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
++			task_uid(tsk), task_euid(tsk), pc, sp);
++	free_page((unsigned long)buffer_exec);
++	free_page((unsigned long)buffer_fault);
++	pax_report_insns(pc, sp);
++	do_coredump(SIGKILL, SIGKILL, regs);
++}
++#endif
++
++#ifdef CONFIG_PAX_REFCOUNT
++void pax_report_refcount_overflow(struct pt_regs *regs)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
++	else
++		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
++				 current->comm, task_pid_nr(current), current_uid(), current_euid());
++	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
++	show_regs(regs);
++	force_sig_specific(SIGKILL, current);
++}
++#endif
++
++#ifdef CONFIG_PAX_USERCOPY
++void pax_report_leak_to_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++
++void pax_report_overflow_from_user(const void *ptr, unsigned long len)
++{
++	if (current->signal->curr_ip)
++		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
++			&current->signal->curr_ip, ptr, len);
++	else
++		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
++	dump_stack();
++	do_group_exit(SIGKILL);
++}
++#endif
++
+ static int zap_process(struct task_struct *start)
+ {
+ 	struct task_struct *t;
+@@ -1753,17 +2005,17 @@ static void wait_for_dump_helpers(struct
+ 	pipe = file->f_path.dentry->d_inode->i_pipe;
+ 
+ 	pipe_lock(pipe);
+-	pipe->readers++;
+-	pipe->writers--;
++	atomic_inc(&pipe->readers);
++	atomic_dec(&pipe->writers);
+ 
+-	while ((pipe->readers > 1) && (!signal_pending(current))) {
++	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
+ 		wake_up_interruptible_sync(&pipe->wait);
+ 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 		pipe_wait(pipe);
+ 	}
+ 
+-	pipe->readers--;
+-	pipe->writers++;
++	atomic_dec(&pipe->readers);
++	atomic_inc(&pipe->writers);
+ 	pipe_unlock(pipe);
+ 
+ }
+@@ -1834,6 +2086,10 @@ void do_coredump(long signr, int exit_co
+ 	 */
+ 	clear_thread_flag(TIF_SIGPENDING);
+ 
++	if (signr == SIGKILL || signr == SIGILL)
++		gr_handle_brute_attach(current);
++	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
++
+ 	/*
+ 	 * lock_kernel() because format_corename() is controlled by sysctl, which
+ 	 * uses lock_kernel()
+diff -urNp linux-2.6.32.14/fs/ext2/balloc.c linux-2.6.32.14/fs/ext2/balloc.c
+--- linux-2.6.32.14/fs/ext2/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext2/balloc.c	2010-05-28 21:27:16.139352882 -0400
+@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.14/fs/ext2/xattr.c linux-2.6.32.14/fs/ext2/xattr.c
+--- linux-2.6.32.14/fs/ext2/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext2/xattr.c	2010-05-28 21:27:16.139352882 -0400
+@@ -85,8 +85,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static int ext2_xattr_set2(struct inode *, struct buffer_head *,
+diff -urNp linux-2.6.32.14/fs/ext3/balloc.c linux-2.6.32.14/fs/ext3/balloc.c
+--- linux-2.6.32.14/fs/ext3/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext3/balloc.c	2010-05-28 21:27:16.139352882 -0400
+@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
+ 
+ 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+ 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
+-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
++	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
+ 		sbi->s_resuid != current_fsuid() &&
+ 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+ 		return 0;
+diff -urNp linux-2.6.32.14/fs/ext3/namei.c linux-2.6.32.14/fs/ext3/namei.c
+--- linux-2.6.32.14/fs/ext3/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext3/namei.c	2010-05-28 21:27:16.139352882 -0400
+@@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext3_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext3_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.14/fs/ext3/xattr.c linux-2.6.32.14/fs/ext3/xattr.c
+--- linux-2.6.32.14/fs/ext3/xattr.c	2010-04-29 17:49:38.429034237 -0400
++++ linux-2.6.32.14/fs/ext3/xattr.c	2010-05-28 21:27:16.139352882 -0400
+@@ -89,8 +89,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(f...) do {} while (0)
++# define ea_bdebug(f...) do {} while (0)
+ #endif
+ 
+ static void ext3_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.14/fs/ext4/balloc.c linux-2.6.32.14/fs/ext4/balloc.c
+--- linux-2.6.32.14/fs/ext4/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext4/balloc.c	2010-05-28 21:27:16.143235197 -0400
+@@ -573,7 +573,7 @@ int ext4_has_free_blocks(struct ext4_sb_
+ 	/* Hm, nope.  Are (enough) root reserved blocks available? */
+ 	if (sbi->s_resuid == current_fsuid() ||
+ 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
+-	    capable(CAP_SYS_RESOURCE)) {
++	    capable_nolog(CAP_SYS_RESOURCE)) {
+ 		if (free_blocks >= (nblocks + dirty_blocks))
+ 			return 1;
+ 	}
+diff -urNp linux-2.6.32.14/fs/ext4/ioctl.c linux-2.6.32.14/fs/ext4/ioctl.c
+--- linux-2.6.32.14/fs/ext4/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext4/ioctl.c	2010-05-28 21:27:16.143235197 -0400
+@@ -221,6 +221,9 @@ setversion_out:
+ 		struct file *donor_filp;
+ 		int err;
+ 
++		/* temporary workaround for bugs in here */
++		return -EOPNOTSUPP;
++
+ 		if (!(filp->f_mode & FMODE_READ) ||
+ 		    !(filp->f_mode & FMODE_WRITE))
+ 			return -EBADF;
+diff -urNp linux-2.6.32.14/fs/ext4/namei.c linux-2.6.32.14/fs/ext4/namei.c
+--- linux-2.6.32.14/fs/ext4/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext4/namei.c	2010-05-28 21:27:16.151243127 -0400
+@@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
+ 	char *data1 = (*bh)->b_data, *data2;
+ 	unsigned split, move, size;
+ 	struct ext4_dir_entry_2 *de = NULL, *de2;
+-	int	err = 0, i;
++	int	i, err = 0;
+ 
+ 	bh2 = ext4_append (handle, dir, &newblock, &err);
+ 	if (!(bh2)) {
+diff -urNp linux-2.6.32.14/fs/ext4/super.c linux-2.6.32.14/fs/ext4/super.c
+--- linux-2.6.32.14/fs/ext4/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext4/super.c	2010-05-28 21:27:16.155228523 -0400
+@@ -2276,7 +2276,7 @@ static void ext4_sb_release(struct kobje
+ }
+ 
+ 
+-static struct sysfs_ops ext4_attr_ops = {
++static const struct sysfs_ops ext4_attr_ops = {
+ 	.show	= ext4_attr_show,
+ 	.store	= ext4_attr_store,
+ };
+diff -urNp linux-2.6.32.14/fs/ext4/xattr.c linux-2.6.32.14/fs/ext4/xattr.c
+--- linux-2.6.32.14/fs/ext4/xattr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ext4/xattr.c	2010-05-28 21:27:16.155228523 -0400
+@@ -82,8 +82,8 @@
+ 		printk("\n"); \
+ 	} while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) do {} while (0)
++# define ea_bdebug(bh, f...) do {} while (0)
+ #endif
+ 
+ static void ext4_xattr_cache_insert(struct buffer_head *);
+diff -urNp linux-2.6.32.14/fs/fcntl.c linux-2.6.32.14/fs/fcntl.c
+--- linux-2.6.32.14/fs/fcntl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fcntl.c	2010-05-28 21:27:16.158915754 -0400
+@@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
+ 	switch (cmd) {
+ 	case F_DUPFD:
+ 	case F_DUPFD_CLOEXEC:
++		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
+ 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 			break;
+ 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
+@@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
+ 	ret = ((fown->euid == 0 ||
+ 		fown->euid == cred->suid || fown->euid == cred->uid ||
+ 		fown->uid  == cred->suid || fown->uid  == cred->uid) &&
+-	       !security_file_send_sigiotask(p, fown, sig));
++	       !security_file_send_sigiotask(p, fown, sig) &&
++	       !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
+ 	rcu_read_unlock();
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.14/fs/fifo.c linux-2.6.32.14/fs/fifo.c
+--- linux-2.6.32.14/fs/fifo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fifo.c	2010-05-28 21:27:16.158915754 -0400
+@@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &read_pipefifo_fops;
+ 		pipe->r_counter++;
+-		if (pipe->readers++ == 0)
++		if (atomic_inc_return(&pipe->readers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->writers) {
++		if (!atomic_read(&pipe->writers)) {
+ 			if ((filp->f_flags & O_NONBLOCK)) {
+ 				/* suppress POLLHUP until we have
+ 				 * seen a writer */
+@@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
+ 	 *  errno=ENXIO when there is no process reading the FIFO.
+ 	 */
+ 		ret = -ENXIO;
+-		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
++		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
+ 			goto err;
+ 
+ 		filp->f_op = &write_pipefifo_fops;
+ 		pipe->w_counter++;
+-		if (!pipe->writers++)
++		if (atomic_inc_return(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			wait_for_partner(inode, &pipe->r_counter);
+ 			if (signal_pending(current))
+ 				goto err_wr;
+@@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
+ 	 */
+ 		filp->f_op = &rdwr_pipefifo_fops;
+ 
+-		pipe->readers++;
+-		pipe->writers++;
++		atomic_inc(&pipe->readers);
++		atomic_inc(&pipe->writers);
+ 		pipe->r_counter++;
+ 		pipe->w_counter++;
+-		if (pipe->readers == 1 || pipe->writers == 1)
++		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
+ 			wake_up_partner(inode);
+ 		break;
+ 
+@@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
+ 	return 0;
+ 
+ err_rd:
+-	if (!--pipe->readers)
++	if (atomic_dec_and_test(&pipe->readers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err_wr:
+-	if (!--pipe->writers)
++	if (atomic_dec_and_test(&pipe->writers))
+ 		wake_up_interruptible(&pipe->wait);
+ 	ret = -ERESTARTSYS;
+ 	goto err;
+ 
+ err:
+-	if (!pipe->readers && !pipe->writers)
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
+ 		free_pipe_info(inode);
+ 
+ err_nocleanup:
+diff -urNp linux-2.6.32.14/fs/file.c linux-2.6.32.14/fs/file.c
+--- linux-2.6.32.14/fs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/file.c	2010-05-28 21:27:16.158915754 -0400
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/file.h>
++#include <linux/security.h>
+ #include <linux/fdtable.h>
+ #include <linux/bitops.h>
+ #include <linux/interrupt.h>
+@@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
+ 	 * N.B. For clone tasks sharing a files structure, this test
+ 	 * will limit the total number of files that can be opened.
+ 	 */
++
++	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
+ 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EMFILE;
+ 
+diff -urNp linux-2.6.32.14/fs/fs_struct.c linux-2.6.32.14/fs/fs_struct.c
+--- linux-2.6.32.14/fs/fs_struct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fs_struct.c	2010-05-28 21:27:16.158915754 -0400
+@@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
+ 	struct task_struct *g, *p;
+ 	struct fs_struct *fs;
+ 	int count = 0;
++	unsigned long flags;
+ 
+ 	read_lock(&tasklist_lock);
+ 	do_each_thread(g, p) {
+ 		task_lock(p);
++		gr_fs_write_lock_irqsave(p, flags);
+ 		fs = p->fs;
+ 		if (fs) {
+ 			write_lock(&fs->lock);
+@@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
+ 			}
+ 			write_unlock(&fs->lock);
+ 		}
++		gr_fs_write_unlock_irqrestore(p, flags);
+ 		task_unlock(p);
+ 	} while_each_thread(g, p);
+ 	read_unlock(&tasklist_lock);
+@@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
+ void exit_fs(struct task_struct *tsk)
+ {
+ 	struct fs_struct *fs = tsk->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+ 		task_lock(tsk);
++		gr_fs_write_lock_irqsave(tsk, flags);
+ 		write_lock(&fs->lock);
+ 		tsk->fs = NULL;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(tsk, flags);
+ 		task_unlock(tsk);
+ 		if (kill)
+ 			free_fs_struct(fs);
+@@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct 
+ 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
+ 	/* We don't need to lock fs - think why ;-) */
+ 	if (fs) {
+-		fs->users = 1;
++		atomic_set(&fs->users, 1);
+ 		fs->in_exec = 0;
+ 		rwlock_init(&fs->lock);
+ 		fs->umask = old->umask;
+@@ -121,15 +127,18 @@ int unshare_fs_struct(void)
+ 	struct fs_struct *fs = current->fs;
+ 	struct fs_struct *new_fs = copy_fs_struct(fs);
+ 	int kill;
++	unsigned long flags;
+ 
+ 	if (!new_fs)
+ 		return -ENOMEM;
+ 
+ 	task_lock(current);
++	gr_fs_write_lock_irqsave(current, flags);
+ 	write_lock(&fs->lock);
+-	kill = !--fs->users;
++	kill = !atomic_dec_return(&fs->users);
+ 	current->fs = new_fs;
+ 	write_unlock(&fs->lock);
++	gr_fs_write_unlock_irqrestore(current, flags);
+ 	task_unlock(current);
+ 
+ 	if (kill)
+@@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
+ 
+ /* to be mentioned only in INIT_TASK */
+ struct fs_struct init_fs = {
+-	.users		= 1,
++	.users		= ATOMIC_INIT(1),
+ 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
+ 	.umask		= 0022,
+ };
+@@ -155,6 +164,7 @@ struct fs_struct init_fs = {
+ void daemonize_fs_struct(void)
+ {
+ 	struct fs_struct *fs = current->fs;
++	unsigned long flags;
+ 
+ 	if (fs) {
+ 		int kill;
+@@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
+ 		task_lock(current);
+ 
+ 		write_lock(&init_fs.lock);
+-		init_fs.users++;
++		atomic_inc(&init_fs.users);
+ 		write_unlock(&init_fs.lock);
+ 
++		gr_fs_write_lock_irqsave(current, flags);
+ 		write_lock(&fs->lock);
+ 		current->fs = &init_fs;
+-		kill = !--fs->users;
++		kill = !atomic_dec_return(&fs->users);
+ 		write_unlock(&fs->lock);
++		gr_fs_write_unlock_irqrestore(current, flags);
+ 
+ 		task_unlock(current);
+ 		if (kill)
+diff -urNp linux-2.6.32.14/fs/fuse/control.c linux-2.6.32.14/fs/fuse/control.c
+--- linux-2.6.32.14/fs/fuse/control.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fuse/control.c	2010-05-28 21:27:16.158915754 -0400
+@@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
+ 
+ static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
+ {
+-	struct tree_descr empty_descr = {""};
++	struct tree_descr empty_descr = {"", NULL, 0};
+ 	struct fuse_conn *fc;
+ 	int err;
+ 
+diff -urNp linux-2.6.32.14/fs/fuse/cuse.c linux-2.6.32.14/fs/fuse/cuse.c
+--- linux-2.6.32.14/fs/fuse/cuse.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fuse/cuse.c	2010-05-28 21:27:16.158915754 -0400
+@@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
+ 	return rc;
+ }
+ 
+-static struct file_operations cuse_channel_fops; /* initialized during init */
+-
++static const struct file_operations cuse_channel_fops = { /* initialized during init */
++	.owner		= THIS_MODULE,
++	.llseek		= no_llseek,
++	.read		= do_sync_read,
++	.aio_read	= fuse_dev_read,
++	.write		= do_sync_write,
++	.aio_write	= fuse_dev_write,
++	.poll		= fuse_dev_poll,
++	.open		= cuse_channel_open,
++	.release	= cuse_channel_release,
++	.fasync		= fuse_dev_fasync,
++};
+ 
+ /**************************************************************************
+  * Misc stuff and module initializatiion
+@@ -575,12 +585,6 @@ static int __init cuse_init(void)
+ 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
+ 		INIT_LIST_HEAD(&cuse_conntbl[i]);
+ 
+-	/* inherit and extend fuse_dev_operations */
+-	cuse_channel_fops		= fuse_dev_operations;
+-	cuse_channel_fops.owner		= THIS_MODULE;
+-	cuse_channel_fops.open		= cuse_channel_open;
+-	cuse_channel_fops.release	= cuse_channel_release;
+-
+ 	cuse_class = class_create(THIS_MODULE, "cuse");
+ 	if (IS_ERR(cuse_class))
+ 		return PTR_ERR(cuse_class);
+diff -urNp linux-2.6.32.14/fs/fuse/dev.c linux-2.6.32.14/fs/fuse/dev.c
+--- linux-2.6.32.14/fs/fuse/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fuse/dev.c	2010-05-28 21:27:16.158915754 -0400
+@@ -745,7 +745,7 @@ __releases(&fc->lock)
+  * request_end().  Otherwise add it to the processing list, and set
+  * the 'sent' flag.
+  */
+-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+ 			      unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -827,6 +827,7 @@ static ssize_t fuse_dev_read(struct kioc
+ 	spin_unlock(&fc->lock);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_read);
+ 
+ static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
+ 			    struct fuse_copy_state *cs)
+@@ -885,7 +886,7 @@ static int fuse_notify_inval_entry(struc
+ {
+ 	struct fuse_notify_inval_entry_out outarg;
+ 	int err = -EINVAL;
+-	char buf[FUSE_NAME_MAX+1];
++	char *buf = NULL;
+ 	struct qstr name;
+ 
+ 	if (size < sizeof(outarg))
+@@ -899,6 +900,11 @@ static int fuse_notify_inval_entry(struc
+ 	if (outarg.namelen > FUSE_NAME_MAX)
+ 		goto err;
+ 
++	err = -ENOMEM;
++	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
++	if (!buf)
++		goto err;
++
+ 	name.name = buf;
+ 	name.len = outarg.namelen;
+ 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
+@@ -910,17 +916,15 @@ static int fuse_notify_inval_entry(struc
+ 
+ 	down_read(&fc->killsb);
+ 	err = -ENOENT;
+-	if (!fc->sb)
+-		goto err_unlock;
+-
+-	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+-
+-err_unlock:
++	if (fc->sb)
++		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
+ 	up_read(&fc->killsb);
++	kfree(buf);
+ 	return err;
+ 
+ err:
+ 	fuse_copy_finish(cs);
++	kfree(buf);
+ 	return err;
+ }
+ 
+@@ -987,7 +991,7 @@ static int copy_out_args(struct fuse_cop
+  * it from the list and copy the rest of the buffer to the request.
+  * The request is finished by calling request_end()
+  */
+-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
+ 			       unsigned long nr_segs, loff_t pos)
+ {
+ 	int err;
+@@ -1083,8 +1087,9 @@ static ssize_t fuse_dev_write(struct kio
+ 	fuse_copy_finish(&cs);
+ 	return err;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_write);
+ 
+-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
++unsigned fuse_dev_poll(struct file *file, poll_table *wait)
+ {
+ 	unsigned mask = POLLOUT | POLLWRNORM;
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+@@ -1102,6 +1107,7 @@ static unsigned fuse_dev_poll(struct fil
+ 
+ 	return mask;
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_poll);
+ 
+ /*
+  * Abort all requests on the given list (pending or processing)
+@@ -1210,7 +1216,7 @@ int fuse_dev_release(struct inode *inode
+ }
+ EXPORT_SYMBOL_GPL(fuse_dev_release);
+ 
+-static int fuse_dev_fasync(int fd, struct file *file, int on)
++int fuse_dev_fasync(int fd, struct file *file, int on)
+ {
+ 	struct fuse_conn *fc = fuse_get_conn(file);
+ 	if (!fc)
+@@ -1219,6 +1225,7 @@ static int fuse_dev_fasync(int fd, struc
+ 	/* No locking - fasync_helper does its own locking */
+ 	return fasync_helper(fd, file, on, &fc->fasync);
+ }
++EXPORT_SYMBOL_GPL(fuse_dev_fasync);
+ 
+ const struct file_operations fuse_dev_operations = {
+ 	.owner		= THIS_MODULE,
+diff -urNp linux-2.6.32.14/fs/fuse/dir.c linux-2.6.32.14/fs/fuse/dir.c
+--- linux-2.6.32.14/fs/fuse/dir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fuse/dir.c	2010-05-28 21:27:16.167243337 -0400
+@@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
+ 	return link;
+ }
+ 
+-static void free_link(char *link)
++static void free_link(const char *link)
+ {
+ 	if (!IS_ERR(link))
+ 		free_page((unsigned long) link);
+diff -urNp linux-2.6.32.14/fs/fuse/fuse_i.h linux-2.6.32.14/fs/fuse/fuse_i.h
+--- linux-2.6.32.14/fs/fuse/fuse_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/fuse/fuse_i.h	2010-05-28 21:27:16.167243337 -0400
+@@ -521,6 +521,16 @@ extern const struct file_operations fuse
+ 
+ extern const struct dentry_operations fuse_dentry_operations;
+ 
++extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
++			      unsigned long nr_segs, loff_t pos);
++
++extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
++			       unsigned long nr_segs, loff_t pos);
++
++extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
++
++extern int fuse_dev_fasync(int fd, struct file *file, int on);
++
+ /**
+  * Inode to nodeid comparison.
+  */
+diff -urNp linux-2.6.32.14/fs/gfs2/sys.c linux-2.6.32.14/fs/gfs2/sys.c
+--- linux-2.6.32.14/fs/gfs2/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/gfs2/sys.c	2010-05-28 21:27:16.167243337 -0400
+@@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
+ 	return a->store ? a->store(sdp, buf, len) : len;
+ }
+ 
+-static struct sysfs_ops gfs2_attr_ops = {
++static const struct sysfs_ops gfs2_attr_ops = {
+ 	.show  = gfs2_attr_show,
+ 	.store = gfs2_attr_store,
+ };
+@@ -584,7 +584,7 @@ static int gfs2_uevent(struct kset *kset
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops gfs2_uevent_ops = {
++static const struct kset_uevent_ops gfs2_uevent_ops = {
+ 	.uevent = gfs2_uevent,
+ };
+ 
+diff -urNp linux-2.6.32.14/fs/hfs/inode.c linux-2.6.32.14/fs/hfs/inode.c
+--- linux-2.6.32.14/fs/hfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/hfs/inode.c	2010-05-28 21:27:16.171892577 -0400
+@@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
+ 
+ 	if (S_ISDIR(main_inode->i_mode)) {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_dir));
+ 		if (rec.type != HFS_CDR_DIR ||
+@@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
+ 				sizeof(struct hfs_cat_file));
+ 	} else {
+ 		if (fd.entrylength < sizeof(struct hfs_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
+ 			   sizeof(struct hfs_cat_file));
+ 		if (rec.type != HFS_CDR_FIL ||
+diff -urNp linux-2.6.32.14/fs/hfsplus/inode.c linux-2.6.32.14/fs/hfsplus/inode.c
+--- linux-2.6.32.14/fs/hfsplus/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/hfsplus/inode.c	2010-05-28 21:27:16.171892577 -0400
+@@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		hfsplus_get_perms(inode, &folder->permissions, 1);
+@@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode 
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 
+@@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_folder *folder = &entry.folder;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_folder));
+ 		/* simple node checks? */
+@@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
+ 		struct hfsplus_cat_file *file = &entry.file;
+ 
+ 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
+-			/* panic? */;
++			{/* panic? */}
+ 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
+ 					sizeof(struct hfsplus_cat_file));
+ 		hfsplus_inode_write_fork(inode, &file->data_fork);
+diff -urNp linux-2.6.32.14/fs/hugetlbfs/inode.c linux-2.6.32.14/fs/hugetlbfs/inode.c
+--- linux-2.6.32.14/fs/hugetlbfs/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/hugetlbfs/inode.c	2010-05-28 21:27:16.171892577 -0400
+@@ -909,7 +909,7 @@ static struct file_system_type hugetlbfs
+ 	.kill_sb	= kill_litter_super,
+ };
+ 
+-static struct vfsmount *hugetlbfs_vfsmount;
++struct vfsmount *hugetlbfs_vfsmount;
+ 
+ static int can_do_hugetlb_shm(void)
+ {
+diff -urNp linux-2.6.32.14/fs/ioctl.c linux-2.6.32.14/fs/ioctl.c
+--- linux-2.6.32.14/fs/ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ioctl.c	2010-05-28 21:27:16.175116356 -0400
+@@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
+ 			    u64 phys, u64 len, u32 flags)
+ {
+ 	struct fiemap_extent extent;
+-	struct fiemap_extent *dest = fieinfo->fi_extents_start;
++	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+ 
+ 	/* only count the extents */
+ 	if (fieinfo->fi_extents_max == 0) {
+@@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
+ 
+ 	fieinfo.fi_flags = fiemap.fm_flags;
+ 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
+-	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
++	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
+ 
+ 	if (fiemap.fm_extent_count != 0 &&
+ 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
+@@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
+ 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
+ 	fiemap.fm_flags = fieinfo.fi_flags;
+ 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
+-	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
++	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
+ 		error = -EFAULT;
+ 
+ 	return error;
+diff -urNp linux-2.6.32.14/fs/jffs2/debug.h linux-2.6.32.14/fs/jffs2/debug.h
+--- linux-2.6.32.14/fs/jffs2/debug.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/jffs2/debug.h	2010-05-28 21:27:16.175116356 -0400
+@@ -52,13 +52,13 @@
+ #if CONFIG_JFFS2_FS_DEBUG > 0
+ #define D1(x) x
+ #else
+-#define D1(x)
++#define D1(x) do {} while (0);
+ #endif
+ 
+ #if CONFIG_JFFS2_FS_DEBUG > 1
+ #define D2(x) x
+ #else
+-#define D2(x)
++#define D2(x) do {} while (0);
+ #endif
+ 
+ /* The prefixes of JFFS2 messages */
+@@ -114,73 +114,73 @@
+ #ifdef JFFS2_DBG_READINODE_MESSAGES
+ #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode(fmt, ...)
++#define dbg_readinode(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_READINODE2_MESSAGES
+ #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_readinode2(fmt, ...)
++#define dbg_readinode2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Fragtree build debugging messages */
+ #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
+ #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree(fmt, ...)
++#define dbg_fragtree(fmt, ...)	do {} while (0)
+ #endif
+ #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
+ #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fragtree2(fmt, ...)
++#define dbg_fragtree2(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Directory entry list manilulation debugging messages */
+ #ifdef JFFS2_DBG_DENTLIST_MESSAGES
+ #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_dentlist(fmt, ...)
++#define dbg_dentlist(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Print the messages about manipulating node_refs */
+ #ifdef JFFS2_DBG_NODEREF_MESSAGES
+ #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_noderef(fmt, ...)
++#define dbg_noderef(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Manipulations with the list of inodes (JFFS2 inocache) */
+ #ifdef JFFS2_DBG_INOCACHE_MESSAGES
+ #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_inocache(fmt, ...)
++#define dbg_inocache(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Summary debugging messages */
+ #ifdef JFFS2_DBG_SUMMARY_MESSAGES
+ #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_summary(fmt, ...)
++#define dbg_summary(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* File system build messages */
+ #ifdef JFFS2_DBG_FSBUILD_MESSAGES
+ #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_fsbuild(fmt, ...)
++#define dbg_fsbuild(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the object allocations */
+ #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
+ #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_memalloc(fmt, ...)
++#define dbg_memalloc(fmt, ...)	do {} while (0)
+ #endif
+ 
+ /* Watch the XATTR subsystem */
+ #ifdef JFFS2_DBG_XATTR_MESSAGES
+ #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
+ #else
+-#define dbg_xattr(fmt, ...)
++#define dbg_xattr(fmt, ...)	do {} while (0)
+ #endif 
+ 
+ /* "Sanity" checks */
+diff -urNp linux-2.6.32.14/fs/jffs2/erase.c linux-2.6.32.14/fs/jffs2/erase.c
+--- linux-2.6.32.14/fs/jffs2/erase.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/jffs2/erase.c	2010-05-28 21:27:16.175116356 -0400
+@@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
+ 		struct jffs2_unknown_node marker = {
+ 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-			.totlen =	cpu_to_je32(c->cleanmarker_size)
++			.totlen =	cpu_to_je32(c->cleanmarker_size),
++			.hdr_crc =	cpu_to_je32(0)
+ 		};
+ 
+ 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
+diff -urNp linux-2.6.32.14/fs/jffs2/summary.h linux-2.6.32.14/fs/jffs2/summary.h
+--- linux-2.6.32.14/fs/jffs2/summary.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/jffs2/summary.h	2010-05-28 21:27:16.175116356 -0400
+@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
+ 
+ #define jffs2_sum_active() (0)
+ #define jffs2_sum_init(a) (0)
+-#define jffs2_sum_exit(a)
+-#define jffs2_sum_disable_collecting(a)
++#define jffs2_sum_exit(a) do {} while (0)
++#define jffs2_sum_disable_collecting(a) do {} while (0)
+ #define jffs2_sum_is_disabled(a) (0)
+-#define jffs2_sum_reset_collected(a)
++#define jffs2_sum_reset_collected(a) do {} while (0)
+ #define jffs2_sum_add_kvec(a,b,c,d) (0)
+-#define jffs2_sum_move_collected(a,b)
++#define jffs2_sum_move_collected(a,b) do {} while (0)
+ #define jffs2_sum_write_sumnode(a) (0)
+-#define jffs2_sum_add_padding_mem(a,b)
+-#define jffs2_sum_add_inode_mem(a,b,c)
+-#define jffs2_sum_add_dirent_mem(a,b,c)
+-#define jffs2_sum_add_xattr_mem(a,b,c)
+-#define jffs2_sum_add_xref_mem(a,b,c)
++#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
++#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
++#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
+ #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
+ 
+ #endif /* CONFIG_JFFS2_SUMMARY */
+diff -urNp linux-2.6.32.14/fs/jffs2/wbuf.c linux-2.6.32.14/fs/jffs2/wbuf.c
+--- linux-2.6.32.14/fs/jffs2/wbuf.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/jffs2/wbuf.c	2010-05-28 21:27:16.175116356 -0400
+@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
+ {
+ 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
+ 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
+-	.totlen = constant_cpu_to_je32(8)
++	.totlen = constant_cpu_to_je32(8),
++	.hdr_crc = constant_cpu_to_je32(0)
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.14/fs/lockd/svc.c linux-2.6.32.14/fs/lockd/svc.c
+--- linux-2.6.32.14/fs/lockd/svc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/lockd/svc.c	2010-05-28 21:27:16.175116356 -0400
+@@ -43,7 +43,7 @@
+ 
+ static struct svc_program	nlmsvc_program;
+ 
+-struct nlmsvc_binding *		nlmsvc_ops;
++const struct nlmsvc_binding *	nlmsvc_ops;
+ EXPORT_SYMBOL_GPL(nlmsvc_ops);
+ 
+ static DEFINE_MUTEX(nlmsvc_mutex);
+diff -urNp linux-2.6.32.14/fs/locks.c linux-2.6.32.14/fs/locks.c
+--- linux-2.6.32.14/fs/locks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/locks.c	2010-05-28 21:27:16.191151426 -0400
+@@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
+ 		return;
+ 
+ 	if (filp->f_op && filp->f_op->flock) {
+-		struct file_lock fl = {
++		struct file_lock flock = {
+ 			.fl_pid = current->tgid,
+ 			.fl_file = filp,
+ 			.fl_flags = FL_FLOCK,
+ 			.fl_type = F_UNLCK,
+ 			.fl_end = OFFSET_MAX,
+ 		};
+-		filp->f_op->flock(filp, F_SETLKW, &fl);
+-		if (fl.fl_ops && fl.fl_ops->fl_release_private)
+-			fl.fl_ops->fl_release_private(&fl);
++		filp->f_op->flock(filp, F_SETLKW, &flock);
++		if (flock.fl_ops && flock.fl_ops->fl_release_private)
++			flock.fl_ops->fl_release_private(&flock);
+ 	}
+ 
+ 	lock_kernel();
+diff -urNp linux-2.6.32.14/fs/namei.c linux-2.6.32.14/fs/namei.c
+--- linux-2.6.32.14/fs/namei.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/namei.c	2010-05-28 21:27:16.199231859 -0400
+@@ -638,7 +638,7 @@ static __always_inline int __do_follow_l
+ 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+ 	error = PTR_ERR(cookie);
+ 	if (!IS_ERR(cookie)) {
+-		char *s = nd_get_link(nd);
++		const char *s = nd_get_link(nd);
+ 		error = 0;
+ 		if (s)
+ 			error = __vfs_follow_link(nd, s);
+@@ -669,6 +669,13 @@ static inline int do_follow_link(struct 
+ 	err = security_inode_follow_link(path->dentry, nd);
+ 	if (err)
+ 		goto loop;
++
++	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
++				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
++		err = -EACCES;
++		goto loop;
++	}
++
+ 	current->link_count++;
+ 	current->total_link_count++;
+ 	nd->depth++;
+@@ -1016,11 +1023,18 @@ return_reval:
+ 				break;
+ 		}
+ return_base:
++		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
++			path_put(&nd->path);
++			return -ENOENT;
++		}
+ 		return 0;
+ out_dput:
+ 		path_put_conditional(&next, nd);
+ 		break;
+ 	}
++	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
++		err = -ENOENT;
++
+ 	path_put(&nd->path);
+ return_err:
+ 	return err;
+@@ -1621,12 +1635,19 @@ static int __open_namei_create(struct na
+ 	int error;
+ 	struct dentry *dir = nd->path.dentry;
+ 
++	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
++		error = -EACCES;
++		goto out_unlock;
++	}
++
+ 	if (!IS_POSIXACL(dir->d_inode))
+ 		mode &= ~current_umask();
+ 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
+ 	if (error)
+ 		goto out_unlock;
+ 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
++	if (!error)
++		gr_handle_create(path->dentry, nd->path.mnt);
+ out_unlock:
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	dput(nd->path.dentry);
+@@ -1709,6 +1730,22 @@ struct file *do_filp_open(int dfd, const
+ 					 &nd, flag);
+ 		if (error)
+ 			return ERR_PTR(error);
++
++		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
++			error = -EPERM;
++			goto exit;
++		}
++
++		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
++			error = -EACCES;
++			goto exit;
++		}
++
+ 		goto ok;
+ 	}
+ 
+@@ -1795,6 +1832,24 @@ do_last:
+ 	/*
+ 	 * It already exists.
+ 	 */
++
++	if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_rawio(path.dentry->d_inode)) {
++		error = -EPERM;
++		goto exit_mutex_unlock;
++	}
++	if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++	if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
++		error = -EACCES;
++		goto exit_mutex_unlock;
++	}
++
+ 	mutex_unlock(&dir->d_inode->i_mutex);
+ 	audit_inode(pathname, path.dentry);
+ 
+@@ -1887,6 +1942,13 @@ do_link:
+ 	error = security_inode_follow_link(path.dentry, &nd);
+ 	if (error)
+ 		goto exit_dput;
++
++	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
++				  path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto exit_dput;
++	}
++
+ 	error = __do_follow_link(&path, &nd);
+ 	if (error) {
+ 		/* Does someone understand code flow here? Or it is only
+@@ -2061,6 +2123,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	error = may_mknod(mode);
+ 	if (error)
+ 		goto out_dput;
++
++	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
++		error = -EPERM;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2081,6 +2154,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+ 	}
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2134,6 +2210,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
+ 		mode &= ~current_umask();
+ 	error = mnt_want_write(nd.path.mnt);
+@@ -2145,6 +2226,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+ 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
++
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
++
+ out_dput:
+ 	dput(dentry);
+ out_unlock:
+@@ -2226,6 +2311,8 @@ static long do_rmdir(int dfd, const char
+ 	char * name;
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2250,6 +2337,19 @@ static long do_rmdir(int dfd, const char
+ 	error = PTR_ERR(dentry);
+ 	if (IS_ERR(dentry))
+ 		goto exit2;
++
++	if (dentry->d_inode != NULL) {
++		if (dentry->d_inode->i_nlink <= 1) {
++			saved_ino = dentry->d_inode->i_ino;
++			saved_dev = dentry->d_inode->i_sb->s_dev;
++		}
++
++		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
++			error = -EACCES;
++			goto exit3;
++		}
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto exit3;
+@@ -2257,6 +2357,8 @@ static long do_rmdir(int dfd, const char
+ 	if (error)
+ 		goto exit4;
+ 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
++	if (!error && (saved_dev || saved_ino))
++		gr_handle_delete(saved_ino, saved_dev);
+ exit4:
+ 	mnt_drop_write(nd.path.mnt);
+ exit3:
+@@ -2318,6 +2420,8 @@ static long do_unlinkat(int dfd, const c
+ 	struct dentry *dentry;
+ 	struct nameidata nd;
+ 	struct inode *inode = NULL;
++	ino_t saved_ino = 0;
++	dev_t saved_dev = 0;
+ 
+ 	error = user_path_parent(dfd, pathname, &nd, &name);
+ 	if (error)
+@@ -2337,8 +2441,19 @@ static long do_unlinkat(int dfd, const c
+ 		if (nd.last.name[nd.last.len])
+ 			goto slashes;
+ 		inode = dentry->d_inode;
+-		if (inode)
++		if (inode) {
++			if (inode->i_nlink <= 1) {
++				saved_ino = inode->i_ino;
++				saved_dev = inode->i_sb->s_dev;
++			}
++
+ 			atomic_inc(&inode->i_count);
++
++			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
++				error = -EACCES;
++				goto exit2;
++			}
++		}
+ 		error = mnt_want_write(nd.path.mnt);
+ 		if (error)
+ 			goto exit2;
+@@ -2346,6 +2461,8 @@ static long do_unlinkat(int dfd, const c
+ 		if (error)
+ 			goto exit3;
+ 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
++		if (!error && (saved_ino || saved_dev))
++			gr_handle_delete(saved_ino, saved_dev);
+ exit3:
+ 		mnt_drop_write(nd.path.mnt);
+ 	exit2:
+@@ -2424,6 +2541,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (IS_ERR(dentry))
+ 		goto out_unlock;
+ 
++	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2431,6 +2553,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
++	if (!error)
++		gr_handle_create(dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2524,6 +2648,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	error = PTR_ERR(new_dentry);
+ 	if (IS_ERR(new_dentry))
+ 		goto out_unlock;
++
++	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
++			       old_path.dentry->d_inode,
++			       old_path.dentry->d_inode->i_mode, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
++	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
++				old_path.dentry, old_path.mnt, to)) {
++		error = -EACCES;
++		goto out_dput;
++	}
++
+ 	error = mnt_want_write(nd.path.mnt);
+ 	if (error)
+ 		goto out_dput;
+@@ -2531,6 +2669,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+ 	if (error)
+ 		goto out_drop_write;
+ 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
++	if (!error)
++		gr_handle_create(new_dentry, nd.path.mnt);
+ out_drop_write:
+ 	mnt_drop_write(nd.path.mnt);
+ out_dput:
+@@ -2764,6 +2904,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 	if (new_dentry == trap)
+ 		goto exit5;
+ 
++	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
++				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
++				     to);
++	if (error)
++		goto exit5;
++
+ 	error = mnt_want_write(oldnd.path.mnt);
+ 	if (error)
+ 		goto exit5;
+@@ -2773,6 +2919,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 		goto exit6;
+ 	error = vfs_rename(old_dir->d_inode, old_dentry,
+ 				   new_dir->d_inode, new_dentry);
++	if (!error)
++		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
++				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
+ exit6:
+ 	mnt_drop_write(oldnd.path.mnt);
+ exit5:
+diff -urNp linux-2.6.32.14/fs/namespace.c linux-2.6.32.14/fs/namespace.c
+--- linux-2.6.32.14/fs/namespace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/namespace.c	2010-05-28 21:27:16.199231859 -0400
+@@ -1083,6 +1083,9 @@ static int do_umount(struct vfsmount *mn
+ 		if (!(sb->s_flags & MS_RDONLY))
+ 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
+ 		up_write(&sb->s_umount);
++
++		gr_log_remount(mnt->mnt_devname, retval);
++
+ 		return retval;
+ 	}
+ 
+@@ -1104,6 +1107,9 @@ static int do_umount(struct vfsmount *mn
+ 		security_sb_umount_busy(mnt);
+ 	up_write(&namespace_sem);
+ 	release_mounts(&umount_list);
++
++	gr_log_unmount(mnt->mnt_devname, retval);
++
+ 	return retval;
+ }
+ 
+@@ -1955,6 +1961,16 @@ long do_mount(char *dev_name, char *dir_
+ 	if (retval)
+ 		goto dput_out;
+ 
++	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
++	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
++		retval = -EPERM;
++		goto dput_out;
++	}
++
+ 	if (flags & MS_REMOUNT)
+ 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
+ 				    data_page);
+@@ -1969,6 +1985,9 @@ long do_mount(char *dev_name, char *dir_
+ 				      dev_name, data_page);
+ dput_out:
+ 	path_put(&path);
++
++	gr_log_mount(dev_name, dir_name, retval);
++
+ 	return retval;
+ }
+ 
+@@ -2175,6 +2194,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
+ 		goto out1;
+ 	}
+ 
++	if (gr_handle_chroot_pivot()) {
++		error = -EPERM;
++		path_put(&old);
++		goto out1;
++	}
++
+ 	read_lock(&current->fs->lock);
+ 	root = current->fs->root;
+ 	path_get(&current->fs->root);
+diff -urNp linux-2.6.32.14/fs/nfs/inode.c linux-2.6.32.14/fs/nfs/inode.c
+--- linux-2.6.32.14/fs/nfs/inode.c	2010-04-04 20:41:50.045778117 -0400
++++ linux-2.6.32.14/fs/nfs/inode.c	2010-05-28 21:27:16.199231859 -0400
+@@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
+ 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
+ }
+ 
+-static atomic_long_t nfs_attr_generation_counter;
++static atomic_long_unchecked_t nfs_attr_generation_counter;
+ 
+ static unsigned long nfs_read_attr_generation_counter(void)
+ {
+-	return atomic_long_read(&nfs_attr_generation_counter);
++	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ unsigned long nfs_inc_attr_generation_counter(void)
+ {
+-	return atomic_long_inc_return(&nfs_attr_generation_counter);
++	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
+ }
+ 
+ void nfs_fattr_init(struct nfs_fattr *fattr)
+diff -urNp linux-2.6.32.14/fs/nfs/nfs4proc.c linux-2.6.32.14/fs/nfs/nfs4proc.c
+--- linux-2.6.32.14/fs/nfs/nfs4proc.c	2010-04-29 17:49:38.445067399 -0400
++++ linux-2.6.32.14/fs/nfs/nfs4proc.c	2010-05-28 21:27:16.210892100 -0400
+@@ -1131,7 +1131,7 @@ static int _nfs4_do_open_reclaim(struct 
+ static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_do_open_reclaim(ctx, state);
+@@ -1173,7 +1173,7 @@ static int _nfs4_open_delegation_recall(
+ 
+ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+ 	int err;
+ 	do {
+@@ -1493,7 +1493,7 @@ static int _nfs4_open_expired(struct nfs
+ static inline int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -1593,7 +1593,7 @@ out_err:
+ 
+ static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	struct nfs4_state *res;
+ 	int status;
+ 
+@@ -1684,7 +1684,7 @@ static int nfs4_do_setattr(struct inode 
+ 			   struct nfs4_state *state)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2050,7 +2050,7 @@ static int _nfs4_server_capabilities(str
+ 
+ int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2084,7 +2084,7 @@ static int _nfs4_lookup_root(struct nfs_
+ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_fsinfo *info)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2173,7 +2173,7 @@ static int _nfs4_proc_getattr(struct nfs
+ 
+ static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2261,7 +2261,7 @@ static int nfs4_proc_lookupfh(struct nfs
+ 			      struct qstr *name, struct nfs_fh *fhandle,
+ 			      struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
+@@ -2290,7 +2290,7 @@ static int _nfs4_proc_lookup(struct inod
+ 
+ static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2354,7 +2354,7 @@ static int _nfs4_proc_access(struct inod
+ 
+ static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2410,7 +2410,7 @@ static int _nfs4_proc_readlink(struct in
+ static int nfs4_proc_readlink(struct inode *inode, struct page *page,
+ 		unsigned int pgbase, unsigned int pglen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2508,7 +2508,7 @@ static int _nfs4_proc_remove(struct inod
+ 
+ static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2582,7 +2582,7 @@ static int _nfs4_proc_rename(struct inod
+ static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
+ 		struct inode *new_dir, struct qstr *new_name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
+@@ -2629,7 +2629,7 @@ static int _nfs4_proc_link(struct inode 
+ 
+ static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -2721,7 +2721,7 @@ out:
+ static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
+ 		struct page *page, unsigned int len, struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2752,7 +2752,7 @@ out:
+ static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2801,7 +2801,7 @@ static int _nfs4_proc_readdir(struct den
+ static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+                   u64 cookie, struct page *page, unsigned int count, int plus)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
+@@ -2849,7 +2849,7 @@ out:
+ static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
+ 		struct iattr *sattr, dev_t rdev)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(dir),
+@@ -2881,7 +2881,7 @@ static int _nfs4_proc_statfs(struct nfs_
+ 
+ static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(server,
+@@ -2912,7 +2912,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
+ 
+ static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -2958,7 +2958,7 @@ static int _nfs4_proc_pathconf(struct nf
+ static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		struct nfs_pathconf *pathconf)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -3257,7 +3257,7 @@ out_free:
+ 
+ static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	ssize_t ret;
+ 	do {
+ 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
+@@ -3313,7 +3313,7 @@ static int __nfs4_proc_set_acl(struct in
+ 
+ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = nfs4_handle_exception(NFS_SERVER(inode),
+@@ -3578,7 +3578,7 @@ out:
+ int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
+ {
+ 	struct nfs_server *server = NFS_SERVER(inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 	do {
+ 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
+@@ -3651,7 +3651,7 @@ out:
+ 
+ static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4044,7 +4044,7 @@ static int _nfs4_do_setlk(struct nfs4_st
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4062,7 +4062,7 @@ static int nfs4_lock_reclaim(struct nfs4
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, request);
+@@ -4120,7 +4120,7 @@ out:
+ 
+ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
+ {
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	do {
+@@ -4180,7 +4180,7 @@ nfs4_proc_lock(struct file *filp, int cm
+ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
++	struct nfs4_exception exception = {0, 0};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, fl);
+diff -urNp linux-2.6.32.14/fs/nfsd/lockd.c linux-2.6.32.14/fs/nfsd/lockd.c
+--- linux-2.6.32.14/fs/nfsd/lockd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/nfsd/lockd.c	2010-05-28 21:27:16.210892100 -0400
+@@ -67,7 +67,7 @@ nlm_fclose(struct file *filp)
+ 	fput(filp);
+ }
+ 
+-static struct nlmsvc_binding	nfsd_nlm_ops = {
++static const struct nlmsvc_binding	nfsd_nlm_ops = {
+ 	.fopen		= nlm_fopen,		/* open file for locking */
+ 	.fclose		= nlm_fclose,		/* close file */
+ };
+diff -urNp linux-2.6.32.14/fs/nfsd/vfs.c linux-2.6.32.14/fs/nfsd/vfs.c
+--- linux-2.6.32.14/fs/nfsd/vfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/nfsd/vfs.c	2010-05-28 21:27:16.218925750 -0400
+@@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
+ 	} else {
+ 		oldfs = get_fs();
+ 		set_fs(KERNEL_DS);
+-		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
++		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 		set_fs(oldfs);
+ 	}
+ 
+@@ -1060,7 +1060,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
+ 
+ 	/* Write the data. */
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
++	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
+ 	set_fs(oldfs);
+ 	if (host_err < 0)
+ 		goto out_nfserr;
+@@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
+ 	 */
+ 
+ 	oldfs = get_fs(); set_fs(KERNEL_DS);
+-	host_err = inode->i_op->readlink(dentry, buf, *lenp);
++	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
+ 	set_fs(oldfs);
+ 
+ 	if (host_err < 0)
+diff -urNp linux-2.6.32.14/fs/nls/nls_base.c linux-2.6.32.14/fs/nls/nls_base.c
+--- linux-2.6.32.14/fs/nls/nls_base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/nls/nls_base.c	2010-05-28 21:27:16.218925750 -0400
+@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
+     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
+     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
+     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
+-    {0,						       /* end of table    */}
++    {0, 0, 0, 0, 0,				       /* end of table    */}
+ };
+ 
+ #define UNICODE_MAX	0x0010ffff
+diff -urNp linux-2.6.32.14/fs/ntfs/file.c linux-2.6.32.14/fs/ntfs/file.c
+--- linux-2.6.32.14/fs/ntfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ntfs/file.c	2010-05-28 21:27:16.227248042 -0400
+@@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
+ #endif /* NTFS_RW */
+ };
+ 
+-const struct file_operations ntfs_empty_file_ops = {};
++const struct file_operations ntfs_empty_file_ops __read_only;
+ 
+-const struct inode_operations ntfs_empty_inode_ops = {};
++const struct inode_operations ntfs_empty_inode_ops __read_only;
+diff -urNp linux-2.6.32.14/fs/ocfs2/cluster/masklog.c linux-2.6.32.14/fs/ocfs2/cluster/masklog.c
+--- linux-2.6.32.14/fs/ocfs2/cluster/masklog.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ocfs2/cluster/masklog.c	2010-05-28 21:27:16.227248042 -0400
+@@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
+ 	return mlog_mask_store(mlog_attr->mask, buf, count);
+ }
+ 
+-static struct sysfs_ops mlog_attr_ops = {
++static const struct sysfs_ops mlog_attr_ops = {
+ 	.show  = mlog_show,
+ 	.store = mlog_store,
+ };
+diff -urNp linux-2.6.32.14/fs/ocfs2/localalloc.c linux-2.6.32.14/fs/ocfs2/localalloc.c
+--- linux-2.6.32.14/fs/ocfs2/localalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ocfs2/localalloc.c	2010-05-28 21:27:16.227248042 -0400
+@@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
+ 		goto bail;
+ 	}
+ 
+-	atomic_inc(&osb->alloc_stats.moves);
++	atomic_inc_unchecked(&osb->alloc_stats.moves);
+ 
+ 	status = 0;
+ bail:
+diff -urNp linux-2.6.32.14/fs/ocfs2/ocfs2.h linux-2.6.32.14/fs/ocfs2/ocfs2.h
+--- linux-2.6.32.14/fs/ocfs2/ocfs2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ocfs2/ocfs2.h	2010-05-28 21:27:16.227248042 -0400
+@@ -217,11 +217,11 @@ enum ocfs2_vol_state
+ 
+ struct ocfs2_alloc_stats
+ {
+-	atomic_t moves;
+-	atomic_t local_data;
+-	atomic_t bitmap_data;
+-	atomic_t bg_allocs;
+-	atomic_t bg_extends;
++	atomic_unchecked_t moves;
++	atomic_unchecked_t local_data;
++	atomic_unchecked_t bitmap_data;
++	atomic_unchecked_t bg_allocs;
++	atomic_unchecked_t bg_extends;
+ };
+ 
+ enum ocfs2_local_alloc_state
+diff -urNp linux-2.6.32.14/fs/ocfs2/suballoc.c linux-2.6.32.14/fs/ocfs2/suballoc.c
+--- linux-2.6.32.14/fs/ocfs2/suballoc.c	2010-04-29 17:49:38.449086403 -0400
++++ linux-2.6.32.14/fs/ocfs2/suballoc.c	2010-05-28 21:27:16.227248042 -0400
+@@ -623,7 +623,7 @@ static int ocfs2_reserve_suballoc_bits(s
+ 				mlog_errno(status);
+ 			goto bail;
+ 		}
+-		atomic_inc(&osb->alloc_stats.bg_extends);
++		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
+ 
+ 		/* You should never ask for this much metadata */
+ 		BUG_ON(bits_wanted >
+@@ -1654,7 +1654,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
+ 	ac->ac_bits_given += (*num_bits);
+@@ -1728,7 +1728,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
+ 		mlog_errno(status);
+ 		goto bail;
+ 	}
+-	atomic_inc(&osb->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
+ 
+ 	BUG_ON(num_bits != 1);
+ 
+@@ -1830,7 +1830,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 						      cluster_start,
+ 						      num_clusters);
+ 		if (!status)
+-			atomic_inc(&osb->alloc_stats.local_data);
++			atomic_inc_unchecked(&osb->alloc_stats.local_data);
+ 	} else {
+ 		if (min_clusters > (osb->bitmap_cpg - 1)) {
+ 			/* The only paths asking for contiguousness
+@@ -1858,7 +1858,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
+ 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
+ 								 bg_blkno,
+ 								 bg_bit_off);
+-			atomic_inc(&osb->alloc_stats.bitmap_data);
++			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
+ 		}
+ 	}
+ 	if (status < 0) {
+diff -urNp linux-2.6.32.14/fs/ocfs2/super.c linux-2.6.32.14/fs/ocfs2/super.c
+--- linux-2.6.32.14/fs/ocfs2/super.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/ocfs2/super.c	2010-05-28 21:27:16.247317121 -0400
+@@ -284,11 +284,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
+ 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
+ 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
+ 			"Stats",
+-			atomic_read(&osb->alloc_stats.bitmap_data),
+-			atomic_read(&osb->alloc_stats.local_data),
+-			atomic_read(&osb->alloc_stats.bg_allocs),
+-			atomic_read(&osb->alloc_stats.moves),
+-			atomic_read(&osb->alloc_stats.bg_extends));
++			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
++			atomic_read_unchecked(&osb->alloc_stats.local_data),
++			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
++			atomic_read_unchecked(&osb->alloc_stats.moves),
++			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
+ 
+ 	out += snprintf(buf + out, len - out,
+ 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
+@@ -1998,11 +1998,11 @@ static int ocfs2_initialize_super(struct
+ 	spin_lock_init(&osb->osb_xattr_lock);
+ 	ocfs2_init_inode_steal_slot(osb);
+ 
+-	atomic_set(&osb->alloc_stats.moves, 0);
+-	atomic_set(&osb->alloc_stats.local_data, 0);
+-	atomic_set(&osb->alloc_stats.bitmap_data, 0);
+-	atomic_set(&osb->alloc_stats.bg_allocs, 0);
+-	atomic_set(&osb->alloc_stats.bg_extends, 0);
++	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
++	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
++	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
+ 
+ 	/* Copy the blockcheck stats from the superblock probe */
+ 	osb->osb_ecc_stats = *stats;
+diff -urNp linux-2.6.32.14/fs/open.c linux-2.6.32.14/fs/open.c
+--- linux-2.6.32.14/fs/open.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/open.c	2010-05-28 21:27:16.247317121 -0400
+@@ -206,6 +206,9 @@ int do_truncate(struct dentry *dentry, l
+ 	if (length < 0)
+ 		return -EINVAL;
+ 
++	if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
++		return -EACCES;
++
+ 	newattrs.ia_size = length;
+ 	newattrs.ia_valid = ATTR_SIZE | time_attrs;
+ 	if (filp) {
+@@ -511,6 +514,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
+ 	if (__mnt_is_readonly(path.mnt))
+ 		res = -EROFS;
+ 
++	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
++		res = -EACCES;
++
+ out_path_release:
+ 	path_put(&path);
+ out:
+@@ -537,6 +543,8 @@ SYSCALL_DEFINE1(chdir, const char __user
+ 	if (error)
+ 		goto dput_and_out;
+ 
++	gr_log_chdir(path.dentry, path.mnt);
++
+ 	set_fs_pwd(current->fs, &path);
+ 
+ dput_and_out:
+@@ -563,6 +571,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
+ 		goto out_putf;
+ 
+ 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
++
++	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
++		error = -EPERM;
++
++	if (!error)
++		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
++
+ 	if (!error)
+ 		set_fs_pwd(current->fs, &file->f_path);
+ out_putf:
+@@ -588,7 +603,18 @@ SYSCALL_DEFINE1(chroot, const char __use
+ 	if (!capable(CAP_SYS_CHROOT))
+ 		goto dput_and_out;
+ 
++	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
++		goto dput_and_out;
++
++	if (gr_handle_chroot_caps(&path)) {
++		error = -ENOMEM;
++		goto dput_and_out;
++	}
++
+ 	set_fs_root(current->fs, &path);
++
++	gr_handle_chroot_chdir(&path);
++
+ 	error = 0;
+ dput_and_out:
+ 	path_put(&path);
+@@ -616,13 +642,28 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
+ 	err = mnt_want_write_file(file);
+ 	if (err)
+ 		goto out_putf;
++
++	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
++		err = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
++		err = -EPERM;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	err = notify_change(dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(file->f_path.mnt);
+ out_putf:
+ 	fput(file);
+@@ -645,13 +686,28 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto dput_and_out;
++
++	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		goto out_drop_write;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	if (mode == (mode_t) -1)
+ 		mode = inode->i_mode;
++
++	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
++		error = -EACCES;
++		mutex_unlock(&inode->i_mutex);
++		goto out_drop_write;
++	}
++
+ 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
+ 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
+ 	error = notify_change(path.dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
++
++out_drop_write:
+ 	mnt_drop_write(path.mnt);
+ dput_and_out:
+ 	path_put(&path);
+@@ -664,12 +720,15 @@ SYSCALL_DEFINE2(chmod, const char __user
+ 	return sys_fchmodat(AT_FDCWD, filename, mode);
+ }
+ 
+-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
++static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int error;
+ 	struct iattr newattrs;
+ 
++	if (!gr_acl_handle_chown(dentry, mnt))
++		return -EACCES;
++
+ 	newattrs.ia_valid =  ATTR_CTIME;
+ 	if (user != (uid_t) -1) {
+ 		newattrs.ia_valid |= ATTR_UID;
+@@ -700,7 +759,7 @@ SYSCALL_DEFINE3(chown, const char __user
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -725,7 +784,7 @@ SYSCALL_DEFINE5(fchownat, int, dfd, cons
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -744,7 +803,7 @@ SYSCALL_DEFINE3(lchown, const char __use
+ 	error = mnt_want_write(path.mnt);
+ 	if (error)
+ 		goto out_release;
+-	error = chown_common(path.dentry, user, group);
++	error = chown_common(path.dentry, user, group, path.mnt);
+ 	mnt_drop_write(path.mnt);
+ out_release:
+ 	path_put(&path);
+@@ -767,7 +826,7 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd
+ 		goto out_fput;
+ 	dentry = file->f_path.dentry;
+ 	audit_inode(NULL, dentry);
+-	error = chown_common(dentry, user, group);
++	error = chown_common(dentry, user, group, file->f_path.mnt);
+ 	mnt_drop_write(file->f_path.mnt);
+ out_fput:
+ 	fput(file);
+diff -urNp linux-2.6.32.14/fs/pipe.c linux-2.6.32.14/fs/pipe.c
+--- linux-2.6.32.14/fs/pipe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/pipe.c	2010-05-28 21:27:16.247317121 -0400
+@@ -401,9 +401,9 @@ redo:
+ 		}
+ 		if (bufs)	/* More to do? */
+ 			continue;
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			/* syscall merging: Usually we must not sleep
+ 			 * if O_NONBLOCK is set, or if we got some data.
+ 			 * But if a writer sleeps in kernel space, then
+@@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+ 
+-	if (!pipe->readers) {
++	if (!atomic_read(&pipe->readers)) {
+ 		send_sig(SIGPIPE, current, 0);
+ 		ret = -EPIPE;
+ 		goto out;
+@@ -511,7 +511,7 @@ redo1:
+ 	for (;;) {
+ 		int bufs;
+ 
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -597,9 +597,9 @@ redo2:
+ 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 			do_wakeup = 0;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ out:
+ 	mutex_unlock(&inode->i_mutex);
+@@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table 
+ 	mask = 0;
+ 	if (filp->f_mode & FMODE_READ) {
+ 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
+-		if (!pipe->writers && filp->f_version != pipe->w_counter)
++		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
+ 			mask |= POLLHUP;
+ 	}
+ 
+@@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table 
+ 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
+ 		 * behave exactly like pipes for poll().
+ 		 */
+-		if (!pipe->readers)
++		if (!atomic_read(&pipe->readers))
+ 			mask |= POLLERR;
+ 	}
+ 
+@@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
+ 
+ 	mutex_lock(&inode->i_mutex);
+ 	pipe = inode->i_pipe;
+-	pipe->readers -= decr;
+-	pipe->writers -= decw;
++	atomic_sub(decr, &pipe->readers);
++	atomic_sub(decw, &pipe->writers);
+ 
+-	if (!pipe->readers && !pipe->writers) {
++	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
+ 		free_pipe_info(inode);
+ 	} else {
+ 		wake_up_interruptible_sync(&pipe->wait);
+@@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->readers++;
++		atomic_inc(&inode->i_pipe->readers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
+ 
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+-		inode->i_pipe->writers++;
++		atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
+ 	if (inode->i_pipe) {
+ 		ret = 0;
+ 		if (filp->f_mode & FMODE_READ)
+-			inode->i_pipe->readers++;
++			atomic_inc(&inode->i_pipe->readers);
+ 		if (filp->f_mode & FMODE_WRITE)
+-			inode->i_pipe->writers++;
++			atomic_inc(&inode->i_pipe->writers);
+ 	}
+ 
+ 	mutex_unlock(&inode->i_mutex);
+@@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
+ 	inode->i_pipe = NULL;
+ }
+ 
+-static struct vfsmount *pipe_mnt __read_mostly;
++struct vfsmount *pipe_mnt __read_mostly;
+ static int pipefs_delete_dentry(struct dentry *dentry)
+ {
+ 	/*
+@@ -945,7 +945,8 @@ static struct inode * get_pipe_inode(voi
+ 		goto fail_iput;
+ 	inode->i_pipe = pipe;
+ 
+-	pipe->readers = pipe->writers = 1;
++	atomic_set(&pipe->readers, 1);
++	atomic_set(&pipe->writers, 1);
+ 	inode->i_fop = &rdwr_pipefifo_fops;
+ 
+ 	/*
+diff -urNp linux-2.6.32.14/fs/proc/array.c linux-2.6.32.14/fs/proc/array.c
+--- linux-2.6.32.14/fs/proc/array.c	2010-05-28 20:16:44.454934408 -0400
++++ linux-2.6.32.14/fs/proc/array.c	2010-05-28 22:32:01.011402212 -0400
+@@ -321,6 +321,21 @@ static inline void task_context_switch_c
+ 			p->nivcsw);
+ }
+ 
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline void task_pax(struct seq_file *m, struct task_struct *p)
++{
++	if (p->mm)
++		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
++			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
++			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
++			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
++			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
++			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
++	else
++		seq_printf(m, "PaX:\t-----\n");
++}
++#endif
++
+ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task)
+ {
+@@ -340,9 +355,20 @@ int proc_pid_status(struct seq_file *m, 
+ 	task_show_regs(m, task);
+ #endif
+ 	task_context_switch_counts(m, task);
++
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	task_pax(m, task);
++#endif
++
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task, int whole)
+ {
+@@ -439,6 +465,19 @@ static int do_task_stat(struct seq_file 
+ 		gtime = task_gtime(task);
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (PAX_RAND_FLAGS(mm)) {
++		eip = 0;
++		esp = 0;
++		wchan = 0;
++	}
++#endif
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	wchan = 0;
++	eip =0;
++	esp =0;
++#endif
++
+ 	/* scale priority and nice values from timeslices to -20..20 */
+ 	/* to make it look like a "normal" Unix priority/nice value  */
+ 	priority = task_prio(task);
+@@ -479,9 +518,15 @@ static int do_task_stat(struct seq_file 
+ 		vsize,
+ 		mm ? get_mm_rss(mm) : 0,
+ 		rsslim,
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
++		PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
++		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
++#else
+ 		mm ? mm->start_code : 0,
+ 		mm ? mm->end_code : 0,
+ 		(permitted && mm) ? mm->start_stack : 0,
++#endif
+ 		esp,
+ 		eip,
+ 		/* The signal information here is obsolete.
+@@ -534,3 +579,10 @@ int proc_pid_statm(struct seq_file *m, s
+ 
+ 	return 0;
+ }
++
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++int proc_pid_ipaddr(struct task_struct *task, char *buffer)
++{
++	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
++}
++#endif
+diff -urNp linux-2.6.32.14/fs/proc/base.c linux-2.6.32.14/fs/proc/base.c
+--- linux-2.6.32.14/fs/proc/base.c	2010-05-15 13:20:19.242597763 -0400
++++ linux-2.6.32.14/fs/proc/base.c	2010-05-28 21:27:16.250934990 -0400
+@@ -102,6 +102,22 @@ struct pid_entry {
+ 	union proc_op op;
+ };
+ 
++struct getdents_callback {
++	struct linux_dirent __user * current_dir;
++	struct linux_dirent __user * previous;
++	struct file * file;
++	int count;
++	int error;
++};
++
++static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
++			   loff_t offset, u64 ino, unsigned int d_type)
++{
++	struct getdents_callback * buf = (struct getdents_callback *) __buf;
++	buf->error = -EINVAL;
++	return 0;
++}
++
+ #define NOD(NAME, MODE, IOP, FOP, OP) {			\
+ 	.name = (NAME),					\
+ 	.len  = sizeof(NAME) - 1,			\
+@@ -213,6 +229,9 @@ static int check_mem_permission(struct t
+ 	if (task == current)
+ 		return 0;
+ 
++	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
++		return -EPERM;
++
+ 	/*
+ 	 * If current is actively ptrace'ing, and would also be
+ 	 * permitted to freshly attach with ptrace now, permit it.
+@@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
+ 	if (!mm->arg_end)
+ 		goto out_mm;	/* Shh! No looking before we're done */
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out_mm;
++
+  	len = mm->arg_end - mm->arg_start;
+  
+ 	if (len > PAGE_SIZE)
+@@ -287,12 +309,26 @@ out:
+ 	return res;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static int proc_pid_auxv(struct task_struct *task, char *buffer)
+ {
+ 	int res = 0;
+ 	struct mm_struct *mm = get_task_mm(task);
+ 	if (mm) {
+ 		unsigned int nwords = 0;
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (PAX_RAND_FLAGS(mm)) {
++			mmput(mm);
++			return res;
++		}
++#endif
++
+ 		do {
+ 			nwords += 2;
+ 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
+@@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
+ }
+ #endif /* CONFIG_KALLSYMS */
+ 
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 
+ #define MAX_STACK_TRACE_DEPTH	64
+ 
+@@ -522,7 +558,7 @@ static int proc_pid_limits(struct task_s
+ 	return count;
+ }
+ 
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ static int proc_pid_syscall(struct task_struct *task, char *buffer)
+ {
+ 	long nr;
+@@ -936,6 +972,9 @@ static ssize_t environ_read(struct file 
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_acl_handle_procpidmem(task))
++		goto out;
++
+ 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ 		goto out;
+ 
+@@ -1456,7 +1495,11 @@ static struct inode *proc_pid_make_inode
+ 		rcu_read_lock();
+ 		cred = __task_cred(task);
+ 		inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 		inode->i_gid = cred->egid;
++#endif
+ 		rcu_read_unlock();
+ 	}
+ 	security_task_to_inode(task, inode);
+@@ -1474,6 +1517,9 @@ static int pid_getattr(struct vfsmount *
+ 	struct inode *inode = dentry->d_inode;
+ 	struct task_struct *task;
+ 	const struct cred *cred;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++#endif
+ 
+ 	generic_fillattr(inode, stat);
+ 
+@@ -1481,12 +1527,34 @@ static int pid_getattr(struct vfsmount *
+ 	stat->uid = 0;
+ 	stat->gid = 0;
+ 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
++
++	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
++		rcu_read_unlock();
++		return -ENOENT;
++	}
++
+ 	if (task) {
++		cred = __task_cred(task);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++		)
++#endif
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+-			cred = __task_cred(task);
+ 			stat->uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			stat->gid = cred->egid;
++#endif
+ 		}
+ 	}
+ 	rcu_read_unlock();
+@@ -1518,11 +1586,20 @@ static int pid_revalidate(struct dentry 
+ 
+ 	if (task) {
+ 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
++#endif
+ 		    task_dumpable(task)) {
+ 			rcu_read_lock();
+ 			cred = __task_cred(task);
+ 			inode->i_uid = cred->euid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = cred->egid;
++#endif
+ 			rcu_read_unlock();
+ 		} else {
+ 			inode->i_uid = 0;
+@@ -1643,7 +1720,8 @@ static int proc_fd_info(struct inode *in
+ 	int fd = proc_fd(inode);
+ 
+ 	if (task) {
+-		files = get_files_struct(task);
++		if (!gr_acl_handle_procpidmem(task))
++			files = get_files_struct(task);
+ 		put_task_struct(task);
+ 	}
+ 	if (files) {
+@@ -1895,12 +1973,22 @@ static const struct file_operations proc
+ static int proc_fd_permission(struct inode *inode, int mask)
+ {
+ 	int rv;
++	struct task_struct *task;
+ 
+ 	rv = generic_permission(inode, mask, NULL);
+-	if (rv == 0)
+-		return 0;
++
+ 	if (task_pid(current) == proc_pid(inode))
+ 		rv = 0;
++
++	task = get_proc_task(inode);
++	if (task == NULL)
++		return rv;
++
++	if (gr_acl_handle_procpidmem(task))
++		rv = -EACCES;
++
++	put_task_struct(task);
++
+ 	return rv;
+ }
+ 
+@@ -2009,6 +2097,9 @@ static struct dentry *proc_pident_lookup
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	/*
+ 	 * Yes, it does not scale. And it should not. Don't add
+ 	 * new entries into /proc/<tgid>/ without very good reasons.
+@@ -2053,6 +2144,9 @@ static int proc_pident_readdir(struct fi
+ 	if (!task)
+ 		goto out_no_task;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	ret = 0;
+ 	i = filp->f_pos;
+ 	switch (i) {
+@@ -2320,7 +2414,7 @@ static void *proc_self_follow_link(struc
+ static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+ 				void *cookie)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+@@ -2433,6 +2527,9 @@ static struct dentry *proc_base_lookup(s
+ 	if (p > last)
+ 		goto out;
+ 
++	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
++		goto out;
++
+ 	error = proc_base_instantiate(dir, dentry, task, p);
+ 
+ out:
+@@ -2519,7 +2616,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",    S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
+@@ -2547,7 +2644,7 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",      S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+@@ -2577,6 +2674,9 @@ static const struct pid_entry tgid_base_
+ #ifdef CONFIG_TASK_IO_ACCOUNTING
+ 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
++#endif
+ };
+ 
+ static int proc_tgid_base_readdir(struct file * filp,
+@@ -2701,7 +2801,14 @@ static struct dentry *proc_pid_instantia
+ 	if (!inode)
+ 		goto out;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
++#else
+ 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
++#endif
+ 	inode->i_op = &proc_tgid_base_inode_operations;
+ 	inode->i_fop = &proc_tgid_base_operations;
+ 	inode->i_flags|=S_IMMUTABLE;
+@@ -2743,7 +2850,11 @@ struct dentry *proc_pid_lookup(struct in
+ 	if (!task)
+ 		goto out;
+ 
++	if (gr_check_hidden_task(task))
++		goto out_put_task;
++
+ 	result = proc_pid_instantiate(dir, dentry, task, NULL);
++out_put_task:
+ 	put_task_struct(task);
+ out:
+ 	return result;
+@@ -2808,6 +2919,11 @@ int proc_pid_readdir(struct file * filp,
+ {
+ 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
+ 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *tmpcred = current_cred();
++	const struct cred *itercred;
++#endif
++	filldir_t __filldir = filldir;
+ 	struct tgid_iter iter;
+ 	struct pid_namespace *ns;
+ 
+@@ -2826,8 +2942,27 @@ int proc_pid_readdir(struct file * filp,
+ 	for (iter = next_tgid(ns, iter);
+ 	     iter.task;
+ 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		rcu_read_lock();
++		itercred = __task_cred(iter.task);
++#endif
++		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
++#endif
++			)
++#endif
++		)
++			__filldir = &gr_fake_filldir;
++		else
++			__filldir = filldir;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	rcu_read_unlock();
++#endif
+ 		filp->f_pos = iter.tgid + TGID_OFFSET;
+-		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
++		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
+ 			put_task_struct(iter.task);
+ 			goto out;
+ 		}
+@@ -2853,7 +2988,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_SCHED_DEBUG
+ 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
+ #endif
+-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
++#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+ 	INF("syscall",   S_IRUSR, proc_pid_syscall),
+ #endif
+ 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
+@@ -2880,7 +3015,7 @@ static const struct pid_entry tid_base_s
+ #ifdef CONFIG_KALLSYMS
+ 	INF("wchan",     S_IRUGO, proc_pid_wchan),
+ #endif
+-#ifdef CONFIG_STACKTRACE
++#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ 	ONE("stack",      S_IRUSR, proc_pid_stack),
+ #endif
+ #ifdef CONFIG_SCHEDSTATS
+diff -urNp linux-2.6.32.14/fs/proc/cmdline.c linux-2.6.32.14/fs/proc/cmdline.c
+--- linux-2.6.32.14/fs/proc/cmdline.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/cmdline.c	2010-05-28 21:27:16.250934990 -0400
+@@ -23,7 +23,11 @@ static const struct file_operations cmdl
+ 
+ static int __init proc_cmdline_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
++#else
+ 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
++#endif
+ 	return 0;
+ }
+ module_init(proc_cmdline_init);
+diff -urNp linux-2.6.32.14/fs/proc/devices.c linux-2.6.32.14/fs/proc/devices.c
+--- linux-2.6.32.14/fs/proc/devices.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/devices.c	2010-05-28 21:27:16.250934990 -0400
+@@ -64,7 +64,11 @@ static const struct file_operations proc
+ 
+ static int __init proc_devices_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
++#else
+ 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_devices_init);
+diff -urNp linux-2.6.32.14/fs/proc/inode.c linux-2.6.32.14/fs/proc/inode.c
+--- linux-2.6.32.14/fs/proc/inode.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/inode.c	2010-05-28 21:27:16.250934990 -0400
+@@ -457,7 +457,11 @@ struct inode *proc_get_inode(struct supe
+ 		if (de->mode) {
+ 			inode->i_mode = de->mode;
+ 			inode->i_uid = de->uid;
++#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
++			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
++#else
+ 			inode->i_gid = de->gid;
++#endif
+ 		}
+ 		if (de->size)
+ 			inode->i_size = de->size;
+diff -urNp linux-2.6.32.14/fs/proc/internal.h linux-2.6.32.14/fs/proc/internal.h
+--- linux-2.6.32.14/fs/proc/internal.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/internal.h	2010-05-28 21:27:16.250934990 -0400
+@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
+ 				struct pid *pid, struct task_struct *task);
+ extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+ 				struct pid *pid, struct task_struct *task);
++#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
++extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
++#endif
+ extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
+ 
+ extern const struct file_operations proc_maps_operations;
+diff -urNp linux-2.6.32.14/fs/proc/Kconfig linux-2.6.32.14/fs/proc/Kconfig
+--- linux-2.6.32.14/fs/proc/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/Kconfig	2010-05-28 21:27:16.250934990 -0400
+@@ -30,12 +30,12 @@ config PROC_FS
+ 
+ config PROC_KCORE
+ 	bool "/proc/kcore support" if !ARM
+-	depends on PROC_FS && MMU
++	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
+ 
+ config PROC_VMCORE
+         bool "/proc/vmcore support (EXPERIMENTAL)"
+-        depends on PROC_FS && CRASH_DUMP
+-	default y
++        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
++	default n
+         help
+         Exports the dump image of crashed kernel in ELF format.
+ 
+@@ -59,8 +59,8 @@ config PROC_SYSCTL
+ 	  limited in memory.
+ 
+ config PROC_PAGE_MONITOR
+- 	default y
+-	depends on PROC_FS && MMU
++ 	default n
++	depends on PROC_FS && MMU && !GRKERNSEC
+ 	bool "Enable /proc page monitoring" if EMBEDDED
+  	help
+ 	  Various /proc files exist to monitor process memory utilization:
+diff -urNp linux-2.6.32.14/fs/proc/kcore.c linux-2.6.32.14/fs/proc/kcore.c
+--- linux-2.6.32.14/fs/proc/kcore.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/kcore.c	2010-05-28 21:27:16.250934990 -0400
+@@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
+ 
+ static int open_kcore(struct inode *inode, struct file *filp)
+ {
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	return -EPERM;
++#endif
+ 	if (!capable(CAP_SYS_RAWIO))
+ 		return -EPERM;
+ 	if (kcore_need_update)
+diff -urNp linux-2.6.32.14/fs/proc/meminfo.c linux-2.6.32.14/fs/proc/meminfo.c
+--- linux-2.6.32.14/fs/proc/meminfo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/meminfo.c	2010-05-28 21:27:16.250934990 -0400
+@@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
+ 		vmi.used >> 10,
+ 		vmi.largest_chunk >> 10
+ #ifdef CONFIG_MEMORY_FAILURE
+-		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
++		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
+ #endif
+ 		);
+ 
+diff -urNp linux-2.6.32.14/fs/proc/nommu.c linux-2.6.32.14/fs/proc/nommu.c
+--- linux-2.6.32.14/fs/proc/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/nommu.c	2010-05-28 21:27:16.250934990 -0400
+@@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.14/fs/proc/proc_net.c linux-2.6.32.14/fs/proc/proc_net.c
+--- linux-2.6.32.14/fs/proc/proc_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/proc_net.c	2010-05-28 21:27:16.250934990 -0400
+@@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
+ 	struct task_struct *task;
+ 	struct nsproxy *ns;
+ 	struct net *net = NULL;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred = current_cred();
++#endif
++
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	if (cred->fsuid)
++		return net;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
++		return net;
++#endif
+ 
+ 	rcu_read_lock();
+ 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
+diff -urNp linux-2.6.32.14/fs/proc/proc_sysctl.c linux-2.6.32.14/fs/proc/proc_sysctl.c
+--- linux-2.6.32.14/fs/proc/proc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/proc_sysctl.c	2010-05-28 21:27:16.250934990 -0400
+@@ -7,6 +7,8 @@
+ #include <linux/security.h>
+ #include "internal.h"
+ 
++extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
++
+ static const struct dentry_operations proc_sys_dentry_operations;
+ static const struct file_operations proc_sys_file_operations;
+ static const struct inode_operations proc_sys_inode_operations;
+@@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
+ 	if (!p)
+ 		goto out;
+ 
++	if (gr_handle_sysctl(p, MAY_EXEC))
++		goto out;
++
+ 	err = ERR_PTR(-ENOMEM);
+ 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+ 	if (h)
+@@ -228,6 +233,9 @@ static int scan(struct ctl_table_header 
+ 		if (*pos < file->f_pos)
+ 			continue;
+ 
++		if (gr_handle_sysctl(table, 0))
++			continue;
++
+ 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
+ 		if (res)
+ 			return res;
+@@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
+ 	if (IS_ERR(head))
+ 		return PTR_ERR(head);
+ 
++	if (table && gr_handle_sysctl(table, MAY_EXEC))
++		return -ENOENT;
++
+ 	generic_fillattr(inode, stat);
+ 	if (table)
+ 		stat->mode = (stat->mode & S_IFMT) | table->mode;
+diff -urNp linux-2.6.32.14/fs/proc/root.c linux-2.6.32.14/fs/proc/root.c
+--- linux-2.6.32.14/fs/proc/root.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/root.c	2010-05-28 21:27:16.250934990 -0400
+@@ -134,7 +134,15 @@ void __init proc_root_init(void)
+ #ifdef CONFIG_PROC_DEVICETREE
+ 	proc_device_tree_init();
+ #endif
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
++#endif
++#else
+ 	proc_mkdir("bus", NULL);
++#endif
+ 	proc_sys_init();
+ }
+ 
+diff -urNp linux-2.6.32.14/fs/proc/task_mmu.c linux-2.6.32.14/fs/proc/task_mmu.c
+--- linux-2.6.32.14/fs/proc/task_mmu.c	2010-05-28 20:16:44.454934408 -0400
++++ linux-2.6.32.14/fs/proc/task_mmu.c	2010-05-28 21:27:16.250934990 -0400
+@@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
+ 		"VmStk:\t%8lu kB\n"
+ 		"VmExe:\t%8lu kB\n"
+ 		"VmLib:\t%8lu kB\n"
+-		"VmPTE:\t%8lu kB\n",
+-		hiwater_vm << (PAGE_SHIFT-10),
++		"VmPTE:\t%8lu kB\n"
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
++#endif
++
++		,hiwater_vm << (PAGE_SHIFT-10),
+ 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
+ 		mm->locked_vm << (PAGE_SHIFT-10),
+ 		hiwater_rss << (PAGE_SHIFT-10),
+ 		total_rss << (PAGE_SHIFT-10),
+ 		data << (PAGE_SHIFT-10),
+ 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
+-		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
++		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		, mm->context.user_cs_base, mm->context.user_cs_limit
++#endif
++
++	);
+ }
+ 
+ unsigned long task_vsize(struct mm_struct *mm)
+@@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
++			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
++			      _mm->pax_flags & MF_PAX_SEGMEXEC))
++#endif
++
+ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
+ {
+ 	struct mm_struct *mm = vma->vm_mm;
+@@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
+ 	}
+ 
+ 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
++			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
++#else
+ 			vma->vm_start,
+ 			vma->vm_end,
++#endif
+ 			flags & VM_READ ? 'r' : '-',
+ 			flags & VM_WRITE ? 'w' : '-',
+ 			flags & VM_EXEC ? 'x' : '-',
+ 			flags & VM_MAYSHARE ? 's' : 'p',
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
++#else
+ 			pgoff,
++#endif
+ 			MAJOR(dev), MINOR(dev), ino, &len);
+ 
+ 	/*
+@@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
+ 	 */
+ 	if (file) {
+ 		pad_len_spaces(m, len);
+-		seq_path(m, &file->f_path, "\n");
++		seq_path(m, &file->f_path, "\n\\");
+ 	} else {
+ 		const char *name = arch_vma_name(vma);
+ 		if (!name) {
+ 			if (mm) {
+-				if (vma->vm_start <= mm->start_brk &&
+-						vma->vm_end >= mm->brk) {
++				if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 					name = "[heap]";
+-				} else if (vma->vm_start <= mm->start_stack &&
+-					   vma->vm_end >= mm->start_stack) {
++				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
++					   (vma->vm_start <= mm->start_stack &&
++					    vma->vm_end >= mm->start_stack)) {
+ 					name = "[stack]";
+ 				}
+ 			} else {
+@@ -384,9 +410,16 @@ static int show_smap(struct seq_file *m,
+ 	};
+ 
+ 	memset(&mss, 0, sizeof mss);
+-	mss.vma = vma;
+-	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
+-		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
++#endif
++		mss.vma = vma;
++		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
++			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	}
++#endif
+ 
+ 	show_map_vma(m, vma);
+ 
+@@ -402,7 +435,11 @@ static int show_smap(struct seq_file *m,
+ 		   "Swap:           %8lu kB\n"
+ 		   "KernelPageSize: %8lu kB\n"
+ 		   "MMUPageSize:    %8lu kB\n",
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
++#else
+ 		   (vma->vm_end - vma->vm_start) >> 10,
++#endif
+ 		   mss.resident >> 10,
+ 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
+ 		   mss.shared_clean  >> 10,
+diff -urNp linux-2.6.32.14/fs/proc/task_nommu.c linux-2.6.32.14/fs/proc/task_nommu.c
+--- linux-2.6.32.14/fs/proc/task_nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/proc/task_nommu.c	2010-05-28 21:27:16.250934990 -0400
+@@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
+ 	else
+ 		bytes += kobjsize(mm);
+ 	
+-	if (current->fs && current->fs->users > 1)
++	if (current->fs && atomic_read(&current->fs->users) > 1)
+ 		sbytes += kobjsize(current->fs);
+ 	else
+ 		bytes += kobjsize(current->fs);
+@@ -154,7 +154,7 @@ static int nommu_vma_show(struct seq_fil
+ 		if (len < 1)
+ 			len = 1;
+ 		seq_printf(m, "%*c", len, ' ');
+-		seq_path(m, &file->f_path, "");
++		seq_path(m, &file->f_path, "\n\\");
+ 	}
+ 
+ 	seq_putc(m, '\n');
+diff -urNp linux-2.6.32.14/fs/readdir.c linux-2.6.32.14/fs/readdir.c
+--- linux-2.6.32.14/fs/readdir.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/readdir.c	2010-05-28 21:27:16.250934990 -0400
+@@ -16,6 +16,7 @@
+ #include <linux/security.h>
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
++#include <linux/namei.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -67,6 +68,7 @@ struct old_linux_dirent {
+ 
+ struct readdir_callback {
+ 	struct old_linux_dirent __user * dirent;
++	struct file * file;
+ 	int result;
+ };
+ 
+@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
+ 		buf->result = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	buf->result++;
+ 	dirent = buf->dirent;
+ 	if (!access_ok(VERIFY_WRITE, dirent,
+@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
+ 
+ 	buf.result = 0;
+ 	buf.dirent = dirent;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, fillonedir, &buf);
+ 	if (buf.result)
+@@ -142,6 +149,7 @@ struct linux_dirent {
+ struct getdents_callback {
+ 	struct linux_dirent __user * current_dir;
+ 	struct linux_dirent __user * previous;
++	struct file * file;
+ 	int count;
+ 	int error;
+ };
+@@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
+ 		buf->error = -EOVERFLOW;
+ 		return -EOVERFLOW;
+ 	}
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, 
+ 	buf.previous = NULL;
+ 	buf.count = count;
+ 	buf.error = 0;
++	buf.file = file;
+ 
+ 	error = vfs_readdir(file, filldir, &buf);
+ 	if (error >= 0)
+@@ -228,6 +241,7 @@ out:
+ struct getdents_callback64 {
+ 	struct linux_dirent64 __user * current_dir;
+ 	struct linux_dirent64 __user * previous;
++	struct file *file;
+ 	int count;
+ 	int error;
+ };
+@@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
+ 	buf->error = -EINVAL;	/* only used if we fail.. */
+ 	if (reclen > buf->count)
+ 		return -EINVAL;
++
++	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
++		return 0;
++
+ 	dirent = buf->previous;
+ 	if (dirent) {
+ 		if (__put_user(offset, &dirent->d_off))
+@@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
+ 
+ 	buf.current_dir = dirent;
+ 	buf.previous = NULL;
++	buf.file = file;
+ 	buf.count = count;
+ 	buf.error = 0;
+ 
+diff -urNp linux-2.6.32.14/fs/reiserfs/do_balan.c linux-2.6.32.14/fs/reiserfs/do_balan.c
+--- linux-2.6.32.14/fs/reiserfs/do_balan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/reiserfs/do_balan.c	2010-05-28 21:27:16.255227340 -0400
+@@ -2058,7 +2058,7 @@ void do_balance(struct tree_balance *tb,
+ 		return;
+ 	}
+ 
+-	atomic_inc(&(fs_generation(tb->tb_sb)));
++	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
+ 	do_balance_starts(tb);
+ 
+ 	/* balance leaf returns 0 except if combining L R and S into
+diff -urNp linux-2.6.32.14/fs/reiserfs/item_ops.c linux-2.6.32.14/fs/reiserfs/item_ops.c
+--- linux-2.6.32.14/fs/reiserfs/item_ops.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/reiserfs/item_ops.c	2010-05-28 21:27:16.255227340 -0400
+@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations stat_data_ops = {
++static const struct item_operations stat_data_ops = {
+ 	.bytes_number = sd_bytes_number,
+ 	.decrement_key = sd_decrement_key,
+ 	.is_left_mergeable = sd_is_left_mergeable,
+@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations direct_ops = {
++static const struct item_operations direct_ops = {
+ 	.bytes_number = direct_bytes_number,
+ 	.decrement_key = direct_decrement_key,
+ 	.is_left_mergeable = direct_is_left_mergeable,
+@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
+ 			 vi->vi_index, vi->vi_type, vi->vi_ih);
+ }
+ 
+-static struct item_operations indirect_ops = {
++static const struct item_operations indirect_ops = {
+ 	.bytes_number = indirect_bytes_number,
+ 	.decrement_key = indirect_decrement_key,
+ 	.is_left_mergeable = indirect_is_left_mergeable,
+@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
+ 	printk("\n");
+ }
+ 
+-static struct item_operations direntry_ops = {
++static const struct item_operations direntry_ops = {
+ 	.bytes_number = direntry_bytes_number,
+ 	.decrement_key = direntry_decrement_key,
+ 	.is_left_mergeable = direntry_is_left_mergeable,
+@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
+ 			 "Invalid item type observed, run fsck ASAP");
+ }
+ 
+-static struct item_operations errcatch_ops = {
++static const struct item_operations errcatch_ops = {
+ 	errcatch_bytes_number,
+ 	errcatch_decrement_key,
+ 	errcatch_is_left_mergeable,
+@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
+ #error Item types must use disk-format assigned values.
+ #endif
+ 
+-struct item_operations *item_ops[TYPE_ANY + 1] = {
++const struct item_operations * const item_ops[TYPE_ANY + 1] = {
+ 	&stat_data_ops,
+ 	&indirect_ops,
+ 	&direct_ops,
+diff -urNp linux-2.6.32.14/fs/reiserfs/procfs.c linux-2.6.32.14/fs/reiserfs/procfs.c
+--- linux-2.6.32.14/fs/reiserfs/procfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/reiserfs/procfs.c	2010-05-28 21:27:16.255227340 -0400
+@@ -123,7 +123,7 @@ static int show_super(struct seq_file *m
+ 		   "SMALL_TAILS " : "NO_TAILS ",
+ 		   replay_only(sb) ? "REPLAY_ONLY " : "",
+ 		   convert_reiserfs(sb) ? "CONV " : "",
+-		   atomic_read(&r->s_generation_counter),
++		   atomic_read_unchecked(&r->s_generation_counter),
+ 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
+ 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
+ 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
+diff -urNp linux-2.6.32.14/fs/select.c linux-2.6.32.14/fs/select.c
+--- linux-2.6.32.14/fs/select.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/select.c	2010-05-28 21:27:16.263231213 -0400
+@@ -20,6 +20,7 @@
+ #include <linux/module.h>
+ #include <linux/slab.h>
+ #include <linux/poll.h>
++#include <linux/security.h>
+ #include <linux/personality.h> /* for STICKY_TIMEOUTS */
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
+@@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
+  	struct poll_list *walk = head;
+  	unsigned long todo = nfds;
+ 
++	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
+ 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+ 		return -EINVAL;
+ 
+diff -urNp linux-2.6.32.14/fs/seq_file.c linux-2.6.32.14/fs/seq_file.c
+--- linux-2.6.32.14/fs/seq_file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/seq_file.c	2010-05-28 21:27:16.267126788 -0400
+@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
+ 		return 0;
+ 	}
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			return -ENOMEM;
+ 	}
+@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m, 
+ Eoverflow:
+ 	m->op->stop(m, p);
+ 	kfree(m->buf);
+-	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++	m->size <<= 1;
++	m->buf = kmalloc(m->size, GFP_KERNEL);
+ 	return !m->buf ? -ENOMEM : -EAGAIN;
+ }
+ 
+@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
+ 	m->version = file->f_version;
+ 	/* grab buffer if we didn't have one */
+ 	if (!m->buf) {
+-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
++		m->size = PAGE_SIZE;
++		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 	}
+@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
+ 			goto Fill;
+ 		m->op->stop(m, p);
+ 		kfree(m->buf);
+-		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
++		m->size <<= 1;
++		m->buf = kmalloc(m->size, GFP_KERNEL);
+ 		if (!m->buf)
+ 			goto Enomem;
+ 		m->count = 0;
+diff -urNp linux-2.6.32.14/fs/smbfs/symlink.c linux-2.6.32.14/fs/smbfs/symlink.c
+--- linux-2.6.32.14/fs/smbfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/smbfs/symlink.c	2010-05-28 21:27:16.267126788 -0400
+@@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
+ 
+ static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		__putname(s);
+ }
+diff -urNp linux-2.6.32.14/fs/splice.c linux-2.6.32.14/fs/splice.c
+--- linux-2.6.32.14/fs/splice.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/splice.c	2010-05-28 21:27:16.267126788 -0400
+@@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 	pipe_lock(pipe);
+ 
+ 	for (;;) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
+ 			do_wakeup = 0;
+ 		}
+ 
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
++	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file 
+ 	old_fs = get_fs();
+ 	set_fs(get_ds());
+ 	/* The cast to a user pointer is valid due to the set_fs() */
+-	res = vfs_write(file, (const char __user *)buf, count, &pos);
++	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
+ 	set_fs(old_fs);
+ 
+ 	return res;
+@@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct 
+ 			goto err;
+ 
+ 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
+-		vec[i].iov_base = (void __user *) page_address(page);
++		vec[i].iov_base = (__force void __user *) page_address(page);
+ 		vec[i].iov_len = this_len;
+ 		pages[i] = page;
+ 		spd.nr_pages++;
+@@ -808,10 +808,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+ int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
+ 	while (!pipe->nrbufs) {
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			return 0;
+ 
+-		if (!pipe->waiting_writers && sd->num_spliced)
++		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
+ 			return 0;
+ 
+ 		if (sd->flags & SPLICE_F_NONBLOCK)
+@@ -1146,7 +1146,7 @@ ssize_t splice_direct_to_actor(struct fi
+ 		 * out of the pipe right after the splice_to_pipe(). So set
+ 		 * PIPE_READERS appropriately.
+ 		 */
+-		pipe->readers = 1;
++		atomic_set(&pipe->readers, 1);
+ 
+ 		current->splice_pipe = pipe;
+ 	}
+@@ -1704,9 +1704,9 @@ static int ipipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		if (!pipe->writers)
++		if (!atomic_read(&pipe->writers))
+ 			break;
+-		if (!pipe->waiting_writers) {
++		if (!atomic_read(&pipe->waiting_writers)) {
+ 			if (flags & SPLICE_F_NONBLOCK) {
+ 				ret = -EAGAIN;
+ 				break;
+@@ -1738,7 +1738,7 @@ static int opipe_prep(struct pipe_inode_
+ 	pipe_lock(pipe);
+ 
+ 	while (pipe->nrbufs >= PIPE_BUFFERS) {
+-		if (!pipe->readers) {
++		if (!atomic_read(&pipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			ret = -EPIPE;
+ 			break;
+@@ -1751,9 +1751,9 @@ static int opipe_prep(struct pipe_inode_
+ 			ret = -ERESTARTSYS;
+ 			break;
+ 		}
+-		pipe->waiting_writers++;
++		atomic_inc(&pipe->waiting_writers);
+ 		pipe_wait(pipe);
+-		pipe->waiting_writers--;
++		atomic_dec(&pipe->waiting_writers);
+ 	}
+ 
+ 	pipe_unlock(pipe);
+@@ -1789,14 +1789,14 @@ retry:
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+ 			break;
+ 		}
+ 
+-		if (!ipipe->nrbufs && !ipipe->writers)
++		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
+ 			break;
+ 
+ 		/*
+@@ -1896,7 +1896,7 @@ static int link_pipe(struct pipe_inode_i
+ 	pipe_double_lock(ipipe, opipe);
+ 
+ 	do {
+-		if (!opipe->readers) {
++		if (!atomic_read(&opipe->readers)) {
+ 			send_sig(SIGPIPE, current, 0);
+ 			if (!ret)
+ 				ret = -EPIPE;
+@@ -1941,7 +1941,7 @@ static int link_pipe(struct pipe_inode_i
+ 	 * return EAGAIN if we have the potential of some data in the
+ 	 * future, otherwise just return 0
+ 	 */
+-	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
++	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
+ 		ret = -EAGAIN;
+ 
+ 	pipe_unlock(ipipe);
+diff -urNp linux-2.6.32.14/fs/sysfs/file.c linux-2.6.32.14/fs/sysfs/file.c
+--- linux-2.6.32.14/fs/sysfs/file.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/sysfs/file.c	2010-05-28 21:27:16.267126788 -0400
+@@ -53,7 +53,7 @@ struct sysfs_buffer {
+ 	size_t			count;
+ 	loff_t			pos;
+ 	char			* page;
+-	struct sysfs_ops	* ops;
++	const struct sysfs_ops	* ops;
+ 	struct mutex		mutex;
+ 	int			needs_read_fill;
+ 	int			event;
+@@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int ret = 0;
+ 	ssize_t count;
+ 
+@@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
+ {
+ 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+-	struct sysfs_ops * ops = buffer->ops;
++	const struct sysfs_ops * ops = buffer->ops;
+ 	int rc;
+ 
+ 	/* need attr_sd for attr and ops, its parent for kobj */
+@@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode 
+ 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
+ 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
+ 	struct sysfs_buffer *buffer;
+-	struct sysfs_ops *ops;
++	const struct sysfs_ops *ops;
+ 	int error = -EACCES;
+ 	char *p;
+ 
+diff -urNp linux-2.6.32.14/fs/sysfs/symlink.c linux-2.6.32.14/fs/sysfs/symlink.c
+--- linux-2.6.32.14/fs/sysfs/symlink.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/sysfs/symlink.c	2010-05-28 21:27:16.267126788 -0400
+@@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
+ 
+ static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
+ {
+-	char *page = nd_get_link(nd);
++	const char *page = nd_get_link(nd);
+ 	if (!IS_ERR(page))
+ 		free_page((unsigned long)page);
+ }
+diff -urNp linux-2.6.32.14/fs/udf/balloc.c linux-2.6.32.14/fs/udf/balloc.c
+--- linux-2.6.32.14/fs/udf/balloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/udf/balloc.c	2010-05-28 21:27:16.267126788 -0400
+@@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
+ 			  count, partmap->s_partition_len);
+@@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
+ 
+ 	mutex_lock(&sbi->s_alloc_mutex);
+ 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
+-	if (bloc->logicalBlockNum < 0 ||
+-	    (bloc->logicalBlockNum + count) >
+-		partmap->s_partition_len) {
++	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
+ 		udf_debug("%d < %d || %d + %d > %d\n",
+ 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
+ 			  partmap->s_partition_len);
+diff -urNp linux-2.6.32.14/fs/udf/misc.c linux-2.6.32.14/fs/udf/misc.c
+--- linux-2.6.32.14/fs/udf/misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/udf/misc.c	2010-05-28 21:27:16.271177364 -0400
+@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
+ 		iinfo->i_lenEAttr += size;
+ 		return (struct genericFormat *)&ea[offset];
+ 	}
+-	if (loc & 0x02)
+-		;
++	if (loc & 0x02) {
++	}
+ 
+ 	return NULL;
+ }
+diff -urNp linux-2.6.32.14/fs/udf/udfdecl.h linux-2.6.32.14/fs/udf/udfdecl.h
+--- linux-2.6.32.14/fs/udf/udfdecl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/udf/udfdecl.h	2010-05-28 21:27:16.271177364 -0400
+@@ -26,7 +26,7 @@ do { \
+ 	printk(f, ##a); \
+ } while (0)
+ #else
+-#define udf_debug(f, a...) /**/
++#define udf_debug(f, a...) do {} while (0)
+ #endif
+ 
+ #define udf_info(f, a...) \
+diff -urNp linux-2.6.32.14/fs/utimes.c linux-2.6.32.14/fs/utimes.c
+--- linux-2.6.32.14/fs/utimes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/utimes.c	2010-05-28 21:27:16.271177364 -0400
+@@ -1,6 +1,7 @@
+ #include <linux/compiler.h>
+ #include <linux/file.h>
+ #include <linux/fs.h>
++#include <linux/security.h>
+ #include <linux/linkage.h>
+ #include <linux/mount.h>
+ #include <linux/namei.h>
+@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
+ 				goto mnt_drop_write_and_out;
+ 		}
+ 	}
++
++	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
++		error = -EACCES;
++		goto mnt_drop_write_and_out;
++	}
++
+ 	mutex_lock(&inode->i_mutex);
+ 	error = notify_change(path->dentry, &newattrs);
+ 	mutex_unlock(&inode->i_mutex);
+diff -urNp linux-2.6.32.14/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.14/fs/xfs/linux-2.6/xfs_ioctl.c
+--- linux-2.6.32.14/fs/xfs/linux-2.6/xfs_ioctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/xfs/linux-2.6/xfs_ioctl.c	2010-05-28 21:27:16.275231809 -0400
+@@ -134,7 +134,7 @@ xfs_find_handle(
+ 	}
+ 
+ 	error = -EFAULT;
+-	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
++	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
+ 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
+ 		goto out_put;
+ 
+diff -urNp linux-2.6.32.14/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.14/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.32.14/fs/xfs/linux-2.6/xfs_iops.c	2010-04-29 17:49:38.453075413 -0400
++++ linux-2.6.32.14/fs/xfs/linux-2.6/xfs_iops.c	2010-05-28 21:27:16.279036027 -0400
+@@ -468,7 +468,7 @@ xfs_vn_put_link(
+ 	struct nameidata *nd,
+ 	void		*p)
+ {
+-	char		*s = nd_get_link(nd);
++	const char	*s = nd_get_link(nd);
+ 
+ 	if (!IS_ERR(s))
+ 		kfree(s);
+diff -urNp linux-2.6.32.14/fs/xfs/xfs_bmap.c linux-2.6.32.14/fs/xfs/xfs_bmap.c
+--- linux-2.6.32.14/fs/xfs/xfs_bmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/fs/xfs/xfs_bmap.c	2010-05-28 21:27:16.327077893 -0400
+@@ -360,7 +360,7 @@ xfs_bmap_validate_ret(
+ 	int			nmap,
+ 	int			ret_nmap);
+ #else
+-#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
++#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
+ #endif /* DEBUG */
+ 
+ #if defined(XFS_RW_TRACE)
+diff -urNp linux-2.6.32.14/grsecurity/gracl_alloc.c linux-2.6.32.14/grsecurity/gracl_alloc.c
+--- linux-2.6.32.14/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_alloc.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,105 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++
++static unsigned long alloc_stack_next = 1;
++static unsigned long alloc_stack_size = 1;
++static void **alloc_stack;
++
++static __inline__ int
++alloc_pop(void)
++{
++	if (alloc_stack_next == 1)
++		return 0;
++
++	kfree(alloc_stack[alloc_stack_next - 2]);
++
++	alloc_stack_next--;
++
++	return 1;
++}
++
++static __inline__ int
++alloc_push(void *buf)
++{
++	if (alloc_stack_next >= alloc_stack_size)
++		return 1;
++
++	alloc_stack[alloc_stack_next - 1] = buf;
++
++	alloc_stack_next++;
++
++	return 0;
++}
++
++void *
++acl_alloc(unsigned long len)
++{
++	void *ret = NULL;
++
++	if (!len || len > PAGE_SIZE)
++		goto out;
++
++	ret = kmalloc(len, GFP_KERNEL);
++
++	if (ret) {
++		if (alloc_push(ret)) {
++			kfree(ret);
++			ret = NULL;
++		}
++	}
++
++out:
++	return ret;
++}
++
++void *
++acl_alloc_num(unsigned long num, unsigned long len)
++{
++	if (!len || (num > (PAGE_SIZE / len)))
++		return NULL;
++
++	return acl_alloc(num * len);
++}
++
++void
++acl_free_all(void)
++{
++	if (gr_acl_is_enabled() || !alloc_stack)
++		return;
++
++	while (alloc_pop()) ;
++
++	if (alloc_stack) {
++		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
++			kfree(alloc_stack);
++		else
++			vfree(alloc_stack);
++	}
++
++	alloc_stack = NULL;
++	alloc_stack_size = 1;
++	alloc_stack_next = 1;
++
++	return;
++}
++
++int
++acl_alloc_stack_init(unsigned long size)
++{
++	if ((size * sizeof (void *)) <= PAGE_SIZE)
++		alloc_stack =
++		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
++	else
++		alloc_stack = (void **) vmalloc(size * sizeof (void *));
++
++	alloc_stack_size = size;
++
++	if (!alloc_stack)
++		return 0;
++	else
++		return 1;
++}
+diff -urNp linux-2.6.32.14/grsecurity/gracl.c linux-2.6.32.14/grsecurity/gracl.c
+--- linux-2.6.32.14/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,3897 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/namei.h>
++#include <linux/mount.h>
++#include <linux/tty.h>
++#include <linux/proc_fs.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/types.h>
++#include <linux/sysctl.h>
++#include <linux/netdevice.h>
++#include <linux/ptrace.h>
++#include <linux/gracl.h>
++#include <linux/gralloc.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/pid_namespace.h>
++#include <linux/fdtable.h>
++#include <linux/percpu.h>
++
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++
++static struct acl_role_db acl_role_set;
++static struct name_db name_set;
++static struct inodev_db inodev_set;
++
++/* for keeping track of userspace pointers used for subjects, so we
++   can share references in the kernel as well
++*/
++
++static struct dentry *real_root;
++static struct vfsmount *real_root_mnt;
++
++static struct acl_subj_map_db subj_map_set;
++
++static struct acl_role_label *default_role;
++
++static struct acl_role_label *role_list;
++
++static u16 acl_sp_role_value;
++
++extern char *gr_shared_page[4];
++static DECLARE_MUTEX(gr_dev_sem);
++DEFINE_RWLOCK(gr_inode_lock);
++
++struct gr_arg *gr_usermode;
++
++static unsigned int gr_status __read_only = GR_STATUS_INIT;
++
++extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
++extern void gr_clear_learn_entries(void);
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++extern void gr_log_resource(const struct task_struct *task,
++			    const int res, const unsigned long wanted, const int gt);
++#endif
++
++unsigned char *gr_system_salt;
++unsigned char *gr_system_sum;
++
++static struct sprole_pw **acl_special_roles = NULL;
++static __u16 num_sprole_pws = 0;
++
++static struct acl_role_label *kernel_role = NULL;
++
++static unsigned int gr_auth_attempts = 0;
++static unsigned long gr_auth_expires = 0UL;
++
++extern struct vfsmount *sock_mnt;
++extern struct vfsmount *pipe_mnt;
++extern struct vfsmount *shm_mnt;
++#ifdef CONFIG_HUGETLBFS
++extern struct vfsmount *hugetlbfs_vfsmount;
++#endif
++
++static struct acl_object_label *fakefs_obj;
++
++extern int gr_init_uidset(void);
++extern void gr_free_uidset(void);
++extern void gr_remove_uid(uid_t uid);
++extern int gr_find_uid(uid_t uid);
++
++__inline__ int
++gr_acl_is_enabled(void)
++{
++	return (gr_status & GR_READY);
++}
++
++char gr_roletype_to_char(void)
++{
++	switch (current->role->roletype &
++		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
++		 GR_ROLE_SPECIAL)) {
++	case GR_ROLE_DEFAULT:
++		return 'D';
++	case GR_ROLE_USER:
++		return 'U';
++	case GR_ROLE_GROUP:
++		return 'G';
++	case GR_ROLE_SPECIAL:
++		return 'S';
++	}
++
++	return 'X';
++}
++
++__inline__ int
++gr_acl_tpe_check(void)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++	if (current->role->roletype & GR_ROLE_TPE)
++		return 1;
++	else
++		return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (inode && S_ISBLK(inode->i_mode) &&
++	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
++	    !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++static int
++gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
++{
++	if (likely(lena != lenb))
++		return 0;
++
++	return !memcmp(a, b, lena);
++}
++
++static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++	                   struct dentry *root, struct vfsmount *rootmnt,
++			   char *buffer, int buflen)
++{
++	char * end = buffer+buflen;
++	char * retval;
++	int namelen;
++
++	*--end = '\0';
++	buflen--;
++
++	if (buflen < 1)
++		goto Elong;
++	/* Get '/' right */
++	retval = end-1;
++	*retval = '/';
++
++	for (;;) {
++		struct dentry * parent;
++
++		if (dentry == root && vfsmnt == rootmnt)
++			break;
++		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
++			/* Global root? */
++			spin_lock(&vfsmount_lock);
++			if (vfsmnt->mnt_parent == vfsmnt) {
++				spin_unlock(&vfsmount_lock);
++				goto global_root;
++			}
++			dentry = vfsmnt->mnt_mountpoint;
++			vfsmnt = vfsmnt->mnt_parent;
++			spin_unlock(&vfsmount_lock);
++			continue;
++		}
++		parent = dentry->d_parent;
++		prefetch(parent);
++		namelen = dentry->d_name.len;
++		buflen -= namelen + 1;
++		if (buflen < 0)
++			goto Elong;
++		end -= namelen;
++		memcpy(end, dentry->d_name.name, namelen);
++		*--end = '/';
++		retval = end;
++		dentry = parent;
++	}
++
++	return retval;
++
++global_root:
++	namelen = dentry->d_name.len;
++	buflen -= namelen;
++	if (buflen < 0)
++		goto Elong;
++	retval -= namelen-1;	/* hit the slash */
++	memcpy(retval, dentry->d_name.name, namelen);
++	return retval;
++Elong:
++	return ERR_PTR(-ENAMETOOLONG);
++}
++
++static char *
++gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
++              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
++{
++	char *retval;
++
++	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
++	if (unlikely(IS_ERR(retval)))
++		retval = strcpy(buf, "<path too long>");
++	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
++		retval[1] = '\0';
++
++	return retval;
++}
++
++static char *
++__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++		char *buf, int buflen)
++{
++	char *res;
++
++	/* we can use real_root, real_root_mnt, because this is only called
++	   by the RBAC system */
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
++
++	return res;
++}
++
++static char *
++d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
++	    char *buf, int buflen)
++{
++	char *res;
++	struct dentry *root;
++	struct vfsmount *rootmnt;
++	struct task_struct *reaper = &init_task;
++
++	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
++	read_lock(&reaper->fs->lock);
++	root = dget(reaper->fs->root.dentry);
++	rootmnt = mntget(reaper->fs->root.mnt);
++	read_unlock(&reaper->fs->lock);
++
++	spin_lock(&dcache_lock);
++	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
++	spin_unlock(&dcache_lock);
++
++	dput(root);
++	mntput(rootmnt);
++	return res;
++}
++
++static char *
++gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	char *ret;
++	spin_lock(&dcache_lock);
++	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++	spin_unlock(&dcache_lock);
++	return ret;
++}
++
++char *
++gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
++			     PAGE_SIZE);
++}
++
++char *
++gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++char *
++gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
++			   PAGE_SIZE);
++}
++
++__inline__ __u32
++to_gr_audit(const __u32 reqmode)
++{
++	/* masks off auditable permission flags, then shifts them to create
++	   auditing flags, and adds the special case of append auditing if
++	   we're requesting write */
++	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
++}
++
++struct acl_subject_label *
++lookup_subject_map(const struct acl_subject_label *userp)
++{
++	unsigned int index = shash(userp, subj_map_set.s_size);
++	struct subject_map *match;
++
++	match = subj_map_set.s_hash[index];
++
++	while (match && match->user != userp)
++		match = match->next;
++
++	if (match != NULL)
++		return match->kernel;
++	else
++		return NULL;
++}
++
++static void
++insert_subj_map_entry(struct subject_map *subjmap)
++{
++	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
++	struct subject_map **curr;
++
++	subjmap->prev = NULL;
++
++	curr = &subj_map_set.s_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = subjmap;
++
++	subjmap->next = *curr;
++	*curr = subjmap;
++
++	return;
++}
++
++static struct acl_role_label *
++lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
++		      const gid_t gid)
++{
++	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
++	struct acl_role_label *match;
++	struct role_allowed_ip *ipp;
++	unsigned int x;
++
++	match = acl_role_set.r_hash[index];
++
++	while (match) {
++		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
++			for (x = 0; x < match->domain_child_num; x++) {
++				if (match->domain_children[x] == uid)
++					goto found;
++			}
++		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
++			break;
++		match = match->next;
++	}
++found:
++	if (match == NULL) {
++	      try_group:
++		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
++		match = acl_role_set.r_hash[index];
++
++		while (match) {
++			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
++				for (x = 0; x < match->domain_child_num; x++) {
++					if (match->domain_children[x] == gid)
++						goto found2;
++				}
++			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
++				break;
++			match = match->next;
++		}
++found2:
++		if (match == NULL)
++			match = default_role;
++		if (match->allowed_ips == NULL)
++			return match;
++		else {
++			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++				if (likely
++				    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++				     (ntohl(ipp->addr) & ipp->netmask)))
++					return match;
++			}
++			match = default_role;
++		}
++	} else if (match->allowed_ips == NULL) {
++		return match;
++	} else {
++		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
++			if (likely
++			    ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
++			     (ntohl(ipp->addr) & ipp->netmask)))
++				return match;
++		}
++		goto try_group;
++	}
++
++	return match;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label(const ino_t ino, const dev_t dev,
++		      const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++struct acl_subject_label *
++lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
++			  const struct acl_role_label *role)
++{
++	unsigned int index = fhash(ino, dev, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct acl_object_label *
++lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
++		     const struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       !(match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && (match->mode & GR_DELETED))
++		return match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != ino || match->device != dev ||
++	       (match->mode & GR_DELETED))) {
++		match = match->next;
++	}
++
++	if (match && !(match->mode & GR_DELETED))
++		return match;
++	else
++		return NULL;
++}
++
++static struct name_entry *
++lookup_name_entry(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
++		match = match->next;
++
++	return match;
++}
++
++static struct name_entry *
++lookup_name_entry_create(const char *name)
++{
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++	struct name_entry *match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 !match->deleted))
++		match = match->next;
++
++	if (match && match->deleted)
++		return match;
++
++	match = name_set.n_hash[index];
++
++	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
++			 match->deleted))
++		match = match->next;
++
++	if (match && !match->deleted)
++		return match;
++	else
++		return NULL;
++}
++
++static struct inodev_entry *
++lookup_inodev_entry(const ino_t ino, const dev_t dev)
++{
++	unsigned int index = fhash(ino, dev, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
++		match = match->next;
++
++	return match;
++}
++
++static void
++insert_inodev_entry(struct inodev_entry *entry)
++{
++	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
++				    inodev_set.i_size);
++	struct inodev_entry **curr;
++
++	entry->prev = NULL;
++
++	curr = &inodev_set.i_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = entry;
++	
++	entry->next = *curr;
++	*curr = entry;
++
++	return;
++}
++
++static void
++__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
++{
++	unsigned int index =
++	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
++	struct acl_role_label **curr;
++	struct acl_role_label *tmp;
++
++	curr = &acl_role_set.r_hash[index];
++
++	/* if role was already inserted due to domains and already has
++	   a role in the same bucket as it attached, then we need to
++	   combine these two buckets
++	*/
++	if (role->next) {
++		tmp = role->next;
++		while (tmp->next)
++			tmp = tmp->next;
++		tmp->next = *curr;
++	} else
++		role->next = *curr;
++	*curr = role;
++
++	return;
++}
++
++static void
++insert_acl_role_label(struct acl_role_label *role)
++{
++	int i;
++
++	if (role_list == NULL) {
++		role_list = role;
++		role->prev = NULL;
++	} else {
++		role->prev = role_list;
++		role_list = role;
++	}
++	
++	/* used for hash chains */
++	role->next = NULL;
++
++	if (role->roletype & GR_ROLE_DOMAIN) {
++		for (i = 0; i < role->domain_child_num; i++)
++			__insert_acl_role_label(role, role->domain_children[i]);
++	} else
++		__insert_acl_role_label(role, role->uidgid);
++}
++					
++static int
++insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
++{
++	struct name_entry **curr, *nentry;
++	struct inodev_entry *ientry;
++	unsigned int len = strlen(name);
++	unsigned int key = full_name_hash(name, len);
++	unsigned int index = key % name_set.n_size;
++
++	curr = &name_set.n_hash[index];
++
++	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
++		curr = &((*curr)->next);
++
++	if (*curr != NULL)
++		return 1;
++
++	nentry = acl_alloc(sizeof (struct name_entry));
++	if (nentry == NULL)
++		return 0;
++	ientry = acl_alloc(sizeof (struct inodev_entry));
++	if (ientry == NULL)
++		return 0;
++	ientry->nentry = nentry;
++
++	nentry->key = key;
++	nentry->name = name;
++	nentry->inode = inode;
++	nentry->device = device;
++	nentry->len = len;
++	nentry->deleted = deleted;
++
++	nentry->prev = NULL;
++	curr = &name_set.n_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = nentry;
++	nentry->next = *curr;
++	*curr = nentry;
++
++	/* insert us into the table searchable by inode/dev */
++	insert_inodev_entry(ientry);
++
++	return 1;
++}
++
++static void
++insert_acl_obj_label(struct acl_object_label *obj,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index =
++	    fhash(obj->inode, obj->device, subj->obj_hash_size);
++	struct acl_object_label **curr;
++
++	
++	obj->prev = NULL;
++
++	curr = &subj->obj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++static void
++insert_acl_subj_label(struct acl_subject_label *obj,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
++	struct acl_subject_label **curr;
++
++	obj->prev = NULL;
++
++	curr = &role->subj_hash[index];
++	if (*curr != NULL)
++		(*curr)->prev = obj;
++
++	obj->next = *curr;
++	*curr = obj;
++
++	return;
++}
++
++/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
++
++static void *
++create_table(__u32 * len, int elementsize)
++{
++	unsigned int table_sizes[] = {
++		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
++		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
++		4194301, 8388593, 16777213, 33554393, 67108859
++	};
++	void *newtable = NULL;
++	unsigned int pwr = 0;
++
++	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
++	       table_sizes[pwr] <= *len)
++		pwr++;
++
++	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
++		return newtable;
++
++	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
++		newtable =
++		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
++	else
++		newtable = vmalloc(table_sizes[pwr] * elementsize);
++
++	*len = table_sizes[pwr];
++
++	return newtable;
++}
++
++static int
++init_variables(const struct gr_arg *arg)
++{
++	struct task_struct *reaper = &init_task;
++	unsigned int stacksize;
++
++	subj_map_set.s_size = arg->role_db.num_subjects;
++	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
++	name_set.n_size = arg->role_db.num_objects;
++	inodev_set.i_size = arg->role_db.num_objects;
++
++	if (!subj_map_set.s_size || !acl_role_set.r_size ||
++	    !name_set.n_size || !inodev_set.i_size)
++		return 1;
++
++	if (!gr_init_uidset())
++		return 1;
++
++	/* set up the stack that holds allocation info */
++
++	stacksize = arg->role_db.num_pointers + 5;
++
++	if (!acl_alloc_stack_init(stacksize))
++		return 1;
++
++	/* grab reference for the real root dentry and vfsmount */
++	read_lock(&reaper->fs->lock);
++	real_root_mnt = mntget(reaper->fs->root.mnt);
++	real_root = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++	
++	fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
++	if (fakefs_obj == NULL)
++		return 1;
++	fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
++
++	subj_map_set.s_hash =
++	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
++	acl_role_set.r_hash =
++	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
++	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
++	inodev_set.i_hash =
++	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
++
++	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
++	    !name_set.n_hash || !inodev_set.i_hash)
++		return 1;
++
++	memset(subj_map_set.s_hash, 0,
++	       sizeof(struct subject_map *) * subj_map_set.s_size);
++	memset(acl_role_set.r_hash, 0,
++	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
++	memset(name_set.n_hash, 0,
++	       sizeof (struct name_entry *) * name_set.n_size);
++	memset(inodev_set.i_hash, 0,
++	       sizeof (struct inodev_entry *) * inodev_set.i_size);
++
++	return 0;
++}
++
++/* free information not needed after startup
++   currently contains user->kernel pointer mappings for subjects
++*/
++
++static void
++free_init_variables(void)
++{
++	__u32 i;
++
++	if (subj_map_set.s_hash) {
++		for (i = 0; i < subj_map_set.s_size; i++) {
++			if (subj_map_set.s_hash[i]) {
++				kfree(subj_map_set.s_hash[i]);
++				subj_map_set.s_hash[i] = NULL;
++			}
++		}
++
++		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
++		    PAGE_SIZE)
++			kfree(subj_map_set.s_hash);
++		else
++			vfree(subj_map_set.s_hash);
++	}
++
++	return;
++}
++
++static void
++free_variables(void)
++{
++	struct acl_subject_label *s;
++	struct acl_role_label *r;
++	struct task_struct *task, *task2;
++	unsigned int x;
++
++	gr_clear_learn_entries();
++
++	read_lock(&tasklist_lock);
++	do_each_thread(task2, task) {
++		task->acl_sp_role = 0;
++		task->acl_role_id = 0;
++		task->acl = NULL;
++		task->role = NULL;
++	} while_each_thread(task2, task);
++	read_unlock(&tasklist_lock);
++
++	/* release the reference to the real root dentry and vfsmount */
++	if (real_root)
++		dput(real_root);
++	real_root = NULL;
++	if (real_root_mnt)
++		mntput(real_root_mnt);
++	real_root_mnt = NULL;
++
++	/* free all object hash tables */
++
++	FOR_EACH_ROLE_START(r)
++		if (r->subj_hash == NULL)
++			goto next_role;
++		FOR_EACH_SUBJECT_START(r, s, x)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_SUBJECT_END(s, x)
++		FOR_EACH_NESTED_SUBJECT_START(r, s)
++			if (s->obj_hash == NULL)
++				break;
++			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
++				kfree(s->obj_hash);
++			else
++				vfree(s->obj_hash);
++		FOR_EACH_NESTED_SUBJECT_END(s)
++		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
++			kfree(r->subj_hash);
++		else
++			vfree(r->subj_hash);
++		r->subj_hash = NULL;
++next_role:
++	FOR_EACH_ROLE_END(r)
++
++	acl_free_all();
++
++	if (acl_role_set.r_hash) {
++		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
++		    PAGE_SIZE)
++			kfree(acl_role_set.r_hash);
++		else
++			vfree(acl_role_set.r_hash);
++	}
++	if (name_set.n_hash) {
++		if ((name_set.n_size * sizeof (struct name_entry *)) <=
++		    PAGE_SIZE)
++			kfree(name_set.n_hash);
++		else
++			vfree(name_set.n_hash);
++	}
++
++	if (inodev_set.i_hash) {
++		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
++		    PAGE_SIZE)
++			kfree(inodev_set.i_hash);
++		else
++			vfree(inodev_set.i_hash);
++	}
++
++	gr_free_uidset();
++
++	memset(&name_set, 0, sizeof (struct name_db));
++	memset(&inodev_set, 0, sizeof (struct inodev_db));
++	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
++	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
++
++	default_role = NULL;
++	role_list = NULL;
++
++	return;
++}
++
++static __u32
++count_user_objs(struct acl_object_label *userp)
++{
++	struct acl_object_label o_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			break;
++
++		userp = o_tmp.prev;
++		num++;
++	}
++
++	return num;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
++
++static int
++copy_user_glob(struct acl_object_label *obj)
++{
++	struct acl_object_label *g_tmp, **guser;
++	unsigned int len;
++	char *tmp;
++
++	if (obj->globbed == NULL)
++		return 0;
++
++	guser = &obj->globbed;
++	while (*guser) {
++		g_tmp = (struct acl_object_label *)
++			acl_alloc(sizeof (struct acl_object_label));
++		if (g_tmp == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(g_tmp, *guser,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		len = strnlen_user(g_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, g_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		g_tmp->filename = tmp;
++
++		*guser = g_tmp;
++		guser = &(g_tmp->next);
++	}
++
++	return 0;
++}
++
++static int
++copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
++	       struct acl_role_label *role)
++{
++	struct acl_object_label *o_tmp;
++	unsigned int len;
++	int ret;
++	char *tmp;
++
++	while (userp) {
++		if ((o_tmp = (struct acl_object_label *)
++		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(o_tmp, userp,
++				   sizeof (struct acl_object_label)))
++			return -EFAULT;
++
++		userp = o_tmp->prev;
++
++		len = strnlen_user(o_tmp->filename, PATH_MAX);
++
++		if (!len || len >= PATH_MAX)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, o_tmp->filename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		o_tmp->filename = tmp;
++
++		insert_acl_obj_label(o_tmp, subj);
++		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
++				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
++			return -ENOMEM;
++
++		ret = copy_user_glob(o_tmp);
++		if (ret)
++			return ret;
++
++		if (o_tmp->nested) {
++			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
++			if (IS_ERR(o_tmp->nested))
++				return PTR_ERR(o_tmp->nested);
++
++			/* insert into nested subject list */
++			o_tmp->nested->next = role->hash->first;
++			role->hash->first = o_tmp->nested;
++		}
++	}
++
++	return 0;
++}
++
++static __u32
++count_user_subjs(struct acl_subject_label *userp)
++{
++	struct acl_subject_label s_tmp;
++	__u32 num = 0;
++
++	while (userp) {
++		if (copy_from_user(&s_tmp, userp,
++				   sizeof (struct acl_subject_label)))
++			break;
++
++		userp = s_tmp.prev;
++		/* do not count nested subjects against this count, since
++		   they are not included in the hash table, but are
++		   attached to objects.  We have already counted
++		   the subjects in userspace for the allocation 
++		   stack
++		*/
++		if (!(s_tmp.mode & GR_NESTED))
++			num++;
++	}
++
++	return num;
++}
++
++static int
++copy_user_allowedips(struct acl_role_label *rolep)
++{
++	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
++
++	ruserip = rolep->allowed_ips;
++
++	while (ruserip) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_allowed_ip *)
++		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, ruserip,
++				   sizeof (struct role_allowed_ip)))
++			return -EFAULT;
++
++		ruserip = rtmp->prev;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->allowed_ips = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!ruserip)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_transitions(struct acl_role_label *rolep)
++{
++	struct role_transition *rusertp, *rtmp = NULL, *rlast;
++	
++	unsigned int len;
++	char *tmp;
++
++	rusertp = rolep->transitions;
++
++	while (rusertp) {
++		rlast = rtmp;
++
++		if ((rtmp = (struct role_transition *)
++		     acl_alloc(sizeof (struct role_transition))) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(rtmp, rusertp,
++				   sizeof (struct role_transition)))
++			return -EFAULT;
++
++		rusertp = rtmp->prev;
++
++		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN)
++			return -EINVAL;
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL)
++			return -ENOMEM;
++
++		if (copy_from_user(tmp, rtmp->rolename, len))
++			return -EFAULT;
++		tmp[len-1] = '\0';
++		rtmp->rolename = tmp;
++
++		if (!rlast) {
++			rtmp->prev = NULL;
++			rolep->transitions = rtmp;
++		} else {
++			rlast->next = rtmp;
++			rtmp->prev = rlast;
++		}
++
++		if (!rusertp)
++			rtmp->next = NULL;
++	}
++
++	return 0;
++}
++
++static struct acl_subject_label *
++do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
++	unsigned int len;
++	char *tmp;
++	__u32 num_objs;
++	struct acl_ip_label **i_tmp, *i_utmp2;
++	struct gr_hash_struct ghash;
++	struct subject_map *subjmap;
++	unsigned int i_num;
++	int err;
++
++	s_tmp = lookup_subject_map(userp);
++
++	/* we've already copied this subject into the kernel, just return
++	   the reference to it, and don't copy it over again
++	*/
++	if (s_tmp)
++		return(s_tmp);
++
++	if ((s_tmp = (struct acl_subject_label *)
++	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
++	if (subjmap == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	subjmap->user = userp;
++	subjmap->kernel = s_tmp;
++	insert_subj_map_entry(subjmap);
++
++	if (copy_from_user(s_tmp, userp,
++			   sizeof (struct acl_subject_label)))
++		return ERR_PTR(-EFAULT);
++
++	len = strnlen_user(s_tmp->filename, PATH_MAX);
++
++	if (!len || len >= PATH_MAX)
++		return ERR_PTR(-EINVAL);
++
++	if ((tmp = (char *) acl_alloc(len)) == NULL)
++		return ERR_PTR(-ENOMEM);
++
++	if (copy_from_user(tmp, s_tmp->filename, len))
++		return ERR_PTR(-EFAULT);
++	tmp[len-1] = '\0';
++	s_tmp->filename = tmp;
++
++	if (!strcmp(s_tmp->filename, "/"))
++		role->root_label = s_tmp;
++
++	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
++		return ERR_PTR(-EFAULT);
++
++	/* copy user and group transition tables */
++
++	if (s_tmp->user_trans_num) {
++		uid_t *uidlist;
++
++		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
++		if (uidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->user_transitions = uidlist;
++	}
++
++	if (s_tmp->group_trans_num) {
++		gid_t *gidlist;
++
++		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
++		if (gidlist == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
++			return ERR_PTR(-EFAULT);
++
++		s_tmp->group_transitions = gidlist;
++	}
++
++	/* set up object hash table */
++	num_objs = count_user_objs(ghash.first);
++
++	s_tmp->obj_hash_size = num_objs;
++	s_tmp->obj_hash =
++	    (struct acl_object_label **)
++	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
++
++	if (!s_tmp->obj_hash)
++		return ERR_PTR(-ENOMEM);
++
++	memset(s_tmp->obj_hash, 0,
++	       s_tmp->obj_hash_size *
++	       sizeof (struct acl_object_label *));
++
++	/* add in objects */
++	err = copy_user_objs(ghash.first, s_tmp, role);
++
++	if (err)
++		return ERR_PTR(err);
++
++	/* set pointer for parent subject */
++	if (s_tmp->parent_subject) {
++		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
++
++		if (IS_ERR(s_tmp2))
++			return s_tmp2;
++
++		s_tmp->parent_subject = s_tmp2;
++	}
++
++	/* add in ip acls */
++
++	if (!s_tmp->ip_num) {
++		s_tmp->ips = NULL;
++		goto insert;
++	}
++
++	i_tmp =
++	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
++					       sizeof (struct acl_ip_label *));
++
++	if (!i_tmp)
++		return ERR_PTR(-ENOMEM);
++
++	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
++		*(i_tmp + i_num) =
++		    (struct acl_ip_label *)
++		    acl_alloc(sizeof (struct acl_ip_label));
++		if (!*(i_tmp + i_num))
++			return ERR_PTR(-ENOMEM);
++
++		if (copy_from_user
++		    (&i_utmp2, s_tmp->ips + i_num,
++		     sizeof (struct acl_ip_label *)))
++			return ERR_PTR(-EFAULT);
++
++		if (copy_from_user
++		    (*(i_tmp + i_num), i_utmp2,
++		     sizeof (struct acl_ip_label)))
++			return ERR_PTR(-EFAULT);
++		
++		if ((*(i_tmp + i_num))->iface == NULL)
++			continue;
++
++		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
++		if (!len || len >= IFNAMSIZ)
++			return ERR_PTR(-EINVAL);
++		tmp = acl_alloc(len);
++		if (tmp == NULL)
++			return ERR_PTR(-ENOMEM);
++		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
++			return ERR_PTR(-EFAULT);
++		(*(i_tmp + i_num))->iface = tmp;
++	}
++
++	s_tmp->ips = i_tmp;
++
++insert:
++	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
++			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
++		return ERR_PTR(-ENOMEM);
++
++	return s_tmp;
++}
++
++static int
++copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
++{
++	struct acl_subject_label s_pre;
++	struct acl_subject_label * ret;
++	int err;
++
++	while (userp) {
++		if (copy_from_user(&s_pre, userp,
++				   sizeof (struct acl_subject_label)))
++			return -EFAULT;
++		
++		/* do not add nested subjects here, add
++		   while parsing objects
++		*/
++
++		if (s_pre.mode & GR_NESTED) {
++			userp = s_pre.prev;
++			continue;
++		}
++
++		ret = do_copy_user_subj(userp, role);
++
++		err = PTR_ERR(ret);
++		if (IS_ERR(ret))
++			return err;
++
++		insert_acl_subj_label(ret, role);
++
++		userp = s_pre.prev;
++	}
++
++	return 0;
++}
++
++static int
++copy_user_acl(struct gr_arg *arg)
++{
++	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
++	struct sprole_pw *sptmp;
++	struct gr_hash_struct *ghash;
++	uid_t *domainlist;
++	unsigned int r_num;
++	unsigned int len;
++	char *tmp;
++	int err = 0;
++	__u16 i;
++	__u32 num_subjs;
++
++	/* we need a default and kernel role */
++	if (arg->role_db.num_roles < 2)
++		return -EINVAL;
++
++	/* copy special role authentication info from userspace */
++
++	num_sprole_pws = arg->num_sprole_pws;
++	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
++
++	if (!acl_special_roles) {
++		err = -ENOMEM;
++		goto cleanup;
++	}
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
++		if (!sptmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(sptmp, arg->sprole_pws + i,
++				   sizeof (struct sprole_pw))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len =
++		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= GR_SPROLE_LEN) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(tmp, sptmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++		printk(KERN_ALERT "Copying special role %s\n", tmp);
++#endif
++		sptmp->rolename = tmp;
++		acl_special_roles[i] = sptmp;
++	}
++
++	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
++
++	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
++		r_tmp = acl_alloc(sizeof (struct acl_role_label));
++
++		if (!r_tmp) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		if (copy_from_user(&r_utmp2, r_utmp + r_num,
++				   sizeof (struct acl_role_label *))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		if (copy_from_user(r_tmp, r_utmp2,
++				   sizeof (struct acl_role_label))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
++
++		if (!len || len >= PATH_MAX) {
++			err = -EINVAL;
++			goto cleanup;
++		}
++
++		if ((tmp = (char *) acl_alloc(len)) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(tmp, r_tmp->rolename, len)) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++		tmp[len-1] = '\0';
++		r_tmp->rolename = tmp;
++
++		if (!strcmp(r_tmp->rolename, "default")
++		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
++			default_role = r_tmp;
++		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
++			kernel_role = r_tmp;
++		}
++
++		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
++			err = -EFAULT;
++			goto cleanup;
++		}
++
++		r_tmp->hash = ghash;
++
++		num_subjs = count_user_subjs(r_tmp->hash->first);
++
++		r_tmp->subj_hash_size = num_subjs;
++		r_tmp->subj_hash =
++		    (struct acl_subject_label **)
++		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
++
++		if (!r_tmp->subj_hash) {
++			err = -ENOMEM;
++			goto cleanup;
++		}
++
++		err = copy_user_allowedips(r_tmp);
++		if (err)
++			goto cleanup;
++
++		/* copy domain info */
++		if (r_tmp->domain_children != NULL) {
++			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
++			if (domainlist == NULL) {
++				err = -ENOMEM;
++				goto cleanup;
++			}
++			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
++				err = -EFAULT;
++				goto cleanup;
++			}
++			r_tmp->domain_children = domainlist;
++		}
++
++		err = copy_user_transitions(r_tmp);
++		if (err)
++			goto cleanup;
++
++		memset(r_tmp->subj_hash, 0,
++		       r_tmp->subj_hash_size *
++		       sizeof (struct acl_subject_label *));
++
++		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
++
++		if (err)
++			goto cleanup;
++
++		/* set nested subject list to null */
++		r_tmp->hash->first = NULL;
++
++		insert_acl_role_label(r_tmp);
++	}
++
++	goto return_err;
++      cleanup:
++	free_variables();
++      return_err:
++	return err;
++
++}
++
++static int
++gracl_init(struct gr_arg *args)
++{
++	int error = 0;
++
++	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
++	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
++
++	if (init_variables(args)) {
++		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
++		error = -ENOMEM;
++		free_variables();
++		goto out;
++	}
++
++	error = copy_user_acl(args);
++	free_init_variables();
++	if (error) {
++		free_variables();
++		goto out;
++	}
++
++	if ((error = gr_set_acls(0))) {
++		free_variables();
++		goto out;
++	}
++
++	pax_open_kernel();
++	gr_status |= GR_READY;
++	pax_close_kernel();
++
++      out:
++	return error;
++}
++
++/* derived from glibc fnmatch() 0: match, 1: no match*/
++
++static int
++glob_match(const char *p, const char *n)
++{
++	char c;
++
++	while ((c = *p++) != '\0') {
++	switch (c) {
++		case '?':
++			if (*n == '\0')
++				return 1;
++			else if (*n == '/')
++				return 1;
++			break;
++		case '\\':
++			if (*n != c)
++				return 1;
++			break;
++		case '*':
++			for (c = *p++; c == '?' || c == '*'; c = *p++) {
++				if (*n == '/')
++					return 1;
++				else if (c == '?') {
++					if (*n == '\0')
++						return 1;
++					else
++						++n;
++				}
++			}
++			if (c == '\0') {
++				return 0;
++			} else {
++				const char *endp;
++
++				if ((endp = strchr(n, '/')) == NULL)
++					endp = n + strlen(n);
++
++				if (c == '[') {
++					for (--p; n < endp; ++n)
++						if (!glob_match(p, n))
++							return 0;
++				} else if (c == '/') {
++					while (*n != '\0' && *n != '/')
++						++n;
++					if (*n == '/' && !glob_match(p, n + 1))
++						return 0;
++				} else {
++					for (--p; n < endp; ++n)
++						if (*n == c && !glob_match(p, n))
++							return 0;
++				}
++
++				return 1;
++			}
++		case '[':
++			{
++			int not;
++			char cold;
++
++			if (*n == '\0' || *n == '/')
++				return 1;
++
++			not = (*p == '!' || *p == '^');
++			if (not)
++				++p;
++
++			c = *p++;
++			for (;;) {
++				unsigned char fn = (unsigned char)*n;
++
++				if (c == '\0')
++					return 1;
++				else {
++					if (c == fn)
++						goto matched;
++					cold = c;
++					c = *p++;
++
++					if (c == '-' && *p != ']') {
++						unsigned char cend = *p++;
++
++						if (cend == '\0')
++							return 1;
++
++						if (cold <= fn && fn <= cend)
++							goto matched;
++
++						c = *p++;
++					}
++				}
++
++				if (c == ']')
++					break;
++			}
++			if (!not)
++				return 1;
++			break;
++		matched:
++			while (c != ']') {
++				if (c == '\0')
++					return 1;
++
++				c = *p++;
++			}
++			if (not)
++				return 1;
++		}
++		break;
++	default:
++		if (c != *n)
++			return 1;
++	}
++
++	++n;
++	}
++
++	if (*n == '\0')
++		return 0;
++
++	if (*n == '/')
++		return 0;
++
++	return 1;
++}
++
++static struct acl_object_label *
++chk_glob_label(struct acl_object_label *globbed,
++	struct dentry *dentry, struct vfsmount *mnt, char **path)
++{
++	struct acl_object_label *tmp;
++
++	if (*path == NULL)
++		*path = gr_to_filename_nolock(dentry, mnt);
++
++	tmp = globbed;
++
++	while (tmp) {
++		if (!glob_match(tmp->filename, *path))
++			return tmp;
++		tmp = tmp->next;
++	}
++
++	return NULL;
++}
++
++static struct acl_object_label *
++__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const ino_t curr_ino, const dev_t curr_dev,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	struct acl_subject_label *tmpsubj;
++	struct acl_object_label *retval;
++	struct acl_object_label *retval2;
++
++	tmpsubj = (struct acl_subject_label *) subj;
++	read_lock(&gr_inode_lock);
++	do {
++		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
++		if (retval) {
++			if (checkglob && retval->globbed) {
++				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
++						(struct vfsmount *)orig_mnt, path);
++				if (retval2)
++					retval = retval2;
++			}
++			break;
++		}
++	} while ((tmpsubj = tmpsubj->parent_subject));
++	read_unlock(&gr_inode_lock);
++
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
++	    const struct dentry *curr_dentry,
++	    const struct acl_subject_label *subj, char **path, const int checkglob)
++{
++	return __full_lookup(orig_dentry, orig_mnt,
++			     curr_dentry->d_inode->i_ino, 
++			     curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
++}
++
++static struct acl_object_label *
++__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj, char *path, const int checkglob)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_object_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
++#ifdef CONFIG_HUGETLBFS
++	    mnt == hugetlbfs_vfsmount ||
++#endif
++		/* ignore Eric Biederman */
++	    IS_PRIVATE(l_dentry->d_inode))) {
++		retval = fakefs_obj;
++		goto out;
++	}
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
++
++	if (retval == NULL)
++		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
++out:
++	spin_unlock(&dcache_lock);
++	return retval;
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	      const struct acl_subject_label *subj)
++{
++	char *path = NULL;
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
++}
++
++static __inline__ struct acl_object_label *
++chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++		     const struct acl_subject_label *subj, char *path)
++{
++	return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
++}
++
++static struct acl_subject_label *
++chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
++	       const struct acl_role_label *role)
++{
++	struct dentry *dentry = (struct dentry *) l_dentry;
++	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
++	struct acl_subject_label *retval;
++
++	spin_lock(&dcache_lock);
++
++	for (;;) {
++		if (dentry == real_root && mnt == real_root_mnt)
++			break;
++		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
++			if (mnt->mnt_parent == mnt)
++				break;
++
++			read_lock(&gr_inode_lock);
++			retval =
++				lookup_acl_subj_label(dentry->d_inode->i_ino,
++						dentry->d_inode->i_sb->s_dev, role);
++			read_unlock(&gr_inode_lock);
++			if (retval != NULL)
++				goto out;
++
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++					  dentry->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++		if (retval != NULL)
++			goto out;
++
++		dentry = dentry->d_parent;
++	}
++
++	read_lock(&gr_inode_lock);
++	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
++				  dentry->d_inode->i_sb->s_dev, role);
++	read_unlock(&gr_inode_lock);
++
++	if (unlikely(retval == NULL)) {
++		read_lock(&gr_inode_lock);
++		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
++					  real_root->d_inode->i_sb->s_dev, role);
++		read_unlock(&gr_inode_lock);
++	}
++out:
++	spin_unlock(&dcache_lock);
++
++	return retval;
++}
++
++static void
++gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_sysctl(const char *path, const __u32 mode)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
++
++	return;
++}
++
++static void
++gr_log_learn_id_change(const char type, const unsigned int real, 
++		       const unsigned int effective, const unsigned int fs)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++
++	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
++		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
++		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
++		       type, real, effective, fs, &task->signal->curr_ip);
++
++	return;
++}
++
++__u32
++gr_check_link(const struct dentry * new_dentry,
++	      const struct dentry * parent_dentry,
++	      const struct vfsmount * parent_mnt,
++	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
++{
++	struct acl_object_label *obj;
++	__u32 oldmode, newmode;
++	__u32 needmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (GR_CREATE | GR_LINK);
++
++	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
++	oldmode = obj->mode;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		oldmode |= (GR_CREATE | GR_LINK);
++
++	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID | GR_AUDIT_SETID;
++
++	newmode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    oldmode | needmode);
++
++	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
++			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
++			      GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
++		goto bad;
++
++	if ((oldmode & needmode) != needmode)
++		goto bad;
++
++	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
++	if ((newmode & needmode) != needmode)
++		goto bad;
++
++	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
++		return newmode;
++bad:
++	needmode = oldmode;
++	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
++		needmode |= GR_SETID;
++	
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		gr_log_learn(old_dentry, old_mnt, needmode);
++		return (GR_CREATE | GR_LINK);
++	} else if (newmode & GR_SUPPRESS)
++		return GR_SUPPRESS;
++	else
++		return 0;
++}
++
++__u32
++gr_search_file(const struct dentry * dentry, const __u32 mode,
++	       const struct vfsmount * mnt)
++{
++	__u32 retval = mode;
++	struct acl_subject_label *curracl;
++	struct acl_object_label *currobj;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	curracl = current->acl;
++
++	currobj = chk_obj_label(dentry, mnt, curracl);
++	retval = currobj->mode & mode;
++
++	if (unlikely
++	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
++	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		retval = new_mode;
++
++		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
++			new_mode |= GR_INHERIT;
++
++		if (!(mode & GR_NOLEARN))
++			gr_log_learn(dentry, mnt, new_mode);
++	}
++
++	return retval;
++}
++
++__u32
++gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
++		const struct vfsmount * mnt, const __u32 mode)
++{
++	struct name_entry *match;
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *curracl;
++	char *path;
++	__u32 retval;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return (mode & ~GR_AUDITS);
++
++	preempt_disable();
++	path = gr_to_filename_rbac(new_dentry, mnt);
++	match = lookup_name_entry_create(path);
++
++	if (!match)
++		goto check_parent;
++
++	curracl = current->acl;
++
++	read_lock(&gr_inode_lock);
++	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
++	read_unlock(&gr_inode_lock);
++
++	if (matchpo) {
++		if ((matchpo->mode & mode) !=
++		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
++		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
++			__u32 new_mode = mode;
++
++			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++			gr_log_learn(new_dentry, mnt, new_mode);
++
++			preempt_enable();
++			return new_mode;
++		}
++		preempt_enable();
++		return (matchpo->mode & mode);
++	}
++
++      check_parent:
++	curracl = current->acl;
++
++	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
++	retval = matchpo->mode & mode;
++
++	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
++	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		gr_log_learn(new_dentry, mnt, new_mode);
++		preempt_enable();
++		return new_mode;
++	}
++
++	preempt_enable();
++	return retval;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	if (unlikely(!(gr_status & GR_READY) || !task))
++		return 0;
++
++	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
++	    task->acl != current->acl)
++		return 1;
++
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	tsk->signal->used_accept = 0;
++	tsk->acl_sp_role = 0;
++	tsk->acl_role_id = current->acl_role_id;
++	tsk->acl = current->acl;
++	tsk->role = current->role;
++	tsk->signal->curr_ip = current->signal->curr_ip;
++	if (current->exec_file)
++		get_file(current->exec_file);
++	tsk->exec_file = current->exec_file;
++	tsk->is_writable = current->is_writable;
++	if (unlikely(current->signal->used_accept))
++		current->signal->curr_ip = 0;
++
++	return;
++}
++
++static void
++gr_set_proc_res(struct task_struct *task)
++{
++	struct acl_subject_label *proc;
++	unsigned short i;
++
++	proc = task->acl;
++
++	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
++		return;
++
++	for (i = 0; i < RLIM_NLIMITS; i++) {
++		if (!(proc->resmask & (1 << i)))
++			continue;
++
++		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
++		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
++	}
++
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	uid_t *uidlist;
++	int curuid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('u', real, effective, fs);
++
++	num = current->acl->user_trans_num;
++	uidlist = current->acl->user_transitions;
++
++	if (uidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->user_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				realok = 1;
++			if (effective == curuid)
++				effectiveok = 1;
++			if (fs == curuid)
++				fsok = 1;
++		}
++	} else if (current->acl->user_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curuid = (int)uidlist[i];
++			if (real == curuid)
++				break;
++			if (effective == curuid)
++				break;
++			if (fs == curuid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	unsigned int i;
++	__u16 num;
++	gid_t *gidlist;
++	int curgid;
++	int realok = 0;
++	int effectiveok = 0;
++	int fsok = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		gr_log_learn_id_change('g', real, effective, fs);
++
++	num = current->acl->group_trans_num;
++	gidlist = current->acl->group_transitions;
++
++	if (gidlist == NULL)
++		return 0;
++
++	if (real == -1)
++		realok = 1;
++	if (effective == -1)
++		effectiveok = 1;
++	if (fs == -1)
++		fsok = 1;
++
++	if (current->acl->group_trans_type & GR_ID_ALLOW) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				realok = 1;
++			if (effective == curgid)
++				effectiveok = 1;
++			if (fs == curgid)
++				fsok = 1;
++		}
++	} else if (current->acl->group_trans_type & GR_ID_DENY) {
++		for (i = 0; i < num; i++) {
++			curgid = (int)gidlist[i];
++			if (real == curgid)
++				break;
++			if (effective == curgid)
++				break;
++			if (fs == curgid)
++				break;
++		}
++		/* not in deny list */
++		if (i == num) {
++			realok = 1;
++			effectiveok = 1;
++			fsok = 1;
++		}
++	}
++
++	if (realok && effectiveok && fsok)
++		return 0;
++	else {
++		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
++		return 1;
++	}
++}
++
++void
++gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
++{
++	struct acl_role_label *role = task->role;
++	struct acl_subject_label *subj = NULL;
++	struct acl_object_label *obj;
++	struct file *filp;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	filp = task->exec_file;
++
++	/* kernel process, we'll give them the kernel role */
++	if (unlikely(!filp)) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++		return;
++	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
++		role = lookup_acl_role_label(task, uid, gid);
++
++	/* perform subject lookup in possibly new role
++	   we can use this result below in the case where role == task->role
++	*/
++	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
++
++	/* if we changed uid/gid, but result in the same role
++	   and are using inheritance, don't lose the inherited subject
++	   if current subject is other than what normal lookup
++	   would result in, we arrived via inheritance, don't
++	   lose subject
++	*/
++	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
++				   (subj == task->acl)))
++		task->acl = subj;
++
++	task->role = role;
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++
++	gr_set_proc_res(task);
++
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	struct task_struct *task = current;
++	struct acl_subject_label *newacl;
++	struct acl_object_label *obj;
++	__u32 retmode;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	newacl = chk_subj_label(dentry, mnt, task->role);
++
++	task_lock(task);
++	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
++	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
++	     !(task->role->roletype & GR_ROLE_GOD) &&
++	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
++	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
++                task_unlock(task);
++		if (unsafe_share)
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
++		else
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
++		return -EACCES;
++	}
++	task_unlock(task);
++
++	obj = chk_obj_label(dentry, mnt, task->acl);
++	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
++
++	if (!(task->acl->mode & GR_INHERITLEARN) &&
++	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
++		if (obj->nested)
++			task->acl = obj->nested;
++		else
++			task->acl = newacl;
++	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
++		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
++
++	task->is_writable = 0;
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(dentry, mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++	obj = chk_obj_label(dentry, mnt, task->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		task->is_writable = 1;
++
++	gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++	return 0;
++}
++
++/* always called with valid inodev ptr */
++static void
++do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
++{
++	struct acl_object_label *matchpo;
++	struct acl_subject_label *matchps;
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++
++	FOR_EACH_ROLE_START(role)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
++				matchpo->mode |= GR_DELETED;
++		FOR_EACH_SUBJECT_END(subj,x)
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if (subj->inode == ino && subj->device == dev)
++				subj->mode |= GR_DELETED;
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
++			matchps->mode |= GR_DELETED;
++	FOR_EACH_ROLE_END(role)
++
++	inodev->nentry->deleted = 1;
++
++	return;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	struct inodev_entry *inodev;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	write_lock(&gr_inode_lock);
++	inodev = lookup_inodev_entry(ino, dev);
++	if (inodev != NULL)
++		do_handle_delete(inodev, ino, dev);
++	write_unlock(&gr_inode_lock);
++
++	return;
++}
++
++static void
++update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
++		     const ino_t newinode, const dev_t newdevice,
++		     struct acl_subject_label *subj)
++{
++	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
++	struct acl_object_label *match;
++
++	match = subj->obj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			subj->obj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_obj_label(match, subj);
++	}
++
++	return;
++}
++
++static void
++update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
++		      const ino_t newinode, const dev_t newdevice,
++		      struct acl_role_label *role)
++{
++	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
++	struct acl_subject_label *match;
++
++	match = role->subj_hash[index];
++
++	while (match && (match->inode != oldinode ||
++	       match->device != olddevice ||
++	       !(match->mode & GR_DELETED)))
++		match = match->next;
++
++	if (match && (match->inode == oldinode)
++	    && (match->device == olddevice)
++	    && (match->mode & GR_DELETED)) {
++		if (match->prev == NULL) {
++			role->subj_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->inode = newinode;
++		match->device = newdevice;
++		match->mode &= ~GR_DELETED;
++
++		insert_acl_subj_label(match, role);
++	}
++
++	return;
++}
++
++static void
++update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
++		    const ino_t newinode, const dev_t newdevice)
++{
++	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
++	struct inodev_entry *match;
++
++	match = inodev_set.i_hash[index];
++
++	while (match && (match->nentry->inode != oldinode ||
++	       match->nentry->device != olddevice || !match->nentry->deleted))
++		match = match->next;
++
++	if (match && (match->nentry->inode == oldinode)
++	    && (match->nentry->device == olddevice) &&
++	    match->nentry->deleted) {
++		if (match->prev == NULL) {
++			inodev_set.i_hash[index] = match->next;
++			if (match->next != NULL)
++				match->next->prev = NULL;
++		} else {
++			match->prev->next = match->next;
++			if (match->next != NULL)
++				match->next->prev = match->prev;
++		}
++		match->prev = NULL;
++		match->next = NULL;
++		match->nentry->inode = newinode;
++		match->nentry->device = newdevice;
++		match->nentry->deleted = 0;
++
++		insert_inodev_entry(match);
++	}
++
++	return;
++}
++
++static void
++do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
++		 const struct vfsmount *mnt)
++{
++	struct acl_subject_label *subj;
++	struct acl_role_label *role;
++	unsigned int x;
++	
++	FOR_EACH_ROLE_START(role)
++		update_acl_subj_label(matchn->inode, matchn->device,
++				      dentry->d_inode->i_ino,
++				      dentry->d_inode->i_sb->s_dev, role);
++
++		FOR_EACH_NESTED_SUBJECT_START(role, subj)
++			if ((subj->inode == dentry->d_inode->i_ino) &&
++			    (subj->device == dentry->d_inode->i_sb->s_dev)) {
++				subj->inode = dentry->d_inode->i_ino;
++				subj->device = dentry->d_inode->i_sb->s_dev;
++			}
++		FOR_EACH_NESTED_SUBJECT_END(subj)
++		FOR_EACH_SUBJECT_START(role, subj, x)
++			update_acl_obj_label(matchn->inode, matchn->device,
++					     dentry->d_inode->i_ino,
++					     dentry->d_inode->i_sb->s_dev, subj);
++		FOR_EACH_SUBJECT_END(subj,x)
++	FOR_EACH_ROLE_END(role)
++
++	update_inodev_entry(matchn->inode, matchn->device,
++			    dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
++
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	struct name_entry *matchn;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
++
++	if (unlikely((unsigned long)matchn)) {
++		write_lock(&gr_inode_lock);
++		do_handle_create(matchn, dentry, mnt);
++		write_unlock(&gr_inode_lock);
++	}
++	preempt_enable();
++
++	return;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	struct name_entry *matchn;
++	struct inodev_entry *inodev;
++
++	/* vfs_rename swaps the name and parent link for old_dentry and
++	   new_dentry
++	   at this point, old_dentry has the new name, parent link, and inode
++	   for the renamed file
++	   if a file is being replaced by a rename, new_dentry has the inode
++	   and name for the replaced file
++	*/
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return;
++
++	preempt_disable();
++	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
++
++	/* we wouldn't have to check d_inode if it weren't for
++	   NFS silly-renaming
++	 */
++
++	write_lock(&gr_inode_lock);
++	if (unlikely(replace && new_dentry->d_inode)) {
++		inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
++					     new_dentry->d_inode->i_sb->s_dev);
++		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
++			do_handle_delete(inodev, new_dentry->d_inode->i_ino,
++					 new_dentry->d_inode->i_sb->s_dev);
++	}
++
++	inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
++				     old_dentry->d_inode->i_sb->s_dev);
++	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
++		do_handle_delete(inodev, old_dentry->d_inode->i_ino,
++				 old_dentry->d_inode->i_sb->s_dev);
++
++	if (unlikely((unsigned long)matchn))
++		do_handle_create(matchn, old_dentry, mnt);
++
++	write_unlock(&gr_inode_lock);
++	preempt_enable();
++
++	return;
++}
++
++static int
++lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
++			 unsigned char **sum)
++{
++	struct acl_role_label *r;
++	struct role_allowed_ip *ipp;
++	struct role_transition *trans;
++	unsigned int i;
++	int found = 0;
++
++	/* check transition table */
++
++	for (trans = current->role->transitions; trans; trans = trans->next) {
++		if (!strcmp(rolename, trans->rolename)) {
++			found = 1;
++			break;
++		}
++	}
++
++	if (!found)
++		return 0;
++
++	/* handle special roles that do not require authentication
++	   and check ip */
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			found = 0;
++			if (r->allowed_ips != NULL) {
++				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
++					if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
++					     (ntohl(ipp->addr) & ipp->netmask))
++						found = 1;
++				}
++			} else
++				found = 2;
++			if (!found)
++				return 0;
++
++			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
++			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
++				*salt = NULL;
++				*sum = NULL;
++				return 1;
++			}
++		}
++	FOR_EACH_ROLE_END(r)
++
++	for (i = 0; i < num_sprole_pws; i++) {
++		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
++			*salt = acl_special_roles[i]->salt;
++			*sum = acl_special_roles[i]->sum;
++			return 1;
++		}
++	}
++
++	return 0;
++}
++
++static void
++assign_special_role(char *rolename)
++{
++	struct acl_object_label *obj;
++	struct acl_role_label *r;
++	struct acl_role_label *assigned = NULL;
++	struct task_struct *tsk;
++	struct file *filp;
++
++	FOR_EACH_ROLE_START(r)
++		if (!strcmp(rolename, r->rolename) &&
++		    (r->roletype & GR_ROLE_SPECIAL)) {
++			assigned = r;
++			break;
++		}
++	FOR_EACH_ROLE_END(r)
++
++	if (!assigned)
++		return;
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++
++	tsk = current->parent;
++	if (tsk == NULL)
++		goto out_unlock;
++
++	filp = tsk->exec_file;
++	if (filp == NULL)
++		goto out_unlock;
++
++	tsk->is_writable = 0;
++
++	tsk->acl_sp_role = 1;
++	tsk->acl_role_id = ++acl_sp_role_value;
++	tsk->role = assigned;
++	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
++
++	/* ignore additional mmap checks for processes that are writable 
++	   by the default ACL */
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
++	if (unlikely(obj->mode & GR_WRITE))
++		tsk->is_writable = 1;
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
++#endif
++
++out_unlock:
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	return;
++}
++
++int gr_check_secure_terminal(struct task_struct *task)
++{
++	struct task_struct *p, *p2, *p3;
++	struct files_struct *files;
++	struct fdtable *fdt;
++	struct file *our_file = NULL, *file;
++	int i;
++
++	if (task->signal->tty == NULL)
++		return 1;
++
++	files = get_files_struct(task);
++	if (files != NULL) {
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
++				get_file(file);
++				our_file = file;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	}
++
++	if (our_file == NULL)
++		return 1;
++
++	read_lock(&tasklist_lock);
++	do_each_thread(p2, p) {
++		files = get_files_struct(p);
++		if (files == NULL ||
++		    (p->signal && p->signal->tty == task->signal->tty)) {
++			if (files != NULL)
++				put_files_struct(files);
++			continue;
++		}
++		rcu_read_lock();
++		fdt = files_fdtable(files);
++		for (i=0; i < fdt->max_fds; i++) {
++			file = fcheck_files(files, i);
++			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
++			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
++				p3 = task;
++				while (p3->pid > 0) {
++					if (p3 == p)
++						break;
++					p3 = p3->parent;
++				}
++				if (p3 == p)
++					break;
++				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
++				gr_handle_alertkill(p);
++				rcu_read_unlock();
++				put_files_struct(files);
++				read_unlock(&tasklist_lock);
++				fput(our_file);
++				return 0;
++			}
++		}
++		rcu_read_unlock();
++		put_files_struct(files);
++	} while_each_thread(p2, p);
++	read_unlock(&tasklist_lock);
++
++	fput(our_file);
++	return 1;
++}
++
++ssize_t
++write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
++{
++	struct gr_arg_wrapper uwrap;
++	unsigned char *sprole_salt = NULL;
++	unsigned char *sprole_sum = NULL;
++	int error = sizeof (struct gr_arg_wrapper);
++	int error2 = 0;
++
++	down(&gr_dev_sem);
++
++	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
++		error = -EPERM;
++		goto out;
++	}
++
++	if (count != sizeof (struct gr_arg_wrapper)) {
++		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
++		error = -EINVAL;
++		goto out;
++	}
++
++	
++	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
++		gr_auth_expires = 0;
++		gr_auth_attempts = 0;
++	}
++
++	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
++		error = -EINVAL;
++		goto out;
++	}
++
++	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
++		error = -EFAULT;
++		goto out;
++	}
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++	    time_after(gr_auth_expires, get_seconds())) {
++		error = -EBUSY;
++		goto out;
++	}
++
++	/* if non-root trying to do anything other than use a special role,
++	   do not attempt authentication, do not count towards authentication
++	   locking
++	 */
++
++	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
++	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
++	    current_uid()) {
++		error = -EPERM;
++		goto out;
++	}
++
++	/* ensure pw and special role name are null terminated */
++
++	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
++	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
++
++	/* Okay. 
++	 * We have our enough of the argument structure..(we have yet
++	 * to copy_from_user the tables themselves) . Copy the tables
++	 * only if we need them, i.e. for loading operations. */
++
++	switch (gr_usermode->mode) {
++	case GR_STATUS:
++			if (gr_status & GR_READY) {
++				error = 1;
++				if (!gr_check_secure_terminal(current))
++					error = 3;
++			} else
++				error = 2;
++			goto out;
++	case GR_SHUTDOWN:
++		if ((gr_status & GR_READY)
++		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
++			free_variables();
++			memset(gr_usermode, 0, sizeof (struct gr_arg));
++			memset(gr_system_salt, 0, GR_SALT_LEN);
++			memset(gr_system_sum, 0, GR_SHA_LEN);
++		} else if (gr_status & GR_READY) {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
++			error = -EPERM;
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
++			error = -EAGAIN;
++		}
++		break;
++	case GR_ENABLE:
++		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
++		else {
++			if (gr_status & GR_READY)
++				error = -EAGAIN;
++			else
++				error = error2;
++			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
++		}
++		break;
++	case GR_RELOAD:
++		if (!(gr_status & GR_READY)) {
++			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
++			error = -EAGAIN;
++		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			lock_kernel();
++
++			pax_open_kernel();
++			gr_status &= ~GR_READY;
++			pax_close_kernel();
++
++			free_variables();
++			if (!(error2 = gracl_init(gr_usermode))) {
++				unlock_kernel();
++				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
++			} else {
++				unlock_kernel();
++				error = error2;
++				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			}
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
++			error = -EPERM;
++		}
++		break;
++	case GR_SEGVMOD:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
++			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
++				struct acl_subject_label *segvacl;
++				segvacl =
++				    lookup_acl_subj_label(gr_usermode->segv_inode,
++							  gr_usermode->segv_device,
++							  current->role);
++				if (segvacl) {
++					segvacl->crashes = 0;
++					segvacl->expires = 0;
++				}
++			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
++				gr_remove_uid(gr_usermode->segv_uid);
++			}
++		} else {
++			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
++			error = -EPERM;
++		}
++		break;
++	case GR_SPROLE:
++	case GR_SPROLEPAM:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
++			current->role->expires = 0;
++			current->role->auth_attempts = 0;
++		}
++
++		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
++		    time_after(current->role->expires, get_seconds())) {
++			error = -EBUSY;
++			goto out;
++		}
++
++		if (lookup_special_role_auth
++		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
++		    && ((!sprole_salt && !sprole_sum)
++			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
++			char *p = "";
++			assign_special_role(gr_usermode->sp_role);
++			read_lock(&tasklist_lock);
++			if (current->parent)
++				p = current->parent->role->rolename;
++			read_unlock(&tasklist_lock);
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
++					p, acl_sp_role_value);
++		} else {
++			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
++			error = -EPERM;
++			if(!(current->role->auth_attempts++))
++				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++			goto out;
++		}
++		break;
++	case GR_UNSPROLE:
++		if (unlikely(!(gr_status & GR_READY))) {
++			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
++			error = -EAGAIN;
++			break;
++		}
++
++		if (current->role->roletype & GR_ROLE_SPECIAL) {
++			char *p = "";
++			int i = 0;
++
++			read_lock(&tasklist_lock);
++			if (current->parent) {
++				p = current->parent->role->rolename;
++				i = current->parent->acl_role_id;
++			}
++			read_unlock(&tasklist_lock);
++
++			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
++			gr_set_acls(1);
++		} else {
++			error = -EPERM;
++			goto out;
++		}
++		break;
++	default:
++		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
++		error = -EINVAL;
++		break;
++	}
++
++	if (error != -EPERM)
++		goto out;
++
++	if(!(gr_auth_attempts++))
++		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
++
++      out:
++	up(&gr_dev_sem);
++	return error;
++}
++
++int
++gr_set_acls(const int type)
++{
++	struct acl_object_label *obj;
++	struct task_struct *task, *task2;
++	struct file *filp;
++	struct acl_role_label *role = current->role;
++	__u16 acl_role_id = current->acl_role_id;
++	const struct cred *cred;
++	char *tmpname;
++	struct name_entry *nmatch;
++	struct acl_subject_label *tmpsubj;
++
++	rcu_read_lock();
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	do_each_thread(task2, task) {
++		/* check to see if we're called from the exit handler,
++		   if so, only replace ACLs that have inherited the admin
++		   ACL */
++
++		if (type && (task->role != role ||
++			     task->acl_role_id != acl_role_id))
++			continue;
++
++		task->acl_role_id = 0;
++		task->acl_sp_role = 0;
++
++		if ((filp = task->exec_file)) {
++			cred = __task_cred(task);
++			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
++
++			/* the following is to apply the correct subject 
++			   on binaries running when the RBAC system 
++			   is enabled, when the binaries have been 
++			   replaced or deleted since their execution
++			   -----
++			   when the RBAC system starts, the inode/dev
++			   from exec_file will be one the RBAC system
++			   is unaware of.  It only knows the inode/dev
++			   of the present file on disk, or the absence
++			   of it.
++			*/
++			preempt_disable();
++			tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
++			
++			nmatch = lookup_name_entry(tmpname);
++			preempt_enable();
++			tmpsubj = NULL;
++			if (nmatch) {
++				if (nmatch->deleted)
++					tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
++				else
++					tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
++				if (tmpsubj != NULL)
++					task->acl = tmpsubj;
++			}
++			if (tmpsubj == NULL)
++				task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
++							   task->role);
++			if (task->acl) {
++				struct acl_subject_label *curr;
++				curr = task->acl;
++
++				task->is_writable = 0;
++				/* ignore additional mmap checks for processes that are writable 
++				   by the default ACL */
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++				obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
++				if (unlikely(obj->mode & GR_WRITE))
++					task->is_writable = 1;
++
++				gr_set_proc_res(task);
++
++#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
++				printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
++#endif
++			} else {
++				read_unlock(&grsec_exec_file_lock);
++				read_unlock(&tasklist_lock);
++				rcu_read_unlock();
++				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
++				return 1;
++			}
++		} else {
++			// it's a kernel process
++			task->role = kernel_role;
++			task->acl = kernel_role->root_label;
++#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
++			task->acl->mode &= ~GR_PROCFIND;
++#endif
++		}
++	} while_each_thread(task2, task);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
++
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	struct acl_subject_label *acl;
++	const struct cred *cred;
++
++	if (unlikely((gr_status & GR_READY) &&
++		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
++		goto skip_reslog;
++
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	gr_log_resource(task, res, wanted, gt);
++#endif
++      skip_reslog:
++
++	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
++		return;
++
++	acl = task->acl;
++
++	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
++		   !(acl->resmask & (1 << (unsigned short) res))))
++		return;
++
++	if (wanted >= acl->res[res].rlim_cur) {
++		unsigned long res_add;
++
++		res_add = wanted;
++		switch (res) {
++		case RLIMIT_CPU:
++			res_add += GR_RLIM_CPU_BUMP;
++			break;
++		case RLIMIT_FSIZE:
++			res_add += GR_RLIM_FSIZE_BUMP;
++			break;
++		case RLIMIT_DATA:
++			res_add += GR_RLIM_DATA_BUMP;
++			break;
++		case RLIMIT_STACK:
++			res_add += GR_RLIM_STACK_BUMP;
++			break;
++		case RLIMIT_CORE:
++			res_add += GR_RLIM_CORE_BUMP;
++			break;
++		case RLIMIT_RSS:
++			res_add += GR_RLIM_RSS_BUMP;
++			break;
++		case RLIMIT_NPROC:
++			res_add += GR_RLIM_NPROC_BUMP;
++			break;
++		case RLIMIT_NOFILE:
++			res_add += GR_RLIM_NOFILE_BUMP;
++			break;
++		case RLIMIT_MEMLOCK:
++			res_add += GR_RLIM_MEMLOCK_BUMP;
++			break;
++		case RLIMIT_AS:
++			res_add += GR_RLIM_AS_BUMP;
++			break;
++		case RLIMIT_LOCKS:
++			res_add += GR_RLIM_LOCKS_BUMP;
++			break;
++		case RLIMIT_SIGPENDING:
++			res_add += GR_RLIM_SIGPENDING_BUMP;
++			break;
++		case RLIMIT_MSGQUEUE:
++			res_add += GR_RLIM_MSGQUEUE_BUMP;
++			break;
++		case RLIMIT_NICE:
++			res_add += GR_RLIM_NICE_BUMP;
++			break;
++		case RLIMIT_RTPRIO:
++			res_add += GR_RLIM_RTPRIO_BUMP;
++			break;
++		case RLIMIT_RTTIME:
++			res_add += GR_RLIM_RTTIME_BUMP;
++			break;
++		}
++
++		acl->res[res].rlim_cur = res_add;
++
++		if (wanted > acl->res[res].rlim_max)
++			acl->res[res].rlim_max = res_add;
++
++		/* only log the subject filename, since resource logging is supported for
++		   single-subject learning only */
++		rcu_read_lock();
++		cred = __task_cred(task);
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid, cred->gid, acl->filename,
++			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
++			       "", (unsigned long) res, &task->signal->curr_ip);
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	struct task_struct *task = current;
++        struct acl_subject_label *proc;
++	unsigned long flags;
++
++        if (unlikely(!(gr_status & GR_READY)))
++                return;
++
++	flags = pax_get_flags(task);
++
++        proc = task->acl;
++
++	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
++		flags &= ~MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
++		flags &= ~MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
++		flags &= ~MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
++		flags &= ~MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
++		flags &= ~MF_PAX_MPROTECT;
++
++	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
++		flags |= MF_PAX_PAGEEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
++		flags |= MF_PAX_SEGMEXEC;
++	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
++		flags |= MF_PAX_RANDMMAP;
++	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
++		flags |= MF_PAX_EMUTRAMP;
++	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
++		flags |= MF_PAX_MPROTECT;
++
++	pax_set_flags(task, flags);
++
++        return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++/* Eric Biederman likes breaking userland ABI and every inode-based security
++   system to save 35kb of memory */
++
++/* we modify the passed in filename, but adjust it back before returning */
++static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
++{
++	struct name_entry *nmatch;
++	char *p, *lastp = NULL;
++	struct acl_object_label *obj = NULL, *tmp;
++	struct acl_subject_label *tmpsubj;
++	char c = '\0';
++
++	read_lock(&gr_inode_lock);
++
++	p = name + len - 1;
++	do {
++		nmatch = lookup_name_entry(name);
++		if (lastp != NULL)
++			*lastp = c;
++
++		if (nmatch == NULL)
++			goto next_component;
++		tmpsubj = current->acl;
++		do {
++			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
++			if (obj != NULL) {
++				tmp = obj->globbed;
++				while (tmp) {
++					if (!glob_match(tmp->filename, name)) {
++						obj = tmp;
++						goto found_obj;
++					}
++					tmp = tmp->next;
++				}
++				goto found_obj;
++			}
++		} while ((tmpsubj = tmpsubj->parent_subject));
++next_component:
++		/* end case */
++		if (p == name)
++			break;
++
++		while (*p != '/')
++			p--;
++		if (p == name)
++			lastp = p + 1;
++		else {
++			lastp = p;
++			p--;
++		}
++		c = *lastp;
++		*lastp = '\0';
++	} while (1);
++found_obj:
++	read_unlock(&gr_inode_lock);
++	/* obj returned will always be non-null */
++	return obj;
++}
++
++/* returns 0 when allowing, non-zero on error
++   op of 0 is used for readdir, so we don't log the names of hidden files
++*/
++__u32
++gr_handle_sysctl(const struct ctl_table *table, const int op)
++{
++	ctl_table *tmp;
++	const char *proc_sys = "/proc/sys";
++	char *path;
++	struct acl_object_label *obj;
++	unsigned short len = 0, pos = 0, depth = 0, i;
++	__u32 err = 0;
++	__u32 mode = 0;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++
++	/* for now, ignore operations on non-sysctl entries if it's not a
++	   readdir*/
++	if (table->child != NULL && op != 0)
++		return 0;
++
++	mode |= GR_FIND;
++	/* it's only a read if it's an entry, read on dirs is for readdir */
++	if (op & MAY_READ)
++		mode |= GR_READ;
++	if (op & MAY_WRITE)
++		mode |= GR_WRITE;
++
++	preempt_disable();
++
++	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
++
++	/* it's only a read/write if it's an actual entry, not a dir
++	   (which are opened for readdir)
++	*/
++
++	/* convert the requested sysctl entry into a pathname */
++
++	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++		len += strlen(tmp->procname);
++		len++;
++		depth++;
++	}
++
++	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
++		/* deny */
++		goto out;
++	}
++
++	memset(path, 0, PAGE_SIZE);
++
++	memcpy(path, proc_sys, strlen(proc_sys));
++
++	pos += strlen(proc_sys);
++
++	for (; depth > 0; depth--) {
++		path[pos] = '/';
++		pos++;
++		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
++			if (depth == i) {
++				memcpy(path + pos, tmp->procname,
++				       strlen(tmp->procname));
++				pos += strlen(tmp->procname);
++			}
++			i++;
++		}
++	}
++
++	obj = gr_lookup_by_name(path, pos);
++	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
++
++	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
++		     ((err & mode) != mode))) {
++		__u32 new_mode = mode;
++
++		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
++
++		err = 0;
++		gr_log_learn_sysctl(path, new_mode);
++	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
++		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
++		err = -ENOENT;
++	} else if (!(err & GR_FIND)) {
++		err = -ENOENT;
++	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
++		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = -EACCES;
++	} else if ((err & mode) != mode) {
++		err = -EACCES;
++	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
++		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
++			       path, (mode & GR_READ) ? " reading" : "",
++			       (mode & GR_WRITE) ? " writing" : "");
++		err = 0;
++	} else
++		err = 0;
++
++      out:
++	preempt_enable();
++
++	return err;
++}
++#endif
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	struct file *filp;
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	filp = task->exec_file;
++
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 1;
++	}
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY)) {
++		read_unlock(&grsec_exec_file_lock);
++		read_unlock(&tasklist_lock);
++		return 0;
++	}
++#endif
++
++	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++
++	if (retmode & GR_NOPTRACE)
++		return 1;
++
++	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
++	    && (current->acl != task->acl || (current->acl != current->role->root_label
++	    && current->pid != task->pid)))
++		return 1;
++
++	return 0;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	struct task_struct *tmp = task;
++	struct task_struct *curtemp = current;
++	__u32 retmode;
++
++#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (unlikely(!(gr_status & GR_READY)))
++		return 0;
++#endif
++
++	read_lock(&tasklist_lock);
++	while (tmp->pid > 0) {
++		if (tmp == curtemp)
++			break;
++		tmp = tmp->parent;
++	}
++
++	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
++				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
++		read_unlock(&tasklist_lock);
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++	read_unlock(&tasklist_lock);
++
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	if (!(gr_status & GR_READY))
++		return 0;
++#endif
++
++	read_lock(&grsec_exec_file_lock);
++	if (unlikely(!task->exec_file)) {
++		read_unlock(&grsec_exec_file_lock);
++		return 0;
++	}
++
++	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
++	read_unlock(&grsec_exec_file_lock);
++
++	if (retmode & GR_NOPTRACE) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++		
++	if (retmode & GR_PTRACERD) {
++		switch (request) {
++		case PTRACE_POKETEXT:
++		case PTRACE_POKEDATA:
++		case PTRACE_POKEUSR:
++#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
++		case PTRACE_SETREGS:
++		case PTRACE_SETFPREGS:
++#endif
++#ifdef CONFIG_X86
++		case PTRACE_SETFPXREGS:
++#endif
++#ifdef CONFIG_ALTIVEC
++		case PTRACE_SETVRREGS:
++#endif
++			return 1;
++		default:
++			return 0;
++		}
++	} else if (!(current->acl->mode & GR_POVERRIDE) &&
++		   !(current->role->roletype & GR_ROLE_GOD) &&
++		   (current->acl != task->acl)) {
++		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
++		return 1;
++	}
++
++	return 0;
++}
++
++static int is_writable_mmap(const struct file *filp)
++{
++	struct task_struct *task = current;
++	struct acl_object_label *obj, *obj2;
++
++	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
++	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
++		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
++		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
++				     task->role->root_label);
++		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
++			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
++			return 1;
++		}
++	}
++	return 0;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	__u32 mode;
++
++	if (unlikely(!file || !(prot & PROT_EXEC)))
++		return 1;
++
++	if (is_writable_mmap(file))
++		return 0;
++
++	mode =
++	    gr_search_file(file->f_path.dentry,
++			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
++			   file->f_path.mnt);
++
++	if (!gr_tpe_allow(file))
++		return 0;
++
++	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_EXEC))) {
++		return 0;
++	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 1;
++	}
++
++	return 1;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	unsigned long runtime;
++	unsigned long cputime;
++	unsigned int wday, cday;
++	__u8 whr, chr;
++	__u8 wmin, cmin;
++	__u8 wsec, csec;
++	struct timespec timeval;
++
++	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
++		     !(task->acl->mode & GR_PROCACCT)))
++		return;
++
++	do_posix_clock_monotonic_gettime(&timeval);
++	runtime = timeval.tv_sec - task->start_time.tv_sec;
++	wday = runtime / (3600 * 24);
++	runtime -= wday * (3600 * 24);
++	whr = runtime / 3600;
++	runtime -= whr * 3600;
++	wmin = runtime / 60;
++	runtime -= wmin * 60;
++	wsec = runtime;
++
++	cputime = (task->utime + task->stime) / HZ;
++	cday = cputime / (3600 * 24);
++	cputime -= cday * (3600 * 24);
++	chr = cputime / 3600;
++	cputime -= chr * 3600;
++	cmin = cputime / 60;
++	cputime -= cmin * 60;
++	csec = cputime;
++
++	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
++
++	return;
++}
++
++void gr_set_kernel_label(struct task_struct *task)
++{
++	if (gr_status & GR_READY) {
++		task->role = kernel_role;
++		task->acl = kernel_role->root_label;
++	}
++	return;
++}
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	struct task_struct *task;
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	const struct cred *cred;
++#endif
++	int ret = 0;
++
++	/* restrict taskstats viewing to un-chrooted root users
++	   who have the 'view' subject flag if the RBAC system is enabled
++	*/
++
++	read_lock(&tasklist_lock);
++	task = find_task_by_vpid(pid);
++	if (task) {
++		gr_fs_read_lock(task);
++#ifdef CONFIG_GRKERNSEC_CHROOT
++		if (proc_is_chrooted(task))
++			ret = -EACCES;
++#endif
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		cred = __task_cred(task);
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++		if (cred->uid != 0)
++			ret = -EACCES;
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
++			ret = -EACCES;
++#endif
++#endif
++		if (gr_status & GR_READY) {
++			if (!(task->acl->mode & GR_VIEW))
++				ret = -EACCES;
++		}
++		
++		gr_fs_read_unlock(task);
++	} else
++		ret = -ENOENT;
++
++	read_unlock(&tasklist_lock);
++
++	return ret;
++}
++#endif
++
++int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
++{
++	struct task_struct *task = current;
++	struct dentry *dentry = file->f_path.dentry;
++	struct vfsmount *mnt = file->f_path.mnt;
++	struct acl_object_label *obj, *tmp;
++	struct acl_subject_label *subj;
++	unsigned int bufsize;
++	int is_not_root;
++	char *path;
++
++	if (unlikely(!(gr_status & GR_READY)))
++		return 1;
++
++	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
++		return 1;
++
++	/* ignore Eric Biederman */
++	if (IS_PRIVATE(dentry->d_inode))
++		return 1;
++
++	subj = task->acl;
++	do {
++		obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
++		if (obj != NULL)
++			return (obj->mode & GR_FIND) ? 1 : 0;
++	} while ((subj = subj->parent_subject));
++	
++	/* this is purely an optimization since we're looking for an object
++	   for the directory we're doing a readdir on
++	   if it's possible for any globbed object to match the entry we're
++	   filling into the directory, then the object we find here will be
++	   an anchor point with attached globbed objects
++	*/
++	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
++	if (obj->globbed == NULL)
++		return (obj->mode & GR_FIND) ? 1 : 0;
++
++	is_not_root = ((obj->filename[0] == '/') &&
++		   (obj->filename[1] == '\0')) ? 0 : 1;
++	bufsize = PAGE_SIZE - namelen - is_not_root;
++
++	/* check bufsize > PAGE_SIZE || bufsize == 0 */
++	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
++		return 1;
++
++	preempt_disable();
++	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
++			   bufsize);
++
++	bufsize = strlen(path);
++
++	/* if base is "/", don't append an additional slash */
++	if (is_not_root)
++		*(path + bufsize) = '/';
++	memcpy(path + bufsize + is_not_root, name, namelen);
++	*(path + bufsize + namelen + is_not_root) = '\0';
++
++	tmp = obj->globbed;
++	while (tmp) {
++		if (!glob_match(tmp->filename, path)) {
++			preempt_enable();
++			return (tmp->mode & GR_FIND) ? 1 : 0;
++		}
++		tmp = tmp->next;
++	}
++	preempt_enable();
++	return (obj->mode & GR_FIND) ? 1 : 0;
++}
++
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
++
+diff -urNp linux-2.6.32.14/grsecurity/gracl_cap.c linux-2.6.32.14/grsecurity/gracl_cap.c
+--- linux-2.6.32.14/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_cap.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,131 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static const char *captab_log[] = {
++	"CAP_CHOWN",
++	"CAP_DAC_OVERRIDE",
++	"CAP_DAC_READ_SEARCH",
++	"CAP_FOWNER",
++	"CAP_FSETID",
++	"CAP_KILL",
++	"CAP_SETGID",
++	"CAP_SETUID",
++	"CAP_SETPCAP",
++	"CAP_LINUX_IMMUTABLE",
++	"CAP_NET_BIND_SERVICE",
++	"CAP_NET_BROADCAST",
++	"CAP_NET_ADMIN",
++	"CAP_NET_RAW",
++	"CAP_IPC_LOCK",
++	"CAP_IPC_OWNER",
++	"CAP_SYS_MODULE",
++	"CAP_SYS_RAWIO",
++	"CAP_SYS_CHROOT",
++	"CAP_SYS_PTRACE",
++	"CAP_SYS_PACCT",
++	"CAP_SYS_ADMIN",
++	"CAP_SYS_BOOT",
++	"CAP_SYS_NICE",
++	"CAP_SYS_RESOURCE",
++	"CAP_SYS_TIME",
++	"CAP_SYS_TTY_CONFIG",
++	"CAP_MKNOD",
++	"CAP_LEASE",
++	"CAP_AUDIT_WRITE",
++	"CAP_AUDIT_CONTROL",
++	"CAP_SETFCAP",
++	"CAP_MAC_OVERRIDE",
++	"CAP_MAC_ADMIN"
++};
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++
++int
++gr_is_capable(const int cap)
++{
++	struct task_struct *task = current;
++	const struct cred *cred = current_cred();
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = task->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	curracl = task->acl;
++
++	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
++	    && cap_raised(cred->cap_effective, cap)) {
++		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
++			       task->role->roletype, cred->uid,
++			       cred->gid, task->exec_file ?
++			       gr_to_filename(task->exec_file->f_path.dentry,
++			       task->exec_file->f_path.mnt) : curracl->filename,
++			       curracl->filename, 0UL,
++			       0UL, "", (unsigned long) cap, &task->signal->curr_ip);
++		return 1;
++	}
++
++	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
++		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
++	return 0;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	struct acl_subject_label *curracl;
++	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	curracl = current->acl;
++
++	cap_drop = curracl->cap_lower;
++	cap_mask = curracl->cap_mask;
++
++	while ((curracl = curracl->parent_subject)) {
++		/* if the cap isn't specified in the current computed mask but is specified in the
++		   current level subject, and is lowered in the current level subject, then add
++		   it to the set of dropped capabilities
++		   otherwise, add the current level subject's mask to the current computed mask
++		 */
++		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
++			cap_raise(cap_mask, cap);
++			if (cap_raised(curracl->cap_lower, cap))
++				cap_raise(cap_drop, cap);
++		}
++	}
++
++	if (!cap_raised(cap_drop, cap))
++		return 1;
++
++	return 0;
++}
++
+diff -urNp linux-2.6.32.14/grsecurity/gracl_fs.c linux-2.6.32.14/grsecurity/gracl_fs.c
+--- linux-2.6.32.14/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_fs.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,424 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/types.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/stat.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return GR_FIND;
++
++	mode =
++	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
++
++	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return mode;
++	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
++		return 0;
++	} else if (unlikely(!(mode & GR_FIND)))
++		return 0;
++
++	return GR_FIND;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	__u32 reqmode = GR_FIND;
++	__u32 mode;
++
++	if (unlikely(!dentry->d_inode))
++		return reqmode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	else if (unlikely(fmode & FMODE_WRITE))
++		reqmode |= GR_WRITE;
++	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
++		reqmode &= ~GR_READ;
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	if (unlikely(fmode & O_APPEND))
++		reqmode |= GR_APPEND;
++	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
++		reqmode |= GR_READ;
++	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
++		reqmode |= GR_SETID;
++
++	mode =
++	    gr_check_create(dentry, p_dentry, p_mnt,
++			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : reqmode &
++			       GR_APPEND ? " appending" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
++		     const int fmode)
++{
++	__u32 mode, reqmode = GR_FIND;
++
++	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
++		reqmode |= GR_EXEC;
++	if (fmode & S_IWOTH)
++		reqmode |= GR_WRITE;
++	if (fmode & S_IROTH)
++		reqmode |= GR_READ;
++
++	mode =
++	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
++			   mnt);
++
++	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return reqmode;
++	} else
++	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
++	{
++		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
++			       reqmode & GR_READ ? " reading" : "",
++			       reqmode & GR_WRITE ? " writing" : "",
++			       reqmode & GR_EXEC ? " executing" : "");
++		return 0;
++	} else if (unlikely((mode & reqmode) != reqmode))
++		return 0;
++
++	return reqmode;
++}
++
++static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		     mode_t mode)
++{
++	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
++		return 1;
++
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_FCHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
++		    mode_t mode)
++{
++	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
++		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
++				   GR_CHMOD_ACL_MSG);
++	} else {
++		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
++	}
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
++			   GR_UNIXCONNECT_ACL_MSG);
++}
++
++/* hardlinks require at minimum create permission,
++   any additional privilege required is based on the
++   privilege of the file being linked to
++*/
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	__u32 mode;
++	__u32 needmode = GR_CREATE | GR_LINK;
++	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
++
++	mode =
++	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
++			  old_mnt);
++
++	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	__u32 needmode = GR_WRITE | GR_CREATE;
++	__u32 mode;
++
++	mode =
++	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
++			    GR_CREATE | GR_AUDIT_CREATE |
++			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
++
++	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
++		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & needmode) != needmode))
++		return 0;
++
++	return (GR_WRITE | GR_CREATE);
++}
++
++static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
++{
++	__u32 mode;
++
++	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
++
++	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
++		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
++		return mode;
++	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
++		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
++		return 0;
++	} else if (unlikely((mode & (reqmode)) != (reqmode)))
++		return 0;
++
++	return (reqmode);
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	__u32 reqmode = GR_WRITE | GR_CREATE;
++	if (unlikely(mode & (S_ISUID | S_ISGID)))
++		reqmode |= GR_SETID;
++
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  reqmode, GR_MKNOD_ACL_MSG);
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry *new_dentry,
++		    const struct dentry *parent_dentry,
++		    const struct vfsmount *parent_mnt)
++{
++	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
++				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
++}
++
++#define RENAME_CHECK_SUCCESS(old, new) \
++	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
++	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
++
++int
++gr_acl_handle_rename(struct dentry *new_dentry,
++		     struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     struct dentry *old_dentry,
++		     struct inode *old_parent_inode,
++		     struct vfsmount *old_mnt, const char *newname)
++{
++	__u32 comp1, comp2;
++	int error = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (!new_dentry->d_inode) {
++		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
++					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
++					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
++		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
++				       GR_DELETE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, old_mnt);
++	} else {
++		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
++				       GR_CREATE | GR_DELETE |
++				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
++				       GR_AUDIT_READ | GR_AUDIT_WRITE |
++				       GR_SUPPRESS, parent_mnt);
++		comp2 =
++		    gr_search_file(old_dentry,
++				   GR_READ | GR_WRITE | GR_AUDIT_READ |
++				   GR_DELETE | GR_AUDIT_DELETE |
++				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
++	}
++
++	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
++	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
++		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
++		 && !(comp2 & GR_SUPPRESS)) {
++		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
++		error = -EACCES;
++	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
++		error = -EACCES;
++
++	return error;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	u16 id;
++	char *rolename;
++	struct file *exec_file;
++
++	if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
++		id = current->acl_role_id;
++		rolename = current->role->rolename;
++		gr_set_acls(1);
++		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
++	}
++
++	write_lock(&grsec_exec_file_lock);
++	exec_file = current->exec_file;
++	current->exec_file = NULL;
++	write_unlock(&grsec_exec_file_lock);
++
++	if (exec_file)
++		fput(exec_file);
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	if (task != current && task->acl->mode & GR_PROTPROCFD)
++		return -EACCES;
++
++	return 0;
++}
+diff -urNp linux-2.6.32.14/grsecurity/gracl_ip.c linux-2.6.32.14/grsecurity/gracl_ip.c
+--- linux-2.6.32.14/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_ip.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,339 @@
++#include <linux/kernel.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/skbuff.h>
++#include <linux/ip.h>
++#include <linux/udp.h>
++#include <linux/smp_lock.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/netdevice.h>
++#include <linux/inetdevice.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++#define GR_BIND			0x01
++#define GR_CONNECT		0x02
++#define GR_INVERT		0x04
++#define GR_BINDOVERRIDE		0x08
++#define GR_CONNECTOVERRIDE	0x10
++
++static const char * gr_protocols[256] = {
++	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
++	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
++	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
++	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
++	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
++	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
++	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
++	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
++	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
++	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
++	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
++	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
++	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
++	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
++	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
++	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
++	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
++	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
++	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
++	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
++	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
++	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
++	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
++	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
++	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
++	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
++	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
++	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
++	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
++	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
++	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
++	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
++	};
++
++static const char * gr_socktypes[11] = {
++	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
++	"unknown:7", "unknown:8", "unknown:9", "packet"
++	};
++
++const char *
++gr_proto_to_name(unsigned char proto)
++{
++	return gr_protocols[proto];
++}
++
++const char *
++gr_socktype_to_name(unsigned char type)
++{
++	return gr_socktypes[type];
++}
++
++int
++gr_search_socket(const int domain, const int type, const int protocol)
++{
++	struct acl_subject_label *curr;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled()))
++		goto exit;
++
++	if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
++	    || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
++		goto exit;	// let the kernel handle it
++
++	curr = current->acl;
++
++	if (!curr->ips)
++		goto exit;
++
++	if ((curr->ip_type & (1 << type)) &&
++	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++		goto exit;
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		/* we don't place acls on raw sockets , and sometimes
++		   dgram/ip sockets are opened for ioctl and not
++		   bind/connect, so we'll fake a bind learn log */
++		if (type == SOCK_RAW || type == SOCK_PACKET) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_CONNECT, &current->signal->curr_ip);
++		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
++			__u32 fakeip = 0;
++			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++				       current->role->roletype, cred->uid,
++				       cred->gid, current->exec_file ?
++				       gr_to_filename(current->exec_file->f_path.dentry,
++				       current->exec_file->f_path.mnt) :
++				       curr->filename, curr->filename,
++				       &fakeip, 0, type,
++				       protocol, GR_BIND, &current->signal->curr_ip);
++		}
++		/* we'll log when they use connect or bind */
++		goto exit;
++	}
++
++	gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet", 
++		    gr_socktype_to_name(type), gr_proto_to_name(protocol));
++
++	return 0;
++      exit:
++	return 1;
++}
++
++int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
++{
++	if ((ip->mode & mode) &&
++	    (ip_port >= ip->low) &&
++	    (ip_port <= ip->high) &&
++	    ((ntohl(ip_addr) & our_netmask) ==
++	     (ntohl(our_addr) & our_netmask))
++	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
++	    && (ip->type & (1 << type))) {
++		if (ip->mode & GR_INVERT)
++			return 2; // specifically denied
++		else
++			return 1; // allowed
++	}
++
++	return 0; // not specifically allowed, may continue parsing
++}
++
++static int
++gr_search_connectbind(const int full_mode, struct sock *sk,
++		      struct sockaddr_in *addr, const int type)
++{
++	char iface[IFNAMSIZ] = {0};
++	struct acl_subject_label *curr;
++	struct acl_ip_label *ip;
++	struct inet_sock *isk;
++	struct net_device *dev;
++	struct in_device *idev;
++	unsigned long i;
++	int ret;
++	int mode = full_mode & (GR_BIND | GR_CONNECT);
++	__u32 ip_addr = 0;
++	__u32 our_addr;
++	__u32 our_netmask;
++	char *p;
++	__u16 ip_port = 0;
++	const struct cred *cred = current_cred();
++
++	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
++		return 0;
++
++	curr = current->acl;
++	isk = inet_sk(sk);
++
++	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
++	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
++		addr->sin_addr.s_addr = curr->inaddr_any_override;
++	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
++		struct sockaddr_in saddr;
++		int err;
++
++		saddr.sin_family = AF_INET;
++		saddr.sin_addr.s_addr = curr->inaddr_any_override;
++		saddr.sin_port = isk->sport;
++
++		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++
++		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
++		if (err)
++			return err;
++	}
++
++	if (!curr->ips)
++		return 0;
++
++	ip_addr = addr->sin_addr.s_addr;
++	ip_port = ntohs(addr->sin_port);
++
++	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
++		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
++			       current->role->roletype, cred->uid,
++			       cred->gid, current->exec_file ?
++			       gr_to_filename(current->exec_file->f_path.dentry,
++			       current->exec_file->f_path.mnt) :
++			       curr->filename, curr->filename,
++			       &ip_addr, ip_port, type,
++			       sk->sk_protocol, mode, &current->signal->curr_ip);
++		return 0;
++	}
++
++	for (i = 0; i < curr->ip_num; i++) {
++		ip = *(curr->ips + i);
++		if (ip->iface != NULL) {
++			strncpy(iface, ip->iface, IFNAMSIZ - 1);
++			p = strchr(iface, ':');
++			if (p != NULL)
++				*p = '\0';
++			dev = dev_get_by_name(sock_net(sk), iface);
++			if (dev == NULL)
++				continue;
++			idev = in_dev_get(dev);
++			if (idev == NULL) {
++				dev_put(dev);
++				continue;
++			}
++			rcu_read_lock();
++			for_ifa(idev) {
++				if (!strcmp(ip->iface, ifa->ifa_label)) {
++					our_addr = ifa->ifa_address;
++					our_netmask = 0xffffffff;
++					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++					if (ret == 1) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						return 0;
++					} else if (ret == 2) {
++						rcu_read_unlock();
++						in_dev_put(idev);
++						dev_put(dev);
++						goto denied;
++					}
++				}
++			} endfor_ifa(idev);
++			rcu_read_unlock();
++			in_dev_put(idev);
++			dev_put(dev);
++		} else {
++			our_addr = ip->addr;
++			our_netmask = ip->netmask;
++			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
++			if (ret == 1)
++				return 0;
++			else if (ret == 2)
++				goto denied;
++		}
++	}
++
++denied:
++	if (mode == GR_BIND)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++	else if (mode == GR_CONNECT)
++		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
++
++	return -EACCES;
++}
++
++int
++gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int
++gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
++{
++	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
++}
++
++int gr_search_listen(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int gr_search_accept(struct socket *sock)
++{
++	struct sock *sk = sock->sk;
++	struct sockaddr_in addr;
++
++	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
++	addr.sin_port = inet_sk(sk)->sport;
++
++	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
++}
++
++int
++gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
++{
++	if (addr)
++		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
++	else {
++		struct sockaddr_in sin;
++		const struct inet_sock *inet = inet_sk(sk);
++
++		sin.sin_addr.s_addr = inet->daddr;
++		sin.sin_port = inet->dport;
++
++		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++	}
++}
++
++int
++gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
++{
++	struct sockaddr_in sin;
++
++	if (unlikely(skb->len < sizeof (struct udphdr)))
++		return 0;	// skip this packet
++
++	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
++	sin.sin_port = udp_hdr(skb)->source;
++
++	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
++}
+diff -urNp linux-2.6.32.14/grsecurity/gracl_learn.c linux-2.6.32.14/grsecurity/gracl_learn.c
+--- linux-2.6.32.14/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_learn.c	2010-05-28 21:27:16.327077893 -0400
+@@ -0,0 +1,211 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/poll.h>
++#include <linux/smp_lock.h>
++#include <linux/string.h>
++#include <linux/file.h>
++#include <linux/types.h>
++#include <linux/vmalloc.h>
++#include <linux/grinternal.h>
++
++extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
++				   size_t count, loff_t *ppos);
++extern int gr_acl_is_enabled(void);
++
++static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
++static int gr_learn_attached;
++
++/* use a 512k buffer */
++#define LEARN_BUFFER_SIZE (512 * 1024)
++
++static DEFINE_SPINLOCK(gr_learn_lock);
++static DECLARE_MUTEX(gr_learn_user_sem);
++
++/* we need to maintain two buffers, so that the kernel context of grlearn
++   uses a semaphore around the userspace copying, and the other kernel contexts
++   use a spinlock when copying into the buffer, since they cannot sleep
++*/
++static char *learn_buffer;
++static char *learn_buffer_user;
++static int learn_buffer_len;
++static int learn_buffer_user_len;
++
++static ssize_t
++read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
++{
++	DECLARE_WAITQUEUE(wait, current);
++	ssize_t retval = 0;
++
++	add_wait_queue(&learn_wait, &wait);
++	set_current_state(TASK_INTERRUPTIBLE);
++	do {
++		down(&gr_learn_user_sem);
++		spin_lock(&gr_learn_lock);
++		if (learn_buffer_len)
++			break;
++		spin_unlock(&gr_learn_lock);
++		up(&gr_learn_user_sem);
++		if (file->f_flags & O_NONBLOCK) {
++			retval = -EAGAIN;
++			goto out;
++		}
++		if (signal_pending(current)) {
++			retval = -ERESTARTSYS;
++			goto out;
++		}
++
++		schedule();
++	} while (1);
++
++	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
++	learn_buffer_user_len = learn_buffer_len;
++	retval = learn_buffer_len;
++	learn_buffer_len = 0;
++
++	spin_unlock(&gr_learn_lock);
++
++	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
++		retval = -EFAULT;
++
++	up(&gr_learn_user_sem);
++out:
++	set_current_state(TASK_RUNNING);
++	remove_wait_queue(&learn_wait, &wait);
++	return retval;
++}
++
++static unsigned int
++poll_learn(struct file * file, poll_table * wait)
++{
++	poll_wait(file, &learn_wait, wait);
++
++	if (learn_buffer_len)
++		return (POLLIN | POLLRDNORM);
++
++	return 0;
++}
++
++void
++gr_clear_learn_entries(void)
++{
++	char *tmp;
++
++	down(&gr_learn_user_sem);
++	if (learn_buffer != NULL) {
++		spin_lock(&gr_learn_lock);
++		tmp = learn_buffer;
++		learn_buffer = NULL;
++		spin_unlock(&gr_learn_lock);
++		vfree(learn_buffer);
++	}
++	if (learn_buffer_user != NULL) {
++		vfree(learn_buffer_user);
++		learn_buffer_user = NULL;
++	}
++	learn_buffer_len = 0;
++	up(&gr_learn_user_sem);
++
++	return;
++}
++
++void
++gr_add_learn_entry(const char *fmt, ...)
++{
++	va_list args;
++	unsigned int len;
++
++	if (!gr_learn_attached)
++		return;
++
++	spin_lock(&gr_learn_lock);
++
++	/* leave a gap at the end so we know when it's "full" but don't have to
++	   compute the exact length of the string we're trying to append
++	*/
++	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
++		spin_unlock(&gr_learn_lock);
++		wake_up_interruptible(&learn_wait);
++		return;
++	}
++	if (learn_buffer == NULL) {
++		spin_unlock(&gr_learn_lock);
++		return;
++	}
++
++	va_start(args, fmt);
++	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
++	va_end(args);
++
++	learn_buffer_len += len + 1;
++
++	spin_unlock(&gr_learn_lock);
++	wake_up_interruptible(&learn_wait);
++
++	return;
++}
++
++static int
++open_learn(struct inode *inode, struct file *file)
++{
++	if (file->f_mode & FMODE_READ && gr_learn_attached)
++		return -EBUSY;
++	if (file->f_mode & FMODE_READ) {
++		int retval = 0;
++		down(&gr_learn_user_sem);
++		if (learn_buffer == NULL)
++			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer_user == NULL)
++			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
++		if (learn_buffer == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		if (learn_buffer_user == NULL) {
++			retval = -ENOMEM;
++			goto out_error;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 1;
++out_error:
++		up(&gr_learn_user_sem);
++		return retval;
++	}
++	return 0;
++}
++
++static int
++close_learn(struct inode *inode, struct file *file)
++{
++	char *tmp;
++
++	if (file->f_mode & FMODE_READ) {
++		down(&gr_learn_user_sem);
++		if (learn_buffer != NULL) {
++			spin_lock(&gr_learn_lock);
++			tmp = learn_buffer;
++			learn_buffer = NULL;
++			spin_unlock(&gr_learn_lock);
++			vfree(tmp);
++		}
++		if (learn_buffer_user != NULL) {
++			vfree(learn_buffer_user);
++			learn_buffer_user = NULL;
++		}
++		learn_buffer_len = 0;
++		learn_buffer_user_len = 0;
++		gr_learn_attached = 0;
++		up(&gr_learn_user_sem);
++	}
++
++	return 0;
++}
++		
++const struct file_operations grsec_fops = {
++	.read		= read_learn,
++	.write		= write_grsec_handler,
++	.open		= open_learn,
++	.release	= close_learn,
++	.poll		= poll_learn,
++};
+diff -urNp linux-2.6.32.14/grsecurity/gracl_res.c linux-2.6.32.14/grsecurity/gracl_res.c
+--- linux-2.6.32.14/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_res.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/gracl.h>
++#include <linux/grinternal.h>
++
++static const char *restab_log[] = {
++	[RLIMIT_CPU] = "RLIMIT_CPU",
++	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
++	[RLIMIT_DATA] = "RLIMIT_DATA",
++	[RLIMIT_STACK] = "RLIMIT_STACK",
++	[RLIMIT_CORE] = "RLIMIT_CORE",
++	[RLIMIT_RSS] = "RLIMIT_RSS",
++	[RLIMIT_NPROC] = "RLIMIT_NPROC",
++	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
++	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
++	[RLIMIT_AS] = "RLIMIT_AS",
++	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
++	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
++	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
++	[RLIMIT_NICE] = "RLIMIT_NICE",
++	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
++	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
++	[GR_CRASH_RES] = "RLIMIT_CRASH"
++};
++
++void
++gr_log_resource(const struct task_struct *task,
++		const int res, const unsigned long wanted, const int gt)
++{
++	const struct cred *cred;
++
++	if (!gr_acl_is_enabled() && !grsec_resource_logging)
++		return;
++
++	// not yet supported resource
++	if (!restab_log[res])
++		return;
++
++	rcu_read_lock();
++	cred = __task_cred(task);
++
++	if (res == RLIMIT_NPROC && 
++	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
++	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_MEMLOCK &&
++		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
++		goto out_rcu_unlock;
++	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
++		goto out_rcu_unlock;
++	rcu_read_unlock();
++
++	preempt_disable();
++
++	if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
++		      (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
++		     task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
++		gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
++	preempt_enable_no_resched();
++
++	return;
++out_rcu_unlock:
++	rcu_read_unlock();
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/gracl_segv.c linux-2.6.32.14/grsecurity/gracl_segv.c
+--- linux-2.6.32.14/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_segv.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,310 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <asm/uaccess.h>
++#include <asm/errno.h>
++#include <asm/mman.h>
++#include <net/sock.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/smp_lock.h>
++#include <linux/slab.h>
++#include <linux/types.h>
++#include <linux/sched.h>
++#include <linux/timer.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++static struct crash_uid *uid_set;
++static unsigned short uid_used;
++static DEFINE_SPINLOCK(gr_uid_lock);
++extern rwlock_t gr_inode_lock;
++extern struct acl_subject_label *
++	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
++			      struct acl_role_label *role);
++extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
++
++int
++gr_init_uidset(void)
++{
++	uid_set =
++	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
++	uid_used = 0;
++
++	return uid_set ? 1 : 0;
++}
++
++void
++gr_free_uidset(void)
++{
++	if (uid_set)
++		kfree(uid_set);
++
++	return;
++}
++
++int
++gr_find_uid(const uid_t uid)
++{
++	struct crash_uid *tmp = uid_set;
++	uid_t buid;
++	int low = 0, high = uid_used - 1, mid;
++
++	while (high >= low) {
++		mid = (low + high) >> 1;
++		buid = tmp[mid].uid;
++		if (buid == uid)
++			return mid;
++		if (buid > uid)
++			high = mid - 1;
++		if (buid < uid)
++			low = mid + 1;
++	}
++
++	return -1;
++}
++
++static __inline__ void
++gr_insertsort(void)
++{
++	unsigned short i, j;
++	struct crash_uid index;
++
++	for (i = 1; i < uid_used; i++) {
++		index = uid_set[i];
++		j = i;
++		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
++			uid_set[j] = uid_set[j - 1];
++			j--;
++		}
++		uid_set[j] = index;
++	}
++
++	return;
++}
++
++static __inline__ void
++gr_insert_uid(const uid_t uid, const unsigned long expires)
++{
++	int loc;
++
++	if (uid_used == GR_UIDTABLE_MAX)
++		return;
++
++	loc = gr_find_uid(uid);
++
++	if (loc >= 0) {
++		uid_set[loc].expires = expires;
++		return;
++	}
++
++	uid_set[uid_used].uid = uid;
++	uid_set[uid_used].expires = expires;
++	uid_used++;
++
++	gr_insertsort();
++
++	return;
++}
++
++void
++gr_remove_uid(const unsigned short loc)
++{
++	unsigned short i;
++
++	for (i = loc + 1; i < uid_used; i++)
++		uid_set[i - 1] = uid_set[i];
++
++	uid_used--;
++
++	return;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	int loc;
++	int ret = 0;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	spin_lock(&gr_uid_lock);
++	loc = gr_find_uid(uid);
++
++	if (loc < 0)
++		goto out_unlock;
++
++	if (time_before_eq(uid_set[loc].expires, get_seconds()))
++		gr_remove_uid(loc);
++	else
++		ret = 1;
++
++out_unlock:
++	spin_unlock(&gr_uid_lock);
++	return ret;
++}
++
++static __inline__ int
++proc_is_setxid(const struct cred *cred)
++{
++	if (cred->uid != cred->euid || cred->uid != cred->suid ||
++	    cred->uid != cred->fsuid)
++		return 1;
++	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
++	    cred->gid != cred->fsgid)
++		return 1;
++
++	return 0;
++}
++static __inline__ int
++gr_fake_force_sig(int sig, struct task_struct *t)
++{
++	unsigned long int flags;
++	int ret, blocked, ignored;
++	struct k_sigaction *action;
++
++	spin_lock_irqsave(&t->sighand->siglock, flags);
++	action = &t->sighand->action[sig-1];
++	ignored = action->sa.sa_handler == SIG_IGN;
++	blocked = sigismember(&t->blocked, sig);
++	if (blocked || ignored) {
++		action->sa.sa_handler = SIG_DFL;
++		if (blocked) {
++			sigdelset(&t->blocked, sig);
++			recalc_sigpending_and_wake(t);
++		}
++	}
++	if (action->sa.sa_handler == SIG_DFL)
++		t->signal->flags &= ~SIGNAL_UNKILLABLE;
++	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
++
++	spin_unlock_irqrestore(&t->sighand->siglock, flags);
++
++	return ret;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	struct acl_subject_label *curr;
++	struct acl_subject_label *curr2;
++	struct task_struct *tsk, *tsk2;
++	const struct cred *cred;
++	const struct cred *cred2;
++
++	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
++		return;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curr = task->acl;
++
++	if (!(curr->resmask & (1 << GR_CRASH_RES)))
++		return;
++
++	if (time_before_eq(curr->expires, get_seconds())) {
++		curr->expires = 0;
++		curr->crashes = 0;
++	}
++
++	curr->crashes++;
++
++	if (!curr->expires)
++		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds())) {
++		rcu_read_lock();
++		cred = __task_cred(task);
++		if (cred->uid && proc_is_setxid(cred)) {
++			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			spin_lock(&gr_uid_lock);
++			gr_insert_uid(cred->uid, curr->expires);
++			spin_unlock(&gr_uid_lock);
++			curr->expires = 0;
++			curr->crashes = 0;
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				cred2 = __task_cred(tsk);
++				if (tsk != task && cred2->uid == cred->uid)
++					gr_fake_force_sig(SIGKILL, tsk);
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		} else {
++			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
++			read_lock(&tasklist_lock);
++			do_each_thread(tsk2, tsk) {
++				if (likely(tsk != task)) {
++					curr2 = tsk->acl;
++
++					if (curr2->device == curr->device &&
++					    curr2->inode == curr->inode)
++						gr_fake_force_sig(SIGKILL, tsk);
++				}
++			} while_each_thread(tsk2, tsk);
++			read_unlock(&tasklist_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	struct acl_subject_label *curr;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return 0;
++
++	read_lock(&gr_inode_lock);
++	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
++				     filp->f_path.dentry->d_inode->i_sb->s_dev,
++				     current->role);
++	read_unlock(&gr_inode_lock);
++
++	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++	    (!curr->crashes && !curr->expires))
++		return 0;
++
++	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
++	    time_after(curr->expires, get_seconds()))
++		return 1;
++	else if (time_before_eq(curr->expires, get_seconds())) {
++		curr->crashes = 0;
++		curr->expires = 0;
++	}
++
++	return 0;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	struct acl_subject_label *curracl;
++	__u32 curr_ip;
++	struct task_struct *p, *p2;
++
++	if (unlikely(!gr_acl_is_enabled()))
++		return;
++
++	curracl = task->acl;
++	curr_ip = task->signal->curr_ip;
++
++	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
++		read_lock(&tasklist_lock);
++		do_each_thread(p2, p) {
++			if (p->signal->curr_ip == curr_ip)
++				gr_fake_force_sig(SIGKILL, p);
++		} while_each_thread(p2, p);
++		read_unlock(&tasklist_lock);
++	} else if (curracl->mode & GR_KILLPROC)
++		gr_fake_force_sig(SIGKILL, task);
++
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/gracl_shm.c linux-2.6.32.14/grsecurity/gracl_shm.c
+--- linux-2.6.32.14/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/gracl_shm.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,37 @@
++#include <linux/kernel.h>
++#include <linux/mm.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/ipc.h>
++#include <linux/gracl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	struct task_struct *task;
++
++	if (!gr_acl_is_enabled())
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	task = find_task_by_vpid(shm_cprid);
++
++	if (unlikely(!task))
++		task = find_task_by_vpid(shm_lapid);
++
++	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
++			      (task->pid == shm_lapid)) &&
++		     (task->acl->mode & GR_PROTSHM) &&
++		     (task->acl != current->acl))) {
++		read_unlock(&tasklist_lock);
++		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
++		return 0;
++	}
++	read_unlock(&tasklist_lock);
++
++	return 1;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_chdir.c linux-2.6.32.14/grsecurity/grsec_chdir.c
+--- linux-2.6.32.14/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_chdir.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,19 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	if ((grsec_enable_chdir && grsec_enable_group &&
++	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
++					      !grsec_enable_group)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
++	}
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_chroot.c linux-2.6.32.14/grsecurity/grsec_chroot.c
+--- linux-2.6.32.14/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_chroot.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,348 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/mount.h>
++#include <linux/types.h>
++#include <linux/pid_namespace.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_chroot_unix(const pid_t pid)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	struct pid *spid = NULL;
++
++	if (unlikely(!grsec_enable_chroot_unix))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	spid = find_vpid(pid);
++	if (spid) {
++		struct task_struct *p;
++		p = pid_task(spid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		if (unlikely(!have_same_root(current, p))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	}
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++int
++gr_handle_chroot_nice(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
++			&& proc_is_chrooted(current)) {
++		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_rawio(const struct inode *inode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
++	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
++		return 1;
++#endif
++	return 0;
++}
++
++int
++gr_pid_is_chrooted(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
++		return 0;
++
++	gr_fs_read_lock(p);
++	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
++	    !have_same_root(current, p)) {
++		gr_fs_read_unlock(p);
++		return 1;
++	}
++	gr_fs_read_unlock(p);
++#endif
++	return 0;
++}
++
++EXPORT_SYMBOL(gr_pid_is_chrooted);
++
++#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
++int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
++{
++	struct dentry *dentry = (struct dentry *)u_dentry;
++	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
++	struct dentry *realroot;
++	struct vfsmount *realrootmnt;
++	struct dentry *currentroot;
++	struct vfsmount *currentmnt;
++	struct task_struct *reaper = &init_task;
++	int ret = 1;
++
++	read_lock(&reaper->fs->lock);
++	realrootmnt = mntget(reaper->fs->root.mnt);
++	realroot = dget(reaper->fs->root.dentry);
++	read_unlock(&reaper->fs->lock);
++
++	read_lock(&current->fs->lock);
++	currentmnt = mntget(current->fs->root.mnt);
++	currentroot = dget(current->fs->root.dentry);
++	read_unlock(&current->fs->lock);
++
++	spin_lock(&dcache_lock);
++	for (;;) {
++		if (unlikely((dentry == realroot && mnt == realrootmnt)
++		     || (dentry == currentroot && mnt == currentmnt)))
++			break;
++		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
++			if (mnt->mnt_parent == mnt)
++				break;
++			dentry = mnt->mnt_mountpoint;
++			mnt = mnt->mnt_parent;
++			continue;
++		}
++		dentry = dentry->d_parent;
++	}
++	spin_unlock(&dcache_lock);
++
++	dput(currentroot);
++	mntput(currentmnt);
++
++	/* access is outside of chroot */
++	if (dentry == realroot && mnt == realrootmnt)
++		ret = 0;
++
++	dput(realroot);
++	mntput(realrootmnt);
++	return ret;
++}
++#endif
++
++int
++gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	if (!grsec_enable_chroot_fchdir)
++		return 1;
++
++	if (!proc_is_chrooted(current))
++		return 1;
++	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
++		return 0;
++	}
++#endif
++	return 1;
++}
++
++int
++gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	struct pid *pid = NULL;
++	time_t starttime;
++
++	if (unlikely(!grsec_enable_chroot_shmat))
++		return 1;
++
++	if (likely(!proc_is_chrooted(current)))
++		return 1;
++
++	read_lock(&tasklist_lock);
++
++	pid = find_vpid(shm_cprid);
++	if (pid) {
++		struct task_struct *p;
++		p = pid_task(pid, PIDTYPE_PID);
++		gr_fs_read_lock(p);
++		starttime = p->start_time.tv_sec;
++		if (unlikely(!have_same_root(current, p) &&
++			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
++			gr_fs_read_unlock(p);
++			read_unlock(&tasklist_lock);
++			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++			return 0;
++		}
++		gr_fs_read_unlock(p);
++	} else {
++		pid = find_vpid(shm_lapid);
++		if (pid) {
++			struct task_struct *p;
++			p = pid_task(pid, PIDTYPE_PID);
++			gr_fs_read_lock(p);
++			if (unlikely(!have_same_root(current, p))) {
++				gr_fs_read_unlock(p);
++				read_unlock(&tasklist_lock);
++				gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
++				return 0;
++			}
++			gr_fs_read_unlock(p);
++		}
++	}
++
++	read_unlock(&tasklist_lock);
++#endif
++	return 1;
++}
++
++void
++gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
++		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_mknod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_mount(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const char *dev_name)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
++		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_pivot(void)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
++	    !gr_is_outside_chroot(dentry, mnt)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_caps(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
++		(init_task.fs->root.dentry != path->dentry) &&
++		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
++
++		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
++		const struct cred *old = current_cred();
++		struct cred *new = prepare_creds();
++		if (new == NULL)
++			return 1;
++
++		new->cap_permitted = cap_drop(old->cap_permitted, 
++					      chroot_caps);
++		new->cap_inheritable = cap_drop(old->cap_inheritable, 
++						chroot_caps);
++		new->cap_effective = cap_drop(old->cap_effective,
++					      chroot_caps);
++
++		commit_creds(new);
++
++		return 0;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_chroot_sysctl(const int op)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
++	    && (op & MAY_WRITE))
++		return -EACCES;
++#endif
++	return 0;
++}
++
++void
++gr_handle_chroot_chdir(struct path *path)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	if (grsec_enable_chroot_chdir)
++		set_fs_pwd(current->fs, path);
++#endif
++	return;
++}
++
++int
++gr_handle_chroot_chmod(const struct dentry *dentry,
++		       const struct vfsmount *mnt, const int mode)
++{
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	if (grsec_enable_chroot_chmod &&
++	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
++	    proc_is_chrooted(current)) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_handle_chroot_caps);
++#endif
+diff -urNp linux-2.6.32.14/grsecurity/grsec_disabled.c linux-2.6.32.14/grsecurity/grsec_disabled.c
+--- linux-2.6.32.14/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_disabled.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,426 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/kdev_t.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <linux/skbuff.h>
++#include <linux/sysctl.h>
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++void
++pax_set_initial_flags(struct linux_binprm *bprm)
++{
++	return;
++}
++#endif
++
++#ifdef CONFIG_SYSCTL
++__u32
++gr_handle_sysctl(const struct ctl_table * table, const int op)
++{
++	return 0;
++}
++#endif
++
++#ifdef CONFIG_TASKSTATS
++int gr_is_taskstats_denied(int pid)
++{
++	return 0;
++}
++#endif
++
++int
++gr_acl_is_enabled(void)
++{
++	return 0;
++}
++
++int
++gr_handle_rawio(const struct inode *inode)
++{
++	return 0;
++}
++
++void
++gr_acl_handle_psacct(struct task_struct *task, const long code)
++{
++	return;
++}
++
++int
++gr_handle_ptrace(struct task_struct *task, const long request)
++{
++	return 0;
++}
++
++int
++gr_handle_proc_ptrace(struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_learn_resource(const struct task_struct *task,
++		  const int res, const unsigned long wanted, const int gt)
++{
++	return;
++}
++
++int
++gr_set_acls(const int type)
++{
++	return 0;
++}
++
++int
++gr_check_hidden_task(const struct task_struct *tsk)
++{
++	return 0;
++}
++
++int
++gr_check_protected_task(const struct task_struct *task)
++{
++	return 0;
++}
++
++void
++gr_copy_label(struct task_struct *tsk)
++{
++	return;
++}
++
++void
++gr_set_pax_flags(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
++		  const int unsafe_share)
++{
++	return 0;
++}
++
++void
++gr_handle_delete(const ino_t ino, const dev_t dev)
++{
++	return;
++}
++
++void
++gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
++{
++	return;
++}
++
++void
++gr_handle_crash(struct task_struct *task, const int sig)
++{
++	return;
++}
++
++int
++gr_check_crash_exec(const struct file *filp)
++{
++	return 0;
++}
++
++int
++gr_check_crash_uid(const uid_t uid)
++{
++	return 0;
++}
++
++void
++gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++		 struct dentry *old_dentry,
++		 struct dentry *new_dentry,
++		 struct vfsmount *mnt, const __u8 replace)
++{
++	return;
++}
++
++int
++gr_search_socket(const int family, const int type, const int protocol)
++{
++	return 1;
++}
++
++int
++gr_search_connectbind(const int mode, const struct socket *sock,
++		      const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_is_capable(const int cap)
++{
++	return 1;
++}
++
++int
++gr_is_capable_nolog(const int cap)
++{
++	return 1;
++}
++
++void
++gr_handle_alertkill(struct task_struct *task)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_hidden_file(const struct dentry * dentry,
++			  const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
++		   const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
++		   unsigned int *vm_flags)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_truncate(const struct dentry * dentry,
++		       const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_access(const struct dentry * dentry,
++		     const struct vfsmount * mnt, const int fmode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		     mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
++		    mode_t mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++void
++grsecurity_init(void)
++{
++	return;
++}
++
++__u32
++gr_acl_handle_mknod(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt,
++		    const int mode)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_mkdir(const struct dentry * new_dentry,
++		    const struct dentry * parent_dentry,
++		    const struct vfsmount * parent_mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_symlink(const struct dentry * new_dentry,
++		      const struct dentry * parent_dentry,
++		      const struct vfsmount * parent_mnt, const char *from)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_link(const struct dentry * new_dentry,
++		   const struct dentry * parent_dentry,
++		   const struct vfsmount * parent_mnt,
++		   const struct dentry * old_dentry,
++		   const struct vfsmount * old_mnt, const char *to)
++{
++	return 1;
++}
++
++int
++gr_acl_handle_rename(const struct dentry *new_dentry,
++		     const struct dentry *parent_dentry,
++		     const struct vfsmount *parent_mnt,
++		     const struct dentry *old_dentry,
++		     const struct inode *old_parent_inode,
++		     const struct vfsmount *old_mnt, const char *newname)
++{
++	return 0;
++}
++
++int
++gr_acl_handle_filldir(const struct file *file, const char *name,
++		      const int namelen, const ino_t ino)
++{
++	return 1;
++}
++
++int
++gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++		const time_t shm_createtime, const uid_t cuid, const int shmid)
++{
++	return 1;
++}
++
++int
++gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++int
++gr_search_accept(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_listen(const struct socket *sock)
++{
++	return 0;
++}
++
++int
++gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++__u32
++gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
++{
++	return 1;
++}
++
++__u32
++gr_acl_handle_creat(const struct dentry * dentry,
++		    const struct dentry * p_dentry,
++		    const struct vfsmount * p_mnt, const int fmode,
++		    const int imode)
++{
++	return 1;
++}
++
++void
++gr_acl_handle_exit(void)
++{
++	return;
++}
++
++int
++gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
++{
++	return 1;
++}
++
++void
++gr_set_role_label(const uid_t uid, const gid_t gid)
++{
++	return;
++}
++
++int
++gr_acl_handle_procpidmem(const struct task_struct *task)
++{
++	return 0;
++}
++
++int
++gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
++{
++	return 0;
++}
++
++int
++gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
++{
++	return 0;
++}
++
++void
++gr_set_kernel_label(struct task_struct *task)
++{
++	return;
++}
++
++int
++gr_check_user_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++int
++gr_check_group_change(int real, int effective, int fs)
++{
++	return 0;
++}
++
++
++EXPORT_SYMBOL(gr_is_capable);
++EXPORT_SYMBOL(gr_is_capable_nolog);
++EXPORT_SYMBOL(gr_learn_resource);
++EXPORT_SYMBOL(gr_set_kernel_label);
++#ifdef CONFIG_SECURITY
++EXPORT_SYMBOL(gr_check_user_change);
++EXPORT_SYMBOL(gr_check_group_change);
++#endif
+diff -urNp linux-2.6.32.14/grsecurity/grsec_exec.c linux-2.6.32.14/grsecurity/grsec_exec.c
+--- linux-2.6.32.14/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_exec.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,89 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/binfmts.h>
++#include <linux/smp_lock.h>
++#include <linux/fs.h>
++#include <linux/types.h>
++#include <linux/grdefs.h>
++#include <linux/grinternal.h>
++#include <linux/capability.h>
++
++#include <asm/uaccess.h>
++
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++static char gr_exec_arg_buf[132];
++static DECLARE_MUTEX(gr_exec_arg_sem);
++#endif
++
++int
++gr_handle_nproc(void)
++{
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	const struct cred *cred = current_cred();
++	if (grsec_enable_execve && cred->user &&
++	    (atomic_read(&cred->user->processes) >
++	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
++	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
++		return -EAGAIN;
++	}
++#endif
++	return 0;
++}
++
++void
++gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
++{
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	char *grarg = gr_exec_arg_buf;
++	unsigned int i, x, execlen = 0;
++	char c;
++
++	if (!((grsec_enable_execlog && grsec_enable_group &&
++	       in_group_p(grsec_audit_gid))
++	      || (grsec_enable_execlog && !grsec_enable_group)))
++		return;
++
++	down(&gr_exec_arg_sem);
++	memset(grarg, 0, sizeof(gr_exec_arg_buf));
++
++	if (unlikely(argv == NULL))
++		goto log;
++
++	for (i = 0; i < bprm->argc && execlen < 128; i++) {
++		const char __user *p;
++		unsigned int len;
++
++		if (copy_from_user(&p, argv + i, sizeof(p)))
++			goto log;
++		if (!p)
++			goto log;
++		len = strnlen_user(p, 128 - execlen);
++		if (len > 128 - execlen)
++			len = 128 - execlen;
++		else if (len > 0)
++			len--;
++		if (copy_from_user(grarg + execlen, p, len))
++			goto log;
++
++		/* rewrite unprintable characters */
++		for (x = 0; x < len; x++) {
++			c = *(grarg + execlen + x);
++			if (c < 32 || c > 126)
++				*(grarg + execlen + x) = ' ';
++		}
++
++		execlen += len;
++		*(grarg + execlen) = ' ';
++		*(grarg + execlen + 1) = '\0';
++		execlen++;
++	}
++
++      log:
++	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
++			bprm->file->f_path.mnt, grarg);
++	up(&gr_exec_arg_sem);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_fifo.c linux-2.6.32.14/grsecurity/grsec_fifo.c
+--- linux-2.6.32.14/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_fifo.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,24 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
++	       const struct dentry *dir, const int flag, const int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_FIFO
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
++	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
++	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
++	    (cred->fsuid != dentry->d_inode->i_uid)) {
++		if (!generic_permission(dentry->d_inode, acc_mode, NULL))
++			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_fork.c linux-2.6.32.14/grsecurity/grsec_fork.c
+--- linux-2.6.32.14/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_fork.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,15 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/errno.h>
++
++void
++gr_log_forkfail(const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
++		gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_init.c linux-2.6.32.14/grsecurity/grsec_init.c
+--- linux-2.6.32.14/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_init.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,241 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/smp_lock.h>
++#include <linux/gracl.h>
++#include <linux/slab.h>
++#include <linux/vmalloc.h>
++#include <linux/percpu.h>
++
++int grsec_enable_link;
++int grsec_enable_dmesg;
++int grsec_enable_harden_ptrace;
++int grsec_enable_fifo;
++int grsec_enable_execve;
++int grsec_enable_execlog;
++int grsec_enable_signal;
++int grsec_enable_forkfail;
++int grsec_enable_audit_ptrace;
++int grsec_enable_time;
++int grsec_enable_audit_textrel;
++int grsec_enable_group;
++int grsec_audit_gid;
++int grsec_enable_chdir;
++int grsec_enable_mount;
++int grsec_enable_rofs;
++int grsec_enable_chroot_findtask;
++int grsec_enable_chroot_mount;
++int grsec_enable_chroot_shmat;
++int grsec_enable_chroot_fchdir;
++int grsec_enable_chroot_double;
++int grsec_enable_chroot_pivot;
++int grsec_enable_chroot_chdir;
++int grsec_enable_chroot_chmod;
++int grsec_enable_chroot_mknod;
++int grsec_enable_chroot_nice;
++int grsec_enable_chroot_execlog;
++int grsec_enable_chroot_caps;
++int grsec_enable_chroot_sysctl;
++int grsec_enable_chroot_unix;
++int grsec_enable_tpe;
++int grsec_tpe_gid;
++int grsec_enable_blackhole;
++int grsec_lastack_retries;
++int grsec_enable_tpe_all;
++int grsec_enable_socket_all;
++int grsec_socket_all_gid;
++int grsec_enable_socket_client;
++int grsec_socket_client_gid;
++int grsec_enable_socket_server;
++int grsec_socket_server_gid;
++int grsec_resource_logging;
++int grsec_lock;
++
++DEFINE_SPINLOCK(grsec_alert_lock);
++unsigned long grsec_alert_wtime = 0;
++unsigned long grsec_alert_fyet = 0;
++
++DEFINE_SPINLOCK(grsec_audit_lock);
++
++DEFINE_RWLOCK(grsec_exec_file_lock);
++
++char *gr_shared_page[4];
++
++char *gr_alert_log_fmt;
++char *gr_audit_log_fmt;
++char *gr_alert_log_buf;
++char *gr_audit_log_buf;
++
++extern struct gr_arg *gr_usermode;
++extern unsigned char *gr_system_salt;
++extern unsigned char *gr_system_sum;
++
++void __init
++grsecurity_init(void)
++{
++	int j;
++	/* create the per-cpu shared pages */
++
++#ifdef CONFIG_X86
++	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
++#endif
++
++	for (j = 0; j < 4; j++) {
++		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
++		if (gr_shared_page[j] == NULL) {
++			panic("Unable to allocate grsecurity shared page");
++			return;
++		}
++	}
++
++	/* allocate log buffers */
++	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_alert_log_fmt) {
++		panic("Unable to allocate grsecurity alert log format buffer");
++		return;
++	}
++	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
++	if (!gr_audit_log_fmt) {
++		panic("Unable to allocate grsecurity audit log format buffer");
++		return;
++	}
++	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_alert_log_buf) {
++		panic("Unable to allocate grsecurity alert log buffer");
++		return;
++	}
++	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
++	if (!gr_audit_log_buf) {
++		panic("Unable to allocate grsecurity audit log buffer");
++		return;
++	}
++
++	/* allocate memory for authentication structure */
++	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
++	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
++	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
++
++	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
++		panic("Unable to allocate grsecurity authentication structure");
++		return;
++	}
++
++#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
++#ifndef CONFIG_GRKERNSEC_SYSCTL
++	grsec_lock = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	grsec_enable_audit_textrel = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	grsec_enable_group = 1;
++	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	grsec_enable_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	grsec_enable_harden_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	grsec_enable_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_LINK
++	grsec_enable_link = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	grsec_enable_dmesg = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	grsec_enable_blackhole = 1;
++	grsec_lastack_retries = 4;
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	grsec_enable_fifo = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	grsec_enable_execve = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	grsec_enable_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	grsec_enable_signal = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	grsec_enable_forkfail = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	grsec_enable_time = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	grsec_resource_logging = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	grsec_enable_chroot_findtask = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	grsec_enable_chroot_unix = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	grsec_enable_chroot_mount = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	grsec_enable_chroot_fchdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	grsec_enable_chroot_shmat = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	grsec_enable_audit_ptrace = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	grsec_enable_chroot_double = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	grsec_enable_chroot_pivot = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	grsec_enable_chroot_chdir = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	grsec_enable_chroot_chmod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	grsec_enable_chroot_mknod = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	grsec_enable_chroot_nice = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	grsec_enable_chroot_execlog = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	grsec_enable_chroot_caps = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	grsec_enable_chroot_sysctl = 1;
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	grsec_enable_tpe = 1;
++	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	grsec_enable_tpe_all = 1;
++#endif
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	grsec_enable_socket_all = 1;
++	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	grsec_enable_socket_client = 1;
++	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	grsec_enable_socket_server = 1;
++	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
++#endif
++#endif
++
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_link.c linux-2.6.32.14/grsecurity/grsec_link.c
+--- linux-2.6.32.14/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_link.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,43 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/fs.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_follow_link(const struct inode *parent,
++		      const struct inode *inode,
++		      const struct dentry *dentry, const struct vfsmount *mnt)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
++	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
++	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
++		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_hardlink(const struct dentry *dentry,
++		   const struct vfsmount *mnt,
++		   struct inode *inode, const int mode, const char *to)
++{
++#ifdef CONFIG_GRKERNSEC_LINK
++	const struct cred *cred = current_cred();
++
++	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
++	    (!S_ISREG(mode) || (mode & S_ISUID) ||
++	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
++	     (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
++	    !capable(CAP_FOWNER) && cred->uid) {
++		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_log.c linux-2.6.32.14/grsecurity/grsec_log.c
+--- linux-2.6.32.14/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_log.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,296 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/tty.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++#define BEGIN_LOCKS(x) \
++	rcu_read_lock(); \
++	read_lock(&tasklist_lock); \
++	read_lock(&grsec_exec_file_lock); \
++	if (x != GR_DO_AUDIT) \
++		spin_lock(&grsec_alert_lock); \
++	else \
++		spin_lock(&grsec_audit_lock)
++
++#define END_LOCKS(x) \
++	if (x != GR_DO_AUDIT) \
++		spin_unlock(&grsec_alert_lock); \
++	else \
++		spin_unlock(&grsec_audit_lock); \
++	read_unlock(&grsec_exec_file_lock); \
++	read_unlock(&tasklist_lock); \
++	rcu_read_unlock(); \
++	if (x == GR_DONT_AUDIT) \
++		gr_handle_alertkill(current)
++
++enum {
++	FLOODING,
++	NO_FLOODING
++};
++
++extern char *gr_alert_log_fmt;
++extern char *gr_audit_log_fmt;
++extern char *gr_alert_log_buf;
++extern char *gr_audit_log_buf;
++
++static int gr_log_start(int audit)
++{
++	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
++	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++
++	if (audit == GR_DO_AUDIT)
++		goto set_fmt;
++
++	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet = 0;
++	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
++		grsec_alert_fyet++;
++	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
++		grsec_alert_wtime = jiffies;
++		grsec_alert_fyet++;
++		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
++		return FLOODING;
++	} else return FLOODING;
++
++set_fmt:
++	memset(buf, 0, PAGE_SIZE);
++	if (current->signal->curr_ip && gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else if (current->signal->curr_ip) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
++	} else if (gr_acl_is_enabled()) {
++		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
++		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
++	} else {
++		sprintf(fmt, "%s%s", loglevel, "grsec: ");
++		strcpy(buf, fmt);
++	}
++
++	return NO_FLOODING;
++}
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++	__attribute__ ((format (printf, 2, 0)));
++
++static void gr_log_middle(int audit, const char *msg, va_list ap)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++
++	return;
++}
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++	__attribute__ ((format (printf, 2, 3)));
++
++static void gr_log_middle_varargs(int audit, const char *msg, ...)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++	va_list ap;
++
++	va_start(ap, msg);
++	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
++	va_end(ap);
++
++	return;
++}
++
++static void gr_log_end(int audit)
++{
++	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
++	unsigned int len = strlen(buf);
++
++	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
++	printk("%s\n", buf);
++
++	return;
++}
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
++{
++	int logtype;
++	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
++	char *str1, *str2, *str3;
++	void *voidptr;
++	int num1, num2;
++	unsigned long ulong1, ulong2;
++	struct dentry *dentry;
++	struct vfsmount *mnt;
++	struct file *file;
++	struct task_struct *task;
++	const struct cred *cred, *pcred;
++	va_list ap;
++
++	BEGIN_LOCKS(audit);
++	logtype = gr_log_start(audit);
++	if (logtype == FLOODING) {
++		END_LOCKS(audit);
++		return;
++	}
++	va_start(ap, argtypes);
++	switch (argtypes) {
++	case GR_TTYSNIFF:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
++		break;
++	case GR_SYSCTL_HIDDEN:
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, str1);
++		break;
++	case GR_RBAC:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_STR_RBAC:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_RBAC_MODE2:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
++		break;
++	case GR_RBAC_MODE3:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		str2 = va_arg(ap, char *);
++		str3 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
++		break;
++	case GR_FILENAME:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
++		break;
++	case GR_STR_FILENAME:
++		str1 = va_arg(ap, char *);
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
++		break;
++	case GR_FILENAME_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
++		break;
++	case GR_FILENAME_TWO_INT:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
++		break;
++	case GR_FILENAME_TWO_INT_STR:
++		dentry = va_arg(ap, struct dentry *);
++		mnt = va_arg(ap, struct vfsmount *);
++		num1 = va_arg(ap, int);
++		num2 = va_arg(ap, int);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
++		break;
++	case GR_TEXTREL:
++		file = va_arg(ap, struct file *);
++		ulong1 = va_arg(ap, unsigned long);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
++		break;
++	case GR_PTRACE:
++		task = va_arg(ap, struct task_struct *);
++		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
++		break;
++	case GR_RESOURCE:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		str1 = va_arg(ap, char *);
++		ulong2 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CAP:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		str1 = va_arg(ap, char *);
++		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_SIG:
++		str1 = va_arg(ap, char *);
++		voidptr = va_arg(ap, void *);
++		gr_log_middle_varargs(audit, msg, str1, voidptr);
++		break;
++	case GR_SIG2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		num1 = va_arg(ap, int);
++		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		break;
++	case GR_CRASH1:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
++		break;
++	case GR_CRASH2:
++		task = va_arg(ap, struct task_struct *);
++		cred = __task_cred(task);
++		pcred = __task_cred(task->parent);
++		ulong1 = va_arg(ap, unsigned long);
++		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
++		break;
++	case GR_PSACCT:
++		{
++			unsigned int wday, cday;
++			__u8 whr, chr;
++			__u8 wmin, cmin;
++			__u8 wsec, csec;
++			char cur_tty[64] = { 0 };
++			char parent_tty[64] = { 0 };
++
++			task = va_arg(ap, struct task_struct *);
++			wday = va_arg(ap, unsigned int);
++			cday = va_arg(ap, unsigned int);
++			whr = va_arg(ap, int);
++			chr = va_arg(ap, int);
++			wmin = va_arg(ap, int);
++			cmin = va_arg(ap, int);
++			wsec = va_arg(ap, int);
++			csec = va_arg(ap, int);
++			ulong1 = va_arg(ap, unsigned long);
++			cred = __task_cred(task);
++			pcred = __task_cred(task->parent);
++
++			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
++		}
++		break;
++	default:
++		gr_log_middle(audit, msg, ap);
++	}
++	va_end(ap);
++	gr_log_end(audit);
++	END_LOCKS(audit);
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_mem.c linux-2.6.32.14/grsecurity/grsec_mem.c
+--- linux-2.6.32.14/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_mem.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,85 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/mman.h>
++#include <linux/grinternal.h>
++
++void
++gr_handle_ioperm(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
++	return;
++}
++
++void
++gr_handle_iopl(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
++	return;
++}
++
++void
++gr_handle_mem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
++	return;
++}
++
++void
++gr_handle_kmem_write(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
++	return;
++}
++
++void
++gr_handle_open_port(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
++	return;
++}
++
++int
++gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
++{
++	unsigned long start, end;
++
++	start = offset;
++	end = start + vma->vm_end - vma->vm_start;
++
++	if (start > end) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	}
++
++	/* allowed ranges : ISA I/O BIOS */
++	if ((start >= __pa(high_memory))
++#if defined(CONFIG_X86) || defined(CONFIG_PPC)
++	    || (start >= 0x000a0000 && end <= 0x00100000)
++	    || (start >= 0x00000000 && end <= 0x00001000)
++#endif
++	)
++		return 0;
++
++	if (vma->vm_flags & VM_WRITE) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
++		return -EPERM;
++	} else
++		vma->vm_flags &= ~VM_MAYWRITE;
++
++	return 0;
++}
++
++void
++gr_log_nonroot_mod_load(const char *modname)
++{
++        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
++        return;
++}
++
++void
++gr_handle_vm86(void)
++{
++	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_mount.c linux-2.6.32.14/grsecurity/grsec_mount.c
+--- linux-2.6.32.14/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_mount.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,62 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mount.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_remount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_unmount(const char *devname, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
++#endif
++	return;
++}
++
++void
++gr_log_mount(const char *from, const char *to, const int retval)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	if (grsec_enable_mount && (retval >= 0))
++		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
++#endif
++	return;
++}
++
++int
++gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
++
++int
++gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
++{
++#ifdef CONFIG_GRKERNSEC_ROFS
++	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
++	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
++		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
++		return -EPERM;
++	} else
++		return 0;
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_ptrace.c linux-2.6.32.14/grsecurity/grsec_ptrace.c
+--- linux-2.6.32.14/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_ptrace.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,14 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_audit_ptrace(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	if (grsec_enable_audit_ptrace)
++		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_sig.c linux-2.6.32.14/grsecurity/grsec_sig.c
+--- linux-2.6.32.14/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_sig.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,65 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++char *signames[] = {
++	[SIGSEGV] = "Segmentation fault",
++	[SIGILL] = "Illegal instruction",
++	[SIGABRT] = "Abort",
++	[SIGBUS] = "Invalid alignment/Bus error"
++};
++
++void
++gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
++{
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
++				    (sig == SIGABRT) || (sig == SIGBUS))) {
++		if (t->pid == current->pid) {
++			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
++		} else {
++			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
++		}
++	}
++#endif
++	return;
++}
++
++int
++gr_handle_signal(const struct task_struct *p, const int sig)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (current->pid > 1 && gr_check_protected_task(p)) {
++		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
++		return -EPERM;
++	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
++		return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++void gr_handle_brute_attach(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	read_lock(&tasklist_lock);
++	read_lock(&grsec_exec_file_lock);
++	if (p->parent && p->parent->exec_file == p->exec_file)
++		p->parent->brute = 1;
++	read_unlock(&grsec_exec_file_lock);
++	read_unlock(&tasklist_lock);
++#endif
++	return;
++}
++
++void gr_handle_brute_check(void)
++{
++#ifdef CONFIG_GRKERNSEC_BRUTE
++	if (current->brute)
++		msleep(30 * 1000);
++#endif
++	return;
++}
++
+diff -urNp linux-2.6.32.14/grsecurity/grsec_sock.c linux-2.6.32.14/grsecurity/grsec_sock.c
+--- linux-2.6.32.14/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_sock.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,271 @@
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/net.h>
++#include <linux/in.h>
++#include <linux/ip.h>
++#include <net/sock.h>
++#include <net/inet_sock.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++#include <linux/gracl.h>
++
++kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
++EXPORT_SYMBOL(gr_cap_rtnetlink);
++
++extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
++
++EXPORT_SYMBOL(gr_search_udp_recvmsg);
++EXPORT_SYMBOL(gr_search_udp_sendmsg);
++
++#ifdef CONFIG_UNIX_MODULE
++EXPORT_SYMBOL(gr_acl_handle_unix);
++EXPORT_SYMBOL(gr_acl_handle_mknod);
++EXPORT_SYMBOL(gr_handle_chroot_unix);
++EXPORT_SYMBOL(gr_handle_create);
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define gr_conn_table_size 32749
++struct conn_table_entry {
++	struct conn_table_entry *next;
++	struct signal_struct *sig;
++};
++
++struct conn_table_entry *gr_conn_table[gr_conn_table_size];
++DEFINE_SPINLOCK(gr_conn_table_lock);
++
++extern const char * gr_socktype_to_name(unsigned char type);
++extern const char * gr_proto_to_name(unsigned char proto);
++
++static __inline__ int 
++conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
++{
++	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
++}
++
++static __inline__ int
++conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
++	   __u16 sport, __u16 dport)
++{
++	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
++		     sig->gr_sport == sport && sig->gr_dport == dport))
++		return 1;
++	else
++		return 0;
++}
++
++static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
++{
++	struct conn_table_entry **match;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	newent->sig = sig;
++	
++	match = &gr_conn_table[index];
++	newent->next = *match;
++	*match = newent;
++
++	return;
++}
++
++static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
++{
++	struct conn_table_entry *match, *last = NULL;
++	unsigned int index;
++
++	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
++			  sig->gr_sport, sig->gr_dport, 
++			  gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, 
++		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
++		sig->gr_dport)) {
++		last = match;
++		match = match->next;
++	}
++
++	if (match) {
++		if (last)
++			last->next = match->next;
++		else
++			gr_conn_table[index] = NULL;
++		kfree(match);
++	}
++
++	return;
++}
++
++static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
++					     __u16 sport, __u16 dport)
++{
++	struct conn_table_entry *match;
++	unsigned int index;
++
++	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
++
++	match = gr_conn_table[index];
++	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
++		match = match->next;
++
++	if (match)
++		return match->sig;
++	else
++		return NULL;
++}
++
++#endif
++
++void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *sig = task->signal;
++	struct conn_table_entry *newent;
++
++	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
++	if (newent == NULL)
++		return;
++	/* no bh lock needed since we are called with bh disabled */
++	spin_lock(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(sig);
++	sig->gr_saddr = inet->rcv_saddr;
++	sig->gr_daddr = inet->daddr;
++	sig->gr_sport = inet->sport;
++	sig->gr_dport = inet->dport;
++	gr_add_to_task_ip_table_nolock(sig, newent);
++	spin_unlock(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void gr_del_task_from_ip_table(struct task_struct *task)
++{
++#ifdef CONFIG_GRKERNSEC
++	spin_lock_bh(&gr_conn_table_lock);
++	gr_del_task_from_ip_table_nolock(task->signal);
++	spin_unlock_bh(&gr_conn_table_lock);
++#endif
++	return;
++}
++
++void
++gr_attach_curr_ip(const struct sock *sk)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct signal_struct *p, *set;
++	const struct inet_sock *inet = inet_sk(sk);	
++
++	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
++		return;
++
++	set = current->signal;
++
++	spin_lock_bh(&gr_conn_table_lock);
++	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
++				    inet->dport, inet->sport);
++	if (unlikely(p != NULL)) {
++		set->curr_ip = p->curr_ip;
++		set->used_accept = 1;
++		gr_del_task_from_ip_table_nolock(p);
++		spin_unlock_bh(&gr_conn_table_lock);
++		return;
++	}
++	spin_unlock_bh(&gr_conn_table_lock);
++
++	set->curr_ip = inet->daddr;
++	set->used_accept = 1;
++#endif
++	return;
++}
++
++int
++gr_handle_sock_all(const int family, const int type, const int protocol)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
++	    (family != AF_UNIX) && (family != AF_LOCAL)) {
++		gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_server_other(const struct sock *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	if (grsec_enable_socket_server &&
++	    in_group_p(grsec_socket_server_gid) &&
++	    sck && (sck->sk_family != AF_UNIX) &&
++	    (sck->sk_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++int
++gr_handle_sock_client(const struct sockaddr *sck)
++{
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
++	    sck && (sck->sa_family != AF_UNIX) &&
++	    (sck->sa_family != AF_LOCAL)) {
++		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++kernel_cap_t
++gr_cap_rtnetlink(struct sock *sock)
++{
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_acl_is_enabled())
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_ISCSI &&
++		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
++		 gr_is_capable(CAP_SYS_ADMIN))
++		return current_cap();
++	else if (sock->sk_protocol == NETLINK_AUDIT &&
++		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
++		 gr_is_capable(CAP_AUDIT_WRITE) &&
++		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
++		 gr_is_capable(CAP_AUDIT_CONTROL))
++		return current_cap();
++	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
++		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
++		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
++		  gr_is_capable(CAP_NET_ADMIN)))
++		return current_cap();
++	else
++		return __cap_empty_set;
++#else
++	return current_cap();
++#endif
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_sysctl.c linux-2.6.32.14/grsecurity/grsec_sysctl.c
+--- linux-2.6.32.14/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_sysctl.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,447 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/sysctl.h>
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++int
++gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
++{
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
++		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
++		return -EACCES;
++	}
++#endif
++	return 0;
++}
++
++#ifdef CONFIG_GRKERNSEC_ROFS
++static int __maybe_unused one = 1;
++#endif
++
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++ctl_table grsecurity_table[] = {
++#ifdef CONFIG_GRKERNSEC_SYSCTL
++#ifdef CONFIG_GRKERNSEC_LINK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "linking_restrictions",
++		.data		= &grsec_enable_link,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FIFO
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "fifo_restrictions",
++		.data		= &grsec_enable_fifo,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECVE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "execve_limiting",
++		.data		= &grsec_enable_execve,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "ip_blackhole",
++		.data		= &grsec_enable_blackhole,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "lastack_retries",
++		.data		= &grsec_lastack_retries,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "exec_logging",
++		.data		= &grsec_enable_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SIGNAL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "signal_logging",
++		.data		= &grsec_enable_signal,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_FORKFAIL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "forkfail_logging",
++		.data		= &grsec_enable_forkfail,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TIME
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "timechange_logging",
++		.data		= &grsec_enable_time,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_shmat",
++		.data		= &grsec_enable_chroot_shmat,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_unix",
++		.data		= &grsec_enable_chroot_unix,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mount",
++		.data		= &grsec_enable_chroot_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_fchdir",
++		.data		= &grsec_enable_chroot_fchdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chroot",
++		.data		= &grsec_enable_chroot_double,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_pivot",
++		.data		= &grsec_enable_chroot_pivot,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_enforce_chdir",
++		.data		= &grsec_enable_chroot_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_chmod",
++		.data		= &grsec_enable_chroot_chmod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_mknod",
++		.data		= &grsec_enable_chroot_mknod,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_restrict_nice",
++		.data		= &grsec_enable_chroot_nice,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_execlog",
++		.data		= &grsec_enable_chroot_execlog,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_caps",
++		.data		= &grsec_enable_chroot_caps,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_deny_sysctl",
++		.data		= &grsec_enable_chroot_sysctl,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe",
++		.data		= &grsec_enable_tpe,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_gid",
++		.data		= &grsec_tpe_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "tpe_restrict_all",
++		.data		= &grsec_enable_tpe_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all",
++		.data		= &grsec_enable_socket_all,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_all_gid",
++		.data		= &grsec_socket_all_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client",
++		.data		= &grsec_enable_socket_client,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_client_gid",
++		.data		= &grsec_socket_client_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server",
++		.data		= &grsec_enable_socket_server,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "socket_server_gid",
++		.data		= &grsec_socket_server_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_group",
++		.data		= &grsec_enable_group,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_gid",
++		.data		= &grsec_audit_gid,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_chdir",
++		.data		= &grsec_enable_chdir,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_mount",
++		.data		= &grsec_enable_mount,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_textrel",
++		.data		= &grsec_enable_audit_textrel,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_DMESG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "dmesg",
++		.data		= &grsec_enable_dmesg,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "chroot_findtask",
++		.data		= &grsec_enable_chroot_findtask,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_RESLOG
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "resource_logging",
++		.data		= &grsec_resource_logging,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "audit_ptrace",
++		.data		= &grsec_enable_audit_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "harden_ptrace",
++		.data		= &grsec_enable_harden_ptrace,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsec_lock",
++		.data		= &grsec_lock,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++#endif
++#ifdef CONFIG_GRKERNSEC_ROFS
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "romount_protect",
++		.data		= &grsec_enable_rofs,
++		.maxlen		= sizeof(int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec_minmax,
++		.extra1		= &one,
++		.extra2		= &one,
++	},
++#endif
++	{ .ctl_name = 0 }
++};
++#endif
+diff -urNp linux-2.6.32.14/grsecurity/grsec_textrel.c linux-2.6.32.14/grsecurity/grsec_textrel.c
+--- linux-2.6.32.14/grsecurity/grsec_textrel.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_textrel.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,16 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/file.h>
++#include <linux/grinternal.h>
++#include <linux/grsecurity.h>
++
++void
++gr_log_textrel(struct vm_area_struct * vma)
++{
++#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
++	if (grsec_enable_audit_textrel)
++		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_time.c linux-2.6.32.14/grsecurity/grsec_time.c
+--- linux-2.6.32.14/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_time.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,13 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/grinternal.h>
++
++void
++gr_log_timechange(void)
++{
++#ifdef CONFIG_GRKERNSEC_TIME
++	if (grsec_enable_time)
++		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
++#endif
++	return;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsec_tpe.c linux-2.6.32.14/grsecurity/grsec_tpe.c
+--- linux-2.6.32.14/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsec_tpe.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,38 @@
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/grinternal.h>
++
++extern int gr_acl_tpe_check(void);
++
++int
++gr_tpe_allow(const struct file *file)
++{
++#ifdef CONFIG_GRKERNSEC
++	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
++	const struct cred *cred = current_cred();
++
++	if (cred->uid && ((grsec_enable_tpe &&
++#ifdef CONFIG_GRKERNSEC_TPE_INVERT
++	    !in_group_p(grsec_tpe_gid)
++#else
++	    in_group_p(grsec_tpe_gid)
++#endif
++	    ) || gr_acl_tpe_check()) &&
++	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
++						(inode->i_mode & S_IWOTH))))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#ifdef CONFIG_GRKERNSEC_TPE_ALL
++	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
++	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
++	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
++		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
++		return 0;
++	}
++#endif
++#endif
++	return 1;
++}
+diff -urNp linux-2.6.32.14/grsecurity/grsum.c linux-2.6.32.14/grsecurity/grsum.c
+--- linux-2.6.32.14/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/grsum.c	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,59 @@
++#include <linux/err.h>
++#include <linux/kernel.h>
++#include <linux/sched.h>
++#include <linux/mm.h>
++#include <linux/scatterlist.h>
++#include <linux/crypto.h>
++#include <linux/gracl.h>
++
++
++#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
++#error "crypto and sha256 must be built into the kernel"
++#endif
++
++int
++chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
++{
++	char *p;
++	struct crypto_hash *tfm;
++	struct hash_desc desc;
++	struct scatterlist sg;
++	unsigned char temp_sum[GR_SHA_LEN];
++	volatile int retval = 0;
++	volatile int dummy = 0;
++	unsigned int i;
++
++	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
++	if (IS_ERR(tfm)) {
++		/* should never happen, since sha256 should be built in */
++		return 1;
++	}
++
++	desc.tfm = tfm;
++	desc.flags = 0;
++
++	crypto_hash_init(&desc);
++
++	p = salt;
++	sg_set_buf(&sg, p, GR_SALT_LEN);
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	p = entry->pw;
++	sg_set_buf(&sg, p, strlen(p));
++	
++	crypto_hash_update(&desc, &sg, sg.length);
++
++	crypto_hash_final(&desc, temp_sum);
++
++	memset(entry->pw, 0, GR_PW_LEN);
++
++	for (i = 0; i < GR_SHA_LEN; i++)
++		if (sum[i] != temp_sum[i])
++			retval = 1;
++		else
++			dummy = 1;	// waste a cycle
++
++	crypto_free_hash(tfm);
++
++	return retval;
++}
+diff -urNp linux-2.6.32.14/grsecurity/Kconfig linux-2.6.32.14/grsecurity/Kconfig
+--- linux-2.6.32.14/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/Kconfig	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,965 @@
++#
++# grecurity configuration
++#
++
++menu "Grsecurity"
++
++config GRKERNSEC
++	bool "Grsecurity"
++	select CRYPTO
++	select CRYPTO_SHA256
++	help
++	  If you say Y here, you will be able to configure many features
++	  that will enhance the security of your system.  It is highly
++	  recommended that you say Y here and read through the help
++	  for each option so that you fully understand the features and
++	  can evaluate their usefulness for your machine.
++
++choice
++	prompt "Security Level"
++	depends on GRKERNSEC
++	default GRKERNSEC_CUSTOM
++
++config GRKERNSEC_LOW
++	bool "Low"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_CHDIR
++
++	help
++	  If you choose this option, several of the grsecurity options will
++	  be enabled that will give you greater protection against a number
++	  of attacks, while assuring that none of your software will have any
++	  conflicts with the additional security measures.  If you run a lot
++	  of unusual software, or you are having problems with the higher
++	  security levels, you should say Y here.  With this option, the
++	  following features are enabled:
++
++	  - Linking restrictions
++	  - FIFO restrictions
++	  - Enforcing RLIMIT_NPROC on execve
++	  - Restricted dmesg
++	  - Enforced chdir("/") on chroot
++	  - Runtime module disabling
++
++config GRKERNSEC_MEDIUM
++	bool "Medium"
++	select PAX
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_USERGROUP
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
++
++	help
++	  If you say Y here, several features in addition to those included
++	  in the low additional security level will be enabled.  These
++	  features provide even more security to your system, though in rare
++	  cases they may be incompatible with very old or poorly written
++	  software.  If you enable this option, make sure that your auth
++	  service (identd) is running as gid 1001.  With this option, 
++	  the following features (in addition to those provided in the 
++	  low additional security level) will be enabled:
++
++	  - Failed fork logging
++	  - Time change logging
++	  - Signal logging
++	  - Deny mounts in chroot
++	  - Deny double chrooting
++	  - Deny sysctl writes in chroot
++	  - Deny mknod in chroot
++	  - Deny access to abstract AF_UNIX sockets out of chroot
++	  - Deny pivot_root in chroot
++	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
++	  - /proc restrictions with special GID set to 10 (usually wheel)
++	  - Address Space Layout Randomization (ASLR)
++	  - Prevent exploitation of most refcount overflows
++	  - Bounds checking of copying between the kernel and userland
++
++config GRKERNSEC_HIGH
++	bool "High"
++	select GRKERNSEC_LINK
++	select GRKERNSEC_FIFO
++	select GRKERNSEC_EXECVE
++	select GRKERNSEC_DMESG
++	select GRKERNSEC_FORKFAIL
++	select GRKERNSEC_TIME
++	select GRKERNSEC_SIGNAL
++	select GRKERNSEC_CHROOT
++	select GRKERNSEC_CHROOT_SHMAT
++	select GRKERNSEC_CHROOT_UNIX
++	select GRKERNSEC_CHROOT_MOUNT
++	select GRKERNSEC_CHROOT_FCHDIR
++	select GRKERNSEC_CHROOT_PIVOT
++	select GRKERNSEC_CHROOT_DOUBLE
++	select GRKERNSEC_CHROOT_CHDIR
++	select GRKERNSEC_CHROOT_MKNOD
++	select GRKERNSEC_CHROOT_CAPS
++	select GRKERNSEC_CHROOT_SYSCTL
++	select GRKERNSEC_CHROOT_FINDTASK
++	select GRKERNSEC_PROC
++	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
++	select GRKERNSEC_HIDESYM
++	select GRKERNSEC_BRUTE
++	select GRKERNSEC_PROC_USERGROUP
++	select GRKERNSEC_KMEM
++	select GRKERNSEC_RESLOG
++	select GRKERNSEC_RANDNET
++	select GRKERNSEC_PROC_ADD
++	select GRKERNSEC_CHROOT_CHMOD
++	select GRKERNSEC_CHROOT_NICE
++	select GRKERNSEC_AUDIT_MOUNT
++	select GRKERNSEC_MODHARDEN if (MODULES)
++	select GRKERNSEC_HARDEN_PTRACE
++	select GRKERNSEC_VM86 if (X86_32)
++	select PAX
++	select PAX_RANDUSTACK
++	select PAX_ASLR
++	select PAX_RANDMMAP
++	select PAX_NOEXEC
++	select PAX_MPROTECT
++	select PAX_EI_PAX
++	select PAX_PT_PAX_FLAGS
++	select PAX_HAVE_ACL_FLAGS
++	select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
++	select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
++	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
++	select PAX_SEGMEXEC if (X86_32)
++	select PAX_PAGEEXEC
++	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
++	select PAX_EMUTRAMP if (PARISC)
++	select PAX_EMUSIGRT if (PARISC)
++	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
++	select PAX_REFCOUNT if (X86 || SPARC64)
++	select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
++	help
++	  If you say Y here, many of the features of grsecurity will be
++	  enabled, which will protect you against many kinds of attacks
++	  against your system.  The heightened security comes at a cost
++	  of an increased chance of incompatibilities with rare software
++	  on your machine.  Since this security level enables PaX, you should
++	  view <http://pax.grsecurity.net> and read about the PaX
++	  project.  While you are there, download chpax and run it on
++	  binaries that cause problems with PaX.  Also remember that
++	  since the /proc restrictions are enabled, you must run your
++	  identd as gid 1001.  This security level enables the following 
++	  features in addition to those listed in the low and medium 
++	  security levels:
++
++	  - Additional /proc restrictions
++	  - Chmod restrictions in chroot
++	  - No signals, ptrace, or viewing of processes outside of chroot
++	  - Capability restrictions in chroot
++	  - Deny fchdir out of chroot
++	  - Priority restrictions in chroot
++	  - Segmentation-based implementation of PaX
++	  - Mprotect restrictions
++	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
++	  - Kernel stack randomization
++	  - Mount/unmount/remount logging
++	  - Kernel symbol hiding
++	  - Prevention of memory exhaustion-based exploits
++	  - Hardening of module auto-loading
++	  - Ptrace restrictions
++	  - Restricted vm86 mode
++
++config GRKERNSEC_CUSTOM
++	bool "Custom"
++	help
++	  If you say Y here, you will be able to configure every grsecurity
++	  option, which allows you to enable many more features that aren't
++	  covered in the basic security levels.  These additional features
++	  include TPE, socket restrictions, and the sysctl system for
++	  grsecurity.  It is advised that you read through the help for
++	  each option to determine its usefulness in your situation.
++
++endchoice
++
++menu "Address Space Protection"
++depends on GRKERNSEC
++
++config GRKERNSEC_KMEM
++	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
++	help
++	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
++	  be written to via mmap or otherwise to modify the running kernel.
++	  /dev/port will also not be allowed to be opened. If you have module
++	  support disabled, enabling this will close up four ways that are
++	  currently used  to insert malicious code into the running kernel.
++	  Even with all these features enabled, we still highly recommend that
++	  you use the RBAC system, as it is still possible for an attacker to
++	  modify the running kernel through privileged I/O granted by ioperm/iopl.
++	  If you are not using XFree86, you may be able to stop this additional
++	  case by enabling the 'Disable privileged I/O' option. Though nothing
++	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
++	  but only to video memory, which is the only writing we allow in this
++	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
++	  not be allowed to mprotect it with PROT_WRITE later.
++	  It is highly recommended that you say Y here if you meet all the
++	  conditions above.
++
++config GRKERNSEC_VM86
++	bool "Restrict VM86 mode"
++	depends on X86_32
++
++	help
++	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
++	  make use of a special execution mode on 32bit x86 processors called
++	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
++	  video cards and will still work with this option enabled.  The purpose
++	  of the option is to prevent exploitation of emulation errors in
++	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
++	  Nearly all users should be able to enable this option.
++
++config GRKERNSEC_IO
++	bool "Disable privileged I/O"
++	depends on X86
++	select RTC_CLASS
++	select RTC_INTF_DEV
++	select RTC_DRV_CMOS
++
++	help
++	  If you say Y here, all ioperm and iopl calls will return an error.
++	  Ioperm and iopl can be used to modify the running kernel.
++	  Unfortunately, some programs need this access to operate properly,
++	  the most notable of which are XFree86 and hwclock.  hwclock can be
++	  remedied by having RTC support in the kernel, so real-time 
++	  clock support is enabled if this option is enabled, to ensure 
++	  that hwclock operates correctly.  XFree86 still will not 
++	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
++	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
++	  protect your kernel against modification, use the RBAC system.
++
++config GRKERNSEC_PROC_MEMMAP
++	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
++	default y if (PAX_NOEXEC || PAX_ASLR)
++	depends on PAX_NOEXEC || PAX_ASLR
++	help
++	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
++	  give no information about the addresses of its mappings if
++	  PaX features that rely on random addresses are enabled on the task.
++	  If you use PaX it is greatly recommended that you say Y here as it
++	  closes up a hole that makes the full ASLR useless for suid
++	  binaries.
++
++config GRKERNSEC_BRUTE
++	bool "Deter exploit bruteforcing"
++	help
++	  If you say Y here, attempts to bruteforce exploits against forking
++	  daemons such as apache or sshd will be deterred.  When a child of a
++	  forking daemon is killed by PaX or crashes due to an illegal
++	  instruction, the parent process will be delayed 30 seconds upon every
++	  subsequent fork until the administrator is able to assess the
++	  situation and restart the daemon.  It is recommended that you also
++	  enable signal logging in the auditing section so that logs are
++	  generated when a process performs an illegal instruction.
++
++config GRKERNSEC_MODHARDEN
++	bool "Harden module auto-loading"
++	depends on MODULES
++	help
++	  If you say Y here, module auto-loading in response to use of some
++	  feature implemented by an unloaded module will be restricted to
++	  root users.  Enabling this option helps defend against attacks 
++	  by unprivileged users who abuse the auto-loading behavior to 
++	  cause a vulnerable module to load that is then exploited.
++
++	  If this option prevents a legitimate use of auto-loading for a 
++	  non-root user, the administrator can execute modprobe manually 
++	  with the exact name of the module mentioned in the alert log.
++	  Alternatively, the administrator can add the module to the list
++	  of modules loaded at boot by modifying init scripts.
++
++	  Modification of init scripts will most likely be needed on 
++	  Ubuntu servers with encrypted home directory support enabled,
++	  as the first non-root user logging in will cause the ecb(aes),
++	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
++
++config GRKERNSEC_HIDESYM
++	bool "Hide kernel symbols"
++	help
++	  If you say Y here, getting information on loaded modules, and
++	  displaying all kernel symbols through a syscall will be restricted
++	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
++	  /proc/kallsyms will be restricted to the root user.  The RBAC
++	  system can hide that entry even from root.  Note that this option
++	  is only effective provided the following conditions are met:
++	  1) The kernel using grsecurity is not precompiled by some distribution
++	  2) You are using the RBAC system and hiding other files such as your
++	     kernel image and System.map.  Alternatively, enabling this option
++	     causes the permissions on /boot, /lib/modules, and the kernel
++	     source directory to change at compile time to prevent 
++	     reading by non-root users.
++	  If the above conditions are met, this option will aid in providing a
++	  useful protection against local kernel exploitation of overflows
++	  and arbitrary read/write vulnerabilities.
++
++endmenu
++menu "Role Based Access Control Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_NO_RBAC
++	bool "Disable RBAC system"
++	help
++	  If you say Y here, the /dev/grsec device will be removed from the kernel,
++	  preventing the RBAC system from being enabled.  You should only say Y
++	  here if you have no intention of using the RBAC system, so as to prevent
++	  an attacker with root access from misusing the RBAC system to hide files
++	  and processes when loadable module support and /dev/[k]mem have been
++	  locked down.
++
++config GRKERNSEC_ACL_HIDEKERN
++	bool "Hide kernel processes"
++	help
++	  If you say Y here, all kernel threads will be hidden to all
++	  processes but those whose subject has the "view hidden processes"
++	  flag.
++
++config GRKERNSEC_ACL_MAXTRIES
++	int "Maximum tries before password lockout"
++	default 3
++	help
++	  This option enforces the maximum number of times a user can attempt
++	  to authorize themselves with the grsecurity RBAC system before being
++	  denied the ability to attempt authorization again for a specified time.
++	  The lower the number, the harder it will be to brute-force a password.
++
++config GRKERNSEC_ACL_TIMEOUT
++	int "Time to wait after max password tries, in seconds"
++	default 30
++	help
++	  This option specifies the time the user must wait after attempting to
++	  authorize to the RBAC system with the maximum number of invalid
++	  passwords.  The higher the number, the harder it will be to brute-force
++	  a password.
++
++endmenu
++menu "Filesystem Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_PROC
++	bool "Proc restrictions"
++	help
++	  If you say Y here, the permissions of the /proc filesystem
++	  will be altered to enhance system security and privacy.  You MUST
++  	  choose either a user only restriction or a user and group restriction.
++	  Depending upon the option you choose, you can either restrict users to
++	  see only the processes they themselves run, or choose a group that can
++	  view all processes and files normally restricted to root if you choose
++	  the "restrict to user only" option.  NOTE: If you're running identd as
++	  a non-root user, you will have to run it as the group you specify here.
++
++config GRKERNSEC_PROC_USER
++	bool "Restrict /proc to user only"
++	depends on GRKERNSEC_PROC
++	help
++	  If you say Y here, non-root users will only be able to view their own
++	  processes, and restricts them from viewing network-related information,
++	  and viewing kernel symbol and module information.
++
++config GRKERNSEC_PROC_USERGROUP
++	bool "Allow special group"
++	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
++	help
++	  If you say Y here, you will be able to select a group that will be
++	  able to view all processes, network-related information, and
++	  kernel and symbol information.  This option is useful if you want
++	  to run identd as a non-root user.
++
++config GRKERNSEC_PROC_GID
++	int "GID for special group"
++	depends on GRKERNSEC_PROC_USERGROUP
++	default 1001
++
++config GRKERNSEC_PROC_ADD
++	bool "Additional restrictions"
++	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
++	help
++	  If you say Y here, additional restrictions will be placed on
++	  /proc that keep normal users from viewing device information and 
++	  slabinfo information that could be useful for exploits.
++
++config GRKERNSEC_LINK
++	bool "Linking restrictions"
++	help
++	  If you say Y here, /tmp race exploits will be prevented, since users
++	  will no longer be able to follow symlinks owned by other users in
++	  world-writable +t directories (i.e. /tmp), unless the owner of the
++	  symlink is the owner of the directory. users will also not be
++	  able to hardlink to files they do not own.  If the sysctl option is
++	  enabled, a sysctl option with name "linking_restrictions" is created.
++
++config GRKERNSEC_FIFO
++	bool "FIFO restrictions"
++	help
++	  If you say Y here, users will not be able to write to FIFOs they don't
++	  own in world-writable +t directories (i.e. /tmp), unless the owner of
++	  the FIFO is the same owner of the directory it's held in.  If the sysctl
++	  option is enabled, a sysctl option with name "fifo_restrictions" is
++	  created.
++
++config GRKERNSEC_ROFS
++	bool "Runtime read-only mount protection"
++	help
++	  If you say Y here, a sysctl option with name "romount_protect" will
++	  be created.  By setting this option to 1 at runtime, filesystems
++	  will be protected in the following ways:
++	  * No new writable mounts will be allowed
++	  * Existing read-only mounts won't be able to be remounted read/write
++	  * Write operations will be denied on all block devices
++	  This option acts independently of grsec_lock: once it is set to 1,
++	  it cannot be turned off.  Therefore, please be mindful of the resulting
++	  behavior if this option is enabled in an init script on a read-only
++	  filesystem.  This feature is mainly intended for secure embedded systems.
++
++config GRKERNSEC_CHROOT
++	bool "Chroot jail restrictions"
++	help
++	  If you say Y here, you will be able to choose several options that will
++	  make breaking out of a chrooted jail much more difficult.  If you
++	  encounter no software incompatibilities with the following options, it
++	  is recommended that you enable each one.
++
++config GRKERNSEC_CHROOT_MOUNT
++	bool "Deny mounts"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  mount or remount filesystems.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_deny_mount" is created.
++
++config GRKERNSEC_CHROOT_DOUBLE
++	bool "Deny double-chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chroot
++	  again outside the chroot.  This is a widely used method of breaking
++	  out of a chroot jail and should not be allowed.  If the sysctl 
++	  option is enabled, a sysctl option with name 
++	  "chroot_deny_chroot" is created.
++
++config GRKERNSEC_CHROOT_PIVOT
++	bool "Deny pivot_root in chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to use
++	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
++	  works similar to chroot in that it changes the root filesystem.  This
++	  function could be misused in a chrooted process to attempt to break out
++	  of the chroot, and therefore should not be allowed.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
++	  created.
++
++config GRKERNSEC_CHROOT_CHDIR
++	bool "Enforce chdir(\"/\") on all chroots"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the current working directory of all newly-chrooted
++	  applications will be set to the the root directory of the chroot.
++	  The man page on chroot(2) states:
++	  Note that this call does not change  the  current  working
++	  directory,  so  that `.' can be outside the tree rooted at
++	  `/'.  In particular, the  super-user  can  escape  from  a
++	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
++
++	  It is recommended that you say Y here, since it's not known to break
++	  any software.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_enforce_chdir" is created.
++
++config GRKERNSEC_CHROOT_CHMOD
++	bool "Deny (f)chmod +s"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to chmod
++	  or fchmod files to make them have suid or sgid bits.  This protects
++	  against another published method of breaking a chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
++	  created.
++
++config GRKERNSEC_CHROOT_FCHDIR
++	bool "Deny fchdir out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
++	  to a file descriptor of the chrooting process that points to a directory
++	  outside the filesystem will be stopped.  If the sysctl option
++	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
++
++config GRKERNSEC_CHROOT_MKNOD
++	bool "Deny mknod"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be allowed to
++	  mknod.  The problem with using mknod inside a chroot is that it
++	  would allow an attacker to create a device entry that is the same
++	  as one on the physical root of your system, which could range from
++	  anything from the console device to a device for your harddrive (which
++	  they could then use to wipe the drive or steal data).  It is recommended
++	  that you say Y here, unless you run into software incompatibilities.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_mknod" is created.
++
++config GRKERNSEC_CHROOT_SHMAT
++	bool "Deny shmat() out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to attach
++	  to shared memory segments that were created outside of the chroot jail.
++	  It is recommended that you say Y here.  If the sysctl option is enabled,
++	  a sysctl option with name "chroot_deny_shmat" is created.
++
++config GRKERNSEC_CHROOT_UNIX
++	bool "Deny access to abstract AF_UNIX sockets out of chroot"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  connect to abstract (meaning not belonging to a filesystem) Unix
++	  domain sockets that were bound outside of a chroot.  It is recommended
++	  that you say Y here.  If the sysctl option is enabled, a sysctl option
++	  with name "chroot_deny_unix" is created.
++
++config GRKERNSEC_CHROOT_FINDTASK
++	bool "Protect outside processes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to
++	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
++	  getsid, or view any process outside of the chroot.  If the sysctl
++	  option is enabled, a sysctl option with name "chroot_findtask" is
++	  created.
++
++config GRKERNSEC_CHROOT_NICE
++	bool "Restrict priority changes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, processes inside a chroot will not be able to raise
++	  the priority of processes in the chroot, or alter the priority of
++	  processes outside the chroot.  This provides more security than simply
++	  removing CAP_SYS_NICE from the process' capability set.  If the
++	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
++	  is created.
++
++config GRKERNSEC_CHROOT_SYSCTL
++	bool "Deny sysctl writes"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, an attacker in a chroot will not be able to
++	  write to sysctl entries, either by sysctl(2) or through a /proc
++	  interface.  It is strongly recommended that you say Y here. If the
++	  sysctl option is enabled, a sysctl option with name
++	  "chroot_deny_sysctl" is created.
++
++config GRKERNSEC_CHROOT_CAPS
++	bool "Capability restrictions"
++	depends on GRKERNSEC_CHROOT
++	help
++	  If you say Y here, the capabilities on all root processes within a
++	  chroot jail will be lowered to stop module insertion, raw i/o,
++	  system and net admin tasks, rebooting the system, modifying immutable
++	  files, modifying IPC owned by another, and changing the system time.
++	  This is left an option because it can break some apps.  Disable this
++	  if your chrooted apps are having problems performing those kinds of
++	  tasks.  If the sysctl option is enabled, a sysctl option with
++	  name "chroot_caps" is created.
++
++endmenu
++menu "Kernel Auditing"
++depends on GRKERNSEC
++
++config GRKERNSEC_AUDIT_GROUP
++	bool "Single group for auditing"
++	help
++	  If you say Y here, the exec, chdir, and (un)mount logging features
++	  will only operate on a group you specify.  This option is recommended
++	  if you only want to watch certain users instead of having a large
++	  amount of logs from the entire system.  If the sysctl option is enabled,
++	  a sysctl option with name "audit_group" is created.
++
++config GRKERNSEC_AUDIT_GID
++	int "GID for auditing"
++	depends on GRKERNSEC_AUDIT_GROUP
++	default 1007
++
++config GRKERNSEC_EXECLOG
++	bool "Exec logging"
++	help
++	  If you say Y here, all execve() calls will be logged (since the
++	  other exec*() calls are frontends to execve(), all execution
++	  will be logged).  Useful for shell-servers that like to keep track
++	  of their users.  If the sysctl option is enabled, a sysctl option with
++	  name "exec_logging" is created.
++	  WARNING: This option when enabled will produce a LOT of logs, especially
++	  on an active system.
++
++config GRKERNSEC_RESLOG
++	bool "Resource logging"
++	help
++	  If you say Y here, all attempts to overstep resource limits will
++	  be logged with the resource name, the requested size, and the current
++	  limit.  It is highly recommended that you say Y here.  If the sysctl
++	  option is enabled, a sysctl option with name "resource_logging" is
++	  created.  If the RBAC system is enabled, the sysctl value is ignored.
++
++config GRKERNSEC_CHROOT_EXECLOG
++	bool "Log execs within chroot"
++	help
++	  If you say Y here, all executions inside a chroot jail will be logged
++	  to syslog.  This can cause a large amount of logs if certain
++	  applications (eg. djb's daemontools) are installed on the system, and
++	  is therefore left as an option.  If the sysctl option is enabled, a
++	  sysctl option with name "chroot_execlog" is created.
++
++config GRKERNSEC_AUDIT_PTRACE
++	bool "Ptrace logging"
++	help
++	  If you say Y here, all attempts to attach to a process via ptrace
++	  will be logged.  If the sysctl option is enabled, a sysctl option
++	  with name "audit_ptrace" is created.
++
++config GRKERNSEC_AUDIT_CHDIR
++	bool "Chdir logging"
++	help
++	  If you say Y here, all chdir() calls will be logged.  If the sysctl
++ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
++
++config GRKERNSEC_AUDIT_MOUNT
++	bool "(Un)Mount logging"
++	help
++	  If you say Y here, all mounts and unmounts will be logged.  If the
++	  sysctl option is enabled, a sysctl option with name "audit_mount" is
++	  created.
++
++config GRKERNSEC_SIGNAL
++	bool "Signal logging"
++	help
++	  If you say Y here, certain important signals will be logged, such as
++	  SIGSEGV, which will as a result inform you of when a error in a program
++	  occurred, which in some cases could mean a possible exploit attempt.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "signal_logging" is created.
++
++config GRKERNSEC_FORKFAIL
++	bool "Fork failure logging"
++	help
++	  If you say Y here, all failed fork() attempts will be logged.
++	  This could suggest a fork bomb, or someone attempting to overstep
++	  their process limit.  If the sysctl option is enabled, a sysctl option
++	  with name "forkfail_logging" is created.
++
++config GRKERNSEC_TIME
++	bool "Time change logging"
++	help
++	  If you say Y here, any changes of the system clock will be logged.
++	  If the sysctl option is enabled, a sysctl option with name
++	  "timechange_logging" is created.
++
++config GRKERNSEC_PROC_IPADDR
++	bool "/proc/<pid>/ipaddr support"
++	help
++	  If you say Y here, a new entry will be added to each /proc/<pid>
++	  directory that contains the IP address of the person using the task.
++	  The IP is carried across local TCP and AF_UNIX stream sockets.
++	  This information can be useful for IDS/IPSes to perform remote response
++	  to a local attack.  The entry is readable by only the owner of the
++	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
++	  the RBAC system), and thus does not create privacy concerns.
++
++config GRKERNSEC_AUDIT_TEXTREL
++	bool 'ELF text relocations logging (READ HELP)'
++	depends on PAX_MPROTECT
++	help
++	  If you say Y here, text relocations will be logged with the filename
++	  of the offending library or binary.  The purpose of the feature is
++	  to help Linux distribution developers get rid of libraries and
++	  binaries that need text relocations which hinder the future progress
++	  of PaX.  Only Linux distribution developers should say Y here, and
++	  never on a production machine, as this option creates an information
++	  leak that could aid an attacker in defeating the randomization of
++	  a single memory region.  If the sysctl option is enabled, a sysctl
++	  option with name "audit_textrel" is created.
++
++endmenu
++
++menu "Executable Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_EXECVE
++	bool "Enforce RLIMIT_NPROC on execs"
++	help
++	  If you say Y here, users with a resource limit on processes will
++	  have the value checked during execve() calls.  The current system
++	  only checks the system limit during fork() calls.  If the sysctl option
++	  is enabled, a sysctl option with name "execve_limiting" is created.
++
++config GRKERNSEC_DMESG
++	bool "Dmesg(8) restriction"
++	help
++	  If you say Y here, non-root users will not be able to use dmesg(8)
++	  to view up to the last 4kb of messages in the kernel's log buffer.
++	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
++	  created.
++
++config GRKERNSEC_HARDEN_PTRACE
++	bool "Deter ptrace-based process snooping"
++	help
++	  If you say Y here, TTY sniffers and other malicious monitoring
++	  programs implemented through ptrace will be defeated.  If you
++	  have been using the RBAC system, this option has already been
++	  enabled for several years for all users, with the ability to make
++	  fine-grained exceptions.
++
++	  This option only affects the ability of non-root users to ptrace
++	  processes that are not a descendent of the ptracing process.
++	  This means that strace ./binary and gdb ./binary will still work,
++	  but attaching to arbitrary processes will not.  If the sysctl
++	  option is enabled, a sysctl option with name "harden_ptrace" is
++	  created.
++
++config GRKERNSEC_TPE
++	bool "Trusted Path Execution (TPE)"
++	help
++	  If you say Y here, you will be able to choose a gid to add to the
++	  supplementary groups of users you want to mark as "untrusted."
++	  These users will not be able to execute any files that are not in
++	  root-owned directories writable only by root.  If the sysctl option
++	  is enabled, a sysctl option with name "tpe" is created.
++
++config GRKERNSEC_TPE_ALL
++	bool "Partially restrict non-root users"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, All non-root users other than the ones in the
++	  group specified in the main TPE option will only be allowed to
++	  execute files in directories they own that are not group or
++	  world-writable, or in directories owned by root and writable only by
++	  root.  If the sysctl option is enabled, a sysctl option with name
++	  "tpe_restrict_all" is created.
++
++config GRKERNSEC_TPE_INVERT
++	bool "Invert GID option"
++	depends on GRKERNSEC_TPE
++	help
++	  If you say Y here, the group you specify in the TPE configuration will
++	  decide what group TPE restrictions will be *disabled* for.  This
++	  option is useful if you want TPE restrictions to be applied to most
++	  users on the system.
++
++config GRKERNSEC_TPE_GID
++	int "GID for untrusted users"
++	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++config GRKERNSEC_TPE_GID
++	int "GID for trusted users"
++	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
++	default 1005
++	help
++	  If you have selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *disabled* for.
++	  If you have not selected the "Invert GID option" above, setting this
++	  GID determines what group TPE restrictions will be *enabled* for.
++	  If the sysctl option is enabled, a sysctl option with name "tpe_gid"
++	  is created.
++
++endmenu
++menu "Network Protections"
++depends on GRKERNSEC
++
++config GRKERNSEC_RANDNET
++	bool "Larger entropy pools"
++	help
++	  If you say Y here, the entropy pools used for many features of Linux
++	  and grsecurity will be doubled in size.  Since several grsecurity
++	  features use additional randomness, it is recommended that you say Y
++	  here.  Saying Y here has a similar effect as modifying
++	  /proc/sys/kernel/random/poolsize.
++
++config GRKERNSEC_BLACKHOLE
++	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
++	help
++	  If you say Y here, neither TCP resets nor ICMP
++	  destination-unreachable packets will be sent in response to packets
++	  send to ports for which no associated listening process exists.
++	  This feature supports both IPV4 and IPV6 and exempts the 
++	  loopback interface from blackholing.  Enabling this feature 
++	  makes a host more resilient to DoS attacks and reduces network
++	  visibility against scanners.
++
++	  The blackhole feature as-implemented is equivalent to the FreeBSD
++	  blackhole feature, as prevents RST responses to all packets, not
++	  just SYNs.  Under most application behavior this causes no
++	  problems, but applications (like haproxy) may not close certain
++	  connections in a way that cleanly terminates them on the remote
++	  end, leaving the remote host in LAST_ACK state.  Because of this
++	  side-effect and to prevent intentional LAST_ACK DoSes, this
++	  feature also adds automatic mitigation against such attacks.
++	  The mitigation drastically reduces the amount of time a socket
++	  can spend in LAST_ACK state.  If you're using haproxy and not
++	  all servers it connects to have this option enabled, consider
++	  disabling this feature on the haproxy host.
++
++	  If this option is enabled, two sysctl options with names
++	  "ip_blackhole" and "lastack_retries" will be created.
++	  While "ip_blackhole" takes the standard zero/non-zero on/off
++	  toggle, "lastack_retries" uses the same kinds of values as
++	  "tcp_retries1" and "tcp_retries2".  The default value of 4
++	  prevents a socket from lasting more than 45 seconds in LAST_ACK
++	  state.
++
++config GRKERNSEC_SOCKET
++	bool "Socket restrictions"
++	help
++	  If you say Y here, you will be able to choose from several options.
++	  If you assign a GID on your system and add it to the supplementary
++	  groups of users you want to restrict socket access to, this patch
++	  will perform up to three things, based on the option(s) you choose.
++
++config GRKERNSEC_SOCKET_ALL
++	bool "Deny any sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine or run server
++	  applications from your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_all" is created.
++
++config GRKERNSEC_SOCKET_ALL_GID
++	int "GID to deny all sockets for"
++	depends on GRKERNSEC_SOCKET_ALL
++	default 1004
++	help
++	  Here you can choose the GID to disable socket access for. Remember to
++	  add the users you want socket access disabled for to the GID
++	  specified here.  If the sysctl option is enabled, a sysctl option
++	  with name "socket_all_gid" is created.
++
++config GRKERNSEC_SOCKET_CLIENT
++	bool "Deny client sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to connect to other hosts from your machine, but will be
++	  able to run servers.  If this option is enabled, all users in the group
++	  you specify will have to use passive mode when initiating ftp transfers
++	  from the shell on your machine.  If the sysctl option is enabled, a
++	  sysctl option with name "socket_client" is created.
++
++config GRKERNSEC_SOCKET_CLIENT_GID
++	int "GID to deny client sockets for"
++	depends on GRKERNSEC_SOCKET_CLIENT
++	default 1003
++	help
++	  Here you can choose the GID to disable client socket access for.
++	  Remember to add the users you want client socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_client_gid" is created.
++
++config GRKERNSEC_SOCKET_SERVER
++	bool "Deny server sockets to group"
++	depends on GRKERNSEC_SOCKET
++	help
++	  If you say Y here, you will be able to choose a GID of whose users will
++	  be unable to run server applications from your machine.  If the sysctl
++	  option is enabled, a sysctl option with name "socket_server" is created.
++
++config GRKERNSEC_SOCKET_SERVER_GID
++	int "GID to deny server sockets for"
++	depends on GRKERNSEC_SOCKET_SERVER
++	default 1002
++	help
++	  Here you can choose the GID to disable server socket access for.
++	  Remember to add the users you want server socket access disabled for to
++	  the GID specified here.  If the sysctl option is enabled, a sysctl
++	  option with name "socket_server_gid" is created.
++
++endmenu
++menu "Sysctl support"
++depends on GRKERNSEC && SYSCTL
++
++config GRKERNSEC_SYSCTL
++	bool "Sysctl support"
++	help
++	  If you say Y here, you will be able to change the options that
++	  grsecurity runs with at bootup, without having to recompile your
++	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
++	  to enable (1) or disable (0) various features.  All the sysctl entries
++	  are mutable until the "grsec_lock" entry is set to a non-zero value.
++	  All features enabled in the kernel configuration are disabled at boot
++	  if you do not say Y to the "Turn on features by default" option.
++	  All options should be set at startup, and the grsec_lock entry should
++	  be set to a non-zero value after all the options are set.
++	  *THIS IS EXTREMELY IMPORTANT*
++
++config GRKERNSEC_SYSCTL_ON
++	bool "Turn on features by default"
++	depends on GRKERNSEC_SYSCTL
++	help
++	  If you say Y here, instead of having all features enabled in the
++	  kernel configuration disabled at boot time, the features will be
++	  enabled at boot time.  It is recommended you say Y here unless
++	  there is some reason you would want all sysctl-tunable features to
++	  be disabled by default.  As mentioned elsewhere, it is important
++	  to enable the grsec_lock entry once you have finished modifying
++	  the sysctl entries.
++
++endmenu
++menu "Logging Options"
++depends on GRKERNSEC
++
++config GRKERNSEC_FLOODTIME
++	int "Seconds in between log messages (minimum)"
++	default 10
++	help
++	  This option allows you to enforce the number of seconds between
++	  grsecurity log messages.  The default should be suitable for most
++	  people, however, if you choose to change it, choose a value small enough
++	  to allow informative logs to be produced, but large enough to
++	  prevent flooding.
++
++config GRKERNSEC_FLOODBURST
++	int "Number of messages in a burst (maximum)"
++	default 4
++	help
++	  This option allows you to choose the maximum number of messages allowed
++	  within the flood time interval you chose in a separate option.  The
++	  default should be suitable for most people, however if you find that
++	  many of your logs are being interpreted as flooding, you may want to
++	  raise this value.
++
++endmenu
++
++endmenu
+diff -urNp linux-2.6.32.14/grsecurity/Makefile linux-2.6.32.14/grsecurity/Makefile
+--- linux-2.6.32.14/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/grsecurity/Makefile	2010-05-28 21:27:16.331240103 -0400
+@@ -0,0 +1,29 @@
++# grsecurity's ACL system was originally written in 2001 by Michael Dalton
++# during 2001-2009 it has been completely redesigned by Brad Spengler
++# into an RBAC system
++#
++# All code in this directory and various hooks inserted throughout the kernel
++# are copyright Brad Spengler - Open Source Security, Inc., and released 
++# under the GPL v2 or higher
++
++obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
++	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
++	grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
++
++obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
++	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
++	gracl_learn.o grsec_log.o
++obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
++
++ifndef CONFIG_GRKERNSEC
++obj-y += grsec_disabled.o
++endif
++
++ifdef CONFIG_GRKERNSEC_HIDESYM
++extra-y := grsec_hidesym.o
++$(obj)/grsec_hidesym.o:
++	@-chmod -f 500 /boot
++	@-chmod -f 500 /lib/modules
++	@-chmod -f 700 .
++	@echo '  grsec: protected kernel image paths'
++endif
+diff -urNp linux-2.6.32.14/include/acpi/acoutput.h linux-2.6.32.14/include/acpi/acoutput.h
+--- linux-2.6.32.14/include/acpi/acoutput.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/acpi/acoutput.h	2010-05-28 21:27:16.336579957 -0400
+@@ -264,8 +264,8 @@
+  * leaving no executable debug code!
+  */
+ #define ACPI_FUNCTION_NAME(a)
+-#define ACPI_DEBUG_PRINT(pl)
+-#define ACPI_DEBUG_PRINT_RAW(pl)
++#define ACPI_DEBUG_PRINT(pl) do {} while (0)
++#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
+ 
+ #endif				/* ACPI_DEBUG_OUTPUT */
+ 
+diff -urNp linux-2.6.32.14/include/acpi/acpi_drivers.h linux-2.6.32.14/include/acpi/acpi_drivers.h
+--- linux-2.6.32.14/include/acpi/acpi_drivers.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/acpi/acpi_drivers.h	2010-05-28 21:27:16.336579957 -0400
+@@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
+                                   Dock Station
+   -------------------------------------------------------------------------- */
+ struct acpi_dock_ops {
+-	acpi_notify_handler handler;
+-	acpi_notify_handler uevent;
++	const acpi_notify_handler handler;
++	const acpi_notify_handler uevent;
+ };
+ 
+ #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
+@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
+ extern int register_dock_notifier(struct notifier_block *nb);
+ extern void unregister_dock_notifier(struct notifier_block *nb);
+ extern int register_hotplug_dock_device(acpi_handle handle,
+-					struct acpi_dock_ops *ops,
++					const struct acpi_dock_ops *ops,
+ 					void *context);
+ extern void unregister_hotplug_dock_device(acpi_handle handle);
+ #else
+@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
+ {
+ }
+ static inline int register_hotplug_dock_device(acpi_handle handle,
+-					       struct acpi_dock_ops *ops,
++					       const struct acpi_dock_ops *ops,
+ 					       void *context)
+ {
+ 	return -ENODEV;
+diff -urNp linux-2.6.32.14/include/asm-generic/atomic-long.h linux-2.6.32.14/include/asm-generic/atomic-long.h
+--- linux-2.6.32.14/include/asm-generic/atomic-long.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/atomic-long.h	2010-05-28 21:27:16.339120729 -0400
+@@ -22,6 +22,12 @@
+ 
+ typedef atomic64_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic64_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic64_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
+ 
+ static inline long atomic_long_read(atomic_long_t *l)
+@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic64_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
+ 	atomic64_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic64_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -59,6 +92,15 @@ static inline void atomic_long_add(long 
+ 	atomic64_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	atomic64_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic64_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
++
++	return (long)atomic64_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic64_t *v = (atomic64_t *)l;
+@@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
+ 
+ typedef atomic_t atomic_long_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef atomic_unchecked_t atomic_long_unchecked_t;
++#else
++typedef atomic_t atomic_long_unchecked_t;
++#endif
++
+ #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
+ static inline long atomic_long_read(atomic_long_t *l)
+ {
+@@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
+ 	return (long)atomic_read(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_read_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_set(atomic_long_t *l, long i)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
+ 	atomic_set(v, i);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_set_unchecked(v, i);
++}
++#endif
++
+ static inline void atomic_long_inc(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
+ 	atomic_inc(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_inc_unchecked(v);
++}
++#endif
++
+ static inline void atomic_long_dec(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -176,6 +260,15 @@ static inline void atomic_long_add(long 
+ 	atomic_add(i, v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	atomic_add_unchecked(i, v);
++}
++#endif
++
+ static inline void atomic_long_sub(long i, atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
+ 	return (long)atomic_inc_return(v);
+ }
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
++{
++	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
++
++	return (long)atomic_inc_return_unchecked(v);
++}
++#endif
++
+ static inline long atomic_long_dec_return(atomic_long_t *l)
+ {
+ 	atomic_t *v = (atomic_t *)l;
+@@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
+ 
+ #endif  /*  BITS_PER_LONG == 64  */
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++static inline void pax_refcount_needs_these_functions(void)
++{
++	atomic_read_unchecked((atomic_unchecked_t *)NULL);
++	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
++	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
++
++	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
++	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
++	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
++}
++#else
++#define atomic_read_unchecked(v) atomic_read(v)
++#define atomic_set_unchecked(v, i) atomic_set((v), (i))
++#define atomic_add_unchecked(i, v) atomic_add((i), (v))
++#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
++#define atomic_inc_unchecked(v) atomic_inc(v)
++
++#define atomic_long_read_unchecked(v) atomic_long_read(v)
++#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
++#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
++#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
++#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
++#endif
++
+ #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
+diff -urNp linux-2.6.32.14/include/asm-generic/dma-mapping-common.h linux-2.6.32.14/include/asm-generic/dma-mapping-common.h
+--- linux-2.6.32.14/include/asm-generic/dma-mapping-common.h	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/include/asm-generic/dma-mapping-common.h	2010-05-28 21:27:16.339120729 -0400
+@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
+ 					      enum dma_data_direction dir,
+ 					      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(ptr, size);
+@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
+ 					  enum dma_data_direction dir,
+ 					  struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
+ 				   int nents, enum dma_data_direction dir,
+ 				   struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	int i, ents;
+ 	struct scatterlist *s;
+ 
+@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
+ 				      int nents, enum dma_data_direction dir,
+ 				      struct dma_attrs *attrs)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	debug_dma_unmap_sg(dev, sg, nents, dir);
+@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
+ 				      size_t offset, size_t size,
+ 				      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 	dma_addr_t addr;
+ 
+ 	kmemcheck_mark_initialized(page_address(page) + offset, size);
+@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
+ static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+ 				  size_t size, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->unmap_page)
+@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
+ 					   size_t size,
+ 					   enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_cpu)
+@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
+ 					      dma_addr_t addr, size_t size,
+ 					      enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_for_device)
+@@ -123,7 +123,7 @@ static inline void dma_sync_single_range
+ 						 size_t size,
+ 						 enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_cpu) {
+@@ -140,7 +140,7 @@ static inline void dma_sync_single_range
+ 						    size_t size,
+ 						    enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_single_range_for_device) {
+@@ -155,7 +155,7 @@ static inline void
+ dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
+ 		    int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_cpu)
+@@ -167,7 +167,7 @@ static inline void
+ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
+ 		       int nelems, enum dma_data_direction dir)
+ {
+-	struct dma_map_ops *ops = get_dma_ops(dev);
++	const struct dma_map_ops *ops = get_dma_ops(dev);
+ 
+ 	BUG_ON(!valid_dma_direction(dir));
+ 	if (ops->sync_sg_for_device)
+diff -urNp linux-2.6.32.14/include/asm-generic/futex.h linux-2.6.32.14/include/asm-generic/futex.h
+--- linux-2.6.32.14/include/asm-generic/futex.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/futex.h	2010-05-28 21:27:16.343246556 -0400
+@@ -6,7 +6,7 @@
+ #include <asm/errno.h>
+ 
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
++futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
+ {
+ 	int op = (encoded_op >> 28) & 7;
+ 	int cmp = (encoded_op >> 24) & 15;
+@@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op, 
+ }
+ 
+ static inline int
+-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
++futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
+ {
+ 	return -ENOSYS;
+ }
+diff -urNp linux-2.6.32.14/include/asm-generic/int-l64.h linux-2.6.32.14/include/asm-generic/int-l64.h
+--- linux-2.6.32.14/include/asm-generic/int-l64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/int-l64.h	2010-05-28 21:27:16.343246556 -0400
+@@ -46,6 +46,8 @@ typedef unsigned int u32;
+ typedef signed long s64;
+ typedef unsigned long u64;
+ 
++typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.14/include/asm-generic/int-ll64.h linux-2.6.32.14/include/asm-generic/int-ll64.h
+--- linux-2.6.32.14/include/asm-generic/int-ll64.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/int-ll64.h	2010-05-28 21:27:16.343246556 -0400
+@@ -51,6 +51,8 @@ typedef unsigned int u32;
+ typedef signed long long s64;
+ typedef unsigned long long u64;
+ 
++typedef unsigned long long intoverflow_t;
++
+ #define S8_C(x)  x
+ #define U8_C(x)  x ## U
+ #define S16_C(x) x
+diff -urNp linux-2.6.32.14/include/asm-generic/kmap_types.h linux-2.6.32.14/include/asm-generic/kmap_types.h
+--- linux-2.6.32.14/include/asm-generic/kmap_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/kmap_types.h	2010-05-28 21:27:16.343246556 -0400
+@@ -28,7 +28,8 @@ KMAP_D(15)	KM_UML_USERCOPY,
+ KMAP_D(16)	KM_IRQ_PTE,
+ KMAP_D(17)	KM_NMI,
+ KMAP_D(18)	KM_NMI_PTE,
+-KMAP_D(19)	KM_TYPE_NR
++KMAP_D(19)	KM_CLEARPAGE,
++KMAP_D(20)	KM_TYPE_NR
+ };
+ 
+ #undef KMAP_D
+diff -urNp linux-2.6.32.14/include/asm-generic/pgtable.h linux-2.6.32.14/include/asm-generic/pgtable.h
+--- linux-2.6.32.14/include/asm-generic/pgtable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/pgtable.h	2010-05-28 21:27:16.343246556 -0400
+@@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
+ 				unsigned long size);
+ #endif
+ 
++#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
++static inline unsigned long pax_open_kernel(void) { return 0; }
++#endif
++
++#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
++static inline unsigned long pax_close_kernel(void) { return 0; }
++#endif
++
+ #endif /* !__ASSEMBLY__ */
+ 
+ #endif /* _ASM_GENERIC_PGTABLE_H */
+diff -urNp linux-2.6.32.14/include/asm-generic/vmlinux.lds.h linux-2.6.32.14/include/asm-generic/vmlinux.lds.h
+--- linux-2.6.32.14/include/asm-generic/vmlinux.lds.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/asm-generic/vmlinux.lds.h	2010-05-28 21:27:16.343246556 -0400
+@@ -199,6 +199,7 @@
+ 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
+ 		VMLINUX_SYMBOL(__start_rodata) = .;			\
+ 		*(.rodata) *(.rodata.*)					\
++		*(.data.read_only)					\
+ 		*(__vermagic)		/* Kernel version magic */	\
+ 		*(__markers_strings)	/* Markers: strings */		\
+ 		*(__tracepoints_strings)/* Tracepoints: strings */	\
+@@ -656,22 +657,24 @@
+  * section in the linker script will go there too.  @phdr should have
+  * a leading colon.
+  *
+- * Note that this macros defines __per_cpu_load as an absolute symbol.
++ * Note that this macros defines per_cpu_load as an absolute symbol.
+  * If there is no need to put the percpu section at a predetermined
+  * address, use PERCPU().
+  */
+ #define PERCPU_VADDR(vaddr, phdr)					\
+-	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
+-	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
++	per_cpu_load = .;						\
++	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
+ 				- LOAD_OFFSET) {			\
++		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
+ 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
+ 		*(.data.percpu.first)					\
+-		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu)						\
++		. = ALIGN(PAGE_SIZE);					\
++		*(.data.percpu.page_aligned)				\
+ 		*(.data.percpu.shared_aligned)				\
+ 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
+ 	} phdr								\
+-	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
++	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
+ 
+ /**
+  * PERCPU - define output section for percpu area, simple version
+diff -urNp linux-2.6.32.14/include/drm/drm_pciids.h linux-2.6.32.14/include/drm/drm_pciids.h
+--- linux-2.6.32.14/include/drm/drm_pciids.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.14/include/drm/drm_pciids.h	2010-05-28 21:27:16.343246556 -0400
+@@ -377,7 +377,7 @@
+ 	{0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ 	{0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define r128_PCI_IDS \
+ 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -417,14 +417,14 @@
+ 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mga_PCI_IDS \
+ 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
+ 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
+ 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define mach64_PCI_IDS \
+ 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -447,7 +447,7 @@
+ 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define sisdrv_PCI_IDS \
+ 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -458,7 +458,7 @@
+ 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+ 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define tdfx_PCI_IDS \
+ 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -467,7 +467,7 @@
+ 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define viadrv_PCI_IDS \
+ 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -479,14 +479,14 @@
+ 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
+ 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i810_PCI_IDS \
+ 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i830_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+@@ -494,11 +494,11 @@
+ 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+ 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define gamma_PCI_IDS \
+ 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define savage_PCI_IDS \
+ 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
+@@ -524,10 +524,10 @@
+ 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
+ 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+ 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define ffb_PCI_IDS \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+ 
+ #define i915_PCI_IDS \
+ 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+@@ -560,4 +560,4 @@
+ 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+ 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+-	{0, 0, 0}
++	{0, 0, 0, 0, 0, 0}
+diff -urNp linux-2.6.32.14/include/drm/drmP.h linux-2.6.32.14/include/drm/drmP.h
+--- linux-2.6.32.14/include/drm/drmP.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/drm/drmP.h	2010-05-28 21:27:16.343246556 -0400
+@@ -814,7 +814,7 @@ struct drm_driver {
+ 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
+ 
+ 	/* Driver private ops for this object */
+-	struct vm_operations_struct *gem_vm_ops;
++	const struct vm_operations_struct *gem_vm_ops;
+ 
+ 	int major;
+ 	int minor;
+@@ -917,7 +917,7 @@ struct drm_device {
+ 
+ 	/** \name Usage Counters */
+ 	/*@{ */
+-	int open_count;			/**< Outstanding files open */
++	atomic_t open_count;		/**< Outstanding files open */
+ 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
+ 	atomic_t vma_count;		/**< Outstanding vma areas open */
+ 	int buf_use;			/**< Buffers in use -- cannot alloc */
+@@ -928,7 +928,7 @@ struct drm_device {
+ 	/*@{ */
+ 	unsigned long counters;
+ 	enum drm_stat_type types[15];
+-	atomic_t counts[15];
++	atomic_unchecked_t counts[15];
+ 	/*@} */
+ 
+ 	struct list_head filelist;
+diff -urNp linux-2.6.32.14/include/linux/a.out.h linux-2.6.32.14/include/linux/a.out.h
+--- linux-2.6.32.14/include/linux/a.out.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/a.out.h	2010-05-28 21:27:16.343246556 -0400
+@@ -39,6 +39,14 @@ enum machine_type {
+   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
+ };
+ 
++/* Constants for the N_FLAGS field */
++#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
++#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
++#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
++#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
++/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
++#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
++
+ #if !defined (N_MAGIC)
+ #define N_MAGIC(exec) ((exec).a_info & 0xffff)
+ #endif
+diff -urNp linux-2.6.32.14/include/linux/atmdev.h linux-2.6.32.14/include/linux/atmdev.h
+--- linux-2.6.32.14/include/linux/atmdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/atmdev.h	2010-05-28 21:27:16.343246556 -0400
+@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
+ #endif
+ 
+ struct k_atm_aal_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.14/include/linux/backlight.h linux-2.6.32.14/include/linux/backlight.h
+--- linux-2.6.32.14/include/linux/backlight.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/backlight.h	2010-05-28 21:27:16.343246556 -0400
+@@ -36,18 +36,18 @@ struct backlight_device;
+ struct fb_info;
+ 
+ struct backlight_ops {
+-	unsigned int options;
++	const unsigned int options;
+ 
+ #define BL_CORE_SUSPENDRESUME	(1 << 0)
+ 
+ 	/* Notify the backlight driver some property has changed */
+-	int (*update_status)(struct backlight_device *);
++	int (* const update_status)(struct backlight_device *);
+ 	/* Return the current backlight brightness (accounting for power,
+ 	   fb_blank etc.) */
+-	int (*get_brightness)(struct backlight_device *);
++	int (* const get_brightness)(struct backlight_device *);
+ 	/* Check if given framebuffer device is the one bound to this backlight;
+ 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
+-	int (*check_fb)(struct fb_info *);
++	int (* const check_fb)(struct fb_info *);
+ };
+ 
+ /* This structure defines all the properties of a backlight */
+@@ -86,7 +86,7 @@ struct backlight_device {
+ 	   registered this device has been unloaded, and if class_get_devdata()
+ 	   points to something in the body of that driver, it is also invalid. */
+ 	struct mutex ops_lock;
+-	struct backlight_ops *ops;
++	const struct backlight_ops *ops;
+ 
+ 	/* The framebuffer notifier block */
+ 	struct notifier_block fb_notif;
+@@ -103,7 +103,7 @@ static inline void backlight_update_stat
+ }
+ 
+ extern struct backlight_device *backlight_device_register(const char *name,
+-	struct device *dev, void *devdata, struct backlight_ops *ops);
++	struct device *dev, void *devdata, const struct backlight_ops *ops);
+ extern void backlight_device_unregister(struct backlight_device *bd);
+ extern void backlight_force_update(struct backlight_device *bd,
+ 				   enum backlight_update_reason reason);
+diff -urNp linux-2.6.32.14/include/linux/binfmts.h linux-2.6.32.14/include/linux/binfmts.h
+--- linux-2.6.32.14/include/linux/binfmts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/binfmts.h	2010-05-28 21:27:16.343246556 -0400
+@@ -78,6 +78,7 @@ struct linux_binfmt {
+ 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
+ 	int (*load_shlib)(struct file *);
+ 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
++	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
+ 	unsigned long min_coredump;	/* minimal dump size */
+ 	int hasvdso;
+ };
+diff -urNp linux-2.6.32.14/include/linux/blkdev.h linux-2.6.32.14/include/linux/blkdev.h
+--- linux-2.6.32.14/include/linux/blkdev.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/blkdev.h	2010-05-28 21:27:16.347237122 -0400
+@@ -1262,19 +1262,19 @@ static inline int blk_integrity_rq(struc
+ #endif /* CONFIG_BLK_DEV_INTEGRITY */
+ 
+ struct block_device_operations {
+-	int (*open) (struct block_device *, fmode_t);
+-	int (*release) (struct gendisk *, fmode_t);
+-	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+-	int (*direct_access) (struct block_device *, sector_t,
++	int (* const open) (struct block_device *, fmode_t);
++	int (* const release) (struct gendisk *, fmode_t);
++	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
++	int (* const direct_access) (struct block_device *, sector_t,
+ 						void **, unsigned long *);
+-	int (*media_changed) (struct gendisk *);
+-	unsigned long long (*set_capacity) (struct gendisk *,
++	int (* const media_changed) (struct gendisk *);
++	unsigned long long (* const set_capacity) (struct gendisk *,
+ 						unsigned long long);
+-	int (*revalidate_disk) (struct gendisk *);
+-	int (*getgeo)(struct block_device *, struct hd_geometry *);
+-	struct module *owner;
++	int (* const revalidate_disk) (struct gendisk *);
++	int (*const getgeo)(struct block_device *, struct hd_geometry *);
++	struct module * const owner;
+ };
+ 
+ extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
+diff -urNp linux-2.6.32.14/include/linux/cache.h linux-2.6.32.14/include/linux/cache.h
+--- linux-2.6.32.14/include/linux/cache.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/cache.h	2010-05-28 21:27:16.347237122 -0400
+@@ -16,6 +16,10 @@
+ #define __read_mostly
+ #endif
+ 
++#ifndef __read_only
++#define __read_only __read_mostly
++#endif
++
+ #ifndef ____cacheline_aligned
+ #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
+ #endif
+diff -urNp linux-2.6.32.14/include/linux/capability.h linux-2.6.32.14/include/linux/capability.h
+--- linux-2.6.32.14/include/linux/capability.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/capability.h	2010-05-28 21:27:16.347237122 -0400
+@@ -563,6 +563,7 @@ extern const kernel_cap_t __cap_init_eff
+ 	(security_real_capable_noaudit((t), (cap)) == 0)
+ 
+ extern int capable(int cap);
++int capable_nolog(int cap);
+ 
+ /* audit system wants to get cap info from files as well */
+ struct dentry;
+diff -urNp linux-2.6.32.14/include/linux/compiler-gcc4.h linux-2.6.32.14/include/linux/compiler-gcc4.h
+--- linux-2.6.32.14/include/linux/compiler-gcc4.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/compiler-gcc4.h	2010-05-28 21:27:16.347237122 -0400
+@@ -36,4 +36,8 @@
+    the kernel context */
+ #define __cold			__attribute__((__cold__))
+ 
++#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
++#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
++#define __bos0(ptr)		__bos((ptr), 0)
++#define __bos1(ptr)		__bos((ptr), 1)
+ #endif
+diff -urNp linux-2.6.32.14/include/linux/compiler.h linux-2.6.32.14/include/linux/compiler.h
+--- linux-2.6.32.14/include/linux/compiler.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/compiler.h	2010-05-28 21:27:16.347237122 -0400
+@@ -256,6 +256,22 @@ void ftrace_likely_update(struct ftrace_
+ #define __cold
+ #endif
+ 
++#ifndef __alloc_size
++#define __alloc_size
++#endif
++
++#ifndef __bos
++#define __bos
++#endif
++
++#ifndef __bos0
++#define __bos0
++#endif
++
++#ifndef __bos1
++#define __bos1
++#endif
++
+ /* Simple shorthand for a section definition */
+ #ifndef __section
+ # define __section(S) __attribute__ ((__section__(#S)))
+diff -urNp linux-2.6.32.14/include/linux/decompress/mm.h linux-2.6.32.14/include/linux/decompress/mm.h
+--- linux-2.6.32.14/include/linux/decompress/mm.h	2010-04-04 20:41:50.048452804 -0400
++++ linux-2.6.32.14/include/linux/decompress/mm.h	2010-05-28 21:27:16.347237122 -0400
+@@ -78,7 +78,7 @@ static void free(void *where)
+  * warnings when not needed (indeed large_malloc / large_free are not
+  * needed by inflate */
+ 
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ 
+ #define large_malloc(a) vmalloc(a)
+diff -urNp linux-2.6.32.14/include/linux/dma-mapping.h linux-2.6.32.14/include/linux/dma-mapping.h
+--- linux-2.6.32.14/include/linux/dma-mapping.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/dma-mapping.h	2010-05-28 21:27:16.347237122 -0400
+@@ -16,50 +16,50 @@ enum dma_data_direction {
+ };
+ 
+ struct dma_map_ops {
+-	void* (*alloc_coherent)(struct device *dev, size_t size,
++	void* (* const alloc_coherent)(struct device *dev, size_t size,
+ 				dma_addr_t *dma_handle, gfp_t gfp);
+-	void (*free_coherent)(struct device *dev, size_t size,
++	void (* const free_coherent)(struct device *dev, size_t size,
+ 			      void *vaddr, dma_addr_t dma_handle);
+-	dma_addr_t (*map_page)(struct device *dev, struct page *page,
++	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
+ 			       unsigned long offset, size_t size,
+ 			       enum dma_data_direction dir,
+ 			       struct dma_attrs *attrs);
+-	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
++	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
+ 			   size_t size, enum dma_data_direction dir,
+ 			   struct dma_attrs *attrs);
+-	int (*map_sg)(struct device *dev, struct scatterlist *sg,
++	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
+ 		      int nents, enum dma_data_direction dir,
+ 		      struct dma_attrs *attrs);
+-	void (*unmap_sg)(struct device *dev,
++	void (* const unmap_sg)(struct device *dev,
+ 			 struct scatterlist *sg, int nents,
+ 			 enum dma_data_direction dir,
+ 			 struct dma_attrs *attrs);
+-	void (*sync_single_for_cpu)(struct device *dev,
++	void (* const sync_single_for_cpu)(struct device *dev,
+ 				    dma_addr_t dma_handle, size_t size,
+ 				    enum dma_data_direction dir);
+-	void (*sync_single_for_device)(struct device *dev,
++	void (* const sync_single_for_device)(struct device *dev,
+ 				       dma_addr_t dma_handle, size_t size,
+ 				       enum dma_data_direction dir);
+-	void (*sync_single_range_for_cpu)(struct device *dev,
++	void (* const sync_single_range_for_cpu)(struct device *dev,
+ 					  dma_addr_t dma_handle,
+ 					  unsigned long offset,
+ 					  size_t size,
+ 					  enum dma_data_direction dir);
+-	void (*sync_single_range_for_device)(struct device *dev,
++	void (* const sync_single_range_for_device)(struct device *dev,
+ 					     dma_addr_t dma_handle,
+ 					     unsigned long offset,
+ 					     size_t size,
+ 					     enum dma_data_direction dir);
+-	void (*sync_sg_for_cpu)(struct device *dev,
++	void (* const sync_sg_for_cpu)(struct device *dev,
+ 				struct scatterlist *sg, int nents,
+ 				enum dma_data_direction dir);
+-	void (*sync_sg_for_device)(struct device *dev,
++	void (* const sync_sg_for_device)(struct device *dev,
+ 				   struct scatterlist *sg, int nents,
+ 				   enum dma_data_direction dir);
+-	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
+-	int (*dma_supported)(struct device *dev, u64 mask);
++	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
++	int (* const dma_supported)(struct device *dev, u64 mask);
+ 	int (*set_dma_mask)(struct device *dev, u64 mask);
+-	int is_phys;
++	const int is_phys;
+ };
+ 
+ #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+diff -urNp linux-2.6.32.14/include/linux/dst.h linux-2.6.32.14/include/linux/dst.h
+--- linux-2.6.32.14/include/linux/dst.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/dst.h	2010-05-28 21:27:16.347237122 -0400
+@@ -380,7 +380,7 @@ struct dst_node
+ 	struct thread_pool	*pool;
+ 
+ 	/* Transaction IDs live here */
+-	atomic_long_t		gen;
++	atomic_long_unchecked_t	gen;
+ 
+ 	/*
+ 	 * How frequently and how many times transaction
+diff -urNp linux-2.6.32.14/include/linux/elf.h linux-2.6.32.14/include/linux/elf.h
+--- linux-2.6.32.14/include/linux/elf.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/elf.h	2010-05-28 21:27:16.347237122 -0400
+@@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
+ #define PT_GNU_EH_FRAME		0x6474e550
+ 
+ #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
++#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
++
++#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
++
++/* Constants for the e_flags field */
++#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
++#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
++#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
++#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
++/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
++#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
+ 
+ /* These constants define the different elf file types */
+ #define ET_NONE   0
+@@ -84,6 +95,8 @@ typedef __s64	Elf64_Sxword;
+ #define DT_DEBUG	21
+ #define DT_TEXTREL	22
+ #define DT_JMPREL	23
++#define DT_FLAGS	30
++  #define DF_TEXTREL  0x00000004
+ #define DT_ENCODING	32
+ #define OLD_DT_LOOS	0x60000000
+ #define DT_LOOS		0x6000000d
+@@ -230,6 +243,19 @@ typedef struct elf64_hdr {
+ #define PF_W		0x2
+ #define PF_X		0x1
+ 
++#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
++#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
++#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
++#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
++#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
++#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
++/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
++/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
++#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
++#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
++#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
++#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
++
+ typedef struct elf32_phdr{
+   Elf32_Word	p_type;
+   Elf32_Off	p_offset;
+@@ -322,6 +348,8 @@ typedef struct elf64_shdr {
+ #define	EI_OSABI	7
+ #define	EI_PAD		8
+ 
++#define	EI_PAX		14
++
+ #define	ELFMAG0		0x7f		/* EI_MAG */
+ #define	ELFMAG1		'E'
+ #define	ELFMAG2		'L'
+@@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
+ #define elf_phdr	elf32_phdr
+ #define elf_note	elf32_note
+ #define elf_addr_t	Elf32_Off
++#define elf_dyn		Elf32_Dyn
+ 
+ #else
+ 
+@@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
+ #define elf_phdr	elf64_phdr
+ #define elf_note	elf64_note
+ #define elf_addr_t	Elf64_Off
++#define elf_dyn		Elf64_Dyn
+ 
+ #endif
+ 
+diff -urNp linux-2.6.32.14/include/linux/fs.h linux-2.6.32.14/include/linux/fs.h
+--- linux-2.6.32.14/include/linux/fs.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.14/include/linux/fs.h	2010-05-28 21:27:16.347237122 -0400
+@@ -90,6 +90,11 @@ struct inodes_stat_t {
+ /* Expect random access pattern */
+ #define FMODE_RANDOM		((__force fmode_t)4096)
+ 
++/* Hack for grsec so as not to require read permission simply to execute
++ * a binary
++ */
++#define FMODE_GREXEC		((__force fmode_t)8192)
++
+ /*
+  * The below are the various read and write types that we support. Some of
+  * them include behavioral modifiers that send information down to the
+@@ -568,41 +573,41 @@ typedef int (*read_actor_t)(read_descrip
+ 		unsigned long, unsigned long);
+ 
+ struct address_space_operations {
+-	int (*writepage)(struct page *page, struct writeback_control *wbc);
+-	int (*readpage)(struct file *, struct page *);
+-	void (*sync_page)(struct page *);
++	int (* const writepage)(struct page *page, struct writeback_control *wbc);
++	int (* const readpage)(struct file *, struct page *);
++	void (* const sync_page)(struct page *);
+ 
+ 	/* Write back some dirty pages from this mapping. */
+-	int (*writepages)(struct address_space *, struct writeback_control *);
++	int (* const writepages)(struct address_space *, struct writeback_control *);
+ 
+ 	/* Set a page dirty.  Return true if this dirtied it */
+-	int (*set_page_dirty)(struct page *page);
++	int (* const set_page_dirty)(struct page *page);
+ 
+-	int (*readpages)(struct file *filp, struct address_space *mapping,
++	int (* const readpages)(struct file *filp, struct address_space *mapping,
+ 			struct list_head *pages, unsigned nr_pages);
+ 
+-	int (*write_begin)(struct file *, struct address_space *mapping,
++	int (* const write_begin)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned flags,
+ 				struct page **pagep, void **fsdata);
+-	int (*write_end)(struct file *, struct address_space *mapping,
++	int (* const write_end)(struct file *, struct address_space *mapping,
+ 				loff_t pos, unsigned len, unsigned copied,
+ 				struct page *page, void *fsdata);
+ 
+ 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
+-	sector_t (*bmap)(struct address_space *, sector_t);
+-	void (*invalidatepage) (struct page *, unsigned long);
+-	int (*releasepage) (struct page *, gfp_t);
+-	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
++	sector_t (* const bmap)(struct address_space *, sector_t);
++	void (* const invalidatepage) (struct page *, unsigned long);
++	int (* const releasepage) (struct page *, gfp_t);
++	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
+ 			loff_t offset, unsigned long nr_segs);
+-	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
++	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
+ 						void **, unsigned long *);
+ 	/* migrate the contents of a page to the specified target */
+-	int (*migratepage) (struct address_space *,
++	int (* const migratepage) (struct address_space *,
+ 			struct page *, struct page *);
+-	int (*launder_page) (struct page *);
+-	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
++	int (* const launder_page) (struct page *);
++	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
+ 					unsigned long);
+-	int (*error_remove_page)(struct address_space *, struct page *);
++	int (* const error_remove_page)(struct address_space *, struct page *);
+ };
+ 
+ /*
+@@ -1030,19 +1035,19 @@ static inline int file_check_writeable(s
+ typedef struct files_struct *fl_owner_t;
+ 
+ struct file_lock_operations {
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
+ };
+ 
+ struct lock_manager_operations {
+-	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
+-	void (*fl_notify)(struct file_lock *);	/* unblock callback */
+-	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
+-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
+-	void (*fl_release_private)(struct file_lock *);
+-	void (*fl_break)(struct file_lock *);
+-	int (*fl_mylease)(struct file_lock *, struct file_lock *);
+-	int (*fl_change)(struct file_lock **, int);
++	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
++	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
++	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
++	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
++	void (* const fl_release_private)(struct file_lock *);
++	void (* const fl_break)(struct file_lock *);
++	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
++	int (* const fl_change)(struct file_lock **, int);
+ };
+ 
+ struct lock_manager {
+@@ -1439,7 +1444,7 @@ struct fiemap_extent_info {
+ 	unsigned int fi_flags;		/* Flags as passed from user */
+ 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
+ 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
+-	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
++	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
+ 						 * array */
+ };
+ int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
+@@ -1556,30 +1561,30 @@ extern ssize_t vfs_writev(struct file *,
+ 		unsigned long, loff_t *);
+ 
+ struct super_operations {
+-   	struct inode *(*alloc_inode)(struct super_block *sb);
+-	void (*destroy_inode)(struct inode *);
++   	struct inode *(* const alloc_inode)(struct super_block *sb);
++	void (* const destroy_inode)(struct inode *);
+ 
+-   	void (*dirty_inode) (struct inode *);
+-	int (*write_inode) (struct inode *, int);
+-	void (*drop_inode) (struct inode *);
+-	void (*delete_inode) (struct inode *);
+-	void (*put_super) (struct super_block *);
+-	void (*write_super) (struct super_block *);
+-	int (*sync_fs)(struct super_block *sb, int wait);
+-	int (*freeze_fs) (struct super_block *);
+-	int (*unfreeze_fs) (struct super_block *);
+-	int (*statfs) (struct dentry *, struct kstatfs *);
+-	int (*remount_fs) (struct super_block *, int *, char *);
+-	void (*clear_inode) (struct inode *);
+-	void (*umount_begin) (struct super_block *);
++   	void (* const dirty_inode) (struct inode *);
++	int (* const write_inode) (struct inode *, int);
++	void (* const drop_inode) (struct inode *);
++	void (* const delete_inode) (struct inode *);
++	void (* const put_super) (struct super_block *);
++	void (* const write_super) (struct super_block *);
++	int (* const sync_fs)(struct super_block *sb, int wait);
++	int (* const freeze_fs) (struct super_block *);
++	int (* const unfreeze_fs) (struct super_block *);
++	int (* const statfs) (struct dentry *, struct kstatfs *);
++	int (* const remount_fs) (struct super_block *, int *, char *);
++	void (* const clear_inode) (struct inode *);
++	void (* const umount_begin) (struct super_block *);
+ 
+-	int (*show_options)(struct seq_file *, struct vfsmount *);
+-	int (*show_stats)(struct seq_file *, struct vfsmount *);
++	int (* const show_options)(struct seq_file *, struct vfsmount *);
++	int (* const show_stats)(struct seq_file *, struct vfsmount *);
+ #ifdef CONFIG_QUOTA
+-	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
+-	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
++	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
++	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+ #endif
+-	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
++	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
+ };
+ 
+ /*
+diff -urNp linux-2.6.32.14/include/linux/fs_struct.h linux-2.6.32.14/include/linux/fs_struct.h
+--- linux-2.6.32.14/include/linux/fs_struct.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/fs_struct.h	2010-05-28 21:27:16.347237122 -0400
+@@ -4,7 +4,7 @@
+ #include <linux/path.h>
+ 
+ struct fs_struct {
+-	int users;
++	atomic_t users;
+ 	rwlock_t lock;
+ 	int umask;
+ 	int in_exec;
+diff -urNp linux-2.6.32.14/include/linux/genhd.h linux-2.6.32.14/include/linux/genhd.h
+--- linux-2.6.32.14/include/linux/genhd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/genhd.h	2010-05-28 21:27:16.355225759 -0400
+@@ -161,7 +161,7 @@ struct gendisk {
+ 
+ 	struct timer_rand_state *random;
+ 
+-	atomic_t sync_io;		/* RAID */
++	atomic_unchecked_t sync_io;	/* RAID */
+ 	struct work_struct async_notify;
+ #ifdef  CONFIG_BLK_DEV_INTEGRITY
+ 	struct blk_integrity *integrity;
+diff -urNp linux-2.6.32.14/include/linux/gracl.h linux-2.6.32.14/include/linux/gracl.h
+--- linux-2.6.32.14/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/gracl.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,309 @@
++#ifndef GR_ACL_H
++#define GR_ACL_H
++
++#include <linux/grdefs.h>
++#include <linux/resource.h>
++#include <linux/capability.h>
++#include <linux/dcache.h>
++#include <asm/resource.h>
++
++/* Major status information */
++
++#define GR_VERSION  "grsecurity 2.1.14"
++#define GRSECURITY_VERSION 0x2114
++
++enum {
++	GR_SHUTDOWN = 0,
++	GR_ENABLE = 1,
++	GR_SPROLE = 2,
++	GR_RELOAD = 3,
++	GR_SEGVMOD = 4,
++	GR_STATUS = 5,
++	GR_UNSPROLE = 6,
++	GR_PASSSET = 7,
++	GR_SPROLEPAM = 8,
++};
++
++/* Password setup definitions
++ * kernel/grhash.c */
++enum {
++	GR_PW_LEN = 128,
++	GR_SALT_LEN = 16,
++	GR_SHA_LEN = 32,
++};
++
++enum {
++	GR_SPROLE_LEN = 64,
++};
++
++#define GR_NLIMITS 32
++
++/* Begin Data Structures */
++
++struct sprole_pw {
++	unsigned char *rolename;
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
++};
++
++struct name_entry {
++	__u32 key;
++	ino_t inode;
++	dev_t device;
++	char *name;
++	__u16 len;
++	__u8 deleted;
++	struct name_entry *prev;
++	struct name_entry *next;
++};
++
++struct inodev_entry {
++	struct name_entry *nentry;
++	struct inodev_entry *prev;
++	struct inodev_entry *next;
++};
++
++struct acl_role_db {
++	struct acl_role_label **r_hash;
++	__u32 r_size;
++};
++
++struct inodev_db {
++	struct inodev_entry **i_hash;
++	__u32 i_size;
++};
++
++struct name_db {
++	struct name_entry **n_hash;
++	__u32 n_size;
++};
++
++struct crash_uid {
++	uid_t uid;
++	unsigned long expires;
++};
++
++struct gr_hash_struct {
++	void **table;
++	void **nametable;
++	void *first;
++	__u32 table_size;
++	__u32 used_size;
++	int type;
++};
++
++/* Userspace Grsecurity ACL data structures */
++
++struct acl_subject_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++	kernel_cap_t cap_mask;
++	kernel_cap_t cap_lower;
++
++	struct rlimit res[GR_NLIMITS];
++	__u32 resmask;
++
++	__u8 user_trans_type;
++	__u8 group_trans_type;
++	uid_t *user_transitions;
++	gid_t *group_transitions;
++	__u16 user_trans_num;
++	__u16 group_trans_num;
++
++	__u32 ip_proto[8];
++	__u32 ip_type;
++	struct acl_ip_label **ips;
++	__u32 ip_num;
++	__u32 inaddr_any_override;
++
++	__u32 crashes;
++	unsigned long expires;
++
++	struct acl_subject_label *parent_subject;
++	struct gr_hash_struct *hash;
++	struct acl_subject_label *prev;
++	struct acl_subject_label *next;
++
++	struct acl_object_label **obj_hash;
++	__u32 obj_hash_size;
++	__u16 pax_flags;
++};
++
++struct role_allowed_ip {
++	__u32 addr;
++	__u32 netmask;
++
++	struct role_allowed_ip *prev;
++	struct role_allowed_ip *next;
++};
++
++struct role_transition {
++	char *rolename;
++
++	struct role_transition *prev;
++	struct role_transition *next;
++};
++
++struct acl_role_label {
++	char *rolename;
++	uid_t uidgid;
++	__u16 roletype;
++
++	__u16 auth_attempts;
++	unsigned long expires;
++
++	struct acl_subject_label *root_label;
++	struct gr_hash_struct *hash;
++
++	struct acl_role_label *prev;
++	struct acl_role_label *next;
++
++	struct role_transition *transitions;
++	struct role_allowed_ip *allowed_ips;
++	uid_t *domain_children;
++	__u16 domain_child_num;
++
++	struct acl_subject_label **subj_hash;
++	__u32 subj_hash_size;
++};
++
++struct user_acl_role_db {
++	struct acl_role_label **r_table;
++	__u32 num_pointers;		/* Number of allocations to track */
++	__u32 num_roles;		/* Number of roles */
++	__u32 num_domain_children;	/* Number of domain children */
++	__u32 num_subjects;		/* Number of subjects */
++	__u32 num_objects;		/* Number of objects */
++};
++
++struct acl_object_label {
++	char *filename;
++	ino_t inode;
++	dev_t device;
++	__u32 mode;
++
++	struct acl_subject_label *nested;
++	struct acl_object_label *globbed;
++
++	/* next two structures not used */
++
++	struct acl_object_label *prev;
++	struct acl_object_label *next;
++};
++
++struct acl_ip_label {
++	char *iface;
++	__u32 addr;
++	__u32 netmask;
++	__u16 low, high;
++	__u8 mode;
++	__u32 type;
++	__u32 proto[8];
++
++	/* next two structures not used */
++
++	struct acl_ip_label *prev;
++	struct acl_ip_label *next;
++};
++
++struct gr_arg {
++	struct user_acl_role_db role_db;
++	unsigned char pw[GR_PW_LEN];
++	unsigned char salt[GR_SALT_LEN];
++	unsigned char sum[GR_SHA_LEN];
++	unsigned char sp_role[GR_SPROLE_LEN];
++	struct sprole_pw *sprole_pws;
++	dev_t segv_device;
++	ino_t segv_inode;
++	uid_t segv_uid;
++	__u16 num_sprole_pws;
++	__u16 mode;
++};
++
++struct gr_arg_wrapper {
++	struct gr_arg *arg;
++	__u32 version;
++	__u32 size;
++};
++
++struct subject_map {
++	struct acl_subject_label *user;
++	struct acl_subject_label *kernel;
++	struct subject_map *prev;
++	struct subject_map *next;
++};
++
++struct acl_subj_map_db {
++	struct subject_map **s_hash;
++	__u32 s_size;
++};
++
++/* End Data Structures Section */
++
++/* Hash functions generated by empirical testing by Brad Spengler
++   Makes good use of the low bits of the inode.  Generally 0-1 times
++   in loop for successful match.  0-3 for unsuccessful match.
++   Shift/add algorithm with modulus of table size and an XOR*/
++
++static __inline__ unsigned int
++rhash(const uid_t uid, const __u16 type, const unsigned int sz)
++{
++	return ((((uid + type) << (16 + type)) ^ uid) % sz);
++}
++
++ static __inline__ unsigned int
++shash(const struct acl_subject_label *userp, const unsigned int sz)
++{
++	return ((const unsigned long)userp % sz);
++}
++
++static __inline__ unsigned int
++fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
++{
++	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
++}
++
++static __inline__ unsigned int
++nhash(const char *name, const __u16 len, const unsigned int sz)
++{
++	return full_name_hash((const unsigned char *)name, len) % sz;
++}
++
++#define FOR_EACH_ROLE_START(role) \
++	role = role_list; \
++	while (role) {
++
++#define FOR_EACH_ROLE_END(role) \
++		role = role->prev; \
++	}
++
++#define FOR_EACH_SUBJECT_START(role,subj,iter) \
++	subj = NULL; \
++	iter = 0; \
++	while (iter < role->subj_hash_size) { \
++		if (subj == NULL) \
++			subj = role->subj_hash[iter]; \
++		if (subj == NULL) { \
++			iter++; \
++			continue; \
++		}
++
++#define FOR_EACH_SUBJECT_END(subj,iter) \
++		subj = subj->next; \
++		if (subj == NULL) \
++			iter++; \
++	}
++
++
++#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
++	subj = role->hash->first; \
++	while (subj != NULL) {
++
++#define FOR_EACH_NESTED_SUBJECT_END(subj) \
++		subj = subj->next; \
++	}
++
++#endif
++
+diff -urNp linux-2.6.32.14/include/linux/gralloc.h linux-2.6.32.14/include/linux/gralloc.h
+--- linux-2.6.32.14/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/gralloc.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,9 @@
++#ifndef __GRALLOC_H
++#define __GRALLOC_H
++
++void acl_free_all(void);
++int acl_alloc_stack_init(unsigned long size);
++void *acl_alloc(unsigned long len);
++void *acl_alloc_num(unsigned long num, unsigned long len);
++
++#endif
+diff -urNp linux-2.6.32.14/include/linux/grdefs.h linux-2.6.32.14/include/linux/grdefs.h
+--- linux-2.6.32.14/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/grdefs.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,136 @@
++#ifndef GRDEFS_H
++#define GRDEFS_H
++
++/* Begin grsecurity status declarations */
++
++enum {
++	GR_READY = 0x01,
++	GR_STATUS_INIT = 0x00	// disabled state
++};
++
++/* Begin  ACL declarations */
++
++/* Role flags */
++
++enum {
++	GR_ROLE_USER = 0x0001,
++	GR_ROLE_GROUP = 0x0002,
++	GR_ROLE_DEFAULT = 0x0004,
++	GR_ROLE_SPECIAL = 0x0008,
++	GR_ROLE_AUTH = 0x0010,
++	GR_ROLE_NOPW = 0x0020,
++	GR_ROLE_GOD = 0x0040,
++	GR_ROLE_LEARN = 0x0080,
++	GR_ROLE_TPE = 0x0100,
++	GR_ROLE_DOMAIN = 0x0200,
++	GR_ROLE_PAM = 0x0400
++};
++
++/* ACL Subject and Object mode flags */
++enum {
++	GR_DELETED = 0x80000000
++};
++
++/* ACL Object-only mode flags */
++enum {
++	GR_READ 	= 0x00000001,
++	GR_APPEND 	= 0x00000002,
++	GR_WRITE 	= 0x00000004,
++	GR_EXEC 	= 0x00000008,
++	GR_FIND 	= 0x00000010,
++	GR_INHERIT 	= 0x00000020,
++	GR_SETID 	= 0x00000040,
++	GR_CREATE 	= 0x00000080,
++	GR_DELETE 	= 0x00000100,
++	GR_LINK		= 0x00000200,
++	GR_AUDIT_READ 	= 0x00000400,
++	GR_AUDIT_APPEND = 0x00000800,
++	GR_AUDIT_WRITE 	= 0x00001000,
++	GR_AUDIT_EXEC 	= 0x00002000,
++	GR_AUDIT_FIND 	= 0x00004000,
++	GR_AUDIT_INHERIT= 0x00008000,
++	GR_AUDIT_SETID 	= 0x00010000,
++	GR_AUDIT_CREATE = 0x00020000,
++	GR_AUDIT_DELETE = 0x00040000,
++	GR_AUDIT_LINK	= 0x00080000,
++	GR_PTRACERD 	= 0x00100000,
++	GR_NOPTRACE	= 0x00200000,
++	GR_SUPPRESS 	= 0x00400000,
++	GR_NOLEARN 	= 0x00800000
++};
++
++#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
++		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
++		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
++
++/* ACL subject-only mode flags */
++enum {
++	GR_KILL 	= 0x00000001,
++	GR_VIEW 	= 0x00000002,
++	GR_PROTECTED 	= 0x00000004,
++	GR_LEARN 	= 0x00000008,
++	GR_OVERRIDE 	= 0x00000010,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_DUMMY 	= 0x00000020,
++	GR_PROTSHM	= 0x00000040,
++	GR_KILLPROC	= 0x00000080,
++	GR_KILLIPPROC	= 0x00000100,
++	/* just a placeholder, this mode is only used in userspace */
++	GR_NOTROJAN	= 0x00000200,
++	GR_PROTPROCFD	= 0x00000400,
++	GR_PROCACCT	= 0x00000800,
++	GR_RELAXPTRACE	= 0x00001000,
++	GR_NESTED	= 0x00002000,
++	GR_INHERITLEARN	= 0x00004000,
++	GR_PROCFIND	= 0x00008000,
++	GR_POVERRIDE	= 0x00010000,
++	GR_KERNELAUTH	= 0x00020000,
++};
++
++enum {
++	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
++	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
++	GR_PAX_ENABLE_MPROTECT	= 0x0004,
++	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
++	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
++	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
++	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
++	GR_PAX_DISABLE_MPROTECT	= 0x0400,
++	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
++	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
++};
++
++enum {
++	GR_ID_USER	= 0x01,
++	GR_ID_GROUP	= 0x02,
++};
++
++enum {
++	GR_ID_ALLOW	= 0x01,
++	GR_ID_DENY	= 0x02,
++};
++
++#define GR_CRASH_RES	31
++#define GR_UIDTABLE_MAX 500
++
++/* begin resource learning section */
++enum {
++	GR_RLIM_CPU_BUMP = 60,
++	GR_RLIM_FSIZE_BUMP = 50000,
++	GR_RLIM_DATA_BUMP = 10000,
++	GR_RLIM_STACK_BUMP = 1000,
++	GR_RLIM_CORE_BUMP = 10000,
++	GR_RLIM_RSS_BUMP = 500000,
++	GR_RLIM_NPROC_BUMP = 1,
++	GR_RLIM_NOFILE_BUMP = 5,
++	GR_RLIM_MEMLOCK_BUMP = 50000,
++	GR_RLIM_AS_BUMP = 500000,
++	GR_RLIM_LOCKS_BUMP = 2,
++	GR_RLIM_SIGPENDING_BUMP = 5,
++	GR_RLIM_MSGQUEUE_BUMP = 10000,
++	GR_RLIM_NICE_BUMP = 1,
++	GR_RLIM_RTPRIO_BUMP = 1,
++	GR_RLIM_RTTIME_BUMP = 1000000
++};
++
++#endif
+diff -urNp linux-2.6.32.14/include/linux/grinternal.h linux-2.6.32.14/include/linux/grinternal.h
+--- linux-2.6.32.14/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/grinternal.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,215 @@
++#ifndef __GRINTERNAL_H
++#define __GRINTERNAL_H
++
++#ifdef CONFIG_GRKERNSEC
++
++#include <linux/fs.h>
++#include <linux/mnt_namespace.h>
++#include <linux/nsproxy.h>
++#include <linux/gracl.h>
++#include <linux/grdefs.h>
++#include <linux/grmsg.h>
++
++void gr_add_learn_entry(const char *fmt, ...)
++	__attribute__ ((format (printf, 1, 2)));
++__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
++			    const struct vfsmount *mnt);
++__u32 gr_check_create(const struct dentry *new_dentry,
++			     const struct dentry *parent,
++			     const struct vfsmount *mnt, const __u32 mode);
++int gr_check_protected_task(const struct task_struct *task);
++__u32 to_gr_audit(const __u32 reqmode);
++int gr_set_acls(const int type);
++
++int gr_acl_is_enabled(void);
++char gr_roletype_to_char(void);
++
++void gr_handle_alertkill(struct task_struct *task);
++char *gr_to_filename(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename1(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename2(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++char *gr_to_filename3(const struct dentry *dentry,
++			    const struct vfsmount *mnt);
++
++extern int grsec_enable_harden_ptrace;
++extern int grsec_enable_link;
++extern int grsec_enable_fifo;
++extern int grsec_enable_execve;
++extern int grsec_enable_shm;
++extern int grsec_enable_execlog;
++extern int grsec_enable_signal;
++extern int grsec_enable_audit_ptrace;
++extern int grsec_enable_forkfail;
++extern int grsec_enable_time;
++extern int grsec_enable_rofs;
++extern int grsec_enable_chroot_shmat;
++extern int grsec_enable_chroot_findtask;
++extern int grsec_enable_chroot_mount;
++extern int grsec_enable_chroot_double;
++extern int grsec_enable_chroot_pivot;
++extern int grsec_enable_chroot_chdir;
++extern int grsec_enable_chroot_chmod;
++extern int grsec_enable_chroot_mknod;
++extern int grsec_enable_chroot_fchdir;
++extern int grsec_enable_chroot_nice;
++extern int grsec_enable_chroot_execlog;
++extern int grsec_enable_chroot_caps;
++extern int grsec_enable_chroot_sysctl;
++extern int grsec_enable_chroot_unix;
++extern int grsec_enable_tpe;
++extern int grsec_tpe_gid;
++extern int grsec_enable_tpe_all;
++extern int grsec_enable_sidcaps;
++extern int grsec_enable_socket_all;
++extern int grsec_socket_all_gid;
++extern int grsec_enable_socket_client;
++extern int grsec_socket_client_gid;
++extern int grsec_enable_socket_server;
++extern int grsec_socket_server_gid;
++extern int grsec_audit_gid;
++extern int grsec_enable_group;
++extern int grsec_enable_audit_textrel;
++extern int grsec_enable_mount;
++extern int grsec_enable_chdir;
++extern int grsec_resource_logging;
++extern int grsec_enable_blackhole;
++extern int grsec_lastack_retries;
++extern int grsec_lock;
++
++extern spinlock_t grsec_alert_lock;
++extern unsigned long grsec_alert_wtime;
++extern unsigned long grsec_alert_fyet;
++
++extern spinlock_t grsec_audit_lock;
++
++extern rwlock_t grsec_exec_file_lock;
++
++#define gr_task_fullpath(tsk) (tsk->exec_file ? \
++			gr_to_filename2(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
++			gr_to_filename(tsk->exec_file->f_path.dentry, \
++			tsk->exec_file->f_vfsmnt) : "/")
++
++#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
++			gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
++			tsk->parent->exec_file->f_vfsmnt) : "/")
++
++#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
++			  ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
++			   (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
++			    tsk_a->fs->root.dentry)))
++
++#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
++			  (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
++
++#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
++		       task->pid, cred->uid, \
++		       cred->euid, cred->gid, cred->egid, \
++		       gr_parent_task_fullpath(task), \
++		       task->parent->comm, task->parent->pid, \
++		       pcred->uid, pcred->euid, \
++		       pcred->gid, pcred->egid
++
++#define GR_CHROOT_CAPS {{ \
++	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
++	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
++	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
++	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
++	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
++
++#define security_learn(normal_msg,args...) \
++({ \
++	read_lock(&grsec_exec_file_lock); \
++	gr_add_learn_entry(normal_msg "\n", ## args); \
++	read_unlock(&grsec_exec_file_lock); \
++})
++
++enum {
++	GR_DO_AUDIT,
++	GR_DONT_AUDIT,
++	GR_DONT_AUDIT_GOOD
++};
++
++enum {
++	GR_TTYSNIFF,
++	GR_RBAC,
++	GR_RBAC_STR,
++	GR_STR_RBAC,
++	GR_RBAC_MODE2,
++	GR_RBAC_MODE3,
++	GR_FILENAME,
++	GR_SYSCTL_HIDDEN,
++	GR_NOARGS,
++	GR_ONE_INT,
++	GR_ONE_INT_TWO_STR,
++	GR_ONE_STR,
++	GR_STR_INT,
++	GR_TWO_INT,
++	GR_THREE_INT,
++	GR_FIVE_INT_TWO_STR,
++	GR_TWO_STR,
++	GR_THREE_STR,
++	GR_FOUR_STR,
++	GR_STR_FILENAME,
++	GR_FILENAME_STR,
++	GR_FILENAME_TWO_INT,
++	GR_FILENAME_TWO_INT_STR,
++	GR_TEXTREL,
++	GR_PTRACE,
++	GR_RESOURCE,
++	GR_CAP,
++	GR_SIG,
++	GR_SIG2,
++	GR_CRASH1,
++	GR_CRASH2,
++	GR_PSACCT
++};
++
++#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
++#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
++#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
++#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
++#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
++#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
++#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
++#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
++#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
++#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
++#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
++#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
++#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
++#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
++#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
++#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
++#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
++#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
++#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
++#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
++#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
++#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
++#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
++#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
++#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
++#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
++#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
++#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
++#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
++#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
++#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
++#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
++
++void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
++
++#endif
++
++#endif
+diff -urNp linux-2.6.32.14/include/linux/grmsg.h linux-2.6.32.14/include/linux/grmsg.h
+--- linux-2.6.32.14/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/grmsg.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,107 @@
++#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
++#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
++#define GR_STOPMOD_MSG "denied modification of module state by "
++#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
++#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
++#define GR_IOPERM_MSG "denied use of ioperm() by "
++#define GR_IOPL_MSG "denied use of iopl() by "
++#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
++#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
++#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
++#define GR_KMEM_MSG "denied write of /dev/kmem by "
++#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
++#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
++#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
++#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
++#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
++#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
++#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
++#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
++#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
++#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
++#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
++#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
++#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
++#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
++#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
++#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
++#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
++#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
++#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
++#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
++#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
++#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
++#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
++#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
++#define GR_NPROC_MSG "denied overstep of process limit by "
++#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
++#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
++#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
++#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
++#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
++#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
++#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
++#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
++#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
++#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
++#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
++#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
++#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
++#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
++#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
++#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
++#define GR_INITF_ACL_MSG "init_variables() failed %s by "
++#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
++#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
++#define GR_SHUTS_ACL_MSG "shutdown auth success for "
++#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
++#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
++#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
++#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
++#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
++#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
++#define GR_ENABLEF_ACL_MSG "unable to load %s for "
++#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
++#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
++#define GR_RELOADF_ACL_MSG "failed reload of %s for "
++#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
++#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
++#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
++#define GR_SPROLEF_ACL_MSG "special role %s failure for "
++#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
++#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
++#define GR_INVMODE_ACL_MSG "invalid mode %d by "
++#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
++#define GR_FAILFORK_MSG "failed fork with errno %d by "
++#define GR_NICE_CHROOT_MSG "denied priority change by "
++#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
++#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
++#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
++#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
++#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
++#define GR_TIME_MSG "time set by "
++#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
++#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
++#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
++#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
++#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
++#define GR_BIND_MSG "denied bind() by "
++#define GR_CONNECT_MSG "denied connect() by "
++#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
++#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
++#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
++#define GR_CAP_ACL_MSG "use of %s denied for "
++#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
++#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
++#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
++#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
++#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
++#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
++#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
++#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
++#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
++#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
++#define GR_VM86_MSG "denied use of vm86 by "
++#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
+diff -urNp linux-2.6.32.14/include/linux/grsecurity.h linux-2.6.32.14/include/linux/grsecurity.h
+--- linux-2.6.32.14/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/include/linux/grsecurity.h	2010-05-28 21:27:16.355225759 -0400
+@@ -0,0 +1,199 @@
++#ifndef GR_SECURITY_H
++#define GR_SECURITY_H
++#include <linux/fs.h>
++#include <linux/fs_struct.h>
++#include <linux/binfmts.h>
++#include <linux/gracl.h>
++
++/* notify of brain-dead configs */
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
++#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
++#endif
++#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
++#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
++#endif
++#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
++#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
++#endif
++#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
++#error "CONFIG_PAX enabled, but no PaX options are enabled."
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p);
++void gr_handle_brute_check(void);
++
++char gr_roletype_to_char(void);
++
++int gr_check_user_change(int real, int effective, int fs);
++int gr_check_group_change(int real, int effective, int fs);
++
++void gr_del_task_from_ip_table(struct task_struct *p);
++
++int gr_pid_is_chrooted(struct task_struct *p);
++int gr_handle_chroot_nice(void);
++int gr_handle_chroot_sysctl(const int op);
++int gr_handle_chroot_setpriority(struct task_struct *p,
++					const int niceval);
++int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
++int gr_handle_chroot_chroot(const struct dentry *dentry,
++				   const struct vfsmount *mnt);
++int gr_handle_chroot_caps(struct path *path);
++void gr_handle_chroot_chdir(struct path *path);
++int gr_handle_chroot_chmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mknod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int mode);
++int gr_handle_chroot_mount(const struct dentry *dentry,
++				  const struct vfsmount *mnt,
++				  const char *dev_name);
++int gr_handle_chroot_pivot(void);
++int gr_handle_chroot_unix(const pid_t pid);
++
++int gr_handle_rawio(const struct inode *inode);
++int gr_handle_nproc(void);
++
++void gr_handle_ioperm(void);
++void gr_handle_iopl(void);
++
++int gr_tpe_allow(const struct file *file);
++
++int gr_random_pid(void);
++
++void gr_log_forkfail(const int retval);
++void gr_log_timechange(void);
++void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
++void gr_log_chdir(const struct dentry *dentry,
++			 const struct vfsmount *mnt);
++void gr_log_chroot_exec(const struct dentry *dentry,
++			       const struct vfsmount *mnt);
++void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
++void gr_log_remount(const char *devname, const int retval);
++void gr_log_unmount(const char *devname, const int retval);
++void gr_log_mount(const char *from, const char *to, const int retval);
++void gr_log_textrel(struct vm_area_struct *vma);
++
++int gr_handle_follow_link(const struct inode *parent,
++				 const struct inode *inode,
++				 const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_fifo(const struct dentry *dentry,
++			  const struct vfsmount *mnt,
++			  const struct dentry *dir, const int flag,
++			  const int acc_mode);
++int gr_handle_hardlink(const struct dentry *dentry,
++			      const struct vfsmount *mnt,
++			      struct inode *inode,
++			      const int mode, const char *to);
++
++int gr_is_capable(const int cap);
++int gr_is_capable_nolog(const int cap);
++void gr_learn_resource(const struct task_struct *task, const int limit,
++			      const unsigned long wanted, const int gt);
++void gr_copy_label(struct task_struct *tsk);
++void gr_handle_crash(struct task_struct *task, const int sig);
++int gr_handle_signal(const struct task_struct *p, const int sig);
++int gr_check_crash_uid(const uid_t uid);
++int gr_check_protected_task(const struct task_struct *task);
++int gr_acl_handle_mmap(const struct file *file,
++			      const unsigned long prot);
++int gr_acl_handle_mprotect(const struct file *file,
++				  const unsigned long prot);
++int gr_check_hidden_task(const struct task_struct *tsk);
++__u32 gr_acl_handle_truncate(const struct dentry *dentry,
++				    const struct vfsmount *mnt);
++__u32 gr_acl_handle_utime(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++__u32 gr_acl_handle_access(const struct dentry *dentry,
++				  const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
++				  const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chmod(const struct dentry *dentry,
++				 const struct vfsmount *mnt, mode_t mode);
++__u32 gr_acl_handle_chown(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++int gr_handle_ptrace(struct task_struct *task, const long request);
++int gr_handle_proc_ptrace(struct task_struct *task);
++__u32 gr_acl_handle_execve(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++int gr_check_crash_exec(const struct file *filp);
++int gr_acl_is_enabled(void);
++void gr_set_kernel_label(struct task_struct *task);
++void gr_set_role_label(struct task_struct *task, const uid_t uid,
++			      const gid_t gid);
++int gr_set_proc_label(const struct dentry *dentry,
++			const struct vfsmount *mnt,
++			const int unsafe_share);
++__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++__u32 gr_acl_handle_open(const struct dentry *dentry,
++				const struct vfsmount *mnt, const int fmode);
++__u32 gr_acl_handle_creat(const struct dentry *dentry,
++				 const struct dentry *p_dentry,
++				 const struct vfsmount *p_mnt, const int fmode,
++				 const int imode);
++void gr_handle_create(const struct dentry *dentry,
++			     const struct vfsmount *mnt);
++__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt,
++				 const int mode);
++__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
++				 const struct dentry *parent_dentry,
++				 const struct vfsmount *parent_mnt);
++__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
++				 const struct vfsmount *mnt);
++void gr_handle_delete(const ino_t ino, const dev_t dev);
++__u32 gr_acl_handle_unlink(const struct dentry *dentry,
++				  const struct vfsmount *mnt);
++__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
++				   const struct dentry *parent_dentry,
++				   const struct vfsmount *parent_mnt,
++				   const char *from);
++__u32 gr_acl_handle_link(const struct dentry *new_dentry,
++				const struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				const struct dentry *old_dentry,
++				const struct vfsmount *old_mnt, const char *to);
++int gr_acl_handle_rename(struct dentry *new_dentry,
++				struct dentry *parent_dentry,
++				const struct vfsmount *parent_mnt,
++				struct dentry *old_dentry,
++				struct inode *old_parent_inode,
++				struct vfsmount *old_mnt, const char *newname);
++void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
++				struct dentry *old_dentry,
++				struct dentry *new_dentry,
++				struct vfsmount *mnt, const __u8 replace);
++__u32 gr_check_link(const struct dentry *new_dentry,
++			   const struct dentry *parent_dentry,
++			   const struct vfsmount *parent_mnt,
++			   const struct dentry *old_dentry,
++			   const struct vfsmount *old_mnt);
++int gr_acl_handle_filldir(const struct file *file, const char *name,
++				 const unsigned int namelen, const ino_t ino);
++
++__u32 gr_acl_handle_unix(const struct dentry *dentry,
++				const struct vfsmount *mnt);
++void gr_acl_handle_exit(void);
++void gr_acl_handle_psacct(struct task_struct *task, const long code);
++int gr_acl_handle_procpidmem(const struct task_struct *task);
++int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
++int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
++void gr_audit_ptrace(struct task_struct *task);
++
++#ifdef CONFIG_GRKERNSEC
++void gr_log_nonroot_mod_load(const char *modname);
++void gr_handle_vm86(void);
++void gr_handle_mem_write(void);
++void gr_handle_kmem_write(void);
++void gr_handle_open_port(void);
++int gr_handle_mem_mmap(const unsigned long offset,
++			      struct vm_area_struct *vma);
++
++extern int grsec_enable_dmesg;
++#endif
++
++#endif
+diff -urNp linux-2.6.32.14/include/linux/hdpu_features.h linux-2.6.32.14/include/linux/hdpu_features.h
+--- linux-2.6.32.14/include/linux/hdpu_features.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/hdpu_features.h	2010-05-28 21:27:16.355225759 -0400
+@@ -3,7 +3,7 @@
+ struct cpustate_t {
+ 	spinlock_t lock;
+ 	int excl;
+-        int open_count;
++	atomic_t open_count;
+ 	unsigned char cached_val;
+ 	int inited;
+ 	unsigned long *set_addr;
+diff -urNp linux-2.6.32.14/include/linux/highmem.h linux-2.6.32.14/include/linux/highmem.h
+--- linux-2.6.32.14/include/linux/highmem.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/highmem.h	2010-05-28 21:27:16.372277939 -0400
+@@ -137,6 +137,18 @@ static inline void clear_highpage(struct
+ 	kunmap_atomic(kaddr, KM_USER0);
+ }
+ 
++static inline void sanitize_highpage(struct page *page)
++{
++	void *kaddr;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	kaddr = kmap_atomic(page, KM_CLEARPAGE);
++	clear_page(kaddr);
++	kunmap_atomic(kaddr, KM_CLEARPAGE);
++	local_irq_restore(flags);
++}
++
+ static inline void zero_user_segments(struct page *page,
+ 	unsigned start1, unsigned end1,
+ 	unsigned start2, unsigned end2)
+diff -urNp linux-2.6.32.14/include/linux/init_task.h linux-2.6.32.14/include/linux/init_task.h
+--- linux-2.6.32.14/include/linux/init_task.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/init_task.h	2010-05-28 21:27:16.377048812 -0400
+@@ -115,6 +115,13 @@ extern struct cred init_cred;
+ # define INIT_PERF_EVENTS(tsk)
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++# define INIT_GR_FS_LOCK					\
++	.gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
++#else
++# define INIT_GR_FS_LOCK
++#endif
++
+ /*
+  *  INIT_TASK is used to set up the first task table, touch at
+  * your own risk!. Base=0, limit=0x1fffff (=2MB)
+@@ -184,6 +191,7 @@ extern struct cred init_cred;
+ 	INIT_FTRACE_GRAPH						\
+ 	INIT_TRACE_RECURSION						\
+ 	INIT_TASK_RCU_PREEMPT(tsk)					\
++	INIT_GR_FS_LOCK							\
+ }
+ 
+ 
+diff -urNp linux-2.6.32.14/include/linux/interrupt.h linux-2.6.32.14/include/linux/interrupt.h
+--- linux-2.6.32.14/include/linux/interrupt.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/interrupt.h	2010-05-28 21:27:16.377048812 -0400
+@@ -357,7 +357,7 @@ enum
+ /* map softirq index to softirq name. update 'softirq_to_name' in
+  * kernel/softirq.c when adding a new softirq.
+  */
+-extern char *softirq_to_name[NR_SOFTIRQS];
++extern const char * const softirq_to_name[NR_SOFTIRQS];
+ 
+ /* softirq mask and active fields moved to irq_cpustat_t in
+  * asm/hardirq.h to get better cache usage.  KAO
+@@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
+ 
+ struct softirq_action
+ {
+-	void	(*action)(struct softirq_action *);
++	void	(*action)(void);
+ };
+ 
+ asmlinkage void do_softirq(void);
+ asmlinkage void __do_softirq(void);
+-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
++extern void open_softirq(int nr, void (*action)(void));
+ extern void softirq_init(void);
+ #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
+ extern void raise_softirq_irqoff(unsigned int nr);
+diff -urNp linux-2.6.32.14/include/linux/jbd2.h linux-2.6.32.14/include/linux/jbd2.h
+--- linux-2.6.32.14/include/linux/jbd2.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/jbd2.h	2010-05-28 21:27:16.377048812 -0400
+@@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd2_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.14/include/linux/jbd.h linux-2.6.32.14/include/linux/jbd.h
+--- linux-2.6.32.14/include/linux/jbd.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/jbd.h	2010-05-28 21:27:16.377048812 -0400
+@@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
+ 		}							\
+ 	} while (0)
+ #else
+-#define jbd_debug(f, a...)	/**/
++#define jbd_debug(f, a...)	do {} while (0)
+ #endif
+ 
+ static inline void *jbd_alloc(size_t size, gfp_t flags)
+diff -urNp linux-2.6.32.14/include/linux/kallsyms.h linux-2.6.32.14/include/linux/kallsyms.h
+--- linux-2.6.32.14/include/linux/kallsyms.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/kallsyms.h	2010-05-28 21:27:16.377048812 -0400
+@@ -15,7 +15,8 @@
+ 
+ struct module;
+ 
+-#ifdef CONFIG_KALLSYMS
++#ifndef __INCLUDED_BY_HIDESYM
++#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
+ /* Lookup the address for a symbol. Returns 0 if not found. */
+ unsigned long kallsyms_lookup_name(const char *name);
+ 
+@@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
+ /* Stupid that this does nothing, but I didn't create this mess. */
+ #define __print_symbol(fmt, addr)
+ #endif /*CONFIG_KALLSYMS*/
++#else /* when included by kallsyms.c, with HIDESYM enabled */
++extern void __print_symbol(const char *fmt, unsigned long address);
++#endif
+ 
+ /* This macro allows us to keep printk typechecking */
+ static void __check_printsym_format(const char *fmt, ...)
+diff -urNp linux-2.6.32.14/include/linux/kgdb.h linux-2.6.32.14/include/linux/kgdb.h
+--- linux-2.6.32.14/include/linux/kgdb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/kgdb.h	2010-05-28 21:27:16.379237094 -0400
+@@ -251,20 +251,20 @@ struct kgdb_arch {
+  */
+ struct kgdb_io {
+ 	const char		*name;
+-	int			(*read_char) (void);
+-	void			(*write_char) (u8);
+-	void			(*flush) (void);
+-	int			(*init) (void);
+-	void			(*pre_exception) (void);
+-	void			(*post_exception) (void);
++	int			(* const read_char) (void);
++	void			(* const write_char) (u8);
++	void			(* const flush) (void);
++	int			(* const init) (void);
++	void			(* const pre_exception) (void);
++	void			(* const post_exception) (void);
+ };
+ 
+-extern struct kgdb_arch		arch_kgdb_ops;
++extern const struct kgdb_arch arch_kgdb_ops;
+ 
+ extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
+ 
+-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
+-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
++extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
++extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
+ 
+ extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
+ extern int kgdb_mem2hex(char *mem, char *buf, int count);
+diff -urNp linux-2.6.32.14/include/linux/kobject.h linux-2.6.32.14/include/linux/kobject.h
+--- linux-2.6.32.14/include/linux/kobject.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/kobject.h	2010-05-28 21:27:16.379237094 -0400
+@@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
+ 
+ struct kobj_type {
+ 	void (*release)(struct kobject *kobj);
+-	struct sysfs_ops *sysfs_ops;
++	const struct sysfs_ops *sysfs_ops;
+ 	struct attribute **default_attrs;
+ };
+ 
+@@ -118,9 +118,9 @@ struct kobj_uevent_env {
+ };
+ 
+ struct kset_uevent_ops {
+-	int (*filter)(struct kset *kset, struct kobject *kobj);
+-	const char *(*name)(struct kset *kset, struct kobject *kobj);
+-	int (*uevent)(struct kset *kset, struct kobject *kobj,
++	int (* const filter)(struct kset *kset, struct kobject *kobj);
++	const char *(* const name)(struct kset *kset, struct kobject *kobj);
++	int (* const uevent)(struct kset *kset, struct kobject *kobj,
+ 		      struct kobj_uevent_env *env);
+ };
+ 
+@@ -132,7 +132,7 @@ struct kobj_attribute {
+ 			 const char *buf, size_t count);
+ };
+ 
+-extern struct sysfs_ops kobj_sysfs_ops;
++extern const struct sysfs_ops kobj_sysfs_ops;
+ 
+ /**
+  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
+@@ -155,14 +155,14 @@ struct kset {
+ 	struct list_head list;
+ 	spinlock_t list_lock;
+ 	struct kobject kobj;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ };
+ 
+ extern void kset_init(struct kset *kset);
+ extern int __must_check kset_register(struct kset *kset);
+ extern void kset_unregister(struct kset *kset);
+ extern struct kset * __must_check kset_create_and_add(const char *name,
+-						struct kset_uevent_ops *u,
++						const struct kset_uevent_ops *u,
+ 						struct kobject *parent_kobj);
+ 
+ static inline struct kset *to_kset(struct kobject *kobj)
+diff -urNp linux-2.6.32.14/include/linux/kvm_host.h linux-2.6.32.14/include/linux/kvm_host.h
+--- linux-2.6.32.14/include/linux/kvm_host.h	2010-04-29 17:49:38.529851956 -0400
++++ linux-2.6.32.14/include/linux/kvm_host.h	2010-05-28 21:27:16.379237094 -0400
+@@ -210,7 +210,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
+ void vcpu_load(struct kvm_vcpu *vcpu);
+ void vcpu_put(struct kvm_vcpu *vcpu);
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module);
+ void kvm_exit(void);
+ 
+@@ -316,7 +316,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
+ 					struct kvm_guest_debug *dbg);
+ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
+ 
+-int kvm_arch_init(void *opaque);
++int kvm_arch_init(const void *opaque);
+ void kvm_arch_exit(void);
+ 
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
+diff -urNp linux-2.6.32.14/include/linux/libata.h linux-2.6.32.14/include/linux/libata.h
+--- linux-2.6.32.14/include/linux/libata.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/libata.h	2010-05-28 21:27:16.391248013 -0400
+@@ -64,11 +64,11 @@
+ #ifdef ATA_VERBOSE_DEBUG
+ #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+ #else
+-#define VPRINTK(fmt, args...)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_VERBOSE_DEBUG */
+ #else
+-#define DPRINTK(fmt, args...)
+-#define VPRINTK(fmt, args...)
++#define DPRINTK(fmt, args...) do {} while (0)
++#define VPRINTK(fmt, args...) do {} while (0)
+ #endif	/* ATA_DEBUG */
+ 
+ #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
+@@ -524,11 +524,11 @@ struct ata_ioports {
+ 
+ struct ata_host {
+ 	spinlock_t		lock;
+-	struct device 		*dev;
++	struct device		*dev;
+ 	void __iomem * const	*iomap;
+ 	unsigned int		n_ports;
+ 	void			*private_data;
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	unsigned long		flags;
+ #ifdef CONFIG_ATA_ACPI
+ 	acpi_handle		acpi_handle;
+@@ -709,7 +709,7 @@ struct ata_link {
+ 
+ struct ata_port {
+ 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
+-	struct ata_port_operations *ops;
++	const struct ata_port_operations *ops;
+ 	spinlock_t		*lock;
+ 	/* Flags owned by the EH context. Only EH should touch these once the
+ 	   port is active */
+@@ -891,7 +891,7 @@ struct ata_port_info {
+ 	unsigned long		pio_mask;
+ 	unsigned long		mwdma_mask;
+ 	unsigned long		udma_mask;
+-	struct ata_port_operations *port_ops;
++	const struct ata_port_operations *port_ops;
+ 	void 			*private_data;
+ };
+ 
+@@ -915,7 +915,7 @@ extern const unsigned long sata_deb_timi
+ extern const unsigned long sata_deb_timing_hotplug[];
+ extern const unsigned long sata_deb_timing_long[];
+ 
+-extern struct ata_port_operations ata_dummy_port_ops;
++extern const struct ata_port_operations ata_dummy_port_ops;
+ extern const struct ata_port_info ata_dummy_port_info;
+ 
+ static inline const unsigned long *
+@@ -961,7 +961,7 @@ extern int ata_host_activate(struct ata_
+ 			     struct scsi_host_template *sht);
+ extern void ata_host_detach(struct ata_host *host);
+ extern void ata_host_init(struct ata_host *, struct device *,
+-			  unsigned long, struct ata_port_operations *);
++			  unsigned long, const struct ata_port_operations *);
+ extern int ata_scsi_detect(struct scsi_host_template *sht);
+ extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
+ extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
+diff -urNp linux-2.6.32.14/include/linux/lockd/bind.h linux-2.6.32.14/include/linux/lockd/bind.h
+--- linux-2.6.32.14/include/linux/lockd/bind.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/lockd/bind.h	2010-05-28 21:27:16.391248013 -0400
+@@ -23,13 +23,13 @@ struct svc_rqst;
+  * This is the set of functions for lockd->nfsd communication
+  */
+ struct nlmsvc_binding {
+-	__be32			(*fopen)(struct svc_rqst *,
++	__be32			(* const fopen)(struct svc_rqst *,
+ 						struct nfs_fh *,
+ 						struct file **);
+-	void			(*fclose)(struct file *);
++	void			(* const fclose)(struct file *);
+ };
+ 
+-extern struct nlmsvc_binding *	nlmsvc_ops;
++extern const struct nlmsvc_binding *	nlmsvc_ops;
+ 
+ /*
+  * Similar to nfs_client_initdata, but without the NFS-specific
+diff -urNp linux-2.6.32.14/include/linux/mm.h linux-2.6.32.14/include/linux/mm.h
+--- linux-2.6.32.14/include/linux/mm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/mm.h	2010-05-28 21:27:16.391248013 -0400
+@@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void 
+ #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
+ #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++#define VM_PAGEEXEC	0x80000000	/* vma->vm_page_prot needs special handling */
++#endif
++
+ #ifndef VM_STACK_DEFAULT_FLAGS		/* arch can override this */
+ #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
+ #endif
+@@ -880,6 +884,8 @@ struct shrinker {
+ extern void register_shrinker(struct shrinker *);
+ extern void unregister_shrinker(struct shrinker *);
+ 
++pgprot_t vm_get_page_prot(unsigned long vm_flags);
++
+ int vma_wants_writenotify(struct vm_area_struct *vma);
+ 
+ extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
+@@ -1152,6 +1158,7 @@ out:
+ }
+ 
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
++extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
+ 
+@@ -1206,6 +1213,10 @@ extern struct vm_area_struct * find_vma(
+ extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
+ 					     struct vm_area_struct **pprev);
+ 
++extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
++extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
++extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
++
+ /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
+    NULL if none.  Assume start_addr < end_addr. */
+ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
+@@ -1222,7 +1233,6 @@ static inline unsigned long vma_pages(st
+ 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ }
+ 
+-pgprot_t vm_get_page_prot(unsigned long vm_flags);
+ struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
+ int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
+ 			unsigned long pfn, unsigned long size, pgprot_t);
+@@ -1320,7 +1330,13 @@ extern void memory_failure(unsigned long
+ extern int __memory_failure(unsigned long pfn, int trapno, int ref);
+ extern int sysctl_memory_failure_early_kill;
+ extern int sysctl_memory_failure_recovery;
+-extern atomic_long_t mce_bad_pages;
++extern atomic_long_unchecked_t mce_bad_pages;
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
++#else
++static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
++#endif
+ 
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_MM_H */
+diff -urNp linux-2.6.32.14/include/linux/mm_types.h linux-2.6.32.14/include/linux/mm_types.h
+--- linux-2.6.32.14/include/linux/mm_types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/mm_types.h	2010-05-28 21:27:16.391248013 -0400
+@@ -186,6 +186,8 @@ struct vm_area_struct {
+ #ifdef CONFIG_NUMA
+ 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
+ #endif
++
++	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
+ };
+ 
+ struct core_thread {
+@@ -287,6 +289,24 @@ struct mm_struct {
+ #ifdef CONFIG_MMU_NOTIFIER
+ 	struct mmu_notifier_mm *mmu_notifier_mm;
+ #endif
++
++#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++	unsigned long pax_flags;
++#endif
++
++#ifdef CONFIG_PAX_DLRESOLVE
++	unsigned long call_dl_resolve;
++#endif
++
++#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
++	unsigned long call_syscall;
++#endif
++
++#ifdef CONFIG_PAX_ASLR
++	unsigned long delta_mmap;		/* randomized offset */
++	unsigned long delta_stack;		/* randomized offset */
++#endif
++
+ };
+ 
+ /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
+diff -urNp linux-2.6.32.14/include/linux/mmu_notifier.h linux-2.6.32.14/include/linux/mmu_notifier.h
+--- linux-2.6.32.14/include/linux/mmu_notifier.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/mmu_notifier.h	2010-05-28 21:27:16.391248013 -0400
+@@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
+  */
+ #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
+ ({									\
+-	pte_t __pte;							\
++	pte_t ___pte;							\
+ 	struct vm_area_struct *___vma = __vma;				\
+ 	unsigned long ___address = __address;				\
+-	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
++	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
+ 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
+-	__pte;								\
++	___pte;								\
+ })
+ 
+ #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
+diff -urNp linux-2.6.32.14/include/linux/mod_devicetable.h linux-2.6.32.14/include/linux/mod_devicetable.h
+--- linux-2.6.32.14/include/linux/mod_devicetable.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/mod_devicetable.h	2010-05-28 21:27:16.391248013 -0400
+@@ -12,7 +12,7 @@
+ typedef unsigned long kernel_ulong_t;
+ #endif
+ 
+-#define PCI_ANY_ID (~0)
++#define PCI_ANY_ID ((__u16)~0)
+ 
+ struct pci_device_id {
+ 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
+@@ -131,7 +131,7 @@ struct usb_device_id {
+ #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
+ #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
+ 
+-#define HID_ANY_ID				(~0)
++#define HID_ANY_ID				(~0U)
+ 
+ struct hid_device_id {
+ 	__u16 bus;
+diff -urNp linux-2.6.32.14/include/linux/module.h linux-2.6.32.14/include/linux/module.h
+--- linux-2.6.32.14/include/linux/module.h	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/include/linux/module.h	2010-05-28 21:27:16.391248013 -0400
+@@ -287,16 +287,16 @@ struct module
+ 	int (*init)(void);
+ 
+ 	/* If this is non-NULL, vfree after init() returns */
+-	void *module_init;
++	void *module_init_rx, *module_init_rw;
+ 
+ 	/* Here is the actual code + data, vfree'd on unload. */
+-	void *module_core;
++	void *module_core_rx, *module_core_rw;
+ 
+ 	/* Here are the sizes of the init and core sections */
+-	unsigned int init_size, core_size;
++	unsigned int init_size_rw, core_size_rw;
+ 
+ 	/* The size of the executable code in each section.  */
+-	unsigned int init_text_size, core_text_size;
++	unsigned int init_size_rx, core_size_rx;
+ 
+ 	/* Arch-specific module values */
+ 	struct mod_arch_specific arch;
+@@ -393,16 +393,46 @@ struct module *__module_address(unsigned
+ bool is_module_address(unsigned long addr);
+ bool is_module_text_address(unsigned long addr);
+ 
++static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
++{
++
++#ifdef CONFIG_PAX_KERNEXEC
++	if (ktla_ktva(addr) >= (unsigned long)start &&
++	    ktla_ktva(addr) < (unsigned long)start + size)
++		return 1;
++#endif
++
++	return ((void *)addr >= start && (void *)addr < start + size);
++}
++
++static inline int within_module_core_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
++}
++
++static inline int within_module_core_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
++}
++
++static inline int within_module_init_rx(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
++}
++
++static inline int within_module_init_rw(unsigned long addr, struct module *mod)
++{
++	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
++}
++
+ static inline int within_module_core(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_core <= addr &&
+-	       addr < (unsigned long)mod->module_core + mod->core_size;
++	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
+ }
+ 
+ static inline int within_module_init(unsigned long addr, struct module *mod)
+ {
+-	return (unsigned long)mod->module_init <= addr &&
+-	       addr < (unsigned long)mod->module_init + mod->init_size;
++	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
+ }
+ 
+ /* Search for module by name: must hold module_mutex. */
+diff -urNp linux-2.6.32.14/include/linux/moduleloader.h linux-2.6.32.14/include/linux/moduleloader.h
+--- linux-2.6.32.14/include/linux/moduleloader.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/moduleloader.h	2010-05-28 21:27:16.391248013 -0400
+@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
+    sections.  Returns NULL on failure. */
+ void *module_alloc(unsigned long size);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void *module_alloc_exec(unsigned long size);
++#else
++#define module_alloc_exec(x) module_alloc(x)
++#endif
++
+ /* Free memory returned from module_alloc. */
+ void module_free(struct module *mod, void *module_region);
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++void module_free_exec(struct module *mod, void *module_region);
++#else
++#define module_free_exec(x, y) module_free((x), (y))
++#endif
++
+ /* Apply the given relocation to the (simplified) ELF.  Return -error
+    or 0. */
+ int apply_relocate(Elf_Shdr *sechdrs,
+diff -urNp linux-2.6.32.14/include/linux/namei.h linux-2.6.32.14/include/linux/namei.h
+--- linux-2.6.32.14/include/linux/namei.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/namei.h	2010-05-28 21:27:16.394947878 -0400
+@@ -22,7 +22,7 @@ struct nameidata {
+ 	unsigned int	flags;
+ 	int		last_type;
+ 	unsigned	depth;
+-	char *saved_names[MAX_NESTED_LINKS + 1];
++	const char *saved_names[MAX_NESTED_LINKS + 1];
+ 
+ 	/* Intent data */
+ 	union {
+@@ -84,12 +84,12 @@ extern int follow_up(struct path *);
+ extern struct dentry *lock_rename(struct dentry *, struct dentry *);
+ extern void unlock_rename(struct dentry *, struct dentry *);
+ 
+-static inline void nd_set_link(struct nameidata *nd, char *path)
++static inline void nd_set_link(struct nameidata *nd, const char *path)
+ {
+ 	nd->saved_names[nd->depth] = path;
+ }
+ 
+-static inline char *nd_get_link(struct nameidata *nd)
++static inline const char *nd_get_link(const struct nameidata *nd)
+ {
+ 	return nd->saved_names[nd->depth];
+ }
+diff -urNp linux-2.6.32.14/include/linux/nodemask.h linux-2.6.32.14/include/linux/nodemask.h
+--- linux-2.6.32.14/include/linux/nodemask.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/nodemask.h	2010-05-28 21:27:16.394947878 -0400
+@@ -464,11 +464,11 @@ static inline int num_node_state(enum no
+ 
+ #define any_online_node(mask)			\
+ ({						\
+-	int node;				\
+-	for_each_node_mask(node, (mask))	\
+-		if (node_online(node))		\
++	int __node;				\
++	for_each_node_mask(__node, (mask))	\
++		if (node_online(__node))	\
+ 			break;			\
+-	node;					\
++	__node;					\
+ })
+ 
+ #define num_online_nodes()	num_node_state(N_ONLINE)
+diff -urNp linux-2.6.32.14/include/linux/oprofile.h linux-2.6.32.14/include/linux/oprofile.h
+--- linux-2.6.32.14/include/linux/oprofile.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/oprofile.h	2010-05-28 21:27:16.394947878 -0400
+@@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
+ int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
+ 	char const * name, ulong * val);
+  
+-/** Create a file for read-only access to an atomic_t. */
++/** Create a file for read-only access to an atomic_unchecked_t. */
+ int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
+-	char const * name, atomic_t * val);
++	char const * name, atomic_unchecked_t * val);
+  
+ /** create a directory */
+ struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
+diff -urNp linux-2.6.32.14/include/linux/pipe_fs_i.h linux-2.6.32.14/include/linux/pipe_fs_i.h
+--- linux-2.6.32.14/include/linux/pipe_fs_i.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/pipe_fs_i.h	2010-05-28 21:27:16.394947878 -0400
+@@ -46,9 +46,9 @@ struct pipe_inode_info {
+ 	wait_queue_head_t wait;
+ 	unsigned int nrbufs, curbuf;
+ 	struct page *tmp_page;
+-	unsigned int readers;
+-	unsigned int writers;
+-	unsigned int waiting_writers;
++	atomic_t readers;
++	atomic_t writers;
++	atomic_t waiting_writers;
+ 	unsigned int r_counter;
+ 	unsigned int w_counter;
+ 	struct fasync_struct *fasync_readers;
+diff -urNp linux-2.6.32.14/include/linux/poison.h linux-2.6.32.14/include/linux/poison.h
+--- linux-2.6.32.14/include/linux/poison.h	2010-05-15 13:20:19.331913169 -0400
++++ linux-2.6.32.14/include/linux/poison.h	2010-05-28 21:27:16.394947878 -0400
+@@ -19,8 +19,8 @@
+  * under normal circumstances, used to verify that nobody uses
+  * non-initialized list entries.
+  */
+-#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
+-#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
++#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
++#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
+ 
+ /********** include/linux/timer.h **********/
+ /*
+diff -urNp linux-2.6.32.14/include/linux/proc_fs.h linux-2.6.32.14/include/linux/proc_fs.h
+--- linux-2.6.32.14/include/linux/proc_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/proc_fs.h	2010-05-28 21:27:16.394947878 -0400
+@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
+ 	return proc_create_data(name, mode, parent, proc_fops, NULL);
+ }
+ 
++static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
++	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
++{
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
++#else
++	return proc_create_data(name, mode, parent, proc_fops, NULL);
++#endif
++}
++	
++
+ static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
+ 	mode_t mode, struct proc_dir_entry *base, 
+ 	read_proc_t *read_proc, void * data)
+diff -urNp linux-2.6.32.14/include/linux/random.h linux-2.6.32.14/include/linux/random.h
+--- linux-2.6.32.14/include/linux/random.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/random.h	2010-05-28 21:27:16.394947878 -0400
+@@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
+ u32 random32(void);
+ void srandom32(u32 seed);
+ 
++static inline unsigned long pax_get_random_long(void)
++{
++	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
++}
++
+ #endif /* __KERNEL___ */
+ 
+ #endif /* _LINUX_RANDOM_H */
+diff -urNp linux-2.6.32.14/include/linux/reiserfs_fs.h linux-2.6.32.14/include/linux/reiserfs_fs.h
+--- linux-2.6.32.14/include/linux/reiserfs_fs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/reiserfs_fs.h	2010-05-28 21:27:16.394947878 -0400
+@@ -1326,7 +1326,7 @@ static inline loff_t max_reiserfs_offset
+ #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
+ 
+ #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
+-#define get_generation(s) atomic_read (&fs_generation(s))
++#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
+ #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
+ #define __fs_changed(gen,s) (gen != get_generation (s))
+ #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
+@@ -1534,24 +1534,24 @@ static inline struct super_block *sb_fro
+ */
+ 
+ struct item_operations {
+-	int (*bytes_number) (struct item_head * ih, int block_size);
+-	void (*decrement_key) (struct cpu_key *);
+-	int (*is_left_mergeable) (struct reiserfs_key * ih,
++	int (* const bytes_number) (struct item_head * ih, int block_size);
++	void (* const decrement_key) (struct cpu_key *);
++	int (* const is_left_mergeable) (struct reiserfs_key * ih,
+ 				  unsigned long bsize);
+-	void (*print_item) (struct item_head *, char *item);
+-	void (*check_item) (struct item_head *, char *item);
++	void (* const print_item) (struct item_head *, char *item);
++	void (* const check_item) (struct item_head *, char *item);
+ 
+-	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
++	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
+ 			  int is_affected, int insert_size);
+-	int (*check_left) (struct virtual_item * vi, int free,
++	int (* const check_left) (struct virtual_item * vi, int free,
+ 			   int start_skip, int end_skip);
+-	int (*check_right) (struct virtual_item * vi, int free);
+-	int (*part_size) (struct virtual_item * vi, int from, int to);
+-	int (*unit_num) (struct virtual_item * vi);
+-	void (*print_vi) (struct virtual_item * vi);
++	int (* const check_right) (struct virtual_item * vi, int free);
++	int (* const part_size) (struct virtual_item * vi, int from, int to);
++	int (* const unit_num) (struct virtual_item * vi);
++	void (* const print_vi) (struct virtual_item * vi);
+ };
+ 
+-extern struct item_operations *item_ops[TYPE_ANY + 1];
++extern const struct item_operations * const item_ops[TYPE_ANY + 1];
+ 
+ #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
+ #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
+diff -urNp linux-2.6.32.14/include/linux/reiserfs_fs_sb.h linux-2.6.32.14/include/linux/reiserfs_fs_sb.h
+--- linux-2.6.32.14/include/linux/reiserfs_fs_sb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/reiserfs_fs_sb.h	2010-05-28 21:27:16.394947878 -0400
+@@ -377,7 +377,7 @@ struct reiserfs_sb_info {
+ 	/* Comment? -Hans */
+ 	wait_queue_head_t s_wait;
+ 	/* To be obsoleted soon by per buffer seals.. -Hans */
+-	atomic_t s_generation_counter;	// increased by one every time the
++	atomic_unchecked_t s_generation_counter;	// increased by one every time the
+ 	// tree gets re-balanced
+ 	unsigned long s_properties;	/* File system properties. Currently holds
+ 					   on-disk FS format */
+diff -urNp linux-2.6.32.14/include/linux/sched.h linux-2.6.32.14/include/linux/sched.h
+--- linux-2.6.32.14/include/linux/sched.h	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/include/linux/sched.h	2010-05-28 21:27:16.403248422 -0400
+@@ -101,6 +101,7 @@ struct bio;
+ struct fs_struct;
+ struct bts_context;
+ struct perf_event_context;
++struct linux_binprm;
+ 
+ /*
+  * List of flags we want to share for kernel threads,
+@@ -664,6 +665,15 @@ struct signal_struct {
+ 	struct tty_audit_buf *tty_audit_buf;
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++	u32 curr_ip;
++	u32 gr_saddr;
++	u32 gr_daddr;
++	u16 gr_sport;
++	u16 gr_dport;
++	u8 used_accept:1;
++#endif
++
+ 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
+ };
+ 
+@@ -1217,7 +1227,7 @@ struct rcu_node;
+ 
+ struct task_struct {
+ 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
+-	void *stack;
++	struct thread_info *stack;
+ 	atomic_t usage;
+ 	unsigned int flags;	/* per process flags, defined below */
+ 	unsigned int ptrace;
+@@ -1329,8 +1339,8 @@ struct task_struct {
+ 	struct list_head thread_group;
+ 
+ 	struct completion *vfork_done;		/* for vfork() */
+-	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
+-	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
++	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
++	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
+ 
+ 	cputime_t utime, stime, utimescaled, stimescaled;
+ 	cputime_t gtime;
+@@ -1344,16 +1354,6 @@ struct task_struct {
+ 	struct task_cputime cputime_expires;
+ 	struct list_head cpu_timers[3];
+ 
+-/* process credentials */
+-	const struct cred *real_cred;	/* objective and real subjective task
+-					 * credentials (COW) */
+-	const struct cred *cred;	/* effective (overridable) subjective task
+-					 * credentials (COW) */
+-	struct mutex cred_guard_mutex;	/* guard against foreign influences on
+-					 * credential calculations
+-					 * (notably. ptrace) */
+-	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
+-
+ 	char comm[TASK_COMM_LEN]; /* executable name excluding path
+ 				     - access with [gs]et_task_comm (which lock
+ 				       it with task_lock())
+@@ -1437,6 +1437,15 @@ struct task_struct {
+ 	int hardirq_context;
+ 	int softirq_context;
+ #endif
++
++/* process credentials */
++	const struct cred *real_cred;	/* objective and real subjective task
++					 * credentials (COW) */
++	struct mutex cred_guard_mutex;	/* guard against foreign influences on
++					 * credential calculations
++					 * (notably. ptrace) */
++	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
++
+ #ifdef CONFIG_LOCKDEP
+ # define MAX_LOCK_DEPTH 48UL
+ 	u64 curr_chain_key;
+@@ -1457,6 +1466,9 @@ struct task_struct {
+ 
+ 	struct backing_dev_info *backing_dev_info;
+ 
++	const struct cred *cred;	/* effective (overridable) subjective task
++					 * credentials (COW) */
++
+ 	struct io_context *io_context;
+ 
+ 	unsigned long ptrace_message;
+@@ -1520,6 +1532,19 @@ struct task_struct {
+ 	unsigned long default_timer_slack_ns;
+ 
+ 	struct list_head	*scm_work_list;
++
++#ifdef CONFIG_GRKERNSEC
++	/* grsecurity */
++	rwlock_t gr_fs_lock;
++	struct acl_subject_label *acl;
++	struct acl_role_label *role;
++	struct file *exec_file;
++	u16 acl_role_id;
++	u8 acl_sp_role;
++	u8 is_writable;
++	u8 brute;
++#endif
++
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ 	/* Index of current stored adress in ret_stack */
+ 	int curr_ret_stack;
+@@ -1543,6 +1568,52 @@ struct task_struct {
+ #endif /* CONFIG_TRACING */
+ };
+ 
++#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
++#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
++#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
++#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
++/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
++#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
++
++#ifdef CONFIG_PAX_SOFTMODE
++extern unsigned int pax_softmode;
++#endif
++
++extern int pax_check_flags(unsigned long *);
++
++/* if tsk != current then task_lock must be held on it */
++#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
++static inline unsigned long pax_get_flags(struct task_struct *tsk)
++{
++	if (likely(tsk->mm))
++		return tsk->mm->pax_flags;
++	else
++		return 0UL;
++}
++
++/* if tsk != current then task_lock must be held on it */
++static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
++{
++	if (likely(tsk->mm)) {
++		tsk->mm->pax_flags = flags;
++		return 0;
++	}
++	return -EINVAL;
++}
++#endif
++
++#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
++extern void pax_set_initial_flags(struct linux_binprm *bprm);
++#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
++extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
++#endif
++
++void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
++void pax_report_insns(void *pc, void *sp);
++void pax_report_refcount_overflow(struct pt_regs *regs);
++void pax_report_leak_to_user(const void *ptr, unsigned long len);
++void pax_report_overflow_from_user(const void *ptr, unsigned long len);
++
+ /* Future-safe accessor for struct task_struct's cpus_allowed. */
+ #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+ 
+@@ -2142,7 +2213,7 @@ extern void __cleanup_sighand(struct sig
+ extern void exit_itimers(struct signal_struct *);
+ extern void flush_itimer_signals(void);
+ 
+-extern NORET_TYPE void do_group_exit(int);
++extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
+ 
+ extern void daemonize(const char *, ...);
+ extern int allow_signal(int);
+@@ -2244,6 +2315,33 @@ static inline void task_unlock(struct ta
+ 	spin_unlock(&p->alloc_lock);
+ }
+ 
++/* grsec: protects only ->fs as task_lock is overkill and we can't
++   be using a spin_lock in interrupt context
++*/
++#ifdef CONFIG_GRKERNSEC
++#define gr_fs_write_lock_irqsave(x, y)				\
++	write_lock_irqsave(&x->gr_fs_lock, y)
++#define gr_fs_write_unlock_irqrestore(x, y) 			\
++	write_unlock_irqrestore(&x->gr_fs_lock, y)
++#else
++#define gr_fs_write_lock_irqsave(x, y)
++#define gr_fs_write_unlock_irqrestore(x, y)
++#endif
++
++static inline void gr_fs_read_lock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_lock(&p->gr_fs_lock);
++#endif
++}
++
++static inline void gr_fs_read_unlock(struct task_struct *p)
++{
++#ifdef CONFIG_GRKERNSEC
++	read_unlock(&p->gr_fs_lock);
++#endif
++}
++
+ extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
+ 							unsigned long *flags);
+ 
+@@ -2255,8 +2353,8 @@ static inline void unlock_task_sighand(s
+ 
+ #ifndef __HAVE_THREAD_FUNCTIONS
+ 
+-#define task_thread_info(task)	((struct thread_info *)(task)->stack)
+-#define task_stack_page(task)	((task)->stack)
++#define task_thread_info(task)	((task)->stack)
++#define task_stack_page(task)	((void *)(task)->stack)
+ 
+ static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
+ {
+@@ -2271,13 +2369,31 @@ static inline unsigned long *end_of_stac
+ 
+ #endif
+ 
+-static inline int object_is_on_stack(void *obj)
++static inline int object_starts_on_stack(void *obj)
+ {
+-	void *stack = task_stack_page(current);
++	const void *stack = task_stack_page(current);
+ 
+ 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
+ }
+ 
++/* 0: not at all, 1: fully, -1: partially (implies an error) */
++static inline int object_is_on_stack(const void *obj, unsigned long len)
++{
++	const void *stack = task_stack_page(current);
++	const void *stackend = stack + THREAD_SIZE;
++
++	if (obj + len < obj)
++		return -1;
++
++	if (stack <= obj && obj + len <= stackend)
++		return 1;
++
++	if (obj + len <= stack || stackend <=  obj)
++		return 0;
++
++	return -1;
++}
++
+ extern void thread_info_cache_init(void);
+ 
+ #ifdef CONFIG_DEBUG_STACK_USAGE
+diff -urNp linux-2.6.32.14/include/linux/screen_info.h linux-2.6.32.14/include/linux/screen_info.h
+--- linux-2.6.32.14/include/linux/screen_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/screen_info.h	2010-05-28 21:27:16.403248422 -0400
+@@ -42,7 +42,8 @@ struct screen_info {
+ 	__u16 pages;		/* 0x32 */
+ 	__u16 vesa_attributes;	/* 0x34 */
+ 	__u32 capabilities;     /* 0x36 */
+-	__u8  _reserved[6];	/* 0x3a */
++	__u16 vesapm_size;	/* 0x3a */
++	__u8  _reserved[4];	/* 0x3c */
+ } __attribute__((packed));
+ 
+ #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
+diff -urNp linux-2.6.32.14/include/linux/security.h linux-2.6.32.14/include/linux/security.h
+--- linux-2.6.32.14/include/linux/security.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/security.h	2010-05-28 21:27:16.403248422 -0400
+@@ -34,6 +34,7 @@
+ #include <linux/key.h>
+ #include <linux/xfrm.h>
+ #include <linux/gfp.h>
++#include <linux/grsecurity.h>
+ #include <net/flow.h>
+ 
+ /* Maximum number of letters for an LSM name string */
+diff -urNp linux-2.6.32.14/include/linux/shm.h linux-2.6.32.14/include/linux/shm.h
+--- linux-2.6.32.14/include/linux/shm.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/shm.h	2010-05-28 21:27:16.403248422 -0400
+@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
+ 	pid_t			shm_cprid;
+ 	pid_t			shm_lprid;
+ 	struct user_struct	*mlock_user;
++#ifdef CONFIG_GRKERNSEC
++	time_t			shm_createtime;
++	pid_t			shm_lapid;
++#endif
+ };
+ 
+ /* shm_mode upper byte flags */
+diff -urNp linux-2.6.32.14/include/linux/slab.h linux-2.6.32.14/include/linux/slab.h
+--- linux-2.6.32.14/include/linux/slab.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/slab.h	2010-05-28 21:27:16.407250185 -0400
+@@ -11,6 +11,7 @@
+ 
+ #include <linux/gfp.h>
+ #include <linux/types.h>
++#include <linux/err.h>
+ 
+ /*
+  * Flags to pass to kmem_cache_create().
+@@ -82,10 +83,13 @@
+  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
+  * Both make kfree a no-op.
+  */
+-#define ZERO_SIZE_PTR ((void *)16)
++#define ZERO_SIZE_PTR				\
++({						\
++	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
++	(void *)(-MAX_ERRNO-1L);		\
++})
+ 
+-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
+-				(unsigned long)ZERO_SIZE_PTR)
++#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
+ 
+ /*
+  * struct kmem_cache related prototypes
+@@ -138,6 +142,7 @@ void * __must_check krealloc(const void 
+ void kfree(const void *);
+ void kzfree(const void *);
+ size_t ksize(const void *);
++void check_object_size(const void *ptr, unsigned long n, bool to);
+ 
+ /*
+  * Allocator specific definitions. These are mainly used to establish optimized
+@@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t 
+ 
+ void __init kmem_cache_init_late(void);
+ 
++#define kmalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kmalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
++#define kmalloc_node(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = kmalloc_node((size_t)___x, (y), (z));\
++	___retval;						\
++})
++
++#define kzalloc(x, y)					\
++({							\
++	void *___retval;				\
++	intoverflow_t ___x = (intoverflow_t)x;		\
++	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
++		___retval = NULL;			\
++	else						\
++		___retval = kzalloc((size_t)___x, (y));	\
++	___retval;					\
++})
++
+ #endif	/* _LINUX_SLAB_H */
+diff -urNp linux-2.6.32.14/include/linux/slub_def.h linux-2.6.32.14/include/linux/slub_def.h
+--- linux-2.6.32.14/include/linux/slub_def.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/slub_def.h	2010-05-28 21:27:16.407250185 -0400
+@@ -86,7 +86,7 @@ struct kmem_cache {
+ 	struct kmem_cache_order_objects max;
+ 	struct kmem_cache_order_objects min;
+ 	gfp_t allocflags;	/* gfp flags to use on each alloc */
+-	int refcount;		/* Refcount for slab cache destroy */
++	atomic_t refcount;	/* Refcount for slab cache destroy */
+ 	void (*ctor)(void *);
+ 	int inuse;		/* Offset to metadata */
+ 	int align;		/* Alignment */
+diff -urNp linux-2.6.32.14/include/linux/sonet.h linux-2.6.32.14/include/linux/sonet.h
+--- linux-2.6.32.14/include/linux/sonet.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/sonet.h	2010-05-28 21:27:16.407250185 -0400
+@@ -61,7 +61,7 @@ struct sonet_stats {
+ #include <asm/atomic.h>
+ 
+ struct k_sonet_stats {
+-#define __HANDLE_ITEM(i) atomic_t i
++#define __HANDLE_ITEM(i) atomic_unchecked_t i
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ };
+diff -urNp linux-2.6.32.14/include/linux/suspend.h linux-2.6.32.14/include/linux/suspend.h
+--- linux-2.6.32.14/include/linux/suspend.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/suspend.h	2010-05-28 21:27:16.407250185 -0400
+@@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
+  *	which require special recovery actions in that situation.
+  */
+ struct platform_suspend_ops {
+-	int (*valid)(suspend_state_t state);
+-	int (*begin)(suspend_state_t state);
+-	int (*prepare)(void);
+-	int (*prepare_late)(void);
+-	int (*enter)(suspend_state_t state);
+-	void (*wake)(void);
+-	void (*finish)(void);
+-	void (*end)(void);
+-	void (*recover)(void);
++	int (* const valid)(suspend_state_t state);
++	int (* const begin)(suspend_state_t state);
++	int (* const prepare)(void);
++	int (* const prepare_late)(void);
++	int (* const enter)(suspend_state_t state);
++	void (* const wake)(void);
++	void (* const finish)(void);
++	void (* const end)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_SUSPEND
+@@ -120,7 +120,7 @@ struct platform_suspend_ops {
+  * suspend_set_ops - set platform dependent suspend operations
+  * @ops: The new suspend operations to set.
+  */
+-extern void suspend_set_ops(struct platform_suspend_ops *ops);
++extern void suspend_set_ops(const struct platform_suspend_ops *ops);
+ extern int suspend_valid_only_mem(suspend_state_t state);
+ 
+ /**
+@@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
+ #else /* !CONFIG_SUSPEND */
+ #define suspend_valid_only_mem	NULL
+ 
+-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
++static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
+ static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
+ #endif /* !CONFIG_SUSPEND */
+ 
+@@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone 
+  *	platforms which require special recovery actions in that situation.
+  */
+ struct platform_hibernation_ops {
+-	int (*begin)(void);
+-	void (*end)(void);
+-	int (*pre_snapshot)(void);
+-	void (*finish)(void);
+-	int (*prepare)(void);
+-	int (*enter)(void);
+-	void (*leave)(void);
+-	int (*pre_restore)(void);
+-	void (*restore_cleanup)(void);
+-	void (*recover)(void);
++	int (* const begin)(void);
++	void (* const end)(void);
++	int (* const pre_snapshot)(void);
++	void (* const finish)(void);
++	int (* const prepare)(void);
++	int (* const enter)(void);
++	void (* const leave)(void);
++	int (* const pre_restore)(void);
++	void (* const restore_cleanup)(void);
++	void (* const recover)(void);
+ };
+ 
+ #ifdef CONFIG_HIBERNATION
+@@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct 
+ extern void swsusp_unset_page_free(struct page *);
+ extern unsigned long get_safe_page(gfp_t gfp_mask);
+ 
+-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
++extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
+ extern int hibernate(void);
+ extern bool system_entering_hibernation(void);
+ #else /* CONFIG_HIBERNATION */
+@@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
+ static inline void swsusp_set_page_free(struct page *p) {}
+ static inline void swsusp_unset_page_free(struct page *p) {}
+ 
+-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
++static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
+ static inline int hibernate(void) { return -ENOSYS; }
+ static inline bool system_entering_hibernation(void) { return false; }
+ #endif /* CONFIG_HIBERNATION */
+diff -urNp linux-2.6.32.14/include/linux/sysctl.h linux-2.6.32.14/include/linux/sysctl.h
+--- linux-2.6.32.14/include/linux/sysctl.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/sysctl.h	2010-05-28 21:27:16.423734148 -0400
+@@ -164,7 +164,11 @@ enum
+ 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
+ };
+ 
+-
++#ifdef CONFIG_PAX_SOFTMODE
++enum {
++	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
++};
++#endif
+ 
+ /* CTL_VM names: */
+ enum
+diff -urNp linux-2.6.32.14/include/linux/sysfs.h linux-2.6.32.14/include/linux/sysfs.h
+--- linux-2.6.32.14/include/linux/sysfs.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/sysfs.h	2010-05-28 21:27:16.423734148 -0400
+@@ -75,8 +75,8 @@ struct bin_attribute {
+ };
+ 
+ struct sysfs_ops {
+-	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
+-	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
++	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
++	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
+ };
+ 
+ struct sysfs_dirent;
+diff -urNp linux-2.6.32.14/include/linux/thread_info.h linux-2.6.32.14/include/linux/thread_info.h
+--- linux-2.6.32.14/include/linux/thread_info.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/thread_info.h	2010-05-28 21:27:16.423734148 -0400
+@@ -23,7 +23,7 @@ struct restart_block {
+ 		};
+ 		/* For futex_wait and futex_wait_requeue_pi */
+ 		struct {
+-			u32 *uaddr;
++			u32 __user *uaddr;
+ 			u32 val;
+ 			u32 flags;
+ 			u32 bitset;
+diff -urNp linux-2.6.32.14/include/linux/tty.h linux-2.6.32.14/include/linux/tty.h
+--- linux-2.6.32.14/include/linux/tty.h	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.14/include/linux/tty.h	2010-05-28 21:27:16.423734148 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/tty_ldisc.h>
+ #include <linux/mutex.h>
++#include <linux/poll.h>
+ 
+ #include <asm/system.h>
+ 
+@@ -443,7 +444,6 @@ extern int tty_perform_flush(struct tty_
+ extern dev_t tty_devnum(struct tty_struct *tty);
+ extern void proc_clear_tty(struct task_struct *p);
+ extern struct tty_struct *get_current_tty(void);
+-extern void tty_default_fops(struct file_operations *fops);
+ extern struct tty_struct *alloc_tty_struct(void);
+ extern void free_tty_struct(struct tty_struct *tty);
+ extern void initialize_tty_struct(struct tty_struct *tty,
+@@ -493,6 +493,18 @@ extern void tty_ldisc_begin(void);
+ /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
+ extern void tty_ldisc_enable(struct tty_struct *tty);
+ 
++/* tty_io.c */
++extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
++extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
++extern unsigned int tty_poll(struct file *, poll_table *);
++#ifdef CONFIG_COMPAT
++extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
++				unsigned long arg);
++#else
++#define tty_compat_ioctl NULL
++#endif
++extern int tty_release(struct inode *, struct file *);
++extern int tty_fasync(int fd, struct file *filp, int on);
+ 
+ /* n_tty.c */
+ extern struct tty_ldisc_ops tty_ldisc_N_TTY;
+diff -urNp linux-2.6.32.14/include/linux/tty_ldisc.h linux-2.6.32.14/include/linux/tty_ldisc.h
+--- linux-2.6.32.14/include/linux/tty_ldisc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/tty_ldisc.h	2010-05-28 21:27:16.423734148 -0400
+@@ -139,7 +139,7 @@ struct tty_ldisc_ops {
+ 
+ 	struct  module *owner;
+ 	
+-	int refcount;
++	atomic_t refcount;
+ };
+ 
+ struct tty_ldisc {
+diff -urNp linux-2.6.32.14/include/linux/types.h linux-2.6.32.14/include/linux/types.h
+--- linux-2.6.32.14/include/linux/types.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/types.h	2010-05-28 21:27:16.427051097 -0400
+@@ -191,10 +191,26 @@ typedef struct {
+ 	volatile int counter;
+ } atomic_t;
+ 
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile int counter;
++} atomic_unchecked_t;
++#else
++typedef atomic_t atomic_unchecked_t;
++#endif
++
+ #ifdef CONFIG_64BIT
+ typedef struct {
+ 	volatile long counter;
+ } atomic64_t;
++
++#ifdef CONFIG_PAX_REFCOUNT
++typedef struct {
++	volatile long counter;
++} atomic64_unchecked_t;
++#else
++typedef atomic64_t atomic64_unchecked_t;
++#endif
+ #endif
+ 
+ struct ustat {
+diff -urNp linux-2.6.32.14/include/linux/uaccess.h linux-2.6.32.14/include/linux/uaccess.h
+--- linux-2.6.32.14/include/linux/uaccess.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/uaccess.h	2010-05-28 21:27:16.427051097 -0400
+@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
+ 		long ret;				\
+ 		mm_segment_t old_fs = get_fs();		\
+ 							\
+-		set_fs(KERNEL_DS);			\
+ 		pagefault_disable();			\
++		set_fs(KERNEL_DS);			\
+ 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
+-		pagefault_enable();			\
+ 		set_fs(old_fs);				\
++		pagefault_enable();			\
+ 		ret;					\
+ 	})
+ 
+@@ -93,7 +93,7 @@ static inline unsigned long __copy_from_
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_read(void *dst, void *src, size_t size);
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
+ 
+ /*
+  * probe_kernel_write(): safely attempt to write to a location
+@@ -104,6 +104,6 @@ extern long probe_kernel_read(void *dst,
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-extern long probe_kernel_write(void *dst, void *src, size_t size);
++extern long probe_kernel_write(void *dst, const void *src, size_t size);
+ 
+ #endif		/* __LINUX_UACCESS_H__ */
+diff -urNp linux-2.6.32.14/include/linux/vmalloc.h linux-2.6.32.14/include/linux/vmalloc.h
+--- linux-2.6.32.14/include/linux/vmalloc.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/linux/vmalloc.h	2010-05-28 21:27:16.427051097 -0400
+@@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
+ #define VM_MAP		0x00000004	/* vmap()ed pages */
+ #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
+ #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
++#endif
++
+ /* bits [20..32] reserved for arch specific ioremap internals */
+ 
+ /*
+@@ -123,4 +128,81 @@ struct vm_struct **pcpu_get_vm_areas(con
+ 
+ void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
+ 
++#define vmalloc(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define __vmalloc(x, y, z)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = __vmalloc((unsigned long)___x, (y), (z));\
++	___retval;						\
++})
++
++#define vmalloc_user(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_user((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_exec(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_exec((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_node(x, y)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_node((unsigned long)___x, (y));\
++	___retval;						\
++})
++
++#define vmalloc_32(x)						\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32((unsigned long)___x);	\
++	___retval;						\
++})
++
++#define vmalloc_32_user(x)					\
++({								\
++	void *___retval;					\
++	intoverflow_t ___x = (intoverflow_t)x;			\
++	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
++		___retval = NULL;				\
++	else							\
++		___retval = vmalloc_32_user((unsigned long)___x);\
++	___retval;						\
++})
++
+ #endif /* _LINUX_VMALLOC_H */
+diff -urNp linux-2.6.32.14/include/net/irda/ircomm_tty.h linux-2.6.32.14/include/net/irda/ircomm_tty.h
+--- linux-2.6.32.14/include/net/irda/ircomm_tty.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/net/irda/ircomm_tty.h	2010-05-28 21:27:16.427051097 -0400
+@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
+         unsigned short    close_delay;
+         unsigned short    closing_wait; /* time to wait before closing */
+ 
+-	int  open_count;
+-	int  blocked_open;	/* # of blocked opens */
++	atomic_t open_count;
++	atomic_t blocked_open;	/* # of blocked opens */
+ 
+ 	/* Protect concurent access to :
+ 	 *	o self->open_count
+diff -urNp linux-2.6.32.14/include/net/neighbour.h linux-2.6.32.14/include/net/neighbour.h
+--- linux-2.6.32.14/include/net/neighbour.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/net/neighbour.h	2010-05-28 21:27:16.427051097 -0400
+@@ -125,12 +125,12 @@ struct neighbour
+ struct neigh_ops
+ {
+ 	int			family;
+-	void			(*solicit)(struct neighbour *, struct sk_buff*);
+-	void			(*error_report)(struct neighbour *, struct sk_buff*);
+-	int			(*output)(struct sk_buff*);
+-	int			(*connected_output)(struct sk_buff*);
+-	int			(*hh_output)(struct sk_buff*);
+-	int			(*queue_xmit)(struct sk_buff*);
++	void			(* const solicit)(struct neighbour *, struct sk_buff*);
++	void			(* const error_report)(struct neighbour *, struct sk_buff*);
++	int			(* const output)(struct sk_buff*);
++	int			(* const connected_output)(struct sk_buff*);
++	int			(* const hh_output)(struct sk_buff*);
++	int			(* const queue_xmit)(struct sk_buff*);
+ };
+ 
+ struct pneigh_entry
+diff -urNp linux-2.6.32.14/include/net/sctp/sctp.h linux-2.6.32.14/include/net/sctp/sctp.h
+--- linux-2.6.32.14/include/net/sctp/sctp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/net/sctp/sctp.h	2010-05-28 21:27:16.427051097 -0400
+@@ -305,8 +305,8 @@ extern int sctp_debug_flag;
+ 
+ #else	/* SCTP_DEBUG */
+ 
+-#define SCTP_DEBUG_PRINTK(whatever...)
+-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
++#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
++#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
+ #define SCTP_ENABLE_DEBUG
+ #define SCTP_DISABLE_DEBUG
+ #define SCTP_ASSERT(expr, str, func)
+diff -urNp linux-2.6.32.14/include/net/tcp.h linux-2.6.32.14/include/net/tcp.h
+--- linux-2.6.32.14/include/net/tcp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/net/tcp.h	2010-05-28 21:27:16.427051097 -0400
+@@ -1420,6 +1420,7 @@ enum tcp_seq_states {
+ struct tcp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.14/include/net/udp.h linux-2.6.32.14/include/net/udp.h
+--- linux-2.6.32.14/include/net/udp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/net/udp.h	2010-05-28 21:27:16.427051097 -0400
+@@ -187,6 +187,7 @@ struct udp_seq_afinfo {
+ 	char			*name;
+ 	sa_family_t		family;
+ 	struct udp_table	*udp_table;
++	/* cannot be const */
+ 	struct file_operations	seq_fops;
+ 	struct seq_operations	seq_ops;
+ };
+diff -urNp linux-2.6.32.14/include/sound/ac97_codec.h linux-2.6.32.14/include/sound/ac97_codec.h
+--- linux-2.6.32.14/include/sound/ac97_codec.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/sound/ac97_codec.h	2010-05-28 21:27:16.427051097 -0400
+@@ -419,15 +419,15 @@
+ struct snd_ac97;
+ 
+ struct snd_ac97_build_ops {
+-	int (*build_3d) (struct snd_ac97 *ac97);
+-	int (*build_specific) (struct snd_ac97 *ac97);
+-	int (*build_spdif) (struct snd_ac97 *ac97);
+-	int (*build_post_spdif) (struct snd_ac97 *ac97);
++	int (* const build_3d) (struct snd_ac97 *ac97);
++	int (* const build_specific) (struct snd_ac97 *ac97);
++	int (* const build_spdif) (struct snd_ac97 *ac97);
++	int (* const build_post_spdif) (struct snd_ac97 *ac97);
+ #ifdef CONFIG_PM
+-	void (*suspend) (struct snd_ac97 *ac97);
+-	void (*resume) (struct snd_ac97 *ac97);
++	void (* const suspend) (struct snd_ac97 *ac97);
++	void (* const resume) (struct snd_ac97 *ac97);
+ #endif
+-	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
++	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
+ };
+ 
+ struct snd_ac97_bus_ops {
+@@ -477,7 +477,7 @@ struct snd_ac97_template {
+ 
+ struct snd_ac97 {
+ 	/* -- lowlevel (hardware) driver specific -- */
+-	struct snd_ac97_build_ops * build_ops;
++	const struct snd_ac97_build_ops * build_ops;
+ 	void *private_data;
+ 	void (*private_free) (struct snd_ac97 *ac97);
+ 	/* --- */
+diff -urNp linux-2.6.32.14/include/trace/events/irq.h linux-2.6.32.14/include/trace/events/irq.h
+--- linux-2.6.32.14/include/trace/events/irq.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/trace/events/irq.h	2010-05-28 21:27:16.427051097 -0400
+@@ -34,7 +34,7 @@
+  */
+ TRACE_EVENT(irq_handler_entry,
+ 
+-	TP_PROTO(int irq, struct irqaction *action),
++	TP_PROTO(int irq, const struct irqaction *action),
+ 
+ 	TP_ARGS(irq, action),
+ 
+@@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
+  */
+ TRACE_EVENT(irq_handler_exit,
+ 
+-	TP_PROTO(int irq, struct irqaction *action, int ret),
++	TP_PROTO(int irq, const struct irqaction *action, int ret),
+ 
+ 	TP_ARGS(irq, action, ret),
+ 
+@@ -95,7 +95,7 @@ TRACE_EVENT(irq_handler_exit,
+  */
+ TRACE_EVENT(softirq_entry,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+@@ -124,7 +124,7 @@ TRACE_EVENT(softirq_entry,
+  */
+ TRACE_EVENT(softirq_exit,
+ 
+-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
++	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
+ 
+ 	TP_ARGS(h, vec),
+ 
+diff -urNp linux-2.6.32.14/include/video/uvesafb.h linux-2.6.32.14/include/video/uvesafb.h
+--- linux-2.6.32.14/include/video/uvesafb.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/include/video/uvesafb.h	2010-05-28 21:27:16.427051097 -0400
+@@ -177,6 +177,7 @@ struct uvesafb_par {
+ 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
+ 	u8 pmi_setpal;			/* PMI for palette changes */
+ 	u16 *pmi_base;			/* protected mode interface location */
++	u8 *pmi_code;			/* protected mode code location */
+ 	void *pmi_start;
+ 	void *pmi_pal;
+ 	u8 *vbe_state_orig;		/*
+diff -urNp linux-2.6.32.14/init/do_mounts.c linux-2.6.32.14/init/do_mounts.c
+--- linux-2.6.32.14/init/do_mounts.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/do_mounts.c	2010-05-28 21:27:16.427051097 -0400
+@@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
+ 
+ static int __init do_mount_root(char *name, char *fs, int flags, void *data)
+ {
+-	int err = sys_mount(name, "/root", fs, flags, data);
++	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
+ 	if (err)
+ 		return err;
+ 
+-	sys_chdir("/root");
++	sys_chdir((__force char __user *)"/root");
+ 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
+ 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
+ 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
+@@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
+ 	va_start(args, fmt);
+ 	vsprintf(buf, fmt, args);
+ 	va_end(args);
+-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
++	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, FDEJECT, 0);
+ 		sys_close(fd);
+ 	}
+ 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
+-	fd = sys_open("/dev/console", O_RDWR, 0);
++	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, TCGETS, (long)&termios);
+ 		termios.c_lflag &= ~ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+-		sys_read(fd, &c, 1);
++		sys_read(fd, (char __user *)&c, 1);
+ 		termios.c_lflag |= ICANON;
+ 		sys_ioctl(fd, TCSETSF, (long)&termios);
+ 		sys_close(fd);
+@@ -416,6 +416,6 @@ void __init prepare_namespace(void)
+ 	mount_root();
+ out:
+ 	devtmpfs_mount("dev");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force char __user *)".");
+ }
+diff -urNp linux-2.6.32.14/init/do_mounts.h linux-2.6.32.14/init/do_mounts.h
+--- linux-2.6.32.14/init/do_mounts.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/do_mounts.h	2010-05-28 21:27:16.427051097 -0400
+@@ -15,15 +15,15 @@ extern int root_mountflags;
+ 
+ static inline int create_dev(char *name, dev_t dev)
+ {
+-	sys_unlink(name);
+-	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
++	sys_unlink((__force char __user *)name);
++	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
+ }
+ 
+ #if BITS_PER_LONG == 32
+ static inline u32 bstat(char *name)
+ {
+ 	struct stat64 stat;
+-	if (sys_stat64(name, &stat) != 0)
++	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
+ 		return 0;
+ 	if (!S_ISBLK(stat.st_mode))
+ 		return 0;
+diff -urNp linux-2.6.32.14/init/do_mounts_initrd.c linux-2.6.32.14/init/do_mounts_initrd.c
+--- linux-2.6.32.14/init/do_mounts_initrd.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/do_mounts_initrd.c	2010-05-28 21:27:16.427051097 -0400
+@@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
+ 	sys_close(old_fd);sys_close(root_fd);
+ 	sys_close(0);sys_close(1);sys_close(2);
+ 	sys_setsid();
+-	(void) sys_open("/dev/console",O_RDWR,0);
++	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
+ 	(void) sys_dup(0);
+ 	(void) sys_dup(0);
+ 	return kernel_execve(shell, argv, envp_init);
+@@ -47,13 +47,13 @@ static void __init handle_initrd(void)
+ 	create_dev("/dev/root.old", Root_RAM0);
+ 	/* mount initrd on rootfs' /root */
+ 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
+-	sys_mkdir("/old", 0700);
+-	root_fd = sys_open("/", 0, 0);
+-	old_fd = sys_open("/old", 0, 0);
++	sys_mkdir((__force const char __user *)"/old", 0700);
++	root_fd = sys_open((__force const char __user *)"/", 0, 0);
++	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
+ 	/* move initrd over / and chdir/chroot in initrd root */
+-	sys_chdir("/root");
+-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
+-	sys_chroot(".");
++	sys_chdir((__force const char __user *)"/root");
++	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
++	sys_chroot((__force const char __user *)".");
+ 
+ 	/*
+ 	 * In case that a resume from disk is carried out by linuxrc or one of
+@@ -70,15 +70,15 @@ static void __init handle_initrd(void)
+ 
+ 	/* move initrd to rootfs' /old */
+ 	sys_fchdir(old_fd);
+-	sys_mount("/", ".", NULL, MS_MOVE, NULL);
++	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
+ 	/* switch root and cwd back to / of rootfs */
+ 	sys_fchdir(root_fd);
+-	sys_chroot(".");
++	sys_chroot((__force const char __user *)".");
+ 	sys_close(old_fd);
+ 	sys_close(root_fd);
+ 
+ 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
+-		sys_chdir("/old");
++		sys_chdir((__force const char __user *)"/old");
+ 		return;
+ 	}
+ 
+@@ -86,17 +86,17 @@ static void __init handle_initrd(void)
+ 	mount_root();
+ 
+ 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
+-	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
++	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
+ 	if (!error)
+ 		printk("okay\n");
+ 	else {
+-		int fd = sys_open("/dev/root.old", O_RDWR, 0);
++		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
+ 		if (error == -ENOENT)
+ 			printk("/initrd does not exist. Ignored.\n");
+ 		else
+ 			printk("failed\n");
+ 		printk(KERN_NOTICE "Unmounting old root\n");
+-		sys_umount("/old", MNT_DETACH);
++		sys_umount((__force char __user *)"/old", MNT_DETACH);
+ 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
+ 		if (fd < 0) {
+ 			error = fd;
+@@ -119,11 +119,11 @@ int __init initrd_load(void)
+ 		 * mounted in the normal path.
+ 		 */
+ 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
+-			sys_unlink("/initrd.image");
++			sys_unlink((__force const char __user *)"/initrd.image");
+ 			handle_initrd();
+ 			return 1;
+ 		}
+ 	}
+-	sys_unlink("/initrd.image");
++	sys_unlink((__force const char __user *)"/initrd.image");
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/init/do_mounts_md.c linux-2.6.32.14/init/do_mounts_md.c
+--- linux-2.6.32.14/init/do_mounts_md.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/do_mounts_md.c	2010-05-28 21:27:16.427051097 -0400
+@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
+ 			partitioned ? "_d" : "", minor,
+ 			md_setup_args[ent].device_names);
+ 
+-		fd = sys_open(name, 0, 0);
++		fd = sys_open((__force char __user *)name, 0, 0);
+ 		if (fd < 0) {
+ 			printk(KERN_ERR "md: open failed - cannot start "
+ 					"array %s\n", name);
+@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
+ 			 * array without it
+ 			 */
+ 			sys_close(fd);
+-			fd = sys_open(name, 0, 0);
++			fd = sys_open((__force char __user *)name, 0, 0);
+ 			sys_ioctl(fd, BLKRRPART, 0);
+ 		}
+ 		sys_close(fd);
+@@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
+ 
+ 	wait_for_device_probe();
+ 
+-	fd = sys_open("/dev/md0", 0, 0);
++	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
+ 	if (fd >= 0) {
+ 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
+ 		sys_close(fd);
+diff -urNp linux-2.6.32.14/init/initramfs.c linux-2.6.32.14/init/initramfs.c
+--- linux-2.6.32.14/init/initramfs.c	2010-05-15 13:20:19.362999772 -0400
++++ linux-2.6.32.14/init/initramfs.c	2010-05-28 21:27:16.427051097 -0400
+@@ -74,7 +74,7 @@ static void __init free_hash(void)
+ 	}
+ }
+ 
+-static long __init do_utime(char __user *filename, time_t mtime)
++static long __init do_utime(__force char __user *filename, time_t mtime)
+ {
+ 	struct timespec t[2];
+ 
+@@ -109,7 +109,7 @@ static void __init dir_utime(void)
+ 	struct dir_entry *de, *tmp;
+ 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
+ 		list_del(&de->list);
+-		do_utime(de->name, de->mtime);
++		do_utime((__force char __user *)de->name, de->mtime);
+ 		kfree(de->name);
+ 		kfree(de);
+ 	}
+@@ -271,7 +271,7 @@ static int __init maybe_link(void)
+ 	if (nlink >= 2) {
+ 		char *old = find_link(major, minor, ino, mode, collected);
+ 		if (old)
+-			return (sys_link(old, collected) < 0) ? -1 : 1;
++			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
+ 	}
+ 	return 0;
+ }
+@@ -280,11 +280,11 @@ static void __init clean_path(char *path
+ {
+ 	struct stat st;
+ 
+-	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
++	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
+ 		if (S_ISDIR(st.st_mode))
+-			sys_rmdir(path);
++			sys_rmdir((__force char __user *)path);
+ 		else
+-			sys_unlink(path);
++			sys_unlink((__force char __user *)path);
+ 	}
+ }
+ 
+@@ -305,7 +305,7 @@ static int __init do_name(void)
+ 			int openflags = O_WRONLY|O_CREAT;
+ 			if (ml != 1)
+ 				openflags |= O_TRUNC;
+-			wfd = sys_open(collected, openflags, mode);
++			wfd = sys_open((__force char __user *)collected, openflags, mode);
+ 
+ 			if (wfd >= 0) {
+ 				sys_fchown(wfd, uid, gid);
+@@ -317,17 +317,17 @@ static int __init do_name(void)
+ 			}
+ 		}
+ 	} else if (S_ISDIR(mode)) {
+-		sys_mkdir(collected, mode);
+-		sys_chown(collected, uid, gid);
+-		sys_chmod(collected, mode);
++		sys_mkdir((__force char __user *)collected, mode);
++		sys_chown((__force char __user *)collected, uid, gid);
++		sys_chmod((__force char __user *)collected, mode);
+ 		dir_add(collected, mtime);
+ 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
+ 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
+ 		if (maybe_link() == 0) {
+-			sys_mknod(collected, mode, rdev);
+-			sys_chown(collected, uid, gid);
+-			sys_chmod(collected, mode);
+-			do_utime(collected, mtime);
++			sys_mknod((__force char __user *)collected, mode, rdev);
++			sys_chown((__force char __user *)collected, uid, gid);
++			sys_chmod((__force char __user *)collected, mode);
++			do_utime((__force char __user *)collected, mtime);
+ 		}
+ 	}
+ 	return 0;
+@@ -336,15 +336,15 @@ static int __init do_name(void)
+ static int __init do_copy(void)
+ {
+ 	if (count >= body_len) {
+-		sys_write(wfd, victim, body_len);
++		sys_write(wfd, (__force char __user *)victim, body_len);
+ 		sys_close(wfd);
+-		do_utime(vcollected, mtime);
++		do_utime((__force char __user *)vcollected, mtime);
+ 		kfree(vcollected);
+ 		eat(body_len);
+ 		state = SkipIt;
+ 		return 0;
+ 	} else {
+-		sys_write(wfd, victim, count);
++		sys_write(wfd, (__force char __user *)victim, count);
+ 		body_len -= count;
+ 		eat(count);
+ 		return 1;
+@@ -355,9 +355,9 @@ static int __init do_symlink(void)
+ {
+ 	collected[N_ALIGN(name_len) + body_len] = '\0';
+ 	clean_path(collected, 0);
+-	sys_symlink(collected + N_ALIGN(name_len), collected);
+-	sys_lchown(collected, uid, gid);
+-	do_utime(collected, mtime);
++	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
++	sys_lchown((__force char __user *)collected, uid, gid);
++	do_utime((__force char __user *)collected, mtime);
+ 	state = SkipIt;
+ 	next_state = Reset;
+ 	return 0;
+diff -urNp linux-2.6.32.14/init/Kconfig linux-2.6.32.14/init/Kconfig
+--- linux-2.6.32.14/init/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/Kconfig	2010-05-29 16:35:52.581909467 -0400
+@@ -1026,7 +1026,7 @@ config SLUB_DEBUG
+ 
+ config COMPAT_BRK
+ 	bool "Disable heap randomization"
+-	default y
++	default n
+ 	help
+ 	  Randomizing heap placement makes heap exploits harder, but it
+ 	  also breaks ancient binaries (including anything libc5 based).
+diff -urNp linux-2.6.32.14/init/main.c linux-2.6.32.14/init/main.c
+--- linux-2.6.32.14/init/main.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.14/init/main.c	2010-05-28 21:27:16.427051097 -0400
+@@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) 
+ #ifdef CONFIG_TC
+ extern void tc_init(void);
+ #endif
++extern void grsecurity_init(void);
+ 
+ enum system_states system_state __read_mostly;
+ EXPORT_SYMBOL(system_state);
+@@ -183,6 +184,50 @@ static int __init set_reset_devices(char
+ 
+ __setup("reset_devices", set_reset_devices);
+ 
++#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
++extern void pax_enter_kernel_user(void);
++extern void pax_exit_kernel_user(void);
++extern pteval_t clone_pgd_mask;
++#endif
++
++#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++	unsigned int cpu;
++
++	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
++		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++	}
++	asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
++	asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
++#else
++	char *p;
++	p = (char *)pax_enter_kernel_user;
++	*p = 0xc3;
++	p = (char *)pax_exit_kernel_user;
++	*p = 0xc3;
++	clone_pgd_mask = ~(pteval_t)0UL;
++#endif
++
++	return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++unsigned int pax_softmode;
++
++static int __init setup_pax_softmode(char *str)
++{
++	get_option(&str, &pax_softmode);
++	return 1;
++}
++__setup("pax_softmode=", setup_pax_softmode);
++#endif
++
+ static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
+ char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
+ static const char *panic_later, *panic_param;
+@@ -697,52 +742,53 @@ int initcall_debug;
+ core_param(initcall_debug, initcall_debug, bool, 0644);
+ 
+ static char msgbuf[64];
+-static struct boot_trace_call call;
+-static struct boot_trace_ret ret;
++static struct boot_trace_call trace_call;
++static struct boot_trace_ret trace_ret;
+ 
+ int do_one_initcall(initcall_t fn)
+ {
+ 	int count = preempt_count();
+ 	ktime_t calltime, delta, rettime;
++	const char *msg1 = "", *msg2 = "";
+ 
+ 	if (initcall_debug) {
+-		call.caller = task_pid_nr(current);
+-		printk("calling  %pF @ %i\n", fn, call.caller);
++		trace_call.caller = task_pid_nr(current);
++		printk("calling  %pF @ %i\n", fn, trace_call.caller);
+ 		calltime = ktime_get();
+-		trace_boot_call(&call, fn);
++		trace_boot_call(&trace_call, fn);
+ 		enable_boot_trace();
+ 	}
+ 
+-	ret.result = fn();
++	trace_ret.result = fn();
+ 
+ 	if (initcall_debug) {
+ 		disable_boot_trace();
+ 		rettime = ktime_get();
+ 		delta = ktime_sub(rettime, calltime);
+-		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
+-		trace_boot_ret(&ret, fn);
++		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
++		trace_boot_ret(&trace_ret, fn);
+ 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
+-			ret.result, ret.duration);
++			trace_ret.result, trace_ret.duration);
+ 	}
+ 
+ 	msgbuf[0] = 0;
+ 
+-	if (ret.result && ret.result != -ENODEV && initcall_debug)
+-		sprintf(msgbuf, "error code %d ", ret.result);
++	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
++		sprintf(msgbuf, "error code %d ", trace_ret.result);
+ 
+ 	if (preempt_count() != count) {
+-		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
++		msg1 = " preemption imbalance";
+ 		preempt_count() = count;
+ 	}
+ 	if (irqs_disabled()) {
+-		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
++		msg2 = " disabled interrupts";
+ 		local_irq_enable();
+ 	}
+-	if (msgbuf[0]) {
+-		printk("initcall %pF returned with %s\n", fn, msgbuf);
++	if (msgbuf[0] || *msg1 || *msg2) {
++		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
+ 	}
+ 
+-	return ret.result;
++	return trace_ret.result;
+ }
+ 
+ 
+@@ -881,11 +927,13 @@ static int __init kernel_init(void * unu
+ 	if (!ramdisk_execute_command)
+ 		ramdisk_execute_command = "/init";
+ 
+-	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
++	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
+ 		ramdisk_execute_command = NULL;
+ 		prepare_namespace();
+ 	}
+ 
++	grsecurity_init();
++
+ 	/*
+ 	 * Ok, we have completed the initial bootup, and
+ 	 * we're essentially up and running. Get rid of the
+diff -urNp linux-2.6.32.14/init/noinitramfs.c linux-2.6.32.14/init/noinitramfs.c
+--- linux-2.6.32.14/init/noinitramfs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/init/noinitramfs.c	2010-05-28 21:27:16.427051097 -0400
+@@ -29,7 +29,7 @@ static int __init default_rootfs(void)
+ {
+ 	int err;
+ 
+-	err = sys_mkdir("/dev", 0755);
++	err = sys_mkdir((const char __user *)"/dev", 0755);
+ 	if (err < 0)
+ 		goto out;
+ 
+@@ -39,7 +39,7 @@ static int __init default_rootfs(void)
+ 	if (err < 0)
+ 		goto out;
+ 
+-	err = sys_mkdir("/root", 0700);
++	err = sys_mkdir((const char __user *)"/root", 0700);
+ 	if (err < 0)
+ 		goto out;
+ 
+diff -urNp linux-2.6.32.14/ipc/ipc_sysctl.c linux-2.6.32.14/ipc/ipc_sysctl.c
+--- linux-2.6.32.14/ipc/ipc_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/ipc/ipc_sysctl.c	2010-05-28 21:27:16.427051097 -0400
+@@ -267,7 +267,7 @@ static struct ctl_table ipc_kern_table[]
+ 		.extra1		= &zero,
+ 		.extra2		= &one,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table ipc_root_table[] = {
+@@ -277,7 +277,7 @@ static struct ctl_table ipc_root_table[]
+ 		.mode		= 0555,
+ 		.child		= ipc_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init ipc_sysctl_init(void)
+diff -urNp linux-2.6.32.14/ipc/mqueue.c linux-2.6.32.14/ipc/mqueue.c
+--- linux-2.6.32.14/ipc/mqueue.c	2010-04-04 20:41:50.060586306 -0400
++++ linux-2.6.32.14/ipc/mqueue.c	2010-05-28 21:27:16.431938706 -0400
+@@ -150,6 +150,7 @@ static struct inode *mqueue_get_inode(st
+ 			mq_bytes = (mq_msg_tblsz +
+ 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
+ 
++			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
+ 			spin_lock(&mq_lock);
+ 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
+ 		 	    u->mq_bytes + mq_bytes >
+diff -urNp linux-2.6.32.14/ipc/shm.c linux-2.6.32.14/ipc/shm.c
+--- linux-2.6.32.14/ipc/shm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/ipc/shm.c	2010-05-28 21:27:16.431938706 -0400
+@@ -70,6 +70,14 @@ static void shm_destroy (struct ipc_name
+ static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
+ #endif
+ 
++#ifdef CONFIG_GRKERNSEC
++extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime, const uid_t cuid,
++			   const int shmid);
++extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
++			   const time_t shm_createtime);
++#endif
++
+ void shm_init_ns(struct ipc_namespace *ns)
+ {
+ 	ns->shm_ctlmax = SHMMAX;
+@@ -396,6 +404,14 @@ static int newseg(struct ipc_namespace *
+ 	shp->shm_lprid = 0;
+ 	shp->shm_atim = shp->shm_dtim = 0;
+ 	shp->shm_ctim = get_seconds();
++#ifdef CONFIG_GRKERNSEC
++	{
++		struct timespec timeval;
++		do_posix_clock_monotonic_gettime(&timeval);
++
++		shp->shm_createtime = timeval.tv_sec;
++	}
++#endif
+ 	shp->shm_segsz = size;
+ 	shp->shm_nattch = 0;
+ 	shp->shm_file = file;
+@@ -879,9 +895,21 @@ long do_shmat(int shmid, char __user *sh
+ 	if (err)
+ 		goto out_unlock;
+ 
++#ifdef CONFIG_GRKERNSEC
++	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
++			     shp->shm_perm.cuid, shmid) ||
++	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
++		err = -EACCES;
++		goto out_unlock;
++	}
++#endif
++
+ 	path.dentry = dget(shp->shm_file->f_path.dentry);
+ 	path.mnt    = shp->shm_file->f_path.mnt;
+ 	shp->shm_nattch++;
++#ifdef CONFIG_GRKERNSEC
++	shp->shm_lapid = current->pid;
++#endif
+ 	size = i_size_read(path.dentry->d_inode);
+ 	shm_unlock(shp);
+ 
+diff -urNp linux-2.6.32.14/kernel/acct.c linux-2.6.32.14/kernel/acct.c
+--- linux-2.6.32.14/kernel/acct.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/acct.c	2010-05-28 21:27:16.431938706 -0400
+@@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
+ 	 */
+ 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
+-	file->f_op->write(file, (char *)&ac,
++	file->f_op->write(file, (__force char __user *)&ac,
+ 			       sizeof(acct_t), &file->f_pos);
+ 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
+ 	set_fs(fs);
+diff -urNp linux-2.6.32.14/kernel/capability.c linux-2.6.32.14/kernel/capability.c
+--- linux-2.6.32.14/kernel/capability.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/capability.c	2010-05-28 21:27:16.431938706 -0400
+@@ -306,10 +306,21 @@ int capable(int cap)
+ 		BUG();
+ 	}
+ 
+-	if (security_capable(cap) == 0) {
++	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
+ 		current->flags |= PF_SUPERPRIV;
+ 		return 1;
+ 	}
+ 	return 0;
+ }
++
++int capable_nolog(int cap)
++{
++	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
++		current->flags |= PF_SUPERPRIV;
++		return 1;
++	}
++	return 0;
++}
++
+ EXPORT_SYMBOL(capable);
++EXPORT_SYMBOL(capable_nolog);
+diff -urNp linux-2.6.32.14/kernel/configs.c linux-2.6.32.14/kernel/configs.c
+--- linux-2.6.32.14/kernel/configs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/configs.c	2010-05-28 21:27:16.431938706 -0400
+@@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
+ 	struct proc_dir_entry *entry;
+ 
+ 	/* create the current config file */
++#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
++#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
++			    &ikconfig_file_ops);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
++			    &ikconfig_file_ops);
++#endif
++#else
+ 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+ 			    &ikconfig_file_ops);
++#endif
++
+ 	if (!entry)
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.14/kernel/cpu.c linux-2.6.32.14/kernel/cpu.c
+--- linux-2.6.32.14/kernel/cpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/cpu.c	2010-05-28 21:27:16.431938706 -0400
+@@ -19,7 +19,7 @@
+ /* Serializes the updates to cpu_online_mask, cpu_present_mask */
+ static DEFINE_MUTEX(cpu_add_remove_lock);
+ 
+-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
++static RAW_NOTIFIER_HEAD(cpu_chain);
+ 
+ /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
+  * Should always be manipulated under cpu_add_remove_lock
+diff -urNp linux-2.6.32.14/kernel/cred.c linux-2.6.32.14/kernel/cred.c
+--- linux-2.6.32.14/kernel/cred.c	2010-05-15 13:20:19.362999772 -0400
++++ linux-2.6.32.14/kernel/cred.c	2010-05-28 21:27:16.431938706 -0400
+@@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
+ 
+ 	get_cred(new); /* we will require a ref for the subj creds too */
+ 
++	gr_set_role_label(task, new->uid, new->gid);
++
+ 	/* dumpability changes */
+ 	if (old->euid != new->euid ||
+ 	    old->egid != new->egid ||
+diff -urNp linux-2.6.32.14/kernel/exit.c linux-2.6.32.14/kernel/exit.c
+--- linux-2.6.32.14/kernel/exit.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/exit.c	2010-05-28 21:27:16.431938706 -0400
+@@ -56,6 +56,10 @@
+ #include <asm/mmu_context.h>
+ #include "cred-internals.h"
+ 
++#ifdef CONFIG_GRKERNSEC
++extern rwlock_t grsec_exec_file_lock;
++#endif
++
+ static void exit_mm(struct task_struct * tsk);
+ 
+ static void __unhash_process(struct task_struct *p)
+@@ -167,6 +171,8 @@ void release_task(struct task_struct * p
+ 	struct task_struct *leader;
+ 	int zap_leader;
+ repeat:
++	gr_del_task_from_ip_table(p);
++
+ 	tracehook_prepare_release_task(p);
+ 	/* don't need to get the RCU readlock here - the process is dead and
+ 	 * can't be modifying its own credentials */
+@@ -334,11 +340,22 @@ static void reparent_to_kthreadd(void)
+ {
+ 	write_lock_irq(&tasklist_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
+ 	ptrace_unlink(current);
+ 	/* Reparent to init */
+ 	current->real_parent = current->parent = kthreadd_task;
+ 	list_move_tail(&current->sibling, &current->real_parent->children);
+ 
++	gr_set_kernel_label(current);
++
+ 	/* Set the exit signal to SIGCHLD so we signal init on exit */
+ 	current->exit_signal = SIGCHLD;
+ 
+@@ -390,7 +407,7 @@ int allow_signal(int sig)
+ 	 * know it'll be handled, so that they don't get converted to
+ 	 * SIGKILL or just silently dropped.
+ 	 */
+-	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
++	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
+ 	recalc_sigpending();
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 	return 0;
+@@ -426,6 +443,17 @@ void daemonize(const char *name, ...)
+ 	vsnprintf(current->comm, sizeof(current->comm), name, args);
+ 	va_end(args);
+ 
++#ifdef CONFIG_GRKERNSEC
++	write_lock(&grsec_exec_file_lock);
++	if (current->exec_file) {
++		fput(current->exec_file);
++		current->exec_file = NULL;
++	}
++	write_unlock(&grsec_exec_file_lock);
++#endif
++
++	gr_set_kernel_label(current);
++
+ 	/*
+ 	 * If we were started as result of loading a module, close all of the
+ 	 * user space pages.  We don't need them, and if we didn't close them
+@@ -957,6 +985,9 @@ NORET_TYPE void do_exit(long code)
+ 	tsk->exit_code = code;
+ 	taskstats_exit(tsk, group_dead);
+ 
++	gr_acl_handle_psacct(tsk, code);
++	gr_acl_handle_exit();
++
+ 	exit_mm(tsk);
+ 
+ 	if (group_dead)
+@@ -1172,7 +1203,7 @@ static int wait_task_zombie(struct wait_
+ 
+ 	if (unlikely(wo->wo_flags & WNOWAIT)) {
+ 		int exit_code = p->exit_code;
+-		int why, status;
++		int why;
+ 
+ 		get_task_struct(p);
+ 		read_unlock(&tasklist_lock);
+diff -urNp linux-2.6.32.14/kernel/fork.c linux-2.6.32.14/kernel/fork.c
+--- linux-2.6.32.14/kernel/fork.c	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/kernel/fork.c	2010-05-28 21:27:16.436716677 -0400
+@@ -253,7 +253,7 @@ static struct task_struct *dup_task_stru
+ 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
+ 
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-	tsk->stack_canary = get_random_int();
++	tsk->stack_canary = pax_get_random_long();
+ #endif
+ 
+ 	/* One for us, one for whoever does the "release_task()" (usually parent) */
+@@ -293,8 +293,8 @@ static int dup_mmap(struct mm_struct *mm
+ 	mm->locked_vm = 0;
+ 	mm->mmap = NULL;
+ 	mm->mmap_cache = NULL;
+-	mm->free_area_cache = oldmm->mmap_base;
+-	mm->cached_hole_size = ~0UL;
++	mm->free_area_cache = oldmm->free_area_cache;
++	mm->cached_hole_size = oldmm->cached_hole_size;
+ 	mm->map_count = 0;
+ 	cpumask_clear(mm_cpumask(mm));
+ 	mm->mm_rb = RB_ROOT;
+@@ -334,6 +334,7 @@ static int dup_mmap(struct mm_struct *mm
+ 		tmp->vm_flags &= ~VM_LOCKED;
+ 		tmp->vm_mm = mm;
+ 		tmp->vm_next = NULL;
++		tmp->vm_mirror = NULL;
+ 		anon_vma_link(tmp);
+ 		file = tmp->vm_file;
+ 		if (file) {
+@@ -381,6 +382,31 @@ static int dup_mmap(struct mm_struct *mm
+ 		if (retval)
+ 			goto out;
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
++		struct vm_area_struct *mpnt_m;
++
++		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
++			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
++
++			if (!mpnt->vm_mirror)
++				continue;
++
++			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
++				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
++				mpnt->vm_mirror = mpnt_m;
++			} else {
++				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
++				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
++				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
++				mpnt->vm_mirror->vm_mirror = mpnt;
++			}
++		}
++		BUG_ON(mpnt_m);
++	}
++#endif
++
+ 	/* a new mm has just been created */
+ 	arch_dup_mmap(oldmm, mm);
+ 	retval = 0;
+@@ -731,7 +757,7 @@ static int copy_fs(unsigned long clone_f
+ 			write_unlock(&fs->lock);
+ 			return -EAGAIN;
+ 		}
+-		fs->users++;
++		atomic_inc(&fs->users);
+ 		write_unlock(&fs->lock);
+ 		return 0;
+ 	}
+@@ -1027,10 +1053,13 @@ static struct task_struct *copy_process(
+ 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
+ #endif
+ 	retval = -EAGAIN;
++
++	gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
++
+ 	if (atomic_read(&p->real_cred->user->processes) >=
+ 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
+-		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
+-		    p->real_cred->user != INIT_USER)
++		if (p->real_cred->user != INIT_USER &&
++		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
+ 			goto bad_fork_free;
+ 	}
+ 
+@@ -1059,6 +1088,10 @@ static struct task_struct *copy_process(
+ 	p->vfork_done = NULL;
+ 	spin_lock_init(&p->alloc_lock);
+ 
++#ifdef CONFIG_GRKERNSEC
++	rwlock_init(&p->gr_fs_lock);
++#endif
++
+ 	init_sigpending(&p->pending);
+ 
+ 	p->utime = cputime_zero;
+@@ -1177,6 +1210,8 @@ static struct task_struct *copy_process(
+ 			goto bad_fork_free_pid;
+ 	}
+ 
++	gr_copy_label(p);
++
+ 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+ 	/*
+ 	 * Clear TID on mm_release()?
+@@ -1342,6 +1377,8 @@ bad_fork_cleanup_count:
+ bad_fork_free:
+ 	free_task(p);
+ fork_out:
++	gr_log_forkfail(retval);
++
+ 	return ERR_PTR(retval);
+ }
+ 
+@@ -1435,6 +1472,8 @@ long do_fork(unsigned long clone_flags,
+ 		if (clone_flags & CLONE_PARENT_SETTID)
+ 			put_user(nr, parent_tidptr);
+ 
++		gr_handle_brute_check();
++
+ 		if (clone_flags & CLONE_VFORK) {
+ 			p->vfork_done = &vfork;
+ 			init_completion(&vfork);
+@@ -1567,7 +1606,7 @@ static int unshare_fs(unsigned long unsh
+ 		return 0;
+ 
+ 	/* don't need lock here; in the worst case we'll do useless copy */
+-	if (fs->users == 1)
++	if (atomic_read(&fs->users) == 1)
+ 		return 0;
+ 
+ 	*new_fsp = copy_fs_struct(fs);
+@@ -1687,14 +1726,18 @@ SYSCALL_DEFINE1(unshare, unsigned long, 
+ 		task_lock(current);
+ 
+ 		if (new_fs) {
++			unsigned long flags;
++
++			gr_fs_write_lock_irqsave(current, flags);
+ 			fs = current->fs;
+ 			write_lock(&fs->lock);
+ 			current->fs = new_fs;
+-			if (--fs->users)
++			if (atomic_dec_return(&fs->users))
+ 				new_fs = NULL;
+ 			else
+ 				new_fs = fs;
+ 			write_unlock(&fs->lock);
++			gr_fs_write_unlock_irqrestore(current, flags);
+ 		}
+ 
+ 		if (new_mm) {
+diff -urNp linux-2.6.32.14/kernel/futex.c linux-2.6.32.14/kernel/futex.c
+--- linux-2.6.32.14/kernel/futex.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/futex.c	2010-05-28 21:27:16.439128347 -0400
+@@ -54,6 +54,7 @@
+ #include <linux/mount.h>
+ #include <linux/pagemap.h>
+ #include <linux/syscalls.h>
++#include <linux/ptrace.h>
+ #include <linux/signal.h>
+ #include <linux/module.h>
+ #include <linux/magic.h>
+@@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
+ 	struct page *page;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
++		return -EFAULT;
++#endif
++
+ 	/*
+ 	 * The futex address must be "naturally" aligned.
+ 	 */
+@@ -1852,7 +1858,7 @@ retry:
+ 
+ 	restart = &current_thread_info()->restart_block;
+ 	restart->fn = futex_wait_restart;
+-	restart->futex.uaddr = (u32 *)uaddr;
++	restart->futex.uaddr = uaddr;
+ 	restart->futex.val = val;
+ 	restart->futex.time = abs_time->tv64;
+ 	restart->futex.bitset = bitset;
+@@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ {
+ 	struct robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *cred = current_cred();
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->robust_list;
+ 		rcu_read_unlock();
+ 	}
+@@ -2467,7 +2481,7 @@ retry:
+  */
+ static inline int fetch_robust_entry(struct robust_list __user **entry,
+ 				     struct robust_list __user * __user *head,
+-				     int *pi)
++				     unsigned int *pi)
+ {
+ 	unsigned long uentry;
+ 
+diff -urNp linux-2.6.32.14/kernel/futex_compat.c linux-2.6.32.14/kernel/futex_compat.c
+--- linux-2.6.32.14/kernel/futex_compat.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/futex_compat.c	2010-05-28 21:27:16.439128347 -0400
+@@ -10,6 +10,7 @@
+ #include <linux/compat.h>
+ #include <linux/nsproxy.h>
+ #include <linux/futex.h>
++#include <linux/ptrace.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
+ {
+ 	struct compat_robust_list_head __user *head;
+ 	unsigned long ret;
+-	const struct cred *cred = current_cred(), *pcred;
++	const struct cred *cred = current_cred();
++#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
++	const struct cred *pcred;
++#endif
+ 
+ 	if (!futex_cmpxchg_enabled)
+ 		return -ENOSYS;
+@@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
+ 		if (!p)
+ 			goto err_unlock;
+ 		ret = -EPERM;
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++		if (!ptrace_may_access(p, PTRACE_MODE_READ))
++			goto err_unlock;
++#else
+ 		pcred = __task_cred(p);
+ 		if (cred->euid != pcred->euid &&
+ 		    cred->euid != pcred->uid &&
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
++#endif
+ 		head = p->compat_robust_list;
+ 		read_unlock(&tasklist_lock);
+ 	}
+diff -urNp linux-2.6.32.14/kernel/gcov/base.c linux-2.6.32.14/kernel/gcov/base.c
+--- linux-2.6.32.14/kernel/gcov/base.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/gcov/base.c	2010-05-28 21:27:16.439128347 -0400
+@@ -102,11 +102,6 @@ void gcov_enable_events(void)
+ }
+ 
+ #ifdef CONFIG_MODULES
+-static inline int within(void *addr, void *start, unsigned long size)
+-{
+-	return ((addr >= start) && (addr < start + size));
+-}
+-
+ /* Update list and generate events when modules are unloaded. */
+ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
+ 				void *data)
+@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
+ 	prev = NULL;
+ 	/* Remove entries located in module from linked list. */
+ 	for (info = gcov_info_head; info; info = info->next) {
+-		if (within(info, mod->module_core, mod->core_size)) {
++		if (within_module_core_rw((unsigned long)info, mod)) {
+ 			if (prev)
+ 				prev->next = info->next;
+ 			else
+diff -urNp linux-2.6.32.14/kernel/hrtimer.c linux-2.6.32.14/kernel/hrtimer.c
+--- linux-2.6.32.14/kernel/hrtimer.c	2010-04-04 20:41:50.064534828 -0400
++++ linux-2.6.32.14/kernel/hrtimer.c	2010-05-28 21:27:16.439128347 -0400
+@@ -1382,7 +1382,7 @@ void hrtimer_peek_ahead_timers(void)
+ 	local_irq_restore(flags);
+ }
+ 
+-static void run_hrtimer_softirq(struct softirq_action *h)
++static void run_hrtimer_softirq(void)
+ {
+ 	hrtimer_peek_ahead_timers();
+ }
+diff -urNp linux-2.6.32.14/kernel/kallsyms.c linux-2.6.32.14/kernel/kallsyms.c
+--- linux-2.6.32.14/kernel/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/kallsyms.c	2010-05-28 21:27:16.439128347 -0400
+@@ -11,6 +11,9 @@
+  *      Changed the compression method from stem compression to "table lookup"
+  *      compression (see scripts/kallsyms.c for a more complete description)
+  */
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++#define __INCLUDED_BY_HIDESYM 1
++#endif
+ #include <linux/kallsyms.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
+ 
+ static inline int is_kernel_inittext(unsigned long addr)
+ {
++	if (system_state != SYSTEM_BOOTING)
++		return 0;
++
+ 	if (addr >= (unsigned long)_sinittext
+ 	    && addr <= (unsigned long)_einittext)
+ 		return 1;
+@@ -67,6 +73,26 @@ static inline int is_kernel_text(unsigne
+ 
+ static inline int is_kernel(unsigned long addr)
+ {
++	if (is_kernel_inittext(addr))
++		return 1;
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++#ifdef CONFIG_MODULES
++	if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
++		return 0;
++#endif
++
++	if (is_kernel_text(addr))
++		return 1;
++
++	if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
++		return 1;
++
++	if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
++		return 1;
++	return in_gate_area_no_task(addr);
++#endif
++
+ 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+ 		return 1;
+ 	return in_gate_area_no_task(addr);
+@@ -413,7 +439,6 @@ static unsigned long get_ksymbol_core(st
+ 
+ static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
+ {
+-	iter->name[0] = '\0';
+ 	iter->nameoff = get_symbol_offset(new_pos);
+ 	iter->pos = new_pos;
+ }
+@@ -461,6 +486,11 @@ static int s_show(struct seq_file *m, vo
+ {
+ 	struct kallsym_iter *iter = m->private;
+ 
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	if (current_uid())
++		return 0;
++#endif
++
+ 	/* Some debugging symbols have no name.  Ignore them. */
+ 	if (!iter->name[0])
+ 		return 0;
+@@ -501,7 +531,7 @@ static int kallsyms_open(struct inode *i
+ 	struct kallsym_iter *iter;
+ 	int ret;
+ 
+-	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
++	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
+ 	if (!iter)
+ 		return -ENOMEM;
+ 	reset_iter(iter, 0);
+diff -urNp linux-2.6.32.14/kernel/kgdb.c linux-2.6.32.14/kernel/kgdb.c
+--- linux-2.6.32.14/kernel/kgdb.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/kgdb.c	2010-05-28 21:27:16.439128347 -0400
+@@ -86,7 +86,7 @@ static int			kgdb_io_module_registered;
+ /* Guard for recursive entry */
+ static int			exception_level;
+ 
+-static struct kgdb_io		*kgdb_io_ops;
++static const struct kgdb_io	*kgdb_io_ops;
+ static DEFINE_SPINLOCK(kgdb_registration_lock);
+ 
+ /* kgdb console driver is loaded */
+@@ -1637,7 +1637,7 @@ static void kgdb_initial_breakpoint(void
+  *
+  *	Register it with the KGDB core.
+  */
+-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
++int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
+ {
+ 	int err;
+ 
+@@ -1682,7 +1682,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
+  *
+  *	Unregister it with the KGDB core.
+  */
+-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
++void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
+ {
+ 	BUG_ON(kgdb_connected);
+ 
+diff -urNp linux-2.6.32.14/kernel/kmod.c linux-2.6.32.14/kernel/kmod.c
+--- linux-2.6.32.14/kernel/kmod.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/kmod.c	2010-05-28 21:27:16.439128347 -0400
+@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
+ 	if (ret >= MODULE_NAME_LEN)
+ 		return -ENAMETOOLONG;
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	/* we could do a tighter check here, but some distros
++	   are taking it upon themselves to remove CAP_SYS_MODULE
++	   from even root-running apps which cause modules to be 
++	   auto-loaded
++	*/
++	if (current_uid()) {
++		gr_log_nonroot_mod_load(module_name);
++		return -EPERM;
++	}
++#endif
++
+ 	/* If modprobe needs a service that is in a module, we get a recursive
+ 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
+ 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
+diff -urNp linux-2.6.32.14/kernel/kprobes.c linux-2.6.32.14/kernel/kprobes.c
+--- linux-2.6.32.14/kernel/kprobes.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/kprobes.c	2010-05-28 21:27:16.439128347 -0400
+@@ -183,7 +183,7 @@ static kprobe_opcode_t __kprobes *__get_
+ 	 * kernel image and loaded module images reside. This is required
+ 	 * so x86_64 can correctly handle the %rip-relative fixups.
+ 	 */
+-	kip->insns = module_alloc(PAGE_SIZE);
++	kip->insns = module_alloc_exec(PAGE_SIZE);
+ 	if (!kip->insns) {
+ 		kfree(kip);
+ 		return NULL;
+@@ -220,7 +220,7 @@ static int __kprobes collect_one_slot(st
+ 		 */
+ 		if (!list_is_singular(&kprobe_insn_pages)) {
+ 			list_del(&kip->list);
+-			module_free(NULL, kip->insns);
++			module_free_exec(NULL, kip->insns);
+ 			kfree(kip);
+ 		}
+ 		return 1;
+@@ -1189,7 +1189,7 @@ static int __init init_kprobes(void)
+ {
+ 	int i, err = 0;
+ 	unsigned long offset = 0, size = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 	const char *symbol_name;
+ 	void *addr;
+ 	struct kprobe_blackpoint *kb;
+@@ -1304,7 +1304,7 @@ static int __kprobes show_kprobe_addr(st
+ 	const char *sym = NULL;
+ 	unsigned int i = *(loff_t *) v;
+ 	unsigned long offset = 0;
+-	char *modname, namebuf[128];
++	char *modname, namebuf[KSYM_NAME_LEN];
+ 
+ 	head = &kprobe_table[i];
+ 	preempt_disable();
+diff -urNp linux-2.6.32.14/kernel/lockdep.c linux-2.6.32.14/kernel/lockdep.c
+--- linux-2.6.32.14/kernel/lockdep.c	2010-04-29 17:49:38.578001941 -0400
++++ linux-2.6.32.14/kernel/lockdep.c	2010-05-28 21:27:16.439128347 -0400
+@@ -577,6 +577,10 @@ static int static_obj(void *obj)
+ 	int i;
+ #endif
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	start = ktla_ktva(start);
++#endif
++
+ 	/*
+ 	 * static variable?
+ 	 */
+@@ -592,8 +596,7 @@ static int static_obj(void *obj)
+ 	 */
+ 	for_each_possible_cpu(i) {
+ 		start = (unsigned long) per_cpu_ptr(&__per_cpu_start, i);
+-		end   = (unsigned long) per_cpu_ptr(&__per_cpu_start, i)
+-					+ PERCPU_ENOUGH_ROOM;
++		end   = start + PERCPU_ENOUGH_ROOM;
+ 
+ 		if ((addr >= start) && (addr < end))
+ 			return 1;
+@@ -710,6 +713,7 @@ register_lock_class(struct lockdep_map *
+ 	if (!static_obj(lock->key)) {
+ 		debug_locks_off();
+ 		printk("INFO: trying to register non-static key.\n");
++		printk("lock:%pS key:%pS.\n", lock, lock->key);
+ 		printk("the code is fine but needs lockdep annotation.\n");
+ 		printk("turning off the locking correctness validator.\n");
+ 		dump_stack();
+diff -urNp linux-2.6.32.14/kernel/lockdep_proc.c linux-2.6.32.14/kernel/lockdep_proc.c
+--- linux-2.6.32.14/kernel/lockdep_proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/lockdep_proc.c	2010-05-28 21:27:16.439128347 -0400
+@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
+ 
+ static void print_name(struct seq_file *m, struct lock_class *class)
+ {
+-	char str[128];
++	char str[KSYM_NAME_LEN];
+ 	const char *name = class->name;
+ 
+ 	if (!name) {
+diff -urNp linux-2.6.32.14/kernel/module.c linux-2.6.32.14/kernel/module.c
+--- linux-2.6.32.14/kernel/module.c	2010-04-29 17:49:38.586002480 -0400
++++ linux-2.6.32.14/kernel/module.c	2010-05-28 21:27:16.439128347 -0400
+@@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
+ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
+ 
+ /* Bounds of module allocation, for speeding __module_address */
+-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
++static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
++static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
+ 
+ int register_module_notifier(struct notifier_block * nb)
+ {
+@@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
+ 		return true;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list) {
+-		struct symsearch arr[] = {
++		struct symsearch modarr[] = {
+ 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ 			  NOT_GPL_ONLY, false },
+ 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
+@@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
+ #endif
+ 		};
+ 
+-		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
++		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
+ 			return true;
+ 	}
+ 	return false;
+@@ -442,7 +443,7 @@ static void *percpu_modalloc(unsigned lo
+ 	void *ptr;
+ 	int cpu;
+ 
+-	if (align > PAGE_SIZE) {
++	if (align-1 >= PAGE_SIZE) {
+ 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
+ 		       name, align, PAGE_SIZE);
+ 		align = PAGE_SIZE;
+@@ -1543,7 +1544,8 @@ static void free_module(struct module *m
+ 	destroy_params(mod->kp, mod->num_kp);
+ 
+ 	/* This may be NULL, but that's OK */
+-	module_free(mod, mod->module_init);
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
+ 	kfree(mod->args);
+ 	if (mod->percpu)
+ 		percpu_modfree(mod->percpu);
+@@ -1552,10 +1554,12 @@ static void free_module(struct module *m
+ 		percpu_modfree(mod->refptr);
+ #endif
+ 	/* Free lock-classes: */
+-	lockdep_free_key_range(mod->module_core, mod->core_size);
++	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
++	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
+ 
+ 	/* Finally, free the core (containing the module structure) */
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_core_rx);
++	module_free(mod, mod->module_core_rw);
+ 
+ #ifdef CONFIG_MPU
+ 	update_protections(current->mm);
+@@ -1649,7 +1653,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 					      strtab + sym[i].st_name, mod);
+ 			/* Ok if resolved.  */
+ 			if (ksym) {
++				pax_open_kernel();
+ 				sym[i].st_value = ksym->value;
++				pax_close_kernel();
+ 				break;
+ 			}
+ 
+@@ -1668,7 +1674,9 @@ static int simplify_symbols(Elf_Shdr *se
+ 				secbase = (unsigned long)mod->percpu;
+ 			else
+ 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
++			pax_open_kernel();
+ 			sym[i].st_value += secbase;
++			pax_close_kernel();
+ 			break;
+ 		}
+ 	}
+@@ -1729,11 +1737,12 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->core_text_size = mod->core_size;
+ 	}
+ 
+ 	DEBUGP("Init section allocation order:\n");
+@@ -1746,12 +1755,13 @@ static void layout_sections(struct modul
+ 			    || s->sh_entsize != ~0UL
+ 			    || !strstarts(secstrings + s->sh_name, ".init"))
+ 				continue;
+-			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
+-					 | INIT_OFFSET_MASK);
++			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
++				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
++			else
++				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
++			s->sh_entsize |= INIT_OFFSET_MASK;
+ 			DEBUGP("\t%s\n", secstrings + s->sh_name);
+ 		}
+-		if (m == 0)
+-			mod->init_text_size = mod->init_size;
+ 	}
+ }
+ 
+@@ -1855,9 +1865,8 @@ static int is_exported(const char *name,
+ 
+ /* As per nm */
+ static char elf_type(const Elf_Sym *sym,
+-		     Elf_Shdr *sechdrs,
+-		     const char *secstrings,
+-		     struct module *mod)
++		     const Elf_Shdr *sechdrs,
++		     const char *secstrings)
+ {
+ 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
+@@ -1932,7 +1941,7 @@ static unsigned long layout_symtab(struc
+ 
+ 	/* Put symbol section at end of init part of module. */
+ 	symsect->sh_flags |= SHF_ALLOC;
+-	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
++	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
+ 					 symindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
+ 
+@@ -1949,19 +1958,19 @@ static unsigned long layout_symtab(struc
+ 		}
+ 
+ 	/* Append room for core symbols at end of core part. */
+-	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
+-	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
++	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
++	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
+ 
+ 	/* Put string table section at end of init part of module. */
+ 	strsect->sh_flags |= SHF_ALLOC;
+-	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
++	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
+ 					 strindex) | INIT_OFFSET_MASK;
+ 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
+ 
+ 	/* Append room for core symbols' strings at end of core part. */
+-	*pstroffs = mod->core_size;
++	*pstroffs = mod->core_size_rx;
+ 	__set_bit(0, strmap);
+-	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
++	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
+ 
+ 	return symoffs;
+ }
+@@ -1985,12 +1994,14 @@ static void add_kallsyms(struct module *
+ 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
+ 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
+ 
++	pax_open_kernel();
++
+ 	/* Set types up while we still have access to sections. */
+ 	for (i = 0; i < mod->num_symtab; i++)
+ 		mod->symtab[i].st_info
+-			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
++			= elf_type(&mod->symtab[i], sechdrs, secstrings);
+ 
+-	mod->core_symtab = dst = mod->module_core + symoffs;
++	mod->core_symtab = dst = mod->module_core_rx + symoffs;
+ 	src = mod->symtab;
+ 	*dst = *src;
+ 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
+@@ -2002,10 +2013,12 @@ static void add_kallsyms(struct module *
+ 	}
+ 	mod->core_num_syms = ndst;
+ 
+-	mod->core_strtab = s = mod->module_core + stroffs;
++	mod->core_strtab = s = mod->module_core_rx + stroffs;
+ 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
+ 		if (test_bit(i, strmap))
+ 			*++s = mod->strtab[i];
++
++	pax_close_kernel();
+ }
+ #else
+ static inline unsigned long layout_symtab(struct module *mod,
+@@ -2042,16 +2055,30 @@ static void dynamic_debug_setup(struct _
+ #endif
+ }
+ 
+-static void *module_alloc_update_bounds(unsigned long size)
++static void *module_alloc_update_bounds_rw(unsigned long size)
+ {
+ 	void *ret = module_alloc(size);
+ 
+ 	if (ret) {
+ 		/* Update module bounds. */
+-		if ((unsigned long)ret < module_addr_min)
+-			module_addr_min = (unsigned long)ret;
+-		if ((unsigned long)ret + size > module_addr_max)
+-			module_addr_max = (unsigned long)ret + size;
++		if ((unsigned long)ret < module_addr_min_rw)
++			module_addr_min_rw = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rw)
++			module_addr_max_rw = (unsigned long)ret + size;
++	}
++	return ret;
++}
++
++static void *module_alloc_update_bounds_rx(unsigned long size)
++{
++	void *ret = module_alloc_exec(size);
++
++	if (ret) {
++		/* Update module bounds. */
++		if ((unsigned long)ret < module_addr_min_rx)
++			module_addr_min_rx = (unsigned long)ret;
++		if ((unsigned long)ret + size > module_addr_max_rx)
++			module_addr_max_rx = (unsigned long)ret + size;
+ 	}
+ 	return ret;
+ }
+@@ -2063,8 +2090,8 @@ static void kmemleak_load_module(struct 
+ 	unsigned int i;
+ 
+ 	/* only scan the sections containing data */
+-	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
+-			   (unsigned long)mod->module_core,
++	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
++			   (unsigned long)mod->module_core_rw,
+ 			   sizeof(struct module), GFP_KERNEL);
+ 
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+@@ -2074,8 +2101,8 @@ static void kmemleak_load_module(struct 
+ 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
+ 			continue;
+ 
+-		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
+-				   (unsigned long)mod->module_core,
++		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
++				   (unsigned long)mod->module_core_rw,
+ 				   sechdrs[i].sh_size, GFP_KERNEL);
+ 	}
+ }
+@@ -2261,7 +2288,7 @@ static noinline struct module *load_modu
+ 				secstrings, &stroffs, strmap);
+ 
+ 	/* Do the allocs. */
+-	ptr = module_alloc_update_bounds(mod->core_size);
++	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. Just mark it as not being a
+@@ -2272,23 +2299,47 @@ static noinline struct module *load_modu
+ 		err = -ENOMEM;
+ 		goto free_percpu;
+ 	}
+-	memset(ptr, 0, mod->core_size);
+-	mod->module_core = ptr;
++	memset(ptr, 0, mod->core_size_rw);
++	mod->module_core_rw = ptr;
+ 
+-	ptr = module_alloc_update_bounds(mod->init_size);
++	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
+ 	/*
+ 	 * The pointer to this block is stored in the module structure
+ 	 * which is inside the block. This block doesn't need to be
+ 	 * scanned as it contains data and code that will be freed
+ 	 * after the module is initialized.
+ 	 */
+-	kmemleak_ignore(ptr);
+-	if (!ptr && mod->init_size) {
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rw) {
++		err = -ENOMEM;
++		goto free_core_rw;
++	}
++	memset(ptr, 0, mod->init_size_rw);
++	mod->module_init_rw = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr) {
+ 		err = -ENOMEM;
+-		goto free_core;
++		goto free_init_rw;
+ 	}
+-	memset(ptr, 0, mod->init_size);
+-	mod->module_init = ptr;
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->core_size_rx);
++	pax_close_kernel();
++	mod->module_core_rx = ptr;
++
++	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
++	kmemleak_not_leak(ptr);
++	if (!ptr && mod->init_size_rx) {
++		err = -ENOMEM;
++		goto free_core_rx;
++	}
++
++	pax_open_kernel();
++	memset(ptr, 0, mod->init_size_rx);
++	pax_close_kernel();
++	mod->module_init_rx = ptr;
+ 
+ 	/* Transfer each section which specifies SHF_ALLOC */
+ 	DEBUGP("final section addresses:\n");
+@@ -2298,17 +2349,41 @@ static noinline struct module *load_modu
+ 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+ 			continue;
+ 
+-		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
+-			dest = mod->module_init
+-				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+-		else
+-			dest = mod->module_core + sechdrs[i].sh_entsize;
++		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_init_rw
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++			else
++				dest = mod->module_init_rx
++					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
++		} else {
++			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
++				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
++			else
++				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
++		}
++
++		if (sechdrs[i].sh_type != SHT_NOBITS) {
++
++#ifdef CONFIG_PAX_KERNEXEC
++			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
++				pax_open_kernel();
++				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++				pax_close_kernel();
++			} else
++#endif
+ 
+-		if (sechdrs[i].sh_type != SHT_NOBITS)
+-			memcpy(dest, (void *)sechdrs[i].sh_addr,
+-			       sechdrs[i].sh_size);
++			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
++		}
+ 		/* Update sh_addr to point to copy in image. */
+-		sechdrs[i].sh_addr = (unsigned long)dest;
++
++#ifdef CONFIG_PAX_KERNEXEC
++		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
++			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
++		else
++#endif
++
++			sechdrs[i].sh_addr = (unsigned long)dest;
+ 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
+ 	}
+ 	/* Module has been moved. */
+@@ -2320,7 +2395,7 @@ static noinline struct module *load_modu
+ 				      mod->name);
+ 	if (!mod->refptr) {
+ 		err = -ENOMEM;
+-		goto free_init;
++		goto free_init_rx;
+ 	}
+ #endif
+ 	/* Now we've moved module, initialize linked lists, etc. */
+@@ -2429,8 +2504,8 @@ static noinline struct module *load_modu
+ 
+ 	/* Now do relocations. */
+ 	for (i = 1; i < hdr->e_shnum; i++) {
+-		const char *strtab = (char *)sechdrs[strindex].sh_addr;
+ 		unsigned int info = sechdrs[i].sh_info;
++		strtab = (char *)sechdrs[strindex].sh_addr;
+ 
+ 		/* Not a valid relocation section? */
+ 		if (info >= hdr->e_shnum)
+@@ -2491,12 +2566,12 @@ static noinline struct module *load_modu
+ 	 * Do it before processing of module parameters, so the module
+ 	 * can provide parameter accessor functions of its own.
+ 	 */
+-	if (mod->module_init)
+-		flush_icache_range((unsigned long)mod->module_init,
+-				   (unsigned long)mod->module_init
+-				   + mod->init_size);
+-	flush_icache_range((unsigned long)mod->module_core,
+-			   (unsigned long)mod->module_core + mod->core_size);
++	if (mod->module_init_rx)
++		flush_icache_range((unsigned long)mod->module_init_rx,
++				   (unsigned long)mod->module_init_rx
++				   + mod->init_size_rx);
++	flush_icache_range((unsigned long)mod->module_core_rx,
++			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
+ 
+ 	set_fs(old_fs);
+ 
+@@ -2544,12 +2619,16 @@ static noinline struct module *load_modu
+  free_unload:
+ 	module_unload_free(mod);
+ #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
++ free_init_rx:
+ 	percpu_modfree(mod->refptr);
+- free_init:
+ #endif
+-	module_free(mod, mod->module_init);
+- free_core:
+-	module_free(mod, mod->module_core);
++	module_free_exec(mod, mod->module_init_rx);
++ free_core_rx:
++	module_free_exec(mod, mod->module_core_rx);
++ free_init_rw:
++	module_free(mod, mod->module_init_rw);
++ free_core_rw:
++	module_free(mod, mod->module_core_rw);
+ 	/* mod will be freed with core. Don't access it beyond this line! */
+  free_percpu:
+ 	if (percpu)
+@@ -2651,10 +2730,12 @@ SYSCALL_DEFINE3(init_module, void __user
+ 	mod->symtab = mod->core_symtab;
+ 	mod->strtab = mod->core_strtab;
+ #endif
+-	module_free(mod, mod->module_init);
+-	mod->module_init = NULL;
+-	mod->init_size = 0;
+-	mod->init_text_size = 0;
++	module_free(mod, mod->module_init_rw);
++	module_free_exec(mod, mod->module_init_rx);
++	mod->module_init_rw = NULL;
++	mod->module_init_rx = NULL;
++	mod->init_size_rw = 0;
++	mod->init_size_rx = 0;
+ 	mutex_unlock(&module_mutex);
+ 
+ 	return 0;
+@@ -2685,10 +2766,16 @@ static const char *get_ksymbol(struct mo
+ 	unsigned long nextval;
+ 
+ 	/* At worse, next value is at end of module */
+-	if (within_module_init(addr, mod))
+-		nextval = (unsigned long)mod->module_init+mod->init_text_size;
++	if (within_module_init_rx(addr, mod))
++		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
++	else if (within_module_init_rw(addr, mod))
++		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
++	else if (within_module_core_rx(addr, mod))
++		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
++	else if (within_module_core_rw(addr, mod))
++		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
+ 	else
+-		nextval = (unsigned long)mod->module_core+mod->core_text_size;
++		return NULL;
+ 
+ 	/* Scan for closest preceeding symbol, and next symbol. (ELF
+ 	   starts real symbols at 1). */
+@@ -2934,7 +3021,7 @@ static int m_show(struct seq_file *m, vo
+ 	char buf[8];
+ 
+ 	seq_printf(m, "%s %u",
+-		   mod->name, mod->init_size + mod->core_size);
++		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
+ 	print_unload_info(m, mod);
+ 
+ 	/* Informative for users. */
+@@ -2943,7 +3030,7 @@ static int m_show(struct seq_file *m, vo
+ 		   mod->state == MODULE_STATE_COMING ? "Loading":
+ 		   "Live");
+ 	/* Used by oprofile and other similar tools. */
+-	seq_printf(m, " 0x%p", mod->module_core);
++	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
+ 
+ 	/* Taints info */
+ 	if (mod->taints)
+@@ -2979,7 +3066,17 @@ static const struct file_operations proc
+ 
+ static int __init proc_modules_init(void)
+ {
++#ifndef CONFIG_GRKERNSEC_HIDESYM
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
++#else
+ 	proc_create("modules", 0, NULL, &proc_modules_operations);
++#endif
++#else
++	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
++#endif
+ 	return 0;
+ }
+ module_init(proc_modules_init);
+@@ -3038,12 +3135,12 @@ struct module *__module_address(unsigned
+ {
+ 	struct module *mod;
+ 
+-	if (addr < module_addr_min || addr > module_addr_max)
++	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
++	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
+ 		return NULL;
+ 
+ 	list_for_each_entry_rcu(mod, &modules, list)
+-		if (within_module_core(addr, mod)
+-		    || within_module_init(addr, mod))
++		if (within_module_init(addr, mod) || within_module_core(addr, mod))
+ 			return mod;
+ 	return NULL;
+ }
+@@ -3077,11 +3174,20 @@ bool is_module_text_address(unsigned lon
+  */
+ struct module *__module_text_address(unsigned long addr)
+ {
+-	struct module *mod = __module_address(addr);
++	struct module *mod;
++
++#ifdef CONFIG_X86_32
++	addr = ktla_ktva(addr);
++#endif
++
++	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
++		return NULL;
++
++	mod = __module_address(addr);
++
+ 	if (mod) {
+ 		/* Make sure it's within the text section. */
+-		if (!within(addr, mod->module_init, mod->init_text_size)
+-		    && !within(addr, mod->module_core, mod->core_text_size))
++		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
+ 			mod = NULL;
+ 	}
+ 	return mod;
+diff -urNp linux-2.6.32.14/kernel/panic.c linux-2.6.32.14/kernel/panic.c
+--- linux-2.6.32.14/kernel/panic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/panic.c	2010-05-28 21:27:16.442904432 -0400
+@@ -392,7 +392,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
+  */
+ void __stack_chk_fail(void)
+ {
+-	panic("stack-protector: Kernel stack is corrupted in: %p\n",
++	dump_stack();
++	panic("stack-protector: Kernel stack is corrupted in: %pS\n",
+ 		__builtin_return_address(0));
+ }
+ EXPORT_SYMBOL(__stack_chk_fail);
+diff -urNp linux-2.6.32.14/kernel/params.c linux-2.6.32.14/kernel/params.c
+--- linux-2.6.32.14/kernel/params.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/params.c	2010-05-28 21:27:16.442904432 -0400
+@@ -725,7 +725,7 @@ static ssize_t module_attr_store(struct 
+ 	return ret;
+ }
+ 
+-static struct sysfs_ops module_sysfs_ops = {
++static const struct sysfs_ops module_sysfs_ops = {
+ 	.show = module_attr_show,
+ 	.store = module_attr_store,
+ };
+@@ -739,7 +739,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops module_uevent_ops = {
++static const struct kset_uevent_ops module_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+diff -urNp linux-2.6.32.14/kernel/pid.c linux-2.6.32.14/kernel/pid.c
+--- linux-2.6.32.14/kernel/pid.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/pid.c	2010-05-28 21:27:16.442904432 -0400
+@@ -33,6 +33,7 @@
+ #include <linux/rculist.h>
+ #include <linux/bootmem.h>
+ #include <linux/hash.h>
++#include <linux/security.h>
+ #include <linux/pid_namespace.h>
+ #include <linux/init_task.h>
+ #include <linux/syscalls.h>
+@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
+ 
+ int pid_max = PID_MAX_DEFAULT;
+ 
+-#define RESERVED_PIDS		300
++#define RESERVED_PIDS		500
+ 
+ int pid_max_min = RESERVED_PIDS + 1;
+ int pid_max_max = PID_MAX_LIMIT;
+@@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
+  */
+ struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
+ {
+-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++	struct task_struct *task;
++	
++	task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
++
++	if (gr_pid_is_chrooted(task))
++		return NULL;
++
++	return task;
+ }
+ 
+ struct task_struct *find_task_by_vpid(pid_t vnr)
+diff -urNp linux-2.6.32.14/kernel/posix-cpu-timers.c linux-2.6.32.14/kernel/posix-cpu-timers.c
+--- linux-2.6.32.14/kernel/posix-cpu-timers.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/posix-cpu-timers.c	2010-05-28 21:27:16.442904432 -0400
+@@ -6,6 +6,7 @@
+ #include <linux/posix-timers.h>
+ #include <linux/errno.h>
+ #include <linux/math64.h>
++#include <linux/security.h>
+ #include <asm/uaccess.h>
+ #include <linux/kernel_stat.h>
+ #include <trace/events/timer.h>
+@@ -1044,6 +1045,7 @@ static void check_thread_timers(struct t
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
+ 		if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+@@ -1206,6 +1208,7 @@ static void check_process_timers(struct 
+ 			__group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
+ 			return;
+ 		}
++		gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
+ 		if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
+ 			/*
+ 			 * At the soft limit, send a SIGXCPU every second.
+diff -urNp linux-2.6.32.14/kernel/power/hibernate.c linux-2.6.32.14/kernel/power/hibernate.c
+--- linux-2.6.32.14/kernel/power/hibernate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/power/hibernate.c	2010-05-28 21:27:16.442904432 -0400
+@@ -48,14 +48,14 @@ enum {
+ 
+ static int hibernation_mode = HIBERNATION_SHUTDOWN;
+ 
+-static struct platform_hibernation_ops *hibernation_ops;
++static const struct platform_hibernation_ops *hibernation_ops;
+ 
+ /**
+  * hibernation_set_ops - set the global hibernate operations
+  * @ops: the hibernation operations to use in subsequent hibernation transitions
+  */
+ 
+-void hibernation_set_ops(struct platform_hibernation_ops *ops)
++void hibernation_set_ops(const struct platform_hibernation_ops *ops)
+ {
+ 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
+ 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
+diff -urNp linux-2.6.32.14/kernel/power/poweroff.c linux-2.6.32.14/kernel/power/poweroff.c
+--- linux-2.6.32.14/kernel/power/poweroff.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/power/poweroff.c	2010-05-28 21:27:16.442904432 -0400
+@@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
+ 	.enable_mask	= SYSRQ_ENABLE_BOOT,
+ };
+ 
+-static int pm_sysrq_init(void)
++static int __init pm_sysrq_init(void)
+ {
+ 	register_sysrq_key('o', &sysrq_poweroff_op);
+ 	return 0;
+diff -urNp linux-2.6.32.14/kernel/power/process.c linux-2.6.32.14/kernel/power/process.c
+--- linux-2.6.32.14/kernel/power/process.c	2010-04-29 17:49:38.590000225 -0400
++++ linux-2.6.32.14/kernel/power/process.c	2010-05-28 21:27:16.442904432 -0400
+@@ -37,12 +37,15 @@ static int try_to_freeze_tasks(bool sig_
+ 	struct timeval start, end;
+ 	u64 elapsed_csecs64;
+ 	unsigned int elapsed_csecs;
++	bool timedout = false;
+ 
+ 	do_gettimeofday(&start);
+ 
+ 	end_time = jiffies + TIMEOUT;
+ 	do {
+ 		todo = 0;
++		if (time_after(jiffies, end_time))
++			timedout = true;
+ 		read_lock(&tasklist_lock);
+ 		do_each_thread(g, p) {
+ 			if (frozen(p) || !freezeable(p))
+@@ -57,15 +60,17 @@ static int try_to_freeze_tasks(bool sig_
+ 			 * It is "frozen enough".  If the task does wake
+ 			 * up, it will immediately call try_to_freeze.
+ 			 */
+-			if (!task_is_stopped_or_traced(p) &&
+-			    !freezer_should_skip(p))
++			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
+ 				todo++;
++				if (timedout) {
++					printk(KERN_ERR "Task refusing to freeze:\n");
++					sched_show_task(p);
++				}
++			}
+ 		} while_each_thread(g, p);
+ 		read_unlock(&tasklist_lock);
+ 		yield();			/* Yield is okay here */
+-		if (time_after(jiffies, end_time))
+-			break;
+-	} while (todo);
++	} while (todo && !timedout);
+ 
+ 	do_gettimeofday(&end);
+ 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
+diff -urNp linux-2.6.32.14/kernel/power/suspend.c linux-2.6.32.14/kernel/power/suspend.c
+--- linux-2.6.32.14/kernel/power/suspend.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/power/suspend.c	2010-05-28 21:27:16.442904432 -0400
+@@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
+ 	[PM_SUSPEND_MEM]	= "mem",
+ };
+ 
+-static struct platform_suspend_ops *suspend_ops;
++static const struct platform_suspend_ops *suspend_ops;
+ 
+ /**
+  *	suspend_set_ops - Set the global suspend method table.
+  *	@ops:	Pointer to ops structure.
+  */
+-void suspend_set_ops(struct platform_suspend_ops *ops)
++void suspend_set_ops(const struct platform_suspend_ops *ops)
+ {
+ 	mutex_lock(&pm_mutex);
+ 	suspend_ops = ops;
+diff -urNp linux-2.6.32.14/kernel/printk.c linux-2.6.32.14/kernel/printk.c
+--- linux-2.6.32.14/kernel/printk.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/printk.c	2010-05-28 21:27:16.442904432 -0400
+@@ -278,6 +278,11 @@ int do_syslog(int type, char __user *buf
+ 	char c;
+ 	int error = 0;
+ 
++#ifdef CONFIG_GRKERNSEC_DMESG
++	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
++		return -EPERM;
++#endif
++
+ 	error = security_syslog(type);
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.14/kernel/ptrace.c linux-2.6.32.14/kernel/ptrace.c
+--- linux-2.6.32.14/kernel/ptrace.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/ptrace.c	2010-05-28 21:27:16.442904432 -0400
+@@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
+ 	     cred->gid != tcred->egid ||
+ 	     cred->gid != tcred->sgid ||
+ 	     cred->gid != tcred->gid) &&
+-	    !capable(CAP_SYS_PTRACE)) {
++	    !capable_nolog(CAP_SYS_PTRACE)) {
+ 		rcu_read_unlock();
+ 		return -EPERM;
+ 	}
+@@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
+ 	smp_rmb();
+ 	if (task->mm)
+ 		dumpable = get_dumpable(task->mm);
+-	if (!dumpable && !capable(CAP_SYS_PTRACE))
++	if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
+ 		return -EPERM;
+ 
+ 	return security_ptrace_access_check(task, mode);
+@@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
+ 		goto unlock_tasklist;
+ 
+ 	task->ptrace = PT_PTRACED;
+-	if (capable(CAP_SYS_PTRACE))
++	if (capable_nolog(CAP_SYS_PTRACE))
+ 		task->ptrace |= PT_PTRACE_CAP;
+ 
+ 	__ptrace_link(task, current);
+@@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
+ 		ret = ptrace_setoptions(child, data);
+ 		break;
+ 	case PTRACE_GETEVENTMSG:
+-		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
++		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
+ 		break;
+ 
+ 	case PTRACE_GETSIGINFO:
+ 		ret = ptrace_getsiginfo(child, &siginfo);
+ 		if (!ret)
+-			ret = copy_siginfo_to_user((siginfo_t __user *) data,
++			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
+ 						   &siginfo);
+ 		break;
+ 
+ 	case PTRACE_SETSIGINFO:
+-		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
++		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
+ 				   sizeof siginfo))
+ 			ret = -EFAULT;
+ 		else
+@@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
+ 		goto out;
+ 	}
+ 
++	if (gr_handle_ptrace(child, request)) {
++		ret = -EPERM;
++		goto out_put_task_struct;
++	}
++
+ 	if (request == PTRACE_ATTACH) {
+ 		ret = ptrace_attach(child);
+ 		/*
+ 		 * Some architectures need to do book-keeping after
+ 		 * a ptrace attach.
+ 		 */
+-		if (!ret)
++		if (!ret) {
+ 			arch_ptrace_attach(child);
++			gr_audit_ptrace(child);
++		}
+ 		goto out_put_task_struct;
+ 	}
+ 
+@@ -653,7 +660,7 @@ int generic_ptrace_peekdata(struct task_
+ 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
+ 	if (copied != sizeof(tmp))
+ 		return -EIO;
+-	return put_user(tmp, (unsigned long __user *)data);
++	return put_user(tmp, (__force unsigned long __user *)data);
+ }
+ 
+ int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
+diff -urNp linux-2.6.32.14/kernel/rcutree.c linux-2.6.32.14/kernel/rcutree.c
+--- linux-2.6.32.14/kernel/rcutree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/rcutree.c	2010-05-28 21:27:16.442904432 -0400
+@@ -1303,7 +1303,7 @@ __rcu_process_callbacks(struct rcu_state
+ /*
+  * Do softirq processing for the current CPU.
+  */
+-static void rcu_process_callbacks(struct softirq_action *unused)
++static void rcu_process_callbacks(void)
+ {
+ 	/*
+ 	 * Memory references from any prior RCU read-side critical sections
+diff -urNp linux-2.6.32.14/kernel/relay.c linux-2.6.32.14/kernel/relay.c
+--- linux-2.6.32.14/kernel/relay.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/relay.c	2010-05-28 21:27:16.442904432 -0400
+@@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
+ 		return 0;
+ 
+ 	ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
+-	if (ret < 0 || ret < total_len)
++	if ((int)ret < 0 || ret < total_len)
+ 		return ret;
+ 
+         if (read_start + ret == nonpad_end)
+diff -urNp linux-2.6.32.14/kernel/resource.c linux-2.6.32.14/kernel/resource.c
+--- linux-2.6.32.14/kernel/resource.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/resource.c	2010-05-28 21:27:16.442904432 -0400
+@@ -132,8 +132,18 @@ static const struct file_operations proc
+ 
+ static int __init ioresources_init(void)
+ {
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++#ifdef CONFIG_GRKERNSEC_PROC_USER
++	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
++#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
++	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
++	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
++#endif
++#else
+ 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
+ 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
++#endif
+ 	return 0;
+ }
+ __initcall(ioresources_init);
+diff -urNp linux-2.6.32.14/kernel/sched.c linux-2.6.32.14/kernel/sched.c
+--- linux-2.6.32.14/kernel/sched.c	2010-04-29 17:49:38.609495328 -0400
++++ linux-2.6.32.14/kernel/sched.c	2010-05-28 21:27:16.447114196 -0400
+@@ -4841,7 +4841,7 @@ out:
+  * In CONFIG_NO_HZ case, the idle load balance owner will do the
+  * rebalancing for all the cpus for whom scheduler ticks are stopped.
+  */
+-static void run_rebalance_domains(struct softirq_action *h)
++static void run_rebalance_domains(void)
+ {
+ 	int this_cpu = smp_processor_id();
+ 	struct rq *this_rq = cpu_rq(this_cpu);
+@@ -6110,6 +6110,8 @@ int can_nice(const struct task_struct *p
+ 	/* convert nice value [19,-20] to rlimit style value [1,40] */
+ 	int nice_rlim = 20 - nice;
+ 
++	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
++
+ 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+ 		capable(CAP_SYS_NICE));
+ }
+@@ -6143,7 +6145,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+ 	if (nice > 19)
+ 		nice = 19;
+ 
+-	if (increment < 0 && !can_nice(current, nice))
++	if (increment < 0 && (!can_nice(current, nice) ||
++			      gr_handle_chroot_nice()))
+ 		return -EPERM;
+ 
+ 	retval = security_task_setnice(current, nice);
+@@ -6293,6 +6296,8 @@ recheck:
+ 		if (rt_policy(policy)) {
+ 			unsigned long rlim_rtprio;
+ 
++			gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
++
+ 			if (!lock_task_sighand(p, &flags))
+ 				return -ESRCH;
+ 			rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
+@@ -7452,7 +7457,7 @@ static struct ctl_table sd_ctl_dir[] = {
+ 		.procname	= "sched_domain",
+ 		.mode		= 0555,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table sd_ctl_root[] = {
+@@ -7462,7 +7467,7 @@ static struct ctl_table sd_ctl_root[] = 
+ 		.mode		= 0555,
+ 		.child		= sd_ctl_dir,
+ 	},
+-	{0, },
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table *sd_alloc_ctl_entry(int n)
+diff -urNp linux-2.6.32.14/kernel/signal.c linux-2.6.32.14/kernel/signal.c
+--- linux-2.6.32.14/kernel/signal.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/signal.c	2010-05-28 21:27:16.447114196 -0400
+@@ -41,12 +41,12 @@
+ 
+ static struct kmem_cache *sigqueue_cachep;
+ 
+-static void __user *sig_handler(struct task_struct *t, int sig)
++static __sighandler_t sig_handler(struct task_struct *t, int sig)
+ {
+ 	return t->sighand->action[sig - 1].sa.sa_handler;
+ }
+ 
+-static int sig_handler_ignored(void __user *handler, int sig)
++static int sig_handler_ignored(__sighandler_t handler, int sig)
+ {
+ 	/* Is it explicitly or implicitly ignored? */
+ 	return handler == SIG_IGN ||
+@@ -56,7 +56,7 @@ static int sig_handler_ignored(void __us
+ static int sig_task_ignored(struct task_struct *t, int sig,
+ 		int from_ancestor_ns)
+ {
+-	void __user *handler;
++	__sighandler_t handler;
+ 
+ 	handler = sig_handler(t, sig);
+ 
+@@ -207,6 +207,9 @@ static struct sigqueue *__sigqueue_alloc
+ 	 */
+ 	user = get_uid(__task_cred(t)->user);
+ 	atomic_inc(&user->sigpending);
++
++	if (!override_rlimit)
++		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
+ 	if (override_rlimit ||
+ 	    atomic_read(&user->sigpending) <=
+ 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+@@ -327,7 +330,7 @@ flush_signal_handlers(struct task_struct
+ 
+ int unhandled_signal(struct task_struct *tsk, int sig)
+ {
+-	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
++	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
+ 	if (is_global_init(tsk))
+ 		return 1;
+ 	if (handler != SIG_IGN && handler != SIG_DFL)
+@@ -625,6 +628,9 @@ static int check_kill_permission(int sig
+ 		}
+ 	}
+ 
++	if (gr_handle_signal(t, sig))
++		return -EPERM;
++
+ 	return security_task_kill(t, info, sig, 0);
+ }
+ 
+@@ -966,7 +972,7 @@ __group_send_sig_info(int sig, struct si
+ 	return send_signal(sig, info, p, 1);
+ }
+ 
+-static int
++int
+ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
+ {
+ 	return send_signal(sig, info, t, 0);
+@@ -1020,6 +1026,9 @@ force_sig_info(int sig, struct siginfo *
+ 	ret = specific_send_sig_info(sig, info, t);
+ 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
+ 
++	gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
++	gr_handle_crash(t, sig);
++
+ 	return ret;
+ }
+ 
+@@ -1079,8 +1088,11 @@ int group_send_sig_info(int sig, struct 
+ {
+ 	int ret = check_kill_permission(sig, info, p);
+ 
+-	if (!ret && sig)
++	if (!ret && sig) {
+ 		ret = do_send_sig_info(sig, info, p, true);
++		if (!ret)
++			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
++	}
+ 
+ 	return ret;
+ }
+diff -urNp linux-2.6.32.14/kernel/smp.c linux-2.6.32.14/kernel/smp.c
+--- linux-2.6.32.14/kernel/smp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/smp.c	2010-05-28 21:27:16.447114196 -0400
+@@ -459,22 +459,22 @@ int smp_call_function(void (*func)(void 
+ }
+ EXPORT_SYMBOL(smp_call_function);
+ 
+-void ipi_call_lock(void)
++void ipi_call_lock(void) __acquires(call_function.lock)
+ {
+ 	spin_lock(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock(void)
++void ipi_call_unlock(void) __releases(call_function.lock)
+ {
+ 	spin_unlock(&call_function.lock);
+ }
+ 
+-void ipi_call_lock_irq(void)
++void ipi_call_lock_irq(void) __acquires(call_function.lock)
+ {
+ 	spin_lock_irq(&call_function.lock);
+ }
+ 
+-void ipi_call_unlock_irq(void)
++void ipi_call_unlock_irq(void) __releases(call_function.lock)
+ {
+ 	spin_unlock_irq(&call_function.lock);
+ }
+diff -urNp linux-2.6.32.14/kernel/softirq.c linux-2.6.32.14/kernel/softirq.c
+--- linux-2.6.32.14/kernel/softirq.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/softirq.c	2010-05-28 21:27:16.447114196 -0400
+@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
+ 
+ static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
+ 
+-char *softirq_to_name[NR_SOFTIRQS] = {
++const char * const softirq_to_name[NR_SOFTIRQS] = {
+ 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
+ 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
+ };
+@@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
+ asmlinkage void __do_softirq(void)
+ {
+-	struct softirq_action *h;
++	const struct softirq_action *h;
+ 	__u32 pending;
+ 	int max_restart = MAX_SOFTIRQ_RESTART;
+ 	int cpu;
+@@ -216,7 +216,7 @@ restart:
+ 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
+ 
+ 			trace_softirq_entry(h, softirq_vec);
+-			h->action(h);
++			h->action();
+ 			trace_softirq_exit(h, softirq_vec);
+ 			if (unlikely(prev_count != preempt_count())) {
+ 				printk(KERN_ERR "huh, entered softirq %td %s %p"
+@@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
+ 	local_irq_restore(flags);
+ }
+ 
+-void open_softirq(int nr, void (*action)(struct softirq_action *))
++void open_softirq(int nr, void (*action)(void))
+ {
+ 	softirq_vec[nr].action = action;
+ }
+@@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct 
+ 
+ EXPORT_SYMBOL(__tasklet_hi_schedule_first);
+ 
+-static void tasklet_action(struct softirq_action *a)
++static void tasklet_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+@@ -431,7 +431,7 @@ static void tasklet_action(struct softir
+ 	}
+ }
+ 
+-static void tasklet_hi_action(struct softirq_action *a)
++static void tasklet_hi_action(void)
+ {
+ 	struct tasklet_struct *list;
+ 
+diff -urNp linux-2.6.32.14/kernel/sys.c linux-2.6.32.14/kernel/sys.c
+--- linux-2.6.32.14/kernel/sys.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/sys.c	2010-05-28 21:27:16.447114196 -0400
+@@ -133,6 +133,12 @@ static int set_one_prio(struct task_stru
+ 		error = -EACCES;
+ 		goto out;
+ 	}
++
++	if (gr_handle_chroot_setpriority(p, niceval)) {
++		error = -EACCES;
++		goto out;
++	}
++
+ 	no_nice = security_task_setnice(p, niceval);
+ 	if (no_nice) {
+ 		error = no_nice;
+@@ -190,10 +196,10 @@ SYSCALL_DEFINE3(setpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who)
+ 					error = set_one_prio(p, niceval, error);
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* For find_user() */
+ 			break;
+@@ -253,13 +259,13 @@ SYSCALL_DEFINE2(getpriority, int, which,
+ 				 !(user = find_user(who)))
+ 				goto out_unlock;	/* No processes for this user */
+ 
+-			do_each_thread(g, p)
++			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid == who) {
+ 					niceval = 20 - task_nice(p);
+ 					if (niceval > retval)
+ 						retval = niceval;
+ 				}
+-			while_each_thread(g, p);
++			} while_each_thread(g, p);
+ 			if (who != cred->uid)
+ 				free_uid(user);		/* for find_user() */
+ 			break;
+@@ -509,6 +515,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(new->gid, new->egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1 ||
+ 	    (egid != (gid_t) -1 && egid != old->gid))
+ 		new->sgid = new->egid;
+@@ -542,6 +551,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_group_change(gid, gid, gid))
++		goto error;
++
+ 	if (capable(CAP_SETGID))
+ 		new->gid = new->egid = new->sgid = new->fsgid = gid;
+ 	else if (gid == old->gid || gid == old->sgid)
+@@ -632,6 +645,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(new->uid, new->euid, -1))
++		goto error;
++
+ 	if (new->uid != old->uid) {
+ 		retval = set_user(new);
+ 		if (retval < 0)
+@@ -680,6 +696,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+ 		goto error;
+ 
+ 	retval = -EPERM;
++
++	if (gr_check_crash_uid(uid))
++		goto error;
++	if (gr_check_user_change(uid, uid, uid))
++		goto error;
++
+ 	if (capable(CAP_SETUID)) {
+ 		new->suid = new->uid = uid;
+ 		if (uid != old->uid) {
+@@ -737,6 +759,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_user_change(ruid, euid, -1))
++		goto error;
++
+ 	if (ruid != (uid_t) -1) {
+ 		new->uid = ruid;
+ 		if (ruid != old->uid) {
+@@ -805,6 +830,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, 
+ 			goto error;
+ 	}
+ 
++	if (gr_check_group_change(rgid, egid, -1))
++		goto error;
++
+ 	if (rgid != (gid_t) -1)
+ 		new->gid = rgid;
+ 	if (egid != (gid_t) -1)
+@@ -854,6 +882,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+ 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
+ 		goto error;
+ 
++	if (gr_check_user_change(-1, -1, uid))
++		goto error;
++
+ 	if (uid == old->uid  || uid == old->euid  ||
+ 	    uid == old->suid || uid == old->fsuid ||
+ 	    capable(CAP_SETUID)) {
+@@ -894,6 +925,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+ 	if (gid == old->gid  || gid == old->egid  ||
+ 	    gid == old->sgid || gid == old->fsgid ||
+ 	    capable(CAP_SETGID)) {
++		if (gr_check_group_change(-1, -1, gid))
++			goto error;
++
+ 		if (gid != old_fsgid) {
+ 			new->fsgid = gid;
+ 			goto change_okay;
+@@ -1459,7 +1493,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
+ 			error = get_dumpable(me->mm);
+ 			break;
+ 		case PR_SET_DUMPABLE:
+-			if (arg2 < 0 || arg2 > 1) {
++			if (arg2 > 1) {
+ 				error = -EINVAL;
+ 				break;
+ 			}
+diff -urNp linux-2.6.32.14/kernel/sysctl.c linux-2.6.32.14/kernel/sysctl.c
+--- linux-2.6.32.14/kernel/sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/sysctl.c	2010-05-28 21:27:16.447114196 -0400
+@@ -63,6 +63,13 @@
+ static int deprecated_sysctl_warning(struct __sysctl_args *args);
+ 
+ #if defined(CONFIG_SYSCTL)
++#include <linux/grsecurity.h>
++#include <linux/grinternal.h>
++
++extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
++extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
++				const int op);
++extern int gr_handle_chroot_sysctl(const int op);
+ 
+ /* External variables not in a header file. */
+ extern int C_A_D;
+@@ -168,6 +175,7 @@ static int proc_do_cad_pid(struct ctl_ta
+ static int proc_taint(struct ctl_table *table, int write,
+ 			       void __user *buffer, size_t *lenp, loff_t *ppos);
+ #endif
++extern ctl_table grsecurity_table[];
+ 
+ static struct ctl_table root_table[];
+ static struct ctl_table_root sysctl_table_root;
+@@ -200,6 +208,21 @@ extern struct ctl_table epoll_table[];
+ int sysctl_legacy_va_layout;
+ #endif
+ 
++#ifdef CONFIG_PAX_SOFTMODE
++static ctl_table pax_table[] = {
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "softmode",
++		.data		= &pax_softmode,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0600,
++		.proc_handler	= &proc_dointvec,
++	},
++
++	{ .ctl_name = 0 }
++};
++#endif
++
+ extern int prove_locking;
+ extern int lock_stat;
+ 
+@@ -251,6 +274,24 @@ static int max_wakeup_granularity_ns = N
+ #endif
+ 
+ static struct ctl_table kern_table[] = {
++#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "grsecurity",
++		.mode		= 0500,
++		.child		= grsecurity_table,
++	},
++#endif
++
++#ifdef CONFIG_PAX_SOFTMODE
++	{
++		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "pax",
++		.mode		= 0500,
++		.child		= pax_table,
++	},
++#endif
++
+ 	{
+ 		.ctl_name	= CTL_UNNUMBERED,
+ 		.procname	= "sched_child_runs_first",
+@@ -1803,6 +1844,8 @@ static int do_sysctl_strategy(struct ctl
+ 	return 0;
+ }
+ 
++static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
++
+ static int parse_table(int __user *name, int nlen,
+ 		       void __user *oldval, size_t __user *oldlenp,
+ 		       void __user *newval, size_t newlen,
+@@ -1821,7 +1864,7 @@ repeat:
+ 		if (n == table->ctl_name) {
+ 			int error;
+ 			if (table->child) {
+-				if (sysctl_perm(root, table, MAY_EXEC))
++				if (sysctl_perm_nochk(root, table, MAY_EXEC))
+ 					return -EPERM;
+ 				name++;
+ 				nlen--;
+@@ -1906,6 +1949,33 @@ int sysctl_perm(struct ctl_table_root *r
+ 	int error;
+ 	int mode;
+ 
++	if (table->parent != NULL && table->parent->procname != NULL &&
++	   table->procname != NULL &&
++	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
++		return -EACCES;
++	if (gr_handle_chroot_sysctl(op))
++		return -EACCES;
++	error = gr_handle_sysctl(table, op);
++	if (error)
++		return error;
++
++	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
++	if (error)
++		return error;
++
++	if (root->permissions)
++		mode = root->permissions(root, current->nsproxy, table);
++	else
++		mode = table->mode;
++
++	return test_perm(mode, op);
++}
++
++int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
++{
++	int error;
++	int mode;
++
+ 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
+ 	if (error)
+ 		return error;
+diff -urNp linux-2.6.32.14/kernel/taskstats.c linux-2.6.32.14/kernel/taskstats.c
+--- linux-2.6.32.14/kernel/taskstats.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/taskstats.c	2010-05-28 21:27:16.447114196 -0400
+@@ -26,9 +26,12 @@
+ #include <linux/cgroup.h>
+ #include <linux/fs.h>
+ #include <linux/file.h>
++#include <linux/grsecurity.h>
+ #include <net/genetlink.h>
+ #include <asm/atomic.h>
+ 
++extern int gr_is_taskstats_denied(int pid);
++
+ /*
+  * Maximum length of a cpumask that can be specified in
+  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
+@@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
+ 	size_t size;
+ 	cpumask_var_t mask;
+ 
++	if (gr_is_taskstats_denied(current->pid))
++		return -EACCES;
++
+ 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.32.14/kernel/time/tick-broadcast.c linux-2.6.32.14/kernel/time/tick-broadcast.c
+--- linux-2.6.32.14/kernel/time/tick-broadcast.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/time/tick-broadcast.c	2010-05-28 21:27:16.447114196 -0400
+@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
+ 		 * then clear the broadcast bit.
+ 		 */
+ 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
+-			int cpu = smp_processor_id();
++			cpu = smp_processor_id();
+ 
+ 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
+ 			tick_broadcast_clear_oneshot(cpu);
+diff -urNp linux-2.6.32.14/kernel/time.c linux-2.6.32.14/kernel/time.c
+--- linux-2.6.32.14/kernel/time.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/time.c	2010-05-28 21:27:16.451020026 -0400
+@@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *, 
+ 		return err;
+ 
+ 	do_settimeofday(&tv);
++
++	gr_log_timechange();
++
+ 	return 0;
+ }
+ 
+@@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
+ 			return -EFAULT;
+ 	}
+ 
++	gr_log_timechange();
++
+ 	return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
+ }
+ 
+@@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
+  * Avoid unnecessary multiplications/divisions in the
+  * two most common HZ cases:
+  */
+-unsigned int inline jiffies_to_msecs(const unsigned long j)
++inline unsigned int jiffies_to_msecs(const unsigned long j)
+ {
+ #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
+ 	return (MSEC_PER_SEC / HZ) * j;
+@@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
+ }
+ EXPORT_SYMBOL(jiffies_to_msecs);
+ 
+-unsigned int inline jiffies_to_usecs(const unsigned long j)
++inline unsigned int jiffies_to_usecs(const unsigned long j)
+ {
+ #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
+ 	return (USEC_PER_SEC / HZ) * j;
+diff -urNp linux-2.6.32.14/kernel/timer.c linux-2.6.32.14/kernel/timer.c
+--- linux-2.6.32.14/kernel/timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/timer.c	2010-05-28 21:27:16.451020026 -0400
+@@ -1207,7 +1207,7 @@ void update_process_times(int user_tick)
+ /*
+  * This function runs timers and the timer-tq in bottom half context.
+  */
+-static void run_timer_softirq(struct softirq_action *h)
++static void run_timer_softirq(void)
+ {
+ 	struct tvec_base *base = __get_cpu_var(tvec_bases);
+ 
+diff -urNp linux-2.6.32.14/kernel/trace/ftrace.c linux-2.6.32.14/kernel/trace/ftrace.c
+--- linux-2.6.32.14/kernel/trace/ftrace.c	2010-04-04 20:41:50.068477203 -0400
++++ linux-2.6.32.14/kernel/trace/ftrace.c	2010-05-28 21:27:16.451020026 -0400
+@@ -1093,13 +1093,18 @@ ftrace_code_disable(struct module *mod, 
+ 
+ 	ip = rec->ip;
+ 
++	ret = ftrace_arch_code_modify_prepare();
++	FTRACE_WARN_ON(ret);
++	if (ret)
++		return 0;
++
+ 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
++	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
+ 	if (ret) {
+ 		ftrace_bug(ret, ip);
+ 		rec->flags |= FTRACE_FL_FAILED;
+-		return 0;
+ 	}
+-	return 1;
++	return ret ? 0 : 1;
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.14/kernel/trace/Kconfig linux-2.6.32.14/kernel/trace/Kconfig
+--- linux-2.6.32.14/kernel/trace/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/trace/Kconfig	2010-05-28 21:27:16.451020026 -0400
+@@ -126,6 +126,7 @@ if FTRACE
+ config FUNCTION_TRACER
+ 	bool "Kernel Function Tracer"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FRAME_POINTER
+ 	select KALLSYMS
+ 	select GENERIC_TRACER
+@@ -343,6 +344,7 @@ config POWER_TRACER
+ config STACK_TRACER
+ 	bool "Trace max stack"
+ 	depends on HAVE_FUNCTION_TRACER
++	depends on !PAX_KERNEXEC
+ 	select FUNCTION_TRACER
+ 	select STACKTRACE
+ 	select KALLSYMS
+diff -urNp linux-2.6.32.14/kernel/trace/ring_buffer.c linux-2.6.32.14/kernel/trace/ring_buffer.c
+--- linux-2.6.32.14/kernel/trace/ring_buffer.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.14/kernel/trace/ring_buffer.c	2010-05-28 21:27:16.451020026 -0400
+@@ -606,7 +606,7 @@ static struct list_head *rb_list_head(st
+  * the reader page). But if the next page is a header page,
+  * its flags will be non zero.
+  */
+-static int inline
++static inline int
+ rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
+ 		struct buffer_page *page, struct list_head *list)
+ {
+diff -urNp linux-2.6.32.14/kernel/trace/trace.c linux-2.6.32.14/kernel/trace/trace.c
+--- linux-2.6.32.14/kernel/trace/trace.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.14/kernel/trace/trace.c	2010-05-28 21:27:16.451020026 -0400
+@@ -3808,10 +3808,9 @@ static const struct file_operations trac
+ };
+ #endif
+ 
+-static struct dentry *d_tracer;
+-
+ struct dentry *tracing_init_dentry(void)
+ {
++	static struct dentry *d_tracer;
+ 	static int once;
+ 
+ 	if (d_tracer)
+@@ -3831,10 +3830,9 @@ struct dentry *tracing_init_dentry(void)
+ 	return d_tracer;
+ }
+ 
+-static struct dentry *d_percpu;
+-
+ struct dentry *tracing_dentry_percpu(void)
+ {
++	static struct dentry *d_percpu;
+ 	static int once;
+ 	struct dentry *d_tracer;
+ 
+diff -urNp linux-2.6.32.14/kernel/trace/trace_events.c linux-2.6.32.14/kernel/trace/trace_events.c
+--- linux-2.6.32.14/kernel/trace/trace_events.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/trace/trace_events.c	2010-05-28 21:27:16.451020026 -0400
+@@ -951,6 +951,8 @@ static LIST_HEAD(ftrace_module_file_list
+  * Modules must own their file_operations to keep up with
+  * reference counting.
+  */
++
++/* cannot be const */
+ struct ftrace_module_file_ops {
+ 	struct list_head		list;
+ 	struct module			*mod;
+diff -urNp linux-2.6.32.14/kernel/trace/trace_output.c linux-2.6.32.14/kernel/trace/trace_output.c
+--- linux-2.6.32.14/kernel/trace/trace_output.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/trace/trace_output.c	2010-05-28 21:27:16.451020026 -0400
+@@ -237,7 +237,7 @@ int trace_seq_path(struct trace_seq *s, 
+ 		return 0;
+ 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
+ 	if (!IS_ERR(p)) {
+-		p = mangle_path(s->buffer + s->len, p, "\n");
++		p = mangle_path(s->buffer + s->len, p, "\n\\");
+ 		if (p) {
+ 			s->len = p - s->buffer;
+ 			return 1;
+diff -urNp linux-2.6.32.14/kernel/trace/trace_stack.c linux-2.6.32.14/kernel/trace/trace_stack.c
+--- linux-2.6.32.14/kernel/trace/trace_stack.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/trace/trace_stack.c	2010-05-28 21:27:16.451020026 -0400
+@@ -50,7 +50,7 @@ static inline void check_stack(void)
+ 		return;
+ 
+ 	/* we do not handle interrupt stacks yet */
+-	if (!object_is_on_stack(&this_size))
++	if (!object_starts_on_stack(&this_size))
+ 		return;
+ 
+ 	local_irq_save(flags);
+diff -urNp linux-2.6.32.14/kernel/utsname_sysctl.c linux-2.6.32.14/kernel/utsname_sysctl.c
+--- linux-2.6.32.14/kernel/utsname_sysctl.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/kernel/utsname_sysctl.c	2010-05-28 21:27:16.451020026 -0400
+@@ -123,7 +123,7 @@ static struct ctl_table uts_kern_table[]
+ 		.proc_handler	= proc_do_uts_string,
+ 		.strategy	= sysctl_uts_string,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static struct ctl_table uts_root_table[] = {
+@@ -133,7 +133,7 @@ static struct ctl_table uts_root_table[]
+ 		.mode		= 0555,
+ 		.child		= uts_kern_table,
+ 	},
+-	{}
++	{ 0, NULL, NULL, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }
+ };
+ 
+ static int __init utsname_sysctl_init(void)
+diff -urNp linux-2.6.32.14/lib/bug.c linux-2.6.32.14/lib/bug.c
+--- linux-2.6.32.14/lib/bug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/bug.c	2010-05-28 21:27:16.451020026 -0400
+@@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
+ 		return BUG_TRAP_TYPE_NONE;
+ 
+ 	bug = find_bug(bugaddr);
++	if (!bug)
++		return BUG_TRAP_TYPE_NONE;
+ 
+ 	printk(KERN_EMERG "------------[ cut here ]------------\n");
+ 
+diff -urNp linux-2.6.32.14/lib/debugobjects.c linux-2.6.32.14/lib/debugobjects.c
+--- linux-2.6.32.14/lib/debugobjects.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/debugobjects.c	2010-05-28 21:27:16.455065280 -0400
+@@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
+ 	if (limit > 4)
+ 		return;
+ 
+-	is_on_stack = object_is_on_stack(addr);
++	is_on_stack = object_starts_on_stack(addr);
+ 	if (is_on_stack == onstack)
+ 		return;
+ 
+diff -urNp linux-2.6.32.14/lib/dma-debug.c linux-2.6.32.14/lib/dma-debug.c
+--- linux-2.6.32.14/lib/dma-debug.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/dma-debug.c	2010-05-28 21:27:16.463242745 -0400
+@@ -861,7 +861,7 @@ out:
+ 
+ static void check_for_stack(struct device *dev, void *addr)
+ {
+-	if (object_is_on_stack(addr))
++	if (object_starts_on_stack(addr))
+ 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
+ 				"stack [addr=%p]\n", addr);
+ }
+diff -urNp linux-2.6.32.14/lib/idr.c linux-2.6.32.14/lib/idr.c
+--- linux-2.6.32.14/lib/idr.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/idr.c	2010-05-28 21:27:16.463242745 -0400
+@@ -156,7 +156,7 @@ static int sub_alloc(struct idr *idp, in
+ 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
+ 
+ 			/* if already at the top layer, we need to grow */
+-			if (id >= 1 << (idp->layers * IDR_BITS)) {
++			if (id >= (1 << (idp->layers * IDR_BITS))) {
+ 				*starting_id = id;
+ 				return IDR_NEED_TO_GROW;
+ 			}
+diff -urNp linux-2.6.32.14/lib/inflate.c linux-2.6.32.14/lib/inflate.c
+--- linux-2.6.32.14/lib/inflate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/inflate.c	2010-05-28 21:27:16.463242745 -0400
+@@ -266,7 +266,7 @@ static void free(void *where)
+ 		malloc_ptr = free_mem_ptr;
+ }
+ #else
+-#define malloc(a) kmalloc(a, GFP_KERNEL)
++#define malloc(a) kmalloc((a), GFP_KERNEL)
+ #define free(a) kfree(a)
+ #endif
+ 
+diff -urNp linux-2.6.32.14/lib/Kconfig.debug linux-2.6.32.14/lib/Kconfig.debug
+--- linux-2.6.32.14/lib/Kconfig.debug	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/Kconfig.debug	2010-05-28 21:27:16.463242745 -0400
+@@ -905,7 +905,7 @@ config LATENCYTOP
+ 	select STACKTRACE
+ 	select SCHEDSTATS
+ 	select SCHED_DEBUG
+-	depends on HAVE_LATENCYTOP_SUPPORT
++	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
+ 	help
+ 	  Enable this option if you want to use the LatencyTOP tool
+ 	  to find out which userspace is blocking on what kernel operations.
+diff -urNp linux-2.6.32.14/lib/kobject.c linux-2.6.32.14/lib/kobject.c
+--- linux-2.6.32.14/lib/kobject.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/kobject.c	2010-05-28 21:27:16.463242745 -0400
+@@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
+ 	return ret;
+ }
+ 
+-struct sysfs_ops kobj_sysfs_ops = {
++const struct sysfs_ops kobj_sysfs_ops = {
+ 	.show	= kobj_attr_show,
+ 	.store	= kobj_attr_store,
+ };
+@@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ static struct kset *kset_create(const char *name,
+-				struct kset_uevent_ops *uevent_ops,
++				const struct kset_uevent_ops *uevent_ops,
+ 				struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+@@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
+  * If the kset was not able to be created, NULL will be returned.
+  */
+ struct kset *kset_create_and_add(const char *name,
+-				 struct kset_uevent_ops *uevent_ops,
++				 const struct kset_uevent_ops *uevent_ops,
+ 				 struct kobject *parent_kobj)
+ {
+ 	struct kset *kset;
+diff -urNp linux-2.6.32.14/lib/kobject_uevent.c linux-2.6.32.14/lib/kobject_uevent.c
+--- linux-2.6.32.14/lib/kobject_uevent.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/kobject_uevent.c	2010-05-28 21:27:16.463242745 -0400
+@@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
+ 	const char *subsystem;
+ 	struct kobject *top_kobj;
+ 	struct kset *kset;
+-	struct kset_uevent_ops *uevent_ops;
++	const struct kset_uevent_ops *uevent_ops;
+ 	u64 seq;
+ 	int i = 0;
+ 	int retval = 0;
+diff -urNp linux-2.6.32.14/lib/parser.c linux-2.6.32.14/lib/parser.c
+--- linux-2.6.32.14/lib/parser.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/parser.c	2010-05-28 21:27:16.463242745 -0400
+@@ -126,7 +126,7 @@ static int match_number(substring_t *s, 
+ 	char *buf;
+ 	int ret;
+ 
+-	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
++	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
+ 	if (!buf)
+ 		return -ENOMEM;
+ 	memcpy(buf, s->from, s->to - s->from);
+diff -urNp linux-2.6.32.14/lib/radix-tree.c linux-2.6.32.14/lib/radix-tree.c
+--- linux-2.6.32.14/lib/radix-tree.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/radix-tree.c	2010-05-28 21:27:16.471246042 -0400
+@@ -81,7 +81,7 @@ struct radix_tree_preload {
+ 	int nr;
+ 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
+ };
+-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
++static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
+ 
+ static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
+ {
+diff -urNp linux-2.6.32.14/lib/random32.c linux-2.6.32.14/lib/random32.c
+--- linux-2.6.32.14/lib/random32.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/lib/random32.c	2010-05-28 21:27:16.471246042 -0400
+@@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
+  */
+ static inline u32 __seed(u32 x, u32 m)
+ {
+-	return (x < m) ? x + m : x;
++	return (x <= m) ? x + m + 1 : x;
+ }
+ 
+ /**
+diff -urNp linux-2.6.32.14/localversion-grsec linux-2.6.32.14/localversion-grsec
+--- linux-2.6.32.14/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.32.14/localversion-grsec	2010-05-28 21:27:16.471246042 -0400
+@@ -0,0 +1 @@
++-grsec
+diff -urNp linux-2.6.32.14/Makefile linux-2.6.32.14/Makefile
+--- linux-2.6.32.14/Makefile	2010-05-28 20:16:44.396488303 -0400
++++ linux-2.6.32.14/Makefile	2010-05-28 21:27:16.474989604 -0400
+@@ -221,8 +221,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
+ 
+ HOSTCC       = gcc
+ HOSTCXX      = g++
+-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
+-HOSTCXXFLAGS = -O2
++HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
++HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
+ 
+ # Decide whether to build built-in, modular, or both.
+ # Normally, just do built-in.
+@@ -644,7 +644,7 @@ export mod_strip_cmd
+ 
+ 
+ ifeq ($(KBUILD_EXTMOD),)
+-core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ 
+ vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
+ 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
+diff -urNp linux-2.6.32.14/mm/filemap.c linux-2.6.32.14/mm/filemap.c
+--- linux-2.6.32.14/mm/filemap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/filemap.c	2010-05-28 21:27:16.479250347 -0400
+@@ -1622,7 +1622,7 @@ int generic_file_mmap(struct file * file
+ 	struct address_space *mapping = file->f_mapping;
+ 
+ 	if (!mapping->a_ops->readpage)
+-		return -ENOEXEC;
++		return -ENODEV;
+ 	file_accessed(file);
+ 	vma->vm_ops = &generic_file_vm_ops;
+ 	vma->vm_flags |= VM_CAN_NONLINEAR;
+@@ -2018,6 +2018,7 @@ inline int generic_write_checks(struct f
+                         *pos = i_size_read(inode);
+ 
+ 		if (limit != RLIM_INFINITY) {
++			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
+ 			if (*pos >= limit) {
+ 				send_sig(SIGXFSZ, current, 0);
+ 				return -EFBIG;
+diff -urNp linux-2.6.32.14/mm/fremap.c linux-2.6.32.14/mm/fremap.c
+--- linux-2.6.32.14/mm/fremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/fremap.c	2010-05-28 21:27:16.487251224 -0400
+@@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
+  retry:
+ 	vma = find_vma(mm, start);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
++		goto out;
++#endif
++
+ 	/*
+ 	 * Make sure the vma is shared, that it supports prefaulting,
+ 	 * and that the remapped range is valid and fully within
+diff -urNp linux-2.6.32.14/mm/highmem.c linux-2.6.32.14/mm/highmem.c
+--- linux-2.6.32.14/mm/highmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/highmem.c	2010-05-28 21:27:16.487251224 -0400
+@@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
+ 		 * So no dangers, even with speculative execution.
+ 		 */
+ 		page = pte_page(pkmap_page_table[i]);
++		pax_open_kernel();
+ 		pte_clear(&init_mm, (unsigned long)page_address(page),
+ 			  &pkmap_page_table[i]);
+-
++		pax_close_kernel();
+ 		set_page_address(page, NULL);
+ 		need_flush = 1;
+ 	}
+@@ -177,9 +178,11 @@ start:
+ 		}
+ 	}
+ 	vaddr = PKMAP_ADDR(last_pkmap_nr);
++
++	pax_open_kernel();
+ 	set_pte_at(&init_mm, vaddr,
+ 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
+-
++	pax_close_kernel();
+ 	pkmap_count[last_pkmap_nr] = 1;
+ 	set_page_address(page, (void *)vaddr);
+ 
+diff -urNp linux-2.6.32.14/mm/hugetlb.c linux-2.6.32.14/mm/hugetlb.c
+--- linux-2.6.32.14/mm/hugetlb.c	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/mm/hugetlb.c	2010-05-28 21:27:16.487251224 -0400
+@@ -1925,6 +1925,26 @@ static int unmap_ref_private(struct mm_s
+ 	return 1;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	struct vm_area_struct *vma_m;
++	unsigned long address_m;
++	pte_t *ptep_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
++	get_page(page_m);
++	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
++}
++#endif
++
+ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			unsigned long address, pte_t *ptep, pte_t pte,
+ 			struct page *pagecache_page)
+@@ -1996,6 +2016,11 @@ retry_avoidcopy:
+ 		huge_ptep_clear_flush(vma, address, ptep);
+ 		set_huge_pte_at(mm, address, ptep,
+ 				make_huge_pte(vma, new_page, 1));
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_huge_pte(vma, address, new_page);
++#endif
++
+ 		/* Make the old page be freed below */
+ 		new_page = old_page;
+ 	}
+@@ -2127,6 +2152,10 @@ retry:
+ 				&& (vma->vm_flags & VM_SHARED)));
+ 	set_huge_pte_at(mm, address, ptep, new_pte);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_huge_pte(vma, address, page);
++#endif
++
+ 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
+ 		/* Optimization, do the COW without a second fault */
+ 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
+@@ -2155,6 +2184,28 @@ int hugetlb_fault(struct mm_struct *mm, 
+ 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
+ 	struct hstate *h = hstate_vma(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++			h = hstate_vma(vma);
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
++			return VM_FAULT_OOM;
++		address_m &= HPAGE_MASK;
++		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
++	}
++#endif
++
+ 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+ 	if (!ptep)
+ 		return VM_FAULT_OOM;
+diff -urNp linux-2.6.32.14/mm/Kconfig linux-2.6.32.14/mm/Kconfig
+--- linux-2.6.32.14/mm/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/Kconfig	2010-05-28 21:27:16.487251224 -0400
+@@ -228,7 +228,7 @@ config KSM
+ config DEFAULT_MMAP_MIN_ADDR
+         int "Low address space to protect from user allocation"
+ 	depends on MMU
+-        default 4096
++        default 65536
+         help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.14/mm/maccess.c linux-2.6.32.14/mm/maccess.c
+--- linux-2.6.32.14/mm/maccess.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/maccess.c	2010-05-28 21:27:16.487251224 -0400
+@@ -14,7 +14,7 @@
+  * Safely read from address @src to the buffer at @dst.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long probe_kernel_read(void *dst, void *src, size_t size)
++long probe_kernel_read(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
+  * Safely write to address @dst from the buffer at @src.  If a kernel fault
+  * happens, handle that and return -EFAULT.
+  */
+-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
++long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
+ {
+ 	long ret;
+ 	mm_segment_t old_fs = get_fs();
+diff -urNp linux-2.6.32.14/mm/madvise.c linux-2.6.32.14/mm/madvise.c
+--- linux-2.6.32.14/mm/madvise.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/madvise.c	2010-05-28 21:27:16.487251224 -0400
+@@ -44,6 +44,10 @@ static long madvise_behavior(struct vm_a
+ 	pgoff_t pgoff;
+ 	unsigned long new_flags = vma->vm_flags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	switch (behavior) {
+ 	case MADV_NORMAL:
+ 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
+@@ -103,6 +107,13 @@ success:
+ 	/*
+ 	 * vm_flags is protected by the mmap_sem held in write mode.
+ 	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m)
++		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
++#endif
++
+ 	vma->vm_flags = new_flags;
+ 
+ out:
+@@ -161,6 +172,11 @@ static long madvise_dontneed(struct vm_a
+ 			     struct vm_area_struct ** prev,
+ 			     unsigned long start, unsigned long end)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	*prev = vma;
+ 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
+ 		return -EINVAL;
+@@ -173,6 +189,21 @@ static long madvise_dontneed(struct vm_a
+ 		zap_page_range(vma, start, end - start, &details);
+ 	} else
+ 		zap_page_range(vma, start, end - start, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
++			struct zap_details details = {
++				.nonlinear_vma = vma_m,
++				.last_index = ULONG_MAX,
++			};
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++		} else
++			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -359,6 +390,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, 
+ 	if (end < start)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			goto out;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		goto out;
++
+ 	error = 0;
+ 	if (end == start)
+ 		goto out;
+diff -urNp linux-2.6.32.14/mm/memory.c linux-2.6.32.14/mm/memory.c
+--- linux-2.6.32.14/mm/memory.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/memory.c	2010-05-28 21:27:16.487251224 -0400
+@@ -48,6 +48,7 @@
+ #include <linux/ksm.h>
+ #include <linux/rmap.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/delayacct.h>
+ #include <linux/init.h>
+ #include <linux/writeback.h>
+@@ -1251,10 +1252,10 @@ int __get_user_pages(struct task_struct 
+ 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
+ 	i = 0;
+ 
+-	do {
++	while (nr_pages) {
+ 		struct vm_area_struct *vma;
+ 
+-		vma = find_extend_vma(mm, start);
++		vma = find_vma(mm, start);
+ 		if (!vma && in_gate_area(tsk, start)) {
+ 			unsigned long pg = start & PAGE_MASK;
+ 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
+@@ -1296,7 +1297,7 @@ int __get_user_pages(struct task_struct 
+ 			continue;
+ 		}
+ 
+-		if (!vma ||
++		if (!vma || start < vma->vm_start ||
+ 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
+ 		    !(vm_flags & vma->vm_flags))
+ 			return i ? : -EFAULT;
+@@ -1371,7 +1372,7 @@ int __get_user_pages(struct task_struct 
+ 			start += PAGE_SIZE;
+ 			nr_pages--;
+ 		} while (nr_pages && start < vma->vm_end);
+-	} while (nr_pages);
++	}
+ 	return i;
+ }
+ 
+@@ -1967,6 +1968,186 @@ static inline void cow_user_page(struct 
+ 		copy_user_highpage(dst, src, va, vma);
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	spinlock_t *ptl;
++	pte_t *pte, entry;
++
++	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
++	entry = *pte;
++	if (!pte_present(entry)) {
++		if (!pte_none(entry)) {
++			BUG_ON(pte_file(entry));
++			free_swap_and_cache(pte_to_swp_entry(entry));
++			pte_clear_not_present_full(mm, address, pte, 0);
++		}
++	} else {
++		struct page *page;
++
++		flush_cache_page(vma, address, pte_pfn(entry));
++		entry = ptep_clear_flush(vma, address, pte);
++		BUG_ON(pte_dirty(entry));
++		page = vm_normal_page(vma, address, entry);
++		if (page) {
++			update_hiwater_rss(mm);
++			if (PageAnon(page))
++				dec_mm_counter(mm, anon_rss);
++			else
++				dec_mm_counter(mm, file_rss);
++			page_remove_rmap(page);
++			page_cache_release(page);
++		}
++	}
++	pte_unmap_unlock(pte, ptl);
++}
++
++/* PaX: if vma is mirrored, synchronize the mirror's PTE
++ *
++ * the ptl of the lower mapped page is held on entry and is not released on exit
++ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
++ */
++static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || !PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(!PageLocked(page_m));
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_anon_rmap(page_m, vma_m, address_m);
++	inc_mm_counter(mm, anon_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++	unlock_page(page_m);
++}
++
++void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	BUG_ON(!page_m || PageAnon(page_m));
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
++	page_cache_get(page_m);
++	page_add_file_rmap(page_m);
++	inc_mm_counter(mm, file_rss);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++	update_mmu_cache(vma_m, address_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
++{
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long address_m;
++	spinlock_t *ptl_m;
++	struct vm_area_struct *vma_m;
++	pmd_t *pmd_m;
++	pte_t *pte_m, entry_m;
++
++	vma_m = pax_find_mirror_vma(vma);
++	if (!vma_m)
++		return;
++
++	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
++	address_m = address + SEGMEXEC_TASK_SIZE;
++	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
++	pte_m = pte_offset_map_nested(pmd_m, address_m);
++	ptl_m = pte_lockptr(mm, pmd_m);
++	if (ptl != ptl_m) {
++		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
++		if (!pte_none(*pte_m))
++			goto out;
++	}
++
++	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
++	set_pte_at(mm, address_m, pte_m, entry_m);
++out:
++	if (ptl != ptl_m)
++		spin_unlock(ptl_m);
++	pte_unmap_nested(pte_m);
++}
++
++static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
++{
++	struct page *page_m;
++	pte_t entry;
++
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
++		goto out;
++
++	entry = *pte;
++	page_m  = vm_normal_page(vma, address, entry);
++	if (!page_m)
++		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
++	else if (PageAnon(page_m)) {
++		if (pax_find_mirror_vma(vma)) {
++			pte_unmap_unlock(pte, ptl);
++			lock_page(page_m);
++			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
++			if (pte_same(entry, *pte))
++				pax_mirror_anon_pte(vma, address, page_m, ptl);
++			else
++				unlock_page(page_m);
++		}
++	} else
++		pax_mirror_file_pte(vma, address, page_m, ptl);
++
++out:
++	pte_unmap_unlock(pte, ptl);
++}
++#endif
++
+ /*
+  * This routine handles present pages, when users try to write
+  * to a shared page. It is done by copying the page to a new address
+@@ -2146,6 +2327,12 @@ gotten:
+ 	 */
+ 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(new_page));
++#endif
++
+ 		if (old_page) {
+ 			if (!PageAnon(old_page)) {
+ 				dec_mm_counter(mm, file_rss);
+@@ -2197,6 +2384,10 @@ gotten:
+ 			page_remove_rmap(old_page);
+ 		}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		pax_mirror_anon_pte(vma, address, new_page, ptl);
++#endif
++
+ 		/* Free the old page.. */
+ 		new_page = old_page;
+ 		ret |= VM_FAULT_WRITE;
+@@ -2594,6 +2785,11 @@ static int do_swap_page(struct mm_struct
+ 	swap_free(entry);
+ 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
+ 		try_to_free_swap(page);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
++#endif
++
+ 	unlock_page(page);
+ 
+ 	if (flags & FAULT_FLAG_WRITE) {
+@@ -2605,6 +2801,11 @@ static int do_swap_page(struct mm_struct
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, pte);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ out:
+@@ -2628,7 +2829,7 @@ static int do_anonymous_page(struct mm_s
+ 		unsigned long address, pte_t *page_table, pmd_t *pmd,
+ 		unsigned int flags)
+ {
+-	struct page *page;
++	struct page *page = NULL;
+ 	spinlock_t *ptl;
+ 	pte_t entry;
+ 
+@@ -2663,6 +2864,11 @@ static int do_anonymous_page(struct mm_s
+ 	if (!pte_none(*page_table))
+ 		goto release;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		BUG_ON(!trylock_page(page));
++#endif
++
+ 	inc_mm_counter(mm, anon_rss);
+ 	page_add_new_anon_rmap(page, vma, address);
+ setpte:
+@@ -2670,6 +2876,12 @@ setpte:
+ 
+ 	/* No need to invalidate - it was non-present before */
+ 	update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (page)
++		pax_mirror_anon_pte(vma, address, page, ptl);
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(page_table, ptl);
+ 	return 0;
+@@ -2812,6 +3024,12 @@ static int __do_fault(struct mm_struct *
+ 	 */
+ 	/* Only go through if we didn't race with anybody else... */
+ 	if (likely(pte_same(*page_table, orig_pte))) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon && pax_find_mirror_vma(vma))
++			BUG_ON(!trylock_page(page));
++#endif
++
+ 		flush_icache_page(vma, page);
+ 		entry = mk_pte(page, vma->vm_page_prot);
+ 		if (flags & FAULT_FLAG_WRITE)
+@@ -2831,6 +3049,14 @@ static int __do_fault(struct mm_struct *
+ 
+ 		/* no need to invalidate: a not-present page won't be cached */
+ 		update_mmu_cache(vma, address, entry);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (anon)
++			pax_mirror_anon_pte(vma, address, page, ptl);
++		else
++			pax_mirror_file_pte(vma, address, page, ptl);
++#endif
++
+ 	} else {
+ 		if (charged)
+ 			mem_cgroup_uncharge_page(page);
+@@ -2978,6 +3204,12 @@ static inline int handle_pte_fault(struc
+ 		if (flags & FAULT_FLAG_WRITE)
+ 			flush_tlb_page(vma, address);
+ 	}
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	pax_mirror_pte(vma, address, pte, pmd, ptl);
++	return 0;
++#endif
++
+ unlock:
+ 	pte_unmap_unlock(pte, ptl);
+ 	return 0;
+@@ -2994,6 +3226,10 @@ int handle_mm_fault(struct mm_struct *mm
+ 	pmd_t *pmd;
+ 	pte_t *pte;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	__set_current_state(TASK_RUNNING);
+ 
+ 	count_vm_event(PGFAULT);
+@@ -3001,6 +3237,34 @@ int handle_mm_fault(struct mm_struct *mm
+ 	if (unlikely(is_vm_hugetlb_page(vma)))
+ 		return hugetlb_fault(mm, vma, address, flags);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++	if (vma_m) {
++		unsigned long address_m;
++		pgd_t *pgd_m;
++		pud_t *pud_m;
++		pmd_t *pmd_m;
++
++		if (vma->vm_start > vma_m->vm_start) {
++			address_m = address;
++			address -= SEGMEXEC_TASK_SIZE;
++			vma = vma_m;
++		} else
++			address_m = address + SEGMEXEC_TASK_SIZE;
++
++		pgd_m = pgd_offset(mm, address_m);
++		pud_m = pud_alloc(mm, pgd_m, address_m);
++		if (!pud_m)
++			return VM_FAULT_OOM;
++		pmd_m = pmd_alloc(mm, pud_m, address_m);
++		if (!pmd_m)
++			return VM_FAULT_OOM;
++		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
++			return VM_FAULT_OOM;
++		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
++	}
++#endif
++
+ 	pgd = pgd_offset(mm, address);
+ 	pud = pud_alloc(mm, pgd, address);
+ 	if (!pud)
+@@ -3098,7 +3362,7 @@ static int __init gate_vma_init(void)
+ 	gate_vma.vm_start = FIXADDR_USER_START;
+ 	gate_vma.vm_end = FIXADDR_USER_END;
+ 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
+-	gate_vma.vm_page_prot = __P101;
++	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
+ 	/*
+ 	 * Make sure the vDSO gets into every core dump.
+ 	 * Dumping its contents makes post-mortem fully interpretable later
+diff -urNp linux-2.6.32.14/mm/memory-failure.c linux-2.6.32.14/mm/memory-failure.c
+--- linux-2.6.32.14/mm/memory-failure.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/memory-failure.c	2010-05-28 21:27:16.487251224 -0400
+@@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r
+ 
+ int sysctl_memory_failure_recovery __read_mostly = 1;
+ 
+-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
++atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
+ 
+ /*
+  * Send all the processes who have the page mapped an ``action optional''
+@@ -741,7 +741,7 @@ int __memory_failure(unsigned long pfn, 
+ 		return 0;
+ 	}
+ 
+-	atomic_long_add(1, &mce_bad_pages);
++	atomic_long_add_unchecked(1, &mce_bad_pages);
+ 
+ 	/*
+ 	 * We need/can do nothing about count=0 pages.
+diff -urNp linux-2.6.32.14/mm/mempolicy.c linux-2.6.32.14/mm/mempolicy.c
+--- linux-2.6.32.14/mm/mempolicy.c	2010-04-04 20:41:50.072525146 -0400
++++ linux-2.6.32.14/mm/mempolicy.c	2010-05-28 21:27:16.487251224 -0400
+@@ -573,6 +573,10 @@ static int mbind_range(struct vm_area_st
+ 	struct vm_area_struct *next;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m;
++#endif
++
+ 	err = 0;
+ 	for (; vma && vma->vm_start < end; vma = next) {
+ 		next = vma->vm_next;
+@@ -584,6 +588,16 @@ static int mbind_range(struct vm_area_st
+ 			err = policy_vma(vma, new);
+ 		if (err)
+ 			break;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		vma_m = pax_find_mirror_vma(vma);
++		if (vma_m) {
++			err = policy_vma(vma_m, new);
++			if (err)
++				break;
++		}
++#endif
++
+ 	}
+ 	return err;
+ }
+@@ -1002,6 +1016,17 @@ static long do_mbind(unsigned long start
+ 
+ 	if (end < start)
+ 		return -EINVAL;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (end == start)
+ 		return 0;
+ 
+@@ -1207,6 +1232,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1216,8 +1249,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+@@ -2396,7 +2428,7 @@ int show_numa_map(struct seq_file *m, vo
+ 
+ 	if (file) {
+ 		seq_printf(m, " file=");
+-		seq_path(m, &file->f_path, "\n\t= ");
++		seq_path(m, &file->f_path, "\n\t\\= ");
+ 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+ 		seq_printf(m, " heap");
+ 	} else if (vma->vm_start <= mm->start_stack &&
+diff -urNp linux-2.6.32.14/mm/migrate.c linux-2.6.32.14/mm/migrate.c
+--- linux-2.6.32.14/mm/migrate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/migrate.c	2010-05-28 21:27:16.491098771 -0400
+@@ -1106,6 +1106,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	if (!mm)
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
++	if (mm != current->mm &&
++	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
++		err = -EPERM;
++		goto out;
++	}
++#endif
++
+ 	/*
+ 	 * Check if this process has the right to modify the specified
+ 	 * process. The right exists if the process has administrative
+@@ -1115,8 +1123,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+ 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
+-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
+-	    !capable(CAP_SYS_NICE)) {
++	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
+ 		rcu_read_unlock();
+ 		err = -EPERM;
+ 		goto out;
+diff -urNp linux-2.6.32.14/mm/mlock.c linux-2.6.32.14/mm/mlock.c
+--- linux-2.6.32.14/mm/mlock.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/mlock.c	2010-05-28 21:27:16.499256346 -0400
+@@ -13,6 +13,7 @@
+ #include <linux/pagemap.h>
+ #include <linux/mempolicy.h>
+ #include <linux/syscalls.h>
++#include <linux/security.h>
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ #include <linux/rmap.h>
+@@ -435,6 +436,17 @@ static int do_mlock(unsigned long start,
+ 		return -EINVAL;
+ 	if (end == start)
+ 		return 0;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	vma = find_vma_prev(current->mm, start, &prev);
+ 	if (!vma || vma->vm_start > start)
+ 		return -ENOMEM;
+@@ -494,6 +506,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	/* check against resource limits */
++	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
+ 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
+ 		error = do_mlock(start, len, 1);
+ 	up_write(&current->mm->mmap_sem);
+@@ -515,10 +528,10 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
+ static int do_mlockall(int flags)
+ {
+ 	struct vm_area_struct * vma, * prev = NULL;
+-	unsigned int def_flags = 0;
++	unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
+ 
+ 	if (flags & MCL_FUTURE)
+-		def_flags = VM_LOCKED;
++		def_flags |= VM_LOCKED;
+ 	current->mm->def_flags = def_flags;
+ 	if (flags == MCL_FUTURE)
+ 		goto out;
+@@ -526,6 +539,12 @@ static int do_mlockall(int flags)
+ 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
+ 		unsigned int newflags;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
++			break;
++#endif
++
++		BUG_ON(vma->vm_end > TASK_SIZE);
+ 		newflags = vma->vm_flags | VM_LOCKED;
+ 		if (!(flags & MCL_CURRENT))
+ 			newflags &= ~VM_LOCKED;
+@@ -557,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+ 	lock_limit >>= PAGE_SHIFT;
+ 
+ 	ret = -ENOMEM;
++	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
+ 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
+ 	    capable(CAP_IPC_LOCK))
+ 		ret = do_mlockall(flags);
+diff -urNp linux-2.6.32.14/mm/mmap.c linux-2.6.32.14/mm/mmap.c
+--- linux-2.6.32.14/mm/mmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/mmap.c	2010-05-28 21:27:16.502950026 -0400
+@@ -45,6 +45,16 @@
+ #define arch_rebalance_pgtables(addr, len)		(addr)
+ #endif
+ 
++static inline void verify_mm_writelocked(struct mm_struct *mm)
++{
++#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
++	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++		up_read(&mm->mmap_sem);
++		BUG();
++	}
++#endif
++}
++
+ static void unmap_region(struct mm_struct *mm,
+ 		struct vm_area_struct *vma, struct vm_area_struct *prev,
+ 		unsigned long start, unsigned long end);
+@@ -70,16 +80,25 @@ static void unmap_region(struct mm_struc
+  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
+  *
+  */
+-pgprot_t protection_map[16] = {
++pgprot_t protection_map[16] __read_only = {
+ 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+ 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
+ };
+ 
+ pgprot_t vm_get_page_prot(unsigned long vm_flags)
+ {
+-	return __pgprot(pgprot_val(protection_map[vm_flags &
++	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
+ 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
+ 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if (!nx_enabled &&
++	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
++	    (vm_flags & (VM_READ | VM_WRITE)))
++		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
++#endif
++
++	return prot;
+ }
+ EXPORT_SYMBOL(vm_get_page_prot);
+ 
+@@ -231,6 +250,7 @@ static struct vm_area_struct *remove_vma
+ 	struct vm_area_struct *next = vma->vm_next;
+ 
+ 	might_sleep();
++	BUG_ON(vma->vm_mirror);
+ 	if (vma->vm_ops && vma->vm_ops->close)
+ 		vma->vm_ops->close(vma);
+ 	if (vma->vm_file) {
+@@ -267,6 +287,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
+ 	 * not page aligned -Ram Gupta
+ 	 */
+ 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
++	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
+ 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
+ 			(mm->end_data - mm->start_data) > rlim)
+ 		goto out;
+@@ -694,6 +715,12 @@ static int
+ can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		if (vma->vm_pgoff == vm_pgoff)
+@@ -713,6 +740,12 @@ static int
+ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
+ 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
++		return 0;
++#endif
++
+ 	if (is_mergeable_vma(vma, file, vm_flags) &&
+ 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
+ 		pgoff_t vm_pglen;
+@@ -755,12 +788,19 @@ can_vma_merge_after(struct vm_area_struc
+ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ 			struct vm_area_struct *prev, unsigned long addr,
+ 			unsigned long end, unsigned long vm_flags,
+-		     	struct anon_vma *anon_vma, struct file *file,
++			struct anon_vma *anon_vma, struct file *file,
+ 			pgoff_t pgoff, struct mempolicy *policy)
+ {
+ 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
+ 	struct vm_area_struct *area, *next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
++	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
++
++	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
++#endif
++
+ 	/*
+ 	 * We later require that vma->vm_flags == vm_flags,
+ 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
+@@ -776,6 +816,15 @@ struct vm_area_struct *vma_merge(struct 
+ 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
+ 		next = next->vm_next;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (prev)
++		prev_m = pax_find_mirror_vma(prev);
++	if (area)
++		area_m = pax_find_mirror_vma(area);
++	if (next)
++		next_m = pax_find_mirror_vma(next);
++#endif
++
+ 	/*
+ 	 * Can it merge with the predecessor?
+ 	 */
+@@ -795,9 +844,24 @@ struct vm_area_struct *vma_merge(struct 
+ 							/* cases 1, 6 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				next->vm_end, prev->vm_pgoff, NULL);
+-		} else					/* cases 2, 5, 7 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					next_m->vm_end, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 2, 5, 7 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				end, prev->vm_pgoff, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					end_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		}
+ 		return prev;
+ 	}
+ 
+@@ -808,12 +872,27 @@ struct vm_area_struct *vma_merge(struct 
+  			mpol_equal(policy, vma_policy(next)) &&
+ 			can_vma_merge_before(next, vm_flags,
+ 					anon_vma, file, pgoff+pglen)) {
+-		if (prev && addr < prev->vm_end)	/* case 4 */
++		if (prev && addr < prev->vm_end) {	/* case 4 */
+ 			vma_adjust(prev, prev->vm_start,
+ 				addr, prev->vm_pgoff, NULL);
+-		else					/* cases 3, 8 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (prev_m)
++				vma_adjust(prev_m, prev_m->vm_start,
++					addr_m, prev_m->vm_pgoff, NULL);
++#endif
++
++		} else {				/* cases 3, 8 */
+ 			vma_adjust(area, addr, next->vm_end,
+ 				next->vm_pgoff - pglen, NULL);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (area_m)
++				vma_adjust(area_m, addr_m, next_m->vm_end,
++					next_m->vm_pgoff - pglen, NULL);
++#endif
++
++		}
+ 		return area;
+ 	}
+ 
+@@ -888,14 +967,11 @@ none:
+ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+ 						struct file *file, long pages)
+ {
+-	const unsigned long stack_flags
+-		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
+-
+ 	if (file) {
+ 		mm->shared_vm += pages;
+ 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
+ 			mm->exec_vm += pages;
+-	} else if (flags & stack_flags)
++	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
+ 		mm->stack_vm += pages;
+ 	if (flags & (VM_RESERVED|VM_IO))
+ 		mm->reserved_vm += pages;
+@@ -922,7 +998,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	 * (the exception is when the underlying filesystem is noexec
+ 	 *  mounted, in which case we dont add PROT_EXEC.)
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
+ 			prot |= PROT_EXEC;
+ 
+@@ -948,7 +1024,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 	/* Obtain the address to map to. we verify (or select) it and ensure
+ 	 * that it represents a valid section of the address space.
+ 	 */
+-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
++	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
+ 	if (addr & ~PAGE_MASK)
+ 		return addr;
+ 
+@@ -959,6 +1035,26 @@ unsigned long do_mmap_pgoff(struct file 
+ 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
+ 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT) {
++			if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
++				vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++			else
++				vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++		}
++#endif
++
++	}
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
++		vm_flags &= ~VM_PAGEEXEC;
++#endif
++
+ 	if (flags & MAP_LOCKED)
+ 		if (!can_do_mlock())
+ 			return -EPERM;
+@@ -970,6 +1066,7 @@ unsigned long do_mmap_pgoff(struct file 
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
+ 			return -EAGAIN;
+ 	}
+@@ -1043,6 +1140,9 @@ unsigned long do_mmap_pgoff(struct file 
+ 	if (error)
+ 		return error;
+ 
++	if (!gr_acl_handle_mmap(file, prot))
++		return -EACCES;
++
+ 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
+ }
+ EXPORT_SYMBOL(do_mmap_pgoff);
+@@ -1055,10 +1155,10 @@ EXPORT_SYMBOL(do_mmap_pgoff);
+  */
+ int vma_wants_writenotify(struct vm_area_struct *vma)
+ {
+-	unsigned int vm_flags = vma->vm_flags;
++	unsigned long vm_flags = vma->vm_flags;
+ 
+ 	/* If it was private or non-writable, the write bit is already clear */
+-	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
++	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
+ 		return 0;
+ 
+ 	/* The backer wishes to know when pages are first written to? */
+@@ -1107,14 +1207,24 @@ unsigned long mmap_region(struct file *f
+ 	unsigned long charged = 0;
+ 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	/* Clear old maps */
+ 	error = -ENOMEM;
+-munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limit. */
+@@ -1163,6 +1273,16 @@ munmap_back:
+ 		goto unacct_error;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			error = -ENOMEM;
++			goto free_vma;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -1185,6 +1305,19 @@ munmap_back:
+ 		error = file->f_op->mmap(file, vma);
+ 		if (error)
+ 			goto unmap_and_free_vma;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma_m && (vm_flags & VM_EXECUTABLE))
++			added_exe_file_vma(mm);
++#endif
++
++#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
++		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
++			vma->vm_flags |= VM_PAGEEXEC;
++			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
++		}
++#endif
++
+ 		if (vm_flags & VM_EXECUTABLE)
+ 			added_exe_file_vma(mm);
+ 
+@@ -1208,6 +1341,11 @@ munmap_back:
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ 	file = vma->vm_file;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	/* Once vma denies write, undo our temporary denial count */
+ 	if (correct_wcount)
+ 		atomic_inc(&inode->i_writecount);
+@@ -1216,6 +1354,7 @@ out:
+ 
+ 	mm->total_vm += len >> PAGE_SHIFT;
+ 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
++	track_exec_limit(mm, addr, addr + len, vm_flags);
+ 	if (vm_flags & VM_LOCKED) {
+ 		/*
+ 		 * makes pages present; downgrades, drops, reacquires mmap_sem
+@@ -1238,6 +1377,12 @@ unmap_and_free_vma:
+ 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
+ 	charged = 0;
+ free_vma:
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		kmem_cache_free(vm_area_cachep, vma_m);
++#endif
++
+ 	kmem_cache_free(vm_area_cachep, vma);
+ unacct_error:
+ 	if (charged)
+@@ -1271,6 +1416,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+ 		vma = find_vma(mm, addr);
+@@ -1279,10 +1428,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -1293,9 +1442,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				addr = TASK_UNMAPPED_BASE;
+-			        start_addr = addr;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+@@ -1317,10 +1465,16 @@ full_search:
+ 
+ void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the lowest possible address?
+ 	 */
+-	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
++	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
+ 		mm->free_area_cache = addr;
+ 		mm->cached_hole_size = ~0UL;
+ 	}
+@@ -1338,7 +1492,7 @@ arch_get_unmapped_area_topdown(struct fi
+ {
+ 	struct vm_area_struct *vma;
+ 	struct mm_struct *mm = current->mm;
+-	unsigned long addr = addr0;
++	unsigned long base = mm->mmap_base, addr = addr0;
+ 
+ 	/* requested length too big for entire address space */
+ 	if (len > TASK_SIZE)
+@@ -1347,6 +1501,10 @@ arch_get_unmapped_area_topdown(struct fi
+ 	if (flags & MAP_FIXED)
+ 		return addr;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
++#endif
++
+ 	/* requesting a specific address */
+ 	if (addr) {
+ 		addr = PAGE_ALIGN(addr);
+@@ -1404,13 +1562,21 @@ bottomup:
+ 	 * can happen with large stack limits and large mmap()
+ 	 * allocations.
+ 	 */
++	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
++	mm->free_area_cache = mm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+-  	mm->free_area_cache = TASK_UNMAPPED_BASE;
+ 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+ 	/*
+ 	 * Restore the topdown base:
+ 	 */
+-	mm->free_area_cache = mm->mmap_base;
++	mm->mmap_base = base;
++	mm->free_area_cache = base;
+ 	mm->cached_hole_size = ~0UL;
+ 
+ 	return addr;
+@@ -1419,6 +1585,12 @@ bottomup:
+ 
+ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
+ {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
++		return;
++#endif
++
+ 	/*
+ 	 * Is this a new hole at the highest possible address?
+ 	 */
+@@ -1426,8 +1598,10 @@ void arch_unmap_area_topdown(struct mm_s
+ 		mm->free_area_cache = addr;
+ 
+ 	/* dont allow allocations above current base */
+-	if (mm->free_area_cache > mm->mmap_base)
++	if (mm->free_area_cache > mm->mmap_base) {
+ 		mm->free_area_cache = mm->mmap_base;
++		mm->cached_hole_size = ~0UL;
++	}
+ }
+ 
+ unsigned long
+@@ -1535,6 +1709,27 @@ out:
+ 	return prev ? prev->vm_next : vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
++{
++	struct vm_area_struct *vma_m;
++
++	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
++	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
++		BUG_ON(vma->vm_mirror);
++		return NULL;
++	}
++	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
++	vma_m = vma->vm_mirror;
++	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
++	BUG_ON(vma->vm_file != vma_m->vm_file);
++	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
++	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
++	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
++	return vma_m;
++}
++#endif
++
+ /*
+  * Verify that the stack growth is acceptable and
+  * update accounting. This is shared with both the
+@@ -1551,6 +1746,7 @@ static int acct_stack_growth(struct vm_a
+ 		return -ENOMEM;
+ 
+ 	/* Stack limit test */
++	gr_learn_resource(current, RLIMIT_STACK, size, 1);
+ 	if (size > rlim[RLIMIT_STACK].rlim_cur)
+ 		return -ENOMEM;
+ 
+@@ -1560,6 +1756,7 @@ static int acct_stack_growth(struct vm_a
+ 		unsigned long limit;
+ 		locked = mm->locked_vm + grow;
+ 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
++		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
+ 		if (locked > limit && !capable(CAP_IPC_LOCK))
+ 			return -ENOMEM;
+ 	}
+@@ -1595,35 +1792,40 @@ static
+ #endif
+ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ {
+-	int error;
++	int error, locknext;
+ 
+ 	if (!(vma->vm_flags & VM_GROWSUP))
+ 		return -EFAULT;
+ 
++	/* Also guard against wrapping around to address 0. */
++	if (address < PAGE_ALIGN(address+1))
++		address = PAGE_ALIGN(address+1);
++	else
++		return -ENOMEM;
++
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+ 	 * so that the anon_vma locking is not a noop.
+ 	 */
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		return -ENOMEM;
++	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
++	if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
++		return -ENOMEM;
+ 	anon_vma_lock(vma);
++	if (locknext)
++		anon_vma_lock(vma->vm_next);
+ 
+ 	/*
+ 	 * vma->vm_start/vm_end cannot change under us because the caller
+ 	 * is required to hold the mmap_sem in read mode.  We need the
+-	 * anon_vma lock to serialize against concurrent expand_stacks.
+-	 * Also guard against wrapping around to address 0.
++	 * anon_vma locks to serialize against concurrent expand_stacks
++	 * and expand_upwards.
+ 	 */
+-	if (address < PAGE_ALIGN(address+4))
+-		address = PAGE_ALIGN(address+4);
+-	else {
+-		anon_vma_unlock(vma);
+-		return -ENOMEM;
+-	}
+ 	error = 0;
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address > vma->vm_end) {
++	if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
+ 		unsigned long size, grow;
+ 
+ 		size = address - vma->vm_start;
+@@ -1633,6 +1835,8 @@ int expand_upwards(struct vm_area_struct
+ 		if (!error)
+ 			vma->vm_end = address;
+ 	}
++	if (locknext)
++		anon_vma_unlock(vma->vm_next);
+ 	anon_vma_unlock(vma);
+ 	return error;
+ }
+@@ -1644,7 +1848,8 @@ int expand_upwards(struct vm_area_struct
+ static int expand_downwards(struct vm_area_struct *vma,
+ 				   unsigned long address)
+ {
+-	int error;
++	int error, lockprev = 0;
++	struct vm_area_struct *prev = NULL;
+ 
+ 	/*
+ 	 * We must make sure the anon_vma is allocated
+@@ -1658,6 +1863,15 @@ static int expand_downwards(struct vm_ar
+ 	if (error)
+ 		return error;
+ 
++#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
++	find_vma_prev(vma->vm_mm, address, &prev);
++	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
++#endif
++	if (lockprev && unlikely(anon_vma_prepare(prev)))
++		return -ENOMEM;
++	if (lockprev)
++		anon_vma_lock(prev);
++
+ 	anon_vma_lock(vma);
+ 
+ 	/*
+@@ -1667,9 +1881,15 @@ static int expand_downwards(struct vm_ar
+ 	 */
+ 
+ 	/* Somebody else might have raced and expanded it already */
+-	if (address < vma->vm_start) {
++	if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
+ 		unsigned long size, grow;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++
++		vma_m = pax_find_mirror_vma(vma);
++#endif
++
+ 		size = vma->vm_end - address;
+ 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 
+@@ -1677,9 +1897,20 @@ static int expand_downwards(struct vm_ar
+ 		if (!error) {
+ 			vma->vm_start = address;
+ 			vma->vm_pgoff -= grow;
++			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			if (vma_m) {
++				vma_m->vm_start -= grow << PAGE_SHIFT;
++				vma_m->vm_pgoff -= grow;
++			}
++#endif
++
+ 		}
+ 	}
+ 	anon_vma_unlock(vma);
++	if (lockprev)
++		anon_vma_unlock(prev);
+ 	return error;
+ }
+ 
+@@ -1755,6 +1986,13 @@ static void remove_vma_list(struct mm_st
+ 	do {
+ 		long nrpages = vma_pages(vma);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
++			vma = remove_vma(vma);
++			continue;
++		}
++#endif
++
+ 		mm->total_vm -= nrpages;
+ 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
+ 		vma = remove_vma(vma);
+@@ -1799,6 +2037,16 @@ detach_vmas_to_be_unmapped(struct mm_str
+ 
+ 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
+ 	do {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (vma->vm_mirror) {
++			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
++			vma->vm_mirror->vm_mirror = NULL;
++			vma->vm_mirror->vm_flags &= ~VM_EXEC;
++			vma->vm_mirror = NULL;
++		}
++#endif
++
+ 		rb_erase(&vma->vm_rb, &mm->mm_rb);
+ 		mm->map_count--;
+ 		tail_vma = vma;
+@@ -1824,10 +2072,25 @@ int split_vma(struct mm_struct * mm, str
+ 	struct mempolicy *pol;
+ 	struct vm_area_struct *new;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m, *new_m = NULL;
++	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (is_vm_hugetlb_page(vma) && (addr &
+ 					~(huge_page_mask(hstate_vma(vma)))))
+ 		return -EINVAL;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	vma_m = pax_find_mirror_vma(vma);
++
++	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
++		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
++		if (mm->map_count >= sysctl_max_map_count-1)
++			return -ENOMEM;
++	} else
++#endif
++
+ 	if (mm->map_count >= sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+@@ -1835,6 +2098,16 @@ int split_vma(struct mm_struct * mm, str
+ 	if (!new)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
++		if (!new_m) {
++			kmem_cache_free(vm_area_cachep, new);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	/* most fields are the same, copy all, and then fixup */
+ 	*new = *vma;
+ 
+@@ -1845,8 +2118,29 @@ int split_vma(struct mm_struct * mm, str
+ 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		*new_m = *vma_m;
++		new_m->vm_mirror = new;
++		new->vm_mirror = new_m;
++
++		if (new_below)
++			new_m->vm_end = addr_m;
++		else {
++			new_m->vm_start = addr_m;
++			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
++		}
++	}
++#endif
++
+ 	pol = mpol_dup(vma_policy(vma));
+ 	if (IS_ERR(pol)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++		if (new_m)
++			kmem_cache_free(vm_area_cachep, new_m);
++#endif
++
+ 		kmem_cache_free(vm_area_cachep, new);
+ 		return PTR_ERR(pol);
+ 	}
+@@ -1867,6 +2161,28 @@ int split_vma(struct mm_struct * mm, str
+ 	else
+ 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m) {
++		mpol_get(pol);
++		vma_set_policy(new_m, pol);
++
++		if (new_m->vm_file) {
++			get_file(new_m->vm_file);
++			if (vma_m->vm_flags & VM_EXECUTABLE)
++				added_exe_file_vma(mm);
++		}
++
++		if (new_m->vm_ops && new_m->vm_ops->open)
++			new_m->vm_ops->open(new_m);
++
++		if (new_below)
++			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
++				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
++		else
++			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -1875,11 +2191,30 @@ int split_vma(struct mm_struct * mm, str
+  * work.  This now handles partial unmappings.
+  * Jeremy Fitzhardinge <jeremy@goop.org>
+  */
++#ifdef CONFIG_PAX_SEGMEXEC
+ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ {
++	int ret = __do_munmap(mm, start, len);
++	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
++		return ret;
++
++	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
++}
++
++int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#else
++int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++#endif
++{
+ 	unsigned long end;
+ 	struct vm_area_struct *vma, *prev, *last;
+ 
++	/*
++	 * mm->mmap_sem is required to protect against another thread
++	 * changing the mappings in case we sleep.
++	 */
++	verify_mm_writelocked(mm);
++
+ 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
+ 		return -EINVAL;
+ 
+@@ -1943,6 +2278,8 @@ int do_munmap(struct mm_struct *mm, unsi
+ 	/* Fix up all other VM information */
+ 	remove_vma_list(mm, vma);
+ 
++	track_exec_limit(mm, start, end, 0UL);
++
+ 	return 0;
+ }
+ 
+@@ -1955,22 +2292,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
+ 
+ 	profile_munmap(addr);
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
++	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
++		return -EINVAL;
++#endif
++
+ 	down_write(&mm->mmap_sem);
+ 	ret = do_munmap(mm, addr, len);
+ 	up_write(&mm->mmap_sem);
+ 	return ret;
+ }
+ 
+-static inline void verify_mm_writelocked(struct mm_struct *mm)
+-{
+-#ifdef CONFIG_DEBUG_VM
+-	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
+-		WARN_ON(1);
+-		up_read(&mm->mmap_sem);
+-	}
+-#endif
+-}
+-
+ /*
+  *  this is really a simplified "do_mmap".  it only handles
+  *  anonymous maps.  eventually we may be able to do some
+@@ -1984,6 +2317,11 @@ unsigned long do_brk(unsigned long addr,
+ 	struct rb_node ** rb_link, * rb_parent;
+ 	pgoff_t pgoff = addr >> PAGE_SHIFT;
+ 	int error;
++	unsigned long charged;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
+ 
+ 	len = PAGE_ALIGN(len);
+ 	if (!len)
+@@ -1995,16 +2333,30 @@ unsigned long do_brk(unsigned long addr,
+ 
+ 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
+ 
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
++	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
++		flags &= ~VM_EXEC;
++
++#ifdef CONFIG_PAX_MPROTECT
++		if (mm->pax_flags & MF_PAX_MPROTECT)
++			flags &= ~VM_MAYEXEC;
++#endif
++
++	}
++#endif
++
+ 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
+ 	if (error & ~PAGE_MASK)
+ 		return error;
+ 
++	charged = len >> PAGE_SHIFT;
++
+ 	/*
+ 	 * mlock MCL_FUTURE?
+ 	 */
+ 	if (mm->def_flags & VM_LOCKED) {
+ 		unsigned long locked, lock_limit;
+-		locked = len >> PAGE_SHIFT;
++		locked = charged;
+ 		locked += mm->locked_vm;
+ 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+ 		lock_limit >>= PAGE_SHIFT;
+@@ -2021,22 +2373,22 @@ unsigned long do_brk(unsigned long addr,
+ 	/*
+ 	 * Clear old maps.  this also does some error checking for us
+ 	 */
+- munmap_back:
+ 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ 	if (vma && vma->vm_start < addr + len) {
+ 		if (do_munmap(mm, addr, len))
+ 			return -ENOMEM;
+-		goto munmap_back;
++		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
++		BUG_ON(vma && vma->vm_start < addr + len);
+ 	}
+ 
+ 	/* Check against address space limits *after* clearing old maps... */
+-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
++	if (!may_expand_vm(mm, charged))
+ 		return -ENOMEM;
+ 
+ 	if (mm->map_count > sysctl_max_map_count)
+ 		return -ENOMEM;
+ 
+-	if (security_vm_enough_memory(len >> PAGE_SHIFT))
++	if (security_vm_enough_memory(charged))
+ 		return -ENOMEM;
+ 
+ 	/* Can we just expand an old private anonymous mapping? */
+@@ -2050,10 +2402,21 @@ unsigned long do_brk(unsigned long addr,
+ 	 */
+ 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+ 	if (!vma) {
+-		vm_unacct_memory(len >> PAGE_SHIFT);
++		vm_unacct_memory(charged);
+ 		return -ENOMEM;
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m) {
++			kmem_cache_free(vm_area_cachep, vma);
++			vm_unacct_memory(charged);
++			return -ENOMEM;
++		}
++	}
++#endif
++
+ 	vma->vm_mm = mm;
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+@@ -2062,11 +2425,12 @@ unsigned long do_brk(unsigned long addr,
+ 	vma->vm_page_prot = vm_get_page_prot(flags);
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
+ out:
+-	mm->total_vm += len >> PAGE_SHIFT;
++	mm->total_vm += charged;
+ 	if (flags & VM_LOCKED) {
+ 		if (!mlock_vma_pages_range(vma, addr, addr + len))
+-			mm->locked_vm += (len >> PAGE_SHIFT);
++			mm->locked_vm += charged;
+ 	}
++	track_exec_limit(mm, addr, addr + len, flags);
+ 	return addr;
+ }
+ 
+@@ -2113,8 +2477,10 @@ void exit_mmap(struct mm_struct *mm)
+ 	 * Walk the list again, actually closing and freeing it,
+ 	 * with preemption enabled, without holding any MM locks.
+ 	 */
+-	while (vma)
++	while (vma) {
++		vma->vm_mirror = NULL;
+ 		vma = remove_vma(vma);
++	}
+ 
+ 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
+ }
+@@ -2128,6 +2494,10 @@ int insert_vm_struct(struct mm_struct * 
+ 	struct vm_area_struct * __vma, * prev;
+ 	struct rb_node ** rb_link, * rb_parent;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++#endif
++
+ 	/*
+ 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
+ 	 * until its first write fault, when page's anon_vma and index
+@@ -2150,7 +2520,22 @@ int insert_vm_struct(struct mm_struct * 
+ 	if ((vma->vm_flags & VM_ACCOUNT) &&
+ 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
++		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++		if (!vma_m)
++			return -ENOMEM;
++	}
++#endif
++
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (vma_m)
++		pax_mirror_vma(vma_m, vma);
++#endif
++
+ 	return 0;
+ }
+ 
+@@ -2168,6 +2553,8 @@ struct vm_area_struct *copy_vma(struct v
+ 	struct rb_node **rb_link, *rb_parent;
+ 	struct mempolicy *pol;
+ 
++	BUG_ON(vma->vm_mirror);
++
+ 	/*
+ 	 * If anonymous vma has not yet been faulted, update new pgoff
+ 	 * to match new location, to increase its chance of merging.
+@@ -2211,6 +2598,35 @@ struct vm_area_struct *copy_vma(struct v
+ 	return new_vma;
+ }
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
++{
++	struct vm_area_struct *prev_m;
++	struct rb_node **rb_link_m, *rb_parent_m;
++	struct mempolicy *pol_m;
++
++	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
++	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
++	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
++	*vma_m = *vma;
++	pol_m = vma_policy(vma_m);
++	mpol_get(pol_m);
++	vma_set_policy(vma_m, pol_m);
++	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
++	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
++	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
++	if (vma_m->vm_file)
++		get_file(vma_m->vm_file);
++	if (vma_m->vm_ops && vma_m->vm_ops->open)
++		vma_m->vm_ops->open(vma_m);
++	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
++	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
++	vma_m->vm_mirror = vma;
++	vma->vm_mirror = vma_m;
++}
++#endif
++
+ /*
+  * Return true if the calling process may expand its vm space by the passed
+  * number of pages
+@@ -2221,7 +2637,7 @@ int may_expand_vm(struct mm_struct *mm, 
+ 	unsigned long lim;
+ 
+ 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+-
++	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
+ 	if (cur + npages > lim)
+ 		return 0;
+ 	return 1;
+@@ -2290,6 +2706,15 @@ int install_special_mapping(struct mm_st
+ 	vma->vm_start = addr;
+ 	vma->vm_end = addr + len;
+ 
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->pax_flags & MF_PAX_MPROTECT) {
++		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
++			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
++		else
++			vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
++	}
++#endif
++
+ 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 
+diff -urNp linux-2.6.32.14/mm/mprotect.c linux-2.6.32.14/mm/mprotect.c
+--- linux-2.6.32.14/mm/mprotect.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/mprotect.c	2010-05-28 21:27:16.502950026 -0400
+@@ -24,10 +24,16 @@
+ #include <linux/mmu_notifier.h>
+ #include <linux/migrate.h>
+ #include <linux/perf_event.h>
++
++#ifdef CONFIG_PAX_MPROTECT
++#include <linux/elf.h>
++#endif
++
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+ #include <asm/cacheflush.h>
+ #include <asm/tlbflush.h>
++#include <asm/mmu_context.h>
+ 
+ #ifndef pgprot_modify
+ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
+@@ -132,6 +138,48 @@ static void change_protection(struct vm_
+ 	flush_tlb_range(vma, start, end);
+ }
+ 
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++/* called while holding the mmap semaphor for writing except stack expansion */
++void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
++{
++	unsigned long oldlimit, newlimit = 0UL;
++
++	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
++		return;
++
++	spin_lock(&mm->page_table_lock);
++	oldlimit = mm->context.user_cs_limit;
++	if ((prot & VM_EXEC) && oldlimit < end)
++		/* USER_CS limit moved up */
++		newlimit = end;
++	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
++		/* USER_CS limit moved down */
++		newlimit = start;
++
++	if (newlimit) {
++		mm->context.user_cs_limit = newlimit;
++
++#ifdef CONFIG_SMP
++		wmb();
++		cpus_clear(mm->context.cpu_user_cs_mask);
++		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
++#endif
++
++		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
++	}
++	spin_unlock(&mm->page_table_lock);
++	if (newlimit == end) {
++		struct vm_area_struct *vma = find_vma(mm, oldlimit);
++
++		for (; vma && vma->vm_start < end; vma = vma->vm_next)
++			if (is_vm_hugetlb_page(vma))
++				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
++			else
++				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
++	}
++}
++#endif
++
+ int
+ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
+ 	unsigned long start, unsigned long end, unsigned long newflags)
+@@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
+ 	int error;
+ 	int dirty_accountable = 0;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	struct vm_area_struct *vma_m = NULL;
++	unsigned long start_m, end_m;
++
++	start_m = start + SEGMEXEC_TASK_SIZE;
++	end_m = end + SEGMEXEC_TASK_SIZE;
++#endif
++
+ 	if (newflags == oldflags) {
+ 		*pprev = vma;
+ 		return 0;
+@@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
+ 		}
+ 	}
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
++		if (start != vma->vm_start) {
++			error = split_vma(mm, vma, start, 1);
++			if (error)
++				goto fail;
++			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
++			*pprev = (*pprev)->vm_next;
++		}
++
++		if (end != vma->vm_end) {
++			error = split_vma(mm, vma, end, 0);
++			if (error)
++				goto fail;
++		}
++
++		if (pax_find_mirror_vma(vma)) {
++			error = __do_munmap(mm, start_m, end_m - start_m);
++			if (error)
++				goto fail;
++		} else {
++			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
++			if (!vma_m) {
++				error = -ENOMEM;
++				goto fail;
++			}
++			vma->vm_flags = newflags;
++			pax_mirror_vma(vma_m, vma);
++		}
++	}
++#endif
++
+ 	/*
+ 	 * First try to merge with previous and/or next vma.
+ 	 */
+@@ -195,9 +283,21 @@ success:
+ 	 * vm_flags and vm_page_prot are protected by the mmap_sem
+ 	 * held in write mode.
+ 	 */
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
++		pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
++#endif
++
+ 	vma->vm_flags = newflags;
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (mm->binfmt && mm->binfmt->handle_mprotect)
++		mm->binfmt->handle_mprotect(vma, newflags);
++#endif
++
+ 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
+-					  vm_get_page_prot(newflags));
++					  vm_get_page_prot(vma->vm_flags));
+ 
+ 	if (vma_wants_writenotify(vma)) {
+ 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
+@@ -238,6 +338,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	end = start + len;
+ 	if (end <= start)
+ 		return -ENOMEM;
++
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
++		if (end > SEGMEXEC_TASK_SIZE)
++			return -EINVAL;
++	} else
++#endif
++
++	if (end > TASK_SIZE)
++		return -EINVAL;
++
+ 	if (!arch_validate_prot(prot))
+ 		return -EINVAL;
+ 
+@@ -245,7 +356,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	/*
+ 	 * Does the application expect PROT_READ to imply PROT_EXEC:
+ 	 */
+-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
++	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
+ 		prot |= PROT_EXEC;
+ 
+ 	vm_flags = calc_vm_prot_bits(prot);
+@@ -277,6 +388,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 	if (start > vma->vm_start)
+ 		prev = vma;
+ 
++	if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
++		error = -EACCES;
++		goto out;
++	}
++
++#ifdef CONFIG_PAX_MPROTECT
++	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
++		current->mm->binfmt->handle_mprotect(vma, vm_flags);
++#endif
++
+ 	for (nstart = start ; ; ) {
+ 		unsigned long newflags;
+ 
+@@ -301,6 +422,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
+ 		if (error)
+ 			goto out;
+ 		perf_event_mmap(vma);
++
++		track_exec_limit(current->mm, nstart, tmp, vm_flags);
++
+ 		nstart = tmp;
+ 
+ 		if (nstart < prev->vm_end)
+diff -urNp linux-2.6.32.14/mm/mremap.c linux-2.6.32.14/mm/mremap.c
+--- linux-2.6.32.14/mm/mremap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/mremap.c	2010-05-28 21:27:16.502950026 -0400
+@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
+ 			continue;
+ 		pte = ptep_clear_flush(vma, old_addr, old_pte);
+ 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
++
++#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
++		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
++			pte = pte_exprotect(pte);
++#endif
++
+ 		set_pte_at(mm, new_addr, new_pte, pte);
+ 	}
+ 
+@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
+ 	if (is_vm_hugetlb_page(vma))
+ 		goto Einval;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (pax_find_mirror_vma(vma))
++		goto Einval;
++#endif
++
+ 	/* We can't remap across vm area boundaries */
+ 	if (old_len > vma->vm_end - addr)
+ 		goto Efault;
+@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
+ 	unsigned long map_flags;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (new_addr & ~PAGE_MASK)
+ 		goto out;
+ 
+-	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
+ 		goto out;
+ 
+ 	/* Check if the location we're moving into overlaps the
+ 	 * old location at all, and fail if it does.
+ 	 */
+-	if ((new_addr <= addr) && (new_addr+new_len) > addr)
+-		goto out;
+-
+-	if ((addr <= new_addr) && (addr+old_len) > new_addr)
++	if (addr + old_len > new_addr && new_addr + new_len > addr)
+ 		goto out;
+ 
+ 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
+ 	struct vm_area_struct *vma;
+ 	unsigned long ret = -EINVAL;
+ 	unsigned long charged = 0;
++	unsigned long pax_task_size = TASK_SIZE;
+ 
+ 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+ 		goto out;
+@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
+ 	if (!new_len)
+ 		goto out;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++	if (mm->pax_flags & MF_PAX_SEGMEXEC)
++		pax_task_size = SEGMEXEC_TASK_SIZE;
++#endif
++
++	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
++	    old_len > pax_task_size || addr > pax_task_size-old_len)
++		goto out;
++
+ 	if (flags & MREMAP_FIXED) {
+ 		if (flags & MREMAP_MAYMOVE)
+ 			ret = mremap_to(addr, old_len, new_addr, new_len);
+@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
+ 						   addr + new_len);
+ 			}
+ 			ret = addr;
++			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
+ 			goto out;
+ 		}
+ 	}
+@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
+ 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+ 		if (ret)
+ 			goto out;
++
++		map_flags = vma->vm_flags;
+ 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
++		if (!(ret & ~PAGE_MASK)) {
++			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
++			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
++		}
+ 	}
+ out:
+ 	if (ret & ~PAGE_MASK)
+diff -urNp linux-2.6.32.14/mm/nommu.c linux-2.6.32.14/mm/nommu.c
+--- linux-2.6.32.14/mm/nommu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/nommu.c	2010-05-28 21:27:16.502950026 -0400
+@@ -758,15 +758,6 @@ struct vm_area_struct *find_vma(struct m
+ EXPORT_SYMBOL(find_vma);
+ 
+ /*
+- * find a VMA
+- * - we don't extend stack VMAs under NOMMU conditions
+- */
+-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
+-{
+-	return find_vma(mm, addr);
+-}
+-
+-/*
+  * expand a stack to a given address
+  * - not supported under NOMMU conditions
+  */
+diff -urNp linux-2.6.32.14/mm/page_alloc.c linux-2.6.32.14/mm/page_alloc.c
+--- linux-2.6.32.14/mm/page_alloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/page_alloc.c	2010-05-28 21:27:16.530961628 -0400
+@@ -586,6 +586,10 @@ static void __free_pages_ok(struct page 
+ 	int bad = 0;
+ 	int wasMlocked = __TestClearPageMlocked(page);
+ 
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	unsigned long index = 1UL << order;
++#endif
++
+ 	kmemcheck_free_shadow(page, order);
+ 
+ 	for (i = 0 ; i < (1 << order) ; ++i)
+@@ -598,6 +602,12 @@ static void __free_pages_ok(struct page 
+ 		debug_check_no_obj_freed(page_address(page),
+ 					   PAGE_SIZE << order);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	for (; index; --index)
++		sanitize_highpage(page + index - 1);
++#endif
++
+ 	arch_free_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 0);
+ 
+@@ -701,8 +711,10 @@ static int prep_new_page(struct page *pa
+ 	arch_alloc_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 1);
+ 
++#ifndef CONFIG_PAX_MEMORY_SANITIZE
+ 	if (gfp_flags & __GFP_ZERO)
+ 		prep_zero_page(page, order, gfp_flags);
++#endif
+ 
+ 	if (order && (gfp_flags & __GFP_COMP))
+ 		prep_compound_page(page, order);
+@@ -1096,6 +1108,11 @@ static void free_hot_cold_page(struct pa
+ 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
+ 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
+ 	}
++
++#ifdef CONFIG_PAX_MEMORY_SANITIZE
++	sanitize_highpage(page);
++#endif
++
+ 	arch_free_page(page, 0);
+ 	kernel_map_pages(page, 1, 0);
+ 
+@@ -3723,7 +3740,7 @@ static void __init setup_usemap(struct p
+ 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
+ }
+ #else
+-static void inline setup_usemap(struct pglist_data *pgdat,
++static inline void setup_usemap(struct pglist_data *pgdat,
+ 				struct zone *zone, unsigned long zonesize) {}
+ #endif /* CONFIG_SPARSEMEM */
+ 
+diff -urNp linux-2.6.32.14/mm/percpu.c linux-2.6.32.14/mm/percpu.c
+--- linux-2.6.32.14/mm/percpu.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/percpu.c	2010-05-28 21:27:16.530961628 -0400
+@@ -115,7 +115,7 @@ static unsigned int pcpu_first_unit_cpu 
+ static unsigned int pcpu_last_unit_cpu __read_mostly;
+ 
+ /* the address of the first chunk which starts with the kernel static area */
+-void *pcpu_base_addr __read_mostly;
++void *pcpu_base_addr __read_only;
+ EXPORT_SYMBOL_GPL(pcpu_base_addr);
+ 
+ static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
+diff -urNp linux-2.6.32.14/mm/rmap.c linux-2.6.32.14/mm/rmap.c
+--- linux-2.6.32.14/mm/rmap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/rmap.c	2010-05-28 21:27:16.539259032 -0400
+@@ -108,6 +108,10 @@ int anon_vma_prepare(struct vm_area_stru
+ 		struct mm_struct *mm = vma->vm_mm;
+ 		struct anon_vma *allocated;
+ 
++#ifdef CONFIG_PAX_SEGMEXEC
++		struct vm_area_struct *vma_m;
++#endif
++
+ 		anon_vma = find_mergeable_anon_vma(vma);
+ 		allocated = NULL;
+ 		if (!anon_vma) {
+@@ -121,6 +125,16 @@ int anon_vma_prepare(struct vm_area_stru
+ 		/* page_table_lock to protect against threads */
+ 		spin_lock(&mm->page_table_lock);
+ 		if (likely(!vma->anon_vma)) {
++
++#ifdef CONFIG_PAX_SEGMEXEC
++			vma_m = pax_find_mirror_vma(vma);
++			if (vma_m) {
++				BUG_ON(vma_m->anon_vma);
++				vma_m->anon_vma = anon_vma;
++				list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
++			}
++#endif
++
+ 			vma->anon_vma = anon_vma;
+ 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
+ 			allocated = NULL;
+diff -urNp linux-2.6.32.14/mm/shmem.c linux-2.6.32.14/mm/shmem.c
+--- linux-2.6.32.14/mm/shmem.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/shmem.c	2010-05-28 21:27:16.543245570 -0400
+@@ -31,7 +31,7 @@
+ #include <linux/swap.h>
+ #include <linux/ima.h>
+ 
+-static struct vfsmount *shm_mnt;
++struct vfsmount *shm_mnt;
+ 
+ #ifdef CONFIG_SHMEM
+ /*
+diff -urNp linux-2.6.32.14/mm/slab.c linux-2.6.32.14/mm/slab.c
+--- linux-2.6.32.14/mm/slab.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/slab.c	2010-05-29 17:19:33.609046968 -0400
+@@ -308,7 +308,7 @@ struct kmem_list3 {
+  * Need this for bootstrapping a per node allocator.
+  */
+ #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
+-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
++struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
+ #define	CACHE_CACHE 0
+ #define	SIZE_AC MAX_NUMNODES
+ #define	SIZE_L3 (2 * MAX_NUMNODES)
+@@ -558,7 +558,7 @@ static inline void *index_to_obj(struct 
+  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
+  */
+ static inline unsigned int obj_to_index(const struct kmem_cache *cache,
+-					const struct slab *slab, void *obj)
++					const struct slab *slab, const void *obj)
+ {
+ 	u32 offset = (obj - slab->s_mem);
+ 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
+@@ -584,14 +584,14 @@ struct cache_names {
+ static struct cache_names __initdata cache_names[] = {
+ #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
+ #include <linux/kmalloc_sizes.h>
+-	{NULL,}
++	{NULL, NULL}
+ #undef CACHE
+ };
+ 
+ static struct arraycache_init initarray_cache __initdata =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ static struct arraycache_init initarray_generic =
+-    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
++    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+ 
+ /* internal cache of cache description objs */
+ static struct kmem_cache cache_cache = {
+@@ -4471,15 +4471,63 @@ static const struct file_operations proc
+ 
+ static int __init slab_proc_init(void)
+ {
+-	proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
++	mode_t gr_mode = S_IRUGO;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	gr_mode = S_IRUSR;
++#endif
++
++	proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
+ #ifdef CONFIG_DEBUG_SLAB_LEAK
+-	proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
++	proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
+ #endif
+ 	return 0;
+ }
+ module_init(slab_proc_init);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct kmem_cache *cachep;
++	struct slab *slabp;
++	struct page *page;
++	unsigned int objnr;
++	unsigned long offset;
++
++	if (ZERO_OR_NULL_PTR(ptr) && n)
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = virt_to_head_page(ptr);
++
++	if (!PageSlab(page)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	cachep = page_get_cache(page);
++	slabp = page_get_slab(page);
++	objnr = obj_to_index(cachep, slabp, ptr);
++	BUG_ON(objnr >= cachep->num);
++	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
++	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /**
+  * ksize - get the actual amount of memory allocated for a given object
+  * @objp: Pointer to the object
+diff -urNp linux-2.6.32.14/mm/slob.c linux-2.6.32.14/mm/slob.c
+--- linux-2.6.32.14/mm/slob.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/slob.c	2010-05-29 17:20:26.289194269 -0400
+@@ -29,7 +29,7 @@
+  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
+  * alloc_pages() directly, allocating compound pages so the page order
+  * does not have to be separately tracked, and also stores the exact
+- * allocation size in page->private so that it can be used to accurately
++ * allocation size in slob_page->size so that it can be used to accurately
+  * provide ksize(). These objects are detected in kfree() because slob_page()
+  * is false for them.
+  *
+@@ -58,6 +58,7 @@
+  */
+ 
+ #include <linux/kernel.h>
++#include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+ #include <linux/swap.h> /* struct reclaim_state */
+@@ -100,7 +101,8 @@ struct slob_page {
+ 			unsigned long flags;	/* mandatory */
+ 			atomic_t _count;	/* mandatory */
+ 			slobidx_t units;	/* free units left in page */
+-			unsigned long pad[2];
++			unsigned long pad[1];
++			unsigned long size;	/* size when >=PAGE_SIZE */
+ 			slob_t *free;		/* first free slob_t in page */
+ 			struct list_head list;	/* linked list of free pages */
+ 		};
+@@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
+  */
+ static inline int is_slob_page(struct slob_page *sp)
+ {
+-	return PageSlab((struct page *)sp);
++	return PageSlab((struct page *)sp) && !sp->size;
+ }
+ 
+ static inline void set_slob_page(struct slob_page *sp)
+@@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
+ 
+ static inline struct slob_page *slob_page(const void *addr)
+ {
+-	return (struct slob_page *)virt_to_page(addr);
++	return (struct slob_page *)virt_to_head_page(addr);
+ }
+ 
+ /*
+@@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
+ /*
+  * Return the size of a slob block.
+  */
+-static slobidx_t slob_units(slob_t *s)
++static slobidx_t slob_units(const slob_t *s)
+ {
+ 	if (s->units > 0)
+ 		return s->units;
+@@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
+ /*
+  * Return the next free slob block pointer after this one.
+  */
+-static slob_t *slob_next(slob_t *s)
++static slob_t *slob_next(const slob_t *s)
+ {
+ 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
+ 	slobidx_t next;
+@@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
+ /*
+  * Returns true if s is the last free block in its page.
+  */
+-static int slob_last(slob_t *s)
++static int slob_last(const slob_t *s)
+ {
+ 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
+ }
+@@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
+ 	if (!page)
+ 		return NULL;
+ 
++	set_slob_page(page);
+ 	return page_address(page);
+ }
+ 
+@@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
+ 		if (!b)
+ 			return NULL;
+ 		sp = slob_page(b);
+-		set_slob_page(sp);
+ 
+ 		spin_lock_irqsave(&slob_lock, flags);
+ 		sp->units = SLOB_UNITS(PAGE_SIZE);
+ 		sp->free = b;
++		sp->size = 0;
+ 		INIT_LIST_HEAD(&sp->list);
+ 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
+ 		set_slob_page_free(sp, slob_list);
+@@ -475,10 +478,9 @@ out:
+ #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
+ #endif
+ 
+-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
+ {
+-	unsigned int *m;
+-	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++	slob_t *m;
+ 	void *ret;
+ 
+ 	lockdep_trace_alloc(gfp);
+@@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		if (!m)
+ 			return NULL;
+-		*m = size;
++		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
++		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
++		m[0].units = size;
++		m[1].units = align;
+ 		ret = (void *)m + align;
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 
+ 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
+ 		if (ret) {
+-			struct page *page;
+-			page = virt_to_page(ret);
+-			page->private = size;
++			struct slob_page *sp;
++			sp = slob_page(ret);
++			sp->size = size;
+ 		}
+ 
+ 		trace_kmalloc_node(_RET_IP_, ret,
+@@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t 
+ 	kmemleak_alloc(ret, size, 1, gfp);
+ 	return ret;
+ }
++
++void *__kmalloc_node(size_t size, gfp_t gfp, int node)
++{
++	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
++
++	return __kmalloc_node_align(size, gfp, node, align);
++}
+ EXPORT_SYMBOL(__kmalloc_node);
+ 
+ void kfree(const void *block)
+@@ -528,13 +540,81 @@ void kfree(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		slob_free(m, *m + align);
+-	} else
++		slob_t *m = (slob_t *)(block - align);
++		slob_free(m, m[0].units + align);
++	} else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		put_page(&sp->page);
++	}
+ }
+ EXPORT_SYMBOL(kfree);
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct slob_page *sp;
++	const slob_t *free;
++	const void *base;
++
++	if (ZERO_OR_NULL_PTR(ptr) && n)
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	sp = slob_page(ptr);
++	if (!PageSlab((struct page*)sp)) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	if (sp->size) {
++		base = page_address(&sp->page);
++		if (base <= ptr && n <= sp->size - (ptr - base))
++			return;
++		goto report;
++	}
++
++	/* some tricky double walking to find the chunk */
++	base = (void *)((unsigned long)ptr & PAGE_MASK);
++	free = sp->free;
++
++	while (!slob_last(free) && (void *)free <= ptr) {
++		base = free + slob_units(free);
++		free = slob_next(free);
++	}
++
++	while (base < (void *)free) {
++		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
++		int size = SLOB_UNIT * SLOB_UNITS(m + align);
++		int offset;
++
++		if (ptr < base + align)
++			goto report;
++
++		offset = ptr - base - align;
++		if (offset < m) {
++			if (n <= m - offset)
++				return;
++			goto report;
++		}
++		base += size;
++	}
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
+ size_t ksize(const void *block)
+ {
+@@ -547,10 +627,10 @@ size_t ksize(const void *block)
+ 	sp = slob_page(block);
+ 	if (is_slob_page(sp)) {
+ 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+-		unsigned int *m = (unsigned int *)(block - align);
+-		return SLOB_UNITS(*m) * SLOB_UNIT;
++		slob_t *m = (slob_t *)(block - align);
++		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
+ 	} else
+-		return sp->page.private;
++		return sp->size;
+ }
+ EXPORT_SYMBOL(ksize);
+ 
+@@ -605,17 +685,25 @@ void *kmem_cache_alloc_node(struct kmem_
+ {
+ 	void *b;
+ 
++#ifdef CONFIG_PAX_USERCOPY
++	b = __kmalloc_node_align(c->size, flags, node, c->align);
++#else
+ 	if (c->size < PAGE_SIZE) {
+ 		b = slob_alloc(c->size, flags, c->align, node);
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    SLOB_UNITS(c->size) * SLOB_UNIT,
+ 					    flags, node);
+ 	} else {
++		struct slob_page *sp;
++
+ 		b = slob_new_pages(flags, get_order(c->size), node);
++		sp = slob_page(b);
++		sp->size = c->size;
+ 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
+ 					    PAGE_SIZE << get_order(c->size),
+ 					    flags, node);
+ 	}
++#endif
+ 
+ 	if (c->ctor)
+ 		c->ctor(b);
+@@ -627,10 +715,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+ 
+ static void __kmem_cache_free(void *b, int size)
+ {
+-	if (size < PAGE_SIZE)
++	struct slob_page *sp = slob_page(b);
++
++	if (is_slob_page(sp))
+ 		slob_free(b, size);
+-	else
++	else {
++		clear_slob_page(sp);
++		free_slob_page(sp);
++		sp->size = 0;
+ 		slob_free_pages(b, get_order(size));
++	}
+ }
+ 
+ static void kmem_rcu_free(struct rcu_head *head)
+@@ -643,15 +737,24 @@ static void kmem_rcu_free(struct rcu_hea
+ 
+ void kmem_cache_free(struct kmem_cache *c, void *b)
+ {
++	int size = c->size;
++
++#ifdef CONFIG_PAX_USERCOPY
++	if (size + c->align < PAGE_SIZE) {
++		size += c->align;
++		b -= c->align;
++	}
++#endif
++
+ 	kmemleak_free_recursive(b, c->flags);
+ 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
+ 		struct slob_rcu *slob_rcu;
+-		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
++		slob_rcu = b + (size - sizeof(struct slob_rcu));
+ 		INIT_RCU_HEAD(&slob_rcu->head);
+-		slob_rcu->size = c->size;
++		slob_rcu->size = size;
+ 		call_rcu(&slob_rcu->head, kmem_rcu_free);
+ 	} else {
+-		__kmem_cache_free(b, c->size);
++		__kmem_cache_free(b, size);
+ 	}
+ 
+ 	trace_kmem_cache_free(_RET_IP_, b);
+diff -urNp linux-2.6.32.14/mm/slub.c linux-2.6.32.14/mm/slub.c
+--- linux-2.6.32.14/mm/slub.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/slub.c	2010-05-29 17:20:09.189015611 -0400
+@@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
+ 
+ 	page = virt_to_head_page(x);
+ 
++	BUG_ON(!PageSlab(page));
++
+ 	slab_free(s, page, x, _RET_IP_);
+ 
+ 	trace_kmem_cache_free(_RET_IP_, x);
+@@ -1937,7 +1939,7 @@ static int slub_min_objects;
+  * Merge control. If this is set then no merging of slab caches will occur.
+  * (Could be removed. This was introduced to pacify the merge skeptics.)
+  */
+-static int slub_nomerge;
++static int slub_nomerge = 1;
+ 
+ /*
+  * Calculate the order of allocation given an slab object size.
+@@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
+ 	 * list to avoid pounding the page allocator excessively.
+ 	 */
+ 	set_min_partial(s, ilog2(s->size));
+-	s->refcount = 1;
++	atomic_set(&s->refcount, 1);
+ #ifdef CONFIG_NUMA
+ 	s->remote_node_defrag_ratio = 1000;
+ #endif
+@@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
+ 	down_write(&slub_lock);
+-	s->refcount--;
+-	if (!s->refcount) {
++	if (atomic_dec_and_test(&s->refcount)) {
+ 		list_del(&s->list);
+ 		up_write(&slub_lock);
+ 		if (kmem_cache_close(s)) {
+@@ -2915,6 +2916,43 @@ void *__kmalloc_node(size_t size, gfp_t 
+ EXPORT_SYMBOL(__kmalloc_node);
+ #endif
+ 
++void check_object_size(const void *ptr, unsigned long n, bool to)
++{
++
++#ifdef CONFIG_PAX_USERCOPY
++	struct page *page;
++	struct kmem_cache *s;
++	unsigned long offset;
++
++	if (ZERO_OR_NULL_PTR(ptr) && n)
++		goto report;
++
++	if (!virt_addr_valid(ptr))
++		return;
++
++	page = get_object_page(ptr);
++
++	if (!page) {
++		if (object_is_on_stack(ptr, n) == -1)
++			goto report;
++		return;
++	}
++
++	s = page->slab;
++	offset = (ptr - page_address(page)) % s->size;
++	if (offset <= s->objsize && n <= s->objsize - offset)
++		return;
++
++report:
++	if (to)
++		pax_report_leak_to_user(ptr, n);
++	else
++		pax_report_overflow_from_user(ptr, n);
++#endif
++
++}
++EXPORT_SYMBOL(check_object_size);
++
+ size_t ksize(const void *object)
+ {
+ 	struct page *page;
+@@ -3186,7 +3224,7 @@ void __init kmem_cache_init(void)
+ 	 */
+ 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
+ 		sizeof(struct kmem_cache_node), GFP_NOWAIT);
+-	kmalloc_caches[0].refcount = -1;
++	atomic_set(&kmalloc_caches[0].refcount, -1);
+ 	caches++;
+ 
+ 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
+@@ -3293,7 +3331,7 @@ static int slab_unmergeable(struct kmem_
+ 	/*
+ 	 * We may have set a slab to be unmergeable during bootstrap.
+ 	 */
+-	if (s->refcount < 0)
++	if (atomic_read(&s->refcount) < 0)
+ 		return 1;
+ 
+ 	return 0;
+@@ -3353,7 +3391,7 @@ struct kmem_cache *kmem_cache_create(con
+ 	if (s) {
+ 		int cpu;
+ 
+-		s->refcount++;
++		atomic_inc(&s->refcount);
+ 		/*
+ 		 * Adjust the object sizes so that we clear
+ 		 * the complete object on kzalloc.
+@@ -3372,7 +3410,7 @@ struct kmem_cache *kmem_cache_create(con
+ 
+ 		if (sysfs_slab_alias(s, name)) {
+ 			down_write(&slub_lock);
+-			s->refcount--;
++			atomic_dec(&s->refcount);
+ 			up_write(&slub_lock);
+ 			goto err;
+ 		}
+@@ -4101,7 +4139,7 @@ SLAB_ATTR_RO(ctor);
+ 
+ static ssize_t aliases_show(struct kmem_cache *s, char *buf)
+ {
+-	return sprintf(buf, "%d\n", s->refcount - 1);
++	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
+ }
+ SLAB_ATTR_RO(aliases);
+ 
+@@ -4503,7 +4541,7 @@ static void kmem_cache_release(struct ko
+ 	kfree(s);
+ }
+ 
+-static struct sysfs_ops slab_sysfs_ops = {
++static const struct sysfs_ops slab_sysfs_ops = {
+ 	.show = slab_attr_show,
+ 	.store = slab_attr_store,
+ };
+@@ -4522,7 +4560,7 @@ static int uevent_filter(struct kset *ks
+ 	return 0;
+ }
+ 
+-static struct kset_uevent_ops slab_uevent_ops = {
++static const struct kset_uevent_ops slab_uevent_ops = {
+ 	.filter = uevent_filter,
+ };
+ 
+@@ -4785,7 +4823,13 @@ static const struct file_operations proc
+ 
+ static int __init slab_proc_init(void)
+ {
+-	proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
++	mode_t gr_mode = S_IRUGO;
++
++#ifdef CONFIG_GRKERNSEC_PROC_ADD
++	gr_mode = S_IRUSR;
++#endif
++
++	proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
+ 	return 0;
+ }
+ module_init(slab_proc_init);
+diff -urNp linux-2.6.32.14/mm/util.c linux-2.6.32.14/mm/util.c
+--- linux-2.6.32.14/mm/util.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/util.c	2010-05-28 21:27:16.563017088 -0400
+@@ -228,6 +228,12 @@ EXPORT_SYMBOL(strndup_user);
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
+ 	mm->mmap_base = TASK_UNMAPPED_BASE;
++
++#ifdef CONFIG_PAX_RANDMMAP
++	if (mm->pax_flags & MF_PAX_RANDMMAP)
++		mm->mmap_base += mm->delta_mmap;
++#endif
++
+ 	mm->get_unmapped_area = arch_get_unmapped_area;
+ 	mm->unmap_area = arch_unmap_area;
+ }
+diff -urNp linux-2.6.32.14/mm/vmalloc.c linux-2.6.32.14/mm/vmalloc.c
+--- linux-2.6.32.14/mm/vmalloc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/mm/vmalloc.c	2010-05-28 21:27:16.567244417 -0400
+@@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
+ 
+ 	pte = pte_offset_kernel(pmd, addr);
+ 	do {
+-		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
+-		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
++			BUG_ON(!pte_exec(*pte));
++			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
++			continue;
++		}
++#endif
++
++		{
++			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
++			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
++		}
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+ }
+ 
+@@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+ {
+ 	pte_t *pte;
++	int ret = -ENOMEM;
+ 
+ 	/*
+ 	 * nr is a running index into the array which helps higher level
+@@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
+ 	pte = pte_alloc_kernel(pmd, addr);
+ 	if (!pte)
+ 		return -ENOMEM;
++
++	pax_open_kernel();
+ 	do {
+ 		struct page *page = pages[*nr];
+ 
+-		if (WARN_ON(!pte_none(*pte)))
+-			return -EBUSY;
+-		if (WARN_ON(!page))
+-			return -ENOMEM;
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++		if (pgprot_val(prot) & _PAGE_NX)
++#endif
++
++		if (WARN_ON(!pte_none(*pte))) {
++			ret = -EBUSY;
++			goto out;
++		}
++		if (WARN_ON(!page)) {
++			ret = -ENOMEM;
++			goto out;
++		}
+ 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
+ 		(*nr)++;
+ 	} while (pte++, addr += PAGE_SIZE, addr != end);
+-	return 0;
++	ret = 0;
++out:
++	pax_close_kernel();
++	return ret;
+ }
+ 
+ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
+@@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
+ 	 * and fall back on vmalloc() if that fails. Others
+ 	 * just put it in the vmalloc space.
+ 	 */
+-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
++#ifdef CONFIG_MODULES
++#ifdef MODULES_VADDR
+ 	unsigned long addr = (unsigned long)x;
+ 	if (addr >= MODULES_VADDR && addr < MODULES_END)
+ 		return 1;
+ #endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
++		return 1;
++#endif
++
++#endif
++
+ 	return is_vmalloc_addr(x);
+ }
+ 
+@@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
+ 	struct rb_node *tmp;
+ 
+ 	while (*p) {
+-		struct vmap_area *tmp;
++		struct vmap_area *varea;
+ 
+ 		parent = *p;
+-		tmp = rb_entry(parent, struct vmap_area, rb_node);
+-		if (va->va_start < tmp->va_end)
++		varea = rb_entry(parent, struct vmap_area, rb_node);
++		if (va->va_start < varea->va_end)
+ 			p = &(*p)->rb_left;
+-		else if (va->va_end > tmp->va_start)
++		else if (va->va_end > varea->va_start)
+ 			p = &(*p)->rb_right;
+ 		else
+ 			BUG();
+@@ -1223,6 +1257,16 @@ static struct vm_struct *__get_vm_area_n
+ 	struct vm_struct *area;
+ 
+ 	BUG_ON(in_interrupt());
++
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (flags & VM_KERNEXEC) {
++		if (start != VMALLOC_START || end != VMALLOC_END)
++			return NULL;
++		start = (unsigned long)MODULES_EXEC_VADDR;
++		end = (unsigned long)MODULES_EXEC_END;
++	}
++#endif
++
+ 	if (flags & VM_IOREMAP) {
+ 		int bit = fls(size);
+ 
+@@ -1448,6 +1492,11 @@ void *vmap(struct page **pages, unsigned
+ 	if (count > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		flags |= VM_KERNEXEC;
++#endif
++
+ 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
+ 					__builtin_return_address(0));
+ 	if (!area)
+@@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
+ 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
+ 		return NULL;
+ 
++#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
++	if (!(pgprot_val(prot) & _PAGE_NX))
++		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
++						node, gfp_mask, caller);
++	else
++#endif
++
+ 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
+ 				  VMALLOC_END, node, gfp_mask, caller);
+ 
+@@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
+ 	return addr;
+ }
+ 
++#undef __vmalloc
+ void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
+ {
+ 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
+@@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc
+ void *vmalloc(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
+  * The resulting memory area is zeroed so it can be mapped to userspace
+  * without leaking data.
+  */
++#undef vmalloc_user
+ void *vmalloc_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+@@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
++#undef vmalloc_node
+ void *vmalloc_node(unsigned long size, int node)
+ {
+ 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
+@@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
+  *	For tight control over page level allocator and protection flags
+  *	use __vmalloc() instead.
+  */
+-
++#undef vmalloc_exec
+ void *vmalloc_exec(unsigned long size)
+ {
+-	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
++	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
+ 			      -1, __builtin_return_address(0));
+ }
+ 
+@@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
+  *	Allocate enough 32bit PA addressable pages to cover @size from the
+  *	page level allocator and map them into contiguous kernel virtual space.
+  */
++#undef vmalloc_32
+ void *vmalloc_32(unsigned long size)
+ {
+ 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
+@@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
+  * The resulting memory area is 32bit addressable and zeroed so it can be
+  * mapped to userspace without leaking data.
+  */
++#undef vmalloc_32_user
+ void *vmalloc_32_user(unsigned long size)
+ {
+ 	struct vm_struct *area;
+diff -urNp linux-2.6.32.14/net/8021q/vlan.c linux-2.6.32.14/net/8021q/vlan.c
+--- linux-2.6.32.14/net/8021q/vlan.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/8021q/vlan.c	2010-05-28 21:27:16.567244417 -0400
+@@ -622,8 +622,7 @@ static int vlan_ioctl_handler(struct net
+ 		err = -EPERM;
+ 		if (!capable(CAP_NET_ADMIN))
+ 			break;
+-		if ((args.u.name_type >= 0) &&
+-		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
++		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
+ 			struct vlan_net *vn;
+ 
+ 			vn = net_generic(net, vlan_net_id);
+diff -urNp linux-2.6.32.14/net/atm/atm_misc.c linux-2.6.32.14/net/atm/atm_misc.c
+--- linux-2.6.32.14/net/atm/atm_misc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/atm/atm_misc.c	2010-05-28 21:27:16.567244417 -0400
+@@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
+ 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
+ 		return 1;
+ 	atm_return(vcc,truesize);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return 0;
+ }
+ 
+@@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct 
+ 		}
+ 	}
+ 	atm_return(vcc,guess);
+-	atomic_inc(&vcc->stats->rx_drop);
++	atomic_inc_unchecked(&vcc->stats->rx_drop);
+ 	return NULL;
+ }
+ 
+@@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
+ 
+ void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
+ 
+ void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
+ 	__SONET_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.14/net/atm/proc.c linux-2.6.32.14/net/atm/proc.c
+--- linux-2.6.32.14/net/atm/proc.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/atm/proc.c	2010-05-28 21:27:16.567244417 -0400
+@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
+   const struct k_atm_aal_stats *stats)
+ {
+ 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
+-	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
+-	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
+-	    atomic_read(&stats->rx_drop));
++	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
++	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
++	    atomic_read_unchecked(&stats->rx_drop));
+ }
+ 
+ static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
+diff -urNp linux-2.6.32.14/net/atm/resources.c linux-2.6.32.14/net/atm/resources.c
+--- linux-2.6.32.14/net/atm/resources.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/atm/resources.c	2010-05-28 21:27:16.579274907 -0400
+@@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
+ static void copy_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
++#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+@@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
+ static void subtract_aal_stats(struct k_atm_aal_stats *from,
+     struct atm_aal_stats *to)
+ {
+-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
++#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
+ 	__AAL_STAT_ITEMS
+ #undef __HANDLE_ITEM
+ }
+diff -urNp linux-2.6.32.14/net/bridge/br_private.h linux-2.6.32.14/net/bridge/br_private.h
+--- linux-2.6.32.14/net/bridge/br_private.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/bridge/br_private.h	2010-05-28 21:27:16.579274907 -0400
+@@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event, 
+ 
+ #ifdef CONFIG_SYSFS
+ /* br_sysfs_if.c */
+-extern struct sysfs_ops brport_sysfs_ops;
++extern const struct sysfs_ops brport_sysfs_ops;
+ extern int br_sysfs_addif(struct net_bridge_port *p);
+ 
+ /* br_sysfs_br.c */
+diff -urNp linux-2.6.32.14/net/bridge/br_stp_if.c linux-2.6.32.14/net/bridge/br_stp_if.c
+--- linux-2.6.32.14/net/bridge/br_stp_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/bridge/br_stp_if.c	2010-05-28 21:27:16.579274907 -0400
+@@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
+ 	char *envp[] = { NULL };
+ 
+ 	if (br->stp_enabled == BR_USER_STP) {
+-		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
++		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
+ 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
+ 			br->dev->name, r);
+ 
+diff -urNp linux-2.6.32.14/net/bridge/br_sysfs_if.c linux-2.6.32.14/net/bridge/br_sysfs_if.c
+--- linux-2.6.32.14/net/bridge/br_sysfs_if.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/bridge/br_sysfs_if.c	2010-05-28 21:27:16.579274907 -0400
+@@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
+ 	return ret;
+ }
+ 
+-struct sysfs_ops brport_sysfs_ops = {
++const struct sysfs_ops brport_sysfs_ops = {
+ 	.show = brport_show,
+ 	.store = brport_store,
+ };
+diff -urNp linux-2.6.32.14/net/core/dev.c linux-2.6.32.14/net/core/dev.c
+--- linux-2.6.32.14/net/core/dev.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/core/dev.c	2010-05-28 21:27:16.595266161 -0400
+@@ -2047,7 +2047,7 @@ int netif_rx_ni(struct sk_buff *skb)
+ }
+ EXPORT_SYMBOL(netif_rx_ni);
+ 
+-static void net_tx_action(struct softirq_action *h)
++static void net_tx_action(void)
+ {
+ 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
+ 
+@@ -2808,7 +2808,7 @@ void netif_napi_del(struct napi_struct *
+ EXPORT_SYMBOL(netif_napi_del);
+ 
+ 
+-static void net_rx_action(struct softirq_action *h)
++static void net_rx_action(void)
+ {
+ 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
+ 	unsigned long time_limit = jiffies + 2;
+diff -urNp linux-2.6.32.14/net/core/flow.c linux-2.6.32.14/net/core/flow.c
+--- linux-2.6.32.14/net/core/flow.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/core/flow.c	2010-05-28 21:27:16.595266161 -0400
+@@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
+ 
+ static u32 flow_hash_shift;
+ #define flow_hash_size	(1 << flow_hash_shift)
+-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
++static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
+ 
+ #define flow_table(cpu) (per_cpu(flow_tables, cpu))
+ 
+@@ -52,7 +52,7 @@ struct flow_percpu_info {
+ 	u32 hash_rnd;
+ 	int count;
+ };
+-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
++static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
+ 
+ #define flow_hash_rnd_recalc(cpu) \
+ 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
+@@ -69,7 +69,7 @@ struct flow_flush_info {
+ 	atomic_t cpuleft;
+ 	struct completion completion;
+ };
+-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
++static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
+ 
+ #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
+ 
+diff -urNp linux-2.6.32.14/net/dccp/ccids/ccid3.c linux-2.6.32.14/net/dccp/ccids/ccid3.c
+--- linux-2.6.32.14/net/dccp/ccids/ccid3.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/dccp/ccids/ccid3.c	2010-05-28 21:27:16.595266161 -0400
+@@ -41,7 +41,7 @@
+ static int ccid3_debug;
+ #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
+ #else
+-#define ccid3_pr_debug(format, a...)
++#define ccid3_pr_debug(format, a...) do {} while (0)
+ #endif
+ 
+ /*
+diff -urNp linux-2.6.32.14/net/dccp/dccp.h linux-2.6.32.14/net/dccp/dccp.h
+--- linux-2.6.32.14/net/dccp/dccp.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/dccp/dccp.h	2010-05-28 21:27:16.595266161 -0400
+@@ -44,9 +44,9 @@ extern int dccp_debug;
+ #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
+ #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
+ #else
+-#define dccp_pr_debug(format, a...)
+-#define dccp_pr_debug_cat(format, a...)
+-#define dccp_debug(format, a...)
++#define dccp_pr_debug(format, a...) do {} while (0)
++#define dccp_pr_debug_cat(format, a...) do {} while (0)
++#define dccp_debug(format, a...) do {} while (0)
+ #endif
+ 
+ extern struct inet_hashinfo dccp_hashinfo;
+diff -urNp linux-2.6.32.14/net/decnet/sysctl_net_decnet.c linux-2.6.32.14/net/decnet/sysctl_net_decnet.c
+--- linux-2.6.32.14/net/decnet/sysctl_net_decnet.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/decnet/sysctl_net_decnet.c	2010-05-28 21:27:16.595266161 -0400
+@@ -206,7 +206,7 @@ static int dn_node_address_handler(ctl_t
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, addr, len))
++	if (len > sizeof addr || copy_to_user(buffer, addr, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+@@ -327,7 +327,7 @@ static int dn_def_dev_handler(ctl_table 
+ 
+ 	if (len > *lenp) len = *lenp;
+ 
+-	if (copy_to_user(buffer, devname, len))
++	if (len > sizeof devname || copy_to_user(buffer, devname, len))
+ 		return -EFAULT;
+ 
+ 	*lenp = len;
+diff -urNp linux-2.6.32.14/net/ipv4/inet_hashtables.c linux-2.6.32.14/net/ipv4/inet_hashtables.c
+--- linux-2.6.32.14/net/ipv4/inet_hashtables.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/inet_hashtables.c	2010-05-28 21:27:16.600259316 -0400
+@@ -18,11 +18,14 @@
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/wait.h>
++#include <linux/security.h>
+ 
+ #include <net/inet_connection_sock.h>
+ #include <net/inet_hashtables.h>
+ #include <net/ip.h>
+ 
++extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
++
+ /*
+  * Allocate and initialize a new local port bind bucket.
+  * The bindhash mutex for snum's hash chain must be held here.
+@@ -490,6 +493,8 @@ ok:
+ 		}
+ 		spin_unlock(&head->lock);
+ 
++		gr_update_task_in_ip_table(current, inet_sk(sk));
++
+ 		if (tw) {
+ 			inet_twsk_deschedule(tw, death_row);
+ 			inet_twsk_put(tw);
+diff -urNp linux-2.6.32.14/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.14/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.32.14/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/netfilter/nf_nat_snmp_basic.c	2010-05-28 21:27:16.600259316 -0400
+@@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
+ 
+ 	*len = 0;
+ 
+-	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
++	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
+ 	if (*octets == NULL) {
+ 		if (net_ratelimit())
+ 			printk("OOM in bsalg (%d)\n", __LINE__);
+diff -urNp linux-2.6.32.14/net/ipv4/tcp_ipv4.c linux-2.6.32.14/net/ipv4/tcp_ipv4.c
+--- linux-2.6.32.14/net/ipv4/tcp_ipv4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/tcp_ipv4.c	2010-05-28 21:27:16.600259316 -0400
+@@ -84,6 +84,9 @@
+ int sysctl_tcp_tw_reuse __read_mostly;
+ int sysctl_tcp_low_latency __read_mostly;
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+ static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
+@@ -1603,12 +1606,20 @@ int tcp_v4_rcv(struct sk_buff *skb)
+ 	TCP_SKB_CB(skb)->sacked	 = 0;
+ 
+ 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+-	if (!sk)
++	if (!sk) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 1;
++#endif
+ 		goto no_tcp_socket;
++	}
+ 
+ process:
+-	if (sk->sk_state == TCP_TIME_WAIT)
++	if (sk->sk_state == TCP_TIME_WAIT) {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		ret = 2;
++#endif
+ 		goto do_time_wait;
++	}
+ 
+ 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+ 		goto discard_and_relse;
+@@ -1650,6 +1661,10 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (!grsec_enable_blackhole || (ret == 1 &&
++		    (skb->dev->flags & IFF_LOOPBACK)))
++#endif
+ 		tcp_v4_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.14/net/ipv4/tcp_minisocks.c linux-2.6.32.14/net/ipv4/tcp_minisocks.c
+--- linux-2.6.32.14/net/ipv4/tcp_minisocks.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/tcp_minisocks.c	2010-05-28 21:27:16.600259316 -0400
+@@ -26,6 +26,10 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ #ifdef CONFIG_SYSCTL
+ #define SYNC_INIT 0 /* let the user enable it */
+ #else
+@@ -672,6 +676,10 @@ listen_overflow:
+ 
+ embryonic_reset:
+ 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole)
++#endif
+ 	if (!(flg & TCP_FLAG_RST))
+ 		req->rsk_ops->send_reset(sk, skb);
+ 
+diff -urNp linux-2.6.32.14/net/ipv4/tcp_probe.c linux-2.6.32.14/net/ipv4/tcp_probe.c
+--- linux-2.6.32.14/net/ipv4/tcp_probe.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/tcp_probe.c	2010-05-28 21:27:16.600259316 -0400
+@@ -200,7 +200,7 @@ static ssize_t tcpprobe_read(struct file
+ 		if (cnt + width >= len)
+ 			break;
+ 
+-		if (copy_to_user(buf + cnt, tbuf, width))
++		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
+ 			return -EFAULT;
+ 		cnt += width;
+ 	}
+diff -urNp linux-2.6.32.14/net/ipv4/tcp_timer.c linux-2.6.32.14/net/ipv4/tcp_timer.c
+--- linux-2.6.32.14/net/ipv4/tcp_timer.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv4/tcp_timer.c	2010-05-28 21:27:16.600259316 -0400
+@@ -21,6 +21,10 @@
+ #include <linux/module.h>
+ #include <net/tcp.h>
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_lastack_retries;
++#endif
++
+ int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
+ int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
+ int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
+@@ -164,6 +168,13 @@ static int tcp_write_timeout(struct sock
+ 		}
+ 	}
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if ((sk->sk_state == TCP_LAST_ACK) &&
++	    (grsec_lastack_retries > 0) &&
++	    (grsec_lastack_retries < retry_until))
++		retry_until = grsec_lastack_retries;
++#endif
++
+ 	if (retransmits_timed_out(sk, retry_until)) {
+ 		/* Has it gone just too far? */
+ 		tcp_write_err(sk);
+diff -urNp linux-2.6.32.14/net/ipv4/udp.c linux-2.6.32.14/net/ipv4/udp.c
+--- linux-2.6.32.14/net/ipv4/udp.c	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/net/ipv4/udp.c	2010-05-28 21:27:16.624385427 -0400
+@@ -86,6 +86,7 @@
+ #include <linux/types.h>
+ #include <linux/fcntl.h>
+ #include <linux/module.h>
++#include <linux/security.h>
+ #include <linux/socket.h>
+ #include <linux/sockios.h>
+ #include <linux/igmp.h>
+@@ -106,6 +107,10 @@
+ #include <net/xfrm.h>
+ #include "udp_impl.h"
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++extern int grsec_enable_blackhole;
++#endif
++
+ struct udp_table udp_table;
+ EXPORT_SYMBOL(udp_table);
+ 
+@@ -371,6 +376,9 @@ found:
+ 	return s;
+ }
+ 
++extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
++extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
++
+ /*
+  * This routine is called by the ICMP module when it gets some
+  * sort of error condition.  If err < 0 then the socket should
+@@ -639,9 +647,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
+ 		dport = usin->sin_port;
+ 		if (dport == 0)
+ 			return -EINVAL;
++
++		err = gr_search_udp_sendmsg(sk, usin);
++		if (err)
++			return err;
+ 	} else {
+ 		if (sk->sk_state != TCP_ESTABLISHED)
+ 			return -EDESTADDRREQ;
++
++		err = gr_search_udp_sendmsg(sk, NULL);
++		if (err)
++			return err;
++
+ 		daddr = inet->daddr;
+ 		dport = inet->dport;
+ 		/* Open fast path for connected socket.
+@@ -945,6 +962,10 @@ try_again:
+ 	if (!skb)
+ 		goto out;
+ 
++	err = gr_search_udp_recvmsg(sk, skb);
++	if (err)
++		goto out_free;
++
+ 	ulen = skb->len - sizeof(struct udphdr);
+ 	copied = len;
+ 	if (copied > ulen)
+@@ -1335,6 +1356,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
+ 		goto csum_error;
+ 
+ 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+ 
+ 	/*
+diff -urNp linux-2.6.32.14/net/ipv6/exthdrs.c linux-2.6.32.14/net/ipv6/exthdrs.c
+--- linux-2.6.32.14/net/ipv6/exthdrs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv6/exthdrs.c	2010-05-28 21:27:16.624385427 -0400
+@@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
+ 		.type	= IPV6_TLV_JUMBO,
+ 		.func	= ipv6_hop_jumbo,
+ 	},
+-	{ -1, }
++	{ -1, NULL }
+ };
+ 
+ int ipv6_parse_hopopts(struct sk_buff *skb)
+diff -urNp linux-2.6.32.14/net/ipv6/raw.c linux-2.6.32.14/net/ipv6/raw.c
+--- linux-2.6.32.14/net/ipv6/raw.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv6/raw.c	2010-05-28 21:27:16.624385427 -0400
+@@ -600,7 +600,7 @@ out:
+ 	return err;
+ }
+ 
+-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
++static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
+ 			struct flowi *fl, struct rt6_info *rt,
+ 			unsigned int flags)
+ {
+diff -urNp linux-2.6.32.14/net/ipv6/tcp_ipv6.c linux-2.6.32.14/net/ipv6/tcp_ipv6.c
+--- linux-2.6.32.14/net/ipv6/tcp_ipv6.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv6/tcp_ipv6.c	2010-05-28 21:27:16.624385427 -0400
+@@ -1578,6 +1578,9 @@ static int tcp_v6_do_rcv(struct sock *sk
+ 	return 0;
+ 
+ reset:
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++	if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
++#endif
+ 	tcp_v6_send_reset(sk, skb);
+ discard:
+ 	if (opt_skb)
+@@ -1700,6 +1703,9 @@ no_tcp_socket:
+ bad_packet:
+ 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
+ 	} else {
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		tcp_v6_send_reset(NULL, skb);
+ 	}
+ 
+diff -urNp linux-2.6.32.14/net/ipv6/udp.c linux-2.6.32.14/net/ipv6/udp.c
+--- linux-2.6.32.14/net/ipv6/udp.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/ipv6/udp.c	2010-05-28 21:27:16.631258014 -0400
+@@ -587,6 +587,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
+ 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+ 				proto == IPPROTO_UDPLITE);
+ 
++#ifdef CONFIG_GRKERNSEC_BLACKHOLE
++		if (skb->dev->flags & IFF_LOOPBACK)
++#endif
+ 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+ 
+ 		kfree_skb(skb);
+diff -urNp linux-2.6.32.14/net/irda/ircomm/ircomm_tty.c linux-2.6.32.14/net/irda/ircomm/ircomm_tty.c
+--- linux-2.6.32.14/net/irda/ircomm/ircomm_tty.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/irda/ircomm/ircomm_tty.c	2010-05-28 21:27:16.634961077 -0400
+@@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
+ 	add_wait_queue(&self->open_wait, &wait);
+ 
+ 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count );
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 	/* As far as I can see, we protect open_count - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	if (!tty_hung_up_p(filp)) {
+ 		extra_count = 1;
+-		self->open_count--;
++		atomic_dec(&self->open_count);
+ 	}
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+-	self->blocked_open++;
++	atomic_inc(&self->blocked_open);
+ 
+ 	while (1) {
+ 		if (tty->termios->c_cflag & CBAUD) {
+@@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
+ 		}
+ 
+ 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
+-		      __FILE__,__LINE__, tty->driver->name, self->open_count );
++		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
+ 
+ 		schedule();
+ 	}
+@@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
+ 	if (extra_count) {
+ 		/* ++ is not atomic, so this should be protected - Jean II */
+ 		spin_lock_irqsave(&self->spinlock, flags);
+-		self->open_count++;
++		atomic_inc(&self->open_count);
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 	}
+-	self->blocked_open--;
++	atomic_dec(&self->blocked_open);
+ 
+ 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
+-	      __FILE__,__LINE__, tty->driver->name, self->open_count);
++	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
+ 
+ 	if (!retval)
+ 		self->flags |= ASYNC_NORMAL_ACTIVE;
+@@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
+ 	}
+ 	/* ++ is not atomic, so this should be protected - Jean II */
+ 	spin_lock_irqsave(&self->spinlock, flags);
+-	self->open_count++;
++	atomic_inc(&self->open_count);
+ 
+ 	tty->driver_data = self;
+ 	self->tty = tty;
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
+-		   self->line, self->open_count);
++		   self->line, atomic_read(&self->open_count));
+ 
+ 	/* Not really used by us, but lets do it anyway */
+ 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+@@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
+ 		return;
+ 	}
+ 
+-	if ((tty->count == 1) && (self->open_count != 1)) {
++	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
+ 		/*
+ 		 * Uh, oh.  tty->count is 1, which means that the tty
+ 		 * structure will be freed.  state->count should always
+@@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
+ 		 */
+ 		IRDA_DEBUG(0, "%s(), bad serial port count; "
+ 			   "tty->count is 1, state->count is %d\n", __func__ ,
+-			   self->open_count);
+-		self->open_count = 1;
++			   atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 1);
+ 	}
+ 
+-	if (--self->open_count < 0) {
++	if (atomic_dec_return(&self->open_count) < 0) {
+ 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
+-			   __func__, self->line, self->open_count);
+-		self->open_count = 0;
++			   __func__, self->line, atomic_read(&self->open_count));
++		atomic_set(&self->open_count, 0);
+ 	}
+-	if (self->open_count) {
++	if (atomic_read(&self->open_count)) {
+ 		spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
+@@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
+ 	tty->closing = 0;
+ 	self->tty = NULL;
+ 
+-	if (self->blocked_open) {
++	if (atomic_read(&self->blocked_open)) {
+ 		if (self->close_delay)
+ 			schedule_timeout_interruptible(self->close_delay);
+ 		wake_up_interruptible(&self->open_wait);
+@@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
+ 	spin_lock_irqsave(&self->spinlock, flags);
+ 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
+ 	self->tty = NULL;
+-	self->open_count = 0;
++	atomic_set(&self->open_count, 0);
+ 	spin_unlock_irqrestore(&self->spinlock, flags);
+ 
+ 	wake_up_interruptible(&self->open_wait);
+@@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct 
+ 	seq_putc(m, '\n');
+ 
+ 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
+-	seq_printf(m, "Open count: %d\n", self->open_count);
++	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
+ 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
+ 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
+ 
+diff -urNp linux-2.6.32.14/net/mac80211/ieee80211_i.h linux-2.6.32.14/net/mac80211/ieee80211_i.h
+--- linux-2.6.32.14/net/mac80211/ieee80211_i.h	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.14/net/mac80211/ieee80211_i.h	2010-05-28 21:27:16.639255900 -0400
+@@ -635,7 +635,7 @@ struct ieee80211_local {
+ 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
+ 	spinlock_t queue_stop_reason_lock;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int monitors, cooked_mntrs;
+ 	/* number of interfaces with corresponding FIF_ flags */
+ 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
+diff -urNp linux-2.6.32.14/net/mac80211/iface.c linux-2.6.32.14/net/mac80211/iface.c
+--- linux-2.6.32.14/net/mac80211/iface.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/mac80211/iface.c	2010-05-28 21:27:16.650898496 -0400
+@@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
+ 		break;
+ 	}
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		res = drv_start(local);
+ 		if (res)
+ 			goto err_del_bss;
+@@ -196,7 +196,7 @@ static int ieee80211_open(struct net_dev
+ 	 * Validate the MAC address for this device.
+ 	 */
+ 	if (!is_valid_ether_addr(dev->dev_addr)) {
+-		if (!local->open_count)
++		if (!atomic_read(&local->open_count))
+ 			drv_stop(local);
+ 		return -EADDRNOTAVAIL;
+ 	}
+@@ -292,7 +292,7 @@ static int ieee80211_open(struct net_dev
+ 
+ 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
+ 
+-	local->open_count++;
++	atomic_inc(&local->open_count);
+ 	if (hw_reconf_flags) {
+ 		ieee80211_hw_config(local, hw_reconf_flags);
+ 		/*
+@@ -320,7 +320,7 @@ static int ieee80211_open(struct net_dev
+  err_del_interface:
+ 	drv_remove_interface(local, &conf);
+  err_stop:
+-	if (!local->open_count)
++	if (!atomic_read(&local->open_count))
+ 		drv_stop(local);
+  err_del_bss:
+ 	sdata->bss = NULL;
+@@ -420,7 +420,7 @@ static int ieee80211_stop(struct net_dev
+ 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
+ 	}
+ 
+-	local->open_count--;
++	atomic_dec(&local->open_count);
+ 
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+@@ -526,7 +526,7 @@ static int ieee80211_stop(struct net_dev
+ 
+ 	ieee80211_recalc_ps(local, -1);
+ 
+-	if (local->open_count == 0) {
++	if (atomic_read(&local->open_count) == 0) {
+ 		ieee80211_clear_tx_pending(local);
+ 		ieee80211_stop_device(local);
+ 
+diff -urNp linux-2.6.32.14/net/mac80211/main.c linux-2.6.32.14/net/mac80211/main.c
+--- linux-2.6.32.14/net/mac80211/main.c	2010-04-04 20:41:50.080541354 -0400
++++ linux-2.6.32.14/net/mac80211/main.c	2010-05-28 21:27:16.650898496 -0400
+@@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
+ 		local->hw.conf.power_level = power;
+ 	}
+ 
+-	if (changed && local->open_count) {
++	if (changed && atomic_read(&local->open_count)) {
+ 		ret = drv_config(local, changed);
+ 		/*
+ 		 * Goal:
+diff -urNp linux-2.6.32.14/net/mac80211/pm.c linux-2.6.32.14/net/mac80211/pm.c
+--- linux-2.6.32.14/net/mac80211/pm.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/mac80211/pm.c	2010-05-28 21:27:16.650898496 -0400
+@@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
+ 	}
+ 
+ 	/* stop hardware - this must stop RX */
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		ieee80211_stop_device(local);
+ 
+ 	local->suspended = true;
+diff -urNp linux-2.6.32.14/net/mac80211/rate.c linux-2.6.32.14/net/mac80211/rate.c
+--- linux-2.6.32.14/net/mac80211/rate.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/mac80211/rate.c	2010-05-28 21:27:16.650898496 -0400
+@@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
+ 	struct rate_control_ref *ref, *old;
+ 
+ 	ASSERT_RTNL();
+-	if (local->open_count)
++	if (atomic_read(&local->open_count))
+ 		return -EBUSY;
+ 
+ 	ref = rate_control_alloc(name, local);
+diff -urNp linux-2.6.32.14/net/mac80211/tx.c linux-2.6.32.14/net/mac80211/tx.c
+--- linux-2.6.32.14/net/mac80211/tx.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.14/net/mac80211/tx.c	2010-05-28 21:27:16.655282610 -0400
+@@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
+ 	return cpu_to_le16(dur);
+ }
+ 
+-static int inline is_ieee80211_device(struct ieee80211_local *local,
++static inline int is_ieee80211_device(struct ieee80211_local *local,
+ 				      struct net_device *dev)
+ {
+ 	return local == wdev_priv(dev->ieee80211_ptr);
+diff -urNp linux-2.6.32.14/net/mac80211/util.c linux-2.6.32.14/net/mac80211/util.c
+--- linux-2.6.32.14/net/mac80211/util.c	2010-04-29 17:49:38.690617032 -0400
++++ linux-2.6.32.14/net/mac80211/util.c	2010-05-28 21:27:16.655282610 -0400
+@@ -1042,14 +1042,14 @@ int ieee80211_reconfig(struct ieee80211_
+ 		local->resuming = true;
+ 
+ 	/* restart hardware */
+-	if (local->open_count) {
++	if (atomic_read(&local->open_count)) {
+ 		/*
+ 		 * Upon resume hardware can sometimes be goofy due to
+ 		 * various platform / driver / bus issues, so restarting
+ 		 * the device may at times not work immediately. Propagate
+ 		 * the error.
+ 		 */
+-		res = drv_start(local);
++                res = drv_start(local);
+ 		if (res) {
+ 			WARN(local->suspended, "Harware became unavailable "
+ 			     "upon resume. This is could be a software issue"
+diff -urNp linux-2.6.32.14/net/sctp/socket.c linux-2.6.32.14/net/sctp/socket.c
+--- linux-2.6.32.14/net/sctp/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/sctp/socket.c	2010-05-28 21:27:16.667233121 -0400
+@@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
+ 	struct sctp_sndrcvinfo *sinfo;
+ 	struct sctp_initmsg *sinit;
+ 	sctp_assoc_t associd = 0;
+-	sctp_cmsgs_t cmsgs = { NULL };
++	sctp_cmsgs_t cmsgs = { NULL, NULL };
+ 	int err;
+ 	sctp_scope_t scope;
+ 	long timeo;
+@@ -5802,7 +5802,6 @@ pp_found:
+ 		 */
+ 		int reuse = sk->sk_reuse;
+ 		struct sock *sk2;
+-		struct hlist_node *node;
+ 
+ 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
+ 		if (pp->fastreuse && sk->sk_reuse &&
+diff -urNp linux-2.6.32.14/net/socket.c linux-2.6.32.14/net/socket.c
+--- linux-2.6.32.14/net/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/socket.c	2010-05-28 21:27:16.671255671 -0400
+@@ -87,6 +87,7 @@
+ #include <linux/wireless.h>
+ #include <linux/nsproxy.h>
+ #include <linux/magic.h>
++#include <linux/in.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/unistd.h>
+@@ -97,6 +98,21 @@
+ #include <net/sock.h>
+ #include <linux/netfilter.h>
+ 
++extern void gr_attach_curr_ip(const struct sock *sk);
++extern int gr_handle_sock_all(const int family, const int type,
++			      const int protocol);
++extern int gr_handle_sock_server(const struct sockaddr *sck);
++extern int gr_handle_sock_server_other(const struct socket *sck);
++extern int gr_handle_sock_client(const struct sockaddr *sck);
++extern int gr_search_connect(struct socket * sock,
++			     struct sockaddr_in * addr);
++extern int gr_search_bind(struct socket * sock,
++			  struct sockaddr_in * addr);
++extern int gr_search_listen(struct socket * sock);
++extern int gr_search_accept(struct socket * sock);
++extern int gr_search_socket(const int domain, const int type,
++			    const int protocol);
++
+ static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
+ static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+ 			 unsigned long nr_segs, loff_t pos);
+@@ -298,7 +314,7 @@ static int sockfs_get_sb(struct file_sys
+ 			     mnt);
+ }
+ 
+-static struct vfsmount *sock_mnt __read_mostly;
++struct vfsmount *sock_mnt __read_mostly;
+ 
+ static struct file_system_type sock_fs_type = {
+ 	.name =		"sockfs",
+@@ -1283,6 +1299,16 @@ SYSCALL_DEFINE3(socket, int, family, int
+ 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
+ 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
+ 
++	if(!gr_search_socket(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
++	if (gr_handle_sock_all(family, type, protocol)) {
++		retval = -EACCES;
++		goto out;
++	}
++
+ 	retval = sock_create(family, type, protocol, &sock);
+ 	if (retval < 0)
+ 		goto out;
+@@ -1415,6 +1441,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 	if (sock) {
+ 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
+ 		if (err >= 0) {
++			if (gr_handle_sock_server((struct sockaddr *)&address)) {
++				err = -EACCES;
++				goto error;
++			}
++			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
++			if (err)
++				goto error;
++
+ 			err = security_socket_bind(sock,
+ 						   (struct sockaddr *)&address,
+ 						   addrlen);
+@@ -1423,6 +1457,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
+ 						      (struct sockaddr *)
+ 						      &address, addrlen);
+ 		}
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1446,10 +1481,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
+ 		if ((unsigned)backlog > somaxconn)
+ 			backlog = somaxconn;
+ 
++		if (gr_handle_sock_server_other(sock)) {
++			err = -EPERM;
++			goto error;
++		}
++
++		err = gr_search_listen(sock);
++		if (err)
++			goto error;
++
+ 		err = security_socket_listen(sock, backlog);
+ 		if (!err)
+ 			err = sock->ops->listen(sock, backlog);
+ 
++error:
+ 		fput_light(sock->file, fput_needed);
+ 	}
+ 	return err;
+@@ -1492,6 +1537,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	newsock->type = sock->type;
+ 	newsock->ops = sock->ops;
+ 
++	if (gr_handle_sock_server_other(sock)) {
++		err = -EPERM;
++		sock_release(newsock);
++		goto out_put;
++	}
++
++	err = gr_search_accept(sock);
++	if (err) {
++		sock_release(newsock);
++		goto out_put;
++	}
++
+ 	/*
+ 	 * We don't need try_module_get here, as the listening socket (sock)
+ 	 * has the protocol module (sock->ops->owner) held.
+@@ -1534,6 +1591,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
+ 	fd_install(newfd, newfile);
+ 	err = newfd;
+ 
++	gr_attach_curr_ip(newsock->sk);
++
+ out_put:
+ 	fput_light(sock->file, fput_needed);
+ out:
+@@ -1571,6 +1630,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 		int, addrlen)
+ {
+ 	struct socket *sock;
++	struct sockaddr *sck;
+ 	struct sockaddr_storage address;
+ 	int err, fput_needed;
+ 
+@@ -1581,6 +1641,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
+ 	if (err < 0)
+ 		goto out_put;
+ 
++	sck = (struct sockaddr *)&address;
++
++	if (gr_handle_sock_client(sck)) {
++		err = -EACCES;
++		goto out_put;
++	}
++
++	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
++	if (err)
++		goto out_put;
++
+ 	err =
+ 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
+ 	if (err)
+diff -urNp linux-2.6.32.14/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.14/net/sunrpc/xprtrdma/svc_rdma.c
+--- linux-2.6.32.14/net/sunrpc/xprtrdma/svc_rdma.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/sunrpc/xprtrdma/svc_rdma.c	2010-05-28 21:27:16.671255671 -0400
+@@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
+ 		len -= *ppos;
+ 		if (len > *lenp)
+ 			len = *lenp;
+-		if (len && copy_to_user(buffer, str_buf, len))
++		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
+ 			return -EFAULT;
+ 		*lenp = len;
+ 		*ppos += len;
+diff -urNp linux-2.6.32.14/net/sysctl_net.c linux-2.6.32.14/net/sysctl_net.c
+--- linux-2.6.32.14/net/sysctl_net.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/sysctl_net.c	2010-05-28 21:27:16.674940896 -0400
+@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
+ 			       struct ctl_table *table)
+ {
+ 	/* Allow network administrator to have same access as root. */
+-	if (capable(CAP_NET_ADMIN)) {
++	if (capable_nolog(CAP_NET_ADMIN)) {
+ 		int mode = (table->mode >> 6) & 7;
+ 		return (mode << 6) | (mode << 3) | mode;
+ 	}
+diff -urNp linux-2.6.32.14/net/tipc/socket.c linux-2.6.32.14/net/tipc/socket.c
+--- linux-2.6.32.14/net/tipc/socket.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/tipc/socket.c	2010-05-28 21:27:16.683249187 -0400
+@@ -1449,8 +1449,9 @@ static int connect(struct socket *sock, 
+ 	} else {
+ 		if (res == 0)
+ 			res = -ETIMEDOUT;
+-		else
+-			; /* leave "res" unchanged */
++		else {
++			/* leave "res" unchanged */
++		}
+ 		sock->state = SS_DISCONNECTING;
+ 	}
+ 
+diff -urNp linux-2.6.32.14/net/unix/af_unix.c linux-2.6.32.14/net/unix/af_unix.c
+--- linux-2.6.32.14/net/unix/af_unix.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/unix/af_unix.c	2010-05-28 21:27:16.686916709 -0400
+@@ -734,6 +734,12 @@ static struct sock *unix_find_other(stru
+ 		err = -ECONNREFUSED;
+ 		if (!S_ISSOCK(inode->i_mode))
+ 			goto put_fail;
++
++		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
++			err = -EACCES;
++			goto put_fail;
++		}
++
+ 		u = unix_find_socket_byinode(net, inode);
+ 		if (!u)
+ 			goto put_fail;
+@@ -754,6 +760,13 @@ static struct sock *unix_find_other(stru
+ 		if (u) {
+ 			struct dentry *dentry;
+ 			dentry = unix_sk(u)->dentry;
++
++			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
++				err = -EPERM;
++				sock_put(u);
++				goto fail;
++			}
++
+ 			if (dentry)
+ 				touch_atime(unix_sk(u)->mnt, dentry);
+ 		} else
+@@ -839,11 +852,18 @@ static int unix_bind(struct socket *sock
+ 		err = security_path_mknod(&nd.path, dentry, mode, 0);
+ 		if (err)
+ 			goto out_mknod_drop_write;
++		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
++			err = -EACCES;
++			goto out_mknod_drop_write;
++		}
+ 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
+ out_mknod_drop_write:
+ 		mnt_drop_write(nd.path.mnt);
+ 		if (err)
+ 			goto out_mknod_dput;
++
++		gr_handle_create(dentry, nd.path.mnt);
++
+ 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+ 		dput(nd.path.dentry);
+ 		nd.path.dentry = dentry;
+@@ -861,6 +881,10 @@ out_mknod_drop_write:
+ 			goto out_unlock;
+ 		}
+ 
++#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
++		sk->sk_peercred.pid = current->pid;
++#endif
++
+ 		list = &unix_socket_table[addr->hash];
+ 	} else {
+ 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
+diff -urNp linux-2.6.32.14/net/wireless/wext.c linux-2.6.32.14/net/wireless/wext.c
+--- linux-2.6.32.14/net/wireless/wext.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/wireless/wext.c	2010-05-28 21:27:16.686916709 -0400
+@@ -816,8 +816,7 @@ static int ioctl_standard_iw_point(struc
+ 		 */
+ 
+ 		/* Support for very large requests */
+-		if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
+-		    (user_length > descr->max_tokens)) {
++		if (user_length > descr->max_tokens) {
+ 			/* Allow userspace to GET more than max so
+ 			 * we can support any size GET requests.
+ 			 * There is still a limit : -ENOMEM.
+diff -urNp linux-2.6.32.14/net/xfrm/xfrm_policy.c linux-2.6.32.14/net/xfrm/xfrm_policy.c
+--- linux-2.6.32.14/net/xfrm/xfrm_policy.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/net/xfrm/xfrm_policy.c	2010-05-28 21:27:16.686916709 -0400
+@@ -1477,7 +1477,7 @@ free_dst:
+ 	goto out;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_alloc_copy(void **target, void *src, int size)
+ {
+ 	if (!*target) {
+@@ -1489,7 +1489,7 @@ xfrm_dst_alloc_copy(void **target, void 
+ 	return 0;
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+@@ -1501,7 +1501,7 @@ xfrm_dst_update_parent(struct dst_entry 
+ #endif
+ }
+ 
+-static int inline
++static inline int
+ xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
+ {
+ #ifdef CONFIG_XFRM_SUB_POLICY
+diff -urNp linux-2.6.32.14/samples/kobject/kset-example.c linux-2.6.32.14/samples/kobject/kset-example.c
+--- linux-2.6.32.14/samples/kobject/kset-example.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/samples/kobject/kset-example.c	2010-05-28 21:27:16.686916709 -0400
+@@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
+ }
+ 
+ /* Our custom sysfs_ops that we will associate with our ktype later on */
+-static struct sysfs_ops foo_sysfs_ops = {
++static const struct sysfs_ops foo_sysfs_ops = {
+ 	.show = foo_attr_show,
+ 	.store = foo_attr_store,
+ };
+diff -urNp linux-2.6.32.14/scripts/basic/fixdep.c linux-2.6.32.14/scripts/basic/fixdep.c
+--- linux-2.6.32.14/scripts/basic/fixdep.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/basic/fixdep.c	2010-05-28 21:27:16.686916709 -0400
+@@ -222,9 +222,9 @@ static void use_config(char *m, int slen
+ 
+ static void parse_config_file(char *map, size_t len)
+ {
+-	int *end = (int *) (map + len);
++	unsigned int *end = (unsigned int *) (map + len);
+ 	/* start at +1, so that p can never be < map */
+-	int *m   = (int *) map + 1;
++	unsigned int *m   = (unsigned int *) map + 1;
+ 	char *p, *q;
+ 
+ 	for (; m < end; m++) {
+@@ -371,7 +371,7 @@ static void print_deps(void)
+ static void traps(void)
+ {
+ 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
+-	int *p = (int *)test;
++	unsigned int *p = (unsigned int *)test;
+ 
+ 	if (*p != INT_CONF) {
+ 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
+diff -urNp linux-2.6.32.14/scripts/kallsyms.c linux-2.6.32.14/scripts/kallsyms.c
+--- linux-2.6.32.14/scripts/kallsyms.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/kallsyms.c	2010-05-28 21:27:16.686916709 -0400
+@@ -43,10 +43,10 @@ struct text_range {
+ 
+ static unsigned long long _text;
+ static struct text_range text_ranges[] = {
+-	{ "_stext",     "_etext"     },
+-	{ "_sinittext", "_einittext" },
+-	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
+-	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
++	{ "_stext",     "_etext",     0, 0 },
++	{ "_sinittext", "_einittext", 0, 0 },
++	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
++	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
+ };
+ #define text_range_text     (&text_ranges[0])
+ #define text_range_inittext (&text_ranges[1])
+diff -urNp linux-2.6.32.14/scripts/mod/file2alias.c linux-2.6.32.14/scripts/mod/file2alias.c
+--- linux-2.6.32.14/scripts/mod/file2alias.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/mod/file2alias.c	2010-05-28 21:27:16.686916709 -0400
+@@ -72,7 +72,7 @@ static void device_id_check(const char *
+ 			    unsigned long size, unsigned long id_size,
+ 			    void *symval)
+ {
+-	int i;
++	unsigned int i;
+ 
+ 	if (size % id_size || size < id_size) {
+ 		if (cross_build != 0)
+@@ -102,7 +102,7 @@ static void device_id_check(const char *
+ /* USB is special because the bcdDevice can be matched against a numeric range */
+ /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
+ static void do_usb_entry(struct usb_device_id *id,
+-			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
++			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
+ 			 unsigned char range_lo, unsigned char range_hi,
+ 			 struct module *mod)
+ {
+@@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy
+ 	for (i = 0; i < count; i++) {
+ 		const char *id = (char *)devs[i].id;
+ 		char acpi_id[sizeof(devs[0].id)];
+-		int j;
++		unsigned int j;
+ 
+ 		buf_printf(&mod->dev_table_buf,
+ 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -398,7 +398,7 @@ static void do_pnp_card_entries(void *sy
+ 
+ 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
+ 			const char *id = (char *)card->devs[j].id;
+-			int i2, j2;
++			unsigned int i2, j2;
+ 			int dup = 0;
+ 
+ 			if (!id[0])
+@@ -424,7 +424,7 @@ static void do_pnp_card_entries(void *sy
+ 			/* add an individual alias for every device entry */
+ 			if (!dup) {
+ 				char acpi_id[sizeof(card->devs[0].id)];
+-				int k;
++				unsigned int k;
+ 
+ 				buf_printf(&mod->dev_table_buf,
+ 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
+@@ -699,7 +699,7 @@ static void dmi_ascii_filter(char *d, co
+ static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
+ 			char *alias)
+ {
+-	int i, j;
++	unsigned int i, j;
+ 
+ 	sprintf(alias, "dmi*");
+ 
+diff -urNp linux-2.6.32.14/scripts/mod/modpost.c linux-2.6.32.14/scripts/mod/modpost.c
+--- linux-2.6.32.14/scripts/mod/modpost.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/mod/modpost.c	2010-05-28 21:27:16.694974041 -0400
+@@ -835,6 +835,7 @@ enum mismatch {
+ 	INIT_TO_EXIT,
+ 	EXIT_TO_INIT,
+ 	EXPORT_TO_INIT_EXIT,
++	DATA_TO_TEXT
+ };
+ 
+ struct sectioncheck {
+@@ -920,6 +921,12 @@ const struct sectioncheck sectioncheck[]
+ 	.fromsec = { "__ksymtab*", NULL },
+ 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
+ 	.mismatch = EXPORT_TO_INIT_EXIT
++},
++/* Do not reference code from writable data */
++{
++	.fromsec = { DATA_SECTIONS, NULL },
++	.tosec   = { TEXT_SECTIONS, NULL },
++	.mismatch = DATA_TO_TEXT
+ }
+ };
+ 
+@@ -1024,10 +1031,10 @@ static Elf_Sym *find_elf_symbol(struct e
+ 			continue;
+ 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
+ 			continue;
+-		if (sym->st_value == addr)
+-			return sym;
+ 		/* Find a symbol nearby - addr are maybe negative */
+ 		d = sym->st_value - addr;
++		if (d == 0)
++			return sym;
+ 		if (d < 0)
+ 			d = addr - sym->st_value;
+ 		if (d < distance) {
+@@ -1268,6 +1275,14 @@ static void report_sec_mismatch(const ch
+ 		"Fix this by removing the %sannotation of %s "
+ 		"or drop the export.\n",
+ 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
++	case DATA_TO_TEXT:
++/*
++		fprintf(stderr,
++		"The variable %s references\n"
++		"the %s %s%s%s\n",
++		fromsym, to, sec2annotation(tosec), tosym, to_p);
++*/
++		break;
+ 	case NO_MISMATCH:
+ 		/* To get warnings on missing members */
+ 		break;
+@@ -1651,7 +1666,7 @@ void __attribute__((format(printf, 2, 3)
+ 	va_end(ap);
+ }
+ 
+-void buf_write(struct buffer *buf, const char *s, int len)
++void buf_write(struct buffer *buf, const char *s, unsigned int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+@@ -1863,7 +1878,7 @@ static void write_if_changed(struct buff
+ 	if (fstat(fileno(file), &st) < 0)
+ 		goto close_write;
+ 
+-	if (st.st_size != b->pos)
++	if (st.st_size != (off_t)b->pos)
+ 		goto close_write;
+ 
+ 	tmp = NOFAIL(malloc(b->pos));
+diff -urNp linux-2.6.32.14/scripts/mod/modpost.h linux-2.6.32.14/scripts/mod/modpost.h
+--- linux-2.6.32.14/scripts/mod/modpost.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/mod/modpost.h	2010-05-28 21:27:16.694974041 -0400
+@@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
+ 
+ struct buffer {
+ 	char *p;
+-	int pos;
+-	int size;
++	unsigned int pos;
++	unsigned int size;
+ };
+ 
+ void __attribute__((format(printf, 2, 3)))
+ buf_printf(struct buffer *buf, const char *fmt, ...);
+ 
+ void
+-buf_write(struct buffer *buf, const char *s, int len);
++buf_write(struct buffer *buf, const char *s, unsigned int len);
+ 
+ struct module {
+ 	struct module *next;
+diff -urNp linux-2.6.32.14/scripts/mod/sumversion.c linux-2.6.32.14/scripts/mod/sumversion.c
+--- linux-2.6.32.14/scripts/mod/sumversion.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/mod/sumversion.c	2010-05-28 21:27:16.694974041 -0400
+@@ -455,7 +455,7 @@ static void write_version(const char *fi
+ 		goto out;
+ 	}
+ 
+-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
++	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
+ 		warn("writing sum in %s failed: %s\n",
+ 			filename, strerror(errno));
+ 		goto out;
+diff -urNp linux-2.6.32.14/scripts/pnmtologo.c linux-2.6.32.14/scripts/pnmtologo.c
+--- linux-2.6.32.14/scripts/pnmtologo.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/scripts/pnmtologo.c	2010-05-28 21:27:16.694974041 -0400
+@@ -237,14 +237,14 @@ static void write_header(void)
+     fprintf(out, " *  Linux logo %s\n", logoname);
+     fputs(" */\n\n", out);
+     fputs("#include <linux/linux_logo.h>\n\n", out);
+-    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_data[] = {\n",
+ 	    logoname);
+ }
+ 
+ static void write_footer(void)
+ {
+     fputs("\n};\n\n", out);
+-    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
++    fprintf(out, "const struct linux_logo %s = {\n", logoname);
+     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
+     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
+     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
+@@ -374,7 +374,7 @@ static void write_logo_clut224(void)
+     fputs("\n};\n\n", out);
+ 
+     /* write logo clut */
+-    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
++    fprintf(out, "static unsigned char %s_clut[] = {\n",
+ 	    logoname);
+     write_hex_cnt = 0;
+     for (i = 0; i < logo_clutsize; i++) {
+diff -urNp linux-2.6.32.14/security/commoncap.c linux-2.6.32.14/security/commoncap.c
+--- linux-2.6.32.14/security/commoncap.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/commoncap.c	2010-05-28 21:27:16.694974041 -0400
+@@ -27,7 +27,7 @@
+ #include <linux/sched.h>
+ #include <linux/prctl.h>
+ #include <linux/securebits.h>
+-
++#include <net/sock.h>
+ /*
+  * If a non-root user executes a setuid-root binary in
+  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
+@@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
+ 	}
+ }
+ 
++extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
++
+ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
+ {
+-	NETLINK_CB(skb).eff_cap = current_cap();
++	NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.32.14/security/integrity/ima/ima_api.c linux-2.6.32.14/security/integrity/ima/ima_api.c
+--- linux-2.6.32.14/security/integrity/ima/ima_api.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/integrity/ima/ima_api.c	2010-05-28 21:27:16.694974041 -0400
+@@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
+ 	int result;
+ 
+ 	/* can overflow, only indicator */
+-	atomic_long_inc(&ima_htable.violations);
++	atomic_long_inc_unchecked(&ima_htable.violations);
+ 
+ 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+ 	if (!entry) {
+diff -urNp linux-2.6.32.14/security/integrity/ima/ima_fs.c linux-2.6.32.14/security/integrity/ima/ima_fs.c
+--- linux-2.6.32.14/security/integrity/ima/ima_fs.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/integrity/ima/ima_fs.c	2010-05-28 21:27:16.694974041 -0400
+@@ -27,12 +27,12 @@
+ static int valid_policy = 1;
+ #define TMPBUFLEN 12
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+-				     loff_t *ppos, atomic_long_t *val)
++				     loff_t *ppos, atomic_long_unchecked_t *val)
+ {
+ 	char tmpbuf[TMPBUFLEN];
+ 	ssize_t len;
+ 
+-	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
+ 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+ 
+diff -urNp linux-2.6.32.14/security/integrity/ima/ima.h linux-2.6.32.14/security/integrity/ima/ima.h
+--- linux-2.6.32.14/security/integrity/ima/ima.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/integrity/ima/ima.h	2010-05-28 21:27:16.694974041 -0400
+@@ -84,8 +84,8 @@ void ima_add_violation(struct inode *ino
+ extern spinlock_t ima_queue_lock;
+ 
+ struct ima_h_table {
+-	atomic_long_t len;	/* number of stored measurements in the list */
+-	atomic_long_t violations;
++	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
++	atomic_long_unchecked_t violations;
+ 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
+ };
+ extern struct ima_h_table ima_htable;
+diff -urNp linux-2.6.32.14/security/integrity/ima/ima_queue.c linux-2.6.32.14/security/integrity/ima/ima_queue.c
+--- linux-2.6.32.14/security/integrity/ima/ima_queue.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/integrity/ima/ima_queue.c	2010-05-28 21:27:16.694974041 -0400
+@@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
+ 	INIT_LIST_HEAD(&qe->later);
+ 	list_add_tail_rcu(&qe->later, &ima_measurements);
+ 
+-	atomic_long_inc(&ima_htable.len);
++	atomic_long_inc_unchecked(&ima_htable.len);
+ 	key = ima_hash_key(entry->digest);
+ 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
+ 	return 0;
+diff -urNp linux-2.6.32.14/security/Kconfig linux-2.6.32.14/security/Kconfig
+--- linux-2.6.32.14/security/Kconfig	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/security/Kconfig	2010-05-28 21:27:16.694974041 -0400
+@@ -4,6 +4,499 @@
+ 
+ menu "Security options"
+ 
++source grsecurity/Kconfig
++
++menu "PaX"
++
++	config PAX_PER_CPU_PGD
++	bool
++
++	config TASK_SIZE_MAX_SHIFT
++	int
++	depends on X86_64
++	default 47 if !PAX_PER_CPU_PGD
++	default 42 if PAX_PER_CPU_PGD
++
++config PAX
++	bool "Enable various PaX features"
++	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC || SPARC || X86)
++	help
++	  This allows you to enable various PaX features.  PaX adds
++	  intrusion prevention mechanisms to the kernel that reduce
++	  the risks posed by exploitable memory corruption bugs.
++
++menu "PaX Control"
++	depends on PAX
++
++config PAX_SOFTMODE
++	bool 'Support soft mode'
++	select PAX_PT_PAX_FLAGS
++	help
++	  Enabling this option will allow you to run PaX in soft mode, that
++	  is, PaX features will not be enforced by default, only on executables
++	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
++	  is the only way to mark executables for soft mode use.
++
++	  Soft mode can be activated by using the "pax_softmode=1" kernel command
++	  line option on boot.  Furthermore you can control various PaX features
++	  at runtime via the entries in /proc/sys/kernel/pax.
++
++config PAX_EI_PAX
++	bool 'Use legacy ELF header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'chpax' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  an otherwise reserved part of the ELF header.  This marking has
++	  numerous drawbacks (no support for soft-mode, toolchain does not
++	  know about the non-standard use of the ELF header) therefore it
++	  has been deprecated in favour of PT_PAX_FLAGS support.
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable this option otherwise they
++	  will not get any protection.
++
++	  Note that if you enable PT_PAX_FLAGS marking support as well,
++	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
++
++config PAX_PT_PAX_FLAGS
++	bool 'Use ELF program header marking'
++	help
++	  Enabling this option will allow you to control PaX features on
++	  a per executable basis via the 'paxctl' utility available at
++	  http://pax.grsecurity.net/.  The control flags will be read from
++	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
++	  has the benefits of supporting both soft mode and being fully
++	  integrated into the toolchain (the binutils patch is available
++	  from http://pax.grsecurity.net).
++
++	  If you have applications not marked by the PT_PAX_FLAGS ELF
++	  program header then you MUST enable the EI_PAX marking support
++	  otherwise they will not get any protection.
++
++	  Note that if you enable the legacy EI_PAX marking support as well,
++	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
++
++choice
++	prompt 'MAC system integration'
++	default PAX_HAVE_ACL_FLAGS
++	help
++	  Mandatory Access Control systems have the option of controlling
++	  PaX flags on a per executable basis, choose the method supported
++	  by your particular system.
++
++	  - "none": if your MAC system does not interact with PaX,
++	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
++	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
++
++	  NOTE: this option is for developers/integrators only.
++
++	config PAX_NO_ACL_FLAGS
++		bool 'none'
++
++	config PAX_HAVE_ACL_FLAGS
++		bool 'direct'
++
++	config PAX_HOOK_ACL_FLAGS
++		bool 'hook'
++endchoice
++
++endmenu
++
++menu "Non-executable pages"
++	depends on PAX
++
++config PAX_NOEXEC
++	bool "Enforce non-executable pages"
++	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
++	help
++	  By design some architectures do not allow for protecting memory
++	  pages against execution or even if they do, Linux does not make
++	  use of this feature.  In practice this means that if a page is
++	  readable (such as the stack or heap) it is also executable.
++
++	  There is a well known exploit technique that makes use of this
++	  fact and a common programming mistake where an attacker can
++	  introduce code of his choice somewhere in the attacked program's
++	  memory (typically the stack or the heap) and then execute it.
++
++	  If the attacked program was running with different (typically
++	  higher) privileges than that of the attacker, then he can elevate
++	  his own privilege level (e.g. get a root shell, write to files for
++	  which he does not have write access to, etc).
++
++	  Enabling this option will let you choose from various features
++	  that prevent the injection and execution of 'foreign' code in
++	  a program.
++
++	  This will also break programs that rely on the old behaviour and
++	  expect that dynamically allocated memory via the malloc() family
++	  of functions is executable (which it is not).  Notable examples
++	  are the XFree86 4.x server, the java runtime and wine.
++
++config PAX_PAGEEXEC
++	bool "Paging based non-executable pages"
++	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
++	select S390_SWITCH_AMODE if S390
++	select S390_EXEC_PROTECT if S390
++	help
++	  This implementation is based on the paging feature of the CPU.
++	  On i386 without hardware non-executable bit support there is a
++	  variable but usually low performance impact, however on Intel's
++	  P4 core based CPUs it is very high so you should not enable this
++	  for kernels meant to be used on such CPUs.
++
++	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
++	  with hardware non-executable bit support there is no performance
++	  impact, on ppc the impact is negligible.
++
++	  Note that several architectures require various emulations due to
++	  badly designed userland ABIs, this will cause a performance impact
++	  but will disappear as soon as userland is fixed. For example, ppc
++	  userland MUST have been built with secure-plt by a recent toolchain.
++
++config PAX_SEGMEXEC
++	bool "Segmentation based non-executable pages"
++	depends on PAX_NOEXEC && X86_32
++	help
++	  This implementation is based on the segmentation feature of the
++	  CPU and has a very small performance impact, however applications
++	  will be limited to a 1.5 GB address space instead of the normal
++	  3 GB.
++
++config PAX_EMUTRAMP
++	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
++	default y if PARISC
++	help
++	  There are some programs and libraries that for one reason or
++	  another attempt to execute special small code snippets from
++	  non-executable memory pages.  Most notable examples are the
++	  signal handler return code generated by the kernel itself and
++	  the GCC trampolines.
++
++	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
++	  such programs will no longer work under your kernel.
++
++	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
++	  utilities to enable trampoline emulation for the affected programs
++	  yet still have the protection provided by the non-executable pages.
++
++	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
++	  your system will not even boot.
++
++	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
++	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
++	  for the affected files.
++
++	  NOTE: enabling this feature *may* open up a loophole in the
++	  protection provided by non-executable pages that an attacker
++	  could abuse.  Therefore the best solution is to not have any
++	  files on your system that would require this option.  This can
++	  be achieved by not using libc5 (which relies on the kernel
++	  signal handler return code) and not using or rewriting programs
++	  that make use of the nested function implementation of GCC.
++	  Skilled users can just fix GCC itself so that it implements
++	  nested function calls in a way that does not interfere with PaX.
++
++config PAX_EMUSIGRT
++	bool "Automatically emulate sigreturn trampolines"
++	depends on PAX_EMUTRAMP && PARISC
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate signal return trampolines executing on the stack
++	  that would otherwise lead to task termination.
++
++	  This solution is intended as a temporary one for users with
++	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
++	  Modula-3 runtime, etc) or executables linked to such, basically
++	  everything that does not specify its own SA_RESTORER function in
++	  normal executable memory like glibc 2.1+ does.
++
++	  On parisc you MUST enable this option, otherwise your system will
++	  not even boot.
++
++	  NOTE: this feature cannot be disabled on a per executable basis
++	  and since it *does* open up a loophole in the protection provided
++	  by non-executable pages, the best solution is to not have any
++	  files on your system that would require this option.
++
++config PAX_MPROTECT
++	bool "Restrict mprotect()"
++	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
++	help
++	  Enabling this option will prevent programs from
++	   - changing the executable status of memory pages that were
++	     not originally created as executable,
++	   - making read-only executable pages writable again,
++	   - creating executable pages from anonymous memory.
++
++	  You should say Y here to complete the protection provided by
++	  the enforcement of non-executable pages.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_NOELFRELOCS
++	bool "Disallow ELF text relocations"
++	depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
++	help
++	  Non-executable pages and mprotect() restrictions are effective
++	  in preventing the introduction of new executable code into an
++	  attacked task's address space.  There remain only two venues
++	  for this kind of attack: if the attacker can execute already
++	  existing code in the attacked task then he can either have it
++	  create and mmap() a file containing his code or have it mmap()
++	  an already existing ELF library that does not have position
++	  independent code in it and use mprotect() on it to make it
++	  writable and copy his code there.  While protecting against
++	  the former approach is beyond PaX, the latter can be prevented
++	  by having only PIC ELF libraries on one's system (which do not
++	  need to relocate their code).  If you are sure this is your case,
++	  then enable this option otherwise be careful as you may not even
++	  be able to boot or log on your system (for example, some PAM
++	  modules are erroneously compiled as non-PIC by default).
++
++	  NOTE: if you are using dynamic ELF executables (as suggested
++	  when using ASLR) then you must have made sure that you linked
++	  your files using the PIC version of crt1 (the et_dyn.tar.gz package
++	  referenced there has already been updated to support this).
++
++config PAX_ETEXECRELOCS
++	bool "Allow ELF ET_EXEC text relocations"
++	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
++	default y
++	help
++	  On some architectures there are incorrectly created applications
++	  that require text relocations and would not work without enabling
++	  this option.  If you are an alpha, ia64 or parisc user, you should
++	  enable this option and disable it once you have made sure that
++	  none of your applications need it.
++
++config PAX_EMUPLT
++	bool "Automatically emulate ELF PLT"
++	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
++	default y
++	help
++	  Enabling this option will have the kernel automatically detect
++	  and emulate the Procedure Linkage Table entries in ELF files.
++	  On some architectures such entries are in writable memory, and
++	  become non-executable leading to task termination.  Therefore
++	  it is mandatory that you enable this option on alpha, parisc,
++	  sparc and sparc64, otherwise your system would not even boot.
++
++	  NOTE: this feature *does* open up a loophole in the protection
++	  provided by the non-executable pages, therefore the proper
++	  solution is to modify the toolchain to produce a PLT that does
++	  not need to be writable.
++
++config PAX_DLRESOLVE
++	bool 'Emulate old glibc resolver stub'
++	depends on PAX_EMUPLT && SPARC
++	default n
++	help
++	  This option is needed if userland has an old glibc (before 2.4)
++	  that puts a 'save' instruction into the runtime generated resolver
++	  stub that needs special emulation.
++
++config PAX_KERNEXEC
++	bool "Enforce non-executable kernel pages"
++	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
++	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
++	help
++	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
++	  that is, enabling this option will make it harder to inject
++	  and execute 'foreign' code in kernel memory itself.
++
++config PAX_KERNEXEC_MODULE_TEXT
++	int "Minimum amount of memory reserved for module code"
++	default "4"
++	depends on PAX_KERNEXEC && X86_32 && MODULES
++	help
++	  Due to implementation details the kernel must reserve a fixed
++	  amount of memory for module code at compile time that cannot be
++	  changed at runtime.  Here you can specify the minimum amount
++	  in MB that will be reserved.  Due to the same implementation
++	  details this size will always be rounded up to the next 2/4 MB
++	  boundary (depends on PAE) so the actually available memory for
++	  module code will usually be more than this minimum.
++
++	  The default 4 MB should be enough for most users but if you have
++	  an excessive number of modules (e.g., most distribution configs
++	  compile many drivers as modules) or use huge modules such as
++	  nvidia's kernel driver, you will need to adjust this amount.
++	  A good rule of thumb is to look at your currently loaded kernel
++	  modules and add up their sizes.
++
++endmenu
++
++menu "Address Space Layout Randomization"
++	depends on PAX
++
++config PAX_ASLR
++	bool "Address Space Layout Randomization"
++	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
++	help
++	  Many if not most exploit techniques rely on the knowledge of
++	  certain addresses in the attacked program.  The following options
++	  will allow the kernel to apply a certain amount of randomization
++	  to specific parts of the program thereby forcing an attacker to
++	  guess them in most cases.  Any failed guess will most likely crash
++	  the attacked program which allows the kernel to detect such attempts
++	  and react on them.  PaX itself provides no reaction mechanisms,
++	  instead it is strongly encouraged that you make use of Nergal's
++	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
++	  (http://www.grsecurity.net/) built-in crash detection features or
++	  develop one yourself.
++
++	  By saying Y here you can choose to randomize the following areas:
++	   - top of the task's kernel stack
++	   - top of the task's userland stack
++	   - base address for mmap() requests that do not specify one
++	     (this includes all libraries)
++	   - base address of the main executable
++
++	  It is strongly recommended to say Y here as address space layout
++	  randomization has negligible impact on performance yet it provides
++	  a very effective protection.
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
++	  this feature on a per file basis.
++
++config PAX_RANDKSTACK
++	bool "Randomize kernel stack base"
++	depends on PAX_ASLR && X86_TSC && X86_32
++	help
++	  By saying Y here the kernel will randomize every task's kernel
++	  stack on every system call.  This will not only force an attacker
++	  to guess it but also prevent him from making use of possible
++	  leaked information about it.
++
++	  Since the kernel stack is a rather scarce resource, randomization
++	  may cause unexpected stack overflows, therefore you should very
++	  carefully test your system.  Note that once enabled in the kernel
++	  configuration, this feature cannot be disabled on a per file basis.
++
++config PAX_RANDUSTACK
++	bool "Randomize user stack base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will randomize every task's userland
++	  stack.  The randomization is done in two steps where the second
++	  one may apply a big amount of shift to the top of the stack and
++	  cause problems for programs that want to use lots of memory (more
++	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
++	  For this reason the second step can be controlled by 'chpax' or
++	  'paxctl' on a per file basis.
++
++config PAX_RANDMMAP
++	bool "Randomize mmap() base"
++	depends on PAX_ASLR
++	help
++	  By saying Y here the kernel will use a randomized base address for
++	  mmap() requests that do not specify one themselves.  As a result
++	  all dynamically loaded libraries will appear at random addresses
++	  and therefore be harder to exploit by a technique where an attacker
++	  attempts to execute library code for his purposes (e.g. spawn a
++	  shell from an exploited program that is running at an elevated
++	  privilege level).
++
++	  Furthermore, if a program is relinked as a dynamic ELF file, its
++	  base address will be randomized as well, completing the full
++	  randomization of the address space layout.  Attacking such programs
++	  becomes a guess game.  You can find an example of doing this at
++	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
++	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
++
++	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
++	  feature on a per file basis.
++
++endmenu
++
++menu "Miscellaneous hardening features"
++
++config PAX_MEMORY_SANITIZE
++	bool "Sanitize all freed memory"
++	help
++	  By saying Y here the kernel will erase memory pages as soon as they
++	  are freed.  This in turn reduces the lifetime of data stored in the
++	  pages, making it less likely that sensitive information such as
++	  passwords, cryptographic secrets, etc stay in memory for too long.
++
++	  This is especially useful for programs whose runtime is short, long
++	  lived processes and the kernel itself benefit from this as long as
++	  they operate on whole memory pages and ensure timely freeing of pages
++	  that may hold sensitive information.
++
++	  The tradeoff is performance impact, on a single CPU system kernel
++	  compilation sees a 3% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
++
++	  Note that this feature does not protect data stored in live pages,
++	  e.g., process memory swapped to disk may stay there for a long time.
++
++config PAX_MEMORY_UDEREF
++	bool "Prevent invalid userland pointer dereference"
++	depends on X86 && !UML_X86 && !XEN
++	select PAX_PER_CPU_PGD if X86_64
++	help
++	  By saying Y here the kernel will be prevented from dereferencing
++	  userland pointers in contexts where the kernel expects only kernel
++	  pointers.  This is both a useful runtime debugging feature and a
++	  security measure that prevents exploiting a class of kernel bugs.
++
++	  The tradeoff is that some virtualization solutions may experience
++	  a huge slowdown and therefore you should not enable this feature
++	  for kernels meant to run in such environments.  Whether a given VM
++	  solution is affected or not is best determined by simply trying it
++	  out, the performance impact will be obvious right on boot as this
++	  mechanism engages from very early on.  A good rule of thumb is that
++	  VMs running on CPUs without hardware virtualization support (i.e.,
++	  the majority of IA-32 CPUs) will likely experience the slowdown.
++
++config PAX_REFCOUNT
++	bool "Prevent various kernel object reference counter overflows"
++	depends on GRKERNSEC && (X86 || SPARC64)
++	help
++	  By saying Y here the kernel will detect and prevent overflowing
++	  various (but not all) kinds of object reference counters.  Such
++	  overflows can normally occur due to bugs only and are often, if
++	  not always, exploitable.
++
++	  The tradeoff is that data structures protected by an overflowed
++	  refcount will never be freed and therefore will leak memory.  Note
++	  that this leak also happens even without this protection but in
++	  that case the overflow can eventually trigger the freeing of the
++	  data structure while it is still being used elsewhere, resulting
++	  in the exploitable situation that this feature prevents.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++
++config PAX_USERCOPY
++	bool "Bounds check heap object copies between kernel and userland"
++	depends on X86 || PPC || SPARC
++	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++	help
++	  By saying Y here the kernel will enforce the size of heap objects
++	  when they are copied in either direction between the kernel and
++	  userland, even if only a part of the heap object is copied.
++
++	  Specifically, this checking prevents information leaking from the
++	  kernel heap during kernel to userland copies (if the kernel heap
++	  object is otherwise fully initialized) and prevents kernel heap
++	  overflows during userland to kernel copies.
++
++	  Note that the current implementation provides the strictest checks
++	  for the SLUB allocator.
++
++	  Since this has a negligible performance impact, you should enable
++	  this feature.
++endmenu
++
++endmenu
++
+ config KEYS
+ 	bool "Enable access key retention support"
+ 	help
+@@ -146,7 +639,7 @@ config INTEL_TXT
+ config LSM_MMAP_MIN_ADDR
+ 	int "Low address space for LSM to protect from user allocation"
+ 	depends on SECURITY && SECURITY_SELINUX
+-	default 65536
++	default 32768
+ 	help
+ 	  This is the portion of low virtual memory which should be protected
+ 	  from userspace allocation.  Keeping a user from writing to low pages
+diff -urNp linux-2.6.32.14/security/min_addr.c linux-2.6.32.14/security/min_addr.c
+--- linux-2.6.32.14/security/min_addr.c	2010-05-28 20:16:44.458924952 -0400
++++ linux-2.6.32.14/security/min_addr.c	2010-05-28 21:27:16.694974041 -0400
+@@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
+  */
+ static void update_mmap_min_addr(void)
+ {
++#ifndef SPARC
+ #ifdef CONFIG_LSM_MMAP_MIN_ADDR
+ 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+ 		mmap_min_addr = dac_mmap_min_addr;
+@@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
+ #else
+ 	mmap_min_addr = dac_mmap_min_addr;
+ #endif
++#endif
+ }
+ 
+ /*
+diff -urNp linux-2.6.32.14/sound/aoa/codecs/onyx.c linux-2.6.32.14/sound/aoa/codecs/onyx.c
+--- linux-2.6.32.14/sound/aoa/codecs/onyx.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/aoa/codecs/onyx.c	2010-05-28 21:27:16.694974041 -0400
+@@ -53,7 +53,7 @@ struct onyx {
+ 				spdif_locked:1,
+ 				analog_locked:1,
+ 				original_mute:2;
+-	int			open_count;
++	atomic_t		open_count;
+ 	struct codec_info	*codec_info;
+ 
+ 	/* mutex serializes concurrent access to the device
+@@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count++;
++	atomic_inc(&onyx->open_count);
+ 	mutex_unlock(&onyx->mutex);
+ 
+ 	return 0;
+@@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
+ 	struct onyx *onyx = cii->codec_data;
+ 
+ 	mutex_lock(&onyx->mutex);
+-	onyx->open_count--;
+-	if (!onyx->open_count)
++	if (atomic_dec_and_test(&onyx->open_count))
+ 		onyx->spdif_locked = onyx->analog_locked = 0;
+ 	mutex_unlock(&onyx->mutex);
+ 
+diff -urNp linux-2.6.32.14/sound/core/oss/pcm_oss.c linux-2.6.32.14/sound/core/oss/pcm_oss.c
+--- linux-2.6.32.14/sound/core/oss/pcm_oss.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/core/oss/pcm_oss.c	2010-05-28 21:27:16.698950213 -0400
+@@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
+ 	}
+ }
+ #else /* !CONFIG_SND_VERBOSE_PROCFS */
+-#define snd_pcm_oss_proc_init(pcm)
+-#define snd_pcm_oss_proc_done(pcm)
++#define snd_pcm_oss_proc_init(pcm) do {} while (0)
++#define snd_pcm_oss_proc_done(pcm) do {} while (0)
+ #endif /* CONFIG_SND_VERBOSE_PROCFS */
+ 
+ /*
+diff -urNp linux-2.6.32.14/sound/core/seq/seq_lock.h linux-2.6.32.14/sound/core/seq/seq_lock.h
+--- linux-2.6.32.14/sound/core/seq/seq_lock.h	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/core/seq/seq_lock.h	2010-05-28 21:27:16.698950213 -0400
+@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
+ #else /* SMP || CONFIG_SND_DEBUG */
+ 
+ typedef spinlock_t snd_use_lock_t;	/* dummy */
+-#define snd_use_lock_init(lockp) /**/
+-#define snd_use_lock_use(lockp) /**/
+-#define snd_use_lock_free(lockp) /**/
+-#define snd_use_lock_sync(lockp) /**/
++#define snd_use_lock_init(lockp) do {} while (0)
++#define snd_use_lock_use(lockp) do {} while (0)
++#define snd_use_lock_free(lockp) do {} while (0)
++#define snd_use_lock_sync(lockp) do {} while (0)
+ 
+ #endif /* SMP || CONFIG_SND_DEBUG */
+ 
+diff -urNp linux-2.6.32.14/sound/drivers/mts64.c linux-2.6.32.14/sound/drivers/mts64.c
+--- linux-2.6.32.14/sound/drivers/mts64.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/drivers/mts64.c	2010-05-28 21:27:16.698950213 -0400
+@@ -65,7 +65,7 @@ struct mts64 {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int current_midi_output_port;
+ 	int current_midi_input_port;
+ 	u8 mode[MTS64_NUM_INPUT_PORTS];
+@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
+ {
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 
+-	if (mts->open_count == 0) {
++	if (atomic_read(&mts->open_count) == 0) {
+ 		/* We don't need a spinlock here, because this is just called 
+ 		   if the device has not been opened before. 
+ 		   So there aren't any IRQs from the device */
+@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
+ 
+ 		msleep(50);
+ 	}
+-	++(mts->open_count);
++	atomic_inc(&mts->open_count);
+ 
+ 	return 0;
+ }
+@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
+ 	struct mts64 *mts = substream->rmidi->private_data;
+ 	unsigned long flags;
+ 
+-	--(mts->open_count);
+-	if (mts->open_count == 0) {
++	if (atomic_dec_return(&mts->open_count) == 0) {
+ 		/* We need the spinlock_irqsave here because we can still
+ 		   have IRQs at this point */
+ 		spin_lock_irqsave(&mts->lock, flags);
+@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
+ 
+ 		msleep(500);
+ 
+-	} else if (mts->open_count < 0)
+-		mts->open_count = 0;
++	} else if (atomic_read(&mts->open_count) < 0)
++		atomic_set(&mts->open_count, 0);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.32.14/sound/drivers/portman2x4.c linux-2.6.32.14/sound/drivers/portman2x4.c
+--- linux-2.6.32.14/sound/drivers/portman2x4.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/drivers/portman2x4.c	2010-05-28 21:27:16.698950213 -0400
+@@ -83,7 +83,7 @@ struct portman {
+ 	struct pardevice *pardev;
+ 	int pardev_claimed;
+ 
+-	int open_count;
++	atomic_t open_count;
+ 	int mode[PORTMAN_NUM_INPUT_PORTS];
+ 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
+ };
+diff -urNp linux-2.6.32.14/sound/oss/sb_audio.c linux-2.6.32.14/sound/oss/sb_audio.c
+--- linux-2.6.32.14/sound/oss/sb_audio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/oss/sb_audio.c	2010-05-28 21:27:16.698950213 -0400
+@@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
+ 		buf16 = (signed short *)(localbuf + localoffs);
+ 		while (c)
+ 		{
+-			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
++			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+ 			if (copy_from_user(lbuf8,
+ 					   userbuf+useroffs + p,
+ 					   locallen))
+diff -urNp linux-2.6.32.14/sound/pci/ac97/ac97_codec.c linux-2.6.32.14/sound/pci/ac97/ac97_codec.c
+--- linux-2.6.32.14/sound/pci/ac97/ac97_codec.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/pci/ac97/ac97_codec.c	2010-05-28 21:27:16.698950213 -0400
+@@ -1952,7 +1952,7 @@ static int snd_ac97_dev_disconnect(struc
+ }
+ 
+ /* build_ops to do nothing */
+-static struct snd_ac97_build_ops null_build_ops;
++static const struct snd_ac97_build_ops null_build_ops;
+ 
+ #ifdef CONFIG_SND_AC97_POWER_SAVE
+ static void do_update_power(struct work_struct *work)
+diff -urNp linux-2.6.32.14/sound/pci/ac97/ac97_patch.c linux-2.6.32.14/sound/pci/ac97/ac97_patch.c
+--- linux-2.6.32.14/sound/pci/ac97/ac97_patch.c	2010-04-04 20:41:50.084493253 -0400
++++ linux-2.6.32.14/sound/pci/ac97/ac97_patch.c	2010-05-28 21:27:16.698950213 -0400
+@@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
+ 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ };
+@@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
++static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
+ 	.build_3d	= patch_yamaha_ymf7x3_3d,
+ 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
+ };
+@@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
+ 	.build_specific = patch_wolfson_wm9703_specific,
+ };
+ 
+@@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
+ 	.build_specific = patch_wolfson_wm9704_specific,
+ };
+ 
+@@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
+ 	.build_specific = patch_wolfson_wm9705_specific,
+ };
+ 
+@@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
+ 	.build_specific = patch_wolfson_wm9711_specific,
+ };
+ 
+@@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume 
+ }
+ #endif
+ 
+-static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
++static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
+ 	.build_specific = patch_wolfson_wm9713_specific,
+ 	.build_3d = patch_wolfson_wm9713_3d,
+ #ifdef CONFIG_PM	
+@@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac97xx_specific
+ };
+@@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
+ 	return patch_sigmatel_stac97xx_specific(ac97);
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
+ 	.build_3d	= patch_sigmatel_stac9708_3d,
+ 	.build_specific	= patch_sigmatel_stac9708_specific
+ };
+@@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
++static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
+ 	.build_3d	= patch_sigmatel_stac9700_3d,
+ 	.build_specific	= patch_sigmatel_stac9758_specific
+ };
+@@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_cirrus_ops = {
++static const struct snd_ac97_build_ops patch_cirrus_ops = {
+ 	.build_spdif = patch_cirrus_build_spdif
+ };
+ 
+@@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_conexant_ops = {
++static const struct snd_ac97_build_ops patch_conexant_ops = {
+ 	.build_spdif = patch_conexant_build_spdif
+ };
+ 
+@@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
+ 	{ AC97_VIDEO, 0x9f1f },
+ 	{ AC97_AUX, 0x9f1f },
+ 	{ AC97_PCM, 0x9f1f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_ad1819(struct snd_ac97 * ac97)
+@@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct 
+ 	}
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1881_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+ #endif
+@@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1885_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
+ 	.build_specific = &patch_ad1885_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1886_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
+ 	.build_specific = &patch_ad1886_specific,
+ #ifdef CONFIG_PM
+ 	.resume = ad18xx_resume
+@@ -1896,7 +1896,7 @@ static int patch_ad1981a_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981a_specific,
+ #ifdef CONFIG_PM
+@@ -1951,7 +1951,7 @@ static int patch_ad1981b_specific(struct
+ 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1981b_specific,
+ #ifdef CONFIG_PM
+@@ -2090,7 +2090,7 @@ static int patch_ad1888_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1888_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1888_specific,
+ #ifdef CONFIG_PM
+@@ -2139,7 +2139,7 @@ static int patch_ad1980_specific(struct 
+ 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1980_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1980_specific,
+ #ifdef CONFIG_PM
+@@ -2254,7 +2254,7 @@ static int patch_ad1985_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1985_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1985_specific,
+ #ifdef CONFIG_PM
+@@ -2546,7 +2546,7 @@ static int patch_ad1986_specific(struct 
+ 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_ad1986_build_ops = {
++static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
+ 	.build_post_spdif = patch_ad198x_post_spdif,
+ 	.build_specific = patch_ad1986_specific,
+ #ifdef CONFIG_PM
+@@ -2651,7 +2651,7 @@ static int patch_alc650_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc650_ops = {
++static const struct snd_ac97_build_ops patch_alc650_ops = {
+ 	.build_specific	= patch_alc650_specific,
+ 	.update_jacks = alc650_update_jacks
+ };
+@@ -2803,7 +2803,7 @@ static int patch_alc655_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc655_ops = {
++static const struct snd_ac97_build_ops patch_alc655_ops = {
+ 	.build_specific	= patch_alc655_specific,
+ 	.update_jacks = alc655_update_jacks
+ };
+@@ -2915,7 +2915,7 @@ static int patch_alc850_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_alc850_ops = {
++static const struct snd_ac97_build_ops patch_alc850_ops = {
+ 	.build_specific	= patch_alc850_specific,
+ 	.update_jacks = alc850_update_jacks
+ };
+@@ -2977,7 +2977,7 @@ static int patch_cm9738_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9738_ops = {
++static const struct snd_ac97_build_ops patch_cm9738_ops = {
+ 	.build_specific	= patch_cm9738_specific,
+ 	.update_jacks = cm9738_update_jacks
+ };
+@@ -3068,7 +3068,7 @@ static int patch_cm9739_post_spdif(struc
+ 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9739_ops = {
++static const struct snd_ac97_build_ops patch_cm9739_ops = {
+ 	.build_specific	= patch_cm9739_specific,
+ 	.build_post_spdif = patch_cm9739_post_spdif,
+ 	.update_jacks = cm9739_update_jacks
+@@ -3242,7 +3242,7 @@ static int patch_cm9761_specific(struct 
+ 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9761_ops = {
++static const struct snd_ac97_build_ops patch_cm9761_ops = {
+ 	.build_specific	= patch_cm9761_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif,
+ 	.update_jacks = cm9761_update_jacks
+@@ -3338,7 +3338,7 @@ static int patch_cm9780_specific(struct 
+ 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
+ }
+ 
+-static struct snd_ac97_build_ops patch_cm9780_ops = {
++static const struct snd_ac97_build_ops patch_cm9780_ops = {
+ 	.build_specific	= patch_cm9780_specific,
+ 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
+ };
+@@ -3458,7 +3458,7 @@ static int patch_vt1616_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_vt1616_ops = {
++static const struct snd_ac97_build_ops patch_vt1616_ops = {
+ 	.build_specific	= patch_vt1616_specific
+ };
+ 
+@@ -3812,7 +3812,7 @@ static int patch_it2646_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_it2646_ops = {
++static const struct snd_ac97_build_ops patch_it2646_ops = {
+ 	.build_specific	= patch_it2646_specific,
+ 	.update_jacks = it2646_update_jacks
+ };
+@@ -3846,7 +3846,7 @@ static int patch_si3036_specific(struct 
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_si3036_ops = {
++static const struct snd_ac97_build_ops patch_si3036_ops = {
+ 	.build_specific	= patch_si3036_specific,
+ };
+ 
+@@ -3879,7 +3879,7 @@ static struct snd_ac97_res_table lm4550_
+ 	{ AC97_AUX, 0x1f1f },
+ 	{ AC97_PCM, 0x1f1f },
+ 	{ AC97_REC_GAIN, 0x0f0f },
+-	{ } /* terminator */
++	{ 0, 0 } /* terminator */
+ };
+ 
+ static int patch_lm4550(struct snd_ac97 *ac97)
+@@ -3913,7 +3913,7 @@ static int patch_ucb1400_specific(struct
+ 	return 0;
+ }
+ 
+-static struct snd_ac97_build_ops patch_ucb1400_ops = {
++static const struct snd_ac97_build_ops patch_ucb1400_ops = {
+ 	.build_specific	= patch_ucb1400_specific,
+ };
+ 
+diff -urNp linux-2.6.32.14/sound/pci/ens1370.c linux-2.6.32.14/sound/pci/ens1370.c
+--- linux-2.6.32.14/sound/pci/ens1370.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/pci/ens1370.c	2010-05-28 21:27:16.698950213 -0400
+@@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
+ 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
+ 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
+diff -urNp linux-2.6.32.14/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.14/sound/pci/hda/patch_intelhdmi.c
+--- linux-2.6.32.14/sound/pci/hda/patch_intelhdmi.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/pci/hda/patch_intelhdmi.c	2010-05-28 21:27:16.698950213 -0400
+@@ -511,10 +511,10 @@ static void hdmi_non_intrinsic_event(str
+ 		cp_ready);
+ 
+ 	/* TODO */
+-	if (cp_state)
+-		;
+-	if (cp_ready)
+-		;
++	if (cp_state) {
++	}
++	if (cp_ready) {
++	}
+ }
+ 
+ 
+diff -urNp linux-2.6.32.14/sound/pci/intel8x0.c linux-2.6.32.14/sound/pci/intel8x0.c
+--- linux-2.6.32.14/sound/pci/intel8x0.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/pci/intel8x0.c	2010-05-28 21:27:16.698950213 -0400
+@@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
+@@ -2123,7 +2123,7 @@ static struct ac97_quirk ac97_quirks[] _
+ 		.type = AC97_TUNE_HP_ONLY
+ 	},
+ #endif
+-	{ } /* terminator */
++	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
+ };
+ 
+ static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
+diff -urNp linux-2.6.32.14/sound/pci/intel8x0m.c linux-2.6.32.14/sound/pci/intel8x0m.c
+--- linux-2.6.32.14/sound/pci/intel8x0m.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/sound/pci/intel8x0m.c	2010-05-28 21:27:16.703208428 -0400
+@@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
+ 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
+ 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
+ #endif
+-	{ 0, }
++	{ 0, 0, 0, 0, 0, 0, 0 }
+ };
+ 
+ MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
+@@ -1264,7 +1264,7 @@ static struct shortname_table {
+ 	{ 0x5455, "ALi M5455" },
+ 	{ 0x746d, "AMD AMD8111" },
+ #endif
+-	{ 0 },
++	{ 0, NULL },
+ };
+ 
+ static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
+diff -urNp linux-2.6.32.14/usr/gen_init_cpio.c linux-2.6.32.14/usr/gen_init_cpio.c
+--- linux-2.6.32.14/usr/gen_init_cpio.c	2010-03-15 11:52:04.000000000 -0400
++++ linux-2.6.32.14/usr/gen_init_cpio.c	2010-05-28 21:27:16.703208428 -0400
+@@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
+ 	int retval;
+ 	int rc = -1;
+ 	int namesize;
+-	int i;
++	unsigned int i;
+ 
+ 	mode |= S_IFREG;
+ 
+@@ -383,9 +383,10 @@ static char *cpio_replace_env(char *new_
+                        *env_var = *expanded = '\0';
+                        strncat(env_var, start + 2, end - start - 2);
+                        strncat(expanded, new_location, start - new_location);
+-                       strncat(expanded, getenv(env_var), PATH_MAX);
+-                       strncat(expanded, end + 1, PATH_MAX);
++                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
++                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
+                        strncpy(new_location, expanded, PATH_MAX);
++                       new_location[PATH_MAX] = 0;
+                } else
+                        break;
+        }
+diff -urNp linux-2.6.32.14/virt/kvm/kvm_main.c linux-2.6.32.14/virt/kvm/kvm_main.c
+--- linux-2.6.32.14/virt/kvm/kvm_main.c	2010-04-29 17:49:38.869035092 -0400
++++ linux-2.6.32.14/virt/kvm/kvm_main.c	2010-05-28 21:27:16.731271133 -0400
+@@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vcpu_fops = {
+ 	.release        = kvm_vcpu_release,
+ 	.unlocked_ioctl = kvm_vcpu_ioctl,
+@@ -2344,6 +2345,7 @@ static int kvm_vm_mmap(struct file *file
+ 	return 0;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_vm_fops = {
+ 	.release        = kvm_vm_release,
+ 	.unlocked_ioctl = kvm_vm_ioctl,
+@@ -2431,6 +2433,7 @@ out:
+ 	return r;
+ }
+ 
++/* cannot be const */
+ static struct file_operations kvm_chardev_ops = {
+ 	.unlocked_ioctl = kvm_dev_ioctl,
+ 	.compat_ioctl   = kvm_dev_ioctl,
+@@ -2440,6 +2443,9 @@ static struct miscdevice kvm_dev = {
+ 	KVM_MINOR,
+ 	"kvm",
+ 	&kvm_chardev_ops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ static void hardware_enable(void *junk)
+@@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
+ 	kvm_arch_vcpu_put(vcpu);
+ }
+ 
+-int kvm_init(void *opaque, unsigned int vcpu_size,
++int kvm_init(const void *opaque, unsigned int vcpu_size,
+ 		  struct module *module)
+ {
+ 	int r;
-- 
cgit v1.2.3


From 10828a1e09839f7b4bba8428ba0abd4417162935 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 11:32:42 +0000
Subject: main/confuse: upgrade to 2.7

---
 main/confuse/APKBUILD | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/main/confuse/APKBUILD b/main/confuse/APKBUILD
index ec90644f..b58927c7 100644
--- a/main/confuse/APKBUILD
+++ b/main/confuse/APKBUILD
@@ -1,14 +1,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=confuse
-pkgver=2.6
-pkgrel=1
+pkgver=2.7
+pkgrel=0
 pkgdesc="C-library for parsing configuration files"
 url="http://www.nongnu.org/confuse"
 license="LGPL"
 depends=
 makedepends="flex bison pkgconfig"
 subpackages="$pkgname-dev"
-source="http://bzero.se/$pkgname/$pkgname-$pkgver.tar.gz"
+source="http://savannah.nongnu.org/download/confuse/confuse-$pkgver.tar.gz"
 
 build() {
 	cd "$srcdir"/$pkgname-$pkgver
@@ -26,4 +26,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 	install -D -m644 libconfuse.pc "$pkgdir"/usr/lib/pkgconfig/libconfuse.pc
 }
-md5sums="0e883d66f0f58fc33585b430c652aa30  confuse-2.6.tar.gz"
+md5sums="45932fdeeccbb9ef4228f1c1a25e9c8f  confuse-2.7.tar.gz"
-- 
cgit v1.2.3


From 75ed3844602938bdb5caa4a6044900d13b9d18a0 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 11:35:50 +0000
Subject: main/libogg: upgrade to 1.2.0

---
 main/libogg/APKBUILD | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/main/libogg/APKBUILD b/main/libogg/APKBUILD
index 072f0216..5d5c3719 100644
--- a/main/libogg/APKBUILD
+++ b/main/libogg/APKBUILD
@@ -2,8 +2,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 
 pkgname=libogg
-pkgver=1.1.4
-pkgrel=1
+pkgver=1.2.0
+pkgrel=0
 pkgdesc="Ogg bitstream and framing library"
 url="http://xiph.org/ogg/"
 license="as-is"
@@ -17,9 +17,12 @@ build() {
 
 	./configure --prefix=/usr
 	make || return 1
-	make -j1 DESTDIR="$pkgdir" install
+}
 
+package() {
+	cd "$srcdir/$pkgname-$pkgver"
+	make -j1 DESTDIR="$pkgdir" install
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
 
-md5sums="10200ec22543841d9d1c23e0aed4e5e9  libogg-1.1.4.tar.gz"
+md5sums="c95b73759acfc30712beef6ce4e88efa  libogg-1.2.0.tar.gz"
-- 
cgit v1.2.3


From 5bfbc398e72f7453bd5b2265afcad11b20be4bdf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 11:38:33 +0000
Subject: main/ngircd: upgrade to 16

---
 main/ngircd/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/ngircd/APKBUILD b/main/ngircd/APKBUILD
index 3b6dce21..dfe18d97 100644
--- a/main/ngircd/APKBUILD
+++ b/main/ngircd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ngircd
-pkgver=15
-pkgrel=2
+pkgver=16
+pkgrel=0
 pkgdesc="Next Generation IRC Daemon"
 url="http://ngircd.barton.de/"
 license="GPL"
@@ -34,5 +34,5 @@ package() {
 	install -Dm755 ../$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
 }
 
-md5sums="c183a85eba6fe51255983848f099c8ae  ngircd-15.tar.gz
+md5sums="8c9e0382cd982b0ca77c05528ebe28eb  ngircd-16.tar.gz
 50d8388540a2e3eb0630e8ac6369f394  ngircd.initd"
-- 
cgit v1.2.3


From 1d97e4ca8da481cc993af05020ee794d21eb0cbf Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 12:49:59 +0000
Subject: main/xchat: upgrade to 2.8.8

---
 main/xchat/APKBUILD                 | 21 ++++++--------
 main/xchat/depreciated-macros.patch | 57 -------------------------------------
 main/xchat/xchat-gtk2.patch         | 12 --------
 3 files changed, 9 insertions(+), 81 deletions(-)
 delete mode 100644 main/xchat/depreciated-macros.patch
 delete mode 100644 main/xchat/xchat-gtk2.patch

diff --git a/main/xchat/APKBUILD b/main/xchat/APKBUILD
index 9fe4bbe2..c5c67a59 100644
--- a/main/xchat/APKBUILD
+++ b/main/xchat/APKBUILD
@@ -1,23 +1,23 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=xchat
-pkgver=2.8.6
-pkgrel=4
+pkgver=2.8.8
+pkgrel=0
 pkgdesc="A GTK+ based IRC client"
 url="http://www.xchat.org/"
 license="GPL"
 makedepends="pkgconfig gtk+-dev openssl-dev dbus-glib-dev perl-dev
 	libxext-dev"
 source="http://www.$pkgname.org/files/source/2.8/$pkgname-$pkgver.tar.bz2
-	http://www.$pkgname.org/files/source/2.8/patches/xc286-smallfixes.diff
-	depreciated-macros.patch
-	$pkgname-gtk2.patch"
+	"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 < ../xc286-smallfixes.diff || return 1
-	patch -p1 -i "$srcdir"/depreciated-macros.patch || return 1
-	patch -p1 < ../xchat-gtk2.patch || return 1
+	for i in "$srcdir"/*.patch; do
+		[ -r "$i" ] || continue
+		msg "Applying $i"
+		patch -p1 -i "$i" || return 1
+	done
 }
 
 
@@ -42,7 +42,4 @@ package() {
 	make DESTDIR="$pkgdir" install || return 1
 }
 
-md5sums="1f2670865d43a23a9abc596dde999aca  xchat-2.8.6.tar.bz2
-eb68b6261bf6740cb5f223627eb8f384  xc286-smallfixes.diff
-daee42354f95ca54a84248c3cb690fee  depreciated-macros.patch
-f3fe00982c0bec93152ed0b32438ef87  xchat-gtk2.patch"
+md5sums="6775c44f38e84d06c06c336b32c4a452  xchat-2.8.8.tar.bz2"
diff --git a/main/xchat/depreciated-macros.patch b/main/xchat/depreciated-macros.patch
deleted file mode 100644
index 1b86be2f..00000000
--- a/main/xchat/depreciated-macros.patch
+++ /dev/null
@@ -1,57 +0,0 @@
---- a/src/fe-gtk/fe-gtk.c	2008-02-24 08:39:44.000000000 +0000
-+++ b/src/fe-gtk/fe-gtk.c.new	2010-04-01 18:10:31.840778707 +0000
-@@ -819,7 +819,8 @@
- 	switch (info_type)
- 	{
- 	case 0:	/* window status */
--		if (!GTK_WIDGET_VISIBLE (GTK_WINDOW (sess->gui->window)))
-+		if (!gtk_widget_get_visible (GTK_WINDOW (sess->gui->window)))
-+
- 			return 2;	/* hidden (iconified or systray) */
- #if GTK_CHECK_VERSION(2,4,0)
- 		if (gtk_window_is_active (GTK_WINDOW (sess->gui->window)))
---- a/src/fe-gtk/menu.c	2008-06-08 07:59:37.000000000 +0000
-+++ b/src/fe-gtk/menu.c.new	2010-04-01 18:15:54.527573869 +0000
-@@ -1670,7 +1670,7 @@
- menu_canacaccel (GtkWidget *widget, guint signal_id, gpointer user_data)
- {
- 	/* GTK2.2 behaviour */
--	return GTK_WIDGET_IS_SENSITIVE (widget);
-+	return gtk_widget_is_sensitive (widget);
- }
- 
- #endif
---- a/src/fe-gtk/maingui.c	2008-04-01 08:53:41.000000000 +0000
-+++ b/src/fe-gtk/maingui.c.new	2010-04-01 18:21:56.400181435 +0000
-@@ -599,7 +599,7 @@
- 	int num;
- 	GtkWidget *f = NULL;
- 
--	if (current_sess && GTK_WIDGET_HAS_FOCUS (current_sess->gui->input_box))
-+	if (current_sess && gtk_widget_has_focus (current_sess->gui->input_box))
- 		f = current_sess->gui->input_box;
- 
- 	num = gtk_notebook_page_num (GTK_NOTEBOOK (mg_gui->note_book), box);
-@@ -809,8 +809,8 @@
- static void
- mg_hide_empty_pane (GtkPaned *pane)
- {
--	if ((pane->child1 == NULL || !GTK_WIDGET_VISIBLE (pane->child1)) &&
--		 (pane->child2 == NULL || !GTK_WIDGET_VISIBLE (pane->child2)))
-+	if ((pane->child1 == NULL || !gtk_widget_get_visible (pane->child1)) &&
-+		 (pane->child2 == NULL || !gtk_widget_get_visible (pane->child2)))
- 	{
- 		gtk_widget_hide (GTK_WIDGET (pane));
- 		return;
-@@ -2563,9 +2563,9 @@
- {
- 	int handle_size;
- 
--/*	if (pane->child1 == NULL || (!GTK_WIDGET_VISIBLE (pane->child1)))
-+/*	if (pane->child1 == NULL || (!gtk_widget_get_visible (pane->child1)))
- 		return;
--	if (pane->child2 == NULL || (!GTK_WIDGET_VISIBLE (pane->child2)))
-+	if (pane->child2 == NULL || (!gtk_widget_get_visible (pane->child2)))
- 		return;*/
- 
- 	gtk_widget_style_get (GTK_WIDGET (pane), "handle-size", &handle_size, NULL);
diff --git a/main/xchat/xchat-gtk2.patch b/main/xchat/xchat-gtk2.patch
deleted file mode 100644
index 4e13a2cf..00000000
--- a/main/xchat/xchat-gtk2.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- xchat-2.8.6/src/fe-gtk/xtext.h.orig 2008-02-24 
-05:48:02.000000000 +0100
-+++ xchat-2.8.6/src/fe-gtk/xtext.h 2008-09-06 
-02:18:39.000000000 +0200
-@@ -270,6 +270,6 @@
- xtext_buffer *gtk_xtext_buffer_new (GtkXText *xtext);
- void gtk_xtext_buffer_free (xtext_buffer *buf);
- void gtk_xtext_buffer_show (GtkXText *xtext, xtext_buffer *buf, int render);
--GtkType gtk_xtext_get_type (void);
-+GType gtk_xtext_get_type (void);
-
- #endif
-- 
cgit v1.2.3


From 1eaec8708ee7b9fcdb44c1e7cc8beea0cd0f953a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 12:55:54 +0000
Subject: main/linux-vserver: upgrade to 2.6.32.14-vs2.3.0.36.29.4

set KBUILD_VERSION too while here
---
 main/linux-vserver/APKBUILD | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/main/linux-vserver/APKBUILD b/main/linux-vserver/APKBUILD
index 57f7ec06..794893bf 100644
--- a/main/linux-vserver/APKBUILD
+++ b/main/linux-vserver/APKBUILD
@@ -2,7 +2,7 @@
 
 _flavor=vserver
 pkgname=linux-${_flavor}
-pkgver=2.6.32.13
+pkgver=2.6.32.14
 
 _kernver=2.6.32
 pkgrel=0
@@ -15,7 +15,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	http://vserver.13thfloor.at/Experimental/patch-2.6.32.13-vs2.3.0.36.29.4.diff
+	http://vserver.13thfloor.at/Experimental/patch-2.6.32.14-vs2.3.0.36.29.4.diff
 	kernelconfig.x86
 	"
 subpackages="$pkgname-dev"
@@ -50,7 +50,10 @@ menuconfig() {
 
 build() {
 	cd "$srcdir"/build
-	make CC="${CC:-gcc}" || return 1
+	make CC="${CC:-gcc}" \
+		KBUILD_BUILD_VERSION="$((pkgrel + 1 ))-Alpine" \
+		|| return 1
+
 }
 
 package() {
-- 
cgit v1.2.3


From dec7d7cc8f62e45d37ee9aac000f9cfdaf9ef92a Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 13:01:52 +0000
Subject: main/linux-vserver: build fix

updated checksum
---
 main/linux-vserver/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/linux-vserver/APKBUILD b/main/linux-vserver/APKBUILD
index 794893bf..c8a5774f 100644
--- a/main/linux-vserver/APKBUILD
+++ b/main/linux-vserver/APKBUILD
@@ -118,6 +118,6 @@ dev() {
 }
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
-ba6abb1ffee513a1d4f831599ddae490  patch-2.6.32.13.bz2
-ef893f851b25e3806f24f1460e11f9b5  patch-2.6.32.13-vs2.3.0.36.29.4.diff
+90f0ec928aff643f05a8b98fad54b10c  patch-2.6.32.14.bz2
+9b580218bcde3965bcb6b161227b99c4  patch-2.6.32.14-vs2.3.0.36.29.4.diff
 42ce36a36e7c71ee54761e56d59d17ed  kernelconfig.x86"
-- 
cgit v1.2.3


From 284d20e7a1a0ec3b7900600d6c801fbbded2f95f Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 15:01:16 +0000
Subject: main/postfix: upgrade to 2.7.0

and backport the dynamic maps patch
---
 main/postfix/APKBUILD                         |   10 +-
 main/postfix/postfix-2.6.1-dynamicmaps.patch  | 5273 -------------------------
 main/postfix/postfix-2.7.0-dynamic-maps.patch | 1064 +++++
 3 files changed, 1069 insertions(+), 5278 deletions(-)
 delete mode 100644 main/postfix/postfix-2.6.1-dynamicmaps.patch
 create mode 100644 main/postfix/postfix-2.7.0-dynamic-maps.patch

diff --git a/main/postfix/APKBUILD b/main/postfix/APKBUILD
index 2367e986..a2213c26 100644
--- a/main/postfix/APKBUILD
+++ b/main/postfix/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=postfix
-pkgver=2.6.5
-pkgrel=4
+pkgver=2.7.0
+pkgrel=0
 pkgdesc="Secure and fast drop-in replacement for Sendmail (MTA)"
 url="http://www.postfix.org/"
 license="IPL-1"
@@ -12,7 +12,7 @@ subpackages="$pkgname-doc $pkgname-ldap $pkgname-mysql $pkgname-pcre
 	$pkgname-pgsql"
 source="ftp://ftp.porcupine.org/mirrors/$pkgname-release/official/$pkgname-$pkgver.tar.gz
 	$pkgname.initd
-	postfix-2.6.1-dynamicmaps.patch
+	postfix-2.7.0-dynamic-maps.patch
 	dynamicmaps.cf
 	postfix-ldap.post-install
 	postfix-mysql.post-install
@@ -145,9 +145,9 @@ mysql() { _mv_dict mysql ;}
 pcre()  { _mv_dict pcre ; }
 pgsql() { _mv_dict pgsql ; }
 
-md5sums="6b954cfb3eb6141dac1e773281211717  postfix-2.6.5.tar.gz
+md5sums="df648f59421604e895cce56325f00bae  postfix-2.7.0.tar.gz
 6bbabcd041aefaf40e1f3ee1fc1d6d7e  postfix.initd
-d45552cfdcd911d0934c0cb7816c4011  postfix-2.6.1-dynamicmaps.patch
+4d9c373e8a35bfb5bfa9b899e64fb70a  postfix-2.7.0-dynamic-maps.patch
 442efd1a95b0c061dfb8ab75456e0f24  dynamicmaps.cf
 2ebe51a882eb9d6d7866583eb6af3969  postfix-ldap.post-install
 2ebe51a882eb9d6d7866583eb6af3969  postfix-mysql.post-install
diff --git a/main/postfix/postfix-2.6.1-dynamicmaps.patch b/main/postfix/postfix-2.6.1-dynamicmaps.patch
deleted file mode 100644
index 630abedc..00000000
--- a/main/postfix/postfix-2.6.1-dynamicmaps.patch
+++ /dev/null
@@ -1,5273 +0,0 @@
-diff -ruN a/conf/postfix-files b/conf/postfix-files
---- a/conf/postfix-files	2009-06-01 12:27:42.000000000 +0000
-+++ b/conf/postfix-files	2009-06-01 13:08:26.000000000 +0000
-@@ -65,6 +65,10 @@
- $queue_directory/trace:d:$mail_owner:-:700:ucr
- $daemon_directory/anvil:f:root:-:755
- $daemon_directory/bounce:f:root:-:755
-+$daemon_directory/dict_ldap.so:f:root:-:755
-+$daemon_directory/dict_pcre.so:f:root:-:755
-+$daemon_directory/dict_mysql.so:f:root:-:755
-+$daemon_directory/dict_pgsql.so:f:root:-:755
- $daemon_directory/cleanup:f:root:-:755
- $daemon_directory/discard:f:root:-:755
- $daemon_directory/error:f:root:-:755
-@@ -94,6 +98,11 @@
- $daemon_directory/trivial-rewrite:f:root:-:755
- $daemon_directory/verify:f:root:-:755
- $daemon_directory/virtual:f:root:-:755
-+/usr/lib/libpostfix-dns.so.1:f:root:-:755
-+/usr/lib/libpostfix-global.so.1:f:root:-:755
-+/usr/lib/libpostfix-tls.so.1:f:root:-:755
-+/usr/lib/libpostfix-master.so.1:f:root:-:755
-+/usr/lib/libpostfix-util.so.1:f:root:-:755
- $daemon_directory/nqmgr:h:$daemon_directory/qmgr
- $daemon_directory/lmtp:h:$daemon_directory/smtp
- $command_directory/postalias:f:root:-:755
-@@ -117,6 +126,7 @@
- $config_directory/aliases:f:root:-:644:p1
- $config_directory/bounce.cf.default:f:root:-:644:1
- $config_directory/canonical:f:root:-:644:p1
-+$config_directory/dynamicmaps.cf:f:root:-:644:p
- $config_directory/cidr_table:f:root:-:644:o
- $config_directory/generic:f:root:-:644:p1
- $config_directory/generics:f:root:-:644:o
-diff -ruN a/src/dns/Makefile.in b/src/dns/Makefile.in
---- a/src/dns/Makefile.in	2009-06-01 12:27:43.000000000 +0000
-+++ b/src/dns/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -14,7 +14,7 @@
- LIB_DIR	= ../../lib
- INC_DIR	= ../../include
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
- 
- all: $(LIB)
- 
-@@ -31,12 +31,10 @@
- root_tests:
- 
- $(LIB):	$(OBJS)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	gcc -shared -Wl,-soname,libpostfix-dns.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
- update: $(LIB_DIR)/$(LIB) $(HDRS)
- 	-for i in $(HDRS); \
-diff -ruN a/src/global/Makefile.in b/src/global/Makefile.in
---- a/src/global/Makefile.in	2009-06-01 12:27:43.000000000 +0000
-+++ b/src/global/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -34,7 +34,7 @@
- 	canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \
- 	clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \
- 	defer.o deliver_completed.o deliver_flock.o deliver_pass.o \
--	deliver_request.o dict_ldap.o dict_mysql.o dict_pgsql.o \
-+	deliver_request.o \
- 	dict_proxy.o domain_list.o dot_lockfile.o dot_lockfile_as.o \
- 	dsb_scan.o dsn.o dsn_buf.o dsn_mask.o dsn_print.o dsn_util.o \
- 	ehlo_mask.o ext_prop.o file_id.o flush_clnt.o header_opts.o \
-@@ -103,10 +103,13 @@
- LIB_DIR	= ../../lib
- INC_DIR	= ../../include
- MAKES	=
-+LDAPSO  = dict_ldap.so
-+MYSQLSO = dict_mysql.so
-+PGSQLSO = dict_pgsql.so
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
- 
--all: $(LIB)
-+all: $(LIB) $(LDAPSO) $(MYSQLSO) $(PGSQLSO) 
- 
- $(OBJS): ../../conf/makedefs.out
- 
-@@ -116,14 +119,30 @@
- test:	$(TESTPROG)
- 
- $(LIB):	$(OBJS)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	gcc -shared -Wl,-soname,libpostfix-global.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
-+
-+$(LDAPSO): dict_ldap.o $(LIB) ../../lib/libglobal.a
-+	gcc -shared -Wl,-soname,dict_ldap.so -o $@ $? -lldap -llber -L../../lib -lutil -L. -lglobal
-+
-+$(MYSQLSO): dict_mysql.o $(LIB) ../../lib/libglobal.a
-+	gcc -shared -Wl,-soname,dict_mysql.so -o $@ $? -lmysqlclient -L. -lutil -lglobal
-+
-+$(PGSQLSO): dict_pgsql.o $(LIB) ../../lib/libglobal.a
-+	gcc -shared -Wl,-soname,dict_pgsql.so -o $@ $? -lpq -L. -lutil -lglobal
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
--update: $(LIB_DIR)/$(LIB) $(HDRS)
-+../../libexec/$(LDAPSO): $(LDAPSO)
-+	cp $(LDAPSO) ../../libexec
-+
-+../../libexec/$(MYSQLSO): $(MYSQLSO)
-+	cp $(MYSQLSO) ../../libexec
-+
-+../../libexec/$(PGSQLSO): $(PGSQLSO)
-+	cp $(PGSQLSO) ../../libexec
-+
-+update: $(LIB_DIR)/$(LIB) ../../libexec/$(LDAPSO) ../../libexec/$(MYSQLSO) ../../libexec/$(PGSQLSO) $(HDRS)
- 	-for i in $(HDRS); \
- 	do \
- 	  cmp -s $$i $(INC_DIR)/$$i 2>/dev/null || cp $$i $(INC_DIR); \
-@@ -491,7 +510,7 @@
- 	lint $(DEFS) $(SRCS) $(LINTFIX)
- 
- clean:
--	rm -f *.o $(LIB) *core $(TESTPROG) junk
-+	rm -f *.o $(LIB) $(LDAPSO) $(MYSQLSO) $(PGSQLSO) *core $(TESTPROG) junk
- 	rm -rf printfck
- 
- tidy:	clean
-diff -ruN a/src/global/Makefile.in.orig b/src/global/Makefile.in.orig
---- a/src/global/Makefile.in.orig	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/global/Makefile.in.orig	2009-06-01 13:07:56.000000000 +0000
-@@ -0,0 +1,2018 @@
-+SHELL	= /bin/sh
-+SRCS	= abounce.c anvil_clnt.c been_here.c bounce.c bounce_log.c \
-+	canon_addr.c cfg_parser.c cleanup_strerror.c cleanup_strflags.c \
-+	clnt_stream.c conv_time.c db_common.c debug_peer.c debug_process.c \
-+	defer.c deliver_completed.c deliver_flock.c deliver_pass.c \
-+	deliver_request.c dict_ldap.c dict_mysql.c dict_pgsql.c \
-+	dict_proxy.c domain_list.c dot_lockfile.c dot_lockfile_as.c \
-+	dsb_scan.c dsn.c dsn_buf.c dsn_mask.c dsn_print.c dsn_util.c \
-+	ehlo_mask.c ext_prop.c file_id.c flush_clnt.c header_opts.c \
-+	header_token.c input_transp.c int_filt.c is_header.c log_adhoc.c \
-+	mail_addr.c mail_addr_crunch.c mail_addr_find.c mail_addr_map.c \
-+	mail_command_client.c mail_command_server.c mail_conf.c \
-+	mail_conf_bool.c mail_conf_int.c mail_conf_long.c mail_conf_raw.c \
-+	mail_conf_str.c mail_conf_time.c mail_connect.c mail_copy.c \
-+	mail_date.c mail_dict.c mail_error.c mail_flush.c mail_open_ok.c \
-+	mail_params.c mail_pathname.c mail_queue.c mail_run.c \
-+	mail_scan_dir.c mail_stream.c mail_task.c mail_trigger.c maps.c \
-+	mark_corrupt.c match_parent_style.c mbox_conf.c mbox_open.c \
-+	mime_state.c mkmap_cdb.c mkmap_db.c mkmap_dbm.c mkmap_open.c \
-+	mkmap_sdbm.c msg_stats_print.c msg_stats_scan.c mynetworks.c \
-+	mypwd.c namadr_list.c off_cvt.c opened.c own_inet_addr.c \
-+	pipe_command.c post_mail.c quote_821_local.c quote_822_local.c \
-+	rcpt_buf.c rcpt_print.c rec_attr_map.c rec_streamlf.c rec_type.c \
-+	recipient_list.c record.c remove.c resolve_clnt.c resolve_local.c \
-+	rewrite_clnt.c scache_clnt.c scache_multi.c scache_single.c \
-+	sent.c smtp_stream.c split_addr.c string_list.c strip_addr.c \
-+	sys_exits.c timed_ipc.c tok822_find.c tok822_node.c tok822_parse.c \
-+	tok822_resolve.c tok822_rewrite.c tok822_tree.c trace.c \
-+	user_acl.c valid_mailhost_addr.c verify.c verify_clnt.c \
-+	verp_sender.c wildcard_inet_addr.c xtext.c delivered_hdr.c \
-+	fold_addr.c header_body_checks.c mkmap_proxy.c data_redirect.c \
-+	match_service.c mail_conf_nint.c
-+OBJS	= abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
-+	canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \
-+	clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \
-+	defer.o deliver_completed.o deliver_flock.o deliver_pass.o \
-+	deliver_request.o dict_ldap.o dict_mysql.o dict_pgsql.o \
-+	dict_proxy.o domain_list.o dot_lockfile.o dot_lockfile_as.o \
-+	dsb_scan.o dsn.o dsn_buf.o dsn_mask.o dsn_print.o dsn_util.o \
-+	ehlo_mask.o ext_prop.o file_id.o flush_clnt.o header_opts.o \
-+	header_token.o input_transp.o int_filt.o is_header.o log_adhoc.o \
-+	mail_addr.o mail_addr_crunch.o mail_addr_find.o mail_addr_map.o \
-+	mail_command_client.o mail_command_server.o mail_conf.o \
-+	mail_conf_bool.o mail_conf_int.o mail_conf_long.o mail_conf_raw.o \
-+	mail_conf_str.o mail_conf_time.o mail_connect.o mail_copy.o \
-+	mail_date.o mail_dict.o mail_error.o mail_flush.o mail_open_ok.o \
-+	mail_params.o mail_pathname.o mail_queue.o mail_run.o \
-+	mail_scan_dir.o mail_stream.o mail_task.o mail_trigger.o maps.o \
-+	mark_corrupt.o match_parent_style.o mbox_conf.o mbox_open.o \
-+	mime_state.o mkmap_cdb.o mkmap_db.o mkmap_dbm.o mkmap_open.o \
-+	mkmap_sdbm.o msg_stats_print.o msg_stats_scan.o mynetworks.o \
-+	mypwd.o namadr_list.o off_cvt.o opened.o own_inet_addr.o \
-+	pipe_command.o post_mail.o quote_821_local.o quote_822_local.o \
-+	rcpt_buf.o rcpt_print.o rec_attr_map.o rec_streamlf.o rec_type.o \
-+	recipient_list.o record.o remove.o resolve_clnt.o resolve_local.o \
-+	rewrite_clnt.o scache_clnt.o scache_multi.o scache_single.o \
-+	sent.o smtp_stream.o split_addr.o string_list.o strip_addr.o \
-+	sys_exits.o timed_ipc.o tok822_find.o tok822_node.o tok822_parse.o \
-+	tok822_resolve.o tok822_rewrite.o tok822_tree.o trace.o \
-+	user_acl.o valid_mailhost_addr.o verify.o verify_clnt.o \
-+	verp_sender.o wildcard_inet_addr.o xtext.o delivered_hdr.o \
-+	fold_addr.o header_body_checks.o mkmap_proxy.o data_redirect.o \
-+	match_service.o mail_conf_nint.o
-+HDRS	= abounce.h anvil_clnt.h been_here.h bounce.h bounce_log.h \
-+	canon_addr.h cfg_parser.h cleanup_user.h clnt_stream.h config.h \
-+	conv_time.h db_common.h debug_peer.h debug_process.h defer.h \
-+	deliver_completed.h deliver_flock.h deliver_pass.h deliver_request.h \
-+	dict_ldap.h dict_mysql.h dict_pgsql.h dict_proxy.h domain_list.h \
-+	dot_lockfile.h dot_lockfile_as.h dsb_scan.h dsn.h dsn_buf.h \
-+	dsn_mask.h dsn_print.h dsn_util.h ehlo_mask.h ext_prop.h \
-+	file_id.h flush_clnt.h header_opts.h header_token.h input_transp.h \
-+	int_filt.h is_header.h lex_822.h log_adhoc.h mail_addr.h \
-+	mail_addr_crunch.h mail_addr_find.h mail_addr_map.h mail_conf.h \
-+	mail_copy.h mail_date.h mail_dict.h mail_error.h mail_flush.h \
-+	mail_open_ok.h mail_params.h mail_proto.h mail_queue.h mail_run.h \
-+	mail_scan_dir.h mail_stream.h mail_task.h mail_version.h maps.h \
-+	mark_corrupt.h match_parent_style.h mbox_conf.h mbox_open.h \
-+	mime_state.h mkmap.h msg_stats.h mynetworks.h mypwd.h namadr_list.h \
-+	off_cvt.h opened.h own_inet_addr.h pipe_command.h post_mail.h \
-+	qmgr_user.h qmqp_proto.h quote_821_local.h quote_822_local.h \
-+	quote_flags.h rcpt_buf.h rcpt_print.h rec_attr_map.h rec_streamlf.h \
-+	rec_type.h recipient_list.h record.h resolve_clnt.h resolve_local.h \
-+	rewrite_clnt.h scache.h sent.h smtp_stream.h split_addr.h \
-+	string_list.h strip_addr.h sys_exits.h timed_ipc.h tok822.h \
-+	trace.h user_acl.h valid_mailhost_addr.h verify.h verify_clnt.h \
-+	verp_sender.h wildcard_inet_addr.h xtext.h delivered_hdr.h \
-+	fold_addr.h header_body_checks.h data_redirect.h match_service.h
-+TESTSRC	= rec2stream.c stream2rec.c recdump.c
-+DEFS	= -I. -I$(INC_DIR) -D$(SYSTYPE)
-+CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
-+INCL	=
-+LIB	= libglobal.a
-+TESTPROG= domain_list dot_lockfile mail_addr_crunch mail_addr_find \
-+	mail_addr_map mail_date maps mynetworks mypwd namadr_list \
-+	off_cvt quote_822_local rec2stream recdump resolve_clnt \
-+	resolve_local rewrite_clnt stream2rec string_list tok822_parse \
-+	quote_821_local mail_conf_time mime_state strip_addr \
-+	verify_clnt xtext anvil_clnt scache ehlo_mask \
-+	valid_mailhost_addr own_inet_addr header_body_checks \
-+	data_redirect
-+
-+LIBS	= ../../lib/libutil.a
-+LIB_DIR	= ../../lib
-+INC_DIR	= ../../include
-+MAKES	=
-+
-+.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+
-+all: $(LIB)
-+
-+$(OBJS): ../../conf/makedefs.out
-+
-+Makefile: Makefile.in
-+	cat ../../conf/makedefs.out $? >$@
-+
-+test:	$(TESTPROG)
-+
-+$(LIB):	$(OBJS)
-+	$(AR) $(ARFL) $(LIB) $?
-+	$(RANLIB) $(LIB)
-+
-+$(LIB_DIR)/$(LIB): $(LIB)
-+	cp $(LIB) $(LIB_DIR)
-+	$(RANLIB) $(LIB_DIR)/$(LIB)
-+
-+update: $(LIB_DIR)/$(LIB) $(HDRS)
-+	-for i in $(HDRS); \
-+	do \
-+	  cmp -s $$i $(INC_DIR)/$$i 2>/dev/null || cp $$i $(INC_DIR); \
-+	done
-+	cd $(INC_DIR); chmod 644 $(HDRS)
-+
-+dot_lockfile: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) -DTEST $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+tok822_parse: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) -DTEST $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+rec2stream: rec2stream.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+stream2rec: stream2rec.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+recdump: recdump.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+namadr_list: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+domain_list: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mynetworks: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+resolve_clnt: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+rewrite_clnt: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+quote_822_local: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+off_cvt: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mail_addr_map: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mail_addr_find: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+maps: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mypwd: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mail_date: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+resolve_local: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mail_addr_crunch: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+string_list: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+local_transport: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+quote_821_local: quote_821_local.c $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS) $(SYSLIBS)
-+
-+mail_conf_time: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) -DTEST $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+mime_state: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) -DTEST $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+strip_addr: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) -DTEST $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+verify_clnt: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+xtext: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+anvil_clnt: $(LIB) $(LIBS)
-+	mv $@.o junk
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+	mv junk $@.o
-+
-+scache: scache.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+ehlo_mask: ehlo_mask.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+valid_mailhost_addr: valid_mailhost_addr.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+own_inet_addr: own_inet_addr.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+header_body_checks: header_body_checks.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+data_redirect: data_redirect.c $(LIB) $(LIBS)
-+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
-+
-+tests: tok822_test mime_tests strip_addr_test tok822_limit_test \
-+	xtext_test scache_multi_test ehlo_mask_test \
-+	namadr_list_test mail_conf_time_test header_body_checks_tests
-+
-+mime_tests: mime_test mime_nest mime_8bit mime_dom mime_trunc mime_cvt \
-+	mime_cvt2 mime_cvt3 mime_garb1 mime_garb2 mime_garb3 mime_garb4
-+
-+header_body_checks_tests: header_body_checks_null_test \
-+	header_body_checks_warn_test header_body_checks_prepend_test \
-+	header_body_checks_ignore_test header_body_checks_replace_test
-+
-+root_tests: rewrite_clnt_test resolve_clnt_test
-+
-+tok822_test: tok822_parse tok822_parse.in tok822_parse.ref
-+	./tok822_parse <tok822_parse.in >tok822_parse.tmp 2>&1
-+	diff tok822_parse.ref tok822_parse.tmp
-+	rm -f tok822_parse.tmp
-+
-+mime_test: mime_state mime_test.in mime_test.ref
-+	./mime_state <mime_test.in >mime_test.tmp
-+	diff  mime_test.ref mime_test.tmp
-+	rm -f mime_test.tmp
-+
-+mime_nest: mime_state mime_nest.in mime_nest.ref
-+	./mime_state <mime_nest.in >mime_nest.tmp
-+	diff  mime_nest.ref mime_nest.tmp
-+	rm -f mime_nest.tmp
-+
-+mime_8bit: mime_state mime_8bit.in mime_8bit.ref
-+	./mime_state <mime_8bit.in >mime_8bit.tmp
-+	diff  mime_8bit.ref mime_8bit.tmp
-+	rm -f mime_8bit.tmp
-+
-+mime_dom: mime_state mime_dom.in mime_dom.ref
-+	./mime_state <mime_dom.in >mime_dom.tmp
-+	diff  mime_dom.ref mime_dom.tmp
-+	rm -f mime_dom.tmp
-+
-+mime_trunc: mime_state mime_trunc.in mime_trunc.ref
-+	./mime_state <mime_trunc.in >mime_trunc.tmp
-+	diff  mime_trunc.ref mime_trunc.tmp
-+	rm -f mime_trunc.tmp
-+
-+mime_cvt: mime_state mime_cvt.in mime_cvt.ref
-+	./mime_state <mime_cvt.in >mime_cvt.tmp
-+	diff  mime_cvt.ref mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_cvt2: mime_state mime_cvt.in2 mime_cvt.ref2
-+	./mime_state <mime_cvt.in2 >mime_cvt.tmp
-+	diff  mime_cvt.ref2 mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_cvt3: mime_state mime_cvt.in3 mime_cvt.ref3
-+	./mime_state <mime_cvt.in3 >mime_cvt.tmp
-+	diff  mime_cvt.ref3 mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_garb1: mime_state mime_garb1.in mime_garb1.ref
-+	./mime_state <mime_garb1.in >mime_cvt.tmp
-+	diff  mime_garb1.ref mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_garb2: mime_state mime_garb2.in mime_garb2.ref
-+	./mime_state <mime_garb2.in >mime_cvt.tmp
-+	diff  mime_garb2.ref mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_garb3: mime_state mime_garb3.in mime_garb3.ref
-+	./mime_state <mime_garb3.in >mime_cvt.tmp
-+	diff  mime_garb3.ref mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+mime_garb4: mime_state mime_garb4.in mime_garb4.ref
-+	./mime_state <mime_garb4.in >mime_cvt.tmp
-+	diff  mime_garb4.ref mime_cvt.tmp
-+	rm -f mime_cvt.tmp
-+
-+tok822_limit_test: tok822_parse tok822_limit.in tok822_limit.ref
-+	./tok822_parse <tok822_limit.in >tok822_limit.tmp
-+	diff tok822_limit.ref tok822_limit.tmp
-+	rm -f tok822_limit.tmp
-+
-+strip_addr_test: strip_addr strip_addr.ref
-+	./strip_addr 2>strip_addr.tmp
-+	diff strip_addr.ref strip_addr.tmp
-+	rm -f strip_addr.tmp
-+
-+xtext_test: xtext
-+	./xtext <xtext.c | od -cb >xtext.tmp
-+	od -cb <xtext.c >xtext.ref
-+	cmp xtext.ref xtext.tmp
-+	rm -f xtext.ref xtext.tmp
-+
-+# Requires: Postfix running, root privileges
-+
-+rewrite_clnt_test: rewrite_clnt rewrite_clnt.in rewrite_clnt.ref
-+	@set -- `id`; case "$$1" in \
-+	    *"(root)") ;; \
-+	    *) echo 'This test requires root privilege'; exit 1;; \
-+	esac
-+	@test -n "`postconf -h remote_header_rewrite_domain`" || { \
-+	    echo 'This test requires non-empty remote_header_rewrite_domain'; exit 1; }
-+	./rewrite_clnt <rewrite_clnt.in >rewrite_clnt.tmp
-+	sed -e "s/MYDOMAIN/`postconf -h mydomain`/" \
-+	    -e "s/INVALID_DOMAIN/`postconf -h remote_header_rewrite_domain`/" \
-+		rewrite_clnt.ref | diff - rewrite_clnt.tmp
-+	rm -f rewrite_clnt.tmp
-+
-+# Requires: Postfix, root, relayhost=$mydomain, no transport map
-+
-+resolve_clnt_test: resolve_clnt resolve_clnt.in resolve_clnt.ref
-+	@set -- `id`; case "$$1" in \
-+	    *"(root)") ;; \
-+	    *) echo 'This test requires root privilege'; exit 1;; \
-+	esac
-+	@test "`postconf -h relayhost`" = '$$mydomain' || { \
-+	    echo 'This test requires relayhost=$$mydomain'; exit 1; }
-+	@test "`postconf -h transport_maps`" = "" || { \
-+	    echo 'This test requires no transport map'; exit 1; }
-+	sed -e "s/MYDOMAIN/`postconf -h mydomain`/g" \
-+	    -e "s/MYHOSTNAME/`postconf -h myhostname`/g" \
-+	    resolve_clnt.in | ./resolve_clnt >resolve_clnt.tmp
-+	sed -e "s/MYDOMAIN/`postconf -h mydomain`/g" \
-+	    -e "s/MYHOSTNAME/`postconf -h myhostname`/g" \
-+	    -e "s/RELAYHOST/`postconf -h mydomain`/g" \
-+	    resolve_clnt.ref | diff - resolve_clnt.tmp
-+	rm -f resolve_clnt.tmp
-+
-+scache_multi_test: scache scache_multi.in scache_multi.ref
-+	./scache <scache_multi.in >scache_multi.tmp
-+	diff scache_multi.ref scache_multi.tmp
-+	rm -f scache_multi.tmp
-+
-+ehlo_mask_test: ehlo_mask ehlo_mask.in ehlo_mask.ref
-+	./ehlo_mask <ehlo_mask.in >ehlo_mask.tmp
-+	diff ehlo_mask.ref ehlo_mask.tmp
-+	rm -f ehlo_mask.tmp
-+
-+namadr_list_test: namadr_list namadr_list.in namadr_list.ref
-+	-sh namadr_list.in >namadr_list.tmp 2>&1
-+	diff namadr_list.ref namadr_list.tmp
-+	rm -f namadr_list.tmp
-+
-+mail_conf_time_test: mail_conf_time mail_conf_time.ref
-+	./mail_conf_time >mail_conf_time.tmp
-+	diff mail_conf_time.ref mail_conf_time.tmp
-+	rm -f mail_conf_time.tmp
-+
-+header_body_checks_null_test: header_body_checks header_body_checks_null.ref
-+	./header_body_checks "" "" "" "" \
-+		<mime_test.in >header_body_checks_null.tmp 2>&1
-+	cmp header_body_checks_null.ref header_body_checks_null.tmp
-+	./header_body_checks static:dunno static:dunno static:dunno static:dunno \
-+		<mime_test.in >header_body_checks_null.tmp 2>&1
-+	cmp header_body_checks_null.ref header_body_checks_null.tmp
-+	./header_body_checks static:ok static:ok static:ok static:ok \
-+		<mime_test.in >header_body_checks_null.tmp 2>&1
-+	cmp header_body_checks_null.ref header_body_checks_null.tmp
-+	rm -f header_body_checks_null.tmp
-+
-+header_body_checks_warn_test: header_body_checks header_body_checks_warn.ref
-+	./header_body_checks static:warn static:warn static:warn static:warn \
-+		<mime_test.in >header_body_checks_warn.tmp 2>&1
-+	cmp header_body_checks_warn.ref header_body_checks_warn.tmp
-+	rm -f header_body_checks_warn.tmp
-+
-+header_body_checks_prepend_test: header_body_checks header_body_checks_prepend.ref
-+	echo /./ prepend header: head >header_body_checks_head
-+	echo /./ prepend header: mime >header_body_checks_mime
-+	echo /./ prepend header: nest >header_body_checks_nest
-+	echo /./ prepend body >header_body_checks_body
-+	./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
-+		regexp:header_body_checks_nest regexp:header_body_checks_body \
-+		<mime_test.in >header_body_checks_prepend.tmp 2>&1
-+	cmp header_body_checks_prepend.ref header_body_checks_prepend.tmp
-+	rm -f header_body_checks_prepend.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
-+
-+# Note: the IGNORE action will not strip empty lines. Postfix maps
-+# currently never see null query strings because some map types raise
-+# errors. We can eliminate this restriction by allowing individual
-+# map types to advertise whether they can handle null queries.
-+header_body_checks_ignore_test: header_body_checks header_body_checks_ignore.ref
-+	./header_body_checks static:ignore static:ignore static:ignore static:ignore \
-+		<mime_test.in >header_body_checks_ignore.tmp 2>&1
-+	cmp header_body_checks_ignore.ref header_body_checks_ignore.tmp
-+	rm -f header_body_checks_ignore.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
-+
-+header_body_checks_replace_test: header_body_checks header_body_checks_replace.ref
-+	echo /./ replace header: head >header_body_checks_head
-+	echo /./ replace header: mime >header_body_checks_mime
-+	echo /./ replace header: nest >header_body_checks_nest
-+	echo /./ replace body >header_body_checks_body
-+	./header_body_checks regexp:header_body_checks_head regexp:header_body_checks_mime \
-+		regexp:header_body_checks_nest regexp:header_body_checks_body \
-+		<mime_test.in >header_body_checks_replace.tmp 2>&1
-+	cmp header_body_checks_replace.ref header_body_checks_replace.tmp
-+	rm -f header_body_checks_replace.tmp header_body_checks_head header_body_checks_mime header_body_checks_nest header_body_checks_body
-+
-+printfck: $(OBJS) $(PROG)
-+	rm -rf printfck
-+	mkdir printfck
-+	cp *.h printfck
-+	sed '1,/^# do not edit/!d' Makefile >printfck/Makefile
-+	set -e; for i in *.c; do printfck -f .printfck $$i >printfck/$$i; done
-+	cd printfck; make "INC_DIR=../../../include" `cd ..; ls *.o`
-+
-+lint:
-+	lint $(DEFS) $(SRCS) $(LINTFIX)
-+
-+clean:
-+	rm -f *.o $(LIB) *core $(TESTPROG) junk
-+	rm -rf printfck
-+
-+tidy:	clean
-+
-+depend: $(MAKES)
-+	(sed '1,/^# do not edit/!d' Makefile.in; \
-+	set -e; for i in [a-z][a-z0-9]*.c; do \
-+	    $(CC) -E $(DEFS) $(INCL) $$i | grep -v '[<>]' | sed -n -e '/^# *1 *"\([^"]*\)".*/{' \
-+	    -e 's//'`echo $$i|sed 's/c$$/o/'`': \1/' \
-+	    -e 's/o: \.\//o: /' -e p -e '}' ; \
-+	done | sort -u) | grep -v '[.][o][:][ ][/]' >$$$$ && mv $$$$ Makefile.in
-+	@$(EXPORT) make -f Makefile.in Makefile 1>&2
-+
-+# do not edit below this line - it is generated by 'make depend'
-+abounce.o: ../../include/attr.h
-+abounce.o: ../../include/events.h
-+abounce.o: ../../include/iostuff.h
-+abounce.o: ../../include/msg.h
-+abounce.o: ../../include/mymalloc.h
-+abounce.o: ../../include/sys_defs.h
-+abounce.o: ../../include/vbuf.h
-+abounce.o: ../../include/vstream.h
-+abounce.o: ../../include/vstring.h
-+abounce.o: abounce.c
-+abounce.o: abounce.h
-+abounce.o: bounce.h
-+abounce.o: deliver_request.h
-+abounce.o: dsn.h
-+abounce.o: dsn_buf.h
-+abounce.o: mail_params.h
-+abounce.o: mail_proto.h
-+abounce.o: msg_stats.h
-+abounce.o: recipient_list.h
-+anvil_clnt.o: ../../include/attr.h
-+anvil_clnt.o: ../../include/attr_clnt.h
-+anvil_clnt.o: ../../include/iostuff.h
-+anvil_clnt.o: ../../include/msg.h
-+anvil_clnt.o: ../../include/mymalloc.h
-+anvil_clnt.o: ../../include/stringops.h
-+anvil_clnt.o: ../../include/sys_defs.h
-+anvil_clnt.o: ../../include/vbuf.h
-+anvil_clnt.o: ../../include/vstream.h
-+anvil_clnt.o: ../../include/vstring.h
-+anvil_clnt.o: anvil_clnt.c
-+anvil_clnt.o: anvil_clnt.h
-+anvil_clnt.o: mail_params.h
-+anvil_clnt.o: mail_proto.h
-+been_here.o: ../../include/htable.h
-+been_here.o: ../../include/msg.h
-+been_here.o: ../../include/mymalloc.h
-+been_here.o: ../../include/stringops.h
-+been_here.o: ../../include/sys_defs.h
-+been_here.o: ../../include/vbuf.h
-+been_here.o: ../../include/vstring.h
-+been_here.o: been_here.c
-+been_here.o: been_here.h
-+bounce.o: ../../include/attr.h
-+bounce.o: ../../include/iostuff.h
-+bounce.o: ../../include/msg.h
-+bounce.o: ../../include/mymalloc.h
-+bounce.o: ../../include/sys_defs.h
-+bounce.o: ../../include/vbuf.h
-+bounce.o: ../../include/vstream.h
-+bounce.o: ../../include/vstring.h
-+bounce.o: bounce.c
-+bounce.o: bounce.h
-+bounce.o: defer.h
-+bounce.o: deliver_request.h
-+bounce.o: dsn.h
-+bounce.o: dsn_buf.h
-+bounce.o: dsn_print.h
-+bounce.o: dsn_util.h
-+bounce.o: log_adhoc.h
-+bounce.o: mail_params.h
-+bounce.o: mail_proto.h
-+bounce.o: msg_stats.h
-+bounce.o: rcpt_print.h
-+bounce.o: recipient_list.h
-+bounce.o: trace.h
-+bounce.o: verify.h
-+bounce_log.o: ../../include/attr.h
-+bounce_log.o: ../../include/iostuff.h
-+bounce_log.o: ../../include/msg.h
-+bounce_log.o: ../../include/mymalloc.h
-+bounce_log.o: ../../include/stringops.h
-+bounce_log.o: ../../include/sys_defs.h
-+bounce_log.o: ../../include/vbuf.h
-+bounce_log.o: ../../include/vstream.h
-+bounce_log.o: ../../include/vstring.h
-+bounce_log.o: ../../include/vstring_vstream.h
-+bounce_log.o: bounce_log.c
-+bounce_log.o: bounce_log.h
-+bounce_log.o: dsn.h
-+bounce_log.o: dsn_buf.h
-+bounce_log.o: dsn_mask.h
-+bounce_log.o: mail_params.h
-+bounce_log.o: mail_proto.h
-+bounce_log.o: mail_queue.h
-+bounce_log.o: rcpt_buf.h
-+bounce_log.o: recipient_list.h
-+canon_addr.o: ../../include/attr.h
-+canon_addr.o: ../../include/iostuff.h
-+canon_addr.o: ../../include/mymalloc.h
-+canon_addr.o: ../../include/sys_defs.h
-+canon_addr.o: ../../include/vbuf.h
-+canon_addr.o: ../../include/vstream.h
-+canon_addr.o: ../../include/vstring.h
-+canon_addr.o: canon_addr.c
-+canon_addr.o: canon_addr.h
-+canon_addr.o: mail_proto.h
-+canon_addr.o: rewrite_clnt.h
-+cfg_parser.o: ../../include/argv.h
-+cfg_parser.o: ../../include/dict.h
-+cfg_parser.o: ../../include/msg.h
-+cfg_parser.o: ../../include/mymalloc.h
-+cfg_parser.o: ../../include/sys_defs.h
-+cfg_parser.o: ../../include/vbuf.h
-+cfg_parser.o: ../../include/vstream.h
-+cfg_parser.o: ../../include/vstring.h
-+cfg_parser.o: cfg_parser.c
-+cfg_parser.o: cfg_parser.h
-+cfg_parser.o: mail_conf.h
-+cleanup_strerror.o: ../../include/msg.h
-+cleanup_strerror.o: ../../include/sys_defs.h
-+cleanup_strerror.o: ../../include/vbuf.h
-+cleanup_strerror.o: ../../include/vstring.h
-+cleanup_strerror.o: cleanup_strerror.c
-+cleanup_strerror.o: cleanup_user.h
-+cleanup_strflags.o: ../../include/msg.h
-+cleanup_strflags.o: ../../include/sys_defs.h
-+cleanup_strflags.o: ../../include/vbuf.h
-+cleanup_strflags.o: ../../include/vstring.h
-+cleanup_strflags.o: cleanup_strflags.c
-+cleanup_strflags.o: cleanup_user.h
-+clnt_stream.o: ../../include/attr.h
-+clnt_stream.o: ../../include/events.h
-+clnt_stream.o: ../../include/iostuff.h
-+clnt_stream.o: ../../include/msg.h
-+clnt_stream.o: ../../include/mymalloc.h
-+clnt_stream.o: ../../include/sys_defs.h
-+clnt_stream.o: ../../include/vbuf.h
-+clnt_stream.o: ../../include/vstream.h
-+clnt_stream.o: clnt_stream.c
-+clnt_stream.o: clnt_stream.h
-+clnt_stream.o: mail_params.h
-+clnt_stream.o: mail_proto.h
-+conv_time.o: ../../include/msg.h
-+conv_time.o: ../../include/sys_defs.h
-+conv_time.o: conv_time.c
-+conv_time.o: conv_time.h
-+data_redirect.o: ../../include/argv.h
-+data_redirect.o: ../../include/dict.h
-+data_redirect.o: ../../include/dict_cdb.h
-+data_redirect.o: ../../include/dict_db.h
-+data_redirect.o: ../../include/dict_dbm.h
-+data_redirect.o: ../../include/msg.h
-+data_redirect.o: ../../include/name_code.h
-+data_redirect.o: ../../include/split_at.h
-+data_redirect.o: ../../include/stringops.h
-+data_redirect.o: ../../include/sys_defs.h
-+data_redirect.o: ../../include/vbuf.h
-+data_redirect.o: ../../include/vstream.h
-+data_redirect.o: ../../include/vstring.h
-+data_redirect.o: data_redirect.c
-+data_redirect.o: data_redirect.h
-+data_redirect.o: dict_proxy.h
-+data_redirect.o: mail_params.h
-+db_common.o: ../../include/argv.h
-+db_common.o: ../../include/dict.h
-+db_common.o: ../../include/match_list.h
-+db_common.o: ../../include/match_ops.h
-+db_common.o: ../../include/msg.h
-+db_common.o: ../../include/mymalloc.h
-+db_common.o: ../../include/sys_defs.h
-+db_common.o: ../../include/vbuf.h
-+db_common.o: ../../include/vstream.h
-+db_common.o: ../../include/vstring.h
-+db_common.o: cfg_parser.h
-+db_common.o: db_common.c
-+db_common.o: db_common.h
-+db_common.o: string_list.h
-+debug_peer.o: ../../include/match_list.h
-+debug_peer.o: ../../include/match_ops.h
-+debug_peer.o: ../../include/msg.h
-+debug_peer.o: ../../include/sys_defs.h
-+debug_peer.o: debug_peer.c
-+debug_peer.o: debug_peer.h
-+debug_peer.o: mail_params.h
-+debug_peer.o: match_parent_style.h
-+debug_peer.o: namadr_list.h
-+debug_process.o: ../../include/msg.h
-+debug_process.o: ../../include/sys_defs.h
-+debug_process.o: debug_process.c
-+debug_process.o: debug_process.h
-+debug_process.o: mail_conf.h
-+debug_process.o: mail_params.h
-+defer.o: ../../include/attr.h
-+defer.o: ../../include/iostuff.h
-+defer.o: ../../include/msg.h
-+defer.o: ../../include/sys_defs.h
-+defer.o: ../../include/vbuf.h
-+defer.o: ../../include/vstream.h
-+defer.o: ../../include/vstring.h
-+defer.o: bounce.h
-+defer.o: defer.c
-+defer.o: defer.h
-+defer.o: deliver_request.h
-+defer.o: dsn.h
-+defer.o: dsn_buf.h
-+defer.o: dsn_print.h
-+defer.o: dsn_util.h
-+defer.o: flush_clnt.h
-+defer.o: log_adhoc.h
-+defer.o: mail_params.h
-+defer.o: mail_proto.h
-+defer.o: mail_queue.h
-+defer.o: msg_stats.h
-+defer.o: rcpt_print.h
-+defer.o: recipient_list.h
-+defer.o: trace.h
-+defer.o: verify.h
-+deliver_completed.o: ../../include/msg.h
-+deliver_completed.o: ../../include/sys_defs.h
-+deliver_completed.o: ../../include/vbuf.h
-+deliver_completed.o: ../../include/vstream.h
-+deliver_completed.o: ../../include/vstring.h
-+deliver_completed.o: deliver_completed.c
-+deliver_completed.o: deliver_completed.h
-+deliver_completed.o: rec_type.h
-+deliver_completed.o: record.h
-+deliver_flock.o: ../../include/iostuff.h
-+deliver_flock.o: ../../include/myflock.h
-+deliver_flock.o: ../../include/sys_defs.h
-+deliver_flock.o: ../../include/vbuf.h
-+deliver_flock.o: ../../include/vstring.h
-+deliver_flock.o: deliver_flock.c
-+deliver_flock.o: deliver_flock.h
-+deliver_flock.o: mail_params.h
-+deliver_pass.o: ../../include/attr.h
-+deliver_pass.o: ../../include/iostuff.h
-+deliver_pass.o: ../../include/msg.h
-+deliver_pass.o: ../../include/mymalloc.h
-+deliver_pass.o: ../../include/split_at.h
-+deliver_pass.o: ../../include/sys_defs.h
-+deliver_pass.o: ../../include/vbuf.h
-+deliver_pass.o: ../../include/vstream.h
-+deliver_pass.o: ../../include/vstring.h
-+deliver_pass.o: bounce.h
-+deliver_pass.o: defer.h
-+deliver_pass.o: deliver_pass.c
-+deliver_pass.o: deliver_pass.h
-+deliver_pass.o: deliver_request.h
-+deliver_pass.o: dsb_scan.h
-+deliver_pass.o: dsn.h
-+deliver_pass.o: dsn_buf.h
-+deliver_pass.o: mail_params.h
-+deliver_pass.o: mail_proto.h
-+deliver_pass.o: msg_stats.h
-+deliver_pass.o: rcpt_print.h
-+deliver_pass.o: recipient_list.h
-+deliver_request.o: ../../include/attr.h
-+deliver_request.o: ../../include/iostuff.h
-+deliver_request.o: ../../include/msg.h
-+deliver_request.o: ../../include/myflock.h
-+deliver_request.o: ../../include/mymalloc.h
-+deliver_request.o: ../../include/sys_defs.h
-+deliver_request.o: ../../include/vbuf.h
-+deliver_request.o: ../../include/vstream.h
-+deliver_request.o: ../../include/vstring.h
-+deliver_request.o: deliver_request.c
-+deliver_request.o: deliver_request.h
-+deliver_request.o: dsn.h
-+deliver_request.o: dsn_print.h
-+deliver_request.o: mail_open_ok.h
-+deliver_request.o: mail_proto.h
-+deliver_request.o: mail_queue.h
-+deliver_request.o: msg_stats.h
-+deliver_request.o: rcpt_buf.h
-+deliver_request.o: recipient_list.h
-+delivered_hdr.o: ../../include/htable.h
-+delivered_hdr.o: ../../include/msg.h
-+delivered_hdr.o: ../../include/mymalloc.h
-+delivered_hdr.o: ../../include/stringops.h
-+delivered_hdr.o: ../../include/sys_defs.h
-+delivered_hdr.o: ../../include/vbuf.h
-+delivered_hdr.o: ../../include/vstream.h
-+delivered_hdr.o: ../../include/vstring.h
-+delivered_hdr.o: ../../include/vstring_vstream.h
-+delivered_hdr.o: delivered_hdr.c
-+delivered_hdr.o: delivered_hdr.h
-+delivered_hdr.o: fold_addr.h
-+delivered_hdr.o: header_opts.h
-+delivered_hdr.o: is_header.h
-+delivered_hdr.o: quote_822_local.h
-+delivered_hdr.o: quote_flags.h
-+delivered_hdr.o: rec_type.h
-+delivered_hdr.o: record.h
-+dict_ldap.o: ../../include/argv.h
-+dict_ldap.o: ../../include/binhash.h
-+dict_ldap.o: ../../include/dict.h
-+dict_ldap.o: ../../include/match_list.h
-+dict_ldap.o: ../../include/match_ops.h
-+dict_ldap.o: ../../include/msg.h
-+dict_ldap.o: ../../include/mymalloc.h
-+dict_ldap.o: ../../include/stringops.h
-+dict_ldap.o: ../../include/sys_defs.h
-+dict_ldap.o: ../../include/vbuf.h
-+dict_ldap.o: ../../include/vstream.h
-+dict_ldap.o: ../../include/vstring.h
-+dict_ldap.o: cfg_parser.h
-+dict_ldap.o: db_common.h
-+dict_ldap.o: dict_ldap.c
-+dict_ldap.o: dict_ldap.h
-+dict_ldap.o: string_list.h
-+dict_mysql.o: ../../include/argv.h
-+dict_mysql.o: ../../include/dict.h
-+dict_mysql.o: ../../include/events.h
-+dict_mysql.o: ../../include/find_inet.h
-+dict_mysql.o: ../../include/match_list.h
-+dict_mysql.o: ../../include/match_ops.h
-+dict_mysql.o: ../../include/msg.h
-+dict_mysql.o: ../../include/mymalloc.h
-+dict_mysql.o: ../../include/myrand.h
-+dict_mysql.o: ../../include/split_at.h
-+dict_mysql.o: ../../include/stringops.h
-+dict_mysql.o: ../../include/sys_defs.h
-+dict_mysql.o: ../../include/vbuf.h
-+dict_mysql.o: ../../include/vstream.h
-+dict_mysql.o: ../../include/vstring.h
-+dict_mysql.o: cfg_parser.h
-+dict_mysql.o: db_common.h
-+dict_mysql.o: dict_mysql.c
-+dict_mysql.o: dict_mysql.h
-+dict_mysql.o: string_list.h
-+dict_pgsql.o: ../../include/argv.h
-+dict_pgsql.o: ../../include/dict.h
-+dict_pgsql.o: ../../include/events.h
-+dict_pgsql.o: ../../include/find_inet.h
-+dict_pgsql.o: ../../include/match_list.h
-+dict_pgsql.o: ../../include/match_ops.h
-+dict_pgsql.o: ../../include/msg.h
-+dict_pgsql.o: ../../include/mymalloc.h
-+dict_pgsql.o: ../../include/myrand.h
-+dict_pgsql.o: ../../include/split_at.h
-+dict_pgsql.o: ../../include/stringops.h
-+dict_pgsql.o: ../../include/sys_defs.h
-+dict_pgsql.o: ../../include/vbuf.h
-+dict_pgsql.o: ../../include/vstream.h
-+dict_pgsql.o: ../../include/vstring.h
-+dict_pgsql.o: cfg_parser.h
-+dict_pgsql.o: db_common.h
-+dict_pgsql.o: dict_pgsql.c
-+dict_pgsql.o: dict_pgsql.h
-+dict_pgsql.o: string_list.h
-+dict_proxy.o: ../../include/argv.h
-+dict_proxy.o: ../../include/attr.h
-+dict_proxy.o: ../../include/dict.h
-+dict_proxy.o: ../../include/iostuff.h
-+dict_proxy.o: ../../include/msg.h
-+dict_proxy.o: ../../include/mymalloc.h
-+dict_proxy.o: ../../include/stringops.h
-+dict_proxy.o: ../../include/sys_defs.h
-+dict_proxy.o: ../../include/vbuf.h
-+dict_proxy.o: ../../include/vstream.h
-+dict_proxy.o: ../../include/vstring.h
-+dict_proxy.o: clnt_stream.h
-+dict_proxy.o: dict_proxy.c
-+dict_proxy.o: dict_proxy.h
-+dict_proxy.o: mail_params.h
-+dict_proxy.o: mail_proto.h
-+domain_list.o: ../../include/match_list.h
-+domain_list.o: ../../include/match_ops.h
-+domain_list.o: ../../include/sys_defs.h
-+domain_list.o: domain_list.c
-+domain_list.o: domain_list.h
-+dot_lockfile.o: ../../include/iostuff.h
-+dot_lockfile.o: ../../include/mymalloc.h
-+dot_lockfile.o: ../../include/stringops.h
-+dot_lockfile.o: ../../include/sys_defs.h
-+dot_lockfile.o: ../../include/vbuf.h
-+dot_lockfile.o: ../../include/vstring.h
-+dot_lockfile.o: dot_lockfile.c
-+dot_lockfile.o: dot_lockfile.h
-+dot_lockfile.o: mail_params.h
-+dot_lockfile_as.o: ../../include/msg.h
-+dot_lockfile_as.o: ../../include/set_eugid.h
-+dot_lockfile_as.o: ../../include/sys_defs.h
-+dot_lockfile_as.o: ../../include/vbuf.h
-+dot_lockfile_as.o: ../../include/vstring.h
-+dot_lockfile_as.o: dot_lockfile.h
-+dot_lockfile_as.o: dot_lockfile_as.c
-+dot_lockfile_as.o: dot_lockfile_as.h
-+dsb_scan.o: ../../include/attr.h
-+dsb_scan.o: ../../include/iostuff.h
-+dsb_scan.o: ../../include/sys_defs.h
-+dsb_scan.o: ../../include/vbuf.h
-+dsb_scan.o: ../../include/vstream.h
-+dsb_scan.o: ../../include/vstring.h
-+dsb_scan.o: dsb_scan.c
-+dsb_scan.o: dsb_scan.h
-+dsb_scan.o: dsn.h
-+dsb_scan.o: dsn_buf.h
-+dsb_scan.o: mail_proto.h
-+dsn.o: ../../include/msg.h
-+dsn.o: ../../include/mymalloc.h
-+dsn.o: ../../include/sys_defs.h
-+dsn.o: dsn.c
-+dsn.o: dsn.h
-+dsn_buf.o: ../../include/msg.h
-+dsn_buf.o: ../../include/mymalloc.h
-+dsn_buf.o: ../../include/sys_defs.h
-+dsn_buf.o: ../../include/vbuf.h
-+dsn_buf.o: ../../include/vstring.h
-+dsn_buf.o: dsn.h
-+dsn_buf.o: dsn_buf.c
-+dsn_buf.o: dsn_buf.h
-+dsn_mask.o: ../../include/msg.h
-+dsn_mask.o: ../../include/name_code.h
-+dsn_mask.o: ../../include/name_mask.h
-+dsn_mask.o: ../../include/sys_defs.h
-+dsn_mask.o: ../../include/vbuf.h
-+dsn_mask.o: ../../include/vstring.h
-+dsn_mask.o: dsn_mask.c
-+dsn_mask.o: dsn_mask.h
-+dsn_print.o: ../../include/attr.h
-+dsn_print.o: ../../include/iostuff.h
-+dsn_print.o: ../../include/sys_defs.h
-+dsn_print.o: ../../include/vbuf.h
-+dsn_print.o: ../../include/vstream.h
-+dsn_print.o: dsn.h
-+dsn_print.o: dsn_print.c
-+dsn_print.o: dsn_print.h
-+dsn_print.o: mail_proto.h
-+dsn_util.o: ../../include/msg.h
-+dsn_util.o: ../../include/mymalloc.h
-+dsn_util.o: ../../include/stringops.h
-+dsn_util.o: ../../include/sys_defs.h
-+dsn_util.o: ../../include/vbuf.h
-+dsn_util.o: ../../include/vstring.h
-+dsn_util.o: dsn_util.c
-+dsn_util.o: dsn_util.h
-+ehlo_mask.o: ../../include/name_mask.h
-+ehlo_mask.o: ../../include/sys_defs.h
-+ehlo_mask.o: ../../include/vbuf.h
-+ehlo_mask.o: ../../include/vstring.h
-+ehlo_mask.o: ehlo_mask.c
-+ehlo_mask.o: ehlo_mask.h
-+ext_prop.o: ../../include/name_mask.h
-+ext_prop.o: ../../include/sys_defs.h
-+ext_prop.o: ../../include/vbuf.h
-+ext_prop.o: ../../include/vstring.h
-+ext_prop.o: ext_prop.c
-+ext_prop.o: ext_prop.h
-+ext_prop.o: mail_params.h
-+file_id.o: ../../include/msg.h
-+file_id.o: ../../include/sys_defs.h
-+file_id.o: ../../include/vbuf.h
-+file_id.o: ../../include/vstring.h
-+file_id.o: file_id.c
-+file_id.o: file_id.h
-+flush_clnt.o: ../../include/attr.h
-+flush_clnt.o: ../../include/iostuff.h
-+flush_clnt.o: ../../include/match_list.h
-+flush_clnt.o: ../../include/match_ops.h
-+flush_clnt.o: ../../include/msg.h
-+flush_clnt.o: ../../include/sys_defs.h
-+flush_clnt.o: ../../include/vbuf.h
-+flush_clnt.o: ../../include/vstream.h
-+flush_clnt.o: domain_list.h
-+flush_clnt.o: flush_clnt.c
-+flush_clnt.o: flush_clnt.h
-+flush_clnt.o: mail_flush.h
-+flush_clnt.o: mail_params.h
-+flush_clnt.o: mail_proto.h
-+flush_clnt.o: match_parent_style.h
-+fold_addr.o: ../../include/stringops.h
-+fold_addr.o: ../../include/sys_defs.h
-+fold_addr.o: ../../include/vbuf.h
-+fold_addr.o: ../../include/vstring.h
-+fold_addr.o: fold_addr.c
-+fold_addr.o: fold_addr.h
-+header_body_checks.o: ../../include/argv.h
-+header_body_checks.o: ../../include/dict.h
-+header_body_checks.o: ../../include/msg.h
-+header_body_checks.o: ../../include/mymalloc.h
-+header_body_checks.o: ../../include/sys_defs.h
-+header_body_checks.o: ../../include/vbuf.h
-+header_body_checks.o: ../../include/vstream.h
-+header_body_checks.o: ../../include/vstring.h
-+header_body_checks.o: cleanup_user.h
-+header_body_checks.o: dsn_util.h
-+header_body_checks.o: header_body_checks.c
-+header_body_checks.o: header_body_checks.h
-+header_body_checks.o: header_opts.h
-+header_body_checks.o: is_header.h
-+header_body_checks.o: maps.h
-+header_body_checks.o: mime_state.h
-+header_body_checks.o: rec_type.h
-+header_opts.o: ../../include/htable.h
-+header_opts.o: ../../include/msg.h
-+header_opts.o: ../../include/stringops.h
-+header_opts.o: ../../include/sys_defs.h
-+header_opts.o: ../../include/vbuf.h
-+header_opts.o: ../../include/vstring.h
-+header_opts.o: header_opts.c
-+header_opts.o: header_opts.h
-+header_token.o: ../../include/msg.h
-+header_token.o: ../../include/sys_defs.h
-+header_token.o: ../../include/vbuf.h
-+header_token.o: ../../include/vstring.h
-+header_token.o: header_token.c
-+header_token.o: header_token.h
-+header_token.o: lex_822.h
-+input_transp.o: ../../include/msg.h
-+input_transp.o: ../../include/name_mask.h
-+input_transp.o: ../../include/sys_defs.h
-+input_transp.o: ../../include/vbuf.h
-+input_transp.o: ../../include/vstring.h
-+input_transp.o: cleanup_user.h
-+input_transp.o: input_transp.c
-+input_transp.o: input_transp.h
-+input_transp.o: mail_params.h
-+int_filt.o: ../../include/msg.h
-+int_filt.o: ../../include/name_mask.h
-+int_filt.o: ../../include/sys_defs.h
-+int_filt.o: ../../include/vbuf.h
-+int_filt.o: ../../include/vstring.h
-+int_filt.o: cleanup_user.h
-+int_filt.o: int_filt.c
-+int_filt.o: int_filt.h
-+int_filt.o: mail_params.h
-+is_header.o: ../../include/sys_defs.h
-+is_header.o: is_header.c
-+is_header.o: is_header.h
-+log_adhoc.o: ../../include/attr.h
-+log_adhoc.o: ../../include/format_tv.h
-+log_adhoc.o: ../../include/msg.h
-+log_adhoc.o: ../../include/sys_defs.h
-+log_adhoc.o: ../../include/vbuf.h
-+log_adhoc.o: ../../include/vstream.h
-+log_adhoc.o: ../../include/vstring.h
-+log_adhoc.o: dsn.h
-+log_adhoc.o: log_adhoc.c
-+log_adhoc.o: log_adhoc.h
-+log_adhoc.o: mail_params.h
-+log_adhoc.o: msg_stats.h
-+log_adhoc.o: recipient_list.h
-+mail_addr.o: ../../include/stringops.h
-+mail_addr.o: ../../include/sys_defs.h
-+mail_addr.o: ../../include/vbuf.h
-+mail_addr.o: ../../include/vstring.h
-+mail_addr.o: mail_addr.c
-+mail_addr.o: mail_addr.h
-+mail_addr.o: mail_params.h
-+mail_addr_crunch.o: ../../include/argv.h
-+mail_addr_crunch.o: ../../include/mymalloc.h
-+mail_addr_crunch.o: ../../include/sys_defs.h
-+mail_addr_crunch.o: ../../include/vbuf.h
-+mail_addr_crunch.o: ../../include/vstring.h
-+mail_addr_crunch.o: canon_addr.h
-+mail_addr_crunch.o: mail_addr_crunch.c
-+mail_addr_crunch.o: mail_addr_crunch.h
-+mail_addr_crunch.o: resolve_clnt.h
-+mail_addr_crunch.o: tok822.h
-+mail_addr_find.o: ../../include/argv.h
-+mail_addr_find.o: ../../include/dict.h
-+mail_addr_find.o: ../../include/msg.h
-+mail_addr_find.o: ../../include/mymalloc.h
-+mail_addr_find.o: ../../include/stringops.h
-+mail_addr_find.o: ../../include/sys_defs.h
-+mail_addr_find.o: ../../include/vbuf.h
-+mail_addr_find.o: ../../include/vstream.h
-+mail_addr_find.o: ../../include/vstring.h
-+mail_addr_find.o: mail_addr_find.c
-+mail_addr_find.o: mail_addr_find.h
-+mail_addr_find.o: mail_params.h
-+mail_addr_find.o: maps.h
-+mail_addr_find.o: resolve_local.h
-+mail_addr_find.o: strip_addr.h
-+mail_addr_map.o: ../../include/argv.h
-+mail_addr_map.o: ../../include/dict.h
-+mail_addr_map.o: ../../include/msg.h
-+mail_addr_map.o: ../../include/mymalloc.h
-+mail_addr_map.o: ../../include/sys_defs.h
-+mail_addr_map.o: ../../include/vbuf.h
-+mail_addr_map.o: ../../include/vstream.h
-+mail_addr_map.o: ../../include/vstring.h
-+mail_addr_map.o: mail_addr_crunch.h
-+mail_addr_map.o: mail_addr_find.h
-+mail_addr_map.o: mail_addr_map.c
-+mail_addr_map.o: mail_addr_map.h
-+mail_addr_map.o: maps.h
-+mail_command_client.o: ../../include/attr.h
-+mail_command_client.o: ../../include/iostuff.h
-+mail_command_client.o: ../../include/sys_defs.h
-+mail_command_client.o: ../../include/vbuf.h
-+mail_command_client.o: ../../include/vstream.h
-+mail_command_client.o: mail_command_client.c
-+mail_command_client.o: mail_proto.h
-+mail_command_server.o: ../../include/attr.h
-+mail_command_server.o: ../../include/iostuff.h
-+mail_command_server.o: ../../include/sys_defs.h
-+mail_command_server.o: ../../include/vbuf.h
-+mail_command_server.o: ../../include/vstream.h
-+mail_command_server.o: mail_command_server.c
-+mail_command_server.o: mail_proto.h
-+mail_conf.o: ../../include/argv.h
-+mail_conf.o: ../../include/dict.h
-+mail_conf.o: ../../include/msg.h
-+mail_conf.o: ../../include/mymalloc.h
-+mail_conf.o: ../../include/readlline.h
-+mail_conf.o: ../../include/safe.h
-+mail_conf.o: ../../include/stringops.h
-+mail_conf.o: ../../include/sys_defs.h
-+mail_conf.o: ../../include/vbuf.h
-+mail_conf.o: ../../include/vstream.h
-+mail_conf.o: ../../include/vstring.h
-+mail_conf.o: mail_conf.c
-+mail_conf.o: mail_conf.h
-+mail_conf.o: mail_params.h
-+mail_conf_bool.o: ../../include/argv.h
-+mail_conf_bool.o: ../../include/dict.h
-+mail_conf_bool.o: ../../include/msg.h
-+mail_conf_bool.o: ../../include/sys_defs.h
-+mail_conf_bool.o: ../../include/vbuf.h
-+mail_conf_bool.o: ../../include/vstream.h
-+mail_conf_bool.o: ../../include/vstring.h
-+mail_conf_bool.o: mail_conf.h
-+mail_conf_bool.o: mail_conf_bool.c
-+mail_conf_int.o: ../../include/argv.h
-+mail_conf_int.o: ../../include/dict.h
-+mail_conf_int.o: ../../include/msg.h
-+mail_conf_int.o: ../../include/mymalloc.h
-+mail_conf_int.o: ../../include/stringops.h
-+mail_conf_int.o: ../../include/sys_defs.h
-+mail_conf_int.o: ../../include/vbuf.h
-+mail_conf_int.o: ../../include/vstream.h
-+mail_conf_int.o: ../../include/vstring.h
-+mail_conf_int.o: mail_conf.h
-+mail_conf_int.o: mail_conf_int.c
-+mail_conf_long.o: ../../include/argv.h
-+mail_conf_long.o: ../../include/dict.h
-+mail_conf_long.o: ../../include/msg.h
-+mail_conf_long.o: ../../include/mymalloc.h
-+mail_conf_long.o: ../../include/stringops.h
-+mail_conf_long.o: ../../include/sys_defs.h
-+mail_conf_long.o: ../../include/vbuf.h
-+mail_conf_long.o: ../../include/vstream.h
-+mail_conf_long.o: ../../include/vstring.h
-+mail_conf_long.o: mail_conf.h
-+mail_conf_long.o: mail_conf_long.c
-+mail_conf_nint.o: ../../include/argv.h
-+mail_conf_nint.o: ../../include/dict.h
-+mail_conf_nint.o: ../../include/msg.h
-+mail_conf_nint.o: ../../include/mymalloc.h
-+mail_conf_nint.o: ../../include/stringops.h
-+mail_conf_nint.o: ../../include/sys_defs.h
-+mail_conf_nint.o: ../../include/vbuf.h
-+mail_conf_nint.o: ../../include/vstream.h
-+mail_conf_nint.o: ../../include/vstring.h
-+mail_conf_nint.o: mail_conf.h
-+mail_conf_nint.o: mail_conf_nint.c
-+mail_conf_raw.o: ../../include/msg.h
-+mail_conf_raw.o: ../../include/mymalloc.h
-+mail_conf_raw.o: ../../include/sys_defs.h
-+mail_conf_raw.o: mail_conf.h
-+mail_conf_raw.o: mail_conf_raw.c
-+mail_conf_str.o: ../../include/msg.h
-+mail_conf_str.o: ../../include/mymalloc.h
-+mail_conf_str.o: ../../include/stringops.h
-+mail_conf_str.o: ../../include/sys_defs.h
-+mail_conf_str.o: ../../include/vbuf.h
-+mail_conf_str.o: ../../include/vstring.h
-+mail_conf_str.o: mail_conf.h
-+mail_conf_str.o: mail_conf_str.c
-+mail_conf_time.o: ../../include/argv.h
-+mail_conf_time.o: ../../include/dict.h
-+mail_conf_time.o: ../../include/msg.h
-+mail_conf_time.o: ../../include/mymalloc.h
-+mail_conf_time.o: ../../include/stringops.h
-+mail_conf_time.o: ../../include/sys_defs.h
-+mail_conf_time.o: ../../include/vbuf.h
-+mail_conf_time.o: ../../include/vstream.h
-+mail_conf_time.o: ../../include/vstring.h
-+mail_conf_time.o: conv_time.h
-+mail_conf_time.o: mail_conf.h
-+mail_conf_time.o: mail_conf_time.c
-+mail_connect.o: ../../include/attr.h
-+mail_connect.o: ../../include/connect.h
-+mail_connect.o: ../../include/iostuff.h
-+mail_connect.o: ../../include/msg.h
-+mail_connect.o: ../../include/mymalloc.h
-+mail_connect.o: ../../include/stringops.h
-+mail_connect.o: ../../include/sys_defs.h
-+mail_connect.o: ../../include/vbuf.h
-+mail_connect.o: ../../include/vstream.h
-+mail_connect.o: ../../include/vstring.h
-+mail_connect.o: mail_connect.c
-+mail_connect.o: mail_proto.h
-+mail_connect.o: timed_ipc.h
-+mail_copy.o: ../../include/htable.h
-+mail_copy.o: ../../include/iostuff.h
-+mail_copy.o: ../../include/msg.h
-+mail_copy.o: ../../include/safe_open.h
-+mail_copy.o: ../../include/stringops.h
-+mail_copy.o: ../../include/sys_defs.h
-+mail_copy.o: ../../include/vbuf.h
-+mail_copy.o: ../../include/vstream.h
-+mail_copy.o: ../../include/vstring.h
-+mail_copy.o: ../../include/vstring_vstream.h
-+mail_copy.o: dsn.h
-+mail_copy.o: dsn_buf.h
-+mail_copy.o: mail_addr.h
-+mail_copy.o: mail_copy.c
-+mail_copy.o: mail_copy.h
-+mail_copy.o: mail_params.h
-+mail_copy.o: mail_queue.h
-+mail_copy.o: mark_corrupt.h
-+mail_copy.o: mbox_open.h
-+mail_copy.o: quote_822_local.h
-+mail_copy.o: quote_flags.h
-+mail_copy.o: rec_type.h
-+mail_copy.o: record.h
-+mail_copy.o: sys_exits.h
-+mail_date.o: ../../include/msg.h
-+mail_date.o: ../../include/sys_defs.h
-+mail_date.o: ../../include/vbuf.h
-+mail_date.o: ../../include/vstring.h
-+mail_date.o: mail_date.c
-+mail_date.o: mail_date.h
-+mail_dict.o: ../../include/argv.h
-+mail_dict.o: ../../include/dict.h
-+mail_dict.o: ../../include/msg.h
-+mail_dict.o: ../../include/sys_defs.h
-+mail_dict.o: ../../include/vbuf.h
-+mail_dict.o: ../../include/vstream.h
-+mail_dict.o: ../../include/vstring.h
-+mail_dict.o: dict_ldap.h
-+mail_dict.o: dict_mysql.h
-+mail_dict.o: dict_pgsql.h
-+mail_dict.o: dict_proxy.h
-+mail_dict.o: mail_dict.c
-+mail_dict.o: mail_dict.h
-+mail_error.o: ../../include/name_mask.h
-+mail_error.o: ../../include/sys_defs.h
-+mail_error.o: ../../include/vbuf.h
-+mail_error.o: ../../include/vstring.h
-+mail_error.o: mail_error.c
-+mail_error.o: mail_error.h
-+mail_flush.o: ../../include/attr.h
-+mail_flush.o: ../../include/iostuff.h
-+mail_flush.o: ../../include/sys_defs.h
-+mail_flush.o: ../../include/vbuf.h
-+mail_flush.o: ../../include/vstream.h
-+mail_flush.o: mail_flush.c
-+mail_flush.o: mail_flush.h
-+mail_flush.o: mail_params.h
-+mail_flush.o: mail_proto.h
-+mail_open_ok.o: ../../include/msg.h
-+mail_open_ok.o: ../../include/sys_defs.h
-+mail_open_ok.o: ../../include/vbuf.h
-+mail_open_ok.o: ../../include/vstream.h
-+mail_open_ok.o: ../../include/vstring.h
-+mail_open_ok.o: mail_open_ok.c
-+mail_open_ok.o: mail_open_ok.h
-+mail_open_ok.o: mail_queue.h
-+mail_params.o: ../../include/argv.h
-+mail_params.o: ../../include/attr.h
-+mail_params.o: ../../include/dict.h
-+mail_params.o: ../../include/dict_db.h
-+mail_params.o: ../../include/get_hostname.h
-+mail_params.o: ../../include/inet_addr_list.h
-+mail_params.o: ../../include/inet_proto.h
-+mail_params.o: ../../include/iostuff.h
-+mail_params.o: ../../include/msg.h
-+mail_params.o: ../../include/msg_syslog.h
-+mail_params.o: ../../include/myaddrinfo.h
-+mail_params.o: ../../include/mymalloc.h
-+mail_params.o: ../../include/safe.h
-+mail_params.o: ../../include/safe_open.h
-+mail_params.o: ../../include/stringops.h
-+mail_params.o: ../../include/sys_defs.h
-+mail_params.o: ../../include/valid_hostname.h
-+mail_params.o: ../../include/vbuf.h
-+mail_params.o: ../../include/vstream.h
-+mail_params.o: ../../include/vstring.h
-+mail_params.o: ../../include/vstring_vstream.h
-+mail_params.o: mail_conf.h
-+mail_params.o: mail_params.c
-+mail_params.o: mail_params.h
-+mail_params.o: mail_proto.h
-+mail_params.o: mail_version.h
-+mail_params.o: mynetworks.h
-+mail_params.o: own_inet_addr.h
-+mail_params.o: recipient_list.h
-+mail_params.o: verp_sender.h
-+mail_pathname.o: ../../include/attr.h
-+mail_pathname.o: ../../include/iostuff.h
-+mail_pathname.o: ../../include/stringops.h
-+mail_pathname.o: ../../include/sys_defs.h
-+mail_pathname.o: ../../include/vbuf.h
-+mail_pathname.o: ../../include/vstream.h
-+mail_pathname.o: ../../include/vstring.h
-+mail_pathname.o: mail_pathname.c
-+mail_pathname.o: mail_proto.h
-+mail_queue.o: ../../include/argv.h
-+mail_queue.o: ../../include/dir_forest.h
-+mail_queue.o: ../../include/make_dirs.h
-+mail_queue.o: ../../include/msg.h
-+mail_queue.o: ../../include/mymalloc.h
-+mail_queue.o: ../../include/sane_fsops.h
-+mail_queue.o: ../../include/split_at.h
-+mail_queue.o: ../../include/sys_defs.h
-+mail_queue.o: ../../include/valid_hostname.h
-+mail_queue.o: ../../include/vbuf.h
-+mail_queue.o: ../../include/vstream.h
-+mail_queue.o: ../../include/vstring.h
-+mail_queue.o: file_id.h
-+mail_queue.o: mail_params.h
-+mail_queue.o: mail_queue.c
-+mail_queue.o: mail_queue.h
-+mail_run.o: ../../include/msg.h
-+mail_run.o: ../../include/mymalloc.h
-+mail_run.o: ../../include/stringops.h
-+mail_run.o: ../../include/sys_defs.h
-+mail_run.o: ../../include/vbuf.h
-+mail_run.o: ../../include/vstring.h
-+mail_run.o: mail_params.h
-+mail_run.o: mail_run.c
-+mail_run.o: mail_run.h
-+mail_scan_dir.o: ../../include/scan_dir.h
-+mail_scan_dir.o: ../../include/sys_defs.h
-+mail_scan_dir.o: mail_scan_dir.c
-+mail_scan_dir.o: mail_scan_dir.h
-+mail_stream.o: ../../include/argv.h
-+mail_stream.o: ../../include/attr.h
-+mail_stream.o: ../../include/iostuff.h
-+mail_stream.o: ../../include/msg.h
-+mail_stream.o: ../../include/mymalloc.h
-+mail_stream.o: ../../include/sane_fsops.h
-+mail_stream.o: ../../include/stringops.h
-+mail_stream.o: ../../include/sys_defs.h
-+mail_stream.o: ../../include/vbuf.h
-+mail_stream.o: ../../include/vstream.h
-+mail_stream.o: ../../include/vstring.h
-+mail_stream.o: cleanup_user.h
-+mail_stream.o: mail_params.h
-+mail_stream.o: mail_proto.h
-+mail_stream.o: mail_queue.h
-+mail_stream.o: mail_stream.c
-+mail_stream.o: mail_stream.h
-+mail_stream.o: opened.h
-+mail_task.o: ../../include/safe.h
-+mail_task.o: ../../include/sys_defs.h
-+mail_task.o: ../../include/vbuf.h
-+mail_task.o: ../../include/vstring.h
-+mail_task.o: mail_conf.h
-+mail_task.o: mail_params.h
-+mail_task.o: mail_task.c
-+mail_task.o: mail_task.h
-+mail_trigger.o: ../../include/attr.h
-+mail_trigger.o: ../../include/iostuff.h
-+mail_trigger.o: ../../include/msg.h
-+mail_trigger.o: ../../include/mymalloc.h
-+mail_trigger.o: ../../include/sys_defs.h
-+mail_trigger.o: ../../include/trigger.h
-+mail_trigger.o: ../../include/vbuf.h
-+mail_trigger.o: ../../include/vstream.h
-+mail_trigger.o: mail_params.h
-+mail_trigger.o: mail_proto.h
-+mail_trigger.o: mail_trigger.c
-+mail_version.o: mail_version.c
-+maps.o: ../../include/argv.h
-+maps.o: ../../include/dict.h
-+maps.o: ../../include/msg.h
-+maps.o: ../../include/mymalloc.h
-+maps.o: ../../include/split_at.h
-+maps.o: ../../include/stringops.h
-+maps.o: ../../include/sys_defs.h
-+maps.o: ../../include/vbuf.h
-+maps.o: ../../include/vstream.h
-+maps.o: ../../include/vstring.h
-+maps.o: mail_conf.h
-+maps.o: maps.c
-+maps.o: maps.h
-+mark_corrupt.o: ../../include/attr.h
-+mark_corrupt.o: ../../include/msg.h
-+mark_corrupt.o: ../../include/set_eugid.h
-+mark_corrupt.o: ../../include/sys_defs.h
-+mark_corrupt.o: ../../include/vbuf.h
-+mark_corrupt.o: ../../include/vstream.h
-+mark_corrupt.o: ../../include/vstring.h
-+mark_corrupt.o: deliver_request.h
-+mark_corrupt.o: dsn.h
-+mark_corrupt.o: mail_params.h
-+mark_corrupt.o: mail_queue.h
-+mark_corrupt.o: mark_corrupt.c
-+mark_corrupt.o: mark_corrupt.h
-+mark_corrupt.o: msg_stats.h
-+mark_corrupt.o: recipient_list.h
-+match_parent_style.o: ../../include/match_list.h
-+match_parent_style.o: ../../include/match_ops.h
-+match_parent_style.o: ../../include/sys_defs.h
-+match_parent_style.o: mail_params.h
-+match_parent_style.o: match_parent_style.c
-+match_parent_style.o: match_parent_style.h
-+match_parent_style.o: string_list.h
-+match_service.o: ../../include/argv.h
-+match_service.o: ../../include/msg.h
-+match_service.o: ../../include/mymalloc.h
-+match_service.o: ../../include/stringops.h
-+match_service.o: ../../include/sys_defs.h
-+match_service.o: ../../include/vbuf.h
-+match_service.o: ../../include/vstring.h
-+match_service.o: match_service.c
-+match_service.o: match_service.h
-+mbox_conf.o: ../../include/argv.h
-+mbox_conf.o: ../../include/name_mask.h
-+mbox_conf.o: ../../include/sys_defs.h
-+mbox_conf.o: ../../include/vbuf.h
-+mbox_conf.o: ../../include/vstring.h
-+mbox_conf.o: mail_params.h
-+mbox_conf.o: mbox_conf.c
-+mbox_conf.o: mbox_conf.h
-+mbox_open.o: ../../include/argv.h
-+mbox_open.o: ../../include/iostuff.h
-+mbox_open.o: ../../include/msg.h
-+mbox_open.o: ../../include/myflock.h
-+mbox_open.o: ../../include/mymalloc.h
-+mbox_open.o: ../../include/safe_open.h
-+mbox_open.o: ../../include/sys_defs.h
-+mbox_open.o: ../../include/vbuf.h
-+mbox_open.o: ../../include/vstream.h
-+mbox_open.o: ../../include/vstring.h
-+mbox_open.o: deliver_flock.h
-+mbox_open.o: dot_lockfile.h
-+mbox_open.o: dsn.h
-+mbox_open.o: dsn_buf.h
-+mbox_open.o: mbox_conf.h
-+mbox_open.o: mbox_open.c
-+mbox_open.o: mbox_open.h
-+mime_state.o: ../../include/msg.h
-+mime_state.o: ../../include/mymalloc.h
-+mime_state.o: ../../include/sys_defs.h
-+mime_state.o: ../../include/vbuf.h
-+mime_state.o: ../../include/vstring.h
-+mime_state.o: header_opts.h
-+mime_state.o: header_token.h
-+mime_state.o: is_header.h
-+mime_state.o: lex_822.h
-+mime_state.o: mail_params.h
-+mime_state.o: mime_state.c
-+mime_state.o: mime_state.h
-+mime_state.o: rec_type.h
-+mkmap_cdb.o: ../../include/argv.h
-+mkmap_cdb.o: ../../include/dict.h
-+mkmap_cdb.o: ../../include/dict_cdb.h
-+mkmap_cdb.o: ../../include/mymalloc.h
-+mkmap_cdb.o: ../../include/sys_defs.h
-+mkmap_cdb.o: ../../include/vbuf.h
-+mkmap_cdb.o: ../../include/vstream.h
-+mkmap_cdb.o: ../../include/vstring.h
-+mkmap_cdb.o: mkmap.h
-+mkmap_cdb.o: mkmap_cdb.c
-+mkmap_db.o: ../../include/argv.h
-+mkmap_db.o: ../../include/dict.h
-+mkmap_db.o: ../../include/dict_db.h
-+mkmap_db.o: ../../include/msg.h
-+mkmap_db.o: ../../include/myflock.h
-+mkmap_db.o: ../../include/mymalloc.h
-+mkmap_db.o: ../../include/stringops.h
-+mkmap_db.o: ../../include/sys_defs.h
-+mkmap_db.o: ../../include/vbuf.h
-+mkmap_db.o: ../../include/vstream.h
-+mkmap_db.o: ../../include/vstring.h
-+mkmap_db.o: mail_params.h
-+mkmap_db.o: mkmap.h
-+mkmap_db.o: mkmap_db.c
-+mkmap_dbm.o: ../../include/argv.h
-+mkmap_dbm.o: ../../include/dict.h
-+mkmap_dbm.o: ../../include/dict_dbm.h
-+mkmap_dbm.o: ../../include/msg.h
-+mkmap_dbm.o: ../../include/myflock.h
-+mkmap_dbm.o: ../../include/mymalloc.h
-+mkmap_dbm.o: ../../include/stringops.h
-+mkmap_dbm.o: ../../include/sys_defs.h
-+mkmap_dbm.o: ../../include/vbuf.h
-+mkmap_dbm.o: ../../include/vstream.h
-+mkmap_dbm.o: ../../include/vstring.h
-+mkmap_dbm.o: mkmap.h
-+mkmap_dbm.o: mkmap_dbm.c
-+mkmap_open.o: ../../include/argv.h
-+mkmap_open.o: ../../include/dict.h
-+mkmap_open.o: ../../include/dict_cdb.h
-+mkmap_open.o: ../../include/dict_db.h
-+mkmap_open.o: ../../include/dict_dbm.h
-+mkmap_open.o: ../../include/dict_sdbm.h
-+mkmap_open.o: ../../include/msg.h
-+mkmap_open.o: ../../include/mymalloc.h
-+mkmap_open.o: ../../include/sigdelay.h
-+mkmap_open.o: ../../include/sys_defs.h
-+mkmap_open.o: ../../include/vbuf.h
-+mkmap_open.o: ../../include/vstream.h
-+mkmap_open.o: ../../include/vstring.h
-+mkmap_open.o: dict_proxy.h
-+mkmap_open.o: mkmap.h
-+mkmap_open.o: mkmap_open.c
-+mkmap_proxy.o: ../../include/argv.h
-+mkmap_proxy.o: ../../include/dict.h
-+mkmap_proxy.o: ../../include/mymalloc.h
-+mkmap_proxy.o: ../../include/sys_defs.h
-+mkmap_proxy.o: ../../include/vbuf.h
-+mkmap_proxy.o: ../../include/vstream.h
-+mkmap_proxy.o: ../../include/vstring.h
-+mkmap_proxy.o: dict_proxy.h
-+mkmap_proxy.o: mkmap.h
-+mkmap_proxy.o: mkmap_proxy.c
-+mkmap_sdbm.o: ../../include/argv.h
-+mkmap_sdbm.o: ../../include/dict.h
-+mkmap_sdbm.o: ../../include/dict_sdbm.h
-+mkmap_sdbm.o: ../../include/msg.h
-+mkmap_sdbm.o: ../../include/myflock.h
-+mkmap_sdbm.o: ../../include/mymalloc.h
-+mkmap_sdbm.o: ../../include/stringops.h
-+mkmap_sdbm.o: ../../include/sys_defs.h
-+mkmap_sdbm.o: ../../include/vbuf.h
-+mkmap_sdbm.o: ../../include/vstream.h
-+mkmap_sdbm.o: ../../include/vstring.h
-+mkmap_sdbm.o: mkmap.h
-+mkmap_sdbm.o: mkmap_sdbm.c
-+msg_stats_print.o: ../../include/attr.h
-+msg_stats_print.o: ../../include/iostuff.h
-+msg_stats_print.o: ../../include/sys_defs.h
-+msg_stats_print.o: ../../include/vbuf.h
-+msg_stats_print.o: ../../include/vstream.h
-+msg_stats_print.o: mail_proto.h
-+msg_stats_print.o: msg_stats.h
-+msg_stats_print.o: msg_stats_print.c
-+msg_stats_scan.o: ../../include/attr.h
-+msg_stats_scan.o: ../../include/iostuff.h
-+msg_stats_scan.o: ../../include/msg.h
-+msg_stats_scan.o: ../../include/sys_defs.h
-+msg_stats_scan.o: ../../include/vbuf.h
-+msg_stats_scan.o: ../../include/vstream.h
-+msg_stats_scan.o: ../../include/vstring.h
-+msg_stats_scan.o: mail_proto.h
-+msg_stats_scan.o: msg_stats.h
-+msg_stats_scan.o: msg_stats_scan.c
-+mynetworks.o: ../../include/argv.h
-+mynetworks.o: ../../include/inet_addr_list.h
-+mynetworks.o: ../../include/mask_addr.h
-+mynetworks.o: ../../include/msg.h
-+mynetworks.o: ../../include/myaddrinfo.h
-+mynetworks.o: ../../include/name_mask.h
-+mynetworks.o: ../../include/sock_addr.h
-+mynetworks.o: ../../include/sys_defs.h
-+mynetworks.o: ../../include/vbuf.h
-+mynetworks.o: ../../include/vstring.h
-+mynetworks.o: been_here.h
-+mynetworks.o: mail_params.h
-+mynetworks.o: mynetworks.c
-+mynetworks.o: mynetworks.h
-+mynetworks.o: own_inet_addr.h
-+mypwd.o: ../../include/binhash.h
-+mypwd.o: ../../include/htable.h
-+mypwd.o: ../../include/msg.h
-+mypwd.o: ../../include/mymalloc.h
-+mypwd.o: ../../include/sys_defs.h
-+mypwd.o: mypwd.c
-+mypwd.o: mypwd.h
-+namadr_list.o: ../../include/match_list.h
-+namadr_list.o: ../../include/match_ops.h
-+namadr_list.o: ../../include/sys_defs.h
-+namadr_list.o: namadr_list.c
-+namadr_list.o: namadr_list.h
-+off_cvt.o: ../../include/msg.h
-+off_cvt.o: ../../include/sys_defs.h
-+off_cvt.o: ../../include/vbuf.h
-+off_cvt.o: ../../include/vstring.h
-+off_cvt.o: off_cvt.c
-+off_cvt.o: off_cvt.h
-+opened.o: ../../include/msg.h
-+opened.o: ../../include/sys_defs.h
-+opened.o: ../../include/vbuf.h
-+opened.o: ../../include/vstring.h
-+opened.o: opened.c
-+opened.o: opened.h
-+own_inet_addr.o: ../../include/inet_addr_host.h
-+own_inet_addr.o: ../../include/inet_addr_list.h
-+own_inet_addr.o: ../../include/inet_addr_local.h
-+own_inet_addr.o: ../../include/inet_proto.h
-+own_inet_addr.o: ../../include/msg.h
-+own_inet_addr.o: ../../include/myaddrinfo.h
-+own_inet_addr.o: ../../include/mymalloc.h
-+own_inet_addr.o: ../../include/sock_addr.h
-+own_inet_addr.o: ../../include/stringops.h
-+own_inet_addr.o: ../../include/sys_defs.h
-+own_inet_addr.o: ../../include/vbuf.h
-+own_inet_addr.o: ../../include/vstring.h
-+own_inet_addr.o: mail_params.h
-+own_inet_addr.o: own_inet_addr.c
-+own_inet_addr.o: own_inet_addr.h
-+pipe_command.o: ../../include/argv.h
-+pipe_command.o: ../../include/chroot_uid.h
-+pipe_command.o: ../../include/clean_env.h
-+pipe_command.o: ../../include/exec_command.h
-+pipe_command.o: ../../include/iostuff.h
-+pipe_command.o: ../../include/msg.h
-+pipe_command.o: ../../include/msg_vstream.h
-+pipe_command.o: ../../include/set_eugid.h
-+pipe_command.o: ../../include/set_ugid.h
-+pipe_command.o: ../../include/stringops.h
-+pipe_command.o: ../../include/sys_defs.h
-+pipe_command.o: ../../include/timed_wait.h
-+pipe_command.o: ../../include/vbuf.h
-+pipe_command.o: ../../include/vstream.h
-+pipe_command.o: ../../include/vstring.h
-+pipe_command.o: dsn.h
-+pipe_command.o: dsn_buf.h
-+pipe_command.o: dsn_util.h
-+pipe_command.o: mail_copy.h
-+pipe_command.o: mail_params.h
-+pipe_command.o: pipe_command.c
-+pipe_command.o: pipe_command.h
-+pipe_command.o: sys_exits.h
-+post_mail.o: ../../include/attr.h
-+post_mail.o: ../../include/events.h
-+post_mail.o: ../../include/iostuff.h
-+post_mail.o: ../../include/msg.h
-+post_mail.o: ../../include/mymalloc.h
-+post_mail.o: ../../include/sys_defs.h
-+post_mail.o: ../../include/vbuf.h
-+post_mail.o: ../../include/vstream.h
-+post_mail.o: ../../include/vstring.h
-+post_mail.o: cleanup_user.h
-+post_mail.o: int_filt.h
-+post_mail.o: mail_date.h
-+post_mail.o: mail_params.h
-+post_mail.o: mail_proto.h
-+post_mail.o: post_mail.c
-+post_mail.o: post_mail.h
-+post_mail.o: rec_type.h
-+post_mail.o: record.h
-+quote_821_local.o: ../../include/sys_defs.h
-+quote_821_local.o: ../../include/vbuf.h
-+quote_821_local.o: ../../include/vstring.h
-+quote_821_local.o: quote_821_local.c
-+quote_821_local.o: quote_821_local.h
-+quote_821_local.o: quote_flags.h
-+quote_822_local.o: ../../include/sys_defs.h
-+quote_822_local.o: ../../include/vbuf.h
-+quote_822_local.o: ../../include/vstring.h
-+quote_822_local.o: quote_822_local.c
-+quote_822_local.o: quote_822_local.h
-+quote_822_local.o: quote_flags.h
-+rcpt_buf.o: ../../include/attr.h
-+rcpt_buf.o: ../../include/iostuff.h
-+rcpt_buf.o: ../../include/mymalloc.h
-+rcpt_buf.o: ../../include/sys_defs.h
-+rcpt_buf.o: ../../include/vbuf.h
-+rcpt_buf.o: ../../include/vstream.h
-+rcpt_buf.o: ../../include/vstring.h
-+rcpt_buf.o: mail_proto.h
-+rcpt_buf.o: rcpt_buf.c
-+rcpt_buf.o: rcpt_buf.h
-+rcpt_buf.o: recipient_list.h
-+rcpt_print.o: ../../include/attr.h
-+rcpt_print.o: ../../include/iostuff.h
-+rcpt_print.o: ../../include/sys_defs.h
-+rcpt_print.o: ../../include/vbuf.h
-+rcpt_print.o: ../../include/vstream.h
-+rcpt_print.o: mail_proto.h
-+rcpt_print.o: rcpt_print.c
-+rcpt_print.o: rcpt_print.h
-+rcpt_print.o: recipient_list.h
-+rec2stream.o: ../../include/sys_defs.h
-+rec2stream.o: ../../include/vbuf.h
-+rec2stream.o: ../../include/vstream.h
-+rec2stream.o: ../../include/vstring.h
-+rec2stream.o: rec2stream.c
-+rec2stream.o: rec_streamlf.h
-+rec2stream.o: rec_type.h
-+rec2stream.o: record.h
-+rec_attr_map.o: ../../include/attr.h
-+rec_attr_map.o: ../../include/iostuff.h
-+rec_attr_map.o: ../../include/sys_defs.h
-+rec_attr_map.o: ../../include/vbuf.h
-+rec_attr_map.o: ../../include/vstream.h
-+rec_attr_map.o: mail_proto.h
-+rec_attr_map.o: rec_attr_map.c
-+rec_attr_map.o: rec_attr_map.h
-+rec_attr_map.o: rec_type.h
-+rec_streamlf.o: ../../include/sys_defs.h
-+rec_streamlf.o: ../../include/vbuf.h
-+rec_streamlf.o: ../../include/vstream.h
-+rec_streamlf.o: ../../include/vstring.h
-+rec_streamlf.o: rec_streamlf.c
-+rec_streamlf.o: rec_streamlf.h
-+rec_streamlf.o: rec_type.h
-+rec_streamlf.o: record.h
-+rec_type.o: rec_type.c
-+rec_type.o: rec_type.h
-+recdump.o: ../../include/msg_vstream.h
-+recdump.o: ../../include/sys_defs.h
-+recdump.o: ../../include/vbuf.h
-+recdump.o: ../../include/vstream.h
-+recdump.o: ../../include/vstring.h
-+recdump.o: rec_streamlf.h
-+recdump.o: rec_type.h
-+recdump.o: recdump.c
-+recdump.o: record.h
-+recipient_list.o: ../../include/msg.h
-+recipient_list.o: ../../include/mymalloc.h
-+recipient_list.o: ../../include/sys_defs.h
-+recipient_list.o: recipient_list.c
-+recipient_list.o: recipient_list.h
-+record.o: ../../include/msg.h
-+record.o: ../../include/mymalloc.h
-+record.o: ../../include/stringops.h
-+record.o: ../../include/sys_defs.h
-+record.o: ../../include/vbuf.h
-+record.o: ../../include/vstream.h
-+record.o: ../../include/vstring.h
-+record.o: off_cvt.h
-+record.o: rec_type.h
-+record.o: record.c
-+record.o: record.h
-+remove.o: ../../include/sys_defs.h
-+remove.o: ../../include/vbuf.h
-+remove.o: ../../include/vstring.h
-+remove.o: mail_params.h
-+remove.o: remove.c
-+resolve_clnt.o: ../../include/attr.h
-+resolve_clnt.o: ../../include/events.h
-+resolve_clnt.o: ../../include/iostuff.h
-+resolve_clnt.o: ../../include/msg.h
-+resolve_clnt.o: ../../include/sys_defs.h
-+resolve_clnt.o: ../../include/vbuf.h
-+resolve_clnt.o: ../../include/vstream.h
-+resolve_clnt.o: ../../include/vstring.h
-+resolve_clnt.o: ../../include/vstring_vstream.h
-+resolve_clnt.o: clnt_stream.h
-+resolve_clnt.o: mail_params.h
-+resolve_clnt.o: mail_proto.h
-+resolve_clnt.o: resolve_clnt.c
-+resolve_clnt.o: resolve_clnt.h
-+resolve_local.o: ../../include/inet_addr_list.h
-+resolve_local.o: ../../include/match_list.h
-+resolve_local.o: ../../include/match_ops.h
-+resolve_local.o: ../../include/msg.h
-+resolve_local.o: ../../include/myaddrinfo.h
-+resolve_local.o: ../../include/mymalloc.h
-+resolve_local.o: ../../include/sys_defs.h
-+resolve_local.o: ../../include/valid_hostname.h
-+resolve_local.o: mail_params.h
-+resolve_local.o: own_inet_addr.h
-+resolve_local.o: resolve_local.c
-+resolve_local.o: resolve_local.h
-+resolve_local.o: string_list.h
-+resolve_local.o: valid_mailhost_addr.h
-+rewrite_clnt.o: ../../include/attr.h
-+rewrite_clnt.o: ../../include/events.h
-+rewrite_clnt.o: ../../include/iostuff.h
-+rewrite_clnt.o: ../../include/msg.h
-+rewrite_clnt.o: ../../include/sys_defs.h
-+rewrite_clnt.o: ../../include/vbuf.h
-+rewrite_clnt.o: ../../include/vstream.h
-+rewrite_clnt.o: ../../include/vstring.h
-+rewrite_clnt.o: ../../include/vstring_vstream.h
-+rewrite_clnt.o: clnt_stream.h
-+rewrite_clnt.o: mail_params.h
-+rewrite_clnt.o: mail_proto.h
-+rewrite_clnt.o: quote_822_local.h
-+rewrite_clnt.o: quote_flags.h
-+rewrite_clnt.o: rewrite_clnt.c
-+rewrite_clnt.o: rewrite_clnt.h
-+scache.o: ../../include/argv.h
-+scache.o: ../../include/events.h
-+scache.o: ../../include/msg.h
-+scache.o: ../../include/sys_defs.h
-+scache.o: ../../include/vbuf.h
-+scache.o: ../../include/vstream.h
-+scache.o: ../../include/vstring.h
-+scache.o: ../../include/vstring_vstream.h
-+scache.o: scache.c
-+scache.o: scache.h
-+scache_clnt.o: ../../include/attr.h
-+scache_clnt.o: ../../include/auto_clnt.h
-+scache_clnt.o: ../../include/iostuff.h
-+scache_clnt.o: ../../include/msg.h
-+scache_clnt.o: ../../include/mymalloc.h
-+scache_clnt.o: ../../include/stringops.h
-+scache_clnt.o: ../../include/sys_defs.h
-+scache_clnt.o: ../../include/vbuf.h
-+scache_clnt.o: ../../include/vstream.h
-+scache_clnt.o: ../../include/vstring.h
-+scache_clnt.o: mail_params.h
-+scache_clnt.o: mail_proto.h
-+scache_clnt.o: scache.h
-+scache_clnt.o: scache_clnt.c
-+scache_multi.o: ../../include/events.h
-+scache_multi.o: ../../include/htable.h
-+scache_multi.o: ../../include/msg.h
-+scache_multi.o: ../../include/mymalloc.h
-+scache_multi.o: ../../include/ring.h
-+scache_multi.o: ../../include/sys_defs.h
-+scache_multi.o: ../../include/vbuf.h
-+scache_multi.o: ../../include/vstring.h
-+scache_multi.o: scache.h
-+scache_multi.o: scache_multi.c
-+scache_single.o: ../../include/events.h
-+scache_single.o: ../../include/msg.h
-+scache_single.o: ../../include/mymalloc.h
-+scache_single.o: ../../include/sys_defs.h
-+scache_single.o: ../../include/vbuf.h
-+scache_single.o: ../../include/vstring.h
-+scache_single.o: scache.h
-+scache_single.o: scache_single.c
-+sent.o: ../../include/attr.h
-+sent.o: ../../include/msg.h
-+sent.o: ../../include/sys_defs.h
-+sent.o: ../../include/vbuf.h
-+sent.o: ../../include/vstream.h
-+sent.o: ../../include/vstring.h
-+sent.o: bounce.h
-+sent.o: defer.h
-+sent.o: deliver_request.h
-+sent.o: dsn.h
-+sent.o: dsn_buf.h
-+sent.o: dsn_mask.h
-+sent.o: dsn_util.h
-+sent.o: log_adhoc.h
-+sent.o: mail_params.h
-+sent.o: msg_stats.h
-+sent.o: recipient_list.h
-+sent.o: sent.c
-+sent.o: sent.h
-+sent.o: trace.h
-+sent.o: verify.h
-+smtp_stream.o: ../../include/iostuff.h
-+smtp_stream.o: ../../include/msg.h
-+smtp_stream.o: ../../include/sys_defs.h
-+smtp_stream.o: ../../include/vbuf.h
-+smtp_stream.o: ../../include/vstream.h
-+smtp_stream.o: ../../include/vstring.h
-+smtp_stream.o: ../../include/vstring_vstream.h
-+smtp_stream.o: smtp_stream.c
-+smtp_stream.o: smtp_stream.h
-+split_addr.o: ../../include/split_at.h
-+split_addr.o: ../../include/sys_defs.h
-+split_addr.o: mail_addr.h
-+split_addr.o: mail_params.h
-+split_addr.o: split_addr.c
-+split_addr.o: split_addr.h
-+stream2rec.o: ../../include/sys_defs.h
-+stream2rec.o: ../../include/vbuf.h
-+stream2rec.o: ../../include/vstream.h
-+stream2rec.o: ../../include/vstring.h
-+stream2rec.o: rec_streamlf.h
-+stream2rec.o: rec_type.h
-+stream2rec.o: record.h
-+stream2rec.o: stream2rec.c
-+string_list.o: ../../include/match_list.h
-+string_list.o: ../../include/match_ops.h
-+string_list.o: ../../include/sys_defs.h
-+string_list.o: string_list.c
-+string_list.o: string_list.h
-+strip_addr.o: ../../include/mymalloc.h
-+strip_addr.o: ../../include/sys_defs.h
-+strip_addr.o: split_addr.h
-+strip_addr.o: strip_addr.c
-+strip_addr.o: strip_addr.h
-+sys_exits.o: ../../include/msg.h
-+sys_exits.o: ../../include/sys_defs.h
-+sys_exits.o: ../../include/vbuf.h
-+sys_exits.o: ../../include/vstring.h
-+sys_exits.o: sys_exits.c
-+sys_exits.o: sys_exits.h
-+timed_ipc.o: ../../include/msg.h
-+timed_ipc.o: ../../include/sys_defs.h
-+timed_ipc.o: ../../include/vbuf.h
-+timed_ipc.o: ../../include/vstream.h
-+timed_ipc.o: mail_params.h
-+timed_ipc.o: timed_ipc.c
-+timed_ipc.o: timed_ipc.h
-+tok822_find.o: ../../include/sys_defs.h
-+tok822_find.o: ../../include/vbuf.h
-+tok822_find.o: ../../include/vstring.h
-+tok822_find.o: resolve_clnt.h
-+tok822_find.o: tok822.h
-+tok822_find.o: tok822_find.c
-+tok822_node.o: ../../include/mymalloc.h
-+tok822_node.o: ../../include/sys_defs.h
-+tok822_node.o: ../../include/vbuf.h
-+tok822_node.o: ../../include/vstring.h
-+tok822_node.o: resolve_clnt.h
-+tok822_node.o: tok822.h
-+tok822_node.o: tok822_node.c
-+tok822_parse.o: ../../include/msg.h
-+tok822_parse.o: ../../include/stringops.h
-+tok822_parse.o: ../../include/sys_defs.h
-+tok822_parse.o: ../../include/vbuf.h
-+tok822_parse.o: ../../include/vstring.h
-+tok822_parse.o: lex_822.h
-+tok822_parse.o: quote_822_local.h
-+tok822_parse.o: quote_flags.h
-+tok822_parse.o: resolve_clnt.h
-+tok822_parse.o: tok822.h
-+tok822_parse.o: tok822_parse.c
-+tok822_resolve.o: ../../include/msg.h
-+tok822_resolve.o: ../../include/sys_defs.h
-+tok822_resolve.o: ../../include/vbuf.h
-+tok822_resolve.o: ../../include/vstring.h
-+tok822_resolve.o: resolve_clnt.h
-+tok822_resolve.o: tok822.h
-+tok822_resolve.o: tok822_resolve.c
-+tok822_rewrite.o: ../../include/attr.h
-+tok822_rewrite.o: ../../include/iostuff.h
-+tok822_rewrite.o: ../../include/msg.h
-+tok822_rewrite.o: ../../include/sys_defs.h
-+tok822_rewrite.o: ../../include/vbuf.h
-+tok822_rewrite.o: ../../include/vstream.h
-+tok822_rewrite.o: ../../include/vstring.h
-+tok822_rewrite.o: mail_proto.h
-+tok822_rewrite.o: resolve_clnt.h
-+tok822_rewrite.o: rewrite_clnt.h
-+tok822_rewrite.o: tok822.h
-+tok822_rewrite.o: tok822_rewrite.c
-+tok822_tree.o: ../../include/mymalloc.h
-+tok822_tree.o: ../../include/sys_defs.h
-+tok822_tree.o: ../../include/vbuf.h
-+tok822_tree.o: ../../include/vstring.h
-+tok822_tree.o: resolve_clnt.h
-+tok822_tree.o: tok822.h
-+tok822_tree.o: tok822_tree.c
-+trace.o: ../../include/attr.h
-+trace.o: ../../include/iostuff.h
-+trace.o: ../../include/msg.h
-+trace.o: ../../include/sys_defs.h
-+trace.o: ../../include/vbuf.h
-+trace.o: ../../include/vstream.h
-+trace.o: ../../include/vstring.h
-+trace.o: bounce.h
-+trace.o: deliver_request.h
-+trace.o: dsn.h
-+trace.o: dsn_buf.h
-+trace.o: dsn_print.h
-+trace.o: log_adhoc.h
-+trace.o: mail_params.h
-+trace.o: mail_proto.h
-+trace.o: msg_stats.h
-+trace.o: rcpt_print.h
-+trace.o: recipient_list.h
-+trace.o: trace.c
-+trace.o: trace.h
-+user_acl.o: ../../include/match_list.h
-+user_acl.o: ../../include/match_ops.h
-+user_acl.o: ../../include/sys_defs.h
-+user_acl.o: ../../include/vbuf.h
-+user_acl.o: ../../include/vstring.h
-+user_acl.o: mail_params.h
-+user_acl.o: mypwd.h
-+user_acl.o: string_list.h
-+user_acl.o: user_acl.c
-+user_acl.o: user_acl.h
-+valid_mailhost_addr.o: ../../include/msg.h
-+valid_mailhost_addr.o: ../../include/myaddrinfo.h
-+valid_mailhost_addr.o: ../../include/sys_defs.h
-+valid_mailhost_addr.o: ../../include/valid_hostname.h
-+valid_mailhost_addr.o: valid_mailhost_addr.c
-+valid_mailhost_addr.o: valid_mailhost_addr.h
-+verify.o: ../../include/attr.h
-+verify.o: ../../include/iostuff.h
-+verify.o: ../../include/msg.h
-+verify.o: ../../include/sys_defs.h
-+verify.o: ../../include/vbuf.h
-+verify.o: ../../include/vstream.h
-+verify.o: ../../include/vstring.h
-+verify.o: deliver_request.h
-+verify.o: dsn.h
-+verify.o: log_adhoc.h
-+verify.o: mail_params.h
-+verify.o: mail_proto.h
-+verify.o: msg_stats.h
-+verify.o: recipient_list.h
-+verify.o: verify.c
-+verify.o: verify.h
-+verify.o: verify_clnt.h
-+verify_clnt.o: ../../include/attr.h
-+verify_clnt.o: ../../include/iostuff.h
-+verify_clnt.o: ../../include/msg.h
-+verify_clnt.o: ../../include/sys_defs.h
-+verify_clnt.o: ../../include/vbuf.h
-+verify_clnt.o: ../../include/vstream.h
-+verify_clnt.o: ../../include/vstring.h
-+verify_clnt.o: clnt_stream.h
-+verify_clnt.o: deliver_request.h
-+verify_clnt.o: dsn.h
-+verify_clnt.o: mail_params.h
-+verify_clnt.o: mail_proto.h
-+verify_clnt.o: msg_stats.h
-+verify_clnt.o: recipient_list.h
-+verify_clnt.o: verify_clnt.c
-+verify_clnt.o: verify_clnt.h
-+verp_sender.o: ../../include/sys_defs.h
-+verp_sender.o: ../../include/vbuf.h
-+verp_sender.o: ../../include/vstring.h
-+verp_sender.o: mail_params.h
-+verp_sender.o: recipient_list.h
-+verp_sender.o: verp_sender.c
-+verp_sender.o: verp_sender.h
-+wildcard_inet_addr.o: ../../include/inet_addr_host.h
-+wildcard_inet_addr.o: ../../include/inet_addr_list.h
-+wildcard_inet_addr.o: ../../include/msg.h
-+wildcard_inet_addr.o: ../../include/myaddrinfo.h
-+wildcard_inet_addr.o: ../../include/sys_defs.h
-+wildcard_inet_addr.o: wildcard_inet_addr.c
-+wildcard_inet_addr.o: wildcard_inet_addr.h
-+xtext.o: ../../include/msg.h
-+xtext.o: ../../include/sys_defs.h
-+xtext.o: ../../include/vbuf.h
-+xtext.o: ../../include/vstring.h
-+xtext.o: xtext.c
-+xtext.o: xtext.h
-diff -ruN a/src/global/mail_conf.c b/src/global/mail_conf.c
---- a/src/global/mail_conf.c	2009-06-01 12:27:43.000000000 +0000
-+++ b/src/global/mail_conf.c	2009-06-01 13:08:26.000000000 +0000
-@@ -182,6 +182,13 @@
-     path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
-     dict_load_file(CONFIG_DICT, path);
-     myfree(path);
-+
-+#ifndef NO_DYNAMIC_MAPS
-+    path = concatenate(var_config_dir, "/", "dynamicmaps.cf", (char *) 0);
-+    dict_open_dlinfo(path);
-+    myfree(path);
-+#endif
-+
- }
- 
- /* mail_conf_flush - discard configuration dictionary */
-diff -ruN a/src/global/mail_conf.c.orig b/src/global/mail_conf.c.orig
---- a/src/global/mail_conf.c.orig	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/global/mail_conf.c.orig	2009-06-01 13:07:56.000000000 +0000
-@@ -0,0 +1,229 @@
-+/*++
-+/* NAME
-+/*	mail_conf 3
-+/* SUMMARY
-+/*	global configuration parameter management
-+/* SYNOPSIS
-+/*	#include <mail_conf.h>
-+/*
-+/*	void	mail_conf_read()
-+/*
-+/*	void	mail_conf_suck()
-+/*
-+/*	void	mail_conf_flush()
-+/*
-+/*	void	mail_conf_update(name, value)
-+/*	const char *name;
-+/*	const char *value;
-+/*
-+/*	const char *mail_conf_lookup(name)
-+/*	const char *name;
-+/*
-+/*	const char *mail_conf_eval(string)
-+/*	const char *string;
-+/*
-+/*	const char *mail_conf_lookup_eval(name)
-+/*	const char *name;
-+/* DESCRIPTION
-+/*	mail_conf_suck() reads the global Postfix configuration file, and
-+/*	stores its values into a global configuration dictionary.
-+/*
-+/*	mail_conf_read() invokes mail_conf_suck() and assigns the values
-+/*	to global variables by calling mail_params_init().
-+/*
-+/*	mail_conf_flush() discards the global configuration dictionary.
-+/*	This is needed in programs that read main.cf multiple times, to
-+/*	ensure that deleted parameter settings are handled properly.
-+/*
-+/*	The following routines are wrappers around the generic dictionary
-+/*	access routines.
-+/*
-+/*	mail_conf_update() updates the named global parameter. This has
-+/*	no effect on parameters whose value has already been looked up.
-+/*	The update succeeds or the program terminates with fatal error.
-+/*
-+/*	mail_conf_lookup() looks up the value of the named parameter.
-+/*	A null pointer result means the parameter was not found.
-+/*	The result is volatile and should be copied if it is to be
-+/*	used for any appreciable amount of time.
-+/*
-+/*	mail_conf_eval() recursively expands any $parameters in the
-+/*	string argument. The result is volatile and should be copied
-+/*	if it is to be used for any appreciable amount of time.
-+/*
-+/*	mail_conf_lookup_eval() looks up the named parameter, and expands any
-+/*	$parameters in the result. The result is volatile and should be
-+/*	copied if it is to be used for any appreciable amount of time.
-+/* DIAGNOSTICS
-+/*	Fatal errors: malformed numerical value.
-+/* ENVIRONMENT
-+/*	MAIL_CONFIG, non-default configuration database
-+/*	MAIL_VERBOSE, enable verbose mode
-+/* FILES
-+/*	/etc/postfix: default Postfix configuration directory.
-+/* SEE ALSO
-+/*	dict(3) generic dictionary manager
-+/*	mail_conf_int(3) integer-valued parameters
-+/*	mail_conf_str(3) string-valued parameters
-+/* LICENSE
-+/* .ad
-+/* .fi
-+/*	The Secure Mailer license must be distributed with this software.
-+/* AUTHOR(S)
-+/*	Wietse Venema
-+/*	IBM T.J. Watson Research
-+/*	P.O. Box 704
-+/*	Yorktown Heights, NY 10598, USA
-+/*--*/
-+
-+/* System library. */
-+
-+#include <sys_defs.h>
-+#include <unistd.h>
-+#include <stdlib.h>
-+#include <string.h>
-+
-+/* Utility library. */
-+
-+#include <msg.h>
-+#include <mymalloc.h>
-+#include <vstream.h>
-+#include <vstring.h>
-+#include <dict.h>
-+#include <safe.h>
-+#include <stringops.h>
-+#include <readlline.h>
-+
-+/* Global library. */
-+
-+#include "mail_params.h"
-+#include "mail_conf.h"
-+
-+/* mail_conf_checkdir - authorize non-default directory */
-+
-+static void mail_conf_checkdir(const char *config_dir)
-+{
-+    VSTRING *buf;
-+    VSTREAM *fp;
-+    char   *path;
-+    char   *name;
-+    char   *value;
-+    char   *cp;
-+    int     found = 0;
-+
-+    /*
-+     * If running set-[ug]id, require that a non-default configuration
-+     * directory name is blessed as a bona fide configuration directory in
-+     * the default main.cf file.
-+     */
-+    path = concatenate(DEF_CONFIG_DIR, "/", "main.cf", (char *) 0);
-+    if ((fp = vstream_fopen(path, O_RDONLY, 0)) == 0)
-+	msg_fatal("open file %s: %m", path);
-+
-+    buf = vstring_alloc(1);
-+    while (found == 0 && readlline(buf, fp, (int *) 0)) {
-+	if (split_nameval(vstring_str(buf), &name, &value) == 0
-+	    && (strcmp(name, VAR_CONFIG_DIRS) == 0
-+		|| strcmp(name, VAR_MULTI_CONF_DIRS) == 0)) {
-+	    while (found == 0 && (cp = mystrtok(&value, ", \t\r\n")) != 0)
-+		if (strcmp(cp, config_dir) == 0)
-+		    found = 1;
-+	}
-+    }
-+    if (vstream_fclose(fp))
-+	msg_fatal("read file %s: %m", path);
-+    vstring_free(buf);
-+
-+    if (found == 0) {
-+	msg_error("untrusted configuration directory name: %s", config_dir);
-+	msg_fatal("specify \"%s = %s\" in %s",
-+		  VAR_CONFIG_DIRS, config_dir, path);
-+    }
-+    myfree(path);
-+}
-+
-+/* mail_conf_read - read global configuration file */
-+
-+void    mail_conf_read(void)
-+{
-+    mail_conf_suck();
-+    mail_params_init();
-+}
-+
-+/* mail_conf_suck - suck in the global configuration file */
-+
-+void    mail_conf_suck(void)
-+{
-+    char   *config_dir;
-+    char   *path;
-+
-+    /*
-+     * Permit references to unknown configuration variable names. We rely on
-+     * a separate configuration checking tool to spot misspelled names and
-+     * other kinds of trouble. Enter the configuration directory into the
-+     * default dictionary.
-+     */
-+    dict_unknown_allowed = 1;
-+    if (var_config_dir)
-+	myfree(var_config_dir);
-+    if ((config_dir = getenv(CONF_ENV_PATH)) == 0)
-+	config_dir = DEF_CONFIG_DIR;
-+    var_config_dir = mystrdup(config_dir);
-+    set_mail_conf_str(VAR_CONFIG_DIR, var_config_dir);
-+
-+    /*
-+     * If the configuration directory name comes from a different trust
-+     * domain, require that it is listed in the default main.cf file.
-+     */
-+    if (strcmp(var_config_dir, DEF_CONFIG_DIR) != 0	/* non-default */
-+	&& safe_getenv(CONF_ENV_PATH) == 0	/* non-default */
-+	&& geteuid() != 0)			/* untrusted */
-+	mail_conf_checkdir(var_config_dir);
-+    path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
-+    dict_load_file(CONFIG_DICT, path);
-+    myfree(path);
-+}
-+
-+/* mail_conf_flush - discard configuration dictionary */
-+
-+void mail_conf_flush(void)
-+{
-+    if (dict_handle(CONFIG_DICT) != 0)
-+        dict_unregister(CONFIG_DICT);
-+}
-+
-+/* mail_conf_eval - expand macros in string */
-+
-+const char *mail_conf_eval(const char *string)
-+{
-+#define RECURSIVE	1
-+
-+    return (dict_eval(CONFIG_DICT, string, RECURSIVE));
-+}
-+
-+/* mail_conf_lookup - lookup named variable */
-+
-+const char *mail_conf_lookup(const char *name)
-+{
-+    return (dict_lookup(CONFIG_DICT, name));
-+}
-+
-+/* mail_conf_lookup_eval - expand named variable */
-+
-+const char *mail_conf_lookup_eval(const char *name)
-+{
-+    const char *value;
-+
-+#define RECURSIVE	1
-+
-+    if ((value = dict_lookup(CONFIG_DICT, name)) != 0)
-+	value = dict_eval(CONFIG_DICT, value, RECURSIVE);
-+    return (value);
-+}
-+
-+/* mail_conf_update - update parameter */
-+
-+void    mail_conf_update(const char *key, const char *value)
-+{
-+    dict_update(CONFIG_DICT, key, value);
-+}
-diff -ruN a/src/global/mail_dict.c b/src/global/mail_dict.c
---- a/src/global/mail_dict.c	2009-06-01 12:27:43.000000000 +0000
-+++ b/src/global/mail_dict.c	2009-06-01 13:08:26.000000000 +0000
-@@ -45,6 +45,7 @@
- 
- static const DICT_OPEN_INFO dict_open_info[] = {
-     DICT_TYPE_PROXY, dict_proxy_open,
-+#ifdef NO_DYNAMIC_MAPS
- #ifdef HAS_LDAP
-     DICT_TYPE_LDAP, dict_ldap_open,
- #endif
-@@ -54,6 +55,7 @@
- #ifdef HAS_PGSQL
-     DICT_TYPE_PGSQL, dict_pgsql_open,
- #endif
-+#endif /* NO_DYNAMIC_MAPS */
-     0,
- };
- 
-diff -ruN a/src/global/mail_params.c b/src/global/mail_params.c
---- a/src/global/mail_params.c	2009-06-01 12:27:43.000000000 +0000
-+++ b/src/global/mail_params.c	2009-06-01 13:08:26.000000000 +0000
-@@ -79,6 +79,7 @@
- /*	char	*var_export_environ;
- /*	char	*var_debug_peer_list;
- /*	int	var_debug_peer_level;
-+/*	int	var_command_maxtime;
- /*	int	var_in_flow_delay;
- /*	int	var_fault_inj_code;
- /*	char   *var_bounce_service;
-@@ -265,6 +266,7 @@
- char   *var_export_environ;
- char   *var_debug_peer_list;
- int     var_debug_peer_level;
-+int	var_command_maxtime;
- int     var_fault_inj_code;
- char   *var_bounce_service;
- char   *var_cleanup_service;
-@@ -276,6 +278,7 @@
- char   *var_error_service;
- char   *var_flush_service;
- char   *var_verify_service;
-+char   *var_scache_service;
- char   *var_trace_service;
- char   *var_proxymap_service;
- char   *var_proxywrite_service;
-diff -ruN a/src/global/mail_params.c.orig b/src/global/mail_params.c.orig
---- a/src/global/mail_params.c.orig	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/global/mail_params.c.orig	2009-06-01 13:07:56.000000000 +0000
-@@ -0,0 +1,752 @@
-+/*++
-+/* NAME
-+/*	mail_params 3
-+/* SUMMARY
-+/*	global mail configuration parameters
-+/* SYNOPSIS
-+/*	#include <mail_params.h>
-+/*
-+/*	char	*var_myhostname;
-+/*	char	*var_mydomain;
-+/*	char	*var_myorigin;
-+/*	char	*var_mydest;
-+/*	char	*var_relayhost;
-+/*	char	*var_transit_origin;
-+/*	char	*var_transit_dest;
-+/*	char	*var_mail_name;
-+/*	int	var_helpful_warnings;
-+/*	char	*var_syslog_name;
-+/*	char	*var_mail_owner;
-+/*	uid_t	var_owner_uid;
-+/*	gid_t	var_owner_gid;
-+/*	char	*var_sgid_group;
-+/*	gid_t	var_sgid_gid;
-+/*	char	*var_default_privs;
-+/*	uid_t	var_default_uid;
-+/*	gid_t	var_default_gid;
-+/*	char	*var_config_dir;
-+/*	char	*var_daemon_dir;
-+/*	char	*var_data_dir;
-+/*	char	*var_command_dir;
-+/*	char	*var_queue_dir;
-+/*	int	var_use_limit;
-+/*	int	var_idle_limit;
-+/*	int	var_event_drain;
-+/*	int	var_bundle_rcpt;
-+/*	char	*var_procname;
-+/*	int	var_pid;
-+/*	int	var_ipc_timeout;
-+/*	char	*var_pid_dir;
-+/*	int	var_dont_remove;
-+/*	char	*var_inet_interfaces;
-+/*	char	*var_proxy_interfaces;
-+/*	char	*var_inet_protocols;
-+/*	char	*var_mynetworks;
-+/*	char	*var_double_bounce_sender;
-+/*	int	var_line_limit;
-+/*	char	*var_alias_db_map;
-+/*	int	var_message_limit;
-+/*	char	*var_mail_release;
-+/*	char	*var_mail_version;
-+/*	int	var_ipc_idle_limit;
-+/*	int	var_ipc_ttl_limit;
-+/*	char	*var_db_type;
-+/*	char	*var_hash_queue_names;
-+/*	int	var_hash_queue_depth;
-+/*	int	var_trigger_timeout;
-+/*	char	*var_rcpt_delim;
-+/*	int	var_fork_tries;
-+/*	int	var_fork_delay;
-+/*	int	var_flock_tries;
-+/*	int	var_flock_delay;
-+/*	int	var_flock_stale;
-+/*	int	var_disable_dns;
-+/*	int	var_soft_bounce;
-+/*	time_t	var_starttime;
-+/*	int	var_ownreq_special;
-+/*	int	var_daemon_timeout;
-+/*	char	*var_syslog_facility;
-+/*	char	*var_relay_domains;
-+/*	char	*var_fflush_domains;
-+/*	char	*var_mynetworks_style;
-+/*	char	*var_verp_delims;
-+/*	char	*var_verp_filter;
-+/*	char	*var_par_dom_match;
-+/*	char	*var_config_dirs;
-+/*
-+/*	int	var_inet_windowsize;
-+/*	char	*var_import_environ;
-+/*	char	*var_export_environ;
-+/*	char	*var_debug_peer_list;
-+/*	int	var_debug_peer_level;
-+/*	int	var_in_flow_delay;
-+/*	int	var_fault_inj_code;
-+/*	char   *var_bounce_service;
-+/*	char   *var_cleanup_service;
-+/*	char   *var_defer_service;
-+/*	char   *var_pickup_service;
-+/*	char   *var_queue_service;
-+/*	char   *var_rewrite_service;
-+/*	char   *var_showq_service;
-+/*	char   *var_error_service;
-+/*	char   *var_flush_service;
-+/*	char   *var_verify_service;
-+/*	char   *var_trace_service;
-+/*	char   *var_proxymap_service;
-+/*	char   *var_proxywrite_service;
-+/*	int	var_db_create_buf;
-+/*	int	var_db_read_buf;
-+/*	int	var_mime_maxdepth;
-+/*	int	var_mime_bound_len;
-+/*	int	var_header_limit;
-+/*	int	var_token_limit;
-+/*	int	var_disable_mime_input;
-+/*	int	var_disable_mime_oconv;
-+/*	int     var_strict_8bitmime;
-+/*	int     var_strict_7bit_hdrs;
-+/*	int     var_strict_8bit_body;
-+/*	int     var_strict_encoding;
-+/*	int     var_verify_neg_cache;
-+/*	int	var_oldlog_compat;
-+/*	int	var_delay_max_res;
-+/*	char	*var_int_filt_classes;
-+/*	int	var_cyrus_sasl_authzid;
-+/*
-+/*	char	*var_multi_conf_dirs;
-+/*	char	*var_multi_wrapper;
-+/*	char	*var_multi_group;
-+/*	char	*var_multi_name;
-+/*	bool	var_multi_enable;
-+/*
-+/*	void	mail_params_init()
-+/*
-+/*	const	char null_format_string[1];
-+/* DESCRIPTION
-+/*	This module (actually the associated include file) define the names
-+/*	and defaults of all mail configuration parameters.
-+/*
-+/*	mail_params_init() initializes the built-in parameters listed above.
-+/*	These parameters are relied upon by library routines, so they are
-+/*	initialized globally so as to avoid hard-to-find errors due to
-+/*	missing initialization. This routine must be called early, at
-+/*	least before entering a chroot jail.
-+/*
-+/*	null_format_string is a workaround for gcc compilers that complain
-+/*	about empty or null format strings.
-+/* DIAGNOSTICS
-+/*	Fatal errors: out of memory; null system or domain name.
-+/* LICENSE
-+/* .ad
-+/* .fi
-+/*	The Secure Mailer license must be distributed with this software.
-+/* AUTHOR(S)
-+/*	Wietse Venema
-+/*	IBM T.J. Watson Research
-+/*	P.O. Box 704
-+/*	Yorktown Heights, NY 10598, USA
-+/*--*/
-+
-+/* System library. */
-+
-+#include <sys_defs.h>
-+#include <unistd.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include <pwd.h>
-+#include <grp.h>
-+#include <time.h>
-+#include <ctype.h>
-+
-+#ifdef STRCASECMP_IN_STRINGS_H
-+#include <strings.h>
-+#endif
-+
-+/* Utility library. */
-+
-+#include <msg.h>
-+#include <msg_syslog.h>
-+#include <get_hostname.h>
-+#include <valid_hostname.h>
-+#include <stringops.h>
-+#include <safe.h>
-+#include <safe_open.h>
-+#include <mymalloc.h>
-+#ifdef HAS_DB
-+#include <dict_db.h>
-+#endif
-+#include <inet_proto.h>
-+#include <vstring_vstream.h>
-+#include <iostuff.h>
-+
-+/* Global library. */
-+
-+#include <mynetworks.h>
-+#include <mail_conf.h>
-+#include <mail_version.h>
-+#include <mail_proto.h>
-+#include <verp_sender.h>
-+#include <own_inet_addr.h>
-+#include <mail_params.h>
-+
-+ /*
-+  * Special configuration variables.
-+  */
-+char   *var_myhostname;
-+char   *var_mydomain;
-+char   *var_myorigin;
-+char   *var_mydest;
-+char   *var_relayhost;
-+char   *var_transit_origin;
-+char   *var_transit_dest;
-+char   *var_mail_name;
-+int     var_helpful_warnings;
-+char   *var_syslog_name;
-+char   *var_mail_owner;
-+uid_t   var_owner_uid;
-+gid_t   var_owner_gid;
-+char   *var_sgid_group;
-+gid_t   var_sgid_gid;
-+char   *var_default_privs;
-+uid_t   var_default_uid;
-+gid_t   var_default_gid;
-+char   *var_config_dir;
-+char   *var_daemon_dir;
-+char   *var_data_dir;
-+char   *var_command_dir;
-+char   *var_queue_dir;
-+int     var_use_limit;
-+int     var_event_drain;
-+int     var_idle_limit;
-+int     var_bundle_rcpt;
-+char   *var_procname;
-+int     var_pid;
-+int     var_ipc_timeout;
-+char   *var_pid_dir;
-+int     var_dont_remove;
-+char   *var_inet_interfaces;
-+char   *var_proxy_interfaces;
-+char   *var_inet_protocols;
-+char   *var_mynetworks;
-+char   *var_double_bounce_sender;
-+int     var_line_limit;
-+char   *var_alias_db_map;
-+int     var_message_limit;
-+char   *var_mail_release;
-+char   *var_mail_version;
-+int     var_ipc_idle_limit;
-+int     var_ipc_ttl_limit;
-+char   *var_db_type;
-+char   *var_hash_queue_names;
-+int     var_hash_queue_depth;
-+int     var_trigger_timeout;
-+char   *var_rcpt_delim;
-+int     var_fork_tries;
-+int     var_fork_delay;
-+int     var_flock_tries;
-+int     var_flock_delay;
-+int     var_flock_stale;
-+int     var_disable_dns;
-+int     var_soft_bounce;
-+time_t  var_starttime;
-+int     var_ownreq_special;
-+int     var_daemon_timeout;
-+char   *var_syslog_facility;
-+char   *var_relay_domains;
-+char   *var_fflush_domains;
-+char   *var_mynetworks_style;
-+char   *var_verp_delims;
-+char   *var_verp_filter;
-+int     var_in_flow_delay;
-+char   *var_par_dom_match;
-+char   *var_config_dirs;
-+
-+int     var_inet_windowsize;
-+char   *var_import_environ;
-+char   *var_export_environ;
-+char   *var_debug_peer_list;
-+int     var_debug_peer_level;
-+int     var_fault_inj_code;
-+char   *var_bounce_service;
-+char   *var_cleanup_service;
-+char   *var_defer_service;
-+char   *var_pickup_service;
-+char   *var_queue_service;
-+char   *var_rewrite_service;
-+char   *var_showq_service;
-+char   *var_error_service;
-+char   *var_flush_service;
-+char   *var_verify_service;
-+char   *var_trace_service;
-+char   *var_proxymap_service;
-+char   *var_proxywrite_service;
-+int     var_db_create_buf;
-+int     var_db_read_buf;
-+int     var_mime_maxdepth;
-+int     var_mime_bound_len;
-+int     var_header_limit;
-+int     var_token_limit;
-+int     var_disable_mime_input;
-+int     var_disable_mime_oconv;
-+int     var_strict_8bitmime;
-+int     var_strict_7bit_hdrs;
-+int     var_strict_8bit_body;
-+int     var_strict_encoding;
-+int     var_verify_neg_cache;
-+int     var_oldlog_compat;
-+int     var_delay_max_res;
-+char   *var_int_filt_classes;
-+int     var_cyrus_sasl_authzid;
-+
-+char   *var_multi_conf_dirs;
-+char   *var_multi_wrapper;
-+char   *var_multi_group;
-+char   *var_multi_name;
-+bool    var_multi_enable;
-+
-+const char null_format_string[1] = "";
-+
-+/* check_myhostname - lookup hostname and validate */
-+
-+static const char *check_myhostname(void)
-+{
-+    static const char *name;
-+    const char *dot;
-+    const char *domain;
-+
-+    /*
-+     * Use cached result.
-+     */
-+    if (name)
-+	return (name);
-+
-+    /*
-+     * If the local machine name is not in FQDN form, try to append the
-+     * contents of $mydomain. Use a default domain as a final workaround.
-+     */
-+    name = get_hostname();
-+    if ((dot = strchr(name, '.')) == 0) {
-+	if ((domain = mail_conf_lookup_eval(VAR_MYDOMAIN)) == 0)
-+	    domain = DEF_MYDOMAIN;
-+	name = concatenate(name, ".", domain, (char *) 0);
-+    }
-+    return (name);
-+}
-+
-+/* check_mydomainname - lookup domain name and validate */
-+
-+static const char *check_mydomainname(void)
-+{
-+    char   *dot;
-+
-+    /*
-+     * Use a default domain when the hostname is not a FQDN ("foo").
-+     */
-+    if ((dot = strchr(var_myhostname, '.')) == 0)
-+	return (DEF_MYDOMAIN);
-+    return (dot + 1);
-+}
-+
-+/* check_default_privs - lookup default user attributes and validate */
-+
-+static void check_default_privs(void)
-+{
-+    struct passwd *pwd;
-+
-+    if ((pwd = getpwnam(var_default_privs)) == 0)
-+	msg_fatal("file %s/%s: parameter %s: unknown user name value: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, var_default_privs);
-+    if ((var_default_uid = pwd->pw_uid) == 0)
-+	msg_fatal("file %s/%s: parameter %s: user %s has privileged user ID",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, var_default_privs);
-+    if ((var_default_gid = pwd->pw_gid) == 0)
-+	msg_fatal("file %s/%s: parameter %s: user %s has privileged group ID",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, var_default_privs);
-+}
-+
-+/* check_mail_owner - lookup owner user attributes and validate */
-+
-+static void check_mail_owner(void)
-+{
-+    struct passwd *pwd;
-+
-+    if ((pwd = getpwnam(var_mail_owner)) == 0)
-+	msg_fatal("file %s/%s: parameter %s: unknown user name value: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MAIL_OWNER, var_mail_owner);
-+    if ((var_owner_uid = pwd->pw_uid) == 0)
-+	msg_fatal("file %s/%s: parameter %s: user %s has privileged user ID",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MAIL_OWNER, var_mail_owner);
-+    if ((var_owner_gid = pwd->pw_gid) == 0)
-+	msg_fatal("file %s/%s: parameter %s: user %s has privileged group ID",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MAIL_OWNER, var_mail_owner);
-+
-+    /*
-+     * This detects only some forms of sharing. Enumerating the entire
-+     * password file name space could be expensive. The purpose of this code
-+     * is to discourage user ID sharing by developers and package
-+     * maintainers.
-+     */
-+    if ((pwd = getpwuid(var_owner_uid)) != 0
-+	&& strcmp(pwd->pw_name, var_mail_owner) != 0)
-+	msg_fatal("file %s/%s: parameter %s: user %s has same user ID as %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MAIL_OWNER, var_mail_owner, pwd->pw_name);
-+}
-+
-+/* check_sgid_group - lookup setgid group attributes and validate */
-+
-+static void check_sgid_group(void)
-+{
-+    struct group *grp;
-+
-+    if ((grp = getgrnam(var_sgid_group)) == 0)
-+	msg_fatal("file %s/%s: parameter %s: unknown group name: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_SGID_GROUP, var_sgid_group);
-+    if ((var_sgid_gid = grp->gr_gid) == 0)
-+	msg_fatal("file %s/%s: parameter %s: group %s has privileged group ID",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_SGID_GROUP, var_sgid_group);
-+
-+    /*
-+     * This detects only some forms of sharing. Enumerating the entire group
-+     * file name space could be expensive. The purpose of this code is to
-+     * discourage group ID sharing by developers and package maintainers.
-+     */
-+    if ((grp = getgrgid(var_sgid_gid)) != 0
-+	&& strcmp(grp->gr_name, var_sgid_group) != 0)
-+	msg_fatal("file %s/%s: parameter %s: group %s has same group ID as %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_SGID_GROUP, var_sgid_group, grp->gr_name);
-+}
-+
-+/* check_overlap - disallow UID or GID sharing */
-+
-+static void check_overlap(void)
-+{
-+    if (strcmp(var_default_privs, var_mail_owner) == 0)
-+	msg_fatal("file %s/%s: parameters %s and %s specify the same user %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, VAR_MAIL_OWNER,
-+		  var_default_privs);
-+    if (var_default_uid == var_owner_uid)
-+	msg_fatal("file %s/%s: parameters %s and %s: users %s and %s have the same user ID: %ld",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, VAR_MAIL_OWNER,
-+		  var_default_privs, var_mail_owner,
-+		  (long) var_owner_uid);
-+    if (var_default_gid == var_owner_gid)
-+	msg_fatal("file %s/%s: parameters %s and %s: users %s and %s have the same group ID: %ld",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, VAR_MAIL_OWNER,
-+		  var_default_privs, var_mail_owner,
-+		  (long) var_owner_gid);
-+    if (var_default_gid == var_sgid_gid)
-+	msg_fatal("file %s/%s: parameters %s and %s: user %s and group %s have the same group ID: %ld",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_DEFAULT_PRIVS, VAR_SGID_GROUP,
-+		  var_default_privs, var_sgid_group,
-+		  (long) var_sgid_gid);
-+    if (var_owner_gid == var_sgid_gid)
-+	msg_fatal("file %s/%s: parameters %s and %s: user %s and group %s have the same group ID: %ld",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MAIL_OWNER, VAR_SGID_GROUP,
-+		  var_mail_owner, var_sgid_group,
-+		  (long) var_sgid_gid);
-+}
-+
-+#ifdef MYORIGIN_FROM_FILE
-+
-+/* read_param_from_file - read parameter value from file */
-+
-+static char *read_param_from_file(const char *path)
-+{
-+    VSTRING *why = vstring_alloc(100);
-+    VSTRING *buf = vstring_alloc(100);
-+    VSTREAM *fp;
-+    char   *bp;
-+    char   *result;
-+
-+    /*
-+     * Ugly macros to make complex expressions less unreadable.
-+     */
-+#define SKIP(start, var, cond) \
-+	for (var = start; *var && (cond); var++);
-+
-+#define TRIM(s) { \
-+	char *p; \
-+	for (p = (s) + strlen(s); p > (s) && ISSPACE(p[-1]); p--); \
-+	*p = 0; \
-+    }
-+
-+    fp = safe_open(path, O_RDONLY, 0, (struct stat *) 0, -1, -1, why);
-+    if (fp == 0)
-+	msg_fatal("%s: %s", path, vstring_str(why));
-+    vstring_get_nonl(buf, fp);
-+    if (vstream_ferror(fp))			/* FIX 20070501 */
-+	msg_fatal("%s: read error: %m", path);
-+    vstream_fclose(fp);
-+    SKIP(vstring_str(buf), bp, ISSPACE(*bp));
-+    TRIM(bp);
-+    result = mystrdup(bp);
-+
-+    vstring_free(why);
-+    vstring_free(buf);
-+    return (result);
-+}
-+
-+#endif
-+
-+/* mail_params_init - configure built-in parameters */
-+
-+void    mail_params_init()
-+{
-+    static const CONFIG_STR_TABLE first_str_defaults[] = {
-+	VAR_SYSLOG_FACILITY, DEF_SYSLOG_FACILITY, &var_syslog_facility, 1, 0,
-+	VAR_INET_PROTOCOLS, DEF_INET_PROTOCOLS, &var_inet_protocols, 1, 0,
-+	VAR_MULTI_CONF_DIRS, DEF_MULTI_CONF_DIRS, &var_multi_conf_dirs, 0, 0,
-+	VAR_MULTI_WRAPPER, DEF_MULTI_WRAPPER, &var_multi_wrapper, 0, 0,
-+	VAR_MULTI_GROUP, DEF_MULTI_GROUP, &var_multi_group, 0, 0,
-+	VAR_MULTI_NAME, DEF_MULTI_NAME, &var_multi_name, 0, 0,
-+	0,
-+    };
-+    static const CONFIG_STR_FN_TABLE function_str_defaults[] = {
-+	VAR_MYHOSTNAME, check_myhostname, &var_myhostname, 1, 0,
-+	VAR_MYDOMAIN, check_mydomainname, &var_mydomain, 1, 0,
-+	0,
-+    };
-+    static const CONFIG_STR_TABLE other_str_defaults[] = {
-+	VAR_MAIL_NAME, DEF_MAIL_NAME, &var_mail_name, 1, 0,
-+	VAR_SYSLOG_NAME, DEF_SYSLOG_NAME, &var_syslog_name, 1, 0,
-+	VAR_MAIL_OWNER, DEF_MAIL_OWNER, &var_mail_owner, 1, 0,
-+	VAR_SGID_GROUP, DEF_SGID_GROUP, &var_sgid_group, 1, 0,
-+	VAR_MYDEST, DEF_MYDEST, &var_mydest, 0, 0,
-+	VAR_MYORIGIN, DEF_MYORIGIN, &var_myorigin, 1, 0,
-+	VAR_RELAYHOST, DEF_RELAYHOST, &var_relayhost, 0, 0,
-+	VAR_DAEMON_DIR, DEF_DAEMON_DIR, &var_daemon_dir, 1, 0,
-+	VAR_DATA_DIR, DEF_DATA_DIR, &var_data_dir, 1, 0,
-+	VAR_COMMAND_DIR, DEF_COMMAND_DIR, &var_command_dir, 1, 0,
-+	VAR_QUEUE_DIR, DEF_QUEUE_DIR, &var_queue_dir, 1, 0,
-+	VAR_PID_DIR, DEF_PID_DIR, &var_pid_dir, 1, 0,
-+	VAR_INET_INTERFACES, DEF_INET_INTERFACES, &var_inet_interfaces, 1, 0,
-+	VAR_PROXY_INTERFACES, DEF_PROXY_INTERFACES, &var_proxy_interfaces, 0, 0,
-+	VAR_DOUBLE_BOUNCE, DEF_DOUBLE_BOUNCE, &var_double_bounce_sender, 1, 0,
-+	VAR_DEFAULT_PRIVS, DEF_DEFAULT_PRIVS, &var_default_privs, 1, 0,
-+	VAR_ALIAS_DB_MAP, DEF_ALIAS_DB_MAP, &var_alias_db_map, 0, 0,
-+	VAR_MAIL_RELEASE, DEF_MAIL_RELEASE, &var_mail_release, 1, 0,
-+	VAR_MAIL_VERSION, DEF_MAIL_VERSION, &var_mail_version, 1, 0,
-+	VAR_DB_TYPE, DEF_DB_TYPE, &var_db_type, 1, 0,
-+	VAR_HASH_QUEUE_NAMES, DEF_HASH_QUEUE_NAMES, &var_hash_queue_names, 1, 0,
-+	VAR_RCPT_DELIM, DEF_RCPT_DELIM, &var_rcpt_delim, 0, 1,
-+	VAR_RELAY_DOMAINS, DEF_RELAY_DOMAINS, &var_relay_domains, 0, 0,
-+	VAR_FFLUSH_DOMAINS, DEF_FFLUSH_DOMAINS, &var_fflush_domains, 0, 0,
-+	VAR_EXPORT_ENVIRON, DEF_EXPORT_ENVIRON, &var_export_environ, 0, 0,
-+	VAR_IMPORT_ENVIRON, DEF_IMPORT_ENVIRON, &var_import_environ, 0, 0,
-+	VAR_MYNETWORKS_STYLE, DEF_MYNETWORKS_STYLE, &var_mynetworks_style, 1, 0,
-+	VAR_DEBUG_PEER_LIST, DEF_DEBUG_PEER_LIST, &var_debug_peer_list, 0, 0,
-+	VAR_VERP_DELIMS, DEF_VERP_DELIMS, &var_verp_delims, 2, 2,
-+	VAR_VERP_FILTER, DEF_VERP_FILTER, &var_verp_filter, 1, 0,
-+	VAR_PAR_DOM_MATCH, DEF_PAR_DOM_MATCH, &var_par_dom_match, 0, 0,
-+	VAR_CONFIG_DIRS, DEF_CONFIG_DIRS, &var_config_dirs, 0, 0,
-+	VAR_BOUNCE_SERVICE, DEF_BOUNCE_SERVICE, &var_bounce_service, 1, 0,
-+	VAR_CLEANUP_SERVICE, DEF_CLEANUP_SERVICE, &var_cleanup_service, 1, 0,
-+	VAR_DEFER_SERVICE, DEF_DEFER_SERVICE, &var_defer_service, 1, 0,
-+	VAR_PICKUP_SERVICE, DEF_PICKUP_SERVICE, &var_pickup_service, 1, 0,
-+	VAR_QUEUE_SERVICE, DEF_QUEUE_SERVICE, &var_queue_service, 1, 0,
-+	VAR_REWRITE_SERVICE, DEF_REWRITE_SERVICE, &var_rewrite_service, 1, 0,
-+	VAR_SHOWQ_SERVICE, DEF_SHOWQ_SERVICE, &var_showq_service, 1, 0,
-+	VAR_ERROR_SERVICE, DEF_ERROR_SERVICE, &var_error_service, 1, 0,
-+	VAR_FLUSH_SERVICE, DEF_FLUSH_SERVICE, &var_flush_service, 1, 0,
-+	VAR_VERIFY_SERVICE, DEF_VERIFY_SERVICE, &var_verify_service, 1, 0,
-+	VAR_TRACE_SERVICE, DEF_TRACE_SERVICE, &var_trace_service, 1, 0,
-+	VAR_PROXYMAP_SERVICE, DEF_PROXYMAP_SERVICE, &var_proxymap_service, 1, 0,
-+	VAR_PROXYWRITE_SERVICE, DEF_PROXYWRITE_SERVICE, &var_proxywrite_service, 1, 0,
-+	VAR_INT_FILT_CLASSES, DEF_INT_FILT_CLASSES, &var_int_filt_classes, 0, 0,
-+	0,
-+    };
-+    static const CONFIG_STR_FN_TABLE function_str_defaults_2[] = {
-+	VAR_MYNETWORKS, mynetworks, &var_mynetworks, 0, 0,
-+	0,
-+    };
-+    static const CONFIG_INT_TABLE other_int_defaults[] = {
-+	VAR_MAX_USE, DEF_MAX_USE, &var_use_limit, 1, 0,
-+	VAR_DONT_REMOVE, DEF_DONT_REMOVE, &var_dont_remove, 0, 0,
-+	VAR_LINE_LIMIT, DEF_LINE_LIMIT, &var_line_limit, 512, 0,
-+	VAR_MESSAGE_LIMIT, DEF_MESSAGE_LIMIT, &var_message_limit, 0, 0,
-+	VAR_HASH_QUEUE_DEPTH, DEF_HASH_QUEUE_DEPTH, &var_hash_queue_depth, 1, 0,
-+	VAR_FORK_TRIES, DEF_FORK_TRIES, &var_fork_tries, 1, 0,
-+	VAR_FLOCK_TRIES, DEF_FLOCK_TRIES, &var_flock_tries, 1, 0,
-+	VAR_DEBUG_PEER_LEVEL, DEF_DEBUG_PEER_LEVEL, &var_debug_peer_level, 1, 0,
-+	VAR_FAULT_INJ_CODE, DEF_FAULT_INJ_CODE, &var_fault_inj_code, 0, 0,
-+	VAR_DB_CREATE_BUF, DEF_DB_CREATE_BUF, &var_db_create_buf, 1, 0,
-+	VAR_DB_READ_BUF, DEF_DB_READ_BUF, &var_db_read_buf, 1, 0,
-+	VAR_HEADER_LIMIT, DEF_HEADER_LIMIT, &var_header_limit, 1, 0,
-+	VAR_TOKEN_LIMIT, DEF_TOKEN_LIMIT, &var_token_limit, 1, 0,
-+	VAR_MIME_MAXDEPTH, DEF_MIME_MAXDEPTH, &var_mime_maxdepth, 1, 0,
-+	VAR_MIME_BOUND_LEN, DEF_MIME_BOUND_LEN, &var_mime_bound_len, 1, 0,
-+	VAR_DELAY_MAX_RES, DEF_DELAY_MAX_RES, &var_delay_max_res, MIN_DELAY_MAX_RES, MAX_DELAY_MAX_RES,
-+	VAR_INET_WINDOW, DEF_INET_WINDOW, &var_inet_windowsize, 0, 0,
-+	0,
-+    };
-+    static const CONFIG_TIME_TABLE time_defaults[] = {
-+	VAR_EVENT_DRAIN, DEF_EVENT_DRAIN, &var_event_drain, 1, 0,
-+	VAR_MAX_IDLE, DEF_MAX_IDLE, &var_idle_limit, 1, 0,
-+	VAR_IPC_TIMEOUT, DEF_IPC_TIMEOUT, &var_ipc_timeout, 1, 0,
-+	VAR_IPC_IDLE, DEF_IPC_IDLE, &var_ipc_idle_limit, 1, 0,
-+	VAR_IPC_TTL, DEF_IPC_TTL, &var_ipc_ttl_limit, 1, 0,
-+	VAR_TRIGGER_TIMEOUT, DEF_TRIGGER_TIMEOUT, &var_trigger_timeout, 1, 0,
-+	VAR_FORK_DELAY, DEF_FORK_DELAY, &var_fork_delay, 1, 0,
-+	VAR_FLOCK_DELAY, DEF_FLOCK_DELAY, &var_flock_delay, 1, 0,
-+	VAR_FLOCK_STALE, DEF_FLOCK_STALE, &var_flock_stale, 1, 0,
-+	VAR_DAEMON_TIMEOUT, DEF_DAEMON_TIMEOUT, &var_daemon_timeout, 1, 0,
-+	VAR_IN_FLOW_DELAY, DEF_IN_FLOW_DELAY, &var_in_flow_delay, 0, 10,
-+	0,
-+    };
-+    static const CONFIG_BOOL_TABLE bool_defaults[] = {
-+	VAR_DISABLE_DNS, DEF_DISABLE_DNS, &var_disable_dns,
-+	VAR_SOFT_BOUNCE, DEF_SOFT_BOUNCE, &var_soft_bounce,
-+	VAR_OWNREQ_SPECIAL, DEF_OWNREQ_SPECIAL, &var_ownreq_special,
-+	VAR_STRICT_8BITMIME, DEF_STRICT_8BITMIME, &var_strict_8bitmime,
-+	VAR_STRICT_7BIT_HDRS, DEF_STRICT_7BIT_HDRS, &var_strict_7bit_hdrs,
-+	VAR_STRICT_8BIT_BODY, DEF_STRICT_8BIT_BODY, &var_strict_8bit_body,
-+	VAR_STRICT_ENCODING, DEF_STRICT_ENCODING, &var_strict_encoding,
-+	VAR_DISABLE_MIME_INPUT, DEF_DISABLE_MIME_INPUT, &var_disable_mime_input,
-+	VAR_DISABLE_MIME_OCONV, DEF_DISABLE_MIME_OCONV, &var_disable_mime_oconv,
-+	VAR_VERIFY_NEG_CACHE, DEF_VERIFY_NEG_CACHE, &var_verify_neg_cache,
-+	VAR_OLDLOG_COMPAT, DEF_OLDLOG_COMPAT, &var_oldlog_compat,
-+	VAR_HELPFUL_WARNINGS, DEF_HELPFUL_WARNINGS, &var_helpful_warnings,
-+	VAR_CYRUS_SASL_AUTHZID, DEF_CYRUS_SASL_AUTHZID, &var_cyrus_sasl_authzid,
-+	VAR_MULTI_ENABLE, DEF_MULTI_ENABLE, &var_multi_enable,
-+	0,
-+    };
-+    const char *cp;
-+    INET_PROTO_INFO *proto_info;
-+
-+    /*
-+     * Extract syslog_facility early, so that from here on all errors are
-+     * logged with the proper facility.
-+     */
-+    get_mail_conf_str_table(first_str_defaults);
-+
-+    if (!msg_syslog_facility(var_syslog_facility))
-+	msg_fatal("file %s/%s: parameter %s: unrecognized value: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_SYSLOG_FACILITY, var_syslog_facility);
-+
-+    /*
-+     * What protocols should we attempt to support? The result is stored in
-+     * the global inet_proto_table variable.
-+     */
-+    proto_info = inet_proto_init(VAR_INET_PROTOCOLS, var_inet_protocols);
-+
-+    /*
-+     * Variables whose defaults are determined at runtime. Some sites use
-+     * short hostnames in the host table; some sites name their system after
-+     * the domain.
-+     */
-+    get_mail_conf_str_fn_table(function_str_defaults);
-+    if (!valid_hostname(var_myhostname, DO_GRIPE))
-+	msg_fatal("file %s/%s: parameter %s: bad parameter value: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MYHOSTNAME, var_myhostname);
-+    if (!valid_hostname(var_mydomain, DO_GRIPE))
-+	msg_fatal("file %s/%s: parameter %s: bad parameter value: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_MYDOMAIN, var_mydomain);
-+
-+    /*
-+     * Variables that are needed by almost every program.
-+     * 
-+     * XXX Reading the myorigin value from file is originally a Debian Linux
-+     * feature. This code is not enabled by default because of problems: 1)
-+     * it re-implements its own parameter syntax checks, and 2) it does not
-+     * implement $name expansions.
-+     */
-+    get_mail_conf_str_table(other_str_defaults);
-+#ifdef MYORIGIN_FROM_FILE
-+    if (*var_myorigin == '/') {
-+	char   *origin = read_param_from_file(var_myorigin);
-+
-+	if (*origin == 0)
-+	    msg_fatal("%s file %s is empty", VAR_MYORIGIN, var_myorigin);
-+	myfree(var_myorigin);			/* FIX 20070501 */
-+	var_myorigin = origin;
-+    }
-+#endif
-+    get_mail_conf_int_table(other_int_defaults);
-+    get_mail_conf_bool_table(bool_defaults);
-+    get_mail_conf_time_table(time_defaults);
-+    check_default_privs();
-+    check_mail_owner();
-+    check_sgid_group();
-+    check_overlap();
-+#ifdef HAS_DB
-+    dict_db_cache_size = var_db_read_buf;
-+#endif
-+    inet_windowsize = var_inet_windowsize;
-+
-+    /*
-+     * Variables whose defaults are determined at runtime, after other
-+     * variables have been set. This dependency is admittedly a bit tricky.
-+     * XXX Perhaps we should just register variables, and let the evaluator
-+     * figure out in what order to evaluate things.
-+     */
-+    get_mail_conf_str_fn_table(function_str_defaults_2);
-+
-+    /*
-+     * FIX 200412 The IPv6 patch did not call own_inet_addr_list() before
-+     * entering the chroot jail on Linux IPv6 systems. Linux has the IPv6
-+     * interface list in /proc, which is not available after chrooting.
-+     */
-+    (void) own_inet_addr_list();
-+
-+    /*
-+     * The PID variable cannot be set from the configuration file!!
-+     */
-+    set_mail_conf_int(VAR_PID, var_pid = getpid());
-+
-+    /*
-+     * Neither can the start time variable. It isn't even visible.
-+     */
-+    time(&var_starttime);
-+
-+    /*
-+     * Export the syslog name so children can inherit and use it before they
-+     * have initialized.
-+     */
-+    if ((cp = safe_getenv(CONF_ENV_LOGTAG)) == 0
-+	|| strcmp(cp, var_syslog_name) != 0)
-+	if (setenv(CONF_ENV_LOGTAG, var_syslog_name, 1) < 0)
-+	    msg_fatal("setenv %s %s: %m", CONF_ENV_LOGTAG, var_syslog_name);
-+
-+    /*
-+     * I have seen this happen just too often.
-+     */
-+    if (strcasecmp(var_myhostname, var_relayhost) == 0)
-+	msg_fatal("%s and %s parameter settings must not be identical: %s",
-+		  VAR_MYHOSTNAME, VAR_RELAYHOST, var_myhostname);
-+
-+    /*
-+     * XXX These should be caught by a proper parameter parsing algorithm.
-+     */
-+    if (var_myorigin[strcspn(var_myorigin, ", \t\r\n")])
-+	msg_fatal("%s parameter setting must not contain multiple values: %s",
-+		  VAR_MYORIGIN, var_myorigin);
-+
-+    if (var_relayhost[strcspn(var_relayhost, ", \t\r\n")])
-+	msg_fatal("%s parameter setting must not contain multiple values: %s",
-+		  VAR_RELAYHOST, var_relayhost);
-+
-+    /*
-+     * One more sanity check.
-+     */
-+    if ((cp = verp_delims_verify(var_verp_delims)) != 0)
-+	msg_fatal("file %s/%s: parameters %s and %s: %s",
-+		  var_config_dir, MAIN_CONF_FILE,
-+		  VAR_VERP_DELIMS, VAR_VERP_FILTER, cp);
-+}
-diff -ruN a/src/global/mkmap_open.c b/src/global/mkmap_open.c
---- a/src/global/mkmap_open.c	2009-06-01 12:27:44.000000000 +0000
-+++ b/src/global/mkmap_open.c	2009-06-01 13:08:26.000000000 +0000
-@@ -81,7 +81,7 @@
-   * We use a different table (in dict_open.c) when querying maps.
-   */
- typedef struct {
--    char   *type;
-+    const char   *type;
-     MKMAP  *(*before_open) (const char *);
- } MKMAP_OPEN_INFO;
- 
-@@ -156,7 +156,16 @@
-      */
-     for (mp = mkmap_types; /* void */ ; mp++) {
- 	if (mp->type == 0)
-+#ifndef NO_DYNAMIC_MAPS
-+	{
-+	    static MKMAP_OPEN_INFO oi;
-+	    oi.before_open=(MKMAP*(*)(const char*))dict_mkmap_func(type);
-+	    oi.type=type;
-+	    mp=&oi;
-+	}
-+#else
- 	    msg_fatal("unsupported map type: %s", type);
-+#endif
- 	if (strcmp(type, mp->type) == 0)
- 	    break;
-     }
-diff -ruN a/src/master/Makefile.in b/src/master/Makefile.in
---- a/src/master/Makefile.in	2009-06-01 12:27:44.000000000 +0000
-+++ b/src/master/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -20,7 +20,7 @@
- INC_DIR	= ../../include
- BIN_DIR	= ../../libexec
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) `for i in $(LIB_OBJ); do [ $$i = $@ ] && echo -fPIC; done` $(CFLAGS) -c $*.c
- 
- all:	$(PROG) $(LIB)
- 
-@@ -39,12 +39,10 @@
- root_tests:
- 
- $(LIB):	$(LIB_OBJ)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	gcc -shared -Wl,-soname,libpostfix-master.so.1 -o $(LIB) $(LIB_OBJ) $(LIBS) $(SYSLIBS)
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)/$(LIB)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
- $(BIN_DIR)/$(PROG): $(PROG)
- 	 cp $(PROG) $(BIN_DIR)
-diff -ruN a/src/milter/Makefile.in b/src/milter/Makefile.in
---- a/src/milter/Makefile.in	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/milter/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -14,7 +14,7 @@
- INC_DIR	= ../../include
- MAKES	=
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
- 
- all: $(LIB)
- 
-@@ -30,12 +30,10 @@
- root_tests:
- 
- $(LIB):	$(OBJS)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	 gcc -shared -Wl,-soname,libpostfix-milter.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
- update: $(LIB_DIR)/$(LIB) $(HDRS)
- 	-for i in $(HDRS); \
-diff -ruN a/src/postconf/postconf.c b/src/postconf/postconf.c
---- a/src/postconf/postconf.c	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/postconf/postconf.c	2009-06-01 13:08:26.000000000 +0000
-@@ -962,6 +962,16 @@
- {
-     ARGV   *maps_argv;
-     int     i;
-+#ifndef NO_DYNAMIC_MAPS
-+    char   *path;
-+    char   *config_dir;
-+
-+    var_config_dir = mystrdup((config_dir = safe_getenv(CONF_ENV_PATH)) != 0 ?
-+			      config_dir : DEF_CONFIG_DIR);	/* XXX */
-+    path = concatenate(var_config_dir, "/", "dynamicmaps.cf", (char *) 0);
-+    dict_open_dlinfo(path);
-+    myfree(path);
-+#endif
- 
-     maps_argv = dict_mapnames();
-     for (i = 0; i < maps_argv->argc; i++)
-diff -ruN a/src/postconf/postconf.c.orig b/src/postconf/postconf.c.orig
---- a/src/postconf/postconf.c.orig	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/postconf/postconf.c.orig	2009-06-01 13:07:57.000000000 +0000
-@@ -0,0 +1,1218 @@
-+/*++
-+/* NAME
-+/*	postconf 1
-+/* SUMMARY
-+/*	Postfix configuration utility
-+/* SYNOPSIS
-+/* .fi
-+/*	\fBpostconf\fR [\fB-dhnv\fR] [\fB-c \fIconfig_dir\fR]
-+/*	[\fIparameter ...\fR]
-+/*
-+/*	\fBpostconf\fR [\fB-aAmlv\fR] [\fB-c \fIconfig_dir\fR]
-+/*
-+/*	\fBpostconf\fR [\fB-ev\fR] [\fB-c \fIconfig_dir\fR]
-+/*	[\fIparameter=value ...\fR]
-+/*
-+/*	\fBpostconf\fR [\fB-#v\fR] [\fB-c \fIconfig_dir\fR]
-+/*	[\fIparameter ...\fR]
-+/*
-+/*	\fBpostconf\fR [\fB-btv\fR] [\fB-c \fIconfig_dir\fR] [\fItemplate_file\fR]
-+/* DESCRIPTION
-+/*	The \fBpostconf\fR(1) command displays the actual values
-+/*	of configuration parameters, changes configuration parameter
-+/*	values, or displays other configuration information about
-+/*	the Postfix mail system.
-+/*
-+/*	Options:
-+/* .IP \fB-a\fR
-+/*	List the available SASL server plug-in types.  The SASL
-+/*	plug-in type is selected with the \fBsmtpd_sasl_type\fR
-+/*	configuration parameter by specifying one of the names
-+/*	listed below.
-+/* .RS
-+/* .IP \fBcyrus\fR
-+/*	This server plug-in is available when Postfix is built with
-+/*	Cyrus SASL support.
-+/* .IP \fBdovecot\fR
-+/*	This server plug-in uses the Dovecot authentication server,
-+/*	and is available when Postfix is built with any form of SASL
-+/*	support.
-+/* .RE
-+/* .IP
-+/*	This feature is available with Postfix 2.3 and later.
-+/* .IP \fB-A\fR
-+/*	List the available SASL client plug-in types.  The SASL
-+/*	plug-in type is selected with the \fBsmtp_sasl_type\fR or
-+/*	\fBlmtp_sasl_type\fR configuration parameters by specifying
-+/*	one of the names listed below.
-+/* .RS
-+/* .IP \fBcyrus\fR
-+/*	This client plug-in is available when Postfix is built with
-+/*	Cyrus SASL support.
-+/* .RE
-+/* .IP
-+/*	This feature is available with Postfix 2.3 and later.
-+/* .IP "\fB-b\fR [\fItemplate_file\fR]"
-+/*	Display the message text that appears at the beginning of
-+/*	delivery status notification (DSN) messages, with $\fBname\fR
-+/*	expressions replaced by actual values.  To override the
-+/*	built-in message text, specify a template file at the end
-+/*	of the command line, or specify a template file in main.cf
-+/*	with the \fBbounce_template_file\fR parameter.
-+/*	To force selection of the built-in message text templates,
-+/*	specify an empty template file name (in shell language: "").
-+/*
-+/*	This feature is available with Postfix 2.3 and later.
-+/* .IP "\fB-c \fIconfig_dir\fR"
-+/*	The \fBmain.cf\fR configuration file is in the named directory
-+/*	instead of the default configuration directory.
-+/* .IP \fB-d\fR
-+/*	Print default parameter settings instead of actual settings.
-+/* .IP \fB-e\fR
-+/*	Edit the \fBmain.cf\fR configuration file. The file is copied
-+/*	to a temporary file then renamed into place. Parameters and
-+/*	values are specified on the command line. Use quotes in order
-+/*	to protect shell metacharacters and whitespace.
-+/* .IP \fB-h\fR
-+/*	Show parameter values only, not the ``name = '' label
-+/*	that normally precedes the value.
-+/* .IP \fB-l\fR
-+/*	List the names of all supported mailbox locking methods.
-+/*	Postfix supports the following methods:
-+/* .RS
-+/* .IP \fBflock\fR
-+/*	A kernel-based advisory locking method for local files only.
-+/*	This locking method is available on systems with a BSD
-+/*	compatible library.
-+/* .IP \fBfcntl\fR
-+/*	A kernel-based advisory locking method for local and remote files.
-+/* .IP \fBdotlock\fR
-+/*	An application-level locking method. An application locks a file
-+/*	named \fIfilename\fR by creating a file named \fIfilename\fB.lock\fR.
-+/*	The application is expected to remove its own lock file, as well as
-+/*	stale lock files that were left behind after abnormal termination.
-+/* .RE
-+/* .IP \fB-m\fR
-+/*	List the names of all supported lookup table types. In Postfix
-+/*	configuration files,
-+/*	lookup tables are specified as \fItype\fB:\fIname\fR, where
-+/*	\fItype\fR is one of the types listed below. The table \fIname\fR
-+/*	syntax depends on the lookup table type as described in the
-+/*	DATABASE_README document.
-+/* .RS
-+/* .IP \fBbtree\fR
-+/*	A sorted, balanced tree structure.
-+/*	This is available on systems with support for Berkeley DB
-+/*	databases.
-+/* .IP \fBcdb\fR
-+/*	A read-optimized structure with no support for incremental updates.
-+/*	This is available on systems with support for CDB databases.
-+/* .IP \fBcidr\fR
-+/*	A table that associates values with Classless Inter-Domain Routing
-+/*	(CIDR) patterns. This is described in \fBcidr_table\fR(5).
-+/* .IP \fBdbm\fR
-+/*	An indexed file type based on hashing.
-+/*	This is available on systems with support for DBM databases.
-+/* .IP \fBenviron\fR
-+/*	The UNIX process environment array. The lookup key is the variable
-+/*	name. Originally implemented for testing, someone may find this
-+/*	useful someday.
-+/* .IP \fBhash\fR
-+/*	An indexed file type based on hashing.
-+/*	This is available on systems with support for Berkeley DB
-+/*	databases.
-+/* .IP "\fBldap\fR (read-only)"
-+/*	Perform lookups using the LDAP protocol. This is described
-+/*	in \fBldap_table\fR(5).
-+/* .IP "\fBmysql\fR (read-only)"
-+/*	Perform lookups using the MYSQL protocol. This is described
-+/*	in \fBmysql_table\fR(5).
-+/* .IP "\fBpcre\fR (read-only)"
-+/*	A lookup table based on Perl Compatible Regular Expressions. The
-+/*	file format is described in \fBpcre_table\fR(5).
-+/* .IP "\fBpgsql\fR (read-only)"
-+/*	Perform lookups using the PostgreSQL protocol. This is described
-+/*	in \fBpgsql_table\fR(5).
-+/* .IP "\fBproxy\fR (read-only)"
-+/*	A lookup table that is implemented via the Postfix
-+/*	\fBproxymap\fR(8) service. The table name syntax is
-+/*	\fItype\fB:\fIname\fR.
-+/* .IP "\fBregexp\fR (read-only)"
-+/*	A lookup table based on regular expressions. The file format is
-+/*	described in \fBregexp_table\fR(5).
-+/* .IP \fBsdbm\fR
-+/*	An indexed file type based on hashing.
-+/*	This is available on systems with support for SDBM databases.
-+/* .IP "\fBstatic\fR (read-only)"
-+/*	A table that always returns its name as lookup result. For example,
-+/*	\fBstatic:foobar\fR always returns the string \fBfoobar\fR as lookup
-+/*	result.
-+/* .IP "\fBtcp\fR (read-only)"
-+/*	Perform lookups using a simple request-reply protocol that is
-+/*	described in \fBtcp_table\fR(5).
-+/*	This feature is not included with the stable Postfix release.
-+/* .IP "\fBunix\fR (read-only)"
-+/*	A limited way to query the UNIX authentication database. The
-+/*	following tables are implemented:
-+/* .RS
-+/*. IP \fBunix:passwd.byname\fR
-+/*	The table is the UNIX password database. The key is a login name.
-+/*	The result is a password file entry in \fBpasswd\fR(5) format.
-+/* .IP \fBunix:group.byname\fR
-+/*	The table is the UNIX group database. The key is a group name.
-+/*	The result is a group file entry in \fBgroup\fR(5) format.
-+/* .RE
-+/* .RE
-+/* .IP
-+/*	Other table types may exist depending on how Postfix was built.
-+/* .IP \fB-n\fR
-+/*	Print parameter settings that are not left at their built-in
-+/*	default value, because they are explicitly specified in main.cf.
-+/* .IP "\fB-t\fR [\fItemplate_file\fR]"
-+/*	Display the templates for delivery status notification (DSN)
-+/*	messages. To override the built-in templates, specify a
-+/*	template file at the end of the command line, or specify a
-+/*	template file in main.cf with the \fBbounce_template_file\fR
-+/*	parameter.  To force selection of the built-in templates,
-+/*	specify an empty template file name (in shell language:
-+/*	"").
-+/*
-+/*	This feature is available with Postfix 2.3 and later.
-+/* .IP \fB-v\fR
-+/*	Enable verbose logging for debugging purposes. Multiple \fB-v\fR
-+/*	options make the software increasingly verbose.
-+/* .IP \fB-#\fR
-+/*	Edit the \fBmain.cf\fR configuration file. The file is copied
-+/*	to a temporary file then renamed into place. The parameters
-+/*	specified on the command line are commented-out, so that they
-+/*	revert to their default values. Specify a list of parameter
-+/*	names, not name=value pairs.  There is no \fBpostconf\fR command
-+/*	to perform the reverse operation.
-+/*
-+/*	This feature is available with Postfix 2.6 and later.
-+/* DIAGNOSTICS
-+/*	Problems are reported to the standard error stream.
-+/* ENVIRONMENT
-+/* .ad
-+/* .fi
-+/* .IP \fBMAIL_CONFIG\fR
-+/*	Directory with Postfix configuration files.
-+/* CONFIGURATION PARAMETERS
-+/* .ad
-+/* .fi
-+/*	The following \fBmain.cf\fR parameters are especially relevant to
-+/*	this program.
-+/*
-+/*	The text below provides only a parameter summary. See
-+/*	\fBpostconf\fR(5) for more details including examples.
-+/* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
-+/*	The default location of the Postfix main.cf and master.cf
-+/*	configuration files.
-+/* .IP "\fBbounce_template_file (empty)\fR"
-+/*	Pathname of a configuration file with bounce message templates.
-+/* FILES
-+/*	/etc/postfix/main.cf, Postfix configuration parameters
-+/* SEE ALSO
-+/*	bounce(5), bounce template file format
-+/*	postconf(5), configuration parameters
-+/* README FILES
-+/* .ad
-+/* .fi
-+/*	Use "\fBpostconf readme_directory\fR" or
-+/*	"\fBpostconf html_directory\fR" to locate this information.
-+/* .na
-+/* .nf
-+/*	DATABASE_README, Postfix lookup table overview
-+/* LICENSE
-+/* .ad
-+/* .fi
-+/*	The Secure Mailer license must be distributed with this software.
-+/* AUTHOR(S)
-+/*	Wietse Venema
-+/*	IBM T.J. Watson Research
-+/*	P.O. Box 704
-+/*	Yorktown Heights, NY 10598, USA
-+/*--*/
-+
-+/* System library. */
-+
-+#include <sys_defs.h>
-+#include <sys/stat.h>
-+#include <stdio.h>			/* rename() */
-+#include <pwd.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <unistd.h>
-+#include <ctype.h>
-+
-+#ifdef USE_PATHS_H
-+#include <paths.h>
-+#endif
-+
-+/* Utility library. */
-+
-+#include <msg.h>
-+#include <vstream.h>
-+#include <msg_vstream.h>
-+#include <get_hostname.h>
-+#include <stringops.h>
-+#include <htable.h>
-+#include <dict.h>
-+#include <safe.h>
-+#include <mymalloc.h>
-+#include <argv.h>
-+#include <split_at.h>
-+#include <vstring_vstream.h>
-+#include <myflock.h>
-+#include <inet_proto.h>
-+#include <argv.h>
-+#include <edit_file.h>
-+
-+/* Global library. */
-+
-+#include <mynetworks.h>
-+#include <mail_conf.h>
-+#include <mail_dict.h>
-+#include <mail_proto.h>
-+#include <mail_version.h>
-+#include <mail_params.h>
-+#include <mail_addr.h>
-+#include <mbox_conf.h>
-+#include <mail_run.h>
-+
-+/* XSASL library. */
-+
-+#include <xsasl.h>
-+
-+ /*
-+  * What we're supposed to be doing.
-+  */
-+#define SHOW_NONDEF	(1<<0)		/* show non-default settings */
-+#define SHOW_DEFS	(1<<1)		/* show default setting */
-+#define SHOW_NAME	(1<<2)		/* show parameter name */
-+#define SHOW_MAPS	(1<<3)		/* show map types */
-+#define EDIT_MAIN	(1<<4)		/* edit main.cf */
-+#define SHOW_LOCKS	(1<<5)		/* show mailbox lock methods */
-+#define SHOW_EVAL	(1<<6)		/* expand right-hand sides */
-+#define SHOW_SASL_SERV	(1<<7)		/* show server auth plugin types */
-+#define SHOW_SASL_CLNT	(1<<8)		/* show client auth plugin types */
-+#define COMMENT_OUT	(1<<9)		/* #-out selected main.cf entries */
-+
-+ /*
-+  * Lookup table for in-core parameter info.
-+  */
-+HTABLE *param_table;
-+
-+ /*
-+  * Lookup table for external parameter info.
-+  */
-+DICT   *text_table;
-+
-+ /*
-+  * Declarations generated by scanning actual C source files.
-+  */
-+#include "time_vars.h"
-+#include "bool_vars.h"
-+#include "int_vars.h"
-+#include "str_vars.h"
-+#include "raw_vars.h"
-+#include "nint_vars.h"
-+
-+ /*
-+  * Manually extracted.
-+  */
-+#include "auto_vars.h"
-+#include "install_vars.h"
-+
-+ /*
-+  * Lookup tables generated by scanning actual C source files.
-+  */
-+static const CONFIG_TIME_TABLE time_table[] = {
-+#include "time_table.h"
-+    0,
-+};
-+
-+static const CONFIG_BOOL_TABLE bool_table[] = {
-+#include "bool_table.h"
-+    0,
-+};
-+
-+static const CONFIG_INT_TABLE int_table[] = {
-+#include "int_table.h"
-+    0,
-+};
-+
-+static const CONFIG_STR_TABLE str_table[] = {
-+#include "str_table.h"
-+#include "auto_table.h"			/* XXX */
-+#include "install_table.h"
-+    0,
-+};
-+
-+static const CONFIG_RAW_TABLE raw_table[] = {
-+#include "raw_table.h"
-+    0,
-+};
-+
-+static const CONFIG_NINT_TABLE nint_table[] = {
-+#include "nint_table.h"
-+    0,
-+};
-+
-+ /*
-+  * Parameters with default values obtained via function calls.
-+  */
-+char   *var_myhostname;
-+char   *var_mydomain;
-+char   *var_mynetworks;
-+
-+static const char *check_myhostname(void);
-+static const char *check_mydomainname(void);
-+static const char *check_mynetworks(void);
-+
-+static const CONFIG_STR_FN_TABLE str_fn_table[] = {
-+    VAR_MYHOSTNAME, check_myhostname, &var_myhostname, 1, 0,
-+    VAR_MYDOMAIN, check_mydomainname, &var_mydomain, 1, 0,
-+    0,
-+};
-+static const CONFIG_STR_FN_TABLE str_fn_table_2[] = {
-+    VAR_MYNETWORKS, check_mynetworks, &var_mynetworks, 1, 0,
-+    0,
-+};
-+
-+ /*
-+  * XXX Global so that call-backs can see it.
-+  */
-+static int cmd_mode = SHOW_NAME;
-+
-+/* check_myhostname - lookup hostname and validate */
-+
-+static const char *check_myhostname(void)
-+{
-+    static const char *name;
-+    const char *dot;
-+    const char *domain;
-+
-+    /*
-+     * Use cached result.
-+     */
-+    if (name)
-+	return (name);
-+
-+    /*
-+     * If the local machine name is not in FQDN form, try to append the
-+     * contents of $mydomain.
-+     */
-+    name = get_hostname();
-+    if ((dot = strchr(name, '.')) == 0) {
-+	if ((domain = mail_conf_lookup_eval(VAR_MYDOMAIN)) == 0)
-+	    domain = DEF_MYDOMAIN;
-+	name = concatenate(name, ".", domain, (char *) 0);
-+    }
-+    return (name);
-+}
-+
-+/* get_myhostname - look up and store my hostname */
-+
-+static void get_myhostname(void)
-+{
-+    const char *name;
-+
-+    if ((name = mail_conf_lookup_eval(VAR_MYHOSTNAME)) == 0)
-+	name = check_myhostname();
-+    var_myhostname = mystrdup(name);
-+}
-+
-+/* check_mydomainname - lookup domain name and validate */
-+
-+static const char *check_mydomainname(void)
-+{
-+    char   *dot;
-+
-+    /*
-+     * Use the hostname when it is not a FQDN ("foo"), or when the hostname
-+     * actually is a domain name ("foo.com").
-+     */
-+    if (var_myhostname == 0)
-+	get_myhostname();
-+    if ((dot = strchr(var_myhostname, '.')) == 0 || strchr(dot + 1, '.') == 0)
-+	return (DEF_MYDOMAIN);
-+    return (dot + 1);
-+}
-+
-+/* check_mynetworks - lookup network address list */
-+
-+static const char *check_mynetworks(void)
-+{
-+    INET_PROTO_INFO *proto_info;
-+    const char *junk;
-+
-+    if (var_inet_interfaces == 0) {
-+	if ((cmd_mode & SHOW_DEFS)
-+	    || (junk = mail_conf_lookup_eval(VAR_INET_INTERFACES)) == 0)
-+	    junk = DEF_INET_INTERFACES;
-+	var_inet_interfaces = mystrdup(junk);
-+    }
-+    if (var_mynetworks_style == 0) {
-+	if ((cmd_mode & SHOW_DEFS)
-+	    || (junk = mail_conf_lookup_eval(VAR_MYNETWORKS_STYLE)) == 0)
-+	    junk = DEF_MYNETWORKS_STYLE;
-+	var_mynetworks_style = mystrdup(junk);
-+    }
-+    if (var_inet_protocols == 0) {
-+	if ((cmd_mode & SHOW_DEFS)
-+	    || (junk = mail_conf_lookup_eval(VAR_INET_PROTOCOLS)) == 0)
-+	    junk = DEF_INET_PROTOCOLS;
-+	var_inet_protocols = mystrdup(junk);
-+	proto_info = inet_proto_init(VAR_INET_PROTOCOLS, var_inet_protocols);
-+    }
-+    return (mynetworks());
-+}
-+
-+/* edit_parameters - edit parameter file */
-+
-+static void edit_parameters(int cmd_mode, int argc, char **argv)
-+{
-+    char   *config_dir;
-+    char   *path;
-+    EDIT_FILE *ep;
-+    VSTREAM *src;
-+    VSTREAM *dst;
-+    VSTRING *buf = vstring_alloc(100);
-+    VSTRING *key = vstring_alloc(10);
-+    char   *cp;
-+    char   *edit_key;
-+    char   *edit_val;
-+    HTABLE *table;
-+    struct cvalue {
-+	char   *value;
-+	int     found;
-+    };
-+    struct cvalue *cvalue;
-+    HTABLE_INFO **ht_info;
-+    HTABLE_INFO **ht;
-+    int     interesting;
-+    const char *err;
-+
-+    /*
-+     * Store command-line parameters for quick lookup.
-+     */
-+    table = htable_create(argc);
-+    while ((cp = *argv++) != 0) {
-+	if (strchr(cp, '\n') != 0)
-+	    msg_fatal("-e or -# accepts no multi-line input");
-+	while (ISSPACE(*cp))
-+	    cp++;
-+	if (*cp == '#')
-+	    msg_fatal("-e or -# accepts no comment input");
-+	if (cmd_mode & EDIT_MAIN) {
-+	    if ((err = split_nameval(cp, &edit_key, &edit_val)) != 0)
-+		msg_fatal("%s: \"%s\"", err, cp);
-+	} else if (cmd_mode & COMMENT_OUT) {
-+	    if (*cp == 0)
-+		msg_fatal("-# requires non-blank parameter names");
-+	    if (strchr(cp, '=') != 0)
-+		msg_fatal("-# requires parameter names only");
-+	    edit_key = mystrdup(cp);
-+	    trimblanks(edit_key, 0);
-+	    edit_val = 0;
-+	} else {
-+	    msg_panic("edit_parameters: unknown mode %d", cmd_mode);
-+	}
-+	cvalue = (struct cvalue *) mymalloc(sizeof(*cvalue));
-+	cvalue->value = edit_val;
-+	cvalue->found = 0;
-+	htable_enter(table, edit_key, (char *) cvalue);
-+    }
-+
-+    /*
-+     * XXX Avoid code duplication by better code decomposition.
-+     */
-+    if (var_config_dir)
-+	myfree(var_config_dir);
-+    var_config_dir = mystrdup((config_dir = safe_getenv(CONF_ENV_PATH)) != 0 ?
-+			      config_dir : DEF_CONFIG_DIR);	/* XXX */
-+    set_mail_conf_str(VAR_CONFIG_DIR, var_config_dir);
-+
-+    /*
-+     * Open a temp file for the result. This uses a deterministic name so we
-+     * don't leave behind thrash with random names.
-+     */
-+    path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
-+    if ((ep = edit_file_open(path, O_CREAT | O_WRONLY, 0644)) == 0)
-+	msg_fatal("open %s%s: %m", path, EDIT_FILE_SUFFIX);
-+    dst = ep->tmp_fp;
-+
-+    /*
-+     * Open the original file for input.
-+     */
-+    if ((src = vstream_fopen(path, O_RDONLY, 0)) == 0) {
-+	/* OK to delete, since we control the temp file name exclusively. */
-+	(void) unlink(ep->tmp_path);
-+	msg_fatal("open %s for reading: %m", path);
-+    }
-+
-+    /*
-+     * Copy original file to temp file, while replacing parameters on the
-+     * fly. Issue warnings for names found multiple times.
-+     */
-+#define STR(x) vstring_str(x)
-+
-+    interesting = 0;
-+    while (vstring_get(buf, src) != VSTREAM_EOF) {
-+	for (cp = STR(buf); ISSPACE(*cp) /* including newline */ ; cp++)
-+	     /* void */ ;
-+	/* Copy comment, all-whitespace, or empty line. */
-+	if (*cp == '#' || *cp == 0) {
-+	    vstream_fputs(STR(buf), dst);
-+	}
-+	/* Copy, skip or replace continued text. */
-+	else if (cp > STR(buf)) {
-+	    if (interesting == 0)
-+		vstream_fputs(STR(buf), dst);
-+	    else if (cmd_mode & COMMENT_OUT)
-+		vstream_fprintf(dst, "#%s", STR(buf));
-+	}
-+	/* Copy or replace start of logical line. */
-+	else {
-+	    vstring_strncpy(key, cp, strcspn(cp, " \t\r\n="));
-+	    cvalue = (struct cvalue *) htable_find(table, STR(key));
-+	    if ((interesting = !!cvalue) != 0) {
-+		if (cvalue->found++ == 1)
-+		    msg_warn("%s: multiple entries for \"%s\"", path, STR(key));
-+		if (cmd_mode & EDIT_MAIN)
-+		    vstream_fprintf(dst, "%s = %s\n", STR(key), cvalue->value);
-+		else if (cmd_mode & COMMENT_OUT)
-+		    vstream_fprintf(dst, "#%s", cp);
-+		else
-+		    msg_panic("edit_parameters: unknown mode %d", cmd_mode);
-+	    } else {
-+		vstream_fputs(STR(buf), dst);
-+	    }
-+	}
-+    }
-+
-+    /*
-+     * Generate new entries for parameters that were not found.
-+     */
-+    if (cmd_mode & EDIT_MAIN) {
-+	for (ht_info = ht = htable_list(table); *ht; ht++) {
-+	    cvalue = (struct cvalue *) ht[0]->value;
-+	    if (cvalue->found == 0)
-+		vstream_fprintf(dst, "%s = %s\n", ht[0]->key, cvalue->value);
-+	}
-+	myfree((char *) ht_info);
-+    }
-+
-+    /*
-+     * When all is well, rename the temp file to the original one.
-+     */
-+    if (vstream_fclose(src))
-+	msg_fatal("read %s: %m", path);
-+    if (edit_file_close(ep) != 0)
-+	msg_fatal("close %s%s: %m", path, EDIT_FILE_SUFFIX);
-+
-+    /*
-+     * Cleanup.
-+     */
-+    myfree(path);
-+    vstring_free(buf);
-+    vstring_free(key);
-+    htable_free(table, myfree);
-+}
-+
-+/* read_parameters - read parameter info from file */
-+
-+static void read_parameters(void)
-+{
-+    char   *config_dir;
-+    char   *path;
-+
-+    /*
-+     * A direct rip-off of mail_conf_read(). XXX Avoid code duplication by
-+     * better code decomposition.
-+     */
-+    dict_unknown_allowed = 1;
-+    if (var_config_dir)
-+	myfree(var_config_dir);
-+    var_config_dir = mystrdup((config_dir = safe_getenv(CONF_ENV_PATH)) != 0 ?
-+			      config_dir : DEF_CONFIG_DIR);	/* XXX */
-+    set_mail_conf_str(VAR_CONFIG_DIR, var_config_dir);
-+    path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
-+    dict_load_file(CONFIG_DICT, path);
-+    myfree(path);
-+}
-+
-+/* set_parameters - set parameter values from default or explicit setting */
-+
-+static void set_parameters(void)
-+{
-+
-+    /*
-+     * Populate the configuration parameter dictionary with default settings
-+     * or with actual settings.
-+     * 
-+     * Iterate over each entry in str_fn_table, str_fn_table_2, time_table,
-+     * bool_table, int_table, str_table, and raw_table. Look up each
-+     * parameter name in the configuration parameter dictionary. If the
-+     * parameter is not set, take the default value, or take the value from
-+     * main.cf, without doing $name expansions. This includes converting
-+     * default values from numeric/boolean internal forms to external string
-+     * form.
-+     * 
-+     * Once the configuration parameter dictionary is populated, printing a
-+     * parameter setting is a matter of querying the configuration parameter
-+     * dictionary, optionally expanding of $name values, and printing the
-+     * result.
-+     */
-+}
-+
-+/* hash_parameters - hash all parameter names so we can find and sort them */
-+
-+static void hash_parameters(void)
-+{
-+    const CONFIG_TIME_TABLE *ctt;
-+    const CONFIG_BOOL_TABLE *cbt;
-+    const CONFIG_INT_TABLE *cit;
-+    const CONFIG_STR_TABLE *cst;
-+    const CONFIG_STR_FN_TABLE *csft;
-+    const CONFIG_RAW_TABLE *rst;
-+    const CONFIG_NINT_TABLE *nst;
-+
-+    param_table = htable_create(100);
-+
-+    for (ctt = time_table; ctt->name; ctt++)
-+	htable_enter(param_table, ctt->name, (char *) ctt);
-+    for (cbt = bool_table; cbt->name; cbt++)
-+	htable_enter(param_table, cbt->name, (char *) cbt);
-+    for (cit = int_table; cit->name; cit++)
-+	htable_enter(param_table, cit->name, (char *) cit);
-+    for (cst = str_table; cst->name; cst++)
-+	htable_enter(param_table, cst->name, (char *) cst);
-+    for (csft = str_fn_table; csft->name; csft++)
-+	htable_enter(param_table, csft->name, (char *) csft);
-+    for (csft = str_fn_table_2; csft->name; csft++)
-+	htable_enter(param_table, csft->name, (char *) csft);
-+    for (rst = raw_table; rst->name; rst++)
-+	htable_enter(param_table, rst->name, (char *) rst);
-+    for (nst = nint_table; nst->name; nst++)
-+	htable_enter(param_table, nst->name, (char *) nst);
-+}
-+
-+/* show_strval - show string-valued parameter */
-+
-+static void show_strval(int mode, const char *name, const char *value)
-+{
-+    if (mode & SHOW_EVAL)
-+	value = mail_conf_eval(value);
-+
-+    if (mode & SHOW_NAME) {
-+	vstream_printf("%s = %s\n", name, value);
-+    } else {
-+	vstream_printf("%s\n", value);
-+    }
-+}
-+
-+/* show_intval - show integer-valued parameter */
-+
-+static void show_intval(int mode, const char *name, int value)
-+{
-+    if (mode & SHOW_NAME) {
-+	vstream_printf("%s = %d\n", name, value);
-+    } else {
-+	vstream_printf("%d\n", value);
-+    }
-+}
-+
-+/* print_bool - print boolean parameter */
-+
-+static void print_bool(int mode, CONFIG_BOOL_TABLE *cbt)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, cbt->name, cbt->defval ? "yes" : "no");
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, cbt->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, cbt->name, cbt->defval ? "yes" : "no");
-+	    } else {
-+		show_strval(mode, cbt->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, cbt->name, value);
-+	}
-+    }
-+}
-+
-+/* print_time - print relative time parameter */
-+
-+static void print_time(int mode, CONFIG_TIME_TABLE *ctt)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, ctt->name, ctt->defval);
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, ctt->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, ctt->name, ctt->defval);
-+	    } else {
-+		show_strval(mode, ctt->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, ctt->name, value);
-+	}
-+    }
-+}
-+
-+/* print_int - print integer parameter */
-+
-+static void print_int(int mode, CONFIG_INT_TABLE *cit)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_intval(mode, cit->name, cit->defval);
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, cit->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_intval(mode, cit->name, cit->defval);
-+	    } else {
-+		show_strval(mode, cit->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, cit->name, value);
-+	}
-+    }
-+}
-+
-+/* print_str - print string parameter */
-+
-+static void print_str(int mode, CONFIG_STR_TABLE *cst)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, cst->name, cst->defval);
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, cst->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, cst->name, cst->defval);
-+	    } else {
-+		show_strval(mode, cst->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, cst->name, value);
-+	}
-+    }
-+}
-+
-+/* print_str_fn - print string-function parameter */
-+
-+static void print_str_fn(int mode, CONFIG_STR_FN_TABLE *csft)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, csft->name, csft->defval());
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, csft->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, csft->name, csft->defval());
-+	    } else {
-+		show_strval(mode, csft->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, csft->name, value);
-+	}
-+    }
-+}
-+
-+/* print_str_fn_2 - print string-function parameter */
-+
-+static void print_str_fn_2(int mode, CONFIG_STR_FN_TABLE *csft)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, csft->name, csft->defval());
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, csft->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, csft->name, csft->defval());
-+	    } else {
-+		show_strval(mode, csft->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, csft->name, value);
-+	}
-+    }
-+}
-+
-+/* print_raw - print raw string parameter */
-+
-+static void print_raw(int mode, CONFIG_RAW_TABLE * rst)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_EVAL)
-+	msg_warn("parameter %s expands at run-time", rst->name);
-+    mode &= ~SHOW_EVAL;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, rst->name, rst->defval);
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, rst->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, rst->name, rst->defval);
-+	    } else {
-+		show_strval(mode, rst->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, rst->name, value);
-+	}
-+    }
-+}
-+
-+/* print_nint - print new integer parameter */
-+
-+static void print_nint(int mode, CONFIG_NINT_TABLE * rst)
-+{
-+    const char *value;
-+
-+    if (mode & SHOW_EVAL)
-+	msg_warn("parameter %s expands at run-time", rst->name);
-+    mode &= ~SHOW_EVAL;
-+
-+    if (mode & SHOW_DEFS) {
-+	show_strval(mode, rst->name, rst->defval);
-+    } else {
-+	value = dict_lookup(CONFIG_DICT, rst->name);
-+	if ((mode & SHOW_NONDEF) == 0) {
-+	    if (value == 0) {
-+		show_strval(mode, rst->name, rst->defval);
-+	    } else {
-+		show_strval(mode, rst->name, value);
-+	    }
-+	} else {
-+	    if (value != 0)
-+		show_strval(mode, rst->name, value);
-+	}
-+    }
-+}
-+
-+/* print_parameter - show specific parameter */
-+
-+static void print_parameter(int mode, char *ptr)
-+{
-+
-+#define INSIDE(p,t) (ptr >= (char *) t && ptr < ((char *) t) + sizeof(t))
-+
-+    /*
-+     * This is gross, but the best we can do on short notice.
-+     */
-+    if (INSIDE(ptr, time_table))
-+	print_time(mode, (CONFIG_TIME_TABLE *) ptr);
-+    if (INSIDE(ptr, bool_table))
-+	print_bool(mode, (CONFIG_BOOL_TABLE *) ptr);
-+    if (INSIDE(ptr, int_table))
-+	print_int(mode, (CONFIG_INT_TABLE *) ptr);
-+    if (INSIDE(ptr, str_table))
-+	print_str(mode, (CONFIG_STR_TABLE *) ptr);
-+    if (INSIDE(ptr, str_fn_table))
-+	print_str_fn(mode, (CONFIG_STR_FN_TABLE *) ptr);
-+    if (INSIDE(ptr, str_fn_table_2))
-+	print_str_fn_2(mode, (CONFIG_STR_FN_TABLE *) ptr);
-+    if (INSIDE(ptr, raw_table))
-+	print_raw(mode, (CONFIG_RAW_TABLE *) ptr);
-+    if (INSIDE(ptr, nint_table))
-+	print_nint(mode, (CONFIG_NINT_TABLE *) ptr);
-+    if (msg_verbose)
-+	vstream_fflush(VSTREAM_OUT);
-+}
-+
-+/* comp_names - qsort helper */
-+
-+static int comp_names(const void *a, const void *b)
-+{
-+    HTABLE_INFO **ap = (HTABLE_INFO **) a;
-+    HTABLE_INFO **bp = (HTABLE_INFO **) b;
-+
-+    return (strcmp(ap[0]->key, bp[0]->key));
-+}
-+
-+/* show_maps - show available maps */
-+
-+static void show_maps(void)
-+{
-+    ARGV   *maps_argv;
-+    int     i;
-+
-+    maps_argv = dict_mapnames();
-+    for (i = 0; i < maps_argv->argc; i++)
-+	vstream_printf("%s\n", maps_argv->argv[i]);
-+    argv_free(maps_argv);
-+}
-+
-+/* show_locks - show available mailbox locking methods */
-+
-+static void show_locks(void)
-+{
-+    ARGV   *locks_argv;
-+    int     i;
-+
-+    locks_argv = mbox_lock_names();
-+    for (i = 0; i < locks_argv->argc; i++)
-+	vstream_printf("%s\n", locks_argv->argv[i]);
-+    argv_free(locks_argv);
-+}
-+
-+/* show_sasl - show SASL plug-in types */
-+
-+static void show_sasl(int what)
-+{
-+    ARGV   *sasl_argv;
-+    int     i;
-+
-+    sasl_argv = (what & SHOW_SASL_SERV) ? xsasl_server_types() :
-+	xsasl_client_types();
-+    for (i = 0; i < sasl_argv->argc; i++)
-+	vstream_printf("%s\n", sasl_argv->argv[i]);
-+    argv_free(sasl_argv);
-+}
-+
-+/* show_parameters - show parameter info */
-+
-+static void show_parameters(int mode, char **names)
-+{
-+    HTABLE_INFO **list;
-+    HTABLE_INFO **ht;
-+    char  **namep;
-+    char   *value;
-+
-+    /*
-+     * Show all parameters.
-+     */
-+    if (*names == 0) {
-+	list = htable_list(param_table);
-+	qsort((char *) list, param_table->used, sizeof(*list), comp_names);
-+	for (ht = list; *ht; ht++)
-+	    print_parameter(mode, ht[0]->value);
-+	myfree((char *) list);
-+	return;
-+    }
-+
-+    /*
-+     * Show named parameters.
-+     */
-+    for (namep = names; *namep; namep++) {
-+	if ((value = htable_find(param_table, *namep)) == 0) {
-+	    msg_warn("%s: unknown parameter", *namep);
-+	} else {
-+	    print_parameter(mode, value);
-+	}
-+    }
-+}
-+
-+MAIL_VERSION_STAMP_DECLARE;
-+
-+/* main */
-+
-+int     main(int argc, char **argv)
-+{
-+    int     ch;
-+    int     fd;
-+    struct stat st;
-+    int     junk;
-+    ARGV   *ext_argv = 0;
-+
-+    /*
-+     * Fingerprint executables and core dumps.
-+     */
-+    MAIL_VERSION_STAMP_ALLOCATE;
-+
-+    /*
-+     * Be consistent with file permissions.
-+     */
-+    umask(022);
-+
-+    /*
-+     * To minimize confusion, make sure that the standard file descriptors
-+     * are open before opening anything else. XXX Work around for 44BSD where
-+     * fstat can return EBADF on an open file descriptor.
-+     */
-+    for (fd = 0; fd < 3; fd++)
-+	if (fstat(fd, &st) == -1
-+	    && (close(fd), open("/dev/null", O_RDWR, 0)) != fd)
-+	    msg_fatal("open /dev/null: %m");
-+
-+    /*
-+     * Set up logging.
-+     */
-+    msg_vstream_init(argv[0], VSTREAM_ERR);
-+
-+    /*
-+     * Parse JCL.
-+     */
-+    while ((ch = GETOPT(argc, argv, "aAbc:deE#hmlntv")) > 0) {
-+	switch (ch) {
-+	case 'a':
-+	    cmd_mode |= SHOW_SASL_SERV;
-+	    break;
-+	case 'A':
-+	    cmd_mode |= SHOW_SASL_CLNT;
-+	    break;
-+	case 'b':
-+	    if (ext_argv)
-+		msg_fatal("specify one of -b and -t");
-+	    ext_argv = argv_alloc(2);
-+	    argv_add(ext_argv, "bounce", "-SVnexpand_templates", (char *) 0);
-+	    break;
-+	case 'c':
-+	    if (setenv(CONF_ENV_PATH, optarg, 1) < 0)
-+		msg_fatal("out of memory");
-+	    break;
-+	case 'd':
-+	    cmd_mode |= SHOW_DEFS;
-+	    break;
-+	case 'e':
-+	    cmd_mode |= EDIT_MAIN;
-+	    break;
-+
-+	    /*
-+	     * People, this does not work unless you properly handle default
-+	     * settings. For example, fast_flush_domains = $relay_domains
-+	     * must not evaluate to the empty string when relay_domains is
-+	     * left at its default setting of $mydestination.
-+	     */
-+#if 0
-+	case 'E':
-+	    cmd_mode |= SHOW_EVAL;
-+	    break;
-+#endif
-+	case '#':
-+	    cmd_mode = COMMENT_OUT;
-+	    break;
-+
-+	case 'h':
-+	    cmd_mode &= ~SHOW_NAME;
-+	    break;
-+	case 'l':
-+	    cmd_mode |= SHOW_LOCKS;
-+	    break;
-+	case 'm':
-+	    cmd_mode |= SHOW_MAPS;
-+	    break;
-+	case 'n':
-+	    cmd_mode |= SHOW_NONDEF;
-+	    break;
-+	case 't':
-+	    if (ext_argv)
-+		msg_fatal("specify one of -b and -t");
-+	    ext_argv = argv_alloc(2);
-+	    argv_add(ext_argv, "bounce", "-SVndump_templates", (char *) 0);
-+	    break;
-+	case 'v':
-+	    msg_verbose++;
-+	    break;
-+	default:
-+	    msg_fatal("usage: %s [-a (server SASL types)] [-A (client SASL types)] [-b (bounce templates)] [-c config_dir] [-d (defaults)] [-e (edit)] [-# (comment-out)] [-h (no names)] [-l (lock types)] [-m (map types)] [-n (non-defaults)] [-v] [name...]", argv[0]);
-+	}
-+    }
-+
-+    /*
-+     * Sanity check.
-+     */
-+    junk = (cmd_mode & (SHOW_DEFS | SHOW_NONDEF | SHOW_MAPS | SHOW_LOCKS | EDIT_MAIN | SHOW_SASL_SERV | SHOW_SASL_CLNT | COMMENT_OUT));
-+    if (junk != 0 && ((junk != SHOW_DEFS && junk != SHOW_NONDEF
-+	     && junk != SHOW_MAPS && junk != SHOW_LOCKS && junk != EDIT_MAIN
-+		       && junk != SHOW_SASL_SERV && junk != SHOW_SASL_CLNT
-+		       && junk != COMMENT_OUT)
-+		      || ext_argv != 0))
-+	msg_fatal("specify one of -a, -A, -b, -d, -e, -#, -m, -l and -n");
-+
-+    /*
-+     * Display bounce template information and exit.
-+     */
-+    if (ext_argv) {
-+	if (argv[optind]) {
-+	    if (argv[optind + 1])
-+		msg_fatal("options -b and -t require at most one template file");
-+	    argv_add(ext_argv, "-o",
-+		     concatenate(VAR_BOUNCE_TMPL, "=",
-+				 argv[optind], (char *) 0),
-+		     (char *) 0);
-+	}
-+	/* Grr... */
-+	argv_add(ext_argv, "-o",
-+		 concatenate(VAR_QUEUE_DIR, "=", ".", (char *) 0),
-+		 (char *) 0);
-+	mail_conf_read();
-+	mail_run_replace(var_daemon_dir, ext_argv->argv);
-+	/* NOTREACHED */
-+    }
-+
-+    /*
-+     * If showing map types, show them and exit
-+     */
-+    if (cmd_mode & SHOW_MAPS) {
-+	mail_dict_init();
-+	show_maps();
-+    }
-+
-+    /*
-+     * If showing locking methods, show them and exit
-+     */
-+    else if (cmd_mode & SHOW_LOCKS) {
-+	show_locks();
-+    }
-+
-+    /*
-+     * If showing SASL plug-in types, show them and exit
-+     */
-+    else if (cmd_mode & SHOW_SASL_SERV) {
-+	show_sasl(SHOW_SASL_SERV);
-+    } else if (cmd_mode & SHOW_SASL_CLNT) {
-+	show_sasl(SHOW_SASL_CLNT);
-+    }
-+
-+    /*
-+     * Edit main.cf.
-+     */
-+    else if (cmd_mode & (EDIT_MAIN | COMMENT_OUT)) {
-+	edit_parameters(cmd_mode, argc - optind, argv + optind);
-+    }
-+
-+    /*
-+     * If showing non-default values, read main.cf.
-+     */
-+    else {
-+	if ((cmd_mode & SHOW_DEFS) == 0) {
-+	    read_parameters();
-+	    set_parameters();
-+	}
-+
-+	/*
-+	 * Throw together all parameters and show the asked values.
-+	 */
-+	hash_parameters();
-+	show_parameters(cmd_mode, argv + optind);
-+    }
-+    vstream_fflush(VSTREAM_OUT);
-+    exit(0);
-+}
-diff -ruN a/src/postmap/postmap.c b/src/postmap/postmap.c
---- a/src/postmap/postmap.c	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/postmap/postmap.c	2009-06-01 13:08:26.000000000 +0000
-@@ -5,7 +5,7 @@
- /*	Postfix lookup table management
- /* SYNOPSIS
- /* .fi
--/*	\fBpostmap\fR [\fB-Nbfhimnoprsvw\fR] [\fB-c \fIconfig_dir\fR]
-+/*	\fBpostmap\fR [\fB-Nbfhimnoprsuvw\fR] [\fB-c \fIconfig_dir\fR]
- /*	[\fB-d \fIkey\fR] [\fB-q \fIkey\fR]
- /*		[\fIfile_type\fR:]\fIfile_name\fR ...
- /* DESCRIPTION
-@@ -151,6 +151,8 @@
- /* .sp
- /*	This feature is available in Postfix version 2.2 and later,
- /*	and is not available for all database types.
-+/* .IP \fB-u\fR
-+/*     Upgrade the database to the current version.
- /* .IP \fB-v\fR
- /*	Enable verbose logging for debugging purposes. Multiple \fB-v\fR
- /*	options make the software increasingly verbose.
-@@ -723,6 +725,18 @@
-     dict_close(dict);
- }
- 
-+/* postmap_upgrade - upgrade a map */
-+
-+static int postmap_upgrade(const char *map_type, const char *map_name)
-+{
-+    DICT   *dict;
-+
-+    dict = dict_open3(map_type, map_name, O_RDWR,
-+                       DICT_FLAG_LOCK|DICT_FLAG_UPGRADE);
-+    dict_close(dict);
-+    return (dict != 0);
-+}
-+
- /* usage - explain */
- 
- static NORETURN usage(char *myname)
-@@ -743,6 +757,7 @@
-     int     postmap_flags = POSTMAP_FLAG_AS_OWNER | POSTMAP_FLAG_SAVE_PERM;
-     int     open_flags = O_RDWR | O_CREAT | O_TRUNC;
-     int     dict_flags = DICT_FLAG_DUP_WARN | DICT_FLAG_FOLD_FIX;
-+    int     upgrade = 0;
-     char   *query = 0;
-     char   *delkey = 0;
-     int     sequence = 0;
-@@ -787,7 +802,7 @@
-     /*
-      * Parse JCL.
-      */
--    while ((ch = GETOPT(argc, argv, "Nbc:d:fhimnopq:rsvw")) > 0) {
-+    while ((ch = GETOPT(argc, argv, "Nbc:d:fhimnopq:rsuvw")) > 0) {
- 	switch (ch) {
- 	default:
- 	    usage(argv[0]);
-@@ -804,8 +819,8 @@
- 		msg_fatal("out of memory");
- 	    break;
- 	case 'd':
--	    if (sequence || query || delkey)
--		msg_fatal("specify only one of -s -q or -d");
-+	    if (sequence || query || delkey || upgrade)
-+		msg_fatal("specify only one of -s -q -u or -d");
- 	    delkey = optarg;
- 	    break;
- 	case 'f':
-@@ -831,8 +846,8 @@
- 	    postmap_flags &= ~POSTMAP_FLAG_SAVE_PERM;
- 	    break;
- 	case 'q':
--	    if (sequence || query || delkey)
--		msg_fatal("specify only one of -s -q or -d");
-+	    if (sequence || query || delkey || upgrade)
-+		msg_fatal("specify only one of -s -q -u or -d");
- 	    query = optarg;
- 	    break;
- 	case 'r':
-@@ -840,10 +855,15 @@
- 	    dict_flags |= DICT_FLAG_DUP_REPLACE;
- 	    break;
- 	case 's':
--	    if (query || delkey)
--		msg_fatal("specify only one of -s or -q or -d");
-+	    if (query || delkey || upgrade)
-+		msg_fatal("specify only one of -s or -q or -u or -d");
- 	    sequence = 1;
- 	    break;
-+       case 'u':
-+           if (sequence || query || delkey || upgrade)
-+               msg_fatal("specify only one of -s -q -u or -d");
-+           upgrade=1;
-+           break;
- 	case 'v':
- 	    msg_verbose++;
- 	    break;
-@@ -914,6 +934,21 @@
- 	    exit(0);
- 	}
- 	exit(1);
-+    } else if (upgrade) {                      /* Upgrade the map(s) */
-+       int success = 1;
-+       if (optind + 1 > argc)
-+           usage(argv[0]);
-+       while (optind < argc) {
-+           if ((path_name = split_at(argv[optind], ':')) != 0) {
-+               success &= postmap_upgrade(argv[optind], path_name);
-+           } else {
-+               success &= postmap_upgrade(var_db_type, path_name);
-+           }
-+           if (!success)
-+               exit(1);
-+           optind++;
-+       }
-+       exit(0);
-     } else {					/* create/update map(s) */
- 	if (optind + 1 > argc)
- 	    usage(argv[0]);
-diff -ruN a/src/tls/Makefile.in b/src/tls/Makefile.in
---- a/src/tls/Makefile.in	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/tls/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -22,7 +22,7 @@
- INC_DIR	= ../../include
- MAKES	=
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
- 
- all: $(LIB)
- 
-@@ -38,12 +38,10 @@
- root_tests:
- 
- $(LIB):	$(OBJS)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	gcc -shared -Wl,-soname,libpostfix-tls.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
- update: $(LIB_DIR)/$(LIB) $(HDRS)
- 	-for i in $(HDRS); \
-diff -ruN a/src/util/Makefile.in b/src/util/Makefile.in
---- a/src/util/Makefile.in	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/util/Makefile.in	2009-06-01 13:08:26.000000000 +0000
-@@ -31,21 +31,23 @@
- 	vstream_popen.c vstring.c vstring_vstream.c watchdog.c writable.c \
- 	write_buf.c write_wait.c sane_basename.c format_tv.c allspace.c \
- 	allascii.c load_file.c killme_after.c vstream_tweak.c upass_connect.c \
--	upass_listen.c upass_trigger.c edit_file.c inet_windowsize.c
-+	upass_listen.c upass_trigger.c edit_file.c inet_windowsize.c \
-+	load_lib.c
- OBJS	= alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \
- 	attr_print64.o attr_print_plain.o attr_scan0.o attr_scan64.o \
- 	attr_scan_plain.o auto_clnt.o base64_code.o basename.o binhash.o \
- 	chroot_uid.o cidr_match.o clean_env.o close_on_exec.o concatenate.o \
- 	ctable.o dict.o dict_alloc.o dict_cdb.o dict_cidr.o dict_db.o \
- 	dict_dbm.o dict_debug.o dict_env.o dict_ht.o dict_ni.o dict_nis.o \
--	dict_nisplus.o dict_open.o dict_pcre.o dict_regexp.o dict_sdbm.o \
--	dict_static.o dict_tcp.o dict_unix.o dir_forest.o doze.o dummy_read.o \
-+	dict_nisplus.o dict_open.o dict_regexp.o \
-+	dict_static.o dict_unix.o dir_forest.o doze.o dummy_read.o \
- 	dummy_write.o duplex_pipe.o environ.o events.o exec_command.o \
- 	fifo_listen.o fifo_trigger.o file_limit.o find_inet.o fsspace.o \
- 	fullname.o get_domainname.o get_hostname.o hex_code.o hex_quote.o \
- 	host_port.o htable.o inet_addr_host.o inet_addr_list.o \
- 	inet_addr_local.o inet_connect.o inet_listen.o inet_proto.o \
- 	inet_trigger.o line_wrap.o lowercase.o lstat_as.o mac_expand.o \
-+	load_lib.o \
- 	mac_parse.o make_dirs.o mask_addr.o match_list.o match_ops.o msg.o \
- 	msg_output.o msg_syslog.o msg_vstream.o mvect.o myaddrinfo.o myflock.o \
- 	mymalloc.o myrand.o mystrtok.o name_code.o name_mask.o netstring.o \
-@@ -78,7 +80,7 @@
- 	msg_output.h msg_syslog.h msg_vstream.h mvect.h myaddrinfo.h myflock.h \
- 	mymalloc.h myrand.h name_code.h name_mask.h netstring.h nvtable.h \
- 	open_as.h open_lock.h percentm.h posix_signals.h readlline.h ring.h \
--	safe.h safe_open.h sane_accept.h sane_connect.h sane_fsops.h \
-+	safe.h safe_open.h sane_accept.h sane_connect.h sane_fsops.h load_lib.h \
- 	sane_socketpair.h sane_time.h scan_dir.h set_eugid.h set_ugid.h \
- 	sigdelay.h sock_addr.h spawn_command.h split_at.h stat_as.h \
- 	stringops.h sys_defs.h timed_connect.h timed_wait.h trigger.h \
-@@ -91,6 +93,7 @@
- CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
- FILES	= Makefile $(SRCS) $(HDRS)
- INCL	=
-+PCRESO  = dict_pcre.so
- LIB	= libutil.a
- TESTPROG= dict_open dup2_pass_on_exec events exec_command fifo_open \
- 	fifo_rdonly_bug fifo_rdwr_bug fifo_trigger fsspace fullname \
-@@ -105,10 +108,11 @@
- 
- LIB_DIR	= ../../lib
- INC_DIR	= ../../include
-+LIBS    = $(LIB_DIR)/$(LIB) $(PCRESO)
- 
--.c.o:;	$(CC) $(CFLAGS) -c $*.c
-+.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
- 
--all: $(LIB)
-+all: $(LIB) $(PCRESO)
- 
- $(OBJS): ../../conf/makedefs.out
- 
-@@ -117,15 +121,19 @@
- 
- test:	$(TESTPROG)
- 
-+$(PCRESO): dict_pcre.o libutil.a
-+	gcc -shared -Wl,-soname,dict_pcre.so -o $@ $? -lpcre -L. -lutil
-+
- $(LIB):	$(OBJS)
--	$(AR) $(ARFL) $(LIB) $?
--	$(RANLIB) $(LIB)
-+	gcc -shared -Wl,-soname,libpostfix-util.so.1 -o $(LIB) $(OBJS) -ldl $(SYSLIBS)
- 
- $(LIB_DIR)/$(LIB): $(LIB)
- 	cp $(LIB) $(LIB_DIR)
--	$(RANLIB) $(LIB_DIR)/$(LIB)
- 
--update: $(LIB_DIR)/$(LIB) $(HDRS)
-+../../libexec/$(PCRESO): $(PCRESO)
-+	cp $(PCRESO) ../../libexec
-+
-+update: $(LIBS) ../../libexec/$(PCRESO) $(HDRS)
- 	-for i in $(HDRS); \
- 	do \
- 	  cmp -s $$i $(INC_DIR)/$$i 2>/dev/null || cp $$i $(INC_DIR); \
-@@ -147,7 +155,8 @@
- 	lint $(SRCS)
- 
- clean:
--	rm -f *.o $(LIB) *core $(TESTPROG) junk $(MAKES) *.tmp
-+	rm -f *.o $(LIB) $(PCRESO) *core $(TESTPROG) \
-+		junk $(MAKES) *.tmp
- 	rm -rf printfck
- 
- tidy:	clean
-diff -ruN a/src/util/dict.h b/src/util/dict.h
---- a/src/util/dict.h	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/util/dict.h	2009-06-01 13:08:26.000000000 +0000
-@@ -66,6 +66,7 @@
- #define DICT_FLAG_NO_UNAUTH	(1<<13)	/* disallow unauthenticated data */
- #define DICT_FLAG_FOLD_FIX	(1<<14)	/* case-fold key with fixed-case map */
- #define DICT_FLAG_FOLD_MUL	(1<<15)	/* case-fold key with multi-case map */
-+#define DICT_FLAG_UPGRADE	(1<<30) /* Upgrade the db */
- #define DICT_FLAG_FOLD_ANY	(DICT_FLAG_FOLD_FIX | DICT_FLAG_FOLD_MUL)
- 
-  /* IMPORTANT: Update the dict_mask[] table when the above changes */
-@@ -138,6 +139,11 @@
- extern DICT *dict_open(const char *, int, int);
- extern DICT *dict_open3(const char *, const char *, int, int);
- extern void dict_open_register(const char *, DICT *(*) (const char *, int, int));
-+#ifndef NO_DYNAMIC_MAPS
-+extern void dict_open_dlinfo(const char *path);
-+typedef void* (*dict_mkmap_func_t)(const char *);
-+dict_mkmap_func_t dict_mkmap_func(const char *dict_type);
-+#endif
- 
- #define dict_get(dp, key)	((const char *) (dp)->lookup((dp), (key)))
- #define dict_put(dp, key, val)	(dp)->update((dp), (key), (val))
-diff -ruN a/src/util/dict_db.c b/src/util/dict_db.c
---- a/src/util/dict_db.c	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/util/dict_db.c	2009-06-01 13:08:26.000000000 +0000
-@@ -664,6 +664,12 @@
- 	msg_fatal("set DB cache size %d: %m", dict_db_cache_size);
-     if (type == DB_HASH && db->set_h_nelem(db, DICT_DB_NELM) != 0)
- 	msg_fatal("set DB hash element count %d: %m", DICT_DB_NELM);
-+    if (dict_flags & DICT_FLAG_UPGRADE) {
-+	if (msg_verbose)
-+	    msg_info("upgrading database %s",db_path);
-+	if ((errno = db->upgrade(db,db_path,0)) != 0)
-+	    msg_fatal("upgrade of database %s: %m",db_path);
-+    }
- #if (DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR > 0)
-     if ((errno = db->open(db, 0, db_path, 0, type, db_flags, 0644)) != 0)
- 	msg_fatal("open database %s: %m", db_path);
-diff -ruN a/src/util/dict_dbm.c b/src/util/dict_dbm.c
---- a/src/util/dict_dbm.c	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/util/dict_dbm.c	2009-06-01 13:08:26.000000000 +0000
-@@ -407,6 +407,10 @@
-     char   *dbm_path;
-     int     lock_fd;
- 
-+#ifdef HAVE_GDBM
-+    msg_fatal("%s: gdbm maps use locking that is incompatible with postfix.  Use a hash map instead.",
-+		 path);
-+#endif
-     /*
-      * Note: DICT_FLAG_LOCK is used only by programs that do fine-grained (in
-      * the time domain) locking while accessing individual database records.
-diff -ruN a/src/util/dict_open.c b/src/util/dict_open.c
---- a/src/util/dict_open.c	2009-06-01 12:27:45.000000000 +0000
-+++ b/src/util/dict_open.c	2009-06-01 13:08:26.000000000 +0000
-@@ -44,6 +44,8 @@
- /*	DICT	*(*open) (const char *, int, int);
- /*
- /*	ARGV	*dict_mapnames()
-+/*
-+/*	void (*)() dict_mkmap_func(const char *dict_type)
- /* DESCRIPTION
- /*	This module implements a low-level interface to multiple
- /*	physical dictionary types.
-@@ -159,6 +161,9 @@
- /*
- /*	dict_mapnames() returns a sorted list with the names of all available
- /*	dictionary types.
-+/*
-+/*	dict_mkmap_func() returns a pointer to the mkmap setup function
-+/*	for the given map type, as given in /etc/dynamicmaps.cf
- /* DIAGNOSTICS
- /*	Fatal error: open error, unsupported dictionary type, attempt to
- /*	update non-writable dictionary.
-@@ -183,6 +188,9 @@
- #include <strings.h>
- #endif
- 
-+#include <sys/stat.h>
-+#include <unistd.h>
-+
- /* Utility library. */
- 
- #include <argv.h>
-@@ -207,6 +215,27 @@
- #include <split_at.h>
- #include <htable.h>
- 
-+#ifndef NO_DYNAMIC_MAPS
-+#include <load_lib.h>
-+#include <vstring.h>
-+#include <vstream.h>
-+#include <vstring_vstream.h>
-+#include <mvect.h>
-+
-+ /*
-+  * Interface for dynamic map loading.
-+  */
-+typedef struct {
-+    const char  *pattern;
-+    const char  *soname;
-+    const char  *openfunc;
-+    const char  *mkmapfunc;
-+} DLINFO;
-+
-+static DLINFO *dict_dlinfo;
-+static DLINFO *dict_open_dlfind(const char *type);
-+#endif
-+
-  /*
-   * lookup table for available map types.
-   */
-@@ -221,9 +250,11 @@
- #endif
-     DICT_TYPE_ENVIRON, dict_env_open,
-     DICT_TYPE_UNIX, dict_unix_open,
-+#ifdef NO_DYNAMIC_MAPS
- #ifdef SNAPSHOT
-     DICT_TYPE_TCP, dict_tcp_open,
- #endif
-+#endif
- #ifdef HAS_SDBM
-     DICT_TYPE_SDBM, dict_sdbm_open,
- #endif
-@@ -243,9 +274,11 @@
- #ifdef HAS_NETINFO
-     DICT_TYPE_NETINFO, dict_ni_open,
- #endif
-+#ifdef NO_DYNAMIC_MAPS
- #ifdef HAS_PCRE
-     DICT_TYPE_PCRE, dict_pcre_open,
- #endif
-+#endif /* NO_DYNAMIC_MAPS */
- #ifdef HAS_POSIX_REGEXP
-     DICT_TYPE_REGEXP, dict_regexp_open,
- #endif
-@@ -303,8 +336,31 @@
- 		  dict_type, dict_name);
-     if (dict_open_hash == 0)
- 	dict_open_init();
--    if ((dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type)) == 0)
--	msg_fatal("unsupported dictionary type: %s", dict_type);
-+    if ((dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type)) == 0) {
-+#ifdef NO_DYNAMIC_MAPS
-+	msg_fatal("%s: unsupported dictionary type: %s", myname, dict_type);
-+#else
-+	struct stat st;
-+	LIB_FN fn[2];
-+	DICT *(*open) (const char *, int, int);
-+	DLINFO *dl=dict_open_dlfind(dict_type);
-+	if (!dl)
-+	    msg_fatal("%s: unsupported dictionary type: %s:  Is the postfix-%s package installed?", myname, dict_type, dict_type);
-+	if (stat(dl->soname,&st) < 0) {
-+	    msg_fatal("%s: unsupported dictionary type: %s (%s not found.  Is the postfix-%s package installed?)",
-+		myname, dict_type, dl->soname, dict_type);
-+	}
-+	fn[0].name = dl->openfunc;
-+	fn[0].ptr  = (void**)&open;
-+	fn[1].name = NULL;
-+	load_library_symbols(dl->soname, fn, NULL);
-+	dict_open_register(dict_type, open);
-+	dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type);
-+#endif
-+    }
-+    if (msg_verbose>1) {
-+	msg_info("%s: calling %s open routine",myname,dict_type);
-+    }
-     if ((dict = dp->open(dict_name, open_flags, dict_flags)) == 0)
- 	msg_fatal("opening %s:%s %m", dict_type, dict_name);
-     if (msg_verbose)
-@@ -312,6 +368,36 @@
-     return (dict);
- }
- 
-+dict_mkmap_func_t dict_mkmap_func(const char *dict_type)
-+{
-+    char   *myname="dict_mkmap_func";
-+    struct stat st;
-+    LIB_FN fn[2];
-+    dict_mkmap_func_t mkmap;
-+    DLINFO *dl;
-+#ifndef NO_DYNAMIC_MAPS
-+    if (!dict_dlinfo)
-+	msg_fatal("dlinfo==NULL");
-+    dl=dict_open_dlfind(dict_type);
-+    if (!dl)
-+	msg_fatal("%s: unsupported dictionary type: %s:  Is the postfix-%s package installed?", myname, dict_type, dict_type);
-+    if (stat(dl->soname,&st) < 0) {
-+	msg_fatal("%s: unsupported dictionary type: %s (%s not found.  Is the postfix-%s package installed?)",
-+	    myname, dict_type, dl->soname, dict_type);
-+    }
-+    if (!dl->mkmapfunc)
-+	msg_fatal("%s: unsupported dictionary type: %s does not allow map creation.", myname, dict_type);
-+
-+    fn[0].name = dl->mkmapfunc;
-+    fn[0].ptr  = (void**)&mkmap;
-+    fn[1].name = NULL;
-+    load_library_symbols(dl->soname, fn, NULL);
-+    return mkmap;
-+#else
-+    return (void(*)())NULL;
-+#endif
-+}
-+
- /* dict_open_register - register dictionary type */
- 
- void    dict_open_register(const char *type,
-@@ -345,6 +431,9 @@
-     HTABLE_INFO **ht;
-     DICT_OPEN_INFO *dp;
-     ARGV   *mapnames;
-+#ifndef NO_DYNAMIC_MAPS
-+    DLINFO *dlp;
-+#endif
- 
-     if (dict_open_hash == 0)
- 	dict_open_init();
-@@ -353,6 +442,13 @@
- 	dp = (DICT_OPEN_INFO *) ht[0]->value;
- 	argv_add(mapnames, dp->type, ARGV_END);
-     }
-+#ifndef NO_DYNAMIC_MAPS
-+    if (!dict_dlinfo)
-+	msg_fatal("dlinfo==NULL");
-+    for (dlp=dict_dlinfo; dlp->pattern; dlp++) {
-+	argv_add(mapnames, dlp->pattern, ARGV_END);
-+    }
-+#endif
-     qsort((void *) mapnames->argv, mapnames->argc, sizeof(mapnames->argv[0]),
- 	  dict_sort_alpha_cpp);
-     myfree((char *) ht_info);
-@@ -360,6 +456,87 @@
-     return mapnames;
- }
- 
-+#ifndef NO_DYNAMIC_MAPS
-+#define	STREQ(x,y) (x == y || (x[0] == y[0] && strcmp(x,y) == 0))
-+
-+void dict_open_dlinfo(const char *path)
-+{
-+    char    *myname="dict_open_dlinfo";
-+    VSTREAM *conf_fp=vstream_fopen(path,O_RDONLY,0);
-+    VSTRING *buf = vstring_alloc(100);
-+    char    *cp;
-+    ARGV    *argv;
-+    MVECT    vector;
-+    int      nelm=0;
-+    int      linenum=0;
-+
-+    dict_dlinfo=(DLINFO*)mvect_alloc(&vector,sizeof(DLINFO),3,NULL,NULL);
-+
-+    if (!conf_fp) {
-+	msg_warn("%s: cannot open %s.  No dynamic maps will be allowed.",
-+		myname, path);
-+    } else {
-+	while (vstring_get_nonl(buf,conf_fp) != VSTREAM_EOF) {
-+	    cp = vstring_str(buf);
-+	    linenum++;
-+	    if (*cp == '#' || *cp == '\0')
-+		continue;
-+	    argv = argv_split(cp, " \t");
-+	    if (argv->argc != 3 && argv->argc != 4) {
-+		msg_fatal("%s: Expected \"pattern .so-name open-function [mkmap-function]\" at line %d",
-+			  myname, linenum);
-+	    }
-+	    if (STREQ(argv->argv[0],"*")) {
-+		msg_warn("%s: wildcard dynamic map entry no longer supported.",
-+			  myname);
-+		continue;
-+	    }
-+	    if (argv->argv[1][0] != '/') {
-+		msg_fatal("%s: .so name must begin with a \"/\" at line %d",
-+			  myname, linenum);
-+	    }
-+	    if (nelm >= vector.nelm) {
-+		dict_dlinfo=(DLINFO*)mvect_realloc(&vector,vector.nelm+3);
-+	    }
-+	    dict_dlinfo[nelm].pattern  = mystrdup(argv->argv[0]);
-+	    dict_dlinfo[nelm].soname   = mystrdup(argv->argv[1]);
-+	    dict_dlinfo[nelm].openfunc = mystrdup(argv->argv[2]);
-+	    if (argv->argc==4)
-+		dict_dlinfo[nelm].mkmapfunc = mystrdup(argv->argv[3]);
-+	    else
-+		dict_dlinfo[nelm].mkmapfunc = NULL;
-+	    nelm++;
-+	    argv_free(argv);
-+	}
-+    }
-+    if (nelm >= vector.nelm) {
-+	dict_dlinfo=(DLINFO*)mvect_realloc(&vector,vector.nelm+1);
-+    }
-+    dict_dlinfo[nelm].pattern  = NULL;
-+    dict_dlinfo[nelm].soname   = NULL;
-+    dict_dlinfo[nelm].openfunc = NULL;
-+    dict_dlinfo[nelm].mkmapfunc = NULL;
-+    if (conf_fp)
-+	vstream_fclose(conf_fp);
-+    vstring_free(buf);
-+}
-+
-+static DLINFO *dict_open_dlfind(const char *type)
-+{
-+    DLINFO *dp;
-+
-+    if (!dict_dlinfo)
-+	return NULL;
-+
-+    for (dp=dict_dlinfo; dp->pattern; dp++) {
-+	if (STREQ(dp->pattern,type))
-+	    return dp;
-+    }
-+    return NULL;
-+}
-+
-+#endif /* !NO_DYNAMIC_MAPS */
-+
- #ifdef TEST
- 
-  /*
-diff -ruN a/src/util/load_lib.c b/src/util/load_lib.c
---- a/src/util/load_lib.c	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/util/load_lib.c	2009-06-01 13:08:26.000000000 +0000
-@@ -0,0 +1,135 @@
-+/*++
-+/* NAME
-+/*	load_lib 3
-+/* SUMMARY
-+/*	library loading wrappers
-+/* SYNOPSIS
-+/*	#include <load_lib.h>
-+/*
-+/*	extern int  load_library_symbols(const char *, LIB_FN *, LIB_FN *);
-+/*	const char *libname;
-+/*      LIB_FN     *libfuncs;
-+/*      LIB_FN     *libdata;
-+/*
-+/* DESCRIPTION
-+/*	This module loads functions from libraries, returnine pointers
-+/*	to the named functions.
-+/*
-+/*	load_library_symbols() loads all of the desired functions, and
-+/*	returns zero for success, or exits via msg_fatal().
-+/*
-+/* SEE ALSO
-+/*	msg(3) diagnostics interface
-+/* DIAGNOSTICS
-+/*	Problems are reported via the msg(3) diagnostics routines:
-+/*	library not found, symbols not found, other fatal errors.
-+/* LICENSE
-+/* .ad
-+/* .fi
-+/*	The Secure Mailer license must be distributed with this software.
-+/* AUTHOR(S)
-+/*	LaMont Jones
-+/*	Hewlett-Packard Company
-+/*	3404 Harmony Road
-+/*	Fort Collins, CO 80528, USA
-+/*
-+/*	Wietse Venema
-+/*	IBM T.J. Watson Research
-+/*	P.O. Box 704
-+/*	Yorktown Heights, NY 10598, USA
-+/*--*/
-+
-+/* System libraries. */
-+
-+#include "sys_defs.h"
-+#include <stdlib.h>
-+#include <stddef.h>
-+#include <string.h>
-+#if defined(HAS_DLOPEN)
-+#include <dlfcn.h>
-+#elif defined(HAS_SHL_LOAD)
-+#include <dl.h>
-+#endif
-+
-+/* Application-specific. */
-+
-+#include "msg.h"
-+#include "load_lib.h"
-+
-+extern int  load_library_symbols(const char * libname, LIB_FN * libfuncs, LIB_FN * libdata)
-+{
-+    char   *myname = "load_library_symbols";
-+    LIB_FN *fn;
-+
-+#if defined(HAS_DLOPEN)
-+    void   *handle;
-+    char   *emsg;
-+
-+    handle=dlopen(libname,RTLD_NOW);
-+    emsg=dlerror();
-+    if (emsg) {
-+	msg_fatal("%s: dlopen failure loading %s: %s", myname, libname, emsg);
-+    }
-+
-+    if (libfuncs) {
-+	for (fn=libfuncs; fn->name; fn++) {
-+	    *(fn->ptr) = dlsym(handle,fn->name);
-+	    emsg=dlerror();
-+	    if (emsg) {
-+		msg_fatal("%s: dlsym failure looking up %s in %s: %s", myname,
-+			  fn->name, libname, emsg);
-+	    }
-+	    if (msg_verbose>1) {
-+		msg_info("loaded %s = %lx",fn->name, *((long*)(fn->ptr)));
-+	    }
-+	}
-+    }
-+
-+    if (libdata) {
-+	for (fn=libdata; fn->name; fn++) {
-+	    *(fn->ptr) = dlsym(handle,fn->name);
-+	    emsg=dlerror();
-+	    if (emsg) {
-+		msg_fatal("%s: dlsym failure looking up %s in %s: %s", myname,
-+			  fn->name, libname, emsg);
-+	    }
-+	    if (msg_verbose>1) {
-+		msg_info("loaded %s = %lx",fn->name, *((long*)(fn->ptr)));
-+	    }
-+	}
-+    }
-+#elif defined(HAS_SHL_LOAD)
-+    shl_t   handle;
-+
-+    handle = shl_load(libname,BIND_IMMEDIATE,0);
-+
-+    if (libfuncs) {
-+	for (fn=libfuncs; fn->name; fn++) {
-+	    if (shl_findsym(&handle,fn->name,TYPE_PROCEDURE,fn->ptr) != 0) {
-+		msg_fatal("%s: shl_findsym failure looking up %s in %s: %m",
-+			  myname, fn->name, libname);
-+	    }
-+	    if (msg_verbose>1) {
-+		msg_info("loaded %s = %x",fn->name, *((long*)(fn->ptr)));
-+	    }
-+	}
-+    }
-+
-+    if (libdata) {
-+	for (fn=libdata; fn->name; fn++) {
-+	    if (shl_findsym(&handle,fn->name,TYPE_DATA,fn->ptr) != 0) {
-+		msg_fatal("%s: shl_findsym failure looking up %s in %s: %m",
-+			  myname, fn->name, libname);
-+	    }
-+	    if (msg_verbose>1) {
-+		msg_info("loaded %s = %x",fn->name, *((long*)(fn->ptr)));
-+	    }
-+	}
-+    }
-+
-+#else
-+    msg_fatal("%s: need dlopen or shl_load support for dynamic libraries",
-+		myname);
-+#endif
-+    return 0;
-+}
-diff -ruN a/src/util/load_lib.h b/src/util/load_lib.h
---- a/src/util/load_lib.h	1970-01-01 00:00:00.000000000 +0000
-+++ b/src/util/load_lib.h	2009-06-01 13:08:26.000000000 +0000
-@@ -0,0 +1,41 @@
-+#ifndef _LOAD_LIB_H_INCLUDED_
-+#define _LOAD_LIB_H_INCLUDED_
-+
-+/*++
-+/* NAME
-+/*	load_lib 3h
-+/* SUMMARY
-+/*	library loading wrappers
-+/* SYNOPSIS
-+/*	#include "load_lib.h"
-+/* DESCRIPTION
-+/* .nf
-+
-+ /*
-+  * External interface.
-+  */
-+/* NULL name terminates list */
-+typedef struct LIB_FN {
-+    const char *name;
-+    void       **ptr;
-+} LIB_FN;
-+
-+extern int  load_library_symbols(const char *, LIB_FN *, LIB_FN *);
-+
-+/* LICENSE
-+/* .ad
-+/* .fi
-+/*	The Secure Mailer license must be distributed with this software.
-+/* AUTHOR(S)
-+/*	LaMont Jones
-+/*	Hewlett-Packard Company
-+/*	3404 Harmony Road
-+/*	Fort Collins, CO 80528, USA
-+/*
-+/*	Wietse Venema
-+/*	IBM T.J. Watson Research
-+/*	P.O. Box 704
-+/*	Yorktown Heights, NY 10598, USA
-+/*--*/
-+
-+#endif
diff --git a/main/postfix/postfix-2.7.0-dynamic-maps.patch b/main/postfix/postfix-2.7.0-dynamic-maps.patch
new file mode 100644
index 00000000..da1c799b
--- /dev/null
+++ b/main/postfix/postfix-2.7.0-dynamic-maps.patch
@@ -0,0 +1,1064 @@
+commit 98599e6387147a26d8433e85a4a61ef5c4240e83
+Author: Natanael Copa <ncopa@alpinelinux.org>
+Date:   Mon May 31 14:49:38 2010 +0000
+
+    added dynamic maps
+
+diff --git a/conf/postfix-files b/conf/postfix-files
+index 7ff93ea..7cae109 100644
+--- a/conf/postfix-files
++++ b/conf/postfix-files
+@@ -65,6 +65,10 @@ $queue_directory/saved:d:$mail_owner:-:700:ucr
+ $queue_directory/trace:d:$mail_owner:-:700:ucr
+ $daemon_directory/anvil:f:root:-:755
+ $daemon_directory/bounce:f:root:-:755
++$daemon_directory/dict_ldap.so:f:root:-:755
++$daemon_directory/dict_pcre.so:f:root:-:755
++$daemon_directory/dict_mysql.so:f:root:-:755
++$daemon_directory/dict_pgsql.so:f:root:-:755
+ $daemon_directory/cleanup:f:root:-:755
+ $daemon_directory/discard:f:root:-:755
+ $daemon_directory/error:f:root:-:755
+@@ -94,6 +98,11 @@ $daemon_directory/tlsmgr:f:root:-:755
+ $daemon_directory/trivial-rewrite:f:root:-:755
+ $daemon_directory/verify:f:root:-:755
+ $daemon_directory/virtual:f:root:-:755
++/usr/lib/libpostfix-dns.so.1:f:root:-:755
++/usr/lib/libpostfix-global.so.1:f:root:-:755
++/usr/lib/libpostfix-tls.so.1:f:root:-:755
++/usr/lib/libpostfix-master.so.1:f:root:-:755
++/usr/lib/libpostfix-util.so.1:f:root:-:755
+ $daemon_directory/nqmgr:h:$daemon_directory/qmgr
+ $daemon_directory/lmtp:h:$daemon_directory/smtp
+ $command_directory/postalias:f:root:-:755
+@@ -117,6 +126,7 @@ $config_directory/access:f:root:-:644:p1
+ $config_directory/aliases:f:root:-:644:p1
+ $config_directory/bounce.cf.default:f:root:-:644:1
+ $config_directory/canonical:f:root:-:644:p1
++$config_directory/dynamicmaps.cf:f:root:-:644:p
+ $config_directory/cidr_table:f:root:-:644:o
+ $config_directory/generic:f:root:-:644:p1
+ $config_directory/generics:f:root:-:644:o
+diff --git a/src/dns/Makefile.in b/src/dns/Makefile.in
+index bbc5e98..f70cb96 100644
+--- a/src/dns/Makefile.in
++++ b/src/dns/Makefile.in
+@@ -14,7 +14,7 @@ LIBS	= ../../lib/libutil.a
+ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
+ 
+ all: $(LIB)
+ 
+@@ -31,12 +31,10 @@ tests:	test dns_rr_to_pa_test dns_rr_to_sa_test dns_sa_to_rr_test \
+ root_tests:
+ 
+ $(LIB):	$(OBJS)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	gcc -shared -Wl,-soname,libpostfix-dns.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+ update: $(LIB_DIR)/$(LIB) $(HDRS)
+ 	-for i in $(HDRS); \
+diff --git a/src/global/Makefile.in b/src/global/Makefile.in
+index 56c9b6c..b0c83d6 100644
+--- a/src/global/Makefile.in
++++ b/src/global/Makefile.in
+@@ -34,7 +34,7 @@ OBJS	= abounce.o anvil_clnt.o been_here.o bounce.o bounce_log.o \
+ 	canon_addr.o cfg_parser.o cleanup_strerror.o cleanup_strflags.o \
+ 	clnt_stream.o conv_time.o db_common.o debug_peer.o debug_process.o \
+ 	defer.o deliver_completed.o deliver_flock.o deliver_pass.o \
+-	deliver_request.o dict_ldap.o dict_mysql.o dict_pgsql.o \
++	deliver_request.o \
+ 	dict_proxy.o domain_list.o dot_lockfile.o dot_lockfile_as.o \
+ 	dsb_scan.o dsn.o dsn_buf.o dsn_mask.o dsn_print.o dsn_util.o \
+ 	ehlo_mask.o ext_prop.o file_id.o flush_clnt.o header_opts.o \
+@@ -104,10 +104,13 @@ LIBS	= ../../lib/libutil.a
+ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
+ MAKES	=
++LDAPSO  = dict_ldap.so
++MYSQLSO = dict_mysql.so
++PGSQLSO = dict_pgsql.so
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
+ 
+-all: $(LIB)
++all: $(LIB) $(LDAPSO) $(MYSQLSO) $(PGSQLSO) 
+ 
+ $(OBJS): ../../conf/makedefs.out
+ 
+@@ -117,14 +120,30 @@ Makefile: Makefile.in
+ test:	$(TESTPROG)
+ 
+ $(LIB):	$(OBJS)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	gcc -shared -Wl,-soname,libpostfix-global.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
++
++$(LDAPSO): dict_ldap.o $(LIB) ../../lib/libglobal.a
++	gcc -shared -Wl,-soname,dict_ldap.so -o $@ $? -lldap -llber -L../../lib -lutil -L. -lglobal
++
++$(MYSQLSO): dict_mysql.o $(LIB) ../../lib/libglobal.a
++	gcc -shared -Wl,-soname,dict_mysql.so -o $@ $? -lmysqlclient -L. -lutil -lglobal
++
++$(PGSQLSO): dict_pgsql.o $(LIB) ../../lib/libglobal.a
++	gcc -shared -Wl,-soname,dict_pgsql.so -o $@ $? -lpq -L. -lutil -lglobal
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+-update: $(LIB_DIR)/$(LIB) $(HDRS)
++../../libexec/$(LDAPSO): $(LDAPSO)
++	cp $(LDAPSO) ../../libexec
++
++../../libexec/$(MYSQLSO): $(MYSQLSO)
++	cp $(MYSQLSO) ../../libexec
++
++../../libexec/$(PGSQLSO): $(PGSQLSO)
++	cp $(PGSQLSO) ../../libexec
++
++update: $(LIB_DIR)/$(LIB) ../../libexec/$(LDAPSO) ../../libexec/$(MYSQLSO) ../../libexec/$(PGSQLSO) $(HDRS)
+ 	-for i in $(HDRS); \
+ 	do \
+ 	  cmp -s $$i $(INC_DIR)/$$i 2>/dev/null || cp $$i $(INC_DIR); \
+@@ -492,7 +511,7 @@ lint:
+ 	lint $(DEFS) $(SRCS) $(LINTFIX)
+ 
+ clean:
+-	rm -f *.o $(LIB) *core $(TESTPROG) junk
++	rm -f *.o $(LIB) $(LDAPSO) $(MYSQLSO) $(PGSQLSO) *core $(TESTPROG) junk
+ 	rm -rf printfck
+ 
+ tidy:	clean
+diff --git a/src/global/mail_conf.c b/src/global/mail_conf.c
+index c5d3d43..feb7d66 100644
+--- a/src/global/mail_conf.c
++++ b/src/global/mail_conf.c
+@@ -182,6 +182,13 @@ void    mail_conf_suck(void)
+     path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
+     dict_load_file(CONFIG_DICT, path);
+     myfree(path);
++
++#ifndef NO_DYNAMIC_MAPS
++    path = concatenate(var_config_dir, "/", "dynamicmaps.cf", (char *) 0);
++    dict_open_dlinfo(path);
++    myfree(path);
++#endif
++
+ }
+ 
+ /* mail_conf_flush - discard configuration dictionary */
+diff --git a/src/global/mail_dict.c b/src/global/mail_dict.c
+index 35ecffb..c1ff165 100644
+--- a/src/global/mail_dict.c
++++ b/src/global/mail_dict.c
+@@ -45,6 +45,7 @@ typedef struct {
+ 
+ static const DICT_OPEN_INFO dict_open_info[] = {
+     DICT_TYPE_PROXY, dict_proxy_open,
++#ifdef NO_DYNAMIC_MAPS
+ #ifdef HAS_LDAP
+     DICT_TYPE_LDAP, dict_ldap_open,
+ #endif
+@@ -54,6 +55,7 @@ static const DICT_OPEN_INFO dict_open_info[] = {
+ #ifdef HAS_PGSQL
+     DICT_TYPE_PGSQL, dict_pgsql_open,
+ #endif
++#endif /* NO_DYNAMIC_MAPS */
+     0,
+ };
+ 
+diff --git a/src/global/mail_params.c b/src/global/mail_params.c
+index f5350a1..1bbad7a 100644
+--- a/src/global/mail_params.c
++++ b/src/global/mail_params.c
+@@ -79,6 +79,7 @@
+ /*	char	*var_export_environ;
+ /*	char	*var_debug_peer_list;
+ /*	int	var_debug_peer_level;
++/*	int	var_command_maxtime;
+ /*	int	var_in_flow_delay;
+ /*	int	var_fault_inj_code;
+ /*	char   *var_bounce_service;
+@@ -265,6 +266,7 @@ char   *var_import_environ;
+ char   *var_export_environ;
+ char   *var_debug_peer_list;
+ int     var_debug_peer_level;
++int	var_command_maxtime;
+ int     var_fault_inj_code;
+ char   *var_bounce_service;
+ char   *var_cleanup_service;
+@@ -276,6 +278,7 @@ char   *var_showq_service;
+ char   *var_error_service;
+ char   *var_flush_service;
+ char   *var_verify_service;
++char   *var_scache_service;
+ char   *var_trace_service;
+ char   *var_proxymap_service;
+ char   *var_proxywrite_service;
+diff --git a/src/global/mkmap_open.c b/src/global/mkmap_open.c
+index 69a0d57..eb8de71 100644
+--- a/src/global/mkmap_open.c
++++ b/src/global/mkmap_open.c
+@@ -81,7 +81,7 @@
+   * We use a different table (in dict_open.c) when querying maps.
+   */
+ typedef struct {
+-    char   *type;
++    const char   *type;
+     MKMAP  *(*before_open) (const char *);
+ } MKMAP_OPEN_INFO;
+ 
+@@ -156,7 +156,16 @@ MKMAP  *mkmap_open(const char *type, const char *path,
+      */
+     for (mp = mkmap_types; /* void */ ; mp++) {
+ 	if (mp->type == 0)
++#ifndef NO_DYNAMIC_MAPS
++	{
++	    static MKMAP_OPEN_INFO oi;
++	    oi.before_open=(MKMAP*(*)(const char*))dict_mkmap_func(type);
++	    oi.type=type;
++	    mp=&oi;
++	}
++#else
+ 	    msg_fatal("unsupported map type: %s", type);
++#endif
+ 	if (strcmp(type, mp->type) == 0)
+ 	    break;
+     }
+diff --git a/src/master/Makefile.in b/src/master/Makefile.in
+index 53f65bd..48ca35e 100644
+--- a/src/master/Makefile.in
++++ b/src/master/Makefile.in
+@@ -20,7 +20,7 @@ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
+ BIN_DIR	= ../../libexec
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) `for i in $(LIB_OBJ); do [ $$i = $@ ] && echo -fPIC; done` $(CFLAGS) -c $*.c
+ 
+ all:	$(PROG) $(LIB)
+ 
+@@ -39,12 +39,10 @@ tests:
+ root_tests:
+ 
+ $(LIB):	$(LIB_OBJ)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	gcc -shared -Wl,-soname,libpostfix-master.so.1 -o $(LIB) $(LIB_OBJ) $(LIBS) $(SYSLIBS)
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)/$(LIB)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+ $(BIN_DIR)/$(PROG): $(PROG)
+ 	 cp $(PROG) $(BIN_DIR)
+diff --git a/src/milter/Makefile.in b/src/milter/Makefile.in
+index c28263a..549b868 100644
+--- a/src/milter/Makefile.in
++++ b/src/milter/Makefile.in
+@@ -14,7 +14,7 @@ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
+ MAKES	=
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
+ 
+ all: $(LIB)
+ 
+@@ -30,12 +30,10 @@ tests:
+ root_tests:
+ 
+ $(LIB):	$(OBJS)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	 gcc -shared -Wl,-soname,libpostfix-milter.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+ update: $(LIB_DIR)/$(LIB) $(HDRS)
+ 	-for i in $(HDRS); \
+diff --git a/src/postconf/postconf.c b/src/postconf/postconf.c
+index d1ae434..dd604bb 100644
+--- a/src/postconf/postconf.c
++++ b/src/postconf/postconf.c
+@@ -965,6 +965,16 @@ static void show_maps(void)
+ {
+     ARGV   *maps_argv;
+     int     i;
++#ifndef NO_DYNAMIC_MAPS
++    char   *path;
++    char   *config_dir;
++
++    var_config_dir = mystrdup((config_dir = safe_getenv(CONF_ENV_PATH)) != 0 ?
++			      config_dir : DEF_CONFIG_DIR);	/* XXX */
++    path = concatenate(var_config_dir, "/", "dynamicmaps.cf", (char *) 0);
++    dict_open_dlinfo(path);
++    myfree(path);
++#endif
+ 
+     maps_argv = dict_mapnames();
+     for (i = 0; i < maps_argv->argc; i++)
+diff --git a/src/postmap/postmap.c b/src/postmap/postmap.c
+index e956aed..712d041 100644
+--- a/src/postmap/postmap.c
++++ b/src/postmap/postmap.c
+@@ -5,7 +5,7 @@
+ /*	Postfix lookup table management
+ /* SYNOPSIS
+ /* .fi
+-/*	\fBpostmap\fR [\fB-Nbfhimnoprsvw\fR] [\fB-c \fIconfig_dir\fR]
++/*	\fBpostmap\fR [\fB-Nbfhimnoprsuvw\fR] [\fB-c \fIconfig_dir\fR]
+ /*	[\fB-d \fIkey\fR] [\fB-q \fIkey\fR]
+ /*		[\fIfile_type\fR:]\fIfile_name\fR ...
+ /* DESCRIPTION
+@@ -151,6 +151,8 @@
+ /* .sp
+ /*	This feature is available in Postfix version 2.2 and later,
+ /*	and is not available for all database types.
++/* .IP \fB-u\fR
++/*     Upgrade the database to the current version.
+ /* .IP \fB-v\fR
+ /*	Enable verbose logging for debugging purposes. Multiple \fB-v\fR
+ /*	options make the software increasingly verbose.
+@@ -723,6 +725,18 @@ static void postmap_seq(const char *map_type, const char *map_name,
+     dict_close(dict);
+ }
+ 
++/* postmap_upgrade - upgrade a map */
++
++static int postmap_upgrade(const char *map_type, const char *map_name)
++{
++    DICT   *dict;
++
++    dict = dict_open3(map_type, map_name, O_RDWR,
++                       DICT_FLAG_LOCK|DICT_FLAG_UPGRADE);
++    dict_close(dict);
++    return (dict != 0);
++}
++
+ /* usage - explain */
+ 
+ static NORETURN usage(char *myname)
+@@ -743,6 +757,7 @@ int     main(int argc, char **argv)
+     int     postmap_flags = POSTMAP_FLAG_AS_OWNER | POSTMAP_FLAG_SAVE_PERM;
+     int     open_flags = O_RDWR | O_CREAT | O_TRUNC;
+     int     dict_flags = DICT_FLAG_DUP_WARN | DICT_FLAG_FOLD_FIX;
++    int     upgrade = 0;
+     char   *query = 0;
+     char   *delkey = 0;
+     int     sequence = 0;
+@@ -787,7 +802,7 @@ int     main(int argc, char **argv)
+     /*
+      * Parse JCL.
+      */
+-    while ((ch = GETOPT(argc, argv, "Nbc:d:fhimnopq:rsvw")) > 0) {
++    while ((ch = GETOPT(argc, argv, "Nbc:d:fhimnopq:rsuvw")) > 0) {
+ 	switch (ch) {
+ 	default:
+ 	    usage(argv[0]);
+@@ -804,8 +819,8 @@ int     main(int argc, char **argv)
+ 		msg_fatal("out of memory");
+ 	    break;
+ 	case 'd':
+-	    if (sequence || query || delkey)
+-		msg_fatal("specify only one of -s -q or -d");
++	    if (sequence || query || delkey || upgrade)
++		msg_fatal("specify only one of -s -q -u or -d");
+ 	    delkey = optarg;
+ 	    break;
+ 	case 'f':
+@@ -831,8 +846,8 @@ int     main(int argc, char **argv)
+ 	    postmap_flags &= ~POSTMAP_FLAG_SAVE_PERM;
+ 	    break;
+ 	case 'q':
+-	    if (sequence || query || delkey)
+-		msg_fatal("specify only one of -s -q or -d");
++	    if (sequence || query || delkey || upgrade)
++		msg_fatal("specify only one of -s -q -u or -d");
+ 	    query = optarg;
+ 	    break;
+ 	case 'r':
+@@ -840,10 +855,15 @@ int     main(int argc, char **argv)
+ 	    dict_flags |= DICT_FLAG_DUP_REPLACE;
+ 	    break;
+ 	case 's':
+-	    if (query || delkey)
+-		msg_fatal("specify only one of -s or -q or -d");
++	    if (query || delkey || upgrade)
++		msg_fatal("specify only one of -s or -q or -u or -d");
+ 	    sequence = 1;
+ 	    break;
++       case 'u':
++           if (sequence || query || delkey || upgrade)
++               msg_fatal("specify only one of -s -q -u or -d");
++           upgrade=1;
++           break;
+ 	case 'v':
+ 	    msg_verbose++;
+ 	    break;
+@@ -914,6 +934,21 @@ int     main(int argc, char **argv)
+ 	    exit(0);
+ 	}
+ 	exit(1);
++    } else if (upgrade) {                      /* Upgrade the map(s) */
++       int success = 1;
++       if (optind + 1 > argc)
++           usage(argv[0]);
++       while (optind < argc) {
++           if ((path_name = split_at(argv[optind], ':')) != 0) {
++               success &= postmap_upgrade(argv[optind], path_name);
++           } else {
++               success &= postmap_upgrade(var_db_type, path_name);
++           }
++           if (!success)
++               exit(1);
++           optind++;
++       }
++       exit(0);
+     } else {					/* create/update map(s) */
+ 	if (optind + 1 > argc)
+ 	    usage(argv[0]);
+diff --git a/src/tls/Makefile.in b/src/tls/Makefile.in
+index 1a8e26d..1f26fd8 100644
+--- a/src/tls/Makefile.in
++++ b/src/tls/Makefile.in
+@@ -22,7 +22,7 @@ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
+ MAKES	=
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
+ 
+ all: $(LIB)
+ 
+@@ -38,12 +38,10 @@ tests:
+ root_tests:
+ 
+ $(LIB):	$(OBJS)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	gcc -shared -Wl,-soname,libpostfix-tls.so.1 -o $(LIB) $(OBJS) $(LIBS) $(SYSLIBS)
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+ update: $(LIB_DIR)/$(LIB) $(HDRS)
+ 	-for i in $(HDRS); \
+diff --git a/src/util/Makefile.in b/src/util/Makefile.in
+index 653919c..21e918a 100644
+--- a/src/util/Makefile.in
++++ b/src/util/Makefile.in
+@@ -32,21 +32,22 @@ SRCS	= alldig.c allprint.c argv.c argv_split.c attr_clnt.c attr_print0.c \
+ 	write_buf.c write_wait.c sane_basename.c format_tv.c allspace.c \
+ 	allascii.c load_file.c killme_after.c vstream_tweak.c upass_connect.c \
+ 	upass_listen.c upass_trigger.c edit_file.c inet_windowsize.c \
+-	unix_pass_fd_fix.c dict_cache.c
++	unix_pass_fd_fix.c dict_cache.c load_lib.c
+ OBJS	= alldig.o allprint.o argv.o argv_split.o attr_clnt.o attr_print0.o \
+ 	attr_print64.o attr_print_plain.o attr_scan0.o attr_scan64.o \
+ 	attr_scan_plain.o auto_clnt.o base64_code.o basename.o binhash.o \
+ 	chroot_uid.o cidr_match.o clean_env.o close_on_exec.o concatenate.o \
+ 	ctable.o dict.o dict_alloc.o dict_cdb.o dict_cidr.o dict_db.o \
+ 	dict_dbm.o dict_debug.o dict_env.o dict_ht.o dict_ni.o dict_nis.o \
+-	dict_nisplus.o dict_open.o dict_pcre.o dict_regexp.o dict_sdbm.o \
+-	dict_static.o dict_tcp.o dict_unix.o dir_forest.o doze.o dummy_read.o \
++	dict_nisplus.o dict_open.o dict_regexp.o \
++	dict_static.o dict_unix.o dir_forest.o doze.o dummy_read.o \
+ 	dummy_write.o duplex_pipe.o environ.o events.o exec_command.o \
+ 	fifo_listen.o fifo_trigger.o file_limit.o find_inet.o fsspace.o \
+ 	fullname.o get_domainname.o get_hostname.o hex_code.o hex_quote.o \
+ 	host_port.o htable.o inet_addr_host.o inet_addr_list.o \
+ 	inet_addr_local.o inet_connect.o inet_listen.o inet_proto.o \
+ 	inet_trigger.o line_wrap.o lowercase.o lstat_as.o mac_expand.o \
++	load_lib.o \
+ 	mac_parse.o make_dirs.o mask_addr.o match_list.o match_ops.o msg.o \
+ 	msg_output.o msg_syslog.o msg_vstream.o mvect.o myaddrinfo.o myflock.o \
+ 	mymalloc.o myrand.o mystrtok.o name_code.o name_mask.o netstring.o \
+@@ -80,7 +81,7 @@ HDRS	= argv.h attr.h attr_clnt.h auto_clnt.h base64_code.h binhash.h \
+ 	msg_output.h msg_syslog.h msg_vstream.h mvect.h myaddrinfo.h myflock.h \
+ 	mymalloc.h myrand.h name_code.h name_mask.h netstring.h nvtable.h \
+ 	open_as.h open_lock.h percentm.h posix_signals.h readlline.h ring.h \
+-	safe.h safe_open.h sane_accept.h sane_connect.h sane_fsops.h \
++	safe.h safe_open.h sane_accept.h sane_connect.h sane_fsops.h load_lib.h \
+ 	sane_socketpair.h sane_time.h scan_dir.h set_eugid.h set_ugid.h \
+ 	sigdelay.h sock_addr.h spawn_command.h split_at.h stat_as.h \
+ 	stringops.h sys_defs.h timed_connect.h timed_wait.h trigger.h \
+@@ -93,6 +94,7 @@ DEFS	= -I. -D$(SYSTYPE)
+ CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
+ FILES	= Makefile $(SRCS) $(HDRS)
+ INCL	=
++PCRESO  = dict_pcre.so
+ LIB	= libutil.a
+ TESTPROG= dict_open dup2_pass_on_exec events exec_command fifo_open \
+ 	fifo_rdonly_bug fifo_rdwr_bug fifo_trigger fsspace fullname \
+@@ -108,10 +110,11 @@ TESTPROG= dict_open dup2_pass_on_exec events exec_command fifo_open \
+ 
+ LIB_DIR	= ../../lib
+ INC_DIR	= ../../include
++LIBS    = $(LIB_DIR)/$(LIB) $(PCRESO)
+ 
+-.c.o:;	$(CC) $(CFLAGS) -c $*.c
++.c.o:;	$(CC) -fPIC $(CFLAGS) -c $*.c
+ 
+-all: $(LIB)
++all: $(LIB) $(PCRESO)
+ 
+ $(OBJS): ../../conf/makedefs.out
+ 
+@@ -120,15 +123,19 @@ Makefile: Makefile.in
+ 
+ test:	$(TESTPROG)
+ 
++$(PCRESO): dict_pcre.o libutil.a
++	gcc -shared -Wl,-soname,dict_pcre.so -o $@ $? -lpcre -L. -lutil
++
+ $(LIB):	$(OBJS)
+-	$(AR) $(ARFL) $(LIB) $?
+-	$(RANLIB) $(LIB)
++	gcc -shared -Wl,-soname,libpostfix-util.so.1 -o $(LIB) $(OBJS) -ldl $(SYSLIBS)
+ 
+ $(LIB_DIR)/$(LIB): $(LIB)
+ 	cp $(LIB) $(LIB_DIR)
+-	$(RANLIB) $(LIB_DIR)/$(LIB)
+ 
+-update: $(LIB_DIR)/$(LIB) $(HDRS)
++../../libexec/$(PCRESO): $(PCRESO)
++	cp $(PCRESO) ../../libexec
++
++update: $(LIBS) ../../libexec/$(PCRESO) $(HDRS)
+ 	-for i in $(HDRS); \
+ 	do \
+ 	  cmp -s $$i $(INC_DIR)/$$i 2>/dev/null || cp $$i $(INC_DIR); \
+@@ -150,7 +157,8 @@ lint:
+ 	lint $(SRCS)
+ 
+ clean:
+-	rm -f *.o $(LIB) *core $(TESTPROG) junk $(MAKES) *.tmp
++	rm -f *.o $(LIB) $(PCRESO) *core $(TESTPROG) \
++		junk $(MAKES) *.tmp
+ 	rm -rf printfck
+ 
+ tidy:	clean
+diff --git a/src/util/dict.h b/src/util/dict.h
+index 9829d28..d7dc53c 100644
+--- a/src/util/dict.h
++++ b/src/util/dict.h
+@@ -66,6 +66,7 @@ extern DICT *dict_debug(DICT *);
+ #define DICT_FLAG_NO_UNAUTH	(1<<13)	/* disallow unauthenticated data */
+ #define DICT_FLAG_FOLD_FIX	(1<<14)	/* case-fold key with fixed-case map */
+ #define DICT_FLAG_FOLD_MUL	(1<<15)	/* case-fold key with multi-case map */
++#define DICT_FLAG_UPGRADE	(1<<30) /* Upgrade the db */
+ #define DICT_FLAG_FOLD_ANY	(DICT_FLAG_FOLD_FIX | DICT_FLAG_FOLD_MUL)
+ 
+  /* IMPORTANT: Update the dict_mask[] table when the above changes */
+@@ -138,6 +139,11 @@ extern const char *dict_eval(const char *, const char *, int);
+ extern DICT *dict_open(const char *, int, int);
+ extern DICT *dict_open3(const char *, const char *, int, int);
+ extern void dict_open_register(const char *, DICT *(*) (const char *, int, int));
++#ifndef NO_DYNAMIC_MAPS
++extern void dict_open_dlinfo(const char *path);
++typedef void* (*dict_mkmap_func_t)(const char *);
++dict_mkmap_func_t dict_mkmap_func(const char *dict_type);
++#endif
+ 
+ #define dict_get(dp, key)	((const char *) (dp)->lookup((dp), (key)))
+ #define dict_put(dp, key, val)	(dp)->update((dp), (key), (val))
+diff --git a/src/util/dict_db.c b/src/util/dict_db.c
+index e4b301d..8dc9c9d 100644
+--- a/src/util/dict_db.c
++++ b/src/util/dict_db.c
+@@ -675,6 +675,12 @@ static DICT *dict_db_open(const char *class, const char *path, int open_flags,
+ 	msg_fatal("set DB cache size %d: %m", dict_db_cache_size);
+     if (type == DB_HASH && db->set_h_nelem(db, DICT_DB_NELM) != 0)
+ 	msg_fatal("set DB hash element count %d: %m", DICT_DB_NELM);
++    if (dict_flags & DICT_FLAG_UPGRADE) {
++	if (msg_verbose)
++	    msg_info("upgrading database %s",db_path);
++	if ((errno = db->upgrade(db,db_path,0)) != 0)
++	    msg_fatal("upgrade of database %s: %m",db_path);
++    }
+ #if (DB_VERSION_MAJOR == 4 && DB_VERSION_MINOR > 0)
+     if ((errno = db->open(db, 0, db_path, 0, type, db_flags, 0644)) != 0)
+ 	msg_fatal("open database %s: %m", db_path);
+diff --git a/src/util/dict_dbm.c b/src/util/dict_dbm.c
+index 3603e44..adc5258 100644
+--- a/src/util/dict_dbm.c
++++ b/src/util/dict_dbm.c
+@@ -409,6 +409,10 @@ DICT   *dict_dbm_open(const char *path, int open_flags, int dict_flags)
+     char   *dbm_path;
+     int     lock_fd;
+ 
++#ifdef HAVE_GDBM
++    msg_fatal("%s: gdbm maps use locking that is incompatible with postfix.  Use a hash map instead.",
++		 path);
++#endif
+     /*
+      * Note: DICT_FLAG_LOCK is used only by programs that do fine-grained (in
+      * the time domain) locking while accessing individual database records.
+diff --git a/src/util/dict_open.c b/src/util/dict_open.c
+index b807bc2..0f4e382 100644
+--- a/src/util/dict_open.c
++++ b/src/util/dict_open.c
+@@ -44,6 +44,8 @@
+ /*	DICT	*(*open) (const char *, int, int);
+ /*
+ /*	ARGV	*dict_mapnames()
++/*
++/*	void (*)() dict_mkmap_func(const char *dict_type)
+ /* DESCRIPTION
+ /*	This module implements a low-level interface to multiple
+ /*	physical dictionary types.
+@@ -159,6 +161,9 @@
+ /*
+ /*	dict_mapnames() returns a sorted list with the names of all available
+ /*	dictionary types.
++/*
++/*	dict_mkmap_func() returns a pointer to the mkmap setup function
++/*	for the given map type, as given in /etc/dynamicmaps.cf
+ /* DIAGNOSTICS
+ /*	Fatal error: open error, unsupported dictionary type, attempt to
+ /*	update non-writable dictionary.
+@@ -183,6 +188,9 @@
+ #include <strings.h>
+ #endif
+ 
++#include <sys/stat.h>
++#include <unistd.h>
++
+ /* Utility library. */
+ 
+ #include <argv.h>
+@@ -208,6 +216,27 @@
+ #include <split_at.h>
+ #include <htable.h>
+ 
++#ifndef NO_DYNAMIC_MAPS
++#include <load_lib.h>
++#include <vstring.h>
++#include <vstream.h>
++#include <vstring_vstream.h>
++#include <mvect.h>
++
++ /*
++  * Interface for dynamic map loading.
++  */
++typedef struct {
++    const char  *pattern;
++    const char  *soname;
++    const char  *openfunc;
++    const char  *mkmapfunc;
++} DLINFO;
++
++static DLINFO *dict_dlinfo;
++static DLINFO *dict_open_dlfind(const char *type);
++#endif
++
+  /*
+   * lookup table for available map types.
+   */
+@@ -223,7 +252,9 @@ static const DICT_OPEN_INFO dict_open_info[] = {
+     DICT_TYPE_ENVIRON, dict_env_open,
+     DICT_TYPE_HT, dict_ht_open,
+     DICT_TYPE_UNIX, dict_unix_open,
++#ifdef NO_DYNAMIC_MAPS
+     DICT_TYPE_TCP, dict_tcp_open,
++#endif
+ #ifdef HAS_SDBM
+     DICT_TYPE_SDBM, dict_sdbm_open,
+ #endif
+@@ -243,9 +274,11 @@ static const DICT_OPEN_INFO dict_open_info[] = {
+ #ifdef HAS_NETINFO
+     DICT_TYPE_NETINFO, dict_ni_open,
+ #endif
++#ifdef NO_DYNAMIC_MAPS
+ #ifdef HAS_PCRE
+     DICT_TYPE_PCRE, dict_pcre_open,
+ #endif
++#endif /* NO_DYNAMIC_MAPS */
+ #ifdef HAS_POSIX_REGEXP
+     DICT_TYPE_REGEXP, dict_regexp_open,
+ #endif
+@@ -303,8 +336,31 @@ DICT   *dict_open3(const char *dict_type, const char *dict_name,
+ 		  dict_type, dict_name);
+     if (dict_open_hash == 0)
+ 	dict_open_init();
+-    if ((dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type)) == 0)
+-	msg_fatal("unsupported dictionary type: %s", dict_type);
++    if ((dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type)) == 0) {
++#ifdef NO_DYNAMIC_MAPS
++	msg_fatal("%s: unsupported dictionary type: %s", myname, dict_type);
++#else
++	struct stat st;
++	LIB_FN fn[2];
++	DICT *(*open) (const char *, int, int);
++	DLINFO *dl=dict_open_dlfind(dict_type);
++	if (!dl)
++	    msg_fatal("%s: unsupported dictionary type: %s:  Is the postfix-%s package installed?", myname, dict_type, dict_type);
++	if (stat(dl->soname,&st) < 0) {
++	    msg_fatal("%s: unsupported dictionary type: %s (%s not found.  Is the postfix-%s package installed?)",
++		myname, dict_type, dl->soname, dict_type);
++	}
++	fn[0].name = dl->openfunc;
++	fn[0].ptr  = (void**)&open;
++	fn[1].name = NULL;
++	load_library_symbols(dl->soname, fn, NULL);
++	dict_open_register(dict_type, open);
++	dp = (DICT_OPEN_INFO *) htable_find(dict_open_hash, dict_type);
++#endif
++    }
++    if (msg_verbose>1) {
++	msg_info("%s: calling %s open routine",myname,dict_type);
++    }
+     if ((dict = dp->open(dict_name, open_flags, dict_flags)) == 0)
+ 	msg_fatal("opening %s:%s %m", dict_type, dict_name);
+     if (msg_verbose)
+@@ -312,6 +368,36 @@ DICT   *dict_open3(const char *dict_type, const char *dict_name,
+     return (dict);
+ }
+ 
++dict_mkmap_func_t dict_mkmap_func(const char *dict_type)
++{
++    char   *myname="dict_mkmap_func";
++    struct stat st;
++    LIB_FN fn[2];
++    dict_mkmap_func_t mkmap;
++    DLINFO *dl;
++#ifndef NO_DYNAMIC_MAPS
++    if (!dict_dlinfo)
++	msg_fatal("dlinfo==NULL");
++    dl=dict_open_dlfind(dict_type);
++    if (!dl)
++	msg_fatal("%s: unsupported dictionary type: %s:  Is the postfix-%s package installed?", myname, dict_type, dict_type);
++    if (stat(dl->soname,&st) < 0) {
++	msg_fatal("%s: unsupported dictionary type: %s (%s not found.  Is the postfix-%s package installed?)",
++	    myname, dict_type, dl->soname, dict_type);
++    }
++    if (!dl->mkmapfunc)
++	msg_fatal("%s: unsupported dictionary type: %s does not allow map creation.", myname, dict_type);
++
++    fn[0].name = dl->mkmapfunc;
++    fn[0].ptr  = (void**)&mkmap;
++    fn[1].name = NULL;
++    load_library_symbols(dl->soname, fn, NULL);
++    return mkmap;
++#else
++    return (void(*)())NULL;
++#endif
++}
++
+ /* dict_open_register - register dictionary type */
+ 
+ void    dict_open_register(const char *type,
+@@ -345,6 +431,9 @@ ARGV   *dict_mapnames()
+     HTABLE_INFO **ht;
+     DICT_OPEN_INFO *dp;
+     ARGV   *mapnames;
++#ifndef NO_DYNAMIC_MAPS
++    DLINFO *dlp;
++#endif
+ 
+     if (dict_open_hash == 0)
+ 	dict_open_init();
+@@ -353,6 +442,13 @@ ARGV   *dict_mapnames()
+ 	dp = (DICT_OPEN_INFO *) ht[0]->value;
+ 	argv_add(mapnames, dp->type, ARGV_END);
+     }
++#ifndef NO_DYNAMIC_MAPS
++    if (!dict_dlinfo)
++	msg_fatal("dlinfo==NULL");
++    for (dlp=dict_dlinfo; dlp->pattern; dlp++) {
++	argv_add(mapnames, dlp->pattern, ARGV_END);
++    }
++#endif
+     qsort((void *) mapnames->argv, mapnames->argc, sizeof(mapnames->argv[0]),
+ 	  dict_sort_alpha_cpp);
+     myfree((char *) ht_info);
+@@ -360,6 +456,87 @@ ARGV   *dict_mapnames()
+     return mapnames;
+ }
+ 
++#ifndef NO_DYNAMIC_MAPS
++#define	STREQ(x,y) (x == y || (x[0] == y[0] && strcmp(x,y) == 0))
++
++void dict_open_dlinfo(const char *path)
++{
++    char    *myname="dict_open_dlinfo";
++    VSTREAM *conf_fp=vstream_fopen(path,O_RDONLY,0);
++    VSTRING *buf = vstring_alloc(100);
++    char    *cp;
++    ARGV    *argv;
++    MVECT    vector;
++    int      nelm=0;
++    int      linenum=0;
++
++    dict_dlinfo=(DLINFO*)mvect_alloc(&vector,sizeof(DLINFO),3,NULL,NULL);
++
++    if (!conf_fp) {
++	msg_warn("%s: cannot open %s.  No dynamic maps will be allowed.",
++		myname, path);
++    } else {
++	while (vstring_get_nonl(buf,conf_fp) != VSTREAM_EOF) {
++	    cp = vstring_str(buf);
++	    linenum++;
++	    if (*cp == '#' || *cp == '\0')
++		continue;
++	    argv = argv_split(cp, " \t");
++	    if (argv->argc != 3 && argv->argc != 4) {
++		msg_fatal("%s: Expected \"pattern .so-name open-function [mkmap-function]\" at line %d",
++			  myname, linenum);
++	    }
++	    if (STREQ(argv->argv[0],"*")) {
++		msg_warn("%s: wildcard dynamic map entry no longer supported.",
++			  myname);
++		continue;
++	    }
++	    if (argv->argv[1][0] != '/') {
++		msg_fatal("%s: .so name must begin with a \"/\" at line %d",
++			  myname, linenum);
++	    }
++	    if (nelm >= vector.nelm) {
++		dict_dlinfo=(DLINFO*)mvect_realloc(&vector,vector.nelm+3);
++	    }
++	    dict_dlinfo[nelm].pattern  = mystrdup(argv->argv[0]);
++	    dict_dlinfo[nelm].soname   = mystrdup(argv->argv[1]);
++	    dict_dlinfo[nelm].openfunc = mystrdup(argv->argv[2]);
++	    if (argv->argc==4)
++		dict_dlinfo[nelm].mkmapfunc = mystrdup(argv->argv[3]);
++	    else
++		dict_dlinfo[nelm].mkmapfunc = NULL;
++	    nelm++;
++	    argv_free(argv);
++	}
++    }
++    if (nelm >= vector.nelm) {
++	dict_dlinfo=(DLINFO*)mvect_realloc(&vector,vector.nelm+1);
++    }
++    dict_dlinfo[nelm].pattern  = NULL;
++    dict_dlinfo[nelm].soname   = NULL;
++    dict_dlinfo[nelm].openfunc = NULL;
++    dict_dlinfo[nelm].mkmapfunc = NULL;
++    if (conf_fp)
++	vstream_fclose(conf_fp);
++    vstring_free(buf);
++}
++
++static DLINFO *dict_open_dlfind(const char *type)
++{
++    DLINFO *dp;
++
++    if (!dict_dlinfo)
++	return NULL;
++
++    for (dp=dict_dlinfo; dp->pattern; dp++) {
++	if (STREQ(dp->pattern,type))
++	    return dp;
++    }
++    return NULL;
++}
++
++#endif /* !NO_DYNAMIC_MAPS */
++
+ #ifdef TEST
+ 
+  /*
+diff --git a/src/util/load_lib.c b/src/util/load_lib.c
+new file mode 100644
+index 0000000..b6526ef
+--- /dev/null
++++ b/src/util/load_lib.c
+@@ -0,0 +1,135 @@
++/*++
++/* NAME
++/*	load_lib 3
++/* SUMMARY
++/*	library loading wrappers
++/* SYNOPSIS
++/*	#include <load_lib.h>
++/*
++/*	extern int  load_library_symbols(const char *, LIB_FN *, LIB_FN *);
++/*	const char *libname;
++/*      LIB_FN     *libfuncs;
++/*      LIB_FN     *libdata;
++/*
++/* DESCRIPTION
++/*	This module loads functions from libraries, returnine pointers
++/*	to the named functions.
++/*
++/*	load_library_symbols() loads all of the desired functions, and
++/*	returns zero for success, or exits via msg_fatal().
++/*
++/* SEE ALSO
++/*	msg(3) diagnostics interface
++/* DIAGNOSTICS
++/*	Problems are reported via the msg(3) diagnostics routines:
++/*	library not found, symbols not found, other fatal errors.
++/* LICENSE
++/* .ad
++/* .fi
++/*	The Secure Mailer license must be distributed with this software.
++/* AUTHOR(S)
++/*	LaMont Jones
++/*	Hewlett-Packard Company
++/*	3404 Harmony Road
++/*	Fort Collins, CO 80528, USA
++/*
++/*	Wietse Venema
++/*	IBM T.J. Watson Research
++/*	P.O. Box 704
++/*	Yorktown Heights, NY 10598, USA
++/*--*/
++
++/* System libraries. */
++
++#include "sys_defs.h"
++#include <stdlib.h>
++#include <stddef.h>
++#include <string.h>
++#if defined(HAS_DLOPEN)
++#include <dlfcn.h>
++#elif defined(HAS_SHL_LOAD)
++#include <dl.h>
++#endif
++
++/* Application-specific. */
++
++#include "msg.h"
++#include "load_lib.h"
++
++extern int  load_library_symbols(const char * libname, LIB_FN * libfuncs, LIB_FN * libdata)
++{
++    char   *myname = "load_library_symbols";
++    LIB_FN *fn;
++
++#if defined(HAS_DLOPEN)
++    void   *handle;
++    char   *emsg;
++
++    handle=dlopen(libname,RTLD_NOW);
++    emsg=dlerror();
++    if (emsg) {
++	msg_fatal("%s: dlopen failure loading %s: %s", myname, libname, emsg);
++    }
++
++    if (libfuncs) {
++	for (fn=libfuncs; fn->name; fn++) {
++	    *(fn->ptr) = dlsym(handle,fn->name);
++	    emsg=dlerror();
++	    if (emsg) {
++		msg_fatal("%s: dlsym failure looking up %s in %s: %s", myname,
++			  fn->name, libname, emsg);
++	    }
++	    if (msg_verbose>1) {
++		msg_info("loaded %s = %lx",fn->name, *((long*)(fn->ptr)));
++	    }
++	}
++    }
++
++    if (libdata) {
++	for (fn=libdata; fn->name; fn++) {
++	    *(fn->ptr) = dlsym(handle,fn->name);
++	    emsg=dlerror();
++	    if (emsg) {
++		msg_fatal("%s: dlsym failure looking up %s in %s: %s", myname,
++			  fn->name, libname, emsg);
++	    }
++	    if (msg_verbose>1) {
++		msg_info("loaded %s = %lx",fn->name, *((long*)(fn->ptr)));
++	    }
++	}
++    }
++#elif defined(HAS_SHL_LOAD)
++    shl_t   handle;
++
++    handle = shl_load(libname,BIND_IMMEDIATE,0);
++
++    if (libfuncs) {
++	for (fn=libfuncs; fn->name; fn++) {
++	    if (shl_findsym(&handle,fn->name,TYPE_PROCEDURE,fn->ptr) != 0) {
++		msg_fatal("%s: shl_findsym failure looking up %s in %s: %m",
++			  myname, fn->name, libname);
++	    }
++	    if (msg_verbose>1) {
++		msg_info("loaded %s = %x",fn->name, *((long*)(fn->ptr)));
++	    }
++	}
++    }
++
++    if (libdata) {
++	for (fn=libdata; fn->name; fn++) {
++	    if (shl_findsym(&handle,fn->name,TYPE_DATA,fn->ptr) != 0) {
++		msg_fatal("%s: shl_findsym failure looking up %s in %s: %m",
++			  myname, fn->name, libname);
++	    }
++	    if (msg_verbose>1) {
++		msg_info("loaded %s = %x",fn->name, *((long*)(fn->ptr)));
++	    }
++	}
++    }
++
++#else
++    msg_fatal("%s: need dlopen or shl_load support for dynamic libraries",
++		myname);
++#endif
++    return 0;
++}
+diff --git a/src/util/load_lib.h b/src/util/load_lib.h
+new file mode 100644
+index 0000000..adebd25
+--- /dev/null
++++ b/src/util/load_lib.h
+@@ -0,0 +1,41 @@
++#ifndef _LOAD_LIB_H_INCLUDED_
++#define _LOAD_LIB_H_INCLUDED_
++
++/*++
++/* NAME
++/*	load_lib 3h
++/* SUMMARY
++/*	library loading wrappers
++/* SYNOPSIS
++/*	#include "load_lib.h"
++/* DESCRIPTION
++/* .nf
++
++ /*
++  * External interface.
++  */
++/* NULL name terminates list */
++typedef struct LIB_FN {
++    const char *name;
++    void       **ptr;
++} LIB_FN;
++
++extern int  load_library_symbols(const char *, LIB_FN *, LIB_FN *);
++
++/* LICENSE
++/* .ad
++/* .fi
++/*	The Secure Mailer license must be distributed with this software.
++/* AUTHOR(S)
++/*	LaMont Jones
++/*	Hewlett-Packard Company
++/*	3404 Harmony Road
++/*	Fort Collins, CO 80528, USA
++/*
++/*	Wietse Venema
++/*	IBM T.J. Watson Research
++/*	P.O. Box 704
++/*	Yorktown Heights, NY 10598, USA
++/*--*/
++
++#endif
-- 
cgit v1.2.3


From 4f6f25f4573ead961138da57abea8319bb6f8f01 Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Mon, 31 May 2010 15:08:19 +0000
Subject: main/xfce4-notes-plugin: upgrade to 1.7.4

---
 main/xfce4-notes-plugin/APKBUILD | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/main/xfce4-notes-plugin/APKBUILD b/main/xfce4-notes-plugin/APKBUILD
index 42e7ccd1..4c8870cd 100644
--- a/main/xfce4-notes-plugin/APKBUILD
+++ b/main/xfce4-notes-plugin/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: 
 # Maintainer: 
 pkgname=xfce4-notes-plugin
-pkgver=1.7.2
+pkgver=1.7.4
 pkgrel=0
 pkgdesc="Notes plugin for the Xfce4 desktop"
 url="http://goodies.xfce.org/projects/panel-plugins/xfce4-notes-plugin"
@@ -33,4 +33,4 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-md5sums="054742ecc4bb83de6c1447b023938d3e  xfce4-notes-plugin-1.7.2.tar.bz2"
+md5sums="47bd8d19d807a471d9d4d09db2ebafb6  xfce4-notes-plugin-1.7.4.tar.bz2"
-- 
cgit v1.2.3


From 8ccbbcf2593450a4b2a6c280af7070cba881dd7b Mon Sep 17 00:00:00 2001
From: Natanael Copa <ncopa@alpinelinux.org>
Date: Tue, 1 Jun 2010 08:49:12 +0000
Subject: main/alpine-conf: upgrade to 2.4

---
 main/alpine-conf/APKBUILD             | 11 ++++-------
 main/alpine-conf/setup-disk-fix.patch | 19 -------------------
 2 files changed, 4 insertions(+), 26 deletions(-)
 delete mode 100644 main/alpine-conf/setup-disk-fix.patch

diff --git a/main/alpine-conf/APKBUILD b/main/alpine-conf/APKBUILD
index 239a9f6a..64333a38 100644
--- a/main/alpine-conf/APKBUILD
+++ b/main/alpine-conf/APKBUILD
@@ -1,18 +1,16 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=alpine-conf
-pkgver=2.3
-pkgrel=1
+pkgver=2.4
+pkgrel=0
 pkgdesc="Alpine configuration management scripts"
 url=http://git.alpinelinux.org/cgit/$pkgname
 depends="openrc"
-source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2
-	setup-disk-fix.patch"
+source="http://git.alpinelinux.org/cgit/$pkgname/snapshot/$pkgname-$pkgver.tar.bz2"
 license="GPL-2"
 
 _builddir="$srcdir"/$pkgname-$pkgver
 prepare() {
 	cd "$_builddir"
-	patch -p1 -i "$srcdir"/setup-disk-fix.patch
 }
 
 build() {
@@ -27,5 +25,4 @@ package() {
 		ln -s lbu "$pkgdir"/sbin/lbu_$i
 	done
 }
-md5sums="9e7b7602a16fb64a10ded850c508d412  alpine-conf-2.3.tar.bz2
-27b009c1193e396ee145f59cd3844a2c  setup-disk-fix.patch"
+md5sums="4c8db8948a21b0435f577d1e0f8d7c8e  alpine-conf-2.4.tar.bz2"
diff --git a/main/alpine-conf/setup-disk-fix.patch b/main/alpine-conf/setup-disk-fix.patch
deleted file mode 100644
index 2fa7aec4..00000000
--- a/main/alpine-conf/setup-disk-fix.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-commit e149170d4736017c76b09625fa9a4b6a90b5e3a3
-Author: Natanael Copa <ncopa@alpinelinux.org>
-Date:   Wed May 26 13:59:25 2010 +0000
-
-    setup-disk: fix typo in the option handling
-
-diff --git a/setup-disk.in b/setup-disk.in
-index 7a485b8..aa4a92f 100644
---- a/setup-disk.in
-+++ b/setup-disk.in
-@@ -401,7 +401,7 @@ while getopts "hk:o:r" opt; do
- 		*) usage;;
- 	esac
- done
--shift $(( OPTIND - 1))
-+shift $(( $OPTIND - 1))
- 
- if [ -d "$1" ]; then
- 	# install to given mounted root
-- 
cgit v1.2.3


From c6c0b6f9dbde1244e7b31f74c703178a867e873f Mon Sep 17 00:00:00 2001
From: Mika Havela <mika.havela@gmail.com>
Date: Tue, 1 Jun 2010 08:53:33 +0000
Subject: main/perl-test-pod: Bumped version

---
 main/perl-test-pod/APKBUILD | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/main/perl-test-pod/APKBUILD b/main/perl-test-pod/APKBUILD
index 83e13d8f..65fc2adc 100644
--- a/main/perl-test-pod/APKBUILD
+++ b/main/perl-test-pod/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer:  Leonardo Arena <rnalrd@gmail.com>
 pkgname=perl-test-pod
 _realname=Test-Pod
-pkgver=1.26
+pkgver=1.44
 pkgrel=0
 pkgdesc="Check for POD errors in files"
 url="http://search.cpan.org/~petdance/Test-Pod-1.26/"
@@ -11,7 +11,7 @@ depends="perl"
 makedepends="perl-dev"
 install=
 subpackages="$pkgname-doc"
-source="http://search.cpan.org/CPAN/authors/id/P/PE/PETDANCE/$_realname-$pkgver.tar.gz"
+source="http://search.cpan.org/CPAN/authors/id/D/DW/DWHEELER/$_realname-$pkgver.tar.gz"
 
 build() {
 	cd "$srcdir/$_realname-$pkgver"
@@ -23,4 +23,4 @@ build() {
 	find "$pkgdir" -name perllocal.pod -delete
 }
 
-md5sums="2f259135656ac4549b65a4f14f07b7c6  Test-Pod-1.26.tar.gz"
+md5sums="02380af5539521524d5df17273a57ae7  Test-Pod-1.44.tar.gz"
-- 
cgit v1.2.3